Merge commit 'v2.6.27-rc1' into x86/core

Conflicts:

	include/asm-x86/dma-mapping.h
	include/asm-x86/namei.h
	include/asm-x86/uaccess.h

Signed-off-by: Ingo Molnar <mingo@elte.hu>

49 files changed, 964 insertions, 222 deletions

diff --git a/Documentation/DMA-API.txt b/Documentation/DMA-API.txt
index 80d150458c80..d8b63d164e41 100644
--- a/Documentation/DMA-API.txt
+++ b/Documentation/DMA-API.txt
@@ -298,10 +298,10 @@ recommended that you never use these unless you really know what the
 cache width is.
 
 int
-dma_mapping_error(dma_addr_t dma_addr)
+dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 
 int
-pci_dma_mapping_error(dma_addr_t dma_addr)
+pci_dma_mapping_error(struct pci_dev *hwdev, dma_addr_t dma_addr)
 
 In some circumstances dma_map_single and dma_map_page will fail to create
 a mapping. A driver can check for these errors by testing the returned
diff --git a/Documentation/Intel-IOMMU.txt b/Documentation/Intel-IOMMU.txt
index c2321903aa09..21bc416d887e 100644
--- a/Documentation/Intel-IOMMU.txt
+++ b/Documentation/Intel-IOMMU.txt
@@ -48,7 +48,7 @@ IOVA generation is pretty generic. We used the same technique as vmalloc()
 but these are not global address spaces, but separate for each domain.
 Different DMA engines may support different number of domains.
 
-We also allocate gaurd pages with each mapping, so we can attempt to catch
+We also allocate guard pages with each mapping, so we can attempt to catch
 any overflow that might happen.
 
 
@@ -112,4 +112,4 @@ TBD
 
 - For compatibility testing, could use unity map domain for all devices, just
   provide a 1-1 for all useful memory under a single domain for all devices.
-- API for paravirt ops for abstracting functionlity for VMM folks.
+- API for paravirt ops for abstracting functionality for VMM folks.
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 118ca6e9404f..f79ad9ff6031 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -528,7 +528,33 @@ See more details on the proper patch format in the following
 references.
 
 
+16) Sending "git pull" requests  (from Linus emails)
 
+Please write the git repo address and branch name alone on the same line
+so that I can't even by mistake pull from the wrong branch, and so
+that a triple-click just selects the whole thing.
+
+So the proper format is something along the lines of:
+
+        "Please pull from
+
+                git://jdelvare.pck.nerim.net/jdelvare-2.6 i2c-for-linus
+
+         to get these changes:"
+
+so that I don't have to hunt-and-peck for the address and inevitably
+get it wrong (actually, I've only gotten it wrong a few times, and
+checking against the diffstat tells me when I get it wrong, but I'm
+just a lot more comfortable when I don't have to "look for" the right
+thing to pull, and double-check that I have the right branch-name).
+
+
+Please use "git diff -M --stat --summary" to generate the diffstat:
+the -M enables rename detection, and the summary enables a summary of
+new/deleted or renamed files.
+
+With rename detection, the statistics are rather different [...]
+because git will notice that a fair number of the changes are renames.
 
 -----------------------------------
 SECTION 2 - HINTS, TIPS, AND TRICKS
diff --git a/Documentation/accounting/taskstats-struct.txt b/Documentation/accounting/taskstats-struct.txt
index b988d110db59..e7512c061c15 100644
--- a/Documentation/accounting/taskstats-struct.txt
+++ b/Documentation/accounting/taskstats-struct.txt
@@ -6,7 +6,7 @@ This document contains an explanation of the struct taskstats fields.
 There are three different groups of fields in the struct taskstats:
 
 1) Common and basic accounting fields
-    If CONFIG_TASKSTATS is set, the taskstats inteface is enabled and
+    If CONFIG_TASKSTATS is set, the taskstats interface is enabled and
     the common fields and basic accounting fields are collected for
     delivery at do_exit() of a task.
 2) Delay accounting fields
diff --git a/Documentation/arm/Interrupts b/Documentation/arm/Interrupts
index 0d3dbf1099bc..c202ed35d7d6 100644
--- a/Documentation/arm/Interrupts
+++ b/Documentation/arm/Interrupts
@@ -138,14 +138,8 @@ So, what's changed?
 
                 Set active the IRQ edge(s)/level.  This replaces the
                 SA1111 INTPOL manipulation, and the set_GPIO_IRQ_edge()
-                function.  Type should be one of the following:
-
-                #define IRQT_NOEDGE     (0)
-                #define IRQT_RISING     (__IRQT_RISEDGE)
-                #define IRQT_FALLING    (__IRQT_FALEDGE)
-                #define IRQT_BOTHEDGE   (__IRQT_RISEDGE|__IRQT_FALEDGE)
-                #define IRQT_LOW        (__IRQT_LOWLVL)
-                #define IRQT_HIGH       (__IRQT_HIGHLVL)
+                function.  Type should be one of IRQ_TYPE_xxx defined in
+                <linux/irq.h>
 
 3. set_GPIO_IRQ_edge() is obsolete, and should be replaced by set_irq_type.
 
diff --git a/Documentation/cpu-freq/governors.txt b/Documentation/cpu-freq/governors.txt
index dcec0564d040..5b0cfa67aff9 100644
--- a/Documentation/cpu-freq/governors.txt
+++ b/Documentation/cpu-freq/governors.txt
@@ -122,7 +122,7 @@ around '10000' or more.
 show_sampling_rate_(min|max): the minimum and maximum sampling rates
 available that you may set 'sampling_rate' to.
 
-up_threshold: defines what the average CPU usaged between the samplings
+up_threshold: defines what the average CPU usage between the samplings
 of 'sampling_rate' needs to be for the kernel to make a decision on
 whether it should increase the frequency.  For example when it is set
 to its default value of '80' it means that between the checking
diff --git a/Documentation/edac.txt b/Documentation/edac.txt
index ced527388001..8eda3fb66416 100644
--- a/Documentation/edac.txt
+++ b/Documentation/edac.txt
@@ -327,7 +327,7 @@ Sdram memory scrubbing rate:
         'sdram_scrub_rate'
 
         Read/Write attribute file that controls memory scrubbing. The scrubbing
-        rate is set by writing a minimum bandwith in bytes/sec to the attribute
+        rate is set by writing a minimum bandwidth in bytes/sec to the attribute
         file. The rate will be translated to an internal value that gives at
         least the specified rate.
 
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 721c71b86e06..c23955404bf5 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -47,6 +47,30 @@ Who:	Mauro Carvalho Chehab <mchehab@infradead.org>
 
 ---------------------------
 
+What:   old tuner-3036 i2c driver
+When:   2.6.28
+Why:    This driver is for VERY old i2c-over-parallel port teletext receiver
+        boxes. Rather then spending effort on converting this driver to V4L2,
+        and since it is extremely unlikely that anyone still uses one of these
+        devices, it was decided to drop it.
+Who:    Hans Verkuil <hverkuil@xs4all.nl>
+        Mauro Carvalho Chehab <mchehab@infradead.org>
+
+ ---------------------------
+
+What:   V4L2 dpc7146 driver
+When:   2.6.28
+Why:    Old driver for the dpc7146 demonstration board that is no longer
+        relevant. The last time this was tested on actual hardware was
+        probably around 2002. Since this is a driver for a demonstration
+        board the decision was made to remove it rather than spending a
+        lot of effort continually updating this driver to stay in sync
+        with the latest internal V4L2 or I2C API.
+Who:    Hans Verkuil <hverkuil@xs4all.nl>
+        Mauro Carvalho Chehab <mchehab@infradead.org>
+
+---------------------------
+
 What:   PCMCIA control ioctl (needed for pcmcia-cs [cardmgr, cardctl])
 When:   November 2005
 Files:  drivers/pcmcia/: pcmcia_ioctl.c
diff --git a/Documentation/filesystems/omfs.txt b/Documentation/filesystems/omfs.txt
new file mode 100644
index 000000000000..1d0d41ff5c65
--- /dev/null
+++ b/Documentation/filesystems/omfs.txt
@@ -0,0 +1,106 @@
+Optimized MPEG Filesystem (OMFS)
+
+Overview
+========
+
+OMFS is a filesystem created by SonicBlue for use in the ReplayTV DVR
+and Rio Karma MP3 player.  The filesystem is extent-based, utilizing
+block sizes from 2k to 8k, with hash-based directories.  This
+filesystem driver may be used to read and write disks from these
+devices.
+
+Note, it is not recommended that this FS be used in place of a general
+filesystem for your own streaming media device.  Native Linux filesystems
+will likely perform better.
+
+More information is available at:
+
+    http://linux-karma.sf.net/
+
+Various utilities, including mkomfs and omfsck, are included with
+omfsprogs, available at:
+
+    http://bobcopeland.com/karma/
+
+Instructions are included in its README.
+
+Options
+=======
+
+OMFS supports the following mount-time options:
+
+    uid=n        - make all files owned by specified user
+    gid=n        - make all files owned by specified group
+    umask=xxx    - set permission umask to xxx
+    fmask=xxx    - set umask to xxx for files
+    dmask=xxx    - set umask to xxx for directories
+
+Disk format
+===========
+
+OMFS discriminates between "sysblocks" and normal data blocks.  The sysblock
+group consists of super block information, file metadata, directory structures,
+and extents.  Each sysblock has a header containing CRCs of the entire
+sysblock, and may be mirrored in successive blocks on the disk.  A sysblock may
+have a smaller size than a data block, but since they are both addressed by the
+same 64-bit block number, any remaining space in the smaller sysblock is
+unused.
+
+Sysblock header information:
+
+struct omfs_header {
+        __be64 h_self;                  /* FS block where this is located */
+        __be32 h_body_size;             /* size of useful data after header */
+        __be16 h_crc;                   /* crc-ccitt of body_size bytes */
+        char h_fill1[2];
+        u8 h_version;                   /* version, always 1 */
+        char h_type;                    /* OMFS_INODE_X */
+        u8 h_magic;                     /* OMFS_IMAGIC */
+        u8 h_check_xor;                 /* XOR of header bytes before this */
+        __be32 h_fill2;
+};
+
+Files and directories are both represented by omfs_inode:
+
+struct omfs_inode {
+        struct omfs_header i_head;      /* header */
+        __be64 i_parent;                /* parent containing this inode */
+        __be64 i_sibling;               /* next inode in hash bucket */
+        __be64 i_ctime;                 /* ctime, in milliseconds */
+        char i_fill1[35];
+        char i_type;                    /* OMFS_[DIR,FILE] */
+        __be32 i_fill2;
+        char i_fill3[64];
+        char i_name[OMFS_NAMELEN];      /* filename */
+        __be64 i_size;                  /* size of file, in bytes */
+};
+
+Directories in OMFS are implemented as a large hash table.  Filenames are
+hashed then prepended into the bucket list beginning at OMFS_DIR_START.
+Lookup requires hashing the filename, then seeking across i_sibling pointers
+until a match is found on i_name.  Empty buckets are represented by block
+pointers with all-1s (~0).
+
+A file is an omfs_inode structure followed by an extent table beginning at
+OMFS_EXTENT_START:
+
+struct omfs_extent_entry {
+        __be64 e_cluster;               /* start location of a set of blocks */
+        __be64 e_blocks;                /* number of blocks after e_cluster */
+};
+
+struct omfs_extent {
+        __be64 e_next;                  /* next extent table location */
+        __be32 e_extent_count;          /* total # extents in this table */
+        __be32 e_fill;
+        struct omfs_extent_entry e_entry;       /* start of extent entries */
+};
+
+Each extent holds the block offset followed by number of blocks allocated to
+the extent.  The final extent in each table is a terminator with e_cluster
+being ~0 and e_blocks being ones'-complement of the total number of blocks
+in the table.
+
+If this table overflows, a continuation inode is written and pointed to by
+e_next.  These have a header but lack the rest of the inode structure.
+
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 8c6384bdfed4..64557821ee59 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -931,7 +931,7 @@ group_prealloc  max_to_scan  mb_groups  mb_history  min_to_scan  order2_req
 stats  stream_req
 
 mb_groups:
-This file gives the details of mutiblock allocator buddy cache of free blocks
+This file gives the details of multiblock allocator buddy cache of free blocks
 
 mb_history:
 Multiblock allocation history.
@@ -1474,7 +1474,7 @@ used because pages_free(1355) is smaller than watermark + protection[2]
 normal page requirement. If requirement is DMA zone(index=0), protection[0]
 (=0) is used.
 
