Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-upstream

Conflicts:

	drivers/uwb/wlp/eda.c

64 files changed, 3801 insertions, 907 deletions

diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index 9b1f6ca100d1..0a08126d3094 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -6,7 +6,7 @@
 # To add a new book the only step required is to add the book to the
 # list of DOCBOOKS.
 
-DOCBOOKS := wanbook.xml z8530book.xml mcabook.xml \
+DOCBOOKS := z8530book.xml mcabook.xml \
             kernel-hacking.xml kernel-locking.xml deviceiobook.xml \
             procfs-guide.xml writing_usb_driver.xml networking.xml \
             kernel-api.xml filesystems.xml lsm.xml usb.xml kgdb.xml \
diff --git a/Documentation/DocBook/networking.tmpl b/Documentation/DocBook/networking.tmpl
index f24f9e85e4ae..627707a3cb9d 100644
--- a/Documentation/DocBook/networking.tmpl
+++ b/Documentation/DocBook/networking.tmpl
@@ -98,9 +98,6 @@
 X!Enet/core/wireless.c
      </sect1>
 -->
-     <sect1><title>Synchronous PPP</title>
-!Edrivers/net/wan/syncppp.c
-     </sect1>
   </chapter>
 
 </book>
diff --git a/Documentation/DocBook/wanbook.tmpl b/Documentation/DocBook/wanbook.tmpl
deleted file mode 100644
index 8c93db122f04..000000000000
--- a/Documentation/DocBook/wanbook.tmpl
+++ /dev/null
@@ -1,99 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
-        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
-
-<book id="WANGuide">
- <bookinfo>
-  <title>Synchronous PPP and Cisco HDLC Programming Guide</title>
-  
-  <authorgroup>
-   <author>
-    <firstname>Alan</firstname>
-    <surname>Cox</surname>
-    <affiliation>
-     <address>
-      <email>alan@lxorguk.ukuu.org.uk</email>
-     </address>
-    </affiliation>
-   </author>
-  </authorgroup>
-
-  <copyright>
-   <year>2000</year>
-   <holder>Alan Cox</holder>
-  </copyright>
-
-  <legalnotice>
-   <para>
-     This documentation is free software; you can redistribute
-     it and/or modify it under the terms of the GNU General Public
-     License as published by the Free Software Foundation; either
-     version 2 of the License, or (at your option) any later
-     version.
-   </para>
-      
-   <para>
-     This program is distributed in the hope that it will be
-     useful, but WITHOUT ANY WARRANTY; without even the implied
-     warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-     See the GNU General Public License for more details.
-   </para>
-      
-   <para>
-     You should have received a copy of the GNU General Public
-     License along with this program; if not, write to the Free
-     Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-     MA 02111-1307 USA
-   </para>
-      
-   <para>
-     For more details see the file COPYING in the source
-     distribution of Linux.
-   </para>
-  </legalnotice>
- </bookinfo>
-
-<toc></toc>
-
-  <chapter id="intro">
-      <title>Introduction</title>
-  <para>
-        The syncppp drivers in Linux provide a fairly complete 
-        implementation of Cisco HDLC and a minimal implementation of
-        PPP. The longer term goal is to switch the PPP layer to the
-        generic PPP interface that is new in Linux 2.3.x. The API should
-        remain unchanged when this is done, but support will then be
-        available for IPX, compression and other PPP features
-  </para>
-  </chapter>
-  <chapter id="bugs">
-     <title>Known Bugs And Assumptions</title>
-  <para>
-  <variablelist>
-    <varlistentry><term>PPP is minimal</term>
-    <listitem>
-    <para>
-        The current PPP implementation is very basic, although sufficient
-        for most wan usages.
-    </para>
-    </listitem></varlistentry>
-
-    <varlistentry><term>Cisco HDLC Quirks</term>
-    <listitem>
-    <para>
-        Currently we do not end all packets with the correct Cisco multicast
-        or unicast flags. Nothing appears to mind too much but this should
-        be corrected.
-    </para>
-    </listitem></varlistentry>
-  </variablelist>
-        
-  </para>
-  </chapter>
-
-  <chapter id="pubfunctions">
-     <title>Public Functions Provided</title>
-!Edrivers/net/wan/syncppp.c
-  </chapter>
-
-</book>
diff --git a/Documentation/RCU/00-INDEX b/Documentation/RCU/00-INDEX
index 461481dfb7c3..7dc0695a8f90 100644
--- a/Documentation/RCU/00-INDEX
+++ b/Documentation/RCU/00-INDEX
@@ -16,6 +16,8 @@ RTFP.txt
         - List of RCU papers (bibliography) going back to 1980.
 torture.txt
         - RCU Torture Test Operation (CONFIG_RCU_TORTURE_TEST)
+trace.txt
+        - CONFIG_RCU_TRACE debugfs files and formats
 UP.txt
         - RCU on Uniprocessor Systems
 whatisRCU.txt
diff --git a/Documentation/RCU/rculist_nulls.txt b/Documentation/RCU/rculist_nulls.txt
new file mode 100644
index 000000000000..239f542d48ba
--- /dev/null
+++ b/Documentation/RCU/rculist_nulls.txt
@@ -0,0 +1,167 @@
+Using hlist_nulls to protect read-mostly linked lists and
+objects using SLAB_DESTROY_BY_RCU allocations.
+
+Please read the basics in Documentation/RCU/listRCU.txt
+
+Using special makers (called 'nulls') is a convenient way
+to solve following problem :
+
+A typical RCU linked list managing objects which are
+allocated with SLAB_DESTROY_BY_RCU kmem_cache can
+use following algos :
+
+1) Lookup algo
+--------------
+rcu_read_lock()
+begin:
+obj = lockless_lookup(key);
+if (obj) {
+  if (!try_get_ref(obj)) // might fail for free objects
+    goto begin;
+  /*
+   * Because a writer could delete object, and a writer could
+   * reuse these object before the RCU grace period, we
+   * must check key after geting the reference on object
+   */
+  if (obj->key != key) { // not the object we expected
+     put_ref(obj);
+     goto begin;
+   }
+}
+rcu_read_unlock();
+
+Beware that lockless_lookup(key) cannot use traditional hlist_for_each_entry_rcu()
+but a version with an additional memory barrier (smp_rmb())
+
+lockless_lookup(key)
+{
+   struct hlist_node *node, *next;
+   for (pos = rcu_dereference((head)->first);
+          pos && ({ next = pos->next; smp_rmb(); prefetch(next); 1; }) &&
+          ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; });
+          pos = rcu_dereference(next))
+      if (obj->key == key)
+         return obj;
+   return NULL;
+
+And note the traditional hlist_for_each_entry_rcu() misses this smp_rmb() :
+
+   struct hlist_node *node;
+   for (pos = rcu_dereference((head)->first);
+                pos && ({ prefetch(pos->next); 1; }) &&
+                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; });
+                pos = rcu_dereference(pos->next))
+      if (obj->key == key)
+         return obj;
+   return NULL;
+}
+
+Quoting Corey Minyard :
+
+"If the object is moved from one list to another list in-between the
+ time the hash is calculated and the next field is accessed, and the
+ object has moved to the end of a new list, the traversal will not
+ complete properly on the list it should have, since the object will
+ be on the end of the new list and there's not a way to tell it's on a
+ new list and restart the list traversal.  I think that this can be
+ solved by pre-fetching the "next" field (with proper barriers) before
+ checking the key."
+
+2) Insert algo :
+----------------
+
+We need to make sure a reader cannot read the new 'obj->obj_next' value
+and previous value of 'obj->key'. Or else, an item could be deleted
+from a chain, and inserted into another chain. If new chain was empty
+before the move, 'next' pointer is NULL, and lockless reader can
+not detect it missed following items in original chain.
+
+/*
+ * Please note that new inserts are done at the head of list,
+ * not in the middle or end.
+ */
+obj = kmem_cache_alloc(...);
+lock_chain(); // typically a spin_lock()
+obj->key = key;
+atomic_inc(&obj->refcnt);
+/*
+ * we need to make sure obj->key is updated before obj->next
+ */
+smp_wmb();
+hlist_add_head_rcu(&obj->obj_node, list);
+unlock_chain(); // typically a spin_unlock()
+
+
+3) Remove algo
+--------------
+Nothing special here, we can use a standard RCU hlist deletion.
+But thanks to SLAB_DESTROY_BY_RCU, beware a deleted object can be reused
+very very fast (before the end of RCU grace period)
+
+if (put_last_reference_on(obj) {
+   lock_chain(); // typically a spin_lock()
+   hlist_del_init_rcu(&obj->obj_node);
+   unlock_chain(); // typically a spin_unlock()
+   kmem_cache_free(cachep, obj);
+}
+
+
+
+--------------------------------------------------------------------------
+With hlist_nulls we can avoid extra smp_rmb() in lockless_lookup()
+and extra smp_wmb() in insert function.
+
+For example, if we choose to store the slot number as the 'nulls'
+end-of-list marker for each slot of the hash table, we can detect
+a race (some writer did a delete and/or a move of an object
+to another chain) checking the final 'nulls' value if
+the lookup met the end of chain. If final 'nulls' value
+is not the slot number, then we must restart the lookup at
+the begining. If the object was moved to same chain,
+then the reader doesnt care : It might eventually
+scan the list again without harm.
+
+
+1) lookup algo
+
+ head = &table[slot];
+ rcu_read_lock();
+begin:
+ hlist_nulls_for_each_entry_rcu(obj, node, head, member) {
+   if (obj->key == key) {
+      if (!try_get_ref(obj)) // might fail for free objects
+         goto begin;
+      if (obj->key != key) { // not the object we expected
+         put_ref(obj);
+         goto begin;
+      }
+  goto out;
+ }
+/*
+ * if the nulls value we got at the end of this lookup is
+ * not the expected one, we must restart lookup.
+ * We probably met an item that was moved to another chain.
+ */
+ if (get_nulls_value(node) != slot)
+   goto begin;
+ obj = NULL;
+
+out:
+ rcu_read_unlock();
+
+2) Insert function :
+--------------------
+
+/*
+ * Please note that new inserts are done at the head of list,
+ * not in the middle or end.
+ */
+obj = kmem_cache_alloc(cachep);
+lock_chain(); // typically a spin_lock()
+obj->key = key;
+atomic_set(&obj->refcnt, 1);
+/*
+ * insert obj in RCU way (readers might be traversing chain)
+ */
+hlist_nulls_add_head_rcu(&obj->obj_node, list);
+unlock_chain(); // typically a spin_unlock()
diff --git a/Documentation/RCU/trace.txt b/Documentation/RCU/trace.txt
new file mode 100644
index 000000000000..068848240a8b
--- /dev/null
+++ b/Documentation/RCU/trace.txt
@@ -0,0 +1,413 @@
+CONFIG_RCU_TRACE debugfs Files and Formats
+
+
+The rcupreempt and rcutree implementations of RCU provide debugfs trace
+output that summarizes counters and state.  This information is useful for
+debugging RCU itself, and can sometimes also help to debug abuses of RCU.
+Note that the rcuclassic implementation of RCU does not provide debugfs
+trace output.
+
+The following sections describe the debugfs files and formats for
+preemptable RCU (rcupreempt) and hierarchical RCU (rcutree).
+
+
+Preemptable RCU debugfs Files and Formats
+
+This implementation of RCU provides three debugfs files under the
+top-level directory RCU: rcu/rcuctrs (which displays the per-CPU
+counters used by preemptable RCU) rcu/rcugp (which displays grace-period
+counters), and rcu/rcustats (which internal counters for debugging RCU).
+
+The output of "cat rcu/rcuctrs" looks as follows:
+
+CPU last cur F M
+  0    5  -5 0 0
+  1   -1   0 0 0
+  2    0   1 0 0
+  3    0   1 0 0
+  4    0   1 0 0
+  5    0   1 0 0
+  6    0   2 0 0
+  7    0  -1 0 0
+  8    0   1 0 0
+ggp = 26226, state = waitzero
+
+The per-CPU fields are as follows:
+
+o       "CPU" gives the CPU number.  Offline CPUs are not displayed.
+
+o       "last" gives the value of the counter that is being decremented
+        for the current grace period phase.  In the example above,
+        the counters sum to 4, indicating that there are still four
+        RCU read-side critical sections still running that started
+        before the last counter flip.
+
+o       "cur" gives the value of the counter that is currently being
+        both incremented (by rcu_read_lock()) and decremented (by
+        rcu_read_unlock()).  In the example above, the counters sum to
+        1, indicating that there is only one RCU read-side critical section
+        still running that started after the last counter flip.
+
+o       "F" indicates whether RCU is waiting for this CPU to acknowledge
+        a counter flip.  In the above example, RCU is not waiting on any,
+        which is consistent with the state being "waitzero" rather than
+        "waitack".
+
+o       "M" indicates whether RCU is waiting for this CPU to execute a
+        memory barrier.  In the above example, RCU is not waiting on any,
+        which is consistent with the state being "waitzero" rather than
+        "waitmb".
+
+o       "ggp" is the global grace-period counter.
+
+o       "state" is the RCU state, which can be one of the following:
+
+        o       "idle": there is no grace period in progress.
+
+        o       "waitack": RCU just incremented the global grace-period
+                counter, which has the effect of reversing the roles of
+                the "last" and "cur" counters above, and is waiting for
+                all the CPUs to acknowledge the flip.  Once the flip has
+                been acknowledged, CPUs will no longer be incrementing
+                what are now the "last" counters, so that their sum will
+                decrease monotonically down to zero.
+
+        o       "waitzero": RCU is waiting for the sum of the "last" counters
+                to decrease to zero.
+
+        o       "waitmb": RCU is waiting for each CPU to execute a memory
+                barrier, which ensures that instructions from a given CPU's
+                last RCU read-side critical section cannot be reordered
+                with instructions following the memory-barrier instruction.
+
+The output of "cat rcu/rcugp" looks as follows:
+
+oldggp=48870  newggp=48873
+
+Note that reading from this file provokes a synchronize_rcu().  The
+"oldggp" value is that of "ggp" from rcu/rcuctrs above, taken before
+executing the synchronize_rcu(), and the "newggp" value is also the
+"ggp" value, but taken after the synchronize_rcu() command returns.
+
+
+The output of "cat rcu/rcugp" looks as follows:
+
+na=1337955 nl=40 wa=1337915 wl=44 da=1337871 dl=0 dr=1337871 di=1337871
+1=50989 e1=6138 i1=49722 ie1=82 g1=49640 a1=315203 ae1=265563 a2=49640
+z1=1401244 ze1=1351605 z2=49639 m1=5661253 me1=5611614 m2=49639
+
+These are counters tracking internal preemptable-RCU events, however,
+some of them may be useful for debugging algorithms using RCU.  In
+particular, the "nl", "wl", and "dl" values track the number of RCU
+callbacks in various states.  The fields are as follows:
+
+o       "na" is the total number of RCU callbacks that have been enqueued
+        since boot.
+
+o       "nl" is the number of RCU callbacks waiting for the previous
+        grace period to end so that they can start waiting on the next
+        grace period.
+
+o       "wa" is the total number of RCU callbacks that have started waiting
+        for a grace period since boot.  "na" should be roughly equal to
+        "nl" plus "wa".
+
+o       "wl" is the number of RCU callbacks currently waiting for their
+        grace period to end.
+
+o       "da" is the total number of RCU callbacks whose grace periods
+        have completed since boot.  "wa" should be roughly equal to
+        "wl" plus "da".
+
+o       "dr" is the total number of RCU callbacks that have been removed
+        from the list of callbacks ready to invoke.  "dr" should be roughly
+        equal to "da".
+
+o       "di" is the total number of RCU callbacks that have been invoked
+        since boot.  "di" should be roughly equal to "da", though some
+        early versions of preemptable RCU had a bug so that only the
+        last CPU's count of invocations was displayed, rather than the
+        sum of all CPU's counts.
+
+o       "1" is the number of calls to rcu_try_flip().  This should be
+        roughly equal to the sum of "e1", "i1", "a1", "z1", and "m1"
+        described below.  In other words, the number of times that
+        the state machine is visited should be equal to the sum of the
+        number of times that each state is visited plus the number of
+        times that the state-machine lock acquisition failed.
+
+o       "e1" is the number of times that rcu_try_flip() was unable to
+        acquire the fliplock.
+
+o       "i1" is the number of calls to rcu_try_flip_idle().
+
+o       "ie1" is the number of times rcu_try_flip_idle() exited early
+        due to the calling CPU having no work for RCU.
+
+o       "g1" is the number of times that rcu_try_flip_idle() decided
+        to start a new grace period.  "i1" should be roughly equal to
+        "ie1" plus "g1".
+
+o       "a1" is the number of calls to rcu_try_flip_waitack().
+
+o       "ae1" is the number of times that rcu_try_flip_waitack() found
+        that at least one CPU had not yet acknowledge the new grace period
+        (AKA "counter flip").
+
+o       "a2" is the number of time rcu_try_flip_waitack() found that
+        all CPUs had acknowledged.  "a1" should be roughly equal to
+        "ae1" plus "a2".  (This particular output was collected on
+        a 128-CPU machine, hence the smaller-than-usual fraction of
+        calls to rcu_try_flip_waitack() finding all CPUs having already
+        acknowledged.)
+
+o       "z1" is the number of calls to rcu_try_flip_waitzero().
+
+o       "ze1" is the number of times that rcu_try_flip_waitzero() found
+        that not all of the old RCU read-side critical sections had
+        completed.
+
+o       "z2" is the number of times that rcu_try_flip_waitzero() finds
+        the sum of the counters equal to zero, in other words, that
+        all of the old RCU read-side critical sections had completed.
+        The value of "z1" should be roughly equal to "ze1" plus
+        "z2".
+
+o       "m1" is the number of calls to rcu_try_flip_waitmb().
+
+o       "me1" is the number of times that rcu_try_flip_waitmb() finds
+        that at least one CPU has not yet executed a memory barrier.
+
+o       "m2" is the number of times that rcu_try_flip_waitmb() finds that
+        all CPUs have executed a memory barrier.
+
+
+Hierarchical RCU debugfs Files and Formats
+
+This implementation of RCU provides three debugfs files under the
+top-level directory RCU: rcu/rcudata (which displays fields in struct
+rcu_data), rcu/rcugp (which displays grace-period counters), and
+rcu/rcuhier (which displays the struct rcu_node hierarchy).
+
+The output of "cat rcu/rcudata" looks as follows:
+
+rcu:
+  0 c=4011 g=4012 pq=1 pqc=4011 qp=0 rpfq=1 rp=3c2a dt=23301/73 dn=2 df=1882 of=0 ri=2126 ql=2 b=10
+  1 c=4011 g=4012 pq=1 pqc=4011 qp=0 rpfq=3 rp=39a6 dt=78073/1 dn=2 df=1402 of=0 ri=1875 ql=46 b=10
+  2 c=4010 g=4010 pq=1 pqc=4010 qp=0 rpfq=-5 rp=1d12 dt=16646/0 dn=2 df=3140 of=0 ri=2080 ql=0 b=10
+  3 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=2b50 dt=21159/1 dn=2 df=2230 of=0 ri=1923 ql=72 b=10
+  4 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=1644 dt=5783/1 dn=2 df=3348 of=0 ri=2805 ql=7 b=10
+  5 c=4012 g=4013 pq=0 pqc=4011 qp=1 rpfq=3 rp=1aac dt=5879/1 dn=2 df=3140 of=0 ri=2066 ql=10 b=10
+  6 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=ed8 dt=5847/1 dn=2 df=3797 of=0 ri=1266 ql=10 b=10
+  7 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=1fa2 dt=6199/1 dn=2 df=2795 of=0 ri=2162 ql=28 b=10
+rcu_bh:
+  0 c=-268 g=-268 pq=1 pqc=-268 qp=0 rpfq=-145 rp=21d6 dt=23301/73 dn=2 df=0 of=0 ri=0 ql=0 b=10
+  1 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-170 rp=20ce dt=78073/1 dn=2 df=26 of=0 ri=5 ql=0 b=10
+  2 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-83 rp=fbd dt=16646/0 dn=2 df=28 of=0 ri=4 ql=0 b=10
+  3 c=-268 g=-268 pq=1 pqc=-268 qp=0 rpfq=-105 rp=178c dt=21159/1 dn=2 df=28 of=0 ri=2 ql=0 b=10
+  4 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-30 rp=b54 dt=5783/1 dn=2 df=32 of=0 ri=0 ql=0 b=10
+  5 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-29 rp=df5 dt=5879/1 dn=2 df=30 of=0 ri=3 ql=0 b=10
+  6 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-28 rp=788 dt=5847/1 dn=2 df=32 of=0 ri=0 ql=0 b=10
+  7 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-53 rp=1098 dt=6199/1 dn=2 df=30 of=0 ri=3 ql=0 b=10
+
+The first section lists the rcu_data structures for rcu, the second for
+rcu_bh.  Each section has one line per CPU, or eight for this 8-CPU system.
+The fields are as follows:
+
+o       The number at the beginning of each line is the CPU number.
+        CPUs numbers followed by an exclamation mark are offline,
+        but have been online at least once since boot.  There will be
+        no output for CPUs that have never been online, which can be
+        a good thing in the surprisingly common case where NR_CPUS is
+        substantially larger than the number of actual CPUs.
+
+o       "c" is the count of grace periods that this CPU believes have
+        completed.  CPUs in dynticks idle mode may lag quite a ways
+        behind, for example, CPU 4 under "rcu" above, which has slept
+        through the past 25 RCU grace periods.  It is not unusual to
+        see CPUs lagging by thousands of grace periods.
+
+o       "g" is the count of grace periods that this CPU believes have
+        started.  Again, CPUs in dynticks idle mode may lag behind.
+        If the "c" and "g" values are equal, this CPU has already
+        reported a quiescent state for the last RCU grace period that
+        it is aware of, otherwise, the CPU believes that it owes RCU a
+        quiescent state.
+
+o       "pq" indicates that this CPU has passed through a quiescent state
+        for the current grace period.  It is possible for "pq" to be
+        "1" and "c" different than "g", which indicates that although
+        the CPU has passed through a quiescent state, either (1) this
+        CPU has not yet reported that fact, (2) some other CPU has not
+        yet reported for this grace period, or (3) both.
+
+o       "pqc" indicates which grace period the last-observed quiescent
+        state for this CPU corresponds to.  This is important for handling
+        the race between CPU 0 reporting an extended dynticks-idle
+        quiescent state for CPU 1 and CPU 1 suddenly waking up and
+        reporting its own quiescent state.  If CPU 1 was the last CPU
+        for the current grace period, then the CPU that loses this race
+        will attempt to incorrectly mark CPU 1 as having checked in for
+        the next grace period!
+
+o       "qp" indicates that RCU still expects a quiescent state from
+        this CPU.
+
+o       "rpfq" is the number of rcu_pending() calls on this CPU required
+        to induce this CPU to invoke force_quiescent_state().
+
+o       "rp" is low-order four hex digits of the count of how many times
+        rcu_pending() has been invoked on this CPU.
+
+o       "dt" is the current value of the dyntick counter that is incremented
+        when entering or leaving dynticks idle state, either by the
+        scheduler or by irq.  The number after the "/" is the interrupt
+        nesting depth when in dyntick-idle state, or one greater than
+        the interrupt-nesting depth otherwise.
+
+        This field is displayed only for CONFIG_NO_HZ kernels.
+
+o       "dn" is the current value of the dyntick counter that is incremented
+        when entering or leaving dynticks idle state via NMI.  If both
+        the "dt" and "dn" values are even, then this CPU is in dynticks
+        idle mode and may be ignored by RCU.  If either of these two
+        counters is odd, then RCU must be alert to the possibility of
+        an RCU read-side critical section running on this CPU.
+
+        This field is displayed only for CONFIG_NO_HZ kernels.
+
+o       "df" is the number of times that some other CPU has forced a
+        quiescent state on behalf of this CPU due to this CPU being in
+        dynticks-idle state.
+
+        This field is displayed only for CONFIG_NO_HZ kernels.
+
+o       "of" is the number of times that some other CPU has forced a
+        quiescent state on behalf of this CPU due to this CPU being
+        offline.  In a perfect world, this might neve happen, but it
+        turns out that offlining and onlining a CPU can take several grace
+        periods, and so there is likely to be an extended period of time
+        when RCU believes that the CPU is online when it really is not.
+        Please note that erring in the other direction (RCU believing a
+        CPU is offline when it is really alive and kicking) is a fatal
+        error, so it makes sense to err conservatively.
+
+o       "ri" is the number of times that RCU has seen fit to send a
+        reschedule IPI to this CPU in order to get it to report a
+        quiescent state.
+
+o       "ql" is the number of RCU callbacks currently residing on
+        this CPU.  This is the total number of callbacks, regardless
+        of what state they are in (new, waiting for grace period to
+        start, waiting for grace period to end, ready to invoke).
+
+o       "b" is the batch limit for this CPU.  If more than this number
+        of RCU callbacks is ready to invoke, then the remainder will
+        be deferred.
+
+
+The output of "cat rcu/rcugp" looks as follows:
+
+rcu: completed=33062  gpnum=33063
+rcu_bh: completed=464  gpnum=464
+
+Again, this output is for both "rcu" and "rcu_bh".  The fields are
+taken from the rcu_state structure, and are as follows:
+
+o       "completed" is the number of grace periods that have completed.
+        It is comparable to the "c" field from rcu/rcudata in that a
+        CPU whose "c" field matches the value of "completed" is aware
+        that the corresponding RCU grace period has completed.
+
+o       "gpnum" is the number of grace periods that have started.  It is
+        comparable to the "g" field from rcu/rcudata in that a CPU
+        whose "g" field matches the value of "gpnum" is aware that the
+        corresponding RCU grace period has started.
+
+        If these two fields are equal (as they are for "rcu_bh" above),
+        then there is no grace period in progress, in other words, RCU
+        is idle.  On the other hand, if the two fields differ (as they
+        do for "rcu" above), then an RCU grace period is in progress.
+
+
+The output of "cat rcu/rcuhier" looks as follows, with very long lines:
+
+c=6902 g=6903 s=2 jfq=3 j=72c7 nfqs=13142/nfqsng=0(13142) fqlh=6
+1/1 0:127 ^0    
+3/3 0:35 ^0    0/0 36:71 ^1    0/0 72:107 ^2    0/0 108:127 ^3    
+3/3f 0:5 ^0    2/3 6:11 ^1    0/0 12:17 ^2    0/0 18:23 ^3    0/0 24:29 ^4    0/0 30:35 ^5    0/0 36:41 ^0    0/0 42:47 ^1    0/0 48:53 ^2    0/0 54:59 ^3    0/0 60:65 ^4    0/0 66:71 ^5    0/0 72:77 ^0    0/0 78:83 ^1    0/0 84:89 ^2    0/0 90:95 ^3    0/0 96:101 ^4    0/0 102:107 ^5    0/0 108:113 ^0    0/0 114:119 ^1    0/0 120:125 ^2    0/0 126:127 ^3    
+rcu_bh:
+c=-226 g=-226 s=1 jfq=-5701 j=72c7 nfqs=88/nfqsng=0(88) fqlh=0
+0/1 0:127 ^0    
+0/3 0:35 ^0    0/0 36:71 ^1    0/0 72:107 ^2    0/0 108:127 ^3    
+0/3f 0:5 ^0    0/3 6:11 ^1    0/0 12:17 ^2    0/0 18:23 ^3    0/0 24:29 ^4    0/0 30:35 ^5    0/0 36:41 ^0    0/0 42:47 ^1    0/0 48:53 ^2    0/0 54:59 ^3    0/0 60:65 ^4    0/0 66:71 ^5    0/0 72:77 ^0    0/0 78:83 ^1    0/0 84:89 ^2    0/0 90:95 ^3    0/0 96:101 ^4    0/0 102:107 ^5    0/0 108:113 ^0    0/0 114:119 ^1    0/0 120:125 ^2    0/0 126:127 ^3
+
+This is once again split into "rcu" and "rcu_bh" portions.  The fields are
+as follows:
+
+o       "c" is exactly the same as "completed" under rcu/rcugp.
+
+o       "g" is exactly the same as "gpnum" under rcu/rcugp.
+
+o       "s" is the "signaled" state that drives force_quiescent_state()'s
+        state machine.
+
+o       "jfq" is the number of jiffies remaining for this grace period
+        before force_quiescent_state() is invoked to help push things
+        along.  Note that CPUs in dyntick-idle mode thoughout the grace
+        period will not report on their own, but rather must be check by
+        some other CPU via force_quiescent_state().
+
+o       "j" is the low-order four hex digits of the jiffies counter.
+        Yes, Paul did run into a number of problems that turned out to
+        be due to the jiffies counter no longer counting.  Why do you ask?
+
+o       "nfqs" is the number of calls to force_quiescent_state() since
+        boot.
+
+o       "nfqsng" is the number of useless calls to force_quiescent_state(),
+        where there wasn't actually a grace period active.  This can
+        happen due to races.  The number in parentheses is the difference
+        between "nfqs" and "nfqsng", or the number of times that
+        force_quiescent_state() actually did some real work.
+
+o       "fqlh" is the number of calls to force_quiescent_state() that
+        exited immediately (without even being counted in nfqs above)
+        due to contention on ->fqslock.
+
+o       Each element of the form "1/1 0:127 ^0" represents one struct
+        rcu_node.  Each line represents one level of the hierarchy, from
+        root to leaves.  It is best to think of the rcu_data structures
+        as forming yet another level after the leaves.  Note that there
+        might be either one, two, or three levels of rcu_node structures,
+        depending on the relationship between CONFIG_RCU_FANOUT and
+        CONFIG_NR_CPUS.
+        
+        o       The numbers separated by the "/" are the qsmask followed
+                by the qsmaskinit.  The qsmask will have one bit
+                set for each entity in the next lower level that
+                has not yet checked in for the current grace period.
+                The qsmaskinit will have one bit for each entity that is
+                currently expected to check in during each grace period.
+                The value of qsmaskinit is assigned to that of qsmask
+                at the beginning of each grace period.
+
+                For example, for "rcu", the qsmask of the first entry
+                of the lowest level is 0x14, meaning that we are still
+                waiting for CPUs 2 and 4 to check in for the current
+                grace period.
+
+        o       The numbers separated by the ":" are the range of CPUs
+                served by this struct rcu_node.  This can be helpful
+                in working out how the hierarchy is wired together.
+
+                For example, the first entry at the lowest level shows
+                "0:5", indicating that it covers CPUs 0 through 5.
+
+        o       The number after the "^" indicates the bit in the
+                next higher level rcu_node structure that this
+                rcu_node structure corresponds to.
+
+                For example, the first entry at the lowest level shows
+                "^0", indicating that it corresponds to bit zero in
+                the first entry at the middle level.
diff --git a/Documentation/arm/mem_alignment b/Documentation/arm/mem_alignment
index d145ccca169a..c7c7a114c78c 100644
--- a/Documentation/arm/mem_alignment
+++ b/Documentation/arm/mem_alignment
@@ -24,7 +24,7 @@ real bad - it changes the behaviour of all unaligned instructions in user
 space, and might cause programs to fail unexpectedly.
 
