Merge branch 'tracing/urgent' into tracing/core

Merge reason: Pick up fixes and move base from -rc1 to -rc5.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

27 files changed, 698 insertions, 431 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 5859f598c951..e61891f80123 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -991,8 +991,6 @@ NORET_TYPE void do_exit(long code)
         tsk->mempolicy = NULL;
 #endif
 #ifdef CONFIG_FUTEX
-        if (unlikely(!list_empty(&tsk->pi_state_list)))
-                exit_pi_state_list(tsk);
         if (unlikely(current->pi_state_cache))
                 kfree(current->pi_state_cache);
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index 266c6af6ef1b..4c20fff8c13a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -570,12 +570,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 
         /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
-        if (unlikely(tsk->robust_list))
+        if (unlikely(tsk->robust_list)) {
                 exit_robust_list(tsk);
+                tsk->robust_list = NULL;
+        }
 #ifdef CONFIG_COMPAT
-        if (unlikely(tsk->compat_robust_list))
+        if (unlikely(tsk->compat_robust_list)) {
                 compat_exit_robust_list(tsk);
+                tsk->compat_robust_list = NULL;
+        }
 #endif
+        if (unlikely(!list_empty(&tsk->pi_state_list)))
+                exit_pi_state_list(tsk);
 #endif
 
         /* Get rid of any cached register state */
diff --git a/kernel/futex.c b/kernel/futex.c
index b911adceb2c4..4949d336d88d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -916,8 +916,8 @@ retry:
         hb1 = hash_futex(&key1);
         hb2 = hash_futex(&key2);
 
-        double_lock_hb(hb1, hb2);
 retry_private:
+        double_lock_hb(hb1, hb2);
         op_ret = futex_atomic_op_inuser(op, uaddr2);
         if (unlikely(op_ret < 0)) {
 
@@ -2117,7 +2117,6 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                  * Unqueue the futex_q and determine which it was.
                  */
                 plist_del(&q->list, &q->list.plist);
-                drop_futex_key_refs(&q->key);
 
                 if (timeout && !timeout->task)
                         ret = -ETIMEDOUT;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 6d7020490f94..3e1c36e7998f 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -726,8 +726,6 @@ static int hrtimer_switch_to_hres(void)
         /* "Retrigger" the interrupt to get things going */
         retrigger_next_event(NULL);
         local_irq_restore(flags);
-        printk(KERN_DEBUG "Switched to high resolution mode on CPU %d\n",
-               smp_processor_id());
         return 1;
 }
 
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index a81cf80554db..17c71bb565c6 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/irq.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/random.h>
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 3815ac1d58b2..9af56723c096 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -142,6 +142,11 @@ static inline struct lock_class *hlock_class(struct held_lock *hlock)
 #ifdef CONFIG_LOCK_STAT
 static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], lock_stats);
 
+static inline u64 lockstat_clock(void)
+{
+        return cpu_clock(smp_processor_id());
+}
+
 static int lock_point(unsigned long points[], unsigned long ip)
 {
         int i;
@@ -158,7 +163,7 @@ static int lock_point(unsigned long points[], unsigned long ip)
         return i;
 }
 
-static void lock_time_inc(struct lock_time *lt, s64 time)
+static void lock_time_inc(struct lock_time *lt, u64 time)
 {
         if (time > lt->max)
                 lt->max = time;
@@ -234,12 +239,12 @@ static void put_lock_stats(struct lock_class_stats *stats)
 static void lock_release_holdtime(struct held_lock *hlock)
 {
         struct lock_class_stats *stats;
-        s64 holdtime;
+        u64 holdtime;
 
         if (!lock_stat)
                 return;
 
-        holdtime = sched_clock() - hlock->holdtime_stamp;
+        holdtime = lockstat_clock() - hlock->holdtime_stamp;
 
         stats = get_lock_stats(hlock_class(hlock));
         if (hlock->read)
@@ -2792,7 +2797,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         hlock->references = references;
 #ifdef CONFIG_LOCK_STAT
         hlock->waittime_stamp = 0;
-        hlock->holdtime_stamp = sched_clock();
+        hlock->holdtime_stamp = lockstat_clock();
 #endif
 
         if (check == 2 && !mark_irqflags(curr, hlock))
@@ -3322,7 +3327,7 @@ found_it:
         if (hlock->instance != lock)
                 return;
 
-        hlock->waittime_stamp = sched_clock();
+        hlock->waittime_stamp = lockstat_clock();
 
         contention_point = lock_point(hlock_class(hlock)->contention_point, ip);
         contending_point = lock_point(hlock_class(hlock)->contending_point,
@@ -3345,8 +3350,7 @@ __lock_acquired(struct lockdep_map *lock, unsigned long ip)
         struct held_lock *hlock, *prev_hlock;
         struct lock_class_stats *stats;
         unsigned int depth;
-        u64 now;
-        s64 waittime = 0;
+        u64 now, waittime = 0;
         int i, cpu;
 
         depth = curr->lockdep_depth;
@@ -3374,7 +3378,7 @@ found_it:
 
         cpu = smp_processor_id();
         if (hlock->waittime_stamp) {
-                now = sched_clock();
+                now = lockstat_clock();
                 waittime = now - hlock->waittime_stamp;
                 hlock->holdtime_stamp = now;
         }
diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
index 50d022e5a560..ec815a960b5d 100644
--- a/kernel/mutex-debug.c
+++ b/kernel/mutex-debug.c
@@ -16,6 +16,7 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/poison.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/kallsyms.h>
 #include <linux/interrupt.h>
diff --git a/kernel/panic.c b/kernel/panic.c
index bcdef26e3332..96b45d0b4ba5 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -90,6 +90,8 @@ NORET_TYPE void panic(const char * fmt, ...)
 
         atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 
+        bust_spinlocks(0);
+
         if (!panic_blink)
                 panic_blink = no_blink;
 
@@ -136,7 +138,6 @@ NORET_TYPE void panic(const char * fmt, ...)
                 mdelay(1);
                 i++;
         }
-        bust_spinlocks(0);
 }
 
 EXPORT_SYMBOL(panic);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 0f86feb6db0c..9d0b5c665883 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -20,6 +20,7 @@
 #include <linux/percpu.h>
 #include <linux/ptrace.h>
 #include <linux/vmstat.h>
+#include <linux/vmalloc.h>
 #include <linux/hardirq.h>
 #include <linux/rculist.h>
 #include <linux/uaccess.h>
@@ -1030,14 +1031,10 @@ void __perf_event_sched_out(struct perf_event_context *ctx,
         update_context_time(ctx);
 
         perf_disable();
-        if (ctx->nr_active) {
-                list_for_each_entry(event, &ctx->group_list, group_entry) {
-                        if (event != event->group_leader)
-                                event_sched_out(event, cpuctx, ctx);
-                        else
-                                group_sched_out(event, cpuctx, ctx);
-                }
-        }
+        if (ctx->nr_active)
+                list_for_each_entry(event, &ctx->group_list, group_entry)
+                        group_sched_out(event, cpuctx, ctx);
+
         perf_enable();
  out:
         spin_unlock(&ctx->lock);
@@ -1258,12 +1255,8 @@ __perf_event_sched_in(struct perf_event_context *ctx,
                 if (event->cpu != -1 && event->cpu != cpu)
                         continue;
 
-                if (event != event->group_leader)
-                        event_sched_in(event, cpuctx, ctx, cpu);
-                else {
-                        if (group_can_go_on(event, cpuctx, 1))
-                                group_sched_in(event, cpuctx, ctx, cpu);
-                }
+                if (group_can_go_on(event, cpuctx, 1))
+                        group_sched_in(event, cpuctx, ctx, cpu);
 
                 /*
                  * If this pinned group hasn't been scheduled,
@@ -1291,15 +1284,9 @@ __perf_event_sched_in(struct perf_event_context *ctx,
                 if (event->cpu != -1 && event->cpu != cpu)
                         continue;
 
-                if (event != event->group_leader) {
-                        if (event_sched_in(event, cpuctx, ctx, cpu))
+                if (group_can_go_on(event, cpuctx, can_add_hw))
+                        if (group_sched_in(event, cpuctx, ctx, cpu))
                                 can_add_hw = 0;
-                } else {
-                        if (group_can_go_on(event, cpuctx, can_add_hw)) {
-                                if (group_sched_in(event, cpuctx, ctx, cpu))
-                                        can_add_hw = 0;
-                        }
-                }
         }
         perf_enable();
  out:
@@ -2105,49 +2092,31 @@ unlock:
         rcu_read_unlock();
 }
 
-static int perf_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+static unsigned long perf_data_size(struct perf_mmap_data *data)
 {
-        struct perf_event *event = vma->vm_file->private_data;
-        struct perf_mmap_data *data;
-        int ret = VM_FAULT_SIGBUS;
-
-        if (vmf->flags & FAULT_FLAG_MKWRITE) {
-                if (vmf->pgoff == 0)
-                        ret = 0;
-                return ret;
-        }
-
-        rcu_read_lock();
-        data = rcu_dereference(event->data);
-        if (!data)
-                goto unlock;
-
-        if (vmf->pgoff == 0) {
-                vmf->page = virt_to_page(data->user_page);
-        } else {
-                int nr = vmf->pgoff - 1;
-
-                if ((unsigned)nr > data->nr_pages)
-                        goto unlock;
+        return data->nr_pages << (PAGE_SHIFT + data->data_order);
+}
 
-                if (vmf->flags & FAULT_FLAG_WRITE)
-                        goto unlock;
+#ifndef CONFIG_PERF_USE_VMALLOC
 
-                vmf->page = virt_to_page(data->data_pages[nr]);
-        }
+/*
+ * Back perf_mmap() with regular GFP_KERNEL-0 pages.
+ */
 
-        get_page(vmf->page);
-        vmf->page->mapping = vma->vm_file->f_mapping;
-        vmf->page->index   = vmf->pgoff;
+static struct page *
+perf_mmap_to_page(struct perf_mmap_data *data, unsigned long pgoff)
+{
+        if (pgoff > data->nr_pages)
+                return NULL;
 
