Merge v2.6.37-rc8 into powerpc/next

131 files changed, 9005 insertions, 4928 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index c53e491e25a8..0b5ff083fa22 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -10,8 +10,7 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o pm_qos_params.o sched_clock.o cred.o \
-            async.o range.o
-obj-$(CONFIG_HAVE_EARLY_RES) += early_res.o
+            async.o range.o jump_label.o
 obj-y += groups.o
 
 ifdef CONFIG_FUNCTION_TRACER
@@ -23,6 +22,7 @@ CFLAGS_REMOVE_rtmutex-debug.o = -pg
 CFLAGS_REMOVE_cgroup-debug.o = -pg
 CFLAGS_REMOVE_sched_clock.o = -pg
 CFLAGS_REMOVE_perf_event.o = -pg
+CFLAGS_REMOVE_irq_work.o = -pg
 endif
 
 obj-$(CONFIG_FREEZER) += freezer.o
@@ -70,10 +70,11 @@ obj-$(CONFIG_IKCONFIG) += configs.o
 obj-$(CONFIG_RESOURCE_COUNTERS) += res_counter.o
 obj-$(CONFIG_SMP) += stop_machine.o
 obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
-obj-$(CONFIG_AUDIT) += audit.o auditfilter.o audit_watch.o
+obj-$(CONFIG_AUDIT) += audit.o auditfilter.o
 obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
-obj-$(CONFIG_GCOV_KERNEL) += gcov/
+obj-$(CONFIG_AUDIT_WATCH) += audit_watch.o
 obj-$(CONFIG_AUDIT_TREE) += audit_tree.o
+obj-$(CONFIG_GCOV_KERNEL) += gcov/
 obj-$(CONFIG_KPROBES) += kprobes.o
 obj-$(CONFIG_KGDB) += debug/
 obj-$(CONFIG_DETECT_HUNG_TASK) += hung_task.o
@@ -85,6 +86,7 @@ obj-$(CONFIG_TREE_RCU) += rcutree.o
 obj-$(CONFIG_TREE_PREEMPT_RCU) += rcutree.o
 obj-$(CONFIG_TREE_RCU_TRACE) += rcutree_trace.o
 obj-$(CONFIG_TINY_RCU) += rcutiny.o
+obj-$(CONFIG_TINY_PREEMPT_RCU) += rcutiny.o
 obj-$(CONFIG_RELAY) += relay.o
 obj-$(CONFIG_SYSCTL) += utsname_sysctl.o
 obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
@@ -99,6 +101,7 @@ obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_X86_DS) += trace/
 obj-$(CONFIG_RING_BUFFER) += trace/
 obj-$(CONFIG_SMP) += sched_cpupri.o
+obj-$(CONFIG_IRQ_WORK) += irq_work.o
 obj-$(CONFIG_PERF_EVENTS) += perf_event.o
 obj-$(CONFIG_HAVE_HW_BREAKPOINT) += hw_breakpoint.o
 obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
diff --git a/kernel/acct.c b/kernel/acct.c
index 385b88461c29..fa7eb3de2ddc 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -122,7 +122,7 @@ static int check_free_space(struct bsd_acct_struct *acct, struct file *file)
         spin_unlock(&acct_lock);
 
         /* May block */
-        if (vfs_statfs(file->f_path.dentry, &sbuf))
+        if (vfs_statfs(&file->f_path, &sbuf))
                 return res;
         suspend = sbuf.f_blocks * SUSPEND;
         resume = sbuf.f_blocks * RESUME;
diff --git a/kernel/audit.c b/kernel/audit.c
index 8296aa516c5a..77770a034d59 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -56,7 +56,6 @@
 #include <net/netlink.h>
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
-#include <linux/inotify.h>
 #include <linux/freezer.h>
 #include <linux/tty.h>
 
@@ -468,23 +467,16 @@ static int audit_prepare_user_tty(pid_t pid, uid_t loginuid, u32 sessionid)
         struct task_struct *tsk;
         int err;
 
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
         tsk = find_task_by_vpid(pid);
-        err = -ESRCH;
-        if (!tsk)
-                goto out;
-        err = 0;
-
-        spin_lock_irq(&tsk->sighand->siglock);
-        if (!tsk->signal->audit_tty)
-                err = -EPERM;
-        spin_unlock_irq(&tsk->sighand->siglock);
-        if (err)
-                goto out;
-
-        tty_audit_push_task(tsk, loginuid, sessionid);
-out:
-        read_unlock(&tasklist_lock);
+        if (!tsk) {
+                rcu_read_unlock();
+                return -ESRCH;
+        }
+        get_task_struct(tsk);
+        rcu_read_unlock();
+        err = tty_audit_push_task(tsk, loginuid, sessionid);
+        put_task_struct(tsk);
         return err;
 }
 
@@ -507,7 +499,7 @@ int audit_send_list(void *_dest)
 }
 
 struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
-                                 int multi, void *payload, int size)
+                                 int multi, const void *payload, int size)
 {
         struct sk_buff  *skb;
         struct nlmsghdr *nlh;
@@ -556,8 +548,8 @@ static int audit_send_reply_thread(void *arg)
  * Allocates an skb, builds the netlink message, and sends it to the pid.
  * No failure notifications.
  */
-void audit_send_reply(int pid, int seq, int type, int done, int multi,
-                      void *payload, int size)
+static void audit_send_reply(int pid, int seq, int type, int done, int multi,
+                             const void *payload, int size)
 {
         struct sk_buff *skb;
         struct task_struct *tsk;
@@ -881,40 +873,40 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         case AUDIT_TTY_GET: {
                 struct audit_tty_status s;
                 struct task_struct *tsk;
+                unsigned long flags;
 
-                read_lock(&tasklist_lock);
+                rcu_read_lock();
                 tsk = find_task_by_vpid(pid);
-                if (!tsk)
-                        err = -ESRCH;
-                else {
-                        spin_lock_irq(&tsk->sighand->siglock);
+                if (tsk && lock_task_sighand(tsk, &flags)) {
                         s.enabled = tsk->signal->audit_tty != 0;
-                        spin_unlock_irq(&tsk->sighand->siglock);
-                }
-                read_unlock(&tasklist_lock);
-                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
-                                 &s, sizeof(s));
+                        unlock_task_sighand(tsk, &flags);
+                } else
+                        err = -ESRCH;
+                rcu_read_unlock();
+
+                if (!err)
+                        audit_send_reply(NETLINK_CB(skb).pid, seq,
+                                         AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                 break;
         }
         case AUDIT_TTY_SET: {
                 struct audit_tty_status *s;
                 struct task_struct *tsk;
+                unsigned long flags;
 
                 if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
                         return -EINVAL;
                 s = data;
                 if (s->enabled != 0 && s->enabled != 1)
                         return -EINVAL;
-                read_lock(&tasklist_lock);
+                rcu_read_lock();
                 tsk = find_task_by_vpid(pid);
-                if (!tsk)
-                        err = -ESRCH;
-                else {
-                        spin_lock_irq(&tsk->sighand->siglock);
+                if (tsk && lock_task_sighand(tsk, &flags)) {
                         tsk->signal->audit_tty = s->enabled != 0;
-                        spin_unlock_irq(&tsk->sighand->siglock);
-                }
-                read_unlock(&tasklist_lock);
+                        unlock_task_sighand(tsk, &flags);
+                } else
+                        err = -ESRCH;
+                rcu_read_unlock();
                 break;
         }
         default:
diff --git a/kernel/audit.h b/kernel/audit.h
index 208687be4f30..91e7071c4d2c 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -84,10 +84,7 @@ extern int audit_compare_dname_path(const char *dname, const char *path,
                                     int *dirlen);
 extern struct sk_buff *     audit_make_reply(int pid, int seq, int type,
                                              int done, int multi,
-                                             void *payload, int size);
-extern void                 audit_send_reply(int pid, int seq, int type,
-                                             int done, int multi,
-                                             void *payload, int size);
+                                             const void *payload, int size);
 extern void                 audit_panic(const char *message);
 
 struct audit_netlink_list {
@@ -103,21 +100,27 @@ extern struct mutex audit_filter_mutex;
 extern void audit_free_rule_rcu(struct rcu_head *);
 extern struct list_head audit_filter_list[];
 
+extern struct audit_entry *audit_dupe_rule(struct audit_krule *old);
+
 /* audit watch functions */
-extern unsigned long audit_watch_inode(struct audit_watch *watch);
-extern dev_t audit_watch_dev(struct audit_watch *watch);
+#ifdef CONFIG_AUDIT_WATCH
 extern void audit_put_watch(struct audit_watch *watch);
 extern void audit_get_watch(struct audit_watch *watch);
 extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op);
-extern int audit_add_watch(struct audit_krule *krule);
-extern void audit_remove_watch(struct audit_watch *watch);
-extern void audit_remove_watch_rule(struct audit_krule *krule, struct list_head *list);
-extern void audit_inotify_unregister(struct list_head *in_list);
+extern int audit_add_watch(struct audit_krule *krule, struct list_head **list);
+extern void audit_remove_watch_rule(struct audit_krule *krule);
 extern char *audit_watch_path(struct audit_watch *watch);
-extern struct list_head *audit_watch_rules(struct audit_watch *watch);
-
-extern struct audit_entry *audit_dupe_rule(struct audit_krule *old,
-                                           struct audit_watch *watch);
+extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev);
+#else
+#define audit_put_watch(w) {}
+#define audit_get_watch(w) {}
+#define audit_to_watch(k, p, l, o) (-EINVAL)
+#define audit_add_watch(k, l) (-EINVAL)
+#define audit_remove_watch_rule(k) BUG()
+#define audit_watch_path(w) ""
+#define audit_watch_compare(w, i, d) 0
+
+#endif /* CONFIG_AUDIT_WATCH */
 
 #ifdef CONFIG_AUDIT_TREE
 extern struct audit_chunk *audit_tree_lookup(const struct inode *);
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 46a57b57a335..37b2bea170c8 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -1,5 +1,5 @@
 #include "audit.h"
-#include <linux/inotify.h>
+#include <linux/fsnotify_backend.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/kthread.h>
@@ -22,7 +22,7 @@ struct audit_tree {
 
 struct audit_chunk {
         struct list_head hash;
-        struct inotify_watch watch;
+        struct fsnotify_mark mark;
         struct list_head trees;         /* with root here */
         int dead;
         int count;
@@ -59,7 +59,7 @@ static LIST_HEAD(prune_list);
  * tree is refcounted; one reference for "some rules on rules_list refer to
  * it", one for each chunk with pointer to it.
  *
- * chunk is refcounted by embedded inotify_watch + .refs (non-zero refcount
+ * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount
  * of watch contributes 1 to .refs).
  *
  * node.index allows to get from node.list to containing chunk.
@@ -68,7 +68,7 @@ static LIST_HEAD(prune_list);
  * that makes a difference.  Some.
  */
 
-static struct inotify_handle *rtree_ih;
+static struct fsnotify_group *audit_tree_group;
 
 static struct audit_tree *alloc_tree(const char *s)
 {
@@ -111,29 +111,6 @@ const char *audit_tree_path(struct audit_tree *tree)
         return tree->pathname;
 }
 
-static struct audit_chunk *alloc_chunk(int count)
-{
-        struct audit_chunk *chunk;
-        size_t size;
-        int i;
-
-        size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
-        chunk = kzalloc(size, GFP_KERNEL);
-        if (!chunk)
-                return NULL;
-
-        INIT_LIST_HEAD(&chunk->hash);
-        INIT_LIST_HEAD(&chunk->trees);
-        chunk->count = count;
-        atomic_long_set(&chunk->refs, 1);
-        for (i = 0; i < count; i++) {
-                INIT_LIST_HEAD(&chunk->owners[i].list);
-                chunk->owners[i].index = i;
-        }
-        inotify_init_watch(&chunk->watch);
-        return chunk;
-}
-
 static void free_chunk(struct audit_chunk *chunk)
 {
         int i;
@@ -157,6 +134,35 @@ static void __put_chunk(struct rcu_head *rcu)
         audit_put_chunk(chunk);
 }
 
+static void audit_tree_destroy_watch(struct fsnotify_mark *entry)
+{
+        struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
+        call_rcu(&chunk->head, __put_chunk);
+}
+
+static struct audit_chunk *alloc_chunk(int count)
+{
+        struct audit_chunk *chunk;
+        size_t size;
+        int i;
+
+        size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
+        chunk = kzalloc(size, GFP_KERNEL);
+        if (!chunk)
+                return NULL;
+
+        INIT_LIST_HEAD(&chunk->hash);
+        INIT_LIST_HEAD(&chunk->trees);
+        chunk->count = count;
+        atomic_long_set(&chunk->refs, 1);
+        for (i = 0; i < count; i++) {
+                INIT_LIST_HEAD(&chunk->owners[i].list);
+                chunk->owners[i].index = i;
+        }
+        fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
+        return chunk;
+}
+
 enum {HASH_SIZE = 128};
 static struct list_head chunk_hash_heads[HASH_SIZE];
 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
@@ -167,10 +173,15 @@ static inline struct list_head *chunk_hash(const struct inode *inode)
         return chunk_hash_heads + n % HASH_SIZE;
 }
 
-/* hash_lock is held by caller */
+/* hash_lock & entry->lock is held by caller */
 static void insert_hash(struct audit_chunk *chunk)
 {
-        struct list_head *list = chunk_hash(chunk->watch.inode);
+        struct fsnotify_mark *entry = &chunk->mark;
+        struct list_head *list;
+
+        if (!entry->i.inode)
+                return;
+        list = chunk_hash(entry->i.inode);
         list_add_rcu(&chunk->hash, list);
 }
 
@@ -181,7 +192,8 @@ struct audit_chunk *audit_tree_lookup(const struct inode *inode)
         struct audit_chunk *p;
 
         list_for_each_entry_rcu(p, list, hash) {
-                if (p->watch.inode == inode) {
+                /* mark.inode may have gone NULL, but who cares? */
+                if (p->mark.i.inode == inode) {
                         atomic_long_inc(&p->refs);
                         return p;
                 }
@@ -210,38 +222,24 @@ static struct audit_chunk *find_chunk(struct node *p)
 static void untag_chunk(struct node *p)
 {
         struct audit_chunk *chunk = find_chunk(p);
-        struct audit_chunk *new;
+        struct fsnotify_mark *entry = &chunk->mark;
+        struct audit_chunk *new = NULL;
         struct audit_tree *owner;
         int size = chunk->count - 1;
         int i, j;
 
-        if (!pin_inotify_watch(&chunk->watch)) {
-                /*
-                 * Filesystem is shutting down; all watches are getting
-                 * evicted, just take it off the node list for this
-                 * tree and let the eviction logics take care of the
-                 * rest.
-                 */
-                owner = p->owner;
-                if (owner->root == chunk) {
-                        list_del_init(&owner->same_root);
-                        owner->root = NULL;
-                }
-                list_del_init(&p->list);
-                p->owner = NULL;
-                put_tree(owner);
-                return;
-        }
+        fsnotify_get_mark(entry);
 
         spin_unlock(&hash_lock);
 
-        /*
-         * pin_inotify_watch() succeeded, so the watch won't go away
-         * from under us.
-         */
-        mutex_lock(&chunk->watch.inode->inotify_mutex);
-        if (chunk->dead) {
-                mutex_unlock(&chunk->watch.inode->inotify_mutex);
+        if (size)
+                new = alloc_chunk(size);
+
+        spin_lock(&entry->lock);
+        if (chunk->dead || !entry->i.inode) {
+                spin_unlock(&entry->lock);
+                if (new)
+                        free_chunk(new);
                 goto out;
         }
 
@@ -256,16 +254,17 @@ static void untag_chunk(struct node *p)
                 list_del_init(&p->list);
                 list_del_rcu(&chunk->hash);
                 spin_unlock(&hash_lock);
-                inotify_evict_watch(&chunk->watch);
-                mutex_unlock(&chunk->watch.inode->inotify_mutex);
-                put_inotify_watch(&chunk->watch);
+                spin_unlock(&entry->lock);
+                fsnotify_destroy_mark(entry);
+                fsnotify_put_mark(entry);
                 goto out;
         }
 
-        new = alloc_chunk(size);
         if (!new)
                 goto Fallback;
-        if (inotify_clone_watch(&chunk->watch, &new->watch) < 0) {
+
+        fsnotify_duplicate_mark(&new->mark, entry);
+        if (fsnotify_add_mark(&new->mark, new->mark.group, new->mark.i.inode, NULL, 1)) {
                 free_chunk(new);
                 goto Fallback;
         }
@@ -298,9 +297,9 @@ static void untag_chunk(struct node *p)
         list_for_each_entry(owner, &new->trees, same_root)
                 owner->root = new;
         spin_unlock(&hash_lock);
-        inotify_evict_watch(&chunk->watch);
-        mutex_unlock(&chunk->watch.inode->inotify_mutex);
-        put_inotify_watch(&chunk->watch);
+        spin_unlock(&entry->lock);
+        fsnotify_destroy_mark(entry);
+        fsnotify_put_mark(entry);
         goto out;
 
 Fallback:
@@ -314,31 +313,33 @@ Fallback:
         p->owner = NULL;
         put_tree(owner);
         spin_unlock(&hash_lock);
-        mutex_unlock(&chunk->watch.inode->inotify_mutex);
+        spin_unlock(&entry->lock);
 out:
-        unpin_inotify_watch(&chunk->watch);
+        fsnotify_put_mark(entry);
         spin_lock(&hash_lock);
 }
 
 static int create_chunk(struct inode *inode, struct audit_tree *tree)
 {
+        struct fsnotify_mark *entry;
         struct audit_chunk *chunk = alloc_chunk(1);
         if (!chunk)
                 return -ENOMEM;
 
-        if (inotify_add_watch(rtree_ih, &chunk->watch, inode, IN_IGNORED | IN_DELETE_SELF) < 0) {
+        entry = &chunk->mark;
+        if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) {
                 free_chunk(chunk);
                 return -ENOSPC;
         }
 
-        mutex_lock(&inode->inotify_mutex);
+        spin_lock(&entry->lock);
         spin_lock(&hash_lock);
         if (tree->goner) {
                 spin_unlock(&hash_lock);
                 chunk->dead = 1;
-                inotify_evict_watch(&chunk->watch);
-                mutex_unlock(&inode->inotify_mutex);
-                put_inotify_watch(&chunk->watch);
+                spin_unlock(&entry->lock);
+                fsnotify_destroy_mark(entry);
+                fsnotify_put_mark(entry);
                 return 0;
         }
         chunk->owners[0].index = (1U << 31);
@@ -351,30 +352,31 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
         }
         insert_hash(chunk);
         spin_unlock(&hash_lock);
-        mutex_unlock(&inode->inotify_mutex);
+        spin_unlock(&entry->lock);
         return 0;
 }
 
 /* the first tagged inode becomes root of tree */
 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
 {
-        struct inotify_watch *watch;
+        struct fsnotify_mark *old_entry, *chunk_entry;
         struct audit_tree *owner;
         struct audit_chunk *chunk, *old;
         struct node *p;
         int n;
 
-        if (inotify_find_watch(rtree_ih, inode, &watch) < 0)
+        old_entry = fsnotify_find_inode_mark(audit_tree_group, inode);
+        if (!old_entry)
                 return create_chunk(inode, tree);
 
-        old = container_of(watch, struct audit_chunk, watch);
+        old = container_of(old_entry, struct audit_chunk, mark);
 
         /* are we already there? */
         spin_lock(&hash_lock);
         for (n = 0; n < old->count; n++) {
                 if (old->owners[n].owner == tree) {
                         spin_unlock(&hash_lock);
-                        put_inotify_watch(&old->watch);
+                        fsnotify_put_mark(old_entry);
                         return 0;
                 }
         }
@@ -382,25 +384,44 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
 
         chunk = alloc_chunk(old->count + 1);
         if (!chunk) {
-                put_inotify_watch(&old->watch);
+                fsnotify_put_mark(old_entry);
                 return -ENOMEM;
         }
 
-        mutex_lock(&inode->inotify_mutex);
-        if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
-                mutex_unlock(&inode->inotify_mutex);
-                put_inotify_watch(&old->watch);
+        chunk_entry = &chunk->mark;
+
+        spin_lock(&old_entry->lock);
+        if (!old_entry->i.inode) {
+                /* old_entry is being shot, lets just lie */
+                spin_unlock(&old_entry->lock);
+                fsnotify_put_mark(old_entry);
                 free_chunk(chunk);
+                return -ENOENT;
+        }
+
+        fsnotify_duplicate_mark(chunk_entry, old_entry);
+        if (fsnotify_add_mark(chunk_entry, chunk_entry->group, chunk_entry->i.inode, NULL, 1)) {
+                spin_unlock(&old_entry->lock);
+                free_chunk(chunk);
+                fsnotify_put_mark(old_entry);
                 return -ENOSPC;
         }
+
+        /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */
+        spin_lock(&chunk_entry->lock);
         spin_lock(&hash_lock);
+
+        /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */
         if (tree->goner) {
                 spin_unlock(&hash_lock);
                 chunk->dead = 1;
-                inotify_evict_watch(&chunk->watch);
-                mutex_unlock(&inode->inotify_mutex);
-                put_inotify_watch(&old->watch);
-                put_inotify_watch(&chunk->watch);
+                spin_unlock(&chunk_entry->lock);
+                spin_unlock(&old_entry->lock);
+
+                fsnotify_destroy_mark(chunk_entry);
+
+                fsnotify_put_mark(chunk_entry);
+                fsnotify_put_mark(old_entry);
                 return 0;
         }
         list_replace_init(&old->trees, &chunk->trees);
@@ -426,10 +447,11 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
                 list_add(&tree->same_root, &chunk->trees);
         }
         spin_unlock(&hash_lock);
-        inotify_evict_watch(&old->watch);
-        mutex_unlock(&inode->inotify_mutex);
-        put_inotify_watch(&old->watch); /* pair to inotify_find_watch */
-        put_inotify_watch(&old->watch); /* and kill it */
+        spin_unlock(&chunk_entry->lock);
+        spin_unlock(&old_entry->lock);
+        fsnotify_destroy_mark(old_entry);
+        fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
+        fsnotify_put_mark(old_entry); /* and kill it */
         return 0;
 }
 
@@ -584,7 +606,9 @@ void audit_trim_trees(void)
 
                 spin_lock(&hash_lock);
                 list_for_each_entry(node, &tree->chunks, list) {
-                        struct inode *inode = find_chunk(node)->watch.inode;
+                        struct audit_chunk *chunk = find_chunk(node);
+                        /* this could be NULL if the watch is dieing else where... */
+                        struct inode *inode = chunk->mark.i.inode;
                         node->index |= 1U<<31;
                         if (iterate_mounts(compare_root, inode, root_mnt))
                                 node->index &= ~(1U<<31);
@@ -846,7 +870,6 @@ void audit_kill_trees(struct list_head *list)
  *  Here comes the stuff asynchronous to auditctl operations
  */
 
-/* inode->inotify_mutex is locked */
 static void evict_chunk(struct audit_chunk *chunk)
 {
         struct audit_tree *owner;
@@ -885,35 +908,46 @@ static void evict_chunk(struct audit_chunk *chunk)
         mutex_unlock(&audit_filter_mutex);
 }
 
-static void handle_event(struct inotify_watch *watch, u32 wd, u32 mask,
-                         u32 cookie, const char *dname, struct inode *inode)
+static int audit_tree_handle_event(struct fsnotify_group *group,
+                                   struct fsnotify_mark *inode_mark,
+                                   struct fsnotify_mark *vfsmonut_mark,
+                                   struct fsnotify_event *event)
+{
+        BUG();
+        return -EOPNOTSUPP;
+}
+
+static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify_group *group)
 {
-        struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
+        struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
 
-        if (mask & IN_IGNORED) {
-                evict_chunk(chunk);
-                put_inotify_watch(watch);
-        }
+        evict_chunk(chunk);
+        fsnotify_put_mark(entry);
 }
 
-static void destroy_watch(struct inotify_watch *watch)
+static bool audit_tree_send_event(struct fsnotify_group *group, struct inode *inode,
+                                  struct fsnotify_mark *inode_mark,
+                                  struct fsnotify_mark *vfsmount_mark,
+                                  __u32 mask, void *data, int data_type)
 {
-        struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
-        call_rcu(&chunk->head, __put_chunk);
+        return false;
 }
 
-static const struct inotify_operations rtree_inotify_ops = {
-        .handle_event   = handle_event,
-        .destroy_watch  = destroy_watch,
+static const struct fsnotify_ops audit_tree_ops = {
+        .handle_event = audit_tree_handle_event,
+        .should_send_event = audit_tree_send_event,
+        .free_group_priv = NULL,
+        .free_event_priv = NULL,
+        .freeing_mark = audit_tree_freeing_mark,
 };
 
 static int __init audit_tree_init(void)
 {
         int i;
 
-        rtree_ih = inotify_init(&rtree_inotify_ops);
-        if (IS_ERR(rtree_ih))
-                audit_panic("cannot initialize inotify handle for rectree watches");
+        audit_tree_group = fsnotify_alloc_group(&audit_tree_ops);
+        if (IS_ERR(audit_tree_group))
+                audit_panic("cannot initialize fsnotify group for rectree watches");
 
         for (i = 0; i < HASH_SIZE; i++)
                 INIT_LIST_HEAD(&chunk_hash_heads[i]);
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 8df43696f4ba..d2e3c7866460 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -24,18 +24,18 @@
 #include <linux/kthread.h>
 #include <linux/mutex.h>
 #include <linux/fs.h>
+#include <linux/fsnotify_backend.h>
 #include <linux/namei.h>
 #include <linux/netlink.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/inotify.h>
 #include <linux/security.h>
 #include "audit.h"
 
 /*
  * Reference counting:
  *
- * audit_parent: lifetime is from audit_init_parent() to receipt of an IN_IGNORED
+ * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
  *      event.  Each audit_watch holds a reference to its associated parent.
  *
  * audit_watch: if added to lists, lifetime is from audit_init_watch() to
@@ -51,40 +51,61 @@ struct audit_watch {
         unsigned long           ino;    /* associated inode number */
         struct audit_parent     *parent; /* associated parent */
         struct list_head        wlist;  /* entry in parent->watches list */
-        struct list_head        rules;  /* associated rules */
+        struct list_head        rules;  /* anchor for krule->rlist */
 };
 
 struct audit_parent {
-        struct list_head        ilist;  /* entry in inotify registration list */
-        struct list_head        watches; /* associated watches */
-        struct inotify_watch    wdata;  /* inotify watch data */
-        unsigned                flags;  /* status flags */
+        struct list_head        watches; /* anchor for audit_watch->wlist */
+        struct fsnotify_mark mark; /* fsnotify mark on the inode */
 };
 
-/* Inotify handle. */
-struct inotify_handle *audit_ih;
+/* fsnotify handle. */
+static struct fsnotify_group *audit_watch_group;
 
-/*
- * audit_parent status flags:
- *
- * AUDIT_PARENT_INVALID - set anytime rules/watches are auto-removed due to
- * a filesystem event to ensure we're adding audit watches to a valid parent.
- * Technically not needed for IN_DELETE_SELF or IN_UNMOUNT events, as we cannot
- * receive them while we have nameidata, but must be used for IN_MOVE_SELF which
- * we can receive while holding nameidata.
- */
-#define AUDIT_PARENT_INVALID    0x001
+/* fsnotify events we care about. */
+#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
+                        FS_MOVE_SELF | FS_EVENT_ON_CHILD)
 
-/* Inotify events we care about. */
-#define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
+static void audit_free_parent(struct audit_parent *parent)
+{
+        WARN_ON(!list_empty(&parent->watches));
+        kfree(parent);
+}
 
-static void audit_free_parent(struct inotify_watch *i_watch)
+static void audit_watch_free_mark(struct fsnotify_mark *entry)
 {
         struct audit_parent *parent;
 
-        parent = container_of(i_watch, struct audit_parent, wdata);
-        WARN_ON(!list_empty(&parent->watches));
-        kfree(parent);
+        parent = container_of(entry, struct audit_parent, mark);
+        audit_free_parent(parent);
+}
+
+static void audit_get_parent(struct audit_parent *parent)
+{
+        if (likely(parent))
+                fsnotify_get_mark(&parent->mark);
+}
+
+static void audit_put_parent(struct audit_parent *parent)
+{
+        if (likely(parent))
+                fsnotify_put_mark(&parent->mark);
+}
+
+/*
+ * Find and return the audit_parent on the given inode.  If found a reference
+ * is taken on this parent.
+ */
+static inline struct audit_parent *audit_find_parent(struct inode *inode)
+{
+        struct audit_parent *parent = NULL;
+        struct fsnotify_mark *entry;
+
+        entry = fsnotify_find_inode_mark(audit_watch_group, inode);
+        if (entry)
+                parent = container_of(entry, struct audit_parent, mark);
+
+        return parent;
 }
 
 void audit_get_watch(struct audit_watch *watch)
@@ -102,10 +123,10 @@ void audit_put_watch(struct audit_watch *watch)
         }
 }
 
-void audit_remove_watch(struct audit_watch *watch)
+static void audit_remove_watch(struct audit_watch *watch)
 {
         list_del(&watch->wlist);
-        put_inotify_watch(&watch->parent->wdata);
+        audit_put_parent(watch->parent);
         watch->parent = NULL;
         audit_put_watch(watch); /* match initial get */
 }
@@ -115,42 +136,32 @@ char *audit_watch_path(struct audit_watch *watch)
         return watch->path;
 }
 
-struct list_head *audit_watch_rules(struct audit_watch *watch)
-{
-        return &watch->rules;
-}
-
-unsigned long audit_watch_inode(struct audit_watch *watch)
+int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
 {
-        return watch->ino;
-}
-
-dev_t audit_watch_dev(struct audit_watch *watch)
-{
-        return watch->dev;
+        return (watch->ino != (unsigned long)-1) &&
+                (watch->ino == ino) &&
+                (watch->dev == dev);
 }
 
 /* Initialize a parent watch entry. */
 static struct audit_parent *audit_init_parent(struct nameidata *ndp)
 {
+        struct inode *inode = ndp->path.dentry->d_inode;
         struct audit_parent *parent;
-        s32 wd;
+        int ret;
 
         parent = kzalloc(sizeof(*parent), GFP_KERNEL);
         if (unlikely(!parent))
                 return ERR_PTR(-ENOMEM);
 
         INIT_LIST_HEAD(&parent->watches);
-        parent->flags = 0;
-
-        inotify_init_watch(&parent->wdata);
-        /* grab a ref so inotify watch hangs around until we take audit_filter_mutex */
-        get_inotify_watch(&parent->wdata);
-        wd = inotify_add_watch(audit_ih, &parent->wdata,
-                               ndp->path.dentry->d_inode, AUDIT_IN_WATCH);
-        if (wd < 0) {
-                audit_free_parent(&parent->wdata);
-                return ERR_PTR(wd);
+
+        fsnotify_init_mark(&parent->mark, audit_watch_free_mark);
+        parent->mark.mask = AUDIT_FS_WATCH;
+        ret = fsnotify_add_mark(&parent->mark, audit_watch_group, inode, NULL, 0);
+        if (ret < 0) {
+                audit_free_parent(parent);
+                return ERR_PTR(ret);
         }
 
         return parent;
@@ -179,7 +190,7 @@ int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
 {
         struct audit_watch *watch;
 
-        if (!audit_ih)
+        if (!audit_watch_group)
                 return -EOPNOTSUPP;
 
         if (path[0] != '/' || path[len-1] == '/' ||
@@ -217,7 +228,7 @@ static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
 
         new->dev = old->dev;
         new->ino = old->ino;
-        get_inotify_watch(&old->parent->wdata);
+        audit_get_parent(old->parent);
         new->parent = old->parent;
 
 out:
@@ -251,15 +262,19 @@ static void audit_update_watch(struct audit_parent *parent,
         struct audit_entry *oentry, *nentry;
 
         mutex_lock(&audit_filter_mutex);
+        /* Run all of the watches on this parent looking for the one that
+         * matches the given dname */
         list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
                 if (audit_compare_dname_path(dname, owatch->path, NULL))
                         continue;
 
                 /* If the update involves invalidating rules, do the inode-based
                  * filtering now, so we don't omit records. */
-                if (invalidating && current->audit_context)
+                if (invalidating && !audit_dummy_context())
                         audit_filter_inodes(current, current->audit_context);
 
+                /* updating ino will likely change which audit_hash_list we
+                 * are on so we need a new watch for the new list */
                 nwatch = audit_dupe_watch(owatch);
                 if (IS_ERR(nwatch)) {
                         mutex_unlock(&audit_filter_mutex);
@@ -275,12 +290,21 @@ static void audit_update_watch(struct audit_parent *parent,
                         list_del(&oentry->rule.rlist);
                         list_del_rcu(&oentry->list);
 
-                        nentry = audit_dupe_rule(&oentry->rule, nwatch);
+                        nentry = audit_dupe_rule(&oentry->rule);
                         if (IS_ERR(nentry)) {
                                 list_del(&oentry->rule.list);
                                 audit_panic("error updating watch, removing");
                         } else {
                                 int h = audit_hash_ino((u32)ino);
+
+                                /*
+                                 * nentry->rule.watch == oentry->rule.watch so
+                                 * we must drop that reference and set it to our
+                                 * new watch.
+                                 */
+                                audit_put_watch(nentry->rule.watch);
+                                audit_get_watch(nwatch);
+                                nentry->rule.watch = nwatch;
                                 list_add(&nentry->rule.rlist, &nwatch->rules);
                                 list_add_rcu(&nentry->list, &audit_inode_hash[h]);
                                 list_replace(&oentry->rule.list,
@@ -312,7 +336,6 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
         struct audit_entry *e;
 
         mutex_lock(&audit_filter_mutex);
-        parent->flags |= AUDIT_PARENT_INVALID;
         list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
                 list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
                         e = container_of(r, struct audit_entry, rule);
@@ -325,20 +348,8 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
                 audit_remove_watch(w);
         }
         mutex_unlock(&audit_filter_mutex);
-}
-
-/* Unregister inotify watches for parents on in_list.
- * Generates an IN_IGNORED event. */
-void audit_inotify_unregister(struct list_head *in_list)
-{
-        struct audit_parent *p, *n;
 
-        list_for_each_entry_safe(p, n, in_list, ilist) {
-                list_del(&p->ilist);
-                inotify_rm_watch(audit_ih, &p->wdata);
-                /* the unpin matching the pin in audit_do_del_rule() */
-                unpin_inotify_watch(&p->wdata);
-        }
+        fsnotify_destroy_mark(&parent->mark);
 }
 
 /* Get path information necessary for adding watches. */
@@ -389,7 +400,7 @@ static void audit_put_nd(struct nameidata *ndp, struct nameidata *ndw)
         }
 }
 
-/* Associate the given rule with an existing parent inotify_watch.
+/* Associate the given rule with an existing parent.
  * Caller must hold audit_filter_mutex. */
 static void audit_add_to_parent(struct audit_krule *krule,
                                 struct audit_parent *parent)
@@ -397,6 +408,8 @@ static void audit_add_to_parent(struct audit_krule *krule,
         struct audit_watch *w, *watch = krule->watch;
         int watch_found = 0;
 
+        BUG_ON(!mutex_is_locked(&audit_filter_mutex));
+
         list_for_each_entry(w, &parent->watches, wlist) {
                 if (strcmp(watch->path, w->path))
                         continue;
@@ -413,7 +426,7 @@ static void audit_add_to_parent(struct audit_krule *krule,
         }
 
         if (!watch_found) {
-                get_inotify_watch(&parent->wdata);
+                audit_get_parent(parent);
                 watch->parent = parent;
 
                 list_add(&watch->wlist, &parent->watches);
@@ -423,13 +436,12 @@ static void audit_add_to_parent(struct audit_krule *krule,
 
 /* Find a matching watch entry, or add this one.
  * Caller must hold audit_filter_mutex. */
-int audit_add_watch(struct audit_krule *krule)
+int audit_add_watch(struct audit_krule *krule, struct list_head **list)
 {
         struct audit_watch *watch = krule->watch;
-        struct inotify_watch *i_watch;
         struct audit_parent *parent;
         struct nameidata *ndp = NULL, *ndw = NULL;
-        int ret = 0;
+        int h, ret = 0;
 
         mutex_unlock(&audit_filter_mutex);
 
@@ -441,47 +453,38 @@ int audit_add_watch(struct audit_krule *krule)
                 goto error;
         }
 
+        mutex_lock(&audit_filter_mutex);
+
         /* update watch filter fields */
         if (ndw) {
                 watch->dev = ndw->path.dentry->d_inode->i_sb->s_dev;
                 watch->ino = ndw->path.dentry->d_inode->i_ino;
         }
 
-        /* The audit_filter_mutex must not be held during inotify calls because
-         * we hold it during inotify event callback processing.  If an existing
-         * inotify watch is found, inotify_find_watch() grabs a reference before
-         * returning.
-         */
-        if (inotify_find_watch(audit_ih, ndp->path.dentry->d_inode,
-                               &i_watch) < 0) {
+        /* either find an old parent or attach a new one */
+        parent = audit_find_parent(ndp->path.dentry->d_inode);
+        if (!parent) {
                 parent = audit_init_parent(ndp);
                 if (IS_ERR(parent)) {
-                        /* caller expects mutex locked */
-                        mutex_lock(&audit_filter_mutex);
                         ret = PTR_ERR(parent);
                         goto error;
                 }
-        } else
-                parent = container_of(i_watch, struct audit_parent, wdata);
-
-        mutex_lock(&audit_filter_mutex);
+        }
 
-        /* parent was moved before we took audit_filter_mutex */
-        if (parent->flags & AUDIT_PARENT_INVALID)
-                ret = -ENOENT;
-        else
-                audit_add_to_parent(krule, parent);
+        audit_add_to_parent(krule, parent);
 
-        /* match get in audit_init_parent or inotify_find_watch */
-        put_inotify_watch(&parent->wdata);
+        /* match get in audit_find_parent or audit_init_parent */
+        audit_put_parent(parent);
 
+        h = audit_hash_ino((u32)watch->ino);
+        *list = &audit_inode_hash[h];
 error:
         audit_put_nd(ndp, ndw);         /* NULL args OK */
         return ret;
 
 }
 
-void audit_remove_watch_rule(struct audit_krule *krule, struct list_head *list)
+void audit_remove_watch_rule(struct audit_krule *krule)
 {
         struct audit_watch *watch = krule->watch;
         struct audit_parent *parent = watch->parent;
@@ -492,53 +495,74 @@ void audit_remove_watch_rule(struct audit_krule *krule, struct list_head *list)
                 audit_remove_watch(watch);
 
                 if (list_empty(&parent->watches)) {
-                        /* Put parent on the inotify un-registration
-                         * list.  Grab a reference before releasing
-                         * audit_filter_mutex, to be released in
-                         * audit_inotify_unregister().
-                         * If filesystem is going away, just leave
-                         * the sucker alone, eviction will take
-                         * care of it. */
-                        if (pin_inotify_watch(&parent->wdata))
-                                list_add(&parent->ilist, list);
+                        audit_get_parent(parent);
+                        fsnotify_destroy_mark(&parent->mark);
+                        audit_put_parent(parent);
                 }
         }
 }
 
-/* Update watch data in audit rules based on inotify events. */
-static void audit_handle_ievent(struct inotify_watch *i_watch, u32 wd, u32 mask,
-                         u32 cookie, const char *dname, struct inode *inode)
+static bool audit_watch_should_send_event(struct fsnotify_group *group, struct inode *inode,
+                                          struct fsnotify_mark *inode_mark,
+                                          struct fsnotify_mark *vfsmount_mark,
+                                          __u32 mask, void *data, int data_type)
+{
+       return true;
+}
+
+/* Update watch data in audit rules based on fsnotify events. */
+static int audit_watch_handle_event(struct fsnotify_group *group,
+                                    struct fsnotify_mark *inode_mark,
+                                    struct fsnotify_mark *vfsmount_mark,
+                                    struct fsnotify_event *event)
 {
+        struct inode *inode;
+        __u32 mask = event->mask;
+        const char *dname = event->file_name;
         struct audit_parent *parent;
 
-        parent = container_of(i_watch, struct audit_parent, wdata);
+        parent = container_of(inode_mark, struct audit_parent, mark);
 
-        if (mask & (IN_CREATE|IN_MOVED_TO) && inode)
-                audit_update_watch(parent, dname, inode->i_sb->s_dev,
-                                   inode->i_ino, 0);
-        else if (mask & (IN_DELETE|IN_MOVED_FROM))
+        BUG_ON(group != audit_watch_group);
+
+        switch (event->data_type) {
+        case (FSNOTIFY_EVENT_PATH):
+                inode = event->path.dentry->d_inode;
+                break;
+        case (FSNOTIFY_EVENT_INODE):
+                inode = event->inode;
+                break;
+        default:
+                BUG();
+                inode = NULL;
+                break;
+        };
+
+        if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
+                audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
+        else if (mask & (FS_DELETE|FS_MOVED_FROM))
                 audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);
-        /* inotify automatically removes the watch and sends IN_IGNORED */
-        else if (mask & (IN_DELETE_SELF|IN_UNMOUNT))
-                audit_remove_parent_watches(parent);
-        /* inotify does not remove the watch, so remove it manually */
-        else if(mask & IN_MOVE_SELF) {
+        else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
                 audit_remove_parent_watches(parent);
-                inotify_remove_watch_locked(audit_ih, i_watch);
-        } else if (mask & IN_IGNORED)
-                put_inotify_watch(i_watch);
+
+        return 0;
 }
 
-static const struct inotify_operations audit_inotify_ops = {
-        .handle_event   = audit_handle_ievent,
-        .destroy_watch  = audit_free_parent,
+static const struct fsnotify_ops audit_watch_fsnotify_ops = {
+        .should_send_event =    audit_watch_should_send_event,
+        .handle_event =         audit_watch_handle_event,
+        .free_group_priv =      NULL,
+        .freeing_mark =         NULL,
+        .free_event_priv =      NULL,
 };
 
 static int __init audit_watch_init(void)
 {
-        audit_ih = inotify_init(&audit_inotify_ops);
-        if (IS_ERR(audit_ih))
-                audit_panic("cannot initialize inotify handle");
+        audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
+        if (IS_ERR(audit_watch_group)) {
+                audit_watch_group = NULL;
+                audit_panic("cannot create audit fsnotify group");
+        }
         return 0;
 }
-subsys_initcall(audit_watch_init);
+device_initcall(audit_watch_init);
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index ce08041f578d..add2819af71b 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -71,6 +71,7 @@ static inline void audit_free_rule(struct audit_entry *e)
 {
         int i;
         struct audit_krule *erule = &e->rule;
+
         /* some rules don't have associated watches */
         if (erule->watch)
                 audit_put_watch(erule->watch);
@@ -746,8 +747,7 @@ static inline int audit_dupe_lsm_field(struct audit_field *df,
  * rule with the new rule in the filterlist, then free the old rule.
  * The rlist element is undefined; list manipulations are handled apart from
  * the initial copy. */
-struct audit_entry *audit_dupe_rule(struct audit_krule *old,
-                                    struct audit_watch *watch)
+struct audit_entry *audit_dupe_rule(struct audit_krule *old)
 {
         u32 fcount = old->field_count;
         struct audit_entry *entry;
@@ -769,8 +769,8 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old,
         new->prio = old->prio;
         new->buflen = old->buflen;
         new->inode_f = old->inode_f;
-        new->watch = NULL;
         new->field_count = old->field_count;
+
         /*
          * note that we are OK with not refcounting here; audit_match_tree()
          * never dereferences tree and we can't get false positives there
@@ -811,9 +811,9 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old,
                 }
         }
 
-        if (watch) {
-                audit_get_watch(watch);
-                new->watch = watch;
+        if (old->watch) {
+                audit_get_watch(old->watch);
+                new->watch = old->watch;
         }
 
         return entry;
@@ -866,7 +866,7 @@ static inline int audit_add_rule(struct audit_entry *entry)
         struct audit_watch *watch = entry->rule.watch;
         struct audit_tree *tree = entry->rule.tree;
         struct list_head *list;
-        int h, err;
+        int err;
 #ifdef CONFIG_AUDITSYSCALL
         int dont_count = 0;
 
@@ -889,15 +889,11 @@ static inline int audit_add_rule(struct audit_entry *entry)
 
         if (watch) {
                 /* audit_filter_mutex is dropped and re-taken during this call */
-                err = audit_add_watch(&entry->rule);
+                err = audit_add_watch(&entry->rule, &list);
                 if (err) {
                         mutex_unlock(&audit_filter_mutex);
                         goto error;
                 }
-                /* entry->rule.watch may have changed during audit_add_watch() */
-                watch = entry->rule.watch;
-                h = audit_hash_ino((u32)audit_watch_inode(watch));
-                list = &audit_inode_hash[h];
         }
         if (tree) {
                 err = audit_add_tree_rule(&entry->rule);
@@ -949,7 +945,6 @@ static inline int audit_del_rule(struct audit_entry *entry)
         struct audit_watch *watch = entry->rule.watch;
         struct audit_tree *tree = entry->rule.tree;
         struct list_head *list;
-        LIST_HEAD(inotify_list);
         int ret = 0;
 #ifdef CONFIG_AUDITSYSCALL
         int dont_count = 0;
@@ -969,7 +964,7 @@ static inline int audit_del_rule(struct audit_entry *entry)
         }
 
         if (e->rule.watch)
-                audit_remove_watch_rule(&e->rule, &inotify_list);
+                audit_remove_watch_rule(&e->rule);
 
         if (e->rule.tree)
                 audit_remove_tree_rule(&e->rule);
@@ -987,9 +982,6 @@ static inline int audit_del_rule(struct audit_entry *entry)
 #endif
         mutex_unlock(&audit_filter_mutex);
 
-        if (!list_empty(&inotify_list))
-                audit_inotify_unregister(&inotify_list);
-
 out:
         if (watch)
                 audit_put_watch(watch); /* match initial get */
@@ -1260,6 +1252,18 @@ static int audit_filter_user_rules(struct netlink_skb_parms *cb,
                 case AUDIT_LOGINUID:
                         result = audit_comparator(cb->loginuid, f->op, f->val);
                         break;
+                case AUDIT_SUBJ_USER:
+                case AUDIT_SUBJ_ROLE:
+                case AUDIT_SUBJ_TYPE:
+                case AUDIT_SUBJ_SEN:
+                case AUDIT_SUBJ_CLR:
+                        if (f->lsm_rule)
+                                result = security_audit_rule_match(cb->sid,
+                                                                   f->type,
+                                                                   f->op,
+                                                                   f->lsm_rule,
+                                                                   NULL);
+                        break;
                 }
 
                 if (!result)
@@ -1323,30 +1327,23 @@ static int update_lsm_rule(struct audit_krule *r)
 {
         struct audit_entry *entry = container_of(r, struct audit_entry, rule);
         struct audit_entry *nentry;
-        struct audit_watch *watch;
-        struct audit_tree *tree;
         int err = 0;
 
         if (!security_audit_rule_known(r))
                 return 0;
 
-        watch = r->watch;
-        tree = r->tree;
-        nentry = audit_dupe_rule(r, watch);
+        nentry = audit_dupe_rule(r);
         if (IS_ERR(nentry)) {
                 /* save the first error encountered for the
                  * return value */
                 err = PTR_ERR(nentry);
                 audit_panic("error updating LSM filters");
-                if (watch)
+                if (r->watch)
                         list_del(&r->rlist);
                 list_del_rcu(&entry->list);
                 list_del(&r->list);
         } else {
-                if (watch) {
-                        list_add(&nentry->rule.rlist, audit_watch_rules(watch));
-                        list_del(&r->rlist);
-                } else if (tree)
+                if (r->watch || r->tree)
                         list_replace_init(&r->rlist, &nentry->rule.rlist);
                 list_replace_rcu(&entry->list, &nentry->list);
                 list_replace(&r->list, &nentry->rule.list);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3828ad5fb8f1..f49a0318c2ed 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -65,7 +65,6 @@
 #include <linux/binfmts.h>
 #include <linux/highmem.h>
 #include <linux/syscalls.h>
-#include <linux/inotify.h>
 #include <linux/capability.h>
 #include <linux/fs_struct.h>
 
@@ -242,6 +241,10 @@ struct audit_context {
                         pid_t                   pid;
                         struct audit_cap_data   cap;
                 } capset;
+                struct {
+                        int                     fd;
+                        int                     flags;
+                } mmap;
         };
         int fds[2];
 
@@ -549,9 +552,8 @@ static int audit_filter_rules(struct task_struct *tsk,
                         }
                         break;
                 case AUDIT_WATCH:
-                        if (name && audit_watch_inode(rule->watch) != (unsigned long)-1)
-                                result = (name->dev == audit_watch_dev(rule->watch) &&
-                                          name->ino == audit_watch_inode(rule->watch));
+                        if (name)
+                                result = audit_watch_compare(rule->watch, name->ino, name->dev);
                         break;
                 case AUDIT_DIR:
                         if (ctx)
@@ -1307,6 +1309,10 @@ static void show_special(struct audit_context *context, int *call_panic)
                 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
                 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
                 break; }
+        case AUDIT_MMAP: {
+                audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
+                                 context->mmap.flags);
+                break; }
         }
         audit_log_end(ab);
 }
@@ -1726,7 +1732,7 @@ static inline void handle_one(const struct inode *inode)
         struct audit_tree_refs *p;
         struct audit_chunk *chunk;
         int count;
-        if (likely(list_empty(&inode->inotify_watches)))
+        if (likely(hlist_empty(&inode->i_fsnotify_marks)))
                 return;
         context = current->audit_context;
         p = context->trees;
@@ -1769,7 +1775,7 @@ retry:
         seq = read_seqbegin(&rename_lock);
         for(;;) {
                 struct inode *inode = d->d_inode;
-                if (inode && unlikely(!list_empty(&inode->inotify_watches))) {
+                if (inode && unlikely(!hlist_empty(&inode->i_fsnotify_marks))) {
                         struct audit_chunk *chunk;
                         chunk = audit_tree_lookup(inode);
                         if (chunk) {
@@ -1837,13 +1843,8 @@ void __audit_getname(const char *name)
         context->names[context->name_count].ino  = (unsigned long)-1;
         context->names[context->name_count].osid = 0;
         ++context->name_count;
-        if (!context->pwd.dentry) {
-                read_lock(&current->fs->lock);
-                context->pwd = current->fs->pwd;
-                path_get(&current->fs->pwd);
-                read_unlock(&current->fs->lock);
-        }
-
+        if (!context->pwd.dentry)
+                get_fs_pwd(current->fs, &context->pwd);
 }
 
 /* audit_putname - intercept a putname request
@@ -2483,6 +2484,14 @@ void __audit_log_capset(pid_t pid,
         context->type = AUDIT_CAPSET;
 }
 
+void __audit_mmap_fd(int fd, int flags)
+{
+        struct audit_context *context = current->audit_context;
+        context->mmap.fd = fd;
+        context->mmap.flags = flags;
+        context->type = AUDIT_MMAP;
+}
+
 /**
  * audit_core_dumps - record information about processes that end abnormally
  * @signr: signal value
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d83cab06da87..66a416b42c18 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -52,7 +52,6 @@
 #include <linux/cgroupstats.h>
 #include <linux/hash.h>
 #include <linux/namei.h>
-#include <linux/smp_lock.h>
 #include <linux/pid_namespace.h>
 #include <linux/idr.h>
 #include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
@@ -138,7 +137,7 @@ struct css_id {
          * is called after synchronize_rcu(). But for safe use, css_is_removed()
          * css_tryget() should be used for avoiding race.
          */
-        struct cgroup_subsys_state *css;
+        struct cgroup_subsys_state __rcu *css;
         /*
          * ID of this css.
          */
@@ -244,6 +243,11 @@ static int notify_on_release(const struct cgroup *cgrp)
         return test_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
 }
 
+static int clone_children(const struct cgroup *cgrp)
+{
+        return test_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
+}
+
 /*
  * for_each_subsys() allows you to iterate on each subsystem attached to
  * an active hierarchy
@@ -778,6 +782,7 @@ static struct inode *cgroup_new_inode(mode_t mode, struct super_block *sb)
         struct inode *inode = new_inode(sb);
 
         if (inode) {
+                inode->i_ino = get_next_ino();
                 inode->i_mode = mode;
                 inode->i_uid = current_fsuid();
                 inode->i_gid = current_fsgid();
@@ -1040,6 +1045,8 @@ static int cgroup_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_puts(seq, ",noprefix");
         if (strlen(root->release_agent_path))
                 seq_printf(seq, ",release_agent=%s", root->release_agent_path);
+        if (clone_children(&root->top_cgroup))
+                seq_puts(seq, ",clone_children");
         if (strlen(root->name))
                 seq_printf(seq, ",name=%s", root->name);
         mutex_unlock(&cgroup_mutex);
@@ -1050,6 +1057,7 @@ struct cgroup_sb_opts {
         unsigned long subsys_bits;
         unsigned long flags;
         char *release_agent;
+        bool clone_children;
         char *name;
         /* User explicitly requested empty subsystem */
         bool none;
@@ -1066,7 +1074,8 @@ struct cgroup_sb_opts {
  */
 static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
 {
-        char *token, *o = data ?: "all";
+        char *token, *o = data;
+        bool all_ss = false, one_ss = false;
         unsigned long mask = (unsigned long)-1;
         int i;
         bool module_pin_failed = false;
@@ -1082,30 +1091,37 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
         while ((token = strsep(&o, ",")) != NULL) {
                 if (!*token)
                         return -EINVAL;
-                if (!strcmp(token, "all")) {
-                        /* Add all non-disabled subsystems */
-                        opts->subsys_bits = 0;
-                        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
-                                struct cgroup_subsys *ss = subsys[i];
-                                if (ss == NULL)
-                                        continue;
-                                if (!ss->disabled)
-                                        opts->subsys_bits |= 1ul << i;
-                        }
-                } else if (!strcmp(token, "none")) {
+                if (!strcmp(token, "none")) {
                         /* Explicitly have no subsystems */
                         opts->none = true;
-                } else if (!strcmp(token, "noprefix")) {
+                        continue;
+                }
+                if (!strcmp(token, "all")) {
+                        /* Mutually exclusive option 'all' + subsystem name */
+                        if (one_ss)
+                                return -EINVAL;
+                        all_ss = true;
+                        continue;
+                }
+                if (!strcmp(token, "noprefix")) {
                         set_bit(ROOT_NOPREFIX, &opts->flags);
-                } else if (!strncmp(token, "release_agent=", 14)) {
+                        continue;
+                }
+                if (!strcmp(token, "clone_children")) {
+                        opts->clone_children = true;
+                        continue;
+                }
+                if (!strncmp(token, "release_agent=", 14)) {
                         /* Specifying two release agents is forbidden */
                         if (opts->release_agent)
                                 return -EINVAL;
                         opts->release_agent =
-                                kstrndup(token + 14, PATH_MAX, GFP_KERNEL);
+                                kstrndup(token + 14, PATH_MAX - 1, GFP_KERNEL);
                         if (!opts->release_agent)
                                 return -ENOMEM;
-                } else if (!strncmp(token, "name=", 5)) {
+                        continue;
+                }
+                if (!strncmp(token, "name=", 5)) {
                         const char *name = token + 5;
                         /* Can't specify an empty name */
                         if (!strlen(name))
@@ -1123,24 +1139,48 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
                         if (opts->name)
                                 return -EINVAL;
                         opts->name = kstrndup(name,
-                                              MAX_CGROUP_ROOT_NAMELEN,
+                                              MAX_CGROUP_ROOT_NAMELEN - 1,
                                               GFP_KERNEL);
                         if (!opts->name)
                                 return -ENOMEM;
-                } else {
-                        struct cgroup_subsys *ss;
-                        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
-                                ss = subsys[i];
-                                if (ss == NULL)
-                                        continue;
-                                if (!strcmp(token, ss->name)) {
-                                        if (!ss->disabled)
-                                                set_bit(i, &opts->subsys_bits);
-                                        break;
-                                }
-                        }
-                        if (i == CGROUP_SUBSYS_COUNT)
-                                return -ENOENT;
+
+                        continue;
+                }
+
+                for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+                        struct cgroup_subsys *ss = subsys[i];
+                        if (ss == NULL)
+                                continue;
+                        if (strcmp(token, ss->name))
+                                continue;
+                        if (ss->disabled)
+                                continue;
+
+                        /* Mutually exclusive option 'all' + subsystem name */
+                        if (all_ss)
+                                return -EINVAL;
+                        set_bit(i, &opts->subsys_bits);
+                        one_ss = true;
+
+                        break;
+                }
+                if (i == CGROUP_SUBSYS_COUNT)
+                        return -ENOENT;
+        }
+
+        /*
+         * If the 'all' option was specified select all the subsystems,
+         * otherwise 'all, 'none' and a subsystem name options were not
+         * specified, let's default to 'all'
+         */
+        if (all_ss || (!all_ss && !one_ss && !opts->none)) {
+                for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+                        struct cgroup_subsys *ss = subsys[i];
+                        if (ss == NULL)
+                                continue;
+                        if (ss->disabled)
+                                continue;
+                        set_bit(i, &opts->subsys_bits);
                 }
         }
 
@@ -1222,7 +1262,6 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
         struct cgroup *cgrp = &root->top_cgroup;
         struct cgroup_sb_opts opts;
 
-        lock_kernel();
         mutex_lock(&cgrp->dentry->d_inode->i_mutex);
         mutex_lock(&cgroup_mutex);
 
@@ -1255,7 +1294,6 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
         kfree(opts.name);
         mutex_unlock(&cgroup_mutex);
         mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
-        unlock_kernel();
         return ret;
 }
 
@@ -1357,6 +1395,8 @@ static struct cgroupfs_root *cgroup_root_from_opts(struct cgroup_sb_opts *opts)
                 strcpy(root->release_agent_path, opts->release_agent);
         if (opts->name)
                 strcpy(root->name, opts->name);
+        if (opts->clone_children)
+                set_bit(CGRP_CLONE_CHILDREN, &root->top_cgroup.flags);
         return root;
 }
 
@@ -1420,9 +1460,9 @@ static int cgroup_get_rootdir(struct super_block *sb)
         return 0;
 }
 
-static int cgroup_get_sb(struct file_system_type *fs_type,
+static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                          int flags, const char *unused_dev_name,
-                         void *data, struct vfsmount *mnt)
+                         void *data)
 {
         struct cgroup_sb_opts opts;
         struct cgroupfs_root *root;
@@ -1556,10 +1596,9 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                 drop_parsed_module_refcounts(opts.subsys_bits);
         }
 
-        simple_set_mnt(mnt, sb);
         kfree(opts.release_agent);
         kfree(opts.name);
-        return 0;
+        return dget(sb->s_root);
 
  drop_new_super:
         deactivate_locked_super(sb);
@@ -1568,8 +1607,7 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
  out_err:
         kfree(opts.release_agent);
         kfree(opts.name);
-
-        return ret;
+        return ERR_PTR(ret);
 }
 
 static void cgroup_kill_sb(struct super_block *sb) {
@@ -1619,7 +1657,7 @@ static void cgroup_kill_sb(struct super_block *sb) {
 
 static struct file_system_type cgroup_fs_type = {
         .name = "cgroup",
-        .get_sb = cgroup_get_sb,
+        .mount = cgroup_mount,
         .kill_sb = cgroup_kill_sb,
 };
 
@@ -1791,19 +1829,20 @@ out:
 }
 
 /**
- * cgroup_attach_task_current_cg - attach task 'tsk' to current task's cgroup
+ * cgroup_attach_task_all - attach task 'tsk' to all cgroups of task 'from'
+ * @from: attach to all cgroups of a given task
  * @tsk: the task to be attached
  */
-int cgroup_attach_task_current_cg(struct task_struct *tsk)
+int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
 {
         struct cgroupfs_root *root;
-        struct cgroup *cur_cg;
         int retval = 0;
 
         cgroup_lock();
         for_each_active_root(root) {
-                cur_cg = task_cgroup_from_root(current, root);
-                retval = cgroup_attach_task(cur_cg, tsk);
+                struct cgroup *from_cg = task_cgroup_from_root(from, root);
+
+                retval = cgroup_attach_task(from_cg, tsk);
                 if (retval)
                         break;
         }
@@ -1811,7 +1850,7 @@ int cgroup_attach_task_current_cg(struct task_struct *tsk)
 
         return retval;
 }
-EXPORT_SYMBOL_GPL(cgroup_attach_task_current_cg);
+EXPORT_SYMBOL_GPL(cgroup_attach_task_all);
 
 /*
  * Attach task with pid 'pid' to cgroup 'cgrp'. Call with cgroup_mutex
@@ -1882,6 +1921,8 @@ static int cgroup_release_agent_write(struct cgroup *cgrp, struct cftype *cft,
                                       const char *buffer)
 {
         BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
+        if (strlen(buffer) >= PATH_MAX)
+                return -EINVAL;
         if (!cgroup_lock_live_group(cgrp))
                 return -ENODEV;
         strcpy(cgrp->root->release_agent_path, buffer);
@@ -3175,6 +3216,23 @@ fail:
         return ret;
 }
 
+static u64 cgroup_clone_children_read(struct cgroup *cgrp,
+                                    struct cftype *cft)
+{
+        return clone_children(cgrp);
+}
+
+static int cgroup_clone_children_write(struct cgroup *cgrp,
+                                     struct cftype *cft,
+                                     u64 val)
+{
+        if (val)
+                set_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
+        else
+                clear_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
+        return 0;
+}
+
 /*
  * for the common functions, 'private' gives the type of file
  */
@@ -3205,6 +3263,11 @@ static struct cftype files[] = {
                 .write_string = cgroup_write_event_control,
                 .mode = S_IWUGO,
         },
+        {
+                .name = "cgroup.clone_children",
+                .read_u64 = cgroup_clone_children_read,
+                .write_u64 = cgroup_clone_children_write,
+        },
 };
 
 static struct cftype cft_release_agent = {
@@ -3334,6 +3397,9 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         if (notify_on_release(parent))
                 set_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
 
+        if (clone_children(parent))
+                set_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
+
         for_each_subsys(root, ss) {
                 struct cgroup_subsys_state *css = ss->create(ss, cgrp);
 
@@ -3348,6 +3414,8 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                                 goto err_destroy;
                 }
                 /* At error, ->destroy() callback has to free assigned ID. */
+                if (clone_children(parent) && ss->post_clone)
+                        ss->post_clone(ss, cgrp);
         }
 
         cgroup_lock_hierarchy(root);
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index ce71ed53e88f..e7bebb7c6c38 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -48,20 +48,19 @@ static inline struct freezer *task_freezer(struct task_struct *task)
                             struct freezer, css);
 }
 
-int cgroup_freezing_or_frozen(struct task_struct *task)
+static inline int __cgroup_freezing_or_frozen(struct task_struct *task)
 {
-        struct freezer *freezer;
-        enum freezer_state state;
+        enum freezer_state state = task_freezer(task)->state;
+        return (state == CGROUP_FREEZING) || (state == CGROUP_FROZEN);
+}
 
+int cgroup_freezing_or_frozen(struct task_struct *task)
+{
+        int result;
         task_lock(task);
-        freezer = task_freezer(task);
-        if (!freezer->css.cgroup->parent)
-                state = CGROUP_THAWED; /* root cgroup can't be frozen */
-        else
-                state = freezer->state;
+        result = __cgroup_freezing_or_frozen(task);
         task_unlock(task);
-
-        return (state == CGROUP_FREEZING) || (state == CGROUP_FROZEN);
+        return result;
 }
 
 /*
@@ -154,13 +153,6 @@ static void freezer_destroy(struct cgroup_subsys *ss,
         kfree(cgroup_freezer(cgroup));
 }
 
-/* Task is frozen or will freeze immediately when next it gets woken */
-static bool is_task_frozen_enough(struct task_struct *task)
-{
-        return frozen(task) ||
-                (task_is_stopped_or_traced(task) && freezing(task));
-}
-
 /*
  * The call to cgroup_lock() in the freezer.state write method prevents
  * a write to that file racing against an attach, and hence the
@@ -174,24 +166,25 @@ static int freezer_can_attach(struct cgroup_subsys *ss,
 
         /*
          * Anything frozen can't move or be moved to/from.
-         *
-         * Since orig_freezer->state == FROZEN means that @task has been
-         * frozen, so it's sufficient to check the latter condition.
          */
 
-        if (is_task_frozen_enough(task))
+        freezer = cgroup_freezer(new_cgroup);
+        if (freezer->state != CGROUP_THAWED)
                 return -EBUSY;
 
-        freezer = cgroup_freezer(new_cgroup);
-        if (freezer->state == CGROUP_FROZEN)
+        rcu_read_lock();
+        if (__cgroup_freezing_or_frozen(task)) {
+                rcu_read_unlock();
                 return -EBUSY;
+        }
+        rcu_read_unlock();
 
         if (threadgroup) {
                 struct task_struct *c;
 
                 rcu_read_lock();
                 list_for_each_entry_rcu(c, &task->thread_group, thread_group) {
-                        if (is_task_frozen_enough(c)) {
+                        if (__cgroup_freezing_or_frozen(c)) {
                                 rcu_read_unlock();
                                 return -EBUSY;
                         }
@@ -236,31 +229,30 @@ static void freezer_fork(struct cgroup_subsys *ss, struct task_struct *task)
 /*
  * caller must hold freezer->lock
  */
-static void update_freezer_state(struct cgroup *cgroup,
+static void update_if_frozen(struct cgroup *cgroup,
                                  struct freezer *freezer)
 {
         struct cgroup_iter it;
         struct task_struct *task;
         unsigned int nfrozen = 0, ntotal = 0;
+        enum freezer_state old_state = freezer->state;
 
         cgroup_iter_start(cgroup, &it);
         while ((task = cgroup_iter_next(cgroup, &it))) {
                 ntotal++;
-                if (is_task_frozen_enough(task))
+                if (frozen(task))
                         nfrozen++;
         }
 
-        /*
-         * Transition to FROZEN when no new tasks can be added ensures
-         * that we never exist in the FROZEN state while there are unfrozen
-         * tasks.
-         */
-        if (nfrozen == ntotal)
-                freezer->state = CGROUP_FROZEN;
-        else if (nfrozen > 0)
-                freezer->state = CGROUP_FREEZING;
-        else
-                freezer->state = CGROUP_THAWED;
+        if (old_state == CGROUP_THAWED) {
+                BUG_ON(nfrozen > 0);
+        } else if (old_state == CGROUP_FREEZING) {
+                if (nfrozen == ntotal)
+                        freezer->state = CGROUP_FROZEN;
+        } else { /* old_state == CGROUP_FROZEN */
+                BUG_ON(nfrozen != ntotal);
+        }
+
         cgroup_iter_end(cgroup, &it);
 }
 
@@ -279,7 +271,7 @@ static int freezer_read(struct cgroup *cgroup, struct cftype *cft,
         if (state == CGROUP_FREEZING) {
                 /* We change from FREEZING to FROZEN lazily if the cgroup was
                  * only partially frozen when we exitted write. */
-                update_freezer_state(cgroup, freezer);
+                update_if_frozen(cgroup, freezer);
                 state = freezer->state;
         }
         spin_unlock_irq(&freezer->lock);
@@ -301,7 +293,7 @@ static int try_to_freeze_cgroup(struct cgroup *cgroup, struct freezer *freezer)
         while ((task = cgroup_iter_next(cgroup, &it))) {
                 if (!freeze_task(task, true))
                         continue;
-                if (is_task_frozen_enough(task))
+                if (frozen(task))
                         continue;
                 if (!freezing(task) && !freezer_should_skip(task))
                         num_cant_freeze_now++;
@@ -335,7 +327,7 @@ static int freezer_change_state(struct cgroup *cgroup,
 
         spin_lock_irq(&freezer->lock);
 
-        update_freezer_state(cgroup, freezer);
+        update_if_frozen(cgroup, freezer);
         if (goal_state == freezer->state)
                 goto out;
 
diff --git a/kernel/compat.c b/kernel/compat.c
index 5adab05a3172..c9e2ec0b34a8 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -279,11 +279,6 @@ asmlinkage long compat_sys_setrlimit(unsigned int resource,
                 struct compat_rlimit __user *rlim)
 {
         struct rlimit r;
-        int ret;
-        mm_segment_t old_fs = get_fs ();
-
-        if (resource >= RLIM_NLIMITS)
-                return -EINVAL;
 
         if (!access_ok(VERIFY_READ, rlim, sizeof(*rlim)) ||
             __get_user(r.rlim_cur, &rlim->rlim_cur) ||
@@ -294,10 +289,7 @@ asmlinkage long compat_sys_setrlimit(unsigned int resource,
                 r.rlim_cur = RLIM_INFINITY;
         if (r.rlim_max == COMPAT_RLIM_INFINITY)
                 r.rlim_max = RLIM_INFINITY;
-        set_fs(KERNEL_DS);
-        ret = sys_setrlimit(resource, (struct rlimit __user *) &r);
-        set_fs(old_fs);
-        return ret;
+        return do_prlimit(current, resource, &r, NULL);
 }
 
 #ifdef COMPAT_RLIM_OLD_INFINITY
@@ -329,16 +321,13 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
 
 #endif
 
-asmlinkage long compat_sys_getrlimit (unsigned int resource,
+asmlinkage long compat_sys_getrlimit(unsigned int resource,
                 struct compat_rlimit __user *rlim)
 {
         struct rlimit r;
         int ret;
-        mm_segment_t old_fs = get_fs();
 
-        set_fs(KERNEL_DS);
-        ret = sys_getrlimit(resource, (struct rlimit __user *) &r);
-        set_fs(old_fs);
+        ret = do_prlimit(current, resource, NULL, &r);
         if (!ret) {
                 if (r.rlim_cur > COMPAT_RLIM_INFINITY)
                         r.rlim_cur = COMPAT_RLIM_INFINITY;
@@ -1137,3 +1126,24 @@ compat_sys_sysinfo(struct compat_sysinfo __user *info)
 
         return 0;
 }
+
+/*
+ * Allocate user-space memory for the duration of a single system call,
+ * in order to marshall parameters inside a compat thunk.
+ */
+void __user *compat_alloc_user_space(unsigned long len)
+{
+        void __user *ptr;
+
+        /* If len would occupy more than half of the entire compat space... */
+        if (unlikely(len > (((compat_uptr_t)~0) >> 1)))
+                return NULL;
+
+        ptr = arch_compat_alloc_user_space(len);
+
+        if (unlikely(!access_ok(VERIFY_WRITE, ptr, len)))
+                return NULL;
+
+        return ptr;
+}
+EXPORT_SYMBOL_GPL(compat_alloc_user_space);
diff --git a/kernel/configs.c b/kernel/configs.c
index abaee684ecbf..b4066b44a99d 100644
--- a/kernel/configs.c
+++ b/kernel/configs.c
@@ -66,6 +66,7 @@ ikconfig_read_current(struct file *file, char __user *buf,
 static const struct file_operations ikconfig_file_ops = {
         .owner = THIS_MODULE,
         .read = ikconfig_read_current,
+        .llseek = default_llseek,
 };
 
 static int __init ikconfig_init(void)
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index b23c0979bbe7..4349935c2ad8 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -231,18 +231,17 @@ static DEFINE_SPINLOCK(cpuset_buffer_lock);
  * users. If someone tries to mount the "cpuset" filesystem, we
  * silently switch it to mount "cgroup" instead
  */
-static int cpuset_get_sb(struct file_system_type *fs_type,
-                         int flags, const char *unused_dev_name,
-                         void *data, struct vfsmount *mnt)
+static struct dentry *cpuset_mount(struct file_system_type *fs_type,
+                         int flags, const char *unused_dev_name, void *data)
 {
         struct file_system_type *cgroup_fs = get_fs_type("cgroup");
-        int ret = -ENODEV;
+        struct dentry *ret = ERR_PTR(-ENODEV);
         if (cgroup_fs) {
                 char mountopts[] =
                         "cpuset,noprefix,"
                         "release_agent=/sbin/cpuset_release_agent";
-                ret = cgroup_fs->get_sb(cgroup_fs, flags,
-                                           unused_dev_name, mountopts, mnt);
+                ret = cgroup_fs->mount(cgroup_fs, flags,
+                                           unused_dev_name, mountopts);
                 put_filesystem(cgroup_fs);
         }
         return ret;
@@ -250,7 +249,7 @@ static int cpuset_get_sb(struct file_system_type *fs_type,
 
 static struct file_system_type cpuset_fs_type = {
         .name = "cpuset",
-        .get_sb = cpuset_get_sb,
+        .mount = cpuset_mount,
 };
 