-zone[i]'s protection[j] is calculated by following exprssion.
+zone[i]'s protection[j] is calculated by following expression.
 
 (i < j):
   zone[i]->protection[j]
diff --git a/Documentation/filesystems/relay.txt b/Documentation/filesystems/relay.txt
index 094f2d2f38b1..510b722667ac 100644
--- a/Documentation/filesystems/relay.txt
+++ b/Documentation/filesystems/relay.txt
@@ -294,6 +294,16 @@ user-defined data with a channel, and is immediately available
 (including in create_buf_file()) via chan->private_data or
 buf->chan->private_data.
 
+Buffer-only channels
+--------------------
+
+These channels have no files associated and can be created with
+relay_open(NULL, NULL, ...). Such channels are useful in scenarios such
+as when doing early tracing in the kernel, before the VFS is up. In these
+cases, one may open a buffer-only channel and then call
+relay_late_setup_files() when the kernel is ready to handle files,
+to expose the buffered data to the userspace.
+
 Channel 'modes'
 ---------------
 
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index b7522c6cbae3..c4d348dabe94 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -143,7 +143,7 @@ struct file_system_type {
 
 The get_sb() method has the following arguments:
 
-  struct file_system_type *fs_type: decribes the filesystem, partly initialized
+  struct file_system_type *fs_type: describes the filesystem, partly initialized
         by the specific filesystem code
 
   int flags: mount flags
@@ -895,9 +895,9 @@ struct dentry_operations {
         iput() yourself
 
   d_dname: called when the pathname of a dentry should be generated.
-        Usefull for some pseudo filesystems (sockfs, pipefs, ...) to delay
+        Useful for some pseudo filesystems (sockfs, pipefs, ...) to delay
         pathname generation. (Instead of doing it when dentry is created,
-        its done only when the path is needed.). Real filesystems probably
+        it's done only when the path is needed.). Real filesystems probably
         dont want to use it, because their dentries are present in global
         dcache hash, so their hash should be an invariant. As no lock is
         held, d_dname() should not try to modify the dentry itself, unless
diff --git a/Documentation/i2c/upgrading-clients b/Documentation/i2c/upgrading-clients
new file mode 100644
index 000000000000..9a45f9bb6a25
--- /dev/null
+++ b/Documentation/i2c/upgrading-clients
@@ -0,0 +1,281 @@
+Upgrading I2C Drivers to the new 2.6 Driver Model
+=================================================
+
+Ben Dooks <ben-linux@fluff.org>
+
+Introduction
+------------
+
+This guide outlines how to alter existing Linux 2.6 client drivers from
+the old to the new new binding methods.
+
+
+Example old-style driver
+------------------------
+
+
+struct example_state {
+        struct i2c_client       client;
+        ....
+};
+
+static struct i2c_driver example_driver;
+
+static unsigned short ignore[] = { I2C_CLIENT_END };
+static unsigned short normal_addr[] = { OUR_ADDR, I2C_CLIENT_END };
+
+I2C_CLIENT_INSMOD;
+
+static int example_attach(struct i2c_adapter *adap, int addr, int kind)
+{
+        struct example_state *state;
+        struct device *dev = &adap->dev;  /* to use for dev_ reports */
+        int ret;
+
+        state = kzalloc(sizeof(struct example_state), GFP_KERNEL);
+        if (state == NULL) {
+                dev_err(dev, "failed to create our state\n");
+                return -ENOMEM;
+        }
+
+        example->client.addr    = addr;
+        example->client.flags   = 0;
+        example->client.adapter = adap;
+
+        i2c_set_clientdata(&state->i2c_client, state);
+        strlcpy(client->i2c_client.name, "example", I2C_NAME_SIZE);
+
+        ret = i2c_attach_client(&state->i2c_client);
+        if (ret < 0) {
+                dev_err(dev, "failed to attach client\n");
+                kfree(state);
+                return ret;
+        }
+
+        dev = &state->i2c_client.dev;
+
+        /* rest of the initialisation goes here. */
+
+        dev_info(dev, "example client created\n");
+
+        return 0;
+}
+
+static int __devexit example_detach(struct i2c_client *client)
+{
+        struct example_state *state = i2c_get_clientdata(client);
+
+        i2c_detach_client(client);
+        kfree(state);
+        return 0;
+}
+
+static int example_attach_adapter(struct i2c_adapter *adap)
+{
+        return i2c_probe(adap, &addr_data, example_attach);
+}
+
+static struct i2c_driver example_driver = {
+        .driver         = {
+                .owner          = THIS_MODULE,
+                .name           = "example",
+        },
+        .attach_adapter = example_attach_adapter,
+        .detach_client  = __devexit_p(example_detach),
+        .suspend        = example_suspend,
+        .resume         = example_resume,
+};
+
+
+Updating the client
+-------------------
+
+The new style binding model will check against a list of supported
+devices and their associated address supplied by the code registering
+the busses. This means that the driver .attach_adapter and
+.detach_adapter methods can be removed, along with the addr_data,
+as follows:
+
+- static struct i2c_driver example_driver;
+
+- static unsigned short ignore[] = { I2C_CLIENT_END };
+- static unsigned short normal_addr[] = { OUR_ADDR, I2C_CLIENT_END };
+
+- I2C_CLIENT_INSMOD;
+
+- static int example_attach_adapter(struct i2c_adapter *adap)
+- {
+-       return i2c_probe(adap, &addr_data, example_attach);
+- }
+
+ static struct i2c_driver example_driver = {
+-       .attach_adapter = example_attach_adapter,
+-       .detach_client  = __devexit_p(example_detach),
+ }
+
+Add the probe and remove methods to the i2c_driver, as so:
+
+ static struct i2c_driver example_driver = {
++       .probe          = example_probe,
++       .remove         = __devexit_p(example_remove),
+ }
+
+Change the example_attach method to accept the new parameters
+which include the i2c_client that it will be working with:
+
+- static int example_attach(struct i2c_adapter *adap, int addr, int kind)
++ static int example_probe(struct i2c_client *client,
++                          const struct i2c_device_id *id)
+
+Change the name of example_attach to example_probe to align it with the
+i2c_driver entry names. The rest of the probe routine will now need to be
+changed as the i2c_client has already been setup for use.
+
+The necessary client fields have already been setup before
+the probe function is called, so the following client setup
+can be removed:
+
+-       example->client.addr    = addr;
+-       example->client.flags   = 0;
+-       example->client.adapter = adap;
+-
+-       strlcpy(client->i2c_client.name, "example", I2C_NAME_SIZE);
+
+The i2c_set_clientdata is now:
+
+-       i2c_set_clientdata(&state->client, state);
++       i2c_set_clientdata(client, state);
+
+The call to i2c_attach_client is no longer needed, if the probe
+routine exits successfully, then the driver will be automatically
+attached by the core. Change the probe routine as so:
+
+-       ret = i2c_attach_client(&state->i2c_client);
+-       if (ret < 0) {
+-               dev_err(dev, "failed to attach client\n");
+-               kfree(state);
+-               return ret;
+-       }
+
+
+Remove the storage of 'struct i2c_client' from the 'struct example_state'
+as we are provided with the i2c_client in our example_probe. Instead we
+store a pointer to it for when it is needed.
+
+struct example_state {
+-       struct i2c_client       client;
++       struct i2c_client       *client;
+
+the new i2c client as so:
+
+-       struct device *dev = &adap->dev;  /* to use for dev_ reports */
++       struct device *dev = &i2c_client->dev;  /* to use for dev_ reports */
+
+And remove the change after our client is attached, as the driver no
+longer needs to register a new client structure with the core:
+
+-       dev = &state->i2c_client.dev;
+
+In the probe routine, ensure that the new state has the client stored
+in it:
+
+static int example_probe(struct i2c_client *i2c_client,
+                         const struct i2c_device_id *id)
+{
+        struct example_state *state;
+        struct device *dev = &i2c_client->dev;
+        int ret;
+
+        state = kzalloc(sizeof(struct example_state), GFP_KERNEL);
+        if (state == NULL) {
+                dev_err(dev, "failed to create our state\n");
+                return -ENOMEM;
+        }
+
++       state->client = i2c_client;
+
+Update the detach method, by changing the name to _remove and
+to delete the i2c_detach_client call. It is possible that you
+can also remove the ret variable as it is not not needed for
+any of the core functions.
+
+- static int __devexit example_detach(struct i2c_client *client)
++ static int __devexit example_remove(struct i2c_client *client)
+{
+        struct example_state *state = i2c_get_clientdata(client);
+
+-       i2c_detach_client(client);
+
+And finally ensure that we have the correct ID table for the i2c-core
+and other utilities:
+
++ struct i2c_device_id example_idtable[] = {
++       { "example", 0 },
++       { }
++};
++
++MODULE_DEVICE_TABLE(i2c, example_idtable);
+
+static struct i2c_driver example_driver = {
+        .driver         = {
+                .owner          = THIS_MODULE,
+                .name           = "example",
+        },
++       .id_table       = example_ids,
+
+
+Our driver should now look like this:
+
+struct example_state {
+        struct i2c_client       *client;
+        ....
+};
+
+static int example_probe(struct i2c_client *client,
+                         const struct i2c_device_id *id)
+{
+        struct example_state *state;
+        struct device *dev = &client->dev;
+
+        state = kzalloc(sizeof(struct example_state), GFP_KERNEL);
+        if (state == NULL) {
+                dev_err(dev, "failed to create our state\n");
+                return -ENOMEM;
+        }
+
+        state->client = client;
+        i2c_set_clientdata(client, state);
+
+        /* rest of the initialisation goes here. */
+
+        dev_info(dev, "example client created\n");
+
+        return 0;
+}
+
+static int __devexit example_remove(struct i2c_client *client)
+{
+        struct example_state *state = i2c_get_clientdata(client);
+
+        kfree(state);
+        return 0;
+}
+
+static struct i2c_device_id example_idtable[] = {
+        { "example", 0 },
+        { }
+};
+
+MODULE_DEVICE_TABLE(i2c, example_idtable);
+
+static struct i2c_driver example_driver = {
+        .driver         = {
+                .owner          = THIS_MODULE,
+                .name           = "example",
+        },
+        .id_table       = example_idtable,
+        .probe          = example_probe,
+        .remove         = __devexit_p(example_remove),
+        .suspend        = example_suspend,
+        .resume         = example_resume,
+};
diff --git a/Documentation/ia64/kvm.txt b/Documentation/ia64/kvm.txt
index bec9d815da33..914d07f49268 100644
--- a/Documentation/ia64/kvm.txt
+++ b/Documentation/ia64/kvm.txt
@@ -50,9 +50,9 @@ Note: For step 2, please make sure that host page size == TARGET_PAGE_SIZE of qe
                 /usr/local/bin/qemu-system-ia64 -smp xx -m 512 -hda $your_image
                 (xx is the number of virtual processors for the guest, now the maximum value is 4)
 
-5. Known possibile issue on some platforms with old Firmware.
+5. Known possible issue on some platforms with old Firmware.
 
-If meet strange host crashe issues, try to solve it through either of the following ways:
+In the event of strange host crash issues, try to solve it through either of the following ways:
 
 (1): Upgrade your Firmware to the latest one.
 