 To change the alignment trap behavior, simply echo a number into
-/proc/sys/debug/alignment.  The number is made up from various bits:
+/proc/cpu/alignment.  The number is made up from various bits:
 
 bit             behavior when set
 ---             -----------------
diff --git a/Documentation/arm/pxa/mfp.txt b/Documentation/arm/pxa/mfp.txt
new file mode 100644
index 000000000000..a179e5bc02c9
--- /dev/null
+++ b/Documentation/arm/pxa/mfp.txt
@@ -0,0 +1,286 @@
+                 MFP Configuration for PXA2xx/PXA3xx Processors
+
+                        Eric Miao <eric.miao@marvell.com>
+
+MFP stands for Multi-Function Pin, which is the pin-mux logic on PXA3xx and
+later PXA series processors.  This document describes the existing MFP API,
+and how board/platform driver authors could make use of it.
+
+ Basic Concept
+===============
+
+Unlike the GPIO alternate function settings on PXA25x and PXA27x, a new MFP
+mechanism is introduced from PXA3xx to completely move the pin-mux functions
+out of the GPIO controller. In addition to pin-mux configurations, the MFP
+also controls the low power state, driving strength, pull-up/down and event
+detection of each pin.  Below is a diagram of internal connections between
+the MFP logic and the remaining SoC peripherals:
+
+ +--------+
+ |        |--(GPIO19)--+
+ |  GPIO  |            |
+ |        |--(GPIO...) |
+ +--------+            |
+                       |       +---------+
+ +--------+            +------>|         |
+ |  PWM2  |--(PWM_OUT)-------->|   MFP   |
+ +--------+            +------>|         |-------> to external PAD
+                       | +---->|         |
+ +--------+            | | +-->|         |
+ |  SSP2  |---(TXD)----+ | |   +---------+
+ +--------+              | |
+                         | |
+ +--------+              | |
+ | Keypad |--(MKOUT4)----+ |
+ +--------+                |
+                           |
+ +--------+                |
+ |  UART2 |---(TXD)--------+
+ +--------+
+
+NOTE: the external pad is named as MFP_PIN_GPIO19, it doesn't necessarily
+mean it's dedicated for GPIO19, only as a hint that internally this pin
+can be routed from GPIO19 of the GPIO controller.
+
+To better understand the change from PXA25x/PXA27x GPIO alternate function
+to this new MFP mechanism, here are several key points:
+
+  1. GPIO controller on PXA3xx is now a dedicated controller, same as other
+     internal controllers like PWM, SSP and UART, with 128 internal signals
+     which can be routed to external through one or more MFPs (e.g. GPIO<0>
+     can be routed through either MFP_PIN_GPIO0 as well as MFP_PIN_GPIO0_2,
+     see arch/arm/mach-pxa/mach/include/mfp-pxa300.h)
+
+  2. Alternate function configuration is removed from this GPIO controller,
+     the remaining functions are pure GPIO-specific, i.e.
+
+       - GPIO signal level control
+       - GPIO direction control
+       - GPIO level change detection
+
+  3. Low power state for each pin is now controlled by MFP, this means the
+     PGSRx registers on PXA2xx are now useless on PXA3xx
+
+  4. Wakeup detection is now controlled by MFP, PWER does not control the
+     wakeup from GPIO(s) any more, depending on the sleeping state, ADxER
+     (as defined in pxa3xx-regs.h) controls the wakeup from MFP
+
+NOTE: with such a clear separation of MFP and GPIO, by GPIO<xx> we normally
+mean it is a GPIO signal, and by MFP<xxx> or pin xxx, we mean a physical
+pad (or ball).
+
+ MFP API Usage
+===============
+
+For board code writers, here are some guidelines:
+
+1. include ONE of the following header files in your <board>.c:
+
+   - #include <mach/mfp-pxa25x.h>
+   - #include <mach/mfp-pxa27x.h>
+   - #include <mach/mfp-pxa300.h>
+   - #include <mach/mfp-pxa320.h>
+   - #include <mach/mfp-pxa930.h>
+
+   NOTE: only one file in your <board>.c, depending on the processors used,
+   because pin configuration definitions may conflict in these file (i.e.
+   same name, different meaning and settings on different processors). E.g.
+   for zylonite platform, which support both PXA300/PXA310 and PXA320, two
+   separate files are introduced: zylonite_pxa300.c and zylonite_pxa320.c
+   (in addition to handle MFP configuration differences, they also handle
+   the other differences between the two combinations).
+
+   NOTE: PXA300 and PXA310 are almost identical in pin configurations (with
+   PXA310 supporting some additional ones), thus the difference is actually
+   covered in a single mfp-pxa300.h.
+
+2. prepare an array for the initial pin configurations, e.g.:
+
+   static unsigned long mainstone_pin_config[] __initdata = {
+        /* Chip Select */
+        GPIO15_nCS_1,
+
+        /* LCD - 16bpp Active TFT */
+        GPIOxx_TFT_LCD_16BPP,
+        GPIO16_PWM0_OUT,        /* Backlight */
+
+        /* MMC */
+        GPIO32_MMC_CLK,
+        GPIO112_MMC_CMD,
+        GPIO92_MMC_DAT_0,
+        GPIO109_MMC_DAT_1,
+        GPIO110_MMC_DAT_2,
+        GPIO111_MMC_DAT_3,
+
+        ...
+
+        /* GPIO */
+        GPIO1_GPIO | WAKEUP_ON_EDGE_BOTH,
+   };
+
+   a) once the pin configurations are passed to pxa{2xx,3xx}_mfp_config(),
+   and written to the actual registers, they are useless and may discard,
+   adding '__initdata' will help save some additional bytes here.
+
+   b) when there is only one possible pin configurations for a component,
+   some simplified definitions can be used, e.g. GPIOxx_TFT_LCD_16BPP on
+   PXA25x and PXA27x processors
+
+   c) if by board design, a pin can be configured to wake up the system
+   from low power state, it can be 'OR'ed with any of:
+
+      WAKEUP_ON_EDGE_BOTH
+      WAKEUP_ON_EDGE_RISE
+      WAKEUP_ON_EDGE_FALL
+      WAKEUP_ON_LEVEL_HIGH - specifically for enabling of keypad GPIOs,
+
+   to indicate that this pin has the capability of wake-up the system,
+   and on which edge(s). This, however, doesn't necessarily mean the
+   pin _will_ wakeup the system, it will only when set_irq_wake() is
+   invoked with the corresponding GPIO IRQ (GPIO_IRQ(xx) or gpio_to_irq())
+   and eventually calls gpio_set_wake() for the actual register setting.
+
+   d) although PXA3xx MFP supports edge detection on each pin, the
+   internal logic will only wakeup the system when those specific bits
+   in ADxER registers are set, which can be well mapped to the
+   corresponding peripheral, thus set_irq_wake() can be called with 
+   the peripheral IRQ to enable the wakeup.
+
+
+ MFP on PXA3xx
+===============
+
+Every external I/O pad on PXA3xx (excluding those for special purpose) has
+one MFP logic associated, and is controlled by one MFP register (MFPR).
+
+The MFPR has the following bit definitions (for PXA300/PXA310/PXA320):
+
+ 31                        16 15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
+  +-------------------------+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+  |         RESERVED        |PS|PU|PD|  DRIVE |SS|SD|SO|EC|EF|ER|--| AF_SEL |
+  +-------------------------+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+
+  Bit 3:   RESERVED
+  Bit 4:   EDGE_RISE_EN - enable detection of rising edge on this pin
+  Bit 5:   EDGE_FALL_EN - enable detection of falling edge on this pin
+  Bit 6:   EDGE_CLEAR   - disable edge detection on this pin
+  Bit 7:   SLEEP_OE_N   - enable outputs during low power modes
+  Bit 8:   SLEEP_DATA   - output data on the pin during low power modes
+  Bit 9:   SLEEP_SEL    - selection control for low power modes signals
+  Bit 13:  PULLDOWN_EN  - enable the internal pull-down resistor on this pin
+  Bit 14:  PULLUP_EN    - enable the internal pull-up resistor on this pin
+  Bit 15:  PULL_SEL     - pull state controlled by selected alternate function
+                          (0) or by PULL{UP,DOWN}_EN bits (1)
+
+  Bit 0 - 2: AF_SEL - alternate function selection, 8 possibilities, from 0-7
+  Bit 10-12: DRIVE  - drive strength and slew rate
+                        0b000 - fast 1mA
+                        0b001 - fast 2mA
+                        0b002 - fast 3mA
+                        0b003 - fast 4mA
+                        0b004 - slow 6mA
+                        0b005 - fast 6mA
+                        0b006 - slow 10mA
+                        0b007 - fast 10mA
+
+ MFP Design for PXA2xx/PXA3xx
+==============================
+
+Due to the difference of pin-mux handling between PXA2xx and PXA3xx, a unified
+MFP API is introduced to cover both series of processors.
+
+The basic idea of this design is to introduce definitions for all possible pin
+configurations, these definitions are processor and platform independent, and
+the actual API invoked to convert these definitions into register settings and
+make them effective there-after.
+
+  Files Involved
+  --------------
+
+  - arch/arm/mach-pxa/include/mach/mfp.h
+  
+  for
+    1. Unified pin definitions - enum constants for all configurable pins
+    2. processor-neutral bit definitions for a possible MFP configuration
+
+  - arch/arm/mach-pxa/include/mach/mfp-pxa3xx.h
+
+  for PXA3xx specific MFPR register bit definitions and PXA3xx common pin
+  configurations
+
+  - arch/arm/mach-pxa/include/mach/mfp-pxa2xx.h
+
+  for PXA2xx specific definitions and PXA25x/PXA27x common pin configurations
+
+  - arch/arm/mach-pxa/include/mach/mfp-pxa25x.h
+    arch/arm/mach-pxa/include/mach/mfp-pxa27x.h
+    arch/arm/mach-pxa/include/mach/mfp-pxa300.h
+    arch/arm/mach-pxa/include/mach/mfp-pxa320.h
+    arch/arm/mach-pxa/include/mach/mfp-pxa930.h
+
+  for processor specific definitions
+
+  - arch/arm/mach-pxa/mfp-pxa3xx.c
+  - arch/arm/mach-pxa/mfp-pxa2xx.c
+
+  for implementation of the pin configuration to take effect for the actual
+  processor.
+
+  Pin Configuration
+  -----------------
+
+  The following comments are copied from mfp.h (see the actual source code
+  for most updated info)
+  
+  /*
+   * a possible MFP configuration is represented by a 32-bit integer
+   *
+   * bit  0.. 9 - MFP Pin Number (1024 Pins Maximum)
+   * bit 10..12 - Alternate Function Selection
+   * bit 13..15 - Drive Strength
+   * bit 16..18 - Low Power Mode State
+   * bit 19..20 - Low Power Mode Edge Detection
+   * bit 21..22 - Run Mode Pull State
+   *
+   * to facilitate the definition, the following macros are provided
+   *
+   * MFP_CFG_DEFAULT - default MFP configuration value, with
+   *              alternate function = 0,
+   *              drive strength = fast 3mA (MFP_DS03X)
+   *              low power mode = default
+   *              edge detection = none
+   *
+   * MFP_CFG    - default MFPR value with alternate function
+   * MFP_CFG_DRV        - default MFPR value with alternate function and
+   *              pin drive strength
+   * MFP_CFG_LPM        - default MFPR value with alternate function and
+   *              low power mode
+   * MFP_CFG_X  - default MFPR value with alternate function,
+   *              pin drive strength and low power mode
+   */
+
+   Examples of pin configurations are:
+
+   #define GPIO94_SSP3_RXD              MFP_CFG_X(GPIO94, AF1, DS08X, FLOAT)
+
+   which reads GPIO94 can be configured as SSP3_RXD, with alternate function
+   selection of 1, driving strength of 0b101, and a float state in low power
+   modes.
+
+   NOTE: this is the default setting of this pin being configured as SSP3_RXD
+   which can be modified a bit in board code, though it is not recommended to
+   do so, simply because this default setting is usually carefully encoded,
+   and is supposed to work in most cases.
+
+  Register Settings
+  -----------------
+
+   Register settings on PXA3xx for a pin configuration is actually very
+   straight-forward, most bits can be converted directly into MFPR value
+   in a easier way. Two sets of MFPR values are calculated: the run-time
+   ones and the low power mode ones, to allow different settings.
+
+   The conversion from a generic pin configuration to the actual register
+   settings on PXA2xx is a bit complicated: many registers are involved,
+   including GAFRx, GPDRx, PGSRx, PWER, PKWR, PFER and PRER. Please see
+   mfp-pxa2xx.c for how the conversion is made.
diff --git a/Documentation/block/biodoc.txt b/Documentation/block/biodoc.txt
index 4dbb8be1c991..3c5434c83daf 100644
--- a/Documentation/block/biodoc.txt
+++ b/Documentation/block/biodoc.txt
@@ -914,7 +914,7 @@ I/O scheduler, a.k.a. elevator, is implemented in two layers.  Generic dispatch
 queue and specific I/O schedulers.  Unless stated otherwise, elevator is used
 to refer to both parts and I/O scheduler to specific I/O schedulers.
 
-Block layer implements generic dispatch queue in ll_rw_blk.c and elevator.c.
+Block layer implements generic dispatch queue in block/*.c.
 The generic dispatch queue is responsible for properly ordering barrier
 requests, requeueing, handling non-fs requests and all other subtleties.
 
@@ -926,8 +926,8 @@ be built inside the kernel.  Each queue can choose different one and can also
 change to another one dynamically.
 
 A block layer call to the i/o scheduler follows the convention elv_xxx(). This
-calls elevator_xxx_fn in the elevator switch (drivers/block/elevator.c). Oh,
-xxx and xxx might not match exactly, but use your imagination. If an elevator
+calls elevator_xxx_fn in the elevator switch (block/elevator.c). Oh, xxx
+and xxx might not match exactly, but use your imagination. If an elevator
 doesn't implement a function, the switch does nothing or some minimal house
 keeping work.
 
diff --git a/Documentation/controllers/cpuacct.txt b/Documentation/controllers/cpuacct.txt
new file mode 100644
index 000000000000..bb775fbe43d7
--- /dev/null
+++ b/Documentation/controllers/cpuacct.txt
@@ -0,0 +1,32 @@
+CPU Accounting Controller
+-------------------------
+
+The CPU accounting controller is used to group tasks using cgroups and
+account the CPU usage of these groups of tasks.
+
+The CPU accounting controller supports multi-hierarchy groups. An accounting
+group accumulates the CPU usage of all of its child groups and the tasks
+directly present in its group.
+
+Accounting groups can be created by first mounting the cgroup filesystem.
+
+# mkdir /cgroups
+# mount -t cgroup -ocpuacct none /cgroups
+
+With the above step, the initial or the parent accounting group
+becomes visible at /cgroups. At bootup, this group includes all the
+tasks in the system. /cgroups/tasks lists the tasks in this cgroup.
+/cgroups/cpuacct.usage gives the CPU time (in nanoseconds) obtained by
+this group which is essentially the CPU time obtained by all the tasks
+in the system.
+
+New accounting groups can be created under the parent group /cgroups.
+
+# cd /cgroups
+# mkdir g1
+# echo $$ > g1
+
+The above steps create a new group g1 and move the current shell
+process (bash) into it. CPU time consumed by this bash and its children
+can be obtained from g1/cpuacct.usage and the same is accumulated in
+/cgroups/cpuacct.usage also.
diff --git a/Documentation/cpu-freq/user-guide.txt b/Documentation/cpu-freq/user-guide.txt
index 4f3f3840320e..e3443ddcfb89 100644
--- a/Documentation/cpu-freq/user-guide.txt
+++ b/Documentation/cpu-freq/user-guide.txt
@@ -93,10 +93,8 @@ Several "PowerBook" and "iBook2" notebooks are supported.
 1.5 SuperH
 ----------
 
-The following SuperH processors are supported by cpufreq:
-
-SH-3
-SH-4
+All SuperH processors supporting rate rounding through the clock
+framework are supported by cpufreq.
 
 1.6 Blackfin
 ------------
diff --git a/Documentation/credentials.txt b/Documentation/credentials.txt
new file mode 100644
index 000000000000..df03169782ea
--- /dev/null
+++ b/Documentation/credentials.txt
@@ -0,0 +1,582 @@
+                             ====================
+                             CREDENTIALS IN LINUX
+                             ====================
+
+By: David Howells <dhowells@redhat.com>
+
+Contents:
+
+ (*) Overview.
+
+ (*) Types of credentials.
+
+ (*) File markings.
+
+ (*) Task credentials.
+
+     - Immutable credentials.
+     - Accessing task credentials.
+     - Accessing another task's credentials.
+     - Altering credentials.
+     - Managing credentials.
+
+ (*) Open file credentials.
+
+ (*) Overriding the VFS's use of credentials.
+
+
+========
+OVERVIEW
+========
+
+There are several parts to the security check performed by Linux when one
+object acts upon another:
+
+ (1) Objects.
+
+     Objects are things in the system that may be acted upon directly by
+     userspace programs.  Linux has a variety of actionable objects, including:
+
+        - Tasks
+        - Files/inodes
+        - Sockets
+        - Message queues
+        - Shared memory segments
+        - Semaphores
+        - Keys
+
+     As a part of the description of all these objects there is a set of
+     credentials.  What's in the set depends on the type of object.
+
+ (2) Object ownership.
+
+     Amongst the credentials of most objects, there will be a subset that
+     indicates the ownership of that object.  This is used for resource
+     accounting and limitation (disk quotas and task rlimits for example).
+
+     In a standard UNIX filesystem, for instance, this will be defined by the
+     UID marked on the inode.
+
+ (3) The objective context.
+
+     Also amongst the credentials of those objects, there will be a subset that
+     indicates the 'objective context' of that object.  This may or may not be
+     the same set as in (2) - in standard UNIX files, for instance, this is the
+     defined by the UID and the GID marked on the inode.
+
+     The objective context is used as part of the security calculation that is
+     carried out when an object is acted upon.
+
+ (4) Subjects.
+
+     A subject is an object that is acting upon another object.
+
+     Most of the objects in the system are inactive: they don't act on other
+     objects within the system.  Processes/tasks are the obvious exception:
+     they do stuff; they access and manipulate things.
+
+     Objects other than tasks may under some circumstances also be subjects.
+     For instance an open file may send SIGIO to a task using the UID and EUID
+     given to it by a task that called fcntl(F_SETOWN) upon it.  In this case,
+     the file struct will have a subjective context too.
+
+ (5) The subjective context.
+
+     A subject has an additional interpretation of its credentials.  A subset
+     of its credentials forms the 'subjective context'.  The subjective context
+     is used as part of the security calculation that is carried out when a
+     subject acts.
+
+     A Linux task, for example, has the FSUID, FSGID and the supplementary
+     group list for when it is acting upon a file - which are quite separate
+     from the real UID and GID that normally form the objective context of the
+     task.
+
+ (6) Actions.
+
+     Linux has a number of actions available that a subject may perform upon an
+     object.  The set of actions available depends on the nature of the subject
+     and the object.
+
+     Actions include reading, writing, creating and deleting files; forking or
+     signalling and tracing tasks.
+
+ (7) Rules, access control lists and security calculations.
+
+     When a subject acts upon an object, a security calculation is made.  This
+     involves taking the subjective context, the objective context and the
+     action, and searching one or more sets of rules to see whether the subject
+     is granted or denied permission to act in the desired manner on the
+     object, given those contexts.
+
+     There are two main sources of rules:
+
+     (a) Discretionary access control (DAC):
+
+         Sometimes the object will include sets of rules as part of its
+         description.  This is an 'Access Control List' or 'ACL'.  A Linux
+         file may supply more than one ACL.
+
+         A traditional UNIX file, for example, includes a permissions mask that
+         is an abbreviated ACL with three fixed classes of subject ('user',
+         'group' and 'other'), each of which may be granted certain privileges
+         ('read', 'write' and 'execute' - whatever those map to for the object
+         in question).  UNIX file permissions do not allow the arbitrary
+         specification of subjects, however, and so are of limited use.
+
+         A Linux file might also sport a POSIX ACL.  This is a list of rules
+         that grants various permissions to arbitrary subjects.
+
+     (b) Mandatory access control (MAC):
+
+         The system as a whole may have one or more sets of rules that get
+         applied to all subjects and objects, regardless of their source.
+         SELinux and Smack are examples of this.
+
+         In the case of SELinux and Smack, each object is given a label as part
+         of its credentials.  When an action is requested, they take the
+         subject label, the object label and the action and look for a rule
+         that says that this action is either granted or denied.
+
+
+====================
+TYPES OF CREDENTIALS
+====================
+
+The Linux kernel supports the following types of credentials:
+
+ (1) Traditional UNIX credentials.
+
+        Real User ID
+        Real Group ID
+
+     The UID and GID are carried by most, if not all, Linux objects, even if in
+     some cases it has to be invented (FAT or CIFS files for example, which are
+     derived from Windows).  These (mostly) define the objective context of
+     that object, with tasks being slightly different in some cases.
+
+        Effective, Saved and FS User ID
+        Effective, Saved and FS Group ID
+        Supplementary groups
+
+     These are additional credentials used by tasks only.  Usually, an
+     EUID/EGID/GROUPS will be used as the subjective context, and real UID/GID
+     will be used as the objective.  For tasks, it should be noted that this is
+     not always true.
+
+ (2) Capabilities.
+
+        Set of permitted capabilities
+        Set of inheritable capabilities
+        Set of effective capabilities
+        Capability bounding set
+
+     These are only carried by tasks.  They indicate superior capabilities
+     granted piecemeal to a task that an ordinary task wouldn't otherwise have.
+     These are manipulated implicitly by changes to the traditional UNIX
+     credentials, but can also be manipulated directly by the capset() system
+     call.
+
+     The permitted capabilities are those caps that the process might grant
+     itself to its effective or permitted sets through capset().  This
+     inheritable set might also be so constrained.
+
+     The effective capabilities are the ones that a task is actually allowed to
+     make use of itself.
+
+     The inheritable capabilities are the ones that may get passed across
+     execve().
+
+     The bounding set limits the capabilities that may be inherited across
+     execve(), especially when a binary is executed that will execute as UID 0.
+
+ (3) Secure management flags (securebits).
+
+     These are only carried by tasks.  These govern the way the above
+     credentials are manipulated and inherited over certain operations such as
+     execve().  They aren't used directly as objective or subjective
+     credentials.
+
+ (4) Keys and keyrings.
+
+     These are only carried by tasks.  They carry and cache security tokens
+     that don't fit into the other standard UNIX credentials.  They are for
+     making such things as network filesystem keys available to the file
+     accesses performed by processes, without the necessity of ordinary
+     programs having to know about security details involved.
+
+     Keyrings are a special type of key.  They carry sets of other keys and can
+     be searched for the desired key.  Each process may subscribe to a number
+     of keyrings:
+
+        Per-thread keying
+        Per-process keyring
+        Per-session keyring
+
+     When a process accesses a key, if not already present, it will normally be
+     cached on one of these keyrings for future accesses to find.
+
+     For more information on using keys, see Documentation/keys.txt.
+
+ (5) LSM
+
+     The Linux Security Module allows extra controls to be placed over the
+     operations that a task may do.  Currently Linux supports two main
+     alternate LSM options: SELinux and Smack.
+
+     Both work by labelling the objects in a system and then applying sets of
+     rules (policies) that say what operations a task with one label may do to
+     an object with another label.
+
+ (6) AF_KEY
+
+     This is a socket-based approach to credential management for networking
+     stacks [RFC 2367].  It isn't discussed by this document as it doesn't
+     interact directly with task and file credentials; rather it keeps system
+     level credentials.
+
+
+When a file is opened, part of the opening task's subjective context is
+recorded in the file struct created.  This allows operations using that file
+struct to use those credentials instead of the subjective context of the task
+that issued the operation.  An example of this would be a file opened on a
+network filesystem where the credentials of the opened file should be presented
+to the server, regardless of who is actually doing a read or a write upon it.
+
+
+=============
+FILE MARKINGS
+=============
+
+Files on disk or obtained over the network may have annotations that form the
+objective security context of that file.  Depending on the type of filesystem,
+this may include one or more of the following:
+
+ (*) UNIX UID, GID, mode;
+
+ (*) Windows user ID;
+
+ (*) Access control list;
+
+ (*) LSM security label;
+
+ (*) UNIX exec privilege escalation bits (SUID/SGID);
+
+ (*) File capabilities exec privilege escalation bits.
+
+These are compared to the task's subjective security context, and certain
+operations allowed or disallowed as a result.  In the case of execve(), the
+privilege escalation bits come into play, and may allow the resulting process
+extra privileges, based on the annotations on the executable file.
+
+
+================
+TASK CREDENTIALS
+================
+
+In Linux, all of a task's credentials are held in (uid, gid) or through
+(groups, keys, LSM security) a refcounted structure of type 'struct cred'.
+Each task points to its credentials by a pointer called 'cred' in its
+task_struct.
+
+Once a set of credentials has been prepared and committed, it may not be
+changed, barring the following exceptions:
+
+ (1) its reference count may be changed;
+
+ (2) the reference count on the group_info struct it points to may be changed;
+
+ (3) the reference count on the security data it points to may be changed;
+
+ (4) the reference count on any keyrings it points to may be changed;
+
+ (5) any keyrings it points to may be revoked, expired or have their security
+     attributes changed; and
+
+ (6) the contents of any keyrings to which it points may be changed (the whole
+     point of keyrings being a shared set of credentials, modifiable by anyone
+     with appropriate access).
+
+To alter anything in the cred struct, the copy-and-replace principle must be
+adhered to.  First take a copy, then alter the copy and then use RCU to change
+the task pointer to make it point to the new copy.  There are wrappers to aid
+with this (see below).
+
+A task may only alter its _own_ credentials; it is no longer permitted for a
+task to alter another's credentials.  This means the capset() system call is no
+longer permitted to take any PID other than the one of the current process.
+Also keyctl_instantiate() and keyctl_negate() functions no longer permit
+attachment to process-specific keyrings in the requesting process as the
+instantiating process may need to create them.
+
+
+IMMUTABLE CREDENTIALS
+---------------------
+
+Once a set of credentials has been made public (by calling commit_creds() for
+example), it must be considered immutable, barring two exceptions:
+
+ (1) The reference count may be altered.
+
+ (2) Whilst the keyring subscriptions of a set of credentials may not be
+     changed, the keyrings subscribed to may have their contents altered.
+
+To catch accidental credential alteration at compile time, struct task_struct
+has _const_ pointers to its credential sets, as does struct file.  Furthermore,
+certain functions such as get_cred() and put_cred() operate on const pointers,
+thus rendering casts unnecessary, but require to temporarily ditch the const
+qualification to be able to alter the reference count.
+
+
+ACCESSING TASK CREDENTIALS
+--------------------------
+
+A task being able to alter only its own credentials permits the current process
+to read or replace its own credentials without the need for any form of locking
+- which simplifies things greatly.  It can just call:
+
+        const struct cred *current_cred()
+
+to get a pointer to its credentials structure, and it doesn't have to release
+it afterwards.
+
+There are convenience wrappers for retrieving specific aspects of a task's
+credentials (the value is simply returned in each case):
+
+        uid_t current_uid(void)         Current's real UID
+        gid_t current_gid(void)         Current's real GID
+        uid_t current_euid(void)        Current's effective UID
+        gid_t current_egid(void)        Current's effective GID
+        uid_t current_fsuid(void)       Current's file access UID
+        gid_t current_fsgid(void)       Current's file access GID
+        kernel_cap_t current_cap(void)  Current's effective capabilities
+        void *current_security(void)    Current's LSM security pointer
+        struct user_struct *current_user(void)  Current's user account
+
+There are also convenience wrappers for retrieving specific associated pairs of
+a task's credentials:
+
+        void current_uid_gid(uid_t *, gid_t *);
+        void current_euid_egid(uid_t *, gid_t *);
+        void current_fsuid_fsgid(uid_t *, gid_t *);
+
+which return these pairs of values through their arguments after retrieving
+them from the current task's credentials.
+
+
+In addition, there is a function for obtaining a reference on the current
+process's current set of credentials:
+
+        const struct cred *get_current_cred(void);
+
+and functions for getting references to one of the credentials that don't
+actually live in struct cred:
+
+        struct user_struct *get_current_user(void);
+        struct group_info *get_current_groups(void);
+
+which get references to the current process's user accounting structure and
+supplementary groups list respectively.
+
+Once a reference has been obtained, it must be released with put_cred(),
+free_uid() or put_group_info() as appropriate.
+
+
+ACCESSING ANOTHER TASK'S CREDENTIALS
+------------------------------------
+
+Whilst a task may access its own credentials without the need for locking, the
+same is not true of a task wanting to access another task's credentials.  It
+must use the RCU read lock and rcu_dereference().
+
+The rcu_dereference() is wrapped by:
+
+        const struct cred *__task_cred(struct task_struct *task);
+
+This should be used inside the RCU read lock, as in the following example:
+
+        void foo(struct task_struct *t, struct foo_data *f)
+        {
+                const struct cred *tcred;
+                ...
+                rcu_read_lock();
+                tcred = __task_cred(t);
+                f->uid = tcred->uid;
+                f->gid = tcred->gid;
+                f->groups = get_group_info(tcred->groups);
+                rcu_read_unlock();
+                ...
+        }
+
+A function need not get RCU read lock to use __task_cred() if it is holding a
+spinlock at the time as this implicitly holds the RCU read lock.
+
+Should it be necessary to hold another task's credentials for a long period of
+time, and possibly to sleep whilst doing so, then the caller should get a
+reference on them using:
+
+        const struct cred *get_task_cred(struct task_struct *task);
+
+This does all the RCU magic inside of it.  The caller must call put_cred() on
+the credentials so obtained when they're finished with.
+
+There are a couple of convenience functions to access bits of another task's
+credentials, hiding the RCU magic from the caller:
+
+        uid_t task_uid(task)            Task's real UID
+        uid_t task_euid(task)           Task's effective UID
+
+If the caller is holding a spinlock or the RCU read lock at the time anyway,
+then:
+
+        __task_cred(task)->uid
+        __task_cred(task)->euid
+
+should be used instead.  Similarly, if multiple aspects of a task's credentials
+need to be accessed, RCU read lock or a spinlock should be used, __task_cred()
+called, the result stored in a temporary pointer and then the credential
+aspects called from that before dropping the lock.  This prevents the
+potentially expensive RCU magic from being invoked multiple times.
+
+Should some other single aspect of another task's credentials need to be
+accessed, then this can be used:
+
+        task_cred_xxx(task, member)
+
+where 'member' is a non-pointer member of the cred struct.  For instance:
+
+        uid_t task_cred_xxx(task, suid);
+
+will retrieve 'struct cred::suid' from the task, doing the appropriate RCU
+magic.  This may not be used for pointer members as what they point to may
+disappear the moment the RCU read lock is dropped.
+
+
+ALTERING CREDENTIALS
+--------------------
+
+As previously mentioned, a task may only alter its own credentials, and may not
+alter those of another task.  This means that it doesn't need to use any
+locking to alter its own credentials.
+
+To alter the current process's credentials, a function should first prepare a
+new set of credentials by calling:
+
+        struct cred *prepare_creds(void);
+
+this locks current->cred_replace_mutex and then allocates and constructs a
+duplicate of the current process's credentials, returning with the mutex still
+held if successful.  It returns NULL if not successful (out of memory).
+
+The mutex prevents ptrace() from altering the ptrace state of a process whilst
+security checks on credentials construction and changing is taking place as
+the ptrace state may alter the outcome, particularly in the case of execve().
+
+The new credentials set should be altered appropriately, and any security
+checks and hooks done.  Both the current and the proposed sets of credentials
+are available for this purpose as current_cred() will return the current set
+still at this point.
+
+
+When the credential set is ready, it should be committed to the current process
+by calling:
+
+        int commit_creds(struct cred *new);
+
+This will alter various aspects of the credentials and the process, giving the
+LSM a chance to do likewise, then it will use rcu_assign_pointer() to actually
+commit the new credentials to current->cred, it will release
+current->cred_replace_mutex to allow ptrace() to take place, and it will notify
+the scheduler and others of the changes.
+
+This function is guaranteed to return 0, so that it can be tail-called at the
+end of such functions as sys_setresuid().
+
+Note that this function consumes the caller's reference to the new credentials.
+The caller should _not_ call put_cred() on the new credentials afterwards.
+
+Furthermore, once this function has been called on a new set of credentials,
+those credentials may _not_ be changed further.
+
+
+Should the security checks fail or some other error occur after prepare_creds()
+has been called, then the following function should be invoked:
+
+        void abort_creds(struct cred *new);
+
+This releases the lock on current->cred_replace_mutex that prepare_creds() got
+and then releases the new credentials.
+
+
+A typical credentials alteration function would look something like this:
+
+        int alter_suid(uid_t suid)
+        {
+                struct cred *new;
+                int ret;
+
+                new = prepare_creds();
+                if (!new)
+                        return -ENOMEM;
+
+                new->suid = suid;
+                ret = security_alter_suid(new);
+                if (ret < 0) {
+                        abort_creds(new);
+                        return ret;
+                }
+
+                return commit_creds(new);
+        }
+
+
+MANAGING CREDENTIALS
+--------------------
+
+There are some functions to help manage credentials:
+
+ (*) void put_cred(const struct cred *cred);
+
+     This releases a reference to the given set of credentials.  If the
+     reference count reaches zero, the credentials will be scheduled for
+     destruction by the RCU system.
+
+ (*) const struct cred *get_cred(const struct cred *cred);
+
+     This gets a reference on a live set of credentials, returning a pointer to
+     that set of credentials.
+
+ (*) struct cred *get_new_cred(struct cred *cred);
+
+     This gets a reference on a set of credentials that is under construction
+     and is thus still mutable, returning a pointer to that set of credentials.
+
+
+=====================
+OPEN FILE CREDENTIALS
+=====================
+
+When a new file is opened, a reference is obtained on the opening task's
+credentials and this is attached to the file struct as 'f_cred' in place of
+'f_uid' and 'f_gid'.  Code that used to access file->f_uid and file->f_gid
+should now access file->f_cred->fsuid and file->f_cred->fsgid.
+
+It is safe to access f_cred without the use of RCU or locking because the
+pointer will not change over the lifetime of the file struct, and nor will the
+contents of the cred struct pointed to, barring the exceptions listed above
+(see the Task Credentials section).
+
+
+=======================================
+OVERRIDING THE VFS'S USE OF CREDENTIALS
+=======================================
+
+Under some circumstances it is desirable to override the credentials used by
+the VFS, and that can be done by calling into such as vfs_mkdir() with a
+different set of credentials.  This is done in the following places:
+
+ (*) sys_faccessat().
+
+ (*) do_coredump().
+
+ (*) nfs4recover.c.
diff --git a/Documentation/dvb/technisat.txt b/Documentation/dvb/technisat.txt
new file mode 100644
index 000000000000..cdf6ee4b2da1
--- /dev/null
+++ b/Documentation/dvb/technisat.txt
@@ -0,0 +1,69 @@
+How to set up the Technisat devices
+===================================
+
+1) Find out what device you have
+================================
+
+First start your linux box with a shipped kernel:
+lspci -vvv for a PCI device (lsusb -vvv for an USB device) will show you for example:
+02:0b.0 Network controller: Techsan Electronics Co Ltd B2C2 FlexCopII DVB chip / Technisat SkyStar2 DVB card (rev 02)
+
+dmesg | grep frontend may show you for example:
+DVB: registering frontend 0 (Conexant CX24123/CX24109)...
+
+2) Kernel compilation:
+======================
+
+If the Technisat is the only TV device in your box get rid of unnecessary modules and check this one:
+"Multimedia devices" => "Customise analog and hybrid tuner modules to build"
+In this directory uncheck every driver which is activated there.
+
+Then please activate:
+2a) Main module part:
+
+a.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters"
+b.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Technisat/B2C2 Air/Sky/Cable2PC PCI" in case of a PCI card OR
+c.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Technisat/B2C2 Air/Sky/Cable2PC USB" in case of an USB 1.1 adapter
+d.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Enable debug for the B2C2 FlexCop drivers"
+Notice: d.) is helpful for troubleshooting
+
+2b) Frontend module part:
+
+1.) Revision 2.3:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "Zarlink VP310/MT312/ZL10313 based"
+
+2.) Revision 2.6:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "ST STV0299 based"
+
+3.) Revision 2.7:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "Samsung S5H1420 based"
+c.)"Multimedia devices" => "Customise DVB frontends" => "Integrant ITD1000 Zero IF tuner for DVB-S/DSS"
+d.)"Multimedia devices" => "Customise DVB frontends" => "ISL6421 SEC controller"
+
+4.) Revision 2.8:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "Conexant CX24113/CX24128 tuner for DVB-S/DSS"
+c.)"Multimedia devices" => "Customise DVB frontends" => "Conexant CX24123 based"
+d.)"Multimedia devices" => "Customise DVB frontends" => "ISL6421 SEC controller"
+
+5.) DVB-T card:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "Zarlink MT352 based"
+
+6.) DVB-C card:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "ST STV0297 based"
+
+7.) ATSC card 1st generation:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "Broadcom BCM3510"
+
+8.) ATSC card 2nd generation:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "NxtWave Communications NXT2002/NXT2004 based"
+c.)"Multimedia devices" => "Customise DVB frontends" => "LG Electronics LGDT3302/LGDT3303 based"
+
+Author: Uwe Bugla <uwe.bugla@gmx.de> December 2008
diff --git a/Documentation/fb/pxafb.txt b/Documentation/fb/pxafb.txt
index db9b8500b43b..d143a0a749f9 100644
--- a/Documentation/fb/pxafb.txt
+++ b/Documentation/fb/pxafb.txt
@@ -5,9 +5,13 @@ The driver supports the following options, either via
 options=<OPTIONS> when modular or video=pxafb:<OPTIONS> when built in.
 