 /*
@@ -1397,7 +1396,7 @@ static int cpuset_can_attach(struct cgroup_subsys *ss, struct cgroup *cont,
         if (tsk->flags & PF_THREAD_BOUND)
                 return -EINVAL;
 
-        ret = security_task_setscheduler(tsk, 0, NULL);
+        ret = security_task_setscheduler(tsk);
         if (ret)
                 return ret;
         if (threadgroup) {
@@ -1405,7 +1404,7 @@ static int cpuset_can_attach(struct cgroup_subsys *ss, struct cgroup *cont,
 
                 rcu_read_lock();
                 list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
-                        ret = security_task_setscheduler(c, 0, NULL);
+                        ret = security_task_setscheduler(c);
                         if (ret) {
                                 rcu_read_unlock();
                                 return ret;
diff --git a/kernel/cred.c b/kernel/cred.c
index 60bc8b1e32e6..6a1aa004e376 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -22,10 +22,6 @@
 #define kdebug(FMT, ...) \
         printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
 #else
-static inline __attribute__((format(printf, 1, 2)))
-void no_printk(const char *fmt, ...)
-{
-}
 #define kdebug(FMT, ...) \
         no_printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
 #endif
@@ -329,7 +325,7 @@ EXPORT_SYMBOL(prepare_creds);
 
 /*
  * Prepare credentials for current to perform an execve()
- * - The caller must hold current->cred_guard_mutex
+ * - The caller must hold ->cred_guard_mutex
  */
 struct cred *prepare_exec_creds(void)
 {
@@ -388,8 +384,6 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
         struct cred *new;
         int ret;
 
-        mutex_init(&p->cred_guard_mutex);
-
         if (
 #ifdef CONFIG_KEYS
                 !p->cred->thread_keyring &&
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 3c2d4972d235..cefd4a11f6d9 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -47,6 +47,7 @@
 #include <linux/pid.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
+#include <linux/rcupdate.h>
 
 #include <asm/cacheflush.h>
 #include <asm/byteorder.h>
@@ -109,13 +110,15 @@ static struct kgdb_bkpt		kgdb_break[KGDB_MAX_BREAKPOINTS] = {
  */
 atomic_t                        kgdb_active = ATOMIC_INIT(-1);
 EXPORT_SYMBOL_GPL(kgdb_active);
+static DEFINE_RAW_SPINLOCK(dbg_master_lock);
+static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
 
 /*
  * We use NR_CPUs not PERCPU, in case kgdb is used to debug early
  * bootup code (which might not have percpu set up yet):
  */
-static atomic_t                 passive_cpu_wait[NR_CPUS];
-static atomic_t                 cpu_in_kgdb[NR_CPUS];
+static atomic_t                 masters_in_kgdb;
+static atomic_t                 slaves_in_kgdb;
 static atomic_t                 kgdb_break_tasklet_var;
 atomic_t                        kgdb_setting_breakpoint;
 
@@ -206,18 +209,6 @@ int __weak kgdb_skipexception(int exception, struct pt_regs *regs)
         return 0;
 }
 
-/**
- *      kgdb_disable_hw_debug - Disable hardware debugging while we in kgdb.
- *      @regs: Current &struct pt_regs.
- *
- *      This function will be called if the particular architecture must
- *      disable hardware debugging while it is processing gdb packets or
- *      handling exception.
- */
-void __weak kgdb_disable_hw_debug(struct pt_regs *regs)
-{
-}
-
 /*
  * Some architectures need cache flushes when we set/clear a
  * breakpoint:
@@ -457,26 +448,34 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
         return 1;
 }
 
-static void dbg_cpu_switch(int cpu, int next_cpu)
+static void dbg_touch_watchdogs(void)
 {
-        /* Mark the cpu we are switching away from as a slave when it
-         * holds the kgdb_active token.  This must be done so that the
-         * that all the cpus wait in for the debug core will not enter
-         * again as the master. */
-        if (cpu == atomic_read(&kgdb_active)) {
-                kgdb_info[cpu].exception_state |= DCPU_IS_SLAVE;
-                kgdb_info[cpu].exception_state &= ~DCPU_WANT_MASTER;
-        }
-        kgdb_info[next_cpu].exception_state |= DCPU_NEXT_MASTER;
+        touch_softlockup_watchdog_sync();
+        clocksource_touch_watchdog();
+        rcu_cpu_stall_reset();
 }
 
-static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs)
+static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
+                int exception_state)
 {
         unsigned long flags;
         int sstep_tries = 100;
         int error;
-        int i, cpu;
+        int cpu;
         int trace_on = 0;
+        int online_cpus = num_online_cpus();
+
+        kgdb_info[ks->cpu].enter_kgdb++;
+        kgdb_info[ks->cpu].exception_state |= exception_state;
+
+        if (exception_state == DCPU_WANT_MASTER)
+                atomic_inc(&masters_in_kgdb);
+        else
+                atomic_inc(&slaves_in_kgdb);
+
+        if (arch_kgdb_ops.disable_hw_break)
+                arch_kgdb_ops.disable_hw_break(regs);
+
 acquirelock:
         /*
          * Interrupts will be restored by the 'trap return' code, except when
@@ -489,14 +488,15 @@ acquirelock:
         kgdb_info[cpu].task = current;
         kgdb_info[cpu].ret_state = 0;
         kgdb_info[cpu].irq_depth = hardirq_count() >> HARDIRQ_SHIFT;
-        /*
-         * Make sure the above info reaches the primary CPU before
-         * our cpu_in_kgdb[] flag setting does:
-         */
-        atomic_inc(&cpu_in_kgdb[cpu]);
 
-        if (exception_level == 1)
+        /* Make sure the above info reaches the primary CPU */
+        smp_mb();
+
+        if (exception_level == 1) {
+                if (raw_spin_trylock(&dbg_master_lock))
+                        atomic_xchg(&kgdb_active, cpu);
                 goto cpu_master_loop;
+        }
 
         /*
          * CPU will loop if it is a slave or request to become a kgdb
@@ -508,10 +508,12 @@ cpu_loop:
                         kgdb_info[cpu].exception_state &= ~DCPU_NEXT_MASTER;
                         goto cpu_master_loop;
                 } else if (kgdb_info[cpu].exception_state & DCPU_WANT_MASTER) {
-                        if (atomic_cmpxchg(&kgdb_active, -1, cpu) == cpu)
+                        if (raw_spin_trylock(&dbg_master_lock)) {
+                                atomic_xchg(&kgdb_active, cpu);
                                 break;
+                        }
                 } else if (kgdb_info[cpu].exception_state & DCPU_IS_SLAVE) {
-                        if (!atomic_read(&passive_cpu_wait[cpu]))
+                        if (!raw_spin_is_locked(&dbg_slave_lock))
                                 goto return_normal;
                 } else {
 return_normal:
@@ -522,9 +524,12 @@ return_normal:
                                 arch_kgdb_ops.correct_hw_break();
                         if (trace_on)
                                 tracing_on();
-                        atomic_dec(&cpu_in_kgdb[cpu]);
-                        touch_softlockup_watchdog_sync();
-                        clocksource_touch_watchdog();
+                        kgdb_info[cpu].exception_state &=
+                                ~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
+                        kgdb_info[cpu].enter_kgdb--;
+                        smp_mb__before_atomic_dec();
+                        atomic_dec(&slaves_in_kgdb);
+                        dbg_touch_watchdogs();
                         local_irq_restore(flags);
                         return 0;
                 }
@@ -541,8 +546,8 @@ return_normal:
             (kgdb_info[cpu].task &&
              kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
                 atomic_set(&kgdb_active, -1);
-                touch_softlockup_watchdog_sync();
-                clocksource_touch_watchdog();
+                raw_spin_unlock(&dbg_master_lock);
+                dbg_touch_watchdogs();
                 local_irq_restore(flags);
 
                 goto acquirelock;
@@ -563,16 +568,12 @@ return_normal:
         if (dbg_io_ops->pre_exception)
                 dbg_io_ops->pre_exception();
 
-        kgdb_disable_hw_debug(ks->linux_regs);
-
         /*
          * Get the passive CPU lock which will hold all the non-primary
          * CPU in a spin state while the debugger is active
          */
-        if (!kgdb_single_step) {
-                for (i = 0; i < NR_CPUS; i++)
-                        atomic_inc(&passive_cpu_wait[i]);
-        }
+        if (!kgdb_single_step)
+                raw_spin_lock(&dbg_slave_lock);
 
 #ifdef CONFIG_SMP
         /* Signal the other CPUs to enter kgdb_wait() */
@@ -583,10 +584,9 @@ return_normal:
         /*
          * Wait for the other CPUs to be notified and be waiting for us:
          */
-        for_each_online_cpu(i) {
-                while (kgdb_do_roundup && !atomic_read(&cpu_in_kgdb[i]))
-                        cpu_relax();
-        }
+        while (kgdb_do_roundup && (atomic_read(&masters_in_kgdb) +
+                                atomic_read(&slaves_in_kgdb)) != online_cpus)
+                cpu_relax();
 
         /*
          * At this point the primary processor is completely
@@ -615,7 +615,8 @@ cpu_master_loop:
                 if (error == DBG_PASS_EVENT) {
                         dbg_kdb_mode = !dbg_kdb_mode;
                 } else if (error == DBG_SWITCH_CPU_EVENT) {
-                        dbg_cpu_switch(cpu, dbg_switch_cpu);
+                        kgdb_info[dbg_switch_cpu].exception_state |=
+                                DCPU_NEXT_MASTER;
                         goto cpu_loop;
                 } else {
                         kgdb_info[cpu].ret_state = error;
@@ -627,24 +628,11 @@ cpu_master_loop:
         if (dbg_io_ops->post_exception)
                 dbg_io_ops->post_exception();
 
-        atomic_dec(&cpu_in_kgdb[ks->cpu]);
-
         if (!kgdb_single_step) {
-                for (i = NR_CPUS-1; i >= 0; i--)
-                        atomic_dec(&passive_cpu_wait[i]);
-                /*
-                 * Wait till all the CPUs have quit from the debugger,
-                 * but allow a CPU that hit an exception and is
-                 * waiting to become the master to remain in the debug
-                 * core.
-                 */
-                for_each_online_cpu(i) {
-                        while (kgdb_do_roundup &&
-                               atomic_read(&cpu_in_kgdb[i]) &&
-                               !(kgdb_info[i].exception_state &
-                                 DCPU_WANT_MASTER))
-                                cpu_relax();
-                }
+                raw_spin_unlock(&dbg_slave_lock);
+                /* Wait till all the CPUs have quit from the debugger. */
+                while (kgdb_do_roundup && atomic_read(&slaves_in_kgdb))
+                        cpu_relax();
         }
 
 kgdb_restore:
@@ -655,12 +643,20 @@ kgdb_restore:
                 else
                         kgdb_sstep_pid = 0;
         }
+        if (arch_kgdb_ops.correct_hw_break)
+                arch_kgdb_ops.correct_hw_break();
         if (trace_on)
                 tracing_on();
+
+        kgdb_info[cpu].exception_state &=
+                ~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
+        kgdb_info[cpu].enter_kgdb--;
+        smp_mb__before_atomic_dec();
+        atomic_dec(&masters_in_kgdb);
         /* Free kgdb_active */
         atomic_set(&kgdb_active, -1);
-        touch_softlockup_watchdog_sync();
-        clocksource_touch_watchdog();
+        raw_spin_unlock(&dbg_master_lock);
+        dbg_touch_watchdogs();
         local_irq_restore(flags);
 
         return kgdb_info[cpu].ret_state;
@@ -678,7 +674,6 @@ kgdb_handle_exception(int evector, int signo, int ecode, struct pt_regs *regs)
 {
         struct kgdb_state kgdb_var;
         struct kgdb_state *ks = &kgdb_var;
-        int ret;
 
         ks->cpu                 = raw_smp_processor_id();
         ks->ex_vector           = evector;
@@ -689,11 +684,10 @@ kgdb_handle_exception(int evector, int signo, int ecode, struct pt_regs *regs)
 
         if (kgdb_reenter_check(ks))
                 return 0; /* Ouch, double exception ! */
-        kgdb_info[ks->cpu].exception_state |= DCPU_WANT_MASTER;
-        ret = kgdb_cpu_enter(ks, regs);
-        kgdb_info[ks->cpu].exception_state &= ~(DCPU_WANT_MASTER |
-                                                DCPU_IS_SLAVE);
-        return ret;
+        if (kgdb_info[ks->cpu].enter_kgdb != 0)
+                return 0;
+
+        return kgdb_cpu_enter(ks, regs, DCPU_WANT_MASTER);
 }
 
 int kgdb_nmicallback(int cpu, void *regs)
@@ -706,12 +700,9 @@ int kgdb_nmicallback(int cpu, void *regs)
         ks->cpu                 = cpu;
         ks->linux_regs          = regs;
 
-        if (!atomic_read(&cpu_in_kgdb[cpu]) &&
-            atomic_read(&kgdb_active) != -1 &&
-            atomic_read(&kgdb_active) != cpu) {
-                kgdb_info[cpu].exception_state |= DCPU_IS_SLAVE;
-                kgdb_cpu_enter(ks, regs);
-                kgdb_info[cpu].exception_state &= ~DCPU_IS_SLAVE;
+        if (kgdb_info[ks->cpu].enter_kgdb == 0 &&
+                        raw_spin_is_locked(&dbg_master_lock)) {
+                kgdb_cpu_enter(ks, regs, DCPU_IS_SLAVE);
                 return 0;
         }
 #endif
@@ -741,7 +732,7 @@ static struct console kgdbcons = {
 };
 
 #ifdef CONFIG_MAGIC_SYSRQ
-static void sysrq_handle_dbg(int key, struct tty_struct *tty)
+static void sysrq_handle_dbg(int key)
 {
         if (!dbg_io_ops) {
                 printk(KERN_CRIT "ERROR: No KGDB I/O module available\n");
diff --git a/kernel/debug/debug_core.h b/kernel/debug/debug_core.h
index c5d753d80f67..3494c28a7e7a 100644
--- a/kernel/debug/debug_core.h
+++ b/kernel/debug/debug_core.h
@@ -40,6 +40,7 @@ struct debuggerinfo_struct {
         int                     exception_state;
         int                     ret_state;
         int                     irq_depth;
+        int                     enter_kgdb;
 };
 
 extern struct debuggerinfo_struct kgdb_info[];
diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c
index 75bd9b3ebbb7..20059ef4459a 100644
--- a/kernel/debug/kdb/kdb_bp.c
+++ b/kernel/debug/kdb/kdb_bp.c
@@ -274,7 +274,6 @@ static int kdb_bp(int argc, const char **argv)
         int i, bpno;
         kdb_bp_t *bp, *bp_check;
         int diag;
-        int free;
         char *symname = NULL;
         long offset = 0ul;
         int nextarg;
@@ -305,7 +304,6 @@ static int kdb_bp(int argc, const char **argv)
         /*
          * Find an empty bp structure to allocate
          */
-        free = KDB_MAXBPT;
         for (bpno = 0, bp = kdb_breakpoints; bpno < KDB_MAXBPT; bpno++, bp++) {
                 if (bp->bp_free)
                         break;
diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c
index bf6e8270e957..dd0b1b7dd02c 100644
--- a/kernel/debug/kdb/kdb_debugger.c
+++ b/kernel/debug/kdb/kdb_debugger.c
@@ -86,7 +86,7 @@ int kdb_stub(struct kgdb_state *ks)
         }
         /* Set initial kdb state variables */
         KDB_STATE_CLEAR(KGDB_TRANS);
-        kdb_initial_cpu = ks->cpu;
+        kdb_initial_cpu = atomic_read(&kgdb_active);
         kdb_current_task = kgdb_info[ks->cpu].task;
         kdb_current_regs = kgdb_info[ks->cpu].debuggerinfo;
         /* Remove any breakpoints as needed by kdb and clear single step */
@@ -105,7 +105,6 @@ int kdb_stub(struct kgdb_state *ks)
                 ks->pass_exception = 1;
                 KDB_FLAG_SET(CATASTROPHIC);
         }
-        kdb_initial_cpu = ks->cpu;
         if (KDB_STATE(SSBPT) && reason == KDB_REASON_SSTEP) {
                 KDB_STATE_CLEAR(SSBPT);
                 KDB_STATE_CLEAR(DOING_SS);
diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index c9b7f4f90bba..96fdaac46a80 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -823,4 +823,4 @@ int kdb_printf(const char *fmt, ...)
 
         return r;
 }
-
+EXPORT_SYMBOL_GPL(kdb_printf);
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 28b844118bbd..a6e729766821 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -82,7 +82,7 @@ static kdbtab_t kdb_base_commands[50];
 #define for_each_kdbcmd(cmd, num)                                       \
         for ((cmd) = kdb_base_commands, (num) = 0;                      \
              num < kdb_max_commands;                                    \
-             num == KDB_BASE_CMD_MAX ? cmd = kdb_commands : cmd++, num++)
+             num++, num == KDB_BASE_CMD_MAX ? cmd = kdb_commands : cmd++)
 
 typedef struct _kdbmsg {
         int     km_diag;        /* kdb diagnostic */
@@ -646,7 +646,7 @@ static int kdb_defcmd2(const char *cmdstr, const char *argv0)
         }
         if (!s->usable)
                 return KDB_NOTIMP;
-        s->command = kmalloc((s->count + 1) * sizeof(*(s->command)), GFP_KDB);
+        s->command = kzalloc((s->count + 1) * sizeof(*(s->command)), GFP_KDB);
         if (!s->command) {
                 kdb_printf("Could not allocate new kdb_defcmd table for %s\n",
                            cmdstr);
@@ -1127,7 +1127,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
                 /* special case below */
         } else {
                 kdb_printf("\nEntering kdb (current=0x%p, pid %d) ",
-                           kdb_current, kdb_current->pid);
+                           kdb_current, kdb_current ? kdb_current->pid : 0);
 #if defined(CONFIG_SMP)
                 kdb_printf("on processor %d ", raw_smp_processor_id());
 #endif
@@ -1749,13 +1749,13 @@ static int kdb_go(int argc, const char **argv)
         int nextarg;
         long offset;
 
+        if (raw_smp_processor_id() != kdb_initial_cpu) {
+                kdb_printf("go must execute on the entry cpu, "
+                           "please use \"cpu %d\" and then execute go\n",
+                           kdb_initial_cpu);
+                return KDB_BADCPUNUM;
+        }
         if (argc == 1) {
-                if (raw_smp_processor_id() != kdb_initial_cpu) {
-                        kdb_printf("go <address> must be issued from the "
-                                   "initial cpu, do cpu %d first\n",
-                                   kdb_initial_cpu);
-                        return KDB_ARGCOUNT;
-                }
                 nextarg = 1;
                 diag = kdbgetaddrarg(argc, argv, &nextarg,
                                      &addr, &offset, NULL);
@@ -1929,7 +1929,7 @@ static int kdb_sr(int argc, const char **argv)
         if (argc != 1)
                 return KDB_ARGCOUNT;
         kdb_trap_printk++;
-        __handle_sysrq(*argv[1], NULL, 0);
+        __handle_sysrq(*argv[1], false);
         kdb_trap_printk--;
 
         return 0;
@@ -2361,7 +2361,7 @@ static int kdb_pid(int argc, const char **argv)
  */
 static int kdb_ll(int argc, const char **argv)
 {
-        int diag;
+        int diag = 0;
         unsigned long addr;
         long offset = 0;
         unsigned long va;
@@ -2400,20 +2400,21 @@ static int kdb_ll(int argc, const char **argv)
                 char buf[80];
 
                 if (KDB_FLAG(CMD_INTERRUPT))
-                        return 0;
+                        goto out;
 
                 sprintf(buf, "%s " kdb_machreg_fmt "\n", command, va);
                 diag = kdb_parse(buf);
                 if (diag)
-                        return diag;
+                        goto out;
 
                 addr = va + linkoffset;
                 if (kdb_getword(&va, addr, sizeof(va)))
-                        return 0;
+                        goto out;
         }
-        kfree(command);
 
-        return 0;
+out:
+        kfree(command);
+        return diag;
 }
 
 static int kdb_kgdb(int argc, const char **argv)
@@ -2603,20 +2604,17 @@ static int kdb_summary(int argc, const char **argv)
  */
 static int kdb_per_cpu(int argc, const char **argv)
 {
-        char buf[256], fmtstr[64];
-        kdb_symtab_t symtab;
-        cpumask_t suppress = CPU_MASK_NONE;
-        int cpu, diag;
-        unsigned long addr, val, bytesperword = 0, whichcpu = ~0UL;
+        char fmtstr[64];
+        int cpu, diag, nextarg = 1;
+        unsigned long addr, symaddr, val, bytesperword = 0, whichcpu = ~0UL;
 
         if (argc < 1 || argc > 3)
                 return KDB_ARGCOUNT;
 
-        snprintf(buf, sizeof(buf), "per_cpu__%s", argv[1]);
-        if (!kdbgetsymval(buf, &symtab)) {
-                kdb_printf("%s is not a per_cpu variable\n", argv[1]);
-                return KDB_BADADDR;
-        }
+        diag = kdbgetaddrarg(argc, argv, &nextarg, &symaddr, NULL, NULL);
+        if (diag)
+                return diag;
+
         if (argc >= 2) {
                 diag = kdbgetularg(argv[2], &bytesperword);
                 if (diag)
@@ -2649,46 +2647,25 @@ static int kdb_per_cpu(int argc, const char **argv)
 #define KDB_PCU(cpu) 0
 #endif
 #endif
-
         for_each_online_cpu(cpu) {
+                if (KDB_FLAG(CMD_INTERRUPT))
+                        return 0;
+
                 if (whichcpu != ~0UL && whichcpu != cpu)
                         continue;
-                addr = symtab.sym_start + KDB_PCU(cpu);
+                addr = symaddr + KDB_PCU(cpu);
                 diag = kdb_getword(&val, addr, bytesperword);
                 if (diag) {
                         kdb_printf("%5d " kdb_bfd_vma_fmt0 " - unable to "
                                    "read, diag=%d\n", cpu, addr, diag);
                         continue;
                 }
-#ifdef  CONFIG_SMP
-                if (!val) {
-                        cpu_set(cpu, suppress);
-                        continue;
-                }
-#endif  /* CONFIG_SMP */
                 kdb_printf("%5d ", cpu);
                 kdb_md_line(fmtstr, addr,
                         bytesperword == KDB_WORD_SIZE,
                         1, bytesperword, 1, 1, 0);
         }
-        if (cpus_weight(suppress) == 0)
-                return 0;
-        kdb_printf("Zero suppressed cpu(s):");
-        for (cpu = first_cpu(suppress); cpu < num_possible_cpus();
-             cpu = next_cpu(cpu, suppress)) {
-                kdb_printf(" %d", cpu);
-                if (cpu == num_possible_cpus() - 1 ||
-                    next_cpu(cpu, suppress) != cpu + 1)
-                        continue;
-                while (cpu < num_possible_cpus() &&
-                       next_cpu(cpu, suppress) == cpu + 1)
-                        ++cpu;
-                kdb_printf("-%d", cpu);
-        }
-        kdb_printf("\n");
-
 #undef KDB_PCU
-
         return 0;
 }
 
@@ -2763,13 +2740,13 @@ int kdb_register_repeat(char *cmd,
                 }
                 if (kdb_commands) {
                         memcpy(new, kdb_commands,
-                               kdb_max_commands * sizeof(*new));
+                          (kdb_max_commands - KDB_BASE_CMD_MAX) * sizeof(*new));
                         kfree(kdb_commands);
                 }
                 memset(new + kdb_max_commands, 0,
                        kdb_command_extend * sizeof(*new));
                 kdb_commands = new;
-                kp = kdb_commands + kdb_max_commands;
+                kp = kdb_commands + kdb_max_commands - KDB_BASE_CMD_MAX;
                 kdb_max_commands += kdb_command_extend;
         }
 
@@ -2783,6 +2760,8 @@ int kdb_register_repeat(char *cmd,
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(kdb_register_repeat);
+
 
 /*
  * kdb_register - Compatibility register function for commands that do
@@ -2805,6 +2784,7 @@ int kdb_register(char *cmd,
         return kdb_register_repeat(cmd, func, usage, help, minlen,
                                    KDB_REPEAT_NONE);
 }
+EXPORT_SYMBOL_GPL(kdb_register);
 
 /*
  * kdb_unregister - This function is used to unregister a kernel
@@ -2823,7 +2803,7 @@ int kdb_unregister(char *cmd)
         /*
          *  find the command.
          */
-        for (i = 0, kp = kdb_commands; i < kdb_max_commands; i++, kp++) {
+        for_each_kdbcmd(kp, i) {
                 if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) {
                         kp->cmd_name = NULL;
                         return 0;
@@ -2833,6 +2813,7 @@ int kdb_unregister(char *cmd)
         /* Couldn't find it.  */
         return 1;
 }
+EXPORT_SYMBOL_GPL(kdb_unregister);
 
 /* Initialize the kdb command table. */
 static void __init kdb_inittab(void)
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index c438f545a321..35d69ed1dfb5 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -15,29 +15,6 @@
 #include <linux/kgdb.h>
 #include "../debug_core.h"
 
-/* Kernel Debugger Error codes.  Must not overlap with command codes. */
-#define KDB_NOTFOUND    (-1)
-#define KDB_ARGCOUNT    (-2)
-#define KDB_BADWIDTH    (-3)
-#define KDB_BADRADIX    (-4)
-#define KDB_NOTENV      (-5)
-#define KDB_NOENVVALUE  (-6)
-#define KDB_NOTIMP      (-7)
-#define KDB_ENVFULL     (-8)
-#define KDB_ENVBUFFULL  (-9)
-#define KDB_TOOMANYBPT  (-10)
-#define KDB_TOOMANYDBREGS (-11)
-#define KDB_DUPBPT      (-12)
-#define KDB_BPTNOTFOUND (-13)
-#define KDB_BADMODE     (-14)
-#define KDB_BADINT      (-15)
-#define KDB_INVADDRFMT  (-16)
-#define KDB_BADREG      (-17)
-#define KDB_BADCPUNUM   (-18)
-#define KDB_BADLENGTH   (-19)
-#define KDB_NOBP        (-20)
-#define KDB_BADADDR     (-21)
-
 /* Kernel Debugger Command codes.  Must not overlap with error codes. */
 #define KDB_CMD_GO      (-1001)
 #define KDB_CMD_CPU     (-1002)
@@ -93,17 +70,6 @@
  */
 #define KDB_MAXBPT      16
 
-/* Maximum number of arguments to a function  */
-#define KDB_MAXARGS    16
-
-typedef enum {
-        KDB_REPEAT_NONE = 0,    /* Do not repeat this command */
-        KDB_REPEAT_NO_ARGS,     /* Repeat the command without arguments */
-        KDB_REPEAT_WITH_ARGS,   /* Repeat the command including its arguments */
-} kdb_repeat_t;
-
-typedef int (*kdb_func_t)(int, const char **);
-
 /* Symbol table format returned by kallsyms. */
 typedef struct __ksymtab {
                 unsigned long value;    /* Address of symbol */
@@ -123,11 +89,6 @@ extern int kallsyms_symbol_next(char *prefix_name, int flag);
 extern int kallsyms_symbol_complete(char *prefix_name, int max_len);
 
 /* Exported Symbols for kernel loadable modules to use. */
-extern int kdb_register(char *, kdb_func_t, char *, char *, short);
-extern int kdb_register_repeat(char *, kdb_func_t, char *, char *,
-                               short, kdb_repeat_t);
-extern int kdb_unregister(char *);
-
 extern int kdb_getarea_size(void *, unsigned long, size_t);
 extern int kdb_putarea_size(unsigned long, void *, size_t);
 
@@ -144,6 +105,7 @@ extern int kdb_getword(unsigned long *, unsigned long, size_t);
 extern int kdb_putword(unsigned long, unsigned long, size_t);
 
 extern int kdbgetularg(const char *, unsigned long *);
+extern int kdbgetu64arg(const char *, u64 *);
 extern char *kdbgetenv(const char *);
 extern int kdbgetaddrarg(int, const char **, int*, unsigned long *,
                          long *, char **);
@@ -255,7 +217,6 @@ extern void kdb_ps1(const struct task_struct *p);
 extern void kdb_print_nameval(const char *name, unsigned long val);
 extern void kdb_send_sig_info(struct task_struct *p, struct siginfo *info);
 extern void kdb_meminfo_proc_show(void);
-extern const char *kdb_walk_kallsyms(loff_t *pos);
 extern char *kdb_getstr(char *, size_t, char *);
 
 /* Defines for kdb_symbol_print */
diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
index 45344d5c53dd..6b2485dcb050 100644
--- a/kernel/debug/kdb/kdb_support.c
+++ b/kernel/debug/kdb/kdb_support.c
@@ -82,8 +82,8 @@ static char *kdb_name_table[100];	/* arbitrary size */
 int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
 {
         int ret = 0;
-        unsigned long symbolsize;
-        unsigned long offset;
+        unsigned long symbolsize = 0;
+        unsigned long offset = 0;
 #define knt1_size 128           /* must be >= kallsyms table size */
         char *knt1 = NULL;
 
diff --git a/kernel/early_res.c b/kernel/early_res.c
deleted file mode 100644
index 7bfae887f211..000000000000
--- a/kernel/early_res.c
+++ /dev/null
@@ -1,590 +0,0 @@
-/*
- * early_res, could be used to replace bootmem
- */
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/init.h>
-#include <linux/bootmem.h>
-#include <linux/mm.h>
-#include <linux/early_res.h>
-#include <linux/slab.h>
-#include <linux/kmemleak.h>
-
-/*
- * Early reserved memory areas.
- */
-/*
- * need to make sure this one is bigger enough before
- * find_fw_memmap_area could be used
- */
-#define MAX_EARLY_RES_X 32
-
-struct early_res {
-        u64 start, end;
-        char name[15];
-        char overlap_ok;
-};
-static struct early_res early_res_x[MAX_EARLY_RES_X] __initdata;
-
-static int max_early_res __initdata = MAX_EARLY_RES_X;
-static struct early_res *early_res __initdata = &early_res_x[0];
-static int early_res_count __initdata;
-
-static int __init find_overlapped_early(u64 start, u64 end)
-{
-        int i;
-        struct early_res *r;
-
-        for (i = 0; i < max_early_res && early_res[i].end; i++) {
-                r = &early_res[i];
-                if (end > r->start && start < r->end)
-                        break;
-        }
-
-        return i;
-}
-
-/*
- * Drop the i-th range from the early reservation map,
- * by copying any higher ranges down one over it, and
- * clearing what had been the last slot.
- */
-static void __init drop_range(int i)
-{
-        int j;
-
-        for (j = i + 1; j < max_early_res && early_res[j].end; j++)
-                ;
-
-        memmove(&early_res[i], &early_res[i + 1],
-               (j - 1 - i) * sizeof(struct early_res));
-
-        early_res[j - 1].end = 0;
-        early_res_count--;
-}
-
-static void __init drop_range_partial(int i, u64 start, u64 end)
-{
-        u64 common_start, common_end;
-        u64 old_start, old_end;
-
-        old_start = early_res[i].start;
-        old_end = early_res[i].end;
-        common_start = max(old_start, start);
-        common_end = min(old_end, end);
-
-        /* no overlap ? */
-        if (common_start >= common_end)
-                return;
-
-        if (old_start < common_start) {
-                /* make head segment */
-                early_res[i].end = common_start;
-                if (old_end > common_end) {
-                        char name[15];
-
-                        /*
-                         * Save a local copy of the name, since the
-                         * early_res array could get resized inside
-                         * reserve_early_without_check() ->
-                         * __check_and_double_early_res(), which would
-                         * make the current name pointer invalid.
-                         */
-                        strncpy(name, early_res[i].name,
-                                         sizeof(early_res[i].name) - 1);
-                        /* add another for left over on tail */
-                        reserve_early_without_check(common_end, old_end, name);
-                }
-                return;
-        } else {
-                if (old_end > common_end) {
-                        /* reuse the entry for tail left */
-                        early_res[i].start = common_end;
-                        return;
-                }
-                /* all covered */
-                drop_range(i);
-        }
-}
-
-/*
- * Split any existing ranges that:
- *  1) are marked 'overlap_ok', and
- *  2) overlap with the stated range [start, end)
- * into whatever portion (if any) of the existing range is entirely
- * below or entirely above the stated range.  Drop the portion
- * of the existing range that overlaps with the stated range,
- * which will allow the caller of this routine to then add that
- * stated range without conflicting with any existing range.
- */
-static void __init drop_overlaps_that_are_ok(u64 start, u64 end)
-{
-        int i;
-        struct early_res *r;
-        u64 lower_start, lower_end;
-        u64 upper_start, upper_end;
-        char name[15];
-
-        for (i = 0; i < max_early_res && early_res[i].end; i++) {
-                r = &early_res[i];
-
-                /* Continue past non-overlapping ranges */
-                if (end <= r->start || start >= r->end)
-                        continue;
-
-                /*
-                 * Leave non-ok overlaps as is; let caller
-                 * panic "Overlapping early reservations"
-                 * when it hits this overlap.
-                 */
-                if (!r->overlap_ok)
-                        return;
-
-                /*
-                 * We have an ok overlap.  We will drop it from the early
-                 * reservation map, and add back in any non-overlapping
-                 * portions (lower or upper) as separate, overlap_ok,
-                 * non-overlapping ranges.
-                 */
-
-                /* 1. Note any non-overlapping (lower or upper) ranges. */
-                strncpy(name, r->name, sizeof(name) - 1);
-
-                lower_start = lower_end = 0;
-                upper_start = upper_end = 0;
-                if (r->start < start) {
-                        lower_start = r->start;
-                        lower_end = start;
-                }
-                if (r->end > end) {
-                        upper_start = end;
-                        upper_end = r->end;
-                }
-
-                /* 2. Drop the original ok overlapping range */
-                drop_range(i);
-
-                i--;            /* resume for-loop on copied down entry */
-
-                /* 3. Add back in any non-overlapping ranges. */
-                if (lower_end)
-                        reserve_early_overlap_ok(lower_start, lower_end, name);
-                if (upper_end)
-                        reserve_early_overlap_ok(upper_start, upper_end, name);
-        }
-}
-
-static void __init __reserve_early(u64 start, u64 end, char *name,
-                                                int overlap_ok)
-{
-        int i;
-        struct early_res *r;
-
-        i = find_overlapped_early(start, end);
-        if (i >= max_early_res)
-                panic("Too many early reservations");
-        r = &early_res[i];
-        if (r->end)
-                panic("Overlapping early reservations "
-                      "%llx-%llx %s to %llx-%llx %s\n",
-                      start, end - 1, name ? name : "", r->start,
-                      r->end - 1, r->name);
-        r->start = start;
-        r->end = end;
-        r->overlap_ok = overlap_ok;
-        if (name)
-                strncpy(r->name, name, sizeof(r->name) - 1);
-        early_res_count++;
-}
-
-/*
- * A few early reservtations come here.
- *
- * The 'overlap_ok' in the name of this routine does -not- mean it
- * is ok for these reservations to overlap an earlier reservation.
- * Rather it means that it is ok for subsequent reservations to
- * overlap this one.
- *
- * Use this entry point to reserve early ranges when you are doing
- * so out of "Paranoia", reserving perhaps more memory than you need,
- * just in case, and don't mind a subsequent overlapping reservation
- * that is known to be needed.
- *
- * The drop_overlaps_that_are_ok() call here isn't really needed.
- * It would be needed if we had two colliding 'overlap_ok'
- * reservations, so that the second such would not panic on the
- * overlap with the first.  We don't have any such as of this
- * writing, but might as well tolerate such if it happens in
- * the future.
- */
-void __init reserve_early_overlap_ok(u64 start, u64 end, char *name)
-{
-        drop_overlaps_that_are_ok(start, end);
-        __reserve_early(start, end, name, 1);
-}
-
-static void __init __check_and_double_early_res(u64 ex_start, u64 ex_end)
-{
-        u64 start, end, size, mem;
-        struct early_res *new;
-
-        /* do we have enough slots left ? */
-        if ((max_early_res - early_res_count) > max(max_early_res/8, 2))
-                return;
-
-        /* double it */
-        mem = -1ULL;
-        size = sizeof(struct early_res) * max_early_res * 2;
-        if (early_res == early_res_x)
-                start = 0;
-        else
-                start = early_res[0].end;
-        end = ex_start;
-        if (start + size < end)
-                mem = find_fw_memmap_area(start, end, size,
-                                         sizeof(struct early_res));
-        if (mem == -1ULL) {
-                start = ex_end;
-                end = get_max_mapped();
-                if (start + size < end)
-                        mem = find_fw_memmap_area(start, end, size,
-                                                 sizeof(struct early_res));
-        }
-        if (mem == -1ULL)
-                panic("can not find more space for early_res array");
-
-        new = __va(mem);
-        /* save the first one for own */
-        new[0].start = mem;
-        new[0].end = mem + size;
-        new[0].overlap_ok = 0;
-        /* copy old to new */
-        if (early_res == early_res_x) {
-                memcpy(&new[1], &early_res[0],
-                         sizeof(struct early_res) * max_early_res);
-                memset(&new[max_early_res+1], 0,
-                         sizeof(struct early_res) * (max_early_res - 1));
-                early_res_count++;
-        } else {
-                memcpy(&new[1], &early_res[1],
-                         sizeof(struct early_res) * (max_early_res - 1));
-                memset(&new[max_early_res], 0,
-                         sizeof(struct early_res) * max_early_res);
-        }
-        memset(&early_res[0], 0, sizeof(struct early_res) * max_early_res);
-        early_res = new;
-        max_early_res *= 2;
-        printk(KERN_DEBUG "early_res array is doubled to %d at [%llx - %llx]\n",
-                max_early_res, mem, mem + size - 1);
-}
-
-/*
- * Most early reservations come here.
- *
- * We first have drop_overlaps_that_are_ok() drop any pre-existing
- * 'overlap_ok' ranges, so that we can then reserve this memory
- * range without risk of panic'ing on an overlapping overlap_ok
- * early reservation.
- */
-void __init reserve_early(u64 start, u64 end, char *name)
-{
-        if (start >= end)
-                return;
-
-        __check_and_double_early_res(start, end);
-
-        drop_overlaps_that_are_ok(start, end);
-        __reserve_early(start, end, name, 0);
-}
-
-void __init reserve_early_without_check(u64 start, u64 end, char *name)
-{
-        struct early_res *r;
-
-        if (start >= end)
-                return;
-
-        __check_and_double_early_res(start, end);
-
-        r = &early_res[early_res_count];
-
-        r->start = start;
-        r->end = end;
-        r->overlap_ok = 0;
-        if (name)
-                strncpy(r->name, name, sizeof(r->name) - 1);
-        early_res_count++;
-}
-
-void __init free_early(u64 start, u64 end)
-{
-        struct early_res *r;
-        int i;
-
-        kmemleak_free_part(__va(start), end - start);
-
-        i = find_overlapped_early(start, end);
-        r = &early_res[i];
-        if (i >= max_early_res || r->end != end || r->start != start)
-                panic("free_early on not reserved area: %llx-%llx!",
-                         start, end - 1);
-
-        drop_range(i);
-}
-
-void __init free_early_partial(u64 start, u64 end)
-{
-        struct early_res *r;
-        int i;
-
-        kmemleak_free_part(__va(start), end - start);
-
-        if (start == end)
-                return;
-
-        if (WARN_ONCE(start > end, "  wrong range [%#llx, %#llx]\n", start, end))
-                return;
-
-try_next:
-        i = find_overlapped_early(start, end);
-        if (i >= max_early_res)
-                return;
-
-        r = &early_res[i];
-        /* hole ? */
-        if (r->end >= end && r->start <= start) {
-                drop_range_partial(i, start, end);
-                return;
-        }
-
-        drop_range_partial(i, start, end);
-        goto try_next;
-}
-
-#ifdef CONFIG_NO_BOOTMEM
-static void __init subtract_early_res(struct range *range, int az)
-{
-        int i, count;
-        u64 final_start, final_end;
-        int idx = 0;
-
-        count  = 0;
-        for (i = 0; i < max_early_res && early_res[i].end; i++)
-                count++;
-
-        /* need to skip first one ?*/
-        if (early_res != early_res_x)
-                idx = 1;
-
-#define DEBUG_PRINT_EARLY_RES 1
-
-#if DEBUG_PRINT_EARLY_RES
-        printk(KERN_INFO "Subtract (%d early reservations)\n", count);
-#endif
-        for (i = idx; i < count; i++) {
-                struct early_res *r = &early_res[i];
-#if DEBUG_PRINT_EARLY_RES
-                printk(KERN_INFO "  #%d [%010llx - %010llx] %15s\n", i,
-                        r->start, r->end, r->name);
-#endif
-                final_start = PFN_DOWN(r->start);
-                final_end = PFN_UP(r->end);
-                if (final_start >= final_end)
-                        continue;
-                subtract_range(range, az, final_start, final_end);
-        }
-
-}
-
-int __init get_free_all_memory_range(struct range **rangep, int nodeid)
-{
-        int i, count;
-        u64 start = 0, end;
-        u64 size;
-        u64 mem;
-        struct range *range;
-        int nr_range;
-
-        count  = 0;
-        for (i = 0; i < max_early_res && early_res[i].end; i++)
-                count++;
-
-        count *= 2;
-
-        size = sizeof(struct range) * count;
-        end = get_max_mapped();
-#ifdef MAX_DMA32_PFN
-        if (end > (MAX_DMA32_PFN << PAGE_SHIFT))
-                start = MAX_DMA32_PFN << PAGE_SHIFT;
-#endif
-        mem = find_fw_memmap_area(start, end, size, sizeof(struct range));
-        if (mem == -1ULL)
-                panic("can not find more space for range free");
-
-        range = __va(mem);
-        /* use early_node_map[] and early_res to get range array at first */
-        memset(range, 0, size);
-        nr_range = 0;
-
-        /* need to go over early_node_map to find out good range for node */
-        nr_range = add_from_early_node_map(range, count, nr_range, nodeid);
-#ifdef CONFIG_X86_32
-        subtract_range(range, count, max_low_pfn, -1ULL);
-#endif
-        subtract_early_res(range, count);
-        nr_range = clean_sort_range(range, count);
-
-        /* need to clear it ? */
-        if (nodeid == MAX_NUMNODES) {
-                memset(&early_res[0], 0,
-                         sizeof(struct early_res) * max_early_res);
-                early_res = NULL;
-                max_early_res = 0;
-        }
-
-        *rangep = range;
-        return nr_range;
-}
-#else
-void __init early_res_to_bootmem(u64 start, u64 end)
-{
-        int i, count;
-        u64 final_start, final_end;
-        int idx = 0;
-
-        count  = 0;
-        for (i = 0; i < max_early_res && early_res[i].end; i++)
-                count++;
-
-        /* need to skip first one ?*/
-        if (early_res != early_res_x)
-                idx = 1;
-
-        printk(KERN_INFO "(%d/%d early reservations) ==> bootmem [%010llx - %010llx]\n",
-                         count - idx, max_early_res, start, end);
-        for (i = idx; i < count; i++) {
-                struct early_res *r = &early_res[i];
-                printk(KERN_INFO "  #%d [%010llx - %010llx] %16s", i,
-                        r->start, r->end, r->name);
-                final_start = max(start, r->start);
-                final_end = min(end, r->end);
-                if (final_start >= final_end) {
-                        printk(KERN_CONT "\n");
-                        continue;
-                }
-                printk(KERN_CONT " ==> [%010llx - %010llx]\n",
-                        final_start, final_end);
-                reserve_bootmem_generic(final_start, final_end - final_start,
-                                BOOTMEM_DEFAULT);
-        }
-        /* clear them */
-        memset(&early_res[0], 0, sizeof(struct early_res) * max_early_res);
-        early_res = NULL;
-        max_early_res = 0;
-        early_res_count = 0;
-}
-#endif
-
-/* Check for already reserved areas */
-static inline int __init bad_addr(u64 *addrp, u64 size, u64 align)
-{
-        int i;
-        u64 addr = *addrp;
-        int changed = 0;
-        struct early_res *r;
-again:
-        i = find_overlapped_early(addr, addr + size);
-        r = &early_res[i];
-        if (i < max_early_res && r->end) {
-                *addrp = addr = round_up(r->end, align);
-                changed = 1;
-                goto again;
-        }
-        return changed;
-}
-
-/* Check for already reserved areas */
-static inline int __init bad_addr_size(u64 *addrp, u64 *sizep, u64 align)
-{
-        int i;
-        u64 addr = *addrp, last;
-        u64 size = *sizep;
-        int changed = 0;
-again:
-        last = addr + size;
-        for (i = 0; i < max_early_res && early_res[i].end; i++) {
-                struct early_res *r = &early_res[i];
-                if (last > r->start && addr < r->start) {
-                        size = r->start - addr;
-                        changed = 1;
-                        goto again;
-                }
-                if (last > r->end && addr < r->end) {
-                        addr = round_up(r->end, align);
-                        size = last - addr;
-                        changed = 1;
-                        goto again;
-                }
-                if (last <= r->end && addr >= r->start) {
-                        (*sizep)++;
-                        return 0;
-                }
-        }
-        if (changed) {
-                *addrp = addr;
-                *sizep = size;
-        }
-        return changed;
-}
-
-/*
- * Find a free area with specified alignment in a specific range.
- * only with the area.between start to end is active range from early_node_map
- * so they are good as RAM
- */
-u64 __init find_early_area(u64 ei_start, u64 ei_last, u64 start, u64 end,
-                         u64 size, u64 align)
-{
-        u64 addr, last;
-
-        addr = round_up(ei_start, align);
-        if (addr < start)
-                addr = round_up(start, align);
-        if (addr >= ei_last)
-                goto out;
-        while (bad_addr(&addr, size, align) && addr+size <= ei_last)
-                ;
-        last = addr + size;
-        if (last > ei_last)
-                goto out;
-        if (last > end)
-                goto out;
-
-        return addr;
-
-out:
-        return -1ULL;
-}
-
-u64 __init find_early_area_size(u64 ei_start, u64 ei_last, u64 start,
-                         u64 *sizep, u64 align)
-{
-        u64 addr, last;
-
-        addr = round_up(ei_start, align);
-        if (addr < start)
-                addr = round_up(start, align);
-        if (addr >= ei_last)
-                goto out;
-        *sizep = ei_last - addr;
-        while (bad_addr_size(&addr, sizep, align) && addr + *sizep <= ei_last)
-                ;
-        last = addr + *sizep;
-        if (last > ei_last)
-                goto out;
-
-        return addr;
-
-out:
-        return -1ULL;
-}
diff --git a/kernel/exit.c b/kernel/exit.c
index ceffc67b564a..676149a4ac5f 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -50,6 +50,7 @@
 #include <linux/perf_event.h>
 #include <trace/events/sched.h>
 #include <linux/hw_breakpoint.h>
+#include <linux/oom.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -95,6 +96,14 @@ static void __exit_signal(struct task_struct *tsk)
                 sig->tty = NULL;
         } else {
                 /*
+                 * This can only happen if the caller is de_thread().
+                 * FIXME: this is the temporary hack, we should teach
+                 * posix-cpu-timers to handle this case correctly.
+                 */
+                if (unlikely(has_group_leader_pid(tsk)))
+                        posix_cpu_timers_exit_group(tsk);
+
+                /*
                  * If there is any task waiting for the group exit
                  * then notify it:
                  */
@@ -149,9 +158,7 @@ static void delayed_put_task_struct(struct rcu_head *rhp)
 {
         struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
 
-#ifdef CONFIG_PERF_EVENTS
-        WARN_ON_ONCE(tsk->perf_event_ctxp);
-#endif
+        perf_event_delayed_put(tsk);
         trace_sched_process_free(tsk);
         put_task_struct(tsk);
 }
@@ -689,6 +696,8 @@ static void exit_mm(struct task_struct * tsk)
         enter_lazy_tlb(mm, current);
         /* We don't want this task to be frozen prematurely */
         clear_freeze_flag(tsk);
+        if (tsk->signal->oom_score_adj == OOM_SCORE_ADJ_MIN)
+                atomic_dec(&mm->oom_disable_count);
         task_unlock(tsk);
         mm_update_next_owner(mm);
         mmput(mm);
@@ -702,6 +711,8 @@ static void exit_mm(struct task_struct * tsk)
  * space.
  */
 static struct task_struct *find_new_reaper(struct task_struct *father)
+        __releases(&tasklist_lock)
+        __acquires(&tasklist_lock)
 {
         struct pid_namespace *pid_ns = task_active_pid_ns(father);
         struct task_struct *thread;
@@ -771,9 +782,12 @@ static void forget_original_parent(struct task_struct *father)
         struct task_struct *p, *n, *reaper;
         LIST_HEAD(dead_children);
 
-        exit_ptrace(father);
-
         write_lock_irq(&tasklist_lock);
+        /*
+         * Note that exit_ptrace() and find_new_reaper() might
+         * drop tasklist_lock and reacquire it.
+         */
+        exit_ptrace(father);
         reaper = find_new_reaper(father);
 
         list_for_each_entry_safe(p, n, &father->children, sibling) {
@@ -900,6 +914,15 @@ NORET_TYPE void do_exit(long code)
         if (unlikely(!tsk->pid))
                 panic("Attempted to kill the idle task!");
 
+        /*
+         * If do_exit is called because this processes oopsed, it's possible
+         * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+         * continuing. Amongst other possible reasons, this is to prevent
+         * mm_release()->clear_child_tid() from writing to a user-controlled
+         * kernel address.
+         */
+        set_fs(USER_DS);
+
         tracehook_report_exit(&code);
 
         validate_creds_for_do_exit(tsk);
@@ -1383,8 +1406,7 @@ static int wait_task_stopped(struct wait_opts *wo,
         if (!unlikely(wo->wo_flags & WNOWAIT))
                 *p_code = 0;
 
-        /* don't need the RCU readlock here as we're holding a spinlock */
-        uid = __task_cred(p)->uid;
+        uid = task_uid(p);
 unlock_sig:
         spin_unlock_irq(&p->sighand->siglock);
         if (!exit_code)
@@ -1457,7 +1479,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
         }
         if (!unlikely(wo->wo_flags & WNOWAIT))
                 p->signal->flags &= ~SIGNAL_STOP_CONTINUED;
-        uid = __task_cred(p)->uid;
+        uid = task_uid(p);
         spin_unlock_irq(&p->sighand->siglock);
 
         pid = task_pid_vnr(p);
diff --git a/kernel/fork.c b/kernel/fork.c
index 98b450876f93..5447dc7defa9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -65,6 +65,7 @@
 #include <linux/perf_event.h>
 #include <linux/posix-timers.h>
 #include <linux/user-return-notifier.h>
+#include <linux/oom.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -272,6 +273,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
 
         setup_thread_stack(tsk, orig);
         clear_user_return_notifier(tsk);
+        clear_tsk_need_resched(tsk);
         stackend = end_of_stack(tsk);
         *stackend = STACK_END_MAGIC;    /* for overflow detection */
 
@@ -300,7 +302,7 @@ out:
 #ifdef CONFIG_MMU
 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
 {
-        struct vm_area_struct *mpnt, *tmp, **pprev;
+        struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
         struct rb_node **rb_link, *rb_parent;
         int retval;
         unsigned long charge;
@@ -328,6 +330,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
         if (retval)
                 goto out;
 
+        prev = NULL;
         for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
                 struct file *file;
 
@@ -355,11 +358,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                 if (IS_ERR(pol))
                         goto fail_nomem_policy;
                 vma_set_policy(tmp, pol);
+                tmp->vm_mm = mm;
                 if (anon_vma_fork(tmp, mpnt))
                         goto fail_nomem_anon_vma_fork;
                 tmp->vm_flags &= ~VM_LOCKED;
-                tmp->vm_mm = mm;
-                tmp->vm_next = NULL;
+                tmp->vm_next = tmp->vm_prev = NULL;
                 file = tmp->vm_file;
                 if (file) {
                         struct inode *inode = file->f_path.dentry->d_inode;
@@ -392,6 +395,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                  */
                 *pprev = tmp;
                 pprev = &tmp->vm_next;
+                tmp->vm_prev = prev;
+                prev = tmp;
 
                 __vma_link_rb(mm, tmp, rb_link, rb_parent);
                 rb_link = &tmp->vm_rb.rb_right;
@@ -485,6 +490,7 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
         mm->cached_hole_size = ~0UL;
         mm_init_aio(mm);
         mm_init_owner(mm, p);
+        atomic_set(&mm->oom_disable_count, 0);
 
         if (likely(!mm_alloc_pgd(mm))) {
                 mm->def_flags = 0;
@@ -738,6 +744,8 @@ good_mm:
         /* Initializing for Swap token stuff */
         mm->token_priority = 0;
         mm->last_interval = 0;
+        if (tsk->signal->oom_score_adj == OOM_SCORE_ADJ_MIN)
+                atomic_inc(&mm->oom_disable_count);
 
         tsk->mm = mm;
         tsk->active_mm = mm;
@@ -752,13 +760,13 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
         struct fs_struct *fs = current->fs;
         if (clone_flags & CLONE_FS) {
                 /* tsk->fs is already what we want */
-                write_lock(&fs->lock);
+                spin_lock(&fs->lock);
                 if (fs->in_exec) {
-                        write_unlock(&fs->lock);
+                        spin_unlock(&fs->lock);
                         return -EAGAIN;
                 }
                 fs->users++;
-                write_unlock(&fs->lock);
+                spin_unlock(&fs->lock);
                 return 0;
         }
         tsk->fs = copy_fs_struct(fs);
@@ -901,6 +909,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         sig->oom_adj = current->signal->oom_adj;
         sig->oom_score_adj = current->signal->oom_score_adj;
 
+        mutex_init(&sig->cred_guard_mutex);
+
         return 0;
 }
 
@@ -1296,8 +1306,13 @@ bad_fork_cleanup_io:
 bad_fork_cleanup_namespaces:
         exit_task_namespaces(p);
 bad_fork_cleanup_mm:
-        if (p->mm)
+        if (p->mm) {
+                task_lock(p);
+                if (p->signal->oom_score_adj == OOM_SCORE_ADJ_MIN)
+                        atomic_dec(&p->mm->oom_disable_count);
+                task_unlock(p);
                 mmput(p->mm);
+        }
 bad_fork_cleanup_signal:
         if (!(clone_flags & CLONE_THREAD))
                 free_signal_struct(p->signal);
@@ -1676,13 +1691,13 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
 
                 if (new_fs) {
                         fs = current->fs;
-                        write_lock(&fs->lock);
+                        spin_lock(&fs->lock);
                         current->fs = new_fs;
                         if (--fs->users)
                                 new_fs = NULL;
                         else
                                 new_fs = fs;
-                        write_unlock(&fs->lock);
+                        spin_unlock(&fs->lock);
                 }
 
                 if (new_mm) {
@@ -1690,6 +1705,10 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
                         active_mm = current->active_mm;
                         current->mm = new_mm;
                         current->active_mm = new_mm;
+                        if (current->signal->oom_score_adj == OOM_SCORE_ADJ_MIN) {
+                                atomic_dec(&mm->oom_disable_count);
+                                atomic_inc(&new_mm->oom_disable_count);
+                        }
                         activate_mm(active_mm, new_mm);
                         new_mm = mm;
                 }
diff --git a/kernel/futex.c b/kernel/futex.c
index 6a3a5fa1526d..40a8777a27d0 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -91,6 +91,7 @@ struct futex_pi_state {
 
 /**
  * struct futex_q - The hashed futex queue entry, one per waiting task
+ * @list:               priority-sorted list of tasks waiting on this futex
  * @task:               the task waiting on the futex
  * @lock_ptr:           the hash bucket lock
  * @key:                the key the futex is hashed on
@@ -104,7 +105,7 @@ struct futex_pi_state {
  *
  * A futex_q has a woken state, just like tasks have TASK_RUNNING.
  * It is considered woken when plist_node_empty(&q->list) || q->lock_ptr == 0.
- * The order of wakup is always to make the first condition true, then
+ * The order of wakeup is always to make the first condition true, then
  * the second.
  *
  * PI futexes are typically woken before they are removed from the hash list via
@@ -168,7 +169,7 @@ static void get_futex_key_refs(union futex_key *key)
 
         switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
         case FUT_OFF_INODE:
-                atomic_inc(&key->shared.inode->i_count);
+                ihold(key->shared.inode);
                 break;
         case FUT_OFF_MMSHARED:
                 atomic_inc(&key->private.mm->mm_count);
@@ -295,7 +296,7 @@ void put_futex_key(int fshared, union futex_key *key)
  * Slow path to fixup the fault we just took in the atomic write
  * access to @uaddr.
  *
- * We have no generic implementation of a non destructive write to the
+ * We have no generic implementation of a non-destructive write to the
  * user address. We know that we faulted in the atomic pagefault
  * disabled section so we can as well avoid the #PF overhead by
  * calling get_user_pages() right away.
@@ -515,7 +516,7 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
                          */
                         pi_state = this->pi_state;
                         /*
-                         * Userspace might have messed up non PI and PI futexes
+                         * Userspace might have messed up non-PI and PI futexes
                          */
                         if (unlikely(!pi_state))
                                 return -EINVAL;
@@ -736,8 +737,8 @@ static void wake_futex(struct futex_q *q)
 
         /*
          * We set q->lock_ptr = NULL _before_ we wake up the task. If
-         * a non futex wake up happens on another CPU then the task
-         * might exit and p would dereference a non existing task
+         * a non-futex wake up happens on another CPU then the task
+         * might exit and p would dereference a non-existing task
          * struct. Prevent this by holding a reference on p across the
          * wake up.
          */
@@ -1131,11 +1132,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
 
 /**
  * futex_requeue() - Requeue waiters from uaddr1 to uaddr2
- * uaddr1:      source futex user address
- * uaddr2:      target futex user address
- * nr_wake:     number of waiters to wake (must be 1 for requeue_pi)
- * nr_requeue:  number of waiters to requeue (0-INT_MAX)
- * requeue_pi:  if we are attempting to requeue from a non-pi futex to a
+ * @uaddr1:     source futex user address
+ * @fshared:    0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
+ * @uaddr2:     target futex user address
+ * @nr_wake:    number of waiters to wake (must be 1 for requeue_pi)
+ * @nr_requeue: number of waiters to requeue (0-INT_MAX)
+ * @cmpval:     @uaddr1 expected value (or %NULL)
+ * @requeue_pi: if we are attempting to requeue from a non-pi futex to a
  *              pi futex (pi to pi requeue is not supported)
  *
  * Requeue waiters on uaddr1 to uaddr2. In the requeue_pi case, try to acquire
@@ -1360,10 +1363,10 @@ out:
 
 /* The key must be already stored in q->key. */
 static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
+        __acquires(&hb->lock)
 {
         struct futex_hash_bucket *hb;
 
-        get_futex_key_refs(&q->key);
         hb = hash_futex(&q->key);
         q->lock_ptr = &hb->lock;
 
@@ -1373,9 +1376,9 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
 
 static inline void
 queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+        __releases(&hb->lock)
 {
         spin_unlock(&hb->lock);
-        drop_futex_key_refs(&q->key);
 }
 
 /**
@@ -1391,6 +1394,7 @@ queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
  * an example).
  */
 static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
+        __releases(&hb->lock)
 {
         int prio;
 
@@ -1471,6 +1475,7 @@ retry:
  * and dropped here.
  */
 static void unqueue_me_pi(struct futex_q *q)
+        __releases(q->lock_ptr)
 {
         WARN_ON(plist_node_empty(&q->list));
         plist_del(&q->list, &q->list.plist);
@@ -1480,8 +1485,6 @@ static void unqueue_me_pi(struct futex_q *q)
         q->pi_state = NULL;
 
         spin_unlock(q->lock_ptr);
-
-        drop_futex_key_refs(&q->key);
 }
 
 /*
@@ -1812,7 +1815,10 @@ static int futex_wait(u32 __user *uaddr, int fshared,
         }
 
 retry:
-        /* Prepare to wait on uaddr. */
+        /*
+         * Prepare to wait on uaddr. On success, holds hb lock and increments
+         * q.key refs.
+         */
         ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
         if (ret)
                 goto out;
@@ -1822,28 +1828,27 @@ retry:
 
         /* If we were woken (and unqueued), we succeeded, whatever. */
         ret = 0;
+        /* unqueue_me() drops q.key ref */
         if (!unqueue_me(&q))
-                goto out_put_key;
+                goto out;
         ret = -ETIMEDOUT;
         if (to && !to->task)
-                goto out_put_key;
+                goto out;
 
         /*
          * We expect signal_pending(current), but we might be the
          * victim of a spurious wakeup as well.
          */
-        if (!signal_pending(current)) {
-                put_futex_key(fshared, &q.key);
+        if (!signal_pending(current))
                 goto retry;
-        }
 
         ret = -ERESTARTSYS;
         if (!abs_time)
-                goto out_put_key;
+                goto out;
 
         restart = &current_thread_info()->restart_block;
         restart->fn = futex_wait_restart;
-        restart->futex.uaddr = (u32 *)uaddr;
+        restart->futex.uaddr = uaddr;
         restart->futex.val = val;
         restart->futex.time = abs_time->tv64;
         restart->futex.bitset = bitset;
@@ -1856,8 +1861,6 @@ retry:
 
         ret = -ERESTART_RESTARTBLOCK;
 
-out_put_key:
-        put_futex_key(fshared, &q.key);
 out:
         if (to) {
                 hrtimer_cancel(&to->timer);
@@ -1869,7 +1872,7 @@ out:
 
 static long futex_wait_restart(struct restart_block *restart)
 {
-        u32 __user *uaddr = (u32 __user *)restart->futex.uaddr;
+        u32 __user *uaddr = restart->futex.uaddr;
         int fshared = 0;
         ktime_t t, *tp = NULL;
 
@@ -2236,7 +2239,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
         q.rt_waiter = &rt_waiter;
         q.requeue_pi_key = &key2;
 
-        /* Prepare to wait on uaddr. */
+        /*
+         * Prepare to wait on uaddr. On success, increments q.key (key1) ref
+         * count.
+         */
         ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
         if (ret)
                 goto out_key2;
@@ -2254,7 +2260,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
          * In order for us to be here, we know our q.key == key2, and since
          * we took the hb->lock above, we also know that futex_requeue() has
          * completed and we no longer have to concern ourselves with a wakeup
-         * race with the atomic proxy lock acquition by the requeue code.
+         * race with the atomic proxy lock acquisition by the requeue code. The
+         * futex_requeue dropped our key1 reference and incremented our key2
+         * reference count.
          */
 
         /* Check if the requeue code acquired the second futex for us. */
@@ -2458,7 +2466,7 @@ retry:
  */
 static inline int fetch_robust_entry(struct robust_list __user **entry,
                                      struct robust_list __user * __user *head,
-                                     int *pi)
+                                     unsigned int *pi)
 {
         unsigned long uentry;
 
@@ -2481,7 +2489,8 @@ void exit_robust_list(struct task_struct *curr)
 {
         struct robust_list_head __user *head = curr->robust_list;
         struct robust_list __user *entry, *next_entry, *pending;
-        unsigned int limit = ROBUST_LIST_LIMIT, pi, next_pi, pip;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+        unsigned int uninitialized_var(next_pi);
         unsigned long futex_offset;
         int rc;
 
@@ -2647,7 +2656,7 @@ static int __init futex_init(void)
          * of the complex code paths. Also we want to prevent
          * registration of robust lists in that case. NULL is
          * guaranteed to fault and we get -EFAULT on functional
-         * implementation, the non functional ones will return
+         * implementation, the non-functional ones will return
          * -ENOSYS.
          */
         curval = cmpxchg_futex_value_locked(NULL, 0, 0);
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d49afb2395e5..a7934ac75e5b 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -19,7 +19,7 @@
  */
 static inline int
 fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
-                   compat_uptr_t __user *head, int *pi)
+                   compat_uptr_t __user *head, unsigned int *pi)
 {
         if (get_user(*uentry, head))
                 return -EFAULT;
@@ -49,7 +49,8 @@ void compat_exit_robust_list(struct task_struct *curr)
 {
         struct compat_robust_list_head __user *head = curr->compat_robust_list;
         struct robust_list __user *entry, *next_entry, *pending;
-        unsigned int limit = ROBUST_LIST_LIMIT, pi, next_pi, pip;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+        unsigned int uninitialized_var(next_pi);
         compat_uptr_t uentry, next_uentry, upending;
         compat_long_t futex_offset;
         int rc;
diff --git a/kernel/gcov/fs.c b/kernel/gcov/fs.c
index ef3c3f88a7a3..9bd0934f6c33 100644
--- a/kernel/gcov/fs.c
+++ b/kernel/gcov/fs.c
@@ -33,10 +33,11 @@
  * @children: child nodes
  * @all: list head for list of all nodes
  * @parent: parent node
- * @info: associated profiling data structure if not a directory
- * @ghost: when an object file containing profiling data is unloaded we keep a
- *         copy of the profiling data here to allow collecting coverage data
- *         for cleanup code. Such a node is called a "ghost".
+ * @loaded_info: array of pointers to profiling data sets for loaded object
+ *   files.
+ * @num_loaded: number of profiling data sets for loaded object files.
+ * @unloaded_info: accumulated copy of profiling data sets for unloaded
+ *   object files. Used only when gcov_persist=1.
  * @dentry: main debugfs entry, either a directory or data file
  * @links: associated symbolic links
  * @name: data file basename
@@ -51,10 +52,11 @@ struct gcov_node {
         struct list_head children;
         struct list_head all;
         struct gcov_node *parent;
-        struct gcov_info *info;
-        struct gcov_info *ghost;
+        struct gcov_info **loaded_info;
+        struct gcov_info *unloaded_info;
         struct dentry *dentry;
         struct dentry **links;
+        int num_loaded;
         char name[0];
 };
 
@@ -136,16 +138,37 @@ static const struct seq_operations gcov_seq_ops = {
 };
 
 /*
- * Return the profiling data set for a given node. This can either be the
- * original profiling data structure or a duplicate (also called "ghost")
- * in case the associated object file has been unloaded.
+ * Return a profiling data set associated with the given node. This is
+ * either a data set for a loaded object file or a data set copy in case
+ * all associated object files have been unloaded.
  */
 static struct gcov_info *get_node_info(struct gcov_node *node)
 {
-        if (node->info)
-                return node->info;
+        if (node->num_loaded > 0)
+                return node->loaded_info[0];
 
-        return node->ghost;
+        return node->unloaded_info;
+}
+
+/*
+ * Return a newly allocated profiling data set which contains the sum of
+ * all profiling data associated with the given node.
+ */
+static struct gcov_info *get_accumulated_info(struct gcov_node *node)
+{
+        struct gcov_info *info;
+        int i = 0;
+
+        if (node->unloaded_info)
+                info = gcov_info_dup(node->unloaded_info);
+        else
+                info = gcov_info_dup(node->loaded_info[i++]);
+        if (!info)
+                return NULL;
+        for (; i < node->num_loaded; i++)
+                gcov_info_add(info, node->loaded_info[i]);
+
+        return info;
 }
 
 /*
@@ -163,9 +186,10 @@ static int gcov_seq_open(struct inode *inode, struct file *file)
         mutex_lock(&node_lock);
         /*
          * Read from a profiling data copy to minimize reference tracking
-         * complexity and concurrent access.
+         * complexity and concurrent access and to keep accumulating multiple
+         * profiling data sets associated with one node simple.
          */
-        info = gcov_info_dup(get_node_info(node));
+        info = get_accumulated_info(node);
         if (!info)
                 goto out_unlock;
         iter = gcov_iter_new(info);
@@ -225,12 +249,25 @@ static struct gcov_node *get_node_by_name(const char *name)
         return NULL;
 }
 
+/*
+ * Reset all profiling data associated with the specified node.
+ */
+static void reset_node(struct gcov_node *node)
+{
+        int i;
+
+        if (node->unloaded_info)
+                gcov_info_reset(node->unloaded_info);
+        for (i = 0; i < node->num_loaded; i++)
+                gcov_info_reset(node->loaded_info[i]);
+}
+
 static void remove_node(struct gcov_node *node);
 
 /*
  * write() implementation for gcov data files. Reset profiling data for the
- * associated file. If the object file has been unloaded (i.e. this is
- * a "ghost" node), remove the debug fs node as well.
+ * corresponding file. If all associated object files have been unloaded,
+ * remove the debug fs node as well.
  */
 static ssize_t gcov_seq_write(struct file *file, const char __user *addr,
                               size_t len, loff_t *pos)
@@ -245,10 +282,10 @@ static ssize_t gcov_seq_write(struct file *file, const char __user *addr,
         node = get_node_by_name(info->filename);
         if (node) {
                 /* Reset counts or remove node for unloaded modules. */
-                if (node->ghost)
+                if (node->num_loaded == 0)
                         remove_node(node);
                 else
-                        gcov_info_reset(node->info);
+                        reset_node(node);
         }
         /* Reset counts for open file. */
         gcov_info_reset(info);
@@ -378,7 +415,10 @@ static void init_node(struct gcov_node *node, struct gcov_info *info,
         INIT_LIST_HEAD(&node->list);
         INIT_LIST_HEAD(&node->children);
         INIT_LIST_HEAD(&node->all);
-        node->info = info;
+        if (node->loaded_info) {
+                node->loaded_info[0] = info;
+                node->num_loaded = 1;
+        }
         node->parent = parent;
         if (name)
                 strcpy(node->name, name);
@@ -394,9 +434,13 @@ static struct gcov_node *new_node(struct gcov_node *parent,
         struct gcov_node *node;
 
         node = kzalloc(sizeof(struct gcov_node) + strlen(name) + 1, GFP_KERNEL);
-        if (!node) {
-                pr_warning("out of memory\n");
-                return NULL;
+        if (!node)
+                goto err_nomem;
+        if (info) {
+                node->loaded_info = kcalloc(1, sizeof(struct gcov_info *),
+                                           GFP_KERNEL);
+                if (!node->loaded_info)
+                        goto err_nomem;
         }
         init_node(node, info, name, parent);
         /* Differentiate between gcov data file nodes and directory nodes. */
@@ -416,6 +460,11 @@ static struct gcov_node *new_node(struct gcov_node *parent,
         list_add(&node->all, &all_head);
 
         return node;
+
+err_nomem:
+        kfree(node);
+        pr_warning("out of memory\n");
+        return NULL;
 }
 
 /* Remove symbolic links associated with node. */
@@ -441,8 +490,9 @@ static void release_node(struct gcov_node *node)
         list_del(&node->all);
         debugfs_remove(node->dentry);
         remove_links(node);
-        if (node->ghost)
-                gcov_info_free(node->ghost);
+        kfree(node->loaded_info);
+        if (node->unloaded_info)
+                gcov_info_free(node->unloaded_info);
         kfree(node);
 }
 
@@ -477,7 +527,7 @@ static struct gcov_node *get_child_by_name(struct gcov_node *parent,
 