@@ -65,8 +65,8 @@ index 0b53344..f02b0f7 100644
         mov ar.pfs = loc1
         mov rp = loc0
         ;;
--       srlz.d                          // seralize restoration of psr.l
-+       srlz.i                  // seralize restoration of psr.l
+-       srlz.d                          // serialize restoration of psr.l
++       srlz.i                  // serialize restoration of psr.l
 +       ;;
         br.ret.sptk.many b0
  END(ia64_pal_call_static)
diff --git a/Documentation/input/cs461x.txt b/Documentation/input/cs461x.txt
index afe0d6543e09..202e9dbacec3 100644
--- a/Documentation/input/cs461x.txt
+++ b/Documentation/input/cs461x.txt
@@ -31,7 +31,7 @@ The driver works with ALSA drivers simultaneously. For example, the xracer
 uses joystick as input device and PCM device as sound output in one time.
 There are no sound or input collisions detected. The source code have
 comments about them; but I've found the joystick can be initialized 
-separately of ALSA modules. So, you canm use only one joystick driver
+separately of ALSA modules. So, you can use only one joystick driver
 without ALSA drivers. The ALSA drivers are not needed to compile or
 run this driver.
 
diff --git a/Documentation/ioctl/ioctl-decoding.txt b/Documentation/ioctl/ioctl-decoding.txt
index bfdf7f3ee4f0..e35efb0cec2e 100644
--- a/Documentation/ioctl/ioctl-decoding.txt
+++ b/Documentation/ioctl/ioctl-decoding.txt
@@ -1,6 +1,6 @@
 To decode a hex IOCTL code:
 
-Most architecures use this generic format, but check
+Most architectures use this generic format, but check
 include/ARCH/ioctl.h for specifics, e.g. powerpc
 uses 3 bits to encode read/write and 13 bits for size.
 
@@ -18,7 +18,7 @@ uses 3 bits to encode read/write and 13 bits for size.
  7-0    function #
 
 
- So for example 0x82187201 is a read with arg length of 0x218,
+So for example 0x82187201 is a read with arg length of 0x218,
 character 'r' function 1. Grepping the source reveals this is:
 
 #define VFAT_IOCTL_READDIR_BOTH         _IOR('r', 1, struct dirent [2])
diff --git a/Documentation/iostats.txt b/Documentation/iostats.txt
index 5925c3cd030d..59a69ec67c40 100644
--- a/Documentation/iostats.txt
+++ b/Documentation/iostats.txt
@@ -143,7 +143,7 @@ disk and partition statistics are consistent again. Since we still don't
 keep record of the partition-relative address, an operation is attributed to
 the partition which contains the first sector of the request after the
 eventual merges. As requests can be merged across partition, this could lead
-to some (probably insignificant) innacuracy.
+to some (probably insignificant) inaccuracy.
 
 Additional notes
 ----------------
diff --git a/Documentation/isdn/README.mISDN b/Documentation/isdn/README.mISDN
new file mode 100644
index 000000000000..cd8bf920e77b
--- /dev/null
+++ b/Documentation/isdn/README.mISDN
@@ -0,0 +1,6 @@
+mISDN is a new modular ISDN driver, in the long term it should replace
+the old I4L driver architecture for passiv ISDN cards.
+It was designed to allow a broad range of applications and interfaces
+but only have the basic function in kernel, the interface to the user
+space is based on sockets with a own address family AF_ISDN.
+
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 9691c7f5166c..0705040531a5 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -65,26 +65,26 @@ Install kexec-tools
 
 2) Download the kexec-tools user-space package from the following URL:
 
-http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing.tar.gz
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools.tar.gz
 
-This is a symlink to the latest version, which at the time of writing is
-20061214, the only release of kexec-tools-testing so far. As other versions
-are released, the older ones will remain available at
-http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/
+This is a symlink to the latest version.
 
-Note: Latest kexec-tools-testing git tree is available at
+The latest kexec-tools git tree is available at:
 
-git://git.kernel.org/pub/scm/linux/kernel/git/horms/kexec-tools-testing.git
+git://git.kernel.org/pub/scm/linux/kernel/git/horms/kexec-tools.git
 or
-http://www.kernel.org/git/?p=linux/kernel/git/horms/kexec-tools-testing.git;a=summary
+http://www.kernel.org/git/?p=linux/kernel/git/horms/kexec-tools.git
+
+More information about kexec-tools can be found at
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/README.html
 
 3) Unpack the tarball with the tar command, as follows:
 
-   tar xvpzf kexec-tools-testing.tar.gz
+   tar xvpzf kexec-tools.tar.gz
 
 4) Change to the kexec-tools directory, as follows:
 
-   cd kexec-tools-testing-VERSION
+   cd kexec-tools-VERSION
 
 5) Configure the package, as follows:
 
diff --git a/Documentation/keys.txt b/Documentation/keys.txt
index d5c7a57d1700..b56aacc1fff8 100644
--- a/Documentation/keys.txt
+++ b/Documentation/keys.txt
@@ -864,7 +864,7 @@ payload contents" for more information.
     request_key_with_auxdata() respectively.
 
     These two functions return with the key potentially still under
-    construction.  To wait for contruction completion, the following should be
+    construction.  To wait for construction completion, the following should be
     called:
 
         int wait_for_key_construction(struct key *key, bool intr);
diff --git a/Documentation/leds-class.txt b/Documentation/leds-class.txt
index 18860ad9935a..6399557cdab3 100644
--- a/Documentation/leds-class.txt
+++ b/Documentation/leds-class.txt
@@ -59,7 +59,7 @@ Hardware accelerated blink of LEDs
 
 Some LEDs can be programmed to blink without any CPU interaction. To
 support this feature, a LED driver can optionally implement the
-blink_set() function (see <linux/leds.h>). If implemeted, triggers can
+blink_set() function (see <linux/leds.h>). If implemented, triggers can
 attempt to use it before falling back to software timers. The blink_set()
 function should return 0 if the blink setting is supported, or -EINVAL
 otherwise, which means that LED blinking will be handled by software.
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index 82fafe0429fe..b88b0ea54e90 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -36,11 +36,13 @@
 #include <sched.h>
 #include <limits.h>
 #include <stddef.h>
+#include <signal.h>
 #include "linux/lguest_launcher.h"
 #include "linux/virtio_config.h"
 #include "linux/virtio_net.h"
 #include "linux/virtio_blk.h"
 #include "linux/virtio_console.h"
+#include "linux/virtio_rng.h"
 #include "linux/virtio_ring.h"
 #include "asm-x86/bootparam.h"
 /*L:110 We can ignore the 39 include files we need for this program, but I do
@@ -64,8 +66,8 @@ typedef uint8_t u8;
 #endif
 /* We can have up to 256 pages for devices. */
 #define DEVICE_PAGES 256
-/* This will occupy 2 pages: it must be a power of 2. */
-#define VIRTQUEUE_NUM 128
+/* This will occupy 3 pages: it must be a power of 2. */
+#define VIRTQUEUE_NUM 256
 
 /*L:120 verbose is both a global flag and a macro.  The C preprocessor allows
  * this, and although I wouldn't recommend it, it works quite nicely here. */
@@ -74,12 +76,19 @@ static bool verbose;
         do { if (verbose) printf(args); } while(0)
 /*:*/
 
-/* The pipe to send commands to the waker process */
-static int waker_fd;
+/* File descriptors for the Waker. */
+struct {
+        int pipe[2];
+        int lguest_fd;
+} waker_fds;
+
 /* The pointer to the start of guest memory. */
 static void *guest_base;
 /* The maximum guest physical address allowed, and maximum possible. */
 static unsigned long guest_limit, guest_max;
+/* The pipe for signal hander to write to. */
+static int timeoutpipe[2];
+static unsigned int timeout_usec = 500;
 
 /* a per-cpu variable indicating whose vcpu is currently running */
 static unsigned int __thread cpu_id;
@@ -155,11 +164,14 @@ struct virtqueue
         /* Last available index we saw. */
         u16 last_avail_idx;
 
-        /* The routine to call when the Guest pings us. */
-        void (*handle_output)(int fd, struct virtqueue *me);
+        /* The routine to call when the Guest pings us, or timeout. */
+        void (*handle_output)(int fd, struct virtqueue *me, bool timeout);
 
         /* Outstanding buffers */
         unsigned int inflight;
+
+        /* Is this blocked awaiting a timer? */
+        bool blocked;
 };
 
 /* Remember the arguments to the program so we can "reboot" */
@@ -190,6 +202,9 @@ static void *_convert(struct iovec *iov, size_t size, size_t align,
         return iov->iov_base;
 }
 
+/* Wrapper for the last available index.  Makes it easier to change. */
+#define lg_last_avail(vq)       ((vq)->last_avail_idx)
+
 /* The virtio configuration space is defined to be little-endian.  x86 is
  * little-endian too, but it's nice to be explicit so we have these helpers. */
 #define cpu_to_le16(v16) (v16)
@@ -199,6 +214,33 @@ static void *_convert(struct iovec *iov, size_t size, size_t align,
 #define le32_to_cpu(v32) (v32)
 #define le64_to_cpu(v64) (v64)
 
+/* Is this iovec empty? */
+static bool iov_empty(const struct iovec iov[], unsigned int num_iov)
+{
+        unsigned int i;
+
+        for (i = 0; i < num_iov; i++)
+                if (iov[i].iov_len)
+                        return false;
+        return true;
+}
+
+/* Take len bytes from the front of this iovec. */
+static void iov_consume(struct iovec iov[], unsigned num_iov, unsigned len)
+{
+        unsigned int i;
+
+        for (i = 0; i < num_iov; i++) {
+                unsigned int used;
+
+                used = iov[i].iov_len < len ? iov[i].iov_len : len;
+                iov[i].iov_base += used;
+                iov[i].iov_len -= used;
+                len -= used;
+        }
+        assert(len == 0);
+}
+
 /* The device virtqueue descriptors are followed by feature bitmasks. */
 static u8 *get_feature_bits(struct device *dev)
 {
@@ -254,6 +296,7 @@ static void *map_zeroed_pages(unsigned int num)
                     PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, fd, 0);
         if (addr == MAP_FAILED)
                 err(1, "Mmaping %u pages of /dev/zero", num);
+        close(fd);
 
         return addr;
 }
@@ -540,69 +583,64 @@ static void add_device_fd(int fd)
  * watch, but handing a file descriptor mask through to the kernel is fairly
  * icky.
  *
- * Instead, we fork off a process which watches the file descriptors and writes
+ * Instead, we clone off a thread which watches the file descriptors and writes
  * the LHREQ_BREAK command to the /dev/lguest file descriptor to tell the Host
  * stop running the Guest.  This causes the Launcher to return from the
  * /dev/lguest read with -EAGAIN, where it will write to /dev/lguest to reset
  * the LHREQ_BREAK and wake us up again.
  *
  * This, of course, is merely a different *kind* of icky.
+ *
+ * Given my well-known antipathy to threads, I'd prefer to use processes.  But
+ * it's easier to share Guest memory with threads, and trivial to share the
+ * devices.infds as the Launcher changes it.
  */
-static void wake_parent(int pipefd, int lguest_fd)
+static int waker(void *unused)
 {
-        /* Add the pipe from the Launcher to the fdset in the device_list, so
-         * we watch it, too. */
-        add_device_fd(pipefd);
+        /* Close the write end of the pipe: only the Launcher has it open. */
+        close(waker_fds.pipe[1]);
 
         for (;;) {
                 fd_set rfds = devices.infds;
                 unsigned long args[] = { LHREQ_BREAK, 1 };
+                unsigned int maxfd = devices.max_infd;
+
+                /* We also listen to the pipe from the Launcher. */
+                FD_SET(waker_fds.pipe[0], &rfds);
+                if (waker_fds.pipe[0] > maxfd)
+                        maxfd = waker_fds.pipe[0];
 
