77 files changed, 6337 insertions, 1521 deletions

diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 88e42abf5d88..0df8fcb687d6 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -61,6 +61,7 @@ static int acpi_ac_open_fs(struct inode *inode, struct file *file);
 static int acpi_ac_add(struct acpi_device *device);
 static int acpi_ac_remove(struct acpi_device *device, int type);
 static int acpi_ac_resume(struct acpi_device *device);
+static void acpi_ac_notify(struct acpi_device *device, u32 event);
 
 static const struct acpi_device_id ac_device_ids[] = {
         {"ACPI0003", 0},
@@ -72,10 +73,12 @@ static struct acpi_driver acpi_ac_driver = {
         .name = "ac",
         .class = ACPI_AC_CLASS,
         .ids = ac_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
         .ops = {
                 .add = acpi_ac_add,
                 .remove = acpi_ac_remove,
                 .resume = acpi_ac_resume,
+                .notify = acpi_ac_notify,
                 },
 };
 
@@ -220,16 +223,14 @@ static int acpi_ac_remove_fs(struct acpi_device *device)
                                    Driver Model
    -------------------------------------------------------------------------- */
 
-static void acpi_ac_notify(acpi_handle handle, u32 event, void *data)
+static void acpi_ac_notify(struct acpi_device *device, u32 event)
 {
-        struct acpi_ac *ac = data;
-        struct acpi_device *device = NULL;
+        struct acpi_ac *ac = acpi_driver_data(device);
 
 
         if (!ac)
                 return;
 
-        device = ac->device;
         switch (event) {
         default:
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
@@ -253,7 +254,6 @@ static void acpi_ac_notify(acpi_handle handle, u32 event, void *data)
 static int acpi_ac_add(struct acpi_device *device)
 {
         int result = 0;
-        acpi_status status = AE_OK;
         struct acpi_ac *ac = NULL;
 
 
@@ -286,13 +286,6 @@ static int acpi_ac_add(struct acpi_device *device)
         ac->charger.get_property = get_ac_property;
         power_supply_register(&ac->device->dev, &ac->charger);
 #endif
-        status = acpi_install_notify_handler(device->handle,
-                                             ACPI_ALL_NOTIFY, acpi_ac_notify,
-                                             ac);
-        if (ACPI_FAILURE(status)) {
-                result = -ENODEV;
-                goto end;
-        }
 
         printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
                acpi_device_name(device), acpi_device_bid(device),
@@ -328,7 +321,6 @@ static int acpi_ac_resume(struct acpi_device *device)
 
 static int acpi_ac_remove(struct acpi_device *device, int type)
 {
-        acpi_status status = AE_OK;
         struct acpi_ac *ac = NULL;
 
 
@@ -337,8 +329,6 @@ static int acpi_ac_remove(struct acpi_device *device, int type)
 
         ac = acpi_driver_data(device);
 
-        status = acpi_remove_notify_handler(device->handle,
-                                            ACPI_ALL_NOTIFY, acpi_ac_notify);
 #ifdef CONFIG_ACPI_SYSFS_POWER
         if (ac->charger.dev)
                 power_supply_unregister(&ac->charger);
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index b0de6312919a..58b4517ce712 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -796,13 +796,12 @@ static void acpi_battery_remove_fs(struct acpi_device *device)
                                  Driver Interface
    -------------------------------------------------------------------------- */
 
-static void acpi_battery_notify(acpi_handle handle, u32 event, void *data)
+static void acpi_battery_notify(struct acpi_device *device, u32 event)
 {
-        struct acpi_battery *battery = data;
-        struct acpi_device *device;
+        struct acpi_battery *battery = acpi_driver_data(device);
+
         if (!battery)
                 return;
-        device = battery->device;
         acpi_battery_update(battery);
         acpi_bus_generate_proc_event(device, event,
                                      acpi_battery_present(battery));
@@ -819,7 +818,6 @@ static void acpi_battery_notify(acpi_handle handle, u32 event, void *data)
 static int acpi_battery_add(struct acpi_device *device)
 {
         int result = 0;
-        acpi_status status = 0;
         struct acpi_battery *battery = NULL;
         if (!device)
                 return -EINVAL;
@@ -834,22 +832,12 @@ static int acpi_battery_add(struct acpi_device *device)
         acpi_battery_update(battery);
 #ifdef CONFIG_ACPI_PROCFS_POWER
         result = acpi_battery_add_fs(device);
-        if (result)
-                goto end;
 #endif
-        status = acpi_install_notify_handler(device->handle,
-                                             ACPI_ALL_NOTIFY,
-                                             acpi_battery_notify, battery);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status, "Installing notify handler"));
-                result = -ENODEV;
-                goto end;
-        }
-        printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
-               ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
-               device->status.battery_present ? "present" : "absent");
-      end:
-        if (result) {
+        if (!result) {
+                printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
+                        ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
+                        device->status.battery_present ? "present" : "absent");
+        } else {
 #ifdef CONFIG_ACPI_PROCFS_POWER
                 acpi_battery_remove_fs(device);
 #endif
@@ -860,15 +848,11 @@ static int acpi_battery_add(struct acpi_device *device)
 
 static int acpi_battery_remove(struct acpi_device *device, int type)
 {
-        acpi_status status = 0;
         struct acpi_battery *battery = NULL;
 
         if (!device || !acpi_driver_data(device))
                 return -EINVAL;
         battery = acpi_driver_data(device);
-        status = acpi_remove_notify_handler(device->handle,
-                                            ACPI_ALL_NOTIFY,
-                                            acpi_battery_notify);
 #ifdef CONFIG_ACPI_PROCFS_POWER
         acpi_battery_remove_fs(device);
 #endif
@@ -896,10 +880,12 @@ static struct acpi_driver acpi_battery_driver = {
         .name = "battery",
         .class = ACPI_BATTERY_CLASS,
         .ids = battery_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
         .ops = {
                 .add = acpi_battery_add,
                 .resume = acpi_battery_resume,
                 .remove = acpi_battery_remove,
+                .notify = acpi_battery_notify,
                 },
 };
 
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 09c69806c1fc..f6baa77deefb 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -192,6 +192,22 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_NAME, "ESPRIMO Mobile V5505"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Sony VGN-NS10J_S",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "VGN-NS10J_S"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Sony VGN-SR290J",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Sony VGN-SR290J"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index ae862f1798dc..2876fc70c3a9 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -450,18 +450,16 @@ int acpi_bus_receive_event(struct acpi_bus_event *event)
                              Notification Handling
    -------------------------------------------------------------------------- */
 
-static int
-acpi_bus_check_device(struct acpi_device *device, int *status_changed)
+static void acpi_bus_check_device(acpi_handle handle)
 {
-        acpi_status status = 0;
+        struct acpi_device *device;
+        acpi_status status;
         struct acpi_device_status old_status;
 
-
+        if (acpi_bus_get_device(handle, &device))
+                return;
         if (!device)
-                return -EINVAL;
-
-        if (status_changed)
-                *status_changed = 0;
+                return;
 
         old_status = device->status;
 
@@ -471,22 +469,15 @@ acpi_bus_check_device(struct acpi_device *device, int *status_changed)
          */
         if (device->parent && !device->parent->status.present) {
                 device->status = device->parent->status;
-                if (STRUCT_TO_INT(old_status) != STRUCT_TO_INT(device->status)) {
-                        if (status_changed)
-                                *status_changed = 1;
-                }
-                return 0;
+                return;
         }
 
         status = acpi_bus_get_status(device);
         if (ACPI_FAILURE(status))
-                return -ENODEV;
+                return;
 
         if (STRUCT_TO_INT(old_status) == STRUCT_TO_INT(device->status))
-                return 0;
-
-        if (status_changed)
-                *status_changed = 1;
+                return;
 
         /*
          * Device Insertion/Removal
@@ -498,33 +489,17 @@ acpi_bus_check_device(struct acpi_device *device, int *status_changed)
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device removal detected\n"));
                 /* TBD: Handle device removal */
         }
-
-        return 0;
 }
 
-static int acpi_bus_check_scope(struct acpi_device *device)
+static void acpi_bus_check_scope(acpi_handle handle)
 {
-        int result = 0;
-        int status_changed = 0;
-
-
-        if (!device)
-                return -EINVAL;
-
         /* Status Change? */
-        result = acpi_bus_check_device(device, &status_changed);
-        if (result)
-                return result;
-
-        if (!status_changed)
-                return 0;
+        acpi_bus_check_device(handle);
 
         /*
          * TBD: Enumerate child devices within this device's scope and
          *       run acpi_bus_check_device()'s on them.
          */
-
-        return 0;
 }
 
 static BLOCKING_NOTIFIER_HEAD(acpi_bus_notify_list);
@@ -547,22 +522,19 @@ EXPORT_SYMBOL_GPL(unregister_acpi_bus_notifier);
  */
 static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
 {
-        int result = 0;
         struct acpi_device *device = NULL;
+        struct acpi_driver *driver;
+
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Notification %#02x to handle %p\n",
+                          type, handle));
 
         blocking_notifier_call_chain(&acpi_bus_notify_list,
                 type, (void *)handle);
 
-        if (acpi_bus_get_device(handle, &device))
-                return;
-
         switch (type) {
 
         case ACPI_NOTIFY_BUS_CHECK:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received BUS CHECK notification for device [%s]\n",
-                                  device->pnp.bus_id));
-                result = acpi_bus_check_scope(device);
+                acpi_bus_check_scope(handle);
                 /*
                  * TBD: We'll need to outsource certain events to non-ACPI
                  *      drivers via the device manager (device.c).
@@ -570,10 +542,7 @@ static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
                 break;
 
         case ACPI_NOTIFY_DEVICE_CHECK:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received DEVICE CHECK notification for device [%s]\n",
-                                  device->pnp.bus_id));
-                result = acpi_bus_check_device(device, NULL);
+                acpi_bus_check_device(handle);
                 /*
                  * TBD: We'll need to outsource certain events to non-ACPI
                  *      drivers via the device manager (device.c).
@@ -581,44 +550,26 @@ static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
                 break;
 
         case ACPI_NOTIFY_DEVICE_WAKE:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received DEVICE WAKE notification for device [%s]\n",
-                                  device->pnp.bus_id));
                 /* TBD */
                 break;
 
         case ACPI_NOTIFY_EJECT_REQUEST:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received EJECT REQUEST notification for device [%s]\n",
-                                  device->pnp.bus_id));
                 /* TBD */
                 break;
 
         case ACPI_NOTIFY_DEVICE_CHECK_LIGHT:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received DEVICE CHECK LIGHT notification for device [%s]\n",
-                                  device->pnp.bus_id));
                 /* TBD: Exactly what does 'light' mean? */
                 break;
 
         case ACPI_NOTIFY_FREQUENCY_MISMATCH:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received FREQUENCY MISMATCH notification for device [%s]\n",
-                                  device->pnp.bus_id));
                 /* TBD */
                 break;
 
         case ACPI_NOTIFY_BUS_MODE_MISMATCH:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received BUS MODE MISMATCH notification for device [%s]\n",
-                                  device->pnp.bus_id));
                 /* TBD */
                 break;
 
         case ACPI_NOTIFY_POWER_FAULT:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Received POWER FAULT notification for device [%s]\n",
-                                  device->pnp.bus_id));
                 /* TBD */
                 break;
 
@@ -629,7 +580,13 @@ static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
                 break;
         }
 
-        return;
+        acpi_bus_get_device(handle, &device);
+        if (device) {
+                driver = device->driver;
+                if (driver && driver->ops.notify &&
+                    (driver->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS))
+                        driver->ops.notify(device, type);
+        }
 }
 
 /* --------------------------------------------------------------------------
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 8bd2c2a6884d..a8a5c29958c8 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -140,46 +140,6 @@ struct device *acpi_get_physical_device(acpi_handle handle)
 
 EXPORT_SYMBOL(acpi_get_physical_device);
 
-/* ToDo: When a PCI bridge is found, return the PCI device behind the bridge
- *       This should work in general, but did not on a Lenovo T61 for the
- *       graphics card. But this must be fixed when the PCI device is
- *       bound and the kernel device struct is attached to the acpi device
- * Note: A success call will increase reference count by one
- *       Do call put_device(dev) on the returned device then
- */
-struct device *acpi_get_physical_pci_device(acpi_handle handle)
-{
-        struct device *dev;
-        long long device_id;
-        acpi_status status;
-
-        status =
-                acpi_evaluate_integer(handle, "_ADR", NULL, &device_id);
-
-        if (ACPI_FAILURE(status))
-                return NULL;
-
-        /* We need to attempt to determine whether the _ADR refers to a
-           PCI device or not. There's no terribly good way to do this,
-           so the best we can hope for is to assume that there'll never
-           be a device in the host bridge */
-        if (device_id >= 0x10000) {
-                /* It looks like a PCI device. Does it exist? */
-                dev = acpi_get_physical_device(handle);
-        } else {
-                /* It doesn't look like a PCI device. Does its parent
-                   exist? */
-                acpi_handle phandle;
-                if (acpi_get_parent(handle, &phandle))
-                        return NULL;
-                dev = acpi_get_physical_device(phandle);
-        }
-        if (!dev)
-                return NULL;
-        return dev;
-}
-EXPORT_SYMBOL(acpi_get_physical_pci_device);
-
 static int acpi_bind_one(struct device *dev, acpi_handle handle)
 {
         struct acpi_device *acpi_dev;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index d916bea729f1..71670719d61a 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -79,6 +79,7 @@ static acpi_osd_handler acpi_irq_handler;
 static void *acpi_irq_context;
 static struct workqueue_struct *kacpid_wq;
 static struct workqueue_struct *kacpi_notify_wq;
+static struct workqueue_struct *kacpi_hotplug_wq;
 
 struct acpi_res_list {
         resource_size_t start;
@@ -192,8 +193,10 @@ acpi_status acpi_os_initialize1(void)
 {
         kacpid_wq = create_singlethread_workqueue("kacpid");
         kacpi_notify_wq = create_singlethread_workqueue("kacpi_notify");
+        kacpi_hotplug_wq = create_singlethread_workqueue("kacpi_hotplug");
         BUG_ON(!kacpid_wq);
         BUG_ON(!kacpi_notify_wq);
+        BUG_ON(!kacpi_hotplug_wq);
         return AE_OK;
 }
 
@@ -206,6 +209,7 @@ acpi_status acpi_os_terminate(void)
 
         destroy_workqueue(kacpid_wq);
         destroy_workqueue(kacpi_notify_wq);
+        destroy_workqueue(kacpi_hotplug_wq);
 
         return AE_OK;
 }
@@ -716,6 +720,7 @@ static acpi_status __acpi_os_execute(acpi_execute_type type,
         acpi_status status = AE_OK;
         struct acpi_os_dpc *dpc;
         struct workqueue_struct *queue;
+        work_func_t func;
         int ret;
         ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
                           "Scheduling function [%p(%p)] for deferred execution.\n",
@@ -740,15 +745,17 @@ static acpi_status __acpi_os_execute(acpi_execute_type type,
         dpc->function = function;
         dpc->context = context;
 
-        if (!hp) {
-                INIT_WORK(&dpc->work, acpi_os_execute_deferred);
-                queue = (type == OSL_NOTIFY_HANDLER) ?
-                        kacpi_notify_wq : kacpid_wq;
-                ret = queue_work(queue, &dpc->work);
-        } else {
-                INIT_WORK(&dpc->work, acpi_os_execute_hp_deferred);
-                ret = schedule_work(&dpc->work);
-        }
+        /*
+         * We can't run hotplug code in keventd_wq/kacpid_wq/kacpid_notify_wq
+         * because the hotplug code may call driver .remove() functions,
+         * which invoke flush_scheduled_work/acpi_os_wait_events_complete
+         * to flush these workqueues.
+         */
+        queue = hp ? kacpi_hotplug_wq :
+                (type == OSL_NOTIFY_HANDLER ? kacpi_notify_wq : kacpid_wq);
+        func = hp ? acpi_os_execute_hp_deferred : acpi_os_execute_deferred;
+        INIT_WORK(&dpc->work, func);
+        ret = queue_work(queue, &dpc->work);
 
         if (!ret) {
                 printk(KERN_ERR PREFIX
diff --git a/drivers/acpi/pci_bind.c b/drivers/acpi/pci_bind.c
index bc46de3d967f..a5a77b78a723 100644
--- a/drivers/acpi/pci_bind.c
+++ b/drivers/acpi/pci_bind.c
@@ -24,12 +24,7 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
 #include <linux/types.h>
-#include <linux/proc_fs.h>
-#include <linux/spinlock.h>
-#include <linux/pm.h>
 #include <linux/pci.h>
 #include <linux/acpi.h>
 #include <acpi/acpi_bus.h>
@@ -38,310 +33,76 @@
 #define _COMPONENT              ACPI_PCI_COMPONENT
 ACPI_MODULE_NAME("pci_bind");
 
-struct acpi_pci_data {
-        struct acpi_pci_id id;
-        struct pci_bus *bus;
-        struct pci_dev *dev;
-};
-
-static int acpi_pci_unbind(struct acpi_device *device);
-
-static void acpi_pci_data_handler(acpi_handle handle, u32 function,
-                                  void *context)
-{
-
-        /* TBD: Anything we need to do here? */
-
-        return;
-}
-
-/**
- * acpi_get_pci_id
- * ------------------
- * This function is used by the ACPI Interpreter (a.k.a. Core Subsystem)
- * to resolve PCI information for ACPI-PCI devices defined in the namespace.
- * This typically occurs when resolving PCI operation region information.
- */
-acpi_status acpi_get_pci_id(acpi_handle handle, struct acpi_pci_id *id)
+static int acpi_pci_unbind(struct acpi_device *device)
 {
-        int result = 0;
-        acpi_status status = AE_OK;
-        struct acpi_device *device = NULL;
-        struct acpi_pci_data *data = NULL;
-
-
-        if (!id)
-                return AE_BAD_PARAMETER;
-
-        result = acpi_bus_get_device(handle, &device);
-        if (result) {
-                printk(KERN_ERR PREFIX
-                            "Invalid ACPI Bus context for device %s\n",
-                            acpi_device_bid(device));
-                return AE_NOT_EXIST;
-        }
-
-        status = acpi_get_data(handle, acpi_pci_data_handler, (void **)&data);
-        if (ACPI_FAILURE(status) || !data) {
-                ACPI_EXCEPTION((AE_INFO, status,
-                                "Invalid ACPI-PCI context for device %s",
-                                acpi_device_bid(device)));
-                return status;
-        }
+        struct pci_dev *dev;
 
-        *id = data->id;
+        dev = acpi_get_pci_dev(device->handle);
+        if (!dev || !dev->subordinate)
+                goto out;
 
-        /*
-           id->segment = data->id.segment;
-           id->bus = data->id.bus;
-           id->device = data->id.device;
-           id->function = data->id.function;
-         */
+        acpi_pci_irq_del_prt(dev->subordinate);
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                          "Device %s has PCI address %04x:%02x:%02x.%d\n",
-                          acpi_device_bid(device), id->segment, id->bus,
-                          id->device, id->function));
+        device->ops.bind = NULL;
+        device->ops.unbind = NULL;
 
-        return AE_OK;
+out:
+        pci_dev_put(dev);
+        return 0;
 }
 
-EXPORT_SYMBOL(acpi_get_pci_id);
-
-int acpi_pci_bind(struct acpi_device *device)
+static int acpi_pci_bind(struct acpi_device *device)
 {
-        int result = 0;
         acpi_status status;
-        struct acpi_pci_data *data;
-        struct acpi_pci_data *pdata;
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         acpi_handle handle;
+        struct pci_bus *bus;
+        struct pci_dev *dev;
 
-        if (!device || !device->parent)
-                return -EINVAL;
-
-        data = kzalloc(sizeof(struct acpi_pci_data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        status = acpi_get_name(device->handle, ACPI_FULL_PATHNAME, &buffer);
-        if (ACPI_FAILURE(status)) {
-                kfree(data);
-                return -ENODEV;
-        }
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Binding PCI device [%s]...\n",
-                          (char *)buffer.pointer));
-
-        /* 
-         * Segment & Bus
-         * -------------
-         * These are obtained via the parent device's ACPI-PCI context.
-         */
-        status = acpi_get_data(device->parent->handle, acpi_pci_data_handler,
-                               (void **)&pdata);
-        if (ACPI_FAILURE(status) || !pdata || !pdata->bus) {
-                ACPI_EXCEPTION((AE_INFO, status,
-                                "Invalid ACPI-PCI context for parent device %s",
-                                acpi_device_bid(device->parent)));
-                result = -ENODEV;
-                goto end;
-        }
-        data->id.segment = pdata->id.segment;
-        data->id.bus = pdata->bus->number;
-
-        /*
-         * Device & Function
-         * -----------------
-         * These are simply obtained from the device's _ADR method.  Note
-         * that a value of zero is valid.
-         */
-        data->id.device = device->pnp.bus_address >> 16;
-        data->id.function = device->pnp.bus_address & 0xFFFF;
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "...to %04x:%02x:%02x.%d\n",
-                          data->id.segment, data->id.bus, data->id.device,
-                          data->id.function));
-
-        /*
-         * TBD: Support slot devices (e.g. function=0xFFFF).
-         */
-
-        /* 
-         * Locate PCI Device
-         * -----------------
-         * Locate matching device in PCI namespace.  If it doesn't exist
-         * this typically means that the device isn't currently inserted
-         * (e.g. docking station, port replicator, etc.).
-         */
-        data->dev = pci_get_slot(pdata->bus,
-                                PCI_DEVFN(data->id.device, data->id.function));
-        if (!data->dev) {
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Device %04x:%02x:%02x.%d not present in PCI namespace\n",
-                                  data->id.segment, data->id.bus,
-                                  data->id.device, data->id.function));
-                result = -ENODEV;
-                goto end;
-        }
-        if (!data->dev->bus) {
-                printk(KERN_ERR PREFIX
-                            "Device %04x:%02x:%02x.%d has invalid 'bus' field\n",
-                            data->id.segment, data->id.bus,
-                            data->id.device, data->id.function);
-                result = -ENODEV;
-                goto end;
-        }
+        dev = acpi_get_pci_dev(device->handle);
+        if (!dev)
+                return 0;
 
         /*
-         * PCI Bridge?
-         * -----------
-         * If so, set the 'bus' field and install the 'bind' function to 
-         * facilitate callbacks for all of its children.
+         * Install the 'bind' function to facilitate callbacks for
+         * children of the P2P bridge.
          */
-        if (data->dev->subordinate) {
+        if (dev->subordinate) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "Device %04x:%02x:%02x.%d is a PCI bridge\n",
-                                  data->id.segment, data->id.bus,
-                                  data->id.device, data->id.function));
-                data->bus = data->dev->subordinate;
+                                  pci_domain_nr(dev->bus), dev->bus->number,
+                                  PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn)));
                 device->ops.bind = acpi_pci_bind;
                 device->ops.unbind = acpi_pci_unbind;
         }
 
         /*
-         * Attach ACPI-PCI Context
-         * -----------------------
-         * Thus binding the ACPI and PCI devices.
-         */
-        status = acpi_attach_data(device->handle, acpi_pci_data_handler, data);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status,
-                                "Unable to attach ACPI-PCI context to device %s",
-                                acpi_device_bid(device)));
-                result = -ENODEV;
-                goto end;
-        }
-
-        /*
-         * PCI Routing Table
-         * -----------------
-         * Evaluate and parse _PRT, if exists.  This code is independent of 
-         * PCI bridges (above) to allow parsing of _PRT objects within the
-         * scope of non-bridge devices.  Note that _PRTs within the scope of
-         * a PCI bridge assume the bridge's subordinate bus number.
+         * Evaluate and parse _PRT, if exists.  This code allows parsing of
+         * _PRT objects within the scope of non-bridge devices.  Note that
+         * _PRTs within the scope of a PCI bridge assume the bridge's
+         * subordinate bus number.
          *
          * TBD: Can _PRTs exist within the scope of non-bridge PCI devices?
          */
         status = acpi_get_handle(device->handle, METHOD_NAME__PRT, &handle);
-        if (ACPI_SUCCESS(status)) {
-                if (data->bus)  /* PCI-PCI bridge */
-                        acpi_pci_irq_add_prt(device->handle, data->id.segment,
-                                             data->bus->number);
-                else            /* non-bridge PCI device */
-                        acpi_pci_irq_add_prt(device->handle, data->id.segment,
-                                             data->id.bus);
-        }
-
-      end:
-        kfree(buffer.pointer);
-        if (result) {
-                pci_dev_put(data->dev);
-                kfree(data);
-        }
-        return result;
-}
-
-static int acpi_pci_unbind(struct acpi_device *device)
-{
-        int result = 0;
-        acpi_status status;
-        struct acpi_pci_data *data;
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-
-
-        if (!device || !device->parent)
-                return -EINVAL;
-
-        status = acpi_get_name(device->handle, ACPI_FULL_PATHNAME, &buffer);
         if (ACPI_FAILURE(status))
-                return -ENODEV;
+                goto out;
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Unbinding PCI device [%s]...\n",
-                          (char *) buffer.pointer));
-        kfree(buffer.pointer);
+        if (dev->subordinate)
+                bus = dev->subordinate;
+        else
+                bus = dev->bus;
 
-        status =
-            acpi_get_data(device->handle, acpi_pci_data_handler,
-                          (void **)&data);
-        if (ACPI_FAILURE(status)) {
-                result = -ENODEV;
-                goto end;
-        }
+        acpi_pci_irq_add_prt(device->handle, bus);
 
-        status = acpi_detach_data(device->handle, acpi_pci_data_handler);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status,
-                                "Unable to detach data from device %s",
-                                acpi_device_bid(device)));
-                result = -ENODEV;
-                goto end;
-        }
-        if (data->dev->subordinate) {
-                acpi_pci_irq_del_prt(data->id.segment, data->bus->number);
-        }
-        pci_dev_put(data->dev);
-        kfree(data);
-
-      end:
-        return result;
+out:
+        pci_dev_put(dev);
+        return 0;
 }
 
-int
-acpi_pci_bind_root(struct acpi_device *device,
-                   struct acpi_pci_id *id, struct pci_bus *bus)
+int acpi_pci_bind_root(struct acpi_device *device)
 {
-        int result = 0;
-        acpi_status status;
-        struct acpi_pci_data *data = NULL;
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-
-        if (!device || !id || !bus) {
-                return -EINVAL;
-        }
-
-        data = kzalloc(sizeof(struct acpi_pci_data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        data->id = *id;
-        data->bus = bus;
         device->ops.bind = acpi_pci_bind;
         device->ops.unbind = acpi_pci_unbind;
 
-        status = acpi_get_name(device->handle, ACPI_FULL_PATHNAME, &buffer);
-        if (ACPI_FAILURE(status)) {
-                kfree (data);
-                return -ENODEV;
-        }
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Binding PCI root bridge [%s] to "
-                        "%04x:%02x\n", (char *)buffer.pointer,
-                        id->segment, id->bus));
-
-        status = acpi_attach_data(device->handle, acpi_pci_data_handler, data);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status,
-                                "Unable to attach ACPI-PCI context to device %s",
-                                (char *)buffer.pointer));
-                result = -ENODEV;
-                goto end;
-        }
-
-      end:
-        kfree(buffer.pointer);
-        if (result != 0)
-                kfree(data);
-
-        return result;
+        return 0;
 }
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index 2faa9e2ac893..b794eb88ab90 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -182,7 +182,7 @@ static void do_prt_fixups(struct acpi_prt_entry *entry,
         }
 }
 
-static int acpi_pci_irq_add_entry(acpi_handle handle, int segment, int bus,
+static int acpi_pci_irq_add_entry(acpi_handle handle, struct pci_bus *bus,
                                   struct acpi_pci_routing_table *prt)
 {
         struct acpi_prt_entry *entry;
@@ -196,8 +196,8 @@ static int acpi_pci_irq_add_entry(acpi_handle handle, int segment, int bus,
          * 1=INTA, 2=INTB.  We use the PCI encoding throughout, so convert
          * it here.
          */
-        entry->id.segment = segment;
-        entry->id.bus = bus;
+        entry->id.segment = pci_domain_nr(bus);
+        entry->id.bus = bus->number;
         entry->id.device = (prt->address >> 16) & 0xFFFF;
         entry->pin = prt->pin + 1;
 
@@ -242,7 +242,7 @@ static int acpi_pci_irq_add_entry(acpi_handle handle, int segment, int bus,
         return 0;
 }
 
-int acpi_pci_irq_add_prt(acpi_handle handle, int segment, int bus)
+int acpi_pci_irq_add_prt(acpi_handle handle, struct pci_bus *bus)
 {
         acpi_status status;
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
@@ -271,7 +271,7 @@ int acpi_pci_irq_add_prt(acpi_handle handle, int segment, int bus)
 
         entry = buffer.pointer;
         while (entry && (entry->length > 0)) {
-                acpi_pci_irq_add_entry(handle, segment, bus, entry);
+                acpi_pci_irq_add_entry(handle, bus, entry);
                 entry = (struct acpi_pci_routing_table *)
                     ((unsigned long)entry + entry->length);
         }
@@ -280,16 +280,17 @@ int acpi_pci_irq_add_prt(acpi_handle handle, int segment, int bus)
         return 0;
 }
 
-void acpi_pci_irq_del_prt(int segment, int bus)
+void acpi_pci_irq_del_prt(struct pci_bus *bus)
 {
         struct acpi_prt_entry *entry, *tmp;
 
         printk(KERN_DEBUG
                "ACPI: Delete PCI Interrupt Routing Table for %04x:%02x\n",
-               segment, bus);
+               pci_domain_nr(bus), bus->number);
         spin_lock(&acpi_prt_lock);
         list_for_each_entry_safe(entry, tmp, &acpi_prt_list, list) {
-                if (segment == entry->id.segment && bus == entry->id.bus) {
+                if (pci_domain_nr(bus) == entry->id.segment
+                        && bus->number == entry->id.bus) {
                         list_del(&entry->list);
                         kfree(entry);
                 }
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 196f97d00956..8a5bf3b356fa 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -63,9 +63,10 @@ static struct acpi_driver acpi_pci_root_driver = {
 
 struct acpi_pci_root {
         struct list_head node;
-        struct acpi_device * device;
-        struct acpi_pci_id id;
+        struct acpi_device *device;
         struct pci_bus *bus;
+        u16 segment;
+        u8 bus_nr;
 
         u32 osc_support_set;    /* _OSC state of support bits */
         u32 osc_control_set;    /* _OSC state of control bits */
@@ -82,7 +83,7 @@ static DEFINE_MUTEX(osc_lock);
 int acpi_pci_register_driver(struct acpi_pci_driver *driver)
 {
         int n = 0;
-        struct list_head *entry;
+        struct acpi_pci_root *root;
 
         struct acpi_pci_driver **pptr = &sub_driver;
         while (*pptr)
@@ -92,9 +93,7 @@ int acpi_pci_register_driver(struct acpi_pci_driver *driver)
         if (!driver->add)
                 return 0;
 
-        list_for_each(entry, &acpi_pci_roots) {
-                struct acpi_pci_root *root;
-                root = list_entry(entry, struct acpi_pci_root, node);
+        list_for_each_entry(root, &acpi_pci_roots, node) {
                 driver->add(root->device->handle);
                 n++;
         }
@@ -106,7 +105,7 @@ EXPORT_SYMBOL(acpi_pci_register_driver);
 
 void acpi_pci_unregister_driver(struct acpi_pci_driver *driver)
 {
-        struct list_head *entry;
+        struct acpi_pci_root *root;
 
         struct acpi_pci_driver **pptr = &sub_driver;
         while (*pptr) {
@@ -120,28 +119,48 @@ void acpi_pci_unregister_driver(struct acpi_pci_driver *driver)
         if (!driver->remove)
                 return;
 
-        list_for_each(entry, &acpi_pci_roots) {
-                struct acpi_pci_root *root;
-                root = list_entry(entry, struct acpi_pci_root, node);
+        list_for_each_entry(root, &acpi_pci_roots, node)
                 driver->remove(root->device->handle);
-        }
 }
 
 EXPORT_SYMBOL(acpi_pci_unregister_driver);
 
 acpi_handle acpi_get_pci_rootbridge_handle(unsigned int seg, unsigned int bus)
 {
-        struct acpi_pci_root *tmp;
+        struct acpi_pci_root *root;
         
-        list_for_each_entry(tmp, &acpi_pci_roots, node) {
-                if ((tmp->id.segment == (u16) seg) && (tmp->id.bus == (u16) bus))
-                        return tmp->device->handle;
-        }
+        list_for_each_entry(root, &acpi_pci_roots, node)
+                if ((root->segment == (u16) seg) && (root->bus_nr == (u16) bus))
+                        return root->device->handle;
         return NULL;            
 }
 
 EXPORT_SYMBOL_GPL(acpi_get_pci_rootbridge_handle);
 
+/**
+ * acpi_is_root_bridge - determine whether an ACPI CA node is a PCI root bridge
+ * @handle - the ACPI CA node in question.
+ *
+ * Note: we could make this API take a struct acpi_device * instead, but
+ * for now, it's more convenient to operate on an acpi_handle.
+ */
+int acpi_is_root_bridge(acpi_handle handle)
+{
+        int ret;
+        struct acpi_device *device;
+
+        ret = acpi_bus_get_device(handle, &device);
+        if (ret)
+                return 0;
+
+        ret = acpi_match_device_ids(device, root_device_ids);
+        if (ret)
+                return 0;
+        else
+                return 1;
+}
+EXPORT_SYMBOL_GPL(acpi_is_root_bridge);
+
 static acpi_status
 get_root_bridge_busnr_callback(struct acpi_resource *resource, void *data)
 {
@@ -161,19 +180,22 @@ get_root_bridge_busnr_callback(struct acpi_resource *resource, void *data)
         return AE_OK;
 }
 
-static acpi_status try_get_root_bridge_busnr(acpi_handle handle, int *busnum)
+static acpi_status try_get_root_bridge_busnr(acpi_handle handle,
+                                             unsigned long long *bus)
 {
         acpi_status status;
+        int busnum;
 
-        *busnum = -1;
+        busnum = -1;
         status =
             acpi_walk_resources(handle, METHOD_NAME__CRS,
-                                get_root_bridge_busnr_callback, busnum);
+                                get_root_bridge_busnr_callback, &busnum);
         if (ACPI_FAILURE(status))
                 return status;
         /* Check if we really get a bus number from _CRS */
-        if (*busnum == -1)
+        if (busnum == -1)
                 return AE_ERROR;
+        *bus = busnum;
         return AE_OK;
 }
 
@@ -298,6 +320,7 @@ static acpi_status acpi_pci_osc_support(struct acpi_pci_root *root, u32 flags)
 static struct acpi_pci_root *acpi_pci_find_root(acpi_handle handle)
 {
         struct acpi_pci_root *root;
+
         list_for_each_entry(root, &acpi_pci_roots, node) {
                 if (root->device->handle == handle)
                         return root;
@@ -305,6 +328,87 @@ static struct acpi_pci_root *acpi_pci_find_root(acpi_handle handle)
         return NULL;
 }
 
+struct acpi_handle_node {
+        struct list_head node;
+        acpi_handle handle;
+};
+
+/**
+ * acpi_get_pci_dev - convert ACPI CA handle to struct pci_dev
+ * @handle: the handle in question
+ *
+ * Given an ACPI CA handle, the desired PCI device is located in the
+ * list of PCI devices.
+ *
+ * If the device is found, its reference count is increased and this
+ * function returns a pointer to its data structure.  The caller must
+ * decrement the reference count by calling pci_dev_put().
+ * If no device is found, %NULL is returned.
+ */
+struct pci_dev *acpi_get_pci_dev(acpi_handle handle)
+{
+        int dev, fn;
+        unsigned long long adr;
+        acpi_status status;
+        acpi_handle phandle;
+        struct pci_bus *pbus;
+        struct pci_dev *pdev = NULL;
+        struct acpi_handle_node *node, *tmp;
+        struct acpi_pci_root *root;
+        LIST_HEAD(device_list);
+
+        /*
+         * Walk up the ACPI CA namespace until we reach a PCI root bridge.
+         */
+        phandle = handle;
+        while (!acpi_is_root_bridge(phandle)) {
+                node = kzalloc(sizeof(struct acpi_handle_node), GFP_KERNEL);
+                if (!node)
+                        goto out;
+
+                INIT_LIST_HEAD(&node->node);
+                node->handle = phandle;
+                list_add(&node->node, &device_list);
+
+                status = acpi_get_parent(phandle, &phandle);
+                if (ACPI_FAILURE(status))
+                        goto out;
+        }
+
+        root = acpi_pci_find_root(phandle);
+        if (!root)
+                goto out;
+
+        pbus = root->bus;
+
+        /*
+         * Now, walk back down the PCI device tree until we return to our
+         * original handle. Assumes that everything between the PCI root
+         * bridge and the device we're looking for must be a P2P bridge.
+         */
+        list_for_each_entry(node, &device_list, node) {
+                acpi_handle hnd = node->handle;
+                status = acpi_evaluate_integer(hnd, "_ADR", NULL, &adr);
+                if (ACPI_FAILURE(status))
+                        goto out;
+                dev = (adr >> 16) & 0xffff;
+                fn  = adr & 0xffff;
+
+                pdev = pci_get_slot(pbus, PCI_DEVFN(dev, fn));
+                if (hnd == handle)
+                        break;
+
+                pbus = pdev->subordinate;
+                pci_dev_put(pdev);
+        }
+out:
+        list_for_each_entry_safe(node, tmp, &device_list, node)
+                kfree(node);
+
+        return pdev;
+}
+EXPORT_SYMBOL_GPL(acpi_get_pci_dev);
+
 /**
  * acpi_pci_osc_control_set - commit requested control to Firmware
  * @handle: acpi_handle for the target ACPI object
@@ -363,31 +467,46 @@ EXPORT_SYMBOL(acpi_pci_osc_control_set);
 
 static int __devinit acpi_pci_root_add(struct acpi_device *device)
 {
-        int result = 0;
-        struct acpi_pci_root *root = NULL;
-        struct acpi_pci_root *tmp;
-        acpi_status status = AE_OK;
-        unsigned long long value = 0;
-        acpi_handle handle = NULL;
+        unsigned long long segment, bus;
+        acpi_status status;
+        int result;
+        struct acpi_pci_root *root;
+        acpi_handle handle;
         struct acpi_device *child;
         u32 flags, base_flags;
 
+        segment = 0;
+        status = acpi_evaluate_integer(device->handle, METHOD_NAME__SEG, NULL,
+                                       &segment);
+        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
+                printk(KERN_ERR PREFIX "can't evaluate _SEG\n");
+                return -ENODEV;
+        }
 
-        if (!device)
-                return -EINVAL;
+        /* Check _CRS first, then _BBN.  If no _BBN, default to zero. */
+        bus = 0;
+        status = try_get_root_bridge_busnr(device->handle, &bus);
+        if (ACPI_FAILURE(status)) {
+                status = acpi_evaluate_integer(device->handle, METHOD_NAME__BBN,                                               NULL, &bus);
+                if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
+                        printk(KERN_ERR PREFIX
+                             "no bus number in _CRS and can't evaluate _BBN\n");
+                        return -ENODEV;
+                }
+        }
 
         root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
         if (!root)
                 return -ENOMEM;
-        INIT_LIST_HEAD(&root->node);
 
+        INIT_LIST_HEAD(&root->node);
         root->device = device;
+        root->segment = segment & 0xFFFF;
+        root->bus_nr = bus & 0xFF;
         strcpy(acpi_device_name(device), ACPI_PCI_ROOT_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_PCI_ROOT_CLASS);
         device->driver_data = root;
 
-        device->ops.bind = acpi_pci_bind;
-
         /*
          * All supported architectures that use ACPI have support for
          * PCI domains, so we indicate this in _OSC support capabilities.
@@ -395,79 +514,6 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
         flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
         acpi_pci_osc_support(root, flags);
 
-        /* 
-         * Segment
-         * -------
-         * Obtained via _SEG, if exists, otherwise assumed to be zero (0).
-         */
-        status = acpi_evaluate_integer(device->handle, METHOD_NAME__SEG, NULL,
-                                       &value);
-        switch (status) {
-        case AE_OK:
-                root->id.segment = (u16) value;
-                break;
-        case AE_NOT_FOUND:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Assuming segment 0 (no _SEG)\n"));
-                root->id.segment = 0;
-                break;
-        default:
-                ACPI_EXCEPTION((AE_INFO, status, "Evaluating _SEG"));
-                result = -ENODEV;
-                goto end;
-        }
-
-        /* 
-         * Bus
-         * ---
-         * Obtained via _BBN, if exists, otherwise assumed to be zero (0).
-         */
-        status = acpi_evaluate_integer(device->handle, METHOD_NAME__BBN, NULL,
-                                       &value);
-        switch (status) {
-        case AE_OK:
-                root->id.bus = (u16) value;
-                break;
-        case AE_NOT_FOUND:
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Assuming bus 0 (no _BBN)\n"));
-                root->id.bus = 0;
-                break;
-        default:
-                ACPI_EXCEPTION((AE_INFO, status, "Evaluating _BBN"));
-                result = -ENODEV;
-                goto end;
-        }
-
-        /* Some systems have wrong _BBN */
-        list_for_each_entry(tmp, &acpi_pci_roots, node) {
-                if ((tmp->id.segment == root->id.segment)
-                    && (tmp->id.bus == root->id.bus)) {
-                        int bus = 0;
-                        acpi_status status;
-
-                        printk(KERN_ERR PREFIX
-                                    "Wrong _BBN value, reboot"
-                                    " and use option 'pci=noacpi'\n");
-
-                        status = try_get_root_bridge_busnr(device->handle, &bus);
-                        if (ACPI_FAILURE(status))
-                                break;
-                        if (bus != root->id.bus) {
-                                printk(KERN_INFO PREFIX
-                                       "PCI _CRS %d overrides _BBN 0\n", bus);
-                                root->id.bus = bus;
-                        }
-                        break;
-                }
-        }
-        /*
-         * Device & Function
-         * -----------------
-         * Obtained from _ADR (which has already been evaluated for us).
-         */
-        root->id.device = device->pnp.bus_address >> 16;
-        root->id.function = device->pnp.bus_address & 0xFFFF;
-
         /*
          * TBD: Need PCI interface for enumeration/configuration of roots.
          */
@@ -477,7 +523,7 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
 
         printk(KERN_INFO PREFIX "%s [%s] (%04x:%02x)\n",
                acpi_device_name(device), acpi_device_bid(device),
-               root->id.segment, root->id.bus);
+               root->segment, root->bus_nr);
 
         /*
          * Scan the Root Bridge
@@ -486,11 +532,11 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
          * PCI namespace does not get created until this call is made (and 
          * thus the root bridge's pci_dev does not exist).
          */
-        root->bus = pci_acpi_scan_root(device, root->id.segment, root->id.bus);
+        root->bus = pci_acpi_scan_root(device, segment, bus);
         if (!root->bus) {
                 printk(KERN_ERR PREFIX
                             "Bus %04x:%02x not present in PCI namespace\n",
-                            root->id.segment, root->id.bus);
+                            root->segment, root->bus_nr);
                 result = -ENODEV;
                 goto end;
         }
@@ -500,7 +546,7 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
          * -----------------------
          * Thus binding the ACPI and PCI devices.
          */
-        result = acpi_pci_bind_root(device, &root->id, root->bus);
+        result = acpi_pci_bind_root(device);
         if (result)
                 goto end;
 
@@ -511,8 +557,7 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
          */
         status = acpi_get_handle(device->handle, METHOD_NAME__PRT, &handle);
         if (ACPI_SUCCESS(status))
-                result = acpi_pci_irq_add_prt(device->handle, root->id.segment,
-                                              root->id.bus);
+                result = acpi_pci_irq_add_prt(device->handle, root->bus);
 
         /*
          * Scan and bind all _ADR-Based Devices
@@ -531,42 +576,28 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
         if (flags != base_flags)
                 acpi_pci_osc_support(root, flags);
 
-      end:
-        if (result) {
-                if (!list_empty(&root->node))
-                        list_del(&root->node);
-                kfree(root);
-        }
+        return 0;
 
+end:
+        if (!list_empty(&root->node))
+                list_del(&root->node);
+        kfree(root);
         return result;
 }
 
 static int acpi_pci_root_start(struct acpi_device *device)
 {
-        struct acpi_pci_root *root;
+        struct acpi_pci_root *root = acpi_driver_data(device);
 
-
-        list_for_each_entry(root, &acpi_pci_roots, node) {
-                if (root->device == device) {
-                        pci_bus_add_devices(root->bus);
-                        return 0;
-                }
-        }
-        return -ENODEV;
+        pci_bus_add_devices(root->bus);
+        return 0;
 }
 
 static int acpi_pci_root_remove(struct acpi_device *device, int type)
 {
-        struct acpi_pci_root *root = NULL;
-
-
-        if (!device || !acpi_driver_data(device))
-                return -EINVAL;
-
-        root = acpi_driver_data(device);
+        struct acpi_pci_root *root = acpi_driver_data(device);
 
         kfree(root);
-
         return 0;
 }
 
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 56665a63bf19..d74365d4a6e7 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -194,7 +194,7 @@ static int acpi_power_get_list_state(struct acpi_handle_list *list, int *state)
 
 static int acpi_power_on(acpi_handle handle, struct acpi_device *dev)
 {
-        int result = 0, state;
+        int result = 0;
         int found = 0;
         acpi_status status = AE_OK;
         struct acpi_power_resource *resource = NULL;
@@ -236,18 +236,6 @@ static int acpi_power_on(acpi_handle handle, struct acpi_device *dev)
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        if (!acpi_power_nocheck) {
-                /*
-                 * If acpi_power_nocheck is set, it is unnecessary to check
-                 * the power state after power transition.
-                 */
-                result = acpi_power_get_state(resource->device->handle,
-                                &state);
-                if (result)
-                        return result;
-                if (state != ACPI_POWER_RESOURCE_STATE_ON)
-                        return -ENOEXEC;
-        }
         /* Update the power resource's _device_ power state */
         resource->device->power.state = ACPI_STATE_D0;
 
@@ -258,7 +246,7 @@ static int acpi_power_on(acpi_handle handle, struct acpi_device *dev)
 
 static int acpi_power_off_device(acpi_handle handle, struct acpi_device *dev)
 {
-        int result = 0, state;
+        int result = 0;
         acpi_status status = AE_OK;
         struct acpi_power_resource *resource = NULL;
         struct list_head *node, *next;
@@ -293,18 +281,6 @@ static int acpi_power_off_device(acpi_handle handle, struct acpi_device *dev)
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        if (!acpi_power_nocheck) {
-                /*
-                 * If acpi_power_nocheck is set, it is unnecessary to check
-                 * the power state after power transition.
-                 */
-                result = acpi_power_get_state(handle, &state);
-                if (result)
-                        return result;
-                if (state != ACPI_POWER_RESOURCE_STATE_OFF)
-                        return -ENOEXEC;
-        }
-
         /* Update the power resource's _device_ power state */
         resource->device->power.state = ACPI_STATE_D3;
 
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 23f0fb84f1c1..84e0f3c07442 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -89,7 +89,7 @@ static int acpi_processor_handle_eject(struct acpi_processor *pr);
 
 static const struct acpi_device_id processor_device_ids[] = {
         {ACPI_PROCESSOR_OBJECT_HID, 0},
-        {ACPI_PROCESSOR_HID, 0},
+        {"ACPI0007", 0},
         {"", 0},
 };
 MODULE_DEVICE_TABLE(acpi, processor_device_ids);
@@ -596,7 +596,21 @@ static int acpi_processor_get_info(struct acpi_device *device)
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "No bus mastering arbitration control\n"));
 
-        if (!strcmp(acpi_device_hid(device), ACPI_PROCESSOR_HID)) {
+        if (!strcmp(acpi_device_hid(device), ACPI_PROCESSOR_OBJECT_HID)) {
+                /* Declared with "Processor" statement; match ProcessorID */
+                status = acpi_evaluate_object(pr->handle, NULL, NULL, &buffer);
+                if (ACPI_FAILURE(status)) {
+                        printk(KERN_ERR PREFIX "Evaluating processor object\n");
+                        return -ENODEV;
+                }
+
+                /*
+                 * TBD: Synch processor ID (via LAPIC/LSAPIC structures) on SMP.
+                 *      >>> 'acpi_get_processor_id(acpi_id, &id)' in
+                 *      arch/xxx/acpi.c
+                 */
+                pr->acpi_id = object.processor.proc_id;
+        } else {
                 /*
                  * Declared with "Device" statement; match _UID.
                  * Note that we don't handle string _UIDs yet.
@@ -611,20 +625,6 @@ static int acpi_processor_get_info(struct acpi_device *device)
                 }
                 device_declaration = 1;
                 pr->acpi_id = value;
-        } else {
-                /* Declared with "Processor" statement; match ProcessorID */
-                status = acpi_evaluate_object(pr->handle, NULL, NULL, &buffer);
-                if (ACPI_FAILURE(status)) {
-                        printk(KERN_ERR PREFIX "Evaluating processor object\n");
-                        return -ENODEV;
-                }
-
-                /*
-                 * TBD: Synch processor ID (via LAPIC/LSAPIC structures) on SMP.
-                 *      >>> 'acpi_get_processor_id(acpi_id, &id)' in
-                 *      arch/xxx/acpi.c
-                 */
-                pr->acpi_id = object.processor.proc_id;
         }
         cpu_index = get_cpu_id(pr->handle, device_declaration, pr->acpi_id);
 
