269 files changed, 2261 insertions, 2850 deletions
diff --git a/Documentation/arm64/memory.txt b/Documentation/arm64/memory.txt
index dbbdcbba75a3..4110cca96bd6 100644
--- a/Documentation/arm64/memory.txt
+++ b/Documentation/arm64/memory.txt
@@ -27,17 +27,17 @@ Start			End			Size		Use
 -----------------------------------------------------------------------
 0000000000000000        0000007fffffffff         512GB          user
-ffffff8000000000        ffffffbbfffcffff        ~240GB          vmalloc
+ffffff8000000000        ffffffbbfffeffff        ~240GB          vmalloc
-ffffffbbfffd0000        ffffffbcfffdffff          64KB          [guard page]
+ffffffbbffff0000        ffffffbbffffffff          64KB          [guard page]
-ffffffbbfffe0000        ffffffbcfffeffff          64KB          PCI I/O space
+ffffffbc00000000        ffffffbdffffffff           8GB          vmemmap
-ffffffbbffff0000        ffffffbcffffffff          64KB          [guard page]
+ffffffbe00000000        ffffffbffbbfffff          ~8GB          [guard, future vmmemap]
-ffffffbc00000000        ffffffbdffffffff           8GB          vmemmap
+ffffffbffbe00000        ffffffbffbe0ffff          64KB          PCI I/O space
-ffffffbe00000000        ffffffbffbffffff          ~8GB          [guard, future vmmemap]
+ffffffbbffff0000        ffffffbcffffffff          ~2MB          [guard]
 ffffffbffc000000        ffffffbfffffffff          64MB          modules
diff --git a/Makefile b/Makefile
index a1ccf225c4e9..6edac73ee1ba 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Terrified Chipmunk
 # *DOCUMENTATION*
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 59bcb96ac369..f57609275449 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -166,3 +166,14 @@ void free_xenballooned_pages(int nr_pages, struct page **pages)
        *pages = NULL;
 }
 EXPORT_SYMBOL_GPL(free_xenballooned_pages);
+/* In the hypervisor.S file. */
+EXPORT_SYMBOL_GPL(HYPERVISOR_event_channel_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_grant_table_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_xen_version);
+EXPORT_SYMBOL_GPL(HYPERVISOR_console_io);
+EXPORT_SYMBOL_GPL(HYPERVISOR_sched_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_hvm_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_memory_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_physdev_op);
+EXPORT_SYMBOL_GPL(privcmd_call);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index ef54a59a9e89..20b688c81956 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1,11 +1,14 @@
 config ARM64
        def_bool y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        select GENERIC_CLOCKEVENTS
        select GENERIC_HARDIRQS_NO_DEPRECATED
        select GENERIC_IOMAP
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
+        select GENERIC_KERNEL_EXECVE
+        select GENERIC_KERNEL_THREAD
        select GENERIC_SMP_IDLE_THREAD
        select GENERIC_TIME_VSYSCALL
        select HARDIRQS_SW_RESEND
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index cf284649dfcb..07fea290d7c1 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -25,12 +25,10 @@
 #include <asm/user.h>
 typedef unsigned long elf_greg_t;
-typedef unsigned long elf_freg_t[3];
 #define ELF_NGREG (sizeof (struct pt_regs) / sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
+typedef struct user_fpsimd_state elf_fpregset_t;
-typedef struct user_fp elf_fpregset_t;
 #define EM_AARCH64              183
@@ -87,7 +85,6 @@ typedef struct user_fp elf_fpregset_t;
 #define R_AARCH64_MOVW_PREL_G2_NC       292
 #define R_AARCH64_MOVW_PREL_G3          293
 /*
 * These are used to set parameters in the core dumps.
 */
diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h
index b42fab9f62a9..c43b4ac13008 100644
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -25,9 +25,8 @@
 *  - FPSR and FPCR
 *  - 32 128-bit data registers
 *
- * Note that user_fp forms a prefix of this structure, which is relied
+ * Note that user_fpsimd forms a prefix of this structure, which is
- * upon in the ptrace FP/SIMD accessors. struct user_fpsimd_state must
+ * relied upon in the ptrace FP/SIMD accessors.
- * form a prefix of struct fpsimd_state.
 */
 struct fpsimd_state {
        union {
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 74a2a7d304a9..54f6116697f7 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -114,7 +114,7 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 *  I/O port access primitives.
 */
 #define IO_SPACE_LIMIT          0xffff
-#define PCI_IOBASE              ((void __iomem *)0xffffffbbfffe0000UL)
+#define PCI_IOBASE              ((void __iomem *)(MODULES_VADDR - SZ_2M))
 static inline u8 inb(unsigned long addr)
 {
@@ -225,9 +225,9 @@ extern void __iounmap(volatile void __iomem *addr);
 #define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_XN | PTE_ATTRINDX(MT_DEVICE_nGnRE))
 #define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL_NC))
-#define ioremap(addr, size)             __ioremap((addr), (size), PROT_DEVICE_nGnRE)
+#define ioremap(addr, size)             __ioremap((addr), (size), __pgprot(PROT_DEVICE_nGnRE))
-#define ioremap_nocache(addr, size)     __ioremap((addr), (size), PROT_DEVICE_nGnRE)
+#define ioremap_nocache(addr, size)     __ioremap((addr), (size), __pgprot(PROT_DEVICE_nGnRE))
-#define ioremap_wc(addr, size)          __ioremap((addr), (size), PROT_NORMAL_NC)
+#define ioremap_wc(addr, size)          __ioremap((addr), (size), __pgprot(PROT_NORMAL_NC))
 #define iounmap                         __iounmap
 #define ARCH_HAS_IOREMAP_WC
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 5d810044feda..ab239b2c456f 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -43,6 +43,8 @@
 #else
 #define STACK_TOP               STACK_TOP_MAX
 #endif /* CONFIG_COMPAT */
+#define ARCH_LOW_ADDRESS_LIMIT  PHYS_MASK
 #endif /* __KERNEL__ */
 struct debug_info {
@@ -126,11 +128,6 @@ unsigned long get_wchan(struct task_struct *p);
 extern struct task_struct *cpu_switch_to(struct task_struct *prev,
                                         struct task_struct *next);
-/*
- * Create a new kernel thread
- */
-extern int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
 #define task_pt_regs(p) \
        ((struct pt_regs *)(THREAD_START_SP + task_stack_page(p)) - 1)
diff --git a/arch/arm64/include/asm/syscalls.h b/arch/arm64/include/asm/syscalls.h
index 09ff33572aab..a1b00cd6f786 100644
--- a/arch/arm64/include/asm/syscalls.h
+++ b/arch/arm64/include/asm/syscalls.h
@@ -23,18 +23,16 @@
 /*
 * System call wrappers implemented in kernel/entry.S.
 */
-asmlinkage long sys_execve_wrapper(const char __user *filename,
-                                   const char __user *const __user *argv,
-                                   const char __user *const __user *envp);
-asmlinkage long sys_clone_wrapper(unsigned long clone_flags,
-                                  unsigned long newsp,
-                                  void __user *parent_tid,
-                                  unsigned long tls_val,
-                                  void __user *child_tid);
 asmlinkage long sys_rt_sigreturn_wrapper(void);
 asmlinkage long sys_sigaltstack_wrapper(const stack_t __user *uss,
                                        stack_t __user *uoss);
+/*
+ * AArch64 sys_clone implementation has a different prototype than the generic
+ * one (additional TLS value argument).
+ */
+#define sys_clone       sys_clone
 #include <asm-generic/syscalls.h>
 #endif  /* __ASM_SYSCALLS_H */
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index 63f853f8b718..43064a8bd99e 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -14,7 +14,6 @@
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #ifdef CONFIG_COMPAT
-#define __ARCH_WANT_COMPAT_IPC_PARSE_VERSION
 #define __ARCH_WANT_COMPAT_STAT64
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
@@ -26,4 +25,5 @@
 #define __ARCH_WANT_COMPAT_SYS_RT_SIGSUSPEND
 #define __ARCH_WANT_COMPAT_SYS_SENDFILE
 #endif
+#define __ARCH_WANT_SYS_EXECVE
 #include <uapi/asm/unistd.h>
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index 6d909faebf28..d9850cf9870d 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -23,7 +23,7 @@
 __SYSCALL(0,   sys_restart_syscall)
 __SYSCALL(1,   sys_exit)
-__SYSCALL(2,   compat_sys_fork_wrapper)
+__SYSCALL(2,   compat_sys_fork)
 __SYSCALL(3,   sys_read)
 __SYSCALL(4,   sys_write)
 __SYSCALL(5,   compat_sys_open)
@@ -32,7 +32,7 @@ __SYSCALL(7,   sys_ni_syscall)			/* 7 was sys_waitpid */
 __SYSCALL(8,   sys_creat)
 __SYSCALL(9,   sys_link)
 __SYSCALL(10,  sys_unlink)
-__SYSCALL(11,  compat_sys_execve_wrapper)
+__SYSCALL(11,  compat_sys_execve)
 __SYSCALL(12,  sys_chdir)
 __SYSCALL(13,  sys_ni_syscall)                  /* 13 was sys_time */
 __SYSCALL(14,  sys_mknod)
@@ -141,7 +141,7 @@ __SYSCALL(116, compat_sys_sysinfo)
 __SYSCALL(117, sys_ni_syscall)                  /* 117 was sys_ipc */
 __SYSCALL(118, sys_fsync)
 __SYSCALL(119, compat_sys_sigreturn_wrapper)
-__SYSCALL(120, compat_sys_clone_wrapper)
+__SYSCALL(120, sys_clone)
 __SYSCALL(121, sys_setdomainname)
 __SYSCALL(122, sys_newuname)
 __SYSCALL(123, sys_ni_syscall)                  /* 123 was sys_modify_ldt */
@@ -211,7 +211,7 @@ __SYSCALL(186, compat_sys_sigaltstack_wrapper)
 __SYSCALL(187, compat_sys_sendfile)
 __SYSCALL(188, sys_ni_syscall)                  /* 188 reserved */
 __SYSCALL(189, sys_ni_syscall)                  /* 189 reserved */
-__SYSCALL(190, compat_sys_vfork_wrapper)
+__SYSCALL(190, compat_sys_vfork)
 __SYSCALL(191, compat_sys_getrlimit)            /* SuS compliant getrlimit */
 __SYSCALL(192, sys_mmap_pgoff)
 __SYSCALL(193, compat_sys_truncate64_wrapper)
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index a6f3f7da6880..cbfa4d28100e 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -594,7 +594,7 @@ work_resched:
 /*
 * "slow" syscall return path.
 */
-ENTRY(ret_to_user)
+ret_to_user:
        disable_irq                             // disable interrupts
        ldr     x1, [tsk, #TI_FLAGS]
        and     x2, x1, #_TIF_WORK_MASK
@@ -611,7 +611,10 @@ ENDPROC(ret_to_user)
 */
 ENTRY(ret_from_fork)
        bl      schedule_tail
-        get_thread_info tsk
+        cbz     x19, 1f                         // not a kernel thread
+        mov     x0, x20
+        blr     x19
+1:      get_thread_info tsk
        b       ret_to_user
 ENDPROC(ret_from_fork)
@@ -673,16 +676,6 @@ __sys_trace_return:
 /*
 * Special system call wrappers.
 */
-ENTRY(sys_execve_wrapper)
-        mov     x3, sp
-        b       sys_execve
-ENDPROC(sys_execve_wrapper)
-ENTRY(sys_clone_wrapper)
-        mov     x5, sp
-        b       sys_clone
-ENDPROC(sys_clone_wrapper)
 ENTRY(sys_rt_sigreturn_wrapper)
        mov     x0, sp
        b       sys_rt_sigreturn
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index ecbf2d81ec5c..c76c7241125b 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -613,17 +613,11 @@ enum armv8_pmuv3_perf_types {
        ARMV8_PMUV3_PERFCTR_BUS_ACCESS                          = 0x19,
        ARMV8_PMUV3_PERFCTR_MEM_ERROR                           = 0x1A,
        ARMV8_PMUV3_PERFCTR_BUS_CYCLES                          = 0x1D,
-        /*
-         * This isn't an architected event.
-         * We detect this event number and use the cycle counter instead.
-         */
-        ARMV8_PMUV3_PERFCTR_CPU_CYCLES                          = 0xFF,
 };
 /* PMUv3 HW events mapping. */
 static const unsigned armv8_pmuv3_perf_map[PERF_COUNT_HW_MAX] = {
-        [PERF_COUNT_HW_CPU_CYCLES]              = ARMV8_PMUV3_PERFCTR_CPU_CYCLES,
+        [PERF_COUNT_HW_CPU_CYCLES]              = ARMV8_PMUV3_PERFCTR_CLOCK_CYCLES,
        [PERF_COUNT_HW_INSTRUCTIONS]            = ARMV8_PMUV3_PERFCTR_INSTR_EXECUTED,
        [PERF_COUNT_HW_CACHE_REFERENCES]        = ARMV8_PMUV3_PERFCTR_L1_DCACHE_ACCESS,
        [PERF_COUNT_HW_CACHE_MISSES]            = ARMV8_PMUV3_PERFCTR_L1_DCACHE_REFILL,
@@ -1106,7 +1100,7 @@ static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc,
        unsigned long evtype = event->config_base & ARMV8_EVTYPE_EVENT;
        /* Always place a cycle counter into the cycle counter. */
-        if (evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) {
+        if (evtype == ARMV8_PMUV3_PERFCTR_CLOCK_CYCLES) {
                if (test_and_set_bit(ARMV8_IDX_CYCLE_COUNTER, cpuc->used_mask))
                        return -EAGAIN;
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index f22965ea1cfc..8a5f3341861e 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -240,27 +240,41 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
        struct pt_regs *childregs = task_pt_regs(p);
        unsigned long tls = p->thread.tp_value;
-        *childregs = *regs;
+        memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
-        childregs->regs[0] = 0;
-        if (is_compat_thread(task_thread_info(p)))
+        if (likely(regs)) {
-                childregs->compat_sp = stack_start;
+                *childregs = *regs;
-        else {
+                childregs->regs[0] = 0;
+                if (is_compat_thread(task_thread_info(p))) {
+                        if (stack_start)
+                                childregs->compat_sp = stack_start;
+                } else {
+                        /*
+                         * Read the current TLS pointer from tpidr_el0 as it may be
+                         * out-of-sync with the saved value.
+                         */
+                        asm("mrs %0, tpidr_el0" : "=r" (tls));
+                        if (stack_start) {
+                                /* 16-byte aligned stack mandatory on AArch64 */
+                                if (stack_start & 15)
+                                        return -EINVAL;
+                                childregs->sp = stack_start;
+                        }
+                }
                /*
-                 * Read the current TLS pointer from tpidr_el0 as it may be
+                 * If a TLS pointer was passed to clone (4th argument), use it
-                 * out-of-sync with the saved value.
+                 * for the new thread.
                 */
-                asm("mrs %0, tpidr_el0" : "=r" (tls));
+                if (clone_flags & CLONE_SETTLS)
-                childregs->sp = stack_start;
+                        tls = regs->regs[3];
+        } else {
+                memset(childregs, 0, sizeof(struct pt_regs));
+                childregs->pstate = PSR_MODE_EL1h;
+                p->thread.cpu_context.x19 = stack_start;
+                p->thread.cpu_context.x20 = stk_sz;
        }
-        memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
-        p->thread.cpu_context.sp = (unsigned long)childregs;
        p->thread.cpu_context.pc = (unsigned long)ret_from_fork;
+        p->thread.cpu_context.sp = (unsigned long)childregs;
-        /* If a TLS pointer was passed to clone, use that for the new thread. */
-        if (clone_flags & CLONE_SETTLS)
-                tls = regs->regs[3];
        p->thread.tp_value = tls;
        ptrace_hw_copy_thread(p);
@@ -309,61 +323,6 @@ struct task_struct *__switch_to(struct task_struct *prev,
        return last;
 }
-/*
- * Fill in the task's elfregs structure for a core dump.
- */
-int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs)
-{
-        elf_core_copy_regs(elfregs, task_pt_regs(t));
-        return 1;
-}
-/*
- * fill in the fpe structure for a core dump...
- */
-int dump_fpu (struct pt_regs *regs, struct user_fp *fp)
-{
-        return 0;
-}
-EXPORT_SYMBOL(dump_fpu);
-/*
- * Shuffle the argument into the correct register before calling the
- * thread function.  x1 is the thread argument, x2 is the pointer to
- * the thread function, and x3 points to the exit function.
- */
-extern void kernel_thread_helper(void);
-asm(    ".section .text\n"
-"       .align\n"
-"       .type   kernel_thread_helper, #function\n"
-"kernel_thread_helper:\n"
-"       mov     x0, x1\n"
-"       mov     x30, x3\n"
-"       br      x2\n"
-"       .size   kernel_thread_helper, . - kernel_thread_helper\n"
-"       .previous");
-#define kernel_thread_exit      do_exit
-/*
- * Create a kernel thread.
- */
-pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        regs.regs[1] = (unsigned long)arg;
-        regs.regs[2] = (unsigned long)fn;
-        regs.regs[3] = (unsigned long)kernel_thread_exit;
-        regs.pc = (unsigned long)kernel_thread_helper;
-        regs.pstate = PSR_MODE_EL1h;
-        return do_fork(flags|CLONE_VM|CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);
-}
-EXPORT_SYMBOL(kernel_thread);
 unsigned long get_wchan(struct task_struct *p)
 {
        struct stackframe frame;
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 226b6bf6e9c2..538300f2273d 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -211,8 +211,7 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
         * before we continue.
         */
        set_cpu_online(cpu, true);
-        while (!cpu_active(cpu))
+        complete(&cpu_running);
-                cpu_relax();
        /*
         * OK, it's off to the idle thread for us
diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c
index b120df37de35..4364df85050e 100644
--- a/arch/arm64/kernel/sys.c
+++ b/arch/arm64/kernel/sys.c
@@ -31,79 +31,11 @@
 */
 asmlinkage long sys_clone(unsigned long clone_flags, unsigned long newsp,
                          int __user *parent_tidptr, unsigned long tls_val,
-                          int __user *child_tidptr, struct pt_regs *regs)
+                          int __user *child_tidptr)
 {
-        if (!newsp)
+        return do_fork(clone_flags, newsp, current_pt_regs(), 0,
-                newsp = regs->sp;
+                        parent_tidptr, child_tidptr);
-        /* 16-byte aligned stack mandatory on AArch64 */
-        if (newsp & 15)
-                return -EINVAL;
-        return do_fork(clone_flags, newsp, regs, 0, parent_tidptr, child_tidptr);
-}
-/*
- * sys_execve() executes a new program.
- */
-asmlinkage long sys_execve(const char __user *filenamei,
-                           const char __user *const __user *argv,
-                           const char __user *const __user *envp,
-                           struct pt_regs *regs)
-{
-        long error;
-        struct filename *filename;
-        filename = getname(filenamei);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name, argv, envp, regs);
-        putname(filename);
-out:
-        return error;
-}
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
-{
-        struct pt_regs regs;
-        int ret;
-        memset(&regs, 0, sizeof(struct pt_regs));
-        ret = do_execve(filename,
-                        (const char __user *const __user *)argv,
-                        (const char __user *const __user *)envp, &regs);
-        if (ret < 0)
-                goto out;
-        /*
-         * Save argc to the register structure for userspace.
-         */
-        regs.regs[0] = ret;
-        /*
-         * We were successful.  We won't be returning to our caller, but
-         * instead to user space by manipulating the kernel stack.
-         */
-        asm(    "add    x0, %0, %1\n\t"
-                "mov    x1, %2\n\t"
-                "mov    x2, %3\n\t"
-                "bl     memmove\n\t"    /* copy regs to top of stack */
-                "mov    x27, #0\n\t"    /* not a syscall */
-                "mov    x28, %0\n\t"    /* thread structure */
-                "mov    sp, x0\n\t"     /* reposition stack pointer */
-                "b      ret_to_user"
-                :
-                : "r" (current_thread_info()),
-                  "Ir" (THREAD_START_SP - sizeof(regs)),
-                  "r" (&regs),
-                  "Ir" (sizeof(regs))
-                : "x0", "x1", "x2", "x27", "x28", "x30", "memory");
- out:
-        return ret;
 }
-EXPORT_SYMBOL(kernel_execve);
 asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
                         unsigned long prot, unsigned long flags,
@@ -118,8 +50,6 @@ asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
 /*
 * Wrappers to pass the pt_regs argument.
 */
-#define sys_execve              sys_execve_wrapper
-#define sys_clone               sys_clone_wrapper
 #define sys_rt_sigreturn        sys_rt_sigreturn_wrapper
 #define sys_sigaltstack         sys_sigaltstack_wrapper
diff --git a/arch/arm64/kernel/sys32.S b/arch/arm64/kernel/sys32.S
index 54c4aec47a08..7ef59e9245ef 100644
--- a/arch/arm64/kernel/sys32.S
+++ b/arch/arm64/kernel/sys32.S
@@ -26,25 +26,6 @@
 /*
 * System call wrappers for the AArch32 compatibility layer.
 */
-compat_sys_fork_wrapper:
-        mov     x0, sp
-        b       compat_sys_fork
-ENDPROC(compat_sys_fork_wrapper)
-compat_sys_vfork_wrapper:
-        mov     x0, sp
-        b       compat_sys_vfork
-ENDPROC(compat_sys_vfork_wrapper)
-compat_sys_execve_wrapper:
-        mov     x3, sp
-        b       compat_sys_execve
-ENDPROC(compat_sys_execve_wrapper)
-compat_sys_clone_wrapper:
-        mov     x5, sp
-        b       compat_sys_clone
-ENDPROC(compat_sys_clone_wrapper)
 compat_sys_sigreturn_wrapper:
        mov     x0, sp
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 906e3bd270b0..6fabc1912da0 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -28,43 +28,15 @@
 #include <asm/cacheflush.h>
 #include <asm/unistd32.h>
-asmlinkage int compat_sys_fork(struct pt_regs *regs)
+asmlinkage int compat_sys_fork(void)
 {
-        return do_fork(SIGCHLD, regs->compat_sp, regs, 0, NULL, NULL);
+        return do_fork(SIGCHLD, 0, current_pt_regs(), 0, NULL, NULL);
 }
-asmlinkage int compat_sys_clone(unsigned long clone_flags, unsigned long newsp,
+asmlinkage int compat_sys_vfork(void)
-                          int __user *parent_tidptr, int tls_val,
-                          int __user *child_tidptr, struct pt_regs *regs)
 {
-        if (!newsp)
+        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
-                newsp = regs->compat_sp;
+                       current_pt_regs(), 0, NULL, NULL);
-        return do_fork(clone_flags, newsp, regs, 0, parent_tidptr, child_tidptr);
-}
-asmlinkage int compat_sys_vfork(struct pt_regs *regs)
-{
-        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, regs->compat_sp,
-                       regs, 0, NULL, NULL);
-}
-asmlinkage int compat_sys_execve(const char __user *filenamei,
-                                 compat_uptr_t argv, compat_uptr_t envp,
-                                 struct pt_regs *regs)
-{
-        int error;
-        struct filename *filename;
-        filename = getname(filenamei);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = compat_do_execve(filename->name, compat_ptr(argv),
-                                        compat_ptr(envp), regs);
-        putname(filename);
-out:
-        return error;
 }
 asmlinkage int compat_sys_sched_rr_get_interval(compat_pid_t pid,
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index efbf7df05d3f..4cd28931dba9 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -80,7 +80,7 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
 #ifdef CONFIG_ZONE_DMA32
        /* 4GB maximum for 32-bit only capable devices */
        max_dma32 = min(max, MAX_DMA32_PFN);
-        zone_size[ZONE_DMA32] = max_dma32 - min;
+        zone_size[ZONE_DMA32] = max(min, max_dma32) - min;
 #endif
        zone_size[ZONE_NORMAL] = max - max_dma32;
diff --git a/arch/c6x/Kconfig b/arch/c6x/Kconfig
index aee1b569ee6e..66eab3703c75 100644
--- a/arch/c6x/Kconfig
+++ b/arch/c6x/Kconfig
@@ -18,6 +18,7 @@ config C6X
        select OF_EARLY_FLATTREE
        select GENERIC_CLOCKEVENTS
        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        select MODULES_USE_ELF_RELA
 config MMU
diff --git a/arch/c6x/include/uapi/asm/unistd.h b/arch/c6x/include/uapi/asm/unistd.h
index 4ff747d12dad..625beafb9cd1 100644
--- a/arch/c6x/include/uapi/asm/unistd.h
+++ b/arch/c6x/include/uapi/asm/unistd.h
@@ -14,7 +14,6 @@
 *   more details.
 */
-#define __ARCH_WANT_KERNEL_EXECVE
 #define __ARCH_WANT_SYS_EXECVE
 /* Use the standard ABI for syscalls. */
diff --git a/arch/c6x/kernel/entry.S b/arch/c6x/kernel/entry.S
index 5449c36018fe..75f6f36472cf 100644
--- a/arch/c6x/kernel/entry.S
+++ b/arch/c6x/kernel/entry.S
@@ -413,19 +413,9 @@ ENTRY(ret_from_kernel_thread)
 0:
        B       .S2     B10                /* call fn */
        LDW     .D2T1   *+SP(REGS_A1+8),A4 /* get arg */
-        MVKL    .S2     sys_exit,B11
+        ADDKPC  .S2     ret_from_fork_2,B3,3
-        MVKH    .S2     sys_exit,B11
-        ADDKPC  .S2     0f,B3,1
-0:
-        BNOP    .S2     B11,5   /* jump to sys_exit */
 ENDPROC(ret_from_kernel_thread)
-ENTRY(ret_from_kernel_execve)
-        GET_THREAD_INFO A12
-        BNOP    .S2     syscall_exit,4
-        ADD     .D2X    A4,-8,SP
-ENDPROC(ret_from_kernel_execve)
        ;;
        ;; These are the interrupt handlers, responsible for calling __do_IRQ()
        ;; int6 is used for syscalls (see _system_call entry)
diff --git a/arch/h8300/include/asm/cache.h b/arch/h8300/include/asm/cache.h
index c6350283649d..05887a1d80e5 100644
--- a/arch/h8300/include/asm/cache.h
+++ b/arch/h8300/include/asm/cache.h
@@ -2,7 +2,8 @@
 #define __ARCH_H8300_CACHE_H
 /* bytes per L1 cache line */
-#define        L1_CACHE_BYTES  4
+#define        L1_CACHE_SHIFT  2
+#define        L1_CACHE_BYTES  (1 << L1_CACHE_SHIFT)
 /* m68k-elf-gcc  2.95.2 doesn't like these */
diff --git a/arch/hexagon/Kconfig b/arch/hexagon/Kconfig
index 0744f7d7b1fd..e418803b6c8e 100644
--- a/arch/hexagon/Kconfig
+++ b/arch/hexagon/Kconfig
@@ -31,6 +31,8 @@ config HEXAGON
        select GENERIC_CLOCKEVENTS
        select GENERIC_CLOCKEVENTS_BROADCAST
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        ---help---
          Qualcomm Hexagon is a processor architecture designed for high
          performance and low power across a wide variety of applications.
diff --git a/arch/hexagon/include/asm/processor.h b/arch/hexagon/include/asm/processor.h
index a03323ab9d44..6dd5d3706869 100644
--- a/arch/hexagon/include/asm/processor.h
+++ b/arch/hexagon/include/asm/processor.h
@@ -34,7 +34,6 @@
 struct task_struct;
 /*  this is defined in arch/process.c  */
-extern pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern unsigned long thread_saved_pc(struct task_struct *tsk);
 extern void start_thread(struct pt_regs *, unsigned long, unsigned long);
diff --git a/arch/hexagon/include/uapi/asm/ptrace.h b/arch/hexagon/include/uapi/asm/ptrace.h
index 8ef784047a74..1ffce0c6ee07 100644
--- a/arch/hexagon/include/uapi/asm/ptrace.h
+++ b/arch/hexagon/include/uapi/asm/ptrace.h
@@ -32,4 +32,8 @@
 extern int regs_query_register_offset(const char *name);
 extern const char *regs_query_register_name(unsigned int offset);
+#define current_pt_regs() \
+        ((struct pt_regs *) \
+         ((unsigned long)current_thread_info() + THREAD_SIZE) - 1)
 #endif
diff --git a/arch/hexagon/include/uapi/asm/unistd.h b/arch/hexagon/include/uapi/asm/unistd.h
index 81312d6a52e6..26b2e0f909c8 100644
--- a/arch/hexagon/include/uapi/asm/unistd.h
+++ b/arch/hexagon/include/uapi/asm/unistd.h
@@ -27,5 +27,6 @@
 */
 #define sys_mmap2 sys_mmap_pgoff
+#define __ARCH_WANT_SYS_EXECVE
 #include <asm-generic/unistd.h>
diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
index 9f6d7411b574..cfbc52bd5227 100644
--- a/arch/hexagon/kernel/process.c
+++ b/arch/hexagon/kernel/process.c
@@ -26,33 +26,6 @@
 #include <linux/slab.h>
 /*
- * Kernel thread creation.  The desired kernel function is "wrapped"
- * in the kernel_thread_helper function, which does cleanup
- * afterwards.
- */
-static void __noreturn kernel_thread_helper(void *arg, int (*fn)(void *))
-{
-        do_exit(fn(arg));
-}
-int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        /*
-         * Yes, we're exploting illicit knowledge of the ABI here.
-         */
-        regs.r00 = (unsigned long) arg;
-        regs.r01 = (unsigned long) fn;
-        pt_set_elr(&regs, (unsigned long)kernel_thread_helper);
-        pt_set_kmode(&regs);
-        return do_fork(flags|CLONE_VM|CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);
-}
-EXPORT_SYMBOL(kernel_thread);
-/*
 * Program thread launch.  Often defined as a macro in processor.h,
 * but we're shooting for a small footprint and it's not an inner-loop
 * performance-critical operation.
@@ -114,7 +87,7 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
 * Copy architecture-specific thread state
 */
 int copy_thread(unsigned long clone_flags, unsigned long usp,
-                unsigned long unused, struct task_struct *p,
+                unsigned long arg, struct task_struct *p,
                struct pt_regs *regs)
 {
        struct thread_info *ti = task_thread_info(p);
@@ -125,61 +98,50 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
        childregs = (struct pt_regs *) (((unsigned long) ti + THREAD_SIZE) -
                                        sizeof(*childregs));
-        memcpy(childregs, regs, sizeof(*childregs));
        ti->regs = childregs;
        /*
         * Establish kernel stack pointer and initial PC for new thread
+         * Note that unlike the usual situation, we do not copy the
+         * parent's callee-saved here; those are in pt_regs and whatever
+         * we leave here will be overridden on return to userland.
         */
        ss = (struct hexagon_switch_stack *) ((unsigned long) childregs -
                                                    sizeof(*ss));
        ss->lr = (unsigned long)ret_from_fork;
        p->thread.switch_sp = ss;
+        if (unlikely(p->flags & PF_KTHREAD)) {
-        /* If User mode thread, set pt_reg stack pointer as per parameter */
+                memset(childregs, 0, sizeof(struct pt_regs));
-        if (user_mode(childregs)) {
+                /* r24 <- fn, r25 <- arg */
-                pt_set_rte_sp(childregs, usp);
+                ss->r2524 = usp | ((u64)arg << 32);
+                pt_set_kmode(childregs);
-                /* Child sees zero return value */
+                return 0;
-                childregs->r00 = 0;
-                /*
-                 * The clone syscall has the C signature:
-                 * int [r0] clone(int flags [r0],
-                 *           void *child_frame [r1],
-                 *           void *parent_tid [r2],
-                 *           void *child_tid [r3],
-                 *           void *thread_control_block [r4]);
-                 * ugp is used to provide TLS support.
-                 */
-                if (clone_flags & CLONE_SETTLS)
-                        childregs->ugp = childregs->r04;
-                /*
-                 * Parent sees new pid -- not necessary, not even possible at
-                 * this point in the fork process
-                 * Might also want to set things like ti->addr_limit
-                 */
-        } else {
-                /*
-                 * If kernel thread, resume stack is kernel stack base.
-                 * Note that this is pointer arithmetic on pt_regs *
-                 */
-                pt_set_rte_sp(childregs, (unsigned long)(childregs + 1));
-                /*
-                 * We need the current thread_info fast path pointer
-                 * set up in pt_regs.  The register to be used is
-                 * parametric for assembler code, but the mechanism
-                 * doesn't drop neatly into C.  Needs to be fixed.
-                 */
-                childregs->THREADINFO_REG = (unsigned long) ti;
        }
+        memcpy(childregs, regs, sizeof(*childregs));
+        ss->r2524 = 0;
+        pt_set_rte_sp(childregs, usp);
+        /* Child sees zero return value */
+        childregs->r00 = 0;
+        /*
+         * The clone syscall has the C signature:
+         * int [r0] clone(int flags [r0],
+         *           void *child_frame [r1],
+         *           void *parent_tid [r2],
+         *           void *child_tid [r3],
+         *           void *thread_control_block [r4]);
+         * ugp is used to provide TLS support.
+         */
+        if (clone_flags & CLONE_SETTLS)
+                childregs->ugp = childregs->r04;
        /*
-         * thread_info pointer is pulled out of task_struct "stack"
+         * Parent sees new pid -- not necessary, not even possible at
-         * field on switch_to.
+         * this point in the fork process
+         * Might also want to set things like ti->addr_limit
         */
-        p->stack = (void *)ti;
        return 0;
 }
diff --git a/arch/hexagon/kernel/signal.c b/arch/hexagon/kernel/signal.c
index 5047b8b879c0..fe0d1373165d 100644
--- a/arch/hexagon/kernel/signal.c
+++ b/arch/hexagon/kernel/signal.c
@@ -249,14 +249,14 @@ void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags)
 */
 asmlinkage int sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss)
 {
-        struct pt_regs *regs = current_thread_info()->regs;
+        struct pt_regs *regs = current_pt_regs();
        return do_sigaltstack(uss, uoss, regs->r29);
 }
 asmlinkage int sys_rt_sigreturn(void)
 {
-        struct pt_regs *regs = current_thread_info()->regs;
+        struct pt_regs *regs = current_pt_regs();
        struct rt_sigframe __user *frame;
        sigset_t blocked;
diff --git a/arch/hexagon/kernel/syscall.c b/arch/hexagon/kernel/syscall.c
index 319fa6494f58..d2cc3270af3e 100644
--- a/arch/hexagon/kernel/syscall.c
+++ b/arch/hexagon/kernel/syscall.c
@@ -35,55 +35,13 @@
 * See signal.c for signal-related system call wrappers.
 */
-asmlinkage int sys_execve(char __user *ufilename,
-                          const char __user *const __user *argv,
-                          const char __user *const __user *envp)
-{
-        struct pt_regs *pregs = current_thread_info()->regs;
-        struct filename *filename;
-        int retval;
-        filename = getname(ufilename);
-        retval = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                return retval;
-        retval = do_execve(filename->name, argv, envp, pregs);
-        putname(filename);
-        return retval;
-}
 asmlinkage int sys_clone(unsigned long clone_flags, unsigned long newsp,
                         unsigned long parent_tidp, unsigned long child_tidp)
 {
-        struct pt_regs *pregs = current_thread_info()->regs;
+        struct pt_regs *pregs = current_pt_regs();
        if (!newsp)
                newsp = pregs->SP;
        return do_fork(clone_flags, newsp, pregs, 0, (int __user *)parent_tidp,
                       (int __user *)child_tidp);
 }
-/*
- * Do a system call from the kernel, so as to have a proper pt_regs
- * and recycle the sys_execvpe infrustructure.
- */
-int kernel_execve(const char *filename,
-                  const char *const argv[], const char *const envp[])
-{
-        register unsigned long __a0 asm("r0") = (unsigned long) filename;
-        register unsigned long __a1 asm("r1") = (unsigned long) argv;
-        register unsigned long __a2 asm("r2") = (unsigned long) envp;
-        int retval;
-        __asm__ volatile(
-                "       R6 = #%4;\n"
-                "       trap0(#1);\n"
-                "       %0 = R0;\n"
-                : "=r" (retval)
-                : "r" (__a0), "r" (__a1), "r" (__a2), "i" (__NR_execve)
-        );
-        return retval;
-}
diff --git a/arch/hexagon/kernel/vm_entry.S b/arch/hexagon/kernel/vm_entry.S
index cd71673ac259..425e50c694f7 100644
--- a/arch/hexagon/kernel/vm_entry.S
+++ b/arch/hexagon/kernel/vm_entry.S
@@ -266,4 +266,8 @@ _K_enter_machcheck:
        .globl ret_from_fork
 ret_from_fork:
        call schedule_tail
+        P0 = cmp.eq(R24, #0);
+        if P0 jump return_from_syscall
+        R0 = R25;
+        callr R24
        jump return_from_syscall
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 3279646120e3..670600468128 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -42,6 +42,8 @@ config IA64
        select GENERIC_TIME_VSYSCALL_OLD
        select HAVE_MOD_ARCH_SPECIFIC
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        default y
        help
          The Itanium Processor Family is Intel's 64-bit successor to
diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
index 944152a50912..e0a899a1a8a6 100644
--- a/arch/ia64/include/asm/processor.h
+++ b/arch/ia64/include/asm/processor.h
@@ -340,22 +340,6 @@ struct task_struct;
 */
 #define release_thread(dead_task)
-/*
- * This is the mechanism for creating a new kernel thread.
- *
- * NOTE 1: Only a kernel-only process (ie the swapper or direct
- * descendants who haven't done an "execve()") should use this: it
- * will work within a system call from a "real" process, but the
- * process memory space will not be free'd until both the parent and
- * the child have exited.
- *
- * NOTE 2: This MUST NOT be an inlined function.  Otherwise, we get
- * into trouble in init/main.c when the child thread returns to
- * do_basic_setup() and the timing is such that free_initmem() has
- * been called already.
- */
-extern pid_t kernel_thread (int (*fn)(void *), void *arg, unsigned long flags);
 /* Get wait channel for task P.  */
 extern unsigned long get_wchan (struct task_struct *p);
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index 8b3ff2f5b861..1574bca86138 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -29,6 +29,7 @@
 #define __ARCH_WANT_SYS_RT_SIGACTION
 #define __ARCH_WANT_SYS_RT_SIGSUSPEND
+#define __ARCH_WANT_SYS_EXECVE
 #if !defined(__ASSEMBLY__) && !defined(ASSEMBLER)
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 1ccbe12a4d84..940a67263629 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -61,14 +61,13 @@ ENTRY(ia64_execve)
         * Allocate 8 input registers since ptrace() may clobber them
         */
        .prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(8)
-        alloc loc1=ar.pfs,8,2,4,0
+        alloc loc1=ar.pfs,8,2,3,0
        mov loc0=rp
        .body
        mov out0=in0                    // filename
        ;;                              // stop bit between alloc and call
        mov out1=in1                    // argv
        mov out2=in2                    // envp
-        add out3=16,sp                  // regs
        br.call.sptk.many rp=sys_execve
 .ret0:
        cmp4.ge p6,p7=r8,r0
@@ -76,7 +75,6 @@ ENTRY(ia64_execve)
        sxt4 r8=r8                      // return 64-bit result
        ;;
        stf.spill [sp]=f0
-(p6)    cmp.ne pKStk,pUStk=r0,r0        // a successful execve() lands us in user-mode...
        mov rp=loc0
 (p6)    mov ar.pfs=r0                   // clear ar.pfs on success
 (p7)    br.ret.sptk.many rp
@@ -484,19 +482,6 @@ GLOBAL_ENTRY(prefetch_stack)
        br.ret.sptk.many rp
 END(prefetch_stack)
-GLOBAL_ENTRY(kernel_execve)
-        rum psr.ac
-        mov r15=__NR_execve                     // put syscall number in place
-        break __BREAK_SYSCALL
-        br.ret.sptk.many rp
-END(kernel_execve)
-GLOBAL_ENTRY(clone)
-        mov r15=__NR_clone                      // put syscall number in place
-        break __BREAK_SYSCALL
-        br.ret.sptk.many rp
-END(clone)
        /*
         * Invoke a system call, but do some tracing before and after the call.
         * We MUST preserve the current register frame throughout this routine
@@ -600,6 +585,27 @@ GLOBAL_ENTRY(ia64_strace_leave_kernel)
 .ret4:  br.cond.sptk ia64_leave_kernel
 END(ia64_strace_leave_kernel)
+ENTRY(call_payload)
+        .prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(0)
+        /* call the kernel_thread payload; fn is in r4, arg - in r5 */
+        alloc loc1=ar.pfs,0,3,1,0
+        mov loc0=rp
+        mov loc2=gp
+        mov out0=r5             // arg
+        ld8 r14 = [r4], 8       // fn.address
+        ;;
+        mov b6 = r14
+        ld8 gp = [r4]           // fn.gp
+        ;;
+        br.call.sptk.many rp=b6 // fn(arg)
+.ret12: mov gp=loc2
+        mov rp=loc0
+        mov ar.pfs=loc1
+        /* ... and if it has returned, we are going to userland */
+        cmp.ne pKStk,pUStk=r0,r0
+        br.ret.sptk.many rp
+END(call_payload)
 GLOBAL_ENTRY(ia64_ret_from_clone)
        PT_REGS_UNWIND_INFO(0)
 {       /*
@@ -616,6 +622,7 @@ GLOBAL_ENTRY(ia64_ret_from_clone)
        br.call.sptk.many rp=ia64_invoke_schedule_tail
 }
 .ret8:
+(pKStk) br.call.sptk.many rp=call_payload
        adds r2=TI_FLAGS+IA64_TASK_SIZE,r13
        ;;
        ld4 r2=[r2]
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 629a250f7c19..4738ff7bd66a 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -1093,19 +1093,6 @@ GLOBAL_ENTRY(cycle_to_cputime)
 END(cycle_to_cputime)
 #endif /* CONFIG_VIRT_CPU_ACCOUNTING */
-GLOBAL_ENTRY(start_kernel_thread)
-        .prologue
-        .save rp, r0                            // this is the end of the call-chain
-        .body
-        alloc r2 = ar.pfs, 0, 0, 2, 0
-        mov out0 = r9
-        mov out1 = r11;;
-        br.call.sptk.many rp = kernel_thread_helper;;
-        mov out0 = r8
-        br.call.sptk.many rp = sys_exit;;
-1:      br.sptk.few 1b                          // not reached
-END(start_kernel_thread)
 #ifdef CONFIG_IA64_BRL_EMU
 /*
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index 35e106f2ed13..25543a295ad9 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -401,64 +401,15 @@ copy_thread(unsigned long clone_flags,
        struct pt_regs *child_ptregs;
        int retval = 0;
-#ifdef CONFIG_SMP
-        /*
-         * For SMP idle threads, fork_by_hand() calls do_fork with
-         * NULL regs.
-         */
-        if (!regs)
-                return 0;
-#endif
-        stack = ((struct switch_stack *) regs) - 1;
        child_ptregs = (struct pt_regs *) ((unsigned long) p + IA64_STK_OFFSET) - 1;
        child_stack = (struct switch_stack *) child_ptregs - 1;
-        /* copy parent's switch_stack & pt_regs to child: */
-        memcpy(child_stack, stack, sizeof(*child_ptregs) + sizeof(*child_stack));
        rbs = (unsigned long) current + IA64_RBS_OFFSET;
        child_rbs = (unsigned long) p + IA64_RBS_OFFSET;
-        rbs_size = stack->ar_bspstore - rbs;
-        /* copy the parent's register backing store to the child: */
-        memcpy((void *) child_rbs, (void *) rbs, rbs_size);
-        if (likely(user_mode(child_ptregs))) {
-                if (clone_flags & CLONE_SETTLS)
-                        child_ptregs->r13 = regs->r16;  /* see sys_clone2() in entry.S */
-                if (user_stack_base) {
-                        child_ptregs->r12 = user_stack_base + user_stack_size - 16;
-                        child_ptregs->ar_bspstore = user_stack_base;
-                        child_ptregs->ar_rnat = 0;
-                        child_ptregs->loadrs = 0;
-                }
-        } else {
-                /*
-                 * Note: we simply preserve the relative position of
-                 * the stack pointer here.  There is no need to
-                 * allocate a scratch area here, since that will have
-                 * been taken care of by the caller of sys_clone()
-                 * already.
-                 */
-                child_ptregs->r12 = (unsigned long) child_ptregs - 16; /* kernel sp */
-                child_ptregs->r13 = (unsigned long) p;          /* set `current' pointer */
-        }
-        child_stack->ar_bspstore = child_rbs + rbs_size;
-        child_stack->b0 = (unsigned long) &ia64_ret_from_clone;
        /* copy parts of thread_struct: */
        p->thread.ksp = (unsigned long) child_stack - 16;
-        /* stop some PSR bits from being inherited.
-         * the psr.up/psr.pp bits must be cleared on fork but inherited on execve()
-         * therefore we must specify them explicitly here and not include them in
-         * IA64_PSR_BITS_TO_CLEAR.
-         */
-        child_ptregs->cr_ipsr = ((child_ptregs->cr_ipsr | IA64_PSR_BITS_TO_SET)
-                                 & ~(IA64_PSR_BITS_TO_CLEAR | IA64_PSR_PP | IA64_PSR_UP));
        /*
         * NOTE: The calling convention considers all floating point
         * registers in the high partition (fph) to be scratch.  Since
@@ -480,8 +431,66 @@ copy_thread(unsigned long clone_flags,
 #       define THREAD_FLAGS_TO_SET      0
        p->thread.flags = ((current->thread.flags & ~THREAD_FLAGS_TO_CLEAR)
                           | THREAD_FLAGS_TO_SET);
        ia64_drop_fpu(p);       /* don't pick up stale state from a CPU's fph */
+        if (unlikely(p->flags & PF_KTHREAD)) {
+                if (unlikely(!user_stack_base)) {
+                        /* fork_idle() called us */
+                        return 0;
+                }
+                memset(child_stack, 0, sizeof(*child_ptregs) + sizeof(*child_stack));
+                child_stack->r4 = user_stack_base;      /* payload */
+                child_stack->r5 = user_stack_size;      /* argument */
+                /*
+                 * Preserve PSR bits, except for bits 32-34 and 37-45,
+                 * which we can't read.
+                 */
+                child_ptregs->cr_ipsr = ia64_getreg(_IA64_REG_PSR) | IA64_PSR_BN;
+                /* mark as valid, empty frame */
+                child_ptregs->cr_ifs = 1UL << 63;
+                child_stack->ar_fpsr = child_ptregs->ar_fpsr
+                        = ia64_getreg(_IA64_REG_AR_FPSR);
+                child_stack->pr = (1 << PRED_KERNEL_STACK);
+                child_stack->ar_bspstore = child_rbs;
+                child_stack->b0 = (unsigned long) &ia64_ret_from_clone;
+                /* stop some PSR bits from being inherited.
+                 * the psr.up/psr.pp bits must be cleared on fork but inherited on execve()
+                 * therefore we must specify them explicitly here and not include them in
+                 * IA64_PSR_BITS_TO_CLEAR.
+                 */
+                child_ptregs->cr_ipsr = ((child_ptregs->cr_ipsr | IA64_PSR_BITS_TO_SET)
+                                 & ~(IA64_PSR_BITS_TO_CLEAR | IA64_PSR_PP | IA64_PSR_UP));
+                return 0;
+        }
+        stack = ((struct switch_stack *) regs) - 1;
+        /* copy parent's switch_stack & pt_regs to child: */
+        memcpy(child_stack, stack, sizeof(*child_ptregs) + sizeof(*child_stack));
+        /* copy the parent's register backing store to the child: */
+        rbs_size = stack->ar_bspstore - rbs;
+        memcpy((void *) child_rbs, (void *) rbs, rbs_size);
+        if (clone_flags & CLONE_SETTLS)
+                child_ptregs->r13 = regs->r16;  /* see sys_clone2() in entry.S */
+        if (user_stack_base) {
+                child_ptregs->r12 = user_stack_base + user_stack_size - 16;
+                child_ptregs->ar_bspstore = user_stack_base;
+                child_ptregs->ar_rnat = 0;
+                child_ptregs->loadrs = 0;
+        }
+        child_stack->ar_bspstore = child_rbs + rbs_size;
+        child_stack->b0 = (unsigned long) &ia64_ret_from_clone;
+        /* stop some PSR bits from being inherited.