                 /* Wait until input is ready from one of the devices. */
-                select(devices.max_infd+1, &rfds, NULL, NULL, NULL);
-                /* Is it a message from the Launcher? */
-                if (FD_ISSET(pipefd, &rfds)) {
-                        int fd;
-                        /* If read() returns 0, it means the Launcher has
-                         * exited.  We silently follow. */
-                        if (read(pipefd, &fd, sizeof(fd)) == 0)
-                                exit(0);
-                        /* Otherwise it's telling us to change what file
-                         * descriptors we're to listen to.  Positive means
-                         * listen to a new one, negative means stop
-                         * listening. */
-                        if (fd >= 0)
-                                FD_SET(fd, &devices.infds);
-                        else
-                                FD_CLR(-fd - 1, &devices.infds);
-                } else /* Send LHREQ_BREAK command. */
-                        pwrite(lguest_fd, args, sizeof(args), cpu_id);
+                select(maxfd+1, &rfds, NULL, NULL, NULL);
+
+                /* Message from Launcher? */
+                if (FD_ISSET(waker_fds.pipe[0], &rfds)) {
+                        char c;
+                        /* If this fails, then assume Launcher has exited.
+                         * Don't do anything on exit: we're just a thread! */
+                        if (read(waker_fds.pipe[0], &c, 1) != 1)
+                                _exit(0);
+                        continue;
+                }
+
+                /* Send LHREQ_BREAK command to snap the Launcher out of it. */
+                pwrite(waker_fds.lguest_fd, args, sizeof(args), cpu_id);
         }
+        return 0;
 }
 
 /* This routine just sets up a pipe to the Waker process. */
-static int setup_waker(int lguest_fd)
-{
-        int pipefd[2], child;
-
-        /* We create a pipe to talk to the Waker, and also so it knows when the
-         * Launcher dies (and closes pipe). */
-        pipe(pipefd);
-        child = fork();
-        if (child == -1)
-                err(1, "forking");
-
-        if (child == 0) {
-                /* We are the Waker: close the "writing" end of our copy of the
-                 * pipe and start waiting for input. */
-                close(pipefd[1]);
-                wake_parent(pipefd[0], lguest_fd);
-        }
-        /* Close the reading end of our copy of the pipe. */
-        close(pipefd[0]);
+static void setup_waker(int lguest_fd)
+{
+        /* This pipe is closed when Launcher dies, telling Waker. */
+        if (pipe(waker_fds.pipe) != 0)
+                err(1, "Creating pipe for Waker");
 
-        /* Here is the fd used to talk to the waker. */
-        return pipefd[1];
+        /* Waker also needs to know the lguest fd */
+        waker_fds.lguest_fd = lguest_fd;
+
+        if (clone(waker, malloc(4096) + 4096, CLONE_VM | SIGCHLD, NULL) == -1)
+                err(1, "Creating Waker");
 }
 
 /*
@@ -661,19 +699,22 @@ static unsigned get_vq_desc(struct virtqueue *vq,
                             unsigned int *out_num, unsigned int *in_num)
 {
         unsigned int i, head;
+        u16 last_avail;
 
         /* Check it isn't doing very strange things with descriptor numbers. */
-        if ((u16)(vq->vring.avail->idx - vq->last_avail_idx) > vq->vring.num)
+        last_avail = lg_last_avail(vq);
+        if ((u16)(vq->vring.avail->idx - last_avail) > vq->vring.num)
                 errx(1, "Guest moved used index from %u to %u",
-                     vq->last_avail_idx, vq->vring.avail->idx);
+                     last_avail, vq->vring.avail->idx);
 
         /* If there's nothing new since last we looked, return invalid. */
-        if (vq->vring.avail->idx == vq->last_avail_idx)
+        if (vq->vring.avail->idx == last_avail)
                 return vq->vring.num;
 
         /* Grab the next descriptor number they're advertising, and increment
          * the index we've seen. */
-        head = vq->vring.avail->ring[vq->last_avail_idx++ % vq->vring.num];
+        head = vq->vring.avail->ring[last_avail % vq->vring.num];
+        lg_last_avail(vq)++;
 
         /* If their number is silly, that's a fatal mistake. */
         if (head >= vq->vring.num)
@@ -821,8 +862,8 @@ static bool handle_console_input(int fd, struct device *dev)
                                 unsigned long args[] = { LHREQ_BREAK, 0 };
                                 /* Close the fd so Waker will know it has to
                                  * exit. */
-                                close(waker_fd);
-                                /* Just in case waker is blocked in BREAK, send
+                                close(waker_fds.pipe[1]);
+                                /* Just in case Waker is blocked in BREAK, send
                                  * unbreak now. */
                                 write(fd, args, sizeof(args));
                                 exit(2);
@@ -839,7 +880,7 @@ static bool handle_console_input(int fd, struct device *dev)
 
 /* Handling output for console is simple: we just get all the output buffers
  * and write them to stdout. */
-static void handle_console_output(int fd, struct virtqueue *vq)
+static void handle_console_output(int fd, struct virtqueue *vq, bool timeout)
 {
         unsigned int head, out, in;
         int len;
@@ -854,6 +895,21 @@ static void handle_console_output(int fd, struct virtqueue *vq)
         }
 }
 
+static void block_vq(struct virtqueue *vq)
+{
+        struct itimerval itm;
+
+        vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
+        vq->blocked = true;
+
+        itm.it_interval.tv_sec = 0;
+        itm.it_interval.tv_usec = 0;
+        itm.it_value.tv_sec = 0;
+        itm.it_value.tv_usec = timeout_usec;
+
+        setitimer(ITIMER_REAL, &itm, NULL);
+}
+
 /*
  * The Network
  *
@@ -861,22 +917,34 @@ static void handle_console_output(int fd, struct virtqueue *vq)
  * and write them (ignoring the first element) to this device's file descriptor
  * (/dev/net/tun).
  */
-static void handle_net_output(int fd, struct virtqueue *vq)
+static void handle_net_output(int fd, struct virtqueue *vq, bool timeout)
 {
-        unsigned int head, out, in;
+        unsigned int head, out, in, num = 0;
         int len;
         struct iovec iov[vq->vring.num];
+        static int last_timeout_num;
 
         /* Keep getting output buffers from the Guest until we run out. */
         while ((head = get_vq_desc(vq, iov, &out, &in)) != vq->vring.num) {
                 if (in)
                         errx(1, "Input buffers in output queue?");
-                /* Check header, but otherwise ignore it (we told the Guest we
-                 * supported no features, so it shouldn't have anything
-                 * interesting). */
-                (void)convert(&iov[0], struct virtio_net_hdr);
-                len = writev(vq->dev->fd, iov+1, out-1);
+                len = writev(vq->dev->fd, iov, out);
+                if (len < 0)
+                        err(1, "Writing network packet to tun");
                 add_used_and_trigger(fd, vq, head, len);
+                num++;
+        }
+
+        /* Block further kicks and set up a timer if we saw anything. */
+        if (!timeout && num)
+                block_vq(vq);
+
+        if (timeout) {
+                if (num < last_timeout_num)
+                        timeout_usec += 10;
+                else if (timeout_usec > 1)
+                        timeout_usec--;
+                last_timeout_num = num;
         }
 }
 
@@ -887,7 +955,6 @@ static bool handle_tun_input(int fd, struct device *dev)
         unsigned int head, in_num, out_num;
         int len;
         struct iovec iov[dev->vq->vring.num];
-        struct virtio_net_hdr *hdr;
 
         /* First we need a network buffer from the Guests's recv virtqueue. */
         head = get_vq_desc(dev->vq, iov, &out_num, &in_num);
@@ -896,25 +963,23 @@ static bool handle_tun_input(int fd, struct device *dev)
                  * early, the Guest won't be ready yet.  Wait until the device
                  * status says it's ready. */
                 /* FIXME: Actually want DRIVER_ACTIVE here. */
-                if (dev->desc->status & VIRTIO_CONFIG_S_DRIVER_OK)
-                        warn("network: no dma buffer!");
+
+                /* Now tell it we want to know if new things appear. */
+                dev->vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
+                wmb();
+
                 /* We'll turn this back on if input buffers are registered. */
                 return false;
         } else if (out_num)
                 errx(1, "Output buffers in network recv queue?");
 
-        /* First element is the header: we set it to 0 (no features). */
-        hdr = convert(&iov[0], struct virtio_net_hdr);
-        hdr->flags = 0;
-        hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;
-
         /* Read the packet from the device directly into the Guest's buffer. */
-        len = readv(dev->fd, iov+1, in_num-1);
+        len = readv(dev->fd, iov, in_num);
         if (len <= 0)
                 err(1, "reading network");
 
         /* Tell the Guest about the new packet. */
-        add_used_and_trigger(fd, dev->vq, head, sizeof(*hdr) + len);
+        add_used_and_trigger(fd, dev->vq, head, len);
 
         verbose("tun input packet len %i [%02x %02x] (%s)\n", len,
                 ((u8 *)iov[1].iov_base)[0], ((u8 *)iov[1].iov_base)[1],
@@ -927,11 +992,18 @@ static bool handle_tun_input(int fd, struct device *dev)
 /*L:215 This is the callback attached to the network and console input
  * virtqueues: it ensures we try again, in case we stopped console or net
  * delivery because Guest didn't have any buffers. */
-static void enable_fd(int fd, struct virtqueue *vq)
+static void enable_fd(int fd, struct virtqueue *vq, bool timeout)
 {
         add_device_fd(vq->dev->fd);
-        /* Tell waker to listen to it again */
-        write(waker_fd, &vq->dev->fd, sizeof(vq->dev->fd));
+        /* Snap the Waker out of its select loop. */
+        write(waker_fds.pipe[1], "", 1);
+}
+
+static void net_enable_fd(int fd, struct virtqueue *vq, bool timeout)
+{
+        /* We don't need to know again when Guest refills receive buffer. */
+        vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
+        enable_fd(fd, vq, timeout);
 }
 
 /* When the Guest tells us they updated the status field, we handle it. */
@@ -951,7 +1023,7 @@ static void update_device_status(struct device *dev)
                 for (vq = dev->vq; vq; vq = vq->next) {
                         memset(vq->vring.desc, 0,
                                vring_size(vq->config.num, getpagesize()));
-                        vq->last_avail_idx = 0;
+                        lg_last_avail(vq) = 0;
                 }
         } else if (dev->desc->status & VIRTIO_CONFIG_S_FAILED) {
                 warnx("Device %s configuration FAILED", dev->name);
@@ -960,10 +1032,10 @@ static void update_device_status(struct device *dev)
 
                 verbose("Device %s OK: offered", dev->name);
                 for (i = 0; i < dev->desc->feature_len; i++)
-                        verbose(" %08x", get_feature_bits(dev)[i]);
+                        verbose(" %02x", get_feature_bits(dev)[i]);
                 verbose(", accepted");
                 for (i = 0; i < dev->desc->feature_len; i++)
-                        verbose(" %08x", get_feature_bits(dev)
+                        verbose(" %02x", get_feature_bits(dev)
                                 [dev->desc->feature_len+i]);
 
                 if (dev->ready)
@@ -1000,7 +1072,7 @@ static void handle_output(int fd, unsigned long addr)
                         if (strcmp(vq->dev->name, "console") != 0)
                                 verbose("Output to %s\n", vq->dev->name);
                         if (vq->handle_output)
-                                vq->handle_output(fd, vq);
+                                vq->handle_output(fd, vq, false);
                         return;
                 }
         }
@@ -1014,6 +1086,29 @@ static void handle_output(int fd, unsigned long addr)
               strnlen(from_guest_phys(addr), guest_limit - addr));
 }
 
+static void handle_timeout(int fd)
+{
+        char buf[32];
+        struct device *i;
+        struct virtqueue *vq;
+
+        /* Clear the pipe */
+        read(timeoutpipe[0], buf, sizeof(buf));
+
+        /* Check each device and virtqueue: flush blocked ones. */
+        for (i = devices.dev; i; i = i->next) {
+                for (vq = i->vq; vq; vq = vq->next) {
+                        if (!vq->blocked)
+                                continue;
+
+                        vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
+                        vq->blocked = false;
+                        if (vq->handle_output)
+                                vq->handle_output(fd, vq, true);
+                }
+        }
+}
+
 /* This is called when the Waker wakes us up: check for incoming file
  * descriptors. */
 static void handle_input(int fd)
@@ -1024,16 +1119,20 @@ static void handle_input(int fd)
         for (;;) {
                 struct device *i;
                 fd_set fds = devices.infds;
+                int num;
 