@@ -649,7 +649,16 @@ static int acpi_processor_get_info(struct acpi_device *device)
                         return -ENODEV;
                 }
         }
-
+        /*
+         * On some boxes several processors use the same processor bus id.
+         * But they are located in different scope. For example:
+         * \_SB.SCK0.CPU0
+         * \_SB.SCK1.CPU0
+         * Rename the processor device bus id. And the new bus id will be
+         * generated as the following format:
+         * CPU+CPU ID.
+         */
+        sprintf(acpi_device_bid(device), "CPU%X", pr->id);
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Processor [%d:%d]\n", pr->id,
                           pr->acpi_id));
 
@@ -731,6 +740,8 @@ static int __cpuinit acpi_processor_start(struct acpi_device *device)
         /* _PDC call should be done before doing anything else (if reqd.). */
         arch_acpi_processor_init_pdc(pr);
         acpi_processor_set_pdc(pr);
+        arch_acpi_processor_cleanup_pdc(pr);
+
 #ifdef CONFIG_CPU_FREQ
         acpi_processor_ppc_has_changed(pr);
 #endif
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 10a2d913635a..0efa59e7e3af 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -139,7 +139,7 @@ static void acpi_safe_halt(void)
  * are affected too. We pick the most conservative approach: we assume
  * that the local APIC stops in both C2 and C3.
  */
-static void acpi_timer_check_state(int state, struct acpi_processor *pr,
+static void lapic_timer_check_state(int state, struct acpi_processor *pr,
                                    struct acpi_processor_cx *cx)
 {
         struct acpi_processor_power *pwr = &pr->power;
@@ -162,7 +162,7 @@ static void acpi_timer_check_state(int state, struct acpi_processor *pr,
                 pr->power.timer_broadcast_on_state = state;
 }
 
-static void acpi_propagate_timer_broadcast(struct acpi_processor *pr)
+static void lapic_timer_propagate_broadcast(struct acpi_processor *pr)
 {
         unsigned long reason;
 
@@ -173,7 +173,7 @@ static void acpi_propagate_timer_broadcast(struct acpi_processor *pr)
 }
 
 /* Power(C) State timer broadcast control */
-static void acpi_state_timer_broadcast(struct acpi_processor *pr,
+static void lapic_timer_state_broadcast(struct acpi_processor *pr,
                                        struct acpi_processor_cx *cx,
                                        int broadcast)
 {
@@ -190,10 +190,10 @@ static void acpi_state_timer_broadcast(struct acpi_processor *pr,
 
 #else
 
-static void acpi_timer_check_state(int state, struct acpi_processor *pr,
+static void lapic_timer_check_state(int state, struct acpi_processor *pr,
                                    struct acpi_processor_cx *cstate) { }
-static void acpi_propagate_timer_broadcast(struct acpi_processor *pr) { }
-static void acpi_state_timer_broadcast(struct acpi_processor *pr,
+static void lapic_timer_propagate_broadcast(struct acpi_processor *pr) { }
+static void lapic_timer_state_broadcast(struct acpi_processor *pr,
                                        struct acpi_processor_cx *cx,
                                        int broadcast)
 {
@@ -515,7 +515,8 @@ static void acpi_processor_power_verify_c2(struct acpi_processor_cx *cx)
 static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
                                            struct acpi_processor_cx *cx)
 {
-        static int bm_check_flag;
+        static int bm_check_flag = -1;
+        static int bm_control_flag = -1;
 
 
         if (!cx->address)
@@ -545,12 +546,14 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
         }
 
         /* All the logic here assumes flags.bm_check is same across all CPUs */
-        if (!bm_check_flag) {
+        if (bm_check_flag == -1) {
                 /* Determine whether bm_check is needed based on CPU  */
                 acpi_processor_power_init_bm_check(&(pr->flags), pr->id);
                 bm_check_flag = pr->flags.bm_check;
+                bm_control_flag = pr->flags.bm_control;
         } else {
                 pr->flags.bm_check = bm_check_flag;
+                pr->flags.bm_control = bm_control_flag;
         }
 
         if (pr->flags.bm_check) {
@@ -614,29 +617,25 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                 switch (cx->type) {
                 case ACPI_STATE_C1:
                         cx->valid = 1;
-                        acpi_timer_check_state(i, pr, cx);
                         break;
 
                 case ACPI_STATE_C2:
                         acpi_processor_power_verify_c2(cx);
-                        if (cx->valid)
-                                acpi_timer_check_state(i, pr, cx);
                         break;
 
                 case ACPI_STATE_C3:
                         acpi_processor_power_verify_c3(pr, cx);
-                        if (cx->valid)
-                                acpi_timer_check_state(i, pr, cx);
                         break;
                 }
-                if (cx->valid)
-                        tsc_check_state(cx->type);
+                if (!cx->valid)
+                        continue;
 
-                if (cx->valid)
-                        working++;
+                lapic_timer_check_state(i, pr, cx);
+                tsc_check_state(cx->type);
+                working++;
         }
 
-        acpi_propagate_timer_broadcast(pr);
+        lapic_timer_propagate_broadcast(pr);
 
         return (working);
 }
@@ -839,7 +838,7 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
                 return 0;
         }
 
-        acpi_state_timer_broadcast(pr, cx, 1);
+        lapic_timer_state_broadcast(pr, cx, 1);
         kt1 = ktime_get_real();
         acpi_idle_do_entry(cx);
         kt2 = ktime_get_real();
@@ -847,7 +846,7 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
 
         local_irq_enable();
         cx->usage++;
-        acpi_state_timer_broadcast(pr, cx, 0);
+        lapic_timer_state_broadcast(pr, cx, 0);
 
         return idle_time;
 }
@@ -892,7 +891,7 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
          * Must be done before busmaster disable as we might need to
          * access HPET !
          */
-        acpi_state_timer_broadcast(pr, cx, 1);
+        lapic_timer_state_broadcast(pr, cx, 1);
 
         if (cx->type == ACPI_STATE_C3)
                 ACPI_FLUSH_CPU_CACHE();
@@ -914,7 +913,7 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
 
         cx->usage++;
 
-        acpi_state_timer_broadcast(pr, cx, 0);
+        lapic_timer_state_broadcast(pr, cx, 0);
         cx->time += sleep_ticks;
         return idle_time;
 }
@@ -981,7 +980,7 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
          * Must be done before busmaster disable as we might need to
          * access HPET !
          */
-        acpi_state_timer_broadcast(pr, cx, 1);
+        lapic_timer_state_broadcast(pr, cx, 1);
 
         kt1 = ktime_get_real();
         /*
@@ -1026,7 +1025,7 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
 
         cx->usage++;
 
-        acpi_state_timer_broadcast(pr, cx, 0);
+        lapic_timer_state_broadcast(pr, cx, 0);
         cx->time += sleep_ticks;
         return idle_time;
 }
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 8ff510b91d88..781435d7e369 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -95,7 +95,7 @@ acpi_device_modalias_show(struct device *dev, struct device_attribute *attr, cha
 }
 static DEVICE_ATTR(modalias, 0444, acpi_device_modalias_show, NULL);
 
-static int acpi_bus_hot_remove_device(void *context)
+static void acpi_bus_hot_remove_device(void *context)
 {
         struct acpi_device *device;
         acpi_handle handle = context;
@@ -104,10 +104,10 @@ static int acpi_bus_hot_remove_device(void *context)
         acpi_status status = AE_OK;
 
         if (acpi_bus_get_device(handle, &device))
-                return 0;
+                return;
 
         if (!device)
-                return 0;
+                return;
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                 "Hot-removing device %s...\n", dev_name(&device->dev)));
@@ -115,7 +115,7 @@ static int acpi_bus_hot_remove_device(void *context)
         if (acpi_bus_trim(device, 1)) {
                 printk(KERN_ERR PREFIX
                                 "Removing device failed\n");
-                return -1;
+                return;
         }
 
         /* power off device */
@@ -142,9 +142,10 @@ static int acpi_bus_hot_remove_device(void *context)
          */
         status = acpi_evaluate_object(handle, "_EJ0", &arg_list, NULL);
         if (ACPI_FAILURE(status))
-                return -ENODEV;
+                printk(KERN_WARNING PREFIX
+                                "Eject device failed\n");
 
-        return 0;
+        return;
 }
 
 static ssize_t
@@ -155,7 +156,6 @@ acpi_eject_store(struct device *d, struct device_attribute *attr,
         acpi_status status;
         acpi_object_type type = 0;
         struct acpi_device *acpi_device = to_acpi_device(d);
-        struct task_struct *task;
 
         if ((!count) || (buf[0] != '1')) {
                 return -EINVAL;
@@ -172,11 +172,7 @@ acpi_eject_store(struct device *d, struct device_attribute *attr,
                 goto err;
         }
 
-        /* remove the device in another thread to fix the deadlock issue */
-        task = kthread_run(acpi_bus_hot_remove_device,
-                                acpi_device->handle, "acpi_hot_remove_device");
-        if (IS_ERR(task))
-                ret = PTR_ERR(task);
+        acpi_os_hotplug_execute(acpi_bus_hot_remove_device, acpi_device->handle);
 err:
         return ret;
 }
@@ -198,12 +194,12 @@ acpi_device_path_show(struct device *dev, struct device_attribute *attr, char *b
         int result;
 
         result = acpi_get_name(acpi_dev->handle, ACPI_FULL_PATHNAME, &path);
-        if(result)
+        if (result)
                 goto end;
 
         result = sprintf(buf, "%s\n", (char*)path.pointer);
         kfree(path.pointer);
-  end:
+end:
         return result;
 }
 static DEVICE_ATTR(path, 0444, acpi_device_path_show, NULL);
@@ -217,21 +213,21 @@ static int acpi_device_setup_files(struct acpi_device *dev)
         /*
          * Devices gotten from FADT don't have a "path" attribute
          */
-        if(dev->handle) {
+        if (dev->handle) {
                 result = device_create_file(&dev->dev, &dev_attr_path);
-                if(result)
+                if (result)
                         goto end;
         }
 
-        if(dev->flags.hardware_id) {
+        if (dev->flags.hardware_id) {
                 result = device_create_file(&dev->dev, &dev_attr_hid);
-                if(result)
+                if (result)
                         goto end;
         }
 
-        if (dev->flags.hardware_id || dev->flags.compatible_ids){
+        if (dev->flags.hardware_id || dev->flags.compatible_ids) {
                 result = device_create_file(&dev->dev, &dev_attr_modalias);
-                if(result)
+                if (result)
                         goto end;
         }
 
@@ -242,7 +238,7 @@ static int acpi_device_setup_files(struct acpi_device *dev)
         status = acpi_get_handle(dev->handle, "_EJ0", &temp);
         if (ACPI_SUCCESS(status))
                 result = device_create_file(&dev->dev, &dev_attr_eject);
-  end:
+end:
         return result;
 }
 
@@ -262,9 +258,9 @@ static void acpi_device_remove_files(struct acpi_device *dev)
         if (dev->flags.hardware_id || dev->flags.compatible_ids)
                 device_remove_file(&dev->dev, &dev_attr_modalias);
 
-        if(dev->flags.hardware_id)
+        if (dev->flags.hardware_id)
                 device_remove_file(&dev->dev, &dev_attr_hid);
-        if(dev->handle)
+        if (dev->handle)
                 device_remove_file(&dev->dev, &dev_attr_path);
 }
 /* --------------------------------------------------------------------------
@@ -512,7 +508,7 @@ static int acpi_device_register(struct acpi_device *device,
                         break;
                 }
         }
-        if(!found) {
+        if (!found) {
                 acpi_device_bus_id = new_bus_id;
                 strcpy(acpi_device_bus_id->bus_id, device->flags.hardware_id ? device->pnp.hardware_id : "device");
                 acpi_device_bus_id->instance_no = 0;
@@ -530,22 +526,21 @@ static int acpi_device_register(struct acpi_device *device,
         if (device->parent)
                 device->dev.parent = &parent->dev;
         device->dev.bus = &acpi_bus_type;
-        device_initialize(&device->dev);
         device->dev.release = &acpi_device_release;
-        result = device_add(&device->dev);
-        if(result) {
-                dev_err(&device->dev, "Error adding device\n");
+        result = device_register(&device->dev);
+        if (result) {
+                dev_err(&device->dev, "Error registering device\n");
                 goto end;
         }
 
         result = acpi_device_setup_files(device);
-        if(result)
+        if (result)
                 printk(KERN_ERR PREFIX "Error creating sysfs interface for device %s\n",
                        dev_name(&device->dev));
 
         device->removal_type = ACPI_BUS_REMOVAL_NORMAL;
         return 0;
-  end:
+end:
         mutex_lock(&acpi_device_lock);
         if (device->parent)
                 list_del(&device->node);
@@ -577,7 +572,7 @@ static void acpi_device_unregister(struct acpi_device *device, int type)
  * @device: the device to add and initialize
  * @driver: driver for the device
  *
- * Used to initialize a device via its device driver.  Called whenever a 
+ * Used to initialize a device via its device driver.  Called whenever a
  * driver is bound to a device.  Invokes the driver's add() ops.
  */
 static int
@@ -585,7 +580,6 @@ acpi_bus_driver_init(struct acpi_device *device, struct acpi_driver *driver)
 {
         int result = 0;
 
-
         if (!device || !driver)
                 return -EINVAL;
 
@@ -802,7 +796,7 @@ static int acpi_bus_get_wakeup_device_flags(struct acpi_device *device)
         if (!acpi_match_device_ids(device, button_device_ids))
                 device->wakeup.flags.run_wake = 1;
 
-      end:
+end:
         if (ACPI_FAILURE(status))
                 device->flags.wake_capable = 0;
         return 0;
@@ -1070,7 +1064,7 @@ static void acpi_device_set_id(struct acpi_device *device,
                 break;
         }
 
-        /* 
+        /*
          * \_SB
          * ----
          * Fix for the system root bus device -- the only root-level device.
@@ -1320,7 +1314,7 @@ acpi_add_single_object(struct acpi_device **child,
                         device->parent->ops.bind(device);
         }
 
-      end:
+end:
         if (!result)
                 *child = device;
         else {
@@ -1464,7 +1458,6 @@ acpi_bus_add(struct acpi_device **child,
 
         return result;
 }
-
 EXPORT_SYMBOL(acpi_bus_add);
 
 int acpi_bus_start(struct acpi_device *device)
@@ -1484,7 +1477,6 @@ int acpi_bus_start(struct acpi_device *device)
         }
         return result;
 }
-
 EXPORT_SYMBOL(acpi_bus_start);
 
 int acpi_bus_trim(struct acpi_device *start, int rmdevice)
@@ -1542,7 +1534,6 @@ int acpi_bus_trim(struct acpi_device *start, int rmdevice)
 }
 EXPORT_SYMBOL_GPL(acpi_bus_trim);
 
-
 static int acpi_bus_scan_fixed(struct acpi_device *root)
 {
         int result = 0;
@@ -1610,6 +1601,6 @@ int __init acpi_scan_init(void)
         if (result)
                 acpi_device_unregister(acpi_root, ACPI_BUS_REMOVAL_NORMAL);
 
-      Done:
+Done:
         return result;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 1bdfb37377e3..8851315ce858 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL");
 static int brightness_switch_enabled = 1;
 module_param(brightness_switch_enabled, bool, 0644);
 
+static int register_count = 0;
 static int acpi_video_bus_add(struct acpi_device *device);
 static int acpi_video_bus_remove(struct acpi_device *device, int type);
 static int acpi_video_resume(struct acpi_device *device);
@@ -586,6 +587,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5315"),
                 },
         },
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "Acer Aspire 7720",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720"),
+                },
+        },
         {}
 };
 
@@ -976,6 +985,11 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                 device->backlight->props.max_brightness = device->brightness->count-3;
                 kfree(name);
 
+                result = sysfs_create_link(&device->backlight->dev.kobj,
+                                           &device->dev->dev.kobj, "device");
+                if (result)
+                        printk(KERN_ERR PREFIX "Create sysfs link\n");
+
                 device->cdev = thermal_cooling_device_register("LCD",
                                         device->dev, &video_cooling_ops);
                 if (IS_ERR(device->cdev))
@@ -1054,15 +1068,15 @@ static void acpi_video_bus_find_cap(struct acpi_video_bus *video)
 static int acpi_video_bus_check(struct acpi_video_bus *video)
 {
         acpi_status status = -ENOENT;
-        struct device *dev;
+        struct pci_dev *dev;
 
         if (!video)
                 return -EINVAL;
 
-        dev = acpi_get_physical_pci_device(video->device->handle);
+        dev = acpi_get_pci_dev(video->device->handle);
         if (!dev)
                 return -ENODEV;
-        put_device(dev);
+        pci_dev_put(dev);
 
         /* Since there is no HID, CID and so on for VGA driver, we have
          * to check well known required nodes.
@@ -1990,6 +2004,7 @@ static int acpi_video_bus_put_one_device(struct acpi_video_device *device)
         status = acpi_remove_notify_handler(device->dev->handle,
                                             ACPI_DEVICE_NOTIFY,
                                             acpi_video_device_notify);
+        sysfs_remove_link(&device->backlight->dev.kobj, "device");
         backlight_device_unregister(device->backlight);
         if (device->cdev) {
                 sysfs_remove_link(&device->dev->dev.kobj,
@@ -2318,6 +2333,13 @@ static int __init intel_opregion_present(void)
 int acpi_video_register(void)
 {
         int result = 0;
+        if (register_count) {
+                /*
+                 * if the function of acpi_video_register is already called,
+                 * don't register the acpi_vide_bus again and return no error.
+                 */
+                return 0;
+        }
 
         acpi_video_dir = proc_mkdir(ACPI_VIDEO_CLASS, acpi_root_dir);
         if (!acpi_video_dir)
@@ -2329,10 +2351,35 @@ int acpi_video_register(void)
                 return -ENODEV;
         }
 
+        /*
+         * When the acpi_video_bus is loaded successfully, increase
+         * the counter reference.
+         */
+        register_count = 1;
+
         return 0;
 }
 EXPORT_SYMBOL(acpi_video_register);
 
+void acpi_video_unregister(void)
+{
+        if (!register_count) {
+                /*
+                 * If the acpi video bus is already unloaded, don't
+                 * unload it again and return directly.
+                 */
+                return;
+        }
+        acpi_bus_unregister_driver(&acpi_video_bus);
+
+        remove_proc_entry(ACPI_VIDEO_CLASS, acpi_root_dir);
+
+        register_count = 0;
+
+        return;
+}
+EXPORT_SYMBOL(acpi_video_unregister);
+
 /*
  * This is kind of nasty. Hardware using Intel chipsets may require
  * the video opregion code to be run first in order to initialise
@@ -2350,16 +2397,12 @@ static int __init acpi_video_init(void)
         return acpi_video_register();
 }
 
-void acpi_video_exit(void)
+static void __exit acpi_video_exit(void)
 {
-
-        acpi_bus_unregister_driver(&acpi_video_bus);
-
-        remove_proc_entry(ACPI_VIDEO_CLASS, acpi_root_dir);
+        acpi_video_unregister();
 
         return;
 }
-EXPORT_SYMBOL(acpi_video_exit);
 
 module_init(acpi_video_init);
 module_exit(acpi_video_exit);
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 09737275e25f..7cd2b63435ea 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -10,7 +10,7 @@
  * assinged
  *
  * After PCI devices are glued with ACPI devices
- * acpi_get_physical_pci_device() can be called to identify ACPI graphics
+ * acpi_get_pci_dev() can be called to identify ACPI graphics
  * devices for which a real graphics card is plugged in
  *
  * Now acpi_video_get_capabilities() can be called to check which
@@ -36,6 +36,7 @@
 
 #include <linux/acpi.h>
 #include <linux/dmi.h>
+#include <linux/pci.h>
 
 ACPI_MODULE_NAME("video");
 #define _COMPONENT              ACPI_VIDEO_COMPONENT
@@ -109,7 +110,7 @@ static acpi_status
 find_video(acpi_handle handle, u32 lvl, void *context, void **rv)
 {
         long *cap = context;
-        struct device *dev;
+        struct pci_dev *dev;
         struct acpi_device *acpi_dev;
 
         const struct acpi_device_id video_ids[] = {
@@ -120,10 +121,10 @@ find_video(acpi_handle handle, u32 lvl, void *context, void **rv)
                 return AE_OK;
 
         if (!acpi_match_device_ids(acpi_dev, video_ids)) {
-                dev = acpi_get_physical_pci_device(handle);
+                dev = acpi_get_pci_dev(handle);
                 if (!dev)
                         return AE_OK;
-                put_device(dev);
+                pci_dev_put(dev);
                 *cap |= acpi_is_video_device(acpi_dev);
         }
         return AE_OK;
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 9533f43a30bb..52d953eb30c3 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1048,8 +1048,6 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
         if (retval)
                 return retval;
 
-        /* unmark here for very high baud rate (ex. 921600 bps) used */
-        tty->low_latency = 1;
         return 0;
 }
 
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index d6102b644b55..574f1c79b6e6 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -1591,8 +1591,6 @@ static int ntty_open(struct tty_struct *tty, struct file *file)
 
         /* Enable interrupt downlink for channel */
         if (port->port.count == 1) {
-                /* FIXME: is this needed now ? */
-                tty->low_latency = 1;
                 tty->driver_data = port;
                 tty_port_tty_set(&port->port, tty);
                 DBG1("open: %d", port->token_dl);
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 1386625fc4ca..a2e67e6df3a1 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -467,7 +467,6 @@ static unsigned int free_tbuf_count(struct slgt_info *info);
 static unsigned int tbuf_bytes(struct slgt_info *info);
 static void reset_tbufs(struct slgt_info *info);
 static void tdma_reset(struct slgt_info *info);
-static void tdma_start(struct slgt_info *info);
 static void tx_load(struct slgt_info *info, const char *buf, unsigned int count);
 
 static void get_signals(struct slgt_info *info);
@@ -795,6 +794,18 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios)
         }
 }
 
+static void update_tx_timer(struct slgt_info *info)
+{
+        /*
+         * use worst case speed of 1200bps to calculate transmit timeout
+         * based on data in buffers (tbuf_bytes) and FIFO (128 bytes)
+         */
+        if (info->params.mode == MGSL_MODE_HDLC) {
+                int timeout  = (tbuf_bytes(info) * 7) + 1000;
+                mod_timer(&info->tx_timer, jiffies + msecs_to_jiffies(timeout));
+        }
+}
+
 static int write(struct tty_struct *tty,
                  const unsigned char *buf, int count)
 {
@@ -838,8 +849,18 @@ start:
                 spin_lock_irqsave(&info->lock,flags);
                 if (!info->tx_active)
                         tx_start(info);
-                else
-                        tdma_start(info);
+                else if (!(rd_reg32(info, TDCSR) & BIT0)) {
+                        /* transmit still active but transmit DMA stopped */
+                        unsigned int i = info->tbuf_current;
+                        if (!i)
+                                i = info->tbuf_count;
+                        i--;
+                        /* if DMA buf unsent must try later after tx idle */
+                        if (desc_count(info->tbufs[i]))
+                                ret = 0;
+                }
+                if (ret > 0)
+                        update_tx_timer(info);
                 spin_unlock_irqrestore(&info->lock,flags);
         }
 
@@ -1502,10 +1523,9 @@ static int hdlcdev_xmit(struct sk_buff *skb, struct net_device *dev)
         /* save start time for transmit timeout detection */
         dev->trans_start = jiffies;
 
-        /* start hardware transmitter if necessary */
         spin_lock_irqsave(&info->lock,flags);
-        if (!info->tx_active)
-                tx_start(info);
+        tx_start(info);
+        update_tx_timer(info);
         spin_unlock_irqrestore(&info->lock,flags);
 
         return 0;
@@ -3946,50 +3966,19 @@ static void tx_start(struct slgt_info *info)
                         slgt_irq_on(info, IRQ_TXUNDER + IRQ_TXIDLE);
                         /* clear tx idle and underrun status bits */
                         wr_reg16(info, SSR, (unsigned short)(IRQ_TXIDLE + IRQ_TXUNDER));
-                        if (info->params.mode == MGSL_MODE_HDLC)
-                                mod_timer(&info->tx_timer, jiffies +
-                                                msecs_to_jiffies(5000));
                 } else {
                         slgt_irq_off(info, IRQ_TXDATA);
                         slgt_irq_on(info, IRQ_TXIDLE);
                         /* clear tx idle status bit */
                         wr_reg16(info, SSR, IRQ_TXIDLE);
                 }
-                tdma_start(info);
+                /* set 1st descriptor address and start DMA */
+                wr_reg32(info, TDDAR, info->tbufs[info->tbuf_start].pdesc);
+                wr_reg32(info, TDCSR, BIT2 + BIT0);
                 info->tx_active = true;
         }
 }
 
-/*
- * start transmit DMA if inactive and there are unsent buffers
- */
-static void tdma_start(struct slgt_info *info)
-{
-        unsigned int i;
-
-        if (rd_reg32(info, TDCSR) & BIT0)
-                return;
-
-        /* transmit DMA inactive, check for unsent buffers */
-        i = info->tbuf_start;
-        while (!desc_count(info->tbufs[i])) {
-                if (++i == info->tbuf_count)
-                        i = 0;
-                if (i == info->tbuf_current)
-                        return;
-        }
-        info->tbuf_start = i;
-
-        /* there are unsent buffers, start transmit DMA */
-
-        /* reset needed if previous error condition */
-        tdma_reset(info);
-
-        /* set 1st descriptor address */
-        wr_reg32(info, TDDAR, info->tbufs[info->tbuf_start].pdesc);
-        wr_reg32(info, TDCSR, BIT2 + BIT0); /* IRQ + DMA enable */
-}
-
 static void tx_stop(struct slgt_info *info)
 {
         unsigned short val;
@@ -5004,8 +4993,7 @@ static void tx_timeout(unsigned long context)
                 info->icount.txtimeout++;
         }
         spin_lock_irqsave(&info->lock,flags);
-        info->tx_active = false;
-        info->tx_count = 0;
+        tx_stop(info);
         spin_unlock_irqrestore(&info->lock,flags);
 
 #if SYNCLINK_GENERIC_HDLC
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index 62dadfc95e34..4e862a75f7ff 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -193,7 +193,7 @@ int tty_port_block_til_ready(struct tty_port *port,
 {
         int do_clocal = 0, retval;
         unsigned long flags;
-        DECLARE_WAITQUEUE(wait, current);
+        DEFINE_WAIT(wait);
         int cd;
 
         /* block if port is in the process of being closed */
diff --git a/drivers/gpu/drm/i915/i915_opregion.c b/drivers/gpu/drm/i915/i915_opregion.c
index dc425e74a268..e4b4e8898e39 100644
--- a/drivers/gpu/drm/i915/i915_opregion.c
+++ b/drivers/gpu/drm/i915/i915_opregion.c
@@ -419,7 +419,7 @@ void intel_opregion_free(struct drm_device *dev, int suspend)
                 return;
 
         if (!suspend)
-                acpi_video_exit();
+                acpi_video_unregister();
 
         opregion->acpi->drdy = 0;
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 3c259ee7ddda..aa87b6a3bbef 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -326,6 +326,15 @@ config I2C_DAVINCI
           devices such as DaVinci NIC.
           For details please see http://www.ti.com/davinci
 
+config I2C_DESIGNWARE
+        tristate "Synopsys DesignWare"
+        help
+          If you say yes to this option, support will be included for the
+          Synopsys DesignWare I2C adapter. Only master mode is supported.
+
+          This driver can also be built as a module.  If so, the module
+          will be called i2c-designware.
+
 config I2C_GPIO
         tristate "GPIO-based bitbanging I2C"
         depends on GENERIC_GPIO
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index edeabf003106..e654263bfc01 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_I2C_AU1550)	+= i2c-au1550.o
 obj-$(CONFIG_I2C_BLACKFIN_TWI)  += i2c-bfin-twi.o
 obj-$(CONFIG_I2C_CPM)           += i2c-cpm.o
 obj-$(CONFIG_I2C_DAVINCI)       += i2c-davinci.o
+obj-$(CONFIG_I2C_DESIGNWARE)    += i2c-designware.o
 obj-$(CONFIG_I2C_GPIO)          += i2c-gpio.o
 obj-$(CONFIG_I2C_HIGHLANDER)    += i2c-highlander.o
 obj-$(CONFIG_I2C_IBM_IIC)       += i2c-ibm_iic.o
diff --git a/drivers/i2c/busses/i2c-designware.c b/drivers/i2c/busses/i2c-designware.c
new file mode 100644
index 000000000000..b444762e9b9f
--- /dev/null
+++ b/drivers/i2c/busses/i2c-designware.c
@@ -0,0 +1,624 @@
+/*
+ * Synopsys Designware I2C adapter driver (master only).
+ *
+ * Based on the TI DAVINCI I2C adapter driver.
+ *
+ * Copyright (C) 2006 Texas Instruments.
+ * Copyright (C) 2007 MontaVista Software Inc.
+ * Copyright (C) 2009 Provigent Ltd.
+ *
+ * ----------------------------------------------------------------------------
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ * ----------------------------------------------------------------------------
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/clk.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+
+/*
+ * Registers offset
+ */
+#define DW_IC_CON               0x0
+#define DW_IC_TAR               0x4
+#define DW_IC_DATA_CMD          0x10
+#define DW_IC_SS_SCL_HCNT       0x14
+#define DW_IC_SS_SCL_LCNT       0x18
+#define DW_IC_FS_SCL_HCNT       0x1c
+#define DW_IC_FS_SCL_LCNT       0x20
+#define DW_IC_INTR_STAT         0x2c
+#define DW_IC_INTR_MASK         0x30
+#define DW_IC_CLR_INTR          0x40
+#define DW_IC_ENABLE            0x6c
+#define DW_IC_STATUS            0x70
+#define DW_IC_TXFLR             0x74
+#define DW_IC_RXFLR             0x78
+#define DW_IC_COMP_PARAM_1      0xf4
+#define DW_IC_TX_ABRT_SOURCE    0x80
+
+#define DW_IC_CON_MASTER                0x1
+#define DW_IC_CON_SPEED_STD             0x2
+#define DW_IC_CON_SPEED_FAST            0x4
+#define DW_IC_CON_10BITADDR_MASTER      0x10
+#define DW_IC_CON_RESTART_EN            0x20
+#define DW_IC_CON_SLAVE_DISABLE         0x40
+
+#define DW_IC_INTR_TX_EMPTY     0x10
+#define DW_IC_INTR_TX_ABRT      0x40
+#define DW_IC_INTR_STOP_DET     0x200
+
+#define DW_IC_STATUS_ACTIVITY   0x1
+
+#define DW_IC_ERR_TX_ABRT       0x1
+
+/*
+ * status codes
+ */
+#define STATUS_IDLE                     0x0
+#define STATUS_WRITE_IN_PROGRESS        0x1
+#define STATUS_READ_IN_PROGRESS         0x2
+
+#define TIMEOUT                 20 /* ms */
+
+/*
+ * hardware abort codes from the DW_IC_TX_ABRT_SOURCE register
+ *
+ * only expected abort codes are listed here
+ * refer to the datasheet for the full list
+ */
+#define ABRT_7B_ADDR_NOACK      0
+#define ABRT_10ADDR1_NOACK      1
+#define ABRT_10ADDR2_NOACK      2
+#define ABRT_TXDATA_NOACK       3
+#define ABRT_GCALL_NOACK        4
+#define ABRT_GCALL_READ         5
+#define ABRT_SBYTE_ACKDET       7
+#define ABRT_SBYTE_NORSTRT      9
+#define ABRT_10B_RD_NORSTRT     10
+#define ARB_MASTER_DIS          11
+#define ARB_LOST                12
+
+static char *abort_sources[] = {
+        [ABRT_7B_ADDR_NOACK]    =
+                "slave address not acknowledged (7bit mode)",
+        [ABRT_10ADDR1_NOACK]    =
+                "first address byte not acknowledged (10bit mode)",
+        [ABRT_10ADDR2_NOACK]    =
+                "second address byte not acknowledged (10bit mode)",
+        [ABRT_TXDATA_NOACK]             =
+                "data not acknowledged",
+        [ABRT_GCALL_NOACK]              =
+                "no acknowledgement for a general call",
+        [ABRT_GCALL_READ]               =
+                "read after general call",
+        [ABRT_SBYTE_ACKDET]             =
+                "start byte acknowledged",
+        [ABRT_SBYTE_NORSTRT]    =
+                "trying to send start byte when restart is disabled",
+        [ABRT_10B_RD_NORSTRT]   =
+                "trying to read when restart is disabled (10bit mode)",
+        [ARB_MASTER_DIS]                =
+                "trying to use disabled adapter",
+        [ARB_LOST]                      =
+                "lost arbitration",
+};
+
+/**
+ * struct dw_i2c_dev - private i2c-designware data
+ * @dev: driver model device node
+ * @base: IO registers pointer
+ * @cmd_complete: tx completion indicator
+ * @pump_msg: continue in progress transfers
+ * @lock: protect this struct and IO registers
+ * @clk: input reference clock
+ * @cmd_err: run time hadware error code
+ * @msgs: points to an array of messages currently being transfered
+ * @msgs_num: the number of elements in msgs
+ * @msg_write_idx: the element index of the current tx message in the msgs
+ *      array
+ * @tx_buf_len: the length of the current tx buffer
+ * @tx_buf: the current tx buffer
+ * @msg_read_idx: the element index of the current rx message in the msgs
+ *      array
+ * @rx_buf_len: the length of the current rx buffer
+ * @rx_buf: the current rx buffer
+ * @msg_err: error status of the current transfer
+ * @status: i2c master status, one of STATUS_*
+ * @abort_source: copy of the TX_ABRT_SOURCE register
+ * @irq: interrupt number for the i2c master
+ * @adapter: i2c subsystem adapter node
+ * @tx_fifo_depth: depth of the hardware tx fifo
+ * @rx_fifo_depth: depth of the hardware rx fifo
+ */
+struct dw_i2c_dev {
+        struct device           *dev;
+        void __iomem            *base;
+        struct completion       cmd_complete;
+        struct tasklet_struct   pump_msg;
+        struct mutex            lock;
+        struct clk              *clk;
+        int                     cmd_err;
+        struct i2c_msg          *msgs;
+        int                     msgs_num;
+        int                     msg_write_idx;
+        u16                     tx_buf_len;
+        u8                      *tx_buf;
+        int                     msg_read_idx;
+        u16                     rx_buf_len;
+        u8                      *rx_buf;
+        int                     msg_err;
+        unsigned int            status;
+        u16                     abort_source;
+        int                     irq;
+        struct i2c_adapter      adapter;
+        unsigned int            tx_fifo_depth;
+        unsigned int            rx_fifo_depth;
+};
+
+/**
+ * i2c_dw_init() - initialize the designware i2c master hardware
+ * @dev: device private data
+ *
+ * This functions configures and enables the I2C master.
+ * This function is called during I2C init function, and in case of timeout at
+ * run time.
+ */
+static void i2c_dw_init(struct dw_i2c_dev *dev)
+{
+        u32 input_clock_khz = clk_get_rate(dev->clk) / 1000;
+        u16 ic_con;
+
+        /* Disable the adapter */
+        writeb(0, dev->base + DW_IC_ENABLE);
+
+        /* set standard and fast speed deviders for high/low periods */
+        writew((input_clock_khz * 40 / 10000)+1, /* std speed high, 4us */
+                        dev->base + DW_IC_SS_SCL_HCNT);
+        writew((input_clock_khz * 47 / 10000)+1, /* std speed low, 4.7us */
+                        dev->base + DW_IC_SS_SCL_LCNT);
+        writew((input_clock_khz *  6 / 10000)+1, /* fast speed high, 0.6us */
+                        dev->base + DW_IC_FS_SCL_HCNT);
+        writew((input_clock_khz * 13 / 10000)+1, /* fast speed low, 1.3us */
+                        dev->base + DW_IC_FS_SCL_LCNT);
+
+        /* configure the i2c master */
+        ic_con = DW_IC_CON_MASTER | DW_IC_CON_SLAVE_DISABLE |
+                DW_IC_CON_RESTART_EN | DW_IC_CON_SPEED_FAST;
+        writew(ic_con, dev->base + DW_IC_CON);
+}
+
+/*
+ * Waiting for bus not busy
+ */
+static int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev)
+{
+        int timeout = TIMEOUT;
+
+        while (readb(dev->base + DW_IC_STATUS) & DW_IC_STATUS_ACTIVITY) {
+                if (timeout <= 0) {
+                        dev_warn(dev->dev, "timeout waiting for bus ready\n");
+                        return -ETIMEDOUT;
+                }
+                timeout--;
+                mdelay(1);
+        }
+
+        return 0;
+}
+
+/*
+ * Initiate low level master read/write transaction.
+ * This function is called from i2c_dw_xfer when starting a transfer.
+ * This function is also called from dw_i2c_pump_msg to continue a transfer
+ * that is longer than the size of the TX FIFO.
+ */
+static void
+i2c_dw_xfer_msg(struct i2c_adapter *adap)
+{
+        struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
+        struct i2c_msg *msgs = dev->msgs;
+        int num = dev->msgs_num;
+        u16 ic_con, intr_mask;
+        int tx_limit = dev->tx_fifo_depth - readb(dev->base + DW_IC_TXFLR);
+        int rx_limit = dev->rx_fifo_depth - readb(dev->base + DW_IC_RXFLR);
+        u16 addr = msgs[dev->msg_write_idx].addr;
+        u16 buf_len = dev->tx_buf_len;
+
+        if (!(dev->status & STATUS_WRITE_IN_PROGRESS)) {
+                /* Disable the adapter */
+                writeb(0, dev->base + DW_IC_ENABLE);
+
+                /* set the slave (target) address */
+                writew(msgs[dev->msg_write_idx].addr, dev->base + DW_IC_TAR);
+
+                /* if the slave address is ten bit address, enable 10BITADDR */
+                ic_con = readw(dev->base + DW_IC_CON);
+                if (msgs[dev->msg_write_idx].flags & I2C_M_TEN)
+                        ic_con |= DW_IC_CON_10BITADDR_MASTER;
+                else
+                        ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+                writew(ic_con, dev->base + DW_IC_CON);
+
+                /* Enable the adapter */
+                writeb(1, dev->base + DW_IC_ENABLE);
+        }
+
+        for (; dev->msg_write_idx < num; dev->msg_write_idx++) {
+                /* if target address has changed, we need to
+                 * reprogram the target address in the i2c
+                 * adapter when we are done with this transfer
+                 */
+                if (msgs[dev->msg_write_idx].addr != addr)
+                        return;
+
+                if (msgs[dev->msg_write_idx].len == 0) {
+                        dev_err(dev->dev,
+                                "%s: invalid message length\n", __func__);
+                        dev->msg_err = -EINVAL;
+                        return;
+                }
+
+                if (!(dev->status & STATUS_WRITE_IN_PROGRESS)) {
+                        /* new i2c_msg */
+                        dev->tx_buf = msgs[dev->msg_write_idx].buf;
+                        buf_len = msgs[dev->msg_write_idx].len;
+                }
+
+                while (buf_len > 0 && tx_limit > 0 && rx_limit > 0) {
+                        if (msgs[dev->msg_write_idx].flags & I2C_M_RD) {
+                                writew(0x100, dev->base + DW_IC_DATA_CMD);
+                                rx_limit--;
+                        } else
+                                writew(*(dev->tx_buf++),
+                                                dev->base + DW_IC_DATA_CMD);
+                        tx_limit--; buf_len--;
+                }
+        }
+
+        intr_mask = DW_IC_INTR_STOP_DET | DW_IC_INTR_TX_ABRT;
+        if (buf_len > 0) { /* more bytes to be written */
+                intr_mask |= DW_IC_INTR_TX_EMPTY;
+                dev->status |= STATUS_WRITE_IN_PROGRESS;
+        } else
+                dev->status &= ~STATUS_WRITE_IN_PROGRESS;
+        writew(intr_mask, dev->base + DW_IC_INTR_MASK);
+
+        dev->tx_buf_len = buf_len;
+}
+
+static void
+i2c_dw_read(struct i2c_adapter *adap)
+{
+        struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
+        struct i2c_msg *msgs = dev->msgs;
+        int num = dev->msgs_num;
+        u16 addr = msgs[dev->msg_read_idx].addr;
+        int rx_valid = readw(dev->base + DW_IC_RXFLR);
+
+        for (; dev->msg_read_idx < num; dev->msg_read_idx++) {
+                u16 len;
+                u8 *buf;
+
+                if (!(msgs[dev->msg_read_idx].flags & I2C_M_RD))
+                        continue;
+
+                /* different i2c client, reprogram the i2c adapter */
+                if (msgs[dev->msg_read_idx].addr != addr)
+                        return;
+
+                if (!(dev->status & STATUS_READ_IN_PROGRESS)) {
+                        len = msgs[dev->msg_read_idx].len;
+                        buf = msgs[dev->msg_read_idx].buf;
+                } else {
+                        len = dev->rx_buf_len;
+                        buf = dev->rx_buf;
+                }
+
+                for (; len > 0 && rx_valid > 0; len--, rx_valid--)
+                        *buf++ = readb(dev->base + DW_IC_DATA_CMD);
+
+                if (len > 0) {
+                        dev->status |= STATUS_READ_IN_PROGRESS;
+                        dev->rx_buf_len = len;
+                        dev->rx_buf = buf;
+                        return;
+                } else
+                        dev->status &= ~STATUS_READ_IN_PROGRESS;
+        }
+}
+
+/*
+ * Prepare controller for a transaction and call i2c_dw_xfer_msg
+ */
+static int
+i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+{
+        struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
+        int ret;
+
+        dev_dbg(dev->dev, "%s: msgs: %d\n", __func__, num);
+
+        mutex_lock(&dev->lock);
+
+        INIT_COMPLETION(dev->cmd_complete);
+        dev->msgs = msgs;
+        dev->msgs_num = num;
+        dev->cmd_err = 0;
+        dev->msg_write_idx = 0;
+        dev->msg_read_idx = 0;
+        dev->msg_err = 0;
+        dev->status = STATUS_IDLE;
+
+        ret = i2c_dw_wait_bus_not_busy(dev);
+        if (ret < 0)
+                goto done;
+
+        /* start the transfers */
+        i2c_dw_xfer_msg(adap);
+
+        /* wait for tx to complete */
+        ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete, HZ);
+        if (ret == 0) {
+                dev_err(dev->dev, "controller timed out\n");
+                i2c_dw_init(dev);
+                ret = -ETIMEDOUT;
+                goto done;
+        } else if (ret < 0)
+                goto done;
+
+        if (dev->msg_err) {
+                ret = dev->msg_err;
+                goto done;
+        }
+
+        /* no error */
+        if (likely(!dev->cmd_err)) {
+                /* read rx fifo, and disable the adapter */
+                do {
+                        i2c_dw_read(adap);
+                } while (dev->status & STATUS_READ_IN_PROGRESS);
+                writeb(0, dev->base + DW_IC_ENABLE);
+                ret = num;
+                goto done;
+        }
+
+        /* We have an error */
+        if (dev->cmd_err == DW_IC_ERR_TX_ABRT) {
+                unsigned long abort_source = dev->abort_source;
+                int i;
+
+                for_each_bit(i, &abort_source, ARRAY_SIZE(abort_sources)) {
+                    dev_err(dev->dev, "%s: %s\n", __func__, abort_sources[i]);
+                }
+        }
+        ret = -EIO;
+
+done:
+        mutex_unlock(&dev->lock);
+
+        return ret;
+}
+
+static u32 i2c_dw_func(struct i2c_adapter *adap)
+{
+        return I2C_FUNC_I2C | I2C_FUNC_10BIT_ADDR;
+}
+
+static void dw_i2c_pump_msg(unsigned long data)
+{
+        struct dw_i2c_dev *dev = (struct dw_i2c_dev *) data;
+        u16 intr_mask;
+
+        i2c_dw_read(&dev->adapter);
+        i2c_dw_xfer_msg(&dev->adapter);
+
+        intr_mask = DW_IC_INTR_STOP_DET | DW_IC_INTR_TX_ABRT;
+        if (dev->status & STATUS_WRITE_IN_PROGRESS)
+                intr_mask |= DW_IC_INTR_TX_EMPTY;
+        writew(intr_mask, dev->base + DW_IC_INTR_MASK);
+}
+
+/*
+ * Interrupt service routine. This gets called whenever an I2C interrupt
+ * occurs.
+ */
+static irqreturn_t i2c_dw_isr(int this_irq, void *dev_id)
+{
+        struct dw_i2c_dev *dev = dev_id;
+        u16 stat;
+
+        stat = readw(dev->base + DW_IC_INTR_STAT);
+        dev_dbg(dev->dev, "%s: stat=0x%x\n", __func__, stat);
+        if (stat & DW_IC_INTR_TX_ABRT) {
+                dev->abort_source = readw(dev->base + DW_IC_TX_ABRT_SOURCE);
+                dev->cmd_err |= DW_IC_ERR_TX_ABRT;
+                dev->status = STATUS_IDLE;
+        } else if (stat & DW_IC_INTR_TX_EMPTY)
+                tasklet_schedule(&dev->pump_msg);
+
+        readb(dev->base + DW_IC_CLR_INTR);      /* clear interrupts */
+        writew(0, dev->base + DW_IC_INTR_MASK); /* disable interrupts */
+        if (stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET))
+                complete(&dev->cmd_complete);
+
+        return IRQ_HANDLED;
+}
+
+static struct i2c_algorithm i2c_dw_algo = {
+        .master_xfer    = i2c_dw_xfer,
+        .functionality  = i2c_dw_func,
+};
+
+static int __devinit dw_i2c_probe(struct platform_device *pdev)
+{
+        struct dw_i2c_dev *dev;
+        struct i2c_adapter *adap;
+        struct resource *mem, *irq, *ioarea;
+        int r;
+
+        /* NOTE: driver uses the static register mapping */
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!mem) {
+                dev_err(&pdev->dev, "no mem resource?\n");
+                return -EINVAL;
+        }
+
+        irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!irq) {
+                dev_err(&pdev->dev, "no irq resource?\n");
+                return -EINVAL;
+        }
+
+        ioarea = request_mem_region(mem->start, resource_size(mem),
+                        pdev->name);
+        if (!ioarea) {
+                dev_err(&pdev->dev, "I2C region already claimed\n");
+                return -EBUSY;
+        }
+
+        dev = kzalloc(sizeof(struct dw_i2c_dev), GFP_KERNEL);
+        if (!dev) {
+                r = -ENOMEM;
+                goto err_release_region;
+        }
+
+        init_completion(&dev->cmd_complete);
+        tasklet_init(&dev->pump_msg, dw_i2c_pump_msg, (unsigned long) dev);
+        mutex_init(&dev->lock);
+        dev->dev = get_device(&pdev->dev);
+        dev->irq = irq->start;
+        platform_set_drvdata(pdev, dev);
+
+        dev->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(dev->clk)) {
+                r = -ENODEV;
+                goto err_free_mem;
+        }
+        clk_enable(dev->clk);
+
+        dev->base = ioremap(mem->start, resource_size(mem));
+        if (dev->base == NULL) {
+                dev_err(&pdev->dev, "failure mapping io resources\n");
+                r = -EBUSY;
+                goto err_unuse_clocks;
+        }
+        {
+                u32 param1 = readl(dev->base + DW_IC_COMP_PARAM_1);
+
+                dev->tx_fifo_depth = ((param1 >> 16) & 0xff) + 1;
+                dev->rx_fifo_depth = ((param1 >> 8)  & 0xff) + 1;
+        }
+        i2c_dw_init(dev);
+
+        writew(0, dev->base + DW_IC_INTR_MASK); /* disable IRQ */
+        r = request_irq(dev->irq, i2c_dw_isr, 0, pdev->name, dev);
+        if (r) {
+                dev_err(&pdev->dev, "failure requesting irq %i\n", dev->irq);
+                goto err_iounmap;
+        }
+
+        adap = &dev->adapter;
+        i2c_set_adapdata(adap, dev);
+        adap->owner = THIS_MODULE;
+        adap->class = I2C_CLASS_HWMON;
+        strlcpy(adap->name, "Synopsys DesignWare I2C adapter",
+                        sizeof(adap->name));
+        adap->algo = &i2c_dw_algo;
+        adap->dev.parent = &pdev->dev;
+
+        adap->nr = pdev->id;
+        r = i2c_add_numbered_adapter(adap);
+        if (r) {
+                dev_err(&pdev->dev, "failure adding adapter\n");
+                goto err_free_irq;
+        }
+
+        return 0;
+
+err_free_irq:
+        free_irq(dev->irq, dev);
+err_iounmap:
+        iounmap(dev->base);
+err_unuse_clocks:
+        clk_disable(dev->clk);
+        clk_put(dev->clk);
+        dev->clk = NULL;
+err_free_mem:
+        platform_set_drvdata(pdev, NULL);
+        put_device(&pdev->dev);
+        kfree(dev);
+err_release_region:
+        release_mem_region(mem->start, resource_size(mem));
+
+        return r;
+}
+
+static int __devexit dw_i2c_remove(struct platform_device *pdev)
+{
+        struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        struct resource *mem;
+
+        platform_set_drvdata(pdev, NULL);
+        i2c_del_adapter(&dev->adapter);
+        put_device(&pdev->dev);
+
+        clk_disable(dev->clk);
+        clk_put(dev->clk);
+        dev->clk = NULL;
+
+        writeb(0, dev->base + DW_IC_ENABLE);
+        free_irq(dev->irq, dev);
+        kfree(dev);
+
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        release_mem_region(mem->start, resource_size(mem));
+        return 0;
+}
+
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:i2c_designware");
+
+static struct platform_driver dw_i2c_driver = {
+        .remove         = __devexit_p(dw_i2c_remove),
+        .driver         = {
+                .name   = "i2c_designware",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init dw_i2c_init_driver(void)
+{
+        return platform_driver_probe(&dw_i2c_driver, dw_i2c_probe);
+}
+module_init(dw_i2c_init_driver);
+
+static void __exit dw_i2c_exit_driver(void)
+{
+        platform_driver_unregister(&dw_i2c_driver);
+}
+module_exit(dw_i2c_exit_driver);
+
+MODULE_AUTHOR("Baruch Siach <baruch@tkos.co.il>");
+MODULE_DESCRIPTION("Synopsys DesignWare I2C bus adapter");
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 36e0675be9f7..020f9573fd82 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -231,6 +231,17 @@ config DM_MIRROR
          Allow volume managers to mirror logical volumes, also
          needed for live data migration tools such as 'pvmove'.
 
