108 files changed, 2734 insertions, 986 deletions
diff --git a/Documentation/ABI/testing/sysfs-block b/Documentation/ABI/testing/sysfs-block
index 44f52a4f5903..cbbd3e069945 100644
--- a/Documentation/ABI/testing/sysfs-block
+++ b/Documentation/ABI/testing/sysfs-block
@@ -60,3 +60,62 @@ Description:
                Indicates whether the block layer should automatically
                generate checksums for write requests bound for
                devices that support receiving integrity metadata.
+What:           /sys/block/<disk>/alignment_offset
+Date:           April 2009
+Contact:        Martin K. Petersen <martin.petersen@oracle.com>
+Description:
+                Storage devices may report a physical block size that is
+                bigger than the logical block size (for instance a drive
+                with 4KB physical sectors exposing 512-byte logical
+                blocks to the operating system).  This parameter
+                indicates how many bytes the beginning of the device is
+                offset from the disk's natural alignment.
+What:           /sys/block/<disk>/<partition>/alignment_offset
+Date:           April 2009
+Contact:        Martin K. Petersen <martin.petersen@oracle.com>
+Description:
+                Storage devices may report a physical block size that is
+                bigger than the logical block size (for instance a drive
+                with 4KB physical sectors exposing 512-byte logical
+                blocks to the operating system).  This parameter
+                indicates how many bytes the beginning of the partition
+                is offset from the disk's natural alignment.
+What:           /sys/block/<disk>/queue/logical_block_size
+Date:           May 2009
+Contact:        Martin K. Petersen <martin.petersen@oracle.com>
+Description:
+                This is the smallest unit the storage device can
+                address.  It is typically 512 bytes.
+What:           /sys/block/<disk>/queue/physical_block_size
+Date:           May 2009
+Contact:        Martin K. Petersen <martin.petersen@oracle.com>
+Description:
+                This is the smallest unit the storage device can write
+                without resorting to read-modify-write operation.  It is
+                usually the same as the logical block size but may be
+                bigger.  One example is SATA drives with 4KB sectors
+                that expose a 512-byte logical block size to the
+                operating system.
+What:           /sys/block/<disk>/queue/minimum_io_size
+Date:           April 2009
+Contact:        Martin K. Petersen <martin.petersen@oracle.com>
+Description:
+                Storage devices may report a preferred minimum I/O size,
+                which is the smallest request the device can perform
+                without incurring a read-modify-write penalty.  For disk
+                drives this is often the physical block size.  For RAID
+                arrays it is often the stripe chunk size.
+What:           /sys/block/<disk>/queue/optimal_io_size
+Date:           April 2009
+Contact:        Martin K. Petersen <martin.petersen@oracle.com>
+Description:
+                Storage devices may report an optimal I/O size, which is
+                the device's preferred unit of receiving I/O.  This is
+                rarely reported for disk drives.  For RAID devices it is
+                usually the stripe width or the internal block size.
diff --git a/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss b/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss
new file mode 100644
index 000000000000..0a92a7c93a62
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss
@@ -0,0 +1,33 @@
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/model
+Date:           March 2009
+Kernel Version: 2.6.30
+Contact:        iss_storagedev@hp.com
+Description:    Displays the SCSI INQUIRY page 0 model for logical drive
+                Y of controller X.
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/rev
+Date:           March 2009
+Kernel Version: 2.6.30
+Contact:        iss_storagedev@hp.com
+Description:    Displays the SCSI INQUIRY page 0 revision for logical
+                drive Y of controller X.
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/unique_id
+Date:           March 2009
+Kernel Version: 2.6.30
+Contact:        iss_storagedev@hp.com
+Description:    Displays the SCSI INQUIRY page 83 serial number for logical
+                drive Y of controller X.
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/vendor
+Date:           March 2009
+Kernel Version: 2.6.30
+Contact:        iss_storagedev@hp.com
+Description:    Displays the SCSI INQUIRY page 0 vendor for logical drive
+                Y of controller X.
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/block:cciss!cXdY
+Date:           March 2009
+Kernel Version: 2.6.30
+Contact:        iss_storagedev@hp.com
+Description:    A symbolic link to /sys/block/cciss!cXdY
diff --git a/Documentation/ABI/testing/sysfs-devices-cache_disable b/Documentation/ABI/testing/sysfs-devices-cache_disable
new file mode 100644
index 000000000000..175bb4f70512
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-devices-cache_disable
@@ -0,0 +1,18 @@
+What:      /sys/devices/system/cpu/cpu*/cache/index*/cache_disable_X
+Date:      August 2008
+KernelVersion:  2.6.27
+Contact:        mark.langsdorf@amd.com
+Description:    These files exist in every cpu's cache index directories.
+                There are currently 2 cache_disable_# files in each
+                directory.  Reading from these files on a supported
+                processor will return that cache disable index value
+                for that processor and node.  Writing to one of these
+                files will cause the specificed cache index to be disabled.
+                Currently, only AMD Family 10h Processors support cache index
+                disable, and only for their L3 caches.  See the BIOS and
+                Kernel Developer's Guide at
+                http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/31116-Public-GH-BKDG_3.20_2-4-09.pdf
+                for formatting information and other details on the
+                cache index disable.
+Users:    joachim.deguara@amd.com
diff --git a/Documentation/ABI/testing/sysfs-kernel-slab b/Documentation/ABI/testing/sysfs-kernel-slab
new file mode 100644
index 000000000000..6dcf75e594fb
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-kernel-slab
@@ -0,0 +1,479 @@
+What:           /sys/kernel/slab
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The /sys/kernel/slab directory contains a snapshot of the
+                internal state of the SLUB allocator for each cache.  Certain
+                files may be modified to change the behavior of the cache (and
+                any cache it aliases, if any).
+Users:          kernel memory tuning tools
+What:           /sys/kernel/slab/cache/aliases
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The aliases file is read-only and specifies how many caches
+                have merged into this cache.
+What:           /sys/kernel/slab/cache/align
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The align file is read-only and specifies the cache's object
+                alignment in bytes.
+What:           /sys/kernel/slab/cache/alloc_calls
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The alloc_calls file is read-only and lists the kernel code
+                locations from which allocations for this cache were performed.
+                The alloc_calls file only contains information if debugging is
+                enabled for that cache (see Documentation/vm/slub.txt).
+What:           /sys/kernel/slab/cache/alloc_fastpath
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The alloc_fastpath file is read-only and specifies how many
+                objects have been allocated using the fast path.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/alloc_from_partial
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The alloc_from_partial file is read-only and specifies how
+                many times a cpu slab has been full and it has been refilled
+                by using a slab from the list of partially used slabs.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/alloc_refill
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The alloc_refill file is read-only and specifies how many
+                times the per-cpu freelist was empty but there were objects
+                available as the result of remote cpu frees.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/alloc_slab
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The alloc_slab file is read-only and specifies how many times
+                a new slab had to be allocated from the page allocator.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/alloc_slowpath
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The alloc_slowpath file is read-only and specifies how many
+                objects have been allocated using the slow path because of a
+                refill or allocation from a partial or new slab.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/cache_dma
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The cache_dma file is read-only and specifies whether objects
+                are from ZONE_DMA.
+                Available when CONFIG_ZONE_DMA is enabled.
+What:           /sys/kernel/slab/cache/cpu_slabs
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The cpu_slabs file is read-only and displays how many cpu slabs
+                are active and their NUMA locality.
+What:           /sys/kernel/slab/cache/cpuslab_flush
+Date:           April 2009
+KernelVersion:  2.6.31
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file cpuslab_flush is read-only and specifies how many
+                times a cache's cpu slabs have been flushed as the result of
+                destroying or shrinking a cache, a cpu going offline, or as
+                the result of forcing an allocation from a certain node.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/ctor
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The ctor file is read-only and specifies the cache's object
+                constructor function, which is invoked for each object when a
+                new slab is allocated.
+What:           /sys/kernel/slab/cache/deactivate_empty
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file deactivate_empty is read-only and specifies how many
+                times an empty cpu slab was deactivated.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/deactivate_full
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file deactivate_full is read-only and specifies how many
+                times a full cpu slab was deactivated.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/deactivate_remote_frees
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file deactivate_remote_frees is read-only and specifies how
+                many times a cpu slab has been deactivated and contained free
+                objects that were freed remotely.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/deactivate_to_head
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file deactivate_to_head is read-only and specifies how
+                many times a partial cpu slab was deactivated and added to the
+                head of its node's partial list.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/deactivate_to_tail
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file deactivate_to_tail is read-only and specifies how
+                many times a partial cpu slab was deactivated and added to the
+                tail of its node's partial list.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/destroy_by_rcu
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The destroy_by_rcu file is read-only and specifies whether
+                slabs (not objects) are freed by rcu.
+What:           /sys/kernel/slab/cache/free_add_partial
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file free_add_partial is read-only and specifies how many
+                times an object has been freed in a full slab so that it had to
+                added to its node's partial list.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/free_calls
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The free_calls file is read-only and lists the locations of
+                object frees if slab debugging is enabled (see
+                Documentation/vm/slub.txt).
+What:           /sys/kernel/slab/cache/free_fastpath
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The free_fastpath file is read-only and specifies how many
+                objects have been freed using the fast path because it was an
+                object from the cpu slab.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/free_frozen
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The free_frozen file is read-only and specifies how many
+                objects have been freed to a frozen slab (i.e. a remote cpu
+                slab).
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/free_remove_partial
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file free_remove_partial is read-only and specifies how
+                many times an object has been freed to a now-empty slab so
+                that it had to be removed from its node's partial list.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/free_slab
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The free_slab file is read-only and specifies how many times an
+                empty slab has been freed back to the page allocator.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/free_slowpath
+Date:           February 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The free_slowpath file is read-only and specifies how many
+                objects have been freed using the slow path (i.e. to a full or
+                partial slab).
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/hwcache_align
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The hwcache_align file is read-only and specifies whether
+                objects are aligned on cachelines.
+What:           /sys/kernel/slab/cache/min_partial
+Date:           February 2009
+KernelVersion:  2.6.30
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                David Rientjes <rientjes@google.com>
+Description:
+                The min_partial file specifies how many empty slabs shall
+                remain on a node's partial list to avoid the overhead of
+                allocating new slabs.  Such slabs may be reclaimed by utilizing
+                the shrink file.
+What:           /sys/kernel/slab/cache/object_size
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The object_size file is read-only and specifies the cache's
+                object size.
+What:           /sys/kernel/slab/cache/objects
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The objects file is read-only and displays how many objects are
+                active and from which nodes they are from.
+What:           /sys/kernel/slab/cache/objects_partial
+Date:           April 2008
+KernelVersion:  2.6.26
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The objects_partial file is read-only and displays how many
+                objects are on partial slabs and from which nodes they are
+                from.
+What:           /sys/kernel/slab/cache/objs_per_slab
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file objs_per_slab is read-only and specifies how many
+                objects may be allocated from a single slab of the order
+                specified in /sys/kernel/slab/cache/order.
+What:           /sys/kernel/slab/cache/order
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The order file specifies the page order at which new slabs are
+                allocated.  It is writable and can be changed to increase the
+                number of objects per slab.  If a slab cannot be allocated
+                because of fragmentation, SLUB will retry with the minimum order
+                possible depending on its characteristics.
+What:           /sys/kernel/slab/cache/order_fallback
+Date:           April 2008
+KernelVersion:  2.6.26
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file order_fallback is read-only and specifies how many
+                times an allocation of a new slab has not been possible at the
+                cache's order and instead fallen back to its minimum possible
+                order.
+                Available when CONFIG_SLUB_STATS is enabled.
+What:           /sys/kernel/slab/cache/partial
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The partial file is read-only and displays how long many
+                partial slabs there are and how long each node's list is.
+What:           /sys/kernel/slab/cache/poison
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The poison file specifies whether objects should be poisoned
+                when a new slab is allocated.
+What:           /sys/kernel/slab/cache/reclaim_account
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The reclaim_account file specifies whether the cache's objects
+                are reclaimable (and grouped by their mobility).
+What:           /sys/kernel/slab/cache/red_zone
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The red_zone file specifies whether the cache's objects are red
+                zoned.
+What:           /sys/kernel/slab/cache/remote_node_defrag_ratio
+Date:           January 2008
+KernelVersion:  2.6.25
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The file remote_node_defrag_ratio specifies the percentage of
+                times SLUB will attempt to refill the cpu slab with a partial
+                slab from a remote node as opposed to allocating a new slab on
+                the local node.  This reduces the amount of wasted memory over
+                the entire system but can be expensive.
+                Available when CONFIG_NUMA is enabled.
+What:           /sys/kernel/slab/cache/sanity_checks
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The sanity_checks file specifies whether expensive checks
+                should be performed on free and, at minimum, enables double free
+                checks.  Caches that enable sanity_checks cannot be merged with
+                caches that do not.
+What:           /sys/kernel/slab/cache/shrink
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The shrink file is written when memory should be reclaimed from
+                a cache.  Empty partial slabs are freed and the partial list is
+                sorted so the slabs with the fewest available objects are used
+                first.
+What:           /sys/kernel/slab/cache/slab_size
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The slab_size file is read-only and specifies the object size
+                with metadata (debugging information and alignment) in bytes.
+What:           /sys/kernel/slab/cache/slabs
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The slabs file is read-only and displays how long many slabs
+                there are (both cpu and partial) and from which nodes they are
+                from.
+What:           /sys/kernel/slab/cache/store_user
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The store_user file specifies whether the location of
+                allocation or free should be tracked for a cache.
+What:           /sys/kernel/slab/cache/total_objects
+Date:           April 2008
+KernelVersion:  2.6.26
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The total_objects file is read-only and displays how many total
+                objects a cache has and from which nodes they are from.
+What:           /sys/kernel/slab/cache/trace
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                The trace file specifies whether object allocations and frees
+                should be traced.
+What:           /sys/kernel/slab/cache/validate
+Date:           May 2007
+KernelVersion:  2.6.22
+Contact:        Pekka Enberg <penberg@cs.helsinki.fi>,
+                Christoph Lameter <cl@linux-foundation.org>
+Description:
+                Writing to the validate file causes SLUB to traverse all of its
+                cache's objects and check the validity of metadata.
diff --git a/Documentation/Changes b/Documentation/Changes
index b95082be4d5e..664392481c84 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -29,7 +29,7 @@ hardware, for example, you probably needn't concern yourself with
 isdn4k-utils.
 o  Gnu C                  3.2                     # gcc --version
-o  Gnu make               3.79.1                  # make --version
+o  Gnu make               3.80                    # make --version
 o  binutils               2.12                    # ld -v
 o  util-linux             2.10o                   # fdformat --version
 o  module-init-tools      0.9.10                  # depmod -V
@@ -48,6 +48,7 @@ o  procps                 3.2.0                   # ps --version
 o  oprofile               0.9                     # oprofiled --version
 o  udev                   081                     # udevinfo -V
 o  grub                   0.93                    # grub --version
+o  mcelog                 0.6
 Kernel compilation
 ==================
@@ -61,7 +62,7 @@ computer.
 Make
 ----
-You will need Gnu make 3.79.1 or later to build the kernel.
+You will need Gnu make 3.80 or later to build the kernel.
 Binutils
 --------
@@ -276,6 +277,16 @@ before running exportfs or mountd.  It is recommended that all NFS
 services be protected from the internet-at-large by a firewall where
 that is possible.
+mcelog
+------
+In Linux 2.6.31+ the i386 kernel needs to run the mcelog utility
+as a regular cronjob similar to the x86-64 kernel to process and log
+machine check events when CONFIG_X86_NEW_MCE is enabled. Machine check
+events are errors reported by the CPU. Processing them is strongly encouraged.
+All x86-64 kernels since 2.6.4 require the mcelog utility to
+process machine checks.
 Getting updated software
 ========================
@@ -365,6 +376,10 @@ FUSE
 ----
 o <http://sourceforge.net/projects/fuse>
+mcelog
+------
+o <ftp://ftp.kernel.org/pub/linux/utils/cpu/mce/mcelog/>
 Networking
 **********
diff --git a/Documentation/CodingStyle b/Documentation/CodingStyle
index 72968cd5eaf3..8bb37237ebd2 100644
--- a/Documentation/CodingStyle
+++ b/Documentation/CodingStyle
@@ -698,8 +698,8 @@ very often is not. Abundant use of the inline keyword leads to a much bigger
 kernel, which in turn slows the system as a whole down, due to a bigger
 icache footprint for the CPU and simply because there is less memory
 available for the pagecache. Just think about it; a pagecache miss causes a
-disk seek, which easily takes 5 miliseconds. There are a LOT of cpu cycles
+disk seek, which easily takes 5 milliseconds. There are a LOT of cpu cycles
-that can go into these 5 miliseconds.
+that can go into these 5 milliseconds.
 A reasonable rule of thumb is to not put inline at functions that have more
 than 3 lines of code in them. An exception to this rule are the cases where
diff --git a/Documentation/DMA-API.txt b/Documentation/DMA-API.txt
index d9aa43d78bcc..5aceb88b3f8b 100644
--- a/Documentation/DMA-API.txt
+++ b/Documentation/DMA-API.txt
@@ -676,8 +676,8 @@ this directory the following files can currently be found:
        dma-api/all_errors      This file contains a numeric value. If this
                                value is not equal to zero the debugging code
                                will print a warning for every error it finds
-                                into the kernel log. Be carefull with this
+                                into the kernel log. Be careful with this
-                                option. It can easily flood your logs.
+                                option, as it can easily flood your logs.
        dma-api/disabled        This read-only file contains the character 'Y'
                                if the debugging code is disabled. This can
@@ -704,12 +704,24 @@ this directory the following files can currently be found:
                                The current number of free dma_debug_entries
                                in the allocator.
+        dma-api/driver-filter
+                                You can write a name of a driver into this file
+                                to limit the debug output to requests from that
+                                particular driver. Write an empty string to
+                                that file to disable the filter and see
+                                all errors again.
 If you have this code compiled into your kernel it will be enabled by default.
 If you want to boot without the bookkeeping anyway you can provide
 'dma_debug=off' as a boot parameter. This will disable DMA-API debugging.
 Notice that you can not enable it again at runtime. You have to reboot to do
 so.
+If you want to see debug messages only for a special device driver you can
+specify the dma_debug_driver=<drivername> parameter. This will enable the
+driver filter at boot time. The debug code will only print errors for that
+driver afterwards. This filter can be disabled or changed later using debugfs.
 When the code disables itself at runtime this is most likely because it ran
 out of dma_debug_entries. These entries are preallocated at boot. The number
 of preallocated entries is defined per architecture. If it is too low for you
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index b1eb661e6302..9632444f6c62 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -13,7 +13,8 @@ DOCBOOKS := z8530book.xml mcabook.xml device-drivers.xml \
            gadget.xml libata.xml mtdnand.xml librs.xml rapidio.xml \
            genericirq.xml s390-drivers.xml uio-howto.xml scsi.xml \
            mac80211.xml debugobjects.xml sh.xml regulator.xml \
-            alsa-driver-api.xml writing-an-alsa-driver.xml
+            alsa-driver-api.xml writing-an-alsa-driver.xml \
+            tracepoint.xml
 ###
 # The build process is as follows (targets):
diff --git a/Documentation/DocBook/tracepoint.tmpl b/Documentation/DocBook/tracepoint.tmpl
new file mode 100644
index 000000000000..b0756d0fd579
--- /dev/null
+++ b/Documentation/DocBook/tracepoint.tmpl
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
+        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
+<book id="Tracepoints">
+ <bookinfo>
+  <title>The Linux Kernel Tracepoint API</title>
+  <authorgroup>
+   <author>
+    <firstname>Jason</firstname>
+    <surname>Baron</surname>
+    <affiliation>
+     <address>
+      <email>jbaron@redhat.com</email>
+     </address>
+    </affiliation>
+   </author>
+  </authorgroup>
+  <legalnotice>
+   <para>
+     This documentation is free software; you can redistribute
+     it and/or modify it under the terms of the GNU General Public
+     License as published by the Free Software Foundation; either
+     version 2 of the License, or (at your option) any later
+     version.
+   </para>
+   <para>
+     This program is distributed in the hope that it will be
+     useful, but WITHOUT ANY WARRANTY; without even the implied
+     warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+     See the GNU General Public License for more details.
+   </para>
+   <para>
+     You should have received a copy of the GNU General Public
+     License along with this program; if not, write to the Free
+     Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+     MA 02111-1307 USA
+   </para>
+   <para>
+     For more details see the file COPYING in the source
+     distribution of Linux.
+   </para>
+  </legalnotice>
+ </bookinfo>
+ <toc></toc>
+  <chapter id="intro">
+   <title>Introduction</title>
+   <para>
+     Tracepoints are static probe points that are located in strategic points
+     throughout the kernel. 'Probes' register/unregister with tracepoints
+     via a callback mechanism. The 'probes' are strictly typed functions that
+     are passed a unique set of parameters defined by each tracepoint.
+   </para>
+   <para>
+     From this simple callback mechanism, 'probes' can be used to profile, debug,
+     and understand kernel behavior. There are a number of tools that provide a
+     framework for using 'probes'. These tools include Systemtap, ftrace, and
+     LTTng.
+   </para>
+   <para>
+     Tracepoints are defined in a number of header files via various macros. Thus,
+     the purpose of this document is to provide a clear accounting of the available
+     tracepoints. The intention is to understand not only what tracepoints are
+     available but also to understand where future tracepoints might be added.
+   </para>
+   <para>
+     The API presented has functions of the form:
+     <function>trace_tracepointname(function parameters)</function>. These are the
+     tracepoints callbacks that are found throughout the code. Registering and
+     unregistering probes with these callback sites is covered in the
+     <filename>Documentation/trace/*</filename> directory.
+   </para>
+  </chapter>
+  <chapter id="irq">
+   <title>IRQ</title>
+!Iinclude/trace/events/irq.h
+  </chapter>
+</book>
diff --git a/Documentation/RCU/rculist_nulls.txt b/Documentation/RCU/rculist_nulls.txt
index 6389dec33459..93cb28d05dcd 100644
--- a/Documentation/RCU/rculist_nulls.txt
+++ b/Documentation/RCU/rculist_nulls.txt
@@ -118,7 +118,7 @@ to another chain) checking the final 'nulls' value if
 the lookup met the end of chain. If final 'nulls' value
 is not the slot number, then we must restart the lookup at
 the beginning. If the object was moved to the same chain,
-then the reader doesnt care : It might eventually
+then the reader doesn't care : It might eventually
 scan the list again without harm.
diff --git a/Documentation/RCU/trace.txt b/Documentation/RCU/trace.txt
index 068848240a8b..02cced183b2d 100644
--- a/Documentation/RCU/trace.txt
+++ b/Documentation/RCU/trace.txt
@@ -192,23 +192,24 @@ rcu/rcuhier (which displays the struct rcu_node hierarchy).
 The output of "cat rcu/rcudata" looks as follows:
 rcu:
-  0 c=4011 g=4012 pq=1 pqc=4011 qp=0 rpfq=1 rp=3c2a dt=23301/73 dn=2 df=1882 of=0 ri=2126 ql=2 b=10
+rcu:
-  1 c=4011 g=4012 pq=1 pqc=4011 qp=0 rpfq=3 rp=39a6 dt=78073/1 dn=2 df=1402 of=0 ri=1875 ql=46 b=10
+  0 c=17829 g=17829 pq=1 pqc=17829 qp=0 dt=10951/1 dn=0 df=1101 of=0 ri=36 ql=0 b=10
-  2 c=4010 g=4010 pq=1 pqc=4010 qp=0 rpfq=-5 rp=1d12 dt=16646/0 dn=2 df=3140 of=0 ri=2080 ql=0 b=10
+  1 c=17829 g=17829 pq=1 pqc=17829 qp=0 dt=16117/1 dn=0 df=1015 of=0 ri=0 ql=0 b=10
-  3 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=2b50 dt=21159/1 dn=2 df=2230 of=0 ri=1923 ql=72 b=10
+  2 c=17829 g=17829 pq=1 pqc=17829 qp=0 dt=1445/1 dn=0 df=1839 of=0 ri=0 ql=0 b=10
-  4 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=1644 dt=5783/1 dn=2 df=3348 of=0 ri=2805 ql=7 b=10
+  3 c=17829 g=17829 pq=1 pqc=17829 qp=0 dt=6681/1 dn=0 df=1545 of=0 ri=0 ql=0 b=10
-  5 c=4012 g=4013 pq=0 pqc=4011 qp=1 rpfq=3 rp=1aac dt=5879/1 dn=2 df=3140 of=0 ri=2066 ql=10 b=10
+  4 c=17829 g=17829 pq=1 pqc=17829 qp=0 dt=1003/1 dn=0 df=1992 of=0 ri=0 ql=0 b=10
-  6 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=ed8 dt=5847/1 dn=2 df=3797 of=0 ri=1266 ql=10 b=10
+  5 c=17829 g=17830 pq=1 pqc=17829 qp=1 dt=3887/1 dn=0 df=3331 of=0 ri=4 ql=2 b=10
-  7 c=4012 g=4013 pq=1 pqc=4012 qp=1 rpfq=3 rp=1fa2 dt=6199/1 dn=2 df=2795 of=0 ri=2162 ql=28 b=10
+  6 c=17829 g=17829 pq=1 pqc=17829 qp=0 dt=859/1 dn=0 df=3224 of=0 ri=0 ql=0 b=10
+  7 c=17829 g=17830 pq=0 pqc=17829 qp=1 dt=3761/1 dn=0 df=1818 of=0 ri=0 ql=2 b=10
 rcu_bh:
-  0 c=-268 g=-268 pq=1 pqc=-268 qp=0 rpfq=-145 rp=21d6 dt=23301/73 dn=2 df=0 of=0 ri=0 ql=0 b=10
+  0 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=10951/1 dn=0 df=0 of=0 ri=0 ql=0 b=10
-  1 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-170 rp=20ce dt=78073/1 dn=2 df=26 of=0 ri=5 ql=0 b=10
+  1 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=16117/1 dn=0 df=13 of=0 ri=0 ql=0 b=10
-  2 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-83 rp=fbd dt=16646/0 dn=2 df=28 of=0 ri=4 ql=0 b=10
+  2 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=1445/1 dn=0 df=15 of=0 ri=0 ql=0 b=10
-  3 c=-268 g=-268 pq=1 pqc=-268 qp=0 rpfq=-105 rp=178c dt=21159/1 dn=2 df=28 of=0 ri=2 ql=0 b=10
+  3 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=6681/1 dn=0 df=9 of=0 ri=0 ql=0 b=10
-  4 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-30 rp=b54 dt=5783/1 dn=2 df=32 of=0 ri=0 ql=0 b=10
+  4 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=1003/1 dn=0 df=15 of=0 ri=0 ql=0 b=10
-  5 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-29 rp=df5 dt=5879/1 dn=2 df=30 of=0 ri=3 ql=0 b=10
+  5 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=3887/1 dn=0 df=15 of=0 ri=0 ql=0 b=10
-  6 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-28 rp=788 dt=5847/1 dn=2 df=32 of=0 ri=0 ql=0 b=10
+  6 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=859/1 dn=0 df=15 of=0 ri=0 ql=0 b=10
-  7 c=-268 g=-268 pq=1 pqc=-268 qp=1 rpfq=-53 rp=1098 dt=6199/1 dn=2 df=30 of=0 ri=3 ql=0 b=10
+  7 c=-275 g=-275 pq=1 pqc=-275 qp=0 dt=3761/1 dn=0 df=15 of=0 ri=0 ql=0 b=10
 The first section lists the rcu_data structures for rcu, the second for
 rcu_bh.  Each section has one line per CPU, or eight for this 8-CPU system.
@@ -253,12 +254,6 @@ o	"pqc" indicates which grace period the last-observed quiescent
 o       "qp" indicates that RCU still expects a quiescent state from
        this CPU.
-o       "rpfq" is the number of rcu_pending() calls on this CPU required
-        to induce this CPU to invoke force_quiescent_state().
-o       "rp" is low-order four hex digits of the count of how many times
-        rcu_pending() has been invoked on this CPU.
 o       "dt" is the current value of the dyntick counter that is incremented
        when entering or leaving dynticks idle state, either by the
        scheduler or by irq.  The number after the "/" is the interrupt
@@ -305,6 +300,9 @@ o	"b" is the batch limit for this CPU.  If more than this number
        of RCU callbacks is ready to invoke, then the remainder will
        be deferred.
+There is also an rcu/rcudata.csv file with the same information in
+comma-separated-variable spreadsheet format.
 The output of "cat rcu/rcugp" looks as follows:
@@ -411,3 +409,63 @@ o	Each element of the form "1/1 0:127 ^0" represents one struct
                For example, the first entry at the lowest level shows
                "^0", indicating that it corresponds to bit zero in
                the first entry at the middle level.
+The output of "cat rcu/rcu_pending" looks as follows:
+rcu:
+  0 np=255892 qsp=53936 cbr=0 cng=14417 gpc=10033 gps=24320 nf=6445 nn=146741
+  1 np=261224 qsp=54638 cbr=0 cng=25723 gpc=16310 gps=2849 nf=5912 nn=155792
+  2 np=237496 qsp=49664 cbr=0 cng=2762 gpc=45478 gps=1762 nf=1201 nn=136629
+  3 np=236249 qsp=48766 cbr=0 cng=286 gpc=48049 gps=1218 nf=207 nn=137723
+  4 np=221310 qsp=46850 cbr=0 cng=26 gpc=43161 gps=4634 nf=3529 nn=123110
+  5 np=237332 qsp=48449 cbr=0 cng=54 gpc=47920 gps=3252 nf=201 nn=137456
+  6 np=219995 qsp=46718 cbr=0 cng=50 gpc=42098 gps=6093 nf=4202 nn=120834
+  7 np=249893 qsp=49390 cbr=0 cng=72 gpc=38400 gps=17102 nf=41 nn=144888
+rcu_bh:
+  0 np=146741 qsp=1419 cbr=0 cng=6 gpc=0 gps=0 nf=2 nn=145314
+  1 np=155792 qsp=12597 cbr=0 cng=0 gpc=4 gps=8 nf=3 nn=143180
+  2 np=136629 qsp=18680 cbr=0 cng=0 gpc=7 gps=6 nf=0 nn=117936
+  3 np=137723 qsp=2843 cbr=0 cng=0 gpc=10 gps=7 nf=0 nn=134863
+  4 np=123110 qsp=12433 cbr=0 cng=0 gpc=4 gps=2 nf=0 nn=110671
+  5 np=137456 qsp=4210 cbr=0 cng=0 gpc=6 gps=5 nf=0 nn=133235
+  6 np=120834 qsp=9902 cbr=0 cng=0 gpc=6 gps=3 nf=2 nn=110921
+  7 np=144888 qsp=26336 cbr=0 cng=0 gpc=8 gps=2 nf=0 nn=118542
+As always, this is once again split into "rcu" and "rcu_bh" portions.
