26 files changed, 1017 insertions, 57 deletions

diff --git a/Documentation/ABI/testing/sysfs-class-bdi b/Documentation/ABI/testing/sysfs-class-bdi
new file mode 100644
index 000000000000..5ac1e01bbd48
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-class-bdi
@@ -0,0 +1,46 @@
+What:           /sys/class/bdi/<bdi>/
+Date:           January 2008
+Contact:        Peter Zijlstra <a.p.zijlstra@chello.nl>
+Description:
+
+Provide a place in sysfs for the backing_dev_info object.  This allows
+setting and retrieving various BDI specific variables.
+
+The <bdi> identifier can be either of the following:
+
+MAJOR:MINOR
+
+        Device number for block devices, or value of st_dev on
+        non-block filesystems which provide their own BDI, such as NFS
+        and FUSE.
+
+default
+
+        The default backing dev, used for non-block device backed
+        filesystems which do not provide their own BDI.
+
+Files under /sys/class/bdi/<bdi>/
+---------------------------------
+
+read_ahead_kb (read-write)
+
+        Size of the read-ahead window in kilobytes
+
+min_ratio (read-write)
+
+        Under normal circumstances each device is given a part of the
+        total write-back cache that relates to its current average
+        writeout speed in relation to the other devices.
+
+        The 'min_ratio' parameter allows assigning a minimum
+        percentage of the write-back cache to a particular device.
+        For example, this is useful for providing a minimum QoS.
+
+max_ratio (read-write)
+
+        Allows limiting a particular device to use not more than the
+        given percentage of the write-back cache.  This is useful in
+        situations where we want to avoid one device taking all or
+        most of the write-back cache.  For example in case of an NFS
+        mount that is prone to get stuck, or a FUSE mount which cannot
+        be trusted to play fair.
diff --git a/Documentation/DMA-API.txt b/Documentation/DMA-API.txt
index b939ebb62871..80d150458c80 100644
--- a/Documentation/DMA-API.txt
+++ b/Documentation/DMA-API.txt
@@ -145,7 +145,7 @@ Part Ic - DMA addressing limitations
 int
 dma_supported(struct device *dev, u64 mask)
 int
-pci_dma_supported(struct device *dev, u64 mask)
+pci_dma_supported(struct pci_dev *hwdev, u64 mask)
 
 Checks to see if the device can support DMA to the memory described by
 mask.
@@ -189,7 +189,7 @@ dma_addr_t
 dma_map_single(struct device *dev, void *cpu_addr, size_t size,
                       enum dma_data_direction direction)
 dma_addr_t
-pci_map_single(struct device *dev, void *cpu_addr, size_t size,
+pci_map_single(struct pci_dev *hwdev, void *cpu_addr, size_t size,
                       int direction)
 
 Maps a piece of processor virtual memory so it can be accessed by the
@@ -395,6 +395,71 @@ Notes:  You must do this:
 
 See also dma_map_single().
 
+dma_addr_t
+dma_map_single_attrs(struct device *dev, void *cpu_addr, size_t size,
+                     enum dma_data_direction dir,
+                     struct dma_attrs *attrs)
+
+void
+dma_unmap_single_attrs(struct device *dev, dma_addr_t dma_addr,
+                       size_t size, enum dma_data_direction dir,
+                       struct dma_attrs *attrs)
+
+int
+dma_map_sg_attrs(struct device *dev, struct scatterlist *sgl,
+                 int nents, enum dma_data_direction dir,
+                 struct dma_attrs *attrs)
+
+void
+dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sgl,
+                   int nents, enum dma_data_direction dir,
+                   struct dma_attrs *attrs)
+
+The four functions above are just like the counterpart functions
+without the _attrs suffixes, except that they pass an optional
+struct dma_attrs*.
+
+struct dma_attrs encapsulates a set of "dma attributes". For the
+definition of struct dma_attrs see linux/dma-attrs.h.
+
+The interpretation of dma attributes is architecture-specific, and
+each attribute should be documented in Documentation/DMA-attributes.txt.
+
+If struct dma_attrs* is NULL, the semantics of each of these
+functions is identical to those of the corresponding function
+without the _attrs suffix. As a result dma_map_single_attrs()
+can generally replace dma_map_single(), etc.
+
+As an example of the use of the *_attrs functions, here's how
+you could pass an attribute DMA_ATTR_FOO when mapping memory
+for DMA:
+
+#include <linux/dma-attrs.h>
+/* DMA_ATTR_FOO should be defined in linux/dma-attrs.h and
+ * documented in Documentation/DMA-attributes.txt */
+...
+
+        DEFINE_DMA_ATTRS(attrs);
+        dma_set_attr(DMA_ATTR_FOO, &attrs);
+        ....
+        n = dma_map_sg_attrs(dev, sg, nents, DMA_TO_DEVICE, &attr);
+        ....
+
+Architectures that care about DMA_ATTR_FOO would check for its
+presence in their implementations of the mapping and unmapping
+routines, e.g.:
+
+void whizco_dma_map_sg_attrs(struct device *dev, dma_addr_t dma_addr,
+                             size_t size, enum dma_data_direction dir,
+                             struct dma_attrs *attrs)
+{
+        ....
+        int foo =  dma_get_attr(DMA_ATTR_FOO, attrs);
+        ....
+        if (foo)
+                /* twizzle the frobnozzle */
+        ....
+
 
 Part II - Advanced dma_ usage
 -----------------------------
diff --git a/Documentation/DMA-attributes.txt b/Documentation/DMA-attributes.txt
new file mode 100644
index 000000000000..6d772f84b477
--- /dev/null
+++ b/Documentation/DMA-attributes.txt
@@ -0,0 +1,24 @@
+                        DMA attributes
+                        ==============
+
+This document describes the semantics of the DMA attributes that are
+defined in linux/dma-attrs.h.
+
+DMA_ATTR_WRITE_BARRIER
+----------------------
+
+DMA_ATTR_WRITE_BARRIER is a (write) barrier attribute for DMA.  DMA
+to a memory region with the DMA_ATTR_WRITE_BARRIER attribute forces
+all pending DMA writes to complete, and thus provides a mechanism to
+strictly order DMA from a device across all intervening busses and
+bridges.  This barrier is not specific to a particular type of
+interconnect, it applies to the system as a whole, and so its
+implementation must account for the idiosyncracies of the system all
+the way from the DMA device to memory.
+
+As an example of a situation where DMA_ATTR_WRITE_BARRIER would be
+useful, suppose that a device does a DMA write to indicate that data is
+ready and available in memory.  The DMA of the "completion indication"
+could race with data DMA.  Mapping the memory used for completion
+indications with DMA_ATTR_WRITE_BARRIER would prevent the race.
+
diff --git a/Documentation/DMA-mapping.txt b/Documentation/DMA-mapping.txt
index d84f89dbf921..b463ecd0c7ce 100644
--- a/Documentation/DMA-mapping.txt
+++ b/Documentation/DMA-mapping.txt
@@ -315,11 +315,11 @@ you should do:
 
         dma_addr_t dma_handle;
 
-        cpu_addr = pci_alloc_consistent(dev, size, &dma_handle);
+        cpu_addr = pci_alloc_consistent(pdev, size, &dma_handle);
 
-where dev is a struct pci_dev *. You should pass NULL for PCI like buses
-where devices don't have struct pci_dev (like ISA, EISA).  This may be
-called in interrupt context. 
+where pdev is a struct pci_dev *. This may be called in interrupt context.
+You should use dma_alloc_coherent (see DMA-API.txt) for buses
+where devices don't have struct pci_dev (like ISA, EISA).
 