+config DM_LOG_USERSPACE
+        tristate "Mirror userspace logging (EXPERIMENTAL)"
+        depends on DM_MIRROR && EXPERIMENTAL && NET
+        select CONNECTOR
+        ---help---
+          The userspace logging module provides a mechanism for
+          relaying the dm-dirty-log API to userspace.  Log designs
+          which are more suited to userspace implementation (e.g.
+          shared storage logs) or experimental logs can be implemented
+          by leveraging this framework.
+
 config DM_ZERO
         tristate "Zero target"
         depends on BLK_DEV_DM
@@ -249,6 +260,25 @@ config DM_MULTIPATH
         ---help---
           Allow volume managers to support multipath hardware.
 
+config DM_MULTIPATH_QL
+        tristate "I/O Path Selector based on the number of in-flight I/Os"
+        depends on DM_MULTIPATH
+        ---help---
+          This path selector is a dynamic load balancer which selects
+          the path with the least number of in-flight I/Os.
+
+          If unsure, say N.
+
+config DM_MULTIPATH_ST
+        tristate "I/O Path Selector based on the service time"
+        depends on DM_MULTIPATH
+        ---help---
+          This path selector is a dynamic load balancer which selects
+          the path expected to complete the incoming I/O in the shortest
+          time.
+
+          If unsure, say N.
+
 config DM_DELAY
         tristate "I/O delaying target (EXPERIMENTAL)"
         depends on BLK_DEV_DM && EXPERIMENTAL
diff --git a/drivers/md/Makefile b/drivers/md/Makefile
index 45cc5951d928..1dc4185bd781 100644
--- a/drivers/md/Makefile
+++ b/drivers/md/Makefile
@@ -8,6 +8,8 @@ dm-multipath-y	+= dm-path-selector.o dm-mpath.o
 dm-snapshot-y   += dm-snap.o dm-exception-store.o dm-snap-transient.o \
                     dm-snap-persistent.o
 dm-mirror-y     += dm-raid1.o
+dm-log-userspace-y \
+                += dm-log-userspace-base.o dm-log-userspace-transfer.o
 md-mod-y        += md.o bitmap.o
 raid456-y       += raid5.o
 raid6_pq-y      += raid6algos.o raid6recov.o raid6tables.o \
@@ -36,8 +38,11 @@ obj-$(CONFIG_BLK_DEV_DM)	+= dm-mod.o
 obj-$(CONFIG_DM_CRYPT)          += dm-crypt.o
 obj-$(CONFIG_DM_DELAY)          += dm-delay.o
 obj-$(CONFIG_DM_MULTIPATH)      += dm-multipath.o dm-round-robin.o
+obj-$(CONFIG_DM_MULTIPATH_QL)   += dm-queue-length.o
+obj-$(CONFIG_DM_MULTIPATH_ST)   += dm-service-time.o
 obj-$(CONFIG_DM_SNAPSHOT)       += dm-snapshot.o
 obj-$(CONFIG_DM_MIRROR)         += dm-mirror.o dm-log.o dm-region-hash.o
+obj-$(CONFIG_DM_LOG_USERSPACE)  += dm-log-userspace.o
 obj-$(CONFIG_DM_ZERO)           += dm-zero.o
 
 quiet_cmd_unroll = UNROLL  $@
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 53394e863c74..9933eb861c71 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1132,6 +1132,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad_crypt_queue;
         }
 
+        ti->num_flush_requests = 1;
         ti->private = cc;
         return 0;
 
@@ -1189,6 +1190,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio,
                      union map_info *map_context)
 {
         struct dm_crypt_io *io;
+        struct crypt_config *cc;
+
+        if (unlikely(bio_empty_barrier(bio))) {
+                cc = ti->private;
+                bio->bi_bdev = cc->dev->bdev;
+                return DM_MAPIO_REMAPPED;
+        }
 
         io = crypt_io_alloc(ti, bio, bio->bi_sector - ti->begin);
 
@@ -1305,9 +1313,17 @@ static int crypt_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
         return min(max_size, q->merge_bvec_fn(q, bvm, biovec));
 }
 
+static int crypt_iterate_devices(struct dm_target *ti,
+                                 iterate_devices_callout_fn fn, void *data)
+{
+        struct crypt_config *cc = ti->private;
+
+        return fn(ti, cc->dev, cc->start, data);
+}
+
 static struct target_type crypt_target = {
         .name   = "crypt",
-        .version= {1, 6, 0},
+        .version = {1, 7, 0},
         .module = THIS_MODULE,
         .ctr    = crypt_ctr,
         .dtr    = crypt_dtr,
@@ -1318,6 +1334,7 @@ static struct target_type crypt_target = {
         .resume = crypt_resume,
         .message = crypt_message,
         .merge  = crypt_merge,
+        .iterate_devices = crypt_iterate_devices,
 };
 
 static int __init dm_crypt_init(void)
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 559dbb52bc85..4e5b843cd4d7 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -197,6 +197,7 @@ out:
         mutex_init(&dc->timer_lock);
         atomic_set(&dc->may_delay, 1);
 
+        ti->num_flush_requests = 1;
         ti->private = dc;
         return 0;
 
@@ -278,8 +279,9 @@ static int delay_map(struct dm_target *ti, struct bio *bio,
 
         if ((bio_data_dir(bio) == WRITE) && (dc->dev_write)) {
                 bio->bi_bdev = dc->dev_write->bdev;
-                bio->bi_sector = dc->start_write +
-                                 (bio->bi_sector - ti->begin);
+                if (bio_sectors(bio))
+                        bio->bi_sector = dc->start_write +
+                                         (bio->bi_sector - ti->begin);
 
                 return delay_bio(dc, dc->write_delay, bio);
         }
@@ -316,9 +318,26 @@ static int delay_status(struct dm_target *ti, status_type_t type,
         return 0;
 }
 
+static int delay_iterate_devices(struct dm_target *ti,
+                                 iterate_devices_callout_fn fn, void *data)
+{
+        struct delay_c *dc = ti->private;
+        int ret = 0;
+
+        ret = fn(ti, dc->dev_read, dc->start_read, data);
+        if (ret)
+                goto out;
+
+        if (dc->dev_write)
+                ret = fn(ti, dc->dev_write, dc->start_write, data);
+
+out:
+        return ret;
+}
+
 static struct target_type delay_target = {
         .name        = "delay",
-        .version     = {1, 0, 2},
+        .version     = {1, 1, 0},
         .module      = THIS_MODULE,
         .ctr         = delay_ctr,
         .dtr         = delay_dtr,
@@ -326,6 +345,7 @@ static struct target_type delay_target = {
         .presuspend  = delay_presuspend,
         .resume      = delay_resume,
         .status      = delay_status,
+        .iterate_devices = delay_iterate_devices,
 };
 
 static int __init dm_delay_init(void)
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 75d8081a9041..c3ae51584b12 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -216,7 +216,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                 return -EINVAL;
         }
 
-        type = get_type(argv[1]);
+        type = get_type(&persistent);
         if (!type) {
                 ti->error = "Exception store type not recognised";
                 r = -EINVAL;
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index c92701dc5001..2442c8c07898 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -156,7 +156,7 @@ static inline void dm_consecutive_chunk_count_inc(struct dm_snap_exception *e)
  */
 static inline sector_t get_dev_size(struct block_device *bdev)
 {
-        return bdev->bd_inode->i_size >> SECTOR_SHIFT;
+        return i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
 }
 
 static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index e73aabd61cd7..3a2e6a2f8bdd 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -22,6 +22,7 @@ struct dm_io_client {
 /* FIXME: can we shrink this ? */
 struct io {
         unsigned long error_bits;
+        unsigned long eopnotsupp_bits;
         atomic_t count;
         struct task_struct *sleeper;
         struct dm_io_client *client;
@@ -107,8 +108,11 @@ static inline unsigned bio_get_region(struct bio *bio)
  *---------------------------------------------------------------*/
 static void dec_count(struct io *io, unsigned int region, int error)
 {
-        if (error)
+        if (error) {
                 set_bit(region, &io->error_bits);
+                if (error == -EOPNOTSUPP)
+                        set_bit(region, &io->eopnotsupp_bits);
+        }
 
         if (atomic_dec_and_test(&io->count)) {
                 if (io->sleeper)
@@ -360,7 +364,9 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
                 return -EIO;
         }
 
+retry:
         io.error_bits = 0;
+        io.eopnotsupp_bits = 0;
         atomic_set(&io.count, 1); /* see dispatch_io() */
         io.sleeper = current;
         io.client = client;
@@ -377,6 +383,11 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
         }
         set_current_state(TASK_RUNNING);
 
+        if (io.eopnotsupp_bits && (rw & (1 << BIO_RW_BARRIER))) {
+                rw &= ~(1 << BIO_RW_BARRIER);
+                goto retry;
+        }
+
         if (error_bits)
                 *error_bits = io.error_bits;
 
@@ -397,6 +408,7 @@ static int async_io(struct dm_io_client *client, unsigned int num_regions,
 
         io = mempool_alloc(client->pool, GFP_NOIO);
         io->error_bits = 0;
+        io->eopnotsupp_bits = 0;
         atomic_set(&io->count, 1); /* see dispatch_io() */
         io->sleeper = NULL;
         io->client = client;
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 1128d3fba797..7f77f18fcafa 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -276,7 +276,7 @@ retry:
         up_write(&_hash_lock);
 }
 
-static int dm_hash_rename(const char *old, const char *new)
+static int dm_hash_rename(uint32_t cookie, const char *old, const char *new)
 {
         char *new_name, *old_name;
         struct hash_cell *hc;
@@ -333,7 +333,7 @@ static int dm_hash_rename(const char *old, const char *new)
                 dm_table_put(table);
         }
 
-        dm_kobject_uevent(hc->md);
+        dm_kobject_uevent(hc->md, KOBJ_CHANGE, cookie);
 
         dm_put(hc->md);
         up_write(&_hash_lock);
@@ -680,6 +680,9 @@ static int dev_remove(struct dm_ioctl *param, size_t param_size)
 
         __hash_remove(hc);
         up_write(&_hash_lock);
+
+        dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr);
+
         dm_put(md);
         param->data_size = 0;
         return 0;
@@ -715,7 +718,7 @@ static int dev_rename(struct dm_ioctl *param, size_t param_size)
                 return r;
 
         param->data_size = 0;
-        return dm_hash_rename(param->name, new_name);
+        return dm_hash_rename(param->event_nr, param->name, new_name);
 }
 
 static int dev_set_geometry(struct dm_ioctl *param, size_t param_size)
@@ -842,8 +845,11 @@ static int do_resume(struct dm_ioctl *param)
         if (dm_suspended(md))
                 r = dm_resume(md);
 
-        if (!r)
+
+        if (!r) {
+                dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr);
                 r = __dev_status(md, param);
+        }
 
         dm_put(md);
         return r;
@@ -1044,6 +1050,12 @@ static int populate_table(struct dm_table *table,
                 next = spec->next;
         }
 
+        r = dm_table_set_type(table);
+        if (r) {
+                DMWARN("unable to set table type");
+                return r;
+        }
+
         return dm_table_complete(table);
 }
 
@@ -1089,6 +1101,13 @@ static int table_load(struct dm_ioctl *param, size_t param_size)
                 goto out;
         }
 
+        r = dm_table_alloc_md_mempools(t);
+        if (r) {
+                DMWARN("unable to allocate mempools for this table");
+                dm_table_destroy(t);
+                goto out;
+        }
+
         down_write(&_hash_lock);
         hc = dm_get_mdptr(md);
         if (!hc || hc->md != md) {
diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
index 79fb53e51c70..9184b6deb868 100644
--- a/drivers/md/dm-linear.c
+++ b/drivers/md/dm-linear.c
@@ -53,6 +53,7 @@ static int linear_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad;
         }
 
+        ti->num_flush_requests = 1;
         ti->private = lc;
         return 0;
 
@@ -81,7 +82,8 @@ static void linear_map_bio(struct dm_target *ti, struct bio *bio)
         struct linear_c *lc = ti->private;
 
         bio->bi_bdev = lc->dev->bdev;
-        bio->bi_sector = linear_map_sector(ti, bio->bi_sector);
+        if (bio_sectors(bio))
+                bio->bi_sector = linear_map_sector(ti, bio->bi_sector);
 }
 
 static int linear_map(struct dm_target *ti, struct bio *bio,
@@ -132,9 +134,17 @@ static int linear_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
         return min(max_size, q->merge_bvec_fn(q, bvm, biovec));
 }
 
+static int linear_iterate_devices(struct dm_target *ti,
+                                  iterate_devices_callout_fn fn, void *data)
+{
+        struct linear_c *lc = ti->private;
+
+        return fn(ti, lc->dev, lc->start, data);
+}
+
 static struct target_type linear_target = {
         .name   = "linear",
-        .version= {1, 0, 3},
+        .version = {1, 1, 0},
         .module = THIS_MODULE,
         .ctr    = linear_ctr,
         .dtr    = linear_dtr,
@@ -142,6 +152,7 @@ static struct target_type linear_target = {
         .status = linear_status,
         .ioctl  = linear_ioctl,
         .merge  = linear_merge,
+        .iterate_devices = linear_iterate_devices,
 };
 
 int __init dm_linear_init(void)
diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
new file mode 100644
index 000000000000..e69b96560997
--- /dev/null
+++ b/drivers/md/dm-log-userspace-base.c
@@ -0,0 +1,696 @@
+/*
+ * Copyright (C) 2006-2009 Red Hat, Inc.
+ *
+ * This file is released under the LGPL.
+ */
+
+#include <linux/bio.h>
+#include <linux/dm-dirty-log.h>
+#include <linux/device-mapper.h>
+#include <linux/dm-log-userspace.h>
+
+#include "dm-log-userspace-transfer.h"
+
+struct flush_entry {
+        int type;
+        region_t region;
+        struct list_head list;
+};
+
+struct log_c {
+        struct dm_target *ti;
+        uint32_t region_size;
+        region_t region_count;
+        char uuid[DM_UUID_LEN];
+
+        char *usr_argv_str;
+        uint32_t usr_argc;
+
+        /*
+         * in_sync_hint gets set when doing is_remote_recovering.  It
+         * represents the first region that needs recovery.  IOW, the
+         * first zero bit of sync_bits.  This can be useful for to limit
+         * traffic for calls like is_remote_recovering and get_resync_work,
+         * but be take care in its use for anything else.
+         */
+        uint64_t in_sync_hint;
+
+        spinlock_t flush_lock;
+        struct list_head flush_list;  /* only for clear and mark requests */
+};
+
+static mempool_t *flush_entry_pool;
+
+static void *flush_entry_alloc(gfp_t gfp_mask, void *pool_data)
+{
+        return kmalloc(sizeof(struct flush_entry), gfp_mask);
+}
+
+static void flush_entry_free(void *element, void *pool_data)
+{
+        kfree(element);
+}
+
+static int userspace_do_request(struct log_c *lc, const char *uuid,
+                                int request_type, char *data, size_t data_size,
+                                char *rdata, size_t *rdata_size)
+{
+        int r;
+
+        /*
+         * If the server isn't there, -ESRCH is returned,
+         * and we must keep trying until the server is
+         * restored.
+         */
+retry:
+        r = dm_consult_userspace(uuid, request_type, data,
+                                 data_size, rdata, rdata_size);
+
+        if (r != -ESRCH)
+                return r;
+
+        DMERR(" Userspace log server not found.");
+        while (1) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout(2*HZ);
+                DMWARN("Attempting to contact userspace log server...");
+                r = dm_consult_userspace(uuid, DM_ULOG_CTR, lc->usr_argv_str,
+                                         strlen(lc->usr_argv_str) + 1,
+                                         NULL, NULL);
+                if (!r)
+                        break;
+        }
+        DMINFO("Reconnected to userspace log server... DM_ULOG_CTR complete");
+        r = dm_consult_userspace(uuid, DM_ULOG_RESUME, NULL,
+                                 0, NULL, NULL);
+        if (!r)
+                goto retry;
+
+        DMERR("Error trying to resume userspace log: %d", r);
+
+        return -ESRCH;
+}
+
+static int build_constructor_string(struct dm_target *ti,
+                                    unsigned argc, char **argv,
+                                    char **ctr_str)
+{
+        int i, str_size;
+        char *str = NULL;
+
+        *ctr_str = NULL;
+
+        for (i = 0, str_size = 0; i < argc; i++)
+                str_size += strlen(argv[i]) + 1; /* +1 for space between args */
+
+        str_size += 20; /* Max number of chars in a printed u64 number */
+
+        str = kzalloc(str_size, GFP_KERNEL);
+        if (!str) {
+                DMWARN("Unable to allocate memory for constructor string");
+                return -ENOMEM;
+        }
+
+        for (i = 0, str_size = 0; i < argc; i++)
+                str_size += sprintf(str + str_size, "%s ", argv[i]);
+        str_size += sprintf(str + str_size, "%llu",
+                            (unsigned long long)ti->len);
+
+        *ctr_str = str;
+        return str_size;
+}
+
+/*
+ * userspace_ctr
+ *
+ * argv contains:
+ *      <UUID> <other args>
+ * Where 'other args' is the userspace implementation specific log
+ * arguments.  An example might be:
+ *      <UUID> clustered_disk <arg count> <log dev> <region_size> [[no]sync]
+ *
+ * So, this module will strip off the <UUID> for identification purposes
+ * when communicating with userspace about a log; but will pass on everything
+ * else.
+ */
+static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
+                         unsigned argc, char **argv)
+{
+        int r = 0;
+        int str_size;
+        char *ctr_str = NULL;
+        struct log_c *lc = NULL;
+        uint64_t rdata;
+        size_t rdata_size = sizeof(rdata);
+
+        if (argc < 3) {
+                DMWARN("Too few arguments to userspace dirty log");
+                return -EINVAL;
+        }
+
+        lc = kmalloc(sizeof(*lc), GFP_KERNEL);
+        if (!lc) {
+                DMWARN("Unable to allocate userspace log context.");
+                return -ENOMEM;
+        }
+
+        lc->ti = ti;
+
+        if (strlen(argv[0]) > (DM_UUID_LEN - 1)) {
+                DMWARN("UUID argument too long.");
+                kfree(lc);
+                return -EINVAL;
+        }
+
+        strncpy(lc->uuid, argv[0], DM_UUID_LEN);
+        spin_lock_init(&lc->flush_lock);
+        INIT_LIST_HEAD(&lc->flush_list);
+
+        str_size = build_constructor_string(ti, argc - 1, argv + 1, &ctr_str);
+        if (str_size < 0) {
+                kfree(lc);
+                return str_size;
+        }
+
+        /* Send table string */
+        r = dm_consult_userspace(lc->uuid, DM_ULOG_CTR,
+                                 ctr_str, str_size, NULL, NULL);
+
+        if (r == -ESRCH) {
+                DMERR("Userspace log server not found");
+                goto out;
+        }
+
+        /* Since the region size does not change, get it now */
+        rdata_size = sizeof(rdata);
+        r = dm_consult_userspace(lc->uuid, DM_ULOG_GET_REGION_SIZE,
+                                 NULL, 0, (char *)&rdata, &rdata_size);
+
+        if (r) {
+                DMERR("Failed to get region size of dirty log");
+                goto out;
+        }
+
+        lc->region_size = (uint32_t)rdata;
+        lc->region_count = dm_sector_div_up(ti->len, lc->region_size);
+
+out:
+        if (r) {
+                kfree(lc);
+                kfree(ctr_str);
+        } else {
+                lc->usr_argv_str = ctr_str;
+                lc->usr_argc = argc;
+                log->context = lc;
+        }
+
+        return r;
+}
+
+static void userspace_dtr(struct dm_dirty_log *log)
+{
+        int r;
+        struct log_c *lc = log->context;
+
+        r = dm_consult_userspace(lc->uuid, DM_ULOG_DTR,
+                                 NULL, 0,
+                                 NULL, NULL);
+
+        kfree(lc->usr_argv_str);
+        kfree(lc);
+
+        return;
+}
+
+static int userspace_presuspend(struct dm_dirty_log *log)
+{
+        int r;
+        struct log_c *lc = log->context;
+
+        r = dm_consult_userspace(lc->uuid, DM_ULOG_PRESUSPEND,
+                                 NULL, 0,
+                                 NULL, NULL);
+
+        return r;
+}
+
+static int userspace_postsuspend(struct dm_dirty_log *log)
+{
+        int r;
+        struct log_c *lc = log->context;
+
+        r = dm_consult_userspace(lc->uuid, DM_ULOG_POSTSUSPEND,
+                                 NULL, 0,
+                                 NULL, NULL);
+
+        return r;
+}
+
+static int userspace_resume(struct dm_dirty_log *log)
+{
+        int r;
+        struct log_c *lc = log->context;
+
+        lc->in_sync_hint = 0;
+        r = dm_consult_userspace(lc->uuid, DM_ULOG_RESUME,
+                                 NULL, 0,
+                                 NULL, NULL);
+
+        return r;
+}
+
+static uint32_t userspace_get_region_size(struct dm_dirty_log *log)
+{
+        struct log_c *lc = log->context;
+
+        return lc->region_size;
+}
+
+/*
+ * userspace_is_clean
+ *
+ * Check whether a region is clean.  If there is any sort of
+ * failure when consulting the server, we return not clean.
+ *
+ * Returns: 1 if clean, 0 otherwise
+ */
+static int userspace_is_clean(struct dm_dirty_log *log, region_t region)
+{
+        int r;
+        uint64_t region64 = (uint64_t)region;
+        int64_t is_clean;
+        size_t rdata_size;
+        struct log_c *lc = log->context;
+
+        rdata_size = sizeof(is_clean);
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_IS_CLEAN,
+                                 (char *)&region64, sizeof(region64),
+                                 (char *)&is_clean, &rdata_size);
+
+        return (r) ? 0 : (int)is_clean;
+}
+
+/*
+ * userspace_in_sync
+ *
+ * Check if the region is in-sync.  If there is any sort
+ * of failure when consulting the server, we assume that
+ * the region is not in sync.
+ *
+ * If 'can_block' is set, return immediately
+ *
+ * Returns: 1 if in-sync, 0 if not-in-sync, -EWOULDBLOCK
+ */
+static int userspace_in_sync(struct dm_dirty_log *log, region_t region,
+                             int can_block)
+{
+        int r;
+        uint64_t region64 = region;
+        int64_t in_sync;
+        size_t rdata_size;
+        struct log_c *lc = log->context;
+
+        /*
+         * We can never respond directly - even if in_sync_hint is
+         * set.  This is because another machine could see a device
+         * failure and mark the region out-of-sync.  If we don't go
+         * to userspace to ask, we might think the region is in-sync
+         * and allow a read to pick up data that is stale.  (This is
+         * very unlikely if a device actually fails; but it is very
+         * likely if a connection to one device from one machine fails.)
+         *
+         * There still might be a problem if the mirror caches the region
+         * state as in-sync... but then this call would not be made.  So,
+         * that is a mirror problem.
+         */
+        if (!can_block)
+                return -EWOULDBLOCK;
+
+        rdata_size = sizeof(in_sync);
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_IN_SYNC,
+                                 (char *)&region64, sizeof(region64),
+                                 (char *)&in_sync, &rdata_size);
+        return (r) ? 0 : (int)in_sync;
+}
+
+/*
+ * userspace_flush
+ *
+ * This function is ok to block.
+ * The flush happens in two stages.  First, it sends all
+ * clear/mark requests that are on the list.  Then it
+ * tells the server to commit them.  This gives the
+ * server a chance to optimise the commit, instead of
+ * doing it for every request.
+ *
+ * Additionally, we could implement another thread that
+ * sends the requests up to the server - reducing the
+ * load on flush.  Then the flush would have less in
+ * the list and be responsible for the finishing commit.
+ *
+ * Returns: 0 on success, < 0 on failure
+ */
+static int userspace_flush(struct dm_dirty_log *log)
+{
+        int r = 0;
+        unsigned long flags;
+        struct log_c *lc = log->context;
+        LIST_HEAD(flush_list);
+        struct flush_entry *fe, *tmp_fe;
+
+        spin_lock_irqsave(&lc->flush_lock, flags);
+        list_splice_init(&lc->flush_list, &flush_list);
+        spin_unlock_irqrestore(&lc->flush_lock, flags);
+
+        if (list_empty(&flush_list))
+                return 0;
+
+        /*
+         * FIXME: Count up requests, group request types,
+         * allocate memory to stick all requests in and
+         * send to server in one go.  Failing the allocation,
+         * do it one by one.
+         */
+
+        list_for_each_entry(fe, &flush_list, list) {
+                r = userspace_do_request(lc, lc->uuid, fe->type,
+                                         (char *)&fe->region,
+                                         sizeof(fe->region),
+                                         NULL, NULL);
+                if (r)
+                        goto fail;
+        }
+
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_FLUSH,
+                                 NULL, 0, NULL, NULL);
+
+fail:
+        /*
+         * We can safely remove these entries, even if failure.
+         * Calling code will receive an error and will know that
+         * the log facility has failed.
+         */
+        list_for_each_entry_safe(fe, tmp_fe, &flush_list, list) {
+                list_del(&fe->list);
+                mempool_free(fe, flush_entry_pool);
+        }
+
+        if (r)
+                dm_table_event(lc->ti->table);
+
+        return r;
+}
+
+/*
+ * userspace_mark_region
+ *
+ * This function should avoid blocking unless absolutely required.
+ * (Memory allocation is valid for blocking.)
+ */
+static void userspace_mark_region(struct dm_dirty_log *log, region_t region)
+{
+        unsigned long flags;
+        struct log_c *lc = log->context;
+        struct flush_entry *fe;
+
+        /* Wait for an allocation, but _never_ fail */
+        fe = mempool_alloc(flush_entry_pool, GFP_NOIO);
+        BUG_ON(!fe);
+
+        spin_lock_irqsave(&lc->flush_lock, flags);
+        fe->type = DM_ULOG_MARK_REGION;
+        fe->region = region;
+        list_add(&fe->list, &lc->flush_list);
+        spin_unlock_irqrestore(&lc->flush_lock, flags);
+
+        return;
+}
+
+/*
+ * userspace_clear_region
+ *
+ * This function must not block.
+ * So, the alloc can't block.  In the worst case, it is ok to
+ * fail.  It would simply mean we can't clear the region.
+ * Does nothing to current sync context, but does mean
+ * the region will be re-sync'ed on a reload of the mirror
+ * even though it is in-sync.
+ */
+static void userspace_clear_region(struct dm_dirty_log *log, region_t region)
+{
+        unsigned long flags;
+        struct log_c *lc = log->context;
+        struct flush_entry *fe;
+
+        /*
+         * If we fail to allocate, we skip the clearing of
+         * the region.  This doesn't hurt us in any way, except
+         * to cause the region to be resync'ed when the
+         * device is activated next time.
+         */
+        fe = mempool_alloc(flush_entry_pool, GFP_ATOMIC);
+        if (!fe) {
+                DMERR("Failed to allocate memory to clear region.");
+                return;
+        }
+
+        spin_lock_irqsave(&lc->flush_lock, flags);
+        fe->type = DM_ULOG_CLEAR_REGION;
+        fe->region = region;
+        list_add(&fe->list, &lc->flush_list);
+        spin_unlock_irqrestore(&lc->flush_lock, flags);
+
+        return;
+}
+
+/*
+ * userspace_get_resync_work
+ *
+ * Get a region that needs recovery.  It is valid to return
+ * an error for this function.
+ *
+ * Returns: 1 if region filled, 0 if no work, <0 on error
+ */
+static int userspace_get_resync_work(struct dm_dirty_log *log, region_t *region)
+{
+        int r;
+        size_t rdata_size;
+        struct log_c *lc = log->context;
+        struct {
+                int64_t i; /* 64-bit for mix arch compatibility */
+                region_t r;
+        } pkg;
+
+        if (lc->in_sync_hint >= lc->region_count)
+                return 0;
+
+        rdata_size = sizeof(pkg);
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_GET_RESYNC_WORK,
+                                 NULL, 0,
+                                 (char *)&pkg, &rdata_size);
+
+        *region = pkg.r;
+        return (r) ? r : (int)pkg.i;
+}
+
+/*
+ * userspace_set_region_sync
+ *
+ * Set the sync status of a given region.  This function
+ * must not fail.
+ */
+static void userspace_set_region_sync(struct dm_dirty_log *log,
+                                      region_t region, int in_sync)
+{
+        int r;
+        struct log_c *lc = log->context;
+        struct {
+                region_t r;
+                int64_t i;
+        } pkg;
+
+        pkg.r = region;
+        pkg.i = (int64_t)in_sync;
+
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_SET_REGION_SYNC,
+                                 (char *)&pkg, sizeof(pkg),
+                                 NULL, NULL);
+
+        /*
+         * It would be nice to be able to report failures.
+         * However, it is easy emough to detect and resolve.
+         */
+        return;
+}
+
+/*
+ * userspace_get_sync_count
+ *
+ * If there is any sort of failure when consulting the server,
+ * we assume that the sync count is zero.
+ *
+ * Returns: sync count on success, 0 on failure
+ */
+static region_t userspace_get_sync_count(struct dm_dirty_log *log)
+{
+        int r;
+        size_t rdata_size;
+        uint64_t sync_count;
+        struct log_c *lc = log->context;
+
+        rdata_size = sizeof(sync_count);
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_GET_SYNC_COUNT,
+                                 NULL, 0,
+                                 (char *)&sync_count, &rdata_size);
+
+        if (r)
+                return 0;
+
+        if (sync_count >= lc->region_count)
+                lc->in_sync_hint = lc->region_count;
+
+        return (region_t)sync_count;
+}
+
+/*
+ * userspace_status
+ *
+ * Returns: amount of space consumed
+ */
+static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
+                            char *result, unsigned maxlen)
+{
+        int r = 0;
+        size_t sz = (size_t)maxlen;
+        struct log_c *lc = log->context;
+
+        switch (status_type) {
+        case STATUSTYPE_INFO:
+                r = userspace_do_request(lc, lc->uuid, DM_ULOG_STATUS_INFO,
+                                         NULL, 0,
+                                         result, &sz);
+
+                if (r) {
+                        sz = 0;
+                        DMEMIT("%s 1 COM_FAILURE", log->type->name);
+                }
+                break;
+        case STATUSTYPE_TABLE:
+                sz = 0;
+                DMEMIT("%s %u %s %s", log->type->name, lc->usr_argc + 1,
+                       lc->uuid, lc->usr_argv_str);
+                break;
+        }
+        return (r) ? 0 : (int)sz;
+}
+
+/*
+ * userspace_is_remote_recovering
+ *
+ * Returns: 1 if region recovering, 0 otherwise
+ */
+static int userspace_is_remote_recovering(struct dm_dirty_log *log,
+                                          region_t region)
+{
+        int r;
+        uint64_t region64 = region;
+        struct log_c *lc = log->context;
+        static unsigned long long limit;
+        struct {
+                int64_t is_recovering;
+                uint64_t in_sync_hint;
+        } pkg;
+        size_t rdata_size = sizeof(pkg);
+
+        /*
+         * Once the mirror has been reported to be in-sync,
+         * it will never again ask for recovery work.  So,
+         * we can safely say there is not a remote machine
+         * recovering if the device is in-sync.  (in_sync_hint
+         * must be reset at resume time.)
+         */
+        if (region < lc->in_sync_hint)
+                return 0;
+        else if (jiffies < limit)
+                return 1;
+
+        limit = jiffies + (HZ / 4);
+        r = userspace_do_request(lc, lc->uuid, DM_ULOG_IS_REMOTE_RECOVERING,
+                                 (char *)&region64, sizeof(region64),
+                                 (char *)&pkg, &rdata_size);
+        if (r)
+                return 1;
+
+        lc->in_sync_hint = pkg.in_sync_hint;
+
+        return (int)pkg.is_recovering;
+}
+
+static struct dm_dirty_log_type _userspace_type = {
+        .name = "userspace",
+        .module = THIS_MODULE,
+        .ctr = userspace_ctr,
+        .dtr = userspace_dtr,
+        .presuspend = userspace_presuspend,
+        .postsuspend = userspace_postsuspend,
+        .resume = userspace_resume,
+        .get_region_size = userspace_get_region_size,
+        .is_clean = userspace_is_clean,
+        .in_sync = userspace_in_sync,
+        .flush = userspace_flush,
+        .mark_region = userspace_mark_region,
+        .clear_region = userspace_clear_region,
+        .get_resync_work = userspace_get_resync_work,
+        .set_region_sync = userspace_set_region_sync,
+        .get_sync_count = userspace_get_sync_count,
+        .status = userspace_status,
+        .is_remote_recovering = userspace_is_remote_recovering,
+};
+
+static int __init userspace_dirty_log_init(void)
+{
+        int r = 0;
+
+        flush_entry_pool = mempool_create(100, flush_entry_alloc,
+                                          flush_entry_free, NULL);
+
+        if (!flush_entry_pool) {
+                DMWARN("Unable to create flush_entry_pool:  No memory.");
+                return -ENOMEM;
+        }
+
+        r = dm_ulog_tfr_init();
+        if (r) {
+                DMWARN("Unable to initialize userspace log communications");
+                mempool_destroy(flush_entry_pool);
+                return r;
+        }
+
+        r = dm_dirty_log_type_register(&_userspace_type);
+        if (r) {
+                DMWARN("Couldn't register userspace dirty log type");
+                dm_ulog_tfr_exit();
+                mempool_destroy(flush_entry_pool);
+                return r;
+        }
+
+        DMINFO("version 1.0.0 loaded");
+        return 0;
+}
+
+static void __exit userspace_dirty_log_exit(void)
+{
+        dm_dirty_log_type_unregister(&_userspace_type);
+        dm_ulog_tfr_exit();
+        mempool_destroy(flush_entry_pool);
+
+        DMINFO("version 1.0.0 unloaded");
+        return;
+}
+
+module_init(userspace_dirty_log_init);
+module_exit(userspace_dirty_log_exit);
+
+MODULE_DESCRIPTION(DM_NAME " userspace dirty log link");
+MODULE_AUTHOR("Jonathan Brassow <dm-devel@redhat.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
new file mode 100644
index 000000000000..0ca1ee768a1f
--- /dev/null
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) 2006-2009 Red Hat, Inc.
+ *
+ * This file is released under the LGPL.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <net/sock.h>
+#include <linux/workqueue.h>
+#include <linux/connector.h>
+#include <linux/device-mapper.h>
+#include <linux/dm-log-userspace.h>
+
+#include "dm-log-userspace-transfer.h"
+
+static uint32_t dm_ulog_seq;
+
+/*
+ * Netlink/Connector is an unreliable protocol.  How long should
+ * we wait for a response before assuming it was lost and retrying?
+ * (If we do receive a response after this time, it will be discarded
+ * and the response to the resent request will be waited for.
+ */
+#define DM_ULOG_RETRY_TIMEOUT (15 * HZ)
+
+/*
+ * Pre-allocated space for speed
+ */
+#define DM_ULOG_PREALLOCED_SIZE 512
+static struct cn_msg *prealloced_cn_msg;
+static struct dm_ulog_request *prealloced_ulog_tfr;
+
+static struct cb_id ulog_cn_id = {
+        .idx = CN_IDX_DM,
+        .val = CN_VAL_DM_USERSPACE_LOG
+};
+
+static DEFINE_MUTEX(dm_ulog_lock);
+
+struct receiving_pkg {
+        struct list_head list;
+        struct completion complete;
+
+        uint32_t seq;
+
+        int error;
+        size_t *data_size;
+        char *data;
+};
+
+static DEFINE_SPINLOCK(receiving_list_lock);
+static struct list_head receiving_list;
+
+static int dm_ulog_sendto_server(struct dm_ulog_request *tfr)
+{
+        int r;
+        struct cn_msg *msg = prealloced_cn_msg;
+
+        memset(msg, 0, sizeof(struct cn_msg));
+
+        msg->id.idx = ulog_cn_id.idx;
+        msg->id.val = ulog_cn_id.val;
+        msg->ack = 0;
+        msg->seq = tfr->seq;
+        msg->len = sizeof(struct dm_ulog_request) + tfr->data_size;
+
+        r = cn_netlink_send(msg, 0, gfp_any());
+
+        return r;
+}
+
+/*
+ * Parameters for this function can be either msg or tfr, but not
+ * both.  This function fills in the reply for a waiting request.
+ * If just msg is given, then the reply is simply an ACK from userspace
+ * that the request was received.
+ *
+ * Returns: 0 on success, -ENOENT on failure
+ */
+static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
+{
+        uint32_t rtn_seq = (msg) ? msg->seq : (tfr) ? tfr->seq : 0;
+        struct receiving_pkg *pkg;
+
+        /*
+         * The 'receiving_pkg' entries in this list are statically
+         * allocated on the stack in 'dm_consult_userspace'.
+         * Each process that is waiting for a reply from the user
+         * space server will have an entry in this list.
+         *
+         * We are safe to do it this way because the stack space
+         * is unique to each process, but still addressable by
+         * other processes.
+         */
+        list_for_each_entry(pkg, &receiving_list, list) {
+                if (rtn_seq != pkg->seq)
+                        continue;
+
+                if (msg) {
+                        pkg->error = -msg->ack;
+                        /*
+                         * If we are trying again, we will need to know our
+                         * storage capacity.  Otherwise, along with the
+                         * error code, we make explicit that we have no data.
+                         */
+                        if (pkg->error != -EAGAIN)
+                                *(pkg->data_size) = 0;
+                } else if (tfr->data_size > *(pkg->data_size)) {
+                        DMERR("Insufficient space to receive package [%u] "
+                              "(%u vs %lu)", tfr->request_type,
+                              tfr->data_size, *(pkg->data_size));
+
+                        *(pkg->data_size) = 0;
+                        pkg->error = -ENOSPC;
+                } else {
+                        pkg->error = tfr->error;
+                        memcpy(pkg->data, tfr->data, tfr->data_size);
+                        *(pkg->data_size) = tfr->data_size;
+                }
+                complete(&pkg->complete);
+                return 0;
+        }
+
+        return -ENOENT;
+}
+
+/*
+ * This is the connector callback that delivers data
+ * that was sent from userspace.
+ */
+static void cn_ulog_callback(void *data)
+{
+        struct cn_msg *msg = (struct cn_msg *)data;
+        struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
+
+        spin_lock(&receiving_list_lock);
+        if (msg->len == 0)
+                fill_pkg(msg, NULL);
+        else if (msg->len < sizeof(*tfr))
+                DMERR("Incomplete message received (expected %u, got %u): [%u]",
+                      (unsigned)sizeof(*tfr), msg->len, msg->seq);
+        else
+                fill_pkg(NULL, tfr);
+        spin_unlock(&receiving_list_lock);
+}
+
+/**
+ * dm_consult_userspace
+ * @uuid: log's uuid (must be DM_UUID_LEN in size)
+ * @request_type:  found in include/linux/dm-log-userspace.h
+ * @data: data to tx to the server
+ * @data_size: size of data in bytes
+ * @rdata: place to put return data from server
+ * @rdata_size: value-result (amount of space given/amount of space used)
+ *
+ * rdata_size is undefined on failure.
+ *
+ * Memory used to communicate with userspace is zero'ed
+ * before populating to ensure that no unwanted bits leak
+ * from kernel space to user-space.  All userspace log communications
+ * between kernel and user space go through this function.
+ *
+ * Returns: 0 on success, -EXXX on failure
+ **/
+int dm_consult_userspace(const char *uuid, int request_type,
+                         char *data, size_t data_size,
+                         char *rdata, size_t *rdata_size)
+{
+        int r = 0;
+        size_t dummy = 0;
+        int overhead_size =
+                sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
+        struct dm_ulog_request *tfr = prealloced_ulog_tfr;
+        struct receiving_pkg pkg;
+
+        if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
+                DMINFO("Size of tfr exceeds preallocated size");
+                return -EINVAL;
+        }
+
+        if (!rdata_size)
+                rdata_size = &dummy;
+resend:
+        /*
+         * We serialize the sending of requests so we can
+         * use the preallocated space.
+         */
+        mutex_lock(&dm_ulog_lock);
+
+        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
+        memcpy(tfr->uuid, uuid, DM_UUID_LEN);
+        tfr->seq = dm_ulog_seq++;
+
+        /*
+         * Must be valid request type (all other bits set to
+         * zero).  This reserves other bits for possible future
+         * use.
+         */
+        tfr->request_type = request_type & DM_ULOG_REQUEST_MASK;
+
+        tfr->data_size = data_size;
+        if (data && data_size)
+                memcpy(tfr->data, data, data_size);
+
+        memset(&pkg, 0, sizeof(pkg));
+        init_completion(&pkg.complete);
+        pkg.seq = tfr->seq;
+        pkg.data_size = rdata_size;
+        pkg.data = rdata;
+        spin_lock(&receiving_list_lock);
+        list_add(&(pkg.list), &receiving_list);
+        spin_unlock(&receiving_list_lock);
+
+        r = dm_ulog_sendto_server(tfr);
+
+        mutex_unlock(&dm_ulog_lock);
+
+        if (r) {
+                DMERR("Unable to send log request [%u] to userspace: %d",
+                      request_type, r);
+                spin_lock(&receiving_list_lock);
+                list_del_init(&(pkg.list));
+                spin_unlock(&receiving_list_lock);
+
+                goto out;
+        }
+
+        r = wait_for_completion_timeout(&(pkg.complete), DM_ULOG_RETRY_TIMEOUT);
+        spin_lock(&receiving_list_lock);
+        list_del_init(&(pkg.list));
+        spin_unlock(&receiving_list_lock);
+        if (!r) {
+                DMWARN("[%s] Request timed out: [%u/%u] - retrying",
+                       (strlen(uuid) > 8) ?
+                       (uuid + (strlen(uuid) - 8)) : (uuid),
+                       request_type, pkg.seq);
+                goto resend;
+        }
+
+        r = pkg.error;
+        if (r == -EAGAIN)
+                goto resend;
+
+out:
+        return r;
+}
+
+int dm_ulog_tfr_init(void)
+{
+        int r;
+        void *prealloced;
+
+        INIT_LIST_HEAD(&receiving_list);
+
+        prealloced = kmalloc(DM_ULOG_PREALLOCED_SIZE, GFP_KERNEL);
+        if (!prealloced)
+                return -ENOMEM;
+
+        prealloced_cn_msg = prealloced;
+        prealloced_ulog_tfr = prealloced + sizeof(struct cn_msg);
+
+        r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback);
+        if (r) {
+                cn_del_callback(&ulog_cn_id);
+                return r;
+        }
+
+        return 0;
+}
+
+void dm_ulog_tfr_exit(void)
+{
+        cn_del_callback(&ulog_cn_id);
+        kfree(prealloced_cn_msg);
+}
diff --git a/drivers/md/dm-log-userspace-transfer.h b/drivers/md/dm-log-userspace-transfer.h
new file mode 100644
index 000000000000..c26d8e4e2710
--- /dev/null
+++ b/drivers/md/dm-log-userspace-transfer.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) 2006-2009 Red Hat, Inc.
+ *
+ * This file is released under the LGPL.
+ */
+
+#ifndef __DM_LOG_USERSPACE_TRANSFER_H__
+#define __DM_LOG_USERSPACE_TRANSFER_H__
+
+#define DM_MSG_PREFIX "dm-log-userspace"
+
+int dm_ulog_tfr_init(void);
+void dm_ulog_tfr_exit(void);
+int dm_consult_userspace(const char *uuid, int request_type,
+                         char *data, size_t data_size,
+                         char *rdata, size_t *rdata_size);
+
+#endif /* __DM_LOG_USERSPACE_TRANSFER_H__ */
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 6fa8ccf91c70..9443896ede07 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -412,11 +412,12 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
                 /*
                  * Buffer holds both header and bitset.
                  */
-                buf_size = dm_round_up((LOG_OFFSET << SECTOR_SHIFT) +
-                                       bitset_size,
-                                       ti->limits.logical_block_size);
+                buf_size =
+                    dm_round_up((LOG_OFFSET << SECTOR_SHIFT) + bitset_size,
+                                bdev_logical_block_size(lc->header_location.
+                                                            bdev));
 
-                if (buf_size > dev->bdev->bd_inode->i_size) {
+                if (buf_size > i_size_read(dev->bdev->bd_inode)) {
                         DMWARN("log device %s too small: need %llu bytes",
                                 dev->name, (unsigned long long)buf_size);
                         kfree(lc);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 6a386ab4f7eb..c70604a20897 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -8,7 +8,6 @@
 #include <linux/device-mapper.h>
 
 #include "dm-path-selector.h"
-#include "dm-bio-record.h"
 #include "dm-uevent.h"
 
 #include <linux/ctype.h>
@@ -35,6 +34,7 @@ struct pgpath {
 
         struct dm_path path;
         struct work_struct deactivate_path;
+        struct work_struct activate_path;
 };
 
 #define path_to_pgpath(__pgp) container_of((__pgp), struct pgpath, path)
@@ -64,8 +64,6 @@ struct multipath {
         spinlock_t lock;
 
         const char *hw_handler_name;
-        struct work_struct activate_path;
-        struct pgpath *pgpath_to_activate;
         unsigned nr_priority_groups;
         struct list_head priority_groups;
         unsigned pg_init_required;      /* pg_init needs calling? */
@@ -84,7 +82,7 @@ struct multipath {
         unsigned pg_init_count;         /* Number of times pg_init called */
 
         struct work_struct process_queued_ios;
-        struct bio_list queued_ios;
+        struct list_head queued_ios;
         unsigned queue_size;
 
         struct work_struct trigger_event;
@@ -101,7 +99,7 @@ struct multipath {
  */
 struct dm_mpath_io {
         struct pgpath *pgpath;
-        struct dm_bio_details details;
+        size_t nr_bytes;
 };
 
 typedef int (*action_fn) (struct pgpath *pgpath);
@@ -128,6 +126,7 @@ static struct pgpath *alloc_pgpath(void)
         if (pgpath) {
                 pgpath->is_active = 1;
                 INIT_WORK(&pgpath->deactivate_path, deactivate_path);
+                INIT_WORK(&pgpath->activate_path, activate_path);
         }
 
         return pgpath;
@@ -160,7 +159,6 @@ static struct priority_group *alloc_priority_group(void)
 
 static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
 {
-        unsigned long flags;
         struct pgpath *pgpath, *tmp;
         struct multipath *m = ti->private;
 
@@ -169,10 +167,6 @@ static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
                 if (m->hw_handler_name)
                         scsi_dh_detach(bdev_get_queue(pgpath->path.dev->bdev));
                 dm_put_device(ti, pgpath->path.dev);
-                spin_lock_irqsave(&m->lock, flags);
-                if (m->pgpath_to_activate == pgpath)
-                        m->pgpath_to_activate = NULL;
-                spin_unlock_irqrestore(&m->lock, flags);
                 free_pgpath(pgpath);
         }
 }
@@ -198,11 +192,11 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
         m = kzalloc(sizeof(*m), GFP_KERNEL);
         if (m) {
                 INIT_LIST_HEAD(&m->priority_groups);
+                INIT_LIST_HEAD(&m->queued_ios);
                 spin_lock_init(&m->lock);
                 m->queue_io = 1;
                 INIT_WORK(&m->process_queued_ios, process_queued_ios);
                 INIT_WORK(&m->trigger_event, trigger_event);
-                INIT_WORK(&m->activate_path, activate_path);
                 m->mpio_pool = mempool_create_slab_pool(MIN_IOS, _mpio_cache);
                 if (!m->mpio_pool) {
                         kfree(m);
@@ -250,11 +244,12 @@ static void __switch_pg(struct multipath *m, struct pgpath *pgpath)
         m->pg_init_count = 0;
 }
 
-static int __choose_path_in_pg(struct multipath *m, struct priority_group *pg)
+static int __choose_path_in_pg(struct multipath *m, struct priority_group *pg,
+                               size_t nr_bytes)
 {
         struct dm_path *path;
 
-        path = pg->ps.type->select_path(&pg->ps, &m->repeat_count);
+        path = pg->ps.type->select_path(&pg->ps, &m->repeat_count, nr_bytes);
         if (!path)
                 return -ENXIO;
 
@@ -266,7 +261,7 @@ static int __choose_path_in_pg(struct multipath *m, struct priority_group *pg)
         return 0;
 }
 
-static void __choose_pgpath(struct multipath *m)
+static void __choose_pgpath(struct multipath *m, size_t nr_bytes)
 {
         struct priority_group *pg;
         unsigned bypassed = 1;
@@ -278,12 +273,12 @@ static void __choose_pgpath(struct multipath *m)
         if (m->next_pg) {
                 pg = m->next_pg;
                 m->next_pg = NULL;
-                if (!__choose_path_in_pg(m, pg))
+                if (!__choose_path_in_pg(m, pg, nr_bytes))
                         return;
         }
 
         /* Don't change PG until it has no remaining paths */
-        if (m->current_pg && !__choose_path_in_pg(m, m->current_pg))
+        if (m->current_pg && !__choose_path_in_pg(m, m->current_pg, nr_bytes))
                 return;
 
