30 files changed, 383 insertions, 641 deletions

diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index f2296ecedb89..e2ddcdeb61b6 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -36,8 +36,6 @@ detailed description):
         - Bluetooth enable and disable
         - video output switching, expansion control
         - ThinkLight on and off
-        - limited docking and undocking
-        - UltraBay eject
         - CMOS/UCMS control
         - LED control
         - ACPI sounds
@@ -729,131 +727,6 @@ cannot be read or if it is unknown, thinkpad-acpi will report it as "off".
 It is impossible to know if the status returned through sysfs is valid.
 
 
-Docking / undocking -- /proc/acpi/ibm/dock
-------------------------------------------
-
-Docking and undocking (e.g. with the X4 UltraBase) requires some
-actions to be taken by the operating system to safely make or break
-the electrical connections with the dock.
-
-The docking feature of this driver generates the following ACPI events:
-
-        ibm/dock GDCK 00000003 00000001 -- eject request
-        ibm/dock GDCK 00000003 00000002 -- undocked
-        ibm/dock GDCK 00000000 00000003 -- docked
-
-NOTE: These events will only be generated if the laptop was docked
-when originally booted. This is due to the current lack of support for
-hot plugging of devices in the Linux ACPI framework. If the laptop was
-booted while not in the dock, the following message is shown in the
-logs:
-
-        Mar 17 01:42:34 aero kernel: thinkpad_acpi: dock device not present
-
-In this case, no dock-related events are generated but the dock and
-undock commands described below still work. They can be executed
-manually or triggered by Fn key combinations (see the example acpid
-configuration files included in the driver tarball package available
-on the web site).
-
-When the eject request button on the dock is pressed, the first event
-above is generated. The handler for this event should issue the
-following command:
-
-        echo undock > /proc/acpi/ibm/dock
-
-After the LED on the dock goes off, it is safe to eject the laptop.
-Note: if you pressed this key by mistake, go ahead and eject the
-laptop, then dock it back in. Otherwise, the dock may not function as
-expected.
-
-When the laptop is docked, the third event above is generated. The
-handler for this event should issue the following command to fully
-enable the dock:
-
-        echo dock > /proc/acpi/ibm/dock
-
-The contents of the /proc/acpi/ibm/dock file shows the current status
-of the dock, as provided by the ACPI framework.
-
-The docking support in this driver does not take care of enabling or
-disabling any other devices you may have attached to the dock. For
-example, a CD drive plugged into the UltraBase needs to be disabled or
-enabled separately. See the provided example acpid configuration files
-for how this can be accomplished.
-
-There is no support yet for PCI devices that may be attached to a
-docking station, e.g. in the ThinkPad Dock II. The driver currently
-does not recognize, enable or disable such devices. This means that
-the only docking stations currently supported are the X-series
-UltraBase docks and "dumb" port replicators like the Mini Dock (the
-latter don't need any ACPI support, actually).
-
-
-UltraBay eject -- /proc/acpi/ibm/bay
-------------------------------------
-
-Inserting or ejecting an UltraBay device requires some actions to be
-taken by the operating system to safely make or break the electrical
-connections with the device.
-
-This feature generates the following ACPI events:
-
-        ibm/bay MSTR 00000003 00000000 -- eject request
-        ibm/bay MSTR 00000001 00000000 -- eject lever inserted
-
-NOTE: These events will only be generated if the UltraBay was present
-when the laptop was originally booted (on the X series, the UltraBay
-is in the dock, so it may not be present if the laptop was undocked).
-This is due to the current lack of support for hot plugging of devices
-in the Linux ACPI framework. If the laptop was booted without the
-UltraBay, the following message is shown in the logs:
-
-        Mar 17 01:42:34 aero kernel: thinkpad_acpi: bay device not present
-
-In this case, no bay-related events are generated but the eject
-command described below still works. It can be executed manually or
-triggered by a hot key combination.
-
-Sliding the eject lever generates the first event shown above. The
-handler for this event should take whatever actions are necessary to
-shut down the device in the UltraBay (e.g. call idectl), then issue
-the following command:
-
-        echo eject > /proc/acpi/ibm/bay
-
-After the LED on the UltraBay goes off, it is safe to pull out the
-device.
-
-When the eject lever is inserted, the second event above is
-generated. The handler for this event should take whatever actions are
-necessary to enable the UltraBay device (e.g. call idectl).
-
-The contents of the /proc/acpi/ibm/bay file shows the current status
-of the UltraBay, as provided by the ACPI framework.
-
-EXPERIMENTAL warm eject support on the 600e/x, A22p and A3x (To use
-this feature, you need to supply the experimental=1 parameter when
-loading the module):
-
-These models do not have a button near the UltraBay device to request
-a hot eject but rather require the laptop to be put to sleep
-(suspend-to-ram) before the bay device is ejected or inserted).
-The sequence of steps to eject the device is as follows:
-
-        echo eject > /proc/acpi/ibm/bay
-        put the ThinkPad to sleep
-        remove the drive
-        resume from sleep
-        cat /proc/acpi/ibm/bay should show that the drive was removed
-
-On the A3x, both the UltraBay 2000 and UltraBay Plus devices are
-supported. Use "eject2" instead of "eject" for the second bay.
-
-Note: the UltraBay eject support on the 600e/x, A22p and A3x is
-EXPERIMENTAL and may not work as expected. USE WITH CAUTION!
-
-
 CMOS/UCMS control
 -----------------
 
diff --git a/MAINTAINERS b/MAINTAINERS
index d6befb2c470f..b1114cfac6bf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4995,7 +4995,9 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial.git
 S:      Maintained
 
 TTY LAYER
-S:      Orphan
+M:      Greg Kroah-Hartman <gregkh@suse.de>
+S:      Maintained
+T:      quilt kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/
 F:      drivers/char/tty_*
 F:      drivers/serial/serial_core.c
 F:      include/linux/serial_core.h
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index 7a0f4aa4fa1e..9a62224cc278 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -38,6 +38,9 @@
 
 #define _COMPONENT              ACPI_MEMORY_DEVICE_COMPONENT
 
+#undef PREFIX
+#define         PREFIX          "ACPI:memory_hp:"
+
 ACPI_MODULE_NAME("acpi_memhotplug");
 MODULE_AUTHOR("Naveen B S <naveen.b.s@intel.com>");
 MODULE_DESCRIPTION("Hotplug Mem Driver");
@@ -153,6 +156,7 @@ acpi_memory_get_device(acpi_handle handle,
         acpi_handle phandle;
         struct acpi_device *device = NULL;
         struct acpi_device *pdevice = NULL;
+        int result;
 
 
         if (!acpi_bus_get_device(handle, &device) && device)
@@ -165,9 +169,9 @@ acpi_memory_get_device(acpi_handle handle,
         }
 
         /* Get the parent device */
-        status = acpi_bus_get_device(phandle, &pdevice);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status, "Cannot get acpi bus device"));
+        result = acpi_bus_get_device(phandle, &pdevice);
+        if (result) {
+                printk(KERN_WARNING PREFIX "Cannot get acpi bus device");
                 return -EINVAL;
         }
 
@@ -175,9 +179,9 @@ acpi_memory_get_device(acpi_handle handle,
          * Now add the notified device.  This creates the acpi_device
          * and invokes .add function
          */
-        status = acpi_bus_add(&device, pdevice, handle, ACPI_BUS_TYPE_DEVICE);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status, "Cannot add acpi bus"));
+        result = acpi_bus_add(&device, pdevice, handle, ACPI_BUS_TYPE_DEVICE);
+        if (result) {
+                printk(KERN_WARNING PREFIX "Cannot add acpi bus");
                 return -EINVAL;
         }
 
@@ -238,7 +242,12 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
                         num_enabled++;
                         continue;
                 }
-
+                /*
+                 * If the memory block size is zero, please ignore it.
+                 * Don't try to do the following memory hotplug flowchart.
+                 */
+                if (!info->length)
+                        continue;
                 if (node < 0)
                         node = memory_add_physaddr_to_nid(info->start_addr);
 