 This argument is needed because the DMA translations may be bus
 specific (and often is private to the bus which the device is attached
@@ -332,7 +332,7 @@ __get_free_pages (but takes size instead of a page order).  If your
 driver needs regions sized smaller than a page, you may prefer using
 the pci_pool interface, described below.
 
-The consistent DMA mapping interfaces, for non-NULL dev, will by
+The consistent DMA mapping interfaces, for non-NULL pdev, will by
 default return a DMA address which is SAC (Single Address Cycle)
 addressable.  Even if the device indicates (via PCI dma mask) that it
 may address the upper 32-bits and thus perform DAC cycles, consistent
@@ -354,9 +354,9 @@ buffer you receive will not cross a 64K boundary.
 
 To unmap and free such a DMA region, you call:
 
-        pci_free_consistent(dev, size, cpu_addr, dma_handle);
+        pci_free_consistent(pdev, size, cpu_addr, dma_handle);
 
-where dev, size are the same as in the above call and cpu_addr and
+where pdev, size are the same as in the above call and cpu_addr and
 dma_handle are the values pci_alloc_consistent returned to you.
 This function may not be called in interrupt context.
 
@@ -371,9 +371,9 @@ Create a pci_pool like this:
 
         struct pci_pool *pool;
 
-        pool = pci_pool_create(name, dev, size, align, alloc);
+        pool = pci_pool_create(name, pdev, size, align, alloc);
 
-The "name" is for diagnostics (like a kmem_cache name); dev and size
+The "name" is for diagnostics (like a kmem_cache name); pdev and size
 are as above.  The device's hardware alignment requirement for this
 type of data is "align" (which is expressed in bytes, and must be a
 power of two).  If your device has no boundary crossing restrictions,
@@ -472,11 +472,11 @@ To map a single region, you do:
         void *addr = buffer->ptr;
         size_t size = buffer->len;
 
-        dma_handle = pci_map_single(dev, addr, size, direction);
+        dma_handle = pci_map_single(pdev, addr, size, direction);
 
 and to unmap it:
 
-        pci_unmap_single(dev, dma_handle, size, direction);
+        pci_unmap_single(pdev, dma_handle, size, direction);
 
 You should call pci_unmap_single when the DMA activity is finished, e.g.
 from the interrupt which told you that the DMA transfer is done.
@@ -493,17 +493,17 @@ Specifically:
         unsigned long offset = buffer->offset;
         size_t size = buffer->len;
 
-        dma_handle = pci_map_page(dev, page, offset, size, direction);
+        dma_handle = pci_map_page(pdev, page, offset, size, direction);
 
         ...
 
-        pci_unmap_page(dev, dma_handle, size, direction);
+        pci_unmap_page(pdev, dma_handle, size, direction);
 
 Here, "offset" means byte offset within the given page.
 
 With scatterlists, you map a region gathered from several regions by:
 
-        int i, count = pci_map_sg(dev, sglist, nents, direction);
+        int i, count = pci_map_sg(pdev, sglist, nents, direction);
         struct scatterlist *sg;
 
         for_each_sg(sglist, sg, count, i) {
@@ -527,7 +527,7 @@ accessed sg->address and sg->length as shown above.
 
 To unmap a scatterlist, just call:
 
-        pci_unmap_sg(dev, sglist, nents, direction);
+        pci_unmap_sg(pdev, sglist, nents, direction);
 
 Again, make sure DMA activity has already finished.
 
@@ -550,11 +550,11 @@ correct copy of the DMA buffer.
 So, firstly, just map it with pci_map_{single,sg}, and after each DMA
 transfer call either:
 
-        pci_dma_sync_single_for_cpu(dev, dma_handle, size, direction);
+        pci_dma_sync_single_for_cpu(pdev, dma_handle, size, direction);
 
 or:
 
-        pci_dma_sync_sg_for_cpu(dev, sglist, nents, direction);
+        pci_dma_sync_sg_for_cpu(pdev, sglist, nents, direction);
 
 as appropriate.
 
@@ -562,7 +562,7 @@ Then, if you wish to let the device get at the DMA area again,
 finish accessing the data with the cpu, and then before actually
 giving the buffer to the hardware call either:
 
-        pci_dma_sync_single_for_device(dev, dma_handle, size, direction);
+        pci_dma_sync_single_for_device(pdev, dma_handle, size, direction);
 
 or:
 
@@ -739,7 +739,7 @@ failure can be determined by:
 
         dma_addr_t dma_handle;
 
-        dma_handle = pci_map_single(dev, addr, size, direction);
+        dma_handle = pci_map_single(pdev, addr, size, direction);
         if (pci_dma_mapping_error(dma_handle)) {
                 /*
                  * reduce current DMA mapping usage,
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index 83966e94cc32..0eb0d027eb32 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -12,7 +12,7 @@ DOCBOOKS := wanbook.xml z8530book.xml mcabook.xml videobook.xml \
             kernel-api.xml filesystems.xml lsm.xml usb.xml kgdb.xml \
             gadget.xml libata.xml mtdnand.xml librs.xml rapidio.xml \
             genericirq.xml s390-drivers.xml uio-howto.xml scsi.xml \
-            mac80211.xml
+            mac80211.xml debugobjects.xml
 