+         * the psr.up/psr.pp bits must be cleared on fork but inherited on execve()
+         * therefore we must specify them explicitly here and not include them in
+         * IA64_PSR_BITS_TO_CLEAR.
+         */
+        child_ptregs->cr_ipsr = ((child_ptregs->cr_ipsr | IA64_PSR_BITS_TO_SET)
+                                 & ~(IA64_PSR_BITS_TO_CLEAR | IA64_PSR_PP | IA64_PSR_UP));
 #ifdef CONFIG_PERFMON
        if (current->thread.pfm_context)
                pfm_inherit(p, child_ptregs);
@@ -608,57 +617,6 @@ dump_fpu (struct pt_regs *pt, elf_fpregset_t dst)
        return 1;       /* f0-f31 are always valid so we always return 1 */
 }
-long
-sys_execve (const char __user *filename,
-            const char __user *const __user *argv,
-            const char __user *const __user *envp,
-            struct pt_regs *regs)
-{
-        struct filename *fname;
-        int error;
-        fname = getname(filename);
-        error = PTR_ERR(fname);
-        if (IS_ERR(fname))
-                goto out;
-        error = do_execve(fname->name, argv, envp, regs);
-        putname(fname);
-out:
-        return error;
-}
-pid_t
-kernel_thread (int (*fn)(void *), void *arg, unsigned long flags)
-{
-        extern void start_kernel_thread (void);
-        unsigned long *helper_fptr = (unsigned long *) &start_kernel_thread;
-        struct {
-                struct switch_stack sw;
-                struct pt_regs pt;
-        } regs;
-        memset(&regs, 0, sizeof(regs));
-        regs.pt.cr_iip = helper_fptr[0];        /* set entry point (IP) */
-        regs.pt.r1 = helper_fptr[1];            /* set GP */
-        regs.pt.r9 = (unsigned long) fn;        /* 1st argument */
-        regs.pt.r11 = (unsigned long) arg;      /* 2nd argument */
-        /* Preserve PSR bits, except for bits 32-34 and 37-45, which we can't read.  */
-        regs.pt.cr_ipsr = ia64_getreg(_IA64_REG_PSR) | IA64_PSR_BN;
-        regs.pt.cr_ifs = 1UL << 63;             /* mark as valid, empty frame */
-        regs.sw.ar_fpsr = regs.pt.ar_fpsr = ia64_getreg(_IA64_REG_AR_FPSR);
-        regs.sw.ar_bspstore = (unsigned long) current + IA64_RBS_OFFSET;
-        regs.sw.pr = (1 << PRED_KERNEL_STACK);
-        return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &regs.pt, 0, NULL, NULL);
-}
-EXPORT_SYMBOL(kernel_thread);
-/* This gets called from kernel_thread() via ia64_invoke_thread_helper().  */
-int
-kernel_thread_helper (int (*fn)(void *), void *arg)
-{
-        return (*fn)(arg);
-}
 /*
 * Flush thread state.  This is called when a thread does an execve().
 */
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index e7c161433eae..953a7ba5d050 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -16,6 +16,7 @@ config M68K
        select ARCH_WANT_IPC_PARSE_VERSION
        select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE
        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        select HAVE_MOD_ARCH_SPECIFIC
        select MODULES_USE_ELF_REL
        select MODULES_USE_ELF_RELA
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 5fc7f7bec1c8..0aa165405966 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -32,7 +32,6 @@
 #define __ARCH_WANT_SYS_RT_SIGACTION
 #define __ARCH_WANT_SYS_RT_SIGSUSPEND
 #define __ARCH_WANT_SYS_EXECVE
-#define __ARCH_WANT_KERNEL_EXECVE
 /*
 * "Conditional" syscalls
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index 946cb0187751..45b2f293f8cf 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -115,16 +115,9 @@ ENTRY(ret_from_kernel_thread)
        | a3 contains the kernel thread payload, d7 - its argument
        movel   %d1,%sp@-
        jsr     schedule_tail
-        GET_CURRENT(%d0)
        movel   %d7,(%sp)
        jsr     %a3@
        addql   #4,%sp
-        movel   %d0,(%sp)
-        jra     sys_exit
-ENTRY(ret_from_kernel_execve)
-        movel   4(%sp), %sp
-        GET_CURRENT(%d0)
        jra     ret_from_exception
 #if defined(CONFIG_COLDFIRE) || !defined(CONFIG_MMU)
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 4cba7439f9de..198abf6d41c4 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -26,6 +26,8 @@ config MICROBLAZE
        select GENERIC_ATOMIC64
        select GENERIC_CLOCKEVENTS
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
 config SWAP
        def_bool n
diff --git a/arch/microblaze/include/asm/processor.h b/arch/microblaze/include/asm/processor.h
index af2bb9652392..0759153e8117 100644
--- a/arch/microblaze/include/asm/processor.h
+++ b/arch/microblaze/include/asm/processor.h
@@ -31,6 +31,7 @@ extern const struct seq_operations cpuinfo_op;
 void start_thread(struct pt_regs *regs, unsigned long pc, unsigned long usp);
 extern void ret_from_fork(void);
+extern void ret_from_kernel_thread(void);
 # endif /* __ASSEMBLY__ */
@@ -78,11 +79,6 @@ extern unsigned long thread_saved_pc(struct task_struct *t);
 extern unsigned long get_wchan(struct task_struct *p);
-/*
- * create a kernel thread without removing it from tasklists
- */
-extern int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
 # define KSTK_EIP(tsk)  (0)
 # define KSTK_ESP(tsk)  (0)
@@ -131,8 +127,6 @@ extern inline void release_thread(struct task_struct *dead_task)
 {
 }
-extern int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
 /* Free current thread data structures etc.  */
 static inline void exit_thread(void)
 {
diff --git a/arch/microblaze/include/asm/unistd.h b/arch/microblaze/include/asm/unistd.h
index 6985e6e9d826..ea7442834294 100644
--- a/arch/microblaze/include/asm/unistd.h
+++ b/arch/microblaze/include/asm/unistd.h
@@ -422,6 +422,7 @@
 #define __ARCH_WANT_SYS_SIGPROCMASK
 #define __ARCH_WANT_SYS_RT_SIGACTION
 #define __ARCH_WANT_SYS_RT_SIGSUSPEND
+#define __ARCH_WANT_SYS_EXECVE
 /*
 * "Conditional" syscalls
diff --git a/arch/microblaze/kernel/entry-nommu.S b/arch/microblaze/kernel/entry-nommu.S
index 75c3ea1f48a1..673a49c04a02 100644
--- a/arch/microblaze/kernel/entry-nommu.S
+++ b/arch/microblaze/kernel/entry-nommu.S
@@ -474,6 +474,14 @@ ENTRY(ret_from_fork)
        brid    ret_to_user
        nop
+ENTRY(ret_from_kernel_thread)
+        brlid   r15, schedule_tail
+        addk    r5, r0, r3
+        brald   r15, r20
+        addk    r5, r0, r19
+        brid    ret_to_user
+        addk    r3, r0, r0
 work_pending:
        enable_irq
@@ -559,10 +567,6 @@ sys_clone:
        brid    microblaze_clone
        addk    r7, r1, r0
-sys_execve:
-        brid    microblaze_execve
-        addk    r8, r1, r0
 sys_rt_sigreturn_wrapper:
        brid    sys_rt_sigreturn
        addk    r5, r1, r0
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 03f7b8ce6b6b..10f360ed82b4 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -293,24 +293,6 @@ C_ENTRY(_user_exception):
        swi     r1, r0, TOPHYS(PER_CPU(ENTRY_SP)) /* save stack */
        addi    r14, r14, 4     /* return address is 4 byte after call */
-        mfs     r1, rmsr
-        nop
-        andi    r1, r1, MSR_UMS
-        bnei    r1, 1f
-/* Kernel-mode state save - kernel execve */
-        lwi     r1, r0, TOPHYS(PER_CPU(ENTRY_SP)); /* Reload kernel stack-ptr*/
-        tophys(r1,r1);
-        addik   r1, r1, -PT_SIZE; /* Make room on the stack. */
-        SAVE_REGS
-        swi     r1, r1, PT_MODE; /* pt_regs -> kernel mode */
-        brid    2f;
-        nop;                            /* Fill delay slot */
-/* User-mode state save.  */
-1:
        lwi     r1, r0, TOPHYS(PER_CPU(CURRENT_SAVE)); /* get saved current */
        tophys(r1,r1);
        lwi     r1, r1, TS_THREAD_INFO; /* get stack from task_struct */
@@ -479,11 +461,20 @@ C_ENTRY(sys_fork_wrapper):
   saved context).  */
 C_ENTRY(ret_from_fork):
        bralid  r15, schedule_tail; /* ...which is schedule_tail's arg */
-        add     r3, r5, r0;     /* switch_thread returns the prev task */
+        add     r5, r3, r0;     /* switch_thread returns the prev task */
                                /* ( in the delay slot ) */
        brid    ret_from_trap;  /* Do normal trap return */
        add     r3, r0, r0;     /* Child's fork call should return 0. */
+C_ENTRY(ret_from_kernel_thread):
+        bralid  r15, schedule_tail; /* ...which is schedule_tail's arg */
+        add     r5, r3, r0;     /* switch_thread returns the prev task */
+                                /* ( in the delay slot ) */
+        brald   r15, r20        /* fn was left in r20 */
+        addk    r5, r0, r19     /* ... and argument - in r19 */
+        brid    ret_from_trap
+        add     r3, r0, r0
 C_ENTRY(sys_vfork):
        brid    microblaze_vfork        /* Do real work (tail-call) */
        addik   r5, r1, 0
@@ -498,10 +489,6 @@ C_ENTRY(sys_clone):
        brid    do_fork         /* Do real work (tail-call) */
        add     r8, r0, r0;             /* Arg 3: (unused) */
-C_ENTRY(sys_execve):
-        brid    microblaze_execve;      /* Do real work (tail-call).*/
-        addik   r8, r1, 0;              /* add user context as 4th arg */
 C_ENTRY(sys_rt_sigreturn_wrapper):
        brid    sys_rt_sigreturn        /* Do real work */
        addik   r5, r1, 0;              /* add user context as 1st arg */
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 1944e00f07e1..29768c3dc358 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -119,46 +119,38 @@ void flush_thread(void)
 }
 int copy_thread(unsigned long clone_flags, unsigned long usp,
-                unsigned long unused,
+                unsigned long arg,
                struct task_struct *p, struct pt_regs *regs)
 {
        struct pt_regs *childregs = task_pt_regs(p);
        struct thread_info *ti = task_thread_info(p);
+        if (unlikely(p->flags & PF_KTHREAD)) {
+                /* if we're creating a new kernel thread then just zeroing all
+                 * the registers. That's OK for a brand new thread.*/
+                memset(childregs, 0, sizeof(struct pt_regs));
+                memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
+                ti->cpu_context.r1  = (unsigned long)childregs;
+                ti->cpu_context.r20 = (unsigned long)usp; /* fn */
+                ti->cpu_context.r19 = (unsigned long)arg;
+                childregs->pt_mode = 1;
+                local_save_flags(childregs->msr);
+#ifdef CONFIG_MMU
+                ti->cpu_context.msr = childregs->msr & ~MSR_IE;
+#endif
+                ti->cpu_context.r15 = (unsigned long)ret_from_kernel_thread - 8;
+                return 0;
+        }
        *childregs = *regs;
-        if (user_mode(regs))
+        childregs->r1 = usp;
-                childregs->r1 = usp;
-        else
-                childregs->r1 = ((unsigned long) ti) + THREAD_SIZE;
-#ifndef CONFIG_MMU
        memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
        ti->cpu_context.r1 = (unsigned long)childregs;
+#ifndef CONFIG_MMU
        ti->cpu_context.msr = (unsigned long)childregs->msr;
 #else
+        childregs->msr |= MSR_UMS;
-        /* if creating a kernel thread then update the current reg (we don't
-         * want to use the parent's value when restoring by POP_STATE) */
-        if (kernel_mode(regs))
-                /* save new current on stack to use POP_STATE */
-                childregs->CURRENT_TASK = (unsigned long)p;
-        /* if returning to user then use the parent's value of this register */
-        /* if we're creating a new kernel thread then just zeroing all
-         * the registers. That's OK for a brand new thread.*/
-        /* Pls. note that some of them will be restored in POP_STATE */
-        if (kernel_mode(regs))
-                memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
-        /* if this thread is created for fork/vfork/clone, then we want to
-         * restore all the parent's context */
-        /* in addition to the registers which will be restored by POP_STATE */
-        else {
-                ti->cpu_context = *(struct cpu_context *)regs;
-                childregs->msr |= MSR_UMS;
-        }
-        /* FIXME STATE_SAVE_PT_OFFSET; */
-        ti->cpu_context.r1  = (unsigned long)childregs;
        /* we should consider the fact that childregs is a copy of the parent
         * regs which were saved immediately after entering the kernel state
         * before enabling VM. This MSR will be restored in switch_to and
@@ -209,29 +201,6 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
 }
 #endif
-static void kernel_thread_helper(int (*fn)(void *), void *arg)
-{
-        fn(arg);
-        do_exit(-1);
-}
-int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        /* store them in non-volatile registers */
-        regs.r5 = (unsigned long)fn;
-        regs.r6 = (unsigned long)arg;
-        local_save_flags(regs.msr);
-        regs.pc = (unsigned long)kernel_thread_helper;
-        regs.pt_mode = 1;
-        return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0,
-                        &regs, 0, NULL, NULL);
-}
-EXPORT_SYMBOL_GPL(kernel_thread);
 unsigned long get_wchan(struct task_struct *p)
 {
 /* TBD (used by procfs) */
@@ -246,6 +215,7 @@ void start_thread(struct pt_regs *regs, unsigned long pc, unsigned long usp)
        regs->pt_mode = 0;
 #ifdef CONFIG_MMU
        regs->msr |= MSR_UMS;
+        regs->msr &= ~MSR_VM;
 #endif
 }
diff --git a/arch/microblaze/kernel/sys_microblaze.c b/arch/microblaze/kernel/sys_microblaze.c
index 404c0f24bd41..a6a7bae9f5c6 100644
--- a/arch/microblaze/kernel/sys_microblaze.c
+++ b/arch/microblaze/kernel/sys_microblaze.c
@@ -48,24 +48,6 @@ asmlinkage long microblaze_clone(int flags, unsigned long stack,
        return do_fork(flags, stack, regs, 0, NULL, NULL);
 }
-asmlinkage long microblaze_execve(const char __user *filenamei,
-                                  const char __user *const __user *argv,
-                                  const char __user *const __user *envp,
-                                  struct pt_regs *regs)
-{
-        int error;
-        struct filename *filename;
-        filename = getname(filenamei);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name, argv, envp, regs);
-        putname(filename);
-out:
-        return error;
-}
 asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
                        unsigned long prot, unsigned long flags,
                        unsigned long fd, off_t pgoff)
@@ -75,24 +57,3 @@ asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
        return sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff >> PAGE_SHIFT);
 }
-/*
- * Do a system call from kernel instead of calling sys_execve so we
- * end up with proper pt_regs.
- */
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
-{
-        register const char *__a __asm__("r5") = filename;
-        register const void *__b __asm__("r6") = argv;
-        register const void *__c __asm__("r7") = envp;
-        register unsigned long __syscall __asm__("r12") = __NR_execve;
-        register unsigned long __ret __asm__("r3");
-        __asm__ __volatile__ ("brki r14, 0x8"
-                        : "=r" (__ret), "=r" (__syscall)
-                        : "1" (__syscall), "r" (__a), "r" (__b), "r" (__c)
-                        : "r4", "r8", "r9",
-                        "r10", "r11", "r14", "cc", "memory");
-        return __ret;
-}
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index dba9390d37cf..4183e62f178c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -40,6 +40,8 @@ config MIPS
        select HAVE_MOD_ARCH_SPECIFIC
        select MODULES_USE_ELF_REL
        select MODULES_USE_ELF_RELA if 64BIT
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
 menu "Machine selection"
diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index 5e33fabe354d..d28c41e0887c 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -310,8 +310,6 @@ struct task_struct;
 /* Free all resources held by a thread. */
 #define release_thread(thread) do { } while(0)
-extern long kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern unsigned long thread_saved_pc(struct task_struct *tsk);
 /*
diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
index 4f5da948a777..cec5e125f7e4 100644
--- a/arch/mips/include/asm/ptrace.h
+++ b/arch/mips/include/asm/ptrace.h
@@ -61,4 +61,10 @@ static inline void die_if_kernel(const char *str, struct pt_regs *regs)
                die(str, regs);
 }
+#define current_pt_regs()                                               \
+({                                                                      \
+        unsigned long sp = (unsigned long)__builtin_frame_address(0);   \
+        (struct pt_regs *)((sp | (THREAD_SIZE - 1)) + 1 - 32) - 1;      \
+})
 #endif /* _ASM_PTRACE_H */
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index 9e47cc11aa26..b306e2081cad 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -20,6 +20,7 @@
 #define __ARCH_OMIT_COMPAT_SYS_GETDENTS64
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
+#define __ARCH_WANT_SYS_EXECVE
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index a6c133212003..3320cb4ac1d4 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -65,6 +65,12 @@ need_resched:
        b       need_resched
 #endif
+FEXPORT(ret_from_kernel_thread)
+        jal     schedule_tail           # a0 = struct task_struct *prev
+        move    a0, s1
+        jal     s0
+        j       syscall_exit
 FEXPORT(ret_from_fork)
        jal     schedule_tail           # a0 = struct task_struct *prev
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 3a21acedf882..8796dbc7e358 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -3,7 +3,6 @@
 *
 * Copyright (C) 2000 Silicon Graphics, Inc.
 * Written by Ulf Carlsson (ulfc@engr.sgi.com)
- * sys32_execve from ia64/ia32 code, Feb 2000, Kanoj Sarcar (kanoj@sgi.com)
 */
 #include <linux/compiler.h>
 #include <linux/mm.h>
@@ -77,26 +76,6 @@ out:
        return error;
 }
-/*
- * sys_execve() executes a new program.
- */
-asmlinkage int sys32_execve(nabi_no_regargs struct pt_regs regs)
-{
-        int error;
-        struct filename *filename;
-        filename = getname(compat_ptr(regs.regs[4]));
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = compat_do_execve(filename->name, compat_ptr(regs.regs[5]),
-                                 compat_ptr(regs.regs[6]), &regs);
-        putname(filename);
-out:
-        return error;
-}
 #define RLIM_INFINITY32 0x7fffffff
 #define RESOURCE32(x) ((x > RLIM_INFINITY32) ? RLIM_INFINITY32 : x)
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index 3fc1691110dc..2d9304c2b54c 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -32,8 +32,6 @@ EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(kernel_thread);
 /*
 * Functions that operate on entire pages.  Mostly used by memory management.
 */
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index e9a5fd7277f4..d13720ac656f 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -84,6 +84,7 @@ void __noreturn cpu_idle(void)
 }
 asmlinkage void ret_from_fork(void);
+asmlinkage void ret_from_kernel_thread(void);
 void start_thread(struct pt_regs * regs, unsigned long pc, unsigned long sp)
 {
@@ -113,7 +114,7 @@ void flush_thread(void)
 }
 int copy_thread(unsigned long clone_flags, unsigned long usp,
-        unsigned long unused, struct task_struct *p, struct pt_regs *regs)
+        unsigned long arg, struct task_struct *p, struct pt_regs *regs)
 {
        struct thread_info *ti = task_thread_info(p);
        struct pt_regs *childregs;
@@ -136,19 +137,30 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
        childregs = (struct pt_regs *) childksp - 1;
        /*  Put the stack after the struct pt_regs.  */
        childksp = (unsigned long) childregs;
+        p->thread.cp0_status = read_c0_status() & ~(ST0_CU2|ST0_CU1);
+        if (unlikely(p->flags & PF_KTHREAD)) {
+                unsigned long status = p->thread.cp0_status;
+                memset(childregs, 0, sizeof(struct pt_regs));
+                ti->addr_limit = KERNEL_DS;
+                p->thread.reg16 = usp; /* fn */
+                p->thread.reg17 = arg;
+                p->thread.reg29 = childksp;
+                p->thread.reg31 = (unsigned long) ret_from_kernel_thread;
+#if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
+                status = (status & ~(ST0_KUP | ST0_IEP | ST0_IEC)) |
+                         ((status & (ST0_KUC | ST0_IEC)) << 2);
+#else
+                status |= ST0_EXL;
+#endif
+                childregs->cp0_status = status;
+                return 0;
+        }
        *childregs = *regs;
        childregs->regs[7] = 0; /* Clear error flag */
        childregs->regs[2] = 0; /* Child gets zero as return value */
+        childregs->regs[29] = usp;
+        ti->addr_limit = USER_DS;
-        if (childregs->cp0_status & ST0_CU0) {
-                childregs->regs[28] = (unsigned long) ti;
-                childregs->regs[29] = childksp;
-                ti->addr_limit = KERNEL_DS;
-        } else {
-                childregs->regs[29] = usp;
-                ti->addr_limit = USER_DS;
-        }
        p->thread.reg29 = (unsigned long) childregs;
        p->thread.reg31 = (unsigned long) ret_from_fork;
@@ -156,7 +168,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
         * New tasks lose permission to use the fpu. This accelerates context
         * switching for most programs since they don't use the fpu.
         */
-        p->thread.cp0_status = read_c0_status() & ~(ST0_CU2|ST0_CU1);
        childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
 #ifdef CONFIG_MIPS_MT_SMTC
@@ -222,35 +233,6 @@ int dump_task_fpu(struct task_struct *t, elf_fpregset_t *fpr)
 }
 /*
- * Create a kernel thread
- */
-static void __noreturn kernel_thread_helper(void *arg, int (*fn)(void *))
-{
-        do_exit(fn(arg));
-}
-long kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        regs.regs[4] = (unsigned long) arg;
-        regs.regs[5] = (unsigned long) fn;
-        regs.cp0_epc = (unsigned long) kernel_thread_helper;
-        regs.cp0_status = read_c0_status();
-#if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
-        regs.cp0_status = (regs.cp0_status & ~(ST0_KUP | ST0_IEP | ST0_IEC)) |
-                          ((regs.cp0_status & (ST0_KUC | ST0_IEC)) << 2);
-#else
-        regs.cp0_status |= ST0_EXL;
-#endif
-        /* Ok, create the new process.. */
-        return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);
-}
-/*
 *
 */
 struct mips_frame_info {
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index f6ba8381ee01..d27ca340d46d 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -167,7 +167,7 @@ EXPORT(sysn32_call_table)
        PTR     sys_getsockopt
        PTR     sys_clone                       /* 6055 */
        PTR     sys_fork
-        PTR     sys32_execve
+        PTR     compat_sys_execve
        PTR     sys_exit
        PTR     compat_sys_wait4
        PTR     sys_kill                        /* 6060 */
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 53c2d7245764..9601be6afa3d 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -203,7 +203,7 @@ sys_call_table:
        PTR     sys_creat
        PTR     sys_link
        PTR     sys_unlink                      /* 4010 */
-        PTR     sys32_execve
+        PTR     compat_sys_execve
        PTR     sys_chdir
        PTR     compat_sys_time
        PTR     sys_mknod
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 2bd561bc05ae..c611e2df7767 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -127,28 +127,6 @@ _sys_clone(nabi_no_regargs struct pt_regs regs)
                       parent_tidptr, child_tidptr);
 }
-/*
- * sys_execve() executes a new program.
- */
-asmlinkage int sys_execve(nabi_no_regargs struct pt_regs regs)
-{
-        int error;
-        struct filename *filename;
-        filename = getname((const char __user *) (long)regs.regs[4]);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name,
-                          (const char __user *const __user *) (long)regs.regs[5],
-                          (const char __user *const __user *) (long)regs.regs[6],
-                          &regs);
-        putname(filename);
-out:
-        return error;
-}
 SYSCALL_DEFINE1(set_thread_area, unsigned long, addr)
 {
        struct thread_info *ti = task_thread_info(current);
@@ -313,34 +291,3 @@ asmlinkage void bad_stack(void)
 {
        do_exit(SIGSEGV);
 }
-/*
- * Do a system call from kernel instead of calling sys_execve so we
- * end up with proper pt_regs.
- */
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
-{
-        register unsigned long __a0 asm("$4") = (unsigned long) filename;
-        register unsigned long __a1 asm("$5") = (unsigned long) argv;
-        register unsigned long __a2 asm("$6") = (unsigned long) envp;
-        register unsigned long __a3 asm("$7");
-        unsigned long __v0;
-        __asm__ volatile ("                                     \n"
-        "       .set    noreorder                               \n"
-        "       li      $2, %5          # __NR_execve           \n"
-        "       syscall                                         \n"
-        "       move    %0, $2                                  \n"
-        "       .set    reorder                                 \n"
-        : "=&r" (__v0), "=r" (__a3)
-        : "r" (__a0), "r" (__a1), "r" (__a2), "i" (__NR_execve)
-        : "$2", "$8", "$9", "$10", "$11", "$12", "$13", "$14", "$15", "$24",
-          "memory");
-        if (__a3 == 0)
-                return __v0;
-        return -__v0;
-}
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index 05f2ba41ff1a..e7f1a2993f78 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -22,6 +22,8 @@ config OPENRISC
        select GENERIC_STRNCPY_FROM_USER
        select GENERIC_STRNLEN_USER
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
 config MMU
        def_bool y
diff --git a/arch/openrisc/include/uapi/asm/unistd.h b/arch/openrisc/include/uapi/asm/unistd.h
index 437bdbb61b14..5db7bc0fa5a7 100644
--- a/arch/openrisc/include/uapi/asm/unistd.h
+++ b/arch/openrisc/include/uapi/asm/unistd.h
@@ -20,6 +20,8 @@
 #define sys_mmap2 sys_mmap_pgoff
+#define __ARCH_WANT_SYS_EXECVE
 #include <asm-generic/unistd.h>
 #define __NR_or1k_atomic __NR_arch_specific_syscall
diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
index ddfcaa828b0e..c60a09df323f 100644
--- a/arch/openrisc/kernel/entry.S
+++ b/arch/openrisc/kernel/entry.S
@@ -894,6 +894,16 @@ ENTRY(ret_from_fork)
        l.jal   schedule_tail
         l.nop
+        /* Check if we are a kernel thread */
+        l.sfeqi r20,0
+        l.bf    1f
+         l.nop
+        /* ...we are a kernel thread so invoke the requested callback */
+        l.jalr  r20
+         l.or   r3,r22,r0
+1:
        /* _syscall_returns expect r11 to contain return value */
        l.lwz   r11,PT_GPR11(r1)
@@ -915,26 +925,6 @@ ENTRY(ret_from_fork)
        l.j     _syscall_return
         l.nop
-/* Since syscalls don't save call-clobbered registers, the args to
- * kernel_thread_helper will need to be passed through callee-saved
- * registers and copied to the parameter registers when the thread
- * begins running.
- *
- * See arch/openrisc/kernel/process.c:
- * The args are passed as follows:
- *   arg1 (r3) : passed in r20
- *   arg2 (r4) : passed in r22
- */
-ENTRY(_kernel_thread_helper)
-        l.or    r3,r20,r0
-        l.or    r4,r22,r0
-        l.movhi r31,hi(kernel_thread_helper)
-        l.ori   r31,r31,lo(kernel_thread_helper)
-        l.jr    r31
-         l.nop
 /* ========================================================[ switch ] === */
 /*
@@ -1044,8 +1034,13 @@ ENTRY(_switch)
        /* Unwind stack to pre-switch state */
        l.addi  r1,r1,(INT_FRAME_SIZE)
-        /* Return via the link-register back to where we 'came from', where that can be
+        /* Return via the link-register back to where we 'came from', where
-         * either schedule() or return_from_fork()... */
+         * that may be either schedule(), ret_from_fork(), or
+         * ret_from_kernel_thread().  If we are returning to a new thread,
+         * we are expected to have set up the arg to schedule_tail already,
+         * hence we do so here unconditionally:
+         */
+        l.lwz   r3,TI_STACK(r3)         /* Load 'prev' as schedule_tail arg */
        l.jr    r9
         l.nop
@@ -1088,10 +1083,6 @@ ENTRY(sys_fork)
        l.j     _fork_save_extra_regs_and_call
         l.addi r3,r1,0
-ENTRY(sys_execve)
-        l.j     _sys_execve
-         l.addi r6,r1,0
 ENTRY(sys_sigaltstack)
        l.j     _sys_sigaltstack
         l.addi r5,r1,0
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index c35f3ab1a8d3..e0874b8e09e4 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -109,66 +109,82 @@ void release_thread(struct task_struct *dead_task)
 */
 extern asmlinkage void ret_from_fork(void);
+/*
+ * copy_thread
+ * @clone_flags: flags
+ * @usp: user stack pointer or fn for kernel thread
+ * @arg: arg to fn for kernel thread; always NULL for userspace thread
+ * @p: the newly created task
+ * @regs: CPU context to copy for userspace thread; always NULL for kthread
+ *
+ * At the top of a newly initialized kernel stack are two stacked pt_reg
+ * structures.  The first (topmost) is the userspace context of the thread.
+ * The second is the kernelspace context of the thread.
+ *
+ * A kernel thread will not be returning to userspace, so the topmost pt_regs
+ * struct can be uninitialized; it _does_ need to exist, though, because
+ * a kernel thread can become a userspace thread by doing a kernel_execve, in
+ * which case the topmost context will be initialized and used for 'returning'
+ * to userspace.
+ *
+ * The second pt_reg struct needs to be initialized to 'return' to
+ * ret_from_fork.  A kernel thread will need to set r20 to the address of
+ * a function to call into (with arg in r22); userspace threads need to set
+ * r20 to NULL in which case ret_from_fork will just continue a return to
+ * userspace.
+ *
+ * A kernel thread 'fn' may return; this is effectively what happens when
+ * kernel_execve is called.  In that case, the userspace pt_regs must have
+ * been initialized (which kernel_execve takes care of, see start_thread
+ * below); ret_from_fork will then continue its execution causing the
+ * 'kernel thread' to return to userspace as a userspace thread.
+ */
 int
 copy_thread(unsigned long clone_flags, unsigned long usp,
-            unsigned long unused, struct task_struct *p, struct pt_regs *regs)
+            unsigned long arg, struct task_struct *p, struct pt_regs *regs)
 {
-        struct pt_regs *childregs;
+        struct pt_regs *userregs;
        struct pt_regs *kregs;
        unsigned long sp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
-        struct thread_info *ti;
        unsigned long top_of_kernel_stack;
        top_of_kernel_stack = sp;
        p->set_child_tid = p->clear_child_tid = NULL;
-        /* Copy registers */
+        /* Locate userspace context on stack... */
-        /* redzone */
+        sp -= STACK_FRAME_OVERHEAD;     /* redzone */
-        sp -= STACK_FRAME_OVERHEAD;
        sp -= sizeof(struct pt_regs);
-        childregs = (struct pt_regs *)sp;
+        userregs = (struct pt_regs *) sp;
-        /* Copy parent registers */
+        /* ...and kernel context */
-        *childregs = *regs;
+        sp -= STACK_FRAME_OVERHEAD;     /* redzone */
+        sp -= sizeof(struct pt_regs);
+        kregs = (struct pt_regs *)sp;
-        if ((childregs->sr & SPR_SR_SM) == 1) {
+        if (unlikely(p->flags & PF_KTHREAD)) {
-                /* for kernel thread, set `current_thread_info'
+                memset(kregs, 0, sizeof(struct pt_regs));
-                 * and stackptr in new task
+                kregs->gpr[20] = usp; /* fn, kernel thread */
-                 */
+                kregs->gpr[22] = arg;
-                childregs->sp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
-                childregs->gpr[10] = (unsigned long)task_thread_info(p);
        } else {
-                childregs->sp = usp;
+                *userregs = *regs;
-        }
-        childregs->gpr[11] = 0; /* Result from fork() */
-        /*
+                userregs->sp = usp;
-         * The way this works is that at some point in the future
+                userregs->gpr[11] = 0;  /* Result from fork() */
-         * some task will call _switch to switch to the new task.
-         * That will pop off the stack frame created below and start
-         * the new task running at ret_from_fork.  The new task will
-         * do some house keeping and then return from the fork or clone
-         * system call, using the stack frame created above.
-         */
-        /* redzone */
-        sp -= STACK_FRAME_OVERHEAD;
-        sp -= sizeof(struct pt_regs);
-        kregs = (struct pt_regs *)sp;
-        ti = task_thread_info(p);
+                kregs->gpr[20] = 0;     /* Userspace thread */
-        ti->ksp = sp;
+        }
-        /* kregs->sp must store the location of the 'pre-switch' kernel stack
+        /*
-         * pointer... for a newly forked process, this is simply the top of
+         * _switch wants the kernel stack page in pt_regs->sp so that it
-         * the kernel stack.
+         * can restore it to thread_info->ksp... see _switch for details.
         */
        kregs->sp = top_of_kernel_stack;
-        kregs->gpr[3] = (unsigned long)current; /* arg to schedule_tail */
-        kregs->gpr[10] = (unsigned long)task_thread_info(p);
        kregs->gpr[9] = (unsigned long)ret_from_fork;
+        task_thread_info(p)->ksp = (unsigned long)kregs;
        return 0;
 }
@@ -177,16 +193,14 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
 */
 void start_thread(struct pt_regs *regs, unsigned long pc, unsigned long sp)
 {
-        unsigned long sr = regs->sr & ~SPR_SR_SM;
+        unsigned long sr = mfspr(SPR_SR) & ~SPR_SR_SM;
        set_fs(USER_DS);
-        memset(regs->gpr, 0, sizeof(regs->gpr));
+        memset(regs, 0, sizeof(struct pt_regs));
        regs->pc = pc;
        regs->sr = sr;
        regs->sp = sp;
-/*      printk("start thread, ksp = %lx\n", current_thread_info()->ksp);*/
 }
 /* Fill in the fpu structure for a core dump.  */
@@ -237,74 +251,9 @@ void dump_elf_thread(elf_greg_t *dest, struct pt_regs* regs)
        dest[35] = 0;
 }
-extern void _kernel_thread_helper(void);
-void __noreturn kernel_thread_helper(int (*fn) (void *), void *arg)
-{
-        do_exit(fn(arg));
-}
-/*
- * Create a kernel thread.
- */
-int kernel_thread(int (*fn) (void *), void *arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        regs.gpr[20] = (unsigned long)fn;
-        regs.gpr[22] = (unsigned long)arg;
-        regs.sr = mfspr(SPR_SR);
-        regs.pc = (unsigned long)_kernel_thread_helper;
-        return do_fork(flags | CLONE_VM | CLONE_UNTRACED,
-                       0, &regs, 0, NULL, NULL);
-}
-/*
- * sys_execve() executes a new program.
- */
-asmlinkage long _sys_execve(const char __user *name,
-                            const char __user * const __user *argv,
-                            const char __user * const __user *envp,
-                            struct pt_regs *regs)
-{
-        int error;
-        struct filename *filename;
-        filename = getname(name);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name, argv, envp, regs);
-        putname(filename);
-out:
-        return error;
-}
 unsigned long get_wchan(struct task_struct *p)
 {
        /* TODO */
        return 0;
 }
-int kernel_execve(const char *filename, char *const argv[], char *const envp[])
-{
-        register long __res asm("r11") = __NR_execve;
-        register long __a asm("r3") = (long)(filename);
-        register long __b asm("r4") = (long)(argv);
-        register long __c asm("r5") = (long)(envp);
-        __asm__ volatile ("l.sys 1"
-                          : "=r" (__res), "=r"(__a), "=r"(__b), "=r"(__c)
-                          : "0"(__res), "1"(__a), "2"(__b), "3"(__c)
-                          : "r6", "r7", "r8", "r12", "r13", "r15",
-                            "r17", "r19", "r21", "r23", "r25", "r27",
-                            "r29", "r31");
-        __asm__ volatile ("l.nop");
-        return __res;
-}
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 11def45b98c5..0aec70c35614 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -22,6 +22,8 @@ config PARISC
        select GENERIC_STRNCPY_FROM_USER
        select HAVE_MOD_ARCH_SPECIFIC
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        help
          The PA-RISC microprocessor is designed by Hewlett-Packard and used
diff --git a/arch/parisc/include/asm/unistd.h b/arch/parisc/include/asm/unistd.h
index 541639c3f607..55512e26b0c2 100644
--- a/arch/parisc/include/asm/unistd.h
+++ b/arch/parisc/include/asm/unistd.h
@@ -163,6 +163,7 @@ type name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, type5 arg5)	\
 #define __ARCH_WANT_SYS_RT_SIGACTION
 #define __ARCH_WANT_SYS_RT_SIGSUSPEND
 #define __ARCH_WANT_COMPAT_SYS_RT_SIGSUSPEND
+#define __ARCH_WANT_SYS_EXECVE
 #endif /* __ASSEMBLY__ */
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 18670a078849..c9a9abd4bc58 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -708,59 +708,9 @@ ENTRY(end_fault_vector)
        .import         do_cpu_irq_mask,code
        /*
-         * r26 = function to be called
-         * r25 = argument to pass in
-         * r24 = flags for do_fork()
-         *
-         * Kernel threads don't ever return, so they don't need
-         * a true register context. We just save away the arguments
-         * for copy_thread/ret_ to properly set up the child.
-         */
-#define CLONE_VM 0x100  /* Must agree with <linux/sched.h> */
-#define CLONE_UNTRACED 0x00800000
-        .import do_fork
-ENTRY(__kernel_thread)
-        STREG   %r2, -RP_OFFSET(%r30)
-        copy    %r30, %r1
-        ldo     PT_SZ_ALGN(%r30),%r30
-#ifdef CONFIG_64BIT
-        /* Yo, function pointers in wide mode are little structs... -PB */
-        ldd     24(%r26), %r2
-        STREG   %r2, PT_GR27(%r1)       /* Store childs %dp */
-        ldd     16(%r26), %r26
-        STREG   %r22, PT_GR22(%r1)      /* save r22 (arg5) */
-        copy    %r0, %r22               /* user_tid */
-#endif
-        STREG   %r26, PT_GR26(%r1)  /* Store function & argument for child */
-        STREG   %r25, PT_GR25(%r1)
-        ldil    L%CLONE_UNTRACED, %r26
-        ldo     CLONE_VM(%r26), %r26   /* Force CLONE_VM since only init_mm */
-        or      %r26, %r24, %r26      /* will have kernel mappings.      */
-        ldi     1, %r25                 /* stack_start, signals kernel thread */
-        stw     %r0, -52(%r30)          /* user_tid */
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-#endif
-        BL      do_fork, %r2
-        copy    %r1, %r24               /* pt_regs */
-        /* Parent Returns here */
-        LDREG   -PT_SZ_ALGN-RP_OFFSET(%r30), %r2
-        ldo     -PT_SZ_ALGN(%r30), %r30
-        bv      %r0(%r2)
-        nop
-ENDPROC(__kernel_thread)
-        /*
         * Child Returns here
         *
-         * copy_thread moved args from temp save area set up above
+         * copy_thread moved args into task save area.
-         * into task save area.
         */
 ENTRY(ret_from_kernel_thread)
@@ -769,51 +719,17 @@ ENTRY(ret_from_kernel_thread)
        BL      schedule_tail, %r2
        nop
-        LDREG   TI_TASK-THREAD_SZ_ALGN(%r30), %r1
+        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30), %r1
        LDREG   TASK_PT_GR25(%r1), %r26
 #ifdef CONFIG_64BIT
        LDREG   TASK_PT_GR27(%r1), %r27
-        LDREG   TASK_PT_GR22(%r1), %r22
 #endif
        LDREG   TASK_PT_GR26(%r1), %r1
        ble     0(%sr7, %r1)
        copy    %r31, %r2
+        b       finish_child_return
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-        loadgp                          /* Thread could have been in a module */
-#endif
-#ifndef CONFIG_64BIT
-        b       sys_exit
-#else
-        load32  sys_exit, %r1
-        bv      %r0(%r1)
-#endif
-        ldi     0, %r26
-ENDPROC(ret_from_kernel_thread)
-        .import sys_execve, code
-ENTRY(__execve)
-        copy    %r2, %r15
-        copy    %r30, %r16
-        ldo     PT_SZ_ALGN(%r30), %r30
-        STREG   %r26, PT_GR26(%r16)
-        STREG   %r25, PT_GR25(%r16)
-        STREG   %r24, PT_GR24(%r16)
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-#endif
-        BL      sys_execve, %r2
-        copy    %r16, %r26
-        cmpib,=,n 0,%r28,intr_return    /* forward */
-        /* yes, this will trap and die. */
-        copy    %r15, %r2
-        copy    %r16, %r30
-        bv      %r0(%r2)
        nop
-ENDPROC(__execve)
+ENDPROC(ret_from_kernel_thread)
        /*
@@ -1776,49 +1692,27 @@ ENTRY(sys_fork_wrapper)
        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30), %r1
        ldo     TASK_REGS(%r1),%r1
        reg_save %r1
-        mfctl   %cr27, %r3
+        mfctl   %cr27, %r28
-        STREG   %r3, PT_CR27(%r1)
+        STREG   %r28, PT_CR27(%r1)
-        STREG   %r2,-RP_OFFSET(%r30)
-        ldo     FRAME_SIZE(%r30),%r30
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-#endif
-        /* These are call-clobbered registers and therefore
-           also syscall-clobbered (we hope). */
-        STREG   %r2,PT_GR19(%r1)        /* save for child */
-        STREG   %r30,PT_GR21(%r1)
        LDREG   PT_GR30(%r1),%r25
        copy    %r1,%r24
-        BL      sys_clone,%r2
+        b       sys_clone
        ldi     SIGCHLD,%r26
-        LDREG   -RP_OFFSET-FRAME_SIZE(%r30),%r2
-wrapper_exit:
-        ldo     -FRAME_SIZE(%r30),%r30          /* get the stackframe */
-        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
-        ldo     TASK_REGS(%r1),%r1       /* get pt regs */
-        LDREG   PT_CR27(%r1), %r3
-        mtctl   %r3, %cr27
-        reg_restore %r1
-        /* strace expects syscall # to be preserved in r20 */
-        ldi     __NR_fork,%r20
-        bv %r0(%r2)
-        STREG   %r20,PT_GR20(%r1)
 ENDPROC(sys_fork_wrapper)
        /* Set the return value for the child */
 ENTRY(child_return)
        BL      schedule_tail, %r2
        nop
+finish_child_return:
+        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30), %r1
+        ldo     TASK_REGS(%r1),%r1       /* get pt regs */
-        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE-FRAME_SIZE(%r30), %r1
+        LDREG   PT_CR27(%r1), %r3
-        LDREG   TASK_PT_GR19(%r1),%r2
+        mtctl   %r3, %cr27
-        b       wrapper_exit
+        reg_restore %r1
+        b       syscall_exit
        copy    %r0,%r28
 ENDPROC(child_return)
@@ -1827,23 +1721,10 @@ ENTRY(sys_clone_wrapper)
        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
        ldo     TASK_REGS(%r1),%r1      /* get pt regs */
        reg_save %r1
-        mfctl   %cr27, %r3
+        mfctl   %cr27, %r28
-        STREG   %r3, PT_CR27(%r1)
+        STREG   %r28, PT_CR27(%r1)
+        b       sys_clone
-        STREG   %r2,-RP_OFFSET(%r30)
-        ldo     FRAME_SIZE(%r30),%r30
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-#endif
-        /* WARNING - Clobbers r19 and r21, userspace must save these! */
-        STREG   %r2,PT_GR19(%r1)        /* save for child */
-        STREG   %r30,PT_GR21(%r1)
-        BL      sys_clone,%r2
        copy    %r1,%r24
-        b       wrapper_exit
-        LDREG   -RP_OFFSET-FRAME_SIZE(%r30),%r2
 ENDPROC(sys_clone_wrapper)
@@ -1851,72 +1732,14 @@ ENTRY(sys_vfork_wrapper)
        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
        ldo     TASK_REGS(%r1),%r1      /* get pt regs */
        reg_save %r1
-        mfctl   %cr27, %r3
+        mfctl   %cr27, %r28
-        STREG   %r3, PT_CR27(%r1)
+        STREG   %r28, PT_CR27(%r1)
-        STREG   %r2,-RP_OFFSET(%r30)
+        b       sys_vfork
-        ldo     FRAME_SIZE(%r30),%r30
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-#endif
-        STREG   %r2,PT_GR19(%r1)        /* save for child */
-        STREG   %r30,PT_GR21(%r1)
-        BL      sys_vfork,%r2
        copy    %r1,%r26
-        b       wrapper_exit
-        LDREG   -RP_OFFSET-FRAME_SIZE(%r30),%r2
 ENDPROC(sys_vfork_wrapper)
        
-        .macro  execve_wrapper execve
-        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
-        ldo     TASK_REGS(%r1),%r1      /* get pt regs */
-        /*
-         * Do we need to save/restore r3-r18 here?
-         * I don't think so. why would new thread need old
-         * threads registers?
-         */
-        /* %arg0 - %arg3 are already saved for us. */
-        STREG %r2,-RP_OFFSET(%r30)
-        ldo FRAME_SIZE(%r30),%r30
-#ifdef CONFIG_64BIT
-        ldo     -16(%r30),%r29          /* Reference param save area */
-#endif
-        BL \execve,%r2
-        copy %r1,%arg0
-        ldo -FRAME_SIZE(%r30),%r30
-        LDREG -RP_OFFSET(%r30),%r2
-        /* If exec succeeded we need to load the args */
-        ldo -1024(%r0),%r1
-        cmpb,>>= %r28,%r1,error_\execve
-        copy %r2,%r19
-error_\execve:
-        bv %r0(%r19)
-        nop
-        .endm
-        .import sys_execve
-ENTRY(sys_execve_wrapper)
-        execve_wrapper sys_execve
-ENDPROC(sys_execve_wrapper)
-#ifdef CONFIG_64BIT
-        .import sys32_execve
-ENTRY(sys32_execve_wrapper)
-        execve_wrapper sys32_execve
-ENDPROC(sys32_execve_wrapper)
-#endif
 ENTRY(sys_rt_sigreturn_wrapper)
        LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r26
        ldo     TASK_REGS(%r26),%r26    /* get pt regs */
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index cbc37216bf90..38db36f64307 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -52,6 +52,7 @@
 #include <asm/io.h>
 #include <asm/asm-offsets.h>
+#include <asm/assembly.h>
 #include <asm/pdc.h>
 #include <asm/pdc_chassis.h>
 #include <asm/pgalloc.h>
@@ -165,23 +166,6 @@ void (*pm_power_off)(void) = machine_power_off;
 EXPORT_SYMBOL(pm_power_off);
 /*
- * Create a kernel thread
- */
-extern pid_t __kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
-pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
-{
-        /*
-         * FIXME: Once we are sure we don't need any debug here,
-         *        kernel_thread can become a #define.
-         */
-        return __kernel_thread(fn, arg, flags);
-}
-EXPORT_SYMBOL(kernel_thread);
-/*
 * Free current thread data structures etc..
 */
 void exit_thread(void)
@@ -256,8 +240,8 @@ sys_vfork(struct pt_regs *regs)
 int
 copy_thread(unsigned long clone_flags, unsigned long usp,
-            unsigned long unused,       /* in ia64 this is "user_stack_size" */
+            unsigned long arg,
-            struct task_struct * p, struct pt_regs * pregs)
+            struct task_struct *p, struct pt_regs *pregs)
 {
        struct pt_regs * cregs = &(p->thread.regs);
        void *stack = task_stack_page(p);
@@ -270,48 +254,32 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
 #ifdef CONFIG_HPUX
        extern void * const hpux_child_return;
 #endif
+        if (unlikely(p->flags & PF_KTHREAD)) {
+                memset(cregs, 0, sizeof(struct pt_regs));
+                if (!usp) /* idle thread */
+                        return 0;
-        *cregs = *pregs;
-        /* Set the return value for the child.  Note that this is not
-           actually restored by the syscall exit path, but we put it
-           here for consistency in case of signals. */
-        cregs->gr[28] = 0; /* child */
-        /*
-         * We need to differentiate between a user fork and a
-         * kernel fork. We can't use user_mode, because the
-         * the syscall path doesn't save iaoq. Right now
-         * We rely on the fact that kernel_thread passes
-         * in zero for usp.