 /*
  * write() implementation for reset file. Reset all profiling data to zero
- * and remove ghost nodes.
+ * and remove nodes for which all associated object files are unloaded.
  */
 static ssize_t reset_write(struct file *file, const char __user *addr,
                            size_t len, loff_t *pos)
@@ -487,8 +537,8 @@ static ssize_t reset_write(struct file *file, const char __user *addr,
         mutex_lock(&node_lock);
 restart:
         list_for_each_entry(node, &all_head, all) {
-                if (node->info)
-                        gcov_info_reset(node->info);
+                if (node->num_loaded > 0)
+                        reset_node(node);
                 else if (list_empty(&node->children)) {
                         remove_node(node);
                         /* Several nodes may have gone - restart loop. */
@@ -511,6 +561,7 @@ static ssize_t reset_read(struct file *file, char __user *addr, size_t len,
 static const struct file_operations gcov_reset_fops = {
         .write  = reset_write,
         .read   = reset_read,
+        .llseek = noop_llseek,
 };
 
 /*
@@ -564,37 +615,115 @@ err_remove:
 }
 
 /*
- * The profiling data set associated with this node is being unloaded. Store a
- * copy of the profiling data and turn this node into a "ghost".
+ * Associate a profiling data set with an existing node. Needs to be called
+ * with node_lock held.
  */
-static int ghost_node(struct gcov_node *node)
+static void add_info(struct gcov_node *node, struct gcov_info *info)
 {
-        node->ghost = gcov_info_dup(node->info);
-        if (!node->ghost) {
-                pr_warning("could not save data for '%s' (out of memory)\n",
-                           node->info->filename);
-                return -ENOMEM;
+        struct gcov_info **loaded_info;
+        int num = node->num_loaded;
+
+        /*
+         * Prepare new array. This is done first to simplify cleanup in
+         * case the new data set is incompatible, the node only contains
+         * unloaded data sets and there's not enough memory for the array.
+         */
+        loaded_info = kcalloc(num + 1, sizeof(struct gcov_info *), GFP_KERNEL);
+        if (!loaded_info) {
+                pr_warning("could not add '%s' (out of memory)\n",
+                           info->filename);
+                return;
+        }
+        memcpy(loaded_info, node->loaded_info,
+               num * sizeof(struct gcov_info *));
+        loaded_info[num] = info;
+        /* Check if the new data set is compatible. */
+        if (num == 0) {
+                /*
+                 * A module was unloaded, modified and reloaded. The new
+                 * data set replaces the copy of the last one.
+                 */
+                if (!gcov_info_is_compatible(node->unloaded_info, info)) {
+                        pr_warning("discarding saved data for %s "
+                                   "(incompatible version)\n", info->filename);
+                        gcov_info_free(node->unloaded_info);
+                        node->unloaded_info = NULL;
+                }
+        } else {
+                /*
+                 * Two different versions of the same object file are loaded.
+                 * The initial one takes precedence.
+                 */
+                if (!gcov_info_is_compatible(node->loaded_info[0], info)) {
+                        pr_warning("could not add '%s' (incompatible "
+                                   "version)\n", info->filename);
+                        kfree(loaded_info);
+                        return;
+                }
         }
-        node->info = NULL;
+        /* Overwrite previous array. */
+        kfree(node->loaded_info);
+        node->loaded_info = loaded_info;
+        node->num_loaded = num + 1;
+}
 
-        return 0;
+/*
+ * Return the index of a profiling data set associated with a node.
+ */
+static int get_info_index(struct gcov_node *node, struct gcov_info *info)
+{
+        int i;
+
+        for (i = 0; i < node->num_loaded; i++) {
+                if (node->loaded_info[i] == info)
+                        return i;
+        }
+        return -ENOENT;
 }
 
 /*
- * Profiling data for this node has been loaded again. Add profiling data
- * from previous instantiation and turn this node into a regular node.
+ * Save the data of a profiling data set which is being unloaded.
  */
-static void revive_node(struct gcov_node *node, struct gcov_info *info)
+static void save_info(struct gcov_node *node, struct gcov_info *info)
 {
-        if (gcov_info_is_compatible(node->ghost, info))
-                gcov_info_add(info, node->ghost);
+        if (node->unloaded_info)
+                gcov_info_add(node->unloaded_info, info);
         else {
-                pr_warning("discarding saved data for '%s' (version changed)\n",
+                node->unloaded_info = gcov_info_dup(info);
+                if (!node->unloaded_info) {
+                        pr_warning("could not save data for '%s' "
+                                   "(out of memory)\n", info->filename);
+                }
+        }
+}
+
+/*
+ * Disassociate a profiling data set from a node. Needs to be called with
+ * node_lock held.
+ */
+static void remove_info(struct gcov_node *node, struct gcov_info *info)
+{
+        int i;
+
+        i = get_info_index(node, info);
+        if (i < 0) {
+                pr_warning("could not remove '%s' (not found)\n",
                            info->filename);
+                return;
         }
-        gcov_info_free(node->ghost);
-        node->ghost = NULL;
-        node->info = info;
+        if (gcov_persist)
+                save_info(node, info);
+        /* Shrink array. */
+        node->loaded_info[i] = node->loaded_info[node->num_loaded - 1];
+        node->num_loaded--;
+        if (node->num_loaded > 0)
+                return;
+        /* Last loaded data set was removed. */
+        kfree(node->loaded_info);
+        node->loaded_info = NULL;
+        node->num_loaded = 0;
+        if (!node->unloaded_info)
+                remove_node(node);
 }
 
 /*
@@ -609,30 +738,18 @@ void gcov_event(enum gcov_action action, struct gcov_info *info)
         node = get_node_by_name(info->filename);
         switch (action) {
         case GCOV_ADD:
-                /* Add new node or revive ghost. */
-                if (!node) {
+                if (node)
+                        add_info(node, info);
+                else
                         add_node(info);
-                        break;
-                }
-                if (gcov_persist)
-                        revive_node(node, info);
-                else {
-                        pr_warning("could not add '%s' (already exists)\n",
-                                   info->filename);
-                }
                 break;
         case GCOV_REMOVE:
-                /* Remove node or turn into ghost. */
-                if (!node) {
+                if (node)
+                        remove_info(node, info);
+                else {
                         pr_warning("could not remove '%s' (not found)\n",
                                    info->filename);
-                        break;
                 }
-                if (gcov_persist) {
-                        if (!ghost_node(node))
-                                break;
-                }
-                remove_node(node);
                 break;
         }
         mutex_unlock(&node_lock);
diff --git a/kernel/groups.c b/kernel/groups.c
index 53b1916c9492..253dc0f35cf4 100644
--- a/kernel/groups.c
+++ b/kernel/groups.c
@@ -143,10 +143,9 @@ int groups_search(const struct group_info *group_info, gid_t grp)
         right = group_info->ngroups;
         while (left < right) {
                 unsigned int mid = (left+right)/2;
-                int cmp = grp - GROUP_AT(group_info, mid);
-                if (cmp > 0)
+                if (grp > GROUP_AT(group_info, mid))
                         left = mid + 1;
-                else if (cmp < 0)
+                else if (grp < GROUP_AT(group_info, mid))
                         right = mid;
                 else
                         return 1;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ce669174f355..72206cf5c6cf 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -931,6 +931,7 @@ static inline int
 remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
 {
         if (hrtimer_is_queued(timer)) {
+                unsigned long state;
                 int reprogram;
 
                 /*
@@ -944,8 +945,13 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
                 debug_deactivate(timer);
                 timer_stats_hrtimer_clear_start_info(timer);
                 reprogram = base->cpu_base == &__get_cpu_var(hrtimer_bases);
-                __remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE,
-                                 reprogram);
+                /*
+                 * We must preserve the CALLBACK state flag here,
+                 * otherwise we could move the timer base in
+                 * switch_hrtimer_base.
+                 */
+                state = timer->state & HRTIMER_STATE_CALLBACK;
+                __remove_hrtimer(timer, base, state, reprogram);
                 return 1;
         }
         return 0;
@@ -1091,11 +1097,10 @@ EXPORT_SYMBOL_GPL(hrtimer_cancel);
  */
 ktime_t hrtimer_get_remaining(const struct hrtimer *timer)
 {
-        struct hrtimer_clock_base *base;
         unsigned long flags;
         ktime_t rem;
 
-        base = lock_hrtimer_base(timer, &flags);
+        lock_hrtimer_base(timer, &flags);
         rem = hrtimer_expires_remaining(timer);
         unlock_hrtimer_base(timer, &flags);
 
@@ -1232,6 +1237,9 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now)
                 BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
                 enqueue_hrtimer(timer, base);
         }
+
+        WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));
+
         timer->state &= ~HRTIMER_STATE_CALLBACK;
 }
 
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 0c642d51aac2..53ead174da2f 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -98,7 +98,7 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
         printk(KERN_ERR "\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\""
                         " disables this message.\n");
         sched_show_task(t);
-        __debug_show_held_locks(t);
+        debug_show_held_locks(t);
 
         touch_nmi_watchdog();
 
@@ -111,7 +111,7 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
  * periodically exit the critical section and enter a new one.
  *
  * For preemptible RCU it is sufficient to call rcu_read_unlock in order
- * exit the grace period. For classic RCU, a reschedule is required.
+ * to exit the grace period. For classic RCU, a reschedule is required.
  */
 static void rcu_lock_break(struct task_struct *g, struct task_struct *t)
 {
diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
index d71a987fd2bf..e5325825aeb6 100644
--- a/kernel/hw_breakpoint.c
+++ b/kernel/hw_breakpoint.c
@@ -113,12 +113,12 @@ static unsigned int max_task_bp_pinned(int cpu, enum bp_type_idx type)
  */
 static int task_bp_pinned(struct perf_event *bp, enum bp_type_idx type)
 {
-        struct perf_event_context *ctx = bp->ctx;
+        struct task_struct *tsk = bp->hw.bp_target;
         struct perf_event *iter;
         int count = 0;
 
         list_for_each_entry(iter, &bp_task_head, hw.bp_list) {
-                if (iter->ctx == ctx && find_slot_idx(iter) == type)
+                if (iter->hw.bp_target == tsk && find_slot_idx(iter) == type)
                         count += hw_breakpoint_weight(iter);
         }
 
@@ -134,7 +134,7 @@ fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp,
                     enum bp_type_idx type)
 {
         int cpu = bp->cpu;
-        struct task_struct *tsk = bp->ctx->task;
+        struct task_struct *tsk = bp->hw.bp_target;
 
         if (cpu >= 0) {
                 slots->pinned = per_cpu(nr_cpu_bp_pinned[type], cpu);
@@ -213,7 +213,7 @@ toggle_bp_slot(struct perf_event *bp, bool enable, enum bp_type_idx type,
                int weight)
 {
         int cpu = bp->cpu;
-        struct task_struct *tsk = bp->ctx->task;
+        struct task_struct *tsk = bp->hw.bp_target;
 
         /* Pinned counter cpu profiling */
         if (!tsk) {
@@ -433,7 +433,7 @@ register_user_hw_breakpoint(struct perf_event_attr *attr,
                             perf_overflow_handler_t triggered,
                             struct task_struct *tsk)
 {
-        return perf_event_create_kernel_counter(attr, -1, tsk->pid, triggered);
+        return perf_event_create_kernel_counter(attr, -1, tsk, triggered);
 }
 EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
 
@@ -515,7 +515,7 @@ register_wide_hw_breakpoint(struct perf_event_attr *attr,
         get_online_cpus();
         for_each_online_cpu(cpu) {
                 pevent = per_cpu_ptr(cpu_events, cpu);
-                bp = perf_event_create_kernel_counter(attr, cpu, -1, triggered);
+                bp = perf_event_create_kernel_counter(attr, cpu, NULL, triggered);
 
                 *pevent = bp;
 
@@ -565,7 +565,62 @@ static struct notifier_block hw_breakpoint_exceptions_nb = {
         .priority = 0x7fffffff
 };
 
-static int __init init_hw_breakpoint(void)
+static void bp_perf_event_destroy(struct perf_event *event)
+{
+        release_bp_slot(event);
+}
+
+static int hw_breakpoint_event_init(struct perf_event *bp)
+{
+        int err;
+
+        if (bp->attr.type != PERF_TYPE_BREAKPOINT)
+                return -ENOENT;
+
+        err = register_perf_hw_breakpoint(bp);
+        if (err)
+                return err;
+
+        bp->destroy = bp_perf_event_destroy;
+
+        return 0;
+}
+
+static int hw_breakpoint_add(struct perf_event *bp, int flags)
+{
+        if (!(flags & PERF_EF_START))
+                bp->hw.state = PERF_HES_STOPPED;
+
+        return arch_install_hw_breakpoint(bp);
+}
+
+static void hw_breakpoint_del(struct perf_event *bp, int flags)
+{
+        arch_uninstall_hw_breakpoint(bp);
+}
+
+static void hw_breakpoint_start(struct perf_event *bp, int flags)
+{
+        bp->hw.state = 0;
+}
+
+static void hw_breakpoint_stop(struct perf_event *bp, int flags)
+{
+        bp->hw.state = PERF_HES_STOPPED;
+}
+
+static struct pmu perf_breakpoint = {
+        .task_ctx_nr    = perf_sw_context, /* could eventually get its own */
+
+        .event_init     = hw_breakpoint_event_init,
+        .add            = hw_breakpoint_add,
+        .del            = hw_breakpoint_del,
+        .start          = hw_breakpoint_start,
+        .stop           = hw_breakpoint_stop,
+        .read           = hw_breakpoint_pmu_read,
+};
+
+int __init init_hw_breakpoint(void)
 {
         unsigned int **task_bp_pinned;
         int cpu, err_cpu;
@@ -586,6 +641,8 @@ static int __init init_hw_breakpoint(void)
 
         constraints_initialized = 1;
 
+        perf_pmu_register(&perf_breakpoint);
+
         return register_die_notifier(&hw_breakpoint_exceptions_nb);
 
  err_alloc:
@@ -598,11 +655,5 @@ static int __init init_hw_breakpoint(void)
 
         return -ENOMEM;
 }
-core_initcall(init_hw_breakpoint);
 
 
-struct pmu perf_ops_bp = {
-        .enable         = arch_install_hw_breakpoint,
-        .disable        = arch_uninstall_hw_breakpoint,
-        .read           = hw_breakpoint_pmu_read,
-};
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
new file mode 100644
index 000000000000..31d766bf5d2e
--- /dev/null
+++ b/kernel/irq/Kconfig
@@ -0,0 +1,53 @@
+config HAVE_GENERIC_HARDIRQS
+        def_bool n
+
+if HAVE_GENERIC_HARDIRQS
+menu "IRQ subsystem"
+#
+# Interrupt subsystem related configuration options
+#
+config GENERIC_HARDIRQS
+       def_bool y
+
+config GENERIC_HARDIRQS_NO__DO_IRQ
+       def_bool y
+
+# Select this to disable the deprecated stuff
+config GENERIC_HARDIRQS_NO_DEPRECATED
+       def_bool n
+
+# Options selectable by the architecture code
+config HAVE_SPARSE_IRQ
+       def_bool n
+
+config GENERIC_IRQ_PROBE
+        def_bool n
+
+config GENERIC_PENDING_IRQ
+        def_bool n
+
+config AUTO_IRQ_AFFINITY
+       def_bool n
+
+config IRQ_PER_CPU
+       def_bool n
+
+config HARDIRQS_SW_RESEND
+       def_bool n
+
+config SPARSE_IRQ
+        bool "Support sparse irq numbering"
+        depends on HAVE_SPARSE_IRQ
+        ---help---
+
+          Sparse irq numbering is useful for distro kernels that want
+          to define a high CONFIG_NR_CPUS value but still want to have
+          low kernel memory footprint on smaller machines.
+
+          ( Sparse irqs can also be beneficial on NUMA boxes, as they spread
+            out the interrupt descriptors in a more NUMA-friendly way. )
+
+          If you don't know what to do here, say N.
+
+endmenu
+endif
diff --git a/kernel/irq/Makefile b/kernel/irq/Makefile
index 7d047808419d..54329cd7b3ee 100644
--- a/kernel/irq/Makefile
+++ b/kernel/irq/Makefile
@@ -1,7 +1,6 @@
 
-obj-y := handle.o manage.o spurious.o resend.o chip.o devres.o
+obj-y := irqdesc.o handle.o manage.o spurious.o resend.o chip.o dummychip.o devres.o
 obj-$(CONFIG_GENERIC_IRQ_PROBE) += autoprobe.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_GENERIC_PENDING_IRQ) += migration.o
-obj-$(CONFIG_NUMA_IRQ_DESC) += numa_migrate.o
 obj-$(CONFIG_PM_SLEEP) += pm.o
diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
index 2295a31ef110..505798f86c36 100644
--- a/kernel/irq/autoprobe.c
+++ b/kernel/irq/autoprobe.c
@@ -57,9 +57,10 @@ unsigned long probe_irq_on(void)
                          * Some chips need to know about probing in
                          * progress:
                          */
-                        if (desc->chip->set_type)
-                                desc->chip->set_type(i, IRQ_TYPE_PROBE);
-                        desc->chip->startup(i);
+                        if (desc->irq_data.chip->irq_set_type)
+                                desc->irq_data.chip->irq_set_type(&desc->irq_data,
+                                                         IRQ_TYPE_PROBE);
+                        desc->irq_data.chip->irq_startup(&desc->irq_data);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -76,7 +77,7 @@ unsigned long probe_irq_on(void)
                 raw_spin_lock_irq(&desc->lock);
                 if (!desc->action && !(desc->status & IRQ_NOPROBE)) {
                         desc->status |= IRQ_AUTODETECT | IRQ_WAITING;
-                        if (desc->chip->startup(i))
+                        if (desc->irq_data.chip->irq_startup(&desc->irq_data))
                                 desc->status |= IRQ_PENDING;
                 }
                 raw_spin_unlock_irq(&desc->lock);
@@ -98,7 +99,7 @@ unsigned long probe_irq_on(void)
                         /* It triggered already - consider it spurious. */
                         if (!(status & IRQ_WAITING)) {
                                 desc->status = status & ~IRQ_AUTODETECT;
-                                desc->chip->shutdown(i);
+                                desc->irq_data.chip->irq_shutdown(&desc->irq_data);
                         } else
                                 if (i < 32)
                                         mask |= 1 << i;
@@ -137,7 +138,7 @@ unsigned int probe_irq_mask(unsigned long val)
                                 mask |= 1 << i;
 
                         desc->status = status & ~IRQ_AUTODETECT;
-                        desc->chip->shutdown(i);
+                        desc->irq_data.chip->irq_shutdown(&desc->irq_data);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -181,7 +182,7 @@ int probe_irq_off(unsigned long val)
                                 nr_of_irqs++;
                         }
                         desc->status = status & ~IRQ_AUTODETECT;
-                        desc->chip->shutdown(i);
+                        desc->irq_data.chip->irq_shutdown(&desc->irq_data);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index b7091d5ca2f8..baa5c4acad83 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -18,108 +18,6 @@
 
 #include "internals.h"
 
-static void dynamic_irq_init_x(unsigned int irq, bool keep_chip_data)
-{
-        struct irq_desc *desc;
-        unsigned long flags;
-
-        desc = irq_to_desc(irq);
-        if (!desc) {
-                WARN(1, KERN_ERR "Trying to initialize invalid IRQ%d\n", irq);
-                return;
-        }
-
-        /* Ensure we don't have left over values from a previous use of this irq */
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->status = IRQ_DISABLED;
-        desc->chip = &no_irq_chip;
-        desc->handle_irq = handle_bad_irq;
-        desc->depth = 1;
-        desc->msi_desc = NULL;
-        desc->handler_data = NULL;
-        if (!keep_chip_data)
-                desc->chip_data = NULL;
-        desc->action = NULL;
-        desc->irq_count = 0;
-        desc->irqs_unhandled = 0;
-#ifdef CONFIG_SMP
-        cpumask_setall(desc->affinity);
-#ifdef CONFIG_GENERIC_PENDING_IRQ
-        cpumask_clear(desc->pending_mask);
-#endif
-#endif
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-}
-
-/**
- *      dynamic_irq_init - initialize a dynamically allocated irq
- *      @irq:   irq number to initialize
- */
-void dynamic_irq_init(unsigned int irq)
-{
-        dynamic_irq_init_x(irq, false);
-}
-
-/**
- *      dynamic_irq_init_keep_chip_data - initialize a dynamically allocated irq
- *      @irq:   irq number to initialize
- *
- *      does not set irq_to_desc(irq)->chip_data to NULL
- */
-void dynamic_irq_init_keep_chip_data(unsigned int irq)
-{
-        dynamic_irq_init_x(irq, true);
-}
-
-static void dynamic_irq_cleanup_x(unsigned int irq, bool keep_chip_data)
-{
-        struct irq_desc *desc = irq_to_desc(irq);
-        unsigned long flags;
-
-        if (!desc) {
-                WARN(1, KERN_ERR "Trying to cleanup invalid IRQ%d\n", irq);
-                return;
-        }
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        if (desc->action) {
-                raw_spin_unlock_irqrestore(&desc->lock, flags);
-                WARN(1, KERN_ERR "Destroying IRQ%d without calling free_irq\n",
-                        irq);
-                return;
-        }
-        desc->msi_desc = NULL;
-        desc->handler_data = NULL;
-        if (!keep_chip_data)
-                desc->chip_data = NULL;
-        desc->handle_irq = handle_bad_irq;
-        desc->chip = &no_irq_chip;
-        desc->name = NULL;
-        clear_kstat_irqs(desc);
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-}
-
-/**
- *      dynamic_irq_cleanup - cleanup a dynamically allocated irq
- *      @irq:   irq number to initialize
- */
-void dynamic_irq_cleanup(unsigned int irq)
-{
-        dynamic_irq_cleanup_x(irq, false);
-}
-
-/**
- *      dynamic_irq_cleanup_keep_chip_data - cleanup a dynamically allocated irq
- *      @irq:   irq number to initialize
- *
- *      does not set irq_to_desc(irq)->chip_data to NULL
- */
-void dynamic_irq_cleanup_keep_chip_data(unsigned int irq)
-{
-        dynamic_irq_cleanup_x(irq, true);
-}
-
-
 /**
  *      set_irq_chip - set the irq chip for an irq
  *      @irq:   irq number
@@ -140,7 +38,7 @@ int set_irq_chip(unsigned int irq, struct irq_chip *chip)
 
         raw_spin_lock_irqsave(&desc->lock, flags);
         irq_chip_set_defaults(chip);
-        desc->chip = chip;
+        desc->irq_data.chip = chip;
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 
         return 0;
@@ -193,7 +91,7 @@ int set_irq_data(unsigned int irq, void *data)
         }
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->handler_data = data;
+        desc->irq_data.handler_data = data;
         raw_spin_unlock_irqrestore(&desc->lock, flags);
         return 0;
 }
@@ -218,7 +116,7 @@ int set_irq_msi(unsigned int irq, struct msi_desc *entry)
         }
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->msi_desc = entry;
+        desc->irq_data.msi_desc = entry;
         if (entry)
                 entry->irq = irq;
         raw_spin_unlock_irqrestore(&desc->lock, flags);
@@ -243,19 +141,27 @@ int set_irq_chip_data(unsigned int irq, void *data)
                 return -EINVAL;
         }
 
-        if (!desc->chip) {
+        if (!desc->irq_data.chip) {
                 printk(KERN_ERR "BUG: bad set_irq_chip_data(IRQ#%d)\n", irq);
                 return -EINVAL;
         }
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->chip_data = data;
+        desc->irq_data.chip_data = data;
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 
         return 0;
 }
 EXPORT_SYMBOL(set_irq_chip_data);
 
+struct irq_data *irq_get_irq_data(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+
+        return desc ? &desc->irq_data : NULL;
+}
+EXPORT_SYMBOL_GPL(irq_get_irq_data);
+
 /**
  *      set_irq_nested_thread - Set/Reset the IRQ_NESTED_THREAD flag of an irq
  *
@@ -287,93 +193,216 @@ EXPORT_SYMBOL_GPL(set_irq_nested_thread);
 /*
  * default enable function
  */
-static void default_enable(unsigned int irq)
+static void default_enable(struct irq_data *data)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_desc *desc = irq_data_to_desc(data);
 
-        desc->chip->unmask(irq);
+        desc->irq_data.chip->irq_unmask(&desc->irq_data);
         desc->status &= ~IRQ_MASKED;
 }
 
 /*
  * default disable function
  */
-static void default_disable(unsigned int irq)
+static void default_disable(struct irq_data *data)
 {
 }
 
 /*
  * default startup function
  */
-static unsigned int default_startup(unsigned int irq)
+static unsigned int default_startup(struct irq_data *data)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_desc *desc = irq_data_to_desc(data);
 
-        desc->chip->enable(irq);
+        desc->irq_data.chip->irq_enable(data);
         return 0;
 }
 
 /*
  * default shutdown function
  */
-static void default_shutdown(unsigned int irq)
+static void default_shutdown(struct irq_data *data)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_desc *desc = irq_data_to_desc(data);
 
-        desc->chip->mask(irq);
+        desc->irq_data.chip->irq_mask(&desc->irq_data);
         desc->status |= IRQ_MASKED;
 }
 
+#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
+/* Temporary migration helpers */
+static void compat_irq_mask(struct irq_data *data)
+{
+        data->chip->mask(data->irq);
+}
+
+static void compat_irq_unmask(struct irq_data *data)
+{
+        data->chip->unmask(data->irq);
+}
+
+static void compat_irq_ack(struct irq_data *data)
+{
+        data->chip->ack(data->irq);
+}
+
+static void compat_irq_mask_ack(struct irq_data *data)
+{
+        data->chip->mask_ack(data->irq);
+}
+
+static void compat_irq_eoi(struct irq_data *data)
+{
+        data->chip->eoi(data->irq);
+}
+
+static void compat_irq_enable(struct irq_data *data)
+{
+        data->chip->enable(data->irq);
+}
+
+static void compat_irq_disable(struct irq_data *data)
+{
+        data->chip->disable(data->irq);
+}
+
+static void compat_irq_shutdown(struct irq_data *data)
+{
+        data->chip->shutdown(data->irq);
+}
+
+static unsigned int compat_irq_startup(struct irq_data *data)
+{
+        return data->chip->startup(data->irq);
+}
+
+static int compat_irq_set_affinity(struct irq_data *data,
+                                   const struct cpumask *dest, bool force)
+{
+        return data->chip->set_affinity(data->irq, dest);
+}
+
+static int compat_irq_set_type(struct irq_data *data, unsigned int type)
+{
+        return data->chip->set_type(data->irq, type);
+}
+
+static int compat_irq_set_wake(struct irq_data *data, unsigned int on)
+{
+        return data->chip->set_wake(data->irq, on);
+}
+
+static int compat_irq_retrigger(struct irq_data *data)
+{
+        return data->chip->retrigger(data->irq);
+}
+
+static void compat_bus_lock(struct irq_data *data)
+{
+        data->chip->bus_lock(data->irq);
+}
+
+static void compat_bus_sync_unlock(struct irq_data *data)
+{
+        data->chip->bus_sync_unlock(data->irq);
+}
+#endif
+
 /*
  * Fixup enable/disable function pointers
  */
 void irq_chip_set_defaults(struct irq_chip *chip)
 {
-        if (!chip->enable)
-                chip->enable = default_enable;
-        if (!chip->disable)
-                chip->disable = default_disable;
-        if (!chip->startup)
-                chip->startup = default_startup;
+#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
         /*
-         * We use chip->disable, when the user provided its own. When
-         * we have default_disable set for chip->disable, then we need
+         * Compat fixup functions need to be before we set the
+         * defaults for enable/disable/startup/shutdown
+         */
+        if (chip->enable)
+                chip->irq_enable = compat_irq_enable;
+        if (chip->disable)
+                chip->irq_disable = compat_irq_disable;
+        if (chip->shutdown)
+                chip->irq_shutdown = compat_irq_shutdown;
+        if (chip->startup)
+                chip->irq_startup = compat_irq_startup;
+#endif
+        /*
+         * The real defaults
+         */
+        if (!chip->irq_enable)
+                chip->irq_enable = default_enable;
+        if (!chip->irq_disable)
+                chip->irq_disable = default_disable;
+        if (!chip->irq_startup)
+                chip->irq_startup = default_startup;
+        /*
+         * We use chip->irq_disable, when the user provided its own. When
+         * we have default_disable set for chip->irq_disable, then we need
          * to use default_shutdown, otherwise the irq line is not
          * disabled on free_irq():
          */
-        if (!chip->shutdown)
-                chip->shutdown = chip->disable != default_disable ?
-                        chip->disable : default_shutdown;
-        if (!chip->name)
-                chip->name = chip->typename;
+        if (!chip->irq_shutdown)
+                chip->irq_shutdown = chip->irq_disable != default_disable ?
+                        chip->irq_disable : default_shutdown;
+
+#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
         if (!chip->end)
                 chip->end = dummy_irq_chip.end;
+
+        /*
+         * Now fix up the remaining compat handlers
+         */
+        if (chip->bus_lock)
+                chip->irq_bus_lock = compat_bus_lock;
+        if (chip->bus_sync_unlock)
+                chip->irq_bus_sync_unlock = compat_bus_sync_unlock;
+        if (chip->mask)
+                chip->irq_mask = compat_irq_mask;
+        if (chip->unmask)
+                chip->irq_unmask = compat_irq_unmask;
+        if (chip->ack)
+                chip->irq_ack = compat_irq_ack;
+        if (chip->mask_ack)
+                chip->irq_mask_ack = compat_irq_mask_ack;
+        if (chip->eoi)
+                chip->irq_eoi = compat_irq_eoi;
+        if (chip->set_affinity)
+                chip->irq_set_affinity = compat_irq_set_affinity;
+        if (chip->set_type)
+                chip->irq_set_type = compat_irq_set_type;
+        if (chip->set_wake)
+                chip->irq_set_wake = compat_irq_set_wake;
+        if (chip->retrigger)
+                chip->irq_retrigger = compat_irq_retrigger;
+#endif
 }
 
-static inline void mask_ack_irq(struct irq_desc *desc, int irq)
+static inline void mask_ack_irq(struct irq_desc *desc)
 {
-        if (desc->chip->mask_ack)
-                desc->chip->mask_ack(irq);
+        if (desc->irq_data.chip->irq_mask_ack)
+                desc->irq_data.chip->irq_mask_ack(&desc->irq_data);
         else {
-                desc->chip->mask(irq);
-                if (desc->chip->ack)
-                        desc->chip->ack(irq);
+                desc->irq_data.chip->irq_mask(&desc->irq_data);
+                if (desc->irq_data.chip->irq_ack)
+                        desc->irq_data.chip->irq_ack(&desc->irq_data);
         }
         desc->status |= IRQ_MASKED;
 }
 
-static inline void mask_irq(struct irq_desc *desc, int irq)
+static inline void mask_irq(struct irq_desc *desc)
 {
-        if (desc->chip->mask) {
-                desc->chip->mask(irq);
+        if (desc->irq_data.chip->irq_mask) {
+                desc->irq_data.chip->irq_mask(&desc->irq_data);
                 desc->status |= IRQ_MASKED;
         }
 }
 
-static inline void unmask_irq(struct irq_desc *desc, int irq)
+static inline void unmask_irq(struct irq_desc *desc)
 {
-        if (desc->chip->unmask) {
-                desc->chip->unmask(irq);
+        if (desc->irq_data.chip->irq_unmask) {
+                desc->irq_data.chip->irq_unmask(&desc->irq_data);
                 desc->status &= ~IRQ_MASKED;
         }
 }
@@ -476,7 +505,7 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
         irqreturn_t action_ret;
 
         raw_spin_lock(&desc->lock);
-        mask_ack_irq(desc, irq);
+        mask_ack_irq(desc);
 
         if (unlikely(desc->status & IRQ_INPROGRESS))
                 goto out_unlock;
@@ -502,7 +531,7 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
         desc->status &= ~IRQ_INPROGRESS;
 
         if (!(desc->status & (IRQ_DISABLED | IRQ_ONESHOT)))
-                unmask_irq(desc, irq);
+                unmask_irq(desc);
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -539,7 +568,7 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
         action = desc->action;
         if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
                 desc->status |= IRQ_PENDING;
-                mask_irq(desc, irq);
+                mask_irq(desc);
                 goto out;
         }
 
@@ -554,7 +583,7 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
         raw_spin_lock(&desc->lock);
         desc->status &= ~IRQ_INPROGRESS;
 out:
-        desc->chip->eoi(irq);
+        desc->irq_data.chip->irq_eoi(&desc->irq_data);
 
         raw_spin_unlock(&desc->lock);
 }
@@ -590,14 +619,13 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
         if (unlikely((desc->status & (IRQ_INPROGRESS | IRQ_DISABLED)) ||
                     !desc->action)) {
                 desc->status |= (IRQ_PENDING | IRQ_MASKED);
-                mask_ack_irq(desc, irq);
+                mask_ack_irq(desc);
                 goto out_unlock;
         }
         kstat_incr_irqs_this_cpu(irq, desc);
 
         /* Start handling the irq */
-        if (desc->chip->ack)
-                desc->chip->ack(irq);
+        desc->irq_data.chip->irq_ack(&desc->irq_data);
 
         /* Mark the IRQ currently in progress.*/
         desc->status |= IRQ_INPROGRESS;
@@ -607,7 +635,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                 irqreturn_t action_ret;
 
                 if (unlikely(!action)) {
-                        mask_irq(desc, irq);
+                        mask_irq(desc);
                         goto out_unlock;
                 }
 
@@ -619,7 +647,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                 if (unlikely((desc->status &
                                (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
                               (IRQ_PENDING | IRQ_MASKED))) {
-                        unmask_irq(desc, irq);
+                        unmask_irq(desc);
                 }
 
                 desc->status &= ~IRQ_PENDING;
@@ -650,15 +678,15 @@ handle_percpu_irq(unsigned int irq, struct irq_desc *desc)
 
         kstat_incr_irqs_this_cpu(irq, desc);
 
-        if (desc->chip->ack)
-                desc->chip->ack(irq);
+        if (desc->irq_data.chip->irq_ack)
+                desc->irq_data.chip->irq_ack(&desc->irq_data);
 
         action_ret = handle_IRQ_event(irq, desc->action);
         if (!noirqdebug)
                 note_interrupt(irq, desc, action_ret);
 
-        if (desc->chip->eoi)
-                desc->chip->eoi(irq);
+        if (desc->irq_data.chip->irq_eoi)
+                desc->irq_data.chip->irq_eoi(&desc->irq_data);
 }
 
 void
@@ -676,7 +704,7 @@ __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
 
         if (!handle)
                 handle = handle_bad_irq;
-        else if (desc->chip == &no_irq_chip) {
+        else if (desc->irq_data.chip == &no_irq_chip) {
                 printk(KERN_WARNING "Trying to install %sinterrupt handler "
                        "for IRQ%d\n", is_chained ? "chained " : "", irq);
                 /*
@@ -686,16 +714,16 @@ __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
                  * prevent us to setup the interrupt at all. Switch it to
                  * dummy_irq_chip for easy transition.
                  */
-                desc->chip = &dummy_irq_chip;
+                desc->irq_data.chip = &dummy_irq_chip;
         }
 
-        chip_bus_lock(irq, desc);
+        chip_bus_lock(desc);
         raw_spin_lock_irqsave(&desc->lock, flags);
 
         /* Uninstall? */
         if (handle == handle_bad_irq) {
-                if (desc->chip != &no_irq_chip)
-                        mask_ack_irq(desc, irq);
+                if (desc->irq_data.chip != &no_irq_chip)
+                        mask_ack_irq(desc);
                 desc->status |= IRQ_DISABLED;
                 desc->depth = 1;
         }
@@ -706,10 +734,10 @@ __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
                 desc->status &= ~IRQ_DISABLED;
                 desc->status |= IRQ_NOREQUEST | IRQ_NOPROBE;
                 desc->depth = 0;
-                desc->chip->startup(irq);
+                desc->irq_data.chip->irq_startup(&desc->irq_data);
         }
         raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(irq, desc);
+        chip_bus_sync_unlock(desc);
 }
 EXPORT_SYMBOL_GPL(__set_irq_handler);
 
@@ -729,32 +757,20 @@ set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
         __set_irq_handler(irq, handle, 0, name);
 }
 
-void set_irq_noprobe(unsigned int irq)
+void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
 
-        if (!desc) {
-                printk(KERN_ERR "Trying to mark IRQ%d non-probeable\n", irq);
+        if (!desc)
                 return;
-        }
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->status |= IRQ_NOPROBE;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-}
-
-void set_irq_probe(unsigned int irq)
-{
-        struct irq_desc *desc = irq_to_desc(irq);
-        unsigned long flags;
 
-        if (!desc) {
-                printk(KERN_ERR "Trying to mark IRQ%d probeable\n", irq);
-                return;
-        }
+        /* Sanitize flags */
+        set &= IRQF_MODIFY_MASK;
+        clr &= IRQF_MODIFY_MASK;
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->status &= ~IRQ_NOPROBE;
+        desc->status &= ~clr;
+        desc->status |= set;
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
diff --git a/kernel/irq/dummychip.c b/kernel/irq/dummychip.c
new file mode 100644
index 000000000000..20dc5474947e
--- /dev/null
+++ b/kernel/irq/dummychip.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 1992, 1998-2006 Linus Torvalds, Ingo Molnar
+ * Copyright (C) 2005-2006, Thomas Gleixner, Russell King
+ *
+ * This file contains the dummy interrupt chip implementation
+ */
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+
+#include "internals.h"
+
+/*
+ * What should we do if we get a hw irq event on an illegal vector?
+ * Each architecture has to answer this themself.
+ */
+static void ack_bad(struct irq_data *data)
+{
+        struct irq_desc *desc = irq_data_to_desc(data);
+
+        print_irq_desc(data->irq, desc);
+        ack_bad_irq(data->irq);
+}
+
+/*
+ * NOP functions
+ */
+static void noop(struct irq_data *data) { }
+
+static unsigned int noop_ret(struct irq_data *data)
+{
+        return 0;
+}
+
+#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
+static void compat_noop(unsigned int irq) { }
+#define END_INIT .end = compat_noop
+#else
+#define END_INIT
+#endif
+
+/*
+ * Generic no controller implementation
+ */
+struct irq_chip no_irq_chip = {
+        .name           = "none",
+        .irq_startup    = noop_ret,
+        .irq_shutdown   = noop,
+        .irq_enable     = noop,
+        .irq_disable    = noop,
+        .irq_ack        = ack_bad,
+        END_INIT
+};
+
+/*
+ * Generic dummy implementation which can be used for
+ * real dumb interrupt sources
+ */
+struct irq_chip dummy_irq_chip = {
+        .name           = "dummy",
+        .irq_startup    = noop_ret,
+        .irq_shutdown   = noop,
+        .irq_enable     = noop,
+        .irq_disable    = noop,
+        .irq_ack        = noop,
+        .irq_mask       = noop,
+        .irq_unmask     = noop,
+        END_INIT
+};
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 27e5c6911223..e2347eb63306 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -11,24 +11,15 @@
  */
 
 #include <linux/irq.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/module.h>
 #include <linux/random.h>
+#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/kernel_stat.h>
-#include <linux/rculist.h>
-#include <linux/hash.h>
-#include <linux/radix-tree.h>
+
 #include <trace/events/irq.h>
 
 #include "internals.h"
 
-/*
- * lockdep: we want to handle all irq_desc locks as a single lock-class:
- */
-struct lock_class_key irq_desc_lock_class;
-
 /**
  * handle_bad_irq - handle spurious and unhandled irqs
  * @irq:       the interrupt number
@@ -43,304 +34,6 @@ void handle_bad_irq(unsigned int irq, struct irq_desc *desc)
         ack_bad_irq(irq);
 }
 
-#if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_HARDIRQS)
-static void __init init_irq_default_affinity(void)
-{
-        alloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT);
-        cpumask_setall(irq_default_affinity);
-}
-#else
-static void __init init_irq_default_affinity(void)
-{
-}
-#endif
-
-/*
- * Linux has a controller-independent interrupt architecture.
- * Every controller has a 'controller-template', that is used
- * by the main code to do the right thing. Each driver-visible
- * interrupt source is transparently wired to the appropriate
- * controller. Thus drivers need not be aware of the
- * interrupt-controller.
- *
- * The code is designed to be easily extended with new/different
- * interrupt controllers, without having to do assembly magic or
- * having to touch the generic code.
- *
- * Controller mappings for all interrupt sources:
- */
-int nr_irqs = NR_IRQS;
-EXPORT_SYMBOL_GPL(nr_irqs);
-
-#ifdef CONFIG_SPARSE_IRQ
-
-static struct irq_desc irq_desc_init = {
-        .irq        = -1,
-        .status     = IRQ_DISABLED,
-        .chip       = &no_irq_chip,
-        .handle_irq = handle_bad_irq,
-        .depth      = 1,
-        .lock       = __RAW_SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
-};
-
-void __ref init_kstat_irqs(struct irq_desc *desc, int node, int nr)
-{
-        void *ptr;
-
-        ptr = kzalloc_node(nr * sizeof(*desc->kstat_irqs),
-                           GFP_ATOMIC, node);
-
-        /*
-         * don't overwite if can not get new one
-         * init_copy_kstat_irqs() could still use old one
-         */
-        if (ptr) {
-                printk(KERN_DEBUG "  alloc kstat_irqs on node %d\n", node);
-                desc->kstat_irqs = ptr;
-        }
-}
-
-static void init_one_irq_desc(int irq, struct irq_desc *desc, int node)
-{
-        memcpy(desc, &irq_desc_init, sizeof(struct irq_desc));
-
-        raw_spin_lock_init(&desc->lock);
-        desc->irq = irq;
-#ifdef CONFIG_SMP
-        desc->node = node;
-#endif
-        lockdep_set_class(&desc->lock, &irq_desc_lock_class);
-        init_kstat_irqs(desc, node, nr_cpu_ids);
-        if (!desc->kstat_irqs) {
-                printk(KERN_ERR "can not alloc kstat_irqs\n");
-                BUG_ON(1);
-        }
-        if (!alloc_desc_masks(desc, node, false)) {
-                printk(KERN_ERR "can not alloc irq_desc cpumasks\n");
-                BUG_ON(1);
-        }
-        init_desc_masks(desc);
-        arch_init_chip_data(desc, node);
-}
-
-/*
- * Protect the sparse_irqs:
- */
-DEFINE_RAW_SPINLOCK(sparse_irq_lock);
-
-static RADIX_TREE(irq_desc_tree, GFP_ATOMIC);
-
-static void set_irq_desc(unsigned int irq, struct irq_desc *desc)
-{
-        radix_tree_insert(&irq_desc_tree, irq, desc);
-}
-
-struct irq_desc *irq_to_desc(unsigned int irq)
-{
-        return radix_tree_lookup(&irq_desc_tree, irq);
-}
-
-void replace_irq_desc(unsigned int irq, struct irq_desc *desc)
-{
-        void **ptr;
-
-        ptr = radix_tree_lookup_slot(&irq_desc_tree, irq);
-        if (ptr)
-                radix_tree_replace_slot(ptr, desc);
-}
-
-static struct irq_desc irq_desc_legacy[NR_IRQS_LEGACY] __cacheline_aligned_in_smp = {
-        [0 ... NR_IRQS_LEGACY-1] = {
-                .irq        = -1,
-                .status     = IRQ_DISABLED,
-                .chip       = &no_irq_chip,
-                .handle_irq = handle_bad_irq,
-                .depth      = 1,
-                .lock       = __RAW_SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
-        }
-};
-
-static unsigned int *kstat_irqs_legacy;
-
-int __init early_irq_init(void)
-{
-        struct irq_desc *desc;
-        int legacy_count;
-        int node;
-        int i;
-
-        init_irq_default_affinity();
-
-         /* initialize nr_irqs based on nr_cpu_ids */
-        arch_probe_nr_irqs();
-        printk(KERN_INFO "NR_IRQS:%d nr_irqs:%d\n", NR_IRQS, nr_irqs);
-
-        desc = irq_desc_legacy;
-        legacy_count = ARRAY_SIZE(irq_desc_legacy);
-        node = first_online_node;
-
-        /* allocate based on nr_cpu_ids */
-        kstat_irqs_legacy = kzalloc_node(NR_IRQS_LEGACY * nr_cpu_ids *
-                                          sizeof(int), GFP_NOWAIT, node);
-
-        for (i = 0; i < legacy_count; i++) {
-                desc[i].irq = i;
-#ifdef CONFIG_SMP
-                desc[i].node = node;
-#endif
-                desc[i].kstat_irqs = kstat_irqs_legacy + i * nr_cpu_ids;
-                lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
-                alloc_desc_masks(&desc[i], node, true);
-                init_desc_masks(&desc[i]);
-                set_irq_desc(i, &desc[i]);
-        }
-
-        return arch_early_irq_init();
-}
-
-struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
-{
-        struct irq_desc *desc;
-        unsigned long flags;
-
-        if (irq >= nr_irqs) {
-                WARN(1, "irq (%d) >= nr_irqs (%d) in irq_to_desc_alloc\n",
-                        irq, nr_irqs);
-                return NULL;
-        }
-
-        desc = irq_to_desc(irq);
-        if (desc)
-                return desc;
-
-        raw_spin_lock_irqsave(&sparse_irq_lock, flags);
-
-        /* We have to check it to avoid races with another CPU */
-        desc = irq_to_desc(irq);
-        if (desc)
-                goto out_unlock;
-
-        desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
-
-        printk(KERN_DEBUG "  alloc irq_desc for %d on node %d\n", irq, node);
-        if (!desc) {
-                printk(KERN_ERR "can not alloc irq_desc\n");
-                BUG_ON(1);
-        }
-        init_one_irq_desc(irq, desc, node);
-
-        set_irq_desc(irq, desc);
-
-out_unlock:
-        raw_spin_unlock_irqrestore(&sparse_irq_lock, flags);
-
-        return desc;
-}
-
-#else /* !CONFIG_SPARSE_IRQ */
-
-struct irq_desc irq_desc[NR_IRQS] __cacheline_aligned_in_smp = {
-        [0 ... NR_IRQS-1] = {
-                .status = IRQ_DISABLED,
-                .chip = &no_irq_chip,
-                .handle_irq = handle_bad_irq,
-                .depth = 1,
-                .lock = __RAW_SPIN_LOCK_UNLOCKED(irq_desc->lock),
-        }
-};
-
-static unsigned int kstat_irqs_all[NR_IRQS][NR_CPUS];
-int __init early_irq_init(void)
-{
-        struct irq_desc *desc;
-        int count;
-        int i;
-
-        init_irq_default_affinity();
-
-        printk(KERN_INFO "NR_IRQS:%d\n", NR_IRQS);
-
-        desc = irq_desc;
-        count = ARRAY_SIZE(irq_desc);
-
-        for (i = 0; i < count; i++) {
-                desc[i].irq = i;
-                alloc_desc_masks(&desc[i], 0, true);
-                init_desc_masks(&desc[i]);
-                desc[i].kstat_irqs = kstat_irqs_all[i];
-        }
-        return arch_early_irq_init();
-}
-
-struct irq_desc *irq_to_desc(unsigned int irq)
-{
-        return (irq < NR_IRQS) ? irq_desc + irq : NULL;
-}
-
-struct irq_desc *irq_to_desc_alloc_node(unsigned int irq, int node)
-{
-        return irq_to_desc(irq);
-}
-#endif /* !CONFIG_SPARSE_IRQ */
-
-void clear_kstat_irqs(struct irq_desc *desc)
-{
-        memset(desc->kstat_irqs, 0, nr_cpu_ids * sizeof(*(desc->kstat_irqs)));
-}
-
-/*
- * What should we do if we get a hw irq event on an illegal vector?
- * Each architecture has to answer this themself.
- */
-static void ack_bad(unsigned int irq)
-{
-        struct irq_desc *desc = irq_to_desc(irq);
-
-        print_irq_desc(irq, desc);
-        ack_bad_irq(irq);
-}
-
-/*
- * NOP functions
- */
-static void noop(unsigned int irq)
-{
-}
-
-static unsigned int noop_ret(unsigned int irq)
-{
-        return 0;
-}
-
-/*
- * Generic no controller implementation
- */
-struct irq_chip no_irq_chip = {
-        .name           = "none",
-        .startup        = noop_ret,
-        .shutdown       = noop,
-        .enable         = noop,
-        .disable        = noop,
-        .ack            = ack_bad,
-        .end            = noop,
-};
-
-/*
- * Generic dummy implementation which can be used for
- * real dumb interrupt sources
- */
-struct irq_chip dummy_irq_chip = {
-        .name           = "dummy",
-        .startup        = noop_ret,
-        .shutdown       = noop,
-        .enable         = noop,
-        .disable        = noop,
-        .ack            = noop,
-        .mask           = noop,
-        .unmask         = noop,
-        .end            = noop,
-};
-
 /*
  * Special, empty irq handler:
  */
@@ -457,20 +150,20 @@ unsigned int __do_IRQ(unsigned int irq)
                 /*
                  * No locking required for CPU-local interrupts:
                  */
-                if (desc->chip->ack)
-                        desc->chip->ack(irq);
+                if (desc->irq_data.chip->ack)
+                        desc->irq_data.chip->ack(irq);
                 if (likely(!(desc->status & IRQ_DISABLED))) {
                         action_ret = handle_IRQ_event(irq, desc->action);
                         if (!noirqdebug)
                                 note_interrupt(irq, desc, action_ret);
                 }
-                desc->chip->end(irq);
+                desc->irq_data.chip->end(irq);
                 return 1;
         }
 
         raw_spin_lock(&desc->lock);
-        if (desc->chip->ack)
-                desc->chip->ack(irq);
+        if (desc->irq_data.chip->ack)
+                desc->irq_data.chip->ack(irq);
         /*
          * REPLAY is when Linux resends an IRQ that was dropped earlier
          * WAITING is used by probe to mark irqs that are being tested
@@ -530,27 +223,9 @@ out:
          * The ->end() handler has to deal with interrupts which got
          * disabled while the handler was running.
          */
-        desc->chip->end(irq);
+        desc->irq_data.chip->end(irq);
         raw_spin_unlock(&desc->lock);
 
         return 1;
 }
 #endif
-
-void early_init_irq_lock_class(void)
-{
-        struct irq_desc *desc;
-        int i;
-
-        for_each_irq_desc(i, desc) {
-                lockdep_set_class(&desc->lock, &irq_desc_lock_class);
-        }
-}
-
-unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
-{
-        struct irq_desc *desc = irq_to_desc(irq);
-        return desc ? desc->kstat_irqs[cpu] : 0;
-}
-EXPORT_SYMBOL(kstat_irqs_cpu);
-
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index c63f3bc88f0b..4571ae7e085a 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -1,9 +1,12 @@
 /*
  * IRQ subsystem internal functions and variables:
  */
+#include <linux/irqdesc.h>
 
 extern int noirqdebug;
 
+#define irq_data_to_desc(data)  container_of(data, struct irq_desc, irq_data)
+
 /* Set default functions for irq_chip structures: */
 extern void irq_chip_set_defaults(struct irq_chip *chip);
 
@@ -15,21 +18,19 @@ extern int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
 extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp);
 extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume);
 
-extern struct lock_class_key irq_desc_lock_class;
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
-extern void clear_kstat_irqs(struct irq_desc *desc);
-extern raw_spinlock_t sparse_irq_lock;
 
-#ifdef CONFIG_SPARSE_IRQ
-void replace_irq_desc(unsigned int irq, struct irq_desc *desc);
-#endif
+/* Resending of interrupts :*/
+void check_irq_resend(struct irq_desc *desc, unsigned int irq);
 
 #ifdef CONFIG_PROC_FS
 extern void register_irq_proc(unsigned int irq, struct irq_desc *desc);
+extern void unregister_irq_proc(unsigned int irq, struct irq_desc *desc);
 extern void register_handler_proc(unsigned int irq, struct irqaction *action);
 extern void unregister_handler_proc(unsigned int irq, struct irqaction *action);
 #else
 static inline void register_irq_proc(unsigned int irq, struct irq_desc *desc) { }
+static inline void unregister_irq_proc(unsigned int irq, struct irq_desc *desc) { }
 static inline void register_handler_proc(unsigned int irq,
                                          struct irqaction *action) { }
 static inline void unregister_handler_proc(unsigned int irq,
@@ -40,17 +41,27 @@ extern int irq_select_affinity_usr(unsigned int irq);
 
 extern void irq_set_thread_affinity(struct irq_desc *desc);
 
+#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
+static inline void irq_end(unsigned int irq, struct irq_desc *desc)
+{
+        if (desc->irq_data.chip && desc->irq_data.chip->end)
+                desc->irq_data.chip->end(irq);
+}
+#else
+static inline void irq_end(unsigned int irq, struct irq_desc *desc) { }
+#endif
+
 /* Inline functions for support of irq chips on slow busses */
-static inline void chip_bus_lock(unsigned int irq, struct irq_desc *desc)
+static inline void chip_bus_lock(struct irq_desc *desc)
 {
-        if (unlikely(desc->chip->bus_lock))
-                desc->chip->bus_lock(irq);
+        if (unlikely(desc->irq_data.chip->irq_bus_lock))
+                desc->irq_data.chip->irq_bus_lock(&desc->irq_data);
 }
 
-static inline void chip_bus_sync_unlock(unsigned int irq, struct irq_desc *desc)
+static inline void chip_bus_sync_unlock(struct irq_desc *desc)
 {
-        if (unlikely(desc->chip->bus_sync_unlock))
-                desc->chip->bus_sync_unlock(irq);
+        if (unlikely(desc->irq_data.chip->irq_bus_sync_unlock))
+                desc->irq_data.chip->irq_bus_sync_unlock(&desc->irq_data);
 }
 
 /*
@@ -67,8 +78,8 @@ static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
                 irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
         printk("->handle_irq():  %p, ", desc->handle_irq);
         print_symbol("%s\n", (unsigned long)desc->handle_irq);
-        printk("->chip(): %p, ", desc->chip);
-        print_symbol("%s\n", (unsigned long)desc->chip);
+        printk("->irq_data.chip(): %p, ", desc->irq_data.chip);
+        print_symbol("%s\n", (unsigned long)desc->irq_data.chip);
         printk("->action(): %p\n", desc->action);
         if (desc->action) {
                 printk("->action->handler(): %p, ", desc->action->handler);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
new file mode 100644
index 000000000000..9988d03797f5
--- /dev/null
+++ b/kernel/irq/irqdesc.c
@@ -0,0 +1,410 @@
+/*
+ * Copyright (C) 1992, 1998-2006 Linus Torvalds, Ingo Molnar
+ * Copyright (C) 2005-2006, Thomas Gleixner, Russell King
+ *
+ * This file contains the interrupt descriptor management code
+ *
+ * Detailed information is available in Documentation/DocBook/genericirq
+ *
+ */
+#include <linux/irq.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/kernel_stat.h>
+#include <linux/radix-tree.h>
+#include <linux/bitmap.h>
+
+#include "internals.h"
+
+/*
+ * lockdep: we want to handle all irq_desc locks as a single lock-class:
+ */
+static struct lock_class_key irq_desc_lock_class;
+
+#if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_HARDIRQS)
+static void __init init_irq_default_affinity(void)
+{
+        alloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT);
+        cpumask_setall(irq_default_affinity);
+}
+#else
+static void __init init_irq_default_affinity(void)
+{
+}
+#endif
+
+#ifdef CONFIG_SMP
+static int alloc_masks(struct irq_desc *desc, gfp_t gfp, int node)
+{
+        if (!zalloc_cpumask_var_node(&desc->irq_data.affinity, gfp, node))
+                return -ENOMEM;
+
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        if (!zalloc_cpumask_var_node(&desc->pending_mask, gfp, node)) {
+                free_cpumask_var(desc->irq_data.affinity);
+                return -ENOMEM;
+        }
+#endif
+        return 0;
+}
+
+static void desc_smp_init(struct irq_desc *desc, int node)
+{
+        desc->irq_data.node = node;
+        cpumask_copy(desc->irq_data.affinity, irq_default_affinity);
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        cpumask_clear(desc->pending_mask);
+#endif
+}
+
+static inline int desc_node(struct irq_desc *desc)
+{
+        return desc->irq_data.node;
+}
+
+#else
+static inline int
+alloc_masks(struct irq_desc *desc, gfp_t gfp, int node) { return 0; }
+static inline void desc_smp_init(struct irq_desc *desc, int node) { }
+static inline int desc_node(struct irq_desc *desc) { return 0; }
+#endif
+
+static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
+{
+        desc->irq_data.irq = irq;
+        desc->irq_data.chip = &no_irq_chip;
+        desc->irq_data.chip_data = NULL;
+        desc->irq_data.handler_data = NULL;
+        desc->irq_data.msi_desc = NULL;
+        desc->status = IRQ_DEFAULT_INIT_FLAGS;
+        desc->handle_irq = handle_bad_irq;
+        desc->depth = 1;
+        desc->irq_count = 0;
+        desc->irqs_unhandled = 0;
+        desc->name = NULL;
+        memset(desc->kstat_irqs, 0, nr_cpu_ids * sizeof(*(desc->kstat_irqs)));
+        desc_smp_init(desc, node);
+}
+
+int nr_irqs = NR_IRQS;
+EXPORT_SYMBOL_GPL(nr_irqs);
+
+static DEFINE_MUTEX(sparse_irq_lock);
+static DECLARE_BITMAP(allocated_irqs, NR_IRQS);
+
+#ifdef CONFIG_SPARSE_IRQ
+
+static RADIX_TREE(irq_desc_tree, GFP_KERNEL);
+
+static void irq_insert_desc(unsigned int irq, struct irq_desc *desc)
+{
+        radix_tree_insert(&irq_desc_tree, irq, desc);
+}
+
+struct irq_desc *irq_to_desc(unsigned int irq)
+{
+        return radix_tree_lookup(&irq_desc_tree, irq);
+}
+
+static void delete_irq_desc(unsigned int irq)
+{
+        radix_tree_delete(&irq_desc_tree, irq);
+}
+
+#ifdef CONFIG_SMP
+static void free_masks(struct irq_desc *desc)
+{
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        free_cpumask_var(desc->pending_mask);
+#endif
+        free_cpumask_var(desc->irq_data.affinity);
+}
+#else
+static inline void free_masks(struct irq_desc *desc) { }
+#endif
+
+static struct irq_desc *alloc_desc(int irq, int node)
+{
+        struct irq_desc *desc;
+        gfp_t gfp = GFP_KERNEL;
+
+        desc = kzalloc_node(sizeof(*desc), gfp, node);
+        if (!desc)
+                return NULL;
+        /* allocate based on nr_cpu_ids */
+        desc->kstat_irqs = kzalloc_node(nr_cpu_ids * sizeof(*desc->kstat_irqs),
+                                         gfp, node);
+        if (!desc->kstat_irqs)
+                goto err_desc;
+
+        if (alloc_masks(desc, gfp, node))
+                goto err_kstat;
+
+        raw_spin_lock_init(&desc->lock);
+        lockdep_set_class(&desc->lock, &irq_desc_lock_class);
+
+        desc_set_defaults(irq, desc, node);
+
+        return desc;
+
+err_kstat:
+        kfree(desc->kstat_irqs);
+err_desc:
+        kfree(desc);
+        return NULL;
+}
+
+static void free_desc(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+
+        unregister_irq_proc(irq, desc);
+
+        mutex_lock(&sparse_irq_lock);
+        delete_irq_desc(irq);
+        mutex_unlock(&sparse_irq_lock);
+
+        free_masks(desc);
+        kfree(desc->kstat_irqs);
+        kfree(desc);
+}
+
+static int alloc_descs(unsigned int start, unsigned int cnt, int node)
+{
+        struct irq_desc *desc;
+        int i;
+
+        for (i = 0; i < cnt; i++) {
+                desc = alloc_desc(start + i, node);
+                if (!desc)
+                        goto err;
+                mutex_lock(&sparse_irq_lock);
+                irq_insert_desc(start + i, desc);
+                mutex_unlock(&sparse_irq_lock);
+        }
+        return start;
+
+err:
+        for (i--; i >= 0; i--)
+                free_desc(start + i);
+
+        mutex_lock(&sparse_irq_lock);
+        bitmap_clear(allocated_irqs, start, cnt);
+        mutex_unlock(&sparse_irq_lock);
+        return -ENOMEM;
+}
+
+struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
+{
+        int res = irq_alloc_descs(irq, irq, 1, node);
+
+        if (res == -EEXIST || res == irq)
+                return irq_to_desc(irq);
+        return NULL;
+}
+
+int __init early_irq_init(void)
+{
+        int i, initcnt, node = first_online_node;
+        struct irq_desc *desc;
+
+        init_irq_default_affinity();
+
+        /* Let arch update nr_irqs and return the nr of preallocated irqs */
+        initcnt = arch_probe_nr_irqs();
+        printk(KERN_INFO "NR_IRQS:%d nr_irqs:%d %d\n", NR_IRQS, nr_irqs, initcnt);
+
+        for (i = 0; i < initcnt; i++) {
+                desc = alloc_desc(i, node);
+                set_bit(i, allocated_irqs);
+                irq_insert_desc(i, desc);
+        }
+        return arch_early_irq_init();
+}
+
+#else /* !CONFIG_SPARSE_IRQ */
+
+struct irq_desc irq_desc[NR_IRQS] __cacheline_aligned_in_smp = {
+        [0 ... NR_IRQS-1] = {
+                .status         = IRQ_DEFAULT_INIT_FLAGS,
+                .handle_irq     = handle_bad_irq,
+                .depth          = 1,
+                .lock           = __RAW_SPIN_LOCK_UNLOCKED(irq_desc->lock),
+        }
+};
+
+static unsigned int kstat_irqs_all[NR_IRQS][NR_CPUS];
+int __init early_irq_init(void)
+{
+        int count, i, node = first_online_node;
+        struct irq_desc *desc;
+
+        init_irq_default_affinity();
+
+        printk(KERN_INFO "NR_IRQS:%d\n", NR_IRQS);
+
+        desc = irq_desc;
+        count = ARRAY_SIZE(irq_desc);
+
+        for (i = 0; i < count; i++) {
+                desc[i].irq_data.irq = i;
+                desc[i].irq_data.chip = &no_irq_chip;
+                desc[i].kstat_irqs = kstat_irqs_all[i];
+                alloc_masks(desc + i, GFP_KERNEL, node);
+                desc_smp_init(desc + i, node);
+                lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
+        }
+        return arch_early_irq_init();
+}
+
+struct irq_desc *irq_to_desc(unsigned int irq)
+{
+        return (irq < NR_IRQS) ? irq_desc + irq : NULL;
+}
+
+struct irq_desc *irq_to_desc_alloc_node(unsigned int irq, int node)
+{
+        return irq_to_desc(irq);
+}
+
+static void free_desc(unsigned int irq)
+{
+        dynamic_irq_cleanup(irq);
+}
+
+static inline int alloc_descs(unsigned int start, unsigned int cnt, int node)
+{
+        return start;
+}
+#endif /* !CONFIG_SPARSE_IRQ */
+
+/* Dynamic interrupt handling */
+
+/**
+ * irq_free_descs - free irq descriptors
+ * @from:       Start of descriptor range
+ * @cnt:        Number of consecutive irqs to free
+ */
+void irq_free_descs(unsigned int from, unsigned int cnt)
+{
+        int i;
+
+        if (from >= nr_irqs || (from + cnt) > nr_irqs)
+                return;
+
+        for (i = 0; i < cnt; i++)
+                free_desc(from + i);
+
+        mutex_lock(&sparse_irq_lock);
+        bitmap_clear(allocated_irqs, from, cnt);
+        mutex_unlock(&sparse_irq_lock);
+}
+
+/**
+ * irq_alloc_descs - allocate and initialize a range of irq descriptors
+ * @irq:        Allocate for specific irq number if irq >= 0
+ * @from:       Start the search from this irq number
+ * @cnt:        Number of consecutive irqs to allocate.
+ * @node:       Preferred node on which the irq descriptor should be allocated
+ *
+ * Returns the first irq number or error code
+ */
+int __ref
+irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
+{
+        int start, ret;
+
+        if (!cnt)
+                return -EINVAL;
+
+        mutex_lock(&sparse_irq_lock);
+
+        start = bitmap_find_next_zero_area(allocated_irqs, nr_irqs, from, cnt, 0);
+        ret = -EEXIST;
+        if (irq >=0 && start != irq)
+                goto err;
+
+        ret = -ENOMEM;
+        if (start >= nr_irqs)
+                goto err;
+
+        bitmap_set(allocated_irqs, start, cnt);
+        mutex_unlock(&sparse_irq_lock);
+        return alloc_descs(start, cnt, node);
+
+err:
+        mutex_unlock(&sparse_irq_lock);
+        return ret;
+}
+
+/**
+ * irq_reserve_irqs - mark irqs allocated
+ * @from:       mark from irq number
+ * @cnt:        number of irqs to mark
+ *
+ * Returns 0 on success or an appropriate error code
+ */
+int irq_reserve_irqs(unsigned int from, unsigned int cnt)
+{
+        unsigned int start;
+        int ret = 0;
+
+        if (!cnt || (from + cnt) > nr_irqs)
+                return -EINVAL;
+
+        mutex_lock(&sparse_irq_lock);
+        start = bitmap_find_next_zero_area(allocated_irqs, nr_irqs, from, cnt, 0);
+        if (start == from)
+                bitmap_set(allocated_irqs, start, cnt);
+        else
+                ret = -EEXIST;
+        mutex_unlock(&sparse_irq_lock);
+        return ret;
+}
+
+/**
+ * irq_get_next_irq - get next allocated irq number
+ * @offset:     where to start the search
+ *
+ * Returns next irq number after offset or nr_irqs if none is found.
+ */
+unsigned int irq_get_next_irq(unsigned int offset)
+{
+        return find_next_bit(allocated_irqs, nr_irqs, offset);
+}
+
+/**
+ * dynamic_irq_cleanup - cleanup a dynamically allocated irq
+ * @irq:        irq number to initialize
+ */
+void dynamic_irq_cleanup(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&desc->lock, flags);
+        desc_set_defaults(irq, desc, desc_node(desc));
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+}
+
+unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+        return desc ? desc->kstat_irqs[cpu] : 0;
+}
+
+#ifdef CONFIG_GENERIC_HARDIRQS
+unsigned int kstat_irqs(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+        int cpu;
+        int sum = 0;
+
+        if (!desc)
+                return 0;
+        for_each_possible_cpu(cpu)
+                sum += desc->kstat_irqs[cpu];
+        return sum;
+}
+#endif /* CONFIG_GENERIC_HARDIRQS */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index c3003e9d91a3..5f92acc5f952 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -73,8 +73,8 @@ int irq_can_set_affinity(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
 
-        if (CHECK_IRQ_PER_CPU(desc->status) || !desc->chip ||
-            !desc->chip->set_affinity)
+        if (CHECK_IRQ_PER_CPU(desc->status) || !desc->irq_data.chip ||
+            !desc->irq_data.chip->irq_set_affinity)
                 return 0;
 
         return 1;
@@ -109,17 +109,18 @@ void irq_set_thread_affinity(struct irq_desc *desc)
 int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
 {
         struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_chip *chip = desc->irq_data.chip;
         unsigned long flags;
 
-        if (!desc->chip->set_affinity)
+        if (!chip->irq_set_affinity)
                 return -EINVAL;
 
         raw_spin_lock_irqsave(&desc->lock, flags);
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         if (desc->status & IRQ_MOVE_PCNTXT) {
-                if (!desc->chip->set_affinity(irq, cpumask)) {
-                        cpumask_copy(desc->affinity, cpumask);
+                if (!chip->irq_set_affinity(&desc->irq_data, cpumask, false)) {
+                        cpumask_copy(desc->irq_data.affinity, cpumask);
                         irq_set_thread_affinity(desc);
                 }
         }
@@ -128,8 +129,8 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
                 cpumask_copy(desc->pending_mask, cpumask);
         }
 #else
-        if (!desc->chip->set_affinity(irq, cpumask)) {
-                cpumask_copy(desc->affinity, cpumask);
+        if (!chip->irq_set_affinity(&desc->irq_data, cpumask, false)) {
+                cpumask_copy(desc->irq_data.affinity, cpumask);
                 irq_set_thread_affinity(desc);
         }
 #endif
@@ -168,16 +169,16 @@ static int setup_affinity(unsigned int irq, struct irq_desc *desc)
          * one of the targets is online.
          */
         if (desc->status & (IRQ_AFFINITY_SET | IRQ_NO_BALANCING)) {
-                if (cpumask_any_and(desc->affinity, cpu_online_mask)
+                if (cpumask_any_and(desc->irq_data.affinity, cpu_online_mask)
                     < nr_cpu_ids)
                         goto set_affinity;
                 else
                         desc->status &= ~IRQ_AFFINITY_SET;
         }
 
-        cpumask_and(desc->affinity, cpu_online_mask, irq_default_affinity);
+        cpumask_and(desc->irq_data.affinity, cpu_online_mask, irq_default_affinity);
 set_affinity:
-        desc->chip->set_affinity(irq, desc->affinity);
+        desc->irq_data.chip->irq_set_affinity(&desc->irq_data, desc->irq_data.affinity, false);
 
         return 0;
 }
@@ -223,7 +224,7 @@ void __disable_irq(struct irq_desc *desc, unsigned int irq, bool suspend)
 
         if (!desc->depth++) {
                 desc->status |= IRQ_DISABLED;
-                desc->chip->disable(irq);
+                desc->irq_data.chip->irq_disable(&desc->irq_data);
         }
 }
 
@@ -246,11 +247,11 @@ void disable_irq_nosync(unsigned int irq)
         if (!desc)
                 return;
 
-        chip_bus_lock(irq, desc);
+        chip_bus_lock(desc);
         raw_spin_lock_irqsave(&desc->lock, flags);
         __disable_irq(desc, irq, false);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(irq, desc);
+        chip_bus_sync_unlock(desc);
 }
 EXPORT_SYMBOL(disable_irq_nosync);
 
@@ -313,7 +314,7 @@ void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume)
  *      IRQ line is re-enabled.
  *
  *      This function may be called from IRQ context only when
- *      desc->chip->bus_lock and desc->chip->bus_sync_unlock are NULL !
+ *      desc->irq_data.chip->bus_lock and desc->chip->bus_sync_unlock are NULL !
  */
 void enable_irq(unsigned int irq)
 {
@@ -323,11 +324,15 @@ void enable_irq(unsigned int irq)
         if (!desc)
                 return;
 
-        chip_bus_lock(irq, desc);
+        if (WARN(!desc->irq_data.chip || !desc->irq_data.chip->irq_enable,
+            KERN_ERR "enable_irq before setup/request_irq: irq %u\n", irq))
+                return;
+
+        chip_bus_lock(desc);
         raw_spin_lock_irqsave(&desc->lock, flags);
         __enable_irq(desc, irq, false);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(irq, desc);
+        chip_bus_sync_unlock(desc);
 }
 EXPORT_SYMBOL(enable_irq);
 
@@ -336,8 +341,8 @@ static int set_irq_wake_real(unsigned int irq, unsigned int on)
         struct irq_desc *desc = irq_to_desc(irq);
         int ret = -ENXIO;
 
-        if (desc->chip->set_wake)
-                ret = desc->chip->set_wake(irq, on);
+        if (desc->irq_data.chip->irq_set_wake)
+                ret = desc->irq_data.chip->irq_set_wake(&desc->irq_data, on);
 
         return ret;
 }
@@ -429,12 +434,12 @@ void compat_irq_chip_set_default_handler(struct irq_desc *desc)
 }
 
 int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
-                unsigned long flags)
+                      unsigned long flags)
 {
         int ret;
-        struct irq_chip *chip = desc->chip;
+        struct irq_chip *chip = desc->irq_data.chip;
 
-        if (!chip || !chip->set_type) {
+        if (!chip || !chip->irq_set_type) {
                 /*
                  * IRQF_TRIGGER_* but the PIC does not support multiple
                  * flow-types?
@@ -445,11 +450,11 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
         }
 