 ###
 # The build process is as follows (targets):
diff --git a/Documentation/DocBook/debugobjects.tmpl b/Documentation/DocBook/debugobjects.tmpl
new file mode 100644
index 000000000000..7f5f218015fe
--- /dev/null
+++ b/Documentation/DocBook/debugobjects.tmpl
@@ -0,0 +1,391 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
+        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
+
+<book id="debug-objects-guide">
+ <bookinfo>
+  <title>Debug objects life time</title>
+
+  <authorgroup>
+   <author>
+    <firstname>Thomas</firstname>
+    <surname>Gleixner</surname>
+    <affiliation>
+     <address>
+      <email>tglx@linutronix.de</email>
+     </address>
+    </affiliation>
+   </author>
+  </authorgroup>
+
+  <copyright>
+   <year>2008</year>
+   <holder>Thomas Gleixner</holder>
+  </copyright>
+
+  <legalnotice>
+   <para>
+     This documentation is free software; you can redistribute
+     it and/or modify it under the terms of the GNU General Public
+     License version 2 as published by the Free Software Foundation.
+   </para>
+
+   <para>
+     This program is distributed in the hope that it will be
+     useful, but WITHOUT ANY WARRANTY; without even the implied
+     warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+     See the GNU General Public License for more details.
+   </para>
+
+   <para>
+     You should have received a copy of the GNU General Public
+     License along with this program; if not, write to the Free
+     Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+     MA 02111-1307 USA
+   </para>
+
+   <para>
+     For more details see the file COPYING in the source
+     distribution of Linux.
+   </para>
+  </legalnotice>
+ </bookinfo>
+
+<toc></toc>
+
+  <chapter id="intro">
+    <title>Introduction</title>
+    <para>
+      debugobjects is a generic infrastructure to track the life time
+      of kernel objects and validate the operations on those.
+    </para>
+    <para>
+      debugobjects is useful to check for the following error patterns:
+        <itemizedlist>
+          <listitem><para>Activation of uninitialized objects</para></listitem>
+          <listitem><para>Initialization of active objects</para></listitem>
+          <listitem><para>Usage of freed/destroyed objects</para></listitem>
+        </itemizedlist>
+    </para>
+    <para>
+      debugobjects is not changing the data structure of the real
+      object so it can be compiled in with a minimal runtime impact
+      and enabled on demand with a kernel command line option.
+    </para>
+  </chapter>
+
+  <chapter id="howto">
+    <title>Howto use debugobjects</title>
+    <para>
+      A kernel subsystem needs to provide a data structure which
+      describes the object type and add calls into the debug code at
+      appropriate places. The data structure to describe the object
+      type needs at minimum the name of the object type. Optional
+      functions can and should be provided to fixup detected problems
+      so the kernel can continue to work and the debug information can
+      be retrieved from a live system instead of hard core debugging
+      with serial consoles and stack trace transcripts from the
+      monitor.
+    </para>
+    <para>
+      The debug calls provided by debugobjects are:
+      <itemizedlist>
+        <listitem><para>debug_object_init</para></listitem>
+        <listitem><para>debug_object_init_on_stack</para></listitem>
+        <listitem><para>debug_object_activate</para></listitem>
+        <listitem><para>debug_object_deactivate</para></listitem>
+        <listitem><para>debug_object_destroy</para></listitem>
+        <listitem><para>debug_object_free</para></listitem>
+      </itemizedlist>
+      Each of these functions takes the address of the real object and
+      a pointer to the object type specific debug description
+      structure.
+    </para>
+    <para>
+      Each detected error is reported in the statistics and a limited
+      number of errors are printk'ed including a full stack trace.
+    </para>
+    <para>
+      The statistics are available via debugfs/debug_objects/stats.
+      They provide information about the number of warnings and the
+      number of successful fixups along with information about the
+      usage of the internal tracking objects and the state of the
+      internal tracking objects pool.
+    </para>
+  </chapter>
+  <chapter id="debugfunctions">
+    <title>Debug functions</title>
+    <sect1 id="prototypes">
+      <title>Debug object function reference</title>
+!Elib/debugobjects.c
+    </sect1>
+    <sect1 id="debug_object_init">
+      <title>debug_object_init</title>
+      <para>
+        This function is called whenever the initialization function
+        of a real object is called.
+      </para>
+      <para>
+        When the real object is already tracked by debugobjects it is
+        checked, whether the object can be initialized.  Initializing
+        is not allowed for active and destroyed objects. When
+        debugobjects detects an error, then it calls the fixup_init
+        function of the object type description structure if provided
+        by the caller. The fixup function can correct the problem
+        before the real initialization of the object happens. E.g. it
+        can deactivate an active object in order to prevent damage to
+        the subsystem.
+      </para>
+      <para>
+        When the real object is not yet tracked by debugobjects,
+        debugobjects allocates a tracker object for the real object
+        and sets the tracker object state to ODEBUG_STATE_INIT. It
+        verifies that the object is not on the callers stack. If it is
+        on the callers stack then a limited number of warnings
+        including a full stack trace is printk'ed. The calling code
+        must use debug_object_init_on_stack() and remove the object
+        before leaving the function which allocated it. See next
+        section.
+      </para>
+    </sect1>
+
+    <sect1 id="debug_object_init_on_stack">
+      <title>debug_object_init_on_stack</title>
+      <para>
+        This function is called whenever the initialization function
+        of a real object which resides on the stack is called.
+      </para>
+      <para>
+        When the real object is already tracked by debugobjects it is
+        checked, whether the object can be initialized. Initializing
+        is not allowed for active and destroyed objects. When
+        debugobjects detects an error, then it calls the fixup_init
+        function of the object type description structure if provided
+        by the caller. The fixup function can correct the problem
+        before the real initialization of the object happens. E.g. it
+        can deactivate an active object in order to prevent damage to
+        the subsystem.
+      </para>
+      <para>
+        When the real object is not yet tracked by debugobjects
+        debugobjects allocates a tracker object for the real object
+        and sets the tracker object state to ODEBUG_STATE_INIT. It
+        verifies that the object is on the callers stack.
+      </para>
+      <para>
+        An object which is on the stack must be removed from the
+        tracker by calling debug_object_free() before the function
+        which allocates the object returns. Otherwise we keep track of
+        stale objects.
+      </para>
+    </sect1>
+
+    <sect1 id="debug_object_activate">
+      <title>debug_object_activate</title>
+      <para>
+        This function is called whenever the activation function of a
+        real object is called.
+      </para>
+      <para>
+        When the real object is already tracked by debugobjects it is
+        checked, whether the object can be activated.  Activating is
+        not allowed for active and destroyed objects. When
+        debugobjects detects an error, then it calls the
+        fixup_activate function of the object type description
+        structure if provided by the caller. The fixup function can
+        correct the problem before the real activation of the object
+        happens. E.g. it can deactivate an active object in order to
+        prevent damage to the subsystem.
+      </para>
+      <para>
+        When the real object is not yet tracked by debugobjects then
+        the fixup_activate function is called if available. This is
+        necessary to allow the legitimate activation of statically
+        allocated and initialized objects. The fixup function checks
+        whether the object is valid and calls the debug_objects_init()
+        function to initialize the tracking of this object.
+      </para>
+      <para>
+        When the activation is legitimate, then the state of the
+        associated tracker object is set to ODEBUG_STATE_ACTIVE.
+      </para>
+    </sect1>
+
+    <sect1 id="debug_object_deactivate">
+      <title>debug_object_deactivate</title>
+      <para>
+        This function is called whenever the deactivation function of
+        a real object is called.
+      </para>
+      <para>