-         */
-        if (usp == 1) {
                /* kernel thread */
-                cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN;
                /* Must exit via ret_from_kernel_thread in order
                 * to call schedule_tail()
                 */
+                cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN + FRAME_SIZE;
                cregs->kpc = (unsigned long) &ret_from_kernel_thread;
                /*
                 * Copy function and argument to be called from
                 * ret_from_kernel_thread.
                 */
 #ifdef CONFIG_64BIT
-                cregs->gr[27] = pregs->gr[27];
+                cregs->gr[27] = ((unsigned long *)usp)[3];
+                cregs->gr[26] = ((unsigned long *)usp)[2];
+#else
+                cregs->gr[26] = usp;
 #endif
-                cregs->gr[26] = pregs->gr[26];
+                cregs->gr[25] = arg;
-                cregs->gr[25] = pregs->gr[25];
        } else {
                /* user thread */
-                /*
-                 * Note that the fork wrappers are responsible
-                 * for setting gr[21].
-                 */
-                /* Use same stack depth as parent */
-                cregs->ksp = (unsigned long)stack
-                        + (pregs->gr[21] & (THREAD_SIZE - 1));
                cregs->gr[30] = usp;
+                cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN + FRAME_SIZE;
                if (personality(p->personality) == PER_HPUX) {
 #ifdef CONFIG_HPUX
                        cregs->kpc = (unsigned long) &hpux_child_return;
@@ -323,8 +291,7 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
                }
                /* Setup thread TLS area from the 4th parameter in clone */
                if (clone_flags & CLONE_SETTLS)
-                  cregs->cr27 = pregs->gr[23];
+                        cregs->cr27 = pregs->gr[23];
-        
        }
        return 0;
@@ -335,39 +302,6 @@ unsigned long thread_saved_pc(struct task_struct *t)
        return t->thread.regs.kpc;
 }
-/*
- * sys_execve() executes a new program.
- */
-asmlinkage int sys_execve(struct pt_regs *regs)
-{
-        int error;
-        struct filename *filename;
-        filename = getname((const char __user *) regs->gr[26]);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name,
-                          (const char __user *const __user *) regs->gr[25],
-                          (const char __user *const __user *) regs->gr[24],
-                          regs);
-        putname(filename);
-out:
-        return error;
-}
-extern int __execve(const char *filename,
-                    const char *const argv[],
-                    const char *const envp[], struct task_struct *task);
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
-{
-        return __execve(filename, argv, envp, current);
-}
 unsigned long
 get_wchan(struct task_struct *p)
 {
diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
index bf5b93a885d3..9cfdaa19ab63 100644
--- a/arch/parisc/kernel/sys_parisc32.c
+++ b/arch/parisc/kernel/sys_parisc32.c
@@ -53,28 +53,6 @@
 #define DBG(x)
 #endif
-/*
- * sys32_execve() executes a new program.
- */
-asmlinkage int sys32_execve(struct pt_regs *regs)
-{
-        int error;
-        struct filename *filename;
-        DBG(("sys32_execve(%p) r26 = 0x%lx\n", regs, regs->gr[26]));
-        filename = getname((const char __user *) regs->gr[26]);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = compat_do_execve(filename->name, compat_ptr(regs->gr[25]),
-                                 compat_ptr(regs->gr[24]), regs);
-        putname(filename);
-out:
-        return error;
-}
 asmlinkage long sys32_unimplemented(int r26, int r25, int r24, int r23,
        int r22, int r21, int r20)
 {
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 3735abd7f8f6..cb2da96d6ab9 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -66,7 +66,7 @@
        ENTRY_SAME(creat)
        ENTRY_SAME(link)
        ENTRY_SAME(unlink)              /* 10 */
-        ENTRY_DIFF(execve_wrapper)
+        ENTRY_COMP(execve)
        ENTRY_SAME(chdir)
        /* See comments in kernel/time.c!!! Maybe we don't need this? */
        ENTRY_COMP(time)
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 5dba755a43e6..af431de6363c 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -137,6 +137,7 @@ config S390
        select KTIME_SCALAR if 32BIT
        select HAVE_ARCH_SECCOMP_FILTER
        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        select HAVE_MOD_ARCH_SPECIFIC
        select MODULES_USE_ELF_RELA
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index 55bde6035216..ad2b924167d7 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -9,6 +9,8 @@
 #define LPM_ANYPATH 0xff
 #define __MAX_CSSID 0
+#define __MAX_SUBCHANNEL 65535
+#define __MAX_SSID 3
 #include <asm/scsw.h>
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index dd647c919a66..2d3b7cb26005 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -506,12 +506,15 @@ static inline int pud_bad(pud_t pud)
 static inline int pmd_present(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN) != 0UL;
+        unsigned long mask = _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO;
+        return (pmd_val(pmd) & mask) == _HPAGE_TYPE_NONE ||
+               !(pmd_val(pmd) & _SEGMENT_ENTRY_INV);
 }
 static inline int pmd_none(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _SEGMENT_ENTRY_INV) != 0UL;
+        return (pmd_val(pmd) & _SEGMENT_ENTRY_INV) &&
+               !(pmd_val(pmd) & _SEGMENT_ENTRY_RO);
 }
 static inline int pmd_large(pmd_t pmd)
@@ -1223,6 +1226,11 @@ static inline void __pmd_idte(unsigned long address, pmd_t *pmdp)
 }
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#define SEGMENT_NONE    __pgprot(_HPAGE_TYPE_NONE)
+#define SEGMENT_RO      __pgprot(_HPAGE_TYPE_RO)
+#define SEGMENT_RW      __pgprot(_HPAGE_TYPE_RW)
 #define __HAVE_ARCH_PGTABLE_DEPOSIT
 extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable);
@@ -1242,16 +1250,15 @@ static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
 static inline unsigned long massage_pgprot_pmd(pgprot_t pgprot)
 {
-        unsigned long pgprot_pmd = 0;
+        /*
+         * pgprot is PAGE_NONE, PAGE_RO, or PAGE_RW (see __Pxxx / __Sxxx)
-        if (pgprot_val(pgprot) & _PAGE_INVALID) {
+         * Convert to segment table entry format.
-                if (pgprot_val(pgprot) & _PAGE_SWT)
+         */
-                        pgprot_pmd |= _HPAGE_TYPE_NONE;
+        if (pgprot_val(pgprot) == pgprot_val(PAGE_NONE))
-                pgprot_pmd |= _SEGMENT_ENTRY_INV;
+                return pgprot_val(SEGMENT_NONE);
-        }
+        if (pgprot_val(pgprot) == pgprot_val(PAGE_RO))
-        if (pgprot_val(pgprot) & _PAGE_RO)
+                return pgprot_val(SEGMENT_RO);
-                pgprot_pmd |= _SEGMENT_ENTRY_RO;
+        return pgprot_val(SEGMENT_RW);
-        return pgprot_pmd;
 }
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
@@ -1269,7 +1276,9 @@ static inline pmd_t pmd_mkhuge(pmd_t pmd)
 static inline pmd_t pmd_mkwrite(pmd_t pmd)
 {
-        pmd_val(pmd) &= ~_SEGMENT_ENTRY_RO;
+        /* Do not clobber _HPAGE_TYPE_NONE pages! */
+        if (!(pmd_val(pmd) & _SEGMENT_ENTRY_INV))
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_RO;
        return pmd;
 }
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index bbbae41fa9a5..ccbcab7742cd 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -54,7 +54,6 @@
 #   define __ARCH_WANT_COMPAT_SYS_RT_SIGSUSPEND
 # endif
 #define __ARCH_WANT_SYS_EXECVE
-#define __ARCH_WANT_KERNEL_EXECVE
 /*
 * "Conditional" syscalls
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index ef46f66bc0d6..aa8f2ba6289b 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -330,40 +330,18 @@ ENTRY(ret_from_fork)
        la      %r11,STACK_FRAME_OVERHEAD(%r15)
        l       %r12,__LC_THREAD_INFO
        l       %r13,__LC_SVC_NEW_PSW+4
-        tm      __PT_PSW+1(%r11),0x01   # forking a kernel thread ?
-        je      1f
        l       %r1,BASED(.Lschedule_tail)
        basr    %r14,%r1                # call schedule_tail
        TRACE_IRQS_ON
        ssm     __LC_SVC_NEW_PSW        # reenable interrupts
-        j       sysc_tracenogo
+        tm      __PT_PSW+1(%r11),0x01   # forking a kernel thread ?
+        jne     sysc_tracenogo
-1:      # it's a kernel thread
+        # it's a kernel thread
-        st      %r15,__PT_R15(%r11)     # store stack pointer for new kthread
+        lm      %r9,%r10,__PT_R9(%r11)  # load gprs
-        l       %r1,BASED(.Lschedule_tail)
-        basr    %r14,%r1                # call schedule_tail
-        TRACE_IRQS_ON
-        ssm     __LC_SVC_NEW_PSW        # reenable interrupts
-        lm      %r9,%r11,__PT_R9(%r11)  # load gprs
 ENTRY(kernel_thread_starter)
        la      %r2,0(%r10)
        basr    %r14,%r9
-        la      %r2,0
+        j       sysc_tracenogo
-        br      %r11                    # do_exit
-#
-# kernel_execve function needs to deal with pt_regs that is not
-# at the usual place
-#
-ENTRY(ret_from_kernel_execve)
-        ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
-        lr      %r15,%r2
-        lr      %r11,%r2
-        ahi     %r15,-STACK_FRAME_OVERHEAD
-        xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
-        l       %r12,__LC_THREAD_INFO
-        ssm     __LC_SVC_NEW_PSW        # reenable interrupts
-        j       sysc_return
 /*
 * Program check handler routine
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 07d8de353984..499e95e90f38 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -352,33 +352,17 @@ sysc_tracenogo:
 ENTRY(ret_from_fork)
        la      %r11,STACK_FRAME_OVERHEAD(%r15)
        lg      %r12,__LC_THREAD_INFO
-        tm      __PT_PSW+1(%r11),0x01   # forking a kernel thread ?
-        je      1f
        brasl   %r14,schedule_tail
        TRACE_IRQS_ON
        ssm     __LC_SVC_NEW_PSW        # reenable interrupts
-        j       sysc_tracenogo
+        tm      __PT_PSW+1(%r11),0x01   # forking a kernel thread ?
-1:      # it's a kernel thread
+        jne     sysc_tracenogo
-        stg     %r15,__PT_R15(%r11)     # store stack pointer for new kthread
+        # it's a kernel thread
-        brasl   %r14,schedule_tail
+        lmg     %r9,%r10,__PT_R9(%r11)  # load gprs
-        TRACE_IRQS_ON
-        ssm     __LC_SVC_NEW_PSW        # reenable interrupts
-        lmg     %r9,%r11,__PT_R9(%r11)  # load gprs
 ENTRY(kernel_thread_starter)
        la      %r2,0(%r10)
        basr    %r14,%r9
-        la      %r2,0
+        j       sysc_tracenogo
-        br      %r11                    # do_exit
-ENTRY(ret_from_kernel_execve)
-        ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
-        lgr     %r15,%r2
-        lgr     %r11,%r2
-        aghi    %r15,-STACK_FRAME_OVERHEAD
-        xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
-        lg      %r12,__LC_THREAD_INFO
-        ssm     __LC_SVC_NEW_PSW        # reenable interrupts
-        j       sysc_return
 /*
 * Program check handler routine
diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
index bf053898630d..b6506ee32a36 100644
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -44,6 +44,12 @@ _sclp_wait_int:
 #endif
        mvc     .LoldpswS1-.LbaseS1(16,%r13),0(%r8)
        mvc     0(16,%r8),0(%r9)
+#ifdef CONFIG_64BIT
+        epsw    %r6,%r7                         # set current addressing mode
+        nill    %r6,0x1                         # in new psw (31 or 64 bit mode)
+        nilh    %r7,0x8000
+        stm     %r6,%r7,0(%r8)
+#endif
        lhi     %r6,0x0200                      # cr mask for ext int (cr0.54)
        ltr     %r2,%r2
        jz      .LsetctS1
@@ -87,7 +93,7 @@ _sclp_wait_int:
        .long   0x00080000, 0x80000000+.LwaitS1 # PSW to handle ext int
 #ifdef CONFIG_64BIT
 .LextpswS1_64:
-        .quad   0x0000000180000000, .LwaitS1    # PSW to handle ext int, 64 bit
+        .quad   0, .LwaitS1                     # PSW to handle ext int, 64 bit
 #endif
 .LwaitpswS1:
        .long   0x010a0000, 0x00000000+.LloopS1 # PSW to wait for ext int
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 2d37bb861faf..9017a63dda3d 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -39,7 +39,7 @@ static __always_inline unsigned long follow_table(struct mm_struct *mm,
        pmd = pmd_offset(pud, addr);
        if (pmd_none(*pmd))
                return -0x10UL;
-        if (pmd_huge(*pmd)) {
+        if (pmd_large(*pmd)) {
                if (write && (pmd_val(*pmd) & _SEGMENT_ENTRY_RO))
                        return -0x04UL;
                return (pmd_val(*pmd) & HPAGE_MASK) + (addr & ~HPAGE_MASK);
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 60acb93a4680..8b8285310b5a 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -126,7 +126,7 @@ static inline int gup_pmd_range(pud_t *pudp, pud_t pud, unsigned long addr,
                 */
                if (pmd_none(pmd) || pmd_trans_splitting(pmd))
                        return 0;
-                if (unlikely(pmd_huge(pmd))) {
+                if (unlikely(pmd_large(pmd))) {
                        if (!gup_huge_pmd(pmdp, pmd, addr, next,
                                          write, pages, nr))
                                return 0;
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index b6b442b0d793..0c7d365fa402 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -20,6 +20,7 @@ config SPARC
        select HAVE_ARCH_TRACEHOOK
        select SYSCTL_EXCEPTION_TRACE
        select ARCH_WANT_OPTIONAL_GPIOLIB
+        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
        select RTC_CLASS
        select RTC_DRV_M48T59
        select HAVE_IRQ_WORK
@@ -40,6 +41,8 @@ config SPARC
        select GENERIC_STRNCPY_FROM_USER
        select GENERIC_STRNLEN_USER
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
 config SPARC32
        def_bool !64BIT
diff --git a/arch/sparc/crypto/Makefile b/arch/sparc/crypto/Makefile
index 6ae1ad5e502b..5d469d81761f 100644
--- a/arch/sparc/crypto/Makefile
+++ b/arch/sparc/crypto/Makefile
@@ -13,13 +13,13 @@ obj-$(CONFIG_CRYPTO_DES_SPARC64) += camellia-sparc64.o
 obj-$(CONFIG_CRYPTO_CRC32C_SPARC64) += crc32c-sparc64.o
-sha1-sparc64-y := sha1_asm.o sha1_glue.o crop_devid.o
+sha1-sparc64-y := sha1_asm.o sha1_glue.o
-sha256-sparc64-y := sha256_asm.o sha256_glue.o crop_devid.o
+sha256-sparc64-y := sha256_asm.o sha256_glue.o
-sha512-sparc64-y := sha512_asm.o sha512_glue.o crop_devid.o
+sha512-sparc64-y := sha512_asm.o sha512_glue.o
-md5-sparc64-y := md5_asm.o md5_glue.o crop_devid.o
+md5-sparc64-y := md5_asm.o md5_glue.o
-aes-sparc64-y := aes_asm.o aes_glue.o crop_devid.o
+aes-sparc64-y := aes_asm.o aes_glue.o
-des-sparc64-y := des_asm.o des_glue.o crop_devid.o
+des-sparc64-y := des_asm.o des_glue.o
-camellia-sparc64-y := camellia_asm.o camellia_glue.o crop_devid.o
+camellia-sparc64-y := camellia_asm.o camellia_glue.o
-crc32c-sparc64-y := crc32c_asm.o crc32c_glue.o crop_devid.o
+crc32c-sparc64-y := crc32c_asm.o crc32c_glue.o
diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c
index 8f1c9980f637..3965d1d36dfa 100644
--- a/arch/sparc/crypto/aes_glue.c
+++ b/arch/sparc/crypto/aes_glue.c
@@ -475,3 +475,5 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("AES Secure Hash Algorithm, sparc64 aes opcode accelerated");
 MODULE_ALIAS("aes");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c
index 42905c084299..62c89af3fd3f 100644
--- a/arch/sparc/crypto/camellia_glue.c
+++ b/arch/sparc/crypto/camellia_glue.c
@@ -320,3 +320,5 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Camellia Cipher Algorithm, sparc64 camellia opcode accelerated");
 MODULE_ALIAS("aes");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/crc32c_glue.c b/arch/sparc/crypto/crc32c_glue.c
index 0bd89cea8d8e..5162fad912ce 100644
--- a/arch/sparc/crypto/crc32c_glue.c
+++ b/arch/sparc/crypto/crc32c_glue.c
@@ -177,3 +177,5 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CRC32c (Castagnoli), sparc64 crc32c opcode accelerated");
 MODULE_ALIAS("crc32c");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c
index c4940c2d3073..41524cebcc49 100644
--- a/arch/sparc/crypto/des_glue.c
+++ b/arch/sparc/crypto/des_glue.c
@@ -527,3 +527,5 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms, sparc64 des opcode accelerated");
 MODULE_ALIAS("des");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/md5_glue.c b/arch/sparc/crypto/md5_glue.c
index 603d723038ce..09a9ea1dfb69 100644
--- a/arch/sparc/crypto/md5_glue.c
+++ b/arch/sparc/crypto/md5_glue.c
@@ -186,3 +186,5 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MD5 Secure Hash Algorithm, sparc64 md5 opcode accelerated");
 MODULE_ALIAS("md5");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/sha1_glue.c b/arch/sparc/crypto/sha1_glue.c
index 2bbb20bee9f1..6cd5f29e1e0d 100644
--- a/arch/sparc/crypto/sha1_glue.c
+++ b/arch/sparc/crypto/sha1_glue.c
@@ -181,3 +181,5 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, sparc64 sha1 opcode accelerated");
 MODULE_ALIAS("sha1");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/sha256_glue.c b/arch/sparc/crypto/sha256_glue.c
index 591e656bd891..04f555ab2680 100644
--- a/arch/sparc/crypto/sha256_glue.c
+++ b/arch/sparc/crypto/sha256_glue.c
@@ -239,3 +239,5 @@ MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm, sparc64 sha256 op
 MODULE_ALIAS("sha224");
 MODULE_ALIAS("sha256");
+#include "crop_devid.c"
diff --git a/arch/sparc/crypto/sha512_glue.c b/arch/sparc/crypto/sha512_glue.c
index 486f0a2b7001..f04d1994d19a 100644
--- a/arch/sparc/crypto/sha512_glue.c
+++ b/arch/sparc/crypto/sha512_glue.c
@@ -224,3 +224,5 @@ MODULE_DESCRIPTION("SHA-384 and SHA-512 Secure Hash Algorithm, sparc64 sha512 op
 MODULE_ALIAS("sha384");
 MODULE_ALIAS("sha512");
+#include "crop_devid.c"
diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
index ce35a1cf1a20..be56a244c9cf 100644
--- a/arch/sparc/include/asm/atomic_64.h
+++ b/arch/sparc/include/asm/atomic_64.h
@@ -1,7 +1,7 @@
 /* atomic.h: Thankfully the V9 is at least reasonable for this
 *           stuff.
 *
- * Copyright (C) 1996, 1997, 2000 David S. Miller (davem@redhat.com)
+ * Copyright (C) 1996, 1997, 2000, 2012 David S. Miller (davem@redhat.com)
 */
 #ifndef __ARCH_SPARC64_ATOMIC__
@@ -106,6 +106,8 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+extern long atomic64_dec_if_positive(atomic64_t *v);
 /* Atomic operations are already serializing */
 #define smp_mb__before_atomic_dec()     barrier()
 #define smp_mb__after_atomic_dec()      barrier()
diff --git a/arch/sparc/include/asm/backoff.h b/arch/sparc/include/asm/backoff.h
index db3af0d30fb1..4e02086b839c 100644
--- a/arch/sparc/include/asm/backoff.h
+++ b/arch/sparc/include/asm/backoff.h
@@ -1,6 +1,46 @@
 #ifndef _SPARC64_BACKOFF_H
 #define _SPARC64_BACKOFF_H
+/* The macros in this file implement an exponential backoff facility
+ * for atomic operations.
+ *
+ * When multiple threads compete on an atomic operation, it is
+ * possible for one thread to be continually denied a successful
+ * completion of the compare-and-swap instruction.  Heavily
+ * threaded cpu implementations like Niagara can compound this
+ * problem even further.
+ *
+ * When an atomic operation fails and needs to be retried, we spin a
+ * certain number of times.  At each subsequent failure of the same
+ * operation we double the spin count, realizing an exponential
+ * backoff.
+ *
+ * When we spin, we try to use an operation that will cause the
+ * current cpu strand to block, and therefore make the core fully
+ * available to any other other runnable strands.  There are two
+ * options, based upon cpu capabilities.
+ *
+ * On all cpus prior to SPARC-T4 we do three dummy reads of the
+ * condition code register.  Each read blocks the strand for something
+ * between 40 and 50 cpu cycles.
+ *
+ * For SPARC-T4 and later we have a special "pause" instruction
+ * available.  This is implemented using writes to register %asr27.
+ * The cpu will block the number of cycles written into the register,
+ * unless a disrupting trap happens first.  SPARC-T4 specifically
+ * implements pause with a granularity of 8 cycles.  Each strand has
+ * an internal pause counter which decrements every 8 cycles.  So the
+ * chip shifts the %asr27 value down by 3 bits, and writes the result
+ * into the pause counter.  If a value smaller than 8 is written, the
+ * chip blocks for 1 cycle.
+ *
+ * To achieve the same amount of backoff as the three %ccr reads give
+ * on earlier chips, we shift the backoff value up by 7 bits.  (Three
+ * %ccr reads block for about 128 cycles, 1 << 7 == 128) We write the
+ * whole amount we want to block into the pause register, rather than
+ * loop writing 128 each time.
+ */
 #define BACKOFF_LIMIT   (4 * 1024)
 #ifdef CONFIG_SMP
@@ -11,16 +51,25 @@
 #define BACKOFF_LABEL(spin_label, continue_label) \
        spin_label
-#define BACKOFF_SPIN(reg, tmp, label)   \
+#define BACKOFF_SPIN(reg, tmp, label)           \
-        mov     reg, tmp; \
+        mov             reg, tmp;               \
-88:     brnz,pt tmp, 88b; \
+88:     rd              %ccr, %g0;              \
-         sub    tmp, 1, tmp; \
+        rd              %ccr, %g0;              \
-        set     BACKOFF_LIMIT, tmp; \
+        rd              %ccr, %g0;              \
-        cmp     reg, tmp; \
+        .section        .pause_3insn_patch,"ax";\
-        bg,pn   %xcc, label; \
+        .word           88b;                    \
-         nop; \
+        sllx            tmp, 7, tmp;            \
-        ba,pt   %xcc, label; \
+        wr              tmp, 0, %asr27;         \
-         sllx   reg, 1, reg;
+        clr             tmp;                    \
+        .previous;                              \
+        brnz,pt         tmp, 88b;               \
+         sub            tmp, 1, tmp;            \
+        set             BACKOFF_LIMIT, tmp;     \
+        cmp             reg, tmp;               \
+        bg,pn           %xcc, label;            \
+         nop;                                   \
+        ba,pt           %xcc, label;            \
+         sllx           reg, 1, reg;
 #else
diff --git a/arch/sparc/include/asm/compat.h b/arch/sparc/include/asm/compat.h
index cef99fbc0a21..830502fe62b4 100644
--- a/arch/sparc/include/asm/compat.h
+++ b/arch/sparc/include/asm/compat.h
@@ -232,9 +232,10 @@ static inline void __user *arch_compat_alloc_user_space(long len)
        struct pt_regs *regs = current_thread_info()->kregs;
        unsigned long usp = regs->u_regs[UREG_I6];
-        if (!(test_thread_flag(TIF_32BIT)))
+        if (test_thread_64bit_stack(usp))
                usp += STACK_BIAS;
-        else
+        if (test_thread_flag(TIF_32BIT))
                usp &= 0xffffffffUL;
        usp -= len;
diff --git a/arch/sparc/include/asm/processor_32.h b/arch/sparc/include/asm/processor_32.h
index f74ac9ee33a8..c1e01914fd98 100644
--- a/arch/sparc/include/asm/processor_32.h
+++ b/arch/sparc/include/asm/processor_32.h
@@ -106,7 +106,6 @@ static inline void start_thread(struct pt_regs * regs, unsigned long pc,
 /* Free all resources held by a thread. */
 #define release_thread(tsk)             do { } while(0)
-extern pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern unsigned long get_wchan(struct task_struct *);
diff --git a/arch/sparc/include/asm/processor_64.h b/arch/sparc/include/asm/processor_64.h
index 4e5a483122a0..cce72ce4c334 100644
--- a/arch/sparc/include/asm/processor_64.h
+++ b/arch/sparc/include/asm/processor_64.h
@@ -94,6 +94,7 @@ struct thread_struct {
 #ifndef __ASSEMBLY__
 #include <linux/types.h>
+#include <asm/fpumacro.h>
 /* Return saved PC of a blocked thread. */
 struct task_struct;
@@ -143,6 +144,10 @@ do { \
        : \
        : "r" (regs), "r" (sp - sizeof(struct reg_window) - STACK_BIAS), \
          "i" ((const unsigned long)(&((struct pt_regs *)0)->u_regs[0]))); \
+        fprs_write(0);  \
+        current_thread_info()->xfsr[0] = 0;     \
+        current_thread_info()->fpsaved[0] = 0;  \
+        regs->tstate &= ~TSTATE_PEF;    \
 } while (0)
 #define start_thread32(regs, pc, sp) \
@@ -183,20 +188,37 @@ do { \
        : \
        : "r" (regs), "r" (sp - sizeof(struct reg_window32)), \
          "i" ((const unsigned long)(&((struct pt_regs *)0)->u_regs[0]))); \
+        fprs_write(0);  \
+        current_thread_info()->xfsr[0] = 0;     \
+        current_thread_info()->fpsaved[0] = 0;  \
+        regs->tstate &= ~TSTATE_PEF;    \
 } while (0)
 /* Free all resources held by a thread. */
 #define release_thread(tsk)             do { } while (0)
-extern pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern unsigned long get_wchan(struct task_struct *task);
 #define task_pt_regs(tsk) (task_thread_info(tsk)->kregs)
 #define KSTK_EIP(tsk)  (task_pt_regs(tsk)->tpc)
 #define KSTK_ESP(tsk)  (task_pt_regs(tsk)->u_regs[UREG_FP])
-#define cpu_relax()     barrier()
+/* Please see the commentary in asm/backoff.h for a description of
+ * what these instructions are doing and how they have been choosen.
+ * To make a long story short, we are trying to yield the current cpu
+ * strand during busy loops.
+ */
+#define cpu_relax()     asm volatile("\n99:\n\t"                        \
+                                     "rd        %%ccr, %%g0\n\t"        \
+                                     "rd        %%ccr, %%g0\n\t"        \
+                                     "rd        %%ccr, %%g0\n\t"        \
+                                     ".section  .pause_3insn_patch,\"ax\"\n\t"\
+                                     ".word     99b\n\t"                \
+                                     "wr        %%g0, 128, %%asr27\n\t" \
+                                     "nop\n\t"                          \
+                                     "nop\n\t"                          \
+                                     ".previous"                        \
+                                     ::: "memory")
 /* Prefetch support.  This is tuned for UltraSPARC-III and later.
 * UltraSPARC-I will treat these as nops, and UltraSPARC-II has
diff --git a/arch/sparc/include/asm/prom.h b/arch/sparc/include/asm/prom.h
index c28765110706..f93003123bce 100644
--- a/arch/sparc/include/asm/prom.h
+++ b/arch/sparc/include/asm/prom.h
@@ -63,5 +63,10 @@ extern char *of_console_options;
 extern void irq_trans_init(struct device_node *dp);
 extern char *build_path_component(struct device_node *dp);
+/* SPARC has a local implementation */
+extern int of_address_to_resource(struct device_node *dev, int index,
+                                  struct resource *r);
+#define of_address_to_resource of_address_to_resource
 #endif /* __KERNEL__ */
 #endif /* _SPARC_PROM_H */
diff --git a/arch/sparc/include/asm/ptrace.h b/arch/sparc/include/asm/ptrace.h
index da43bdc62294..bdfafd7af46f 100644
--- a/arch/sparc/include/asm/ptrace.h
+++ b/arch/sparc/include/asm/ptrace.h
@@ -32,6 +32,9 @@ static inline bool pt_regs_clear_syscall(struct pt_regs *regs)
 #define arch_ptrace_stop(exit_code, info) \
        synchronize_user_stack()
+#define current_pt_regs() \
+        ((struct pt_regs *)((unsigned long)current_thread_info() + THREAD_SIZE) - 1)
 struct global_reg_snapshot {
        unsigned long           tstate;
        unsigned long           tpc;
@@ -55,9 +58,7 @@ union global_cpu_snapshot {
 extern union global_cpu_snapshot global_cpu_snapshot[NR_CPUS];
-#define force_successful_syscall_return()           \
+#define force_successful_syscall_return() set_thread_noerror(1)
-do {    current_thread_info()->syscall_noerror = 1; \
-} while (0)
 #define user_mode(regs) (!((regs)->tstate & TSTATE_PRIV))
 #define instruction_pointer(regs) ((regs)->tpc)
 #define instruction_pointer_set(regs, val) ((regs)->tpc = (val))
@@ -100,6 +101,9 @@ static inline bool pt_regs_clear_syscall(struct pt_regs *regs)
 #define arch_ptrace_stop(exit_code, info) \
        synchronize_user_stack()
+#define current_pt_regs() \
+        ((struct pt_regs *)((unsigned long)current_thread_info() + THREAD_SIZE) - 1)
 #define user_mode(regs) (!((regs)->psr & PSR_PS))
 #define instruction_pointer(regs) ((regs)->pc)
 #define user_stack_pointer(regs) ((regs)->u_regs[UREG_FP])
diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
index 7923c4a2be38..cad36f56fa03 100644
--- a/arch/sparc/include/asm/switch_to_64.h
+++ b/arch/sparc/include/asm/switch_to_64.h
@@ -23,7 +23,7 @@ do {	flush_tlb_pending();						\
        /* If you are tempted to conditionalize the following */        \
        /* so that ASI is only written if it changes, think again. */   \
        __asm__ __volatile__("wr %%g0, %0, %%asi"                       \
-        : : "r" (__thread_flag_byte_ptr(task_thread_info(next))[TI_FLAG_BYTE_CURRENT_DS]));\
+        : : "r" (task_thread_info(next)->current_ds));\
        trap_block[current_thread_info()->cpu].thread =                 \
                task_thread_info(next);                                 \
        __asm__ __volatile__(                                           \
diff --git a/arch/sparc/include/asm/syscalls.h b/arch/sparc/include/asm/syscalls.h
index 45a43f637a14..bf8972adea17 100644
--- a/arch/sparc/include/asm/syscalls.h
+++ b/arch/sparc/include/asm/syscalls.h
@@ -8,6 +8,4 @@ extern asmlinkage long sparc_do_fork(unsigned long clone_flags,
                                     struct pt_regs *regs,
                                     unsigned long stack_size);
-extern asmlinkage int sparc_execve(struct pt_regs *regs);
 #endif /* _SPARC64_SYSCALLS_H */
diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
index 4e2276631081..269bd92313df 100644
--- a/arch/sparc/include/asm/thread_info_64.h
+++ b/arch/sparc/include/asm/thread_info_64.h
@@ -14,12 +14,12 @@
 #define TI_FLAG_FAULT_CODE_SHIFT        56
 #define TI_FLAG_BYTE_WSTATE             1
 #define TI_FLAG_WSTATE_SHIFT            48
-#define TI_FLAG_BYTE_CWP                2
+#define TI_FLAG_BYTE_NOERROR            2
-#define TI_FLAG_CWP_SHIFT               40
+#define TI_FLAG_BYTE_NOERROR_SHIFT      40
-#define TI_FLAG_BYTE_CURRENT_DS         3
+#define TI_FLAG_BYTE_FPDEPTH            3
-#define TI_FLAG_CURRENT_DS_SHIFT        32
+#define TI_FLAG_FPDEPTH_SHIFT           32
-#define TI_FLAG_BYTE_FPDEPTH            4
+#define TI_FLAG_BYTE_CWP                4
-#define TI_FLAG_FPDEPTH_SHIFT           24
+#define TI_FLAG_CWP_SHIFT               24
 #define TI_FLAG_BYTE_WSAVED             5
 #define TI_FLAG_WSAVED_SHIFT            16
@@ -47,7 +47,7 @@ struct thread_info {
        struct exec_domain      *exec_domain;
        int                     preempt_count;  /* 0 => preemptable, <0 => BUG */
        __u8                    new_child;
-        __u8                    syscall_noerror;
+        __u8                    current_ds;
        __u16                   cpu;
        unsigned long           *utraps;
@@ -74,9 +74,9 @@ struct thread_info {
 #define TI_FAULT_CODE   (TI_FLAGS + TI_FLAG_BYTE_FAULT_CODE)
 #define TI_WSTATE       (TI_FLAGS + TI_FLAG_BYTE_WSTATE)
 #define TI_CWP          (TI_FLAGS + TI_FLAG_BYTE_CWP)
-#define TI_CURRENT_DS   (TI_FLAGS + TI_FLAG_BYTE_CURRENT_DS)
 #define TI_FPDEPTH      (TI_FLAGS + TI_FLAG_BYTE_FPDEPTH)
 #define TI_WSAVED       (TI_FLAGS + TI_FLAG_BYTE_WSAVED)
+#define TI_SYS_NOERROR  (TI_FLAGS + TI_FLAG_BYTE_NOERROR)
 #define TI_FPSAVED      0x00000010
 #define TI_KSP          0x00000018
 #define TI_FAULT_ADDR   0x00000020
@@ -84,7 +84,7 @@ struct thread_info {
 #define TI_EXEC_DOMAIN  0x00000030
 #define TI_PRE_COUNT    0x00000038
 #define TI_NEW_CHILD    0x0000003c
-#define TI_SYS_NOERROR  0x0000003d
+#define TI_CURRENT_DS   0x0000003d
 #define TI_CPU          0x0000003e
 #define TI_UTRAPS       0x00000040
 #define TI_REG_WINDOW   0x00000048
@@ -121,7 +121,7 @@ struct thread_info {
 #define INIT_THREAD_INFO(tsk)                           \
 {                                                       \
        .task           =       &tsk,                   \
-        .flags          = ((unsigned long)ASI_P) << TI_FLAG_CURRENT_DS_SHIFT,   \
+        .current_ds     =       ASI_P,                  \
        .exec_domain    =       &default_exec_domain,   \
        .preempt_count  =       INIT_PREEMPT_COUNT,     \
        .restart_block  = {                             \
@@ -153,13 +153,12 @@ register struct thread_info *current_thread_info_reg asm("g6");
 #define set_thread_wstate(val)          (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_WSTATE] = (val))
 #define get_thread_cwp()                (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_CWP])
 #define set_thread_cwp(val)             (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_CWP] = (val))
-#define get_thread_current_ds()         (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_CURRENT_DS])
+#define get_thread_noerror()            (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_NOERROR])
-#define set_thread_current_ds(val)      (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_CURRENT_DS] = (val))
+#define set_thread_noerror(val)         (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_NOERROR] = (val))
 #define get_thread_fpdepth()            (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_FPDEPTH])
 #define set_thread_fpdepth(val)         (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_FPDEPTH] = (val))
 #define get_thread_wsaved()             (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_WSAVED])
 #define set_thread_wsaved(val)          (__cur_thread_flag_byte_ptr[TI_FLAG_BYTE_WSAVED] = (val))
 #endif /* !(__ASSEMBLY__) */
 /*
@@ -259,6 +258,11 @@ static inline bool test_and_clear_restore_sigmask(void)
 #define tsk_is_polling(t) test_tsk_thread_flag(t, TIF_POLLING_NRFLAG)
+#define thread32_stack_is_64bit(__SP) (((__SP) & 0x1) != 0)
+#define test_thread_64bit_stack(__SP) \
+        ((test_thread_flag(TIF_32BIT) && !thread32_stack_is_64bit(__SP)) ? \
+         false : true)
 #endif  /* !__ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/sparc/include/asm/ttable.h b/arch/sparc/include/asm/ttable.h
index 48f2807d3265..71b5a67522ab 100644
--- a/arch/sparc/include/asm/ttable.h
+++ b/arch/sparc/include/asm/ttable.h
@@ -372,7 +372,9 @@ etrap_spill_fixup_64bit:				\
 /* Normal 32bit spill */
 #define SPILL_2_GENERIC(ASI)                            \
-        srl     %sp, 0, %sp;                            \
+        and     %sp, 1, %g3;                            \
+        brnz,pn %g3, (. - (128 + 4));                   \
+         srl    %sp, 0, %sp;                            \
        stwa    %l0, [%sp + %g0] ASI;                   \
        mov     0x04, %g3;                              \
        stwa    %l1, [%sp + %g3] ASI;                   \
@@ -398,14 +400,16 @@ etrap_spill_fixup_64bit:				\
        stwa    %i6, [%g1 + %g0] ASI;                   \
        stwa    %i7, [%g1 + %g3] ASI;                   \
        saved;                                          \
-        retry; nop; nop;                                \
+        retry;                                          \
        b,a,pt  %xcc, spill_fixup_dax;                  \
        b,a,pt  %xcc, spill_fixup_mna;                  \
        b,a,pt  %xcc, spill_fixup;
 #define SPILL_2_GENERIC_ETRAP           \
 etrap_user_spill_32bit:                 \
-        srl     %sp, 0, %sp;            \
+        and     %sp, 1, %g3;            \
+        brnz,pn %g3, etrap_user_spill_64bit;    \
+         srl    %sp, 0, %sp;            \
        stwa    %l0, [%sp + 0x00] %asi; \
        stwa    %l1, [%sp + 0x04] %asi; \
        stwa    %l2, [%sp + 0x08] %asi; \
@@ -427,7 +431,7 @@ etrap_user_spill_32bit:			\
        ba,pt   %xcc, etrap_save;       \
         wrpr   %g1, %cwp;              \
        nop; nop; nop; nop;             \
-        nop; nop; nop; nop;             \
+        nop; nop;                       \
        ba,a,pt %xcc, etrap_spill_fixup_32bit; \
        ba,a,pt %xcc, etrap_spill_fixup_32bit; \
        ba,a,pt %xcc, etrap_spill_fixup_32bit;
@@ -592,7 +596,9 @@ user_rtt_fill_64bit:					\
 /* Normal 32bit fill */
 #define FILL_2_GENERIC(ASI)                             \
-        srl     %sp, 0, %sp;                            \
+        and     %sp, 1, %g3;                            \
+        brnz,pn %g3, (. - (128 + 4));                   \
+         srl    %sp, 0, %sp;                            \
        lduwa   [%sp + %g0] ASI, %l0;                   \
        mov     0x04, %g2;                              \
        mov     0x08, %g3;                              \
@@ -616,14 +622,16 @@ user_rtt_fill_64bit:					\
        lduwa   [%g1 + %g3] ASI, %i6;                   \
        lduwa   [%g1 + %g5] ASI, %i7;                   \
        restored;                                       \
-        retry; nop; nop; nop; nop;                      \
+        retry; nop; nop;                                \
        b,a,pt  %xcc, fill_fixup_dax;                   \
        b,a,pt  %xcc, fill_fixup_mna;                   \
        b,a,pt  %xcc, fill_fixup;
 #define FILL_2_GENERIC_RTRAP                            \
 user_rtt_fill_32bit:                                    \
-        srl     %sp, 0, %sp;                            \
+        and     %sp, 1, %g3;                            \
+        brnz,pn %g3, user_rtt_fill_64bit;               \
+         srl    %sp, 0, %sp;                            \
        lduwa   [%sp + 0x00] %asi, %l0;                 \
        lduwa   [%sp + 0x04] %asi, %l1;                 \
        lduwa   [%sp + 0x08] %asi, %l2;                 \
@@ -643,7 +651,7 @@ user_rtt_fill_32bit:					\
        ba,pt   %xcc, user_rtt_pre_restore;             \
         restored;                                      \
        nop; nop; nop; nop; nop;                        \
-        nop; nop; nop; nop; nop;                        \
+        nop; nop; nop;                                  \
        ba,a,pt %xcc, user_rtt_fill_fixup;              \
        ba,a,pt %xcc, user_rtt_fill_fixup;              \
        ba,a,pt %xcc, user_rtt_fill_fixup;
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index 73083e1d38d9..e562d3caee57 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -38,14 +38,14 @@
 #define VERIFY_READ     0
 #define VERIFY_WRITE    1
-#define get_fs() ((mm_segment_t) { get_thread_current_ds() })
+#define get_fs() ((mm_segment_t){(current_thread_info()->current_ds)})
 #define get_ds() (KERNEL_DS)
 #define segment_eq(a,b)  ((a).seg == (b).seg)
 #define set_fs(val)                                                             \
 do {                                                                            \
-        set_thread_current_ds((val).seg);                                       \
+        current_thread_info()->current_ds =(val).seg;                           \
        __asm__ __volatile__ ("wr %%g0, %0, %%asi" : : "r" ((val).seg));        \
 } while(0)
diff --git a/arch/sparc/include/asm/unistd.h b/arch/sparc/include/asm/unistd.h
index 0ecea6ed943e..c3e5d8b64171 100644
--- a/arch/sparc/include/asm/unistd.h
+++ b/arch/sparc/include/asm/unistd.h
@@ -46,6 +46,7 @@
 #define __ARCH_WANT_COMPAT_SYS_RT_SIGSUSPEND
 #define __ARCH_WANT_COMPAT_SYS_SENDFILE
 #endif
+#define __ARCH_WANT_SYS_EXECVE
 /*
 * "Conditional" syscalls
diff --git a/arch/sparc/include/uapi/asm/unistd.h b/arch/sparc/include/uapi/asm/unistd.h
index 8974ef7ae920..cac719d1bc5c 100644
--- a/arch/sparc/include/uapi/asm/unistd.h
+++ b/arch/sparc/include/uapi/asm/unistd.h
@@ -405,8 +405,13 @@
 #define __NR_setns              337
 #define __NR_process_vm_readv   338
 #define __NR_process_vm_writev  339
+#define __NR_kern_features      340
+#define __NR_kcmp               341
-#define NR_syscalls             340
+#define NR_syscalls             342
+/* Bitmask values returned from kern_features system call.  */
+#define KERN_FEATURE_MIXED_MODE_STACK   0x00000001
 #ifdef __32bit_syscall_numbers__
 /* Sparc 32-bit only has the "setresuid32", "getresuid32" variants,
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index dcaa1cf0de40..21fd1a8f47d2 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -806,23 +806,10 @@ sys_nis_syscall:
        call    c_sys_nis_syscall
         mov    %l5, %o7
-        .align  4
-        .globl  sys_execve
-sys_execve:
-        mov     %o7, %l5
-        add     %sp, STACKFRAME_SZ, %o0         ! pt_regs *regs arg
-        call    sparc_execve
-         mov    %l5, %o7
-        .globl  sunos_execv
 sunos_execv:
-        st      %g0, [%sp + STACKFRAME_SZ + PT_I2]
+        .globl  sunos_execv
+        b       sys_execve
-        call    sparc_execve
+         clr    %i2
-         add    %sp, STACKFRAME_SZ, %o0
-        b       ret_sys_call
-         ld     [%sp + STACKFRAME_SZ + PT_I0], %o0
        .align  4
        .globl  sys_sparc_pipe
@@ -959,17 +946,9 @@ flush_patch_four:
        .align  4
 linux_sparc_ni_syscall:
        sethi   %hi(sys_ni_syscall), %l7
-        b       syscall_is_too_hard
+        b       do_syscall
         or     %l7, %lo(sys_ni_syscall), %l7
-linux_fast_syscall:
-        andn    %l7, 3, %l7
-        mov     %i0, %o0
-        mov     %i1, %o1
-        mov     %i2, %o2
-        jmpl    %l7 + %g0, %g0
-         mov    %i3, %o3
 linux_syscall_trace:
        add     %sp, STACKFRAME_SZ, %o0
        call    syscall_trace
@@ -991,6 +970,23 @@ ret_from_fork:
        b       ret_sys_call
         ld     [%sp + STACKFRAME_SZ + PT_I0], %o0
+        .globl  ret_from_kernel_thread
+ret_from_kernel_thread:
+        call    schedule_tail
+         ld     [%g3 + TI_TASK], %o0
+        ld      [%sp + STACKFRAME_SZ + PT_G1], %l0
+        call    %l0
+         ld     [%sp + STACKFRAME_SZ + PT_G2], %o0
+        rd      %psr, %l1
+        ld      [%sp + STACKFRAME_SZ + PT_PSR], %l0
+        andn    %l0, PSR_CWP, %l0
+        nop
+        and     %l1, PSR_CWP, %l1
+        or      %l0, %l1, %l0
+        st      %l0, [%sp + STACKFRAME_SZ + PT_PSR]
+        b       ret_sys_call
+         mov    0, %o0
        /* Linux native system calls enter here... */
        .align  4
        .globl  linux_sparc_syscall
@@ -1002,11 +998,8 @@ linux_sparc_syscall:
        bgeu    linux_sparc_ni_syscall
         sll    %g1, 2, %l4
        ld      [%l7 + %l4], %l7
-        andcc   %l7, 1, %g0
-        bne     linux_fast_syscall
-         /* Just do first insn from SAVE_ALL in the delay slot */
-syscall_is_too_hard:
+do_syscall:
        SAVE_ALL_HEAD
         rd     %wim, %l3
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 0c218e4c0881..cc3c5cb47cda 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -59,6 +59,13 @@ struct popc_6insn_patch_entry {
 extern struct popc_6insn_patch_entry __popc_6insn_patch,
        __popc_6insn_patch_end;
+struct pause_patch_entry {
+        unsigned int    addr;
+        unsigned int    insns[3];
+};
+extern struct pause_patch_entry __pause_3insn_patch,
+        __pause_3insn_patch_end;
 extern void __init per_cpu_patch(void);
 extern void sun4v_patch_1insn_range(struct sun4v_1insn_patch_entry *,
                                    struct sun4v_1insn_patch_entry *);
diff --git a/arch/sparc/kernel/etrap_64.S b/arch/sparc/kernel/etrap_64.S
index 786b185e6e3f..1276ca2567ba 100644
--- a/arch/sparc/kernel/etrap_64.S
+++ b/arch/sparc/kernel/etrap_64.S
@@ -92,8 +92,10 @@ etrap_save:	save	%g2, -STACK_BIAS, %sp
                rdpr    %wstate, %g2
                wrpr    %g0, 0, %canrestore
                sll     %g2, 3, %g2
+                /* Set TI_SYS_FPDEPTH to 1 and clear TI_SYS_NOERROR.  */
                mov     1, %l5
-                stb     %l5, [%l6 + TI_FPDEPTH]
+                sth     %l5, [%l6 + TI_SYS_NOERROR]
                wrpr    %g3, 0, %otherwin
                wrpr    %g2, 0, %wstate
@@ -152,7 +154,9 @@ etrap_save:	save	%g2, -STACK_BIAS, %sp
                add     %l6, TI_FPSAVED + 1, %l4
                srl     %l5, 1, %l3
                add     %l5, 2, %l5
-                stb     %l5, [%l6 + TI_FPDEPTH]
+                /* Set TI_SYS_FPDEPTH to %l5 and clear TI_SYS_NOERROR.  */
+                sth     %l5, [%l6 + TI_SYS_NOERROR]
                ba,pt   %xcc, 2b
                 stb    %g0, [%l4 + %l3]
                nop
diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c
index f8b6eee40bde..87f60ee65433 100644
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -56,11 +56,13 @@ static inline unsigned int leon_eirq_get(int cpu)
 static void leon_handle_ext_irq(unsigned int irq, struct irq_desc *desc)
 {
        unsigned int eirq;
+        struct irq_bucket *p;
        int cpu = sparc_leon3_cpuid();
        eirq = leon_eirq_get(cpu);
-        if ((eirq & 0x10) && irq_map[eirq]->irq) /* bit4 tells if IRQ happened */
+        p = irq_map[eirq];
-                generic_handle_irq(irq_map[eirq]->irq);
+        if ((eirq & 0x10) && p && p->irq) /* bit4 tells if IRQ happened */
+                generic_handle_irq(p->irq);
 }
 /* The extended IRQ controller has been found, this function registers it */
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 885a8af74064..b5c38faa4ead 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -1762,15 +1762,25 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
        ufp = regs->u_regs[UREG_I6] & 0xffffffffUL;
        do {
-                struct sparc_stackf32 *usf, sf;
                unsigned long pc;
-                usf = (struct sparc_stackf32 *) ufp;
+                if (thread32_stack_is_64bit(ufp)) {
-                if (__copy_from_user_inatomic(&sf, usf, sizeof(sf)))
+                        struct sparc_stackf *usf, sf;
-                        break;
-                pc = sf.callers_pc;
+                        ufp += STACK_BIAS;
-                ufp = (unsigned long)sf.fp;
+                        usf = (struct sparc_stackf *) ufp;
+                        if (__copy_from_user_inatomic(&sf, usf, sizeof(sf)))
+                                break;
+                        pc = sf.callers_pc & 0xffffffff;
+                        ufp = ((unsigned long) sf.fp) & 0xffffffff;
+                } else {
+                        struct sparc_stackf32 *usf, sf;
+                        usf = (struct sparc_stackf32 *) ufp;
+                        if (__copy_from_user_inatomic(&sf, usf, sizeof(sf)))
+                                break;
+                        pc = sf.callers_pc;
+                        ufp = (unsigned long)sf.fp;
+                }
                perf_callchain_store(entry, pc);
        } while (entry->nr < PERF_MAX_STACK_DEPTH);
 }
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index 487bffb36f5e..bf4c6addce7b 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -316,9 +316,10 @@ asmlinkage int sparc_do_fork(unsigned long clone_flags,
 * XXX See comment above sys_vfork in sparc64. todo.
