41 files changed, 4970 insertions, 2125 deletions

diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index e27ae4604cef..bf1a95e31559 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -100,8 +100,8 @@ config MD_RAID1
           If unsure, say Y.
 
 config MD_RAID10
-        tristate "RAID-10 (mirrored striping) mode (EXPERIMENTAL)"
-        depends on BLK_DEV_MD && EXPERIMENTAL
+        tristate "RAID-10 (mirrored striping) mode"
+        depends on BLK_DEV_MD
         ---help---
           RAID-10 provides a combination of striping (RAID-0) and
           mirroring (RAID-1) with easier configuration and more flexible
@@ -169,11 +169,10 @@ config MD_MULTIPATH
         tristate "Multipath I/O support"
         depends on BLK_DEV_MD
         help
-          Multipath-IO is the ability of certain devices to address the same
-          physical disk over multiple 'IO paths'. The code ensures that such
-          paths can be defined and handled at runtime, and ensures that a
-          transparent failover to the backup path(s) happens if a IO errors
-          arrives on the primary path.
+          MD_MULTIPATH provides a simple multi-path personality for use
+          the MD framework.  It is not under active development.  New
+          projects should consider using DM_MULTIPATH which has more
+          features and more testing.
 
           If unsure, say N.
 
diff --git a/drivers/md/Makefile b/drivers/md/Makefile
index c9b3a7843d83..5e3aac41919d 100644
--- a/drivers/md/Makefile
+++ b/drivers/md/Makefile
@@ -40,4 +40,3 @@ obj-$(CONFIG_DM_ZERO)		+= dm-zero.o
 ifeq ($(CONFIG_DM_UEVENT),y)
 dm-mod-objs                     += dm-uevent.o
 endif
-
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 6986b0059d23..1742435ce3ae 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -212,7 +212,7 @@ static void bitmap_checkfree(struct bitmap *bitmap, unsigned long page)
  */
 
 /* IO operations when bitmap is stored near all superblocks */
-static struct page *read_sb_page(mddev_t *mddev, long offset,
+static struct page *read_sb_page(mddev_t *mddev, loff_t offset,
                                  struct page *page,
                                  unsigned long index, int size)
 {
@@ -287,27 +287,36 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 
         while ((rdev = next_active_rdev(rdev, mddev)) != NULL) {
                         int size = PAGE_SIZE;
+                        loff_t offset = mddev->bitmap_info.offset;
                         if (page->index == bitmap->file_pages-1)
                                 size = roundup(bitmap->last_page_size,
                                                bdev_logical_block_size(rdev->bdev));
                         /* Just make sure we aren't corrupting data or
                          * metadata
                          */
-                        if (bitmap->offset < 0) {
+                        if (mddev->external) {
+                                /* Bitmap could be anywhere. */
+                                if (rdev->sb_start + offset + (page->index *(PAGE_SIZE/512)) >
+                                    rdev->data_offset &&
+                                    rdev->sb_start + offset < 
+                                    rdev->data_offset + mddev->dev_sectors +
+                                    (PAGE_SIZE/512))
+                                        goto bad_alignment;
+                        } else if (offset < 0) {
                                 /* DATA  BITMAP METADATA  */
-                                if (bitmap->offset
+                                if (offset
                                     + (long)(page->index * (PAGE_SIZE/512))
                                     + size/512 > 0)
                                         /* bitmap runs in to metadata */
                                         goto bad_alignment;
                                 if (rdev->data_offset + mddev->dev_sectors
-                                    > rdev->sb_start + bitmap->offset)
+                                    > rdev->sb_start + offset)
                                         /* data runs in to bitmap */
                                         goto bad_alignment;
                         } else if (rdev->sb_start < rdev->data_offset) {
                                 /* METADATA BITMAP DATA */
                                 if (rdev->sb_start
-                                    + bitmap->offset
+                                    + offset
                                     + page->index*(PAGE_SIZE/512) + size/512
                                     > rdev->data_offset)
                                         /* bitmap runs in to data */
@@ -316,7 +325,7 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
                                 /* DATA METADATA BITMAP - no problems */
                         }
                         md_super_write(mddev, rdev,
-                                       rdev->sb_start + bitmap->offset
+                                       rdev->sb_start + offset
                                        + page->index * (PAGE_SIZE/512),
                                        size,
                                        page);
@@ -488,19 +497,24 @@ void bitmap_update_sb(struct bitmap *bitmap)
 
         if (!bitmap || !bitmap->mddev) /* no bitmap for this array */
                 return;
+        if (bitmap->mddev->bitmap_info.external)
+                return;
         spin_lock_irqsave(&bitmap->lock, flags);
         if (!bitmap->sb_page) { /* no superblock */
                 spin_unlock_irqrestore(&bitmap->lock, flags);
                 return;
         }
         spin_unlock_irqrestore(&bitmap->lock, flags);
-        sb = (bitmap_super_t *)kmap_atomic(bitmap->sb_page, KM_USER0);
+        sb = kmap_atomic(bitmap->sb_page, KM_USER0);
         sb->events = cpu_to_le64(bitmap->mddev->events);
         if (bitmap->mddev->events < bitmap->events_cleared) {
                 /* rocking back to read-only */
                 bitmap->events_cleared = bitmap->mddev->events;
                 sb->events_cleared = cpu_to_le64(bitmap->events_cleared);
         }
+        /* Just in case these have been changed via sysfs: */
+        sb->daemon_sleep = cpu_to_le32(bitmap->mddev->bitmap_info.daemon_sleep/HZ);
+        sb->write_behind = cpu_to_le32(bitmap->mddev->bitmap_info.max_write_behind);
         kunmap_atomic(sb, KM_USER0);
         write_page(bitmap, bitmap->sb_page, 1);
 }
@@ -512,7 +526,7 @@ void bitmap_print_sb(struct bitmap *bitmap)
 
         if (!bitmap || !bitmap->sb_page)
                 return;
-        sb = (bitmap_super_t *)kmap_atomic(bitmap->sb_page, KM_USER0);
+        sb = kmap_atomic(bitmap->sb_page, KM_USER0);
         printk(KERN_DEBUG "%s: bitmap file superblock:\n", bmname(bitmap));
         printk(KERN_DEBUG "         magic: %08x\n", le32_to_cpu(sb->magic));
         printk(KERN_DEBUG "       version: %d\n", le32_to_cpu(sb->version));
@@ -550,7 +564,8 @@ static int bitmap_read_sb(struct bitmap *bitmap)
 
                 bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);
         } else {
-                bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset,
+                bitmap->sb_page = read_sb_page(bitmap->mddev,
+                                               bitmap->mddev->bitmap_info.offset,
                                                NULL,
                                                0, sizeof(bitmap_super_t));
         }
@@ -560,10 +575,10 @@ static int bitmap_read_sb(struct bitmap *bitmap)
                 return err;
         }
 
-        sb = (bitmap_super_t *)kmap_atomic(bitmap->sb_page, KM_USER0);
+        sb = kmap_atomic(bitmap->sb_page, KM_USER0);
 
         chunksize = le32_to_cpu(sb->chunksize);
-        daemon_sleep = le32_to_cpu(sb->daemon_sleep);
+        daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
         write_behind = le32_to_cpu(sb->write_behind);
 
         /* verify that the bitmap-specific fields are valid */
@@ -576,7 +591,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
                 reason = "bitmap chunksize too small";
         else if ((1 << ffz(~chunksize)) != chunksize)
                 reason = "bitmap chunksize not a power of 2";
-        else if (daemon_sleep < 1 || daemon_sleep > MAX_SCHEDULE_TIMEOUT / HZ)
+        else if (daemon_sleep < 1 || daemon_sleep > MAX_SCHEDULE_TIMEOUT)
                 reason = "daemon sleep period out of range";
         else if (write_behind > COUNTER_MAX)
                 reason = "write-behind limit out of range (0 - 16383)";
@@ -610,10 +625,9 @@ static int bitmap_read_sb(struct bitmap *bitmap)
         }
 success:
         /* assign fields using values from superblock */
-        bitmap->chunksize = chunksize;
-        bitmap->daemon_sleep = daemon_sleep;
-        bitmap->daemon_lastrun = jiffies;
-        bitmap->max_write_behind = write_behind;
+        bitmap->mddev->bitmap_info.chunksize = chunksize;
+        bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep;
+        bitmap->mddev->bitmap_info.max_write_behind = write_behind;
         bitmap->flags |= le32_to_cpu(sb->state);
         if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN)
                 bitmap->flags |= BITMAP_HOSTENDIAN;
@@ -647,7 +661,7 @@ static int bitmap_mask_state(struct bitmap *bitmap, enum bitmap_state bits,
                 return 0;
         }
         spin_unlock_irqrestore(&bitmap->lock, flags);
-        sb = (bitmap_super_t *)kmap_atomic(bitmap->sb_page, KM_USER0);
+        sb = kmap_atomic(bitmap->sb_page, KM_USER0);
         old = le32_to_cpu(sb->state) & bits;
         switch (op) {
                 case MASK_SET: sb->state |= cpu_to_le32(bits);
@@ -664,16 +678,26 @@ static int bitmap_mask_state(struct bitmap *bitmap, enum bitmap_state bits,
  * general bitmap file operations
  */
 
+/*
+ * on-disk bitmap:
+ *
+ * Use one bit per "chunk" (block set). We do the disk I/O on the bitmap
+ * file a page at a time. There's a superblock at the start of the file.
+ */
 /* calculate the index of the page that contains this bit */
-static inline unsigned long file_page_index(unsigned long chunk)
+static inline unsigned long file_page_index(struct bitmap *bitmap, unsigned long chunk)
 {
-        return CHUNK_BIT_OFFSET(chunk) >> PAGE_BIT_SHIFT;
+        if (!bitmap->mddev->bitmap_info.external)
+                chunk += sizeof(bitmap_super_t) << 3;
+        return chunk >> PAGE_BIT_SHIFT;
 }
 
 /* calculate the (bit) offset of this bit within a page */
-static inline unsigned long file_page_offset(unsigned long chunk)
+static inline unsigned long file_page_offset(struct bitmap *bitmap, unsigned long chunk)
 {
-        return CHUNK_BIT_OFFSET(chunk) & (PAGE_BITS - 1);
+        if (!bitmap->mddev->bitmap_info.external)
+                chunk += sizeof(bitmap_super_t) << 3;
+        return chunk & (PAGE_BITS - 1);
 }
 
 /*
@@ -686,8 +710,9 @@ static inline unsigned long file_page_offset(unsigned long chunk)
 static inline struct page *filemap_get_page(struct bitmap *bitmap,
                                         unsigned long chunk)
 {
-        if (file_page_index(chunk) >= bitmap->file_pages) return NULL;
-        return bitmap->filemap[file_page_index(chunk) - file_page_index(0)];
+        if (file_page_index(bitmap, chunk) >= bitmap->file_pages) return NULL;
+        return bitmap->filemap[file_page_index(bitmap, chunk)
+                               - file_page_index(bitmap, 0)];
 }
 
 
@@ -710,7 +735,7 @@ static void bitmap_file_unmap(struct bitmap *bitmap)
         spin_unlock_irqrestore(&bitmap->lock, flags);
 
         while (pages--)
-                if (map[pages]->index != 0) /* 0 is sb_page, release it below */
+                if (map[pages] != sb_page) /* 0 is sb_page, release it below */
                         free_buffers(map[pages]);
         kfree(map);
         kfree(attr);
@@ -821,7 +846,7 @@ static void bitmap_file_set_bit(struct bitmap *bitmap, sector_t block)
 
         page = filemap_get_page(bitmap, chunk);
         if (!page) return;
-        bit = file_page_offset(chunk);
+        bit = file_page_offset(bitmap, chunk);
 
         /* set the bit */
         kaddr = kmap_atomic(page, KM_USER0);
@@ -907,7 +932,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
         chunks = bitmap->chunks;
         file = bitmap->file;
 
-        BUG_ON(!file && !bitmap->offset);
+        BUG_ON(!file && !bitmap->mddev->bitmap_info.offset);
 
 #ifdef INJECT_FAULTS_3
         outofdate = 1;
@@ -919,14 +944,17 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                         "recovery\n", bmname(bitmap));
 
         bytes = (chunks + 7) / 8;
+        if (!bitmap->mddev->bitmap_info.external)
+                bytes += sizeof(bitmap_super_t);
 
-        num_pages = (bytes + sizeof(bitmap_super_t) + PAGE_SIZE - 1) / PAGE_SIZE;
+        
+        num_pages = (bytes + PAGE_SIZE - 1) / PAGE_SIZE;
 
-        if (file && i_size_read(file->f_mapping->host) < bytes + sizeof(bitmap_super_t)) {
+        if (file && i_size_read(file->f_mapping->host) < bytes) {
                 printk(KERN_INFO "%s: bitmap file too short %lu < %lu\n",
                         bmname(bitmap),
                         (unsigned long) i_size_read(file->f_mapping->host),
-                        bytes + sizeof(bitmap_super_t));
+                        bytes);
                 goto err;
         }
 
@@ -947,17 +975,16 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 
         for (i = 0; i < chunks; i++) {
                 int b;
-                index = file_page_index(i);
-                bit = file_page_offset(i);
+                index = file_page_index(bitmap, i);
+                bit = file_page_offset(bitmap, i);
                 if (index != oldindex) { /* this is a new page, read it in */
                         int count;
                         /* unmap the old page, we're done with it */
                         if (index == num_pages-1)
-                                count = bytes + sizeof(bitmap_super_t)
-                                        - index * PAGE_SIZE;
+                                count = bytes - index * PAGE_SIZE;
                         else
                                 count = PAGE_SIZE;
-                        if (index == 0) {
+                        if (index == 0 && bitmap->sb_page) {
                                 /*
                                  * if we're here then the superblock page
                                  * contains some bits (PAGE_SIZE != sizeof sb)
@@ -967,14 +994,15 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                 offset = sizeof(bitmap_super_t);
                                 if (!file)
                                         read_sb_page(bitmap->mddev,
-                                                     bitmap->offset,
+                                                     bitmap->mddev->bitmap_info.offset,
                                                      page,
                                                      index, count);
                         } else if (file) {
                                 page = read_page(file, index, bitmap, count);
                                 offset = 0;
                         } else {
-                                page = read_sb_page(bitmap->mddev, bitmap->offset,
+                                page = read_sb_page(bitmap->mddev,
+                                                    bitmap->mddev->bitmap_info.offset,
                                                     NULL,
                                                     index, count);
                                 offset = 0;
@@ -1078,23 +1106,32 @@ static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
  *                      out to disk
  */
 
-void bitmap_daemon_work(struct bitmap *bitmap)
+void bitmap_daemon_work(mddev_t *mddev)
 {
+        struct bitmap *bitmap;
         unsigned long j;
         unsigned long flags;
         struct page *page = NULL, *lastpage = NULL;
         int blocks;
         void *paddr;
 
-        if (bitmap == NULL)
+        /* Use a mutex to guard daemon_work against
+         * bitmap_destroy.
+         */
+        mutex_lock(&mddev->bitmap_info.mutex);
+        bitmap = mddev->bitmap;
+        if (bitmap == NULL) {
+                mutex_unlock(&mddev->bitmap_info.mutex);
                 return;
-        if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
+        }
+        if (time_before(jiffies, bitmap->daemon_lastrun
+                        + bitmap->mddev->bitmap_info.daemon_sleep))
                 goto done;
 
         bitmap->daemon_lastrun = jiffies;
         if (bitmap->allclean) {
                 bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
-                return;
+                goto done;
         }
         bitmap->allclean = 1;
 
@@ -1142,7 +1179,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                         /* We are possibly going to clear some bits, so make
                          * sure that events_cleared is up-to-date.
                          */
-                        if (bitmap->need_sync) {
+                        if (bitmap->need_sync &&
+                            bitmap->mddev->bitmap_info.external == 0) {
                                 bitmap_super_t *sb;
                                 bitmap->need_sync = 0;
                                 sb = kmap_atomic(bitmap->sb_page, KM_USER0);
@@ -1152,7 +1190,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                 write_page(bitmap, bitmap->sb_page, 1);
                         }
                         spin_lock_irqsave(&bitmap->lock, flags);
-                        clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
+                        if (!bitmap->need_sync)
+                                clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
                 }
                 bmc = bitmap_get_counter(bitmap,
                                          (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
@@ -1167,7 +1206,7 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                         if (*bmc == 2) {
                                 *bmc=1; /* maybe clear the bit next time */
                                 set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
-                        } else if (*bmc == 1) {
+                        } else if (*bmc == 1 && !bitmap->need_sync) {
                                 /* we can clear the bit */
                                 *bmc = 0;
                                 bitmap_count_page(bitmap,
@@ -1177,9 +1216,11 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                 /* clear the bit */
                                 paddr = kmap_atomic(page, KM_USER0);
                                 if (bitmap->flags & BITMAP_HOSTENDIAN)
-                                        clear_bit(file_page_offset(j), paddr);
+                                        clear_bit(file_page_offset(bitmap, j),
+                                                  paddr);
                                 else
-                                        ext2_clear_bit(file_page_offset(j), paddr);
+                                        ext2_clear_bit(file_page_offset(bitmap, j),
+                                                       paddr);
                                 kunmap_atomic(paddr, KM_USER0);
                         }
                 } else
@@ -1202,7 +1243,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 
  done:
         if (bitmap->allclean == 0)
-                bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
+                bitmap->mddev->thread->timeout = 
+                        bitmap->mddev->bitmap_info.daemon_sleep;
+        mutex_unlock(&mddev->bitmap_info.mutex);
 }
 
 static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
@@ -1249,9 +1292,14 @@ int bitmap_startwrite(struct bitmap *bitmap, sector_t offset, unsigned long sect
         if (!bitmap) return 0;
 
         if (behind) {
+                int bw;
                 atomic_inc(&bitmap->behind_writes);
+                bw = atomic_read(&bitmap->behind_writes);
+                if (bw > bitmap->behind_writes_used)
+                        bitmap->behind_writes_used = bw;
+
                 PRINTK(KERN_DEBUG "inc write-behind count %d/%d\n",
-                  atomic_read(&bitmap->behind_writes), bitmap->max_write_behind);
+                       bw, bitmap->max_write_behind);
         }
 
         while (sectors) {
@@ -1308,7 +1356,8 @@ void bitmap_endwrite(struct bitmap *bitmap, sector_t offset, unsigned long secto
 {
         if (!bitmap) return;
         if (behind) {
-                atomic_dec(&bitmap->behind_writes);
+                if (atomic_dec_and_test(&bitmap->behind_writes))
+                        wake_up(&bitmap->behind_wait);
                 PRINTK(KERN_DEBUG "dec write-behind count %d/%d\n",
                   atomic_read(&bitmap->behind_writes), bitmap->max_write_behind);
         }
@@ -1332,6 +1381,7 @@ void bitmap_endwrite(struct bitmap *bitmap, sector_t offset, unsigned long secto
                     bitmap->events_cleared < bitmap->mddev->events) {
                         bitmap->events_cleared = bitmap->mddev->events;
                         bitmap->need_sync = 1;
+                        sysfs_notify_dirent(bitmap->sysfs_can_clear);
                 }
 
                 if (!success && ! (*bmc & NEEDED_MASK))
@@ -1470,7 +1520,7 @@ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector)
                 return;
         }
         if (time_before(jiffies, (bitmap->last_end_sync
-                                  + bitmap->daemon_sleep * HZ)))
+                                  + bitmap->mddev->bitmap_info.daemon_sleep)))
                 return;
         wait_event(bitmap->mddev->recovery_wait,
                    atomic_read(&bitmap->mddev->recovery_active) == 0);
@@ -1522,6 +1572,12 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
                 sector_t sec = (sector_t)chunk << CHUNK_BLOCK_SHIFT(bitmap);
                 bitmap_set_memory_bits(bitmap, sec, 1);
                 bitmap_file_set_bit(bitmap, sec);
+                if (sec < bitmap->mddev->recovery_cp)
+                        /* We are asserting that the array is dirty,
+                         * so move the recovery_cp address back so
+                         * that it is obvious that it is dirty
+                         */
+                        bitmap->mddev->recovery_cp = sec;
         }
 }
 
@@ -1531,7 +1587,7 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
 void bitmap_flush(mddev_t *mddev)
 {
         struct bitmap *bitmap = mddev->bitmap;
-        int sleep;
+        long sleep;
 
         if (!bitmap) /* there was no bitmap */
                 return;
@@ -1539,12 +1595,13 @@ void bitmap_flush(mddev_t *mddev)
         /* run the daemon_work three time to ensure everything is flushed
          * that can be
          */
-        sleep = bitmap->daemon_sleep;
-        bitmap->daemon_sleep = 0;
-        bitmap_daemon_work(bitmap);
-        bitmap_daemon_work(bitmap);
-        bitmap_daemon_work(bitmap);
-        bitmap->daemon_sleep = sleep;
+        sleep = mddev->bitmap_info.daemon_sleep * 2;
+        bitmap->daemon_lastrun -= sleep;
+        bitmap_daemon_work(mddev);
+        bitmap->daemon_lastrun -= sleep;
+        bitmap_daemon_work(mddev);
+        bitmap->daemon_lastrun -= sleep;
+        bitmap_daemon_work(mddev);
         bitmap_update_sb(bitmap);
 }
 
@@ -1574,6 +1631,7 @@ static void bitmap_free(struct bitmap *bitmap)
         kfree(bp);
         kfree(bitmap);
 }
+
 void bitmap_destroy(mddev_t *mddev)
 {
         struct bitmap *bitmap = mddev->bitmap;
@@ -1581,10 +1639,15 @@ void bitmap_destroy(mddev_t *mddev)
         if (!bitmap) /* there was no bitmap */
                 return;
 
+        mutex_lock(&mddev->bitmap_info.mutex);
         mddev->bitmap = NULL; /* disconnect from the md device */
+        mutex_unlock(&mddev->bitmap_info.mutex);
         if (mddev->thread)
                 mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
 
+        if (bitmap->sysfs_can_clear)
+                sysfs_put(bitmap->sysfs_can_clear);
+
         bitmap_free(bitmap);
 }
 
@@ -1598,16 +1661,17 @@ int bitmap_create(mddev_t *mddev)
         sector_t blocks = mddev->resync_max_sectors;
         unsigned long chunks;
         unsigned long pages;
-        struct file *file = mddev->bitmap_file;
+        struct file *file = mddev->bitmap_info.file;
         int err;
         sector_t start;
+        struct sysfs_dirent *bm;
 
         BUILD_BUG_ON(sizeof(bitmap_super_t) != 256);
 
-        if (!file && !mddev->bitmap_offset) /* bitmap disabled, nothing to do */
+        if (!file && !mddev->bitmap_info.offset) /* bitmap disabled, nothing to do */
                 return 0;
 
-        BUG_ON(file && mddev->bitmap_offset);
+        BUG_ON(file && mddev->bitmap_info.offset);
 
         bitmap = kzalloc(sizeof(*bitmap), GFP_KERNEL);
         if (!bitmap)
@@ -1617,24 +1681,42 @@ int bitmap_create(mddev_t *mddev)
         atomic_set(&bitmap->pending_writes, 0);
         init_waitqueue_head(&bitmap->write_wait);
         init_waitqueue_head(&bitmap->overflow_wait);
+        init_waitqueue_head(&bitmap->behind_wait);
 
         bitmap->mddev = mddev;
 
+        bm = sysfs_get_dirent(mddev->kobj.sd, NULL, "bitmap");
+        if (bm) {
+                bitmap->sysfs_can_clear = sysfs_get_dirent(bm, NULL, "can_clear");
+                sysfs_put(bm);
+        } else
+                bitmap->sysfs_can_clear = NULL;
+
         bitmap->file = file;
-        bitmap->offset = mddev->bitmap_offset;
         if (file) {
                 get_file(file);
-                do_sync_mapping_range(file->f_mapping, 0, LLONG_MAX,
-                                      SYNC_FILE_RANGE_WAIT_BEFORE |
-                                      SYNC_FILE_RANGE_WRITE |
-                                      SYNC_FILE_RANGE_WAIT_AFTER);
+                /* As future accesses to this file will use bmap,
+                 * and bypass the page cache, we must sync the file
+                 * first.
+                 */
+                vfs_fsync(file, 1);
+        }
+        /* read superblock from bitmap file (this sets mddev->bitmap_info.chunksize) */
+        if (!mddev->bitmap_info.external)
+                err = bitmap_read_sb(bitmap);
+        else {
+                err = 0;
+                if (mddev->bitmap_info.chunksize == 0 ||
+                    mddev->bitmap_info.daemon_sleep == 0)
+                        /* chunksize and time_base need to be
+                         * set first. */
+                        err = -EINVAL;
         }
-        /* read superblock from bitmap file (this sets bitmap->chunksize) */
-        err = bitmap_read_sb(bitmap);
         if (err)
                 goto error;
 
-        bitmap->chunkshift = ffz(~bitmap->chunksize);
+        bitmap->daemon_lastrun = jiffies;
+        bitmap->chunkshift = ffz(~mddev->bitmap_info.chunksize);
 
         /* now that chunksize and chunkshift are set, we can use these macros */
         chunks = (blocks + CHUNK_BLOCK_RATIO(bitmap) - 1) >>
@@ -1676,7 +1758,8 @@ int bitmap_create(mddev_t *mddev)
 
         mddev->bitmap = bitmap;
 
-        mddev->thread->timeout = bitmap->daemon_sleep * HZ;
+        mddev->thread->timeout = mddev->bitmap_info.daemon_sleep;
+        md_wakeup_thread(mddev->thread);
 
         bitmap_update_sb(bitmap);
 
@@ -1687,6 +1770,286 @@ int bitmap_create(mddev_t *mddev)
         return err;
 }
 
+static ssize_t
+location_show(mddev_t *mddev, char *page)
+{
+        ssize_t len;
+        if (mddev->bitmap_info.file) {
+                len = sprintf(page, "file");
+        } else if (mddev->bitmap_info.offset) {
+                len = sprintf(page, "%+lld", (long long)mddev->bitmap_info.offset);
+        } else
+                len = sprintf(page, "none");
+        len += sprintf(page+len, "\n");
+        return len;
+}
+
+static ssize_t
+location_store(mddev_t *mddev, const char *buf, size_t len)
+{
+
+        if (mddev->pers) {
+                if (!mddev->pers->quiesce)
+                        return -EBUSY;
+                if (mddev->recovery || mddev->sync_thread)
+                        return -EBUSY;
+        }
+
+        if (mddev->bitmap || mddev->bitmap_info.file ||
+            mddev->bitmap_info.offset) {
+                /* bitmap already configured.  Only option is to clear it */
+                if (strncmp(buf, "none", 4) != 0)
+                        return -EBUSY;
+                if (mddev->pers) {
+                        mddev->pers->quiesce(mddev, 1);
+                        bitmap_destroy(mddev);
+                        mddev->pers->quiesce(mddev, 0);
+                }
+                mddev->bitmap_info.offset = 0;
+                if (mddev->bitmap_info.file) {
+                        struct file *f = mddev->bitmap_info.file;
+                        mddev->bitmap_info.file = NULL;
+                        restore_bitmap_write_access(f);
+                        fput(f);
+                }
+        } else {
+                /* No bitmap, OK to set a location */
+                long long offset;
+                if (strncmp(buf, "none", 4) == 0)
+                        /* nothing to be done */;
+                else if (strncmp(buf, "file:", 5) == 0) {
+                        /* Not supported yet */
+                        return -EINVAL;
+                } else {
+                        int rv;
+                        if (buf[0] == '+')
+                                rv = strict_strtoll(buf+1, 10, &offset);
+                        else
+                                rv = strict_strtoll(buf, 10, &offset);
+                        if (rv)
+                                return rv;
+                        if (offset == 0)
+                                return -EINVAL;
+                        if (mddev->bitmap_info.external == 0 &&
+                            mddev->major_version == 0 &&
+                            offset != mddev->bitmap_info.default_offset)
+                                return -EINVAL;
+                        mddev->bitmap_info.offset = offset;
+                        if (mddev->pers) {
+                                mddev->pers->quiesce(mddev, 1);
+                                rv = bitmap_create(mddev);
+                                if (rv) {
+                                        bitmap_destroy(mddev);
+                                        mddev->bitmap_info.offset = 0;
+                                }
+                                mddev->pers->quiesce(mddev, 0);
+                                if (rv)
+                                        return rv;
+                        }
+                }
+        }
+        if (!mddev->external) {
+                /* Ensure new bitmap info is stored in
+                 * metadata promptly.
+                 */
+                set_bit(MD_CHANGE_DEVS, &mddev->flags);
+                md_wakeup_thread(mddev->thread);
+        }
+        return len;
+}
+
+static struct md_sysfs_entry bitmap_location =
+__ATTR(location, S_IRUGO|S_IWUSR, location_show, location_store);
+
+static ssize_t
+timeout_show(mddev_t *mddev, char *page)
+{
+        ssize_t len;
+        unsigned long secs = mddev->bitmap_info.daemon_sleep / HZ;
+        unsigned long jifs = mddev->bitmap_info.daemon_sleep % HZ;
+        
+        len = sprintf(page, "%lu", secs);
+        if (jifs)
+                len += sprintf(page+len, ".%03u", jiffies_to_msecs(jifs));
+        len += sprintf(page+len, "\n");
+        return len;
+}
+
+static ssize_t
+timeout_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        /* timeout can be set at any time */
+        unsigned long timeout;
+        int rv = strict_strtoul_scaled(buf, &timeout, 4);
+        if (rv)
+                return rv;
+
+        /* just to make sure we don't overflow... */
+        if (timeout >= LONG_MAX / HZ)
+                return -EINVAL;
+
+        timeout = timeout * HZ / 10000;
+
+        if (timeout >= MAX_SCHEDULE_TIMEOUT)
+                timeout = MAX_SCHEDULE_TIMEOUT-1;
+        if (timeout < 1)
+                timeout = 1;
+        mddev->bitmap_info.daemon_sleep = timeout;
+        if (mddev->thread) {
+                /* if thread->timeout is MAX_SCHEDULE_TIMEOUT, then
+                 * the bitmap is all clean and we don't need to
+                 * adjust the timeout right now
+                 */
+                if (mddev->thread->timeout < MAX_SCHEDULE_TIMEOUT) {
+                        mddev->thread->timeout = timeout;
+                        md_wakeup_thread(mddev->thread);
+                }
+        }
+        return len;
+}
+
+static struct md_sysfs_entry bitmap_timeout =
+__ATTR(time_base, S_IRUGO|S_IWUSR, timeout_show, timeout_store);
+
+static ssize_t
+backlog_show(mddev_t *mddev, char *page)
+{
+        return sprintf(page, "%lu\n", mddev->bitmap_info.max_write_behind);
+}
+
+static ssize_t
+backlog_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        unsigned long backlog;
+        int rv = strict_strtoul(buf, 10, &backlog);
+        if (rv)
+                return rv;
+        if (backlog > COUNTER_MAX)
+                return -EINVAL;
+        mddev->bitmap_info.max_write_behind = backlog;
+        return len;
+}
+
+static struct md_sysfs_entry bitmap_backlog =
+__ATTR(backlog, S_IRUGO|S_IWUSR, backlog_show, backlog_store);
+
+static ssize_t
+chunksize_show(mddev_t *mddev, char *page)
+{
+        return sprintf(page, "%lu\n", mddev->bitmap_info.chunksize);
+}
+
+static ssize_t
+chunksize_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        /* Can only be changed when no bitmap is active */
+        int rv;
+        unsigned long csize;
+        if (mddev->bitmap)
+                return -EBUSY;
+        rv = strict_strtoul(buf, 10, &csize);
+        if (rv)
+                return rv;
+        if (csize < 512 ||
+            !is_power_of_2(csize))
+                return -EINVAL;
+        mddev->bitmap_info.chunksize = csize;
+        return len;
+}
+
+static struct md_sysfs_entry bitmap_chunksize =
+__ATTR(chunksize, S_IRUGO|S_IWUSR, chunksize_show, chunksize_store);
+
+static ssize_t metadata_show(mddev_t *mddev, char *page)
+{
+        return sprintf(page, "%s\n", (mddev->bitmap_info.external
+                                      ? "external" : "internal"));
+}
+
+static ssize_t metadata_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        if (mddev->bitmap ||
+            mddev->bitmap_info.file ||
+            mddev->bitmap_info.offset)
+                return -EBUSY;
+        if (strncmp(buf, "external", 8) == 0)
+                mddev->bitmap_info.external = 1;
+        else if (strncmp(buf, "internal", 8) == 0)
+                mddev->bitmap_info.external = 0;
+        else
+                return -EINVAL;
+        return len;
+}
+
+static struct md_sysfs_entry bitmap_metadata =
+__ATTR(metadata, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
+
+static ssize_t can_clear_show(mddev_t *mddev, char *page)
+{
+        int len;
+        if (mddev->bitmap)
+                len = sprintf(page, "%s\n", (mddev->bitmap->need_sync ?
+                                             "false" : "true"));
+        else
+                len = sprintf(page, "\n");
+        return len;
+}
+
+static ssize_t can_clear_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        if (mddev->bitmap == NULL)
+                return -ENOENT;
+        if (strncmp(buf, "false", 5) == 0)
+                mddev->bitmap->need_sync = 1;
+        else if (strncmp(buf, "true", 4) == 0) {
+                if (mddev->degraded)
+                        return -EBUSY;
+                mddev->bitmap->need_sync = 0;
+        } else
+                return -EINVAL;
+        return len;
+}
+
+static struct md_sysfs_entry bitmap_can_clear =
+__ATTR(can_clear, S_IRUGO|S_IWUSR, can_clear_show, can_clear_store);
+
+static ssize_t
+behind_writes_used_show(mddev_t *mddev, char *page)
+{
+        if (mddev->bitmap == NULL)
+                return sprintf(page, "0\n");
+        return sprintf(page, "%lu\n",
+                       mddev->bitmap->behind_writes_used);
+}
+
+static ssize_t
+behind_writes_used_reset(mddev_t *mddev, const char *buf, size_t len)
+{
+        if (mddev->bitmap)
+                mddev->bitmap->behind_writes_used = 0;
+        return len;
+}
+
+static struct md_sysfs_entry max_backlog_used =
+__ATTR(max_backlog_used, S_IRUGO | S_IWUSR,
+       behind_writes_used_show, behind_writes_used_reset);
+
+static struct attribute *md_bitmap_attrs[] = {
+        &bitmap_location.attr,
+        &bitmap_timeout.attr,
+        &bitmap_backlog.attr,
+        &bitmap_chunksize.attr,
+        &bitmap_metadata.attr,
+        &bitmap_can_clear.attr,
+        &max_backlog_used.attr,
+        NULL
+};
+struct attribute_group md_bitmap_group = {
+        .name = "bitmap",
+        .attrs = md_bitmap_attrs,
+};
+
+
 /* the bitmap API -- for raid personalities */
 EXPORT_SYMBOL(bitmap_startwrite);
 EXPORT_SYMBOL(bitmap_endwrite);
diff --git a/drivers/md/bitmap.h b/drivers/md/bitmap.h
index e98900671ca9..3797dea4723a 100644
--- a/drivers/md/bitmap.h
+++ b/drivers/md/bitmap.h
@@ -106,7 +106,7 @@ typedef __u16 bitmap_counter_t;
 #define BITMAP_BLOCK_SHIFT 9
 
 /* how many blocks per chunk? (this is variable) */
-#define CHUNK_BLOCK_RATIO(bitmap) ((bitmap)->chunksize >> BITMAP_BLOCK_SHIFT)
+#define CHUNK_BLOCK_RATIO(bitmap) ((bitmap)->mddev->bitmap_info.chunksize >> BITMAP_BLOCK_SHIFT)
 #define CHUNK_BLOCK_SHIFT(bitmap) ((bitmap)->chunkshift - BITMAP_BLOCK_SHIFT)
 #define CHUNK_BLOCK_MASK(bitmap) (CHUNK_BLOCK_RATIO(bitmap) - 1)
 
@@ -118,16 +118,6 @@ typedef __u16 bitmap_counter_t;
                         (CHUNK_BLOCK_SHIFT(bitmap) + PAGE_COUNTER_SHIFT - 1)
 #define PAGEPTR_BLOCK_MASK(bitmap) (PAGEPTR_BLOCK_RATIO(bitmap) - 1)
 
-/*
- * on-disk bitmap:
- *
- * Use one bit per "chunk" (block set). We do the disk I/O on the bitmap
- * file a page at a time. There's a superblock at the start of the file.
- */
-
-/* map chunks (bits) to file pages - offset by the size of the superblock */
-#define CHUNK_BIT_OFFSET(chunk) ((chunk) + (sizeof(bitmap_super_t) << 3))
-
 #endif
 
 /*
@@ -209,7 +199,6 @@ struct bitmap {
         int counter_bits; /* how many bits per block counter */
 
         /* bitmap chunksize -- how much data does each bit represent? */
-        unsigned long chunksize;
         unsigned long chunkshift; /* chunksize = 2^chunkshift (for bitops) */
         unsigned long chunks; /* total number of data chunks for the array */
 
@@ -226,7 +215,6 @@ struct bitmap {
         /* bitmap spinlock */
         spinlock_t lock;
 
-        long offset; /* offset from superblock if file is NULL */
         struct file *file; /* backing disk file */
         struct page *sb_page; /* cached copy of the bitmap file superblock */
         struct page **filemap; /* list of cache pages for the file */
@@ -238,22 +226,23 @@ struct bitmap {
 
         int allclean;
 
-        unsigned long max_write_behind; /* write-behind mode */
         atomic_t behind_writes;
+        unsigned long behind_writes_used; /* highest actual value at runtime */
 
         /*
          * the bitmap daemon - periodically wakes up and sweeps the bitmap
          * file, cleaning up bits and flushing out pages to disk as necessary
          */
         unsigned long daemon_lastrun; /* jiffies of last run */
-        unsigned long daemon_sleep; /* how many seconds between updates? */
         unsigned long last_end_sync; /* when we lasted called end_sync to
                                       * update bitmap with resync progress */
 
         atomic_t pending_writes; /* pending writes to the bitmap file */
         wait_queue_head_t write_wait;
         wait_queue_head_t overflow_wait;
+        wait_queue_head_t behind_wait;
 
+        struct sysfs_dirent *sysfs_can_clear;
 };
 
 /* the bitmap API */
@@ -282,7 +271,7 @@ void bitmap_close_sync(struct bitmap *bitmap);
 void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector);
 
 void bitmap_unplug(struct bitmap *bitmap);
-void bitmap_daemon_work(struct bitmap *bitmap);
+void bitmap_daemon_work(mddev_t *mddev);
 #endif
 
 #endif
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index ed1038164019..3bdbb6115702 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2003 Christophe Saout <christophe@saout.de>
  * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
- * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2006-2009 Red Hat, Inc. All rights reserved.
  *
  * This file is released under the GPL.
  */
@@ -71,10 +71,21 @@ struct crypt_iv_operations {
         int (*ctr)(struct crypt_config *cc, struct dm_target *ti,
                    const char *opts);
         void (*dtr)(struct crypt_config *cc);
-        const char *(*status)(struct crypt_config *cc);
+        int (*init)(struct crypt_config *cc);
+        int (*wipe)(struct crypt_config *cc);
         int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector);
 };
 
+struct iv_essiv_private {
+        struct crypto_cipher *tfm;
+        struct crypto_hash *hash_tfm;
+        u8 *salt;
+};
+
+struct iv_benbi_private {
+        int shift;
+};
+
 /*
  * Crypt: maps a linear range of a block device
  * and encrypts / decrypts at the same time.
@@ -102,8 +113,8 @@ struct crypt_config {
         struct crypt_iv_operations *iv_gen_ops;
         char *iv_mode;
         union {
-                struct crypto_cipher *essiv_tfm;
-                int benbi_shift;
+                struct iv_essiv_private essiv;
+                struct iv_benbi_private benbi;
         } iv_gen_private;
         sector_t iv_offset;
         unsigned int iv_size;
@@ -147,6 +158,9 @@ static void kcryptd_queue_crypt(struct dm_crypt_io *io);
  * plain: the initial vector is the 32-bit little-endian version of the sector
  *        number, padded with zeros if necessary.
  *
+ * plain64: the initial vector is the 64-bit little-endian version of the sector
+ *        number, padded with zeros if necessary.
+ *
  * essiv: "encrypted sector|salt initial vector", the sector number is
  *        encrypted with the bulk cipher using a salt as key. The salt
  *        should be derived from the bulk cipher's key via hashing.
@@ -169,88 +183,123 @@ static int crypt_iv_plain_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
         return 0;
 }
 
-static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
-                              const char *opts)
+static int crypt_iv_plain64_gen(struct crypt_config *cc, u8 *iv,
+                                sector_t sector)
 {
-        struct crypto_cipher *essiv_tfm;
-        struct crypto_hash *hash_tfm;
+        memset(iv, 0, cc->iv_size);
+        *(u64 *)iv = cpu_to_le64(sector);
+
+        return 0;
+}
+
+/* Initialise ESSIV - compute salt but no local memory allocations */
+static int crypt_iv_essiv_init(struct crypt_config *cc)
+{
+        struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
         struct hash_desc desc;
         struct scatterlist sg;
-        unsigned int saltsize;
-        u8 *salt;
         int err;
 
-        if (opts == NULL) {
+        sg_init_one(&sg, cc->key, cc->key_size);
+        desc.tfm = essiv->hash_tfm;
+        desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+
+        err = crypto_hash_digest(&desc, &sg, cc->key_size, essiv->salt);
+        if (err)
+                return err;
+
+        return crypto_cipher_setkey(essiv->tfm, essiv->salt,
+                                    crypto_hash_digestsize(essiv->hash_tfm));
+}
+
+/* Wipe salt and reset key derived from volume key */
+static int crypt_iv_essiv_wipe(struct crypt_config *cc)
+{
+        struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
+        unsigned salt_size = crypto_hash_digestsize(essiv->hash_tfm);
+
+        memset(essiv->salt, 0, salt_size);
+
+        return crypto_cipher_setkey(essiv->tfm, essiv->salt, salt_size);
+}
+
+static void crypt_iv_essiv_dtr(struct crypt_config *cc)
+{
+        struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
+
+        crypto_free_cipher(essiv->tfm);
+        essiv->tfm = NULL;
+
+        crypto_free_hash(essiv->hash_tfm);
+        essiv->hash_tfm = NULL;
+
+        kzfree(essiv->salt);
+        essiv->salt = NULL;
+}
+
+static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
+                              const char *opts)
+{
+        struct crypto_cipher *essiv_tfm = NULL;
+        struct crypto_hash *hash_tfm = NULL;
+        u8 *salt = NULL;
+        int err;
+
+        if (!opts) {
                 ti->error = "Digest algorithm missing for ESSIV mode";
                 return -EINVAL;
         }
 
-        /* Hash the cipher key with the given hash algorithm */
+        /* Allocate hash algorithm */
         hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(hash_tfm)) {
                 ti->error = "Error initializing ESSIV hash";
-                return PTR_ERR(hash_tfm);
+                err = PTR_ERR(hash_tfm);
+                goto bad;
         }
 
-        saltsize = crypto_hash_digestsize(hash_tfm);
-        salt = kmalloc(saltsize, GFP_KERNEL);
-        if (salt == NULL) {
+        salt = kzalloc(crypto_hash_digestsize(hash_tfm), GFP_KERNEL);
+        if (!salt) {
                 ti->error = "Error kmallocing salt storage in ESSIV";
-                crypto_free_hash(hash_tfm);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto bad;
         }
 
-        sg_init_one(&sg, cc->key, cc->key_size);
-        desc.tfm = hash_tfm;
-        desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
-        err = crypto_hash_digest(&desc, &sg, cc->key_size, salt);
-        crypto_free_hash(hash_tfm);
-
-        if (err) {
-                ti->error = "Error calculating hash in ESSIV";
-                kfree(salt);
-                return err;
-        }
-
-        /* Setup the essiv_tfm with the given salt */
+        /* Allocate essiv_tfm */
         essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(essiv_tfm)) {
                 ti->error = "Error allocating crypto tfm for ESSIV";
-                kfree(salt);
-                return PTR_ERR(essiv_tfm);
+                err = PTR_ERR(essiv_tfm);
+                goto bad;
         }
         if (crypto_cipher_blocksize(essiv_tfm) !=
             crypto_ablkcipher_ivsize(cc->tfm)) {
                 ti->error = "Block size of ESSIV cipher does "
                             "not match IV size of block cipher";
-                crypto_free_cipher(essiv_tfm);
-                kfree(salt);
-                return -EINVAL;
+                err = -EINVAL;
+                goto bad;
         }
-        err = crypto_cipher_setkey(essiv_tfm, salt, saltsize);
-        if (err) {
-                ti->error = "Failed to set key for ESSIV cipher";
-                crypto_free_cipher(essiv_tfm);
-                kfree(salt);
-                return err;
-        }
-        kfree(salt);
 
-        cc->iv_gen_private.essiv_tfm = essiv_tfm;
+        cc->iv_gen_private.essiv.salt = salt;
+        cc->iv_gen_private.essiv.tfm = essiv_tfm;
+        cc->iv_gen_private.essiv.hash_tfm = hash_tfm;
+
         return 0;
-}
 
-static void crypt_iv_essiv_dtr(struct crypt_config *cc)
-{
-        crypto_free_cipher(cc->iv_gen_private.essiv_tfm);
-        cc->iv_gen_private.essiv_tfm = NULL;
+bad:
+        if (essiv_tfm && !IS_ERR(essiv_tfm))
+                crypto_free_cipher(essiv_tfm);
+        if (hash_tfm && !IS_ERR(hash_tfm))
+                crypto_free_hash(hash_tfm);
+        kfree(salt);
+        return err;
 }
 
 static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
 {
         memset(iv, 0, cc->iv_size);
         *(u64 *)iv = cpu_to_le64(sector);
-        crypto_cipher_encrypt_one(cc->iv_gen_private.essiv_tfm, iv, iv);
+        crypto_cipher_encrypt_one(cc->iv_gen_private.essiv.tfm, iv, iv);
         return 0;
 }
 
@@ -273,7 +322,7 @@ static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti,
                 return -EINVAL;
         }
 
-        cc->iv_gen_private.benbi_shift = 9 - log;
+        cc->iv_gen_private.benbi.shift = 9 - log;
 
         return 0;
 }
@@ -288,7 +337,7 @@ static int crypt_iv_benbi_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
 
         memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */
 
-        val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi_shift) + 1);
+        val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi.shift) + 1);
         put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64)));
 
         return 0;
@@ -305,9 +354,15 @@ static struct crypt_iv_operations crypt_iv_plain_ops = {
         .generator = crypt_iv_plain_gen
 };
 
+static struct crypt_iv_operations crypt_iv_plain64_ops = {
+        .generator = crypt_iv_plain64_gen
+};
+
 static struct crypt_iv_operations crypt_iv_essiv_ops = {
         .ctr       = crypt_iv_essiv_ctr,
         .dtr       = crypt_iv_essiv_dtr,
+        .init      = crypt_iv_essiv_init,
+        .wipe      = crypt_iv_essiv_wipe,
         .generator = crypt_iv_essiv_gen
 };
 
@@ -934,14 +989,14 @@ static int crypt_set_key(struct crypt_config *cc, char *key)
 
         set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
 
-        return 0;
+        return crypto_ablkcipher_setkey(cc->tfm, cc->key, cc->key_size);
 }
 
 static int crypt_wipe_key(struct crypt_config *cc)
 {
         clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
         memset(&cc->key, 0, cc->key_size * sizeof(u8));
-        return 0;
+        return crypto_ablkcipher_setkey(cc->tfm, cc->key, cc->key_size);
 }
 
 /*
@@ -983,12 +1038,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 return -ENOMEM;
         }
 
-        if (crypt_set_key(cc, argv[1])) {
-                ti->error = "Error decoding key";
-                goto bad_cipher;
-        }
-
-        /* Compatiblity mode for old dm-crypt cipher strings */
+        /* Compatibility mode for old dm-crypt cipher strings */
         if (!chainmode || (strcmp(chainmode, "plain") == 0 && !ivmode)) {
                 chainmode = "cbc";
                 ivmode = "plain";
@@ -1015,6 +1065,11 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         strcpy(cc->chainmode, chainmode);
         cc->tfm = tfm;
 
+        if (crypt_set_key(cc, argv[1]) < 0) {
+                ti->error = "Error decoding and setting key";
+                goto bad_ivmode;
+        }
+
         /*
          * Choose ivmode. Valid modes: "plain", "essiv:<esshash>", "benbi".
          * See comments at iv code
@@ -1024,6 +1079,8 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 cc->iv_gen_ops = NULL;
         else if (strcmp(ivmode, "plain") == 0)
                 cc->iv_gen_ops = &crypt_iv_plain_ops;
+        else if (strcmp(ivmode, "plain64") == 0)
+                cc->iv_gen_ops = &crypt_iv_plain64_ops;
         else if (strcmp(ivmode, "essiv") == 0)
                 cc->iv_gen_ops = &crypt_iv_essiv_ops;
         else if (strcmp(ivmode, "benbi") == 0)
@@ -1039,6 +1096,12 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
             cc->iv_gen_ops->ctr(cc, ti, ivopts) < 0)
                 goto bad_ivmode;
 
+        if (cc->iv_gen_ops && cc->iv_gen_ops->init &&
+            cc->iv_gen_ops->init(cc) < 0) {
+                ti->error = "Error initialising IV";
+                goto bad_slab_pool;
+        }
+
         cc->iv_size = crypto_ablkcipher_ivsize(tfm);
         if (cc->iv_size)
                 /* at least a 64 bit sector number should fit in our buffer */
@@ -1085,11 +1148,6 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad_bs;
         }
 
-        if (crypto_ablkcipher_setkey(tfm, cc->key, key_size) < 0) {
-                ti->error = "Error setting key";
-                goto bad_device;
-        }
-
         if (sscanf(argv[2], "%llu", &tmpll) != 1) {
                 ti->error = "Invalid iv_offset sector";
                 goto bad_device;
@@ -1102,8 +1160,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
         cc->start = tmpll;
 
-        if (dm_get_device(ti, argv[3], cc->start, ti->len,
-                          dm_table_get_mode(ti->table), &cc->dev)) {
+        if (dm_get_device(ti, argv[3], dm_table_get_mode(ti->table), &cc->dev)) {
                 ti->error = "Device lookup failed";
                 goto bad_device;
         }
@@ -1278,6 +1335,7 @@ static void crypt_resume(struct dm_target *ti)
 static int crypt_message(struct dm_target *ti, unsigned argc, char **argv)
 {
         struct crypt_config *cc = ti->private;
+        int ret = -EINVAL;
 
         if (argc < 2)
                 goto error;
@@ -1287,10 +1345,22 @@ static int crypt_message(struct dm_target *ti, unsigned argc, char **argv)
                         DMWARN("not suspended during key manipulation.");
                         return -EINVAL;
                 }
-                if (argc == 3 && !strnicmp(argv[1], MESG_STR("set")))
-                        return crypt_set_key(cc, argv[2]);
-                if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe")))
+                if (argc == 3 && !strnicmp(argv[1], MESG_STR("set"))) {
+                        ret = crypt_set_key(cc, argv[2]);
+                        if (ret)
+                                return ret;
+                        if (cc->iv_gen_ops && cc->iv_gen_ops->init)
+                                ret = cc->iv_gen_ops->init(cc);
+                        return ret;
+                }
+                if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe"))) {
+                        if (cc->iv_gen_ops && cc->iv_gen_ops->wipe) {
+                                ret = cc->iv_gen_ops->wipe(cc);
+                                if (ret)
+                                        return ret;
+                        }
                         return crypt_wipe_key(cc);
+                }
         }
 
 error:
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index ebe7381f47c8..852052880d7a 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -156,8 +156,8 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad;
         }
 
-        if (dm_get_device(ti, argv[0], dc->start_read, ti->len,
-                          dm_table_get_mode(ti->table), &dc->dev_read)) {
+        if (dm_get_device(ti, argv[0], dm_table_get_mode(ti->table),
+                          &dc->dev_read)) {
                 ti->error = "Device lookup failed";
                 goto bad;
         }
@@ -177,8 +177,8 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad_dev_read;
         }
 
-        if (dm_get_device(ti, argv[3], dc->start_write, ti->len,
-                          dm_table_get_mode(ti->table), &dc->dev_write)) {
+        if (dm_get_device(ti, argv[3], dm_table_get_mode(ti->table),
+                          &dc->dev_write)) {
                 ti->error = "Write device lookup failed";
                 goto bad_dev_read;
         }
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 556acff3952f..2b7907b6dd09 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -138,16 +138,6 @@ int dm_exception_store_type_unregister(struct dm_exception_store_type *type)
 }
 EXPORT_SYMBOL(dm_exception_store_type_unregister);
 
-/*
- * Round a number up to the nearest 'size' boundary.  size must
- * be a power of 2.
- */
-static ulong round_up(ulong n, ulong size)
-{
-        size--;
-        return (n + size) & ~size;
-}
-
 static int set_chunk_size(struct dm_exception_store *store,
                           const char *chunk_size_arg, char **error)
 {
@@ -155,7 +145,8 @@ static int set_chunk_size(struct dm_exception_store *store,
         char *value;
 
         chunk_size_ulong = simple_strtoul(chunk_size_arg, &value, 10);
-        if (*chunk_size_arg == '\0' || *value != '\0') {
+        if (*chunk_size_arg == '\0' || *value != '\0' ||
+            chunk_size_ulong > UINT_MAX) {
                 *error = "Invalid chunk size";
                 return -EINVAL;
         }
@@ -165,45 +156,42 @@ static int set_chunk_size(struct dm_exception_store *store,
                 return 0;
         }
 
-        /*
-         * Chunk size must be multiple of page size.  Silently
-         * round up if it's not.
-         */
-        chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
-
-        return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
+        return dm_exception_store_set_chunk_size(store,
+                                                 (unsigned) chunk_size_ulong,
                                                  error);
 }
 
 int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
-                                      unsigned long chunk_size_ulong,
+                                      unsigned chunk_size,
                                       char **error)
 {
         /* Check chunk_size is a power of 2 */
-        if (!is_power_of_2(chunk_size_ulong)) {
+        if (!is_power_of_2(chunk_size)) {
                 *error = "Chunk size is not a power of 2";
                 return -EINVAL;
         }
 
         /* Validate the chunk size against the device block size */
-        if (chunk_size_ulong % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
+        if (chunk_size %
+            (bdev_logical_block_size(dm_snap_cow(store->snap)->bdev) >> 9)) {
                 *error = "Chunk size is not a multiple of device blocksize";
                 return -EINVAL;
         }
 
-        if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
+        if (chunk_size > INT_MAX >> SECTOR_SHIFT) {
                 *error = "Chunk size is too high";
                 return -EINVAL;
         }
 
-        store->chunk_size = chunk_size_ulong;
-        store->chunk_mask = chunk_size_ulong - 1;
-        store->chunk_shift = ffs(chunk_size_ulong) - 1;
+        store->chunk_size = chunk_size;
+        store->chunk_mask = chunk_size - 1;
+        store->chunk_shift = ffs(chunk_size) - 1;
 
         return 0;
 }
 
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
+                              struct dm_snapshot *snap,
                               unsigned *args_used,
                               struct dm_exception_store **store)
 {
@@ -212,7 +200,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
         struct dm_exception_store *tmp_store;
         char persistent;
 
-        if (argc < 3) {
+        if (argc < 2) {
                 ti->error = "Insufficient exception store arguments";
                 return -EINVAL;
         }
@@ -223,14 +211,15 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                 return -ENOMEM;
         }
 
-        persistent = toupper(*argv[1]);
+        persistent = toupper(*argv[0]);
         if (persistent == 'P')
                 type = get_type("P");
         else if (persistent == 'N')
                 type = get_type("N");
         else {
                 ti->error = "Persistent flag is not P or N";
-                return -EINVAL;
+                r = -EINVAL;
+                goto bad_type;
         }
 
         if (!type) {
@@ -240,32 +229,23 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
         }
 
         tmp_store->type = type;
-        tmp_store->ti = ti;
-
-        r = dm_get_device(ti, argv[0], 0, 0,
-                          FMODE_READ | FMODE_WRITE, &tmp_store->cow);
-        if (r) {
-                ti->error = "Cannot get COW device";
-                goto bad_cow;
-        }
+        tmp_store->snap = snap;
 
-        r = set_chunk_size(tmp_store, argv[2], &ti->error);
+        r = set_chunk_size(tmp_store, argv[1], &ti->error);
         if (r)
-                goto bad_cow;
+                goto bad;
 
         r = type->ctr(tmp_store, 0, NULL);
         if (r) {
                 ti->error = "Exception store type constructor failed";
-                goto bad_ctr;
+                goto bad;
         }
 
-        *args_used = 3;
+        *args_used = 2;
         *store = tmp_store;
         return 0;
 
-bad_ctr:
-        dm_put_device(ti, tmp_store->cow);
-bad_cow:
+bad:
         put_type(type);
 bad_type:
         kfree(tmp_store);
@@ -276,7 +256,6 @@ EXPORT_SYMBOL(dm_exception_store_create);
 void dm_exception_store_destroy(struct dm_exception_store *store)
 {
         store->type->dtr(store);
-        dm_put_device(store->ti, store->cow);
         put_type(store->type);
         kfree(store);
 }
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index 812c71872ba0..e8dfa06af3ba 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -26,7 +26,7 @@ typedef sector_t chunk_t;
  * of chunks that follow contiguously.  Remaining bits hold the number of the
  * chunk within the device.
  */
-struct dm_snap_exception {
+struct dm_exception {
         struct list_head hash_list;
 
         chunk_t old_chunk;
@@ -64,17 +64,34 @@ struct dm_exception_store_type {
          * Find somewhere to store the next exception.
          */
         int (*prepare_exception) (struct dm_exception_store *store,
-                                  struct dm_snap_exception *e);
+                                  struct dm_exception *e);
 
         /*
          * Update the metadata with this exception.
          */
         void (*commit_exception) (struct dm_exception_store *store,
-                                  struct dm_snap_exception *e,
+                                  struct dm_exception *e,
                                   void (*callback) (void *, int success),
                                   void *callback_context);
 
         /*
+         * Returns 0 if the exception store is empty.
+         *
+         * If there are exceptions still to be merged, sets
+         * *last_old_chunk and *last_new_chunk to the most recent
+         * still-to-be-merged chunk and returns the number of
+         * consecutive previous ones.
+         */
+        int (*prepare_merge) (struct dm_exception_store *store,
+                              chunk_t *last_old_chunk, chunk_t *last_new_chunk);
+
+        /*
+         * Clear the last n exceptions.
+         * nr_merged must be <= the value returned by prepare_merge.
+         */
+        int (*commit_merge) (struct dm_exception_store *store, int nr_merged);
+
+        /*
          * The snapshot is invalid, note this in the metadata.
          */
         void (*drop_snapshot) (struct dm_exception_store *store);
@@ -86,29 +103,34 @@ struct dm_exception_store_type {
         /*
          * Return how full the snapshot is.
          */
-        void (*fraction_full) (struct dm_exception_store *store,
-                               sector_t *numerator,
-                               sector_t *denominator);
+        void (*usage) (struct dm_exception_store *store,
+                       sector_t *total_sectors, sector_t *sectors_allocated,
+                       sector_t *metadata_sectors);
 
         /* For internal device-mapper use only. */
         struct list_head list;
 };
 
+struct dm_snapshot;
+
 struct dm_exception_store {
         struct dm_exception_store_type *type;
-        struct dm_target *ti;
-
-        struct dm_dev *cow;
+        struct dm_snapshot *snap;
 
         /* Size of data blocks saved - must be a power of 2 */
-        chunk_t chunk_size;
-        chunk_t chunk_mask;
-        chunk_t chunk_shift;
+        unsigned chunk_size;
+        unsigned chunk_mask;
+        unsigned chunk_shift;
 
         void *context;
 };
 
 /*
+ * Obtain the cow device used by a given snapshot.
+ */
+struct dm_dev *dm_snap_cow(struct dm_snapshot *snap);
+
+/*
  * Funtions to manipulate consecutive chunks
  */
 #  if defined(CONFIG_LBDAF) || (BITS_PER_LONG == 64)
@@ -120,18 +142,25 @@ static inline chunk_t dm_chunk_number(chunk_t chunk)
         return chunk & (chunk_t)((1ULL << DM_CHUNK_NUMBER_BITS) - 1ULL);
 }
 