+        When the real object is tracked by debugobjects it is checked,
+        whether the object can be deactivated. Deactivating is not
+        allowed for untracked or destroyed objects.
+      </para>
+      <para>
+        When the deactivation is legitimate, then the state of the
+        associated tracker object is set to ODEBUG_STATE_INACTIVE.
+      </para>
+    </sect1>
+
+    <sect1 id="debug_object_destroy">
+      <title>debug_object_destroy</title>
+      <para>
+        This function is called to mark an object destroyed. This is
+        useful to prevent the usage of invalid objects, which are
+        still available in memory: either statically allocated objects
+        or objects which are freed later.
+      </para>
+      <para>
+        When the real object is tracked by debugobjects it is checked,
+        whether the object can be destroyed. Destruction is not
+        allowed for active and destroyed objects. When debugobjects
+        detects an error, then it calls the fixup_destroy function of
+        the object type description structure if provided by the
+        caller. The fixup function can correct the problem before the
+        real destruction of the object happens. E.g. it can deactivate
+        an active object in order to prevent damage to the subsystem.
+      </para>
+      <para>
+        When the destruction is legitimate, then the state of the
+        associated tracker object is set to ODEBUG_STATE_DESTROYED.
+      </para>
+    </sect1>
+
+    <sect1 id="debug_object_free">
+      <title>debug_object_free</title>
+      <para>
+        This function is called before an object is freed.
+      </para>
+      <para>
+        When the real object is tracked by debugobjects it is checked,
+        whether the object can be freed. Free is not allowed for
+        active objects. When debugobjects detects an error, then it
+        calls the fixup_free function of the object type description
+        structure if provided by the caller. The fixup function can
+        correct the problem before the real free of the object
+        happens. E.g. it can deactivate an active object in order to
+        prevent damage to the subsystem.
+      </para>
+      <para>
+        Note that debug_object_free removes the object from the
+        tracker. Later usage of the object is detected by the other
+        debug checks.
+      </para>
+    </sect1>
+  </chapter>
+  <chapter id="fixupfunctions">
+    <title>Fixup functions</title>
+    <sect1 id="debug_obj_descr">
+      <title>Debug object type description structure</title>
+!Iinclude/linux/debugobjects.h
+    </sect1>
+    <sect1 id="fixup_init">
+      <title>fixup_init</title>
+      <para>
+        This function is called from the debug code whenever a problem
+        in debug_object_init is detected. The function takes the
+        address of the object and the state which is currently
+        recorded in the tracker.
+      </para>
+      <para>
+        Called from debug_object_init when the object state is:
+        <itemizedlist>
+          <listitem><para>ODEBUG_STATE_ACTIVE</para></listitem>
+        </itemizedlist>
+      </para>
+      <para>
+        The function returns 1 when the fixup was successful,
+        otherwise 0. The return value is used to update the
+        statistics.
+      </para>
+      <para>
+        Note, that the function needs to call the debug_object_init()
+        function again, after the damage has been repaired in order to
+        keep the state consistent.
+      </para>
+    </sect1>
+
+    <sect1 id="fixup_activate">
+      <title>fixup_activate</title>
+      <para>
+        This function is called from the debug code whenever a problem
+        in debug_object_activate is detected.
+      </para>
+      <para>
+        Called from debug_object_activate when the object state is:
+        <itemizedlist>
+          <listitem><para>ODEBUG_STATE_NOTAVAILABLE</para></listitem>
+          <listitem><para>ODEBUG_STATE_ACTIVE</para></listitem>
+        </itemizedlist>
+      </para>
+      <para>
+        The function returns 1 when the fixup was successful,
+        otherwise 0. The return value is used to update the
+        statistics.
+      </para>
+      <para>
+        Note that the function needs to call the debug_object_activate()
+        function again after the damage has been repaired in order to
+        keep the state consistent.
+      </para>
+      <para>
+        The activation of statically initialized objects is a special
+        case. When debug_object_activate() has no tracked object for
+        this object address then fixup_activate() is called with
+        object state ODEBUG_STATE_NOTAVAILABLE. The fixup function
+        needs to check whether this is a legitimate case of a
+        statically initialized object or not. In case it is it calls
+        debug_object_init() and debug_object_activate() to make the
+        object known to the tracker and marked active. In this case
+        the function should return 0 because this is not a real fixup.
+      </para>
+    </sect1>
+
+    <sect1 id="fixup_destroy">
+      <title>fixup_destroy</title>
+      <para>
+        This function is called from the debug code whenever a problem
+        in debug_object_destroy is detected.
+      </para>
+      <para>
+        Called from debug_object_destroy when the object state is:
+        <itemizedlist>
+          <listitem><para>ODEBUG_STATE_ACTIVE</para></listitem>
+        </itemizedlist>
+      </para>
+      <para>
+        The function returns 1 when the fixup was successful,
+        otherwise 0. The return value is used to update the
+        statistics.
+      </para>
+    </sect1>
+    <sect1 id="fixup_free">
+      <title>fixup_free</title>
+      <para>
+        This function is called from the debug code whenever a problem
+        in debug_object_free is detected. Further it can be called
+        from the debug checks in kfree/vfree, when an active object is
+        detected from the debug_check_no_obj_freed() sanity checks.
+      </para>
+      <para>
+        Called from debug_object_free() or debug_check_no_obj_freed()
+        when the object state is:
+        <itemizedlist>
+          <listitem><para>ODEBUG_STATE_ACTIVE</para></listitem>
+        </itemizedlist>
+      </para>
+      <para>
+        The function returns 1 when the fixup was successful,
+        otherwise 0. The return value is used to update the
+        statistics.
+      </para>
+    </sect1>
+  </chapter>
+  <chapter id="bugs">
+    <title>Known Bugs And Assumptions</title>
+    <para>
+        None (knock on wood).
+    </para>
+  </chapter>
+</book>
diff --git a/Documentation/DocBook/rapidio.tmpl b/Documentation/DocBook/rapidio.tmpl
index b9e143e28c64..54eb26b57372 100644
--- a/Documentation/DocBook/rapidio.tmpl
+++ b/Documentation/DocBook/rapidio.tmpl
@@ -133,7 +133,6 @@
 !Idrivers/rapidio/rio-sysfs.c
      </sect1>
      <sect1 id="PPC32_support"><title>PPC32 support</title>
-!Iarch/powerpc/kernel/rio.c
 !Earch/powerpc/sysdev/fsl_rio.c
 !Iarch/powerpc/sysdev/fsl_rio.c
      </sect1>
diff --git a/Documentation/braille-console.txt b/Documentation/braille-console.txt
new file mode 100644
index 000000000000..000b0fbdc105
--- /dev/null
+++ b/Documentation/braille-console.txt
@@ -0,0 +1,34 @@
+                       Linux Braille Console
+
+To get early boot messages on a braille device (before userspace screen
+readers can start), you first need to compile the support for the usual serial
+console (see serial-console.txt), and for braille device (in Device Drivers -
+Accessibility).
+
+Then you need to specify a console=brl, option on the kernel command line, the
+format is:
+
+        console=brl,serial_options...
+
+where serial_options... are the same as described in serial-console.txt
+
+So for instance you can use console=brl,ttyS0 if the braille device is connected
+to the first serial port, and console=brl,ttyS0,115200 to override the baud rate
+to 115200, etc.
+
+By default, the braille device will just show the last kernel message (console
+mode).  To review previous messages, press the Insert key to switch to the VT
+review mode.  In review mode, the arrow keys permit to browse in the VT content,
+page up/down keys go at the top/bottom of the screen, and the home key goes back
+to the cursor, hence providing very basic screen reviewing facility.
+
+Sound feedback can be obtained by adding the braille_console.sound=1 kernel
+parameter.
+
+For simplicity, only one braille console can be enabled, other uses of
+console=brl,... will be discarded.  Also note that it does not interfere with
+the console selection mecanism described in serial-console.txt
+
+For now, only the VisioBraille device is supported.
+
+Samuel Thibault <samuel.thibault@ens-lyon.org>
diff --git a/Documentation/cgroups.txt b/Documentation/cgroups.txt
index 31d12e21ff8a..c298a6690e0d 100644
--- a/Documentation/cgroups.txt
+++ b/Documentation/cgroups.txt
@@ -500,8 +500,7 @@ post-attachment activity that requires memory allocations or blocking.
 