 For example:
-        modprobe pxafb options=mode:640x480-8,passive
+        modprobe pxafb options=vmem:2M,mode:640x480-8,passive
 or on the kernel command line
-        video=pxafb:mode:640x480-8,passive
+        video=pxafb:vmem:2M,mode:640x480-8,passive
+
+vmem: VIDEO_MEM_SIZE
+        Amount of video memory to allocate (can be suffixed with K or M
+        for kilobytes or megabytes)
 
 mode:XRESxYRES[-BPP]
         XRES == LCCR1_PPL + 1
@@ -52,3 +56,87 @@ outputen:POLARITY
 pixclockpol:POLARITY
         pixel clock polarity
         0 => falling edge, 1 => rising edge
+
+
+Overlay Support for PXA27x and later LCD controllers
+====================================================
+
+  PXA27x and later processors support overlay1 and overlay2 on-top of the
+  base framebuffer (although under-neath the base is also possible). They
+  support palette and no-palette RGB formats, as well as YUV formats (only
+  available on overlay2). These overlays have dedicated DMA channels and
+  behave in a similar way as a framebuffer.
+
+  However, there are some differences between these overlay framebuffers
+  and normal framebuffers, as listed below:
+
+  1. overlay can start at a 32-bit word aligned position within the base
+     framebuffer, which means they have a start (x, y). This information
+     is encoded into var->nonstd (no, var->xoffset and var->yoffset are
+     not for such purpose).
+
+  2. overlay framebuffer is allocated dynamically according to specified
+     'struct fb_var_screeninfo', the amount is decided by:
+
+        var->xres_virtual * var->yres_virtual * bpp
+
+     bpp = 16 -- for RGB565 or RGBT555
+         = 24 -- for YUV444 packed
+         = 24 -- for YUV444 planar
+         = 16 -- for YUV422 planar (1 pixel = 1 Y + 1/2 Cb + 1/2 Cr)
+         = 12 -- for YUV420 planar (1 pixel = 1 Y + 1/4 Cb + 1/4 Cr)
+
+     NOTE:
+
+     a. overlay does not support panning in x-direction, thus
+        var->xres_virtual will always be equal to var->xres
+
+     b. line length of overlay(s) must be on a 32-bit word boundary,
+        for YUV planar modes, it is a requirement for the component
+        with minimum bits per pixel,  e.g. for YUV420, Cr component
+        for one pixel is actually 2-bits, it means the line length
+        should be a multiple of 16-pixels
+
+     c. starting horizontal position (XPOS) should start on a 32-bit
+        word boundary, otherwise the fb_check_var() will just fail.
+
+     d. the rectangle of the overlay should be within the base plane,
+        otherwise fail
+
+     Applications should follow the sequence below to operate an overlay
+     framebuffer:
+
+         a. open("/dev/fb[1-2]", ...)
+         b. ioctl(fd, FBIOGET_VSCREENINFO, ...)
+         c. modify 'var' with desired parameters:
+            1) var->xres and var->yres
+            2) larger var->yres_virtual if more memory is required,
+               usually for double-buffering
+            3) var->nonstd for starting (x, y) and color format
+            4) var->{red, green, blue, transp} if RGB mode is to be used
+         d. ioctl(fd, FBIOPUT_VSCREENINFO, ...)
+         e. ioctl(fd, FBIOGET_FSCREENINFO, ...)
+         f. mmap
+         g. ...
+
+  3. for YUV planar formats, these are actually not supported within the
+     framebuffer framework, application has to take care of the offsets
+     and lengths of each component within the framebuffer.
+
+  4. var->nonstd is used to pass starting (x, y) position and color format,
+     the detailed bit fields are shown below:
+
+    31                23  20         10          0
+     +-----------------+---+----------+----------+
+     |  ... unused ... |FOR|   XPOS   |   YPOS   |
+     +-----------------+---+----------+----------+
+
+     FOR  - color format, as defined by OVERLAY_FORMAT_* in pxafb.h
+            0 - RGB
+            1 - YUV444 PACKED
+            2 - YUV444 PLANAR
+            3 - YUV422 PLANAR
+            4 - YUR420 PLANAR
+
+     XPOS - starting horizontal position
+     YPOS - starting vertical position
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index c28a2ac88f9d..dc7c681e532c 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -120,13 +120,6 @@ Who:	Christoph Hellwig <hch@lst.de>
 
 ---------------------------
 
-What:   eepro100 network driver
-When:   January 2007
-Why:    replaced by the e100 driver
-Who:    Adrian Bunk <bunk@stusta.de>
-
----------------------------
-
 What:   Unused EXPORT_SYMBOL/EXPORT_SYMBOL_GPL exports
         (temporary transition config option provided until then)
         The transition config option will also be removed at the same time.
@@ -244,18 +237,6 @@ Who:	Michael Buesch <mb@bu3sch.de>
 
 ---------------------------
 
-What:   init_mm export
-When:   2.6.26
-Why:    Not used in-tree. The current out-of-tree users used it to
-        work around problems in the CPA code which should be resolved
-        by now. One usecase was described to provide verification code
-        of the CPA operation. That's a good idea in general, but such
-        code / infrastructure should be in the kernel and not in some
-        out-of-tree driver.
-Who:    Thomas Gleixner <tglx@linutronix.de>
-
-----------------------------
-
 What:   usedac i386 kernel parameter
 When:   2.6.27
 Why:    replaced by allowdac and no dac combination
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index 23d2f4460deb..ccec55394380 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -394,7 +394,6 @@ prototypes:
         unsigned long (*get_unmapped_area)(struct file *, unsigned long,
                         unsigned long, unsigned long, unsigned long);
         int (*check_flags)(int);
-        int (*dir_notify)(struct file *, unsigned long);
 };
 
 locking rules:
@@ -424,7 +423,6 @@ sendfile:		no
 sendpage:               no
 get_unmapped_area:      no
 check_flags:            no
-dir_notify:             no
 
 ->llseek() locking has moved from llseek to the individual llseek
 implementations.  If your fs is not using generic_file_llseek, you
diff --git a/Documentation/filesystems/files.txt b/Documentation/filesystems/files.txt
index bb0142f61084..ac2facc50d2a 100644
--- a/Documentation/filesystems/files.txt
+++ b/Documentation/filesystems/files.txt
@@ -76,13 +76,13 @@ the fdtable structure -
 5. Handling of the file structures is special. Since the look-up
    of the fd (fget()/fget_light()) are lock-free, it is possible
    that look-up may race with the last put() operation on the
-   file structure. This is avoided using atomic_inc_not_zero()
+   file structure. This is avoided using atomic_long_inc_not_zero()
    on ->f_count :
 
         rcu_read_lock();
         file = fcheck_files(files, fd);
         if (file) {
-                if (atomic_inc_not_zero(&file->f_count))
+                if (atomic_long_inc_not_zero(&file->f_count))
                         *fput_needed = 1;
                 else
                 /* Didn't get the reference, someone's freed */
@@ -92,7 +92,7 @@ the fdtable structure -
         ....
         return file;
 
-   atomic_inc_not_zero() detects if refcounts is already zero or
+   atomic_long_inc_not_zero() detects if refcounts is already zero or
    goes to zero during increment. If it does, we fail
    fget()/fget_light().
 
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index bb1b0dd3bfcb..71df353e367c 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1339,10 +1339,13 @@ nmi_watchdog
 
 Enables/Disables the NMI watchdog on x86 systems.  When the value is non-zero
 the NMI watchdog is enabled and will continuously test all online cpus to
-determine whether or not they are still functioning properly.
+determine whether or not they are still functioning properly. Currently,
+passing "nmi_watchdog=" parameter at boot time is required for this function
+to work.
 
-Because the NMI watchdog shares registers with oprofile, by disabling the NMI
-watchdog, oprofile may have more registers to utilize.
+If LAPIC NMI watchdog method is in use (nmi_watchdog=2 kernel parameter), the
+NMI watchdog shares registers with oprofile. By disabling the NMI watchdog,
+oprofile may have more registers to utilize.
 
 msgmni
 ------
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index 5579bda58a6d..ef19afa186a9 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -733,7 +733,6 @@ struct file_operations {
         ssize_t (*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int);
         unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
         int (*check_flags)(int);
-        int (*dir_notify)(struct file *filp, unsigned long arg);
         int (*flock) (struct file *, int, struct file_lock *);
         ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, size_t, unsigned int);
         ssize_t (*splice_read)(struct file *, struct pipe_inode_info *, size_t, unsigned int);
@@ -800,8 +799,6 @@ otherwise noted.
 
   check_flags: called by the fcntl(2) system call for F_SETFL command
 
-  dir_notify: called by the fcntl(2) system call for F_NOTIFY command
-
   flock: called by the flock(2) system call
 
   splice_write: called by the VFS to splice data from a pipe to a file. This
@@ -931,7 +928,7 @@ manipulate dentries:
   d_lookup: look up a dentry given its parent and path name component
         It looks up the child of that given name from the dcache
         hash table. If it is found, the reference count is incremented
-        and the dentry is returned. The caller must use d_put()
+        and the dentry is returned. The caller must use dput()
         to free the dentry when it finishes using it.
 
 For further information on dentry locking, please refer to the document
diff --git a/Documentation/filesystems/xfs.txt b/Documentation/filesystems/xfs.txt
index 0a1668ba2600..9878f50d6ed6 100644
--- a/Documentation/filesystems/xfs.txt
+++ b/Documentation/filesystems/xfs.txt
@@ -229,10 +229,6 @@ The following sysctls are available for the XFS filesystem:
         ISGID bit is cleared if the irix_sgid_inherit compatibility sysctl
         is set.
 
-  fs.xfs.restrict_chown         (Min: 0  Default: 1  Max: 1)
-        Controls whether unprivileged users can use chown to "give away"
-        a file to another user.
-
   fs.xfs.inherit_sync           (Min: 0  Default: 1  Max: 1)
         Setting this to "1" will cause the "sync" flag set
         by the xfs_io(8) chattr command on a directory to be
diff --git a/Documentation/ftrace.txt b/Documentation/ftrace.txt
index 9cc4d685dde5..803b1318b13d 100644
--- a/Documentation/ftrace.txt
+++ b/Documentation/ftrace.txt
@@ -82,7 +82,7 @@ of ftrace. Here is a list of some of the key files:
                 tracer is not adding more data, they will display
                 the same information every time they are read.
 
-  iter_ctrl: This file lets the user control the amount of data
+  trace_options: This file lets the user control the amount of data
                 that is displayed in one of the above output
                 files.
 
@@ -94,10 +94,10 @@ of ftrace. Here is a list of some of the key files:
                 only be recorded if the latency is greater than
                 the value in this file. (in microseconds)
 
-  trace_entries: This sets or displays the number of bytes each CPU
+  buffer_size_kb: This sets or displays the number of kilobytes each CPU
                 buffer can hold. The tracer buffers are the same size
                 for each CPU. The displayed number is the size of the
-                 CPU buffer and not total size of all buffers. The
+                CPU buffer and not total size of all buffers. The
                 trace buffers are allocated in pages (blocks of memory
                 that the kernel uses for allocation, usually 4 KB in size).
                 If the last page allocated has room for more bytes
@@ -127,6 +127,8 @@ of ftrace. Here is a list of some of the key files:
                 be traced. If a function exists in both set_ftrace_filter
                 and set_ftrace_notrace, the function will _not_ be traced.
 
+  set_ftrace_pid: Have the function tracer only trace a single thread.
+
   available_filter_functions: This lists the functions that ftrace
                 has processed and can trace. These are the function
                 names that you can pass to "set_ftrace_filter" or
@@ -316,23 +318,23 @@ The above is mostly meaningful for kernel developers.
   The rest is the same as the 'trace' file.
 
 
-iter_ctrl
----------
+trace_options
+-------------
 
-The iter_ctrl file is used to control what gets printed in the trace
+The trace_options file is used to control what gets printed in the trace
 output. To see what is available, simply cat the file:
 
-  cat /debug/tracing/iter_ctrl
+  cat /debug/tracing/trace_options
   print-parent nosym-offset nosym-addr noverbose noraw nohex nobin \
- noblock nostacktrace nosched-tree
+ noblock nostacktrace nosched-tree nouserstacktrace nosym-userobj
 
 To disable one of the options, echo in the option prepended with "no".
 
-  echo noprint-parent > /debug/tracing/iter_ctrl
+  echo noprint-parent > /debug/tracing/trace_options
 
 To enable an option, leave off the "no".
 
-  echo sym-offset > /debug/tracing/iter_ctrl
+  echo sym-offset > /debug/tracing/trace_options
 
 Here are the available options:
 
@@ -378,6 +380,20 @@ Here are the available options:
                 When a trace is recorded, so is the stack of functions.
                 This allows for back traces of trace sites.
 
+  userstacktrace - This option changes the trace.
+                   It records a stacktrace of the current userspace thread.
+
+  sym-userobj - when user stacktrace are enabled, look up which object the
+                address belongs to, and print a relative address
+                This is especially useful when ASLR is on, otherwise you don't
+                get a chance to resolve the address to object/file/line after the app is no
+                longer running
+
+                The lookup is performed when you read trace,trace_pipe,latency_trace. Example:
+
+                a.out-1623  [000] 40874.465068: /root/a.out[+0x480] <-/root/a.out[+0
+x494] <- /root/a.out[+0x4a8] <- /lib/libc-2.7.so[+0x1e1a6]
+
   sched-tree - TBD (any users??)
 
 
@@ -1059,6 +1075,83 @@ For simple one time traces, the above is sufficent. For anything else,
 a search through /proc/mounts may be needed to find where the debugfs
 file-system is mounted.
 
+
+Single thread tracing
+---------------------
+
+By writing into /debug/tracing/set_ftrace_pid you can trace a
+single thread. For example:
+
+# cat /debug/tracing/set_ftrace_pid
+no pid
+# echo 3111 > /debug/tracing/set_ftrace_pid
+# cat /debug/tracing/set_ftrace_pid
+3111
+# echo function > /debug/tracing/current_tracer
+# cat /debug/tracing/trace | head
+ # tracer: function
+ #
+ #           TASK-PID    CPU#    TIMESTAMP  FUNCTION
+ #              | |       |          |         |
+     yum-updatesd-3111  [003]  1637.254676: finish_task_switch <-thread_return
+     yum-updatesd-3111  [003]  1637.254681: hrtimer_cancel <-schedule_hrtimeout_range
+     yum-updatesd-3111  [003]  1637.254682: hrtimer_try_to_cancel <-hrtimer_cancel
+     yum-updatesd-3111  [003]  1637.254683: lock_hrtimer_base <-hrtimer_try_to_cancel
+     yum-updatesd-3111  [003]  1637.254685: fget_light <-do_sys_poll
+     yum-updatesd-3111  [003]  1637.254686: pipe_poll <-do_sys_poll
+# echo -1 > /debug/tracing/set_ftrace_pid
+# cat /debug/tracing/trace |head
+ # tracer: function
+ #
+ #           TASK-PID    CPU#    TIMESTAMP  FUNCTION
+ #              | |       |          |         |
+ ##### CPU 3 buffer started ####
+     yum-updatesd-3111  [003]  1701.957688: free_poll_entry <-poll_freewait
+     yum-updatesd-3111  [003]  1701.957689: remove_wait_queue <-free_poll_entry
+     yum-updatesd-3111  [003]  1701.957691: fput <-free_poll_entry
+     yum-updatesd-3111  [003]  1701.957692: audit_syscall_exit <-sysret_audit
+     yum-updatesd-3111  [003]  1701.957693: path_put <-audit_syscall_exit
+
+If you want to trace a function when executing, you could use
+something like this simple program:
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+int main (int argc, char **argv)
+{
+        if (argc < 1)
+                exit(-1);
+
+        if (fork() > 0) {
+                int fd, ffd;
+                char line[64];
+                int s;
+
+                ffd = open("/debug/tracing/current_tracer", O_WRONLY);
+                if (ffd < 0)
+                        exit(-1);
+                write(ffd, "nop", 3);
+
+                fd = open("/debug/tracing/set_ftrace_pid", O_WRONLY);
+                s = sprintf(line, "%d\n", getpid());
+                write(fd, line, s);
+
+                write(ffd, "function", 8);
+
+                close(fd);
+                close(ffd);
+
+                execvp(argv[1], argv+1);
+        }
+
+        return 0;
+}
+
 dynamic ftrace
 --------------
 
@@ -1158,7 +1251,11 @@ These are the only wild cards which are supported.
 
   <match>*<match> will not work.
 
- # echo hrtimer_* > /debug/tracing/set_ftrace_filter
+Note: It is better to use quotes to enclose the wild cards, otherwise
+  the shell may expand the parameters into names of files in the local
+  directory.
+
+ # echo 'hrtimer_*' > /debug/tracing/set_ftrace_filter
 
 Produces:
 
@@ -1213,7 +1310,7 @@ Again, now we want to append.
  # echo sys_nanosleep > /debug/tracing/set_ftrace_filter
  # cat /debug/tracing/set_ftrace_filter
 sys_nanosleep
- # echo hrtimer_* >> /debug/tracing/set_ftrace_filter
+ # echo 'hrtimer_*' >> /debug/tracing/set_ftrace_filter
  # cat /debug/tracing/set_ftrace_filter
 hrtimer_run_queues
 hrtimer_run_pending
@@ -1299,41 +1396,29 @@ trace entries
 -------------
 
 Having too much or not enough data can be troublesome in diagnosing
-an issue in the kernel. The file trace_entries is used to modify
+an issue in the kernel. The file buffer_size_kb is used to modify
 the size of the internal trace buffers. The number listed
 is the number of entries that can be recorded per CPU. To know
 the full size, multiply the number of possible CPUS with the
 number of entries.
 
- # cat /debug/tracing/trace_entries
-65620
+ # cat /debug/tracing/buffer_size_kb
+1408 (units kilobytes)
 
 Note, to modify this, you must have tracing completely disabled. To do that,
 echo "nop" into the current_tracer. If the current_tracer is not set
 to "nop", an EINVAL error will be returned.
 
  # echo nop > /debug/tracing/current_tracer
- # echo 100000 > /debug/tracing/trace_entries
- # cat /debug/tracing/trace_entries
-100045
-
-
-Notice that we echoed in 100,000 but the size is 100,045. The entries
-are held in individual pages. It allocates the number of pages it takes
-to fulfill the request. If more entries may fit on the last page
-then they will be added.
-
- # echo 1 > /debug/tracing/trace_entries
- # cat /debug/tracing/trace_entries
-85
-
-This shows us that 85 entries can fit in a single page.
+ # echo 10000 > /debug/tracing/buffer_size_kb
+ # cat /debug/tracing/buffer_size_kb
+10000 (units kilobytes)
 
 The number of pages which will be allocated is limited to a percentage
 of available memory. Allocating too much will produce an error.
 
- # echo 1000000000000 > /debug/tracing/trace_entries
+ # echo 1000000000000 > /debug/tracing/buffer_size_kb
 -bash: echo: write error: Cannot allocate memory
- # cat /debug/tracing/trace_entries
+ # cat /debug/tracing/buffer_size_kb
 85
 
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index 7a7753321a26..51104f9194a5 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -383,6 +383,20 @@ more details, with real examples.
         to prerequisites are referenced with $(src) (because they are not
         generated files).
 
+    $(kecho)
+        echoing information to user in a rule is often a good practice
+        but when execution "make -s" one does not expect to see any output
+        except for warnings/errors.
+        To support this kbuild define $(kecho) which will echo out the
+        text following $(kecho) to stdout except if "make -s" is used.
+
+        Example:
+                #arch/blackfin/boot/Makefile
+                $(obj)/vmImage: $(obj)/vmlinux.gz
+                        $(call if_changed,uimage)
+                        @$(kecho) 'Kernel: $@ is ready'
+
+
 --- 3.11 $(CC) support functions
 
         The kernel may be built with several different versions of
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e0f346d201ed..a2d8805c03d5 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -89,6 +89,7 @@ parameter is applicable:
         SPARC   Sparc architecture is enabled.
         SWSUSP  Software suspend (hibernation) is enabled.
         SUSPEND System suspend states are enabled.
+        FTRACE  Function tracing enabled.
         TS      Appropriate touchscreen support is enabled.
         USB     USB support is enabled.
         USBHID  USB Human Interface Device support is enabled.
@@ -220,14 +221,17 @@ and is between 256 and 4096 characters. It is defined in the file
                         Bits in debug_level correspond to a level in
                         ACPI_DEBUG_PRINT statements, e.g.,
                             ACPI_DEBUG_PRINT((ACPI_DB_INFO, ...
-                        See Documentation/acpi/debug.txt for more information
-                        about debug layers and levels.
+                        The debug_level mask defaults to "info".  See
+                        Documentation/acpi/debug.txt for more information about
+                        debug layers and levels.
 