         /*
@@ -295,7 +290,7 @@ static void __choose_pgpath(struct multipath *m)
                 list_for_each_entry(pg, &m->priority_groups, list) {
                         if (pg->bypassed == bypassed)
                                 continue;
-                        if (!__choose_path_in_pg(m, pg))
+                        if (!__choose_path_in_pg(m, pg, nr_bytes))
                                 return;
                 }
         } while (bypassed--);
@@ -322,19 +317,21 @@ static int __must_push_back(struct multipath *m)
                 dm_noflush_suspending(m->ti));
 }
 
-static int map_io(struct multipath *m, struct bio *bio,
+static int map_io(struct multipath *m, struct request *clone,
                   struct dm_mpath_io *mpio, unsigned was_queued)
 {
         int r = DM_MAPIO_REMAPPED;
+        size_t nr_bytes = blk_rq_bytes(clone);
         unsigned long flags;
         struct pgpath *pgpath;
+        struct block_device *bdev;
 
         spin_lock_irqsave(&m->lock, flags);
 
         /* Do we need to select a new pgpath? */
         if (!m->current_pgpath ||
             (!m->queue_io && (m->repeat_count && --m->repeat_count == 0)))
-                __choose_pgpath(m);
+                __choose_pgpath(m, nr_bytes);
 
         pgpath = m->current_pgpath;
 
@@ -344,21 +341,28 @@ static int map_io(struct multipath *m, struct bio *bio,
         if ((pgpath && m->queue_io) ||
             (!pgpath && m->queue_if_no_path)) {
                 /* Queue for the daemon to resubmit */
-                bio_list_add(&m->queued_ios, bio);
+                list_add_tail(&clone->queuelist, &m->queued_ios);
                 m->queue_size++;
                 if ((m->pg_init_required && !m->pg_init_in_progress) ||
                     !m->queue_io)
                         queue_work(kmultipathd, &m->process_queued_ios);
                 pgpath = NULL;
                 r = DM_MAPIO_SUBMITTED;
-        } else if (pgpath)
-                bio->bi_bdev = pgpath->path.dev->bdev;
-        else if (__must_push_back(m))
+        } else if (pgpath) {
+                bdev = pgpath->path.dev->bdev;
+                clone->q = bdev_get_queue(bdev);
+                clone->rq_disk = bdev->bd_disk;
+        } else if (__must_push_back(m))
                 r = DM_MAPIO_REQUEUE;
         else
                 r = -EIO;       /* Failed */
 
         mpio->pgpath = pgpath;
+        mpio->nr_bytes = nr_bytes;
+
+        if (r == DM_MAPIO_REMAPPED && pgpath->pg->ps.type->start_io)
+                pgpath->pg->ps.type->start_io(&pgpath->pg->ps, &pgpath->path,
+                                              nr_bytes);
 
         spin_unlock_irqrestore(&m->lock, flags);
 
@@ -396,30 +400,31 @@ static void dispatch_queued_ios(struct multipath *m)
 {
         int r;
         unsigned long flags;
-        struct bio *bio = NULL, *next;
         struct dm_mpath_io *mpio;
         union map_info *info;
+        struct request *clone, *n;
+        LIST_HEAD(cl);
 
         spin_lock_irqsave(&m->lock, flags);
-        bio = bio_list_get(&m->queued_ios);
+        list_splice_init(&m->queued_ios, &cl);
         spin_unlock_irqrestore(&m->lock, flags);
 
-        while (bio) {
-                next = bio->bi_next;
-                bio->bi_next = NULL;
+        list_for_each_entry_safe(clone, n, &cl, queuelist) {
+                list_del_init(&clone->queuelist);
 
-                info = dm_get_mapinfo(bio);
+                info = dm_get_rq_mapinfo(clone);
                 mpio = info->ptr;
 
-                r = map_io(m, bio, mpio, 1);
-                if (r < 0)
-                        bio_endio(bio, r);
-                else if (r == DM_MAPIO_REMAPPED)
-                        generic_make_request(bio);
-                else if (r == DM_MAPIO_REQUEUE)
-                        bio_endio(bio, -EIO);
-
-                bio = next;
+                r = map_io(m, clone, mpio, 1);
+                if (r < 0) {
+                        mempool_free(mpio, m->mpio_pool);
+                        dm_kill_unmapped_request(clone, r);
+                } else if (r == DM_MAPIO_REMAPPED)
+                        dm_dispatch_request(clone);
+                else if (r == DM_MAPIO_REQUEUE) {
+                        mempool_free(mpio, m->mpio_pool);
+                        dm_requeue_unmapped_request(clone);
+                }
         }
 }
 
@@ -427,8 +432,8 @@ static void process_queued_ios(struct work_struct *work)
 {
         struct multipath *m =
                 container_of(work, struct multipath, process_queued_ios);
-        struct pgpath *pgpath = NULL;
-        unsigned init_required = 0, must_queue = 1;
+        struct pgpath *pgpath = NULL, *tmp;
+        unsigned must_queue = 1;
         unsigned long flags;
 
         spin_lock_irqsave(&m->lock, flags);
@@ -437,7 +442,7 @@ static void process_queued_ios(struct work_struct *work)
                 goto out;
 
         if (!m->current_pgpath)
-                __choose_pgpath(m);
+                __choose_pgpath(m, 0);
 
         pgpath = m->current_pgpath;
 
@@ -446,19 +451,15 @@ static void process_queued_ios(struct work_struct *work)
                 must_queue = 0;
 
         if (m->pg_init_required && !m->pg_init_in_progress && pgpath) {
-                m->pgpath_to_activate = pgpath;
                 m->pg_init_count++;
                 m->pg_init_required = 0;
-                m->pg_init_in_progress = 1;
-                init_required = 1;
+                list_for_each_entry(tmp, &pgpath->pg->pgpaths, list) {
+                        if (queue_work(kmpath_handlerd, &tmp->activate_path))
+                                m->pg_init_in_progress++;
+                }
         }
-
 out:
         spin_unlock_irqrestore(&m->lock, flags);
-
-        if (init_required)
-                queue_work(kmpath_handlerd, &m->activate_path);
-
         if (!must_queue)
                 dispatch_queued_ios(m);
 }
@@ -553,6 +554,12 @@ static int parse_path_selector(struct arg_set *as, struct priority_group *pg,
                 return -EINVAL;
         }
 
+        if (ps_argc > as->argc) {
+                dm_put_path_selector(pst);
+                ti->error = "not enough arguments for path selector";
+                return -EINVAL;
+        }
+
         r = pst->create(&pg->ps, ps_argc, as->argv);
         if (r) {
                 dm_put_path_selector(pst);
@@ -591,9 +598,20 @@ static struct pgpath *parse_path(struct arg_set *as, struct path_selector *ps,
         }
 
         if (m->hw_handler_name) {
-                r = scsi_dh_attach(bdev_get_queue(p->path.dev->bdev),
-                                   m->hw_handler_name);
+                struct request_queue *q = bdev_get_queue(p->path.dev->bdev);
+
+                r = scsi_dh_attach(q, m->hw_handler_name);
+                if (r == -EBUSY) {
+                        /*
+                         * Already attached to different hw_handler,
+                         * try to reattach with correct one.
+                         */
+                        scsi_dh_detach(q);
+                        r = scsi_dh_attach(q, m->hw_handler_name);
+                }
+
                 if (r < 0) {
+                        ti->error = "error attaching hardware handler";
                         dm_put_device(ti, p->path.dev);
                         goto bad;
                 }
@@ -699,6 +717,11 @@ static int parse_hw_handler(struct arg_set *as, struct multipath *m)
         if (!hw_argc)
                 return 0;
 
+        if (hw_argc > as->argc) {
+                ti->error = "not enough arguments for hardware handler";
+                return -EINVAL;
+        }
+
         m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL);
         request_module("scsi_dh_%s", m->hw_handler_name);
         if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
@@ -823,6 +846,8 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
                 goto bad;
         }
 
+        ti->num_flush_requests = 1;
+
         return 0;
 
  bad:
@@ -836,25 +861,29 @@ static void multipath_dtr(struct dm_target *ti)
 
         flush_workqueue(kmpath_handlerd);
         flush_workqueue(kmultipathd);
+        flush_scheduled_work();
         free_multipath(m);
 }
 
 /*
- * Map bios, recording original fields for later in case we have to resubmit
+ * Map cloned requests
  */
-static int multipath_map(struct dm_target *ti, struct bio *bio,
+static int multipath_map(struct dm_target *ti, struct request *clone,
                          union map_info *map_context)
 {
         int r;
         struct dm_mpath_io *mpio;
         struct multipath *m = (struct multipath *) ti->private;
 
-        mpio = mempool_alloc(m->mpio_pool, GFP_NOIO);
-        dm_bio_record(&mpio->details, bio);
+        mpio = mempool_alloc(m->mpio_pool, GFP_ATOMIC);
+        if (!mpio)
+                /* ENOMEM, requeue */
+                return DM_MAPIO_REQUEUE;
+        memset(mpio, 0, sizeof(*mpio));
 
         map_context->ptr = mpio;
-        bio->bi_rw |= (1 << BIO_RW_FAILFAST_TRANSPORT);
-        r = map_io(m, bio, mpio, 0);
+        clone->cmd_flags |= REQ_FAILFAST_TRANSPORT;
+        r = map_io(m, clone, mpio, 0);
         if (r < 0 || r == DM_MAPIO_REQUEUE)
                 mempool_free(mpio, m->mpio_pool);
 
@@ -924,9 +953,13 @@ static int reinstate_path(struct pgpath *pgpath)
 
         pgpath->is_active = 1;
 
-        m->current_pgpath = NULL;
-        if (!m->nr_valid_paths++ && m->queue_size)
+        if (!m->nr_valid_paths++ && m->queue_size) {
+                m->current_pgpath = NULL;
                 queue_work(kmultipathd, &m->process_queued_ios);
+        } else if (m->hw_handler_name && (m->current_pg == pgpath->pg)) {
+                if (queue_work(kmpath_handlerd, &pgpath->activate_path))
+                        m->pg_init_in_progress++;
+        }
 
         dm_path_uevent(DM_UEVENT_PATH_REINSTATED, m->ti,
                       pgpath->path.dev->name, m->nr_valid_paths);
@@ -1102,87 +1135,70 @@ static void pg_init_done(struct dm_path *path, int errors)
 
         spin_lock_irqsave(&m->lock, flags);
         if (errors) {
-                DMERR("Could not failover device. Error %d.", errors);
-                m->current_pgpath = NULL;
-                m->current_pg = NULL;
+                if (pgpath == m->current_pgpath) {
+                        DMERR("Could not failover device. Error %d.", errors);
+                        m->current_pgpath = NULL;
+                        m->current_pg = NULL;
+                }
         } else if (!m->pg_init_required) {
                 m->queue_io = 0;
                 pg->bypassed = 0;
         }
 
-        m->pg_init_in_progress = 0;
-        queue_work(kmultipathd, &m->process_queued_ios);
+        m->pg_init_in_progress--;
+        if (!m->pg_init_in_progress)
+                queue_work(kmultipathd, &m->process_queued_ios);
         spin_unlock_irqrestore(&m->lock, flags);
 }
 
 static void activate_path(struct work_struct *work)
 {
         int ret;
-        struct multipath *m =
-                container_of(work, struct multipath, activate_path);
-        struct dm_path *path;
-        unsigned long flags;
+        struct pgpath *pgpath =
+                container_of(work, struct pgpath, activate_path);
 
-        spin_lock_irqsave(&m->lock, flags);
-        path = &m->pgpath_to_activate->path;
-        m->pgpath_to_activate = NULL;
-        spin_unlock_irqrestore(&m->lock, flags);
-        if (!path)
-                return;
-        ret = scsi_dh_activate(bdev_get_queue(path->dev->bdev));
-        pg_init_done(path, ret);
+        ret = scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev));
+        pg_init_done(&pgpath->path, ret);
 }
 
 /*
  * end_io handling
  */
-static int do_end_io(struct multipath *m, struct bio *bio,
+static int do_end_io(struct multipath *m, struct request *clone,
                      int error, struct dm_mpath_io *mpio)
 {
+        /*
+         * We don't queue any clone request inside the multipath target
+         * during end I/O handling, since those clone requests don't have
+         * bio clones.  If we queue them inside the multipath target,
+         * we need to make bio clones, that requires memory allocation.
+         * (See drivers/md/dm.c:end_clone_bio() about why the clone requests
+         *  don't have bio clones.)
+         * Instead of queueing the clone request here, we queue the original
+         * request into dm core, which will remake a clone request and
+         * clone bios for it and resubmit it later.
+         */
+        int r = DM_ENDIO_REQUEUE;
         unsigned long flags;
 
-        if (!error)
+        if (!error && !clone->errors)
                 return 0;       /* I/O complete */
 
-        if ((error == -EWOULDBLOCK) && bio_rw_ahead(bio))
-                return error;
-
         if (error == -EOPNOTSUPP)
                 return error;
 
-        spin_lock_irqsave(&m->lock, flags);
-        if (!m->nr_valid_paths) {
-                if (__must_push_back(m)) {
-                        spin_unlock_irqrestore(&m->lock, flags);
-                        return DM_ENDIO_REQUEUE;
-                } else if (!m->queue_if_no_path) {
-                        spin_unlock_irqrestore(&m->lock, flags);
-                        return -EIO;
-                } else {
-                        spin_unlock_irqrestore(&m->lock, flags);
-                        goto requeue;
-                }
-        }
-        spin_unlock_irqrestore(&m->lock, flags);
-
         if (mpio->pgpath)
                 fail_path(mpio->pgpath);
 
-      requeue:
-        dm_bio_restore(&mpio->details, bio);
-
-        /* queue for the daemon to resubmit or fail */
         spin_lock_irqsave(&m->lock, flags);
-        bio_list_add(&m->queued_ios, bio);
-        m->queue_size++;
-        if (!m->queue_io)
-                queue_work(kmultipathd, &m->process_queued_ios);
+        if (!m->nr_valid_paths && !m->queue_if_no_path && !__must_push_back(m))
+                r = -EIO;
         spin_unlock_irqrestore(&m->lock, flags);
 
-        return DM_ENDIO_INCOMPLETE;     /* io not complete */
+        return r;
 }
 
-static int multipath_end_io(struct dm_target *ti, struct bio *bio,
+static int multipath_end_io(struct dm_target *ti, struct request *clone,
                             int error, union map_info *map_context)
 {
         struct multipath *m = ti->private;
@@ -1191,14 +1207,13 @@ static int multipath_end_io(struct dm_target *ti, struct bio *bio,
         struct path_selector *ps;
         int r;
 
-        r  = do_end_io(m, bio, error, mpio);
+        r  = do_end_io(m, clone, error, mpio);
         if (pgpath) {
                 ps = &pgpath->pg->ps;
                 if (ps->type->end_io)
-                        ps->type->end_io(ps, &pgpath->path);
+                        ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes);
         }
-        if (r != DM_ENDIO_INCOMPLETE)
-                mempool_free(mpio, m->mpio_pool);
+        mempool_free(mpio, m->mpio_pool);
 
         return r;
 }
@@ -1411,7 +1426,7 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
         spin_lock_irqsave(&m->lock, flags);
 
         if (!m->current_pgpath)
-                __choose_pgpath(m);
+                __choose_pgpath(m, 0);
 
         if (m->current_pgpath) {
                 bdev = m->current_pgpath->path.dev->bdev;
@@ -1428,22 +1443,113 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
         return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
 }
 
+static int multipath_iterate_devices(struct dm_target *ti,
+                                     iterate_devices_callout_fn fn, void *data)
+{
+        struct multipath *m = ti->private;
+        struct priority_group *pg;
+        struct pgpath *p;
+        int ret = 0;
+
+        list_for_each_entry(pg, &m->priority_groups, list) {
+                list_for_each_entry(p, &pg->pgpaths, list) {
+                        ret = fn(ti, p->path.dev, ti->begin, data);
+                        if (ret)
+                                goto out;
+                }
+        }
+
+out:
+        return ret;
+}
+
+static int __pgpath_busy(struct pgpath *pgpath)
+{
+        struct request_queue *q = bdev_get_queue(pgpath->path.dev->bdev);
+
+        return dm_underlying_device_busy(q);
+}
+
+/*
+ * We return "busy", only when we can map I/Os but underlying devices
+ * are busy (so even if we map I/Os now, the I/Os will wait on
+ * the underlying queue).
+ * In other words, if we want to kill I/Os or queue them inside us
+ * due to map unavailability, we don't return "busy".  Otherwise,
+ * dm core won't give us the I/Os and we can't do what we want.
+ */
+static int multipath_busy(struct dm_target *ti)
+{
+        int busy = 0, has_active = 0;
+        struct multipath *m = ti->private;
+        struct priority_group *pg;
+        struct pgpath *pgpath;
+        unsigned long flags;
+
+        spin_lock_irqsave(&m->lock, flags);
+
+        /* Guess which priority_group will be used at next mapping time */
+        if (unlikely(!m->current_pgpath && m->next_pg))
+                pg = m->next_pg;
+        else if (likely(m->current_pg))
+                pg = m->current_pg;
+        else
+                /*
+                 * We don't know which pg will be used at next mapping time.
+                 * We don't call __choose_pgpath() here to avoid to trigger
+                 * pg_init just by busy checking.
+                 * So we don't know whether underlying devices we will be using
+                 * at next mapping time are busy or not. Just try mapping.
+                 */
+                goto out;
+
+        /*
+         * If there is one non-busy active path at least, the path selector
+         * will be able to select it. So we consider such a pg as not busy.
+         */
+        busy = 1;
+        list_for_each_entry(pgpath, &pg->pgpaths, list)
+                if (pgpath->is_active) {
+                        has_active = 1;
+
+                        if (!__pgpath_busy(pgpath)) {
+                                busy = 0;
+                                break;
+                        }
+                }
+
+        if (!has_active)
+                /*
+                 * No active path in this pg, so this pg won't be used and
+                 * the current_pg will be changed at next mapping time.
+                 * We need to try mapping to determine it.
+                 */
+                busy = 0;
+
+out:
+        spin_unlock_irqrestore(&m->lock, flags);
+
+        return busy;
+}
+
 /*-----------------------------------------------------------------
  * Module setup
  *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
         .name = "multipath",
-        .version = {1, 0, 5},
+        .version = {1, 1, 0},
         .module = THIS_MODULE,
         .ctr = multipath_ctr,
         .dtr = multipath_dtr,
-        .map = multipath_map,
-        .end_io = multipath_end_io,
+        .map_rq = multipath_map,
+        .rq_end_io = multipath_end_io,
         .presuspend = multipath_presuspend,
         .resume = multipath_resume,
         .status = multipath_status,
         .message = multipath_message,
         .ioctl  = multipath_ioctl,
+        .iterate_devices = multipath_iterate_devices,
+        .busy = multipath_busy,
 };
 
 static int __init dm_multipath_init(void)
diff --git a/drivers/md/dm-path-selector.h b/drivers/md/dm-path-selector.h
index 27357b85d73d..e7d1fa8b0459 100644
--- a/drivers/md/dm-path-selector.h
+++ b/drivers/md/dm-path-selector.h
@@ -56,7 +56,8 @@ struct path_selector_type {
          * the path fails.
          */
         struct dm_path *(*select_path) (struct path_selector *ps,
-                                     unsigned *repeat_count);
+                                        unsigned *repeat_count,
+                                        size_t nr_bytes);
 
         /*
          * Notify the selector that a path has failed.
@@ -75,7 +76,10 @@ struct path_selector_type {
         int (*status) (struct path_selector *ps, struct dm_path *path,
                        status_type_t type, char *result, unsigned int maxlen);
 
-        int (*end_io) (struct path_selector *ps, struct dm_path *path);
+        int (*start_io) (struct path_selector *ps, struct dm_path *path,
+                         size_t nr_bytes);
+        int (*end_io) (struct path_selector *ps, struct dm_path *path,
+                       size_t nr_bytes);
 };
 
 /* Register a path selector */
diff --git a/drivers/md/dm-queue-length.c b/drivers/md/dm-queue-length.c
new file mode 100644
index 000000000000..f92b6cea9d9c
--- /dev/null
+++ b/drivers/md/dm-queue-length.c
@@ -0,0 +1,263 @@
+/*
+ * Copyright (C) 2004-2005 IBM Corp.  All Rights Reserved.
+ * Copyright (C) 2006-2009 NEC Corporation.
+ *
+ * dm-queue-length.c
+ *
+ * Module Author: Stefan Bader, IBM
+ * Modified by: Kiyoshi Ueda, NEC
+ *
+ * This file is released under the GPL.
+ *
+ * queue-length path selector - choose a path with the least number of
+ * in-flight I/Os.
+ */
+
+#include "dm.h"
+#include "dm-path-selector.h"
+
+#include <linux/slab.h>
+#include <linux/ctype.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <asm/atomic.h>
+
+#define DM_MSG_PREFIX   "multipath queue-length"
+#define QL_MIN_IO       128
+#define QL_VERSION      "0.1.0"
+
+struct selector {
+        struct list_head        valid_paths;
+        struct list_head        failed_paths;
+};
+
+struct path_info {
+        struct list_head        list;
+        struct dm_path          *path;
+        unsigned                repeat_count;
+        atomic_t                qlen;   /* the number of in-flight I/Os */
+};
+
+static struct selector *alloc_selector(void)
+{
+        struct selector *s = kmalloc(sizeof(*s), GFP_KERNEL);
+
+        if (s) {
+                INIT_LIST_HEAD(&s->valid_paths);
+                INIT_LIST_HEAD(&s->failed_paths);
+        }
+
+        return s;
+}
+
+static int ql_create(struct path_selector *ps, unsigned argc, char **argv)
+{
+        struct selector *s = alloc_selector();
+
+        if (!s)
+                return -ENOMEM;
+
+        ps->context = s;
+        return 0;
+}
+
+static void ql_free_paths(struct list_head *paths)
+{
+        struct path_info *pi, *next;
+
+        list_for_each_entry_safe(pi, next, paths, list) {
+                list_del(&pi->list);
+                kfree(pi);
+        }
+}
+
+static void ql_destroy(struct path_selector *ps)
+{
+        struct selector *s = ps->context;
+
+        ql_free_paths(&s->valid_paths);
+        ql_free_paths(&s->failed_paths);
+        kfree(s);
+        ps->context = NULL;
+}
+
+static int ql_status(struct path_selector *ps, struct dm_path *path,
+                     status_type_t type, char *result, unsigned maxlen)
+{
+        unsigned sz = 0;
+        struct path_info *pi;
+
+        /* When called with NULL path, return selector status/args. */
+        if (!path)
+                DMEMIT("0 ");
+        else {
+                pi = path->pscontext;
+
+                switch (type) {
+                case STATUSTYPE_INFO:
+                        DMEMIT("%d ", atomic_read(&pi->qlen));
+                        break;
+                case STATUSTYPE_TABLE:
+                        DMEMIT("%u ", pi->repeat_count);
+                        break;
+                }
+        }
+
+        return sz;
+}
+
+static int ql_add_path(struct path_selector *ps, struct dm_path *path,
+                       int argc, char **argv, char **error)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi;
+        unsigned repeat_count = QL_MIN_IO;
+
+        /*
+         * Arguments: [<repeat_count>]
+         *      <repeat_count>: The number of I/Os before switching path.
+         *                      If not given, default (QL_MIN_IO) is used.
+         */
+        if (argc > 1) {
+                *error = "queue-length ps: incorrect number of arguments";
+                return -EINVAL;
+        }
+
+        if ((argc == 1) && (sscanf(argv[0], "%u", &repeat_count) != 1)) {
+                *error = "queue-length ps: invalid repeat count";
+                return -EINVAL;
+        }
+
+        /* Allocate the path information structure */
+        pi = kmalloc(sizeof(*pi), GFP_KERNEL);
+        if (!pi) {
+                *error = "queue-length ps: Error allocating path information";
+                return -ENOMEM;
+        }
+
+        pi->path = path;
+        pi->repeat_count = repeat_count;
+        atomic_set(&pi->qlen, 0);
+
+        path->pscontext = pi;
+
+        list_add_tail(&pi->list, &s->valid_paths);
+
+        return 0;
+}
+
+static void ql_fail_path(struct path_selector *ps, struct dm_path *path)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi = path->pscontext;
+
+        list_move(&pi->list, &s->failed_paths);
+}
+
+static int ql_reinstate_path(struct path_selector *ps, struct dm_path *path)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi = path->pscontext;
+
+        list_move_tail(&pi->list, &s->valid_paths);
+
+        return 0;
+}
+
+/*
+ * Select a path having the minimum number of in-flight I/Os
+ */
+static struct dm_path *ql_select_path(struct path_selector *ps,
+                                      unsigned *repeat_count, size_t nr_bytes)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi = NULL, *best = NULL;
+
+        if (list_empty(&s->valid_paths))
+                return NULL;
+
+        /* Change preferred (first in list) path to evenly balance. */
+        list_move_tail(s->valid_paths.next, &s->valid_paths);
+
+        list_for_each_entry(pi, &s->valid_paths, list) {
+                if (!best ||
+                    (atomic_read(&pi->qlen) < atomic_read(&best->qlen)))
+                        best = pi;
+
+                if (!atomic_read(&best->qlen))
+                        break;
+        }
+
+        if (!best)
+                return NULL;
+
+        *repeat_count = best->repeat_count;
+
+        return best->path;
+}
+
+static int ql_start_io(struct path_selector *ps, struct dm_path *path,
+                       size_t nr_bytes)
+{
+        struct path_info *pi = path->pscontext;
+
+        atomic_inc(&pi->qlen);
+
+        return 0;
+}
+
+static int ql_end_io(struct path_selector *ps, struct dm_path *path,
+                     size_t nr_bytes)
+{
+        struct path_info *pi = path->pscontext;
+
+        atomic_dec(&pi->qlen);
+
+        return 0;
+}
+
+static struct path_selector_type ql_ps = {
+        .name           = "queue-length",
+        .module         = THIS_MODULE,
+        .table_args     = 1,
+        .info_args      = 1,
+        .create         = ql_create,
+        .destroy        = ql_destroy,
+        .status         = ql_status,
+        .add_path       = ql_add_path,
+        .fail_path      = ql_fail_path,
+        .reinstate_path = ql_reinstate_path,
+        .select_path    = ql_select_path,
+        .start_io       = ql_start_io,
+        .end_io         = ql_end_io,
+};
+
+static int __init dm_ql_init(void)
+{
+        int r = dm_register_path_selector(&ql_ps);
+
+        if (r < 0)
+                DMERR("register failed %d", r);
+
+        DMINFO("version " QL_VERSION " loaded");
+
+        return r;
+}
+
+static void __exit dm_ql_exit(void)
+{
+        int r = dm_unregister_path_selector(&ql_ps);
+
+        if (r < 0)
+                DMERR("unregister failed %d", r);
+}
+
+module_init(dm_ql_init);
+module_exit(dm_ql_exit);
+
+MODULE_AUTHOR("Stefan Bader <Stefan.Bader at de.ibm.com>");
+MODULE_DESCRIPTION(
+        "(C) Copyright IBM Corp. 2004,2005   All Rights Reserved.\n"
+        DM_NAME " path selector to balance the number of in-flight I/Os"
+);
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 076fbb4e967a..ce8868c768cc 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -1283,9 +1283,23 @@ static int mirror_status(struct dm_target *ti, status_type_t type,
         return 0;
 }
 
+static int mirror_iterate_devices(struct dm_target *ti,
+                                  iterate_devices_callout_fn fn, void *data)
+{
+        struct mirror_set *ms = ti->private;
+        int ret = 0;
+        unsigned i;
+
+        for (i = 0; !ret && i < ms->nr_mirrors; i++)
+                ret = fn(ti, ms->mirror[i].dev,
+                         ms->mirror[i].offset, data);
+
+        return ret;
+}
+
 static struct target_type mirror_target = {
         .name    = "mirror",
-        .version = {1, 0, 20},
+        .version = {1, 12, 0},
         .module  = THIS_MODULE,
         .ctr     = mirror_ctr,
         .dtr     = mirror_dtr,
@@ -1295,6 +1309,7 @@ static struct target_type mirror_target = {
         .postsuspend = mirror_postsuspend,
         .resume  = mirror_resume,
         .status  = mirror_status,
+        .iterate_devices = mirror_iterate_devices,
 };
 
 static int __init dm_mirror_init(void)
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 7b899be0b087..36dbe29f2fd6 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -283,7 +283,7 @@ static struct dm_region *__rh_alloc(struct dm_region_hash *rh, region_t region)
 
         nreg = mempool_alloc(rh->region_pool, GFP_ATOMIC);
         if (unlikely(!nreg))
-                nreg = kmalloc(sizeof(*nreg), GFP_NOIO);
+                nreg = kmalloc(sizeof(*nreg), GFP_NOIO | __GFP_NOFAIL);
 
         nreg->state = rh->log->type->in_sync(rh->log, region, 1) ?
                       DM_RH_CLEAN : DM_RH_NOSYNC;
diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
index cdfbf65b28cb..24752f449bef 100644
--- a/drivers/md/dm-round-robin.c
+++ b/drivers/md/dm-round-robin.c
@@ -161,7 +161,7 @@ static int rr_reinstate_path(struct path_selector *ps, struct dm_path *p)
 }
 
 static struct dm_path *rr_select_path(struct path_selector *ps,
-                                   unsigned *repeat_count)
+                                      unsigned *repeat_count, size_t nr_bytes)
 {
         struct selector *s = (struct selector *) ps->context;
         struct path_info *pi = NULL;
diff --git a/drivers/md/dm-service-time.c b/drivers/md/dm-service-time.c
new file mode 100644
index 000000000000..cfa668f46c40
--- /dev/null
+++ b/drivers/md/dm-service-time.c
@@ -0,0 +1,339 @@
+/*
+ * Copyright (C) 2007-2009 NEC Corporation.  All Rights Reserved.
+ *
+ * Module Author: Kiyoshi Ueda
+ *
+ * This file is released under the GPL.
+ *
+ * Throughput oriented path selector.
+ */
+
+#include "dm.h"
+#include "dm-path-selector.h"
+
+#define DM_MSG_PREFIX   "multipath service-time"
+#define ST_MIN_IO       1
+#define ST_MAX_RELATIVE_THROUGHPUT      100
+#define ST_MAX_RELATIVE_THROUGHPUT_SHIFT        7
+#define ST_MAX_INFLIGHT_SIZE    ((size_t)-1 >> ST_MAX_RELATIVE_THROUGHPUT_SHIFT)
+#define ST_VERSION      "0.2.0"
+
+struct selector {
+        struct list_head valid_paths;
+        struct list_head failed_paths;
+};
+
+struct path_info {
+        struct list_head list;
+        struct dm_path *path;
+        unsigned repeat_count;
+        unsigned relative_throughput;
+        atomic_t in_flight_size;        /* Total size of in-flight I/Os */
+};
+
+static struct selector *alloc_selector(void)
+{
+        struct selector *s = kmalloc(sizeof(*s), GFP_KERNEL);
+
+        if (s) {
+                INIT_LIST_HEAD(&s->valid_paths);
+                INIT_LIST_HEAD(&s->failed_paths);
+        }
+
+        return s;
+}
+
+static int st_create(struct path_selector *ps, unsigned argc, char **argv)
+{
+        struct selector *s = alloc_selector();
+
+        if (!s)
+                return -ENOMEM;
+
+        ps->context = s;
+        return 0;
+}
+
+static void free_paths(struct list_head *paths)
+{
+        struct path_info *pi, *next;
+
+        list_for_each_entry_safe(pi, next, paths, list) {
+                list_del(&pi->list);
+                kfree(pi);
+        }
+}
+
+static void st_destroy(struct path_selector *ps)
+{
+        struct selector *s = ps->context;
+
+        free_paths(&s->valid_paths);
+        free_paths(&s->failed_paths);
+        kfree(s);
+        ps->context = NULL;
+}
+
+static int st_status(struct path_selector *ps, struct dm_path *path,
+                     status_type_t type, char *result, unsigned maxlen)
+{
+        unsigned sz = 0;
+        struct path_info *pi;
+
+        if (!path)
+                DMEMIT("0 ");
+        else {
+                pi = path->pscontext;
+
+                switch (type) {
+                case STATUSTYPE_INFO:
+                        DMEMIT("%d %u ", atomic_read(&pi->in_flight_size),
+                               pi->relative_throughput);
+                        break;
+                case STATUSTYPE_TABLE:
+                        DMEMIT("%u %u ", pi->repeat_count,
+                               pi->relative_throughput);
+                        break;
+                }
+        }
+
+        return sz;
+}
+
+static int st_add_path(struct path_selector *ps, struct dm_path *path,
+                       int argc, char **argv, char **error)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi;
+        unsigned repeat_count = ST_MIN_IO;
+        unsigned relative_throughput = 1;
+
+        /*
+         * Arguments: [<repeat_count> [<relative_throughput>]]
+         *      <repeat_count>: The number of I/Os before switching path.
+         *                      If not given, default (ST_MIN_IO) is used.
+         *      <relative_throughput>: The relative throughput value of
+         *                      the path among all paths in the path-group.
+         *                      The valid range: 0-<ST_MAX_RELATIVE_THROUGHPUT>
+         *                      If not given, minimum value '1' is used.
+         *                      If '0' is given, the path isn't selected while
+         *                      other paths having a positive value are
+         *                      available.
+         */
+        if (argc > 2) {
+                *error = "service-time ps: incorrect number of arguments";
+                return -EINVAL;
+        }
+
+        if (argc && (sscanf(argv[0], "%u", &repeat_count) != 1)) {
+                *error = "service-time ps: invalid repeat count";
+                return -EINVAL;
+        }
+
+        if ((argc == 2) &&
+            (sscanf(argv[1], "%u", &relative_throughput) != 1 ||
+             relative_throughput > ST_MAX_RELATIVE_THROUGHPUT)) {
+                *error = "service-time ps: invalid relative_throughput value";
+                return -EINVAL;
+        }
+
+        /* allocate the path */
+        pi = kmalloc(sizeof(*pi), GFP_KERNEL);
+        if (!pi) {
+                *error = "service-time ps: Error allocating path context";
+                return -ENOMEM;
+        }
+
+        pi->path = path;
+        pi->repeat_count = repeat_count;
+        pi->relative_throughput = relative_throughput;
+        atomic_set(&pi->in_flight_size, 0);
+
+        path->pscontext = pi;
+
+        list_add_tail(&pi->list, &s->valid_paths);
+
+        return 0;
+}
+
+static void st_fail_path(struct path_selector *ps, struct dm_path *path)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi = path->pscontext;
+
+        list_move(&pi->list, &s->failed_paths);
+}
+
+static int st_reinstate_path(struct path_selector *ps, struct dm_path *path)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi = path->pscontext;
+
+        list_move_tail(&pi->list, &s->valid_paths);
+
+        return 0;
+}
+
+/*
+ * Compare the estimated service time of 2 paths, pi1 and pi2,
+ * for the incoming I/O.
+ *
+ * Returns:
+ * < 0 : pi1 is better
+ * 0   : no difference between pi1 and pi2
+ * > 0 : pi2 is better
+ *
+ * Description:
+ * Basically, the service time is estimated by:
+ *     ('pi->in-flight-size' + 'incoming') / 'pi->relative_throughput'
+ * To reduce the calculation, some optimizations are made.
+ * (See comments inline)
+ */
+static int st_compare_load(struct path_info *pi1, struct path_info *pi2,
+                           size_t incoming)
+{
+        size_t sz1, sz2, st1, st2;
+
+        sz1 = atomic_read(&pi1->in_flight_size);
+        sz2 = atomic_read(&pi2->in_flight_size);
+
+        /*
+         * Case 1: Both have same throughput value. Choose less loaded path.
+         */
+        if (pi1->relative_throughput == pi2->relative_throughput)
+                return sz1 - sz2;
+
+        /*
+         * Case 2a: Both have same load. Choose higher throughput path.
+         * Case 2b: One path has no throughput value. Choose the other one.
+         */
+        if (sz1 == sz2 ||
+            !pi1->relative_throughput || !pi2->relative_throughput)
+                return pi2->relative_throughput - pi1->relative_throughput;
+
+        /*
+         * Case 3: Calculate service time. Choose faster path.
+         *         Service time using pi1:
+         *             st1 = (sz1 + incoming) / pi1->relative_throughput
+         *         Service time using pi2:
+         *             st2 = (sz2 + incoming) / pi2->relative_throughput
+         *
+         *         To avoid the division, transform the expression to use
+         *         multiplication.
+         *         Because ->relative_throughput > 0 here, if st1 < st2,
+         *         the expressions below are the same meaning:
+         *             (sz1 + incoming) / pi1->relative_throughput <
+         *                 (sz2 + incoming) / pi2->relative_throughput
+         *             (sz1 + incoming) * pi2->relative_throughput <
+         *                 (sz2 + incoming) * pi1->relative_throughput
+         *         So use the later one.
+         */
+        sz1 += incoming;
+        sz2 += incoming;
+        if (unlikely(sz1 >= ST_MAX_INFLIGHT_SIZE ||
+                     sz2 >= ST_MAX_INFLIGHT_SIZE)) {
+                /*
+                 * Size may be too big for multiplying pi->relative_throughput
+                 * and overflow.
+                 * To avoid the overflow and mis-selection, shift down both.
+                 */
+                sz1 >>= ST_MAX_RELATIVE_THROUGHPUT_SHIFT;
+                sz2 >>= ST_MAX_RELATIVE_THROUGHPUT_SHIFT;
+        }
+        st1 = sz1 * pi2->relative_throughput;
+        st2 = sz2 * pi1->relative_throughput;
+        if (st1 != st2)
+                return st1 - st2;
+
+        /*
+         * Case 4: Service time is equal. Choose higher throughput path.
+         */
+        return pi2->relative_throughput - pi1->relative_throughput;
+}
+
+static struct dm_path *st_select_path(struct path_selector *ps,
+                                      unsigned *repeat_count, size_t nr_bytes)
+{
+        struct selector *s = ps->context;
+        struct path_info *pi = NULL, *best = NULL;
+
+        if (list_empty(&s->valid_paths))
+                return NULL;
+
+        /* Change preferred (first in list) path to evenly balance. */
+        list_move_tail(s->valid_paths.next, &s->valid_paths);
+
+        list_for_each_entry(pi, &s->valid_paths, list)
+                if (!best || (st_compare_load(pi, best, nr_bytes) < 0))
+                        best = pi;
+
+        if (!best)
+                return NULL;
+
+        *repeat_count = best->repeat_count;
+
+        return best->path;
+}
+
+static int st_start_io(struct path_selector *ps, struct dm_path *path,
+                       size_t nr_bytes)
+{
+        struct path_info *pi = path->pscontext;
+
+        atomic_add(nr_bytes, &pi->in_flight_size);
+
+        return 0;
+}
+
+static int st_end_io(struct path_selector *ps, struct dm_path *path,
+                     size_t nr_bytes)
+{
+        struct path_info *pi = path->pscontext;
+
+        atomic_sub(nr_bytes, &pi->in_flight_size);
+
+        return 0;
+}
+
+static struct path_selector_type st_ps = {
+        .name           = "service-time",
+        .module         = THIS_MODULE,
+        .table_args     = 2,
+        .info_args      = 2,
+        .create         = st_create,
+        .destroy        = st_destroy,
+        .status         = st_status,
+        .add_path       = st_add_path,
+        .fail_path      = st_fail_path,
+        .reinstate_path = st_reinstate_path,
+        .select_path    = st_select_path,
+        .start_io       = st_start_io,
+        .end_io         = st_end_io,
+};
+
+static int __init dm_st_init(void)
+{
+        int r = dm_register_path_selector(&st_ps);
+
+        if (r < 0)
+                DMERR("register failed %d", r);
+
+        DMINFO("version " ST_VERSION " loaded");
+
+        return r;
+}
+
+static void __exit dm_st_exit(void)
+{
+        int r = dm_unregister_path_selector(&st_ps);
+
+        if (r < 0)
+                DMERR("unregister failed %d", r);
+}
+
+module_init(dm_st_init);
+module_exit(dm_st_exit);
+
+MODULE_DESCRIPTION(DM_NAME " throughput oriented path selector");
+MODULE_AUTHOR("Kiyoshi Ueda <k-ueda@ct.jp.nec.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 2662a41337e7..6e3fe4f14934 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -636,7 +636,7 @@ static void persistent_commit_exception(struct dm_exception_store *store,
         /*
          * Commit exceptions to disk.
          */
-        if (ps->valid && area_io(ps, WRITE))
+        if (ps->valid && area_io(ps, WRITE_BARRIER))
                 ps->valid = 0;
 
         /*
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index d73f17fc7778..d573165cd2b7 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -678,6 +678,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         ti->private = s;
         ti->split_io = s->store->chunk_size;
+        ti->num_flush_requests = 1;
 
         return 0;
 
@@ -1030,6 +1031,11 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
         chunk_t chunk;
         struct dm_snap_pending_exception *pe = NULL;
 
+        if (unlikely(bio_empty_barrier(bio))) {
+                bio->bi_bdev = s->store->cow->bdev;
+                return DM_MAPIO_REMAPPED;
+        }
+
         chunk = sector_to_chunk(s->store, bio->bi_sector);
 
         /* Full snapshots are not usable */
@@ -1338,6 +1344,8 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
 
         ti->private = dev;
+        ti->num_flush_requests = 1;
+
         return 0;
 }
 
@@ -1353,6 +1361,9 @@ static int origin_map(struct dm_target *ti, struct bio *bio,
         struct dm_dev *dev = ti->private;
         bio->bi_bdev = dev->bdev;
 
+        if (unlikely(bio_empty_barrier(bio)))
+                return DM_MAPIO_REMAPPED;
+
         /* Only tell snapshots if this is a write */
         return (bio_rw(bio) == WRITE) ? do_origin(dev, bio) : DM_MAPIO_REMAPPED;
 }
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index 41569bc60abc..b240e85ae39a 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -167,6 +167,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         sc->stripes = stripes;
         sc->stripe_width = width;
         ti->split_io = chunk_size;
+        ti->num_flush_requests = stripes;
 
         sc->chunk_mask = ((sector_t) chunk_size) - 1;
         for (sc->chunk_shift = 0; chunk_size; sc->chunk_shift++)
@@ -211,10 +212,18 @@ static int stripe_map(struct dm_target *ti, struct bio *bio,
                       union map_info *map_context)
 {
         struct stripe_c *sc = (struct stripe_c *) ti->private;
+        sector_t offset, chunk;
+        uint32_t stripe;
 
-        sector_t offset = bio->bi_sector - ti->begin;
-        sector_t chunk = offset >> sc->chunk_shift;
-        uint32_t stripe = sector_div(chunk, sc->stripes);
+        if (unlikely(bio_empty_barrier(bio))) {
+                BUG_ON(map_context->flush_request >= sc->stripes);
+                bio->bi_bdev = sc->stripe[map_context->flush_request].dev->bdev;
+                return DM_MAPIO_REMAPPED;
+        }
+
+        offset = bio->bi_sector - ti->begin;
+        chunk = offset >> sc->chunk_shift;
+        stripe = sector_div(chunk, sc->stripes);
 
         bio->bi_bdev = sc->stripe[stripe].dev->bdev;
         bio->bi_sector = sc->stripe[stripe].physical_start +
@@ -304,15 +313,31 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
         return error;
 }
 
+static int stripe_iterate_devices(struct dm_target *ti,
+                                  iterate_devices_callout_fn fn, void *data)
+{
+        struct stripe_c *sc = ti->private;
+        int ret = 0;
+        unsigned i = 0;
+
+        do
+                ret = fn(ti, sc->stripe[i].dev,
+                         sc->stripe[i].physical_start, data);
+        while (!ret && ++i < sc->stripes);
+
+        return ret;
+}
+
 static struct target_type stripe_target = {
         .name   = "striped",
-        .version = {1, 1, 0},
+        .version = {1, 2, 0},
         .module = THIS_MODULE,
         .ctr    = stripe_ctr,
         .dtr    = stripe_dtr,
         .map    = stripe_map,
         .end_io = stripe_end_io,
         .status = stripe_status,
+        .iterate_devices = stripe_iterate_devices,
 };
 
 int __init dm_stripe_init(void)
diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
index a2a45e6c7c8b..4b045903a4e2 100644
--- a/drivers/md/dm-sysfs.c
+++ b/drivers/md/dm-sysfs.c
@@ -57,12 +57,21 @@ static ssize_t dm_attr_uuid_show(struct mapped_device *md, char *buf)
         return strlen(buf);
 }
 
+static ssize_t dm_attr_suspended_show(struct mapped_device *md, char *buf)
+{
+        sprintf(buf, "%d\n", dm_suspended(md));
+
+        return strlen(buf);
+}
+
 static DM_ATTR_RO(name);
 static DM_ATTR_RO(uuid);
+static DM_ATTR_RO(suspended);
 
 static struct attribute *dm_attrs[] = {
         &dm_attr_name.attr,
         &dm_attr_uuid.attr,
+        &dm_attr_suspended.attr,
         NULL,
 };
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index e9a73bb242b0..4899ebe767c8 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -41,6 +41,7 @@
 struct dm_table {
         struct mapped_device *md;
         atomic_t holders;
+        unsigned type;
 
         /* btree table */
         unsigned int depth;
@@ -62,15 +63,11 @@ struct dm_table {
         /* a list of devices used by this table */
         struct list_head devices;
 
-        /*
-         * These are optimistic limits taken from all the
-         * targets, some targets will need smaller limits.
-         */
-        struct io_restrictions limits;
-
         /* events get handed up using this callback */
         void (*event_fn)(void *);
         void *event_context;
+
+        struct dm_md_mempools *mempools;
 };
 
 /*
@@ -89,43 +86,6 @@ static unsigned int int_log(unsigned int n, unsigned int base)
 }
 
 /*
- * Returns the minimum that is _not_ zero, unless both are zero.
- */
-#define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
-
-/*
- * Combine two io_restrictions, always taking the lower value.
- */
-static void combine_restrictions_low(struct io_restrictions *lhs,
-                                     struct io_restrictions *rhs)
-{
-        lhs->max_sectors =
-                min_not_zero(lhs->max_sectors, rhs->max_sectors);
-
-        lhs->max_phys_segments =
-                min_not_zero(lhs->max_phys_segments, rhs->max_phys_segments);
-
-        lhs->max_hw_segments =
-                min_not_zero(lhs->max_hw_segments, rhs->max_hw_segments);
-
-        lhs->logical_block_size = max(lhs->logical_block_size,
-                                      rhs->logical_block_size);
-
-        lhs->max_segment_size =
-                min_not_zero(lhs->max_segment_size, rhs->max_segment_size);
-
-        lhs->max_hw_sectors =
-                min_not_zero(lhs->max_hw_sectors, rhs->max_hw_sectors);
-
-        lhs->seg_boundary_mask =
-                min_not_zero(lhs->seg_boundary_mask, rhs->seg_boundary_mask);
-
-        lhs->bounce_pfn = min_not_zero(lhs->bounce_pfn, rhs->bounce_pfn);
-
-        lhs->no_cluster |= rhs->no_cluster;
-}
-
-/*
  * Calculate the index of the child node of the n'th node k'th key.
  */
 static inline unsigned int get_child(unsigned int n, unsigned int k)
@@ -267,6 +227,8 @@ static void free_devices(struct list_head *devices)
         list_for_each_safe(tmp, next, devices) {
                 struct dm_dev_internal *dd =
                     list_entry(tmp, struct dm_dev_internal, list);
+                DMWARN("dm_table_destroy: dm_put_device call missing for %s",
+                       dd->dm_dev.name);
                 kfree(dd);
         }
 }
@@ -296,12 +258,10 @@ void dm_table_destroy(struct dm_table *t)
         vfree(t->highs);
 
         /* free the device list */
-        if (t->devices.next != &t->devices) {
-                DMWARN("devices still present during destroy: "
-                       "dm_table_remove_device calls missing");
-
+        if (t->devices.next != &t->devices)
                 free_devices(&t->devices);
-        }
+
+        dm_free_md_mempools(t->mempools);
 
         kfree(t);
 }
@@ -385,15 +345,48 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md)
 /*
  * If possible, this checks an area of a destination device is valid.
  */
-static int check_device_area(struct dm_dev_internal *dd, sector_t start,
-                             sector_t len)
+static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
+                                sector_t start, void *data)
 {
-        sector_t dev_size = dd->dm_dev.bdev->bd_inode->i_size >> SECTOR_SHIFT;
+        struct queue_limits *limits = data;
+        struct block_device *bdev = dev->bdev;
+        sector_t dev_size =
+                i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
+        unsigned short logical_block_size_sectors =
+                limits->logical_block_size >> SECTOR_SHIFT;
+        char b[BDEVNAME_SIZE];
 
         if (!dev_size)
                 return 1;
 
-        return ((start < dev_size) && (len <= (dev_size - start)));
+        if ((start >= dev_size) || (start + ti->len > dev_size)) {
+                DMWARN("%s: %s too small for target",
+                       dm_device_name(ti->table->md), bdevname(bdev, b));
+                return 0;
+        }
+
+        if (logical_block_size_sectors <= 1)
+                return 1;
+
+        if (start & (logical_block_size_sectors - 1)) {
+                DMWARN("%s: start=%llu not aligned to h/w "
+                       "logical block size %hu of %s",
+                       dm_device_name(ti->table->md),
+                       (unsigned long long)start,
+                       limits->logical_block_size, bdevname(bdev, b));
+                return 0;
+        }
+
+        if (ti->len & (logical_block_size_sectors - 1)) {
+                DMWARN("%s: len=%llu not aligned to h/w "
+                       "logical block size %hu of %s",
+                       dm_device_name(ti->table->md),
+                       (unsigned long long)ti->len,
+                       limits->logical_block_size, bdevname(bdev, b));
+                return 0;
+        }
+
+        return 1;
 }
 