-static inline unsigned dm_consecutive_chunk_count(struct dm_snap_exception *e)
+static inline unsigned dm_consecutive_chunk_count(struct dm_exception *e)
 {
         return e->new_chunk >> DM_CHUNK_NUMBER_BITS;
 }
 
-static inline void dm_consecutive_chunk_count_inc(struct dm_snap_exception *e)
+static inline void dm_consecutive_chunk_count_inc(struct dm_exception *e)
 {
         e->new_chunk += (1ULL << DM_CHUNK_NUMBER_BITS);
 
         BUG_ON(!dm_consecutive_chunk_count(e));
 }
 
+static inline void dm_consecutive_chunk_count_dec(struct dm_exception *e)
+{
+        BUG_ON(!dm_consecutive_chunk_count(e));
+
+        e->new_chunk -= (1ULL << DM_CHUNK_NUMBER_BITS);
+}
+
 #  else
 #    define DM_CHUNK_CONSECUTIVE_BITS 0
 
@@ -140,12 +169,16 @@ static inline chunk_t dm_chunk_number(chunk_t chunk)
         return chunk;
 }
 
-static inline unsigned dm_consecutive_chunk_count(struct dm_snap_exception *e)
+static inline unsigned dm_consecutive_chunk_count(struct dm_exception *e)
 {
         return 0;
 }
 
-static inline void dm_consecutive_chunk_count_inc(struct dm_snap_exception *e)
+static inline void dm_consecutive_chunk_count_inc(struct dm_exception *e)
+{
+}
+
+static inline void dm_consecutive_chunk_count_dec(struct dm_exception *e)
 {
 }
 
@@ -162,17 +195,18 @@ static inline sector_t get_dev_size(struct block_device *bdev)
 static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
                                       sector_t sector)
 {
-        return (sector & ~store->chunk_mask) >> store->chunk_shift;
+        return sector >> store->chunk_shift;
 }
 
 int dm_exception_store_type_register(struct dm_exception_store_type *type);
 int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
 
 int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
-                                      unsigned long chunk_size_ulong,
+                                      unsigned chunk_size,
                                       char **error);
 
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
+                              struct dm_snapshot *snap,
                               unsigned *args_used,
                               struct dm_exception_store **store);
 void dm_exception_store_destroy(struct dm_exception_store *store);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 3a2e6a2f8bdd..10f457ca6af2 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -5,6 +5,8 @@
  * This file is released under the GPL.
  */
 
+#include "dm.h"
+
 #include <linux/device-mapper.h>
 
 #include <linux/bio.h>
@@ -14,12 +16,19 @@
 #include <linux/slab.h>
 #include <linux/dm-io.h>
 
+#define DM_MSG_PREFIX "io"
+
+#define DM_IO_MAX_REGIONS       BITS_PER_LONG
+
 struct dm_io_client {
         mempool_t *pool;
         struct bio_set *bios;
 };
 
-/* FIXME: can we shrink this ? */
+/*
+ * Aligning 'struct io' reduces the number of bits required to store
+ * its address.  Refer to store_io_and_region_in_bio() below.
+ */
 struct io {
         unsigned long error_bits;
         unsigned long eopnotsupp_bits;
@@ -28,7 +37,9 @@ struct io {
         struct dm_io_client *client;
         io_notify_fn callback;
         void *context;
-};
+} __attribute__((aligned(DM_IO_MAX_REGIONS)));
+
+static struct kmem_cache *_dm_io_cache;
 
 /*
  * io contexts are only dynamically allocated for asynchronous
@@ -53,7 +64,7 @@ struct dm_io_client *dm_io_client_create(unsigned num_pages)
         if (!client)
                 return ERR_PTR(-ENOMEM);
 
-        client->pool = mempool_create_kmalloc_pool(ios, sizeof(struct io));
+        client->pool = mempool_create_slab_pool(ios, _dm_io_cache);
         if (!client->pool)
                 goto bad;
 
@@ -88,18 +99,29 @@ EXPORT_SYMBOL(dm_io_client_destroy);
 
 /*-----------------------------------------------------------------
  * We need to keep track of which region a bio is doing io for.
- * In order to save a memory allocation we store this the last
- * bvec which we know is unused (blech).
- * XXX This is ugly and can OOPS with some configs... find another way.
+ * To avoid a memory allocation to store just 5 or 6 bits, we
+ * ensure the 'struct io' pointer is aligned so enough low bits are
+ * always zero and then combine it with the region number directly in
+ * bi_private.
  *---------------------------------------------------------------*/
-static inline void bio_set_region(struct bio *bio, unsigned region)
+static void store_io_and_region_in_bio(struct bio *bio, struct io *io,
+                                       unsigned region)
 {
-        bio->bi_io_vec[bio->bi_max_vecs].bv_len = region;
+        if (unlikely(!IS_ALIGNED((unsigned long)io, DM_IO_MAX_REGIONS))) {
+                DMCRIT("Unaligned struct io pointer %p", io);
+                BUG();
+        }
+
+        bio->bi_private = (void *)((unsigned long)io | region);
 }
 
-static inline unsigned bio_get_region(struct bio *bio)
+static void retrieve_io_and_region_from_bio(struct bio *bio, struct io **io,
+                                       unsigned *region)
 {
-        return bio->bi_io_vec[bio->bi_max_vecs].bv_len;
+        unsigned long val = (unsigned long)bio->bi_private;
+
+        *io = (void *)(val & -(unsigned long)DM_IO_MAX_REGIONS);
+        *region = val & (DM_IO_MAX_REGIONS - 1);
 }
 
 /*-----------------------------------------------------------------
@@ -140,10 +162,8 @@ static void endio(struct bio *bio, int error)
         /*
          * The bio destructor in bio_put() may use the io object.
          */
-        io = bio->bi_private;
-        region = bio_get_region(bio);
+        retrieve_io_and_region_from_bio(bio, &io, &region);
 
-        bio->bi_max_vecs++;
         bio_put(bio);
 
         dec_count(io, region, error);
@@ -243,7 +263,10 @@ static void vm_dp_init(struct dpages *dp, void *data)
 
 static void dm_bio_destructor(struct bio *bio)
 {
-        struct io *io = bio->bi_private;
+        unsigned region;
+        struct io *io;
+
+        retrieve_io_and_region_from_bio(bio, &io, &region);
 
         bio_free(bio, io->client->bios);
 }
@@ -286,26 +309,23 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
         unsigned num_bvecs;
         sector_t remaining = where->count;
 
-        while (remaining) {
+        /*
+         * where->count may be zero if rw holds a write barrier and we
+         * need to send a zero-sized barrier.
+         */
+        do {
                 /*
-                 * Allocate a suitably sized-bio: we add an extra
-                 * bvec for bio_get/set_region() and decrement bi_max_vecs
-                 * to hide it from bio_add_page().
+                 * Allocate a suitably sized-bio.
                  */
                 num_bvecs = dm_sector_div_up(remaining,
                                              (PAGE_SIZE >> SECTOR_SHIFT));
-                num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
-                                      num_bvecs);
-                if (unlikely(num_bvecs > BIO_MAX_PAGES))
-                        num_bvecs = BIO_MAX_PAGES;
+                num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
                 bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                 bio->bi_sector = where->sector + (where->count - remaining);
                 bio->bi_bdev = where->bdev;
                 bio->bi_end_io = endio;
-                bio->bi_private = io;
                 bio->bi_destructor = dm_bio_destructor;
-                bio->bi_max_vecs--;
-                bio_set_region(bio, region);
+                store_io_and_region_in_bio(bio, io, region);
 
                 /*
                  * Try and add as many pages as possible.
@@ -323,7 +343,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
 
                 atomic_inc(&io->count);
                 submit_bio(rw, bio);
-        }
+        } while (remaining);
 }
 
 static void dispatch_io(int rw, unsigned int num_regions,
@@ -333,6 +353,8 @@ static void dispatch_io(int rw, unsigned int num_regions,
         int i;
         struct dpages old_pages = *dp;
 
+        BUG_ON(num_regions > DM_IO_MAX_REGIONS);
+
         if (sync)
                 rw |= (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
 
@@ -342,7 +364,7 @@ static void dispatch_io(int rw, unsigned int num_regions,
          */
         for (i = 0; i < num_regions; i++) {
                 *dp = old_pages;
-                if (where[i].count)
+                if (where[i].count || (rw & (1 << BIO_RW_BARRIER)))
                         do_region(rw, i, where + i, dp, io);
         }
 
@@ -357,7 +379,14 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
                    struct dm_io_region *where, int rw, struct dpages *dp,
                    unsigned long *error_bits)
 {
-        struct io io;
+        /*
+         * gcc <= 4.3 can't do the alignment for stack variables, so we must
+         * align it on our own.
+         * volatile prevents the optimizer from removing or reusing
+         * "io_" field from the stack frame (allowed in ANSI C).
+         */
+        volatile char io_[sizeof(struct io) + __alignof__(struct io) - 1];
+        struct io *io = (struct io *)PTR_ALIGN(&io_, __alignof__(struct io));
 
         if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
                 WARN_ON(1);
@@ -365,33 +394,33 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
         }
 
 retry:
-        io.error_bits = 0;
-        io.eopnotsupp_bits = 0;
-        atomic_set(&io.count, 1); /* see dispatch_io() */
-        io.sleeper = current;
-        io.client = client;
+        io->error_bits = 0;
+        io->eopnotsupp_bits = 0;
+        atomic_set(&io->count, 1); /* see dispatch_io() */
+        io->sleeper = current;
+        io->client = client;
 
-        dispatch_io(rw, num_regions, where, dp, &io, 1);
+        dispatch_io(rw, num_regions, where, dp, io, 1);
 
         while (1) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
 
-                if (!atomic_read(&io.count))
+                if (!atomic_read(&io->count))
                         break;
 
                 io_schedule();
         }
         set_current_state(TASK_RUNNING);
 
-        if (io.eopnotsupp_bits && (rw & (1 << BIO_RW_BARRIER))) {
+        if (io->eopnotsupp_bits && (rw & (1 << BIO_RW_BARRIER))) {
                 rw &= ~(1 << BIO_RW_BARRIER);
                 goto retry;
         }
 
         if (error_bits)
-                *error_bits = io.error_bits;
+                *error_bits = io->error_bits;
 
-        return io.error_bits ? -EIO : 0;
+        return io->error_bits ? -EIO : 0;
 }
 
 static int async_io(struct dm_io_client *client, unsigned int num_regions,
@@ -472,3 +501,18 @@ int dm_io(struct dm_io_request *io_req, unsigned num_regions,
                         &dp, io_req->notify.fn, io_req->notify.context);
 }
 EXPORT_SYMBOL(dm_io);
+
+int __init dm_io_init(void)
+{
+        _dm_io_cache = KMEM_CACHE(io, 0);
+        if (!_dm_io_cache)
+                return -ENOMEM;
+
+        return 0;
+}
+
+void dm_io_exit(void)
+{
+        kmem_cache_destroy(_dm_io_cache);
+        _dm_io_cache = NULL;
+}
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index a67942931582..d7500e1c26f2 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -56,6 +56,11 @@ static void dm_hash_remove_all(int keep_open_devices);
  */
 static DECLARE_RWSEM(_hash_lock);
 
+/*
+ * Protects use of mdptr to obtain hash cell name and uuid from mapped device.
+ */
+static DEFINE_MUTEX(dm_hash_cells_mutex);
+
 static void init_buckets(struct list_head *buckets)
 {
         unsigned int i;
@@ -206,7 +211,9 @@ static int dm_hash_insert(const char *name, const char *uuid, struct mapped_devi
                 list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid));
         }
         dm_get(md);
+        mutex_lock(&dm_hash_cells_mutex);
         dm_set_mdptr(md, cell);
+        mutex_unlock(&dm_hash_cells_mutex);
         up_write(&_hash_lock);
 
         return 0;
@@ -224,9 +231,11 @@ static void __hash_remove(struct hash_cell *hc)
         /* remove from the dev hash */
         list_del(&hc->uuid_list);
         list_del(&hc->name_list);
+        mutex_lock(&dm_hash_cells_mutex);
         dm_set_mdptr(hc->md, NULL);
+        mutex_unlock(&dm_hash_cells_mutex);
 
-        table = dm_get_table(hc->md);
+        table = dm_get_live_table(hc->md);
         if (table) {
                 dm_table_event(table);
                 dm_table_put(table);
@@ -276,7 +285,8 @@ retry:
         up_write(&_hash_lock);
 }
 
-static int dm_hash_rename(uint32_t cookie, const char *old, const char *new)
+static int dm_hash_rename(uint32_t cookie, uint32_t *flags, const char *old,
+                          const char *new)
 {
         char *new_name, *old_name;
         struct hash_cell *hc;
@@ -321,19 +331,22 @@ static int dm_hash_rename(uint32_t cookie, const char *old, const char *new)
          */
         list_del(&hc->name_list);
         old_name = hc->name;
+        mutex_lock(&dm_hash_cells_mutex);
         hc->name = new_name;
+        mutex_unlock(&dm_hash_cells_mutex);
         list_add(&hc->name_list, _name_buckets + hash_str(new_name));
 
         /*
          * Wake up any dm event waiters.
          */
-        table = dm_get_table(hc->md);
+        table = dm_get_live_table(hc->md);
         if (table) {
                 dm_table_event(table);
                 dm_table_put(table);
         }
 
-        dm_kobject_uevent(hc->md, KOBJ_CHANGE, cookie);
+        if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, cookie))
+                *flags |= DM_UEVENT_GENERATED_FLAG;
 
         dm_put(hc->md);
         up_write(&_hash_lock);
@@ -512,8 +525,6 @@ static int list_versions(struct dm_ioctl *param, size_t param_size)
         return 0;
 }
 
-
-
 static int check_name(const char *name)
 {
         if (strchr(name, '/')) {
@@ -525,6 +536,40 @@ static int check_name(const char *name)
 }
 
 /*
+ * On successful return, the caller must not attempt to acquire
+ * _hash_lock without first calling dm_table_put, because dm_table_destroy
+ * waits for this dm_table_put and could be called under this lock.
+ */
+static struct dm_table *dm_get_inactive_table(struct mapped_device *md)
+{
+        struct hash_cell *hc;
+        struct dm_table *table = NULL;
+
+        down_read(&_hash_lock);
+        hc = dm_get_mdptr(md);
+        if (!hc || hc->md != md) {
+                DMWARN("device has been removed from the dev hash table.");
+                goto out;
+        }
+
+        table = hc->new_map;
+        if (table)
+                dm_table_get(table);
+
+out:
+        up_read(&_hash_lock);
+
+        return table;
+}
+
+static struct dm_table *dm_get_live_or_inactive_table(struct mapped_device *md,
+                                                      struct dm_ioctl *param)
+{
+        return (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) ?
+                dm_get_inactive_table(md) : dm_get_live_table(md);
+}
+
+/*
  * Fills in a dm_ioctl structure, ready for sending back to
  * userland.
  */
@@ -536,7 +581,7 @@ static int __dev_status(struct mapped_device *md, struct dm_ioctl *param)
         param->flags &= ~(DM_SUSPEND_FLAG | DM_READONLY_FLAG |
                           DM_ACTIVE_PRESENT_FLAG);
 
-        if (dm_suspended(md))
+        if (dm_suspended_md(md))
                 param->flags |= DM_SUSPEND_FLAG;
 
         param->dev = huge_encode_dev(disk_devt(disk));
@@ -548,18 +593,30 @@ static int __dev_status(struct mapped_device *md, struct dm_ioctl *param)
          */
         param->open_count = dm_open_count(md);
 
-        if (get_disk_ro(disk))
-                param->flags |= DM_READONLY_FLAG;
-
         param->event_nr = dm_get_event_nr(md);
+        param->target_count = 0;
 
-        table = dm_get_table(md);
+        table = dm_get_live_table(md);
         if (table) {
-                param->flags |= DM_ACTIVE_PRESENT_FLAG;
-                param->target_count = dm_table_get_num_targets(table);
+                if (!(param->flags & DM_QUERY_INACTIVE_TABLE_FLAG)) {
+                        if (get_disk_ro(disk))
+                                param->flags |= DM_READONLY_FLAG;
+                        param->target_count = dm_table_get_num_targets(table);
+                }
                 dm_table_put(table);
-        } else
-                param->target_count = 0;
+
+                param->flags |= DM_ACTIVE_PRESENT_FLAG;
+        }
+
+        if (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) {
+                table = dm_get_inactive_table(md);
+                if (table) {
+                        if (!(dm_table_get_mode(table) & FMODE_WRITE))
+                                param->flags |= DM_READONLY_FLAG;
+                        param->target_count = dm_table_get_num_targets(table);
+                        dm_table_put(table);
+                }
+        }
 
         return 0;
 }
@@ -634,9 +691,9 @@ static struct mapped_device *find_device(struct dm_ioctl *param)
                  * Sneakily write in both the name and the uuid
                  * while we have the cell.
                  */
-                strncpy(param->name, hc->name, sizeof(param->name));
+                strlcpy(param->name, hc->name, sizeof(param->name));
                 if (hc->uuid)
-                        strncpy(param->uuid, hc->uuid, sizeof(param->uuid)-1);
+                        strlcpy(param->uuid, hc->uuid, sizeof(param->uuid));
                 else
                         param->uuid[0] = '\0';
 
@@ -681,10 +738,10 @@ static int dev_remove(struct dm_ioctl *param, size_t param_size)
         __hash_remove(hc);
         up_write(&_hash_lock);
 
-        dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr);
+        if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr))
+                param->flags |= DM_UEVENT_GENERATED_FLAG;
 
         dm_put(md);
-        param->data_size = 0;
         return 0;
 }
 
@@ -718,7 +775,9 @@ static int dev_rename(struct dm_ioctl *param, size_t param_size)
                 return r;
 
         param->data_size = 0;
-        return dm_hash_rename(param->event_nr, param->name, new_name);
+
+        return dm_hash_rename(param->event_nr, &param->flags, param->name,
+                              new_name);
 }
 
 static int dev_set_geometry(struct dm_ioctl *param, size_t param_size)
@@ -784,7 +843,7 @@ static int do_suspend(struct dm_ioctl *param)
         if (param->flags & DM_NOFLUSH_FLAG)
                 suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
 
-        if (!dm_suspended(md))
+        if (!dm_suspended_md(md))
                 r = dm_suspend(md, suspend_flags);
 
         if (!r)
@@ -800,7 +859,7 @@ static int do_resume(struct dm_ioctl *param)
         unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
         struct hash_cell *hc;
         struct mapped_device *md;
-        struct dm_table *new_map;
+        struct dm_table *new_map, *old_map = NULL;
 
         down_write(&_hash_lock);
 
@@ -826,14 +885,14 @@ static int do_resume(struct dm_ioctl *param)
                         suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
                 if (param->flags & DM_NOFLUSH_FLAG)
                         suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
-                if (!dm_suspended(md))
+                if (!dm_suspended_md(md))
                         dm_suspend(md, suspend_flags);
 
-                r = dm_swap_table(md, new_map);
-                if (r) {
+                old_map = dm_swap_table(md, new_map);
+                if (IS_ERR(old_map)) {
                         dm_table_destroy(new_map);
                         dm_put(md);
-                        return r;
+                        return PTR_ERR(old_map);
                 }
 
                 if (dm_table_get_mode(new_map) & FMODE_WRITE)
@@ -842,14 +901,17 @@ static int do_resume(struct dm_ioctl *param)
                         set_disk_ro(dm_disk(md), 1);
         }
 
-        if (dm_suspended(md))
+        if (dm_suspended_md(md)) {
                 r = dm_resume(md);
+                if (!r && !dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr))
+                        param->flags |= DM_UEVENT_GENERATED_FLAG;
+        }
 
+        if (old_map)
+                dm_table_destroy(old_map);
 
-        if (!r) {
-                dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr);
+        if (!r)
                 r = __dev_status(md, param);
-        }
 
         dm_put(md);
         return r;
@@ -982,7 +1044,7 @@ static int dev_wait(struct dm_ioctl *param, size_t param_size)
         if (r)
                 goto out;
 
-        table = dm_get_table(md);
+        table = dm_get_live_or_inactive_table(md, param);
         if (table) {
                 retrieve_status(table, param, param_size);
                 dm_table_put(table);
@@ -1215,7 +1277,7 @@ static int table_deps(struct dm_ioctl *param, size_t param_size)
         if (r)
                 goto out;
 
-        table = dm_get_table(md);
+        table = dm_get_live_or_inactive_table(md, param);
         if (table) {
                 retrieve_deps(table, param, param_size);
                 dm_table_put(table);
@@ -1244,13 +1306,13 @@ static int table_status(struct dm_ioctl *param, size_t param_size)
         if (r)
                 goto out;
 
-        table = dm_get_table(md);
+        table = dm_get_live_or_inactive_table(md, param);
         if (table) {
                 retrieve_status(table, param, param_size);
                 dm_table_put(table);
         }
 
- out:
+out:
         dm_put(md);
         return r;
 }
@@ -1288,10 +1350,15 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
                 goto out;
         }
 
-        table = dm_get_table(md);
+        table = dm_get_live_table(md);
         if (!table)
                 goto out_argv;
 
+        if (dm_deleting_md(md)) {
+                r = -ENXIO;
+                goto out_table;
+        }
+
         ti = dm_table_find_target(table, tmsg->sector);
         if (!dm_target_is_valid(ti)) {
                 DMWARN("Target message sector outside device.");
@@ -1303,6 +1370,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
                 r = -EINVAL;
         }
 
+ out_table:
         dm_table_put(table);
  out_argv:
         kfree(argv);
@@ -1413,6 +1481,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
 {
         /* Always clear this flag */
         param->flags &= ~DM_BUFFER_FULL_FLAG;
+        param->flags &= ~DM_UEVENT_GENERATED_FLAG;
 
         /* Ignores parameters */
         if (cmd == DM_REMOVE_ALL_CMD ||
@@ -1582,8 +1651,7 @@ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
         if (!md)
                 return -ENXIO;
 
-        dm_get(md);
-        down_read(&_hash_lock);
+        mutex_lock(&dm_hash_cells_mutex);
         hc = dm_get_mdptr(md);
         if (!hc || hc->md != md) {
                 r = -ENXIO;
@@ -1596,8 +1664,7 @@ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
                 strcpy(uuid, hc->uuid ? : "");
 
 out:
-        up_read(&_hash_lock);
-        dm_put(md);
+        mutex_unlock(&dm_hash_cells_mutex);
 
         return r;
 }
diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
index 3e3fc06cb861..addf83475040 100644
--- a/drivers/md/dm-kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -450,7 +450,10 @@ static void dispatch_job(struct kcopyd_job *job)
 {
         struct dm_kcopyd_client *kc = job->kc;
         atomic_inc(&kc->nr_jobs);
-        push(&kc->pages_jobs, job);
+        if (unlikely(!job->source.count))
+                push(&kc->complete_jobs, job);
+        else
+                push(&kc->pages_jobs, job);
         wake(kc);
 }
 
diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
index 82f7d6e6b1ea..9200dbf2391a 100644
--- a/drivers/md/dm-linear.c
+++ b/drivers/md/dm-linear.c
@@ -47,8 +47,7 @@ static int linear_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
         lc->start = tmp;
 
-        if (dm_get_device(ti, argv[0], lc->start, ti->len,
-                          dm_table_get_mode(ti->table), &lc->dev)) {
+        if (dm_get_device(ti, argv[0], dm_table_get_mode(ti->table), &lc->dev)) {
                 ti->error = "dm-linear: Device lookup failed";
                 goto bad;
         }
diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
index 652bd33109e3..1ed0094f064b 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -5,6 +5,7 @@
  */
 
 #include <linux/bio.h>
+#include <linux/slab.h>
 #include <linux/dm-dirty-log.h>
 #include <linux/device-mapper.h>
 #include <linux/dm-log-userspace.h>
@@ -156,7 +157,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
         }
 
         /* The ptr value is sufficient for local unique id */
-        lc->luid = (uint64_t)lc;
+        lc->luid = (unsigned long)lc;
 
         lc->ti = ti;
 
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index ba0edad2d048..075cbcf8a9f5 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -6,6 +6,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/workqueue.h>
 #include <linux/connector.h>
@@ -129,11 +130,13 @@ static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
  * This is the connector callback that delivers data
  * that was sent from userspace.
  */
-static void cn_ulog_callback(void *data)
+static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
-        struct cn_msg *msg = (struct cn_msg *)data;
         struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
 
+        if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
+                return;
+
         spin_lock(&receiving_list_lock);
         if (msg->len == 0)
                 fill_pkg(msg, NULL);
@@ -170,11 +173,15 @@ int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
 {
         int r = 0;
         size_t dummy = 0;
-        int overhead_size =
-                sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
+        int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg);
         struct dm_ulog_request *tfr = prealloced_ulog_tfr;
         struct receiving_pkg pkg;
 
+        /*
+         * Given the space needed to hold the 'struct cn_msg' and
+         * 'struct dm_ulog_request' - do we have enough payload
+         * space remaining?
+         */
         if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
                 DMINFO("Size of tfr exceeds preallocated size");
                 return -EINVAL;
@@ -189,7 +196,7 @@ resend:
          */
         mutex_lock(&dm_ulog_lock);
 
-        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
+        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg));
         memcpy(tfr->uuid, uuid, DM_UUID_LEN);
         tfr->luid = luid;
         tfr->seq = dm_ulog_seq++;
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 9443896ede07..5a08be0222db 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -145,8 +145,9 @@ int dm_dirty_log_type_unregister(struct dm_dirty_log_type *type)
 EXPORT_SYMBOL(dm_dirty_log_type_unregister);
 
 struct dm_dirty_log *dm_dirty_log_create(const char *type_name,
-                                         struct dm_target *ti,
-                                         unsigned int argc, char **argv)
+                        struct dm_target *ti,
+                        int (*flush_callback_fn)(struct dm_target *ti),
+                        unsigned int argc, char **argv)
 {
         struct dm_dirty_log_type *type;
         struct dm_dirty_log *log;
@@ -161,6 +162,7 @@ struct dm_dirty_log *dm_dirty_log_create(const char *type_name,
                 return NULL;
         }
 
+        log->flush_callback_fn = flush_callback_fn;
         log->type = type;
         if (type->ctr(log, ti, argc, argv)) {
                 kfree(log);
@@ -208,7 +210,9 @@ struct log_header {
 
 struct log_c {
         struct dm_target *ti;
-        int touched;
+        int touched_dirtied;
+        int touched_cleaned;
+        int flush_failed;
         uint32_t region_size;
         unsigned int region_count;
         region_t sync_count;
@@ -233,6 +237,7 @@ struct log_c {
          * Disk log fields
          */
         int log_dev_failed;
+        int log_dev_flush_failed;
         struct dm_dev *log_dev;
         struct log_header header;
 
@@ -253,14 +258,14 @@ static inline void log_set_bit(struct log_c *l,
                                uint32_t *bs, unsigned bit)
 {
         ext2_set_bit(bit, (unsigned long *) bs);
-        l->touched = 1;
+        l->touched_cleaned = 1;
 }
 
 static inline void log_clear_bit(struct log_c *l,
                                  uint32_t *bs, unsigned bit)
 {
         ext2_clear_bit(bit, (unsigned long *) bs);
-        l->touched = 1;
+        l->touched_dirtied = 1;
 }
 
 /*----------------------------------------------------------------
@@ -287,6 +292,19 @@ static int rw_header(struct log_c *lc, int rw)
         return dm_io(&lc->io_req, 1, &lc->header_location, NULL);
 }
 
+static int flush_header(struct log_c *lc)
+{
+        struct dm_io_region null_location = {
+                .bdev = lc->header_location.bdev,
+                .sector = 0,
+                .count = 0,
+        };
+
+        lc->io_req.bi_rw = WRITE_BARRIER;
+
+        return dm_io(&lc->io_req, 1, &null_location, NULL);
+}
+
 static int read_header(struct log_c *log)
 {
         int r;
@@ -378,7 +396,9 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
         }
 
         lc->ti = ti;
-        lc->touched = 0;
+        lc->touched_dirtied = 0;
+        lc->touched_cleaned = 0;
+        lc->flush_failed = 0;
         lc->region_size = region_size;
         lc->region_count = region_count;
         lc->sync = sync;
@@ -406,6 +426,7 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
         } else {
                 lc->log_dev = dev;
                 lc->log_dev_failed = 0;
+                lc->log_dev_flush_failed = 0;
                 lc->header_location.bdev = lc->log_dev->bdev;
                 lc->header_location.sector = 0;
 
@@ -522,8 +543,7 @@ static int disk_ctr(struct dm_dirty_log *log, struct dm_target *ti,
                 return -EINVAL;
         }
 
-        r = dm_get_device(ti, argv[0], 0, 0 /* FIXME */,
-                          FMODE_READ | FMODE_WRITE, &dev);
+        r = dm_get_device(ti, argv[0], FMODE_READ | FMODE_WRITE, &dev);
         if (r)
                 return r;
 
@@ -614,6 +634,11 @@ static int disk_resume(struct dm_dirty_log *log)
 
         /* write the new header */
         r = rw_header(lc, WRITE);
+        if (!r) {
+                r = flush_header(lc);
+                if (r)
+                        lc->log_dev_flush_failed = 1;
+        }
         if (r) {
                 DMWARN("%s: Failed to write header on dirty region log device",
                        lc->log_dev->name);
@@ -656,18 +681,40 @@ static int core_flush(struct dm_dirty_log *log)
 
 static int disk_flush(struct dm_dirty_log *log)
 {
-        int r;
-        struct log_c *lc = (struct log_c *) log->context;
+        int r, i;
+        struct log_c *lc = log->context;
 
         /* only write if the log has changed */
-        if (!lc->touched)
+        if (!lc->touched_cleaned && !lc->touched_dirtied)
                 return 0;
 
+        if (lc->touched_cleaned && log->flush_callback_fn &&
+            log->flush_callback_fn(lc->ti)) {
+                /*
+                 * At this point it is impossible to determine which
+                 * regions are clean and which are dirty (without
+                 * re-reading the log off disk). So mark all of them
+                 * dirty.
+                 */
+                lc->flush_failed = 1;
+                for (i = 0; i < lc->region_count; i++)
+                        log_clear_bit(lc, lc->clean_bits, i);
+        }
+
         r = rw_header(lc, WRITE);
         if (r)
                 fail_log_device(lc);
-        else
-                lc->touched = 0;
+        else {
+                if (lc->touched_dirtied) {
+                        r = flush_header(lc);
+                        if (r) {
+                                lc->log_dev_flush_failed = 1;
+                                fail_log_device(lc);
+                        } else
+                                lc->touched_dirtied = 0;
+                }
+                lc->touched_cleaned = 0;
+        }
 
         return r;
 }
@@ -681,7 +728,8 @@ static void core_mark_region(struct dm_dirty_log *log, region_t region)
 static void core_clear_region(struct dm_dirty_log *log, region_t region)
 {
         struct log_c *lc = (struct log_c *) log->context;
-        log_set_bit(lc, lc->clean_bits, region);
+        if (likely(!lc->flush_failed))
+                log_set_bit(lc, lc->clean_bits, region);
 }
 
 static int core_get_resync_work(struct dm_dirty_log *log, region_t *region)
@@ -762,7 +810,9 @@ static int disk_status(struct dm_dirty_log *log, status_type_t status,
         switch(status) {
         case STATUSTYPE_INFO:
                 DMEMIT("3 %s %s %c", log->type->name, lc->log_dev->name,
-                       lc->log_dev_failed ? 'D' : 'A');
+                       lc->log_dev_flush_failed ? 'F' :
+                       lc->log_dev_failed ? 'D' :
+                       'A');
                 break;
 
         case STATUSTYPE_TABLE:
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 32d0b878eccc..826bce7343b3 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -69,6 +69,7 @@ struct multipath {
         struct list_head priority_groups;
         unsigned pg_init_required;      /* pg_init needs calling? */
         unsigned pg_init_in_progress;   /* Only one pg_init allowed at once */
+        wait_queue_head_t pg_init_wait; /* Wait for pg_init completion */
 
         unsigned nr_valid_paths;        /* Total number of usable paths */
         struct pgpath *current_pgpath;
@@ -93,6 +94,8 @@ struct multipath {
          * can resubmit bios on error.
          */
         mempool_t *mpio_pool;
+
+        struct mutex work_mutex;
 };
 
 /*
@@ -198,6 +201,8 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
                 m->queue_io = 1;
                 INIT_WORK(&m->process_queued_ios, process_queued_ios);
                 INIT_WORK(&m->trigger_event, trigger_event);
+                init_waitqueue_head(&m->pg_init_wait);
+                mutex_init(&m->work_mutex);
                 m->mpio_pool = mempool_create_slab_pool(MIN_IOS, _mpio_cache);
                 if (!m->mpio_pool) {
                         kfree(m);
@@ -230,6 +235,21 @@ static void free_multipath(struct multipath *m)
  * Path selection
  *-----------------------------------------------*/
 
+static void __pg_init_all_paths(struct multipath *m)
+{
+        struct pgpath *pgpath;
+
+        m->pg_init_count++;
+        m->pg_init_required = 0;
+        list_for_each_entry(pgpath, &m->current_pg->pgpaths, list) {
+                /* Skip failed paths */
+                if (!pgpath->is_active)
+                        continue;
+                if (queue_work(kmpath_handlerd, &pgpath->activate_path))
+                        m->pg_init_in_progress++;
+        }
+}
+
 static void __switch_pg(struct multipath *m, struct pgpath *pgpath)
 {
         m->current_pg = pgpath->pg;
@@ -434,7 +454,7 @@ static void process_queued_ios(struct work_struct *work)
 {
         struct multipath *m =
                 container_of(work, struct multipath, process_queued_ios);
-        struct pgpath *pgpath = NULL, *tmp;
+        struct pgpath *pgpath = NULL;
         unsigned must_queue = 1;
         unsigned long flags;
 
@@ -452,14 +472,9 @@ static void process_queued_ios(struct work_struct *work)
             (!pgpath && !m->queue_if_no_path))
                 must_queue = 0;
 
-        if (m->pg_init_required && !m->pg_init_in_progress && pgpath) {
-                m->pg_init_count++;
-                m->pg_init_required = 0;
-                list_for_each_entry(tmp, &pgpath->pg->pgpaths, list) {
-                        if (queue_work(kmpath_handlerd, &tmp->activate_path))
-                                m->pg_init_in_progress++;
-                }
-        }
+        if (m->pg_init_required && !m->pg_init_in_progress && pgpath)
+                __pg_init_all_paths(m);
+
 out:
         spin_unlock_irqrestore(&m->lock, flags);
         if (!must_queue)
@@ -592,8 +607,8 @@ static struct pgpath *parse_path(struct arg_set *as, struct path_selector *ps,
         if (!p)
                 return ERR_PTR(-ENOMEM);
 
-        r = dm_get_device(ti, shift(as), ti->begin, ti->len,
-                          dm_table_get_mode(ti->table), &p->path.dev);
+        r = dm_get_device(ti, shift(as), dm_table_get_mode(ti->table),
+                          &p->path.dev);
         if (r) {
                 ti->error = "error getting device";
                 goto bad;
@@ -885,13 +900,43 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
         return r;
 }
 
-static void multipath_dtr(struct dm_target *ti)
+static void multipath_wait_for_pg_init_completion(struct multipath *m)
 {
-        struct multipath *m = (struct multipath *) ti->private;
+        DECLARE_WAITQUEUE(wait, current);
+        unsigned long flags;
+
+        add_wait_queue(&m->pg_init_wait, &wait);
 
+        while (1) {
+                set_current_state(TASK_UNINTERRUPTIBLE);
+
+                spin_lock_irqsave(&m->lock, flags);
+                if (!m->pg_init_in_progress) {
+                        spin_unlock_irqrestore(&m->lock, flags);
+                        break;
+                }
+                spin_unlock_irqrestore(&m->lock, flags);
+
+                io_schedule();
+        }
+        set_current_state(TASK_RUNNING);
+
+        remove_wait_queue(&m->pg_init_wait, &wait);
+}
+
+static void flush_multipath_work(struct multipath *m)
+{
         flush_workqueue(kmpath_handlerd);
+        multipath_wait_for_pg_init_completion(m);
         flush_workqueue(kmultipathd);
         flush_scheduled_work();
+}
+
+static void multipath_dtr(struct dm_target *ti)
+{
+        struct multipath *m = ti->private;
+
+        flush_multipath_work(m);
         free_multipath(m);
 }
 
@@ -1116,9 +1161,9 @@ static int pg_init_limit_reached(struct multipath *m, struct pgpath *pgpath)
         return limit_reached;
 }
 
-static void pg_init_done(struct dm_path *path, int errors)
+static void pg_init_done(void *data, int errors)
 {
-        struct pgpath *pgpath = path_to_pgpath(path);
+        struct pgpath *pgpath = data;
         struct priority_group *pg = pgpath->pg;
         struct multipath *m = pg->m;
         unsigned long flags;
@@ -1132,8 +1177,8 @@ static void pg_init_done(struct dm_path *path, int errors)
                         errors = 0;
                         break;
                 }
-                DMERR("Cannot failover device because scsi_dh_%s was not "
-                      "loaded.", m->hw_handler_name);
+                DMERR("Could not failover the device: Handler scsi_dh_%s "
+                      "Error %d.", m->hw_handler_name, errors);
                 /*
                  * Fail path for now, so we do not ping pong
                  */
@@ -1170,25 +1215,34 @@ static void pg_init_done(struct dm_path *path, int errors)
                         m->current_pgpath = NULL;
                         m->current_pg = NULL;
                 }
-        } else if (!m->pg_init_required) {
-                m->queue_io = 0;
+        } else if (!m->pg_init_required)
                 pg->bypassed = 0;
-        }
 
-        m->pg_init_in_progress--;
-        if (!m->pg_init_in_progress)
-                queue_work(kmultipathd, &m->process_queued_ios);
+        if (--m->pg_init_in_progress)
+                /* Activations of other paths are still on going */
+                goto out;
+
+        if (!m->pg_init_required)
+                m->queue_io = 0;
+
+        queue_work(kmultipathd, &m->process_queued_ios);
+
+        /*
+         * Wake up any thread waiting to suspend.
+         */
+        wake_up(&m->pg_init_wait);
+
+out:
         spin_unlock_irqrestore(&m->lock, flags);
 }
 
 static void activate_path(struct work_struct *work)
 {
-        int ret;
         struct pgpath *pgpath =
                 container_of(work, struct pgpath, activate_path);
 
-        ret = scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev));
-        pg_init_done(&pgpath->path, ret);
+        scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev),
+                                pg_init_done, pgpath);
 }
 
 /*
@@ -1261,6 +1315,15 @@ static void multipath_presuspend(struct dm_target *ti)
         queue_if_no_path(m, 0, 1);
 }
 
+static void multipath_postsuspend(struct dm_target *ti)
+{
+        struct multipath *m = ti->private;
+
+        mutex_lock(&m->work_mutex);
+        flush_multipath_work(m);
+        mutex_unlock(&m->work_mutex);
+}
+
 /*
  * Restore the queue_if_no_path setting.
  */
@@ -1397,51 +1460,65 @@ static int multipath_status(struct dm_target *ti, status_type_t type,
 
 static int multipath_message(struct dm_target *ti, unsigned argc, char **argv)
 {
-        int r;
+        int r = -EINVAL;
         struct dm_dev *dev;
         struct multipath *m = (struct multipath *) ti->private;
         action_fn action;
 
+        mutex_lock(&m->work_mutex);
+
+        if (dm_suspended(ti)) {
+                r = -EBUSY;
+                goto out;
+        }
+
         if (argc == 1) {
-                if (!strnicmp(argv[0], MESG_STR("queue_if_no_path")))
-                        return queue_if_no_path(m, 1, 0);
-                else if (!strnicmp(argv[0], MESG_STR("fail_if_no_path")))
-                        return queue_if_no_path(m, 0, 0);
+                if (!strnicmp(argv[0], MESG_STR("queue_if_no_path"))) {
+                        r = queue_if_no_path(m, 1, 0);
+                        goto out;
+                } else if (!strnicmp(argv[0], MESG_STR("fail_if_no_path"))) {
+                        r = queue_if_no_path(m, 0, 0);
+                        goto out;
+                }
         }
 
-        if (argc != 2)
-                goto error;
+        if (argc != 2) {
+                DMWARN("Unrecognised multipath message received.");
+                goto out;
+        }
 
-        if (!strnicmp(argv[0], MESG_STR("disable_group")))
-                return bypass_pg_num(m, argv[1], 1);
-        else if (!strnicmp(argv[0], MESG_STR("enable_group")))
-                return bypass_pg_num(m, argv[1], 0);
-        else if (!strnicmp(argv[0], MESG_STR("switch_group")))
-                return switch_pg_num(m, argv[1]);
-        else if (!strnicmp(argv[0], MESG_STR("reinstate_path")))
+        if (!strnicmp(argv[0], MESG_STR("disable_group"))) {
+                r = bypass_pg_num(m, argv[1], 1);
+                goto out;
+        } else if (!strnicmp(argv[0], MESG_STR("enable_group"))) {
+                r = bypass_pg_num(m, argv[1], 0);
+                goto out;
+        } else if (!strnicmp(argv[0], MESG_STR("switch_group"))) {
+                r = switch_pg_num(m, argv[1]);
+                goto out;
+        } else if (!strnicmp(argv[0], MESG_STR("reinstate_path")))
                 action = reinstate_path;
         else if (!strnicmp(argv[0], MESG_STR("fail_path")))
                 action = fail_path;
-        else
-                goto error;
+        else {
+                DMWARN("Unrecognised multipath message received.");
+                goto out;
+        }
 
-        r = dm_get_device(ti, argv[1], ti->begin, ti->len,
-                          dm_table_get_mode(ti->table), &dev);
+        r = dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev);
         if (r) {
                 DMWARN("message: error getting device %s",
                        argv[1]);
-                return -EINVAL;
+                goto out;
         }
 
         r = action_dev(m, dev, action);
 
         dm_put_device(ti, dev);
 
+out:
+        mutex_unlock(&m->work_mutex);
         return r;
-
-error:
-        DMWARN("Unrecognised multipath message received.");
-        return -EINVAL;
 }
 
 static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
@@ -1567,13 +1644,14 @@ out:
  *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
         .name = "multipath",
-        .version = {1, 1, 0},
+        .version = {1, 1, 1},
         .module = THIS_MODULE,
         .ctr = multipath_ctr,
         .dtr = multipath_dtr,
         .map_rq = multipath_map,
         .rq_end_io = multipath_end_io,
         .presuspend = multipath_presuspend,
+        .postsuspend = multipath_postsuspend,
         .resume = multipath_resume,
         .status = multipath_status,
         .message = multipath_message,
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index cc9dc79b0784..ddda531723dc 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -35,6 +35,7 @@ static DECLARE_WAIT_QUEUE_HEAD(_kmirrord_recovery_stopped);
  *---------------------------------------------------------------*/
 enum dm_raid1_error {
         DM_RAID1_WRITE_ERROR,
+        DM_RAID1_FLUSH_ERROR,
         DM_RAID1_SYNC_ERROR,
         DM_RAID1_READ_ERROR
 };
@@ -57,6 +58,7 @@ struct mirror_set {
         struct bio_list reads;
         struct bio_list writes;
         struct bio_list failures;
+        struct bio_list holds;  /* bios are waiting until suspend */
 
         struct dm_region_hash *rh;
         struct dm_kcopyd_client *kcopyd_client;
@@ -67,6 +69,7 @@ struct mirror_set {
         region_t nr_regions;
         int in_sync;
         int log_failure;
+        int leg_failure;
         atomic_t suspend;
 
         atomic_t default_mirror;        /* Default mirror */
@@ -179,6 +182,17 @@ static void set_default_mirror(struct mirror *m)
         atomic_set(&ms->default_mirror, m - m0);
 }
 
+static struct mirror *get_valid_mirror(struct mirror_set *ms)
+{
+        struct mirror *m;
+
+        for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
+                if (!atomic_read(&m->error_count))
+                        return m;
+
+        return NULL;
+}
+
 /* fail_mirror
  * @m: mirror device to fail
  * @error_type: one of the enum's, DM_RAID1_*_ERROR
@@ -198,6 +212,8 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
         struct mirror_set *ms = m->ms;
         struct mirror *new;
 
+        ms->leg_failure = 1;
+
         /*
          * error_count is used for nothing more than a
          * simple way to tell if a device has encountered
@@ -224,19 +240,50 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
                 goto out;
         }
 
-        for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
-                if (!atomic_read(&new->error_count)) {
-                        set_default_mirror(new);
-                        break;
-                }
-
-        if (unlikely(new == ms->mirror + ms->nr_mirrors))
+        new = get_valid_mirror(ms);
+        if (new)
+                set_default_mirror(new);
+        else
                 DMWARN("All sides of mirror have failed.");
 
 out:
         schedule_work(&ms->trigger_event);
 }
 
+static int mirror_flush(struct dm_target *ti)
+{
+        struct mirror_set *ms = ti->private;
+        unsigned long error_bits;
+
+        unsigned int i;
+        struct dm_io_region io[ms->nr_mirrors];
+        struct mirror *m;
+        struct dm_io_request io_req = {
+                .bi_rw = WRITE_BARRIER,
+                .mem.type = DM_IO_KMEM,
+                .mem.ptr.bvec = NULL,
+                .client = ms->io_client,
+        };
+
+        for (i = 0, m = ms->mirror; i < ms->nr_mirrors; i++, m++) {
+                io[i].bdev = m->dev->bdev;
+                io[i].sector = 0;
+                io[i].count = 0;
+        }
+
+        error_bits = -1;
+        dm_io(&io_req, ms->nr_mirrors, io, &error_bits);
+        if (unlikely(error_bits != 0)) {
+                for (i = 0; i < ms->nr_mirrors; i++)
+                        if (test_bit(i, &error_bits))
+                                fail_mirror(ms->mirror + i,
+                                            DM_RAID1_FLUSH_ERROR);
+                return -EIO;
+        }
+
+        return 0;
+}
+
 /*-----------------------------------------------------------------
  * Recovery.
  *
@@ -396,6 +443,8 @@ static int mirror_available(struct mirror_set *ms, struct bio *bio)
  */
 static sector_t map_sector(struct mirror *m, struct bio *bio)
 {
+        if (unlikely(!bio->bi_size))
+                return 0;
         return m->offset + (bio->bi_sector - m->ms->ti->begin);
 }
 
@@ -413,6 +462,34 @@ static void map_region(struct dm_io_region *io, struct mirror *m,
         io->count = bio->bi_size >> 9;
 }
 
+static void hold_bio(struct mirror_set *ms, struct bio *bio)
+{
+        /*
+         * Lock is required to avoid race condition during suspend
+         * process.
+         */
+        spin_lock_irq(&ms->lock);
+
+        if (atomic_read(&ms->suspend)) {
+                spin_unlock_irq(&ms->lock);
+
+                /*
+                 * If device is suspended, complete the bio.
+                 */
+                if (dm_noflush_suspending(ms->ti))
+                        bio_endio(bio, DM_ENDIO_REQUEUE);
+                else
+                        bio_endio(bio, -EIO);
+                return;
+        }
+
+        /*
+         * Hold bio until the suspend is complete.
+         */
+        bio_list_add(&ms->holds, bio);
+        spin_unlock_irq(&ms->lock);
+}
+
 /*-----------------------------------------------------------------
  * Reads
  *---------------------------------------------------------------*/
@@ -511,7 +588,6 @@ static void write_callback(unsigned long error, void *context)
         unsigned i, ret = 0;
         struct bio *bio = (struct bio *) context;
         struct mirror_set *ms;
-        int uptodate = 0;
         int should_wake = 0;
         unsigned long flags;
 
@@ -524,36 +600,27 @@ static void write_callback(unsigned long error, void *context)
          * This way we handle both writes to SYNC and NOSYNC
          * regions with the same code.
          */
-        if (likely(!error))
-                goto out;
+        if (likely(!error)) {
+                bio_endio(bio, ret);
+                return;
+        }
 
         for (i = 0; i < ms->nr_mirrors; i++)
                 if (test_bit(i, &error))
                         fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
-                else
-                        uptodate = 1;
 
-        if (unlikely(!uptodate)) {
-                DMERR("All replicated volumes dead, failing I/O");
-                /* None of the writes succeeded, fail the I/O. */
-                ret = -EIO;
-        } else if (errors_handled(ms)) {
-                /*
-                 * Need to raise event.  Since raising
-                 * events can block, we need to do it in
-                 * the main thread.
-                 */
-                spin_lock_irqsave(&ms->lock, flags);
-                if (!ms->failures.head)
-                        should_wake = 1;
-                bio_list_add(&ms->failures, bio);
-                spin_unlock_irqrestore(&ms->lock, flags);
-                if (should_wake)
-                        wakeup_mirrord(ms);
-                return;
-        }
-out:
-        bio_endio(bio, ret);
+        /*
+         * Need to raise event.  Since raising
+         * events can block, we need to do it in
+         * the main thread.
+         */
+        spin_lock_irqsave(&ms->lock, flags);
+        if (!ms->failures.head)
+                should_wake = 1;
+        bio_list_add(&ms->failures, bio);
+        spin_unlock_irqrestore(&ms->lock, flags);
+        if (should_wake)
+                wakeup_mirrord(ms);
 }
 
 static void do_write(struct mirror_set *ms, struct bio *bio)
@@ -562,7 +629,7 @@ static void do_write(struct mirror_set *ms, struct bio *bio)
         struct dm_io_region io[ms->nr_mirrors], *dest = io;
         struct mirror *m;
         struct dm_io_request io_req = {
-                .bi_rw = WRITE,
+                .bi_rw = WRITE | (bio->bi_rw & WRITE_BARRIER),
                 .mem.type = DM_IO_BVEC,
                 .mem.ptr.bvec = bio->bi_io_vec + bio->bi_idx,
                 .notify.fn = write_callback,
@@ -603,6 +670,11 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
         bio_list_init(&requeue);
 
         while ((bio = bio_list_pop(writes))) {
+                if (unlikely(bio_empty_barrier(bio))) {
+                        bio_list_add(&sync, bio);
+                        continue;
+                }
+
                 region = dm_rh_bio_to_region(ms->rh, bio);
 
                 if (log->type->is_remote_recovering &&
@@ -659,7 +731,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
         /*
          * Dispatch io.
          */
-        if (unlikely(ms->log_failure)) {
+        if (unlikely(ms->log_failure) && errors_handled(ms)) {
                 spin_lock_irq(&ms->lock);
                 bio_list_merge(&ms->failures, &sync);
                 spin_unlock_irq(&ms->lock);
@@ -672,8 +744,15 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
                 dm_rh_delay(ms->rh, bio);
 
         while ((bio = bio_list_pop(&nosync))) {
-                map_bio(get_default_mirror(ms), bio);
-                generic_make_request(bio);
+                if (unlikely(ms->leg_failure) && errors_handled(ms)) {
+                        spin_lock_irq(&ms->lock);
+                        bio_list_add(&ms->failures, bio);
+                        spin_unlock_irq(&ms->lock);
+                        wakeup_mirrord(ms);
+                } else {
+                        map_bio(get_default_mirror(ms), bio);
+                        generic_make_request(bio);
+                }
         }
 }
 
@@ -681,20 +760,12 @@ static void do_failures(struct mirror_set *ms, struct bio_list *failures)
 {
         struct bio *bio;
 
-        if (!failures->head)
-                return;
-
-        if (!ms->log_failure) {
-                while ((bio = bio_list_pop(failures))) {
-                        ms->in_sync = 0;
-                        dm_rh_mark_nosync(ms->rh, bio, bio->bi_size, 0);
-                }
+        if (likely(!failures->head))
                 return;
-        }
 
         /*
          * If the log has failed, unattempted writes are being
-         * put on the failures list.  We can't issue those writes
+         * put on the holds list.  We can't issue those writes
          * until a log has been marked, so we must store them.
          *
          * If a 'noflush' suspend is in progress, we can requeue
@@ -709,23 +780,27 @@ static void do_failures(struct mirror_set *ms, struct bio_list *failures)
          * for us to treat them the same and requeue them
          * as well.
          */
-        if (dm_noflush_suspending(ms->ti)) {
-                while ((bio = bio_list_pop(failures)))
-                        bio_endio(bio, DM_ENDIO_REQUEUE);
-                return;
-        }
+        while ((bio = bio_list_pop(failures))) {
+                if (!ms->log_failure) {
+                        ms->in_sync = 0;
+                        dm_rh_mark_nosync(ms->rh, bio);
+                }
 
-        if (atomic_read(&ms->suspend)) {
-                while ((bio = bio_list_pop(failures)))
+                /*
+                 * If all the legs are dead, fail the I/O.
+                 * If we have been told to handle errors, hold the bio
+                 * and wait for userspace to deal with the problem.
+                 * Otherwise pretend that the I/O succeeded. (This would
+                 * be wrong if the failed leg returned after reboot and
+                 * got replicated back to the good legs.)
+                 */
+                if (!get_valid_mirror(ms))
                         bio_endio(bio, -EIO);
-                return;
+                else if (errors_handled(ms))
+                        hold_bio(ms, bio);
+                else
+                        bio_endio(bio, 0);
         }
-
-        spin_lock_irq(&ms->lock);
-        bio_list_merge(&ms->failures, failures);
-        spin_unlock_irq(&ms->lock);
-
-        delayed_wake(ms);
 }
 
 static void trigger_event(struct work_struct *work)
@@ -784,12 +859,17 @@ static struct mirror_set *alloc_context(unsigned int nr_mirrors,
         }
 
         spin_lock_init(&ms->lock);
+        bio_list_init(&ms->reads);
+        bio_list_init(&ms->writes);
+        bio_list_init(&ms->failures);
+        bio_list_init(&ms->holds);
 
         ms->ti = ti;
         ms->nr_mirrors = nr_mirrors;
         ms->nr_regions = dm_sector_div_up(ti->len, region_size);
         ms->in_sync = 0;
         ms->log_failure = 0;
+        ms->leg_failure = 0;
         atomic_set(&ms->suspend, 0);
         atomic_set(&ms->default_mirror, DEFAULT_MIRROR);
 
@@ -847,8 +927,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
                 return -EINVAL;
         }
 
-        if (dm_get_device(ti, argv[0], offset, ti->len,
-                          dm_table_get_mode(ti->table),
+        if (dm_get_device(ti, argv[0], dm_table_get_mode(ti->table),
                           &ms->mirror[mirror].dev)) {
                 ti->error = "Device lookup failure";
                 return -ENXIO;
@@ -889,7 +968,8 @@ static struct dm_dirty_log *create_dirty_log(struct dm_target *ti,
                 return NULL;
         }
 
-        dl = dm_dirty_log_create(argv[0], ti, param_count, argv + 2);
+        dl = dm_dirty_log_create(argv[0], ti, mirror_flush, param_count,
+                                 argv + 2);
         if (!dl) {
                 ti->error = "Error creating mirror dirty log";
                 return NULL;
@@ -995,6 +1075,7 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         ti->private = ms;
         ti->split_io = dm_rh_get_region_size(ms->rh);
+        ti->num_flush_requests = 1;
 
         ms->kmirrord_wq = create_singlethread_workqueue("kmirrord");
         if (!ms->kmirrord_wq) {
@@ -1122,7 +1203,8 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio,
          * We need to dec pending if this was a write.
          */
         if (rw == WRITE) {
-                dm_rh_dec(ms->rh, map_context->ll);
+                if (likely(!bio_empty_barrier(bio)))
+                        dm_rh_dec(ms->rh, map_context->ll);
                 return error;
         }
 
@@ -1180,9 +1262,26 @@ static void mirror_presuspend(struct dm_target *ti)
         struct mirror_set *ms = (struct mirror_set *) ti->private;
         struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
 
+        struct bio_list holds;
+        struct bio *bio;
+
         atomic_set(&ms->suspend, 1);
 
         /*
+         * Process bios in the hold list to start recovery waiting
+         * for bios in the hold list. After the process, no bio has
+         * a chance to be added in the hold list because ms->suspend
+         * is set.
+         */
+        spin_lock_irq(&ms->lock);
+        holds = ms->holds;
+        bio_list_init(&ms->holds);
+        spin_unlock_irq(&ms->lock);
+
+        while ((bio = bio_list_pop(&holds)))
+                hold_bio(ms, bio);
+
+        /*
          * We must finish up all the work that we've
          * generated (i.e. recovery work).
          */
@@ -1244,7 +1343,8 @@ static char device_status_char(struct mirror *m)
         if (!atomic_read(&(m->error_count)))
                 return 'A';
 
-        return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
+        return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
+                (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
                 (test_bit(DM_RAID1_SYNC_ERROR, &(m->error_type))) ? 'S' :
                 (test_bit(DM_RAID1_READ_ERROR, &(m->error_type))) ? 'R' : 'U';
 }
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 36dbe29f2fd6..bd5c58b28868 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -11,6 +11,7 @@
 #include <linux/ctype.h>
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 
 #include "dm.h"
@@ -79,6 +80,11 @@ struct dm_region_hash {
         struct list_head recovered_regions;
         struct list_head failed_recovered_regions;
 
+        /*
+         * If there was a barrier failure no regions can be marked clean.
+         */
+        int barrier_failure;
+
         void *context;
         sector_t target_begin;
 
@@ -211,6 +217,7 @@ struct dm_region_hash *dm_region_hash_create(
         INIT_LIST_HEAD(&rh->quiesced_regions);
         INIT_LIST_HEAD(&rh->recovered_regions);
         INIT_LIST_HEAD(&rh->failed_recovered_regions);
+        rh->barrier_failure = 0;
 
         rh->region_pool = mempool_create_kmalloc_pool(MIN_REGIONS,
                                                       sizeof(struct dm_region));
@@ -377,8 +384,6 @@ static void complete_resync_work(struct dm_region *reg, int success)
 /* dm_rh_mark_nosync
  * @ms
  * @bio
- * @done
- * @error
  *
  * The bio was written on some mirror(s) but failed on other mirror(s).
  * We can successfully endio the bio but should avoid the region being
@@ -386,8 +391,7 @@ static void complete_resync_work(struct dm_region *reg, int success)
  *
  * This function is _not_ safe in interrupt context!
  */
-void dm_rh_mark_nosync(struct dm_region_hash *rh,
-                       struct bio *bio, unsigned done, int error)
+void dm_rh_mark_nosync(struct dm_region_hash *rh, struct bio *bio)
 {
         unsigned long flags;
         struct dm_dirty_log *log = rh->log;
@@ -395,6 +399,11 @@ void dm_rh_mark_nosync(struct dm_region_hash *rh,
         region_t region = dm_rh_bio_to_region(rh, bio);
         int recovering = 0;
 
+        if (bio_empty_barrier(bio)) {
+                rh->barrier_failure = 1;
+                return;
+        }
+
         /* We must inform the log that the sync count has changed. */
         log->type->set_region_sync(log, region, 0);
 
@@ -419,7 +428,6 @@ void dm_rh_mark_nosync(struct dm_region_hash *rh,
         BUG_ON(!list_empty(&reg->list));
         spin_unlock_irqrestore(&rh->region_lock, flags);
 
-        bio_endio(bio, error);
         if (recovering)
                 complete_resync_work(reg, 0);
 }
@@ -515,8 +523,11 @@ void dm_rh_inc_pending(struct dm_region_hash *rh, struct bio_list *bios)
 {
         struct bio *bio;
 
-        for (bio = bios->head; bio; bio = bio->bi_next)
+        for (bio = bios->head; bio; bio = bio->bi_next) {
+                if (bio_empty_barrier(bio))
+                        continue;
                 rh_inc(rh, dm_rh_bio_to_region(rh, bio));
+        }
 }
 EXPORT_SYMBOL_GPL(dm_rh_inc_pending);
 
@@ -544,7 +555,14 @@ void dm_rh_dec(struct dm_region_hash *rh, region_t region)
                  */
 