+                        Enable processor driver info messages:
+                            acpi.debug_layer=0x20000000
+                        Enable PCI/PCI interrupt routing info messages:
+                            acpi.debug_layer=0x400000
                         Enable AML "Debug" output, i.e., stores to the Debug
                         object while interpreting AML:
                             acpi.debug_layer=0xffffffff acpi.debug_level=0x2
-                        Enable PCI/PCI interrupt routing info messages:
-                            acpi.debug_layer=0x400000 acpi.debug_level=0x4
                         Enable all messages related to ACPI hardware:
                             acpi.debug_layer=0x2 acpi.debug_level=0xffffffff
 
@@ -750,6 +754,14 @@ and is between 256 and 4096 characters. It is defined in the file
                         parameter will force ia64_sal_cache_flush to call
                         ia64_pal_cache_flush instead of SAL_CACHE_FLUSH.
 
+        ftrace=[tracer]
+                        [ftrace] will set and start the specified tracer
+                        as early as possible in order to facilitate early
+                        boot debugging.
+
+        ftrace_dump_on_oops
+                        [ftrace] will dump the trace buffers on oops.
+
         gamecon.map[2|3]=
                         [HW,JOY] Multisystem joystick and NES/SNES/PSX pad
                         support via parallel port (up to 5 devices per port)
@@ -811,6 +823,9 @@ and is between 256 and 4096 characters. It is defined in the file
 
         hlt             [BUGS=ARM,SH]
 
+        hvc_iucv=       [S390] Number of z/VM IUCV Hypervisor console (HVC)
+                               back-ends. Valid parameters: 0..8
+
         i8042.debug     [HW] Toggle i8042 debug mode
         i8042.direct    [HW] Put keyboard port into non-translated mode
         i8042.dumbkbd   [HW] Pretend that controller can only read data from
@@ -1393,7 +1408,20 @@ and is between 256 and 4096 characters. It is defined in the file
                         when a NMI is triggered.
                         Format: [state][,regs][,debounce][,die]
 
-        nmi_watchdog=   [KNL,BUGS=X86-32] Debugging features for SMP kernels
+        nmi_watchdog=   [KNL,BUGS=X86-32,X86-64] Debugging features for SMP kernels
+                        Format: [panic,][num]
+                        Valid num: 0,1,2
+                        0 - turn nmi_watchdog off
+                        1 - use the IO-APIC timer for the NMI watchdog
+                        2 - use the local APIC for the NMI watchdog using
+                        a performance counter. Note: This will use one performance
+                        counter and the local APIC's performance vector.
+                        When panic is specified panic when an NMI watchdog timeout occurs.
+                        This is useful when you use a panic=... timeout and need the box
+                        quickly up again.
+                        Instead of 1 and 2 it is possible to use the following
+                        symbolic names: lapic and ioapic
+                        Example: nmi_watchdog=2 or nmi_watchdog=panic,lapic
 
         no387           [BUGS=X86-32] Tells the kernel to use the 387 maths
                         emulation library even if a 387 maths coprocessor
@@ -1449,6 +1477,10 @@ and is between 256 and 4096 characters. It is defined in the file
                         instruction doesn't work correctly and not to
                         use it.
 
+        no_file_caps    Tells the kernel not to honor file capabilities.  The
+                        only way then for a file to be executed with privilege
+                        is to be setuid root or executed by root.
+
         nohalt          [IA-64] Tells the kernel not to use the power saving
                         function PAL_HALT_LIGHT when idle. This increases
                         power-consumption. On the positive side, it reduces
@@ -1626,6 +1658,17 @@ and is between 256 and 4096 characters. It is defined in the file
                 nomsi           [MSI] If the PCI_MSI kernel config parameter is
                                 enabled, this kernel boot option can be used to
                                 disable the use of MSI interrupts system-wide.
+                noioapicquirk   [APIC] Disable all boot interrupt quirks.
+                                Safety option to keep boot IRQs enabled. This
+                                should never be necessary.
+                ioapicreroute   [APIC] Enable rerouting of boot IRQs to the
+                                primary IO-APIC for bridges that cannot disable
+                                boot IRQs. This fixes a source of spurious IRQs
+                                when the system masks IRQs.
+                noioapicreroute [APIC] Disable workaround that uses the
+                                boot IRQ equivalent of an IRQ that connects to
+                                a chipset where boot IRQs cannot be disabled.
+                                The opposite of ioapicreroute.
                 biosirq         [X86-32] Use PCI BIOS calls to get the interrupt
                                 routing table. These calls are known to be buggy
                                 on several machines and they hang the machine
@@ -2165,6 +2208,9 @@ and is between 256 and 4096 characters. It is defined in the file
         st=             [HW,SCSI] SCSI tape parameters (buffers, etc.)
                         See Documentation/scsi/st.txt.
 
+        stacktrace      [FTRACE]
+                        Enabled the stack tracer on boot up.
+
         sti=            [PARISC,HW]
                         Format: <num>
                         Set the STI (builtin display/keyboard on the HP-PARISC
@@ -2249,12 +2295,27 @@ and is between 256 and 4096 characters. It is defined in the file
                         See comment before function dc390_setup() in
                         drivers/scsi/tmscsim.c.
 
+        topology=       [S390]
+                        Format: {off | on}
+                        Specify if the kernel should make use of the cpu
+                        topology informations if the hardware supports these.
+                        The scheduler will make use of these informations and
+                        e.g. base its process migration decisions on it.
+                        Default is off.
+
         tp720=          [HW,PS2]
 
         trix=           [HW,OSS] MediaTrix AudioTrix Pro
                         Format:
                         <io>,<irq>,<dma>,<dma2>,<sb_io>,<sb_irq>,<sb_dma>,<mpu_io>,<mpu_irq>
 
+        tsc=            Disable clocksource-must-verify flag for TSC.
+                        Format: <string>
+                        [x86] reliable: mark tsc clocksource as reliable, this
+                        disables clocksource verification at runtime.
+                        Used to enable high-resolution timer mode on older
+                        hardware, and in virtualized environment.
+
         turbografx.map[2|3]=    [HW,JOY]
                         TurboGraFX parallel port interface
                         Format:
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index 804520633fcf..f2dbbf3bdeab 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -481,51 +481,6 @@ static unsigned long load_initrd(const char *name, unsigned long mem)
         /* We return the initrd size. */
         return len;
 }
-
-/* Once we know how much memory we have we can construct simple linear page
- * tables which set virtual == physical which will get the Guest far enough
- * into the boot to create its own.
- *
- * We lay them out of the way, just below the initrd (which is why we need to
- * know its size here). */
-static unsigned long setup_pagetables(unsigned long mem,
-                                      unsigned long initrd_size)
-{
-        unsigned long *pgdir, *linear;
-        unsigned int mapped_pages, i, linear_pages;
-        unsigned int ptes_per_page = getpagesize()/sizeof(void *);
-
-        mapped_pages = mem/getpagesize();
-
-        /* Each PTE page can map ptes_per_page pages: how many do we need? */
-        linear_pages = (mapped_pages + ptes_per_page-1)/ptes_per_page;
-
-        /* We put the toplevel page directory page at the top of memory. */
-        pgdir = from_guest_phys(mem) - initrd_size - getpagesize();
-
-        /* Now we use the next linear_pages pages as pte pages */
-        linear = (void *)pgdir - linear_pages*getpagesize();
-
-        /* Linear mapping is easy: put every page's address into the mapping in
-         * order.  PAGE_PRESENT contains the flags Present, Writable and
-         * Executable. */
-        for (i = 0; i < mapped_pages; i++)
-                linear[i] = ((i * getpagesize()) | PAGE_PRESENT);
-
-        /* The top level points to the linear page table pages above. */
-        for (i = 0; i < mapped_pages; i += ptes_per_page) {
-                pgdir[i/ptes_per_page]
-                        = ((to_guest_phys(linear) + i*sizeof(void *))
-                           | PAGE_PRESENT);
-        }
-
-        verbose("Linear mapping of %u pages in %u pte pages at %#lx\n",
-                mapped_pages, linear_pages, to_guest_phys(linear));
-
-        /* We return the top level (guest-physical) address: the kernel needs
-         * to know where it is. */
-        return to_guest_phys(pgdir);
-}
 /*:*/
 
 /* Simple routine to roll all the commandline arguments together with spaces
@@ -548,13 +503,13 @@ static void concat(char *dst, char *args[])
 
 /*L:185 This is where we actually tell the kernel to initialize the Guest.  We
  * saw the arguments it expects when we looked at initialize() in lguest_user.c:
- * the base of Guest "physical" memory, the top physical page to allow, the
- * top level pagetable and the entry point for the Guest. */
-static int tell_kernel(unsigned long pgdir, unsigned long start)
+ * the base of Guest "physical" memory, the top physical page to allow and the
+ * entry point for the Guest. */
+static int tell_kernel(unsigned long start)
 {
         unsigned long args[] = { LHREQ_INITIALIZE,
                                  (unsigned long)guest_base,
-                                 guest_limit / getpagesize(), pgdir, start };
+                                 guest_limit / getpagesize(), start };
         int fd;
 
         verbose("Guest: %p - %p (%#lx)\n",
@@ -1030,7 +985,7 @@ static void update_device_status(struct device *dev)
                 /* Zero out the virtqueues. */
                 for (vq = dev->vq; vq; vq = vq->next) {
                         memset(vq->vring.desc, 0,
-                               vring_size(vq->config.num, getpagesize()));
+                               vring_size(vq->config.num, LGUEST_VRING_ALIGN));
                         lg_last_avail(vq) = 0;
                 }
         } else if (dev->desc->status & VIRTIO_CONFIG_S_FAILED) {
@@ -1211,7 +1166,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         void *p;
 
         /* First we need some memory for this virtqueue. */
-        pages = (vring_size(num_descs, getpagesize()) + getpagesize() - 1)
+        pages = (vring_size(num_descs, LGUEST_VRING_ALIGN) + getpagesize() - 1)
                 / getpagesize();
         p = get_pages(pages);
 
@@ -1228,7 +1183,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         vq->config.pfn = to_guest_phys(p) / getpagesize();
 
         /* Initialize the vring. */
-        vring_init(&vq->vring, num_descs, p, getpagesize());
+        vring_init(&vq->vring, num_descs, p, LGUEST_VRING_ALIGN);
 
         /* Append virtqueue to this device's descriptor.  We use
          * device_config() to get the end of the device's current virtqueues;
@@ -1941,7 +1896,7 @@ int main(int argc, char *argv[])
 {
         /* Memory, top-level pagetable, code startpoint and size of the
          * (optional) initrd. */
-        unsigned long mem = 0, pgdir, start, initrd_size = 0;
+        unsigned long mem = 0, start, initrd_size = 0;
         /* Two temporaries and the /dev/lguest file descriptor. */
         int i, c, lguest_fd;
         /* The boot information for the Guest. */
@@ -2040,9 +1995,6 @@ int main(int argc, char *argv[])
                 boot->hdr.type_of_loader = 0xFF;
         }
 
-        /* Set up the initial linear pagetables, starting below the initrd. */
-        pgdir = setup_pagetables(mem, initrd_size);
-
         /* The Linux boot header contains an "E820" memory map: ours is a
          * simple, single region. */
         boot->e820_entries = 1;
@@ -2064,7 +2016,7 @@ int main(int argc, char *argv[])
 
         /* We tell the kernel to initialize the Guest: this returns the open
          * /dev/lguest file descriptor. */
-        lguest_fd = tell_kernel(pgdir, start);
+        lguest_fd = tell_kernel(start);
 
         /* We clone off a thread, which wakes the Launcher whenever one of the
          * input file descriptors needs attention.  We call this the Waker, and
diff --git a/Documentation/lockstat.txt b/Documentation/lockstat.txt
index 4ba4664ce5c3..9cb9138f7a79 100644
--- a/Documentation/lockstat.txt
+++ b/Documentation/lockstat.txt
@@ -71,35 +71,50 @@ Look at the current lock statistics:
 
 # less /proc/lock_stat
 
-01 lock_stat version 0.2
+01 lock_stat version 0.3
 02 -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 03                               class name    con-bounces    contentions   waittime-min   waittime-max waittime-total    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total
 04 -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 05
-06               &inode->i_data.tree_lock-W:            15          21657           0.18     1093295.30 11547131054.85             58          10415           0.16          87.51        6387.60
-07               &inode->i_data.tree_lock-R:             0              0           0.00           0.00           0.00          23302         231198           0.25           8.45       98023.38
-08               --------------------------
-09                 &inode->i_data.tree_lock              0          [<ffffffff8027c08f>] add_to_page_cache+0x5f/0x190
-10
-11 ...............................................................................................................................................................................................
-12
-13                              dcache_lock:          1037           1161           0.38          45.32         774.51           6611         243371           0.15         306.48       77387.24
-14                              -----------
-15                              dcache_lock            180          [<ffffffff802c0d7e>] sys_getcwd+0x11e/0x230
-16                              dcache_lock            165          [<ffffffff802c002a>] d_alloc+0x15a/0x210
-17                              dcache_lock             33          [<ffffffff8035818d>] _atomic_dec_and_lock+0x4d/0x70
-18                              dcache_lock              1          [<ffffffff802beef8>] shrink_dcache_parent+0x18/0x130
+06                          &mm->mmap_sem-W:           233            538 18446744073708       22924.27      607243.51           1342          45806           1.71        8595.89     1180582.34
+07                          &mm->mmap_sem-R:           205            587 18446744073708       28403.36      731975.00           1940         412426           0.58      187825.45     6307502.88
+08                          ---------------
+09                            &mm->mmap_sem            487          [<ffffffff8053491f>] do_page_fault+0x466/0x928
+10                            &mm->mmap_sem            179          [<ffffffff802a6200>] sys_mprotect+0xcd/0x21d
+11                            &mm->mmap_sem            279          [<ffffffff80210a57>] sys_mmap+0x75/0xce
+12                            &mm->mmap_sem             76          [<ffffffff802a490b>] sys_munmap+0x32/0x59
+13                          ---------------
+14                            &mm->mmap_sem            270          [<ffffffff80210a57>] sys_mmap+0x75/0xce
+15                            &mm->mmap_sem            431          [<ffffffff8053491f>] do_page_fault+0x466/0x928
+16                            &mm->mmap_sem            138          [<ffffffff802a490b>] sys_munmap+0x32/0x59
+17                            &mm->mmap_sem            145          [<ffffffff802a6200>] sys_mprotect+0xcd/0x21d
+18
+19 ...............................................................................................................................................................................................
+20
+21                              dcache_lock:           621            623           0.52         118.26        1053.02           6745          91930           0.29         316.29      118423.41
+22                              -----------
+23                              dcache_lock            179          [<ffffffff80378274>] _atomic_dec_and_lock+0x34/0x54
+24                              dcache_lock            113          [<ffffffff802cc17b>] d_alloc+0x19a/0x1eb
+25                              dcache_lock             99          [<ffffffff802ca0dc>] d_rehash+0x1b/0x44
+26                              dcache_lock            104          [<ffffffff802cbca0>] d_instantiate+0x36/0x8a
+27                              -----------
+28                              dcache_lock            192          [<ffffffff80378274>] _atomic_dec_and_lock+0x34/0x54
+29                              dcache_lock             98          [<ffffffff802ca0dc>] d_rehash+0x1b/0x44
+30                              dcache_lock             72          [<ffffffff802cc17b>] d_alloc+0x19a/0x1eb
+31                              dcache_lock            112          [<ffffffff802cbca0>] d_instantiate+0x36/0x8a
 
 This excerpt shows the first two lock class statistics. Line 01 shows the
 output version - each time the format changes this will be updated. Line 02-04
-show the header with column descriptions. Lines 05-10 and 13-18 show the actual
+show the header with column descriptions. Lines 05-18 and 20-31 show the actual
 statistics. These statistics come in two parts; the actual stats separated by a
-short separator (line 08, 14) from the contention points.
+short separator (line 08, 13) from the contention points.
 
-The first lock (05-10) is a read/write lock, and shows two lines above the
+The first lock (05-18) is a read/write lock, and shows two lines above the
 short separator. The contention points don't match the column descriptors,
-they have two: contentions and [<IP>] symbol.
+they have two: contentions and [<IP>] symbol. The second set of contention
+points are the points we're contending with.
 
+The integer part of the time values is in us.
 
 View the top contending locks:
 
diff --git a/Documentation/markers.txt b/Documentation/markers.txt
index 089f6138fcd9..d2b3d0e91b26 100644
--- a/Documentation/markers.txt
+++ b/Documentation/markers.txt
@@ -51,11 +51,16 @@ to call) for the specific marker through marker_probe_register() and can be
 activated by calling marker_arm(). Marker deactivation can be done by calling
 marker_disarm() as many times as marker_arm() has been called. Removing a probe
 is done through marker_probe_unregister(); it will disarm the probe.
-marker_synchronize_unregister() must be called before the end of the module exit
-function to make sure there is no caller left using the probe. This, and the
-fact that preemption is disabled around the probe call, make sure that probe
-removal and module unload are safe. See the "Probe example" section below for a
-sample probe module.
+
+marker_synchronize_unregister() must be called between probe unregistration and
+the first occurrence of
+- the end of module exit function,
+  to make sure there is no caller left using the probe;
+- the free of any resource used by the probes,
+  to make sure the probes wont be accessing invalid data.
+This, and the fact that preemption is disabled around the probe call, make sure
+that probe removal and module unload are safe. See the "Probe example" section
+below for a sample probe module.
 
 The marker mechanism supports inserting multiple instances of the same marker.
 Markers can be put in inline functions, inlined static functions, and
@@ -70,6 +75,20 @@ a printk warning which identifies the inconsistency:
 
 "Format mismatch for probe probe_name (format), marker (format)"
 
+Another way to use markers is to simply define the marker without generating any
+function call to actually call into the marker. This is useful in combination
+with tracepoint probes in a scheme like this :
+
+void probe_tracepoint_name(unsigned int arg1, struct task_struct *tsk);
+
+DEFINE_MARKER_TP(marker_eventname, tracepoint_name, probe_tracepoint_name,
+        "arg1 %u pid %d");
+
+notrace void probe_tracepoint_name(unsigned int arg1, struct task_struct *tsk)
+{
+        struct marker *marker = &GET_MARKER(kernel_irq_entry);
+        /* write data to trace buffers ... */
+}
 
 * Probe / marker example
 
diff --git a/Documentation/networking/README.ipw2200 b/Documentation/networking/README.ipw2200
index 4f2a40f1dbc6..80c728522c4c 100644
--- a/Documentation/networking/README.ipw2200
+++ b/Documentation/networking/README.ipw2200
@@ -147,7 +147,7 @@ Where the supported parameter are:
         driver.  If disabled, the driver will not attempt to scan 
         for and associate to a network until it has been configured with 
         one or more properties for the target network, for example configuring 
-        the network SSID.  Default is 1 (auto-associate)
+        the network SSID.  Default is 0 (do not auto-associate)
         
         Example: % modprobe ipw2200 associate=0
 
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 688dfe1e6b70..5ede7473b425 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -194,6 +194,48 @@ or, for backwards compatibility, the option value.  E.g.,
 
         The parameters are as follows:
 
+ad_select
+
+        Specifies the 802.3ad aggregation selection logic to use.  The
+        possible values and their effects are:
+
+        stable or 0
+
+                The active aggregator is chosen by largest aggregate
+                bandwidth.
+
+                Reselection of the active aggregator occurs only when all
+                slaves of the active aggregator are down or the active
+                aggregator has no slaves.
+
+                This is the default value.
+
+        bandwidth or 1
+
+                The active aggregator is chosen by largest aggregate
+                bandwidth.  Reselection occurs if:
+
+                - A slave is added to or removed from the bond
+
+                - Any slave's link state changes
+
+                - Any slave's 802.3ad association state changes
+
+                - The bond's adminstrative state changes to up
+
+        count or 2
+
+                The active aggregator is chosen by the largest number of
+                ports (slaves).  Reselection occurs as described under the
+                "bandwidth" setting, above.
+
+        The bandwidth and count selection policies permit failover of
+        802.3ad aggregations when partial failure of the active aggregator
+        occurs.  This keeps the aggregator with the highest availability
+        (either in bandwidth or in number of ports) active at all times.
+
+        This option was added in bonding version 3.4.0.
+
 arp_interval
 
         Specifies the ARP link monitoring frequency in milliseconds.
@@ -551,6 +593,16 @@ num_grat_arp
         affects only the active-backup mode.  This option was added for
         bonding version 3.3.0.
 
+num_unsol_na
+
+        Specifies the number of unsolicited IPv6 Neighbor Advertisements
+        to be issued after a failover event.  One unsolicited NA is issued
+        immediately after the failover.
+
+        The valid range is 0 - 255; the default value is 1.  This option
+        affects only the active-backup mode.  This option was added for
+        bonding version 3.4.0.
+
 primary
 
         A string (eth0, eth2, etc) specifying which slave is the
@@ -922,17 +974,19 @@ USERCTL=no
 NETMASK, NETWORK and BROADCAST) to match your network configuration.
 
         For later versions of initscripts, such as that found with Fedora
-7 and Red Hat Enterprise Linux version 5 (or later), it is possible, and,
-indeed, preferable, to specify the bonding options in the ifcfg-bond0
+7 (or later) and Red Hat Enterprise Linux version 5 (or later), it is possible,
+and, indeed, preferable, to specify the bonding options in the ifcfg-bond0
 file, e.g. a line of the format:
 
-BONDING_OPTS="mode=active-backup arp_interval=60 arp_ip_target=+192.168.1.254"
+BONDING_OPTS="mode=active-backup arp_interval=60 arp_ip_target=192.168.1.254"
 
         will configure the bond with the specified options.  The options
 specified in BONDING_OPTS are identical to the bonding module parameters
-except for the arp_ip_target field.  Each target should be included as a
-separate option and should be preceded by a '+' to indicate it should be
-added to the list of queried targets, e.g.,
+except for the arp_ip_target field when using versions of initscripts older
+than and 8.57 (Fedora 8) and 8.45.19 (Red Hat Enterprise Linux 5.2).  When
+using older versions each target should be included as a separate option and
+should be preceded by a '+' to indicate it should be added to the list of
+queried targets, e.g.,
 
         arp_ip_target=+192.168.1.1 arp_ip_target=+192.168.1.2
 
@@ -940,7 +994,7 @@ added to the list of queried targets, e.g.,
 options via BONDING_OPTS, it is not necessary to edit /etc/modules.conf or
 /etc/modprobe.conf.
 
-        For older versions of initscripts that do not support
+        For even older versions of initscripts that do not support
 BONDING_OPTS, it is necessary to edit /etc/modules.conf (or
 /etc/modprobe.conf, depending upon your distro) to load the bonding module
 with your desired options when the bond0 interface is brought up.  The
diff --git a/Documentation/networking/dccp.txt b/Documentation/networking/dccp.txt
index 39131a3c78f8..7a3bb1abb830 100644
--- a/Documentation/networking/dccp.txt
+++ b/Documentation/networking/dccp.txt
@@ -57,6 +57,24 @@ can be set before calling bind().
 DCCP_SOCKOPT_GET_CUR_MPS is read-only and retrieves the current maximum packet
 size (application payload size) in bytes, see RFC 4340, section 14.
 
+DCCP_SOCKOPT_AVAILABLE_CCIDS is also read-only and returns the list of CCIDs
+supported by the endpoint (see include/linux/dccp.h for symbolic constants).
+The caller needs to provide a sufficiently large (> 2) array of type uint8_t.
+
+DCCP_SOCKOPT_CCID is write-only and sets both the TX and RX CCIDs at the same
+time, combining the operation of the next two socket options. This option is
+preferrable over the latter two, since often applications will use the same
+type of CCID for both directions; and mixed use of CCIDs is not currently well
+understood. This socket option takes as argument at least one uint8_t value, or
+an array of uint8_t values, which must match available CCIDS (see above). CCIDs
+must be registered on the socket before calling connect() or listen().
+
+DCCP_SOCKOPT_TX_CCID is read/write. It returns the current CCID (if set) or sets
+the preference list for the TX CCID, using the same format as DCCP_SOCKOPT_CCID.
+Please note that the getsockopt argument type here is `int', not uint8_t.
+
+DCCP_SOCKOPT_RX_CCID is analogous to DCCP_SOCKOPT_TX_CCID, but for the RX CCID.
+
 DCCP_SOCKOPT_SERVER_TIMEWAIT enables the server (listening socket) to hold
 timewait state when closing the connection (RFC 4340, 8.3). The usual case is
 that the closing server sends a CloseReq, whereupon the client holds timewait
@@ -115,20 +133,12 @@ retries2
         importance for retransmitted acknowledgments and feature negotiation,
         data packets are never retransmitted. Analogue of tcp_retries2.
 
-send_ndp = 1
-        Whether or not to send NDP count options (sec. 7.7.2).
-
-send_ackvec = 1
-        Whether or not to send Ack Vector options (sec. 11.5).
-
-ack_ratio = 2
-        The default Ack Ratio (sec. 11.3) to use.
-
 tx_ccid = 2
-        Default CCID for the sender-receiver half-connection.
+        Default CCID for the sender-receiver half-connection. Depending on the
+        choice of CCID, the Send Ack Vector feature is enabled automatically.
 
 rx_ccid = 2
-        Default CCID for the receiver-sender half-connection.
+        Default CCID for the receiver-sender half-connection; see tx_ccid.
 
 seq_window = 100
         The initial sequence window (sec. 7.5.2).
diff --git a/Documentation/networking/driver.txt b/Documentation/networking/driver.txt
index ea72d2e66ca8..03283daa64fe 100644
--- a/Documentation/networking/driver.txt
+++ b/Documentation/networking/driver.txt
@@ -13,7 +13,7 @@ Transmit path guidelines:
         static int drv_hard_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev)
         {
-                struct drv *dp = dev->priv;
+                struct drv *dp = netdev_priv(dev);
 
                 lock_tx(dp);
                 ...
diff --git a/Documentation/networking/generic-hdlc.txt b/Documentation/networking/generic-hdlc.txt
index 31bc8b759b75..4eb3cc40b702 100644
--- a/Documentation/networking/generic-hdlc.txt
+++ b/Documentation/networking/generic-hdlc.txt
@@ -3,15 +3,15 @@ Krzysztof Halasa <khc@pm.waw.pl>
 
 
 Generic HDLC layer currently supports:
-1. Frame Relay (ANSI, CCITT, Cisco and no LMI).
+1. Frame Relay (ANSI, CCITT, Cisco and no LMI)
    - Normal (routed) and Ethernet-bridged (Ethernet device emulation)
      interfaces can share a single PVC.
    - ARP support (no InARP support in the kernel - there is an
      experimental InARP user-space daemon available on:
      http://www.kernel.org/pub/linux/utils/net/hdlc/).
-2. raw HDLC - either IP (IPv4) interface or Ethernet device emulation.
-3. Cisco HDLC.
-4. PPP (uses syncppp.c).
+2. raw HDLC - either IP (IPv4) interface or Ethernet device emulation
+3. Cisco HDLC
+4. PPP
 5. X.25 (uses X.25 routines).
 
 Generic HDLC is a protocol driver only - it needs a low-level driver
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d84932650fd3..c7712787933c 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -27,6 +27,12 @@ min_adv_mss - INTEGER
         The advertised MSS depends on the first hop route MTU, but will
         never be lower than this setting.
 
+rt_cache_rebuild_count - INTEGER
+        The per net-namespace route cache emergency rebuild threshold.
+        Any net-namespace having its route cache rebuilt due to
+        a hash bucket chain being too long more than this many times
+        will have its route caching disabled
+
 IP Fragmentation:
 
 ipfrag_high_thresh - INTEGER
diff --git a/Documentation/networking/mac80211_hwsim/README b/Documentation/networking/mac80211_hwsim/README
index 2ff8ccb8dc37..24ac91d56698 100644
--- a/Documentation/networking/mac80211_hwsim/README
+++ b/Documentation/networking/mac80211_hwsim/README
@@ -50,10 +50,6 @@ associates with the AP. hostapd and wpa_supplicant are used to take
 care of WPA2-PSK authentication. In addition, hostapd is also
 processing access point side of association.
 
-Please note that the current Linux kernel does not enable AP mode, so a
-simple patch is needed to enable AP mode selection:
-http://johannes.sipsolutions.net/patches/kernel/all/LATEST/006-allow-ap-vlan-modes.patch
-
 
 # Build mac80211_hwsim as part of kernel configuration
 
@@ -65,3 +61,8 @@ hostapd hostapd.conf
 
 # Run wpa_supplicant (station) for wlan1
 wpa_supplicant -Dwext -iwlan1 -c wpa_supplicant.conf
+
+
+More test cases are available in hostap.git:
+git://w1.fi/srv/git/hostap.git and mac80211_hwsim/tests subdirectory
+(http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=tree;f=mac80211_hwsim/tests)
diff --git a/Documentation/networking/netdevices.txt b/Documentation/networking/netdevices.txt
index d0f71fc7f782..a2ab6a0b116d 100644
--- a/Documentation/networking/netdevices.txt
+++ b/Documentation/networking/netdevices.txt
@@ -18,7 +18,7 @@ There are routines in net_init.c to handle the common cases of
 alloc_etherdev, alloc_netdev.  These reserve extra space for driver
 private data which gets freed when the network device is freed. If
 separately allocated data is attached to the network device
-(dev->priv) then it is up to the module exit handler to free that.
+(netdev_priv(dev)) then it is up to the module exit handler to free that.
 