 */
 extern void ret_from_fork(void);
+extern void ret_from_kernel_thread(void);
 int copy_thread(unsigned long clone_flags, unsigned long sp,
-                unsigned long unused,
+                unsigned long arg,
                struct task_struct *p, struct pt_regs *regs)
 {
        struct thread_info *ti = task_thread_info(p);
@@ -336,16 +337,13 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
        }
        /*
-         *  p->thread_info         new_stack   childregs
+         *  p->thread_info         new_stack   childregs stack bottom
-         *  !                      !           !             {if(PSR_PS) }
+         *  !                      !           !             !
-         *  V                      V (stk.fr.) V  (pt_regs)  { (stk.fr.) }
+         *  V                      V (stk.fr.) V  (pt_regs)  V
-         *  +----- - - - - - ------+===========+============={+==========}+
+         *  +----- - - - - - ------+===========+=============+
         */
        new_stack = task_stack_page(p) + THREAD_SIZE;
-        if (regs->psr & PSR_PS)
-                new_stack -= STACKFRAME_SZ;
        new_stack -= STACKFRAME_SZ + TRACEREG_SZ;
-        memcpy(new_stack, (char *)regs - STACKFRAME_SZ, STACKFRAME_SZ + TRACEREG_SZ);
        childregs = (struct pt_regs *) (new_stack + STACKFRAME_SZ);
        /*
@@ -356,55 +354,58 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
         * Thus, kpsr|=PSR_PIL.
         */
        ti->ksp = (unsigned long) new_stack;
+        p->thread.kregs = childregs;
+        if (unlikely(p->flags & PF_KTHREAD)) {
+                extern int nwindows;
+                unsigned long psr;
+                memset(new_stack, 0, STACKFRAME_SZ + TRACEREG_SZ);
+                p->thread.flags |= SPARC_FLAG_KTHREAD;
+                p->thread.current_ds = KERNEL_DS;
+                ti->kpc = (((unsigned long) ret_from_kernel_thread) - 0x8);
+                childregs->u_regs[UREG_G1] = sp; /* function */
+                childregs->u_regs[UREG_G2] = arg;
+                psr = childregs->psr = get_psr();
+                ti->kpsr = psr | PSR_PIL;
+                ti->kwim = 1 << (((psr & PSR_CWP) + 1) % nwindows);
+                return 0;
+        }
+        memcpy(new_stack, (char *)regs - STACKFRAME_SZ, STACKFRAME_SZ + TRACEREG_SZ);
+        childregs->u_regs[UREG_FP] = sp;
+        p->thread.flags &= ~SPARC_FLAG_KTHREAD;
+        p->thread.current_ds = USER_DS;
        ti->kpc = (((unsigned long) ret_from_fork) - 0x8);
        ti->kpsr = current->thread.fork_kpsr | PSR_PIL;
        ti->kwim = current->thread.fork_kwim;
-        if(regs->psr & PSR_PS) {
+        if (sp != regs->u_regs[UREG_FP]) {
-                extern struct pt_regs fake_swapper_regs;
+                struct sparc_stackf __user *childstack;
+                struct sparc_stackf __user *parentstack;
-                p->thread.kregs = &fake_swapper_regs;
+                /*
-                new_stack += STACKFRAME_SZ + TRACEREG_SZ;
+                 * This is a clone() call with supplied user stack.
-                childregs->u_regs[UREG_FP] = (unsigned long) new_stack;
+                 * Set some valid stack frames to give to the child.
-                p->thread.flags |= SPARC_FLAG_KTHREAD;
+                 */
-                p->thread.current_ds = KERNEL_DS;
+                childstack = (struct sparc_stackf __user *)
-                memcpy(new_stack, (void *)regs->u_regs[UREG_FP], STACKFRAME_SZ);
+                        (sp & ~0xfUL);
-                childregs->u_regs[UREG_G6] = (unsigned long) ti;
+                parentstack = (struct sparc_stackf __user *)
-        } else {
+                        regs->u_regs[UREG_FP];
-                p->thread.kregs = childregs;
-                childregs->u_regs[UREG_FP] = sp;
-                p->thread.flags &= ~SPARC_FLAG_KTHREAD;
-                p->thread.current_ds = USER_DS;
-                if (sp != regs->u_regs[UREG_FP]) {
-                        struct sparc_stackf __user *childstack;
-                        struct sparc_stackf __user *parentstack;
-                        /*
-                         * This is a clone() call with supplied user stack.
-                         * Set some valid stack frames to give to the child.
-                         */
-                        childstack = (struct sparc_stackf __user *)
-                                (sp & ~0xfUL);
-                        parentstack = (struct sparc_stackf __user *)
-                                regs->u_regs[UREG_FP];
 #if 0
-                        printk("clone: parent stack:\n");
+                printk("clone: parent stack:\n");
-                        show_stackframe(parentstack);
+                show_stackframe(parentstack);
 #endif
-                        childstack = clone_stackframe(childstack, parentstack);
+                childstack = clone_stackframe(childstack, parentstack);
-                        if (!childstack)
+                if (!childstack)
-                                return -EFAULT;
+                        return -EFAULT;
 #if 0
-                        printk("clone: child stack:\n");
+                printk("clone: child stack:\n");
-                        show_stackframe(childstack);
+                show_stackframe(childstack);
 #endif
-                        childregs->u_regs[UREG_FP] = (unsigned long)childstack;
+                childregs->u_regs[UREG_FP] = (unsigned long)childstack;
-                }
        }
 #ifdef CONFIG_SMP
@@ -475,69 +476,6 @@ int dump_fpu (struct pt_regs * regs, elf_fpregset_t * fpregs)
        return 1;
 }
-/*
- * sparc_execve() executes a new program after the asm stub has set
- * things up for us.  This should basically do what I want it to.
- */
-asmlinkage int sparc_execve(struct pt_regs *regs)
-{
-        int error, base = 0;
-        struct filename *filename;
-        /* Check for indirect call. */
-        if(regs->u_regs[UREG_G1] == 0)
-                base = 1;
-        filename = getname((char __user *)regs->u_regs[base + UREG_I0]);
-        error = PTR_ERR(filename);
-        if(IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name,
-                          (const char __user *const  __user *)
-                          regs->u_regs[base + UREG_I1],
-                          (const char __user *const  __user *)
-                          regs->u_regs[base + UREG_I2],
-                          regs);
-        putname(filename);
-out:
-        return error;
-}
-/*
- * This is the mechanism for creating a new kernel thread.
- *
- * NOTE! Only a kernel-only process(ie the swapper or direct descendants
- * who haven't done an "execve()") should use this: it will work within
- * a system call from a "real" process, but the process memory space will
- * not be freed until both the parent and the child have exited.
- */
-pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
-{
-        long retval;
-        __asm__ __volatile__("mov %4, %%g2\n\t"    /* Set aside fn ptr... */
-                             "mov %5, %%g3\n\t"    /* and arg. */
-                             "mov %1, %%g1\n\t"
-                             "mov %2, %%o0\n\t"    /* Clone flags. */
-                             "mov 0, %%o1\n\t"     /* usp arg == 0 */
-                             "t 0x10\n\t"          /* Linux/Sparc clone(). */
-                             "cmp %%o1, 0\n\t"
-                             "be 1f\n\t"           /* The parent, just return. */
-                             " nop\n\t"            /* Delay slot. */
-                             "jmpl %%g2, %%o7\n\t" /* Call the function. */
-                             " mov %%g3, %%o0\n\t" /* Get back the arg in delay. */
-                             "mov %3, %%g1\n\t"
-                             "t 0x10\n\t"          /* Linux/Sparc exit(). */
-                             /* Notreached by child. */
-                             "1: mov %%o0, %0\n\t" :
-                             "=r" (retval) :
-                             "i" (__NR_clone), "r" (flags | CLONE_VM | CLONE_UNTRACED),
-                             "i" (__NR_exit),  "r" (fn), "r" (arg) :
-                             "g1", "g2", "g3", "o0", "o1", "memory", "cc");
-        return retval;
-}
-EXPORT_SYMBOL(kernel_thread);
 unsigned long get_wchan(struct task_struct *task)
 {
        unsigned long pc, fp, bias = 0;
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index d778248ef3f8..dff54f46728d 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -452,13 +452,16 @@ void flush_thread(void)
 /* It's a bit more tricky when 64-bit tasks are involved... */
 static unsigned long clone_stackframe(unsigned long csp, unsigned long psp)
 {
+        bool stack_64bit = test_thread_64bit_stack(psp);
        unsigned long fp, distance, rval;
-        if (!(test_thread_flag(TIF_32BIT))) {
+        if (stack_64bit) {
                csp += STACK_BIAS;
                psp += STACK_BIAS;
                __get_user(fp, &(((struct reg_window __user *)psp)->ins[6]));
                fp += STACK_BIAS;
+                if (test_thread_flag(TIF_32BIT))
+                        fp &= 0xffffffff;
        } else
                __get_user(fp, &(((struct reg_window32 __user *)psp)->ins[6]));
@@ -472,7 +475,7 @@ static unsigned long clone_stackframe(unsigned long csp, unsigned long psp)
        rval = (csp - distance);
        if (copy_in_user((void __user *) rval, (void __user *) psp, distance))
                rval = 0;
-        else if (test_thread_flag(TIF_32BIT)) {
+        else if (!stack_64bit) {
                if (put_user(((u32)csp),
                             &(((struct reg_window32 __user *)rval)->ins[6])))
                        rval = 0;
@@ -507,18 +510,18 @@ void synchronize_user_stack(void)
        flush_user_windows();
        if ((window = get_thread_wsaved()) != 0) {
-                int winsize = sizeof(struct reg_window);
-                int bias = 0;
-                if (test_thread_flag(TIF_32BIT))
-                        winsize = sizeof(struct reg_window32);
-                else
-                        bias = STACK_BIAS;
                window -= 1;
                do {
-                        unsigned long sp = (t->rwbuf_stkptrs[window] + bias);
                        struct reg_window *rwin = &t->reg_window[window];
+                        int winsize = sizeof(struct reg_window);
+                        unsigned long sp;
+                        sp = t->rwbuf_stkptrs[window];
+                        if (test_thread_64bit_stack(sp))
+                                sp += STACK_BIAS;
+                        else
+                                winsize = sizeof(struct reg_window32);
                        if (!copy_to_user((char __user *)sp, rwin, winsize)) {
                                shift_window_buffer(window, get_thread_wsaved() - 1, t);
@@ -544,13 +547,6 @@ void fault_in_user_windows(void)
 {
        struct thread_info *t = current_thread_info();
        unsigned long window;
-        int winsize = sizeof(struct reg_window);
-        int bias = 0;
-        if (test_thread_flag(TIF_32BIT))
-                winsize = sizeof(struct reg_window32);
-        else
-                bias = STACK_BIAS;
        flush_user_windows();
        window = get_thread_wsaved();
@@ -558,8 +554,16 @@ void fault_in_user_windows(void)
        if (likely(window != 0)) {
                window -= 1;
                do {
-                        unsigned long sp = (t->rwbuf_stkptrs[window] + bias);
                        struct reg_window *rwin = &t->reg_window[window];
+                        int winsize = sizeof(struct reg_window);
+                        unsigned long sp;
+                        sp = t->rwbuf_stkptrs[window];
+                        if (test_thread_64bit_stack(sp))
+                                sp += STACK_BIAS;
+                        else
+                                winsize = sizeof(struct reg_window32);
                        if (unlikely(sp & 0x7UL))
                                stack_unaligned(sp);
@@ -618,64 +622,55 @@ asmlinkage long sparc_do_fork(unsigned long clone_flags,
 * Child  -->  %o0 == parents pid, %o1 == 1
 */
 int copy_thread(unsigned long clone_flags, unsigned long sp,
-                unsigned long unused,
+                unsigned long arg,
                struct task_struct *p, struct pt_regs *regs)
 {
        struct thread_info *t = task_thread_info(p);
        struct sparc_stackf *parent_sf;
        unsigned long child_stack_sz;
        char *child_trap_frame;
-        int kernel_thread;
-        kernel_thread = (regs->tstate & TSTATE_PRIV) ? 1 : 0;
-        parent_sf = ((struct sparc_stackf *) regs) - 1;
        /* Calculate offset to stack_frame & pt_regs */
-        child_stack_sz = ((STACKFRAME_SZ + TRACEREG_SZ) +
+        child_stack_sz = (STACKFRAME_SZ + TRACEREG_SZ);
-                          (kernel_thread ? STACKFRAME_SZ : 0));
        child_trap_frame = (task_stack_page(p) +
                            (THREAD_SIZE - child_stack_sz));
-        memcpy(child_trap_frame, parent_sf, child_stack_sz);
-        t->flags = (t->flags & ~((0xffUL << TI_FLAG_CWP_SHIFT) |
-                                 (0xffUL << TI_FLAG_CURRENT_DS_SHIFT))) |
-                (((regs->tstate + 1) & TSTATE_CWP) << TI_FLAG_CWP_SHIFT);
        t->new_child = 1;
        t->ksp = ((unsigned long) child_trap_frame) - STACK_BIAS;
        t->kregs = (struct pt_regs *) (child_trap_frame +
                                       sizeof(struct sparc_stackf));
        t->fpsaved[0] = 0;
-        if (kernel_thread) {
+        if (unlikely(p->flags & PF_KTHREAD)) {
-                struct sparc_stackf *child_sf = (struct sparc_stackf *)
+                memset(child_trap_frame, 0, child_stack_sz);
-                        (child_trap_frame + (STACKFRAME_SZ + TRACEREG_SZ));
+                __thread_flag_byte_ptr(t)[TI_FLAG_BYTE_CWP] = 
+                        (current_pt_regs()->tstate + 1) & TSTATE_CWP;
-                /* Zero terminate the stack backtrace.  */
+                t->current_ds = ASI_P;
-                child_sf->fp = NULL;
+                t->kregs->u_regs[UREG_G1] = sp; /* function */
-                t->kregs->u_regs[UREG_FP] =
+                t->kregs->u_regs[UREG_G2] = arg;
-                  ((unsigned long) child_sf) - STACK_BIAS;
+                return 0;
+        }
-                t->flags |= ((long)ASI_P << TI_FLAG_CURRENT_DS_SHIFT);
+        parent_sf = ((struct sparc_stackf *) regs) - 1;
-                t->kregs->u_regs[UREG_G6] = (unsigned long) t;
+        memcpy(child_trap_frame, parent_sf, child_stack_sz);
-                t->kregs->u_regs[UREG_G4] = (unsigned long) t->task;
+        if (t->flags & _TIF_32BIT) {
-        } else {
+                sp &= 0x00000000ffffffffUL;
-                if (t->flags & _TIF_32BIT) {
+                regs->u_regs[UREG_FP] &= 0x00000000ffffffffUL;
-                        sp &= 0x00000000ffffffffUL;
-                        regs->u_regs[UREG_FP] &= 0x00000000ffffffffUL;
-                }
-                t->kregs->u_regs[UREG_FP] = sp;
-                t->flags |= ((long)ASI_AIUS << TI_FLAG_CURRENT_DS_SHIFT);
-                if (sp != regs->u_regs[UREG_FP]) {
-                        unsigned long csp;
-                        csp = clone_stackframe(sp, regs->u_regs[UREG_FP]);
-                        if (!csp)
-                                return -EFAULT;
-                        t->kregs->u_regs[UREG_FP] = csp;
-                }
-                if (t->utraps)
-                        t->utraps[0]++;
        }
+        t->kregs->u_regs[UREG_FP] = sp;
+        __thread_flag_byte_ptr(t)[TI_FLAG_BYTE_CWP] = 
+                (regs->tstate + 1) & TSTATE_CWP;
+        t->current_ds = ASI_AIUS;
+        if (sp != regs->u_regs[UREG_FP]) {
+                unsigned long csp;
+                csp = clone_stackframe(sp, regs->u_regs[UREG_FP]);
+                if (!csp)
+                        return -EFAULT;
+                t->kregs->u_regs[UREG_FP] = csp;
+        }
+        if (t->utraps)
+                t->utraps[0]++;
        /* Set the return value for the child. */
        t->kregs->u_regs[UREG_I0] = current->pid;
@@ -690,45 +685,6 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
        return 0;
 }
-/*
- * This is the mechanism for creating a new kernel thread.
- *
- * NOTE! Only a kernel-only process(ie the swapper or direct descendants
- * who haven't done an "execve()") should use this: it will work within
- * a system call from a "real" process, but the process memory space will
- * not be freed until both the parent and the child have exited.
- */
-pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
-{
-        long retval;
-        /* If the parent runs before fn(arg) is called by the child,
-         * the input registers of this function can be clobbered.
-         * So we stash 'fn' and 'arg' into global registers which
-         * will not be modified by the parent.
-         */
-        __asm__ __volatile__("mov %4, %%g2\n\t"    /* Save FN into global */
-                             "mov %5, %%g3\n\t"    /* Save ARG into global */
-                             "mov %1, %%g1\n\t"    /* Clone syscall nr. */
-                             "mov %2, %%o0\n\t"    /* Clone flags. */
-                             "mov 0, %%o1\n\t"     /* usp arg == 0 */
-                             "t 0x6d\n\t"          /* Linux/Sparc clone(). */
-                             "brz,a,pn %%o1, 1f\n\t" /* Parent, just return. */
-                             " mov %%o0, %0\n\t"
-                             "jmpl %%g2, %%o7\n\t"   /* Call the function. */
-                             " mov %%g3, %%o0\n\t"   /* Set arg in delay. */
-                             "mov %3, %%g1\n\t"
-                             "t 0x6d\n\t"          /* Linux/Sparc exit(). */
-                             /* Notreached by child. */
-                             "1:" :
-                             "=r" (retval) :
-                             "i" (__NR_clone), "r" (flags | CLONE_VM | CLONE_UNTRACED),
-                             "i" (__NR_exit),  "r" (fn), "r" (arg) :
-                             "g1", "g2", "g3", "o0", "o1", "memory", "cc");
-        return retval;
-}
-EXPORT_SYMBOL(kernel_thread);
 typedef struct {
        union {
                unsigned int    pr_regs[32];
@@ -795,41 +751,6 @@ int dump_fpu (struct pt_regs * regs, elf_fpregset_t * fpregs)
 }
 EXPORT_SYMBOL(dump_fpu);
-/*
- * sparc_execve() executes a new program after the asm stub has set
- * things up for us.  This should basically do what I want it to.
- */
-asmlinkage int sparc_execve(struct pt_regs *regs)
-{
-        int error, base = 0;
-        struct filename *filename;
-        /* User register window flush is done by entry.S */
-        /* Check for indirect call. */
-        if (regs->u_regs[UREG_G1] == 0)
-                base = 1;
-        filename = getname((char __user *)regs->u_regs[base + UREG_I0]);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name,
-                          (const char __user *const __user *)
-                          regs->u_regs[base + UREG_I1],
-                          (const char __user *const __user *)
-                          regs->u_regs[base + UREG_I2], regs);
-        putname(filename);
-        if (!error) {
-                fprs_write(0);
-                current_thread_info()->xfsr[0] = 0;
-                current_thread_info()->fpsaved[0] = 0;
-                regs->tstate &= ~TSTATE_PEF;
-        }
-out:
-        return error;
-}
 unsigned long get_wchan(struct task_struct *task)
 {
        unsigned long pc, fp, bias = 0;
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 484dabac7045..7ff45e4ba681 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -151,7 +151,7 @@ static int regwindow64_get(struct task_struct *target,
 {
        unsigned long rw_addr = regs->u_regs[UREG_I6];
-        if (test_tsk_thread_flag(current, TIF_32BIT)) {
+        if (!test_thread_64bit_stack(rw_addr)) {
                struct reg_window32 win32;
                int i;
@@ -176,7 +176,7 @@ static int regwindow64_set(struct task_struct *target,
 {
        unsigned long rw_addr = regs->u_regs[UREG_I6];
-        if (test_tsk_thread_flag(current, TIF_32BIT)) {
+        if (!test_thread_64bit_stack(rw_addr)) {
                struct reg_window32 win32;
                int i;
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 0800e71d8a88..0eaf0059aaef 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -316,6 +316,25 @@ static void __init popc_patch(void)
        }
 }
+static void __init pause_patch(void)
+{
+        struct pause_patch_entry *p;
+        p = &__pause_3insn_patch;
+        while (p < &__pause_3insn_patch_end) {
+                unsigned long i, addr = p->addr;
+                for (i = 0; i < 3; i++) {
+                        *(unsigned int *) (addr +  (i * 4)) = p->insns[i];
+                        wmb();
+                        __asm__ __volatile__("flush     %0"
+                                             : : "r" (addr +  (i * 4)));
+                }
+                p++;
+        }
+}
 #ifdef CONFIG_SMP
 void __init boot_cpu_id_too_large(int cpu)
 {
@@ -528,6 +547,8 @@ static void __init init_sparc64_elf_hwcap(void)
        if (sparc64_elf_hwcap & AV_SPARC_POPC)
                popc_patch();
+        if (sparc64_elf_hwcap & AV_SPARC_PAUSE)
+                pause_patch();
 }
 void __init setup_arch(char **cmdline_p)
diff --git a/arch/sparc/kernel/sys_sparc32.c b/arch/sparc/kernel/sys_sparc32.c
index c3239811a1b5..03c7e929ec34 100644
--- a/arch/sparc/kernel/sys_sparc32.c
+++ b/arch/sparc/kernel/sys_sparc32.c
@@ -396,42 +396,6 @@ asmlinkage long compat_sys_rt_sigaction(int sig,
        return ret;
 }
-/*
- * sparc32_execve() executes a new program after the asm stub has set
- * things up for us.  This should basically do what I want it to.
- */
-asmlinkage long sparc32_execve(struct pt_regs *regs)
-{
-        int error, base = 0;
-        struct filename *filename;
-        /* User register window flush is done by entry.S */
-        /* Check for indirect call. */
-        if ((u32)regs->u_regs[UREG_G1] == 0)
-                base = 1;
-        filename = getname(compat_ptr(regs->u_regs[base + UREG_I0]));
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = compat_do_execve(filename->name,
-                                 compat_ptr(regs->u_regs[base + UREG_I1]),
-                                 compat_ptr(regs->u_regs[base + UREG_I2]), regs);
-        putname(filename);
-        if (!error) {
-                fprs_write(0);
-                current_thread_info()->xfsr[0] = 0;
-                current_thread_info()->fpsaved[0] = 0;
-                regs->tstate &= ~TSTATE_PEF;
-        }
-out:
-        return error;
-}
 #ifdef CONFIG_MODULES
 asmlinkage long sys32_init_module(void __user *umod, u32 len,
diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
index 0c9b31b22e07..a8e6eb0a11d5 100644
--- a/arch/sparc/kernel/sys_sparc_32.c
+++ b/arch/sparc/kernel/sys_sparc_32.c
@@ -258,27 +258,3 @@ out:
        up_read(&uts_sem);
        return err;
 }
-/*
- * Do a system call from kernel instead of calling sys_execve so we
- * end up with proper pt_regs.
- */
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
-{
-        long __res;
-        register long __g1 __asm__ ("g1") = __NR_execve;
-        register long __o0 __asm__ ("o0") = (long)(filename);
-        register long __o1 __asm__ ("o1") = (long)(argv);
-        register long __o2 __asm__ ("o2") = (long)(envp);
-        asm volatile ("t 0x10\n\t"
-                      "bcc 1f\n\t"
-                      "mov %%o0, %0\n\t"
-                      "sub %%g0, %%o0, %0\n\t"
-                      "1:\n\t"
-                      : "=r" (__res), "=&r" (__o0)
-                      : "1" (__o0), "r" (__o1), "r" (__o2), "r" (__g1)
-                      : "cc");
-        return __res;
-}
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 11c6c9603e71..51b85feb8b97 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -730,24 +730,7 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, const struct sigaction __user *, act,
        return ret;
 }
-/*
+asmlinkage long sys_kern_features(void)
- * Do a system call from kernel instead of calling sys_execve so we
- * end up with proper pt_regs.
- */
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
 {
-        long __res;
+        return KERN_FEATURE_MIXED_MODE_STACK;
-        register long __g1 __asm__ ("g1") = __NR_execve;
-        register long __o0 __asm__ ("o0") = (long)(filename);
-        register long __o1 __asm__ ("o1") = (long)(argv);
-        register long __o2 __asm__ ("o2") = (long)(envp);
-        asm volatile ("t 0x6d\n\t"
-                      "sub %%g0, %%o0, %0\n\t"
-                      "movcc %%xcc, %%o0, %0\n\t"
-                      : "=r" (__res), "=&r" (__o0)
-                      : "1" (__o0), "r" (__o1), "r" (__o2), "r" (__g1)
-                      : "cc");
-        return __res;
 }
diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
index 7f5f65d0b3fd..2ef41e67f0be 100644
--- a/arch/sparc/kernel/syscalls.S
+++ b/arch/sparc/kernel/syscalls.S
@@ -1,23 +1,19 @@
        /* SunOS's execv() call only specifies the argv argument, the
         * environment settings are the same as the calling processes.
         */
-sys_execve:
+sys64_execve:
-        sethi   %hi(sparc_execve), %g1
+        set     sys_execve, %g1
-        ba,pt   %xcc, execve_merge
+        jmpl    %g1, %g0
-         or     %g1, %lo(sparc_execve), %g1
+         flushw
 #ifdef CONFIG_COMPAT
 sunos_execv:
-        stx     %g0, [%sp + PTREGS_OFF + PT_V9_I2]
+        mov     %g0, %o2
 sys32_execve:
-        sethi   %hi(sparc32_execve), %g1
+        set     compat_sys_execve, %g1
-        or      %g1, %lo(sparc32_execve), %g1
-#endif
-execve_merge:
-        flushw
        jmpl    %g1, %g0
-         add    %sp, PTREGS_OFF, %o0
+         flushw
+#endif
        .align  32
 sys_sparc_pipe:
@@ -112,11 +108,16 @@ sys_clone:
 ret_from_syscall:
        /* Clear current_thread_info()->new_child. */
        stb     %g0, [%g6 + TI_NEW_CHILD]
-        ldx     [%g6 + TI_FLAGS], %l0
        call    schedule_tail
         mov    %g7, %o0
+        ldx     [%sp + PTREGS_OFF + PT_V9_I0], %o0
+        brnz,pt %o0, ret_sys_call
+         ldx    [%g6 + TI_FLAGS], %l0
+        ldx     [%sp + PTREGS_OFF + PT_V9_G1], %l1
+        call    %l1
+         ldx    [%sp + PTREGS_OFF + PT_V9_G2], %o0
        ba,pt   %xcc, ret_sys_call
-         ldx    [%sp + PTREGS_OFF + PT_V9_I0], %o0
+         mov    0, %o0
        .globl  sparc_exit
        .type   sparc_exit,#function
@@ -222,7 +223,6 @@ ret_sys_call:
        ldx     [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
 2:
-        stb     %g0, [%g6 + TI_SYS_NOERROR]
        /* System call success, clear Carry condition code. */
        andn    %g3, %g2, %g3
 3:
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index 63402f9e9f51..5147f574f125 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -85,3 +85,4 @@ sys_call_table:
 /*325*/ .long sys_pwritev, sys_rt_tgsigqueueinfo, sys_perf_event_open, sys_recvmmsg, sys_fanotify_init
 /*330*/ .long sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
 /*335*/ .long sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
+/*340*/ .long sys_ni_syscall, sys_kcmp
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index 3a58e0d66f51..ebb7f5fc58fb 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -86,6 +86,7 @@ sys_call_table32:
        .word compat_sys_pwritev, compat_sys_rt_tgsigqueueinfo, sys_perf_event_open, compat_sys_recvmmsg, sys_fanotify_init
 /*330*/ .word sys32_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, compat_sys_open_by_handle_at, compat_sys_clock_adjtime
        .word sys_syncfs, compat_sys_sendmmsg, sys_setns, compat_sys_process_vm_readv, compat_sys_process_vm_writev
+/*340*/ .word sys_kern_features, sys_kcmp
 #endif /* CONFIG_COMPAT */
@@ -106,7 +107,7 @@ sys_call_table:
 /*40*/  .word sys_newlstat, sys_dup, sys_sparc_pipe, sys_times, sys_nis_syscall
        .word sys_umount, sys_setgid, sys_getgid, sys_signal, sys_geteuid
 /*50*/  .word sys_getegid, sys_acct, sys_memory_ordering, sys_nis_syscall, sys_ioctl
-        .word sys_reboot, sys_nis_syscall, sys_symlink, sys_readlink, sys_execve
+        .word sys_reboot, sys_nis_syscall, sys_symlink, sys_readlink, sys64_execve
 /*60*/  .word sys_umask, sys_chroot, sys_newfstat, sys_fstat64, sys_getpagesize
        .word sys_msync, sys_vfork, sys_pread64, sys_pwrite64, sys_nis_syscall
 /*70*/  .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys_64_munmap, sys_mprotect
@@ -163,3 +164,4 @@ sys_call_table:
        .word sys_pwritev, sys_rt_tgsigqueueinfo, sys_perf_event_open, sys_recvmmsg, sys_fanotify_init
 /*330*/ .word sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
        .word sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
+/*340*/ .word sys_kern_features, sys_kcmp
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index b66a77968f35..e7ecf1507d90 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2688,8 +2688,8 @@ void __init trap_init(void)
                     TI_PRE_COUNT != offsetof(struct thread_info,
                                              preempt_count) ||
                     TI_NEW_CHILD != offsetof(struct thread_info, new_child) ||
-                     TI_SYS_NOERROR != offsetof(struct thread_info,
+                     TI_CURRENT_DS != offsetof(struct thread_info,
-                                                syscall_noerror) ||
+                                                current_ds) ||
                     TI_RESTART_BLOCK != offsetof(struct thread_info,
                                                  restart_block) ||
                     TI_KUNA_REGS != offsetof(struct thread_info,
diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
index f81d038f7340..8201c25e7669 100644
--- a/arch/sparc/kernel/unaligned_64.c
+++ b/arch/sparc/kernel/unaligned_64.c
@@ -113,21 +113,24 @@ static inline long sign_extend_imm13(long imm)
 static unsigned long fetch_reg(unsigned int reg, struct pt_regs *regs)
 {
-        unsigned long value;
+        unsigned long value, fp;
        
        if (reg < 16)
                return (!reg ? 0 : regs->u_regs[reg]);
+        fp = regs->u_regs[UREG_FP];
        if (regs->tstate & TSTATE_PRIV) {
                struct reg_window *win;
-                win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window *)(fp + STACK_BIAS);
                value = win->locals[reg - 16];
-        } else if (test_thread_flag(TIF_32BIT)) {
+        } else if (!test_thread_64bit_stack(fp)) {
                struct reg_window32 __user *win32;
-                win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
+                win32 = (struct reg_window32 __user *)((unsigned long)((u32)fp));
                get_user(value, &win32->locals[reg - 16]);
        } else {
                struct reg_window __user *win;
-                win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window __user *)(fp + STACK_BIAS);
                get_user(value, &win->locals[reg - 16]);
        }
        return value;
@@ -135,19 +138,24 @@ static unsigned long fetch_reg(unsigned int reg, struct pt_regs *regs)
 static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
 {
+        unsigned long fp;
        if (reg < 16)
                return &regs->u_regs[reg];
+        fp = regs->u_regs[UREG_FP];
        if (regs->tstate & TSTATE_PRIV) {
                struct reg_window *win;
-                win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window *)(fp + STACK_BIAS);
                return &win->locals[reg - 16];
-        } else if (test_thread_flag(TIF_32BIT)) {
+        } else if (!test_thread_64bit_stack(fp)) {
                struct reg_window32 *win32;
-                win32 = (struct reg_window32 *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
+                win32 = (struct reg_window32 *)((unsigned long)((u32)fp));
                return (unsigned long *)&win32->locals[reg - 16];
        } else {
                struct reg_window *win;
-                win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window *)(fp + STACK_BIAS);
                return &win->locals[reg - 16];
        }
 }
@@ -392,13 +400,15 @@ int handle_popc(u32 insn, struct pt_regs *regs)
                if (rd)
                        regs->u_regs[rd] = ret;
        } else {
-                if (test_thread_flag(TIF_32BIT)) {
+                unsigned long fp = regs->u_regs[UREG_FP];
+                if (!test_thread_64bit_stack(fp)) {
                        struct reg_window32 __user *win32;
-                        win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
+                        win32 = (struct reg_window32 __user *)((unsigned long)((u32)fp));
                        put_user(ret, &win32->locals[rd - 16]);
                } else {
                        struct reg_window __user *win;
-                        win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                        win = (struct reg_window __user *)(fp + STACK_BIAS);
                        put_user(ret, &win->locals[rd - 16]);
                }
        }
@@ -554,7 +564,7 @@ void handle_ld_nf(u32 insn, struct pt_regs *regs)
                reg[0] = 0;
                if ((insn & 0x780000) == 0x180000)
                        reg[1] = 0;
-        } else if (test_thread_flag(TIF_32BIT)) {
+        } else if (!test_thread_64bit_stack(regs->u_regs[UREG_FP])) {
                put_user(0, (int __user *) reg);
                if ((insn & 0x780000) == 0x180000)
                        put_user(0, ((int __user *) reg) + 1);
diff --git a/arch/sparc/kernel/visemul.c b/arch/sparc/kernel/visemul.c
index 08e074b7eb6a..c096c624ac4d 100644
--- a/arch/sparc/kernel/visemul.c
+++ b/arch/sparc/kernel/visemul.c
@@ -149,21 +149,24 @@ static inline void maybe_flush_windows(unsigned int rs1, unsigned int rs2,
 static unsigned long fetch_reg(unsigned int reg, struct pt_regs *regs)
 {
-        unsigned long value;
+        unsigned long value, fp;
        
        if (reg < 16)
                return (!reg ? 0 : regs->u_regs[reg]);
+        fp = regs->u_regs[UREG_FP];
        if (regs->tstate & TSTATE_PRIV) {
                struct reg_window *win;
-                win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window *)(fp + STACK_BIAS);
                value = win->locals[reg - 16];
-        } else if (test_thread_flag(TIF_32BIT)) {
+        } else if (!test_thread_64bit_stack(fp)) {
                struct reg_window32 __user *win32;
-                win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
+                win32 = (struct reg_window32 __user *)((unsigned long)((u32)fp));
                get_user(value, &win32->locals[reg - 16]);
        } else {
                struct reg_window __user *win;
-                win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window __user *)(fp + STACK_BIAS);
                get_user(value, &win->locals[reg - 16]);
        }
        return value;
@@ -172,16 +175,18 @@ static unsigned long fetch_reg(unsigned int reg, struct pt_regs *regs)
 static inline unsigned long __user *__fetch_reg_addr_user(unsigned int reg,
                                                          struct pt_regs *regs)
 {
+        unsigned long fp = regs->u_regs[UREG_FP];
        BUG_ON(reg < 16);
        BUG_ON(regs->tstate & TSTATE_PRIV);
-        if (test_thread_flag(TIF_32BIT)) {
+        if (!test_thread_64bit_stack(fp)) {
                struct reg_window32 __user *win32;
-                win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
+                win32 = (struct reg_window32 __user *)((unsigned long)((u32)fp));
                return (unsigned long __user *)&win32->locals[reg - 16];
        } else {
                struct reg_window __user *win;
-                win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS);
+                win = (struct reg_window __user *)(fp + STACK_BIAS);
                return &win->locals[reg - 16];
        }
 }
@@ -204,7 +209,7 @@ static void store_reg(struct pt_regs *regs, unsigned long val, unsigned long rd)
        } else {
                unsigned long __user *rd_user = __fetch_reg_addr_user(rd, regs);
-                if (test_thread_flag(TIF_32BIT))
+                if (!test_thread_64bit_stack(regs->u_regs[UREG_FP]))
                        __put_user((u32)val, (u32 __user *)rd_user);
                else
                        __put_user(val, rd_user);
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index 89c2c29f154b..0bacceb19150 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -132,6 +132,11 @@ SECTIONS
                *(.popc_6insn_patch)
                __popc_6insn_patch_end = .;
        }
+        .pause_3insn_patch : {
+                __pause_3insn_patch = .;
+                *(.pause_3insn_patch)
+                __pause_3insn_patch_end = .;
+        }
        PERCPU_SECTION(SMP_CACHE_BYTES)
        . = ALIGN(PAGE_SIZE);
diff --git a/arch/sparc/kernel/winfixup.S b/arch/sparc/kernel/winfixup.S
index a6b0863c27df..1e67ce958369 100644
--- a/arch/sparc/kernel/winfixup.S
+++ b/arch/sparc/kernel/winfixup.S
@@ -43,6 +43,8 @@ spill_fixup_mna:
 spill_fixup_dax:
        TRAP_LOAD_THREAD_REG(%g6, %g1)
        ldx     [%g6 + TI_FLAGS], %g1
+        andcc   %sp, 0x1, %g0
+        movne   %icc, 0, %g1
        andcc   %g1, _TIF_32BIT, %g0
        ldub    [%g6 + TI_WSAVED], %g1
        sll     %g1, 3, %g3
diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
index 4d502da3de78..85c233d0a340 100644
--- a/arch/sparc/lib/atomic_64.S
+++ b/arch/sparc/lib/atomic_64.S
@@ -1,6 +1,6 @@
 /* atomic.S: These things are too big to do inline.
 *
- * Copyright (C) 1999, 2007 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 1999, 2007 2012 David S. Miller (davem@davemloft.net)
 */
 #include <linux/linkage.h>
@@ -117,3 +117,17 @@ ENTRY(atomic64_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */
         sub    %g1, %o0, %o0
 2:      BACKOFF_SPIN(%o2, %o3, 1b)
 ENDPROC(atomic64_sub_ret)
+ENTRY(atomic64_dec_if_positive) /* %o0 = atomic_ptr */
+        BACKOFF_SETUP(%o2)
+1:      ldx     [%o0], %g1
+        brlez,pn %g1, 3f
+         sub    %g1, 1, %g7
+        casx    [%o0], %g1, %g7
+        cmp     %g1, %g7
+        bne,pn  %xcc, BACKOFF_LABEL(2f, 1b)
+         nop
+3:      retl
+         sub    %g1, 1, %o0
+2:      BACKOFF_SPIN(%o2, %o3, 1b)
+ENDPROC(atomic64_dec_if_positive)
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
index ee31b884c61b..0c4e35e522fa 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -116,6 +116,7 @@ EXPORT_SYMBOL(atomic64_add);
 EXPORT_SYMBOL(atomic64_add_ret);
 EXPORT_SYMBOL(atomic64_sub);
 EXPORT_SYMBOL(atomic64_sub_ret);
+EXPORT_SYMBOL(atomic64_dec_if_positive);
 /* Atomic bit operations. */
 EXPORT_SYMBOL(test_and_set_bit);
diff --git a/arch/sparc/math-emu/math_64.c b/arch/sparc/math-emu/math_64.c
index 1704068da928..034aadbff036 100644
--- a/arch/sparc/math-emu/math_64.c
+++ b/arch/sparc/math-emu/math_64.c
@@ -320,7 +320,7 @@ int do_mathemu(struct pt_regs *regs, struct fpustate *f, bool illegal_insn_trap)
                                        XR = 0;
                                else if (freg < 16)
                                        XR = regs->u_regs[freg];
-                                else if (test_thread_flag(TIF_32BIT)) {
+                                else if (!test_thread_64bit_stack(regs->u_regs[UREG_FP])) {
                                        struct reg_window32 __user *win32;
                                        flushw_user ();
                                        win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP]));
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 9e28a118e6a4..85be1ca539b2 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -624,7 +624,7 @@ static void __init inherit_prom_mappings(void)
 void prom_world(int enter)
 {
        if (!enter)
-                set_fs((mm_segment_t) { get_thread_current_ds() });
+                set_fs(get_fs());
        __asm__ __volatile__("flushw");
 }
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 875d008828b8..ea7f61e8bc9e 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -21,6 +21,8 @@ config TILE
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
        select GENERIC_CLOCKEVENTS
        select MODULES_USE_ELF_RELA
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
 # FIXME: investigate whether we need/want these options.
 #       select HAVE_IOREMAP_PROT
diff --git a/arch/tile/include/asm/compat.h b/arch/tile/include/asm/compat.h
index 3063e6fc8daa..ca61fb4296b3 100644
--- a/arch/tile/include/asm/compat.h
+++ b/arch/tile/include/asm/compat.h
@@ -275,18 +275,14 @@ extern int compat_setup_rt_frame(int sig, struct k_sigaction *ka,
 struct compat_sigaction;
 struct compat_siginfo;
 struct compat_sigaltstack;
-long compat_sys_execve(const char __user *path,
-                       compat_uptr_t __user *argv,
-                       compat_uptr_t __user *envp, struct pt_regs *);
 long compat_sys_rt_sigaction(int sig, struct compat_sigaction __user *act,
                             struct compat_sigaction __user *oact,
                             size_t sigsetsize);
 long compat_sys_rt_sigqueueinfo(int pid, int sig,
                                struct compat_siginfo __user *uinfo);
-long compat_sys_rt_sigreturn(struct pt_regs *);
+long compat_sys_rt_sigreturn(void);
 long compat_sys_sigaltstack(const struct compat_sigaltstack __user *uss_ptr,
-                            struct compat_sigaltstack __user *uoss_ptr,
+                            struct compat_sigaltstack __user *uoss_ptr);
-                            struct pt_regs *);
 long compat_sys_truncate64(char __user *filename, u32 dummy, u32 low, u32 high);
 long compat_sys_ftruncate64(unsigned int fd, u32 dummy, u32 low, u32 high);
 long compat_sys_pread64(unsigned int fd, char __user *ubuf, size_t count,
@@ -303,12 +299,7 @@ long compat_sys_fallocate(int fd, int mode,
 long compat_sys_sched_rr_get_interval(compat_pid_t pid,
                                      struct compat_timespec __user *interval);
-/* These are the intvec_64.S trampolines. */
+/* Assembly trampoline to avoid clobbering r0. */
-long _compat_sys_execve(const char __user *path,
-                        const compat_uptr_t __user *argv,
-                        const compat_uptr_t __user *envp);
-long _compat_sys_sigaltstack(const struct compat_sigaltstack __user *uss_ptr,
-                            struct compat_sigaltstack __user *uoss_ptr);
 long _compat_sys_rt_sigreturn(void);
 #endif /* _ASM_TILE_COMPAT_H */
diff --git a/arch/tile/include/asm/elf.h b/arch/tile/include/asm/elf.h
index f8ccf08f6934..b73e1039c911 100644
--- a/arch/tile/include/asm/elf.h
+++ b/arch/tile/include/asm/elf.h
@@ -148,6 +148,7 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 #define compat_start_thread(regs, ip, usp) do { \
                regs->pc = ptr_to_compat_reg((void *)(ip)); \
                regs->sp = ptr_to_compat_reg((void *)(usp)); \
+                single_step_execve();   \
        } while (0)
 /*
diff --git a/arch/tile/include/asm/processor.h b/arch/tile/include/asm/processor.h
index 8c4dd9ff91eb..879073e76586 100644
--- a/arch/tile/include/asm/processor.h
+++ b/arch/tile/include/asm/processor.h
@@ -211,6 +211,7 @@ static inline void start_thread(struct pt_regs *regs,
 {
        regs->pc = pc;
        regs->sp = usp;
+        single_step_execve();
 }
 /* Free all resources held by a thread. */
@@ -239,6 +240,9 @@ unsigned long get_wchan(struct task_struct *p);
 #define KSTK_TOP(task)  (task_ksp0(task) - STACK_TOP_DELTA)
 #define task_pt_regs(task) \
  ((struct pt_regs *)(task_ksp0(task) - KSTK_PTREGS_GAP) - 1)
+#define current_pt_regs()                                   \
+  ((struct pt_regs *)((stack_pointer | (THREAD_SIZE - 1)) - \
+                      (KSTK_PTREGS_GAP - 1)) - 1)
 #define task_sp(task)   (task_pt_regs(task)->sp)
 #define task_pc(task)   (task_pt_regs(task)->pc)
 /* Aliases for pc and sp (used in fs/proc/array.c) */
diff --git a/arch/tile/include/asm/switch_to.h b/arch/tile/include/asm/switch_to.h
index 1d48c5fee8b7..b8f888cbe6b0 100644
--- a/arch/tile/include/asm/switch_to.h
+++ b/arch/tile/include/asm/switch_to.h
@@ -68,7 +68,10 @@ extern unsigned long get_switch_to_pc(void);
 /* Support function for forking a new task. */
 void ret_from_fork(void);
-/* Called from ret_from_fork() when a new process starts up. */
+/* Support function for forking a new kernel thread. */
+void ret_from_kernel_thread(void *fn, void *arg);
+/* Called from ret_from_xxx() when a new process starts up. */
 struct task_struct *sim_notify_fork(struct task_struct *prev);
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/tile/include/asm/syscalls.h b/arch/tile/include/asm/syscalls.h
index 06f0464cfed9..369696d63e7b 100644
--- a/arch/tile/include/asm/syscalls.h
+++ b/arch/tile/include/asm/syscalls.h
@@ -51,8 +51,7 @@ long sys_cacheflush(unsigned long addr, unsigned long len,
 #ifndef __tilegx__
 /* mm/fault.c */
-long sys_cmpxchg_badaddr(unsigned long address, struct pt_regs *);
+long sys_cmpxchg_badaddr(unsigned long address);
-long _sys_cmpxchg_badaddr(unsigned long address);
 #endif
 #ifdef CONFIG_COMPAT
@@ -63,14 +62,23 @@ long sys_truncate64(const char __user *path, loff_t length);
 long sys_ftruncate64(unsigned int fd, loff_t length);
 #endif
+/* Provide versions of standard syscalls that use current_pt_regs(). */
+long sys_clone(unsigned long clone_flags, unsigned long newsp,
+                void __user *parent_tid, void __user *child_tid);
+long sys_execve(const char __user *filename,
+                 const char __user *const __user *argv,
+                 const char __user *const __user *envp);
+long sys_rt_sigreturn(void);
+long sys_sigaltstack(const stack_t __user *, stack_t __user *);
+#define sys_clone sys_clone
+#define sys_execve sys_execve
+#define sys_rt_sigreturn sys_rt_sigreturn
+#define sys_sigaltstack sys_sigaltstack
 /* These are the intvec*.S trampolines. */
-long _sys_sigaltstack(const stack_t __user *, stack_t __user *);
 long _sys_rt_sigreturn(void);
 long _sys_clone(unsigned long clone_flags, unsigned long newsp,
                void __user *parent_tid, void __user *child_tid);
-long _sys_execve(const char __user *filename,
-                 const char __user *const __user *argv,
-                 const char __user *const __user *envp);
 #include <asm-generic/syscalls.h>
diff --git a/arch/tile/include/asm/unistd.h b/arch/tile/include/asm/unistd.h
index 6e032a0a268e..dab827dc8acb 100644
--- a/arch/tile/include/asm/unistd.h
+++ b/arch/tile/include/asm/unistd.h
@@ -16,4 +16,5 @@
 #define __ARCH_WANT_SYS_LLSEEK
 #endif
 #define __ARCH_WANT_SYS_NEWFSTATAT
+#define __ARCH_WANT_SYS_EXECVE
 #include <uapi/asm/unistd.h>
diff --git a/arch/tile/kernel/compat.c b/arch/tile/kernel/compat.c
index d67459b9ac2a..a2e805569d5d 100644
--- a/arch/tile/kernel/compat.c
+++ b/arch/tile/kernel/compat.c
@@ -102,10 +102,9 @@ long compat_sys_sched_rr_get_interval(compat_pid_t pid,
 #define compat_sys_fadvise64_64 sys32_fadvise64_64
 #define compat_sys_readahead sys32_readahead
-/* Call the trampolines to manage pt_regs where necessary. */
+/* Call the assembly trampolines where necessary. */
-#define compat_sys_execve _compat_sys_execve
-#define compat_sys_sigaltstack _compat_sys_sigaltstack
 #define compat_sys_rt_sigreturn _compat_sys_rt_sigreturn
+#undef sys_clone
 #define sys_clone _sys_clone
 /*
diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
index 08b4fe1717bb..210a9bbae963 100644
--- a/arch/tile/kernel/compat_signal.c
+++ b/arch/tile/kernel/compat_signal.c
@@ -197,8 +197,7 @@ int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from)
 }
 long compat_sys_sigaltstack(const struct compat_sigaltstack __user *uss_ptr,
-                            struct compat_sigaltstack __user *uoss_ptr,
+                            struct compat_sigaltstack __user *uoss_ptr)
-                            struct pt_regs *regs)
 {
        stack_t uss, uoss;
        int ret;
@@ -219,7 +218,7 @@ long compat_sys_sigaltstack(const struct compat_sigaltstack __user *uss_ptr,
        set_fs(KERNEL_DS);
        ret = do_sigaltstack(uss_ptr ? (stack_t __user __force *)&uss : NULL,
                             (stack_t __user __force *)&uoss,
-                             (unsigned long)compat_ptr(regs->sp));
+                             (unsigned long)compat_ptr(current_pt_regs()->sp));
        set_fs(seg);
        if (ret >= 0 && uoss_ptr)  {
                if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(*uoss_ptr)) ||
@@ -232,8 +231,9 @@ long compat_sys_sigaltstack(const struct compat_sigaltstack __user *uss_ptr,
 }
 /* The assembly shim for this function arranges to ignore the return value. */
-long compat_sys_rt_sigreturn(struct pt_regs *regs)
+long compat_sys_rt_sigreturn(void)
 {
+        struct pt_regs *regs = current_pt_regs();
        struct compat_rt_sigframe __user *frame =
                (struct compat_rt_sigframe __user *) compat_ptr(regs->sp);
        sigset_t set;
@@ -248,7 +248,7 @@ long compat_sys_rt_sigreturn(struct pt_regs *regs)
        if (restore_sigcontext(regs, &frame->uc.uc_mcontext))
                goto badframe;
-        if (compat_sys_sigaltstack(&frame->uc.uc_stack, NULL, regs) != 0)
+        if (compat_sys_sigaltstack(&frame->uc.uc_stack, NULL) != 0)
                goto badframe;
        return 0;
diff --git a/arch/tile/kernel/entry.S b/arch/tile/kernel/entry.S
index c31637baff28..f116cb0bce20 100644
--- a/arch/tile/kernel/entry.S
+++ b/arch/tile/kernel/entry.S
@@ -28,17 +28,6 @@ STD_ENTRY(current_text_addr)
        STD_ENDPROC(current_text_addr)
 /*
- * Implement execve().  The i386 code has a note that forking from kernel
- * space results in no copy on write until the execve, so we should be
- * careful not to write to the stack here.