         /* caller masked out all except trigger mode flags */
-        ret = chip->set_type(irq, flags);
+        ret = chip->irq_set_type(&desc->irq_data, flags);
 
         if (ret)
-                pr_err("setting trigger mode %d for irq %u failed (%pF)\n",
-                                (int)flags, irq, chip->set_type);
+                pr_err("setting trigger mode %lu for irq %u failed (%pF)\n",
+                       flags, irq, chip->irq_set_type);
         else {
                 if (flags & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
                         flags |= IRQ_LEVEL;
@@ -457,8 +462,8 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
                 desc->status &= ~(IRQ_LEVEL | IRQ_TYPE_SENSE_MASK);
                 desc->status |= flags;
 
-                if (chip != desc->chip)
-                        irq_chip_set_defaults(desc->chip);
+                if (chip != desc->irq_data.chip)
+                        irq_chip_set_defaults(desc->irq_data.chip);
         }
 
         return ret;
@@ -507,7 +512,7 @@ static int irq_wait_for_interrupt(struct irqaction *action)
 static void irq_finalize_oneshot(unsigned int irq, struct irq_desc *desc)
 {
 again:
-        chip_bus_lock(irq, desc);
+        chip_bus_lock(desc);
         raw_spin_lock_irq(&desc->lock);
 
         /*
@@ -521,17 +526,17 @@ again:
          */
         if (unlikely(desc->status & IRQ_INPROGRESS)) {
                 raw_spin_unlock_irq(&desc->lock);
-                chip_bus_sync_unlock(irq, desc);
+                chip_bus_sync_unlock(desc);
                 cpu_relax();
                 goto again;
         }
 
         if (!(desc->status & IRQ_DISABLED) && (desc->status & IRQ_MASKED)) {
                 desc->status &= ~IRQ_MASKED;
-                desc->chip->unmask(irq);
+                desc->irq_data.chip->irq_unmask(&desc->irq_data);
         }
         raw_spin_unlock_irq(&desc->lock);
-        chip_bus_sync_unlock(irq, desc);
+        chip_bus_sync_unlock(desc);
 }
 
 #ifdef CONFIG_SMP
@@ -556,7 +561,7 @@ irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
         }
 
         raw_spin_lock_irq(&desc->lock);
-        cpumask_copy(mask, desc->affinity);
+        cpumask_copy(mask, desc->irq_data.affinity);
         raw_spin_unlock_irq(&desc->lock);
 
         set_cpus_allowed_ptr(current, mask);
@@ -657,7 +662,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         if (!desc)
                 return -EINVAL;
 
-        if (desc->chip == &no_irq_chip)
+        if (desc->irq_data.chip == &no_irq_chip)
                 return -ENOSYS;
         /*
          * Some drivers like serial.c use request_irq() heavily,
@@ -752,7 +757,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         }
 
         if (!shared) {
-                irq_chip_set_defaults(desc->chip);
+                irq_chip_set_defaults(desc->irq_data.chip);
 
                 init_waitqueue_head(&desc->wait_for_threads);
 
@@ -779,7 +784,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                 if (!(desc->status & IRQ_NOAUTOEN)) {
                         desc->depth = 0;
                         desc->status &= ~IRQ_DISABLED;
-                        desc->chip->startup(irq);
+                        desc->irq_data.chip->irq_startup(&desc->irq_data);
                 } else
                         /* Undo nested disables: */
                         desc->depth = 1;
@@ -912,17 +917,17 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 
         /* Currently used only by UML, might disappear one day: */
 #ifdef CONFIG_IRQ_RELEASE_METHOD
-        if (desc->chip->release)
-                desc->chip->release(irq, dev_id);
+        if (desc->irq_data.chip->release)
+                desc->irq_data.chip->release(irq, dev_id);
 #endif
 
         /* If this was the last handler, shut down the IRQ line: */
         if (!desc->action) {
                 desc->status |= IRQ_DISABLED;
-                if (desc->chip->shutdown)
-                        desc->chip->shutdown(irq);
+                if (desc->irq_data.chip->irq_shutdown)
+                        desc->irq_data.chip->irq_shutdown(&desc->irq_data);
                 else
-                        desc->chip->disable(irq);
+                        desc->irq_data.chip->irq_disable(&desc->irq_data);
         }
 
 #ifdef CONFIG_SMP
@@ -997,9 +1002,9 @@ void free_irq(unsigned int irq, void *dev_id)
         if (!desc)
                 return;
 
-        chip_bus_lock(irq, desc);
+        chip_bus_lock(desc);
         kfree(__free_irq(irq, dev_id));
-        chip_bus_sync_unlock(irq, desc);
+        chip_bus_sync_unlock(desc);
 }
 EXPORT_SYMBOL(free_irq);
 
@@ -1086,9 +1091,9 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
         action->name = devname;
         action->dev_id = dev_id;
 
-        chip_bus_lock(irq, desc);
+        chip_bus_lock(desc);
         retval = __setup_irq(irq, desc, action);
-        chip_bus_sync_unlock(irq, desc);
+        chip_bus_sync_unlock(desc);
 
         if (retval)
                 kfree(action);
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index 241962280836..1d2541940480 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -7,6 +7,7 @@
 void move_masked_irq(int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_chip *chip = desc->irq_data.chip;
 
         if (likely(!(desc->status & IRQ_MOVE_PENDING)))
                 return;
@@ -24,7 +25,7 @@ void move_masked_irq(int irq)
         if (unlikely(cpumask_empty(desc->pending_mask)))
                 return;
 
-        if (!desc->chip->set_affinity)
+        if (!chip->irq_set_affinity)
                 return;
 
         assert_raw_spin_locked(&desc->lock);
@@ -43,8 +44,9 @@ void move_masked_irq(int irq)
          */
         if (likely(cpumask_any_and(desc->pending_mask, cpu_online_mask)
                    < nr_cpu_ids))
-                if (!desc->chip->set_affinity(irq, desc->pending_mask)) {
-                        cpumask_copy(desc->affinity, desc->pending_mask);
+                if (!chip->irq_set_affinity(&desc->irq_data,
+                                            desc->pending_mask, false)) {
+                        cpumask_copy(desc->irq_data.affinity, desc->pending_mask);
                         irq_set_thread_affinity(desc);
                 }
 
@@ -61,8 +63,8 @@ void move_native_irq(int irq)
         if (unlikely(desc->status & IRQ_DISABLED))
                 return;
 
-        desc->chip->mask(irq);
+        desc->irq_data.chip->irq_mask(&desc->irq_data);
         move_masked_irq(irq);
-        desc->chip->unmask(irq);
+        desc->irq_data.chip->irq_unmask(&desc->irq_data);
 }
 
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
deleted file mode 100644
index 65d3845665ac..000000000000
--- a/kernel/irq/numa_migrate.c
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * NUMA irq-desc migration code
- *
- * Migrate IRQ data structures (irq_desc, chip_data, etc.) over to
- * the new "home node" of the IRQ.
- */
-
-#include <linux/irq.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/random.h>
-#include <linux/interrupt.h>
-#include <linux/kernel_stat.h>
-
-#include "internals.h"
-
-static void init_copy_kstat_irqs(struct irq_desc *old_desc,
-                                 struct irq_desc *desc,
-                                 int node, int nr)
-{
-        init_kstat_irqs(desc, node, nr);
-
-        if (desc->kstat_irqs != old_desc->kstat_irqs)
-                memcpy(desc->kstat_irqs, old_desc->kstat_irqs,
-                         nr * sizeof(*desc->kstat_irqs));
-}
-
-static void free_kstat_irqs(struct irq_desc *old_desc, struct irq_desc *desc)
-{
-        if (old_desc->kstat_irqs == desc->kstat_irqs)
-                return;
-
-        kfree(old_desc->kstat_irqs);
-        old_desc->kstat_irqs = NULL;
-}
-
-static bool init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,
-                 struct irq_desc *desc, int node)
-{
-        memcpy(desc, old_desc, sizeof(struct irq_desc));
-        if (!alloc_desc_masks(desc, node, false)) {
-                printk(KERN_ERR "irq %d: can not get new irq_desc cpumask "
-                                "for migration.\n", irq);
-                return false;
-        }
-        raw_spin_lock_init(&desc->lock);
-        desc->node = node;
-        lockdep_set_class(&desc->lock, &irq_desc_lock_class);
-        init_copy_kstat_irqs(old_desc, desc, node, nr_cpu_ids);
-        init_copy_desc_masks(old_desc, desc);
-        arch_init_copy_chip_data(old_desc, desc, node);
-        return true;
-}
-
-static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc)
-{
-        free_kstat_irqs(old_desc, desc);
-        free_desc_masks(old_desc, desc);
-        arch_free_chip_data(old_desc, desc);
-}
-
-static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
-                                                int node)
-{
-        struct irq_desc *desc;
-        unsigned int irq;
-        unsigned long flags;
-
-        irq = old_desc->irq;
-
-        raw_spin_lock_irqsave(&sparse_irq_lock, flags);
-
-        /* We have to check it to avoid races with another CPU */
-        desc = irq_to_desc(irq);
-
-        if (desc && old_desc != desc)
-                goto out_unlock;
-
-        desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
-        if (!desc) {
-                printk(KERN_ERR "irq %d: can not get new irq_desc "
-                                "for migration.\n", irq);
-                /* still use old one */
-                desc = old_desc;
-                goto out_unlock;
-        }
-        if (!init_copy_one_irq_desc(irq, old_desc, desc, node)) {
-                /* still use old one */
-                kfree(desc);
-                desc = old_desc;
-                goto out_unlock;
-        }
-
-        replace_irq_desc(irq, desc);
-        raw_spin_unlock_irqrestore(&sparse_irq_lock, flags);
-
-        /* free the old one */
-        free_one_irq_desc(old_desc, desc);
-        kfree(old_desc);
-
-        return desc;
-
-out_unlock:
-        raw_spin_unlock_irqrestore(&sparse_irq_lock, flags);
-
-        return desc;
-}
-
-struct irq_desc *move_irq_desc(struct irq_desc *desc, int node)
-{
-        /* those static or target node is -1, do not move them */
-        if (desc->irq < NR_IRQS_LEGACY || node == -1)
-                return desc;
-
-        if (desc->node != node)
-                desc = __real_move_irq_desc(desc, node);
-
-        return desc;
-}
-
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 09a2ee540bd2..6c8a2a9f8a7b 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -21,7 +21,7 @@ static struct proc_dir_entry *root_irq_dir;
 static int irq_affinity_proc_show(struct seq_file *m, void *v)
 {
         struct irq_desc *desc = irq_to_desc((long)m->private);
-        const struct cpumask *mask = desc->affinity;
+        const struct cpumask *mask = desc->irq_data.affinity;
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         if (desc->status & IRQ_MOVE_PENDING)
@@ -65,7 +65,7 @@ static ssize_t irq_affinity_proc_write(struct file *file,
         cpumask_var_t new_value;
         int err;
 
-        if (!irq_to_desc(irq)->chip->set_affinity || no_irq_affinity ||
+        if (!irq_to_desc(irq)->irq_data.chip->irq_set_affinity || no_irq_affinity ||
             irq_balancing_disabled(irq))
                 return -EIO;
 
@@ -185,7 +185,7 @@ static int irq_node_proc_show(struct seq_file *m, void *v)
 {
         struct irq_desc *desc = irq_to_desc((long) m->private);
 
-        seq_printf(m, "%d\n", desc->node);
+        seq_printf(m, "%d\n", desc->irq_data.node);
         return 0;
 }
 
@@ -214,7 +214,7 @@ static int irq_spurious_proc_show(struct seq_file *m, void *v)
 
 static int irq_spurious_proc_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, irq_spurious_proc_show, NULL);
+        return single_open(file, irq_spurious_proc_show, PDE(inode)->data);
 }
 
 static const struct file_operations irq_spurious_proc_fops = {
@@ -269,7 +269,7 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
 {
         char name [MAX_NAMELEN];
 
-        if (!root_irq_dir || (desc->chip == &no_irq_chip) || desc->dir)
+        if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir)
                 return;
 
         memset(name, 0, MAX_NAMELEN);
@@ -297,6 +297,24 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
                          &irq_spurious_proc_fops, (void *)(long)irq);
 }
 
+void unregister_irq_proc(unsigned int irq, struct irq_desc *desc)
+{
+        char name [MAX_NAMELEN];
+
+        if (!root_irq_dir || !desc->dir)
+                return;
+#ifdef CONFIG_SMP
+        remove_proc_entry("smp_affinity", desc->dir);
+        remove_proc_entry("affinity_hint", desc->dir);
+        remove_proc_entry("node", desc->dir);
+#endif
+        remove_proc_entry("spurious", desc->dir);
+
+        memset(name, 0, MAX_NAMELEN);
+        sprintf(name, "%u", irq);
+        remove_proc_entry(name, root_irq_dir);
+}
+
 #undef MAX_NAMELEN
 
 void unregister_handler_proc(unsigned int irq, struct irqaction *action)
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index 090c3763f3a2..891115a929aa 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -60,7 +60,7 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
         /*
          * Make sure the interrupt is enabled, before resending it:
          */
-        desc->chip->enable(irq);
+        desc->irq_data.chip->irq_enable(&desc->irq_data);
 
         /*
          * We do not resend level type interrupts. Level type
@@ -70,7 +70,8 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
         if ((status & (IRQ_LEVEL | IRQ_PENDING | IRQ_REPLAY)) == IRQ_PENDING) {
                 desc->status = (status & ~IRQ_PENDING) | IRQ_REPLAY;
 
-                if (!desc->chip->retrigger || !desc->chip->retrigger(irq)) {
+                if (!desc->irq_data.chip->irq_retrigger ||
+                    !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
 #ifdef CONFIG_HARDIRQS_SW_RESEND
                         /* Set it pending and activate the softirq: */
                         set_bit(irq, irqs_resend);
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 89fb90ae534f..3089d3b9d5f3 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -14,6 +14,8 @@
 #include <linux/moduleparam.h>
 #include <linux/timer.h>
 
+#include "internals.h"
+
 static int irqfixup __read_mostly;
 
 #define POLL_SPURIOUS_IRQ_INTERVAL (HZ/10)
@@ -78,8 +80,8 @@ static int try_one_irq(int irq, struct irq_desc *desc)
          * If we did actual work for the real IRQ line we must let the
          * IRQ controller clean up too
          */
-        if (work && desc->chip && desc->chip->end)
-                desc->chip->end(irq);
+        if (work)
+                irq_end(irq, desc);
         raw_spin_unlock(&desc->lock);
 
         return ok;
@@ -254,7 +256,7 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
                 printk(KERN_EMERG "Disabling IRQ #%d\n", irq);
                 desc->status |= IRQ_DISABLED | IRQ_SPURIOUS_DISABLED;
                 desc->depth++;
-                desc->chip->disable(irq);
+                desc->irq_data.chip->irq_disable(&desc->irq_data);
 
                 mod_timer(&poll_spurious_irq_timer,
                           jiffies + POLL_SPURIOUS_IRQ_INTERVAL);
diff --git a/kernel/irq_work.c b/kernel/irq_work.c
new file mode 100644
index 000000000000..90f881904bb1
--- /dev/null
+++ b/kernel/irq_work.c
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2010 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *
+ * Provides a framework for enqueueing and running callbacks from hardirq
+ * context. The enqueueing is NMI-safe.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/irq_work.h>
+#include <linux/hardirq.h>
+
+/*
+ * An entry can be in one of four states:
+ *
+ * free      NULL, 0 -> {claimed}       : free to be used
+ * claimed   NULL, 3 -> {pending}       : claimed to be enqueued
+ * pending   next, 3 -> {busy}          : queued, pending callback
+ * busy      NULL, 2 -> {free, claimed} : callback in progress, can be claimed
+ *
+ * We use the lower two bits of the next pointer to keep PENDING and BUSY
+ * flags.
+ */
+
+#define IRQ_WORK_PENDING        1UL
+#define IRQ_WORK_BUSY           2UL
+#define IRQ_WORK_FLAGS          3UL
+
+static inline bool irq_work_is_set(struct irq_work *entry, int flags)
+{
+        return (unsigned long)entry->next & flags;
+}
+
+static inline struct irq_work *irq_work_next(struct irq_work *entry)
+{
+        unsigned long next = (unsigned long)entry->next;
+        next &= ~IRQ_WORK_FLAGS;
+        return (struct irq_work *)next;
+}
+
+static inline struct irq_work *next_flags(struct irq_work *entry, int flags)
+{
+        unsigned long next = (unsigned long)entry;
+        next |= flags;
+        return (struct irq_work *)next;
+}
+
+static DEFINE_PER_CPU(struct irq_work *, irq_work_list);
+
+/*
+ * Claim the entry so that no one else will poke at it.
+ */
+static bool irq_work_claim(struct irq_work *entry)
+{
+        struct irq_work *next, *nflags;
+
+        do {
+                next = entry->next;
+                if ((unsigned long)next & IRQ_WORK_PENDING)
+                        return false;
+                nflags = next_flags(next, IRQ_WORK_FLAGS);
+        } while (cmpxchg(&entry->next, next, nflags) != next);
+
+        return true;
+}
+
+
+void __weak arch_irq_work_raise(void)
+{
+        /*
+         * Lame architectures will get the timer tick callback
+         */
+}
+
+/*
+ * Queue the entry and raise the IPI if needed.
+ */
+static void __irq_work_queue(struct irq_work *entry)
+{
+        struct irq_work **head, *next;
+
+        head = &get_cpu_var(irq_work_list);
+
+        do {
+                next = *head;
+                /* Can assign non-atomic because we keep the flags set. */
+                entry->next = next_flags(next, IRQ_WORK_FLAGS);
+        } while (cmpxchg(head, next, entry) != next);
+
+        /* The list was empty, raise self-interrupt to start processing. */
+        if (!irq_work_next(entry))
+                arch_irq_work_raise();
+
+        put_cpu_var(irq_work_list);
+}
+
+/*
+ * Enqueue the irq_work @entry, returns true on success, failure when the
+ * @entry was already enqueued by someone else.
+ *
+ * Can be re-enqueued while the callback is still in progress.
+ */
+bool irq_work_queue(struct irq_work *entry)
+{
+        if (!irq_work_claim(entry)) {
+                /*
+                 * Already enqueued, can't do!
+                 */
+                return false;
+        }
+
+        __irq_work_queue(entry);
+        return true;
+}
+EXPORT_SYMBOL_GPL(irq_work_queue);
+
+/*
+ * Run the irq_work entries on this cpu. Requires to be ran from hardirq
+ * context with local IRQs disabled.
+ */
+void irq_work_run(void)
+{
+        struct irq_work *list, **head;
+
+        head = &__get_cpu_var(irq_work_list);
+        if (*head == NULL)
+                return;
+
+        BUG_ON(!in_irq());
+        BUG_ON(!irqs_disabled());
+
+        list = xchg(head, NULL);
+        while (list != NULL) {
+                struct irq_work *entry = list;
+
+                list = irq_work_next(list);
+
+                /*
+                 * Clear the PENDING bit, after this point the @entry
+                 * can be re-used.
+                 */
+                entry->next = next_flags(NULL, IRQ_WORK_BUSY);
+                entry->func(entry);
+                /*
+                 * Clear the BUSY bit and return to the free state if
+                 * no-one else claimed it meanwhile.
+                 */
+                (void)cmpxchg(&entry->next,
+                              next_flags(NULL, IRQ_WORK_BUSY),
+                              NULL);
+        }
+}
+EXPORT_SYMBOL_GPL(irq_work_run);
+
+/*
+ * Synchronize against the irq_work @entry, ensures the entry is not
+ * currently in use.
+ */
+void irq_work_sync(struct irq_work *entry)
+{
+        WARN_ON_ONCE(irqs_disabled());
+
+        while (irq_work_is_set(entry, IRQ_WORK_BUSY))
+                cpu_relax();
+}
+EXPORT_SYMBOL_GPL(irq_work_sync);
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
new file mode 100644
index 000000000000..3b79bd938330
--- /dev/null
+++ b/kernel/jump_label.c
@@ -0,0 +1,484 @@
+/*
+ * jump label support
+ *
+ * Copyright (C) 2009 Jason Baron <jbaron@redhat.com>
+ *
+ */
+#include <linux/jump_label.h>
+#include <linux/memory.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/jhash.h>
+#include <linux/slab.h>
+#include <linux/sort.h>
+#include <linux/err.h>
+
+#ifdef HAVE_JUMP_LABEL
+
+#define JUMP_LABEL_HASH_BITS 6
+#define JUMP_LABEL_TABLE_SIZE (1 << JUMP_LABEL_HASH_BITS)
+static struct hlist_head jump_label_table[JUMP_LABEL_TABLE_SIZE];
+
+/* mutex to protect coming/going of the the jump_label table */
+static DEFINE_MUTEX(jump_label_mutex);
+
+struct jump_label_entry {
+        struct hlist_node hlist;
+        struct jump_entry *table;
+        int nr_entries;
+        /* hang modules off here */
+        struct hlist_head modules;
+        unsigned long key;
+};
+
+struct jump_label_module_entry {
+        struct hlist_node hlist;
+        struct jump_entry *table;
+        int nr_entries;
+        struct module *mod;
+};
+
+void jump_label_lock(void)
+{
+        mutex_lock(&jump_label_mutex);
+}
+
+void jump_label_unlock(void)
+{
+        mutex_unlock(&jump_label_mutex);
+}
+
+static int jump_label_cmp(const void *a, const void *b)
+{
+        const struct jump_entry *jea = a;
+        const struct jump_entry *jeb = b;
+
+        if (jea->key < jeb->key)
+                return -1;
+
+        if (jea->key > jeb->key)
+                return 1;
+
+        return 0;
+}
+
+static void
+sort_jump_label_entries(struct jump_entry *start, struct jump_entry *stop)
+{
+        unsigned long size;
+
+        size = (((unsigned long)stop - (unsigned long)start)
+                                        / sizeof(struct jump_entry));
+        sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
+}
+
+static struct jump_label_entry *get_jump_label_entry(jump_label_t key)
+{
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct jump_label_entry *e;
+        u32 hash = jhash((void *)&key, sizeof(jump_label_t), 0);
+
+        head = &jump_label_table[hash & (JUMP_LABEL_TABLE_SIZE - 1)];
+        hlist_for_each_entry(e, node, head, hlist) {
+                if (key == e->key)
+                        return e;
+        }
+        return NULL;
+}
+
+static struct jump_label_entry *
+add_jump_label_entry(jump_label_t key, int nr_entries, struct jump_entry *table)
+{
+        struct hlist_head *head;
+        struct jump_label_entry *e;
+        u32 hash;
+
+        e = get_jump_label_entry(key);
+        if (e)
+                return ERR_PTR(-EEXIST);
+
+        e = kmalloc(sizeof(struct jump_label_entry), GFP_KERNEL);
+        if (!e)
+                return ERR_PTR(-ENOMEM);
+
+        hash = jhash((void *)&key, sizeof(jump_label_t), 0);
+        head = &jump_label_table[hash & (JUMP_LABEL_TABLE_SIZE - 1)];
+        e->key = key;
+        e->table = table;
+        e->nr_entries = nr_entries;
+        INIT_HLIST_HEAD(&(e->modules));
+        hlist_add_head(&e->hlist, head);
+        return e;
+}
+
+static int
+build_jump_label_hashtable(struct jump_entry *start, struct jump_entry *stop)
+{
+        struct jump_entry *iter, *iter_begin;
+        struct jump_label_entry *entry;
+        int count;
+
+        sort_jump_label_entries(start, stop);
+        iter = start;
+        while (iter < stop) {
+                entry = get_jump_label_entry(iter->key);
+                if (!entry) {
+                        iter_begin = iter;
+                        count = 0;
+                        while ((iter < stop) &&
+                                (iter->key == iter_begin->key)) {
+                                iter++;
+                                count++;
+                        }
+                        entry = add_jump_label_entry(iter_begin->key,
+                                                        count, iter_begin);
+                        if (IS_ERR(entry))
+                                return PTR_ERR(entry);
+                 } else {
+                        WARN_ONCE(1, KERN_ERR "build_jump_hashtable: unexpected entry!\n");
+                        return -1;
+                }
+        }
+        return 0;
+}
+
+/***
+ * jump_label_update - update jump label text
+ * @key -  key value associated with a a jump label
+ * @type - enum set to JUMP_LABEL_ENABLE or JUMP_LABEL_DISABLE
+ *
+ * Will enable/disable the jump for jump label @key, depending on the
+ * value of @type.
+ *
+ */
+
+void jump_label_update(unsigned long key, enum jump_label_type type)
+{
+        struct jump_entry *iter;
+        struct jump_label_entry *entry;
+        struct hlist_node *module_node;
+        struct jump_label_module_entry *e_module;
+        int count;
+
+        jump_label_lock();
+        entry = get_jump_label_entry((jump_label_t)key);
+        if (entry) {
+                count = entry->nr_entries;
+                iter = entry->table;
+                while (count--) {
+                        if (kernel_text_address(iter->code))
+                                arch_jump_label_transform(iter, type);
+                        iter++;
+                }
+                /* eanble/disable jump labels in modules */
+                hlist_for_each_entry(e_module, module_node, &(entry->modules),
+                                                        hlist) {
+                        count = e_module->nr_entries;
+                        iter = e_module->table;
+                        while (count--) {
+                                if (iter->key &&
+                                                kernel_text_address(iter->code))
+                                        arch_jump_label_transform(iter, type);
+                                iter++;
+                        }
+                }
+        }
+        jump_label_unlock();
+}
+
+static int addr_conflict(struct jump_entry *entry, void *start, void *end)
+{
+        if (entry->code <= (unsigned long)end &&
+                entry->code + JUMP_LABEL_NOP_SIZE > (unsigned long)start)
+                return 1;
+
+        return 0;
+}
+
+#ifdef CONFIG_MODULES
+
+static int module_conflict(void *start, void *end)
+{
+        struct hlist_head *head;
+        struct hlist_node *node, *node_next, *module_node, *module_node_next;
+        struct jump_label_entry *e;
+        struct jump_label_module_entry *e_module;
+        struct jump_entry *iter;
+        int i, count;
+        int conflict = 0;
+
+        for (i = 0; i < JUMP_LABEL_TABLE_SIZE; i++) {
+                head = &jump_label_table[i];
+                hlist_for_each_entry_safe(e, node, node_next, head, hlist) {
+                        hlist_for_each_entry_safe(e_module, module_node,
+                                                        module_node_next,
+                                                        &(e->modules), hlist) {
+                                count = e_module->nr_entries;
+                                iter = e_module->table;
+                                while (count--) {
+                                        if (addr_conflict(iter, start, end)) {
+                                                conflict = 1;
+                                                goto out;
+                                        }
+                                        iter++;
+                                }
+                        }
+                }
+        }
+out:
+        return conflict;
+}
+
+#endif
+
+/***
+ * jump_label_text_reserved - check if addr range is reserved
+ * @start: start text addr
+ * @end: end text addr
+ *
+ * checks if the text addr located between @start and @end
+ * overlaps with any of the jump label patch addresses. Code
+ * that wants to modify kernel text should first verify that
+ * it does not overlap with any of the jump label addresses.
+ * Caller must hold jump_label_mutex.
+ *
+ * returns 1 if there is an overlap, 0 otherwise
+ */
+int jump_label_text_reserved(void *start, void *end)
+{
+        struct jump_entry *iter;
+        struct jump_entry *iter_start = __start___jump_table;
+        struct jump_entry *iter_stop = __start___jump_table;
+        int conflict = 0;
+
+        iter = iter_start;
+        while (iter < iter_stop) {
+                if (addr_conflict(iter, start, end)) {
+                        conflict = 1;
+                        goto out;
+                }
+                iter++;
+        }
+
+        /* now check modules */
+#ifdef CONFIG_MODULES
+        conflict = module_conflict(start, end);
+#endif
+out:
+        return conflict;
+}
+
+/*
+ * Not all archs need this.
+ */
+void __weak arch_jump_label_text_poke_early(jump_label_t addr)
+{
+}
+
+static __init int init_jump_label(void)
+{
+        int ret;
+        struct jump_entry *iter_start = __start___jump_table;
+        struct jump_entry *iter_stop = __stop___jump_table;
+        struct jump_entry *iter;
+
+        jump_label_lock();
+        ret = build_jump_label_hashtable(__start___jump_table,
+                                         __stop___jump_table);
+        iter = iter_start;
+        while (iter < iter_stop) {
+                arch_jump_label_text_poke_early(iter->code);
+                iter++;
+        }
+        jump_label_unlock();
+        return ret;
+}
+early_initcall(init_jump_label);
+
+#ifdef CONFIG_MODULES
+
+static struct jump_label_module_entry *
+add_jump_label_module_entry(struct jump_label_entry *entry,
+                            struct jump_entry *iter_begin,
+                            int count, struct module *mod)
+{
+        struct jump_label_module_entry *e;
+
+        e = kmalloc(sizeof(struct jump_label_module_entry), GFP_KERNEL);
+        if (!e)
+                return ERR_PTR(-ENOMEM);
+        e->mod = mod;
+        e->nr_entries = count;
+        e->table = iter_begin;
+        hlist_add_head(&e->hlist, &entry->modules);
+        return e;
+}
+
+static int add_jump_label_module(struct module *mod)
+{
+        struct jump_entry *iter, *iter_begin;
+        struct jump_label_entry *entry;
+        struct jump_label_module_entry *module_entry;
+        int count;
+
+        /* if the module doesn't have jump label entries, just return */
+        if (!mod->num_jump_entries)
+                return 0;
+
+        sort_jump_label_entries(mod->jump_entries,
+                                mod->jump_entries + mod->num_jump_entries);
+        iter = mod->jump_entries;
+        while (iter < mod->jump_entries + mod->num_jump_entries) {
+                entry = get_jump_label_entry(iter->key);
+                iter_begin = iter;
+                count = 0;
+                while ((iter < mod->jump_entries + mod->num_jump_entries) &&
+                        (iter->key == iter_begin->key)) {
+                                iter++;
+                                count++;
+                }
+                if (!entry) {
+                        entry = add_jump_label_entry(iter_begin->key, 0, NULL);
+                        if (IS_ERR(entry))
+                                return PTR_ERR(entry);
+                }
+                module_entry = add_jump_label_module_entry(entry, iter_begin,
+                                                           count, mod);
+                if (IS_ERR(module_entry))
+                        return PTR_ERR(module_entry);
+        }
+        return 0;
+}
+
+static void remove_jump_label_module(struct module *mod)
+{
+        struct hlist_head *head;
+        struct hlist_node *node, *node_next, *module_node, *module_node_next;
+        struct jump_label_entry *e;
+        struct jump_label_module_entry *e_module;
+        int i;
+
+        /* if the module doesn't have jump label entries, just return */
+        if (!mod->num_jump_entries)
+                return;
+
+        for (i = 0; i < JUMP_LABEL_TABLE_SIZE; i++) {
+                head = &jump_label_table[i];
+                hlist_for_each_entry_safe(e, node, node_next, head, hlist) {
+                        hlist_for_each_entry_safe(e_module, module_node,
+                                                  module_node_next,
+                                                  &(e->modules), hlist) {
+                                if (e_module->mod == mod) {
+                                        hlist_del(&e_module->hlist);
+                                        kfree(e_module);
+                                }
+                        }
+                        if (hlist_empty(&e->modules) && (e->nr_entries == 0)) {
+                                hlist_del(&e->hlist);
+                                kfree(e);
+                        }
+                }
+        }
+}
+
+static void remove_jump_label_module_init(struct module *mod)
+{
+        struct hlist_head *head;
+        struct hlist_node *node, *node_next, *module_node, *module_node_next;
+        struct jump_label_entry *e;
+        struct jump_label_module_entry *e_module;
+        struct jump_entry *iter;
+        int i, count;
+
+        /* if the module doesn't have jump label entries, just return */
+        if (!mod->num_jump_entries)
+                return;
+
+        for (i = 0; i < JUMP_LABEL_TABLE_SIZE; i++) {
+                head = &jump_label_table[i];
+                hlist_for_each_entry_safe(e, node, node_next, head, hlist) {
+                        hlist_for_each_entry_safe(e_module, module_node,
+                                                  module_node_next,
+                                                  &(e->modules), hlist) {
+                                if (e_module->mod != mod)
+                                        continue;
+                                count = e_module->nr_entries;
+                                iter = e_module->table;
+                                while (count--) {
+                                        if (within_module_init(iter->code, mod))
+                                                iter->key = 0;
+                                        iter++;
+                                }
+                        }
+                }
+        }
+}
+
+static int
+jump_label_module_notify(struct notifier_block *self, unsigned long val,
+                         void *data)
+{
+        struct module *mod = data;
+        int ret = 0;
+
+        switch (val) {
+        case MODULE_STATE_COMING:
+                jump_label_lock();
+                ret = add_jump_label_module(mod);
+                if (ret)
+                        remove_jump_label_module(mod);
+                jump_label_unlock();
+                break;
+        case MODULE_STATE_GOING:
+                jump_label_lock();
+                remove_jump_label_module(mod);
+                jump_label_unlock();
+                break;
+        case MODULE_STATE_LIVE:
+                jump_label_lock();
+                remove_jump_label_module_init(mod);
+                jump_label_unlock();
+                break;
+        }
+        return ret;
+}
+
+/***
+ * apply_jump_label_nops - patch module jump labels with arch_get_jump_label_nop()
+ * @mod: module to patch
+ *
+ * Allow for run-time selection of the optimal nops. Before the module
+ * loads patch these with arch_get_jump_label_nop(), which is specified by
+ * the arch specific jump label code.
+ */
+void jump_label_apply_nops(struct module *mod)
+{
+        struct jump_entry *iter;
+
+        /* if the module doesn't have jump label entries, just return */
+        if (!mod->num_jump_entries)
+                return;
+
+        iter = mod->jump_entries;
+        while (iter < mod->jump_entries + mod->num_jump_entries) {
+                arch_jump_label_text_poke_early(iter->code);
+                iter++;
+        }
+}
+
+struct notifier_block jump_label_module_nb = {
+        .notifier_call = jump_label_module_notify,
+        .priority = 0,
+};
+
+static __init int init_jump_label_module(void)
+{
+        return register_module_notifier(&jump_label_module_nb);
+}
+early_initcall(init_jump_label_module);
+
+#endif /* CONFIG_MODULES */
+
+#endif
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 131b1703936f..b55045bc7563 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -151,8 +151,10 @@ static int do_kimage_alloc(struct kimage **rimage, unsigned long entry,
         image->nr_segments = nr_segments;
         segment_bytes = nr_segments * sizeof(*segments);
         result = copy_from_user(image->segment, segments, segment_bytes);
-        if (result)
+        if (result) {
+                result = -EFAULT;
                 goto out;
+        }
 
         /*
          * Verify we have good destination addresses.  The caller is
@@ -814,7 +816,7 @@ static int kimage_load_normal_segment(struct kimage *image,
 
                 ptr = kmap(page);
                 /* Start with a clear page */
-                memset(ptr, 0, PAGE_SIZE);
+                clear_page(ptr);
                 ptr += maddr & ~PAGE_MASK;
                 mchunk = PAGE_SIZE - (maddr & ~PAGE_MASK);
                 if (mchunk > mbytes)
@@ -827,7 +829,7 @@ static int kimage_load_normal_segment(struct kimage *image,
                 result = copy_from_user(ptr, buf, uchunk);
                 kunmap(page);
                 if (result) {
-                        result = (result < 0) ? result : -EIO;
+                        result = -EFAULT;
                         goto out;
                 }
                 ubytes -= uchunk;
@@ -882,7 +884,7 @@ static int kimage_load_crash_segment(struct kimage *image,
                 kexec_flush_icache_page(page);
                 kunmap(page);
                 if (result) {
-                        result = (result < 0) ? result : -EIO;
+                        result = -EFAULT;
                         goto out;
                 }
                 ubytes -= uchunk;
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 35edbe22e9a9..01a0700e873f 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -1,8 +1,7 @@
 /*
- * A generic kernel FIFO implementation.
+ * A generic kernel FIFO implementation
  *
- * Copyright (C) 2009 Stefani Seibold <stefani@seibold.net>
- * Copyright (C) 2004 Stelian Pop <stelian@popies.net>
+ * Copyright (C) 2009/2010 Stefani Seibold <stefani@seibold.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -11,7 +10,7 @@
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
@@ -24,422 +23,586 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/err.h>
-#include <linux/kfifo.h>
 #include <linux/log2.h>
 #include <linux/uaccess.h>
+#include <linux/kfifo.h>
 
-static void _kfifo_init(struct kfifo *fifo, void *buffer,
-                unsigned int size)
-{
-        fifo->buffer = buffer;
-        fifo->size = size;
-
-        kfifo_reset(fifo);
-}
-
-/**
- * kfifo_init - initialize a FIFO using a preallocated buffer
- * @fifo: the fifo to assign the buffer
- * @buffer: the preallocated buffer to be used.
- * @size: the size of the internal buffer, this has to be a power of 2.
- *
+/*
+ * internal helper to calculate the unused elements in a fifo
  */
-void kfifo_init(struct kfifo *fifo, void *buffer, unsigned int size)
+static inline unsigned int kfifo_unused(struct __kfifo *fifo)
 {
-        /* size must be a power of 2 */
-        BUG_ON(!is_power_of_2(size));
-
-        _kfifo_init(fifo, buffer, size);
+        return (fifo->mask + 1) - (fifo->in - fifo->out);
 }
-EXPORT_SYMBOL(kfifo_init);
 
-/**
- * kfifo_alloc - allocates a new FIFO internal buffer
- * @fifo: the fifo to assign then new buffer
- * @size: the size of the buffer to be allocated, this have to be a power of 2.
- * @gfp_mask: get_free_pages mask, passed to kmalloc()
- *
- * This function dynamically allocates a new fifo internal buffer
- *
- * The size will be rounded-up to a power of 2.
- * The buffer will be release with kfifo_free().
- * Return 0 if no error, otherwise the an error code
- */
-int kfifo_alloc(struct kfifo *fifo, unsigned int size, gfp_t gfp_mask)
+int __kfifo_alloc(struct __kfifo *fifo, unsigned int size,
+                size_t esize, gfp_t gfp_mask)
 {
-        unsigned char *buffer;
-
         /*
-         * round up to the next power of 2, since our 'let the indices
+         * round down to the next power of 2, since our 'let the indices
          * wrap' technique works only in this case.
          */
-        if (!is_power_of_2(size)) {
-                BUG_ON(size > 0x80000000);
-                size = roundup_pow_of_two(size);
+        if (!is_power_of_2(size))
+                size = rounddown_pow_of_two(size);
+
+        fifo->in = 0;
+        fifo->out = 0;
+        fifo->esize = esize;
+
+        if (size < 2) {
+                fifo->data = NULL;
+                fifo->mask = 0;
+                return -EINVAL;
         }
 
-        buffer = kmalloc(size, gfp_mask);
-        if (!buffer) {
-                _kfifo_init(fifo, NULL, 0);
+        fifo->data = kmalloc(size * esize, gfp_mask);
+
+        if (!fifo->data) {
+                fifo->mask = 0;
                 return -ENOMEM;
         }
-
-        _kfifo_init(fifo, buffer, size);
+        fifo->mask = size - 1;
 
         return 0;
 }
-EXPORT_SYMBOL(kfifo_alloc);
+EXPORT_SYMBOL(__kfifo_alloc);
 
-/**
- * kfifo_free - frees the FIFO internal buffer
- * @fifo: the fifo to be freed.
- */
-void kfifo_free(struct kfifo *fifo)
+void __kfifo_free(struct __kfifo *fifo)
 {
-        kfree(fifo->buffer);
-        _kfifo_init(fifo, NULL, 0);
+        kfree(fifo->data);
+        fifo->in = 0;
+        fifo->out = 0;
+        fifo->esize = 0;
+        fifo->data = NULL;
+        fifo->mask = 0;
 }
-EXPORT_SYMBOL(kfifo_free);
+EXPORT_SYMBOL(__kfifo_free);
 
-/**
- * kfifo_skip - skip output data
- * @fifo: the fifo to be used.
- * @len: number of bytes to skip
- */
-void kfifo_skip(struct kfifo *fifo, unsigned int len)
+int __kfifo_init(struct __kfifo *fifo, void *buffer,
+                unsigned int size, size_t esize)
 {
-        if (len < kfifo_len(fifo)) {
-                __kfifo_add_out(fifo, len);
-                return;
+        size /= esize;
+
+        if (!is_power_of_2(size))
+                size = rounddown_pow_of_two(size);
+
+        fifo->in = 0;
+        fifo->out = 0;
+        fifo->esize = esize;
+        fifo->data = buffer;
+
+        if (size < 2) {
+                fifo->mask = 0;
+                return -EINVAL;
         }
-        kfifo_reset_out(fifo);
+        fifo->mask = size - 1;
+
+        return 0;
 }
-EXPORT_SYMBOL(kfifo_skip);
+EXPORT_SYMBOL(__kfifo_init);
 
-static inline void __kfifo_in_data(struct kfifo *fifo,
-                const void *from, unsigned int len, unsigned int off)
+static void kfifo_copy_in(struct __kfifo *fifo, const void *src,
+                unsigned int len, unsigned int off)
 {
+        unsigned int size = fifo->mask + 1;
+        unsigned int esize = fifo->esize;
         unsigned int l;
 
+        off &= fifo->mask;
+        if (esize != 1) {
+                off *= esize;
+                size *= esize;
+                len *= esize;
+        }
+        l = min(len, size - off);
+
+        memcpy(fifo->data + off, src, l);
+        memcpy(fifo->data, src + l, len - l);
         /*
-         * Ensure that we sample the fifo->out index -before- we
-         * start putting bytes into the kfifo.
+         * make sure that the data in the fifo is up to date before
+         * incrementing the fifo->in index counter
          */
+        smp_wmb();
+}
 
-        smp_mb();
-
-        off = __kfifo_off(fifo, fifo->in + off);
+unsigned int __kfifo_in(struct __kfifo *fifo,
+                const void *buf, unsigned int len)
+{
+        unsigned int l;
 
-        /* first put the data starting from fifo->in to buffer end */
-        l = min(len, fifo->size - off);
-        memcpy(fifo->buffer + off, from, l);
+        l = kfifo_unused(fifo);
+        if (len > l)
+                len = l;
 
-        /* then put the rest (if any) at the beginning of the buffer */
-        memcpy(fifo->buffer, from + l, len - l);
+        kfifo_copy_in(fifo, buf, len, fifo->in);
+        fifo->in += len;
+        return len;
 }
+EXPORT_SYMBOL(__kfifo_in);
 
-static inline void __kfifo_out_data(struct kfifo *fifo,
-                void *to, unsigned int len, unsigned int off)
+static void kfifo_copy_out(struct __kfifo *fifo, void *dst,
+                unsigned int len, unsigned int off)
 {
+        unsigned int size = fifo->mask + 1;
+        unsigned int esize = fifo->esize;
         unsigned int l;
 
+        off &= fifo->mask;
+        if (esize != 1) {
+                off *= esize;
+                size *= esize;
+                len *= esize;
+        }
+        l = min(len, size - off);
+
+        memcpy(dst, fifo->data + off, l);
+        memcpy(dst + l, fifo->data, len - l);
         /*
-         * Ensure that we sample the fifo->in index -before- we
-         * start removing bytes from the kfifo.
+         * make sure that the data is copied before
+         * incrementing the fifo->out index counter
          */
+        smp_wmb();
+}
 
-        smp_rmb();
+unsigned int __kfifo_out_peek(struct __kfifo *fifo,
+                void *buf, unsigned int len)
+{
+        unsigned int l;
 
-        off = __kfifo_off(fifo, fifo->out + off);
+        l = fifo->in - fifo->out;
+        if (len > l)
+                len = l;
 
-        /* first get the data from fifo->out until the end of the buffer */
-        l = min(len, fifo->size - off);
-        memcpy(to, fifo->buffer + off, l);
+        kfifo_copy_out(fifo, buf, len, fifo->out);
+        return len;
+}
+EXPORT_SYMBOL(__kfifo_out_peek);
 
-        /* then get the rest (if any) from the beginning of the buffer */
-        memcpy(to + l, fifo->buffer, len - l);
+unsigned int __kfifo_out(struct __kfifo *fifo,
+                void *buf, unsigned int len)
+{
+        len = __kfifo_out_peek(fifo, buf, len);
+        fifo->out += len;
+        return len;
 }
+EXPORT_SYMBOL(__kfifo_out);
 
-static inline int __kfifo_from_user_data(struct kfifo *fifo,
-         const void __user *from, unsigned int len, unsigned int off,
-         unsigned *lenout)
+static unsigned long kfifo_copy_from_user(struct __kfifo *fifo,
+        const void __user *from, unsigned int len, unsigned int off,
+        unsigned int *copied)
 {
+        unsigned int size = fifo->mask + 1;
+        unsigned int esize = fifo->esize;
         unsigned int l;
-        int ret;
+        unsigned long ret;
 
+        off &= fifo->mask;
+        if (esize != 1) {
+                off *= esize;
+                size *= esize;
+                len *= esize;
+        }
+        l = min(len, size - off);
+
+        ret = copy_from_user(fifo->data + off, from, l);
+        if (unlikely(ret))
+                ret = DIV_ROUND_UP(ret + len - l, esize);
+        else {
+                ret = copy_from_user(fifo->data, from + l, len - l);
+                if (unlikely(ret))
+                        ret = DIV_ROUND_UP(ret, esize);
+        }
         /*
-         * Ensure that we sample the fifo->out index -before- we
-         * start putting bytes into the kfifo.
+         * make sure that the data in the fifo is up to date before
+         * incrementing the fifo->in index counter
          */
+        smp_wmb();
+        *copied = len - ret;
+        /* return the number of elements which are not copied */
+        return ret;
+}
 
-        smp_mb();
+int __kfifo_from_user(struct __kfifo *fifo, const void __user *from,
+                unsigned long len, unsigned int *copied)
+{
+        unsigned int l;
+        unsigned long ret;
+        unsigned int esize = fifo->esize;
+        int err;
 
-        off = __kfifo_off(fifo, fifo->in + off);
+        if (esize != 1)
+                len /= esize;
 
-        /* first put the data starting from fifo->in to buffer end */
-        l = min(len, fifo->size - off);
-        ret = copy_from_user(fifo->buffer + off, from, l);
-        if (unlikely(ret)) {
-                *lenout = ret;
-                return -EFAULT;
-        }
-        *lenout = l;
+        l = kfifo_unused(fifo);
+        if (len > l)
+                len = l;
 
-        /* then put the rest (if any) at the beginning of the buffer */
-        ret = copy_from_user(fifo->buffer, from + l, len - l);
-        *lenout += ret ? ret : len - l;
-        return ret ? -EFAULT : 0;
+        ret = kfifo_copy_from_user(fifo, from, len, fifo->in, copied);
+        if (unlikely(ret)) {
+                len -= ret;
+                err = -EFAULT;
+        } else
+                err = 0;
+        fifo->in += len;
+        return err;
 }
+EXPORT_SYMBOL(__kfifo_from_user);
 
-static inline int __kfifo_to_user_data(struct kfifo *fifo,
-                void __user *to, unsigned int len, unsigned int off, unsigned *lenout)
+static unsigned long kfifo_copy_to_user(struct __kfifo *fifo, void __user *to,
+                unsigned int len, unsigned int off, unsigned int *copied)
 {
         unsigned int l;
-        int ret;
-
+        unsigned long ret;
+        unsigned int size = fifo->mask + 1;
+        unsigned int esize = fifo->esize;
+
+        off &= fifo->mask;
+        if (esize != 1) {
+                off *= esize;
+                size *= esize;
+                len *= esize;
+        }
+        l = min(len, size - off);
+
+        ret = copy_to_user(to, fifo->data + off, l);
+        if (unlikely(ret))
+                ret = DIV_ROUND_UP(ret + len - l, esize);
+        else {
+                ret = copy_to_user(to + l, fifo->data, len - l);
+                if (unlikely(ret))
+                        ret = DIV_ROUND_UP(ret, esize);
+        }
         /*
-         * Ensure that we sample the fifo->in index -before- we
-         * start removing bytes from the kfifo.
+         * make sure that the data is copied before
+         * incrementing the fifo->out index counter
          */
+        smp_wmb();
+        *copied = len - ret;
+        /* return the number of elements which are not copied */
+        return ret;
+}
 
-        smp_rmb();
+int __kfifo_to_user(struct __kfifo *fifo, void __user *to,
+                unsigned long len, unsigned int *copied)
+{
+        unsigned int l;
+        unsigned long ret;
+        unsigned int esize = fifo->esize;
+        int err;
 
-        off = __kfifo_off(fifo, fifo->out + off);
+        if (esize != 1)
+                len /= esize;
 
-        /* first get the data from fifo->out until the end of the buffer */
-        l = min(len, fifo->size - off);
-        ret = copy_to_user(to, fifo->buffer + off, l);
-        *lenout = l;
+        l = fifo->in - fifo->out;
+        if (len > l)
+                len = l;
+        ret = kfifo_copy_to_user(fifo, to, len, fifo->out, copied);
         if (unlikely(ret)) {
-                *lenout -= ret;
-                return -EFAULT;
-        }
+                len -= ret;
+                err = -EFAULT;
+        } else
+                err = 0;
+        fifo->out += len;
+        return err;
+}
+EXPORT_SYMBOL(__kfifo_to_user);
 
-        /* then get the rest (if any) from the beginning of the buffer */
-        len -= l;
-        ret = copy_to_user(to + l, fifo->buffer, len);
-        if (unlikely(ret)) {
-                *lenout += len - ret;
-                return -EFAULT;
+static int setup_sgl_buf(struct scatterlist *sgl, void *buf,
+                int nents, unsigned int len)
+{
+        int n;
+        unsigned int l;
+        unsigned int off;
+        struct page *page;
+
+        if (!nents)
+                return 0;
+
+        if (!len)
+                return 0;
+
+        n = 0;
+        page = virt_to_page(buf);
+        off = offset_in_page(buf);
+        l = 0;
+
+        while (len >= l + PAGE_SIZE - off) {
+                struct page *npage;
+
+                l += PAGE_SIZE;
+                buf += PAGE_SIZE;
+                npage = virt_to_page(buf);
+                if (page_to_phys(page) != page_to_phys(npage) - l) {
+                        sg_set_page(sgl, page, l - off, off);
+                        sgl = sg_next(sgl);
+                        if (++n == nents || sgl == NULL)
+                                return n;
+                        page = npage;
+                        len -= l - off;
+                        l = off = 0;
+                }
         }
-        *lenout += len;
-        return 0;
+        sg_set_page(sgl, page, len, off);
+        return n + 1;
 }
 
-unsigned int __kfifo_in_n(struct kfifo *fifo,
-        const void *from, unsigned int len, unsigned int recsize)
+static unsigned int setup_sgl(struct __kfifo *fifo, struct scatterlist *sgl,
+                int nents, unsigned int len, unsigned int off)
 {
-        if (kfifo_avail(fifo) < len + recsize)
-                return len + 1;
+        unsigned int size = fifo->mask + 1;
+        unsigned int esize = fifo->esize;
+        unsigned int l;
+        unsigned int n;
 
-        __kfifo_in_data(fifo, from, len, recsize);
-        return 0;
+        off &= fifo->mask;
+        if (esize != 1) {
+                off *= esize;
+                size *= esize;
+                len *= esize;
+        }
+        l = min(len, size - off);
+
+        n = setup_sgl_buf(sgl, fifo->data + off, nents, l);
+        n += setup_sgl_buf(sgl + n, fifo->data, nents - n, len - l);
+
+        return n;
 }
-EXPORT_SYMBOL(__kfifo_in_n);
 
-/**
- * kfifo_in - puts some data into the FIFO
- * @fifo: the fifo to be used.
- * @from: the data to be added.
- * @len: the length of the data to be added.
- *
- * This function copies at most @len bytes from the @from buffer into
- * the FIFO depending on the free space, and returns the number of
- * bytes copied.
- *
- * Note that with only one concurrent reader and one concurrent
- * writer, you don't need extra locking to use these functions.
- */
-unsigned int kfifo_in(struct kfifo *fifo, const void *from,
-                                unsigned int len)
+unsigned int __kfifo_dma_in_prepare(struct __kfifo *fifo,
+                struct scatterlist *sgl, int nents, unsigned int len)
 {
-        len = min(kfifo_avail(fifo), len);
+        unsigned int l;
 
-        __kfifo_in_data(fifo, from, len, 0);
-        __kfifo_add_in(fifo, len);
-        return len;
+        l = kfifo_unused(fifo);
+        if (len > l)
+                len = l;
+
+        return setup_sgl(fifo, sgl, nents, len, fifo->in);
 }
-EXPORT_SYMBOL(kfifo_in);
+EXPORT_SYMBOL(__kfifo_dma_in_prepare);
 
-unsigned int __kfifo_in_generic(struct kfifo *fifo,
-        const void *from, unsigned int len, unsigned int recsize)
+unsigned int __kfifo_dma_out_prepare(struct __kfifo *fifo,
+                struct scatterlist *sgl, int nents, unsigned int len)
 {
-        return __kfifo_in_rec(fifo, from, len, recsize);
+        unsigned int l;
+
+        l = fifo->in - fifo->out;
+        if (len > l)
+                len = l;
+
+        return setup_sgl(fifo, sgl, nents, len, fifo->out);
 }
-EXPORT_SYMBOL(__kfifo_in_generic);
+EXPORT_SYMBOL(__kfifo_dma_out_prepare);
 
-unsigned int __kfifo_out_n(struct kfifo *fifo,
-        void *to, unsigned int len, unsigned int recsize)
+unsigned int __kfifo_max_r(unsigned int len, size_t recsize)
 {
-        if (kfifo_len(fifo) < len + recsize)
-                return len;
+        unsigned int max = (1 << (recsize << 3)) - 1;
 
-        __kfifo_out_data(fifo, to, len, recsize);
-        __kfifo_add_out(fifo, len + recsize);
-        return 0;
+        if (len > max)
+                return max;
+        return len;
 }
-EXPORT_SYMBOL(__kfifo_out_n);
 
-/**
- * kfifo_out - gets some data from the FIFO
- * @fifo: the fifo to be used.
- * @to: where the data must be copied.
- * @len: the size of the destination buffer.
- *
- * This function copies at most @len bytes from the FIFO into the
- * @to buffer and returns the number of copied bytes.
- *
- * Note that with only one concurrent reader and one concurrent
- * writer, you don't need extra locking to use these functions.
+#define __KFIFO_PEEK(data, out, mask) \
+        ((data)[(out) & (mask)])
+/*
+ * __kfifo_peek_n internal helper function for determinate the length of
+ * the next record in the fifo
  */
-unsigned int kfifo_out(struct kfifo *fifo, void *to, unsigned int len)
+static unsigned int __kfifo_peek_n(struct __kfifo *fifo, size_t recsize)
 {
-        len = min(kfifo_len(fifo), len);
+        unsigned int l;
+        unsigned int mask = fifo->mask;
+        unsigned char *data = fifo->data;
 
-        __kfifo_out_data(fifo, to, len, 0);
-        __kfifo_add_out(fifo, len);
+        l = __KFIFO_PEEK(data, fifo->out, mask);
 
-        return len;
+        if (--recsize)
+                l |= __KFIFO_PEEK(data, fifo->out + 1, mask) << 8;
+
+        return l;
 }
-EXPORT_SYMBOL(kfifo_out);
 
-/**
- * kfifo_out_peek - copy some data from the FIFO, but do not remove it
- * @fifo: the fifo to be used.
- * @to: where the data must be copied.
- * @len: the size of the destination buffer.
- * @offset: offset into the fifo
- *
- * This function copies at most @len bytes at @offset from the FIFO
- * into the @to buffer and returns the number of copied bytes.
- * The data is not removed from the FIFO.
+#define __KFIFO_POKE(data, in, mask, val) \
+        ( \
+        (data)[(in) & (mask)] = (unsigned char)(val) \
+        )
+
+/*
+ * __kfifo_poke_n internal helper function for storeing the length of
+ * the record into the fifo
  */
-unsigned int kfifo_out_peek(struct kfifo *fifo, void *to, unsigned int len,
-                            unsigned offset)
+static void __kfifo_poke_n(struct __kfifo *fifo, unsigned int n, size_t recsize)
 {
-        len = min(kfifo_len(fifo), len + offset);
+        unsigned int mask = fifo->mask;
+        unsigned char *data = fifo->data;
 
-        __kfifo_out_data(fifo, to, len, offset);
-        return len;
+        __KFIFO_POKE(data, fifo->in, mask, n);
+
+        if (recsize > 1)
+                __KFIFO_POKE(data, fifo->in + 1, mask, n >> 8);
 }
-EXPORT_SYMBOL(kfifo_out_peek);
 
-unsigned int __kfifo_out_generic(struct kfifo *fifo,
-        void *to, unsigned int len, unsigned int recsize,
-        unsigned int *total)
+unsigned int __kfifo_len_r(struct __kfifo *fifo, size_t recsize)
 {
-        return __kfifo_out_rec(fifo, to, len, recsize, total);
+        return __kfifo_peek_n(fifo, recsize);
 }
-EXPORT_SYMBOL(__kfifo_out_generic);
+EXPORT_SYMBOL(__kfifo_len_r);
 
-unsigned int __kfifo_from_user_n(struct kfifo *fifo,
-        const void __user *from, unsigned int len, unsigned int recsize)
+unsigned int __kfifo_in_r(struct __kfifo *fifo, const void *buf,
+                unsigned int len, size_t recsize)
 {
-        unsigned total;
+        if (len + recsize > kfifo_unused(fifo))
+                return 0;
 
-        if (kfifo_avail(fifo) < len + recsize)
-                return len + 1;
+        __kfifo_poke_n(fifo, len, recsize);
 
-        __kfifo_from_user_data(fifo, from, len, recsize, &total);
-        return total;
+        kfifo_copy_in(fifo, buf, len, fifo->in + recsize);
+        fifo->in += len + recsize;
+        return len;
 }
-EXPORT_SYMBOL(__kfifo_from_user_n);
+EXPORT_SYMBOL(__kfifo_in_r);
 
-/**
- * kfifo_from_user - puts some data from user space into the FIFO
- * @fifo: the fifo to be used.
- * @from: pointer to the data to be added.
- * @len: the length of the data to be added.
- * @total: the actual returned data length.
- *
- * This function copies at most @len bytes from the @from into the
- * FIFO depending and returns -EFAULT/0.
- *
- * Note that with only one concurrent reader and one concurrent
- * writer, you don't need extra locking to use these functions.
- */
-int kfifo_from_user(struct kfifo *fifo,
-        const void __user *from, unsigned int len, unsigned *total)
-{
-        int ret;
-        len = min(kfifo_avail(fifo), len);
-        ret = __kfifo_from_user_data(fifo, from, len, 0, total);
-        if (ret)
-                return ret;
-        __kfifo_add_in(fifo, len);
-        return 0;
+static unsigned int kfifo_out_copy_r(struct __kfifo *fifo,
+        void *buf, unsigned int len, size_t recsize, unsigned int *n)
+{
+        *n = __kfifo_peek_n(fifo, recsize);
+
+        if (len > *n)
+                len = *n;
+
+        kfifo_copy_out(fifo, buf, len, fifo->out + recsize);
+        return len;
 }
-EXPORT_SYMBOL(kfifo_from_user);
 
-unsigned int __kfifo_from_user_generic(struct kfifo *fifo,
-        const void __user *from, unsigned int len, unsigned int recsize)
+unsigned int __kfifo_out_peek_r(struct __kfifo *fifo, void *buf,
+                unsigned int len, size_t recsize)
 {
-        return __kfifo_from_user_rec(fifo, from, len, recsize);
+        unsigned int n;
+
+        if (fifo->in == fifo->out)
+                return 0;
+
+        return kfifo_out_copy_r(fifo, buf, len, recsize, &n);
 }
-EXPORT_SYMBOL(__kfifo_from_user_generic);
+EXPORT_SYMBOL(__kfifo_out_peek_r);
 
-unsigned int __kfifo_to_user_n(struct kfifo *fifo,
-        void __user *to, unsigned int len, unsigned int reclen,
-        unsigned int recsize)
+unsigned int __kfifo_out_r(struct __kfifo *fifo, void *buf,
+                unsigned int len, size_t recsize)
 {
-        unsigned int ret, total;
+        unsigned int n;
 
-        if (kfifo_len(fifo) < reclen + recsize)
-                return len;
+        if (fifo->in == fifo->out)
+                return 0;
 
-        ret = __kfifo_to_user_data(fifo, to, reclen, recsize, &total);
+        len = kfifo_out_copy_r(fifo, buf, len, recsize, &n);
+        fifo->out += n + recsize;
+        return len;
+}
+EXPORT_SYMBOL(__kfifo_out_r);
 
-        if (likely(ret == 0))
-                __kfifo_add_out(fifo, reclen + recsize);
+void __kfifo_skip_r(struct __kfifo *fifo, size_t recsize)
+{
+        unsigned int n;
 
-        return total;
+        n = __kfifo_peek_n(fifo, recsize);
+        fifo->out += n + recsize;
 }
-EXPORT_SYMBOL(__kfifo_to_user_n);
+EXPORT_SYMBOL(__kfifo_skip_r);
 
-/**
- * kfifo_to_user - gets data from the FIFO and write it to user space
- * @fifo: the fifo to be used.
- * @to: where the data must be copied.
- * @len: the size of the destination buffer.
- * @lenout: pointer to output variable with copied data
- *
- * This function copies at most @len bytes from the FIFO into the
- * @to buffer and 0 or -EFAULT.
- *
- * Note that with only one concurrent reader and one concurrent
- * writer, you don't need extra locking to use these functions.
- */
-int kfifo_to_user(struct kfifo *fifo,
-        void __user *to, unsigned int len, unsigned *lenout)
+int __kfifo_from_user_r(struct __kfifo *fifo, const void __user *from,
+        unsigned long len, unsigned int *copied, size_t recsize)
 {
-        int ret;
-        len = min(kfifo_len(fifo), len);
-        ret = __kfifo_to_user_data(fifo, to, len, 0, lenout);
-        __kfifo_add_out(fifo, *lenout);
-        return ret;
+        unsigned long ret;
+
+        len = __kfifo_max_r(len, recsize);
+
+        if (len + recsize > kfifo_unused(fifo)) {
+                *copied = 0;
+                return 0;
+        }
+
+        __kfifo_poke_n(fifo, len, recsize);
+
+        ret = kfifo_copy_from_user(fifo, from, len, fifo->in + recsize, copied);
+        if (unlikely(ret)) {
+                *copied = 0;
+                return -EFAULT;
+        }
+        fifo->in += len + recsize;
+        return 0;
 }
-EXPORT_SYMBOL(kfifo_to_user);
+EXPORT_SYMBOL(__kfifo_from_user_r);
 
-unsigned int __kfifo_to_user_generic(struct kfifo *fifo,
-        void __user *to, unsigned int len, unsigned int recsize,
-        unsigned int *total)
+int __kfifo_to_user_r(struct __kfifo *fifo, void __user *to,
+        unsigned long len, unsigned int *copied, size_t recsize)
 {
-        return __kfifo_to_user_rec(fifo, to, len, recsize, total);
+        unsigned long ret;
+        unsigned int n;
+
+        if (fifo->in == fifo->out) {
+                *copied = 0;
+                return 0;
+        }
+
+        n = __kfifo_peek_n(fifo, recsize);
+        if (len > n)
+                len = n;
+
+        ret = kfifo_copy_to_user(fifo, to, len, fifo->out + recsize, copied);
+        if (unlikely(ret)) {
+                *copied = 0;
+                return -EFAULT;
+        }
+        fifo->out += n + recsize;
+        return 0;
 }
-EXPORT_SYMBOL(__kfifo_to_user_generic);
+EXPORT_SYMBOL(__kfifo_to_user_r);
 
-unsigned int __kfifo_peek_generic(struct kfifo *fifo, unsigned int recsize)
+unsigned int __kfifo_dma_in_prepare_r(struct __kfifo *fifo,
+        struct scatterlist *sgl, int nents, unsigned int len, size_t recsize)
 {
-        if (recsize == 0)
-                return kfifo_avail(fifo);
+        if (!nents)
+                BUG();
 
-        return __kfifo_peek_n(fifo, recsize);
+        len = __kfifo_max_r(len, recsize);
+
+        if (len + recsize > kfifo_unused(fifo))
+                return 0;
+
+        return setup_sgl(fifo, sgl, nents, len, fifo->in + recsize);
 }
-EXPORT_SYMBOL(__kfifo_peek_generic);
+EXPORT_SYMBOL(__kfifo_dma_in_prepare_r);
 
-void __kfifo_skip_generic(struct kfifo *fifo, unsigned int recsize)
+void __kfifo_dma_in_finish_r(struct __kfifo *fifo,
+        unsigned int len, size_t recsize)
 {
-        __kfifo_skip_rec(fifo, recsize);
+        len = __kfifo_max_r(len, recsize);
+        __kfifo_poke_n(fifo, len, recsize);
+        fifo->in += len + recsize;
 }
-EXPORT_SYMBOL(__kfifo_skip_generic);
+EXPORT_SYMBOL(__kfifo_dma_in_finish_r);
 
+unsigned int __kfifo_dma_out_prepare_r(struct __kfifo *fifo,
+        struct scatterlist *sgl, int nents, unsigned int len, size_t recsize)
+{
+        if (!nents)
+                BUG();
+
+        len = __kfifo_max_r(len, recsize);
+
+        if (len + recsize > fifo->in - fifo->out)
+                return 0;
+
+        return setup_sgl(fifo, sgl, nents, len, fifo->out + recsize);
+}
+EXPORT_SYMBOL(__kfifo_dma_out_prepare_r);
+
+void __kfifo_dma_out_finish_r(struct __kfifo *fifo, size_t recsize)
+{
+        unsigned int len;
+
+        len = __kfifo_peek_n(fifo, recsize);
+        fifo->out += len + recsize;
+}
+EXPORT_SYMBOL(__kfifo_dma_out_finish_r);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6e9b19667a8d..9cd0591c96a2 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -153,7 +153,9 @@ static int ____call_usermodehelper(void *data)
                         goto fail;
         }
 
-        retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
+        retval = kernel_execve(sub_info->path,
+                               (const char *const *)sub_info->argv,
+                               (const char *const *)sub_info->envp);
 
         /* Exec failed? */
 fail:
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 282035f3ae96..9737a76e106f 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -47,6 +47,7 @@
 #include <linux/memory.h>
 #include <linux/ftrace.h>
 #include <linux/cpu.h>
+#include <linux/jump_label.h>
 
 #include <asm-generic/sections.h>
 #include <asm/cacheflush.h>
@@ -73,7 +74,8 @@ static struct hlist_head kretprobe_inst_table[KPROBE_TABLE_SIZE];
 /* NOTE: change this value only with kprobe_mutex held */
 static bool kprobes_all_disarmed;
 
-static DEFINE_MUTEX(kprobe_mutex);      /* Protects kprobe_table */
+/* This protects kprobe_table and optimizing_list */
+static DEFINE_MUTEX(kprobe_mutex);
 static DEFINE_PER_CPU(struct kprobe *, kprobe_instance) = NULL;
 static struct {
         spinlock_t lock ____cacheline_aligned_in_smp;
@@ -399,7 +401,7 @@ static inline int kprobe_optready(struct kprobe *p)
  * Return an optimized kprobe whose optimizing code replaces
  * instructions including addr (exclude breakpoint).
  */
-struct kprobe *__kprobes get_optimized_kprobe(unsigned long addr)
+static struct kprobe *__kprobes get_optimized_kprobe(unsigned long addr)
 {
         int i;
         struct kprobe *p = NULL;
@@ -594,6 +596,7 @@ static __kprobes void try_to_optimize_kprobe(struct kprobe *p)
 }
 
 #ifdef CONFIG_SYSCTL
+/* This should be called with kprobe_mutex locked */
 static void __kprobes optimize_all_kprobes(void)
 {
         struct hlist_head *head;
@@ -606,17 +609,16 @@ static void __kprobes optimize_all_kprobes(void)
                 return;
 
         kprobes_allow_optimization = true;
-        mutex_lock(&text_mutex);
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
                 hlist_for_each_entry_rcu(p, node, head, hlist)
                         if (!kprobe_disabled(p))
                                 optimize_kprobe(p);
         }
-        mutex_unlock(&text_mutex);
         printk(KERN_INFO "Kprobes globally optimized\n");
 }
 
+/* This should be called with kprobe_mutex locked */
 static void __kprobes unoptimize_all_kprobes(void)
 {
         struct hlist_head *head;
@@ -831,6 +833,7 @@ void __kprobes recycle_rp_inst(struct kretprobe_instance *ri,
 
 void __kprobes kretprobe_hash_lock(struct task_struct *tsk,
                          struct hlist_head **head, unsigned long *flags)
+__acquires(hlist_lock)
 {
         unsigned long hash = hash_ptr(tsk, KPROBE_HASH_BITS);
         spinlock_t *hlist_lock;
@@ -842,6 +845,7 @@ void __kprobes kretprobe_hash_lock(struct task_struct *tsk,
 
 static void __kprobes kretprobe_table_lock(unsigned long hash,
         unsigned long *flags)
+__acquires(hlist_lock)
 {
         spinlock_t *hlist_lock = kretprobe_table_lock_ptr(hash);
         spin_lock_irqsave(hlist_lock, *flags);
@@ -849,6 +853,7 @@ static void __kprobes kretprobe_table_lock(unsigned long hash,
 
 void __kprobes kretprobe_hash_unlock(struct task_struct *tsk,
         unsigned long *flags)
+__releases(hlist_lock)
 {
         unsigned long hash = hash_ptr(tsk, KPROBE_HASH_BITS);
         spinlock_t *hlist_lock;
@@ -857,7 +862,9 @@ void __kprobes kretprobe_hash_unlock(struct task_struct *tsk,
         spin_unlock_irqrestore(hlist_lock, *flags);
 }
 
-void __kprobes kretprobe_table_unlock(unsigned long hash, unsigned long *flags)
+static void __kprobes kretprobe_table_unlock(unsigned long hash,
+       unsigned long *flags)
+__releases(hlist_lock)
 {
         spinlock_t *hlist_lock = kretprobe_table_lock_ptr(hash);
         spin_unlock_irqrestore(hlist_lock, *flags);
@@ -1138,13 +1145,13 @@ int __kprobes register_kprobe(struct kprobe *p)
         if (ret)
                 return ret;
 
+        jump_label_lock();
         preempt_disable();
         if (!kernel_text_address((unsigned long) p->addr) ||
             in_kprobes_functions((unsigned long) p->addr) ||
-            ftrace_text_reserved(p->addr, p->addr)) {
-                preempt_enable();
-                return -EINVAL;
-        }
+            ftrace_text_reserved(p->addr, p->addr) ||
+            jump_label_text_reserved(p->addr, p->addr))
+                goto fail_with_jump_label;
 
         /* User can pass only KPROBE_FLAG_DISABLED to register_kprobe */
         p->flags &= KPROBE_FLAG_DISABLED;
@@ -1158,10 +1165,9 @@ int __kprobes register_kprobe(struct kprobe *p)
                  * We must hold a refcount of the probed module while updating
                  * its code to prohibit unexpected unloading.
                  */
-                if (unlikely(!try_module_get(probed_mod))) {
-                        preempt_enable();
-                        return -EINVAL;
-                }
+                if (unlikely(!try_module_get(probed_mod)))
+                        goto fail_with_jump_label;
+
                 /*
                  * If the module freed .init.text, we couldn't insert
                  * kprobes in there.
@@ -1169,16 +1175,18 @@ int __kprobes register_kprobe(struct kprobe *p)
                 if (within_module_init((unsigned long)p->addr, probed_mod) &&
                     probed_mod->state != MODULE_STATE_COMING) {
                         module_put(probed_mod);
-                        preempt_enable();
-                        return -EINVAL;
+                        goto fail_with_jump_label;
                 }
         }
         preempt_enable();
+        jump_label_unlock();
 
         p->nmissed = 0;
         INIT_LIST_HEAD(&p->list);
         mutex_lock(&kprobe_mutex);
 