                 /* do nothing for DM_RH_NOSYNC */
-                if (reg->state == DM_RH_RECOVERING) {
+                if (unlikely(rh->barrier_failure)) {
+                        /*
+                         * If a write barrier failed some time ago, we
+                         * don't know whether or not this write made it
+                         * to the disk, so we must resync the device.
+                         */
+                        reg->state = DM_RH_NOSYNC;
+                } else if (reg->state == DM_RH_RECOVERING) {
                         list_add_tail(&reg->list, &rh->quiesced_regions);
                 } else if (reg->state == DM_RH_DIRTY) {
                         reg->state = DM_RH_CLEAN;
@@ -643,10 +661,9 @@ void dm_rh_recovery_end(struct dm_region *reg, int success)
         spin_lock_irq(&rh->region_lock);
         if (success)
                 list_add(&reg->list, &reg->rh->recovered_regions);
-        else {
-                reg->state = DM_RH_NOSYNC;
+        else
                 list_add(&reg->list, &reg->rh->failed_recovered_regions);
-        }
+
         spin_unlock_irq(&rh->region_lock);
 
         rh->wakeup_workers(rh->context);
diff --git a/drivers/md/dm-service-time.c b/drivers/md/dm-service-time.c
index cfa668f46c40..9c6c2e47ad62 100644
--- a/drivers/md/dm-service-time.c
+++ b/drivers/md/dm-service-time.c
@@ -11,6 +11,8 @@
 #include "dm.h"
 #include "dm-path-selector.h"
 
+#include <linux/slab.h>
+
 #define DM_MSG_PREFIX   "multipath service-time"
 #define ST_MIN_IO       1
 #define ST_MAX_RELATIVE_THROUGHPUT      100
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index d5b2e08750d5..c097d8a4823d 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -55,6 +55,8 @@
  */
 #define SNAPSHOT_DISK_VERSION 1
 
+#define NUM_SNAPSHOT_HDR_CHUNKS 1
+
 struct disk_header {
         uint32_t magic;
 
@@ -120,7 +122,22 @@ struct pstore {
 
         /*
          * The next free chunk for an exception.
+         *
+         * When creating exceptions, all the chunks here and above are
+         * free.  It holds the next chunk to be allocated.  On rare
+         * occasions (e.g. after a system crash) holes can be left in
+         * the exception store because chunks can be committed out of
+         * order.
+         *
+         * When merging exceptions, it does not necessarily mean all the
+         * chunks here and above are free.  It holds the value it would
+         * have held if all chunks had been committed in order of
+         * allocation.  Consequently the value may occasionally be
+         * slightly too low, but since it's only used for 'status' and
+         * it can never reach its minimum value too early this doesn't
+         * matter.
          */
+
         chunk_t next_free;
 
         /*
@@ -214,7 +231,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
                     int metadata)
 {
         struct dm_io_region where = {
-                .bdev = ps->store->cow->bdev,
+                .bdev = dm_snap_cow(ps->store->snap)->bdev,
                 .sector = ps->store->chunk_size * chunk,
                 .count = ps->store->chunk_size,
         };
@@ -237,7 +254,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
          * Issue the synchronous I/O from a different thread
          * to avoid generic_make_request recursion.
          */
-        INIT_WORK(&req.work, do_metadata);
+        INIT_WORK_ON_STACK(&req.work, do_metadata);
         queue_work(ps->metadata_wq, &req.work);
         flush_workqueue(ps->metadata_wq);
 
@@ -284,16 +301,18 @@ static int read_header(struct pstore *ps, int *new_snapshot)
 {
         int r;
         struct disk_header *dh;
-        chunk_t chunk_size;
+        unsigned chunk_size;
         int chunk_size_supplied = 1;
         char *chunk_err;
 
         /*
-         * Use default chunk size (or hardsect_size, if larger) if none supplied
+         * Use default chunk size (or logical_block_size, if larger)
+         * if none supplied
          */
         if (!ps->store->chunk_size) {
                 ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS,
-                    bdev_logical_block_size(ps->store->cow->bdev) >> 9);
+                    bdev_logical_block_size(dm_snap_cow(ps->store->snap)->
+                                            bdev) >> 9);
                 ps->store->chunk_mask = ps->store->chunk_size - 1;
                 ps->store->chunk_shift = ffs(ps->store->chunk_size) - 1;
                 chunk_size_supplied = 0;
@@ -334,10 +353,9 @@ static int read_header(struct pstore *ps, int *new_snapshot)
                 return 0;
 
         if (chunk_size_supplied)
-                DMWARN("chunk size %llu in device metadata overrides "
-                       "table chunk size of %llu.",
-                       (unsigned long long)chunk_size,
-                       (unsigned long long)ps->store->chunk_size);
+                DMWARN("chunk size %u in device metadata overrides "
+                       "table chunk size of %u.",
+                       chunk_size, ps->store->chunk_size);
 
         /* We had a bogus chunk_size. Fix stuff up. */
         free_area(ps);
@@ -345,8 +363,8 @@ static int read_header(struct pstore *ps, int *new_snapshot)
         r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
                                               &chunk_err);
         if (r) {
-                DMERR("invalid on-disk chunk size %llu: %s.",
-                      (unsigned long long)chunk_size, chunk_err);
+                DMERR("invalid on-disk chunk size %u: %s.",
+                      chunk_size, chunk_err);
                 return r;
         }
 
@@ -408,6 +426,15 @@ static void write_exception(struct pstore *ps,
         e->new_chunk = cpu_to_le64(de->new_chunk);
 }
 
+static void clear_exception(struct pstore *ps, uint32_t index)
+{
+        struct disk_exception *e = get_exception(ps, index);
+
+        /* clear it */
+        e->old_chunk = 0;
+        e->new_chunk = 0;
+}
+
 /*
  * Registers the exceptions that are present in the current area.
  * 'full' is filled in to indicate if the area has been
@@ -489,11 +516,23 @@ static struct pstore *get_info(struct dm_exception_store *store)
         return (struct pstore *) store->context;
 }
 
-static void persistent_fraction_full(struct dm_exception_store *store,
-                                     sector_t *numerator, sector_t *denominator)
+static void persistent_usage(struct dm_exception_store *store,
+                             sector_t *total_sectors,
+                             sector_t *sectors_allocated,
+                             sector_t *metadata_sectors)
 {
-        *numerator = get_info(store)->next_free * store->chunk_size;
-        *denominator = get_dev_size(store->cow->bdev);
+        struct pstore *ps = get_info(store);
+
+        *sectors_allocated = ps->next_free * store->chunk_size;
+        *total_sectors = get_dev_size(dm_snap_cow(store->snap)->bdev);
+
+        /*
+         * First chunk is the fixed header.
+         * Then there are (ps->current_area + 1) metadata chunks, each one
+         * separated from the next by ps->exceptions_per_area data chunks.
+         */
+        *metadata_sectors = (ps->current_area + 1 + NUM_SNAPSHOT_HDR_CHUNKS) *
+                            store->chunk_size;
 }
 
 static void persistent_dtr(struct dm_exception_store *store)
@@ -552,44 +591,40 @@ static int persistent_read_metadata(struct dm_exception_store *store,
                 ps->current_area = 0;
                 zero_memory_area(ps);
                 r = zero_disk_area(ps, 0);
-                if (r) {
+                if (r)
                         DMWARN("zero_disk_area(0) failed");
-                        return r;
-                }
-        } else {
-                /*
-                 * Sanity checks.
-                 */
-                if (ps->version != SNAPSHOT_DISK_VERSION) {
-                        DMWARN("unable to handle snapshot disk version %d",
-                               ps->version);
-                        return -EINVAL;
-                }
+                return r;
+        }
+        /*
+         * Sanity checks.
+         */
+        if (ps->version != SNAPSHOT_DISK_VERSION) {
+                DMWARN("unable to handle snapshot disk version %d",
+                       ps->version);
+                return -EINVAL;
+        }
 
-                /*
-                 * Metadata are valid, but snapshot is invalidated
-                 */
-                if (!ps->valid)
-                        return 1;
+        /*
+         * Metadata are valid, but snapshot is invalidated
+         */
+        if (!ps->valid)
+                return 1;
 
-                /*
-                 * Read the metadata.
-                 */
-                r = read_exceptions(ps, callback, callback_context);
-                if (r)
-                        return r;
-        }
+        /*
+         * Read the metadata.
+         */
+        r = read_exceptions(ps, callback, callback_context);
 
-        return 0;
+        return r;
 }
 
 static int persistent_prepare_exception(struct dm_exception_store *store,
-                                        struct dm_snap_exception *e)
+                                        struct dm_exception *e)
 {
         struct pstore *ps = get_info(store);
         uint32_t stride;
         chunk_t next_free;
-        sector_t size = get_dev_size(store->cow->bdev);
+        sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
 
         /* Is there enough room ? */
         if (size < ((ps->next_free + 1) * store->chunk_size))
@@ -611,7 +646,7 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
 }
 
 static void persistent_commit_exception(struct dm_exception_store *store,
-                                        struct dm_snap_exception *e,
+                                        struct dm_exception *e,
                                         void (*callback) (void *, int success),
                                         void *callback_context)
 {
@@ -672,6 +707,85 @@ static void persistent_commit_exception(struct dm_exception_store *store,
         ps->callback_count = 0;
 }
 
+static int persistent_prepare_merge(struct dm_exception_store *store,
+                                    chunk_t *last_old_chunk,
+                                    chunk_t *last_new_chunk)
+{
+        struct pstore *ps = get_info(store);
+        struct disk_exception de;
+        int nr_consecutive;
+        int r;
+
+        /*
+         * When current area is empty, move back to preceding area.
+         */
+        if (!ps->current_committed) {
+                /*
+                 * Have we finished?
+                 */
+                if (!ps->current_area)
+                        return 0;
+
+                ps->current_area--;
+                r = area_io(ps, READ);
+                if (r < 0)
+                        return r;
+                ps->current_committed = ps->exceptions_per_area;
+        }
+
+        read_exception(ps, ps->current_committed - 1, &de);
+        *last_old_chunk = de.old_chunk;
+        *last_new_chunk = de.new_chunk;
+
+        /*
+         * Find number of consecutive chunks within the current area,
+         * working backwards.
+         */
+        for (nr_consecutive = 1; nr_consecutive < ps->current_committed;
+             nr_consecutive++) {
+                read_exception(ps, ps->current_committed - 1 - nr_consecutive,
+                               &de);
+                if (de.old_chunk != *last_old_chunk - nr_consecutive ||
+                    de.new_chunk != *last_new_chunk - nr_consecutive)
+                        break;
+        }
+
+        return nr_consecutive;
+}
+
+static int persistent_commit_merge(struct dm_exception_store *store,
+                                   int nr_merged)
+{
+        int r, i;
+        struct pstore *ps = get_info(store);
+
+        BUG_ON(nr_merged > ps->current_committed);
+
+        for (i = 0; i < nr_merged; i++)
+                clear_exception(ps, ps->current_committed - 1 - i);
+
+        r = area_io(ps, WRITE);
+        if (r < 0)
+                return r;
+
+        ps->current_committed -= nr_merged;
+
+        /*
+         * At this stage, only persistent_usage() uses ps->next_free, so
+         * we make no attempt to keep ps->next_free strictly accurate
+         * as exceptions may have been committed out-of-order originally.
+         * Once a snapshot has become merging, we set it to the value it
+         * would have held had all the exceptions been committed in order.
+         *
+         * ps->current_area does not get reduced by prepare_merge() until
+         * after commit_merge() has removed the nr_merged previous exceptions.
+         */
+        ps->next_free = (area_location(ps, ps->current_area) - 1) +
+                        (ps->current_committed + 1) + NUM_SNAPSHOT_HDR_CHUNKS;
+
+        return 0;
+}
+
 static void persistent_drop_snapshot(struct dm_exception_store *store)
 {
         struct pstore *ps = get_info(store);
@@ -697,7 +811,7 @@ static int persistent_ctr(struct dm_exception_store *store,
         ps->area = NULL;
         ps->zero_area = NULL;
         ps->header_area = NULL;
-        ps->next_free = 2;      /* skipping the header and first area */
+        ps->next_free = NUM_SNAPSHOT_HDR_CHUNKS + 1; /* header and 1st area */
         ps->current_committed = 0;
 
         ps->callback_count = 0;
@@ -726,8 +840,7 @@ static unsigned persistent_status(struct dm_exception_store *store,
         case STATUSTYPE_INFO:
                 break;
         case STATUSTYPE_TABLE:
-                DMEMIT(" %s P %llu", store->cow->name,
-                       (unsigned long long)store->chunk_size);
+                DMEMIT(" P %llu", (unsigned long long)store->chunk_size);
         }
 
         return sz;
@@ -741,8 +854,10 @@ static struct dm_exception_store_type _persistent_type = {
         .read_metadata = persistent_read_metadata,
         .prepare_exception = persistent_prepare_exception,
         .commit_exception = persistent_commit_exception,
+        .prepare_merge = persistent_prepare_merge,
+        .commit_merge = persistent_commit_merge,
         .drop_snapshot = persistent_drop_snapshot,
-        .fraction_full = persistent_fraction_full,
+        .usage = persistent_usage,
         .status = persistent_status,
 };
 
@@ -754,8 +869,10 @@ static struct dm_exception_store_type _persistent_compat_type = {
         .read_metadata = persistent_read_metadata,
         .prepare_exception = persistent_prepare_exception,
         .commit_exception = persistent_commit_exception,
+        .prepare_merge = persistent_prepare_merge,
+        .commit_merge = persistent_commit_merge,
         .drop_snapshot = persistent_drop_snapshot,
-        .fraction_full = persistent_fraction_full,
+        .usage = persistent_usage,
         .status = persistent_status,
 };
 
diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c
index cde5aa558e6d..a0898a66a2f8 100644
--- a/drivers/md/dm-snap-transient.c
+++ b/drivers/md/dm-snap-transient.c
@@ -36,10 +36,10 @@ static int transient_read_metadata(struct dm_exception_store *store,
 }
 
 static int transient_prepare_exception(struct dm_exception_store *store,
-                                       struct dm_snap_exception *e)
+                                       struct dm_exception *e)
 {
         struct transient_c *tc = store->context;
-        sector_t size = get_dev_size(store->cow->bdev);
+        sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
 
         if (size < (tc->next_free + store->chunk_size))
                 return -1;
@@ -51,7 +51,7 @@ static int transient_prepare_exception(struct dm_exception_store *store,
 }
 
 static void transient_commit_exception(struct dm_exception_store *store,
-                                       struct dm_snap_exception *e,
+                                       struct dm_exception *e,
                                        void (*callback) (void *, int success),
                                        void *callback_context)
 {
@@ -59,11 +59,14 @@ static void transient_commit_exception(struct dm_exception_store *store,
         callback(callback_context, 1);
 }
 
-static void transient_fraction_full(struct dm_exception_store *store,
-                                    sector_t *numerator, sector_t *denominator)
+static void transient_usage(struct dm_exception_store *store,
+                            sector_t *total_sectors,
+                            sector_t *sectors_allocated,
+                            sector_t *metadata_sectors)
 {
-        *numerator = ((struct transient_c *) store->context)->next_free;
-        *denominator = get_dev_size(store->cow->bdev);
+        *sectors_allocated = ((struct transient_c *) store->context)->next_free;
+        *total_sectors = get_dev_size(dm_snap_cow(store->snap)->bdev);
+        *metadata_sectors = 0;
 }
 
 static int transient_ctr(struct dm_exception_store *store,
@@ -91,8 +94,7 @@ static unsigned transient_status(struct dm_exception_store *store,
         case STATUSTYPE_INFO:
                 break;
         case STATUSTYPE_TABLE:
-                DMEMIT(" %s N %llu", store->cow->name,
-                       (unsigned long long)store->chunk_size);
+                DMEMIT(" N %llu", (unsigned long long)store->chunk_size);
         }
 
         return sz;
@@ -106,7 +108,7 @@ static struct dm_exception_store_type _transient_type = {
         .read_metadata = transient_read_metadata,
         .prepare_exception = transient_prepare_exception,
         .commit_exception = transient_commit_exception,
-        .fraction_full = transient_fraction_full,
+        .usage = transient_usage,
         .status = transient_status,
 };
 
@@ -118,7 +120,7 @@ static struct dm_exception_store_type _transient_compat_type = {
         .read_metadata = transient_read_metadata,
         .prepare_exception = transient_prepare_exception,
         .commit_exception = transient_commit_exception,
-        .fraction_full = transient_fraction_full,
+        .usage = transient_usage,
         .status = transient_status,
 };
 
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 57f1bf7f3b7a..54853773510c 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -25,6 +25,11 @@
 
 #define DM_MSG_PREFIX "snapshots"
 
+static const char dm_snapshot_merge_target_name[] = "snapshot-merge";
+
+#define dm_target_is_snapshot_merge(ti) \
+        ((ti)->type->name == dm_snapshot_merge_target_name)
+
 /*
  * The percentage increment we will wake up users at
  */
@@ -49,7 +54,7 @@
 #define DM_TRACKED_CHUNK_HASH(x)        ((unsigned long)(x) & \
                                          (DM_TRACKED_CHUNK_HASH_SIZE - 1))
 
-struct exception_table {
+struct dm_exception_table {
         uint32_t hash_mask;
         unsigned hash_shift;
         struct list_head *table;
@@ -59,22 +64,31 @@ struct dm_snapshot {
         struct rw_semaphore lock;
 
         struct dm_dev *origin;
+        struct dm_dev *cow;
+
+        struct dm_target *ti;
 
         /* List of snapshots per Origin */
         struct list_head list;
 
-        /* You can't use a snapshot if this is 0 (e.g. if full) */
+        /*
+         * You can't use a snapshot if this is 0 (e.g. if full).
+         * A snapshot-merge target never clears this.
+         */
         int valid;
 
         /* Origin writes don't trigger exceptions until this is set */
         int active;
 
-        mempool_t *pending_pool;
+        /* Whether or not owning mapped_device is suspended */
+        int suspended;
 
         atomic_t pending_exceptions_count;
 
-        struct exception_table pending;
-        struct exception_table complete;
+        mempool_t *pending_pool;
+
+        struct dm_exception_table pending;
+        struct dm_exception_table complete;
 
         /*
          * pe_lock protects all pending_exception operations and access
@@ -82,6 +96,11 @@ struct dm_snapshot {
          */
         spinlock_t pe_lock;
 
+        /* Chunks with outstanding reads */
+        spinlock_t tracked_chunk_lock;
+        mempool_t *tracked_chunk_pool;
+        struct hlist_head tracked_chunk_hash[DM_TRACKED_CHUNK_HASH_SIZE];
+
         /* The on disk metadata handler */
         struct dm_exception_store *store;
 
@@ -91,12 +110,50 @@ struct dm_snapshot {
         struct bio_list queued_bios;
         struct work_struct queued_bios_work;
 
-        /* Chunks with outstanding reads */
-        mempool_t *tracked_chunk_pool;
-        spinlock_t tracked_chunk_lock;
-        struct hlist_head tracked_chunk_hash[DM_TRACKED_CHUNK_HASH_SIZE];
+        /* Wait for events based on state_bits */
+        unsigned long state_bits;
+
+        /* Range of chunks currently being merged. */
+        chunk_t first_merging_chunk;
+        int num_merging_chunks;
+
+        /*
+         * The merge operation failed if this flag is set.
+         * Failure modes are handled as follows:
+         * - I/O error reading the header
+         *      => don't load the target; abort.
+         * - Header does not have "valid" flag set
+         *      => use the origin; forget about the snapshot.
+         * - I/O error when reading exceptions
+         *      => don't load the target; abort.
+         *         (We can't use the intermediate origin state.)
+         * - I/O error while merging
+         *      => stop merging; set merge_failed; process I/O normally.
+         */
+        int merge_failed;
+
+        /*
+         * Incoming bios that overlap with chunks being merged must wait
+         * for them to be committed.
+         */
+        struct bio_list bios_queued_during_merge;
 };
 
+/*
+ * state_bits:
+ *   RUNNING_MERGE  - Merge operation is in progress.
+ *   SHUTDOWN_MERGE - Set to signal that merge needs to be stopped;
+ *                    cleared afterwards.
+ */
+#define RUNNING_MERGE          0
+#define SHUTDOWN_MERGE         1
+
+struct dm_dev *dm_snap_cow(struct dm_snapshot *s)
+{
+        return s->cow;
+}
+EXPORT_SYMBOL(dm_snap_cow);
+
 static struct workqueue_struct *ksnapd;
 static void flush_queued_bios(struct work_struct *work);
 
@@ -116,7 +173,7 @@ static int bdev_equal(struct block_device *lhs, struct block_device *rhs)
 }
 
 struct dm_snap_pending_exception {
-        struct dm_snap_exception e;
+        struct dm_exception e;
 
         /*
          * Origin buffers waiting for this to complete are held
@@ -125,28 +182,6 @@ struct dm_snap_pending_exception {
         struct bio_list origin_bios;
         struct bio_list snapshot_bios;
 
-        /*
-         * Short-term queue of pending exceptions prior to submission.
-         */
-        struct list_head list;
-
-        /*
-         * The primary pending_exception is the one that holds
-         * the ref_count and the list of origin_bios for a
-         * group of pending_exceptions.  It is always last to get freed.
-         * These fields get set up when writing to the origin.
-         */
-        struct dm_snap_pending_exception *primary_pe;
-
-        /*
-         * Number of pending_exceptions processing this chunk.
-         * When this drops to zero we must complete the origin bios.
-         * If incrementing or decrementing this, hold pe->snap->lock for
-         * the sibling concerned and not pe->primary_pe->snap->lock unless
-         * they are the same.
-         */
-        atomic_t ref_count;
-
         /* Pointer back to snapshot context */
         struct dm_snapshot *snap;
 
@@ -222,6 +257,16 @@ static int __chunk_is_tracked(struct dm_snapshot *s, chunk_t chunk)
 }
 
 /*
+ * This conflicting I/O is extremely improbable in the caller,
+ * so msleep(1) is sufficient and there is no need for a wait queue.
+ */
+static void __check_for_conflicting_io(struct dm_snapshot *s, chunk_t chunk)
+{
+        while (__chunk_is_tracked(s, chunk))
+                msleep(1);
+}
+
+/*
  * One of these per registered origin, held in the snapshot_origins hash
  */
 struct origin {
@@ -243,6 +288,10 @@ struct origin {
 static struct list_head *_origins;
 static struct rw_semaphore _origins_lock;
 
+static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
+static DEFINE_SPINLOCK(_pending_exceptions_done_spinlock);
+static uint64_t _pending_exceptions_done_count;
+
 static int init_origin_hash(void)
 {
         int i;
@@ -291,21 +340,144 @@ static void __insert_origin(struct origin *o)
 }
 
 /*
+ * _origins_lock must be held when calling this function.
+ * Returns number of snapshots registered using the supplied cow device, plus:
+ * snap_src - a snapshot suitable for use as a source of exception handover
+ * snap_dest - a snapshot capable of receiving exception handover.
+ * snap_merge - an existing snapshot-merge target linked to the same origin.
+ *   There can be at most one snapshot-merge target. The parameter is optional.
+ *
+ * Possible return values and states of snap_src and snap_dest.
+ *   0: NULL, NULL  - first new snapshot
+ *   1: snap_src, NULL - normal snapshot
+ *   2: snap_src, snap_dest  - waiting for handover
+ *   2: snap_src, NULL - handed over, waiting for old to be deleted
+ *   1: NULL, snap_dest - source got destroyed without handover
+ */
+static int __find_snapshots_sharing_cow(struct dm_snapshot *snap,
+                                        struct dm_snapshot **snap_src,
+                                        struct dm_snapshot **snap_dest,
+                                        struct dm_snapshot **snap_merge)
+{
+        struct dm_snapshot *s;
+        struct origin *o;
+        int count = 0;
+        int active;
+
+        o = __lookup_origin(snap->origin->bdev);
+        if (!o)
+                goto out;
+
+        list_for_each_entry(s, &o->snapshots, list) {
+                if (dm_target_is_snapshot_merge(s->ti) && snap_merge)
+                        *snap_merge = s;
+                if (!bdev_equal(s->cow->bdev, snap->cow->bdev))
+                        continue;
+
+                down_read(&s->lock);
+                active = s->active;
+                up_read(&s->lock);
+
+                if (active) {
+                        if (snap_src)
+                                *snap_src = s;
+                } else if (snap_dest)
+                        *snap_dest = s;
+
+                count++;
+        }
+
+out:
+        return count;
+}
+
+/*
+ * On success, returns 1 if this snapshot is a handover destination,
+ * otherwise returns 0.
+ */
+static int __validate_exception_handover(struct dm_snapshot *snap)
+{
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+        struct dm_snapshot *snap_merge = NULL;
+
+        /* Does snapshot need exceptions handed over to it? */
+        if ((__find_snapshots_sharing_cow(snap, &snap_src, &snap_dest,
+                                          &snap_merge) == 2) ||
+            snap_dest) {
+                snap->ti->error = "Snapshot cow pairing for exception "
+                                  "table handover failed";
+                return -EINVAL;
+        }
+
+        /*
+         * If no snap_src was found, snap cannot become a handover
+         * destination.
+         */
+        if (!snap_src)
+                return 0;
+
+        /*
+         * Non-snapshot-merge handover?
+         */
+        if (!dm_target_is_snapshot_merge(snap->ti))
+                return 1;
+
+        /*
+         * Do not allow more than one merging snapshot.
+         */
+        if (snap_merge) {
+                snap->ti->error = "A snapshot is already merging.";
+                return -EINVAL;
+        }
+
+        if (!snap_src->store->type->prepare_merge ||
+            !snap_src->store->type->commit_merge) {
+                snap->ti->error = "Snapshot exception store does not "
+                                  "support snapshot-merge.";
+                return -EINVAL;
+        }
+
+        return 1;
+}
+
+static void __insert_snapshot(struct origin *o, struct dm_snapshot *s)
+{
+        struct dm_snapshot *l;
+
+        /* Sort the list according to chunk size, largest-first smallest-last */
+        list_for_each_entry(l, &o->snapshots, list)
+                if (l->store->chunk_size < s->store->chunk_size)
+                        break;
+        list_add_tail(&s->list, &l->list);
+}
+
+/*
  * Make a note of the snapshot and its origin so we can look it
  * up when the origin has a write on it.
+ *
+ * Also validate snapshot exception store handovers.
+ * On success, returns 1 if this registration is a handover destination,
+ * otherwise returns 0.
  */
 static int register_snapshot(struct dm_snapshot *snap)
 {
-        struct origin *o, *new_o;
+        struct origin *o, *new_o = NULL;
         struct block_device *bdev = snap->origin->bdev;
+        int r = 0;
 
         new_o = kmalloc(sizeof(*new_o), GFP_KERNEL);
         if (!new_o)
                 return -ENOMEM;
 
         down_write(&_origins_lock);
-        o = __lookup_origin(bdev);
 
+        r = __validate_exception_handover(snap);
+        if (r < 0) {
+                kfree(new_o);
+                goto out;
+        }
+
+        o = __lookup_origin(bdev);
         if (o)
                 kfree(new_o);
         else {
@@ -319,10 +491,27 @@ static int register_snapshot(struct dm_snapshot *snap)
                 __insert_origin(o);
         }
 
-        list_add_tail(&snap->list, &o->snapshots);
+        __insert_snapshot(o, snap);
+
+out:
+        up_write(&_origins_lock);
+
+        return r;
+}
+
+/*
+ * Move snapshot to correct place in list according to chunk size.
+ */
+static void reregister_snapshot(struct dm_snapshot *s)
+{
+        struct block_device *bdev = s->origin->bdev;
+
+        down_write(&_origins_lock);
+
+        list_del(&s->list);
+        __insert_snapshot(__lookup_origin(bdev), s);
 
         up_write(&_origins_lock);
-        return 0;
 }
 
 static void unregister_snapshot(struct dm_snapshot *s)
@@ -333,7 +522,7 @@ static void unregister_snapshot(struct dm_snapshot *s)
         o = __lookup_origin(s->origin->bdev);
 
         list_del(&s->list);
-        if (list_empty(&o->snapshots)) {
+        if (o && list_empty(&o->snapshots)) {
                 list_del(&o->hash_list);
                 kfree(o);
         }
@@ -346,8 +535,8 @@ static void unregister_snapshot(struct dm_snapshot *s)
  * The lowest hash_shift bits of the chunk number are ignored, allowing
  * some consecutive chunks to be grouped together.
  */
-static int init_exception_table(struct exception_table *et, uint32_t size,
-                                unsigned hash_shift)
+static int dm_exception_table_init(struct dm_exception_table *et,
+                                   uint32_t size, unsigned hash_shift)
 {
         unsigned int i;
 
@@ -363,10 +552,11 @@ static int init_exception_table(struct exception_table *et, uint32_t size,
         return 0;
 }
 
-static void exit_exception_table(struct exception_table *et, struct kmem_cache *mem)
+static void dm_exception_table_exit(struct dm_exception_table *et,
+                                    struct kmem_cache *mem)
 {
         struct list_head *slot;
-        struct dm_snap_exception *ex, *next;
+        struct dm_exception *ex, *next;
         int i, size;
 
         size = et->hash_mask + 1;
@@ -380,19 +570,12 @@ static void exit_exception_table(struct exception_table *et, struct kmem_cache *
         vfree(et->table);
 }
 
-static uint32_t exception_hash(struct exception_table *et, chunk_t chunk)
+static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk)
 {
         return (chunk >> et->hash_shift) & et->hash_mask;
 }
 
-static void insert_exception(struct exception_table *eh,
-                             struct dm_snap_exception *e)
-{
-        struct list_head *l = &eh->table[exception_hash(eh, e->old_chunk)];
-        list_add(&e->hash_list, l);
-}
-
-static void remove_exception(struct dm_snap_exception *e)
+static void dm_remove_exception(struct dm_exception *e)
 {
         list_del(&e->hash_list);
 }
@@ -401,11 +584,11 @@ static void remove_exception(struct dm_snap_exception *e)
  * Return the exception data for a sector, or NULL if not
  * remapped.
  */
-static struct dm_snap_exception *lookup_exception(struct exception_table *et,
-                                                  chunk_t chunk)
+static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et,
+                                                chunk_t chunk)
 {
         struct list_head *slot;
-        struct dm_snap_exception *e;
+        struct dm_exception *e;
 
         slot = &et->table[exception_hash(et, chunk)];
         list_for_each_entry (e, slot, hash_list)
@@ -416,9 +599,9 @@ static struct dm_snap_exception *lookup_exception(struct exception_table *et,
         return NULL;
 }
 
-static struct dm_snap_exception *alloc_exception(void)
+static struct dm_exception *alloc_completed_exception(void)
 {
-        struct dm_snap_exception *e;
+        struct dm_exception *e;
 
         e = kmem_cache_alloc(exception_cache, GFP_NOIO);
         if (!e)
@@ -427,7 +610,7 @@ static struct dm_snap_exception *alloc_exception(void)
         return e;
 }
 
-static void free_exception(struct dm_snap_exception *e)
+static void free_completed_exception(struct dm_exception *e)
 {
         kmem_cache_free(exception_cache, e);
 }
@@ -452,12 +635,11 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe)
         atomic_dec(&s->pending_exceptions_count);
 }
 
-static void insert_completed_exception(struct dm_snapshot *s,
-                                       struct dm_snap_exception *new_e)
+static void dm_insert_exception(struct dm_exception_table *eh,
+                                struct dm_exception *new_e)
 {
-        struct exception_table *eh = &s->complete;
         struct list_head *l;
-        struct dm_snap_exception *e = NULL;
+        struct dm_exception *e = NULL;
 
         l = &eh->table[exception_hash(eh, new_e->old_chunk)];
 
@@ -473,7 +655,7 @@ static void insert_completed_exception(struct dm_snapshot *s,
                     new_e->new_chunk == (dm_chunk_number(e->new_chunk) +
                                          dm_consecutive_chunk_count(e) + 1)) {
                         dm_consecutive_chunk_count_inc(e);
-                        free_exception(new_e);
+                        free_completed_exception(new_e);
                         return;
                 }
 
@@ -483,7 +665,7 @@ static void insert_completed_exception(struct dm_snapshot *s,
                         dm_consecutive_chunk_count_inc(e);
                         e->old_chunk--;
                         e->new_chunk--;
-                        free_exception(new_e);
+                        free_completed_exception(new_e);
                         return;
                 }
 
@@ -502,9 +684,9 @@ out:
 static int dm_add_exception(void *context, chunk_t old, chunk_t new)
 {
         struct dm_snapshot *s = context;
-        struct dm_snap_exception *e;
+        struct dm_exception *e;
 
-        e = alloc_exception();
+        e = alloc_completed_exception();
         if (!e)
                 return -ENOMEM;
 
@@ -513,11 +695,30 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
         /* Consecutive_count is implicitly initialised to zero */
         e->new_chunk = new;
 
-        insert_completed_exception(s, e);
+        dm_insert_exception(&s->complete, e);
 
         return 0;
 }
 
+#define min_not_zero(l, r) (((l) == 0) ? (r) : (((r) == 0) ? (l) : min(l, r)))
+
+/*
+ * Return a minimum chunk size of all snapshots that have the specified origin.
+ * Return zero if the origin has no snapshots.
+ */
+static sector_t __minimum_chunk_size(struct origin *o)
+{
+        struct dm_snapshot *snap;
+        unsigned chunk_size = 0;
+
+        if (o)
+                list_for_each_entry(snap, &o->snapshots, list)
+                        chunk_size = min_not_zero(chunk_size,
+                                                  snap->store->chunk_size);
+
+        return chunk_size;
+}
+
 /*
  * Hard coded magic.
  */
@@ -541,16 +742,18 @@ static int init_hash_tables(struct dm_snapshot *s)
          * Calculate based on the size of the original volume or
          * the COW volume...
          */
-        cow_dev_size = get_dev_size(s->store->cow->bdev);
+        cow_dev_size = get_dev_size(s->cow->bdev);
         origin_dev_size = get_dev_size(s->origin->bdev);
         max_buckets = calc_max_buckets();
 
         hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
         hash_size = min(hash_size, max_buckets);
 
+        if (hash_size < 64)
+                hash_size = 64;
         hash_size = rounddown_pow_of_two(hash_size);
-        if (init_exception_table(&s->complete, hash_size,
-                                 DM_CHUNK_CONSECUTIVE_BITS))
+        if (dm_exception_table_init(&s->complete, hash_size,
+                                    DM_CHUNK_CONSECUTIVE_BITS))
                 return -ENOMEM;
 
         /*
@@ -561,14 +764,284 @@ static int init_hash_tables(struct dm_snapshot *s)
         if (hash_size < 64)
                 hash_size = 64;
 
-        if (init_exception_table(&s->pending, hash_size, 0)) {
-                exit_exception_table(&s->complete, exception_cache);
+        if (dm_exception_table_init(&s->pending, hash_size, 0)) {
+                dm_exception_table_exit(&s->complete, exception_cache);
                 return -ENOMEM;
         }
 
         return 0;
 }
 
+static void merge_shutdown(struct dm_snapshot *s)
+{
+        clear_bit_unlock(RUNNING_MERGE, &s->state_bits);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&s->state_bits, RUNNING_MERGE);
+}
+
+static struct bio *__release_queued_bios_after_merge(struct dm_snapshot *s)
+{
+        s->first_merging_chunk = 0;
+        s->num_merging_chunks = 0;
+
+        return bio_list_get(&s->bios_queued_during_merge);
+}
+
+/*
+ * Remove one chunk from the index of completed exceptions.
+ */
+static int __remove_single_exception_chunk(struct dm_snapshot *s,
+                                           chunk_t old_chunk)
+{
+        struct dm_exception *e;
+
+        e = dm_lookup_exception(&s->complete, old_chunk);
+        if (!e) {
+                DMERR("Corruption detected: exception for block %llu is "
+                      "on disk but not in memory",
+                      (unsigned long long)old_chunk);
+                return -EINVAL;
+        }
+
+        /*
+         * If this is the only chunk using this exception, remove exception.
+         */
+        if (!dm_consecutive_chunk_count(e)) {
+                dm_remove_exception(e);
+                free_completed_exception(e);
+                return 0;
+        }
+
+        /*
+         * The chunk may be either at the beginning or the end of a
+         * group of consecutive chunks - never in the middle.  We are
+         * removing chunks in the opposite order to that in which they
+         * were added, so this should always be true.
+         * Decrement the consecutive chunk counter and adjust the
+         * starting point if necessary.
+         */
+        if (old_chunk == e->old_chunk) {
+                e->old_chunk++;
+                e->new_chunk++;
+        } else if (old_chunk != e->old_chunk +
+                   dm_consecutive_chunk_count(e)) {
+                DMERR("Attempt to merge block %llu from the "
+                      "middle of a chunk range [%llu - %llu]",
+                      (unsigned long long)old_chunk,
+                      (unsigned long long)e->old_chunk,
+                      (unsigned long long)
+                      e->old_chunk + dm_consecutive_chunk_count(e));
+                return -EINVAL;
+        }
+
+        dm_consecutive_chunk_count_dec(e);
+
+        return 0;
+}
+
+static void flush_bios(struct bio *bio);
+
+static int remove_single_exception_chunk(struct dm_snapshot *s)
+{
+        struct bio *b = NULL;
+        int r;
+        chunk_t old_chunk = s->first_merging_chunk + s->num_merging_chunks - 1;
+
+        down_write(&s->lock);
+
+        /*
+         * Process chunks (and associated exceptions) in reverse order
+         * so that dm_consecutive_chunk_count_dec() accounting works.
+         */
+        do {
+                r = __remove_single_exception_chunk(s, old_chunk);
+                if (r)
+                        goto out;
+        } while (old_chunk-- > s->first_merging_chunk);
+
+        b = __release_queued_bios_after_merge(s);
+
+out:
+        up_write(&s->lock);
+        if (b)
+                flush_bios(b);
+
+        return r;
+}
+
+static int origin_write_extent(struct dm_snapshot *merging_snap,
+                               sector_t sector, unsigned chunk_size);
+
+static void merge_callback(int read_err, unsigned long write_err,
+                           void *context);
+
+static uint64_t read_pending_exceptions_done_count(void)
+{
+        uint64_t pending_exceptions_done;
+
+        spin_lock(&_pending_exceptions_done_spinlock);
+        pending_exceptions_done = _pending_exceptions_done_count;
+        spin_unlock(&_pending_exceptions_done_spinlock);
+
+        return pending_exceptions_done;
+}
+
+static void increment_pending_exceptions_done_count(void)
+{
+        spin_lock(&_pending_exceptions_done_spinlock);
+        _pending_exceptions_done_count++;
+        spin_unlock(&_pending_exceptions_done_spinlock);
+
+        wake_up_all(&_pending_exceptions_done);
+}
+
+static void snapshot_merge_next_chunks(struct dm_snapshot *s)
+{
+        int i, linear_chunks;
+        chunk_t old_chunk, new_chunk;
+        struct dm_io_region src, dest;
+        sector_t io_size;
+        uint64_t previous_count;
+
+        BUG_ON(!test_bit(RUNNING_MERGE, &s->state_bits));
+        if (unlikely(test_bit(SHUTDOWN_MERGE, &s->state_bits)))
+                goto shut;
+
+        /*
+         * valid flag never changes during merge, so no lock required.
+         */
+        if (!s->valid) {
+                DMERR("Snapshot is invalid: can't merge");
+                goto shut;
+        }
+
+        linear_chunks = s->store->type->prepare_merge(s->store, &old_chunk,
+                                                      &new_chunk);
+        if (linear_chunks <= 0) {
+                if (linear_chunks < 0) {
+                        DMERR("Read error in exception store: "
+                              "shutting down merge");
+                        down_write(&s->lock);
+                        s->merge_failed = 1;
+                        up_write(&s->lock);
+                }
+                goto shut;
+        }
+
+        /* Adjust old_chunk and new_chunk to reflect start of linear region */
+        old_chunk = old_chunk + 1 - linear_chunks;
+        new_chunk = new_chunk + 1 - linear_chunks;
+
+        /*
+         * Use one (potentially large) I/O to copy all 'linear_chunks'
+         * from the exception store to the origin
+         */
+        io_size = linear_chunks * s->store->chunk_size;
+
+        dest.bdev = s->origin->bdev;
+        dest.sector = chunk_to_sector(s->store, old_chunk);
+        dest.count = min(io_size, get_dev_size(dest.bdev) - dest.sector);
+
+        src.bdev = s->cow->bdev;
+        src.sector = chunk_to_sector(s->store, new_chunk);
+        src.count = dest.count;
+
+        /*
+         * Reallocate any exceptions needed in other snapshots then
+         * wait for the pending exceptions to complete.
+         * Each time any pending exception (globally on the system)
+         * completes we are woken and repeat the process to find out
+         * if we can proceed.  While this may not seem a particularly
+         * efficient algorithm, it is not expected to have any
+         * significant impact on performance.
+         */
+        previous_count = read_pending_exceptions_done_count();
+        while (origin_write_extent(s, dest.sector, io_size)) {
+                wait_event(_pending_exceptions_done,
+                           (read_pending_exceptions_done_count() !=
+                            previous_count));
+                /* Retry after the wait, until all exceptions are done. */
+                previous_count = read_pending_exceptions_done_count();
+        }
+
+        down_write(&s->lock);
+        s->first_merging_chunk = old_chunk;
+        s->num_merging_chunks = linear_chunks;
+        up_write(&s->lock);
+
+        /* Wait until writes to all 'linear_chunks' drain */
+        for (i = 0; i < linear_chunks; i++)
+                __check_for_conflicting_io(s, old_chunk + i);
+
+        dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, merge_callback, s);
+        return;
+
+shut:
+        merge_shutdown(s);
+}
+
+static void error_bios(struct bio *bio);
+
+static void merge_callback(int read_err, unsigned long write_err, void *context)
+{
+        struct dm_snapshot *s = context;
+        struct bio *b = NULL;
+
+        if (read_err || write_err) {
+                if (read_err)
+                        DMERR("Read error: shutting down merge.");
+                else
+                        DMERR("Write error: shutting down merge.");
+                goto shut;
+        }
+
+        if (s->store->type->commit_merge(s->store,
+                                         s->num_merging_chunks) < 0) {
+                DMERR("Write error in exception store: shutting down merge");
+                goto shut;
+        }
+
+        if (remove_single_exception_chunk(s) < 0)
+                goto shut;
+
+        snapshot_merge_next_chunks(s);
+
+        return;
+
+shut:
+        down_write(&s->lock);
+        s->merge_failed = 1;
+        b = __release_queued_bios_after_merge(s);
+        up_write(&s->lock);
+        error_bios(b);
+
+        merge_shutdown(s);
+}
+
+static void start_merge(struct dm_snapshot *s)
+{
+        if (!test_and_set_bit(RUNNING_MERGE, &s->state_bits))
+                snapshot_merge_next_chunks(s);
+}
+
+static int wait_schedule(void *ptr)
+{
+        schedule();
+
+        return 0;
+}
+
+/*
+ * Stop the merging process and wait until it finishes.
+ */
+static void stop_merge(struct dm_snapshot *s)
+{
+        set_bit(SHUTDOWN_MERGE, &s->state_bits);
+        wait_on_bit(&s->state_bits, RUNNING_MERGE, wait_schedule,
+                    TASK_UNINTERRUPTIBLE);
+        clear_bit(SHUTDOWN_MERGE, &s->state_bits);
+}
+
 /*
  * Construct a snapshot mapping: <origin_dev> <COW-dev> <p/n> <chunk-size>
  */
@@ -577,50 +1050,72 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         struct dm_snapshot *s;
         int i;
         int r = -EINVAL;
-        char *origin_path;
-        struct dm_exception_store *store;
-        unsigned args_used;
+        char *origin_path, *cow_path;
+        unsigned args_used, num_flush_requests = 1;
+        fmode_t origin_mode = FMODE_READ;
 
         if (argc != 4) {
                 ti->error = "requires exactly 4 arguments";
                 r = -EINVAL;
-                goto bad_args;
+                goto bad;
+        }
+
+        if (dm_target_is_snapshot_merge(ti)) {
+                num_flush_requests = 2;
+                origin_mode = FMODE_WRITE;
         }
 
         origin_path = argv[0];
         argv++;
         argc--;
 
-        r = dm_exception_store_create(ti, argc, argv, &args_used, &store);
+        s = kmalloc(sizeof(*s), GFP_KERNEL);
+        if (!s) {
+                ti->error = "Cannot allocate snapshot context private "
+                    "structure";
+                r = -ENOMEM;
+                goto bad;
+        }
+
+        cow_path = argv[0];
+        argv++;
+        argc--;
+
+        r = dm_get_device(ti, cow_path, FMODE_READ | FMODE_WRITE, &s->cow);
+        if (r) {
+                ti->error = "Cannot get COW device";
+                goto bad_cow;
+        }
+
+        r = dm_exception_store_create(ti, argc, argv, s, &args_used, &s->store);
         if (r) {
                 ti->error = "Couldn't create exception store";
                 r = -EINVAL;
-                goto bad_args;
+                goto bad_store;
         }
 
         argv += args_used;
         argc -= args_used;
 
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
-        if (!s) {
-                ti->error = "Cannot allocate snapshot context private "
-                    "structure";
-                r = -ENOMEM;
-                goto bad_snap;
-        }
-
-        r = dm_get_device(ti, origin_path, 0, ti->len, FMODE_READ, &s->origin);
+        r = dm_get_device(ti, origin_path, origin_mode, &s->origin);
         if (r) {
                 ti->error = "Cannot get origin device";
                 goto bad_origin;
         }
 
-        s->store = store;
+        s->ti = ti;
         s->valid = 1;
         s->active = 0;
+        s->suspended = 0;
         atomic_set(&s->pending_exceptions_count, 0);
         init_rwsem(&s->lock);
+        INIT_LIST_HEAD(&s->list);
         spin_lock_init(&s->pe_lock);
+        s->state_bits = 0;
+        s->merge_failed = 0;
+        s->first_merging_chunk = 0;
+        s->num_merging_chunks = 0;
+        bio_list_init(&s->bios_queued_during_merge);
 
         /* Allocate hash table for COW data */
         if (init_hash_tables(s)) {
@@ -654,34 +1149,55 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         spin_lock_init(&s->tracked_chunk_lock);
 
-        /* Metadata must only be loaded into one table at once */
+        bio_list_init(&s->queued_bios);
+        INIT_WORK(&s->queued_bios_work, flush_queued_bios);
+
+        ti->private = s;
+        ti->num_flush_requests = num_flush_requests;
+
+        /* Add snapshot to the list of snapshots for this origin */
+        /* Exceptions aren't triggered till snapshot_resume() is called */
+        r = register_snapshot(s);
+        if (r == -ENOMEM) {
+                ti->error = "Snapshot origin struct allocation failed";
+                goto bad_load_and_register;
+        } else if (r < 0) {
+                /* invalid handover, register_snapshot has set ti->error */
+                goto bad_load_and_register;
+        }
+
+        /*
+         * Metadata must only be loaded into one table at once, so skip this
+         * if metadata will be handed over during resume.
+         * Chunk size will be set during the handover - set it to zero to
+         * ensure it's ignored.
+         */
+        if (r > 0) {
+                s->store->chunk_size = 0;
+                return 0;
+        }
+
         r = s->store->type->read_metadata(s->store, dm_add_exception,
                                           (void *)s);
         if (r < 0) {
                 ti->error = "Failed to read snapshot metadata";
-                goto bad_load_and_register;
+                goto bad_read_metadata;
         } else if (r > 0) {
                 s->valid = 0;
                 DMWARN("Snapshot is marked invalid.");
         }
 
-        bio_list_init(&s->queued_bios);
-        INIT_WORK(&s->queued_bios_work, flush_queued_bios);
-
-        /* Add snapshot to the list of snapshots for this origin */
-        /* Exceptions aren't triggered till snapshot_resume() is called */
-        if (register_snapshot(s)) {
-                r = -EINVAL;
-                ti->error = "Cannot register snapshot origin";
-                goto bad_load_and_register;
+        if (!s->store->chunk_size) {
+                ti->error = "Chunk size not set";
+                goto bad_read_metadata;
         }
-
-        ti->private = s;
         ti->split_io = s->store->chunk_size;
-        ti->num_flush_requests = 1;
 
         return 0;
 
+bad_read_metadata:
+        unregister_snapshot(s);
+
 bad_load_and_register:
         mempool_destroy(s->tracked_chunk_pool);
 
@@ -692,19 +1208,22 @@ bad_pending_pool:
         dm_kcopyd_client_destroy(s->kcopyd_client);
 
 bad_kcopyd:
-        exit_exception_table(&s->pending, pending_cache);
-        exit_exception_table(&s->complete, exception_cache);
+        dm_exception_table_exit(&s->pending, pending_cache);
+        dm_exception_table_exit(&s->complete, exception_cache);
 
 bad_hash_tables:
         dm_put_device(ti, s->origin);
 
 bad_origin:
-        kfree(s);
+        dm_exception_store_destroy(s->store);
 
-bad_snap:
-        dm_exception_store_destroy(store);
+bad_store:
+        dm_put_device(ti, s->cow);
+
+bad_cow:
+        kfree(s);
 
-bad_args:
+bad:
         return r;
 }
 
@@ -713,8 +1232,39 @@ static void __free_exceptions(struct dm_snapshot *s)
         dm_kcopyd_client_destroy(s->kcopyd_client);
         s->kcopyd_client = NULL;
 
-        exit_exception_table(&s->pending, pending_cache);
-        exit_exception_table(&s->complete, exception_cache);
+        dm_exception_table_exit(&s->pending, pending_cache);
+        dm_exception_table_exit(&s->complete, exception_cache);
+}
+
+static void __handover_exceptions(struct dm_snapshot *snap_src,
+                                  struct dm_snapshot *snap_dest)
+{
+        union {
+                struct dm_exception_table table_swap;
+                struct dm_exception_store *store_swap;
+        } u;
+
+        /*
+         * Swap all snapshot context information between the two instances.
+         */
+        u.table_swap = snap_dest->complete;
+        snap_dest->complete = snap_src->complete;
+        snap_src->complete = u.table_swap;
+
+        u.store_swap = snap_dest->store;
+        snap_dest->store = snap_src->store;
+        snap_src->store = u.store_swap;
+
+        snap_dest->store->snap = snap_dest;
+        snap_src->store->snap = snap_src;
+
+        snap_dest->ti->split_io = snap_dest->store->chunk_size;
+        snap_dest->valid = snap_src->valid;
+
+        /*
+         * Set source invalid to ensure it receives no further I/O.
+         */
+        snap_src->valid = 0;
 }
 
 static void snapshot_dtr(struct dm_target *ti)
@@ -723,9 +1273,24 @@ static void snapshot_dtr(struct dm_target *ti)
         int i;
 #endif
         struct dm_snapshot *s = ti->private;
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
 
         flush_workqueue(ksnapd);
 
+        down_read(&_origins_lock);
+        /* Check whether exception handover must be cancelled */
+        (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+        if (snap_src && snap_dest && (s == snap_src)) {
+                down_write(&snap_dest->lock);
+                snap_dest->valid = 0;
+                up_write(&snap_dest->lock);
+                DMERR("Cancelling snapshot handover.");
+        }
+        up_read(&_origins_lock);
+
+        if (dm_target_is_snapshot_merge(ti))
+                stop_merge(s);
+
         /* Prevent further origin writes from using this snapshot. */
         /* After this returns there can be no new kcopyd jobs. */
         unregister_snapshot(s);
@@ -753,6 +1318,8 @@ static void snapshot_dtr(struct dm_target *ti)
 
         dm_exception_store_destroy(s->store);
 
+        dm_put_device(ti, s->cow);
+
         kfree(s);
 }
 
@@ -785,6 +1352,26 @@ static void flush_queued_bios(struct work_struct *work)
         flush_bios(queued_bios);
 }
 
+static int do_origin(struct dm_dev *origin, struct bio *bio);
+
+/*
+ * Flush a list of buffers.
+ */
+static void retry_origin_bios(struct dm_snapshot *s, struct bio *bio)
+{
+        struct bio *n;
+        int r;
+
+        while (bio) {
+                n = bio->bi_next;
+                bio->bi_next = NULL;
+                r = do_origin(s->origin, bio);
+                if (r == DM_MAPIO_REMAPPED)
+                        generic_make_request(bio);
+                bio = n;
+        }
+}
+
 /*
  * Error a list of buffers.
  */
@@ -815,45 +1402,12 @@ static void __invalidate_snapshot(struct dm_snapshot *s, int err)
 
         s->valid = 0;
 
-        dm_table_event(s->store->ti->table);
-}
-
-static void get_pending_exception(struct dm_snap_pending_exception *pe)
-{
-        atomic_inc(&pe->ref_count);
-}
-
-static struct bio *put_pending_exception(struct dm_snap_pending_exception *pe)
-{
-        struct dm_snap_pending_exception *primary_pe;
-        struct bio *origin_bios = NULL;
-
-        primary_pe = pe->primary_pe;
-
-        /*
-         * If this pe is involved in a write to the origin and
-         * it is the last sibling to complete then release
-         * the bios for the original write to the origin.
-         */
-        if (primary_pe &&
-            atomic_dec_and_test(&primary_pe->ref_count)) {
-                origin_bios = bio_list_get(&primary_pe->origin_bios);
-                free_pending_exception(primary_pe);
-        }
-
-        /*
-         * Free the pe if it's not linked to an origin write or if
-         * it's not itself a primary pe.
-         */
-        if (!primary_pe || primary_pe != pe)
-                free_pending_exception(pe);
-
-        return origin_bios;
+        dm_table_event(s->ti->table);
 }
 
 static void pending_complete(struct dm_snap_pending_exception *pe, int success)
 {
-        struct dm_snap_exception *e;
+        struct dm_exception *e;
         struct dm_snapshot *s = pe->snap;
         struct bio *origin_bios = NULL;
         struct bio *snapshot_bios = NULL;
@@ -867,7 +1421,7 @@ static void pending_complete(struct dm_snap_pending_exception *pe, int success)
                 goto out;
         }
 
-        e = alloc_exception();
+        e = alloc_completed_exception();
         if (!e) {
                 down_write(&s->lock);
                 __invalidate_snapshot(s, -ENOMEM);
@@ -878,28 +1432,27 @@ static void pending_complete(struct dm_snap_pending_exception *pe, int success)
 
         down_write(&s->lock);
         if (!s->valid) {
-                free_exception(e);
+                free_completed_exception(e);
                 error = 1;
                 goto out;
         }
 
-        /*
-         * Check for conflicting reads. This is extremely improbable,
-         * so msleep(1) is sufficient and there is no need for a wait queue.
-         */
-        while (__chunk_is_tracked(s, pe->e.old_chunk))
-                msleep(1);
+        /* Check for conflicting reads */
+        __check_for_conflicting_io(s, pe->e.old_chunk);
 
         /*
          * Add a proper exception, and remove the
          * in-flight exception from the list.
          */
-        insert_completed_exception(s, e);
+        dm_insert_exception(&s->complete, e);
 
  out:
-        remove_exception(&pe->e);
+        dm_remove_exception(&pe->e);
         snapshot_bios = bio_list_get(&pe->snapshot_bios);
-        origin_bios = put_pending_exception(pe);
+        origin_bios = bio_list_get(&pe->origin_bios);
+        free_pending_exception(pe);
+
+        increment_pending_exceptions_done_count();
 
         up_write(&s->lock);
 
@@ -909,7 +1462,7 @@ static void pending_complete(struct dm_snap_pending_exception *pe, int success)
         else
                 flush_bios(snapshot_bios);
 
-        flush_bios(origin_bios);
+        retry_origin_bios(s, origin_bios);
 }
 
 static void commit_callback(void *context, int success)
@@ -951,9 +1504,9 @@ static void start_copy(struct dm_snap_pending_exception *pe)
 
         src.bdev = bdev;
         src.sector = chunk_to_sector(s->store, pe->e.old_chunk);
-        src.count = min(s->store->chunk_size, dev_size - src.sector);
+        src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector);
 
-        dest.bdev = s->store->cow->bdev;
+        dest.bdev = s->cow->bdev;
         dest.sector = chunk_to_sector(s->store, pe->e.new_chunk);
         dest.count = src.count;
 
@@ -965,7 +1518,7 @@ static void start_copy(struct dm_snap_pending_exception *pe)
 static struct dm_snap_pending_exception *
 __lookup_pending_exception(struct dm_snapshot *s, chunk_t chunk)
 {
-        struct dm_snap_exception *e = lookup_exception(&s->pending, chunk);
+        struct dm_exception *e = dm_lookup_exception(&s->pending, chunk);
 
         if (!e)
                 return NULL;
@@ -996,8 +1549,6 @@ __find_pending_exception(struct dm_snapshot *s,
         pe->e.old_chunk = chunk;
         bio_list_init(&pe->origin_bios);
         bio_list_init(&pe->snapshot_bios);
-        pe->primary_pe = NULL;
-        atomic_set(&pe->ref_count, 0);
         pe->started = 0;
 
         if (s->store->type->prepare_exception(s->store, &pe->e)) {
@@ -1005,16 +1556,15 @@ __find_pending_exception(struct dm_snapshot *s,
                 return NULL;
         }
 
-        get_pending_exception(pe);
-        insert_exception(&s->pending, &pe->e);
+        dm_insert_exception(&s->pending, &pe->e);
 
         return pe;
 }
 
-static void remap_exception(struct dm_snapshot *s, struct dm_snap_exception *e,
+static void remap_exception(struct dm_snapshot *s, struct dm_exception *e,
                             struct bio *bio, chunk_t chunk)
 {
-        bio->bi_bdev = s->store->cow->bdev;
+        bio->bi_bdev = s->cow->bdev;
         bio->bi_sector = chunk_to_sector(s->store,
                                          dm_chunk_number(e->new_chunk) +
                                          (chunk - e->old_chunk)) +
@@ -1025,14 +1575,14 @@ static void remap_exception(struct dm_snapshot *s, struct dm_snap_exception *e,
 static int snapshot_map(struct dm_target *ti, struct bio *bio,
                         union map_info *map_context)
 {
-        struct dm_snap_exception *e;
+        struct dm_exception *e;
         struct dm_snapshot *s = ti->private;
         int r = DM_MAPIO_REMAPPED;
         chunk_t chunk;
         struct dm_snap_pending_exception *pe = NULL;
 
         if (unlikely(bio_empty_barrier(bio))) {
-                bio->bi_bdev = s->store->cow->bdev;
+                bio->bi_bdev = s->cow->bdev;
                 return DM_MAPIO_REMAPPED;
         }
 
@@ -1053,7 +1603,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
         }
 
         /* If the block is already remapped - use that, else remap it */
-        e = lookup_exception(&s->complete, chunk);
+        e = dm_lookup_exception(&s->complete, chunk);
         if (e) {
                 remap_exception(s, e, bio, chunk);
                 goto out_unlock;
@@ -1077,7 +1627,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
                                 goto out_unlock;
                         }
 
-                        e = lookup_exception(&s->complete, chunk);
+                        e = dm_lookup_exception(&s->complete, chunk);
                         if (e) {
                                 free_pending_exception(pe);
                                 remap_exception(s, e, bio, chunk);
@@ -1115,6 +1665,78 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
         return r;
 }
 
+/*
+ * A snapshot-merge target behaves like a combination of a snapshot
+ * target and a snapshot-origin target.  It only generates new
+ * exceptions in other snapshots and not in the one that is being
+ * merged.
+ *
+ * For each chunk, if there is an existing exception, it is used to
+ * redirect I/O to the cow device.  Otherwise I/O is sent to the origin,
+ * which in turn might generate exceptions in other snapshots.
+ * If merging is currently taking place on the chunk in question, the
+ * I/O is deferred by adding it to s->bios_queued_during_merge.
+ */
+static int snapshot_merge_map(struct dm_target *ti, struct bio *bio,
+                              union map_info *map_context)
+{
+        struct dm_exception *e;
+        struct dm_snapshot *s = ti->private;
+        int r = DM_MAPIO_REMAPPED;
+        chunk_t chunk;
+
+        if (unlikely(bio_empty_barrier(bio))) {
+                if (!map_context->flush_request)
+                        bio->bi_bdev = s->origin->bdev;
+                else
+                        bio->bi_bdev = s->cow->bdev;
+                map_context->ptr = NULL;
+                return DM_MAPIO_REMAPPED;
+        }
+
+        chunk = sector_to_chunk(s->store, bio->bi_sector);
+
+        down_write(&s->lock);
+
+        /* Full merging snapshots are redirected to the origin */
+        if (!s->valid)
+                goto redirect_to_origin;
+
+        /* If the block is already remapped - use that */
+        e = dm_lookup_exception(&s->complete, chunk);
+        if (e) {
+                /* Queue writes overlapping with chunks being merged */
+                if (bio_rw(bio) == WRITE &&
+                    chunk >= s->first_merging_chunk &&
+                    chunk < (s->first_merging_chunk +
+                             s->num_merging_chunks)) {
+                        bio->bi_bdev = s->origin->bdev;
+                        bio_list_add(&s->bios_queued_during_merge, bio);
+                        r = DM_MAPIO_SUBMITTED;
+                        goto out_unlock;
+                }
+
+                remap_exception(s, e, bio, chunk);
+
+                if (bio_rw(bio) == WRITE)
+                        map_context->ptr = track_chunk(s, chunk);
+                goto out_unlock;
+        }
+
+redirect_to_origin:
+        bio->bi_bdev = s->origin->bdev;
+
+        if (bio_rw(bio) == WRITE) {
+                up_write(&s->lock);
+                return do_origin(s->origin, bio);
+        }
+
+out_unlock:
+        up_write(&s->lock);
+
+        return r;
+}
+
 static int snapshot_end_io(struct dm_target *ti, struct bio *bio,
                            int error, union map_info *map_context)
 {
@@ -1127,15 +1749,101 @@ static int snapshot_end_io(struct dm_target *ti, struct bio *bio,
         return 0;
 }
 