@@ -253,8 +262,15 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
                 mem_device->state = MEMORY_INVALID_STATE;
                 return -EINVAL;
         }
-
-        return result;
+        /*
+         * Sometimes the memory device will contain several memory blocks.
+         * When one memory block is hot-added to the system memory, it will
+         * be regarded as a success.
+         * Otherwise if the last memory block can't be hot-added to the system
+         * memory, it will be failure and the memory device can't be bound with
+         * driver.
+         */
+        return 0;
 }
 
 static int acpi_memory_powerdown_device(struct acpi_memory_device *mem_device)
diff --git a/drivers/acpi/acpica/acobject.h b/drivers/acpi/acpica/acobject.h
index 544dcf834922..eb6f038b03d9 100644
--- a/drivers/acpi/acpica/acobject.h
+++ b/drivers/acpi/acpica/acobject.h
@@ -97,6 +97,7 @@
 #define AOPOBJ_OBJECT_INITIALIZED   0x08
 #define AOPOBJ_SETUP_COMPLETE       0x10
 #define AOPOBJ_SINGLE_DATUM         0x20
+#define AOPOBJ_INVALID              0x40        /* Used if host OS won't allow an op_region address */
 
 /******************************************************************************
  *
diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
index 584d766e6f12..b79978f7bc71 100644
--- a/drivers/acpi/acpica/dsopcode.c
+++ b/drivers/acpi/acpica/dsopcode.c
@@ -397,6 +397,30 @@ acpi_status acpi_ds_get_region_arguments(union acpi_operand_object *obj_desc)
         status = acpi_ds_execute_arguments(node, acpi_ns_get_parent_node(node),
                                            extra_desc->extra.aml_length,
                                            extra_desc->extra.aml_start);
+        if (ACPI_FAILURE(status)) {
+                return_ACPI_STATUS(status);
+        }
+
+        /* Validate the region address/length via the host OS */
+
+        status = acpi_os_validate_address(obj_desc->region.space_id,
+                                          obj_desc->region.address,
+                                          (acpi_size) obj_desc->region.length,
+                                          acpi_ut_get_node_name(node));
+
+        if (ACPI_FAILURE(status)) {
+                /*
+                 * Invalid address/length. We will emit an error message and mark
+                 * the region as invalid, so that it will cause an additional error if
+                 * it is ever used. Then return AE_OK.
+                 */
+                ACPI_EXCEPTION((AE_INFO, status,
+                                "During address validation of OpRegion [%4.4s]",
+                                node->name.ascii));
+                obj_desc->common.flags |= AOPOBJ_INVALID;
+                status = AE_OK;
+        }
+
         return_ACPI_STATUS(status);
 }
 
diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
index d4075b821021..6687be167f5f 100644
--- a/drivers/acpi/acpica/exfldio.c
+++ b/drivers/acpi/acpica/exfldio.c
@@ -113,6 +113,12 @@ acpi_ex_setup_region(union acpi_operand_object *obj_desc,
                 }
         }
 
+        /* Exit if Address/Length have been disallowed by the host OS */
+
+        if (rgn_desc->common.flags & AOPOBJ_INVALID) {
+                return_ACPI_STATUS(AE_AML_ILLEGAL_ADDRESS);
+        }
+
         /*
          * Exit now for SMBus address space, it has a non-linear address space
          * and the request cannot be directly validated
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 71670719d61a..5691f165a952 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -189,11 +189,36 @@ acpi_status __init acpi_os_initialize(void)
         return AE_OK;
 }
 
+static void bind_to_cpu0(struct work_struct *work)
+{
+        set_cpus_allowed(current, cpumask_of_cpu(0));
+        kfree(work);
+}
+
+static void bind_workqueue(struct workqueue_struct *wq)
+{
+        struct work_struct *work;
+
+        work = kzalloc(sizeof(struct work_struct), GFP_KERNEL);
+        INIT_WORK(work, bind_to_cpu0);
+        queue_work(wq, work);
+}
+
 acpi_status acpi_os_initialize1(void)
 {
+        /*
+         * On some machines, a software-initiated SMI causes corruption unless
+         * the SMI runs on CPU 0.  An SMI can be initiated by any AML, but
+         * typically it's done in GPE-related methods that are run via
+         * workqueues, so we can avoid the known corruption cases by binding
+         * the workqueues to CPU 0.
+         */
         kacpid_wq = create_singlethread_workqueue("kacpid");
+        bind_workqueue(kacpid_wq);
         kacpi_notify_wq = create_singlethread_workqueue("kacpi_notify");
+        bind_workqueue(kacpi_notify_wq);
         kacpi_hotplug_wq = create_singlethread_workqueue("kacpi_hotplug");
+        bind_workqueue(kacpi_hotplug_wq);
         BUG_ON(!kacpid_wq);
         BUG_ON(!kacpi_notify_wq);
         BUG_ON(!kacpi_hotplug_wq);
diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c
index 0944daec064f..9c61ab2177cf 100644
--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -121,7 +121,7 @@ static void acpi_table_attr_init(struct acpi_table_attr *table_attr,
         table_attr->attr.size = 0;
         table_attr->attr.read = acpi_table_show;
         table_attr->attr.attr.name = table_attr->name;
-        table_attr->attr.attr.mode = 0444;
+        table_attr->attr.attr.mode = 0400;
 
         return;
 }
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 5810fa906af0..5fe39c2a3d2b 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -220,6 +220,7 @@ static int linear_run (mddev_t *mddev)
         mddev->queue->unplug_fn = linear_unplug;
         mddev->queue->backing_dev_info.congested_fn = linear_congested;
         mddev->queue->backing_dev_info.congested_data = mddev;
+        md_integrity_register(mddev);
         return 0;
 }
 
@@ -256,6 +257,7 @@ static int linear_add(mddev_t *mddev, mdk_rdev_t *rdev)
         rcu_assign_pointer(mddev->private, newconf);
         md_set_array_sectors(mddev, linear_size(mddev, 0, 0));
         set_capacity(mddev->gendisk, mddev->array_sectors);
+        revalidate_disk(mddev->gendisk);
         call_rcu(&oldconf->rcu, free_conf);
         return 0;
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d4351ff0849f..5b98bea4ff9b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1308,7 +1308,12 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
         }
         if (mddev->level != LEVEL_MULTIPATH) {
                 int role;
-                role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
+                if (rdev->desc_nr < 0 ||
+                    rdev->desc_nr >= le32_to_cpu(sb->max_dev)) {
+                        role = 0xffff;
+                        rdev->desc_nr = -1;
+                } else
+                        role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
                 switch(role) {
                 case 0xffff: /* spare */
                         break;
@@ -1394,8 +1399,14 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
                 if (rdev2->desc_nr+1 > max_dev)
                         max_dev = rdev2->desc_nr+1;
 
-        if (max_dev > le32_to_cpu(sb->max_dev))
+        if (max_dev > le32_to_cpu(sb->max_dev)) {
+                int bmask;
                 sb->max_dev = cpu_to_le32(max_dev);
+                rdev->sb_size = max_dev * 2 + 256;
+                bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
+                if (rdev->sb_size & bmask)
+                        rdev->sb_size = (rdev->sb_size | bmask) + 1;
+        }
         for (i=0; i<max_dev;i++)
                 sb->dev_roles[i] = cpu_to_le16(0xfffe);
         
@@ -1487,37 +1498,76 @@ static int match_mddev_units(mddev_t *mddev1, mddev_t *mddev2)
 
 static LIST_HEAD(pending_raid_disks);
 
-static void md_integrity_check(mdk_rdev_t *rdev, mddev_t *mddev)
+/*
+ * Try to register data integrity profile for an mddev
+ *
+ * This is called when an array is started and after a disk has been kicked
+ * from the array. It only succeeds if all working and active component devices
+ * are integrity capable with matching profiles.
+ */
+int md_integrity_register(mddev_t *mddev)
+{
+        mdk_rdev_t *rdev, *reference = NULL;
+
+        if (list_empty(&mddev->disks))
+                return 0; /* nothing to do */
+        if (blk_get_integrity(mddev->gendisk))
+                return 0; /* already registered */
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                /* skip spares and non-functional disks */
+                if (test_bit(Faulty, &rdev->flags))
+                        continue;
+                if (rdev->raid_disk < 0)
+                        continue;
+                /*
+                 * If at least one rdev is not integrity capable, we can not
+                 * enable data integrity for the md device.
+                 */
+                if (!bdev_get_integrity(rdev->bdev))
+                        return -EINVAL;
+                if (!reference) {
+                        /* Use the first rdev as the reference */
+                        reference = rdev;
+                        continue;
+                }
+                /* does this rdev's profile match the reference profile? */
+                if (blk_integrity_compare(reference->bdev->bd_disk,
+                                rdev->bdev->bd_disk) < 0)
+                        return -EINVAL;
+        }
+        /*
+         * All component devices are integrity capable and have matching
+         * profiles, register the common profile for the md device.
+         */
+        if (blk_integrity_register(mddev->gendisk,
+                        bdev_get_integrity(reference->bdev)) != 0) {
+                printk(KERN_ERR "md: failed to register integrity for %s\n",
+                        mdname(mddev));
+                return -EINVAL;
+        }
+        printk(KERN_NOTICE "md: data integrity on %s enabled\n",
+                mdname(mddev));
+        return 0;
+}
+EXPORT_SYMBOL(md_integrity_register);
+
+/* Disable data integrity if non-capable/non-matching disk is being added */
+void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev)
 {
-        struct mdk_personality *pers = mddev->pers;
-        struct gendisk *disk = mddev->gendisk;
         struct blk_integrity *bi_rdev = bdev_get_integrity(rdev->bdev);
-        struct blk_integrity *bi_mddev = blk_get_integrity(disk);
+        struct blk_integrity *bi_mddev = blk_get_integrity(mddev->gendisk);
 
