27 files changed, 374 insertions, 251 deletions

diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 973be2f44195..4e28b35024ec 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -300,8 +300,7 @@ static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
                         if (space < 2)
                                 return -1;
                         tty->canon_column = tty->column = 0;
-                        tty_put_char(tty, '\r');
-                        tty_put_char(tty, c);
+                        tty->ops->write(tty, "\r\n", 2);
                         return 2;
                 }
                 tty->canon_column = tty->column;
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index d083c73d784a..b33d6688e910 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -109,21 +109,13 @@ static int pty_space(struct tty_struct *to)
  *      the other side of the pty/tty pair.
  */
 
-static int pty_write(struct tty_struct *tty, const unsigned char *buf,
-                                                                int count)
+static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
 {
         struct tty_struct *to = tty->link;
-        int c;
 
         if (tty->stopped)
                 return 0;
 
-        /* This isn't locked but our 8K is quite sloppy so no
-           big deal */
-
-        c = pty_space(to);
-        if (c > count)
-                c = count;
         if (c > 0) {
                 /* Stuff the data into the input queue of the other end */
                 c = tty_insert_flip_string(to, buf, c);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index fd69086d08d5..2968ed6a9c49 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1250,20 +1250,11 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 {
         int ret = 0;
 
-#ifdef __powerpc__
         int cpu = sysdev->id;
-        unsigned int cur_freq = 0;
         struct cpufreq_policy *cpu_policy;
 
         dprintk("suspending cpu %u\n", cpu);
 
-        /*
-         * This whole bogosity is here because Powerbooks are made of fail.
-         * No sane platform should need any of the code below to be run.
-         * (it's entirely the wrong thing to do, as driver->get may
-         *  reenable interrupts on some architectures).
-         */
-
         if (!cpu_online(cpu))
                 return 0;
 
@@ -1282,47 +1273,13 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 
         if (cpufreq_driver->suspend) {
                 ret = cpufreq_driver->suspend(cpu_policy, pmsg);
-                if (ret) {
+                if (ret)
                         printk(KERN_ERR "cpufreq: suspend failed in ->suspend "
                                         "step on CPU %u\n", cpu_policy->cpu);
-                        goto out;
-                }
-        }
-
-        if (cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)
-                goto out;
-
-        if (cpufreq_driver->get)
-                cur_freq = cpufreq_driver->get(cpu_policy->cpu);
-
-        if (!cur_freq || !cpu_policy->cur) {
-                printk(KERN_ERR "cpufreq: suspend failed to assert current "
-                       "frequency is what timing core thinks it is.\n");
-                goto out;
-        }
-
-        if (unlikely(cur_freq != cpu_policy->cur)) {
-                struct cpufreq_freqs freqs;
-
-                if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
-                        dprintk("Warning: CPU frequency is %u, "
-                               "cpufreq assumed %u kHz.\n",
-                               cur_freq, cpu_policy->cur);
-
-                freqs.cpu = cpu;
-                freqs.old = cpu_policy->cur;
-                freqs.new = cur_freq;
-
-                srcu_notifier_call_chain(&cpufreq_transition_notifier_list,
-                                    CPUFREQ_SUSPENDCHANGE, &freqs);
-                adjust_jiffies(CPUFREQ_SUSPENDCHANGE, &freqs);
-
-                cpu_policy->cur = cur_freq;
         }
 
 out:
         cpufreq_cpu_put(cpu_policy);
-#endif  /* __powerpc__ */
         return ret;
 }
 
@@ -1330,24 +1287,21 @@ out:
  *      cpufreq_resume -  restore proper CPU frequency handling after resume
  *
  *      1.) resume CPUfreq hardware support (cpufreq_driver->resume())
- *      2.) if ->target and !CPUFREQ_CONST_LOOPS: verify we're in sync
- *      3.) schedule call cpufreq_update_policy() ASAP as interrupts are
- *          restored.
+ *      2.) schedule call cpufreq_update_policy() ASAP as interrupts are
+ *          restored. It will verify that the current freq is in sync with
+ *          what we believe it to be. This is a bit later than when it
+ *          should be, but nonethteless it's better than calling
+ *          cpufreq_driver->get() here which might re-enable interrupts...
  */
 static int cpufreq_resume(struct sys_device *sysdev)
 {
         int ret = 0;
 
-#ifdef __powerpc__
         int cpu = sysdev->id;
         struct cpufreq_policy *cpu_policy;
 
         dprintk("resuming cpu %u\n", cpu);
 
-        /* As with the ->suspend method, all the code below is
-         * only necessary because Powerbooks suck.
-         * See commit 42d4dc3f4e1e for jokes. */
-
         if (!cpu_online(cpu))
                 return 0;
 
@@ -1373,45 +1327,10 @@ static int cpufreq_resume(struct sys_device *sysdev)
                 }
         }
 
-        if (!(cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)) {
-                unsigned int cur_freq = 0;
-
-                if (cpufreq_driver->get)
-                        cur_freq = cpufreq_driver->get(cpu_policy->cpu);
-
-                if (!cur_freq || !cpu_policy->cur) {
-                        printk(KERN_ERR "cpufreq: resume failed to assert "
-                                        "current frequency is what timing core "
-                                        "thinks it is.\n");
-                        goto out;
-                }
-
-                if (unlikely(cur_freq != cpu_policy->cur)) {
-                        struct cpufreq_freqs freqs;
-
-                        if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
-                                dprintk("Warning: CPU frequency "
-                                       "is %u, cpufreq assumed %u kHz.\n",
-                                       cur_freq, cpu_policy->cur);
-
-                        freqs.cpu = cpu;
-                        freqs.old = cpu_policy->cur;
-                        freqs.new = cur_freq;
-
-                        srcu_notifier_call_chain(
-                                        &cpufreq_transition_notifier_list,
-                                        CPUFREQ_RESUMECHANGE, &freqs);
-                        adjust_jiffies(CPUFREQ_RESUMECHANGE, &freqs);
-
-                        cpu_policy->cur = cur_freq;
-                }
-        }
-
-out:
         schedule_work(&cpu_policy->update);
+
 fail:
         cpufreq_cpu_put(cpu_policy);
-#endif  /* __powerpc__ */
         return ret;
 }
 