- */
-STD_ENTRY(kernel_execve)
-        moveli TREG_SYSCALL_NR_NAME, __NR_execve
-        swint1
-        jrp lr
-        STD_ENDPROC(kernel_execve)
-/*
 * We don't run this function directly, but instead copy it to a page
 * we map into every user process.  See vdso_setup().
 *
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index 6943515100f8..f212bf7cea86 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -1291,6 +1291,21 @@ STD_ENTRY(ret_from_fork)
        }
        STD_ENDPROC(ret_from_fork)
+STD_ENTRY(ret_from_kernel_thread)
+        jal     sim_notify_fork
+        jal     schedule_tail
+        FEEDBACK_REENTER(ret_from_fork)
+        {
+         move   r0, r31
+         jalr   r30
+        }
+        FEEDBACK_REENTER(ret_from_kernel_thread)
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
+        STD_ENDPROC(ret_from_kernel_thread)
        /*
         * Code for ill interrupt.
         */
@@ -1437,15 +1452,6 @@ STD_ENTRY_LOCAL(bad_intr)
        panic   "Unhandled interrupt %#x: PC %#lx"
        STD_ENDPROC(bad_intr)
-/* Put address of pt_regs in reg and jump. */
-#define PTREGS_SYSCALL(x, reg)                          \
-        STD_ENTRY(_##x);                                \
-        {                                               \
-         PTREGS_PTR(reg, PTREGS_OFFSET_BASE);           \
-         j      x                                       \
-        };                                              \
-        STD_ENDPROC(_##x)
 /*
 * Special-case sigreturn to not write r0 to the stack on return.
 * This is technically more efficient, but it also avoids difficulties
@@ -1461,12 +1467,9 @@ STD_ENTRY_LOCAL(bad_intr)
        };                                              \
        STD_ENDPROC(_##x)
-PTREGS_SYSCALL(sys_execve, r3)
-PTREGS_SYSCALL(sys_sigaltstack, r2)
 PTREGS_SYSCALL_SIGRETURN(sys_rt_sigreturn, r0)
-PTREGS_SYSCALL(sys_cmpxchg_badaddr, r1)
-/* Save additional callee-saves to pt_regs, put address in r4 and jump. */
+/* Save additional callee-saves to pt_regs and jump to standard function. */
 STD_ENTRY(_sys_clone)
        push_extra_callee_saves r4
        j       sys_clone
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index 7c06d597ffd0..54bc9a6678e8 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -1150,6 +1150,21 @@ STD_ENTRY(ret_from_fork)
        }
        STD_ENDPROC(ret_from_fork)
+STD_ENTRY(ret_from_kernel_thread)
+        jal     sim_notify_fork
+        jal     schedule_tail
+        FEEDBACK_REENTER(ret_from_fork)
+        {
+         move   r0, r31
+         jalr   r30
+        }
+        FEEDBACK_REENTER(ret_from_kernel_thread)
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
+        STD_ENDPROC(ret_from_kernel_thread)
 /* Various stub interrupt handlers and syscall handlers */
 STD_ENTRY_LOCAL(_kernel_double_fault)
@@ -1166,15 +1181,6 @@ STD_ENTRY_LOCAL(bad_intr)
        panic   "Unhandled interrupt %#x: PC %#lx"
        STD_ENDPROC(bad_intr)
-/* Put address of pt_regs in reg and jump. */
-#define PTREGS_SYSCALL(x, reg)                          \
-        STD_ENTRY(_##x);                                \
-        {                                               \
-         PTREGS_PTR(reg, PTREGS_OFFSET_BASE);           \
-         j      x                                       \
-        };                                              \
-        STD_ENDPROC(_##x)
 /*
 * Special-case sigreturn to not write r0 to the stack on return.
 * This is technically more efficient, but it also avoids difficulties
@@ -1190,16 +1196,12 @@ STD_ENTRY_LOCAL(bad_intr)
        };                                              \
        STD_ENDPROC(_##x)
-PTREGS_SYSCALL(sys_execve, r3)
-PTREGS_SYSCALL(sys_sigaltstack, r2)
 PTREGS_SYSCALL_SIGRETURN(sys_rt_sigreturn, r0)
 #ifdef CONFIG_COMPAT
-PTREGS_SYSCALL(compat_sys_execve, r3)
-PTREGS_SYSCALL(compat_sys_sigaltstack, r2)
 PTREGS_SYSCALL_SIGRETURN(compat_sys_rt_sigreturn, r0)
 #endif
-/* Save additional callee-saves to pt_regs, put address in r4 and jump. */
+/* Save additional callee-saves to pt_regs and jump to standard function. */
 STD_ENTRY(_sys_clone)
        push_extra_callee_saves r4
        j       sys_clone
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 307d010696c9..1c20029d2f5a 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -157,24 +157,44 @@ void arch_release_thread_info(struct thread_info *info)
 static void save_arch_state(struct thread_struct *t);
 int copy_thread(unsigned long clone_flags, unsigned long sp,
-                unsigned long stack_size,
+                unsigned long arg,
-                struct task_struct *p, struct pt_regs *regs)
+                struct task_struct *p, struct pt_regs *unused)
 {
-        struct pt_regs *childregs;
+        struct pt_regs *childregs = task_pt_regs(p);
        unsigned long ksp;
+        unsigned long *callee_regs;
        /*
-         * When creating a new kernel thread we pass sp as zero.
+         * Set up the stack and stack pointer appropriately for the
-         * Assign it to a reasonable value now that we have the stack.
+         * new child to find itself woken up in __switch_to().
+         * The callee-saved registers must be on the stack to be read;
+         * the new task will then jump to assembly support to handle
+         * calling schedule_tail(), etc., and (for userspace tasks)
+         * returning to the context set up in the pt_regs.
         */
-        if (sp == 0 && regs->ex1 == PL_ICS_EX1(KERNEL_PL, 0))
+        ksp = (unsigned long) childregs;
-                sp = KSTK_TOP(p);
+        ksp -= C_ABI_SAVE_AREA_SIZE;   /* interrupt-entry save area */
+        ((long *)ksp)[0] = ((long *)ksp)[1] = 0;
+        ksp -= CALLEE_SAVED_REGS_COUNT * sizeof(unsigned long);
+        callee_regs = (unsigned long *)ksp;
+        ksp -= C_ABI_SAVE_AREA_SIZE;   /* __switch_to() save area */
+        ((long *)ksp)[0] = ((long *)ksp)[1] = 0;
+        p->thread.ksp = ksp;
-        /*
+        /* Record the pid of the task that created this one. */
-         * Do not clone step state from the parent; each thread
+        p->thread.creator_pid = current->pid;
-         * must make its own lazily.
-         */
+        if (unlikely(p->flags & PF_KTHREAD)) {
-        task_thread_info(p)->step_state = NULL;
+                /* kernel thread */
+                memset(childregs, 0, sizeof(struct pt_regs));
+                memset(&callee_regs[2], 0,
+                       (CALLEE_SAVED_REGS_COUNT - 2) * sizeof(unsigned long));
+                callee_regs[0] = sp;   /* r30 = function */
+                callee_regs[1] = arg;  /* r31 = arg */
+                childregs->ex1 = PL_ICS_EX1(KERNEL_PL, 0);
+                p->thread.pc = (unsigned long) ret_from_kernel_thread;
+                return 0;
+        }
        /*
         * Start new thread in ret_from_fork so it schedules properly
@@ -182,46 +202,33 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
         */
        p->thread.pc = (unsigned long) ret_from_fork;
-        /* Save user stack top pointer so we can ID the stack vm area later. */
+        /*
-        p->thread.usp0 = sp;
+         * Do not clone step state from the parent; each thread
+         * must make its own lazily.
-        /* Record the pid of the process that created this one. */
+         */
-        p->thread.creator_pid = current->pid;
+        task_thread_info(p)->step_state = NULL;
        /*
         * Copy the registers onto the kernel stack so the
         * return-from-interrupt code will reload it into registers.
         */
-        childregs = task_pt_regs(p);
+        *childregs = *current_pt_regs();
-        *childregs = *regs;
        childregs->regs[0] = 0;         /* return value is zero */
-        childregs->sp = sp;  /* override with new user stack pointer */
+        if (sp)
+                childregs->sp = sp;  /* override with new user stack pointer */
+        memcpy(callee_regs, &childregs->regs[CALLEE_SAVED_FIRST_REG],
+               CALLEE_SAVED_REGS_COUNT * sizeof(unsigned long));
+        /* Save user stack top pointer so we can ID the stack vm area later. */
+        p->thread.usp0 = childregs->sp;
        /*
         * If CLONE_SETTLS is set, set "tp" in the new task to "r4",
         * which is passed in as arg #5 to sys_clone().
         */
        if (clone_flags & CLONE_SETTLS)
-                childregs->tp = regs->regs[4];
+                childregs->tp = childregs->regs[4];
-        /*
-         * Copy the callee-saved registers from the passed pt_regs struct
-         * into the context-switch callee-saved registers area.
-         * This way when we start the interrupt-return sequence, the
-         * callee-save registers will be correctly in registers, which
-         * is how we assume the compiler leaves them as we start doing
-         * the normal return-from-interrupt path after calling C code.
-         * Zero out the C ABI save area to mark the top of the stack.
-         */
-        ksp = (unsigned long) childregs;
-        ksp -= C_ABI_SAVE_AREA_SIZE;   /* interrupt-entry save area */
-        ((long *)ksp)[0] = ((long *)ksp)[1] = 0;
-        ksp -= CALLEE_SAVED_REGS_COUNT * sizeof(unsigned long);
-        memcpy((void *)ksp, &regs->regs[CALLEE_SAVED_FIRST_REG],
-               CALLEE_SAVED_REGS_COUNT * sizeof(unsigned long));
-        ksp -= C_ABI_SAVE_AREA_SIZE;   /* __switch_to() save area */
-        ((long *)ksp)[0] = ((long *)ksp)[1] = 0;
-        p->thread.ksp = ksp;
 #if CHIP_HAS_TILE_DMA()
        /*
@@ -578,61 +585,13 @@ int do_work_pending(struct pt_regs *regs, u32 thread_info_flags)
 }
 /* Note there is an implicit fifth argument if (clone_flags & CLONE_SETTLS). */
-SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
+SYSCALL_DEFINE4(clone, unsigned long, clone_flags, unsigned long, newsp,
-                void __user *, parent_tidptr, void __user *, child_tidptr,
+                void __user *, parent_tidptr, void __user *, child_tidptr)
-                struct pt_regs *, regs)
 {
-        if (!newsp)
+        return do_fork(clone_flags, newsp, current_pt_regs(), 0,
-                newsp = regs->sp;
-        return do_fork(clone_flags, newsp, regs, 0,
                       parent_tidptr, child_tidptr);
 }
-/*
- * sys_execve() executes a new program.
- */
-SYSCALL_DEFINE4(execve, const char __user *, path,
-                const char __user *const __user *, argv,
-                const char __user *const __user *, envp,
-                struct pt_regs *, regs)
-{
-        long error;
-        struct filename *filename;
-        filename = getname(path);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name, argv, envp, regs);
-        putname(filename);
-        if (error == 0)
-                single_step_execve();
-out:
-        return error;
-}
-#ifdef CONFIG_COMPAT
-long compat_sys_execve(const char __user *path,
-                       compat_uptr_t __user *argv,
-                       compat_uptr_t __user *envp,
-                       struct pt_regs *regs)
-{
-        long error;
-        struct filename *filename;
-        filename = getname(path);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = compat_do_execve(filename->name, argv, envp, regs);
-        putname(filename);
-        if (error == 0)
-                single_step_execve();
-out:
-        return error;
-}
-#endif
 unsigned long get_wchan(struct task_struct *p)
 {
        struct KBacktraceIterator kbt;
@@ -650,37 +609,6 @@ unsigned long get_wchan(struct task_struct *p)
        return 0;
 }
-/*
- * We pass in lr as zero (cleared in kernel_thread) and the caller
- * part of the backtrace ABI on the stack also zeroed (in copy_thread)
- * so that backtraces will stop with this function.
- * Note that we don't use r0, since copy_thread() clears it.
- */
-static void start_kernel_thread(int dummy, int (*fn)(int), int arg)
-{
-        do_exit(fn(arg));
-}
-/*
- * Create a kernel thread
- */
-int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        regs.ex1 = PL_ICS_EX1(KERNEL_PL, 0);  /* run at kernel PL, no ICS */
-        regs.pc = (long) start_kernel_thread;
-        regs.flags = PT_FLAGS_CALLER_SAVES;   /* need to restore r1 and r2 */
-        regs.regs[1] = (long) fn;             /* function pointer */
-        regs.regs[2] = (long) arg;            /* parameter register */
-        /* Ok, create the new process.. */
-        return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &regs,
-                       0, NULL, NULL);
-}
-EXPORT_SYMBOL(kernel_thread);
 /* Flush thread state. */
 void flush_thread(void)
 {
diff --git a/arch/tile/kernel/signal.c b/arch/tile/kernel/signal.c
index 67efb656d104..657a7ace4ab4 100644
--- a/arch/tile/kernel/signal.c
+++ b/arch/tile/kernel/signal.c
@@ -37,10 +37,10 @@
 #define DEBUG_SIG 0
-SYSCALL_DEFINE3(sigaltstack, const stack_t __user *, uss,
+SYSCALL_DEFINE2(sigaltstack, const stack_t __user *, uss,
-                stack_t __user *, uoss, struct pt_regs *, regs)
+                stack_t __user *, uoss)
 {
-        return do_sigaltstack(uss, uoss, regs->sp);
+        return do_sigaltstack(uss, uoss, current_pt_regs()->sp);
 }
@@ -83,8 +83,9 @@ void signal_fault(const char *type, struct pt_regs *regs,
 }
 /* The assembly shim for this function arranges to ignore the return value. */
-SYSCALL_DEFINE1(rt_sigreturn, struct pt_regs *, regs)
+SYSCALL_DEFINE0(rt_sigreturn)
 {
+        struct pt_regs *regs = current_pt_regs();
        struct rt_sigframe __user *frame =
                (struct rt_sigframe __user *)(regs->sp);
        sigset_t set;
diff --git a/arch/tile/kernel/sys.c b/arch/tile/kernel/sys.c
index b08095b402d6..02ff5c0ef775 100644
--- a/arch/tile/kernel/sys.c
+++ b/arch/tile/kernel/sys.c
@@ -106,14 +106,11 @@ SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
 #define sys_readahead sys32_readahead
 #endif
-/* Call the trampolines to manage pt_regs where necessary. */
+/* Call the assembly trampolines where necessary. */
-#define sys_execve _sys_execve
+#undef sys_rt_sigreturn
-#define sys_sigaltstack _sys_sigaltstack
 #define sys_rt_sigreturn _sys_rt_sigreturn
+#undef sys_clone
 #define sys_clone _sys_clone
-#ifndef __tilegx__
-#define sys_cmpxchg_badaddr _sys_cmpxchg_badaddr
-#endif
 /*
 * Note that we can't include <linux/unistd.h> here since the header
diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
index fe811fa5f1b9..3d2b81c163a6 100644
--- a/arch/tile/mm/fault.c
+++ b/arch/tile/mm/fault.c
@@ -70,9 +70,10 @@ static noinline void force_sig_info_fault(const char *type, int si_signo,
 * Synthesize the fault a PL0 process would get by doing a word-load of
 * an unaligned address or a high kernel address.
 */
-SYSCALL_DEFINE2(cmpxchg_badaddr, unsigned long, address,
+SYSCALL_DEFINE1(cmpxchg_badaddr, unsigned long, address)
-                struct pt_regs *, regs)
 {
+        struct pt_regs *regs = current_pt_regs();
        if (address >= PAGE_OFFSET)
                force_sig_info_fault("atomic segfault", SIGSEGV, SEGV_MAPERR,
                                     address, INT_DTLB_MISS, current, regs);
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 59c226d120cd..c20d1ce62dc6 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -359,18 +359,14 @@ HYPERVISOR_update_va_mapping(unsigned long va, pte_t new_val,
                return _hypercall4(int, update_va_mapping, va,
                                   new_val.pte, new_val.pte >> 32, flags);
 }
+extern int __must_check xen_event_channel_op_compat(int, void *);
 static inline int
 HYPERVISOR_event_channel_op(int cmd, void *arg)
 {
        int rc = _hypercall2(int, event_channel_op, cmd, arg);
-        if (unlikely(rc == -ENOSYS)) {
+        if (unlikely(rc == -ENOSYS))
-                struct evtchn_op op;
+                rc = xen_event_channel_op_compat(cmd, arg);
-                op.cmd = cmd;
-                memcpy(&op.u, arg, sizeof(op.u));
-                rc = _hypercall1(int, event_channel_op_compat, &op);
-                memcpy(arg, &op.u, sizeof(op.u));
-        }
        return rc;
 }
@@ -386,17 +382,14 @@ HYPERVISOR_console_io(int cmd, int count, char *str)
        return _hypercall3(int, console_io, cmd, count, str);
 }
+extern int __must_check HYPERVISOR_physdev_op_compat(int, void *);
 static inline int
 HYPERVISOR_physdev_op(int cmd, void *arg)
 {
        int rc = _hypercall2(int, physdev_op, cmd, arg);
-        if (unlikely(rc == -ENOSYS)) {
+        if (unlikely(rc == -ENOSYS))
-                struct physdev_op op;
+                rc = HYPERVISOR_physdev_op_compat(cmd, arg);
-                op.cmd = cmd;
-                memcpy(&op.u, arg, sizeof(op.u));
-                rc = _hypercall1(int, physdev_op_compat, &op);
-                memcpy(arg, &op.u, sizeof(op.u));
-        }
        return rc;
 }
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index 671d4d6d14df..7bdd61b867c8 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -137,13 +137,18 @@ static void cryptd_queue_worker(struct work_struct *work)
        struct crypto_async_request *req, *backlog;
        cpu_queue = container_of(work, struct cryptd_cpu_queue, work);
-        /* Only handle one request at a time to avoid hogging crypto
+        /*
-         * workqueue. preempt_disable/enable is used to prevent
+         * Only handle one request at a time to avoid hogging crypto workqueue.
-         * being preempted by cryptd_enqueue_request() */
+         * preempt_disable/enable is used to prevent being preempted by
+         * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent
+         * cryptd_enqueue_request() being accessed from software interrupts.
+         */
+        local_bh_disable();
        preempt_disable();
        backlog = crypto_get_backlog(&cpu_queue->queue);
        req = crypto_dequeue_request(&cpu_queue->queue);
        preempt_enable();
+        local_bh_enable();
        if (!req)
                return;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 8727e9c5eea4..72c776f2a1f5 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -83,9 +83,16 @@ EXPORT_SYMBOL_GPL(platform_get_resource);
 */
 int platform_get_irq(struct platform_device *dev, unsigned int num)
 {
+#ifdef CONFIG_SPARC
+        /* sparc does not have irqs represented as IORESOURCE_IRQ resources */
+        if (!dev || num >= dev->archdata.num_irqs)
+                return -ENXIO;
+        return dev->archdata.irqs[num];
+#else
        struct resource *r = platform_get_resource(dev, IORESOURCE_IRQ, num);
        return r ? r->start : -ENXIO;
+#endif
 }
 EXPORT_SYMBOL_GPL(platform_get_irq);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index d055cee36942..f11d8e3b4041 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -47,7 +47,7 @@ if GPIOLIB
 config OF_GPIO
        def_bool y
-        depends on OF && !SPARC
+        depends on OF
 config DEBUG_GPIO
        bool "Debug GPIO calls"
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 16a9afb1060b..05a909a17cee 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -22,6 +22,8 @@
 * Authors: Ben Skeggs
 */
+#include <subdev/bar.h>
 #include <engine/software.h>
 #include <engine/disp.h>
@@ -37,6 +39,7 @@ nv50_disp_sclass[] = {
 static void
 nv50_disp_intr_vblank(struct nv50_disp_priv *priv, int crtc)
 {
+        struct nouveau_bar *bar = nouveau_bar(priv);
        struct nouveau_disp *disp = &priv->base;
        struct nouveau_software_chan *chan, *temp;
        unsigned long flags;
@@ -46,18 +49,19 @@ nv50_disp_intr_vblank(struct nv50_disp_priv *priv, int crtc)
                if (chan->vblank.crtc != crtc)
                        continue;
-                nv_wr32(priv, 0x001704, chan->vblank.channel);
-                nv_wr32(priv, 0x001710, 0x80000000 | chan->vblank.ctxdma);
                if (nv_device(priv)->chipset == 0x50) {
+                        nv_wr32(priv, 0x001704, chan->vblank.channel);
+                        nv_wr32(priv, 0x001710, 0x80000000 | chan->vblank.ctxdma);
+                        bar->flush(bar);
                        nv_wr32(priv, 0x001570, chan->vblank.offset);
                        nv_wr32(priv, 0x001574, chan->vblank.value);
                } else {
-                        if (nv_device(priv)->chipset >= 0xc0) {
+                        nv_wr32(priv, 0x001718, 0x80000000 | chan->vblank.channel);
-                                nv_wr32(priv, 0x06000c,
+                        bar->flush(bar);
-                                        upper_32_bits(chan->vblank.offset));
+                        nv_wr32(priv, 0x06000c,
-                        }
+                                upper_32_bits(chan->vblank.offset));
-                        nv_wr32(priv, 0x060010, chan->vblank.offset);
+                        nv_wr32(priv, 0x060010,
+                                lower_32_bits(chan->vblank.offset));
                        nv_wr32(priv, 0x060014, chan->vblank.value);
                }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
index 8d0021049ec0..425001204a89 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
@@ -156,8 +156,8 @@ nv40_graph_context_ctor(struct nouveau_object *parent,
 static int
 nv40_graph_context_fini(struct nouveau_object *object, bool suspend)
 {
-        struct nv04_graph_priv *priv = (void *)object->engine;
+        struct nv40_graph_priv *priv = (void *)object->engine;
-        struct nv04_graph_chan *chan = (void *)object;
+        struct nv40_graph_chan *chan = (void *)object;
        u32 inst = 0x01000000 | nv_gpuobj(chan)->addr >> 4;
        int ret = 0;
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
index 12418574efea..f7c581ad1991 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
@@ -38,7 +38,7 @@ struct nv40_mpeg_priv {
 };
 struct nv40_mpeg_chan {
-        struct nouveau_mpeg base;
+        struct nouveau_mpeg_chan base;
 };
 /*******************************************************************************
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
index 49050d991e75..9474cfca6e4c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
@@ -67,7 +67,7 @@ nv41_vm_unmap(struct nouveau_gpuobj *pgt, u32 pte, u32 cnt)
 static void
 nv41_vm_flush(struct nouveau_vm *vm)
 {
-        struct nv04_vm_priv *priv = (void *)vm->vmm;
+        struct nv04_vmmgr_priv *priv = (void *)vm->vmm;
        mutex_lock(&nv_subdev(priv)->mutex);
        nv_wr32(priv, 0x100810, 0x00000022);
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 9a6e2cb282dc..d3595b23434a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -355,7 +355,7 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
         * valid - it's not (rh#613284)
         */
        if (nv_encoder->dcb->lvdsconf.use_acpi_for_edid) {
-                if (!(nv_connector->edid = nouveau_acpi_edid(dev, connector))) {
+                if ((nv_connector->edid = nouveau_acpi_edid(dev, connector))) {
                        status = connector_status_connected;
                        goto out;
                }
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 2e566e123e9e..3bce0299f64a 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1696,35 +1696,43 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                        return ATOM_PPLL2;
                DRM_ERROR("unable to allocate a PPLL\n");
                return ATOM_PPLL_INVALID;
-        } else {
+        } else if (ASIC_IS_AVIVO(rdev)) {
-                if (ASIC_IS_AVIVO(rdev)) {
+                /* in DP mode, the DP ref clock can come from either PPLL
-                        /* in DP mode, the DP ref clock can come from either PPLL
+                 * depending on the asic:
-                         * depending on the asic:
+                 * DCE3: PPLL1 or PPLL2
-                         * DCE3: PPLL1 or PPLL2
+                 */
-                         */
+                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
-                        if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
+                        /* use the same PPLL for all DP monitors */
-                                /* use the same PPLL for all DP monitors */
+                        pll = radeon_get_shared_dp_ppll(crtc);
-                                pll = radeon_get_shared_dp_ppll(crtc);
+                        if (pll != ATOM_PPLL_INVALID)
-                                if (pll != ATOM_PPLL_INVALID)
+                                return pll;
-                                        return pll;
+                } else {
-                        } else {
+                        /* use the same PPLL for all monitors with the same clock */
-                                /* use the same PPLL for all monitors with the same clock */
+                        pll = radeon_get_shared_nondp_ppll(crtc);
-                                pll = radeon_get_shared_nondp_ppll(crtc);
+                        if (pll != ATOM_PPLL_INVALID)
-                                if (pll != ATOM_PPLL_INVALID)
+                                return pll;
-                                        return pll;
+                }
-                        }
+                /* all other cases */
-                        /* all other cases */
+                pll_in_use = radeon_get_pll_use_mask(crtc);
-                        pll_in_use = radeon_get_pll_use_mask(crtc);
+                /* the order shouldn't matter here, but we probably
+                 * need this until we have atomic modeset
+                 */
+                if (rdev->flags & RADEON_IS_IGP) {
                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
                                return ATOM_PPLL1;
                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                return ATOM_PPLL2;
-                        DRM_ERROR("unable to allocate a PPLL\n");
-                        return ATOM_PPLL_INVALID;
                } else {
-                        /* on pre-R5xx asics, the crtc to pll mapping is hardcoded */
+                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                        return radeon_crtc->crtc_id;
+                                return ATOM_PPLL2;
+                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                                return ATOM_PPLL1;
                }
+                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL_INVALID;
+        } else {
+                /* on pre-R5xx asics, the crtc to pll mapping is hardcoded */
+                return radeon_crtc->crtc_id;
        }
 }
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 95e6318b6268..c042e497e450 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -2725,6 +2725,9 @@ static bool evergreen_vm_reg_valid(u32 reg)
        /* check config regs */
        switch (reg) {
        case GRBM_GFX_INDEX:
+        case CP_STRMOUT_CNTL:
+        case CP_COHER_CNTL:
+        case CP_COHER_SIZE:
        case VGT_VTX_VECT_EJECT_REG:
        case VGT_CACHE_INVALIDATION:
        case VGT_GS_VERTEX_REUSE:
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index df542f1a5dfb..2bc0f6a1b428 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -91,6 +91,10 @@
 #define         FB_READ_EN                                      (1 << 0)
 #define         FB_WRITE_EN                                     (1 << 1)
+#define CP_STRMOUT_CNTL                                 0x84FC
+#define CP_COHER_CNTL                                   0x85F0
+#define CP_COHER_SIZE                                   0x85F4
 #define CP_COHER_BASE                                   0x85F8
 #define CP_STALLED_STAT1                        0x8674
 #define CP_STALLED_STAT2                        0x8678
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index b0db712060fb..4422d630b33b 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2474,6 +2474,7 @@ static bool si_vm_reg_valid(u32 reg)
        /* check config regs */
        switch (reg) {
        case GRBM_GFX_INDEX:
+        case CP_STRMOUT_CNTL:
        case VGT_VTX_VECT_EJECT_REG:
        case VGT_CACHE_INVALIDATION:
        case VGT_ESGS_RING_SIZE:
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 7d2a20e56577..a8871afc5b4e 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -424,6 +424,7 @@
 #       define RDERR_INT_ENABLE                         (1 << 0)
 #       define GUI_IDLE_INT_ENABLE                      (1 << 19)
+#define CP_STRMOUT_CNTL                                 0x84FC
 #define SCRATCH_REG0                                    0x8500
 #define SCRATCH_REG1                                    0x8504
 #define SCRATCH_REG2                                    0x8508
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
index 3ce68a2e312d..d1498bfd7873 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
@@ -306,7 +306,7 @@ void vmw_bo_pin(struct ttm_buffer_object *bo, bool pin)
        BUG_ON(!atomic_read(&bo->reserved));
        BUG_ON(old_mem_type != TTM_PL_VRAM &&
-               old_mem_type != VMW_PL_FLAG_GMR);
+               old_mem_type != VMW_PL_GMR);
        pl_flags = TTM_PL_FLAG_VRAM | VMW_PL_FLAG_GMR | TTM_PL_FLAG_CACHED;
        if (pin)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index ed3c1e7ddde9..2dd185e42f21 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1098,6 +1098,11 @@ static void vmw_pm_complete(struct device *kdev)
        struct drm_device *dev = pci_get_drvdata(pdev);
        struct vmw_private *dev_priv = vmw_priv(dev);
+        mutex_lock(&dev_priv->hw_mutex);
+        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
+        (void) vmw_read(dev_priv, SVGA_REG_ID);
+        mutex_unlock(&dev_priv->hw_mutex);
        /**
         * Reclaim 3d reference held by fbdev and potentially
         * start fifo.
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 17d15bb610d1..7c47fc3f7b2b 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -42,7 +42,6 @@ static struct cdev hidraw_cdev;
 static struct class *hidraw_class;
 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
 static DEFINE_MUTEX(minors_lock);
-static void drop_ref(struct hidraw *hid, int exists_bit);
 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
@@ -114,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
        __u8 *buf;
        int ret = 0;
-        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+        if (!hidraw_table[minor]) {
                ret = -ENODEV;
                goto out;
        }
@@ -262,7 +261,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
        }
        mutex_lock(&minors_lock);
-        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+        if (!hidraw_table[minor]) {
                err = -ENODEV;
                goto out_unlock;
        }
@@ -299,12 +298,36 @@ out:
 static int hidraw_release(struct inode * inode, struct file * file)
 {
        unsigned int minor = iminor(inode);
+        struct hidraw *dev;
        struct hidraw_list *list = file->private_data;
+        int ret;
+        int i;
+        mutex_lock(&minors_lock);
+        if (!hidraw_table[minor]) {
+                ret = -ENODEV;
+                goto unlock;
+        }
-        drop_ref(hidraw_table[minor], 0);
        list_del(&list->node);
+        dev = hidraw_table[minor];
+        if (!--dev->open) {
+                if (list->hidraw->exist) {
+                        hid_hw_power(dev->hid, PM_HINT_NORMAL);
+                        hid_hw_close(dev->hid);
+                } else {
+                        kfree(list->hidraw);
+                }
+        }
+        for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+                kfree(list->buffer[i].value);
        kfree(list);
-        return 0;
+        ret = 0;
+unlock:
+        mutex_unlock(&minors_lock);
+        return ret;
 }
 static long hidraw_ioctl(struct file *file, unsigned int cmd,
@@ -506,7 +529,21 @@ EXPORT_SYMBOL_GPL(hidraw_connect);
 void hidraw_disconnect(struct hid_device *hid)
 {
        struct hidraw *hidraw = hid->hidraw;
-        drop_ref(hidraw, 1);
+        mutex_lock(&minors_lock);
+        hidraw->exist = 0;
+        device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+        hidraw_table[hidraw->minor] = NULL;
+        if (hidraw->open) {
+                hid_hw_close(hid);
+                wake_up_interruptible(&hidraw->wait);
+        } else {
+                kfree(hidraw);
+        }
+        mutex_unlock(&minors_lock);
 }
 EXPORT_SYMBOL_GPL(hidraw_disconnect);
@@ -555,23 +592,3 @@ void hidraw_exit(void)
        unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
 }
-static void drop_ref(struct hidraw *hidraw, int exists_bit)
-{
-        mutex_lock(&minors_lock);
-        if (exists_bit) {
-                hid_hw_close(hidraw->hid);
-                hidraw->exist = 0;
-                if (hidraw->open)
-                        wake_up_interruptible(&hidraw->wait);
-        } else {
-                --hidraw->open;
-        }
-        if (!hidraw->open && !hidraw->exist) {
-                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
-                hidraw_table[hidraw->minor] = NULL;
-                kfree(hidraw);
-        }
-        mutex_unlock(&minors_lock);
-}
diff --git a/drivers/isdn/Kconfig b/drivers/isdn/Kconfig
index a233ed53913a..86cd75a0e84d 100644
--- a/drivers/isdn/Kconfig
+++ b/drivers/isdn/Kconfig
@@ -4,7 +4,7 @@
 menuconfig ISDN
        bool "ISDN support"
-        depends on NET
+        depends on NET && NETDEVICES
        depends on !S390 && !UML
        ---help---
          ISDN ("Integrated Services Digital Network", called RNIS in France)
diff --git a/drivers/isdn/i4l/Kconfig b/drivers/isdn/i4l/Kconfig
index 2302fbe70ac6..9c6650ea848e 100644
--- a/drivers/isdn/i4l/Kconfig
+++ b/drivers/isdn/i4l/Kconfig
@@ -6,7 +6,7 @@ if ISDN_I4L
 config ISDN_PPP
        bool "Support synchronous PPP"
-        depends on INET && NETDEVICES
+        depends on INET
        select SLHC
        help
          Over digital connections such as ISDN, there is no need to
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 8c610fa6782b..e2a945ee9f05 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1312,7 +1312,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                        } else
                                return -EINVAL;
                        break;
-#ifdef CONFIG_NETDEVICES
                case IIOCNETGPN:
                        /* Get peer phone number of a connected
                         * isdn network interface */
@@ -1322,7 +1321,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                                return isdn_net_getpeer(&phone, argp);
                        } else
                                return -EINVAL;
-#endif
                default:
                        return -EINVAL;
                }
@@ -1352,7 +1350,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                case IIOCNETLCR:
                        printk(KERN_INFO "INFO: ISDN_ABC_LCR_SUPPORT not enabled\n");
                        return -ENODEV;
-#ifdef CONFIG_NETDEVICES
                case IIOCNETAIF:
                        /* Add a network-interface */
                        if (arg) {
@@ -1491,7 +1488,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                                return -EFAULT;
                        return isdn_net_force_hangup(name);
                        break;
-#endif                          /* CONFIG_NETDEVICES */
                case IIOCSETVER:
                        dev->net_verbose = arg;
                        printk(KERN_INFO "isdn: Verbose-Level is %d\n", dev->net_verbose);
diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index 660bbc528862..4d50da618166 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -208,7 +208,7 @@ static unsigned long exynos5250_dwmmc_caps[4] = {
        MMC_CAP_CMD23,
 };
-static struct dw_mci_drv_data exynos5250_drv_data = {
+static const struct dw_mci_drv_data exynos5250_drv_data = {
        .caps                   = exynos5250_dwmmc_caps,
        .init                   = dw_mci_exynos_priv_init,
        .setup_clock            = dw_mci_exynos_setup_clock,
@@ -220,14 +220,14 @@ static struct dw_mci_drv_data exynos5250_drv_data = {
 static const struct of_device_id dw_mci_exynos_match[] = {
        { .compatible = "samsung,exynos5250-dw-mshc",
-                        .data = (void *)&exynos5250_drv_data, },
+                        .data = &exynos5250_drv_data, },
        {},
 };
-MODULE_DEVICE_TABLE(of, dw_mci_pltfm_match);
+MODULE_DEVICE_TABLE(of, dw_mci_exynos_match);
 int dw_mci_exynos_probe(struct platform_device *pdev)
 {
-        struct dw_mci_drv_data *drv_data;
+        const struct dw_mci_drv_data *drv_data;
        const struct of_device_id *match;
        match = of_match_node(dw_mci_exynos_match, pdev->dev.of_node);
diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index c960ca7ffbe6..917936bee5d5 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -24,7 +24,7 @@
 #include "dw_mmc.h"
 int dw_mci_pltfm_register(struct platform_device *pdev,
-                                struct dw_mci_drv_data *drv_data)
+                                const struct dw_mci_drv_data *drv_data)
 {
        struct dw_mci *host;
        struct resource *regs;
@@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
        if (!host->regs)
                return -ENOMEM;
-        if (host->drv_data->init) {
+        if (drv_data && drv_data->init) {
-                ret = host->drv_data->init(host);
+                ret = drv_data->init(host);
                if (ret)
                        return ret;
        }
diff --git a/drivers/mmc/host/dw_mmc-pltfm.h b/drivers/mmc/host/dw_mmc-pltfm.h
index 301f24541fc2..2ac37b81de4d 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.h
+++ b/drivers/mmc/host/dw_mmc-pltfm.h
@@ -13,7 +13,7 @@
 #define _DW_MMC_PLTFM_H_
 extern int dw_mci_pltfm_register(struct platform_device *pdev,
-                                struct dw_mci_drv_data *drv_data);
+                                const struct dw_mci_drv_data *drv_data);
 extern int __devexit dw_mci_pltfm_remove(struct platform_device *pdev);
 extern const struct dev_pm_ops dw_mci_pltfm_pmops;
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c2828f35c3b8..c0667c8af2bd 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 {
        struct mmc_data *data;
        struct dw_mci_slot *slot = mmc_priv(mmc);
+        struct dw_mci_drv_data *drv_data = slot->host->drv_data;
        u32 cmdr;
        cmd->error = -EINPROGRESS;
@@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
                        cmdr |= SDMMC_CMD_DAT_WR;
        }
-        if (slot->host->drv_data->prepare_command)
+        if (drv_data && drv_data->prepare_command)
-                slot->host->drv_data->prepare_command(slot->host, &cmdr);
+                drv_data->prepare_command(slot->host, &cmdr);
        return cmdr;
 }
@@ -434,7 +435,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
        return 0;
 }
-static struct dw_mci_dma_ops dw_mci_idmac_ops = {
+static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
        .init = dw_mci_idmac_init,
        .start = dw_mci_idmac_start_dma,
        .stop = dw_mci_idmac_stop_dma,
@@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
 static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
        struct dw_mci_slot *slot = mmc_priv(mmc);
+        struct dw_mci_drv_data *drv_data = slot->host->drv_data;
        u32 regs;
        /* set default 1 bit mode */
@@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                slot->clock = ios->clock;
        }
-        if (slot->host->drv_data->set_ios)
+        if (drv_data && drv_data->set_ios)
-                slot->host->drv_data->set_ios(slot->host, ios);
+                drv_data->set_ios(slot->host, ios);
        switch (ios->power_mode) {
        case MMC_POWER_UP:
@@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 {
        struct mmc_host *mmc;
        struct dw_mci_slot *slot;
+        struct dw_mci_drv_data *drv_data = host->drv_data;
        int ctrl_id, ret;
        u8 bus_width;
@@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
        } else {
                ctrl_id = to_platform_device(host->dev)->id;
        }
-        if (host->drv_data && host->drv_data->caps)
+        if (drv_data && drv_data->caps)
-                mmc->caps |= host->drv_data->caps[ctrl_id];
+                mmc->caps |= drv_data->caps[ctrl_id];
        if (host->pdata->caps2)
                mmc->caps2 = host->pdata->caps2;
@@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
        else
                bus_width = 1;
-        if (host->drv_data->setup_bus) {
+        if (drv_data && drv_data->setup_bus) {
                struct device_node *slot_np;
                slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
-                ret = host->drv_data->setup_bus(host, slot_np, bus_width);
+                ret = drv_data->setup_bus(host, slot_np, bus_width);
                if (ret)
                        goto err_setup_bus;
        }
@@ -1968,7 +1971,7 @@ static void dw_mci_init_dma(struct dw_mci *host)
        /* Determine which DMA interface to use */
 #ifdef CONFIG_MMC_DW_IDMAC
        host->dma_ops = &dw_mci_idmac_ops;
-        dev_info(&host->dev, "Using internal DMA controller.\n");
+        dev_info(host->dev, "Using internal DMA controller.\n");
 #endif
        if (!host->dma_ops)
@@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
        struct dw_mci_board *pdata;
        struct device *dev = host->dev;
        struct device_node *np = dev->of_node;
+        struct dw_mci_drv_data *drv_data = host->drv_data;
        int idx, ret;
        pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
@@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
        of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
-        if (host->drv_data->parse_dt) {
+        if (drv_data && drv_data->parse_dt) {
-                ret = host->drv_data->parse_dt(host);
+                ret = drv_data->parse_dt(host);
                if (ret)
                        return ERR_PTR(ret);
        }
@@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 int dw_mci_probe(struct dw_mci *host)
 {
+        struct dw_mci_drv_data *drv_data = host->drv_data;
        int width, i, ret = 0;
        u32 fifo_size;
        int init_slots = 0;
@@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
        else
                host->bus_hz = clk_get_rate(host->ciu_clk);
-        if (host->drv_data->setup_clock) {
+        if (drv_data && drv_data->setup_clock) {
-                ret = host->drv_data->setup_clock(host);
+                ret = drv_data->setup_clock(host);
                if (ret) {
                        dev_err(host->dev,
                                "implementation specific clock setup failed\n");
@@ -2228,6 +2233,21 @@ int dw_mci_probe(struct dw_mci *host)
        else
                host->num_slots = ((mci_readl(host, HCON) >> 1) & 0x1F) + 1;
+        /*
+         * Enable interrupts for command done, data over, data empty, card det,
+         * receive ready and error such as transmit, receive timeout, crc error
+         */
+        mci_writel(host, RINTSTS, 0xFFFFFFFF);
+        mci_writel(host, INTMASK, SDMMC_INT_CMD_DONE | SDMMC_INT_DATA_OVER |
+                   SDMMC_INT_TXDR | SDMMC_INT_RXDR |
+                   DW_MCI_ERROR_FLAGS | SDMMC_INT_CD);
+        mci_writel(host, CTRL, SDMMC_CTRL_INT_ENABLE); /* Enable mci interrupt */
+        dev_info(host->dev, "DW MMC controller at irq %d, "
+                 "%d bit host data width, "
+                 "%u deep fifo\n",
+                 host->irq, width, fifo_size);
        /* We need at least one slot to succeed */
        for (i = 0; i < host->num_slots; i++) {
                ret = dw_mci_init_slot(host, i);
@@ -2257,20 +2277,6 @@ int dw_mci_probe(struct dw_mci *host)
        else
                host->data_offset = DATA_240A_OFFSET;
-        /*
-         * Enable interrupts for command done, data over, data empty, card det,
-         * receive ready and error such as transmit, receive timeout, crc error
-         */
-        mci_writel(host, RINTSTS, 0xFFFFFFFF);
-        mci_writel(host, INTMASK, SDMMC_INT_CMD_DONE | SDMMC_INT_DATA_OVER |
-                   SDMMC_INT_TXDR | SDMMC_INT_RXDR |
-                   DW_MCI_ERROR_FLAGS | SDMMC_INT_CD);
-        mci_writel(host, CTRL, SDMMC_CTRL_INT_ENABLE); /* Enable mci interrupt */
-        dev_info(host->dev, "DW MMC controller at irq %d, "
-                 "%d bit host data width, "
-                 "%u deep fifo\n",
-                 host->irq, width, fifo_size);
        if (host->quirks & DW_MCI_QUIRK_IDMAC_DTO)
                dev_info(host->dev, "Internal DMAC interrupt fix enabled.\n");
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 565c2e4fac75..6290b7f1ccfe 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -1134,4 +1134,4 @@ module_platform_driver(mxcmci_driver);
 MODULE_DESCRIPTION("i.MX Multimedia Card Interface Driver");
 MODULE_AUTHOR("Sascha Hauer, Pengutronix");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:imx-mmc");
+MODULE_ALIAS("platform:mxc-mmc");
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 54bfd0cc106b..fedd258cc4ea 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -178,7 +178,8 @@ struct omap_hsmmc_host {
 static int omap_hsmmc_card_detect(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        /* NOTE: assumes card detect signal is active-low */
        return !gpio_get_value_cansleep(mmc->slots[0].switch_pin);
@@ -186,7 +187,8 @@ static int omap_hsmmc_card_detect(struct device *dev, int slot)
 static int omap_hsmmc_get_wp(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        /* NOTE: assumes write protect signal is active-high */
        return gpio_get_value_cansleep(mmc->slots[0].gpio_wp);
@@ -194,7 +196,8 @@ static int omap_hsmmc_get_wp(struct device *dev, int slot)
 static int omap_hsmmc_get_cover_state(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        /* NOTE: assumes card detect signal is active-low */
        return !gpio_get_value_cansleep(mmc->slots[0].switch_pin);
@@ -204,7 +207,8 @@ static int omap_hsmmc_get_cover_state(struct device *dev, int slot)
 static int omap_hsmmc_suspend_cdirq(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        disable_irq(mmc->slots[0].card_detect_irq);
        return 0;
@@ -212,7 +216,8 @@ static int omap_hsmmc_suspend_cdirq(struct device *dev, int slot)
 static int omap_hsmmc_resume_cdirq(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        enable_irq(mmc->slots[0].card_detect_irq);
        return 0;
@@ -2009,9 +2014,9 @@ static int __devexit omap_hsmmc_remove(struct platform_device *pdev)
                clk_put(host->dbclk);
        }
-        mmc_free_host(host->mmc);
+        omap_hsmmc_gpio_free(host->pdata);
        iounmap(host->base);
-        omap_hsmmc_gpio_free(pdev->dev.platform_data);
+        mmc_free_host(host->mmc);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (res)
diff --git a/drivers/mmc/host/sdhci-dove.c b/drivers/mmc/host/sdhci-dove.c
index 90140eb03e36..8fd50a211037 100644
--- a/drivers/mmc/host/sdhci-dove.c
+++ b/drivers/mmc/host/sdhci-dove.c
@@ -19,6 +19,7 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#include <linux/err.h>
 #include <linux/io.h>
 #include <linux/clk.h>
 #include <linux/err.h>
@@ -84,30 +85,32 @@ static int __devinit sdhci_dove_probe(struct platform_device *pdev)
        struct sdhci_dove_priv *priv;
        int ret;
-        ret = sdhci_pltfm_register(pdev, &sdhci_dove_pdata);
-        if (ret)
-                goto sdhci_dove_register_fail;
        priv = devm_kzalloc(&pdev->dev, sizeof(struct sdhci_dove_priv),
                            GFP_KERNEL);
        if (!priv) {
                dev_err(&pdev->dev, "unable to allocate private data");
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto sdhci_dove_allocate_fail;
        }
+        priv->clk = clk_get(&pdev->dev, NULL);
+        if (!IS_ERR(priv->clk))
+                clk_prepare_enable(priv->clk);
+        ret = sdhci_pltfm_register(pdev, &sdhci_dove_pdata);
+        if (ret)
+                goto sdhci_dove_register_fail;
        host = platform_get_drvdata(pdev);
        pltfm_host = sdhci_priv(host);
        pltfm_host->priv = priv;
-        priv->clk = clk_get(&pdev->dev, NULL);
-        if (!IS_ERR(priv->clk))
-                clk_prepare_enable(priv->clk);
        return 0;
-sdhci_dove_allocate_fail:
-        sdhci_pltfm_unregister(pdev);
 sdhci_dove_register_fail:
+        if (!IS_ERR(priv->clk)) {
+                clk_disable_unprepare(priv->clk);
+                clk_put(priv->clk);
+        }
        return ret;
 }
@@ -117,14 +120,13 @@ static int __devexit sdhci_dove_remove(struct platform_device *pdev)
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
        struct sdhci_dove_priv *priv = pltfm_host->priv;
-        if (priv->clk) {
+        sdhci_pltfm_unregister(pdev);
-                if (!IS_ERR(priv->clk)) {
-                        clk_disable_unprepare(priv->clk);
+        if (!IS_ERR(priv->clk)) {
-                        clk_put(priv->clk);
+                clk_disable_unprepare(priv->clk);
-                }
+                clk_put(priv->clk);
-                devm_kfree(&pdev->dev, priv->clk);
        }
-        return sdhci_pltfm_unregister(pdev);
+        return 0;
 }
 static const struct of_device_id sdhci_dove_of_match_table[] __devinitdata = {
diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
index ae5fcbfa1eef..63d219f57cae 100644
--- a/drivers/mmc/host/sdhci-of-esdhc.c
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -169,6 +169,16 @@ static void esdhc_of_resume(struct sdhci_host *host)
 }
 #endif
+static void esdhc_of_platform_init(struct sdhci_host *host)
+{
+        u32 vvn;
+        vvn = in_be32(host->ioaddr + SDHCI_SLOT_INT_STATUS);
+        vvn = (vvn & SDHCI_VENDOR_VER_MASK) >> SDHCI_VENDOR_VER_SHIFT;
+        if (vvn == VENDOR_V_22)
+                host->quirks2 |= SDHCI_QUIRK2_HOST_NO_CMD23;
+}
 static struct sdhci_ops sdhci_esdhc_ops = {
        .read_l = esdhc_readl,
        .read_w = esdhc_readw,
@@ -180,6 +190,7 @@ static struct sdhci_ops sdhci_esdhc_ops = {
        .enable_dma = esdhc_of_enable_dma,
        .get_max_clock = esdhc_of_get_max_clock,
        .get_min_clock = esdhc_of_get_min_clock,
+        .platform_init = esdhc_of_platform_init,
 #ifdef CONFIG_PM
        .platform_suspend = esdhc_of_suspend,
        .platform_resume = esdhc_of_resume,
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 4bb74b042a06..04936f353ced 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -1196,7 +1196,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
                return ERR_PTR(-ENODEV);
        }
-        if (pci_resource_len(pdev, bar) != 0x100) {
+        if (pci_resource_len(pdev, bar) < 0x100) {
                dev_err(&pdev->dev, "Invalid iomem size. You may "
                        "experience problems.\n");
        }
diff --git a/drivers/mmc/host/sdhci-pltfm.c b/drivers/mmc/host/sdhci-pltfm.c
index 65551a9709cc..27164457f861 100644
--- a/drivers/mmc/host/sdhci-pltfm.c
+++ b/drivers/mmc/host/sdhci-pltfm.c
@@ -150,6 +150,13 @@ struct sdhci_host *sdhci_pltfm_init(struct platform_device *pdev,
                goto err_remap;
        }
+        /*
+         * Some platforms need to probe the controller to be able to
+         * determine which caps should be used.