 void fork(struct cgroup_subsy *ss, struct task_struct *task)
 
-Called when a task is forked into a cgroup. Also called during
-registration for all existing tasks.
+Called when a task is forked into a cgroup.
 
 void exit(struct cgroup_subsys *ss, struct task_struct *task)
 
diff --git a/Documentation/controllers/devices.txt b/Documentation/controllers/devices.txt
new file mode 100644
index 000000000000..4dcea42432c2
--- /dev/null
+++ b/Documentation/controllers/devices.txt
@@ -0,0 +1,48 @@
+Device Whitelist Controller
+
+1. Description:
+
+Implement a cgroup to track and enforce open and mknod restrictions
+on device files.  A device cgroup associates a device access
+whitelist with each cgroup.  A whitelist entry has 4 fields.
+'type' is a (all), c (char), or b (block).  'all' means it applies
+to all types and all major and minor numbers.  Major and minor are
+either an integer or * for all.  Access is a composition of r
+(read), w (write), and m (mknod).
+
+The root device cgroup starts with rwm to 'all'.  A child device
+cgroup gets a copy of the parent.  Administrators can then remove
+devices from the whitelist or add new entries.  A child cgroup can
+never receive a device access which is denied its parent.  However
+when a device access is removed from a parent it will not also be
+removed from the child(ren).
+
+2. User Interface
+
+An entry is added using devices.allow, and removed using
+devices.deny.  For instance
+
+        echo 'c 1:3 mr' > /cgroups/1/devices.allow
+
+allows cgroup 1 to read and mknod the device usually known as
+/dev/null.  Doing
+
+        echo a > /cgroups/1/devices.deny
+
+will remove the default 'a *:* mrw' entry.
+
+3. Security
+
+Any task can move itself between cgroups.  This clearly won't
+suffice, but we can decide the best way to adequately restrict
+movement as people get some experience with this.  We may just want
+to require CAP_SYS_ADMIN, which at least is a separate bit from
+CAP_MKNOD.  We may want to just refuse moving to a cgroup which
+isn't a descendent of the current one.  Or we may want to use
+CAP_MAC_ADMIN, since we really are trying to lock down root.
+
+CAP_SYS_ADMIN is needed to modify the whitelist or move another
+task to a new cgroup.  (Again we'll probably want to change that).
+
+A cgroup may not be granted more permissions than the cgroup's
+parent has.
diff --git a/Documentation/controllers/resource_counter.txt b/Documentation/controllers/resource_counter.txt
new file mode 100644
index 000000000000..f196ac1d7d25
--- /dev/null
+++ b/Documentation/controllers/resource_counter.txt
@@ -0,0 +1,181 @@
+
+                The Resource Counter
+
+The resource counter, declared at include/linux/res_counter.h,
+is supposed to facilitate the resource management by controllers
+by providing common stuff for accounting.
+
+This "stuff" includes the res_counter structure and routines
+to work with it.
+
+
+
+1. Crucial parts of the res_counter structure
+
+ a. unsigned long long usage
+
+        The usage value shows the amount of a resource that is consumed
+        by a group at a given time. The units of measurement should be
+        determined by the controller that uses this counter. E.g. it can
+        be bytes, items or any other unit the controller operates on.
+
+ b. unsigned long long max_usage
+
+        The maximal value of the usage over time.
+
+        This value is useful when gathering statistical information about
+        the particular group, as it shows the actual resource requirements
+        for a particular group, not just some usage snapshot.
+
+ c. unsigned long long limit
+
+        The maximal allowed amount of resource to consume by the group. In
+        case the group requests for more resources, so that the usage value
+        would exceed the limit, the resource allocation is rejected (see
+        the next section).
+
+ d. unsigned long long failcnt
+
+        The failcnt stands for "failures counter". This is the number of
+        resource allocation attempts that failed.
+
+ c. spinlock_t lock
+
+        Protects changes of the above values.
+
+
+
+2. Basic accounting routines
+
+ a. void res_counter_init(struct res_counter *rc)
+
+        Initializes the resource counter. As usual, should be the first
+        routine called for a new counter.
+
+ b. int res_counter_charge[_locked]
+                        (struct res_counter *rc, unsigned long val)
+
+        When a resource is about to be allocated it has to be accounted
+        with the appropriate resource counter (controller should determine
+        which one to use on its own). This operation is called "charging".
+
+        This is not very important which operation - resource allocation
+        or charging - is performed first, but
+          * if the allocation is performed first, this may create a
+            temporary resource over-usage by the time resource counter is
+            charged;
+          * if the charging is performed first, then it should be uncharged
+            on error path (if the one is called).
+
+ c. void res_counter_uncharge[_locked]
+                        (struct res_counter *rc, unsigned long val)
+
+        When a resource is released (freed) it should be de-accounted
+        from the resource counter it was accounted to.  This is called
+        "uncharging".
+
+    The _locked routines imply that the res_counter->lock is taken.
+
+
+ 2.1 Other accounting routines
+
+    There are more routines that may help you with common needs, like
+    checking whether the limit is reached or resetting the max_usage
+    value. They are all declared in include/linux/res_counter.h.
+
+
+
+3. Analyzing the resource counter registrations
+
+ a. If the failcnt value constantly grows, this means that the counter's
+    limit is too tight. Either the group is misbehaving and consumes too
+    many resources, or the configuration is not suitable for the group
+    and the limit should be increased.
+
+ b. The max_usage value can be used to quickly tune the group. One may
+    set the limits to maximal values and either load the container with
+    a common pattern or leave one for a while. After this the max_usage
+    value shows the amount of memory the container would require during
+    its common activity.
+
+    Setting the limit a bit above this value gives a pretty good
+    configuration that works in most of the cases.
+
+ c. If the max_usage is much less than the limit, but the failcnt value
+    is growing, then the group tries to allocate a big chunk of resource
+    at once.
+
+ d. If the max_usage is much less than the limit, but the failcnt value
+    is 0, then this group is given too high limit, that it does not
+    require. It is better to lower the limit a bit leaving more resource
+    for other groups.
+
+
+
+4. Communication with the control groups subsystem (cgroups)
+
+All the resource controllers that are using cgroups and resource counters
+should provide files (in the cgroup filesystem) to work with the resource
+counter fields. They are recommended to adhere to the following rules:
+
+ a. File names
+
+        Field name      File name
+        ---------------------------------------------------
+        usage           usage_in_<unit_of_measurement>
+        max_usage       max_usage_in_<unit_of_measurement>
+        limit           limit_in_<unit_of_measurement>
+        failcnt         failcnt
+        lock            no file :)
+
+ b. Reading from file should show the corresponding field value in the
+    appropriate format.
+
+ c. Writing to file
+
+        Field           Expected behavior
+        ----------------------------------
+        usage           prohibited
+        max_usage       reset to usage
+        limit           set the limit
+        failcnt         reset to zero
+
+
+
+5. Usage example
+
+ a. Declare a task group (take a look at cgroups subsystem for this) and
+    fold a res_counter into it
+
+        struct my_group {
+                struct res_counter res;
+
+                <other fields>
+        }
+
+ b. Put hooks in resource allocation/release paths
+
+        int alloc_something(...)
+        {
+                if (res_counter_charge(res_counter_ptr, amount) < 0)
+                        return -ENOMEM;
+
+                <allocate the resource and return to the caller>
+        }
+
+        void release_something(...)
+        {
+                res_counter_uncharge(res_counter_ptr, amount);
+
+                <release the resource>
+        }
+
+    In order to keep the usage value self-consistent, both the
+    "res_counter_ptr" and the "amount" in release_something() should be
+    the same as they were in the alloc_something() when the releasing
+    resource was allocated.
+
+ c. Provide the way to read res_counter values and set them (the cgroups
+    still can help with it).
+
+ c. Compile and run :)
diff --git a/Documentation/cpu-freq/user-guide.txt b/Documentation/cpu-freq/user-guide.txt
index af3b925ece08..6c442d8426b5 100644
--- a/Documentation/cpu-freq/user-guide.txt
+++ b/Documentation/cpu-freq/user-guide.txt
@@ -154,6 +154,11 @@ scaling_governor,		and by "echoing" the name of another
                                 that some governors won't load - they only
                                 work on some specific architectures or
                                 processors.
+
+cpuinfo_cur_freq :              Current speed of the CPU, in KHz.
+
+scaling_available_frequencies : List of available frequencies, in KHz.
+
 scaling_min_freq and
 scaling_max_freq                show the current "policy limits" (in
                                 kHz). By echoing new values into these
@@ -162,6 +167,15 @@ scaling_max_freq		show the current "policy limits" (in
                                 first set scaling_max_freq, then
                                 scaling_min_freq.
 