-        /* Data integrity passthrough not supported on RAID 4, 5 and 6 */
-        if (pers && pers->level >= 4 && pers->level <= 6)
+        if (!bi_mddev) /* nothing to do */
                 return;
-
-        /* If rdev is integrity capable, register profile for mddev */
-        if (!bi_mddev && bi_rdev) {
-                if (blk_integrity_register(disk, bi_rdev))
-                        printk(KERN_ERR "%s: %s Could not register integrity!\n",
-                               __func__, disk->disk_name);
-                else
-                        printk(KERN_NOTICE "Enabling data integrity on %s\n",
-                               disk->disk_name);
+        if (rdev->raid_disk < 0) /* skip spares */
                 return;
-        }
-
-        /* Check that mddev and rdev have matching profiles */
-        if (blk_integrity_compare(disk, rdev->bdev->bd_disk) < 0) {
-                printk(KERN_ERR "%s: %s/%s integrity mismatch!\n", __func__,
-                       disk->disk_name, rdev->bdev->bd_disk->disk_name);
-                printk(KERN_NOTICE "Disabling data integrity on %s\n",
-                       disk->disk_name);
-                blk_integrity_unregister(disk);
-        }
+        if (bi_rdev && blk_integrity_compare(mddev->gendisk,
+                                             rdev->bdev->bd_disk) >= 0)
+                return;
+        printk(KERN_NOTICE "disabling data integrity on %s\n", mdname(mddev));
+        blk_integrity_unregister(mddev->gendisk);
 }
+EXPORT_SYMBOL(md_integrity_add_rdev);
 
 static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
 {
@@ -1591,7 +1641,6 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
         /* May as well allow recovery to be retried once */
         mddev->recovery_disabled = 0;
 
-        md_integrity_check(rdev, mddev);
         return 0;
 
  fail:
@@ -2657,6 +2706,7 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         ssize_t rv = len;
         struct mdk_personality *pers;
         void *priv;
+        mdk_rdev_t *rdev;
 
         if (mddev->pers == NULL) {
                 if (len == 0)
@@ -2736,6 +2786,12 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         mddev_suspend(mddev);
         mddev->pers->stop(mddev);
         module_put(mddev->pers->owner);
+        /* Invalidate devices that are now superfluous */
+        list_for_each_entry(rdev, &mddev->disks, same_set)
+                if (rdev->raid_disk >= mddev->raid_disks) {
+                        rdev->raid_disk = -1;
+                        clear_bit(In_sync, &rdev->flags);
+                }
         mddev->pers = pers;
         mddev->private = priv;
         strlcpy(mddev->clevel, pers->name, sizeof(mddev->clevel));
@@ -3685,17 +3741,8 @@ array_size_store(mddev_t *mddev, const char *buf, size_t len)
 
         mddev->array_sectors = sectors;
         set_capacity(mddev->gendisk, mddev->array_sectors);
-        if (mddev->pers) {
-                struct block_device *bdev = bdget_disk(mddev->gendisk, 0);
-
-                if (bdev) {
-                        mutex_lock(&bdev->bd_inode->i_mutex);
-                        i_size_write(bdev->bd_inode,
-                                     (loff_t)mddev->array_sectors << 9);
-                        mutex_unlock(&bdev->bd_inode->i_mutex);
-                        bdput(bdev);
-                }
-        }
+        if (mddev->pers)
+                revalidate_disk(mddev->gendisk);
 
         return len;
 }
@@ -4048,10 +4095,6 @@ static int do_md_run(mddev_t * mddev)
         }
         strlcpy(mddev->clevel, pers->name, sizeof(mddev->clevel));
 
-        if (pers->level >= 4 && pers->level <= 6)
-                /* Cannot support integrity (yet) */
-                blk_integrity_unregister(mddev->gendisk);
-
         if (mddev->reshape_position != MaxSector &&
             pers->start_reshape == NULL) {
                 /* This personality cannot handle reshaping... */
@@ -4189,6 +4232,7 @@ static int do_md_run(mddev_t * mddev)
         md_wakeup_thread(mddev->thread);
         md_wakeup_thread(mddev->sync_thread); /* possibly kick off a reshape */
 
+        revalidate_disk(mddev->gendisk);
         mddev->changed = 1;
         md_new_event(mddev);
         sysfs_notify_dirent(mddev->sysfs_state);
@@ -5087,18 +5131,8 @@ static int update_size(mddev_t *mddev, sector_t num_sectors)
                         return -ENOSPC;
         }
         rv = mddev->pers->resize(mddev, num_sectors);
-        if (!rv) {
-                struct block_device *bdev;
-
-                bdev = bdget_disk(mddev->gendisk, 0);
-                if (bdev) {
-                        mutex_lock(&bdev->bd_inode->i_mutex);
-                        i_size_write(bdev->bd_inode,
-                                     (loff_t)mddev->array_sectors << 9);
-                        mutex_unlock(&bdev->bd_inode->i_mutex);
-                        bdput(bdev);
-                }
-        }
+        if (!rv)
+                revalidate_disk(mddev->gendisk);
         return rv;
 }
 
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 9430a110db93..78f03168baf9 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -431,5 +431,7 @@ extern int md_allow_write(mddev_t *mddev);
 extern void md_wait_for_blocked_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern void md_set_array_sectors(mddev_t *mddev, sector_t array_sectors);
 extern int md_check_no_bitmap(mddev_t *mddev);
+extern int md_integrity_register(mddev_t *mddev);
+void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 
 #endif /* _MD_MD_H */
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 237fe3fd235c..7140909f6662 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -313,6 +313,7 @@ static int multipath_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
                         set_bit(In_sync, &rdev->flags);
                         rcu_assign_pointer(p->rdev, rdev);
                         err = 0;
+                        md_integrity_add_rdev(rdev, mddev);
                         break;
                 }
 
@@ -345,7 +346,9 @@ static int multipath_remove_disk(mddev_t *mddev, int number)
                         /* lost the race, try later */
                         err = -EBUSY;
                         p->rdev = rdev;
+                        goto abort;
                 }
+                md_integrity_register(mddev);
         }
 abort:
 
@@ -519,7 +522,7 @@ static int multipath_run (mddev_t *mddev)
         mddev->queue->unplug_fn = multipath_unplug;
         mddev->queue->backing_dev_info.congested_fn = multipath_congested;
         mddev->queue->backing_dev_info.congested_data = mddev;
-
+        md_integrity_register(mddev);
         return 0;
 
 out_free_conf:
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 335f490dcad6..898e2bdfee47 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -351,6 +351,7 @@ static int raid0_run(mddev_t *mddev)
 
         blk_queue_merge_bvec(mddev->queue, raid0_mergeable_bvec);
         dump_zones(mddev);
+        md_integrity_register(mddev);
         return 0;
 }
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 0569efba0c02..8726fd7ebce5 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1144,7 +1144,7 @@ static int raid1_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
                         rcu_assign_pointer(p->rdev, rdev);
                         break;
                 }
-
+        md_integrity_add_rdev(rdev, mddev);
         print_conf(conf);
         return err;
 }
@@ -1178,7 +1178,9 @@ static int raid1_remove_disk(mddev_t *mddev, int number)
                         /* lost the race, try later */
                         err = -EBUSY;
                         p->rdev = rdev;
+                        goto abort;
                 }
+                md_integrity_register(mddev);
         }
 abort:
 