+                num = select(devices.max_infd+1, &fds, NULL, NULL, &poll);
+                /* Could get interrupted */
+                if (num < 0)
+                        continue;
                 /* If nothing is ready, we're done. */
-                if (select(devices.max_infd+1, &fds, NULL, NULL, &poll) == 0)
+                if (num == 0)
                         break;
 
                 /* Otherwise, call the device(s) which have readable file
                  * descriptors and a method of handling them.  */
                 for (i = devices.dev; i; i = i->next) {
                         if (i->handle_input && FD_ISSET(i->fd, &fds)) {
-                                int dev_fd;
                                 if (i->handle_input(fd, i))
                                         continue;
 
@@ -1043,13 +1142,12 @@ static void handle_input(int fd)
                                  * buffers to deliver into.  Console also uses
                                  * it when it discovers that stdin is closed. */
                                 FD_CLR(i->fd, &devices.infds);
-                                /* Tell waker to ignore it too, by sending a
-                                 * negative fd number (-1, since 0 is a valid
-                                 * FD number). */
-                                dev_fd = -i->fd - 1;
-                                write(waker_fd, &dev_fd, sizeof(dev_fd));
                         }
                 }
+
+                /* Is this the timeout fd? */
+                if (FD_ISSET(timeoutpipe[0], &fds))
+                        handle_timeout(fd);
         }
 }
 
@@ -1098,7 +1196,7 @@ static struct lguest_device_desc *new_dev_desc(u16 type)
 /* Each device descriptor is followed by the description of its virtqueues.  We
  * specify how many descriptors the virtqueue is to have. */
 static void add_virtqueue(struct device *dev, unsigned int num_descs,
-                          void (*handle_output)(int fd, struct virtqueue *me))
+                          void (*handle_output)(int, struct virtqueue *, bool))
 {
         unsigned int pages;
         struct virtqueue **i, *vq = malloc(sizeof(*vq));
@@ -1114,6 +1212,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         vq->last_avail_idx = 0;
         vq->dev = dev;
         vq->inflight = 0;
+        vq->blocked = false;
 
         /* Initialize the configuration. */
         vq->config.num = num_descs;
@@ -1246,6 +1345,24 @@ static void setup_console(void)
 }
 /*:*/
 
+static void timeout_alarm(int sig)
+{
+        write(timeoutpipe[1], "", 1);
+}
+
+static void setup_timeout(void)
+{
+        if (pipe(timeoutpipe) != 0)
+                err(1, "Creating timeout pipe");
+
+        if (fcntl(timeoutpipe[1], F_SETFL,
+                  fcntl(timeoutpipe[1], F_GETFL) | O_NONBLOCK) != 0)
+                err(1, "Making timeout pipe nonblocking");
+
+        add_device_fd(timeoutpipe[0]);
+        signal(SIGALRM, timeout_alarm);
+}
+
 /*M:010 Inter-guest networking is an interesting area.  Simplest is to have a
  * --sharenet=<name> option which opens or creates a named pipe.  This can be
  * used to send packets to another guest in a 1:1 manner.
@@ -1264,10 +1381,25 @@ static void setup_console(void)
 
 static u32 str2ip(const char *ipaddr)
 {
-        unsigned int byte[4];
+        unsigned int b[4];
 
-        sscanf(ipaddr, "%u.%u.%u.%u", &byte[0], &byte[1], &byte[2], &byte[3]);
-        return (byte[0] << 24) | (byte[1] << 16) | (byte[2] << 8) | byte[3];
+        if (sscanf(ipaddr, "%u.%u.%u.%u", &b[0], &b[1], &b[2], &b[3]) != 4)
+                errx(1, "Failed to parse IP address '%s'", ipaddr);
+        return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
+}
+
+static void str2mac(const char *macaddr, unsigned char mac[6])
+{
+        unsigned int m[6];
+        if (sscanf(macaddr, "%02x:%02x:%02x:%02x:%02x:%02x",
+                   &m[0], &m[1], &m[2], &m[3], &m[4], &m[5]) != 6)
+                errx(1, "Failed to parse mac address '%s'", macaddr);
+        mac[0] = m[0];
+        mac[1] = m[1];
+        mac[2] = m[2];
+        mac[3] = m[3];
+        mac[4] = m[4];
+        mac[5] = m[5];
 }
 
 /* This code is "adapted" from libbridge: it attaches the Host end of the
@@ -1288,6 +1420,7 @@ static void add_to_bridge(int fd, const char *if_name, const char *br_name)
                 errx(1, "interface %s does not exist!", if_name);
 
         strncpy(ifr.ifr_name, br_name, IFNAMSIZ);
+        ifr.ifr_name[IFNAMSIZ-1] = '\0';
         ifr.ifr_ifindex = ifidx;
         if (ioctl(fd, SIOCBRADDIF, &ifr) < 0)
                 err(1, "can't add %s to bridge %s", if_name, br_name);
@@ -1296,64 +1429,90 @@ static void add_to_bridge(int fd, const char *if_name, const char *br_name)
 /* This sets up the Host end of the network device with an IP address, brings
  * it up so packets will flow, the copies the MAC address into the hwaddr
  * pointer. */
-static void configure_device(int fd, const char *devname, u32 ipaddr,
-                             unsigned char hwaddr[6])
+static void configure_device(int fd, const char *tapif, u32 ipaddr)
 {
         struct ifreq ifr;
         struct sockaddr_in *sin = (struct sockaddr_in *)&ifr.ifr_addr;
 
-        /* Don't read these incantations.  Just cut & paste them like I did! */
         memset(&ifr, 0, sizeof(ifr));
-        strcpy(ifr.ifr_name, devname);
+        strcpy(ifr.ifr_name, tapif);
+
+        /* Don't read these incantations.  Just cut & paste them like I did! */
         sin->sin_family = AF_INET;
         sin->sin_addr.s_addr = htonl(ipaddr);
         if (ioctl(fd, SIOCSIFADDR, &ifr) != 0)
-                err(1, "Setting %s interface address", devname);
+                err(1, "Setting %s interface address", tapif);
         ifr.ifr_flags = IFF_UP;
         if (ioctl(fd, SIOCSIFFLAGS, &ifr) != 0)
-                err(1, "Bringing interface %s up", devname);
+                err(1, "Bringing interface %s up", tapif);
+}
+
+static void get_mac(int fd, const char *tapif, unsigned char hwaddr[6])
+{
+        struct ifreq ifr;
+
+        memset(&ifr, 0, sizeof(ifr));
+        strcpy(ifr.ifr_name, tapif);
 
         /* SIOC stands for Socket I/O Control.  G means Get (vs S for Set
          * above).  IF means Interface, and HWADDR is hardware address.
          * Simple! */
         if (ioctl(fd, SIOCGIFHWADDR, &ifr) != 0)
-                err(1, "getting hw address for %s", devname);
+                err(1, "getting hw address for %s", tapif);
         memcpy(hwaddr, ifr.ifr_hwaddr.sa_data, 6);
 }
 
-/*L:195 Our network is a Host<->Guest network.  This can either use bridging or
- * routing, but the principle is the same: it uses the "tun" device to inject
- * packets into the Host as if they came in from a normal network card.  We
- * just shunt packets between the Guest and the tun device. */
-static void setup_tun_net(const char *arg)
+static int get_tun_device(char tapif[IFNAMSIZ])
 {
-        struct device *dev;
         struct ifreq ifr;
-        int netfd, ipfd;
-        u32 ip;
-        const char *br_name = NULL;
-        struct virtio_net_config conf;
+        int netfd;
+
+        /* Start with this zeroed.  Messy but sure. */
+        memset(&ifr, 0, sizeof(ifr));
 
         /* We open the /dev/net/tun device and tell it we want a tap device.  A
          * tap device is like a tun device, only somehow different.  To tell
          * the truth, I completely blundered my way through this code, but it
          * works now! */
         netfd = open_or_die("/dev/net/tun", O_RDWR);
-        memset(&ifr, 0, sizeof(ifr));
-        ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
+        ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR;
         strcpy(ifr.ifr_name, "tap%d");
         if (ioctl(netfd, TUNSETIFF, &ifr) != 0)
                 err(1, "configuring /dev/net/tun");
+
+        if (ioctl(netfd, TUNSETOFFLOAD,
+                  TUN_F_CSUM|TUN_F_TSO4|TUN_F_TSO6|TUN_F_TSO_ECN) != 0)
+                err(1, "Could not set features for tun device");
+
         /* We don't need checksums calculated for packets coming in this
          * device: trust us! */
         ioctl(netfd, TUNSETNOCSUM, 1);
 
+        memcpy(tapif, ifr.ifr_name, IFNAMSIZ);
+        return netfd;
+}
+
+/*L:195 Our network is a Host<->Guest network.  This can either use bridging or
+ * routing, but the principle is the same: it uses the "tun" device to inject
+ * packets into the Host as if they came in from a normal network card.  We
+ * just shunt packets between the Guest and the tun device. */
+static void setup_tun_net(char *arg)
+{
+        struct device *dev;
+        int netfd, ipfd;
+        u32 ip = INADDR_ANY;
+        bool bridging = false;
+        char tapif[IFNAMSIZ], *p;
+        struct virtio_net_config conf;
+
+        netfd = get_tun_device(tapif);
+
         /* First we create a new network device. */
         dev = new_device("net", VIRTIO_ID_NET, netfd, handle_tun_input);
 
         /* Network devices need a receive and a send queue, just like
          * console. */
-        add_virtqueue(dev, VIRTQUEUE_NUM, enable_fd);
+        add_virtqueue(dev, VIRTQUEUE_NUM, net_enable_fd);
         add_virtqueue(dev, VIRTQUEUE_NUM, handle_net_output);
 
         /* We need a socket to perform the magic network ioctls to bring up the
@@ -1364,28 +1523,56 @@ static void setup_tun_net(const char *arg)
 
         /* If the command line was --tunnet=bridge:<name> do bridging. */
         if (!strncmp(BRIDGE_PFX, arg, strlen(BRIDGE_PFX))) {
-                ip = INADDR_ANY;
-                br_name = arg + strlen(BRIDGE_PFX);
-                add_to_bridge(ipfd, ifr.ifr_name, br_name);
-        } else /* It is an IP address to set up the device with */
+                arg += strlen(BRIDGE_PFX);
+                bridging = true;
+        }
+
+        /* A mac address may follow the bridge name or IP address */
+        p = strchr(arg, ':');
+        if (p) {
+                str2mac(p+1, conf.mac);
+                *p = '\0';
+        } else {
+                p = arg + strlen(arg);
+                /* None supplied; query the randomly assigned mac. */
+                get_mac(ipfd, tapif, conf.mac);
+        }
+
+        /* arg is now either an IP address or a bridge name */
+        if (bridging)
+                add_to_bridge(ipfd, tapif, arg);
+        else
                 ip = str2ip(arg);
 
-        /* Set up the tun device, and get the mac address for the interface. */
-        configure_device(ipfd, ifr.ifr_name, ip, conf.mac);
+        /* Set up the tun device. */
+        configure_device(ipfd, tapif, ip);
 
         /* Tell Guest what MAC address to use. */
         add_feature(dev, VIRTIO_NET_F_MAC);
         add_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY);
+        /* Expect Guest to handle everything except UFO */
+        add_feature(dev, VIRTIO_NET_F_CSUM);
+        add_feature(dev, VIRTIO_NET_F_GUEST_CSUM);
+        add_feature(dev, VIRTIO_NET_F_MAC);
+        add_feature(dev, VIRTIO_NET_F_GUEST_TSO4);
+        add_feature(dev, VIRTIO_NET_F_GUEST_TSO6);
+        add_feature(dev, VIRTIO_NET_F_GUEST_ECN);
+        add_feature(dev, VIRTIO_NET_F_HOST_TSO4);
+        add_feature(dev, VIRTIO_NET_F_HOST_TSO6);
+        add_feature(dev, VIRTIO_NET_F_HOST_ECN);
         set_config(dev, sizeof(conf), &conf);
 