 /*
@@ -479,38 +472,32 @@ static int __table_get_device(struct dm_table *t, struct dm_target *ti,
         }
         atomic_inc(&dd->count);
 
-        if (!check_device_area(dd, start, len)) {
-                DMWARN("device %s too small for target", path);
-                dm_put_device(ti, &dd->dm_dev);
-                return -EINVAL;
-        }
-
         *result = &dd->dm_dev;
-
         return 0;
 }
 
-void dm_set_device_limits(struct dm_target *ti, struct block_device *bdev)
+/*
+ * Returns the minimum that is _not_ zero, unless both are zero.
+ */
+#define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
+
+int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
+                         sector_t start, void *data)
 {
+        struct queue_limits *limits = data;
+        struct block_device *bdev = dev->bdev;
         struct request_queue *q = bdev_get_queue(bdev);
-        struct io_restrictions *rs = &ti->limits;
         char b[BDEVNAME_SIZE];
 
         if (unlikely(!q)) {
                 DMWARN("%s: Cannot set limits for nonexistent device %s",
                        dm_device_name(ti->table->md), bdevname(bdev, b));
-                return;
+                return 0;
         }
 
-        /*
-         * Combine the device limits low.
-         *
-         * FIXME: if we move an io_restriction struct
-         *        into q this would just be a call to
-         *        combine_restrictions_low()
-         */
-        rs->max_sectors =
-                min_not_zero(rs->max_sectors, queue_max_sectors(q));
+        if (blk_stack_limits(limits, &q->limits, start) < 0)
+                DMWARN("%s: target device %s is misaligned",
+                       dm_device_name(ti->table->md), bdevname(bdev, b));
 
         /*
          * Check if merge fn is supported.
@@ -519,48 +506,21 @@ void dm_set_device_limits(struct dm_target *ti, struct block_device *bdev)
          */
 
         if (q->merge_bvec_fn && !ti->type->merge)
-                rs->max_sectors =
-                        min_not_zero(rs->max_sectors,
+                limits->max_sectors =
+                        min_not_zero(limits->max_sectors,
                                      (unsigned int) (PAGE_SIZE >> 9));
-
-        rs->max_phys_segments =
-                min_not_zero(rs->max_phys_segments,
-                             queue_max_phys_segments(q));
-
-        rs->max_hw_segments =
-                min_not_zero(rs->max_hw_segments, queue_max_hw_segments(q));
-
-        rs->logical_block_size = max(rs->logical_block_size,
-                                     queue_logical_block_size(q));
-
-        rs->max_segment_size =
-                min_not_zero(rs->max_segment_size, queue_max_segment_size(q));
-
-        rs->max_hw_sectors =
-                min_not_zero(rs->max_hw_sectors, queue_max_hw_sectors(q));
-
-        rs->seg_boundary_mask =
-                min_not_zero(rs->seg_boundary_mask,
-                             queue_segment_boundary(q));
-
-        rs->bounce_pfn = min_not_zero(rs->bounce_pfn, queue_bounce_pfn(q));
-
-        rs->no_cluster |= !test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(dm_set_device_limits);
 
 int dm_get_device(struct dm_target *ti, const char *path, sector_t start,
                   sector_t len, fmode_t mode, struct dm_dev **result)
 {
-        int r = __table_get_device(ti->table, ti, path,
-                                   start, len, mode, result);
-
-        if (!r)
-                dm_set_device_limits(ti, (*result)->bdev);
-
-        return r;
+        return __table_get_device(ti->table, ti, path,
+                                  start, len, mode, result);
 }
 
+
 /*
  * Decrement a devices use count and remove it if necessary.
  */
@@ -675,24 +635,78 @@ int dm_split_args(int *argc, char ***argvp, char *input)
         return 0;
 }
 
-static void check_for_valid_limits(struct io_restrictions *rs)
+/*
+ * Impose necessary and sufficient conditions on a devices's table such
+ * that any incoming bio which respects its logical_block_size can be
+ * processed successfully.  If it falls across the boundary between
+ * two or more targets, the size of each piece it gets split into must
+ * be compatible with the logical_block_size of the target processing it.
+ */
+static int validate_hardware_logical_block_alignment(struct dm_table *table,
+                                                 struct queue_limits *limits)
 {
-        if (!rs->max_sectors)
-                rs->max_sectors = SAFE_MAX_SECTORS;
-        if (!rs->max_hw_sectors)
-                rs->max_hw_sectors = SAFE_MAX_SECTORS;
-        if (!rs->max_phys_segments)
-                rs->max_phys_segments = MAX_PHYS_SEGMENTS;
-        if (!rs->max_hw_segments)
-                rs->max_hw_segments = MAX_HW_SEGMENTS;
-        if (!rs->logical_block_size)
-                rs->logical_block_size = 1 << SECTOR_SHIFT;
-        if (!rs->max_segment_size)
-                rs->max_segment_size = MAX_SEGMENT_SIZE;
-        if (!rs->seg_boundary_mask)
-                rs->seg_boundary_mask = BLK_SEG_BOUNDARY_MASK;
-        if (!rs->bounce_pfn)
-                rs->bounce_pfn = -1;
+        /*
+         * This function uses arithmetic modulo the logical_block_size
+         * (in units of 512-byte sectors).
+         */
+        unsigned short device_logical_block_size_sects =
+                limits->logical_block_size >> SECTOR_SHIFT;
+
+        /*
+         * Offset of the start of the next table entry, mod logical_block_size.
+         */
+        unsigned short next_target_start = 0;
+
+        /*
+         * Given an aligned bio that extends beyond the end of a
+         * target, how many sectors must the next target handle?
+         */
+        unsigned short remaining = 0;
+
+        struct dm_target *uninitialized_var(ti);
+        struct queue_limits ti_limits;
+        unsigned i = 0;
+
+        /*
+         * Check each entry in the table in turn.
+         */
+        while (i < dm_table_get_num_targets(table)) {
+                ti = dm_table_get_target(table, i++);
+
+                blk_set_default_limits(&ti_limits);
+
+                /* combine all target devices' limits */
+                if (ti->type->iterate_devices)
+                        ti->type->iterate_devices(ti, dm_set_device_limits,
+                                                  &ti_limits);
+
+                /*
+                 * If the remaining sectors fall entirely within this
+                 * table entry are they compatible with its logical_block_size?
+                 */
+                if (remaining < ti->len &&
+                    remaining & ((ti_limits.logical_block_size >>
+                                  SECTOR_SHIFT) - 1))
+                        break;  /* Error */
+
+                next_target_start =
+                    (unsigned short) ((next_target_start + ti->len) &
+                                      (device_logical_block_size_sects - 1));
+                remaining = next_target_start ?
+                    device_logical_block_size_sects - next_target_start : 0;
+        }
+
+        if (remaining) {
+                DMWARN("%s: table line %u (start sect %llu len %llu) "
+                       "not aligned to h/w logical block size %hu",
+                       dm_device_name(table->md), i,
+                       (unsigned long long) ti->begin,
+                       (unsigned long long) ti->len,
+                       limits->logical_block_size);
+                return -EINVAL;
+        }
+
+        return 0;
 }
 
 int dm_table_add_target(struct dm_table *t, const char *type,
@@ -747,9 +761,6 @@ int dm_table_add_target(struct dm_table *t, const char *type,
 
         t->highs[t->num_targets++] = tgt->begin + tgt->len - 1;
 
-        /* FIXME: the plan is to combine high here and then have
-         * the merge fn apply the target level restrictions. */
-        combine_restrictions_low(&t->limits, &tgt->limits);
         return 0;
 
  bad:
@@ -758,6 +769,104 @@ int dm_table_add_target(struct dm_table *t, const char *type,
         return r;
 }
 
+int dm_table_set_type(struct dm_table *t)
+{
+        unsigned i;
+        unsigned bio_based = 0, request_based = 0;
+        struct dm_target *tgt;
+        struct dm_dev_internal *dd;
+        struct list_head *devices;
+
+        for (i = 0; i < t->num_targets; i++) {
+                tgt = t->targets + i;
+                if (dm_target_request_based(tgt))
+                        request_based = 1;
+                else
+                        bio_based = 1;
+
+                if (bio_based && request_based) {
+                        DMWARN("Inconsistent table: different target types"
+                               " can't be mixed up");
+                        return -EINVAL;
+                }
+        }
+
+        if (bio_based) {
+                /* We must use this table as bio-based */
+                t->type = DM_TYPE_BIO_BASED;
+                return 0;
+        }
+
+        BUG_ON(!request_based); /* No targets in this table */
+
+        /* Non-request-stackable devices can't be used for request-based dm */
+        devices = dm_table_get_devices(t);
+        list_for_each_entry(dd, devices, list) {
+                if (!blk_queue_stackable(bdev_get_queue(dd->dm_dev.bdev))) {
+                        DMWARN("table load rejected: including"
+                               " non-request-stackable devices");
+                        return -EINVAL;
+                }
+        }
+
+        /*
+         * Request-based dm supports only tables that have a single target now.
+         * To support multiple targets, request splitting support is needed,
+         * and that needs lots of changes in the block-layer.
+         * (e.g. request completion process for partial completion.)
+         */
+        if (t->num_targets > 1) {
+                DMWARN("Request-based dm doesn't support multiple targets yet");
+                return -EINVAL;
+        }
+
+        t->type = DM_TYPE_REQUEST_BASED;
+
+        return 0;
+}
+
+unsigned dm_table_get_type(struct dm_table *t)
+{
+        return t->type;
+}
+
+bool dm_table_bio_based(struct dm_table *t)
+{
+        return dm_table_get_type(t) == DM_TYPE_BIO_BASED;
+}
+
+bool dm_table_request_based(struct dm_table *t)
+{
+        return dm_table_get_type(t) == DM_TYPE_REQUEST_BASED;
+}
+
+int dm_table_alloc_md_mempools(struct dm_table *t)
+{
+        unsigned type = dm_table_get_type(t);
+
+        if (unlikely(type == DM_TYPE_NONE)) {
+                DMWARN("no table type is set, can't allocate mempools");
+                return -EINVAL;
+        }
+
+        t->mempools = dm_alloc_md_mempools(type);
+        if (!t->mempools)
+                return -ENOMEM;
+
+        return 0;
+}
+
+void dm_table_free_md_mempools(struct dm_table *t)
+{
+        dm_free_md_mempools(t->mempools);
+        t->mempools = NULL;
+}
+
+struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t)
+{
+        return t->mempools;
+}
+
 static int setup_indexes(struct dm_table *t)
 {
         int i;
@@ -792,8 +901,6 @@ int dm_table_complete(struct dm_table *t)
         int r = 0;
         unsigned int leaf_nodes;
 
-        check_for_valid_limits(&t->limits);
-
         /* how many indexes will the btree have ? */
         leaf_nodes = dm_div_up(t->num_targets, KEYS_PER_NODE);
         t->depth = 1 + int_log(leaf_nodes, CHILDREN_PER_NODE);
@@ -869,6 +976,57 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
 }
 
 /*
+ * Establish the new table's queue_limits and validate them.
+ */
+int dm_calculate_queue_limits(struct dm_table *table,
+                              struct queue_limits *limits)
+{
+        struct dm_target *uninitialized_var(ti);
+        struct queue_limits ti_limits;
+        unsigned i = 0;
+
+        blk_set_default_limits(limits);
+
+        while (i < dm_table_get_num_targets(table)) {
+                blk_set_default_limits(&ti_limits);
+
+                ti = dm_table_get_target(table, i++);
+
+                if (!ti->type->iterate_devices)
+                        goto combine_limits;
+
+                /*
+                 * Combine queue limits of all the devices this target uses.
+                 */
+                ti->type->iterate_devices(ti, dm_set_device_limits,
+                                          &ti_limits);
+
+                /*
+                 * Check each device area is consistent with the target's
+                 * overall queue limits.
+                 */
+                if (!ti->type->iterate_devices(ti, device_area_is_valid,
+                                               &ti_limits))
+                        return -EINVAL;
+
+combine_limits:
+                /*
+                 * Merge this target's queue limits into the overall limits
+                 * for the table.
+                 */
+                if (blk_stack_limits(limits, &ti_limits, 0) < 0)
+                        DMWARN("%s: target device "
+                               "(start sect %llu len %llu) "
+                               "is misaligned",
+                               dm_device_name(table->md),
+                               (unsigned long long) ti->begin,
+                               (unsigned long long) ti->len);
+        }
+
+        return validate_hardware_logical_block_alignment(table, limits);
+}
+
+/*
  * Set the integrity profile for this device if all devices used have
  * matching profiles.
  */
@@ -907,27 +1065,42 @@ no_integrity:
         return;
 }
 
-void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q)
+void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+                               struct queue_limits *limits)
 {
         /*
-         * Make sure we obey the optimistic sub devices
-         * restrictions.
+         * Each target device in the table has a data area that should normally
+         * be aligned such that the DM device's alignment_offset is 0.
+         * FIXME: Propagate alignment_offsets up the stack and warn of
+         *        sub-optimal or inconsistent settings.
+         */
+        limits->alignment_offset = 0;
+        limits->misaligned = 0;
+
+        /*
+         * Copy table's limits to the DM device's request_queue
          */
-        blk_queue_max_sectors(q, t->limits.max_sectors);
-        blk_queue_max_phys_segments(q, t->limits.max_phys_segments);
-        blk_queue_max_hw_segments(q, t->limits.max_hw_segments);
-        blk_queue_logical_block_size(q, t->limits.logical_block_size);
-        blk_queue_max_segment_size(q, t->limits.max_segment_size);
-        blk_queue_max_hw_sectors(q, t->limits.max_hw_sectors);
-        blk_queue_segment_boundary(q, t->limits.seg_boundary_mask);
-        blk_queue_bounce_limit(q, t->limits.bounce_pfn);
-
-        if (t->limits.no_cluster)
+        q->limits = *limits;
+
+        if (limits->no_cluster)
                 queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
         else
                 queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, q);
 
         dm_table_set_integrity(t);
+
+        /*
+         * QUEUE_FLAG_STACKABLE must be set after all queue settings are
+         * visible to other CPUs because, once the flag is set, incoming bios
+         * are processed by request-based dm, which refers to the queue
+         * settings.
+         * Until the flag set, bios are passed to bio-based dm and queued to
+         * md->deferred where queue settings are not needed yet.
+         * Those bios are passed to request-based dm at the resume time.
+         */
+        smp_mb();
+        if (dm_table_request_based(t))
+                queue_flag_set_unlocked(QUEUE_FLAG_STACKABLE, q);
 }
 
 unsigned int dm_table_get_num_targets(struct dm_table *t)
@@ -1023,6 +1196,20 @@ int dm_table_any_congested(struct dm_table *t, int bdi_bits)
         return r;
 }
 
+int dm_table_any_busy_target(struct dm_table *t)
+{
+        unsigned i;
+        struct dm_target *ti;
+
+        for (i = 0; i < t->num_targets; i++) {
+                ti = t->targets + i;
+                if (ti->type->busy && ti->type->busy(ti))
+                        return 1;
+        }
+
+        return 0;
+}
+
 void dm_table_unplug_all(struct dm_table *t)
 {
         struct dm_dev_internal *dd;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 48db308fae67..3c6d4ee8921d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -24,6 +24,13 @@
 
 #define DM_MSG_PREFIX "core"
 
+/*
+ * Cookies are numeric values sent with CHANGE and REMOVE
+ * uevents while resuming, removing or renaming the device.
+ */
+#define DM_COOKIE_ENV_VAR_NAME "DM_COOKIE"
+#define DM_COOKIE_LENGTH 24
+
 static const char *_name = DM_NAME;
 
 static unsigned int major = 0;
@@ -71,7 +78,7 @@ struct dm_rq_target_io {
  */
 struct dm_rq_clone_bio_info {
         struct bio *orig;
-        struct request *rq;
+        struct dm_rq_target_io *tio;
 };
 
 union map_info *dm_get_mapinfo(struct bio *bio)
@@ -81,6 +88,14 @@ union map_info *dm_get_mapinfo(struct bio *bio)
         return NULL;
 }
 
+union map_info *dm_get_rq_mapinfo(struct request *rq)
+{
+        if (rq && rq->end_io_data)
+                return &((struct dm_rq_target_io *)rq->end_io_data)->info;
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(dm_get_rq_mapinfo);
+
 #define MINOR_ALLOCED ((void *)-1)
 
 /*
@@ -157,13 +172,31 @@ struct mapped_device {
          * freeze/thaw support require holding onto a super block
          */
         struct super_block *frozen_sb;
-        struct block_device *suspended_bdev;
+        struct block_device *bdev;
 
         /* forced geometry settings */
         struct hd_geometry geometry;
 
+        /* marker of flush suspend for request-based dm */
+        struct request suspend_rq;
+
+        /* For saving the address of __make_request for request based dm */
+        make_request_fn *saved_make_request_fn;
+
         /* sysfs handle */
         struct kobject kobj;
+
+        /* zero-length barrier that will be cloned and submitted to targets */
+        struct bio barrier_bio;
+};
+
+/*
+ * For mempools pre-allocation at the table loading time.
+ */
+struct dm_md_mempools {
+        mempool_t *io_pool;
+        mempool_t *tio_pool;
+        struct bio_set *bs;
 };
 
 #define MIN_IOS 256
@@ -391,14 +424,29 @@ static void free_io(struct mapped_device *md, struct dm_io *io)
         mempool_free(io, md->io_pool);
 }
 
-static struct dm_target_io *alloc_tio(struct mapped_device *md)
+static void free_tio(struct mapped_device *md, struct dm_target_io *tio)
 {
-        return mempool_alloc(md->tio_pool, GFP_NOIO);
+        mempool_free(tio, md->tio_pool);
 }
 
-static void free_tio(struct mapped_device *md, struct dm_target_io *tio)
+static struct dm_rq_target_io *alloc_rq_tio(struct mapped_device *md)
 {
-        mempool_free(tio, md->tio_pool);
+        return mempool_alloc(md->tio_pool, GFP_ATOMIC);
+}
+
+static void free_rq_tio(struct dm_rq_target_io *tio)
+{
+        mempool_free(tio, tio->md->tio_pool);
+}
+
+static struct dm_rq_clone_bio_info *alloc_bio_info(struct mapped_device *md)
+{
+        return mempool_alloc(md->io_pool, GFP_ATOMIC);
+}
+
+static void free_bio_info(struct dm_rq_clone_bio_info *info)
+{
+        mempool_free(info, info->tio->md->io_pool);
 }
 
 static void start_io_acct(struct dm_io *io)
@@ -464,12 +512,13 @@ static void queue_io(struct mapped_device *md, struct bio *bio)
 struct dm_table *dm_get_table(struct mapped_device *md)
 {
         struct dm_table *t;
+        unsigned long flags;
 
-        read_lock(&md->map_lock);
+        read_lock_irqsave(&md->map_lock, flags);
         t = md->map;
         if (t)
                 dm_table_get(t);
-        read_unlock(&md->map_lock);
+        read_unlock_irqrestore(&md->map_lock, flags);
 
         return t;
 }
@@ -536,9 +585,11 @@ static void dec_pending(struct dm_io *io, int error)
                          * Target requested pushing back the I/O.
                          */
                         spin_lock_irqsave(&md->deferred_lock, flags);
-                        if (__noflush_suspending(md))
-                                bio_list_add_head(&md->deferred, io->bio);
-                        else
+                        if (__noflush_suspending(md)) {
+                                if (!bio_barrier(io->bio))
+                                        bio_list_add_head(&md->deferred,
+                                                          io->bio);
+                        } else
                                 /* noflush suspend was interrupted. */
                                 io->error = -EIO;
                         spin_unlock_irqrestore(&md->deferred_lock, flags);
@@ -553,7 +604,8 @@ static void dec_pending(struct dm_io *io, int error)
                          * a per-device variable for error reporting.
                          * Note that you can't touch the bio after end_io_acct
                          */
-                        md->barrier_error = io_error;
+                        if (!md->barrier_error && io_error != -EOPNOTSUPP)
+                                md->barrier_error = io_error;
                         end_io_acct(io);
                 } else {
                         end_io_acct(io);
@@ -607,6 +659,262 @@ static void clone_endio(struct bio *bio, int error)
         dec_pending(io, error);
 }
 
+/*
+ * Partial completion handling for request-based dm
+ */
+static void end_clone_bio(struct bio *clone, int error)
+{
+        struct dm_rq_clone_bio_info *info = clone->bi_private;
+        struct dm_rq_target_io *tio = info->tio;
+        struct bio *bio = info->orig;
+        unsigned int nr_bytes = info->orig->bi_size;
+
+        bio_put(clone);
+
+        if (tio->error)
+                /*
+                 * An error has already been detected on the request.
+                 * Once error occurred, just let clone->end_io() handle
+                 * the remainder.
+                 */
+                return;
+        else if (error) {
+                /*
+                 * Don't notice the error to the upper layer yet.
+                 * The error handling decision is made by the target driver,
+                 * when the request is completed.
+                 */
+                tio->error = error;
+                return;
+        }
+
+        /*
+         * I/O for the bio successfully completed.
+         * Notice the data completion to the upper layer.
+         */
+
+        /*
+         * bios are processed from the head of the list.
+         * So the completing bio should always be rq->bio.
+         * If it's not, something wrong is happening.
+         */
+        if (tio->orig->bio != bio)
+                DMERR("bio completion is going in the middle of the request");
+
+        /*
+         * Update the original request.
+         * Do not use blk_end_request() here, because it may complete
+         * the original request before the clone, and break the ordering.
+         */
+        blk_update_request(tio->orig, 0, nr_bytes);
+}
+
+/*
+ * Don't touch any member of the md after calling this function because
+ * the md may be freed in dm_put() at the end of this function.
+ * Or do dm_get() before calling this function and dm_put() later.
+ */
+static void rq_completed(struct mapped_device *md, int run_queue)
+{
+        int wakeup_waiters = 0;
+        struct request_queue *q = md->queue;
+        unsigned long flags;
+
+        spin_lock_irqsave(q->queue_lock, flags);
+        if (!queue_in_flight(q))
+                wakeup_waiters = 1;
+        spin_unlock_irqrestore(q->queue_lock, flags);
+
+        /* nudge anyone waiting on suspend queue */
+        if (wakeup_waiters)
+                wake_up(&md->wait);
+
+        if (run_queue)
+                blk_run_queue(q);
+
+        /*
+         * dm_put() must be at the end of this function. See the comment above
+         */
+        dm_put(md);
+}
+
+static void dm_unprep_request(struct request *rq)
+{
+        struct request *clone = rq->special;
+        struct dm_rq_target_io *tio = clone->end_io_data;
+
+        rq->special = NULL;
+        rq->cmd_flags &= ~REQ_DONTPREP;
+
+        blk_rq_unprep_clone(clone);
+        free_rq_tio(tio);
+}
+
+/*
+ * Requeue the original request of a clone.
+ */
+void dm_requeue_unmapped_request(struct request *clone)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        struct mapped_device *md = tio->md;
+        struct request *rq = tio->orig;
+        struct request_queue *q = rq->q;
+        unsigned long flags;
+
+        dm_unprep_request(rq);
+
+        spin_lock_irqsave(q->queue_lock, flags);
+        if (elv_queue_empty(q))
+                blk_plug_device(q);
+        blk_requeue_request(q, rq);
+        spin_unlock_irqrestore(q->queue_lock, flags);
+
+        rq_completed(md, 0);
+}
+EXPORT_SYMBOL_GPL(dm_requeue_unmapped_request);
+
+static void __stop_queue(struct request_queue *q)
+{
+        blk_stop_queue(q);
+}
+
+static void stop_queue(struct request_queue *q)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(q->queue_lock, flags);
+        __stop_queue(q);
+        spin_unlock_irqrestore(q->queue_lock, flags);
+}
+
+static void __start_queue(struct request_queue *q)
+{
+        if (blk_queue_stopped(q))
+                blk_start_queue(q);
+}
+
+static void start_queue(struct request_queue *q)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(q->queue_lock, flags);
+        __start_queue(q);
+        spin_unlock_irqrestore(q->queue_lock, flags);
+}
+
+/*
+ * Complete the clone and the original request.
+ * Must be called without queue lock.
+ */
+static void dm_end_request(struct request *clone, int error)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        struct mapped_device *md = tio->md;
+        struct request *rq = tio->orig;
+
+        if (blk_pc_request(rq)) {
+                rq->errors = clone->errors;
+                rq->resid_len = clone->resid_len;
+
+                if (rq->sense)
+                        /*
+                         * We are using the sense buffer of the original
+                         * request.
+                         * So setting the length of the sense data is enough.
+                         */
+                        rq->sense_len = clone->sense_len;
+        }
+
+        BUG_ON(clone->bio);
+        free_rq_tio(tio);
+
+        blk_end_request_all(rq, error);
+
+        rq_completed(md, 1);
+}
+
+/*
+ * Request completion handler for request-based dm
+ */
+static void dm_softirq_done(struct request *rq)
+{
+        struct request *clone = rq->completion_data;
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
+        int error = tio->error;
+
+        if (!(rq->cmd_flags & REQ_FAILED) && rq_end_io)
+                error = rq_end_io(tio->ti, clone, error, &tio->info);
+
+        if (error <= 0)
+                /* The target wants to complete the I/O */
+                dm_end_request(clone, error);
+        else if (error == DM_ENDIO_INCOMPLETE)
+                /* The target will handle the I/O */
+                return;
+        else if (error == DM_ENDIO_REQUEUE)
+                /* The target wants to requeue the I/O */
+                dm_requeue_unmapped_request(clone);
+        else {
+                DMWARN("unimplemented target endio return value: %d", error);
+                BUG();
+        }
+}
+
+/*
+ * Complete the clone and the original request with the error status
+ * through softirq context.
+ */
+static void dm_complete_request(struct request *clone, int error)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        struct request *rq = tio->orig;
+
+        tio->error = error;
+        rq->completion_data = clone;
+        blk_complete_request(rq);
+}
+
+/*
+ * Complete the not-mapped clone and the original request with the error status
+ * through softirq context.
+ * Target's rq_end_io() function isn't called.
+ * This may be used when the target's map_rq() function fails.
+ */
+void dm_kill_unmapped_request(struct request *clone, int error)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        struct request *rq = tio->orig;
+
+        rq->cmd_flags |= REQ_FAILED;
+        dm_complete_request(clone, error);
+}
+EXPORT_SYMBOL_GPL(dm_kill_unmapped_request);
+
+/*
+ * Called with the queue lock held
+ */
+static void end_clone_request(struct request *clone, int error)
+{
+        /*
+         * For just cleaning up the information of the queue in which
+         * the clone was dispatched.
+         * The clone is *NOT* freed actually here because it is alloced from
+         * dm own mempool and REQ_ALLOCED isn't set in clone->cmd_flags.
+         */
+        __blk_put_request(clone->q, clone);
+
+        /*
+         * Actual request completion is done in a softirq context which doesn't
+         * hold the queue lock.  Otherwise, deadlock could occur because:
+         *     - another request may be submitted by the upper level driver
+         *       of the stacking during the completion
+         *     - the submission which requires queue lock may be done
+         *       against this queue
+         */
+        dm_complete_request(clone, error);
+}
+
 static sector_t max_io_len(struct mapped_device *md,
                            sector_t sector, struct dm_target *ti)
 {
@@ -634,11 +942,6 @@ static void __map_bio(struct dm_target *ti, struct bio *clone,
         sector_t sector;
         struct mapped_device *md;
 
-        /*
-         * Sanity checks.
-         */
-        BUG_ON(!clone->bi_size);
-
         clone->bi_end_io = clone_endio;
         clone->bi_private = tio;
 
@@ -752,6 +1055,48 @@ static struct bio *clone_bio(struct bio *bio, sector_t sector,
         return clone;
 }
 
+static struct dm_target_io *alloc_tio(struct clone_info *ci,
+                                      struct dm_target *ti)
+{
+        struct dm_target_io *tio = mempool_alloc(ci->md->tio_pool, GFP_NOIO);
+
+        tio->io = ci->io;
+        tio->ti = ti;
+        memset(&tio->info, 0, sizeof(tio->info));
+
+        return tio;
+}
+
+static void __flush_target(struct clone_info *ci, struct dm_target *ti,
+                          unsigned flush_nr)
+{
+        struct dm_target_io *tio = alloc_tio(ci, ti);
+        struct bio *clone;
+
+        tio->info.flush_request = flush_nr;
+
+        clone = bio_alloc_bioset(GFP_NOIO, 0, ci->md->bs);
+        __bio_clone(clone, ci->bio);
+        clone->bi_destructor = dm_bio_destructor;
+
+        __map_bio(ti, clone, tio);
+}
+
+static int __clone_and_map_empty_barrier(struct clone_info *ci)
+{
+        unsigned target_nr = 0, flush_nr;
+        struct dm_target *ti;
+
+        while ((ti = dm_table_get_target(ci->map, target_nr++)))
+                for (flush_nr = 0; flush_nr < ti->num_flush_requests;
+                     flush_nr++)
+                        __flush_target(ci, ti, flush_nr);
+
+        ci->sector_count = 0;
+
+        return 0;
+}
+
 static int __clone_and_map(struct clone_info *ci)
 {
         struct bio *clone, *bio = ci->bio;
@@ -759,6 +1104,9 @@ static int __clone_and_map(struct clone_info *ci)
         sector_t len = 0, max;
         struct dm_target_io *tio;
 
+        if (unlikely(bio_empty_barrier(bio)))
+                return __clone_and_map_empty_barrier(ci);
+
         ti = dm_table_find_target(ci->map, ci->sector);
         if (!dm_target_is_valid(ti))
                 return -EIO;
@@ -768,10 +1116,7 @@ static int __clone_and_map(struct clone_info *ci)
         /*
          * Allocate a target io object.
          */
-        tio = alloc_tio(ci->md);
-        tio->io = ci->io;
-        tio->ti = ti;
-        memset(&tio->info, 0, sizeof(tio->info));
+        tio = alloc_tio(ci, ti);
 
         if (ci->sector_count <= max) {
                 /*
@@ -827,10 +1172,7 @@ static int __clone_and_map(struct clone_info *ci)
 
                                 max = max_io_len(ci->md, ci->sector, ti);
 
-                                tio = alloc_tio(ci->md);
-                                tio->io = ci->io;
-                                tio->ti = ti;
-                                memset(&tio->info, 0, sizeof(tio->info));
+                                tio = alloc_tio(ci, ti);
                         }
 
                         len = min(remaining, max);
@@ -865,7 +1207,8 @@ static void __split_and_process_bio(struct mapped_device *md, struct bio *bio)
                 if (!bio_barrier(bio))
                         bio_io_error(bio);
                 else
-                        md->barrier_error = -EIO;
+                        if (!md->barrier_error)
+                                md->barrier_error = -EIO;
                 return;
         }
 
@@ -878,6 +1221,8 @@ static void __split_and_process_bio(struct mapped_device *md, struct bio *bio)
         ci.io->md = md;
         ci.sector = bio->bi_sector;
         ci.sector_count = bio_sectors(bio);
+        if (unlikely(bio_empty_barrier(bio)))
+                ci.sector_count = 1;
         ci.idx = bio->bi_idx;
 
         start_io_acct(ci.io);
@@ -925,6 +1270,16 @@ static int dm_merge_bvec(struct request_queue *q,
          */
         if (max_size && ti->type->merge)
                 max_size = ti->type->merge(ti, bvm, biovec, max_size);
+        /*
+         * If the target doesn't support merge method and some of the devices
+         * provided their merge_bvec method (we know this by looking at
+         * queue_max_hw_sectors), then we can't allow bios with multiple vector
+         * entries.  So always set max_size to 0, and the code below allows
+         * just one page.
+         */
+        else if (queue_max_hw_sectors(q) <= PAGE_SIZE >> 9)
+
+                max_size = 0;
 
 out_table:
         dm_table_put(map);
@@ -943,7 +1298,7 @@ out:
  * The request function that just remaps the bio built up by
  * dm_merge_bvec.
  */
-static int dm_request(struct request_queue *q, struct bio *bio)
+static int _dm_request(struct request_queue *q, struct bio *bio)
 {
         int rw = bio_data_dir(bio);
         struct mapped_device *md = q->queuedata;
@@ -980,12 +1335,274 @@ static int dm_request(struct request_queue *q, struct bio *bio)
         return 0;
 }
 
+static int dm_make_request(struct request_queue *q, struct bio *bio)
+{
+        struct mapped_device *md = q->queuedata;
+
+        if (unlikely(bio_barrier(bio))) {
+                bio_endio(bio, -EOPNOTSUPP);
+                return 0;
+        }
+
+        return md->saved_make_request_fn(q, bio); /* call __make_request() */
+}
+
+static int dm_request_based(struct mapped_device *md)
+{
+        return blk_queue_stackable(md->queue);
+}
+
+static int dm_request(struct request_queue *q, struct bio *bio)
+{
+        struct mapped_device *md = q->queuedata;
+
+        if (dm_request_based(md))
+                return dm_make_request(q, bio);
+
+        return _dm_request(q, bio);
+}
+
+void dm_dispatch_request(struct request *rq)
+{
+        int r;
+
+        if (blk_queue_io_stat(rq->q))
+                rq->cmd_flags |= REQ_IO_STAT;
+
+        rq->start_time = jiffies;
+        r = blk_insert_cloned_request(rq->q, rq);
+        if (r)
+                dm_complete_request(rq, r);
+}
+EXPORT_SYMBOL_GPL(dm_dispatch_request);
+
+static void dm_rq_bio_destructor(struct bio *bio)
+{
+        struct dm_rq_clone_bio_info *info = bio->bi_private;
+        struct mapped_device *md = info->tio->md;
+
+        free_bio_info(info);
+        bio_free(bio, md->bs);
+}
+
+static int dm_rq_bio_constructor(struct bio *bio, struct bio *bio_orig,
+                                 void *data)
+{
+        struct dm_rq_target_io *tio = data;
+        struct mapped_device *md = tio->md;
+        struct dm_rq_clone_bio_info *info = alloc_bio_info(md);
+
+        if (!info)
+                return -ENOMEM;
+
+        info->orig = bio_orig;
+        info->tio = tio;
+        bio->bi_end_io = end_clone_bio;
+        bio->bi_private = info;
+        bio->bi_destructor = dm_rq_bio_destructor;
+
+        return 0;
+}
+
+static int setup_clone(struct request *clone, struct request *rq,
+                       struct dm_rq_target_io *tio)
+{
+        int r = blk_rq_prep_clone(clone, rq, tio->md->bs, GFP_ATOMIC,
+                                  dm_rq_bio_constructor, tio);
+
+        if (r)
+                return r;
+
+        clone->cmd = rq->cmd;
+        clone->cmd_len = rq->cmd_len;
+        clone->sense = rq->sense;
+        clone->buffer = rq->buffer;
+        clone->end_io = end_clone_request;
+        clone->end_io_data = tio;
+
+        return 0;
+}
+
+static int dm_rq_flush_suspending(struct mapped_device *md)
+{
+        return !md->suspend_rq.special;
+}
+
+/*
+ * Called with the queue lock held.
+ */
+static int dm_prep_fn(struct request_queue *q, struct request *rq)
+{
+        struct mapped_device *md = q->queuedata;
+        struct dm_rq_target_io *tio;
+        struct request *clone;
+
+        if (unlikely(rq == &md->suspend_rq)) {
+                if (dm_rq_flush_suspending(md))
+                        return BLKPREP_OK;
+                else
+                        /* The flush suspend was interrupted */
+                        return BLKPREP_KILL;
+        }
+
+        if (unlikely(rq->special)) {
+                DMWARN("Already has something in rq->special.");
+                return BLKPREP_KILL;
+        }
+
+        tio = alloc_rq_tio(md); /* Only one for each original request */
+        if (!tio)
+                /* -ENOMEM */
+                return BLKPREP_DEFER;
+
+        tio->md = md;
+        tio->ti = NULL;
+        tio->orig = rq;
+        tio->error = 0;
+        memset(&tio->info, 0, sizeof(tio->info));
+
+        clone = &tio->clone;
+        if (setup_clone(clone, rq, tio)) {
+                /* -ENOMEM */
+                free_rq_tio(tio);
+                return BLKPREP_DEFER;
+        }
+
+        rq->special = clone;
+        rq->cmd_flags |= REQ_DONTPREP;
+
+        return BLKPREP_OK;
+}
+
+static void map_request(struct dm_target *ti, struct request *rq,
+                        struct mapped_device *md)
+{
+        int r;
+        struct request *clone = rq->special;
+        struct dm_rq_target_io *tio = clone->end_io_data;
+
+        /*
+         * Hold the md reference here for the in-flight I/O.
+         * We can't rely on the reference count by device opener,
+         * because the device may be closed during the request completion
+         * when all bios are completed.
+         * See the comment in rq_completed() too.
+         */
+        dm_get(md);
+
+        tio->ti = ti;
+        r = ti->type->map_rq(ti, clone, &tio->info);
+        switch (r) {
+        case DM_MAPIO_SUBMITTED:
+                /* The target has taken the I/O to submit by itself later */
+                break;
+        case DM_MAPIO_REMAPPED:
+                /* The target has remapped the I/O so dispatch it */
+                dm_dispatch_request(clone);
+                break;
+        case DM_MAPIO_REQUEUE:
+                /* The target wants to requeue the I/O */
+                dm_requeue_unmapped_request(clone);
+                break;
+        default:
+                if (r > 0) {
+                        DMWARN("unimplemented target map return value: %d", r);
+                        BUG();
+                }
+
+                /* The target wants to complete the I/O */
+                dm_kill_unmapped_request(clone, r);
+                break;
+        }
+}
+
+/*
+ * q->request_fn for request-based dm.
+ * Called with the queue lock held.
+ */
+static void dm_request_fn(struct request_queue *q)
+{
+        struct mapped_device *md = q->queuedata;
+        struct dm_table *map = dm_get_table(md);
+        struct dm_target *ti;
+        struct request *rq;
+
+        /*
+         * For noflush suspend, check blk_queue_stopped() to immediately
+         * quit I/O dispatching.
+         */
+        while (!blk_queue_plugged(q) && !blk_queue_stopped(q)) {
+                rq = blk_peek_request(q);
+                if (!rq)
+                        goto plug_and_out;
+
+                if (unlikely(rq == &md->suspend_rq)) { /* Flush suspend maker */
+                        if (queue_in_flight(q))
+                                /* Not quiet yet.  Wait more */
+                                goto plug_and_out;
+
+                        /* This device should be quiet now */
+                        __stop_queue(q);
+                        blk_start_request(rq);
+                        __blk_end_request_all(rq, 0);
+                        wake_up(&md->wait);
+                        goto out;
+                }
+
+                ti = dm_table_find_target(map, blk_rq_pos(rq));
+                if (ti->type->busy && ti->type->busy(ti))
+                        goto plug_and_out;
+
+                blk_start_request(rq);
+                spin_unlock(q->queue_lock);
+                map_request(ti, rq, md);
+                spin_lock_irq(q->queue_lock);
+        }
+
+        goto out;
+
+plug_and_out:
+        if (!elv_queue_empty(q))
+                /* Some requests still remain, retry later */
+                blk_plug_device(q);
+
+out:
+        dm_table_put(map);
+
+        return;
+}
+
+int dm_underlying_device_busy(struct request_queue *q)
+{
+        return blk_lld_busy(q);
+}
+EXPORT_SYMBOL_GPL(dm_underlying_device_busy);
+
+static int dm_lld_busy(struct request_queue *q)
+{
+        int r;
+        struct mapped_device *md = q->queuedata;
+        struct dm_table *map = dm_get_table(md);
+
+        if (!map || test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))
+                r = 1;
+        else
+                r = dm_table_any_busy_target(map);
+
+        dm_table_put(map);
+
+        return r;
+}
+
 static void dm_unplug_all(struct request_queue *q)
 {
         struct mapped_device *md = q->queuedata;
         struct dm_table *map = dm_get_table(md);
 
         if (map) {
+                if (dm_request_based(md))
+                        generic_unplug_device(q);
+
                 dm_table_unplug_all(map);
                 dm_table_put(map);
         }
@@ -1000,7 +1617,16 @@ static int dm_any_congested(void *congested_data, int bdi_bits)
         if (!test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) {
                 map = dm_get_table(md);
                 if (map) {
-                        r = dm_table_any_congested(map, bdi_bits);
+                        /*
+                         * Request-based dm cares about only own queue for
+                         * the query about congestion status of request_queue
+                         */
+                        if (dm_request_based(md))
+                                r = md->queue->backing_dev_info.state &
+                                    bdi_bits;
+                        else
+                                r = dm_table_any_congested(map, bdi_bits);
+
                         dm_table_put(map);
                 }
         }
@@ -1123,30 +1749,32 @@ static struct mapped_device *alloc_dev(int minor)
         INIT_LIST_HEAD(&md->uevent_list);
         spin_lock_init(&md->uevent_lock);
 
-        md->queue = blk_alloc_queue(GFP_KERNEL);
+        md->queue = blk_init_queue(dm_request_fn, NULL);
         if (!md->queue)
                 goto bad_queue;
 
+        /*
+         * Request-based dm devices cannot be stacked on top of bio-based dm
+         * devices.  The type of this dm device has not been decided yet,
+         * although we initialized the queue using blk_init_queue().
+         * The type is decided at the first table loading time.
+         * To prevent problematic device stacking, clear the queue flag
+         * for request stacking support until then.
+         *
+         * This queue is new, so no concurrency on the queue_flags.
+         */
+        queue_flag_clear_unlocked(QUEUE_FLAG_STACKABLE, md->queue);
+        md->saved_make_request_fn = md->queue->make_request_fn;
         md->queue->queuedata = md;
         md->queue->backing_dev_info.congested_fn = dm_any_congested;
         md->queue->backing_dev_info.congested_data = md;
         blk_queue_make_request(md->queue, dm_request);
-        blk_queue_ordered(md->queue, QUEUE_ORDERED_DRAIN, NULL);
         blk_queue_bounce_limit(md->queue, BLK_BOUNCE_ANY);
         md->queue->unplug_fn = dm_unplug_all;
         blk_queue_merge_bvec(md->queue, dm_merge_bvec);
-
-        md->io_pool = mempool_create_slab_pool(MIN_IOS, _io_cache);
-        if (!md->io_pool)
-                goto bad_io_pool;
-
-        md->tio_pool = mempool_create_slab_pool(MIN_IOS, _tio_cache);
-        if (!md->tio_pool)
-                goto bad_tio_pool;
-
-        md->bs = bioset_create(16, 0);
-        if (!md->bs)
-                goto bad_no_bioset;
+        blk_queue_softirq_done(md->queue, dm_softirq_done);
+        blk_queue_prep_rq(md->queue, dm_prep_fn);
+        blk_queue_lld_busy(md->queue, dm_lld_busy);
 
         md->disk = alloc_disk(1);
         if (!md->disk)
@@ -1170,6 +1798,10 @@ static struct mapped_device *alloc_dev(int minor)
         if (!md->wq)
                 goto bad_thread;
 
+        md->bdev = bdget_disk(md->disk, 0);
+        if (!md->bdev)
+                goto bad_bdev;
+
         /* Populate the mapping, nobody knows we exist yet */
         spin_lock(&_minor_lock);
         old_md = idr_replace(&_minor_idr, md, minor);
@@ -1179,15 +1811,11 @@ static struct mapped_device *alloc_dev(int minor)
 
         return md;
 
+bad_bdev:
+        destroy_workqueue(md->wq);
 bad_thread:
         put_disk(md->disk);
 bad_disk:
-        bioset_free(md->bs);
-bad_no_bioset:
-        mempool_destroy(md->tio_pool);
-bad_tio_pool:
-        mempool_destroy(md->io_pool);
-bad_io_pool:
         blk_cleanup_queue(md->queue);
 bad_queue:
         free_minor(minor);
@@ -1204,14 +1832,15 @@ static void free_dev(struct mapped_device *md)
 {
         int minor = MINOR(disk_devt(md->disk));
 
-        if (md->suspended_bdev) {
-                unlock_fs(md);
-                bdput(md->suspended_bdev);
-        }
+        unlock_fs(md);
+        bdput(md->bdev);
         destroy_workqueue(md->wq);
-        mempool_destroy(md->tio_pool);
-        mempool_destroy(md->io_pool);
-        bioset_free(md->bs);
+        if (md->tio_pool)
+                mempool_destroy(md->tio_pool);
+        if (md->io_pool)
+                mempool_destroy(md->io_pool);
+        if (md->bs)
+                bioset_free(md->bs);
         blk_integrity_unregister(md->disk);
         del_gendisk(md->disk);
         free_minor(minor);
@@ -1226,6 +1855,29 @@ static void free_dev(struct mapped_device *md)
         kfree(md);
 }
 
+static void __bind_mempools(struct mapped_device *md, struct dm_table *t)
+{
+        struct dm_md_mempools *p;
+
+        if (md->io_pool && md->tio_pool && md->bs)
+                /* the md already has necessary mempools */
+                goto out;
+
+        p = dm_table_get_md_mempools(t);
+        BUG_ON(!p || md->io_pool || md->tio_pool || md->bs);
+
+        md->io_pool = p->io_pool;
+        p->io_pool = NULL;
+        md->tio_pool = p->tio_pool;
+        p->tio_pool = NULL;
+        md->bs = p->bs;
+        p->bs = NULL;
+
+out:
+        /* mempool bind completed, now no need any mempools in the table */
+        dm_table_free_md_mempools(t);
+}
+
 /*
  * Bind a table to the device.
  */
@@ -1249,15 +1901,17 @@ static void __set_size(struct mapped_device *md, sector_t size)
 {
         set_capacity(md->disk, size);
 
-        mutex_lock(&md->suspended_bdev->bd_inode->i_mutex);
-        i_size_write(md->suspended_bdev->bd_inode, (loff_t)size << SECTOR_SHIFT);
-        mutex_unlock(&md->suspended_bdev->bd_inode->i_mutex);
+        mutex_lock(&md->bdev->bd_inode->i_mutex);
+        i_size_write(md->bdev->bd_inode, (loff_t)size << SECTOR_SHIFT);
+        mutex_unlock(&md->bdev->bd_inode->i_mutex);
 }
 
-static int __bind(struct mapped_device *md, struct dm_table *t)
+static int __bind(struct mapped_device *md, struct dm_table *t,
+                  struct queue_limits *limits)
 {
         struct request_queue *q = md->queue;
         sector_t size;
+        unsigned long flags;
 
         size = dm_table_get_size(t);
 
@@ -1267,8 +1921,7 @@ static int __bind(struct mapped_device *md, struct dm_table *t)
         if (size != get_capacity(md->disk))
                 memset(&md->geometry, 0, sizeof(md->geometry));
 
-        if (md->suspended_bdev)
-                __set_size(md, size);
+        __set_size(md, size);
 
         if (!size) {
                 dm_table_destroy(t);
@@ -1277,10 +1930,22 @@ static int __bind(struct mapped_device *md, struct dm_table *t)
 
         dm_table_event_callback(t, event_callback, md);
 
-        write_lock(&md->map_lock);
+        /*
+         * The queue hasn't been stopped yet, if the old table type wasn't
+         * for request-based during suspension.  So stop it to prevent
+         * I/O mapping before resume.
+         * This must be done before setting the queue restrictions,
+         * because request-based dm may be run just after the setting.
+         */
+        if (dm_table_request_based(t) && !blk_queue_stopped(q))
+                stop_queue(q);
+
+        __bind_mempools(md, t);
+
+        write_lock_irqsave(&md->map_lock, flags);
         md->map = t;
-        dm_table_set_restrictions(t, q);
-        write_unlock(&md->map_lock);
+        dm_table_set_restrictions(t, q, limits);
+        write_unlock_irqrestore(&md->map_lock, flags);
 
         return 0;
 }
@@ -1288,14 +1953,15 @@ static int __bind(struct mapped_device *md, struct dm_table *t)
 static void __unbind(struct mapped_device *md)
 {
         struct dm_table *map = md->map;
+        unsigned long flags;
 
         if (!map)
                 return;
 
         dm_table_event_callback(map, NULL, NULL);
-        write_lock(&md->map_lock);
+        write_lock_irqsave(&md->map_lock, flags);
         md->map = NULL;
-        write_unlock(&md->map_lock);
+        write_unlock_irqrestore(&md->map_lock, flags);
         dm_table_destroy(map);
 }
 
@@ -1399,6 +2065,8 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
 {
         int r = 0;
         DECLARE_WAITQUEUE(wait, current);
+        struct request_queue *q = md->queue;
+        unsigned long flags;
 
         dm_unplug_all(md->queue);
 
@@ -1408,7 +2076,14 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
                 set_current_state(interruptible);
 
                 smp_mb();
-                if (!atomic_read(&md->pending))
+                if (dm_request_based(md)) {
+                        spin_lock_irqsave(q->queue_lock, flags);
+                        if (!queue_in_flight(q) && blk_queue_stopped(q)) {
+                                spin_unlock_irqrestore(q->queue_lock, flags);
+                                break;
+                        }
+                        spin_unlock_irqrestore(q->queue_lock, flags);
+                } else if (!atomic_read(&md->pending))
                         break;
 
                 if (interruptible == TASK_INTERRUPTIBLE &&
@@ -1426,34 +2101,36 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
         return r;
 }
 