+static void snapshot_merge_presuspend(struct dm_target *ti)
+{
+        struct dm_snapshot *s = ti->private;
+
+        stop_merge(s);
+}
+
+static void snapshot_postsuspend(struct dm_target *ti)
+{
+        struct dm_snapshot *s = ti->private;
+
+        down_write(&s->lock);
+        s->suspended = 1;
+        up_write(&s->lock);
+}
+
+static int snapshot_preresume(struct dm_target *ti)
+{
+        int r = 0;
+        struct dm_snapshot *s = ti->private;
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+
+        down_read(&_origins_lock);
+        (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+        if (snap_src && snap_dest) {
+                down_read(&snap_src->lock);
+                if (s == snap_src) {
+                        DMERR("Unable to resume snapshot source until "
+                              "handover completes.");
+                        r = -EINVAL;
+                } else if (!snap_src->suspended) {
+                        DMERR("Unable to perform snapshot handover until "
+                              "source is suspended.");
+                        r = -EINVAL;
+                }
+                up_read(&snap_src->lock);
+        }
+        up_read(&_origins_lock);
+
+        return r;
+}
+
 static void snapshot_resume(struct dm_target *ti)
 {
         struct dm_snapshot *s = ti->private;
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+
+        down_read(&_origins_lock);
+        (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+        if (snap_src && snap_dest) {
+                down_write(&snap_src->lock);
+                down_write_nested(&snap_dest->lock, SINGLE_DEPTH_NESTING);
+                __handover_exceptions(snap_src, snap_dest);
+                up_write(&snap_dest->lock);
+                up_write(&snap_src->lock);
+        }
+        up_read(&_origins_lock);
+
+        /* Now we have correct chunk size, reregister */
+        reregister_snapshot(s);
 
         down_write(&s->lock);
         s->active = 1;
+        s->suspended = 0;
         up_write(&s->lock);
 }
 
+static sector_t get_origin_minimum_chunksize(struct block_device *bdev)
+{
+        sector_t min_chunksize;
+
+        down_read(&_origins_lock);
+        min_chunksize = __minimum_chunk_size(__lookup_origin(bdev));
+        up_read(&_origins_lock);
+
+        return min_chunksize;
+}
+
+static void snapshot_merge_resume(struct dm_target *ti)
+{
+        struct dm_snapshot *s = ti->private;
+
+        /*
+         * Handover exceptions from existing snapshot.
+         */
+        snapshot_resume(ti);
+
+        /*
+         * snapshot-merge acts as an origin, so set ti->split_io
+         */
+        ti->split_io = get_origin_minimum_chunksize(s->origin->bdev);
+
+        start_merge(s);
+}
+
 static int snapshot_status(struct dm_target *ti, status_type_t type,
                            char *result, unsigned int maxlen)
 {
@@ -1144,21 +1852,32 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
 
         switch (type) {
         case STATUSTYPE_INFO:
+
+                down_write(&snap->lock);
+
                 if (!snap->valid)
                         DMEMIT("Invalid");
+                else if (snap->merge_failed)
+                        DMEMIT("Merge failed");
                 else {
-                        if (snap->store->type->fraction_full) {
-                                sector_t numerator, denominator;
-                                snap->store->type->fraction_full(snap->store,
-                                                                 &numerator,
-                                                                 &denominator);
-                                DMEMIT("%llu/%llu",
-                                       (unsigned long long)numerator,
-                                       (unsigned long long)denominator);
+                        if (snap->store->type->usage) {
+                                sector_t total_sectors, sectors_allocated,
+                                         metadata_sectors;
+                                snap->store->type->usage(snap->store,
+                                                         &total_sectors,
+                                                         &sectors_allocated,
+                                                         &metadata_sectors);
+                                DMEMIT("%llu/%llu %llu",
+                                       (unsigned long long)sectors_allocated,
+                                       (unsigned long long)total_sectors,
+                                       (unsigned long long)metadata_sectors);
                         }
                         else
                                 DMEMIT("Unknown");
                 }
+
+                up_write(&snap->lock);
+
                 break;
 
         case STATUSTYPE_TABLE:
@@ -1167,7 +1886,7 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
                  * to make private copies if the output is to
                  * make sense.
                  */
-                DMEMIT("%s", snap->origin->name);
+                DMEMIT("%s %s", snap->origin->name, snap->cow->name);
                 snap->store->type->status(snap->store, type, result + sz,
                                           maxlen - sz);
                 break;
@@ -1188,17 +1907,36 @@ static int snapshot_iterate_devices(struct dm_target *ti,
 /*-----------------------------------------------------------------
  * Origin methods
  *---------------------------------------------------------------*/
-static int __origin_write(struct list_head *snapshots, struct bio *bio)
+
+/*
+ * If no exceptions need creating, DM_MAPIO_REMAPPED is returned and any
+ * supplied bio was ignored.  The caller may submit it immediately.
+ * (No remapping actually occurs as the origin is always a direct linear
+ * map.)
+ *
+ * If further exceptions are required, DM_MAPIO_SUBMITTED is returned
+ * and any supplied bio is added to a list to be submitted once all
+ * the necessary exceptions exist.
+ */
+static int __origin_write(struct list_head *snapshots, sector_t sector,
+                          struct bio *bio)
 {
-        int r = DM_MAPIO_REMAPPED, first = 0;
+        int r = DM_MAPIO_REMAPPED;
         struct dm_snapshot *snap;
-        struct dm_snap_exception *e;
-        struct dm_snap_pending_exception *pe, *next_pe, *primary_pe = NULL;
+        struct dm_exception *e;
+        struct dm_snap_pending_exception *pe;
+        struct dm_snap_pending_exception *pe_to_start_now = NULL;
+        struct dm_snap_pending_exception *pe_to_start_last = NULL;
         chunk_t chunk;
-        LIST_HEAD(pe_queue);
 
         /* Do all the snapshots on this origin */
         list_for_each_entry (snap, snapshots, list) {
+                /*
+                 * Don't make new exceptions in a merging snapshot
+                 * because it has effectively been deleted
+                 */
+                if (dm_target_is_snapshot_merge(snap->ti))
+                        continue;
 
                 down_write(&snap->lock);
 
@@ -1207,24 +1945,21 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
                         goto next_snapshot;
 
                 /* Nothing to do if writing beyond end of snapshot */
-                if (bio->bi_sector >= dm_table_get_size(snap->store->ti->table))
+                if (sector >= dm_table_get_size(snap->ti->table))
                         goto next_snapshot;
 
                 /*
                  * Remember, different snapshots can have
                  * different chunk sizes.
                  */
-                chunk = sector_to_chunk(snap->store, bio->bi_sector);
+                chunk = sector_to_chunk(snap->store, sector);
 
                 /*
                  * Check exception table to see if block
                  * is already remapped in this snapshot
                  * and trigger an exception if not.
-                 *
-                 * ref_count is initialised to 1 so pending_complete()
-                 * won't destroy the primary_pe while we're inside this loop.
                  */
-                e = lookup_exception(&snap->complete, chunk);
+                e = dm_lookup_exception(&snap->complete, chunk);
                 if (e)
                         goto next_snapshot;
 
@@ -1239,7 +1974,7 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
                                 goto next_snapshot;
                         }
 
-                        e = lookup_exception(&snap->complete, chunk);
+                        e = dm_lookup_exception(&snap->complete, chunk);
                         if (e) {
                                 free_pending_exception(pe);
                                 goto next_snapshot;
@@ -1252,59 +1987,43 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
                         }
                 }
 
-                if (!primary_pe) {
-                        /*
-                         * Either every pe here has same
-                         * primary_pe or none has one yet.
-                         */
-                        if (pe->primary_pe)
-                                primary_pe = pe->primary_pe;
-                        else {
-                                primary_pe = pe;
-                                first = 1;
-                        }
-
-                        bio_list_add(&primary_pe->origin_bios, bio);
+                r = DM_MAPIO_SUBMITTED;
 
-                        r = DM_MAPIO_SUBMITTED;
-                }
+                /*
+                 * If an origin bio was supplied, queue it to wait for the
+                 * completion of this exception, and start this one last,
+                 * at the end of the function.
+                 */
+                if (bio) {
+                        bio_list_add(&pe->origin_bios, bio);
+                        bio = NULL;
 
-                if (!pe->primary_pe) {
-                        pe->primary_pe = primary_pe;
-                        get_pending_exception(primary_pe);
+                        if (!pe->started) {
+                                pe->started = 1;
+                                pe_to_start_last = pe;
+                        }
                 }
 
                 if (!pe->started) {
                         pe->started = 1;
-                        list_add_tail(&pe->list, &pe_queue);
+                        pe_to_start_now = pe;
                 }
 
  next_snapshot:
                 up_write(&snap->lock);
-        }
-
-        if (!primary_pe)
-                return r;
-
-        /*
-         * If this is the first time we're processing this chunk and
-         * ref_count is now 1 it means all the pending exceptions
-         * got completed while we were in the loop above, so it falls to
-         * us here to remove the primary_pe and submit any origin_bios.
-         */
 
-        if (first && atomic_dec_and_test(&primary_pe->ref_count)) {
-                flush_bios(bio_list_get(&primary_pe->origin_bios));
-                free_pending_exception(primary_pe);
-                /* If we got here, pe_queue is necessarily empty. */
-                return r;
+                if (pe_to_start_now) {
+                        start_copy(pe_to_start_now);
+                        pe_to_start_now = NULL;
+                }
         }
 
         /*
-         * Now that we have a complete pe list we can start the copying.
+         * Submit the exception against which the bio is queued last,
+         * to give the other exceptions a head start.
          */
-        list_for_each_entry_safe(pe, next_pe, &pe_queue, list)
-                start_copy(pe);
+        if (pe_to_start_last)
+                start_copy(pe_to_start_last);
 
         return r;
 }
@@ -1320,13 +2039,48 @@ static int do_origin(struct dm_dev *origin, struct bio *bio)
         down_read(&_origins_lock);
         o = __lookup_origin(origin->bdev);
         if (o)
-                r = __origin_write(&o->snapshots, bio);
+                r = __origin_write(&o->snapshots, bio->bi_sector, bio);
         up_read(&_origins_lock);
 
         return r;
 }
 
 /*
+ * Trigger exceptions in all non-merging snapshots.
+ *
+ * The chunk size of the merging snapshot may be larger than the chunk
+ * size of some other snapshot so we may need to reallocate multiple
+ * chunks in other snapshots.
+ *
+ * We scan all the overlapping exceptions in the other snapshots.
+ * Returns 1 if anything was reallocated and must be waited for,
+ * otherwise returns 0.
+ *
+ * size must be a multiple of merging_snap's chunk_size.
+ */
+static int origin_write_extent(struct dm_snapshot *merging_snap,
+                               sector_t sector, unsigned size)
+{
+        int must_wait = 0;
+        sector_t n;
+        struct origin *o;
+
+        /*
+         * The origin's __minimum_chunk_size() got stored in split_io
+         * by snapshot_merge_resume().
+         */
+        down_read(&_origins_lock);
+        o = __lookup_origin(merging_snap->origin->bdev);
+        for (n = 0; n < size; n += merging_snap->ti->split_io)
+                if (__origin_write(&o->snapshots, sector + n, NULL) ==
+                    DM_MAPIO_SUBMITTED)
+                        must_wait = 1;
+        up_read(&_origins_lock);
+
+        return must_wait;
+}
+
+/*
  * Origin: maps a linear range of a device, with hooks for snapshotting.
  */
 
@@ -1345,8 +2099,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 return -EINVAL;
         }
 
-        r = dm_get_device(ti, argv[0], 0, ti->len,
-                          dm_table_get_mode(ti->table), &dev);
+        r = dm_get_device(ti, argv[0], dm_table_get_mode(ti->table), &dev);
         if (r) {
                 ti->error = "Cannot get target device";
                 return r;
@@ -1377,8 +2130,6 @@ static int origin_map(struct dm_target *ti, struct bio *bio,
         return (bio_rw(bio) == WRITE) ? do_origin(dev, bio) : DM_MAPIO_REMAPPED;
 }
 
-#define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
-
 /*
  * Set the target "split_io" field to the minimum of all the snapshots'
  * chunk sizes.
@@ -1386,19 +2137,8 @@ static int origin_map(struct dm_target *ti, struct bio *bio,
 static void origin_resume(struct dm_target *ti)
 {
         struct dm_dev *dev = ti->private;
-        struct dm_snapshot *snap;
-        struct origin *o;
-        chunk_t chunk_size = 0;
 
-        down_read(&_origins_lock);
-        o = __lookup_origin(dev->bdev);
-        if (o)
-                list_for_each_entry (snap, &o->snapshots, list)
-                        chunk_size = min_not_zero(chunk_size,
-                                                  snap->store->chunk_size);
-        up_read(&_origins_lock);
-
-        ti->split_io = chunk_size;
+        ti->split_io = get_origin_minimum_chunksize(dev->bdev);
 }
 
 static int origin_status(struct dm_target *ti, status_type_t type, char *result,
@@ -1441,17 +2181,35 @@ static struct target_type origin_target = {
 
 static struct target_type snapshot_target = {
         .name    = "snapshot",
-        .version = {1, 7, 0},
+        .version = {1, 9, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
         .map     = snapshot_map,
         .end_io  = snapshot_end_io,
+        .postsuspend = snapshot_postsuspend,
+        .preresume  = snapshot_preresume,
         .resume  = snapshot_resume,
         .status  = snapshot_status,
         .iterate_devices = snapshot_iterate_devices,
 };
 
+static struct target_type merge_target = {
+        .name    = dm_snapshot_merge_target_name,
+        .version = {1, 0, 0},
+        .module  = THIS_MODULE,
+        .ctr     = snapshot_ctr,
+        .dtr     = snapshot_dtr,
+        .map     = snapshot_merge_map,
+        .end_io  = snapshot_end_io,
+        .presuspend = snapshot_merge_presuspend,
+        .postsuspend = snapshot_postsuspend,
+        .preresume  = snapshot_preresume,
+        .resume  = snapshot_merge_resume,
+        .status  = snapshot_status,
+        .iterate_devices = snapshot_iterate_devices,
+};
+
 static int __init dm_snapshot_init(void)
 {
         int r;
@@ -1463,42 +2221,48 @@ static int __init dm_snapshot_init(void)
         }
 
         r = dm_register_target(&snapshot_target);
-        if (r) {
+        if (r < 0) {
                 DMERR("snapshot target register failed %d", r);
-                return r;
+                goto bad_register_snapshot_target;
         }
 
         r = dm_register_target(&origin_target);
         if (r < 0) {
                 DMERR("Origin target register failed %d", r);
-                goto bad1;
+                goto bad_register_origin_target;
+        }
+
+        r = dm_register_target(&merge_target);
+        if (r < 0) {
+                DMERR("Merge target register failed %d", r);
+                goto bad_register_merge_target;
         }
 
         r = init_origin_hash();
         if (r) {
                 DMERR("init_origin_hash failed.");
-                goto bad2;
+                goto bad_origin_hash;
         }
 
-        exception_cache = KMEM_CACHE(dm_snap_exception, 0);
+        exception_cache = KMEM_CACHE(dm_exception, 0);
         if (!exception_cache) {
                 DMERR("Couldn't create exception cache.");
                 r = -ENOMEM;
-                goto bad3;
+                goto bad_exception_cache;
         }
 
         pending_cache = KMEM_CACHE(dm_snap_pending_exception, 0);
         if (!pending_cache) {
                 DMERR("Couldn't create pending cache.");
                 r = -ENOMEM;
-                goto bad4;
+                goto bad_pending_cache;
         }
 
         tracked_chunk_cache = KMEM_CACHE(dm_snap_tracked_chunk, 0);
         if (!tracked_chunk_cache) {
                 DMERR("Couldn't create cache to track chunks in use.");
                 r = -ENOMEM;
-                goto bad5;
+                goto bad_tracked_chunk_cache;
         }
 
         ksnapd = create_singlethread_workqueue("ksnapd");
@@ -1512,16 +2276,21 @@ static int __init dm_snapshot_init(void)
 
 bad_pending_pool:
         kmem_cache_destroy(tracked_chunk_cache);
-bad5:
+bad_tracked_chunk_cache:
         kmem_cache_destroy(pending_cache);
-bad4:
+bad_pending_cache:
         kmem_cache_destroy(exception_cache);
-bad3:
+bad_exception_cache:
         exit_origin_hash();
-bad2:
+bad_origin_hash:
+        dm_unregister_target(&merge_target);
+bad_register_merge_target:
         dm_unregister_target(&origin_target);
-bad1:
+bad_register_origin_target:
         dm_unregister_target(&snapshot_target);
+bad_register_snapshot_target:
+        dm_exception_store_exit();
+
         return r;
 }
 
@@ -1531,6 +2300,7 @@ static void __exit dm_snapshot_exit(void)
 
         dm_unregister_target(&snapshot_target);
         dm_unregister_target(&origin_target);
+        dm_unregister_target(&merge_target);
 
         exit_origin_hash();
         kmem_cache_destroy(pending_cache);
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index e0efc1adcaff..e610725db766 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -80,8 +80,7 @@ static int get_stripe(struct dm_target *ti, struct stripe_c *sc,
         if (sscanf(argv[1], "%llu", &start) != 1)
                 return -EINVAL;
 
-        if (dm_get_device(ti, argv[0], start, sc->stripe_width,
-                          dm_table_get_mode(ti->table),
+        if (dm_get_device(ti, argv[0], dm_table_get_mode(ti->table),
                           &sc->stripe[stripe].dev))
                 return -ENXIO;
 
@@ -110,7 +109,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
 
         stripes = simple_strtoul(argv[0], &end, 10);
-        if (*end) {
+        if (!stripes || *end) {
                 ti->error = "Invalid stripe count";
                 return -EINVAL;
         }
diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
index 4b045903a4e2..84d2b91e4efb 100644
--- a/drivers/md/dm-sysfs.c
+++ b/drivers/md/dm-sysfs.c
@@ -59,7 +59,7 @@ static ssize_t dm_attr_uuid_show(struct mapped_device *md, char *buf)
 
 static ssize_t dm_attr_suspended_show(struct mapped_device *md, char *buf)
 {
-        sprintf(buf, "%d\n", dm_suspended(md));
+        sprintf(buf, "%d\n", dm_suspended_md(md));
 
         return strlen(buf);
 }
@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
         NULL,
 };
 
-static struct sysfs_ops dm_sysfs_ops = {
+static const struct sysfs_ops dm_sysfs_ops = {
         .show   = dm_attr_show,
 };
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 1a6cb3c7822e..9924ea23032d 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -12,6 +12,7 @@
 #include <linux/blkdev.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/mutex.h>
@@ -237,6 +238,9 @@ void dm_table_destroy(struct dm_table *t)
 {
         unsigned int i;
 
+        if (!t)
+                return;
+
         while (atomic_read(&t->holders))
                 msleep(1);
         smp_mb();
@@ -425,8 +429,7 @@ static int upgrade_mode(struct dm_dev_internal *dd, fmode_t new_mode,
  * it's already present.
  */
 static int __table_get_device(struct dm_table *t, struct dm_target *ti,
-                              const char *path, sector_t start, sector_t len,
-                              fmode_t mode, struct dm_dev **result)
+                      const char *path, fmode_t mode, struct dm_dev **result)
 {
         int r;
         dev_t uninitialized_var(dev);
@@ -499,16 +502,15 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
                 return 0;
         }
 
-        if (blk_stack_limits(limits, &q->limits, start << 9) < 0)
-                DMWARN("%s: target device %s is misaligned: "
+        if (bdev_stack_limits(limits, bdev, start) < 0)
+                DMWARN("%s: adding target device %s caused an alignment inconsistency: "
                        "physical_block_size=%u, logical_block_size=%u, "
                        "alignment_offset=%u, start=%llu",
                        dm_device_name(ti->table->md), bdevname(bdev, b),
                        q->limits.physical_block_size,
                        q->limits.logical_block_size,
                        q->limits.alignment_offset,
-                       (unsigned long long) start << 9);
-
+                       (unsigned long long) start << SECTOR_SHIFT);
 
         /*
          * Check if merge fn is supported.
@@ -524,11 +526,10 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
 }
 EXPORT_SYMBOL_GPL(dm_set_device_limits);
 
-int dm_get_device(struct dm_target *ti, const char *path, sector_t start,
-                  sector_t len, fmode_t mode, struct dm_dev **result)
+int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
+                  struct dm_dev **result)
 {
-        return __table_get_device(ti->table, ti, path,
-                                  start, len, mode, result);
+        return __table_get_device(ti->table, ti, path, mode, result);
 }
 
 
@@ -600,11 +601,8 @@ int dm_split_args(int *argc, char ***argvp, char *input)
                 return -ENOMEM;
 
         while (1) {
-                start = end;
-
                 /* Skip whitespace */
-                while (*start && isspace(*start))
-                        start++;
+                start = skip_spaces(end);
 
                 if (!*start)
                         break;  /* success, we hit the end */
@@ -1025,9 +1023,9 @@ combine_limits:
                  * for the table.
                  */
                 if (blk_stack_limits(limits, &ti_limits, 0) < 0)
-                        DMWARN("%s: target device "
+                        DMWARN("%s: adding target device "
                                "(start sect %llu len %llu) "
-                               "is misaligned",
+                               "caused an alignment inconsistency",
                                dm_device_name(table->md),
                                (unsigned long long) ti->begin,
                                (unsigned long long) ti->len);
@@ -1079,15 +1077,6 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
                                struct queue_limits *limits)
 {
         /*
-         * Each target device in the table has a data area that should normally
-         * be aligned such that the DM device's alignment_offset is 0.
-         * FIXME: Propagate alignment_offsets up the stack and warn of
-         *        sub-optimal or inconsistent settings.
-         */
-        limits->alignment_offset = 0;
-        limits->misaligned = 0;
-
-        /*
          * Copy table's limits to the DM device's request_queue
          */
         q->limits = *limits;
@@ -1240,8 +1229,6 @@ void dm_table_unplug_all(struct dm_table *t)
 
 struct mapped_device *dm_table_get_md(struct dm_table *t)
 {
-        dm_get(t->md);
-
         return t->md;
 }
 
diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
index 04feccf2a997..11dea11dc0b6 100644
--- a/drivers/md/dm-target.c
+++ b/drivers/md/dm-target.c
@@ -10,7 +10,6 @@
 #include <linux/init.h>
 #include <linux/kmod.h>
 #include <linux/bio.h>
-#include <linux/slab.h>
 
 #define DM_MSG_PREFIX "target"
 
diff --git a/drivers/md/dm-uevent.c b/drivers/md/dm-uevent.c
index 6f65883aef12..6b1e3b61b25e 100644
--- a/drivers/md/dm-uevent.c
+++ b/drivers/md/dm-uevent.c
@@ -139,14 +139,13 @@ void dm_send_uevents(struct list_head *events, struct kobject *kobj)
                 list_del_init(&event->elist);
 
                 /*
-                 * Need to call dm_copy_name_and_uuid from here for now.
-                 * Context of previous var adds and locking used for
-                 * hash_cell not compatable.
+                 * When a device is being removed this copy fails and we
+                 * discard these unsent events.
                  */
                 if (dm_copy_name_and_uuid(event->md, event->name,
                                           event->uuid)) {
-                        DMERR("%s: dm_copy_name_and_uuid() failed",
-                              __func__);
+                        DMINFO("%s: skipping sending uevent for lost device",
+                               __func__);
                         goto uevent_free;
                 }
 
@@ -188,7 +187,7 @@ void dm_path_uevent(enum dm_uevent_type event_type, struct dm_target *ti,
 
         if (event_type >= ARRAY_SIZE(_dm_uevent_type_names)) {
                 DMERR("%s: Invalid event_type %d", __func__, event_type);
-                goto out;
+                return;
         }
 
         event = dm_build_path_uevent(md, ti,
@@ -196,12 +195,9 @@ void dm_path_uevent(enum dm_uevent_type event_type, struct dm_target *ti,
                                      _dm_uevent_type_names[event_type].name,
                                      path, nr_valid_paths);
         if (IS_ERR(event))
-                goto out;
+                return;
 
         dm_uevent_add(md, &event->elist);
-
-out:
-        dm_put(md);
 }
 EXPORT_SYMBOL_GPL(dm_path_uevent);
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 376f1ab48a24..d21e1284604f 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -47,6 +47,7 @@ struct dm_io {
         atomic_t io_count;
         struct bio *bio;
         unsigned long start_time;
+        spinlock_t endio_lock;
 };
 
 /*
@@ -142,9 +143,19 @@ struct mapped_device {
         int barrier_error;
 
         /*
+         * Protect barrier_error from concurrent endio processing
+         * in request-based dm.
+         */
+        spinlock_t barrier_error_lock;
+
+        /*
          * Processing queue (flush/barriers)
          */
         struct workqueue_struct *wq;
+        struct work_struct barrier_work;
+
+        /* A pointer to the currently processing pre/post flush request */
+        struct request *flush_request;
 
         /*
          * The current mapping.
@@ -177,9 +188,6 @@ struct mapped_device {
         /* forced geometry settings */
         struct hd_geometry geometry;
 
-        /* marker of flush suspend for request-based dm */
-        struct request suspend_rq;
-
         /* For saving the address of __make_request for request based dm */
         make_request_fn *saved_make_request_fn;
 
@@ -274,6 +282,7 @@ static int (*_inits[])(void) __initdata = {
         dm_target_init,
         dm_linear_init,
         dm_stripe_init,
+        dm_io_init,
         dm_kcopyd_init,
         dm_interface_init,
 };
@@ -283,6 +292,7 @@ static void (*_exits[])(void) = {
         dm_target_exit,
         dm_linear_exit,
         dm_stripe_exit,
+        dm_io_exit,
         dm_kcopyd_exit,
         dm_interface_exit,
 };
@@ -319,6 +329,11 @@ static void __exit dm_exit(void)
 /*
  * Block device functions
  */
+int dm_deleting_md(struct mapped_device *md)
+{
+        return test_bit(DMF_DELETING, &md->flags);
+}
+
 static int dm_blk_open(struct block_device *bdev, fmode_t mode)
 {
         struct mapped_device *md;
@@ -330,7 +345,7 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
                 goto out;
 
         if (test_bit(DMF_FREEING, &md->flags) ||
-            test_bit(DMF_DELETING, &md->flags)) {
+            dm_deleting_md(md)) {
                 md = NULL;
                 goto out;
         }
@@ -387,7 +402,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
                         unsigned int cmd, unsigned long arg)
 {
         struct mapped_device *md = bdev->bd_disk->private_data;
-        struct dm_table *map = dm_get_table(md);
+        struct dm_table *map = dm_get_live_table(md);
         struct dm_target *tgt;
         int r = -ENOTTY;
 
@@ -400,7 +415,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 
         tgt = dm_table_get_target(map, 0);
 
-        if (dm_suspended(md)) {
+        if (dm_suspended_md(md)) {
                 r = -EAGAIN;
                 goto out;
         }
@@ -429,9 +444,10 @@ static void free_tio(struct mapped_device *md, struct dm_target_io *tio)
         mempool_free(tio, md->tio_pool);
 }
 
-static struct dm_rq_target_io *alloc_rq_tio(struct mapped_device *md)
+static struct dm_rq_target_io *alloc_rq_tio(struct mapped_device *md,
+                                            gfp_t gfp_mask)
 {
-        return mempool_alloc(md->tio_pool, GFP_ATOMIC);
+        return mempool_alloc(md->tio_pool, gfp_mask);
 }
 
 static void free_rq_tio(struct dm_rq_target_io *tio)
@@ -449,6 +465,12 @@ static void free_bio_info(struct dm_rq_clone_bio_info *info)
         mempool_free(info, info->tio->md->io_pool);
 }
 
+static int md_in_flight(struct mapped_device *md)
+{
+        return atomic_read(&md->pending[READ]) +
+               atomic_read(&md->pending[WRITE]);
+}
+
 static void start_io_acct(struct dm_io *io)
 {
         struct mapped_device *md = io->md;
@@ -511,7 +533,7 @@ static void queue_io(struct mapped_device *md, struct bio *bio)
  * function to access the md->map field, and make sure they call
  * dm_table_put() when finished.
  */
-struct dm_table *dm_get_table(struct mapped_device *md)
+struct dm_table *dm_get_live_table(struct mapped_device *md)
 {
         struct dm_table *t;
         unsigned long flags;
@@ -578,8 +600,12 @@ static void dec_pending(struct dm_io *io, int error)
         struct mapped_device *md = io->md;
 
         /* Push-back supersedes any I/O errors */
-        if (error && !(io->error > 0 && __noflush_suspending(md)))
-                io->error = error;
+        if (unlikely(error)) {
+                spin_lock_irqsave(&io->endio_lock, flags);
+                if (!(io->error > 0 && __noflush_suspending(md)))
+                        io->error = error;
+                spin_unlock_irqrestore(&io->endio_lock, flags);
+        }
 
         if (atomic_dec_and_test(&io->io_count)) {
                 if (io->error == DM_ENDIO_REQUEUE) {
@@ -609,8 +635,10 @@ static void dec_pending(struct dm_io *io, int error)
                         if (!md->barrier_error && io_error != -EOPNOTSUPP)
                                 md->barrier_error = io_error;
                         end_io_acct(io);
+                        free_io(md, io);
                 } else {
                         end_io_acct(io);
+                        free_io(md, io);
 
                         if (io_error != DM_ENDIO_REQUEUE) {
                                 trace_block_bio_complete(md->queue, bio);
@@ -618,8 +646,6 @@ static void dec_pending(struct dm_io *io, int error)
                                 bio_endio(bio, io_error);
                         }
                 }
-
-                free_io(md, io);
         }
 }
 
@@ -711,28 +737,38 @@ static void end_clone_bio(struct bio *clone, int error)
         blk_update_request(tio->orig, 0, nr_bytes);
 }
 
+static void store_barrier_error(struct mapped_device *md, int error)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&md->barrier_error_lock, flags);
+        /*
+         * Basically, the first error is taken, but:
+         *   -EOPNOTSUPP supersedes any I/O error.
+         *   Requeue request supersedes any I/O error but -EOPNOTSUPP.
+         */
+        if (!md->barrier_error || error == -EOPNOTSUPP ||
+            (md->barrier_error != -EOPNOTSUPP &&
+             error == DM_ENDIO_REQUEUE))
+                md->barrier_error = error;
+        spin_unlock_irqrestore(&md->barrier_error_lock, flags);
+}
+
 /*
  * Don't touch any member of the md after calling this function because
  * the md may be freed in dm_put() at the end of this function.
  * Or do dm_get() before calling this function and dm_put() later.
  */
-static void rq_completed(struct mapped_device *md, int run_queue)
+static void rq_completed(struct mapped_device *md, int rw, int run_queue)
 {
-        int wakeup_waiters = 0;
-        struct request_queue *q = md->queue;
-        unsigned long flags;
-
-        spin_lock_irqsave(q->queue_lock, flags);
-        if (!queue_in_flight(q))
-                wakeup_waiters = 1;
-        spin_unlock_irqrestore(q->queue_lock, flags);
+        atomic_dec(&md->pending[rw]);
 
         /* nudge anyone waiting on suspend queue */
-        if (wakeup_waiters)
+        if (!md_in_flight(md))
                 wake_up(&md->wait);
 
         if (run_queue)
-                blk_run_queue(q);
+                blk_run_queue(md->queue);
 
         /*
          * dm_put() must be at the end of this function. See the comment above
@@ -748,6 +784,44 @@ static void free_rq_clone(struct request *clone)
         free_rq_tio(tio);
 }
 
+/*
+ * Complete the clone and the original request.
+ * Must be called without queue lock.
+ */
+static void dm_end_request(struct request *clone, int error)
+{
+        int rw = rq_data_dir(clone);
+        int run_queue = 1;
+        bool is_barrier = blk_barrier_rq(clone);
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        struct mapped_device *md = tio->md;
+        struct request *rq = tio->orig;
+
+        if (blk_pc_request(rq) && !is_barrier) {
+                rq->errors = clone->errors;
+                rq->resid_len = clone->resid_len;
+
+                if (rq->sense)
+                        /*
+                         * We are using the sense buffer of the original
+                         * request.
+                         * So setting the length of the sense data is enough.
+                         */
+                        rq->sense_len = clone->sense_len;
+        }
+
+        free_rq_clone(clone);
+
+        if (unlikely(is_barrier)) {
+                if (unlikely(error))
+                        store_barrier_error(md, error);
+                run_queue = 0;
+        } else
+                blk_end_request_all(rq, error);
+
+        rq_completed(md, rw, run_queue);
+}
+
 static void dm_unprep_request(struct request *rq)
 {
         struct request *clone = rq->special;
@@ -763,12 +837,23 @@ static void dm_unprep_request(struct request *rq)
  */
 void dm_requeue_unmapped_request(struct request *clone)
 {
+        int rw = rq_data_dir(clone);
         struct dm_rq_target_io *tio = clone->end_io_data;
         struct mapped_device *md = tio->md;
         struct request *rq = tio->orig;
         struct request_queue *q = rq->q;
         unsigned long flags;
 
+        if (unlikely(blk_barrier_rq(clone))) {
+                /*
+                 * Barrier clones share an original request.
+                 * Leave it to dm_end_request(), which handles this special
+                 * case.
+                 */
+                dm_end_request(clone, DM_ENDIO_REQUEUE);
+                return;
+        }
+
         dm_unprep_request(rq);
 
         spin_lock_irqsave(q->queue_lock, flags);
@@ -777,7 +862,7 @@ void dm_requeue_unmapped_request(struct request *clone)
         blk_requeue_request(q, rq);
         spin_unlock_irqrestore(q->queue_lock, flags);
 
-        rq_completed(md, 0);
+        rq_completed(md, rw, 0);
 }
 EXPORT_SYMBOL_GPL(dm_requeue_unmapped_request);
 
@@ -810,34 +895,28 @@ static void start_queue(struct request_queue *q)
         spin_unlock_irqrestore(q->queue_lock, flags);
 }
 
-/*
- * Complete the clone and the original request.
- * Must be called without queue lock.
- */
-static void dm_end_request(struct request *clone, int error)
+static void dm_done(struct request *clone, int error, bool mapped)
 {
+        int r = error;
         struct dm_rq_target_io *tio = clone->end_io_data;
-        struct mapped_device *md = tio->md;
-        struct request *rq = tio->orig;
+        dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
 
-        if (blk_pc_request(rq)) {
-                rq->errors = clone->errors;
-                rq->resid_len = clone->resid_len;
+        if (mapped && rq_end_io)
+                r = rq_end_io(tio->ti, clone, error, &tio->info);
 
-                if (rq->sense)
-                        /*
-                         * We are using the sense buffer of the original
-                         * request.
-                         * So setting the length of the sense data is enough.
-                         */
-                        rq->sense_len = clone->sense_len;
+        if (r <= 0)
+                /* The target wants to complete the I/O */
+                dm_end_request(clone, r);
+        else if (r == DM_ENDIO_INCOMPLETE)
+                /* The target will handle the I/O */
+                return;
+        else if (r == DM_ENDIO_REQUEUE)
+                /* The target wants to requeue the I/O */
+                dm_requeue_unmapped_request(clone);
+        else {
+                DMWARN("unimplemented target endio return value: %d", r);
+                BUG();
         }
-
-        free_rq_clone(clone);
-
-        blk_end_request_all(rq, error);
-
-        rq_completed(md, 1);
 }
 
 /*
@@ -845,27 +924,14 @@ static void dm_end_request(struct request *clone, int error)
  */
 static void dm_softirq_done(struct request *rq)
 {
+        bool mapped = true;
         struct request *clone = rq->completion_data;
         struct dm_rq_target_io *tio = clone->end_io_data;
-        dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
-        int error = tio->error;
 
-        if (!(rq->cmd_flags & REQ_FAILED) && rq_end_io)
-                error = rq_end_io(tio->ti, clone, error, &tio->info);
+        if (rq->cmd_flags & REQ_FAILED)
+                mapped = false;
 
-        if (error <= 0)
-                /* The target wants to complete the I/O */
-                dm_end_request(clone, error);
-        else if (error == DM_ENDIO_INCOMPLETE)
-                /* The target will handle the I/O */
-                return;
-        else if (error == DM_ENDIO_REQUEUE)
-                /* The target wants to requeue the I/O */
-                dm_requeue_unmapped_request(clone);
-        else {
-                DMWARN("unimplemented target endio return value: %d", error);
-                BUG();
-        }
+        dm_done(clone, tio->error, mapped);
 }
 
 /*
@@ -877,6 +943,19 @@ static void dm_complete_request(struct request *clone, int error)
         struct dm_rq_target_io *tio = clone->end_io_data;
         struct request *rq = tio->orig;
 
+        if (unlikely(blk_barrier_rq(clone))) {
+                /*
+                 * Barrier clones share an original request.  So can't use
+                 * softirq_done with the original.
+                 * Pass the clone to dm_done() directly in this special case.
+                 * It is safe (even if clone->q->queue_lock is held here)
+                 * because there is no I/O dispatching during the completion
+                 * of barrier clone.
+                 */
+                dm_done(clone, error, true);
+                return;
+        }
+
         tio->error = error;
         rq->completion_data = clone;
         blk_complete_request(rq);
@@ -893,6 +972,17 @@ void dm_kill_unmapped_request(struct request *clone, int error)
         struct dm_rq_target_io *tio = clone->end_io_data;
         struct request *rq = tio->orig;
 
+        if (unlikely(blk_barrier_rq(clone))) {
+                /*
+                 * Barrier clones share an original request.
+                 * Leave it to dm_end_request(), which handles this special
+                 * case.
+                 */
+                BUG_ON(error > 0);
+                dm_end_request(clone, error);
+                return;
+        }
+
         rq->cmd_flags |= REQ_FAILED;
         dm_complete_request(clone, error);
 }
@@ -1209,7 +1299,7 @@ static void __split_and_process_bio(struct mapped_device *md, struct bio *bio)
         struct clone_info ci;
         int error = 0;
 
-        ci.map = dm_get_table(md);
+        ci.map = dm_get_live_table(md);
         if (unlikely(!ci.map)) {
                 if (!bio_rw_flagged(bio, BIO_RW_BARRIER))
                         bio_io_error(bio);
@@ -1226,6 +1316,7 @@ static void __split_and_process_bio(struct mapped_device *md, struct bio *bio)
         atomic_set(&ci.io->io_count, 1);
         ci.io->bio = bio;
         ci.io->md = md;
+        spin_lock_init(&ci.io->endio_lock);
         ci.sector = bio->bi_sector;
         ci.sector_count = bio_sectors(bio);
         if (unlikely(bio_empty_barrier(bio)))
@@ -1249,7 +1340,7 @@ static int dm_merge_bvec(struct request_queue *q,
                          struct bio_vec *biovec)
 {
         struct mapped_device *md = q->queuedata;
-        struct dm_table *map = dm_get_table(md);
+        struct dm_table *map = dm_get_live_table(md);
         struct dm_target *ti;
         sector_t max_sectors;
         int max_size = 0;
@@ -1346,11 +1437,6 @@ static int dm_make_request(struct request_queue *q, struct bio *bio)
 {
         struct mapped_device *md = q->queuedata;
 
-        if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-                bio_endio(bio, -EOPNOTSUPP);
-                return 0;
-        }
-
         return md->saved_make_request_fn(q, bio); /* call __make_request() */
 }
 
@@ -1369,6 +1455,25 @@ static int dm_request(struct request_queue *q, struct bio *bio)
         return _dm_request(q, bio);
 }
 
+/*
+ * Mark this request as flush request, so that dm_request_fn() can
+ * recognize.
+ */
+static void dm_rq_prepare_flush(struct request_queue *q, struct request *rq)
+{
+        rq->cmd_type = REQ_TYPE_LINUX_BLOCK;
+        rq->cmd[0] = REQ_LB_OP_FLUSH;
+}
+
+static bool dm_rq_is_flush_request(struct request *rq)
+{
+        if (rq->cmd_type == REQ_TYPE_LINUX_BLOCK &&
+            rq->cmd[0] == REQ_LB_OP_FLUSH)
+                return true;
+        else
+                return false;
+}
+
 void dm_dispatch_request(struct request *rq)
 {
         int r;
@@ -1414,25 +1519,54 @@ static int dm_rq_bio_constructor(struct bio *bio, struct bio *bio_orig,
 static int setup_clone(struct request *clone, struct request *rq,
                        struct dm_rq_target_io *tio)
 {
-        int r = blk_rq_prep_clone(clone, rq, tio->md->bs, GFP_ATOMIC,
-                                  dm_rq_bio_constructor, tio);
+        int r;
 
-        if (r)
-                return r;
+        if (dm_rq_is_flush_request(rq)) {
+                blk_rq_init(NULL, clone);
+                clone->cmd_type = REQ_TYPE_FS;
+                clone->cmd_flags |= (REQ_HARDBARRIER | WRITE);
+        } else {
+                r = blk_rq_prep_clone(clone, rq, tio->md->bs, GFP_ATOMIC,
+                                      dm_rq_bio_constructor, tio);
+                if (r)
+                        return r;
+
+                clone->cmd = rq->cmd;
+                clone->cmd_len = rq->cmd_len;
+                clone->sense = rq->sense;
+                clone->buffer = rq->buffer;
+        }
 
-        clone->cmd = rq->cmd;
-        clone->cmd_len = rq->cmd_len;
-        clone->sense = rq->sense;
-        clone->buffer = rq->buffer;
         clone->end_io = end_clone_request;
         clone->end_io_data = tio;
 
         return 0;
 }
 
-static int dm_rq_flush_suspending(struct mapped_device *md)
+static struct request *clone_rq(struct request *rq, struct mapped_device *md,
+                                gfp_t gfp_mask)
 {
-        return !md->suspend_rq.special;
+        struct request *clone;
+        struct dm_rq_target_io *tio;
+
+        tio = alloc_rq_tio(md, gfp_mask);
+        if (!tio)
+                return NULL;
+
+        tio->md = md;
+        tio->ti = NULL;
+        tio->orig = rq;
+        tio->error = 0;
+        memset(&tio->info, 0, sizeof(tio->info));
+
+        clone = &tio->clone;
+        if (setup_clone(clone, rq, tio)) {
+                /* -ENOMEM */
+                free_rq_tio(tio);
+                return NULL;
+        }
+
+        return clone;
 }
 
 /*
@@ -1441,51 +1575,35 @@ static int dm_rq_flush_suspending(struct mapped_device *md)
 static int dm_prep_fn(struct request_queue *q, struct request *rq)
 {
         struct mapped_device *md = q->queuedata;
-        struct dm_rq_target_io *tio;
         struct request *clone;
 
-        if (unlikely(rq == &md->suspend_rq)) {
-                if (dm_rq_flush_suspending(md))
-                        return BLKPREP_OK;
-                else
-                        /* The flush suspend was interrupted */
-                        return BLKPREP_KILL;
-        }
+        if (unlikely(dm_rq_is_flush_request(rq)))
+                return BLKPREP_OK;
 
         if (unlikely(rq->special)) {
                 DMWARN("Already has something in rq->special.");
                 return BLKPREP_KILL;
         }
 
-        tio = alloc_rq_tio(md); /* Only one for each original request */
-        if (!tio)
-                /* -ENOMEM */
+        clone = clone_rq(rq, md, GFP_ATOMIC);
+        if (!clone)
                 return BLKPREP_DEFER;
 
-        tio->md = md;
-        tio->ti = NULL;
-        tio->orig = rq;
-        tio->error = 0;
-        memset(&tio->info, 0, sizeof(tio->info));
-
-        clone = &tio->clone;
-        if (setup_clone(clone, rq, tio)) {
-                /* -ENOMEM */
-                free_rq_tio(tio);
-                return BLKPREP_DEFER;
-        }
-
         rq->special = clone;
         rq->cmd_flags |= REQ_DONTPREP;
 
         return BLKPREP_OK;
 }
 
-static void map_request(struct dm_target *ti, struct request *rq,
-                        struct mapped_device *md)
+/*
+ * Returns:
+ * 0  : the request has been processed (not requeued)
+ * !0 : the request has been requeued
+ */
+static int map_request(struct dm_target *ti, struct request *clone,
+                       struct mapped_device *md)
 {
-        int r;
-        struct request *clone = rq->special;
+        int r, requeued = 0;
         struct dm_rq_target_io *tio = clone->end_io_data;
 
         /*
@@ -1505,11 +1623,14 @@ static void map_request(struct dm_target *ti, struct request *rq,
                 break;
         case DM_MAPIO_REMAPPED:
                 /* The target has remapped the I/O so dispatch it */
+                trace_block_rq_remap(clone->q, clone, disk_devt(dm_disk(md)),
+                                     blk_rq_pos(tio->orig));
                 dm_dispatch_request(clone);
                 break;
         case DM_MAPIO_REQUEUE:
                 /* The target wants to requeue the I/O */
                 dm_requeue_unmapped_request(clone);
+                requeued = 1;
                 break;
         default:
                 if (r > 0) {
@@ -1521,6 +1642,8 @@ static void map_request(struct dm_target *ti, struct request *rq,
                 dm_kill_unmapped_request(clone, r);
                 break;
         }
+
+        return requeued;
 }
 
 /*
@@ -1530,29 +1653,26 @@ static void map_request(struct dm_target *ti, struct request *rq,
 static void dm_request_fn(struct request_queue *q)
 {
         struct mapped_device *md = q->queuedata;
-        struct dm_table *map = dm_get_table(md);
+        struct dm_table *map = dm_get_live_table(md);
         struct dm_target *ti;
-        struct request *rq;
+        struct request *rq, *clone;
 
         /*
-         * For noflush suspend, check blk_queue_stopped() to immediately
-         * quit I/O dispatching.
+         * For suspend, check blk_queue_stopped() and increment
+         * ->pending within a single queue_lock not to increment the
+         * number of in-flight I/Os after the queue is stopped in
+         * dm_suspend().
          */
         while (!blk_queue_plugged(q) && !blk_queue_stopped(q)) {
                 rq = blk_peek_request(q);
                 if (!rq)
                         goto plug_and_out;
 
-                if (unlikely(rq == &md->suspend_rq)) { /* Flush suspend maker */
-                        if (queue_in_flight(q))
-                                /* Not quiet yet.  Wait more */
-                                goto plug_and_out;
-
-                        /* This device should be quiet now */
-                        __stop_queue(q);
+                if (unlikely(dm_rq_is_flush_request(rq))) {
+                        BUG_ON(md->flush_request);
+                        md->flush_request = rq;
                         blk_start_request(rq);
-                        __blk_end_request_all(rq, 0);
-                        wake_up(&md->wait);
+                        queue_work(md->wq, &md->barrier_work);
                         goto out;
                 }
 
@@ -1561,13 +1681,21 @@ static void dm_request_fn(struct request_queue *q)
                         goto plug_and_out;
 
                 blk_start_request(rq);
+                clone = rq->special;
+                atomic_inc(&md->pending[rq_data_dir(clone)]);
+
                 spin_unlock(q->queue_lock);
-                map_request(ti, rq, md);
+                if (map_request(ti, clone, md))
+                        goto requeued;
+
                 spin_lock_irq(q->queue_lock);
         }
 
         goto out;
 
+requeued:
+        spin_lock_irq(q->queue_lock);
+
 plug_and_out:
         if (!elv_queue_empty(q))
                 /* Some requests still remain, retry later */
@@ -1589,7 +1717,7 @@ static int dm_lld_busy(struct request_queue *q)
 {
         int r;
         struct mapped_device *md = q->queuedata;
-        struct dm_table *map = dm_get_table(md);
+        struct dm_table *map = dm_get_live_table(md);
 
         if (!map || test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))
                 r = 1;
@@ -1604,7 +1732,7 @@ static int dm_lld_busy(struct request_queue *q)
 static void dm_unplug_all(struct request_queue *q)
 {
         struct mapped_device *md = q->queuedata;
-        struct dm_table *map = dm_get_table(md);
+        struct dm_table *map = dm_get_live_table(md);
 
         if (map) {
                 if (dm_request_based(md))
@@ -1622,7 +1750,7 @@ static int dm_any_congested(void *congested_data, int bdi_bits)
         struct dm_table *map;
 
         if (!test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) {
-                map = dm_get_table(md);
+                map = dm_get_live_table(md);
                 if (map) {
                         /*
                          * Request-based dm cares about only own queue for
@@ -1719,6 +1847,7 @@ out:
 static const struct block_device_operations dm_blk_dops;
 
 static void dm_wq_work(struct work_struct *work);
+static void dm_rq_barrier_work(struct work_struct *work);
 
 /*
  * Allocate and initialise a blank device with a given minor.
@@ -1748,6 +1877,7 @@ static struct mapped_device *alloc_dev(int minor)
         init_rwsem(&md->io_lock);
         mutex_init(&md->suspend_lock);
         spin_lock_init(&md->deferred_lock);
+        spin_lock_init(&md->barrier_error_lock);
         rwlock_init(&md->map_lock);
         atomic_set(&md->holders, 1);
         atomic_set(&md->open_count, 0);
@@ -1782,6 +1912,8 @@ static struct mapped_device *alloc_dev(int minor)
         blk_queue_softirq_done(md->queue, dm_softirq_done);
         blk_queue_prep_rq(md->queue, dm_prep_fn);
         blk_queue_lld_busy(md->queue, dm_lld_busy);
+        blk_queue_ordered(md->queue, QUEUE_ORDERED_DRAIN_FLUSH,
+                          dm_rq_prepare_flush);
 
         md->disk = alloc_disk(1);
         if (!md->disk)
@@ -1791,6 +1923,7 @@ static struct mapped_device *alloc_dev(int minor)
         atomic_set(&md->pending[1], 0);
         init_waitqueue_head(&md->wait);
         INIT_WORK(&md->work, dm_wq_work);
+        INIT_WORK(&md->barrier_work, dm_rq_barrier_work);
         init_waitqueue_head(&md->eventq);
 
         md->disk->major = _major;
@@ -1822,6 +1955,7 @@ static struct mapped_device *alloc_dev(int minor)
 bad_bdev:
         destroy_workqueue(md->wq);
 bad_thread:
+        del_gendisk(md->disk);
         put_disk(md->disk);
 bad_disk:
         blk_cleanup_queue(md->queue);
@@ -1914,9 +2048,13 @@ static void __set_size(struct mapped_device *md, sector_t size)
         mutex_unlock(&md->bdev->bd_inode->i_mutex);
 }
 
-static int __bind(struct mapped_device *md, struct dm_table *t,
-                  struct queue_limits *limits)
+/*
+ * Returns old map, which caller must destroy.
+ */
+static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t,
+                               struct queue_limits *limits)
 {
+        struct dm_table *old_map;
         struct request_queue *q = md->queue;
         sector_t size;
         unsigned long flags;
@@ -1931,11 +2069,6 @@ static int __bind(struct mapped_device *md, struct dm_table *t,
 
         __set_size(md, size);
 
-        if (!size) {
-                dm_table_destroy(t);
-                return 0;
-        }
-
         dm_table_event_callback(t, event_callback, md);
 
         /*
@@ -1951,26 +2084,31 @@ static int __bind(struct mapped_device *md, struct dm_table *t,
         __bind_mempools(md, t);
 
         write_lock_irqsave(&md->map_lock, flags);
+        old_map = md->map;
         md->map = t;
         dm_table_set_restrictions(t, q, limits);
         write_unlock_irqrestore(&md->map_lock, flags);
 
-        return 0;
+        return old_map;
 }
 
-static void __unbind(struct mapped_device *md)
+/*
+ * Returns unbound table for the caller to free.
+ */
+static struct dm_table *__unbind(struct mapped_device *md)
 {
         struct dm_table *map = md->map;
         unsigned long flags;
 
         if (!map)
-                return;
+                return NULL;
 
         dm_table_event_callback(map, NULL, NULL);
         write_lock_irqsave(&md->map_lock, flags);
         md->map = NULL;
         write_unlock_irqrestore(&md->map_lock, flags);
-        dm_table_destroy(map);
+
+        return map;
 }
 
 /*
@@ -2052,18 +2190,18 @@ void dm_put(struct mapped_device *md)
         BUG_ON(test_bit(DMF_FREEING, &md->flags));
 
         if (atomic_dec_and_lock(&md->holders, &_minor_lock)) {
-                map = dm_get_table(md);
+                map = dm_get_live_table(md);
                 idr_replace(&_minor_idr, MINOR_ALLOCED,
                             MINOR(disk_devt(dm_disk(md))));
                 set_bit(DMF_FREEING, &md->flags);
                 spin_unlock(&_minor_lock);
-                if (!dm_suspended(md)) {
+                if (!dm_suspended_md(md)) {
                         dm_table_presuspend_targets(map);
                         dm_table_postsuspend_targets(map);
                 }
                 dm_sysfs_exit(md);
                 dm_table_put(map);
-                __unbind(md);
+                dm_table_destroy(__unbind(md));
                 free_dev(md);
         }
 }
@@ -2073,8 +2211,6 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
 {
         int r = 0;
         DECLARE_WAITQUEUE(wait, current);
-        struct request_queue *q = md->queue;
-        unsigned long flags;
 
         dm_unplug_all(md->queue);
 
@@ -2084,15 +2220,7 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
                 set_current_state(interruptible);
 
                 smp_mb();
-                if (dm_request_based(md)) {
-                        spin_lock_irqsave(q->queue_lock, flags);
-                        if (!queue_in_flight(q) && blk_queue_stopped(q)) {
-                                spin_unlock_irqrestore(q->queue_lock, flags);
-                                break;
-                        }
-                        spin_unlock_irqrestore(q->queue_lock, flags);
-                } else if (!atomic_read(&md->pending[0]) &&
-                                        !atomic_read(&md->pending[1]))
+                if (!md_in_flight(md))
                         break;
 
                 if (interruptible == TASK_INTERRUPTIBLE &&
@@ -2187,98 +2315,106 @@ static void dm_queue_flush(struct mapped_device *md)
         queue_work(md->wq, &md->work);
 }
 
-/*
- * Swap in a new table (destroying old one).
- */
-int dm_swap_table(struct mapped_device *md, struct dm_table *table)
+static void dm_rq_set_flush_nr(struct request *clone, unsigned flush_nr)
 {
-        struct queue_limits limits;
-        int r = -EINVAL;
+        struct dm_rq_target_io *tio = clone->end_io_data;
 
-        mutex_lock(&md->suspend_lock);
+        tio->info.flush_request = flush_nr;
+}
 
-        /* device must be suspended */
-        if (!dm_suspended(md))
-                goto out;
+/* Issue barrier requests to targets and wait for their completion. */
+static int dm_rq_barrier(struct mapped_device *md)
+{
+        int i, j;
+        struct dm_table *map = dm_get_live_table(md);
+        unsigned num_targets = dm_table_get_num_targets(map);
+        struct dm_target *ti;
+        struct request *clone;
 
-        r = dm_calculate_queue_limits(table, &limits);
-        if (r)
-                goto out;
+        md->barrier_error = 0;
 
-        /* cannot change the device type, once a table is bound */
-        if (md->map &&
-            (dm_table_get_type(md->map) != dm_table_get_type(table))) {
-                DMWARN("can't change the device type after a table is bound");
-                goto out;
+        for (i = 0; i < num_targets; i++) {
+                ti = dm_table_get_target(map, i);
+                for (j = 0; j < ti->num_flush_requests; j++) {
+                        clone = clone_rq(md->flush_request, md, GFP_NOIO);
+                        dm_rq_set_flush_nr(clone, j);
+                        atomic_inc(&md->pending[rq_data_dir(clone)]);
+                        map_request(ti, clone, md);
+                }
         }
 
-        __unbind(md);
-        r = __bind(md, table, &limits);
-
-out:
-        mutex_unlock(&md->suspend_lock);
-        return r;
-}
+        dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
+        dm_table_put(map);
 
-static void dm_rq_invalidate_suspend_marker(struct mapped_device *md)
-{
-        md->suspend_rq.special = (void *)0x1;
+        return md->barrier_error;
 }
 
-static void dm_rq_abort_suspend(struct mapped_device *md, int noflush)
+static void dm_rq_barrier_work(struct work_struct *work)
 {
+        int error;
+        struct mapped_device *md = container_of(work, struct mapped_device,
+                                                barrier_work);
         struct request_queue *q = md->queue;
+        struct request *rq;
         unsigned long flags;
 
-        spin_lock_irqsave(q->queue_lock, flags);
-        if (!noflush)
-                dm_rq_invalidate_suspend_marker(md);
-        __start_queue(q);
-        spin_unlock_irqrestore(q->queue_lock, flags);
-}
+        /*
+         * Hold the md reference here and leave it at the last part so that
+         * the md can't be deleted by device opener when the barrier request
+         * completes.
+         */
+        dm_get(md);
 
-static void dm_rq_start_suspend(struct mapped_device *md, int noflush)
-{
-        struct request *rq = &md->suspend_rq;
-        struct request_queue *q = md->queue;
+        error = dm_rq_barrier(md);
 
-        if (noflush)
-                stop_queue(q);
-        else {
-                blk_rq_init(q, rq);
-                blk_insert_request(q, rq, 0, NULL);
-        }
+        rq = md->flush_request;
+        md->flush_request = NULL;
+
+        if (error == DM_ENDIO_REQUEUE) {
+                spin_lock_irqsave(q->queue_lock, flags);
+                blk_requeue_request(q, rq);
+                spin_unlock_irqrestore(q->queue_lock, flags);
+        } else
+                blk_end_request_all(rq, error);
+
+        blk_run_queue(q);
+
+        dm_put(md);
 }
 
-static int dm_rq_suspend_available(struct mapped_device *md, int noflush)
+/*
+ * Swap in a new table, returning the old one for the caller to destroy.
+ */
+struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
 {
-        int r = 1;
-        struct request *rq = &md->suspend_rq;
-        struct request_queue *q = md->queue;
-        unsigned long flags;
+        struct dm_table *map = ERR_PTR(-EINVAL);
+        struct queue_limits limits;
+        int r;
 
-        if (noflush)
-                return r;
+        mutex_lock(&md->suspend_lock);
 
-        /* The marker must be protected by queue lock if it is in use */
-        spin_lock_irqsave(q->queue_lock, flags);
-        if (unlikely(rq->ref_count)) {
-                /*
-                 * This can happen, when the previous flush suspend was
-                 * interrupted, the marker is still in the queue and
-                 * this flush suspend has been invoked, because we don't
-                 * remove the marker at the time of suspend interruption.
-                 * We have only one marker per mapped_device, so we can't
-                 * start another flush suspend while it is in use.
-                 */
-                BUG_ON(!rq->special); /* The marker should be invalidated */
-                DMWARN("Invalidating the previous flush suspend is still in"
-                       " progress.  Please retry later.");
-                r = 0;
+        /* device must be suspended */
+        if (!dm_suspended_md(md))
+                goto out;
+
+        r = dm_calculate_queue_limits(table, &limits);
+        if (r) {
+                map = ERR_PTR(r);
+                goto out;
         }
-        spin_unlock_irqrestore(q->queue_lock, flags);
 
-        return r;
+        /* cannot change the device type, once a table is bound */
+        if (md->map &&
+            (dm_table_get_type(md->map) != dm_table_get_type(table))) {
+                DMWARN("can't change the device type after a table is bound");
+                goto out;
+        }
+
+        map = __bind(md, table, &limits);
+
+out:
+        mutex_unlock(&md->suspend_lock);
+        return map;
 }
 