 MTU
 ===
diff --git a/Documentation/networking/regulatory.txt b/Documentation/networking/regulatory.txt
index a96989a8ff35..dcf31648414a 100644
--- a/Documentation/networking/regulatory.txt
+++ b/Documentation/networking/regulatory.txt
@@ -131,11 +131,13 @@ are expected to do this during initialization.
 
         r = zd_reg2alpha2(mac->regdomain, alpha2);
         if (!r)
-                regulatory_hint(hw->wiphy, alpha2, NULL);
+                regulatory_hint(hw->wiphy, alpha2);
 
 Example code - drivers providing a built in regulatory domain:
 --------------------------------------------------------------
 
+[NOTE: This API is not currently available, it can be added when required]
+
 If you have regulatory information you can obtain from your
 driver and you *need* to use this we let you build a regulatory domain
 structure and pass it to the wireless core. To do this you should
@@ -167,7 +169,6 @@ struct ieee80211_regdomain mydriver_jp_regdom = {
 
 Then in some part of your code after your wiphy has been registered:
 
-        int r;
         struct ieee80211_regdomain *rd;
         int size_of_regd;
         int num_rules = mydriver_jp_regdom.n_reg_rules;
@@ -178,17 +179,12 @@ Then in some part of your code after your wiphy has been registered:
 
         rd = kzalloc(size_of_regd, GFP_KERNEL);
         if (!rd)
-        return -ENOMEM;
+                return -ENOMEM;
 
         memcpy(rd, &mydriver_jp_regdom, sizeof(struct ieee80211_regdomain));
 
-        for (i=0; i < num_rules; i++) {
-                memcpy(&rd->reg_rules[i], &mydriver_jp_regdom.reg_rules[i],
-                        sizeof(struct ieee80211_reg_rule));
-        }
-        r = regulatory_hint(hw->wiphy, NULL, rd);
-        if (r) {
-                kfree(rd);
-                return r;
-        }
-
+        for (i=0; i < num_rules; i++)
+                memcpy(&rd->reg_rules[i],
+                       &mydriver_jp_regdom.reg_rules[i],
+                       sizeof(struct ieee80211_reg_rule));
+        regulatory_struct_hint(rd);
diff --git a/Documentation/nmi_watchdog.txt b/Documentation/nmi_watchdog.txt
index 90aa4531cb67..bf9f80a98282 100644
--- a/Documentation/nmi_watchdog.txt
+++ b/Documentation/nmi_watchdog.txt
@@ -69,6 +69,11 @@ to the overall system performance.
 On x86 nmi_watchdog is disabled by default so you have to enable it with
 a boot time parameter.
 
+It's possible to disable the NMI watchdog in run-time by writing "0" to
+/proc/sys/kernel/nmi_watchdog. Writing "1" to the same file will re-enable
+the NMI watchdog. Notice that you still need to use "nmi_watchdog=" parameter
+at boot time.
+
 NOTE: In kernels prior to 2.4.2-ac18 the NMI-oopser is enabled unconditionally
 on x86 SMP boxes.
 
diff --git a/Documentation/powerpc/dts-bindings/fsl/tsec.txt b/Documentation/powerpc/dts-bindings/fsl/tsec.txt
index cf55fa4112d2..7fa4b27574b5 100644
--- a/Documentation/powerpc/dts-bindings/fsl/tsec.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/tsec.txt
@@ -2,8 +2,8 @@
 
 The MDIO is a bus to which the PHY devices are connected.  For each
 device that exists on this bus, a child node should be created.  See
-the definition of the PHY node below for an example of how to define
-a PHY.
+the definition of the PHY node in booting-without-of.txt for an example
+of how to define a PHY.
 
 Required properties:
   - reg : Offset and length of the register set for the device
@@ -21,6 +21,14 @@ Example:
                 };
         };
 
+* TBI Internal MDIO bus
+
+As of this writing, every tsec is associated with an internal TBI PHY.
+This PHY is accessed through the local MDIO bus.  These buses are defined
+similarly to the mdio buses, except they are compatible with "fsl,gianfar-tbi".
+The TBI PHYs underneath them are similar to normal PHYs, but the reg property
+is considered instructive, rather than descriptive.  The reg property should
+be chosen so it doesn't interfere with other PHYs on the bus.
 
 * Gianfar-compatible ethernet nodes
 
diff --git a/Documentation/rfkill.txt b/Documentation/rfkill.txt
index b65f0799df48..4d3ee317a4a3 100644
--- a/Documentation/rfkill.txt
+++ b/Documentation/rfkill.txt
@@ -191,12 +191,20 @@ Userspace input handlers (uevents) or kernel input handlers (rfkill-input):
           to tell the devices registered with the rfkill class to change
           their state (i.e. translates the input layer event into real
           action).
+
         * rfkill-input implements EPO by handling EV_SW SW_RFKILL_ALL 0
           (power off all transmitters) in a special way: it ignores any
           overrides and local state cache and forces all transmitters to the
           RFKILL_STATE_SOFT_BLOCKED state (including those which are already
-          supposed to be BLOCKED).  Note that the opposite event (power on all
-          transmitters) is handled normally.
+          supposed to be BLOCKED).
+        * rfkill EPO will remain active until rfkill-input receives an
+          EV_SW SW_RFKILL_ALL 1 event.  While the EPO is active, transmitters
+          are locked in the blocked state (rfkill will refuse to unblock them).
+        * rfkill-input implements different policies that the user can
+          select for handling EV_SW SW_RFKILL_ALL 1.  It will unlock rfkill,
+          and either do nothing (leave transmitters blocked, but now unlocked),
+          restore the transmitters to their state before the EPO, or unblock
+          them all.
 
 Userspace uevent handler or kernel platform-specific drivers hooked to the
 rfkill notifier chain:
@@ -331,11 +339,9 @@ class to get a sysfs interface :-)
 correct event for your switch/button.  These events are emergency power-off
 events when they are trying to turn the transmitters off.  An example of an
 input device which SHOULD generate *_RFKILL_ALL events is the wireless-kill
-switch in a laptop which is NOT a hotkey, but a real switch that kills radios
-in hardware, even if the O.S. has gone to lunch.  An example of an input device
-which SHOULD NOT generate *_RFKILL_ALL events by default, is any sort of hot
-key that does nothing by itself, as well as any hot key that is type-specific
-(e.g. the one for WLAN).
+switch in a laptop which is NOT a hotkey, but a real sliding/rocker switch.
+An example of an input device which SHOULD NOT generate *_RFKILL_ALL events by
+default, is any sort of hot key that is type-specific (e.g. the one for WLAN).
 
 
 3.1 Guidelines for wireless device drivers
diff --git a/Documentation/scheduler/sched-arch.txt b/Documentation/scheduler/sched-arch.txt
index 941615a9769b..d43dbcbd163b 100644
--- a/Documentation/scheduler/sched-arch.txt
+++ b/Documentation/scheduler/sched-arch.txt
@@ -8,7 +8,7 @@ Context switch
 By default, the switch_to arch function is called with the runqueue
 locked. This is usually not a problem unless switch_to may need to
 take the runqueue lock. This is usually due to a wake up operation in
-the context switch. See include/asm-ia64/system.h for an example.
+the context switch. See arch/ia64/include/asm/system.h for an example.
 
 To request the scheduler call switch_to with the runqueue unlocked,
 you must `#define __ARCH_WANT_UNLOCKED_CTXSW` in a header file
@@ -23,7 +23,7 @@ disabled. Interrupts may be enabled over the call if it is likely to
 introduce a significant interrupt latency by adding the line
 `#define __ARCH_WANT_INTERRUPTS_ON_CTXSW` in the same place as for
 unlocked context switches. This define also implies
-`__ARCH_WANT_UNLOCKED_CTXSW`. See include/asm-arm/system.h for an
+`__ARCH_WANT_UNLOCKED_CTXSW`. See arch/arm/include/asm/system.h for an
 example.
 
 
diff --git a/Documentation/scheduler/sched-design-CFS.txt b/Documentation/scheduler/sched-design-CFS.txt
index eb471c7a905e..8398ca4ff4ed 100644
--- a/Documentation/scheduler/sched-design-CFS.txt
+++ b/Documentation/scheduler/sched-design-CFS.txt
@@ -273,3 +273,24 @@ task groups and modify their CPU share using the "cgroups" pseudo filesystem.
 
         # #Launch gmplayer (or your favourite movie player)
         # echo <movie_player_pid> > multimedia/tasks
+
+8. Implementation note: user namespaces
+
+User namespaces are intended to be hierarchical.  But they are currently
+only partially implemented.  Each of those has ramifications for CFS.
+
+First, since user namespaces are hierarchical, the /sys/kernel/uids
+presentation is inadequate.  Eventually we will likely want to use sysfs
+tagging to provide private views of /sys/kernel/uids within each user
+namespace.
+
+Second, the hierarchical nature is intended to support completely
+unprivileged use of user namespaces.  So if using user groups, then
+we want the users in a user namespace to be children of the user
+who created it.
+
+That is currently unimplemented.  So instead, every user in a new
+user namespace will receive 1024 shares just like any user in the
+initial user namespace.  Note that at the moment creation of a new
+user namespace requires each of CAP_SYS_ADMIN, CAP_SETUID, and
+CAP_SETGID.
diff --git a/Documentation/scsi/cxgb3i.txt b/Documentation/scsi/cxgb3i.txt
new file mode 100644
index 000000000000..8141fa01978e
--- /dev/null
+++ b/Documentation/scsi/cxgb3i.txt
@@ -0,0 +1,85 @@
+Chelsio S3 iSCSI Driver for Linux
+
+Introduction
+============
+
+The Chelsio T3 ASIC based Adapters (S310, S320, S302, S304, Mezz cards, etc.
+series of products) supports iSCSI acceleration and iSCSI Direct Data Placement
+(DDP) where the hardware handles the expensive byte touching operations, such
+as CRC computation and verification, and direct DMA to the final host memory
+destination:
+
+        - iSCSI PDU digest generation and verification
+
+          On transmitting, Chelsio S3 h/w computes and inserts the Header and
+          Data digest into the PDUs.
+          On receiving, Chelsio S3 h/w computes and verifies the Header and
+          Data digest of the PDUs.
+
+        - Direct Data Placement (DDP)
+
+          S3 h/w can directly place the iSCSI Data-In or Data-Out PDU's
+          payload into pre-posted final destination host-memory buffers based
+          on the Initiator Task Tag (ITT) in Data-In or Target Task Tag (TTT)
+          in Data-Out PDUs.
+
+        - PDU Transmit and Recovery
+
+          On transmitting, S3 h/w accepts the complete PDU (header + data)
+          from the host driver, computes and inserts the digests, decomposes
+          the PDU into multiple TCP segments if necessary, and transmit all
+          the TCP segments onto the wire. It handles TCP retransmission if
+          needed.
+
+          On receving, S3 h/w recovers the iSCSI PDU by reassembling TCP
+          segments, separating the header and data, calculating and verifying
+          the digests, then forwards the header to the host. The payload data,
+          if possible, will be directly placed into the pre-posted host DDP
+          buffer. Otherwise, the payload data will be sent to the host too.
+
+The cxgb3i driver interfaces with open-iscsi initiator and provides the iSCSI
+acceleration through Chelsio hardware wherever applicable.
+
+Using the cxgb3i Driver
+=======================
+
+The following steps need to be taken to accelerates the open-iscsi initiator:
+
+1. Load the cxgb3i driver: "modprobe cxgb3i"
+
+   The cxgb3i module registers a new transport class "cxgb3i" with open-iscsi.
+
+   * in the case of recompiling the kernel, the cxgb3i selection is located at
+        Device Drivers
+                SCSI device support --->
+                        [*] SCSI low-level drivers  --->
+                                <M>   Chelsio S3xx iSCSI support
+
+2. Create an interface file located under /etc/iscsi/ifaces/ for the new
+   transport class "cxgb3i".
+
+   The content of the file should be in the following format:
+        iface.transport_name = cxgb3i
+        iface.net_ifacename = <ethX>
+        iface.ipaddress = <iscsi ip address>
+
+   * if iface.ipaddress is specified, <iscsi ip address> needs to be either the
+        same as the ethX's ip address or an address on the same subnet. Make
+        sure the ip address is unique in the network.
+
+3. edit /etc/iscsi/iscsid.conf
+   The default setting for MaxRecvDataSegmentLength (131072) is too big,
+   replace "node.conn[0].iscsi.MaxRecvDataSegmentLength" to be a value no
+   bigger than 15360 (for example 8192):
+
+        node.conn[0].iscsi.MaxRecvDataSegmentLength = 8192
+
+   * The login would fail for a normal session if MaxRecvDataSegmentLength is
+        too big.  A error message in the format of
+        "cxgb3i: ERR! MaxRecvSegmentLength <X> too big. Need to be <= <Y>."
+        would be logged to dmesg.
+
+4. To direct open-iscsi traffic to go through cxgb3i's accelerated path,
+   "-I <iface file name>" option needs to be specified with most of the
+   iscsiadm command. <iface file name> is the transport interface file created
+   in step 2.
diff --git a/Documentation/sh/kgdb.txt b/Documentation/sh/kgdb.txt
deleted file mode 100644
index 05b4ba89d28c..000000000000
--- a/Documentation/sh/kgdb.txt
+++ /dev/null
@@ -1,179 +0,0 @@
-
-This file describes the configuration and behavior of KGDB for the SH
-kernel. Based on a description from Henry Bell <henry.bell@st.com>, it
-has been modified to account for quirks in the current implementation.
-
-Version
-=======
-
-This version of KGDB was written for 2.4.xx kernels for the SH architecture.
-Further documentation is available from the linux-sh project website.
-
-
-Debugging Setup: Host
-======================
-
-The two machines will be connected together via a serial line - this
-should be a null modem cable i.e. with a twist.
-
-On your DEVELOPMENT machine, go to your kernel source directory and
-build the kernel, enabling KGDB support in the "kernel hacking" section.
-This includes the KGDB code, and also makes the kernel be compiled with
-the "-g" option set -- necessary for debugging.
-
-To install this new kernel, use the following installation procedure.
-
-Decide on which tty port you want the machines to communicate, then
-cable them up back-to-back using the null modem.  On the DEVELOPMENT
-machine, you may wish to create an initialization file called .gdbinit
-(in the kernel source directory or in your home directory) to execute 
-commonly-used commands at startup.
-
-A minimal .gdbinit might look like this:
-
-  file vmlinux
-  set remotebaud 115200
-  target remote /dev/ttyS0
-
-Change the "target" definition so that it specifies the tty port that
-you intend to use.  Change the "remotebaud" definition to match the
-data rate that you are going to use for the com line (115200 is the
-default). 
-
-Debugging Setup: Target
-========================
-
-By default, the KGDB stub will communicate with the host GDB using
-ttySC1 at 115200 baud, 8 databits, no parity; these defaults can be
-changed in the kernel configuration. As the kernel starts up, KGDB will
-initialize so that breakpoints, kernel segfaults, and so forth will
-generally enter the debugger.
-
-This behavior can be modified by including the "kgdb" option in the
-kernel command line; this option has the general form:
-
-  kgdb=<ttyspec>,<action>
-
-The <ttyspec> indicates the port to use, and can optionally specify
-baud, parity and databits -- e.g. "ttySC0,9600N8" or "ttySC1,19200".
-
-The <action> can be "halt" or "disabled".  The "halt" action enters the
-debugger via a breakpoint as soon as kgdb is initialized; the "disabled"
-action causes kgdb to ignore kernel segfaults and such until explicitly
-entered by a breakpoint in the code or by external action (sysrq or NMI). 
-
-(Both <ttyspec> and <action> can appear alone, w/o the separating comma.)
-
-For example, if you wish to debug early in kernel startup code, you
-might specify the halt option:
-
-  kgdb=halt
-
-Boot the TARGET machine, which will appear to hang. 
-
-On your DEVELOPMENT machine, cd to the source directory and run the gdb
-program.  (This is likely to be a cross GDB which runs on your host but
-is built for an SH target.) If everything is working correctly you
-should see gdb print out a few lines indicating that a breakpoint has
-been taken.  It will actually show a line of code in the target kernel
-inside the gdbstub activation code.
-
-NOTE: BE SURE TO TERMINATE OR SUSPEND any other host application which
-may be using the same serial port (for example, a terminal emulator you
-have been using to connect to the target boot code.)  Otherwise, data
-from the target may not all get to GDB!
-
-You can now use whatever gdb commands you like to set breakpoints.
-Enter "continue" to start your target machine executing again.  At this
-point the target system will run at full speed until it encounters
-your breakpoint or gets a segment violation in the kernel, or whatever.
-
-Serial Ports: KGDB, Console
-============================
-
-This version of KGDB may not gracefully handle conflict with other
-drivers in the kernel using the same port. If KGDB is configured on the
-same port (and with the same parameters) as the kernel console, or if
-CONFIG_SH_KGDB_CONSOLE is configured, things should be fine (though in
-some cases console messages may appear twice through GDB).  But if the
-KGDB port is not the kernel console and used by another serial driver
-which assumes different serial parameters (e.g. baud rate) KGDB may not
-recover.
-
-Also, when KGDB is entered via sysrq-g (requires CONFIG_KGDB_SYSRQ) and
-the kgdb port uses the same port as the console, detaching GDB will not
-restore the console to working order without the port being re-opened.
-
-Another serious consequence of this is that GDB currently CANNOT break
-into KGDB externally (e.g. via ^C or <BREAK>); unless a breakpoint or
-error is encountered, the only way to enter KGDB after the initial halt
-(see above) is via NMI (CONFIG_KGDB_NMI) or sysrq-g (CONFIG_KGDB_SYSRQ).
-
-Code is included for the basic Hitachi Solution Engine boards to allow
-the use of ttyS0 for KGDB if desired; this is less robust, but may be
-useful in some cases.  (This cannot be selected using the config file, 
-but only through the kernel command line, e.g. "kgdb=ttyS0", though the
-configured defaults for baud rate etc. still apply if not overridden.)
-
-If gdbstub Does Not Work
-========================
-
-If it doesn't work, you will have to troubleshoot it.  Do the easy
-things first like double checking your cabling and data rates.  You
-might try some non-kernel based programs to see if the back-to-back
-connection works properly.  Just something simple like cat /etc/hosts
-/dev/ttyS0 on one machine and cat /dev/ttyS0 on the other will tell you
-if you can send data from one machine to the other.  There is no point
-in tearing out your hair in the kernel if the line doesn't work.
-
-If you need to debug the GDB/KGDB communication itself, the gdb commands
-"set debug remote 1" and "set debug serial 1" may be useful, but be
-warned: they produce a lot of output.
-
-Threads
-=======
-
-Each process in a target machine is seen as a gdb thread. gdb thread related
-commands (info threads, thread n) can be used. CONFIG_KGDB_THREAD must
-be defined for this to work.
-
-In this version, kgdb reports PID_MAX (32768) as the process ID for the
-idle process (pid 0), since GDB does not accept 0 as an ID.
-
-Detaching (exiting KGDB)
-=========================
-
-There are two ways to resume full-speed target execution: "continue" and
-"detach". With "continue", GDB inserts any specified breakpoints in the
-target code and resumes execution; the target is still in "gdb mode".
-If a breakpoint or other debug event (e.g. NMI) happens, the target
-halts and communicates with GDB again, which is waiting for it.
-
-With "detach", GDB does *not* insert any breakpoints; target execution
-is resumed and GDB stops communicating (does not wait for the target).
-In this case, the target is no longer in "gdb mode" -- for example,
-console messages no longer get sent separately to the KGDB port, or
-encapsulated for GDB.  If a debug event (e.g. NMI) occurs, the target
-will re-enter "gdb mode" and will display this fact on the console; you
-must give a new "target remote" command to gdb.
-
-NOTE: TO AVOID LOSSING CONSOLE MESSAGES IN CASE THE KERNEL CONSOLE AND
-KGDB USING THE SAME PORT, THE TARGET WAITS FOR ANY INPUT CHARACTER ON
-THE KGDB PORT AFTER A DETACH COMMAND.  For example, after the detach you
-could start a terminal emulator on the same host port and enter a <cr>;
-however, this program must then be terminated or suspended in order to
-use GBD again if KGDB is re-entered.
-
-
-Acknowledgements
-================
-
-This code was mostly generated by Henry Bell <henry.bell@st.com>;
-largely from KGDB by Amit S. Kale <akale@veritas.com> - extracts from
-code by Glenn Engel, Jim Kingdon, David Grothe <dave@gcom.com>, Tigran
-Aivazian <tigran@sco.com>, William Gatliff <bgat@open-widgets.com>, Ben
-Lee, Steve Chamberlain and Benoit Miller <fulg@iname.com> are also
-included. 
-
-Jeremy Siegel
-<jsiegel@mvista.com>
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 3cd2ad958176..841a9365d5fd 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -757,6 +757,8 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     model       - force the model name
     position_fix - Fix DMA pointer (0 = auto, 1 = use LPIB, 2 = POSBUF)
     probe_mask  - Bitmask to probe codecs (default = -1, meaning all slots)
+    probe_only  - Only probing and no codec initialization (default=off);
+                  Useful to check the initial codec status for debugging
     bdl_pos_adj - Specifies the DMA IRQ timing delay in samples.
                 Passing -1 will make the driver to choose the appropriate
                 value based on the controller chip.
@@ -772,325 +774,23 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     This module supports multiple cards and autoprobe.
     
+    See Documentation/sound/alsa/HD-Audio.txt for more details about
+    HD-audio driver.
+
     Each codec may have a model table for different configurations.
     If your machine isn't listed there, the default (usually minimal)
     configuration is set up.  You can pass "model=<name>" option to
     specify a certain model in such a case.  There are different
-    models depending on the codec chip.
-
-          Model name    Description
-          ----------    -----------
-        ALC880
-          3stack        3-jack in back and a headphone out
-          3stack-digout 3-jack in back, a HP out and a SPDIF out
-          5stack        5-jack in back, 2-jack in front
-          5stack-digout 5-jack in back, 2-jack in front, a SPDIF out
-          6stack        6-jack in back, 2-jack in front
-          6stack-digout 6-jack with a SPDIF out
-          w810          3-jack
-          z71v          3-jack (HP shared SPDIF)
-          asus          3-jack (ASUS Mobo)
-          asus-w1v      ASUS W1V
-          asus-dig      ASUS with SPDIF out
-          asus-dig2     ASUS with SPDIF out (using GPIO2)
-          uniwill       3-jack
-          fujitsu       Fujitsu Laptops (Pi1536)
-          F1734         2-jack
-          lg            LG laptop (m1 express dual)
-          lg-lw         LG LW20/LW25 laptop
-          tcl           TCL S700
-          clevo         Clevo laptops (m520G, m665n)
-          medion        Medion Rim 2150
-          test          for testing/debugging purpose, almost all controls can be
-                        adjusted.  Appearing only when compiled with
-                        $CONFIG_SND_DEBUG=y
-          auto          auto-config reading BIOS (default)
-
-        ALC260
-          hp            HP machines
-          hp-3013       HP machines (3013-variant)
-          hp-dc7600     HP DC7600
-          fujitsu       Fujitsu S7020
-          acer          Acer TravelMate
-          will          Will laptops (PB V7900)
-          replacer      Replacer 672V
-          basic         fixed pin assignment (old default model)
-          test          for testing/debugging purpose, almost all controls can
-                        adjusted.  Appearing only when compiled with
-                        $CONFIG_SND_DEBUG=y
-          auto          auto-config reading BIOS (default)
-
-        ALC262
-          fujitsu       Fujitsu Laptop
-          hp-bpc        HP xw4400/6400/8400/9400 laptops
-          hp-bpc-d7000  HP BPC D7000
-          hp-tc-t5735   HP Thin Client T5735
-          hp-rp5700     HP RP5700
-          benq          Benq ED8
-          benq-t31      Benq T31
-          hippo         Hippo (ATI) with jack detection, Sony UX-90s
-          hippo_1       Hippo (Benq) with jack detection
-          sony-assamd   Sony ASSAMD
-          toshiba-s06   Toshiba S06
-          toshiba-rx1   Toshiba RX1
-          ultra         Samsung Q1 Ultra Vista model
-          lenovo-3000   Lenovo 3000 y410
-          nec           NEC Versa S9100
-          basic         fixed pin assignment w/o SPDIF
-          auto          auto-config reading BIOS (default)
-
-        ALC267/268
-          quanta-il1    Quanta IL1 mini-notebook
-          3stack        3-stack model
-          toshiba       Toshiba A205
-          acer          Acer laptops
-          acer-aspire   Acer Aspire One
-          dell          Dell OEM laptops (Vostro 1200)
-          zepto         Zepto laptops
-          test          for testing/debugging purpose, almost all controls can
-                        adjusted.  Appearing only when compiled with
-                        $CONFIG_SND_DEBUG=y
-          auto          auto-config reading BIOS (default)
-
-        ALC269
-          basic         Basic preset
-          quanta        Quanta FL1
-          eeepc-p703    ASUS Eeepc P703 P900A
-          eeepc-p901    ASUS Eeepc P901 S101
-
-        ALC662/663
-          3stack-dig    3-stack (2-channel) with SPDIF
-          3stack-6ch     3-stack (6-channel)
-          3stack-6ch-dig 3-stack (6-channel) with SPDIF
-          6stack-dig     6-stack with SPDIF
-          lenovo-101e    Lenovo laptop
-          eeepc-p701    ASUS Eeepc P701
-          eeepc-ep20    ASUS Eeepc EP20
-          ecs           ECS/Foxconn mobo
-          m51va         ASUS M51VA
-          g71v          ASUS G71V
-          h13           ASUS H13
-          g50v          ASUS G50V
-          asus-mode1    ASUS
-          asus-mode2    ASUS
-          asus-mode3    ASUS
-          asus-mode4    ASUS
-          asus-mode5    ASUS
-          asus-mode6    ASUS
-          auto          auto-config reading BIOS (default)
-
-        ALC882/885
-          3stack-dig    3-jack with SPDIF I/O
-          6stack-dig    6-jack digital with SPDIF I/O
-          arima         Arima W820Di1
-          targa         Targa T8, MSI-1049 T8
-          asus-a7j      ASUS A7J
-          asus-a7m      ASUS A7M
-          macpro        MacPro support
-          mbp3          Macbook Pro rev3
-          imac24        iMac 24'' with jack detection
-          w2jc          ASUS W2JC
-          auto          auto-config reading BIOS (default)
-
-        ALC883/888
-          3stack-dig    3-jack with SPDIF I/O
-          6stack-dig    6-jack digital with SPDIF I/O
-          3stack-6ch    3-jack 6-channel
-          3stack-6ch-dig 3-jack 6-channel with SPDIF I/O
-          6stack-dig-demo  6-jack digital for Intel demo board
-          acer          Acer laptops (Travelmate 3012WTMi, Aspire 5600, etc)
-          acer-aspire   Acer Aspire 9810
-          medion        Medion Laptops
-          medion-md2    Medion MD2
-          targa-dig     Targa/MSI
-          targa-2ch-dig Targs/MSI with 2-channel
-          laptop-eapd   3-jack with SPDIF I/O and EAPD (Clevo M540JE, M550JE)
-          lenovo-101e   Lenovo 101E
-          lenovo-nb0763 Lenovo NB0763
-          lenovo-ms7195-dig Lenovo MS7195
-          lenovo-sky    Lenovo Sky
-          haier-w66     Haier W66
-          3stack-hp     HP machines with 3stack (Lucknow, Samba boards)
-          6stack-dell   Dell machines with 6stack (Inspiron 530)
-          mitac         Mitac 8252D
-          clevo-m720    Clevo M720 laptop series
-          fujitsu-pi2515 Fujitsu AMILO Pi2515
-          3stack-6ch-intel Intel DG33* boards
-          auto          auto-config reading BIOS (default)
-
-        ALC861/660
-          3stack        3-jack
-          3stack-dig    3-jack with SPDIF I/O
-          6stack-dig    6-jack with SPDIF I/O
-          3stack-660    3-jack (for ALC660)
-          uniwill-m31   Uniwill M31 laptop
-          toshiba       Toshiba laptop support
-          asus          Asus laptop support
-          asus-laptop   ASUS F2/F3 laptops
-          auto          auto-config reading BIOS (default)
-
-        ALC861VD/660VD
-          3stack        3-jack
-          3stack-dig    3-jack with SPDIF OUT
-          6stack-dig    6-jack with SPDIF OUT
-          3stack-660    3-jack (for ALC660VD)
-          3stack-660-digout 3-jack with SPDIF OUT (for ALC660VD)
-          lenovo        Lenovo 3000 C200
-          dallas        Dallas laptops
-          hp            HP TX1000
-          auto          auto-config reading BIOS (default)
-
-        CMI9880
-          minimal       3-jack in back
-          min_fp        3-jack in back, 2-jack in front
-          full          6-jack in back, 2-jack in front
-          full_dig      6-jack in back, 2-jack in front, SPDIF I/O
-          allout        5-jack in back, 2-jack in front, SPDIF out
-          auto          auto-config reading BIOS (default)
-
-        AD1882 / AD1882A
-          3stack        3-stack mode (default)
-          6stack        6-stack mode
-
-        AD1884A / AD1883 / AD1984A / AD1984B
-          desktop       3-stack desktop (default)
-          laptop        laptop with HP jack sensing
-          mobile        mobile devices with HP jack sensing
-          thinkpad      Lenovo Thinkpad X300
-
-        AD1884
-          N/A
-
-        AD1981
-          basic         3-jack (default)
-          hp            HP nx6320
-          thinkpad      Lenovo Thinkpad T60/X60/Z60
-          toshiba       Toshiba U205
-
-        AD1983
-          N/A
-
-        AD1984
-          basic         default configuration
-          thinkpad      Lenovo Thinkpad T61/X61
-          dell          Dell T3400
-
-        AD1986A
-          6stack        6-jack, separate surrounds (default)
-          3stack        3-stack, shared surrounds
-          laptop        2-channel only (FSC V2060, Samsung M50)
-          laptop-eapd   2-channel with EAPD (Samsung R65, ASUS A6J)
-          laptop-automute 2-channel with EAPD and HP-automute (Lenovo N100)
-          ultra         2-channel with EAPD (Samsung Ultra tablet PC)
-
-        AD1988/AD1988B/AD1989A/AD1989B
-          6stack        6-jack
-          6stack-dig    ditto with SPDIF
-          3stack        3-jack
-          3stack-dig    ditto with SPDIF
-          laptop        3-jack with hp-jack automute
-          laptop-dig    ditto with SPDIF
-          auto          auto-config reading BIOS (default)
-        
-        Conexant 5045
-          laptop-hpsense    Laptop with HP sense (old model laptop)
-          laptop-micsense   Laptop with Mic sense (old model fujitsu)
-          laptop-hpmicsense Laptop with HP and Mic senses
-          benq          Benq R55E
-          test          for testing/debugging purpose, almost all controls
-                        can be adjusted.  Appearing only when compiled with
-                        $CONFIG_SND_DEBUG=y
-
-        Conexant 5047
-          laptop        Basic Laptop config 
-          laptop-hp     Laptop config for some HP models (subdevice 30A5)
-          laptop-eapd   Laptop config with EAPD support
-          test          for testing/debugging purpose, almost all controls
-                        can be adjusted.  Appearing only when compiled with
-                        $CONFIG_SND_DEBUG=y
-
-        Conexant 5051
-          laptop        Basic Laptop config (default)
-          hp            HP Spartan laptop
-
-        STAC9200
-          ref           Reference board
-          dell-d21      Dell (unknown)
-          dell-d22      Dell (unknown)
-          dell-d23      Dell (unknown)
-          dell-m21      Dell Inspiron 630m, Dell Inspiron 640m
-          dell-m22      Dell Latitude D620, Dell Latitude D820
-          dell-m23      Dell XPS M1710, Dell Precision M90
-          dell-m24      Dell Latitude 120L
-          dell-m25      Dell Inspiron E1505n
-          dell-m26      Dell Inspiron 1501
-          dell-m27      Dell Inspiron E1705/9400
-          gateway       Gateway laptops with EAPD control
-          panasonic     Panasonic CF-74
-
-        STAC9205/9254
-          ref           Reference board
-          dell-m42      Dell (unknown)
-          dell-m43      Dell Precision
-          dell-m44      Dell Inspiron
-
-        STAC9220/9221
-          ref           Reference board
-          3stack        D945 3stack
-          5stack        D945 5stack + SPDIF
-          intel-mac-v1  Intel Mac Type 1
-          intel-mac-v2  Intel Mac Type 2
-          intel-mac-v3  Intel Mac Type 3
-          intel-mac-v4  Intel Mac Type 4
-          intel-mac-v5  Intel Mac Type 5
-          intel-mac-auto Intel Mac (detect type according to subsystem id)
-          macmini       Intel Mac Mini (equivalent with type 3)
-          macbook       Intel Mac Book (eq. type 5)
-          macbook-pro-v1 Intel Mac Book Pro 1st generation (eq. type 3)
-          macbook-pro   Intel Mac Book Pro 2nd generation (eq. type 3)
-          imac-intel    Intel iMac (eq. type 2)
-          imac-intel-20 Intel iMac (newer version) (eq. type 3)
-          dell-d81      Dell (unknown)
-          dell-d82      Dell (unknown)
-          dell-m81      Dell (unknown)
-          dell-m82      Dell XPS M1210
-
-        STAC9202/9250/9251
-          ref           Reference board, base config
-          m2-2          Some Gateway MX series laptops
-          m6            Some Gateway NX series laptops
-          pa6           Gateway NX860 series
-
-        STAC9227/9228/9229/927x
-          ref           Reference board
-          3stack        D965 3stack
-          5stack        D965 5stack + SPDIF
-          dell-3stack   Dell Dimension E520
-          dell-bios     Fixes with Dell BIOS setup
-
-        STAC92HD71B*
-          ref           Reference board
-          dell-m4-1     Dell desktops
-          dell-m4-2     Dell desktops
-          dell-m4-3     Dell desktops
-
-        STAC92HD73*
-          ref           Reference board
-          dell-m6-amic  Dell desktops/laptops with analog mics
-          dell-m6-dmic  Dell desktops/laptops with digital mics
-          dell-m6       Dell desktops/laptops with both type of mics
-
-        STAC9872
-          vaio          Setup for VAIO FE550G/SZ110
-          vaio-ar Setup for VAIO AR
+    models depending on the codec chip.  The list of available models
+    is found in HD-Audio-Models.txt
 
     The model name "genric" is treated as a special case.  When this
     model is given, the driver uses the generic codec parser without
     "codec-patch".  It's sometimes good for testing and debugging.
 