+The fields are as follows:
+o       "np" is the number of times that __rcu_pending() has been invoked
+        for the corresponding flavor of RCU.
+o       "qsp" is the number of times that the RCU was waiting for a
+        quiescent state from this CPU.
+o       "cbr" is the number of times that this CPU had RCU callbacks
+        that had passed through a grace period, and were thus ready
+        to be invoked.
+o       "cng" is the number of times that this CPU needed another
+        grace period while RCU was idle.
+o       "gpc" is the number of times that an old grace period had
+        completed, but this CPU was not yet aware of it.
+o       "gps" is the number of times that a new grace period had started,
+        but this CPU was not yet aware of it.
+o       "nf" is the number of times that this CPU suspected that the
+        current grace period had run for too long, and thus needed to
+        be forced.
+        Please note that "forcing" consists of sending resched IPIs
+        to holdout CPUs.  If that CPU really still is in an old RCU
+        read-side critical section, then we really do have to wait for it.
+        The assumption behing "forcing" is that the CPU is not still in
+        an old RCU read-side critical section, but has not yet responded
+        for some other reason.
+o       "nn" is the number of times that this CPU needed nothing.  Alert
+        readers will note that the rcu "nn" number for a given CPU very
+        closely matches the rcu_bh "np" number for that same CPU.  This
+        is due to short-circuit evaluation in rcu_pending().
diff --git a/Documentation/SM501.txt b/Documentation/SM501.txt
index 6fc656035925..561826f82093 100644
--- a/Documentation/SM501.txt
+++ b/Documentation/SM501.txt
@@ -5,7 +5,7 @@ Copyright 2006, 2007 Simtec Electronics
 The Silicon Motion SM501 multimedia companion chip is a multifunction device
 which may provide numerous interfaces including USB host controller USB gadget,
-Asyncronous Serial ports, Audio functions and a dual display video interface.
+asynchronous serial ports, audio functions, and a dual display video interface.
 The device may be connected by PCI or local bus with varying functions enabled.
 Core
diff --git a/Documentation/Smack.txt b/Documentation/Smack.txt
index 629c92e99783..34614b4c708e 100644
--- a/Documentation/Smack.txt
+++ b/Documentation/Smack.txt
@@ -184,8 +184,9 @@ length. Single character labels using special characters, that being anything
 other than a letter or digit, are reserved for use by the Smack development
 team. Smack labels are unstructured, case sensitive, and the only operation
 ever performed on them is comparison for equality. Smack labels cannot
-contain unprintable characters or the "/" (slash) character. Smack labels
+contain unprintable characters, the "/" (slash), the "\" (backslash), the "'"
-cannot begin with a '-', which is reserved for special options.
+(quote) and '"' (double-quote) characters.
+Smack labels cannot begin with a '-', which is reserved for special options.
 There are some predefined labels:
@@ -523,3 +524,18 @@ Smack supports some mount options:
 These mount options apply to all file system types.
+Smack auditing
+If you want Smack auditing of security events, you need to set CONFIG_AUDIT
+in your kernel configuration.
+By default, all denied events will be audited. You can change this behavior by
+writing a single character to the /smack/logging file :
+0 : no logging
+1 : log denied (default)
+2 : log accepted
+3 : log denied & accepted
+Events are logged as 'key=value' pairs, for each event you at least will get
+the subjet, the object, the rights requested, the action, the kernel function
+that triggered the event, plus other pairs depending on the type of event
+audited.
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index f309d3c6221c..5c555a8b39e5 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -91,6 +91,10 @@ Be as specific as possible.  The WORST descriptions possible include
 things like "update driver X", "bug fix for driver X", or "this patch
 includes updates for subsystem X.  Please apply."
+The maintainer will thank you if you write your patch description in a
+form which can be easily pulled into Linux's source code management
+system, git, as a "commit log".  See #15, below.
 If your description starts to get long, that's a sign that you probably
 need to split up your patch.  See #3, next.
@@ -183,8 +187,9 @@ Even if the maintainer did not respond in step #4, make sure to ALWAYS
 copy the maintainer when you change their code.
 For small patches you may want to CC the Trivial Patch Monkey
-trivial@kernel.org managed by Jesper Juhl; which collects "trivial"
+trivial@kernel.org which collects "trivial" patches. Have a look
-patches. Trivial patches must qualify for one of the following rules:
+into the MAINTAINERS file for its current manager.
+Trivial patches must qualify for one of the following rules:
 Spelling fixes in documentation
 Spelling fixes which could break grep(1)
 Warning fixes (cluttering with useless warnings is bad)
@@ -196,7 +201,6 @@ patches. Trivial patches must qualify for one of the following rules:
 since people copy, as long as it's trivial)
 Any fix by the author/maintainer of the file (ie. patch monkey
 in re-transmission mode)
-URL: <http://www.kernel.org/pub/linux/kernel/people/juhl/trivial/>
@@ -405,7 +409,14 @@ person it names.  This tag documents that potentially interested parties
 have been included in the discussion
-14) Using Tested-by: and Reviewed-by:
+14) Using Reported-by:, Tested-by: and Reviewed-by:
+If this patch fixes a problem reported by somebody else, consider adding a
+Reported-by: tag to credit the reporter for their contribution.  Please
+note that this tag should not be added without the reporter's permission,
+especially if the problem was not reported in a public forum.  That said,
+if we diligently credit our bug reporters, they will, hopefully, be
+inspired to help us again in the future.
 A Tested-by: tag indicates that the patch has been successfully tested (in
 some environment) by the person named.  This tag informs maintainers that
@@ -444,7 +455,7 @@ offer a Reviewed-by tag for a patch.  This tag serves to give credit to
 reviewers and to inform maintainers of the degree of review which has been
 done on the patch.  Reviewed-by: tags, when supplied by reviewers known to
 understand the subject area and to perform thorough reviews, will normally
-increase the liklihood of your patch getting into the kernel.
+increase the likelihood of your patch getting into the kernel.
 15) The canonical patch format
@@ -485,12 +496,33 @@ phrase" should not be a filename.  Do not use the same "summary
 phrase" for every patch in a whole patch series (where a "patch
 series" is an ordered sequence of multiple, related patches).
-Bear in mind that the "summary phrase" of your email becomes
+Bear in mind that the "summary phrase" of your email becomes a
-a globally-unique identifier for that patch.  It propagates
+globally-unique identifier for that patch.  It propagates all the way
-all the way into the git changelog.  The "summary phrase" may
+into the git changelog.  The "summary phrase" may later be used in
-later be used in developer discussions which refer to the patch.
+developer discussions which refer to the patch.  People will want to
-People will want to google for the "summary phrase" to read
+google for the "summary phrase" to read discussion regarding that
-discussion regarding that patch.
+patch.  It will also be the only thing that people may quickly see
+when, two or three months later, they are going through perhaps
+thousands of patches using tools such as "gitk" or "git log
+--oneline".
+For these reasons, the "summary" must be no more than 70-75
+characters, and it must describe both what the patch changes, as well
+as why the patch might be necessary.  It is challenging to be both
+succinct and descriptive, but that is what a well-written summary
+should do.
+The "summary phrase" may be prefixed by tags enclosed in square
+brackets: "Subject: [PATCH tag] <summary phrase>".  The tags are not
+considered part of the summary phrase, but describe how the patch
+should be treated.  Common tags might include a version descriptor if
+the multiple versions of the patch have been sent out in response to
+comments (i.e., "v1, v2, v3"), or "RFC" to indicate a request for
+comments.  If there are four patches in a patch series the individual
+patches may be numbered like this: 1/4, 2/4, 3/4, 4/4.  This assures
+that developers understand the order in which the patches should be
+applied and that they have reviewed or applied all of the patches in
+the patch series.
 A couple of example Subjects:
@@ -510,19 +542,31 @@ the patch author in the changelog.
 The explanation body will be committed to the permanent source
 changelog, so should make sense to a competent reader who has long
 since forgotten the immediate details of the discussion that might
-have led to this patch.
+have led to this patch.  Including symptoms of the failure which the
+patch addresses (kernel log messages, oops messages, etc.) is
+especially useful for people who might be searching the commit logs
+looking for the applicable patch.  If a patch fixes a compile failure,
+it may not be necessary to include _all_ of the compile failures; just
+enough that it is likely that someone searching for the patch can find
+it.  As in the "summary phrase", it is important to be both succinct as
+well as descriptive.
 The "---" marker line serves the essential purpose of marking for patch
 handling tools where the changelog message ends.
 One good use for the additional comments after the "---" marker is for
-a diffstat, to show what files have changed, and the number of inserted
+a diffstat, to show what files have changed, and the number of
-and deleted lines per file.  A diffstat is especially useful on bigger
+inserted and deleted lines per file.  A diffstat is especially useful
-patches.  Other comments relevant only to the moment or the maintainer,
+on bigger patches.  Other comments relevant only to the moment or the
-not suitable for the permanent changelog, should also go here.
+maintainer, not suitable for the permanent changelog, should also go
-Use diffstat options "-p 1 -w 70" so that filenames are listed from the
+here.  A good example of such comments might be "patch changelogs"
-top of the kernel source tree and don't use too much horizontal space
+which describe what has changed between the v1 and v2 version of the
-(easily fit in 80 columns, maybe with some indentation).
+patch.
+If you are going to include a diffstat after the "---" marker, please
+use diffstat options "-p 1 -w 70" so that filenames are listed from
+the top of the kernel source tree and don't use too much horizontal
+space (easily fit in 80 columns, maybe with some indentation).
 See more details on the proper patch format in the following
 references.
diff --git a/Documentation/arm/Samsung-S3C24XX/GPIO.txt b/Documentation/arm/Samsung-S3C24XX/GPIO.txt
index ea7ccfc4b274..948c8718d967 100644
--- a/Documentation/arm/Samsung-S3C24XX/GPIO.txt
+++ b/Documentation/arm/Samsung-S3C24XX/GPIO.txt
@@ -51,7 +51,7 @@ PIN Numbers
 -----------
  Each pin has an unique number associated with it in regs-gpio.h,
-  eg S3C2410_GPA0 or S3C2410_GPF1. These defines are used to tell
+  eg S3C2410_GPA(0) or S3C2410_GPF(1). These defines are used to tell
  the GPIO functions which pin is to be used.
@@ -65,11 +65,11 @@ Configuring a pin
  Eg:
-     s3c2410_gpio_cfgpin(S3C2410_GPA0, S3C2410_GPA0_ADDR0);
+     s3c2410_gpio_cfgpin(S3C2410_GPA(0), S3C2410_GPA0_ADDR0);
-     s3c2410_gpio_cfgpin(S3C2410_GPE8, S3C2410_GPE8_SDDAT1);
+     s3c2410_gpio_cfgpin(S3C2410_GPE(8), S3C2410_GPE8_SDDAT1);
-   which would turn GPA0 into the lowest Address line A0, and set
+   which would turn GPA(0) into the lowest Address line A0, and set
-   GPE8 to be connected to the SDIO/MMC controller's SDDAT1 line.
+   GPE(8) to be connected to the SDIO/MMC controller's SDDAT1 line.
 Reading the current configuration
diff --git a/Documentation/block/biodoc.txt b/Documentation/block/biodoc.txt
index 6fab97ea7e6b..8d2158a1c6aa 100644
--- a/Documentation/block/biodoc.txt
+++ b/Documentation/block/biodoc.txt
@@ -186,7 +186,7 @@ a virtual address mapping (unlike the earlier scheme of virtual address
 do not have a corresponding kernel virtual address space mapping) and
 low-memory pages.
-Note: Please refer to Documentation/PCI/PCI-DMA-mapping.txt for a discussion
+Note: Please refer to Documentation/DMA-mapping.txt for a discussion
 on PCI high mem DMA aspects and mapping of scatter gather lists, and support
 for 64 bit PCI.
diff --git a/Documentation/block/deadline-iosched.txt b/Documentation/block/deadline-iosched.txt
index 72576769e0f4..2d82c80322cb 100644
--- a/Documentation/block/deadline-iosched.txt
+++ b/Documentation/block/deadline-iosched.txt
@@ -58,7 +58,7 @@ same criteria as reads.
 front_merges    (bool)
 ------------
-Sometimes it happens that a request enters the io scheduler that is contigious
+Sometimes it happens that a request enters the io scheduler that is contiguous
 with a request that is already on the queue. Either it fits in the back of that
 request, or it fits at the front. That is called either a back merge candidate
 or a front merge candidate. Due to the way files are typically laid out,
diff --git a/Documentation/braille-console.txt b/Documentation/braille-console.txt
index 000b0fbdc105..d0d042c2fd5e 100644
--- a/Documentation/braille-console.txt
+++ b/Documentation/braille-console.txt
@@ -27,7 +27,7 @@ parameter.
 For simplicity, only one braille console can be enabled, other uses of
 console=brl,... will be discarded.  Also note that it does not interfere with
-the console selection mecanism described in serial-console.txt
+the console selection mechanism described in serial-console.txt
 For now, only the VisioBraille device is supported.
diff --git a/Documentation/dell_rbu.txt b/Documentation/dell_rbu.txt
index c11b931f8f98..15174985ad08 100644
--- a/Documentation/dell_rbu.txt
+++ b/Documentation/dell_rbu.txt
@@ -76,9 +76,9 @@ Do the steps below to download the BIOS image.
 The /sys/class/firmware/dell_rbu/ entries will remain till the following is
 done.
-echo -1 > /sys/class/firmware/dell_rbu/loading.
+echo -1 > /sys/class/firmware/dell_rbu/loading
 Until this step is completed the driver cannot be unloaded.
-Also echoing either mono ,packet or init in to image_type will free up the
+Also echoing either mono, packet or init in to image_type will free up the
 memory allocated by the driver.
 If a user by accident executes steps 1 and 3 above without executing step 2;
diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
index dd48132a74dd..f622c1e9f0f9 100644
--- a/Documentation/development-process/5.Posting
+++ b/Documentation/development-process/5.Posting
@@ -119,7 +119,7 @@ which takes quite a bit of time and thought after the "real work" has been
 done.  When done properly, though, it is time well spent.
-5.4: PATCH FORMATTING
+5.4: PATCH FORMATTING AND CHANGELOGS
 So now you have a perfect series of patches for posting, but the work is
 not done quite yet.  Each patch needs to be formatted into a message which
@@ -146,8 +146,33 @@ that end, each patch will be composed of the following:
 - One or more tag lines, with, at a minimum, one Signed-off-by: line from
   the author of the patch.  Tags will be described in more detail below.
-The above three items should, normally, be the text used when committing
+The items above, together, form the changelog for the patch.  Writing good
-the change to a revision control system.  They are followed by:
+changelogs is a crucial but often-neglected art; it's worth spending
+another moment discussing this issue.  When writing a changelog, you should
+bear in mind that a number of different people will be reading your words.
+These include subsystem maintainers and reviewers who need to decide
+whether the patch should be included, distributors and other maintainers
+trying to decide whether a patch should be backported to other kernels, bug
+hunters wondering whether the patch is responsible for a problem they are
+chasing, users who want to know how the kernel has changed, and more.  A
+good changelog conveys the needed information to all of these people in the
+most direct and concise way possible.
+To that end, the summary line should describe the effects of and motivation
+for the change as well as possible given the one-line constraint.  The
+detailed description can then amplify on those topics and provide any
+needed additional information.  If the patch fixes a bug, cite the commit
+which introduced the bug if possible.  If a problem is associated with
+specific log or compiler output, include that output to help others
+searching for a solution to the same problem.  If the change is meant to
+support other changes coming in later patch, say so.  If internal APIs are
+changed, detail those changes and how other developers should respond.  In
+general, the more you can put yourself into the shoes of everybody who will
+be reading your changelog, the better that changelog (and the kernel as a
+whole) will be.
+Needless to say, the changelog should be the text used when committing the
+change to a revision control system.  It will be followed by:
 - The patch itself, in the unified ("-u") patch format.  Using the "-p"
   option to diff will associate function names with changes, making the
diff --git a/Documentation/driver-model/devres.txt b/Documentation/driver-model/devres.txt
index 387b8a720f4a..d79aead9418b 100644
--- a/Documentation/driver-model/devres.txt
+++ b/Documentation/driver-model/devres.txt
@@ -188,7 +188,7 @@ For example, you can do something like the following.
  void my_midlayer_destroy_something()
  {
-        devres_release_group(dev, my_midlayer_create_soemthing);
+        devres_release_group(dev, my_midlayer_create_something);
  }
diff --git a/Documentation/edac.txt b/Documentation/edac.txt
index 8eda3fb66416..06f8f46692dc 100644
--- a/Documentation/edac.txt
+++ b/Documentation/edac.txt
@@ -23,8 +23,8 @@ first time, it was renamed to 'EDAC'.
 The bluesmoke project at sourceforge.net is now utilized as a 'staging area'
 for EDAC development, before it is sent upstream to kernel.org
-At the bluesmoke/EDAC project site, is a series of quilt patches against
+At the bluesmoke/EDAC project site is a series of quilt patches against
-recent kernels, stored in a SVN respository. For easier downloading, there
+recent kernels, stored in a SVN repository. For easier downloading, there
 is also a tarball snapshot available.
 ============================================================================
@@ -73,9 +73,9 @@ the vendor should tie the parity status bits to 0 if they do not intend
 to generate parity.  Some vendors do not do this, and thus the parity bit
 can "float" giving false positives.
-In the kernel there is a pci device attribute located in sysfs that is
+In the kernel there is a PCI device attribute located in sysfs that is
 checked by the EDAC PCI scanning code. If that attribute is set,
-PCI parity/error scannining is skipped for that device. The attribute
+PCI parity/error scanning is skipped for that device. The attribute
 is:
        broken_parity_status
diff --git a/Documentation/fb/sh7760fb.txt b/Documentation/fb/sh7760fb.txt
index c87bfe5c630a..b994c3b10549 100644
--- a/Documentation/fb/sh7760fb.txt
+++ b/Documentation/fb/sh7760fb.txt
@@ -1,7 +1,7 @@
 SH7760/SH7763 integrated LCDC Framebuffer driver
 ================================================
-0. Overwiew
+0. Overview
 -----------
 The SH7760/SH7763 have an integrated LCD Display controller (LCDC) which
 supports (in theory) resolutions ranging from 1x1 to 1024x1024,
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index edb2f0b07616..7129846a2785 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -444,3 +444,13 @@ What:	CONFIG_RFKILL_INPUT
 When:   2.6.33
 Why:    Should be implemented in userspace, policy daemon.
 Who:    Johannes Berg <johannes@sipsolutions.net>
+----------------------------
+What:   CONFIG_X86_OLD_MCE
+When:   2.6.32
+Why:    Remove the old legacy 32bit machine check code. This has been
+        superseded by the newer machine check code from the 64bit port,
+        but the old version has been kept around for easier testing. Note this
+        doesn't impact the old P5 and WinChip machine check handlers.
+Who:    Andi Kleen <andi@firstfloor.org>
diff --git a/Documentation/filesystems/autofs4-mount-control.txt b/Documentation/filesystems/autofs4-mount-control.txt
index c6341745df37..8f78ded4b648 100644
--- a/Documentation/filesystems/autofs4-mount-control.txt
+++ b/Documentation/filesystems/autofs4-mount-control.txt
@@ -369,7 +369,7 @@ The call requires an initialized struct autofs_dev_ioctl. There are two
 possible variations. Both use the path field set to the path of the mount
 point to check and the size field adjusted appropriately. One uses the
 ioctlfd field to identify a specific mount point to check while the other
-variation uses the path and optionaly arg1 set to an autofs mount type.
+variation uses the path and optionally arg1 set to an autofs mount type.
 The call returns 1 if this is a mount point and sets arg1 to the device
 number of the mount and field arg2 to the relevant super block magic
 number (described below) or 0 if it isn't a mountpoint. In both cases
diff --git a/Documentation/filesystems/caching/netfs-api.txt b/Documentation/filesystems/caching/netfs-api.txt
index 4db125b3a5c6..2666b1ed5e9e 100644
--- a/Documentation/filesystems/caching/netfs-api.txt
+++ b/Documentation/filesystems/caching/netfs-api.txt
@@ -184,7 +184,7 @@ This has the following fields:
     have index children.
     If this function is not supplied or if it returns NULL then the first
-     cache in the parent's list will be chosed, or failing that, the first
+     cache in the parent's list will be chosen, or failing that, the first
     cache in the master list.
 (4) A function to retrieve an object's key from the netfs [mandatory].
diff --git a/Documentation/filesystems/debugfs.txt b/Documentation/filesystems/debugfs.txt
new file mode 100644
index 000000000000..ed52af60c2d8
--- /dev/null
+++ b/Documentation/filesystems/debugfs.txt
@@ -0,0 +1,158 @@
+Copyright 2009 Jonathan Corbet <corbet@lwn.net>
+Debugfs exists as a simple way for kernel developers to make information
+available to user space.  Unlike /proc, which is only meant for information
+about a process, or sysfs, which has strict one-value-per-file rules,
+debugfs has no rules at all.  Developers can put any information they want
+there.  The debugfs filesystem is also intended to not serve as a stable
+ABI to user space; in theory, there are no stability constraints placed on
+files exported there.  The real world is not always so simple, though [1];
+even debugfs interfaces are best designed with the idea that they will need
+to be maintained forever.
+Debugfs is typically mounted with a command like:
+    mount -t debugfs none /sys/kernel/debug
+(Or an equivalent /etc/fstab line). 
+Note that the debugfs API is exported GPL-only to modules.
+Code using debugfs should include <linux/debugfs.h>.  Then, the first order
+of business will be to create at least one directory to hold a set of
+debugfs files:
+    struct dentry *debugfs_create_dir(const char *name, struct dentry *parent);
+This call, if successful, will make a directory called name underneath the
+indicated parent directory.  If parent is NULL, the directory will be
+created in the debugfs root.  On success, the return value is a struct
+dentry pointer which can be used to create files in the directory (and to
+clean it up at the end).  A NULL return value indicates that something went
+wrong.  If ERR_PTR(-ENODEV) is returned, that is an indication that the
+kernel has been built without debugfs support and none of the functions
+described below will work.
+The most general way to create a file within a debugfs directory is with:
+    struct dentry *debugfs_create_file(const char *name, mode_t mode,
+                                       struct dentry *parent, void *data,
+                                       const struct file_operations *fops);
+Here, name is the name of the file to create, mode describes the access
+permissions the file should have, parent indicates the directory which
+should hold the file, data will be stored in the i_private field of the
+resulting inode structure, and fops is a set of file operations which
+implement the file's behavior.  At a minimum, the read() and/or write()
+operations should be provided; others can be included as needed.  Again,
+the return value will be a dentry pointer to the created file, NULL for
+error, or ERR_PTR(-ENODEV) if debugfs support is missing.
+In a number of cases, the creation of a set of file operations is not
+actually necessary; the debugfs code provides a number of helper functions
+for simple situations.  Files containing a single integer value can be
+created with any of:
+    struct dentry *debugfs_create_u8(const char *name, mode_t mode,
+                                     struct dentry *parent, u8 *value);
+    struct dentry *debugfs_create_u16(const char *name, mode_t mode,
+                                      struct dentry *parent, u16 *value);
+    struct dentry *debugfs_create_u32(const char *name, mode_t mode,
+                                      struct dentry *parent, u32 *value);
+    struct dentry *debugfs_create_u64(const char *name, mode_t mode,
+                                      struct dentry *parent, u64 *value);
+These files support both reading and writing the given value; if a specific
+file should not be written to, simply set the mode bits accordingly.  The
+values in these files are in decimal; if hexadecimal is more appropriate,
+the following functions can be used instead:
+    struct dentry *debugfs_create_x8(const char *name, mode_t mode,
+                                     struct dentry *parent, u8 *value);
+    struct dentry *debugfs_create_x16(const char *name, mode_t mode,
+                                      struct dentry *parent, u16 *value);
+    struct dentry *debugfs_create_x32(const char *name, mode_t mode,
+                                      struct dentry *parent, u32 *value);
+Note that there is no debugfs_create_x64().
+These functions are useful as long as the developer knows the size of the
+value to be exported.  Some types can have different widths on different
+architectures, though, complicating the situation somewhat.  There is a
+function meant to help out in one special case:
+    struct dentry *debugfs_create_size_t(const char *name, mode_t mode,
+                                         struct dentry *parent, 
+                                         size_t *value);
+As might be expected, this function will create a debugfs file to represent
+a variable of type size_t.
+Boolean values can be placed in debugfs with:
+    struct dentry *debugfs_create_bool(const char *name, mode_t mode,
+                                       struct dentry *parent, u32 *value);
+A read on the resulting file will yield either Y (for non-zero values) or
+N, followed by a newline.  If written to, it will accept either upper- or
+lower-case values, or 1 or 0.  Any other input will be silently ignored.
+Finally, a block of arbitrary binary data can be exported with:
+    struct debugfs_blob_wrapper {
+        void *data;
+        unsigned long size;
+    };
+    struct dentry *debugfs_create_blob(const char *name, mode_t mode,
+                                       struct dentry *parent,
+                                       struct debugfs_blob_wrapper *blob);
+A read of this file will return the data pointed to by the
+debugfs_blob_wrapper structure.  Some drivers use "blobs" as a simple way
+to return several lines of (static) formatted text output.  This function
+can be used to export binary information, but there does not appear to be
+any code which does so in the mainline.  Note that all files created with
+debugfs_create_blob() are read-only.
+There are a couple of other directory-oriented helper functions:
+    struct dentry *debugfs_rename(struct dentry *old_dir, 
+                                  struct dentry *old_dentry,
+                                  struct dentry *new_dir, 
+                                  const char *new_name);
+    struct dentry *debugfs_create_symlink(const char *name, 
+                                          struct dentry *parent,
+                                          const char *target);
+A call to debugfs_rename() will give a new name to an existing debugfs
+file, possibly in a different directory.  The new_name must not exist prior
+to the call; the return value is old_dentry with updated information.
+Symbolic links can be created with debugfs_create_symlink().
+There is one important thing that all debugfs users must take into account:
+there is no automatic cleanup of any directories created in debugfs.  If a
+module is unloaded without explicitly removing debugfs entries, the result
+will be a lot of stale pointers and no end of highly antisocial behavior.
+So all debugfs users - at least those which can be built as modules - must
+be prepared to remove all files and directories they create there.  A file
+can be removed with:
+    void debugfs_remove(struct dentry *dentry);
+The dentry value can be NULL, in which case nothing will be removed.
+Once upon a time, debugfs users were required to remember the dentry
+pointer for every debugfs file they created so that all files could be
+cleaned up.  We live in more civilized times now, though, and debugfs users
+can call:
+    void debugfs_remove_recursive(struct dentry *dentry);
+If this function is passed a pointer for the dentry corresponding to the
+top-level directory, the entire hierarchy below that directory will be
+removed.
+Notes:
+        [1] http://lwn.net/Articles/309298/
diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
index 97882df04865..608fdba97b72 100644
--- a/Documentation/filesystems/ext4.txt
+++ b/Documentation/filesystems/ext4.txt
@@ -294,7 +294,7 @@ max_batch_time=usec	Maximum amount of time ext4 should wait for
                        amount of time (on average) that it takes to
                        finish committing a transaction.  Call this time
                        the "commit time".  If the time that the
-                        transactoin has been running is less than the
+                        transaction has been running is less than the
                        commit time, ext4 will try sleeping for the
                        commit time to see if other operations will join
                        the transaction.   The commit time is capped by
@@ -328,7 +328,7 @@ noauto_da_alloc		replacing existing files via patterns such as
                        journal commit, in the default data=ordered
                        mode, the data blocks of the new file are forced
                        to disk before the rename() operation is
-                        commited.  This provides roughly the same level
+                        committed.  This provides roughly the same level
                        of guarantees as ext3, and avoids the
                        "zero-length" problem that can happen when a
                        system crashes before the delayed allocation
@@ -358,7 +358,7 @@ written to the journal first, and then to its final location.
 In the event of a crash, the journal can be replayed, bringing both data and
 metadata into a consistent state.  This mode is the slowest except when data
 needs to be read from and written to disk at the same time where it
-outperforms all others modes.  Curently ext4 does not have delayed
+outperforms all others modes.  Currently ext4 does not have delayed
 allocation support if this data journalling mode is selected.