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 110e731f5574..1c0b504a42f3 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -196,7 +196,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
                 switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
                                 irm_id, generation, SCODE_100,
                                 CSR_REGISTER_BASE + CSR_BANDWIDTH_AVAILABLE,
-                                data, sizeof(data))) {
+                                data, 8)) {
                 case RCODE_GENERATION:
                         /* A generation change frees all bandwidth. */
                         return allocate ? -EAGAIN : bandwidth;
@@ -233,7 +233,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                 data[1] = old ^ c;
                 switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
                                            irm_id, generation, SCODE_100,
-                                           offset, data, sizeof(data))) {
+                                           offset, data, 8)) {
                 case RCODE_GENERATION:
                         /* A generation change frees all channels. */
                         return allocate ? -EAGAIN : i;
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index ecddd11b797a..76b321bb73f9 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -34,6 +34,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
+#include <linux/pci_ids.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
 
@@ -2372,6 +2373,9 @@ static void ohci_pmac_off(struct pci_dev *dev)
 #define ohci_pmac_off(dev)
 #endif /* CONFIG_PPC_PMAC */
 
+#define PCI_VENDOR_ID_AGERE             PCI_VENDOR_ID_ATT
+#define PCI_DEVICE_ID_AGERE_FW643       0x5901
+
 static int __devinit pci_probe(struct pci_dev *dev,
                                const struct pci_device_id *ent)
 {
@@ -2422,6 +2426,16 @@ static int __devinit pci_probe(struct pci_dev *dev,
         version = reg_read(ohci, OHCI1394_Version) & 0x00ff00ff;
         ohci->use_dualbuffer = version >= OHCI_VERSION_1_1;
 
+        /* dual-buffer mode is broken if more than one IR context is active */
+        if (dev->vendor == PCI_VENDOR_ID_AGERE &&
+            dev->device == PCI_DEVICE_ID_AGERE_FW643)
+                ohci->use_dualbuffer = false;
+
+        /* dual-buffer mode is broken */
+        if (dev->vendor == PCI_VENDOR_ID_RICOH &&
+            dev->device == PCI_DEVICE_ID_RICOH_R5C832)
+                ohci->use_dualbuffer = false;
+
 /* x86-32 currently doesn't use highmem for dma_alloc_coherent */
 #if !defined(CONFIG_X86_32)
         /* dual-buffer mode is broken with descriptor addresses above 2G */
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 8d51568ee143..e5df822a8130 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -456,12 +456,12 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
         }
         spin_unlock_irqrestore(&card->lock, flags);
 
-        if (&orb->link != &lu->orb_list)
+        if (&orb->link != &lu->orb_list) {
                 orb->callback(orb, &status);
-        else
+                kref_put(&orb->kref, free_orb);
+        } else {
                 fw_error("status write for unknown orb\n");
-
-        kref_put(&orb->kref, free_orb);
+        }
 
         fw_send_response(card, request, RCODE_COMPLETE);
 }
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 95fe0452dae4..6c6a09b1c0fe 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -880,6 +880,14 @@ static unsigned int atkbd_hp_zv6100_forced_release_keys[] = {
 };
 
 /*
+ * Perform fixup for HP (Compaq) Presario R4000 R4100 R4200 that don't generate
+ * release for their volume buttons
+ */
+static unsigned int atkbd_hp_r4000_forced_release_keys[] = {
+        0xae, 0xb0, -1U
+};
+
+/*
  * Samsung NC10,NC20 with Fn+F? key release not working
  */
 static unsigned int atkbd_samsung_forced_release_keys[] = {
@@ -1537,6 +1545,33 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .driver_data = atkbd_hp_zv6100_forced_release_keys,
         },
         {
+                .ident = "HP Presario R4000",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4000"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
+                .ident = "HP Presario R4100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4100"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
+                .ident = "HP Presario R4200",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4200"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
                 .ident = "Inventec Symphony",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"),
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index ae04d8a494e5..ccbf23ece8e3 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -382,6 +382,14 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
                 },
         },
+        {
+                .ident = "Acer Aspire 5536",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 3710ff88fc10..556acff3952f 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -171,6 +171,14 @@ static int set_chunk_size(struct dm_exception_store *store,
          */
         chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
 
+        return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
+                                                 error);
+}
+
+int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+                                      unsigned long chunk_size_ulong,
+                                      char **error)
+{
         /* Check chunk_size is a power of 2 */
         if (!is_power_of_2(chunk_size_ulong)) {
                 *error = "Chunk size is not a power of 2";
@@ -183,6 +191,11 @@ static int set_chunk_size(struct dm_exception_store *store,
                 return -EINVAL;
         }
 
+        if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
+                *error = "Chunk size is too high";
+                return -EINVAL;
+        }
+
         store->chunk_size = chunk_size_ulong;
         store->chunk_mask = chunk_size_ulong - 1;
         store->chunk_shift = ffs(chunk_size_ulong) - 1;
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index 2442c8c07898..812c71872ba0 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -168,6 +168,10 @@ static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
 int dm_exception_store_type_register(struct dm_exception_store_type *type);
 int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
 