+        jump_label_lock(); /* needed to call jump_label_text_reserved() */
+
         get_online_cpus();      /* For avoiding text_mutex deadlock. */
         mutex_lock(&text_mutex);
 
@@ -1206,12 +1214,18 @@ int __kprobes register_kprobe(struct kprobe *p)
 out:
         mutex_unlock(&text_mutex);
         put_online_cpus();
+        jump_label_unlock();
         mutex_unlock(&kprobe_mutex);
 
         if (probed_mod)
                 module_put(probed_mod);
 
         return ret;
+
+fail_with_jump_label:
+        preempt_enable();
+        jump_label_unlock();
+        return -EINVAL;
 }
 EXPORT_SYMBOL_GPL(register_kprobe);
 
@@ -1339,18 +1353,19 @@ int __kprobes register_jprobes(struct jprobe **jps, int num)
         if (num <= 0)
                 return -EINVAL;
         for (i = 0; i < num; i++) {
-                unsigned long addr;
+                unsigned long addr, offset;
                 jp = jps[i];
                 addr = arch_deref_entry_point(jp->entry);
 
-                if (!kernel_text_address(addr))
-                        ret = -EINVAL;
-                else {
-                        /* Todo: Verify probepoint is a function entry point */
+                /* Verify probepoint is a function entry point */
+                if (kallsyms_lookup_size_offset(addr, NULL, &offset) &&
+                    offset == 0) {
                         jp->kp.pre_handler = setjmp_pre_handler;
                         jp->kp.break_handler = longjmp_break_handler;
                         ret = register_kprobe(&jp->kp);
-                }
+                } else
+                        ret = -EINVAL;
+
                 if (ret < 0) {
                         if (i > 0)
                                 unregister_jprobes(jps, i);
@@ -1992,6 +2007,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
 static const struct file_operations fops_kp = {
         .read =         read_enabled_file_bool,
         .write =        write_enabled_file_bool,
+        .llseek =       default_llseek,
 };
 
 static int __kprobes debugfs_kprobe_init(void)
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 2dc3786349d1..ca61bbdd44b2 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -265,6 +265,17 @@ int kthreadd(void *unused)
         return 0;
 }
 
+void __init_kthread_worker(struct kthread_worker *worker,
+                                const char *name,
+                                struct lock_class_key *key)
+{
+        spin_lock_init(&worker->lock);
+        lockdep_set_class_and_name(&worker->lock, key, name);
+        INIT_LIST_HEAD(&worker->work_list);
+        worker->task = NULL;
+}
+EXPORT_SYMBOL_GPL(__init_kthread_worker);
+
 /**
  * kthread_worker_fn - kthread function to process kthread_worker
  * @worker_ptr: pointer to initialized kthread_worker
diff --git a/kernel/latencytop.c b/kernel/latencytop.c
index 877fb306d415..17110a4a4fc2 100644
--- a/kernel/latencytop.c
+++ b/kernel/latencytop.c
@@ -194,14 +194,7 @@ __account_scheduler_latency(struct task_struct *tsk, int usecs, int inter)
 
         account_global_scheduler_latency(tsk, &lat);
 
-        /*
-         * short term hack; if we're > 32 we stop; future we recycle:
-         */
-        tsk->latency_record_count++;
-        if (tsk->latency_record_count >= LT_SAVECOUNT)
-                goto out_unlock;
-
-        for (i = 0; i < LT_SAVECOUNT; i++) {
+        for (i = 0; i < tsk->latency_record_count; i++) {
                 struct latency_record *mylat;
                 int same = 1;
 
@@ -227,8 +220,14 @@ __account_scheduler_latency(struct task_struct *tsk, int usecs, int inter)
                 }
         }
 
+        /*
+         * short term hack; if we're > 32 we stop; future we recycle:
+         */
+        if (tsk->latency_record_count >= LT_SAVECOUNT)
+                goto out_unlock;
+
         /* Allocated a new one: */
-        i = tsk->latency_record_count;
+        i = tsk->latency_record_count++;
         memcpy(&tsk->latency_record[i], &lat, sizeof(struct latency_record));
 
 out_unlock:
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index f2852a510232..42ba65dff7d9 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -639,6 +639,16 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
         }
 #endif
 
+        if (unlikely(subclass >= MAX_LOCKDEP_SUBCLASSES)) {
+                debug_locks_off();
+                printk(KERN_ERR
+                        "BUG: looking up invalid subclass: %u\n", subclass);
+                printk(KERN_ERR
+                        "turning off the locking correctness validator.\n");
+                dump_stack();
+                return NULL;
+        }
+
         /*
          * Static locks do not have their class-keys yet - for them the key
          * is the lock object itself:
@@ -774,7 +784,9 @@ out_unlock_set:
         raw_local_irq_restore(flags);
 
         if (!subclass || force)
-                lock->class_cache = class;
+                lock->class_cache[0] = class;
+        else if (subclass < NR_LOCKDEP_CACHING_CLASSES)
+                lock->class_cache[subclass] = class;
 
         if (DEBUG_LOCKS_WARN_ON(class->subclass != subclass))
                 return NULL;
@@ -2679,7 +2691,11 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
 void lockdep_init_map(struct lockdep_map *lock, const char *name,
                       struct lock_class_key *key, int subclass)
 {
-        lock->class_cache = NULL;
+        int i;
+
+        for (i = 0; i < NR_LOCKDEP_CACHING_CLASSES; i++)
+                lock->class_cache[i] = NULL;
+
 #ifdef CONFIG_LOCK_STAT
         lock->cpu = raw_smp_processor_id();
 #endif
@@ -2739,21 +2755,13 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
                 return 0;
 
-        if (unlikely(subclass >= MAX_LOCKDEP_SUBCLASSES)) {
-                debug_locks_off();
-                printk("BUG: MAX_LOCKDEP_SUBCLASSES too low!\n");
-                printk("turning off the locking correctness validator.\n");
-                dump_stack();
-                return 0;
-        }
-
         if (lock->key == &__lockdep_no_validate__)
                 check = 1;
 
-        if (!subclass)
-                class = lock->class_cache;
+        if (subclass < NR_LOCKDEP_CACHING_CLASSES)
+                class = lock->class_cache[subclass];
         /*
-         * Not cached yet or subclass?
+         * Not cached?
          */
         if (unlikely(!class)) {
                 class = register_lock_class(lock, subclass, 0);
@@ -2918,7 +2926,7 @@ static int match_held_lock(struct held_lock *hlock, struct lockdep_map *lock)
                 return 1;
 
         if (hlock->references) {
-                struct lock_class *class = lock->class_cache;
+                struct lock_class *class = lock->class_cache[0];
 
                 if (!class)
                         class = look_up_lock_class(lock, 0);
@@ -3559,7 +3567,12 @@ void lockdep_reset_lock(struct lockdep_map *lock)
                 if (list_empty(head))
                         continue;
                 list_for_each_entry_safe(class, next, head, hash_entry) {
-                        if (unlikely(class == lock->class_cache)) {
+                        int match = 0;
+
+                        for (j = 0; j < NR_LOCKDEP_CACHING_CLASSES; j++)
+                                match |= class == lock->class_cache[j];
+
+                        if (unlikely(match)) {
                                 if (debug_locks_off_graph_unlock())
                                         WARN_ON(1);
                                 goto out_restore;
@@ -3775,7 +3788,7 @@ EXPORT_SYMBOL_GPL(debug_show_all_locks);
  * Careful: only use this function if you are sure that
  * the task cannot run in parallel!
  */
-void __debug_show_held_locks(struct task_struct *task)
+void debug_show_held_locks(struct task_struct *task)
 {
         if (unlikely(!debug_locks)) {
                 printk("INFO: lockdep is turned off.\n");
@@ -3783,12 +3796,6 @@ void __debug_show_held_locks(struct task_struct *task)
         }
         lockdep_print_held_locks(task);
 }
-EXPORT_SYMBOL_GPL(__debug_show_held_locks);
-
-void debug_show_held_locks(struct task_struct *task)
-{
-                __debug_show_held_locks(task);
-}
 EXPORT_SYMBOL_GPL(debug_show_held_locks);
 
 void lockdep_sys_exit(void)
diff --git a/kernel/module.c b/kernel/module.c
index d0b5f8db11b4..d190664f25ff 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -55,6 +55,7 @@
 #include <linux/async.h>
 #include <linux/percpu.h>
 #include <linux/kmemleak.h>
+#include <linux/jump_label.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
@@ -1537,6 +1538,7 @@ static int __unlink_module(void *_mod)
 {
         struct module *mod = _mod;
         list_del(&mod->list);
+        module_bug_cleanup(mod);
         return 0;
 }
 
@@ -2035,7 +2037,7 @@ static inline void layout_symtab(struct module *mod, struct load_info *info)
 {
 }
 
-static void add_kallsyms(struct module *mod, struct load_info *info)
+static void add_kallsyms(struct module *mod, const struct load_info *info)
 {
 }
 #endif /* CONFIG_KALLSYMS */
@@ -2308,6 +2310,11 @@ static void find_module_sections(struct module *mod, struct load_info *info)
                                         sizeof(*mod->tracepoints),
                                         &mod->num_tracepoints);
 #endif
+#ifdef HAVE_JUMP_LABEL
+        mod->jump_entries = section_objs(info, "__jump_table",
+                                        sizeof(*mod->jump_entries),
+                                        &mod->num_jump_entries);
+#endif
 #ifdef CONFIG_EVENT_TRACING
         mod->trace_events = section_objs(info, "_ftrace_events",
                                          sizeof(*mod->trace_events),
@@ -2319,6 +2326,18 @@ static void find_module_sections(struct module *mod, struct load_info *info)
         kmemleak_scan_area(mod->trace_events, sizeof(*mod->trace_events) *
                            mod->num_trace_events, GFP_KERNEL);
 #endif
+#ifdef CONFIG_TRACING
+        mod->trace_bprintk_fmt_start = section_objs(info, "__trace_printk_fmt",
+                                         sizeof(*mod->trace_bprintk_fmt_start),
+                                         &mod->num_trace_bprintk_fmt);
+        /*
+         * This section contains pointers to allocated objects in the trace
+         * code and not scanning it leads to false positives.
+         */
+        kmemleak_scan_area(mod->trace_bprintk_fmt_start,
+                           sizeof(*mod->trace_bprintk_fmt_start) *
+                           mod->num_trace_bprintk_fmt, GFP_KERNEL);
+#endif
 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
         /* sechdrs[0].sh_size is always zero */
         mod->ftrace_callsites = section_objs(info, "__mcount_loc",
@@ -2625,6 +2644,7 @@ static struct module *load_module(void __user *umod,
         if (err < 0)
                 goto ddebug;
 
+        module_bug_finalize(info.hdr, info.sechdrs, mod);
         list_add_rcu(&mod->list, &modules);
         mutex_unlock(&module_mutex);
 
@@ -2650,6 +2670,8 @@ static struct module *load_module(void __user *umod,
         mutex_lock(&module_mutex);
         /* Unlink carefully: kallsyms could be walking list. */
         list_del_rcu(&mod->list);
+        module_bug_cleanup(mod);
+
  ddebug:
         if (!mod->taints)
                 dynamic_debug_remove(info.debug);
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 4c0b7b3e6d2e..200407c1502f 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -36,15 +36,6 @@
 # include <asm/mutex.h>
 #endif
 
-/***
- * mutex_init - initialize the mutex
- * @lock: the mutex to be initialized
- * @key: the lock_class_key for the class; used by mutex lock debugging
- *
- * Initialize the mutex to unlocked state.
- *
- * It is not allowed to initialize an already locked mutex.
- */
 void
 __mutex_init(struct mutex *lock, const char *name, struct lock_class_key *key)
 {
@@ -68,7 +59,7 @@ EXPORT_SYMBOL(__mutex_init);
 static __used noinline void __sched
 __mutex_lock_slowpath(atomic_t *lock_count);
 
-/***
+/**
  * mutex_lock - acquire the mutex
  * @lock: the mutex to be acquired
  *
@@ -105,7 +96,7 @@ EXPORT_SYMBOL(mutex_lock);
 
 static __used noinline void __sched __mutex_unlock_slowpath(atomic_t *lock_count);
 
-/***
+/**
  * mutex_unlock - release the mutex
  * @lock: the mutex to be released
  *
@@ -364,8 +355,8 @@ __mutex_lock_killable_slowpath(atomic_t *lock_count);
 static noinline int __sched
 __mutex_lock_interruptible_slowpath(atomic_t *lock_count);
 
-/***
- * mutex_lock_interruptible - acquire the mutex, interruptable
+/**
+ * mutex_lock_interruptible - acquire the mutex, interruptible
  * @lock: the mutex to be acquired
  *
  * Lock the mutex like mutex_lock(), and return 0 if the mutex has
@@ -456,15 +447,15 @@ static inline int __mutex_trylock_slowpath(atomic_t *lock_count)
         return prev == 1;
 }
 
-/***
- * mutex_trylock - try acquire the mutex, without waiting
+/**
+ * mutex_trylock - try to acquire the mutex, without waiting
  * @lock: the mutex to be acquired
  *
  * Try to acquire the mutex atomically. Returns 1 if the mutex
  * has been acquired successfully, and 0 on contention.
  *
  * NOTE: this function follows the spin_trylock() convention, so
- * it is negated to the down_trylock() return values! Be careful
+ * it is negated from the down_trylock() return values! Be careful
  * about this when converting semaphore users to mutexes.
  *
  * This function must not be used in interrupt context. The
diff --git a/kernel/ns_cgroup.c b/kernel/ns_cgroup.c
index 2a5dfec8efe0..2c98ad94ba0e 100644
--- a/kernel/ns_cgroup.c
+++ b/kernel/ns_cgroup.c
@@ -85,6 +85,14 @@ static struct cgroup_subsys_state *ns_create(struct cgroup_subsys *ss,
                 return ERR_PTR(-EPERM);
         if (!cgroup_is_descendant(cgroup, current))
                 return ERR_PTR(-EPERM);
+        if (test_bit(CGRP_CLONE_CHILDREN, &cgroup->flags)) {
+                printk("ns_cgroup can't be created with parent "
+                       "'clone_children' set.\n");
+                return ERR_PTR(-EINVAL);
+        }
+
+        printk_once("ns_cgroup deprecated: consider using the "
+                    "'clone_children' flag without the ns_cgroup.\n");
 
         ns_cgroup = kzalloc(sizeof(*ns_cgroup), GFP_KERNEL);
         if (!ns_cgroup)
diff --git a/kernel/panic.c b/kernel/panic.c
index 3b16cd93fa7d..4c13b1a88ebb 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -24,6 +24,9 @@
 #include <linux/nmi.h>
 #include <linux/dmi.h>
 
+#define PANIC_TIMER_STEP 100
+#define PANIC_BLINK_SPD 18
+
 int panic_on_oops;
 static unsigned long tainted_mask;
 static int pause_on_oops;
@@ -36,36 +39,15 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
 
 EXPORT_SYMBOL(panic_notifier_list);
 
-/* Returns how long it waited in ms */
-long (*panic_blink)(long time);
-EXPORT_SYMBOL(panic_blink);
-
-static void panic_blink_one_second(void)
+static long no_blink(int state)
 {
-        static long i = 0, end;
-
-        if (panic_blink) {
-                end = i + MSEC_PER_SEC;
-
-                while (i < end) {
-                        i += panic_blink(i);
-                        mdelay(1);
-                        i++;
-                }
-        } else {
-                /*
-                 * When running under a hypervisor a small mdelay may get
-                 * rounded up to the hypervisor timeslice. For example, with
-                 * a 1ms in 10ms hypervisor timeslice we might inflate a
-                 * mdelay(1) loop by 10x.
-                 *
-                 * If we have nothing to blink, spin on 1 second calls to
-                 * mdelay to avoid this.
-                 */
-                mdelay(MSEC_PER_SEC);
-        }
+        return 0;
 }
 
+/* Returns how long it waited in ms */
+long (*panic_blink)(int state);
+EXPORT_SYMBOL(panic_blink);
+
 /**
  *      panic - halt the system
  *      @fmt: The text string to print
@@ -78,7 +60,8 @@ NORET_TYPE void panic(const char * fmt, ...)
 {
         static char buf[1024];
         va_list args;
-        long i;
+        long i, i_next = 0;
+        int state = 0;
 
         /*
          * It's possible to come here directly from a panic-assertion and
@@ -117,6 +100,9 @@ NORET_TYPE void panic(const char * fmt, ...)
 
         bust_spinlocks(0);
 
+        if (!panic_blink)
+                panic_blink = no_blink;
+
         if (panic_timeout > 0) {
                 /*
                  * Delay timeout seconds before rebooting the machine.
@@ -124,9 +110,13 @@ NORET_TYPE void panic(const char * fmt, ...)
                  */
                 printk(KERN_EMERG "Rebooting in %d seconds..", panic_timeout);
 
-                for (i = 0; i < panic_timeout; i++) {
+                for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
                         touch_nmi_watchdog();
-                        panic_blink_one_second();
+                        if (i >= i_next) {
+                                i += panic_blink(state ^= 1);
+                                i_next = i + 3600 / PANIC_BLINK_SPD;
+                        }
+                        mdelay(PANIC_TIMER_STEP);
                 }
                 /*
                  * This will not be a clean reboot, with everything
@@ -152,9 +142,13 @@ NORET_TYPE void panic(const char * fmt, ...)
         }
 #endif
         local_irq_enable();
-        while (1) {
+        for (i = 0; ; i += PANIC_TIMER_STEP) {
                 touch_softlockup_watchdog();
-                panic_blink_one_second();
+                if (i >= i_next) {
+                        i += panic_blink(state ^= 1);
+                        i_next = i + 3600 / PANIC_BLINK_SPD;
+                }
+                mdelay(PANIC_TIMER_STEP);
         }
 }
 
@@ -344,7 +338,7 @@ static int init_oops_id(void)
 }
 late_initcall(init_oops_id);
 
-static void print_oops_end_marker(void)
+void print_oops_end_marker(void)
 {
         init_oops_id();
         printk(KERN_WARNING "---[ end trace %016llx ]---\n",
diff --git a/kernel/params.c b/kernel/params.c
index 0b30ecd53a52..08107d181758 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -31,6 +31,42 @@
 #define DEBUGP(fmt, a...)
 #endif
 
+/* Protects all parameters, and incidentally kmalloced_param list. */
+static DEFINE_MUTEX(param_lock);
+
+/* This just allows us to keep track of which parameters are kmalloced. */
+struct kmalloced_param {
+        struct list_head list;
+        char val[];
+};
+static LIST_HEAD(kmalloced_params);
+
+static void *kmalloc_parameter(unsigned int size)
+{
+        struct kmalloced_param *p;
+
+        p = kmalloc(sizeof(*p) + size, GFP_KERNEL);
+        if (!p)
+                return NULL;
+
+        list_add(&p->list, &kmalloced_params);
+        return p->val;
+}
+
+/* Does nothing if parameter wasn't kmalloced above. */
+static void maybe_kfree_parameter(void *param)
+{
+        struct kmalloced_param *p;
+
+        list_for_each_entry(p, &kmalloced_params, list) {
+                if (p->val == param) {
+                        list_del(&p->list);
+                        kfree(p);
+                        break;
+                }
+        }
+}
+
 static inline char dash2underscore(char c)
 {
         if (c == '-')
@@ -49,18 +85,25 @@ static inline int parameq(const char *input, const char *paramname)
 
 static int parse_one(char *param,
                      char *val,
-                     struct kernel_param *params, 
+                     const struct kernel_param *params,
                      unsigned num_params,
                      int (*handle_unknown)(char *param, char *val))
 {
         unsigned int i;
+        int err;
 
         /* Find parameter */
         for (i = 0; i < num_params; i++) {
                 if (parameq(param, params[i].name)) {
+                        /* Noone handled NULL, so do it here. */
+                        if (!val && params[i].ops->set != param_set_bool)
+                                return -EINVAL;
                         DEBUGP("They are equal!  Calling %p\n",
-                               params[i].set);
-                        return params[i].set(val, &params[i]);
+                               params[i].ops->set);
+                        mutex_lock(&param_lock);
+                        err = params[i].ops->set(val, &params[i]);
+                        mutex_unlock(&param_lock);
+                        return err;
                 }
         }
 
@@ -128,7 +171,7 @@ static char *next_arg(char *args, char **param, char **val)
 /* Args looks like "foo=bar,bar2 baz=fuz wiz". */
 int parse_args(const char *name,
                char *args,
-               struct kernel_param *params,
+               const struct kernel_param *params,
                unsigned num,
                int (*unknown)(char *param, char *val))
 {
@@ -176,22 +219,29 @@ int parse_args(const char *name,
 
 /* Lazy bastard, eh? */
 #define STANDARD_PARAM_DEF(name, type, format, tmptype, strtolfn)       \
-        int param_set_##name(const char *val, struct kernel_param *kp)  \
+        int param_set_##name(const char *val, const struct kernel_param *kp) \
         {                                                               \
                 tmptype l;                                              \
                 int ret;                                                \
                                                                         \
-                if (!val) return -EINVAL;                               \
                 ret = strtolfn(val, 0, &l);                             \
                 if (ret == -EINVAL || ((type)l != l))                   \
                         return -EINVAL;                                 \
                 *((type *)kp->arg) = l;                                 \
                 return 0;                                               \
         }                                                               \
-        int param_get_##name(char *buffer, struct kernel_param *kp)     \
+        int param_get_##name(char *buffer, const struct kernel_param *kp) \
         {                                                               \
                 return sprintf(buffer, format, *((type *)kp->arg));     \
-        }
+        }                                                               \
+        struct kernel_param_ops param_ops_##name = {                    \
+                .set = param_set_##name,                                \
+                .get = param_get_##name,                                \
+        };                                                              \
+        EXPORT_SYMBOL(param_set_##name);                                \
+        EXPORT_SYMBOL(param_get_##name);                                \
+        EXPORT_SYMBOL(param_ops_##name)
+
 
 STANDARD_PARAM_DEF(byte, unsigned char, "%c", unsigned long, strict_strtoul);
 STANDARD_PARAM_DEF(short, short, "%hi", long, strict_strtol);
@@ -201,39 +251,50 @@ STANDARD_PARAM_DEF(uint, unsigned int, "%u", unsigned long, strict_strtoul);
 STANDARD_PARAM_DEF(long, long, "%li", long, strict_strtol);
 STANDARD_PARAM_DEF(ulong, unsigned long, "%lu", unsigned long, strict_strtoul);
 
-int param_set_charp(const char *val, struct kernel_param *kp)
+int param_set_charp(const char *val, const struct kernel_param *kp)
 {
-        if (!val) {
-                printk(KERN_ERR "%s: string parameter expected\n",
-                       kp->name);
-                return -EINVAL;
-        }
-
         if (strlen(val) > 1024) {
                 printk(KERN_ERR "%s: string parameter too long\n",
                        kp->name);
                 return -ENOSPC;
         }
 
-        /* This is a hack.  We can't need to strdup in early boot, and we
+        maybe_kfree_parameter(*(char **)kp->arg);
+
+        /* This is a hack.  We can't kmalloc in early boot, and we
          * don't need to; this mangled commandline is preserved. */
         if (slab_is_available()) {
-                *(char **)kp->arg = kstrdup(val, GFP_KERNEL);
+                *(char **)kp->arg = kmalloc_parameter(strlen(val)+1);
                 if (!*(char **)kp->arg)
                         return -ENOMEM;
+                strcpy(*(char **)kp->arg, val);
         } else
                 *(const char **)kp->arg = val;
 
         return 0;
 }
+EXPORT_SYMBOL(param_set_charp);
 
-int param_get_charp(char *buffer, struct kernel_param *kp)
+int param_get_charp(char *buffer, const struct kernel_param *kp)
 {
         return sprintf(buffer, "%s", *((char **)kp->arg));
 }
+EXPORT_SYMBOL(param_get_charp);
+
+static void param_free_charp(void *arg)
+{
+        maybe_kfree_parameter(*((char **)arg));
+}
+
+struct kernel_param_ops param_ops_charp = {
+        .set = param_set_charp,
+        .get = param_get_charp,
+        .free = param_free_charp,
+};
+EXPORT_SYMBOL(param_ops_charp);
 
 /* Actually could be a bool or an int, for historical reasons. */
-int param_set_bool(const char *val, struct kernel_param *kp)
+int param_set_bool(const char *val, const struct kernel_param *kp)
 {
         bool v;
 
@@ -258,8 +319,9 @@ int param_set_bool(const char *val, struct kernel_param *kp)
                 *(int *)kp->arg = v;
         return 0;
 }
+EXPORT_SYMBOL(param_set_bool);
 
-int param_get_bool(char *buffer, struct kernel_param *kp)
+int param_get_bool(char *buffer, const struct kernel_param *kp)
 {
         bool val;
         if (kp->flags & KPARAM_ISBOOL)
@@ -270,9 +332,16 @@ int param_get_bool(char *buffer, struct kernel_param *kp)
         /* Y and N chosen as being relatively non-coder friendly */
         return sprintf(buffer, "%c", val ? 'Y' : 'N');
 }
+EXPORT_SYMBOL(param_get_bool);
+
+struct kernel_param_ops param_ops_bool = {
+        .set = param_set_bool,
+        .get = param_get_bool,
+};
+EXPORT_SYMBOL(param_ops_bool);
 
 /* This one must be bool. */
-int param_set_invbool(const char *val, struct kernel_param *kp)
+int param_set_invbool(const char *val, const struct kernel_param *kp)
 {
         int ret;
         bool boolval;
@@ -285,18 +354,26 @@ int param_set_invbool(const char *val, struct kernel_param *kp)
                 *(bool *)kp->arg = !boolval;
         return ret;
 }
+EXPORT_SYMBOL(param_set_invbool);
 
-int param_get_invbool(char *buffer, struct kernel_param *kp)
+int param_get_invbool(char *buffer, const struct kernel_param *kp)
 {
         return sprintf(buffer, "%c", (*(bool *)kp->arg) ? 'N' : 'Y');
 }
+EXPORT_SYMBOL(param_get_invbool);
+
+struct kernel_param_ops param_ops_invbool = {
+        .set = param_set_invbool,
+        .get = param_get_invbool,
+};
+EXPORT_SYMBOL(param_ops_invbool);
 
 /* We break the rule and mangle the string. */
 static int param_array(const char *name,
                        const char *val,
                        unsigned int min, unsigned int max,
                        void *elem, int elemsize,
-                       int (*set)(const char *, struct kernel_param *kp),
+                       int (*set)(const char *, const struct kernel_param *kp),
                        u16 flags,
                        unsigned int *num)
 {
@@ -309,12 +386,6 @@ static int param_array(const char *name,
         kp.arg = elem;
         kp.flags = flags;
 
-        /* No equals sign? */
-        if (!val) {
-                printk(KERN_ERR "%s: expects arguments\n", name);
-                return -EINVAL;
-        }
-
         *num = 0;
         /* We expect a comma-separated list of values. */
         do {
@@ -330,6 +401,7 @@ static int param_array(const char *name,
                 /* nul-terminate and parse */
                 save = val[len];
                 ((char *)val)[len] = '\0';
+                BUG_ON(!mutex_is_locked(&param_lock));
                 ret = set(val, &kp);
 
                 if (ret != 0)
@@ -347,17 +419,17 @@ static int param_array(const char *name,
         return 0;
 }
 
-int param_array_set(const char *val, struct kernel_param *kp)
+static int param_array_set(const char *val, const struct kernel_param *kp)
 {
         const struct kparam_array *arr = kp->arr;
         unsigned int temp_num;
 
         return param_array(kp->name, val, 1, arr->max, arr->elem,
-                           arr->elemsize, arr->set, kp->flags,
+                           arr->elemsize, arr->ops->set, kp->flags,
                            arr->num ?: &temp_num);
 }
 
-int param_array_get(char *buffer, struct kernel_param *kp)
+static int param_array_get(char *buffer, const struct kernel_param *kp)
 {
         int i, off, ret;
         const struct kparam_array *arr = kp->arr;
@@ -368,7 +440,8 @@ int param_array_get(char *buffer, struct kernel_param *kp)
                 if (i)
                         buffer[off++] = ',';
                 p.arg = arr->elem + arr->elemsize * i;
-                ret = arr->get(buffer + off, &p);
+                BUG_ON(!mutex_is_locked(&param_lock));
+                ret = arr->ops->get(buffer + off, &p);
                 if (ret < 0)
                         return ret;
                 off += ret;
@@ -377,14 +450,27 @@ int param_array_get(char *buffer, struct kernel_param *kp)
         return off;
 }
 
-int param_set_copystring(const char *val, struct kernel_param *kp)
+static void param_array_free(void *arg)
+{
+        unsigned int i;
+        const struct kparam_array *arr = arg;
+
+        if (arr->ops->free)
+                for (i = 0; i < (arr->num ? *arr->num : arr->max); i++)
+                        arr->ops->free(arr->elem + arr->elemsize * i);
+}
+
+struct kernel_param_ops param_array_ops = {
+        .set = param_array_set,
+        .get = param_array_get,
+        .free = param_array_free,
+};
+EXPORT_SYMBOL(param_array_ops);
+
+int param_set_copystring(const char *val, const struct kernel_param *kp)
 {
         const struct kparam_string *kps = kp->str;
 
-        if (!val) {
-                printk(KERN_ERR "%s: missing param set value\n", kp->name);
-                return -EINVAL;
-        }
         if (strlen(val)+1 > kps->maxlen) {
                 printk(KERN_ERR "%s: string doesn't fit in %u chars.\n",
                        kp->name, kps->maxlen-1);
@@ -393,12 +479,20 @@ int param_set_copystring(const char *val, struct kernel_param *kp)
         strcpy(kps->string, val);
         return 0;
 }
+EXPORT_SYMBOL(param_set_copystring);
 
-int param_get_string(char *buffer, struct kernel_param *kp)
+int param_get_string(char *buffer, const struct kernel_param *kp)
 {
         const struct kparam_string *kps = kp->str;
         return strlcpy(buffer, kps->string, kps->maxlen);
 }
+EXPORT_SYMBOL(param_get_string);
+
+struct kernel_param_ops param_ops_string = {
+        .set = param_set_copystring,
+        .get = param_get_string,
+};
+EXPORT_SYMBOL(param_ops_string);
 
 /* sysfs output in /sys/modules/XYZ/parameters/ */
 #define to_module_attr(n) container_of(n, struct module_attribute, attr)
@@ -409,7 +503,7 @@ extern struct kernel_param __start___param[], __stop___param[];
 struct param_attribute
 {
         struct module_attribute mattr;
-        struct kernel_param *param;
+        const struct kernel_param *param;
 };
 
 struct module_param_attrs
@@ -428,10 +522,12 @@ static ssize_t param_attr_show(struct module_attribute *mattr,
         int count;
         struct param_attribute *attribute = to_param_attr(mattr);
 
-        if (!attribute->param->get)
+        if (!attribute->param->ops->get)
                 return -EPERM;
 
-        count = attribute->param->get(buf, attribute->param);
+        mutex_lock(&param_lock);
+        count = attribute->param->ops->get(buf, attribute->param);
+        mutex_unlock(&param_lock);
         if (count > 0) {
                 strcat(buf, "\n");
                 ++count;
@@ -447,10 +543,12 @@ static ssize_t param_attr_store(struct module_attribute *mattr,
         int err;
         struct param_attribute *attribute = to_param_attr(mattr);
 
-        if (!attribute->param->set)
+        if (!attribute->param->ops->set)
                 return -EPERM;
 
-        err = attribute->param->set(buf, attribute->param);
+        mutex_lock(&param_lock);
+        err = attribute->param->ops->set(buf, attribute->param);
+        mutex_unlock(&param_lock);
         if (!err)
                 return len;
         return err;
@@ -464,6 +562,18 @@ static ssize_t param_attr_store(struct module_attribute *mattr,
 #endif
 
 #ifdef CONFIG_SYSFS
+void __kernel_param_lock(void)
+{
+        mutex_lock(&param_lock);
+}
+EXPORT_SYMBOL(__kernel_param_lock);
+
+void __kernel_param_unlock(void)
+{
+        mutex_unlock(&param_lock);
+}
+EXPORT_SYMBOL(__kernel_param_unlock);
+
 /*
  * add_sysfs_param - add a parameter to sysfs
  * @mk: struct module_kobject
@@ -475,7 +585,7 @@ static ssize_t param_attr_store(struct module_attribute *mattr,
  * if there's an error.
  */
 static __modinit int add_sysfs_param(struct module_kobject *mk,
-                                     struct kernel_param *kp,
+                                     const struct kernel_param *kp,
                                      const char *name)
 {
         struct module_param_attrs *new;
@@ -557,7 +667,7 @@ static void free_module_param_attrs(struct module_kobject *mk)
  * /sys/module/[mod->name]/parameters/
  */
 int module_param_sysfs_setup(struct module *mod,
-                             struct kernel_param *kparam,
+                             const struct kernel_param *kparam,
                              unsigned int num_params)
 {
         int i, err;
@@ -602,7 +712,11 @@ void module_param_sysfs_remove(struct module *mod)
 
 void destroy_params(const struct kernel_param *params, unsigned num)
 {
-        /* FIXME: This should free kmalloced charp parameters.  It doesn't. */
+        unsigned int i;
+
+        for (i = 0; i < num; i++)
+                if (params[i].ops->free)
+                        params[i].ops->free(params[i].arg);
 }
 
 static void __init kernel_add_sysfs_param(const char *name,
@@ -768,28 +882,3 @@ static int __init param_sysfs_init(void)
 subsys_initcall(param_sysfs_init);
 
 #endif /* CONFIG_SYSFS */
-
-EXPORT_SYMBOL(param_set_byte);
-EXPORT_SYMBOL(param_get_byte);
-EXPORT_SYMBOL(param_set_short);
-EXPORT_SYMBOL(param_get_short);
-EXPORT_SYMBOL(param_set_ushort);
-EXPORT_SYMBOL(param_get_ushort);
-EXPORT_SYMBOL(param_set_int);
-EXPORT_SYMBOL(param_get_int);
-EXPORT_SYMBOL(param_set_uint);
-EXPORT_SYMBOL(param_get_uint);
-EXPORT_SYMBOL(param_set_long);
-EXPORT_SYMBOL(param_get_long);
-EXPORT_SYMBOL(param_set_ulong);
-EXPORT_SYMBOL(param_get_ulong);
-EXPORT_SYMBOL(param_set_charp);
-EXPORT_SYMBOL(param_get_charp);
-EXPORT_SYMBOL(param_set_bool);
-EXPORT_SYMBOL(param_get_bool);
-EXPORT_SYMBOL(param_set_invbool);
-EXPORT_SYMBOL(param_get_invbool);
-EXPORT_SYMBOL(param_array_set);
-EXPORT_SYMBOL(param_array_get);
-EXPORT_SYMBOL(param_set_copystring);
-EXPORT_SYMBOL(param_get_string);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 403d1804b198..2870feee81dd 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -35,20 +35,15 @@
 
 #include <asm/irq_regs.h>
 
-/*
- * Each CPU has a list of per CPU events:
- */
-static DEFINE_PER_CPU(struct perf_cpu_context, perf_cpu_context);
-
-int perf_max_events __read_mostly = 1;
-static int perf_reserved_percpu __read_mostly;
-static int perf_overcommit __read_mostly = 1;
-
-static atomic_t nr_events __read_mostly;
+atomic_t perf_task_events __read_mostly;
 static atomic_t nr_mmap_events __read_mostly;
 static atomic_t nr_comm_events __read_mostly;
 static atomic_t nr_task_events __read_mostly;
 
+static LIST_HEAD(pmus);
+static DEFINE_MUTEX(pmus_lock);
+static struct srcu_struct pmus_srcu;
+
 /*
  * perf event paranoia level:
  *  -1 - not paranoid at all
@@ -67,36 +62,43 @@ int sysctl_perf_event_sample_rate __read_mostly = 100000;
 
 static atomic64_t perf_event_id;
 
-/*
- * Lock for (sysadmin-configurable) event reservations:
- */
-static DEFINE_SPINLOCK(perf_resource_lock);
+void __weak perf_event_print_debug(void)        { }
 
-/*
- * Architecture provided APIs - weak aliases:
- */
-extern __weak const struct pmu *hw_perf_event_init(struct perf_event *event)
+extern __weak const char *perf_pmu_name(void)
 {
-        return NULL;
+        return "pmu";
 }
 
-void __weak hw_perf_disable(void)               { barrier(); }
-void __weak hw_perf_enable(void)                { barrier(); }
-
-void __weak perf_event_print_debug(void)        { }
-
-static DEFINE_PER_CPU(int, perf_disable_count);
+void perf_pmu_disable(struct pmu *pmu)
+{
+        int *count = this_cpu_ptr(pmu->pmu_disable_count);
+        if (!(*count)++)
+                pmu->pmu_disable(pmu);
+}
 
-void perf_disable(void)
+void perf_pmu_enable(struct pmu *pmu)
 {
-        if (!__get_cpu_var(perf_disable_count)++)
-                hw_perf_disable();
+        int *count = this_cpu_ptr(pmu->pmu_disable_count);
+        if (!--(*count))
+                pmu->pmu_enable(pmu);
 }
 
-void perf_enable(void)
+static DEFINE_PER_CPU(struct list_head, rotation_list);
+
+/*
+ * perf_pmu_rotate_start() and perf_rotate_context() are fully serialized
+ * because they're strictly cpu affine and rotate_start is called with IRQs
+ * disabled, while rotate_context is called from IRQ context.
+ */
+static void perf_pmu_rotate_start(struct pmu *pmu)
 {
-        if (!--__get_cpu_var(perf_disable_count))
-                hw_perf_enable();
+        struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+        struct list_head *head = &__get_cpu_var(rotation_list);
+
+        WARN_ON(!irqs_disabled());
+
+        if (list_empty(&cpuctx->rotation_list))
+                list_add(&cpuctx->rotation_list, head);
 }
 
 static void get_ctx(struct perf_event_context *ctx)
@@ -151,13 +153,13 @@ static u64 primary_event_id(struct perf_event *event)
  * the context could get moved to another task.
  */
 static struct perf_event_context *
-perf_lock_task_context(struct task_struct *task, unsigned long *flags)
+perf_lock_task_context(struct task_struct *task, int ctxn, unsigned long *flags)
 {
         struct perf_event_context *ctx;
 
         rcu_read_lock();
- retry:
-        ctx = rcu_dereference(task->perf_event_ctxp);
+retry:
+        ctx = rcu_dereference(task->perf_event_ctxp[ctxn]);
         if (ctx) {
                 /*
                  * If this context is a clone of another, it might
@@ -170,7 +172,7 @@ perf_lock_task_context(struct task_struct *task, unsigned long *flags)
                  * can't get swapped on us any more.
                  */
                 raw_spin_lock_irqsave(&ctx->lock, *flags);
-                if (ctx != rcu_dereference(task->perf_event_ctxp)) {
+                if (ctx != rcu_dereference(task->perf_event_ctxp[ctxn])) {
                         raw_spin_unlock_irqrestore(&ctx->lock, *flags);
                         goto retry;
                 }
@@ -189,12 +191,13 @@ perf_lock_task_context(struct task_struct *task, unsigned long *flags)
  * can't get swapped to another task.  This also increments its
  * reference count so that the context can't get freed.
  */
-static struct perf_event_context *perf_pin_task_context(struct task_struct *task)
+static struct perf_event_context *
+perf_pin_task_context(struct task_struct *task, int ctxn)
 {
         struct perf_event_context *ctx;
         unsigned long flags;
 
-        ctx = perf_lock_task_context(task, &flags);
+        ctx = perf_lock_task_context(task, ctxn, &flags);
         if (ctx) {
                 ++ctx->pin_count;
                 raw_spin_unlock_irqrestore(&ctx->lock, flags);
@@ -302,6 +305,8 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
         }
 
         list_add_rcu(&event->event_entry, &ctx->event_list);
+        if (!ctx->nr_events)
+                perf_pmu_rotate_start(ctx->pmu);
         ctx->nr_events++;
         if (event->attr.inherit_stat)
                 ctx->nr_stat++;
@@ -311,7 +316,12 @@ static void perf_group_attach(struct perf_event *event)
 {
         struct perf_event *group_leader = event->group_leader;
 
-        WARN_ON_ONCE(event->attach_state & PERF_ATTACH_GROUP);
+        /*
+         * We can have double attach due to group movement in perf_event_open.
+         */
+        if (event->attach_state & PERF_ATTACH_GROUP)
+                return;
+
         event->attach_state |= PERF_ATTACH_GROUP;
 
         if (group_leader == event)
@@ -402,11 +412,31 @@ static void perf_group_detach(struct perf_event *event)
         }
 }
 
+static inline int
+event_filter_match(struct perf_event *event)
+{
+        return event->cpu == -1 || event->cpu == smp_processor_id();
+}
+
 static void
 event_sched_out(struct perf_event *event,
                   struct perf_cpu_context *cpuctx,
                   struct perf_event_context *ctx)
 {
+        u64 delta;
+        /*
+         * An event which could not be activated because of
+         * filter mismatch still needs to have its timings
+         * maintained, otherwise bogus information is return
+         * via read() for time_enabled, time_running:
+         */
+        if (event->state == PERF_EVENT_STATE_INACTIVE
+            && !event_filter_match(event)) {
+                delta = ctx->time - event->tstamp_stopped;
+                event->tstamp_running += delta;
+                event->tstamp_stopped = ctx->time;
+        }
+
         if (event->state != PERF_EVENT_STATE_ACTIVE)
                 return;
 
@@ -416,7 +446,7 @@ event_sched_out(struct perf_event *event,
                 event->state = PERF_EVENT_STATE_OFF;
         }
         event->tstamp_stopped = ctx->time;
-        event->pmu->disable(event);
+        event->pmu->del(event, 0);
         event->oncpu = -1;
 
         if (!is_software_event(event))
@@ -432,9 +462,7 @@ group_sched_out(struct perf_event *group_event,
                 struct perf_event_context *ctx)
 {
         struct perf_event *event;
-
-        if (group_event->state != PERF_EVENT_STATE_ACTIVE)
-                return;
+        int state = group_event->state;
 
         event_sched_out(group_event, cpuctx, ctx);
 
@@ -444,10 +472,16 @@ group_sched_out(struct perf_event *group_event,
         list_for_each_entry(event, &group_event->sibling_list, group_entry)
                 event_sched_out(event, cpuctx, ctx);
 
-        if (group_event->attr.exclusive)
+        if (state == PERF_EVENT_STATE_ACTIVE && group_event->attr.exclusive)
                 cpuctx->exclusive = 0;
 }
 
+static inline struct perf_cpu_context *
+__get_cpu_context(struct perf_event_context *ctx)
+{
+        return this_cpu_ptr(ctx->pmu->pmu_cpu_context);
+}
+
 /*
  * Cross CPU call to remove a performance event
  *
@@ -456,9 +490,9 @@ group_sched_out(struct perf_event *group_event,
  */
 static void __perf_event_remove_from_context(void *info)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
         /*
          * If this is a task context, we need to check whether it is
@@ -469,27 +503,11 @@ static void __perf_event_remove_from_context(void *info)
                 return;
 
         raw_spin_lock(&ctx->lock);
-        /*
-         * Protect the list operation against NMI by disabling the
-         * events on a global level.
-         */
-        perf_disable();
 
         event_sched_out(event, cpuctx, ctx);
 
         list_del_event(event, ctx);
 
-        if (!ctx->task) {
-                /*
-                 * Allow more per task events with respect to the
-                 * reservation:
-                 */
-                cpuctx->max_pertask =
-                        min(perf_max_events - ctx->nr_events,
-                            perf_max_events - perf_reserved_percpu);
-        }
-
-        perf_enable();
         raw_spin_unlock(&ctx->lock);
 }
 
@@ -554,8 +572,8 @@ retry:
 static void __perf_event_disable(void *info)
 {
         struct perf_event *event = info;
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_event_context *ctx = event->ctx;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
         /*
          * If this is a per-task event, need to check whether this
@@ -610,7 +628,7 @@ void perf_event_disable(struct perf_event *event)
                 return;
         }
 
- retry:
+retry:
         task_oncpu_function_call(task, __perf_event_disable, event);
 
         raw_spin_lock_irq(&ctx->lock);
@@ -649,7 +667,7 @@ event_sched_in(struct perf_event *event,
          */
         smp_wmb();
 
-        if (event->pmu->enable(event)) {
+        if (event->pmu->add(event, PERF_EF_START)) {
                 event->state = PERF_EVENT_STATE_INACTIVE;
                 event->oncpu = -1;
                 return -EAGAIN;
@@ -657,6 +675,8 @@ event_sched_in(struct perf_event *event,
 
         event->tstamp_running += ctx->time - event->tstamp_stopped;
 
+        event->shadow_ctx_time = ctx->time - ctx->timestamp;
+
         if (!is_software_event(event))
                 cpuctx->active_oncpu++;
         ctx->nr_active++;
@@ -673,22 +693,17 @@ group_sched_in(struct perf_event *group_event,
                struct perf_event_context *ctx)
 {
         struct perf_event *event, *partial_group = NULL;
-        const struct pmu *pmu = group_event->pmu;
-        bool txn = false;
+        struct pmu *pmu = group_event->pmu;
+        u64 now = ctx->time;
+        bool simulate = false;
 
         if (group_event->state == PERF_EVENT_STATE_OFF)
                 return 0;
 
-        /* Check if group transaction availabe */
-        if (pmu->start_txn)
-                txn = true;
-
-        if (txn)
-                pmu->start_txn(pmu);
+        pmu->start_txn(pmu);
 
         if (event_sched_in(group_event, cpuctx, ctx)) {
-                if (txn)
-                        pmu->cancel_txn(pmu);
+                pmu->cancel_txn(pmu);
                 return -EAGAIN;
         }
 
@@ -702,23 +717,38 @@ group_sched_in(struct perf_event *group_event,
                 }
         }
 
-        if (!txn || !pmu->commit_txn(pmu))
+        if (!pmu->commit_txn(pmu))
                 return 0;
 
 group_error:
         /*
          * Groups can be scheduled in as one unit only, so undo any
          * partial group before returning:
+         * The events up to the failed event are scheduled out normally,
+         * tstamp_stopped will be updated.
+         *
+         * The failed events and the remaining siblings need to have
+         * their timings updated as if they had gone thru event_sched_in()
+         * and event_sched_out(). This is required to get consistent timings
+         * across the group. This also takes care of the case where the group
+         * could never be scheduled by ensuring tstamp_stopped is set to mark
+         * the time the event was actually stopped, such that time delta
+         * calculation in update_event_times() is correct.
          */
         list_for_each_entry(event, &group_event->sibling_list, group_entry) {
                 if (event == partial_group)
-                        break;
-                event_sched_out(event, cpuctx, ctx);
+                        simulate = true;
+
+                if (simulate) {
+                        event->tstamp_running += now - event->tstamp_stopped;
+                        event->tstamp_stopped = now;
+                } else {
+                        event_sched_out(event, cpuctx, ctx);
+                }
         }
         event_sched_out(group_event, cpuctx, ctx);
 
-        if (txn)
-                pmu->cancel_txn(pmu);
+        pmu->cancel_txn(pmu);
 
         return -EAGAIN;
 }
@@ -771,10 +801,10 @@ static void add_event_to_ctx(struct perf_event *event,
  */
 static void __perf_install_in_context(void *info)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
         struct perf_event *leader = event->group_leader;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
         int err;
 
         /*
@@ -794,12 +824,6 @@ static void __perf_install_in_context(void *info)
         ctx->is_active = 1;
         update_context_time(ctx);
 
-        /*
-         * Protect the list operation against NMI by disabling the
-         * events on a global level. NOP for non NMI based events.
-         */
-        perf_disable();
-
         add_event_to_ctx(event, ctx);
 
         if (event->cpu != -1 && event->cpu != smp_processor_id())
@@ -837,12 +861,7 @@ static void __perf_install_in_context(void *info)
                 }
         }
 
-        if (!err && !ctx->task && cpuctx->max_pertask)
-                cpuctx->max_pertask--;
-
- unlock:
-        perf_enable();
-
+unlock:
         raw_spin_unlock(&ctx->lock);
 }
 
@@ -865,6 +884,8 @@ perf_install_in_context(struct perf_event_context *ctx,
 {
         struct task_struct *task = ctx->task;
 
+        event->ctx = ctx;
+
         if (!task) {
                 /*
                  * Per cpu events are installed via an smp call and
@@ -913,10 +934,12 @@ static void __perf_event_mark_enabled(struct perf_event *event,
 
         event->state = PERF_EVENT_STATE_INACTIVE;
         event->tstamp_enabled = ctx->time - event->total_time_enabled;
-        list_for_each_entry(sub, &event->sibling_list, group_entry)
-                if (sub->state >= PERF_EVENT_STATE_INACTIVE)
+        list_for_each_entry(sub, &event->sibling_list, group_entry) {
+                if (sub->state >= PERF_EVENT_STATE_INACTIVE) {
                         sub->tstamp_enabled =
                                 ctx->time - sub->total_time_enabled;
+                }
+        }
 }
 
 /*
@@ -925,9 +948,9 @@ static void __perf_event_mark_enabled(struct perf_event *event,
 static void __perf_event_enable(void *info)
 {
         struct perf_event *event = info;
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_event_context *ctx = event->ctx;
         struct perf_event *leader = event->group_leader;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
         int err;
 
         /*
@@ -961,12 +984,10 @@ static void __perf_event_enable(void *info)
         if (!group_can_go_on(event, cpuctx, 1)) {
                 err = -EEXIST;
         } else {
-                perf_disable();
                 if (event == leader)
                         err = group_sched_in(event, cpuctx, ctx);
                 else
                         err = event_sched_in(event, cpuctx, ctx);
-                perf_enable();
         }
 
         if (err) {
@@ -982,7 +1003,7 @@ static void __perf_event_enable(void *info)
                 }
         }
 
- unlock:
+unlock:
         raw_spin_unlock(&ctx->lock);
 }
 
@@ -1023,7 +1044,7 @@ void perf_event_enable(struct perf_event *event)
         if (event->state == PERF_EVENT_STATE_ERROR)
                 event->state = PERF_EVENT_STATE_OFF;
 
- retry:
+retry:
         raw_spin_unlock_irq(&ctx->lock);
         task_oncpu_function_call(task, __perf_event_enable, event);
 
@@ -1043,7 +1064,7 @@ void perf_event_enable(struct perf_event *event)
         if (event->state == PERF_EVENT_STATE_OFF)
                 __perf_event_mark_enabled(event, ctx);
 
- out:
+out:
         raw_spin_unlock_irq(&ctx->lock);
 }
 
@@ -1074,26 +1095,26 @@ static void ctx_sched_out(struct perf_event_context *ctx,
         struct perf_event *event;
 
         raw_spin_lock(&ctx->lock);
+        perf_pmu_disable(ctx->pmu);
         ctx->is_active = 0;
         if (likely(!ctx->nr_events))
                 goto out;
         update_context_time(ctx);
 
-        perf_disable();
         if (!ctx->nr_active)
-                goto out_enable;
+                goto out;
 
-        if (event_type & EVENT_PINNED)
+        if (event_type & EVENT_PINNED) {
                 list_for_each_entry(event, &ctx->pinned_groups, group_entry)
                         group_sched_out(event, cpuctx, ctx);
+        }
 
-        if (event_type & EVENT_FLEXIBLE)
+        if (event_type & EVENT_FLEXIBLE) {
                 list_for_each_entry(event, &ctx->flexible_groups, group_entry)
                         group_sched_out(event, cpuctx, ctx);
-
- out_enable:
-        perf_enable();
- out:
+        }
+out:
+        perf_pmu_enable(ctx->pmu);
         raw_spin_unlock(&ctx->lock);
 }
 
@@ -1191,34 +1212,25 @@ static void perf_event_sync_stat(struct perf_event_context *ctx,
         }
 }
 
-/*
- * Called from scheduler to remove the events of the current task,
- * with interrupts disabled.
- *
- * We stop each event and update the event value in event->count.
- *
- * This does not protect us against NMI, but disable()
- * sets the disabled bit in the control field of event _before_
- * accessing the event control register. If a NMI hits, then it will
- * not restart the event.
- */
-void perf_event_task_sched_out(struct task_struct *task,
-                                 struct task_struct *next)
+void perf_event_context_sched_out(struct task_struct *task, int ctxn,
+                                  struct task_struct *next)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
-        struct perf_event_context *ctx = task->perf_event_ctxp;
+        struct perf_event_context *ctx = task->perf_event_ctxp[ctxn];
         struct perf_event_context *next_ctx;
         struct perf_event_context *parent;
+        struct perf_cpu_context *cpuctx;
         int do_switch = 1;
 
-        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0);
+        if (likely(!ctx))
+                return;
 
-        if (likely(!ctx || !cpuctx->task_ctx))
+        cpuctx = __get_cpu_context(ctx);
+        if (!cpuctx->task_ctx)
                 return;
 
         rcu_read_lock();
         parent = rcu_dereference(ctx->parent_ctx);
-        next_ctx = next->perf_event_ctxp;
+        next_ctx = next->perf_event_ctxp[ctxn];
         if (parent && next_ctx &&
             rcu_dereference(next_ctx->parent_ctx) == parent) {
                 /*
@@ -1237,8 +1249,8 @@ void perf_event_task_sched_out(struct task_struct *task,
                          * XXX do we need a memory barrier of sorts
                          * wrt to rcu_dereference() of perf_event_ctxp
                          */
-                        task->perf_event_ctxp = next_ctx;
-                        next->perf_event_ctxp = ctx;
+                        task->perf_event_ctxp[ctxn] = next_ctx;
+                        next->perf_event_ctxp[ctxn] = ctx;
                         ctx->task = next;
                         next_ctx->task = task;
                         do_switch = 0;
@@ -1256,10 +1268,33 @@ void perf_event_task_sched_out(struct task_struct *task,
         }
 }
 
+#define for_each_task_context_nr(ctxn)                                  \
+        for ((ctxn) = 0; (ctxn) < perf_nr_task_contexts; (ctxn)++)
+
+/*
+ * Called from scheduler to remove the events of the current task,
+ * with interrupts disabled.
+ *
+ * We stop each event and update the event value in event->count.
+ *
+ * This does not protect us against NMI, but disable()
+ * sets the disabled bit in the control field of event _before_
+ * accessing the event control register. If a NMI hits, then it will
+ * not restart the event.
+ */
+void __perf_event_task_sched_out(struct task_struct *task,
+                                 struct task_struct *next)
+{
+        int ctxn;
+
+        for_each_task_context_nr(ctxn)
+                perf_event_context_sched_out(task, ctxn, next);
+}
+
 static void task_ctx_sched_out(struct perf_event_context *ctx,
                                enum event_type_t event_type)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
         if (!cpuctx->task_ctx)
                 return;
@@ -1274,14 +1309,6 @@ static void task_ctx_sched_out(struct perf_event_context *ctx,
 /*
  * Called with IRQs disabled
  */
-static void __perf_event_task_sched_out(struct perf_event_context *ctx)
-{
-        task_ctx_sched_out(ctx, EVENT_ALL);
-}
-
-/*
- * Called with IRQs disabled
- */
 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
                               enum event_type_t event_type)
 {
@@ -1332,9 +1359,10 @@ ctx_flexible_sched_in(struct perf_event_context *ctx,
                 if (event->cpu != -1 && event->cpu != smp_processor_id())
                         continue;
 
-                if (group_can_go_on(event, cpuctx, can_add_hw))
+                if (group_can_go_on(event, cpuctx, can_add_hw)) {
                         if (group_sched_in(event, cpuctx, ctx))
                                 can_add_hw = 0;
+                }
         }
 }
 
@@ -1350,8 +1378,6 @@ ctx_sched_in(struct perf_event_context *ctx,
 
         ctx->timestamp = perf_clock();
 
-        perf_disable();
-
         /*
          * First go through the list and put on any pinned groups
          * in order to give them the best chance of going on.
@@ -1363,8 +1389,7 @@ ctx_sched_in(struct perf_event_context *ctx,
         if (event_type & EVENT_FLEXIBLE)
                 ctx_flexible_sched_in(ctx, cpuctx);
 
-        perf_enable();
- out:
+out:
         raw_spin_unlock(&ctx->lock);
 }
 
@@ -1376,43 +1401,28 @@ static void cpu_ctx_sched_in(struct perf_cpu_context *cpuctx,
         ctx_sched_in(ctx, cpuctx, event_type);
 }
 
-static void task_ctx_sched_in(struct task_struct *task,
+static void task_ctx_sched_in(struct perf_event_context *ctx,
                               enum event_type_t event_type)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
-        struct perf_event_context *ctx = task->perf_event_ctxp;
+        struct perf_cpu_context *cpuctx;
 
-        if (likely(!ctx))
-                return;
+        cpuctx = __get_cpu_context(ctx);
         if (cpuctx->task_ctx == ctx)
                 return;
+
         ctx_sched_in(ctx, cpuctx, event_type);
         cpuctx->task_ctx = ctx;
 }
-/*
- * Called from scheduler to add the events of the current task
- * with interrupts disabled.
- *
- * We restore the event value and then enable it.
- *
- * This does not protect us against NMI, but enable()
- * sets the enabled bit in the control field of event _before_
- * accessing the event control register. If a NMI hits, then it will
- * keep the event running.
- */
-void perf_event_task_sched_in(struct task_struct *task)
-{
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
-        struct perf_event_context *ctx = task->perf_event_ctxp;
 
-        if (likely(!ctx))
-                return;
+void perf_event_context_sched_in(struct perf_event_context *ctx)
+{
+        struct perf_cpu_context *cpuctx;
 
+        cpuctx = __get_cpu_context(ctx);
         if (cpuctx->task_ctx == ctx)
                 return;
 
-        perf_disable();
-
+        perf_pmu_disable(ctx->pmu);
         /*
          * We want to keep the following priority order:
          * cpu pinned (that don't need to move), task pinned,
@@ -1426,7 +1436,37 @@ void perf_event_task_sched_in(struct task_struct *task)
 
         cpuctx->task_ctx = ctx;
 
-        perf_enable();
+        /*
+         * Since these rotations are per-cpu, we need to ensure the
+         * cpu-context we got scheduled on is actually rotating.
+         */
+        perf_pmu_rotate_start(ctx->pmu);
+        perf_pmu_enable(ctx->pmu);
+}
+
+/*
+ * Called from scheduler to add the events of the current task
+ * with interrupts disabled.
+ *
+ * We restore the event value and then enable it.
+ *
+ * This does not protect us against NMI, but enable()
+ * sets the enabled bit in the control field of event _before_
+ * accessing the event control register. If a NMI hits, then it will
+ * keep the event running.
+ */
+void __perf_event_task_sched_in(struct task_struct *task)
+{
+        struct perf_event_context *ctx;
+        int ctxn;
+
+        for_each_task_context_nr(ctxn) {
+                ctx = task->perf_event_ctxp[ctxn];
+                if (likely(!ctx))
+                        continue;
+
+                perf_event_context_sched_in(ctx);
+        }
 }
 
 #define MAX_INTERRUPTS (~0ULL)
@@ -1506,22 +1546,6 @@ do {					\
         return div64_u64(dividend, divisor);
 }
 
-static void perf_event_stop(struct perf_event *event)
-{
-        if (!event->pmu->stop)
-                return event->pmu->disable(event);
-
-        return event->pmu->stop(event);
-}
-
-static int perf_event_start(struct perf_event *event)
-{
-        if (!event->pmu->start)
-                return event->pmu->enable(event);
-
-        return event->pmu->start(event);
-}
-
 static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
 {
         struct hw_perf_event *hwc = &event->hw;
@@ -1541,15 +1565,13 @@ static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
         hwc->sample_period = sample_period;
 
         if (local64_read(&hwc->period_left) > 8*sample_period) {
-                perf_disable();
-                perf_event_stop(event);
+                event->pmu->stop(event, PERF_EF_UPDATE);
                 local64_set(&hwc->period_left, 0);
-                perf_event_start(event);
-                perf_enable();
+                event->pmu->start(event, PERF_EF_RELOAD);
         }
 }
 
-static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
+static void perf_ctx_adjust_freq(struct perf_event_context *ctx, u64 period)
 {
         struct perf_event *event;
         struct hw_perf_event *hwc;
@@ -1574,23 +1596,19 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
                  */
                 if (interrupts == MAX_INTERRUPTS) {
                         perf_log_throttle(event, 1);
-                        perf_disable();
-                        event->pmu->unthrottle(event);
-                        perf_enable();
+                        event->pmu->start(event, 0);
                 }
 
                 if (!event->attr.freq || !event->attr.sample_freq)
                         continue;
 
-                perf_disable();
                 event->pmu->read(event);
                 now = local64_read(&event->count);
                 delta = now - hwc->freq_count_stamp;
                 hwc->freq_count_stamp = now;
 
                 if (delta > 0)
-                        perf_adjust_period(event, TICK_NSEC, delta);
-                perf_enable();
+                        perf_adjust_period(event, period, delta);
         }
         raw_spin_unlock(&ctx->lock);
 }
@@ -1602,38 +1620,48 @@ static void rotate_ctx(struct perf_event_context *ctx)
 {
         raw_spin_lock(&ctx->lock);
 
-        /* Rotate the first entry last of non-pinned groups */
-        list_rotate_left(&ctx->flexible_groups);
+        /*
+         * Rotate the first entry last of non-pinned groups. Rotation might be
+         * disabled by the inheritance code.
+         */
+        if (!ctx->rotate_disable)
+                list_rotate_left(&ctx->flexible_groups);
 
         raw_spin_unlock(&ctx->lock);
 }
 
-void perf_event_task_tick(struct task_struct *curr)
+/*
+ * perf_pmu_rotate_start() and perf_rotate_context() are fully serialized
+ * because they're strictly cpu affine and rotate_start is called with IRQs
+ * disabled, while rotate_context is called from IRQ context.
+ */
+static void perf_rotate_context(struct perf_cpu_context *cpuctx)
 {
-        struct perf_cpu_context *cpuctx;
-        struct perf_event_context *ctx;
-        int rotate = 0;
+        u64 interval = (u64)cpuctx->jiffies_interval * TICK_NSEC;
+        struct perf_event_context *ctx = NULL;
+        int rotate = 0, remove = 1;
 
-        if (!atomic_read(&nr_events))
-                return;
-
-        cpuctx = &__get_cpu_var(perf_cpu_context);
-        if (cpuctx->ctx.nr_events &&
-            cpuctx->ctx.nr_events != cpuctx->ctx.nr_active)
-                rotate = 1;
+        if (cpuctx->ctx.nr_events) {
+                remove = 0;
+                if (cpuctx->ctx.nr_events != cpuctx->ctx.nr_active)
+                        rotate = 1;
+        }
 
-        ctx = curr->perf_event_ctxp;
-        if (ctx && ctx->nr_events && ctx->nr_events != ctx->nr_active)
-                rotate = 1;
+        ctx = cpuctx->task_ctx;
+        if (ctx && ctx->nr_events) {
+                remove = 0;
+                if (ctx->nr_events != ctx->nr_active)
+                        rotate = 1;
+        }
 
-        perf_ctx_adjust_freq(&cpuctx->ctx);
+        perf_pmu_disable(cpuctx->ctx.pmu);
+        perf_ctx_adjust_freq(&cpuctx->ctx, interval);
         if (ctx)
-                perf_ctx_adjust_freq(ctx);
+                perf_ctx_adjust_freq(ctx, interval);
 
         if (!rotate)
-                return;
+                goto done;
 
-        perf_disable();
         cpu_ctx_sched_out(cpuctx, EVENT_FLEXIBLE);
         if (ctx)
                 task_ctx_sched_out(ctx, EVENT_FLEXIBLE);
@@ -1644,8 +1672,27 @@ void perf_event_task_tick(struct task_struct *curr)
 
         cpu_ctx_sched_in(cpuctx, EVENT_FLEXIBLE);
         if (ctx)
-                task_ctx_sched_in(curr, EVENT_FLEXIBLE);
-        perf_enable();
+                task_ctx_sched_in(ctx, EVENT_FLEXIBLE);
+
+done:
+        if (remove)
+                list_del_init(&cpuctx->rotation_list);
+
+        perf_pmu_enable(cpuctx->ctx.pmu);
+}
+
+void perf_event_task_tick(void)
+{
+        struct list_head *head = &__get_cpu_var(rotation_list);
+        struct perf_cpu_context *cpuctx, *tmp;
+
+        WARN_ON(!irqs_disabled());
+
+        list_for_each_entry_safe(cpuctx, tmp, head, rotation_list) {
+                if (cpuctx->jiffies_interval == 1 ||
+                                !(jiffies % cpuctx->jiffies_interval))
+                        perf_rotate_context(cpuctx);
+        }
 }
 
 static int event_enable_on_exec(struct perf_event *event,
@@ -1667,20 +1714,18 @@ static int event_enable_on_exec(struct perf_event *event,
  * Enable all of a task's events that have been marked enable-on-exec.
  * This expects task == current.
  */
-static void perf_event_enable_on_exec(struct task_struct *task)
+static void perf_event_enable_on_exec(struct perf_event_context *ctx)
 {
-        struct perf_event_context *ctx;
         struct perf_event *event;
         unsigned long flags;
         int enabled = 0;
         int ret;
 
         local_irq_save(flags);
-        ctx = task->perf_event_ctxp;
         if (!ctx || !ctx->nr_events)
                 goto out;
 
-        __perf_event_task_sched_out(ctx);
+        task_ctx_sched_out(ctx, EVENT_ALL);
 
         raw_spin_lock(&ctx->lock);
 
@@ -1704,8 +1749,8 @@ static void perf_event_enable_on_exec(struct task_struct *task)
 
         raw_spin_unlock(&ctx->lock);
 
-        perf_event_task_sched_in(task);
- out:
+        perf_event_context_sched_in(ctx);
+out:
         local_irq_restore(flags);
 }
 
@@ -1714,9 +1759,9 @@ static void perf_event_enable_on_exec(struct task_struct *task)
  */
 static void __perf_event_read(void *info)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
         /*
          * If this is a task context, we need to check whether it is
@@ -1755,7 +1800,13 @@ static u64 perf_event_read(struct perf_event *event)
                 unsigned long flags;
 
                 raw_spin_lock_irqsave(&ctx->lock, flags);
-                update_context_time(ctx);
+                /*
+                 * may read while context is not active
+                 * (e.g., thread is blocked), in that case
+                 * we cannot update context time
+                 */
+                if (ctx->is_active)
+                        update_context_time(ctx);
                 update_event_times(event);
                 raw_spin_unlock_irqrestore(&ctx->lock, flags);
         }
@@ -1764,11 +1815,219 @@ static u64 perf_event_read(struct perf_event *event)
 }
 
 /*
- * Initialize the perf_event context in a task_struct:
+ * Callchain support
  */
+
+struct callchain_cpus_entries {
+        struct rcu_head                 rcu_head;
+        struct perf_callchain_entry     *cpu_entries[0];
+};
+
+static DEFINE_PER_CPU(int, callchain_recursion[PERF_NR_CONTEXTS]);
+static atomic_t nr_callchain_events;
+static DEFINE_MUTEX(callchain_mutex);
+struct callchain_cpus_entries *callchain_cpus_entries;
+
+
+__weak void perf_callchain_kernel(struct perf_callchain_entry *entry,
+                                  struct pt_regs *regs)
+{
+}
+
+__weak void perf_callchain_user(struct perf_callchain_entry *entry,
+                                struct pt_regs *regs)
+{
+}
+
+static void release_callchain_buffers_rcu(struct rcu_head *head)
+{
+        struct callchain_cpus_entries *entries;
+        int cpu;
+
+        entries = container_of(head, struct callchain_cpus_entries, rcu_head);
+
+        for_each_possible_cpu(cpu)
+                kfree(entries->cpu_entries[cpu]);
+
+        kfree(entries);
+}
+
+static void release_callchain_buffers(void)
+{
+        struct callchain_cpus_entries *entries;
+
+        entries = callchain_cpus_entries;
+        rcu_assign_pointer(callchain_cpus_entries, NULL);
+        call_rcu(&entries->rcu_head, release_callchain_buffers_rcu);
+}
+
+static int alloc_callchain_buffers(void)
+{
+        int cpu;
+        int size;
+        struct callchain_cpus_entries *entries;
+
+        /*
+         * We can't use the percpu allocation API for data that can be
+         * accessed from NMI. Use a temporary manual per cpu allocation
+         * until that gets sorted out.
+         */
+        size = sizeof(*entries) + sizeof(struct perf_callchain_entry *) *
+                num_possible_cpus();
+
+        entries = kzalloc(size, GFP_KERNEL);
+        if (!entries)
+                return -ENOMEM;
+
+        size = sizeof(struct perf_callchain_entry) * PERF_NR_CONTEXTS;
+
+        for_each_possible_cpu(cpu) {
+                entries->cpu_entries[cpu] = kmalloc_node(size, GFP_KERNEL,
+                                                         cpu_to_node(cpu));
+                if (!entries->cpu_entries[cpu])
+                        goto fail;
+        }
+
+        rcu_assign_pointer(callchain_cpus_entries, entries);
+
+        return 0;
+
+fail:
+        for_each_possible_cpu(cpu)
+                kfree(entries->cpu_entries[cpu]);
+        kfree(entries);
+
+        return -ENOMEM;
+}
+
+static int get_callchain_buffers(void)
+{
+        int err = 0;
+        int count;
+
+        mutex_lock(&callchain_mutex);
+
+        count = atomic_inc_return(&nr_callchain_events);
+        if (WARN_ON_ONCE(count < 1)) {
+                err = -EINVAL;
+                goto exit;
+        }
+
+        if (count > 1) {
+                /* If the allocation failed, give up */
+                if (!callchain_cpus_entries)
+                        err = -ENOMEM;
+                goto exit;
+        }
+
+        err = alloc_callchain_buffers();
+        if (err)
+                release_callchain_buffers();
+exit:
+        mutex_unlock(&callchain_mutex);
+
+        return err;
+}
+
+static void put_callchain_buffers(void)
+{
+        if (atomic_dec_and_mutex_lock(&nr_callchain_events, &callchain_mutex)) {
+                release_callchain_buffers();
+                mutex_unlock(&callchain_mutex);
+        }
+}
+
+static int get_recursion_context(int *recursion)
+{
+        int rctx;
+
+        if (in_nmi())
+                rctx = 3;
+        else if (in_irq())
+                rctx = 2;
+        else if (in_softirq())
+                rctx = 1;
+        else
+                rctx = 0;
+
+        if (recursion[rctx])
+                return -1;
+
+        recursion[rctx]++;
+        barrier();
+
+        return rctx;
+}
+
+static inline void put_recursion_context(int *recursion, int rctx)
+{
+        barrier();
+        recursion[rctx]--;
+}
+
+static struct perf_callchain_entry *get_callchain_entry(int *rctx)
+{
+        int cpu;
+        struct callchain_cpus_entries *entries;
+
+        *rctx = get_recursion_context(__get_cpu_var(callchain_recursion));
+        if (*rctx == -1)
+                return NULL;
+
+        entries = rcu_dereference(callchain_cpus_entries);
+        if (!entries)
+                return NULL;
+
+        cpu = smp_processor_id();
+
+        return &entries->cpu_entries[cpu][*rctx];
+}
+
 static void
-__perf_event_init_context(struct perf_event_context *ctx,
-                            struct task_struct *task)
+put_callchain_entry(int rctx)
+{
+        put_recursion_context(__get_cpu_var(callchain_recursion), rctx);
+}
+
+static struct perf_callchain_entry *perf_callchain(struct pt_regs *regs)
+{
+        int rctx;
+        struct perf_callchain_entry *entry;
+
+
+        entry = get_callchain_entry(&rctx);
+        if (rctx == -1)
+                return NULL;
+
+        if (!entry)
+                goto exit_put;
+
+        entry->nr = 0;
+
+        if (!user_mode(regs)) {
+                perf_callchain_store(entry, PERF_CONTEXT_KERNEL);
+                perf_callchain_kernel(entry, regs);
+                if (current->mm)
+                        regs = task_pt_regs(current);
+                else
+                        regs = NULL;
+        }
+
+        if (regs) {
+                perf_callchain_store(entry, PERF_CONTEXT_USER);
+                perf_callchain_user(entry, regs);
+        }
+
+exit_put:
+        put_callchain_entry(rctx);
+
+        return entry;
+}
+
+/*
+ * Initialize the perf_event context in a task_struct:
+ */
+static void __perf_event_init_context(struct perf_event_context *ctx)
 {
         raw_spin_lock_init(&ctx->lock);
         mutex_init(&ctx->mutex);
@@ -1776,45 +2035,38 @@ __perf_event_init_context(struct perf_event_context *ctx,
         INIT_LIST_HEAD(&ctx->flexible_groups);
         INIT_LIST_HEAD(&ctx->event_list);
         atomic_set(&ctx->refcount, 1);
-        ctx->task = task;
 }
 