 References
diff --git a/Documentation/filesystems/fiemap.txt b/Documentation/filesystems/fiemap.txt
index 1e3defcfe50b..606233cd4618 100644
--- a/Documentation/filesystems/fiemap.txt
+++ b/Documentation/filesystems/fiemap.txt
@@ -204,7 +204,7 @@ fiemap_check_flags() helper:
 int fiemap_check_flags(struct fiemap_extent_info *fieinfo, u32 fs_flags);
-The struct fieinfo should be passed in as recieved from ioctl_fiemap(). The
+The struct fieinfo should be passed in as received from ioctl_fiemap(). The
 set of fiemap flags which the fs understands should be passed via fs_flags. If
 fiemap_check_flags finds invalid user flags, it will place the bad values in
 fieinfo->fi_flags and return -EBADR. If the file system gets -EBADR, from
diff --git a/Documentation/filesystems/gfs2-glocks.txt b/Documentation/filesystems/gfs2-glocks.txt
index 4dae9a3840bf..0494f78d87e4 100644
--- a/Documentation/filesystems/gfs2-glocks.txt
+++ b/Documentation/filesystems/gfs2-glocks.txt
@@ -60,7 +60,7 @@ go_lock          | Called for the first local holder of a lock
 go_unlock        | Called on the final local unlock of a lock
 go_dump          | Called to print content of object for debugfs file, or on
                 | error to dump glock to the log.
-go_type;         | The type of the glock, LM_TYPE_.....
+go_type          | The type of the glock, LM_TYPE_.....
 go_min_hold_time | The minimum hold time
 The minimum hold time for each lock is the time after a remote lock
diff --git a/Documentation/filesystems/gfs2.txt b/Documentation/filesystems/gfs2.txt
index 593004b6bbab..5e3ab8f3beff 100644
--- a/Documentation/filesystems/gfs2.txt
+++ b/Documentation/filesystems/gfs2.txt
@@ -11,18 +11,15 @@ their I/O so file system consistency is maintained.  One of the nifty
 features of GFS is perfect consistency -- changes made to the file system
 on one machine show up immediately on all other machines in the cluster.
-GFS uses interchangable inter-node locking mechanisms.  Different lock
+GFS uses interchangable inter-node locking mechanisms, the currently
-modules can plug into GFS and each file system selects the appropriate
+supported mechanisms are:
-lock module at mount time.  Lock modules include:
  lock_nolock -- allows gfs to be used as a local file system
  lock_dlm -- uses a distributed lock manager (dlm) for inter-node locking
  The dlm is found at linux/fs/dlm/
-In addition to interfacing with an external locking manager, a gfs lock
+Lock_dlm depends on user space cluster management systems found
-module is responsible for interacting with external cluster management
-systems.  Lock_dlm depends on user space cluster management systems found
 at the URL above.
 To use gfs as a local file system, no external clustering systems are
@@ -31,13 +28,19 @@ needed, simply:
  $ mkfs -t gfs2 -p lock_nolock -j 1 /dev/block_device
  $ mount -t gfs2 /dev/block_device /dir
-GFS2 is not on-disk compatible with previous versions of GFS.
+If you are using Fedora, you need to install the gfs2-utils package
+and, for lock_dlm, you will also need to install the cman package
+and write a cluster.conf as per the documentation.
+GFS2 is not on-disk compatible with previous versions of GFS, but it
+is pretty close.
 The following man pages can be found at the URL above:
-  gfs2_fsck     to repair a filesystem
+  fsck.gfs2     to repair a filesystem
  gfs2_grow     to expand a filesystem online
  gfs2_jadd     to add journals to a filesystem online
  gfs2_tool     to manipulate, examine and tune a filesystem
  gfs2_quota    to examine and change quota values in a filesystem
+  gfs2_convert  to convert a gfs filesystem to gfs2 in-place
  mount.gfs2    to help mount(8) mount a filesystem
  mkfs.gfs2     to make a filesystem
diff --git a/Documentation/filesystems/nfs-rdma.txt b/Documentation/filesystems/nfs-rdma.txt
index 85eaeaddd27c..e386f7e4bcee 100644
--- a/Documentation/filesystems/nfs-rdma.txt
+++ b/Documentation/filesystems/nfs-rdma.txt
@@ -100,7 +100,7 @@ Installation
    $ sudo cp utils/mount/mount.nfs /sbin/mount.nfs
    In this location, mount.nfs will be invoked automatically for NFS mounts
-    by the system mount commmand.
+    by the system mount command.
    NOTE: mount.nfs and therefore nfs-utils-1.1.2 or greater is only needed
    on the NFS client machine. You do not need this specific version of
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index ce84cfc9eae0..cd8717a36271 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -366,7 +366,7 @@ just those considered 'most important'.  The new vectors are:
  RES, CAL, TLB -- rescheduling, call and TLB flush interrupts are
  sent from one CPU to another per the needs of the OS.  Typically,
  their statistics are used by kernel developers and interested users to
-  determine the occurance of interrupt of the given type.
+  determine the occurrence of interrupts of the given type.
 The above IRQ vectors are displayed only when relevent.  For example,
 the threshold vector does not exist on x86_64 platforms.  Others are
@@ -551,7 +551,7 @@ Committed_AS: The amount of memory presently allocated on the system.
              memory once that memory has been successfully allocated.
 VmallocTotal: total size of vmalloc memory area
 VmallocUsed: amount of vmalloc area which is used
-VmallocChunk: largest contigious block of vmalloc area which is free
+VmallocChunk: largest contiguous block of vmalloc area which is free
 ..............................................................................
diff --git a/Documentation/filesystems/sysfs-pci.txt b/Documentation/filesystems/sysfs-pci.txt
index 26e4b8bc53ee..85354b32d731 100644
--- a/Documentation/filesystems/sysfs-pci.txt
+++ b/Documentation/filesystems/sysfs-pci.txt
@@ -72,7 +72,7 @@ The 'rom' file is special in that it provides read-only access to the device's
 ROM file, if available.  It's disabled by default, however, so applications
 should write the string "1" to the file to enable it before attempting a read
 call, and disable it following the access by writing "0" to the file.  Note
-that the device must be enabled for a rom read to return data succesfully.
+that the device must be enabled for a rom read to return data successfully.
 In the event a driver is not bound to the device, it can be enabled using the
 'enable' file, documented above.
diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
index 222437efd75a..3015da0c6b2a 100644
--- a/Documentation/filesystems/tmpfs.txt
+++ b/Documentation/filesystems/tmpfs.txt
@@ -133,4 +133,4 @@ RAM/SWAP in 10240 inodes and it is only accessible by root.
 Author:
   Christoph Rohland <cr@sap.com>, 1.12.01
 Updated:
-   Hugh Dickins <hugh@veritas.com>, 4 June 2007
+   Hugh Dickins, 4 June 2007
diff --git a/Documentation/filesystems/vfat.txt b/Documentation/filesystems/vfat.txt
index 3a5ddc96901a..5147be5e13cd 100644
--- a/Documentation/filesystems/vfat.txt
+++ b/Documentation/filesystems/vfat.txt
@@ -124,10 +124,10 @@ sys_immutable -- If set, ATTR_SYS attribute on FAT is handled as
 flush         -- If set, the filesystem will try to flush to disk more
                 early than normal. Not set by default.
-rodir         -- FAT has the ATTR_RO (read-only) attribute. But on Windows,
+rodir         -- FAT has the ATTR_RO (read-only) attribute. On Windows,
-                 the ATTR_RO of the directory will be just ignored actually,
+                 the ATTR_RO of the directory will just be ignored,
-                 and is used by only applications as flag. E.g. it's setted
+                 and is used only by applications as a flag (e.g. it's set
-                 for the customized folder.
+                 for the customized folder).
                 If you want to use ATTR_RO as read-only flag even for
                 the directory, set this option.
diff --git a/Documentation/futex-requeue-pi.txt b/Documentation/futex-requeue-pi.txt
new file mode 100644
index 000000000000..9dc1ff4fd536
--- /dev/null
+++ b/Documentation/futex-requeue-pi.txt
@@ -0,0 +1,131 @@
+Futex Requeue PI
+----------------
+Requeueing of tasks from a non-PI futex to a PI futex requires
+special handling in order to ensure the underlying rt_mutex is never
+left without an owner if it has waiters; doing so would break the PI
+boosting logic [see rt-mutex-desgin.txt] For the purposes of
+brevity, this action will be referred to as "requeue_pi" throughout
+this document.  Priority inheritance is abbreviated throughout as
+"PI".
+Motivation
+----------
+Without requeue_pi, the glibc implementation of
+pthread_cond_broadcast() must resort to waking all the tasks waiting
+on a pthread_condvar and letting them try to sort out which task
+gets to run first in classic thundering-herd formation.  An ideal
+implementation would wake the highest-priority waiter, and leave the
+rest to the natural wakeup inherent in unlocking the mutex
+associated with the condvar.
+Consider the simplified glibc calls:
+/* caller must lock mutex */
+pthread_cond_wait(cond, mutex)
+{
+        lock(cond->__data.__lock);
+        unlock(mutex);
+        do {
+           unlock(cond->__data.__lock);
+           futex_wait(cond->__data.__futex);
+           lock(cond->__data.__lock);
+        } while(...)
+        unlock(cond->__data.__lock);
+        lock(mutex);
+}
+pthread_cond_broadcast(cond)
+{
+        lock(cond->__data.__lock);
+        unlock(cond->__data.__lock);
+        futex_requeue(cond->data.__futex, cond->mutex);
+}
+Once pthread_cond_broadcast() requeues the tasks, the cond->mutex
+has waiters. Note that pthread_cond_wait() attempts to lock the
+mutex only after it has returned to user space.  This will leave the
+underlying rt_mutex with waiters, and no owner, breaking the
+previously mentioned PI-boosting algorithms.
+In order to support PI-aware pthread_condvar's, the kernel needs to
+be able to requeue tasks to PI futexes.  This support implies that
+upon a successful futex_wait system call, the caller would return to
+user space already holding the PI futex.  The glibc implementation
+would be modified as follows:
+/* caller must lock mutex */
+pthread_cond_wait_pi(cond, mutex)
+{
+        lock(cond->__data.__lock);
+        unlock(mutex);
+        do {
+           unlock(cond->__data.__lock);
+           futex_wait_requeue_pi(cond->__data.__futex);
+           lock(cond->__data.__lock);
+        } while(...)
+        unlock(cond->__data.__lock);
+        /* the kernel acquired the the mutex for us */
+}
+pthread_cond_broadcast_pi(cond)
+{
+        lock(cond->__data.__lock);
+        unlock(cond->__data.__lock);
+        futex_requeue_pi(cond->data.__futex, cond->mutex);
+}
+The actual glibc implementation will likely test for PI and make the
+necessary changes inside the existing calls rather than creating new
+calls for the PI cases.  Similar changes are needed for
+pthread_cond_timedwait() and pthread_cond_signal().
+Implementation
+--------------
+In order to ensure the rt_mutex has an owner if it has waiters, it
+is necessary for both the requeue code, as well as the waiting code,
+to be able to acquire the rt_mutex before returning to user space.
+The requeue code cannot simply wake the waiter and leave it to
+acquire the rt_mutex as it would open a race window between the
+requeue call returning to user space and the waiter waking and
+starting to run.  This is especially true in the uncontended case.
+The solution involves two new rt_mutex helper routines,
+rt_mutex_start_proxy_lock() and rt_mutex_finish_proxy_lock(), which
+allow the requeue code to acquire an uncontended rt_mutex on behalf
+of the waiter and to enqueue the waiter on a contended rt_mutex.
+Two new system calls provide the kernel<->user interface to
+requeue_pi: FUTEX_WAIT_REQUEUE_PI and FUTEX_REQUEUE_CMP_PI.
+FUTEX_WAIT_REQUEUE_PI is called by the waiter (pthread_cond_wait()
+and pthread_cond_timedwait()) to block on the initial futex and wait
+to be requeued to a PI-aware futex.  The implementation is the
+result of a high-speed collision between futex_wait() and
+futex_lock_pi(), with some extra logic to check for the additional
+wake-up scenarios.
+FUTEX_REQUEUE_CMP_PI is called by the waker
+(pthread_cond_broadcast() and pthread_cond_signal()) to requeue and
+possibly wake the waiting tasks. Internally, this system call is
+still handled by futex_requeue (by passing requeue_pi=1).  Before
+requeueing, futex_requeue() attempts to acquire the requeue target
+PI futex on behalf of the top waiter.  If it can, this waiter is
+woken.  futex_requeue() then proceeds to requeue the remaining
+nr_wake+nr_requeue tasks to the PI futex, calling
+rt_mutex_start_proxy_lock() prior to each requeue to prepare the
+task as a waiter on the underlying rt_mutex.  It is possible that
+the lock can be acquired at this stage as well, if so, the next
+waiter is woken to finish the acquisition of the lock.
+FUTEX_REQUEUE_PI accepts nr_wake and nr_requeue as arguments, but
+their sum is all that really matters.  futex_requeue() will wake or
+requeue up to nr_wake + nr_requeue tasks.  It will wake only as many
+tasks as it can acquire the lock for, which in the majority of cases
+should be 0 as good programming practice dictates that the caller of
+either pthread_cond_broadcast() or pthread_cond_signal() acquire the
+mutex prior to making the call. FUTEX_REQUEUE_PI requires that
+nr_wake=1.  nr_requeue should be INT_MAX for broadcast and 0 for
+signal.
diff --git a/Documentation/gpio.txt b/Documentation/gpio.txt
index 145c25a170c7..e4b6985044a2 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio.txt
@@ -458,7 +458,7 @@ debugfs interface, since it provides control over GPIO direction and
 value instead of just showing a gpio state summary.  Plus, it could be
 present on production systems without debugging support.
-Given approprate hardware documentation for the system, userspace could
+Given appropriate hardware documentation for the system, userspace could
 know for example that GPIO #23 controls the write protect line used to
 protect boot loader segments in flash memory.  System upgrade procedures
 may need to temporarily remove that protection, first importing a GPIO,
diff --git a/Documentation/hwmon/sysfs-interface b/Documentation/hwmon/sysfs-interface
index 2f10ce6a879f..004ee161721e 100644
--- a/Documentation/hwmon/sysfs-interface
+++ b/Documentation/hwmon/sysfs-interface
@@ -150,6 +150,11 @@ fan[1-*]_min	Fan minimum value
                Unit: revolution/min (RPM)
                RW
+fan[1-*]_max    Fan maximum value
+                Unit: revolution/min (RPM)
+                Only rarely supported by the hardware.
+                RW
 fan[1-*]_input  Fan input value.
                Unit: revolution/min (RPM)
                RO
@@ -390,6 +395,7 @@ OR
 in[0-*]_min_alarm
 in[0-*]_max_alarm
 fan[1-*]_min_alarm
+fan[1-*]_max_alarm
 temp[1-*]_min_alarm
 temp[1-*]_max_alarm
 temp[1-*]_crit_alarm
diff --git a/Documentation/i2c/busses/i2c-ocores b/Documentation/i2c/busses/i2c-ocores
index cfcebb10d14e..c269aaa2f26a 100644
--- a/Documentation/i2c/busses/i2c-ocores
+++ b/Documentation/i2c/busses/i2c-ocores
@@ -20,6 +20,8 @@ platform_device with the base address and interrupt number. The
 dev.platform_data of the device should also point to a struct
 ocores_i2c_platform_data (see linux/i2c-ocores.h) describing the
 distance between registers and the input clock speed.
+There is also a possibility to attach a list of i2c_board_info which
+the i2c-ocores driver will add to the bus upon creation.
 E.G. something like:
@@ -36,9 +38,24 @@ static struct resource ocores_resources[] = {
        },
 };
+/* optional board info */
+struct i2c_board_info ocores_i2c_board_info[] = {
+        {
+                I2C_BOARD_INFO("tsc2003", 0x48),
+                .platform_data = &tsc2003_platform_data,
+                .irq = TSC_IRQ
+        },
+        {
+                I2C_BOARD_INFO("adv7180", 0x42 >> 1),
+                .irq = ADV_IRQ
+        }
+};
 static struct ocores_i2c_platform_data myi2c_data = {
        .regstep        = 2,            /* two bytes between registers */
        .clock_khz      = 50000,        /* input clock of 50MHz */
+        .devices        = ocores_i2c_board_info, /* optional table of devices */
+        .num_devices    = ARRAY_SIZE(ocores_i2c_board_info), /* table size */
 };
 static struct platform_device myi2c = {
diff --git a/Documentation/ide/ide.txt b/Documentation/ide/ide.txt
index 0c78f4b1d9d9..e77bebfa7b0d 100644
--- a/Documentation/ide/ide.txt
+++ b/Documentation/ide/ide.txt
@@ -216,6 +216,8 @@ Other kernel parameters for ide_core are:
 * "noflush=[interface_number.device_number]" to disable flush requests
+* "nohpa=[interface_number.device_number]" to disable Host Protected Area
 * "noprobe=[interface_number.device_number]" to skip probing
 * "nowerr=[interface_number.device_number]" to ignore the WRERR_STAT bit
diff --git a/Documentation/input/multi-touch-protocol.txt b/Documentation/input/multi-touch-protocol.txt
index 9f09557aea39..a12ea3b586e6 100644
--- a/Documentation/input/multi-touch-protocol.txt
+++ b/Documentation/input/multi-touch-protocol.txt
@@ -18,8 +18,12 @@ Usage
 Anonymous finger details are sent sequentially as separate packets of ABS
 events. Only the ABS_MT events are recognized as part of a finger
 packet. The end of a packet is marked by calling the input_mt_sync()
-function, which generates a SYN_MT_REPORT event. The end of multi-touch
+function, which generates a SYN_MT_REPORT event. This instructs the
-transfer is marked by calling the usual input_sync() function.
+receiver to accept the data for the current finger and prepare to receive
+another. The end of a multi-touch transfer is marked by calling the usual
+input_sync() function. This instructs the receiver to act upon events
+accumulated since last EV_SYN/SYN_REPORT and prepare to receive a new
+set of events/packets.
 A set of ABS_MT events with the desired properties is defined. The events
 are divided into categories, to allow for partial implementation.  The
@@ -27,11 +31,26 @@ minimum set consists of ABS_MT_TOUCH_MAJOR, ABS_MT_POSITION_X and
 ABS_MT_POSITION_Y, which allows for multiple fingers to be tracked.  If the
 device supports it, the ABS_MT_WIDTH_MAJOR may be used to provide the size
 of the approaching finger. Anisotropy and direction may be specified with
-ABS_MT_TOUCH_MINOR, ABS_MT_WIDTH_MINOR and ABS_MT_ORIENTATION. Devices with
+ABS_MT_TOUCH_MINOR, ABS_MT_WIDTH_MINOR and ABS_MT_ORIENTATION.  The
-more granular information may specify general shapes as blobs, i.e., as a
+ABS_MT_TOOL_TYPE may be used to specify whether the touching tool is a
-sequence of rectangular shapes grouped together by an
+finger or a pen or something else.  Devices with more granular information
-ABS_MT_BLOB_ID. Finally, the ABS_MT_TOOL_TYPE may be used to specify
+may specify general shapes as blobs, i.e., as a sequence of rectangular
-whether the touching tool is a finger or a pen or something else.
+shapes grouped together by an ABS_MT_BLOB_ID. Finally, for the few devices
+that currently support it, the ABS_MT_TRACKING_ID event may be used to
+report finger tracking from hardware [5].
+Here is what a minimal event sequence for a two-finger touch would look
+like:
+   ABS_MT_TOUCH_MAJOR
+   ABS_MT_POSITION_X
+   ABS_MT_POSITION_Y
+   SYN_MT_REPORT
+   ABS_MT_TOUCH_MAJOR
+   ABS_MT_POSITION_X
+   ABS_MT_POSITION_Y
+   SYN_MT_REPORT
+   SYN_REPORT
 Event Semantics
@@ -44,24 +63,24 @@ ABS_MT_TOUCH_MAJOR
 The length of the major axis of the contact. The length should be given in
 surface units. If the surface has an X times Y resolution, the largest
-possible value of ABS_MT_TOUCH_MAJOR is sqrt(X^2 + Y^2), the diagonal.
+possible value of ABS_MT_TOUCH_MAJOR is sqrt(X^2 + Y^2), the diagonal [4].
 ABS_MT_TOUCH_MINOR
 The length, in surface units, of the minor axis of the contact. If the
-contact is circular, this event can be omitted.
+contact is circular, this event can be omitted [4].
 ABS_MT_WIDTH_MAJOR
 The length, in surface units, of the major axis of the approaching
 tool. This should be understood as the size of the tool itself. The
 orientation of the contact and the approaching tool are assumed to be the
-same.
+same [4].
 ABS_MT_WIDTH_MINOR
 The length, in surface units, of the minor axis of the approaching
-tool. Omit if circular.
+tool. Omit if circular [4].
 The above four values can be used to derive additional information about
 the contact. The ratio ABS_MT_TOUCH_MAJOR / ABS_MT_WIDTH_MAJOR approximates
@@ -70,14 +89,17 @@ different characteristic widths [1].
 ABS_MT_ORIENTATION
-The orientation of the ellipse. The value should describe half a revolution
+The orientation of the ellipse. The value should describe a signed quarter
-clockwise around the touch center. The scale of the value is arbitrary, but
+of a revolution clockwise around the touch center. The signed value range
-zero should be returned for an ellipse aligned along the Y axis of the
+is arbitrary, but zero should be returned for a finger aligned along the Y
-surface. As an example, an index finger placed straight onto the axis could
+axis of the surface, a negative value when finger is turned to the left, and
-return zero orientation, something negative when twisted to the left, and
+a positive value when finger turned to the right. When completely aligned with
-something positive when twisted to the right. This value can be omitted if
+the X axis, the range max should be returned.  Orientation can be omitted
-the touching object is circular, or if the information is not available in
+if the touching object is circular, or if the information is not available
-the kernel driver.
+in the kernel driver. Partial orientation support is possible if the device
+can distinguish between the two axis, but not (uniquely) any values in
+between. In such cases, the range of ABS_MT_ORIENTATION should be [0, 1]
+[4].
 ABS_MT_POSITION_X
@@ -98,8 +120,35 @@ ABS_MT_BLOB_ID
 The BLOB_ID groups several packets together into one arbitrarily shaped
 contact. This is a low-level anonymous grouping, and should not be confused
-with the high-level contactID, explained below. Most kernel drivers will
+with the high-level trackingID [5]. Most kernel drivers will not have blob
-not have this capability, and can safely omit the event.
+capability, and can safely omit the event.
+ABS_MT_TRACKING_ID
+The TRACKING_ID identifies an initiated contact throughout its life cycle
+[5]. There are currently only a few devices that support it, so this event
+should normally be omitted.
+Event Computation
+-----------------
+The flora of different hardware unavoidably leads to some devices fitting
+better to the MT protocol than others. To simplify and unify the mapping,
+this section gives recipes for how to compute certain events.
+For devices reporting contacts as rectangular shapes, signed orientation
+cannot be obtained. Assuming X and Y are the lengths of the sides of the
+touching rectangle, here is a simple formula that retains the most
+information possible:
+   ABS_MT_TOUCH_MAJOR := max(X, Y)
+   ABS_MT_TOUCH_MINOR := min(X, Y)
+   ABS_MT_ORIENTATION := bool(X > Y)
+The range of ABS_MT_ORIENTATION should be set to [0, 1], to indicate that
+the device can distinguish between a finger along the Y axis (0) and a
+finger along the X axis (1).
 Finger Tracking
@@ -109,14 +158,18 @@ The kernel driver should generate an arbitrary enumeration of the set of
 anonymous contacts currently on the surface. The order in which the packets
 appear in the event stream is not important.
-The process of finger tracking, i.e., to assign a unique contactID to each
+The process of finger tracking, i.e., to assign a unique trackingID to each
 initiated contact on the surface, is left to user space; preferably the
-multi-touch X driver [3]. In that driver, the contactID stays the same and
+multi-touch X driver [3]. In that driver, the trackingID stays the same and
 unique until the contact vanishes (when the finger leaves the surface). The
 problem of assigning a set of anonymous fingers to a set of identified
 fingers is a euclidian bipartite matching problem at each event update, and
 relies on a sufficiently rapid update rate.
+There are a few devices that support trackingID in hardware. User space can
+make use of these native identifiers to reduce bandwidth and cpu usage.
 Notes
 -----
@@ -136,5 +189,7 @@ could be used to derive tilt.
 time of writing (April 2009), the MT protocol is not yet merged, and the
 prototype implements finger matching, basic mouse support and two-finger
 scrolling. The project aims at improving the quality of current multi-touch
-functionality available in the synaptics X driver, and in addition
+functionality available in the Synaptics X driver, and in addition
 implement more advanced gestures.
+[4] See the section on event computation.
+[5] See the section on finger tracking.
diff --git a/Documentation/kbuild/kconfig.txt b/Documentation/kbuild/kconfig.txt
index 26a7c0a93193..849b5e56d06f 100644
--- a/Documentation/kbuild/kconfig.txt
+++ b/Documentation/kbuild/kconfig.txt
@@ -35,48 +35,26 @@ new .config files to see the differences:
 (Yes, we need something better here.)
-======================================================================
-menuconfig
--------------------------------------------------
-SEARCHING for CONFIG symbols
-Searching in menuconfig:
-        The Search function searches for kernel configuration symbol
-        names, so you have to know something close to what you are
-        looking for.
-        Example:
-                /hotplug
-                This lists all config symbols that contain "hotplug",
-                e.g., HOTPLUG, HOTPLUG_CPU, MEMORY_HOTPLUG.
-        For search help, enter / followed TAB-TAB-TAB (to highlight
-        <Help>) and Enter.  This will tell you that you can also use
-        regular expressions (regexes) in the search string, so if you
-        are not interested in MEMORY_HOTPLUG, you could try
-                /^hotplug
 ______________________________________________________________________
-Color Themes for 'menuconfig'
+Environment variables for '*config'
-It is possible to select different color themes using the variable
+KCONFIG_CONFIG
-MENUCONFIG_COLOR.  To select a theme use:
+--------------------------------------------------
+This environment variable can be used to specify a default kernel config
+file name to override the default name of ".config".
-        make MENUCONFIG_COLOR=<theme> menuconfig
+KCONFIG_OVERWRITECONFIG
+--------------------------------------------------
+If you set KCONFIG_OVERWRITECONFIG in the environment, Kconfig will not
+break symlinks when .config is a symlink to somewhere else.
-Available themes are:
+KCONFIG_NOTIMESTAMP
-  mono       => selects colors suitable for monochrome displays
+--------------------------------------------------
-  blackbg    => selects a color scheme with black background
+If this environment variable exists and is non-null, the timestamp line
-  classic    => theme with blue background. The classic look
+in generated .config files is omitted.
-  bluetitle  => a LCD friendly version of classic. (default)
 ______________________________________________________________________
-Environment variables in 'menuconfig'
+Environment variables for '{allyes/allmod/allno/rand}config'
 KCONFIG_ALLCONFIG
 --------------------------------------------------
@@ -95,8 +73,7 @@ values.
 This enables you to create "miniature" config (miniconfig) or custom
 config files containing just the config symbols that you are interested
 in.  Then the kernel config system generates the full .config file,
-including dependencies of your miniconfig file, based on the miniconfig
+including symbols of your miniconfig file.
-file.
 This 'KCONFIG_ALLCONFIG' file is a config file which contains
 (usually a subset of all) preset config symbols.  These variable
@@ -113,26 +90,14 @@ These examples will disable most options (allnoconfig) but enable or
 disable the options that are explicitly listed in the specified
 mini-config files.
+______________________________________________________________________
+Environment variables for 'silentoldconfig'
 KCONFIG_NOSILENTUPDATE
 --------------------------------------------------
 If this variable has a non-blank value, it prevents silent kernel
 config udpates (requires explicit updates).
-KCONFIG_CONFIG
--------------------------------------------------
-This environment variable can be used to specify a default kernel config
-file name to override the default name of ".config".
-KCONFIG_OVERWRITECONFIG
--------------------------------------------------
-If you set KCONFIG_OVERWRITECONFIG in the environment, Kconfig will not
-break symlinks when .config is a symlink to somewhere else.
-KCONFIG_NOTIMESTAMP
--------------------------------------------------
-If this environment variable exists and is non-null, the timestamp line
-in generated .config files is omitted.
 KCONFIG_AUTOCONFIG
 --------------------------------------------------
 This environment variable can be set to specify the path & name of the
@@ -143,15 +108,54 @@ KCONFIG_AUTOHEADER
 This environment variable can be set to specify the path & name of the
 "autoconf.h" (header) file.  Its default value is "include/linux/autoconf.h".
+======================================================================
+menuconfig
+--------------------------------------------------
+SEARCHING for CONFIG symbols
+Searching in menuconfig:
+        The Search function searches for kernel configuration symbol
+        names, so you have to know something close to what you are
+        looking for.
+        Example:
+                /hotplug
+                This lists all config symbols that contain "hotplug",
+                e.g., HOTPLUG, HOTPLUG_CPU, MEMORY_HOTPLUG.
+        For search help, enter / followed TAB-TAB-TAB (to highlight
+        <Help>) and Enter.  This will tell you that you can also use
+        regular expressions (regexes) in the search string, so if you
+        are not interested in MEMORY_HOTPLUG, you could try
+                /^hotplug
 ______________________________________________________________________
-menuconfig User Interface Options
+User interface options for 'menuconfig'
----------------------------------------------------------------------
+MENUCONFIG_COLOR
+--------------------------------------------------
+It is possible to select different color themes using the variable
+MENUCONFIG_COLOR.  To select a theme use:
+        make MENUCONFIG_COLOR=<theme> menuconfig
+Available themes are:
+  mono       => selects colors suitable for monochrome displays
+  blackbg    => selects a color scheme with black background
+  classic    => theme with blue background. The classic look
+  bluetitle  => a LCD friendly version of classic. (default)
 MENUCONFIG_MODE
 --------------------------------------------------
 This mode shows all sub-menus in one large tree.
 Example:
-        MENUCONFIG_MODE=single_menu make menuconfig
+        make MENUCONFIG_MODE=single_menu menuconfig
 ======================================================================
 xconfig
diff --git a/Documentation/kbuild/modules.txt b/Documentation/kbuild/modules.txt
index b1096da953c8..0767cf69c69e 100644
--- a/Documentation/kbuild/modules.txt
+++ b/Documentation/kbuild/modules.txt
@@ -275,7 +275,7 @@ following files:
                KERNELDIR := /lib/modules/`uname -r`/build
                all::
-                        $(MAKE) -C $KERNELDIR M=`pwd` $@
+                        $(MAKE) -C $(KERNELDIR) M=`pwd` $@
                # Module specific targets
                genbin:
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 3f4bc840da8b..cab61d842259 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -108,7 +108,7 @@ There are two possible methods of using Kdump.