+int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+                                      unsigned long chunk_size_ulong,
+                                      char **error);
+
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                               unsigned *args_used,
                               struct dm_exception_store **store);
diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
index e69b96560997..6e186b1a062d 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -21,6 +21,7 @@ struct log_c {
         struct dm_target *ti;
         uint32_t region_size;
         region_t region_count;
+        uint64_t luid;
         char uuid[DM_UUID_LEN];
 
         char *usr_argv_str;
@@ -63,7 +64,7 @@ static int userspace_do_request(struct log_c *lc, const char *uuid,
          * restored.
          */
 retry:
-        r = dm_consult_userspace(uuid, request_type, data,
+        r = dm_consult_userspace(uuid, lc->luid, request_type, data,
                                  data_size, rdata, rdata_size);
 
         if (r != -ESRCH)
@@ -74,14 +75,15 @@ retry:
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule_timeout(2*HZ);
                 DMWARN("Attempting to contact userspace log server...");
-                r = dm_consult_userspace(uuid, DM_ULOG_CTR, lc->usr_argv_str,
+                r = dm_consult_userspace(uuid, lc->luid, DM_ULOG_CTR,
+                                         lc->usr_argv_str,
                                          strlen(lc->usr_argv_str) + 1,
                                          NULL, NULL);
                 if (!r)
                         break;
         }
         DMINFO("Reconnected to userspace log server... DM_ULOG_CTR complete");
-        r = dm_consult_userspace(uuid, DM_ULOG_RESUME, NULL,
+        r = dm_consult_userspace(uuid, lc->luid, DM_ULOG_RESUME, NULL,
                                  0, NULL, NULL);
         if (!r)
                 goto retry;
@@ -111,10 +113,9 @@ static int build_constructor_string(struct dm_target *ti,
                 return -ENOMEM;
         }
 
-        for (i = 0, str_size = 0; i < argc; i++)
-                str_size += sprintf(str + str_size, "%s ", argv[i]);
-        str_size += sprintf(str + str_size, "%llu",
-                            (unsigned long long)ti->len);
+        str_size = sprintf(str, "%llu", (unsigned long long)ti->len);
+        for (i = 0; i < argc; i++)
+                str_size += sprintf(str + str_size, " %s", argv[i]);
 
         *ctr_str = str;
         return str_size;
@@ -154,6 +155,9 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
                 return -ENOMEM;
         }
 
+        /* The ptr value is sufficient for local unique id */
+        lc->luid = (uint64_t)lc;
+
         lc->ti = ti;
 
         if (strlen(argv[0]) > (DM_UUID_LEN - 1)) {
@@ -173,7 +177,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
         }
 
         /* Send table string */
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_CTR,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_CTR,
                                  ctr_str, str_size, NULL, NULL);
 
         if (r == -ESRCH) {
@@ -183,7 +187,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
 
         /* Since the region size does not change, get it now */
         rdata_size = sizeof(rdata);
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_GET_REGION_SIZE,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_GET_REGION_SIZE,
                                  NULL, 0, (char *)&rdata, &rdata_size);
 
         if (r) {
@@ -212,7 +216,7 @@ static void userspace_dtr(struct dm_dirty_log *log)
         int r;
         struct log_c *lc = log->context;
 
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_DTR,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_DTR,
                                  NULL, 0,
                                  NULL, NULL);
 
@@ -227,7 +231,7 @@ static int userspace_presuspend(struct dm_dirty_log *log)
         int r;
         struct log_c *lc = log->context;
 
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_PRESUSPEND,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_PRESUSPEND,
                                  NULL, 0,
                                  NULL, NULL);
 
@@ -239,7 +243,7 @@ static int userspace_postsuspend(struct dm_dirty_log *log)
         int r;
         struct log_c *lc = log->context;
 
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_POSTSUSPEND,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_POSTSUSPEND,
                                  NULL, 0,
                                  NULL, NULL);
 
@@ -252,7 +256,7 @@ static int userspace_resume(struct dm_dirty_log *log)
         struct log_c *lc = log->context;
 
         lc->in_sync_hint = 0;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_RESUME,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_RESUME,
                                  NULL, 0,
                                  NULL, NULL);
 
@@ -561,6 +565,7 @@ static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
                             char *result, unsigned maxlen)
 {
         int r = 0;
+        char *table_args;
         size_t sz = (size_t)maxlen;
         struct log_c *lc = log->context;
 
@@ -577,8 +582,12 @@ static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
                 break;
         case STATUSTYPE_TABLE:
                 sz = 0;
-                DMEMIT("%s %u %s %s", log->type->name, lc->usr_argc + 1,
-                       lc->uuid, lc->usr_argv_str);
+                table_args = strstr(lc->usr_argv_str, " ");
+                BUG_ON(!table_args); /* There will always be a ' ' */
+                table_args++;
+
+                DMEMIT("%s %u %s %s ", log->type->name, lc->usr_argc,
+                       lc->uuid, table_args);
                 break;
         }
         return (r) ? 0 : (int)sz;
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 8ce74d95ae4d..ba0edad2d048 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -147,7 +147,8 @@ static void cn_ulog_callback(void *data)
 
 /**
  * dm_consult_userspace
- * @uuid: log's uuid (must be DM_UUID_LEN in size)
+ * @uuid: log's universal unique identifier (must be DM_UUID_LEN in size)
+ * @luid: log's local unique identifier
  * @request_type:  found in include/linux/dm-log-userspace.h
  * @data: data to tx to the server
  * @data_size: size of data in bytes
@@ -163,7 +164,7 @@ static void cn_ulog_callback(void *data)
  *
  * Returns: 0 on success, -EXXX on failure
  **/
-int dm_consult_userspace(const char *uuid, int request_type,
+int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
                          char *data, size_t data_size,
                          char *rdata, size_t *rdata_size)
 {
@@ -190,6 +191,7 @@ resend:
 
         memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
         memcpy(tfr->uuid, uuid, DM_UUID_LEN);
+        tfr->luid = luid;
         tfr->seq = dm_ulog_seq++;
 