-        ret = 0;
-unlock:
-        rcu_read_unlock();
+        if (pgoff == 0)
+                return virt_to_page(data->user_page);
 
-        return ret;
+        return virt_to_page(data->data_pages[pgoff - 1]);
 }
 
-static int perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
+static struct perf_mmap_data *
+perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
 {
         struct perf_mmap_data *data;
         unsigned long size;
@@ -2172,19 +2141,10 @@ static int perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
                         goto fail_data_pages;
         }
 
+        data->data_order = 0;
         data->nr_pages = nr_pages;
-        atomic_set(&data->lock, -1);
-
-        if (event->attr.watermark) {
-                data->watermark = min_t(long, PAGE_SIZE * nr_pages,
-                                      event->attr.wakeup_watermark);
-        }
-        if (!data->watermark)
-                data->watermark = max(PAGE_SIZE, PAGE_SIZE * nr_pages / 4);
 
-        rcu_assign_pointer(event->data, data);
-
-        return 0;
+        return data;
 
 fail_data_pages:
         for (i--; i >= 0; i--)
@@ -2196,7 +2156,7 @@ fail_user_page:
         kfree(data);
 
 fail:
-        return -ENOMEM;
+        return NULL;
 }
 
 static void perf_mmap_free_page(unsigned long addr)
@@ -2207,28 +2167,169 @@ static void perf_mmap_free_page(unsigned long addr)
         __free_page(page);
 }
 
-static void __perf_mmap_data_free(struct rcu_head *rcu_head)
+static void perf_mmap_data_free(struct perf_mmap_data *data)
 {
-        struct perf_mmap_data *data;
         int i;
 
-        data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
-
         perf_mmap_free_page((unsigned long)data->user_page);
         for (i = 0; i < data->nr_pages; i++)
                 perf_mmap_free_page((unsigned long)data->data_pages[i]);
+}
+
+#else
+
+/*
+ * Back perf_mmap() with vmalloc memory.
+ *
+ * Required for architectures that have d-cache aliasing issues.
+ */
+
+static struct page *
+perf_mmap_to_page(struct perf_mmap_data *data, unsigned long pgoff)
+{
+        if (pgoff > (1UL << data->data_order))
+                return NULL;
+
+        return vmalloc_to_page((void *)data->user_page + pgoff * PAGE_SIZE);
+}
+
+static void perf_mmap_unmark_page(void *addr)
+{
+        struct page *page = vmalloc_to_page(addr);
+
+        page->mapping = NULL;
+}
+
+static void perf_mmap_data_free_work(struct work_struct *work)
+{
+        struct perf_mmap_data *data;
+        void *base;
+        int i, nr;
+
+        data = container_of(work, struct perf_mmap_data, work);
+        nr = 1 << data->data_order;
+
+        base = data->user_page;
+        for (i = 0; i < nr + 1; i++)
+                perf_mmap_unmark_page(base + (i * PAGE_SIZE));
+
+        vfree(base);
+}
 
+static void perf_mmap_data_free(struct perf_mmap_data *data)
+{
+        schedule_work(&data->work);
+}
+
+static struct perf_mmap_data *
+perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
+{
+        struct perf_mmap_data *data;
+        unsigned long size;
+        void *all_buf;
+
+        WARN_ON(atomic_read(&event->mmap_count));
+
+        size = sizeof(struct perf_mmap_data);
+        size += sizeof(void *);
+
+        data = kzalloc(size, GFP_KERNEL);
+        if (!data)
+                goto fail;
+
+        INIT_WORK(&data->work, perf_mmap_data_free_work);
+
+        all_buf = vmalloc_user((nr_pages + 1) * PAGE_SIZE);
+        if (!all_buf)
+                goto fail_all_buf;
+
+        data->user_page = all_buf;
+        data->data_pages[0] = all_buf + PAGE_SIZE;
+        data->data_order = ilog2(nr_pages);
+        data->nr_pages = 1;
+
+        return data;
+
+fail_all_buf:
+        kfree(data);
+
+fail:
+        return NULL;
+}
+
+#endif
+
+static int perf_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct perf_event *event = vma->vm_file->private_data;
+        struct perf_mmap_data *data;
+        int ret = VM_FAULT_SIGBUS;
+
+        if (vmf->flags & FAULT_FLAG_MKWRITE) {
+                if (vmf->pgoff == 0)
+                        ret = 0;
+                return ret;
+        }
+
+        rcu_read_lock();
+        data = rcu_dereference(event->data);
+        if (!data)
+                goto unlock;
+
+        if (vmf->pgoff && (vmf->flags & FAULT_FLAG_WRITE))
+                goto unlock;
+
+        vmf->page = perf_mmap_to_page(data, vmf->pgoff);
+        if (!vmf->page)
+                goto unlock;
+
+        get_page(vmf->page);
+        vmf->page->mapping = vma->vm_file->f_mapping;
+        vmf->page->index   = vmf->pgoff;
+
+        ret = 0;
+unlock:
+        rcu_read_unlock();
+
+        return ret;
+}
+
+static void
+perf_mmap_data_init(struct perf_event *event, struct perf_mmap_data *data)
+{
+        long max_size = perf_data_size(data);
+
+        atomic_set(&data->lock, -1);
+
+        if (event->attr.watermark) {
+                data->watermark = min_t(long, max_size,
+                                        event->attr.wakeup_watermark);
+        }
+
+        if (!data->watermark)
+                data->watermark = max_t(long, PAGE_SIZE, max_size / 2);
+
+
+        rcu_assign_pointer(event->data, data);
+}
+
+static void perf_mmap_data_free_rcu(struct rcu_head *rcu_head)
+{
+        struct perf_mmap_data *data;
+
+        data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
+        perf_mmap_data_free(data);
         kfree(data);
 }
 
-static void perf_mmap_data_free(struct perf_event *event)
+static void perf_mmap_data_release(struct perf_event *event)
 {
         struct perf_mmap_data *data = event->data;
 
         WARN_ON(atomic_read(&event->mmap_count));
 
         rcu_assign_pointer(event->data, NULL);
-        call_rcu(&data->rcu_head, __perf_mmap_data_free);
+        call_rcu(&data->rcu_head, perf_mmap_data_free_rcu);
 }
 
 static void perf_mmap_open(struct vm_area_struct *vma)
@@ -2244,11 +2345,12 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 
         WARN_ON_ONCE(event->ctx->parent_ctx);
         if (atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) {
+                unsigned long size = perf_data_size(event->data);
                 struct user_struct *user = current_user();
 
-                atomic_long_sub(event->data->nr_pages + 1, &user->locked_vm);
+                atomic_long_sub((size >> PAGE_SHIFT) + 1, &user->locked_vm);
                 vma->vm_mm->locked_vm -= event->data->nr_locked;
-                perf_mmap_data_free(event);
+                perf_mmap_data_release(event);
                 mutex_unlock(&event->mmap_mutex);
         }
 }
@@ -2266,6 +2368,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
         unsigned long user_locked, user_lock_limit;
         struct user_struct *user = current_user();
         unsigned long locked, lock_limit;
+        struct perf_mmap_data *data;
         unsigned long vma_size;
         unsigned long nr_pages;
         long user_extra, extra;
@@ -2328,10 +2431,15 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
         }
 
         WARN_ON(event->data);
-        ret = perf_mmap_data_alloc(event, nr_pages);
-        if (ret)
+
+        data = perf_mmap_data_alloc(event, nr_pages);
+        ret = -ENOMEM;
+        if (!data)
                 goto unlock;
 
+        ret = 0;
+        perf_mmap_data_init(event, data);
+
         atomic_set(&event->mmap_count, 1);
         atomic_long_add(user_extra, &user->locked_vm);
         vma->vm_mm->locked_vm += extra;
@@ -2519,7 +2627,7 @@ static bool perf_output_space(struct perf_mmap_data *data, unsigned long tail,
         if (!data->writable)
                 return true;
 
-        mask = (data->nr_pages << PAGE_SHIFT) - 1;
+        mask = perf_data_size(data) - 1;
 
         offset = (offset - tail) & mask;
         head   = (head   - tail) & mask;
@@ -2624,7 +2732,7 @@ void perf_output_copy(struct perf_output_handle *handle,
                       const void *buf, unsigned int len)
 {
         unsigned int pages_mask;
-        unsigned int offset;
+        unsigned long offset;
         unsigned int size;
         void **pages;
 
@@ -2633,12 +2741,14 @@ void perf_output_copy(struct perf_output_handle *handle,
         pages           = handle->data->data_pages;
 
         do {
-                unsigned int page_offset;
+                unsigned long page_offset;
+                unsigned long page_size;
                 int nr;
 
                 nr          = (offset >> PAGE_SHIFT) & pages_mask;
-                page_offset = offset & (PAGE_SIZE - 1);
-                size        = min_t(unsigned int, PAGE_SIZE - page_offset, len);
+                page_size   = 1UL << (handle->data->data_order + PAGE_SHIFT);
+                page_offset = offset & (page_size - 1);
+                size        = min_t(unsigned int, page_size - page_offset, len);
 
                 memcpy(pages[nr] + page_offset, buf, size);
 
@@ -4781,9 +4891,7 @@ int perf_event_init_task(struct task_struct *child)
          * We dont have to disable NMIs - we are only looking at
          * the list, not manipulating it:
          */
-        list_for_each_entry_rcu(event, &parent_ctx->event_list, event_entry) {
-                if (event != event->group_leader)
-                        continue;
+        list_for_each_entry(event, &parent_ctx->group_list, group_entry) {
 
                 if (!event->attr.inherit) {
                         inherited_all = 0;
diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
index 17d8bb1acf9c..25596e450ac7 100644
--- a/kernel/power/suspend_test.c
+++ b/kernel/power/suspend_test.c
@@ -19,7 +19,7 @@
  * The time it takes is system-specific though, so when we test this
  * during system bootup we allow a LOT of time.
  */
-#define TEST_SUSPEND_SECONDS    5
+#define TEST_SUSPEND_SECONDS    10
 
 static unsigned long suspend_test_start_time;
 