 2) Or use the system kernel binary itself as dump-capture kernel and there is
   no need to build a separate dump-capture kernel. This is possible
-   only with the architecutres which support a relocatable kernel. As
+   only with the architectures which support a relocatable kernel. As
   of today, i386, x86_64, ppc64 and ia64 architectures support relocatable
   kernel.
@@ -222,7 +222,7 @@ Dump-capture kernel config options (Arch Dependent, ia64)
 ----------------------------------------------------------
 - No specific options are required to create a dump-capture kernel
-  for ia64, other than those specified in the arch idependent section
+  for ia64, other than those specified in the arch independent section
  above. This means that it is possible to use the system kernel
  as a dump-capture kernel if desired.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e87bdbfbcc75..5f66ba295c5d 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -56,7 +56,6 @@ parameter is applicable:
        ISAPNP  ISA PnP code is enabled.
        ISDN    Appropriate ISDN support is enabled.
        JOY     Appropriate joystick support is enabled.
-        KMEMTRACE kmemtrace is enabled.
        LIBATA  Libata driver is enabled
        LP      Printer support is enabled.
        LOOP    Loopback device support is enabled.
@@ -329,11 +328,6 @@ and is between 256 and 4096 characters. It is defined in the file
                                    flushed before they will be reused, which
                                    is a lot of faster
-        amd_iommu_size= [HW,X86-64]
-                        Define the size of the aperture for the AMD IOMMU
-                        driver. Possible values are:
-                        '32M', '64M' (default), '128M', '256M', '512M', '1G'
        amijoy.map=     [HW,JOY] Amiga joystick support
                        Map of devices attached to JOY0DAT and JOY1DAT
                        Format: <a>,<b>
@@ -646,6 +640,13 @@ and is between 256 and 4096 characters. It is defined in the file
                        DMA-API debugging code disables itself because the
                        architectural default is too low.
+        dma_debug_driver=<driver_name>
+                        With this option the DMA-API debugging driver
+                        filter feature can be enabled at boot time. Just
+                        pass the driver to filter for as the parameter.
+                        The filter can be disabled or changed to another
+                        driver later using sysfs.
        dscc4.setup=    [NET]
        dtc3181e=       [HW,SCSI]
@@ -752,12 +753,25 @@ and is between 256 and 4096 characters. It is defined in the file
                        ia64_pal_cache_flush instead of SAL_CACHE_FLUSH.
        ftrace=[tracer]
-                        [ftrace] will set and start the specified tracer
+                        [FTRACE] will set and start the specified tracer
                        as early as possible in order to facilitate early
                        boot debugging.
        ftrace_dump_on_oops
-                        [ftrace] will dump the trace buffers on oops.
+                        [FTRACE] will dump the trace buffers on oops.
+        ftrace_filter=[function-list]
+                        [FTRACE] Limit the functions traced by the function
+                        tracer at boot up. function-list is a comma separated
+                        list of functions. This list can be changed at run
+                        time by the set_ftrace_filter file in the debugfs
+                        tracing directory. 
+        ftrace_notrace=[function-list]
+                        [FTRACE] Do not trace the functions specified in
+                        function-list. This list can be changed at run time
+                        by the set_ftrace_notrace file in the debugfs
+                        tracing directory.
        gamecon.map[2|3]=
                        [HW,JOY] Multisystem joystick and NES/SNES/PSX pad
@@ -873,11 +887,8 @@ and is between 256 and 4096 characters. It is defined in the file
        ide-core.nodma= [HW] (E)IDE subsystem
                        Format: =0.0 to prevent dma on hda, =0.1 hdb =1.0 hdc
-                        .vlb_clock .pci_clock .noflush .noprobe .nowerr .cdrom
+                        .vlb_clock .pci_clock .noflush .nohpa .noprobe .nowerr
-                        .chs .ignore_cable are additional options
+                        .cdrom .chs .ignore_cable are additional options
-                        See Documentation/ide/ide.txt.
-        idebus=         [HW] (E)IDE subsystem - VLB/PCI bus speed
                        See Documentation/ide/ide.txt.
        ide-pci-generic.all-generic-ide [HW] (E)IDE subsystem
@@ -914,6 +925,12 @@ and is between 256 and 4096 characters. It is defined in the file
                        Formt: { "sha1" | "md5" }
                        default: "sha1"
+        ima_tcb         [IMA]
+                        Load a policy which meets the needs of the Trusted
+                        Computing Base.  This means IMA will measure all
+                        programs exec'd, files mmap'd for exec, and all files
+                        opened for read by uid=0.
        in2000=         [HW,SCSI]
                        See header of drivers/scsi/in2000.c.
@@ -1054,24 +1071,19 @@ and is between 256 and 4096 characters. It is defined in the file
                        use the HighMem zone if it exists, and the Normal
                        zone if it does not.
-        kmemtrace.enable=       [KNL,KMEMTRACE] Format: { yes | no }
-                                Controls whether kmemtrace is enabled
-                                at boot-time.
-        kmemtrace.subbufs=n     [KNL,KMEMTRACE] Overrides the number of
-                        subbufs kmemtrace's relay channel has. Set this
-                        higher than default (KMEMTRACE_N_SUBBUFS in code) if
-                        you experience buffer overruns.
        kgdboc=         [HW] kgdb over consoles.
                        Requires a tty driver that supports console polling.
-                        (only serial suported for now)
+                        (only serial supported for now)
                        Format: <serial_device>[,baud]
        kmac=           [MIPS] korina ethernet MAC address.
                        Configure the RouterBoard 532 series on-chip
                        Ethernet adapter MAC address.
+        kmemleak=       [KNL] Boot-time kmemleak enable/disable
+                        Valid arguments: on, off
+                        Default: on
        kstack=N        [X86] Print N words from the kernel stack
                        in oops dumps.
@@ -1390,7 +1402,7 @@ and is between 256 and 4096 characters. It is defined in the file
                        ('y', default) or cooked coordinates ('n')
        mtrr_chunk_size=nn[KMG] [X86]
-                        used for mtrr cleanup. It is largest continous chunk
+                        used for mtrr cleanup. It is largest continuous chunk
                        that could hold holes aka. UC entries.
        mtrr_gran_size=nn[KMG] [X86]
@@ -1535,6 +1547,10 @@ and is between 256 and 4096 characters. It is defined in the file
                        register save and restore. The kernel will only save
                        legacy floating-point registers on task switch.
+        noxsave         [BUGS=X86] Disables x86 extended register state save
+                        and restore using xsave. The kernel will fallback to
+                        enabling legacy floating-point and sse state.
        nohlt           [BUGS=ARM,SH] Tells the kernel that the sleep(SH) or
                        wfi(ARM) instruction doesn't work correctly and not to
                        use it. This is also useful when using JTAG debugger.
@@ -1571,6 +1587,9 @@ and is between 256 and 4096 characters. It is defined in the file
        noinitrd        [RAM] Tells the kernel not to load any configured
                        initial RAM disk.
+        nointremap      [X86-64, Intel-IOMMU] Do not enable interrupt
+                        remapping.
        nointroute      [IA-64]
        nojitter        [IA64] Disables jitter checking for ITC timers.
@@ -1656,6 +1675,14 @@ and is between 256 and 4096 characters. It is defined in the file
        oprofile.timer= [HW]
                        Use timer interrupt instead of performance counters
+        oprofile.cpu_type=      Force an oprofile cpu type
+                        This might be useful if you have an older oprofile
+                        userland or if you want common events.
+                        Format: { archperfmon }
+                        archperfmon: [X86] Force use of architectural
+                                perfmon on Intel CPUs instead of the
+                                CPU specific event set.
        osst=           [HW,SCSI] SCSI Tape Driver
                        Format: <buffer_size>,<write_threshold>
                        See also Documentation/scsi/st.txt.
diff --git a/Documentation/kmemleak.txt b/Documentation/kmemleak.txt
new file mode 100644
index 000000000000..0112da3b9ab8
--- /dev/null
+++ b/Documentation/kmemleak.txt
@@ -0,0 +1,142 @@
+Kernel Memory Leak Detector
+===========================
+Introduction
+------------
+Kmemleak provides a way of detecting possible kernel memory leaks in a
+way similar to a tracing garbage collector
+(http://en.wikipedia.org/wiki/Garbage_collection_%28computer_science%29#Tracing_garbage_collectors),
+with the difference that the orphan objects are not freed but only
+reported via /sys/kernel/debug/kmemleak. A similar method is used by the
+Valgrind tool (memcheck --leak-check) to detect the memory leaks in
+user-space applications.
+Usage
+-----
+CONFIG_DEBUG_KMEMLEAK in "Kernel hacking" has to be enabled. A kernel
+thread scans the memory every 10 minutes (by default) and prints any new
+unreferenced objects found. To trigger an intermediate scan and display
+all the possible memory leaks:
+  # mount -t debugfs nodev /sys/kernel/debug/
+  # cat /sys/kernel/debug/kmemleak
+Note that the orphan objects are listed in the order they were allocated
+and one object at the beginning of the list may cause other subsequent
+objects to be reported as orphan.
+Memory scanning parameters can be modified at run-time by writing to the
+/sys/kernel/debug/kmemleak file. The following parameters are supported:
+  off           - disable kmemleak (irreversible)
+  stack=on      - enable the task stacks scanning
+  stack=off     - disable the tasks stacks scanning
+  scan=on       - start the automatic memory scanning thread
+  scan=off      - stop the automatic memory scanning thread
+  scan=<secs>   - set the automatic memory scanning period in seconds (0
+                  to disable it)
+Kmemleak can also be disabled at boot-time by passing "kmemleak=off" on
+the kernel command line.
+Basic Algorithm
+---------------
+The memory allocations via kmalloc, vmalloc, kmem_cache_alloc and
+friends are traced and the pointers, together with additional
+information like size and stack trace, are stored in a prio search tree.
+The corresponding freeing function calls are tracked and the pointers
+removed from the kmemleak data structures.
+An allocated block of memory is considered orphan if no pointer to its
+start address or to any location inside the block can be found by
+scanning the memory (including saved registers). This means that there
+might be no way for the kernel to pass the address of the allocated
+block to a freeing function and therefore the block is considered a
+memory leak.
+The scanning algorithm steps:
+  1. mark all objects as white (remaining white objects will later be
+     considered orphan)
+  2. scan the memory starting with the data section and stacks, checking
+     the values against the addresses stored in the prio search tree. If
+     a pointer to a white object is found, the object is added to the
+     gray list
+  3. scan the gray objects for matching addresses (some white objects
+     can become gray and added at the end of the gray list) until the
+     gray set is finished
+  4. the remaining white objects are considered orphan and reported via
+     /sys/kernel/debug/kmemleak
+Some allocated memory blocks have pointers stored in the kernel's
+internal data structures and they cannot be detected as orphans. To
+avoid this, kmemleak can also store the number of values pointing to an
+address inside the block address range that need to be found so that the
+block is not considered a leak. One example is __vmalloc().
+Kmemleak API
+------------
+See the include/linux/kmemleak.h header for the functions prototype.
+kmemleak_init            - initialize kmemleak
+kmemleak_alloc           - notify of a memory block allocation
+kmemleak_free            - notify of a memory block freeing
+kmemleak_not_leak        - mark an object as not a leak
+kmemleak_ignore          - do not scan or report an object as leak
+kmemleak_scan_area       - add scan areas inside a memory block
+kmemleak_no_scan         - do not scan a memory block
+kmemleak_erase           - erase an old value in a pointer variable
+kmemleak_alloc_recursive - as kmemleak_alloc but checks the recursiveness
+kmemleak_free_recursive  - as kmemleak_free but checks the recursiveness
+Dealing with false positives/negatives
+--------------------------------------
+The false negatives are real memory leaks (orphan objects) but not
+reported by kmemleak because values found during the memory scanning
+point to such objects. To reduce the number of false negatives, kmemleak
+provides the kmemleak_ignore, kmemleak_scan_area, kmemleak_no_scan and
+kmemleak_erase functions (see above). The task stacks also increase the
+amount of false negatives and their scanning is not enabled by default.
+The false positives are objects wrongly reported as being memory leaks
+(orphan). For objects known not to be leaks, kmemleak provides the
+kmemleak_not_leak function. The kmemleak_ignore could also be used if
+the memory block is known not to contain other pointers and it will no
+longer be scanned.
+Some of the reported leaks are only transient, especially on SMP
+systems, because of pointers temporarily stored in CPU registers or
+stacks. Kmemleak defines MSECS_MIN_AGE (defaulting to 1000) representing
+the minimum age of an object to be reported as a memory leak.
+Limitations and Drawbacks
+-------------------------
+The main drawback is the reduced performance of memory allocation and
+freeing. To avoid other penalties, the memory scanning is only performed
+when the /sys/kernel/debug/kmemleak file is read. Anyway, this tool is
+intended for debugging purposes where the performance might not be the
+most important requirement.
+To keep the algorithm simple, kmemleak scans for values pointing to any
+address inside a block's address range. This may lead to an increased
+number of false negatives. However, it is likely that a real memory leak
+will eventually become visible.
+Another source of false negatives is the data stored in non-pointer
+values. In a future version, kmemleak could only scan the pointer
+members in the allocated structures. This feature would solve many of
+the false negative cases described above.
+The tool can report false positives. These are cases where an allocated
+block doesn't need to be freed (some cases in the init_call functions),
+the pointer is calculated by other methods than the usual container_of
+macro or the pointer is stored in a location not scanned by kmemleak.
+Page allocations and ioremap are not tracked. Only the ARM and x86
+architectures are currently supported.
diff --git a/Documentation/kobject.txt b/Documentation/kobject.txt
index b2e374586bd8..c79ab996dada 100644
--- a/Documentation/kobject.txt
+++ b/Documentation/kobject.txt
@@ -132,7 +132,7 @@ kobject_name():
    const char *kobject_name(const struct kobject * kobj);
 There is a helper function to both initialize and add the kobject to the
-kernel at the same time, called supprisingly enough kobject_init_and_add():
+kernel at the same time, called surprisingly enough kobject_init_and_add():
    int kobject_init_and_add(struct kobject *kobj, struct kobj_type *ktype,
                             struct kobject *parent, const char *fmt, ...);
diff --git a/Documentation/laptops/acer-wmi.txt b/Documentation/laptops/acer-wmi.txt
index 5ee2a02b3b40..0768fcc3ba3e 100644
--- a/Documentation/laptops/acer-wmi.txt
+++ b/Documentation/laptops/acer-wmi.txt
@@ -40,7 +40,7 @@ NOTE: The Acer Aspire One is not supported hardware. It cannot work with
 acer-wmi until Acer fix their ACPI-WMI implementation on them, so has been
 blacklisted until that happens.
-Please see the website for the current list of known working hardare:
+Please see the website for the current list of known working hardware:
 http://code.google.com/p/aceracpi/wiki/SupportedHardware
diff --git a/Documentation/laptops/sony-laptop.txt b/Documentation/laptops/sony-laptop.txt
index 8b2bc1572d98..23ce7d350d1a 100644
--- a/Documentation/laptops/sony-laptop.txt
+++ b/Documentation/laptops/sony-laptop.txt
@@ -22,7 +22,7 @@ If your laptop model supports it, you will find sysfs files in the
 /sys/class/backlight/sony/
 directory. You will be able to query and set the current screen
 brightness:
-        brightness              get/set screen brightness (an iteger
+        brightness              get/set screen brightness (an integer
                                between 0 and 7)
        actual_brightness       reading from this file will query the HW
                                to get real brightness value
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index e7e9a69069e1..78e354b42f67 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -506,7 +506,7 @@ generate input device EV_KEY events.
 In addition to the EV_KEY events, thinkpad-acpi may also issue EV_SW
 events for switches:
-SW_RFKILL_ALL   T60 and later hardare rfkill rocker switch
+SW_RFKILL_ALL   T60 and later hardware rfkill rocker switch
 SW_TABLET_MODE  Tablet ThinkPads HKEY events 0x5009 and 0x500A
 Non hot-key ACPI HKEY event map:
diff --git a/Documentation/lguest/Makefile b/Documentation/lguest/Makefile
index 1f4f9e888bd1..28c8cdfcafd8 100644
--- a/Documentation/lguest/Makefile
+++ b/Documentation/lguest/Makefile
@@ -1,6 +1,5 @@
 # This creates the demonstration utility "lguest" which runs a Linux guest.
-CFLAGS:=-Wall -Wmissing-declarations -Wmissing-prototypes -O3 -I../../include -I../../arch/x86/include -U_FORTIFY_SOURCE
+CFLAGS:=-m32 -Wall -Wmissing-declarations -Wmissing-prototypes -O3 -I../../include -I../../arch/x86/include -U_FORTIFY_SOURCE
-LDLIBS:=-lz
 all: lguest
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index d36fcc0f2715..9ebcd6ef361b 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -16,6 +16,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
+#include <sys/eventfd.h>
 #include <fcntl.h>
 #include <stdbool.h>
 #include <errno.h>
@@ -59,7 +60,6 @@ typedef uint8_t u8;
 /*:*/
 #define PAGE_PRESENT 0x7        /* Present, RW, Execute */
-#define NET_PEERNUM 1
 #define BRIDGE_PFX "bridge:"
 #ifndef SIOCBRADDIF
 #define SIOCBRADDIF     0x89a2          /* add interface to bridge      */
@@ -76,19 +76,12 @@ static bool verbose;
        do { if (verbose) printf(args); } while(0)
 /*:*/
-/* File descriptors for the Waker. */
-struct {
-        int pipe[2];
-        int lguest_fd;
-} waker_fds;
 /* The pointer to the start of guest memory. */
 static void *guest_base;
 /* The maximum guest physical address allowed, and maximum possible. */
 static unsigned long guest_limit, guest_max;
-/* The pipe for signal hander to write to. */
+/* The /dev/lguest file descriptor. */
-static int timeoutpipe[2];
+static int lguest_fd;
-static unsigned int timeout_usec = 500;
 /* a per-cpu variable indicating whose vcpu is currently running */
 static unsigned int __thread cpu_id;
@@ -96,11 +89,6 @@ static unsigned int __thread cpu_id;
 /* This is our list of devices. */
 struct device_list
 {
-        /* Summary information about the devices in our list: ready to pass to
-         * select() to ask which need servicing.*/
-        fd_set infds;
-        int max_infd;
        /* Counter to assign interrupt numbers. */
        unsigned int next_irq;
@@ -126,22 +114,21 @@ struct device
        /* The linked-list pointer. */
        struct device *next;
-        /* The this device's descriptor, as mapped into the Guest. */
+        /* The device's descriptor, as mapped into the Guest. */
        struct lguest_device_desc *desc;
+        /* We can't trust desc values once Guest has booted: we use these. */
+        unsigned int feature_len;
+        unsigned int num_vq;
        /* The name of this device, for --verbose. */
        const char *name;
-        /* If handle_input is set, it wants to be called when this file
-         * descriptor is ready. */
-        int fd;
-        bool (*handle_input)(int fd, struct device *me);
        /* Any queues attached to this device */
        struct virtqueue *vq;
-        /* Handle status being finalized (ie. feature bits stable). */
+        /* Is it operational */
-        void (*ready)(struct device *me);
+        bool running;
        /* Device-specific data. */
        void *priv;
@@ -164,22 +151,28 @@ struct virtqueue
        /* Last available index we saw. */
        u16 last_avail_idx;
-        /* The routine to call when the Guest pings us, or timeout. */
+        /* How many are used since we sent last irq? */
-        void (*handle_output)(int fd, struct virtqueue *me, bool timeout);
+        unsigned int pending_used;
-        /* Outstanding buffers */
+        /* Eventfd where Guest notifications arrive. */
-        unsigned int inflight;
+        int eventfd;
-        /* Is this blocked awaiting a timer? */
+        /* Function for the thread which is servicing this virtqueue. */
-        bool blocked;
+        void (*service)(struct virtqueue *vq);
+        pid_t thread;
 };
 /* Remember the arguments to the program so we can "reboot" */
 static char **main_args;
-/* Since guest is UP and we don't run at the same time, we don't need barriers.
+/* The original tty settings to restore on exit. */
- * But I include them in the code in case others copy it. */
+static struct termios orig_term;
-#define wmb()
+/* We have to be careful with barriers: our devices are all run in separate
+ * threads and so we need to make sure that changes visible to the Guest happen
+ * in precise order. */
+#define wmb() __asm__ __volatile__("" : : : "memory")
+#define mb() __asm__ __volatile__("" : : : "memory")
 /* Convert an iovec element to the given type.
 *
@@ -245,7 +238,7 @@ static void iov_consume(struct iovec iov[], unsigned num_iov, unsigned len)
 static u8 *get_feature_bits(struct device *dev)
 {
        return (u8 *)(dev->desc + 1)
-                + dev->desc->num_vq * sizeof(struct lguest_vqconfig);
+                + dev->num_vq * sizeof(struct lguest_vqconfig);
 }
 /*L:100 The Launcher code itself takes us out into userspace, that scary place
@@ -505,99 +498,19 @@ static void concat(char *dst, char *args[])
 * saw the arguments it expects when we looked at initialize() in lguest_user.c:
 * the base of Guest "physical" memory, the top physical page to allow and the
 * entry point for the Guest. */
-static int tell_kernel(unsigned long start)
+static void tell_kernel(unsigned long start)
 {
        unsigned long args[] = { LHREQ_INITIALIZE,
                                 (unsigned long)guest_base,
                                 guest_limit / getpagesize(), start };
-        int fd;
        verbose("Guest: %p - %p (%#lx)\n",
                guest_base, guest_base + guest_limit, guest_limit);
-        fd = open_or_die("/dev/lguest", O_RDWR);
+        lguest_fd = open_or_die("/dev/lguest", O_RDWR);
-        if (write(fd, args, sizeof(args)) < 0)
+        if (write(lguest_fd, args, sizeof(args)) < 0)
                err(1, "Writing to /dev/lguest");
-        /* We return the /dev/lguest file descriptor to control this Guest */
-        return fd;
 }
 /*:*/
-static void add_device_fd(int fd)
-{
-        FD_SET(fd, &devices.infds);
-        if (fd > devices.max_infd)
-                devices.max_infd = fd;
-}
-/*L:200
- * The Waker.
- *
- * With console, block and network devices, we can have lots of input which we
- * need to process.  We could try to tell the kernel what file descriptors to
- * watch, but handing a file descriptor mask through to the kernel is fairly
- * icky.
- *
- * Instead, we clone off a thread which watches the file descriptors and writes
- * the LHREQ_BREAK command to the /dev/lguest file descriptor to tell the Host
- * stop running the Guest.  This causes the Launcher to return from the
- * /dev/lguest read with -EAGAIN, where it will write to /dev/lguest to reset
- * the LHREQ_BREAK and wake us up again.
- *
- * This, of course, is merely a different *kind* of icky.
- *
- * Given my well-known antipathy to threads, I'd prefer to use processes.  But
- * it's easier to share Guest memory with threads, and trivial to share the
- * devices.infds as the Launcher changes it.
- */
-static int waker(void *unused)
-{
-        /* Close the write end of the pipe: only the Launcher has it open. */
-        close(waker_fds.pipe[1]);
-        for (;;) {
-                fd_set rfds = devices.infds;
-                unsigned long args[] = { LHREQ_BREAK, 1 };
-                unsigned int maxfd = devices.max_infd;
-                /* We also listen to the pipe from the Launcher. */
-                FD_SET(waker_fds.pipe[0], &rfds);
-                if (waker_fds.pipe[0] > maxfd)
-                        maxfd = waker_fds.pipe[0];
-                /* Wait until input is ready from one of the devices. */
-                select(maxfd+1, &rfds, NULL, NULL, NULL);
-                /* Message from Launcher? */
-                if (FD_ISSET(waker_fds.pipe[0], &rfds)) {
-                        char c;
-                        /* If this fails, then assume Launcher has exited.
-                         * Don't do anything on exit: we're just a thread! */
-                        if (read(waker_fds.pipe[0], &c, 1) != 1)
-                                _exit(0);
-                        continue;
-                }
-                /* Send LHREQ_BREAK command to snap the Launcher out of it. */
-                pwrite(waker_fds.lguest_fd, args, sizeof(args), cpu_id);
-        }
-        return 0;
-}
-/* This routine just sets up a pipe to the Waker process. */
-static void setup_waker(int lguest_fd)
-{
-        /* This pipe is closed when Launcher dies, telling Waker. */
-        if (pipe(waker_fds.pipe) != 0)
-                err(1, "Creating pipe for Waker");
-        /* Waker also needs to know the lguest fd */
-        waker_fds.lguest_fd = lguest_fd;
-        if (clone(waker, malloc(4096) + 4096, CLONE_VM | SIGCHLD, NULL) == -1)
-                err(1, "Creating Waker");
-}
 /*
 * Device Handling.
 *
@@ -623,49 +536,90 @@ static void *_check_pointer(unsigned long addr, unsigned int size,
 /* Each buffer in the virtqueues is actually a chain of descriptors.  This
 * function returns the next descriptor in the chain, or vq->vring.num if we're
 * at the end. */
-static unsigned next_desc(struct virtqueue *vq, unsigned int i)
+static unsigned next_desc(struct vring_desc *desc,
+                          unsigned int i, unsigned int max)
 {
        unsigned int next;
        /* If this descriptor says it doesn't chain, we're done. */
-        if (!(vq->vring.desc[i].flags & VRING_DESC_F_NEXT))
+        if (!(desc[i].flags & VRING_DESC_F_NEXT))
-                return vq->vring.num;
+                return max;
        /* Check they're not leading us off end of descriptors. */
-        next = vq->vring.desc[i].next;
+        next = desc[i].next;
        /* Make sure compiler knows to grab that: we don't want it changing! */
        wmb();
-        if (next >= vq->vring.num)
+        if (next >= max)
                errx(1, "Desc next is %u", next);
        return next;
 }
+/* This actually sends the interrupt for this virtqueue */
+static void trigger_irq(struct virtqueue *vq)
+{
+        unsigned long buf[] = { LHREQ_IRQ, vq->config.irq };
+        /* Don't inform them if nothing used. */
+        if (!vq->pending_used)
+                return;
+        vq->pending_used = 0;
+        /* If they don't want an interrupt, don't send one, unless empty. */
+        if ((vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT)
+            && lg_last_avail(vq) != vq->vring.avail->idx)
+                return;
+        /* Send the Guest an interrupt tell them we used something up. */
+        if (write(lguest_fd, buf, sizeof(buf)) != 0)
+                err(1, "Triggering irq %i", vq->config.irq);
+}
 /* This looks in the virtqueue and for the first available buffer, and converts
 * it to an iovec for convenient access.  Since descriptors consist of some
 * number of output then some number of input descriptors, it's actually two
 * iovecs, but we pack them into one and note how many of each there were.