 /*
@@ -2323,49 +2459,11 @@ static void unlock_fs(struct mapped_device *md)
 /*
  * Suspend mechanism in request-based dm.
  *
- * After the suspend starts, further incoming requests are kept in
- * the request_queue and deferred.
- * Remaining requests in the request_queue at the start of suspend are flushed
- * if it is flush suspend.
- * The suspend completes when the following conditions have been satisfied,
- * so wait for it:
- *    1. q->in_flight is 0 (which means no in_flight request)
- *    2. queue has been stopped (which means no request dispatching)
+ * 1. Flush all I/Os by lock_fs() if needed.
+ * 2. Stop dispatching any I/O by stopping the request_queue.
+ * 3. Wait for all in-flight I/Os to be completed or requeued.
  *
- *
- * Noflush suspend
- * ---------------
- * Noflush suspend doesn't need to dispatch remaining requests.
- * So stop the queue immediately.  Then, wait for all in_flight requests
- * to be completed or requeued.
- *
- * To abort noflush suspend, start the queue.
- *
- *
- * Flush suspend
- * -------------
- * Flush suspend needs to dispatch remaining requests.  So stop the queue
- * after the remaining requests are completed. (Requeued request must be also
- * re-dispatched and completed.  Until then, we can't stop the queue.)
- *
- * During flushing the remaining requests, further incoming requests are also
- * inserted to the same queue.  To distinguish which requests are to be
- * flushed, we insert a marker request to the queue at the time of starting
- * flush suspend, like a barrier.
- * The dispatching is blocked when the marker is found on the top of the queue.
- * And the queue is stopped when all in_flight requests are completed, since
- * that means the remaining requests are completely flushed.
- * Then, the marker is removed from the queue.
- *
- * To abort flush suspend, we also need to take care of the marker, not only
- * starting the queue.
- * We don't remove the marker forcibly from the queue since it's against
- * the block-layer manner.  Instead, we put a invalidated mark on the marker.
- * When the invalidated marker is found on the top of the queue, it is
- * immediately removed from the queue, so it doesn't block dispatching.
- * Because we have only one marker per mapped_device, we can't start another
- * flush suspend until the invalidated marker is removed from the queue.
- * So fail and return with -EBUSY in such a case.
+ * To abort suspend, start the request_queue.
  */
 int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 {
@@ -2376,17 +2474,12 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 
         mutex_lock(&md->suspend_lock);
 
-        if (dm_suspended(md)) {
+        if (dm_suspended_md(md)) {
                 r = -EINVAL;
                 goto out_unlock;
         }
 
-        if (dm_request_based(md) && !dm_rq_suspend_available(md, noflush)) {
-                r = -EBUSY;
-                goto out_unlock;
-        }
-
-        map = dm_get_table(md);
+        map = dm_get_live_table(md);
 
         /*
          * DMF_NOFLUSH_SUSPENDING must be set before presuspend.
@@ -2399,8 +2492,10 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
         dm_table_presuspend_targets(map);
 
         /*
-         * Flush I/O to the device. noflush supersedes do_lockfs,
-         * because lock_fs() needs to flush I/Os.
+         * Flush I/O to the device.
+         * Any I/O submitted after lock_fs() may not be flushed.
+         * noflush takes precedence over do_lockfs.
+         * (lock_fs() flushes I/Os and waits for them to complete.)
          */
         if (!noflush && do_lockfs) {
                 r = lock_fs(md);
@@ -2429,10 +2524,15 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
         set_bit(DMF_QUEUE_IO_TO_THREAD, &md->flags);
         up_write(&md->io_lock);
 
-        flush_workqueue(md->wq);
-
+        /*
+         * Request-based dm uses md->wq for barrier (dm_rq_barrier_work) which
+         * can be kicked until md->queue is stopped.  So stop md->queue before
+         * flushing md->wq.
+         */
         if (dm_request_based(md))
-                dm_rq_start_suspend(md, noflush);
+                stop_queue(md->queue);
+
+        flush_workqueue(md->wq);
 
         /*
          * At this point no more requests are entering target request routines.
@@ -2451,7 +2551,7 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
                 dm_queue_flush(md);
 
                 if (dm_request_based(md))
-                        dm_rq_abort_suspend(md, noflush);
+                        start_queue(md->queue);
 
                 unlock_fs(md);
                 goto out; /* pushback list is already flushed, so skip flush */
@@ -2463,10 +2563,10 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
          * requests are being added to md->deferred list.
          */
 
-        dm_table_postsuspend_targets(map);
-
         set_bit(DMF_SUSPENDED, &md->flags);
 
+        dm_table_postsuspend_targets(map);
+
 out:
         dm_table_put(map);
 
@@ -2481,10 +2581,10 @@ int dm_resume(struct mapped_device *md)
         struct dm_table *map = NULL;
 
         mutex_lock(&md->suspend_lock);
-        if (!dm_suspended(md))
+        if (!dm_suspended_md(md))
                 goto out;
 
-        map = dm_get_table(md);
+        map = dm_get_live_table(md);
         if (!map || !dm_table_get_size(map))
                 goto out;
 
@@ -2518,18 +2618,19 @@ out:
 /*-----------------------------------------------------------------
  * Event notification.
  *---------------------------------------------------------------*/
-void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
                        unsigned cookie)
 {
         char udev_cookie[DM_COOKIE_LENGTH];
         char *envp[] = { udev_cookie, NULL };
 
         if (!cookie)
-                kobject_uevent(&disk_to_dev(md->disk)->kobj, action);
+                return kobject_uevent(&disk_to_dev(md->disk)->kobj, action);
         else {
                 snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u",
                          DM_COOKIE_ENV_VAR_NAME, cookie);
-                kobject_uevent_env(&disk_to_dev(md->disk)->kobj, action, envp);
+                return kobject_uevent_env(&disk_to_dev(md->disk)->kobj,
+                                          action, envp);
         }
 }
 
@@ -2585,26 +2686,27 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
                 return NULL;
 
         if (test_bit(DMF_FREEING, &md->flags) ||
-            test_bit(DMF_DELETING, &md->flags))
+            dm_deleting_md(md))
                 return NULL;
 
         dm_get(md);
         return md;
 }
 
-int dm_suspended(struct mapped_device *md)
+int dm_suspended_md(struct mapped_device *md)
 {
         return test_bit(DMF_SUSPENDED, &md->flags);
 }
 
-int dm_noflush_suspending(struct dm_target *ti)
+int dm_suspended(struct dm_target *ti)
 {
-        struct mapped_device *md = dm_table_get_md(ti->table);
-        int r = __noflush_suspending(md);
-
-        dm_put(md);
+        return dm_suspended_md(dm_table_get_md(ti->table));
+}
+EXPORT_SYMBOL_GPL(dm_suspended);
 
-        return r;
+int dm_noflush_suspending(struct dm_target *ti)
+{
+        return __noflush_suspending(dm_table_get_md(ti->table));
 }
 EXPORT_SYMBOL_GPL(dm_noflush_suspending);
 
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index a7663eba17e2..bad1724d4869 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -89,6 +89,16 @@ int dm_target_iterate(void (*iter_func)(struct target_type *tt,
 int dm_split_args(int *argc, char ***argvp, char *input);
 
 /*
+ * Is this mapped_device being deleted?
+ */
+int dm_deleting_md(struct mapped_device *md);
+
+/*
+ * Is this mapped_device suspended?
+ */
+int dm_suspended_md(struct mapped_device *md);
+
+/*
  * The device-mapper can be driven through one of two interfaces;
  * ioctl or filesystem, depending which patch you have applied.
  */
@@ -115,8 +125,11 @@ void dm_stripe_exit(void);
 int dm_open_count(struct mapped_device *md);
 int dm_lock_for_deletion(struct mapped_device *md);
 
-void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
-                       unsigned cookie);
+int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+                      unsigned cookie);
+
+int dm_io_init(void);
+void dm_io_exit(void);
 
 int dm_kcopyd_init(void);
 void dm_kcopyd_exit(void);
diff --git a/drivers/md/faulty.c b/drivers/md/faulty.c
index 87d88dbb667f..1a8987884614 100644
--- a/drivers/md/faulty.c
+++ b/drivers/md/faulty.c
@@ -64,6 +64,7 @@
 #define MaxFault        50
 #include <linux/blkdev.h>
 #include <linux/raid/md_u.h>
+#include <linux/slab.h>
 #include "md.h"
 #include <linux/seq_file.h>
 
@@ -168,10 +169,9 @@ static void add_sector(conf_t *conf, sector_t start, int mode)
                 conf->nfaults = n+1;
 }
 
-static int make_request(struct request_queue *q, struct bio *bio)
+static int make_request(mddev_t *mddev, struct bio *bio)
 {
-        mddev_t *mddev = q->queuedata;
-        conf_t *conf = (conf_t*)mddev->private;
+        conf_t *conf = mddev->private;
         int failit = 0;
 
         if (bio_data_dir(bio) == WRITE) {
@@ -224,7 +224,7 @@ static int make_request(struct request_queue *q, struct bio *bio)
 
 static void status(struct seq_file *seq, mddev_t *mddev)
 {
-        conf_t *conf = (conf_t*)mddev->private;
+        conf_t *conf = mddev->private;
         int n;
 
         if ((n=atomic_read(&conf->counters[WriteTransient])) != 0)
@@ -327,7 +327,7 @@ static int run(mddev_t *mddev)
 
 static int stop(mddev_t *mddev)
 {
-        conf_t *conf = (conf_t *)mddev->private;
+        conf_t *conf = mddev->private;
 
         kfree(conf);
         mddev->private = NULL;
@@ -360,6 +360,7 @@ static void raid_exit(void)
 module_init(raid_init);
 module_exit(raid_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Fault injection personality for MD");
 MODULE_ALIAS("md-personality-10"); /* faulty */
 MODULE_ALIAS("md-faulty");
 MODULE_ALIAS("md-level--5");
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 1ceceb334d5e..7e0e057db9a7 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -19,6 +19,7 @@
 #include <linux/blkdev.h>
 #include <linux/raid/md_u.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "md.h"
 #include "linear.h"
 
@@ -158,7 +159,8 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
                 sector_t sectors;
 
                 if (j < 0 || j >= raid_disks || disk->rdev) {
-                        printk("linear: disk numbering problem. Aborting!\n");
+                        printk(KERN_ERR "md/linear:%s: disk numbering problem. Aborting!\n",
+                               mdname(mddev));
                         goto out;
                 }
 
@@ -172,19 +174,22 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
                 disk_stack_limits(mddev->gendisk, rdev->bdev,
                                   rdev->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
-                 * violating it, so limit ->max_sector to one PAGE, as
-                 * a one page request is never in violation.
+                 * violating it, so limit max_segments to 1 lying within
+                 * a single page.
                  */
-                if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-                    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                        blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
+                if (rdev->bdev->bd_disk->queue->merge_bvec_fn) {
+                        blk_queue_max_segments(mddev->queue, 1);
+                        blk_queue_segment_boundary(mddev->queue,
+                                                   PAGE_CACHE_SIZE - 1);
+                }
 
                 conf->array_sectors += rdev->sectors;
                 cnt++;
 
         }
         if (cnt != raid_disks) {
-                printk("linear: not enough drives present. Aborting!\n");
+                printk(KERN_ERR "md/linear:%s: not enough drives present. Aborting!\n",
+                       mdname(mddev));
                 goto out;
         }
 
@@ -279,29 +284,21 @@ static int linear_stop (mddev_t *mddev)
         rcu_barrier();
         blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
         kfree(conf);
+        mddev->private = NULL;
 
         return 0;
 }
 
-static int linear_make_request (struct request_queue *q, struct bio *bio)
+static int linear_make_request (mddev_t *mddev, struct bio *bio)
 {
-        const int rw = bio_data_dir(bio);
-        mddev_t *mddev = q->queuedata;
         dev_info_t *tmp_dev;
         sector_t start_sector;
-        int cpu;
 
         if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-                bio_endio(bio, -EOPNOTSUPP);
+                md_barrier_request(mddev, bio);
                 return 0;
         }
 
-        cpu = part_stat_lock();
-        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bio));
-        part_stat_unlock();
-
         rcu_read_lock();
         tmp_dev = which_dev(mddev, bio->bi_sector);
         start_sector = tmp_dev->end_sector - tmp_dev->rdev->sectors;
@@ -311,12 +308,14 @@ static int linear_make_request (struct request_queue *q, struct bio *bio)
                      || (bio->bi_sector < start_sector))) {
                 char b[BDEVNAME_SIZE];
 
-                printk("linear_make_request: Sector %llu out of bounds on "
-                        "dev %s: %llu sectors, offset %llu\n",
-                        (unsigned long long)bio->bi_sector,
-                        bdevname(tmp_dev->rdev->bdev, b),
-                        (unsigned long long)tmp_dev->rdev->sectors,
-                        (unsigned long long)start_sector);
+                printk(KERN_ERR
+                       "md/linear:%s: make_request: Sector %llu out of bounds on "
+                       "dev %s: %llu sectors, offset %llu\n",
+                       mdname(mddev),
+                       (unsigned long long)bio->bi_sector,
+                       bdevname(tmp_dev->rdev->bdev, b),
+                       (unsigned long long)tmp_dev->rdev->sectors,
+                       (unsigned long long)start_sector);
                 rcu_read_unlock();
                 bio_io_error(bio);
                 return 0;
@@ -333,9 +332,9 @@ static int linear_make_request (struct request_queue *q, struct bio *bio)
 
                 bp = bio_split(bio, end_sector - bio->bi_sector);
 
-                if (linear_make_request(q, &bp->bio1))
+                if (linear_make_request(mddev, &bp->bio1))
                         generic_make_request(&bp->bio1);
-                if (linear_make_request(q, &bp->bio2))
+                if (linear_make_request(mddev, &bp->bio2))
                         generic_make_request(&bp->bio2);
                 bio_pair_release(bp);
                 return 0;
@@ -383,6 +382,7 @@ static void linear_exit (void)
 module_init(linear_init);
 module_exit(linear_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Linear device concatenation personality for MD");
 MODULE_ALIAS("md-personality-1"); /* LINEAR - deprecated*/
 MODULE_ALIAS("md-linear");
 MODULE_ALIAS("md-level--1");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 26ba42a79129..cb20d0b0555a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -39,14 +39,17 @@
 #include <linux/buffer_head.h> /* for invalidate_bdev */
 #include <linux/poll.h>
 #include <linux/ctype.h>
+#include <linux/string.h>
 #include <linux/hdreg.h>
 #include <linux/proc_fs.h>
 #include <linux/random.h>
 #include <linux/reboot.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 #include <linux/delay.h>
 #include <linux/raid/md_p.h>
 #include <linux/raid/md_u.h>
+#include <linux/slab.h>
 #include "md.h"
 #include "bitmap.h"
 
@@ -68,6 +71,12 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 #define MD_BUG(x...) { printk("md: bug in file %s, line %d\n", __FILE__, __LINE__); md_print_devices(); }
 
 /*
+ * Default number of read corrections we'll attempt on an rdev
+ * before ejecting it from the array. We divide the read error
+ * count by 2 for every hour elapsed between read errors.
+ */
+#define MD_DEFAULT_MAX_CORRECTED_READ_ERRORS 20
+/*
  * Current RAID-1,4,5 parallel reconstruction 'guaranteed speed limit'
  * is 1000 KB/sec, so the extra system load does not show up that much.
  * Increase it if you want to have more _guaranteed_ speed. Note that
@@ -98,44 +107,40 @@ static struct ctl_table_header *raid_table_header;
 
 static ctl_table raid_table[] = {
         {
-                .ctl_name       = DEV_RAID_SPEED_LIMIT_MIN,
                 .procname       = "speed_limit_min",
                 .data           = &sysctl_speed_limit_min,
                 .maxlen         = sizeof(int),
                 .mode           = S_IRUGO|S_IWUSR,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = DEV_RAID_SPEED_LIMIT_MAX,
                 .procname       = "speed_limit_max",
                 .data           = &sysctl_speed_limit_max,
                 .maxlen         = sizeof(int),
                 .mode           = S_IRUGO|S_IWUSR,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static ctl_table raid_dir_table[] = {
         {
-                .ctl_name       = DEV_RAID,
                 .procname       = "raid",
                 .maxlen         = 0,
                 .mode           = S_IRUGO|S_IXUGO,
                 .child          = raid_table,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static ctl_table raid_root_table[] = {
         {
-                .ctl_name       = CTL_DEV,
                 .procname       = "dev",
                 .maxlen         = 0,
                 .mode           = 0555,
                 .child          = raid_dir_table,
         },
-        { .ctl_name = 0 }
+        {  }
 };
 
 static const struct block_device_operations md_fops;
@@ -210,19 +215,22 @@ static DEFINE_SPINLOCK(all_mddevs_lock);
  */
 static int md_make_request(struct request_queue *q, struct bio *bio)
 {
+        const int rw = bio_data_dir(bio);
         mddev_t *mddev = q->queuedata;
         int rv;
+        int cpu;
+
         if (mddev == NULL || mddev->pers == NULL) {
                 bio_io_error(bio);
                 return 0;
         }
         rcu_read_lock();
-        if (mddev->suspended) {
+        if (mddev->suspended || mddev->barrier) {
                 DEFINE_WAIT(__wait);
                 for (;;) {
                         prepare_to_wait(&mddev->sb_wait, &__wait,
                                         TASK_UNINTERRUPTIBLE);
-                        if (!mddev->suspended)
+                        if (!mddev->suspended && !mddev->barrier)
                                 break;
                         rcu_read_unlock();
                         schedule();
@@ -232,13 +240,27 @@ static int md_make_request(struct request_queue *q, struct bio *bio)
         }
         atomic_inc(&mddev->active_io);
         rcu_read_unlock();
-        rv = mddev->pers->make_request(q, bio);
+
+        rv = mddev->pers->make_request(mddev, bio);
+
+        cpu = part_stat_lock();
+        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
+        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
+                      bio_sectors(bio));
+        part_stat_unlock();
+
         if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
                 wake_up(&mddev->sb_wait);
 
         return rv;
 }
 
+/* mddev_suspend makes sure no new requests are submitted
+ * to the device, and that any requests that have been submitted
+ * are completely handled.
+ * Once ->stop is called and completes, the module will be completely
+ * unused.
+ */
 static void mddev_suspend(mddev_t *mddev)
 {
         BUG_ON(mddev->suspended);
@@ -246,13 +268,6 @@ static void mddev_suspend(mddev_t *mddev)
         synchronize_rcu();
         wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
         mddev->pers->quiesce(mddev, 1);
-        md_unregister_thread(mddev->thread);
-        mddev->thread = NULL;
-        /* we now know that no code is executing in the personality module,
-         * except possibly the tail end of a ->bi_end_io function, but that
-         * is certain to complete before the module has a chance to get
-         * unloaded
-         */
 }
 
 static void mddev_resume(mddev_t *mddev)
@@ -264,10 +279,110 @@ static void mddev_resume(mddev_t *mddev)
 
 int mddev_congested(mddev_t *mddev, int bits)
 {
+        if (mddev->barrier)
+                return 1;
         return mddev->suspended;
 }
 EXPORT_SYMBOL(mddev_congested);
 
+/*
+ * Generic barrier handling for md
+ */
+
+#define POST_REQUEST_BARRIER ((void*)1)
+
+static void md_end_barrier(struct bio *bio, int err)
+{
+        mdk_rdev_t *rdev = bio->bi_private;
+        mddev_t *mddev = rdev->mddev;
+        if (err == -EOPNOTSUPP && mddev->barrier != POST_REQUEST_BARRIER)
+                set_bit(BIO_EOPNOTSUPP, &mddev->barrier->bi_flags);
+
+        rdev_dec_pending(rdev, mddev);
+
+        if (atomic_dec_and_test(&mddev->flush_pending)) {
+                if (mddev->barrier == POST_REQUEST_BARRIER) {
+                        /* This was a post-request barrier */
+                        mddev->barrier = NULL;
+                        wake_up(&mddev->sb_wait);
+                } else
+                        /* The pre-request barrier has finished */
+                        schedule_work(&mddev->barrier_work);
+        }
+        bio_put(bio);
+}
+
+static void submit_barriers(mddev_t *mddev)
+{
+        mdk_rdev_t *rdev;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
+                if (rdev->raid_disk >= 0 &&
+                    !test_bit(Faulty, &rdev->flags)) {
+                        /* Take two references, one is dropped
+                         * when request finishes, one after
+                         * we reclaim rcu_read_lock
+                         */
+                        struct bio *bi;
+                        atomic_inc(&rdev->nr_pending);
+                        atomic_inc(&rdev->nr_pending);
+                        rcu_read_unlock();
+                        bi = bio_alloc(GFP_KERNEL, 0);
+                        bi->bi_end_io = md_end_barrier;
+                        bi->bi_private = rdev;
+                        bi->bi_bdev = rdev->bdev;
+                        atomic_inc(&mddev->flush_pending);
+                        submit_bio(WRITE_BARRIER, bi);
+                        rcu_read_lock();
+                        rdev_dec_pending(rdev, mddev);
+                }
+        rcu_read_unlock();
+}
+
+static void md_submit_barrier(struct work_struct *ws)
+{
+        mddev_t *mddev = container_of(ws, mddev_t, barrier_work);
+        struct bio *bio = mddev->barrier;
+
+        atomic_set(&mddev->flush_pending, 1);
+
+        if (test_bit(BIO_EOPNOTSUPP, &bio->bi_flags))
+                bio_endio(bio, -EOPNOTSUPP);
+        else if (bio->bi_size == 0)
+                /* an empty barrier - all done */
+                bio_endio(bio, 0);
+        else {
+                bio->bi_rw &= ~(1<<BIO_RW_BARRIER);
+                if (mddev->pers->make_request(mddev, bio))
+                        generic_make_request(bio);
+                mddev->barrier = POST_REQUEST_BARRIER;
+                submit_barriers(mddev);
+        }
+        if (atomic_dec_and_test(&mddev->flush_pending)) {
+                mddev->barrier = NULL;
+                wake_up(&mddev->sb_wait);
+        }
+}
+
+void md_barrier_request(mddev_t *mddev, struct bio *bio)
+{
+        spin_lock_irq(&mddev->write_lock);
+        wait_event_lock_irq(mddev->sb_wait,
+                            !mddev->barrier,
+                            mddev->write_lock, /*nothing*/);
+        mddev->barrier = bio;
+        spin_unlock_irq(&mddev->write_lock);
+
+        atomic_set(&mddev->flush_pending, 1);
+        INIT_WORK(&mddev->barrier_work, md_submit_barrier);
+
+        submit_barriers(mddev);
+
+        if (atomic_dec_and_test(&mddev->flush_pending))
+                schedule_work(&mddev->barrier_work);
+}
+EXPORT_SYMBOL(md_barrier_request);
 
 static inline mddev_t *mddev_get(mddev_t *mddev)
 {
@@ -282,7 +397,9 @@ static void mddev_put(mddev_t *mddev)
         if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
                 return;
         if (!mddev->raid_disks && list_empty(&mddev->disks) &&
-            !mddev->hold_active) {
+            mddev->ctime == 0 && !mddev->hold_active) {
+                /* Array is not configured at all, and not held active,
+                 * so destroy it */
                 list_del(&mddev->all_mddevs);
                 if (mddev->gendisk) {
                         /* we did a probe so need to clean up.
@@ -299,6 +416,27 @@ static void mddev_put(mddev_t *mddev)
         spin_unlock(&all_mddevs_lock);
 }
 
+static void mddev_init(mddev_t *mddev)
+{
+        mutex_init(&mddev->open_mutex);
+        mutex_init(&mddev->reconfig_mutex);
+        mutex_init(&mddev->bitmap_info.mutex);
+        INIT_LIST_HEAD(&mddev->disks);
+        INIT_LIST_HEAD(&mddev->all_mddevs);
+        init_timer(&mddev->safemode_timer);
+        atomic_set(&mddev->active, 1);
+        atomic_set(&mddev->openers, 0);
+        atomic_set(&mddev->active_io, 0);
+        spin_lock_init(&mddev->write_lock);
+        atomic_set(&mddev->flush_pending, 0);
+        init_waitqueue_head(&mddev->sb_wait);
+        init_waitqueue_head(&mddev->recovery_wait);
+        mddev->reshape_position = MaxSector;
+        mddev->resync_min = 0;
+        mddev->resync_max = MaxSector;
+        mddev->level = LEVEL_NONE;
+}
+
 static mddev_t * mddev_find(dev_t unit)
 {
         mddev_t *mddev, *new = NULL;
@@ -365,21 +503,7 @@ static mddev_t * mddev_find(dev_t unit)
         else
                 new->md_minor = MINOR(unit) >> MdpMinorShift;
 
-        mutex_init(&new->open_mutex);
-        mutex_init(&new->reconfig_mutex);
-        INIT_LIST_HEAD(&new->disks);
-        INIT_LIST_HEAD(&new->all_mddevs);
-        init_timer(&new->safemode_timer);
-        atomic_set(&new->active, 1);
-        atomic_set(&new->openers, 0);
-        atomic_set(&new->active_io, 0);
-        spin_lock_init(&new->write_lock);
-        init_waitqueue_head(&new->sb_wait);
-        init_waitqueue_head(&new->recovery_wait);
-        new->reshape_position = MaxSector;
-        new->resync_min = 0;
-        new->resync_max = MaxSector;
-        new->level = LEVEL_NONE;
+        mddev_init(new);
 
         goto retry;
 }
@@ -399,9 +523,36 @@ static inline int mddev_trylock(mddev_t * mddev)
         return mutex_trylock(&mddev->reconfig_mutex);
 }
 
-static inline void mddev_unlock(mddev_t * mddev)
+static struct attribute_group md_redundancy_group;
+
+static void mddev_unlock(mddev_t * mddev)
 {
-        mutex_unlock(&mddev->reconfig_mutex);
+        if (mddev->to_remove) {
+                /* These cannot be removed under reconfig_mutex as
+                 * an access to the files will try to take reconfig_mutex
+                 * while holding the file unremovable, which leads to
+                 * a deadlock.
+                 * So hold open_mutex instead - we are allowed to take
+                 * it while holding reconfig_mutex, and md_run can
+                 * use it to wait for the remove to complete.
+                 */
+                struct attribute_group *to_remove = mddev->to_remove;
+                mddev->to_remove = NULL;
+                mutex_lock(&mddev->open_mutex);
+                mutex_unlock(&mddev->reconfig_mutex);
+
+                if (to_remove != &md_redundancy_group)
+                        sysfs_remove_group(&mddev->kobj, to_remove);
+                if (mddev->pers == NULL ||
+                    mddev->pers->sync_request == NULL) {
+                        sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                        if (mddev->sysfs_action)
+                                sysfs_put(mddev->sysfs_action);
+                        mddev->sysfs_action = NULL;
+                }
+                mutex_unlock(&mddev->open_mutex);
+        } else
+                mutex_unlock(&mddev->reconfig_mutex);
 
         md_wakeup_thread(mddev->thread);
 }
@@ -752,7 +903,7 @@ struct super_type  {
  */
 int md_check_no_bitmap(mddev_t *mddev)
 {
-        if (!mddev->bitmap_file && !mddev->bitmap_offset)
+        if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset)
                 return 0;
         printk(KERN_ERR "%s: bitmaps are not supported for %s\n",
                 mdname(mddev), mddev->pers->name);
@@ -880,8 +1031,8 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 mddev->raid_disks = sb->raid_disks;
                 mddev->dev_sectors = sb->size * 2;
                 mddev->events = ev1;
-                mddev->bitmap_offset = 0;
-                mddev->default_bitmap_offset = MD_SB_BYTES >> 9;
+                mddev->bitmap_info.offset = 0;
+                mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
 
                 if (mddev->minor_version >= 91) {
                         mddev->reshape_position = sb->reshape_position;
@@ -915,14 +1066,18 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 mddev->max_disks = MD_SB_DISKS;
 
                 if (sb->state & (1<<MD_SB_BITMAP_PRESENT) &&
-                    mddev->bitmap_file == NULL)
-                        mddev->bitmap_offset = mddev->default_bitmap_offset;
+                    mddev->bitmap_info.file == NULL)
+                        mddev->bitmap_info.offset =
+                                mddev->bitmap_info.default_offset;
 
         } else if (mddev->pers == NULL) {
-                /* Insist on good event counter while assembling */
+                /* Insist on good event counter while assembling, except
+                 * for spares (which don't need an event count) */
                 ++ev1;
-                if (ev1 < mddev->events) 
-                        return -EINVAL;
+                if (sb->disks[rdev->desc_nr].state & (
+                            (1<<MD_DISK_SYNC) | (1 << MD_DISK_ACTIVE)))
+                        if (ev1 < mddev->events) 
+                                return -EINVAL;
         } else if (mddev->bitmap) {
                 /* if adding to array with a bitmap, then we can accept an
                  * older device ... but not too old.
@@ -944,6 +1099,14 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                             desc->raid_disk < mddev->raid_disks */) {
                         set_bit(In_sync, &rdev->flags);
                         rdev->raid_disk = desc->raid_disk;
+                } else if (desc->state & (1<<MD_DISK_ACTIVE)) {
+                        /* active but not in sync implies recovery up to
+                         * reshape position.  We don't know exactly where
+                         * that is, so set to zero for now */
+                        if (mddev->minor_version >= 91) {
+                                rdev->recovery_offset = 0;
+                                rdev->raid_disk = desc->raid_disk;
+                        }
                 }
                 if (desc->state & (1<<MD_DISK_WRITEMOSTLY))
                         set_bit(WriteMostly, &rdev->flags);
@@ -1025,15 +1188,26 @@ static void super_90_sync(mddev_t *mddev, mdk_rdev_t *rdev)
         sb->layout = mddev->layout;
         sb->chunk_size = mddev->chunk_sectors << 9;
 
-        if (mddev->bitmap && mddev->bitmap_file == NULL)
+        if (mddev->bitmap && mddev->bitmap_info.file == NULL)
                 sb->state |= (1<<MD_SB_BITMAP_PRESENT);
 
         sb->disks[0].state = (1<<MD_DISK_REMOVED);
         list_for_each_entry(rdev2, &mddev->disks, same_set) {
                 mdp_disk_t *d;
                 int desc_nr;
-                if (rdev2->raid_disk >= 0 && test_bit(In_sync, &rdev2->flags)
-                    && !test_bit(Faulty, &rdev2->flags))
+                int is_active = test_bit(In_sync, &rdev2->flags);
+
+                if (rdev2->raid_disk >= 0 &&
+                    sb->minor_version >= 91)
+                        /* we have nowhere to store the recovery_offset,
+                         * but if it is not below the reshape_position,
+                         * we can piggy-back on that.
+                         */
+                        is_active = 1;
+                if (rdev2->raid_disk < 0 ||
+                    test_bit(Faulty, &rdev2->flags))
+                        is_active = 0;
+                if (is_active)
                         desc_nr = rdev2->raid_disk;
                 else
                         desc_nr = next_spare++;
@@ -1043,16 +1217,16 @@ static void super_90_sync(mddev_t *mddev, mdk_rdev_t *rdev)
                 d->number = rdev2->desc_nr;
                 d->major = MAJOR(rdev2->bdev->bd_dev);
                 d->minor = MINOR(rdev2->bdev->bd_dev);
-                if (rdev2->raid_disk >= 0 && test_bit(In_sync, &rdev2->flags)
-                    && !test_bit(Faulty, &rdev2->flags))
+                if (is_active)
                         d->raid_disk = rdev2->raid_disk;
                 else
                         d->raid_disk = rdev2->desc_nr; /* compatibility */
                 if (test_bit(Faulty, &rdev2->flags))
                         d->state = (1<<MD_DISK_FAULTY);
-                else if (test_bit(In_sync, &rdev2->flags)) {
+                else if (is_active) {
                         d->state = (1<<MD_DISK_ACTIVE);
-                        d->state |= (1<<MD_DISK_SYNC);
+                        if (test_bit(In_sync, &rdev2->flags))
+                                d->state |= (1<<MD_DISK_SYNC);
                         active++;
                         working++;
                 } else {
@@ -1092,7 +1266,7 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
 {
         if (num_sectors && num_sectors < rdev->mddev->dev_sectors)
                 return 0; /* component must fit device */
-        if (rdev->mddev->bitmap_offset)
+        if (rdev->mddev->bitmap_info.offset)
                 return 0; /* can't move bitmap */
         rdev->sb_start = calc_dev_sboffset(rdev->bdev);
         if (!num_sectors || num_sectors > rdev->sb_start)
@@ -1271,8 +1445,8 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 mddev->raid_disks = le32_to_cpu(sb->raid_disks);
                 mddev->dev_sectors = le64_to_cpu(sb->size);
                 mddev->events = ev1;
-                mddev->bitmap_offset = 0;
-                mddev->default_bitmap_offset = 1024 >> 9;
+                mddev->bitmap_info.offset = 0;
+                mddev->bitmap_info.default_offset = 1024 >> 9;
                 
                 mddev->recovery_cp = le64_to_cpu(sb->resync_offset);
                 memcpy(mddev->uuid, sb->set_uuid, 16);
@@ -1280,8 +1454,9 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 mddev->max_disks =  (4096-256)/2;
 
                 if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_BITMAP_OFFSET) &&
-                    mddev->bitmap_file == NULL )
-                        mddev->bitmap_offset = (__s32)le32_to_cpu(sb->bitmap_offset);
+                    mddev->bitmap_info.file == NULL )
+                        mddev->bitmap_info.offset =
+                                (__s32)le32_to_cpu(sb->bitmap_offset);
 
                 if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RESHAPE_ACTIVE)) {
                         mddev->reshape_position = le64_to_cpu(sb->reshape_position);
@@ -1298,10 +1473,14 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                 }
 
         } else if (mddev->pers == NULL) {
-                /* Insist of good event counter while assembling */
+                /* Insist of good event counter while assembling, except for
+                 * spares (which don't need an event count) */
                 ++ev1;
-                if (ev1 < mddev->events)
-                        return -EINVAL;
+                if (rdev->desc_nr >= 0 &&
+                    rdev->desc_nr < le32_to_cpu(sb->max_dev) &&
+                    le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < 0xfffe)
+                        if (ev1 < mddev->events)
+                                return -EINVAL;
         } else if (mddev->bitmap) {
                 /* If adding to array with a bitmap, then we can accept an
                  * older device, but not too old.
@@ -1375,21 +1554,17 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
         sb->level = cpu_to_le32(mddev->level);
         sb->layout = cpu_to_le32(mddev->layout);
 
-        if (mddev->bitmap && mddev->bitmap_file == NULL) {
-                sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_offset);
+        if (mddev->bitmap && mddev->bitmap_info.file == NULL) {
+                sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_info.offset);
                 sb->feature_map = cpu_to_le32(MD_FEATURE_BITMAP_OFFSET);
         }
 
         if (rdev->raid_disk >= 0 &&
             !test_bit(In_sync, &rdev->flags)) {
-                if (mddev->curr_resync_completed > rdev->recovery_offset)
-                        rdev->recovery_offset = mddev->curr_resync_completed;
-                if (rdev->recovery_offset > 0) {
-                        sb->feature_map |=
-                                cpu_to_le32(MD_FEATURE_RECOVERY_OFFSET);
-                        sb->recovery_offset =
-                                cpu_to_le64(rdev->recovery_offset);
-                }
+                sb->feature_map |=
+                        cpu_to_le32(MD_FEATURE_RECOVERY_OFFSET);
+                sb->recovery_offset =
+                        cpu_to_le64(rdev->recovery_offset);
         }
 
         if (mddev->reshape_position != MaxSector) {
@@ -1423,7 +1598,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
                         sb->dev_roles[i] = cpu_to_le16(0xfffe);
                 else if (test_bit(In_sync, &rdev2->flags))
                         sb->dev_roles[i] = cpu_to_le16(rdev2->raid_disk);
-                else if (rdev2->raid_disk >= 0 && rdev2->recovery_offset > 0)
+                else if (rdev2->raid_disk >= 0)
                         sb->dev_roles[i] = cpu_to_le16(rdev2->raid_disk);
                 else
                         sb->dev_roles[i] = cpu_to_le16(0xffff);
@@ -1445,7 +1620,7 @@ super_1_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
                 max_sectors -= rdev->data_offset;
                 if (!num_sectors || num_sectors > max_sectors)
                         num_sectors = max_sectors;
-        } else if (rdev->mddev->bitmap_offset) {
+        } else if (rdev->mddev->bitmap_info.offset) {
                 /* minor version 0 with bitmap we can't move */
                 return 0;
         } else {
@@ -1640,7 +1815,7 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
                 kobject_del(&rdev->kobj);
                 goto fail;
         }
-        rdev->sysfs_state = sysfs_get_dirent(rdev->kobj.sd, "state");
+        rdev->sysfs_state = sysfs_get_dirent(rdev->kobj.sd, NULL, "state");
 
         list_add_rcu(&rdev->same_set, &mddev->disks);
         bd_claim_by_disk(rdev->bdev, rdev->bdev->bd_holder, mddev->gendisk);
@@ -1813,15 +1988,11 @@ static void print_sb_1(struct mdp_superblock_1 *sb)
 
         uuid = sb->set_uuid;
         printk(KERN_INFO
-               "md:  SB: (V:%u) (F:0x%08x) Array-ID:<%02x%02x%02x%02x"
-               ":%02x%02x:%02x%02x:%02x%02x:%02x%02x%02x%02x%02x%02x>\n"
+               "md:  SB: (V:%u) (F:0x%08x) Array-ID:<%pU>\n"
                "md:    Name: \"%s\" CT:%llu\n",
                 le32_to_cpu(sb->major_version),
                 le32_to_cpu(sb->feature_map),
-                uuid[0], uuid[1], uuid[2], uuid[3],
-                uuid[4], uuid[5], uuid[6], uuid[7],
-                uuid[8], uuid[9], uuid[10], uuid[11],
-                uuid[12], uuid[13], uuid[14], uuid[15],
+                uuid,
                 sb->set_name,
                 (unsigned long long)le64_to_cpu(sb->ctime)
                        & MD_SUPERBLOCK_1_TIME_SEC_MASK);
@@ -1830,8 +2001,7 @@ static void print_sb_1(struct mdp_superblock_1 *sb)
         printk(KERN_INFO
                "md:       L%u SZ%llu RD:%u LO:%u CS:%u DO:%llu DS:%llu SO:%llu"
                         " RO:%llu\n"
-               "md:     Dev:%08x UUID: %02x%02x%02x%02x:%02x%02x:%02x%02x:%02x%02x"
-                        ":%02x%02x%02x%02x%02x%02x\n"
+               "md:     Dev:%08x UUID: %pU\n"
                "md:       (F:0x%08x) UT:%llu Events:%llu ResyncOffset:%llu CSUM:0x%08x\n"
                "md:         (MaxDev:%u) \n",
                 le32_to_cpu(sb->level),
@@ -1844,10 +2014,7 @@ static void print_sb_1(struct mdp_superblock_1 *sb)
                 (unsigned long long)le64_to_cpu(sb->super_offset),
                 (unsigned long long)le64_to_cpu(sb->recovery_offset),
                 le32_to_cpu(sb->dev_number),
-                uuid[0], uuid[1], uuid[2], uuid[3],
-                uuid[4], uuid[5], uuid[6], uuid[7],
-                uuid[8], uuid[9], uuid[10], uuid[11],
-                uuid[12], uuid[13], uuid[14], uuid[15],
+                uuid,
                 sb->devflags,
                 (unsigned long long)le64_to_cpu(sb->utime) & MD_SUPERBLOCK_1_TIME_SEC_MASK,
                 (unsigned long long)le64_to_cpu(sb->events),
@@ -1917,11 +2084,19 @@ static void sync_sbs(mddev_t * mddev, int nospares)
          */
         mdk_rdev_t *rdev;
 
+        /* First make sure individual recovery_offsets are correct */
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                if (rdev->raid_disk >= 0 &&
+                    mddev->delta_disks >= 0 &&
+                    !test_bit(In_sync, &rdev->flags) &&
+                    mddev->curr_resync_completed > rdev->recovery_offset)
+                                rdev->recovery_offset = mddev->curr_resync_completed;
+
+        }       
         list_for_each_entry(rdev, &mddev->disks, same_set) {
                 if (rdev->sb_events == mddev->events ||
                     (nospares &&
                      rdev->raid_disk < 0 &&
-                     (rdev->sb_events&1)==0 &&
                      rdev->sb_events+1 == mddev->events)) {
                         /* Don't update this superblock */
                         rdev->sb_loaded = 2;
@@ -1974,22 +2149,14 @@ repeat:
          * and 'events' is odd, we can roll back to the previous clean state */
         if (nospares
             && (mddev->in_sync && mddev->recovery_cp == MaxSector)
-            && (mddev->events & 1)
-            && mddev->events != 1)
+            && mddev->can_decrease_events
+            && mddev->events != 1) {
                 mddev->events--;
-        else {
+                mddev->can_decrease_events = 0;
+        } else {
                 /* otherwise we have to go forward and ... */
                 mddev->events ++;
-                if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
-                        /* .. if the array isn't clean, an 'even' event must also go
-                         * to spares. */
-                        if ((mddev->events&1)==0)
-                                nospares = 0;
-                } else {
-                        /* otherwise an 'odd' event must go to spares */
-                        if ((mddev->events&1))
-                                nospares = 0;
-                }
+                mddev->can_decrease_events = nospares;
         }
 
         if (!mddev->events) {
@@ -2233,6 +2400,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                         return err;
                 sprintf(nm, "rd%d", rdev->raid_disk);
                 sysfs_remove_link(&rdev->mddev->kobj, nm);
+                rdev->raid_disk = -1;
                 set_bit(MD_RECOVERY_NEEDED, &rdev->mddev->recovery);
                 md_wakeup_thread(rdev->mddev->thread);
         } else if (rdev->mddev->pers) {
@@ -2421,12 +2589,49 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
 static struct rdev_sysfs_entry rdev_size =
 __ATTR(size, S_IRUGO|S_IWUSR, rdev_size_show, rdev_size_store);
 
+
+static ssize_t recovery_start_show(mdk_rdev_t *rdev, char *page)
+{
+        unsigned long long recovery_start = rdev->recovery_offset;
+
+        if (test_bit(In_sync, &rdev->flags) ||
+            recovery_start == MaxSector)
+                return sprintf(page, "none\n");
+
+        return sprintf(page, "%llu\n", recovery_start);
+}
+
+static ssize_t recovery_start_store(mdk_rdev_t *rdev, const char *buf, size_t len)
+{
+        unsigned long long recovery_start;
+
+        if (cmd_match(buf, "none"))
+                recovery_start = MaxSector;
+        else if (strict_strtoull(buf, 10, &recovery_start))
+                return -EINVAL;
+
+        if (rdev->mddev->pers &&
+            rdev->raid_disk >= 0)
+                return -EBUSY;
+
+        rdev->recovery_offset = recovery_start;
+        if (recovery_start == MaxSector)
+                set_bit(In_sync, &rdev->flags);
+        else
+                clear_bit(In_sync, &rdev->flags);
+        return len;
+}
+
+static struct rdev_sysfs_entry rdev_recovery_start =
+__ATTR(recovery_start, S_IRUGO|S_IWUSR, recovery_start_show, recovery_start_store);
+
 static struct attribute *rdev_default_attrs[] = {
         &rdev_state.attr,
         &rdev_errors.attr,
         &rdev_slot.attr,
         &rdev_offset.attr,
         &rdev_size.attr,
+        &rdev_recovery_start.attr,
         NULL,
 };
 static ssize_t
@@ -2480,7 +2685,7 @@ static void rdev_free(struct kobject *ko)
         mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
         kfree(rdev);
 }
-static struct sysfs_ops rdev_sysfs_ops = {
+static const struct sysfs_ops rdev_sysfs_ops = {
         .show           = rdev_attr_show,
         .store          = rdev_attr_store,
 };
@@ -2528,6 +2733,8 @@ static mdk_rdev_t *md_import_device(dev_t newdev, int super_format, int super_mi
         rdev->flags = 0;
         rdev->data_offset = 0;
         rdev->sb_events = 0;
+        rdev->last_read_error.tv_sec  = 0;
+        rdev->last_read_error.tv_nsec = 0;
         atomic_set(&rdev->nr_pending, 0);
         atomic_set(&rdev->read_errors, 0);
         atomic_set(&rdev->corrected_errors, 0);
@@ -2609,8 +2816,9 @@ static void analyze_sbs(mddev_t * mddev)
 
         i = 0;
         rdev_for_each(rdev, tmp, mddev) {
-                if (rdev->desc_nr >= mddev->max_disks ||
-                    i > mddev->max_disks) {
+                if (mddev->max_disks &&
+                    (rdev->desc_nr >= mddev->max_disks ||
+                     i > mddev->max_disks)) {
                         printk(KERN_WARNING
                                "md: %s: %s: only %d devices permitted\n",
                                mdname(mddev), bdevname(rdev->bdev, b),
@@ -2631,13 +2839,54 @@ static void analyze_sbs(mddev_t * mddev)
                         rdev->desc_nr = i++;
                         rdev->raid_disk = rdev->desc_nr;
                         set_bit(In_sync, &rdev->flags);
-                } else if (rdev->raid_disk >= mddev->raid_disks) {
+                } else if (rdev->raid_disk >= (mddev->raid_disks - min(0, mddev->delta_disks))) {
                         rdev->raid_disk = -1;
                         clear_bit(In_sync, &rdev->flags);
                 }
         }
 }
 
+/* Read a fixed-point number.
+ * Numbers in sysfs attributes should be in "standard" units where
+ * possible, so time should be in seconds.
+ * However we internally use a a much smaller unit such as 
+ * milliseconds or jiffies.
+ * This function takes a decimal number with a possible fractional
+ * component, and produces an integer which is the result of
+ * multiplying that number by 10^'scale'.
+ * all without any floating-point arithmetic.
+ */
+int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale)
+{
+        unsigned long result = 0;
+        long decimals = -1;
+        while (isdigit(*cp) || (*cp == '.' && decimals < 0)) {
+                if (*cp == '.')
+                        decimals = 0;
+                else if (decimals < scale) {
+                        unsigned int value;
+                        value = *cp - '0';
+                        result = result * 10 + value;
+                        if (decimals >= 0)
+                                decimals++;
+                }
+                cp++;
+        }
+        if (*cp == '\n')
+                cp++;
+        if (*cp)
+                return -EINVAL;
+        if (decimals < 0)
+                decimals = 0;
+        while (decimals < scale) {
+                result *= 10;
+                decimals ++;
+        }
+        *res = result;
+        return 0;
+}
+
+
 static void md_safemode_timeout(unsigned long data);
 
 static ssize_t
@@ -2649,31 +2898,10 @@ safe_delay_show(mddev_t *mddev, char *page)
 static ssize_t
 safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
 {
-        int scale=1;
-        int dot=0;
-        int i;
         unsigned long msec;
-        char buf[30];
 
-        /* remove a period, and count digits after it */
-        if (len >= sizeof(buf))
-                return -EINVAL;
-        strlcpy(buf, cbuf, sizeof(buf));
-        for (i=0; i<len; i++) {
-                if (dot) {
-                        if (isdigit(buf[i])) {
-                                buf[i-1] = buf[i];
-                                scale *= 10;
-                        }
-                        buf[i] = 0;
-                } else if (buf[i] == '.') {
-                        dot=1;
-                        buf[i] = 0;
-                }
-        }
-        if (strict_strtoul(buf, 10, &msec) < 0)
+        if (strict_strtoul_scaled(cbuf, &msec, 3) < 0)
                 return -EINVAL;
-        msec = (msec * 1000) / scale;
         if (msec == 0)
                 mddev->safemode_delay = 0;
         else {
@@ -2706,9 +2934,10 @@ level_show(mddev_t *mddev, char *page)
 static ssize_t
 level_store(mddev_t *mddev, const char *buf, size_t len)
 {
-        char level[16];
+        char clevel[16];
         ssize_t rv = len;
         struct mdk_personality *pers;
+        long level;
         void *priv;
         mdk_rdev_t *rdev;
 
@@ -2741,19 +2970,22 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         }
 
         /* Now find the new personality */
-        if (len == 0 || len >= sizeof(level))
+        if (len == 0 || len >= sizeof(clevel))
                 return -EINVAL;
-        strncpy(level, buf, len);
-        if (level[len-1] == '\n')
+        strncpy(clevel, buf, len);
+        if (clevel[len-1] == '\n')
                 len--;
-        level[len] = 0;
+        clevel[len] = 0;
+        if (strict_strtol(clevel, 10, &level))
+                level = LEVEL_NONE;
 
-        request_module("md-%s", level);
+        if (request_module("md-%s", clevel) != 0)
+                request_module("md-level-%s", clevel);
         spin_lock(&pers_lock);
-        pers = find_pers(LEVEL_NONE, level);
+        pers = find_pers(level, clevel);
         if (!pers || !try_module_get(pers->owner)) {
                 spin_unlock(&pers_lock);
-                printk(KERN_WARNING "md: personality %s not loaded\n", level);
+                printk(KERN_WARNING "md: personality %s not loaded\n", clevel);
                 return -EINVAL;
         }
         spin_unlock(&pers_lock);
@@ -2766,10 +2998,13 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         if (!pers->takeover) {
                 module_put(pers->owner);
                 printk(KERN_WARNING "md: %s: %s does not support personality takeover\n",
-                       mdname(mddev), level);
+                       mdname(mddev), clevel);
                 return -EINVAL;
         }
 
+        list_for_each_entry(rdev, &mddev->disks, same_set)
+                rdev->new_raid_disk = rdev->raid_disk;
+
         /* ->takeover must set new_* and/or delta_disks
          * if it succeeds, and may set them when it fails.
          */
@@ -2782,20 +3017,73 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
                 mddev->delta_disks = 0;
                 module_put(pers->owner);
                 printk(KERN_WARNING "md: %s: %s would not accept array\n",
-                       mdname(mddev), level);
+                       mdname(mddev), clevel);
                 return PTR_ERR(priv);
         }
 
         /* Looks like we have a winner */
         mddev_suspend(mddev);
         mddev->pers->stop(mddev);
-        module_put(mddev->pers->owner);
-        /* Invalidate devices that are now superfluous */
-        list_for_each_entry(rdev, &mddev->disks, same_set)
-                if (rdev->raid_disk >= mddev->raid_disks) {
-                        rdev->raid_disk = -1;
+        
+        if (mddev->pers->sync_request == NULL &&
+            pers->sync_request != NULL) {
+                /* need to add the md_redundancy_group */
+                if (sysfs_create_group(&mddev->kobj, &md_redundancy_group))
+                        printk(KERN_WARNING
+                               "md: cannot register extra attributes for %s\n",
+                               mdname(mddev));
+                mddev->sysfs_action = sysfs_get_dirent(mddev->kobj.sd, NULL, "sync_action");
+        }               
+        if (mddev->pers->sync_request != NULL &&
+            pers->sync_request == NULL) {
+                /* need to remove the md_redundancy_group */
+                if (mddev->to_remove == NULL)
+                        mddev->to_remove = &md_redundancy_group;
+        }
+
+        if (mddev->pers->sync_request == NULL &&
+            mddev->external) {
+                /* We are converting from a no-redundancy array
+                 * to a redundancy array and metadata is managed
+                 * externally so we need to be sure that writes
+                 * won't block due to a need to transition
+                 *      clean->dirty
+                 * until external management is started.
+                 */
+                mddev->in_sync = 0;
+                mddev->safemode_delay = 0;
+                mddev->safemode = 0;
+        }
+
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                char nm[20];
+                if (rdev->raid_disk < 0)
+                        continue;
+                if (rdev->new_raid_disk > mddev->raid_disks)
+                        rdev->new_raid_disk = -1;
+                if (rdev->new_raid_disk == rdev->raid_disk)
+                        continue;
+                sprintf(nm, "rd%d", rdev->raid_disk);
+                sysfs_remove_link(&mddev->kobj, nm);
+        }
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                if (rdev->raid_disk < 0)
+                        continue;
+                if (rdev->new_raid_disk == rdev->raid_disk)
+                        continue;
+                rdev->raid_disk = rdev->new_raid_disk;
+                if (rdev->raid_disk < 0)
                         clear_bit(In_sync, &rdev->flags);
+                else {
+                        char nm[20];
+                        sprintf(nm, "rd%d", rdev->raid_disk);
+                        if(sysfs_create_link(&mddev->kobj, &rdev->kobj, nm))
+                                printk("md: cannot register %s for %s after level change\n",
+                                       nm, mdname(mddev));
                 }
+        }
+
+        module_put(mddev->pers->owner);
         mddev->pers = pers;
         mddev->private = priv;
         strlcpy(mddev->clevel, pers->name, sizeof(mddev->clevel));
@@ -2803,11 +3091,20 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         mddev->layout = mddev->new_layout;
         mddev->chunk_sectors = mddev->new_chunk_sectors;
         mddev->delta_disks = 0;
+        if (mddev->pers->sync_request == NULL) {
+                /* this is now an array without redundancy, so
+                 * it must always be in_sync
+                 */
+                mddev->in_sync = 1;
+                del_timer_sync(&mddev->safemode_timer);
+        }
         pers->run(mddev);
         mddev_resume(mddev);
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         md_wakeup_thread(mddev->thread);
+        sysfs_notify(&mddev->kobj, NULL, "level");
+        md_new_event(mddev);
         return rv;
 }
 
@@ -2949,7 +3246,9 @@ resync_start_store(mddev_t *mddev, const char *buf, size_t len)
 
         if (mddev->pers)
                 return -EBUSY;
-        if (!*buf || (*e && *e != '\n'))
+        if (cmd_match(buf, "none"))
+                n = MaxSector;
+        else if (!*buf || (*e && *e != '\n'))
                 return -EINVAL;
 
         mddev->recovery_cp = n;
@@ -3044,6 +3343,7 @@ array_state_show(mddev_t *mddev, char *page)
 }
 
 static int do_md_stop(mddev_t * mddev, int ro, int is_open);
+static int md_set_readonly(mddev_t * mddev, int is_open);
 static int do_md_run(mddev_t * mddev);
 static int restart_array(mddev_t *mddev);
 
@@ -3074,7 +3374,7 @@ array_state_store(mddev_t *mddev, const char *buf, size_t len)
                 break; /* not supported yet */
         case readonly:
                 if (mddev->pers)
-                        err = do_md_stop(mddev, 1, 0);
+                        err = md_set_readonly(mddev, 0);
                 else {
                         mddev->ro = 1;
                         set_disk_ro(mddev->gendisk, 1);
@@ -3084,7 +3384,7 @@ array_state_store(mddev_t *mddev, const char *buf, size_t len)
         case read_auto:
                 if (mddev->pers) {
                         if (mddev->ro == 0)
-                                err = do_md_stop(mddev, 1, 0);
+                                err = md_set_readonly(mddev, 0);
                         else if (mddev->ro == 1)
                                 err = restart_array(mddev);
                         if (err == 0) {
@@ -3145,6 +3445,29 @@ static struct md_sysfs_entry md_array_state =
 __ATTR(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
 
 static ssize_t
+max_corrected_read_errors_show(mddev_t *mddev, char *page) {
+        return sprintf(page, "%d\n",
+                       atomic_read(&mddev->max_corr_read_errors));
+}
+
+static ssize_t
+max_corrected_read_errors_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        char *e;
+        unsigned long n = simple_strtoul(buf, &e, 10);
+
+        if (*buf && (*e == 0 || *e == '\n')) {
+                atomic_set(&mddev->max_corr_read_errors, n);
+                return len;
+        }
+        return -EINVAL;
+}
+
+static struct md_sysfs_entry max_corr_read_errors =
+__ATTR(max_read_errors, S_IRUGO|S_IWUSR, max_corrected_read_errors_show,
+        max_corrected_read_errors_store);
+
+static ssize_t
 null_show(mddev_t *mddev, char *page)
 {
         return -EINVAL;
@@ -3225,8 +3548,7 @@ bitmap_store(mddev_t *mddev, const char *buf, size_t len)
                 }
                 if (*end && !isspace(*end)) break;
                 bitmap_dirty_bits(mddev->bitmap, chunk, end_chunk);
-                buf = end;
-                while (isspace(*buf)) buf++;
+                buf = skip_spaces(end);
         }
         bitmap_unplug(mddev->bitmap); /* flush the bits to disk */
 out:
@@ -3769,6 +4091,7 @@ static struct attribute *md_default_attrs[] = {
         &md_array_state.attr,
         &md_reshape_position.attr,
         &md_array_size.attr,
+        &max_corr_read_errors.attr,
         NULL,
 };
 
@@ -3850,7 +4173,7 @@ static void md_free(struct kobject *ko)
         kfree(mddev);
 }
 
-static struct sysfs_ops md_sysfs_ops = {
+static const struct sysfs_ops md_sysfs_ops = {
         .show   = md_attr_show,
         .store  = md_attr_store,
 };
@@ -3866,13 +4189,7 @@ static void mddev_delayed_delete(struct work_struct *ws)
 {
         mddev_t *mddev = container_of(ws, mddev_t, del_work);
 
-        if (mddev->private == &md_redundancy_group) {
-                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
-                if (mddev->sysfs_action)
-                        sysfs_put(mddev->sysfs_action);
-                mddev->sysfs_action = NULL;
-                mddev->private = NULL;
-        }
+        sysfs_remove_group(&mddev->kobj, &md_bitmap_group);
         kobject_del(&mddev->kobj);
         kobject_put(&mddev->kobj);
 }
@@ -3964,11 +4281,13 @@ static int md_alloc(dev_t dev, char *name)
                        disk->disk_name);
                 error = 0;
         }
+        if (sysfs_create_group(&mddev->kobj, &md_bitmap_group))
+                printk(KERN_DEBUG "pointless warning\n");
  abort:
         mutex_unlock(&disks_mutex);
         if (!error) {
                 kobject_uevent(&mddev->kobj, KOBJ_ADD);
-                mddev->sysfs_state = sysfs_get_dirent(mddev->kobj.sd, "array_state");
+                mddev->sysfs_state = sysfs_get_dirent(mddev->kobj.sd, NULL, "array_state");
         }
         mddev_put(mddev);
         return error;
@@ -4013,11 +4332,10 @@ static void md_safemode_timeout(unsigned long data)
 
 static int start_dirty_degraded;
 
-static int do_md_run(mddev_t * mddev)
+static int md_run(mddev_t *mddev)
 {
         int err;
         mdk_rdev_t *rdev;
-        struct gendisk *disk;
         struct mdk_personality *pers;
 
         if (list_empty(&mddev->disks))
@@ -4027,6 +4345,13 @@ static int do_md_run(mddev_t * mddev)
         if (mddev->pers)
                 return -EBUSY;
 
+        /* These two calls synchronise us with the
+         * sysfs_remove_group calls in mddev_unlock,
+         * so they must have completed.
+         */
+        mutex_lock(&mddev->open_mutex);
+        mutex_unlock(&mddev->open_mutex);
+
         /*
          * Analyze all RAID superblock(s)
          */
@@ -4075,11 +4400,6 @@ static int do_md_run(mddev_t * mddev)
                 sysfs_notify_dirent(rdev->sysfs_state);
         }
 
-        md_probe(mddev->unit, NULL, NULL);
-        disk = mddev->gendisk;
-        if (!disk)
-                return -ENOMEM;
-
         spin_lock(&pers_lock);
         pers = find_pers(mddev->level, mddev->clevel);
         if (!pers || !try_module_get(pers->owner)) {
@@ -4145,7 +4465,7 @@ static int do_md_run(mddev_t * mddev)
         mddev->barriers_work = 1;
         mddev->ok_start_degraded = start_dirty_degraded;
 
-        if (start_readonly)
+        if (start_readonly && mddev->ro == 0)
                 mddev->ro = 2; /* read-only, but switch on first write */
 
         err = mddev->pers->run(mddev);
@@ -4180,11 +4500,13 @@ static int do_md_run(mddev_t * mddev)
                         printk(KERN_WARNING
                                "md: cannot register extra attributes for %s\n",
                                mdname(mddev));
-                mddev->sysfs_action = sysfs_get_dirent(mddev->kobj.sd, "sync_action");
+                mddev->sysfs_action = sysfs_get_dirent(mddev->kobj.sd, NULL, "sync_action");
         } else if (mddev->ro == 2) /* auto-readonly not meaningful */
                 mddev->ro = 0;
 
         atomic_set(&mddev->writes_pending,0);
+        atomic_set(&mddev->max_corr_read_errors,
+                   MD_DEFAULT_MAX_CORRECTED_READ_ERRORS);
         mddev->safemode = 0;
         mddev->safemode_timer.function = md_safemode_timeout;
         mddev->safemode_timer.data = (unsigned long) mddev;
@@ -4205,49 +4527,32 @@ static int do_md_run(mddev_t * mddev)
         if (mddev->flags)
                 md_update_sb(mddev, 0);
 