         /*
diff --git a/drivers/md/dm-log-userspace-transfer.h b/drivers/md/dm-log-userspace-transfer.h
index c26d8e4e2710..04ee874f9153 100644
--- a/drivers/md/dm-log-userspace-transfer.h
+++ b/drivers/md/dm-log-userspace-transfer.h
@@ -11,7 +11,7 @@
 
 int dm_ulog_tfr_init(void);
 void dm_ulog_tfr_exit(void);
-int dm_consult_userspace(const char *uuid, int request_type,
+int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
                          char *data, size_t data_size,
                          char *rdata, size_t *rdata_size);
 
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 9726577cde49..33f179e66bf5 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -648,7 +648,13 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
          */
         dm_rh_inc_pending(ms->rh, &sync);
         dm_rh_inc_pending(ms->rh, &nosync);
-        ms->log_failure = dm_rh_flush(ms->rh) ? 1 : 0;
+
+        /*
+         * If the flush fails on a previous call and succeeds here,
+         * we must not reset the log_failure variable.  We need
+         * userspace interaction to do that.
+         */
+        ms->log_failure = dm_rh_flush(ms->rh) ? 1 : ms->log_failure;
 
         /*
          * Dispatch io.
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 6e3fe4f14934..d5b2e08750d5 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -106,6 +106,13 @@ struct pstore {
         void *zero_area;
 
         /*
+         * An area used for header. The header can be written
+         * concurrently with metadata (when invalidating the snapshot),
+         * so it needs a separate buffer.
+         */
+        void *header_area;
+
+        /*
          * Used to keep track of which metadata area the data in
          * 'chunk' refers to.
          */
@@ -148,16 +155,27 @@ static int alloc_area(struct pstore *ps)
          */
         ps->area = vmalloc(len);
         if (!ps->area)
-                return r;
+                goto err_area;
 
         ps->zero_area = vmalloc(len);
-        if (!ps->zero_area) {
-                vfree(ps->area);
-                return r;
-        }
+        if (!ps->zero_area)
+                goto err_zero_area;
         memset(ps->zero_area, 0, len);
 
+        ps->header_area = vmalloc(len);
+        if (!ps->header_area)
+                goto err_header_area;
+
         return 0;
+
+err_header_area:
+        vfree(ps->zero_area);
+
+err_zero_area:
+        vfree(ps->area);
+
+err_area:
+        return r;
 }
 
 static void free_area(struct pstore *ps)
@@ -169,6 +187,10 @@ static void free_area(struct pstore *ps)
         if (ps->zero_area)
                 vfree(ps->zero_area);
         ps->zero_area = NULL;
+
+        if (ps->header_area)
+                vfree(ps->header_area);
+        ps->header_area = NULL;
 }
 
 struct mdata_req {
@@ -188,7 +210,8 @@ static void do_metadata(struct work_struct *work)
 /*
  * Read or write a chunk aligned and sized block of data from a device.
  */
-static int chunk_io(struct pstore *ps, chunk_t chunk, int rw, int metadata)
+static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
+                    int metadata)
 {
         struct dm_io_region where = {
                 .bdev = ps->store->cow->bdev,
@@ -198,7 +221,7 @@ static int chunk_io(struct pstore *ps, chunk_t chunk, int rw, int metadata)
         struct dm_io_request io_req = {
                 .bi_rw = rw,
                 .mem.type = DM_IO_VMA,
-                .mem.ptr.vma = ps->area,
+                .mem.ptr.vma = area,
                 .client = ps->io_client,
                 .notify.fn = NULL,
         };
@@ -240,7 +263,7 @@ static int area_io(struct pstore *ps, int rw)
 
         chunk = area_location(ps, ps->current_area);
 
-        r = chunk_io(ps, chunk, rw, 0);
+        r = chunk_io(ps, ps->area, chunk, rw, 0);
         if (r)
                 return r;
 
@@ -254,20 +277,7 @@ static void zero_memory_area(struct pstore *ps)
 
 static int zero_disk_area(struct pstore *ps, chunk_t area)
 {
-        struct dm_io_region where = {
-                .bdev = ps->store->cow->bdev,
-                .sector = ps->store->chunk_size * area_location(ps, area),
-                .count = ps->store->chunk_size,
-        };
-        struct dm_io_request io_req = {
-                .bi_rw = WRITE,
-                .mem.type = DM_IO_VMA,
-                .mem.ptr.vma = ps->zero_area,
-                .client = ps->io_client,
-                .notify.fn = NULL,
-        };
-
-        return dm_io(&io_req, 1, &where, NULL);
+        return chunk_io(ps, ps->zero_area, area_location(ps, area), WRITE, 0);
 }
 
 static int read_header(struct pstore *ps, int *new_snapshot)
@@ -276,6 +286,7 @@ static int read_header(struct pstore *ps, int *new_snapshot)
         struct disk_header *dh;
         chunk_t chunk_size;
         int chunk_size_supplied = 1;
+        char *chunk_err;
 
         /*
          * Use default chunk size (or hardsect_size, if larger) if none supplied
@@ -297,11 +308,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
         if (r)
                 return r;
 
-        r = chunk_io(ps, 0, READ, 1);
+        r = chunk_io(ps, ps->header_area, 0, READ, 1);
         if (r)
                 goto bad;
 