+affected_cpus :                 List of CPUs that require software coordination
+                                of frequency.
+
+related_cpus :                  List of CPUs that need some sort of frequency
+                                coordination, whether software or hardware.
+
+scaling_driver :                Hardware driver for cpufreq.
+
+scaling_cur_freq :              Current frequency of the CPU, in KHz.
 
 If you have selected the "userspace" governor which allows you to
 set the CPU operating frequency to a specific value, you can read out
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index aa854b9b18cd..fb7b361e6eea 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -171,6 +171,7 @@ files describing that cpuset:
  - memory_migrate flag: if set, move pages to cpusets nodes
  - cpu_exclusive flag: is cpu placement exclusive?
  - mem_exclusive flag: is memory placement exclusive?
+ - mem_hardwall flag:  is memory allocation hardwalled
  - memory_pressure: measure of how much paging pressure in cpuset
 
 In addition, the root cpuset only has the following file:
@@ -222,17 +223,18 @@ If a cpuset is cpu or mem exclusive, no other cpuset, other than
 a direct ancestor or descendent, may share any of the same CPUs or
 Memory Nodes.
 
-A cpuset that is mem_exclusive restricts kernel allocations for
-page, buffer and other data commonly shared by the kernel across
-multiple users.  All cpusets, whether mem_exclusive or not, restrict
-allocations of memory for user space.  This enables configuring a
-system so that several independent jobs can share common kernel data,
-such as file system pages, while isolating each jobs user allocation in
-its own cpuset.  To do this, construct a large mem_exclusive cpuset to
-hold all the jobs, and construct child, non-mem_exclusive cpusets for
-each individual job.  Only a small amount of typical kernel memory,
-such as requests from interrupt handlers, is allowed to be taken
-outside even a mem_exclusive cpuset.
+A cpuset that is mem_exclusive *or* mem_hardwall is "hardwalled",
+i.e. it restricts kernel allocations for page, buffer and other data
+commonly shared by the kernel across multiple users.  All cpusets,
+whether hardwalled or not, restrict allocations of memory for user
+space.  This enables configuring a system so that several independent
+jobs can share common kernel data, such as file system pages, while
+isolating each job's user allocation in its own cpuset.  To do this,
+construct a large mem_exclusive cpuset to hold all the jobs, and
+construct child, non-mem_exclusive cpusets for each individual job.
+Only a small amount of typical kernel memory, such as requests from
+interrupt handlers, is allowed to be taken outside even a
+mem_exclusive cpuset.
 
 
 1.5 What is memory_pressure ?
@@ -707,7 +709,7 @@ Now you want to do something with this cpuset.
 
 In this directory you can find several files:
 # ls
-cpus  cpu_exclusive  mems  mem_exclusive  tasks
+cpus  cpu_exclusive  mems  mem_exclusive mem_hardwall  tasks
 
 Reading them will give you information about the state of this cpuset:
 the CPUs and Memory Nodes it can use, the processes that are using
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 599fe55bf297..3c35d452b1a9 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -138,6 +138,24 @@ Who:	Kay Sievers <kay.sievers@suse.de>
 
 ---------------------------
 
+What:   find_task_by_pid
+When:   2.6.26
+Why:    With pid namespaces, calling this funciton will return the
+        wrong task when called from inside a namespace.
+
+        The best way to save a task pid and find a task by this
+        pid later, is to find this task's struct pid pointer (or get
+        it directly from the task) and call pid_task() later.
+
+        If someone really needs to get a task by its pid_t, then
+        he most likely needs the find_task_by_vpid() to get the
+        task from the same namespace as the current task is in, but
+        this may be not so in general.
+
+Who:    Pavel Emelyanov <xemul@openvz.org>
+
+---------------------------
+
 What:   ACPI procfs interface
 When:   July 2008
 Why:    ACPI sysfs conversion should be finished by January 2008.
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 2a99116edc47..dbc3c6a3650f 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -463,11 +463,17 @@ SwapTotal:           0 kB
 SwapFree:            0 kB
 Dirty:             968 kB
 Writeback:           0 kB
+AnonPages:      861800 kB
 Mapped:         280372 kB
-Slab:           684068 kB
+Slab:           284364 kB
+SReclaimable:   159856 kB
+SUnreclaim:     124508 kB
+PageTables:      24448 kB
+NFS_Unstable:        0 kB
+Bounce:              0 kB
+WritebackTmp:        0 kB
 CommitLimit:   7669796 kB
 Committed_AS:   100056 kB
-PageTables:      24448 kB
 VmallocTotal:   112216 kB
 VmallocUsed:       428 kB
 VmallocChunk:   111088 kB
@@ -503,8 +509,17 @@ VmallocChunk:   111088 kB
               on the disk
        Dirty: Memory which is waiting to get written back to the disk
    Writeback: Memory which is actively being written back to the disk
+   AnonPages: Non-file backed pages mapped into userspace page tables
       Mapped: files which have been mmaped, such as libraries
         Slab: in-kernel data structures cache
+SReclaimable: Part of Slab, that might be reclaimed, such as caches
+  SUnreclaim: Part of Slab, that cannot be reclaimed on memory pressure
+  PageTables: amount of memory dedicated to the lowest level of page
+              tables.
+NFS_Unstable: NFS pages sent to the server, but not yet committed to stable
+              storage
+      Bounce: Memory used for block device "bounce buffers"
+WritebackTmp: Memory used by FUSE for temporary writeback buffers
  CommitLimit: Based on the overcommit ratio ('vm.overcommit_ratio'),
               this is the total amount of  memory currently available to
               be allocated on the system. This limit is only adhered to
@@ -531,8 +546,6 @@ Committed_AS: The amount of memory presently allocated on the system.
               above) will not be permitted. This is useful if one needs
               to guarantee that processes will not fail due to lack of
               memory once that memory has been successfully allocated.
-  PageTables: amount of memory dedicated to the lowest level of page
-              tables.
 VmallocTotal: total size of vmalloc memory area
  VmallocUsed: amount of vmalloc area which is used
 VmallocChunk: largest contigious block of vmalloc area which is free
diff --git a/Documentation/i2c/writing-clients b/Documentation/i2c/writing-clients
index bfb0a5520817..ee75cbace28d 100644
--- a/Documentation/i2c/writing-clients
+++ b/Documentation/i2c/writing-clients
@@ -164,7 +164,8 @@ I2C device drivers using this binding model work just like any other
 kind of driver in Linux:  they provide a probe() method to bind to
 those devices, and a remove() method to unbind.
 