@@ -49,7 +49,8 @@ void suspend_test_finish(const char *label)
          * has some performance issues.  The stack dump of a WARN_ON
          * is more likely to get the right attention than a printk...
          */
-        WARN(msec > (TEST_SUSPEND_SECONDS * 1000), "Component: %s\n", label);
+        WARN(msec > (TEST_SUSPEND_SECONDS * 1000),
+             "Component: %s, time: %u\n", label, msec);
 }
 
 /*
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 37ac45483082..400183346ad2 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -46,22 +46,15 @@
 #include <linux/module.h>
 #include <linux/kernel_stat.h>
 
-enum rcu_barrier {
-        RCU_BARRIER_STD,
-        RCU_BARRIER_BH,
-        RCU_BARRIER_SCHED,
-};
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+static struct lock_class_key rcu_lock_key;
+struct lockdep_map rcu_lock_map =
+        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock", &rcu_lock_key);
+EXPORT_SYMBOL_GPL(rcu_lock_map);
+#endif
 
-static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
-static atomic_t rcu_barrier_cpu_count;
-static DEFINE_MUTEX(rcu_barrier_mutex);
-static struct completion rcu_barrier_completion;
 int rcu_scheduler_active __read_mostly;
 
-static atomic_t rcu_migrate_type_count = ATOMIC_INIT(0);
-static struct rcu_head rcu_migrate_head[3];
-static DECLARE_WAIT_QUEUE_HEAD(rcu_migrate_wq);
-
 /*
  * Awaken the corresponding synchronize_rcu() instance now that a
  * grace period has elapsed.
@@ -164,129 +157,10 @@ void synchronize_rcu_bh(void)
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_bh);
 
-static void rcu_barrier_callback(struct rcu_head *notused)
-{
-        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
-                complete(&rcu_barrier_completion);
-}
-
-/*
- * Called with preemption disabled, and from cross-cpu IRQ context.
- */
-static void rcu_barrier_func(void *type)
-{
-        int cpu = smp_processor_id();
-        struct rcu_head *head = &per_cpu(rcu_barrier_head, cpu);
-
-        atomic_inc(&rcu_barrier_cpu_count);
-        switch ((enum rcu_barrier)type) {
-        case RCU_BARRIER_STD:
-                call_rcu(head, rcu_barrier_callback);
-                break;
-        case RCU_BARRIER_BH:
-                call_rcu_bh(head, rcu_barrier_callback);
-                break;
-        case RCU_BARRIER_SCHED:
-                call_rcu_sched(head, rcu_barrier_callback);
-                break;
-        }
-}
-
-static inline void wait_migrated_callbacks(void)
-{
-        wait_event(rcu_migrate_wq, !atomic_read(&rcu_migrate_type_count));
-        smp_mb(); /* In case we didn't sleep. */
-}
-
-/*
- * Orchestrate the specified type of RCU barrier, waiting for all
- * RCU callbacks of the specified type to complete.
- */
-static void _rcu_barrier(enum rcu_barrier type)
-{
-        BUG_ON(in_interrupt());
-        /* Take cpucontrol mutex to protect against CPU hotplug */
-        mutex_lock(&rcu_barrier_mutex);
-        init_completion(&rcu_barrier_completion);
-        /*
-         * Initialize rcu_barrier_cpu_count to 1, then invoke
-         * rcu_barrier_func() on each CPU, so that each CPU also has
-         * incremented rcu_barrier_cpu_count.  Only then is it safe to
-         * decrement rcu_barrier_cpu_count -- otherwise the first CPU
-         * might complete its grace period before all of the other CPUs
-         * did their increment, causing this function to return too
-         * early.
-         */
-        atomic_set(&rcu_barrier_cpu_count, 1);
-        on_each_cpu(rcu_barrier_func, (void *)type, 1);
-        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
-                complete(&rcu_barrier_completion);
-        wait_for_completion(&rcu_barrier_completion);
-        mutex_unlock(&rcu_barrier_mutex);
-        wait_migrated_callbacks();
-}
-
-/**
- * rcu_barrier - Wait until all in-flight call_rcu() callbacks complete.
- */
-void rcu_barrier(void)
-{
-        _rcu_barrier(RCU_BARRIER_STD);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier);
-
-/**
- * rcu_barrier_bh - Wait until all in-flight call_rcu_bh() callbacks complete.
- */
-void rcu_barrier_bh(void)
-{
-        _rcu_barrier(RCU_BARRIER_BH);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier_bh);
-
-/**
- * rcu_barrier_sched - Wait for in-flight call_rcu_sched() callbacks.
- */
-void rcu_barrier_sched(void)
-{
-        _rcu_barrier(RCU_BARRIER_SCHED);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier_sched);
-
-static void rcu_migrate_callback(struct rcu_head *notused)
-{
-        if (atomic_dec_and_test(&rcu_migrate_type_count))
-                wake_up(&rcu_migrate_wq);
-}
-
-extern int rcu_cpu_notify(struct notifier_block *self,
-                          unsigned long action, void *hcpu);
-
 static int __cpuinit rcu_barrier_cpu_hotplug(struct notifier_block *self,
                 unsigned long action, void *hcpu)
 {
-        rcu_cpu_notify(self, action, hcpu);
-        if (action == CPU_DYING) {
-                /*
-                 * preempt_disable() in on_each_cpu() prevents stop_machine(),
-                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
-                 * returns, all online cpus have queued rcu_barrier_func(),
-                 * and the dead cpu(if it exist) queues rcu_migrate_callback()s.
-                 *
-                 * These callbacks ensure _rcu_barrier() waits for all
-                 * RCU callbacks of the specified type to complete.
-                 */
-                atomic_set(&rcu_migrate_type_count, 3);
-                call_rcu_bh(rcu_migrate_head, rcu_migrate_callback);
-                call_rcu_sched(rcu_migrate_head + 1, rcu_migrate_callback);
-                call_rcu(rcu_migrate_head + 2, rcu_migrate_callback);
-        } else if (action == CPU_DOWN_PREPARE) {
-                /* Don't need to wait until next removal operation. */
-                /* rcu_migrate_head is protected by cpu_add_remove_lock */
-                wait_migrated_callbacks();
-        }
-
-        return NOTIFY_OK;
+        return rcu_cpu_notify(self, action, hcpu);
 }
 
 void __init rcu_init(void)
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 233768f21f97..697c0a0229d4 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -606,8 +606,6 @@ static struct rcu_torture_ops sched_ops_sync = {
         .name           = "sched_sync"
 };
 
-extern int rcu_expedited_torture_stats(char *page);
-
 static struct rcu_torture_ops sched_expedited_ops = {
         .init           = rcu_sync_torture_init,
         .cleanup        = NULL,
@@ -650,7 +648,7 @@ rcu_torture_writer(void *arg)
                 old_rp = rcu_torture_current;
                 rp->rtort_mbtest = 1;
                 rcu_assign_pointer(rcu_torture_current, rp);
-                smp_wmb();
+                smp_wmb(); /* Mods to old_rp must follow rcu_assign_pointer() */
                 if (old_rp) {
                         i = old_rp->rtort_pipe_count;
                         if (i > RCU_TORTURE_PIPE_LEN)
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 52b06f6e158c..705f02ac7433 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -49,13 +49,6 @@
 
 #include "rcutree.h"
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-static struct lock_class_key rcu_lock_key;
-struct lockdep_map rcu_lock_map =
-        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock", &rcu_lock_key);
-EXPORT_SYMBOL_GPL(rcu_lock_map);
-#endif
-
 /* Data structures. */
 
 #define RCU_STATE_INITIALIZER(name) { \
@@ -70,6 +63,9 @@ EXPORT_SYMBOL_GPL(rcu_lock_map);
         .gpnum = -300, \
         .completed = -300, \
         .onofflock = __SPIN_LOCK_UNLOCKED(&name.onofflock), \
+        .orphan_cbs_list = NULL, \
+        .orphan_cbs_tail = &name.orphan_cbs_list, \
+        .orphan_qlen = 0, \
         .fqslock = __SPIN_LOCK_UNLOCKED(&name.fqslock), \
         .n_force_qs = 0, \
         .n_force_qs_ngp = 0, \
@@ -81,24 +77,16 @@ DEFINE_PER_CPU(struct rcu_data, rcu_sched_data);
 struct rcu_state rcu_bh_state = RCU_STATE_INITIALIZER(rcu_bh_state);
 DEFINE_PER_CPU(struct rcu_data, rcu_bh_data);
 
-extern long rcu_batches_completed_sched(void);
-static struct rcu_node *rcu_get_root(struct rcu_state *rsp);
-static void cpu_quiet_msk(unsigned long mask, struct rcu_state *rsp,
-                          struct rcu_node *rnp, unsigned long flags);
-static void cpu_quiet_msk_finish(struct rcu_state *rsp, unsigned long flags);
-#ifdef CONFIG_HOTPLUG_CPU
-static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp);
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
-static void __rcu_process_callbacks(struct rcu_state *rsp,
-                                    struct rcu_data *rdp);
-static void __call_rcu(struct rcu_head *head,
-                       void (*func)(struct rcu_head *rcu),
-                       struct rcu_state *rsp);
-static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp);
-static void __cpuinit rcu_init_percpu_data(int cpu, struct rcu_state *rsp,
-                                           int preemptable);
 
-#include "rcutree_plugin.h"
+/*
+ * Return true if an RCU grace period is in progress.  The ACCESS_ONCE()s
+ * permit this function to be invoked without holding the root rcu_node
+ * structure's ->lock, but of course results can be subject to change.
+ */
+static int rcu_gp_in_progress(struct rcu_state *rsp)
+{
+        return ACCESS_ONCE(rsp->completed) != ACCESS_ONCE(rsp->gpnum);
+}
 