-        dh = (struct disk_header *) ps->area;
+        dh = ps->header_area;
 
         if (le32_to_cpu(dh->magic) == 0) {
                 *new_snapshot = 1;
@@ -319,20 +330,25 @@ static int read_header(struct pstore *ps, int *new_snapshot)
         ps->version = le32_to_cpu(dh->version);
         chunk_size = le32_to_cpu(dh->chunk_size);
 
-        if (!chunk_size_supplied || ps->store->chunk_size == chunk_size)
+        if (ps->store->chunk_size == chunk_size)
                 return 0;
 
-        DMWARN("chunk size %llu in device metadata overrides "
-               "table chunk size of %llu.",
-               (unsigned long long)chunk_size,
-               (unsigned long long)ps->store->chunk_size);
+        if (chunk_size_supplied)
+                DMWARN("chunk size %llu in device metadata overrides "
+                       "table chunk size of %llu.",
+                       (unsigned long long)chunk_size,
+                       (unsigned long long)ps->store->chunk_size);
 
         /* We had a bogus chunk_size. Fix stuff up. */
         free_area(ps);
 
-        ps->store->chunk_size = chunk_size;
-        ps->store->chunk_mask = chunk_size - 1;
-        ps->store->chunk_shift = ffs(chunk_size) - 1;
+        r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
+                                              &chunk_err);
+        if (r) {
+                DMERR("invalid on-disk chunk size %llu: %s.",
+                      (unsigned long long)chunk_size, chunk_err);
+                return r;
+        }
 
         r = dm_io_client_resize(sectors_to_pages(ps->store->chunk_size),
                                 ps->io_client);
@@ -351,15 +367,15 @@ static int write_header(struct pstore *ps)
 {
         struct disk_header *dh;
 
-        memset(ps->area, 0, ps->store->chunk_size << SECTOR_SHIFT);
+        memset(ps->header_area, 0, ps->store->chunk_size << SECTOR_SHIFT);
 
-        dh = (struct disk_header *) ps->area;
+        dh = ps->header_area;
         dh->magic = cpu_to_le32(SNAP_MAGIC);
         dh->valid = cpu_to_le32(ps->valid);
         dh->version = cpu_to_le32(ps->version);
         dh->chunk_size = cpu_to_le32(ps->store->chunk_size);
 
-        return chunk_io(ps, 0, WRITE, 1);
+        return chunk_io(ps, ps->header_area, 0, WRITE, 1);
 }
 
 /*
@@ -679,6 +695,8 @@ static int persistent_ctr(struct dm_exception_store *store,
         ps->valid = 1;
         ps->version = SNAPSHOT_DISK_VERSION;
         ps->area = NULL;
+        ps->zero_area = NULL;
+        ps->header_area = NULL;
         ps->next_free = 2;      /* skipping the header and first area */
         ps->current_committed = 0;
 
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index d573165cd2b7..57f1bf7f3b7a 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1176,6 +1176,15 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
         return 0;
 }
 
+static int snapshot_iterate_devices(struct dm_target *ti,
+                                    iterate_devices_callout_fn fn, void *data)
+{
+        struct dm_snapshot *snap = ti->private;
+
+        return fn(ti, snap->origin, 0, ti->len, data);
+}
+
+
 /*-----------------------------------------------------------------
  * Origin methods
  *---------------------------------------------------------------*/
@@ -1410,20 +1419,29 @@ static int origin_status(struct dm_target *ti, status_type_t type, char *result,
         return 0;
 }
 
+static int origin_iterate_devices(struct dm_target *ti,
+                                  iterate_devices_callout_fn fn, void *data)
+{
+        struct dm_dev *dev = ti->private;
+
+        return fn(ti, dev, 0, ti->len, data);
+}
+
 static struct target_type origin_target = {
         .name    = "snapshot-origin",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
         .module  = THIS_MODULE,
         .ctr     = origin_ctr,
         .dtr     = origin_dtr,
         .map     = origin_map,
         .resume  = origin_resume,
         .status  = origin_status,
+        .iterate_devices = origin_iterate_devices,
 };
 
 static struct target_type snapshot_target = {
         .name    = "snapshot",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
@@ -1431,6 +1449,7 @@ static struct target_type snapshot_target = {
         .end_io  = snapshot_end_io,
         .resume  = snapshot_resume,
         .status  = snapshot_status,
+        .iterate_devices = snapshot_iterate_devices,
 };
 
 static int __init dm_snapshot_init(void)
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index 4e0e5937e42a..3e563d251733 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -329,9 +329,19 @@ static int stripe_iterate_devices(struct dm_target *ti,
         return ret;
 }
 
+static void stripe_io_hints(struct dm_target *ti,
+                            struct queue_limits *limits)
+{
+        struct stripe_c *sc = ti->private;
+        unsigned chunk_size = (sc->chunk_mask + 1) << 9;
+
+        blk_limits_io_min(limits, chunk_size);
+        limits->io_opt = chunk_size * sc->stripes;
+}
+
 static struct target_type stripe_target = {
         .name   = "striped",
-        .version = {1, 2, 0},
+        .version = {1, 3, 0},
         .module = THIS_MODULE,
         .ctr    = stripe_ctr,
         .dtr    = stripe_dtr,
@@ -339,6 +349,7 @@ static struct target_type stripe_target = {
         .end_io = stripe_end_io,
         .status = stripe_status,
         .iterate_devices = stripe_iterate_devices,
+        .io_hints = stripe_io_hints,
 };
 
 int __init dm_stripe_init(void)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index d952b3441913..1a6cb3c7822e 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -343,10 +343,10 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md)
 }
 