@@ -2067,7 +2069,7 @@ static int run(mddev_t *mddev)
         mddev->queue->unplug_fn = raid1_unplug;
         mddev->queue->backing_dev_info.congested_fn = raid1_congested;
         mddev->queue->backing_dev_info.congested_data = mddev;
-
+        md_integrity_register(mddev);
         return 0;
 
 out_no_mem:
@@ -2132,6 +2134,7 @@ static int raid1_resize(mddev_t *mddev, sector_t sectors)
                 return -EINVAL;
         set_capacity(mddev->gendisk, mddev->array_sectors);
         mddev->changed = 1;
+        revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp == MaxSector) {
                 mddev->recovery_cp = mddev->dev_sectors;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 7298a5e5a183..3d9020cf6f6e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1170,6 +1170,7 @@ static int raid10_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
                         break;
                 }
 
+        md_integrity_add_rdev(rdev, mddev);
         print_conf(conf);
         return err;
 }
@@ -1203,7 +1204,9 @@ static int raid10_remove_disk(mddev_t *mddev, int number)
                         /* lost the race, try later */
                         err = -EBUSY;
                         p->rdev = rdev;
+                        goto abort;
                 }
+                md_integrity_register(mddev);
         }
 abort:
 
@@ -2225,6 +2228,7 @@ static int run(mddev_t *mddev)
 
         if (conf->near_copies < mddev->raid_disks)
                 blk_queue_merge_bvec(mddev->queue, raid10_mergeable_bvec);
+        md_integrity_register(mddev);
         return 0;
 
 out_free_conf:
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 37835538b58e..2b521ee67dfa 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3999,6 +3999,9 @@ static inline sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *ski
                 return 0;
         }
 
+        /* Allow raid5_quiesce to complete */
+        wait_event(conf->wait_for_overlap, conf->quiesce != 2);
+
         if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
                 return reshape_request(mddev, sector_nr, skipped);
 
@@ -4316,6 +4319,15 @@ raid5_size(mddev_t *mddev, sector_t sectors, int raid_disks)
         return sectors * (raid_disks - conf->max_degraded);
 }
 
+static void free_conf(raid5_conf_t *conf)
+{
+        shrink_stripes(conf);
+        safe_put_page(conf->spare_page);
+        kfree(conf->disks);
+        kfree(conf->stripe_hashtbl);
+        kfree(conf);
+}
+
 static raid5_conf_t *setup_conf(mddev_t *mddev)
 {
         raid5_conf_t *conf;
@@ -4447,11 +4459,7 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
 
  abort:
         if (conf) {
-                shrink_stripes(conf);
-                safe_put_page(conf->spare_page);
-                kfree(conf->disks);
-                kfree(conf->stripe_hashtbl);
-                kfree(conf);
+                free_conf(conf);
                 return ERR_PTR(-EIO);
         } else
                 return ERR_PTR(-ENOMEM);
@@ -4629,12 +4637,8 @@ abort:
         md_unregister_thread(mddev->thread);
         mddev->thread = NULL;
         if (conf) {
-                shrink_stripes(conf);
                 print_raid5_conf(conf);
-                safe_put_page(conf->spare_page);
-                kfree(conf->disks);
-                kfree(conf->stripe_hashtbl);
-                kfree(conf);
+                free_conf(conf);
         }
         mddev->private = NULL;
         printk(KERN_ALERT "raid5: failed to run raid set %s\n", mdname(mddev));
@@ -4649,13 +4653,10 @@ static int stop(mddev_t *mddev)
 
         md_unregister_thread(mddev->thread);
         mddev->thread = NULL;
-        shrink_stripes(conf);
-        kfree(conf->stripe_hashtbl);
         mddev->queue->backing_dev_info.congested_fn = NULL;
         blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
         sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
-        kfree(conf->disks);
-        kfree(conf);
+        free_conf(conf);
         mddev->private = NULL;
         return 0;
 }
@@ -4857,6 +4858,7 @@ static int raid5_resize(mddev_t *mddev, sector_t sectors)
                 return -EINVAL;
         set_capacity(mddev->gendisk, mddev->array_sectors);
         mddev->changed = 1;
+        revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors && mddev->recovery_cp == MaxSector) {
                 mddev->recovery_cp = mddev->dev_sectors;
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
@@ -5002,7 +5004,7 @@ static int raid5_start_reshape(mddev_t *mddev)
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
         mddev->raid_disks = conf->raid_disks;
-        mddev->reshape_position = 0;
+        mddev->reshape_position = conf->reshape_progress;
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
 
         clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
@@ -5057,7 +5059,6 @@ static void end_reshape(raid5_conf_t *conf)
  */
 static void raid5_finish_reshape(mddev_t *mddev)
 {
-        struct block_device *bdev;
         raid5_conf_t *conf = mddev->private;
 
         if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
@@ -5066,15 +5067,7 @@ static void raid5_finish_reshape(mddev_t *mddev)
                         md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
                         set_capacity(mddev->gendisk, mddev->array_sectors);
                         mddev->changed = 1;
-
-                        bdev = bdget_disk(mddev->gendisk, 0);
-                        if (bdev) {
-                                mutex_lock(&bdev->bd_inode->i_mutex);
-                                i_size_write(bdev->bd_inode,
-                                             (loff_t)mddev->array_sectors << 9);
-                                mutex_unlock(&bdev->bd_inode->i_mutex);
-                                bdput(bdev);
-                        }
+                        revalidate_disk(mddev->gendisk);
                 } else {
                         int d;
                         mddev->degraded = conf->raid_disks;
@@ -5106,12 +5099,18 @@ static void raid5_quiesce(mddev_t *mddev, int state)
 
         case 1: /* stop all writes */
                 spin_lock_irq(&conf->device_lock);
-                conf->quiesce = 1;
+                /* '2' tells resync/reshape to pause so that all
+                 * active stripes can drain
+                 */
+                conf->quiesce = 2;
                 wait_event_lock_irq(conf->wait_for_stripe,
                                     atomic_read(&conf->active_stripes) == 0 &&
                                     atomic_read(&conf->active_aligned_reads) == 0,
                                     conf->device_lock, /* nothing */);
+                conf->quiesce = 1;
                 spin_unlock_irq(&conf->device_lock);
+                /* allow reshape to continue */
+                wake_up(&conf->wait_for_overlap);
                 break;
 
         case 0: /* re-enable writes */
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index b711fb7181e2..1898c7b47907 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -100,16 +100,16 @@ int pci_claim_resource(struct pci_dev *dev, int resource)
 {
         struct resource *res = &dev->resource[resource];
         struct resource *root;
-        char *dtype = resource < PCI_BRIDGE_RESOURCES ? "device" : "bridge";
         int err;
 
         root = pci_find_parent_resource(dev, res);
 
         err = -EINVAL;
         if (root != NULL)
-                err = insert_resource(root, res);
+                err = request_resource(root, res);
 
         if (err) {
+                const char *dtype = resource < PCI_BRIDGE_RESOURCES ? "device" : "bridge";
                 dev_err(&dev->dev, "BAR %d: %s of %s %pR\n",
                         resource,
                         root ? "address space collision on" :
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 46dad12f952f..77c6097ced80 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -277,31 +277,6 @@ config THINKPAD_ACPI_UNSAFE_LEDS
           Say N here, unless you are building a kernel for your own
           use, and need to control the important firmware LEDs.
 