-static int dm_flush(struct mapped_device *md)
+static void dm_flush(struct mapped_device *md)
 {
         dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
-        return 0;
+
+        bio_init(&md->barrier_bio);
+        md->barrier_bio.bi_bdev = md->bdev;
+        md->barrier_bio.bi_rw = WRITE_BARRIER;
+        __split_and_process_bio(md, &md->barrier_bio);
+
+        dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
 }
 
 static void process_barrier(struct mapped_device *md, struct bio *bio)
 {
-        int error = dm_flush(md);
-
-        if (unlikely(error)) {
-                bio_endio(bio, error);
-                return;
-        }
-        if (bio_empty_barrier(bio)) {
-                bio_endio(bio, 0);
-                return;
-        }
-
-        __split_and_process_bio(md, bio);
+        md->barrier_error = 0;
 
-        error = dm_flush(md);
+        dm_flush(md);
 
-        if (!error && md->barrier_error)
-                error = md->barrier_error;
+        if (!bio_empty_barrier(bio)) {
+                __split_and_process_bio(md, bio);
+                dm_flush(md);
+        }
 
         if (md->barrier_error != DM_ENDIO_REQUEUE)
-                bio_endio(bio, error);
+                bio_endio(bio, md->barrier_error);
+        else {
+                spin_lock_irq(&md->deferred_lock);
+                bio_list_add_head(&md->deferred, bio);
+                spin_unlock_irq(&md->deferred_lock);
+        }
 }
 
 /*
@@ -1479,10 +2156,14 @@ static void dm_wq_work(struct work_struct *work)
 
                 up_write(&md->io_lock);
 
-                if (bio_barrier(c))
-                        process_barrier(md, c);
-                else
-                        __split_and_process_bio(md, c);
+                if (dm_request_based(md))
+                        generic_make_request(c);
+                else {
+                        if (bio_barrier(c))
+                                process_barrier(md, c);
+                        else
+                                __split_and_process_bio(md, c);
+                }
 
                 down_write(&md->io_lock);
         }
@@ -1502,6 +2183,7 @@ static void dm_queue_flush(struct mapped_device *md)
  */
 int dm_swap_table(struct mapped_device *md, struct dm_table *table)
 {
+        struct queue_limits limits;
         int r = -EINVAL;
 
         mutex_lock(&md->suspend_lock);
@@ -1510,19 +2192,96 @@ int dm_swap_table(struct mapped_device *md, struct dm_table *table)
         if (!dm_suspended(md))
                 goto out;
 
-        /* without bdev, the device size cannot be changed */
-        if (!md->suspended_bdev)
-                if (get_capacity(md->disk) != dm_table_get_size(table))
-                        goto out;
+        r = dm_calculate_queue_limits(table, &limits);
+        if (r)
+                goto out;
+
+        /* cannot change the device type, once a table is bound */
+        if (md->map &&
+            (dm_table_get_type(md->map) != dm_table_get_type(table))) {
+                DMWARN("can't change the device type after a table is bound");
+                goto out;
+        }
+
+        /*
+         * It is enought that blk_queue_ordered() is called only once when
+         * the first bio-based table is bound.
+         *
+         * This setting should be moved to alloc_dev() when request-based dm
+         * supports barrier.
+         */
+        if (!md->map && dm_table_bio_based(table))
+                blk_queue_ordered(md->queue, QUEUE_ORDERED_DRAIN, NULL);
 
         __unbind(md);
-        r = __bind(md, table);
+        r = __bind(md, table, &limits);
 
 out:
         mutex_unlock(&md->suspend_lock);
         return r;
 }
 
+static void dm_rq_invalidate_suspend_marker(struct mapped_device *md)
+{
+        md->suspend_rq.special = (void *)0x1;
+}
+
+static void dm_rq_abort_suspend(struct mapped_device *md, int noflush)
+{
+        struct request_queue *q = md->queue;
+        unsigned long flags;
+
+        spin_lock_irqsave(q->queue_lock, flags);
+        if (!noflush)
+                dm_rq_invalidate_suspend_marker(md);
+        __start_queue(q);
+        spin_unlock_irqrestore(q->queue_lock, flags);
+}
+
+static void dm_rq_start_suspend(struct mapped_device *md, int noflush)
+{
+        struct request *rq = &md->suspend_rq;
+        struct request_queue *q = md->queue;
+
+        if (noflush)
+                stop_queue(q);
+        else {
+                blk_rq_init(q, rq);
+                blk_insert_request(q, rq, 0, NULL);
+        }
+}
+
+static int dm_rq_suspend_available(struct mapped_device *md, int noflush)
+{
+        int r = 1;
+        struct request *rq = &md->suspend_rq;
+        struct request_queue *q = md->queue;
+        unsigned long flags;
+
+        if (noflush)
+                return r;
+
+        /* The marker must be protected by queue lock if it is in use */
+        spin_lock_irqsave(q->queue_lock, flags);
+        if (unlikely(rq->ref_count)) {
+                /*
+                 * This can happen, when the previous flush suspend was
+                 * interrupted, the marker is still in the queue and
+                 * this flush suspend has been invoked, because we don't
+                 * remove the marker at the time of suspend interruption.
+                 * We have only one marker per mapped_device, so we can't
+                 * start another flush suspend while it is in use.
+                 */
+                BUG_ON(!rq->special); /* The marker should be invalidated */
+                DMWARN("Invalidating the previous flush suspend is still in"
+                       " progress.  Please retry later.");
+                r = 0;
+        }
+        spin_unlock_irqrestore(q->queue_lock, flags);
+
+        return r;
+}
+
 /*
  * Functions to lock and unlock any filesystem running on the
  * device.
@@ -1533,7 +2292,7 @@ static int lock_fs(struct mapped_device *md)
 
         WARN_ON(md->frozen_sb);
 
-        md->frozen_sb = freeze_bdev(md->suspended_bdev);
+        md->frozen_sb = freeze_bdev(md->bdev);
         if (IS_ERR(md->frozen_sb)) {
                 r = PTR_ERR(md->frozen_sb);
                 md->frozen_sb = NULL;
@@ -1542,9 +2301,6 @@ static int lock_fs(struct mapped_device *md)
 
         set_bit(DMF_FROZEN, &md->flags);
 
-        /* don't bdput right now, we don't want the bdev
-         * to go away while it is locked.
-         */
         return 0;
 }
 
@@ -1553,7 +2309,7 @@ static void unlock_fs(struct mapped_device *md)
         if (!test_bit(DMF_FROZEN, &md->flags))
                 return;
 
-        thaw_bdev(md->suspended_bdev, md->frozen_sb);
+        thaw_bdev(md->bdev, md->frozen_sb);
         md->frozen_sb = NULL;
         clear_bit(DMF_FROZEN, &md->flags);
 }
@@ -1565,6 +2321,53 @@ static void unlock_fs(struct mapped_device *md)
  * dm_bind_table, dm_suspend must be called to flush any in
  * flight bios and ensure that any further io gets deferred.
  */
+/*
+ * Suspend mechanism in request-based dm.
+ *
+ * After the suspend starts, further incoming requests are kept in
+ * the request_queue and deferred.
+ * Remaining requests in the request_queue at the start of suspend are flushed
+ * if it is flush suspend.
+ * The suspend completes when the following conditions have been satisfied,
+ * so wait for it:
+ *    1. q->in_flight is 0 (which means no in_flight request)
+ *    2. queue has been stopped (which means no request dispatching)
+ *
+ *
+ * Noflush suspend
+ * ---------------
+ * Noflush suspend doesn't need to dispatch remaining requests.
+ * So stop the queue immediately.  Then, wait for all in_flight requests
+ * to be completed or requeued.
+ *
+ * To abort noflush suspend, start the queue.
+ *
+ *
+ * Flush suspend
+ * -------------
+ * Flush suspend needs to dispatch remaining requests.  So stop the queue
+ * after the remaining requests are completed. (Requeued request must be also
+ * re-dispatched and completed.  Until then, we can't stop the queue.)
+ *
+ * During flushing the remaining requests, further incoming requests are also
+ * inserted to the same queue.  To distinguish which requests are to be
+ * flushed, we insert a marker request to the queue at the time of starting
+ * flush suspend, like a barrier.
+ * The dispatching is blocked when the marker is found on the top of the queue.
+ * And the queue is stopped when all in_flight requests are completed, since
+ * that means the remaining requests are completely flushed.
+ * Then, the marker is removed from the queue.
+ *
+ * To abort flush suspend, we also need to take care of the marker, not only
+ * starting the queue.
+ * We don't remove the marker forcibly from the queue since it's against
+ * the block-layer manner.  Instead, we put a invalidated mark on the marker.
+ * When the invalidated marker is found on the top of the queue, it is
+ * immediately removed from the queue, so it doesn't block dispatching.
+ * Because we have only one marker per mapped_device, we can't start another
+ * flush suspend until the invalidated marker is removed from the queue.
+ * So fail and return with -EBUSY in such a case.
+ */
 int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 {
         struct dm_table *map = NULL;
@@ -1579,6 +2382,11 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
                 goto out_unlock;
         }
 
+        if (dm_request_based(md) && !dm_rq_suspend_available(md, noflush)) {
+                r = -EBUSY;
+                goto out_unlock;
+        }
+
         map = dm_get_table(md);
 
         /*
@@ -1591,24 +2399,14 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
         /* This does not get reverted if there's an error later. */
         dm_table_presuspend_targets(map);
 
-        /* bdget() can stall if the pending I/Os are not flushed */
-        if (!noflush) {
-                md->suspended_bdev = bdget_disk(md->disk, 0);
-                if (!md->suspended_bdev) {
-                        DMWARN("bdget failed in dm_suspend");
-                        r = -ENOMEM;
+        /*
+         * Flush I/O to the device. noflush supersedes do_lockfs,
+         * because lock_fs() needs to flush I/Os.
+         */
+        if (!noflush && do_lockfs) {
+                r = lock_fs(md);
+                if (r)
                         goto out;
-                }
-
-                /*
-                 * Flush I/O to the device. noflush supersedes do_lockfs,
-                 * because lock_fs() needs to flush I/Os.
-                 */
-                if (do_lockfs) {
-                        r = lock_fs(md);
-                        if (r)
-                                goto out;
-                }
         }
 
         /*
@@ -1634,6 +2432,9 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 
         flush_workqueue(md->wq);
 
+        if (dm_request_based(md))
+                dm_rq_start_suspend(md, noflush);
+
         /*
          * At this point no more requests are entering target request routines.
          * We call dm_wait_for_completion to wait for all existing requests
@@ -1650,6 +2451,9 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
         if (r < 0) {
                 dm_queue_flush(md);
 
+                if (dm_request_based(md))
+                        dm_rq_abort_suspend(md, noflush);
+
                 unlock_fs(md);
                 goto out; /* pushback list is already flushed, so skip flush */
         }
@@ -1665,11 +2469,6 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
         set_bit(DMF_SUSPENDED, &md->flags);
 
 out:
-        if (r && md->suspended_bdev) {
-                bdput(md->suspended_bdev);
-                md->suspended_bdev = NULL;
-        }
-
         dm_table_put(map);
 
 out_unlock:
@@ -1696,21 +2495,20 @@ int dm_resume(struct mapped_device *md)
 
         dm_queue_flush(md);
 
-        unlock_fs(md);
+        /*
+         * Flushing deferred I/Os must be done after targets are resumed
+         * so that mapping of targets can work correctly.
+         * Request-based dm is queueing the deferred I/Os in its request_queue.
+         */
+        if (dm_request_based(md))
+                start_queue(md->queue);
 
-        if (md->suspended_bdev) {
-                bdput(md->suspended_bdev);
-                md->suspended_bdev = NULL;
-        }
+        unlock_fs(md);
 
         clear_bit(DMF_SUSPENDED, &md->flags);
 
         dm_table_unplug_all(map);
-
-        dm_kobject_uevent(md);
-
         r = 0;
-
 out:
         dm_table_put(map);
         mutex_unlock(&md->suspend_lock);
@@ -1721,9 +2519,19 @@ out:
 /*-----------------------------------------------------------------
  * Event notification.
  *---------------------------------------------------------------*/
-void dm_kobject_uevent(struct mapped_device *md)
-{
-        kobject_uevent(&disk_to_dev(md->disk)->kobj, KOBJ_CHANGE);
+void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+                       unsigned cookie)
+{
+        char udev_cookie[DM_COOKIE_LENGTH];
+        char *envp[] = { udev_cookie, NULL };
+
+        if (!cookie)
+                kobject_uevent(&disk_to_dev(md->disk)->kobj, action);
+        else {
+                snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u",
+                         DM_COOKIE_ENV_VAR_NAME, cookie);
+                kobject_uevent_env(&disk_to_dev(md->disk)->kobj, action, envp);
+        }
 }
 
 uint32_t dm_next_uevent_seq(struct mapped_device *md)
@@ -1777,6 +2585,10 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
         if (&md->kobj != kobj)
                 return NULL;
 
+        if (test_bit(DMF_FREEING, &md->flags) ||
+            test_bit(DMF_DELETING, &md->flags))
+                return NULL;
+
         dm_get(md);
         return md;
 }
@@ -1797,6 +2609,61 @@ int dm_noflush_suspending(struct dm_target *ti)
 }
 EXPORT_SYMBOL_GPL(dm_noflush_suspending);
 
+struct dm_md_mempools *dm_alloc_md_mempools(unsigned type)
+{
+        struct dm_md_mempools *pools = kmalloc(sizeof(*pools), GFP_KERNEL);
+
+        if (!pools)
+                return NULL;
+
+        pools->io_pool = (type == DM_TYPE_BIO_BASED) ?
+                         mempool_create_slab_pool(MIN_IOS, _io_cache) :
+                         mempool_create_slab_pool(MIN_IOS, _rq_bio_info_cache);
+        if (!pools->io_pool)
+                goto free_pools_and_out;
+
+        pools->tio_pool = (type == DM_TYPE_BIO_BASED) ?
+                          mempool_create_slab_pool(MIN_IOS, _tio_cache) :
+                          mempool_create_slab_pool(MIN_IOS, _rq_tio_cache);
+        if (!pools->tio_pool)
+                goto free_io_pool_and_out;
+
+        pools->bs = (type == DM_TYPE_BIO_BASED) ?
+                    bioset_create(16, 0) : bioset_create(MIN_IOS, 0);
+        if (!pools->bs)
+                goto free_tio_pool_and_out;
+
+        return pools;
+
+free_tio_pool_and_out:
+        mempool_destroy(pools->tio_pool);
+
+free_io_pool_and_out:
+        mempool_destroy(pools->io_pool);
+
+free_pools_and_out:
+        kfree(pools);
+
+        return NULL;
+}
+
+void dm_free_md_mempools(struct dm_md_mempools *pools)
+{
+        if (!pools)
+                return;
+
+        if (pools->io_pool)
+                mempool_destroy(pools->io_pool);
+
+        if (pools->tio_pool)
+                mempool_destroy(pools->tio_pool);
+
+        if (pools->bs)
+                bioset_free(pools->bs);
+
+        kfree(pools);
+}
+
 static struct block_device_operations dm_blk_dops = {
         .open = dm_blk_open,
         .release = dm_blk_close,
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index a31506d93e91..23278ae80f08 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -23,6 +23,13 @@
 #define DM_SUSPEND_NOFLUSH_FLAG         (1 << 1)
 
 /*
+ * Type of table and mapped_device's mempool
+ */
+#define DM_TYPE_NONE            0
+#define DM_TYPE_BIO_BASED       1
+#define DM_TYPE_REQUEST_BASED   2
+
+/*
  * List of devices that a metadevice uses and should open/close.
  */
 struct dm_dev_internal {
@@ -32,6 +39,7 @@ struct dm_dev_internal {
 };
 
 struct dm_table;
+struct dm_md_mempools;
 
 /*-----------------------------------------------------------------
  * Internal table functions.
@@ -41,18 +49,34 @@ void dm_table_event_callback(struct dm_table *t,
                              void (*fn)(void *), void *context);
 struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index);
 struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector);
-void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q);
+int dm_calculate_queue_limits(struct dm_table *table,
+                              struct queue_limits *limits);
+void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+                               struct queue_limits *limits);
 struct list_head *dm_table_get_devices(struct dm_table *t);
 void dm_table_presuspend_targets(struct dm_table *t);
 void dm_table_postsuspend_targets(struct dm_table *t);
 int dm_table_resume_targets(struct dm_table *t);
 int dm_table_any_congested(struct dm_table *t, int bdi_bits);
+int dm_table_any_busy_target(struct dm_table *t);
+int dm_table_set_type(struct dm_table *t);
+unsigned dm_table_get_type(struct dm_table *t);
+bool dm_table_bio_based(struct dm_table *t);
+bool dm_table_request_based(struct dm_table *t);
+int dm_table_alloc_md_mempools(struct dm_table *t);
+void dm_table_free_md_mempools(struct dm_table *t);
+struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t);
 
 /*
  * To check the return value from dm_table_find_target().
  */
 #define dm_target_is_valid(t) ((t)->table)
 
+/*
+ * To check whether the target type is request-based or not (bio-based).
+ */
+#define dm_target_request_based(t) ((t)->type->map_rq != NULL)
+
 /*-----------------------------------------------------------------
  * A registry of target types.
  *---------------------------------------------------------------*/
@@ -92,9 +116,16 @@ void dm_stripe_exit(void);
 int dm_open_count(struct mapped_device *md);
 int dm_lock_for_deletion(struct mapped_device *md);
 
-void dm_kobject_uevent(struct mapped_device *md);
+void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+                       unsigned cookie);
 
 int dm_kcopyd_init(void);
 void dm_kcopyd_exit(void);
 
+/*
+ * Mempool operations
+ */
+struct dm_md_mempools *dm_alloc_md_mempools(unsigned type);
+void dm_free_md_mempools(struct dm_md_mempools *pools);
+
 #endif
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 1dc721517e4c..c155bd3ec9f1 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1725,6 +1725,7 @@ config TLAN
 
 config KS8842
         tristate "Micrel KSZ8842"
+        depends on HAS_IOMEM
         help
           This platform driver is for Micrel KSZ8842 chip.
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 38f1c3375d7f..b70cc99962fc 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -6825,6 +6825,14 @@ bnx2_nway_reset(struct net_device *dev)
         return 0;
 }
 
+static u32
+bnx2_get_link(struct net_device *dev)
+{
+        struct bnx2 *bp = netdev_priv(dev);
+
+        return bp->link_up;
+}
+
 static int
 bnx2_get_eeprom_len(struct net_device *dev)
 {
@@ -7392,7 +7400,7 @@ static const struct ethtool_ops bnx2_ethtool_ops = {
         .get_wol                = bnx2_get_wol,
         .set_wol                = bnx2_set_wol,
         .nway_reset             = bnx2_nway_reset,
-        .get_link               = ethtool_op_get_link,
+        .get_link               = bnx2_get_link,
         .get_eeprom_len         = bnx2_get_eeprom_len,
         .get_eeprom             = bnx2_get_eeprom,
         .set_eeprom             = bnx2_set_eeprom,
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index d5e18812bf49..33821a81cbf8 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -36,7 +36,7 @@ config CAN_CALC_BITTIMING
           If unsure, say Y.
 
 config CAN_SJA1000
-        depends on CAN_DEV
+        depends on CAN_DEV && HAS_IOMEM
         tristate "Philips SJA1000"
         ---help---
           Driver for the SJA1000 CAN controllers from Philips or NXP
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index bdb143d2b5c7..055bb61d6e77 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -944,28 +944,31 @@ int netxen_phantom_init(struct netxen_adapter *adapter, int pegtune_val)
         u32 val = 0;
         int retries = 60;
 
-        if (!pegtune_val) {
-                do {
-                        val = NXRD32(adapter, CRB_CMDPEG_STATE);
+        if (pegtune_val)
+                return 0;
 
-                        if (val == PHAN_INITIALIZE_COMPLETE ||
-                                val == PHAN_INITIALIZE_ACK)
-                                return 0;
+        do {
+                val = NXRD32(adapter, CRB_CMDPEG_STATE);
 
-                        msleep(500);
+                switch (val) {
+                case PHAN_INITIALIZE_COMPLETE:
+                case PHAN_INITIALIZE_ACK:
+                        return 0;
+                case PHAN_INITIALIZE_FAILED:
+                        goto out_err;
+                default:
+                        break;
+                }
 
-                } while (--retries);
+                msleep(500);
 
-                if (!retries) {
-                        pegtune_val = NXRD32(adapter,
-                                        NETXEN_ROMUSB_GLB_PEGTUNE_DONE);
-                        printk(KERN_WARNING "netxen_phantom_init: init failed, "
-                                        "pegtune_val=%x\n", pegtune_val);
-                        return -1;
-                }
-        }
+        } while (--retries);
 
-        return 0;
+        NXWR32(adapter, CRB_CMDPEG_STATE, PHAN_INITIALIZE_FAILED);
+
+out_err:
+        dev_warn(&adapter->pdev->dev, "firmware init failed\n");
+        return -EIO;
 }
 
 static int
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 71daa3d5f114..2919a2d12bf4 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -705,7 +705,7 @@ netxen_start_firmware(struct netxen_adapter *adapter, int request_fw)
                 first_driver = (adapter->ahw.pci_func == 0);
 
         if (!first_driver)
-                return 0;
+                goto wait_init;
 
         first_boot = NXRD32(adapter, NETXEN_CAM_RAM(0x1fc));
 
@@ -752,6 +752,7 @@ netxen_start_firmware(struct netxen_adapter *adapter, int request_fw)
                 | (_NETXEN_NIC_LINUX_SUBVERSION);
         NXWR32(adapter, CRB_DRIVER_VERSION, val);
 
+wait_init:
         /* Handshake with the card before we register the devices. */
         err = netxen_phantom_init(adapter, NETXEN_NIC_PEG_TUNE);
         if (err) {
@@ -1178,6 +1179,7 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
         free_netdev(netdev);
 }
 
+#ifdef CONFIG_PM
 static int
 netxen_nic_suspend(struct pci_dev *pdev, pm_message_t state)
 {
@@ -1242,6 +1244,7 @@ netxen_nic_resume(struct pci_dev *pdev)
 
         return 0;
 }
+#endif
 
 static int netxen_nic_open(struct net_device *netdev)
 {
@@ -1771,8 +1774,10 @@ static struct pci_driver netxen_driver = {
         .id_table = netxen_pci_tbl,
         .probe = netxen_nic_probe,
         .remove = __devexit_p(netxen_nic_remove),
+#ifdef CONFIG_PM
         .suspend = netxen_nic_suspend,
         .resume = netxen_nic_resume
+#endif
 };
 
 /* Driver Registration on NetXen card    */
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index bbc6d4d3cc94..3e4b67aaa6ea 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -3142,6 +3142,7 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                                                 (void __iomem *)port_regs;
         u32 delay = 10;
         int status = 0;
+        unsigned long hw_flags = 0;
 
         if(ql_mii_setup(qdev))
                 return -1;
@@ -3150,7 +3151,8 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
         ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             (ISP_SERIAL_PORT_IF_WE |
                              (ISP_SERIAL_PORT_IF_WE << 16)));
-
+        /* Give the PHY time to come out of reset. */
+        mdelay(100);
         qdev->port_link_state = LS_DOWN;
         netif_carrier_off(qdev->ndev);
 
@@ -3350,7 +3352,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 value = ql_read_page0_reg(qdev, &port_regs->portStatus);
                 if (value & PORT_STATUS_IC)
                         break;
+                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
                 msleep(500);
+                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
         } while (--delay);
 
         if (delay == 0) {
diff --git a/drivers/pci/hotplug/acpi_pcihp.c b/drivers/pci/hotplug/acpi_pcihp.c
index fbc63d5e459f..eb159587d0bf 100644
--- a/drivers/pci/hotplug/acpi_pcihp.c
+++ b/drivers/pci/hotplug/acpi_pcihp.c
@@ -354,7 +354,7 @@ acpi_status acpi_get_hp_params_from_firmware(struct pci_bus *bus,
                 status = acpi_run_hpp(handle, hpp);
                 if (ACPI_SUCCESS(status))
                         break;
-                if (acpi_root_bridge(handle))
+                if (acpi_is_root_bridge(handle))
                         break;
                 status = acpi_get_parent(handle, &phandle);
                 if (ACPI_FAILURE(status))
@@ -428,7 +428,7 @@ int acpi_get_hp_hw_control_from_firmware(struct pci_dev *pdev, u32 flags)
                 status = acpi_run_oshp(handle);
                 if (ACPI_SUCCESS(status))
                         goto got_one;
-                if (acpi_root_bridge(handle))
+                if (acpi_is_root_bridge(handle))
                         break;
                 chandle = handle;
                 status = acpi_get_parent(chandle, &handle);
@@ -449,42 +449,6 @@ got_one:
 }
 EXPORT_SYMBOL(acpi_get_hp_hw_control_from_firmware);
 
-/* acpi_root_bridge - check to see if this acpi object is a root bridge
- *
- * @handle - the acpi object in question.
- */
-int acpi_root_bridge(acpi_handle handle)
-{
-        acpi_status status;
-        struct acpi_device_info *info;
-        struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
-        int i;
-
-        status = acpi_get_object_info(handle, &buffer);
-        if (ACPI_SUCCESS(status)) {
-                info = buffer.pointer;
-                if ((info->valid & ACPI_VALID_HID) &&
-                        !strcmp(PCI_ROOT_HID_STRING,
-                                        info->hardware_id.value)) {
-                        kfree(buffer.pointer);
-                        return 1;
-                }
-                if (info->valid & ACPI_VALID_CID) {
-                        for (i=0; i < info->compatibility_id.count; i++) {
-                                if (!strcmp(PCI_ROOT_HID_STRING,
-                                        info->compatibility_id.id[i].value)) {
-                                        kfree(buffer.pointer);
-                                        return 1;
-                                }
-                        }
-                }
-                kfree(buffer.pointer);
-        }
-        return 0;
-}
-EXPORT_SYMBOL_GPL(acpi_root_bridge);
-
-
 static int is_ejectable(acpi_handle handle)
 {
         acpi_status status;
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 3a6064bce561..0cb0f830a993 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -678,18 +678,9 @@ static void remove_bridge(acpi_handle handle)
 
 static struct pci_dev * get_apic_pci_info(acpi_handle handle)
 {
-        struct acpi_pci_id id;
-        struct pci_bus *bus;
         struct pci_dev *dev;
 
-        if (ACPI_FAILURE(acpi_get_pci_id(handle, &id)))
-                return NULL;
-
-        bus = pci_find_bus(id.segment, id.bus);
-        if (!bus)
-                return NULL;
-
-        dev = pci_get_slot(bus, PCI_DEVFN(id.device, id.function));
+        dev = acpi_get_pci_dev(handle);
         if (!dev)
                 return NULL;
 
@@ -1396,19 +1387,16 @@ static void acpiphp_sanitize_bus(struct pci_bus *bus)
 /* Program resources in newly inserted bridge */
 static int acpiphp_configure_bridge (acpi_handle handle)
 {
-        struct acpi_pci_id pci_id;
+        struct pci_dev *dev;
         struct pci_bus *bus;
 
-        if (ACPI_FAILURE(acpi_get_pci_id(handle, &pci_id))) {
+        dev = acpi_get_pci_dev(handle);
+        if (!dev) {
                 err("cannot get PCI domain and bus number for bridge\n");
                 return -EINVAL;
         }
-        bus = pci_find_bus(pci_id.segment, pci_id.bus);
-        if (!bus) {
-                err("cannot find bus %d:%d\n",
-                                pci_id.segment, pci_id.bus);
-                return -EINVAL;
-        }
+
+        bus = dev->bus;
 
         pci_bus_size_bridges(bus);
         pci_bus_assign_resources(bus);
@@ -1416,6 +1404,7 @@ static int acpiphp_configure_bridge (acpi_handle handle)
         acpiphp_set_hpp_values(handle, bus);
         pci_enable_bridges(bus);
         acpiphp_configure_ioapics(handle);
+        pci_dev_put(dev);
         return 0;
 }
 
@@ -1631,7 +1620,7 @@ find_root_bridges(acpi_handle handle, u32 lvl, void *context, void **rv)
 {
         int *count = (int *)context;
 
-        if (acpi_root_bridge(handle)) {
+        if (acpi_is_root_bridge(handle)) {
                 acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                                 handle_hotplug_event_bridge, NULL);
                         (*count)++;
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 178853a07440..e53eacd75c8d 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -39,6 +39,7 @@
 #include <linux/sysdev.h>
 #include <asm/cacheflush.h>
 #include <asm/iommu.h>
+#include <asm/e820.h>
 #include "pci.h"
 
 #define ROOT_SIZE               VTD_PAGE_SIZE
@@ -217,6 +218,14 @@ static inline bool dma_pte_present(struct dma_pte *pte)
         return (pte->val & 3) != 0;
 }
 
+/*
+ * This domain is a statically identity mapping domain.
+ *      1. This domain creats a static 1:1 mapping to all usable memory.
+ *      2. It maps to each iommu if successful.
+ *      3. Each iommu mapps to this domain if successful.
+ */
+struct dmar_domain *si_domain;
+
 /* devices under the same p2p bridge are owned in one domain */
 #define DOMAIN_FLAG_P2P_MULTIPLE_DEVICES (1 << 0)
 
@@ -225,6 +234,9 @@ static inline bool dma_pte_present(struct dma_pte *pte)
  */
 #define DOMAIN_FLAG_VIRTUAL_MACHINE     (1 << 1)
 
+/* si_domain contains mulitple devices */
+#define DOMAIN_FLAG_STATIC_IDENTITY     (1 << 2)
+
 struct dmar_domain {
         int     id;                     /* domain id */
         unsigned long iommu_bmp;        /* bitmap of iommus this domain uses*/
@@ -435,12 +447,14 @@ int iommu_calculate_agaw(struct intel_iommu *iommu)
         return __iommu_calculate_agaw(iommu, DEFAULT_DOMAIN_ADDRESS_WIDTH);
 }
 
-/* in native case, each domain is related to only one iommu */
+/* This functionin only returns single iommu in a domain */
 static struct intel_iommu *domain_get_iommu(struct dmar_domain *domain)
 {
         int iommu_id;
 
+        /* si_domain and vm domain should not get here. */
         BUG_ON(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE);
+        BUG_ON(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY);
 
         iommu_id = find_first_bit(&domain->iommu_bmp, g_num_of_iommus);
         if (iommu_id < 0 || iommu_id >= g_num_of_iommus)
@@ -1189,48 +1203,71 @@ void free_dmar_iommu(struct intel_iommu *iommu)
         free_context_table(iommu);
 }
 
-static struct dmar_domain * iommu_alloc_domain(struct intel_iommu *iommu)
+static struct dmar_domain *alloc_domain(void)
 {
-        unsigned long num;
-        unsigned long ndomains;
         struct dmar_domain *domain;
-        unsigned long flags;
 
         domain = alloc_domain_mem();
         if (!domain)
                 return NULL;
 
+        memset(&domain->iommu_bmp, 0, sizeof(unsigned long));
+        domain->flags = 0;
+
+        return domain;
+}
+
+static int iommu_attach_domain(struct dmar_domain *domain,
+                               struct intel_iommu *iommu)
+{
+        int num;
+        unsigned long ndomains;
+        unsigned long flags;
+
         ndomains = cap_ndoms(iommu->cap);
 
         spin_lock_irqsave(&iommu->lock, flags);
+
         num = find_first_zero_bit(iommu->domain_ids, ndomains);
         if (num >= ndomains) {
                 spin_unlock_irqrestore(&iommu->lock, flags);
-                free_domain_mem(domain);
                 printk(KERN_ERR "IOMMU: no free domain ids\n");
-                return NULL;
+                return -ENOMEM;
         }
 
-        set_bit(num, iommu->domain_ids);
         domain->id = num;
-        memset(&domain->iommu_bmp, 0, sizeof(unsigned long));
+        set_bit(num, iommu->domain_ids);
         set_bit(iommu->seq_id, &domain->iommu_bmp);
-        domain->flags = 0;
         iommu->domains[num] = domain;
         spin_unlock_irqrestore(&iommu->lock, flags);
 
-        return domain;
+        return 0;
 }
 
-static void iommu_free_domain(struct dmar_domain *domain)
+static void iommu_detach_domain(struct dmar_domain *domain,
+                                struct intel_iommu *iommu)
 {
         unsigned long flags;
-        struct intel_iommu *iommu;
-
-        iommu = domain_get_iommu(domain);
+        int num, ndomains;
+        int found = 0;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        clear_bit(domain->id, iommu->domain_ids);
+        ndomains = cap_ndoms(iommu->cap);
+        num = find_first_bit(iommu->domain_ids, ndomains);
+        for (; num < ndomains; ) {
+                if (iommu->domains[num] == domain) {
+                        found = 1;
+                        break;
+                }
+                num = find_next_bit(iommu->domain_ids,
+                                    cap_ndoms(iommu->cap), num+1);
+        }
+
+        if (found) {
+                clear_bit(num, iommu->domain_ids);
+                clear_bit(iommu->seq_id, &domain->iommu_bmp);
+                iommu->domains[num] = NULL;
+        }
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
@@ -1350,6 +1387,8 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
 
 static void domain_exit(struct dmar_domain *domain)
 {
+        struct dmar_drhd_unit *drhd;
+        struct intel_iommu *iommu;
         u64 end;
 
         /* Domain 0 is reserved, so dont process it */
@@ -1368,7 +1407,10 @@ static void domain_exit(struct dmar_domain *domain)
         /* free page tables */
         dma_pte_free_pagetable(domain, 0, end);
 
-        iommu_free_domain(domain);
+        for_each_active_iommu(iommu, drhd)
+                if (test_bit(iommu->seq_id, &domain->iommu_bmp))
+                        iommu_detach_domain(domain, iommu);
+
         free_domain_mem(domain);
 }
 
@@ -1408,7 +1450,8 @@ static int domain_context_mapping_one(struct dmar_domain *domain, int segment,
         id = domain->id;
         pgd = domain->pgd;
 
-        if (domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) {
+        if (domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE ||
+            domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) {
                 int found = 0;
 
                 /* find an available domain id for this device in iommu */
@@ -1433,6 +1476,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain, int segment,
                         }
 
                         set_bit(num, iommu->domain_ids);
+                        set_bit(iommu->seq_id, &domain->iommu_bmp);
                         iommu->domains[num] = domain;
                         id = num;
                 }
@@ -1675,6 +1719,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
         unsigned long flags;
         int bus = 0, devfn = 0;
         int segment;
+        int ret;
 
         domain = find_domain(pdev);
         if (domain)
@@ -1707,6 +1752,10 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
                 }
         }
 
+        domain = alloc_domain();
+        if (!domain)
+                goto error;
+
         /* Allocate new domain for the device */
         drhd = dmar_find_matched_drhd_unit(pdev);
         if (!drhd) {
@@ -1716,9 +1765,11 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
         }
         iommu = drhd->iommu;
 
-        domain = iommu_alloc_domain(iommu);
-        if (!domain)
+        ret = iommu_attach_domain(domain, iommu);
+        if (ret) {
+                domain_exit(domain);
                 goto error;
+        }
 
         if (domain_init(domain, gaw)) {
                 domain_exit(domain);
@@ -1792,6 +1843,8 @@ error:
         return find_domain(pdev);
 }
 
+static int iommu_identity_mapping;
+
 static int iommu_prepare_identity_map(struct pci_dev *pdev,
                                       unsigned long long start,
                                       unsigned long long end)
@@ -1804,8 +1857,11 @@ static int iommu_prepare_identity_map(struct pci_dev *pdev,
         printk(KERN_INFO
                 "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n",
                 pci_name(pdev), start, end);
-        /* page table init */
-        domain = get_domain_for_dev(pdev, DEFAULT_DOMAIN_ADDRESS_WIDTH);
+        if (iommu_identity_mapping)
+                domain = si_domain;
+        else
+                /* page table init */
+                domain = get_domain_for_dev(pdev, DEFAULT_DOMAIN_ADDRESS_WIDTH);
         if (!domain)
                 return -ENOMEM;
 
@@ -1952,7 +2008,110 @@ static int __init init_context_pass_through(void)
         return 0;
 }
 
-static int __init init_dmars(void)
+static int md_domain_init(struct dmar_domain *domain, int guest_width);
+static int si_domain_init(void)
+{
+        struct dmar_drhd_unit *drhd;
+        struct intel_iommu *iommu;
+        int ret = 0;
+
+        si_domain = alloc_domain();
+        if (!si_domain)
+                return -EFAULT;
+
+
+        for_each_active_iommu(iommu, drhd) {
+                ret = iommu_attach_domain(si_domain, iommu);
+                if (ret) {
+                        domain_exit(si_domain);
+                        return -EFAULT;
+                }
+        }
+
+        if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
+                domain_exit(si_domain);
+                return -EFAULT;
+        }
+
+        si_domain->flags = DOMAIN_FLAG_STATIC_IDENTITY;
+
+        return 0;
+}
+
+static void domain_remove_one_dev_info(struct dmar_domain *domain,
+                                          struct pci_dev *pdev);
+static int identity_mapping(struct pci_dev *pdev)
+{
+        struct device_domain_info *info;
+
+        if (likely(!iommu_identity_mapping))
+                return 0;
+
+
+        list_for_each_entry(info, &si_domain->devices, link)
+                if (info->dev == pdev)
+                        return 1;
+        return 0;
+}
+
+static int domain_add_dev_info(struct dmar_domain *domain,
+                                  struct pci_dev *pdev)
+{
+        struct device_domain_info *info;
+        unsigned long flags;
+
+        info = alloc_devinfo_mem();
+        if (!info)
+                return -ENOMEM;
+
+        info->segment = pci_domain_nr(pdev->bus);
+        info->bus = pdev->bus->number;
+        info->devfn = pdev->devfn;
+        info->dev = pdev;
+        info->domain = domain;
+
+        spin_lock_irqsave(&device_domain_lock, flags);
+        list_add(&info->link, &domain->devices);
+        list_add(&info->global, &device_domain_list);
+        pdev->dev.archdata.iommu = info;
+        spin_unlock_irqrestore(&device_domain_lock, flags);
+
+        return 0;
+}
+
+static int iommu_prepare_static_identity_mapping(void)
+{
+        int i;
+        struct pci_dev *pdev = NULL;
+        int ret;
+
+        ret = si_domain_init();
+        if (ret)
+                return -EFAULT;
+
+        printk(KERN_INFO "IOMMU: Setting identity map:\n");
+        for_each_pci_dev(pdev) {
+                for (i = 0; i < e820.nr_map; i++) {
+                        struct e820entry *ei = &e820.map[i];
+
+                        if (ei->type == E820_RAM) {
+                                ret = iommu_prepare_identity_map(pdev,
+                                        ei->addr, ei->addr + ei->size);
+                                if (ret)  {
+                                        printk(KERN_INFO "1:1 mapping to one domain failed.\n");
+                                        return -EFAULT;
+                                }
+                        }
+                }
+                ret = domain_add_dev_info(si_domain, pdev);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+
+int __init init_dmars(void)
 {
         struct dmar_drhd_unit *drhd;
         struct dmar_rmrr_unit *rmrr;
@@ -1962,6 +2121,13 @@ static int __init init_dmars(void)
         int pass_through = 1;
 
         /*
+         * In case pass through can not be enabled, iommu tries to use identity
+         * mapping.
+         */
+        if (iommu_pass_through)
+                iommu_identity_mapping = 1;
+
+        /*
          * for each drhd
          *    allocate root
          *    initialize and program root entry to not present
@@ -2090,9 +2256,12 @@ static int __init init_dmars(void)
 
         /*
          * If pass through is not set or not enabled, setup context entries for
-         * identity mappings for rmrr, gfx, and isa.
+         * identity mappings for rmrr, gfx, and isa and may fall back to static
+         * identity mapping if iommu_identity_mapping is set.
          */
         if (!iommu_pass_through) {
+                if (iommu_identity_mapping)
+                        iommu_prepare_static_identity_mapping();
                 /*
                  * For each rmrr
                  *   for each dev attached to rmrr
@@ -2107,6 +2276,7 @@ static int __init init_dmars(void)
                  *    endfor
                  * endfor
                  */
+                printk(KERN_INFO "IOMMU: Setting RMRR:\n");
                 for_each_rmrr_units(rmrr) {
                         for (i = 0; i < rmrr->devices_cnt; i++) {
                                 pdev = rmrr->devices[i];
@@ -2248,6 +2418,52 @@ get_valid_domain_for_dev(struct pci_dev *pdev)
         return domain;
 }
 
+static int iommu_dummy(struct pci_dev *pdev)
+{
+        return pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
+}
+
+/* Check if the pdev needs to go through non-identity map and unmap process.*/
+static int iommu_no_mapping(struct pci_dev *pdev)
+{
+        int found;
+
+        if (!iommu_identity_mapping)
+                return iommu_dummy(pdev);
+
+        found = identity_mapping(pdev);
+        if (found) {
+                if (pdev->dma_mask > DMA_BIT_MASK(32))
+                        return 1;
+                else {
+                        /*
+                         * 32 bit DMA is removed from si_domain and fall back
+                         * to non-identity mapping.
+                         */
+                        domain_remove_one_dev_info(si_domain, pdev);
+                        printk(KERN_INFO "32bit %s uses non-identity mapping\n",
+                               pci_name(pdev));
+                        return 0;
+                }
+        } else {
+                /*
+                 * In case of a detached 64 bit DMA device from vm, the device
+                 * is put into si_domain for identity mapping.
+                 */
+                if (pdev->dma_mask > DMA_BIT_MASK(32)) {
+                        int ret;
+                        ret = domain_add_dev_info(si_domain, pdev);
+                        if (!ret) {
+                                printk(KERN_INFO "64bit %s uses identity mapping\n",
+                                       pci_name(pdev));
+                                return 1;
+                        }
+                }
+        }
+
+        return iommu_dummy(pdev);
+}
+
 static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
                                      size_t size, int dir, u64 dma_mask)
 {
@@ -2260,7 +2476,8 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
         struct intel_iommu *iommu;
 
         BUG_ON(dir == DMA_NONE);
-        if (pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO)
+
+        if (iommu_no_mapping(pdev))
                 return paddr;
 
         domain = get_valid_domain_for_dev(pdev);
@@ -2401,8 +2618,9 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
         struct iova *iova;
         struct intel_iommu *iommu;
 
-        if (pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO)
+        if (iommu_no_mapping(pdev))
                 return;
+
         domain = find_domain(pdev);
         BUG_ON(!domain);
 
@@ -2492,7 +2710,7 @@ static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
         struct scatterlist *sg;
         struct intel_iommu *iommu;
 
-        if (pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO)
+        if (iommu_no_mapping(pdev))
                 return;
 
         domain = find_domain(pdev);
@@ -2553,7 +2771,7 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
         struct intel_iommu *iommu;
 
         BUG_ON(dir == DMA_NONE);
-        if (pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO)
+        if (iommu_no_mapping(pdev))
                 return intel_nontranslate_map_sg(hwdev, sglist, nelems, dir);
 
         domain = get_valid_domain_for_dev(pdev);
@@ -2951,31 +3169,6 @@ int __init intel_iommu_init(void)
         return 0;
 }
 
-static int vm_domain_add_dev_info(struct dmar_domain *domain,
-                                  struct pci_dev *pdev)
-{
-        struct device_domain_info *info;
-        unsigned long flags;
-
-        info = alloc_devinfo_mem();
-        if (!info)
-                return -ENOMEM;
-
-        info->segment = pci_domain_nr(pdev->bus);
-        info->bus = pdev->bus->number;
-        info->devfn = pdev->devfn;
-        info->dev = pdev;
-        info->domain = domain;
-
-        spin_lock_irqsave(&device_domain_lock, flags);
-        list_add(&info->link, &domain->devices);
-        list_add(&info->global, &device_domain_list);
-        pdev->dev.archdata.iommu = info;
-        spin_unlock_irqrestore(&device_domain_lock, flags);
-
-        return 0;
-}
-
 static void iommu_detach_dependent_devices(struct intel_iommu *iommu,
                                            struct pci_dev *pdev)
 {
@@ -3003,7 +3196,7 @@ static void iommu_detach_dependent_devices(struct intel_iommu *iommu,
         }
 }
 
-static void vm_domain_remove_one_dev_info(struct dmar_domain *domain,
+static void domain_remove_one_dev_info(struct dmar_domain *domain,
                                           struct pci_dev *pdev)
 {
         struct device_domain_info *info;
@@ -3136,7 +3329,7 @@ static struct dmar_domain *iommu_alloc_vm_domain(void)
         return domain;
 }
 
-static int vm_domain_init(struct dmar_domain *domain, int guest_width)
+static int md_domain_init(struct dmar_domain *domain, int guest_width)
 {
         int adjust_width;
 
@@ -3227,7 +3420,7 @@ static int intel_iommu_domain_init(struct iommu_domain *domain)
                         "intel_iommu_domain_init: dmar_domain == NULL\n");
                 return -ENOMEM;
         }
-        if (vm_domain_init(dmar_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
+        if (md_domain_init(dmar_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
                 printk(KERN_ERR
                         "intel_iommu_domain_init() failed\n");
                 vm_domain_exit(dmar_domain);
@@ -3262,8 +3455,9 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
 
                 old_domain = find_domain(pdev);
                 if (old_domain) {
-                        if (dmar_domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE)
-                                vm_domain_remove_one_dev_info(old_domain, pdev);
+                        if (dmar_domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE ||
+                            dmar_domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)
+                                domain_remove_one_dev_info(old_domain, pdev);
                         else
                                 domain_remove_dev_info(old_domain);
                 }
@@ -3285,7 +3479,7 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
                 return -EFAULT;
         }
 
-        ret = vm_domain_add_dev_info(dmar_domain, pdev);
+        ret = domain_add_dev_info(dmar_domain, pdev);
         if (ret)
                 return ret;
 
@@ -3299,7 +3493,7 @@ static void intel_iommu_detach_device(struct iommu_domain *domain,
         struct dmar_domain *dmar_domain = domain->priv;
         struct pci_dev *pdev = to_pci_dev(dev);
 
-        vm_domain_remove_one_dev_info(dmar_domain, pdev);
+        domain_remove_one_dev_info(dmar_domain, pdev);
 }
 
 static int intel_iommu_map_range(struct iommu_domain *domain,
diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
index 1e83c8c5f985..4f5b8712931f 100644
--- a/drivers/pci/intr_remapping.c
+++ b/drivers/pci/intr_remapping.c
@@ -10,6 +10,8 @@
 #include <linux/intel-iommu.h>
 #include "intr_remapping.h"
 #include <acpi/acpi.h>
+#include <asm/pci-direct.h>
+#include "pci.h"
 
 static struct ioapic_scope ir_ioapic[MAX_IO_APICS];
 static int ir_ioapic_num;
@@ -314,7 +316,8 @@ int modify_irte(int irq, struct irte *irte_modified)
         index = irq_iommu->irte_index + irq_iommu->sub_handle;
         irte = &iommu->ir_table->base[index];
 
-        set_64bit((unsigned long *)irte, irte_modified->low);
+        set_64bit((unsigned long *)&irte->low, irte_modified->low);
+        set_64bit((unsigned long *)&irte->high, irte_modified->high);
         __iommu_flush_cache(iommu, irte, sizeof(*irte));
 
         rc = qi_flush_iec(iommu, index, 0);
@@ -369,12 +372,32 @@ struct intel_iommu *map_dev_to_ir(struct pci_dev *dev)
         return drhd->iommu;
 }
 
+static int clear_entries(struct irq_2_iommu *irq_iommu)
+{
+        struct irte *start, *entry, *end;
+        struct intel_iommu *iommu;
+        int index;
+
+        if (irq_iommu->sub_handle)
+                return 0;
+
+        iommu = irq_iommu->iommu;
+        index = irq_iommu->irte_index + irq_iommu->sub_handle;
+
+        start = iommu->ir_table->base + index;
+        end = start + (1 << irq_iommu->irte_mask);
+
+        for (entry = start; entry < end; entry++) {
+                set_64bit((unsigned long *)&entry->low, 0);
+                set_64bit((unsigned long *)&entry->high, 0);
+        }
+
+        return qi_flush_iec(iommu, index, irq_iommu->irte_mask);
+}
+
 int free_irte(int irq)
 {
         int rc = 0;
-        int index, i;
-        struct irte *irte;
-        struct intel_iommu *iommu;
         struct irq_2_iommu *irq_iommu;
         unsigned long flags;
 
@@ -385,16 +408,7 @@ int free_irte(int irq)
                 return -1;
         }
 
-        iommu = irq_iommu->iommu;
-
-        index = irq_iommu->irte_index + irq_iommu->sub_handle;
-        irte = &iommu->ir_table->base[index];
-
-        if (!irq_iommu->sub_handle) {
-                for (i = 0; i < (1 << irq_iommu->irte_mask); i++)
-                        set_64bit((unsigned long *)(irte + i), 0);
-                rc = qi_flush_iec(iommu, index, irq_iommu->irte_mask);
-        }
+        rc = clear_entries(irq_iommu);
 
         irq_iommu->iommu = NULL;
         irq_iommu->irte_index = 0;
@@ -406,6 +420,91 @@ int free_irte(int irq)
         return rc;
 }
 
+/*
+ * source validation type
+ */
+#define SVT_NO_VERIFY           0x0  /* no verification is required */
+#define SVT_VERIFY_SID_SQ       0x1  /* verify using SID and SQ fiels */
+#define SVT_VERIFY_BUS          0x2  /* verify bus of request-id */
+
+/*
+ * source-id qualifier
+ */
+#define SQ_ALL_16       0x0  /* verify all 16 bits of request-id */
+#define SQ_13_IGNORE_1  0x1  /* verify most significant 13 bits, ignore
+                              * the third least significant bit
+                              */
+#define SQ_13_IGNORE_2  0x2  /* verify most significant 13 bits, ignore
+                              * the second and third least significant bits
+                              */
+#define SQ_13_IGNORE_3  0x3  /* verify most significant 13 bits, ignore
+                              * the least three significant bits
+                              */
+
+/*
+ * set SVT, SQ and SID fields of irte to verify
+ * source ids of interrupt requests
+ */
+static void set_irte_sid(struct irte *irte, unsigned int svt,
+                         unsigned int sq, unsigned int sid)
+{
+        irte->svt = svt;
+        irte->sq = sq;
+        irte->sid = sid;
+}
+
+int set_ioapic_sid(struct irte *irte, int apic)
+{
+        int i;
+        u16 sid = 0;
+
+        if (!irte)
+                return -1;
+
+        for (i = 0; i < MAX_IO_APICS; i++) {
+                if (ir_ioapic[i].id == apic) {
+                        sid = (ir_ioapic[i].bus << 8) | ir_ioapic[i].devfn;
+                        break;
+                }
+        }
+
+        if (sid == 0) {
+                pr_warning("Failed to set source-id of IOAPIC (%d)\n", apic);
+                return -1;
+        }
+
+        set_irte_sid(irte, 1, 0, sid);
+
+        return 0;
+}
+
+int set_msi_sid(struct irte *irte, struct pci_dev *dev)
+{
+        struct pci_dev *bridge;
+
+        if (!irte || !dev)
+                return -1;
+
+        /* PCIe device or Root Complex integrated PCI device */
+        if (dev->is_pcie || !dev->bus->parent) {
+                set_irte_sid(irte, SVT_VERIFY_SID_SQ, SQ_ALL_16,
+                             (dev->bus->number << 8) | dev->devfn);
+                return 0;
+        }
+
+        bridge = pci_find_upstream_pcie_bridge(dev);
+        if (bridge) {
+                if (bridge->is_pcie) /* this is a PCIE-to-PCI/PCIX bridge */
+                        set_irte_sid(irte, SVT_VERIFY_BUS, SQ_ALL_16,
+                                (bridge->bus->number << 8) | dev->bus->number);
+                else /* this is a legacy PCI bridge */
+                        set_irte_sid(irte, SVT_VERIFY_SID_SQ, SQ_ALL_16,
+                                (bridge->bus->number << 8) | bridge->devfn);
+        }
+
+        return 0;
+}
+
 static void iommu_set_intr_remapping(struct intel_iommu *iommu, int mode)
 {
         u64 addr;
@@ -612,6 +711,35 @@ error:
         return -1;
 }
 
+static void ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
+                                      struct intel_iommu *iommu)
+{
+        struct acpi_dmar_pci_path *path;
+        u8 bus;
+        int count;
+
+        bus = scope->bus;
+        path = (struct acpi_dmar_pci_path *)(scope + 1);
+        count = (scope->length - sizeof(struct acpi_dmar_device_scope))
+                / sizeof(struct acpi_dmar_pci_path);
+
+        while (--count > 0) {
+                /*
+                 * Access PCI directly due to the PCI
+                 * subsystem isn't initialized yet.
+                 */
+                bus = read_pci_config_byte(bus, path->dev, path->fn,
+                                           PCI_SECONDARY_BUS);
+                path++;
+        }
+
+        ir_ioapic[ir_ioapic_num].bus   = bus;
+        ir_ioapic[ir_ioapic_num].devfn = PCI_DEVFN(path->dev, path->fn);
+        ir_ioapic[ir_ioapic_num].iommu = iommu;
+        ir_ioapic[ir_ioapic_num].id    = scope->enumeration_id;
+        ir_ioapic_num++;
+}
+
 static int ir_parse_ioapic_scope(struct acpi_dmar_header *header,
                                  struct intel_iommu *iommu)
 {
@@ -636,9 +764,7 @@ static int ir_parse_ioapic_scope(struct acpi_dmar_header *header,
                                " 0x%Lx\n", scope->enumeration_id,
                                drhd->address);
 
-                        ir_ioapic[ir_ioapic_num].iommu = iommu;
-                        ir_ioapic[ir_ioapic_num].id = scope->enumeration_id;
-                        ir_ioapic_num++;
+                        ir_parse_one_ioapic_scope(scope, iommu);
                 }
                 start += scope->length;
         }
diff --git a/drivers/pci/intr_remapping.h b/drivers/pci/intr_remapping.h
index ca48f0df8ac9..63a263c18415 100644
--- a/drivers/pci/intr_remapping.h
+++ b/drivers/pci/intr_remapping.h
@@ -3,6 +3,8 @@
 struct ioapic_scope {
         struct intel_iommu *iommu;
         unsigned int id;
+        unsigned int bus;       /* PCI bus number */
+        unsigned int devfn;     /* PCI devfn number */
 };
 
 #define IR_X2APIC_MODE(mode) (mode ? (1 << 11) : 0)
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index c682ac536415..7232fe7104aa 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -34,10 +34,27 @@ config ACER_WMI
           If you have an ACPI-WMI compatible Acer/ Wistron laptop, say Y or M
           here.
 