 /*
- * If possible, this checks an area of a destination device is valid.
+ * If possible, this checks an area of a destination device is invalid.
  */
-static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
-                                sector_t start, sector_t len, void *data)
+static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
+                                  sector_t start, sector_t len, void *data)
 {
         struct queue_limits *limits = data;
         struct block_device *bdev = dev->bdev;
@@ -357,36 +357,40 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
         char b[BDEVNAME_SIZE];
 
         if (!dev_size)
-                return 1;
+                return 0;
 
         if ((start >= dev_size) || (start + len > dev_size)) {
-                DMWARN("%s: %s too small for target",
-                       dm_device_name(ti->table->md), bdevname(bdev, b));
-                return 0;
+                DMWARN("%s: %s too small for target: "
+                       "start=%llu, len=%llu, dev_size=%llu",
+                       dm_device_name(ti->table->md), bdevname(bdev, b),
+                       (unsigned long long)start,
+                       (unsigned long long)len,
+                       (unsigned long long)dev_size);
+                return 1;
         }
 
         if (logical_block_size_sectors <= 1)
-                return 1;
+                return 0;
 
         if (start & (logical_block_size_sectors - 1)) {
                 DMWARN("%s: start=%llu not aligned to h/w "
-                       "logical block size %hu of %s",
+                       "logical block size %u of %s",
                        dm_device_name(ti->table->md),
                        (unsigned long long)start,
                        limits->logical_block_size, bdevname(bdev, b));
-                return 0;
+                return 1;
         }
 
         if (len & (logical_block_size_sectors - 1)) {
                 DMWARN("%s: len=%llu not aligned to h/w "
-                       "logical block size %hu of %s",
+                       "logical block size %u of %s",
                        dm_device_name(ti->table->md),
                        (unsigned long long)len,
                        limits->logical_block_size, bdevname(bdev, b));
-                return 0;
+                return 1;
         }
 
-        return 1;
+        return 0;
 }
 
 /*
@@ -496,8 +500,15 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
         }
 
         if (blk_stack_limits(limits, &q->limits, start << 9) < 0)
-                DMWARN("%s: target device %s is misaligned",
-                       dm_device_name(ti->table->md), bdevname(bdev, b));
+                DMWARN("%s: target device %s is misaligned: "
+                       "physical_block_size=%u, logical_block_size=%u, "
+                       "alignment_offset=%u, start=%llu",
+                       dm_device_name(ti->table->md), bdevname(bdev, b),
+                       q->limits.physical_block_size,
+                       q->limits.logical_block_size,
+                       q->limits.alignment_offset,
+                       (unsigned long long) start << 9);
+
 
         /*
          * Check if merge fn is supported.
@@ -698,7 +709,7 @@ static int validate_hardware_logical_block_alignment(struct dm_table *table,
 
         if (remaining) {
                 DMWARN("%s: table line %u (start sect %llu len %llu) "
-                       "not aligned to h/w logical block size %hu",
+                       "not aligned to h/w logical block size %u",
                        dm_device_name(table->md), i,
                        (unsigned long long) ti->begin,
                        (unsigned long long) ti->len,
@@ -996,12 +1007,16 @@ int dm_calculate_queue_limits(struct dm_table *table,
                 ti->type->iterate_devices(ti, dm_set_device_limits,
                                           &ti_limits);
 
+                /* Set I/O hints portion of queue limits */
+                if (ti->type->io_hints)
+                        ti->type->io_hints(ti, &ti_limits);
+
                 /*
                  * Check each device area is consistent with the target's
                  * overall queue limits.
                  */
-                if (!ti->type->iterate_devices(ti, device_area_is_valid,
-                                               &ti_limits))
+                if (ti->type->iterate_devices(ti, device_area_is_invalid,
+                                              &ti_limits))
                         return -EINVAL;
 
 combine_limits:
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 8a311ea0d441..b4845b14740d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -738,16 +738,22 @@ static void rq_completed(struct mapped_device *md, int run_queue)
         dm_put(md);
 }
 
+static void free_rq_clone(struct request *clone)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+
+        blk_rq_unprep_clone(clone);
+        free_rq_tio(tio);
+}
+
 static void dm_unprep_request(struct request *rq)
 {
         struct request *clone = rq->special;
-        struct dm_rq_target_io *tio = clone->end_io_data;
 
         rq->special = NULL;
         rq->cmd_flags &= ~REQ_DONTPREP;
 
-        blk_rq_unprep_clone(clone);
-        free_rq_tio(tio);
+        free_rq_clone(clone);
 }
 
 /*
@@ -825,8 +831,7 @@ static void dm_end_request(struct request *clone, int error)
                         rq->sense_len = clone->sense_len;
         }
 
-        BUG_ON(clone->bio);
-        free_rq_tio(tio);
+        free_rq_clone(clone);
 
         blk_end_request_all(rq, error);
 
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index ae5fe91867e1..10ed195c0c1c 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -736,7 +736,7 @@ static int __devinit m25p_probe(struct spi_device *spi)
                         flash->partitioned = 1;
                         return add_mtd_partitions(&flash->mtd, parts, nr_parts);
                 }
-        } else if (data->nr_parts)
+        } else if (data && data->nr_parts)
                 dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
                                 data->nr_parts, data->name);
 
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index fb86cacd5bdb..1002e1882996 100644
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -135,16 +135,17 @@ static void nftl_remove_dev(struct mtd_blktrans_dev *dev)
 int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                   size_t *retlen, uint8_t *buf)
 {
+        loff_t mask = mtd->writesize - 1;
         struct mtd_oob_ops ops;
         int res;
 
         ops.mode = MTD_OOB_PLACE;
-        ops.ooboffs = offs & (mtd->writesize - 1);
+        ops.ooboffs = offs & mask;
         ops.ooblen = len;
         ops.oobbuf = buf;
         ops.datbuf = NULL;
 