-config THINKPAD_ACPI_DOCK
-        bool "Legacy Docking Station Support"
-        depends on THINKPAD_ACPI
-        depends on ACPI_DOCK=n
-        default n
-        ---help---
-          Allows the thinkpad_acpi driver to handle docking station events.
-          This support was made obsolete by the generic ACPI docking station
-          support (CONFIG_ACPI_DOCK).  It will allow locking and removing the
-          laptop from the docking station, but will not properly connect PCI
-          devices.
-
-          If you are not sure, say N here.
-
-config THINKPAD_ACPI_BAY
-        bool "Legacy Removable Bay Support"
-        depends on THINKPAD_ACPI
-        default y
-        ---help---
-          Allows the thinkpad_acpi driver to handle removable bays.  It will
-          electrically disable the device in the bay, and also generate
-          notifications when the bay lever is ejected or inserted.
-
-          If you are not sure, say Y here.
-
 config THINKPAD_ACPI_VIDEO
         bool "Video output control support"
         depends on THINKPAD_ACPI
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index ec560f16d720..222ffb892f22 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -143,6 +143,7 @@ struct eeepc_hotk {
         struct rfkill *bluetooth_rfkill;
         struct rfkill *wwan3g_rfkill;
         struct hotplug_slot *hotplug_slot;
+        struct work_struct hotplug_work;
 };
 
 /* The actual device the driver binds to */
@@ -660,7 +661,7 @@ static int eeepc_get_adapter_status(struct hotplug_slot *hotplug_slot,
         return 0;
 }
 
-static void eeepc_rfkill_hotplug(void)
+static void eeepc_hotplug_work(struct work_struct *work)
 {
         struct pci_dev *dev;
         struct pci_bus *bus = pci_find_bus(0, 1);
@@ -701,7 +702,7 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
         if (event != ACPI_NOTIFY_BUS_CHECK)
                 return;
 
-        eeepc_rfkill_hotplug();
+        schedule_work(&ehotk->hotplug_work);
 }
 
 static void eeepc_hotk_notify(struct acpi_device *device, u32 event)
@@ -892,7 +893,7 @@ static int eeepc_hotk_resume(struct acpi_device *device)
 
                 rfkill_set_sw_state(ehotk->wlan_rfkill, wlan != 1);
 
-                eeepc_rfkill_hotplug();
+                schedule_work(&ehotk->hotplug_work);
         }
 
         if (ehotk->bluetooth_rfkill)
@@ -1093,6 +1094,8 @@ static int eeepc_rfkill_init(struct device *dev)
 {
         int result = 0;
 
+        INIT_WORK(&ehotk->hotplug_work, eeepc_hotplug_work);
+
         eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
         eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
 
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index ca508564a181..a2ad53e15874 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -520,11 +520,13 @@ static int hp_wmi_resume_handler(struct platform_device *device)
          * the input layer will only actually pass it on if the state
          * changed.
          */
-
-        input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state());
-        input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-                            hp_wmi_tablet_state());
-        input_sync(hp_wmi_input_dev);
+        if (hp_wmi_input_dev) {
+                input_report_switch(hp_wmi_input_dev, SW_DOCK,
+                                    hp_wmi_dock_state());
+                input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+                                    hp_wmi_tablet_state());
+                input_sync(hp_wmi_input_dev);
+        }
 
         return 0;
 }
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index a463fd72c495..e85600852502 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -239,12 +239,6 @@ struct ibm_init_struct {
 };
 
 static struct {
-#ifdef CONFIG_THINKPAD_ACPI_BAY
-        u32 bay_status:1;
-        u32 bay_eject:1;
-        u32 bay_status2:1;
-        u32 bay_eject2:1;
-#endif
         u32 bluetooth:1;
         u32 hotkey:1;
         u32 hotkey_mask:1;
@@ -589,18 +583,6 @@ static int acpi_ec_write(int i, u8 v)
         return 1;
 }
 
-#if defined(CONFIG_THINKPAD_ACPI_DOCK) || defined(CONFIG_THINKPAD_ACPI_BAY)
-static int _sta(acpi_handle handle)
-{
-        int status;
-
-        if (!handle || !acpi_evalf(handle, &status, "_STA", "d"))
-                status = 0;
-
-        return status;
-}
-#endif
-
 static int issue_thinkpad_cmos_command(int cmos_cmd)
 {
         if (!cmos_handle)
@@ -784,6 +766,8 @@ static int dispatch_procfs_write(struct file *file,
 
         if (!ibm || !ibm->write)
                 return -EINVAL;
+        if (count > PAGE_SIZE - 2)
+                return -EINVAL;
 
         kernbuf = kmalloc(count + 2, GFP_KERNEL);
         if (!kernbuf)
@@ -4442,293 +4426,6 @@ static struct ibm_struct light_driver_data = {
 };
 