+         */
+        if (host->ops && host->ops->platform_init)
+                host->ops->platform_init(host);
        platform_set_drvdata(pdev, host);
        return host;
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 2903949594c6..a54dd5d7a5f9 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -211,8 +211,8 @@ static void sdhci_s3c_set_clock(struct sdhci_host *host, unsigned int clock)
        if (ourhost->cur_clk != best_src) {
                struct clk *clk = ourhost->clk_bus[best_src];
-                clk_enable(clk);
+                clk_prepare_enable(clk);
-                clk_disable(ourhost->clk_bus[ourhost->cur_clk]);
+                clk_disable_unprepare(ourhost->clk_bus[ourhost->cur_clk]);
                /* turn clock off to card before changing clock source */
                writew(0, host->ioaddr + SDHCI_CLOCK_CONTROL);
@@ -607,7 +607,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        }
        /* enable the local io clock and keep it running for the moment. */
-        clk_enable(sc->clk_io);
+        clk_prepare_enable(sc->clk_io);
        for (clks = 0, ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                struct clk *clk;
@@ -638,7 +638,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        }
 #ifndef CONFIG_PM_RUNTIME
-        clk_enable(sc->clk_bus[sc->cur_clk]);
+        clk_prepare_enable(sc->clk_bus[sc->cur_clk]);
 #endif
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -747,13 +747,14 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
                sdhci_s3c_setup_card_detect_gpio(sc);
 #ifdef CONFIG_PM_RUNTIME
-        clk_disable(sc->clk_io);
+        if (pdata->cd_type != S3C_SDHCI_CD_INTERNAL)
+                clk_disable_unprepare(sc->clk_io);
 #endif
        return 0;
 err_req_regs:
 #ifndef CONFIG_PM_RUNTIME
-        clk_disable(sc->clk_bus[sc->cur_clk]);
+        clk_disable_unprepare(sc->clk_bus[sc->cur_clk]);
 #endif
        for (ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                if (sc->clk_bus[ptr]) {
@@ -762,7 +763,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        }
 err_no_busclks:
-        clk_disable(sc->clk_io);
+        clk_disable_unprepare(sc->clk_io);
        clk_put(sc->clk_io);
 err_io_clk:
@@ -794,7 +795,8 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
                gpio_free(sc->ext_cd_gpio);
 #ifdef CONFIG_PM_RUNTIME
-        clk_enable(sc->clk_io);
+        if (pdata->cd_type != S3C_SDHCI_CD_INTERNAL)
+                clk_prepare_enable(sc->clk_io);
 #endif
        sdhci_remove_host(host, 1);
@@ -802,14 +804,14 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
 #ifndef CONFIG_PM_RUNTIME
-        clk_disable(sc->clk_bus[sc->cur_clk]);
+        clk_disable_unprepare(sc->clk_bus[sc->cur_clk]);
 #endif
        for (ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                if (sc->clk_bus[ptr]) {
                        clk_put(sc->clk_bus[ptr]);
                }
        }
-        clk_disable(sc->clk_io);
+        clk_disable_unprepare(sc->clk_io);
        clk_put(sc->clk_io);
        if (pdev->dev.of_node) {
@@ -849,8 +851,8 @@ static int sdhci_s3c_runtime_suspend(struct device *dev)
        ret = sdhci_runtime_suspend_host(host);
-        clk_disable(ourhost->clk_bus[ourhost->cur_clk]);
+        clk_disable_unprepare(ourhost->clk_bus[ourhost->cur_clk]);
-        clk_disable(busclk);
+        clk_disable_unprepare(busclk);
        return ret;
 }
@@ -861,8 +863,8 @@ static int sdhci_s3c_runtime_resume(struct device *dev)
        struct clk *busclk = ourhost->clk_io;
        int ret;
-        clk_enable(busclk);
+        clk_prepare_enable(busclk);
-        clk_enable(ourhost->clk_bus[ourhost->cur_clk]);
+        clk_prepare_enable(ourhost->clk_bus[ourhost->cur_clk]);
        ret = sdhci_runtime_resume_host(host);
        return ret;
 }
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 7922adb42386..c7851c0aabce 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1315,16 +1315,19 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
                 */
                if ((host->flags & SDHCI_NEEDS_RETUNING) &&
                    !(present_state & (SDHCI_DOING_WRITE | SDHCI_DOING_READ))) {
-                        /* eMMC uses cmd21 while sd and sdio use cmd19 */
+                        if (mmc->card) {
-                        tuning_opcode = mmc->card->type == MMC_TYPE_MMC ?
+                                /* eMMC uses cmd21 but sd and sdio use cmd19 */
-                                MMC_SEND_TUNING_BLOCK_HS200 :
+                                tuning_opcode =
-                                MMC_SEND_TUNING_BLOCK;
+                                        mmc->card->type == MMC_TYPE_MMC ?
-                        spin_unlock_irqrestore(&host->lock, flags);
+                                        MMC_SEND_TUNING_BLOCK_HS200 :
-                        sdhci_execute_tuning(mmc, tuning_opcode);
+                                        MMC_SEND_TUNING_BLOCK;
-                        spin_lock_irqsave(&host->lock, flags);
+                                spin_unlock_irqrestore(&host->lock, flags);
+                                sdhci_execute_tuning(mmc, tuning_opcode);
-                        /* Restore original mmc_request structure */
+                                spin_lock_irqsave(&host->lock, flags);
-                        host->mrq = mrq;
+                                /* Restore original mmc_request structure */
+                                host->mrq = mrq;
+                        }
                }
                if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
@@ -2837,6 +2840,9 @@ int sdhci_add_host(struct sdhci_host *host)
        if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
                mmc->caps |= MMC_CAP_4_BIT_DATA;
+        if (host->quirks2 & SDHCI_QUIRK2_HOST_NO_CMD23)
+                mmc->caps &= ~MMC_CAP_CMD23;
        if (caps[0] & SDHCI_CAN_DO_HISPD)
                mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
@@ -2846,9 +2852,12 @@ int sdhci_add_host(struct sdhci_host *host)
        /* If vqmmc regulator and no 1.8V signalling, then there's no UHS */
        host->vqmmc = regulator_get(mmc_dev(mmc), "vqmmc");
-        if (IS_ERR(host->vqmmc)) {
+        if (IS_ERR_OR_NULL(host->vqmmc)) {
-                pr_info("%s: no vqmmc regulator found\n", mmc_hostname(mmc));
+                if (PTR_ERR(host->vqmmc) < 0) {
-                host->vqmmc = NULL;
+                        pr_info("%s: no vqmmc regulator found\n",
+                                mmc_hostname(mmc));
+                        host->vqmmc = NULL;
+                }
        }
        else if (regulator_is_supported_voltage(host->vqmmc, 1800000, 1800000))
                regulator_enable(host->vqmmc);
@@ -2904,9 +2913,12 @@ int sdhci_add_host(struct sdhci_host *host)
        ocr_avail = 0;
        host->vmmc = regulator_get(mmc_dev(mmc), "vmmc");
-        if (IS_ERR(host->vmmc)) {
+        if (IS_ERR_OR_NULL(host->vmmc)) {
-                pr_info("%s: no vmmc regulator found\n", mmc_hostname(mmc));
+                if (PTR_ERR(host->vmmc) < 0) {
-                host->vmmc = NULL;
+                        pr_info("%s: no vmmc regulator found\n",
+                                mmc_hostname(mmc));
+                        host->vmmc = NULL;
+                }
        } else
                regulator_enable(host->vmmc);
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 97653ea8942b..71a4a7ed46c5 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -278,6 +278,7 @@ struct sdhci_ops {
        void    (*hw_reset)(struct sdhci_host *host);
        void    (*platform_suspend)(struct sdhci_host *host);
        void    (*platform_resume)(struct sdhci_host *host);
+        void    (*platform_init)(struct sdhci_host *host);
 };
 #ifdef CONFIG_MMC_SDHCI_IO_ACCESSORS
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index 11d2bc3b51d5..d25bc97dc5c6 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -1466,9 +1466,9 @@ static int __devexit sh_mmcif_remove(struct platform_device *pdev)
        platform_set_drvdata(pdev, NULL);
+        clk_disable(host->hclk);
        mmc_free_host(host->mmc);
        pm_runtime_put_sync(&pdev->dev);
-        clk_disable(host->hclk);
        pm_runtime_disable(&pdev->dev);
        return 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index c65295dded39..6e5bdd1a31d9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1702,7 +1702,7 @@ static int bnx2x_set_eee(struct net_device *dev, struct ethtool_eee *edata)
                                      SHMEM_EEE_ADV_STATUS_SHIFT);
        if ((advertised != (eee_cfg & SHMEM_EEE_ADV_STATUS_MASK))) {
                DP(BNX2X_MSG_ETHTOOL,
-                   "Direct manipulation of EEE advertisment is not supported\n");
+                   "Direct manipulation of EEE advertisement is not supported\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 6dd0dd076cc5..f6cfdc6cf20f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -9941,7 +9941,7 @@ static int bnx2x_848x3_config_init(struct bnx2x_phy *phy,
                else
                        rc = bnx2x_8483x_disable_eee(phy, params, vars);
                if (rc) {
-                        DP(NETIF_MSG_LINK, "Failed to set EEE advertisment\n");
+                        DP(NETIF_MSG_LINK, "Failed to set EEE advertisement\n");
                        return rc;
                }
        } else {
@@ -12987,7 +12987,7 @@ static u8 bnx2x_analyze_link_error(struct link_params *params,
                DP(NETIF_MSG_LINK, "Analyze TX Fault\n");
                break;
        default:
-                DP(NETIF_MSG_LINK, "Analyze UNKOWN\n");
+                DP(NETIF_MSG_LINK, "Analyze UNKNOWN\n");
        }
        DP(NETIF_MSG_LINK, "Link changed:[%x %x]->%x\n", vars->link_up,
           old_status, status);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 32eec15fe4c2..730ae2cfa49e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -2519,6 +2519,7 @@ int t4_fw_bye(struct adapter *adap, unsigned int mbox)
 {
        struct fw_bye_cmd c;
+        memset(&c, 0, sizeof(c));
        INIT_CMD(c, BYE, WRITE);
        return t4_wr_mbox(adap, mbox, &c, sizeof(c), NULL);
 }
@@ -2535,6 +2536,7 @@ int t4_early_init(struct adapter *adap, unsigned int mbox)
 {
        struct fw_initialize_cmd c;
+        memset(&c, 0, sizeof(c));
        INIT_CMD(c, INITIALIZE, WRITE);
        return t4_wr_mbox(adap, mbox, &c, sizeof(c), NULL);
 }
@@ -2551,6 +2553,7 @@ int t4_fw_reset(struct adapter *adap, unsigned int mbox, int reset)
 {
        struct fw_reset_cmd c;
+        memset(&c, 0, sizeof(c));
        INIT_CMD(c, RESET, WRITE);
        c.val = htonl(reset);
        return t4_wr_mbox(adap, mbox, &c, sizeof(c), NULL);
@@ -2828,7 +2831,7 @@ int t4_fixup_host_params(struct adapter *adap, unsigned int page_size,
                     HOSTPAGESIZEPF7(sge_hps));
        t4_set_reg_field(adap, SGE_CONTROL,
-                         INGPADBOUNDARY(INGPADBOUNDARY_MASK) |
+                         INGPADBOUNDARY_MASK |
                         EGRSTATUSPAGESIZE_MASK,
                         INGPADBOUNDARY(fl_align_log - 5) |
                         EGRSTATUSPAGESIZE(stat_len != 64));
@@ -3278,6 +3281,7 @@ int t4_identify_port(struct adapter *adap, unsigned int mbox, unsigned int viid,
 {
        struct fw_vi_enable_cmd c;
+        memset(&c, 0, sizeof(c));
        c.op_to_viid = htonl(FW_CMD_OP(FW_VI_ENABLE_CMD) | FW_CMD_REQUEST |
                             FW_CMD_EXEC | FW_VI_ENABLE_CMD_VIID(viid));
        c.ien_to_len16 = htonl(FW_VI_ENABLE_CMD_LED | FW_LEN16(c));
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 1d03dcdd5e56..19ac096cb07b 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1353,8 +1353,11 @@ static int gfar_restore(struct device *dev)
        struct gfar_private *priv = dev_get_drvdata(dev);
        struct net_device *ndev = priv->ndev;
-        if (!netif_running(ndev))
+        if (!netif_running(ndev)) {
+                netif_device_attach(ndev);
                return 0;
+        }
        gfar_init_bds(ndev);
        init_registers(ndev);
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index f8064df10cc4..92317e9c0f73 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -1948,10 +1948,10 @@ jme_close(struct net_device *netdev)
        JME_NAPI_DISABLE(jme);
-        tasklet_disable(&jme->linkch_task);
+        tasklet_kill(&jme->linkch_task);
-        tasklet_disable(&jme->txclean_task);
+        tasklet_kill(&jme->txclean_task);
-        tasklet_disable(&jme->rxclean_task);
+        tasklet_kill(&jme->rxclean_task);
-        tasklet_disable(&jme->rxempty_task);
+        tasklet_kill(&jme->rxempty_task);
        jme_disable_rx_engine(jme);
        jme_disable_tx_engine(jme);
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 9b9c2ac5c4c2..d19a143aa5a8 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4026,7 +4026,7 @@ static void __devexit skge_remove(struct pci_dev *pdev)
        dev0 = hw->dev[0];
        unregister_netdev(dev0);
-        tasklet_disable(&hw->phy_task);
+        tasklet_kill(&hw->phy_task);
        spin_lock_irq(&hw->hw_lock);
        hw->intr_mask = 0;
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index 318fee91c79d..e558edd1cb6c 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -5407,8 +5407,8 @@ static int netdev_close(struct net_device *dev)
                /* Delay for receive task to stop scheduling itself. */
                msleep(2000 / HZ);
-                tasklet_disable(&hw_priv->rx_tasklet);
+                tasklet_kill(&hw_priv->rx_tasklet);
-                tasklet_disable(&hw_priv->tx_tasklet);
+                tasklet_kill(&hw_priv->tx_tasklet);
                free_irq(dev->irq, hw_priv->dev);
                transmit_cleanup(hw_priv, 0);
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index e7ff886e8047..927aa33d4349 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3827,6 +3827,8 @@ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
        void __iomem *ioaddr = tp->mmio_addr;
        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_25:
+        case RTL_GIGA_MAC_VER_26:
        case RTL_GIGA_MAC_VER_29:
        case RTL_GIGA_MAC_VER_30:
        case RTL_GIGA_MAC_VER_32:
@@ -4519,6 +4521,9 @@ static void rtl_set_rx_mode(struct net_device *dev)
                mc_filter[1] = swab32(data);
        }
+        if (tp->mac_version == RTL_GIGA_MAC_VER_35)
+                mc_filter[1] = mc_filter[0] = 0xffffffff;
        RTL_W32(MAR0 + 4, mc_filter[1]);
        RTL_W32(MAR0 + 0, mc_filter[0]);
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 0793299bd39e..1d04754a6637 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -990,7 +990,7 @@ static int axienet_stop(struct net_device *ndev)
        axienet_setoptions(ndev, lp->options &
                           ~(XAE_OPTION_TXEN | XAE_OPTION_RXEN));
-        tasklet_disable(&lp->dma_err_tasklet);
+        tasklet_kill(&lp->dma_err_tasklet);
        free_irq(lp->tx_irq, ndev);
        free_irq(lp->rx_irq, ndev);
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index c81e278629ff..08d55b6bf272 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -31,6 +31,7 @@
 #include <linux/usb/cdc.h>
 #include <linux/usb/usbnet.h>
 #include <linux/gfp.h>
+#include <linux/if_vlan.h>
 /*
@@ -92,7 +93,7 @@ static int eem_bind(struct usbnet *dev, struct usb_interface *intf)
        /* no jumbogram (16K) support for now */
-        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN;
+        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN + VLAN_HLEN;
        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
        return 0;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 7479a5761d0d..3286166415b4 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1344,6 +1344,7 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
                } else {
                        u32 csum_preamble = smsc95xx_calc_csum_preamble(skb);
                        skb_push(skb, 4);
+                        cpu_to_le32s(&csum_preamble);
                        memcpy(skb->data, &csum_preamble, 4);
                }
        }
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index cb04f900cc46..edb81ed06950 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -359,10 +359,12 @@ static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
 void usbnet_defer_kevent (struct usbnet *dev, int work)
 {
        set_bit (work, &dev->flags);
-        if (!schedule_work (&dev->kevent))
+        if (!schedule_work (&dev->kevent)) {
-                netdev_err(dev->net, "kevent %d may have been dropped\n", work);
+                if (net_ratelimit())
-        else
+                        netdev_err(dev->net, "kevent %d may have been dropped\n", work);
+        } else {
                netdev_dbg(dev->net, "kevent %d scheduled\n", work);
+        }
 }
 EXPORT_SYMBOL_GPL(usbnet_defer_kevent);
diff --git a/drivers/net/wireless/b43legacy/pio.c b/drivers/net/wireless/b43legacy/pio.c
index 192251adf986..282eedec675e 100644
--- a/drivers/net/wireless/b43legacy/pio.c
+++ b/drivers/net/wireless/b43legacy/pio.c
@@ -382,7 +382,7 @@ static void cancel_transfers(struct b43legacy_pioqueue *queue)
 {
        struct b43legacy_pio_txpacket *packet, *tmp_packet;
-        tasklet_disable(&queue->txtask);
+        tasklet_kill(&queue->txtask);
        list_for_each_entry_safe(packet, tmp_packet, &queue->txrunning, list)
                free_txpacket(packet, 0);
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 6241fd05bd41..a543746fb354 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -320,10 +320,7 @@ void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *),
                } else
                        next = dev->bus_list.next;
-                /* Run device routines with the device locked */
-                device_lock(&dev->dev);
                retval = cb(dev, userdata);
-                device_unlock(&dev->dev);
                if (retval)
                        break;
        }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 94c6e2aa03d6..6c94fc9489e7 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -398,6 +398,8 @@ static void pci_device_shutdown(struct device *dev)
        struct pci_dev *pci_dev = to_pci_dev(dev);
        struct pci_driver *drv = pci_dev->driver;
+        pm_runtime_resume(dev);
        if (drv && drv->shutdown)
                drv->shutdown(pci_dev);
        pci_msi_shutdown(pci_dev);
@@ -408,16 +410,6 @@ static void pci_device_shutdown(struct device *dev)
         * continue to do DMA
         */
        pci_disable_device(pci_dev);
-        /*
-         * Devices may be enabled to wake up by runtime PM, but they need not
-         * be supposed to wake up the system from its "power off" state (e.g.
-         * ACPI S5).  Therefore disable wakeup for all devices that aren't
-         * supposed to wake up the system at this point.  The state argument
-         * will be ignored by pci_enable_wake().
-         */
-        if (!device_may_wakeup(dev))
-                pci_enable_wake(pci_dev, PCI_UNKNOWN, false);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 02d107b15281..f39378d9da15 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -458,40 +458,6 @@ boot_vga_show(struct device *dev, struct device_attribute *attr, char *buf)
 }
 struct device_attribute vga_attr = __ATTR_RO(boot_vga);
-static void
-pci_config_pm_runtime_get(struct pci_dev *pdev)
-{
-        struct device *dev = &pdev->dev;
-        struct device *parent = dev->parent;
-        if (parent)
-                pm_runtime_get_sync(parent);
-        pm_runtime_get_noresume(dev);
-        /*
-         * pdev->current_state is set to PCI_D3cold during suspending,
-         * so wait until suspending completes
-         */
-        pm_runtime_barrier(dev);
-        /*
-         * Only need to resume devices in D3cold, because config
-         * registers are still accessible for devices suspended but
-         * not in D3cold.
-         */
-        if (pdev->current_state == PCI_D3cold)
-                pm_runtime_resume(dev);
-}
-static void
-pci_config_pm_runtime_put(struct pci_dev *pdev)
-{
-        struct device *dev = &pdev->dev;
-        struct device *parent = dev->parent;
-        pm_runtime_put(dev);
-        if (parent)
-                pm_runtime_put_sync(parent);
-}
 static ssize_t
 pci_read_config(struct file *filp, struct kobject *kobj,
                struct bin_attribute *bin_attr,
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 54858838f098..aabf64798bda 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1858,6 +1858,38 @@ bool pci_dev_run_wake(struct pci_dev *dev)
 }
 EXPORT_SYMBOL_GPL(pci_dev_run_wake);
+void pci_config_pm_runtime_get(struct pci_dev *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device *parent = dev->parent;
+        if (parent)
+                pm_runtime_get_sync(parent);
+        pm_runtime_get_noresume(dev);
+        /*
+         * pdev->current_state is set to PCI_D3cold during suspending,
+         * so wait until suspending completes
+         */
+        pm_runtime_barrier(dev);
+        /*
+         * Only need to resume devices in D3cold, because config
+         * registers are still accessible for devices suspended but
+         * not in D3cold.
+         */
+        if (pdev->current_state == PCI_D3cold)
+                pm_runtime_resume(dev);
+}
+void pci_config_pm_runtime_put(struct pci_dev *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device *parent = dev->parent;
+        pm_runtime_put(dev);
+        if (parent)
+                pm_runtime_put_sync(parent);
+}
 /**
 * pci_pm_init - Initialize PM functions of given PCI device
 * @dev: PCI device to handle.
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index bacbcba69cf3..fd92aab9904b 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -72,6 +72,8 @@ extern void pci_disable_enabled_device(struct pci_dev *dev);
 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
 extern int __pci_pme_wakeup(struct pci_dev *dev, void *ign);
 extern void pci_wakeup_bus(struct pci_bus *bus);
+extern void pci_config_pm_runtime_get(struct pci_dev *dev);
+extern void pci_config_pm_runtime_put(struct pci_dev *dev);
 extern void pci_pm_init(struct pci_dev *dev);
 extern void platform_pci_wakeup_init(struct pci_dev *dev);
 extern void pci_allocate_cap_save_buffers(struct pci_dev *dev);
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 06bad96af415..af4e31cd3a3b 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -213,6 +213,7 @@ static int report_error_detected(struct pci_dev *dev, void *data)
        struct aer_broadcast_data *result_data;
        result_data = (struct aer_broadcast_data *) data;
+        device_lock(&dev->dev);
        dev->error_state = result_data->state;
        if (!dev->driver ||
@@ -231,12 +232,14 @@ static int report_error_detected(struct pci_dev *dev, void *data)
                                   dev->driver ?
                                   "no AER-aware driver" : "no driver");
                }
-                return 0;
+                goto out;
        }
        err_handler = dev->driver->err_handler;
        vote = err_handler->error_detected(dev, result_data->state);
        result_data->result = merge_result(result_data->result, vote);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
@@ -247,14 +250,17 @@ static int report_mmio_enabled(struct pci_dev *dev, void *data)
        struct aer_broadcast_data *result_data;
        result_data = (struct aer_broadcast_data *) data;
+        device_lock(&dev->dev);
        if (!dev->driver ||
                !dev->driver->err_handler ||
                !dev->driver->err_handler->mmio_enabled)
-                return 0;
+                goto out;
        err_handler = dev->driver->err_handler;
        vote = err_handler->mmio_enabled(dev);
        result_data->result = merge_result(result_data->result, vote);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
@@ -265,14 +271,17 @@ static int report_slot_reset(struct pci_dev *dev, void *data)
        struct aer_broadcast_data *result_data;
        result_data = (struct aer_broadcast_data *) data;
+        device_lock(&dev->dev);
        if (!dev->driver ||
                !dev->driver->err_handler ||
                !dev->driver->err_handler->slot_reset)
-                return 0;
+                goto out;
        err_handler = dev->driver->err_handler;
        vote = err_handler->slot_reset(dev);
        result_data->result = merge_result(result_data->result, vote);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
@@ -280,15 +289,18 @@ static int report_resume(struct pci_dev *dev, void *data)
 {
        const struct pci_error_handlers *err_handler;
+        device_lock(&dev->dev);
        dev->error_state = pci_channel_io_normal;
        if (!dev->driver ||
                !dev->driver->err_handler ||
                !dev->driver->err_handler->resume)
-                return 0;
+                goto out;
        err_handler = dev->driver->err_handler;
        err_handler->resume(dev);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index d03a7a39b2d8..ed129b414624 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -272,7 +272,8 @@ static int get_port_device_capability(struct pci_dev *dev)
        }
        /* Hot-Plug Capable */
-        if (cap_mask & PCIE_PORT_SERVICE_HP) {
+        if ((cap_mask & PCIE_PORT_SERVICE_HP) &&
+            dev->pcie_flags_reg & PCI_EXP_FLAGS_SLOT) {
                pcie_capability_read_dword(dev, PCI_EXP_SLTCAP, &reg32);
                if (reg32 & PCI_EXP_SLTCAP_HPC) {
                        services |= PCIE_PORT_SERVICE_HP;
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index eb907a8faf2a..9b8505ccc56d 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -76,6 +76,8 @@ proc_bus_pci_read(struct file *file, char __user *buf, size_t nbytes, loff_t *pp
        if (!access_ok(VERIFY_WRITE, buf, cnt))
                return -EINVAL;
+        pci_config_pm_runtime_get(dev);
        if ((pos & 1) && cnt) {
                unsigned char val;
                pci_user_read_config_byte(dev, pos, &val);
@@ -121,6 +123,8 @@ proc_bus_pci_read(struct file *file, char __user *buf, size_t nbytes, loff_t *pp
                cnt--;
        }
+        pci_config_pm_runtime_put(dev);
        *ppos = pos;
        return nbytes;
 }
@@ -146,6 +150,8 @@ proc_bus_pci_write(struct file *file, const char __user *buf, size_t nbytes, lof
        if (!access_ok(VERIFY_READ, buf, cnt))
                return -EINVAL;
+        pci_config_pm_runtime_get(dev);
        if ((pos & 1) && cnt) {
                unsigned char val;
                __get_user(val, buf);
@@ -191,6 +197,8 @@ proc_bus_pci_write(struct file *file, const char __user *buf, size_t nbytes, lof
                cnt--;
        }
+        pci_config_pm_runtime_put(dev);
        *ppos = pos;
        i_size_write(ino, dp->size);
        return nbytes;
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index 7bf914df6e91..d96caefd914a 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -179,11 +179,13 @@ config PINCTRL_COH901
 config PINCTRL_SAMSUNG
        bool "Samsung pinctrl driver"
+        depends on OF && GPIOLIB
        select PINMUX
        select PINCONF
 config PINCTRL_EXYNOS4
        bool "Pinctrl driver data for Exynos4 SoC"
+        depends on OF && GPIOLIB
        select PINCTRL_SAMSUNG
 config PINCTRL_MVEBU
diff --git a/drivers/pinctrl/spear/pinctrl-spear.c b/drivers/pinctrl/spear/pinctrl-spear.c
index 5d4f44f462f0..b1fd6ee33c6c 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.c
+++ b/drivers/pinctrl/spear/pinctrl-spear.c
@@ -244,7 +244,7 @@ static int spear_pinctrl_endisable(struct pinctrl_dev *pctldev,
                        else
                                temp = ~muxreg->val;
-                        val |= temp;
+                        val |= muxreg->mask & temp;
                        pmx_writel(pmx, val, muxreg->reg);
                }
        }
diff --git a/drivers/pinctrl/spear/pinctrl-spear1310.c b/drivers/pinctrl/spear/pinctrl-spear1310.c
index d6cca8c81b92..0436fc7895d6 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1310.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1310.c
@@ -25,8 +25,8 @@ static const struct pinctrl_pin_desc spear1310_pins[] = {
 };
 /* registers */
-#define PERIP_CFG                                       0x32C
+#define PERIP_CFG                                       0x3B0
-        #define MCIF_SEL_SHIFT                          3
+        #define MCIF_SEL_SHIFT                          5
        #define MCIF_SEL_SD                             (0x1 << MCIF_SEL_SHIFT)
        #define MCIF_SEL_CF                             (0x2 << MCIF_SEL_SHIFT)
        #define MCIF_SEL_XD                             (0x3 << MCIF_SEL_SHIFT)
@@ -164,6 +164,10 @@ static const struct pinctrl_pin_desc spear1310_pins[] = {
        #define PMX_SSP0_CS0_MASK                       (1 << 29)
        #define PMX_SSP0_CS1_2_MASK                     (1 << 30)
+#define PAD_DIRECTION_SEL_0                             0x65C
+#define PAD_DIRECTION_SEL_1                             0x660
+#define PAD_DIRECTION_SEL_2                             0x664
 /* combined macros */
 #define PMX_GMII_MASK           (PMX_GMIICLK_MASK |                     \
                                PMX_GMIICOL_CRS_XFERER_MIITXCLK_MASK |  \
@@ -237,6 +241,10 @@ static struct spear_muxreg i2c0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2C0_MASK,
                .val = PMX_I2C0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2C0_MASK,
+                .val = PMX_I2C0_MASK,
        },
 };
@@ -269,6 +277,10 @@ static struct spear_muxreg ssp0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_SSP0_MASK,
                .val = PMX_SSP0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SSP0_MASK,
+                .val = PMX_SSP0_MASK,
        },
 };
@@ -294,6 +306,10 @@ static struct spear_muxreg ssp0_cs0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_SSP0_CS0_MASK,
                .val = PMX_SSP0_CS0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_SSP0_CS0_MASK,
+                .val = PMX_SSP0_CS0_MASK,
        },
 };
@@ -319,6 +335,10 @@ static struct spear_muxreg ssp0_cs1_2_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_SSP0_CS1_2_MASK,
                .val = PMX_SSP0_CS1_2_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_SSP0_CS1_2_MASK,
+                .val = PMX_SSP0_CS1_2_MASK,
        },
 };
@@ -352,6 +372,10 @@ static struct spear_muxreg i2s0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2S0_MASK,
                .val = PMX_I2S0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2S0_MASK,
+                .val = PMX_I2S0_MASK,
        },
 };
@@ -384,6 +408,10 @@ static struct spear_muxreg i2s1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_I2S1_MASK,
                .val = PMX_I2S1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_I2S1_MASK,
+                .val = PMX_I2S1_MASK,
        },
 };
@@ -418,6 +446,10 @@ static struct spear_muxreg clcd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = PMX_CLCD1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -443,6 +475,10 @@ static struct spear_muxreg clcd_high_res_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_CLCD2_MASK,
                .val = PMX_CLCD2_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_CLCD2_MASK,
+                .val = PMX_CLCD2_MASK,
        },
 };
@@ -461,7 +497,7 @@ static struct spear_pingroup clcd_high_res_pingroup = {
        .nmodemuxs = ARRAY_SIZE(clcd_high_res_modemux),
 };
-static const char *const clcd_grps[] = { "clcd_grp", "clcd_high_res" };
+static const char *const clcd_grps[] = { "clcd_grp", "clcd_high_res_grp" };
 static struct spear_function clcd_function = {
        .name = "clcd",
        .groups = clcd_grps,
@@ -479,6 +515,14 @@ static struct spear_muxreg arm_gpio_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_EGPIO_1_GRP_MASK,
                .val = PMX_EGPIO_1_GRP_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_EGPIO_0_GRP_MASK,
+                .val = PMX_EGPIO_0_GRP_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_EGPIO_1_GRP_MASK,
+                .val = PMX_EGPIO_1_GRP_MASK,
        },
 };
@@ -511,6 +555,10 @@ static struct spear_muxreg smi_2_chips_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_SMI_MASK,
                .val = PMX_SMI_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SMI_MASK,
+                .val = PMX_SMI_MASK,
        },
 };
@@ -539,6 +587,14 @@ static struct spear_muxreg smi_4_chips_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
                .val = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SMI_MASK,
+                .val = PMX_SMI_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
+                .val = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
        },
 };
@@ -573,6 +629,10 @@ static struct spear_muxreg gmii_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_GMII_MASK,
                .val = PMX_GMII_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_GMII_MASK,
+                .val = PMX_GMII_MASK,
        },
 };
@@ -615,6 +675,18 @@ static struct spear_muxreg rgmii_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_RGMII_REG2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_RGMII_REG0_MASK,
+                .val = PMX_RGMII_REG0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_RGMII_REG1_MASK,
+                .val = PMX_RGMII_REG1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_RGMII_REG2_MASK,
+                .val = PMX_RGMII_REG2_MASK,
        },
 };
@@ -649,6 +721,10 @@ static struct spear_muxreg smii_0_1_2_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_SMII_0_1_2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_SMII_0_1_2_MASK,
+                .val = PMX_SMII_0_1_2_MASK,
        },
 };
@@ -681,6 +757,10 @@ static struct spear_muxreg ras_mii_txclk_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NFCE2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NFCE2_MASK,
+                .val = PMX_NFCE2_MASK,
        },
 };
@@ -721,6 +801,14 @@ static struct spear_muxreg nand_8bit_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NAND8BIT_1_MASK,
                .val = PMX_NAND8BIT_1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_NAND8BIT_0_MASK,
+                .val = PMX_NAND8BIT_0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NAND8BIT_1_MASK,
+                .val = PMX_NAND8BIT_1_MASK,
        },
 };
@@ -747,6 +835,10 @@ static struct spear_muxreg nand_16bit_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NAND16BIT_1_MASK,
                .val = PMX_NAND16BIT_1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NAND16BIT_1_MASK,
+                .val = PMX_NAND16BIT_1_MASK,
        },
 };
@@ -772,6 +864,10 @@ static struct spear_muxreg nand_4_chips_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NAND_4CHIPS_MASK,
                .val = PMX_NAND_4CHIPS_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NAND_4CHIPS_MASK,
+                .val = PMX_NAND_4CHIPS_MASK,
        },
 };
@@ -833,6 +929,10 @@ static struct spear_muxreg keyboard_rowcol6_8_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_KBD_ROWCOL68_MASK,
                .val = PMX_KBD_ROWCOL68_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL68_MASK,
+                .val = PMX_KBD_ROWCOL68_MASK,
        },
 };
@@ -866,6 +966,10 @@ static struct spear_muxreg uart0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_UART0_MASK,
                .val = PMX_UART0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_UART0_MASK,
+                .val = PMX_UART0_MASK,
        },
 };
@@ -891,6 +995,10 @@ static struct spear_muxreg uart0_modem_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_UART0_MODEM_MASK,
                .val = PMX_UART0_MODEM_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_UART0_MODEM_MASK,
+                .val = PMX_UART0_MODEM_MASK,
        },
 };
@@ -923,6 +1031,10 @@ static struct spear_muxreg gpt0_tmr0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT0_TMR0_MASK,
                .val = PMX_GPT0_TMR0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT0_TMR0_MASK,
+                .val = PMX_GPT0_TMR0_MASK,
        },
 };
@@ -948,6 +1060,10 @@ static struct spear_muxreg gpt0_tmr1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT0_TMR1_MASK,
                .val = PMX_GPT0_TMR1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT0_TMR1_MASK,
+                .val = PMX_GPT0_TMR1_MASK,
        },
 };
@@ -980,6 +1096,10 @@ static struct spear_muxreg gpt1_tmr0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT1_TMR0_MASK,
                .val = PMX_GPT1_TMR0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT1_TMR0_MASK,
+                .val = PMX_GPT1_TMR0_MASK,
        },
 };
@@ -1005,6 +1125,10 @@ static struct spear_muxreg gpt1_tmr1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT1_TMR1_MASK,
                .val = PMX_GPT1_TMR1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT1_TMR1_MASK,
+                .val = PMX_GPT1_TMR1_MASK,
        },
 };
@@ -1049,6 +1173,20 @@ static const unsigned mcif_pins[] = { 86, 87, 88, 89, 90, 91, 92, 93, 213, 214,
                .reg = PAD_FUNCTION_EN_2,                       \
                .mask = PMX_MCIFALL_2_MASK,                     \
                .val = PMX_MCIFALL_2_MASK,                      \
+        }, {                                                    \
+                .reg = PAD_DIRECTION_SEL_0,                     \
+                .mask = PMX_MCI_DATA8_15_MASK,                  \
+                .val = PMX_MCI_DATA8_15_MASK,                   \
+        }, {                                                    \
+                .reg = PAD_DIRECTION_SEL_1,                     \
+                .mask = PMX_MCIFALL_1_MASK | PMX_NFWPRT1_MASK | \
+                        PMX_NFWPRT2_MASK,                       \
+                .val = PMX_MCIFALL_1_MASK | PMX_NFWPRT1_MASK |  \
+                        PMX_NFWPRT2_MASK,                       \
+        }, {                                                    \
+                .reg = PAD_DIRECTION_SEL_2,                     \
+                .mask = PMX_MCIFALL_2_MASK,                     \
+                .val = PMX_MCIFALL_2_MASK,                      \
        }
 /* sdhci device */
@@ -1154,6 +1292,10 @@ static struct spear_muxreg touch_xy_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_TOUCH_XY_MASK,
                .val = PMX_TOUCH_XY_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_TOUCH_XY_MASK,
+                .val = PMX_TOUCH_XY_MASK,
        },
 };
@@ -1187,6 +1329,10 @@ static struct spear_muxreg uart1_dis_i2c_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2C0_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2C0_MASK,
+                .val = PMX_I2C0_MASK,
        },
 };
@@ -1213,6 +1359,12 @@ static struct spear_muxreg uart1_dis_sd_muxreg[] = {
                .mask = PMX_MCIDATA1_MASK |
                        PMX_MCIDATA2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_MCIDATA1_MASK |
+                        PMX_MCIDATA2_MASK,
+                .val = PMX_MCIDATA1_MASK |
+                        PMX_MCIDATA2_MASK,
        },
 };
@@ -1246,6 +1398,10 @@ static struct spear_muxreg uart2_3_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2S0_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2S0_MASK,
+                .val = PMX_I2S0_MASK,
        },
 };
@@ -1278,6 +1434,10 @@ static struct spear_muxreg uart4_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2S0_MASK | PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2S0_MASK | PMX_CLCD1_MASK,
+                .val = PMX_I2S0_MASK | PMX_CLCD1_MASK,
        },
 };
@@ -1310,6 +1470,10 @@ static struct spear_muxreg uart5_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -1344,6 +1508,10 @@ static struct spear_muxreg rs485_0_1_tdm_0_1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -1376,6 +1544,10 @@ static struct spear_muxreg i2c_1_2_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -1409,6 +1581,10 @@ static struct spear_muxreg i2c3_dis_smi_clcd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK | PMX_SMI_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK | PMX_SMI_MASK,
+                .val = PMX_CLCD1_MASK | PMX_SMI_MASK,
        },
 };
@@ -1435,6 +1611,10 @@ static struct spear_muxreg i2c3_dis_sd_i2s0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_I2S1_MASK | PMX_MCIDATA3_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_I2S1_MASK | PMX_MCIDATA3_MASK,
+                .val = PMX_I2S1_MASK | PMX_MCIDATA3_MASK,
        },
 };
@@ -1469,6 +1649,10 @@ static struct spear_muxreg i2c_4_5_dis_smi_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_SMI_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SMI_MASK,
+                .val = PMX_SMI_MASK,
        },
 };
@@ -1499,6 +1683,14 @@ static struct spear_muxreg i2c4_dis_sd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_MCIDATA5_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_MCIDATA4_MASK,
+                .val = PMX_MCIDATA4_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIDATA5_MASK,
+                .val = PMX_MCIDATA5_MASK,
        },
 };
@@ -1526,6 +1718,12 @@ static struct spear_muxreg i2c5_dis_sd_muxreg[] = {
                .mask = PMX_MCIDATA6_MASK |
                        PMX_MCIDATA7_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIDATA6_MASK |
+                        PMX_MCIDATA7_MASK,
+                .val = PMX_MCIDATA6_MASK |
+                        PMX_MCIDATA7_MASK,
        },
 };
@@ -1560,6 +1758,10 @@ static struct spear_muxreg i2c_6_7_dis_kbd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_KBD_ROWCOL25_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL25_MASK,
+                .val = PMX_KBD_ROWCOL25_MASK,
        },
 };
@@ -1587,6 +1789,12 @@ static struct spear_muxreg i2c6_dis_sd_muxreg[] = {
                .mask = PMX_MCIIORDRE_MASK |
                        PMX_MCIIOWRWE_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIIORDRE_MASK |
+                        PMX_MCIIOWRWE_MASK,
+                .val = PMX_MCIIORDRE_MASK |
+                        PMX_MCIIOWRWE_MASK,
        },
 };
@@ -1613,6 +1821,12 @@ static struct spear_muxreg i2c7_dis_sd_muxreg[] = {
                .mask = PMX_MCIRESETCF_MASK |
                        PMX_MCICS0CE_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIRESETCF_MASK |
+                        PMX_MCICS0CE_MASK,
+                .val = PMX_MCIRESETCF_MASK |
+                        PMX_MCICS0CE_MASK,
        },
 };
@@ -1651,6 +1865,14 @@ static struct spear_muxreg can0_dis_nor_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NFRSTPWDWN3_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_NFRSTPWDWN2_MASK,
+                .val = PMX_NFRSTPWDWN2_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NFRSTPWDWN3_MASK,
+                .val = PMX_NFRSTPWDWN3_MASK,
        },
 };
@@ -1677,6 +1899,10 @@ static struct spear_muxreg can0_dis_sd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_MCICFINTR_MASK | PMX_MCIIORDY_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCICFINTR_MASK | PMX_MCIIORDY_MASK,
+                .val = PMX_MCICFINTR_MASK | PMX_MCIIORDY_MASK,
        },
 };
@@ -1711,6 +1937,10 @@ static struct spear_muxreg can1_dis_sd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_MCICS1_MASK | PMX_MCIDMAACK_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCICS1_MASK | PMX_MCIDMAACK_MASK,
+                .val = PMX_MCICS1_MASK | PMX_MCIDMAACK_MASK,
        },
 };
@@ -1737,6 +1967,10 @@ static struct spear_muxreg can1_dis_kbd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_KBD_ROWCOL25_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL25_MASK,
+                .val = PMX_KBD_ROWCOL25_MASK,
        },
 };
@@ -1763,29 +1997,64 @@ static struct spear_function can1_function = {
        .ngroups = ARRAY_SIZE(can1_grps),
 };
-/* Pad multiplexing for pci device */
+/* Pad multiplexing for (ras-ip) pci device */
-static const unsigned pci_sata_pins[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 18,
+static const unsigned pci_pins[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 18,
        19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,
        37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54,
        55, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99 };
-#define PCI_SATA_MUXREG                         \
-        {                                       \
-                .reg = PAD_FUNCTION_EN_0,       \
-                .mask = PMX_MCI_DATA8_15_MASK,  \
-                .val = 0,                       \
-        }, {                                    \
-                .reg = PAD_FUNCTION_EN_1,       \
-                .mask = PMX_PCI_REG1_MASK,      \
-                .val = 0,                       \
-        }, {                                    \
-                .reg = PAD_FUNCTION_EN_2,       \
-                .mask = PMX_PCI_REG2_MASK,      \
-                .val = 0,                       \
-        }
-/* pad multiplexing for pcie0 device */
+static struct spear_muxreg pci_muxreg[] = {
+        {
+                .reg = PAD_FUNCTION_EN_0,
+                .mask = PMX_MCI_DATA8_15_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_FUNCTION_EN_1,
+                .mask = PMX_PCI_REG1_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_FUNCTION_EN_2,
+                .mask = PMX_PCI_REG2_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_MCI_DATA8_15_MASK,
+                .val = PMX_MCI_DATA8_15_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_PCI_REG1_MASK,
+                .val = PMX_PCI_REG1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_PCI_REG2_MASK,
+                .val = PMX_PCI_REG2_MASK,
+        },
+};
+static struct spear_modemux pci_modemux[] = {
+        {
+                .muxregs = pci_muxreg,
+                .nmuxregs = ARRAY_SIZE(pci_muxreg),
+        },
+};
+static struct spear_pingroup pci_pingroup = {
+        .name = "pci_grp",
+        .pins = pci_pins,
+        .npins = ARRAY_SIZE(pci_pins),
+        .modemuxs = pci_modemux,
+        .nmodemuxs = ARRAY_SIZE(pci_modemux),
+};
+static const char *const pci_grps[] = { "pci_grp" };
+static struct spear_function pci_function = {
+        .name = "pci",
+        .groups = pci_grps,
+        .ngroups = ARRAY_SIZE(pci_grps),
+};
+/* pad multiplexing for (fix-part) pcie0 device */
 static struct spear_muxreg pcie0_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = PCIE_CFG_VAL(0),
@@ -1802,15 +2071,12 @@ static struct spear_modemux pcie0_modemux[] = {
 static struct spear_pingroup pcie0_pingroup = {
        .name = "pcie0_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = pcie0_modemux,
        .nmodemuxs = ARRAY_SIZE(pcie0_modemux),
 };
-/* pad multiplexing for pcie1 device */
+/* pad multiplexing for (fix-part) pcie1 device */
 static struct spear_muxreg pcie1_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = PCIE_CFG_VAL(1),
@@ -1827,15 +2093,12 @@ static struct spear_modemux pcie1_modemux[] = {
 static struct spear_pingroup pcie1_pingroup = {
        .name = "pcie1_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = pcie1_modemux,
        .nmodemuxs = ARRAY_SIZE(pcie1_modemux),
 };
-/* pad multiplexing for pcie2 device */
+/* pad multiplexing for (fix-part) pcie2 device */
 static struct spear_muxreg pcie2_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = PCIE_CFG_VAL(2),
@@ -1852,22 +2115,20 @@ static struct spear_modemux pcie2_modemux[] = {
 static struct spear_pingroup pcie2_pingroup = {
        .name = "pcie2_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = pcie2_modemux,
        .nmodemuxs = ARRAY_SIZE(pcie2_modemux),
 };
-static const char *const pci_grps[] = { "pcie0_grp", "pcie1_grp", "pcie2_grp" };
+static const char *const pcie_grps[] = { "pcie0_grp", "pcie1_grp", "pcie2_grp"
-static struct spear_function pci_function = {
+};
-        .name = "pci",
+static struct spear_function pcie_function = {
-        .groups = pci_grps,
+        .name = "pci_express",
-        .ngroups = ARRAY_SIZE(pci_grps),
+        .groups = pcie_grps,
+        .ngroups = ARRAY_SIZE(pcie_grps),
 };
 /* pad multiplexing for sata0 device */
 static struct spear_muxreg sata0_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = SATA_CFG_VAL(0),
@@ -1884,15 +2145,12 @@ static struct spear_modemux sata0_modemux[] = {
 static struct spear_pingroup sata0_pingroup = {
        .name = "sata0_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = sata0_modemux,
        .nmodemuxs = ARRAY_SIZE(sata0_modemux),
 };
 /* pad multiplexing for sata1 device */
 static struct spear_muxreg sata1_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = SATA_CFG_VAL(1),
@@ -1909,15 +2167,12 @@ static struct spear_modemux sata1_modemux[] = {
 static struct spear_pingroup sata1_pingroup = {
        .name = "sata1_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = sata1_modemux,
        .nmodemuxs = ARRAY_SIZE(sata1_modemux),
 };
 /* pad multiplexing for sata2 device */
 static struct spear_muxreg sata2_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = SATA_CFG_VAL(2),
@@ -1934,8 +2189,6 @@ static struct spear_modemux sata2_modemux[] = {
 static struct spear_pingroup sata2_pingroup = {
        .name = "sata2_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = sata2_modemux,
        .nmodemuxs = ARRAY_SIZE(sata2_modemux),
 };
@@ -1957,6 +2210,14 @@ static struct spear_muxreg ssp1_dis_kbd_muxreg[] = {
                        PMX_KBD_COL0_MASK | PMX_NFIO8_15_MASK | PMX_NFCE1_MASK |
                        PMX_NFCE2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL25_MASK | PMX_KBD_COL1_MASK |
+                        PMX_KBD_COL0_MASK | PMX_NFIO8_15_MASK | PMX_NFCE1_MASK |
+                        PMX_NFCE2_MASK,
+                .val = PMX_KBD_ROWCOL25_MASK | PMX_KBD_COL1_MASK |
+                        PMX_KBD_COL0_MASK | PMX_NFIO8_15_MASK | PMX_NFCE1_MASK |
+                        PMX_NFCE2_MASK,
        },
 };
@@ -1983,6 +2244,12 @@ static struct spear_muxreg ssp1_dis_sd_muxreg[] = {
                .mask = PMX_MCIADDR0ALE_MASK | PMX_MCIADDR2_MASK |
                        PMX_MCICECF_MASK | PMX_MCICEXD_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIADDR0ALE_MASK | PMX_MCIADDR2_MASK |
+                        PMX_MCICECF_MASK | PMX_MCICEXD_MASK,
+                .val = PMX_MCIADDR0ALE_MASK | PMX_MCIADDR2_MASK |
+                        PMX_MCICECF_MASK | PMX_MCICEXD_MASK,
        },
 };
@@ -2017,6 +2284,12 @@ static struct spear_muxreg gpt64_muxreg[] = {
                .mask = PMX_MCICDCF1_MASK | PMX_MCICDCF2_MASK | PMX_MCICDXD_MASK
                        | PMX_MCILEDS_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCICDCF1_MASK | PMX_MCICDCF2_MASK | PMX_MCICDXD_MASK
+                        | PMX_MCILEDS_MASK,
+                .val = PMX_MCICDCF1_MASK | PMX_MCICDCF2_MASK | PMX_MCICDXD_MASK
+                        | PMX_MCILEDS_MASK,
        },
 };
@@ -2093,6 +2366,7 @@ static struct spear_pingroup *spear1310_pingroups[] = {
        &can0_dis_sd_pingroup,
        &can1_dis_sd_pingroup,
        &can1_dis_kbd_pingroup,
+        &pci_pingroup,
        &pcie0_pingroup,
        &pcie1_pingroup,
        &pcie2_pingroup,
@@ -2138,6 +2412,7 @@ static struct spear_function *spear1310_functions[] = {
        &can0_function,
        &can1_function,
        &pci_function,
+        &pcie_function,
        &sata_function,
        &ssp1_function,
        &gpt64_function,
diff --git a/drivers/pinctrl/spear/pinctrl-spear1340.c b/drivers/pinctrl/spear/pinctrl-spear1340.c
index a0eb057e55bd..0606b8cf3f2c 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1340.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1340.c
@@ -213,7 +213,7 @@ static const struct pinctrl_pin_desc spear1340_pins[] = {
 * Pad multiplexing for making all pads as gpio's. This is done to override the
 * values passed from bootloader and start from scratch.