         /* We don't need the socket any more; setup is done. */
         close(ipfd);
 
-        verbose("device %u: tun net %u.%u.%u.%u\n",
-                devices.device_num++,
-                (u8)(ip>>24),(u8)(ip>>16),(u8)(ip>>8),(u8)ip);
-        if (br_name)
-                verbose("attached to bridge: %s\n", br_name);
+        devices.device_num++;
+
+        if (bridging)
+                verbose("device %u: tun %s attached to bridge: %s\n",
+                        devices.device_num, tapif, arg);
+        else
+                verbose("device %u: tun %s: %s\n",
+                        devices.device_num, tapif, arg);
 }
 
 /* Our block (disk) device should be really simple: the Guest asks for a block
@@ -1550,7 +1737,7 @@ static bool handle_io_finish(int fd, struct device *dev)
 }
 
 /* When the Guest submits some I/O, we just need to wake the I/O thread. */
-static void handle_virtblk_output(int fd, struct virtqueue *vq)
+static void handle_virtblk_output(int fd, struct virtqueue *vq, bool timeout)
 {
         struct vblk_info *vblk = vq->dev->priv;
         char c = 0;
@@ -1621,6 +1808,64 @@ static void setup_block_file(const char *filename)
         verbose("device %u: virtblock %llu sectors\n",
                 devices.device_num, le64_to_cpu(conf.capacity));
 }
+
+/* Our random number generator device reads from /dev/random into the Guest's
+ * input buffers.  The usual case is that the Guest doesn't want random numbers
+ * and so has no buffers although /dev/random is still readable, whereas
+ * console is the reverse.
+ *
+ * The same logic applies, however. */
+static bool handle_rng_input(int fd, struct device *dev)
+{
+        int len;
+        unsigned int head, in_num, out_num, totlen = 0;
+        struct iovec iov[dev->vq->vring.num];
+
+        /* First we need a buffer from the Guests's virtqueue. */
+        head = get_vq_desc(dev->vq, iov, &out_num, &in_num);
+
+        /* If they're not ready for input, stop listening to this file
+         * descriptor.  We'll start again once they add an input buffer. */
+        if (head == dev->vq->vring.num)
+                return false;
+
+        if (out_num)
+                errx(1, "Output buffers in rng?");
+
+        /* This is why we convert to iovecs: the readv() call uses them, and so
+         * it reads straight into the Guest's buffer.  We loop to make sure we
+         * fill it. */
+        while (!iov_empty(iov, in_num)) {
+                len = readv(dev->fd, iov, in_num);
+                if (len <= 0)
+                        err(1, "Read from /dev/random gave %i", len);
+                iov_consume(iov, in_num, len);
+                totlen += len;
+        }
+
+        /* Tell the Guest about the new input. */
+        add_used_and_trigger(fd, dev->vq, head, totlen);
+
+        /* Everything went OK! */
+        return true;
+}
+
+/* And this creates a "hardware" random number device for the Guest. */
+static void setup_rng(void)
+{
+        struct device *dev;
+        int fd;
+
+        fd = open_or_die("/dev/random", O_RDONLY);
+
+        /* The device responds to return from I/O thread. */
+        dev = new_device("rng", VIRTIO_ID_RNG, fd, handle_rng_input);
+
+        /* The device has one virtqueue, where the Guest places inbufs. */
+        add_virtqueue(dev, VIRTQUEUE_NUM, enable_fd);
+
+        verbose("device %u: rng\n", devices.device_num++);
+}
 /* That's the end of device setup. */
 
 /*L:230 Reboot is pretty easy: clean up and exec() the Launcher afresh. */
@@ -1628,11 +1873,12 @@ static void __attribute__((noreturn)) restart_guest(void)
 {
         unsigned int i;
 
-        /* Closing pipes causes the Waker thread and io_threads to die, and
-         * closing /dev/lguest cleans up the Guest.  Since we don't track all
-         * open fds, we simply close everything beyond stderr. */
+        /* Since we don't track all open fds, we simply close everything beyond
+         * stderr. */
         for (i = 3; i < FD_SETSIZE; i++)
                 close(i);
+
+        /* The exec automatically gets rid of the I/O and Waker threads. */
         execv(main_args[0], main_args);
         err(1, "Could not exec %s", main_args[0]);
 }
@@ -1663,7 +1909,7 @@ static void __attribute__((noreturn)) run_guest(int lguest_fd)
                 /* ERESTART means that we need to reboot the guest */
                 } else if (errno == ERESTART) {
                         restart_guest();
-                /* EAGAIN means the Waker wanted us to look at some input.
+                /* EAGAIN means a signal (timeout).
                  * Anything else means a bug or incompatible change. */
                 } else if (errno != EAGAIN)
                         err(1, "Running guest failed");
@@ -1691,13 +1937,14 @@ static struct option opts[] = {
         { "verbose", 0, NULL, 'v' },
         { "tunnet", 1, NULL, 't' },
         { "block", 1, NULL, 'b' },
+        { "rng", 0, NULL, 'r' },
         { "initrd", 1, NULL, 'i' },
         { NULL },
 };
 static void usage(void)
 {
         errx(1, "Usage: lguest [--verbose] "
-             "[--tunnet=(<ipaddr>|bridge:<bridgename>)\n"
+             "[--tunnet=(<ipaddr>:<macaddr>|bridge:<bridgename>:<macaddr>)\n"
              "|--block=<filename>|--initrd=<filename>]...\n"
              "<mem-in-mb> vmlinux [args...]");
 }
@@ -1765,6 +2012,9 @@ int main(int argc, char *argv[])
                 case 'b':
                         setup_block_file(optarg);
                         break;
+                case 'r':
+                        setup_rng();
+                        break;
                 case 'i':
                         initrd_name = optarg;
                         break;
@@ -1783,6 +2033,9 @@ int main(int argc, char *argv[])
         /* We always have a console device */
         setup_console();
 
+        /* We can timeout waiting for Guest network transmit. */
+        setup_timeout();
+
         /* Now we load the kernel */
         start = load_kernel(open_or_die(argv[optind+1], O_RDONLY));
 
@@ -1826,10 +2079,10 @@ int main(int argc, char *argv[])
          * /dev/lguest file descriptor. */
         lguest_fd = tell_kernel(pgdir, start);
 
-        /* We fork off a child process, which wakes the Launcher whenever one
-         * of the input file descriptors needs attention.  We call this the
-         * Waker, and we'll cover it in a moment. */
-        waker_fd = setup_waker(lguest_fd);
+        /* We clone off a thread, which wakes the Launcher whenever one of the
+         * input file descriptors needs attention.  We call this the Waker, and
+         * we'll cover it in a moment. */
+        setup_waker(lguest_fd);
 
         /* Finally, run the Guest.  This doesn't return. */
         run_guest(lguest_fd);
diff --git a/Documentation/local_ops.txt b/Documentation/local_ops.txt
index 4269a1105b37..f4f8b1c6c8ba 100644
--- a/Documentation/local_ops.txt
+++ b/Documentation/local_ops.txt
@@ -36,7 +36,7 @@ It can be done by slightly modifying the standard atomic operations : only
 their UP variant must be kept. It typically means removing LOCK prefix (on
 i386 and x86_64) and any SMP sychronization barrier. If the architecture does
 not have a different behavior between SMP and UP, including asm-generic/local.h
-in your archtecture's local.h is sufficient.
+in your architecture's local.h is sufficient.
 
 The local_t type is defined as an opaque signed long by embedding an
 atomic_long_t inside a structure. This is made so a cast from this type to a
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 7fa7fe71d7a8..688dfe1e6b70 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -631,7 +631,7 @@ xmit_hash_policy
                 in environments where a layer3 gateway device is
                 required to reach most destinations.
 
-                This algorithm is 802.3ad complient.
+                This algorithm is 802.3ad compliant.
 
         layer3+4
 
diff --git a/Documentation/networking/can.txt b/Documentation/networking/can.txt
index 641d2afacffa..297ba7b1ccaf 100644
--- a/Documentation/networking/can.txt
+++ b/Documentation/networking/can.txt
@@ -186,7 +186,7 @@ solution for a couple of reasons:
 
   The Linux network devices (by default) just can handle the
   transmission and reception of media dependent frames. Due to the
-  arbritration on the CAN bus the transmission of a low prio CAN-ID
+  arbitration on the CAN bus the transmission of a low prio CAN-ID
   may be delayed by the reception of a high prio CAN frame. To
   reflect the correct* traffic on the node the loopback of the sent
   data has to be performed right after a successful transmission. If
@@ -481,7 +481,7 @@ solution for a couple of reasons:
   - stats_timer: To calculate the Socket CAN core statistics
     (e.g. current/maximum frames per second) this 1 second timer is
     invoked at can.ko module start time by default. This timer can be
-    disabled by using stattimer=0 on the module comandline.
+    disabled by using stattimer=0 on the module commandline.
 
   - debug: (removed since SocketCAN SVN r546)
 
diff --git a/Documentation/networking/packet_mmap.txt b/Documentation/networking/packet_mmap.txt
index db0cd5169581..07c53d596035 100644
--- a/Documentation/networking/packet_mmap.txt
+++ b/Documentation/networking/packet_mmap.txt
@@ -326,7 +326,7 @@ just one call to mmap is needed:
     mmap(0, size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 
 If tp_frame_size is a divisor of tp_block_size frames will be 
-contiguosly spaced by tp_frame_size bytes. If not, each 
+contiguously spaced by tp_frame_size bytes. If not, each
 tp_block_size/tp_frame_size frames there will be a gap between 
 the frames. This is because a frame cannot be spawn across two
 blocks. 
diff --git a/Documentation/networking/tc-actions-env-rules.txt b/Documentation/networking/tc-actions-env-rules.txt
index 01e716d185f4..dcadf6f88e34 100644
--- a/Documentation/networking/tc-actions-env-rules.txt
+++ b/Documentation/networking/tc-actions-env-rules.txt
@@ -4,26 +4,27 @@ The "enviromental" rules for authors of any new tc actions are:
 1) If you stealeth or borroweth any packet thou shalt be branching
 from the righteous path and thou shalt cloneth.
 
-For example if your action queues a packet to be processed later
-or intentionaly branches by redirecting a packet then you need to
+For example if your action queues a packet to be processed later,
+or intentionally branches by redirecting a packet, then you need to
 clone the packet.
+
 There are certain fields in the skb tc_verd that need to be reset so we
-avoid loops etc. A few are generic enough so much so that skb_act_clone()
-resets them for you. So invoke skb_act_clone() rather than skb_clone()
+avoid loops, etc.  A few are generic enough that skb_act_clone()
+resets them for you, so invoke skb_act_clone() rather than skb_clone().
 
 2) If you munge any packet thou shalt call pskb_expand_head in the case
 someone else is referencing the skb. After that you "own" the skb.
 You must also tell us if it is ok to munge the packet (TC_OK2MUNGE),
 this way any action downstream can stomp on the packet.
 
-3) dropping packets you dont own is a nono. You simply return
+3) Dropping packets you don't own is a no-no. You simply return
 TC_ACT_SHOT to the caller and they will drop it.
 
 The "enviromental" rules for callers of actions (qdiscs etc) are:
 
-*) thou art responsible for freeing anything returned as being
+*) Thou art responsible for freeing anything returned as being
 TC_ACT_SHOT/STOLEN/QUEUED. If none of TC_ACT_SHOT/STOLEN/QUEUED is
-returned then all is great and you dont need to do anything.
+returned, then all is great and you don't need to do anything.
 
 Post on netdev if something is unclear.
 
diff --git a/Documentation/powerpc/booting-without-of.txt b/Documentation/powerpc/booting-without-of.txt
index 99514ced82c5..928a79ceb7aa 100644
--- a/Documentation/powerpc/booting-without-of.txt
+++ b/Documentation/powerpc/booting-without-of.txt
@@ -708,7 +708,7 @@ device or bus to be described by the device tree.
 In general, the format of an address for a device is defined by the
 parent bus type, based on the #address-cells and #size-cells
 properties.  Note that the parent's parent definitions of #address-cells
-and #size-cells are not inhereted so every node with children must specify
+and #size-cells are not inherited so every node with children must specify
 them.  The kernel requires the root node to have those properties defining
 addresses format for devices directly mapped on the processor bus.
 