 /*************************************************************************
- * Dock subdriver
- */
-
-#ifdef CONFIG_THINKPAD_ACPI_DOCK
-
-static void dock_notify(struct ibm_struct *ibm, u32 event);
-static int dock_read(char *p);
-static int dock_write(char *buf);
-
-TPACPI_HANDLE(dock, root, "\\_SB.GDCK", /* X30, X31, X40 */
-           "\\_SB.PCI0.DOCK",   /* 600e/x,770e,770x,A2xm/p,T20-22,X20-21 */
-           "\\_SB.PCI0.PCI1.DOCK",      /* all others */
-           "\\_SB.PCI.ISA.SLCE",        /* 570 */
-    );                          /* A21e,G4x,R30,R31,R32,R40,R40e,R50e */
-
-/* don't list other alternatives as we install a notify handler on the 570 */
-TPACPI_HANDLE(pci, root, "\\_SB.PCI");  /* 570 */
-
-static const struct acpi_device_id ibm_pci_device_ids[] = {
-        {PCI_ROOT_HID_STRING, 0},
-        {"", 0},
-};
-
-static struct tp_acpi_drv_struct ibm_dock_acpidriver[2] = {
-        {
-         .notify = dock_notify,
-         .handle = &dock_handle,
-         .type = ACPI_SYSTEM_NOTIFY,
-        },
-        {
-        /* THIS ONE MUST NEVER BE USED FOR DRIVER AUTOLOADING.
-         * We just use it to get notifications of dock hotplug
-         * in very old thinkpads */
-         .hid = ibm_pci_device_ids,
-         .notify = dock_notify,
-         .handle = &pci_handle,
-         .type = ACPI_SYSTEM_NOTIFY,
-        },
-};
-
-static struct ibm_struct dock_driver_data[2] = {
-        {
-         .name = "dock",
-         .read = dock_read,
-         .write = dock_write,
-         .acpi = &ibm_dock_acpidriver[0],
-        },
-        {
-         .name = "dock",
-         .acpi = &ibm_dock_acpidriver[1],
-        },
-};
-
-#define dock_docked() (_sta(dock_handle) & 1)
-
-static int __init dock_init(struct ibm_init_struct *iibm)
-{
-        vdbg_printk(TPACPI_DBG_INIT, "initializing dock subdriver\n");
-
-        TPACPI_ACPIHANDLE_INIT(dock);
-
-        vdbg_printk(TPACPI_DBG_INIT, "dock is %s\n",
-                str_supported(dock_handle != NULL));
-
-        return (dock_handle)? 0 : 1;
-}
-
-static int __init dock_init2(struct ibm_init_struct *iibm)
-{
-        int dock2_needed;
-
-        vdbg_printk(TPACPI_DBG_INIT, "initializing dock subdriver part 2\n");
-
-        if (dock_driver_data[0].flags.acpi_driver_registered &&
-            dock_driver_data[0].flags.acpi_notify_installed) {
-                TPACPI_ACPIHANDLE_INIT(pci);
-                dock2_needed = (pci_handle != NULL);
-                vdbg_printk(TPACPI_DBG_INIT,
-                            "dock PCI handler for the TP 570 is %s\n",
-                            str_supported(dock2_needed));
-        } else {
-                vdbg_printk(TPACPI_DBG_INIT,
-                "dock subdriver part 2 not required\n");
-                dock2_needed = 0;
-        }
-
-        return (dock2_needed)? 0 : 1;
-}
-
-static void dock_notify(struct ibm_struct *ibm, u32 event)
-{
-        int docked = dock_docked();
-        int pci = ibm->acpi->hid && ibm->acpi->device &&
-                acpi_match_device_ids(ibm->acpi->device, ibm_pci_device_ids);
-        int data;
-
-        if (event == 1 && !pci) /* 570 */
-                data = 1;       /* button */
-        else if (event == 1 && pci)     /* 570 */
-                data = 3;       /* dock */
-        else if (event == 3 && docked)
-                data = 1;       /* button */
-        else if (event == 3 && !docked)
-                data = 2;       /* undock */
-        else if (event == 0 && docked)
-                data = 3;       /* dock */
-        else {
-                printk(TPACPI_ERR "unknown dock event %d, status %d\n",
-                       event, _sta(dock_handle));
-                data = 0;       /* unknown */
-        }
-        acpi_bus_generate_proc_event(ibm->acpi->device, event, data);
-        acpi_bus_generate_netlink_event(ibm->acpi->device->pnp.device_class,
-                                          dev_name(&ibm->acpi->device->dev),
-                                          event, data);
-}
-
-static int dock_read(char *p)
-{
-        int len = 0;
-        int docked = dock_docked();
-
-        if (!dock_handle)
-                len += sprintf(p + len, "status:\t\tnot supported\n");
-        else if (!docked)
-                len += sprintf(p + len, "status:\t\tundocked\n");
-        else {
-                len += sprintf(p + len, "status:\t\tdocked\n");
-                len += sprintf(p + len, "commands:\tdock, undock\n");
-        }
-
-        return len;
-}
-
-static int dock_write(char *buf)
-{
-        char *cmd;
-
-        if (!dock_docked())
-                return -ENODEV;
-
-        while ((cmd = next_cmd(&buf))) {
-                if (strlencmp(cmd, "undock") == 0) {
-                        if (!acpi_evalf(dock_handle, NULL, "_DCK", "vd", 0) ||
-                            !acpi_evalf(dock_handle, NULL, "_EJ0", "vd", 1))
-                                return -EIO;
-                } else if (strlencmp(cmd, "dock") == 0) {
-                        if (!acpi_evalf(dock_handle, NULL, "_DCK", "vd", 1))
-                                return -EIO;
-                } else
-                        return -EINVAL;
-        }
-
-        return 0;
-}
-
-#endif /* CONFIG_THINKPAD_ACPI_DOCK */
-
-/*************************************************************************
- * Bay subdriver
- */
-
-#ifdef CONFIG_THINKPAD_ACPI_BAY
-
-TPACPI_HANDLE(bay, root, "\\_SB.PCI.IDE.SECN.MAST",     /* 570 */
-           "\\_SB.PCI0.IDE0.IDES.IDSM", /* 600e/x, 770e, 770x */
-           "\\_SB.PCI0.SATA.SCND.MSTR", /* T60, X60, Z60 */
-           "\\_SB.PCI0.IDE0.SCND.MSTR", /* all others */
-           );                           /* A21e, R30, R31 */
-TPACPI_HANDLE(bay_ej, bay, "_EJ3",      /* 600e/x, A2xm/p, A3x */
-           "_EJ0",              /* all others */
-           );                   /* 570,A21e,G4x,R30,R31,R32,R40e,R50e */
-TPACPI_HANDLE(bay2, root, "\\_SB.PCI0.IDE0.PRIM.SLAV",  /* A3x, R32 */
-           "\\_SB.PCI0.IDE0.IDEP.IDPS", /* 600e/x, 770e, 770x */
-           );                           /* all others */
-TPACPI_HANDLE(bay2_ej, bay2, "_EJ3",    /* 600e/x, 770e, A3x */
-           "_EJ0",                      /* 770x */
-           );                           /* all others */
-
-static int __init bay_init(struct ibm_init_struct *iibm)
-{
-        vdbg_printk(TPACPI_DBG_INIT, "initializing bay subdriver\n");
-
-        TPACPI_ACPIHANDLE_INIT(bay);
-        if (bay_handle)
-                TPACPI_ACPIHANDLE_INIT(bay_ej);
-        TPACPI_ACPIHANDLE_INIT(bay2);
-        if (bay2_handle)
-                TPACPI_ACPIHANDLE_INIT(bay2_ej);
-
-        tp_features.bay_status = bay_handle &&
-                acpi_evalf(bay_handle, NULL, "_STA", "qv");
-        tp_features.bay_status2 = bay2_handle &&
-                acpi_evalf(bay2_handle, NULL, "_STA", "qv");
-
-        tp_features.bay_eject = bay_handle && bay_ej_handle &&
-                (strlencmp(bay_ej_path, "_EJ0") == 0 || experimental);
-        tp_features.bay_eject2 = bay2_handle && bay2_ej_handle &&
-                (strlencmp(bay2_ej_path, "_EJ0") == 0 || experimental);
-
-        vdbg_printk(TPACPI_DBG_INIT,
-                "bay 1: status %s, eject %s; bay 2: status %s, eject %s\n",
-                str_supported(tp_features.bay_status),
-                str_supported(tp_features.bay_eject),
-                str_supported(tp_features.bay_status2),
-                str_supported(tp_features.bay_eject2));
-
-        return (tp_features.bay_status || tp_features.bay_eject ||
-                tp_features.bay_status2 || tp_features.bay_eject2)? 0 : 1;
-}
-
-static void bay_notify(struct ibm_struct *ibm, u32 event)
-{
-        acpi_bus_generate_proc_event(ibm->acpi->device, event, 0);
-        acpi_bus_generate_netlink_event(ibm->acpi->device->pnp.device_class,
-                                          dev_name(&ibm->acpi->device->dev),
-                                          event, 0);
-}
-
-#define bay_occupied(b) (_sta(b##_handle) & 1)
-
-static int bay_read(char *p)
-{
-        int len = 0;
-        int occupied = bay_occupied(bay);
-        int occupied2 = bay_occupied(bay2);
-        int eject, eject2;
-
-        len += sprintf(p + len, "status:\t\t%s\n",
-                tp_features.bay_status ?
-                        (occupied ? "occupied" : "unoccupied") :
-                                "not supported");
-        if (tp_features.bay_status2)
-                len += sprintf(p + len, "status2:\t%s\n", occupied2 ?
-                               "occupied" : "unoccupied");
-
-        eject = tp_features.bay_eject && occupied;
-        eject2 = tp_features.bay_eject2 && occupied2;
-
-        if (eject && eject2)
-                len += sprintf(p + len, "commands:\teject, eject2\n");
-        else if (eject)
-                len += sprintf(p + len, "commands:\teject\n");
-        else if (eject2)
-                len += sprintf(p + len, "commands:\teject2\n");
-
-        return len;
-}
-
-static int bay_write(char *buf)
-{
-        char *cmd;
-
-        if (!tp_features.bay_eject && !tp_features.bay_eject2)
-                return -ENODEV;
-
-        while ((cmd = next_cmd(&buf))) {
-                if (tp_features.bay_eject && strlencmp(cmd, "eject") == 0) {
-                        if (!acpi_evalf(bay_ej_handle, NULL, NULL, "vd", 1))
-                                return -EIO;
-                } else if (tp_features.bay_eject2 &&
-                           strlencmp(cmd, "eject2") == 0) {
-                        if (!acpi_evalf(bay2_ej_handle, NULL, NULL, "vd", 1))
-                                return -EIO;
-                } else
-                        return -EINVAL;
-        }
-
-        return 0;
-}
-
-static struct tp_acpi_drv_struct ibm_bay_acpidriver = {
-        .notify = bay_notify,
-        .handle = &bay_handle,
-        .type = ACPI_SYSTEM_NOTIFY,
-};
-
-static struct ibm_struct bay_driver_data = {
-        .name = "bay",
-        .read = bay_read,
-        .write = bay_write,
-        .acpi = &ibm_bay_acpidriver,
-};
-
-#endif /* CONFIG_THINKPAD_ACPI_BAY */
-
-/*************************************************************************
  * CMOS subdriver
  */
 
@@ -5945,14 +5642,48 @@ static struct backlight_ops ibm_backlight_data = {
 
 /* --------------------------------------------------------------------- */
 
+/*
+ * These are only useful for models that have only one possibility
+ * of GPU.  If the BIOS model handles both ATI and Intel, don't use
+ * these quirks.
+ */
+#define TPACPI_BRGHT_Q_NOEC     0x0001  /* Must NOT use EC HBRV */
+#define TPACPI_BRGHT_Q_EC       0x0002  /* Should or must use EC HBRV */
+#define TPACPI_BRGHT_Q_ASK      0x8000  /* Ask for user report */
+
+static const struct tpacpi_quirk brightness_quirk_table[] __initconst = {
+        /* Models with ATI GPUs known to require ECNVRAM mode */
+        TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC),      /* T43/p ATI */
+
+        /* Models with ATI GPUs (waiting confirmation) */
+        TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+        TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+        TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+        TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+
+        /* Models with Intel Extreme Graphics 2 (waiting confirmation) */
+        TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+        TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+        TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+
+        /* Models with Intel GMA900 */
+        TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC),    /* T43, R52 */
+        TPACPI_Q_IBM('7', '4', TPACPI_BRGHT_Q_NOEC),    /* X41 */
+        TPACPI_Q_IBM('7', '5', TPACPI_BRGHT_Q_NOEC),    /* X41 Tablet */
+};
+
 static int __init brightness_init(struct ibm_init_struct *iibm)
 {
         int b;
+        unsigned long quirks;
 
         vdbg_printk(TPACPI_DBG_INIT, "initializing brightness subdriver\n");
 
         mutex_init(&brightness_mutex);
 