     If the default configuration doesn't work and one of the above
-    matches with your device, report it together with the PCI
-    subsystem ID (output of "lspci -nv") to ALSA BTS or alsa-devel
+    matches with your device, report it together with alsa-info.sh
+    output (with --no-upload option) to kernel bugzilla or alsa-devel
     ML (see the section "Links and Addresses").
 
     power_save and power_save_controller options are for power-saving
@@ -1650,7 +1350,8 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     * AuzenTech X-Meridian
     * Bgears b-Enspirer
     * Club3D Theatron DTS
-    * HT-Omega Claro
+    * HT-Omega Claro (plus)
+    * HT-Omega Claro halo (XT)
     * Razer Barracuda AC-1
     * Sondigo Inferno
 
@@ -2407,8 +2108,11 @@ Links and Addresses
   ALSA project homepage
        http://www.alsa-project.org
 
-  ALSA Bug Tracking System
-       https://bugtrack.alsa-project.org/bugs/
+  Kernel Bugzilla
+       http://bugzilla.kernel.org/
 
   ALSA Developers ML
        mailto:alsa-devel@alsa-project.org
+
+  alsa-info.sh script
+       http://www.alsa-project.org/alsa-info.sh
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
new file mode 100644
index 000000000000..4b7ac21ea9eb
--- /dev/null
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -0,0 +1,348 @@
+  Model name    Description
+  ----------    -----------
+ALC880
+======
+  3stack        3-jack in back and a headphone out
+  3stack-digout 3-jack in back, a HP out and a SPDIF out
+  5stack        5-jack in back, 2-jack in front
+  5stack-digout 5-jack in back, 2-jack in front, a SPDIF out
+  6stack        6-jack in back, 2-jack in front
+  6stack-digout 6-jack with a SPDIF out
+  w810          3-jack
+  z71v          3-jack (HP shared SPDIF)
+  asus          3-jack (ASUS Mobo)
+  asus-w1v      ASUS W1V
+  asus-dig      ASUS with SPDIF out
+  asus-dig2     ASUS with SPDIF out (using GPIO2)
+  uniwill       3-jack
+  fujitsu       Fujitsu Laptops (Pi1536)
+  F1734         2-jack
+  lg            LG laptop (m1 express dual)
+  lg-lw         LG LW20/LW25 laptop
+  tcl           TCL S700
+  clevo         Clevo laptops (m520G, m665n)
+  medion        Medion Rim 2150
+  test          for testing/debugging purpose, almost all controls can be
+                adjusted.  Appearing only when compiled with
+                $CONFIG_SND_DEBUG=y
+  auto          auto-config reading BIOS (default)
+
+ALC260
+======
+  hp            HP machines
+  hp-3013       HP machines (3013-variant)
+  hp-dc7600     HP DC7600
+  fujitsu       Fujitsu S7020
+  acer          Acer TravelMate
+  will          Will laptops (PB V7900)
+  replacer      Replacer 672V
+  basic         fixed pin assignment (old default model)
+  test          for testing/debugging purpose, almost all controls can
+                adjusted.  Appearing only when compiled with
+                $CONFIG_SND_DEBUG=y
+  auto          auto-config reading BIOS (default)
+
+ALC262
+======
+  fujitsu       Fujitsu Laptop
+  hp-bpc        HP xw4400/6400/8400/9400 laptops
+  hp-bpc-d7000  HP BPC D7000
+  hp-tc-t5735   HP Thin Client T5735
+  hp-rp5700     HP RP5700
+  benq          Benq ED8
+  benq-t31      Benq T31
+  hippo         Hippo (ATI) with jack detection, Sony UX-90s
+  hippo_1       Hippo (Benq) with jack detection
+  sony-assamd   Sony ASSAMD
+  toshiba-s06   Toshiba S06
+  toshiba-rx1   Toshiba RX1
+  ultra         Samsung Q1 Ultra Vista model
+  lenovo-3000   Lenovo 3000 y410
+  nec           NEC Versa S9100
+  basic         fixed pin assignment w/o SPDIF
+  auto          auto-config reading BIOS (default)
+
+ALC267/268
+==========
+  quanta-il1    Quanta IL1 mini-notebook
+  3stack        3-stack model
+  toshiba       Toshiba A205
+  acer          Acer laptops
+  acer-dmic     Acer laptops with digital-mic
+  acer-aspire   Acer Aspire One
+  dell          Dell OEM laptops (Vostro 1200)
+  zepto         Zepto laptops
+  test          for testing/debugging purpose, almost all controls can
+                adjusted.  Appearing only when compiled with
+                $CONFIG_SND_DEBUG=y
+  auto          auto-config reading BIOS (default)
+
+ALC269
+======
+  basic         Basic preset
+  quanta        Quanta FL1
+  eeepc-p703    ASUS Eeepc P703 P900A
+  eeepc-p901    ASUS Eeepc P901 S101
+  fujitsu       FSC Amilo
+  auto          auto-config reading BIOS (default)
+
+ALC662/663
+==========
+  3stack-dig    3-stack (2-channel) with SPDIF
+  3stack-6ch     3-stack (6-channel)
+  3stack-6ch-dig 3-stack (6-channel) with SPDIF
+  6stack-dig     6-stack with SPDIF
+  lenovo-101e    Lenovo laptop
+  eeepc-p701    ASUS Eeepc P701
+  eeepc-ep20    ASUS Eeepc EP20
+  ecs           ECS/Foxconn mobo
+  m51va         ASUS M51VA
+  g71v          ASUS G71V
+  h13           ASUS H13
+  g50v          ASUS G50V
+  asus-mode1    ASUS
+  asus-mode2    ASUS
+  asus-mode3    ASUS
+  asus-mode4    ASUS
+  asus-mode5    ASUS
+  asus-mode6    ASUS
+  auto          auto-config reading BIOS (default)
+
+ALC882/885
+==========
+  3stack-dig    3-jack with SPDIF I/O
+  6stack-dig    6-jack digital with SPDIF I/O
+  arima         Arima W820Di1
+  targa         Targa T8, MSI-1049 T8
+  asus-a7j      ASUS A7J
+  asus-a7m      ASUS A7M
+  macpro        MacPro support
+  mbp3          Macbook Pro rev3
+  imac24        iMac 24'' with jack detection
+  w2jc          ASUS W2JC
+  auto          auto-config reading BIOS (default)
+
+ALC883/888
+==========
+  3stack-dig    3-jack with SPDIF I/O
+  6stack-dig    6-jack digital with SPDIF I/O
+  3stack-6ch    3-jack 6-channel
+  3stack-6ch-dig 3-jack 6-channel with SPDIF I/O
+  6stack-dig-demo  6-jack digital for Intel demo board
+  acer          Acer laptops (Travelmate 3012WTMi, Aspire 5600, etc)
+  acer-aspire   Acer Aspire 9810
+  acer-aspire-4930g Acer Aspire 4930G
+  medion        Medion Laptops
+  medion-md2    Medion MD2
+  targa-dig     Targa/MSI
+  targa-2ch-dig Targs/MSI with 2-channel
+  laptop-eapd   3-jack with SPDIF I/O and EAPD (Clevo M540JE, M550JE)
+  lenovo-101e   Lenovo 101E
+  lenovo-nb0763 Lenovo NB0763
+  lenovo-ms7195-dig Lenovo MS7195
+  lenovo-sky    Lenovo Sky
+  haier-w66     Haier W66
+  3stack-hp     HP machines with 3stack (Lucknow, Samba boards)
+  6stack-dell   Dell machines with 6stack (Inspiron 530)
+  mitac         Mitac 8252D
+  clevo-m720    Clevo M720 laptop series
+  fujitsu-pi2515 Fujitsu AMILO Pi2515
+  fujitsu-xa3530 Fujitsu AMILO XA3530
+  3stack-6ch-intel Intel DG33* boards
+  auto          auto-config reading BIOS (default)
+
+ALC861/660
+==========
+  3stack        3-jack
+  3stack-dig    3-jack with SPDIF I/O
+  6stack-dig    6-jack with SPDIF I/O
+  3stack-660    3-jack (for ALC660)
+  uniwill-m31   Uniwill M31 laptop
+  toshiba       Toshiba laptop support
+  asus          Asus laptop support
+  asus-laptop   ASUS F2/F3 laptops
+  auto          auto-config reading BIOS (default)
+
+ALC861VD/660VD
+==============
+  3stack        3-jack
+  3stack-dig    3-jack with SPDIF OUT
+  6stack-dig    6-jack with SPDIF OUT
+  3stack-660    3-jack (for ALC660VD)
+  3stack-660-digout 3-jack with SPDIF OUT (for ALC660VD)
+  lenovo        Lenovo 3000 C200
+  dallas        Dallas laptops
+  hp            HP TX1000
+  asus-v1s      ASUS V1Sn
+  auto          auto-config reading BIOS (default)
+
+CMI9880
+=======
+  minimal       3-jack in back
+  min_fp        3-jack in back, 2-jack in front
+  full          6-jack in back, 2-jack in front
+  full_dig      6-jack in back, 2-jack in front, SPDIF I/O
+  allout        5-jack in back, 2-jack in front, SPDIF out
+  auto          auto-config reading BIOS (default)
+
+AD1882 / AD1882A
+================
+  3stack        3-stack mode (default)
+  6stack        6-stack mode
+
+AD1884A / AD1883 / AD1984A / AD1984B
+====================================
+  desktop       3-stack desktop (default)
+  laptop        laptop with HP jack sensing
+  mobile        mobile devices with HP jack sensing
+  thinkpad      Lenovo Thinkpad X300
+
+AD1884
+======
+  N/A
+
+AD1981
+======
+  basic         3-jack (default)
+  hp            HP nx6320
+  thinkpad      Lenovo Thinkpad T60/X60/Z60
+  toshiba       Toshiba U205
+
+AD1983
+======
+  N/A
+
+AD1984
+======
+  basic         default configuration
+  thinkpad      Lenovo Thinkpad T61/X61
+  dell          Dell T3400
+
+AD1986A
+=======
+  6stack        6-jack, separate surrounds (default)
+  3stack        3-stack, shared surrounds
+  laptop        2-channel only (FSC V2060, Samsung M50)
+  laptop-eapd   2-channel with EAPD (ASUS A6J)
+  laptop-automute 2-channel with EAPD and HP-automute (Lenovo N100)
+  ultra         2-channel with EAPD (Samsung Ultra tablet PC)
+  samsung       2-channel with EAPD (Samsung R65)
+
+AD1988/AD1988B/AD1989A/AD1989B
+==============================
+  6stack        6-jack
+  6stack-dig    ditto with SPDIF
+  3stack        3-jack
+  3stack-dig    ditto with SPDIF
+  laptop        3-jack with hp-jack automute
+  laptop-dig    ditto with SPDIF
+  auto          auto-config reading BIOS (default)
+
+Conexant 5045
+=============
+  laptop-hpsense    Laptop with HP sense (old model laptop)
+  laptop-micsense   Laptop with Mic sense (old model fujitsu)
+  laptop-hpmicsense Laptop with HP and Mic senses
+  benq          Benq R55E
+  test          for testing/debugging purpose, almost all controls
+                can be adjusted.  Appearing only when compiled with
+                $CONFIG_SND_DEBUG=y
+
+Conexant 5047
+=============
+  laptop        Basic Laptop config 
+  laptop-hp     Laptop config for some HP models (subdevice 30A5)
+  laptop-eapd   Laptop config with EAPD support
+  test          for testing/debugging purpose, almost all controls
+                can be adjusted.  Appearing only when compiled with
+                $CONFIG_SND_DEBUG=y
+
+Conexant 5051
+=============
+  laptop        Basic Laptop config (default)
+  hp            HP Spartan laptop
+
+STAC9200
+========
+  ref           Reference board
+  dell-d21      Dell (unknown)
+  dell-d22      Dell (unknown)
+  dell-d23      Dell (unknown)
+  dell-m21      Dell Inspiron 630m, Dell Inspiron 640m
+  dell-m22      Dell Latitude D620, Dell Latitude D820
+  dell-m23      Dell XPS M1710, Dell Precision M90
+  dell-m24      Dell Latitude 120L
+  dell-m25      Dell Inspiron E1505n
+  dell-m26      Dell Inspiron 1501
+  dell-m27      Dell Inspiron E1705/9400
+  gateway       Gateway laptops with EAPD control
+  panasonic     Panasonic CF-74
+
+STAC9205/9254
+=============
+  ref           Reference board
+  dell-m42      Dell (unknown)
+  dell-m43      Dell Precision
+  dell-m44      Dell Inspiron
+
+STAC9220/9221
+=============
+  ref           Reference board
+  3stack        D945 3stack
+  5stack        D945 5stack + SPDIF
+  intel-mac-v1  Intel Mac Type 1
+  intel-mac-v2  Intel Mac Type 2
+  intel-mac-v3  Intel Mac Type 3
+  intel-mac-v4  Intel Mac Type 4
+  intel-mac-v5  Intel Mac Type 5
+  intel-mac-auto Intel Mac (detect type according to subsystem id)
+  macmini       Intel Mac Mini (equivalent with type 3)
+  macbook       Intel Mac Book (eq. type 5)
+  macbook-pro-v1 Intel Mac Book Pro 1st generation (eq. type 3)
+  macbook-pro   Intel Mac Book Pro 2nd generation (eq. type 3)
+  imac-intel    Intel iMac (eq. type 2)
+  imac-intel-20 Intel iMac (newer version) (eq. type 3)
+  dell-d81      Dell (unknown)
+  dell-d82      Dell (unknown)
+  dell-m81      Dell (unknown)
+  dell-m82      Dell XPS M1210
+
+STAC9202/9250/9251
+==================
+  ref           Reference board, base config
+  m2-2          Some Gateway MX series laptops
+  m6            Some Gateway NX series laptops
+  pa6           Gateway NX860 series
+
+STAC9227/9228/9229/927x
+=======================
+  ref           Reference board
+  ref-no-jd     Reference board without HP/Mic jack detection
+  3stack        D965 3stack
+  5stack        D965 5stack + SPDIF
+  dell-3stack   Dell Dimension E520
+  dell-bios     Fixes with Dell BIOS setup
+
+STAC92HD71B*
+============
+  ref           Reference board
+  dell-m4-1     Dell desktops
+  dell-m4-2     Dell desktops
+  dell-m4-3     Dell desktops
+
+STAC92HD73*
+===========
+  ref           Reference board
+  no-jd         BIOS setup but without jack-detection
+  dell-m6-amic  Dell desktops/laptops with analog mics
+  dell-m6-dmic  Dell desktops/laptops with digital mics
+  dell-m6       Dell desktops/laptops with both type of mics
+
+STAC92HD83*
+===========
+  ref           Reference board
+
+STAC9872
+========
+  vaio          Setup for VAIO FE550G/SZ110
+  vaio-ar Setup for VAIO AR
diff --git a/Documentation/sound/alsa/HD-Audio.txt b/Documentation/sound/alsa/HD-Audio.txt
new file mode 100644
index 000000000000..8d68fff71839
--- /dev/null
+++ b/Documentation/sound/alsa/HD-Audio.txt
@@ -0,0 +1,577 @@
+MORE NOTES ON HD-AUDIO DRIVER
+=============================
+                                        Takashi Iwai <tiwai@suse.de>
+
+
+GENERAL
+-------
+
+HD-audio is the new standard on-board audio component on modern PCs
+after AC97.  Although Linux has been supporting HD-audio since long
+time ago, there are often problems with new machines.  A part of the
+problem is broken BIOS, and the rest is the driver implementation.
+This document explains the brief trouble-shooting and debugging
+methods for the HD-audio hardware.
+
+The HD-audio component consists of two parts: the controller chip and 
+the codec chips on the HD-audio bus.  Linux provides a single driver
+for all controllers, snd-hda-intel.  Although the driver name contains
+a word of a well-known harware vendor, it's not specific to it but for
+all controller chips by other companies.  Since the HD-audio
+controllers are supposed to be compatible, the single snd-hda-driver
+should work in most cases.  But, not surprisingly, there are known
+bugs and issues specific to each controller type.  The snd-hda-intel
+driver has a bunch of workarounds for these as described below.
+
+A controller may have multiple codecs.  Usually you have one audio
+codec and optionally one modem codec.  In theory, there might be
+multiple audio codecs, e.g. for analog and digital outputs, and the
+driver might not work properly because of conflict of mixer elements.
+This should be fixed in future if such hardware really exists.
+
+The snd-hda-intel driver has several different codec parsers depending
+on the codec.  It has a generic parser as a fallback, but this
+functionality is fairly limited until now.  Instead of the generic
+parser, usually the codec-specific parser (coded in patch_*.c) is used
+for the codec-specific implementations.  The details about the
+codec-specific problems are explained in the later sections.
+
+If you are interested in the deep debugging of HD-audio, read the
+HD-audio specification at first.  The specification is found on
+Intel's web page, for example:
+
+- http://www.intel.com/standards/hdaudio/
+
+
+HD-AUDIO CONTROLLER
+-------------------
+
+DMA-Position Problem
+~~~~~~~~~~~~~~~~~~~~
+The most common problem of the controller is the inaccurate DMA
+pointer reporting.  The DMA pointer for playback and capture can be
+read in two ways, either via a LPIB register or via a position-buffer
+map.  As default the driver tries to read from the io-mapped
+position-buffer, and falls back to LPIB if the position-buffer appears
+dead.  However, this detection isn't perfect on some devices.  In such
+a case, you can change the default method via `position_fix` option.
+
+`position_fix=1` means to use LPIB method explicitly.
+`position_fix=2` means to use the position-buffer.  0 is the default
+value, the automatic check and fallback to LPIB as described in the
+above.  If you get a problem of repeated sounds, this option might
+help.
+
+In addition to that, every controller is known to be broken regarding
+the wake-up timing.  It wakes up a few samples before actually
+processing the data on the buffer.  This caused a lot of problems, for
+example, with ALSA dmix or JACK.  Since 2.6.27 kernel, the driver puts
+an artificial delay to the wake up timing.  This delay is controlled
+via `bdl_pos_adj` option. 
+
+When `bdl_pos_adj` is a negative value (as default), it's assigned to
+an appropriate value depending on the controller chip.  For Intel
+chips, it'd be 1 while it'd be 32 for others.  Usually this works.
+Only in case it doesn't work and you get warning messages, you should
+change this parameter to other values.
+
+
+Codec-Probing Problem
+~~~~~~~~~~~~~~~~~~~~~
+A less often but a more severe problem is the codec probing.  When
+BIOS reports the available codec slots wrongly, the driver gets
+confused and tries to access the non-existing codec slot.  This often
+results in the total screw-up, and destructs the further communication
+with the codec chips.  The symptom appears usually as error messages
+like:
+------------------------------------------------------------------------
+  hda_intel: azx_get_response timeout, switching to polling mode:
+        last cmd=0x12345678
+  hda_intel: azx_get_response timeout, switching to single_cmd mode:
+        last cmd=0x12345678
+------------------------------------------------------------------------
+
+The first line is a warning, and this is usually relatively harmless.
+It means that the codec response isn't notified via an IRQ.  The
+driver uses explicit polling method to read the response.  It gives
+very slight CPU overhead, but you'd unlikely notice it.
+
+The second line is, however, a fatal error.  If this happens, usually
+it means that something is really wrong.  Most likely you are
+accessing a non-existing codec slot.
+
+Thus, if the second error message appears, try to narrow the probed
+codec slots via `probe_mask` option.  It's a bitmask, and each bit
+corresponds to the codec slot.  For example, to probe only the first
+slot, pass `probe_mask=1`.  For the first and the third slots, pass
+`probe_mask=5` (where 5 = 1 | 4), and so on.
+
+Since 2.6.29 kernel, the driver has a more robust probing method, so
+this error might happen rarely, though.
+
+
+Interrupt Handling
+~~~~~~~~~~~~~~~~~~
+In rare but some cases, the interrupt isn't properly handled as
+default.  You would notice this by the DMA transfer error reported by
+ALSA PCM core, for example.  Using MSI might help in such a case.
+Pass `enable_msi=1` option for enabling MSI.
+
+
+HD-AUDIO CODEC
+--------------
+
+Model Option
+~~~~~~~~~~~~
+The most common problem regarding the HD-audio driver is the
+unsupported codec features or the mismatched device configuration.
+Most of codec-specific code has several preset models, either to
+override the BIOS setup or to provide more comprehensive features.
+
+The driver checks PCI SSID and looks through the static configuration
+table until any matching entry is found.  If you have a new machine,
+you may see a message like below:
+------------------------------------------------------------------------
+    hda_codec: Unknown model for ALC880, trying auto-probe from BIOS...
+------------------------------------------------------------------------
+Even if you see such a message, DON'T PANIC.  Take a deep breath and
+keep your towel.  First of all, it's an informational message, no
+warning, no error.  This means that the PCI SSID of your device isn't
+listed in the known preset model (white-)list.  But, this doesn't mean
+that the driver is broken.  Many codec-drivers provide the automatic
+configuration mechanism based on the BIOS setup.
+
+The HD-audio codec has usually "pin" widgets, and BIOS sets the default
+configuration of each pin, which indicates the location, the
+connection type, the jack color, etc.  The HD-audio driver can guess
+the right connection judging from these default configuration values.
+However -- some codec-support codes, such as patch_analog.c, don't
+support the automatic probing (yet as of 2.6.28).  And, BIOS is often,
+yes, pretty often broken.  It sets up wrong values and screws up the
+driver.
+
+The preset model is provided basically to overcome such a situation.
+When the matching preset model is found in the white-list, the driver
+assumes the static configuration of that preset and builds the mixer
+elements and PCM streams based on the static information.  Thus, if
+you have a newer machine with a slightly different PCI SSID from the
+existing one, you may have a good chance to re-use the same model.
+You can pass the `model` option to specify the preset model instead of
+PCI SSID look-up.
+
+What `model` option values are available depends on the codec chip.
+Check your codec chip from the codec proc file (see "Codec Proc-File"
+section below).  It will show the vendor/product name of your codec
+chip.  Then, see Documentation/sound/alsa/HD-Audio-Modelstxt file,
+the section of HD-audio driver.  You can find a list of codecs
+and `model` options belonging to each codec.  For example, for Realtek
+ALC262 codec chip, pass `model=ultra` for devices that are compatible
+with Samsung Q1 Ultra.
+
+Thus, the first thing you can do for any brand-new, unsupported and
+non-working HD-audio hardware is to check HD-audio codec and several
+different `model` option values.  If you have a luck, some of them
+might suit with your device well.
+
+Some codecs such as ALC880 have a special model option `model=test`.
+This configures the driver to provide as many mixer controls as
+possible for every single pin feature except for the unsolicited
+events (and maybe some other specials).  Adjust each mixer element and
+try the I/O in the way of trial-and-error until figuring out the whole
+I/O pin mappings.
+
+Note that `model=generic` has a special meaning.  It means to use the
+generic parser regardless of the codec.  Usually the codec-specific
+parser is much better than the generic parser (as now).  Thus this
+option is more about the debugging purpose.
+
+
+Speaker and Headphone Output
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+One of the most frequent (and obvious) bugs with HD-audio is the
+silent output from either or both of a built-in speaker and a
+headphone jack.  In general, you should try a headphone output at
+first.  A speaker output often requires more additional controls like
+the external amplifier bits.  Thus a headphone output has a slightly
+better chance.
+
+Before making a bug report, double-check whether the mixer is set up
+correctly.  The recent version of snd-hda-intel driver provides mostly
+"Master" volume control as well as "Front" volume (where Front
+indicates the front-channels).  In addition, there can be individual
+"Headphone" and "Speaker" controls.
+
+Ditto for the speaker output.  There can be "External Amplifier"
+switch on some codecs.  Turn on this if present.
+
+Another related problem is the automatic mute of speaker output by
+headphone plugging.  This feature is implemented in most cases, but
+not on every preset model or codec-support code.
+
+In anyway, try a different model option if you have such a problem.
+Some other models may match better and give you more matching
+functionality.  If none of the available models works, send a bug
+report.  See the bug report section for details.
+
+If you are masochistic enough to debug the driver problem, note the
+following:
+
+- The speaker (and the headphone, too) output often requires the
+  external amplifier.  This can be set usually via EAPD verb or a
+  certain GPIO.  If the codec pin supports EAPD, you have a better
+  chance via SET_EAPD_BTL verb (0x70c).  On others, GPIO pin (mostly
+  it's either GPIO0 or GPIO1) may turn on/off EAPD.
+- Some Realtek codecs require special vendor-specific coefficients to
+  turn on the amplifier.  See patch_realtek.c.
+- IDT codecs may have extra power-enable/disable controls on each
+  analog pin.  See patch_sigmatel.c.
+- Very rare but some devices don't accept the pin-detection verb until
+  triggered.  Issuing GET_PIN_SENSE verb (0xf09) may result in the
+  codec-communication stall.  Some examples are found in
+  patch_realtek.c.
+
+
+Capture Problems
+~~~~~~~~~~~~~~~~
+The capture problems are often because of missing setups of mixers.
+Thus, before submitting a bug report, make sure that you set up the
+mixer correctly.  For example, both "Capture Volume" and "Capture
+Switch" have to be set properly in addition to the right "Capture
+Source" or "Input Source" selection.  Some devices have "Mic Boost"
+volume or switch.
+
+When the PCM device is opened via "default" PCM (without pulse-audio
+plugin), you'll likely have "Digital Capture Volume" control as well.
+This is provided for the extra gain/attenuation of the signal in
+software, especially for the inputs without the hardware volume
+control such as digital microphones.  Unless really needed, this
+should be set to exactly 50%, corresponding to 0dB -- neither extra
+gain nor attenuation.  When you use "hw" PCM, i.e., a raw access PCM,
+this control will have no influence, though.
+
+It's known that some codecs / devices have fairly bad analog circuits,
+and the recorded sound contains a certain DC-offset.  This is no bug
+of the driver.
+
+Most of modern laptops have no analog CD-input connection.  Thus, the
+recording from CD input won't work in many cases although the driver
+provides it as the capture source.  Use CDDA instead.
+
+The automatic switching of the built-in and external mic per plugging
+is implemented on some codec models but not on every model.  Partly
+because of my laziness but mostly lack of testers.  Feel free to
+submit the improvement patch to the author.
+
+
+Direct Debugging
+~~~~~~~~~~~~~~~~
+If no model option gives you a better result, and you are a tough guy
+to fight against evil, try debugging via hitting the raw HD-audio
+codec verbs to the device.  Some tools are available: hda-emu and
+hda-analyzer.  The detailed description is found in the sections
+below.  You'd need to enable hwdep for using these tools.  See "Kernel
+Configuration" section.
+
+
+OTHER ISSUES
+------------
+
+Kernel Configuration
+~~~~~~~~~~~~~~~~~~~~
+In general, I recommend you to enable the sound debug option,
+`CONFIG_SND_DEBUG=y`, no matter whether you are debugging or not.
+This enables snd_printd() macro and others, and you'll get additional
+kernel messages at probing.
+
+In addition, you can enable `CONFIG_SND_DEBUG_VERBOSE=y`.  But this
+will give you far more messages.  Thus turn this on only when you are
+sure to want it.
+
+Don't forget to turn on the appropriate `CONFIG_SND_HDA_CODEC_*`
+options.  Note that each of them corresponds to the codec chip, not
+the controller chip.  Thus, even if lspci shows the Nvidia controller,
+you may need to choose the option for other vendors.  If you are
+unsure, just select all yes.
+
+`CONFIG_SND_HDA_HWDEP` is a useful option for debugging the driver.
+When this is enabled, the driver creates hardware-dependent devices
+(one per each codec), and you have a raw access to the device via
+these device files.  For example, `hwC0D2` will be created for the
+codec slot #2 of the first card (#0).  For debug-tools such as
+hda-verb and hda-analyzer, the hwdep device has to be enabled.
+Thus, it'd be better to turn this on always.
+
+`CONFIG_SND_HDA_RECONFIG` is a new option, and this depends on the
+hwdep option above.  When enabled, you'll have some sysfs files under
+the corresponding hwdep directory.  See "HD-audio reconfiguration"
+section below.
+
+`CONFIG_SND_HDA_POWER_SAVE` option enables the power-saving feature.
+See "Power-saving" section below.
+
+
+Codec Proc-File
+~~~~~~~~~~~~~~~
+The codec proc-file is a treasure-chest for debugging HD-audio.
+It shows most of useful information of each codec widget.
+
+The proc file is located in /proc/asound/card*/codec#*, one file per
+each codec slot.  You can know the codec vendor, product id and
+names, the type of each widget, capabilities and so on.
+This file, however, doesn't show the jack sensing state, so far.  This
+is because the jack-sensing might be depending on the trigger state.
+
+This file will be picked up by the debug tools, and also it can be fed
+to the emulator as the primary codec information.  See the debug tools
+section below.
+
+This proc file can be also used to check whether the generic parser is
+used.  When the generic parser is used, the vendor/product ID name
+will appear as "Realtek ID 0262", instead of "Realtek ALC262".
+
+
+HD-Audio Reconfiguration
+~~~~~~~~~~~~~~~~~~~~~~~~
+This is an experimental feature to allow you re-configure the HD-audio
+codec dynamically without reloading the driver.  The following sysfs
+files are available under each codec-hwdep device directory (e.g. 
+/sys/class/sound/hwC0D0):
+
+vendor_id::
+  Shows the 32bit codec vendor-id hex number.  You can change the
+  vendor-id value by writing to this file.
+subsystem_id::
+  Shows the 32bit codec subsystem-id hex number.  You can change the
+  subsystem-id value by writing to this file.
+revision_id::
+  Shows the 32bit codec revision-id hex number.  You can change the
+  revision-id value by writing to this file.
+afg::
+  Shows the AFG ID.  This is read-only.
+mfg::
+  Shows the MFG ID.  This is read-only.
+name::
+  Shows the codec name string.  Can be changed by writing to this
+  file.
+modelname::
+  Shows the currently set `model` option.  Can be changed by writing
+  to this file.
+init_verbs::
+  The extra verbs to execute at initialization.  You can add a verb by
+  writing to this file.  Pass tree numbers, nid, verb and parameter.
+hints::
+  Shows hint strings for codec parsers for any use.  Right now it's
+  not used.
+reconfig::
+  Triggers the codec re-configuration.  When any value is written to
+  this file, the driver re-initialize and parses the codec tree
+  again.  All the changes done by the sysfs entries above are taken
+  into account.
+clear::
+  Resets the codec, removes the mixer elements and PCM stuff of the
+  specified codec, and clear all init verbs and hints.
+
+
+Power-Saving
+~~~~~~~~~~~~
+The power-saving is a kind of auto-suspend of the device.  When the
+device is inactive for a certain time, the device is automatically
+turned off to save the power.  The time to go down is specified via
+`power_save` module option, and this option can be changed dynamically
+via sysfs.
+
+The power-saving won't work when the analog loopback is enabled on
+some codecs.  Make sure that you mute all unneeded signal routes when
+you want the power-saving.
+
+The power-saving feature might cause audible click noises at each
+power-down/up depending on the device.  Some of them might be
+solvable, but some are hard, I'm afraid.  Some distros such as
+openSUSE enables the power-saving feature automatically when the power
+cable is unplugged.  Thus, if you hear noises, suspect first the
+power-saving.  See /sys/module/snd_hda_intel/parameters/power_save to
+check the current value.  If it's non-zero, the feature is turned on.
+
+
+Development Tree
+~~~~~~~~~~~~~~~~
+The latest development codes for HD-audio are found on sound git tree:
+
+- git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6.git
+
+The master branch or for-next branches can be used as the main
+development branches in general while the HD-audio specific patches
+are committed in topic/hda branch.
+
+If you are using the latest Linus tree, it'd be better to pull the
+above GIT tree onto it.  If you are using the older kernels, an easy
+way to try the latest ALSA code is to build from the snapshot
+tarball.  There are daily tarballs and the latest snapshot tarball.
+All can be built just like normal alsa-driver release packages, that
+is, installed via the usual spells: configure, make and make
+install(-modules).  See INSTALL in the package.  The snapshot tarballs
+are found at:
+
+- ftp://ftp.kernel.org/pub/linux/kernel/people/tiwai/snapshot/
+
+
+Sending a Bug Report
+~~~~~~~~~~~~~~~~~~~~
+If any model or module options don't work for your device, it's time
+to send a bug report to the developers.  Give the following in your
+bug report:
+
+- Hardware vendor, product and model names
+- Kernel version (and ALSA-driver version if you built externally)
+- `alsa-info.sh` output; run with `--no-upload` option.  See the
+  section below about alsa-info
+
+If it's a regression, at best, send alsa-info outputs of both working
+and non-working kernels.  This is really helpful because we can
+compare the codec registers directly.
+
+Send a bug report either the followings:
+
+kernel-bugzilla::
+  http://bugme.linux-foundation.org/
+alsa-devel ML::
+  alsa-devel@alsa-project.org
+
+
+DEBUG TOOLS
+-----------
+
+This section describes some tools available for debugging HD-audio
+problems.
+
+alsa-info
+~~~~~~~~~
+The script `alsa-info.sh` is a very useful tool to gather the audio
+device information.  You can fetch the latest version from:
+
+- http://www.alsa-project.org/alsa-info.sh
+
+Run this script as root, and it will gather the important information
+such as the module lists, module parameters, proc file contents
+including the codec proc files, mixer outputs and the control
+elements.  As default, it will store the information onto a web server
+on alsa-project.org.  But, if you send a bug report, it'd be better to
+run with `--no-upload` option, and attach the generated file.
+
+There are some other useful options.  See `--help` option output for
+details.
+
+
+hda-verb
+~~~~~~~~
+hda-verb is a tiny program that allows you to access the HD-audio
+codec directly.  You can execute a raw HD-audio codec verb with this.
+This program accesses the hwdep device, thus you need to enable the
+kernel config `CONFIG_SND_HDA_HWDEP=y` beforehand.
+
+The hda-verb program takes four arguments: the hwdep device file, the
+widget NID, the verb and the parameter.  When you access to the codec
+on the slot 2 of the card 0, pass /dev/snd/hwC0D2 to the first
+argument, typically.  (However, the real path name depends on the
+system.)
+
+The second parameter is the widget number-id to access.  The third
+parameter can be either a hex/digit number or a string corresponding
+to a verb.  Similarly, the last parameter is the value to write, or
+can be a string for the parameter type.
+
+------------------------------------------------------------------------
+  % hda-verb /dev/snd/hwC0D0 0x12 0x701 2
+  nid = 0x12, verb = 0x701, param = 0x2
+  value = 0x0
+
+  % hda-verb /dev/snd/hwC0D0 0x0 PARAMETERS VENDOR_ID
+  nid = 0x0, verb = 0xf00, param = 0x0
+  value = 0x10ec0262
+
+  % hda-verb /dev/snd/hwC0D0 2 set_a 0xb080
+  nid = 0x2, verb = 0x300, param = 0xb080
+  value = 0x0
+------------------------------------------------------------------------
+
+Although you can issue any verbs with this program, the driver state
+won't be always updated.  For example, the volume values are usually
+cached in the driver, and thus changing the widget amp value directly
+via hda-verb won't change the mixer value.
+
+The hda-verb program is found in the ftp directory:
+
+- ftp://ftp.kernel.org/pub/linux/kernel/people/tiwai/misc/
+
+Also a git repository is available:
+
+- git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/hda-verb.git
+
+See README file in the tarball for more details about hda-verb
+program.
+
+
+hda-analyzer
+~~~~~~~~~~~~
+hda-analyzer provides a graphical interface to access the raw HD-audio
+control, based on pyGTK2 binding.  It's a more powerful version of
+hda-verb.  The program gives you an easy-to-use GUI stuff for showing
+the widget information and adjusting the amp values, as well as the
+proc-compatible output.
+
+The hda-analyzer is a part of alsa.git repository in
+alsa-project.org:
+
+- http://git.alsa-project.org/?p=alsa.git;a=tree;f=hda-analyzer
+
+
+Codecgraph
+~~~~~~~~~~
+Codecgraph is a utility program to generate a graph and visualizes the
+codec-node connection of a codec chip.  It's especially useful when
+you analyze or debug a codec without a proper datasheet.  The program
+parses the given codec proc file and converts to SVG via graphiz
+program.
+
+The tarball and GIT trees are found in the web page at:
+
+- http://helllabs.org/codecgraph/
+
+
+hda-emu
+~~~~~~~
+hda-emu is an HD-audio emulator.  The main purpose of this program is
+to debug an HD-audio codec without the real hardware.  Thus, it
+doesn't emulate the behavior with the real audio I/O, but it just
+dumps the codec register changes and the ALSA-driver internal changes
+at probing and operating the HD-audio driver.
+
+The program requires a codec proc-file to simulate.  Get a proc file
+for the target codec beforehand, or pick up an example codec from the
+codec proc collections in the tarball.  Then, run the program with the
+proc file, and the hda-emu program will start parsing the codec file
+and simulates the HD-audio driver:
+
+------------------------------------------------------------------------
+  % hda-emu codecs/stac9200-dell-d820-laptop
+  # Parsing..
+  hda_codec: Unknown model for STAC9200, using BIOS defaults
+  hda_codec: pin nid 08 bios pin config 40c003fa
+  ....
+------------------------------------------------------------------------
+
+The program gives you only a very dumb command-line interface.  You
+can get a proc-file dump at the current state, get a list of control
+(mixer) elements, set/get the control element value, simulate the PCM
+operation, the jack plugging simulation, etc.
+
+The package is found in:
+
+- ftp://ftp.kernel.org/pub/linux/kernel/people/tiwai/misc/
+
+A git repository is available:
+
+- git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/hda-emu.git
+
+See README file in the tarball for more details about hda-emu
+program.
diff --git a/Documentation/sound/alsa/Procfile.txt b/Documentation/sound/alsa/Procfile.txt
index f738b296440a..bba2dbb79d81 100644
--- a/Documentation/sound/alsa/Procfile.txt
+++ b/Documentation/sound/alsa/Procfile.txt
@@ -153,6 +153,16 @@ card*/codec#*
         Shows the general codec information and the attribute of each
         widget node.
 