-        set_capacity(disk, mddev->array_sectors);
-
-        /* If there is a partially-recovered drive we need to
-         * start recovery here.  If we leave it to md_check_recovery,
-         * it will remove the drives and not do the right thing
-         */
-        if (mddev->degraded && !mddev->sync_thread) {
-                int spares = 0;
-                list_for_each_entry(rdev, &mddev->disks, same_set)
-                        if (rdev->raid_disk >= 0 &&
-                            !test_bit(In_sync, &rdev->flags) &&
-                            !test_bit(Faulty, &rdev->flags))
-                                /* complete an interrupted recovery */
-                                spares++;
-                if (spares && mddev->pers->sync_request) {
-                        mddev->recovery = 0;
-                        set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
-                        mddev->sync_thread = md_register_thread(md_do_sync,
-                                                                mddev,
-                                                                "resync");
-                        if (!mddev->sync_thread) {
-                                printk(KERN_ERR "%s: could not start resync"
-                                       " thread...\n",
-                                       mdname(mddev));
-                                /* leave the spares where they are, it shouldn't hurt */
-                                mddev->recovery = 0;
-                        }
-                }
-        }
         md_wakeup_thread(mddev->thread);
         md_wakeup_thread(mddev->sync_thread); /* possibly kick off a reshape */
 
-        revalidate_disk(mddev->gendisk);
-        mddev->changed = 1;
         md_new_event(mddev);
         sysfs_notify_dirent(mddev->sysfs_state);
         if (mddev->sysfs_action)
                 sysfs_notify_dirent(mddev->sysfs_action);
         sysfs_notify(&mddev->kobj, NULL, "degraded");
-        kobject_uevent(&disk_to_dev(mddev->gendisk)->kobj, KOBJ_CHANGE);
         return 0;
 }
 
+static int do_md_run(mddev_t *mddev)
+{
+        int err;
+
+        err = md_run(mddev);
+        if (err)
+                goto out;
+
+        set_capacity(mddev->gendisk, mddev->array_sectors);
+        revalidate_disk(mddev->gendisk);
+        kobject_uevent(&disk_to_dev(mddev->gendisk)->kobj, KOBJ_CHANGE);
+out:
+        return err;
+}
+
 static int restart_array(mddev_t *mddev)
 {
         struct gendisk *disk = mddev->gendisk;
@@ -4289,7 +4594,7 @@ static int deny_bitmap_write_access(struct file * file)
         return 0;
 }
 
-static void restore_bitmap_write_access(struct file *file)
+void restore_bitmap_write_access(struct file *file)
 {
         struct inode *inode = file->f_mapping->host;
 
@@ -4298,9 +4603,110 @@ static void restore_bitmap_write_access(struct file *file)
         spin_unlock(&inode->i_lock);
 }
 
+static void md_clean(mddev_t *mddev)
+{
+        mddev->array_sectors = 0;
+        mddev->external_size = 0;
+        mddev->dev_sectors = 0;
+        mddev->raid_disks = 0;
+        mddev->recovery_cp = 0;
+        mddev->resync_min = 0;
+        mddev->resync_max = MaxSector;
+        mddev->reshape_position = MaxSector;
+        mddev->external = 0;
+        mddev->persistent = 0;
+        mddev->level = LEVEL_NONE;
+        mddev->clevel[0] = 0;
+        mddev->flags = 0;
+        mddev->ro = 0;
+        mddev->metadata_type[0] = 0;
+        mddev->chunk_sectors = 0;
+        mddev->ctime = mddev->utime = 0;
+        mddev->layout = 0;
+        mddev->max_disks = 0;
+        mddev->events = 0;
+        mddev->can_decrease_events = 0;
+        mddev->delta_disks = 0;
+        mddev->new_level = LEVEL_NONE;
+        mddev->new_layout = 0;
+        mddev->new_chunk_sectors = 0;
+        mddev->curr_resync = 0;
+        mddev->resync_mismatches = 0;
+        mddev->suspend_lo = mddev->suspend_hi = 0;
+        mddev->sync_speed_min = mddev->sync_speed_max = 0;
+        mddev->recovery = 0;
+        mddev->in_sync = 0;
+        mddev->degraded = 0;
+        mddev->barriers_work = 0;
+        mddev->safemode = 0;
+        mddev->bitmap_info.offset = 0;
+        mddev->bitmap_info.default_offset = 0;
+        mddev->bitmap_info.chunksize = 0;
+        mddev->bitmap_info.daemon_sleep = 0;
+        mddev->bitmap_info.max_write_behind = 0;
+}
+
+static void md_stop_writes(mddev_t *mddev)
+{
+        if (mddev->sync_thread) {
+                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+                md_unregister_thread(mddev->sync_thread);
+                mddev->sync_thread = NULL;
+        }
+
+        del_timer_sync(&mddev->safemode_timer);
+
+        bitmap_flush(mddev);
+        md_super_wait(mddev);
+
+        if (!mddev->in_sync || mddev->flags) {
+                /* mark array as shutdown cleanly */
+                mddev->in_sync = 1;
+                md_update_sb(mddev, 1);
+        }
+}
+
+static void md_stop(mddev_t *mddev)
+{
+        md_stop_writes(mddev);
+
+        mddev->pers->stop(mddev);
+        if (mddev->pers->sync_request && mddev->to_remove == NULL)
+                mddev->to_remove = &md_redundancy_group;
+        module_put(mddev->pers->owner);
+        mddev->pers = NULL;
+        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+}
+
+static int md_set_readonly(mddev_t *mddev, int is_open)
+{
+        int err = 0;
+        mutex_lock(&mddev->open_mutex);
+        if (atomic_read(&mddev->openers) > is_open) {
+                printk("md: %s still in use.\n",mdname(mddev));
+                err = -EBUSY;
+                goto out;
+        }
+        if (mddev->pers) {
+                md_stop_writes(mddev);
+
+                err  = -ENXIO;
+                if (mddev->ro==1)
+                        goto out;
+                mddev->ro = 1;
+                set_disk_ro(mddev->gendisk, 1);
+                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                sysfs_notify_dirent(mddev->sysfs_state);
+                err = 0;        
+        }
+out:
+        mutex_unlock(&mddev->open_mutex);
+        return err;
+}
+
 /* mode:
  *   0 - completely stop and dis-assemble array
- *   1 - switch to readonly
  *   2 - stop but do not disassemble array
  */
 static int do_md_stop(mddev_t * mddev, int mode, int is_open)
@@ -4315,64 +4721,32 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                 err = -EBUSY;
         } else if (mddev->pers) {
 
-                if (mddev->sync_thread) {
-                        set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
-                        md_unregister_thread(mddev->sync_thread);
-                        mddev->sync_thread = NULL;
-                }
-
-                del_timer_sync(&mddev->safemode_timer);
+                if (mddev->ro)
+                        set_disk_ro(disk, 0);
 
-                switch(mode) {
-                case 1: /* readonly */
-                        err  = -ENXIO;
-                        if (mddev->ro==1)
-                                goto out;
-                        mddev->ro = 1;
-                        break;
-                case 0: /* disassemble */
-                case 2: /* stop */
-                        bitmap_flush(mddev);
-                        md_super_wait(mddev);
-                        if (mddev->ro)
-                                set_disk_ro(disk, 0);
+                md_stop(mddev);
+                mddev->queue->merge_bvec_fn = NULL;
+                mddev->queue->unplug_fn = NULL;
+                mddev->queue->backing_dev_info.congested_fn = NULL;
 
-                        mddev->pers->stop(mddev);
-                        mddev->queue->merge_bvec_fn = NULL;
-                        mddev->queue->unplug_fn = NULL;
-                        mddev->queue->backing_dev_info.congested_fn = NULL;
-                        module_put(mddev->pers->owner);
-                        if (mddev->pers->sync_request)
-                                mddev->private = &md_redundancy_group;
-                        mddev->pers = NULL;
-                        /* tell userspace to handle 'inactive' */
-                        sysfs_notify_dirent(mddev->sysfs_state);
+                /* tell userspace to handle 'inactive' */
+                sysfs_notify_dirent(mddev->sysfs_state);
 
-                        list_for_each_entry(rdev, &mddev->disks, same_set)
-                                if (rdev->raid_disk >= 0) {
-                                        char nm[20];
-                                        sprintf(nm, "rd%d", rdev->raid_disk);
-                                        sysfs_remove_link(&mddev->kobj, nm);
-                                }
+                list_for_each_entry(rdev, &mddev->disks, same_set)
+                        if (rdev->raid_disk >= 0) {
+                                char nm[20];
+                                sprintf(nm, "rd%d", rdev->raid_disk);
+                                sysfs_remove_link(&mddev->kobj, nm);
+                        }
 
-                        set_capacity(disk, 0);
-                        mddev->changed = 1;
+                set_capacity(disk, 0);
+                revalidate_disk(disk);
 
-                        if (mddev->ro)
-                                mddev->ro = 0;
-                }
-                if (!mddev->in_sync || mddev->flags) {
-                        /* mark array as shutdown cleanly */
-                        mddev->in_sync = 1;
-                        md_update_sb(mddev, 1);
-                }
-                if (mode == 1)
-                        set_disk_ro(disk, 1);
-                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                if (mddev->ro)
+                        mddev->ro = 0;
+                
                 err = 0;
         }
-out:
         mutex_unlock(&mddev->open_mutex);
         if (err)
                 return err;
@@ -4384,59 +4758,21 @@ out:
                 printk(KERN_INFO "md: %s stopped.\n", mdname(mddev));
 
                 bitmap_destroy(mddev);
-                if (mddev->bitmap_file) {
-                        restore_bitmap_write_access(mddev->bitmap_file);
-                        fput(mddev->bitmap_file);
-                        mddev->bitmap_file = NULL;
+                if (mddev->bitmap_info.file) {
+                        restore_bitmap_write_access(mddev->bitmap_info.file);
+                        fput(mddev->bitmap_info.file);
+                        mddev->bitmap_info.file = NULL;
                 }
-                mddev->bitmap_offset = 0;
-
-                /* make sure all md_delayed_delete calls have finished */
-                flush_scheduled_work();
+                mddev->bitmap_info.offset = 0;
 
                 export_array(mddev);
 
-                mddev->array_sectors = 0;
-                mddev->external_size = 0;
-                mddev->dev_sectors = 0;
-                mddev->raid_disks = 0;
-                mddev->recovery_cp = 0;
-                mddev->resync_min = 0;
-                mddev->resync_max = MaxSector;
-                mddev->reshape_position = MaxSector;
-                mddev->external = 0;
-                mddev->persistent = 0;
-                mddev->level = LEVEL_NONE;
-                mddev->clevel[0] = 0;
-                mddev->flags = 0;
-                mddev->ro = 0;
-                mddev->metadata_type[0] = 0;
-                mddev->chunk_sectors = 0;
-                mddev->ctime = mddev->utime = 0;
-                mddev->layout = 0;
-                mddev->max_disks = 0;
-                mddev->events = 0;
-                mddev->delta_disks = 0;
-                mddev->new_level = LEVEL_NONE;
-                mddev->new_layout = 0;
-                mddev->new_chunk_sectors = 0;
-                mddev->curr_resync = 0;
-                mddev->resync_mismatches = 0;
-                mddev->suspend_lo = mddev->suspend_hi = 0;
-                mddev->sync_speed_min = mddev->sync_speed_max = 0;
-                mddev->recovery = 0;
-                mddev->in_sync = 0;
-                mddev->changed = 0;
-                mddev->degraded = 0;
-                mddev->barriers_work = 0;
-                mddev->safemode = 0;
+                md_clean(mddev);
                 kobject_uevent(&disk_to_dev(mddev->gendisk)->kobj, KOBJ_CHANGE);
                 if (mddev->hold_active == UNTIL_STOP)
                         mddev->hold_active = 0;
 
-        } else if (mddev->pers)
-                printk(KERN_INFO "md: %s switched to read-only mode.\n",
-                        mdname(mddev));
+        }
         err = 0;
         blk_integrity_unregister(disk);
         md_new_event(mddev);
@@ -4615,7 +4951,7 @@ static int get_array_info(mddev_t * mddev, void __user * arg)
         info.state         = 0;
         if (mddev->in_sync)
                 info.state = (1<<MD_SB_CLEAN);
-        if (mddev->bitmap && mddev->bitmap_offset)
+        if (mddev->bitmap && mddev->bitmap_info.offset)
                 info.state = (1<<MD_SB_BITMAP_PRESENT);
         info.active_disks  = insync;
         info.working_disks = working;
@@ -4973,23 +5309,23 @@ static int set_bitmap_file(mddev_t *mddev, int fd)
         if (fd >= 0) {
                 if (mddev->bitmap)
                         return -EEXIST; /* cannot add when bitmap is present */
-                mddev->bitmap_file = fget(fd);
+                mddev->bitmap_info.file = fget(fd);
 
-                if (mddev->bitmap_file == NULL) {
+                if (mddev->bitmap_info.file == NULL) {
                         printk(KERN_ERR "%s: error: failed to get bitmap file\n",
                                mdname(mddev));
                         return -EBADF;
                 }
 
-                err = deny_bitmap_write_access(mddev->bitmap_file);
+                err = deny_bitmap_write_access(mddev->bitmap_info.file);
                 if (err) {
                         printk(KERN_ERR "%s: error: bitmap file is already in use\n",
                                mdname(mddev));
-                        fput(mddev->bitmap_file);
-                        mddev->bitmap_file = NULL;
+                        fput(mddev->bitmap_info.file);
+                        mddev->bitmap_info.file = NULL;
                         return err;
                 }
-                mddev->bitmap_offset = 0; /* file overrides offset */
+                mddev->bitmap_info.offset = 0; /* file overrides offset */
         } else if (mddev->bitmap == NULL)
                 return -ENOENT; /* cannot remove what isn't there */
         err = 0;
@@ -5004,11 +5340,11 @@ static int set_bitmap_file(mddev_t *mddev, int fd)
                 mddev->pers->quiesce(mddev, 0);
         }
         if (fd < 0) {
-                if (mddev->bitmap_file) {
-                        restore_bitmap_write_access(mddev->bitmap_file);
-                        fput(mddev->bitmap_file);
+                if (mddev->bitmap_info.file) {
+                        restore_bitmap_write_access(mddev->bitmap_info.file);
+                        fput(mddev->bitmap_info.file);
                 }
-                mddev->bitmap_file = NULL;
+                mddev->bitmap_info.file = NULL;
         }
 
         return err;
@@ -5045,6 +5381,10 @@ static int set_array_info(mddev_t * mddev, mdu_array_info_t *info)
                 mddev->minor_version = info->minor_version;
                 mddev->patch_version = info->patch_version;
                 mddev->persistent = !info->not_persistent;
+                /* ensure mddev_put doesn't delete this now that there
+                 * is some minimal configuration.
+                 */
+                mddev->ctime         = get_seconds();
                 return 0;
         }
         mddev->major_version = MD_MAJOR_VERSION;
@@ -5075,8 +5415,8 @@ static int set_array_info(mddev_t * mddev, mdu_array_info_t *info)
                 mddev->flags         = 0;
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
 
-        mddev->default_bitmap_offset = MD_SB_BYTES >> 9;
-        mddev->bitmap_offset = 0;
+        mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
+        mddev->bitmap_info.offset = 0;
 
         mddev->reshape_position = MaxSector;
 
@@ -5150,7 +5490,7 @@ static int update_raid_disks(mddev_t *mddev, int raid_disks)
         if (mddev->pers->check_reshape == NULL)
                 return -EINVAL;
         if (raid_disks <= 0 ||
-            raid_disks >= mddev->max_disks)
+            (mddev->max_disks && raid_disks >= mddev->max_disks))
                 return -EINVAL;
         if (mddev->sync_thread || mddev->reshape_position != MaxSector)
                 return -EBUSY;
@@ -5176,7 +5516,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
         int state = 0;
 
         /* calculate expected state,ignoring low bits */
-        if (mddev->bitmap && mddev->bitmap_offset)
+        if (mddev->bitmap && mddev->bitmap_info.offset)
                 state |= (1 << MD_SB_BITMAP_PRESENT);
 
         if (mddev->major_version != info->major_version ||
@@ -5235,9 +5575,10 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
                         /* add the bitmap */
                         if (mddev->bitmap)
                                 return -EEXIST;
-                        if (mddev->default_bitmap_offset == 0)
+                        if (mddev->bitmap_info.default_offset == 0)
                                 return -EINVAL;
-                        mddev->bitmap_offset = mddev->default_bitmap_offset;
+                        mddev->bitmap_info.offset =
+                                mddev->bitmap_info.default_offset;
                         mddev->pers->quiesce(mddev, 1);
                         rv = bitmap_create(mddev);
                         if (rv)
@@ -5252,7 +5593,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
                         mddev->pers->quiesce(mddev, 1);
                         bitmap_destroy(mddev);
                         mddev->pers->quiesce(mddev, 0);
-                        mddev->bitmap_offset = 0;
+                        mddev->bitmap_info.offset = 0;
                 }
         }
         md_update_sb(mddev, 1);
@@ -5286,7 +5627,7 @@ static int md_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 
         geo->heads = 2;
         geo->sectors = 4;
-        geo->cylinders = get_capacity(mddev->gendisk) / 8;
+        geo->cylinders = mddev->array_sectors / 8;
         return 0;
 }
 
@@ -5296,6 +5637,7 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
         int err = 0;
         void __user *argp = (void __user *)arg;
         mddev_t *mddev = NULL;
+        int ro;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -5428,9 +5770,37 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
                         goto done_unlock;
 
                 case STOP_ARRAY_RO:
-                        err = do_md_stop(mddev, 1, 1);
+                        err = md_set_readonly(mddev, 1);
                         goto done_unlock;
 
+                case BLKROSET:
+                        if (get_user(ro, (int __user *)(arg))) {
+                                err = -EFAULT;
+                                goto done_unlock;
+                        }
+                        err = -EINVAL;
+
+                        /* if the bdev is going readonly the value of mddev->ro
+                         * does not matter, no writes are coming
+                         */
+                        if (ro)
+                                goto done_unlock;
+
+                        /* are we are already prepared for writes? */
+                        if (mddev->ro != 1)
+                                goto done_unlock;
+
+                        /* transitioning to readauto need only happen for
+                         * arrays that call md_write_start
+                         */
+                        if (mddev->pers) {
+                                err = restart_array(mddev);
+                                if (err == 0) {
+                                        mddev->ro = 2;
+                                        set_disk_ro(mddev->gendisk, 0);
+                                }
+                        }
+                        goto done_unlock;
         }
 
         /*
@@ -5503,6 +5873,25 @@ done:
 abort:
         return err;
 }
+#ifdef CONFIG_COMPAT
+static int md_compat_ioctl(struct block_device *bdev, fmode_t mode,
+                    unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case HOT_REMOVE_DISK:
+        case HOT_ADD_DISK:
+        case SET_DISK_FAULTY:
+        case SET_BITMAP_FILE:
+                /* These take in integer arg, do not convert */
+                break;
+        default:
+                arg = (unsigned long)compat_ptr(arg);
+                break;
+        }
+
+        return md_ioctl(bdev, mode, cmd, arg);
+}
+#endif /* CONFIG_COMPAT */
 
 static int md_open(struct block_device *bdev, fmode_t mode)
 {
@@ -5532,7 +5921,7 @@ static int md_open(struct block_device *bdev, fmode_t mode)
         atomic_inc(&mddev->openers);
         mutex_unlock(&mddev->open_mutex);
 
-        check_disk_change(bdev);
+        check_disk_size_change(mddev->gendisk, bdev);
  out:
         return err;
 }
@@ -5547,30 +5936,16 @@ static int md_release(struct gendisk *disk, fmode_t mode)
 
         return 0;
 }
-
-static int md_media_changed(struct gendisk *disk)
-{
-        mddev_t *mddev = disk->private_data;
-
-        return mddev->changed;
-}
-
-static int md_revalidate(struct gendisk *disk)
-{
-        mddev_t *mddev = disk->private_data;
-
-        mddev->changed = 0;
-        return 0;
-}
 static const struct block_device_operations md_fops =
 {
         .owner          = THIS_MODULE,
         .open           = md_open,
         .release        = md_release,
         .ioctl          = md_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = md_compat_ioctl,
+#endif
         .getgeo         = md_getgeo,
-        .media_changed  = md_media_changed,
-        .revalidate_disk= md_revalidate,
 };
 
 static int md_thread(void * arg)
@@ -5684,7 +6059,7 @@ void md_error(mddev_t *mddev, mdk_rdev_t *rdev)
         mddev->pers->error_handler(mddev,rdev);
         if (mddev->degraded)
                 set_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
-        set_bit(StateChanged, &rdev->flags);
+        sysfs_notify_dirent(rdev->sysfs_state);
         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         md_wakeup_thread(mddev->thread);
@@ -5961,14 +6336,14 @@ static int md_seq_show(struct seq_file *seq, void *v)
                         unsigned long chunk_kb;
                         unsigned long flags;
                         spin_lock_irqsave(&bitmap->lock, flags);
-                        chunk_kb = bitmap->chunksize >> 10;
+                        chunk_kb = mddev->bitmap_info.chunksize >> 10;
                         seq_printf(seq, "bitmap: %lu/%lu pages [%luKB], "
                                 "%lu%s chunk",
                                 bitmap->pages - bitmap->missing_pages,
                                 bitmap->pages,
                                 (bitmap->pages - bitmap->missing_pages)
                                         << (PAGE_SHIFT - 10),
-                                chunk_kb ? chunk_kb : bitmap->chunksize,
+                                chunk_kb ? chunk_kb : mddev->bitmap_info.chunksize,
                                 chunk_kb ? "KB" : "B");
                         if (bitmap->file) {
                                 seq_printf(seq, ", file: ");
@@ -6254,10 +6629,11 @@ void md_do_sync(mddev_t *mddev)
                 mddev->curr_resync = 2;
 
         try_again:
-                if (kthread_should_stop()) {
+                if (kthread_should_stop())
                         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
                         goto skip;
-                }
                 for_each_mddev(mddev2, tmp) {
                         if (mddev2 == mddev)
                                 continue;
@@ -6317,12 +6693,14 @@ void md_do_sync(mddev_t *mddev)
                 /* recovery follows the physical size of devices */
                 max_sectors = mddev->dev_sectors;
                 j = MaxSector;
-                list_for_each_entry(rdev, &mddev->disks, same_set)
+                rcu_read_lock();
+                list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
                         if (rdev->raid_disk >= 0 &&
                             !test_bit(Faulty, &rdev->flags) &&
                             !test_bit(In_sync, &rdev->flags) &&
                             rdev->recovery_offset < j)
                                 j = rdev->recovery_offset;
+                rcu_read_unlock();
         }
 
         printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
@@ -6359,6 +6737,7 @@ void md_do_sync(mddev_t *mddev)
                        desc, mdname(mddev));
                 mddev->curr_resync = j;
         }
+        mddev->curr_resync_completed = mddev->curr_resync;
 
         while (j < max_sectors) {
                 sector_t sectors;
@@ -6491,21 +6870,30 @@ void md_do_sync(mddev_t *mddev)
                 } else {
                         if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
                                 mddev->curr_resync = MaxSector;
-                        list_for_each_entry(rdev, &mddev->disks, same_set)
+                        rcu_read_lock();
+                        list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
                                 if (rdev->raid_disk >= 0 &&
+                                    mddev->delta_disks >= 0 &&
                                     !test_bit(Faulty, &rdev->flags) &&
                                     !test_bit(In_sync, &rdev->flags) &&
                                     rdev->recovery_offset < mddev->curr_resync)
                                         rdev->recovery_offset = mddev->curr_resync;
+                        rcu_read_unlock();
                 }
         }
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
 
  skip:
+        if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
+                /* We completed so min/max setting can be forgotten if used. */
+                if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
+                        mddev->resync_min = 0;
+                mddev->resync_max = MaxSector;
+        } else if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
+                mddev->resync_min = mddev->curr_resync_completed;
         mddev->curr_resync = 0;
-        mddev->curr_resync_completed = 0;
-        mddev->resync_min = 0;
-        mddev->resync_max = MaxSector;
+        if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
+                mddev->curr_resync_completed = 0;
         sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         wake_up(&resync_wait);
         set_bit(MD_RECOVERY_DONE, &mddev->recovery);
@@ -6568,6 +6956,7 @@ static int remove_and_add_spares(mddev_t *mddev)
                                                        nm, mdname(mddev));
                                         spares++;
                                         md_new_event(mddev);
+                                        set_bit(MD_CHANGE_DEVS, &mddev->flags);
                                 } else
                                         break;
                         }
@@ -6603,7 +6992,7 @@ void md_check_recovery(mddev_t *mddev)
 
 
         if (mddev->bitmap)
-                bitmap_daemon_work(mddev->bitmap);
+                bitmap_daemon_work(mddev);
 
         if (mddev->ro)
                 return;
@@ -6663,11 +7052,6 @@ void md_check_recovery(mddev_t *mddev)
                 if (mddev->flags)
                         md_update_sb(mddev, 0);
 
-                list_for_each_entry(rdev, &mddev->disks, same_set)
-                        if (test_and_clear_bit(StateChanged, &rdev->flags))
-                                sysfs_notify_dirent(rdev->sysfs_state);
-
-
                 if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) &&
                     !test_bit(MD_RECOVERY_DONE, &mddev->recovery)) {
                         /* resync/recovery still happening */
@@ -6804,7 +7188,7 @@ static int md_notify_reboot(struct notifier_block *this,
                                  * appears to still be in use.  Hence
                                  * the '100'.
                                  */
-                                do_md_stop(mddev, 1, 100);
+                                md_set_readonly(mddev, 100);
                                 mddev_unlock(mddev);
                         }
                 /*
@@ -6973,5 +7357,6 @@ EXPORT_SYMBOL(md_unregister_thread);
 EXPORT_SYMBOL(md_wakeup_thread);
 EXPORT_SYMBOL(md_check_recovery);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("MD RAID framework");
 MODULE_ALIAS("md");
 MODULE_ALIAS_BLOCKDEV_MAJOR(MD_MAJOR);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index f184b69ef337..10597bfec000 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -74,13 +74,13 @@ struct mdk_rdev_s
 #define Blocked         8               /* An error occured on an externally
                                          * managed array, don't allow writes
                                          * until it is cleared */
-#define StateChanged    9               /* Faulty or Blocked has changed during
-                                         * interrupt, so it needs to be
-                                         * notified by the thread */
         wait_queue_head_t blocked_wait;
 
         int desc_nr;                    /* descriptor index in the superblock */
         int raid_disk;                  /* role of device in array */
+        int new_raid_disk;              /* role that the device will have in
+                                         * the array after a level-change completes.
+                                         */
         int saved_raid_disk;            /* role that device used to have in the
                                          * array and could again if we did a partial
                                          * resync from the bitmap
@@ -97,6 +97,9 @@ struct mdk_rdev_s
         atomic_t        read_errors;    /* number of consecutive read errors that
                                          * we have tried to ignore.
                                          */
+        struct timespec last_read_error;        /* monotonic time since our
+                                                 * last read error
+                                                 */
         atomic_t        corrected_errors; /* number of corrected read errors,
                                            * for reporting to userspace and storing
                                            * in superblock.
@@ -150,6 +153,12 @@ struct mddev_s
         int                             external_size; /* size managed
                                                         * externally */
         __u64                           events;
+        /* If the last 'event' was simply a clean->dirty transition, and
+         * we didn't write it to the spares, then it is safe and simple
+         * to just decrement the event count on a dirty->clean transition.
+         * So we record that possibility here.
+         */
+        int                             can_decrease_events;
 
         char                            uuid[16];
 
@@ -237,7 +246,6 @@ struct mddev_s
         atomic_t                        active;         /* general refcount */
         atomic_t                        openers;        /* number of active opens */
 
-        int                             changed;        /* true if we might need to reread partition info */
         int                             degraded;       /* whether md should consider
                                                          * adding a spare
                                                          */
@@ -276,21 +284,40 @@ struct mddev_s
         atomic_t                        writes_pending; 
         struct request_queue            *queue; /* for plugging ... */
 
-        atomic_t                        write_behind; /* outstanding async IO */
-        unsigned int                    max_write_behind; /* 0 = sync */
-
         struct bitmap                   *bitmap; /* the bitmap for the device */
-        struct file                     *bitmap_file; /* the bitmap file */
-        long                            bitmap_offset; /* offset from superblock of
-                                                        * start of bitmap. May be
-                                                        * negative, but not '0'
-                                                        */
-        long                            default_bitmap_offset; /* this is the offset to use when
-                                                                * hot-adding a bitmap.  It should
-                                                                * eventually be settable by sysfs.
-                                                                */
-
+        struct {
+                struct file             *file; /* the bitmap file */
+                loff_t                  offset; /* offset from superblock of
+                                                 * start of bitmap. May be
+                                                 * negative, but not '0'
+                                                 * For external metadata, offset
+                                                 * from start of device. 
+                                                 */
+                loff_t                  default_offset; /* this is the offset to use when
+                                                         * hot-adding a bitmap.  It should
+                                                         * eventually be settable by sysfs.
+                                                         */
+                struct mutex            mutex;
+                unsigned long           chunksize;
+                unsigned long           daemon_sleep; /* how many seconds between updates? */
+                unsigned long           max_write_behind; /* write-behind mode */
+                int                     external;
+        } bitmap_info;
+
+        atomic_t                        max_corr_read_errors; /* max read retries */
         struct list_head                all_mddevs;
+
+        struct attribute_group          *to_remove;
+        /* Generic barrier handling.
+         * If there is a pending barrier request, all other
+         * writes are blocked while the devices are flushed.
+         * The last to finish a flush schedules a worker to
+         * submit the barrier request (without the barrier flag),
+         * then submit more flush requests.
+         */
+        struct bio *barrier;
+        atomic_t flush_pending;
+        struct work_struct barrier_work;
 };
 
 
@@ -312,7 +339,7 @@ struct mdk_personality
         int level;
         struct list_head list;
         struct module *owner;
-        int (*make_request)(struct request_queue *q, struct bio *bio);
+        int (*make_request)(mddev_t *mddev, struct bio *bio);
         int (*run)(mddev_t *mddev);
         int (*stop)(mddev_t *mddev);
         void (*status)(struct seq_file *seq, mddev_t *mddev);
@@ -353,7 +380,7 @@ struct md_sysfs_entry {
         ssize_t (*show)(mddev_t *, char *);
         ssize_t (*store)(mddev_t *, const char *, size_t);
 };
-
+extern struct attribute_group md_bitmap_group;
 
 static inline char * mdname (mddev_t * mddev)
 {
@@ -431,6 +458,7 @@ extern void md_done_sync(mddev_t *mddev, int blocks, int ok);
 extern void md_error(mddev_t *mddev, mdk_rdev_t *rdev);
 
 extern int mddev_congested(mddev_t *mddev, int bits);
+extern void md_barrier_request(mddev_t *mddev, struct bio *bio);
 extern void md_super_write(mddev_t *mddev, mdk_rdev_t *rdev,
                            sector_t sector, int size, struct page *page);
 extern void md_super_wait(mddev_t *mddev);
@@ -443,6 +471,8 @@ extern void md_wait_for_blocked_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern void md_set_array_sectors(mddev_t *mddev, sector_t array_sectors);
 extern int md_check_no_bitmap(mddev_t *mddev);
 extern int md_integrity_register(mddev_t *mddev);
-void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
+extern void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
+extern int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale);
+extern void restore_bitmap_write_access(struct file *file);
 
 #endif /* _MD_MD_H */
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index ee7646f974a0..410fb60699ac 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -22,6 +22,7 @@
 #include <linux/blkdev.h>
 #include <linux/raid/md_u.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "md.h"
 #include "multipath.h"
 
@@ -84,7 +85,7 @@ static void multipath_end_bh_io (struct multipath_bh *mp_bh, int err)
 static void multipath_end_request(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        struct multipath_bh * mp_bh = (struct multipath_bh *)(bio->bi_private);
+        struct multipath_bh *mp_bh = bio->bi_private;
         multipath_conf_t *conf = mp_bh->mddev->private;
         mdk_rdev_t *rdev = conf->multipaths[mp_bh->path].rdev;
 
@@ -135,17 +136,14 @@ static void multipath_unplug(struct request_queue *q)
 }
 
 
-static int multipath_make_request (struct request_queue *q, struct bio * bio)
+static int multipath_make_request(mddev_t *mddev, struct bio * bio)
 {
-        mddev_t *mddev = q->queuedata;
         multipath_conf_t *conf = mddev->private;
         struct multipath_bh * mp_bh;
         struct multipath_info *multipath;
-        const int rw = bio_data_dir(bio);
-        int cpu;
 
         if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-                bio_endio(bio, -EOPNOTSUPP);
+                md_barrier_request(mddev, bio);
                 return 0;
         }
 
@@ -154,12 +152,6 @@ static int multipath_make_request (struct request_queue *q, struct bio * bio)
         mp_bh->master_bio = bio;
         mp_bh->mddev = mddev;
 
-        cpu = part_stat_lock();
-        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bio));
-        part_stat_unlock();
-
         mp_bh->path = multipath_map(conf);
         if (mp_bh->path < 0) {
                 bio_endio(bio, -EIO);
@@ -301,14 +293,16 @@ static int multipath_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
                                           rdev->data_offset << 9);
 
                 /* as we don't honour merge_bvec_fn, we must never risk
-                 * violating it, so limit ->max_sector to one PAGE, as
-                 * a one page request is never in violation.
+                 * violating it, so limit ->max_segments to one, lying
+                 * within a single page.
                  * (Note: it is very unlikely that a device with
                  * merge_bvec_fn will be involved in multipath.)
                  */
-                        if (q->merge_bvec_fn &&
-                            queue_max_sectors(q) > (PAGE_SIZE>>9))
-                                blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
+                        if (q->merge_bvec_fn) {
+                                blk_queue_max_segments(mddev->queue, 1);
+                                blk_queue_segment_boundary(mddev->queue,
+                                                           PAGE_CACHE_SIZE - 1);
+                        }
 
                         conf->working_disks++;
                         mddev->degraded--;
@@ -476,9 +470,11 @@ static int multipath_run (mddev_t *mddev)
                 /* as we don't honour merge_bvec_fn, we must never risk
                  * violating it, not that we ever expect a device with
                  * a merge_bvec_fn to be involved in multipath */
-                if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-                    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                        blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
+                if (rdev->bdev->bd_disk->queue->merge_bvec_fn) {
+                        blk_queue_max_segments(mddev->queue, 1);
+                        blk_queue_segment_boundary(mddev->queue,
+                                                   PAGE_CACHE_SIZE - 1);
+                }
 
                 if (!test_bit(Faulty, &rdev->flags))
                         conf->working_disks++;
@@ -581,6 +577,7 @@ static void __exit multipath_exit (void)
 module_init(multipath_init);
 module_exit(multipath_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("simple multi-path personality for MD");
 MODULE_ALIAS("md-personality-7"); /* MULTIPATH */
 MODULE_ALIAS("md-multipath");
 MODULE_ALIAS("md-level--4");
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index d3a4ce06015a..563abed5a2cb 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -20,17 +20,20 @@
 
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "md.h"
 #include "raid0.h"
+#include "raid5.h"
 
 static void raid0_unplug(struct request_queue *q)
 {
         mddev_t *mddev = q->queuedata;
         raid0_conf_t *conf = mddev->private;
         mdk_rdev_t **devlist = conf->devlist;
+        int raid_disks = conf->strip_zone[0].nb_dev;
         int i;
 
-        for (i=0; i<mddev->raid_disks; i++) {
+        for (i=0; i < raid_disks; i++) {
                 struct request_queue *r_queue = bdev_get_queue(devlist[i]->bdev);
 
                 blk_unplug(r_queue);
@@ -42,12 +45,13 @@ static int raid0_congested(void *data, int bits)
         mddev_t *mddev = data;
         raid0_conf_t *conf = mddev->private;
         mdk_rdev_t **devlist = conf->devlist;
+        int raid_disks = conf->strip_zone[0].nb_dev;
         int i, ret = 0;
 
         if (mddev_congested(mddev, bits))
                 return 1;
 
-        for (i = 0; i < mddev->raid_disks && !ret ; i++) {
+        for (i = 0; i < raid_disks && !ret ; i++) {
                 struct request_queue *q = bdev_get_queue(devlist[i]->bdev);
 
                 ret |= bdi_congested(&q->backing_dev_info, bits);
@@ -65,16 +69,17 @@ static void dump_zones(mddev_t *mddev)
         sector_t zone_start = 0;
         char b[BDEVNAME_SIZE];
         raid0_conf_t *conf = mddev->private;
+        int raid_disks = conf->strip_zone[0].nb_dev;
         printk(KERN_INFO "******* %s configuration *********\n",
                 mdname(mddev));
         h = 0;
         for (j = 0; j < conf->nr_strip_zones; j++) {
                 printk(KERN_INFO "zone%d=[", j);
                 for (k = 0; k < conf->strip_zone[j].nb_dev; k++)
-                        printk("%s/",
-                        bdevname(conf->devlist[j*mddev->raid_disks
+                        printk(KERN_CONT "%s/",
+                        bdevname(conf->devlist[j*raid_disks
                                                 + k]->bdev, b));
-                printk("]\n");
+                printk(KERN_CONT "]\n");
 
                 zone_size  = conf->strip_zone[j].zone_end - zone_start;
                 printk(KERN_INFO "        zone offset=%llukb "
@@ -87,7 +92,7 @@ static void dump_zones(mddev_t *mddev)
         printk(KERN_INFO "**********************************\n\n");
 }
 
-static int create_strip_zones(mddev_t *mddev)
+static int create_strip_zones(mddev_t *mddev, raid0_conf_t **private_conf)
 {
         int i, c, err;
         sector_t curr_zone_end, sectors;
@@ -100,8 +105,9 @@ static int create_strip_zones(mddev_t *mddev)
         if (!conf)
                 return -ENOMEM;
         list_for_each_entry(rdev1, &mddev->disks, same_set) {
-                printk(KERN_INFO "raid0: looking at %s\n",
-                        bdevname(rdev1->bdev,b));
+                printk(KERN_INFO "md/raid0:%s: looking at %s\n",
+                       mdname(mddev),
+                       bdevname(rdev1->bdev, b));
                 c = 0;
 
                 /* round size to chunk_size */
@@ -110,14 +116,16 @@ static int create_strip_zones(mddev_t *mddev)
                 rdev1->sectors = sectors * mddev->chunk_sectors;
 
                 list_for_each_entry(rdev2, &mddev->disks, same_set) {
-                        printk(KERN_INFO "raid0:   comparing %s(%llu)",
+                        printk(KERN_INFO "md/raid0:%s:   comparing %s(%llu)",
+                               mdname(mddev),
                                bdevname(rdev1->bdev,b),
                                (unsigned long long)rdev1->sectors);
-                        printk(KERN_INFO " with %s(%llu)\n",
+                        printk(KERN_CONT " with %s(%llu)\n",
                                bdevname(rdev2->bdev,b),
                                (unsigned long long)rdev2->sectors);
                         if (rdev2 == rdev1) {
-                                printk(KERN_INFO "raid0:   END\n");
+                                printk(KERN_INFO "md/raid0:%s:   END\n",
+                                       mdname(mddev));
                                 break;
                         }
                         if (rdev2->sectors == rdev1->sectors) {
@@ -125,20 +133,24 @@ static int create_strip_zones(mddev_t *mddev)
                                  * Not unique, don't count it as a new
                                  * group
                                  */
-                                printk(KERN_INFO "raid0:   EQUAL\n");
+                                printk(KERN_INFO "md/raid0:%s:   EQUAL\n",
+                                       mdname(mddev));
                                 c = 1;
                                 break;
                         }
-                        printk(KERN_INFO "raid0:   NOT EQUAL\n");
+                        printk(KERN_INFO "md/raid0:%s:   NOT EQUAL\n",
+                               mdname(mddev));
                 }
                 if (!c) {
-                        printk(KERN_INFO "raid0:   ==> UNIQUE\n");
+                        printk(KERN_INFO "md/raid0:%s:   ==> UNIQUE\n",
+                               mdname(mddev));
                         conf->nr_strip_zones++;
-                        printk(KERN_INFO "raid0: %d zones\n",
-                                conf->nr_strip_zones);
+                        printk(KERN_INFO "md/raid0:%s: %d zones\n",
+                               mdname(mddev), conf->nr_strip_zones);
                 }
         }
-        printk(KERN_INFO "raid0: FINAL %d zones\n", conf->nr_strip_zones);
+        printk(KERN_INFO "md/raid0:%s: FINAL %d zones\n",
+               mdname(mddev), conf->nr_strip_zones);
         err = -ENOMEM;
         conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
                                 conf->nr_strip_zones, GFP_KERNEL);
@@ -161,14 +173,20 @@ static int create_strip_zones(mddev_t *mddev)
         list_for_each_entry(rdev1, &mddev->disks, same_set) {
                 int j = rdev1->raid_disk;
 
+                if (mddev->level == 10) {
+                        /* taking over a raid10-n2 array */
+                        j /= 2;
+                        rdev1->new_raid_disk = j;
+                }
+
                 if (j < 0 || j >= mddev->raid_disks) {
-                        printk(KERN_ERR "raid0: bad disk number %d - "
-                                "aborting!\n", j);
+                        printk(KERN_ERR "md/raid0:%s: bad disk number %d - "
+                               "aborting!\n", mdname(mddev), j);
                         goto abort;
                 }
                 if (dev[j]) {
-                        printk(KERN_ERR "raid0: multiple devices for %d - "
-                                "aborting!\n", j);
+                        printk(KERN_ERR "md/raid0:%s: multiple devices for %d - "
+                               "aborting!\n", mdname(mddev), j);
                         goto abort;
                 }
                 dev[j] = rdev1;
@@ -176,21 +194,22 @@ static int create_strip_zones(mddev_t *mddev)
                 disk_stack_limits(mddev->gendisk, rdev1->bdev,
                                   rdev1->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
-                 * violating it, so limit ->max_sector to one PAGE, as
-                 * a one page request is never in violation.
+                 * violating it, so limit ->max_segments to 1, lying within
+                 * a single page.
                  */
 
-                if (rdev1->bdev->bd_disk->queue->merge_bvec_fn &&
-                    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                        blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
-
+                if (rdev1->bdev->bd_disk->queue->merge_bvec_fn) {
+                        blk_queue_max_segments(mddev->queue, 1);
+                        blk_queue_segment_boundary(mddev->queue,
+                                                   PAGE_CACHE_SIZE - 1);
+                }
                 if (!smallest || (rdev1->sectors < smallest->sectors))
                         smallest = rdev1;
                 cnt++;
         }
         if (cnt != mddev->raid_disks) {
-                printk(KERN_ERR "raid0: too few disks (%d of %d) - "
-                        "aborting!\n", cnt, mddev->raid_disks);
+                printk(KERN_ERR "md/raid0:%s: too few disks (%d of %d) - "
+                       "aborting!\n", mdname(mddev), cnt, mddev->raid_disks);
                 goto abort;
         }
         zone->nb_dev = cnt;
@@ -206,39 +225,44 @@ static int create_strip_zones(mddev_t *mddev)
                 zone = conf->strip_zone + i;
                 dev = conf->devlist + i * mddev->raid_disks;
 
-                printk(KERN_INFO "raid0: zone %d\n", i);
+                printk(KERN_INFO "md/raid0:%s: zone %d\n",
+                       mdname(mddev), i);
                 zone->dev_start = smallest->sectors;
                 smallest = NULL;
                 c = 0;
 
                 for (j=0; j<cnt; j++) {
                         rdev = conf->devlist[j];
-                        printk(KERN_INFO "raid0: checking %s ...",
-                                bdevname(rdev->bdev, b));
+                        printk(KERN_INFO "md/raid0:%s: checking %s ...",
+                               mdname(mddev),
+                               bdevname(rdev->bdev, b));
                         if (rdev->sectors <= zone->dev_start) {
-                                printk(KERN_INFO " nope.\n");
+                                printk(KERN_CONT " nope.\n");
                                 continue;
                         }
-                        printk(KERN_INFO " contained as device %d\n", c);
+                        printk(KERN_CONT " contained as device %d\n", c);
                         dev[c] = rdev;
                         c++;
                         if (!smallest || rdev->sectors < smallest->sectors) {
                                 smallest = rdev;
-                                printk(KERN_INFO "  (%llu) is smallest!.\n",
-                                        (unsigned long long)rdev->sectors);
+                                printk(KERN_INFO "md/raid0:%s:  (%llu) is smallest!.\n",
+                                       mdname(mddev),
+                                       (unsigned long long)rdev->sectors);
                         }
                 }
 
                 zone->nb_dev = c;
                 sectors = (smallest->sectors - zone->dev_start) * c;
-                printk(KERN_INFO "raid0: zone->nb_dev: %d, sectors: %llu\n",
-                        zone->nb_dev, (unsigned long long)sectors);
+                printk(KERN_INFO "md/raid0:%s: zone->nb_dev: %d, sectors: %llu\n",
+                       mdname(mddev),
+                       zone->nb_dev, (unsigned long long)sectors);
 
                 curr_zone_end += sectors;
                 zone->zone_end = curr_zone_end;
 
-                printk(KERN_INFO "raid0: current zone start: %llu\n",
-                        (unsigned long long)smallest->sectors);
+                printk(KERN_INFO "md/raid0:%s: current zone start: %llu\n",
+                       mdname(mddev),
+                       (unsigned long long)smallest->sectors);
         }
         mddev->queue->unplug_fn = raid0_unplug;
         mddev->queue->backing_dev_info.congested_fn = raid0_congested;
@@ -249,7 +273,7 @@ static int create_strip_zones(mddev_t *mddev)
          * chunk size is a multiple of that sector size
          */
         if ((mddev->chunk_sectors << 9) % queue_logical_block_size(mddev->queue)) {
-                printk(KERN_ERR "%s chunk_size of %d not valid\n",
+                printk(KERN_ERR "md/raid0:%s: chunk_size of %d not valid\n",
                        mdname(mddev),
                        mddev->chunk_sectors << 9);
                 goto abort;
@@ -259,14 +283,15 @@ static int create_strip_zones(mddev_t *mddev)
         blk_queue_io_opt(mddev->queue,
                          (mddev->chunk_sectors << 9) * mddev->raid_disks);
 
-        printk(KERN_INFO "raid0: done.\n");
-        mddev->private = conf;
+        printk(KERN_INFO "md/raid0:%s: done.\n", mdname(mddev));
+        *private_conf = conf;
+
         return 0;
 abort:
         kfree(conf->strip_zone);
         kfree(conf->devlist);
         kfree(conf);
-        mddev->private = NULL;
+        *private_conf = NULL;
         return err;
 }
 
@@ -317,26 +342,34 @@ static sector_t raid0_size(mddev_t *mddev, sector_t sectors, int raid_disks)
 
 static int raid0_run(mddev_t *mddev)
 {
+        raid0_conf_t *conf;
         int ret;
 
         if (mddev->chunk_sectors == 0) {
-                printk(KERN_ERR "md/raid0: chunk size must be set.\n");
+                printk(KERN_ERR "md/raid0:%s: chunk size must be set.\n",
+                       mdname(mddev));
                 return -EINVAL;
         }
         if (md_check_no_bitmap(mddev))
                 return -EINVAL;
-        blk_queue_max_sectors(mddev->queue, mddev->chunk_sectors);
+        blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
         mddev->queue->queue_lock = &mddev->queue->__queue_lock;
 
-        ret = create_strip_zones(mddev);
-        if (ret < 0)
-                return ret;
+        /* if private is not null, we are here after takeover */
+        if (mddev->private == NULL) {
+                ret = create_strip_zones(mddev, &conf);
+                if (ret < 0)
+                        return ret;
+                mddev->private = conf;
+        }
+        conf = mddev->private;
 
         /* calculate array device size */
         md_set_array_sectors(mddev, raid0_size(mddev, 0, 0));
 
-        printk(KERN_INFO "raid0 : md_size is %llu sectors.\n",
-                (unsigned long long)mddev->array_sectors);
+        printk(KERN_INFO "md/raid0:%s: md_size is %llu sectors.\n",
+               mdname(mddev),
+               (unsigned long long)mddev->array_sectors);
         /* calculate the max read-ahead size.
          * For read-ahead of large files to be effective, we need to
          * readahead at least twice a whole stripe. i.e. number of devices
@@ -400,6 +433,7 @@ static mdk_rdev_t *map_sector(mddev_t *mddev, struct strip_zone *zone,
         unsigned int sect_in_chunk;
         sector_t chunk;
         raid0_conf_t *conf = mddev->private;
+        int raid_disks = conf->strip_zone[0].nb_dev;
         unsigned int chunk_sects = mddev->chunk_sectors;
 
         if (is_power_of_2(chunk_sects)) {
@@ -422,7 +456,7 @@ static mdk_rdev_t *map_sector(mddev_t *mddev, struct strip_zone *zone,
         *       + the position in the chunk
         */
         *sector_offset = (chunk * chunk_sects) + sect_in_chunk;
-        return conf->devlist[(zone - conf->strip_zone)*mddev->raid_disks
+        return conf->devlist[(zone - conf->strip_zone)*raid_disks
                              + sector_div(sector, zone->nb_dev)];
 }
 
@@ -442,27 +476,18 @@ static inline int is_io_in_chunk_boundary(mddev_t *mddev,
         }
 }
 
-static int raid0_make_request(struct request_queue *q, struct bio *bio)
+static int raid0_make_request(mddev_t *mddev, struct bio *bio)
 {
-        mddev_t *mddev = q->queuedata;
         unsigned int chunk_sects;
         sector_t sector_offset;
         struct strip_zone *zone;
         mdk_rdev_t *tmp_dev;
-        const int rw = bio_data_dir(bio);
-        int cpu;
 
         if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-                bio_endio(bio, -EOPNOTSUPP);
+                md_barrier_request(mddev, bio);
                 return 0;
         }
 
-        cpu = part_stat_lock();
-        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bio));
-        part_stat_unlock();
-
         chunk_sects = mddev->chunk_sectors;
         if (unlikely(!is_io_in_chunk_boundary(mddev, chunk_sects, bio))) {
                 sector_t sector = bio->bi_sector;
@@ -480,9 +505,9 @@ static int raid0_make_request(struct request_queue *q, struct bio *bio)
                 else
                         bp = bio_split(bio, chunk_sects -
                                        sector_div(sector, chunk_sects));
-                if (raid0_make_request(q, &bp->bio1))
+                if (raid0_make_request(mddev, &bp->bio1))
                         generic_make_request(&bp->bio1);
-                if (raid0_make_request(q, &bp->bio2))
+                if (raid0_make_request(mddev, &bp->bio2))
                         generic_make_request(&bp->bio2);
 
                 bio_pair_release(bp);
@@ -502,9 +527,10 @@ static int raid0_make_request(struct request_queue *q, struct bio *bio)
         return 1;
 
 bad_map:
-        printk("raid0_make_request bug: can't convert block across chunks"
-                " or bigger than %dk %llu %d\n", chunk_sects / 2,
-                (unsigned long long)bio->bi_sector, bio->bi_size >> 10);
+        printk("md/raid0:%s: make_request bug: can't convert block across chunks"
+               " or bigger than %dk %llu %d\n",
+               mdname(mddev), chunk_sects / 2,
+               (unsigned long long)bio->bi_sector, bio->bi_size >> 10);
 
         bio_io_error(bio);
         return 0;
@@ -517,6 +543,7 @@ static void raid0_status(struct seq_file *seq, mddev_t *mddev)
         int j, k, h;
         char b[BDEVNAME_SIZE];
         raid0_conf_t *conf = mddev->private;
+        int raid_disks = conf->strip_zone[0].nb_dev;
 
         sector_t zone_size;
         sector_t zone_start = 0;
@@ -527,7 +554,7 @@ static void raid0_status(struct seq_file *seq, mddev_t *mddev)
                 seq_printf(seq, "=[");
                 for (k = 0; k < conf->strip_zone[j].nb_dev; k++)
                         seq_printf(seq, "%s/", bdevname(
-                                conf->devlist[j*mddev->raid_disks + k]
+                                conf->devlist[j*raid_disks + k]
                                                 ->bdev, b));
 
                 zone_size  = conf->strip_zone[j].zone_end - zone_start;
@@ -542,6 +569,109 @@ static void raid0_status(struct seq_file *seq, mddev_t *mddev)
         return;
 }
 
+static void *raid0_takeover_raid45(mddev_t *mddev)
+{
+        mdk_rdev_t *rdev;
+        raid0_conf_t *priv_conf;
+
+        if (mddev->degraded != 1) {
+                printk(KERN_ERR "md/raid0:%s: raid5 must be degraded! Degraded disks: %d\n",
+                       mdname(mddev),
+                       mddev->degraded);
+                return ERR_PTR(-EINVAL);
+        }
+
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                /* check slot number for a disk */
+                if (rdev->raid_disk == mddev->raid_disks-1) {
+                        printk(KERN_ERR "md/raid0:%s: raid5 must have missing parity disk!\n",
+                               mdname(mddev));
+                        return ERR_PTR(-EINVAL);
+                }
+        }
+
+        /* Set new parameters */
+        mddev->new_level = 0;
+        mddev->new_layout = 0;
+        mddev->new_chunk_sectors = mddev->chunk_sectors;
+        mddev->raid_disks--;
+        mddev->delta_disks = -1;
+        /* make sure it will be not marked as dirty */
+        mddev->recovery_cp = MaxSector;
+
+        create_strip_zones(mddev, &priv_conf);
+        return priv_conf;
+}
+
+static void *raid0_takeover_raid10(mddev_t *mddev)
+{
+        raid0_conf_t *priv_conf;
+
+        /* Check layout:
+         *  - far_copies must be 1
+         *  - near_copies must be 2
+         *  - disks number must be even
+         *  - all mirrors must be already degraded
+         */
+        if (mddev->layout != ((1 << 8) + 2)) {
+                printk(KERN_ERR "md/raid0:%s:: Raid0 cannot takover layout: 0x%x\n",
+                       mdname(mddev),
+                       mddev->layout);
+                return ERR_PTR(-EINVAL);
+        }
+        if (mddev->raid_disks & 1) {
+                printk(KERN_ERR "md/raid0:%s: Raid0 cannot takover Raid10 with odd disk number.\n",
+                       mdname(mddev));
+                return ERR_PTR(-EINVAL);
+        }
+        if (mddev->degraded != (mddev->raid_disks>>1)) {
+                printk(KERN_ERR "md/raid0:%s: All mirrors must be already degraded!\n",
+                       mdname(mddev));
+                return ERR_PTR(-EINVAL);
+        }
+
+        /* Set new parameters */
+        mddev->new_level = 0;
+        mddev->new_layout = 0;
+        mddev->new_chunk_sectors = mddev->chunk_sectors;
+        mddev->delta_disks = - mddev->raid_disks / 2;
+        mddev->raid_disks += mddev->delta_disks;
+        mddev->degraded = 0;
+        /* make sure it will be not marked as dirty */
+        mddev->recovery_cp = MaxSector;
+
+        create_strip_zones(mddev, &priv_conf);
+        return priv_conf;
+}
+
+static void *raid0_takeover(mddev_t *mddev)
+{
+        /* raid0 can take over:
+         *  raid4 - if all data disks are active.
+         *  raid5 - providing it is Raid4 layout and one disk is faulty
+         *  raid10 - assuming we have all necessary active disks
+         */
+        if (mddev->level == 4)
+                return raid0_takeover_raid45(mddev);
+
+        if (mddev->level == 5) {
+                if (mddev->layout == ALGORITHM_PARITY_N)
+                        return raid0_takeover_raid45(mddev);
+
+                printk(KERN_ERR "md/raid0:%s: Raid can only takeover Raid5 with layout: %d\n",
+                       mdname(mddev), ALGORITHM_PARITY_N);
+        }
+
+        if (mddev->level == 10)
+                return raid0_takeover_raid10(mddev);
+
+        return ERR_PTR(-EINVAL);
+}
+
+static void raid0_quiesce(mddev_t *mddev, int state)
+{
+}
+
 static struct mdk_personality raid0_personality=
 {
         .name           = "raid0",
@@ -552,6 +682,8 @@ static struct mdk_personality raid0_personality=
         .stop           = raid0_stop,
         .status         = raid0_status,
         .size           = raid0_size,
+        .takeover       = raid0_takeover,
+        .quiesce        = raid0_quiesce,
 };
 
 static int __init raid0_init (void)
@@ -567,6 +699,7 @@ static void raid0_exit (void)
 module_init(raid0_init);
 module_exit(raid0_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID0 (striping) personality for MD");
 MODULE_ALIAS("md-personality-2"); /* RAID0 */
 MODULE_ALIAS("md-raid0");
 MODULE_ALIAS("md-level-0");
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d1b9bd5fd4f6..a948da8012de 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -31,6 +31,7 @@
  * Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
@@ -64,7 +65,7 @@ static void * r1bio_pool_alloc(gfp_t gfp_flags, void *data)
 
         /* allocate a r1bio with room for raid_disks entries in the bios array */
         r1_bio = kzalloc(size, gfp_flags);
-        if (!r1_bio)
+        if (!r1_bio && pi->mddev)
                 unplug_slaves(pi->mddev);
 
         return r1_bio;
@@ -262,7 +263,7 @@ static inline void update_head_pos(int disk, r1bio_t *r1_bio)
 static void raid1_end_read_request(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
+        r1bio_t *r1_bio = bio->bi_private;
         int mirror;
         conf_t *conf = r1_bio->mddev->private;
 
@@ -296,7 +297,8 @@ static void raid1_end_read_request(struct bio *bio, int error)
                  */
                 char b[BDEVNAME_SIZE];
                 if (printk_ratelimit())
-                        printk(KERN_ERR "raid1: %s: rescheduling sector %llu\n",
+                        printk(KERN_ERR "md/raid1:%s: %s: rescheduling sector %llu\n",
+                               mdname(conf->mddev),
                                bdevname(conf->mirrors[mirror].rdev->bdev,b), (unsigned long long)r1_bio->sector);
                 reschedule_retry(r1_bio);
         }
@@ -307,7 +309,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
 static void raid1_end_write_request(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
+        r1bio_t *r1_bio = bio->bi_private;
         int mirror, behind = test_bit(R1BIO_BehindIO, &r1_bio->state);
         conf_t *conf = r1_bio->mddev->private;
         struct bio *to_put = NULL;
@@ -417,7 +419,7 @@ static void raid1_end_write_request(struct bio *bio, int error)
  */
 static int read_balance(conf_t *conf, r1bio_t *r1_bio)
 {
-        const unsigned long this_sector = r1_bio->sector;
+        const sector_t this_sector = r1_bio->sector;
         int new_disk = conf->last_used, disk = new_disk;
         int wonly_disk = -1;
         const int sectors = r1_bio->sectors;
@@ -433,7 +435,7 @@ static int read_balance(conf_t *conf, r1bio_t *r1_bio)
  retry:
         if (conf->mddev->recovery_cp < MaxSector &&
             (this_sector + sectors >= conf->next_resync)) {
-                /* Choose the first operation device, for consistancy */
+                /* Choose the first operational device, for consistancy */
                 new_disk = 0;
 
                 for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev);
@@ -677,6 +679,7 @@ static void raise_barrier(conf_t *conf)
 static void lower_barrier(conf_t *conf)
 {
         unsigned long flags;
+        BUG_ON(conf->barrier <= 0);
         spin_lock_irqsave(&conf->resync_lock, flags);
         conf->barrier--;
         spin_unlock_irqrestore(&conf->resync_lock, flags);
@@ -772,9 +775,8 @@ do_sync_io:
         return NULL;
 }
 
-static int make_request(struct request_queue *q, struct bio * bio)
+static int make_request(mddev_t *mddev, struct bio * bio)
 {
-        mddev_t *mddev = q->queuedata;
         conf_t *conf = mddev->private;
         mirror_info_t *mirror;
         r1bio_t *r1_bio;
@@ -786,7 +788,6 @@ static int make_request(struct request_queue *q, struct bio * bio)
         struct page **behind_pages = NULL;
         const int rw = bio_data_dir(bio);
         const bool do_sync = bio_rw_flagged(bio, BIO_RW_SYNCIO);
-        int cpu;
         bool do_barriers;
         mdk_rdev_t *blocked_rdev;
 