 *
- * This function returns the descriptor number found, or vq->vring.num (which
+ * This function returns the descriptor number found. */
- * is never a valid descriptor number) if none was found. */
+static unsigned wait_for_vq_desc(struct virtqueue *vq,
-static unsigned get_vq_desc(struct virtqueue *vq,
+                                 struct iovec iov[],
-                            struct iovec iov[],
+                                 unsigned int *out_num, unsigned int *in_num)
-                            unsigned int *out_num, unsigned int *in_num)
 {
-        unsigned int i, head;
+        unsigned int i, head, max;
-        u16 last_avail;
+        struct vring_desc *desc;
+        u16 last_avail = lg_last_avail(vq);
+        while (last_avail == vq->vring.avail->idx) {
+                u64 event;
+                /* OK, tell Guest about progress up to now. */
+                trigger_irq(vq);
+                /* OK, now we need to know about added descriptors. */
+                vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
+                /* They could have slipped one in as we were doing that: make
+                 * sure it's written, then check again. */
+                mb();
+                if (last_avail != vq->vring.avail->idx) {
+                        vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
+                        break;
+                }
+                /* Nothing new?  Wait for eventfd to tell us they refilled. */
+                if (read(vq->eventfd, &event, sizeof(event)) != sizeof(event))
+                        errx(1, "Event read failed?");
+                /* We don't need to be notified again. */
+                vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
+        }
        /* Check it isn't doing very strange things with descriptor numbers. */
-        last_avail = lg_last_avail(vq);
        if ((u16)(vq->vring.avail->idx - last_avail) > vq->vring.num)
                errx(1, "Guest moved used index from %u to %u",
                     last_avail, vq->vring.avail->idx);
-        /* If there's nothing new since last we looked, return invalid. */
-        if (vq->vring.avail->idx == last_avail)
-                return vq->vring.num;
        /* Grab the next descriptor number they're advertising, and increment
         * the index we've seen. */
        head = vq->vring.avail->ring[last_avail % vq->vring.num];
@@ -678,15 +632,28 @@ static unsigned get_vq_desc(struct virtqueue *vq,
        /* When we start there are none of either input nor output. */
        *out_num = *in_num = 0;
+        max = vq->vring.num;
+        desc = vq->vring.desc;
        i = head;
+        /* If this is an indirect entry, then this buffer contains a descriptor
+         * table which we handle as if it's any normal descriptor chain. */
+        if (desc[i].flags & VRING_DESC_F_INDIRECT) {
+                if (desc[i].len % sizeof(struct vring_desc))
+                        errx(1, "Invalid size for indirect buffer table");
+                max = desc[i].len / sizeof(struct vring_desc);
+                desc = check_pointer(desc[i].addr, desc[i].len);
+                i = 0;
+        }
        do {
                /* Grab the first descriptor, and check it's OK. */
-                iov[*out_num + *in_num].iov_len = vq->vring.desc[i].len;
+                iov[*out_num + *in_num].iov_len = desc[i].len;
                iov[*out_num + *in_num].iov_base
-                        = check_pointer(vq->vring.desc[i].addr,
+                        = check_pointer(desc[i].addr, desc[i].len);
-                                        vq->vring.desc[i].len);
                /* If this is an input descriptor, increment that count. */
-                if (vq->vring.desc[i].flags & VRING_DESC_F_WRITE)
+                if (desc[i].flags & VRING_DESC_F_WRITE)
                        (*in_num)++;
                else {
                        /* If it's an output descriptor, they're all supposed
@@ -697,11 +664,10 @@ static unsigned get_vq_desc(struct virtqueue *vq,
                }
                /* If we've got too many, that implies a descriptor loop. */
-                if (*out_num + *in_num > vq->vring.num)
+                if (*out_num + *in_num > max)
                        errx(1, "Looped descriptor");
-        } while ((i = next_desc(vq, i)) != vq->vring.num);
+        } while ((i = next_desc(desc, i, max)) != max);
-        vq->inflight++;
        return head;
 }
@@ -719,44 +685,20 @@ static void add_used(struct virtqueue *vq, unsigned int head, int len)
        /* Make sure buffer is written before we update index. */
        wmb();
        vq->vring.used->idx++;
-        vq->inflight--;
+        vq->pending_used++;
-}
-/* This actually sends the interrupt for this virtqueue */
-static void trigger_irq(int fd, struct virtqueue *vq)
-{
-        unsigned long buf[] = { LHREQ_IRQ, vq->config.irq };
-        /* If they don't want an interrupt, don't send one, unless empty. */
-        if ((vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT)
-            && vq->inflight)
-                return;
-        /* Send the Guest an interrupt tell them we used something up. */
-        if (write(fd, buf, sizeof(buf)) != 0)
-                err(1, "Triggering irq %i", vq->config.irq);
 }
 /* And here's the combo meal deal.  Supersize me! */
-static void add_used_and_trigger(int fd, struct virtqueue *vq,
+static void add_used_and_trigger(struct virtqueue *vq, unsigned head, int len)
-                                 unsigned int head, int len)
 {
        add_used(vq, head, len);
-        trigger_irq(fd, vq);
+        trigger_irq(vq);
 }
 /*
 * The Console
 *
- * Here is the input terminal setting we save, and the routine to restore them
+ * We associate some data with the console for our exit hack. */
- * on exit so the user gets their terminal back. */
-static struct termios orig_term;
-static void restore_term(void)
-{
-        tcsetattr(STDIN_FILENO, TCSANOW, &orig_term);
-}
-/* We associate some data with the console for our exit hack. */
 struct console_abort
 {
        /* How many times have they hit ^C? */
@@ -766,276 +708,275 @@ struct console_abort
 };
 /* This is the routine which handles console input (ie. stdin). */
-static bool handle_console_input(int fd, struct device *dev)
+static void console_input(struct virtqueue *vq)
 {
        int len;
        unsigned int head, in_num, out_num;
-        struct iovec iov[dev->vq->vring.num];
+        struct console_abort *abort = vq->dev->priv;
-        struct console_abort *abort = dev->priv;
+        struct iovec iov[vq->vring.num];
-        /* First we need a console buffer from the Guests's input virtqueue. */
-        head = get_vq_desc(dev->vq, iov, &out_num, &in_num);
-        /* If they're not ready for input, stop listening to this file
-         * descriptor.  We'll start again once they add an input buffer. */
-        if (head == dev->vq->vring.num)
-                return false;
+        /* Make sure there's a descriptor waiting. */
+        head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
        if (out_num)
                errx(1, "Output buffers in console in queue?");
-        /* This is why we convert to iovecs: the readv() call uses them, and so
+        /* Read it in. */
-         * it reads straight into the Guest's buffer. */
+        len = readv(STDIN_FILENO, iov, in_num);
-        len = readv(dev->fd, iov, in_num);
        if (len <= 0) {
-                /* This implies that the console is closed, is /dev/null, or
+                /* Ran out of input? */
-                 * something went terribly wrong. */
                warnx("Failed to get console input, ignoring console.");
-                /* Put the input terminal back. */
+                /* For simplicity, dying threads kill the whole Launcher.  So
-                restore_term();
+                 * just nap here. */
-                /* Remove callback from input vq, so it doesn't restart us. */
+                for (;;)
-                dev->vq->handle_output = NULL;
+                        pause();
-                /* Stop listening to this fd: don't call us again. */
-                return false;
        }
-        /* Tell the Guest about the new input. */
+        add_used_and_trigger(vq, head, len);
-        add_used_and_trigger(fd, dev->vq, head, len);
        /* Three ^C within one second?  Exit.
         *
-         * This is such a hack, but works surprisingly well.  Each ^C has to be
+         * This is such a hack, but works surprisingly well.  Each ^C has to
-         * in a buffer by itself, so they can't be too fast.  But we check that
+         * be in a buffer by itself, so they can't be too fast.  But we check
-         * we get three within about a second, so they can't be too slow. */
+         * that we get three within about a second, so they can't be too
-        if (len == 1 && ((char *)iov[0].iov_base)[0] == 3) {
+         * slow. */
-                if (!abort->count++)
+        if (len != 1 || ((char *)iov[0].iov_base)[0] != 3) {
-                        gettimeofday(&abort->start, NULL);
-                else if (abort->count == 3) {
-                        struct timeval now;
-                        gettimeofday(&now, NULL);
-                        if (now.tv_sec <= abort->start.tv_sec+1) {
-                                unsigned long args[] = { LHREQ_BREAK, 0 };
-                                /* Close the fd so Waker will know it has to
-                                 * exit. */
-                                close(waker_fds.pipe[1]);
-                                /* Just in case Waker is blocked in BREAK, send
-                                 * unbreak now. */
-                                write(fd, args, sizeof(args));
-                                exit(2);
-                        }
-                        abort->count = 0;
-                }
-        } else
-                /* Any other key resets the abort counter. */
                abort->count = 0;
+                return;
+        }
-        /* Everything went OK! */
+        abort->count++;
-        return true;
+        if (abort->count == 1)
+                gettimeofday(&abort->start, NULL);
+        else if (abort->count == 3) {
+                struct timeval now;
+                gettimeofday(&now, NULL);
+                /* Kill all Launcher processes with SIGINT, like normal ^C */
+                if (now.tv_sec <= abort->start.tv_sec+1)
+                        kill(0, SIGINT);
+                abort->count = 0;
+        }
 }
-/* Handling output for console is simple: we just get all the output buffers
+/* This is the routine which handles console output (ie. stdout). */
- * and write them to stdout. */
+static void console_output(struct virtqueue *vq)
-static void handle_console_output(int fd, struct virtqueue *vq, bool timeout)
 {
        unsigned int head, out, in;
-        int len;
        struct iovec iov[vq->vring.num];
-        /* Keep getting output buffers from the Guest until we run out. */
+        head = wait_for_vq_desc(vq, iov, &out, &in);
-        while ((head = get_vq_desc(vq, iov, &out, &in)) != vq->vring.num) {
+        if (in)
-                if (in)
+                errx(1, "Input buffers in console output queue?");
-                        errx(1, "Input buffers in output queue?");
+        while (!iov_empty(iov, out)) {
-                len = writev(STDOUT_FILENO, iov, out);
+                int len = writev(STDOUT_FILENO, iov, out);
-                add_used_and_trigger(fd, vq, head, len);
+                if (len <= 0)
+                        err(1, "Write to stdout gave %i", len);
+                iov_consume(iov, out, len);
        }
-}
+        add_used(vq, head, 0);
-/* This is called when we no longer want to hear about Guest changes to a
- * virtqueue.  This is more efficient in high-traffic cases, but it means we
- * have to set a timer to check if any more changes have occurred. */
-static void block_vq(struct virtqueue *vq)
-{
-        struct itimerval itm;
-        vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
-        vq->blocked = true;
-        itm.it_interval.tv_sec = 0;
-        itm.it_interval.tv_usec = 0;
-        itm.it_value.tv_sec = 0;
-        itm.it_value.tv_usec = timeout_usec;
-        setitimer(ITIMER_REAL, &itm, NULL);
 }
 /*
 * The Network
 *
 * Handling output for network is also simple: we get all the output buffers
- * and write them (ignoring the first element) to this device's file descriptor
+ * and write them to /dev/net/tun.
- * (/dev/net/tun).
 */
-static void handle_net_output(int fd, struct virtqueue *vq, bool timeout)
+struct net_info {
+        int tunfd;
+};
+static void net_output(struct virtqueue *vq)
 {
-        unsigned int head, out, in, num = 0;
+        struct net_info *net_info = vq->dev->priv;
-        int len;
+        unsigned int head, out, in;
        struct iovec iov[vq->vring.num];
-        static int last_timeout_num;
-        /* Keep getting output buffers from the Guest until we run out. */
-        while ((head = get_vq_desc(vq, iov, &out, &in)) != vq->vring.num) {
-                if (in)
-                        errx(1, "Input buffers in output queue?");
-                len = writev(vq->dev->fd, iov, out);
-                if (len < 0)
-                        err(1, "Writing network packet to tun");
-                add_used_and_trigger(fd, vq, head, len);
-                num++;
-        }
-        /* Block further kicks and set up a timer if we saw anything. */
+        head = wait_for_vq_desc(vq, iov, &out, &in);
-        if (!timeout && num)
+        if (in)
-                block_vq(vq);
+                errx(1, "Input buffers in net output queue?");
+        if (writev(net_info->tunfd, iov, out) < 0)
-        /* We never quite know how long should we wait before we check the
+                errx(1, "Write to tun failed?");
-         * queue again for more packets.  We start at 500 microseconds, and if
+        add_used(vq, head, 0);
-         * we get fewer packets than last time, we assume we made the timeout
+}
-         * too small and increase it by 10 microseconds.  Otherwise, we drop it
-         * by one microsecond every time.  It seems to work well enough. */
+/* Will reading from this file descriptor block? */
-        if (timeout) {
+static bool will_block(int fd)
-                if (num < last_timeout_num)
+{
-                        timeout_usec += 10;
+        fd_set fdset;
-                else if (timeout_usec > 1)
+        struct timeval zero = { 0, 0 };
-                        timeout_usec--;
+        FD_ZERO(&fdset);
-                last_timeout_num = num;
+        FD_SET(fd, &fdset);
-        }
+        return select(fd+1, &fdset, NULL, NULL, &zero) != 1;
 }
-/* This is where we handle a packet coming in from the tun device to our
+/* This is where we handle packets coming in from the tun device to our
 * Guest. */
-static bool handle_tun_input(int fd, struct device *dev)
+static void net_input(struct virtqueue *vq)
 {
-        unsigned int head, in_num, out_num;
        int len;
-        struct iovec iov[dev->vq->vring.num];
+        unsigned int head, out, in;
+        struct iovec iov[vq->vring.num];
-        /* First we need a network buffer from the Guests's recv virtqueue. */
+        struct net_info *net_info = vq->dev->priv;
-        head = get_vq_desc(dev->vq, iov, &out_num, &in_num);
-        if (head == dev->vq->vring.num) {
-                /* Now, it's expected that if we try to send a packet too
-                 * early, the Guest won't be ready yet.  Wait until the device
-                 * status says it's ready. */
-                /* FIXME: Actually want DRIVER_ACTIVE here. */
-                /* Now tell it we want to know if new things appear. */
-                dev->vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
-                wmb();
-                /* We'll turn this back on if input buffers are registered. */
-                return false;
-        } else if (out_num)
-                errx(1, "Output buffers in network recv queue?");
-        /* Read the packet from the device directly into the Guest's buffer. */
-        len = readv(dev->fd, iov, in_num);
-        if (len <= 0)
-                err(1, "reading network");
-        /* Tell the Guest about the new packet. */
+        head = wait_for_vq_desc(vq, iov, &out, &in);
-        add_used_and_trigger(fd, dev->vq, head, len);
+        if (out)
+                errx(1, "Output buffers in net input queue?");
-        verbose("tun input packet len %i [%02x %02x] (%s)\n", len,
+        /* Deliver interrupt now, since we're about to sleep. */
-                ((u8 *)iov[1].iov_base)[0], ((u8 *)iov[1].iov_base)[1],
+        if (vq->pending_used && will_block(net_info->tunfd))
-                head != dev->vq->vring.num ? "sent" : "discarded");
+                trigger_irq(vq);
-        /* All good. */
+        len = readv(net_info->tunfd, iov, in);
-        return true;
+        if (len <= 0)
+                err(1, "Failed to read from tun.");
+        add_used(vq, head, len);
 }
-/*L:215 This is the callback attached to the network and console input
+/* This is the helper to create threads. */
- * virtqueues: it ensures we try again, in case we stopped console or net
+static int do_thread(void *_vq)
- * delivery because Guest didn't have any buffers. */
-static void enable_fd(int fd, struct virtqueue *vq, bool timeout)
 {
-        add_device_fd(vq->dev->fd);
+        struct virtqueue *vq = _vq;
-        /* Snap the Waker out of its select loop. */
-        write(waker_fds.pipe[1], "", 1);
+        for (;;)
+                vq->service(vq);
+        return 0;
 }
-static void net_enable_fd(int fd, struct virtqueue *vq, bool timeout)
+/* When a child dies, we kill our entire process group with SIGTERM.  This
+ * also has the side effect that the shell restores the console for us! */
+static void kill_launcher(int signal)
 {
-        /* We don't need to know again when Guest refills receive buffer. */
+        kill(0, SIGTERM);
-        vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
-        enable_fd(fd, vq, timeout);
 }
-/* When the Guest tells us they updated the status field, we handle it. */
+static void reset_device(struct device *dev)
-static void update_device_status(struct device *dev)
 {
        struct virtqueue *vq;
-        /* This is a reset. */
+        verbose("Resetting device %s\n", dev->name);
-        if (dev->desc->status == 0) {
-                verbose("Resetting device %s\n", dev->name);
-                /* Clear any features they've acked. */
+        /* Clear any features they've acked. */
-                memset(get_feature_bits(dev) + dev->desc->feature_len, 0,
+        memset(get_feature_bits(dev) + dev->feature_len, 0, dev->feature_len);
-                       dev->desc->feature_len);
-                /* Zero out the virtqueues. */
+        /* We're going to be explicitly killing threads, so ignore them. */
-                for (vq = dev->vq; vq; vq = vq->next) {
+        signal(SIGCHLD, SIG_IGN);
-                        memset(vq->vring.desc, 0,
-                               vring_size(vq->config.num, LGUEST_VRING_ALIGN));
+        /* Zero out the virtqueues, get rid of their threads */
-                        lg_last_avail(vq) = 0;
+        for (vq = dev->vq; vq; vq = vq->next) {
+                if (vq->thread != (pid_t)-1) {
+                        kill(vq->thread, SIGTERM);
+                        waitpid(vq->thread, NULL, 0);
+                        vq->thread = (pid_t)-1;
                }
-        } else if (dev->desc->status & VIRTIO_CONFIG_S_FAILED) {
+                memset(vq->vring.desc, 0,
+                       vring_size(vq->config.num, LGUEST_VRING_ALIGN));
+                lg_last_avail(vq) = 0;
+        }
+        dev->running = false;
+        /* Now we care if threads die. */
+        signal(SIGCHLD, (void *)kill_launcher);
+}
+static void create_thread(struct virtqueue *vq)
+{
+        /* Create stack for thread and run it.  Since stack grows
+         * upwards, we point the stack pointer to the end of this
+         * region. */
+        char *stack = malloc(32768);
+        unsigned long args[] = { LHREQ_EVENTFD,
+                                 vq->config.pfn*getpagesize(), 0 };
+        /* Create a zero-initialized eventfd. */
+        vq->eventfd = eventfd(0, 0);
+        if (vq->eventfd < 0)
+                err(1, "Creating eventfd");
+        args[2] = vq->eventfd;
+        /* Attach an eventfd to this virtqueue: it will go off
+         * when the Guest does an LHCALL_NOTIFY for this vq. */
+        if (write(lguest_fd, &args, sizeof(args)) != 0)
+                err(1, "Attaching eventfd");
+        /* CLONE_VM: because it has to access the Guest memory, and
+         * SIGCHLD so we get a signal if it dies. */
+        vq->thread = clone(do_thread, stack + 32768, CLONE_VM | SIGCHLD, vq);
+        if (vq->thread == (pid_t)-1)
+                err(1, "Creating clone");
+        /* We close our local copy, now the child has it. */
+        close(vq->eventfd);
+}
+static void start_device(struct device *dev)
+{
+        unsigned int i;
+        struct virtqueue *vq;
+        verbose("Device %s OK: offered", dev->name);
+        for (i = 0; i < dev->feature_len; i++)
+                verbose(" %02x", get_feature_bits(dev)[i]);
+        verbose(", accepted");
+        for (i = 0; i < dev->feature_len; i++)
+                verbose(" %02x", get_feature_bits(dev)
+                        [dev->feature_len+i]);
+        for (vq = dev->vq; vq; vq = vq->next) {
+                if (vq->service)
+                        create_thread(vq);
+        }
+        dev->running = true;
+}
+static void cleanup_devices(void)
+{
+        struct device *dev;
+        for (dev = devices.dev; dev; dev = dev->next)
+                reset_device(dev);
+        /* If we saved off the original terminal settings, restore them now. */
+        if (orig_term.c_lflag & (ISIG|ICANON|ECHO))
+                tcsetattr(STDIN_FILENO, TCSANOW, &orig_term);
+}
+/* When the Guest tells us they updated the status field, we handle it. */
+static void update_device_status(struct device *dev)
+{
+        /* A zero status is a reset, otherwise it's a set of flags. */
+        if (dev->desc->status == 0)
+                reset_device(dev);
+        else if (dev->desc->status & VIRTIO_CONFIG_S_FAILED) {
                warnx("Device %s configuration FAILED", dev->name);
+                if (dev->running)
+                        reset_device(dev);
        } else if (dev->desc->status & VIRTIO_CONFIG_S_DRIVER_OK) {
-                unsigned int i;
+                if (!dev->running)
+                        start_device(dev);
-                verbose("Device %s OK: offered", dev->name);
-                for (i = 0; i < dev->desc->feature_len; i++)
-                        verbose(" %02x", get_feature_bits(dev)[i]);
-                verbose(", accepted");
-                for (i = 0; i < dev->desc->feature_len; i++)
-                        verbose(" %02x", get_feature_bits(dev)
-                                [dev->desc->feature_len+i]);
-                if (dev->ready)
-                        dev->ready(dev);
        }
 }
 /* This is the generic routine we call when the Guest uses LHCALL_NOTIFY. */
-static void handle_output(int fd, unsigned long addr)
+static void handle_output(unsigned long addr)
 {
        struct device *i;
-        struct virtqueue *vq;
-        /* Check each device and virtqueue. */
+        /* Check each device. */
        for (i = devices.dev; i; i = i->next) {
+                struct virtqueue *vq;
                /* Notifications to device descriptors update device status. */
                if (from_guest_phys(addr) == i->desc) {
                        update_device_status(i);
                        return;
                }
-                /* Notifications to virtqueues mean output has occurred. */
+                /* Devices *can* be used before status is set to DRIVER_OK. */
                for (vq = i->vq; vq; vq = vq->next) {
-                        if (vq->config.pfn != addr/getpagesize())
+                        if (addr != vq->config.pfn*getpagesize())
                                continue;
+                        if (i->running)
-                        /* Guest should acknowledge (and set features!)  before
+                                errx(1, "Notification on running %s", i->name);
-                         * using the device. */
+                        start_device(i);
-                        if (i->desc->status == 0) {
-                                warnx("%s gave early output", i->name);
-                                return;
-                        }
-                        if (strcmp(vq->dev->name, "console") != 0)
-                                verbose("Output to %s\n", vq->dev->name);
-                        if (vq->handle_output)
-                                vq->handle_output(fd, vq, false);
                        return;
                }
        }
@@ -1049,71 +990,6 @@ static void handle_output(int fd, unsigned long addr)
              strnlen(from_guest_phys(addr), guest_limit - addr));
 }
-static void handle_timeout(int fd)
-{
-        char buf[32];
-        struct device *i;
-        struct virtqueue *vq;
-        /* Clear the pipe */
-        read(timeoutpipe[0], buf, sizeof(buf));
-        /* Check each device and virtqueue: flush blocked ones. */
-        for (i = devices.dev; i; i = i->next) {
-                for (vq = i->vq; vq; vq = vq->next) {
-                        if (!vq->blocked)
-                                continue;
-                        vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
-                        vq->blocked = false;
-                        if (vq->handle_output)
-                                vq->handle_output(fd, vq, true);
-                }
-        }
-}
-/* This is called when the Waker wakes us up: check for incoming file
- * descriptors. */
-static void handle_input(int fd)
-{
-        /* select() wants a zeroed timeval to mean "don't wait". */
-        struct timeval poll = { .tv_sec = 0, .tv_usec = 0 };
-        for (;;) {
-                struct device *i;
-                fd_set fds = devices.infds;
-                int num;
-                num = select(devices.max_infd+1, &fds, NULL, NULL, &poll);
-                /* Could get interrupted */
-                if (num < 0)
-                        continue;
-                /* If nothing is ready, we're done. */
-                if (num == 0)
-                        break;
-                /* Otherwise, call the device(s) which have readable file
-                 * descriptors and a method of handling them.  */
-                for (i = devices.dev; i; i = i->next) {
-                        if (i->handle_input && FD_ISSET(i->fd, &fds)) {
-                                if (i->handle_input(fd, i))
-                                        continue;
-                                /* If handle_input() returns false, it means we
-                                 * should no longer service it.  Networking and
-                                 * console do this when there's no input
-                                 * buffers to deliver into.  Console also uses
-                                 * it when it discovers that stdin is closed. */
-                                FD_CLR(i->fd, &devices.infds);
-                        }
-                }
-                /* Is this the timeout fd? */
-                if (FD_ISSET(timeoutpipe[0], &fds))
-                        handle_timeout(fd);
-        }
-}
 /*L:190
 * Device Setup
 *
@@ -1129,8 +1005,8 @@ static void handle_input(int fd)
 static u8 *device_config(const struct device *dev)
 {
        return (void *)(dev->desc + 1)
-                + dev->desc->num_vq * sizeof(struct lguest_vqconfig)
+                + dev->num_vq * sizeof(struct lguest_vqconfig)
-                + dev->desc->feature_len * 2;
+                + dev->feature_len * 2;
 }
 /* This routine allocates a new "struct lguest_device_desc" from descriptor
@@ -1159,7 +1035,7 @@ static struct lguest_device_desc *new_dev_desc(u16 type)
 /* Each device descriptor is followed by the description of its virtqueues.  We
 * specify how many descriptors the virtqueue is to have. */
 static void add_virtqueue(struct device *dev, unsigned int num_descs,
-                          void (*handle_output)(int, struct virtqueue *, bool))
+                          void (*service)(struct virtqueue *))
 {
        unsigned int pages;
        struct virtqueue **i, *vq = malloc(sizeof(*vq));
@@ -1174,8 +1050,8 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
        vq->next = NULL;
        vq->last_avail_idx = 0;
        vq->dev = dev;
-        vq->inflight = 0;
+        vq->service = service;
-        vq->blocked = false;
+        vq->thread = (pid_t)-1;
        /* Initialize the configuration. */
        vq->config.num = num_descs;
@@ -1191,6 +1067,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         * yet, otherwise we'd be overwriting them. */
        assert(dev->desc->config_len == 0 && dev->desc->feature_len == 0);
        memcpy(device_config(dev), &vq->config, sizeof(vq->config));
+        dev->num_vq++;
        dev->desc->num_vq++;
        verbose("Virtqueue page %#lx\n", to_guest_phys(p));
@@ -1199,15 +1076,6 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         * second.  */
        for (i = &dev->vq; *i; i = &(*i)->next);
        *i = vq;
-        /* Set the routine to call when the Guest does something to this
-         * virtqueue. */
-        vq->handle_output = handle_output;
-        /* As an optimization, set the advisory "Don't Notify Me" flag if we
-         * don't have a handler */
-        if (!handle_output)
-                vq->vring.used->flags = VRING_USED_F_NO_NOTIFY;
 }
 /* The first half of the feature bitmask is for us to advertise features.  The
@@ -1219,7 +1087,7 @@ static void add_feature(struct device *dev, unsigned bit)
        /* We can't extend the feature bits once we've added config bytes */
        if (dev->desc->feature_len <= bit / CHAR_BIT) {
                assert(dev->desc->config_len == 0);
-                dev->desc->feature_len = (bit / CHAR_BIT) + 1;
+                dev->feature_len = dev->desc->feature_len = (bit/CHAR_BIT) + 1;
        }
        features[bit / CHAR_BIT] |= (1 << (bit % CHAR_BIT));
@@ -1243,22 +1111,17 @@ static void set_config(struct device *dev, unsigned len, const void *conf)
 * calling new_dev_desc() to allocate the descriptor and device memory.
 *
 * See what I mean about userspace being boring? */
-static struct device *new_device(const char *name, u16 type, int fd,
+static struct device *new_device(const char *name, u16 type)
-                                 bool (*handle_input)(int, struct device *))
 {
        struct device *dev = malloc(sizeof(*dev));
        /* Now we populate the fields one at a time. */
-        dev->fd = fd;
-        /* If we have an input handler for this file descriptor, then we add it
-         * to the device_list's fdset and maxfd. */
-        if (handle_input)
-                add_device_fd(dev->fd);
        dev->desc = new_dev_desc(type);
-        dev->handle_input = handle_input;
        dev->name = name;
        dev->vq = NULL;
-        dev->ready = NULL;
+        dev->feature_len = 0;
+        dev->num_vq = 0;
+        dev->running = false;
        /* Append to device list.  Prepending to a single-linked list is
         * easier, but the user expects the devices to be arranged on the bus
@@ -1286,13 +1149,10 @@ static void setup_console(void)
                 * raw input stream to the Guest. */
                term.c_lflag &= ~(ISIG|ICANON|ECHO);
                tcsetattr(STDIN_FILENO, TCSANOW, &term);
-                /* If we exit gracefully, the original settings will be
-                 * restored so the user can see what they're typing. */
-                atexit(restore_term);
        }
-        dev = new_device("console", VIRTIO_ID_CONSOLE,
+        dev = new_device("console", VIRTIO_ID_CONSOLE);
-                         STDIN_FILENO, handle_console_input);
        /* We store the console state in dev->priv, and initialize it. */
        dev->priv = malloc(sizeof(struct console_abort));
        ((struct console_abort *)dev->priv)->count = 0;
@@ -1301,31 +1161,13 @@ static void setup_console(void)
         * they put something the input queue, we make sure we're listening to
         * stdin.  When they put something in the output queue, we write it to
         * stdout. */
-        add_virtqueue(dev, VIRTQUEUE_NUM, enable_fd);
+        add_virtqueue(dev, VIRTQUEUE_NUM, console_input);
-        add_virtqueue(dev, VIRTQUEUE_NUM, handle_console_output);
+        add_virtqueue(dev, VIRTQUEUE_NUM, console_output);
-        verbose("device %u: console\n", devices.device_num++);
+        verbose("device %u: console\n", ++devices.device_num);
 }
 /*:*/
-static void timeout_alarm(int sig)
-{
-        write(timeoutpipe[1], "", 1);
-}
-static void setup_timeout(void)
-{
-        if (pipe(timeoutpipe) != 0)
-                err(1, "Creating timeout pipe");
-        if (fcntl(timeoutpipe[1], F_SETFL,
-                  fcntl(timeoutpipe[1], F_GETFL) | O_NONBLOCK) != 0)
-                err(1, "Making timeout pipe nonblocking");
-        add_device_fd(timeoutpipe[0]);
-        signal(SIGALRM, timeout_alarm);
-}
 /*M:010 Inter-guest networking is an interesting area.  Simplest is to have a
 * --sharenet=<name> option which opens or creates a named pipe.  This can be
 * used to send packets to another guest in a 1:1 manner.