+card*/eld#*
+        Available for HDMI or DisplayPort interfaces.
+        Shows ELD(EDID Like Data) info retrieved from the attached HDMI sink,
+        and describes its audio capabilities and configurations.
+
+        Some ELD fields may be modified by doing `echo name hex_value > eld#*`.
+        Only do this if you are sure the HDMI sink provided value is wrong.
+        And if that makes your HDMI audio work, please report to us so that we
+        can fix it in future kernel releases.
+
 
 Sequencer Information
 ---------------------
diff --git a/Documentation/sound/alsa/soc/machine.txt b/Documentation/sound/alsa/soc/machine.txt
index f370e7db86af..bab7711ce963 100644
--- a/Documentation/sound/alsa/soc/machine.txt
+++ b/Documentation/sound/alsa/soc/machine.txt
@@ -9,7 +9,7 @@ the audio subsystem with the kernel as a platform device and is represented by
 the following struct:-
 
 /* SoC machine */
-struct snd_soc_machine {
+struct snd_soc_card {
         char *name;
 
         int (*probe)(struct platform_device *pdev);
@@ -67,10 +67,10 @@ static struct snd_soc_dai_link corgi_dai = {
         .ops = &corgi_ops,
 };
 
-struct snd_soc_machine then sets up the machine with it's DAIs. e.g.
+struct snd_soc_card then sets up the machine with it's DAIs. e.g.
 
 /* corgi audio machine driver */
-static struct snd_soc_machine snd_soc_machine_corgi = {
+static struct snd_soc_card snd_soc_corgi = {
         .name = "Corgi",
         .dai_link = &corgi_dai,
         .num_links = 1,
@@ -90,7 +90,7 @@ static struct wm8731_setup_data corgi_wm8731_setup = {
 
 /* corgi audio subsystem */
 static struct snd_soc_device corgi_snd_devdata = {
-        .machine = &snd_soc_machine_corgi,
+        .machine = &snd_soc_corgi,
         .platform = &pxa2xx_soc_platform,
         .codec_dev = &soc_codec_dev_wm8731,
         .codec_data = &corgi_wm8731_setup,
diff --git a/Documentation/tracepoints.txt b/Documentation/tracepoints.txt
index 5d354e167494..6f0a044f5b5e 100644
--- a/Documentation/tracepoints.txt
+++ b/Documentation/tracepoints.txt
@@ -3,28 +3,30 @@
                             Mathieu Desnoyers
 
 
-This document introduces Linux Kernel Tracepoints and their use. It provides
-examples of how to insert tracepoints in the kernel and connect probe functions
-to them and provides some examples of probe functions.
+This document introduces Linux Kernel Tracepoints and their use. It
+provides examples of how to insert tracepoints in the kernel and
+connect probe functions to them and provides some examples of probe
+functions.
 
 
 * Purpose of tracepoints
 
-A tracepoint placed in code provides a hook to call a function (probe) that you
-can provide at runtime. A tracepoint can be "on" (a probe is connected to it) or
-"off" (no probe is attached). When a tracepoint is "off" it has no effect,
-except for adding a tiny time penalty (checking a condition for a branch) and
-space penalty (adding a few bytes for the function call at the end of the
-instrumented function and adds a data structure in a separate section).  When a
-tracepoint is "on", the function you provide is called each time the tracepoint
-is executed, in the execution context of the caller. When the function provided
-ends its execution, it returns to the caller (continuing from the tracepoint
-site).
+A tracepoint placed in code provides a hook to call a function (probe)
+that you can provide at runtime. A tracepoint can be "on" (a probe is
+connected to it) or "off" (no probe is attached). When a tracepoint is
+"off" it has no effect, except for adding a tiny time penalty
+(checking a condition for a branch) and space penalty (adding a few
+bytes for the function call at the end of the instrumented function
+and adds a data structure in a separate section).  When a tracepoint
+is "on", the function you provide is called each time the tracepoint
+is executed, in the execution context of the caller. When the function
+provided ends its execution, it returns to the caller (continuing from
+the tracepoint site).
 
 You can put tracepoints at important locations in the code. They are
 lightweight hooks that can pass an arbitrary number of parameters,
-which prototypes are described in a tracepoint declaration placed in a header
-file.
+which prototypes are described in a tracepoint declaration placed in a
+header file.
 
 They can be used for tracing and performance accounting.
 
@@ -42,14 +44,16 @@ In include/trace/subsys.h :
 
 #include <linux/tracepoint.h>
 
-DEFINE_TRACE(subsys_eventname,
-        TPPTOTO(int firstarg, struct task_struct *p),
+DECLARE_TRACE(subsys_eventname,
+        TPPROTO(int firstarg, struct task_struct *p),
         TPARGS(firstarg, p));
 
 In subsys/file.c (where the tracing statement must be added) :
 
 #include <trace/subsys.h>
 
+DEFINE_TRACE(subsys_eventname);
+
 void somefct(void)
 {
         ...
@@ -61,31 +65,41 @@ Where :
 - subsys_eventname is an identifier unique to your event
     - subsys is the name of your subsystem.
     - eventname is the name of the event to trace.
-- TPPTOTO(int firstarg, struct task_struct *p) is the prototype of the function
-  called by this tracepoint.
-- TPARGS(firstarg, p) are the parameters names, same as found in the prototype.
 
-Connecting a function (probe) to a tracepoint is done by providing a probe
-(function to call) for the specific tracepoint through
-register_trace_subsys_eventname().  Removing a probe is done through
-unregister_trace_subsys_eventname(); it will remove the probe sure there is no
-caller left using the probe when it returns. Probe removal is preempt-safe
-because preemption is disabled around the probe call. See the "Probe example"
-section below for a sample probe module.
-
-The tracepoint mechanism supports inserting multiple instances of the same
-tracepoint, but a single definition must be made of a given tracepoint name over
-all the kernel to make sure no type conflict will occur. Name mangling of the
-tracepoints is done using the prototypes to make sure typing is correct.
-Verification of probe type correctness is done at the registration site by the
-compiler. Tracepoints can be put in inline functions, inlined static functions,
-and unrolled loops as well as regular functions.
-
-The naming scheme "subsys_event" is suggested here as a convention intended
-to limit collisions. Tracepoint names are global to the kernel: they are
-considered as being the same whether they are in the core kernel image or in
-modules.
+- TPPROTO(int firstarg, struct task_struct *p) is the prototype of the
+  function called by this tracepoint.
 
+- TPARGS(firstarg, p) are the parameters names, same as found in the
+  prototype.
+
+Connecting a function (probe) to a tracepoint is done by providing a
+probe (function to call) for the specific tracepoint through
+register_trace_subsys_eventname().  Removing a probe is done through
+unregister_trace_subsys_eventname(); it will remove the probe.
+
+tracepoint_synchronize_unregister() must be called before the end of
+the module exit function to make sure there is no caller left using
+the probe. This, and the fact that preemption is disabled around the
+probe call, make sure that probe removal and module unload are safe.
+See the "Probe example" section below for a sample probe module.
+
+The tracepoint mechanism supports inserting multiple instances of the
+same tracepoint, but a single definition must be made of a given
+tracepoint name over all the kernel to make sure no type conflict will
+occur. Name mangling of the tracepoints is done using the prototypes
+to make sure typing is correct. Verification of probe type correctness
+is done at the registration site by the compiler. Tracepoints can be
+put in inline functions, inlined static functions, and unrolled loops
+as well as regular functions.
+
+The naming scheme "subsys_event" is suggested here as a convention
+intended to limit collisions. Tracepoint names are global to the
+kernel: they are considered as being the same whether they are in the
+core kernel image or in modules.
+
+If the tracepoint has to be used in kernel modules, an
+EXPORT_TRACEPOINT_SYMBOL_GPL() or EXPORT_TRACEPOINT_SYMBOL() can be
+used to export the defined tracepoints.
 
 * Probe / tracepoint example
 
diff --git a/Documentation/usb/gadget_serial.txt b/Documentation/usb/gadget_serial.txt
index 9b22bd14c348..eac7df94d8e3 100644
--- a/Documentation/usb/gadget_serial.txt
+++ b/Documentation/usb/gadget_serial.txt
@@ -114,11 +114,11 @@ modules.
 Then you must load the gadget serial driver.  To load it as an
 ACM device (recommended for interoperability), do this:
 
-  modprobe g_serial use_acm=1
+  modprobe g_serial
 
 To load it as a vendor specific bulk in/out device, do this:
 
-  modprobe g_serial
+  modprobe g_serial use_acm=0
 
 This will also automatically load the underlying gadget peripheral
 controller driver.  This must be done each time you reboot the gadget
diff --git a/Documentation/usb/proc_usb_info.txt b/Documentation/usb/proc_usb_info.txt
index 077e9032d0cd..fafcd4723260 100644
--- a/Documentation/usb/proc_usb_info.txt
+++ b/Documentation/usb/proc_usb_info.txt
@@ -49,8 +49,10 @@ it and 002/048 sometime later.
 
 These files can be read as binary data.  The binary data consists
 of first the device descriptor, then the descriptors for each
-configuration of the device.  That information is also shown in
-text form by the /proc/bus/usb/devices file, described later.
+configuration of the device.  Multi-byte fields in the device and
+configuration descriptors, but not other descriptors, are converted
+to host endianness by the kernel.  This information is also shown
+in text form by the /proc/bus/usb/devices file, described later.
 
 These files may also be used to write user-level drivers for the USB
 devices.  You would open the /proc/bus/usb/BBB/DDD file read/write,
diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
index 2917ce4ffdc4..270481906dc8 100644
--- a/Documentation/usb/usbmon.txt
+++ b/Documentation/usb/usbmon.txt
@@ -34,11 +34,12 @@ if usbmon is built into the kernel.
 Verify that bus sockets are present.
 
 # ls /sys/kernel/debug/usbmon
-0s  0t  0u  1s  1t  1u  2s  2t  2u  3s  3t  3u  4s  4t  4u
+0s  0u  1s  1t  1u  2s  2t  2u  3s  3t  3u  4s  4t  4u
 #
 
-Now you can choose to either use the sockets numbered '0' (to capture packets on
-all buses), and skip to step #3, or find the bus used by your device with step #2.
+Now you can choose to either use the socket '0u' (to capture packets on all
+buses), and skip to step #3, or find the bus used by your device with step #2.
+This allows to filter away annoying devices that talk continuously.
 
 2. Find which bus connects to the desired device
 
@@ -99,8 +100,9 @@ on the event type, but there is a set of words, common for all types.
 
 Here is the list of words, from left to right:
 
-- URB Tag. This is used to identify URBs is normally a kernel mode address
- of the URB structure in hexadecimal.
+- URB Tag. This is used to identify URBs, and is normally an in-kernel address
+  of the URB structure in hexadecimal, but can be a sequence number or any
+  other unique string, within reason.
 
 - Timestamp in microseconds, a decimal number. The timestamp's resolution
   depends on available clock, and so it can be much worse than a microsecond
diff --git a/Documentation/video4linux/API.html b/Documentation/video4linux/API.html
index afbe9ae7ee96..d749d41f647b 100644
--- a/Documentation/video4linux/API.html
+++ b/Documentation/video4linux/API.html
@@ -1,16 +1,27 @@
-<TITLE>V4L API</TITLE>
-<H1>Video For Linux APIs</H1>
-<table border=0>
-<tr>
-<td>
-<A HREF=http://www.linuxtv.org/downloads/video4linux/API/V4L1_API.html>
-V4L original API</a>
-</td><td>
-Obsoleted by V4L2 API
-</td></tr><tr><td>
-<A HREF=http://www.linuxtv.org/downloads/video4linux/API/V4L2_API>
-V4L2 API</a>
-</td><td>
-Should be used for new projects
-</td></tr>
-</table>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
+ <head>
+  <meta content="text/html;charset=ISO-8859-2" http-equiv="Content-Type" />
+  <title>V4L API</title>
+ </head>
+ <body>
+  <h1>Video For Linux APIs</h1>
+  <table border="0">
+   <tr>
+    <td>
+     <a href="http://www.linuxtv.org/downloads/video4linux/API/V4L1_API.html">V4L original API</a>
+    </td>
+    <td>
+     Obsoleted by V4L2 API
+    </td>
+   </tr>
+   <tr>
+    <td>
+     <a href="http://www.linuxtv.org/downloads/video4linux/API/V4L2_API">V4L2 API</a>
+    </td>
+    <td>Should be used for new projects
+    </td>
+   </tr>
+  </table>
+ </body>
+</html>
diff --git a/Documentation/video4linux/CARDLIST.bttv b/Documentation/video4linux/CARDLIST.bttv
index 60ba66836038..0d93fa1ac25e 100644
--- a/Documentation/video4linux/CARDLIST.bttv
+++ b/Documentation/video4linux/CARDLIST.bttv
@@ -104,8 +104,8 @@
 103 -> Grand X-Guard / Trust 814PCI                        [0304:0102]
 104 -> Nebula Electronics DigiTV                           [0071:0101]
 105 -> ProVideo PV143                                      [aa00:1430,aa00:1431,aa00:1432,aa00:1433,aa03:1433]
-106 -> PHYTEC VD-009-X1 MiniDIN (bt878)
-107 -> PHYTEC VD-009-X1 Combi (bt878)
+106 -> PHYTEC VD-009-X1 VD-011 MiniDIN (bt878)
+107 -> PHYTEC VD-009-X1 VD-011 Combi (bt878)
 108 -> PHYTEC VD-009 MiniDIN (bt878)
 109 -> PHYTEC VD-009 Combi (bt878)
 110 -> IVC-100                                             [ff00:a132]
@@ -151,3 +151,6 @@
 150 -> Geovision GV-600                                    [008a:763c]
 151 -> Kozumi KTV-01C
 152 -> Encore ENL TV-FM-2                                  [1000:1801]
+153 -> PHYTEC VD-012 (bt878)
+154 -> PHYTEC VD-012-X1 (bt878)
+155 -> PHYTEC VD-012-X2 (bt878)
diff --git a/Documentation/video4linux/CARDLIST.cx23885 b/Documentation/video4linux/CARDLIST.cx23885
index 64823ccacd69..35ea130e9898 100644
--- a/Documentation/video4linux/CARDLIST.cx23885
+++ b/Documentation/video4linux/CARDLIST.cx23885
@@ -11,3 +11,4 @@
  10 -> DViCO FusionHDTV7 Dual Express                      [18ac:d618]
  11 -> DViCO FusionHDTV DVB-T Dual Express                 [18ac:db78]
  12 -> Leadtek Winfast PxDVR3200 H                         [107d:6681]
+ 13 -> Compro VideoMate E650F                              [185b:e800]
diff --git a/Documentation/video4linux/CARDLIST.cx88 b/Documentation/video4linux/CARDLIST.cx88
index a5227e308f4a..0d08f1edcf6d 100644
--- a/Documentation/video4linux/CARDLIST.cx88
+++ b/Documentation/video4linux/CARDLIST.cx88
@@ -2,7 +2,7 @@
   1 -> Hauppauge WinTV 34xxx models                        [0070:3400,0070:3401]
   2 -> GDI Black Gold                                      [14c7:0106,14c7:0107]
   3 -> PixelView                                           [1554:4811]
-  4 -> ATI TV Wonder Pro                                   [1002:00f8]
+  4 -> ATI TV Wonder Pro                                   [1002:00f8,1002:00f9]
   5 -> Leadtek Winfast 2000XP Expert                       [107d:6611,107d:6613]
   6 -> AverTV Studio 303 (M126)                            [1461:000b]
   7 -> MSI TV-@nywhere Master                              [1462:8606]
@@ -74,3 +74,6 @@
  73 -> TeVii S420 DVB-S                                    [d420:9022]
  74 -> Prolink Pixelview Global Extreme                    [1554:4976]
  75 -> PROF 7300 DVB-S/S2                                  [B033:3033]
+ 76 -> SATTRADE ST4200 DVB-S/S2                            [b200:4200]
+ 77 -> TBS 8910 DVB-S                                      [8910:8888]
+ 78 -> Prof 6200 DVB-S                                     [b022:3022]
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 187cc48d0924..75bded8a4aa2 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -1,5 +1,5 @@
   0 -> Unknown EM2800 video grabber             (em2800)        [eb1a:2800]
-  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2820,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
+  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
   2 -> Terratec Cinergy 250 USB                 (em2820/em2840) [0ccd:0036]
   3 -> Pinnacle PCTV USB 2                      (em2820/em2840) [2304:0208]
   4 -> Hauppauge WinTV USB 2                    (em2820/em2840) [2040:4200,2040:4201]
@@ -12,9 +12,9 @@
  11 -> Terratec Hybrid XS                       (em2880)        [0ccd:0042]
  12 -> Kworld PVR TV 2800 RF                    (em2820/em2840)
  13 -> Terratec Prodigy XS                      (em2880)        [0ccd:0047]
- 14 -> Pixelview Prolink PlayTV USB 2.0         (em2820/em2840) [eb1a:2821]
+ 14 -> Pixelview Prolink PlayTV USB 2.0         (em2820/em2840)
  15 -> V-Gear PocketTV                          (em2800)
- 16 -> Hauppauge WinTV HVR 950                  (em2883)        [2040:6513,2040:6517,2040:651b,2040:651f]
+ 16 -> Hauppauge WinTV HVR 950                  (em2883)        [2040:6513,2040:6517,2040:651b]
  17 -> Pinnacle PCTV HD Pro Stick               (em2880)        [2304:0227]
  18 -> Hauppauge WinTV HVR 900 (R2)             (em2880)        [2040:6502]
  19 -> PointNix Intra-Oral Camera               (em2860)
@@ -27,7 +27,6 @@
  26 -> Hercules Smart TV USB 2.0                (em2820/em2840)
  27 -> Pinnacle PCTV USB 2 (Philips FM1216ME)   (em2820/em2840)
  28 -> Leadtek Winfast USB II Deluxe            (em2820/em2840)
- 29 -> Pinnacle Dazzle DVC 100                  (em2820/em2840)
  30 -> Videology 20K14XUSB USB2.0               (em2820/em2840)
  31 -> Usbgear VD204v9                          (em2821)
  32 -> Supercomp USB 2.0 TV                     (em2821)
@@ -57,3 +56,5 @@
  56 -> Pinnacle Hybrid Pro (2)                  (em2882)        [2304:0226]
  57 -> Kworld PlusTV HD Hybrid 330              (em2883)        [eb1a:a316]
  58 -> Compro VideoMate ForYou/Stereo           (em2820/em2840) [185b:2041]
+ 60 -> Hauppauge WinTV HVR 850                  (em2883)        [2040:651f]
+ 61 -> Pixelview PlayTV Box 4 USB 2.0           (em2820/em2840)
diff --git a/Documentation/video4linux/CARDLIST.saa7134 b/Documentation/video4linux/CARDLIST.saa7134
index dc67eef38ff9..335aef4dcaeb 100644
--- a/Documentation/video4linux/CARDLIST.saa7134
+++ b/Documentation/video4linux/CARDLIST.saa7134
@@ -10,7 +10,7 @@
   9 -> Medion 5044
  10 -> Kworld/KuroutoShikou SAA7130-TVPCI
  11 -> Terratec Cinergy 600 TV                  [153b:1143]
- 12 -> Medion 7134                              [16be:0003]
+ 12 -> Medion 7134                              [16be:0003,16be:5000]
  13 -> Typhoon TV+Radio 90031
  14 -> ELSA EX-VISION 300TV                     [1048:226b]
  15 -> ELSA EX-VISION 500TV                     [1048:226a]
@@ -151,3 +151,4 @@
 150 -> Zogis Real Angel 220
 151 -> ADS Tech Instant HDTV                    [1421:0380]
 152 -> Asus Tiger Rev:1.00                      [1043:4857]
+153 -> Kworld Plus TV Analog Lite PCI           [17de:7128]
diff --git a/Documentation/video4linux/README.cx88 b/Documentation/video4linux/README.cx88
index 166d5960b1a9..35fae23f883b 100644
--- a/Documentation/video4linux/README.cx88
+++ b/Documentation/video4linux/README.cx88
@@ -1,4 +1,3 @@
-
 cx8800 release notes
 ====================
 