 /*
  * Note a quiescent state.  Because we do not need to know
@@ -137,6 +125,10 @@ static int blimit = 10;		/* Maximum callbacks per softirq. */
 static int qhimark = 10000;     /* If this many pending, ignore blimit. */
 static int qlowmark = 100;      /* Once only this many pending, use blimit. */
 
+module_param(blimit, int, 0);
+module_param(qhimark, int, 0);
+module_param(qlowmark, int, 0);
+
 static void force_quiescent_state(struct rcu_state *rsp, int relaxed);
 static int rcu_pending(int cpu);
 
@@ -173,9 +165,7 @@ cpu_has_callbacks_ready_to_invoke(struct rcu_data *rdp)
 static int
 cpu_needs_another_gp(struct rcu_state *rsp, struct rcu_data *rdp)
 {
-        /* ACCESS_ONCE() because we are accessing outside of lock. */
-        return *rdp->nxttail[RCU_DONE_TAIL] &&
-               ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum);
+        return *rdp->nxttail[RCU_DONE_TAIL] && !rcu_gp_in_progress(rsp);
 }
 
 /*
@@ -369,7 +359,7 @@ static long dyntick_recall_completed(struct rcu_state *rsp)
 /*
  * Snapshot the specified CPU's dynticks counter so that we can later
  * credit them with an implicit quiescent state.  Return 1 if this CPU
- * is already in a quiescent state courtesy of dynticks idle mode.
+ * is in dynticks idle mode, which is an extended quiescent state.
  */
 static int dyntick_save_progress_counter(struct rcu_data *rdp)
 {
@@ -475,30 +465,34 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
         long delta;
         unsigned long flags;
         struct rcu_node *rnp = rcu_get_root(rsp);
-        struct rcu_node *rnp_cur = rsp->level[NUM_RCU_LVLS - 1];
-        struct rcu_node *rnp_end = &rsp->node[NUM_RCU_NODES];
 
         /* Only let one CPU complain about others per time interval. */
 
         spin_lock_irqsave(&rnp->lock, flags);
         delta = jiffies - rsp->jiffies_stall;
-        if (delta < RCU_STALL_RAT_DELAY || rsp->gpnum == rsp->completed) {
+        if (delta < RCU_STALL_RAT_DELAY || !rcu_gp_in_progress(rsp)) {
                 spin_unlock_irqrestore(&rnp->lock, flags);
                 return;
         }
         rsp->jiffies_stall = jiffies + RCU_SECONDS_TILL_STALL_RECHECK;
+
+        /*
+         * Now rat on any tasks that got kicked up to the root rcu_node
+         * due to CPU offlining.
+         */
+        rcu_print_task_stall(rnp);
         spin_unlock_irqrestore(&rnp->lock, flags);
 
         /* OK, time to rat on our buddy... */
 
         printk(KERN_ERR "INFO: RCU detected CPU stalls:");
-        for (; rnp_cur < rnp_end; rnp_cur++) {
+        rcu_for_each_leaf_node(rsp, rnp) {
                 rcu_print_task_stall(rnp);
-                if (rnp_cur->qsmask == 0)
+                if (rnp->qsmask == 0)
                         continue;
-                for (cpu = 0; cpu <= rnp_cur->grphi - rnp_cur->grplo; cpu++)
-                        if (rnp_cur->qsmask & (1UL << cpu))
-                                printk(" %d", rnp_cur->grplo + cpu);
+                for (cpu = 0; cpu <= rnp->grphi - rnp->grplo; cpu++)
+                        if (rnp->qsmask & (1UL << cpu))
+                                printk(" %d", rnp->grplo + cpu);
         }
         printk(" (detected by %d, t=%ld jiffies)\n",
                smp_processor_id(), (long)(jiffies - rsp->gp_start));
@@ -537,8 +531,7 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
                 /* We haven't checked in, so go dump stack. */
                 print_cpu_stall(rsp);
 
-        } else if (rsp->gpnum != rsp->completed &&
-                   delta >= RCU_STALL_RAT_DELAY) {
+        } else if (rcu_gp_in_progress(rsp) && delta >= RCU_STALL_RAT_DELAY) {
 
                 /* They had two time units to dump stack, so complain. */
                 print_other_cpu_stall(rsp);
@@ -617,9 +610,15 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
         note_new_gpnum(rsp, rdp);
 
         /*
-         * Because we are first, we know that all our callbacks will
-         * be covered by this upcoming grace period, even the ones
-         * that were registered arbitrarily recently.
+         * Because this CPU just now started the new grace period, we know
+         * that all of its callbacks will be covered by this upcoming grace
+         * period, even the ones that were registered arbitrarily recently.
+         * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL.
+         *
+         * Other CPUs cannot be sure exactly when the grace period started.
+         * Therefore, their recently registered callbacks must pass through
+         * an additional RCU_NEXT_READY stage, so that they will be handled
+         * by the next RCU grace period.
          */
         rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
         rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
@@ -657,7 +656,7 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
          * one corresponding to this CPU, due to the fact that we have
          * irqs disabled.
          */
-        for (rnp = &rsp->node[0]; rnp < &rsp->node[NUM_RCU_NODES]; rnp++) {
+        rcu_for_each_node_breadth_first(rsp, rnp) {
                 spin_lock(&rnp->lock);  /* irqs already disabled. */
                 rcu_preempt_check_blocked_tasks(rnp);
                 rnp->qsmask = rnp->qsmaskinit;
@@ -703,9 +702,9 @@ rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp)
  * hold rnp->lock, as required by rcu_start_gp(), which will release it.
  */
 static void cpu_quiet_msk_finish(struct rcu_state *rsp, unsigned long flags)
-        __releases(rnp->lock)
+        __releases(rcu_get_root(rsp)->lock)
 {
-        WARN_ON_ONCE(rsp->completed == rsp->gpnum);
+        WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
         rsp->completed = rsp->gpnum;
         rcu_process_gp_end(rsp, rsp->rda[smp_processor_id()]);
         rcu_start_gp(rsp, flags);  /* releases root node's rnp->lock. */
@@ -842,17 +841,63 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
 #ifdef CONFIG_HOTPLUG_CPU
 
 /*
+ * Move a dying CPU's RCU callbacks to the ->orphan_cbs_list for the
+ * specified flavor of RCU.  The callbacks will be adopted by the next
+ * _rcu_barrier() invocation or by the CPU_DEAD notifier, whichever
+ * comes first.  Because this is invoked from the CPU_DYING notifier,
+ * irqs are already disabled.
+ */
+static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
+{
+        int i;
+        struct rcu_data *rdp = rsp->rda[smp_processor_id()];
+
+        if (rdp->nxtlist == NULL)
+                return;  /* irqs disabled, so comparison is stable. */
+        spin_lock(&rsp->onofflock);  /* irqs already disabled. */
+        *rsp->orphan_cbs_tail = rdp->nxtlist;
+        rsp->orphan_cbs_tail = rdp->nxttail[RCU_NEXT_TAIL];
+        rdp->nxtlist = NULL;
+        for (i = 0; i < RCU_NEXT_SIZE; i++)
+                rdp->nxttail[i] = &rdp->nxtlist;
+        rsp->orphan_qlen += rdp->qlen;
+        rdp->qlen = 0;
+        spin_unlock(&rsp->onofflock);  /* irqs remain disabled. */
+}
+
+/*
+ * Adopt previously orphaned RCU callbacks.
+ */
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+{
+        unsigned long flags;
+        struct rcu_data *rdp;
+
+        spin_lock_irqsave(&rsp->onofflock, flags);
+        rdp = rsp->rda[smp_processor_id()];
+        if (rsp->orphan_cbs_list == NULL) {
+                spin_unlock_irqrestore(&rsp->onofflock, flags);
+                return;
+        }
+        *rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_list;
+        rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_tail;
+        rdp->qlen += rsp->orphan_qlen;
+        rsp->orphan_cbs_list = NULL;
+        rsp->orphan_cbs_tail = &rsp->orphan_cbs_list;
+        rsp->orphan_qlen = 0;
+        spin_unlock_irqrestore(&rsp->onofflock, flags);
+}
+
+/*
  * Remove the outgoing CPU from the bitmasks in the rcu_node hierarchy
  * and move all callbacks from the outgoing CPU to the current one.
  */
 static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
 {
-        int i;
         unsigned long flags;
         long lastcomp;
         unsigned long mask;
         struct rcu_data *rdp = rsp->rda[cpu];
-        struct rcu_data *rdp_me;
         struct rcu_node *rnp;
 
         /* Exclude any attempts to start a new grace period. */
@@ -875,32 +920,9 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
         } while (rnp != NULL);
         lastcomp = rsp->completed;
 
-        spin_unlock(&rsp->onofflock);           /* irqs remain disabled. */
+        spin_unlock_irqrestore(&rsp->onofflock, flags);
 
-        /*
-         * Move callbacks from the outgoing CPU to the running CPU.
-         * Note that the outgoing CPU is now quiscent, so it is now
-         * (uncharacteristically) safe to access its rcu_data structure.
-         * Note also that we must carefully retain the order of the
-         * outgoing CPU's callbacks in order for rcu_barrier() to work
-         * correctly.  Finally, note that we start all the callbacks
-         * afresh, even those that have passed through a grace period
-         * and are therefore ready to invoke.  The theory is that hotplug
-         * events are rare, and that if they are frequent enough to
-         * indefinitely delay callbacks, you have far worse things to
-         * be worrying about.
-         */
-        rdp_me = rsp->rda[smp_processor_id()];
-        if (rdp->nxtlist != NULL) {
-                *rdp_me->nxttail[RCU_NEXT_TAIL] = rdp->nxtlist;
-                rdp_me->nxttail[RCU_NEXT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
-                rdp->nxtlist = NULL;
-                for (i = 0; i < RCU_NEXT_SIZE; i++)
-                        rdp->nxttail[i] = &rdp->nxtlist;
-                rdp_me->qlen += rdp->qlen;
-                rdp->qlen = 0;
-        }
-        local_irq_restore(flags);
+        rcu_adopt_orphan_cbs(rsp);
 }
 