-static struct perf_event_context *find_get_context(pid_t pid, int cpu)
+static struct perf_event_context *
+alloc_perf_context(struct pmu *pmu, struct task_struct *task)
 {
         struct perf_event_context *ctx;
-        struct perf_cpu_context *cpuctx;
-        struct task_struct *task;
-        unsigned long flags;
-        int err;
 
-        if (pid == -1 && cpu != -1) {
-                /* Must be root to operate on a CPU event: */
-                if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
-                        return ERR_PTR(-EACCES);
-
-                if (cpu < 0 || cpu >= nr_cpumask_bits)
-                        return ERR_PTR(-EINVAL);
+        ctx = kzalloc(sizeof(struct perf_event_context), GFP_KERNEL);
+        if (!ctx)
+                return NULL;
 
-                /*
-                 * We could be clever and allow to attach a event to an
-                 * offline CPU and activate it when the CPU comes up, but
-                 * that's for later.
-                 */
-                if (!cpu_online(cpu))
-                        return ERR_PTR(-ENODEV);
+        __perf_event_init_context(ctx);
+        if (task) {
+                ctx->task = task;
+                get_task_struct(task);
+        }
+        ctx->pmu = pmu;
 
-                cpuctx = &per_cpu(perf_cpu_context, cpu);
-                ctx = &cpuctx->ctx;
-                get_ctx(ctx);
+        return ctx;
+}
 
-                return ctx;
-        }
+static struct task_struct *
+find_lively_task_by_vpid(pid_t vpid)
+{
+        struct task_struct *task;
+        int err;
 
         rcu_read_lock();
-        if (!pid)
+        if (!vpid)
                 task = current;
         else
-                task = find_task_by_vpid(pid);
+                task = find_task_by_vpid(vpid);
         if (task)
                 get_task_struct(task);
         rcu_read_unlock();
@@ -1834,36 +2086,78 @@ static struct perf_event_context *find_get_context(pid_t pid, int cpu)
         if (!ptrace_may_access(task, PTRACE_MODE_READ))
                 goto errout;
 
- retry:
-        ctx = perf_lock_task_context(task, &flags);
+        return task;
+errout:
+        put_task_struct(task);
+        return ERR_PTR(err);
+
+}
+
+static struct perf_event_context *
+find_get_context(struct pmu *pmu, struct task_struct *task, int cpu)
+{
+        struct perf_event_context *ctx;
+        struct perf_cpu_context *cpuctx;
+        unsigned long flags;
+        int ctxn, err;
+
+        if (!task && cpu != -1) {
+                /* Must be root to operate on a CPU event: */
+                if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
+                        return ERR_PTR(-EACCES);
+
+                if (cpu < 0 || cpu >= nr_cpumask_bits)
+                        return ERR_PTR(-EINVAL);
+
+                /*
+                 * We could be clever and allow to attach a event to an
+                 * offline CPU and activate it when the CPU comes up, but
+                 * that's for later.
+                 */
+                if (!cpu_online(cpu))
+                        return ERR_PTR(-ENODEV);
+
+                cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
+                ctx = &cpuctx->ctx;
+                get_ctx(ctx);
+
+                return ctx;
+        }
+
+        err = -EINVAL;
+        ctxn = pmu->task_ctx_nr;
+        if (ctxn < 0)
+                goto errout;
+
+retry:
+        ctx = perf_lock_task_context(task, ctxn, &flags);
         if (ctx) {
                 unclone_ctx(ctx);
                 raw_spin_unlock_irqrestore(&ctx->lock, flags);
         }
 
         if (!ctx) {
-                ctx = kzalloc(sizeof(struct perf_event_context), GFP_KERNEL);
+                ctx = alloc_perf_context(pmu, task);
                 err = -ENOMEM;
                 if (!ctx)
                         goto errout;
-                __perf_event_init_context(ctx, task);
+
                 get_ctx(ctx);
-                if (cmpxchg(&task->perf_event_ctxp, NULL, ctx)) {
+
+                if (cmpxchg(&task->perf_event_ctxp[ctxn], NULL, ctx)) {
                         /*
                          * We raced with some other task; use
                          * the context they set.
                          */
+                        put_task_struct(task);
                         kfree(ctx);
                         goto retry;
                 }
-                get_task_struct(task);
         }
 
-        put_task_struct(task);
         return ctx;
 
- errout:
-        put_task_struct(task);
+errout:
         return ERR_PTR(err);
 }
 
@@ -1880,21 +2174,23 @@ static void free_event_rcu(struct rcu_head *head)
         kfree(event);
 }
 
-static void perf_pending_sync(struct perf_event *event);
 static void perf_buffer_put(struct perf_buffer *buffer);
 
 static void free_event(struct perf_event *event)
 {
-        perf_pending_sync(event);
+        irq_work_sync(&event->pending);
 
         if (!event->parent) {
-                atomic_dec(&nr_events);
+                if (event->attach_state & PERF_ATTACH_TASK)
+                        jump_label_dec(&perf_task_events);
                 if (event->attr.mmap || event->attr.mmap_data)
                         atomic_dec(&nr_mmap_events);
                 if (event->attr.comm)
                         atomic_dec(&nr_comm_events);
                 if (event->attr.task)
                         atomic_dec(&nr_task_events);
+                if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
+                        put_callchain_buffers();
         }
 
         if (event->buffer) {
@@ -1905,7 +2201,9 @@ static void free_event(struct perf_event *event)
         if (event->destroy)
                 event->destroy(event);
 
-        put_ctx(event->ctx);
+        if (event->ctx)
+                put_ctx(event->ctx);
+
         call_rcu(&event->rcu_head, free_event_rcu);
 }
 
@@ -1939,11 +2237,6 @@ int perf_event_release_kernel(struct perf_event *event)
         raw_spin_unlock_irq(&ctx->lock);
         mutex_unlock(&ctx->mutex);
 
-        mutex_lock(&event->owner->perf_event_mutex);
-        list_del_init(&event->owner_entry);
-        mutex_unlock(&event->owner->perf_event_mutex);
-        put_task_struct(event->owner);
-
         free_event(event);
 
         return 0;
@@ -1956,9 +2249,43 @@ EXPORT_SYMBOL_GPL(perf_event_release_kernel);
 static int perf_release(struct inode *inode, struct file *file)
 {
         struct perf_event *event = file->private_data;
+        struct task_struct *owner;
 
         file->private_data = NULL;
 
+        rcu_read_lock();
+        owner = ACCESS_ONCE(event->owner);
+        /*
+         * Matches the smp_wmb() in perf_event_exit_task(). If we observe
+         * !owner it means the list deletion is complete and we can indeed
+         * free this event, otherwise we need to serialize on
+         * owner->perf_event_mutex.
+         */
+        smp_read_barrier_depends();
+        if (owner) {
+                /*
+                 * Since delayed_put_task_struct() also drops the last
+                 * task reference we can safely take a new reference
+                 * while holding the rcu_read_lock().
+                 */
+                get_task_struct(owner);
+        }
+        rcu_read_unlock();
+
+        if (owner) {
+                mutex_lock(&owner->perf_event_mutex);
+                /*
+                 * We have to re-check the event->owner field, if it is cleared
+                 * we raced with perf_event_exit_task(), acquiring the mutex
+                 * ensured they're done, and we can proceed with freeing the
+                 * event.
+                 */
+                if (event->owner)
+                        list_del_init(&event->owner_entry);
+                mutex_unlock(&owner->perf_event_mutex);
+                put_task_struct(owner);
+        }
+
         return perf_event_release_kernel(event);
 }
 
@@ -2184,15 +2511,13 @@ static void perf_event_for_each(struct perf_event *event,
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
 {
         struct perf_event_context *ctx = event->ctx;
-        unsigned long size;
         int ret = 0;
         u64 value;
 
         if (!event->attr.sample_period)
                 return -EINVAL;
 
-        size = copy_from_user(&value, arg, sizeof(value));
-        if (size != sizeof(value))
+        if (copy_from_user(&value, arg, sizeof(value)))
                 return -EFAULT;
 
         if (!value)
@@ -2326,6 +2651,9 @@ int perf_event_task_disable(void)
 
 static int perf_event_index(struct perf_event *event)
 {
+        if (event->hw.state & PERF_HES_STOPPED)
+                return 0;
+
         if (event->state != PERF_EVENT_STATE_ACTIVE)
                 return 0;
 
@@ -2829,16 +3157,7 @@ void perf_event_wakeup(struct perf_event *event)
         }
 }
 
-/*
- * Pending wakeups
- *
- * Handle the case where we need to wakeup up from NMI (or rq->lock) context.
- *
- * The NMI bit means we cannot possibly take locks. Therefore, maintain a
- * single linked list and use cmpxchg() to add entries lockless.
- */
-
-static void perf_pending_event(struct perf_pending_entry *entry)
+static void perf_pending_event(struct irq_work *entry)
 {
         struct perf_event *event = container_of(entry,
                         struct perf_event, pending);
@@ -2854,99 +3173,6 @@ static void perf_pending_event(struct perf_pending_entry *entry)
         }
 }
 
-#define PENDING_TAIL ((struct perf_pending_entry *)-1UL)
-
-static DEFINE_PER_CPU(struct perf_pending_entry *, perf_pending_head) = {
-        PENDING_TAIL,
-};
-
-static void perf_pending_queue(struct perf_pending_entry *entry,
-                               void (*func)(struct perf_pending_entry *))
-{
-        struct perf_pending_entry **head;
-
-        if (cmpxchg(&entry->next, NULL, PENDING_TAIL) != NULL)
-                return;
-
-        entry->func = func;
-
-        head = &get_cpu_var(perf_pending_head);
-
-        do {
-                entry->next = *head;
-        } while (cmpxchg(head, entry->next, entry) != entry->next);
-
-        set_perf_event_pending();
-
-        put_cpu_var(perf_pending_head);
-}
-
-static int __perf_pending_run(void)
-{
-        struct perf_pending_entry *list;
-        int nr = 0;
-
-        list = xchg(&__get_cpu_var(perf_pending_head), PENDING_TAIL);
-        while (list != PENDING_TAIL) {
-                void (*func)(struct perf_pending_entry *);
-                struct perf_pending_entry *entry = list;
-
-                list = list->next;
-
-                func = entry->func;
-                entry->next = NULL;
-                /*
-                 * Ensure we observe the unqueue before we issue the wakeup,
-                 * so that we won't be waiting forever.
-                 * -- see perf_not_pending().
-                 */
-                smp_wmb();
-
-                func(entry);
-                nr++;
-        }
-
-        return nr;
-}
-
-static inline int perf_not_pending(struct perf_event *event)
-{
-        /*
-         * If we flush on whatever cpu we run, there is a chance we don't
-         * need to wait.
-         */
-        get_cpu();
-        __perf_pending_run();
-        put_cpu();
-
-        /*
-         * Ensure we see the proper queue state before going to sleep
-         * so that we do not miss the wakeup. -- see perf_pending_handle()
-         */
-        smp_rmb();
-        return event->pending.next == NULL;
-}
-
-static void perf_pending_sync(struct perf_event *event)
-{
-        wait_event(event->waitq, perf_not_pending(event));
-}
-
-void perf_event_do_pending(void)
-{
-        __perf_pending_run();
-}
-
-/*
- * Callchain support -- arch specific
- */
-
-__weak struct perf_callchain_entry *perf_callchain(struct pt_regs *regs)
-{
-        return NULL;
-}
-
-
 /*
  * We assume there is only KVM supporting the callbacks.
  * Later on, we might change it to a list if there is
@@ -2996,8 +3222,7 @@ static void perf_output_wakeup(struct perf_output_handle *handle)
 
         if (handle->nmi) {
                 handle->event->pending_wakeup = 1;
-                perf_pending_queue(&handle->event->pending,
-                                   perf_pending_event);
+                irq_work_queue(&handle->event->pending);
         } else
                 perf_event_wakeup(handle->event);
 }
@@ -3053,7 +3278,7 @@ again:
         if (handle->wakeup != local_read(&buffer->wakeup))
                 perf_output_wakeup(handle);
 
- out:
+out:
         preempt_enable();
 }
 
@@ -3205,7 +3430,8 @@ static u32 perf_event_tid(struct perf_event *event, struct task_struct *p)
 }
 
 static void perf_output_read_one(struct perf_output_handle *handle,
-                                 struct perf_event *event)
+                                 struct perf_event *event,
+                                 u64 enabled, u64 running)
 {
         u64 read_format = event->attr.read_format;
         u64 values[4];
@@ -3213,11 +3439,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
 
         values[n++] = perf_event_count(event);
         if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
-                values[n++] = event->total_time_enabled +
+                values[n++] = enabled +
                         atomic64_read(&event->child_total_time_enabled);
         }
         if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
-                values[n++] = event->total_time_running +
+                values[n++] = running +
                         atomic64_read(&event->child_total_time_running);
         }
         if (read_format & PERF_FORMAT_ID)
@@ -3230,7 +3456,8 @@ static void perf_output_read_one(struct perf_output_handle *handle,
  * XXX PERF_FORMAT_GROUP vs inherited events seems difficult.
  */
 static void perf_output_read_group(struct perf_output_handle *handle,
-                            struct perf_event *event)
+                            struct perf_event *event,
+                            u64 enabled, u64 running)
 {
         struct perf_event *leader = event->group_leader, *sub;
         u64 read_format = event->attr.read_format;
@@ -3240,10 +3467,10 @@ static void perf_output_read_group(struct perf_output_handle *handle,
         values[n++] = 1 + leader->nr_siblings;
 
         if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
-                values[n++] = leader->total_time_enabled;
+                values[n++] = enabled;
 
         if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
-                values[n++] = leader->total_time_running;
+                values[n++] = running;
 
         if (leader != event)
                 leader->pmu->read(leader);
@@ -3268,13 +3495,35 @@ static void perf_output_read_group(struct perf_output_handle *handle,
         }
 }
 
+#define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
+                                 PERF_FORMAT_TOTAL_TIME_RUNNING)
+
 static void perf_output_read(struct perf_output_handle *handle,
                              struct perf_event *event)
 {
+        u64 enabled = 0, running = 0, now, ctx_time;
+        u64 read_format = event->attr.read_format;
+
+        /*
+         * compute total_time_enabled, total_time_running
+         * based on snapshot values taken when the event
+         * was last scheduled in.
+         *
+         * we cannot simply called update_context_time()
+         * because of locking issue as we are called in
+         * NMI context
+         */
+        if (read_format & PERF_FORMAT_TOTAL_TIMES) {
+                now = perf_clock();
+                ctx_time = event->shadow_ctx_time + now;
+                enabled = ctx_time - event->tstamp_enabled;
+                running = ctx_time - event->tstamp_running;
+        }
+
         if (event->attr.read_format & PERF_FORMAT_GROUP)
-                perf_output_read_group(handle, event);
+                perf_output_read_group(handle, event, enabled, running);
         else
-                perf_output_read_one(handle, event);
+                perf_output_read_one(handle, event, enabled, running);
 }
 
 void perf_output_sample(struct perf_output_handle *handle,
@@ -3441,14 +3690,20 @@ static void perf_event_output(struct perf_event *event, int nmi,
         struct perf_output_handle handle;
         struct perf_event_header header;
 
+        /* protect the callchain buffers */
+        rcu_read_lock();
+
         perf_prepare_sample(&header, data, event, regs);
 
         if (perf_output_begin(&handle, event, header.size, nmi, 1))
-                return;
+                goto exit;
 
         perf_output_sample(&handle, &header, data, event);
 
         perf_output_end(&handle);
+
+exit:
+        rcu_read_unlock();
 }
 
 /*
@@ -3562,16 +3817,29 @@ static void perf_event_task_ctx(struct perf_event_context *ctx,
 static void perf_event_task_event(struct perf_task_event *task_event)
 {
         struct perf_cpu_context *cpuctx;
-        struct perf_event_context *ctx = task_event->task_ctx;
+        struct perf_event_context *ctx;
+        struct pmu *pmu;
+        int ctxn;
 
         rcu_read_lock();
-        cpuctx = &get_cpu_var(perf_cpu_context);
-        perf_event_task_ctx(&cpuctx->ctx, task_event);
-        if (!ctx)
-                ctx = rcu_dereference(current->perf_event_ctxp);
-        if (ctx)
-                perf_event_task_ctx(ctx, task_event);
-        put_cpu_var(perf_cpu_context);
+        list_for_each_entry_rcu(pmu, &pmus, entry) {
+                cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+                if (cpuctx->active_pmu != pmu)
+                        goto next;
+                perf_event_task_ctx(&cpuctx->ctx, task_event);
+
+                ctx = task_event->task_ctx;
+                if (!ctx) {
+                        ctxn = pmu->task_ctx_nr;
+                        if (ctxn < 0)
+                                goto next;
+                        ctx = rcu_dereference(current->perf_event_ctxp[ctxn]);
+                }
+                if (ctx)
+                        perf_event_task_ctx(ctx, task_event);
+next:
+                put_cpu_ptr(pmu->pmu_cpu_context);
+        }
         rcu_read_unlock();
 }
 
@@ -3676,8 +3944,10 @@ static void perf_event_comm_event(struct perf_comm_event *comm_event)
 {
         struct perf_cpu_context *cpuctx;
         struct perf_event_context *ctx;
-        unsigned int size;
         char comm[TASK_COMM_LEN];
+        unsigned int size;
+        struct pmu *pmu;
+        int ctxn;
 
         memset(comm, 0, sizeof(comm));
         strlcpy(comm, comm_event->task->comm, sizeof(comm));
@@ -3689,21 +3959,38 @@ static void perf_event_comm_event(struct perf_comm_event *comm_event)
         comm_event->event_id.header.size = sizeof(comm_event->event_id) + size;
 
         rcu_read_lock();
-        cpuctx = &get_cpu_var(perf_cpu_context);
-        perf_event_comm_ctx(&cpuctx->ctx, comm_event);
-        ctx = rcu_dereference(current->perf_event_ctxp);
-        if (ctx)
-                perf_event_comm_ctx(ctx, comm_event);
-        put_cpu_var(perf_cpu_context);
+        list_for_each_entry_rcu(pmu, &pmus, entry) {
+                cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+                if (cpuctx->active_pmu != pmu)
+                        goto next;
+                perf_event_comm_ctx(&cpuctx->ctx, comm_event);
+
+                ctxn = pmu->task_ctx_nr;
+                if (ctxn < 0)
+                        goto next;
+
+                ctx = rcu_dereference(current->perf_event_ctxp[ctxn]);
+                if (ctx)
+                        perf_event_comm_ctx(ctx, comm_event);
+next:
+                put_cpu_ptr(pmu->pmu_cpu_context);
+        }
         rcu_read_unlock();
 }
 
 void perf_event_comm(struct task_struct *task)
 {
         struct perf_comm_event comm_event;
+        struct perf_event_context *ctx;
+        int ctxn;
+
+        for_each_task_context_nr(ctxn) {
+                ctx = task->perf_event_ctxp[ctxn];
+                if (!ctx)
+                        continue;
 
-        if (task->perf_event_ctxp)
-                perf_event_enable_on_exec(task);
+                perf_event_enable_on_exec(ctx);
+        }
 
         if (!atomic_read(&nr_comm_events))
                 return;
@@ -3805,6 +4092,8 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
         char tmp[16];
         char *buf = NULL;
         const char *name;
+        struct pmu *pmu;
+        int ctxn;
 
         memset(tmp, 0, sizeof(tmp));
 
@@ -3857,12 +4146,25 @@ got_name:
         mmap_event->event_id.header.size = sizeof(mmap_event->event_id) + size;
 
         rcu_read_lock();
-        cpuctx = &get_cpu_var(perf_cpu_context);
-        perf_event_mmap_ctx(&cpuctx->ctx, mmap_event, vma->vm_flags & VM_EXEC);
-        ctx = rcu_dereference(current->perf_event_ctxp);
-        if (ctx)
-                perf_event_mmap_ctx(ctx, mmap_event, vma->vm_flags & VM_EXEC);
-        put_cpu_var(perf_cpu_context);
+        list_for_each_entry_rcu(pmu, &pmus, entry) {
+                cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+                if (cpuctx->active_pmu != pmu)
+                        goto next;
+                perf_event_mmap_ctx(&cpuctx->ctx, mmap_event,
+                                        vma->vm_flags & VM_EXEC);
+
+                ctxn = pmu->task_ctx_nr;
+                if (ctxn < 0)
+                        goto next;
+
+                ctx = rcu_dereference(current->perf_event_ctxp[ctxn]);
+                if (ctx) {
+                        perf_event_mmap_ctx(ctx, mmap_event,
+                                        vma->vm_flags & VM_EXEC);
+                }
+next:
+                put_cpu_ptr(pmu->pmu_cpu_context);
+        }
         rcu_read_unlock();
 
         kfree(buf);
@@ -3944,8 +4246,6 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
         struct hw_perf_event *hwc = &event->hw;
         int ret = 0;
 
-        throttle = (throttle && event->pmu->unthrottle != NULL);
-
         if (!throttle) {
                 hwc->interrupts++;
         } else {
@@ -3988,8 +4288,7 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
                 event->pending_kill = POLL_HUP;
                 if (nmi) {
                         event->pending_disable = 1;
-                        perf_pending_queue(&event->pending,
-                                           perf_pending_event);
+                        irq_work_queue(&event->pending);
                 } else
                         perf_event_disable(event);
         }
@@ -4013,6 +4312,17 @@ int perf_event_overflow(struct perf_event *event, int nmi,
  * Generic software event infrastructure
  */
 
+struct swevent_htable {
+        struct swevent_hlist            *swevent_hlist;
+        struct mutex                    hlist_mutex;
+        int                             hlist_refcount;
+
+        /* Recursion avoidance in each contexts */
+        int                             recursion[PERF_NR_CONTEXTS];
+};
+
+static DEFINE_PER_CPU(struct swevent_htable, swevent_htable);
+
 /*
  * We directly increment event->count and keep a second value in
  * event->hw.period_left to count intervals. This period event
@@ -4070,7 +4380,7 @@ static void perf_swevent_overflow(struct perf_event *event, u64 overflow,
         }
 }
 
-static void perf_swevent_add(struct perf_event *event, u64 nr,
+static void perf_swevent_event(struct perf_event *event, u64 nr,
                                int nmi, struct perf_sample_data *data,
                                struct pt_regs *regs)
 {
@@ -4096,6 +4406,9 @@ static void perf_swevent_add(struct perf_event *event, u64 nr,
 static int perf_exclude_event(struct perf_event *event,
                               struct pt_regs *regs)
 {
+        if (event->hw.state & PERF_HES_STOPPED)
+                return 0;
+
         if (regs) {
                 if (event->attr.exclude_user && user_mode(regs))
                         return 1;
@@ -4142,11 +4455,11 @@ __find_swevent_head(struct swevent_hlist *hlist, u64 type, u32 event_id)
 
 /* For the read side: events when they trigger */
 static inline struct hlist_head *
-find_swevent_head_rcu(struct perf_cpu_context *ctx, u64 type, u32 event_id)
+find_swevent_head_rcu(struct swevent_htable *swhash, u64 type, u32 event_id)
 {
         struct swevent_hlist *hlist;
 
-        hlist = rcu_dereference(ctx->swevent_hlist);
+        hlist = rcu_dereference(swhash->swevent_hlist);
         if (!hlist)
                 return NULL;
 
@@ -4155,7 +4468,7 @@ find_swevent_head_rcu(struct perf_cpu_context *ctx, u64 type, u32 event_id)
 
 /* For the event head insertion and removal in the hlist */
 static inline struct hlist_head *
-find_swevent_head(struct perf_cpu_context *ctx, struct perf_event *event)
+find_swevent_head(struct swevent_htable *swhash, struct perf_event *event)
 {
         struct swevent_hlist *hlist;
         u32 event_id = event->attr.config;
@@ -4166,7 +4479,7 @@ find_swevent_head(struct perf_cpu_context *ctx, struct perf_event *event)
          * and release. Which makes the protected version suitable here.
          * The context lock guarantees that.
          */
-        hlist = rcu_dereference_protected(ctx->swevent_hlist,
+        hlist = rcu_dereference_protected(swhash->swevent_hlist,
                                           lockdep_is_held(&event->ctx->lock));
         if (!hlist)
                 return NULL;
@@ -4179,23 +4492,19 @@ static void do_perf_sw_event(enum perf_type_id type, u32 event_id,
                                     struct perf_sample_data *data,
                                     struct pt_regs *regs)
 {
-        struct perf_cpu_context *cpuctx;
+        struct swevent_htable *swhash = &__get_cpu_var(swevent_htable);
         struct perf_event *event;
         struct hlist_node *node;
         struct hlist_head *head;
 
-        cpuctx = &__get_cpu_var(perf_cpu_context);
-
         rcu_read_lock();
-
-        head = find_swevent_head_rcu(cpuctx, type, event_id);
-
+        head = find_swevent_head_rcu(swhash, type, event_id);
         if (!head)
                 goto end;
 
         hlist_for_each_entry_rcu(event, node, head, hlist_entry) {
                 if (perf_swevent_match(event, type, event_id, data, regs))
-                        perf_swevent_add(event, nr, nmi, data, regs);
+                        perf_swevent_event(event, nr, nmi, data, regs);
         }
 end:
         rcu_read_unlock();
@@ -4203,33 +4512,17 @@ end:
 
 int perf_swevent_get_recursion_context(void)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
-        int rctx;
-
-        if (in_nmi())
-                rctx = 3;
-        else if (in_irq())
-                rctx = 2;
-        else if (in_softirq())
-                rctx = 1;
-        else
-                rctx = 0;
-
-        if (cpuctx->recursion[rctx])
-                return -1;
+        struct swevent_htable *swhash = &__get_cpu_var(swevent_htable);
 
-        cpuctx->recursion[rctx]++;
-        barrier();
-
-        return rctx;
+        return get_recursion_context(swhash->recursion);
 }
 EXPORT_SYMBOL_GPL(perf_swevent_get_recursion_context);
 
 void inline perf_swevent_put_recursion_context(int rctx)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
-        barrier();
-        cpuctx->recursion[rctx]--;
+        struct swevent_htable *swhash = &__get_cpu_var(swevent_htable);
+
+        put_recursion_context(swhash->recursion, rctx);
 }
 
 void __perf_sw_event(u32 event_id, u64 nr, int nmi,
@@ -4255,20 +4548,20 @@ static void perf_swevent_read(struct perf_event *event)
 {
 }
 
-static int perf_swevent_enable(struct perf_event *event)
+static int perf_swevent_add(struct perf_event *event, int flags)
 {
+        struct swevent_htable *swhash = &__get_cpu_var(swevent_htable);
         struct hw_perf_event *hwc = &event->hw;
-        struct perf_cpu_context *cpuctx;
         struct hlist_head *head;
 
-        cpuctx = &__get_cpu_var(perf_cpu_context);
-
         if (hwc->sample_period) {
                 hwc->last_period = hwc->sample_period;
                 perf_swevent_set_period(event);
         }
 
-        head = find_swevent_head(cpuctx, event);
+        hwc->state = !(flags & PERF_EF_START);
+
+        head = find_swevent_head(swhash, event);
         if (WARN_ON_ONCE(!head))
                 return -EINVAL;
 
@@ -4277,202 +4570,27 @@ static int perf_swevent_enable(struct perf_event *event)
         return 0;
 }
 
-static void perf_swevent_disable(struct perf_event *event)
+static void perf_swevent_del(struct perf_event *event, int flags)
 {
         hlist_del_rcu(&event->hlist_entry);
 }
 
-static void perf_swevent_void(struct perf_event *event)
+static void perf_swevent_start(struct perf_event *event, int flags)
 {
+        event->hw.state = 0;
 }
 
-static int perf_swevent_int(struct perf_event *event)
+static void perf_swevent_stop(struct perf_event *event, int flags)
 {
-        return 0;
+        event->hw.state = PERF_HES_STOPPED;
 }
 
-static const struct pmu perf_ops_generic = {
-        .enable         = perf_swevent_enable,
-        .disable        = perf_swevent_disable,
-        .start          = perf_swevent_int,
-        .stop           = perf_swevent_void,
-        .read           = perf_swevent_read,
-        .unthrottle     = perf_swevent_void, /* hwc->interrupts already reset */
-};
-
-/*
- * hrtimer based swevent callback
- */
-
-static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
-{
-        enum hrtimer_restart ret = HRTIMER_RESTART;
-        struct perf_sample_data data;
-        struct pt_regs *regs;
-        struct perf_event *event;
-        u64 period;
-
-        event = container_of(hrtimer, struct perf_event, hw.hrtimer);
-        event->pmu->read(event);
-
-        perf_sample_data_init(&data, 0);
-        data.period = event->hw.last_period;
-        regs = get_irq_regs();
-
-        if (regs && !perf_exclude_event(event, regs)) {
-                if (!(event->attr.exclude_idle && current->pid == 0))
-                        if (perf_event_overflow(event, 0, &data, regs))
-                                ret = HRTIMER_NORESTART;
-        }
-
-        period = max_t(u64, 10000, event->hw.sample_period);
-        hrtimer_forward_now(hrtimer, ns_to_ktime(period));
-
-        return ret;
-}
-
-static void perf_swevent_start_hrtimer(struct perf_event *event)
-{
-        struct hw_perf_event *hwc = &event->hw;
-
-        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        hwc->hrtimer.function = perf_swevent_hrtimer;
-        if (hwc->sample_period) {
-                u64 period;
-
-                if (hwc->remaining) {
-                        if (hwc->remaining < 0)
-                                period = 10000;
-                        else
-                                period = hwc->remaining;
-                        hwc->remaining = 0;
-                } else {
-                        period = max_t(u64, 10000, hwc->sample_period);
-                }
-                __hrtimer_start_range_ns(&hwc->hrtimer,
-                                ns_to_ktime(period), 0,
-                                HRTIMER_MODE_REL, 0);
-        }
-}
-
-static void perf_swevent_cancel_hrtimer(struct perf_event *event)
-{
-        struct hw_perf_event *hwc = &event->hw;
-
-        if (hwc->sample_period) {
-                ktime_t remaining = hrtimer_get_remaining(&hwc->hrtimer);
-                hwc->remaining = ktime_to_ns(remaining);
-
-                hrtimer_cancel(&hwc->hrtimer);
-        }
-}
-
-/*
- * Software event: cpu wall time clock
- */
-
-static void cpu_clock_perf_event_update(struct perf_event *event)
-{
-        int cpu = raw_smp_processor_id();
-        s64 prev;
-        u64 now;
-
-        now = cpu_clock(cpu);
-        prev = local64_xchg(&event->hw.prev_count, now);
-        local64_add(now - prev, &event->count);
-}
-
-static int cpu_clock_perf_event_enable(struct perf_event *event)
-{
-        struct hw_perf_event *hwc = &event->hw;
-        int cpu = raw_smp_processor_id();
-
-        local64_set(&hwc->prev_count, cpu_clock(cpu));
-        perf_swevent_start_hrtimer(event);
-
-        return 0;
-}
-
-static void cpu_clock_perf_event_disable(struct perf_event *event)
-{
-        perf_swevent_cancel_hrtimer(event);
-        cpu_clock_perf_event_update(event);
-}
-
-static void cpu_clock_perf_event_read(struct perf_event *event)
-{
-        cpu_clock_perf_event_update(event);
-}
-
-static const struct pmu perf_ops_cpu_clock = {
-        .enable         = cpu_clock_perf_event_enable,
-        .disable        = cpu_clock_perf_event_disable,
-        .read           = cpu_clock_perf_event_read,
-};
-
-/*
- * Software event: task time clock
- */
-
-static void task_clock_perf_event_update(struct perf_event *event, u64 now)
-{
-        u64 prev;
-        s64 delta;
-
-        prev = local64_xchg(&event->hw.prev_count, now);
-        delta = now - prev;
-        local64_add(delta, &event->count);
-}
-
-static int task_clock_perf_event_enable(struct perf_event *event)
-{
-        struct hw_perf_event *hwc = &event->hw;
-        u64 now;
-
-        now = event->ctx->time;
-
-        local64_set(&hwc->prev_count, now);
-
-        perf_swevent_start_hrtimer(event);
-
-        return 0;
-}
-
-static void task_clock_perf_event_disable(struct perf_event *event)
-{
-        perf_swevent_cancel_hrtimer(event);
-        task_clock_perf_event_update(event, event->ctx->time);
-
-}
-
-static void task_clock_perf_event_read(struct perf_event *event)
-{
-        u64 time;
-
-        if (!in_nmi()) {
-                update_context_time(event->ctx);
-                time = event->ctx->time;
-        } else {
-                u64 now = perf_clock();
-                u64 delta = now - event->ctx->timestamp;
-                time = event->ctx->time + delta;
-        }
-
-        task_clock_perf_event_update(event, time);
-}
-
-static const struct pmu perf_ops_task_clock = {
-        .enable         = task_clock_perf_event_enable,
-        .disable        = task_clock_perf_event_disable,
-        .read           = task_clock_perf_event_read,
-};
-
 /* Deref the hlist from the update side */
 static inline struct swevent_hlist *
-swevent_hlist_deref(struct perf_cpu_context *cpuctx)
+swevent_hlist_deref(struct swevent_htable *swhash)
 {
-        return rcu_dereference_protected(cpuctx->swevent_hlist,
-                                         lockdep_is_held(&cpuctx->hlist_mutex));
+        return rcu_dereference_protected(swhash->swevent_hlist,
+                                         lockdep_is_held(&swhash->hlist_mutex));
 }
 
 static void swevent_hlist_release_rcu(struct rcu_head *rcu_head)
@@ -4483,27 +4601,27 @@ static void swevent_hlist_release_rcu(struct rcu_head *rcu_head)
         kfree(hlist);
 }
 
-static void swevent_hlist_release(struct perf_cpu_context *cpuctx)
+static void swevent_hlist_release(struct swevent_htable *swhash)
 {
-        struct swevent_hlist *hlist = swevent_hlist_deref(cpuctx);
+        struct swevent_hlist *hlist = swevent_hlist_deref(swhash);
 
         if (!hlist)
                 return;
 
-        rcu_assign_pointer(cpuctx->swevent_hlist, NULL);
+        rcu_assign_pointer(swhash->swevent_hlist, NULL);
         call_rcu(&hlist->rcu_head, swevent_hlist_release_rcu);
 }
 
 static void swevent_hlist_put_cpu(struct perf_event *event, int cpu)
 {
-        struct perf_cpu_context *cpuctx = &per_cpu(perf_cpu_context, cpu);
+        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
-        mutex_lock(&cpuctx->hlist_mutex);
+        mutex_lock(&swhash->hlist_mutex);
 
-        if (!--cpuctx->hlist_refcount)
-                swevent_hlist_release(cpuctx);
+        if (!--swhash->hlist_refcount)
+                swevent_hlist_release(swhash);
 
-        mutex_unlock(&cpuctx->hlist_mutex);
+        mutex_unlock(&swhash->hlist_mutex);
 }
 
 static void swevent_hlist_put(struct perf_event *event)
@@ -4521,12 +4639,12 @@ static void swevent_hlist_put(struct perf_event *event)
 
 static int swevent_hlist_get_cpu(struct perf_event *event, int cpu)
 {
-        struct perf_cpu_context *cpuctx = &per_cpu(perf_cpu_context, cpu);
+        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
         int err = 0;
 
-        mutex_lock(&cpuctx->hlist_mutex);
+        mutex_lock(&swhash->hlist_mutex);
 
-        if (!swevent_hlist_deref(cpuctx) && cpu_online(cpu)) {
+        if (!swevent_hlist_deref(swhash) && cpu_online(cpu)) {
                 struct swevent_hlist *hlist;
 
                 hlist = kzalloc(sizeof(*hlist), GFP_KERNEL);
@@ -4534,11 +4652,11 @@ static int swevent_hlist_get_cpu(struct perf_event *event, int cpu)
                         err = -ENOMEM;
                         goto exit;
                 }
-                rcu_assign_pointer(cpuctx->swevent_hlist, hlist);
+                rcu_assign_pointer(swhash->swevent_hlist, hlist);
         }
-        cpuctx->hlist_refcount++;
- exit:
-        mutex_unlock(&cpuctx->hlist_mutex);
+        swhash->hlist_refcount++;
+exit:
+        mutex_unlock(&swhash->hlist_mutex);
 
         return err;
 }
@@ -4562,7 +4680,7 @@ static int swevent_hlist_get(struct perf_event *event)
         put_online_cpus();
 
         return 0;
- fail:
+fail:
         for_each_possible_cpu(cpu) {
                 if (cpu == failed_cpu)
                         break;
@@ -4573,17 +4691,64 @@ static int swevent_hlist_get(struct perf_event *event)
         return err;
 }
 
-#ifdef CONFIG_EVENT_TRACING
+atomic_t perf_swevent_enabled[PERF_COUNT_SW_MAX];
 
-static const struct pmu perf_ops_tracepoint = {
-        .enable         = perf_trace_enable,
-        .disable        = perf_trace_disable,
-        .start          = perf_swevent_int,
-        .stop           = perf_swevent_void,
+static void sw_perf_event_destroy(struct perf_event *event)
+{
+        u64 event_id = event->attr.config;
+
+        WARN_ON(event->parent);
+
+        jump_label_dec(&perf_swevent_enabled[event_id]);
+        swevent_hlist_put(event);
+}
+
+static int perf_swevent_init(struct perf_event *event)
+{
+        int event_id = event->attr.config;
+
+        if (event->attr.type != PERF_TYPE_SOFTWARE)
+                return -ENOENT;
+
+        switch (event_id) {
+        case PERF_COUNT_SW_CPU_CLOCK:
+        case PERF_COUNT_SW_TASK_CLOCK:
+                return -ENOENT;
+
+        default:
+                break;
+        }
+
+        if (event_id >= PERF_COUNT_SW_MAX)
+                return -ENOENT;
+
+        if (!event->parent) {
+                int err;
+
+                err = swevent_hlist_get(event);
+                if (err)
+                        return err;
+
+                jump_label_inc(&perf_swevent_enabled[event_id]);
+                event->destroy = sw_perf_event_destroy;
+        }
+
+        return 0;
+}
+
+static struct pmu perf_swevent = {
+        .task_ctx_nr    = perf_sw_context,
+
+        .event_init     = perf_swevent_init,
+        .add            = perf_swevent_add,
+        .del            = perf_swevent_del,
+        .start          = perf_swevent_start,
+        .stop           = perf_swevent_stop,
         .read           = perf_swevent_read,
-        .unthrottle     = perf_swevent_void,
 };
 
+#ifdef CONFIG_EVENT_TRACING
+
 static int perf_tp_filter_match(struct perf_event *event,
                                 struct perf_sample_data *data)
 {
@@ -4627,7 +4792,7 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size,
 
         hlist_for_each_entry_rcu(event, node, head, hlist_entry) {
                 if (perf_tp_event_match(event, &data, regs))
-                        perf_swevent_add(event, count, 1, &data, regs);
+                        perf_swevent_event(event, count, 1, &data, regs);
         }
 
         perf_swevent_put_recursion_context(rctx);
@@ -4639,10 +4804,13 @@ static void tp_perf_event_destroy(struct perf_event *event)
         perf_trace_destroy(event);
 }
 
-static const struct pmu *tp_perf_event_init(struct perf_event *event)
+static int perf_tp_event_init(struct perf_event *event)
 {
         int err;
 
+        if (event->attr.type != PERF_TYPE_TRACEPOINT)
+                return -ENOENT;
+
         /*
          * Raw tracepoint data is a severe data leak, only allow root to
          * have these.
@@ -4650,15 +4818,31 @@ static const struct pmu *tp_perf_event_init(struct perf_event *event)
         if ((event->attr.sample_type & PERF_SAMPLE_RAW) &&
                         perf_paranoid_tracepoint_raw() &&
                         !capable(CAP_SYS_ADMIN))
-                return ERR_PTR(-EPERM);
+                return -EPERM;
 
         err = perf_trace_init(event);
         if (err)
-                return NULL;
+                return err;
 
         event->destroy = tp_perf_event_destroy;
 
-        return &perf_ops_tracepoint;
+        return 0;
+}
+
+static struct pmu perf_tracepoint = {
+        .task_ctx_nr    = perf_sw_context,
+
+        .event_init     = perf_tp_event_init,
+        .add            = perf_trace_add,
+        .del            = perf_trace_del,
+        .start          = perf_swevent_start,
+        .stop           = perf_swevent_stop,
+        .read           = perf_swevent_read,
+};
+
+static inline void perf_tp_register(void)
+{
+        perf_pmu_register(&perf_tracepoint);
 }
 
 static int perf_event_set_filter(struct perf_event *event, void __user *arg)
@@ -4686,9 +4870,8 @@ static void perf_event_free_filter(struct perf_event *event)
 
 #else
 
-static const struct pmu *tp_perf_event_init(struct perf_event *event)
+static inline void perf_tp_register(void)
 {
-        return NULL;
 }
 
 static int perf_event_set_filter(struct perf_event *event, void __user *arg)
@@ -4703,105 +4886,406 @@ static void perf_event_free_filter(struct perf_event *event)
 #endif /* CONFIG_EVENT_TRACING */
 
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
-static void bp_perf_event_destroy(struct perf_event *event)
+void perf_bp_event(struct perf_event *bp, void *data)
 {
-        release_bp_slot(event);
+        struct perf_sample_data sample;
+        struct pt_regs *regs = data;
+
+        perf_sample_data_init(&sample, bp->attr.bp_addr);
+
+        if (!bp->hw.state && !perf_exclude_event(bp, regs))
+                perf_swevent_event(bp, 1, 1, &sample, regs);
 }
+#endif
 
-static const struct pmu *bp_perf_event_init(struct perf_event *bp)
+/*
+ * hrtimer based swevent callback
+ */
+
+static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
 {
-        int err;
+        enum hrtimer_restart ret = HRTIMER_RESTART;
+        struct perf_sample_data data;
+        struct pt_regs *regs;
+        struct perf_event *event;
+        u64 period;
 
-        err = register_perf_hw_breakpoint(bp);
-        if (err)
-                return ERR_PTR(err);
+        event = container_of(hrtimer, struct perf_event, hw.hrtimer);
+        event->pmu->read(event);
 
-        bp->destroy = bp_perf_event_destroy;
+        perf_sample_data_init(&data, 0);
+        data.period = event->hw.last_period;
+        regs = get_irq_regs();
+
+        if (regs && !perf_exclude_event(event, regs)) {
+                if (!(event->attr.exclude_idle && current->pid == 0))
+                        if (perf_event_overflow(event, 0, &data, regs))
+                                ret = HRTIMER_NORESTART;
+        }
+
+        period = max_t(u64, 10000, event->hw.sample_period);
+        hrtimer_forward_now(hrtimer, ns_to_ktime(period));
 
-        return &perf_ops_bp;
+        return ret;
 }
 
-void perf_bp_event(struct perf_event *bp, void *data)
+static void perf_swevent_start_hrtimer(struct perf_event *event)
 {
-        struct perf_sample_data sample;
-        struct pt_regs *regs = data;
+        struct hw_perf_event *hwc = &event->hw;
 
-        perf_sample_data_init(&sample, bp->attr.bp_addr);
+        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hwc->hrtimer.function = perf_swevent_hrtimer;
+        if (hwc->sample_period) {
+                s64 period = local64_read(&hwc->period_left);
 
-        if (!perf_exclude_event(bp, regs))
-                perf_swevent_add(bp, 1, 1, &sample, regs);
+                if (period) {
+                        if (period < 0)
+                                period = 10000;
+
+                        local64_set(&hwc->period_left, 0);
+                } else {
+                        period = max_t(u64, 10000, hwc->sample_period);
+                }
+                __hrtimer_start_range_ns(&hwc->hrtimer,
+                                ns_to_ktime(period), 0,
+                                HRTIMER_MODE_REL_PINNED, 0);
+        }
 }
-#else
-static const struct pmu *bp_perf_event_init(struct perf_event *bp)
+
+static void perf_swevent_cancel_hrtimer(struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+
+        if (hwc->sample_period) {
+                ktime_t remaining = hrtimer_get_remaining(&hwc->hrtimer);
+                local64_set(&hwc->period_left, ktime_to_ns(remaining));
+
+                hrtimer_cancel(&hwc->hrtimer);
+        }
+}
+
+/*
+ * Software event: cpu wall time clock
+ */
+
+static void cpu_clock_event_update(struct perf_event *event)
+{
+        s64 prev;
+        u64 now;
+
+        now = local_clock();
+        prev = local64_xchg(&event->hw.prev_count, now);
+        local64_add(now - prev, &event->count);
+}
+
+static void cpu_clock_event_start(struct perf_event *event, int flags)
+{
+        local64_set(&event->hw.prev_count, local_clock());
+        perf_swevent_start_hrtimer(event);
+}
+
+static void cpu_clock_event_stop(struct perf_event *event, int flags)
+{
+        perf_swevent_cancel_hrtimer(event);
+        cpu_clock_event_update(event);
+}
+
+static int cpu_clock_event_add(struct perf_event *event, int flags)
+{
+        if (flags & PERF_EF_START)
+                cpu_clock_event_start(event, flags);
+
+        return 0;
+}
+
+static void cpu_clock_event_del(struct perf_event *event, int flags)
+{
+        cpu_clock_event_stop(event, flags);
+}
+
+static void cpu_clock_event_read(struct perf_event *event)
+{
+        cpu_clock_event_update(event);
+}
+
+static int cpu_clock_event_init(struct perf_event *event)
+{
+        if (event->attr.type != PERF_TYPE_SOFTWARE)
+                return -ENOENT;
+
+        if (event->attr.config != PERF_COUNT_SW_CPU_CLOCK)
+                return -ENOENT;
+
+        return 0;
+}
+
+static struct pmu perf_cpu_clock = {
+        .task_ctx_nr    = perf_sw_context,
+
+        .event_init     = cpu_clock_event_init,
+        .add            = cpu_clock_event_add,
+        .del            = cpu_clock_event_del,
+        .start          = cpu_clock_event_start,
+        .stop           = cpu_clock_event_stop,
+        .read           = cpu_clock_event_read,
+};
+
+/*
+ * Software event: task time clock
+ */
+
+static void task_clock_event_update(struct perf_event *event, u64 now)
+{
+        u64 prev;
+        s64 delta;
+
+        prev = local64_xchg(&event->hw.prev_count, now);
+        delta = now - prev;
+        local64_add(delta, &event->count);
+}
+
+static void task_clock_event_start(struct perf_event *event, int flags)
+{
+        local64_set(&event->hw.prev_count, event->ctx->time);
+        perf_swevent_start_hrtimer(event);
+}
+
+static void task_clock_event_stop(struct perf_event *event, int flags)
+{
+        perf_swevent_cancel_hrtimer(event);
+        task_clock_event_update(event, event->ctx->time);
+}
+
+static int task_clock_event_add(struct perf_event *event, int flags)
+{
+        if (flags & PERF_EF_START)
+                task_clock_event_start(event, flags);
+
+        return 0;
+}
+
+static void task_clock_event_del(struct perf_event *event, int flags)
+{
+        task_clock_event_stop(event, PERF_EF_UPDATE);
+}
+
+static void task_clock_event_read(struct perf_event *event)
+{
+        u64 time;
+
+        if (!in_nmi()) {
+                update_context_time(event->ctx);
+                time = event->ctx->time;
+        } else {
+                u64 now = perf_clock();
+                u64 delta = now - event->ctx->timestamp;
+                time = event->ctx->time + delta;
+        }
+
+        task_clock_event_update(event, time);
+}
+
+static int task_clock_event_init(struct perf_event *event)
+{
+        if (event->attr.type != PERF_TYPE_SOFTWARE)
+                return -ENOENT;
+
+        if (event->attr.config != PERF_COUNT_SW_TASK_CLOCK)
+                return -ENOENT;
+
+        return 0;
+}
+
+static struct pmu perf_task_clock = {
+        .task_ctx_nr    = perf_sw_context,
+
+        .event_init     = task_clock_event_init,
+        .add            = task_clock_event_add,
+        .del            = task_clock_event_del,
+        .start          = task_clock_event_start,
+        .stop           = task_clock_event_stop,
+        .read           = task_clock_event_read,
+};
+
+static void perf_pmu_nop_void(struct pmu *pmu)
+{
+}
+
+static int perf_pmu_nop_int(struct pmu *pmu)
 {
+        return 0;
+}
+
+static void perf_pmu_start_txn(struct pmu *pmu)
+{
+        perf_pmu_disable(pmu);
+}
+
+static int perf_pmu_commit_txn(struct pmu *pmu)
+{
+        perf_pmu_enable(pmu);
+        return 0;
+}
+
+static void perf_pmu_cancel_txn(struct pmu *pmu)
+{
+        perf_pmu_enable(pmu);
+}
+
+/*
+ * Ensures all contexts with the same task_ctx_nr have the same
+ * pmu_cpu_context too.
+ */
+static void *find_pmu_context(int ctxn)
+{
+        struct pmu *pmu;
+
+        if (ctxn < 0)
+                return NULL;
+
+        list_for_each_entry(pmu, &pmus, entry) {
+                if (pmu->task_ctx_nr == ctxn)
+                        return pmu->pmu_cpu_context;
+        }
+
         return NULL;
 }
 
-void perf_bp_event(struct perf_event *bp, void *regs)
+static void update_pmu_context(struct pmu *pmu, struct pmu *old_pmu)
 {
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct perf_cpu_context *cpuctx;
+
+                cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
+
+                if (cpuctx->active_pmu == old_pmu)
+                        cpuctx->active_pmu = pmu;
+        }
 }
-#endif
 
-atomic_t perf_swevent_enabled[PERF_COUNT_SW_MAX];
+static void free_pmu_context(struct pmu *pmu)
+{
+        struct pmu *i;
 
-static void sw_perf_event_destroy(struct perf_event *event)
+        mutex_lock(&pmus_lock);
+        /*
+         * Like a real lame refcount.
+         */
+        list_for_each_entry(i, &pmus, entry) {
+                if (i->pmu_cpu_context == pmu->pmu_cpu_context) {
+                        update_pmu_context(i, pmu);
+                        goto out;
+                }
+        }
+
+        free_percpu(pmu->pmu_cpu_context);
+out:
+        mutex_unlock(&pmus_lock);
+}
+
+int perf_pmu_register(struct pmu *pmu)
 {
-        u64 event_id = event->attr.config;
+        int cpu, ret;
 
-        WARN_ON(event->parent);
+        mutex_lock(&pmus_lock);
+        ret = -ENOMEM;
+        pmu->pmu_disable_count = alloc_percpu(int);
+        if (!pmu->pmu_disable_count)
+                goto unlock;
 
-        atomic_dec(&perf_swevent_enabled[event_id]);
-        swevent_hlist_put(event);
+        pmu->pmu_cpu_context = find_pmu_context(pmu->task_ctx_nr);
+        if (pmu->pmu_cpu_context)
+                goto got_cpu_context;
+
+        pmu->pmu_cpu_context = alloc_percpu(struct perf_cpu_context);
+        if (!pmu->pmu_cpu_context)
+                goto free_pdc;
+
+        for_each_possible_cpu(cpu) {
+                struct perf_cpu_context *cpuctx;
+
+                cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
+                __perf_event_init_context(&cpuctx->ctx);
+                cpuctx->ctx.type = cpu_context;
+                cpuctx->ctx.pmu = pmu;
+                cpuctx->jiffies_interval = 1;
+                INIT_LIST_HEAD(&cpuctx->rotation_list);
+                cpuctx->active_pmu = pmu;
+        }
+
+got_cpu_context:
+        if (!pmu->start_txn) {
+                if (pmu->pmu_enable) {
+                        /*
+                         * If we have pmu_enable/pmu_disable calls, install
+                         * transaction stubs that use that to try and batch
+                         * hardware accesses.
+                         */
+                        pmu->start_txn  = perf_pmu_start_txn;
+                        pmu->commit_txn = perf_pmu_commit_txn;
+                        pmu->cancel_txn = perf_pmu_cancel_txn;
+                } else {
+                        pmu->start_txn  = perf_pmu_nop_void;
+                        pmu->commit_txn = perf_pmu_nop_int;
+                        pmu->cancel_txn = perf_pmu_nop_void;
+                }
+        }
+
+        if (!pmu->pmu_enable) {
+                pmu->pmu_enable  = perf_pmu_nop_void;
+                pmu->pmu_disable = perf_pmu_nop_void;
+        }
+
+        list_add_rcu(&pmu->entry, &pmus);
+        ret = 0;
+unlock:
+        mutex_unlock(&pmus_lock);
+
+        return ret;
+
+free_pdc:
+        free_percpu(pmu->pmu_disable_count);
+        goto unlock;
 }
 
-static const struct pmu *sw_perf_event_init(struct perf_event *event)
+void perf_pmu_unregister(struct pmu *pmu)
 {
-        const struct pmu *pmu = NULL;
-        u64 event_id = event->attr.config;
+        mutex_lock(&pmus_lock);
+        list_del_rcu(&pmu->entry);
+        mutex_unlock(&pmus_lock);
 
         /*
-         * Software events (currently) can't in general distinguish
-         * between user, kernel and hypervisor events.
-         * However, context switches and cpu migrations are considered
-         * to be kernel events, and page faults are never hypervisor
-         * events.
+         * We dereference the pmu list under both SRCU and regular RCU, so
+         * synchronize against both of those.
          */
-        switch (event_id) {
-        case PERF_COUNT_SW_CPU_CLOCK:
-                pmu = &perf_ops_cpu_clock;
+        synchronize_srcu(&pmus_srcu);
+        synchronize_rcu();
 
-                break;
-        case PERF_COUNT_SW_TASK_CLOCK:
-                /*
-                 * If the user instantiates this as a per-cpu event,
-                 * use the cpu_clock event instead.
-                 */
-                if (event->ctx->task)
-                        pmu = &perf_ops_task_clock;
-                else
-                        pmu = &perf_ops_cpu_clock;
+        free_percpu(pmu->pmu_disable_count);
+        free_pmu_context(pmu);
+}
 
-                break;
-        case PERF_COUNT_SW_PAGE_FAULTS:
-        case PERF_COUNT_SW_PAGE_FAULTS_MIN:
-        case PERF_COUNT_SW_PAGE_FAULTS_MAJ:
-        case PERF_COUNT_SW_CONTEXT_SWITCHES:
-        case PERF_COUNT_SW_CPU_MIGRATIONS:
-        case PERF_COUNT_SW_ALIGNMENT_FAULTS:
-        case PERF_COUNT_SW_EMULATION_FAULTS:
-                if (!event->parent) {
-                        int err;
-
-                        err = swevent_hlist_get(event);
-                        if (err)
-                                return ERR_PTR(err);
+struct pmu *perf_init_event(struct perf_event *event)
+{
+        struct pmu *pmu = NULL;
+        int idx;
 
-                        atomic_inc(&perf_swevent_enabled[event_id]);
-                        event->destroy = sw_perf_event_destroy;
+        idx = srcu_read_lock(&pmus_srcu);
+        list_for_each_entry_rcu(pmu, &pmus, entry) {
+                int ret = pmu->event_init(event);
+                if (!ret)
+                        goto unlock;
+
+                if (ret != -ENOENT) {
+                        pmu = ERR_PTR(ret);
+                        goto unlock;
                 }
-                pmu = &perf_ops_generic;
-                break;
         }
+        pmu = ERR_PTR(-ENOENT);
+unlock:
+        srcu_read_unlock(&pmus_srcu, idx);
 
         return pmu;
 }
@@ -4810,20 +5294,18 @@ static const struct pmu *sw_perf_event_init(struct perf_event *event)
  * Allocate and initialize a event structure
  */
 static struct perf_event *
-perf_event_alloc(struct perf_event_attr *attr,
-                   int cpu,
-                   struct perf_event_context *ctx,
-                   struct perf_event *group_leader,
-                   struct perf_event *parent_event,
-                   perf_overflow_handler_t overflow_handler,
-                   gfp_t gfpflags)
-{
-        const struct pmu *pmu;
+perf_event_alloc(struct perf_event_attr *attr, int cpu,
+                 struct task_struct *task,
+                 struct perf_event *group_leader,
+                 struct perf_event *parent_event,
+                 perf_overflow_handler_t overflow_handler)
+{
+        struct pmu *pmu;
         struct perf_event *event;
         struct hw_perf_event *hwc;
         long err;
 
-        event = kzalloc(sizeof(*event), gfpflags);
+        event = kzalloc(sizeof(*event), GFP_KERNEL);
         if (!event)
                 return ERR_PTR(-ENOMEM);
 
@@ -4841,6 +5323,7 @@ perf_event_alloc(struct perf_event_attr *attr,
         INIT_LIST_HEAD(&event->event_entry);
         INIT_LIST_HEAD(&event->sibling_list);
         init_waitqueue_head(&event->waitq);
+        init_irq_work(&event->pending, perf_pending_event);
 
         mutex_init(&event->mmap_mutex);
 
@@ -4848,7 +5331,6 @@ perf_event_alloc(struct perf_event_attr *attr,
         event->attr             = *attr;
         event->group_leader     = group_leader;
         event->pmu              = NULL;
-        event->ctx              = ctx;
         event->oncpu            = -1;
 
         event->parent           = parent_event;
@@ -4858,6 +5340,17 @@ perf_event_alloc(struct perf_event_attr *attr,
 
         event->state            = PERF_EVENT_STATE_INACTIVE;
 
+        if (task) {
+                event->attach_state = PERF_ATTACH_TASK;
+#ifdef CONFIG_HAVE_HW_BREAKPOINT
+                /*
+                 * hw_breakpoint is a bit difficult here..
+                 */
+                if (attr->type == PERF_TYPE_BREAKPOINT)
+                        event->hw.bp_target = task;
+#endif
+        }
+
         if (!overflow_handler && parent_event)
                 overflow_handler = parent_event->overflow_handler;
         
@@ -4882,29 +5375,8 @@ perf_event_alloc(struct perf_event_attr *attr,
         if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP))
                 goto done;
 
-        switch (attr->type) {
-        case PERF_TYPE_RAW:
-        case PERF_TYPE_HARDWARE:
-        case PERF_TYPE_HW_CACHE:
-                pmu = hw_perf_event_init(event);
-                break;
-
-        case PERF_TYPE_SOFTWARE:
-                pmu = sw_perf_event_init(event);
-                break;
+        pmu = perf_init_event(event);
 
-        case PERF_TYPE_TRACEPOINT:
-                pmu = tp_perf_event_init(event);
-                break;
-
-        case PERF_TYPE_BREAKPOINT:
-                pmu = bp_perf_event_init(event);
-                break;
-
-
-        default:
-                break;
-        }
 done:
         err = 0;
         if (!pmu)
@@ -4922,13 +5394,21 @@ done:
         event->pmu = pmu;
 
         if (!event->parent) {
-                atomic_inc(&nr_events);
+                if (event->attach_state & PERF_ATTACH_TASK)
+                        jump_label_inc(&perf_task_events);
                 if (event->attr.mmap || event->attr.mmap_data)
                         atomic_inc(&nr_mmap_events);
                 if (event->attr.comm)
                         atomic_inc(&nr_comm_events);
                 if (event->attr.task)
                         atomic_inc(&nr_task_events);
+                if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN) {
+                        err = get_callchain_buffers();
+                        if (err) {
+                                free_event(event);
+                                return ERR_PTR(err);
+                        }
+                }
         }
 
         return event;
@@ -5076,12 +5556,16 @@ SYSCALL_DEFINE5(perf_event_open,
                 struct perf_event_attr __user *, attr_uptr,
                 pid_t, pid, int, cpu, int, group_fd, unsigned long, flags)
 {
-        struct perf_event *event, *group_leader = NULL, *output_event = NULL;
+        struct perf_event *group_leader = NULL, *output_event = NULL;
+        struct perf_event *event, *sibling;
         struct perf_event_attr attr;
         struct perf_event_context *ctx;
         struct file *event_file = NULL;
         struct file *group_file = NULL;
+        struct task_struct *task = NULL;
+        struct pmu *pmu;
         int event_fd;
+        int move_group = 0;
         int fput_needed = 0;
         int err;
 
@@ -5107,20 +5591,11 @@ SYSCALL_DEFINE5(perf_event_open,
         if (event_fd < 0)
                 return event_fd;
 
-        /*
-         * Get the target context (task or percpu):
-         */
-        ctx = find_get_context(pid, cpu);
-        if (IS_ERR(ctx)) {
-                err = PTR_ERR(ctx);
-                goto err_fd;
-        }
-
         if (group_fd != -1) {
                 group_leader = perf_fget_light(group_fd, &fput_needed);
                 if (IS_ERR(group_leader)) {
                         err = PTR_ERR(group_leader);
-                        goto err_put_context;
+                        goto err_fd;
                 }
                 group_file = group_leader->filp;
                 if (flags & PERF_FLAG_FD_OUTPUT)
@@ -5129,6 +5604,58 @@ SYSCALL_DEFINE5(perf_event_open,
                         group_leader = NULL;
         }
 
+        if (pid != -1) {
+                task = find_lively_task_by_vpid(pid);
+                if (IS_ERR(task)) {
+                        err = PTR_ERR(task);
+                        goto err_group_fd;
+                }
+        }
+
+        event = perf_event_alloc(&attr, cpu, task, group_leader, NULL, NULL);
+        if (IS_ERR(event)) {
+                err = PTR_ERR(event);
+                goto err_task;
+        }
+
+        /*
+         * Special case software events and allow them to be part of
+         * any hardware group.
+         */
+        pmu = event->pmu;
+
+        if (group_leader &&
+            (is_software_event(event) != is_software_event(group_leader))) {
+                if (is_software_event(event)) {
+                        /*
+                         * If event and group_leader are not both a software
+                         * event, and event is, then group leader is not.
+                         *
+                         * Allow the addition of software events to !software
+                         * groups, this is safe because software events never
+                         * fail to schedule.
+                         */
+                        pmu = group_leader->pmu;
+                } else if (is_software_event(group_leader) &&
+                           (group_leader->group_flags & PERF_GROUP_SOFTWARE)) {
+                        /*
+                         * In case the group is a pure software group, and we
+                         * try to add a hardware event, move the whole group to
+                         * the hardware context.
+                         */
+                        move_group = 1;
+                }
+        }
+
+        /*
+         * Get the target context (task or percpu):
+         */
+        ctx = find_get_context(pmu, task, cpu);
+        if (IS_ERR(ctx)) {
+                err = PTR_ERR(ctx);
+                goto err_alloc;
+        }
+
         /*
          * Look up the group leader (we will attach this event to it):
          */
@@ -5140,48 +5667,72 @@ SYSCALL_DEFINE5(perf_event_open,
                  * becoming part of another group-sibling):
                  */
                 if (group_leader->group_leader != group_leader)
-                        goto err_put_context;
+                        goto err_context;
                 /*
                  * Do not allow to attach to a group in a different
                  * task or CPU context:
                  */
-                if (group_leader->ctx != ctx)
-                        goto err_put_context;
+                if (move_group) {
+                        if (group_leader->ctx->type != ctx->type)
+                                goto err_context;
+                } else {
+                        if (group_leader->ctx != ctx)
+                                goto err_context;
+                }
+
                 /*
                  * Only a group leader can be exclusive or pinned
                  */
                 if (attr.exclusive || attr.pinned)
-                        goto err_put_context;
-        }
-
-        event = perf_event_alloc(&attr, cpu, ctx, group_leader,
-                                     NULL, NULL, GFP_KERNEL);
-        if (IS_ERR(event)) {
-                err = PTR_ERR(event);
-                goto err_put_context;
+                        goto err_context;
         }
 
         if (output_event) {
                 err = perf_event_set_output(event, output_event);
                 if (err)
-                        goto err_free_put_context;
+                        goto err_context;
         }
 
         event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR);
         if (IS_ERR(event_file)) {
                 err = PTR_ERR(event_file);
-                goto err_free_put_context;
+                goto err_context;
+        }
+
+        if (move_group) {
+                struct perf_event_context *gctx = group_leader->ctx;
+
+                mutex_lock(&gctx->mutex);
+                perf_event_remove_from_context(group_leader);
+                list_for_each_entry(sibling, &group_leader->sibling_list,
+                                    group_entry) {
+                        perf_event_remove_from_context(sibling);
+                        put_ctx(gctx);
+                }
+                mutex_unlock(&gctx->mutex);
+                put_ctx(gctx);
         }
 
         event->filp = event_file;
         WARN_ON_ONCE(ctx->parent_ctx);
         mutex_lock(&ctx->mutex);
+
+        if (move_group) {
+                perf_install_in_context(ctx, group_leader, cpu);
+                get_ctx(ctx);
+                list_for_each_entry(sibling, &group_leader->sibling_list,
+                                    group_entry) {
+                        perf_install_in_context(ctx, sibling, cpu);
+                        get_ctx(ctx);
+                }
+        }
+
         perf_install_in_context(ctx, event, cpu);
         ++ctx->generation;
         mutex_unlock(&ctx->mutex);
 
         event->owner = current;
-        get_task_struct(current);
+
         mutex_lock(&current->perf_event_mutex);
         list_add_tail(&event->owner_entry, &current->perf_event_list);
         mutex_unlock(&current->perf_event_mutex);
@@ -5196,11 +5747,15 @@ SYSCALL_DEFINE5(perf_event_open,
         fd_install(event_fd, event_file);
         return event_fd;
 
-err_free_put_context:
+err_context:
+        put_ctx(ctx);
+err_alloc:
         free_event(event);
-err_put_context:
+err_task:
+        if (task)
+                put_task_struct(task);
+err_group_fd:
         fput_light(group_file, fput_needed);
-        put_ctx(ctx);
 err_fd:
         put_unused_fd(event_fd);
         return err;
@@ -5211,32 +5766,31 @@ err_fd:
  *
  * @attr: attributes of the counter to create
  * @cpu: cpu in which the counter is bound
- * @pid: task to profile
+ * @task: task to profile (NULL for percpu)
  */
 struct perf_event *
 perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
-                                 pid_t pid,
+                                 struct task_struct *task,
                                  perf_overflow_handler_t overflow_handler)
 {
-        struct perf_event *event;
         struct perf_event_context *ctx;
+        struct perf_event *event;
         int err;
 
         /*
          * Get the target context (task or percpu):
          */
 
-        ctx = find_get_context(pid, cpu);
-        if (IS_ERR(ctx)) {
-                err = PTR_ERR(ctx);
-                goto err_exit;
-        }
-
-        event = perf_event_alloc(attr, cpu, ctx, NULL,
-                                 NULL, overflow_handler, GFP_KERNEL);
+        event = perf_event_alloc(attr, cpu, task, NULL, NULL, overflow_handler);
         if (IS_ERR(event)) {
                 err = PTR_ERR(event);
-                goto err_put_context;
+                goto err;
+        }
+
+        ctx = find_get_context(event->pmu, task, cpu);
+        if (IS_ERR(ctx)) {
+                err = PTR_ERR(ctx);
+                goto err_free;
         }
 
         event->filp = NULL;
@@ -5246,120 +5800,15 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
         ++ctx->generation;
         mutex_unlock(&ctx->mutex);
 
-        event->owner = current;
-        get_task_struct(current);
-        mutex_lock(&current->perf_event_mutex);
-        list_add_tail(&event->owner_entry, &current->perf_event_list);
-        mutex_unlock(&current->perf_event_mutex);
-
         return event;
 
- err_put_context:
-        put_ctx(ctx);
- err_exit:
+err_free:
+        free_event(event);
+err:
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(perf_event_create_kernel_counter);
 
-/*
- * inherit a event from parent task to child task:
- */
-static struct perf_event *
-inherit_event(struct perf_event *parent_event,
-              struct task_struct *parent,
-              struct perf_event_context *parent_ctx,
-              struct task_struct *child,
-              struct perf_event *group_leader,
-              struct perf_event_context *child_ctx)
-{
-        struct perf_event *child_event;
-
-        /*
-         * Instead of creating recursive hierarchies of events,
-         * we link inherited events back to the original parent,
-         * which has a filp for sure, which we use as the reference
-         * count:
-         */
-        if (parent_event->parent)
-                parent_event = parent_event->parent;
-
-        child_event = perf_event_alloc(&parent_event->attr,
-                                           parent_event->cpu, child_ctx,
-                                           group_leader, parent_event,
-                                           NULL, GFP_KERNEL);
-        if (IS_ERR(child_event))
-                return child_event;
-        get_ctx(child_ctx);
-
-        /*
-         * Make the child state follow the state of the parent event,
-         * not its attr.disabled bit.  We hold the parent's mutex,
-         * so we won't race with perf_event_{en, dis}able_family.
-         */
-        if (parent_event->state >= PERF_EVENT_STATE_INACTIVE)
-                child_event->state = PERF_EVENT_STATE_INACTIVE;
-        else
-                child_event->state = PERF_EVENT_STATE_OFF;
-
-        if (parent_event->attr.freq) {
-                u64 sample_period = parent_event->hw.sample_period;
-                struct hw_perf_event *hwc = &child_event->hw;
-
-                hwc->sample_period = sample_period;
-                hwc->last_period   = sample_period;
-
-                local64_set(&hwc->period_left, sample_period);
-        }
-
-        child_event->overflow_handler = parent_event->overflow_handler;
-
-        /*
-         * Link it up in the child's context:
-         */
-        add_event_to_ctx(child_event, child_ctx);
-
-        /*
-         * Get a reference to the parent filp - we will fput it
-         * when the child event exits. This is safe to do because
-         * we are in the parent and we know that the filp still
-         * exists and has a nonzero count:
-         */
-        atomic_long_inc(&parent_event->filp->f_count);
-
-        /*
-         * Link this into the parent event's child list
-         */
-        WARN_ON_ONCE(parent_event->ctx->parent_ctx);
-        mutex_lock(&parent_event->child_mutex);
-        list_add_tail(&child_event->child_list, &parent_event->child_list);
-        mutex_unlock(&parent_event->child_mutex);
-
-        return child_event;
-}
-
-static int inherit_group(struct perf_event *parent_event,
-              struct task_struct *parent,
-              struct perf_event_context *parent_ctx,
-              struct task_struct *child,
-              struct perf_event_context *child_ctx)
-{
-        struct perf_event *leader;
-        struct perf_event *sub;
-        struct perf_event *child_ctr;
-
-        leader = inherit_event(parent_event, parent, parent_ctx,
-                                 child, NULL, child_ctx);
-        if (IS_ERR(leader))
-                return PTR_ERR(leader);
-        list_for_each_entry(sub, &parent_event->sibling_list, group_entry) {
-                child_ctr = inherit_event(sub, parent, parent_ctx,
-                                            child, leader, child_ctx);
-                if (IS_ERR(child_ctr))
-                        return PTR_ERR(child_ctr);
-        }
-        return 0;
-}
-
 static void sync_child_event(struct perf_event *child_event,
                                struct task_struct *child)
 {
@@ -5416,16 +5865,13 @@ __perf_event_exit_task(struct perf_event *child_event,
         }
 }
 