-        res = mtd->read_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
+        res = mtd->read_oob(mtd, offs & ~mask, &ops);
         *retlen = ops.oobretlen;
         return res;
 }
@@ -155,16 +156,17 @@ int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
 int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                    size_t *retlen, uint8_t *buf)
 {
+        loff_t mask = mtd->writesize - 1;
         struct mtd_oob_ops ops;
         int res;
 
         ops.mode = MTD_OOB_PLACE;
-        ops.ooboffs = offs & (mtd->writesize - 1);
+        ops.ooboffs = offs & mask;
         ops.ooblen = len;
         ops.oobbuf = buf;
         ops.datbuf = NULL;
 
-        res = mtd->write_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
+        res = mtd->write_oob(mtd, offs & ~mask, &ops);
         *retlen = ops.oobretlen;
         return res;
 }
@@ -177,17 +179,18 @@ int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
 static int nftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
                       size_t *retlen, uint8_t *buf, uint8_t *oob)
 {
+        loff_t mask = mtd->writesize - 1;
         struct mtd_oob_ops ops;
         int res;
 
         ops.mode = MTD_OOB_PLACE;
-        ops.ooboffs = offs;
+        ops.ooboffs = offs & mask;
         ops.ooblen = mtd->oobsize;
         ops.oobbuf = oob;
         ops.datbuf = buf;
         ops.len = len;
 
-        res = mtd->write_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
+        res = mtd->write_oob(mtd, offs & ~mask, &ops);
         *retlen = ops.retlen;
         return res;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index e212f2c5448b..24f7ca5e17de 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -491,6 +491,7 @@ static int gfar_remove(struct of_device *ofdev)
 
         dev_set_drvdata(&ofdev->dev, NULL);
 
+        unregister_netdev(dev);
         iounmap(priv->regs);
         free_netdev(priv->ndev);
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 6dcac73b4d29..f593fbbb4e52 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2874,45 +2874,27 @@ static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
         return 0;
 }
 
-static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
-                                 u32 src_phys, u32 dest_address, u32 length)
+static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
+                                 int nr, u32 dest_address, u32 len)
 {
-        u32 bytes_left = length;
-        u32 src_offset = 0;
-        u32 dest_offset = 0;
-        int status = 0;
+        int ret, i;
+        u32 size;
+
         IPW_DEBUG_FW(">> \n");
-        IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
-                          src_phys, dest_address, length);
-        while (bytes_left > CB_MAX_LENGTH) {
-                status = ipw_fw_dma_add_command_block(priv,
-                                                      src_phys + src_offset,
-                                                      dest_address +
-                                                      dest_offset,
-                                                      CB_MAX_LENGTH, 0, 0);
-                if (status) {
+        IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
+                          nr, dest_address, len);
+
+        for (i = 0; i < nr; i++) {
+                size = min_t(u32, len - i * CB_MAX_LENGTH, CB_MAX_LENGTH);
+                ret = ipw_fw_dma_add_command_block(priv, src_address[i],
+                                                   dest_address +
+                                                   i * CB_MAX_LENGTH, size,
+                                                   0, 0);
+                if (ret) {
                         IPW_DEBUG_FW_INFO(": Failed\n");
                         return -1;
                 } else
                         IPW_DEBUG_FW_INFO(": Added new cb\n");
-
-                src_offset += CB_MAX_LENGTH;
-                dest_offset += CB_MAX_LENGTH;
-                bytes_left -= CB_MAX_LENGTH;
-        }
-
-        /* add the buffer tail */
-        if (bytes_left > 0) {
-                status =
-                    ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
-                                                 dest_address + dest_offset,
-                                                 bytes_left, 0, 0);
-                if (status) {
-                        IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
-                        return -1;
-                } else
-                        IPW_DEBUG_FW_INFO
-                            (": Adding new cb - the buffer tail\n");
         }
 
         IPW_DEBUG_FW("<< \n");
@@ -3160,59 +3142,91 @@ static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 
 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 {
-        int rc = -1;
+        int ret = -1;
         int offset = 0;
         struct fw_chunk *chunk;
-        dma_addr_t shared_phys;
-        u8 *shared_virt;
+        int total_nr = 0;
+        int i;
+        struct pci_pool *pool;
+        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
+        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
 
         IPW_DEBUG_TRACE("<< : \n");
-        shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
 
-        if (!shared_virt)
+        pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
+        if (!pool) {
+                IPW_ERROR("pci_pool_create failed\n");
                 return -ENOMEM;
-
-        memmove(shared_virt, data, len);
+        }
 
         /* Start the Dma */
-        rc = ipw_fw_dma_enable(priv);
+        ret = ipw_fw_dma_enable(priv);
 
         /* the DMA is already ready this would be a bug. */
         BUG_ON(priv->sram_desc.last_cb_index > 0);
 
         do {
+                u32 chunk_len;
+                u8 *start;
+                int size;
+                int nr = 0;
+
                 chunk = (struct fw_chunk *)(data + offset);
                 offset += sizeof(struct fw_chunk);
+                chunk_len = le32_to_cpu(chunk->length);
+                start = data + offset;
+
+                nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
+                for (i = 0; i < nr; i++) {
+                        virts[total_nr] = pci_pool_alloc(pool, GFP_KERNEL,
+                                                         &phys[total_nr]);
+                        if (!virts[total_nr]) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                        size = min_t(u32, chunk_len - i * CB_MAX_LENGTH,
+                                     CB_MAX_LENGTH);
+                        memcpy(virts[total_nr], start, size);
+                        start += size;
+                        total_nr++;
+                        /* We don't support fw chunk larger than 64*8K */
+                        BUG_ON(total_nr > CB_NUMBER_OF_ELEMENTS_SMALL);
+                }
+
                 /* build DMA packet and queue up for sending */
                 /* dma to chunk->address, the chunk->length bytes from data +
                  * offeset*/
                 /* Dma loading */
-                rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
-                                           le32_to_cpu(chunk->address),
-                                           le32_to_cpu(chunk->length));
-                if (rc) {
+                ret = ipw_fw_dma_add_buffer(priv, &phys[total_nr - nr],
+                                            nr, le32_to_cpu(chunk->address),
+                                            chunk_len);
+                if (ret) {
                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
                         goto out;
                 }
 