 /*
@@ -918,6 +940,14 @@ static void rcu_offline_cpu(int cpu)
 
 #else /* #ifdef CONFIG_HOTPLUG_CPU */
 
+static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
+{
+}
+
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+{
+}
+
 static void rcu_offline_cpu(int cpu)
 {
 }
@@ -1050,33 +1080,32 @@ static int rcu_process_dyntick(struct rcu_state *rsp, long lastcomp,
         int cpu;
         unsigned long flags;
         unsigned long mask;
-        struct rcu_node *rnp_cur = rsp->level[NUM_RCU_LVLS - 1];
-        struct rcu_node *rnp_end = &rsp->node[NUM_RCU_NODES];
+        struct rcu_node *rnp;
 
-        for (; rnp_cur < rnp_end; rnp_cur++) {
+        rcu_for_each_leaf_node(rsp, rnp) {
                 mask = 0;
-                spin_lock_irqsave(&rnp_cur->lock, flags);
+                spin_lock_irqsave(&rnp->lock, flags);
                 if (rsp->completed != lastcomp) {
-                        spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                        spin_unlock_irqrestore(&rnp->lock, flags);
                         return 1;
                 }
-                if (rnp_cur->qsmask == 0) {
-                        spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                if (rnp->qsmask == 0) {
+                        spin_unlock_irqrestore(&rnp->lock, flags);
                         continue;
                 }
-                cpu = rnp_cur->grplo;
+                cpu = rnp->grplo;
                 bit = 1;
-                for (; cpu <= rnp_cur->grphi; cpu++, bit <<= 1) {
-                        if ((rnp_cur->qsmask & bit) != 0 && f(rsp->rda[cpu]))
+                for (; cpu <= rnp->grphi; cpu++, bit <<= 1) {
+                        if ((rnp->qsmask & bit) != 0 && f(rsp->rda[cpu]))
                                 mask |= bit;
                 }
                 if (mask != 0 && rsp->completed == lastcomp) {
 
-                        /* cpu_quiet_msk() releases rnp_cur->lock. */
-                        cpu_quiet_msk(mask, rsp, rnp_cur, flags);
+                        /* cpu_quiet_msk() releases rnp->lock. */
+                        cpu_quiet_msk(mask, rsp, rnp, flags);
                         continue;
                 }
-                spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                spin_unlock_irqrestore(&rnp->lock, flags);
         }
         return 0;
 }
@@ -1092,7 +1121,7 @@ static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
         struct rcu_node *rnp = rcu_get_root(rsp);
         u8 signaled;
 
-        if (ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum))
+        if (!rcu_gp_in_progress(rsp))
                 return;  /* No grace period in progress, nothing to force. */
         if (!spin_trylock_irqsave(&rsp->fqslock, flags)) {
                 rsp->n_force_qs_lh++; /* Inexact, can lose counts.  Tough! */
@@ -1251,7 +1280,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
         rdp->nxttail[RCU_NEXT_TAIL] = &head->next;
 
         /* Start a new grace period if one not already started. */
-        if (ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum)) {
+        if (!rcu_gp_in_progress(rsp)) {
                 unsigned long nestflag;
                 struct rcu_node *rnp_root = rcu_get_root(rsp);
 
@@ -1331,7 +1360,7 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
         }
 
         /* Has an RCU GP gone long enough to send resched IPIs &c? */
-        if (ACCESS_ONCE(rsp->completed) != ACCESS_ONCE(rsp->gpnum) &&
+        if (rcu_gp_in_progress(rsp) &&
             ((long)(ACCESS_ONCE(rsp->jiffies_force_qs) - jiffies) < 0)) {
                 rdp->n_rp_need_fqs++;
                 return 1;
@@ -1368,6 +1397,82 @@ int rcu_needs_cpu(int cpu)
                rcu_preempt_needs_cpu(cpu);
 }
 
+static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
+static atomic_t rcu_barrier_cpu_count;
+static DEFINE_MUTEX(rcu_barrier_mutex);
+static struct completion rcu_barrier_completion;
+
+static void rcu_barrier_callback(struct rcu_head *notused)
+{
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+}
+
+/*
+ * Called with preemption disabled, and from cross-cpu IRQ context.
+ */
+static void rcu_barrier_func(void *type)
+{
+        int cpu = smp_processor_id();
+        struct rcu_head *head = &per_cpu(rcu_barrier_head, cpu);
+        void (*call_rcu_func)(struct rcu_head *head,
+                              void (*func)(struct rcu_head *head));
+
+        atomic_inc(&rcu_barrier_cpu_count);
+        call_rcu_func = type;
+        call_rcu_func(head, rcu_barrier_callback);
+}
+
+/*
+ * Orchestrate the specified type of RCU barrier, waiting for all
+ * RCU callbacks of the specified type to complete.
+ */
+static void _rcu_barrier(struct rcu_state *rsp,
+                         void (*call_rcu_func)(struct rcu_head *head,
+                                               void (*func)(struct rcu_head *head)))
+{
+        BUG_ON(in_interrupt());
+        /* Take mutex to serialize concurrent rcu_barrier() requests. */
+        mutex_lock(&rcu_barrier_mutex);
+        init_completion(&rcu_barrier_completion);
+        /*
+         * Initialize rcu_barrier_cpu_count to 1, then invoke
+         * rcu_barrier_func() on each CPU, so that each CPU also has
+         * incremented rcu_barrier_cpu_count.  Only then is it safe to
+         * decrement rcu_barrier_cpu_count -- otherwise the first CPU
+         * might complete its grace period before all of the other CPUs
+         * did their increment, causing this function to return too
+         * early.
+         */
+        atomic_set(&rcu_barrier_cpu_count, 1);
+        preempt_disable(); /* stop CPU_DYING from filling orphan_cbs_list */
+        rcu_adopt_orphan_cbs(rsp);
+        on_each_cpu(rcu_barrier_func, (void *)call_rcu_func, 1);
+        preempt_enable(); /* CPU_DYING can again fill orphan_cbs_list */
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+        wait_for_completion(&rcu_barrier_completion);
+        mutex_unlock(&rcu_barrier_mutex);
+}
+
+/**
+ * rcu_barrier_bh - Wait until all in-flight call_rcu_bh() callbacks complete.
+ */
+void rcu_barrier_bh(void)
+{
+        _rcu_barrier(&rcu_bh_state, call_rcu_bh);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier_bh);
+
+/**
+ * rcu_barrier_sched - Wait for in-flight call_rcu_sched() callbacks.
+ */
+void rcu_barrier_sched(void)
+{
+        _rcu_barrier(&rcu_sched_state, call_rcu_sched);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier_sched);
+
 /*
  * Do boot-time initialization of a CPU's per-CPU RCU data.
  */
@@ -1464,6 +1569,22 @@ int __cpuinit rcu_cpu_notify(struct notifier_block *self,
         case CPU_UP_PREPARE_FROZEN:
                 rcu_online_cpu(cpu);
                 break;
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                /*
+                 * preempt_disable() in _rcu_barrier() prevents stop_machine(),
+                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
+                 * returns, all online cpus have queued rcu_barrier_func().
+                 * The dying CPU clears its cpu_online_mask bit and
+                 * moves all of its RCU callbacks to ->orphan_cbs_list
+                 * in the context of stop_machine(), so subsequent calls
+                 * to _rcu_barrier() will adopt these callbacks and only
+                 * then queue rcu_barrier_func() on all remaining CPUs.
+                 */
+                rcu_send_cbs_to_orphanage(&rcu_bh_state);
+                rcu_send_cbs_to_orphanage(&rcu_sched_state);
+                rcu_preempt_send_cbs_to_orphanage();
+                break;
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
         case CPU_UP_CANCELED:
@@ -1526,7 +1647,8 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                 cpustride *= rsp->levelspread[i];
                 rnp = rsp->level[i];
                 for (j = 0; j < rsp->levelcnt[i]; j++, rnp++) {
-                        spin_lock_init(&rnp->lock);
+                        if (rnp != rcu_get_root(rsp))
+                                spin_lock_init(&rnp->lock);
                         rnp->gpnum = 0;
                         rnp->qsmask = 0;
                         rnp->qsmaskinit = 0;
@@ -1549,6 +1671,7 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                         INIT_LIST_HEAD(&rnp->blocked_tasks[1]);
                 }
         }
+        spin_lock_init(&rcu_get_root(rsp)->lock);
 }
 
 /*
@@ -1558,6 +1681,10 @@ static void __init rcu_init_one(struct rcu_state *rsp)
  */
 #define RCU_INIT_FLAVOR(rsp, rcu_data) \
 do { \
+        int i; \
+        int j; \
+        struct rcu_node *rnp; \
+        \
         rcu_init_one(rsp); \
         rnp = (rsp)->level[NUM_RCU_LVLS - 1]; \
         j = 0; \
@@ -1570,31 +1697,8 @@ do { \
         } \
 } while (0)
 
-#ifdef CONFIG_TREE_PREEMPT_RCU
-
-void __init __rcu_init_preempt(void)
-{
-        int i;                  /* All used by RCU_INIT_FLAVOR(). */
-        int j;
-        struct rcu_node *rnp;
-
-        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
-}
-
-#else /* #ifdef CONFIG_TREE_PREEMPT_RCU */
-
-void __init __rcu_init_preempt(void)
-{
-}
-
-#endif /* #else #ifdef CONFIG_TREE_PREEMPT_RCU */
-
 void __init __rcu_init(void)
 {
-        int i;                  /* All used by RCU_INIT_FLAVOR(). */
-        int j;
-        struct rcu_node *rnp;
-
         rcu_bootup_announce();
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
         printk(KERN_INFO "RCU-based detection of stalled CPUs is enabled.\n");
@@ -1605,6 +1709,4 @@ void __init __rcu_init(void)
         open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 }
 