@@ -1447,21 +1289,23 @@ static int get_tun_device(char tapif[IFNAMSIZ])
 static void setup_tun_net(char *arg)
 {
        struct device *dev;
-        int netfd, ipfd;
+        struct net_info *net_info = malloc(sizeof(*net_info));
+        int ipfd;
        u32 ip = INADDR_ANY;
        bool bridging = false;
        char tapif[IFNAMSIZ], *p;
        struct virtio_net_config conf;
-        netfd = get_tun_device(tapif);
+        net_info->tunfd = get_tun_device(tapif);
        /* First we create a new network device. */
-        dev = new_device("net", VIRTIO_ID_NET, netfd, handle_tun_input);
+        dev = new_device("net", VIRTIO_ID_NET);
+        dev->priv = net_info;
        /* Network devices need a receive and a send queue, just like
         * console. */
-        add_virtqueue(dev, VIRTQUEUE_NUM, net_enable_fd);
+        add_virtqueue(dev, VIRTQUEUE_NUM, net_input);
-        add_virtqueue(dev, VIRTQUEUE_NUM, handle_net_output);
+        add_virtqueue(dev, VIRTQUEUE_NUM, net_output);
        /* We need a socket to perform the magic network ioctls to bring up the
         * tap interface, connect to the bridge etc.  Any socket will do! */
@@ -1502,6 +1346,8 @@ static void setup_tun_net(char *arg)
        add_feature(dev, VIRTIO_NET_F_HOST_TSO4);
        add_feature(dev, VIRTIO_NET_F_HOST_TSO6);
        add_feature(dev, VIRTIO_NET_F_HOST_ECN);
+        /* We handle indirect ring entries */
+        add_feature(dev, VIRTIO_RING_F_INDIRECT_DESC);
        set_config(dev, sizeof(conf), &conf);
        /* We don't need the socket any more; setup is done. */
@@ -1550,20 +1396,18 @@ struct vblk_info
 * Remember that the block device is handled by a separate I/O thread.  We head
 * straight into the core of that thread here:
 */
-static bool service_io(struct device *dev)
+static void blk_request(struct virtqueue *vq)
 {
-        struct vblk_info *vblk = dev->priv;
+        struct vblk_info *vblk = vq->dev->priv;
        unsigned int head, out_num, in_num, wlen;
        int ret;
        u8 *in;
        struct virtio_blk_outhdr *out;
-        struct iovec iov[dev->vq->vring.num];
+        struct iovec iov[vq->vring.num];
        off64_t off;
-        /* See if there's a request waiting.  If not, nothing to do. */
+        /* Get the next request. */
-        head = get_vq_desc(dev->vq, iov, &out_num, &in_num);
+        head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
-        if (head == dev->vq->vring.num)
-                return false;
        /* Every block request should contain at least one output buffer
         * (detailing the location on disk and the type of request) and one
@@ -1637,83 +1481,21 @@ static bool service_io(struct device *dev)
        if (out->type & VIRTIO_BLK_T_BARRIER)
                fdatasync(vblk->fd);
-        /* We can't trigger an IRQ, because we're not the Launcher.  It does
+        add_used(vq, head, wlen);
-         * that when we tell it we're done. */
-        add_used(dev->vq, head, wlen);
-        return true;
-}
-/* This is the thread which actually services the I/O. */
-static int io_thread(void *_dev)
-{
-        struct device *dev = _dev;
-        struct vblk_info *vblk = dev->priv;
-        char c;
-        /* Close other side of workpipe so we get 0 read when main dies. */
-        close(vblk->workpipe[1]);
-        /* Close the other side of the done_fd pipe. */
-        close(dev->fd);
-        /* When this read fails, it means Launcher died, so we follow. */
-        while (read(vblk->workpipe[0], &c, 1) == 1) {
-                /* We acknowledge each request immediately to reduce latency,
-                 * rather than waiting until we've done them all.  I haven't
-                 * measured to see if it makes any difference.
-                 *
-                 * That would be an interesting test, wouldn't it?  You could
-                 * also try having more than one I/O thread. */
-                while (service_io(dev))
-                        write(vblk->done_fd, &c, 1);
-        }
-        return 0;
-}
-/* Now we've seen the I/O thread, we return to the Launcher to see what happens
- * when that thread tells us it's completed some I/O. */
-static bool handle_io_finish(int fd, struct device *dev)
-{
-        char c;
-        /* If the I/O thread died, presumably it printed the error, so we
-         * simply exit. */
-        if (read(dev->fd, &c, 1) != 1)
-                exit(1);
-        /* It did some work, so trigger the irq. */
-        trigger_irq(fd, dev->vq);
-        return true;
-}
-/* When the Guest submits some I/O, we just need to wake the I/O thread. */
-static void handle_virtblk_output(int fd, struct virtqueue *vq, bool timeout)
-{
-        struct vblk_info *vblk = vq->dev->priv;
-        char c = 0;
-        /* Wake up I/O thread and tell it to go to work! */
-        if (write(vblk->workpipe[1], &c, 1) != 1)
-                /* Presumably it indicated why it died. */
-                exit(1);
 }
 /*L:198 This actually sets up a virtual block device. */
 static void setup_block_file(const char *filename)
 {
-        int p[2];
        struct device *dev;
        struct vblk_info *vblk;
-        void *stack;
        struct virtio_blk_config conf;
-        /* This is the pipe the I/O thread will use to tell us I/O is done. */
-        pipe(p);
        /* The device responds to return from I/O thread. */
-        dev = new_device("block", VIRTIO_ID_BLOCK, p[0], handle_io_finish);
+        dev = new_device("block", VIRTIO_ID_BLOCK);
        /* The device has one virtqueue, where the Guest places requests. */
-        add_virtqueue(dev, VIRTQUEUE_NUM, handle_virtblk_output);
+        add_virtqueue(dev, VIRTQUEUE_NUM, blk_request);
        /* Allocate the room for our own bookkeeping */
        vblk = dev->priv = malloc(sizeof(*vblk));
@@ -1735,49 +1517,29 @@ static void setup_block_file(const char *filename)
        set_config(dev, sizeof(conf), &conf);
-        /* The I/O thread writes to this end of the pipe when done. */
-        vblk->done_fd = p[1];
-        /* This is the second pipe, which is how we tell the I/O thread about
-         * more work. */
-        pipe(vblk->workpipe);
-        /* Create stack for thread and run it.  Since stack grows upwards, we
-         * point the stack pointer to the end of this region. */
-        stack = malloc(32768);
-        /* SIGCHLD - We dont "wait" for our cloned thread, so prevent it from
-         * becoming a zombie. */
-        if (clone(io_thread, stack + 32768, CLONE_VM | SIGCHLD, dev) == -1)
-                err(1, "Creating clone");
-        /* We don't need to keep the I/O thread's end of the pipes open. */
-        close(vblk->done_fd);
-        close(vblk->workpipe[0]);
        verbose("device %u: virtblock %llu sectors\n",
-                devices.device_num, le64_to_cpu(conf.capacity));
+                ++devices.device_num, le64_to_cpu(conf.capacity));
 }
+struct rng_info {
+        int rfd;
+};
 /* Our random number generator device reads from /dev/random into the Guest's
 * input buffers.  The usual case is that the Guest doesn't want random numbers
 * and so has no buffers although /dev/random is still readable, whereas
 * console is the reverse.
 *
 * The same logic applies, however. */
-static bool handle_rng_input(int fd, struct device *dev)
+static void rng_input(struct virtqueue *vq)
 {
        int len;
        unsigned int head, in_num, out_num, totlen = 0;
-        struct iovec iov[dev->vq->vring.num];
+        struct rng_info *rng_info = vq->dev->priv;
+        struct iovec iov[vq->vring.num];
        /* First we need a buffer from the Guests's virtqueue. */
-        head = get_vq_desc(dev->vq, iov, &out_num, &in_num);
+        head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
-        /* If they're not ready for input, stop listening to this file
-         * descriptor.  We'll start again once they add an input buffer. */
-        if (head == dev->vq->vring.num)
-                return false;
        if (out_num)
                errx(1, "Output buffers in rng?");
@@ -1785,7 +1547,7 @@ static bool handle_rng_input(int fd, struct device *dev)
         * it reads straight into the Guest's buffer.  We loop to make sure we
         * fill it. */
        while (!iov_empty(iov, in_num)) {
-                len = readv(dev->fd, iov, in_num);
+                len = readv(rng_info->rfd, iov, in_num);
                if (len <= 0)
                        err(1, "Read from /dev/random gave %i", len);
                iov_consume(iov, in_num, len);
@@ -1793,25 +1555,23 @@ static bool handle_rng_input(int fd, struct device *dev)
        }
        /* Tell the Guest about the new input. */
-        add_used_and_trigger(fd, dev->vq, head, totlen);
+        add_used(vq, head, totlen);
-        /* Everything went OK! */
-        return true;
 }
 /* And this creates a "hardware" random number device for the Guest. */
 static void setup_rng(void)
 {
        struct device *dev;
-        int fd;
+        struct rng_info *rng_info = malloc(sizeof(*rng_info));
-        fd = open_or_die("/dev/random", O_RDONLY);
+        rng_info->rfd = open_or_die("/dev/random", O_RDONLY);
        /* The device responds to return from I/O thread. */
-        dev = new_device("rng", VIRTIO_ID_RNG, fd, handle_rng_input);
+        dev = new_device("rng", VIRTIO_ID_RNG);
+        dev->priv = rng_info;
        /* The device has one virtqueue, where the Guest places inbufs. */
-        add_virtqueue(dev, VIRTQUEUE_NUM, enable_fd);
+        add_virtqueue(dev, VIRTQUEUE_NUM, rng_input);
        verbose("device %u: rng\n", devices.device_num++);
 }
@@ -1827,17 +1587,18 @@ static void __attribute__((noreturn)) restart_guest(void)
        for (i = 3; i < FD_SETSIZE; i++)
                close(i);
-        /* The exec automatically gets rid of the I/O and Waker threads. */
+        /* Reset all the devices (kills all threads). */
+        cleanup_devices();
        execv(main_args[0], main_args);
        err(1, "Could not exec %s", main_args[0]);
 }
 /*L:220 Finally we reach the core of the Launcher which runs the Guest, serves
 * its input and output, and finally, lays it to rest. */
-static void __attribute__((noreturn)) run_guest(int lguest_fd)
+static void __attribute__((noreturn)) run_guest(void)
 {
        for (;;) {
-                unsigned long args[] = { LHREQ_BREAK, 0 };
                unsigned long notify_addr;
                int readval;
@@ -1848,8 +1609,7 @@ static void __attribute__((noreturn)) run_guest(int lguest_fd)
                /* One unsigned long means the Guest did HCALL_NOTIFY */
                if (readval == sizeof(notify_addr)) {
                        verbose("Notify on address %#lx\n", notify_addr);
-                        handle_output(lguest_fd, notify_addr);
+                        handle_output(notify_addr);
-                        continue;
                /* ENOENT means the Guest died.  Reading tells us why. */
                } else if (errno == ENOENT) {
                        char reason[1024] = { 0 };
@@ -1858,19 +1618,9 @@ static void __attribute__((noreturn)) run_guest(int lguest_fd)
                /* ERESTART means that we need to reboot the guest */
                } else if (errno == ERESTART) {
                        restart_guest();
-                /* EAGAIN means a signal (timeout).
+                /* Anything else means a bug or incompatible change. */
-                 * Anything else means a bug or incompatible change. */
+                } else
-                } else if (errno != EAGAIN)
                        err(1, "Running guest failed");
-                /* Only service input on thread for CPU 0. */
-                if (cpu_id != 0)
-                        continue;
-                /* Service input, then unset the BREAK to release the Waker. */
-                handle_input(lguest_fd);
-                if (pwrite(lguest_fd, args, sizeof(args), cpu_id) < 0)
-                        err(1, "Resetting break");
        }
 }
 /*L:240
@@ -1904,8 +1654,8 @@ int main(int argc, char *argv[])
        /* Memory, top-level pagetable, code startpoint and size of the
         * (optional) initrd. */
        unsigned long mem = 0, start, initrd_size = 0;
-        /* Two temporaries and the /dev/lguest file descriptor. */
+        /* Two temporaries. */
-        int i, c, lguest_fd;
+        int i, c;
        /* The boot information for the Guest. */
        struct boot_params *boot;
        /* If they specify an initrd file to load. */
@@ -1913,18 +1663,10 @@ int main(int argc, char *argv[])
        /* Save the args: we "reboot" by execing ourselves again. */
        main_args = argv;
-        /* We don't "wait" for the children, so prevent them from becoming
-         * zombies. */
-        signal(SIGCHLD, SIG_IGN);
-        /* First we initialize the device list.  Since console and network
+        /* First we initialize the device list.  We keep a pointer to the last
-         * device receive input from a file descriptor, we keep an fdset
+         * device, and the next interrupt number to use for devices (1:
-         * (infds) and the maximum fd number (max_infd) with the head of the
+         * remember that 0 is used by the timer). */
-         * list.  We also keep a pointer to the last device.  Finally, we keep
-         * the next interrupt number to use for devices (1: remember that 0 is
-         * used by the timer). */
-        FD_ZERO(&devices.infds);
-        devices.max_infd = -1;
        devices.lastdev = NULL;
        devices.next_irq = 1;
@@ -1982,9 +1724,6 @@ int main(int argc, char *argv[])
        /* We always have a console device */
        setup_console();
-        /* We can timeout waiting for Guest network transmit. */
-        setup_timeout();
        /* Now we load the kernel */
        start = load_kernel(open_or_die(argv[optind+1], O_RDONLY));
@@ -2023,15 +1762,16 @@ int main(int argc, char *argv[])
        /* We tell the kernel to initialize the Guest: this returns the open
         * /dev/lguest file descriptor. */
-        lguest_fd = tell_kernel(start);
+        tell_kernel(start);
+        /* Ensure that we terminate if a child dies. */
+        signal(SIGCHLD, kill_launcher);
-        /* We clone off a thread, which wakes the Launcher whenever one of the
+        /* If we exit via err(), this kills all the threads, restores tty. */
-         * input file descriptors needs attention.  We call this the Waker, and
+        atexit(cleanup_devices);
-         * we'll cover it in a moment. */
-        setup_waker(lguest_fd);
        /* Finally, run the Guest.  This doesn't return. */
-        run_guest(lguest_fd);
+        run_guest();
 }
 /*:*/
diff --git a/Documentation/lguest/lguest.txt b/Documentation/lguest/lguest.txt
index 28c747362f95..efb3a6a045a2 100644
--- a/Documentation/lguest/lguest.txt
+++ b/Documentation/lguest/lguest.txt
@@ -37,7 +37,6 @@ Running Lguest:
     "Paravirtualized guest support" = Y
        "Lguest guest support" = Y
     "High Memory Support" = off/4GB
-     "PAE (Physical Address Extension) Support" = N
     "Alignment value to which kernel should be aligned" = 0x100000
        (CONFIG_PARAVIRT=y, CONFIG_LGUEST_GUEST=y, CONFIG_HIGHMEM64G=n and
         CONFIG_PHYSICAL_ALIGN=0x100000)
diff --git a/Documentation/local_ops.txt b/Documentation/local_ops.txt
index 23045b8b50f0..300da4bdfdbd 100644
--- a/Documentation/local_ops.txt
+++ b/Documentation/local_ops.txt
@@ -34,7 +34,7 @@ out of order wrt other memory writes by the owner CPU.
 It can be done by slightly modifying the standard atomic operations : only
 their UP variant must be kept. It typically means removing LOCK prefix (on
-i386 and x86_64) and any SMP sychronization barrier. If the architecture does
+i386 and x86_64) and any SMP synchronization barrier. If the architecture does
 not have a different behavior between SMP and UP, including asm-generic/local.h
 in your architecture's local.h is sufficient.
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index f5b7127f54ac..7f5809eddee6 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -31,6 +31,7 @@ Contents:
     - Locking functions.
     - Interrupt disabling functions.
+     - Sleep and wake-up functions.
     - Miscellaneous functions.
 (*) Inter-CPU locking barrier effects.
@@ -1217,6 +1218,132 @@ barriers are required in such a situation, they must be provided from some
 other means.
+SLEEP AND WAKE-UP FUNCTIONS
+---------------------------
+Sleeping and waking on an event flagged in global data can be viewed as an
+interaction between two pieces of data: the task state of the task waiting for
+the event and the global data used to indicate the event.  To make sure that
+these appear to happen in the right order, the primitives to begin the process
+of going to sleep, and the primitives to initiate a wake up imply certain
+barriers.
+Firstly, the sleeper normally follows something like this sequence of events:
+        for (;;) {
+                set_current_state(TASK_UNINTERRUPTIBLE);
+                if (event_indicated)
+                        break;
+                schedule();
+        }
+A general memory barrier is interpolated automatically by set_current_state()
+after it has altered the task state:
+        CPU 1
+        ===============================
+        set_current_state();
+          set_mb();
+            STORE current->state
+            <general barrier>
+        LOAD event_indicated
+set_current_state() may be wrapped by:
+        prepare_to_wait();
+        prepare_to_wait_exclusive();
+which therefore also imply a general memory barrier after setting the state.
+The whole sequence above is available in various canned forms, all of which
+interpolate the memory barrier in the right place:
+        wait_event();
+        wait_event_interruptible();
+        wait_event_interruptible_exclusive();
+        wait_event_interruptible_timeout();
+        wait_event_killable();
+        wait_event_timeout();
+        wait_on_bit();
+        wait_on_bit_lock();
+Secondly, code that performs a wake up normally follows something like this:
+        event_indicated = 1;
+        wake_up(&event_wait_queue);
+or:
+        event_indicated = 1;
+        wake_up_process(event_daemon);
+A write memory barrier is implied by wake_up() and co. if and only if they wake
+something up.  The barrier occurs before the task state is cleared, and so sits
+between the STORE to indicate the event and the STORE to set TASK_RUNNING:
+        CPU 1                           CPU 2
+        =============================== ===============================
+        set_current_state();            STORE event_indicated
+          set_mb();                     wake_up();
+            STORE current->state          <write barrier>
+            <general barrier>             STORE current->state
+        LOAD event_indicated
+The available waker functions include:
+        complete();
+        wake_up();
+        wake_up_all();
+        wake_up_bit();
+        wake_up_interruptible();
+        wake_up_interruptible_all();
+        wake_up_interruptible_nr();
+        wake_up_interruptible_poll();
+        wake_up_interruptible_sync();
+        wake_up_interruptible_sync_poll();
+        wake_up_locked();
+        wake_up_locked_poll();
+        wake_up_nr();
+        wake_up_poll();
+        wake_up_process();
+[!] Note that the memory barriers implied by the sleeper and the waker do _not_
+order multiple stores before the wake-up with respect to loads of those stored
+values after the sleeper has called set_current_state().  For instance, if the
+sleeper does:
+        set_current_state(TASK_INTERRUPTIBLE);
+        if (event_indicated)
+                break;
+        __set_current_state(TASK_RUNNING);
+        do_something(my_data);
+and the waker does:
+        my_data = value;
+        event_indicated = 1;
+        wake_up(&event_wait_queue);
+there's no guarantee that the change to event_indicated will be perceived by
+the sleeper as coming after the change to my_data.  In such a circumstance, the
+code on both sides must interpolate its own memory barriers between the
+separate data accesses.  Thus the above sleeper ought to do:
+        set_current_state(TASK_INTERRUPTIBLE);
+        if (event_indicated) {
+                smp_rmb();
+                do_something(my_data);
+        }
+and the waker should do:
+        my_data = value;
+        smp_wmb();
+        event_indicated = 1;
+        wake_up(&event_wait_queue);
 MISCELLANEOUS FUNCTIONS
 -----------------------
@@ -1366,7 +1493,7 @@ WHERE ARE MEMORY BARRIERS NEEDED?
 Under normal operation, memory operation reordering is generally not going to
 be a problem as a single-threaded linear piece of code will still appear to
-work correctly, even if it's in an SMP kernel.  There are, however, three
+work correctly, even if it's in an SMP kernel.  There are, however, four
 circumstances in which reordering definitely _could_ be a problem:
 (*) Interprocessor interaction.
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
index 4c2ecf537a4a..bbc8a6a36921 100644
--- a/Documentation/memory-hotplug.txt
+++ b/Documentation/memory-hotplug.txt
@@ -73,13 +73,13 @@ this phase is triggered automatically. ACPI can notify this event. If not,
 (see Section 4.).
 Logical Memory Hotplug phase is to change memory state into
-avaiable/unavailable for users. Amount of memory from user's view is
+available/unavailable for users. Amount of memory from user's view is
 changed by this phase. The kernel makes all memory in it as free pages
 when a memory range is available.
 In this document, this phase is described as online/offline.
-Logical Memory Hotplug phase is triggred by write of sysfs file by system
+Logical Memory Hotplug phase is triggered by write of sysfs file by system
 administrator. For the hot-add case, it must be executed after Physical Hotplug
 phase by hand.
 (However, if you writes udev's hotplug scripts for memory hotplug, these
@@ -334,7 +334,7 @@ MEMORY_CANCEL_ONLINE
  Generated if MEMORY_GOING_ONLINE fails.
 MEMORY_ONLINE
-  Generated when memory has succesfully brought online. The callback may
+  Generated when memory has successfully brought online. The callback may
  allocate pages from the new memory.
 MEMORY_GOING_OFFLINE
@@ -359,7 +359,7 @@ The third argument is passed by pointer of struct memory_notify.
 struct memory_notify {
       unsigned long start_pfn;
       unsigned long nr_pages;
-       int status_cahnge_nid;
+       int status_change_nid;
 }
 start_pfn is start_pfn of online/offline memory.
diff --git a/Documentation/mn10300/ABI.txt b/Documentation/mn10300/ABI.txt
index 1fef1f06dfd2..d3507bad428d 100644
--- a/Documentation/mn10300/ABI.txt
+++ b/Documentation/mn10300/ABI.txt
@@ -26,7 +26,7 @@ registers and the stack. If the first argument is a 64-bit value, it will be
 passed in D0:D1. If the first argument is not a 64-bit value, but the second
 is, the second will be passed entirely on the stack and D1 will be unused.
-Arguments smaller than 32-bits are not coelesced within a register or a stack
+Arguments smaller than 32-bits are not coalesced within a register or a stack
 word. For example, two byte-sized arguments will always be passed in separate
 registers or word-sized stack slots.
diff --git a/Documentation/mtd/nand_ecc.txt b/Documentation/mtd/nand_ecc.txt
index bdf93b7f0f24..274821b35a7f 100644
--- a/Documentation/mtd/nand_ecc.txt
+++ b/Documentation/mtd/nand_ecc.txt
@@ -50,7 +50,7 @@ byte 255:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp1 rp3 rp5 ... rp15
           cp5  cp5  cp5  cp5  cp4  cp4  cp4  cp4
 This figure represents a sector of 256 bytes.
-cp is my abbreviaton for column parity, rp for row parity.
+cp is my abbreviation for column parity, rp for row parity.
 Let's start to explain column parity.
 cp0 is the parity that belongs to all bit0, bit2, bit4, bit6.
@@ -560,7 +560,7 @@ Measuring this code again showed big gain. When executing the original
 linux code 1 million times, this took about 1 second on my system.
 (using time to measure the performance). After this iteration I was back
 to 0.075 sec. Actually I had to decide to start measuring over 10
-million interations in order not to loose too much accuracy. This one
+million iterations in order not to lose too much accuracy. This one
 definitely seemed to be the jackpot!
 There is a little bit more room for improvement though. There are three
@@ -571,8 +571,8 @@ loop; This eliminates 3 statements per loop. Of course after the loop we
 need to correct by adding:
    rp4 ^= rp4_6;
    rp6 ^= rp4_6
-Furthermore there are 4 sequential assingments to rp8. This can be
+Furthermore there are 4 sequential assignments to rp8. This can be
-encoded slightly more efficient by saving tmppar before those 4 lines
+encoded slightly more efficiently by saving tmppar before those 4 lines
 and later do rp8 = rp8 ^ tmppar ^ notrp8;
 (where notrp8 is the value of rp8 before those 4 lines).
 Again a use of the commutative property of xor.
@@ -622,7 +622,7 @@ Not a big change, but every penny counts :-)
 Analysis 7
 ==========
-Acutally this made things worse. Not very much, but I don't want to move
+Actually this made things worse. Not very much, but I don't want to move
 into the wrong direction. Maybe something to investigate later. Could
 have to do with caching again.
@@ -642,7 +642,7 @@ Analysis 8
 This makes things worse. Let's stick with attempt 6 and continue from there.
 Although it seems that the code within the loop cannot be optimised
 further there is still room to optimize the generation of the ecc codes.
-We can simply calcualate the total parity. If this is 0 then rp4 = rp5
+We can simply calculate the total parity. If this is 0 then rp4 = rp5
 etc. If the parity is 1, then rp4 = !rp5;
 But if rp4 = rp5 we do not need rp5 etc. We can just write the even bits
 in the result byte and then do something like
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 08762750f121..d5181ce9ff62 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -221,7 +221,7 @@ ad_select
                - Any slave's 802.3ad association state changes
-                - The bond's adminstrative state changes to up
+                - The bond's administrative state changes to up
        count or 2
@@ -369,7 +369,7 @@ fail_over_mac
                When this policy is used in conjuction with the mii
                monitor, devices which assert link up prior to being
                able to actually transmit and receive are particularly
-                susecptible to loss of the gratuitous ARP, and an
+                susceptible to loss of the gratuitous ARP, and an
                appropriate updelay setting may be required.
        follow or 2
@@ -1794,7 +1794,7 @@ target to query.
 generally referred to as "trunk failover."  This is a feature of the
 switch that causes the link state of a particular switch port to be set
 down (or up) when the state of another switch port goes down (or up).
-It's purpose is to propogate link failures from logically "exterior" ports
+Its purpose is to propagate link failures from logically "exterior" ports
 to the logically "interior" ports that bonding is able to monitor via
 miimon.  Availability and configuration for trunk failover varies by
 switch, but this can be a viable alternative to the ARP monitor when using
diff --git a/Documentation/networking/can.txt b/Documentation/networking/can.txt
index 6cd6627c3293..cd79735013f9 100644
--- a/Documentation/networking/can.txt
+++ b/Documentation/networking/can.txt
@@ -334,7 +334,7 @@ solution for a couple of reasons:
            return 1;
    }
-    /* paraniod check ... */
+    /* paranoid check ... */
    if (nbytes < sizeof(struct can_frame)) {
            fprintf(stderr, "read: incomplete CAN frame\n");
            return 1;
diff --git a/Documentation/networking/dm9000.txt b/Documentation/networking/dm9000.txt
index 65df3dea5561..5552e2e575c5 100644
--- a/Documentation/networking/dm9000.txt
+++ b/Documentation/networking/dm9000.txt
@@ -129,7 +129,7 @@ PHY Link state polling
 ----------------------
 The driver keeps track of the link state and informs the network core
-about link (carrier) availablilty. This is managed by several methods
+about link (carrier) availability. This is managed by several methods
 depending on the version of the chip and on which PHY is being used.
 For the internal PHY, the original (and currently default) method is
diff --git a/Documentation/networking/l2tp.txt b/Documentation/networking/l2tp.txt
index 2451f551c505..63214b280e00 100644
--- a/Documentation/networking/l2tp.txt
+++ b/Documentation/networking/l2tp.txt
@@ -158,7 +158,7 @@ Sample Userspace Code
        }
        return 0;
-Miscellanous
+Miscellaneous
 ============
 The PPPoL2TP driver was developed as part of the OpenL2TP project by
diff --git a/Documentation/networking/netdevices.txt b/Documentation/networking/netdevices.txt
index a2ab6a0b116d..87b3d15f523a 100644
--- a/Documentation/networking/netdevices.txt
+++ b/Documentation/networking/netdevices.txt
@@ -74,7 +74,7 @@ dev->hard_start_xmit:
        for this and return NETDEV_TX_LOCKED when the spin lock fails.
        The locking there should also properly protect against 
        set_multicast_list. Note that the use of NETIF_F_LLTX is deprecated.
-        Dont use it for new drivers.
+        Don't use it for new drivers.
        Context: Process with BHs disabled or BH (timer),
                 will be called with interrupts disabled by netconsole.
diff --git a/Documentation/networking/phonet.txt b/Documentation/networking/phonet.txt
index 6a07e45d4a93..6e8ce09f9c73 100644
--- a/Documentation/networking/phonet.txt
+++ b/Documentation/networking/phonet.txt
@@ -36,7 +36,7 @@ Phonet packets have a common header as follows:
 On Linux, the link-layer header includes the pn_media byte (see below).
 The next 7 bytes are part of the network-layer header.
-The device ID is split: the 6 higher-order bits consitute the device
+The device ID is split: the 6 higher-order bits constitute the device
 address, while the 2 lower-order bits are used for multiplexing, as are
 the 8-bit object identifiers. As such, Phonet can be considered as a
 network layer with 6 bits of address space and 10 bits for transport
diff --git a/Documentation/networking/regulatory.txt b/Documentation/networking/regulatory.txt
index dcf31648414a..eaa1a25946c1 100644
--- a/Documentation/networking/regulatory.txt
+++ b/Documentation/networking/regulatory.txt
@@ -89,7 +89,7 @@ added to this document when its support is enabled.
 Device drivers who provide their own built regulatory domain
 do not need a callback as the channels registered by them are
 the only ones that will be allowed and therefore *additional*
-cannels cannot be enabled.
+channels cannot be enabled.
 Example code - drivers hinting an alpha2:
 ------------------------------------------
diff --git a/Documentation/power/devices.txt b/Documentation/power/devices.txt
index 421e7d00ffd0..c9abbd86bc18 100644
--- a/Documentation/power/devices.txt
+++ b/Documentation/power/devices.txt
@@ -75,9 +75,6 @@ may need to apply in domain-specific ways to their devices:
 struct bus_type {
        ...
        int  (*suspend)(struct device *dev, pm_message_t state);
-        int  (*suspend_late)(struct device *dev, pm_message_t state);
-        int  (*resume_early)(struct device *dev);
        int  (*resume)(struct device *dev);
 };
@@ -226,20 +223,7 @@ The phases are seen by driver notifications issued in this order:
        This call should handle parts of device suspend logic that require
        sleeping.  It probably does work to quiesce the device which hasn't
-        been abstracted into class.suspend() or bus.suspend_late().
+        been abstracted into class.suspend().
-   3    bus.suspend_late(dev, message) is called with IRQs disabled, and
-        with only one CPU active.  Until the bus.resume_early() phase
-        completes (see later), IRQs are not enabled again.  This method
-        won't be exposed by all busses; for message based busses like USB,
-        I2C, or SPI, device interactions normally require IRQs.  This bus
-        call may be morphed into a driver call with bus-specific parameters.
-        This call might save low level hardware state that might otherwise
-        be lost in the upcoming low power state, and actually put the
-        device into a low power state ... so that in some cases the device
-        may stay partly usable until this late.  This "late" call may also
-        help when coping with hardware that behaves badly.
 The pm_message_t parameter is currently used to refine those semantics
 (described later).
@@ -351,19 +335,11 @@ devices processing each phase's calls before the next phase begins.
 The phases are seen by driver notifications issued in this order:
-   1    bus.resume_early(dev) is called with IRQs disabled, and with
+   1    bus.resume(dev) reverses the effects of bus.suspend().  This may
-        only one CPU active.  As with bus.suspend_late(), this method
+        be morphed into a device driver call with bus-specific parameters;
-        won't be supported on busses that require IRQs in order to
+        implementations may sleep.
-        interact with devices.
-        This reverses the effects of bus.suspend_late().
-   2    bus.resume(dev) is called next.  This may be morphed into a device
-        driver call with bus-specific parameters; implementations may sleep.