+        quirks = tpacpi_check_quirks(brightness_quirk_table,
+                                ARRAY_SIZE(brightness_quirk_table));
+
         /*
          * We always attempt to detect acpi support, so as to switch
          * Lenovo Vista BIOS to ACPI brightness mode even if we are not
@@ -6009,23 +5740,13 @@ static int __init brightness_init(struct ibm_init_struct *iibm)
         /* TPACPI_BRGHT_MODE_AUTO not implemented yet, just use default */
         if (brightness_mode == TPACPI_BRGHT_MODE_AUTO ||
             brightness_mode == TPACPI_BRGHT_MODE_MAX) {
-                if (thinkpad_id.vendor == PCI_VENDOR_ID_IBM) {
-                        /*
-                         * IBM models that define HBRV probably have
-                         * EC-based backlight level control
-                         */
-                        if (acpi_evalf(ec_handle, NULL, "HBRV", "qd"))
-                                /* T40-T43, R50-R52, R50e, R51e, X31-X41 */
-                                brightness_mode = TPACPI_BRGHT_MODE_ECNVRAM;
-                        else
-                                /* all other IBM ThinkPads */
-                                brightness_mode = TPACPI_BRGHT_MODE_UCMS_STEP;
-                } else
-                        /* All Lenovo ThinkPads */
+                if (quirks & TPACPI_BRGHT_Q_EC)
+                        brightness_mode = TPACPI_BRGHT_MODE_ECNVRAM;
+                else
                         brightness_mode = TPACPI_BRGHT_MODE_UCMS_STEP;
 
                 dbg_printk(TPACPI_DBG_BRGHT,
-                           "selected brightness_mode=%d\n",
+                           "driver auto-selected brightness_mode=%d\n",
                            brightness_mode);
         }
 
@@ -6052,6 +5773,15 @@ static int __init brightness_init(struct ibm_init_struct *iibm)
         vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_BRGHT,
                         "brightness is supported\n");
 
+        if (quirks & TPACPI_BRGHT_Q_ASK) {
+                printk(TPACPI_NOTICE
+                        "brightness: will use unverified default: "
+                        "brightness_mode=%d\n", brightness_mode);
+                printk(TPACPI_NOTICE
+                        "brightness: please report to %s whether it works well "
+                        "or not on your ThinkPad\n", TPACPI_MAIL);
+        }
+
         ibm_backlight_device->props.max_brightness =
                                 (tp_features.bright_16levels)? 15 : 7;
         ibm_backlight_device->props.brightness = b & TP_EC_BACKLIGHT_LVLMSK;
@@ -7854,22 +7584,6 @@ static struct ibm_init_struct ibms_init[] __initdata = {
                 .init = light_init,
                 .data = &light_driver_data,
         },
-#ifdef CONFIG_THINKPAD_ACPI_DOCK
-        {
-                .init = dock_init,
-                .data = &dock_driver_data[0],
-        },
-        {
-                .init = dock_init2,
-                .data = &dock_driver_data[1],
-        },
-#endif
-#ifdef CONFIG_THINKPAD_ACPI_BAY
-        {
-                .init = bay_init,
-                .data = &bay_driver_data,
-        },
-#endif
         {
                 .init = cmos_init,
                 .data = &cmos_driver_data,
@@ -7968,12 +7682,6 @@ TPACPI_PARAM(hotkey);
 TPACPI_PARAM(bluetooth);
 TPACPI_PARAM(video);
 TPACPI_PARAM(light);
-#ifdef CONFIG_THINKPAD_ACPI_DOCK
-TPACPI_PARAM(dock);
-#endif
-#ifdef CONFIG_THINKPAD_ACPI_BAY
-TPACPI_PARAM(bay);
-#endif /* CONFIG_THINKPAD_ACPI_BAY */
 TPACPI_PARAM(cmos);
 TPACPI_PARAM(led);
 TPACPI_PARAM(beep);
diff --git a/drivers/watchdog/coh901327_wdt.c b/drivers/watchdog/coh901327_wdt.c
index fecb307d28e9..aec7cefdef21 100644
--- a/drivers/watchdog/coh901327_wdt.c
+++ b/drivers/watchdog/coh901327_wdt.c
@@ -18,6 +18,7 @@
 #include <linux/bitops.h>
 #include <linux/uaccess.h>
 #include <linux/clk.h>
+#include <linux/delay.h>
 
 #define DRV_NAME "WDOG COH 901 327"
 
@@ -92,6 +93,8 @@ static struct clk *clk;
 static void coh901327_enable(u16 timeout)
 {
         u16 val;
+        unsigned long freq;
+        unsigned long delay_ns;
 
         clk_enable(clk);
         /* Restart timer if it is disabled */
@@ -102,6 +105,14 @@ static void coh901327_enable(u16 timeout)
         /* Acknowledge any pending interrupt so it doesn't just fire off */
         writew(U300_WDOG_IER_WILL_BARK_IRQ_ACK_ENABLE,
                virtbase + U300_WDOG_IER);
+        /*
+         * The interrupt is cleared in the 32 kHz clock domain.
+         * Wait 3 32 kHz cycles for it to take effect
+         */
+        freq = clk_get_rate(clk);
+        delay_ns = (1000000000 + freq - 1) / freq; /* Freq to ns and round up */
+        delay_ns = 3 * delay_ns; /* Wait 3 cycles */
+        ndelay(delay_ns);
         /* Enable the watchdog interrupt */
         writew(U300_WDOG_IMR_WILL_BARK_IRQ_ENABLE, virtbase + U300_WDOG_IMR);
         /* Activate the watchdog timer */
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 92888aa90749..e85b1e4389e0 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,10 @@
+Version 1.60
+-------------
+Fix memory leak in reconnect.  Fix oops in DFS mount error path.
+Set s_maxbytes to smaller (the max that vfs can handle) so that
+sendfile will now work over cifs mounts again.  Add noforcegid
+and noforceuid mount parameters.
+
 Version 1.59
 ------------
 Client uses server inode numbers (which are persistent) rather than
diff --git a/fs/cifs/README b/fs/cifs/README
index ad92921dbde4..79c1a93400be 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -262,11 +262,11 @@ A partial list of the supported mount options follows:
                 mount.  
   domain        Set the SMB/CIFS workgroup name prepended to the
                 username during CIFS session establishment
-  forceuid      Set the default uid for inodes based on the uid
-                passed in. For mounts to servers
+  forceuid      Set the default uid for inodes to the uid
+                passed in on mount. For mounts to servers
                 which do support the CIFS Unix extensions, such as a
                 properly configured Samba server, the server provides
-                the uid, gid and mode so this parameter should  not be
+                the uid, gid and mode so this parameter should not be
                 specified unless the server and clients uid and gid
                 numbering differ.  If the server and client are in the
                 same domain (e.g. running winbind or nss_ldap) and
@@ -278,11 +278,7 @@ A partial list of the supported mount options follows:
                 of existing files will be the uid (gid) of the person
                 who executed the mount (root, except when mount.cifs
                 is configured setuid for user mounts) unless the "uid=" 
-                (gid) mount option is specified.  For the uid (gid) of newly
-                created files and directories, ie files created since 
-                the last mount of the server share, the expected uid 
-                (gid) is cached as long as the inode remains in 
-                memory on the client.   Also note that permission
+                (gid) mount option is specified. Also note that permission
                 checks (authorization checks) on accesses to a file occur
                 at the server, but there are cases in which an administrator
                 may want to restrict at the client as well.  For those
@@ -290,12 +286,15 @@ A partial list of the supported mount options follows:
                 (such as Windows), permissions can also be checked at the
                 client, and a crude form of client side permission checking 
                 can be enabled by specifying file_mode and dir_mode on 
-                the client.  Note that the mount.cifs helper must be
-                at version 1.10 or higher to support specifying the uid
-                (or gid) in non-numeric form.
-  forcegid      (similar to above but for the groupid instead of uid)
+                the client.  (default)
+  forcegid      (similar to above but for the groupid instead of uid) (default)
+  noforceuid    Fill in file owner information (uid) by requesting it from
+                the server if possible. With this option, the value given in
+                the uid= option (on mount) will only be used if the server
+                can not support returning uids on inodes.
+  noforcegid    (similar to above but for the group owner, gid, instead of uid)
   uid           Set the default uid for inodes, and indicate to the
-                cifs kernel driver which local user mounted . If the server
+                cifs kernel driver which local user mounted. If the server
                 supports the unix extensions the default uid is
                 not used to fill in the owner fields of inodes (files)
                 unless the "forceuid" parameter is specified.
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 3bb11be8b6a8..606912d8f2a8 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -55,7 +55,7 @@ void cifs_dfs_release_automount_timer(void)
  * i.e. strips from UNC trailing path that is not part of share
  * name and fixup missing '\' in the begining of DFS node refferal
  * if neccessary.
- * Returns pointer to share name on success or NULL on error.
+ * Returns pointer to share name on success or ERR_PTR on error.
  * Caller is responsible for freeing returned string.
  */
 static char *cifs_get_share_name(const char *node_name)
@@ -68,7 +68,7 @@ static char *cifs_get_share_name(const char *node_name)
         UNC = kmalloc(len+2 /*for term null and additional \ if it's missed */,
                          GFP_KERNEL);
         if (!UNC)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         /* get share name and server name */
         if (node_name[1] != '\\') {
@@ -87,7 +87,7 @@ static char *cifs_get_share_name(const char *node_name)
                 cERROR(1, ("%s: no server name end in node name: %s",
                         __func__, node_name));
                 kfree(UNC);
-                return NULL;
+                return ERR_PTR(-EINVAL);
         }
 