-module_param(blimit, int, 0);
-module_param(qhimark, int, 0);
-module_param(qlowmark, int, 0);
+#include "rcutree_plugin.h"
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 8e8287a983c2..b40ac5706040 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -48,14 +48,14 @@
 #elif NR_CPUS <= RCU_FANOUT_SQ
 #  define NUM_RCU_LVLS        2
 #  define NUM_RCU_LVL_0       1
-#  define NUM_RCU_LVL_1       (((NR_CPUS) + RCU_FANOUT - 1) / RCU_FANOUT)
+#  define NUM_RCU_LVL_1       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT)
 #  define NUM_RCU_LVL_2       (NR_CPUS)
 #  define NUM_RCU_LVL_3       0
 #elif NR_CPUS <= RCU_FANOUT_CUBE
 #  define NUM_RCU_LVLS        3
 #  define NUM_RCU_LVL_0       1
-#  define NUM_RCU_LVL_1       (((NR_CPUS) + RCU_FANOUT_SQ - 1) / RCU_FANOUT_SQ)
-#  define NUM_RCU_LVL_2       (((NR_CPUS) + (RCU_FANOUT) - 1) / (RCU_FANOUT))
+#  define NUM_RCU_LVL_1       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT_SQ)
+#  define NUM_RCU_LVL_2       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT)
 #  define NUM_RCU_LVL_3       NR_CPUS
 #else
 # error "CONFIG_RCU_FANOUT insufficient for NR_CPUS"
@@ -79,15 +79,21 @@ struct rcu_dynticks {
  * Definition for node within the RCU grace-period-detection hierarchy.
  */
 struct rcu_node {
-        spinlock_t lock;
+        spinlock_t lock;        /* Root rcu_node's lock protects some */
+                                /*  rcu_state fields as well as following. */
         long    gpnum;          /* Current grace period for this node. */
                                 /*  This will either be equal to or one */
                                 /*  behind the root rcu_node's gpnum. */
         unsigned long qsmask;   /* CPUs or groups that need to switch in */
                                 /*  order for current grace period to proceed.*/
+                                /*  In leaf rcu_node, each bit corresponds to */
+                                /*  an rcu_data structure, otherwise, each */
+                                /*  bit corresponds to a child rcu_node */
+                                /*  structure. */
         unsigned long qsmaskinit;
                                 /* Per-GP initialization for qsmask. */
         unsigned long grpmask;  /* Mask to apply to parent qsmask. */
+                                /*  Only one bit will be set in this mask. */
         int     grplo;          /* lowest-numbered CPU or group here. */
         int     grphi;          /* highest-numbered CPU or group here. */
         u8      grpnum;         /* CPU/group number for next level up. */
@@ -95,8 +101,23 @@ struct rcu_node {
         struct rcu_node *parent;
         struct list_head blocked_tasks[2];
                                 /* Tasks blocked in RCU read-side critsect. */
+                                /*  Grace period number (->gpnum) x blocked */
+                                /*  by tasks on the (x & 0x1) element of the */
+                                /*  blocked_tasks[] array. */
 } ____cacheline_internodealigned_in_smp;
 
+/*
+ * Do a full breadth-first scan of the rcu_node structures for the
+ * specified rcu_state structure.
+ */
+#define rcu_for_each_node_breadth_first(rsp, rnp) \
+        for ((rnp) = &(rsp)->node[0]; \
+             (rnp) < &(rsp)->node[NUM_RCU_NODES]; (rnp)++)
+
+#define rcu_for_each_leaf_node(rsp, rnp) \
+        for ((rnp) = (rsp)->level[NUM_RCU_LVLS - 1]; \
+             (rnp) < &(rsp)->node[NUM_RCU_NODES]; (rnp)++)
+
 /* Index values for nxttail array in struct rcu_data. */
 #define RCU_DONE_TAIL           0       /* Also RCU_WAIT head. */
 #define RCU_WAIT_TAIL           1       /* Also RCU_NEXT_READY head. */
@@ -126,19 +147,22 @@ struct rcu_data {
          * Any of the partitions might be empty, in which case the
          * pointer to that partition will be equal to the pointer for
          * the following partition.  When the list is empty, all of
-         * the nxttail elements point to nxtlist, which is NULL.
+         * the nxttail elements point to the ->nxtlist pointer itself,
+         * which in that case is NULL.
          *
-         * [*nxttail[RCU_NEXT_READY_TAIL], NULL = *nxttail[RCU_NEXT_TAIL]):
-         *      Entries that might have arrived after current GP ended
-         * [*nxttail[RCU_WAIT_TAIL], *nxttail[RCU_NEXT_READY_TAIL]):
-         *      Entries known to have arrived before current GP ended
-         * [*nxttail[RCU_DONE_TAIL], *nxttail[RCU_WAIT_TAIL]):
-         *      Entries that batch # <= ->completed - 1: waiting for current GP
          * [nxtlist, *nxttail[RCU_DONE_TAIL]):
          *      Entries that batch # <= ->completed
          *      The grace period for these entries has completed, and
          *      the other grace-period-completed entries may be moved
          *      here temporarily in rcu_process_callbacks().
+         * [*nxttail[RCU_DONE_TAIL], *nxttail[RCU_WAIT_TAIL]):
+         *      Entries that batch # <= ->completed - 1: waiting for current GP
+         * [*nxttail[RCU_WAIT_TAIL], *nxttail[RCU_NEXT_READY_TAIL]):
+         *      Entries known to have arrived before current GP ended
+         * [*nxttail[RCU_NEXT_READY_TAIL], *nxttail[RCU_NEXT_TAIL]):
+         *      Entries that might have arrived after current GP ended
+         *      Note that the value of *nxttail[RCU_NEXT_TAIL] will
+         *      always be NULL, as this is the end of the list.
          */
         struct rcu_head *nxtlist;
         struct rcu_head **nxttail[RCU_NEXT_SIZE];
@@ -216,8 +240,19 @@ struct rcu_state {
                                                 /* Force QS state. */
         long    gpnum;                          /* Current gp number. */
         long    completed;                      /* # of last completed gp. */
+
+        /* End  of fields guarded by root rcu_node's lock. */
+
         spinlock_t onofflock;                   /* exclude on/offline and */
-                                                /*  starting new GP. */
+                                                /*  starting new GP.  Also */
+                                                /*  protects the following */
+                                                /*  orphan_cbs fields. */
+        struct rcu_head *orphan_cbs_list;       /* list of rcu_head structs */
+                                                /*  orphaned by all CPUs in */
+                                                /*  a given leaf rcu_node */
+                                                /*  going offline. */
+        struct rcu_head **orphan_cbs_tail;      /* And tail pointer. */
+        long orphan_qlen;                       /* Number of orphaned cbs. */
         spinlock_t fqslock;                     /* Only one task forcing */
                                                 /*  quiescent states. */
         unsigned long jiffies_force_qs;         /* Time at which to invoke */
@@ -255,5 +290,30 @@ extern struct rcu_state rcu_preempt_state;
 DECLARE_PER_CPU(struct rcu_data, rcu_preempt_data);
 #endif /* #ifdef CONFIG_TREE_PREEMPT_RCU */
 
-#endif /* #ifdef RCU_TREE_NONCORE */
+#else /* #ifdef RCU_TREE_NONCORE */
+
+/* Forward declarations for rcutree_plugin.h */
+static inline void rcu_bootup_announce(void);
+long rcu_batches_completed(void);
+static void rcu_preempt_note_context_switch(int cpu);
+static int rcu_preempted_readers(struct rcu_node *rnp);
+#ifdef CONFIG_RCU_CPU_STALL_DETECTOR
+static void rcu_print_task_stall(struct rcu_node *rnp);
+#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
+#ifdef CONFIG_HOTPLUG_CPU
+static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
+                                      struct rcu_node *rnp,
+                                      struct rcu_data *rdp);
+static void rcu_preempt_offline_cpu(int cpu);
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_preempt_check_callbacks(int cpu);
+static void rcu_preempt_process_callbacks(void);
+void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu));
+static int rcu_preempt_pending(int cpu);
+static int rcu_preempt_needs_cpu(int cpu);
+static void __cpuinit rcu_preempt_init_percpu_data(int cpu);
+static void rcu_preempt_send_cbs_to_orphanage(void);
+static void __init __rcu_init_preempt(void);
 
+#endif /* #else #ifdef RCU_TREE_NONCORE */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 1cee04f627eb..c0cb783aa16a 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -150,6 +150,16 @@ void __rcu_read_lock(void)
 }
 EXPORT_SYMBOL_GPL(__rcu_read_lock);
 
+/*
+ * Check for preempted RCU readers blocking the current grace period
+ * for the specified rcu_node structure.  If the caller needs a reliable
+ * answer, it must hold the rcu_node's ->lock.
+ */
+static int rcu_preempted_readers(struct rcu_node *rnp)
+{
+        return !list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
+}
+
 static void rcu_read_unlock_special(struct task_struct *t)
 {
         int empty;
@@ -196,7 +206,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
                                 break;
                         spin_unlock(&rnp->lock);  /* irqs remain disabled. */
                 }
-                empty = list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
+                empty = !rcu_preempted_readers(rnp);
                 list_del_init(&t->rcu_node_entry);
                 t->rcu_blocked_node = NULL;
 
@@ -207,7 +217,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
                  * drop rnp->lock and restore irq.
                  */
                 if (!empty && rnp->qsmask == 0 &&
-                    list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1])) {
+                    !rcu_preempted_readers(rnp)) {
                         struct rcu_node *rnp_p;
 
                         if (rnp->parent == NULL) {
@@ -257,12 +267,12 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
 {
         unsigned long flags;
         struct list_head *lp;
-        int phase = rnp->gpnum & 0x1;
+        int phase;
         struct task_struct *t;
 