-        This reverses the effects of bus.suspend().
-   3    class.resume(dev) is called for devices associated with a class
+   2    class.resume(dev) is called for devices associated with a class
        that has such a method.  Implementations may sleep.
        This reverses the effects of class.suspend(), and would usually
diff --git a/Documentation/power/regulator/consumer.txt b/Documentation/power/regulator/consumer.txt
index 82b7a43aadba..5f83fd24ea84 100644
--- a/Documentation/power/regulator/consumer.txt
+++ b/Documentation/power/regulator/consumer.txt
@@ -178,5 +178,5 @@ Consumers can uregister interest by calling :-
 int regulator_unregister_notifier(struct regulator *regulator,
                                struct notifier_block *nb);
-Regulators use the kernel notifier framework to send event to thier interested
+Regulators use the kernel notifier framework to send event to their interested
 consumers.
diff --git a/Documentation/power/regulator/overview.txt b/Documentation/power/regulator/overview.txt
index bdcb332bd7fb..0cded696ca01 100644
--- a/Documentation/power/regulator/overview.txt
+++ b/Documentation/power/regulator/overview.txt
@@ -119,7 +119,7 @@ Some terms used in this document:-
                   battery power, USB power)
                   Regulator Domains: is the new current limit within the
-                   regulator operating parameters for input/ouput voltage.
+                   regulator operating parameters for input/output voltage.
                   If the regulator request passes all the constraint tests
                   then the new regulator value is applied.
diff --git a/Documentation/power/s2ram.txt b/Documentation/power/s2ram.txt
index 2ebdc6091ce1..514b94fc931e 100644
--- a/Documentation/power/s2ram.txt
+++ b/Documentation/power/s2ram.txt
@@ -63,7 +63,7 @@ hardware during resume operations where a value can be set that will
 survive a reboot.
 Consequence is that after a resume (even if it is successful) your system
-clock will have a value corresponding to the magic mumber instead of the
+clock will have a value corresponding to the magic number instead of the
 correct date/time! It is therefore advisable to use a program like ntp-date
 or rdate to reset the correct date/time from an external time source when
 using this trace option.
diff --git a/Documentation/power/userland-swsusp.txt b/Documentation/power/userland-swsusp.txt
index 7b99636564c8..b967cd9137d6 100644
--- a/Documentation/power/userland-swsusp.txt
+++ b/Documentation/power/userland-swsusp.txt
@@ -109,7 +109,7 @@ unfreeze user space processes frozen by SNAPSHOT_UNFREEZE if they are
 still frozen when the device is being closed).
 Currently it is assumed that the userland utilities reading/writing the
-snapshot image from/to the kernel will use a swap parition, called the resume
+snapshot image from/to the kernel will use a swap partition, called the resume
 partition, or a swap file as storage space (if a swap file is used, the resume
 partition is the partition that holds this file).  However, this is not really
 required, as they can use, for example, a special (blank) suspend partition or
diff --git a/Documentation/powerpc/booting-without-of.txt b/Documentation/powerpc/booting-without-of.txt
index d16b7a1c3793..8d999d862d0e 100644
--- a/Documentation/powerpc/booting-without-of.txt
+++ b/Documentation/powerpc/booting-without-of.txt
@@ -1356,7 +1356,7 @@ platforms are moved over to use the flattened-device-tree model.
    - phy-map           : 1 cell, optional, bitmap of addresses to probe the PHY
                          for, used if phy-address is absent. bit 0x00000001 is
                          MDIO address 0.
-                          For Axon it can be absent, thouugh my current driver
+                          For Axon it can be absent, though my current driver
                          doesn't handle phy-address yet so for now, keep
                          0x00ffffff in it.
    - rx-fifo-size-gige : 1 cell, Rx fifo size in bytes for 1000 Mb/sec
@@ -1438,7 +1438,7 @@ platforms are moved over to use the flattened-device-tree model.
   The Xilinx EDK toolchain ships with a set of IP cores (devices) for use
   in Xilinx Spartan and Virtex FPGAs.  The devices cover the whole range
-   of standard device types (network, serial, etc.) and miscellanious
+   of standard device types (network, serial, etc.) and miscellaneous
   devices (gpio, LCD, spi, etc).  Also, since these devices are
   implemented within the fpga fabric every instance of the device can be
   synthesised with different options that change the behaviour.
diff --git a/Documentation/powerpc/dts-bindings/fsl/board.txt b/Documentation/powerpc/dts-bindings/fsl/board.txt
index 6c974d28eeb4..e8b5bc24d0ac 100644
--- a/Documentation/powerpc/dts-bindings/fsl/board.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/board.txt
@@ -38,7 +38,7 @@ Required properities:
 - reg : Should contain the address and the length of the GPIO bank
  register.
 - #gpio-cells : Should be two. The first cell is the pin number and the
-  second cell is used to specify optional paramters (currently unused).
+  second cell is used to specify optional parameters (currently unused).
 - gpio-controller : Marks the port as GPIO controller.
 Example:
diff --git a/Documentation/powerpc/dts-bindings/fsl/cpm_qe/cpm.txt b/Documentation/powerpc/dts-bindings/fsl/cpm_qe/cpm.txt
index 088fc471e03a..160c752484b4 100644
--- a/Documentation/powerpc/dts-bindings/fsl/cpm_qe/cpm.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/cpm_qe/cpm.txt
@@ -19,7 +19,7 @@ Example:
        reg = <119c0 30>;
     }
-* Properties common to mulitple CPM/QE devices
+* Properties common to multiple CPM/QE devices
 - fsl,cpm-command : This value is ORed with the opcode and command flag
                    to specify the device on which a CPM command operates.
diff --git a/Documentation/powerpc/dts-bindings/fsl/cpm_qe/gpio.txt b/Documentation/powerpc/dts-bindings/fsl/cpm_qe/gpio.txt
index 1815dfede1bc..349f79fd7076 100644
--- a/Documentation/powerpc/dts-bindings/fsl/cpm_qe/gpio.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/cpm_qe/gpio.txt
@@ -11,7 +11,7 @@ Required properties:
  "fsl,cpm1-pario-bank-c", "fsl,cpm1-pario-bank-d",
  "fsl,cpm1-pario-bank-e", "fsl,cpm2-pario-bank"
 - #gpio-cells : Should be two. The first cell is the pin number and the
-  second cell is used to specify optional paramters (currently unused).
+  second cell is used to specify optional parameters (currently unused).
 - gpio-controller : Marks the port as GPIO controller.
 Example of three SOC GPIO banks defined as gpio-controller nodes:
diff --git a/Documentation/powerpc/dts-bindings/fsl/msi-pic.txt b/Documentation/powerpc/dts-bindings/fsl/msi-pic.txt
index b26b91992c55..bcc30bac6831 100644
--- a/Documentation/powerpc/dts-bindings/fsl/msi-pic.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/msi-pic.txt
@@ -1,6 +1,6 @@
 * Freescale MSI interrupt controller
-Reguired properities:
+Required properties:
 - compatible : compatible list, contains 2 entries,
  first is "fsl,CHIP-msi", where CHIP is the processor(mpc8610, mpc8572,
  etc.) and the second is "fsl,mpic-msi" or "fsl,ipic-msi" depending on
diff --git a/Documentation/powerpc/dts-bindings/fsl/pmc.txt b/Documentation/powerpc/dts-bindings/fsl/pmc.txt
index 02f6f43ee1b7..07256b7ffcaa 100644
--- a/Documentation/powerpc/dts-bindings/fsl/pmc.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/pmc.txt
@@ -15,8 +15,8 @@ Properties:
  compatible; all statements below that apply to "fsl,mpc8548-pmc" also
  apply to "fsl,mpc8641d-pmc".
-  Compatibility does not include bit assigments in SCCR/PMCDR/DEVDISR; these
+  Compatibility does not include bit assignments in SCCR/PMCDR/DEVDISR; these
-  bit assigments are indicated via the sleep specifier in each device's
+  bit assignments are indicated via the sleep specifier in each device's
  sleep property.
 - reg: For devices compatible with "fsl,mpc8349-pmc", the first resource
diff --git a/Documentation/powerpc/qe_firmware.txt b/Documentation/powerpc/qe_firmware.txt
index 06da4d4b44f9..2031ddb33d09 100644
--- a/Documentation/powerpc/qe_firmware.txt
+++ b/Documentation/powerpc/qe_firmware.txt
@@ -225,7 +225,7 @@ For example, to match the 8323, revision 1.0:
     soc.major = 1
     soc.minor = 0
-'padding' is neccessary for structure alignment.  This field ensures that the
+'padding' is necessary for structure alignment.  This field ensures that the
 'extended_modes' field is aligned on a 64-bit boundary.
 'extended_modes' is a bitfield that defines special functionality which has an
diff --git a/Documentation/rbtree.txt b/Documentation/rbtree.txt
index 7224459b469e..aae8355d3166 100644
--- a/Documentation/rbtree.txt
+++ b/Documentation/rbtree.txt
@@ -131,8 +131,8 @@ Example:
        }
        /* Add new node and rebalance tree. */
-        rb_link_node(data->node, parent, new);
+        rb_link_node(&data->node, parent, new);
-        rb_insert_color(data->node, root);
+        rb_insert_color(&data->node, root);
        return TRUE;
  }
@@ -146,10 +146,10 @@ To remove an existing node from a tree, call:
 Example:
-  struct mytype *data = mysearch(mytree, "walrus");
+  struct mytype *data = mysearch(&mytree, "walrus");
  if (data) {
-        rb_erase(data->node, mytree);
+        rb_erase(&data->node, &mytree);
        myfree(data);
  }
@@ -188,5 +188,5 @@ Example:
  struct rb_node *node;
  for (node = rb_first(&mytree); node; node = rb_next(node))
-        printk("key=%s\n", rb_entry(node, int, keystring));
+        printk("key=%s\n", rb_entry(node, struct mytype, node)->keystring);
diff --git a/Documentation/s390/Debugging390.txt b/Documentation/s390/Debugging390.txt
index 10711d9f0788..1eb576a023bd 100644
--- a/Documentation/s390/Debugging390.txt
+++ b/Documentation/s390/Debugging390.txt
@@ -1984,7 +1984,7 @@ break *$pc
 break *0x400618
-heres a really useful one for large programs
+Here's a really useful one for large programs
 rbr
 Set a breakpoint for all functions matching REGEXP
 e.g.
@@ -2211,7 +2211,7 @@ Breakpoint 2 at 0x4d87a4: file top.c, line 2609.
 #5  0x51692c in readline_internal () at readline.c:521
 #6  0x5164fe in readline (prompt=0x7ffff810 "\177ÿøx\177ÿ÷Ø\177ÿøxÀ")
    at readline.c:349
-#7  0x4d7a8a in command_line_input (prrompt=0x564420 "(gdb) ", repeat=1,
+#7  0x4d7a8a in command_line_input (prompt=0x564420 "(gdb) ", repeat=1,
    annotation_suffix=0x4d6b44 "prompt") at top.c:2091
 #8  0x4d6cf0 in command_loop () at top.c:1345
 #9  0x4e25bc in main (argc=1, argv=0x7ffffdf4) at main.c:635
diff --git a/Documentation/scheduler/sched-nice-design.txt b/Documentation/scheduler/sched-nice-design.txt
index e2bae5a577e3..3ac1e46d5365 100644
--- a/Documentation/scheduler/sched-nice-design.txt
+++ b/Documentation/scheduler/sched-nice-design.txt
@@ -55,7 +55,7 @@ To sum it up: we always wanted to make nice levels more consistent, but
 within the constraints of HZ and jiffies and their nasty design level
 coupling to timeslices and granularity it was not really viable.
-The second (less frequent but still periodically occuring) complaint
+The second (less frequent but still periodically occurring) complaint
 about Linux's nice level support was its assymetry around the origo
 (which you can see demonstrated in the picture above), or more
 accurately: the fact that nice level behavior depended on the _absolute_
diff --git a/Documentation/scheduler/sched-rt-group.txt b/Documentation/scheduler/sched-rt-group.txt
index 5ba4d3fc625a..1df7f9cdab05 100644
--- a/Documentation/scheduler/sched-rt-group.txt
+++ b/Documentation/scheduler/sched-rt-group.txt
@@ -4,6 +4,7 @@
 CONTENTS
 ========
+0. WARNING
 1. Overview
  1.1 The problem
  1.2 The solution
@@ -14,6 +15,23 @@ CONTENTS
 3. Future plans
+0. WARNING
+==========
+ Fiddling with these settings can result in an unstable system, the knobs are
+ root only and assumes root knows what he is doing.
+Most notable:
+ * very small values in sched_rt_period_us can result in an unstable
+   system when the period is smaller than either the available hrtimer
+   resolution, or the time it takes to handle the budget refresh itself.
+ * very small values in sched_rt_runtime_us can result in an unstable
+   system when the runtime is so small the system has difficulty making
+   forward progress (NOTE: the migration thread and kstopmachine both
+   are real-time processes).
 1. Overview
 ===========
@@ -169,7 +187,7 @@ get their allocated time.
 Implementing SCHED_EDF might take a while to complete. Priority Inheritance is
 the biggest challenge as the current linux PI infrastructure is geared towards
-the limited static priority levels 0-139. With deadline scheduling you need to
+the limited static priority levels 0-99. With deadline scheduling you need to
 do deadline inheritance (since priority is inversely proportional to the
 deadline delta (deadline - now).
diff --git a/Documentation/scsi/aic79xx.txt b/Documentation/scsi/aic79xx.txt
index 683ccae00ad4..c014eccaf19f 100644
--- a/Documentation/scsi/aic79xx.txt
+++ b/Documentation/scsi/aic79xx.txt
@@ -194,7 +194,7 @@ The following information is available in this file:
          - Packetized SCSI Protocol at 160MB/s and 320MB/s
          - Quick Arbitration Selection (QAS)
          - Retained Training Information (Rev B. ASIC only)
-        - Interrupt Coalessing
+        - Interrupt Coalescing
        - Initiator Mode (target mode not currently 
          supported)
        - Support for the PCI-X standard up to 133MHz
diff --git a/Documentation/scsi/ncr53c8xx.txt b/Documentation/scsi/ncr53c8xx.txt
index 230e30846ef2..08e2b4d04aab 100644
--- a/Documentation/scsi/ncr53c8xx.txt
+++ b/Documentation/scsi/ncr53c8xx.txt
@@ -206,7 +206,7 @@ of MOVE MEMORY instructions.
 The 896 and the 895A allows handling of the phase mismatch context from 
 SCRIPTS (avoids the phase mismatch interrupt that stops the SCSI processor 
 until the C code has saved the context of the transfer).
-Implementing this without using LOAD/STORE instructions would be painfull 
+Implementing this without using LOAD/STORE instructions would be painful 
 and I didn't even want to try it.
 The 896 chip supports 64 bit PCI transactions and addressing, while the 
@@ -240,7 +240,7 @@ characteristics. This feature may also reduce average command latency.
 In order to really gain advantage of this feature, devices must have 
 a reasonable cache size (No miracle is to be expected for a low-end 
 hard disk with 128 KB or less).
-Some kown SCSI devices do not properly support tagged command queuing.
+Some known SCSI devices do not properly support tagged command queuing.
 Generally, firmware revisions that fix this kind of problems are available 
 at respective vendor web/ftp sites.
 All I can say is that the hard disks I use on my machines behave well with 
diff --git a/Documentation/scsi/sym53c8xx_2.txt b/Documentation/scsi/sym53c8xx_2.txt
index 49ea5c58c6bc..eb9a7b905b64 100644
--- a/Documentation/scsi/sym53c8xx_2.txt
+++ b/Documentation/scsi/sym53c8xx_2.txt
@@ -206,7 +206,7 @@ characteristics. This feature may also reduce average command latency.
 In order to really gain advantage of this feature, devices must have 
 a reasonable cache size (No miracle is to be expected for a low-end 
 hard disk with 128 KB or less).
-Some kown old SCSI devices do not properly support tagged command queuing.
+Some known old SCSI devices do not properly support tagged command queuing.
 Generally, firmware revisions that fix this kind of problems are available 
 at respective vendor web/ftp sites.
 All I can say is that I never have had problem with tagged queuing using 
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 012858d2b119..4252697a95d6 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -460,6 +460,25 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
    The power-management is supported.
+  Module snd-ctxfi
+  ----------------
+    Module for Creative Sound Blaster X-Fi boards (20k1 / 20k2 chips)
+        * Creative Sound Blaster X-Fi Titanium Fatal1ty Champion Series
+        * Creative Sound Blaster X-Fi Titanium Fatal1ty Professional Series
+        * Creative Sound Blaster X-Fi Titanium Professional Audio
+        * Creative Sound Blaster X-Fi Titanium
+        * Creative Sound Blaster X-Fi Elite Pro
+        * Creative Sound Blaster X-Fi Platinum
+        * Creative Sound Blaster X-Fi Fatal1ty
+        * Creative Sound Blaster X-Fi XtremeGamer
+        * Creative Sound Blaster X-Fi XtremeMusic
+    reference_rate      - reference sample rate, 44100 or 48000 (default)
+    multiple            - multiple to ref. sample rate, 1 or 2 (default)
+    This module supports multiple cards.
  Module snd-darla20
  ------------------
@@ -754,7 +773,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
    single_cmd  - Use single immediate commands to communicate with
                codecs (for debugging only)
    enable_msi  - Enable Message Signaled Interrupt (MSI) (default = off)
-    power_save  - Automatic power-saving timtout (in second, 0 =
+    power_save  - Automatic power-saving timeout (in second, 0 =
                disable)
    power_save_controller - Reset HD-audio controller in power-saving mode
                (default = on)
@@ -925,6 +944,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
                        * Onkyo SE-90PCI
                        * Onkyo SE-200PCI
                        * ESI Juli@
+                        * ESI Maya44
                        * Hercules Fortissimo IV
                        * EGO-SYS WaveTerminal 192M
@@ -933,7 +953,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
                  prodigy71xt, prodigy71hifi, prodigyhd2, prodigy192,
                  juli, aureon51, aureon71, universe, ap192, k8x800,
                  phase22, phase28, ms300, av710, se200pci, se90pci,
-                  fortissimo4, sn25p, WT192M
+                  fortissimo4, sn25p, WT192M, maya44
    This module supports multiple cards and autoprobe.
@@ -1093,6 +1113,13 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
    This module supports multiple cards.
    The driver requires the firmware loader support on kernel.
+  Module snd-lx6464es
+  -------------------
+    Module for Digigram LX6464ES boards
+    This module supports multiple cards.
  Module snd-maestro3
  -------------------
@@ -1543,13 +1570,15 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
  Module snd-sc6000
  -----------------
-    Module for Gallant SC-6000 soundcard.
+    Module for Gallant SC-6000 soundcard and later models: SC-6600
+    and SC-7000.
    port        - Port # (0x220 or 0x240)
    mss_port    - MSS Port # (0x530 or 0xe80)
    irq         - IRQ # (5,7,9,10,11)
    mpu_irq     - MPU-401 IRQ # (5,7,9,10) ,0 - no MPU-401 irq
    dma         - DMA # (1,3,0)
+    joystick    - Enable gameport - 0 = disable (default), 1 = enable
    This module supports multiple cards.
@@ -1859,7 +1888,8 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
  -------------------
    Module for sound cards based on the Asus AV100/AV200 chips,
-    i.e., Xonar D1, DX, D2, D2X, HDAV1.3 (Deluxe), and Essence STX.
+    i.e., Xonar D1, DX, D2, D2X, HDAV1.3 (Deluxe), Essence ST
+    (Deluxe) and Essence STX.
    This module supports autoprobe and multiple cards.
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 8eec05bc079e..de8e10a94103 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -36,6 +36,7 @@ ALC260
  acer          Acer TravelMate
  will          Will laptops (PB V7900)
  replacer      Replacer 672V
+  favorit100    Maxdata Favorit 100XS
  basic         fixed pin assignment (old default model)
  test          for testing/debugging purpose, almost all controls can
                adjusted.  Appearing only when compiled with
@@ -85,10 +86,11 @@ ALC269
  eeepc-p703    ASUS Eeepc P703 P900A
  eeepc-p901    ASUS Eeepc P901 S101
  fujitsu       FSC Amilo
+  lifebook      Fujitsu Lifebook S6420
  auto          auto-config reading BIOS (default)
-ALC662/663
+ALC662/663/272
-==========
+==============
  3stack-dig    3-stack (2-channel) with SPDIF
  3stack-6ch     3-stack (6-channel)
  3stack-6ch-dig 3-stack (6-channel) with SPDIF
@@ -107,6 +109,9 @@ ALC662/663
  asus-mode4    ASUS
  asus-mode5    ASUS
  asus-mode6    ASUS
+  dell          Dell with ALC272
+  dell-zm1      Dell ZM1 with ALC272
+  samsung-nc10  Samsung NC10 mini notebook
  auto          auto-config reading BIOS (default)
 ALC882/885
@@ -118,6 +123,7 @@ ALC882/885
  asus-a7j      ASUS A7J
  asus-a7m      ASUS A7M
  macpro        MacPro support
+  mb5           Macbook 5,1
  mbp3          Macbook Pro rev3
  imac24        iMac 24'' with jack detection
  w2jc          ASUS W2JC
@@ -133,10 +139,12 @@ ALC883/888
  acer          Acer laptops (Travelmate 3012WTMi, Aspire 5600, etc)
  acer-aspire   Acer Aspire 9810
  acer-aspire-4930g Acer Aspire 4930G
+  acer-aspire-8930g Acer Aspire 8930G
  medion        Medion Laptops
  medion-md2    Medion MD2
  targa-dig     Targa/MSI
-  targa-2ch-dig Targs/MSI with 2-channel
+  targa-2ch-dig Targa/MSI with 2-channel
+  targa-8ch-dig Targa/MSI with 8-channel (MSI GX620)
  laptop-eapd   3-jack with SPDIF I/O and EAPD (Clevo M540JE, M550JE)
  lenovo-101e   Lenovo 101E
  lenovo-nb0763 Lenovo NB0763
@@ -150,6 +158,9 @@ ALC883/888
  fujitsu-pi2515 Fujitsu AMILO Pi2515
  fujitsu-xa3530 Fujitsu AMILO XA3530
  3stack-6ch-intel Intel DG33* boards
+  asus-p5q      ASUS P5Q-EM boards
+  mb31          MacBook 3,1
+  sony-vaio-tt  Sony VAIO TT
  auto          auto-config reading BIOS (default)
 ALC861/660
@@ -334,6 +345,7 @@ STAC9227/9228/9229/927x
  ref-no-jd     Reference board without HP/Mic jack detection
  3stack        D965 3stack
  5stack        D965 5stack + SPDIF
+  5stack-no-fp  D965 5stack without front panel
  dell-3stack   Dell Dimension E520
  dell-bios     Fixes with Dell BIOS setup
  auto          BIOS setup (default)
@@ -347,6 +359,7 @@ STAC92HD71B*
  hp-m4         HP mini 1000
  hp-dv5        HP dv series
  hp-hdx        HP HDX series
+  hp-dv4-1222nr HP dv4-1222nr (with LED support)
  auto          BIOS setup (default)
 STAC92HD73*
diff --git a/Documentation/sound/alsa/HD-Audio.txt b/Documentation/sound/alsa/HD-Audio.txt
index 88b7433d2f11..71ac995b1915 100644
--- a/Documentation/sound/alsa/HD-Audio.txt
+++ b/Documentation/sound/alsa/HD-Audio.txt
@@ -16,7 +16,7 @@ methods for the	HD-audio hardware.
 The HD-audio component consists of two parts: the controller chip and 
 the codec chips on the HD-audio bus.  Linux provides a single driver
 for all controllers, snd-hda-intel.  Although the driver name contains
-a word of a well-known harware vendor, it's not specific to it but for
+a word of a well-known hardware vendor, it's not specific to it but for
 all controller chips by other companies.  Since the HD-audio
 controllers are supposed to be compatible, the single snd-hda-driver
 should work in most cases.  But, not surprisingly, there are known
diff --git a/Documentation/sound/alsa/Procfile.txt b/Documentation/sound/alsa/Procfile.txt
index bba2dbb79d81..381908d8ca42 100644
--- a/Documentation/sound/alsa/Procfile.txt
+++ b/Documentation/sound/alsa/Procfile.txt
@@ -88,21 +88,34 @@ card*/pcm*/info
        substreams, etc.
 card*/pcm*/xrun_debug
-        This file appears when CONFIG_SND_DEBUG=y.
+        This file appears when CONFIG_SND_DEBUG=y and
-        This shows the status of xrun (= buffer overrun/xrun) debug of
+        CONFIG_PCM_XRUN_DEBUG=y.
-        ALSA PCM middle layer, as an integer from 0 to 2.  The value
+        This shows the status of xrun (= buffer overrun/xrun) and
-        can be changed by writing to this file, such as
+        invalid PCM position debug/check of ALSA PCM middle layer.
+        It takes an integer value, can be changed by writing to this
-                 # cat 2 > /proc/asound/card0/pcm0p/xrun_debug
+        file, such as
-        When this value is greater than 0, the driver will show the
+                 # cat 5 > /proc/asound/card0/pcm0p/xrun_debug
-        messages to kernel log when an xrun is detected.  The debug
-        message is shown also when the invalid H/W pointer is detected
+        The value consists of the following bit flags:
-        at the update of periods (usually called from the interrupt
+          bit 0 = Enable XRUN/jiffies debug messages
+          bit 1 = Show stack trace at XRUN / jiffies check
+          bit 2 = Enable additional jiffies check
+        When the bit 0 is set, the driver will show the messages to
+        kernel log when an xrun is detected.  The debug message is
+        shown also when the invalid H/W pointer is detected at the
+        update of periods (usually called from the interrupt
        handler).
-        When this value is greater than 1, the driver will show the
+        When the bit 1 is set, the driver will show the stack trace
-        stack trace additionally.  This may help the debugging.
+        additionally.  This may help the debugging.
+        Since 2.6.30, this option can enable the hwptr check using
+        jiffies.  This detects spontaneous invalid pointer callback
+        values, but can be lead to too much corrections for a (mostly
+        buggy) hardware that doesn't give smooth pointer updates.
+        This feature is enabled via the bit 2.
 card*/pcm*/sub*/info
        The general information of this PCM sub-stream.
diff --git a/Documentation/sound/alsa/README.maya44 b/Documentation/sound/alsa/README.maya44
new file mode 100644
index 000000000000..0e41576fa13e
--- /dev/null
+++ b/Documentation/sound/alsa/README.maya44
@@ -0,0 +1,163 @@
+NOTE: The following is the original document of Rainer's patch that the
+current maya44 code based on.  Some contents might be obsoleted, but I
+keep here as reference -- tiwai
+----------------------------------------------------------------
+ 
+STATE OF DEVELOPMENT:
+This driver is being developed on the initiative of Piotr Makowski (oponek@gmail.com) and financed by Lars Bergmann.
+Development is carried out by Rainer Zimmermann (mail@lightshed.de).
+ESI provided a sample Maya44 card for the development work.
+However, unfortunately it has turned out difficult to get detailed programming information, so I (Rainer Zimmermann) had to find out some card-specific information by experiment and conjecture. Some information (in particular, several GPIO bits) is still missing.
+This is the first testing version of the Maya44 driver released to the alsa-devel mailing list (Feb 5, 2008).
+The following functions work, as tested by Rainer Zimmermann and Piotr Makowski:
+- playback and capture at all sampling rates
+- input/output level
+- crossmixing
+- line/mic switch
+- phantom power switch
+- analogue monitor a.k.a bypass
+The following functions *should* work, but are not fully tested:
+- Channel 3+4 analogue - S/PDIF input switching
+- S/PDIF output
+- all inputs/outputs on the M/IO/DIO extension card
+- internal/external clock selection
+*In particular, we would appreciate testing of these functions by anyone who has access to an M/IO/DIO extension card.*
+Things that do not seem to work:
+- The level meters ("multi track") in 'alsamixer' do not seem to react to signals in (if this is a bug, it would probably be in the existing ICE1724 code).
+- Ardour 2.1 seems to work only via JACK, not using ALSA directly or via OSS. This still needs to be tracked down.
+DRIVER DETAILS:
+the following files were added:
+pci/ice1724/maya44.c        - Maya44 specific code
+pci/ice1724/maya44.h
+pci/ice1724/ice1724.patch
+pci/ice1724/ice1724.h.patch - PROPOSED patch to ice1724.h (see SAMPLING RATES)
+i2c/other/wm8776.c  - low-level access routines for Wolfson WM8776 codecs 
+include/wm8776.h
+Note that the wm8776.c code is meant to be card-independent and does not actually register the codec with the ALSA infrastructure.
+This is done in maya44.c, mainly because some of the WM8776 controls are used in Maya44-specific ways, and should be named appropriately.
+the following files were created in pci/ice1724, simply #including the corresponding file from the alsa-kernel tree:
+wtm.h
+vt1720_mobo.h
+revo.h
+prodigy192.h
+pontis.h
+phase.h
+maya44.h
+juli.h
+aureon.h
+amp.h
+envy24ht.h
+se.h
+prodigy_hifi.h
+*I hope this is the correct way to do things.*
+SAMPLING RATES:
+The Maya44 card (or more exactly, the Wolfson WM8776 codecs) allow a maximum sampling rate of 192 kHz for playback and 92 kHz for capture.
+As the ICE1724 chip only allows one global sampling rate, this is handled as follows:
+* setting the sampling rate on any open PCM device on the maya44 card will always set the *global* sampling rate for all playback and capture channels.
+* In the current state of the driver, setting rates of up to 192 kHz is permitted even for capture devices.
+*AVOID CAPTURING AT RATES ABOVE 96kHz*, even though it may appear to work. The codec cannot actually capture at such rates, meaning poor quality.
+I propose some additional code for limiting the sampling rate when setting on a capture pcm device. However because of the global sampling rate, this logic would be somewhat problematic.