@@ -10,21 +9,20 @@ current status
 
 video
         - Basically works.
-        - Some minor image quality glitches.
-        - For now only capture, overlay support isn't completed yet.
+        - For now, only capture and read(). Overlay isn't supported.
 
 audio
         - The chip specs for the on-chip TV sound decoder are next
           to useless :-/
         - Neverless the builtin TV sound decoder starts working now,
-          at least for PAL-BG.  Other TV norms need other code ...
+          at least for some standards.
           FOR ANY REPORTS ON THIS PLEASE MENTION THE TV NORM YOU ARE
           USING.
         - Most tuner chips do provide mono sound, which may or may not
           be useable depending on the board design.  With the Hauppauge
           cards it works, so there is mono sound available as fallback.
         - audio data dma (i.e. recording without loopback cable to the
-          sound card) should be possible, but there is no code yet ...
+          sound card) is supported via cx88-alsa.
 
 vbi
         - Code present. Works for NTSC closed caption. PAL and other
diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt
index 004818fab040..1c58a7630146 100644
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -50,9 +50,14 @@ ov519		045e:028c	Micro$oft xbox cam
 spca508         0461:0815       Micro Innovation IC200
 sunplus         0461:0821       Fujifilm MV-1
 zc3xx           0461:0a00       MicroInnovation WebCam320
+stv06xx         046d:0840       QuickCam Express
+stv06xx         046d:0850       LEGO cam / QuickCam Web
+stv06xx         046d:0870       Dexxa WebCam USB
 spca500         046d:0890       Logitech QuickCam traveler
 vc032x          046d:0892       Logitech Orbicam
 vc032x          046d:0896       Logitech Orbicam
+vc032x          046d:0897       Logitech QuickCam for Dell notebooks
+zc3xx           046d:089d       Logitech QuickCam E2500
 zc3xx           046d:08a0       Logitech QC IM
 zc3xx           046d:08a1       Logitech QC IM 0x08A1 +sound
 zc3xx           046d:08a2       Labtec Webcam Pro
@@ -169,6 +174,9 @@ spca500		06bd:0404	Agfa CL20
 spca500         06be:0800       Optimedia
 sunplus         06d6:0031       Trust 610 LCD PowerC@m Zoom
 spca506         06e1:a190       ADS Instant VCD
+ov534           06f8:3002       Hercules Blog Webcam
+ov534           06f8:3003       Hercules Dualpix HD Weblog
+sonixj          06f8:3004       Hercules Classic Silver
 spca508         0733:0110       ViewQuest VQ110
 spca508         0130:0130       Clone Digital Webcam 11043
 spca501         0733:0401       Intel Create and Share
@@ -199,7 +207,8 @@ sunplus		08ca:2050	Medion MD 41437
 sunplus         08ca:2060       Aiptek PocketDV5300
 tv8532          0923:010f       ICM532 cams
 mars            093a:050f       Mars-Semi Pc-Camera
-pac207          093a:2460       PAC207 Qtec Webcam 100
+pac207          093a:2460       Qtec Webcam 100
+pac207          093a:2461       HP Webcam
 pac207          093a:2463       Philips SPC 220 NC
 pac207          093a:2464       Labtec Webcam 1200
 pac207          093a:2468       PAC207
@@ -213,10 +222,13 @@ pac7311		093a:2603	PAC7312
 pac7311         093a:2608       Trust WB-3300p
 pac7311         093a:260e       Gigaware VGA PC Camera, Trust WB-3350p, SIGMA cam 2350
 pac7311         093a:260f       SnakeCam
+pac7311         093a:2620       Apollo AC-905
 pac7311         093a:2621       PAC731x
+pac7311         093a:2622       Genius Eye 312
 pac7311         093a:2624       PAC7302
 pac7311         093a:2626       Labtec 2200
 pac7311         093a:262a       Webcam 300k
+pac7311         093a:262c       Philips SPC 230 NC
 zc3xx           0ac8:0302       Z-star Vimicro zc0302
 vc032x          0ac8:0321       Vimicro generic vc0321
 vc032x          0ac8:0323       Vimicro Vc0323
@@ -249,11 +261,13 @@ sonixj		0c45:60c0	Sangha Sn535
 sonixj          0c45:60ec       SN9C105+MO4000
 sonixj          0c45:60fb       Surfer NoName
 sonixj          0c45:60fc       LG-LIC300
+sonixj          0c45:60fe       Microdia Audio
 sonixj          0c45:6128       Microdia/Sonix SNP325
 sonixj          0c45:612a       Avant Camera
 sonixj          0c45:612c       Typhoon Rasy Cam 1.3MPix
 sonixj          0c45:6130       Sonix Pccam
 sonixj          0c45:6138       Sn9c120 Mo4000
+sonixj          0c45:613a       Microdia Sonix PC Camera
 sonixj          0c45:613b       Surfer SN-206
 sonixj          0c45:613c       Sonix Pccam168
 sonixj          0c45:6143       Sonix Pccam168
@@ -263,6 +277,9 @@ etoms		102c:6251	Qcam xxxxxx VGA
 zc3xx           10fd:0128       Typhoon Webshot II USB 300k 0x0128
 spca561         10fd:7e50       FlyCam Usb 100
 zc3xx           10fd:8050       Typhoon Webshot II USB 300k
+ov534           1415:2000       Sony HD Eye for PS3 (SLEH 00201)
+pac207          145f:013a       Trust WB-1300N
+vc032x          15b8:6002       HP 2.0 Megapixel rz406aa
 spca501         1776:501c       Arowana 300K CMOS Camera
 t613            17a1:0128       TASCORP JPEG Webcam, NGS Cyclops
 vc032x          17ef:4802       Lenovo Vc0323+MI1310_SOC
diff --git a/Documentation/video4linux/v4l2-framework.txt b/Documentation/video4linux/v4l2-framework.txt
new file mode 100644
index 000000000000..eeae76c22a93
--- /dev/null
+++ b/Documentation/video4linux/v4l2-framework.txt
@@ -0,0 +1,520 @@
+Overview of the V4L2 driver framework
+=====================================
+
+This text documents the various structures provided by the V4L2 framework and
+their relationships.
+
+
+Introduction
+------------
+
+The V4L2 drivers tend to be very complex due to the complexity of the
+hardware: most devices have multiple ICs, export multiple device nodes in
+/dev, and create also non-V4L2 devices such as DVB, ALSA, FB, I2C and input
+(IR) devices.
+
+Especially the fact that V4L2 drivers have to setup supporting ICs to
+do audio/video muxing/encoding/decoding makes it more complex than most.
+Usually these ICs are connected to the main bridge driver through one or
+more I2C busses, but other busses can also be used. Such devices are
+called 'sub-devices'.
+
+For a long time the framework was limited to the video_device struct for
+creating V4L device nodes and video_buf for handling the video buffers
+(note that this document does not discuss the video_buf framework).
+
+This meant that all drivers had to do the setup of device instances and
+connecting to sub-devices themselves. Some of this is quite complicated
+to do right and many drivers never did do it correctly.
+
+There is also a lot of common code that could never be refactored due to
+the lack of a framework.
+
+So this framework sets up the basic building blocks that all drivers
+need and this same framework should make it much easier to refactor
+common code into utility functions shared by all drivers.
+
+
+Structure of a driver
+---------------------
+
+All drivers have the following structure:
+
+1) A struct for each device instance containing the device state.
+
+2) A way of initializing and commanding sub-devices (if any).
+
+3) Creating V4L2 device nodes (/dev/videoX, /dev/vbiX, /dev/radioX and
+   /dev/vtxX) and keeping track of device-node specific data.
+
+4) Filehandle-specific structs containing per-filehandle data.
+
+This is a rough schematic of how it all relates:
+
+    device instances
+      |
+      +-sub-device instances
+      |
+      \-V4L2 device nodes
+          |
+          \-filehandle instances
+
+
+Structure of the framework
+--------------------------
+
+The framework closely resembles the driver structure: it has a v4l2_device
+struct for the device instance data, a v4l2_subdev struct to refer to
+sub-device instances, the video_device struct stores V4L2 device node data
+and in the future a v4l2_fh struct will keep track of filehandle instances
+(this is not yet implemented).
+
+
+struct v4l2_device
+------------------
+
+Each device instance is represented by a struct v4l2_device (v4l2-device.h).
+Very simple devices can just allocate this struct, but most of the time you
+would embed this struct inside a larger struct.
+
+You must register the device instance:
+
+        v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev);
+
+Registration will initialize the v4l2_device struct and link dev->driver_data
+to v4l2_dev. Registration will also set v4l2_dev->name to a value derived from
+dev (driver name followed by the bus_id, to be precise). You may change the
+name after registration if you want.
+
+The first 'dev' argument is normally the struct device pointer of a pci_dev,
+usb_device or platform_device.
+
+You unregister with:
+
+        v4l2_device_unregister(struct v4l2_device *v4l2_dev);
+
+Unregistering will also automatically unregister all subdevs from the device.
+
+Sometimes you need to iterate over all devices registered by a specific
+driver. This is usually the case if multiple device drivers use the same
+hardware. E.g. the ivtvfb driver is a framebuffer driver that uses the ivtv
+hardware. The same is true for alsa drivers for example.
+
+You can iterate over all registered devices as follows:
+
+static int callback(struct device *dev, void *p)
+{
+        struct v4l2_device *v4l2_dev = dev_get_drvdata(dev);
+
+        /* test if this device was inited */
+        if (v4l2_dev == NULL)
+                return 0;
+        ...
+        return 0;
+}
+
+int iterate(void *p)
+{
+        struct device_driver *drv;
+        int err;
+
+        /* Find driver 'ivtv' on the PCI bus.
+           pci_bus_type is a global. For USB busses use usb_bus_type. */
+        drv = driver_find("ivtv", &pci_bus_type);
+        /* iterate over all ivtv device instances */
+        err = driver_for_each_device(drv, NULL, p, callback);
+        put_driver(drv);
+        return err;
+}
+
+Sometimes you need to keep a running counter of the device instance. This is
+commonly used to map a device instance to an index of a module option array.
+
+The recommended approach is as follows:
+
+static atomic_t drv_instance = ATOMIC_INIT(0);
+
+static int __devinit drv_probe(struct pci_dev *dev,
+                                const struct pci_device_id *pci_id)
+{
+        ...
+        state->instance = atomic_inc_return(&drv_instance) - 1;
+}
+
+
+struct v4l2_subdev
+------------------
+
+Many drivers need to communicate with sub-devices. These devices can do all
+sort of tasks, but most commonly they handle audio and/or video muxing,
+encoding or decoding. For webcams common sub-devices are sensors and camera
+controllers.
+
+Usually these are I2C devices, but not necessarily. In order to provide the
+driver with a consistent interface to these sub-devices the v4l2_subdev struct
+(v4l2-subdev.h) was created.
+
+Each sub-device driver must have a v4l2_subdev struct. This struct can be
+stand-alone for simple sub-devices or it might be embedded in a larger struct
+if more state information needs to be stored. Usually there is a low-level
+device struct (e.g. i2c_client) that contains the device data as setup
+by the kernel. It is recommended to store that pointer in the private
+data of v4l2_subdev using v4l2_set_subdevdata(). That makes it easy to go
+from a v4l2_subdev to the actual low-level bus-specific device data.
+
+You also need a way to go from the low-level struct to v4l2_subdev. For the
+common i2c_client struct the i2c_set_clientdata() call is used to store a
+v4l2_subdev pointer, for other busses you may have to use other methods.
+
+From the bridge driver perspective you load the sub-device module and somehow
+obtain the v4l2_subdev pointer. For i2c devices this is easy: you call
+i2c_get_clientdata(). For other busses something similar needs to be done.
+Helper functions exists for sub-devices on an I2C bus that do most of this
+tricky work for you.
+
+Each v4l2_subdev contains function pointers that sub-device drivers can
+implement (or leave NULL if it is not applicable). Since sub-devices can do
+so many different things and you do not want to end up with a huge ops struct
+of which only a handful of ops are commonly implemented, the function pointers
+are sorted according to category and each category has its own ops struct.
+
+The top-level ops struct contains pointers to the category ops structs, which
+may be NULL if the subdev driver does not support anything from that category.
+
+It looks like this:
+
+struct v4l2_subdev_core_ops {
+        int (*g_chip_ident)(struct v4l2_subdev *sd, struct v4l2_chip_ident *chip);
+        int (*log_status)(struct v4l2_subdev *sd);
+        int (*init)(struct v4l2_subdev *sd, u32 val);
+        ...
+};
+
+struct v4l2_subdev_tuner_ops {
+        ...
+};
+
+struct v4l2_subdev_audio_ops {
+        ...
+};
+
+struct v4l2_subdev_video_ops {
+        ...
+};
+
+struct v4l2_subdev_ops {
+        const struct v4l2_subdev_core_ops  *core;
+        const struct v4l2_subdev_tuner_ops *tuner;
+        const struct v4l2_subdev_audio_ops *audio;
+        const struct v4l2_subdev_video_ops *video;
+};
+
+The core ops are common to all subdevs, the other categories are implemented
+depending on the sub-device. E.g. a video device is unlikely to support the
+audio ops and vice versa.
+
+This setup limits the number of function pointers while still making it easy
+to add new ops and categories.
+
+A sub-device driver initializes the v4l2_subdev struct using:
+
+        v4l2_subdev_init(subdev, &ops);
+
+Afterwards you need to initialize subdev->name with a unique name and set the
+module owner. This is done for you if you use the i2c helper functions.
+
+A device (bridge) driver needs to register the v4l2_subdev with the
+v4l2_device:
+
+        int err = v4l2_device_register_subdev(device, subdev);
+
+This can fail if the subdev module disappeared before it could be registered.
+After this function was called successfully the subdev->dev field points to
+the v4l2_device.
+
+You can unregister a sub-device using:
+
+        v4l2_device_unregister_subdev(subdev);
+
+Afterwards the subdev module can be unloaded and subdev->dev == NULL.
+
+You can call an ops function either directly:
+
+        err = subdev->ops->core->g_chip_ident(subdev, &chip);
+
+but it is better and easier to use this macro:
+
+        err = v4l2_subdev_call(subdev, core, g_chip_ident, &chip);
+
+The macro will to the right NULL pointer checks and returns -ENODEV if subdev
+is NULL, -ENOIOCTLCMD if either subdev->core or subdev->core->g_chip_ident is
+NULL, or the actual result of the subdev->ops->core->g_chip_ident ops.
+
+It is also possible to call all or a subset of the sub-devices:
+
+        v4l2_device_call_all(dev, 0, core, g_chip_ident, &chip);
+
+Any subdev that does not support this ops is skipped and error results are
+ignored. If you want to check for errors use this:
+
+        err = v4l2_device_call_until_err(dev, 0, core, g_chip_ident, &chip);
+
+Any error except -ENOIOCTLCMD will exit the loop with that error. If no
+errors (except -ENOIOCTLCMD) occured, then 0 is returned.
+
+The second argument to both calls is a group ID. If 0, then all subdevs are
+called. If non-zero, then only those whose group ID match that value will
+be called. Before a bridge driver registers a subdev it can set subdev->grp_id
+to whatever value it wants (it's 0 by default). This value is owned by the
+bridge driver and the sub-device driver will never modify or use it.
+
+The group ID gives the bridge driver more control how callbacks are called.
+For example, there may be multiple audio chips on a board, each capable of
+changing the volume. But usually only one will actually be used when the
+user want to change the volume. You can set the group ID for that subdev to
+e.g. AUDIO_CONTROLLER and specify that as the group ID value when calling
+v4l2_device_call_all(). That ensures that it will only go to the subdev
+that needs it.
+
+The advantage of using v4l2_subdev is that it is a generic struct and does
+not contain any knowledge about the underlying hardware. So a driver might
+contain several subdevs that use an I2C bus, but also a subdev that is
+controlled through GPIO pins. This distinction is only relevant when setting
+up the device, but once the subdev is registered it is completely transparent.
+
+
+I2C sub-device drivers
+----------------------
+
+Since these drivers are so common, special helper functions are available to
+ease the use of these drivers (v4l2-common.h).
+
+The recommended method of adding v4l2_subdev support to an I2C driver is to
+embed the v4l2_subdev struct into the state struct that is created for each
+I2C device instance. Very simple devices have no state struct and in that case
+you can just create a v4l2_subdev directly.
+
+A typical state struct would look like this (where 'chipname' is replaced by
+the name of the chip):
+
+struct chipname_state {
+        struct v4l2_subdev sd;
+        ...  /* additional state fields */
+};
+
+Initialize the v4l2_subdev struct as follows:
+
+        v4l2_i2c_subdev_init(&state->sd, client, subdev_ops);
+
+This function will fill in all the fields of v4l2_subdev and ensure that the
+v4l2_subdev and i2c_client both point to one another.
+
+You should also add a helper inline function to go from a v4l2_subdev pointer
+to a chipname_state struct:
+
+static inline struct chipname_state *to_state(struct v4l2_subdev *sd)
+{
+        return container_of(sd, struct chipname_state, sd);
+}
+
+Use this to go from the v4l2_subdev struct to the i2c_client struct:
+
+        struct i2c_client *client = v4l2_get_subdevdata(sd);
+
+And this to go from an i2c_client to a v4l2_subdev struct:
+
+        struct v4l2_subdev *sd = i2c_get_clientdata(client);
+
+Finally you need to make a command function to make driver->command()
+call the right subdev_ops functions:
+
+static int subdev_command(struct i2c_client *client, unsigned cmd, void *arg)
+{
+        return v4l2_subdev_command(i2c_get_clientdata(client), cmd, arg);
+}
+
+If driver->command is never used then you can leave this out. Eventually the
+driver->command usage should be removed from v4l.
+
+Make sure to call v4l2_device_unregister_subdev(sd) when the remove() callback
+is called. This will unregister the sub-device from the bridge driver. It is
+safe to call this even if the sub-device was never registered.
+
+
+The bridge driver also has some helper functions it can use:
+
+struct v4l2_subdev *sd = v4l2_i2c_new_subdev(adapter, "module_foo", "chipid", 0x36);
+
+This loads the given module (can be NULL if no module needs to be loaded) and
+calls i2c_new_device() with the given i2c_adapter and chip/address arguments.
+If all goes well, then it registers the subdev with the v4l2_device. It gets
+the v4l2_device by calling i2c_get_adapdata(adapter), so you should make sure
+that adapdata is set to v4l2_device when you setup the i2c_adapter in your
+driver.
+
+You can also use v4l2_i2c_new_probed_subdev() which is very similar to
+v4l2_i2c_new_subdev(), except that it has an array of possible I2C addresses
+that it should probe. Internally it calls i2c_new_probed_device().
+
+Both functions return NULL if something went wrong.
+
+
+struct video_device
+-------------------
+
+The actual device nodes in the /dev directory are created using the
+video_device struct (v4l2-dev.h). This struct can either be allocated
+dynamically or embedded in a larger struct.
+
+To allocate it dynamically use:
+
+        struct video_device *vdev = video_device_alloc();
+
+        if (vdev == NULL)
+                return -ENOMEM;
+
+        vdev->release = video_device_release;
+
+If you embed it in a larger struct, then you must set the release()
+callback to your own function:
+
+        struct video_device *vdev = &my_vdev->vdev;
+
+        vdev->release = my_vdev_release;
+
+The release callback must be set and it is called when the last user
+of the video device exits.
+
+The default video_device_release() callback just calls kfree to free the
+allocated memory.
+
+You should also set these fields:
+
+- parent: set to the parent device (same device as was used to register
+  v4l2_device).
+- name: set to something descriptive and unique.
+- fops: set to the file_operations struct.
+- ioctl_ops: if you use the v4l2_ioctl_ops to simplify ioctl maintenance
+  (highly recommended to use this and it might become compulsory in the
+  future!), then set this to your v4l2_ioctl_ops struct.
+
+If you use v4l2_ioctl_ops, then you should set .unlocked_ioctl to
+__video_ioctl2 or .ioctl to video_ioctl2 in your file_operations struct.
+
+
+video_device registration
+-------------------------
+
+Next you register the video device: this will create the character device
+for you.
+
+        err = video_register_device(vdev, VFL_TYPE_GRABBER, -1);
+        if (err) {
+                video_device_release(vdev); // or kfree(my_vdev);
+                return err;
+        }
+
+Which device is registered depends on the type argument. The following
+types exist:
+
+VFL_TYPE_GRABBER: videoX for video input/output devices
+VFL_TYPE_VBI: vbiX for vertical blank data (i.e. closed captions, teletext)
+VFL_TYPE_RADIO: radioX for radio tuners
+VFL_TYPE_VTX: vtxX for teletext devices (deprecated, don't use)
+
+The last argument gives you a certain amount of control over the device
+kernel number used (i.e. the X in videoX). Normally you will pass -1 to
+let the v4l2 framework pick the first free number. But if a driver creates
+many devices, then it can be useful to have different video devices in
+separate ranges. For example, video capture devices start at 0, video
+output devices start at 16.
+
+So you can use the last argument to specify a minimum kernel number and
+the v4l2 framework will try to pick the first free number that is equal
+or higher to what you passed. If that fails, then it will just pick the
+first free number.
+
+Whenever a device node is created some attributes are also created for you.
+If you look in /sys/class/video4linux you see the devices. Go into e.g.
+video0 and you will see 'name' and 'index' attributes. The 'name' attribute
+is the 'name' field of the video_device struct. The 'index' attribute is
+a device node index that can be assigned by the driver, or that is calculated
+for you.
+
+If you call video_register_device(), then the index is just increased by
+1 for each device node you register. The first video device node you register
+always starts off with 0.
+
+Alternatively you can call video_register_device_index() which is identical
+to video_register_device(), but with an extra index argument. Here you can
+pass a specific index value (between 0 and 31) that should be used.
+
+Users can setup udev rules that utilize the index attribute to make fancy
+device names (e.g. 'mpegX' for MPEG video capture device nodes).
+
+After the device was successfully registered, then you can use these fields:
+
+- vfl_type: the device type passed to video_register_device.
+- minor: the assigned device minor number.
+- num: the device kernel number (i.e. the X in videoX).
+- index: the device index number (calculated or set explicitly using
+  video_register_device_index).
+
+If the registration failed, then you need to call video_device_release()
+to free the allocated video_device struct, or free your own struct if the
+video_device was embedded in it. The vdev->release() callback will never
+be called if the registration failed, nor should you ever attempt to
+unregister the device if the registration failed.
+
+
+video_device cleanup
+--------------------
+
+When the video device nodes have to be removed, either during the unload
+of the driver or because the USB device was disconnected, then you should
+unregister them:
+
+        video_unregister_device(vdev);
+
+This will remove the device nodes from sysfs (causing udev to remove them
+from /dev).
+
+After video_unregister_device() returns no new opens can be done.
+
+However, in the case of USB devices some application might still have one
+of these device nodes open. You should block all new accesses to read,
+write, poll, etc. except possibly for certain ioctl operations like
+queueing buffers.
+
+When the last user of the video device node exits, then the vdev->release()
+callback is called and you can do the final cleanup there.
+
+
+video_device helper functions
+-----------------------------
+
+There are a few useful helper functions:
+
+You can set/get driver private data in the video_device struct using:
+
+void *video_get_drvdata(struct video_device *dev);
+void video_set_drvdata(struct video_device *dev, void *data);
+
+Note that you can safely call video_set_drvdata() before calling
+video_register_device().
+
+And this function:
+
+struct video_device *video_devdata(struct file *file);
+
+returns the video_device belonging to the file struct.
+
+The final helper function combines video_get_drvdata with
+video_devdata:
+
+void *video_drvdata(struct file *file);
+
+You can go from a video_device struct to the v4l2_device struct using:
+
+struct v4l2_device *v4l2_dev = dev_get_drvdata(vdev->parent);
+
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index 83c0033ee9e0..fcdc62b3c3d8 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -349,7 +349,7 @@ Protocol:	2.00+
         3  SYSLINUX
         4  EtherBoot
         5  ELILO
-        7  GRuB
+        7  GRUB
         8  U-BOOT
         9  Xen
         A  Gujin
@@ -537,8 +537,8 @@ Type:		read
 Offset/size:    0x248/4
 Protocol:       2.08+
 
-  If non-zero then this field contains the offset from the end of the
-  real-mode code to the payload.
+  If non-zero then this field contains the offset from the beginning
+  of the protected-mode code to the payload.
 
   The payload may be compressed. The format of both the compressed and
   uncompressed data should be determined using the standard magic
diff --git a/Documentation/x86/pat.txt b/Documentation/x86/pat.txt
index c93ff5f4c0dd..cf08c9fff3cd 100644
--- a/Documentation/x86/pat.txt
+++ b/Documentation/x86/pat.txt
@@ -80,6 +80,30 @@ pci proc               |    --    |    --      |       WC         |
                        |          |            |                  |
 -------------------------------------------------------------------
 
+Advanced APIs for drivers
+-------------------------
+A. Exporting pages to users with remap_pfn_range, io_remap_pfn_range,
+vm_insert_pfn
+
+Drivers wanting to export some pages to userspace do it by using mmap
+interface and a combination of
+1) pgprot_noncached()
+2) io_remap_pfn_range() or remap_pfn_range() or vm_insert_pfn()
+
+With PAT support, a new API pgprot_writecombine is being added. So, drivers can
+continue to use the above sequence, with either pgprot_noncached() or
+pgprot_writecombine() in step 1, followed by step 2.
+
+In addition, step 2 internally tracks the region as UC or WC in memtype
+list in order to ensure no conflicting mapping.
+
+Note that this set of APIs only works with IO (non RAM) regions. If driver
+wants to export a RAM region, it has to do set_memory_uc() or set_memory_wc()
+as step 0 above and also track the usage of those pages and use set_memory_wb()
+before the page is freed to free pool.
+
+
+
 Notes:
 
 -- in the above table mean "Not suggested usage for the API". Some of the --'s
diff --git a/Documentation/x86/x86_64/boot-options.txt b/Documentation/x86/x86_64/boot-options.txt
index f6d561a1a9b2..34c13040a718 100644
--- a/Documentation/x86/x86_64/boot-options.txt
+++ b/Documentation/x86/x86_64/boot-options.txt
@@ -79,17 +79,6 @@ Timing
   Report when timer interrupts are lost because some code turned off
   interrupts for too long.
 
-  nmi_watchdog=NUMBER[,panic]
-  NUMBER can be:
-  0 don't use an NMI watchdog
-  1 use the IO-APIC timer for the NMI watchdog
-  2 use the local APIC for the NMI watchdog using a performance counter. Note
-  This will use one performance counter and the local APIC's performance
-  vector.
-  When panic is specified panic when an NMI watchdog timeout occurs.
-  This is useful when you use a panic=... timeout and need the box
-  quickly up again.
-
   nohpet
   Don't use the HPET timer.
 
diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
index efce75097369..29b52b14d0b4 100644
--- a/Documentation/x86/x86_64/mm.txt
+++ b/Documentation/x86/x86_64/mm.txt
@@ -6,7 +6,7 @@ Virtual memory map with 4 level page tables:
 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm
 hole caused by [48:63] sign extension
 ffff800000000000 - ffff80ffffffffff (=40 bits) guard hole
-ffff810000000000 - ffffc0ffffffffff (=46 bits) direct mapping of all phys. memory
+ffff880000000000 - ffffc0ffffffffff (=57 TB) direct mapping of all phys. memory
 ffffc10000000000 - ffffc1ffffffffff (=40 bits) hole
 ffffc20000000000 - ffffe1ffffffffff (=45 bits) vmalloc/ioremap space
 ffffe20000000000 - ffffe2ffffffffff (=40 bits) virtual memory map (1TB)