+config ACERHDF
+        tristate "Acer Aspire One temperature and fan driver"
+        depends on THERMAL && THERMAL_HWMON && ACPI
+        ---help---
+          This is a driver for Acer Aspire One netbooks. It allows to access
+          the temperature sensor and to control the fan.
+
+          After loading this driver the BIOS is still in control of the fan.
+          To let the kernel handle the fan, do:
+          echo -n enabled > /sys/class/thermal/thermal_zone0/mode
+
+          For more information about this driver see
+          <http://piie.net/files/acerhdf_README.txt>
+
+          If you have an Acer Aspire One netbook, say Y or M
+          here.
+
 config ASUS_LAPTOP
-        tristate "Asus Laptop Extras (EXPERIMENTAL)"
+        tristate "Asus Laptop Extras"
         depends on ACPI
-        depends on EXPERIMENTAL && !ACPI_ASUS
+        depends on !ACPI_ASUS
         select LEDS_CLASS
         select NEW_LEDS
         select BACKLIGHT_CLASS_DEVICE
@@ -45,12 +62,12 @@ config ASUS_LAPTOP
         ---help---
           This is the new Linux driver for Asus laptops. It may also support some
           MEDION, JVC or VICTOR laptops. It makes all the extra buttons generate
-          standard ACPI events that go through /proc/acpi/events. It also adds
+          standard ACPI events and input events. It also adds
           support for video output switching, LCD backlight control, Bluetooth and
           Wlan control, and most importantly, allows you to blink those fancy LEDs.
 
           For more information and a userspace daemon for handling the extra
-          buttons see <http://acpi4asus.sf.net/>.
+          buttons see <http://acpi4asus.sf.net>.
 
           If you have an ACPI-compatible ASUS laptop, say Y or M here.
 
@@ -342,7 +359,10 @@ config EEEPC_LAPTOP
         select HWMON
         ---help---
           This driver supports the Fn-Fx keys on Eee PC laptops.
-          It also adds the ability to switch camera/wlan on/off.
+
+          It  also gives access to some extra laptop functionalities like
+          Bluetooth, backlight and allows powering on/off some other
+          devices.
 
           If you have an Eee PC laptop, say Y or M here.
 
@@ -369,7 +389,7 @@ config ACPI_WMI
           any ACPI-WMI devices.
 
 config ACPI_ASUS
-        tristate "ASUS/Medion Laptop Extras"
+        tristate "ASUS/Medion Laptop Extras (DEPRECATED)"
         depends on ACPI
         select BACKLIGHT_CLASS_DEVICE
         ---help---
@@ -390,7 +410,7 @@ config ACPI_ASUS
           parameters.
 
           More information and a userspace daemon for handling the extra buttons
-          at <http://sourceforge.net/projects/acpi4asus/>.
+          at <http://acpi4asus.sf.net>.
 
           If you have an ACPI-compatible ASUS laptop, say Y or M here. This
           driver is still under development, so if your laptop is unsupported or
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index e40c7bd1b87e..641b8bfa5538 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_COMPAL_LAPTOP)	+= compal-laptop.o
 obj-$(CONFIG_DELL_LAPTOP)       += dell-laptop.o
 obj-$(CONFIG_DELL_WMI)          += dell-wmi.o
 obj-$(CONFIG_ACER_WMI)          += acer-wmi.o
+obj-$(CONFIG_ACERHDF)           += acerhdf.o
 obj-$(CONFIG_HP_WMI)            += hp-wmi.o
 obj-$(CONFIG_TC1100_WMI)        += tc1100-wmi.o
 obj-$(CONFIG_SONY_LAPTOP)       += sony-laptop.o
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
new file mode 100644
index 000000000000..bdfee177eefb
--- /dev/null
+++ b/drivers/platform/x86/acerhdf.c
@@ -0,0 +1,602 @@
+/*
+ * acerhdf - A driver which monitors the temperature
+ *           of the aspire one netbook, turns on/off the fan
+ *           as soon as the upper/lower threshold is reached.
+ *
+ * (C) 2009 - Peter Feuerer     peter (a) piie.net
+ *                              http://piie.net
+ *     2009 Borislav Petkov <petkovbb@gmail.com>
+ *
+ * Inspired by and many thanks to:
+ *  o acerfand   - Rachel Greenham
+ *  o acer_ec.pl - Michael Kurz     michi.kurz (at) googlemail.com
+ *               - Petr Tomasek     tomasek (#) etf,cuni,cz
+ *               - Carlos Corbacho  cathectic (at) gmail.com
+ *  o lkml       - Matthew Garrett
+ *               - Borislav Petkov
+ *               - Andreas Mohr
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#define pr_fmt(fmt) "acerhdf: " fmt
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/dmi.h>
+#include <acpi/acpi_drivers.h>
+#include <linux/sched.h>
+#include <linux/thermal.h>
+#include <linux/platform_device.h>
+
+/*
+ * The driver is started with "kernel mode off" by default. That means, the BIOS
+ * is still in control of the fan. In this mode the driver allows to read the
+ * temperature of the cpu and a userspace tool may take over control of the fan.
+ * If the driver is switched to "kernel mode" (e.g. via module parameter) the
+ * driver is in full control of the fan. If you want the module to be started in
+ * kernel mode by default, define the following:
+ */
+#undef START_IN_KERNEL_MODE
+
+#define DRV_VER "0.5.13"
+
+/*
+ * According to the Atom N270 datasheet,
+ * (http://download.intel.com/design/processor/datashts/320032.pdf) the
+ * CPU's optimal operating limits denoted in junction temperature as
+ * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So,
+ * assume 89°C is critical temperature.
+ */
+#define ACERHDF_TEMP_CRIT 89
+#define ACERHDF_FAN_OFF 0
+#define ACERHDF_FAN_AUTO 1
+
+/*
+ * No matter what value the user puts into the fanon variable, turn on the fan
+ * at 80 degree Celsius to prevent hardware damage
+ */
+#define ACERHDF_MAX_FANON 80
+
+/*
+ * Maximum interval between two temperature checks is 15 seconds, as the die
+ * can get hot really fast under heavy load (plus we shouldn't forget about
+ * possible impact of _external_ aggressive sources such as heaters, sun etc.)
+ */
+#define ACERHDF_MAX_INTERVAL 15
+
+#ifdef START_IN_KERNEL_MODE
+static int kernelmode = 1;
+#else
+static int kernelmode;
+#endif
+
+static unsigned int interval = 10;
+static unsigned int fanon = 63;
+static unsigned int fanoff = 58;
+static unsigned int verbose;
+static unsigned int fanstate = ACERHDF_FAN_AUTO;
+static char force_bios[16];
+static unsigned int prev_interval;
+struct thermal_zone_device *thz_dev;
+struct thermal_cooling_device *cl_dev;
+struct platform_device *acerhdf_dev;
+
+module_param(kernelmode, uint, 0);
+MODULE_PARM_DESC(kernelmode, "Kernel mode fan control on / off");
+module_param(interval, uint, 0600);
+MODULE_PARM_DESC(interval, "Polling interval of temperature check");
+module_param(fanon, uint, 0600);
+MODULE_PARM_DESC(fanon, "Turn the fan on above this temperature");
+module_param(fanoff, uint, 0600);
+MODULE_PARM_DESC(fanoff, "Turn the fan off below this temperature");
+module_param(verbose, uint, 0600);
+MODULE_PARM_DESC(verbose, "Enable verbose dmesg output");
+module_param_string(force_bios, force_bios, 16, 0);
+MODULE_PARM_DESC(force_bios, "Force BIOS version and omit BIOS check");
+
+/* BIOS settings */
+struct bios_settings_t {
+        const char *vendor;
+        const char *version;
+        unsigned char fanreg;
+        unsigned char tempreg;
+        unsigned char fancmd[2]; /* fan off and auto commands */
+};
+
+/* Register addresses and values for different BIOS versions */
+static const struct bios_settings_t bios_tbl[] = {
+        {"Acer", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
+        {"Acer", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
+        {"Acer", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+        {"Acer", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+        {"Acer", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
+        {"Acer", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+        {"Acer", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+        {"Acer", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+        {"Gateway", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
+        {"Packard Bell", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
+        {"", "", 0, 0, {0, 0} }
+};
+
+static const struct bios_settings_t *bios_cfg __read_mostly;
+
+
+static int acerhdf_get_temp(int *temp)
+{
+        u8 read_temp;
+
+        if (ec_read(bios_cfg->tempreg, &read_temp))
+                return -EINVAL;
+
+        *temp = read_temp;
+
+        return 0;
+}
+
+static int acerhdf_get_fanstate(int *state)
+{
+        u8 fan;
+        bool tmp;
+
+        if (ec_read(bios_cfg->fanreg, &fan))
+                return -EINVAL;
+
+        tmp = (fan == bios_cfg->fancmd[ACERHDF_FAN_OFF]);
+        *state = tmp ? ACERHDF_FAN_OFF : ACERHDF_FAN_AUTO;
+
+        return 0;
+}
+
+static void acerhdf_change_fanstate(int state)
+{
+        unsigned char cmd;
+
+        if (verbose)
+                pr_notice("fan %s\n", (state == ACERHDF_FAN_OFF) ?
+                                "OFF" : "ON");
+
+        if ((state != ACERHDF_FAN_OFF) && (state != ACERHDF_FAN_AUTO)) {
+                pr_err("invalid fan state %d requested, setting to auto!\n",
+                        state);
+                state = ACERHDF_FAN_AUTO;
+        }
+
+        cmd = bios_cfg->fancmd[state];
+        fanstate = state;
+
+        ec_write(bios_cfg->fanreg, cmd);
+}
+
+static void acerhdf_check_param(struct thermal_zone_device *thermal)
+{
+        if (fanon > ACERHDF_MAX_FANON) {
+                pr_err("fanon temperature too high, set to %d\n",
+                                ACERHDF_MAX_FANON);
+                fanon = ACERHDF_MAX_FANON;
+        }
+
+        if (kernelmode && prev_interval != interval) {
+                if (interval > ACERHDF_MAX_INTERVAL) {
+                        pr_err("interval too high, set to %d\n",
+                                ACERHDF_MAX_INTERVAL);
+                        interval = ACERHDF_MAX_INTERVAL;
+                }
+                if (verbose)
+                        pr_notice("interval changed to: %d\n",
+                                        interval);
+                thermal->polling_delay = interval*1000;
+                prev_interval = interval;
+        }
+}
+
+/*
+ * This is the thermal zone callback which does the delayed polling of the fan
+ * state. We do check /sysfs-originating settings here in acerhdf_check_param()
+ * as late as the polling interval is since we can't do that in the respective
+ * accessors of the module parameters.
+ */
+static int acerhdf_get_ec_temp(struct thermal_zone_device *thermal,
+                               unsigned long *t)
+{
+        int temp, err = 0;
+
+        acerhdf_check_param(thermal);
+
+        err = acerhdf_get_temp(&temp);
+        if (err)
+                return err;
+
+        if (verbose)
+                pr_notice("temp %d\n", temp);
+
+        *t = temp;
+        return 0;
+}
+
+static int acerhdf_bind(struct thermal_zone_device *thermal,
+                        struct thermal_cooling_device *cdev)
+{
+        /* if the cooling device is the one from acerhdf bind it */
+        if (cdev != cl_dev)
+                return 0;
+
+        if (thermal_zone_bind_cooling_device(thermal, 0, cdev)) {
+                pr_err("error binding cooling dev\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static int acerhdf_unbind(struct thermal_zone_device *thermal,
+                          struct thermal_cooling_device *cdev)
+{
+        if (cdev != cl_dev)
+                return 0;
+
+        if (thermal_zone_unbind_cooling_device(thermal, 0, cdev)) {
+                pr_err("error unbinding cooling dev\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static inline void acerhdf_revert_to_bios_mode(void)
+{
+        acerhdf_change_fanstate(ACERHDF_FAN_AUTO);
+        kernelmode = 0;
+        if (thz_dev)
+                thz_dev->polling_delay = 0;
+        pr_notice("kernel mode fan control OFF\n");
+}
+static inline void acerhdf_enable_kernelmode(void)
+{
+        kernelmode = 1;
+
+        thz_dev->polling_delay = interval*1000;
+        thermal_zone_device_update(thz_dev);
+        pr_notice("kernel mode fan control ON\n");
+}
+
+static int acerhdf_get_mode(struct thermal_zone_device *thermal,
+                            enum thermal_device_mode *mode)
+{
+        if (verbose)
+                pr_notice("kernel mode fan control %d\n", kernelmode);
+
+        *mode = (kernelmode) ? THERMAL_DEVICE_ENABLED
+                             : THERMAL_DEVICE_DISABLED;
+
+        return 0;
+}
+
+/*
+ * set operation mode;
+ * enabled: the thermal layer of the kernel takes care about
+ *          the temperature and the fan.
+ * disabled: the BIOS takes control of the fan.
+ */
+static int acerhdf_set_mode(struct thermal_zone_device *thermal,
+                            enum thermal_device_mode mode)
+{
+        if (mode == THERMAL_DEVICE_DISABLED && kernelmode)
+                acerhdf_revert_to_bios_mode();
+        else if (mode == THERMAL_DEVICE_ENABLED && !kernelmode)
+                acerhdf_enable_kernelmode();
+
+        return 0;
+}
+
+static int acerhdf_get_trip_type(struct thermal_zone_device *thermal, int trip,
+                                 enum thermal_trip_type *type)
+{
+        if (trip == 0)
+                *type = THERMAL_TRIP_ACTIVE;
+
+        return 0;
+}
+
+static int acerhdf_get_trip_temp(struct thermal_zone_device *thermal, int trip,
+                                 unsigned long *temp)
+{
+        if (trip == 0)
+                *temp = fanon;
+
+        return 0;
+}
+
+static int acerhdf_get_crit_temp(struct thermal_zone_device *thermal,
+                                 unsigned long *temperature)
+{
+        *temperature = ACERHDF_TEMP_CRIT;
+        return 0;
+}
+
+/* bind callback functions to thermalzone */
+struct thermal_zone_device_ops acerhdf_dev_ops = {
+        .bind = acerhdf_bind,
+        .unbind = acerhdf_unbind,
+        .get_temp = acerhdf_get_ec_temp,
+        .get_mode = acerhdf_get_mode,
+        .set_mode = acerhdf_set_mode,
+        .get_trip_type = acerhdf_get_trip_type,
+        .get_trip_temp = acerhdf_get_trip_temp,
+        .get_crit_temp = acerhdf_get_crit_temp,
+};
+
+
+/*
+ * cooling device callback functions
+ * get maximal fan cooling state
+ */
+static int acerhdf_get_max_state(struct thermal_cooling_device *cdev,
+                                 unsigned long *state)
+{
+        *state = 1;
+
+        return 0;
+}
+
+static int acerhdf_get_cur_state(struct thermal_cooling_device *cdev,
+                                 unsigned long *state)
+{
+        int err = 0, tmp;
+
+        err = acerhdf_get_fanstate(&tmp);
+        if (err)
+                return err;
+
+        *state = (tmp == ACERHDF_FAN_AUTO) ? 1 : 0;
+        return 0;
+}
+
+/* change current fan state - is overwritten when running in kernel mode */
+static int acerhdf_set_cur_state(struct thermal_cooling_device *cdev,
+                                 unsigned long state)
+{
+        int cur_temp, cur_state, err = 0;
+
+        if (!kernelmode)
+                return 0;
+
+        err = acerhdf_get_temp(&cur_temp);
+        if (err) {
+                pr_err("error reading temperature, hand off control to BIOS\n");
+                goto err_out;
+        }
+
+        err = acerhdf_get_fanstate(&cur_state);
+        if (err) {
+                pr_err("error reading fan state, hand off control to BIOS\n");
+                goto err_out;
+        }
+
+        if (state == 0) {
+                /* turn fan off only if below fanoff temperature */
+                if ((cur_state == ACERHDF_FAN_AUTO) &&
+                    (cur_temp < fanoff))
+                        acerhdf_change_fanstate(ACERHDF_FAN_OFF);
+        } else {
+                if (cur_state == ACERHDF_FAN_OFF)
+                        acerhdf_change_fanstate(ACERHDF_FAN_AUTO);
+        }
+        return 0;
+
+err_out:
+        acerhdf_revert_to_bios_mode();
+        return -EINVAL;
+}
+
+/* bind fan callbacks to fan device */
+struct thermal_cooling_device_ops acerhdf_cooling_ops = {
+        .get_max_state = acerhdf_get_max_state,
+        .get_cur_state = acerhdf_get_cur_state,
+        .set_cur_state = acerhdf_set_cur_state,
+};
+
+/* suspend / resume functionality */
+static int acerhdf_suspend(struct platform_device *dev, pm_message_t state)
+{
+        if (kernelmode)
+                acerhdf_change_fanstate(ACERHDF_FAN_AUTO);
+
+        if (verbose)
+                pr_notice("going suspend\n");
+
+        return 0;
+}
+
+static int acerhdf_resume(struct platform_device *device)
+{
+        if (verbose)
+                pr_notice("resuming\n");
+
+        return 0;
+}
+
+static int __devinit acerhdf_probe(struct platform_device *device)
+{
+        return 0;
+}
+
+static int acerhdf_remove(struct platform_device *device)
+{
+        return 0;
+}
+
+struct platform_driver acerhdf_drv = {
+        .driver = {
+                .name = "acerhdf",
+                .owner = THIS_MODULE,
+        },
+        .probe = acerhdf_probe,
+        .remove = acerhdf_remove,
+        .suspend = acerhdf_suspend,
+        .resume = acerhdf_resume,
+};
+
+
+/* check hardware */
+static int acerhdf_check_hardware(void)
+{
+        char const *vendor, *version, *product;
+        int i;
+
+        /* get BIOS data */
+        vendor  = dmi_get_system_info(DMI_SYS_VENDOR);
+        version = dmi_get_system_info(DMI_BIOS_VERSION);
+        product = dmi_get_system_info(DMI_PRODUCT_NAME);
+
+        pr_info("Acer Aspire One Fan driver, v.%s\n", DRV_VER);
+
+        if (!force_bios[0]) {
+                if (strncmp(product, "AO", 2)) {
+                        pr_err("no Aspire One hardware found\n");
+                        return -EINVAL;
+                }
+        } else {
+                pr_info("forcing BIOS version: %s\n", version);
+                version = force_bios;
+                kernelmode = 0;
+        }
+
+        if (verbose)
+                pr_info("BIOS info: %s %s, product: %s\n",
+                        vendor, version, product);
+
+        /* search BIOS version and vendor in BIOS settings table */
+        for (i = 0; bios_tbl[i].version[0]; i++) {
+                if (!strcmp(bios_tbl[i].vendor, vendor) &&
+                    !strcmp(bios_tbl[i].version, version)) {
+                        bios_cfg = &bios_tbl[i];
+                        break;
+                }
+        }
+
+        if (!bios_cfg) {
+                pr_err("unknown (unsupported) BIOS version %s/%s, "
+                        "please report, aborting!\n", vendor, version);
+                return -EINVAL;
+        }
+
+        /*
+         * if started with kernel mode off, prevent the kernel from switching
+         * off the fan
+         */
+        if (!kernelmode) {
+                pr_notice("Fan control off, to enable do:\n");
+                pr_notice("echo -n \"enabled\" > "
+                        "/sys/class/thermal/thermal_zone0/mode\n");
+        }
+
+        return 0;
+}
+
+static int acerhdf_register_platform(void)
+{
+        int err = 0;
+
+        err = platform_driver_register(&acerhdf_drv);
+        if (err)
+                return err;
+
+        acerhdf_dev = platform_device_alloc("acerhdf", -1);
+        platform_device_add(acerhdf_dev);
+
+        return 0;
+}
+
+static void acerhdf_unregister_platform(void)
+{
+        if (!acerhdf_dev)
+                return;
+
+        platform_device_del(acerhdf_dev);
+        platform_driver_unregister(&acerhdf_drv);
+}
+
+static int acerhdf_register_thermal(void)
+{
+        cl_dev = thermal_cooling_device_register("acerhdf-fan", NULL,
+                                                 &acerhdf_cooling_ops);
+
+        if (IS_ERR(cl_dev))
+                return -EINVAL;
+
+        thz_dev = thermal_zone_device_register("acerhdf", 1, NULL,
+                                              &acerhdf_dev_ops, 0, 0, 0,
+                                              (kernelmode) ? interval*1000 : 0);
+        if (IS_ERR(thz_dev))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void acerhdf_unregister_thermal(void)
+{
+        if (cl_dev) {
+                thermal_cooling_device_unregister(cl_dev);
+                cl_dev = NULL;
+        }
+
+        if (thz_dev) {
+                thermal_zone_device_unregister(thz_dev);
+                thz_dev = NULL;
+        }
+}
+
+static int __init acerhdf_init(void)
+{
+        int err = 0;
+
+        err = acerhdf_check_hardware();
+        if (err)
+                goto out_err;
+
+        err = acerhdf_register_platform();
+        if (err)
+                goto err_unreg;
+
+        err = acerhdf_register_thermal();
+        if (err)
+                goto err_unreg;
+
+        return 0;
+
+err_unreg:
+        acerhdf_unregister_thermal();
+        acerhdf_unregister_platform();
+
+out_err:
+        return -ENODEV;
+}
+
+static void __exit acerhdf_exit(void)
+{
+        acerhdf_change_fanstate(ACERHDF_FAN_AUTO);
+        acerhdf_unregister_thermal();
+        acerhdf_unregister_platform();
+}
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Peter Feuerer");
+MODULE_DESCRIPTION("Aspire One temperature and fan driver");
+MODULE_ALIAS("dmi:*:*Acer*:*:");
+MODULE_ALIAS("dmi:*:*Gateway*:*:");
+MODULE_ALIAS("dmi:*:*Packard Bell*:*:");
+
+module_init(acerhdf_init);
+module_exit(acerhdf_exit);
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index bfc1a8892a32..db657bbeec90 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -33,6 +33,8 @@
  *  Sam Lin        - GPS support
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -53,9 +55,10 @@
 #define ASUS_HOTK_NAME          "Asus Laptop Support"
 #define ASUS_HOTK_CLASS         "hotkey"
 #define ASUS_HOTK_DEVICE_NAME   "Hotkey"
-#define ASUS_HOTK_FILE          "asus-laptop"
+#define ASUS_HOTK_FILE          KBUILD_MODNAME
 #define ASUS_HOTK_PREFIX        "\\_SB.ATKD."
 
+
 /*
  * Some events we use, same for all Asus
  */
@@ -207,13 +210,17 @@ MODULE_DEVICE_TABLE(acpi, asus_device_ids);
 
 static int asus_hotk_add(struct acpi_device *device);
 static int asus_hotk_remove(struct acpi_device *device, int type);
+static void asus_hotk_notify(struct acpi_device *device, u32 event);
+
 static struct acpi_driver asus_hotk_driver = {
         .name = ASUS_HOTK_NAME,
         .class = ASUS_HOTK_CLASS,
         .ids = asus_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
         .ops = {
                 .add = asus_hotk_add,
                 .remove = asus_hotk_remove,
+                .notify = asus_hotk_notify,
                 },
 };
 
@@ -323,7 +330,7 @@ static int read_wireless_status(int mask)
 
         rv = acpi_evaluate_integer(wireless_status_handle, NULL, NULL, &status);
         if (ACPI_FAILURE(rv))
-                printk(ASUS_WARNING "Error reading Wireless status\n");
+                pr_warning("Error reading Wireless status\n");
         else
                 return (status & mask) ? 1 : 0;
 
@@ -337,7 +344,7 @@ static int read_gps_status(void)
 
         rv = acpi_evaluate_integer(gps_status_handle, NULL, NULL, &status);
         if (ACPI_FAILURE(rv))
-                printk(ASUS_WARNING "Error reading GPS status\n");
+                pr_warning("Error reading GPS status\n");
         else
                 return status ? 1 : 0;
 
@@ -377,7 +384,7 @@ static void write_status(acpi_handle handle, int out, int mask)
         }
 
         if (write_acpi_int(handle, NULL, out, NULL))
-                printk(ASUS_WARNING " write failed %x\n", mask);
+                pr_warning(" write failed %x\n", mask);
 }
 
 /* /sys/class/led handlers */
@@ -420,7 +427,7 @@ static int set_lcd_state(int value)
                                               NULL, NULL, NULL);
 
                 if (ACPI_FAILURE(status))
-                        printk(ASUS_WARNING "Error switching LCD\n");
+                        pr_warning("Error switching LCD\n");
         }
 
         write_status(NULL, lcd, LCD_ON);
@@ -444,7 +451,7 @@ static int read_brightness(struct backlight_device *bd)
 
         rv = acpi_evaluate_integer(brightness_get_handle, NULL, NULL, &value);
         if (ACPI_FAILURE(rv))
-                printk(ASUS_WARNING "Error reading brightness\n");
+                pr_warning("Error reading brightness\n");
 
         return value;
 }
@@ -457,7 +464,7 @@ static int set_brightness(struct backlight_device *bd, int value)
         /* 0 <= value <= 15 */
 
         if (write_acpi_int(brightness_set_handle, NULL, value, NULL)) {
-                printk(ASUS_WARNING "Error changing brightness\n");
+                pr_warning("Error changing brightness\n");
                 ret = -EIO;
         }
 
@@ -587,7 +594,7 @@ static ssize_t store_ledd(struct device *dev, struct device_attribute *attr,
         rv = parse_arg(buf, count, &value);
         if (rv > 0) {
                 if (write_acpi_int(ledd_set_handle, NULL, value, NULL))
-                        printk(ASUS_WARNING "LED display write failed\n");
+                        pr_warning("LED display write failed\n");
                 else
                         hotk->ledd_status = (u32) value;
         }
@@ -632,7 +639,7 @@ static void set_display(int value)
 {
         /* no sanity check needed for now */
         if (write_acpi_int(display_set_handle, NULL, value, NULL))
-                printk(ASUS_WARNING "Error setting display\n");
+                pr_warning("Error setting display\n");
         return;
 }
 
@@ -647,7 +654,7 @@ static int read_display(void)
                 rv = acpi_evaluate_integer(display_get_handle, NULL,
                                            NULL, &value);
                 if (ACPI_FAILURE(rv))
-                        printk(ASUS_WARNING "Error reading display status\n");
+                        pr_warning("Error reading display status\n");
         }
 
         value &= 0x0F;          /* needed for some models, shouldn't hurt others */
@@ -689,7 +696,7 @@ static ssize_t store_disp(struct device *dev, struct device_attribute *attr,
 static void set_light_sens_switch(int value)
 {
         if (write_acpi_int(ls_switch_handle, NULL, value, NULL))
-                printk(ASUS_WARNING "Error setting light sensor switch\n");
+                pr_warning("Error setting light sensor switch\n");
         hotk->light_switch = value;
 }
 
@@ -714,7 +721,7 @@ static ssize_t store_lssw(struct device *dev, struct device_attribute *attr,
 static void set_light_sens_level(int value)
 {
         if (write_acpi_int(ls_level_handle, NULL, value, NULL))
-                printk(ASUS_WARNING "Error setting light sensor level\n");
+                pr_warning("Error setting light sensor level\n");
         hotk->light_level = value;
 }
 
@@ -812,7 +819,7 @@ static int asus_setkeycode(struct input_dev *dev, int scancode, int keycode)
         return -EINVAL;
 }
 
-static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
+static void asus_hotk_notify(struct acpi_device *device, u32 event)
 {
         static struct key_entry *key;
         u16 count;
@@ -975,11 +982,11 @@ static int asus_hotk_get_info(void)
          */
         status = acpi_get_table(ACPI_SIG_DSDT, 1, &asus_info);
         if (ACPI_FAILURE(status))
-                printk(ASUS_WARNING "Couldn't get the DSDT table header\n");
+                pr_warning("Couldn't get the DSDT table header\n");
 
         /* We have to write 0 on init this far for all ASUS models */
         if (write_acpi_int(hotk->handle, "INIT", 0, &buffer)) {
-                printk(ASUS_ERR "Hotkey initialization failed\n");
+                pr_err("Hotkey initialization failed\n");
                 return -ENODEV;
         }
 
@@ -987,9 +994,9 @@ static int asus_hotk_get_info(void)
         status =
             acpi_evaluate_integer(hotk->handle, "BSTS", NULL, &bsts_result);
         if (ACPI_FAILURE(status))
-                printk(ASUS_WARNING "Error calling BSTS\n");
+                pr_warning("Error calling BSTS\n");
         else if (bsts_result)
-                printk(ASUS_NOTICE "BSTS called, 0x%02x returned\n",
+                pr_notice("BSTS called, 0x%02x returned\n",
                        (uint) bsts_result);
 
         /* This too ... */
@@ -1020,7 +1027,7 @@ static int asus_hotk_get_info(void)
                 return -ENOMEM;
 
         if (*string)
-                printk(ASUS_NOTICE "  %s model detected\n", string);
+                pr_notice("  %s model detected\n", string);
 
         ASUS_HANDLE_INIT(mled_set);
         ASUS_HANDLE_INIT(tled_set);
@@ -1077,7 +1084,7 @@ static int asus_input_init(void)
 
         hotk->inputdev = input_allocate_device();
         if (!hotk->inputdev) {
-                printk(ASUS_INFO "Unable to allocate input device\n");
+                pr_info("Unable to allocate input device\n");
                 return 0;
         }
         hotk->inputdev->name = "Asus Laptop extra buttons";
@@ -1096,7 +1103,7 @@ static int asus_input_init(void)
         }
         result = input_register_device(hotk->inputdev);
         if (result) {
-                printk(ASUS_INFO "Unable to register input device\n");
+                pr_info("Unable to register input device\n");
                 input_free_device(hotk->inputdev);
         }
         return result;
@@ -1113,7 +1120,7 @@ static int asus_hotk_check(void)
         if (hotk->device->status.present) {
                 result = asus_hotk_get_info();
         } else {
-                printk(ASUS_ERR "Hotkey device not present, aborting\n");
+                pr_err("Hotkey device not present, aborting\n");
                 return -EINVAL;
         }
 
@@ -1124,13 +1131,12 @@ static int asus_hotk_found;
 
 static int asus_hotk_add(struct acpi_device *device)
 {
-        acpi_status status = AE_OK;
         int result;
 
         if (!device)
                 return -EINVAL;
 
-        printk(ASUS_NOTICE "Asus Laptop Support version %s\n",
+        pr_notice("Asus Laptop Support version %s\n",
                ASUS_LAPTOP_VERSION);
 
         hotk = kzalloc(sizeof(struct asus_hotk), GFP_KERNEL);
@@ -1149,15 +1155,6 @@ static int asus_hotk_add(struct acpi_device *device)
 
         asus_hotk_add_fs();
 
-        /*
-         * We install the handler, it will receive the hotk in parameter, so, we
-         * could add other data to the hotk struct
-         */
-        status = acpi_install_notify_handler(hotk->handle, ACPI_ALL_NOTIFY,
-                                             asus_hotk_notify, hotk);
-        if (ACPI_FAILURE(status))
-                printk(ASUS_ERR "Error installing notify handler\n");
-
         asus_hotk_found = 1;
 
         /* WLED and BLED are on by default */
@@ -1198,16 +1195,9 @@ end:
 
 static int asus_hotk_remove(struct acpi_device *device, int type)
 {
-        acpi_status status = 0;
-
         if (!device || !acpi_driver_data(device))
                 return -EINVAL;
 
-        status = acpi_remove_notify_handler(hotk->handle, ACPI_ALL_NOTIFY,
-                                            asus_hotk_notify);
-        if (ACPI_FAILURE(status))
-                printk(ASUS_ERR "Error removing notify handler\n");
-
         kfree(hotk->name);
         kfree(hotk);
 
@@ -1260,8 +1250,7 @@ static int asus_backlight_init(struct device *dev)
                 bd = backlight_device_register(ASUS_HOTK_FILE, dev,
                                                NULL, &asusbl_ops);
                 if (IS_ERR(bd)) {
-                        printk(ASUS_ERR
-                               "Could not register asus backlight device\n");
+                        pr_err("Could not register asus backlight device\n");
                         asus_backlight_device = NULL;
                         return PTR_ERR(bd);
                 }
@@ -1334,7 +1323,6 @@ out:
 
 static int __init asus_laptop_init(void)
 {
-        struct device *dev;
         int result;
 
         if (acpi_disabled)
@@ -1356,24 +1344,10 @@ static int __init asus_laptop_init(void)
                 return -ENODEV;
         }
 
-        dev = acpi_get_physical_device(hotk->device->handle);
-
-        if (!acpi_video_backlight_support()) {
-                result = asus_backlight_init(dev);
-                if (result)
-                        goto fail_backlight;
-        } else
-                printk(ASUS_INFO "Brightness ignored, must be controlled by "
-                       "ACPI video driver\n");
-
         result = asus_input_init();
         if (result)
                 goto fail_input;
 
-        result = asus_led_init(dev);
-        if (result)
-                goto fail_led;
-
         /* Register platform stuff */
         result = platform_driver_register(&asuspf_driver);
         if (result)
@@ -1394,8 +1368,27 @@ static int __init asus_laptop_init(void)
         if (result)
                 goto fail_sysfs;
 
+        result = asus_led_init(&asuspf_device->dev);
+        if (result)
+                goto fail_led;
+
+        if (!acpi_video_backlight_support()) {
+                result = asus_backlight_init(&asuspf_device->dev);
+                if (result)
+                        goto fail_backlight;
+        } else
+                pr_info("Brightness ignored, must be controlled by "
+                       "ACPI video driver\n");
+
         return 0;
 
+fail_backlight:
+       asus_led_exit();
+
+fail_led:
+       sysfs_remove_group(&asuspf_device->dev.kobj,
+                          &asuspf_attribute_group);
+
 fail_sysfs:
         platform_device_del(asuspf_device);
 
@@ -1406,15 +1399,9 @@ fail_platform_device1:
         platform_driver_unregister(&asuspf_driver);
 
 fail_platform_driver:
-        asus_led_exit();
-
-fail_led:
         asus_input_exit();
 
 fail_input:
-        asus_backlight_exit();
-
-fail_backlight:
 
         return result;
 }
diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
index ba1f7497e4b9..ddf5240ade8c 100644
--- a/drivers/platform/x86/asus_acpi.c
+++ b/drivers/platform/x86/asus_acpi.c
@@ -455,6 +455,8 @@ static struct asus_hotk *hotk;
  */
 static int asus_hotk_add(struct acpi_device *device);
 static int asus_hotk_remove(struct acpi_device *device, int type);
+static void asus_hotk_notify(struct acpi_device *device, u32 event);
+
 static const struct acpi_device_id asus_device_ids[] = {
         {"ATK0100", 0},
         {"", 0},
@@ -465,9 +467,11 @@ static struct acpi_driver asus_hotk_driver = {
         .name = "asus_acpi",
         .class = ACPI_HOTK_CLASS,
         .ids = asus_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
         .ops = {
                 .add = asus_hotk_add,
                 .remove = asus_hotk_remove,
+                .notify = asus_hotk_notify,
                 },
 };
 
@@ -1101,12 +1105,20 @@ static int asus_hotk_remove_fs(struct acpi_device *device)
         return 0;
 }
 
-static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
+static void asus_hotk_notify(struct acpi_device *device, u32 event)
 {
         /* TODO Find a better way to handle events count. */
         if (!hotk)
                 return;
 
+        /*
+         * The BIOS *should* be sending us device events, but apparently
+         * Asus uses system events instead, so just ignore any device
+         * events we get.
+         */
+        if (event > ACPI_MAX_SYS_NOTIFY)
+                return;
+
         if ((event & ~((u32) BR_UP)) < 16)
                 hotk->brightness = (event & ~((u32) BR_UP));
         else if ((event & ~((u32) BR_DOWN)) < 16)
@@ -1346,15 +1358,6 @@ static int asus_hotk_add(struct acpi_device *device)
         if (result)
                 goto end;
 
-        /*
-         * We install the handler, it will receive the hotk in parameter, so, we
-         * could add other data to the hotk struct
-         */
-        status = acpi_install_notify_handler(hotk->handle, ACPI_SYSTEM_NOTIFY,
-                                             asus_hotk_notify, hotk);
-        if (ACPI_FAILURE(status))
-                printk(KERN_ERR "  Error installing notify handler\n");
-
         /* For laptops without GPLV: init the hotk->brightness value */
         if ((!hotk->methods->brightness_get)
             && (!hotk->methods->brightness_status)
@@ -1389,16 +1392,9 @@ end:
 
 static int asus_hotk_remove(struct acpi_device *device, int type)
 {
-        acpi_status status = 0;
-
         if (!device || !acpi_driver_data(device))
                 return -EINVAL;
 
-        status = acpi_remove_notify_handler(hotk->handle, ACPI_SYSTEM_NOTIFY,
-                                            asus_hotk_notify);
-        if (ACPI_FAILURE(status))
-                printk(KERN_ERR "Asus ACPI: Error removing notify handler\n");
-
         asus_hotk_remove_fs(device);
 
         kfree(hotk);
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 2fab94162147..0f900cc9fa7a 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -46,10 +46,53 @@ struct key_entry {
         u16 keycode;
 };
 
-enum { KE_KEY, KE_SW, KE_END };
+enum { KE_KEY, KE_SW, KE_IGNORE, KE_END };
+
+/*
+ * Certain keys are flagged as KE_IGNORE. All of these are either
+ * notifications (rather than requests for change) or are also sent
+ * via the keyboard controller so should not be sent again.
+ */
 
 static struct key_entry dell_wmi_keymap[] = {
         {KE_KEY, 0xe045, KEY_PROG1},
+        {KE_KEY, 0xe009, KEY_EJECTCD},
+
+        /* These also contain the brightness level at offset 6 */
+        {KE_KEY, 0xe006, KEY_BRIGHTNESSUP},
+        {KE_KEY, 0xe005, KEY_BRIGHTNESSDOWN},
+
+        /* Battery health status button */
+        {KE_KEY, 0xe007, KEY_BATTERY},
+
+        /* This is actually for all radios. Although physically a
+         * switch, the notification does not provide an indication of
+         * state and so it should be reported as a key */
+        {KE_KEY, 0xe008, KEY_WLAN},
+
+        /* The next device is at offset 6, the active devices are at
+           offset 8 and the attached devices at offset 10 */
+        {KE_KEY, 0xe00b, KEY_DISPLAYTOGGLE},
+
+        {KE_IGNORE, 0xe00c, KEY_KBDILLUMTOGGLE},
+
+        /* BIOS error detected */
+        {KE_IGNORE, 0xe00d, KEY_RESERVED},
+
+        /* Wifi Catcher */
+        {KE_KEY, 0xe011, KEY_PROG2},
+
+        /* Ambient light sensor toggle */
+        {KE_IGNORE, 0xe013, KEY_RESERVED},
+
+        {KE_IGNORE, 0xe020, KEY_MUTE},
+        {KE_IGNORE, 0xe02e, KEY_VOLUMEDOWN},
+        {KE_IGNORE, 0xe030, KEY_VOLUMEUP},
+        {KE_IGNORE, 0xe033, KEY_KBDILLUMUP},
+        {KE_IGNORE, 0xe034, KEY_KBDILLUMDOWN},
+        {KE_IGNORE, 0xe03a, KEY_CAPSLOCK},
+        {KE_IGNORE, 0xe045, KEY_NUMLOCK},
+        {KE_IGNORE, 0xe046, KEY_SCROLLLOCK},
         {KE_END, 0}
 };
 
@@ -122,15 +165,20 @@ static void dell_wmi_notify(u32 value, void *context)
 
         if (obj && obj->type == ACPI_TYPE_BUFFER) {
                 int *buffer = (int *)obj->buffer.pointer;
-                key = dell_wmi_get_entry_by_scancode(buffer[1]);
+                /*
+                 *  The upper bytes of the event may contain
+                 *  additional information, so mask them off for the
+                 *  scancode lookup
+                 */
+                key = dell_wmi_get_entry_by_scancode(buffer[1] & 0xFFFF);
                 if (key) {
                         input_report_key(dell_wmi_input_dev, key->keycode, 1);
                         input_sync(dell_wmi_input_dev);
                         input_report_key(dell_wmi_input_dev, key->keycode, 0);
                         input_sync(dell_wmi_input_dev);
-                } else
+                } else if (buffer[1] & 0xFFFF)
                         printk(KERN_INFO "dell-wmi: Unknown key %x pressed\n",
-                               buffer[1]);
+                               buffer[1] & 0xFFFF);
         }
 }
 
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 8153b3e59189..4207b26ff990 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -62,7 +62,10 @@ enum {
         DISABLE_ASL_GPS = 0x0020,
         DISABLE_ASL_DISPLAYSWITCH = 0x0040,
         DISABLE_ASL_MODEM = 0x0080,
-        DISABLE_ASL_CARDREADER = 0x0100
+        DISABLE_ASL_CARDREADER = 0x0100,
+        DISABLE_ASL_3G = 0x0200,
+        DISABLE_ASL_WIMAX = 0x0400,
+        DISABLE_ASL_HWCF = 0x0800
 };
 
 enum {
@@ -87,7 +90,13 @@ enum {
         CM_ASL_USBPORT3,
         CM_ASL_MODEM,
         CM_ASL_CARDREADER,
-        CM_ASL_LID
+        CM_ASL_3G,
+        CM_ASL_WIMAX,
+        CM_ASL_HWCF,
+        CM_ASL_LID,
+        CM_ASL_TYPE,
+        CM_ASL_PANELPOWER,      /*P901*/
+        CM_ASL_TPD
 };
 
 static const char *cm_getv[] = {
@@ -96,7 +105,8 @@ static const char *cm_getv[] = {
         NULL, "PBLG", NULL, NULL,
         "CFVG", NULL, NULL, NULL,
         "USBG", NULL, NULL, "MODG",
-        "CRDG", "LIDG"
+        "CRDG", "M3GG", "WIMG", "HWCF",
+        "LIDG", "TYPE", "PBPG", "TPDG"
 };
 
 static const char *cm_setv[] = {
@@ -105,7 +115,8 @@ static const char *cm_setv[] = {
         "SDSP", "PBLS", "HDPS", NULL,
         "CFVS", NULL, NULL, NULL,
         "USBG", NULL, NULL, "MODS",
-        "CRDS", NULL
+        "CRDS", "M3GS", "WIMS", NULL,
+        NULL, NULL, "PBPS", "TPDS"
 };
 
 #define EEEPC_EC        "\\_SB.PCI0.SBRG.EC0."
@@ -181,6 +192,7 @@ static struct key_entry eeepc_keymap[] = {
 static int eeepc_hotk_add(struct acpi_device *device);
 static int eeepc_hotk_remove(struct acpi_device *device, int type);
 static int eeepc_hotk_resume(struct acpi_device *device);
+static void eeepc_hotk_notify(struct acpi_device *device, u32 event);
 
 static const struct acpi_device_id eeepc_device_ids[] = {
         {EEEPC_HOTK_HID, 0},
@@ -192,10 +204,12 @@ static struct acpi_driver eeepc_hotk_driver = {
         .name = EEEPC_HOTK_NAME,
         .class = EEEPC_HOTK_CLASS,
         .ids = eeepc_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
         .ops = {
                 .add = eeepc_hotk_add,
                 .remove = eeepc_hotk_remove,
                 .resume = eeepc_hotk_resume,
+                .notify = eeepc_hotk_notify,
         },
 };
 
@@ -318,6 +332,15 @@ static const struct rfkill_ops eeepc_rfkill_ops = {
         .set_block = eeepc_rfkill_set,
 };
 