+The proposed code (currently deactivated) is in ice1712.h.patch, ice1724.c and maya44.c (in pci/ice1712).
+SOUND DEVICES:
+PCM devices correspond to inputs/outputs as follows (assuming Maya44 is card #0):
+hw:0,0 input - stereo, analog input 1+2
+hw:0,0 output - stereo, analog output 1+2
+hw:0,1 input - stereo, analog input 3+4 OR S/PDIF input
+hw:0,1 output - stereo, analog output 3+4 (and SPDIF out)
+NAMING OF MIXER CONTROLS:
+(for more information about the signal flow, please refer to the block diagram on p.24 of the ESI Maya44 manual, or in the ESI windows software).
+PCM: (digital) output level for channel 1+2
+PCM 1: same for channel 3+4
+Mic Phantom+48V: switch for +48V phantom power for electrostatic microphones on input 1/2.
+    Make sure this is not turned on while any other source is connected to input 1/2.
+    It might damage the source and/or the maya44 card.
+Mic/Line input: if switch is is on, input jack 1/2 is microphone input (mono), otherwise line input (stereo).
+Bypass: analogue bypass from ADC input to output for channel 1+2. Same as "Monitor" in the windows driver.
+Bypass 1: same for channel 3+4.
+Crossmix: cross-mixer from channels 1+2 to channels 3+4
+Crossmix 1: cross-mixer from channels 3+4 to channels 1+2
+IEC958 Output: switch for S/PDIF output.
+    This is not supported by the ESI windows driver.
+    S/PDIF should output the same signal as channel 3+4. [untested!]
+Digitial output selectors:
+    These switches allow a direct digital routing from the ADCs to the DACs.
+    Each switch determines where the digital input data to one of the DACs comes from.
+    They are not supported by the ESI windows driver.
+    For normal operation, they should all be set to "PCM out".
+H/W: Output source channel 1
+H/W 1: Output source channel 2
+H/W 2: Output source channel 3
+H/W 3: Output source channel 4
+H/W 4 ... H/W 9: unknown function, left in to enable testing.
+    Possibly some of these control S/PDIF output(s).
+    If these turn out to be unused, they will go away in later driver versions.
+Selectable values for each of the digital output selectors are:
+   "PCM out" -> DAC output of the corresponding channel (default setting)
+   "Input 1"...
+   "Input 4" -> direct routing from ADC output of the selected input channel
+--------
+Feb 14, 2008
+Rainer Zimmermann
+mail@lightshed.de
diff --git a/Documentation/sound/alsa/hda_codec.txt b/Documentation/sound/alsa/hda_codec.txt
index 34e87ec1379c..de8efbc7e4bd 100644
--- a/Documentation/sound/alsa/hda_codec.txt
+++ b/Documentation/sound/alsa/hda_codec.txt
@@ -114,7 +114,7 @@ For writing a sequence of verbs, use snd_hda_sequence_write().
 There are variants of cached read/write, snd_hda_codec_write_cache(),
 snd_hda_sequence_write_cache().  These are used for recording the
-register states for the power-mangement resume.  When no PM is needed,
+register states for the power-management resume.  When no PM is needed,
 these are equivalent with non-cached version.
 To retrieve the number of sub nodes connected to the given node, use
diff --git a/Documentation/sound/alsa/soc/dapm.txt b/Documentation/sound/alsa/soc/dapm.txt
index 9e6763264a2e..9ac842be9b4f 100644
--- a/Documentation/sound/alsa/soc/dapm.txt
+++ b/Documentation/sound/alsa/soc/dapm.txt
@@ -62,6 +62,7 @@ Audio DAPM widgets fall into a number of types:-
 o Mic        - Mic (and optional Jack)
 o Line       - Line Input/Output (and optional Jack)
 o Speaker    - Speaker
+ o Supply     - Power or clock supply widget used by other widgets.
 o Pre        - Special PRE widget (exec before all others)
 o Post       - Special POST widget (exec after all others)
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index f11ca7979fa6..322a00bb99d9 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -32,6 +32,7 @@ show up in /proc/sys/kernel:
 - kstack_depth_to_print       [ X86 only ]
 - l2cr                        [ PPC only ]
 - modprobe                    ==> Documentation/debugging-modules.txt
+- modules_disabled
 - msgmax
 - msgmnb
 - msgmni
@@ -184,6 +185,16 @@ kernel stack.
 ==============================================================
+modules_disabled:
+A toggle value indicating if modules are allowed to be loaded
+in an otherwise modular kernel.  This toggle defaults to off
+(0), but can be set true (1).  Once true, modules can be
+neither loaded nor unloaded, and the toggle cannot be set back
+to false.
+==============================================================
 osrelease, ostype & version:
 # cat osrelease
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index c302ddf629a0..6fab2dcbb4d3 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -358,7 +358,7 @@ nr_pdflush_threads
 The current number of pdflush threads.  This value is read-only.
 The value changes according to the number of dirty pages in the system.
-When neccessary, additional pdflush threads are created, one per second, up to
+When necessary, additional pdflush threads are created, one per second, up to
 nr_pdflush_threads_max.
 ==============================================================
@@ -565,7 +565,7 @@ swappiness
 This control is used to define how aggressive the kernel will swap
 memory pages.  Higher values will increase agressiveness, lower values
-descrease the amount of swap.
+decrease the amount of swap.
 The default value is 60.
diff --git a/Documentation/timers/hpet.txt b/Documentation/timers/hpet.txt
index e7c09abcfab4..04763a325520 100644
--- a/Documentation/timers/hpet.txt
+++ b/Documentation/timers/hpet.txt
@@ -7,7 +7,7 @@ by Intel and Microsoft which can be found at
 Each HPET has one fixed-rate counter (at 10+ MHz, hence "High Precision")
 and up to 32 comparators.  Normally three or more comparators are provided,
-each of which can generate oneshot interupts and at least one of which has
+each of which can generate oneshot interrupts and at least one of which has
 additional hardware to support periodic interrupts.  The comparators are
 also called "timers", which can be misleading since usually timers are
 independent of each other ... these share a counter, complicating resets.
diff --git a/Documentation/timers/timer_stats.txt b/Documentation/timers/timer_stats.txt
index 20d368c59814..9bd00fc2e823 100644
--- a/Documentation/timers/timer_stats.txt
+++ b/Documentation/timers/timer_stats.txt
@@ -62,7 +62,7 @@ Timerstats sample period: 3.888770 s
 The first column is the number of events, the second column the pid, the third
 column is the name of the process. The forth column shows the function which
-initialized the timer and in parantheses the callback function which was
+initialized the timer and in parenthesis the callback function which was
 executed on expiry.
    Thomas, Ingo
diff --git a/Documentation/trace/events.txt b/Documentation/trace/events.txt
new file mode 100644
index 000000000000..f157d7594ea7
--- /dev/null
+++ b/Documentation/trace/events.txt
@@ -0,0 +1,90 @@
+                             Event Tracing
+                Documentation written by Theodore Ts'o
+                        Updated by Li Zefan
+1. Introduction
+===============
+Tracepoints (see Documentation/trace/tracepoints.txt) can be used
+without creating custom kernel modules to register probe functions
+using the event tracing infrastructure.
+Not all tracepoints can be traced using the event tracing system;
+the kernel developer must provide code snippets which define how the
+tracing information is saved into the tracing buffer, and how the
+tracing information should be printed.
+2. Using Event Tracing
+======================
+2.1 Via the 'set_event' interface
+---------------------------------
+The events which are available for tracing can be found in the file
+/debug/tracing/available_events.
+To enable a particular event, such as 'sched_wakeup', simply echo it
+to /debug/tracing/set_event. For example:
+        # echo sched_wakeup >> /debug/tracing/set_event
+[ Note: '>>' is necessary, otherwise it will firstly disable
+  all the events. ]
+To disable an event, echo the event name to the set_event file prefixed
+with an exclamation point:
+        # echo '!sched_wakeup' >> /debug/tracing/set_event
+To disable all events, echo an empty line to the set_event file:
+        # echo > /debug/tracing/set_event
+To enable all events, echo '*:*' or '*:' to the set_event file:
+        # echo *:* > /debug/tracing/set_event
+The events are organized into subsystems, such as ext4, irq, sched,
+etc., and a full event name looks like this: <subsystem>:<event>.  The
+subsystem name is optional, but it is displayed in the available_events
+file.  All of the events in a subsystem can be specified via the syntax
+"<subsystem>:*"; for example, to enable all irq events, you can use the
+command:
+        # echo 'irq:*' > /debug/tracing/set_event
+2.2 Via the 'enable' toggle
+---------------------------
+The events available are also listed in /debug/tracing/events/ hierarchy
+of directories.
+To enable event 'sched_wakeup':
+        # echo 1 > /debug/tracing/events/sched/sched_wakeup/enable
+To disable it:
+        # echo 0 > /debug/tracing/events/sched/sched_wakeup/enable
+To enable all events in sched subsystem:
+        # echo 1 > /debug/tracing/events/sched/enable
+To eanble all events:
+        # echo 1 > /debug/tracing/events/enable
+When reading one of these enable files, there are four results:
+ 0 - all events this file affects are disabled
+ 1 - all events this file affects are enabled
+ X - there is a mixture of events enabled and disabled
+ ? - this file does not affect any event
+3. Defining an event-enabled tracepoint
+=======================================
+See The example provided in samples/trace_events
diff --git a/Documentation/trace/ftrace.txt b/Documentation/trace/ftrace.txt
index fd9a3e693813..7bd27f0e2880 100644
--- a/Documentation/trace/ftrace.txt
+++ b/Documentation/trace/ftrace.txt
@@ -179,7 +179,7 @@ Here is the list of current tracers that may be configured.
        Function call tracer to trace all kernel functions.
-  "function_graph_tracer"
+  "function_graph"
        Similar to the function tracer except that the
        function tracer probes the functions on their entry
@@ -518,9 +518,18 @@ priority with zero (0) being the highest priority and the nice
 values starting at 100 (nice -20). Below is a quick chart to map
 the kernel priority to user land priorities.
-  Kernel priority: 0 to 99    ==> user RT priority 99 to 0
+   Kernel Space                     User Space
-  Kernel priority: 100 to 139 ==> user nice -20 to 19
+ ===============================================================
-  Kernel priority: 140        ==> idle task priority
+   0(high) to  98(low)     user RT priority 99(high) to 1(low)
+                           with SCHED_RR or SCHED_FIFO
+ ---------------------------------------------------------------
+  99                       sched_priority is not used in scheduling
+                           decisions(it must be specified as 0)
+ ---------------------------------------------------------------
+ 100(high) to 139(low)     user nice -20(high) to 19(low)
+ ---------------------------------------------------------------
+ 140                       idle task priority
+ ---------------------------------------------------------------
 The task states are:
@@ -1825,4 +1834,4 @@ an error.
 -----------
 More details can be found in the source code, in the
-kernel/tracing/*.c files.
+kernel/trace/*.c files.
diff --git a/Documentation/trace/kmemtrace.txt b/Documentation/trace/kmemtrace.txt
index a956d9b7f943..6308735e58ca 100644
--- a/Documentation/trace/kmemtrace.txt
+++ b/Documentation/trace/kmemtrace.txt
@@ -64,7 +64,7 @@ III. Quick usage guide
 CONFIG_KMEMTRACE).
 2) Get the userspace tool and build it:
-$ git-clone git://repo.or.cz/kmemtrace-user.git         # current repository
+$ git clone git://repo.or.cz/kmemtrace-user.git         # current repository
 $ cd kmemtrace-user/
 $ ./autogen.sh
 $ ./configure
diff --git a/Documentation/trace/power.txt b/Documentation/trace/power.txt
new file mode 100644
index 000000000000..cd805e16dc27
--- /dev/null
+++ b/Documentation/trace/power.txt
@@ -0,0 +1,17 @@
+The power tracer collects detailed information about C-state and P-state
+transitions, instead of just looking at the high-level "average"
+information.
+There is a helper script found in scrips/tracing/power.pl in the kernel
+sources which can be used to parse this information and create a
+Scalable Vector Graphics (SVG) picture from the trace data.
+To use this tracer:
+        echo 0 > /sys/kernel/debug/tracing/tracing_enabled
+        echo power > /sys/kernel/debug/tracing/current_tracer
+        echo 1 > /sys/kernel/debug/tracing/tracing_enabled
+        sleep 1
+        echo 0 > /sys/kernel/debug/tracing/tracing_enabled
+        cat /sys/kernel/debug/tracing/trace | \
+                perl scripts/tracing/power.pl > out.sv
diff --git a/Documentation/usb/WUSB-Design-overview.txt b/Documentation/usb/WUSB-Design-overview.txt
index 4c3d62c7843a..c480e9c32dbd 100644
--- a/Documentation/usb/WUSB-Design-overview.txt
+++ b/Documentation/usb/WUSB-Design-overview.txt
@@ -84,7 +84,7 @@ The different logical parts of this driver are:
      *UWB*: the Ultra-Wide-Band stack -- manages the radio and
      associated spectrum to allow for devices sharing it. Allows to
-      control bandwidth assingment, beaconing, scanning, etc
+      control bandwidth assignment, beaconing, scanning, etc
    *
@@ -184,7 +184,7 @@ and sends the replies and notifications back to the API
 [/uwb_rc_neh_grok()/]. Notifications are handled to the UWB daemon, that
 is chartered, among other things, to keep the tab of how the UWB radio
 neighborhood looks, creating and destroying devices as they show up or
-dissapear.
+disappear.
 Command execution is very simple: a command block is sent and a event
 block or reply is expected back. For sending/receiving command/events, a
@@ -333,7 +333,7 @@ read descriptors and move our data.
 *Device life cycle and keep alives*
-Everytime there is a succesful transfer to/from a device, we update a
+Every time there is a successful transfer to/from a device, we update a
 per-device activity timestamp. If not, every now and then we check and
 if the activity timestamp gets old, we ping the device by sending it a
 Keep Alive IE; it responds with a /DN_Alive/ pong during the DNTS (this
@@ -411,7 +411,7 @@ context (wa_xfer) and submit it. When the xfer is done, our callback is
 called and we assign the status bits and release the xfer resources.
 In dequeue() we are basically cancelling/aborting the transfer. We issue
-a xfer abort request to the HC, cancell all the URBs we had submitted
+a xfer abort request to the HC, cancel all the URBs we had submitted
 and not yet done and when all that is done, the xfer callback will be
 called--this will call the URB callback.
diff --git a/Documentation/usb/anchors.txt b/Documentation/usb/anchors.txt
index 6f24f566955a..fe6a99a32bbd 100644
--- a/Documentation/usb/anchors.txt
+++ b/Documentation/usb/anchors.txt
@@ -27,7 +27,7 @@ Association and disassociation of URBs with anchors
 An association of URBs to an anchor is made by an explicit
 call to usb_anchor_urb(). The association is maintained until
-an URB is finished by (successfull) completion. Thus disassociation
+an URB is finished by (successful) completion. Thus disassociation
 is automatic. A function is provided to forcibly finish (kill)
 all URBs associated with an anchor.
 Furthermore, disassociation can be made with usb_unanchor_urb()
@@ -76,4 +76,4 @@ usb_get_from_anchor()
 Returns the oldest anchored URB of an anchor. The URB is unanchored
 and returned with a reference. As you may mix URBs to several
 destinations in one anchor you have no guarantee the chronologically
-first submitted URB is returned.
-\ No newline at end of file
+first submitted URB is returned.
diff --git a/Documentation/usb/callbacks.txt b/Documentation/usb/callbacks.txt
index 7c812411945b..bfb36b34b79e 100644
--- a/Documentation/usb/callbacks.txt
+++ b/Documentation/usb/callbacks.txt
@@ -65,7 +65,7 @@ Accept or decline an interface. If you accept the device return 0,
 otherwise -ENODEV or -ENXIO. Other error codes should be used only if a
 genuine error occurred during initialisation which prevented a driver
 from accepting a device that would else have been accepted.
-You are strongly encouraged to use usbcore'sfacility,
+You are strongly encouraged to use usbcore's facility,
 usb_set_intfdata(), to associate a data structure with an interface, so
 that you know which internal state and identity you associate with a
 particular interface. The device will not be suspended and you may do IO
diff --git a/Documentation/video4linux/cx18.txt b/Documentation/video4linux/cx18.txt
index 914cb7e734a2..4652c0f5da32 100644
--- a/Documentation/video4linux/cx18.txt
+++ b/Documentation/video4linux/cx18.txt
@@ -11,7 +11,7 @@ encoder chip:
 2) Some people have problems getting the i2c bus to work.
   The symptom is that the eeprom cannot be read and the card is
   unusable. This is probably fixed, but if you have problems
-   then post to the video4linux or ivtv-users mailinglist.
+   then post to the video4linux or ivtv-users mailing list.
 3) VBI (raw or sliced) has not yet been implemented.
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index e0203662f9e9..8da3a795083f 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -50,6 +50,10 @@ Protocol 2.08:	(Kernel 2.6.26) Added crc32 checksum and ELF format
 Protocol 2.09:  (Kernel 2.6.26) Added a field of 64-bit physical
                pointer to single linked list of struct setup_data.
+Protocol 2.10:  (Kernel 2.6.31) Added a protocol for relaxed alignment
+                beyond the kernel_alignment added, new init_size and
+                pref_address fields.  Added extended boot loader IDs.
 **** MEMORY LAYOUT
 The traditional memory map for the kernel loader, used for Image or
@@ -168,12 +172,13 @@ Offset	Proto	Name		Meaning
 021C/4  2.00+   ramdisk_size    initrd size (set by boot loader)
 0220/4  2.00+   bootsect_kludge DO NOT USE - for bootsect.S use only
 0224/2  2.01+   heap_end_ptr    Free memory after setup end
-0226/2  N/A     pad1            Unused
+0226/1  2.02+(3 ext_loader_ver  Extended boot loader version
+0227/1  2.02+(3 ext_loader_type Extended boot loader ID
 0228/4  2.02+   cmd_line_ptr    32-bit pointer to the kernel command line
 022C/4  2.03+   ramdisk_max     Highest legal initrd address
 0230/4  2.05+   kernel_alignment Physical addr alignment required for kernel
 0234/1  2.05+   relocatable_kernel Whether kernel is relocatable or not
-0235/1  N/A     pad2            Unused
+0235/1  2.10+   min_alignment   Minimum alignment, as a power of two
 0236/2  N/A     pad3            Unused
 0238/4  2.06+   cmdline_size    Maximum size of the kernel command line
 023C/4  2.07+   hardware_subarch Hardware subarchitecture
@@ -182,6 +187,8 @@ Offset	Proto	Name		Meaning
 024C/4  2.08+   payload_length  Length of kernel payload
 0250/8  2.09+   setup_data      64-bit physical pointer to linked list
                                of struct setup_data
+0258/8  2.10+   pref_address    Preferred loading address
+0260/4  2.10+   init_size       Linear memory required during initialization
 (1) For backwards compatibility, if the setup_sects field contains 0, the
    real value is 4.
@@ -190,6 +197,8 @@ Offset	Proto	Name		Meaning
    field are unusable, which means the size of a bzImage kernel
    cannot be determined.
+(3) Ignored, but safe to set, for boot protocols 2.02-2.09.
 If the "HdrS" (0x53726448) magic number is not found at offset 0x202,
 the boot protocol version is "old".  Loading an old kernel, the
 following parameters should be assumed:
@@ -343,18 +352,32 @@ Protocol:	2.00+
  0xTV here, where T is an identifier for the boot loader and V is
  a version number.  Otherwise, enter 0xFF here.
+  For boot loader IDs above T = 0xD, write T = 0xE to this field and
+  write the extended ID minus 0x10 to the ext_loader_type field.
+  Similarly, the ext_loader_ver field can be used to provide more than
+  four bits for the bootloader version.
+  For example, for T = 0x15, V = 0x234, write:
+  type_of_loader  <- 0xE4
+  ext_loader_type <- 0x05
+  ext_loader_ver  <- 0x23
  Assigned boot loader ids:
        0  LILO                 (0x00 reserved for pre-2.00 bootloader)
        1  Loadlin
        2  bootsect-loader      (0x20, all other values reserved)
-        3  SYSLINUX
+        3  Syslinux
-        4  EtherBoot
+        4  Etherboot/gPXE
        5  ELILO
        7  GRUB
-        8  U-BOOT
+        8  U-Boot
        9  Xen
        A  Gujin
        B  Qemu
+        C  Arcturus Networks uCbootloader
+        E  Extended             (see ext_loader_type)
+        F  Special              (0xFF = undefined)
  Please contact <hpa@zytor.com> if you need a bootloader ID
  value assigned.
@@ -453,6 +476,35 @@ Protocol:	2.01+
  Set this field to the offset (from the beginning of the real-mode
  code) of the end of the setup stack/heap, minus 0x0200.
+Field name:     ext_loader_ver
+Type:           write (optional)
+Offset/size:    0x226/1
+Protocol:       2.02+
+  This field is used as an extension of the version number in the
+  type_of_loader field.  The total version number is considered to be
+  (type_of_loader & 0x0f) + (ext_loader_ver << 4).
+  The use of this field is boot loader specific.  If not written, it
+  is zero.
+  Kernels prior to 2.6.31 did not recognize this field, but it is safe
+  to write for protocol version 2.02 or higher.
+Field name:     ext_loader_type
+Type:           write (obligatory if (type_of_loader & 0xf0) == 0xe0)
+Offset/size:    0x227/1
+Protocol:       2.02+
+  This field is used as an extension of the type number in
+  type_of_loader field.  If the type in type_of_loader is 0xE, then
+  the actual type is (ext_loader_type + 0x10).
+  This field is ignored if the type in type_of_loader is not 0xE.
+  Kernels prior to 2.6.31 did not recognize this field, but it is safe
+  to write for protocol version 2.02 or higher.
 Field name:     cmd_line_ptr
 Type:           write (obligatory)
 Offset/size:    0x228/4
@@ -482,11 +534,19 @@ Protocol:	2.03+
  0x37FFFFFF, you can start your ramdisk at 0x37FE0000.)
 Field name:     kernel_alignment
-Type:           read (reloc)
+Type:           read/modify (reloc)
 Offset/size:    0x230/4
-Protocol:       2.05+
+Protocol:       2.05+ (read), 2.10+ (modify)
+  Alignment unit required by the kernel (if relocatable_kernel is
+  true.)  A relocatable kernel that is loaded at an alignment
+  incompatible with the value in this field will be realigned during
+  kernel initialization.
-  Alignment unit required by the kernel (if relocatable_kernel is true.)
+  Starting with protocol version 2.10, this reflects the kernel
+  alignment preferred for optimal performance; it is possible for the
+  loader to modify this field to permit a lesser alignment.  See the
+  min_alignment and pref_address field below.
 Field name:     relocatable_kernel
 Type:           read (reloc)
@@ -498,6 +558,22 @@ Protocol:	2.05+
  After loading, the boot loader must set the code32_start field to
  point to the loaded code, or to a boot loader hook.
+Field name:     min_alignment
+Type:           read (reloc)
+Offset/size:    0x235/1
+Protocol:       2.10+
+  This field, if nonzero, indicates as a power of two the minimum
+  alignment required, as opposed to preferred, by the kernel to boot.
+  If a boot loader makes use of this field, it should update the
+  kernel_alignment field with the alignment unit desired; typically:
+        kernel_alignment = 1 << min_alignment
+  There may be a considerable performance cost with an excessively
+  misaligned kernel.  Therefore, a loader should typically try each
+  power-of-two alignment from kernel_alignment down to this alignment.
 Field name:     cmdline_size
 Type:           read
 Offset/size:    0x238/4
@@ -582,6 +658,36 @@ Protocol:	2.09+
  sure to consider the case where the linked list already contains
  entries.
+Field name:     pref_address
+Type:           read (reloc)
+Offset/size:    0x258/8
+Protocol:       2.10+
+  This field, if nonzero, represents a preferred load address for the
+  kernel.  A relocating bootloader should attempt to load at this
+  address if possible.
+  A non-relocatable kernel will unconditionally move itself and to run
+  at this address.
+Field name:     init_size
+Type:           read
+Offset/size:    0x25c/4
+  This field indicates the amount of linear contiguous memory starting
+  at the kernel runtime start address that the kernel needs before it
+  is capable of examining its memory map.  This is not the same thing
+  as the total amount of memory the kernel needs to boot, but it can
+  be used by a relocating boot loader to help select a safe load
+  address for the kernel.
+  The kernel runtime start address is determined by the following algorithm:
+  if (relocatable_kernel)
+        runtime_start = align_up(load_address, kernel_alignment)
+  else
+        runtime_start = pref_address
 **** THE IMAGE CHECKSUM
diff --git a/Documentation/x86/x86_64/boot-options.txt b/Documentation/x86/x86_64/boot-options.txt
index 34c13040a718..29a6ff8bc7d3 100644
--- a/Documentation/x86/x86_64/boot-options.txt
+++ b/Documentation/x86/x86_64/boot-options.txt
@@ -5,21 +5,51 @@ only the AMD64 specific ones are listed here.
 Machine check
-   mce=off disable machine check
+   Please see Documentation/x86/x86_64/machinecheck for sysfs runtime tunables.
-   mce=bootlog Enable logging of machine checks left over from booting.
-               Disabled by default on AMD because some BIOS leave bogus ones.
+   mce=off
-               If your BIOS doesn't do that it's a good idea to enable though
+                Disable machine check
-               to make sure you log even machine check events that result
+   mce=no_cmci
-               in a reboot. On Intel systems it is enabled by default.
+                Disable CMCI(Corrected Machine Check Interrupt) that
+                Intel processor supports.  Usually this disablement is
+                not recommended, but it might be handy if your hardware
+                is misbehaving.
+                Note that you'll get more problems without CMCI than with
+                due to the shared banks, i.e. you might get duplicated
+                error logs.
+   mce=dont_log_ce
+                Don't make logs for corrected errors.  All events reported
+                as corrected are silently cleared by OS.
+                This option will be useful if you have no interest in any
+                of corrected errors.
+   mce=ignore_ce
+                Disable features for corrected errors, e.g. polling timer
+                and CMCI.  All events reported as corrected are not cleared
+                by OS and remained in its error banks.
+                Usually this disablement is not recommended, however if
+                there is an agent checking/clearing corrected errors
+                (e.g. BIOS or hardware monitoring applications), conflicting
+                with OS's error handling, and you cannot deactivate the agent,
+                then this option will be a help.
+   mce=bootlog
+                Enable logging of machine checks left over from booting.
+                Disabled by default on AMD because some BIOS leave bogus ones.
+                If your BIOS doesn't do that it's a good idea to enable though
+                to make sure you log even machine check events that result
+                in a reboot. On Intel systems it is enabled by default.
   mce=nobootlog
                Disable boot machine check logging.
-   mce=tolerancelevel (number)
+   mce=tolerancelevel[,monarchtimeout] (number,number)
+                tolerance levels:
                0: always panic on uncorrected errors, log corrected errors
                1: panic or SIGBUS on uncorrected errors, log corrected errors
                2: SIGBUS or log uncorrected errors, log corrected errors
                3: never panic or SIGBUS, log all errors (for testing only)
                Default is 1
                Can be also set using sysfs which is preferable.
+                monarchtimeout:
+                Sets the time in us to wait for other CPUs on machine checks. 0
+                to disable.
   nomce (for compatibility with i386): same as mce=off
@@ -150,11 +180,6 @@ NUMA
                Otherwise, the remaining system RAM is allocated to an
                additional node.
-  numa=hotadd=percent
-                Only allow hotadd memory to preallocate page structures upto
-                percent of already available memory.
-                numa=hotadd=0 will disable hotadd memory.
 ACPI
  acpi=off      Don't enable ACPI
diff --git a/Documentation/x86/x86_64/machinecheck b/Documentation/x86/x86_64/machinecheck
index a05e58e7b159..b1fb30273286 100644
--- a/Documentation/x86/x86_64/machinecheck
+++ b/Documentation/x86/x86_64/machinecheck
@@ -41,7 +41,9 @@ check_interval
        the polling interval.  When the poller stops finding MCEs, it
        triggers an exponential backoff (poll less often) on the polling
        interval. The check_interval variable is both the initial and
-        maximum polling interval.
+        maximum polling interval. 0 means no polling for corrected machine
+        check errors (but some corrected errors might be still reported
+        in other ways)
 tolerant
        Tolerance level. When a machine check exception occurs for a non
@@ -67,6 +69,10 @@ trigger
        Program to run when a machine check event is detected.
        This is an alternative to running mcelog regularly from cron
        and allows to detect events faster.
+monarch_timeout
+        How long to wait for the other CPUs to machine check too on a
+        exception. 0 to disable waiting for other CPUs.
+        Unit: us
 TBD document entries for AMD threshold interrupt configuration
diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
index 29b52b14d0b4..d6498e3cd713 100644
--- a/Documentation/x86/x86_64/mm.txt
+++ b/Documentation/x86/x86_64/mm.txt
@@ -6,10 +6,11 @@ Virtual memory map with 4 level page tables:
 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm
 hole caused by [48:63] sign extension
 ffff800000000000 - ffff80ffffffffff (=40 bits) guard hole
-ffff880000000000 - ffffc0ffffffffff (=57 TB) direct mapping of all phys. memory
+ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory
-ffffc10000000000 - ffffc1ffffffffff (=40 bits) hole
+ffffc80000000000 - ffffc8ffffffffff (=40 bits) hole
-ffffc20000000000 - ffffe1ffffffffff (=45 bits) vmalloc/ioremap space
+ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space
-ffffe20000000000 - ffffe2ffffffffff (=40 bits) virtual memory map (1TB)
+ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole
+ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
 ... unused hole ...
 ffffffff80000000 - ffffffffa0000000 (=512 MB)  kernel text mapping, from phys 0
 ffffffffa0000000 - fffffffffff00000 (=1536 MB) module mapping space