 */
-static const unsigned pads_as_gpio_pins[] = { 251 };
+static const unsigned pads_as_gpio_pins[] = { 12, 88, 89, 251 };
 static struct spear_muxreg pads_as_gpio_muxreg[] = {
        {
                .reg = PAD_FUNCTION_EN_1,
@@ -1692,7 +1692,43 @@ static struct spear_pingroup clcd_pingroup = {
        .nmodemuxs = ARRAY_SIZE(clcd_modemux),
 };
-static const char *const clcd_grps[] = { "clcd_grp" };
+/* Disable cld runtime to save panel damage */
+static struct spear_muxreg clcd_sleep_muxreg[] = {
+        {
+                .reg = PAD_SHARED_IP_EN_1,
+                .mask = ARM_TRACE_MASK | MIPHY_DBG_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_FUNCTION_EN_5,
+                .mask = CLCD_REG4_MASK | CLCD_AND_ARM_TRACE_REG4_MASK,
+                .val = 0x0,
+        }, {
+                .reg = PAD_FUNCTION_EN_6,
+                .mask = CLCD_AND_ARM_TRACE_REG5_MASK,
+                .val = 0x0,
+        }, {
+                .reg = PAD_FUNCTION_EN_7,
+                .mask = CLCD_AND_ARM_TRACE_REG6_MASK,
+                .val = 0x0,
+        },
+};
+static struct spear_modemux clcd_sleep_modemux[] = {
+        {
+                .muxregs = clcd_sleep_muxreg,
+                .nmuxregs = ARRAY_SIZE(clcd_sleep_muxreg),
+        },
+};
+static struct spear_pingroup clcd_sleep_pingroup = {
+        .name = "clcd_sleep_grp",
+        .pins = clcd_pins,
+        .npins = ARRAY_SIZE(clcd_pins),
+        .modemuxs = clcd_sleep_modemux,
+        .nmodemuxs = ARRAY_SIZE(clcd_sleep_modemux),
+};
+static const char *const clcd_grps[] = { "clcd_grp", "clcd_sleep_grp" };
 static struct spear_function clcd_function = {
        .name = "clcd",
        .groups = clcd_grps,
@@ -1893,6 +1929,7 @@ static struct spear_pingroup *spear1340_pingroups[] = {
        &sdhci_pingroup,
        &cf_pingroup,
        &xd_pingroup,
+        &clcd_sleep_pingroup,
        &clcd_pingroup,
        &arm_trace_pingroup,
        &miphy_dbg_pingroup,
diff --git a/drivers/pinctrl/spear/pinctrl-spear320.c b/drivers/pinctrl/spear/pinctrl-spear320.c
index 020b1e0bdb3e..ca47b0e50780 100644
--- a/drivers/pinctrl/spear/pinctrl-spear320.c
+++ b/drivers/pinctrl/spear/pinctrl-spear320.c
@@ -2240,6 +2240,10 @@ static struct spear_muxreg pwm2_pin_34_muxreg[] = {
                .mask = PMX_SSP_CS_MASK,
                .val = 0,
        }, {
+                .reg = MODE_CONFIG_REG,
+                .mask = PMX_PWM_MASK,
+                .val = PMX_PWM_MASK,
+        }, {
                .reg = IP_SEL_PAD_30_39_REG,
                .mask = PMX_PL_34_MASK,
                .val = PMX_PWM2_PL_34_VAL,
@@ -2956,9 +2960,9 @@ static struct spear_function mii2_function = {
 };
 /* Pad multiplexing for cadence mii 1_2 as smii or rmii device */
-static const unsigned smii0_1_pins[] = { 10, 11, 13, 14, 15, 16, 17, 18, 19, 20,
+static const unsigned rmii0_1_pins[] = { 10, 11, 13, 14, 15, 16, 17, 18, 19, 20,
        21, 22, 23, 24, 25, 26, 27 };
-static const unsigned rmii0_1_pins[] = { 10, 11, 21, 22, 23, 24, 25, 26, 27 };
+static const unsigned smii0_1_pins[] = { 10, 11, 21, 22, 23, 24, 25, 26, 27 };
 static struct spear_muxreg mii0_1_muxreg[] = {
        {
                .reg = PMX_CONFIG_REG,
diff --git a/drivers/pinctrl/spear/pinctrl-spear3xx.h b/drivers/pinctrl/spear/pinctrl-spear3xx.h
index 31f44347f17c..7860b36053c4 100644
--- a/drivers/pinctrl/spear/pinctrl-spear3xx.h
+++ b/drivers/pinctrl/spear/pinctrl-spear3xx.h
@@ -15,6 +15,7 @@
 #include "pinctrl-spear.h"
 /* pad mux declarations */
+#define PMX_PWM_MASK            (1 << 16)
 #define PMX_FIRDA_MASK          (1 << 14)
 #define PMX_I2C_MASK            (1 << 13)
 #define PMX_SSP_CS_MASK         (1 << 12)
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 33bb4d891e16..4af3dfe70ef5 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -112,9 +112,6 @@ extern int for_each_subchannel(int(*fn)(struct subchannel_id, void *), void *);
 extern void css_reiterate_subchannels(void);
 void css_update_ssd_info(struct subchannel *sch);
-#define __MAX_SUBCHANNEL 65535
-#define __MAX_SSID 3
 struct channel_subsystem {
        u8 cssid;
        int valid;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index fc916f5d7314..fd3143c291c6 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1424,7 +1424,7 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
        }
        if (device_is_disconnected(cdev))
                return IO_SCH_REPROBE;
-        if (cdev->online)
+        if (cdev->online && !cdev->private->flags.resuming)
                return IO_SCH_VERIFY;
        if (cdev->private->state == DEV_STATE_NOT_OPER)
                return IO_SCH_UNREG_ATTACH;
@@ -1469,12 +1469,6 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
                rc = 0;
                goto out_unlock;
        case IO_SCH_VERIFY:
-                if (cdev->private->flags.resuming == 1) {
-                        if (cio_enable_subchannel(sch, (u32)(addr_t)sch)) {
-                                ccw_device_set_notoper(cdev);
-                                break;
-                        }
-                }
                /* Trigger path verification. */
                io_subchannel_verify(sch);
                rc = 0;
diff --git a/drivers/s390/cio/idset.c b/drivers/s390/cio/idset.c
index 199bc6791177..65d13e38803f 100644
--- a/drivers/s390/cio/idset.c
+++ b/drivers/s390/cio/idset.c
@@ -125,8 +125,7 @@ int idset_is_empty(struct idset *set)
 void idset_add_set(struct idset *to, struct idset *from)
 {
-        int len = min(__BITOPS_WORDS(to->num_ssid * to->num_id),
+        int len = min(to->num_ssid * to->num_id, from->num_ssid * from->num_id);
-                      __BITOPS_WORDS(from->num_ssid * from->num_id));
        bitmap_or(to->bitmap, to->bitmap, from->bitmap, len);
 }
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index b191dd549207..71fddbc60f18 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -1294,26 +1294,19 @@ static struct scsi_host_template qpti_template = {
 static const struct of_device_id qpti_match[];
 static int __devinit qpti_sbus_probe(struct platform_device *op)
 {
-        const struct of_device_id *match;
-        struct scsi_host_template *tpnt;
        struct device_node *dp = op->dev.of_node;
        struct Scsi_Host *host;
        struct qlogicpti *qpti;
        static int nqptis;
        const char *fcode;
-        match = of_match_device(qpti_match, &op->dev);
-        if (!match)
-                return -EINVAL;
-        tpnt = match->data;
        /* Sometimes Antares cards come up not completely
         * setup, and we get a report of a zero IRQ.
         */
        if (op->archdata.irqs[0] == 0)
                return -ENODEV;
-        host = scsi_host_alloc(tpnt, sizeof(struct qlogicpti));
+        host = scsi_host_alloc(&qpti_template, sizeof(struct qlogicpti));
        if (!host)
                return -ENOMEM;
@@ -1445,19 +1438,15 @@ static int __devexit qpti_sbus_remove(struct platform_device *op)
 static const struct of_device_id qpti_match[] = {
        {
                .name = "ptisp",
-                .data = &qpti_template,
        },
        {
                .name = "PTI,ptisp",
-                .data = &qpti_template,
        },
        {
                .name = "QLGC,isp",
-                .data = &qpti_template,
        },
        {
                .name = "SUNW,isp",
-                .data = &qpti_template,
        },
        {},
 };
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 6458764994ef..4ec3c0d7a18b 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -20,6 +20,7 @@
 #include <linux/ctype.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
+#include <linux/if_vlan.h>
 #include "u_ether.h"
@@ -295,7 +296,7 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
                while (skb2) {
                        if (status < 0
                                        || ETH_HLEN > skb2->len
-                                        || skb2->len > ETH_FRAME_LEN) {
+                                        || skb2->len > VLAN_ETH_FRAME_LEN) {
                                dev->net->stats.rx_errors++;
                                dev->net->stats.rx_length_errors++;
                                DBG(dev, "rx length %d\n", skb2->len);
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 1e8659ca27ef..809b0de59c09 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -225,8 +225,10 @@ EXPORT_SYMBOL_GPL(register_virtio_device);
 void unregister_virtio_device(struct virtio_device *dev)
 {
+        int index = dev->index; /* save for after device release */
        device_unregister(&dev->dev);
-        ida_simple_remove(&virtio_index_ida, dev->index);
+        ida_simple_remove(&virtio_index_ida, index);
 }
 EXPORT_SYMBOL_GPL(unregister_virtio_device);
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 0e8637035457..74354708c6c4 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -2,6 +2,7 @@ ifneq ($(CONFIG_ARM),y)
 obj-y   += manage.o balloon.o
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
+obj-$(CONFIG_X86)                       += fallback.o
 obj-y   += grant-table.o features.o events.o
 obj-y   += xenbus/
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 912ac81b6dbf..0be4df39e953 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -1395,10 +1395,10 @@ void xen_evtchn_do_upcall(struct pt_regs *regs)
 {
        struct pt_regs *old_regs = set_irq_regs(regs);
+        irq_enter();
 #ifdef CONFIG_X86
        exit_idle();
 #endif
-        irq_enter();
        __xen_evtchn_do_upcall();
diff --git a/drivers/xen/fallback.c b/drivers/xen/fallback.c
new file mode 100644
index 000000000000..0ef7c4d40f86
--- /dev/null
+++ b/drivers/xen/fallback.c
@@ -0,0 +1,80 @@
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/bug.h>
+#include <linux/export.h>
+#include <asm/hypervisor.h>
+#include <asm/xen/hypercall.h>
+int xen_event_channel_op_compat(int cmd, void *arg)
+{
+        struct evtchn_op op;
+        int rc;
+        op.cmd = cmd;
+        memcpy(&op.u, arg, sizeof(op.u));
+        rc = _hypercall1(int, event_channel_op_compat, &op);
+        switch (cmd) {
+        case EVTCHNOP_close:
+        case EVTCHNOP_send:
+        case EVTCHNOP_bind_vcpu:
+        case EVTCHNOP_unmask:
+                /* no output */
+                break;
+#define COPY_BACK(eop) \
+        case EVTCHNOP_##eop: \
+                memcpy(arg, &op.u.eop, sizeof(op.u.eop)); \
+                break
+        COPY_BACK(bind_interdomain);
+        COPY_BACK(bind_virq);
+        COPY_BACK(bind_pirq);
+        COPY_BACK(status);
+        COPY_BACK(alloc_unbound);
+        COPY_BACK(bind_ipi);
+#undef COPY_BACK
+        default:
+                WARN_ON(rc != -ENOSYS);
+                break;
+        }
+        return rc;
+}
+EXPORT_SYMBOL_GPL(xen_event_channel_op_compat);
+int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
+{
+        struct physdev_op op;
+        int rc;
+        op.cmd = cmd;
+        memcpy(&op.u, arg, sizeof(op.u));
+        rc = _hypercall1(int, physdev_op_compat, &op);
+        switch (cmd) {
+        case PHYSDEVOP_IRQ_UNMASK_NOTIFY:
+        case PHYSDEVOP_set_iopl:
+        case PHYSDEVOP_set_iobitmap:
+        case PHYSDEVOP_apic_write:
+                /* no output */
+                break;
+#define COPY_BACK(pop, fld) \
+        case PHYSDEVOP_##pop: \
+                memcpy(arg, &op.u.fld, sizeof(op.u.fld)); \
+                break
+        COPY_BACK(irq_status_query, irq_status_query);
+        COPY_BACK(apic_read, apic_op);
+        COPY_BACK(ASSIGN_VECTOR, irq_op);
+#undef COPY_BACK
+        default:
+                WARN_ON(rc != -ENOSYS);
+                break;
+        }
+        return rc;
+}
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index fc783e264420..0fb15bbbe43c 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -225,6 +225,13 @@ sid_to_str(struct cifs_sid *sidptr, char *sidstr)
 }
 static void
+cifs_copy_sid(struct cifs_sid *dst, const struct cifs_sid *src)
+{
+        memcpy(dst, src, sizeof(*dst));
+        dst->num_subauth = min_t(u8, src->num_subauth, NUM_SUBAUTHS);
+}
+static void
 id_rb_insert(struct rb_root *root, struct cifs_sid *sidptr,
                struct cifs_sid_id **psidid, char *typestr)
 {
@@ -248,7 +255,7 @@ id_rb_insert(struct rb_root *root, struct cifs_sid *sidptr,
                }
        }
-        memcpy(&(*psidid)->sid, sidptr, sizeof(struct cifs_sid));
+        cifs_copy_sid(&(*psidid)->sid, sidptr);
        (*psidid)->time = jiffies - (SID_MAP_RETRY + 1);
        (*psidid)->refcount = 0;
@@ -354,7 +361,7 @@ id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
         * any fields of the node after a reference is put .
         */
        if (test_bit(SID_ID_MAPPED, &psidid->state)) {
-                memcpy(ssid, &psidid->sid, sizeof(struct cifs_sid));
+                cifs_copy_sid(ssid, &psidid->sid);
                psidid->time = jiffies; /* update ts for accessing */
                goto id_sid_out;
        }
@@ -370,14 +377,14 @@ id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
                if (IS_ERR(sidkey)) {
                        rc = -EINVAL;
                        cFYI(1, "%s: Can't map and id to a SID", __func__);
+                } else if (sidkey->datalen < sizeof(struct cifs_sid)) {
+                        rc = -EIO;
+                        cFYI(1, "%s: Downcall contained malformed key "
+                                "(datalen=%hu)", __func__, sidkey->datalen);
                } else {
                        lsid = (struct cifs_sid *)sidkey->payload.data;
-                        memcpy(&psidid->sid, lsid,
+                        cifs_copy_sid(&psidid->sid, lsid);
-                                sidkey->datalen < sizeof(struct cifs_sid) ?
+                        cifs_copy_sid(ssid, &psidid->sid);
-                                sidkey->datalen : sizeof(struct cifs_sid));
-                        memcpy(ssid, &psidid->sid,
-                                sidkey->datalen < sizeof(struct cifs_sid) ?
-                                sidkey->datalen : sizeof(struct cifs_sid));
                        set_bit(SID_ID_MAPPED, &psidid->state);
                        key_put(sidkey);
                        kfree(psidid->sidstr);
@@ -396,7 +403,7 @@ id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
                        return rc;
                }
                if (test_bit(SID_ID_MAPPED, &psidid->state))
-                        memcpy(ssid, &psidid->sid, sizeof(struct cifs_sid));
+                        cifs_copy_sid(ssid, &psidid->sid);
                else
                        rc = -EINVAL;
        }
@@ -675,8 +682,6 @@ int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
 static void copy_sec_desc(const struct cifs_ntsd *pntsd,
                                struct cifs_ntsd *pnntsd, __u32 sidsoffset)
 {
-        int i;
        struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
        struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
@@ -692,26 +697,14 @@ static void copy_sec_desc(const struct cifs_ntsd *pntsd,
        owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
                                le32_to_cpu(pntsd->osidoffset));
        nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
+        cifs_copy_sid(nowner_sid_ptr, owner_sid_ptr);
-        nowner_sid_ptr->revision = owner_sid_ptr->revision;
-        nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
-        for (i = 0; i < 6; i++)
-                nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
-        for (i = 0; i < 5; i++)
-                nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
        /* copy group sid */
        group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
                                le32_to_cpu(pntsd->gsidoffset));
        ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
                                        sizeof(struct cifs_sid));
+        cifs_copy_sid(ngroup_sid_ptr, group_sid_ptr);
-        ngroup_sid_ptr->revision = group_sid_ptr->revision;
-        ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
-        for (i = 0; i < 6; i++)
-                ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
-        for (i = 0; i < 5; i++)
-                ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
        return;
 }
@@ -1120,8 +1113,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
                                kfree(nowner_sid_ptr);
                                return rc;
                        }
-                        memcpy(owner_sid_ptr, nowner_sid_ptr,
+                        cifs_copy_sid(owner_sid_ptr, nowner_sid_ptr);
-                                        sizeof(struct cifs_sid));
                        kfree(nowner_sid_ptr);
                        *aclflag = CIFS_ACL_OWNER;
                }
@@ -1139,8 +1131,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
                                kfree(ngroup_sid_ptr);
                                return rc;
                        }
-                        memcpy(group_sid_ptr, ngroup_sid_ptr,
+                        cifs_copy_sid(group_sid_ptr, ngroup_sid_ptr);
-                                        sizeof(struct cifs_sid));
                        kfree(ngroup_sid_ptr);
                        *aclflag = CIFS_ACL_GROUP;
                }
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 7c0a81283645..d3671f2acb29 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -398,7 +398,16 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
         * in network traffic in the other paths.
         */
        if (!(oflags & O_CREAT)) {
-                struct dentry *res = cifs_lookup(inode, direntry, 0);
+                struct dentry *res;
+                /*
+                 * Check for hashed negative dentry. We have already revalidated
+                 * the dentry and it is fine. No need to perform another lookup.
+                 */
+                if (!d_unhashed(direntry))
+                        return -ENOENT;
+                res = cifs_lookup(inode, direntry, 0);
                if (IS_ERR(res))
                        return PTR_ERR(res);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index da72250ddc1c..cd96649bfe62 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -346,7 +346,7 @@ static inline struct epitem *ep_item_from_epqueue(poll_table *p)
 /* Tells if the epoll_ctl(2) operation needs an event copy from userspace */
 static inline int ep_op_has_event(int op)
 {
-        return op == EPOLL_CTL_ADD || op == EPOLL_CTL_MOD;
+        return op != EPOLL_CTL_DEL;
 }
 /* Initialize the poll safe wake up structure */
@@ -676,34 +676,6 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
        return 0;
 }
-/*
- * Disables a "struct epitem" in the eventpoll set. Returns -EBUSY if the item
- * had no event flags set, indicating that another thread may be currently
- * handling that item's events (in the case that EPOLLONESHOT was being
- * used). Otherwise a zero result indicates that the item has been disabled
- * from receiving events. A disabled item may be re-enabled via
- * EPOLL_CTL_MOD. Must be called with "mtx" held.
- */
-static int ep_disable(struct eventpoll *ep, struct epitem *epi)
-{
-        int result = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&ep->lock, flags);
-        if (epi->event.events & ~EP_PRIVATE_BITS) {
-                if (ep_is_linked(&epi->rdllink))
-                        list_del_init(&epi->rdllink);
-                /* Ensure ep_poll_callback will not add epi back onto ready
-                   list: */
-                epi->event.events &= EP_PRIVATE_BITS;
-                }
-        else
-                result = -EBUSY;
-        spin_unlock_irqrestore(&ep->lock, flags);
-        return result;
-}
 static void ep_free(struct eventpoll *ep)
 {
        struct rb_node *rbp;
@@ -1048,6 +1020,8 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
        rb_insert_color(&epi->rbn, &ep->rbr);
 }
 #define PATH_ARR_SIZE 5
 /*
 * These are the number paths of length 1 to 5, that we are allowing to emanate
@@ -1813,12 +1787,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                } else
                        error = -ENOENT;
                break;
-        case EPOLL_CTL_DISABLE:
-                if (epi)
-                        error = ep_disable(ep, epi);
-                else
-                        error = -ENOENT;
-                break;
        }
        mutex_unlock(&ep->mtx);
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index f35794b97e8e..a50636025364 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -21,6 +21,7 @@ static bool should_merge(struct fsnotify_event *old, struct fsnotify_event *new)
                        if ((old->path.mnt == new->path.mnt) &&
                            (old->path.dentry == new->path.dentry))
                                return true;
+                        break;
                case (FSNOTIFY_EVENT_NONE):
                        return true;
                default:
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 4f33c32affe3..335206a9c698 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1866,6 +1866,7 @@ xfs_alloc_fix_freelist(
        /*
         * Initialize the args structure.
         */
+        memset(&targs, 0, sizeof(targs));
        targs.tp = tp;
        targs.mp = mp;
        targs.agbp = agbp;
@@ -2207,7 +2208,7 @@ xfs_alloc_read_agf(
 * group or loop over the allocation groups to find the result.
 */
 int                             /* error */
-__xfs_alloc_vextent(
+xfs_alloc_vextent(
        xfs_alloc_arg_t *args)  /* allocation argument structure */
 {
        xfs_agblock_t   agsize; /* allocation group size */
@@ -2417,46 +2418,6 @@ error0:
        return error;
 }
-static void
-xfs_alloc_vextent_worker(
-        struct work_struct      *work)
-{
-        struct xfs_alloc_arg    *args = container_of(work,
-                                                struct xfs_alloc_arg, work);
-        unsigned long           pflags;
-        /* we are in a transaction context here */
-        current_set_flags_nested(&pflags, PF_FSTRANS);
-        args->result = __xfs_alloc_vextent(args);
-        complete(args->done);
-        current_restore_flags_nested(&pflags, PF_FSTRANS);
-}
-/*
- * Data allocation requests often come in with little stack to work on. Push
- * them off to a worker thread so there is lots of stack to use. Metadata
- * requests, OTOH, are generally from low stack usage paths, so avoid the
- * context switch overhead here.
- */
-int
-xfs_alloc_vextent(
-        struct xfs_alloc_arg    *args)
-{
-        DECLARE_COMPLETION_ONSTACK(done);
-        if (!args->userdata)
-                return __xfs_alloc_vextent(args);
-        args->done = &done;
-        INIT_WORK_ONSTACK(&args->work, xfs_alloc_vextent_worker);
-        queue_work(xfs_alloc_wq, &args->work);
-        wait_for_completion(&done);
-        return args->result;
-}
 /*
 * Free an extent.
 * Just break up the extent address and hand off to xfs_free_ag_extent
diff --git a/fs/xfs/xfs_alloc.h b/fs/xfs/xfs_alloc.h
index 93be4a667ca1..feacb061bab7 100644
--- a/fs/xfs/xfs_alloc.h
+++ b/fs/xfs/xfs_alloc.h
@@ -120,9 +120,6 @@ typedef struct xfs_alloc_arg {
        char            isfl;           /* set if is freelist blocks - !acctg */
        char            userdata;       /* set if this is user data */
        xfs_fsblock_t   firstblock;     /* io first block allocated */
-        struct completion *done;
-        struct work_struct work;
-        int             result;
 } xfs_alloc_arg_t;
 /*
diff --git a/fs/xfs/xfs_alloc_btree.c b/fs/xfs/xfs_alloc_btree.c
index f1647caace8f..f7876c6d6165 100644
--- a/fs/xfs/xfs_alloc_btree.c
+++ b/fs/xfs/xfs_alloc_btree.c
@@ -121,6 +121,8 @@ xfs_allocbt_free_block(
        xfs_extent_busy_insert(cur->bc_tp, be32_to_cpu(agf->agf_seqno), bno, 1,
                              XFS_EXTENT_BUSY_SKIP_DISCARD);
        xfs_trans_agbtree_delta(cur->bc_tp, -1);
+        xfs_trans_binval(cur->bc_tp, bp);
        return 0;
 }
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 848ffa77707b..83d0cf3df930 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -2437,6 +2437,7 @@ xfs_bmap_btalloc(
         * Normal allocation, done through xfs_alloc_vextent.
         */
        tryagain = isaligned = 0;
+        memset(&args, 0, sizeof(args));
        args.tp = ap->tp;
        args.mp = mp;
        args.fsbno = ap->blkno;
@@ -3082,6 +3083,7 @@ xfs_bmap_extents_to_btree(
         * Convert to a btree with two levels, one record in root.
         */
        XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_BTREE);
+        memset(&args, 0, sizeof(args));
        args.tp = tp;
        args.mp = mp;
        args.firstblock = *firstblock;
@@ -3237,6 +3239,7 @@ xfs_bmap_local_to_extents(
                xfs_buf_t       *bp;    /* buffer for extent block */
                xfs_bmbt_rec_host_t *ep;/* extent record pointer */
+                memset(&args, 0, sizeof(args));
                args.tp = tp;
                args.mp = ip->i_mount;
                args.firstblock = *firstblock;
@@ -4616,12 +4619,11 @@ xfs_bmapi_delay(
 STATIC int
-xfs_bmapi_allocate(
+__xfs_bmapi_allocate(
-        struct xfs_bmalloca     *bma,
+        struct xfs_bmalloca     *bma)
-        int                     flags)
 {
        struct xfs_mount        *mp = bma->ip->i_mount;
-        int                     whichfork = (flags & XFS_BMAPI_ATTRFORK) ?
+        int                     whichfork = (bma->flags & XFS_BMAPI_ATTRFORK) ?
                                                XFS_ATTR_FORK : XFS_DATA_FORK;
        struct xfs_ifork        *ifp = XFS_IFORK_PTR(bma->ip, whichfork);
        int                     tmp_logflags = 0;
@@ -4654,24 +4656,27 @@ xfs_bmapi_allocate(
         * Indicate if this is the first user data in the file, or just any
         * user data.
         */
-        if (!(flags & XFS_BMAPI_METADATA)) {
+        if (!(bma->flags & XFS_BMAPI_METADATA)) {
                bma->userdata = (bma->offset == 0) ?
                        XFS_ALLOC_INITIAL_USER_DATA : XFS_ALLOC_USERDATA;
        }
-        bma->minlen = (flags & XFS_BMAPI_CONTIG) ? bma->length : 1;
+        bma->minlen = (bma->flags & XFS_BMAPI_CONTIG) ? bma->length : 1;
        /*
         * Only want to do the alignment at the eof if it is userdata and
         * allocation length is larger than a stripe unit.
         */
        if (mp->m_dalign && bma->length >= mp->m_dalign &&
-            !(flags & XFS_BMAPI_METADATA) && whichfork == XFS_DATA_FORK) {
+            !(bma->flags & XFS_BMAPI_METADATA) && whichfork == XFS_DATA_FORK) {
                error = xfs_bmap_isaeof(bma, whichfork);
                if (error)
                        return error;
        }
+        if (bma->flags & XFS_BMAPI_STACK_SWITCH)
+                bma->stack_switch = 1;
        error = xfs_bmap_alloc(bma);
        if (error)
                return error;
@@ -4706,7 +4711,7 @@ xfs_bmapi_allocate(
         * A wasdelay extent has been initialized, so shouldn't be flagged
         * as unwritten.
         */
-        if (!bma->wasdel && (flags & XFS_BMAPI_PREALLOC) &&
+        if (!bma->wasdel && (bma->flags & XFS_BMAPI_PREALLOC) &&
            xfs_sb_version_hasextflgbit(&mp->m_sb))
                bma->got.br_state = XFS_EXT_UNWRITTEN;
@@ -4734,6 +4739,45 @@ xfs_bmapi_allocate(
        return 0;
 }
+static void
+xfs_bmapi_allocate_worker(
+        struct work_struct      *work)
+{
+        struct xfs_bmalloca     *args = container_of(work,
+                                                struct xfs_bmalloca, work);
+        unsigned long           pflags;
+        /* we are in a transaction context here */
+        current_set_flags_nested(&pflags, PF_FSTRANS);
+        args->result = __xfs_bmapi_allocate(args);
+        complete(args->done);
+        current_restore_flags_nested(&pflags, PF_FSTRANS);
+}
+/*
+ * Some allocation requests often come in with little stack to work on. Push
+ * them off to a worker thread so there is lots of stack to use. Otherwise just
+ * call directly to avoid the context switch overhead here.
+ */
+int
+xfs_bmapi_allocate(
+        struct xfs_bmalloca     *args)
+{
+        DECLARE_COMPLETION_ONSTACK(done);
+        if (!args->stack_switch)
+                return __xfs_bmapi_allocate(args);
+        args->done = &done;
+        INIT_WORK_ONSTACK(&args->work, xfs_bmapi_allocate_worker);
+        queue_work(xfs_alloc_wq, &args->work);
+        wait_for_completion(&done);
+        return args->result;
+}
 STATIC int
 xfs_bmapi_convert_unwritten(
        struct xfs_bmalloca     *bma,
@@ -4919,6 +4963,7 @@ xfs_bmapi_write(
                        bma.conv = !!(flags & XFS_BMAPI_CONVERT);
                        bma.wasdel = wasdelay;
                        bma.offset = bno;
+                        bma.flags = flags;
                        /*
                         * There's a 32/64 bit type mismatch between the
@@ -4934,7 +4979,7 @@ xfs_bmapi_write(
                        ASSERT(len > 0);
                        ASSERT(bma.length > 0);
-                        error = xfs_bmapi_allocate(&bma, flags);
+                        error = xfs_bmapi_allocate(&bma);
                        if (error)
                                goto error0;
                        if (bma.blkno == NULLFSBLOCK)
diff --git a/fs/xfs/xfs_bmap.h b/fs/xfs/xfs_bmap.h
index 803b56d7ce16..5f469c3516eb 100644
--- a/fs/xfs/xfs_bmap.h
+++ b/fs/xfs/xfs_bmap.h
@@ -77,6 +77,7 @@ typedef	struct xfs_bmap_free
 * from written to unwritten, otherwise convert from unwritten to written.
 */
 #define XFS_BMAPI_CONVERT       0x040
+#define XFS_BMAPI_STACK_SWITCH  0x080
 #define XFS_BMAPI_FLAGS \
        { XFS_BMAPI_ENTIRE,     "ENTIRE" }, \
@@ -85,7 +86,8 @@ typedef	struct xfs_bmap_free
        { XFS_BMAPI_PREALLOC,   "PREALLOC" }, \
        { XFS_BMAPI_IGSTATE,    "IGSTATE" }, \
        { XFS_BMAPI_CONTIG,     "CONTIG" }, \
-        { XFS_BMAPI_CONVERT,    "CONVERT" }
+        { XFS_BMAPI_CONVERT,    "CONVERT" }, \
+        { XFS_BMAPI_STACK_SWITCH, "STACK_SWITCH" }
 static inline int xfs_bmapi_aflag(int w)
@@ -133,6 +135,11 @@ typedef struct xfs_bmalloca {
        char                    userdata;/* set if is user data */
        char                    aeof;   /* allocated space at eof */
        char                    conv;   /* overwriting unwritten extents */
+        char                    stack_switch;
+        int                     flags;
+        struct completion       *done;
+        struct work_struct      work;
+        int                     result;
 } xfs_bmalloca_t;
 /*
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index a8d0ed911196..becf4a97efc6 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -526,7 +526,25 @@ xfs_buf_item_unpin(
                }
                xfs_buf_relse(bp);
        } else if (freed && remove) {
+                /*
+                 * There are currently two references to the buffer - the active
+                 * LRU reference and the buf log item. What we are about to do
+                 * here - simulate a failed IO completion - requires 3
+                 * references.
+                 *
+                 * The LRU reference is removed by the xfs_buf_stale() call. The
+                 * buf item reference is removed by the xfs_buf_iodone()
+                 * callback that is run by xfs_buf_do_callbacks() during ioend
+                 * processing (via the bp->b_iodone callback), and then finally
+                 * the ioend processing will drop the IO reference if the buffer
+                 * is marked XBF_ASYNC.
+                 *
+                 * Hence we need to take an additional reference here so that IO
+                 * completion processing doesn't free the buffer prematurely.
+                 */
                xfs_buf_lock(bp);
+                xfs_buf_hold(bp);
+                bp->b_flags |= XBF_ASYNC;
                xfs_buf_ioerror(bp, EIO);
                XFS_BUF_UNDONE(bp);
                xfs_buf_stale(bp);
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index c25b094efbf7..4beaede43277 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -399,9 +399,26 @@ xfs_growfs_data_private(
        /* update secondary superblocks. */
        for (agno = 1; agno < nagcount; agno++) {
-                error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp,
+                error = 0;
+                /*
+                 * new secondary superblocks need to be zeroed, not read from
+                 * disk as the contents of the new area we are growing into is
+                 * completely unknown.
+                 */
+                if (agno < oagcount) {
+                        error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp,
                                  XFS_AGB_TO_DADDR(mp, agno, XFS_SB_BLOCK(mp)),
                                  XFS_FSS_TO_BB(mp, 1), 0, &bp);
+                } else {
+                        bp = xfs_trans_get_buf(NULL, mp->m_ddev_targp,
+                                  XFS_AGB_TO_DADDR(mp, agno, XFS_SB_BLOCK(mp)),
+                                  XFS_FSS_TO_BB(mp, 1), 0);
+                        if (bp)
+                                xfs_buf_zero(bp, 0, BBTOB(bp->b_length));
+                        else
+                                error = ENOMEM;
+                }
                if (error) {
                        xfs_warn(mp,
                "error %d reading secondary superblock for ag %d",
@@ -423,7 +440,7 @@ xfs_growfs_data_private(
                        break; /* no point in continuing */
                }
        }
-        return 0;
+        return error;
 error0:
        xfs_trans_cancel(tp, XFS_TRANS_ABORT);
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 445bf1aef31c..c5c4ef4f2bdb 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -250,6 +250,7 @@ xfs_ialloc_ag_alloc(
                                        /* boundary */
        struct xfs_perag *pag;
+        memset(&args, 0, sizeof(args));
        args.tp = tp;
        args.mp = tp->t_mountp;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 2778258fcfa2..1938b41ee9f5 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1509,7 +1509,8 @@ xfs_ifree_cluster(
                 * to mark all the active inodes on the buffer stale.
                 */
                bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, blkno,
-                                        mp->m_bsize * blks_per_cluster, 0);
+                                        mp->m_bsize * blks_per_cluster,
+                                        XBF_UNMAPPED);
                if (!bp)
                        return ENOMEM;
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 8305f2ac6773..c1df3c623de2 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -70,7 +70,7 @@ xfs_find_handle(
        int                     hsize;
        xfs_handle_t            handle;
        struct inode            *inode;
-        struct fd               f;
+        struct fd               f = {0};
        struct path             path;
        int                     error;
        struct xfs_inode        *ip;
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 973dff6ad935..7f537663365b 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -584,7 +584,9 @@ xfs_iomap_write_allocate(
                         * pointer that the caller gave to us.
                         */
                        error = xfs_bmapi_write(tp, ip, map_start_fsb,
-                                                count_fsb, 0, &first_block, 1,
+                                                count_fsb,
+                                                XFS_BMAPI_STACK_SWITCH,
+                                                &first_block, 1,
                                                imap, &nimaps, &free_list);
                        if (error)
                                goto trans_cancel;
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 7f4f9370d0e7..4dad756962d0 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -2387,14 +2387,27 @@ xlog_state_do_callback(
                                /*
-                                 * update the last_sync_lsn before we drop the
+                                 * Completion of a iclog IO does not imply that
+                                 * a transaction has completed, as transactions
+                                 * can be large enough to span many iclogs. We
+                                 * cannot change the tail of the log half way
+                                 * through a transaction as this may be the only
+                                 * transaction in the log and moving th etail to
+                                 * point to the middle of it will prevent
+                                 * recovery from finding the start of the
+                                 * transaction. Hence we should only update the
+                                 * last_sync_lsn if this iclog contains
+                                 * transaction completion callbacks on it.
+                                 *
+                                 * We have to do this before we drop the
                                 * icloglock to ensure we are the only one that
                                 * can update it.
                                 */
                                ASSERT(XFS_LSN_CMP(atomic64_read(&log->l_last_sync_lsn),
                                        be64_to_cpu(iclog->ic_header.h_lsn)) <= 0);
-                                atomic64_set(&log->l_last_sync_lsn,
+                                if (iclog->ic_callback)
-                                        be64_to_cpu(iclog->ic_header.h_lsn));
+                                        atomic64_set(&log->l_last_sync_lsn,
+                                                be64_to_cpu(iclog->ic_header.h_lsn));
                        } else
                                ioerrors++;
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 5da3ace352bf..d308749fabf1 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3541,7 +3541,7 @@ xlog_do_recovery_pass(
                                 *   - order is important.
                                 */
                                error = xlog_bread_offset(log, 0,
-                                                bblks - split_bblks, hbp,
+                                                bblks - split_bblks, dbp,
                                                offset + BBTOB(split_bblks));
                                if (error)
                                        goto bread_err2;
diff --git a/include/linux/compat.h b/include/linux/compat.h
index d0ced1011f2f..d2db71077d93 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -286,10 +286,8 @@ asmlinkage ssize_t compat_sys_pwritev(unsigned long fd,
 int compat_do_execve(const char *filename, const compat_uptr_t __user *argv,
                     const compat_uptr_t __user *envp, struct pt_regs *regs);
-#ifdef __ARCH_WANT_SYS_EXECVE
 asmlinkage long compat_sys_execve(const char __user *filename, const compat_uptr_t __user *argv,
                     const compat_uptr_t __user *envp);
-#endif
 asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
                compat_ulong_t __user *outp, compat_ulong_t __user *exp,
diff --git a/include/linux/mmc/dw_mmc.h b/include/linux/mmc/dw_mmc.h
index 7c6a1139d8fa..96531664a061 100644
--- a/include/linux/mmc/dw_mmc.h
+++ b/include/linux/mmc/dw_mmc.h
@@ -137,7 +137,7 @@ struct dw_mci {
        dma_addr_t              sg_dma;
        void                    *sg_cpu;
-        struct dw_mci_dma_ops   *dma_ops;
+        const struct dw_mci_dma_ops     *dma_ops;
 #ifdef CONFIG_MMC_DW_IDMAC
        unsigned int            ring_size;
 #else
@@ -162,7 +162,7 @@ struct dw_mci {
        u16                     data_offset;
        struct device           *dev;
        struct dw_mci_board     *pdata;
-        struct dw_mci_drv_data  *drv_data;
+        const struct dw_mci_drv_data    *drv_data;
        void                    *priv;
        struct clk              *biu_clk;
        struct clk              *ciu_clk;
@@ -186,7 +186,7 @@ struct dw_mci {
        struct regulator        *vmmc;  /* Power regulator */
        unsigned long           irq_flags; /* IRQ flags */
-        unsigned int            irq;
+        int                     irq;
 };
 /* DMA ops for Internal/External DMAC interface */
diff --git a/include/linux/mmc/sdhci.h b/include/linux/mmc/sdhci.h
index fa8529a859b8..1edcb4dad8c4 100644
--- a/include/linux/mmc/sdhci.h
+++ b/include/linux/mmc/sdhci.h
@@ -91,6 +91,7 @@ struct sdhci_host {
        unsigned int quirks2;   /* More deviations from spec. */
 #define SDHCI_QUIRK2_HOST_OFF_CARD_ON                   (1<<0)
+#define SDHCI_QUIRK2_HOST_NO_CMD23                      (1<<1)
        int irq;                /* Device IRQ */
        void __iomem *ioaddr;   /* Mapped address */
diff --git a/include/linux/of_address.h b/include/linux/of_address.h
index a1984dd037da..e20e3af68fb6 100644
--- a/include/linux/of_address.h
+++ b/include/linux/of_address.h
@@ -28,11 +28,13 @@ static inline unsigned long pci_address_to_pio(phys_addr_t addr) { return -1; }
 #endif
 #else /* CONFIG_OF_ADDRESS */
+#ifndef of_address_to_resource
 static inline int of_address_to_resource(struct device_node *dev, int index,
                                         struct resource *r)
 {
        return -EINVAL;
 }
+#endif
 static inline struct device_node *of_find_matching_node_by_address(
                                        struct device_node *from,
                                        const struct of_device_id *matches,
diff --git a/include/linux/ptp_clock_kernel.h b/include/linux/ptp_clock_kernel.h
index f2dc6d8fc680..38a993508327 100644
--- a/include/linux/ptp_clock_kernel.h
+++ b/include/linux/ptp_clock_kernel.h
@@ -54,7 +54,8 @@ struct ptp_clock_request {
 * clock operations
 *
 * @adjfreq:  Adjusts the frequency of the hardware clock.
- *            parameter delta: Desired period change in parts per billion.