@@ -801,6 +802,25 @@ static int make_request(struct request_queue *q, struct bio * bio)
 
         md_write_start(mddev, bio); /* wait on superblock update early */
 
+        if (bio_data_dir(bio) == WRITE &&
+            bio->bi_sector + bio->bi_size/512 > mddev->suspend_lo &&
+            bio->bi_sector < mddev->suspend_hi) {
+                /* As the suspend_* range is controlled by
+                 * userspace, we want an interruptible
+                 * wait.
+                 */
+                DEFINE_WAIT(w);
+                for (;;) {
+                        flush_signals(current);
+                        prepare_to_wait(&conf->wait_barrier,
+                                        &w, TASK_INTERRUPTIBLE);
+                        if (bio->bi_sector + bio->bi_size/512 <= mddev->suspend_lo ||
+                            bio->bi_sector >= mddev->suspend_hi)
+                                break;
+                        schedule();
+                }
+                finish_wait(&conf->wait_barrier, &w);
+        }
         if (unlikely(!mddev->barriers_work &&
                      bio_rw_flagged(bio, BIO_RW_BARRIER))) {
                 if (rw == WRITE)
@@ -813,12 +833,6 @@ static int make_request(struct request_queue *q, struct bio * bio)
 
         bitmap = mddev->bitmap;
 
-        cpu = part_stat_lock();
-        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bio));
-        part_stat_unlock();
-
         /*
          * make_request() can abort the operation when READA is being
          * used and no empty request is available.
@@ -845,6 +859,15 @@ static int make_request(struct request_queue *q, struct bio * bio)
                 }
                 mirror = conf->mirrors + rdisk;
 
+                if (test_bit(WriteMostly, &mirror->rdev->flags) &&
+                    bitmap) {
+                        /* Reading from a write-mostly device must
+                         * take care not to over-take any writes
+                         * that are 'behind'
+                         */
+                        wait_event(bitmap->behind_wait,
+                                   atomic_read(&bitmap->behind_writes) == 0);
+                }
                 r1_bio->read_disk = rdisk;
 
                 read_bio = bio_clone(bio, GFP_NOIO);
@@ -891,9 +914,10 @@ static int make_request(struct request_queue *q, struct bio * bio)
                         if (test_bit(Faulty, &rdev->flags)) {
                                 rdev_dec_pending(rdev, mddev);
                                 r1_bio->bios[i] = NULL;
-                        } else
+                        } else {
                                 r1_bio->bios[i] = bio;
-                        targets++;
+                                targets++;
+                        }
                 } else
                         r1_bio->bios[i] = NULL;
         }
@@ -921,9 +945,14 @@ static int make_request(struct request_queue *q, struct bio * bio)
                 set_bit(R1BIO_Degraded, &r1_bio->state);
         }
 
-        /* do behind I/O ? */
+        /* do behind I/O ?
+         * Not if there are too many, or cannot allocate memory,
+         * or a reader on WriteMostly is waiting for behind writes 
+         * to flush */
         if (bitmap &&
-            atomic_read(&bitmap->behind_writes) < bitmap->max_write_behind &&
+            (atomic_read(&bitmap->behind_writes)
+             < mddev->bitmap_info.max_write_behind) &&
+            !waitqueue_active(&bitmap->behind_wait) &&
             (behind_pages = alloc_behind_pages(bio)) != NULL)
                 set_bit(R1BIO_BehindIO, &r1_bio->state);
 
@@ -1048,21 +1077,22 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
         } else
                 set_bit(Faulty, &rdev->flags);
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
-        printk(KERN_ALERT "raid1: Disk failure on %s, disabling device.\n"
-                "raid1: Operation continuing on %d devices.\n",
-                bdevname(rdev->bdev,b), conf->raid_disks - mddev->degraded);
+        printk(KERN_ALERT "md/raid1:%s: Disk failure on %s, disabling device.\n"
+               KERN_ALERT "md/raid1:%s: Operation continuing on %d devices.\n",
+               mdname(mddev), bdevname(rdev->bdev, b),
+               mdname(mddev), conf->raid_disks - mddev->degraded);
 }
 
 static void print_conf(conf_t *conf)
 {
         int i;
 
-        printk("RAID1 conf printout:\n");
+        printk(KERN_DEBUG "RAID1 conf printout:\n");
         if (!conf) {
-                printk("(!conf)\n");
+                printk(KERN_DEBUG "(!conf)\n");
                 return;
         }
-        printk(" --- wd:%d rd:%d\n", conf->raid_disks - conf->mddev->degraded,
+        printk(KERN_DEBUG " --- wd:%d rd:%d\n", conf->raid_disks - conf->mddev->degraded,
                 conf->raid_disks);
 
         rcu_read_lock();
@@ -1070,7 +1100,7 @@ static void print_conf(conf_t *conf)
                 char b[BDEVNAME_SIZE];
                 mdk_rdev_t *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev)
-                        printk(" disk %d, wo:%d, o:%d, dev:%s\n",
+                        printk(KERN_DEBUG " disk %d, wo:%d, o:%d, dev:%s\n",
                                i, !test_bit(In_sync, &rdev->flags),
                                !test_bit(Faulty, &rdev->flags),
                                bdevname(rdev->bdev,b));
@@ -1131,13 +1161,17 @@ static int raid1_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
 
                         disk_stack_limits(mddev->gendisk, rdev->bdev,
                                           rdev->data_offset << 9);
-                        /* as we don't honour merge_bvec_fn, we must never risk
-                         * violating it, so limit ->max_sector to one PAGE, as
-                         * a one page request is never in violation.
+                        /* as we don't honour merge_bvec_fn, we must
+                         * never risk violating it, so limit
+                         * ->max_segments to one lying with a single
+                         * page, as a one page request is never in
+                         * violation.
                          */
-                        if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-                            queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                                blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
+                        if (rdev->bdev->bd_disk->queue->merge_bvec_fn) {
+                                blk_queue_max_segments(mddev->queue, 1);
+                                blk_queue_segment_boundary(mddev->queue,
+                                                           PAGE_CACHE_SIZE - 1);
+                        }
 
                         p->head_position = 0;
                         rdev->raid_disk = mirror;
@@ -1197,7 +1231,7 @@ abort:
 
 static void end_sync_read(struct bio *bio, int error)
 {
-        r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
+        r1bio_t *r1_bio = bio->bi_private;
         int i;
 
         for (i=r1_bio->mddev->raid_disks; i--; )
@@ -1220,7 +1254,7 @@ static void end_sync_read(struct bio *bio, int error)
 static void end_sync_write(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
+        r1bio_t *r1_bio = bio->bi_private;
         mddev_t *mddev = r1_bio->mddev;
         conf_t *conf = mddev->private;
         int i;
@@ -1427,9 +1461,10 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                                 char b[BDEVNAME_SIZE];
                                 /* Cannot read from anywhere, array is toast */
                                 md_error(mddev, conf->mirrors[r1_bio->read_disk].rdev);
-                                printk(KERN_ALERT "raid1: %s: unrecoverable I/O read error"
+                                printk(KERN_ALERT "md/raid1:%s: %s: unrecoverable I/O read error"
                                        " for block %llu\n",
-                                       bdevname(bio->bi_bdev,b),
+                                       mdname(mddev),
+                                       bdevname(bio->bi_bdev, b),
                                        (unsigned long long)r1_bio->sector);
                                 md_done_sync(mddev, r1_bio->sectors, 0);
                                 put_buf(r1_bio);
@@ -1551,7 +1586,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
                                 else {
                                         atomic_add(s, &rdev->corrected_errors);
                                         printk(KERN_INFO
-                                               "raid1:%s: read error corrected "
+                                               "md/raid1:%s: read error corrected "
                                                "(%d sectors at %llu on %s)\n",
                                                mdname(mddev), s,
                                                (unsigned long long)(sect +
@@ -1650,13 +1685,15 @@ static void raid1d(mddev_t *mddev)
                                                r1_bio->sector,
                                                r1_bio->sectors);
                                 unfreeze_array(conf);
-                        }
+                        } else
+                                md_error(mddev,
+                                         conf->mirrors[r1_bio->read_disk].rdev);
 
                         bio = r1_bio->bios[r1_bio->read_disk];
-                        if ((disk=read_balance(conf, r1_bio)) == -1 ||
-                            disk == r1_bio->read_disk) {
-                                printk(KERN_ALERT "raid1: %s: unrecoverable I/O"
+                        if ((disk=read_balance(conf, r1_bio)) == -1) {
+                                printk(KERN_ALERT "md/raid1:%s: %s: unrecoverable I/O"
                                        " read error for block %llu\n",
+                                       mdname(mddev),
                                        bdevname(bio->bi_bdev,b),
                                        (unsigned long long)r1_bio->sector);
                                 raid_end_bio_io(r1_bio);
@@ -1670,10 +1707,11 @@ static void raid1d(mddev_t *mddev)
                                 r1_bio->bios[r1_bio->read_disk] = bio;
                                 rdev = conf->mirrors[disk].rdev;
                                 if (printk_ratelimit())
-                                        printk(KERN_ERR "raid1: %s: redirecting sector %llu to"
-                                               " another mirror\n",
-                                               bdevname(rdev->bdev,b),
-                                               (unsigned long long)r1_bio->sector);
+                                        printk(KERN_ERR "md/raid1:%s: redirecting sector %llu to"
+                                               " other mirror: %s\n",
+                                               mdname(mddev),
+                                               (unsigned long long)r1_bio->sector,
+                                               bdevname(rdev->bdev,b));
                                 bio->bi_sector = r1_bio->sector + rdev->data_offset;
                                 bio->bi_bdev = rdev->bdev;
                                 bio->bi_end_io = raid1_end_read_request;
@@ -1683,6 +1721,7 @@ static void raid1d(mddev_t *mddev)
                                 generic_make_request(bio);
                         }
                 }
+                cond_resched();
         }
         if (unplug)
                 unplug_slaves(mddev);
@@ -1727,13 +1766,8 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         int still_degraded = 0;
 
         if (!conf->r1buf_pool)
-        {
-/*
-                printk("sync start - bitmap %p\n", mddev->bitmap);
-*/
                 if (init_resync(conf))
                         return 0;
-        }
 
         max_sector = mddev->dev_sectors;
         if (sector_nr >= max_sector) {
@@ -1939,73 +1973,48 @@ static sector_t raid1_size(mddev_t *mddev, sector_t sectors, int raid_disks)
         return mddev->dev_sectors;
 }
 
-static int run(mddev_t *mddev)
+static conf_t *setup_conf(mddev_t *mddev)
 {
         conf_t *conf;
-        int i, j, disk_idx;
+        int i;
         mirror_info_t *disk;
         mdk_rdev_t *rdev;
+        int err = -ENOMEM;
 
-        if (mddev->level != 1) {
-                printk("raid1: %s: raid level not set to mirroring (%d)\n",
-                       mdname(mddev), mddev->level);
-                goto out;
-        }
-        if (mddev->reshape_position != MaxSector) {
-                printk("raid1: %s: reshape_position set but not supported\n",
-                       mdname(mddev));
-                goto out;
-        }
-        /*
-         * copy the already verified devices into our private RAID1
-         * bookkeeping area. [whatever we allocate in run(),
-         * should be freed in stop()]
-         */
         conf = kzalloc(sizeof(conf_t), GFP_KERNEL);
-        mddev->private = conf;
         if (!conf)
-                goto out_no_mem;
+                goto abort;
 
         conf->mirrors = kzalloc(sizeof(struct mirror_info)*mddev->raid_disks,
                                  GFP_KERNEL);
         if (!conf->mirrors)
-                goto out_no_mem;
+                goto abort;
 
         conf->tmppage = alloc_page(GFP_KERNEL);
         if (!conf->tmppage)
-                goto out_no_mem;
+                goto abort;
 
-        conf->poolinfo = kmalloc(sizeof(*conf->poolinfo), GFP_KERNEL);
+        conf->poolinfo = kzalloc(sizeof(*conf->poolinfo), GFP_KERNEL);
         if (!conf->poolinfo)
-                goto out_no_mem;
-        conf->poolinfo->mddev = mddev;
+                goto abort;
         conf->poolinfo->raid_disks = mddev->raid_disks;
         conf->r1bio_pool = mempool_create(NR_RAID1_BIOS, r1bio_pool_alloc,
                                           r1bio_pool_free,
                                           conf->poolinfo);
         if (!conf->r1bio_pool)
-                goto out_no_mem;
+                goto abort;
 
-        spin_lock_init(&conf->device_lock);
-        mddev->queue->queue_lock = &conf->device_lock;
+        conf->poolinfo->mddev = mddev;
 
+        spin_lock_init(&conf->device_lock);
         list_for_each_entry(rdev, &mddev->disks, same_set) {
-                disk_idx = rdev->raid_disk;
+                int disk_idx = rdev->raid_disk;
                 if (disk_idx >= mddev->raid_disks
                     || disk_idx < 0)
                         continue;
                 disk = conf->mirrors + disk_idx;
 
                 disk->rdev = rdev;
-                disk_stack_limits(mddev->gendisk, rdev->bdev,
-                                  rdev->data_offset << 9);
-                /* as we don't honour merge_bvec_fn, we must never risk
-                 * violating it, so limit ->max_sector to one PAGE, as
-                 * a one page request is never in violation.
-                 */
-                if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-                    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                        blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
 
                 disk->head_position = 0;
         }
@@ -2019,8 +2028,7 @@ static int run(mddev_t *mddev)
         bio_list_init(&conf->pending_bio_list);
         bio_list_init(&conf->flushing_bio_list);
 
-
-        mddev->degraded = 0;
+        conf->last_used = -1;
         for (i = 0; i < conf->raid_disks; i++) {
 
                 disk = conf->mirrors + i;
@@ -2028,49 +2036,115 @@ static int run(mddev_t *mddev)
                 if (!disk->rdev ||
                     !test_bit(In_sync, &disk->rdev->flags)) {
                         disk->head_position = 0;
-                        mddev->degraded++;
                         if (disk->rdev)
                                 conf->fullsync = 1;
-                }
+                } else if (conf->last_used < 0)
+                        /*
+                         * The first working device is used as a
+                         * starting point to read balancing.
+                         */
+                        conf->last_used = i;
         }
-        if (mddev->degraded == conf->raid_disks) {
-                printk(KERN_ERR "raid1: no operational mirrors for %s\n",
-                        mdname(mddev));
-                goto out_free_conf;
+
+        err = -EIO;
+        if (conf->last_used < 0) {
+                printk(KERN_ERR "md/raid1:%s: no operational mirrors\n",
+                       mdname(mddev));
+                goto abort;
+        }
+        err = -ENOMEM;
+        conf->thread = md_register_thread(raid1d, mddev, NULL);
+        if (!conf->thread) {
+                printk(KERN_ERR
+                       "md/raid1:%s: couldn't allocate thread\n",
+                       mdname(mddev));
+                goto abort;
         }
-        if (conf->raid_disks - mddev->degraded == 1)
-                mddev->recovery_cp = MaxSector;
 
+        return conf;
+
+ abort:
+        if (conf) {
+                if (conf->r1bio_pool)
+                        mempool_destroy(conf->r1bio_pool);
+                kfree(conf->mirrors);
+                safe_put_page(conf->tmppage);
+                kfree(conf->poolinfo);
+                kfree(conf);
+        }
+        return ERR_PTR(err);
+}
+
+static int run(mddev_t *mddev)
+{
+        conf_t *conf;
+        int i;
+        mdk_rdev_t *rdev;
+
+        if (mddev->level != 1) {
+                printk(KERN_ERR "md/raid1:%s: raid level not set to mirroring (%d)\n",
+                       mdname(mddev), mddev->level);
+                return -EIO;
+        }
+        if (mddev->reshape_position != MaxSector) {
+                printk(KERN_ERR "md/raid1:%s: reshape_position set but not supported\n",
+                       mdname(mddev));
+                return -EIO;
+        }
         /*
-         * find the first working one and use it as a starting point
-         * to read balancing.
+         * copy the already verified devices into our private RAID1
+         * bookkeeping area. [whatever we allocate in run(),
+         * should be freed in stop()]
          */
-        for (j = 0; j < conf->raid_disks &&
-                     (!conf->mirrors[j].rdev ||
-                      !test_bit(In_sync, &conf->mirrors[j].rdev->flags)) ; j++)
-                /* nothing */;
-        conf->last_used = j;
+        if (mddev->private == NULL)
+                conf = setup_conf(mddev);
+        else
+                conf = mddev->private;
 
+        if (IS_ERR(conf))
+                return PTR_ERR(conf);
 
-        mddev->thread = md_register_thread(raid1d, mddev, NULL);
-        if (!mddev->thread) {
-                printk(KERN_ERR
-                       "raid1: couldn't allocate thread for %s\n",
-                       mdname(mddev));
-                goto out_free_conf;
+        mddev->queue->queue_lock = &conf->device_lock;
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
+                                  rdev->data_offset << 9);
+                /* as we don't honour merge_bvec_fn, we must never risk
+                 * violating it, so limit ->max_segments to 1 lying within
+                 * a single page, as a one page request is never in violation.
+                 */
+                if (rdev->bdev->bd_disk->queue->merge_bvec_fn) {
+                        blk_queue_max_segments(mddev->queue, 1);
+                        blk_queue_segment_boundary(mddev->queue,
+                                                   PAGE_CACHE_SIZE - 1);
+                }
         }
 
+        mddev->degraded = 0;
+        for (i=0; i < conf->raid_disks; i++)
+                if (conf->mirrors[i].rdev == NULL ||
+                    !test_bit(In_sync, &conf->mirrors[i].rdev->flags) ||
+                    test_bit(Faulty, &conf->mirrors[i].rdev->flags))
+                        mddev->degraded++;
+
+        if (conf->raid_disks - mddev->degraded == 1)
+                mddev->recovery_cp = MaxSector;
+
         if (mddev->recovery_cp != MaxSector)
-                printk(KERN_NOTICE "raid1: %s is not clean"
+                printk(KERN_NOTICE "md/raid1:%s: not clean"
                        " -- starting background reconstruction\n",
                        mdname(mddev));
         printk(KERN_INFO 
-                "raid1: raid set %s active with %d out of %d mirrors\n",
+                "md/raid1:%s: active with %d out of %d mirrors\n",
                 mdname(mddev), mddev->raid_disks - mddev->degraded, 
                 mddev->raid_disks);
+
         /*
          * Ok, everything is just fine now
          */
+        mddev->thread = conf->thread;
+        conf->thread = NULL;
+        mddev->private = conf;
+
         md_set_array_sectors(mddev, raid1_size(mddev, 0, 0));
 
         mddev->queue->unplug_fn = raid1_unplug;
@@ -2078,38 +2152,20 @@ static int run(mddev_t *mddev)
         mddev->queue->backing_dev_info.congested_data = mddev;
         md_integrity_register(mddev);
         return 0;
-
-out_no_mem:
-        printk(KERN_ERR "raid1: couldn't allocate memory for %s\n",
-               mdname(mddev));
-
-out_free_conf:
-        if (conf) {
-                if (conf->r1bio_pool)
-                        mempool_destroy(conf->r1bio_pool);
-                kfree(conf->mirrors);
-                safe_put_page(conf->tmppage);
-                kfree(conf->poolinfo);
-                kfree(conf);
-                mddev->private = NULL;
-        }
-out:
-        return -EIO;
 }
 
 static int stop(mddev_t *mddev)
 {
         conf_t *conf = mddev->private;
         struct bitmap *bitmap = mddev->bitmap;
-        int behind_wait = 0;
 
         /* wait for behind writes to complete */
-        while (bitmap && atomic_read(&bitmap->behind_writes) > 0) {
-                behind_wait++;
-                printk(KERN_INFO "raid1: behind writes in progress on device %s, waiting to stop (%d)\n", mdname(mddev), behind_wait);
-                set_current_state(TASK_UNINTERRUPTIBLE);
-                schedule_timeout(HZ); /* wait a second */
+        if (bitmap && atomic_read(&bitmap->behind_writes) > 0) {
+                printk(KERN_INFO "md/raid1:%s: behind writes in progress - waiting to stop.\n",
+                       mdname(mddev));
                 /* need to kick something here to make sure I/O goes? */
+                wait_event(bitmap->behind_wait,
+                           atomic_read(&bitmap->behind_writes) == 0);
         }
 
         raise_barrier(conf);
@@ -2140,7 +2196,6 @@ static int raid1_resize(mddev_t *mddev, sector_t sectors)
         if (mddev->array_sectors > raid1_size(mddev, sectors, 0))
                 return -EINVAL;
         set_capacity(mddev->gendisk, mddev->array_sectors);
-        mddev->changed = 1;
         revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp == MaxSector) {
@@ -2235,9 +2290,9 @@ static int raid1_reshape(mddev_t *mddev)
                         if (sysfs_create_link(&mddev->kobj,
                                               &rdev->kobj, nm))
                                 printk(KERN_WARNING
-                                       "md/raid1: cannot register "
-                                       "%s for %s\n",
-                                       nm, mdname(mddev));
+                                       "md/raid1:%s: cannot register "
+                                       "%s\n",
+                                       mdname(mddev), nm);
                 }
                 if (rdev)
                         newmirrors[d2++].rdev = rdev;
@@ -2268,6 +2323,9 @@ static void raid1_quiesce(mddev_t *mddev, int state)
         conf_t *conf = mddev->private;
 
         switch(state) {
+        case 2: /* wake for suspend */
+                wake_up(&conf->wait_barrier);
+                break;
         case 1:
                 raise_barrier(conf);
                 break;
@@ -2277,6 +2335,23 @@ static void raid1_quiesce(mddev_t *mddev, int state)
         }
 }
 
+static void *raid1_takeover(mddev_t *mddev)
+{
+        /* raid1 can take over:
+         *  raid5 with 2 devices, any layout or chunk size
+         */
+        if (mddev->level == 5 && mddev->raid_disks == 2) {
+                conf_t *conf;
+                mddev->new_level = 1;
+                mddev->new_layout = 0;
+                mddev->new_chunk_sectors = 0;
+                conf = setup_conf(mddev);
+                if (!IS_ERR(conf))
+                        conf->barrier = 1;
+                return conf;
+        }
+        return ERR_PTR(-EINVAL);
+}
 
 static struct mdk_personality raid1_personality =
 {
@@ -2296,6 +2371,7 @@ static struct mdk_personality raid1_personality =
         .size           = raid1_size,
         .check_reshape  = raid1_reshape,
         .quiesce        = raid1_quiesce,
+        .takeover       = raid1_takeover,
 };
 
 static int __init raid_init(void)
@@ -2311,6 +2387,7 @@ static void raid_exit(void)
 module_init(raid_init);
 module_exit(raid_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID1 (mirroring) personality for MD");
 MODULE_ALIAS("md-personality-3"); /* RAID1 */
 MODULE_ALIAS("md-raid1");
 MODULE_ALIAS("md-level-1");
diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h
index e87b84deff68..5f2d443ae28a 100644
--- a/drivers/md/raid1.h
+++ b/drivers/md/raid1.h
@@ -59,6 +59,11 @@ struct r1_private_data_s {
 
         mempool_t *r1bio_pool;
         mempool_t *r1buf_pool;
+
+        /* When taking over an array from a different personality, we store
+         * the new thread here until we fully activate the array.
+         */
+        struct mdk_thread_s     *thread;
 };
 
 typedef struct r1_private_data_s conf_t;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 51c4c5c4d87a..42e64e4e5e25 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -18,11 +18,13 @@
  * Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
 #include "md.h"
 #include "raid10.h"
+#include "raid0.h"
 #include "bitmap.h"
 
 /*
@@ -68,7 +70,7 @@ static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 
         /* allocate a r10bio with room for raid_disks entries in the bios array */
         r10_bio = kzalloc(size, gfp_flags);
-        if (!r10_bio)
+        if (!r10_bio && conf->mddev)
                 unplug_slaves(conf->mddev);
 
         return r10_bio;
@@ -254,7 +256,7 @@ static inline void update_head_pos(int slot, r10bio_t *r10_bio)
 static void raid10_end_read_request(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        r10bio_t * r10_bio = (r10bio_t *)(bio->bi_private);
+        r10bio_t *r10_bio = bio->bi_private;
         int slot, dev;
         conf_t *conf = r10_bio->mddev->private;
 
@@ -284,7 +286,8 @@ static void raid10_end_read_request(struct bio *bio, int error)
                  */
                 char b[BDEVNAME_SIZE];
                 if (printk_ratelimit())
-                        printk(KERN_ERR "raid10: %s: rescheduling sector %llu\n",
+                        printk(KERN_ERR "md/raid10:%s: %s: rescheduling sector %llu\n",
+                               mdname(conf->mddev),
                                bdevname(conf->mirrors[dev].rdev->bdev,b), (unsigned long long)r10_bio->sector);
                 reschedule_retry(r10_bio);
         }
@@ -295,7 +298,7 @@ static void raid10_end_read_request(struct bio *bio, int error)
 static void raid10_end_write_request(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        r10bio_t * r10_bio = (r10bio_t *)(bio->bi_private);
+        r10bio_t *r10_bio = bio->bi_private;
         int slot, dev;
         conf_t *conf = r10_bio->mddev->private;
 
@@ -493,7 +496,7 @@ static int raid10_mergeable_bvec(struct request_queue *q,
  */
 static int read_balance(conf_t *conf, r10bio_t *r10_bio)
 {
-        const unsigned long this_sector = r10_bio->sector;
+        const sector_t this_sector = r10_bio->sector;
         int disk, slot, nslot;
         const int sectors = r10_bio->sectors;
         sector_t new_distance, current_distance;
@@ -600,7 +603,7 @@ static void unplug_slaves(mddev_t *mddev)
         int i;
 
         rcu_read_lock();
-        for (i=0; i<mddev->raid_disks; i++) {
+        for (i=0; i < conf->raid_disks; i++) {
                 mdk_rdev_t *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags) && atomic_read(&rdev->nr_pending)) {
                         struct request_queue *r_queue = bdev_get_queue(rdev->bdev);
@@ -634,7 +637,7 @@ static int raid10_congested(void *data, int bits)
         if (mddev_congested(mddev, bits))
                 return 1;
         rcu_read_lock();
-        for (i = 0; i < mddev->raid_disks && ret == 0; i++) {
+        for (i = 0; i < conf->raid_disks && ret == 0; i++) {
                 mdk_rdev_t *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags)) {
                         struct request_queue *q = bdev_get_queue(rdev->bdev);
@@ -787,14 +790,12 @@ static void unfreeze_array(conf_t *conf)
         spin_unlock_irq(&conf->resync_lock);
 }
 
-static int make_request(struct request_queue *q, struct bio * bio)
+static int make_request(mddev_t *mddev, struct bio * bio)
 {
-        mddev_t *mddev = q->queuedata;
         conf_t *conf = mddev->private;
         mirror_info_t *mirror;
         r10bio_t *r10_bio;
         struct bio *read_bio;
-        int cpu;
         int i;
         int chunk_sects = conf->chunk_mask + 1;
         const int rw = bio_data_dir(bio);
@@ -804,7 +805,7 @@ static int make_request(struct request_queue *q, struct bio * bio)
         mdk_rdev_t *blocked_rdev;
 
         if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-                bio_endio(bio, -EOPNOTSUPP);
+                md_barrier_request(mddev, bio);
                 return 0;
         }
 
@@ -824,16 +825,16 @@ static int make_request(struct request_queue *q, struct bio * bio)
                  */
                 bp = bio_split(bio,
                                chunk_sects - (bio->bi_sector & (chunk_sects - 1)) );
-                if (make_request(q, &bp->bio1))
+                if (make_request(mddev, &bp->bio1))
                         generic_make_request(&bp->bio1);
-                if (make_request(q, &bp->bio2))
+                if (make_request(mddev, &bp->bio2))
                         generic_make_request(&bp->bio2);
 
                 bio_pair_release(bp);
                 return 0;
         bad_map:
-                printk("raid10_make_request bug: can't convert block across chunks"
-                       " or bigger than %dk %llu %d\n", chunk_sects/2,
+                printk("md/raid10:%s: make_request bug: can't convert block across chunks"
+                       " or bigger than %dk %llu %d\n", mdname(mddev), chunk_sects/2,
                        (unsigned long long)bio->bi_sector, bio->bi_size >> 10);
 
                 bio_io_error(bio);
@@ -849,12 +850,6 @@ static int make_request(struct request_queue *q, struct bio * bio)
          */
         wait_barrier(conf);
 
-        cpu = part_stat_lock();
-        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bio));
-        part_stat_unlock();
-
         r10_bio = mempool_alloc(conf->r10bio_pool, GFP_NOIO);
 
         r10_bio->master_bio = bio;
@@ -1038,9 +1033,10 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
         }
         set_bit(Faulty, &rdev->flags);
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
-        printk(KERN_ALERT "raid10: Disk failure on %s, disabling device.\n"
-                "raid10: Operation continuing on %d devices.\n",
-                bdevname(rdev->bdev,b), conf->raid_disks - mddev->degraded);
+        printk(KERN_ALERT "md/raid10:%s: Disk failure on %s, disabling device.\n"
+               KERN_ALERT "md/raid10:%s: Operation continuing on %d devices.\n",
+               mdname(mddev), bdevname(rdev->bdev, b),
+               mdname(mddev), conf->raid_disks - mddev->degraded);
 }
 
 static void print_conf(conf_t *conf)
@@ -1048,19 +1044,19 @@ static void print_conf(conf_t *conf)
         int i;
         mirror_info_t *tmp;
 
-        printk("RAID10 conf printout:\n");
+        printk(KERN_DEBUG "RAID10 conf printout:\n");
         if (!conf) {
-                printk("(!conf)\n");
+                printk(KERN_DEBUG "(!conf)\n");
                 return;
         }
-        printk(" --- wd:%d rd:%d\n", conf->raid_disks - conf->mddev->degraded,
+        printk(KERN_DEBUG " --- wd:%d rd:%d\n", conf->raid_disks - conf->mddev->degraded,
                 conf->raid_disks);
 
         for (i = 0; i < conf->raid_disks; i++) {
                 char b[BDEVNAME_SIZE];
                 tmp = conf->mirrors + i;
                 if (tmp->rdev)
-                        printk(" disk %d, wo:%d, o:%d, dev:%s\n",
+                        printk(KERN_DEBUG " disk %d, wo:%d, o:%d, dev:%s\n",
                                 i, !test_bit(In_sync, &tmp->rdev->flags),
                                 !test_bit(Faulty, &tmp->rdev->flags),
                                 bdevname(tmp->rdev->bdev,b));
@@ -1131,7 +1127,7 @@ static int raid10_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
         int mirror;
         mirror_info_t *p;
         int first = 0;
-        int last = mddev->raid_disks - 1;
+        int last = conf->raid_disks - 1;
 
         if (mddev->recovery_cp < MaxSector)
                 /* only hot-add to in-sync arrays, as recovery is
@@ -1155,13 +1151,17 @@ static int raid10_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
 
                         disk_stack_limits(mddev->gendisk, rdev->bdev,
                                           rdev->data_offset << 9);
-                        /* as we don't honour merge_bvec_fn, we must never risk
-                         * violating it, so limit ->max_sector to one PAGE, as
-                         * a one page request is never in violation.
+                        /* as we don't honour merge_bvec_fn, we must
+                         * never risk violating it, so limit
+                         * ->max_segments to one lying with a single
+                         * page, as a one page request is never in
+                         * violation.
                          */
-                        if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-                            queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                                blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
+                        if (rdev->bdev->bd_disk->queue->merge_bvec_fn) {
+                                blk_queue_max_segments(mddev->queue, 1);
+                                blk_queue_segment_boundary(mddev->queue,
+                                                           PAGE_CACHE_SIZE - 1);
+                        }
 
                         p->head_position = 0;
                         rdev->raid_disk = mirror;
@@ -1219,7 +1219,7 @@ abort:
 
 static void end_sync_read(struct bio *bio, int error)
 {
-        r10bio_t * r10_bio = (r10bio_t *)(bio->bi_private);
+        r10bio_t *r10_bio = bio->bi_private;
         conf_t *conf = r10_bio->mddev->private;
         int i,d;
 
@@ -1256,7 +1256,7 @@ static void end_sync_read(struct bio *bio, int error)
 static void end_sync_write(struct bio *bio, int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        r10bio_t * r10_bio = (r10bio_t *)(bio->bi_private);
+        r10bio_t *r10_bio = bio->bi_private;
         mddev_t *mddev = r10_bio->mddev;
         conf_t *conf = mddev->private;
         int i,d;
@@ -1432,6 +1432,43 @@ static void recovery_request_write(mddev_t *mddev, r10bio_t *r10_bio)
 
 
 /*
+ * Used by fix_read_error() to decay the per rdev read_errors.
+ * We halve the read error count for every hour that has elapsed
+ * since the last recorded read error.
+ *
+ */
+static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
+{
+        struct timespec cur_time_mon;
+        unsigned long hours_since_last;
+        unsigned int read_errors = atomic_read(&rdev->read_errors);
+
+        ktime_get_ts(&cur_time_mon);
+
+        if (rdev->last_read_error.tv_sec == 0 &&
+            rdev->last_read_error.tv_nsec == 0) {
+                /* first time we've seen a read error */
+                rdev->last_read_error = cur_time_mon;
+                return;
+        }
+
+        hours_since_last = (cur_time_mon.tv_sec -
+                            rdev->last_read_error.tv_sec) / 3600;
+
+        rdev->last_read_error = cur_time_mon;
+
+        /*
+         * if hours_since_last is > the number of bits in read_errors
+         * just set read errors to 0. We do this to avoid
+         * overflowing the shift of read_errors by hours_since_last.
+         */
+        if (hours_since_last >= 8 * sizeof(read_errors))
+                atomic_set(&rdev->read_errors, 0);
+        else
+                atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
+}
+
+/*
  * This is a kernel thread which:
  *
  *      1.      Retries failed read operations on working mirrors.
@@ -1444,6 +1481,44 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
         int sect = 0; /* Offset from r10_bio->sector */
         int sectors = r10_bio->sectors;
         mdk_rdev_t*rdev;
+        int max_read_errors = atomic_read(&mddev->max_corr_read_errors);
+        int d = r10_bio->devs[r10_bio->read_slot].devnum;
+
+        rcu_read_lock();
+        rdev = rcu_dereference(conf->mirrors[d].rdev);
+        if (rdev) { /* If rdev is not NULL */
+                char b[BDEVNAME_SIZE];
+                int cur_read_error_count = 0;
+
+                bdevname(rdev->bdev, b);
+
+                if (test_bit(Faulty, &rdev->flags)) {
+                        rcu_read_unlock();
+                        /* drive has already been failed, just ignore any
+                           more fix_read_error() attempts */
+                        return;
+                }
+
+                check_decay_read_errors(mddev, rdev);
+                atomic_inc(&rdev->read_errors);
+                cur_read_error_count = atomic_read(&rdev->read_errors);
+                if (cur_read_error_count > max_read_errors) {
+                        rcu_read_unlock();
+                        printk(KERN_NOTICE
+                               "md/raid10:%s: %s: Raid device exceeded "
+                               "read_error threshold "
+                               "[cur %d:max %d]\n",
+                               mdname(mddev),
+                               b, cur_read_error_count, max_read_errors);
+                        printk(KERN_NOTICE
+                               "md/raid10:%s: %s: Failing raid "
+                               "device\n", mdname(mddev), b);
+                        md_error(mddev, conf->mirrors[d].rdev);
+                        return;
+                }
+        }
+        rcu_read_unlock();
+
         while(sectors) {
                 int s = sectors;
                 int sl = r10_bio->read_slot;
@@ -1455,7 +1530,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 
                 rcu_read_lock();
                 do {
-                        int d = r10_bio->devs[sl].devnum;
+                        d = r10_bio->devs[sl].devnum;
                         rdev = rcu_dereference(conf->mirrors[d].rdev);
                         if (rdev &&
                             test_bit(In_sync, &rdev->flags)) {
@@ -1488,7 +1563,8 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
                 /* write it back and re-read */
                 rcu_read_lock();
                 while (sl != r10_bio->read_slot) {
-                        int d;
+                        char b[BDEVNAME_SIZE];
+
                         if (sl==0)
                                 sl = conf->copies;
                         sl--;
@@ -1503,16 +1579,29 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
                                                  r10_bio->devs[sl].addr +
                                                  sect + rdev->data_offset,
                                                  s<<9, conf->tmppage, WRITE)
-                                    == 0)
+                                    == 0) {
                                         /* Well, this device is dead */
+                                        printk(KERN_NOTICE
+                                               "md/raid10:%s: read correction "
+                                               "write failed"
+                                               " (%d sectors at %llu on %s)\n",
+                                               mdname(mddev), s,
+                                               (unsigned long long)(sect+
+                                               rdev->data_offset),
+                                               bdevname(rdev->bdev, b));
+                                        printk(KERN_NOTICE "md/raid10:%s: %s: failing "
+                                               "drive\n",
+                                               mdname(mddev),
+                                               bdevname(rdev->bdev, b));
                                         md_error(mddev, rdev);
+                                }
                                 rdev_dec_pending(rdev, mddev);
                                 rcu_read_lock();
                         }
                 }
                 sl = start;
                 while (sl != r10_bio->read_slot) {
-                        int d;
+
                         if (sl==0)
                                 sl = conf->copies;
                         sl--;
@@ -1526,17 +1615,31 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
                                 if (sync_page_io(rdev->bdev,
                                                  r10_bio->devs[sl].addr +
                                                  sect + rdev->data_offset,
-                                                 s<<9, conf->tmppage, READ) == 0)
+                                                 s<<9, conf->tmppage,
+                                                 READ) == 0) {
                                         /* Well, this device is dead */
+                                        printk(KERN_NOTICE
+                                               "md/raid10:%s: unable to read back "
+                                               "corrected sectors"
+                                               " (%d sectors at %llu on %s)\n",
+                                               mdname(mddev), s,
+                                               (unsigned long long)(sect+
+                                                    rdev->data_offset),
+                                               bdevname(rdev->bdev, b));
+                                        printk(KERN_NOTICE "md/raid10:%s: %s: failing drive\n",
+                                               mdname(mddev),
+                                               bdevname(rdev->bdev, b));
+
                                         md_error(mddev, rdev);
-                                else
+                                } else {
                                         printk(KERN_INFO
-                                               "raid10:%s: read error corrected"
+                                               "md/raid10:%s: read error corrected"
                                                " (%d sectors at %llu on %s)\n",
                                                mdname(mddev), s,
                                                (unsigned long long)(sect+
                                                     rdev->data_offset),
                                                bdevname(rdev->bdev, b));
+                                }
 
                                 rdev_dec_pending(rdev, mddev);
                                 rcu_read_lock();
@@ -1605,8 +1708,9 @@ static void raid10d(mddev_t *mddev)
                                 mddev->ro ? IO_BLOCKED : NULL;
                         mirror = read_balance(conf, r10_bio);
                         if (mirror == -1) {
-                                printk(KERN_ALERT "raid10: %s: unrecoverable I/O"
+                                printk(KERN_ALERT "md/raid10:%s: %s: unrecoverable I/O"
                                        " read error for block %llu\n",
+                                       mdname(mddev),
                                        bdevname(bio->bi_bdev,b),
                                        (unsigned long long)r10_bio->sector);
                                 raid_end_bio_io(r10_bio);
@@ -1616,8 +1720,9 @@ static void raid10d(mddev_t *mddev)
                                 bio_put(bio);
                                 rdev = conf->mirrors[mirror].rdev;
                                 if (printk_ratelimit())
-                                        printk(KERN_ERR "raid10: %s: redirecting sector %llu to"
+                                        printk(KERN_ERR "md/raid10:%s: %s: redirecting sector %llu to"
                                                " another mirror\n",
+                                               mdname(mddev),
                                                bdevname(rdev->bdev,b),
                                                (unsigned long long)r10_bio->sector);
                                 bio = bio_clone(r10_bio->master_bio, GFP_NOIO);
@@ -1632,6 +1737,7 @@ static void raid10d(mddev_t *mddev)
                                 generic_make_request(bio);
                         }
                 }
+                cond_resched();
         }
         if (unplug)
                 unplug_slaves(mddev);
@@ -1874,7 +1980,8 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                                         r10_bio = rb2;
                                         if (!test_and_set_bit(MD_RECOVERY_INTR,
                                                               &mddev->recovery))
-                                                printk(KERN_INFO "raid10: %s: insufficient working devices for recovery.\n",
+                                                printk(KERN_INFO "md/raid10:%s: insufficient "
+                                                       "working devices for recovery.\n",
                                                        mdname(mddev));
                                         break;
                                 }
@@ -2034,9 +2141,9 @@ raid10_size(mddev_t *mddev, sector_t sectors, int raid_disks)
         conf_t *conf = mddev->private;
 
         if (!raid_disks)
-                raid_disks = mddev->raid_disks;
+                raid_disks = conf->raid_disks;
         if (!sectors)
-                sectors = mddev->dev_sectors;
+                sectors = conf->dev_sectors;
 
         size = sectors >> conf->chunk_shift;
         sector_div(size, conf->far_copies);
@@ -2046,63 +2153,61 @@ raid10_size(mddev_t *mddev, sector_t sectors, int raid_disks)
         return size << conf->chunk_shift;
 }
 
-static int run(mddev_t *mddev)
+
+static conf_t *setup_conf(mddev_t *mddev)
 {
-        conf_t *conf;
-        int i, disk_idx, chunk_size;
-        mirror_info_t *disk;
-        mdk_rdev_t *rdev;
+        conf_t *conf = NULL;
         int nc, fc, fo;
         sector_t stride, size;
+        int err = -EINVAL;
 
-        if (mddev->chunk_sectors < (PAGE_SIZE >> 9) ||
-            !is_power_of_2(mddev->chunk_sectors)) {
-                printk(KERN_ERR "md/raid10: chunk size must be "
-                       "at least PAGE_SIZE(%ld) and be a power of 2.\n", PAGE_SIZE);
-                return -EINVAL;
+        if (mddev->new_chunk_sectors < (PAGE_SIZE >> 9) ||
+            !is_power_of_2(mddev->new_chunk_sectors)) {
+                printk(KERN_ERR "md/raid10:%s: chunk size must be "
+                       "at least PAGE_SIZE(%ld) and be a power of 2.\n",
+                       mdname(mddev), PAGE_SIZE);
+                goto out;
         }
 
-        nc = mddev->layout & 255;
-        fc = (mddev->layout >> 8) & 255;
-        fo = mddev->layout & (1<<16);
+        nc = mddev->new_layout & 255;
+        fc = (mddev->new_layout >> 8) & 255;
+        fo = mddev->new_layout & (1<<16);
+
         if ((nc*fc) <2 || (nc*fc) > mddev->raid_disks ||
-            (mddev->layout >> 17)) {
-                printk(KERN_ERR "raid10: %s: unsupported raid10 layout: 0x%8x\n",
-                       mdname(mddev), mddev->layout);
+            (mddev->new_layout >> 17)) {
+                printk(KERN_ERR "md/raid10:%s: unsupported raid10 layout: 0x%8x\n",
+                       mdname(mddev), mddev->new_layout);
                 goto out;
         }
-        /*
-         * copy the already verified devices into our private RAID10
-         * bookkeeping area. [whatever we allocate in run(),
-         * should be freed in stop()]
-         */
+
+        err = -ENOMEM;
         conf = kzalloc(sizeof(conf_t), GFP_KERNEL);
-        mddev->private = conf;
-        if (!conf) {
-                printk(KERN_ERR "raid10: couldn't allocate memory for %s\n",
-                        mdname(mddev));
+        if (!conf)
                 goto out;
-        }
+
         conf->mirrors = kzalloc(sizeof(struct mirror_info)*mddev->raid_disks,
-                                 GFP_KERNEL);
-        if (!conf->mirrors) {
-                printk(KERN_ERR "raid10: couldn't allocate memory for %s\n",
-                       mdname(mddev));
-                goto out_free_conf;
-        }
+                                GFP_KERNEL);
+        if (!conf->mirrors)
+                goto out;
 
         conf->tmppage = alloc_page(GFP_KERNEL);
         if (!conf->tmppage)
-                goto out_free_conf;
+                goto out;
+
 
-        conf->mddev = mddev;
         conf->raid_disks = mddev->raid_disks;
         conf->near_copies = nc;
         conf->far_copies = fc;
         conf->copies = nc*fc;
         conf->far_offset = fo;
-        conf->chunk_mask = mddev->chunk_sectors - 1;
-        conf->chunk_shift = ffz(~mddev->chunk_sectors);
+        conf->chunk_mask = mddev->new_chunk_sectors - 1;
+        conf->chunk_shift = ffz(~mddev->new_chunk_sectors);
+
+        conf->r10bio_pool = mempool_create(NR_RAID10_BIOS, r10bio_pool_alloc,
+                                           r10bio_pool_free, conf);
+        if (!conf->r10bio_pool)
+                goto out;
+
         size = mddev->dev_sectors >> conf->chunk_shift;
         sector_div(size, fc);
         size = size * conf->raid_disks;
@@ -2116,7 +2221,8 @@ static int run(mddev_t *mddev)
          */
         stride += conf->raid_disks - 1;
         sector_div(stride, conf->raid_disks);
-        mddev->dev_sectors = stride << conf->chunk_shift;
+
+        conf->dev_sectors = stride << conf->chunk_shift;
 
         if (fo)
                 stride = 1;
@@ -2124,17 +2230,62 @@ static int run(mddev_t *mddev)
                 sector_div(stride, fc);
         conf->stride = stride << conf->chunk_shift;
 
-        conf->r10bio_pool = mempool_create(NR_RAID10_BIOS, r10bio_pool_alloc,
-                                                r10bio_pool_free, conf);
-        if (!conf->r10bio_pool) {
-                printk(KERN_ERR "raid10: couldn't allocate memory for %s\n",
-                        mdname(mddev));
-                goto out_free_conf;
-        }
 
         spin_lock_init(&conf->device_lock);
+        INIT_LIST_HEAD(&conf->retry_list);
+
+        spin_lock_init(&conf->resync_lock);
+        init_waitqueue_head(&conf->wait_barrier);
+
+        conf->thread = md_register_thread(raid10d, mddev, NULL);
+        if (!conf->thread)
+                goto out;
+
+        conf->mddev = mddev;
+        return conf;
+
+ out:
+        printk(KERN_ERR "md/raid10:%s: couldn't allocate memory.\n",
+               mdname(mddev));
+        if (conf) {
+                if (conf->r10bio_pool)
+                        mempool_destroy(conf->r10bio_pool);
+                kfree(conf->mirrors);
+                safe_put_page(conf->tmppage);
+                kfree(conf);
+        }
+        return ERR_PTR(err);
+}
+
+static int run(mddev_t *mddev)
+{
+        conf_t *conf;
+        int i, disk_idx, chunk_size;
+        mirror_info_t *disk;
+        mdk_rdev_t *rdev;
+        sector_t size;
+
+        /*
+         * copy the already verified devices into our private RAID10
+         * bookkeeping area. [whatever we allocate in run(),
+         * should be freed in stop()]
+         */
+
+        if (mddev->private == NULL) {
+                conf = setup_conf(mddev);
+                if (IS_ERR(conf))
+                        return PTR_ERR(conf);
+                mddev->private = conf;
+        }
+        conf = mddev->private;
+        if (!conf)
+                goto out;
+
         mddev->queue->queue_lock = &conf->device_lock;
 
+        mddev->thread = conf->thread;
+        conf->thread = NULL;
+
         chunk_size = mddev->chunk_sectors << 9;
         blk_queue_io_min(mddev->queue, chunk_size);
         if (conf->raid_disks % conf->near_copies)
@@ -2145,7 +2296,7 @@ static int run(mddev_t *mddev)
 
         list_for_each_entry(rdev, &mddev->disks, same_set) {
                 disk_idx = rdev->raid_disk;
-                if (disk_idx >= mddev->raid_disks
+                if (disk_idx >= conf->raid_disks
                     || disk_idx < 0)
                         continue;
                 disk = conf->mirrors + disk_idx;
@@ -2154,23 +2305,20 @@ static int run(mddev_t *mddev)
                 disk_stack_limits(mddev->gendisk, rdev->bdev,
                                   rdev->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
-                 * violating it, so limit ->max_sector to one PAGE, as
-                 * a one page request is never in violation.
+                 * violating it, so limit max_segments to 1 lying
+                 * within a single page.
                  */
-                if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-                    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-                        blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
+                if (rdev->bdev->bd_disk->queue->merge_bvec_fn) {
+                        blk_queue_max_segments(mddev->queue, 1);
+                        blk_queue_segment_boundary(mddev->queue,
+                                                   PAGE_CACHE_SIZE - 1);
+                }
 
                 disk->head_position = 0;
         }
-        INIT_LIST_HEAD(&conf->retry_list);
-
-        spin_lock_init(&conf->resync_lock);
-        init_waitqueue_head(&conf->wait_barrier);
-
         /* need to check that every block has at least one working mirror */
         if (!enough(conf)) {
-                printk(KERN_ERR "raid10: not enough operational mirrors for %s\n",
+                printk(KERN_ERR "md/raid10:%s: not enough operational mirrors.\n",
                        mdname(mddev));
                 goto out_free_conf;
         }
@@ -2189,28 +2337,21 @@ static int run(mddev_t *mddev)
                 }
         }
 
-
-        mddev->thread = md_register_thread(raid10d, mddev, NULL);
-        if (!mddev->thread) {
-                printk(KERN_ERR
-                       "raid10: couldn't allocate thread for %s\n",
-                       mdname(mddev));
-                goto out_free_conf;
-        }
-
         if (mddev->recovery_cp != MaxSector)
-                printk(KERN_NOTICE "raid10: %s is not clean"
+                printk(KERN_NOTICE "md/raid10:%s: not clean"
                        " -- starting background reconstruction\n",
                        mdname(mddev));
         printk(KERN_INFO
-                "raid10: raid set %s active with %d out of %d devices\n",
-                mdname(mddev), mddev->raid_disks - mddev->degraded,
-                mddev->raid_disks);
+                "md/raid10:%s: active with %d out of %d devices\n",
+                mdname(mddev), conf->raid_disks - mddev->degraded,
+                conf->raid_disks);
         /*
          * Ok, everything is just fine now
          */
-        md_set_array_sectors(mddev, raid10_size(mddev, 0, 0));
-        mddev->resync_max_sectors = raid10_size(mddev, 0, 0);
+        mddev->dev_sectors = conf->dev_sectors;
+        size = raid10_size(mddev, 0, 0);
+        md_set_array_sectors(mddev, size);
+        mddev->resync_max_sectors = size;
 
         mddev->queue->unplug_fn = raid10_unplug;
         mddev->queue->backing_dev_info.congested_fn = raid10_congested;
@@ -2228,7 +2369,7 @@ static int run(mddev_t *mddev)
                         mddev->queue->backing_dev_info.ra_pages = 2* stripe;
         }
 
-        if (conf->near_copies < mddev->raid_disks)
+        if (conf->near_copies < conf->raid_disks)
                 blk_queue_merge_bvec(mddev->queue, raid10_mergeable_bvec);
         md_integrity_register(mddev);
         return 0;
@@ -2240,6 +2381,7 @@ out_free_conf:
         kfree(conf->mirrors);
         kfree(conf);
         mddev->private = NULL;
+        md_unregister_thread(mddev->thread);
 out:
         return -EIO;
 }
@@ -2274,13 +2416,57 @@ static void raid10_quiesce(mddev_t *mddev, int state)
                 lower_barrier(conf);
                 break;
         }
-        if (mddev->thread) {
-                if (mddev->bitmap)
-                        mddev->thread->timeout = mddev->bitmap->daemon_sleep * HZ;
-                else
-                        mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
-                md_wakeup_thread(mddev->thread);
+}
+
+static void *raid10_takeover_raid0(mddev_t *mddev)
+{
+        mdk_rdev_t *rdev;
+        conf_t *conf;
+
+        if (mddev->degraded > 0) {
+                printk(KERN_ERR "md/raid10:%s: Error: degraded raid0!\n",
+                       mdname(mddev));
+                return ERR_PTR(-EINVAL);
+        }
+
+        /* Set new parameters */
+        mddev->new_level = 10;
+        /* new layout: far_copies = 1, near_copies = 2 */
+        mddev->new_layout = (1<<8) + 2;
+        mddev->new_chunk_sectors = mddev->chunk_sectors;
+        mddev->delta_disks = mddev->raid_disks;
+        mddev->raid_disks *= 2;
+        /* make sure it will be not marked as dirty */
+        mddev->recovery_cp = MaxSector;
+
+        conf = setup_conf(mddev);
+        if (!IS_ERR(conf))
+                list_for_each_entry(rdev, &mddev->disks, same_set)
+                        if (rdev->raid_disk >= 0)
+                                rdev->new_raid_disk = rdev->raid_disk * 2;
+                
+        return conf;
+}
+
+static void *raid10_takeover(mddev_t *mddev)
+{
+        struct raid0_private_data *raid0_priv;
+
+        /* raid10 can take over:
+         *  raid0 - providing it has only two drives
+         */
+        if (mddev->level == 0) {
+                /* for raid0 takeover only one zone is supported */
+                raid0_priv = mddev->private;
+                if (raid0_priv->nr_strip_zones > 1) {
+                        printk(KERN_ERR "md/raid10:%s: cannot takeover raid 0"
+                               " with more than one zone.\n",
+                               mdname(mddev));
+                        return ERR_PTR(-EINVAL);
+                }
+                return raid10_takeover_raid0(mddev);
         }
+        return ERR_PTR(-EINVAL);
 }
 
 static struct mdk_personality raid10_personality =
@@ -2299,6 +2485,7 @@ static struct mdk_personality raid10_personality =
         .sync_request   = sync_request,
         .quiesce        = raid10_quiesce,
         .size           = raid10_size,
+        .takeover       = raid10_takeover,
 };
 
 static int __init raid_init(void)
@@ -2314,6 +2501,7 @@ static void raid_exit(void)
 module_init(raid_init);
 module_exit(raid_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID10 (striped mirror) personality for MD");
 MODULE_ALIAS("md-personality-9"); /* RAID10 */
 MODULE_ALIAS("md-raid10");
 MODULE_ALIAS("md-level-10");
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 59cd1efb8d30..2316ac2e8e21 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -33,6 +33,8 @@ struct r10_private_data_s {
                                                * 1 stripe.
                                                */
 
+        sector_t                dev_sectors;  /* temp copy of mddev->dev_sectors */
+
         int chunk_shift; /* shift from chunks to sectors */
         sector_t chunk_mask;
 
@@ -57,6 +59,11 @@ struct r10_private_data_s {
         mempool_t *r10bio_pool;
         mempool_t *r10buf_pool;
         struct page             *tmppage;
+
+        /* When taking over an array from a different personality, we store
+         * the new thread here until we fully activate the array.
+         */
+        struct mdk_thread_s     *thread;
 };
 
 typedef struct r10_private_data_s conf_t;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 94829804ab7f..96c690279fc6 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -50,8 +50,10 @@
 #include <linux/async.h>
 #include <linux/seq_file.h>
 #include <linux/cpu.h>
+#include <linux/slab.h>
 #include "md.h"
 #include "raid5.h"
+#include "raid0.h"
 #include "bitmap.h"
 
 /*
@@ -156,13 +158,16 @@ static inline int raid6_next_disk(int disk, int raid_disks)
 static int raid6_idx_to_slot(int idx, struct stripe_head *sh,
                              int *count, int syndrome_disks)
 {
-        int slot;
+        int slot = *count;
 
+        if (sh->ddf_layout)
+                (*count)++;
         if (idx == sh->pd_idx)
                 return syndrome_disks;
         if (idx == sh->qd_idx)
                 return syndrome_disks + 1;
-        slot = (*count)++;
+        if (!sh->ddf_layout)
+                (*count)++;
         return slot;
 }
 
@@ -272,12 +277,13 @@ out:
         return sh;
 }
 
-static void shrink_buffers(struct stripe_head *sh, int num)
+static void shrink_buffers(struct stripe_head *sh)
 {
         struct page *p;
         int i;
+        int num = sh->raid_conf->pool_size;
 
-        for (i=0; i<num ; i++) {
+        for (i = 0; i < num ; i++) {
                 p = sh->dev[i].page;
                 if (!p)
                         continue;
@@ -286,11 +292,12 @@ static void shrink_buffers(struct stripe_head *sh, int num)
         }
 }
 
-static int grow_buffers(struct stripe_head *sh, int num)
+static int grow_buffers(struct stripe_head *sh)
 {
         int i;
+        int num = sh->raid_conf->pool_size;
 
-        for (i=0; i<num; i++) {
+        for (i = 0; i < num; i++) {
                 struct page *page;
 
                 if (!(page = alloc_page(GFP_KERNEL))) {
@@ -359,6 +366,73 @@ static struct stripe_head *__find_stripe(raid5_conf_t *conf, sector_t sector,
         return NULL;
 }
 
+/*
+ * Need to check if array has failed when deciding whether to:
+ *  - start an array
+ *  - remove non-faulty devices
+ *  - add a spare
+ *  - allow a reshape
+ * This determination is simple when no reshape is happening.
+ * However if there is a reshape, we need to carefully check
+ * both the before and after sections.
+ * This is because some failed devices may only affect one
+ * of the two sections, and some non-in_sync devices may
+ * be insync in the section most affected by failed devices.
+ */
+static int has_failed(raid5_conf_t *conf)
+{
+        int degraded;
+        int i;
+        if (conf->mddev->reshape_position == MaxSector)
+                return conf->mddev->degraded > conf->max_degraded;
+
+        rcu_read_lock();
+        degraded = 0;
+        for (i = 0; i < conf->previous_raid_disks; i++) {
+                mdk_rdev_t *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (!rdev || test_bit(Faulty, &rdev->flags))
+                        degraded++;
+                else if (test_bit(In_sync, &rdev->flags))
+                        ;
+                else
+                        /* not in-sync or faulty.
+                         * If the reshape increases the number of devices,
+                         * this is being recovered by the reshape, so
+                         * this 'previous' section is not in_sync.
+                         * If the number of devices is being reduced however,
+                         * the device can only be part of the array if
+                         * we are reverting a reshape, so this section will
+                         * be in-sync.
+                         */
+                        if (conf->raid_disks >= conf->previous_raid_disks)
+                                degraded++;
+        }
+        rcu_read_unlock();
+        if (degraded > conf->max_degraded)
+                return 1;
+        rcu_read_lock();
+        degraded = 0;
+        for (i = 0; i < conf->raid_disks; i++) {
+                mdk_rdev_t *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (!rdev || test_bit(Faulty, &rdev->flags))
+                        degraded++;
+                else if (test_bit(In_sync, &rdev->flags))
+                        ;
+                else
+                        /* not in-sync or faulty.
+                         * If reshape increases the number of devices, this
+                         * section has already been recovered, else it
+                         * almost certainly hasn't.
+                         */
+                        if (conf->raid_disks <= conf->previous_raid_disks)
+                                degraded++;
+        }
+        rcu_read_unlock();
+        if (degraded > conf->max_degraded)
+                return 1;
+        return 0;
+}
+
 static void unplug_slaves(mddev_t *mddev);
 static void raid5_unplug_device(struct request_queue *q);
 
@@ -717,7 +791,7 @@ static int set_syndrome_sources(struct page **srcs, struct stripe_head *sh)
         int i;
 
         for (i = 0; i < disks; i++)
-                srcs[i] = (void *)raid6_empty_zero_page;
+                srcs[i] = NULL;
 
         count = 0;
         i = d0_idx;
@@ -727,9 +801,8 @@ static int set_syndrome_sources(struct page **srcs, struct stripe_head *sh)
                 srcs[slot] = sh->dev[i].page;
                 i = raid6_next_disk(i, disks);
         } while (i != d0_idx);
-        BUG_ON(count != syndrome_disks);
 