+static void __init eeepc_enable_camera(void)
+{
+        /*
+         * If the following call to set_acpi() fails, it's because there's no
+         * camera so we can ignore the error.
+         */
+        set_acpi(CM_ASL_CAMERA, 1);
+}
+
 /*
  * Sys helpers
  */
@@ -369,13 +392,88 @@ static ssize_t show_sys_acpi(int cm, char *buf)
 EEEPC_CREATE_DEVICE_ATTR(camera, CM_ASL_CAMERA);
 EEEPC_CREATE_DEVICE_ATTR(cardr, CM_ASL_CARDREADER);
 EEEPC_CREATE_DEVICE_ATTR(disp, CM_ASL_DISPLAYSWITCH);
-EEEPC_CREATE_DEVICE_ATTR(cpufv, CM_ASL_CPUFV);
+
+struct eeepc_cpufv {
+        int num;
+        int cur;
+};
+
+static int get_cpufv(struct eeepc_cpufv *c)
+{
+        c->cur = get_acpi(CM_ASL_CPUFV);
+        c->num = (c->cur >> 8) & 0xff;
+        c->cur &= 0xff;
+        if (c->cur < 0 || c->num <= 0 || c->num > 12)
+                return -ENODEV;
+        return 0;
+}
+
+static ssize_t show_available_cpufv(struct device *dev,
+                                    struct device_attribute *attr,
+                                    char *buf)
+{
+        struct eeepc_cpufv c;
+        int i;
+        ssize_t len = 0;
+
+        if (get_cpufv(&c))
+                return -ENODEV;
+        for (i = 0; i < c.num; i++)
+                len += sprintf(buf + len, "%d ", i);
+        len += sprintf(buf + len, "\n");
+        return len;
+}
+
+static ssize_t show_cpufv(struct device *dev,
+                          struct device_attribute *attr,
+                          char *buf)
+{
+        struct eeepc_cpufv c;
+
+        if (get_cpufv(&c))
+                return -ENODEV;
+        return sprintf(buf, "%#x\n", (c.num << 8) | c.cur);
+}
+
+static ssize_t store_cpufv(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct eeepc_cpufv c;
+        int rv, value;
+
+        if (get_cpufv(&c))
+                return -ENODEV;
+        rv = parse_arg(buf, count, &value);
+        if (rv < 0)
+                return rv;
+        if (!rv || value < 0 || value >= c.num)
+                return -EINVAL;
+        set_acpi(CM_ASL_CPUFV, value);
+        return rv;
+}
+
+static struct device_attribute dev_attr_cpufv = {
+        .attr = {
+                .name = "cpufv",
+                .mode = 0644 },
+        .show   = show_cpufv,
+        .store  = store_cpufv
+};
+
+static struct device_attribute dev_attr_available_cpufv = {
+        .attr = {
+                .name = "available_cpufv",
+                .mode = 0444 },
+        .show   = show_available_cpufv
+};
 
 static struct attribute *platform_attributes[] = {
         &dev_attr_camera.attr,
         &dev_attr_cardr.attr,
         &dev_attr_disp.attr,
         &dev_attr_cpufv.attr,
+        &dev_attr_available_cpufv.attr,
         NULL
 };
 
@@ -558,7 +656,7 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
         eeepc_rfkill_hotplug();
 }
 
-static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
+static void eeepc_hotk_notify(struct acpi_device *device, u32 event)
 {
         static struct key_entry *key;
         u16 count;
@@ -566,6 +664,8 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
 
         if (!ehotk)
                 return;
+        if (event > ACPI_MAX_SYS_NOTIFY)
+                return;
         if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX)
                 brn = notify_brn();
         count = ehotk->event_count[event % 128]++;
@@ -646,7 +746,6 @@ static void eeepc_unregister_rfkill_notifier(char *node)
 
 static int eeepc_hotk_add(struct acpi_device *device)
 {
-        acpi_status status = AE_OK;
         int result;
 
         if (!device)
@@ -664,10 +763,6 @@ static int eeepc_hotk_add(struct acpi_device *device)
         result = eeepc_hotk_check();
         if (result)
                 goto ehotk_fail;
-        status = acpi_install_notify_handler(ehotk->handle, ACPI_SYSTEM_NOTIFY,
-                                             eeepc_hotk_notify, ehotk);
-        if (ACPI_FAILURE(status))
-                printk(EEEPC_ERR "Error installing notify handler\n");
 
         eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
         eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
@@ -725,14 +820,8 @@ static int eeepc_hotk_add(struct acpi_device *device)
 
 static int eeepc_hotk_remove(struct acpi_device *device, int type)
 {
-        acpi_status status = 0;
-
         if (!device || !acpi_driver_data(device))
                  return -EINVAL;
-        status = acpi_remove_notify_handler(ehotk->handle, ACPI_SYSTEM_NOTIFY,
-                                            eeepc_hotk_notify);
-        if (ACPI_FAILURE(status))
-                printk(EEEPC_ERR "Error removing notify handler\n");
 
         eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
         eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
@@ -989,6 +1078,9 @@ static int __init eeepc_laptop_init(void)
         result = eeepc_hwmon_init(dev);
         if (result)
                 goto fail_hwmon;
+
+        eeepc_enable_camera();
+
         /* Register platform stuff */
         result = platform_driver_register(&platform_driver);
         if (result)
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 16fffe44e333..4ac2311c00af 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -47,7 +47,7 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_DISPLAY_QUERY 0x1
 #define HPWMI_HDDTEMP_QUERY 0x2
 #define HPWMI_ALS_QUERY 0x3
-#define HPWMI_DOCK_QUERY 0x4
+#define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
 #define HPWMI_HOTKEY_QUERY 0xc
 
@@ -75,10 +75,9 @@ struct key_entry {
         u16 keycode;
 };
 
-enum { KE_KEY, KE_SW, KE_END };
+enum { KE_KEY, KE_END };
 
 static struct key_entry hp_wmi_keymap[] = {
-        {KE_SW, 0x01, SW_DOCK},
         {KE_KEY, 0x02, KEY_BRIGHTNESSUP},
         {KE_KEY, 0x03, KEY_BRIGHTNESSDOWN},
         {KE_KEY, 0x20e6, KEY_PROG1},
@@ -151,7 +150,22 @@ static int hp_wmi_als_state(void)
 
 static int hp_wmi_dock_state(void)
 {
-        return hp_wmi_perform_query(HPWMI_DOCK_QUERY, 0, 0);
+        int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, 0);
+
+        if (ret < 0)
+                return ret;
+
+        return ret & 0x1;
+}
+
+static int hp_wmi_tablet_state(void)
+{
+        int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, 0);
+
+        if (ret < 0)
+                return ret;
+
+        return (ret & 0x4) ? 1 : 0;
 }
 
 static int hp_wmi_set_block(void *data, bool blocked)
@@ -232,6 +246,15 @@ static ssize_t show_dock(struct device *dev, struct device_attribute *attr,
         return sprintf(buf, "%d\n", value);
 }
 
+static ssize_t show_tablet(struct device *dev, struct device_attribute *attr,
+                         char *buf)
+{
+        int value = hp_wmi_tablet_state();
+        if (value < 0)
+                return -EINVAL;
+        return sprintf(buf, "%d\n", value);
+}
+
 static ssize_t set_als(struct device *dev, struct device_attribute *attr,
                        const char *buf, size_t count)
 {
@@ -244,6 +267,7 @@ static DEVICE_ATTR(display, S_IRUGO, show_display, NULL);
 static DEVICE_ATTR(hddtemp, S_IRUGO, show_hddtemp, NULL);
 static DEVICE_ATTR(als, S_IRUGO | S_IWUSR, show_als, set_als);
 static DEVICE_ATTR(dock, S_IRUGO, show_dock, NULL);
+static DEVICE_ATTR(tablet, S_IRUGO, show_tablet, NULL);
 
 static struct key_entry *hp_wmi_get_entry_by_scancode(int code)
 {
@@ -326,13 +350,13 @@ static void hp_wmi_notify(u32 value, void *context)
                                                  key->keycode, 0);
                                 input_sync(hp_wmi_input_dev);
                                 break;
-                        case KE_SW:
-                                input_report_switch(hp_wmi_input_dev,
-                                                    key->keycode,
-                                                    hp_wmi_dock_state());
-                                input_sync(hp_wmi_input_dev);
-                                break;
                         }
+                } else if (eventcode == 0x1) {
+                        input_report_switch(hp_wmi_input_dev, SW_DOCK,
+                                            hp_wmi_dock_state());
+                        input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+                                            hp_wmi_tablet_state());
+                        input_sync(hp_wmi_input_dev);
                 } else if (eventcode == 0x5) {
                         if (wifi_rfkill)
                                 rfkill_set_sw_state(wifi_rfkill,
@@ -369,18 +393,19 @@ static int __init hp_wmi_input_setup(void)
                         set_bit(EV_KEY, hp_wmi_input_dev->evbit);
                         set_bit(key->keycode, hp_wmi_input_dev->keybit);
                         break;
-                case KE_SW:
-                        set_bit(EV_SW, hp_wmi_input_dev->evbit);
-                        set_bit(key->keycode, hp_wmi_input_dev->swbit);
-
-                        /* Set initial dock state */
-                        input_report_switch(hp_wmi_input_dev, key->keycode,
-                                            hp_wmi_dock_state());
-                        input_sync(hp_wmi_input_dev);
-                        break;
                 }
         }
 
+        set_bit(EV_SW, hp_wmi_input_dev->evbit);
+        set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
+        set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+
+        /* Set initial hardware state */
+        input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state());
+        input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+                            hp_wmi_tablet_state());
+        input_sync(hp_wmi_input_dev);
+
         err = input_register_device(hp_wmi_input_dev);
 
         if (err) {
@@ -397,6 +422,7 @@ static void cleanup_sysfs(struct platform_device *device)
         device_remove_file(&device->dev, &dev_attr_hddtemp);
         device_remove_file(&device->dev, &dev_attr_als);
         device_remove_file(&device->dev, &dev_attr_dock);
+        device_remove_file(&device->dev, &dev_attr_tablet);
 }
 
 static int __init hp_wmi_bios_setup(struct platform_device *device)
@@ -416,6 +442,9 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
         err = device_create_file(&device->dev, &dev_attr_dock);
         if (err)
                 goto add_sysfs_error;
+        err = device_create_file(&device->dev, &dev_attr_tablet);
+        if (err)
+                goto add_sysfs_error;
 
         if (wireless & 0x1) {
                 wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev,
@@ -485,23 +514,17 @@ static int __exit hp_wmi_bios_remove(struct platform_device *device)
 
 static int hp_wmi_resume_handler(struct platform_device *device)
 {
-        struct key_entry *key;
-
         /*
-         * Docking state may have changed while suspended, so trigger
-         * an input event for the current state. As this is a switch,
+         * Hardware state may have changed while suspended, so trigger
+         * input events for the current state. As this is a switch,
          * the input layer will only actually pass it on if the state
          * changed.
          */
-        for (key = hp_wmi_keymap; key->type != KE_END; key++) {
-                switch (key->type) {
-                case KE_SW:
-                        input_report_switch(hp_wmi_input_dev, key->keycode,
-                                            hp_wmi_dock_state());
-                        input_sync(hp_wmi_input_dev);
-                        break;
-                }
-        }
+
+        input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state());
+        input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+                            hp_wmi_tablet_state());
+        input_sync(hp_wmi_input_dev);
 
         return 0;
 }
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 40d64c03278c..a463fd72c495 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -22,7 +22,7 @@
  */
 
 #define TPACPI_VERSION "0.23"
-#define TPACPI_SYSFS_VERSION 0x020300
+#define TPACPI_SYSFS_VERSION 0x020400
 
 /*
  *  Changelog:
@@ -257,6 +257,8 @@ static struct {
         u32 wan:1;
         u32 uwb:1;
         u32 fan_ctrl_status_undef:1;
+        u32 second_fan:1;
+        u32 beep_needs_two_args:1;
         u32 input_device_registered:1;
         u32 platform_drv_registered:1;
         u32 platform_drv_attrs_registered:1;
@@ -277,8 +279,10 @@ struct thinkpad_id_data {
         char *bios_version_str; /* Something like 1ZET51WW (1.03z) */
         char *ec_version_str;   /* Something like 1ZHT51WW-1.04a */
 
-        u16 bios_model;         /* Big Endian, TP-1Y = 0x5931, 0 = unknown */
+        u16 bios_model;         /* 1Y = 0x5931, 0 = unknown */
         u16 ec_model;
+        u16 bios_release;       /* 1ZETK1WW = 0x314b, 0 = unknown */
+        u16 ec_release;
 
         char *model_str;        /* ThinkPad T43 */
         char *nummodel_str;     /* 9384A9C for a 9384-A9C model */
@@ -355,6 +359,73 @@ static void tpacpi_log_usertask(const char * const what)
                 } \
         } while (0)
 
+/*
+ * Quirk handling helpers
+ *
+ * ThinkPad IDs and versions seen in the field so far
+ * are two-characters from the set [0-9A-Z], i.e. base 36.
+ *
+ * We use values well outside that range as specials.
+ */
+
+#define TPACPI_MATCH_ANY                0xffffU
+#define TPACPI_MATCH_UNKNOWN            0U
+
+/* TPID('1', 'Y') == 0x5931 */
+#define TPID(__c1, __c2) (((__c2) << 8) | (__c1))
+
+#define TPACPI_Q_IBM(__id1, __id2, __quirk)     \
+        { .vendor = PCI_VENDOR_ID_IBM,          \
+          .bios = TPID(__id1, __id2),           \
+          .ec = TPACPI_MATCH_ANY,               \
+          .quirks = (__quirk) }
+
+#define TPACPI_Q_LNV(__id1, __id2, __quirk)     \
+        { .vendor = PCI_VENDOR_ID_LENOVO,       \
+          .bios = TPID(__id1, __id2),           \
+          .ec = TPACPI_MATCH_ANY,               \
+          .quirks = (__quirk) }
+
+struct tpacpi_quirk {
+        unsigned int vendor;
+        u16 bios;
+        u16 ec;
+        unsigned long quirks;
+};
+
+/**
+ * tpacpi_check_quirks() - search BIOS/EC version on a list
+ * @qlist:              array of &struct tpacpi_quirk
+ * @qlist_size:         number of elements in @qlist
+ *
+ * Iterates over a quirks list until one is found that matches the
+ * ThinkPad's vendor, BIOS and EC model.
+ *
+ * Returns 0 if nothing matches, otherwise returns the quirks field of
+ * the matching &struct tpacpi_quirk entry.
+ *
+ * The match criteria is: vendor, ec and bios much match.
+ */
+static unsigned long __init tpacpi_check_quirks(
+                        const struct tpacpi_quirk *qlist,
+                        unsigned int qlist_size)
+{
+        while (qlist_size) {
+                if ((qlist->vendor == thinkpad_id.vendor ||
+                                qlist->vendor == TPACPI_MATCH_ANY) &&
+                    (qlist->bios == thinkpad_id.bios_model ||
+                                qlist->bios == TPACPI_MATCH_ANY) &&
+                    (qlist->ec == thinkpad_id.ec_model ||
+                                qlist->ec == TPACPI_MATCH_ANY))
+                        return qlist->quirks;
+
+                qlist_size--;
+                qlist++;
+        }
+        return 0;
+}
+
+
 /****************************************************************************
  ****************************************************************************
  *
@@ -2880,7 +2951,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
                 /* update bright_acpimode... */
                 tpacpi_check_std_acpi_brightness_support();
 
-        if (tp_features.bright_acpimode) {
+        if (tp_features.bright_acpimode && acpi_video_backlight_support()) {
                 printk(TPACPI_INFO
                        "This ThinkPad has standard ACPI backlight "
                        "brightness control, supported by the ACPI "
@@ -4773,7 +4844,7 @@ TPACPI_HANDLE(led, ec, "SLED",	/* 570 */
            "LED",               /* all others */
            );                   /* R30, R31 */
 
-#define TPACPI_LED_NUMLEDS 8
+#define TPACPI_LED_NUMLEDS 16
 static struct tpacpi_led_classdev *tpacpi_leds;
 static enum led_status_t tpacpi_led_state_cache[TPACPI_LED_NUMLEDS];
 static const char * const tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
@@ -4786,15 +4857,20 @@ static const char * const tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
         "tpacpi::dock_batt",
         "tpacpi::unknown_led",
         "tpacpi::standby",
+        "tpacpi::dock_status1",
+        "tpacpi::dock_status2",
+        "tpacpi::unknown_led2",
+        "tpacpi::unknown_led3",
+        "tpacpi::thinkvantage",
 };
-#define TPACPI_SAFE_LEDS        0x0081U
+#define TPACPI_SAFE_LEDS        0x1081U
 
 static inline bool tpacpi_is_led_restricted(const unsigned int led)
 {
 #ifdef CONFIG_THINKPAD_ACPI_UNSAFE_LEDS
         return false;
 #else
-        return (TPACPI_SAFE_LEDS & (1 << led)) == 0;
+        return (1U & (TPACPI_SAFE_LEDS >> led)) == 0;
 #endif
 }
 
@@ -4956,6 +5032,10 @@ static int __init tpacpi_init_led(unsigned int led)
 
         tpacpi_leds[led].led = led;
 
+        /* LEDs with no name don't get registered */
+        if (!tpacpi_led_names[led])
+                return 0;
+
         tpacpi_leds[led].led_classdev.brightness_set = &led_sysfs_set;
         tpacpi_leds[led].led_classdev.blink_set = &led_sysfs_blink_set;
         if (led_supported == TPACPI_LED_570)
@@ -4974,10 +5054,59 @@ static int __init tpacpi_init_led(unsigned int led)
         return rc;
 }
 
+static const struct tpacpi_quirk led_useful_qtable[] __initconst = {
+        TPACPI_Q_IBM('1', 'E', 0x009f), /* A30 */
+        TPACPI_Q_IBM('1', 'N', 0x009f), /* A31 */
+        TPACPI_Q_IBM('1', 'G', 0x009f), /* A31 */
+
+        TPACPI_Q_IBM('1', 'I', 0x0097), /* T30 */
+        TPACPI_Q_IBM('1', 'R', 0x0097), /* T40, T41, T42, R50, R51 */
+        TPACPI_Q_IBM('7', '0', 0x0097), /* T43, R52 */
+        TPACPI_Q_IBM('1', 'Y', 0x0097), /* T43 */
+        TPACPI_Q_IBM('1', 'W', 0x0097), /* R50e */
+        TPACPI_Q_IBM('1', 'V', 0x0097), /* R51 */
+        TPACPI_Q_IBM('7', '8', 0x0097), /* R51e */
+        TPACPI_Q_IBM('7', '6', 0x0097), /* R52 */
+
+        TPACPI_Q_IBM('1', 'K', 0x00bf), /* X30 */
+        TPACPI_Q_IBM('1', 'Q', 0x00bf), /* X31, X32 */
+        TPACPI_Q_IBM('1', 'U', 0x00bf), /* X40 */
+        TPACPI_Q_IBM('7', '4', 0x00bf), /* X41 */
+        TPACPI_Q_IBM('7', '5', 0x00bf), /* X41t */
+
+        TPACPI_Q_IBM('7', '9', 0x1f97), /* T60 (1) */
+        TPACPI_Q_IBM('7', '7', 0x1f97), /* Z60* (1) */
+        TPACPI_Q_IBM('7', 'F', 0x1f97), /* Z61* (1) */
+        TPACPI_Q_IBM('7', 'B', 0x1fb7), /* X60 (1) */
+
+        /* (1) - may have excess leds enabled on MSB */
+
+        /* Defaults (order matters, keep last, don't reorder!) */
+        { /* Lenovo */
+          .vendor = PCI_VENDOR_ID_LENOVO,
+          .bios = TPACPI_MATCH_ANY, .ec = TPACPI_MATCH_ANY,
+          .quirks = 0x1fffU,
+        },
+        { /* IBM ThinkPads with no EC version string */
+          .vendor = PCI_VENDOR_ID_IBM,
+          .bios = TPACPI_MATCH_ANY, .ec = TPACPI_MATCH_UNKNOWN,
+          .quirks = 0x00ffU,
+        },
+        { /* IBM ThinkPads with EC version string */
+          .vendor = PCI_VENDOR_ID_IBM,
+          .bios = TPACPI_MATCH_ANY, .ec = TPACPI_MATCH_ANY,
+          .quirks = 0x00bfU,
+        },
+};
+
+#undef TPACPI_LEDQ_IBM
+#undef TPACPI_LEDQ_LNV
+
 static int __init led_init(struct ibm_init_struct *iibm)
 {
         unsigned int i;
         int rc;
+        unsigned long useful_leds;
 
         vdbg_printk(TPACPI_DBG_INIT, "initializing LED subdriver\n");
 
@@ -4999,6 +5128,9 @@ static int __init led_init(struct ibm_init_struct *iibm)
         vdbg_printk(TPACPI_DBG_INIT, "LED commands are %s, mode %d\n",
                 str_supported(led_supported), led_supported);
 
+        if (led_supported == TPACPI_LED_NONE)
+                return 1;
+
         tpacpi_leds = kzalloc(sizeof(*tpacpi_leds) * TPACPI_LED_NUMLEDS,
                               GFP_KERNEL);
         if (!tpacpi_leds) {
@@ -5006,8 +5138,12 @@ static int __init led_init(struct ibm_init_struct *iibm)
                 return -ENOMEM;
         }
 
+        useful_leds = tpacpi_check_quirks(led_useful_qtable,
+                                          ARRAY_SIZE(led_useful_qtable));
+
         for (i = 0; i < TPACPI_LED_NUMLEDS; i++) {
-                if (!tpacpi_is_led_restricted(i)) {
+                if (!tpacpi_is_led_restricted(i) &&
+                    test_bit(i, &useful_leds)) {
                         rc = tpacpi_init_led(i);
                         if (rc < 0) {
                                 led_exit();
@@ -5017,12 +5153,11 @@ static int __init led_init(struct ibm_init_struct *iibm)
         }
 
 #ifdef CONFIG_THINKPAD_ACPI_UNSAFE_LEDS
-        if (led_supported != TPACPI_LED_NONE)
-                printk(TPACPI_NOTICE
-                        "warning: userspace override of important "
-                        "firmware LEDs is enabled\n");
+        printk(TPACPI_NOTICE
+                "warning: userspace override of important "
+                "firmware LEDs is enabled\n");
 #endif
-        return (led_supported != TPACPI_LED_NONE)? 0 : 1;
+        return 0;
 }
 
 #define str_led_status(s) \
@@ -5052,7 +5187,7 @@ static int led_read(char *p)
         }
 
         len += sprintf(p + len, "commands:\t"
-                       "<led> on, <led> off, <led> blink (<led> is 0-7)\n");
+                       "<led> on, <led> off, <led> blink (<led> is 0-15)\n");
 
         return len;
 }
@@ -5067,7 +5202,7 @@ static int led_write(char *buf)
                 return -ENODEV;
 
         while ((cmd = next_cmd(&buf))) {
-                if (sscanf(cmd, "%d", &led) != 1 || led < 0 || led > 7)
+                if (sscanf(cmd, "%d", &led) != 1 || led < 0 || led > 15)
                         return -EINVAL;
 
                 if (strstr(cmd, "off")) {
@@ -5101,8 +5236,17 @@ static struct ibm_struct led_driver_data = {
 
 TPACPI_HANDLE(beep, ec, "BEEP");        /* all except R30, R31 */
 
+#define TPACPI_BEEP_Q1 0x0001
+
+static const struct tpacpi_quirk beep_quirk_table[] __initconst = {
+        TPACPI_Q_IBM('I', 'M', TPACPI_BEEP_Q1), /* 570 */
+        TPACPI_Q_IBM('I', 'U', TPACPI_BEEP_Q1), /* 570E - unverified */
+};
+
 static int __init beep_init(struct ibm_init_struct *iibm)
 {
+        unsigned long quirks;
+
         vdbg_printk(TPACPI_DBG_INIT, "initializing beep subdriver\n");
 
         TPACPI_ACPIHANDLE_INIT(beep);
@@ -5110,6 +5254,11 @@ static int __init beep_init(struct ibm_init_struct *iibm)
         vdbg_printk(TPACPI_DBG_INIT, "beep is %s\n",
                 str_supported(beep_handle != NULL));
 
+        quirks = tpacpi_check_quirks(beep_quirk_table,
+                                     ARRAY_SIZE(beep_quirk_table));
+
+        tp_features.beep_needs_two_args = !!(quirks & TPACPI_BEEP_Q1);
+
         return (beep_handle)? 0 : 1;
 }
 
@@ -5141,8 +5290,15 @@ static int beep_write(char *buf)
                         /* beep_cmd set */
                 } else
                         return -EINVAL;
-                if (!acpi_evalf(beep_handle, NULL, NULL, "vdd", beep_cmd, 0))
-                        return -EIO;
+                if (tp_features.beep_needs_two_args) {
+                        if (!acpi_evalf(beep_handle, NULL, NULL, "vdd",
+                                        beep_cmd, 0))
+                                return -EIO;
+                } else {
+                        if (!acpi_evalf(beep_handle, NULL, NULL, "vd",
+                                        beep_cmd))
+                                return -EIO;
+                }
         }
 
         return 0;
@@ -5569,6 +5725,10 @@ static struct ibm_struct ecdump_driver_data = {
  *   Bit 3-0: backlight brightness level
  *
  * brightness_get_raw returns status data in the HBRV layout
+ *
+ * WARNING: The X61 has been verified to use HBRV for something else, so
+ * this should be used _only_ on IBM ThinkPads, and maybe with some careful
+ * testing on the very early *60 Lenovo models...
  */
 
 enum {
@@ -5869,6 +6029,12 @@ static int __init brightness_init(struct ibm_init_struct *iibm)
                            brightness_mode);
         }
 
+        /* Safety */
+        if (thinkpad_id.vendor != PCI_VENDOR_ID_IBM &&
+            (brightness_mode == TPACPI_BRGHT_MODE_ECNVRAM ||
+             brightness_mode == TPACPI_BRGHT_MODE_EC))
+                return -EINVAL;
+
         if (tpacpi_brightness_get_raw(&b) < 0)
                 return 1;
 
@@ -6161,6 +6327,21 @@ static struct ibm_struct volume_driver_data = {
  *      For firmware bugs, refer to:
  *      http://thinkwiki.org/wiki/Embedded_Controller_Firmware#Firmware_Issues
  *
+ *      ----
+ *
+ *      ThinkPad EC register 0x31 bit 0 (only on select models)
+ *
+ *      When bit 0 of EC register 0x31 is zero, the tachometer registers
+ *      show the speed of the main fan.  When bit 0 of EC register 0x31
+ *      is one, the tachometer registers show the speed of the auxiliary
+ *      fan.
+ *
+ *      Fan control seems to affect both fans, regardless of the state
+ *      of this bit.
+ *
+ *      So far, only the firmware for the X60/X61 non-tablet versions
+ *      seem to support this (firmware TP-7M).
+ *
  * TPACPI_FAN_WR_ACPI_FANS:
  *      ThinkPad X31, X40, X41.  Not available in the X60.
  *
@@ -6187,6 +6368,8 @@ enum {					/* Fan control constants */
         fan_status_offset = 0x2f,       /* EC register 0x2f */
         fan_rpm_offset = 0x84,          /* EC register 0x84: LSB, 0x85 MSB (RPM)
                                          * 0x84 must be read before 0x85 */
+        fan_select_offset = 0x31,       /* EC register 0x31 (Firmware 7M)
+                                           bit 0 selects which fan is active */
 
         TP_EC_FAN_FULLSPEED = 0x40,     /* EC fan mode: full speed */
         TP_EC_FAN_AUTO      = 0x80,     /* EC fan mode: auto fan control */
@@ -6249,30 +6432,18 @@ TPACPI_HANDLE(sfan, ec, "SFAN",	/* 570 */
  * We assume 0x07 really means auto mode while this quirk is active,
  * as this is far more likely than the ThinkPad being in level 7,
  * which is only used by the firmware during thermal emergencies.
+ *
+ * Enable for TP-1Y (T43), TP-78 (R51e), TP-76 (R52),
+ * TP-70 (T43, R52), which are known to be buggy.
  */
 
-static void fan_quirk1_detect(void)
+static void fan_quirk1_setup(void)
 {
-        /* In some ThinkPads, neither the EC nor the ACPI
-         * DSDT initialize the HFSP register, and it ends up
-         * being initially set to 0x07 when it *could* be
-         * either 0x07 or 0x80.
-         *
-         * Enable for TP-1Y (T43), TP-78 (R51e),
-         * TP-76 (R52), TP-70 (T43, R52), which are known
-         * to be buggy. */
         if (fan_control_initial_status == 0x07) {
-                switch (thinkpad_id.ec_model) {
-                case 0x5931: /* TP-1Y */
-                case 0x3837: /* TP-78 */
-                case 0x3637: /* TP-76 */
-                case 0x3037: /* TP-70 */
-                        printk(TPACPI_NOTICE
-                               "fan_init: initial fan status is unknown, "
-                               "assuming it is in auto mode\n");
-                        tp_features.fan_ctrl_status_undef = 1;
-                        ;;
-                }
+                printk(TPACPI_NOTICE
+                       "fan_init: initial fan status is unknown, "
+                       "assuming it is in auto mode\n");
+                tp_features.fan_ctrl_status_undef = 1;
         }
 }
 
@@ -6292,6 +6463,38 @@ static void fan_quirk1_handle(u8 *fan_status)
         }
 }
 
+/* Select main fan on X60/X61, NOOP on others */
+static bool fan_select_fan1(void)
+{
+        if (tp_features.second_fan) {
+                u8 val;
+
+                if (ec_read(fan_select_offset, &val) < 0)
+                        return false;
+                val &= 0xFEU;
+                if (ec_write(fan_select_offset, val) < 0)
+                        return false;
+        }
+        return true;
+}
+
+/* Select secondary fan on X60/X61 */
+static bool fan_select_fan2(void)
+{
+        u8 val;
+
+        if (!tp_features.second_fan)
+                return false;
+
+        if (ec_read(fan_select_offset, &val) < 0)
+                return false;
+        val |= 0x01U;
+        if (ec_write(fan_select_offset, val) < 0)
+                return false;
+
+        return true;
+}
+
 /*
  * Call with fan_mutex held
  */
@@ -6369,6 +6572,8 @@ static int fan_get_speed(unsigned int *speed)
         switch (fan_status_access_mode) {
         case TPACPI_FAN_RD_TPEC:
                 /* all except 570, 600e/x, 770e, 770x */
+                if (unlikely(!fan_select_fan1()))
+                        return -EIO;
                 if (unlikely(!acpi_ec_read(fan_rpm_offset, &lo) ||
                              !acpi_ec_read(fan_rpm_offset + 1, &hi)))
                         return -EIO;
@@ -6385,6 +6590,34 @@ static int fan_get_speed(unsigned int *speed)
         return 0;
 }
 
+static int fan2_get_speed(unsigned int *speed)
+{
+        u8 hi, lo;
+        bool rc;
+
+        switch (fan_status_access_mode) {
+        case TPACPI_FAN_RD_TPEC:
+                /* all except 570, 600e/x, 770e, 770x */
+                if (unlikely(!fan_select_fan2()))
+                        return -EIO;
+                rc = !acpi_ec_read(fan_rpm_offset, &lo) ||
+                             !acpi_ec_read(fan_rpm_offset + 1, &hi);
+                fan_select_fan1(); /* play it safe */
+                if (rc)
+                        return -EIO;
+
+                if (likely(speed))
+                        *speed = (hi << 8) | lo;
+
+                break;
+
+        default:
+                return -ENXIO;
+        }
+
+        return 0;
+}
+
 static int fan_set_level(int level)
 {
         if (!fan_control_allowed)
@@ -6790,6 +7023,25 @@ static struct device_attribute dev_attr_fan_fan1_input =
         __ATTR(fan1_input, S_IRUGO,
                 fan_fan1_input_show, NULL);
 
+/* sysfs fan fan2_input ------------------------------------------------ */
+static ssize_t fan_fan2_input_show(struct device *dev,
+                           struct device_attribute *attr,
+                           char *buf)
+{
+        int res;
+        unsigned int speed;
+
+        res = fan2_get_speed(&speed);
+        if (res < 0)
+                return res;
+
+        return snprintf(buf, PAGE_SIZE, "%u\n", speed);
+}
+
+static struct device_attribute dev_attr_fan_fan2_input =
+        __ATTR(fan2_input, S_IRUGO,
+                fan_fan2_input_show, NULL);
+
 /* sysfs fan fan_watchdog (hwmon driver) ------------------------------- */
 static ssize_t fan_fan_watchdog_show(struct device_driver *drv,
                                      char *buf)
@@ -6823,6 +7075,7 @@ static DRIVER_ATTR(fan_watchdog, S_IWUSR | S_IRUGO,
 static struct attribute *fan_attributes[] = {
         &dev_attr_fan_pwm1_enable.attr, &dev_attr_fan_pwm1.attr,
         &dev_attr_fan_fan1_input.attr,
+        NULL, /* for fan2_input */
         NULL
 };
 
@@ -6830,9 +7083,36 @@ static const struct attribute_group fan_attr_group = {
         .attrs = fan_attributes,
 };
 
+#define TPACPI_FAN_Q1   0x0001          /* Unitialized HFSP */
+#define TPACPI_FAN_2FAN 0x0002          /* EC 0x31 bit 0 selects fan2 */
+
+#define TPACPI_FAN_QI(__id1, __id2, __quirks)   \
+        { .vendor = PCI_VENDOR_ID_IBM,          \
+          .bios = TPACPI_MATCH_ANY,             \
+          .ec = TPID(__id1, __id2),             \
+          .quirks = __quirks }
+
+#define TPACPI_FAN_QL(__id1, __id2, __quirks)   \
+        { .vendor = PCI_VENDOR_ID_LENOVO,       \
+          .bios = TPACPI_MATCH_ANY,             \
+          .ec = TPID(__id1, __id2),             \
+          .quirks = __quirks }
+
+static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
+        TPACPI_FAN_QI('1', 'Y', TPACPI_FAN_Q1),
+        TPACPI_FAN_QI('7', '8', TPACPI_FAN_Q1),
+        TPACPI_FAN_QI('7', '6', TPACPI_FAN_Q1),
+        TPACPI_FAN_QI('7', '0', TPACPI_FAN_Q1),
+        TPACPI_FAN_QL('7', 'M', TPACPI_FAN_2FAN),
+};
+
+#undef TPACPI_FAN_QL
+#undef TPACPI_FAN_QI
+
 static int __init fan_init(struct ibm_init_struct *iibm)
 {
         int rc;
+        unsigned long quirks;
 
         vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_FAN,
                         "initializing fan subdriver\n");
@@ -6843,12 +7123,16 @@ static int __init fan_init(struct ibm_init_struct *iibm)
         fan_control_commands = 0;
         fan_watchdog_maxinterval = 0;
         tp_features.fan_ctrl_status_undef = 0;
+        tp_features.second_fan = 0;
         fan_control_desired_level = 7;
 
         TPACPI_ACPIHANDLE_INIT(fans);
         TPACPI_ACPIHANDLE_INIT(gfan);
         TPACPI_ACPIHANDLE_INIT(sfan);
 
+        quirks = tpacpi_check_quirks(fan_quirk_table,
+                                     ARRAY_SIZE(fan_quirk_table));
+
         if (gfan_handle) {
                 /* 570, 600e/x, 770e, 770x */
                 fan_status_access_mode = TPACPI_FAN_RD_ACPI_GFAN;
@@ -6858,7 +7142,13 @@ static int __init fan_init(struct ibm_init_struct *iibm)
                 if (likely(acpi_ec_read(fan_status_offset,
                                         &fan_control_initial_status))) {
                         fan_status_access_mode = TPACPI_FAN_RD_TPEC;
-                        fan_quirk1_detect();
+                        if (quirks & TPACPI_FAN_Q1)
+                                fan_quirk1_setup();
+                        if (quirks & TPACPI_FAN_2FAN) {
+                                tp_features.second_fan = 1;
+                                dbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_FAN,
+                                        "secondary fan support enabled\n");
+                        }
                 } else {
                         printk(TPACPI_ERR
                                "ThinkPad ACPI EC access misbehaving, "
@@ -6914,6 +7204,11 @@ static int __init fan_init(struct ibm_init_struct *iibm)
 
         if (fan_status_access_mode != TPACPI_FAN_NONE ||
             fan_control_access_mode != TPACPI_FAN_WR_NONE) {
+                if (tp_features.second_fan) {
+                        /* attach second fan tachometer */
+                        fan_attributes[ARRAY_SIZE(fan_attributes)-2] =
+                                        &dev_attr_fan_fan2_input.attr;
+                }
                 rc = sysfs_create_group(&tpacpi_sensors_pdev->dev.kobj,
                                          &fan_attr_group);
                 if (rc < 0)
@@ -7385,6 +7680,24 @@ err_out:
 
 /* Probing */
 
+static bool __pure __init tpacpi_is_fw_digit(const char c)
+{
+        return (c >= '0' && c <= '9') || (c >= 'A' && c <= 'Z');
+}
+
+/* Most models: xxyTkkWW (#.##c); Ancient 570/600 and -SL lacks (#.##c) */
+static bool __pure __init tpacpi_is_valid_fw_id(const char* const s,
+                                                const char t)
+{
+        return s && strlen(s) >= 8 &&
+                tpacpi_is_fw_digit(s[0]) &&
+                tpacpi_is_fw_digit(s[1]) &&
+                s[2] == t && s[3] == 'T' &&
+                tpacpi_is_fw_digit(s[4]) &&
+                tpacpi_is_fw_digit(s[5]) &&
+                s[6] == 'W' && s[7] == 'W';
+}
+
 /* returns 0 - probe ok, or < 0 - probe error.
  * Probe ok doesn't mean thinkpad found.
  * On error, kfree() cleanup on tp->* is not performed, caller must do it */
@@ -7411,10 +7724,15 @@ static int __must_check __init get_thinkpad_model_data(
         tp->bios_version_str = kstrdup(s, GFP_KERNEL);
         if (s && !tp->bios_version_str)
                 return -ENOMEM;
-        if (!tp->bios_version_str)
+
+        /* Really ancient ThinkPad 240X will fail this, which is fine */
+        if (!tpacpi_is_valid_fw_id(tp->bios_version_str, 'E'))
                 return 0;
+
         tp->bios_model = tp->bios_version_str[0]
                          | (tp->bios_version_str[1] << 8);
+        tp->bios_release = (tp->bios_version_str[4] << 8)
+                         | tp->bios_version_str[5];
 
         /*
          * ThinkPad T23 or newer, A31 or newer, R50e or newer,
@@ -7433,8 +7751,21 @@ static int __must_check __init get_thinkpad_model_data(
                         tp->ec_version_str = kstrdup(ec_fw_string, GFP_KERNEL);
                         if (!tp->ec_version_str)
                                 return -ENOMEM;
-                        tp->ec_model = ec_fw_string[0]
-                                        | (ec_fw_string[1] << 8);
+
+                        if (tpacpi_is_valid_fw_id(ec_fw_string, 'H')) {
+                                tp->ec_model = ec_fw_string[0]
+                                                | (ec_fw_string[1] << 8);
+                                tp->ec_release = (ec_fw_string[4] << 8)
+                                                | ec_fw_string[5];
+                        } else {
+                                printk(TPACPI_NOTICE
+                                        "ThinkPad firmware release %s "
+                                        "doesn't match the known patterns\n",
+                                        ec_fw_string);
+                                printk(TPACPI_NOTICE
+                                        "please report this to %s\n",
+                                        TPACPI_MAIL);
+                        }
                         break;
                 }
         }
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 7f207f335bec..ef3a2cd3a7a0 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -287,6 +287,25 @@ static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
                                 ACPI_DECODE_16);
 }
 
+static void pnpacpi_parse_allocated_ext_address_space(struct pnp_dev *dev,
+                                                      struct acpi_resource *res)
+{
+        struct acpi_resource_extended_address64 *p = &res->data.ext_address64;
+
+        if (p->producer_consumer == ACPI_PRODUCER)
+                return;
+
+        if (p->resource_type == ACPI_MEMORY_RANGE)
+                pnpacpi_parse_allocated_memresource(dev,
+                        p->minimum, p->address_length,
+                        p->info.mem.write_protect);
+        else if (p->resource_type == ACPI_IO_RANGE)
+                pnpacpi_parse_allocated_ioresource(dev,
+                        p->minimum, p->address_length,
+                        p->granularity == 0xfff ? ACPI_DECODE_10 :
+                                ACPI_DECODE_16);
+}
+
 static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
                                               void *data)
 {
@@ -400,8 +419,7 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_ADDRESS64:
-                if (res->data.ext_address64.producer_consumer == ACPI_PRODUCER)
-                        return AE_OK;
+                pnpacpi_parse_allocated_ext_address_space(dev, res);
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
@@ -630,6 +648,28 @@ static __init void pnpacpi_parse_address_option(struct pnp_dev *dev,
                                            IORESOURCE_IO_FIXED);
 }
 
+static __init void pnpacpi_parse_ext_address_option(struct pnp_dev *dev,
+                                                    unsigned int option_flags,
+                                                    struct acpi_resource *r)
+{
+        struct acpi_resource_extended_address64 *p = &r->data.ext_address64;
+        unsigned char flags = 0;
+
+        if (p->address_length == 0)
+                return;
+
+        if (p->resource_type == ACPI_MEMORY_RANGE) {
+                if (p->info.mem.write_protect == ACPI_READ_WRITE_MEMORY)
+                        flags = IORESOURCE_MEM_WRITEABLE;
+                pnp_register_mem_resource(dev, option_flags, p->minimum,
+                                          p->minimum, 0, p->address_length,
+                                          flags);
+        } else if (p->resource_type == ACPI_IO_RANGE)
+                pnp_register_port_resource(dev, option_flags, p->minimum,
+                                           p->minimum, 0, p->address_length,
+                                           IORESOURCE_IO_FIXED);
+}
+
 struct acpipnp_parse_option_s {
         struct pnp_dev *dev;
         unsigned int option_flags;
@@ -711,6 +751,7 @@ static __init acpi_status pnpacpi_option_resource(struct acpi_resource *res,
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_ADDRESS64:
+                pnpacpi_parse_ext_address_option(dev, option_flags, res);
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
@@ -765,6 +806,7 @@ static int pnpacpi_supported_resource(struct acpi_resource *res)
         case ACPI_RESOURCE_TYPE_ADDRESS16:
         case ACPI_RESOURCE_TYPE_ADDRESS32:
         case ACPI_RESOURCE_TYPE_ADDRESS64:
+        case ACPI_RESOURCE_TYPE_EXTENDED_ADDRESS64:
         case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
                 return 1;
         }
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index e371a9c15341..a07015d646dd 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -398,8 +398,7 @@ static int sbs_init(struct pci_dev *dev)
 {
         u8 __iomem *p;
 
-        p = ioremap_nocache(pci_resource_start(dev, 0),
-                                                pci_resource_len(dev, 0));
+        p = pci_ioremap_bar(dev, 0);
 
         if (p == NULL)
                 return -ENOMEM;
@@ -423,8 +422,7 @@ static void __devexit sbs_exit(struct pci_dev *dev)
 {
         u8 __iomem *p;
 
-        p = ioremap_nocache(pci_resource_start(dev, 0),
-                                        pci_resource_len(dev, 0));
+        p = pci_ioremap_bar(dev, 0);
         /* FIXME: What if resource_len < OCT_REG_CR_OFF */
         if (p != NULL)
                 writeb(0, p + OCT_REG_CR_OFF);
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index 9f2891c2c4a2..cd1b6a45bb82 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -1548,8 +1548,7 @@ static int __devinit icom_probe(struct pci_dev *dev,
                 goto probe_exit1;
         }
 
-         icom_adapter->base_addr = ioremap(icom_adapter->base_addr_pci,
-                                                pci_resource_len(dev, 0));
+         icom_adapter->base_addr = pci_ioremap_bar(dev, 0);
 
         if (!icom_adapter->base_addr)
                 goto probe_exit1;
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 107ce2e187b8..00f4577d2f7f 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -467,7 +467,7 @@ int __devinit jsm_uart_port_init(struct jsm_board *brd)
                         printk(KERN_INFO "jsm: linemap is full, added device failed\n");
                         continue;
                 } else
-                        set_bit((int)line, linemap);
+                        set_bit(line, linemap);
                 brd->channels[i]->uart_port.line = line;
                 if (uart_add_one_port (&jsm_uart_driver, &brd->channels[i]->uart_port))
                         printk(KERN_INFO "jsm: add device failed\n");
@@ -503,7 +503,7 @@ int jsm_remove_uart_port(struct jsm_board *brd)
 
                 ch = brd->channels[i];
 
-                clear_bit((int)(ch->uart_port.line), linemap);
+                clear_bit(ch->uart_port.line, linemap);
                 uart_remove_one_port(&jsm_uart_driver, &brd->channels[i]->uart_port);
         }
 
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index 7313c2edcb83..54dd16d66a4b 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -461,6 +461,94 @@ static void serial_txx9_break_ctl(struct uart_port *port, int break_state)
         spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
+#if defined(CONFIG_SERIAL_TXX9_CONSOLE) || (CONFIG_CONSOLE_POLL)
+/*
+ *      Wait for transmitter & holding register to empty
+ */
+static void wait_for_xmitr(struct uart_txx9_port *up)
+{
+        unsigned int tmout = 10000;
+
+        /* Wait up to 10ms for the character(s) to be sent. */
+        while (--tmout &&
+               !(sio_in(up, TXX9_SICISR) & TXX9_SICISR_TXALS))
+                udelay(1);
+
+        /* Wait up to 1s for flow control if necessary */
+        if (up->port.flags & UPF_CONS_FLOW) {
+                tmout = 1000000;
+                while (--tmout &&
+                       (sio_in(up, TXX9_SICISR) & TXX9_SICISR_CTSS))
+                        udelay(1);
+        }
+}
+#endif
+
+#ifdef CONFIG_CONSOLE_POLL
+/*
+ * Console polling routines for writing and reading from the uart while
+ * in an interrupt or debug context.
+ */
+
+static int serial_txx9_get_poll_char(struct uart_port *port)
+{
+        unsigned int ier;
+        unsigned char c;
+        struct uart_txx9_port *up = (struct uart_txx9_port *)port;
+
+        /*
+         *      First save the IER then disable the interrupts
+         */
+        ier = sio_in(up, TXX9_SIDICR);
+        sio_out(up, TXX9_SIDICR, 0);
+
+        while (sio_in(up, TXX9_SIDISR) & TXX9_SIDISR_UVALID)
+                ;
+
+        c = sio_in(up, TXX9_SIRFIFO);
+
+        /*
+         *      Finally, clear RX interrupt status
+         *      and restore the IER
+         */
+        sio_mask(up, TXX9_SIDISR, TXX9_SIDISR_RDIS);
+        sio_out(up, TXX9_SIDICR, ier);
+        return c;
+}
+
+
+static void serial_txx9_put_poll_char(struct uart_port *port, unsigned char c)
+{
+        unsigned int ier;
+        struct uart_txx9_port *up = (struct uart_txx9_port *)port;
+
+        /*
+         *      First save the IER then disable the interrupts
+         */
+        ier = sio_in(up, TXX9_SIDICR);
+        sio_out(up, TXX9_SIDICR, 0);
+
+        wait_for_xmitr(up);
+        /*
+         *      Send the character out.
+         *      If a LF, also do CR...
+         */
+        sio_out(up, TXX9_SITFIFO, c);
+        if (c == 10) {
+                wait_for_xmitr(up);
+                sio_out(up, TXX9_SITFIFO, 13);
+        }
+
+        /*
+         *      Finally, wait for transmitter to become empty
+         *      and restore the IER
+         */
+        wait_for_xmitr(up);
+        sio_out(up, TXX9_SIDICR, ier);
+}
+
+#endif /* CONFIG_CONSOLE_POLL */
+
 static int serial_txx9_startup(struct uart_port *port)
 {
         struct uart_txx9_port *up = (struct uart_txx9_port *)port;
@@ -781,6 +869,10 @@ static struct uart_ops serial_txx9_pops = {
         .release_port   = serial_txx9_release_port,
         .request_port   = serial_txx9_request_port,
         .config_port    = serial_txx9_config_port,
+#ifdef CONFIG_CONSOLE_POLL
+        .poll_get_char  = serial_txx9_get_poll_char,
+        .poll_put_char  = serial_txx9_put_poll_char,
+#endif
 };
 
 static struct uart_txx9_port serial_txx9_ports[UART_NR];
@@ -803,27 +895,6 @@ static void __init serial_txx9_register_ports(struct uart_driver *drv,
 
 #ifdef CONFIG_SERIAL_TXX9_CONSOLE
 
-/*
- *      Wait for transmitter & holding register to empty
- */
-static inline void wait_for_xmitr(struct uart_txx9_port *up)
-{
-        unsigned int tmout = 10000;
-
-        /* Wait up to 10ms for the character(s) to be sent. */
-        while (--tmout &&
-               !(sio_in(up, TXX9_SICISR) & TXX9_SICISR_TXALS))
-                udelay(1);
-
-        /* Wait up to 1s for flow control if necessary */
-        if (up->port.flags & UPF_CONS_FLOW) {
-                tmout = 1000000;
-                while (--tmout &&
-                       (sio_in(up, TXX9_SICISR) & TXX9_SICISR_CTSS))
-                        udelay(1);
-        }
-}
-
 static void serial_txx9_console_putchar(struct uart_port *port, int ch)
 {
         struct uart_txx9_port *up = (struct uart_txx9_port *)port;
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 559f8784acf3..9052bcb4f528 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -501,7 +501,7 @@ int hwarc_filter_event_WUSB_0100(struct uwb_rc *rc, struct uwb_rceb **header,
         int result = -ENOANO;
         struct uwb_rceb *rceb = *header;
         int event = le16_to_cpu(rceb->wEvent);
-        size_t event_size;
+        ssize_t event_size;
         size_t core_size, offset;
 
         if (rceb->bEventType != UWB_RC_CET_GENERAL)
diff --git a/drivers/uwb/wlp/txrx.c b/drivers/uwb/wlp/txrx.c
index cd2035768b47..86a853b84119 100644
--- a/drivers/uwb/wlp/txrx.c
+++ b/drivers/uwb/wlp/txrx.c
@@ -326,7 +326,7 @@ int wlp_prepare_tx_frame(struct device *dev, struct wlp *wlp,
         int result = -EINVAL;
         struct ethhdr *eth_hdr = (void *) skb->data;
 
-        if (is_broadcast_ether_addr(eth_hdr->h_dest)) {
+        if (is_multicast_ether_addr(eth_hdr->h_dest)) {
                 result = wlp_eda_for_each(&wlp->eda, wlp_wss_send_copy, skb);
                 if (result < 0) {
                         if (printk_ratelimit())