-                offset += le32_to_cpu(chunk->length);
+                offset += chunk_len;
         } while (offset < len);
 
         /* Run the DMA and wait for the answer */
-        rc = ipw_fw_dma_kick(priv);
-        if (rc) {
+        ret = ipw_fw_dma_kick(priv);
+        if (ret) {
                 IPW_ERROR("dmaKick Failed\n");
                 goto out;
         }
 
-        rc = ipw_fw_dma_wait(priv);
-        if (rc) {
+        ret = ipw_fw_dma_wait(priv);
+        if (ret) {
                 IPW_ERROR("dmaWaitSync Failed\n");
                 goto out;
         }
-      out:
-        pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
-        return rc;
+ out:
+        for (i = 0; i < total_nr; i++)
+                pci_pool_free(pool, virts[i], phys[i]);
+
+        pci_pool_destroy(pool);
+
+        return ret;
 }
 
 /* stop nic */
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index e3a87210e947..e03fe98f0619 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -598,6 +598,29 @@ int pci_iov_resource_bar(struct pci_dev *dev, int resno,
 }
 
 /**
+ * pci_sriov_resource_alignment - get resource alignment for VF BAR
+ * @dev: the PCI device
+ * @resno: the resource number
+ *
+ * Returns the alignment of the VF BAR found in the SR-IOV capability.
+ * This is not the same as the resource size which is defined as
+ * the VF BAR size multiplied by the number of VFs.  The alignment
+ * is just the VF BAR size.
+ */
+int pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
+{
+        struct resource tmp;
+        enum pci_bar_type type;
+        int reg = pci_iov_resource_bar(dev, resno, &type);
+        
+        if (!reg)
+                return 0;
+
+         __pci_read_base(dev, type, &tmp, reg);
+        return resource_alignment(&tmp);
+}
+
+/**
  * pci_restore_iov_state - restore the state of the IOV capability
  * @dev: the PCI device
  */
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index f73bcbedf37c..5ff4d25bf0e9 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -243,6 +243,7 @@ extern int pci_iov_init(struct pci_dev *dev);
 extern void pci_iov_release(struct pci_dev *dev);
 extern int pci_iov_resource_bar(struct pci_dev *dev, int resno,
                                 enum pci_bar_type *type);
+extern int pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
 extern void pci_restore_iov_state(struct pci_dev *dev);
 extern int pci_iov_bus_range(struct pci_bus *bus);
 
@@ -298,4 +299,16 @@ static inline int pci_ats_enabled(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_IOV */
 
+static inline int pci_resource_alignment(struct pci_dev *dev,
+                                         struct resource *res)
+{
+#ifdef CONFIG_PCI_IOV
+        int resno = res - dev->resource;
+
+        if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END)
+                return pci_sriov_resource_alignment(dev, resno);
+#endif
+        return resource_alignment(res);
+}
+
 #endif /* DRIVERS_PCI_H */
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index b636e245445d..7c443b4583ab 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -25,7 +25,7 @@
 #include <linux/ioport.h>
 #include <linux/cache.h>
 #include <linux/slab.h>
-
+#include "pci.h"
 
 static void pbus_assign_resources_sorted(const struct pci_bus *bus)
 {
@@ -384,7 +384,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, unsigned long
                                 continue;
                         r_size = resource_size(r);
                         /* For bridges size != alignment */
-                        align = resource_alignment(r);
+                        align = pci_resource_alignment(dev, r);
                         order = __ffs(align) - 20;
                         if (order > 11) {
                                 dev_warn(&dev->dev, "BAR %d bad alignment %llx: "
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 1898c7b47907..88cdd1a937d6 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -144,7 +144,7 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
 
         size = resource_size(res);
         min = (res->flags & IORESOURCE_IO) ? PCIBIOS_MIN_IO : PCIBIOS_MIN_MEM;
-        align = resource_alignment(res);
+        align = pci_resource_alignment(dev, res);
 
         /* First, try exact prefetching match.. */
         ret = pci_bus_alloc_resource(bus, res, size, align, min,
@@ -178,7 +178,7 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
         struct pci_bus *bus;
         int ret;
 
-        align = resource_alignment(res);
+        align = pci_resource_alignment(dev, res);
         if (!align) {
                 dev_info(&dev->dev, "BAR %d: can't allocate resource (bogus "
                         "alignment) %pR flags %#lx\n",
@@ -259,7 +259,7 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
                 if (!(r->flags) || r->parent)
                         continue;
 
-                r_align = resource_alignment(r);
+                r_align = pci_resource_alignment(dev, r);
                 if (!r_align) {
                         dev_warn(&dev->dev, "BAR %d: bogus alignment "
                                 "%pR flags %#lx\n",
@@ -271,7 +271,7 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
                         struct resource_list *ln = list->next;
 
                         if (ln)
-                                align = resource_alignment(ln->res);
+                                align = pci_resource_alignment(ln->dev, ln->res);
 
                         if (r_align > align) {
                                 tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);