-        if (!list_empty(&rnp->blocked_tasks[phase])) {
+        if (rcu_preempted_readers(rnp)) {
                 spin_lock_irqsave(&rnp->lock, flags);
-                phase = rnp->gpnum & 0x1; /* re-read under lock. */
+                phase = rnp->gpnum & 0x1;
                 lp = &rnp->blocked_tasks[phase];
                 list_for_each_entry(t, lp, rcu_node_entry)
                         printk(" P%d", t->pid);
@@ -281,20 +291,10 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
  */
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
 {
-        WARN_ON_ONCE(!list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]));
+        WARN_ON_ONCE(rcu_preempted_readers(rnp));
         WARN_ON_ONCE(rnp->qsmask);
 }
 
-/*
- * Check for preempted RCU readers for the specified rcu_node structure.
- * If the caller needs a reliable answer, it must hold the rcu_node's
- * >lock.
- */
-static int rcu_preempted_readers(struct rcu_node *rnp)
-{
-        return !list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
-}
-
 #ifdef CONFIG_HOTPLUG_CPU
 
 /*
@@ -410,6 +410,15 @@ static int rcu_preempt_needs_cpu(int cpu)
         return !!per_cpu(rcu_preempt_data, cpu).nxtlist;
 }
 
+/**
+ * rcu_barrier - Wait until all in-flight call_rcu() callbacks complete.
+ */
+void rcu_barrier(void)
+{
+        _rcu_barrier(&rcu_preempt_state, call_rcu);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
+
 /*
  * Initialize preemptable RCU's per-CPU data.
  */
@@ -419,6 +428,22 @@ static void __cpuinit rcu_preempt_init_percpu_data(int cpu)
 }
 
 /*
+ * Move preemptable RCU's callbacks to ->orphan_cbs_list.
+ */
+static void rcu_preempt_send_cbs_to_orphanage(void)
+{
+        rcu_send_cbs_to_orphanage(&rcu_preempt_state);
+}
+
+/*
+ * Initialize preemptable RCU's state structures.
+ */
+static void __init __rcu_init_preempt(void)
+{
+        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
+}
+
+/*
  * Check for a task exiting while in a preemptable-RCU read-side
  * critical section, clean up if so.  No need to issue warnings,
  * as debug_check_no_locks_held() already does this if lockdep
@@ -461,6 +486,15 @@ static void rcu_preempt_note_context_switch(int cpu)
 {
 }
 
+/*
+ * Because preemptable RCU does not exist, there are never any preempted
+ * RCU readers.
+ */
+static int rcu_preempted_readers(struct rcu_node *rnp)
+{
+        return 0;
+}
+
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
 
 /*
@@ -483,15 +517,6 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
         WARN_ON_ONCE(rnp->qsmask);
 }
 
-/*
- * Because preemptable RCU does not exist, there are never any preempted
- * RCU readers.
- */
-static int rcu_preempted_readers(struct rcu_node *rnp)
-{
-        return 0;
-}
-
 #ifdef CONFIG_HOTPLUG_CPU
 
 /*
@@ -518,7 +543,7 @@ static void rcu_preempt_offline_cpu(int cpu)
  * Because preemptable RCU does not exist, it never has any callbacks
  * to check.
  */
-void rcu_preempt_check_callbacks(int cpu)
+static void rcu_preempt_check_callbacks(int cpu)
 {
 }
 
@@ -526,7 +551,7 @@ void rcu_preempt_check_callbacks(int cpu)
  * Because preemptable RCU does not exist, it never has any callbacks
  * to process.
  */
-void rcu_preempt_process_callbacks(void)
+static void rcu_preempt_process_callbacks(void)
 {
 }
 
@@ -556,6 +581,16 @@ static int rcu_preempt_needs_cpu(int cpu)
 }
 
 /*
+ * Because preemptable RCU does not exist, rcu_barrier() is just
+ * another name for rcu_barrier_sched().
+ */
+void rcu_barrier(void)
+{
+        rcu_barrier_sched();
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
+
+/*
  * Because preemptable RCU does not exist, there is no per-CPU
  * data to initialize.
  */
@@ -563,4 +598,18 @@ static void __cpuinit rcu_preempt_init_percpu_data(int cpu)
 {
 }
 
+/*
+ * Because there is no preemptable RCU, there are no callbacks to move.
+ */
+static void rcu_preempt_send_cbs_to_orphanage(void)
+{
+}
+
+/*
+ * Because preemptable RCU does not exist, it need not be initialized.
+ */
+static void __init __rcu_init_preempt(void)
+{
+}
+
 #endif /* #else #ifdef CONFIG_TREE_PREEMPT_RCU */
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index 179e6ad80dc0..4b31c779e62e 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -159,13 +159,13 @@ static void print_one_rcu_state(struct seq_file *m, struct rcu_state *rsp)
         struct rcu_node *rnp;
 
         seq_printf(m, "c=%ld g=%ld s=%d jfq=%ld j=%x "
-                      "nfqs=%lu/nfqsng=%lu(%lu) fqlh=%lu\n",
+                      "nfqs=%lu/nfqsng=%lu(%lu) fqlh=%lu oqlen=%ld\n",
                    rsp->completed, rsp->gpnum, rsp->signaled,
                    (long)(rsp->jiffies_force_qs - jiffies),
                    (int)(jiffies & 0xffff),
                    rsp->n_force_qs, rsp->n_force_qs_ngp,
                    rsp->n_force_qs - rsp->n_force_qs_ngp,
-                   rsp->n_force_qs_lh);
+                   rsp->n_force_qs_lh, rsp->orphan_qlen);
         for (rnp = &rsp->node[0]; rnp - &rsp->node[0] < NUM_RCU_NODES; rnp++) {
                 if (rnp->level != level) {
                         seq_puts(m, "\n");
diff --git a/kernel/sched.c b/kernel/sched.c
index 1535f3884b88..e88689522e66 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -676,6 +676,7 @@ inline void update_rq_clock(struct rq *rq)
 
 /**
  * runqueue_is_locked
+ * @cpu: the processor in question.
  *
  * Returns true if the current cpu runqueue is locked.
  * This interface allows printk to be called with the runqueue lock
@@ -2311,7 +2312,7 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
 {
         int cpu, orig_cpu, this_cpu, success = 0;
         unsigned long flags;
-        struct rq *rq;
+        struct rq *rq, *orig_rq;
 
         if (!sched_feat(SYNC_WAKEUPS))
                 wake_flags &= ~WF_SYNC;
@@ -2319,7 +2320,7 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
         this_cpu = get_cpu();
 
         smp_wmb();
-        rq = task_rq_lock(p, &flags);
+        rq = orig_rq = task_rq_lock(p, &flags);
         update_rq_clock(rq);
         if (!(p->state & state))
                 goto out;
@@ -2350,6 +2351,10 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
                 set_task_cpu(p, cpu);
 
         rq = task_rq_lock(p, &flags);
+
+        if (rq != orig_rq)
+                update_rq_clock(rq);
+
         WARN_ON(p->state != TASK_WAKING);
         cpu = task_cpu(p);
 
@@ -2515,22 +2520,17 @@ void sched_fork(struct task_struct *p, int clone_flags)
         __sched_fork(p);
 
         /*
-         * Make sure we do not leak PI boosting priority to the child.
-         */
-        p->prio = current->normal_prio;
-
-        /*
          * Revert to default priority/policy on fork if requested.
          */
         if (unlikely(p->sched_reset_on_fork)) {
-                if (p->policy == SCHED_FIFO || p->policy == SCHED_RR)
+                if (p->policy == SCHED_FIFO || p->policy == SCHED_RR) {
                         p->policy = SCHED_NORMAL;
-
-                if (p->normal_prio < DEFAULT_PRIO)
-                        p->prio = DEFAULT_PRIO;
+                        p->normal_prio = p->static_prio;
+                }
 
                 if (PRIO_TO_NICE(p->static_prio) < 0) {
                         p->static_prio = NICE_TO_PRIO(0);
+                        p->normal_prio = p->static_prio;
                         set_load_weight(p);
                 }
 
@@ -2541,6 +2541,11 @@ void sched_fork(struct task_struct *p, int clone_flags)
                 p->sched_reset_on_fork = 0;
         }
 
+        /*
+         * Make sure we do not leak PI boosting priority to the child.
+         */
+        p->prio = current->normal_prio;
+
         if (!rt_prio(p->prio))
                 p->sched_class = &fair_sched_class;
 
@@ -2581,8 +2586,6 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags)
         BUG_ON(p->state != TASK_RUNNING);
         update_rq_clock(rq);
 
-        p->prio = effective_prio(p);
-
         if (!p->sched_class->task_new || !current->se.on_rq) {
                 activate_task(rq, p, 0);
         } else {
@@ -3658,6 +3661,7 @@ static void update_group_power(struct sched_domain *sd, int cpu)
 
 /**
  * update_sg_lb_stats - Update sched_group's statistics for load balancing.
+ * @sd: The sched_domain whose statistics are to be updated.
  * @group: sched_group whose statistics are to be updated.
  * @this_cpu: Cpu for which load balance is currently performed.
  * @idle: Idle status of this_cpu
@@ -6720,9 +6724,6 @@ EXPORT_SYMBOL(yield);
 /*
  * This task is about to go to sleep on IO. Increment rq->nr_iowait so
  * that process accounting knows that this is a task in IO wait state.
- *
- * But don't do that if it is a deliberate, throttling IO wait (this task
- * has set its backing_dev_info: the queue against which it should throttle)
  */
 void __sched io_schedule(void)
 {
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index e0f59a21c061..89aed5933ed4 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -231,6 +231,13 @@ void tick_nohz_stop_sched_tick(int inidle)
         if (!inidle && !ts->inidle)
                 goto end;
 