@@ -1777,7 +1777,7 @@ platforms are moved over to use the flattened-device-tree model.
 
       Xilinx uartlite devices are simple fixed speed serial ports.
 
-      Requred properties:
+      Required properties:
        - current-speed : Baud rate of uartlite
 
       v) Xilinx hwicap
@@ -1799,7 +1799,7 @@ platforms are moved over to use the flattened-device-tree model.
       Xilinx UART 16550 devices are very similar to the NS16550 but with
       different register spacing and an offset from the base address.
 
-      Requred properties:
+      Required properties:
        - clock-frequency : Frequency of the clock input
        - reg-offset : A value of 3 is required
        - reg-shift : A value of 2 is required
@@ -1953,7 +1953,7 @@ prefixed with the string "marvell,", for Marvell Technology Group Ltd.
 1) The /system-controller node
 
   This node is used to represent the system-controller and must be
-  present when the system uses a system contller chip. The top-level
+  present when the system uses a system controller chip. The top-level
   system-controller node contains information that is global to all
   devices within the system controller chip. The node name begins
   with "system-controller" followed by the unit address, which is
diff --git a/Documentation/powerpc/qe_firmware.txt b/Documentation/powerpc/qe_firmware.txt
index 896266432d33..06da4d4b44f9 100644
--- a/Documentation/powerpc/qe_firmware.txt
+++ b/Documentation/powerpc/qe_firmware.txt
@@ -217,7 +217,7 @@ Although it is not recommended, you can specify '0' in the soc.model
 field to skip matching SOCs altogether.
 
 The 'model' field is a 16-bit number that matches the actual SOC. The
-'major' and 'minor' fields are the major and minor revision numbrs,
+'major' and 'minor' fields are the major and minor revision numbers,
 respectively, of the SOC.
 
 For example, to match the 8323, revision 1.0:
diff --git a/Documentation/s390/driver-model.txt b/Documentation/s390/driver-model.txt
index e938c442277d..bde473df748d 100644
--- a/Documentation/s390/driver-model.txt
+++ b/Documentation/s390/driver-model.txt
@@ -25,7 +25,7 @@ device 4711 via subchannel 1 in subchannel set 0, and subchannel 2 is a non-I/O
 subchannel. Device 1234 is accessed via subchannel 0 in subchannel set 1.
 
 The subchannel named 'defunct' does not represent any real subchannel on the
-system; it is a pseudo subchannel where disconnnected ccw devices are moved to
+system; it is a pseudo subchannel where disconnected ccw devices are moved to
 if they are displaced by another ccw device becoming operational on their
 former subchannel. The ccw devices will be moved again to a proper subchannel
 if they become operational again on that subchannel.
diff --git a/Documentation/scsi/ibmmca.txt b/Documentation/scsi/ibmmca.txt
index a810421f1fb3..3920f28710c4 100644
--- a/Documentation/scsi/ibmmca.txt
+++ b/Documentation/scsi/ibmmca.txt
@@ -524,7 +524,7 @@
    - Michael Lang
  
    June 25 1997: (v1.8b)
-   1) Some cosmetical changes for the handling of SCSI-device-types.
+   1) Some cosmetic changes for the handling of SCSI-device-types.
       Now, also CD-Burners / WORMs and SCSI-scanners should work. For
       MO-drives I have no experience, therefore not yet supported.
       In logical_devices I changed from different type-variables to one
@@ -914,7 +914,7 @@
       in version 4.0. This was never really necessary, as all troubles were
       based on non-command related reasons up to now, so bypassing commands
       did not help to avoid any bugs. It is kept in 3.2X for debugging reasons.
-   5) Dynamical reassignment of ldns was again verified and analyzed to be
+   5) Dynamic reassignment of ldns was again verified and analyzed to be
       completely inoperational. This is corrected and should work now.
    6) All commands that get sent to the SCSI adapter were verified and
       completed in such a way, that they are now completely conform to the
@@ -1386,7 +1386,7 @@
    concerning the Linux-kernel in special, this SCSI-driver comes without any
    warranty. Its functionality is tested as good as possible on certain 
    machines and combinations of computer hardware, which does not exclude,
-   that dataloss or severe damage of hardware is possible while using this
+   that data loss or severe damage of hardware is possible while using this
    part of software on some arbitrary computer hardware or in combination 
    with other software packages. It is highly recommended to make backup
    copies of your data before using this software. Furthermore, personal
diff --git a/Documentation/scsi/lpfc.txt b/Documentation/scsi/lpfc.txt
index 4dbe41370a6d..5741ea8aa88a 100644
--- a/Documentation/scsi/lpfc.txt
+++ b/Documentation/scsi/lpfc.txt
@@ -36,7 +36,7 @@ Cable pull and temporary device Loss:
   being removed, a switch rebooting, or a device reboot), the driver could
   hide the disappearance of the device from the midlayer. I/O's issued to
   the LLDD would simply be queued for a short duration, allowing the device
-  to reappear or link come back alive, with no inadvertant side effects
+  to reappear or link come back alive, with no inadvertent side effects
   to the system. If the driver did not hide these conditions, i/o would be
   errored by the driver, the mid-layer would exhaust its retries, and the
   device would be taken offline. Manual intervention would be required to
diff --git a/Documentation/scsi/scsi_fc_transport.txt b/Documentation/scsi/scsi_fc_transport.txt
index d403e46d8463..75143f0c23b6 100644
--- a/Documentation/scsi/scsi_fc_transport.txt
+++ b/Documentation/scsi/scsi_fc_transport.txt
@@ -65,7 +65,7 @@ Overview:
     discussion will concentrate on NPIV.
 
   Note: World Wide Name assignment (and uniqueness guarantees) are left
-    up to an administrative entity controling the vport. For example,
+    up to an administrative entity controlling the vport. For example,
     if vports are to be associated with virtual machines, a XEN mgmt
     utility would be responsible for creating wwpn/wwnn's for the vport,
     using it's own naming authority and OUI. (Note: it already does this
@@ -91,7 +91,7 @@ Device Trees and Vport Objects:
   Here's what to expect in the device tree :
    The typical Physical Port's Scsi_Host:
      /sys/devices/.../host17/
-   and it has the typical decendent tree:
+   and it has the typical descendant tree:
      /sys/devices/.../host17/rport-17:0-0/target17:0:0/17:0:0:0:
    and then the vport is created on the Physical Port:
      /sys/devices/.../host17/vport-17:0-0
@@ -192,7 +192,7 @@ Vport States:
       independent of the adapter's link state.
     - Instantiation of the vport on the FC link via ELS traffic, etc.
       This is equivalent to a "link up" and successfull link initialization.
-  Futher information can be found in the interfaces section below for
+  Further information can be found in the interfaces section below for
   Vport Creation.
 
   Once a vport has been instantiated with the kernel/LLDD, a vport state
diff --git a/Documentation/sh/clk.txt b/Documentation/sh/clk.txt
index 9aef710e9a4b..114b595cfa97 100644
--- a/Documentation/sh/clk.txt
+++ b/Documentation/sh/clk.txt
@@ -12,7 +12,7 @@ means no changes to adjanced clock
 Internally, the clk_set_rate_ex forwards request to clk->ops->set_rate method,
 if it is present in ops structure. The method should set the clock rate and adjust
 all needed clocks according to the passed algo_id.
-Exact values for algo_id are machine-dependend. For the sh7722, the following
+Exact values for algo_id are machine-dependent. For the sh7722, the following
 values are defined:
 
         NO_CHANGE       = 0,
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 72aff61e7315..6f6d117ac7e2 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -1024,6 +1024,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           intel-mac-v3  Intel Mac Type 3
           intel-mac-v4  Intel Mac Type 4
           intel-mac-v5  Intel Mac Type 5
+          intel-mac-auto Intel Mac (detect type according to subsystem id)
           macmini       Intel Mac Mini (equivalent with type 3)
           macbook       Intel Mac Book (eq. type 5)
           macbook-pro-v1 Intel Mac Book Pro 1st generation (eq. type 3)
diff --git a/Documentation/sound/alsa/Audiophile-Usb.txt b/Documentation/sound/alsa/Audiophile-Usb.txt
index 2ad5e6306c44..a4c53d8961e1 100644
--- a/Documentation/sound/alsa/Audiophile-Usb.txt
+++ b/Documentation/sound/alsa/Audiophile-Usb.txt
@@ -236,15 +236,15 @@ The parameter can be given:
        alias snd-card-1 snd-usb-audio
        options snd-usb-audio index=1 device_setup=0x09
 
-CAUTION when initializaing the device
+CAUTION when initializing the device
 -------------------------------------
 
  * Correct initialization on the device requires that device_setup is given to
    the module BEFORE the device is turned on. So, if you use the "manual probing"
    method described above, take care to power-on the device AFTER this initialization.
 
- * Failing to respect this will lead in a misconfiguration of the device. In this case
-   turn off the device, unproble the snd-usb-audio module, then probe it again with 
+ * Failing to respect this will lead to a misconfiguration of the device. In this case
+   turn off the device, unprobe the snd-usb-audio module, then probe it again with
    correct device_setup parameter and then (and only then) turn on the device again.
 
  * If you've correctly initialized the device in a valid mode and then want to switch
@@ -388,9 +388,9 @@ There are 2 main potential issues when using Jackd with the device:
 
 Jack supports big endian devices only in recent versions (thanks to
 Andreas Steinmetz for his first big-endian patch). I can't remember 
-extacly when this support was released into jackd, let's just say that 
+exactly when this support was released into jackd, let's just say that
 with jackd version 0.103.0 it's almost ok (just a small bug is affecting 
-16bits Big-Endian devices, but since you've read  carefully the above 
+16bits Big-Endian devices, but since you've read carefully the above
 paragraphs, you're now using kernel >= 2.6.23 and your 16bits devices 
 are now Little Endians ;-) ).
 
diff --git a/Documentation/sound/alsa/hda_codec.txt b/Documentation/sound/alsa/hda_codec.txt
index 8e1b02526698..34e87ec1379c 100644
--- a/Documentation/sound/alsa/hda_codec.txt
+++ b/Documentation/sound/alsa/hda_codec.txt
@@ -67,7 +67,7 @@ CONFIG_SND_HDA_POWER_SAVE kconfig.  It's called when the codec needs
 to power up or may power down.  The controller should check the all
 belonging codecs on the bus whether they are actually powered off
 (check codec->power_on), and optionally the driver may power down the
-contoller side, too.
+controller side, too.
 
 The bus instance is created via snd_hda_bus_new().  You need to pass
 the card instance, the template, and the pointer to store the
diff --git a/Documentation/sound/alsa/soc/dapm.txt b/Documentation/sound/alsa/soc/dapm.txt
index c784a18b94dc..b2ed6983f40d 100644
--- a/Documentation/sound/alsa/soc/dapm.txt
+++ b/Documentation/sound/alsa/soc/dapm.txt
@@ -68,7 +68,7 @@ Audio DAPM widgets fall into a number of types:-
 (Widgets are defined in include/sound/soc-dapm.h)
 
 Widgets are usually added in the codec driver and the machine driver. There are
-convience macros defined in soc-dapm.h that can be used to quickly build a
+convenience macros defined in soc-dapm.h that can be used to quickly build a
 list of widgets of the codecs and machines DAPM widgets.
 
 Most widgets have a name, register, shift and invert. Some widgets have extra
diff --git a/Documentation/sparse.txt b/Documentation/sparse.txt
index 1a3bdc27d95e..42f43fa59f24 100644
--- a/Documentation/sparse.txt
+++ b/Documentation/sparse.txt
@@ -73,10 +73,10 @@ recompiled, or use "make C=2" to run sparse on the files whether they need to
 be recompiled or not.  The latter is a fast way to check the whole tree if you
 have already built it.
 