+ *            parameter delta: Desired frequency offset from nominal frequency
+ *            in parts per billion
 *
 * @adjtime:  Shifts the time of the hardware clock.
 *            parameter delta: Desired change in nanoseconds.
diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
index 8c99ce7202c5..2c267bcbb85c 100644
--- a/include/uapi/linux/eventpoll.h
+++ b/include/uapi/linux/eventpoll.h
@@ -25,7 +25,6 @@
 #define EPOLL_CTL_ADD 1
 #define EPOLL_CTL_DEL 2
 #define EPOLL_CTL_MOD 3
-#define EPOLL_CTL_DISABLE 4
 /*
 * Request the handling of system wakeup events so as to prevent system suspends
diff --git a/include/xen/hvm.h b/include/xen/hvm.h
index b193fa2f9fdd..13e43e41637d 100644
--- a/include/xen/hvm.h
+++ b/include/xen/hvm.h
@@ -5,6 +5,36 @@
 #include <xen/interface/hvm/params.h>
 #include <asm/xen/hypercall.h>
+static const char *param_name(int op)
+{
+#define PARAM(x) [HVM_PARAM_##x] = #x
+        static const char *const names[] = {
+                PARAM(CALLBACK_IRQ),
+                PARAM(STORE_PFN),
+                PARAM(STORE_EVTCHN),
+                PARAM(PAE_ENABLED),
+                PARAM(IOREQ_PFN),
+                PARAM(BUFIOREQ_PFN),
+                PARAM(TIMER_MODE),
+                PARAM(HPET_ENABLED),
+                PARAM(IDENT_PT),
+                PARAM(DM_DOMAIN),
+                PARAM(ACPI_S_STATE),
+                PARAM(VM86_TSS),
+                PARAM(VPT_ALIGN),
+                PARAM(CONSOLE_PFN),
+                PARAM(CONSOLE_EVTCHN),
+        };
+#undef PARAM
+        if (op >= ARRAY_SIZE(names))
+                return "unknown";
+        if (!names[op])
+                return "reserved";
+        return names[op];
+}
 static inline int hvm_get_parameter(int idx, uint64_t *value)
 {
        struct xen_hvm_param xhv;
@@ -14,8 +44,8 @@ static inline int hvm_get_parameter(int idx, uint64_t *value)
        xhv.index = idx;
        r = HYPERVISOR_hvm_op(HVMOP_get_param, &xhv);
        if (r < 0) {
-                printk(KERN_ERR "Cannot get hvm parameter %d: %d!\n",
+                printk(KERN_ERR "Cannot get hvm parameter %s (%d): %d!\n",
-                        idx, r);
+                        param_name(idx), idx, r);
                return r;
        }
        *value = xhv.value;
diff --git a/kernel/module.c b/kernel/module.c
index 6085f5ef88ea..6e48c3a43599 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2293,12 +2293,17 @@ static void layout_symtab(struct module *mod, struct load_info *info)
        src = (void *)info->hdr + symsect->sh_offset;
        nsrc = symsect->sh_size / sizeof(*src);
+        /* strtab always starts with a nul, so offset 0 is the empty string. */
+        strtab_size = 1;
        /* Compute total space required for the core symbols' strtab. */
-        for (ndst = i = strtab_size = 1; i < nsrc; ++i, ++src)
+        for (ndst = i = 0; i < nsrc; i++) {
-                if (is_core_symbol(src, info->sechdrs, info->hdr->e_shnum)) {
+                if (i == 0 ||
-                        strtab_size += strlen(&info->strtab[src->st_name]) + 1;
+                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+                        strtab_size += strlen(&info->strtab[src[i].st_name])+1;
                        ndst++;
                }
+        }
        /* Append room for core symbols at end of core part. */
        info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
@@ -2332,15 +2337,15 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
        mod->core_symtab = dst = mod->module_core + info->symoffs;
        mod->core_strtab = s = mod->module_core + info->stroffs;
        src = mod->symtab;
-        *dst = *src;
        *s++ = 0;
-        for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+        for (ndst = i = 0; i < mod->num_symtab; i++) {
-                if (!is_core_symbol(src, info->sechdrs, info->hdr->e_shnum))
+                if (i == 0 ||
-                        continue;
+                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+                        dst[ndst] = src[i];
-                dst[ndst] = *src;
+                        dst[ndst++].st_name = s - mod->core_strtab;
-                dst[ndst++].st_name = s - mod->core_strtab;
+                        s += strlcpy(s, &mod->strtab[src[i].st_name],
-                s += strlcpy(s, &mod->strtab[src->st_name], KSYM_NAME_LEN) + 1;
+                                     KSYM_NAME_LEN) + 1;
+                }
        }
        mod->core_num_syms = ndst;
 }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2624edcfb420..8b055e9379bc 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3017,6 +3017,8 @@ static int kswapd(void *p)
                                                &balanced_classzone_idx);
                }
        }
+        current->reclaim_state = NULL;
        return 0;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 09cb3f6dc40c..bda6d004f9f0 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1666,7 +1666,7 @@ static inline int deliver_skb(struct sk_buff *skb,
 static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
 {
-        if (ptype->af_packet_priv == NULL)
+        if (!ptype->af_packet_priv || !skb->sk)
                return false;
        if (ptype->id_match)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 76d4c2c3c89b..fad649ae4dec 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2192,7 +2192,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
                        goto skip;
                err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
-                                              portid, seq, 0, NTF_SELF);
+                                              portid, seq,
+                                              RTM_NEWNEIGH, NTF_SELF);
                if (err < 0)
                        return err;
 skip:
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 535584c00f91..0c34bfabc11f 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -892,13 +892,16 @@ static int __inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
                struct inet_diag_req_v2 *r, struct nlattr *bc)
 {
        const struct inet_diag_handler *handler;
+        int err = 0;
        handler = inet_diag_lock_handler(r->sdiag_protocol);
        if (!IS_ERR(handler))
                handler->dump(skb, cb, r, bc);
+        else
+                err = PTR_ERR(handler);
        inet_diag_unlock_handler(handler);
-        return skb->len;
+        return err ? : skb->len;
 }
 static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 0185679c5f53..d5cb3c4e66f8 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1633,9 +1633,9 @@ static size_t ip6gre_get_size(const struct net_device *dev)
                /* IFLA_GRE_OKEY */
                nla_total_size(4) +
                /* IFLA_GRE_LOCAL */
-                nla_total_size(4) +
+                nla_total_size(sizeof(struct in6_addr)) +
                /* IFLA_GRE_REMOTE */
-                nla_total_size(4) +
+                nla_total_size(sizeof(struct in6_addr)) +
                /* IFLA_GRE_TTL */
                nla_total_size(1) +
                /* IFLA_GRE_TOS */
@@ -1659,8 +1659,8 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
            nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
            nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
            nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
-            nla_put(skb, IFLA_GRE_LOCAL, sizeof(struct in6_addr), &p->raddr) ||
+            nla_put(skb, IFLA_GRE_LOCAL, sizeof(struct in6_addr), &p->laddr) ||
-            nla_put(skb, IFLA_GRE_REMOTE, sizeof(struct in6_addr), &p->laddr) ||
+            nla_put(skb, IFLA_GRE_REMOTE, sizeof(struct in6_addr), &p->raddr) ||
            nla_put_u8(skb, IFLA_GRE_TTL, p->hop_limit) ||
            /*nla_put_u8(skb, IFLA_GRE_TOS, t->priority) ||*/
            nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index ff36194a71aa..2edce30ef733 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -535,7 +535,7 @@ static void ndisc_send_unsol_na(struct net_device *dev)
 {
        struct inet6_dev *idev;
        struct inet6_ifaddr *ifa;
-        struct in6_addr mcaddr;
+        struct in6_addr mcaddr = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
        idev = in6_dev_get(dev);
        if (!idev)
@@ -543,7 +543,6 @@ static void ndisc_send_unsol_na(struct net_device *dev)
        read_lock_bh(&idev->lock);
        list_for_each_entry(ifa, &idev->addr_list, if_list) {
-                addrconf_addr_solict_mult(&ifa->addr, &mcaddr);
                ndisc_send_na(dev, NULL, &mcaddr, &ifa->addr,
                              /*router=*/ !!idev->cnf.forwarding,
                              /*solicited=*/ false, /*override=*/ true,
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index f0dd83cff906..9687fa1c2275 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -84,18 +84,19 @@
 * grp->index is the index of the group; and grp->slot_shift
 * is the shift for the corresponding (scaled) sigma_i.
 */
-#define QFQ_MAX_INDEX           19
+#define QFQ_MAX_INDEX           24
-#define QFQ_MAX_WSHIFT          16
+#define QFQ_MAX_WSHIFT          12
 #define QFQ_MAX_WEIGHT          (1<<QFQ_MAX_WSHIFT)
-#define QFQ_MAX_WSUM            (2*QFQ_MAX_WEIGHT)
+#define QFQ_MAX_WSUM            (16*QFQ_MAX_WEIGHT)
 #define FRAC_BITS               30      /* fixed point arithmetic */
 #define ONE_FP                  (1UL << FRAC_BITS)
 #define IWSUM                   (ONE_FP/QFQ_MAX_WSUM)
-#define QFQ_MTU_SHIFT           11
+#define QFQ_MTU_SHIFT           16      /* to support TSO/GSO */
 #define QFQ_MIN_SLOT_SHIFT      (FRAC_BITS + QFQ_MTU_SHIFT - QFQ_MAX_INDEX)
+#define QFQ_MIN_LMAX            256     /* min possible lmax for a class */
 /*
 * Possible group states.  These values are used as indexes for the bitmaps
@@ -231,6 +232,32 @@ static void qfq_update_class_params(struct qfq_sched *q, struct qfq_class *cl,
        q->wsum += delta_w;
 }
+static void qfq_update_reactivate_class(struct qfq_sched *q,
+                                        struct qfq_class *cl,
+                                        u32 inv_w, u32 lmax, int delta_w)
+{
+        bool need_reactivation = false;
+        int i = qfq_calc_index(inv_w, lmax);
+        if (&q->groups[i] != cl->grp && cl->qdisc->q.qlen > 0) {
+                /*
+                 * shift cl->F back, to not charge the
+                 * class for the not-yet-served head
+                 * packet
+                 */
+                cl->F = cl->S;
+                /* remove class from its slot in the old group */
+                qfq_deactivate_class(q, cl);
+                need_reactivation = true;
+        }
+        qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
+        if (need_reactivation) /* activate in new group */
+                qfq_activate_class(q, cl, qdisc_peek_len(cl->qdisc));
+}
 static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                            struct nlattr **tca, unsigned long *arg)
 {
@@ -238,7 +265,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
        struct qfq_class *cl = (struct qfq_class *)*arg;
        struct nlattr *tb[TCA_QFQ_MAX + 1];
        u32 weight, lmax, inv_w;
-        int i, err;
+        int err;
        int delta_w;
        if (tca[TCA_OPTIONS] == NULL) {
@@ -270,16 +297,14 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
        if (tb[TCA_QFQ_LMAX]) {
                lmax = nla_get_u32(tb[TCA_QFQ_LMAX]);
-                if (!lmax || lmax > (1UL << QFQ_MTU_SHIFT)) {
+                if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
                        pr_notice("qfq: invalid max length %u\n", lmax);
                        return -EINVAL;
                }
        } else
-                lmax = 1UL << QFQ_MTU_SHIFT;
+                lmax = psched_mtu(qdisc_dev(sch));
        if (cl != NULL) {
-                bool need_reactivation = false;
                if (tca[TCA_RATE]) {
                        err = gen_replace_estimator(&cl->bstats, &cl->rate_est,
                                                    qdisc_root_sleeping_lock(sch),
@@ -291,24 +316,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                if (lmax == cl->lmax && inv_w == cl->inv_w)
                        return 0; /* nothing to update */
-                i = qfq_calc_index(inv_w, lmax);
                sch_tree_lock(sch);
-                if (&q->groups[i] != cl->grp && cl->qdisc->q.qlen > 0) {
+                qfq_update_reactivate_class(q, cl, inv_w, lmax, delta_w);
-                        /*
-                         * shift cl->F back, to not charge the
-                         * class for the not-yet-served head
-                         * packet
-                         */
-                        cl->F = cl->S;
-                        /* remove class from its slot in the old group */
-                        qfq_deactivate_class(q, cl);
-                        need_reactivation = true;
-                }
-                qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
-                if (need_reactivation) /* activate in new group */
-                        qfq_activate_class(q, cl, qdisc_peek_len(cl->qdisc));
                sch_tree_unlock(sch);
                return 0;
@@ -663,15 +672,48 @@ static void qfq_make_eligible(struct qfq_sched *q, u64 old_V)
 /*
- * XXX we should make sure that slot becomes less than 32.
+ * If the weight and lmax (max_pkt_size) of the classes do not change,
- * This is guaranteed by the input values.
+ * then QFQ guarantees that the slot index is never higher than
- * roundedS is always cl->S rounded on grp->slot_shift bits.
+ * 2 + ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) * (QFQ_MAX_WEIGHT/QFQ_MAX_WSUM).
+ *
+ * With the current values of the above constants, the index is
+ * then guaranteed to never be higher than 2 + 256 * (1 / 16) = 18.
+ *
+ * When the weight of a class is increased or the lmax of the class is
+ * decreased, a new class with smaller slot size may happen to be
+ * activated. The activation of this class should be properly delayed
+ * to when the service of the class has finished in the ideal system
+ * tracked by QFQ. If the activation of the class is not delayed to
+ * this reference time instant, then this class may be unjustly served
+ * before other classes waiting for service. This may cause
+ * (unfrequently) the above bound to the slot index to be violated for
+ * some of these unlucky classes.
+ *
+ * Instead of delaying the activation of the new class, which is quite
+ * complex, the following inaccurate but simple solution is used: if
+ * the slot index is higher than QFQ_MAX_SLOTS-2, then the timestamps
+ * of the class are shifted backward so as to let the slot index
+ * become equal to QFQ_MAX_SLOTS-2. This threshold is used because, if
+ * the slot index is above it, then the data structure implementing
+ * the bucket list either gets immediately corrupted or may get
+ * corrupted on a possible next packet arrival that causes the start
+ * time of the group to be shifted backward.
 */
 static void qfq_slot_insert(struct qfq_group *grp, struct qfq_class *cl,
                            u64 roundedS)
 {
        u64 slot = (roundedS - grp->S) >> grp->slot_shift;
-        unsigned int i = (grp->front + slot) % QFQ_MAX_SLOTS;
+        unsigned int i; /* slot index in the bucket list */
+        if (unlikely(slot > QFQ_MAX_SLOTS - 2)) {
+                u64 deltaS = roundedS - grp->S -
+                        ((u64)(QFQ_MAX_SLOTS - 2)<<grp->slot_shift);
+                cl->S -= deltaS;
+                cl->F -= deltaS;
+                slot = QFQ_MAX_SLOTS - 2;
+        }
+        i = (grp->front + slot) % QFQ_MAX_SLOTS;
        hlist_add_head(&cl->next, &grp->slots[i]);
        __set_bit(slot, &grp->full_slots);
@@ -892,6 +934,13 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        }
        pr_debug("qfq_enqueue: cl = %x\n", cl->common.classid);
+        if (unlikely(cl->lmax < qdisc_pkt_len(skb))) {
+                pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
+                          cl->lmax, qdisc_pkt_len(skb), cl->common.classid);
+                qfq_update_reactivate_class(q, cl, cl->inv_w,
+                                            qdisc_pkt_len(skb), 0);
+        }
        err = qdisc_enqueue(skb, cl->qdisc);
        if (unlikely(err != NET_XMIT_SUCCESS)) {
                pr_debug("qfq_enqueue: enqueue failed %d\n", err);
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index 111ff8300ae5..b36f0fcd9bdf 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -116,7 +116,6 @@ void tipc_handler_stop(void)
                return;
        handler_enabled = 0;
-        tasklet_disable(&tipc_tasklet);
        tasklet_kill(&tipc_tasklet);
        spin_lock_bh(&qitem_lock);
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
index dda4b2b61927..ecbb44797e28 100644
--- a/scripts/Makefile.modinst
+++ b/scripts/Makefile.modinst
@@ -16,8 +16,9 @@ PHONY += $(modules)
 __modinst: $(modules)
        @:
+# Don't stop modules_install if we can't sign external modules.
 quiet_cmd_modules_install = INSTALL $@
-      cmd_modules_install = mkdir -p $(2); cp $@ $(2) ; $(mod_strip_cmd) $(2)/$(notdir $@) ; $(mod_sign_cmd) $(2)/$(notdir $@)
+      cmd_modules_install = mkdir -p $(2); cp $@ $(2) ; $(mod_strip_cmd) $(2)/$(notdir $@) ; $(mod_sign_cmd) $(2)/$(notdir $@) $(patsubst %,|| true,$(KBUILD_EXTMOD))
 # Modules built outside the kernel source tree go into extra by default
 INSTALL_MOD_DIR ?= extra
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 21a9f5de0a21..f18750e3bd6c 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1890,8 +1890,10 @@ sub process {
                }
                if ($realfile =~ m@^(drivers/net/|net/)@ &&
-                    $rawline !~ m@^\+[ \t]*(\/\*|\*\/)@ &&
+                    $rawline !~ m@^\+[ \t]*\*/[ \t]*$@ &&       #trailing */
-                    $rawline =~ m@^\+[ \t]*.+\*\/[ \t]*$@) {
+                    $rawline !~ m@^\+.*/\*.*\*/[ \t]*$@ &&      #inline /*...*/
+                    $rawline !~ m@^\+.*\*{2,}/[ \t]*$@ &&       #trailing **/
+                    $rawline =~ m@^\+[ \t]*.+\*\/[ \t]*$@) {    #non blank */
                        WARN("NETWORKING_BLOCK_COMMENT_STYLE",
                             "networking block comments put the trailing */ on a separate line\n" . $herecurr);
                }
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index a9a2e63c0222..e8a1d18774b2 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -76,6 +76,7 @@ static int snd_mixer_oss_open(struct inode *inode, struct file *file)
                snd_card_unref(card);
                return -EFAULT;
        }
+        snd_card_unref(card);
        return 0;
 }
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f337b66a020b..4c1cc51772e6 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2454,6 +2454,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
        mutex_unlock(&pcm->open_mutex);
        if (err < 0)
                goto __error;
+        snd_card_unref(pcm->card);
        return err;
      __error:
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 6e8872de5ba0..f9ddecf2f4cd 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2122,7 +2122,8 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file)
        pcm = snd_lookup_minor_data(iminor(inode),
                                    SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
-        snd_card_unref(pcm->card);
+        if (pcm)
+                snd_card_unref(pcm->card);
        return err;
 }
@@ -2135,7 +2136,8 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
        pcm = snd_lookup_minor_data(iminor(inode),
                                    SNDRV_DEVICE_TYPE_PCM_CAPTURE);
        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
-        snd_card_unref(pcm->card);
+        if (pcm)
+                snd_card_unref(pcm->card);
        return err;
 }
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 89780c323f19..70ccdab74153 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -114,7 +114,7 @@ void *snd_lookup_minor_data(unsigned int minor, int type)
        mreg = snd_minors[minor];
        if (mreg && mreg->type == type) {
                private_data = mreg->private_data;
-                if (mreg->card_ptr)
+                if (private_data && mreg->card_ptr)
                        atomic_inc(&mreg->card_ptr->refcount);
        } else
                private_data = NULL;
diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
index e1d79ee35906..726a49ac9725 100644
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -54,7 +54,7 @@ void *snd_lookup_oss_minor_data(unsigned int minor, int type)
        mreg = snd_oss_minors[minor];
        if (mreg && mreg->type == type) {
                private_data = mreg->private_data;
-                if (mreg->card_ptr)
+                if (private_data && mreg->card_ptr)
                        atomic_inc(&mreg->card_ptr->refcount);
        } else
                private_data = NULL;
diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c
index ef68d710d08c..e04e750a77ed 100644
--- a/sound/i2c/other/ak4113.c
+++ b/sound/i2c/other/ak4113.c
@@ -426,7 +426,7 @@ static struct snd_kcontrol_new snd_ak4113_iec958_controls[] = {
 },
 {
        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
-        .name =         "IEC958 Preample Capture Default",
+        .name =         "IEC958 Preamble Capture Default",
        .access =       SNDRV_CTL_ELEM_ACCESS_READ |
                SNDRV_CTL_ELEM_ACCESS_VOLATILE,
        .info =         snd_ak4113_spdif_pinfo,
diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
index 816e7d225fb0..5bf4fca19e48 100644
--- a/sound/i2c/other/ak4114.c
+++ b/sound/i2c/other/ak4114.c
@@ -401,7 +401,7 @@ static struct snd_kcontrol_new snd_ak4114_iec958_controls[] = {
 },
 {
        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
-        .name =         "IEC958 Preample Capture Default",
+        .name =         "IEC958 Preamble Capture Default",
        .access =       SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
        .info =         snd_ak4114_spdif_pinfo,
        .get =          snd_ak4114_spdif_pget,
diff --git a/sound/i2c/other/ak4117.c b/sound/i2c/other/ak4117.c
index b4b2a51fc117..40e33c9f2b09 100644
--- a/sound/i2c/other/ak4117.c
+++ b/sound/i2c/other/ak4117.c
@@ -380,7 +380,7 @@ static struct snd_kcontrol_new snd_ak4117_iec958_controls[] = {
 },
 {
        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
-        .name =         "IEC958 Preample Capture Default",
+        .name =         "IEC958 Preamble Capture Default",
        .access =       SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
        .info =         snd_ak4117_spdif_pinfo,
        .get =          snd_ak4117_spdif_pget,
diff --git a/sound/pci/es1968.c b/sound/pci/es1968.c
index 5d0e568fdea1..50169bcfd903 100644
--- a/sound/pci/es1968.c
+++ b/sound/pci/es1968.c
@@ -2655,6 +2655,8 @@ static struct ess_device_list pm_whitelist[] __devinitdata = {
        { TYPE_MAESTRO2E, 0x1179 },
        { TYPE_MAESTRO2E, 0x14c0 },     /* HP omnibook 4150 */
        { TYPE_MAESTRO2E, 0x1558 },
+        { TYPE_MAESTRO2E, 0x125d },     /* a PCI card, e.g. Terratec DMX */
+        { TYPE_MAESTRO2, 0x125d },      /* a PCI card, e.g. SF64-PCE2 */
 };
 static struct ess_device_list mpu_blacklist[] __devinitdata = {
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 72b085ae7d46..cd2dbaf1be78 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -3563,6 +3563,8 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
        /* Teradici */
        { PCI_DEVICE(0x6549, 0x1200),
          .driver_data = AZX_DRIVER_TERA | AZX_DCAPS_NO_64BIT },
+        { PCI_DEVICE(0x6549, 0x2200),
+          .driver_data = AZX_DRIVER_TERA | AZX_DCAPS_NO_64BIT },
        /* Creative X-Fi (CA0110-IBG) */
        /* CTHDA chips */
        { PCI_DEVICE(0x1102, 0x0010),
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index cdd43eadbc67..1eeba7386666 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -545,6 +545,7 @@ static int ad198x_build_pcms(struct hda_codec *codec)
        if (spec->multiout.dig_out_nid) {
                info++;
                codec->num_pcms++;
+                codec->spdif_status_reset = 1;
                info->name = "AD198x Digital";
                info->pcm_type = HDA_PCM_TYPE_SPDIF;
                info->stream[SNDRV_PCM_STREAM_PLAYBACK] = ad198x_pcm_digital_playback;
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 61a71131711c..d5f3a26d608d 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -101,8 +101,8 @@ enum {
 #define CS420X_VENDOR_NID       0x11
 #define CS_DIG_OUT1_PIN_NID     0x10
 #define CS_DIG_OUT2_PIN_NID     0x15
-#define CS_DMIC1_PIN_NID        0x12
+#define CS_DMIC1_PIN_NID        0x0e
-#define CS_DMIC2_PIN_NID        0x0e
+#define CS_DMIC2_PIN_NID        0x12
 /* coef indices */
 #define IDX_SPDIF_STAT          0x0000
@@ -1079,14 +1079,18 @@ static void init_input(struct hda_codec *codec)
                        cs_automic(codec, NULL);
                coef = 0x000a; /* ADC1/2 - Digital and Analog Soft Ramp */
+                cs_vendor_coef_set(codec, IDX_ADC_CFG, coef);
+                coef = cs_vendor_coef_get(codec, IDX_BEEP_CFG);
                if (is_active_pin(codec, CS_DMIC2_PIN_NID))
-                        coef |= 0x0500; /* DMIC2 2 chan on, GPIO1 off */
+                        coef |= 1 << 4; /* DMIC2 2 chan on, GPIO1 off */
                if (is_active_pin(codec, CS_DMIC1_PIN_NID))
-                        coef |= 0x1800; /* DMIC1 2 chan on, GPIO0 off
+                        coef |= 1 << 3; /* DMIC1 2 chan on, GPIO0 off
                                         * No effect if SPDIF_OUT2 is
                                         * selected in IDX_SPDIF_CTL.
                                        */
-                cs_vendor_coef_set(codec, IDX_ADC_CFG, coef);
+                cs_vendor_coef_set(codec, IDX_BEEP_CFG, coef);
        } else {
                if (spec->mic_detect)
                        cs_automic(codec, NULL);
@@ -1107,7 +1111,7 @@ static const struct hda_verb cs_coef_init_verbs[] = {
          | 0x0400 /* Disable Coefficient Auto increment */
          )},
        /* Beep */
-        {0x11, AC_VERB_SET_COEF_INDEX, IDX_DAC_CFG},
+        {0x11, AC_VERB_SET_COEF_INDEX, IDX_BEEP_CFG},
        {0x11, AC_VERB_SET_PROC_COEF, 0x0007}, /* Enable Beep thru DAC1/2/3 */
        {} /* terminator */
@@ -1728,8 +1732,7 @@ static int cs421x_mux_enum_put(struct snd_kcontrol *kcontrol,
 }
-static struct snd_kcontrol_new cs421x_capture_source = {
+static const struct snd_kcontrol_new cs421x_capture_source = {
        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
        .name = "Capture Source",
        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
@@ -1946,7 +1949,7 @@ static int cs421x_suspend(struct hda_codec *codec)
 }
 #endif
-static struct hda_codec_ops cs421x_patch_ops = {
+static const struct hda_codec_ops cs421x_patch_ops = {
        .build_controls = cs421x_build_controls,
        .build_pcms = cs_build_pcms,
        .init = cs421x_init,
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f7397ad02a0d..c0ce3b1f04b4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5840,7 +5840,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
        return alc_parse_auto_config(codec, alc269_ignore, ssids);
 }
-static void alc269_toggle_power_output(struct hda_codec *codec, int power_up)
+static void alc269vb_toggle_power_output(struct hda_codec *codec, int power_up)
 {
        int val = alc_read_coef_idx(codec, 0x04);
        if (power_up)
@@ -5857,10 +5857,10 @@ static void alc269_shutup(struct hda_codec *codec)
        if (spec->codec_variant != ALC269_TYPE_ALC269VB)
                return;
-        if ((alc_get_coef0(codec) & 0x00ff) == 0x017)
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB)
-                alc269_toggle_power_output(codec, 0);
+                alc269vb_toggle_power_output(codec, 0);
-        if ((alc_get_coef0(codec) & 0x00ff) == 0x018) {
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB &&
-                alc269_toggle_power_output(codec, 0);
+                        (alc_get_coef0(codec) & 0x00ff) == 0x018) {
                msleep(150);
        }
 }
@@ -5870,24 +5870,22 @@ static int alc269_resume(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        if (spec->codec_variant == ALC269_TYPE_ALC269VB ||
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB)
+                alc269vb_toggle_power_output(codec, 0);
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB &&
                        (alc_get_coef0(codec) & 0x00ff) == 0x018) {
-                alc269_toggle_power_output(codec, 0);
                msleep(150);
        }
        codec->patch_ops.init(codec);
-        if (spec->codec_variant == ALC269_TYPE_ALC269VB ||
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB)
+                alc269vb_toggle_power_output(codec, 1);
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB &&
                        (alc_get_coef0(codec) & 0x00ff) == 0x017) {
-                alc269_toggle_power_output(codec, 1);
                msleep(200);
        }
-        if (spec->codec_variant == ALC269_TYPE_ALC269VB ||
-                        (alc_get_coef0(codec) & 0x00ff) == 0x018)
-                alc269_toggle_power_output(codec, 1);
        snd_hda_codec_resume_amp(codec);
        snd_hda_codec_resume_cache(codec);
        hda_call_check_power_status(codec, 0x01);
@@ -7079,6 +7077,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
          .patch = patch_alc662 },
        { .id = 0x10ec0663, .name = "ALC663", .patch = patch_alc662 },
        { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
+        { .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
        { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
        { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
        { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
@@ -7096,6 +7095,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
        { .id = 0x10ec0889, .name = "ALC889", .patch = patch_alc882 },
        { .id = 0x10ec0892, .name = "ALC892", .patch = patch_alc662 },
        { .id = 0x10ec0899, .name = "ALC898", .patch = patch_alc882 },
+        { .id = 0x10ec0900, .name = "ALC1150", .patch = patch_alc882 },
        {} /* terminator */
 };
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 72a2f60b087c..019e1a00414a 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -1809,11 +1809,11 @@ static int via_auto_fill_dac_nids(struct hda_codec *codec)
 {
        struct via_spec *spec = codec->spec;
        const struct auto_pin_cfg *cfg = &spec->autocfg;
-        int i, dac_num;
+        int i;
        hda_nid_t nid;
+        spec->multiout.num_dacs = 0;
        spec->multiout.dac_nids = spec->private_dac_nids;
-        dac_num = 0;
        for (i = 0; i < cfg->line_outs; i++) {
                hda_nid_t dac = 0;
                nid = cfg->line_out_pins[i];
@@ -1824,16 +1824,13 @@ static int via_auto_fill_dac_nids(struct hda_codec *codec)
                if (!i && parse_output_path(codec, nid, dac, 1,
                                            &spec->out_mix_path))
                        dac = spec->out_mix_path.path[0];
-                if (dac) {
+                if (dac)
-                        spec->private_dac_nids[i] = dac;
+                        spec->private_dac_nids[spec->multiout.num_dacs++] = dac;
-                        dac_num++;
-                }
        }
        if (!spec->out_path[0].depth && spec->out_mix_path.depth) {
                spec->out_path[0] = spec->out_mix_path;
                spec->out_mix_path.depth = 0;
        }
-        spec->multiout.num_dacs = dac_num;
        return 0;
 }
@@ -3628,6 +3625,7 @@ static void set_widgets_power_state_vt2002P(struct hda_codec *codec)
 */
 enum {
        VIA_FIXUP_INTMIC_BOOST,
+        VIA_FIXUP_ASUS_G75,
 };
 static void via_fixup_intmic_boost(struct hda_codec *codec,
@@ -3642,13 +3640,35 @@ static const struct hda_fixup via_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = via_fixup_intmic_boost,
        },
+        [VIA_FIXUP_ASUS_G75] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* set 0x24 and 0x33 as speakers */
+                        { 0x24, 0x991301f0 },
+                        { 0x33, 0x991301f1 }, /* subwoofer */
+                        { }
+                }
+        },
 };
 static const struct snd_pci_quirk vt2002p_fixups[] = {
+        SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
        SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
        {}
 };
+/* NIDs 0x24 and 0x33 on VT1802 have connections to non-existing NID 0x3e
+ * Replace this with mixer NID 0x1c
+ */
+static void fix_vt1802_connections(struct hda_codec *codec)
+{
+        static hda_nid_t conn_24[] = { 0x14, 0x1c };
+        static hda_nid_t conn_33[] = { 0x1c };
+        snd_hda_override_conn_list(codec, 0x24, ARRAY_SIZE(conn_24), conn_24);
+        snd_hda_override_conn_list(codec, 0x33, ARRAY_SIZE(conn_33), conn_33);
+}
 /* patch for vt2002P */
 static int patch_vt2002P(struct hda_codec *codec)
 {
@@ -3663,6 +3683,8 @@ static int patch_vt2002P(struct hda_codec *codec)
        spec->aa_mix_nid = 0x21;
        override_mic_boost(codec, 0x2b, 0, 3, 40);
        override_mic_boost(codec, 0x29, 0, 3, 40);
+        if (spec->codec_type == VT1802)
+                fix_vt1802_connections(codec);
        add_secret_dac_path(codec);
        snd_hda_pick_fixup(codec, NULL, vt2002p_fixups, via_fixups);
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index f1cd1e387801..748e36c66603 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -3979,7 +3979,8 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                case 8: /* SYNC IN */
                        val = hdspm_sync_in_sync_check(hdspm); break;
                default:
-                        val = hdspm_s1_sync_check(hdspm, ucontrol->id.index-1);
+                        val = hdspm_s1_sync_check(hdspm,
+                                        kcontrol->private_value-1);
                }
                break;
@@ -4899,7 +4900,7 @@ snd_hdspm_proc_read_madi(struct snd_info_entry * entry,
                insel = "Coaxial";
                break;
        default:
-                insel = "Unkown";
+                insel = "Unknown";
        }
        snd_iprintf(buffer,
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 61599298fb26..4d8db3685e96 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -763,7 +763,7 @@ static int cs42l52_set_sysclk(struct snd_soc_dai *codec_dai,
        if ((freq >= CS42L52_MIN_CLK) && (freq <= CS42L52_MAX_CLK)) {
                cs42l52->sysclk = freq;
        } else {
-                dev_err(codec->dev, "Invalid freq paramter\n");
+                dev_err(codec->dev, "Invalid freq parameter\n");
                return -EINVAL;
        }
        return 0;
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 3fddc7ad1127..b2b2b37131bd 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3722,7 +3722,7 @@ static irqreturn_t wm8958_mic_irq(int irq, void *data)
        } while (count--);
        if (count == 0)
-                dev_warn(codec->dev, "No impedence range reported for jack\n");
+                dev_warn(codec->dev, "No impedance range reported for jack\n");
 #ifndef CONFIG_SND_SOC_WM8994_MODULE
        trace_snd_soc_jack_irq(dev_name(codec->dev));
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 7f78c6d782b0..34de6f2faf61 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -35,6 +35,7 @@
 #define EP_FLAG_ACTIVATED       0
 #define EP_FLAG_RUNNING         1
+#define EP_FLAG_STOPPING        2
 /*
 * snd_usb_endpoint is a model that abstracts everything related to an
@@ -502,10 +503,20 @@ static int wait_clear_urbs(struct snd_usb_endpoint *ep)
        if (alive)
                snd_printk(KERN_ERR "timeout: still %d active urbs on EP #%x\n",
                                        alive, ep->ep_num);
+        clear_bit(EP_FLAG_STOPPING, &ep->flags);
        return 0;
 }
+/* sync the pending stop operation;
+ * this function itself doesn't trigger the stop operation
+ */
+void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep)
+{
+        if (ep && test_bit(EP_FLAG_STOPPING, &ep->flags))
+                wait_clear_urbs(ep);
+}
 /*
 * unlink active urbs.
 */
@@ -918,6 +929,8 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
                if (wait)
                        wait_clear_urbs(ep);
+                else
+                        set_bit(EP_FLAG_STOPPING, &ep->flags);
        }
 }
diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
index 6376ccf10fd4..3d4c9705041f 100644
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -19,6 +19,7 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
 int  snd_usb_endpoint_start(struct snd_usb_endpoint *ep, int can_sleep);
 void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
                           int force, int can_sleep, int wait);
+void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_free(struct list_head *head);
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 37428f74dbb6..5c12a3fe8c3e 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -568,6 +568,9 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
                goto unlock;
        }
+        snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
+        snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);
        ret = set_format(subs, subs->cur_audiofmt);
        if (ret < 0)
                goto unlock;
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 43480149119e..85baf11e2acd 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -1,4 +1,4 @@
-TARGETS = breakpoints kcmp mqueue vm cpu-hotplug memory-hotplug epoll
+TARGETS = breakpoints kcmp mqueue vm cpu-hotplug memory-hotplug
 all:
        for TARGET in $(TARGETS); do \
diff --git a/tools/testing/selftests/epoll/Makefile b/tools/testing/selftests/epoll/Makefile
deleted file mode 100644
index 19806ed62f50..000000000000
--- a/tools/testing/selftests/epoll/Makefile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Makefile for epoll selftests
-all: test_epoll
-%: %.c
-        gcc -pthread -g -o $@ $^
-run_tests: all
-        ./test_epoll
-clean:
-        $(RM) test_epoll
diff --git a/tools/testing/selftests/epoll/test_epoll.c b/tools/testing/selftests/epoll/test_epoll.c
deleted file mode 100644
index f7525392ce84..000000000000
--- a/tools/testing/selftests/epoll/test_epoll.c
+++ /dev/null
@@ -1,344 +0,0 @@
-/*
- *  tools/testing/selftests/epoll/test_epoll.c
- *
- *  Copyright 2012 Adobe Systems Incorporated
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  Paton J. Lewis <palewis@adobe.com>
- *
- */
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/epoll.h>
-#include <sys/socket.h>
-/*
- * A pointer to an epoll_item_private structure will be stored in the epoll
- * item's event structure so that we can get access to the epoll_item_private
- * data after calling epoll_wait:
- */
-struct epoll_item_private {
-        int index;  /* Position of this struct within the epoll_items array. */
-        int fd;
-        uint32_t events;
-        pthread_mutex_t mutex;  /* Guards the following variables... */
-        int stop;
-        int status;  /* Stores any error encountered while handling item. */
-        /* The following variable allows us to test whether we have encountered
-           a problem while attempting to cancel and delete the associated
-           event. When the test program exits, 'deleted' should be exactly
-           one. If it is greater than one, then the failed test reflects a real
-           world situation where we would have tried to access the epoll item's
-           private data after deleting it: */
-        int deleted;
-};
-struct epoll_item_private *epoll_items;
-/*
- * Delete the specified item from the epoll set. In a real-world secneario this
- * is where we would free the associated data structure, but in this testing
- * environment we retain the structure so that we can test for double-deletion:
- */
-void delete_item(int index)
-{
-        __sync_fetch_and_add(&epoll_items[index].deleted, 1);
-}
-/*
- * A pointer to a read_thread_data structure will be passed as the argument to
- * each read thread:
- */
-struct read_thread_data {
-        int stop;
-        int status;  /* Indicates any error encountered by the read thread. */
-        int epoll_set;
-};
-/*
- * The function executed by the read threads:
- */
-void *read_thread_function(void *function_data)
-{
-        struct read_thread_data *thread_data =
-                (struct read_thread_data *)function_data;
-        struct epoll_event event_data;
-        struct epoll_item_private *item_data;
-        char socket_data;
-        /* Handle events until we encounter an error or this thread's 'stop'
-           condition is set: */
-        while (1) {
-                int result = epoll_wait(thread_data->epoll_set,
-                                        &event_data,
-                                        1,      /* Number of desired events */
-                                        1000);  /* Timeout in ms */
-                if (result < 0) {
-                        /* Breakpoints signal all threads. Ignore that while
-                           debugging: */
-                        if (errno == EINTR)
-                                continue;
-                        thread_data->status = errno;
-                        return 0;
-                } else if (thread_data->stop)
-                        return 0;
-                else if (result == 0)  /* Timeout */
-                        continue;
-                /* We need the mutex here because checking for the stop
-                   condition and re-enabling the epoll item need to be done
-                   together as one atomic operation when EPOLL_CTL_DISABLE is
-                   available: */
-                item_data = (struct epoll_item_private *)event_data.data.ptr;
-                pthread_mutex_lock(&item_data->mutex);
-                /* Remove the item from the epoll set if we want to stop
-                   handling that event: */
-                if (item_data->stop)
-                        delete_item(item_data->index);
-                else {
-                        /* Clear the data that was written to the other end of
-                           our non-blocking socket: */
-                        do {
-                                if (read(item_data->fd, &socket_data, 1) < 1) {
-                                        if ((errno == EAGAIN) ||
-                                            (errno == EWOULDBLOCK))
-                                                break;
-                                        else
-                                                goto error_unlock;
-                                }
-                        } while (item_data->events & EPOLLET);
-                        /* The item was one-shot, so re-enable it: */
-                        event_data.events = item_data->events;
-                        if (epoll_ctl(thread_data->epoll_set,
-                                                  EPOLL_CTL_MOD,
-                                                  item_data->fd,
-                                                  &event_data) < 0)
-                                goto error_unlock;
-                }
-                pthread_mutex_unlock(&item_data->mutex);
-        }
-error_unlock:
-        thread_data->status = item_data->status = errno;
-        pthread_mutex_unlock(&item_data->mutex);
-        return 0;
-}
-/*
- * A pointer to a write_thread_data structure will be passed as the argument to
- * the write thread:
- */
-struct write_thread_data {
-        int stop;
-        int status;  /* Indicates any error encountered by the write thread. */
-        int n_fds;
-        int *fds;
-};
-/*
- * The function executed by the write thread. It writes a single byte to each
- * socket in turn until the stop condition for this thread is set. If writing to
- * a socket would block (i.e. errno was EAGAIN), we leave that socket alone for
- * the moment and just move on to the next socket in the list. We don't care
- * about the order in which we deliver events to the epoll set. In fact we don't
- * care about the data we're writing to the pipes at all; we just want to
- * trigger epoll events:
- */
-void *write_thread_function(void *function_data)
-{
-        const char data = 'X';
-        int index;
-        struct write_thread_data *thread_data =
-                (struct write_thread_data *)function_data;
-        while (!thread_data->stop)
-                for (index = 0;
-                     !thread_data->stop && (index < thread_data->n_fds);
-                     ++index)
-                        if ((write(thread_data->fds[index], &data, 1) < 1) &&
-                                (errno != EAGAIN) &&
-                                (errno != EWOULDBLOCK)) {
-                                thread_data->status = errno;
-                                return;
-                        }
-}
-/*
- * Arguments are currently ignored:
- */
-int main(int argc, char **argv)
-{
-        const int n_read_threads = 100;
-        const int n_epoll_items = 500;
-        int index;
-        int epoll_set = epoll_create1(0);
-        struct write_thread_data write_thread_data = {
-                0, 0, n_epoll_items, malloc(n_epoll_items * sizeof(int))
-        };
-        struct read_thread_data *read_thread_data =
-                malloc(n_read_threads * sizeof(struct read_thread_data));
-        pthread_t *read_threads = malloc(n_read_threads * sizeof(pthread_t));
-        pthread_t write_thread;
-        printf("-----------------\n");
-        printf("Runing test_epoll\n");
-        printf("-----------------\n");
-        epoll_items = malloc(n_epoll_items * sizeof(struct epoll_item_private));
-        if (epoll_set < 0 || epoll_items == 0 || write_thread_data.fds == 0 ||
-                read_thread_data == 0 || read_threads == 0)
-                goto error;
-        if (sysconf(_SC_NPROCESSORS_ONLN) < 2) {
-                printf("Error: please run this test on a multi-core system.\n");
-                goto error;
-        }
-        /* Create the socket pairs and epoll items: */
-        for (index = 0; index < n_epoll_items; ++index) {
-                int socket_pair[2];
-                struct epoll_event event_data;
-                if (socketpair(AF_UNIX,
-                               SOCK_STREAM | SOCK_NONBLOCK,
-                               0,
-                               socket_pair) < 0)
-                        goto error;
-                write_thread_data.fds[index] = socket_pair[0];
-                epoll_items[index].index = index;
-                epoll_items[index].fd = socket_pair[1];
-                if (pthread_mutex_init(&epoll_items[index].mutex, NULL) != 0)
-                        goto error;
-                /* We always use EPOLLONESHOT because this test is currently
-                   structured to demonstrate the need for EPOLL_CTL_DISABLE,
-                   which only produces useful information in the EPOLLONESHOT
-                   case (without EPOLLONESHOT, calling epoll_ctl with
-                   EPOLL_CTL_DISABLE will never return EBUSY). If support for
-                   testing events without EPOLLONESHOT is desired, it should
-                   probably be implemented in a separate unit test. */
-                epoll_items[index].events = EPOLLIN | EPOLLONESHOT;
-                if (index < n_epoll_items / 2)
-                        epoll_items[index].events |= EPOLLET;
-                epoll_items[index].stop = 0;
-                epoll_items[index].status = 0;
-                epoll_items[index].deleted = 0;
-                event_data.events = epoll_items[index].events;
-                event_data.data.ptr = &epoll_items[index];
-                if (epoll_ctl(epoll_set,
-                              EPOLL_CTL_ADD,
-                              epoll_items[index].fd,
-                              &event_data) < 0)
-                        goto error;
-        }
-        /* Create and start the read threads: */
-        for (index = 0; index < n_read_threads; ++index) {
-                read_thread_data[index].stop = 0;
-                read_thread_data[index].status = 0;
-                read_thread_data[index].epoll_set = epoll_set;
-                if (pthread_create(&read_threads[index],
-                                   NULL,
-                                   read_thread_function,
-                                   &read_thread_data[index]) != 0)
-                        goto error;
-        }
-        if (pthread_create(&write_thread,
-                           NULL,
-                           write_thread_function,
-                           &write_thread_data) != 0)
-                goto error;
-        /* Cancel all event pollers: */
-#ifdef EPOLL_CTL_DISABLE
-        for (index = 0; index < n_epoll_items; ++index) {
-                pthread_mutex_lock(&epoll_items[index].mutex);
-                ++epoll_items[index].stop;
-                if (epoll_ctl(epoll_set,
-                              EPOLL_CTL_DISABLE,
-                              epoll_items[index].fd,
-                              NULL) == 0)
-                        delete_item(index);
-                else if (errno != EBUSY) {
-                        pthread_mutex_unlock(&epoll_items[index].mutex);
-                        goto error;
-                }
-                /* EBUSY means events were being handled; allow the other thread
-                   to delete the item. */
-                pthread_mutex_unlock(&epoll_items[index].mutex);
-        }
-#else
-        for (index = 0; index < n_epoll_items; ++index) {
-                pthread_mutex_lock(&epoll_items[index].mutex);
-                ++epoll_items[index].stop;
-                pthread_mutex_unlock(&epoll_items[index].mutex);
-                /* Wait in case a thread running read_thread_function is
-                   currently executing code between epoll_wait and
-                   pthread_mutex_lock with this item. Note that a longer delay
-                   would make double-deletion less likely (at the expense of
-                   performance), but there is no guarantee that any delay would
-                   ever be sufficient. Note also that we delete all event
-                   pollers at once for testing purposes, but in a real-world
-                   environment we are likely to want to be able to cancel event
-                   pollers at arbitrary times. Therefore we can't improve this
-                   situation by just splitting this loop into two loops
-                   (i.e. signal 'stop' for all items, sleep, and then delete all
-                   items). We also can't fix the problem via EPOLL_CTL_DEL
-                   because that command can't prevent the case where some other
-                   thread is executing read_thread_function within the region
-                   mentioned above: */
-                usleep(1);
-                pthread_mutex_lock(&epoll_items[index].mutex);
-                if (!epoll_items[index].deleted)
-                        delete_item(index);
-                pthread_mutex_unlock(&epoll_items[index].mutex);
-        }
-#endif
-        /* Shut down the read threads: */
-        for (index = 0; index < n_read_threads; ++index)
-                __sync_fetch_and_add(&read_thread_data[index].stop, 1);
-        for (index = 0; index < n_read_threads; ++index) {
-                if (pthread_join(read_threads[index], NULL) != 0)
-                        goto error;
-                if (read_thread_data[index].status)
-                        goto error;
-        }
-        /* Shut down the write thread: */
-        __sync_fetch_and_add(&write_thread_data.stop, 1);
-        if ((pthread_join(write_thread, NULL) != 0) || write_thread_data.status)
-                goto error;
-        /* Check for final error conditions: */
-        for (index = 0; index < n_epoll_items; ++index) {
-                if (epoll_items[index].status != 0)
-                        goto error;
-                if (pthread_mutex_destroy(&epoll_items[index].mutex) < 0)
-                        goto error;
-        }
-        for (index = 0; index < n_epoll_items; ++index)
-                if (epoll_items[index].deleted != 1) {
-                        printf("Error: item data deleted %1d times.\n",
-                                   epoll_items[index].deleted);
-                        goto error;
-                }
-        printf("[PASS]\n");
-        return 0;
- error:
-        printf("[FAIL]\n");
-        return errno;
-}