         /* find sharename end */
@@ -133,6 +133,12 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
                 return ERR_PTR(-EINVAL);
 
         *devname = cifs_get_share_name(ref->node_name);
+        if (IS_ERR(*devname)) {
+                rc = PTR_ERR(*devname);
+                *devname = NULL;
+                goto compose_mount_options_err;
+        }
+
         rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
         if (rc != 0) {
                 cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d",
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 60e3c4253de0..714a542cbafc 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -44,7 +44,7 @@ cifs_ucs2_bytes(const __le16 *from, int maxbytes,
         int maxwords = maxbytes / 2;
         char tmp[NLS_MAX_CHARSET_SIZE];
 
-        for (i = 0; from[i] && i < maxwords; i++) {
+        for (i = 0; i < maxwords && from[i]; i++) {
                 charlen = codepage->uni2char(le16_to_cpu(from[i]), tmp,
                                              NLS_MAX_CHARSET_SIZE);
                 if (charlen > 0)
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 44f30504b82d..84b75253b05a 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -376,10 +376,14 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
         seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID)
                 seq_printf(s, ",forceuid");
+        else
+                seq_printf(s, ",noforceuid");
 
         seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)
                 seq_printf(s, ",forcegid");
+        else
+                seq_printf(s, ",noforcegid");
 
         cifs_show_address(s, tcon->ses->server);
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index fc44d316d0bb..1f3345d7fa79 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -803,6 +803,10 @@ cifs_parse_mount_options(char *options, const char *devname,
         char *data;
         unsigned int  temp_len, i, j;
         char separator[2];
+        short int override_uid = -1;
+        short int override_gid = -1;
+        bool uid_specified = false;
+        bool gid_specified = false;
 
         separator[0] = ',';
         separator[1] = 0;
@@ -1093,18 +1097,20 @@ cifs_parse_mount_options(char *options, const char *devname,
                                                     "too long.\n");
                                 return 1;
                         }
-                } else if (strnicmp(data, "uid", 3) == 0) {
-                        if (value && *value)
-                                vol->linux_uid =
-                                        simple_strtoul(value, &value, 0);
-                } else if (strnicmp(data, "forceuid", 8) == 0) {
-                                vol->override_uid = 1;
-                } else if (strnicmp(data, "gid", 3) == 0) {
-                        if (value && *value)
-                                vol->linux_gid =
-                                        simple_strtoul(value, &value, 0);
-                } else if (strnicmp(data, "forcegid", 8) == 0) {
-                                vol->override_gid = 1;
+                } else if (!strnicmp(data, "uid", 3) && value && *value) {
+                        vol->linux_uid = simple_strtoul(value, &value, 0);
+                        uid_specified = true;
+                } else if (!strnicmp(data, "forceuid", 8)) {
+                        override_uid = 1;
+                } else if (!strnicmp(data, "noforceuid", 10)) {
+                        override_uid = 0;
+                } else if (!strnicmp(data, "gid", 3) && value && *value) {
+                        vol->linux_gid = simple_strtoul(value, &value, 0);
+                        gid_specified = true;
+                } else if (!strnicmp(data, "forcegid", 8)) {
+                        override_gid = 1;
+                } else if (!strnicmp(data, "noforcegid", 10)) {
+                        override_gid = 0;
                 } else if (strnicmp(data, "file_mode", 4) == 0) {
                         if (value && *value) {
                                 vol->file_mode =
@@ -1355,6 +1361,18 @@ cifs_parse_mount_options(char *options, const char *devname,
         if (vol->UNCip == NULL)
                 vol->UNCip = &vol->UNC[2];
 
+        if (uid_specified)
+                vol->override_uid = override_uid;
+        else if (override_uid == 1)
+                printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
+                                   "specified with no uid= option.\n");
+
+        if (gid_specified)
+                vol->override_gid = override_gid;
+        else if (override_gid == 1)
+                printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
+                                   "specified with no gid= option.\n");
+
         return 0;
 }
 
@@ -2544,11 +2562,20 @@ remote_path_check:
 
                         if (mount_data != mount_data_global)
                                 kfree(mount_data);
+
                         mount_data = cifs_compose_mount_options(
                                         cifs_sb->mountdata, full_path + 1,
                                         referrals, &fake_devname);
-                        kfree(fake_devname);
+
                         free_dfs_info_array(referrals, num_referrals);
+                        kfree(fake_devname);
+                        kfree(full_path);
+
+                        if (IS_ERR(mount_data)) {
+                                rc = PTR_ERR(mount_data);
+                                mount_data = NULL;
+                                goto mount_fail_check;
+                        }
 
                         if (tcon)
                                 cifs_put_tcon(tcon);
@@ -2556,8 +2583,6 @@ remote_path_check:
                                 cifs_put_smb_ses(pSesInfo);
 
                         cleanup_volume_info(&volume_info);
-                        FreeXid(xid);
-                        kfree(full_path);
                         referral_walks_count++;
                         goto try_mount_again;
                 }
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index 3e798593b17b..ab0b85cf21f3 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -242,6 +242,10 @@ acpi_os_derive_pci_id(acpi_handle rhandle,
 acpi_status acpi_os_validate_interface(char *interface);
 acpi_status acpi_osi_invalidate(char* interface);
 
+acpi_status
+acpi_os_validate_address(u8 space_id, acpi_physical_address address,
+                         acpi_size length, char *name);
+
 u64 acpi_os_get_timer(void);
 
 acpi_status acpi_os_signal(u32 function, void *info);
diff --git a/kernel/signal.c b/kernel/signal.c
index ccf1ceedaebe..64c5deeaca5d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2454,11 +2454,9 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
         stack_t oss;
         int error;
 
-        if (uoss) {
-                oss.ss_sp = (void __user *) current->sas_ss_sp;
-                oss.ss_size = current->sas_ss_size;
-                oss.ss_flags = sas_ss_flags(sp);
-        }
+        oss.ss_sp = (void __user *) current->sas_ss_sp;
+        oss.ss_size = current->sas_ss_size;
+        oss.ss_flags = sas_ss_flags(sp);
 
         if (uss) {
                 void __user *ss_sp;
@@ -2466,10 +2464,12 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
                 int ss_flags;
 
                 error = -EFAULT;
-                if (!access_ok(VERIFY_READ, uss, sizeof(*uss))
-                    || __get_user(ss_sp, &uss->ss_sp)
-                    || __get_user(ss_flags, &uss->ss_flags)
-                    || __get_user(ss_size, &uss->ss_size))
+                if (!access_ok(VERIFY_READ, uss, sizeof(*uss)))
+                        goto out;
+                error = __get_user(ss_sp, &uss->ss_sp) |
+                        __get_user(ss_flags, &uss->ss_flags) |
+                        __get_user(ss_size, &uss->ss_size);
+                if (error)
                         goto out;
 
                 error = -EPERM;
@@ -2501,13 +2501,16 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
                 current->sas_ss_size = ss_size;
         }
 
+        error = 0;
         if (uoss) {
                 error = -EFAULT;
-                if (copy_to_user(uoss, &oss, sizeof(oss)))
+                if (!access_ok(VERIFY_WRITE, uoss, sizeof(*uoss)))
                         goto out;
+                error = __put_user(oss.ss_sp, &uoss->ss_sp) |
+                        __put_user(oss.ss_size, &uoss->ss_size) |
+                        __put_user(oss.ss_flags, &uoss->ss_flags);
         }
 
-        error = 0;
 out:
         return error;
 }