-The optional make variable CHECKFLAGS can be used to pass arguments to sparse.
-The build system passes -Wbitwise to sparse automatically.  To perform
-endianness checks, you may define __CHECK_ENDIAN__:
+The optional make variable CF can be used to pass arguments to sparse.  The
+build system passes -Wbitwise to sparse automatically.  To perform endianness
+checks, you may define __CHECK_ENDIAN__:
 
-        make C=2 CHECKFLAGS="-D__CHECK_ENDIAN__"
+        make C=2 CF="-D__CHECK_ENDIAN__"
 
 These checks are disabled by default as they generate a host of warnings.
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 8a4863c4edd4..d79eeda7a699 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -116,7 +116,7 @@ of kilobytes free.  The VM uses this number to compute a pages_min
 value for each lowmem zone in the system.  Each lowmem zone gets 
 a number of reserved free pages based proportionally on its size.
 
-Some minimal ammount of memory is needed to satisfy PF_MEMALLOC
+Some minimal amount of memory is needed to satisfy PF_MEMALLOC
 allocations; if you set this to lower than 1024KB, your system will
 become subtly broken, and prone to deadlock under high loads.
 
diff --git a/Documentation/timers/highres.txt b/Documentation/timers/highres.txt
index a73ecf5b4bdb..21332233cef1 100644
--- a/Documentation/timers/highres.txt
+++ b/Documentation/timers/highres.txt
@@ -125,7 +125,7 @@ increase of flexibility and the avoidance of duplicated code across
 architectures justifies the slight increase of the binary size.
 
 The conversion of an architecture has no functional impact, but allows to
-utilize the high resolution and dynamic tick functionalites without any change
+utilize the high resolution and dynamic tick functionalities without any change
 to the clock event device and timer interrupt code. After the conversion the
 enabling of high resolution timers and dynamic ticks is simply provided by
 adding the kernel/time/Kconfig file to the architecture specific Kconfig and
diff --git a/Documentation/usb/authorization.txt b/Documentation/usb/authorization.txt
index 2af400609498..381b22ee7834 100644
--- a/Documentation/usb/authorization.txt
+++ b/Documentation/usb/authorization.txt
@@ -8,7 +8,7 @@ not) in a system. This feature will allow you to implement a lock-down
 of USB devices, fully controlled by user space.
 
 As of now, when a USB device is connected it is configured and
-it's interfaces inmediately made available to the users. With this
+its interfaces are immediately made available to the users.  With this
 modification, only if root authorizes the device to be configured will
 then it be possible to use it.
 
diff --git a/Documentation/video4linux/CARDLIST.au0828 b/Documentation/video4linux/CARDLIST.au0828
index 86d1c8e7b18f..eedc399e8deb 100644
--- a/Documentation/video4linux/CARDLIST.au0828
+++ b/Documentation/video4linux/CARDLIST.au0828
@@ -2,3 +2,4 @@
   1 -> Hauppauge HVR950Q                        (au0828)        [2040:7200,2040:7210,2040:7217,2040:721b,2040:721f,2040:7280,0fd9:0008]
   2 -> Hauppauge HVR850                         (au0828)        [2040:7240]
   3 -> DViCO FusionHDTV USB                     (au0828)        [0fe9:d620]
+  4 -> Hauppauge HVR950Q rev xxF8               (au0828)        [2040:7201,2040:7211,2040:7281]
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 10591467ef16..89c7f32abf9f 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -1,11 +1,11 @@
   0 -> Unknown EM2800 video grabber             (em2800)        [eb1a:2800]
-  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2750,eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
+  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
   2 -> Terratec Cinergy 250 USB                 (em2820/em2840) [0ccd:0036]
   3 -> Pinnacle PCTV USB 2                      (em2820/em2840) [2304:0208]
   4 -> Hauppauge WinTV USB 2                    (em2820/em2840) [2040:4200,2040:4201]
   5 -> MSI VOX USB 2.0                          (em2820/em2840)
   6 -> Terratec Cinergy 200 USB                 (em2800)
-  7 -> Leadtek Winfast USB II                   (em2800)
+  7 -> Leadtek Winfast USB II                   (em2800)        [0413:6023]
   8 -> Kworld USB2800                           (em2800)
   9 -> Pinnacle Dazzle DVC 90/DVC 100           (em2820/em2840) [2304:0207,2304:021a]
  10 -> Hauppauge WinTV HVR 900                  (em2880)        [2040:6500]
@@ -14,7 +14,46 @@
  13 -> Terratec Prodigy XS                      (em2880)        [0ccd:0047]
  14 -> Pixelview Prolink PlayTV USB 2.0         (em2820/em2840)
  15 -> V-Gear PocketTV                          (em2800)
- 16 -> Hauppauge WinTV HVR 950                  (em2880)        [2040:6513,2040:6517,2040:651b,2040:651f]
+ 16 -> Hauppauge WinTV HVR 950                  (em2883)        [2040:6513,2040:6517,2040:651b,2040:651f]
  17 -> Pinnacle PCTV HD Pro Stick               (em2880)        [2304:0227]
  18 -> Hauppauge WinTV HVR 900 (R2)             (em2880)        [2040:6502]
  19 -> PointNix Intra-Oral Camera               (em2860)
+ 20 -> AMD ATI TV Wonder HD 600                 (em2880)        [0438:b002]
+ 21 -> eMPIA Technology, Inc. GrabBeeX+ Video Encoder (em2800)        [eb1a:2801]
+ 22 -> Unknown EM2750/EM2751 webcam grabber     (em2750)        [eb1a:2750,eb1a:2751]
+ 23 -> Huaqi DLCW-130                           (em2750)
+ 24 -> D-Link DUB-T210 TV Tuner                 (em2820/em2840) [2001:f112]
+ 25 -> Gadmei UTV310                            (em2820/em2840)
+ 26 -> Hercules Smart TV USB 2.0                (em2820/em2840)
+ 27 -> Pinnacle PCTV USB 2 (Philips FM1216ME)   (em2820/em2840)
+ 28 -> Leadtek Winfast USB II Deluxe            (em2820/em2840)
+ 29 -> Pinnacle Dazzle DVC 100                  (em2820/em2840)
+ 30 -> Videology 20K14XUSB USB2.0               (em2820/em2840)
+ 31 -> Usbgear VD204v9                          (em2821)
+ 32 -> Supercomp USB 2.0 TV                     (em2821)
+ 33 -> SIIG AVTuner-PVR/Prolink PlayTV USB 2.0  (em2821)
+ 34 -> Terratec Cinergy A Hybrid XS             (em2860)        [0ccd:004f]
+ 35 -> Typhoon DVD Maker                        (em2860)
+ 36 -> NetGMBH Cam                              (em2860)
+ 37 -> Gadmei UTV330                            (em2860)
+ 38 -> Yakumo MovieMixer                        (em2861)
+ 39 -> KWorld PVRTV 300U                        (em2861)        [eb1a:e300]
+ 40 -> Plextor ConvertX PX-TV100U               (em2861)        [093b:a005]
+ 41 -> Kworld 350 U DVB-T                       (em2870)        [eb1a:e350]
+ 42 -> Kworld 355 U DVB-T                       (em2870)        [eb1a:e355,eb1a:e357]
+ 43 -> Terratec Cinergy T XS                    (em2870)        [0ccd:0043]
+ 44 -> Terratec Cinergy T XS (MT2060)           (em2870)
+ 45 -> Pinnacle PCTV DVB-T                      (em2870)
+ 46 -> Compro, VideoMate U3                     (em2870)        [185b:2870]
+ 47 -> KWorld DVB-T 305U                        (em2880)        [eb1a:e305]
+ 48 -> KWorld DVB-T 310U                        (em2880)
+ 49 -> MSI DigiVox A/D                          (em2880)        [eb1a:e310]
+ 50 -> MSI DigiVox A/D II                       (em2880)        [eb1a:e320]
+ 51 -> Terratec Hybrid XS Secam                 (em2880)        [0ccd:004c]
+ 52 -> DNT DA2 Hybrid                           (em2881)
+ 53 -> Pinnacle Hybrid Pro                      (em2881)
+ 54 -> Kworld VS-DVB-T 323UR                    (em2882)        [eb1a:e323]
+ 55 -> Terratec Hybrid XS (em2882)              (em2882)        [0ccd:005e]
+ 56 -> Pinnacle Hybrid Pro (2)                  (em2882)        [2304:0226]
+ 57 -> Kworld PlusTV HD Hybrid 330              (em2883)        [eb1a:a316]
+ 58 -> Compro VideoMate ForYou/Stereo           (em2820/em2840) [185b:2041]
diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt
index 0c4880af57a3..bcaf4ab383be 100644
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -1,4 +1,4 @@
-List of the webcams know by gspca.
+List of the webcams known by gspca.
 
 The modules are:
         gspca_main      main driver
diff --git a/Documentation/video4linux/sn9c102.txt b/Documentation/video4linux/sn9c102.txt
index b26f5195af51..73de4050d637 100644
--- a/Documentation/video4linux/sn9c102.txt
+++ b/Documentation/video4linux/sn9c102.txt
@@ -157,7 +157,7 @@ Loading can be done as shown below:
 
         [root@localhost home]# modprobe sn9c102
 
-Note that the module is called "sn9c102" for historic reasons, althought it
+Note that the module is called "sn9c102" for historic reasons, although it
 does not just support the SN9C102.
 
 At this point all the devices supported by the driver and connected to the USB
diff --git a/Documentation/vm/hugetlbpage.txt b/Documentation/vm/hugetlbpage.txt
index 8a5b5763f0fe..ea8714fcc3ad 100644
--- a/Documentation/vm/hugetlbpage.txt
+++ b/Documentation/vm/hugetlbpage.txt
@@ -77,7 +77,7 @@ memory that is preset in system at this time.  System administrators may want
 to put this command in one of the local rc init files.  This will enable the
 kernel to request huge pages early in the boot process (when the possibility
 of getting physical contiguous pages is still very high). In either
-case, adminstrators will want to verify the number of hugepages actually
+case, administrators will want to verify the number of hugepages actually
 allocated by checking the sysctl or meminfo.
 
 /proc/sys/vm/nr_overcommit_hugepages indicates how large the pool of
diff --git a/Documentation/vm/numa_memory_policy.txt b/Documentation/vm/numa_memory_policy.txt
index bad16d3f6a47..6aaaeb38730c 100644
--- a/Documentation/vm/numa_memory_policy.txt
+++ b/Documentation/vm/numa_memory_policy.txt
@@ -58,7 +58,7 @@ most general to most specific:
         the policy at the time they were allocated.
 
     VMA Policy:  A "VMA" or "Virtual Memory Area" refers to a range of a task's
-    virtual adddress space.  A task may define a specific policy for a range
+    virtual address space.  A task may define a specific policy for a range
     of its virtual address space.   See the MEMORY POLICIES APIS section,
     below, for an overview of the mbind() system call used to set a VMA
     policy.
@@ -353,7 +353,7 @@ follows:
 
    Because of this extra reference counting, and because we must lookup
    shared policies in a tree structure under spinlock, shared policies are
-   more expensive to use in the page allocation path.  This is expecially
+   more expensive to use in the page allocation path.  This is especially
    true for shared policies on shared memory regions shared by tasks running
    on different NUMA nodes.  This extra overhead can be avoided by always
    falling back to task or system default policy for shared memory regions,
diff --git a/Documentation/volatile-considered-harmful.txt b/Documentation/volatile-considered-harmful.txt
index 10c2e411cca8..991c26a6ef64 100644
--- a/Documentation/volatile-considered-harmful.txt
+++ b/Documentation/volatile-considered-harmful.txt
@@ -114,6 +114,6 @@ CREDITS
 
 Original impetus and research by Randy Dunlap
 Written by Jonathan Corbet
-Improvements via coments from Satyam Sharma, Johannes Stezenbach, Jesper
+Improvements via comments from Satyam Sharma, Johannes Stezenbach, Jesper
         Juhl, Heikki Orsila, H. Peter Anvin, Philipp Hahn, and Stefan
         Richter.