-/*
- * When a child task exits, feed back event values to parent events.
- */
-void perf_event_exit_task(struct task_struct *child)
+static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
 {
         struct perf_event *child_event, *tmp;
         struct perf_event_context *child_ctx;
         unsigned long flags;
 
-        if (likely(!child->perf_event_ctxp)) {
+        if (likely(!child->perf_event_ctxp[ctxn])) {
                 perf_event_task(child, NULL, 0);
                 return;
         }
@@ -5437,8 +5883,8 @@ void perf_event_exit_task(struct task_struct *child)
          * scheduled, so we are now safe from rescheduling changing
          * our context.
          */
-        child_ctx = child->perf_event_ctxp;
-        __perf_event_task_sched_out(child_ctx);
+        child_ctx = child->perf_event_ctxp[ctxn];
+        task_ctx_sched_out(child_ctx, EVENT_ALL);
 
         /*
          * Take the context lock here so that if find_get_context is
@@ -5446,7 +5892,7 @@ void perf_event_exit_task(struct task_struct *child)
          * incremented the context's refcount before we do put_ctx below.
          */
         raw_spin_lock(&child_ctx->lock);
-        child->perf_event_ctxp = NULL;
+        child->perf_event_ctxp[ctxn] = NULL;
         /*
          * If this context is a clone; unclone it so it can't get
          * swapped to another process while we're removing all
@@ -5499,6 +5945,33 @@ again:
         put_ctx(child_ctx);
 }
 
+/*
+ * When a child task exits, feed back event values to parent events.
+ */
+void perf_event_exit_task(struct task_struct *child)
+{
+        struct perf_event *event, *tmp;
+        int ctxn;
+
+        mutex_lock(&child->perf_event_mutex);
+        list_for_each_entry_safe(event, tmp, &child->perf_event_list,
+                                 owner_entry) {
+                list_del_init(&event->owner_entry);
+
+                /*
+                 * Ensure the list deletion is visible before we clear
+                 * the owner, closes a race against perf_release() where
+                 * we need to serialize on the owner->perf_event_mutex.
+                 */
+                smp_wmb();
+                event->owner = NULL;
+        }
+        mutex_unlock(&child->perf_event_mutex);
+
+        for_each_task_context_nr(ctxn)
+                perf_event_exit_task_context(child, ctxn);
+}
+
 static void perf_free_event(struct perf_event *event,
                             struct perf_event_context *ctx)
 {
@@ -5520,48 +5993,166 @@ static void perf_free_event(struct perf_event *event,
 
 /*
  * free an unexposed, unused context as created by inheritance by
- * init_task below, used by fork() in case of fail.
+ * perf_event_init_task below, used by fork() in case of fail.
  */
 void perf_event_free_task(struct task_struct *task)
 {
-        struct perf_event_context *ctx = task->perf_event_ctxp;
+        struct perf_event_context *ctx;
         struct perf_event *event, *tmp;
+        int ctxn;
 
-        if (!ctx)
-                return;
+        for_each_task_context_nr(ctxn) {
+                ctx = task->perf_event_ctxp[ctxn];
+                if (!ctx)
+                        continue;
 
-        mutex_lock(&ctx->mutex);
+                mutex_lock(&ctx->mutex);
 again:
-        list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
-                perf_free_event(event, ctx);
+                list_for_each_entry_safe(event, tmp, &ctx->pinned_groups,
+                                group_entry)
+                        perf_free_event(event, ctx);
 
-        list_for_each_entry_safe(event, tmp, &ctx->flexible_groups,
-                                 group_entry)
-                perf_free_event(event, ctx);
+                list_for_each_entry_safe(event, tmp, &ctx->flexible_groups,
+                                group_entry)
+                        perf_free_event(event, ctx);
 
-        if (!list_empty(&ctx->pinned_groups) ||
-            !list_empty(&ctx->flexible_groups))
-                goto again;
+                if (!list_empty(&ctx->pinned_groups) ||
+                                !list_empty(&ctx->flexible_groups))
+                        goto again;
 
-        mutex_unlock(&ctx->mutex);
+                mutex_unlock(&ctx->mutex);
 
-        put_ctx(ctx);
+                put_ctx(ctx);
+        }
+}
+
+void perf_event_delayed_put(struct task_struct *task)
+{
+        int ctxn;
+
+        for_each_task_context_nr(ctxn)
+                WARN_ON_ONCE(task->perf_event_ctxp[ctxn]);
+}
+
+/*
+ * inherit a event from parent task to child task:
+ */
+static struct perf_event *
+inherit_event(struct perf_event *parent_event,
+              struct task_struct *parent,
+              struct perf_event_context *parent_ctx,
+              struct task_struct *child,
+              struct perf_event *group_leader,
+              struct perf_event_context *child_ctx)
+{
+        struct perf_event *child_event;
+        unsigned long flags;
+
+        /*
+         * Instead of creating recursive hierarchies of events,
+         * we link inherited events back to the original parent,
+         * which has a filp for sure, which we use as the reference
+         * count:
+         */
+        if (parent_event->parent)
+                parent_event = parent_event->parent;
+
+        child_event = perf_event_alloc(&parent_event->attr,
+                                           parent_event->cpu,
+                                           child,
+                                           group_leader, parent_event,
+                                           NULL);
+        if (IS_ERR(child_event))
+                return child_event;
+        get_ctx(child_ctx);
+
+        /*
+         * Make the child state follow the state of the parent event,
+         * not its attr.disabled bit.  We hold the parent's mutex,
+         * so we won't race with perf_event_{en, dis}able_family.
+         */
+        if (parent_event->state >= PERF_EVENT_STATE_INACTIVE)
+                child_event->state = PERF_EVENT_STATE_INACTIVE;
+        else
+                child_event->state = PERF_EVENT_STATE_OFF;
+
+        if (parent_event->attr.freq) {
+                u64 sample_period = parent_event->hw.sample_period;
+                struct hw_perf_event *hwc = &child_event->hw;
+
+                hwc->sample_period = sample_period;
+                hwc->last_period   = sample_period;
+
+                local64_set(&hwc->period_left, sample_period);
+        }
+
+        child_event->ctx = child_ctx;
+        child_event->overflow_handler = parent_event->overflow_handler;
+
+        /*
+         * Link it up in the child's context:
+         */
+        raw_spin_lock_irqsave(&child_ctx->lock, flags);
+        add_event_to_ctx(child_event, child_ctx);
+        raw_spin_unlock_irqrestore(&child_ctx->lock, flags);
+
+        /*
+         * Get a reference to the parent filp - we will fput it
+         * when the child event exits. This is safe to do because
+         * we are in the parent and we know that the filp still
+         * exists and has a nonzero count:
+         */
+        atomic_long_inc(&parent_event->filp->f_count);
+
+        /*
+         * Link this into the parent event's child list
+         */
+        WARN_ON_ONCE(parent_event->ctx->parent_ctx);
+        mutex_lock(&parent_event->child_mutex);
+        list_add_tail(&child_event->child_list, &parent_event->child_list);
+        mutex_unlock(&parent_event->child_mutex);
+
+        return child_event;
+}
+
+static int inherit_group(struct perf_event *parent_event,
+              struct task_struct *parent,
+              struct perf_event_context *parent_ctx,
+              struct task_struct *child,
+              struct perf_event_context *child_ctx)
+{
+        struct perf_event *leader;
+        struct perf_event *sub;
+        struct perf_event *child_ctr;
+
+        leader = inherit_event(parent_event, parent, parent_ctx,
+                                 child, NULL, child_ctx);
+        if (IS_ERR(leader))
+                return PTR_ERR(leader);
+        list_for_each_entry(sub, &parent_event->sibling_list, group_entry) {
+                child_ctr = inherit_event(sub, parent, parent_ctx,
+                                            child, leader, child_ctx);
+                if (IS_ERR(child_ctr))
+                        return PTR_ERR(child_ctr);
+        }
+        return 0;
 }
 
 static int
 inherit_task_group(struct perf_event *event, struct task_struct *parent,
                    struct perf_event_context *parent_ctx,
-                   struct task_struct *child,
+                   struct task_struct *child, int ctxn,
                    int *inherited_all)
 {
         int ret;
-        struct perf_event_context *child_ctx = child->perf_event_ctxp;
+        struct perf_event_context *child_ctx;
 
         if (!event->attr.inherit) {
                 *inherited_all = 0;
                 return 0;
         }
 
+        child_ctx = child->perf_event_ctxp[ctxn];
         if (!child_ctx) {
                 /*
                  * This is executed from the parent task context, so
@@ -5570,14 +6161,11 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
                  * child.
                  */
 
-                child_ctx = kzalloc(sizeof(struct perf_event_context),
-                                    GFP_KERNEL);
+                child_ctx = alloc_perf_context(event->pmu, child);
                 if (!child_ctx)
                         return -ENOMEM;
 
-                __perf_event_init_context(child_ctx, child);
-                child->perf_event_ctxp = child_ctx;
-                get_task_struct(child);
+                child->perf_event_ctxp[ctxn] = child_ctx;
         }
 
         ret = inherit_group(event, parent, parent_ctx,
@@ -5589,32 +6177,32 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
         return ret;
 }
 
-
 /*
  * Initialize the perf_event context in task_struct
  */
-int perf_event_init_task(struct task_struct *child)
+int perf_event_init_context(struct task_struct *child, int ctxn)
 {
         struct perf_event_context *child_ctx, *parent_ctx;
         struct perf_event_context *cloned_ctx;
         struct perf_event *event;
         struct task_struct *parent = current;
         int inherited_all = 1;
+        unsigned long flags;
         int ret = 0;
 
-        child->perf_event_ctxp = NULL;
+        child->perf_event_ctxp[ctxn] = NULL;
 
         mutex_init(&child->perf_event_mutex);
         INIT_LIST_HEAD(&child->perf_event_list);
 
-        if (likely(!parent->perf_event_ctxp))
+        if (likely(!parent->perf_event_ctxp[ctxn]))
                 return 0;
 
         /*
          * If the parent's context is a clone, pin it so it won't get
          * swapped under us.
          */
-        parent_ctx = perf_pin_task_context(parent);
+        parent_ctx = perf_pin_task_context(parent, ctxn);
 
         /*
          * No need to check if parent_ctx != NULL here; since we saw
@@ -5634,20 +6222,33 @@ int perf_event_init_task(struct task_struct *child)
          * the list, not manipulating it:
          */
         list_for_each_entry(event, &parent_ctx->pinned_groups, group_entry) {
-                ret = inherit_task_group(event, parent, parent_ctx, child,
-                                         &inherited_all);
+                ret = inherit_task_group(event, parent, parent_ctx,
+                                         child, ctxn, &inherited_all);
                 if (ret)
                         break;
         }
 
+        /*
+         * We can't hold ctx->lock when iterating the ->flexible_group list due
+         * to allocations, but we need to prevent rotation because
+         * rotate_ctx() will change the list from interrupt context.
+         */
+        raw_spin_lock_irqsave(&parent_ctx->lock, flags);
+        parent_ctx->rotate_disable = 1;
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+
         list_for_each_entry(event, &parent_ctx->flexible_groups, group_entry) {
-                ret = inherit_task_group(event, parent, parent_ctx, child,
-                                         &inherited_all);
+                ret = inherit_task_group(event, parent, parent_ctx,
+                                         child, ctxn, &inherited_all);
                 if (ret)
                         break;
         }
 
-        child_ctx = child->perf_event_ctxp;
+        raw_spin_lock_irqsave(&parent_ctx->lock, flags);
+        parent_ctx->rotate_disable = 0;
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+
+        child_ctx = child->perf_event_ctxp[ctxn];
 
         if (child_ctx && inherited_all) {
                 /*
@@ -5676,63 +6277,98 @@ int perf_event_init_task(struct task_struct *child)
         return ret;
 }
 
+/*
+ * Initialize the perf_event context in task_struct
+ */
+int perf_event_init_task(struct task_struct *child)
+{
+        int ctxn, ret;
+
+        for_each_task_context_nr(ctxn) {
+                ret = perf_event_init_context(child, ctxn);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+
 static void __init perf_event_init_all_cpus(void)
 {
+        struct swevent_htable *swhash;
         int cpu;
-        struct perf_cpu_context *cpuctx;
 
         for_each_possible_cpu(cpu) {
-                cpuctx = &per_cpu(perf_cpu_context, cpu);
-                mutex_init(&cpuctx->hlist_mutex);
-                __perf_event_init_context(&cpuctx->ctx, NULL);
+                swhash = &per_cpu(swevent_htable, cpu);
+                mutex_init(&swhash->hlist_mutex);
+                INIT_LIST_HEAD(&per_cpu(rotation_list, cpu));
         }
 }
 
 static void __cpuinit perf_event_init_cpu(int cpu)
 {
-        struct perf_cpu_context *cpuctx;
-
-        cpuctx = &per_cpu(perf_cpu_context, cpu);
+        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
-        spin_lock(&perf_resource_lock);
-        cpuctx->max_pertask = perf_max_events - perf_reserved_percpu;
-        spin_unlock(&perf_resource_lock);
-
-        mutex_lock(&cpuctx->hlist_mutex);
-        if (cpuctx->hlist_refcount > 0) {
+        mutex_lock(&swhash->hlist_mutex);
+        if (swhash->hlist_refcount > 0) {
                 struct swevent_hlist *hlist;
 
-                hlist = kzalloc(sizeof(*hlist), GFP_KERNEL);
-                WARN_ON_ONCE(!hlist);
-                rcu_assign_pointer(cpuctx->swevent_hlist, hlist);
+                hlist = kzalloc_node(sizeof(*hlist), GFP_KERNEL, cpu_to_node(cpu));
+                WARN_ON(!hlist);
+                rcu_assign_pointer(swhash->swevent_hlist, hlist);
         }
-        mutex_unlock(&cpuctx->hlist_mutex);
+        mutex_unlock(&swhash->hlist_mutex);
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-static void __perf_event_exit_cpu(void *info)
+static void perf_pmu_rotate_stop(struct pmu *pmu)
 {
-        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
-        struct perf_event_context *ctx = &cpuctx->ctx;
+        struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+
+        WARN_ON(!irqs_disabled());
+
+        list_del_init(&cpuctx->rotation_list);
+}
+
+static void __perf_event_exit_context(void *__info)
+{
+        struct perf_event_context *ctx = __info;
         struct perf_event *event, *tmp;
 
+        perf_pmu_rotate_stop(ctx->pmu);
+
         list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
                 __perf_event_remove_from_context(event);
         list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry)
                 __perf_event_remove_from_context(event);
 }
+
+static void perf_event_exit_cpu_context(int cpu)
+{
+        struct perf_event_context *ctx;
+        struct pmu *pmu;
+        int idx;
+
+        idx = srcu_read_lock(&pmus_srcu);
+        list_for_each_entry_rcu(pmu, &pmus, entry) {
+                ctx = &per_cpu_ptr(pmu->pmu_cpu_context, cpu)->ctx;
+
+                mutex_lock(&ctx->mutex);
+                smp_call_function_single(cpu, __perf_event_exit_context, ctx, 1);
+                mutex_unlock(&ctx->mutex);
+        }
+        srcu_read_unlock(&pmus_srcu, idx);
+}
+
 static void perf_event_exit_cpu(int cpu)
 {
-        struct perf_cpu_context *cpuctx = &per_cpu(perf_cpu_context, cpu);
-        struct perf_event_context *ctx = &cpuctx->ctx;
+        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
-        mutex_lock(&cpuctx->hlist_mutex);
-        swevent_hlist_release(cpuctx);
-        mutex_unlock(&cpuctx->hlist_mutex);
+        mutex_lock(&swhash->hlist_mutex);
+        swevent_hlist_release(swhash);
+        mutex_unlock(&swhash->hlist_mutex);
 
-        mutex_lock(&ctx->mutex);
-        smp_call_function_single(cpu, __perf_event_exit_cpu, NULL, 1);
-        mutex_unlock(&ctx->mutex);
+        perf_event_exit_cpu_context(cpu);
 }
 #else
 static inline void perf_event_exit_cpu(int cpu) { }
@@ -5743,15 +6379,15 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
 {
         unsigned int cpu = (long)hcpu;
 
-        switch (action) {
+        switch (action & ~CPU_TASKS_FROZEN) {
 
         case CPU_UP_PREPARE:
-        case CPU_UP_PREPARE_FROZEN:
+        case CPU_DOWN_FAILED:
                 perf_event_init_cpu(cpu);
                 break;
 
+        case CPU_UP_CANCELED:
         case CPU_DOWN_PREPARE:
-        case CPU_DOWN_PREPARE_FROZEN:
                 perf_event_exit_cpu(cpu);
                 break;
 
@@ -5762,118 +6398,18 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
         return NOTIFY_OK;
 }
 
-/*
- * This has to have a higher priority than migration_notifier in sched.c.
- */
-static struct notifier_block __cpuinitdata perf_cpu_nb = {
-        .notifier_call          = perf_cpu_notify,
-        .priority               = 20,
-};
-
 void __init perf_event_init(void)
 {
-        perf_event_init_all_cpus();
-        perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_UP_PREPARE,
-                        (void *)(long)smp_processor_id());
-        perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_ONLINE,
-                        (void *)(long)smp_processor_id());
-        register_cpu_notifier(&perf_cpu_nb);
-}
-
-static ssize_t perf_show_reserve_percpu(struct sysdev_class *class,
-                                        struct sysdev_class_attribute *attr,
-                                        char *buf)
-{
-        return sprintf(buf, "%d\n", perf_reserved_percpu);
-}
-
-static ssize_t
-perf_set_reserve_percpu(struct sysdev_class *class,
-                        struct sysdev_class_attribute *attr,
-                        const char *buf,
-                        size_t count)
-{
-        struct perf_cpu_context *cpuctx;
-        unsigned long val;
-        int err, cpu, mpt;
-
-        err = strict_strtoul(buf, 10, &val);
-        if (err)
-                return err;
-        if (val > perf_max_events)
-                return -EINVAL;
-
-        spin_lock(&perf_resource_lock);
-        perf_reserved_percpu = val;
-        for_each_online_cpu(cpu) {
-                cpuctx = &per_cpu(perf_cpu_context, cpu);
-                raw_spin_lock_irq(&cpuctx->ctx.lock);
-                mpt = min(perf_max_events - cpuctx->ctx.nr_events,
-                          perf_max_events - perf_reserved_percpu);
-                cpuctx->max_pertask = mpt;
-                raw_spin_unlock_irq(&cpuctx->ctx.lock);
-        }
-        spin_unlock(&perf_resource_lock);
-
-        return count;
-}
-
-static ssize_t perf_show_overcommit(struct sysdev_class *class,
-                                    struct sysdev_class_attribute *attr,
-                                    char *buf)
-{
-        return sprintf(buf, "%d\n", perf_overcommit);
-}
-
-static ssize_t
-perf_set_overcommit(struct sysdev_class *class,
-                    struct sysdev_class_attribute *attr,
-                    const char *buf, size_t count)
-{
-        unsigned long val;
-        int err;
-
-        err = strict_strtoul(buf, 10, &val);
-        if (err)
-                return err;
-        if (val > 1)
-                return -EINVAL;
-
-        spin_lock(&perf_resource_lock);
-        perf_overcommit = val;
-        spin_unlock(&perf_resource_lock);
-
-        return count;
-}
-
-static SYSDEV_CLASS_ATTR(
-                                reserve_percpu,
-                                0644,
-                                perf_show_reserve_percpu,
-                                perf_set_reserve_percpu
-                        );
-
-static SYSDEV_CLASS_ATTR(
-                                overcommit,
-                                0644,
-                                perf_show_overcommit,
-                                perf_set_overcommit
-                        );
-
-static struct attribute *perfclass_attrs[] = {
-        &attr_reserve_percpu.attr,
-        &attr_overcommit.attr,
-        NULL
-};
+        int ret;
 
-static struct attribute_group perfclass_attr_group = {
-        .attrs                  = perfclass_attrs,
-        .name                   = "perf_events",
-};
+        perf_event_init_all_cpus();
+        init_srcu_struct(&pmus_srcu);
+        perf_pmu_register(&perf_swevent);
+        perf_pmu_register(&perf_cpu_clock);
+        perf_pmu_register(&perf_task_clock);
+        perf_tp_register();
+        perf_cpu_notifier(perf_cpu_notify);
 
-static int __init perf_event_sysfs_init(void)
-{
-        return sysfs_create_group(&cpu_sysdev_class.kset.kobj,
-                                  &perfclass_attr_group);
+        ret = init_hw_breakpoint();
+        WARN(ret, "hw_breakpoint initialization failed with: %d", ret);
 }
-device_initcall(perf_event_sysfs_init);
diff --git a/kernel/pid.c b/kernel/pid.c
index e9fd8c132d26..39b65b69584f 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -122,6 +122,43 @@ static void free_pidmap(struct upid *upid)
         atomic_inc(&map->nr_free);
 }
 
+/*
+ * If we started walking pids at 'base', is 'a' seen before 'b'?
+ */
+static int pid_before(int base, int a, int b)
+{
+        /*
+         * This is the same as saying
+         *
+         * (a - base + MAXUINT) % MAXUINT < (b - base + MAXUINT) % MAXUINT
+         * and that mapping orders 'a' and 'b' with respect to 'base'.
+         */
+        return (unsigned)(a - base) < (unsigned)(b - base);
+}
+
+/*
+ * We might be racing with someone else trying to set pid_ns->last_pid.
+ * We want the winner to have the "later" value, because if the
+ * "earlier" value prevails, then a pid may get reused immediately.
+ *
+ * Since pids rollover, it is not sufficient to just pick the bigger
+ * value.  We have to consider where we started counting from.
+ *
+ * 'base' is the value of pid_ns->last_pid that we observed when
+ * we started looking for a pid.
+ *
+ * 'pid' is the pid that we eventually found.
+ */
+static void set_last_pid(struct pid_namespace *pid_ns, int base, int pid)
+{
+        int prev;
+        int last_write = base;
+        do {
+                prev = last_write;
+                last_write = cmpxchg(&pid_ns->last_pid, prev, pid);
+        } while ((prev != last_write) && (pid_before(base, last_write, pid)));
+}
+
 static int alloc_pidmap(struct pid_namespace *pid_ns)
 {
         int i, offset, max_scan, pid, last = pid_ns->last_pid;
@@ -132,7 +169,12 @@ static int alloc_pidmap(struct pid_namespace *pid_ns)
                 pid = RESERVED_PIDS;
         offset = pid & BITS_PER_PAGE_MASK;
         map = &pid_ns->pidmap[pid/BITS_PER_PAGE];
-        max_scan = (pid_max + BITS_PER_PAGE - 1)/BITS_PER_PAGE - !offset;
+        /*
+         * If last_pid points into the middle of the map->page we
+         * want to scan this bitmap block twice, the second time
+         * we start with offset == 0 (or RESERVED_PIDS).
+         */
+        max_scan = DIV_ROUND_UP(pid_max, BITS_PER_PAGE) - !offset;
         for (i = 0; i <= max_scan; ++i) {
                 if (unlikely(!map->page)) {
                         void *page = kzalloc(PAGE_SIZE, GFP_KERNEL);
@@ -154,20 +196,12 @@ static int alloc_pidmap(struct pid_namespace *pid_ns)
                         do {
                                 if (!test_and_set_bit(offset, map->page)) {
                                         atomic_dec(&map->nr_free);
-                                        pid_ns->last_pid = pid;
+                                        set_last_pid(pid_ns, last, pid);
                                         return pid;
                                 }
                                 offset = find_next_offset(map, offset);
                                 pid = mk_pid(pid_ns, map, offset);
-                        /*
-                         * find_next_offset() found a bit, the pid from it
-                         * is in-bounds, and if we fell back to the last
-                         * bitmap block and the final block was the same
-                         * as the starting point, pid is before last_pid.
-                         */
-                        } while (offset < BITS_PER_PAGE && pid < pid_max &&
-                                        (i != max_scan || pid < last ||
-                                            !((last+1) & BITS_PER_PAGE_MASK)));
+                        } while (offset < BITS_PER_PAGE && pid < pid_max);
                 }
                 if (map < &pid_ns->pidmap[(pid_max-1)/BITS_PER_PAGE]) {
                         ++map;
@@ -367,7 +401,7 @@ struct task_struct *pid_task(struct pid *pid, enum pid_type type)
         struct task_struct *result = NULL;
         if (pid) {
                 struct hlist_node *first;
-                first = rcu_dereference_check(pid->tasks[type].first,
+                first = rcu_dereference_check(hlist_first_rcu(&pid->tasks[type]),
                                               rcu_read_lock_held() ||
                                               lockdep_tasklist_lock_is_held());
                 if (first)
@@ -382,6 +416,7 @@ EXPORT_SYMBOL(pid_task);
  */
 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
 {
+        rcu_lockdep_assert(rcu_read_lock_held());
         return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
 }
 
diff --git a/kernel/pm_qos_params.c b/kernel/pm_qos_params.c
index 996a4dec5f96..aeaa7f846821 100644
--- a/kernel/pm_qos_params.c
+++ b/kernel/pm_qos_params.c
@@ -110,6 +110,7 @@ static const struct file_operations pm_qos_power_fops = {
         .write = pm_qos_power_write,
         .open = pm_qos_power_open,
         .release = pm_qos_power_release,
+        .llseek = noop_llseek,
 };
 
 /* unlocked internal variant */
@@ -120,10 +121,10 @@ static inline int pm_qos_get_value(struct pm_qos_object *o)
 
         switch (o->type) {
         case PM_QOS_MIN:
-                return plist_last(&o->requests)->prio;
+                return plist_first(&o->requests)->prio;
 
         case PM_QOS_MAX:
-                return plist_first(&o->requests)->prio;
+                return plist_last(&o->requests)->prio;
 
         default:
                 /* runtime check for not using enum */
@@ -212,15 +213,17 @@ EXPORT_SYMBOL_GPL(pm_qos_request_active);
 
 /**
  * pm_qos_add_request - inserts new qos request into the list
- * @pm_qos_class: identifies which list of qos request to us
+ * @dep: pointer to a preallocated handle
+ * @pm_qos_class: identifies which list of qos request to use
  * @value: defines the qos request
  *
  * This function inserts a new entry in the pm_qos_class list of requested qos
  * performance characteristics.  It recomputes the aggregate QoS expectations
- * for the pm_qos_class of parameters, and returns the pm_qos_request list
- * element as a handle for use in updating and removal.  Call needs to save
- * this handle for later use.
+ * for the pm_qos_class of parameters and initializes the pm_qos_request_list
+ * handle.  Caller needs to save this handle for later use in updates and
+ * removal.
  */
+
 void pm_qos_add_request(struct pm_qos_request_list *dep,
                         int pm_qos_class, s32 value)
 {
@@ -348,7 +351,7 @@ static int pm_qos_power_open(struct inode *inode, struct file *filp)
 
         pm_qos_class = find_pm_qos_object_by_minor(iminor(inode));
         if (pm_qos_class >= 0) {
-                struct pm_qos_request_list *req = kzalloc(GFP_KERNEL, sizeof(*req));
+               struct pm_qos_request_list *req = kzalloc(sizeof(*req), GFP_KERNEL);
                 if (!req)
                         return -ENOMEM;
 
@@ -387,14 +390,16 @@ static ssize_t pm_qos_power_write(struct file *filp, const char __user *buf,
         } else if (count == 11) { /* len('0x12345678/0') */
                 if (copy_from_user(ascii_value, buf, 11))
                         return -EFAULT;
+                if (strlen(ascii_value) != 10)
+                        return -EINVAL;
                 x = sscanf(ascii_value, "%x", &value);
                 if (x != 1)
                         return -EINVAL;
-                pr_debug(KERN_ERR "%s, %d, 0x%x\n", ascii_value, x, value);
+                pr_debug("%s, %d, 0x%x\n", ascii_value, x, value);
         } else
                 return -EINVAL;
 
-        pm_qos_req = (struct pm_qos_request_list *)filp->private_data;
+        pm_qos_req = filp->private_data;
         pm_qos_update_request(pm_qos_req, value);
 
         return count;
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index f66bdd33a6c6..05bb7173850e 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -16,13 +16,13 @@
  * siglock protection since other code may update expiration cache as
  * well.
  */
-void update_rlimit_cpu(unsigned long rlim_new)
+void update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new)
 {
         cputime_t cputime = secs_to_cputime(rlim_new);
 
-        spin_lock_irq(&current->sighand->siglock);
-        set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime, NULL);
-        spin_unlock_irq(&current->sighand->siglock);
+        spin_lock_irq(&task->sighand->siglock);
+        set_process_cpu_timer(task, CPUCLOCK_PROF, &cputime, NULL);
+        spin_unlock_irq(&task->sighand->siglock);
 }
 
 static int check_clock(const clockid_t which_clock)
@@ -37,13 +37,13 @@ static int check_clock(const clockid_t which_clock)
         if (pid == 0)
                 return 0;
 
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
         p = find_task_by_vpid(pid);
         if (!p || !(CPUCLOCK_PERTHREAD(which_clock) ?
-                   same_thread_group(p, current) : thread_group_leader(p))) {
+                   same_thread_group(p, current) : has_group_leader_pid(p))) {
                 error = -EINVAL;
         }
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
 
         return error;
 }
@@ -390,7 +390,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
 
         INIT_LIST_HEAD(&new_timer->it.cpu.entry);
 
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
         if (CPUCLOCK_PERTHREAD(new_timer->it_clock)) {
                 if (pid == 0) {
                         p = current;
@@ -404,7 +404,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
                         p = current->group_leader;
                 } else {
                         p = find_task_by_vpid(pid);
-                        if (p && !thread_group_leader(p))
+                        if (p && !has_group_leader_pid(p))
                                 p = NULL;
                 }
         }
@@ -414,7 +414,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
         } else {
                 ret = -EINVAL;
         }
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
 
         return ret;
 }
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index ca6066a6952e..a5aff3ebad38 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -86,6 +86,7 @@ config PM_SLEEP_SMP
         depends on SMP
         depends on ARCH_SUSPEND_POSSIBLE || ARCH_HIBERNATION_POSSIBLE
         depends on PM_SLEEP
+        select HOTPLUG
         select HOTPLUG_CPU
         default y
 
@@ -137,6 +138,8 @@ config SUSPEND_FREEZER
 config HIBERNATION
         bool "Hibernation (aka 'suspend to disk')"
         depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
+        select LZO_COMPRESS
+        select LZO_DECOMPRESS
         select SUSPEND_NVS if HAS_IOMEM
         ---help---
           Enable the suspend to disk (STD) functionality, which is usually
@@ -242,3 +245,21 @@ config PM_OPS
         bool
         depends on PM_SLEEP || PM_RUNTIME
         default y
+
+config ARCH_HAS_OPP
+        bool
+
+config PM_OPP
+        bool "Operating Performance Point (OPP) Layer library"
+        depends on PM
+        depends on ARCH_HAS_OPP
+        ---help---
+          SOCs have a standard set of tuples consisting of frequency and
+          voltage pairs that the device will support per voltage domain. This
+          is called Operating Performance Point or OPP. The actual definitions
+          of OPP varies over silicon within the same family of devices.
+
+          OPP layer organizes the data internally using device pointers
+          representing individual voltage domains and provides SOC
+          implementations a ready to use framework to manage OPPs.
+          For more information, read <file:Documentation/power/opp.txt>
diff --git a/kernel/power/block_io.c b/kernel/power/block_io.c
index 97024fd40cd5..83bbc7c02df9 100644
--- a/kernel/power/block_io.c
+++ b/kernel/power/block_io.c
@@ -28,7 +28,7 @@
 static int submit(int rw, struct block_device *bdev, sector_t sector,
                 struct page *page, struct bio **bio_chain)
 {
-        const int bio_rw = rw | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
+        const int bio_rw = rw | REQ_SYNC | REQ_UNPLUG;
         struct bio *bio;
 
         bio = bio_alloc(__GFP_WAIT | __GFP_HIGH, 1);
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index c77963938bca..048d0b514831 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -29,6 +29,7 @@
 #include "power.h"
 
 
+static int nocompress = 0;
 static int noresume = 0;
 static char resume_file[256] = CONFIG_PM_STD_PARTITION;
 dev_t swsusp_resume_device;
@@ -326,7 +327,6 @@ static int create_image(int platform_mode)
 int hibernation_snapshot(int platform_mode)
 {
         int error;
-        gfp_t saved_mask;
 
         error = platform_begin(platform_mode);
         if (error)
@@ -338,8 +338,7 @@ int hibernation_snapshot(int platform_mode)
                 goto Close;
 
         suspend_console();
-        hibernation_freeze_swap();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
         error = dpm_suspend_start(PMSG_FREEZE);
         if (error)
                 goto Recover_platform;
@@ -348,7 +347,10 @@ int hibernation_snapshot(int platform_mode)
                 goto Recover_platform;
 
         error = create_image(platform_mode);
-        /* Control returns here after successful restore */
+        /*
+         * Control returns here (1) after the image has been created or the
+         * image creation has failed and (2) after a successful restore.
+         */
 
  Resume_devices:
         /* We may need to release the preallocated image pages here. */
@@ -357,7 +359,10 @@ int hibernation_snapshot(int platform_mode)
 
         dpm_resume_end(in_suspend ?
                 (error ? PMSG_RECOVER : PMSG_THAW) : PMSG_RESTORE);
-        set_gfp_allowed_mask(saved_mask);
+
+        if (error || !in_suspend)
+                pm_restore_gfp_mask();
+
         resume_console();
  Close:
         platform_end(platform_mode);
@@ -452,17 +457,16 @@ static int resume_target_kernel(bool platform_mode)
 int hibernation_restore(int platform_mode)
 {
         int error;
-        gfp_t saved_mask;
 
         pm_prepare_console();
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
         error = dpm_suspend_start(PMSG_QUIESCE);
         if (!error) {
                 error = resume_target_kernel(platform_mode);
                 dpm_resume_end(PMSG_RECOVER);
         }
-        set_gfp_allowed_mask(saved_mask);
+        pm_restore_gfp_mask();
         resume_console();
         pm_restore_console();
         return error;
@@ -476,7 +480,6 @@ int hibernation_restore(int platform_mode)
 int hibernation_platform_enter(void)
 {
         int error;
-        gfp_t saved_mask;
 
         if (!hibernation_ops)
                 return -ENOSYS;
@@ -492,7 +495,6 @@ int hibernation_platform_enter(void)
 
         entering_platform_hibernation = true;
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
         error = dpm_suspend_start(PMSG_HIBERNATE);
         if (error) {
                 if (hibernation_ops->recover)
@@ -536,7 +538,6 @@ int hibernation_platform_enter(void)
  Resume_devices:
         entering_platform_hibernation = false;
         dpm_resume_end(PMSG_RESTORE);
-        set_gfp_allowed_mask(saved_mask);
         resume_console();
 
  Close:
@@ -639,11 +640,14 @@ int hibernate(void)
 
                 if (hibernation_mode == HIBERNATION_PLATFORM)
                         flags |= SF_PLATFORM_MODE;
+                if (nocompress)
+                        flags |= SF_NOCOMPRESS_MODE;
                 pr_debug("PM: writing image.\n");
                 error = swsusp_write(flags);
                 swsusp_free();
                 if (!error)
                         power_down();
+                pm_restore_gfp_mask();
         } else {
                 pr_debug("PM: Image restored successfully.\n");
         }
@@ -706,7 +710,7 @@ static int software_resume(void)
                 goto Unlock;
         }
 
-        pr_debug("PM: Checking image partition %s\n", resume_file);
+        pr_debug("PM: Checking hibernation image partition %s\n", resume_file);
 
         /* Check if the device is there */
         swsusp_resume_device = name_to_dev_t(resume_file);
@@ -731,10 +735,10 @@ static int software_resume(void)
         }
 
  Check_image:
-        pr_debug("PM: Resume from partition %d:%d\n",
+        pr_debug("PM: Hibernation image partition %d:%d present\n",
                 MAJOR(swsusp_resume_device), MINOR(swsusp_resume_device));
 
-        pr_debug("PM: Checking hibernation image.\n");
+        pr_debug("PM: Looking for hibernation image.\n");
         error = swsusp_check();
         if (error)
                 goto Unlock;
@@ -766,14 +770,14 @@ static int software_resume(void)
                 goto Done;
         }
 
-        pr_debug("PM: Reading hibernation image.\n");
+        pr_debug("PM: Loading hibernation image.\n");
 
         error = swsusp_read(&flags);
         swsusp_close(FMODE_READ);
         if (!error)
                 hibernation_restore(flags & SF_PLATFORM_MODE);
 
-        printk(KERN_ERR "PM: Restore failed, recovering.\n");
+        printk(KERN_ERR "PM: Failed to load hibernation image, recovering.\n");
         swsusp_free();
         thaw_processes();
  Done:
@@ -786,7 +790,7 @@ static int software_resume(void)
         /* For success case, the suspend path will release the lock */
  Unlock:
         mutex_unlock(&pm_mutex);
-        pr_debug("PM: Resume from disk failed.\n");
+        pr_debug("PM: Hibernation image not present or could not be loaded.\n");
         return error;
 close_finish:
         swsusp_close(FMODE_READ);
@@ -1005,6 +1009,15 @@ static int __init resume_offset_setup(char *str)
         return 1;
 }
 
+static int __init hibernate_setup(char *str)
+{
+        if (!strncmp(str, "noresume", 8))
+                noresume = 1;
+        else if (!strncmp(str, "nocompress", 10))
+                nocompress = 1;
+        return 1;
+}
+
 static int __init noresume_setup(char *str)
 {
         noresume = 1;
@@ -1014,3 +1027,4 @@ static int __init noresume_setup(char *str)
 __setup("noresume", noresume_setup);
 __setup("resume_offset=", resume_offset_setup);
 __setup("resume=", resume_setup);
+__setup("hibernate=", hibernate_setup);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 62b0bc6e4983..7b5db6a8561e 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -237,18 +237,18 @@ static ssize_t wakeup_count_show(struct kobject *kobj,
                                 struct kobj_attribute *attr,
                                 char *buf)
 {
-        unsigned long val;
+        unsigned int val;
 
-        return pm_get_wakeup_count(&val) ? sprintf(buf, "%lu\n", val) : -EINTR;
+        return pm_get_wakeup_count(&val) ? sprintf(buf, "%u\n", val) : -EINTR;
 }
 
 static ssize_t wakeup_count_store(struct kobject *kobj,
                                 struct kobj_attribute *attr,
                                 const char *buf, size_t n)
 {
-        unsigned long val;
+        unsigned int val;
 
-        if (sscanf(buf, "%lu", &val) == 1) {
+        if (sscanf(buf, "%u", &val) == 1) {
                 if (pm_save_wakeup_count(val))
                         return n;
         }
@@ -281,12 +281,30 @@ pm_trace_store(struct kobject *kobj, struct kobj_attribute *attr,
 }
 
 power_attr(pm_trace);
+
+static ssize_t pm_trace_dev_match_show(struct kobject *kobj,
+                                       struct kobj_attribute *attr,
+                                       char *buf)
+{
+        return show_trace_dev_match(buf, PAGE_SIZE);
+}
+
+static ssize_t
+pm_trace_dev_match_store(struct kobject *kobj, struct kobj_attribute *attr,
+                         const char *buf, size_t n)
+{
+        return -EINVAL;
+}
+
+power_attr(pm_trace_dev_match);
+
 #endif /* CONFIG_PM_TRACE */
 
 static struct attribute * g[] = {
         &state_attr.attr,
 #ifdef CONFIG_PM_TRACE
         &pm_trace_attr.attr,
+        &pm_trace_dev_match_attr.attr,
 #endif
 #ifdef CONFIG_PM_SLEEP
         &pm_async_attr.attr,
@@ -308,7 +326,7 @@ EXPORT_SYMBOL_GPL(pm_wq);
 
 static int __init pm_start_workqueue(void)
 {
-        pm_wq = create_freezeable_workqueue("pm");
+        pm_wq = alloc_workqueue("pm", WQ_FREEZEABLE, 0);
 
         return pm_wq ? 0 : -ENOMEM;
 }
@@ -321,6 +339,7 @@ static int __init pm_init(void)
         int error = pm_start_workqueue();
         if (error)
                 return error;
+        hibernate_image_size_init();
         power_kobj = kobject_create_and_add("power", NULL);
         if (!power_kobj)
                 return -ENOMEM;
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 006270fe382d..03634be55f62 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -14,6 +14,9 @@ struct swsusp_info {
 } __attribute__((aligned(PAGE_SIZE)));
 
 #ifdef CONFIG_HIBERNATION
+/* kernel/power/snapshot.c */
+extern void __init hibernate_image_size_init(void);
+
 #ifdef CONFIG_ARCH_HIBERNATION_HEADER
 /* Maximum size of architecture specific data in a hibernation header */
 #define MAX_ARCH_HEADER_SIZE    (sizeof(struct new_utsname) + 4)
@@ -49,7 +52,11 @@ static inline char *check_image_kernel(struct swsusp_info *info)
 extern int hibernation_snapshot(int platform_mode);
 extern int hibernation_restore(int platform_mode);
 extern int hibernation_platform_enter(void);
-#endif
+
+#else /* !CONFIG_HIBERNATION */
+
+static inline void hibernate_image_size_init(void) {}
+#endif /* !CONFIG_HIBERNATION */
 
 extern int pfn_is_nosave(unsigned long);
 
@@ -134,6 +141,7 @@ extern int swsusp_swap_in_use(void);
  * the image header.
  */
 #define SF_PLATFORM_MODE        1
+#define SF_NOCOMPRESS_MODE      2
 
 /* kernel/power/hibernate.c */
 extern int swsusp_check(void);
diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
index e8b337006276..d52359374e85 100644
--- a/kernel/power/poweroff.c
+++ b/kernel/power/poweroff.c
@@ -24,7 +24,7 @@ static void do_poweroff(struct work_struct *dummy)
 
 static DECLARE_WORK(poweroff_work, do_poweroff);
 
-static void handle_poweroff(int key, struct tty_struct *tty)
+static void handle_poweroff(int key)
 {
         /* run sysrq poweroff on boot cpu */
         schedule_work_on(cpumask_first(cpu_online_mask), &poweroff_work);
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 028a99598f49..e50b4c1b2a0f 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -40,6 +40,7 @@ static int try_to_freeze_tasks(bool sig_only)
         struct timeval start, end;
         u64 elapsed_csecs64;
         unsigned int elapsed_csecs;
+        bool wakeup = false;
 
         do_gettimeofday(&start);
 
@@ -78,6 +79,11 @@ static int try_to_freeze_tasks(bool sig_only)
                 if (!todo || time_after(jiffies, end_time))
                         break;
 
+                if (!pm_check_wakeup_events()) {
+                        wakeup = true;
+                        break;
+                }
+
                 /*
                  * We need to retry, but first give the freezing tasks some
                  * time to enter the regrigerator.
@@ -97,8 +103,9 @@ static int try_to_freeze_tasks(bool sig_only)
                  * but it cleans up leftover PF_FREEZE requests.
                  */
                 printk("\n");
-                printk(KERN_ERR "Freezing of tasks failed after %d.%02d seconds "
+                printk(KERN_ERR "Freezing of tasks %s after %d.%02d seconds "
                        "(%d tasks refusing to freeze, wq_busy=%d):\n",
+                       wakeup ? "aborted" : "failed",
                        elapsed_csecs / 100, elapsed_csecs % 100,
                        todo - wq_busy, wq_busy);
 
@@ -107,7 +114,7 @@ static int try_to_freeze_tasks(bool sig_only)
                 read_lock(&tasklist_lock);
                 do_each_thread(g, p) {
                         task_lock(p);
-                        if (freezing(p) && !freezer_should_skip(p))
+                        if (!wakeup && freezing(p) && !freezer_should_skip(p))
                                 sched_show_task(p);
                         cancel_freezing(p);
                         task_unlock(p);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 5e7edfb05e66..0dac75ea4456 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -46,7 +46,12 @@ static void swsusp_unset_page_forbidden(struct page *);
  * size will not exceed N bytes, but if that is impossible, it will
  * try to create the smallest image possible.
  */
-unsigned long image_size = 500 * 1024 * 1024;
+unsigned long image_size;
+
+void __init hibernate_image_size_init(void)
+{
+        image_size = ((totalram_pages * 2) / 5) * PAGE_SIZE;
+}
 
 /* List of PBEs needed for restoring the pages that were allocated before
  * the suspend and included in the suspend image, but have also been
@@ -979,8 +984,8 @@ static void copy_data_page(unsigned long dst_pfn, unsigned long src_pfn)
                 src = kmap_atomic(s_page, KM_USER0);
                 dst = kmap_atomic(d_page, KM_USER1);
                 do_copy_page(dst, src);
-                kunmap_atomic(src, KM_USER0);
                 kunmap_atomic(dst, KM_USER1);
+                kunmap_atomic(src, KM_USER0);
         } else {
                 if (PageHighMem(d_page)) {
                         /* Page pointed to by src may contain some kernel
@@ -988,7 +993,7 @@ static void copy_data_page(unsigned long dst_pfn, unsigned long src_pfn)
                          */
                         safe_copy_page(buffer, s_page);
                         dst = kmap_atomic(d_page, KM_USER0);
-                        memcpy(dst, buffer, PAGE_SIZE);
+                        copy_page(dst, buffer);
                         kunmap_atomic(dst, KM_USER0);
                 } else {
                         safe_copy_page(page_address(d_page), s_page);
@@ -1086,7 +1091,6 @@ void swsusp_free(void)
         buffer = NULL;
         alloc_normal = 0;
         alloc_highmem = 0;
-        hibernation_thaw_swap();
 }
 
 /* Helper functions used for the shrinking of memory. */
@@ -1122,9 +1126,19 @@ static unsigned long preallocate_image_pages(unsigned long nr_pages, gfp_t mask)
         return nr_alloc;
 }
 
-static unsigned long preallocate_image_memory(unsigned long nr_pages)
+static unsigned long preallocate_image_memory(unsigned long nr_pages,
+                                              unsigned long avail_normal)
 {
-        return preallocate_image_pages(nr_pages, GFP_IMAGE);
+        unsigned long alloc;
+
+        if (avail_normal <= alloc_normal)
+                return 0;
+
+        alloc = avail_normal - alloc_normal;
+        if (nr_pages < alloc)
+                alloc = nr_pages;
+
+        return preallocate_image_pages(alloc, GFP_IMAGE);
 }
 
 #ifdef CONFIG_HIGHMEM
@@ -1170,15 +1184,22 @@ static inline unsigned long preallocate_highmem_fraction(unsigned long nr_pages,
  */
 static void free_unnecessary_pages(void)
 {
-        unsigned long save_highmem, to_free_normal, to_free_highmem;
+        unsigned long save, to_free_normal, to_free_highmem;
 
-        to_free_normal = alloc_normal - count_data_pages();
-        save_highmem = count_highmem_pages();
-        if (alloc_highmem > save_highmem) {
-                to_free_highmem = alloc_highmem - save_highmem;
+        save = count_data_pages();
+        if (alloc_normal >= save) {
+                to_free_normal = alloc_normal - save;
+                save = 0;
+        } else {
+                to_free_normal = 0;
+                save -= alloc_normal;
+        }
+        save += count_highmem_pages();
+        if (alloc_highmem >= save) {
+                to_free_highmem = alloc_highmem - save;
         } else {
                 to_free_highmem = 0;
-                to_free_normal -= save_highmem - alloc_highmem;
+                to_free_normal -= save - alloc_highmem;
         }
 
         memory_bm_position_reset(&copy_bm);
@@ -1259,7 +1280,7 @@ int hibernate_preallocate_memory(void)
 {
         struct zone *zone;
         unsigned long saveable, size, max_size, count, highmem, pages = 0;
-        unsigned long alloc, save_highmem, pages_highmem;
+        unsigned long alloc, save_highmem, pages_highmem, avail_normal;
         struct timeval start, stop;
         int error;
 
@@ -1296,26 +1317,38 @@ int hibernate_preallocate_memory(void)
                 else
                         count += zone_page_state(zone, NR_FREE_PAGES);
         }
+        avail_normal = count;
         count += highmem;
         count -= totalreserve_pages;
 
         /* Compute the maximum number of saveable pages to leave in memory. */
         max_size = (count - (size + PAGES_FOR_IO)) / 2 - 2 * SPARE_PAGES;
+        /* Compute the desired number of image pages specified by image_size. */
         size = DIV_ROUND_UP(image_size, PAGE_SIZE);
         if (size > max_size)
                 size = max_size;
         /*
-         * If the maximum is not less than the current number of saveable pages
-         * in memory, allocate page frames for the image and we're done.
+         * If the desired number of image pages is at least as large as the
+         * current number of saveable pages in memory, allocate page frames for
+         * the image and we're done.
          */
         if (size >= saveable) {
                 pages = preallocate_image_highmem(save_highmem);
-                pages += preallocate_image_memory(saveable - pages);
+                pages += preallocate_image_memory(saveable - pages, avail_normal);
                 goto out;
         }
 
         /* Estimate the minimum size of the image. */
         pages = minimum_image_size(saveable);
+        /*
+         * To avoid excessive pressure on the normal zone, leave room in it to
+         * accommodate an image of the minimum size (unless it's already too
+         * small, in which case don't preallocate pages from it at all).
+         */
+        if (avail_normal > pages)
+                avail_normal -= pages;
+        else
+                avail_normal = 0;
         if (size < pages)
                 size = min_t(unsigned long, pages, max_size);
 
@@ -1336,16 +1369,34 @@ int hibernate_preallocate_memory(void)
          */
         pages_highmem = preallocate_image_highmem(highmem / 2);
         alloc = (count - max_size) - pages_highmem;
-        pages = preallocate_image_memory(alloc);
-        if (pages < alloc)
-                goto err_out;
-        size = max_size - size;
-        alloc = size;
-        size = preallocate_highmem_fraction(size, highmem, count);
-        pages_highmem += size;
-        alloc -= size;
-        pages += preallocate_image_memory(alloc);
-        pages += pages_highmem;
+        pages = preallocate_image_memory(alloc, avail_normal);
+        if (pages < alloc) {
+                /* We have exhausted non-highmem pages, try highmem. */
+                alloc -= pages;
+                pages += pages_highmem;
+                pages_highmem = preallocate_image_highmem(alloc);
+                if (pages_highmem < alloc)
+                        goto err_out;
+                pages += pages_highmem;
+                /*
+                 * size is the desired number of saveable pages to leave in
+                 * memory, so try to preallocate (all memory - size) pages.
+                 */
+                alloc = (count - pages) - size;
+                pages += preallocate_image_highmem(alloc);
+        } else {
+                /*
+                 * There are approximately max_size saveable pages at this point
+                 * and we want to reduce this number down to size.
+                 */
+                alloc = max_size - size;
+                size = preallocate_highmem_fraction(alloc, highmem, count);
+                pages_highmem += size;
+                alloc -= size;
+                size = preallocate_image_memory(alloc, avail_normal);
+                pages_highmem += preallocate_image_highmem(alloc - size);
+                pages += pages_highmem + size;
+        }
 
         /*
          * We only need as many page frames for the image as there are saveable
@@ -1636,7 +1687,7 @@ int snapshot_read_next(struct snapshot_handle *handle)
                 memory_bm_position_reset(&orig_bm);
                 memory_bm_position_reset(&copy_bm);
         } else if (handle->cur <= nr_meta_pages) {
-                memset(buffer, 0, PAGE_SIZE);
+                clear_page(buffer);
                 pack_pfns(buffer, &orig_bm);
         } else {
                 struct page *page;
@@ -1650,7 +1701,7 @@ int snapshot_read_next(struct snapshot_handle *handle)
                         void *kaddr;
 
                         kaddr = kmap_atomic(page, KM_USER0);
-                        memcpy(buffer, kaddr, PAGE_SIZE);
+                        copy_page(buffer, kaddr);
                         kunmap_atomic(kaddr, KM_USER0);
                         handle->buffer = buffer;
                 } else {
@@ -1933,7 +1984,7 @@ static void copy_last_highmem_page(void)
                 void *dst;
 
                 dst = kmap_atomic(last_highmem_page, KM_USER0);
-                memcpy(dst, buffer, PAGE_SIZE);
+                copy_page(dst, buffer);
                 kunmap_atomic(dst, KM_USER0);
                 last_highmem_page = NULL;
         }
@@ -2219,11 +2270,11 @@ swap_two_pages_data(struct page *p1, struct page *p2, void *buf)
 
         kaddr1 = kmap_atomic(p1, KM_USER0);
         kaddr2 = kmap_atomic(p2, KM_USER1);
-        memcpy(buf, kaddr1, PAGE_SIZE);
-        memcpy(kaddr1, kaddr2, PAGE_SIZE);
-        memcpy(kaddr2, buf, PAGE_SIZE);
-        kunmap_atomic(kaddr1, KM_USER0);
+        copy_page(buf, kaddr1);
+        copy_page(kaddr1, kaddr2);
+        copy_page(kaddr2, buf);
         kunmap_atomic(kaddr2, KM_USER1);
+        kunmap_atomic(kaddr1, KM_USER0);
 }
 
 /**
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 7335952ee473..ecf770509d0d 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -197,7 +197,6 @@ static int suspend_enter(suspend_state_t state)
 int suspend_devices_and_enter(suspend_state_t state)
 {
         int error;
-        gfp_t saved_mask;
 
         if (!suspend_ops)
                 return -ENOSYS;
@@ -208,7 +207,7 @@ int suspend_devices_and_enter(suspend_state_t state)
                         goto Close;
         }
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
         suspend_test_start();
         error = dpm_suspend_start(PMSG_SUSPEND);
         if (error) {
@@ -225,7 +224,7 @@ int suspend_devices_and_enter(suspend_state_t state)
         suspend_test_start();
         dpm_resume_end(PMSG_RESUME);
         suspend_test_finish("resume devices");
-        set_gfp_allowed_mask(saved_mask);
+        pm_restore_gfp_mask();
         resume_console();
  Close:
         if (suspend_ops->end)
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 5d0059eed3e4..8c7e4832b9be 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -6,6 +6,7 @@
  *
  * Copyright (C) 1998,2001-2005 Pavel Machek <pavel@ucw.cz>
  * Copyright (C) 2006 Rafael J. Wysocki <rjw@sisk.pl>
+ * Copyright (C) 2010 Bojan Smojver <bojan@rexursive.com>
  *
  * This file is released under the GPLv2.
  *
@@ -24,10 +25,12 @@
 #include <linux/swapops.h>
 #include <linux/pm.h>
 #include <linux/slab.h>
+#include <linux/lzo.h>
+#include <linux/vmalloc.h>
 
 #include "power.h"
 
-#define SWSUSP_SIG      "S1SUSPEND"
+#define HIBERNATE_SIG   "S1SUSPEND"
 
 /*
  *      The swap map is a data structure used for keeping track of each page
@@ -136,10 +139,10 @@ sector_t alloc_swapdev_block(int swap)
 {
         unsigned long offset;
 
-        offset = swp_offset(get_swap_for_hibernation(swap));
+        offset = swp_offset(get_swap_page_of_type(swap));
         if (offset) {
                 if (swsusp_extents_insert(offset))
-                        swap_free_for_hibernation(swp_entry(swap, offset));
+                        swap_free(swp_entry(swap, offset));
                 else
                         return swapdev_block(swap, offset);
         }
@@ -163,7 +166,7 @@ void free_all_swap_pages(int swap)
                 ext = container_of(node, struct swsusp_extent, node);
                 rb_erase(node, &swsusp_extents);
                 for (offset = ext->start; offset <= ext->end; offset++)
-                        swap_free_for_hibernation(swp_entry(swap, offset));
+                        swap_free(swp_entry(swap, offset));
 
                 kfree(ext);
         }
@@ -193,7 +196,7 @@ static int mark_swapfiles(struct swap_map_handle *handle, unsigned int flags)
         if (!memcmp("SWAP-SPACE",swsusp_header->sig, 10) ||
             !memcmp("SWAPSPACE2",swsusp_header->sig, 10)) {
                 memcpy(swsusp_header->orig_sig,swsusp_header->sig, 10);
-                memcpy(swsusp_header->sig,SWSUSP_SIG, 10);
+                memcpy(swsusp_header->sig, HIBERNATE_SIG, 10);
                 swsusp_header->image = handle->first_sector;
                 swsusp_header->flags = flags;
                 error = hib_bio_write_page(swsusp_resume_block,
@@ -249,7 +252,7 @@ static int write_page(void *buf, sector_t offset, struct bio **bio_chain)
         if (bio_chain) {
                 src = (void *)__get_free_page(__GFP_WAIT | __GFP_HIGH);
                 if (src) {
-                        memcpy(src, buf, PAGE_SIZE);
+                        copy_page(src, buf);
                 } else {
                         WARN_ON_ONCE(1);
                         bio_chain = NULL;       /* Go synchronous */
@@ -323,7 +326,7 @@ static int swap_write_page(struct swap_map_handle *handle, void *buf,
                 error = write_page(handle->cur, handle->cur_swap, NULL);
                 if (error)
                         goto out;
-                memset(handle->cur, 0, PAGE_SIZE);
+                clear_page(handle->cur);
                 handle->cur_swap = offset;
                 handle->k = 0;
         }
@@ -357,6 +360,18 @@ static int swap_writer_finish(struct swap_map_handle *handle,
         return error;
 }
 
+/* We need to remember how much compressed data we need to read. */
+#define LZO_HEADER      sizeof(size_t)
+
+/* Number of pages/bytes we'll compress at one time. */
+#define LZO_UNC_PAGES   32
+#define LZO_UNC_SIZE    (LZO_UNC_PAGES * PAGE_SIZE)
+
+/* Number of pages/bytes we need for compressed data (worst case). */
+#define LZO_CMP_PAGES   DIV_ROUND_UP(lzo1x_worst_compress(LZO_UNC_SIZE) + \
+                                     LZO_HEADER, PAGE_SIZE)
+#define LZO_CMP_SIZE    (LZO_CMP_PAGES * PAGE_SIZE)
+
 /**
  *      save_image - save the suspend image data
  */
@@ -404,6 +419,137 @@ static int save_image(struct swap_map_handle *handle,
         return ret;
 }
 
+
+/**
+ * save_image_lzo - Save the suspend image data compressed with LZO.
+ * @handle: Swap mam handle to use for saving the image.
+ * @snapshot: Image to read data from.
+ * @nr_to_write: Number of pages to save.
+ */
+static int save_image_lzo(struct swap_map_handle *handle,
+                          struct snapshot_handle *snapshot,
+                          unsigned int nr_to_write)
+{
+        unsigned int m;
+        int ret = 0;
+        int nr_pages;
+        int err2;
+        struct bio *bio;
+        struct timeval start;
+        struct timeval stop;
+        size_t off, unc_len, cmp_len;
+        unsigned char *unc, *cmp, *wrk, *page;
+
+        page = (void *)__get_free_page(__GFP_WAIT | __GFP_HIGH);
+        if (!page) {
+                printk(KERN_ERR "PM: Failed to allocate LZO page\n");
+                return -ENOMEM;
+        }
+
+        wrk = vmalloc(LZO1X_1_MEM_COMPRESS);
+        if (!wrk) {
+                printk(KERN_ERR "PM: Failed to allocate LZO workspace\n");
+                free_page((unsigned long)page);
+                return -ENOMEM;
+        }
+
+        unc = vmalloc(LZO_UNC_SIZE);
+        if (!unc) {
+                printk(KERN_ERR "PM: Failed to allocate LZO uncompressed\n");
+                vfree(wrk);
+                free_page((unsigned long)page);
+                return -ENOMEM;
+        }
+
+        cmp = vmalloc(LZO_CMP_SIZE);
+        if (!cmp) {
+                printk(KERN_ERR "PM: Failed to allocate LZO compressed\n");
+                vfree(unc);
+                vfree(wrk);
+                free_page((unsigned long)page);
+                return -ENOMEM;
+        }
+
+        printk(KERN_INFO
+                "PM: Compressing and saving image data (%u pages) ...     ",
+                nr_to_write);
+        m = nr_to_write / 100;
+        if (!m)
+                m = 1;
+        nr_pages = 0;
+        bio = NULL;
+        do_gettimeofday(&start);
+        for (;;) {
+                for (off = 0; off < LZO_UNC_SIZE; off += PAGE_SIZE) {
+                        ret = snapshot_read_next(snapshot);
+                        if (ret < 0)
+                                goto out_finish;
+
+                        if (!ret)
+                                break;
+
+                        memcpy(unc + off, data_of(*snapshot), PAGE_SIZE);
+
+                        if (!(nr_pages % m))
+                                printk(KERN_CONT "\b\b\b\b%3d%%", nr_pages / m);
+                        nr_pages++;
+                }
+
+                if (!off)
+                        break;
+
+                unc_len = off;
+                ret = lzo1x_1_compress(unc, unc_len,
+                                       cmp + LZO_HEADER, &cmp_len, wrk);
+                if (ret < 0) {
+                        printk(KERN_ERR "PM: LZO compression failed\n");
+                        break;
+                }
+
+                if (unlikely(!cmp_len ||
+                             cmp_len > lzo1x_worst_compress(unc_len))) {
+                        printk(KERN_ERR "PM: Invalid LZO compressed length\n");
+                        ret = -1;
+                        break;
+                }
+
+                *(size_t *)cmp = cmp_len;
+
+                /*
+                 * Given we are writing one page at a time to disk, we copy
+                 * that much from the buffer, although the last bit will likely
+                 * be smaller than full page. This is OK - we saved the length
+                 * of the compressed data, so any garbage at the end will be
+                 * discarded when we read it.
+                 */
+                for (off = 0; off < LZO_HEADER + cmp_len; off += PAGE_SIZE) {
+                        memcpy(page, cmp + off, PAGE_SIZE);
+
+                        ret = swap_write_page(handle, page, &bio);
+                        if (ret)
+                                goto out_finish;
+                }
+        }
+
+out_finish:
+        err2 = hib_wait_on_bio_chain(&bio);
+        do_gettimeofday(&stop);
+        if (!ret)
+                ret = err2;
+        if (!ret)
+                printk(KERN_CONT "\b\b\b\bdone\n");
+        else
+                printk(KERN_CONT "\n");
+        swsusp_show_speed(&start, &stop, nr_to_write, "Wrote");
+
+        vfree(cmp);
+        vfree(unc);
+        vfree(wrk);
+        free_page((unsigned long)page);
+
+        return ret;
+}
+
 /**
  *      enough_swap - Make sure we have enough swap to save the image.
  *
@@ -411,12 +557,16 @@ static int save_image(struct swap_map_handle *handle,
  *      space avaiable from the resume partition.
  */
 
-static int enough_swap(unsigned int nr_pages)
+static int enough_swap(unsigned int nr_pages, unsigned int flags)
 {
         unsigned int free_swap = count_swap_pages(root_swap, 1);
+        unsigned int required;
 
         pr_debug("PM: Free swap pages: %u\n", free_swap);
-        return free_swap > nr_pages + PAGES_FOR_IO;
+
+        required = PAGES_FOR_IO + ((flags & SF_NOCOMPRESS_MODE) ?
+                nr_pages : (nr_pages * LZO_CMP_PAGES) / LZO_UNC_PAGES + 1);
+        return free_swap > required;
 }
 
 /**
@@ -443,7 +593,7 @@ int swsusp_write(unsigned int flags)
                 printk(KERN_ERR "PM: Cannot get swap writer\n");
                 return error;
         }
-        if (!enough_swap(pages)) {
+        if (!enough_swap(pages, flags)) {
                 printk(KERN_ERR "PM: Not enough free swap\n");
                 error = -ENOSPC;
                 goto out_finish;
@@ -458,8 +608,11 @@ int swsusp_write(unsigned int flags)
         }
         header = (struct swsusp_info *)data_of(snapshot);
         error = swap_write_page(&handle, header, NULL);
-        if (!error)
-                error = save_image(&handle, &snapshot, pages - 1);
+        if (!error) {
+                error = (flags & SF_NOCOMPRESS_MODE) ?
+                        save_image(&handle, &snapshot, pages - 1) :
+                        save_image_lzo(&handle, &snapshot, pages - 1);
+        }
 out_finish:
         error = swap_writer_finish(&handle, flags, error);
         return error;
@@ -590,6 +743,149 @@ static int load_image(struct swap_map_handle *handle,
 }
 
 /**
+ * load_image_lzo - Load compressed image data and decompress them with LZO.
+ * @handle: Swap map handle to use for loading data.
+ * @snapshot: Image to copy uncompressed data into.
+ * @nr_to_read: Number of pages to load.
+ */
+static int load_image_lzo(struct swap_map_handle *handle,
+                          struct snapshot_handle *snapshot,
+                          unsigned int nr_to_read)
+{
+        unsigned int m;
+        int error = 0;
+        struct bio *bio;
+        struct timeval start;
+        struct timeval stop;
+        unsigned nr_pages;
+        size_t i, off, unc_len, cmp_len;
+        unsigned char *unc, *cmp, *page[LZO_CMP_PAGES];
+
+        for (i = 0; i < LZO_CMP_PAGES; i++) {
+                page[i] = (void *)__get_free_page(__GFP_WAIT | __GFP_HIGH);
+                if (!page[i]) {
+                        printk(KERN_ERR "PM: Failed to allocate LZO page\n");
+
+                        while (i)
+                                free_page((unsigned long)page[--i]);
+
+                        return -ENOMEM;
+                }
+        }
+
+        unc = vmalloc(LZO_UNC_SIZE);
+        if (!unc) {
+                printk(KERN_ERR "PM: Failed to allocate LZO uncompressed\n");
+
+                for (i = 0; i < LZO_CMP_PAGES; i++)
+                        free_page((unsigned long)page[i]);
+
+                return -ENOMEM;
+        }
+
+        cmp = vmalloc(LZO_CMP_SIZE);
+        if (!cmp) {
+                printk(KERN_ERR "PM: Failed to allocate LZO compressed\n");
+
+                vfree(unc);
+                for (i = 0; i < LZO_CMP_PAGES; i++)
+                        free_page((unsigned long)page[i]);
+
+                return -ENOMEM;
+        }
+
+        printk(KERN_INFO
+                "PM: Loading and decompressing image data (%u pages) ...     ",
+                nr_to_read);
+        m = nr_to_read / 100;
+        if (!m)
+                m = 1;
+        nr_pages = 0;
+        bio = NULL;
+        do_gettimeofday(&start);
+
+        error = snapshot_write_next(snapshot);
+        if (error <= 0)
+                goto out_finish;
+
+        for (;;) {
+                error = swap_read_page(handle, page[0], NULL); /* sync */
+                if (error)
+                        break;
+
+                cmp_len = *(size_t *)page[0];
+                if (unlikely(!cmp_len ||
+                             cmp_len > lzo1x_worst_compress(LZO_UNC_SIZE))) {
+                        printk(KERN_ERR "PM: Invalid LZO compressed length\n");
+                        error = -1;
+                        break;
+                }
+
+                for (off = PAGE_SIZE, i = 1;
+                     off < LZO_HEADER + cmp_len; off += PAGE_SIZE, i++) {
+                        error = swap_read_page(handle, page[i], &bio);
+                        if (error)
+                                goto out_finish;
+                }
+
+                error = hib_wait_on_bio_chain(&bio); /* need all data now */
+                if (error)
+                        goto out_finish;
+
+                for (off = 0, i = 0;
+                     off < LZO_HEADER + cmp_len; off += PAGE_SIZE, i++) {
+                        memcpy(cmp + off, page[i], PAGE_SIZE);
+                }
+
+                unc_len = LZO_UNC_SIZE;
+                error = lzo1x_decompress_safe(cmp + LZO_HEADER, cmp_len,
+                                              unc, &unc_len);
+                if (error < 0) {
+                        printk(KERN_ERR "PM: LZO decompression failed\n");
+                        break;
+                }
+
+                if (unlikely(!unc_len ||
+                             unc_len > LZO_UNC_SIZE ||
+                             unc_len & (PAGE_SIZE - 1))) {
+                        printk(KERN_ERR "PM: Invalid LZO uncompressed length\n");
+                        error = -1;
+                        break;
+                }
+
+                for (off = 0; off < unc_len; off += PAGE_SIZE) {
+                        memcpy(data_of(*snapshot), unc + off, PAGE_SIZE);
+
+                        if (!(nr_pages % m))
+                                printk("\b\b\b\b%3d%%", nr_pages / m);
+                        nr_pages++;
+
+                        error = snapshot_write_next(snapshot);
+                        if (error <= 0)
+                                goto out_finish;
+                }
+        }
+
+out_finish:
+        do_gettimeofday(&stop);
+        if (!error) {
+                printk("\b\b\b\bdone\n");
+                snapshot_write_finalize(snapshot);
+                if (!snapshot_image_loaded(snapshot))
+                        error = -ENODATA;
+        } else
+                printk("\n");
+        swsusp_show_speed(&start, &stop, nr_to_read, "Read");
+
+        vfree(cmp);
+        vfree(unc);
+        for (i = 0; i < LZO_CMP_PAGES; i++)
+                free_page((unsigned long)page[i]);
+
+        return error;
+}
+
+/**
  *      swsusp_read - read the hibernation image.
  *      @flags_p: flags passed by the "frozen" kernel in the image header should
  *                be written into this memeory location
@@ -612,8 +908,11 @@ int swsusp_read(unsigned int *flags_p)
                 goto end;
         if (!error)
                 error = swap_read_page(&handle, header, NULL);
-        if (!error)
-                error = load_image(&handle, &snapshot, header->pages - 1);
+        if (!error) {
+                error = (*flags_p & SF_NOCOMPRESS_MODE) ?
+                        load_image(&handle, &snapshot, header->pages - 1) :
+                        load_image_lzo(&handle, &snapshot, header->pages - 1);
+        }
         swap_reader_finish(&handle);
 end:
         if (!error)
@@ -634,13 +933,13 @@ int swsusp_check(void)
         hib_resume_bdev = open_by_devnum(swsusp_resume_device, FMODE_READ);
         if (!IS_ERR(hib_resume_bdev)) {
                 set_blocksize(hib_resume_bdev, PAGE_SIZE);
-                memset(swsusp_header, 0, PAGE_SIZE);
+                clear_page(swsusp_header);
                 error = hib_bio_read_page(swsusp_resume_block,
                                         swsusp_header, NULL);
                 if (error)
                         goto put;
 
-                if (!memcmp(SWSUSP_SIG, swsusp_header->sig, 10)) {
+                if (!memcmp(HIBERNATE_SIG, swsusp_header->sig, 10)) {
                         memcpy(swsusp_header->sig, swsusp_header->orig_sig, 10);
                         /* Reset swap signature now */
                         error = hib_bio_write_page(swsusp_resume_block,
@@ -653,13 +952,13 @@ put:
                 if (error)
                         blkdev_put(hib_resume_bdev, FMODE_READ);
                 else
-                        pr_debug("PM: Signature found, resuming\n");
+                        pr_debug("PM: Image signature found, resuming\n");
         } else {
                 error = PTR_ERR(hib_resume_bdev);
         }
 
         if (error)
-                pr_debug("PM: Error %d checking image file\n", error);
+                pr_debug("PM: Image not found (code %d)\n", error);
 
         return error;
 }
diff --git a/kernel/power/user.c b/kernel/power/user.c
index e819e17877ca..c36c3b9e8a84 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -137,7 +137,7 @@ static int snapshot_release(struct inode *inode, struct file *filp)
         free_all_swap_pages(data->swap);
         if (data->frozen)
                 thaw_processes();
-        pm_notifier_call_chain(data->mode == O_WRONLY ?
+        pm_notifier_call_chain(data->mode == O_RDONLY ?
                         PM_POST_HIBERNATION : PM_POST_RESTORE);
         atomic_inc(&snapshot_device_available);
 