-        static int foo_probe(struct i2c_client *client);
+        static int foo_probe(struct i2c_client *client,
+                             const struct i2c_device_id *id);
         static int foo_remove(struct i2c_client *client);
 
 Remember that the i2c_driver does not create those client handles.  The
diff --git a/Documentation/i386/boot.txt b/Documentation/i386/boot.txt
index 0fac3465f2e3..95ad15c3b01f 100644
--- a/Documentation/i386/boot.txt
+++ b/Documentation/i386/boot.txt
@@ -40,9 +40,17 @@ Protocol 2.05:	(Kernel 2.6.20) Make protected mode kernel relocatable.
                 Introduce relocatable_kernel and kernel_alignment fields.
 
 Protocol 2.06:  (Kernel 2.6.22) Added a field that contains the size of
-                the boot command line
+                the boot command line.
 
-Protocol 2.09:  (kernel 2.6.26) Added a field of 64-bit physical
+Protocol 2.07:  (Kernel 2.6.24) Added paravirtualised boot protocol.
+                Introduced hardware_subarch and hardware_subarch_data
+                and KEEP_SEGMENTS flag in load_flags.
+
+Protocol 2.08:  (Kernel 2.6.26) Added crc32 checksum and ELF format
+                payload. Introduced payload_offset and payload length
+                fields to aid in locating the payload.
+
+Protocol 2.09:  (Kernel 2.6.26) Added a field of 64-bit physical
                 pointer to single linked list of struct setup_data.
 
 **** MEMORY LAYOUT
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e5f3d918316f..a3c35446e755 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -496,6 +496,11 @@ and is between 256 and 4096 characters. It is defined in the file
                         switching to the matching ttyS device later.  The
                         options are the same as for ttyS, above.
 
+                If the device connected to the port is not a TTY but a braille
+                device, prepend "brl," before the device type, for instance
+                        console=brl,ttyS0
+                For now, only VisioBraille is supported.
+
         earlycon=       [KNL] Output early console device and options.
                 uart[8250],io,<addr>[,options]
                 uart[8250],mmio,<addr>[,options]
@@ -556,6 +561,8 @@ and is between 256 and 4096 characters. It is defined in the file
                         1 will print _a lot_ more information - normally
                         only useful to kernel developers.
 
+        debug_objects   [KNL] Enable object debugging
+
         decnet.addr=    [HW,NET]
                         Format: <area>[,<node>]
                         See also Documentation/networking/decnet.txt.
@@ -627,8 +634,7 @@ and is between 256 and 4096 characters. It is defined in the file
         eata=           [HW,SCSI]
 
         edd=            [EDD]
-                        Format: {"of[f]" | "sk[ipmbr]"}
-                        See comment in arch/i386/boot/edd.S
+                        Format: {"off" | "on" | "skip[mbr]"}
 
         eisa_irq_edge=  [PARISC,HW]
                         See header of drivers/parisc/eisa.c.
@@ -1389,6 +1395,13 @@ and is between 256 and 4096 characters. It is defined in the file
 
         nr_uarts=       [SERIAL] maximum number of UARTs to be registered.
 
+        olpc_ec_timeout= [OLPC] ms delay when issuing EC commands
+                        Rather than timing out after 20 ms if an EC
+                        command is not properly ACKed, override the length
+                        of the timeout.  We have interrupts disabled while
+                        waiting for the ACK, so if this is set too high
+                        interrupts *may* be lost!
+
         opl3=           [HW,OSS]
                         Format: <io>
 
diff --git a/Documentation/keys-request-key.txt b/Documentation/keys-request-key.txt
index 266955d23ee6..09b55e461740 100644
--- a/Documentation/keys-request-key.txt
+++ b/Documentation/keys-request-key.txt
@@ -11,26 +11,29 @@ request_key*():
 
         struct key *request_key(const struct key_type *type,
                                 const char *description,
-                                const char *callout_string);
+                                const char *callout_info);
 
 or:
 
         struct key *request_key_with_auxdata(const struct key_type *type,
                                              const char *description,
-                                             const char *callout_string,
+                                             const char *callout_info,
+                                             size_t callout_len,
                                              void *aux);
 
 or:
 
         struct key *request_key_async(const struct key_type *type,
                                       const char *description,
-                                      const char *callout_string);
+                                      const char *callout_info,
+                                      size_t callout_len);
 
 or:
 
         struct key *request_key_async_with_auxdata(const struct key_type *type,
                                                    const char *description,
-                                                   const char *callout_string,
+                                                   const char *callout_info,
+                                                   size_t callout_len,
                                                    void *aux);
 
 Or by userspace invoking the request_key system call:
diff --git a/Documentation/keys.txt b/Documentation/keys.txt
index 51652d39e61c..d5c7a57d1700 100644
--- a/Documentation/keys.txt
+++ b/Documentation/keys.txt
@@ -170,7 +170,8 @@ The key service provides a number of features besides keys:
      amount of description and payload space that can be consumed.
 
      The user can view information on this and other statistics through procfs
-     files.
+     files.  The root user may also alter the quota limits through sysctl files
+     (see the section "New procfs files").
 
      Process-specific and thread-specific keyrings are not counted towards a
      user's quota.
@@ -329,6 +330,27 @@ about the status of the key service:
         <bytes>/<max>           Key size quota
 
 
+Four new sysctl files have been added also for the purpose of controlling the
+quota limits on keys:
+
+ (*) /proc/sys/kernel/keys/root_maxkeys
+     /proc/sys/kernel/keys/root_maxbytes
+
+     These files hold the maximum number of keys that root may have and the
+     maximum total number of bytes of data that root may have stored in those
+     keys.
+
+ (*) /proc/sys/kernel/keys/maxkeys
+     /proc/sys/kernel/keys/maxbytes
+
+     These files hold the maximum number of keys that each non-root user may
+     have and the maximum total number of bytes of data that each of those
+     users may have stored in their keys.
+
+Root may alter these by writing each new limit as a decimal number string to
+the appropriate file.
+
+
 ===============================
 USERSPACE SYSTEM CALL INTERFACE
 ===============================
@@ -711,6 +733,27 @@ The keyctl syscall functions are:
      The assumed authoritative key is inherited across fork and exec.
 
 
+ (*) Get the LSM security context attached to a key.
+
+        long keyctl(KEYCTL_GET_SECURITY, key_serial_t key, char *buffer,
+                    size_t buflen)
+
+     This function returns a string that represents the LSM security context
+     attached to a key in the buffer provided.
+
+     Unless there's an error, it always returns the amount of data it could
+     produce, even if that's too big for the buffer, but it won't copy more
+     than requested to userspace. If the buffer pointer is NULL then no copy
+     will take place.
+
+     A NUL character is included at the end of the string if the buffer is
+     sufficiently big.  This is included in the returned count.  If no LSM is
+     in force then an empty string will be returned.
+
+     A process must have view permission on the key for this function to be
+     successful.
+
+
 ===============
 KERNEL SERVICES
 ===============
@@ -771,7 +814,7 @@ payload contents" for more information.
 
         struct key *request_key(const struct key_type *type,
                                 const char *description,
-                                const char *callout_string);
+                                const char *callout_info);
 
     This is used to request a key or keyring with a description that matches
     the description specified according to the key type's match function. This
@@ -793,24 +836,28 @@ payload contents" for more information.
 
         struct key *request_key_with_auxdata(const struct key_type *type,
                                              const char *description,
-                                             const char *callout_string,
+                                             const void *callout_info,
+                                             size_t callout_len,
                                              void *aux);
 
     This is identical to request_key(), except that the auxiliary data is
-    passed to the key_type->request_key() op if it exists.
+    passed to the key_type->request_key() op if it exists, and the callout_info
+    is a blob of length callout_len, if given (the length may be 0).
 