+        /*
+         * Set ts->inidle unconditionally. Even if the system did not
+         * switch to NOHZ mode the cpu frequency governers rely on the
+         * update of the idle time accounting in tick_nohz_start_idle().
+         */
+        ts->inidle = 1;
+
         now = tick_nohz_start_idle(ts);
 
         /*
@@ -248,8 +255,6 @@ void tick_nohz_stop_sched_tick(int inidle)
         if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
                 goto end;
 
-        ts->inidle = 1;
-
         if (need_resched())
                 goto end;
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index fb0f46fa1ecd..c3a4e2907eaa 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -13,6 +13,7 @@
 #include <linux/percpu.h>
 #include <linux/init.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <linux/sysdev.h>
 #include <linux/clocksource.h>
 #include <linux/jiffies.h>
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 3eb159c277c8..d9d6206e0b14 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -856,6 +856,37 @@ static void blk_add_trace_remap(struct request_queue *q, struct bio *bio,
 }
 
 /**
+ * blk_add_trace_rq_remap - Add a trace for a request-remap operation
+ * @q:          queue the io is for
+ * @rq:         the source request
+ * @dev:        target device
+ * @from:       source sector
+ *
+ * Description:
+ *     Device mapper remaps request to other devices.
+ *     Add a trace for that action.
+ *
+ **/
+static void blk_add_trace_rq_remap(struct request_queue *q,
+                                   struct request *rq, dev_t dev,
+                                   sector_t from)
+{
+        struct blk_trace *bt = q->blk_trace;
+        struct blk_io_trace_remap r;
+
+        if (likely(!bt))
+                return;
+
+        r.device_from = cpu_to_be32(dev);
+        r.device_to   = cpu_to_be32(disk_devt(rq->rq_disk));
+        r.sector_from = cpu_to_be64(from);
+
+        __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
+                        rq_data_dir(rq), BLK_TA_REMAP, !!rq->errors,
+                        sizeof(r), &r);
+}
+
+/**
  * blk_add_driver_data - Add binary message with driver-specific data
  * @q:          queue the io is for
  * @rq:         io request
@@ -922,10 +953,13 @@ static void blk_register_tracepoints(void)
         WARN_ON(ret);
         ret = register_trace_block_remap(blk_add_trace_remap);
         WARN_ON(ret);
+        ret = register_trace_block_rq_remap(blk_add_trace_rq_remap);
+        WARN_ON(ret);
 }
 
 static void blk_unregister_tracepoints(void)
 {
+        unregister_trace_block_rq_remap(blk_add_trace_rq_remap);
         unregister_trace_block_remap(blk_add_trace_remap);
         unregister_trace_block_split(blk_add_trace_split);
         unregister_trace_block_unplug_io(blk_add_trace_unplug_io);
@@ -1657,6 +1691,11 @@ int blk_trace_init_sysfs(struct device *dev)
         return sysfs_create_group(&dev->kobj, &blk_trace_attr_group);
 }
 
+void blk_trace_remove_sysfs(struct device *dev)
+{
+        sysfs_remove_group(&dev->kobj, &blk_trace_attr_group);
+}
+
 #endif /* CONFIG_BLK_DEV_IO_TRACE */
 
 #ifdef CONFIG_EVENT_TRACING
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index b10c0d90a6ff..1ed514fe3a30 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -751,7 +751,7 @@ ftrace_profile_write(struct file *filp, const char __user *ubuf,
  out:
         mutex_unlock(&ftrace_profile_lock);
 
-        filp->f_pos += cnt;
+        *ppos += cnt;
 
         return cnt;
 }
diff --git a/kernel/trace/kmemtrace.c b/kernel/trace/kmemtrace.c
index 81b1645c8549..a91da69f153a 100644
--- a/kernel/trace/kmemtrace.c
+++ b/kernel/trace/kmemtrace.c
@@ -501,7 +501,7 @@ static int __init init_kmem_tracer(void)
                 return 1;
         }
 
-        if (!register_tracer(&kmem_tracer)) {
+        if (register_tracer(&kmem_tracer) != 0) {
                 pr_warning("Warning: could not register the kmem tracer\n");
                 return 1;
         }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index d4ff01970547..3ffa502fb243 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -483,7 +483,7 @@ struct ring_buffer_iter {
 /* Up this if you want to test the TIME_EXTENTS and normalization */
 #define DEBUG_SHIFT 0
 
-static inline u64 rb_time_stamp(struct ring_buffer *buffer, int cpu)
+static inline u64 rb_time_stamp(struct ring_buffer *buffer)
 {
         /* shift to debug/test normalization and TIME_EXTENTS */
         return buffer->clock() << DEBUG_SHIFT;
@@ -494,7 +494,7 @@ u64 ring_buffer_time_stamp(struct ring_buffer *buffer, int cpu)
         u64 time;
 
         preempt_disable_notrace();
-        time = rb_time_stamp(buffer, cpu);
+        time = rb_time_stamp(buffer);
         preempt_enable_no_resched_notrace();
 
         return time;
@@ -599,7 +599,7 @@ static struct list_head *rb_list_head(struct list_head *list)
 }
 
 /*
- * rb_is_head_page - test if the give page is the head page
+ * rb_is_head_page - test if the given page is the head page
  *
  * Because the reader may move the head_page pointer, we can
  * not trust what the head page is (it may be pointing to
@@ -1868,7 +1868,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
                  * Nested commits always have zero deltas, so
                  * just reread the time stamp
                  */
-                *ts = rb_time_stamp(buffer, cpu_buffer->cpu);
+                *ts = rb_time_stamp(buffer);
                 next_page->page->time_stamp = *ts;
         }
 
@@ -2111,7 +2111,7 @@ rb_reserve_next_event(struct ring_buffer *buffer,
         if (RB_WARN_ON(cpu_buffer, ++nr_loops > 1000))
                 goto out_fail;
 
-        ts = rb_time_stamp(cpu_buffer->buffer, cpu_buffer->cpu);
+        ts = rb_time_stamp(cpu_buffer->buffer);
 
         /*
          * Only the first commit can update the timestamp.
@@ -2681,7 +2681,7 @@ unsigned long ring_buffer_entries(struct ring_buffer *buffer)
 EXPORT_SYMBOL_GPL(ring_buffer_entries);
 
 /**
- * ring_buffer_overrun_cpu - get the number of overruns in buffer
+ * ring_buffer_overruns - get the number of overruns in buffer
  * @buffer: The ring buffer
  *
  * Returns the total number of overruns in the ring buffer
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 026e715a0c7a..9d3067a62d43 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2440,7 +2440,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
                         return ret;
         }
 
-        filp->f_pos += cnt;
+        *ppos += cnt;
 
         return cnt;
 }
@@ -2582,7 +2582,7 @@ tracing_ctrl_write(struct file *filp, const char __user *ubuf,
         }
         mutex_unlock(&trace_types_lock);
 
-        filp->f_pos += cnt;
+        *ppos += cnt;
 
         return cnt;
 }
@@ -2764,7 +2764,7 @@ tracing_set_trace_write(struct file *filp, const char __user *ubuf,
         if (err)
                 return err;
 
-        filp->f_pos += ret;
+        *ppos += ret;
 
         return ret;
 }
@@ -3299,7 +3299,7 @@ tracing_entries_write(struct file *filp, const char __user *ubuf,
                 }
         }
 
-        filp->f_pos += cnt;
+        *ppos += cnt;
 
         /* If check pages failed, return ENOMEM */
         if (tracing_disabled)
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index ed17565826b0..b6c12c6a1bcd 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -69,6 +69,9 @@ enum print_line_t trace_print_printk_msg_only(struct trace_iterator *iter)
  * @s: trace sequence descriptor
  * @fmt: printf format string
  *
+ * It returns 0 if the trace oversizes the buffer's free
+ * space, 1 otherwise.
+ *
  * The tracer may use either sequence operations or its own
  * copy to user routines. To simplify formating of a trace
  * trace_seq_printf is used to store strings into a special
@@ -95,7 +98,7 @@ trace_seq_printf(struct trace_seq *s, const char *fmt, ...)
 
         s->len += ret;
 
-        return len;
+        return 1;
 }
 EXPORT_SYMBOL_GPL(trace_seq_printf);
 
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 8bda4bff2286..ddee9c593732 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -229,7 +229,7 @@ int syscall_exit_format(struct ftrace_event_call *call, struct trace_seq *s)
                                "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n"
                                "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n",
                                SYSCALL_FIELD(int, nr),
-                               SYSCALL_FIELD(unsigned long, ret));
+                               SYSCALL_FIELD(long, ret));
         if (!ret)
                 return 0;
 
@@ -275,7 +275,7 @@ int syscall_exit_define_fields(struct ftrace_event_call *call)
         if (ret)
                 return ret;
 
-        ret = trace_define_field(call, SYSCALL_FIELD(unsigned long, ret), 0,
+        ret = trace_define_field(call, SYSCALL_FIELD(long, ret), 0,
                                  FILTER_OTHER);
 
         return ret;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index addfe2df93b1..47cdd7e76f2b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -640,6 +640,24 @@ int schedule_delayed_work(struct delayed_work *dwork,
 EXPORT_SYMBOL(schedule_delayed_work);
 
 /**
+ * flush_delayed_work - block until a dwork_struct's callback has terminated
+ * @dwork: the delayed work which is to be flushed
+ *
+ * Any timeout is cancelled, and any pending work is run immediately.
+ */
+void flush_delayed_work(struct delayed_work *dwork)
+{
+        if (del_timer_sync(&dwork->timer)) {
+                struct cpu_workqueue_struct *cwq;
+                cwq = wq_per_cpu(keventd_wq, get_cpu());
+                __queue_work(cwq, &dwork->work);
+                put_cpu();
+        }
+        flush_work(&dwork->work);
+}
+EXPORT_SYMBOL(flush_delayed_work);
+
+/**
  * schedule_delayed_work_on - queue work in global workqueue on CPU after delay
  * @cpu: cpu to use
  * @dwork: job to be done