-        return count;
+        return syndrome_disks;
 }
 
 static struct dma_async_tx_descriptor *
@@ -814,7 +887,7 @@ ops_run_compute6_2(struct stripe_head *sh, struct raid5_percpu *percpu)
          * slot number conversion for 'faila' and 'failb'
          */
         for (i = 0; i < disks ; i++)
-                blocks[i] = (void *)raid6_empty_zero_page;
+                blocks[i] = NULL;
         count = 0;
         i = d0_idx;
         do {
@@ -828,7 +901,6 @@ ops_run_compute6_2(struct stripe_head *sh, struct raid5_percpu *percpu)
                         failb = slot;
                 i = raid6_next_disk(i, disks);
         } while (i != d0_idx);
-        BUG_ON(count != syndrome_disks);
 
         BUG_ON(faila == failb);
         if (failb < faila)
@@ -845,7 +917,7 @@ ops_run_compute6_2(struct stripe_head *sh, struct raid5_percpu *percpu)
                         init_async_submit(&submit, ASYNC_TX_FENCE, NULL,
                                           ops_complete_compute, sh,
                                           to_addr_conv(sh, percpu));
-                        return async_gen_syndrome(blocks, 0, count+2,
+                        return async_gen_syndrome(blocks, 0, syndrome_disks+2,
                                                   STRIPE_SIZE, &submit);
                 } else {
                         struct page *dest;
@@ -1139,7 +1211,7 @@ static void ops_run_check_pq(struct stripe_head *sh, struct raid5_percpu *percpu
                            &sh->ops.zero_sum_result, percpu->spare_page, &submit);
 }
 
-static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
+static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
 {
         int overlap_clear = 0, i, disks = sh->disks;
         struct dma_async_tx_descriptor *tx = NULL;
@@ -1204,22 +1276,54 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
+#ifdef CONFIG_MULTICORE_RAID456
+static void async_run_ops(void *param, async_cookie_t cookie)
+{
+        struct stripe_head *sh = param;
+        unsigned long ops_request = sh->ops.request;
+
+        clear_bit_unlock(STRIPE_OPS_REQ_PENDING, &sh->state);
+        wake_up(&sh->ops.wait_for_ops);
+
+        __raid_run_ops(sh, ops_request);
+        release_stripe(sh);
+}
+
+static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
+{
+        /* since handle_stripe can be called outside of raid5d context
+         * we need to ensure sh->ops.request is de-staged before another
+         * request arrives
+         */
+        wait_event(sh->ops.wait_for_ops,
+                   !test_and_set_bit_lock(STRIPE_OPS_REQ_PENDING, &sh->state));
+        sh->ops.request = ops_request;
+
+        atomic_inc(&sh->count);
+        async_schedule(async_run_ops, sh);
+}
+#else
+#define raid_run_ops __raid_run_ops
+#endif
+
 static int grow_one_stripe(raid5_conf_t *conf)
 {
         struct stripe_head *sh;
         sh = kmem_cache_alloc(conf->slab_cache, GFP_KERNEL);
         if (!sh)
                 return 0;
-        memset(sh, 0, sizeof(*sh) + (conf->raid_disks-1)*sizeof(struct r5dev));
+        memset(sh, 0, sizeof(*sh) + (conf->pool_size-1)*sizeof(struct r5dev));
         sh->raid_conf = conf;
         spin_lock_init(&sh->lock);
+        #ifdef CONFIG_MULTICORE_RAID456
+        init_waitqueue_head(&sh->ops.wait_for_ops);
+        #endif
 
-        if (grow_buffers(sh, conf->raid_disks)) {
-                shrink_buffers(sh, conf->raid_disks);
+        if (grow_buffers(sh)) {
+                shrink_buffers(sh);
                 kmem_cache_free(conf->slab_cache, sh);
                 return 0;
         }
-        sh->disks = conf->raid_disks;
         /* we just created an active stripe so... */
         atomic_set(&sh->count, 1);
         atomic_inc(&conf->active_stripes);
@@ -1231,7 +1335,7 @@ static int grow_one_stripe(raid5_conf_t *conf)
 static int grow_stripes(raid5_conf_t *conf, int num)
 {
         struct kmem_cache *sc;
-        int devs = conf->raid_disks;
+        int devs = max(conf->raid_disks, conf->previous_raid_disks);
 
         sprintf(conf->cache_name[0],
                 "raid%d-%s", conf->level, mdname(conf->mddev));
@@ -1329,6 +1433,9 @@ static int resize_stripes(raid5_conf_t *conf, int newsize)
 
                 nsh->raid_conf = conf;
                 spin_lock_init(&nsh->lock);
+                #ifdef CONFIG_MULTICORE_RAID456
+                init_waitqueue_head(&nsh->ops.wait_for_ops);
+                #endif
 
                 list_add(&nsh->lru, &newstripes);
         }
@@ -1429,7 +1536,7 @@ static int drop_one_stripe(raid5_conf_t *conf)
         if (!sh)
                 return 0;
         BUG_ON(atomic_read(&sh->count));
-        shrink_buffers(sh, conf->pool_size);
+        shrink_buffers(sh);
         kmem_cache_free(conf->slab_cache, sh);
         atomic_dec(&conf->active_stripes);
         return 1;
@@ -1471,7 +1578,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
                 set_bit(R5_UPTODATE, &sh->dev[i].flags);
                 if (test_bit(R5_ReadError, &sh->dev[i].flags)) {
                         rdev = conf->disks[i].rdev;
-                        printk_rl(KERN_INFO "raid5:%s: read error corrected"
+                        printk_rl(KERN_INFO "md/raid:%s: read error corrected"
                                   " (%lu sectors at %llu on %s)\n",
                                   mdname(conf->mddev), STRIPE_SECTORS,
                                   (unsigned long long)(sh->sector
@@ -1489,9 +1596,9 @@ static void raid5_end_read_request(struct bio * bi, int error)
 
                 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
                 atomic_inc(&rdev->read_errors);
-                if (conf->mddev->degraded)
+                if (conf->mddev->degraded >= conf->max_degraded)
                         printk_rl(KERN_WARNING
-                                  "raid5:%s: read error not correctable "
+                                  "md/raid:%s: read error not correctable "
                                   "(sector %llu on %s).\n",
                                   mdname(conf->mddev),
                                   (unsigned long long)(sh->sector
@@ -1500,7 +1607,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
                 else if (test_bit(R5_ReWrite, &sh->dev[i].flags))
                         /* Oh, no!!! */
                         printk_rl(KERN_WARNING
-                                  "raid5:%s: read error NOT corrected!! "
+                                  "md/raid:%s: read error NOT corrected!! "
                                   "(sector %llu on %s).\n",
                                   mdname(conf->mddev),
                                   (unsigned long long)(sh->sector
@@ -1509,7 +1616,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
                 else if (atomic_read(&rdev->read_errors)
                          > conf->max_nr_stripes)
                         printk(KERN_WARNING
-                               "raid5:%s: Too many read errors, failing device %s.\n",
+                               "md/raid:%s: Too many read errors, failing device %s.\n",
                                mdname(conf->mddev), bdn);
                 else
                         retry = 1;
@@ -1581,8 +1688,8 @@ static void raid5_build_block(struct stripe_head *sh, int i, int previous)
 static void error(mddev_t *mddev, mdk_rdev_t *rdev)
 {
         char b[BDEVNAME_SIZE];
-        raid5_conf_t *conf = (raid5_conf_t *) mddev->private;
-        pr_debug("raid5: error called\n");
+        raid5_conf_t *conf = mddev->private;
+        pr_debug("raid456: error called\n");
 
         if (!test_bit(Faulty, &rdev->flags)) {
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
@@ -1598,9 +1705,13 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
                 }
                 set_bit(Faulty, &rdev->flags);
                 printk(KERN_ALERT
-                       "raid5: Disk failure on %s, disabling device.\n"
-                       "raid5: Operation continuing on %d devices.\n",
-                       bdevname(rdev->bdev,b), conf->raid_disks - mddev->degraded);
+                       "md/raid:%s: Disk failure on %s, disabling device.\n"
+                       KERN_ALERT
+                       "md/raid:%s: Operation continuing on %d devices.\n",
+                       mdname(mddev),
+                       bdevname(rdev->bdev, b),
+                       mdname(mddev),
+                       conf->raid_disks - mddev->degraded);
         }
 }
 
@@ -1612,8 +1723,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                      int previous, int *dd_idx,
                                      struct stripe_head *sh)
 {
-        long stripe;
-        unsigned long chunk_number;
+        sector_t stripe, stripe2;
+        sector_t chunk_number;
         unsigned int chunk_offset;
         int pd_idx, qd_idx;
         int ddf_layout = 0;
@@ -1633,18 +1744,13 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
          */
         chunk_offset = sector_div(r_sector, sectors_per_chunk);
         chunk_number = r_sector;
-        BUG_ON(r_sector != chunk_number);
 
         /*
          * Compute the stripe number
          */
-        stripe = chunk_number / data_disks;
-
-        /*
-         * Compute the data disk and parity disk indexes inside the stripe
-         */
-        *dd_idx = chunk_number % data_disks;
-
+        stripe = chunk_number;
+        *dd_idx = sector_div(stripe, data_disks);
+        stripe2 = stripe;
         /*
          * Select the parity disk based on the user selected algorithm.
          */
@@ -1656,21 +1762,21 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
         case 5:
                 switch (algorithm) {
                 case ALGORITHM_LEFT_ASYMMETRIC:
-                        pd_idx = data_disks - stripe % raid_disks;
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         break;
                 case ALGORITHM_RIGHT_ASYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         break;
                 case ALGORITHM_LEFT_SYMMETRIC:
-                        pd_idx = data_disks - stripe % raid_disks;
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                         break;
                 case ALGORITHM_RIGHT_SYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                         break;
                 case ALGORITHM_PARITY_0:
@@ -1681,8 +1787,6 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                         pd_idx = data_disks;
                         break;
                 default:
-                        printk(KERN_ERR "raid5: unsupported algorithm %d\n",
-                                algorithm);
                         BUG();
                 }
                 break;
@@ -1690,7 +1794,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 
                 switch (algorithm) {
                 case ALGORITHM_LEFT_ASYMMETRIC:
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1699,7 +1803,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                 (*dd_idx) += 2; /* D D P Q D */
                         break;
                 case ALGORITHM_RIGHT_ASYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1708,12 +1812,12 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                 (*dd_idx) += 2; /* D D P Q D */
                         break;
                 case ALGORITHM_LEFT_SYMMETRIC:
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = (pd_idx + 1) % raid_disks;
                         *dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
                         break;
                 case ALGORITHM_RIGHT_SYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         qd_idx = (pd_idx + 1) % raid_disks;
                         *dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
                         break;
@@ -1732,7 +1836,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                         /* Exactly the same as RIGHT_ASYMMETRIC, but or
                          * of blocks for computing Q is different.
                          */
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1747,7 +1851,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                          * D D D P Q  rather than
                          * Q D D D P
                          */
-                        pd_idx = raid_disks - 1 - ((stripe + 1) % raid_disks);
+                        stripe2 += 1;
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1759,7 +1864,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 
                 case ALGORITHM_ROTATING_N_CONTINUE:
                         /* Same as left_symmetric but Q is before P */
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = (pd_idx + raid_disks - 1) % raid_disks;
                         *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                         ddf_layout = 1;
@@ -1767,27 +1872,27 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 
                 case ALGORITHM_LEFT_ASYMMETRIC_6:
                         /* RAID5 left_asymmetric, with Q on last device */
-                        pd_idx = data_disks - stripe % (raid_disks-1);
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         qd_idx = raid_disks - 1;
                         break;
 
                 case ALGORITHM_RIGHT_ASYMMETRIC_6:
-                        pd_idx = stripe % (raid_disks-1);
+                        pd_idx = sector_div(stripe2, raid_disks-1);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         qd_idx = raid_disks - 1;
                         break;
 
                 case ALGORITHM_LEFT_SYMMETRIC_6:
-                        pd_idx = data_disks - stripe % (raid_disks-1);
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
                         qd_idx = raid_disks - 1;
                         break;
 
                 case ALGORITHM_RIGHT_SYMMETRIC_6:
-                        pd_idx = stripe % (raid_disks-1);
+                        pd_idx = sector_div(stripe2, raid_disks-1);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
                         qd_idx = raid_disks - 1;
                         break;
@@ -1798,10 +1903,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                         qd_idx = raid_disks - 1;
                         break;
 
-
                 default:
-                        printk(KERN_CRIT "raid6: unsupported algorithm %d\n",
-                               algorithm);
                         BUG();
                 }
                 break;
@@ -1832,14 +1934,14 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
                                  : conf->algorithm;
         sector_t stripe;
         int chunk_offset;
-        int chunk_number, dummy1, dd_idx = i;
+        sector_t chunk_number;
+        int dummy1, dd_idx = i;
         sector_t r_sector;
         struct stripe_head sh2;
 
 
         chunk_offset = sector_div(new_sector, sectors_per_chunk);
         stripe = new_sector;
-        BUG_ON(new_sector != stripe);
 
         if (i == sh->pd_idx)
                 return 0;
@@ -1864,8 +1966,6 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
                 case ALGORITHM_PARITY_N:
                         break;
                 default:
-                        printk(KERN_ERR "raid5: unsupported algorithm %d\n",
-                               algorithm);
                         BUG();
                 }
                 break;
@@ -1899,10 +1999,15 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
                 case ALGORITHM_PARITY_N:
                         break;
                 case ALGORITHM_ROTATING_N_CONTINUE:
+                        /* Like left_symmetric, but P is before Q */
                         if (sh->pd_idx == 0)
                                 i--;    /* P D D D Q */
-                        else if (i > sh->pd_idx)
-                                i -= 2; /* D D Q P D */
+                        else {
+                                /* D D Q P D */
+                                if (i < sh->pd_idx)
+                                        i += raid_disks;
+                                i -= (sh->pd_idx + 1);
+                        }
                         break;
                 case ALGORITHM_LEFT_ASYMMETRIC_6:
                 case ALGORITHM_RIGHT_ASYMMETRIC_6:
@@ -1919,21 +2024,20 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
                         i -= 1;
                         break;
                 default:
-                        printk(KERN_CRIT "raid6: unsupported algorithm %d\n",
-                               algorithm);
                         BUG();
                 }
                 break;
         }
 
         chunk_number = stripe * data_disks + i;
-        r_sector = (sector_t)chunk_number * sectors_per_chunk + chunk_offset;
+        r_sector = chunk_number * sectors_per_chunk + chunk_offset;
 
         check = raid5_compute_sector(conf, r_sector,
                                      previous, &dummy1, &sh2);
         if (check != sh->sector || dummy1 != dd_idx || sh2.pd_idx != sh->pd_idx
                 || sh2.qd_idx != sh->qd_idx) {
-                printk(KERN_ERR "compute_blocknr: map not correct\n");
+                printk(KERN_ERR "md/raid:%s: compute_blocknr: map not correct\n",
+                       mdname(conf->mddev));
                 return 0;
         }
         return r_sector;
@@ -2896,7 +3000,7 @@ static void handle_stripe_expansion(raid5_conf_t *conf, struct stripe_head *sh,
  *
  */
 
-static bool handle_stripe5(struct stripe_head *sh)
+static void handle_stripe5(struct stripe_head *sh)
 {
         raid5_conf_t *conf = sh->raid_conf;
         int disks = sh->disks, i;
@@ -2905,6 +3009,7 @@ static bool handle_stripe5(struct stripe_head *sh)
         struct r5dev *dev;
         mdk_rdev_t *blocked_rdev = NULL;
         int prexor;
+        int dec_preread_active = 0;
 
         memset(&s, 0, sizeof(s));
         pr_debug("handling stripe %llu, state=%#lx cnt=%d, pd_idx=%d check:%d "
@@ -2926,7 +3031,6 @@ static bool handle_stripe5(struct stripe_head *sh)
                 mdk_rdev_t *rdev;
 
                 dev = &sh->dev[i];
-                clear_bit(R5_Insync, &dev->flags);
 
                 pr_debug("check %d: state 0x%lx toread %p read %p write %p "
                         "written %p\n", i, dev->flags, dev->toread, dev->read,
@@ -2963,17 +3067,27 @@ static bool handle_stripe5(struct stripe_head *sh)
                         blocked_rdev = rdev;
                         atomic_inc(&rdev->nr_pending);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)) {
+                clear_bit(R5_Insync, &dev->flags);
+                if (!rdev)
+                        /* Not in-sync */;
+                else if (test_bit(In_sync, &rdev->flags))
+                        set_bit(R5_Insync, &dev->flags);
+                else {
+                        /* could be in-sync depending on recovery/reshape status */
+                        if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
+                                set_bit(R5_Insync, &dev->flags);
+                }
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         /* The ReadError flag will just be confusing now */
                         clear_bit(R5_ReadError, &dev->flags);
                         clear_bit(R5_ReWrite, &dev->flags);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)
-                    || test_bit(R5_ReadError, &dev->flags)) {
+                if (test_bit(R5_ReadError, &dev->flags))
+                        clear_bit(R5_Insync, &dev->flags);
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         s.failed++;
                         s.failed_num = i;
-                } else
-                        set_bit(R5_Insync, &dev->flags);
+                }
         }
         rcu_read_unlock();
 
@@ -3054,12 +3168,8 @@ static bool handle_stripe5(struct stripe_head *sh)
                                         set_bit(STRIPE_INSYNC, &sh->state);
                         }
                 }
-                if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) {
-                        atomic_dec(&conf->preread_active_stripes);
-                        if (atomic_read(&conf->preread_active_stripes) <
-                                IO_THRESHOLD)
-                                md_wakeup_thread(conf->mddev->thread);
-                }
+                if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+                        dec_preread_active = 1;
         }
 
         /* Now to consider new write requests and what else, if anything
@@ -3166,12 +3276,20 @@ static bool handle_stripe5(struct stripe_head *sh)
 
         ops_run_io(sh, &s);
 
+        if (dec_preread_active) {
+                /* We delay this until after ops_run_io so that if make_request
+                 * is waiting on a barrier, it won't continue until the writes
+                 * have actually been submitted.
+                 */
+                atomic_dec(&conf->preread_active_stripes);
+                if (atomic_read(&conf->preread_active_stripes) <
+                    IO_THRESHOLD)
+                        md_wakeup_thread(conf->mddev->thread);
+        }
         return_io(return_bi);
-
-        return blocked_rdev == NULL;
 }
 
-static bool handle_stripe6(struct stripe_head *sh)
+static void handle_stripe6(struct stripe_head *sh)
 {
         raid5_conf_t *conf = sh->raid_conf;
         int disks = sh->disks;
@@ -3181,6 +3299,7 @@ static bool handle_stripe6(struct stripe_head *sh)
         struct r6_state r6s;
         struct r5dev *dev, *pdev, *qdev;
         mdk_rdev_t *blocked_rdev = NULL;
+        int dec_preread_active = 0;
 
         pr_debug("handling stripe %llu, state=%#lx cnt=%d, "
                 "pd_idx=%d, qd_idx=%d\n, check:%d, reconstruct:%d\n",
@@ -3202,7 +3321,6 @@ static bool handle_stripe6(struct stripe_head *sh)
         for (i=disks; i--; ) {
                 mdk_rdev_t *rdev;
                 dev = &sh->dev[i];
-                clear_bit(R5_Insync, &dev->flags);
 
                 pr_debug("check %d: state 0x%lx read %p write %p written %p\n",
                         i, dev->flags, dev->toread, dev->towrite, dev->written);
@@ -3240,18 +3358,28 @@ static bool handle_stripe6(struct stripe_head *sh)
                         blocked_rdev = rdev;
                         atomic_inc(&rdev->nr_pending);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)) {
+                clear_bit(R5_Insync, &dev->flags);
+                if (!rdev)
+                        /* Not in-sync */;
+                else if (test_bit(In_sync, &rdev->flags))
+                        set_bit(R5_Insync, &dev->flags);
+                else {
+                        /* in sync if before recovery_offset */
+                        if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
+                                set_bit(R5_Insync, &dev->flags);
+                }
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         /* The ReadError flag will just be confusing now */
                         clear_bit(R5_ReadError, &dev->flags);
                         clear_bit(R5_ReWrite, &dev->flags);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)
-                    || test_bit(R5_ReadError, &dev->flags)) {
+                if (test_bit(R5_ReadError, &dev->flags))
+                        clear_bit(R5_Insync, &dev->flags);
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         if (s.failed < 2)
                                 r6s.failed_num[s.failed] = i;
                         s.failed++;
-                } else
-                        set_bit(R5_Insync, &dev->flags);
+                }
         }
         rcu_read_unlock();
 
@@ -3318,7 +3446,6 @@ static bool handle_stripe6(struct stripe_head *sh)
          * completed
          */
         if (sh->reconstruct_state == reconstruct_state_drain_result) {
-                int qd_idx = sh->qd_idx;
 
                 sh->reconstruct_state = reconstruct_state_idle;
                 /* All the 'written' buffers and the parity blocks are ready to
@@ -3340,12 +3467,8 @@ static bool handle_stripe6(struct stripe_head *sh)
                                         set_bit(STRIPE_INSYNC, &sh->state);
                         }
                 }
-                if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) {
-                        atomic_dec(&conf->preread_active_stripes);
-                        if (atomic_read(&conf->preread_active_stripes) <
-                                IO_THRESHOLD)
-                                md_wakeup_thread(conf->mddev->thread);
-                }
+                if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+                        dec_preread_active = 1;
         }
 
         /* Now to consider new write requests and what else, if anything
@@ -3454,18 +3577,27 @@ static bool handle_stripe6(struct stripe_head *sh)
 
         ops_run_io(sh, &s);
 
-        return_io(return_bi);
 
-        return blocked_rdev == NULL;
+        if (dec_preread_active) {
+                /* We delay this until after ops_run_io so that if make_request
+                 * is waiting on a barrier, it won't continue until the writes
+                 * have actually been submitted.
+                 */
+                atomic_dec(&conf->preread_active_stripes);
+                if (atomic_read(&conf->preread_active_stripes) <
+                    IO_THRESHOLD)
+                        md_wakeup_thread(conf->mddev->thread);
+        }
+
+        return_io(return_bi);
 }
 
-/* returns true if the stripe was handled */
-static bool handle_stripe(struct stripe_head *sh)
+static void handle_stripe(struct stripe_head *sh)
 {
         if (sh->raid_conf->level == 6)
-                return handle_stripe6(sh);
+                handle_stripe6(sh);
         else
-                return handle_stripe5(sh);
+                handle_stripe5(sh);
 }
 
 static void raid5_activate_delayed(raid5_conf_t *conf)
@@ -3503,9 +3635,10 @@ static void unplug_slaves(mddev_t *mddev)
 {
         raid5_conf_t *conf = mddev->private;
         int i;
+        int devs = max(conf->raid_disks, conf->previous_raid_disks);
 
         rcu_read_lock();
-        for (i = 0; i < conf->raid_disks; i++) {
+        for (i = 0; i < devs; i++) {
                 mdk_rdev_t *rdev = rcu_dereference(conf->disks[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags) && atomic_read(&rdev->nr_pending)) {
                         struct request_queue *r_queue = bdev_get_queue(rdev->bdev);
@@ -3659,10 +3792,10 @@ static void raid5_align_endio(struct bio *bi, int error)
 
         bio_put(bi);
 
-        mddev = raid_bi->bi_bdev->bd_disk->queue->queuedata;
-        conf = mddev->private;
         rdev = (void*)raid_bi->bi_next;
         raid_bi->bi_next = NULL;
+        mddev = rdev->mddev;
+        conf = mddev->private;
 
         rdev_dec_pending(rdev, conf->mddev);
 
@@ -3686,7 +3819,7 @@ static int bio_fits_rdev(struct bio *bi)
         if ((bi->bi_size>>9) > queue_max_sectors(q))
                 return 0;
         blk_recount_segments(q, bi);
-        if (bi->bi_phys_segments > queue_max_phys_segments(q))
+        if (bi->bi_phys_segments > queue_max_segments(q))
                 return 0;
 
         if (q->merge_bvec_fn)
@@ -3699,11 +3832,10 @@ static int bio_fits_rdev(struct bio *bi)
 }
 
 
-static int chunk_aligned_read(struct request_queue *q, struct bio * raid_bio)
+static int chunk_aligned_read(mddev_t *mddev, struct bio * raid_bio)
 {
-        mddev_t *mddev = q->queuedata;
         raid5_conf_t *conf = mddev->private;
-        unsigned int dd_idx;
+        int dd_idx;
         struct bio* align_bi;
         mdk_rdev_t *rdev;
 
@@ -3816,33 +3948,32 @@ static struct stripe_head *__get_priority_stripe(raid5_conf_t *conf)
         return sh;
 }
 
-static int make_request(struct request_queue *q, struct bio * bi)
+static int make_request(mddev_t *mddev, struct bio * bi)
 {
-        mddev_t *mddev = q->queuedata;
         raid5_conf_t *conf = mddev->private;
         int dd_idx;
         sector_t new_sector;
         sector_t logical_sector, last_sector;
         struct stripe_head *sh;
         const int rw = bio_data_dir(bi);
-        int cpu, remaining;
+        int remaining;
 
         if (unlikely(bio_rw_flagged(bi, BIO_RW_BARRIER))) {
-                bio_endio(bi, -EOPNOTSUPP);
+                /* Drain all pending writes.  We only really need
+                 * to ensure they have been submitted, but this is
+                 * easier.
+                 */
+                mddev->pers->quiesce(mddev, 1);
+                mddev->pers->quiesce(mddev, 0);
+                md_barrier_request(mddev, bi);
                 return 0;
         }
 
         md_write_start(mddev, bi);
 
-        cpu = part_stat_lock();
-        part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bi));
-        part_stat_unlock();
-
         if (rw == READ &&
              mddev->reshape_position == MaxSector &&
-             chunk_aligned_read(q,bi))
+             chunk_aligned_read(mddev,bi))
                 return 0;
 
         logical_sector = bi->bi_sector & ~((sector_t)STRIPE_SECTORS-1);
@@ -3890,7 +4021,7 @@ static int make_request(struct request_queue *q, struct bio * bi)
                 new_sector = raid5_compute_sector(conf, logical_sector,
                                                   previous,
                                                   &dd_idx, NULL);
-                pr_debug("raid5: make_request, sector %llu logical %llu\n",
+                pr_debug("raid456: make_request, sector %llu logical %llu\n",
                         (unsigned long long)new_sector, 
                         (unsigned long long)logical_sector);
 
@@ -3952,6 +4083,9 @@ static int make_request(struct request_queue *q, struct bio * bi)
                         finish_wait(&conf->wait_for_overlap, &w);
                         set_bit(STRIPE_HANDLE, &sh->state);
                         clear_bit(STRIPE_DELAYED, &sh->state);
+                        if (mddev->barrier && 
+                            !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+                                atomic_inc(&conf->preread_active_stripes);
                         release_stripe(sh);
                 } else {
                         /* cannot get stripe for read-ahead, just give-up */
@@ -3971,6 +4105,14 @@ static int make_request(struct request_queue *q, struct bio * bi)
 
                 bio_endio(bi, 0);
         }
+
+        if (mddev->barrier) {
+                /* We need to wait for the stripes to all be handled.
+                 * So: wait for preread_active_stripes to drop to 0.
+                 */
+                wait_event(mddev->thread->wqueue,
+                           atomic_read(&conf->preread_active_stripes) == 0);
+        }
         return 0;
 }
 
@@ -3987,7 +4129,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
          * As the reads complete, handle_stripe will copy the data
          * into the destination stripe and release that stripe.
          */
-        raid5_conf_t *conf = (raid5_conf_t *) mddev->private;
+        raid5_conf_t *conf = mddev->private;
         struct stripe_head *sh;
         sector_t first_sector, last_sector;
         int raid_disks = conf->previous_raid_disks;
@@ -4011,6 +4153,8 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                         sector_nr = conf->reshape_progress;
                 sector_div(sector_nr, new_data_disks);
                 if (sector_nr) {
+                        mddev->curr_resync_completed = sector_nr;
+                        sysfs_notify(&mddev->kobj, NULL, "sync_completed");
                         *skipped = 1;
                         return sector_nr;
                 }
@@ -4194,7 +4338,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
 /* FIXME go_faster isn't used */
 static inline sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, int go_faster)
 {
-        raid5_conf_t *conf = (raid5_conf_t *) mddev->private;
+        raid5_conf_t *conf = mddev->private;
         struct stripe_head *sh;
         sector_t max_sector = mddev->dev_sectors;
         int sync_blocks;
@@ -4277,9 +4421,7 @@ static inline sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *ski
         clear_bit(STRIPE_INSYNC, &sh->state);
         spin_unlock(&sh->lock);
 
-        /* wait for any blocked device to be handled */
-        while (unlikely(!handle_stripe(sh)))
-                ;
+        handle_stripe(sh);
         release_stripe(sh);
 
         return STRIPE_SECTORS;
@@ -4349,37 +4491,6 @@ static int  retry_aligned_read(raid5_conf_t *conf, struct bio *raid_bio)
         return handled;
 }
 
-#ifdef CONFIG_MULTICORE_RAID456
-static void __process_stripe(void *param, async_cookie_t cookie)
-{
-        struct stripe_head *sh = param;
-
-        handle_stripe(sh);
-        release_stripe(sh);
-}
-
-static void process_stripe(struct stripe_head *sh, struct list_head *domain)
-{
-        async_schedule_domain(__process_stripe, sh, domain);
-}
-
-static void synchronize_stripe_processing(struct list_head *domain)
-{
-        async_synchronize_full_domain(domain);
-}
-#else
-static void process_stripe(struct stripe_head *sh, struct list_head *domain)
-{
-        handle_stripe(sh);
-        release_stripe(sh);
-        cond_resched();
-}
-
-static void synchronize_stripe_processing(struct list_head *domain)
-{
-}
-#endif
-
 
 /*
  * This is our raid5 kernel thread.
@@ -4393,7 +4504,6 @@ static void raid5d(mddev_t *mddev)
         struct stripe_head *sh;
         raid5_conf_t *conf = mddev->private;
         int handled;
-        LIST_HEAD(raid_domain);
 
         pr_debug("+++ raid5d active\n");
 
@@ -4430,7 +4540,9 @@ static void raid5d(mddev_t *mddev)
                 spin_unlock_irq(&conf->device_lock);
                 
                 handled++;
-                process_stripe(sh, &raid_domain);
+                handle_stripe(sh);
+                release_stripe(sh);
+                cond_resched();
 
                 spin_lock_irq(&conf->device_lock);
         }
@@ -4438,7 +4550,6 @@ static void raid5d(mddev_t *mddev)
 
         spin_unlock_irq(&conf->device_lock);
 
-        synchronize_stripe_processing(&raid_domain);
         async_tx_issue_pending_all();
         unplug_slaves(mddev);
 
@@ -4558,13 +4669,9 @@ raid5_size(mddev_t *mddev, sector_t sectors, int raid_disks)
 
         if (!sectors)
                 sectors = mddev->dev_sectors;
-        if (!raid_disks) {
+        if (!raid_disks)
                 /* size is defined by the smallest of previous and new size */
-                if (conf->raid_disks < conf->previous_raid_disks)
-                        raid_disks = conf->raid_disks;
-                else
-                        raid_disks = conf->previous_raid_disks;
-        }
+                raid_disks = min(conf->raid_disks, conf->previous_raid_disks);
 
         sectors &= ~((sector_t)mddev->chunk_sectors - 1);
         sectors &= ~((sector_t)mddev->new_chunk_sectors - 1);
@@ -4624,7 +4731,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
                         kfree(percpu->scribble);
                         pr_err("%s: failed memory allocation for cpu%ld\n",
                                __func__, cpu);
-                        return NOTIFY_BAD;
+                        return notifier_from_errno(-ENOMEM);
                 }
                 break;
         case CPU_DEAD:
@@ -4645,7 +4752,7 @@ static int raid5_alloc_percpu(raid5_conf_t *conf)
 {
         unsigned long cpu;
         struct page *spare_page;
-        struct raid5_percpu *allcpus;
+        struct raid5_percpu __percpu *allcpus;
         void *scribble;
         int err;
 
@@ -4665,7 +4772,7 @@ static int raid5_alloc_percpu(raid5_conf_t *conf)
                         }
                         per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page;
                 }
-                scribble = kmalloc(scribble_len(conf->raid_disks), GFP_KERNEL);
+                scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
                 if (!scribble) {
                         err = -ENOMEM;
                         break;
@@ -4686,14 +4793,14 @@ static int raid5_alloc_percpu(raid5_conf_t *conf)
 static raid5_conf_t *setup_conf(mddev_t *mddev)
 {
         raid5_conf_t *conf;
-        int raid_disk, memory;
+        int raid_disk, memory, max_disks;
         mdk_rdev_t *rdev;
         struct disk_info *disk;
 
         if (mddev->new_level != 5
             && mddev->new_level != 4
             && mddev->new_level != 6) {
-                printk(KERN_ERR "raid5: %s: raid level not set to 4/5/6 (%d)\n",
+                printk(KERN_ERR "md/raid:%s: raid level not set to 4/5/6 (%d)\n",
                        mdname(mddev), mddev->new_level);
                 return ERR_PTR(-EIO);
         }
@@ -4701,12 +4808,12 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
              && !algorithm_valid_raid5(mddev->new_layout)) ||
             (mddev->new_level == 6
              && !algorithm_valid_raid6(mddev->new_layout))) {
-                printk(KERN_ERR "raid5: %s: layout %d not supported\n",
+                printk(KERN_ERR "md/raid:%s: layout %d not supported\n",
                        mdname(mddev), mddev->new_layout);
                 return ERR_PTR(-EIO);
         }
         if (mddev->new_level == 6 && mddev->raid_disks < 4) {
-                printk(KERN_ERR "raid6: not enough configured devices for %s (%d, minimum 4)\n",
+                printk(KERN_ERR "md/raid:%s: not enough configured devices (%d, minimum 4)\n",
                        mdname(mddev), mddev->raid_disks);
                 return ERR_PTR(-EINVAL);
         }
@@ -4714,23 +4821,36 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
         if (!mddev->new_chunk_sectors ||
             (mddev->new_chunk_sectors << 9) % PAGE_SIZE ||
             !is_power_of_2(mddev->new_chunk_sectors)) {
-                printk(KERN_ERR "raid5: invalid chunk size %d for %s\n",
-                       mddev->new_chunk_sectors << 9, mdname(mddev));
+                printk(KERN_ERR "md/raid:%s: invalid chunk size %d\n",
+                       mdname(mddev), mddev->new_chunk_sectors << 9);
                 return ERR_PTR(-EINVAL);
         }
 
         conf = kzalloc(sizeof(raid5_conf_t), GFP_KERNEL);
         if (conf == NULL)
                 goto abort;
+        spin_lock_init(&conf->device_lock);
+        init_waitqueue_head(&conf->wait_for_stripe);
+        init_waitqueue_head(&conf->wait_for_overlap);
+        INIT_LIST_HEAD(&conf->handle_list);
+        INIT_LIST_HEAD(&conf->hold_list);
+        INIT_LIST_HEAD(&conf->delayed_list);
+        INIT_LIST_HEAD(&conf->bitmap_list);
+        INIT_LIST_HEAD(&conf->inactive_list);
+        atomic_set(&conf->active_stripes, 0);
+        atomic_set(&conf->preread_active_stripes, 0);
+        atomic_set(&conf->active_aligned_reads, 0);
+        conf->bypass_threshold = BYPASS_THRESHOLD;
 
         conf->raid_disks = mddev->raid_disks;
-        conf->scribble_len = scribble_len(conf->raid_disks);
         if (mddev->reshape_position == MaxSector)
                 conf->previous_raid_disks = mddev->raid_disks;
         else
                 conf->previous_raid_disks = mddev->raid_disks - mddev->delta_disks;
+        max_disks = max(conf->raid_disks, conf->previous_raid_disks);
+        conf->scribble_len = scribble_len(max_disks);
 
-        conf->disks = kzalloc(conf->raid_disks * sizeof(struct disk_info),
+        conf->disks = kzalloc(max_disks * sizeof(struct disk_info),
                               GFP_KERNEL);
         if (!conf->disks)
                 goto abort;
@@ -4744,24 +4864,11 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
         if (raid5_alloc_percpu(conf) != 0)
                 goto abort;
 
-        spin_lock_init(&conf->device_lock);
-        init_waitqueue_head(&conf->wait_for_stripe);
-        init_waitqueue_head(&conf->wait_for_overlap);
-        INIT_LIST_HEAD(&conf->handle_list);
-        INIT_LIST_HEAD(&conf->hold_list);
-        INIT_LIST_HEAD(&conf->delayed_list);
-        INIT_LIST_HEAD(&conf->bitmap_list);
-        INIT_LIST_HEAD(&conf->inactive_list);
-        atomic_set(&conf->active_stripes, 0);
-        atomic_set(&conf->preread_active_stripes, 0);
-        atomic_set(&conf->active_aligned_reads, 0);
-        conf->bypass_threshold = BYPASS_THRESHOLD;
-
-        pr_debug("raid5: run(%s) called.\n", mdname(mddev));
+        pr_debug("raid456: run(%s) called.\n", mdname(mddev));
 
         list_for_each_entry(rdev, &mddev->disks, same_set) {
                 raid_disk = rdev->raid_disk;
-                if (raid_disk >= conf->raid_disks
+                if (raid_disk >= max_disks
                     || raid_disk < 0)
                         continue;
                 disk = conf->disks + raid_disk;
@@ -4770,9 +4877,9 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
 
                 if (test_bit(In_sync, &rdev->flags)) {
                         char b[BDEVNAME_SIZE];
-                        printk(KERN_INFO "raid5: device %s operational as raid"
-                                " disk %d\n", bdevname(rdev->bdev,b),
-                                raid_disk);
+                        printk(KERN_INFO "md/raid:%s: device %s operational as raid"
+                               " disk %d\n",
+                               mdname(mddev), bdevname(rdev->bdev, b), raid_disk);
                 } else
                         /* Cannot rely on bitmap to complete recovery */
                         conf->fullsync = 1;
@@ -4793,19 +4900,20 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
         }
 
         memory = conf->max_nr_stripes * (sizeof(struct stripe_head) +
-                 conf->raid_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
+                 max_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
         if (grow_stripes(conf, conf->max_nr_stripes)) {
                 printk(KERN_ERR
-                        "raid5: couldn't allocate %dkB for buffers\n", memory);
+                       "md/raid:%s: couldn't allocate %dkB for buffers\n",
+                       mdname(mddev), memory);
                 goto abort;
         } else
-                printk(KERN_INFO "raid5: allocated %dkB for %s\n",
-                        memory, mdname(mddev));
+                printk(KERN_INFO "md/raid:%s: allocated %dkB\n",
+                       mdname(mddev), memory);
 
         conf->thread = md_register_thread(raid5d, mddev, NULL);
         if (!conf->thread) {
                 printk(KERN_ERR
-                       "raid5: couldn't allocate thread for %s\n",
+                       "md/raid:%s: couldn't allocate thread.\n",
                        mdname(mddev));
                 goto abort;
         }
@@ -4820,14 +4928,43 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
                 return ERR_PTR(-ENOMEM);
 }
 
+
+static int only_parity(int raid_disk, int algo, int raid_disks, int max_degraded)
+{
+        switch (algo) {
+        case ALGORITHM_PARITY_0:
+                if (raid_disk < max_degraded)
+                        return 1;
+                break;
+        case ALGORITHM_PARITY_N:
+                if (raid_disk >= raid_disks - max_degraded)
+                        return 1;
+                break;
+        case ALGORITHM_PARITY_0_6:
+                if (raid_disk == 0 || 
+                    raid_disk == raid_disks - 1)
+                        return 1;
+                break;
+        case ALGORITHM_LEFT_ASYMMETRIC_6:
+        case ALGORITHM_RIGHT_ASYMMETRIC_6:
+        case ALGORITHM_LEFT_SYMMETRIC_6:
+        case ALGORITHM_RIGHT_SYMMETRIC_6:
+                if (raid_disk == raid_disks - 1)
+                        return 1;
+        }
+        return 0;
+}
+
 static int run(mddev_t *mddev)
 {
         raid5_conf_t *conf;
         int working_disks = 0, chunk_size;
+        int dirty_parity_disks = 0;
         mdk_rdev_t *rdev;
+        sector_t reshape_offset = 0;
 
         if (mddev->recovery_cp != MaxSector)
-                printk(KERN_NOTICE "raid5: %s is not clean"
+                printk(KERN_NOTICE "md/raid:%s: not clean"
                        " -- starting background reconstruction\n",
                        mdname(mddev));
         if (mddev->reshape_position != MaxSector) {
@@ -4841,7 +4978,7 @@ static int run(mddev_t *mddev)
                 int max_degraded = (mddev->level == 6 ? 2 : 1);
 
                 if (mddev->new_level != mddev->level) {
-                        printk(KERN_ERR "raid5: %s: unsupported reshape "
+                        printk(KERN_ERR "md/raid:%s: unsupported reshape "
                                "required - aborting.\n",
                                mdname(mddev));
                         return -EINVAL;
@@ -4854,10 +4991,11 @@ static int run(mddev_t *mddev)
                 here_new = mddev->reshape_position;
                 if (sector_div(here_new, mddev->new_chunk_sectors *
                                (mddev->raid_disks - max_degraded))) {
-                        printk(KERN_ERR "raid5: reshape_position not "
-                               "on a stripe boundary\n");
+                        printk(KERN_ERR "md/raid:%s: reshape_position not "
+                               "on a stripe boundary\n", mdname(mddev));
                         return -EINVAL;
                 }
+                reshape_offset = here_new * mddev->new_chunk_sectors;
                 /* here_new is the stripe we will write to */
                 here_old = mddev->reshape_position;
                 sector_div(here_old, mddev->chunk_sectors *
@@ -4875,8 +5013,9 @@ static int run(mddev_t *mddev)
                         if ((here_new * mddev->new_chunk_sectors != 
                              here_old * mddev->chunk_sectors) ||
                             mddev->ro == 0) {
-                                printk(KERN_ERR "raid5: in-place reshape must be started"
-                                       " in read-only mode - aborting\n");
+                                printk(KERN_ERR "md/raid:%s: in-place reshape must be started"
+                                       " in read-only mode - aborting\n",
+                                       mdname(mddev));
                                 return -EINVAL;
                         }
                 } else if (mddev->delta_disks < 0
@@ -4885,11 +5024,13 @@ static int run(mddev_t *mddev)
                     : (here_new * mddev->new_chunk_sectors >=
                        here_old * mddev->chunk_sectors)) {
                         /* Reading from the same stripe as writing to - bad */
-                        printk(KERN_ERR "raid5: reshape_position too early for "
-                               "auto-recovery - aborting.\n");
+                        printk(KERN_ERR "md/raid:%s: reshape_position too early for "
+                               "auto-recovery - aborting.\n",
+                               mdname(mddev));
                         return -EINVAL;
                 }
-                printk(KERN_INFO "raid5: reshape will continue\n");
+                printk(KERN_INFO "md/raid:%s: reshape will continue\n",
+                       mdname(mddev));
                 /* OK, we should be able to continue; */
         } else {
                 BUG_ON(mddev->level != mddev->new_level);
@@ -4913,15 +5054,47 @@ static int run(mddev_t *mddev)
         /*
          * 0 for a fully functional array, 1 or 2 for a degraded array.
          */
-        list_for_each_entry(rdev, &mddev->disks, same_set)
-                if (rdev->raid_disk >= 0 &&
-                    test_bit(In_sync, &rdev->flags))
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                if (rdev->raid_disk < 0)
+                        continue;
+                if (test_bit(In_sync, &rdev->flags)) {
                         working_disks++;
+                        continue;
+                }
+                /* This disc is not fully in-sync.  However if it
+                 * just stored parity (beyond the recovery_offset),
+                 * when we don't need to be concerned about the
+                 * array being dirty.
+                 * When reshape goes 'backwards', we never have
+                 * partially completed devices, so we only need
+                 * to worry about reshape going forwards.
+                 */
+                /* Hack because v0.91 doesn't store recovery_offset properly. */
+                if (mddev->major_version == 0 &&
+                    mddev->minor_version > 90)
+                        rdev->recovery_offset = reshape_offset;
+                        
+                if (rdev->recovery_offset < reshape_offset) {
+                        /* We need to check old and new layout */
+                        if (!only_parity(rdev->raid_disk,
+                                         conf->algorithm,
+                                         conf->raid_disks,
+                                         conf->max_degraded))
+                                continue;
+                }
+                if (!only_parity(rdev->raid_disk,
+                                 conf->prev_algo,
+                                 conf->previous_raid_disks,
+                                 conf->max_degraded))
+                        continue;
+                dirty_parity_disks++;
+        }
 
-        mddev->degraded = conf->raid_disks - working_disks;
+        mddev->degraded = (max(conf->raid_disks, conf->previous_raid_disks)
+                           - working_disks);
 
-        if (mddev->degraded > conf->max_degraded) {
-                printk(KERN_ERR "raid5: not enough operational devices for %s"
+        if (has_failed(conf)) {
+                printk(KERN_ERR "md/raid:%s: not enough operational devices"
                         " (%d/%d failed)\n",
                         mdname(mddev), mddev->degraded, conf->raid_disks);
                 goto abort;
@@ -4931,36 +5104,36 @@ static int run(mddev_t *mddev)
         mddev->dev_sectors &= ~(mddev->chunk_sectors - 1);
         mddev->resync_max_sectors = mddev->dev_sectors;
 
-        if (mddev->degraded > 0 &&
+        if (mddev->degraded > dirty_parity_disks &&
             mddev->recovery_cp != MaxSector) {
                 if (mddev->ok_start_degraded)
                         printk(KERN_WARNING
-                               "raid5: starting dirty degraded array: %s"
-                               "- data corruption possible.\n",
+                               "md/raid:%s: starting dirty degraded array"
+                               " - data corruption possible.\n",
                                mdname(mddev));
                 else {
                         printk(KERN_ERR
-                               "raid5: cannot start dirty degraded array for %s\n",
+                               "md/raid:%s: cannot start dirty degraded array.\n",
                                mdname(mddev));
                         goto abort;
                 }
         }
 
         if (mddev->degraded == 0)
-                printk("raid5: raid level %d set %s active with %d out of %d"
-                       " devices, algorithm %d\n", conf->level, mdname(mddev),
+                printk(KERN_INFO "md/raid:%s: raid level %d active with %d out of %d"
+                       " devices, algorithm %d\n", mdname(mddev), conf->level,
                        mddev->raid_disks-mddev->degraded, mddev->raid_disks,
                        mddev->new_layout);
         else
-                printk(KERN_ALERT "raid5: raid level %d set %s active with %d"
-                        " out of %d devices, algorithm %d\n", conf->level,
-                        mdname(mddev), mddev->raid_disks - mddev->degraded,
-                        mddev->raid_disks, mddev->new_layout);
+                printk(KERN_ALERT "md/raid:%s: raid level %d active with %d"
+                       " out of %d devices, algorithm %d\n",
+                       mdname(mddev), conf->level,
+                       mddev->raid_disks - mddev->degraded,
+                       mddev->raid_disks, mddev->new_layout);
 
         print_raid5_conf(conf);
 
         if (conf->reshape_progress != MaxSector) {
-                printk("...ok start reshape thread\n");
                 conf->reshape_safe = conf->reshape_progress;
                 atomic_set(&conf->reshape_stripes, 0);
                 clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
@@ -4983,9 +5156,11 @@ static int run(mddev_t *mddev)
         }
 
         /* Ok, everything is just fine now */
-        if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group))
+        if (mddev->to_remove == &raid5_attrs_group)
+                mddev->to_remove = NULL;
+        else if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group))
                 printk(KERN_WARNING
-                       "raid5: failed to create sysfs attributes for %s\n",
+                       "md/raid:%s: failed to create sysfs attributes.\n",
                        mdname(mddev));
 
         mddev->queue->queue_lock = &conf->device_lock;
@@ -5015,23 +5190,21 @@ abort:
                 free_conf(conf);
         }
         mddev->private = NULL;
-        printk(KERN_ALERT "raid5: failed to run raid set %s\n", mdname(mddev));
+        printk(KERN_ALERT "md/raid:%s: failed to run raid set.\n", mdname(mddev));
         return -EIO;
 }
 
-
-
 static int stop(mddev_t *mddev)
 {
-        raid5_conf_t *conf = (raid5_conf_t *) mddev->private;
+        raid5_conf_t *conf = mddev->private;
 
         md_unregister_thread(mddev->thread);
         mddev->thread = NULL;
         mddev->queue->backing_dev_info.congested_fn = NULL;
         blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
-        sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
         free_conf(conf);
         mddev->private = NULL;
+        mddev->to_remove = &raid5_attrs_group;
         return 0;
 }
 
@@ -5072,7 +5245,7 @@ static void printall(struct seq_file *seq, raid5_conf_t *conf)
 
 static void status(struct seq_file *seq, mddev_t *mddev)
 {
-        raid5_conf_t *conf = (raid5_conf_t *) mddev->private;
+        raid5_conf_t *conf = mddev->private;
         int i;
 
         seq_printf(seq, " level %d, %dk chunk, algorithm %d", mddev->level,
@@ -5094,21 +5267,22 @@ static void print_raid5_conf (raid5_conf_t *conf)
         int i;
         struct disk_info *tmp;
 
-        printk("RAID5 conf printout:\n");
+        printk(KERN_DEBUG "RAID conf printout:\n");
         if (!conf) {
                 printk("(conf==NULL)\n");
                 return;
         }
-        printk(" --- rd:%d wd:%d\n", conf->raid_disks,
-                 conf->raid_disks - conf->mddev->degraded);
+        printk(KERN_DEBUG " --- level:%d rd:%d wd:%d\n", conf->level,
+               conf->raid_disks,
+               conf->raid_disks - conf->mddev->degraded);
 
         for (i = 0; i < conf->raid_disks; i++) {
                 char b[BDEVNAME_SIZE];
                 tmp = conf->disks + i;
                 if (tmp->rdev)
-                printk(" disk %d, o:%d, dev:%s\n",
-                        i, !test_bit(Faulty, &tmp->rdev->flags),
-                        bdevname(tmp->rdev->bdev,b));
+                        printk(KERN_DEBUG " disk %d, o:%d, dev:%s\n",
+                               i, !test_bit(Faulty, &tmp->rdev->flags),
+                               bdevname(tmp->rdev->bdev, b));
         }
 }
 
@@ -5121,6 +5295,7 @@ static int raid5_spare_active(mddev_t *mddev)
         for (i = 0; i < conf->raid_disks; i++) {
                 tmp = conf->disks + i;
                 if (tmp->rdev
+                    && tmp->rdev->recovery_offset == MaxSector
                     && !test_bit(Faulty, &tmp->rdev->flags)
                     && !test_and_set_bit(In_sync, &tmp->rdev->flags)) {
                         unsigned long flags;
@@ -5156,7 +5331,7 @@ static int raid5_remove_disk(mddev_t *mddev, int number)
                  * isn't possible.
                  */
                 if (!test_bit(Faulty, &rdev->flags) &&
-                    mddev->degraded <= conf->max_degraded &&
+                    !has_failed(conf) &&
                     number < conf->raid_disks) {
                         err = -EBUSY;
                         goto abort;
@@ -5184,7 +5359,7 @@ static int raid5_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
         int first = 0;
         int last = conf->raid_disks - 1;
 
-        if (mddev->degraded > conf->max_degraded)
+        if (has_failed(conf))
                 /* no point adding a device */
                 return -EINVAL;
 
@@ -5231,7 +5406,6 @@ static int raid5_resize(mddev_t *mddev, sector_t sectors)
             raid5_size(mddev, sectors, mddev->raid_disks))
                 return -EINVAL;
         set_capacity(mddev->gendisk, mddev->array_sectors);
-        mddev->changed = 1;
         revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors && mddev->recovery_cp == MaxSector) {
                 mddev->recovery_cp = mddev->dev_sectors;
@@ -5257,7 +5431,8 @@ static int check_stripe_cache(mddev_t *mddev)
             > conf->max_nr_stripes ||
             ((mddev->new_chunk_sectors << 9) / STRIPE_SIZE) * 4
             > conf->max_nr_stripes) {
-                printk(KERN_WARNING "raid5: reshape: not enough stripes.  Needed %lu\n",
+                printk(KERN_WARNING "md/raid:%s: reshape: not enough stripes.  Needed %lu\n",
+                       mdname(mddev),
                        ((max(mddev->chunk_sectors, mddev->new_chunk_sectors) << 9)
                         / STRIPE_SIZE)*4);
                 return 0;
@@ -5276,7 +5451,7 @@ static int check_reshape(mddev_t *mddev)
         if (mddev->bitmap)
                 /* Cannot grow a bitmap yet */
                 return -EBUSY;
-        if (mddev->degraded > conf->max_degraded)
+        if (has_failed(conf))
                 return -EINVAL;
         if (mddev->delta_disks < 0) {
                 /* We might be able to shrink, but the devices must
@@ -5328,7 +5503,7 @@ static int raid5_start_reshape(mddev_t *mddev)
          */
         if (raid5_size(mddev, 0, conf->raid_disks + mddev->delta_disks)
             < mddev->array_sectors) {
-                printk(KERN_ERR "md: %s: array size must be reduced "
+                printk(KERN_ERR "md/raid:%s: array size must be reduced "
                        "before number of disks\n", mdname(mddev));
                 return -EINVAL;
         }
@@ -5351,29 +5526,39 @@ static int raid5_start_reshape(mddev_t *mddev)
 
         /* Add some new drives, as many as will fit.
          * We know there are enough to make the newly sized array work.
+         * Don't add devices if we are reducing the number of
+         * devices in the array.  This is because it is not possible
+         * to correctly record the "partially reconstructed" state of
+         * such devices during the reshape and confusion could result.
          */
-        list_for_each_entry(rdev, &mddev->disks, same_set)
+        if (mddev->delta_disks >= 0)
+            list_for_each_entry(rdev, &mddev->disks, same_set)
                 if (rdev->raid_disk < 0 &&
                     !test_bit(Faulty, &rdev->flags)) {
                         if (raid5_add_disk(mddev, rdev) == 0) {
                                 char nm[20];
-                                set_bit(In_sync, &rdev->flags);
-                                added_devices++;
-                                rdev->recovery_offset = 0;
+                                if (rdev->raid_disk >= conf->previous_raid_disks) {
+                                        set_bit(In_sync, &rdev->flags);
+                                        added_devices++;
+                                } else
+                                        rdev->recovery_offset = 0;
                                 sprintf(nm, "rd%d", rdev->raid_disk);
                                 if (sysfs_create_link(&mddev->kobj,
                                                       &rdev->kobj, nm))
                                         printk(KERN_WARNING
-                                               "raid5: failed to create "
-                                               " link %s for %s\n",
-                                               nm, mdname(mddev));
+                                               "md/raid:%s: failed to create "
+                                               " link %s\n",
+                                               mdname(mddev), nm);
                         } else
                                 break;
                 }
 
+        /* When a reshape changes the number of devices, ->degraded
+         * is measured against the larger of the pre and post number of
+         * devices.*/
         if (mddev->delta_disks > 0) {
                 spin_lock_irqsave(&conf->device_lock, flags);
-                mddev->degraded = (conf->raid_disks - conf->previous_raid_disks)
+                mddev->degraded += (conf->raid_disks - conf->previous_raid_disks)
                         - added_devices;
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
@@ -5440,7 +5625,6 @@ static void raid5_finish_reshape(mddev_t *mddev)
                 if (mddev->delta_disks > 0) {
                         md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
                         set_capacity(mddev->gendisk, mddev->array_sectors);
-                        mddev->changed = 1;
                         revalidate_disk(mddev->gendisk);
                 } else {
                         int d;
@@ -5505,6 +5689,29 @@ static void raid5_quiesce(mddev_t *mddev, int state)
 }
 
 
+static void *raid45_takeover_raid0(mddev_t *mddev, int level)
+{
+        struct raid0_private_data *raid0_priv = mddev->private;
+
+        /* for raid0 takeover only one zone is supported */
+        if (raid0_priv->nr_strip_zones > 1) {
+                printk(KERN_ERR "md/raid:%s: cannot takeover raid0 with more than one zone.\n",
+                       mdname(mddev));
+                return ERR_PTR(-EINVAL);
+        }
+
+        mddev->new_level = level;
+        mddev->new_layout = ALGORITHM_PARITY_N;
+        mddev->new_chunk_sectors = mddev->chunk_sectors;
+        mddev->raid_disks += 1;
+        mddev->delta_disks = 1;
+        /* make sure it will be not marked as dirty */
+        mddev->recovery_cp = MaxSector;
+
+        return setup_conf(mddev);
+}
+
+
 static void *raid5_takeover_raid1(mddev_t *mddev)
 {
         int chunksect;
@@ -5629,12 +5836,13 @@ static int raid6_check_reshape(mddev_t *mddev)
 static void *raid5_takeover(mddev_t *mddev)
 {
         /* raid5 can take over:
-         *  raid0 - if all devices are the same - make it a raid4 layout
+         *  raid0 - if there is only one strip zone - make it a raid4 layout
          *  raid1 - if there are two drives.  We need to know the chunk size
          *  raid4 - trivial - just use a raid4 layout.
          *  raid6 - Providing it is a *_6 layout
          */
-
+        if (mddev->level == 0)
+                return raid45_takeover_raid0(mddev, 5);
         if (mddev->level == 1)
                 return raid5_takeover_raid1(mddev);
         if (mddev->level == 4) {
@@ -5648,6 +5856,22 @@ static void *raid5_takeover(mddev_t *mddev)
         return ERR_PTR(-EINVAL);
 }
 
+static void *raid4_takeover(mddev_t *mddev)
+{
+        /* raid4 can take over:
+         *  raid0 - if there is only one strip zone
+         *  raid5 - if layout is right
+         */
+        if (mddev->level == 0)
+                return raid45_takeover_raid0(mddev, 4);
+        if (mddev->level == 5 &&
+            mddev->layout == ALGORITHM_PARITY_N) {
+                mddev->new_layout = 0;
+                mddev->new_level = 4;
+                return setup_conf(mddev);
+        }
+        return ERR_PTR(-EINVAL);
+}
 
 static struct mdk_personality raid5_personality;
 
@@ -5763,6 +5987,7 @@ static struct mdk_personality raid4_personality =
         .start_reshape  = raid5_start_reshape,
         .finish_reshape = raid5_finish_reshape,
         .quiesce        = raid5_quiesce,
+        .takeover       = raid4_takeover,
 };
 
 static int __init raid5_init(void)
@@ -5783,6 +6008,7 @@ static void raid5_exit(void)
 module_init(raid5_init);
 module_exit(raid5_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID4/5/6 (striping with parity) personality for MD");
 MODULE_ALIAS("md-personality-4"); /* RAID5 */
 MODULE_ALIAS("md-raid5");
 MODULE_ALIAS("md-raid4");
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 2390e0e83daf..0f86f5e36724 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -214,12 +214,20 @@ struct stripe_head {
         int                     disks;          /* disks in stripe */
         enum check_states       check_state;
         enum reconstruct_states reconstruct_state;
-        /* stripe_operations
+        /**
+         * struct stripe_operations
          * @target - STRIPE_OP_COMPUTE_BLK target
+         * @target2 - 2nd compute target in the raid6 case
+         * @zero_sum_result - P and Q verification flags
+         * @request - async service request flags for raid_run_ops
          */
         struct stripe_operations {
                 int                  target, target2;
                 enum sum_check_flags zero_sum_result;
+                #ifdef CONFIG_MULTICORE_RAID456
+                unsigned long        request;
+                wait_queue_head_t    wait_for_ops;
+                #endif
         } ops;
         struct r5dev {
                 struct bio      req;
@@ -294,6 +302,8 @@ struct r6_state {
 #define STRIPE_FULL_WRITE       13 /* all blocks are set to be overwritten */
 #define STRIPE_BIOFILL_RUN      14
 #define STRIPE_COMPUTE_RUN      15
+#define STRIPE_OPS_REQ_PENDING  16
+
 /*
  * Operation request flags
  */
@@ -395,7 +405,7 @@ struct raid5_private_data {
                                               * lists and performing address
                                               * conversions
                                               */
-        } *percpu;
+        } __percpu *percpu;
         size_t                  scribble_len; /* size of scribble region must be
                                                * associated with conf to handle
                                                * cpu hotplug while reshaping
@@ -478,7 +488,7 @@ static inline int algorithm_valid_raid6(int layout)
 {
         return (layout >= 0 && layout <= 5)
                 ||
-                (layout == 8 || layout == 10)
+                (layout >= 8 && layout <= 10)
                 ||
                 (layout >= 16 && layout <= 20);
 }