 
 (*) A key can be requested asynchronously by calling one of:
 
         struct key *request_key_async(const struct key_type *type,
                                       const char *description,
-                                      const char *callout_string);
+                                      const void *callout_info,
+                                      size_t callout_len);
 
     or:
 
         struct key *request_key_async_with_auxdata(const struct key_type *type,
                                                    const char *description,
-                                                   const char *callout_string,
+                                                   const char *callout_info,
+                                                   size_t callout_len,
                                                    void *aux);
 
     which are asynchronous equivalents of request_key() and
diff --git a/Documentation/oops-tracing.txt b/Documentation/oops-tracing.txt
index 7f60dfe642ca..b152e81da592 100644
--- a/Documentation/oops-tracing.txt
+++ b/Documentation/oops-tracing.txt
@@ -253,6 +253,10 @@ characters, each representing a particular tainted value.
 
   8: 'D' if the kernel has died recently, i.e. there was an OOPS or BUG.
 
+  9: 'A' if the ACPI table has been overridden.
+
+ 10: 'W' if a warning has previously been issued by the kernel.
+
 The primary reason for the 'Tainted: ' string is to tell kernel
 debuggers if this is a clean kernel or if anything unusual has
 occurred.  Tainting is permanent: even if an offending module is
diff --git a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
index 5e03610e186f..cda7a7dffa6d 100644
--- a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
+++ b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
@@ -186,6 +186,12 @@ Recommended soc5200 child nodes; populate as needed for your board
 name            device_type     compatible        Description
 ----            -----------     ----------        -----------
 gpt@<addr>      gpt             fsl,mpc5200-gpt   General purpose timers
+gpt@<addr>      gpt             fsl,mpc5200-gpt-gpio    General purpose
+                                                        timers in GPIO mode
+gpio@<addr>                     fsl,mpc5200-gpio        MPC5200 simple gpio
+                                                        controller
+gpio@<addr>                     fsl,mpc5200-gpio-wkup   MPC5200 wakeup gpio
+                                                        controller
 rtc@<addr>      rtc             mpc5200-rtc       Real time clock
 mscan@<addr>    mscan           mpc5200-mscan     CAN bus controller
 pci@<addr>      pci             mpc5200-pci       PCI bridge
@@ -225,6 +231,12 @@ PSC in i2s mode:  The mpc5200 and mpc5200b PSCs are not compatible when in
 i2s mode.  An 'mpc5200b-psc-i2s' node cannot include 'mpc5200-psc-i2s' in the
 compatible field.
 
+7) GPIO controller nodes
+Each GPIO controller node should have the empty property gpio-controller and
+#gpio-cells set to 2. First cell is the GPIO number which is interpreted
+according to the bit numbers in the GPIO control registers. The second cell
+is for flags which is currently unsused.
+
 IV - Extra Notes
 ================
 
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index fd4c32a031c9..0bbee38acd26 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -795,6 +795,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           lg-lw         LG LW20/LW25 laptop
           tcl           TCL S700
           clevo         Clevo laptops (m520G, m665n)
+          medion        Medion Rim 2150
           test          for testing/debugging purpose, almost all controls can be
                         adjusted.  Appearing only when compiled with
                         $CONFIG_SND_DEBUG=y
diff --git a/Documentation/sysrq.txt b/Documentation/sysrq.txt
index 10c8f6922ef4..5ce0952aa065 100644
--- a/Documentation/sysrq.txt
+++ b/Documentation/sysrq.txt
@@ -85,6 +85,8 @@ On all -  write a character to /proc/sysrq-trigger.  e.g.:
 'k'     - Secure Access Key (SAK) Kills all programs on the current virtual
           console. NOTE: See important comments below in SAK section.
 
+'l'     - Shows a stack backtrace for all active CPUs.
+
 'm'     - Will dump current memory info to your console.
 
 'n'     - Used to make RT tasks nice-able
diff --git a/Documentation/video4linux/CARDLIST.saa7134 b/Documentation/video4linux/CARDLIST.saa7134
index 44d84dd15ad6..67937df1e974 100644
--- a/Documentation/video4linux/CARDLIST.saa7134
+++ b/Documentation/video4linux/CARDLIST.saa7134
@@ -128,7 +128,7 @@
 127 -> Beholder BeholdTV 507 FM/RDS / BeholdTV 509 FM [0000:5071,0000:507B,5ace:5070,5ace:5090]
 128 -> Beholder BeholdTV Columbus TVFM          [0000:5201]
 129 -> Beholder BeholdTV 607 / BeholdTV 609     [5ace:6070,5ace:6071,5ace:6072,5ace:6073,5ace:6090,5ace:6091,5ace:6092,5ace:6093]
-130 -> Beholder BeholdTV M6 / BeholdTV M6 Extra [5ace:6190,5ace:6193]
+130 -> Beholder BeholdTV M6 / BeholdTV M6 Extra [5ace:6190,5ace:6193,5ace:6191]
 131 -> Twinhan Hybrid DTV-DVB 3056 PCI          [1822:0022]
 132 -> Genius TVGO AM11MCE
 133 -> NXP Snake DVB-S reference design
@@ -140,3 +140,4 @@
 139 -> Compro VideoMate T750                    [185b:c900]
 140 -> Avermedia DVB-S Pro A700                 [1461:a7a1]
 141 -> Avermedia DVB-S Hybrid+FM A700           [1461:a7a2]
+142 -> Beholder BeholdTV H6                     [5ace:6290]
diff --git a/Documentation/video4linux/cx18.txt b/Documentation/video4linux/cx18.txt
new file mode 100644
index 000000000000..077d56ec3f3d
--- /dev/null
+++ b/Documentation/video4linux/cx18.txt
@@ -0,0 +1,34 @@
+Some notes regarding the cx18 driver for the Conexant CX23418 MPEG
+encoder chip:
+
+1) The only hardware currently supported is the Hauppauge HVR-1600.
+
+2) Some people have problems getting the i2c bus to work. Cause unknown.
+   The symptom is that the eeprom cannot be read and the card is
+   unusable.
+
+3) The audio from the analog tuner is mono only. Probably caused by
+   incorrect audio register information in the datasheet. We are
+   waiting for updated information from Conexant.
+
+4) VBI (raw or sliced) has not yet been implemented.
+
+5) MPEG indexing is not yet implemented.
+
+6) The driver is still a bit rough around the edges, this should
+   improve over time.
+
+
+Firmware:
+
+The firmware needs to be extracted from the Windows Hauppauge HVR-1600
+driver, available here:
+
+http://hauppauge.lightpath.net/software/install_cd/hauppauge_cd_3.4d1.zip
+
+Unzip, then copy the following files to the firmware directory
+and rename them as follows:
+
+Drivers/Driver18/hcw18apu.rom -> v4l-cx23418-apu.fw
+Drivers/Driver18/hcw18enc.rom -> v4l-cx23418-cpu.fw
+Drivers/Driver18/hcw18mlC.rom -> v4l-cx23418-dig.fw