@@ -263,6 +263,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
         case SNAPSHOT_UNFREEZE:
                 if (!data->frozen || data->ready)
                         break;
+                pm_restore_gfp_mask();
                 thaw_processes();
                 usermodehelper_enable();
                 data->frozen = 0;
@@ -275,6 +276,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                         error = -EPERM;
                         break;
                 }
+                pm_restore_gfp_mask();
                 error = hibernation_snapshot(data->platform_support);
                 if (!error)
                         error = put_user(in_suspend, (int __user *)arg);
diff --git a/kernel/printk.c b/kernel/printk.c
index 8fe465ac008a..a23315dc4498 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -85,7 +85,7 @@ EXPORT_SYMBOL(oops_in_progress);
  * provides serialisation for access to the entire console
  * driver system.
  */
-static DECLARE_MUTEX(console_sem);
+static DEFINE_SEMAPHORE(console_sem);
 struct console *console_drivers;
 EXPORT_SYMBOL_GPL(console_drivers);
 
@@ -210,7 +210,7 @@ __setup("log_buf_len=", log_buf_len_setup);
 
 #ifdef CONFIG_BOOT_PRINTK_DELAY
 
-static unsigned int boot_delay; /* msecs delay after each printk during bootup */
+static int boot_delay; /* msecs delay after each printk during bootup */
 static unsigned long long loops_per_msec;       /* based on boot_delay */
 
 static int __init boot_delay_setup(char *str)
@@ -261,6 +261,12 @@ static inline void boot_delay_msec(void)
 }
 #endif
 
+#ifdef CONFIG_SECURITY_DMESG_RESTRICT
+int dmesg_restrict = 1;
+#else
+int dmesg_restrict;
+#endif
+
 int do_syslog(int type, char __user *buf, int len, bool from_file)
 {
         unsigned i, j, limit, count;
@@ -268,7 +274,20 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
         char c;
         int error = 0;
 
-        error = security_syslog(type, from_file);
+        /*
+         * If this is from /proc/kmsg we only do the capabilities checks
+         * at open time.
+         */
+        if (type == SYSLOG_ACTION_OPEN || !from_file) {
+                if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                if ((type != SYSLOG_ACTION_READ_ALL &&
+                     type != SYSLOG_ACTION_SIZE_BUFFER) &&
+                    !capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+        }
+
+        error = security_syslog(type);
         if (error)
                 return error;
 
@@ -556,7 +575,7 @@ static void zap_locks(void)
         /* If a crash is occurring, make sure we can't deadlock */
         spin_lock_init(&logbuf_lock);
         /* And make sure that we print immediately */
-        init_MUTEX(&console_sem);
+        sema_init(&console_sem, 1);
 }
 
 #if defined(CONFIG_PRINTK_TIME)
@@ -647,6 +666,7 @@ static inline int can_use_console(unsigned int cpu)
  * released but interrupts still disabled.
  */
 static int acquire_console_semaphore_for_printk(unsigned int cpu)
+        __releases(&logbuf_lock)
 {
         int retval = 0;
 
@@ -1062,13 +1082,15 @@ void printk_tick(void)
 
 int printk_needs_cpu(int cpu)
 {
+        if (unlikely(cpu_is_offline(cpu)))
+                printk_tick();
         return per_cpu(printk_pending, cpu);
 }
 
 void wake_up_klogd(void)
 {
         if (waitqueue_active(&log_wait))
-                __raw_get_cpu_var(printk_pending) = 1;
+                this_cpu_write(printk_pending, 1);
 }
 
 /**
@@ -1511,7 +1533,7 @@ int kmsg_dump_unregister(struct kmsg_dumper *dumper)
 }
 EXPORT_SYMBOL_GPL(kmsg_dump_unregister);
 
-static const char const *kmsg_reasons[] = {
+static const char * const kmsg_reasons[] = {
         [KMSG_DUMP_OOPS]        = "oops",
         [KMSG_DUMP_PANIC]       = "panic",
         [KMSG_DUMP_KEXEC]       = "kexec",
diff --git a/kernel/profile.c b/kernel/profile.c
index b22a899934cc..66f841b7fbd3 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -555,6 +555,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
 static const struct file_operations proc_profile_operations = {
         .read           = read_profile,
         .write          = write_profile,
+        .llseek         = default_llseek,
 };
 
 #ifdef CONFIG_SMP
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 74a3d693c196..99bbaa3e5b0d 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -181,7 +181,7 @@ int ptrace_attach(struct task_struct *task)
          * under ptrace.
          */
         retval = -ERESTARTNOINTR;
-        if (mutex_lock_interruptible(&task->cred_guard_mutex))
+        if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
                 goto out;
 
         task_lock(task);
@@ -208,7 +208,7 @@ int ptrace_attach(struct task_struct *task)
 unlock_tasklist:
         write_unlock_irq(&tasklist_lock);
 unlock_creds:
-        mutex_unlock(&task->cred_guard_mutex);
+        mutex_unlock(&task->signal->cred_guard_mutex);
 out:
         return retval;
 }
@@ -324,26 +324,34 @@ int ptrace_detach(struct task_struct *child, unsigned int data)
 }
 
 /*
- * Detach all tasks we were using ptrace on.
+ * Detach all tasks we were using ptrace on. Called with tasklist held
+ * for writing, and returns with it held too. But note it can release
+ * and reacquire the lock.
  */
 void exit_ptrace(struct task_struct *tracer)
+        __releases(&tasklist_lock)
+        __acquires(&tasklist_lock)
 {
         struct task_struct *p, *n;
         LIST_HEAD(ptrace_dead);
 
-        write_lock_irq(&tasklist_lock);
+        if (likely(list_empty(&tracer->ptraced)))
+                return;
+
         list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
                 if (__ptrace_detach(tracer, p))
                         list_add(&p->ptrace_entry, &ptrace_dead);
         }
-        write_unlock_irq(&tasklist_lock);
 
+        write_unlock_irq(&tasklist_lock);
         BUG_ON(!list_empty(&tracer->ptraced));
 
         list_for_each_entry_safe(p, n, &ptrace_dead, ptrace_entry) {
                 list_del_init(&p->ptrace_entry);
                 release_task(p);
         }
+
+        write_lock_irq(&tasklist_lock);
 }
 
 int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
@@ -396,7 +404,7 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
         return copied;
 }
 
-static int ptrace_setoptions(struct task_struct *child, long data)
+static int ptrace_setoptions(struct task_struct *child, unsigned long data)
 {
         child->ptrace &= ~PT_TRACE_MASK;
 
@@ -475,7 +483,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
 #define is_sysemu_singlestep(request)   0
 #endif
 
-static int ptrace_resume(struct task_struct *child, long request, long data)
+static int ptrace_resume(struct task_struct *child, long request,
+                         unsigned long data)
 {
         if (!valid_signal(data))
                 return -EIO;
@@ -552,10 +561,12 @@ static int ptrace_regset(struct task_struct *task, int req, unsigned int type,
 #endif
 
 int ptrace_request(struct task_struct *child, long request,
-                   long addr, long data)
+                   unsigned long addr, unsigned long data)
 {
         int ret = -EIO;
         siginfo_t siginfo;
+        void __user *datavp = (void __user *) data;
+        unsigned long __user *datalp = datavp;
 
         switch (request) {
         case PTRACE_PEEKTEXT:
@@ -572,19 +583,17 @@ int ptrace_request(struct task_struct *child, long request,
                 ret = ptrace_setoptions(child, data);
                 break;
         case PTRACE_GETEVENTMSG:
-                ret = put_user(child->ptrace_message, (unsigned long __user *) data);
+                ret = put_user(child->ptrace_message, datalp);
                 break;
 
         case PTRACE_GETSIGINFO:
                 ret = ptrace_getsiginfo(child, &siginfo);
                 if (!ret)
-                        ret = copy_siginfo_to_user((siginfo_t __user *) data,
-                                                   &siginfo);
+                        ret = copy_siginfo_to_user(datavp, &siginfo);
                 break;
 
         case PTRACE_SETSIGINFO:
-                if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-                                   sizeof siginfo))
+                if (copy_from_user(&siginfo, datavp, sizeof siginfo))
                         ret = -EFAULT;
                 else
                         ret = ptrace_setsiginfo(child, &siginfo);
@@ -615,7 +624,7 @@ int ptrace_request(struct task_struct *child, long request,
                 }
                 mmput(mm);
 
-                ret = put_user(tmp, (unsigned long __user *) data);
+                ret = put_user(tmp, datalp);
                 break;
         }
 #endif
@@ -644,7 +653,7 @@ int ptrace_request(struct task_struct *child, long request,
         case PTRACE_SETREGSET:
         {
                 struct iovec kiov;
-                struct iovec __user *uiov = (struct iovec __user *) data;
+                struct iovec __user *uiov = datavp;
 
                 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
                         return -EFAULT;
@@ -685,7 +694,8 @@ static struct task_struct *ptrace_get_task_struct(pid_t pid)
 #define arch_ptrace_attach(child)       do { } while (0)
 #endif
 
-SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
+SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+                unsigned long, data)
 {
         struct task_struct *child;
         long ret;
@@ -726,7 +736,8 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
         return ret;
 }
 
-int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
+int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
+                            unsigned long data)
 {
         unsigned long tmp;
         int copied;
@@ -737,7 +748,8 @@ int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
         return put_user(tmp, (unsigned long __user *)data);
 }
 
-int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
+int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
+                            unsigned long data)
 {
         int copied;
 
diff --git a/kernel/range.c b/kernel/range.c
index 471b66acabb5..37fa9b99ad58 100644
--- a/kernel/range.c
+++ b/kernel/range.c
@@ -119,7 +119,7 @@ static int cmp_range(const void *x1, const void *x2)
 
 int clean_sort_range(struct range *range, int az)
 {
-        int i, j, k = az - 1, nr_range = 0;
+        int i, j, k = az - 1, nr_range = az;
 
         for (i = 0; i < k; i++) {
                 if (range[i].end)
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 4d169835fb36..a23a57a976d1 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -73,12 +73,14 @@ int debug_lockdep_rcu_enabled(void)
 EXPORT_SYMBOL_GPL(debug_lockdep_rcu_enabled);
 
 /**
- * rcu_read_lock_bh_held - might we be in RCU-bh read-side critical section?
+ * rcu_read_lock_bh_held() - might we be in RCU-bh read-side critical section?
  *
  * Check for bottom half being disabled, which covers both the
  * CONFIG_PROVE_RCU and not cases.  Note that if someone uses
  * rcu_read_lock_bh(), but then later enables BH, lockdep (if enabled)
- * will show the situation.
+ * will show the situation.  This is useful for debug checks in functions
+ * that require that they be called within an RCU read-side critical
+ * section.
  *
  * Check debug_lockdep_rcu_enabled() to prevent false positives during boot.
  */
@@ -86,7 +88,7 @@ int rcu_read_lock_bh_held(void)
 {
         if (!debug_lockdep_rcu_enabled())
                 return 1;
-        return in_softirq();
+        return in_softirq() || irqs_disabled();
 }
 EXPORT_SYMBOL_GPL(rcu_read_lock_bh_held);
 
diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c
index 196ec02f8be0..d806735342ac 100644
--- a/kernel/rcutiny.c
+++ b/kernel/rcutiny.c
@@ -59,6 +59,14 @@ int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
 #endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
 
+/* Forward declarations for rcutiny_plugin.h. */
+static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp);
+static void __call_rcu(struct rcu_head *head,
+                       void (*func)(struct rcu_head *rcu),
+                       struct rcu_ctrlblk *rcp);
+
+#include "rcutiny_plugin.h"
+
 #ifdef CONFIG_NO_HZ
 
 static long rcu_dynticks_nesting = 1;
@@ -140,6 +148,7 @@ void rcu_check_callbacks(int cpu, int user)
                 rcu_sched_qs(cpu);
         else if (!in_softirq())
                 rcu_bh_qs(cpu);
+        rcu_preempt_check_callbacks();
 }
 
 /*
@@ -162,6 +171,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
         *rcp->donetail = NULL;
         if (rcp->curtail == rcp->donetail)
                 rcp->curtail = &rcp->rcucblist;
+        rcu_preempt_remove_callbacks(rcp);
         rcp->donetail = &rcp->rcucblist;
         local_irq_restore(flags);
 
@@ -182,6 +192,7 @@ static void rcu_process_callbacks(struct softirq_action *unused)
 {
         __rcu_process_callbacks(&rcu_sched_ctrlblk);
         __rcu_process_callbacks(&rcu_bh_ctrlblk);
+        rcu_preempt_process_callbacks();
 }
 
 /*
@@ -223,15 +234,15 @@ static void __call_rcu(struct rcu_head *head,
 }
 
 /*
- * Post an RCU callback to be invoked after the end of an RCU grace
+ * Post an RCU callback to be invoked after the end of an RCU-sched grace
  * period.  But since we have but one CPU, that would be after any
  * quiescent state.
  */
-void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
+void call_rcu_sched(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 {
         __call_rcu(head, func, &rcu_sched_ctrlblk);
 }
-EXPORT_SYMBOL_GPL(call_rcu);
+EXPORT_SYMBOL_GPL(call_rcu_sched);
 
 /*
  * Post an RCU bottom-half callback to be invoked after any subsequent
@@ -243,20 +254,6 @@ void call_rcu_bh(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 }
 EXPORT_SYMBOL_GPL(call_rcu_bh);
 
-void rcu_barrier(void)
-{
-        struct rcu_synchronize rcu;
-
-        init_rcu_head_on_stack(&rcu.head);
-        init_completion(&rcu.completion);
-        /* Will wake me after RCU finished. */
-        call_rcu(&rcu.head, wakeme_after_rcu);
-        /* Wait for it. */
-        wait_for_completion(&rcu.completion);
-        destroy_rcu_head_on_stack(&rcu.head);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier);
-
 void rcu_barrier_bh(void)
 {
         struct rcu_synchronize rcu;
@@ -289,5 +286,3 @@ void __init rcu_init(void)
 {
         open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 }
-
-#include "rcutiny_plugin.h"
diff --git a/kernel/rcutiny_plugin.h b/kernel/rcutiny_plugin.h
index d223a92bc742..6ceca4f745ff 100644
--- a/kernel/rcutiny_plugin.h
+++ b/kernel/rcutiny_plugin.h
@@ -1,7 +1,7 @@
 /*
- * Read-Copy Update mechanism for mutual exclusion (tree-based version)
+ * Read-Copy Update mechanism for mutual exclusion, the Bloatwatch edition
  * Internal non-public definitions that provide either classic
- * or preemptable semantics.
+ * or preemptible semantics.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,11 +17,587 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  *
- * Copyright IBM Corporation, 2009
+ * Copyright (c) 2010 Linaro
  *
  * Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
  */
 
+#ifdef CONFIG_TINY_PREEMPT_RCU
+
+#include <linux/delay.h>
+
+/* Global control variables for preemptible RCU. */
+struct rcu_preempt_ctrlblk {
+        struct rcu_ctrlblk rcb; /* curtail: ->next ptr of last CB for GP. */
+        struct rcu_head **nexttail;
+                                /* Tasks blocked in a preemptible RCU */
+                                /*  read-side critical section while an */
+                                /*  preemptible-RCU grace period is in */
+                                /*  progress must wait for a later grace */
+                                /*  period.  This pointer points to the */
+                                /*  ->next pointer of the last task that */
+                                /*  must wait for a later grace period, or */
+                                /*  to &->rcb.rcucblist if there is no */
+                                /*  such task. */
+        struct list_head blkd_tasks;
+                                /* Tasks blocked in RCU read-side critical */
+                                /*  section.  Tasks are placed at the head */
+                                /*  of this list and age towards the tail. */
+        struct list_head *gp_tasks;
+                                /* Pointer to the first task blocking the */
+                                /*  current grace period, or NULL if there */
+                                /*  is not such task. */
+        struct list_head *exp_tasks;
+                                /* Pointer to first task blocking the */
+                                /*  current expedited grace period, or NULL */
+                                /*  if there is no such task.  If there */
+                                /*  is no current expedited grace period, */
+                                /*  then there cannot be any such task. */
+        u8 gpnum;               /* Current grace period. */
+        u8 gpcpu;               /* Last grace period blocked by the CPU. */
+        u8 completed;           /* Last grace period completed. */
+                                /*  If all three are equal, RCU is idle. */
+};
+
+static struct rcu_preempt_ctrlblk rcu_preempt_ctrlblk = {
+        .rcb.donetail = &rcu_preempt_ctrlblk.rcb.rcucblist,
+        .rcb.curtail = &rcu_preempt_ctrlblk.rcb.rcucblist,
+        .nexttail = &rcu_preempt_ctrlblk.rcb.rcucblist,
+        .blkd_tasks = LIST_HEAD_INIT(rcu_preempt_ctrlblk.blkd_tasks),
+};
+
+static int rcu_preempted_readers_exp(void);
+static void rcu_report_exp_done(void);
+
+/*
+ * Return true if the CPU has not yet responded to the current grace period.
+ */
+static int rcu_cpu_blocking_cur_gp(void)
+{
+        return rcu_preempt_ctrlblk.gpcpu != rcu_preempt_ctrlblk.gpnum;
+}
+
+/*
+ * Check for a running RCU reader.  Because there is only one CPU,
+ * there can be but one running RCU reader at a time.  ;-)
+ */
+static int rcu_preempt_running_reader(void)
+{
+        return current->rcu_read_lock_nesting;
+}
+
+/*
+ * Check for preempted RCU readers blocking any grace period.
+ * If the caller needs a reliable answer, it must disable hard irqs.
+ */
+static int rcu_preempt_blocked_readers_any(void)
+{
+        return !list_empty(&rcu_preempt_ctrlblk.blkd_tasks);
+}
+
+/*
+ * Check for preempted RCU readers blocking the current grace period.
+ * If the caller needs a reliable answer, it must disable hard irqs.
+ */
+static int rcu_preempt_blocked_readers_cgp(void)
+{
+        return rcu_preempt_ctrlblk.gp_tasks != NULL;
+}
+
+/*
+ * Return true if another preemptible-RCU grace period is needed.
+ */
+static int rcu_preempt_needs_another_gp(void)
+{
+        return *rcu_preempt_ctrlblk.rcb.curtail != NULL;
+}
+
+/*
+ * Return true if a preemptible-RCU grace period is in progress.
+ * The caller must disable hardirqs.
+ */
+static int rcu_preempt_gp_in_progress(void)
+{
+        return rcu_preempt_ctrlblk.completed != rcu_preempt_ctrlblk.gpnum;
+}
+
+/*
+ * Record a preemptible-RCU quiescent state for the specified CPU.  Note
+ * that this just means that the task currently running on the CPU is
+ * in a quiescent state.  There might be any number of tasks blocked
+ * while in an RCU read-side critical section.
+ *
+ * Unlike the other rcu_*_qs() functions, callers to this function
+ * must disable irqs in order to protect the assignment to
+ * ->rcu_read_unlock_special.
+ *
+ * Because this is a single-CPU implementation, the only way a grace
+ * period can end is if the CPU is in a quiescent state.  The reason is
+ * that a blocked preemptible-RCU reader can exit its critical section
+ * only if the CPU is running it at the time.  Therefore, when the
+ * last task blocking the current grace period exits its RCU read-side
+ * critical section, neither the CPU nor blocked tasks will be stopping
+ * the current grace period.  (In contrast, SMP implementations
+ * might have CPUs running in RCU read-side critical sections that
+ * block later grace periods -- but this is not possible given only
+ * one CPU.)
+ */
+static void rcu_preempt_cpu_qs(void)
+{
+        /* Record both CPU and task as having responded to current GP. */
+        rcu_preempt_ctrlblk.gpcpu = rcu_preempt_ctrlblk.gpnum;
+        current->rcu_read_unlock_special &= ~RCU_READ_UNLOCK_NEED_QS;
+
+        /*
+         * If there is no GP, or if blocked readers are still blocking GP,
+         * then there is nothing more to do.
+         */
+        if (!rcu_preempt_gp_in_progress() || rcu_preempt_blocked_readers_cgp())
+                return;
+
+        /* Advance callbacks. */
+        rcu_preempt_ctrlblk.completed = rcu_preempt_ctrlblk.gpnum;
+        rcu_preempt_ctrlblk.rcb.donetail = rcu_preempt_ctrlblk.rcb.curtail;
+        rcu_preempt_ctrlblk.rcb.curtail = rcu_preempt_ctrlblk.nexttail;
+
+        /* If there are no blocked readers, next GP is done instantly. */
+        if (!rcu_preempt_blocked_readers_any())
+                rcu_preempt_ctrlblk.rcb.donetail = rcu_preempt_ctrlblk.nexttail;
+
+        /* If there are done callbacks, make RCU_SOFTIRQ process them. */
+        if (*rcu_preempt_ctrlblk.rcb.donetail != NULL)
+                raise_softirq(RCU_SOFTIRQ);
+}
+
+/*
+ * Start a new RCU grace period if warranted.  Hard irqs must be disabled.
+ */
+static void rcu_preempt_start_gp(void)
+{
+        if (!rcu_preempt_gp_in_progress() && rcu_preempt_needs_another_gp()) {
+
+                /* Official start of GP. */
+                rcu_preempt_ctrlblk.gpnum++;
+
+                /* Any blocked RCU readers block new GP. */
+                if (rcu_preempt_blocked_readers_any())
+                        rcu_preempt_ctrlblk.gp_tasks =
+                                rcu_preempt_ctrlblk.blkd_tasks.next;
+
+                /* If there is no running reader, CPU is done with GP. */
+                if (!rcu_preempt_running_reader())
+                        rcu_preempt_cpu_qs();
+        }
+}
+
+/*
+ * We have entered the scheduler, and the current task might soon be
+ * context-switched away from.  If this task is in an RCU read-side
+ * critical section, we will no longer be able to rely on the CPU to
+ * record that fact, so we enqueue the task on the blkd_tasks list.
+ * If the task started after the current grace period began, as recorded
+ * by ->gpcpu, we enqueue at the beginning of the list.  Otherwise
+ * before the element referenced by ->gp_tasks (or at the tail if
+ * ->gp_tasks is NULL) and point ->gp_tasks at the newly added element.
+ * The task will dequeue itself when it exits the outermost enclosing
+ * RCU read-side critical section.  Therefore, the current grace period
+ * cannot be permitted to complete until the ->gp_tasks pointer becomes
+ * NULL.
+ *
+ * Caller must disable preemption.
+ */
+void rcu_preempt_note_context_switch(void)
+{
+        struct task_struct *t = current;
+        unsigned long flags;
+
+        local_irq_save(flags); /* must exclude scheduler_tick(). */
+        if (rcu_preempt_running_reader() &&
+            (t->rcu_read_unlock_special & RCU_READ_UNLOCK_BLOCKED) == 0) {
+
+                /* Possibly blocking in an RCU read-side critical section. */
+                t->rcu_read_unlock_special |= RCU_READ_UNLOCK_BLOCKED;
+
+                /*
+                 * If this CPU has already checked in, then this task
+                 * will hold up the next grace period rather than the
+                 * current grace period.  Queue the task accordingly.
+                 * If the task is queued for the current grace period
+                 * (i.e., this CPU has not yet passed through a quiescent
+                 * state for the current grace period), then as long
+                 * as that task remains queued, the current grace period
+                 * cannot end.
+                 */
+                list_add(&t->rcu_node_entry, &rcu_preempt_ctrlblk.blkd_tasks);
+                if (rcu_cpu_blocking_cur_gp())
+                        rcu_preempt_ctrlblk.gp_tasks = &t->rcu_node_entry;
+        }
+
+        /*
+         * Either we were not in an RCU read-side critical section to
+         * begin with, or we have now recorded that critical section
+         * globally.  Either way, we can now note a quiescent state
+         * for this CPU.  Again, if we were in an RCU read-side critical
+         * section, and if that critical section was blocking the current
+         * grace period, then the fact that the task has been enqueued
+         * means that current grace period continues to be blocked.
+         */
+        rcu_preempt_cpu_qs();
+        local_irq_restore(flags);
+}
+
+/*
+ * Tiny-preemptible RCU implementation for rcu_read_lock().
+ * Just increment ->rcu_read_lock_nesting, shared state will be updated
+ * if we block.
+ */
+void __rcu_read_lock(void)
+{
+        current->rcu_read_lock_nesting++;
+        barrier();  /* needed if we ever invoke rcu_read_lock in rcutiny.c */
+}
+EXPORT_SYMBOL_GPL(__rcu_read_lock);
+
+/*
+ * Handle special cases during rcu_read_unlock(), such as needing to
+ * notify RCU core processing or task having blocked during the RCU
+ * read-side critical section.
+ */
+static void rcu_read_unlock_special(struct task_struct *t)
+{
+        int empty;
+        int empty_exp;
+        unsigned long flags;
+        struct list_head *np;
+        int special;
+
+        /*
+         * NMI handlers cannot block and cannot safely manipulate state.
+         * They therefore cannot possibly be special, so just leave.
+         */
+        if (in_nmi())
+                return;
+
+        local_irq_save(flags);
+
+        /*
+         * If RCU core is waiting for this CPU to exit critical section,
+         * let it know that we have done so.
+         */
+        special = t->rcu_read_unlock_special;
+        if (special & RCU_READ_UNLOCK_NEED_QS)
+                rcu_preempt_cpu_qs();
+
+        /* Hardware IRQ handlers cannot block. */
+        if (in_irq()) {
+                local_irq_restore(flags);
+                return;
+        }
+
+        /* Clean up if blocked during RCU read-side critical section. */
+        if (special & RCU_READ_UNLOCK_BLOCKED) {
+                t->rcu_read_unlock_special &= ~RCU_READ_UNLOCK_BLOCKED;
+
+                /*
+                 * Remove this task from the ->blkd_tasks list and adjust
+                 * any pointers that might have been referencing it.
+                 */
+                empty = !rcu_preempt_blocked_readers_cgp();
+                empty_exp = rcu_preempt_ctrlblk.exp_tasks == NULL;
+                np = t->rcu_node_entry.next;
+                if (np == &rcu_preempt_ctrlblk.blkd_tasks)
+                        np = NULL;
+                list_del(&t->rcu_node_entry);
+                if (&t->rcu_node_entry == rcu_preempt_ctrlblk.gp_tasks)
+                        rcu_preempt_ctrlblk.gp_tasks = np;
+                if (&t->rcu_node_entry == rcu_preempt_ctrlblk.exp_tasks)
+                        rcu_preempt_ctrlblk.exp_tasks = np;
+                INIT_LIST_HEAD(&t->rcu_node_entry);
+
+                /*
+                 * If this was the last task on the current list, and if
+                 * we aren't waiting on the CPU, report the quiescent state
+                 * and start a new grace period if needed.
+                 */
+                if (!empty && !rcu_preempt_blocked_readers_cgp()) {
+                        rcu_preempt_cpu_qs();
+                        rcu_preempt_start_gp();
+                }
+
+                /*
+                 * If this was the last task on the expedited lists,
+                 * then we need wake up the waiting task.
+                 */
+                if (!empty_exp && rcu_preempt_ctrlblk.exp_tasks == NULL)
+                        rcu_report_exp_done();
+        }
+        local_irq_restore(flags);
+}
+
+/*
+ * Tiny-preemptible RCU implementation for rcu_read_unlock().
+ * Decrement ->rcu_read_lock_nesting.  If the result is zero (outermost
+ * rcu_read_unlock()) and ->rcu_read_unlock_special is non-zero, then
+ * invoke rcu_read_unlock_special() to clean up after a context switch
+ * in an RCU read-side critical section and other special cases.
+ */
+void __rcu_read_unlock(void)
+{
+        struct task_struct *t = current;
+
+        barrier();  /* needed if we ever invoke rcu_read_unlock in rcutiny.c */
+        --t->rcu_read_lock_nesting;
+        barrier();  /* decrement before load of ->rcu_read_unlock_special */
+        if (t->rcu_read_lock_nesting == 0 &&
+            unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
+                rcu_read_unlock_special(t);
+#ifdef CONFIG_PROVE_LOCKING
+        WARN_ON_ONCE(t->rcu_read_lock_nesting < 0);
+#endif /* #ifdef CONFIG_PROVE_LOCKING */
+}
+EXPORT_SYMBOL_GPL(__rcu_read_unlock);
+
+/*
+ * Check for a quiescent state from the current CPU.  When a task blocks,
+ * the task is recorded in the rcu_preempt_ctrlblk structure, which is
+ * checked elsewhere.  This is called from the scheduling-clock interrupt.
+ *
+ * Caller must disable hard irqs.
+ */
+static void rcu_preempt_check_callbacks(void)
+{
+        struct task_struct *t = current;
+
+        if (rcu_preempt_gp_in_progress() &&
+            (!rcu_preempt_running_reader() ||
+             !rcu_cpu_blocking_cur_gp()))
+                rcu_preempt_cpu_qs();
+        if (&rcu_preempt_ctrlblk.rcb.rcucblist !=
+            rcu_preempt_ctrlblk.rcb.donetail)
+                raise_softirq(RCU_SOFTIRQ);
+        if (rcu_preempt_gp_in_progress() &&
+            rcu_cpu_blocking_cur_gp() &&
+            rcu_preempt_running_reader())
+                t->rcu_read_unlock_special |= RCU_READ_UNLOCK_NEED_QS;
+}
+
+/*
+ * TINY_PREEMPT_RCU has an extra callback-list tail pointer to
+ * update, so this is invoked from __rcu_process_callbacks() to
+ * handle that case.  Of course, it is invoked for all flavors of
+ * RCU, but RCU callbacks can appear only on one of the lists, and
+ * neither ->nexttail nor ->donetail can possibly be NULL, so there
+ * is no need for an explicit check.
+ */
+static void rcu_preempt_remove_callbacks(struct rcu_ctrlblk *rcp)
+{
+        if (rcu_preempt_ctrlblk.nexttail == rcp->donetail)
+                rcu_preempt_ctrlblk.nexttail = &rcp->rcucblist;
+}
+
+/*
+ * Process callbacks for preemptible RCU.
+ */
+static void rcu_preempt_process_callbacks(void)
+{
+        __rcu_process_callbacks(&rcu_preempt_ctrlblk.rcb);
+}
+
+/*
+ * Queue a preemptible -RCU callback for invocation after a grace period.
+ */
+void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
+{
+        unsigned long flags;
+
+        debug_rcu_head_queue(head);
+        head->func = func;
+        head->next = NULL;
+
+        local_irq_save(flags);
+        *rcu_preempt_ctrlblk.nexttail = head;
+        rcu_preempt_ctrlblk.nexttail = &head->next;
+        rcu_preempt_start_gp();  /* checks to see if GP needed. */
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(call_rcu);
+
+void rcu_barrier(void)
+{
+        struct rcu_synchronize rcu;
+
+        init_rcu_head_on_stack(&rcu.head);
+        init_completion(&rcu.completion);
+        /* Will wake me after RCU finished. */
+        call_rcu(&rcu.head, wakeme_after_rcu);
+        /* Wait for it. */
+        wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
+
+/*
+ * synchronize_rcu - wait until a grace period has elapsed.
+ *
+ * Control will return to the caller some time after a full grace
+ * period has elapsed, in other words after all currently executing RCU
+ * read-side critical sections have completed.  RCU read-side critical
+ * sections are delimited by rcu_read_lock() and rcu_read_unlock(),
+ * and may be nested.
+ */
+void synchronize_rcu(void)
+{
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        if (!rcu_scheduler_active)
+                return;
+#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
+
+        WARN_ON_ONCE(rcu_preempt_running_reader());
+        if (!rcu_preempt_blocked_readers_any())
+                return;
+
+        /* Once we get past the fastpath checks, same code as rcu_barrier(). */
+        rcu_barrier();
+}
+EXPORT_SYMBOL_GPL(synchronize_rcu);
+
+static DECLARE_WAIT_QUEUE_HEAD(sync_rcu_preempt_exp_wq);
+static unsigned long sync_rcu_preempt_exp_count;
+static DEFINE_MUTEX(sync_rcu_preempt_exp_mutex);
+
+/*
+ * Return non-zero if there are any tasks in RCU read-side critical
+ * sections blocking the current preemptible-RCU expedited grace period.
+ * If there is no preemptible-RCU expedited grace period currently in
+ * progress, returns zero unconditionally.
+ */
+static int rcu_preempted_readers_exp(void)
+{
+        return rcu_preempt_ctrlblk.exp_tasks != NULL;
+}
+
+/*
+ * Report the exit from RCU read-side critical section for the last task
+ * that queued itself during or before the current expedited preemptible-RCU
+ * grace period.
+ */
+static void rcu_report_exp_done(void)
+{
+        wake_up(&sync_rcu_preempt_exp_wq);
+}
+
+/*
+ * Wait for an rcu-preempt grace period, but expedite it.  The basic idea
+ * is to rely in the fact that there is but one CPU, and that it is
+ * illegal for a task to invoke synchronize_rcu_expedited() while in a
+ * preemptible-RCU read-side critical section.  Therefore, any such
+ * critical sections must correspond to blocked tasks, which must therefore
+ * be on the ->blkd_tasks list.  So just record the current head of the
+ * list in the ->exp_tasks pointer, and wait for all tasks including and
+ * after the task pointed to by ->exp_tasks to drain.
+ */
+void synchronize_rcu_expedited(void)
+{
+        unsigned long flags;
+        struct rcu_preempt_ctrlblk *rpcp = &rcu_preempt_ctrlblk;
+        unsigned long snap;
+
+        barrier(); /* ensure prior action seen before grace period. */
+
+        WARN_ON_ONCE(rcu_preempt_running_reader());
+
+        /*
+         * Acquire lock so that there is only one preemptible RCU grace
+         * period in flight.  Of course, if someone does the expedited
+         * grace period for us while we are acquiring the lock, just leave.
+         */
+        snap = sync_rcu_preempt_exp_count + 1;
+        mutex_lock(&sync_rcu_preempt_exp_mutex);
+        if (ULONG_CMP_LT(snap, sync_rcu_preempt_exp_count))
+                goto unlock_mb_ret; /* Others did our work for us. */
+
+        local_irq_save(flags);
+
+        /*
+         * All RCU readers have to already be on blkd_tasks because
+         * we cannot legally be executing in an RCU read-side critical
+         * section.
+         */
+
+        /* Snapshot current head of ->blkd_tasks list. */
+        rpcp->exp_tasks = rpcp->blkd_tasks.next;
+        if (rpcp->exp_tasks == &rpcp->blkd_tasks)
+                rpcp->exp_tasks = NULL;
+        local_irq_restore(flags);
+
+        /* Wait for tail of ->blkd_tasks list to drain. */
+        if (rcu_preempted_readers_exp())
+                wait_event(sync_rcu_preempt_exp_wq,
+                           !rcu_preempted_readers_exp());
+
+        /* Clean up and exit. */
+        barrier(); /* ensure expedited GP seen before counter increment. */
+        sync_rcu_preempt_exp_count++;
+unlock_mb_ret:
+        mutex_unlock(&sync_rcu_preempt_exp_mutex);
+        barrier(); /* ensure subsequent action seen after grace period. */
+}
+EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+
+/*
+ * Does preemptible RCU need the CPU to stay out of dynticks mode?
+ */
+int rcu_preempt_needs_cpu(void)
+{
+        if (!rcu_preempt_running_reader())
+                rcu_preempt_cpu_qs();
+        return rcu_preempt_ctrlblk.rcb.rcucblist != NULL;
+}
+
+/*
+ * Check for a task exiting while in a preemptible -RCU read-side
+ * critical section, clean up if so.  No need to issue warnings,
+ * as debug_check_no_locks_held() already does this if lockdep
+ * is enabled.
+ */
+void exit_rcu(void)
+{
+        struct task_struct *t = current;
+
+        if (t->rcu_read_lock_nesting == 0)
+                return;
+        t->rcu_read_lock_nesting = 1;
+        rcu_read_unlock();
+}
+
+#else /* #ifdef CONFIG_TINY_PREEMPT_RCU */
+
+/*
+ * Because preemptible RCU does not exist, it never has any callbacks
+ * to check.
+ */
+static void rcu_preempt_check_callbacks(void)
+{
+}
+
+/*
+ * Because preemptible RCU does not exist, it never has any callbacks
+ * to remove.
+ */
+static void rcu_preempt_remove_callbacks(struct rcu_ctrlblk *rcp)
+{
+}
+
+/*
+ * Because preemptible RCU does not exist, it never has any callbacks
+ * to process.
+ */
+static void rcu_preempt_process_callbacks(void)
+{
+}
+
+#endif /* #else #ifdef CONFIG_TINY_PREEMPT_RCU */
+
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 
 #include <linux/kernel_stat.h>
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 2e2726d790b9..9d8e8fb2515f 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -120,7 +120,7 @@ struct rcu_torture {
 };
 
 static LIST_HEAD(rcu_torture_freelist);
-static struct rcu_torture *rcu_torture_current;
+static struct rcu_torture __rcu *rcu_torture_current;
 static long rcu_torture_current_version;
 static struct rcu_torture rcu_tortures[10 * RCU_TORTURE_PIPE_LEN];
 static DEFINE_SPINLOCK(rcu_torture_lock);
@@ -153,8 +153,10 @@ int rcutorture_runnable = RCUTORTURE_RUNNABLE_INIT;
 #define FULLSTOP_SHUTDOWN 1     /* System shutdown with rcutorture running. */
 #define FULLSTOP_RMMOD    2     /* Normal rmmod of rcutorture. */
 static int fullstop = FULLSTOP_RMMOD;
-DEFINE_MUTEX(fullstop_mutex);   /* Protect fullstop transitions and spawning */
-                                /*  of kthreads. */
+/*
+ * Protect fullstop transitions and spawning of kthreads.
+ */
+static DEFINE_MUTEX(fullstop_mutex);
 
 /*
  * Detect and respond to a system shutdown.
@@ -303,6 +305,10 @@ static void rcu_read_delay(struct rcu_random_state *rrsp)
                 mdelay(longdelay_ms);
         if (!(rcu_random(rrsp) % (nrealreaders * 2 * shortdelay_us)))
                 udelay(shortdelay_us);
+#ifdef CONFIG_PREEMPT
+        if (!preempt_count() && !(rcu_random(rrsp) % (nrealreaders * 20000)))
+                preempt_schedule();  /* No QS if preempt_disable() in effect */
+#endif
 }
 
 static void rcu_torture_read_unlock(int idx) __releases(RCU)
@@ -536,6 +542,8 @@ static void srcu_read_delay(struct rcu_random_state *rrsp)
         delay = rcu_random(rrsp) % (nrealreaders * 2 * longdelay * uspertick);
         if (!delay)
                 schedule_timeout_interruptible(longdelay);
+        else
+                rcu_read_delay(rrsp);
 }
 
 static void srcu_torture_read_unlock(int idx) __releases(&srcu_ctl)
@@ -731,7 +739,8 @@ rcu_torture_writer(void *arg)
                         continue;
                 rp->rtort_pipe_count = 0;
                 udelay(rcu_random(&rand) & 0x3ff);
-                old_rp = rcu_torture_current;
+                old_rp = rcu_dereference_check(rcu_torture_current,
+                                               current == writer_task);
                 rp->rtort_mbtest = 1;
                 rcu_assign_pointer(rcu_torture_current, rp);
                 smp_wmb(); /* Mods to old_rp must follow rcu_assign_pointer() */
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index d5bc43976c5a..ccdc04c47981 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -143,6 +143,11 @@ module_param(blimit, int, 0);
 module_param(qhimark, int, 0);
 module_param(qlowmark, int, 0);
 
+#ifdef CONFIG_RCU_CPU_STALL_DETECTOR
+int rcu_cpu_stall_suppress __read_mostly = RCU_CPU_STALL_SUPPRESS_INIT;
+module_param(rcu_cpu_stall_suppress, int, 0644);
+#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+
 static void force_quiescent_state(struct rcu_state *rsp, int relaxed);
 static int rcu_pending(int cpu);
 
@@ -450,7 +455,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
 
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
 
-int rcu_cpu_stall_panicking __read_mostly;
+int rcu_cpu_stall_suppress __read_mostly;
 
 static void record_gp_stall_check_time(struct rcu_state *rsp)
 {
@@ -482,8 +487,11 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
         rcu_print_task_stall(rnp);
         raw_spin_unlock_irqrestore(&rnp->lock, flags);
 
-        /* OK, time to rat on our buddy... */
-
+        /*
+         * OK, time to rat on our buddy...
+         * See Documentation/RCU/stallwarn.txt for info on how to debug
+         * RCU CPU stall warnings.
+         */
         printk(KERN_ERR "INFO: %s detected stalls on CPUs/tasks: {",
                rsp->name);
         rcu_for_each_leaf_node(rsp, rnp) {
@@ -512,6 +520,11 @@ static void print_cpu_stall(struct rcu_state *rsp)
         unsigned long flags;
         struct rcu_node *rnp = rcu_get_root(rsp);
 
+        /*
+         * OK, time to rat on ourselves...
+         * See Documentation/RCU/stallwarn.txt for info on how to debug
+         * RCU CPU stall warnings.
+         */
         printk(KERN_ERR "INFO: %s detected stall on CPU %d (t=%lu jiffies)\n",
                rsp->name, smp_processor_id(), jiffies - rsp->gp_start);
         trigger_all_cpu_backtrace();
@@ -530,11 +543,11 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
         long delta;
         struct rcu_node *rnp;
 
-        if (rcu_cpu_stall_panicking)
+        if (rcu_cpu_stall_suppress)
                 return;
-        delta = jiffies - rsp->jiffies_stall;
+        delta = jiffies - ACCESS_ONCE(rsp->jiffies_stall);
         rnp = rdp->mynode;
-        if ((rnp->qsmask & rdp->grpmask) && delta >= 0) {
+        if ((ACCESS_ONCE(rnp->qsmask) & rdp->grpmask) && delta >= 0) {
 
                 /* We haven't checked in, so go dump stack. */
                 print_cpu_stall(rsp);
@@ -548,10 +561,26 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
 
 static int rcu_panic(struct notifier_block *this, unsigned long ev, void *ptr)
 {
-        rcu_cpu_stall_panicking = 1;
+        rcu_cpu_stall_suppress = 1;
         return NOTIFY_DONE;
 }
 
+/**
+ * rcu_cpu_stall_reset - prevent further stall warnings in current grace period
+ *
+ * Set the stall-warning timeout way off into the future, thus preventing
+ * any RCU CPU stall-warning messages from appearing in the current set of
+ * RCU grace periods.
+ *
+ * The caller must disable hard irqs.
+ */
+void rcu_cpu_stall_reset(void)
+{
+        rcu_sched_state.jiffies_stall = jiffies + ULONG_MAX / 2;
+        rcu_bh_state.jiffies_stall = jiffies + ULONG_MAX / 2;
+        rcu_preempt_stall_reset();
+}
+
 static struct notifier_block rcu_panic_block = {
         .notifier_call = rcu_panic,
 };
@@ -571,6 +600,10 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
 {
 }
 
+void rcu_cpu_stall_reset(void)
+{
+}
+
 static void __init check_cpu_stall_init(void)
 {
 }
@@ -712,7 +745,7 @@ static void
 rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
         __releases(rcu_get_root(rsp)->lock)
 {
-        struct rcu_data *rdp = rsp->rda[smp_processor_id()];
+        struct rcu_data *rdp = this_cpu_ptr(rsp->rda);
         struct rcu_node *rnp = rcu_get_root(rsp);
 
         if (!cpu_needs_another_gp(rsp, rdp) || rsp->fqs_active) {
@@ -960,7 +993,7 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
 static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
 {
         int i;
-        struct rcu_data *rdp = rsp->rda[smp_processor_id()];
+        struct rcu_data *rdp = this_cpu_ptr(rsp->rda);
 
         if (rdp->nxtlist == NULL)
                 return;  /* irqs disabled, so comparison is stable. */
@@ -971,6 +1004,7 @@ static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
         for (i = 0; i < RCU_NEXT_SIZE; i++)
                 rdp->nxttail[i] = &rdp->nxtlist;
         rsp->orphan_qlen += rdp->qlen;
+        rdp->n_cbs_orphaned += rdp->qlen;
         rdp->qlen = 0;
         raw_spin_unlock(&rsp->onofflock);  /* irqs remain disabled. */
 }
@@ -984,7 +1018,7 @@ static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
         struct rcu_data *rdp;
 
         raw_spin_lock_irqsave(&rsp->onofflock, flags);
-        rdp = rsp->rda[smp_processor_id()];
+        rdp = this_cpu_ptr(rsp->rda);
         if (rsp->orphan_cbs_list == NULL) {
                 raw_spin_unlock_irqrestore(&rsp->onofflock, flags);
                 return;
@@ -992,6 +1026,7 @@ static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
         *rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_list;
         rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_tail;
         rdp->qlen += rsp->orphan_qlen;
+        rdp->n_cbs_adopted += rsp->orphan_qlen;
         rsp->orphan_cbs_list = NULL;
         rsp->orphan_cbs_tail = &rsp->orphan_cbs_list;
         rsp->orphan_qlen = 0;
@@ -1007,7 +1042,7 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
         unsigned long flags;
         unsigned long mask;
         int need_report = 0;
-        struct rcu_data *rdp = rsp->rda[cpu];
+        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
         struct rcu_node *rnp;
 
         /* Exclude any attempts to start a new grace period. */
@@ -1123,6 +1158,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
 
         /* Update count, and requeue any remaining callbacks. */
         rdp->qlen -= count;
+        rdp->n_cbs_invoked += count;
         if (list != NULL) {
                 *tail = rdp->nxtlist;
                 rdp->nxtlist = list;
@@ -1226,7 +1262,8 @@ static void force_qs_rnp(struct rcu_state *rsp, int (*f)(struct rcu_data *))
                 cpu = rnp->grplo;
                 bit = 1;
                 for (; cpu <= rnp->grphi; cpu++, bit <<= 1) {
-                        if ((rnp->qsmask & bit) != 0 && f(rsp->rda[cpu]))
+                        if ((rnp->qsmask & bit) != 0 &&
+                            f(per_cpu_ptr(rsp->rda, cpu)))
                                 mask |= bit;
                 }
                 if (mask != 0) {
@@ -1402,7 +1439,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
          * a quiescent state betweentimes.
          */
         local_irq_save(flags);
-        rdp = rsp->rda[smp_processor_id()];
+        rdp = this_cpu_ptr(rsp->rda);
         rcu_process_gp_end(rsp, rdp);
         check_for_new_grace_period(rsp, rdp);
 
@@ -1701,7 +1738,7 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
 {
         unsigned long flags;
         int i;
-        struct rcu_data *rdp = rsp->rda[cpu];
+        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
         struct rcu_node *rnp = rcu_get_root(rsp);
 
         /* Set up local state, ensuring consistent view of global state. */
@@ -1729,7 +1766,7 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptable)
 {
         unsigned long flags;
         unsigned long mask;
-        struct rcu_data *rdp = rsp->rda[cpu];
+        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
         struct rcu_node *rnp = rcu_get_root(rsp);
 
         /* Set up local state, ensuring consistent view of global state. */
@@ -1865,7 +1902,8 @@ static void __init rcu_init_levelspread(struct rcu_state *rsp)
 /*
  * Helper function for rcu_init() that initializes one rcu_state structure.
  */
-static void __init rcu_init_one(struct rcu_state *rsp)
+static void __init rcu_init_one(struct rcu_state *rsp,
+                struct rcu_data __percpu *rda)
 {
         static char *buf[] = { "rcu_node_level_0",
                                "rcu_node_level_1",
@@ -1918,37 +1956,23 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                 }
         }
 
+        rsp->rda = rda;
         rnp = rsp->level[NUM_RCU_LVLS - 1];
         for_each_possible_cpu(i) {
                 while (i > rnp->grphi)
                         rnp++;
-                rsp->rda[i]->mynode = rnp;
+                per_cpu_ptr(rsp->rda, i)->mynode = rnp;
                 rcu_boot_init_percpu_data(i, rsp);
         }
 }
 
-/*
- * Helper macro for __rcu_init() and __rcu_init_preempt().  To be used
- * nowhere else!  Assigns leaf node pointers into each CPU's rcu_data
- * structure.
- */
-#define RCU_INIT_FLAVOR(rsp, rcu_data) \
-do { \
-        int i; \
-        \
-        for_each_possible_cpu(i) { \
-                (rsp)->rda[i] = &per_cpu(rcu_data, i); \
-        } \
-        rcu_init_one(rsp); \
-} while (0)
-
 void __init rcu_init(void)
 {
         int cpu;
 
         rcu_bootup_announce();
-        RCU_INIT_FLAVOR(&rcu_sched_state, rcu_sched_data);
-        RCU_INIT_FLAVOR(&rcu_bh_state, rcu_bh_data);
+        rcu_init_one(&rcu_sched_state, &rcu_sched_data);
+        rcu_init_one(&rcu_bh_state, &rcu_bh_data);
         __rcu_init_preempt();
         open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 14c040b18ed0..91d4170c5c13 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -202,6 +202,9 @@ struct rcu_data {
         long            qlen;           /* # of queued callbacks */
         long            qlen_last_fqs_check;
                                         /* qlen at last check for QS forcing */
+        unsigned long   n_cbs_invoked;  /* count of RCU cbs invoked. */
+        unsigned long   n_cbs_orphaned; /* RCU cbs sent to orphanage. */
+        unsigned long   n_cbs_adopted;  /* RCU cbs adopted from orphanage. */
         unsigned long   n_force_qs_snap;
                                         /* did other CPU force QS recently? */
         long            blimit;         /* Upper limit on a processed batch */
@@ -254,19 +257,23 @@ struct rcu_data {
 #define RCU_STALL_DELAY_DELTA          0
 #endif
 
-#define RCU_SECONDS_TILL_STALL_CHECK   (10 * HZ + RCU_STALL_DELAY_DELTA)
+#define RCU_SECONDS_TILL_STALL_CHECK   (CONFIG_RCU_CPU_STALL_TIMEOUT * HZ + \
+                                        RCU_STALL_DELAY_DELTA)
                                                 /* for rsp->jiffies_stall */
-#define RCU_SECONDS_TILL_STALL_RECHECK (30 * HZ + RCU_STALL_DELAY_DELTA)
+#define RCU_SECONDS_TILL_STALL_RECHECK (3 * RCU_SECONDS_TILL_STALL_CHECK + 30)
                                                 /* for rsp->jiffies_stall */
 #define RCU_STALL_RAT_DELAY             2       /* Allow other CPUs time */
                                                 /*  to take at least one */
                                                 /*  scheduling clock irq */
                                                 /*  before ratting on them. */
 
-#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+#ifdef CONFIG_RCU_CPU_STALL_DETECTOR_RUNNABLE
+#define RCU_CPU_STALL_SUPPRESS_INIT 0
+#else
+#define RCU_CPU_STALL_SUPPRESS_INIT 1
+#endif
 
-#define ULONG_CMP_GE(a, b)      (ULONG_MAX / 2 >= (a) - (b))
-#define ULONG_CMP_LT(a, b)      (ULONG_MAX / 2 < (a) - (b))
+#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
 /*
  * RCU global state, including node hierarchy.  This hierarchy is
@@ -283,7 +290,7 @@ struct rcu_state {
         struct rcu_node *level[NUM_RCU_LVLS];   /* Hierarchy levels. */
         u32 levelcnt[MAX_RCU_LVLS + 1];         /* # nodes in each level. */
         u8 levelspread[NUM_RCU_LVLS];           /* kids/node in each level. */
-        struct rcu_data *rda[NR_CPUS];          /* array of rdp pointers. */
+        struct rcu_data __percpu *rda;          /* pointer of percu rcu_data. */
 
         /* The following fields are guarded by the root rcu_node's lock. */
 
@@ -365,6 +372,7 @@ static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp,
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
 static void rcu_print_detail_task_stall(struct rcu_state *rsp);
 static void rcu_print_task_stall(struct rcu_node *rnp);
+static void rcu_preempt_stall_reset(void);
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 0e4f420245d9..71a4147473f9 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -57,7 +57,7 @@ static void __init rcu_bootup_announce_oddness(void)
         printk(KERN_INFO
                "\tRCU-based detection of stalled CPUs is disabled.\n");
 #endif
-#ifndef CONFIG_RCU_CPU_STALL_VERBOSE
+#if defined(CONFIG_TREE_PREEMPT_RCU) && !defined(CONFIG_RCU_CPU_STALL_VERBOSE)
         printk(KERN_INFO "\tVerbose stalled-CPUs detection is disabled.\n");
 #endif
 #if NUM_RCU_LVL_4 != 0
@@ -154,7 +154,7 @@ static void rcu_preempt_note_context_switch(int cpu)
             (t->rcu_read_unlock_special & RCU_READ_UNLOCK_BLOCKED) == 0) {
 
                 /* Possibly blocking in an RCU read-side critical section. */
-                rdp = rcu_preempt_state.rda[cpu];
+                rdp = per_cpu_ptr(rcu_preempt_state.rda, cpu);
                 rnp = rdp->mynode;
                 raw_spin_lock_irqsave(&rnp->lock, flags);
                 t->rcu_read_unlock_special |= RCU_READ_UNLOCK_BLOCKED;
@@ -201,7 +201,7 @@ static void rcu_preempt_note_context_switch(int cpu)
  */
 void __rcu_read_lock(void)
 {
-        ACCESS_ONCE(current->rcu_read_lock_nesting)++;
+        current->rcu_read_lock_nesting++;
         barrier();  /* needed if we ever invoke rcu_read_lock in rcutree.c */
 }
 EXPORT_SYMBOL_GPL(__rcu_read_lock);
@@ -344,7 +344,9 @@ void __rcu_read_unlock(void)
         struct task_struct *t = current;
 
         barrier();  /* needed if we ever invoke rcu_read_unlock in rcutree.c */
-        if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
+        --t->rcu_read_lock_nesting;
+        barrier();  /* decrement before load of ->rcu_read_unlock_special */
+        if (t->rcu_read_lock_nesting == 0 &&
             unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
                 rcu_read_unlock_special(t);
 #ifdef CONFIG_PROVE_LOCKING
@@ -417,6 +419,16 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
         }
 }
 
+/*
+ * Suppress preemptible RCU's CPU stall warnings by pushing the
+ * time of the next stall-warning message comfortably far into the
+ * future.
+ */
+static void rcu_preempt_stall_reset(void)
+{
+        rcu_preempt_state.jiffies_stall = jiffies + ULONG_MAX / 2;
+}
+
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
 /*
@@ -546,9 +558,11 @@ EXPORT_SYMBOL_GPL(call_rcu);
  *
  * Control will return to the caller some time after a full grace
  * period has elapsed, in other words after all currently executing RCU
- * read-side critical sections have completed.  RCU read-side critical
- * sections are delimited by rcu_read_lock() and rcu_read_unlock(),
- * and may be nested.
+ * read-side critical sections have completed.  Note, however, that
+ * upon return from synchronize_rcu(), the caller might well be executing
+ * concurrently with new RCU read-side critical sections that began while
+ * synchronize_rcu() was waiting.  RCU read-side critical sections are
+ * delimited by rcu_read_lock() and rcu_read_unlock(), and may be nested.
  */
 void synchronize_rcu(void)
 {
@@ -771,7 +785,7 @@ static void rcu_preempt_send_cbs_to_orphanage(void)
  */
 static void __init __rcu_init_preempt(void)
 {
-        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
+        rcu_init_one(&rcu_preempt_state, &rcu_preempt_data);
 }
 
 /*
@@ -865,6 +879,14 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
 {
 }
 
+/*
+ * Because preemptible RCU does not exist, there is no need to suppress
+ * its CPU stall warnings.
+ */
+static void rcu_preempt_stall_reset(void)
+{
+}
+
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
 /*
@@ -919,15 +941,6 @@ static void rcu_preempt_process_callbacks(void)
 }
 
 /*
- * In classic RCU, call_rcu() is just call_rcu_sched().
- */
-void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
-{
-        call_rcu_sched(head, func);
-}
-EXPORT_SYMBOL_GPL(call_rcu);
-
-/*
  * Wait for an rcu-preempt grace period, but make it happen quickly.
  * But because preemptable RCU does not exist, map to rcu-sched.
  */
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index 36c95b45738e..d15430b9d122 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -64,7 +64,9 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
                    rdp->dynticks_fqs);
 #endif /* #ifdef CONFIG_NO_HZ */
         seq_printf(m, " of=%lu ri=%lu", rdp->offline_fqs, rdp->resched_ipi);
-        seq_printf(m, " ql=%ld b=%ld\n", rdp->qlen, rdp->blimit);
+        seq_printf(m, " ql=%ld b=%ld", rdp->qlen, rdp->blimit);
+        seq_printf(m, " ci=%lu co=%lu ca=%lu\n",
+                   rdp->n_cbs_invoked, rdp->n_cbs_orphaned, rdp->n_cbs_adopted);
 }
 
 #define PRINT_RCU_DATA(name, func, m) \
@@ -119,7 +121,9 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
                    rdp->dynticks_fqs);
 #endif /* #ifdef CONFIG_NO_HZ */
         seq_printf(m, ",%lu,%lu", rdp->offline_fqs, rdp->resched_ipi);
-        seq_printf(m, ",%ld,%ld\n", rdp->qlen, rdp->blimit);
+        seq_printf(m, ",%ld,%ld", rdp->qlen, rdp->blimit);
+        seq_printf(m, ",%lu,%lu,%lu\n",
+                   rdp->n_cbs_invoked, rdp->n_cbs_orphaned, rdp->n_cbs_adopted);
 }
 
 static int show_rcudata_csv(struct seq_file *m, void *unused)
@@ -128,7 +132,7 @@ static int show_rcudata_csv(struct seq_file *m, void *unused)
 #ifdef CONFIG_NO_HZ
         seq_puts(m, "\"dt\",\"dt nesting\",\"dn\",\"df\",");
 #endif /* #ifdef CONFIG_NO_HZ */
-        seq_puts(m, "\"of\",\"ri\",\"ql\",\"b\"\n");
+        seq_puts(m, "\"of\",\"ri\",\"ql\",\"b\",\"ci\",\"co\",\"ca\"\n");
 #ifdef CONFIG_TREE_PREEMPT_RCU
         seq_puts(m, "\"rcu_preempt:\"\n");
         PRINT_RCU_DATA(rcu_preempt_data, print_one_rcu_data_csv, m);
@@ -262,7 +266,7 @@ static void print_rcu_pendings(struct seq_file *m, struct rcu_state *rsp)
         struct rcu_data *rdp;
 
         for_each_possible_cpu(cpu) {
-                rdp = rsp->rda[cpu];
+                rdp = per_cpu_ptr(rsp->rda, cpu);
                 if (rdp->beenonline)
                         print_one_rcu_pending(m, rdp);
         }
diff --git a/kernel/relay.c b/kernel/relay.c
index c7cf397fb929..859ea5a9605f 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -70,17 +70,10 @@ static const struct vm_operations_struct relay_file_mmap_ops = {
  */
 static struct page **relay_alloc_page_array(unsigned int n_pages)
 {
-        struct page **array;
-        size_t pa_size = n_pages * sizeof(struct page *);
-
-        if (pa_size > PAGE_SIZE) {
-                array = vmalloc(pa_size);
-                if (array)
-                        memset(array, 0, pa_size);
-        } else {
-                array = kzalloc(pa_size, GFP_KERNEL);
-        }
-        return array;
+        const size_t pa_size = n_pages * sizeof(struct page *);
+        if (pa_size > PAGE_SIZE)
+                return vzalloc(pa_size);
+        return kzalloc(pa_size, GFP_KERNEL);
 }
 
 /*
diff --git a/kernel/resource.c b/kernel/resource.c
index 7b36976e5dea..798e2fae2a06 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -357,6 +357,32 @@ int __weak page_is_ram(unsigned long pfn)
         return walk_system_ram_range(pfn, 1, NULL, __is_ram) == 1;
 }
 
+void __weak arch_remove_reservations(struct resource *avail)
+{
+}
+
+static resource_size_t simple_align_resource(void *data,
+                                             const struct resource *avail,
+                                             resource_size_t size,
+                                             resource_size_t align)
+{
+        return avail->start;
+}
+
+static void resource_clip(struct resource *res, resource_size_t min,
+                          resource_size_t max)
+{
+        if (res->start < min)
+                res->start = min;
+        if (res->end > max)
+                res->end = max;
+}
+
+static bool resource_contains(struct resource *res1, struct resource *res2)
+{
+        return res1->start <= res2->start && res1->end >= res2->end;
+}
+
 /*
  * Find empty slot in the resource tree given range and alignment.
  */
@@ -370,8 +396,9 @@ static int find_resource(struct resource *root, struct resource *new,
                          void *alignf_data)
 {
         struct resource *this = root->child;
-        struct resource tmp = *new;
+        struct resource tmp = *new, avail, alloc;
 
+        tmp.flags = new->flags;
         tmp.start = root->start;
         /*
          * Skip past an allocated resource that starts at 0, since the assignment
@@ -386,17 +413,22 @@ static int find_resource(struct resource *root, struct resource *new,
                         tmp.end = this->start - 1;
                 else
                         tmp.end = root->end;
-                if (tmp.start < min)
-                        tmp.start = min;
-                if (tmp.end > max)
-                        tmp.end = max;
-                tmp.start = ALIGN(tmp.start, align);
-                if (alignf)
-                        tmp.start = alignf(alignf_data, &tmp, size, align);
-                if (tmp.start < tmp.end && tmp.end - tmp.start >= size - 1) {
-                        new->start = tmp.start;
-                        new->end = tmp.start + size - 1;
-                        return 0;
+
+                resource_clip(&tmp, min, max);
+                arch_remove_reservations(&tmp);
+
+                /* Check for overflow after ALIGN() */
+                avail = *new;
+                avail.start = ALIGN(tmp.start, align);
+                avail.end = tmp.end;
+                if (avail.start >= tmp.start) {
+                        alloc.start = alignf(alignf_data, &avail, size, align);
+                        alloc.end = alloc.start + size - 1;
+                        if (resource_contains(&avail, &alloc)) {
+                                new->start = alloc.start;
+                                new->end = alloc.end;
+                                return 0;
+                        }
                 }
                 if (!this)
                         break;
@@ -428,6 +460,9 @@ int allocate_resource(struct resource *root, struct resource *new,
 {
         int err;
 
+        if (!alignf)
+                alignf = simple_align_resource;
+
         write_lock(&resource_lock);
         err = find_resource(root, new, size, min, max, align, alignf, alignf_data);
         if (err >= 0 && __request_resource(root, new))
@@ -453,6 +488,8 @@ static struct resource * __insert_resource(struct resource *parent, struct resou
 
                 if (first == parent)
                         return first;
+                if (WARN_ON(first == new))      /* duplicated insertion */
+                        return first;
 
                 if ((first->start > new->start) || (first->end < new->end))
                         break;
diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
index a56f629b057a..66cb89bc5ef1 100644
--- a/kernel/rtmutex-tester.c
+++ b/kernel/rtmutex-tester.c
@@ -76,7 +76,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
                 }
 
                 if (!lockwakeup && td->bkl == 4) {
+#ifdef CONFIG_LOCK_KERNEL
                         unlock_kernel();
+#endif
                         td->bkl = 0;
                 }
                 return 0;
@@ -133,14 +135,18 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
                 if (td->bkl)
                         return 0;
                 td->bkl = 1;
+#ifdef CONFIG_LOCK_KERNEL
                 lock_kernel();
+#endif
                 td->bkl = 4;
                 return 0;
 
         case RTTEST_UNLOCKBKL:
                 if (td->bkl != 4)
                         break;
+#ifdef CONFIG_LOCK_KERNEL
                 unlock_kernel();
+#endif
                 td->bkl = 0;
                 return 0;
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 41541d79e3c8..297d1a0eedb0 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -426,9 +426,7 @@ struct root_domain {
          */
         cpumask_var_t rto_mask;
         atomic_t rto_count;
-#ifdef CONFIG_SMP
         struct cpupri cpupri;
-#endif
 };
 
 /*
@@ -437,7 +435,7 @@ struct root_domain {
  */
 static struct root_domain def_root_domain;
 
-#endif
+#endif /* CONFIG_SMP */
 
 /*
  * This is the main, per-CPU runqueue data structure.
@@ -488,11 +486,12 @@ struct rq {
          */
         unsigned long nr_uninterruptible;
 
-        struct task_struct *curr, *idle;
+        struct task_struct *curr, *idle, *stop;
         unsigned long next_balance;
         struct mm_struct *prev_mm;
 
         u64 clock;
+        u64 clock_task;
 
         atomic_t nr_iowait;
 
@@ -520,6 +519,10 @@ struct rq {
         u64 avg_idle;
 #endif
 
+#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+        u64 prev_irq_time;
+#endif
+
         /* calc_load related fields */
         unsigned long calc_load_update;
         long calc_load_active;
@@ -557,18 +560,8 @@ struct rq {
 
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
 
-static inline
-void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
-{
-        rq->curr->sched_class->check_preempt_curr(rq, p, flags);
 
-        /*
-         * A queue event has occurred, and we're going to schedule.  In
-         * this case, we can save a useless back to back clock update.
-         */
-        if (test_tsk_need_resched(p))
-                rq->skip_clock_update = 1;
-}
+static void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags);
 
 static inline int cpu_of(struct rq *rq)
 {
@@ -643,10 +636,18 @@ static inline struct task_group *task_group(struct task_struct *p)
 
 #endif /* CONFIG_CGROUP_SCHED */
 
-inline void update_rq_clock(struct rq *rq)
+static void update_rq_clock_task(struct rq *rq, s64 delta);
+
+static void update_rq_clock(struct rq *rq)
 {
-        if (!rq->skip_clock_update)
-                rq->clock = sched_clock_cpu(cpu_of(rq));
+        s64 delta;
+
+        if (rq->skip_clock_update)
+                return;
+
+        delta = sched_clock_cpu(cpu_of(rq)) - rq->clock;
+        rq->clock += delta;
+        update_rq_clock_task(rq, delta);
 }
 
 /*
@@ -723,7 +724,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
                 size_t cnt, loff_t *ppos)
 {
         char buf[64];
-        char *cmp = buf;
+        char *cmp;
         int neg = 0;
         int i;
 
@@ -734,6 +735,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
                 return -EFAULT;
 
         buf[cnt] = 0;
+        cmp = strstrip(buf);
 
         if (strncmp(buf, "NO_", 3) == 0) {
                 neg = 1;
@@ -741,9 +743,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
         }
 
         for (i = 0; sched_feat_names[i]; i++) {
-                int len = strlen(sched_feat_names[i]);
-
-                if (strncmp(cmp, sched_feat_names[i], len) == 0) {
+                if (strcmp(cmp, sched_feat_names[i]) == 0) {
                         if (neg)
                                 sysctl_sched_features &= ~(1UL << i);
                         else
@@ -1294,6 +1294,10 @@ static void resched_task(struct task_struct *p)
 static void sched_rt_avg_update(struct rq *rq, u64 rt_delta)
 {
 }
+
+static void sched_avg_update(struct rq *rq)
+{
+}
 #endif /* CONFIG_SMP */
 
 #if BITS_PER_LONG == 32
@@ -1836,7 +1840,7 @@ static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu)
 
 static const struct sched_class rt_sched_class;
 
-#define sched_class_highest (&rt_sched_class)
+#define sched_class_highest (&stop_sched_class)
 #define for_each_class(class) \
    for (class = sched_class_highest; class; class = class->next)
 
@@ -1854,12 +1858,6 @@ static void dec_nr_running(struct rq *rq)
 
 static void set_load_weight(struct task_struct *p)
 {
-        if (task_has_rt_policy(p)) {
-                p->se.load.weight = 0;
-                p->se.load.inv_weight = WMULT_CONST;
-                return;
-        }
-
         /*
          * SCHED_IDLE tasks get minimal weight:
          */
@@ -1913,13 +1911,193 @@ static void deactivate_task(struct rq *rq, struct task_struct *p, int flags)
         dec_nr_running(rq);
 }
 
+#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+
+/*
+ * There are no locks covering percpu hardirq/softirq time.
+ * They are only modified in account_system_vtime, on corresponding CPU
+ * with interrupts disabled. So, writes are safe.
+ * They are read and saved off onto struct rq in update_rq_clock().
+ * This may result in other CPU reading this CPU's irq time and can
+ * race with irq/account_system_vtime on this CPU. We would either get old
+ * or new value with a side effect of accounting a slice of irq time to wrong
+ * task when irq is in progress while we read rq->clock. That is a worthy
+ * compromise in place of having locks on each irq in account_system_time.
+ */
+static DEFINE_PER_CPU(u64, cpu_hardirq_time);
+static DEFINE_PER_CPU(u64, cpu_softirq_time);
+
+static DEFINE_PER_CPU(u64, irq_start_time);
+static int sched_clock_irqtime;
+
+void enable_sched_clock_irqtime(void)
+{
+        sched_clock_irqtime = 1;
+}
+
+void disable_sched_clock_irqtime(void)
+{
+        sched_clock_irqtime = 0;
+}
+
+#ifndef CONFIG_64BIT
+static DEFINE_PER_CPU(seqcount_t, irq_time_seq);
+
+static inline void irq_time_write_begin(void)
+{
+        __this_cpu_inc(irq_time_seq.sequence);
+        smp_wmb();
+}
+
+static inline void irq_time_write_end(void)
+{
+        smp_wmb();
+        __this_cpu_inc(irq_time_seq.sequence);
+}
+
+static inline u64 irq_time_read(int cpu)
+{
+        u64 irq_time;
+        unsigned seq;
+
+        do {
+                seq = read_seqcount_begin(&per_cpu(irq_time_seq, cpu));
+                irq_time = per_cpu(cpu_softirq_time, cpu) +
+                           per_cpu(cpu_hardirq_time, cpu);
+        } while (read_seqcount_retry(&per_cpu(irq_time_seq, cpu), seq));
+
+        return irq_time;
+}
+#else /* CONFIG_64BIT */
+static inline void irq_time_write_begin(void)
+{
+}
+
+static inline void irq_time_write_end(void)
+{
+}
+
+static inline u64 irq_time_read(int cpu)
+{
+        return per_cpu(cpu_softirq_time, cpu) + per_cpu(cpu_hardirq_time, cpu);
+}
+#endif /* CONFIG_64BIT */
+
+/*
+ * Called before incrementing preempt_count on {soft,}irq_enter
+ * and before decrementing preempt_count on {soft,}irq_exit.
+ */
+void account_system_vtime(struct task_struct *curr)
+{
+        unsigned long flags;
+        s64 delta;
+        int cpu;
+
+        if (!sched_clock_irqtime)
+                return;
+
+        local_irq_save(flags);
+
+        cpu = smp_processor_id();
+        delta = sched_clock_cpu(cpu) - __this_cpu_read(irq_start_time);
+        __this_cpu_add(irq_start_time, delta);
+
+        irq_time_write_begin();
+        /*
+         * We do not account for softirq time from ksoftirqd here.
+         * We want to continue accounting softirq time to ksoftirqd thread
+         * in that case, so as not to confuse scheduler with a special task
+         * that do not consume any time, but still wants to run.
+         */
+        if (hardirq_count())
+                __this_cpu_add(cpu_hardirq_time, delta);
+        else if (in_serving_softirq() && !(curr->flags & PF_KSOFTIRQD))
+                __this_cpu_add(cpu_softirq_time, delta);
+
+        irq_time_write_end();
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(account_system_vtime);
+
+static void update_rq_clock_task(struct rq *rq, s64 delta)
+{
+        s64 irq_delta;
+
+        irq_delta = irq_time_read(cpu_of(rq)) - rq->prev_irq_time;
+
+        /*
+         * Since irq_time is only updated on {soft,}irq_exit, we might run into
+         * this case when a previous update_rq_clock() happened inside a
+         * {soft,}irq region.
+         *
+         * When this happens, we stop ->clock_task and only update the
+         * prev_irq_time stamp to account for the part that fit, so that a next
+         * update will consume the rest. This ensures ->clock_task is
+         * monotonic.
+         *
+         * It does however cause some slight miss-attribution of {soft,}irq
+         * time, a more accurate solution would be to update the irq_time using
+         * the current rq->clock timestamp, except that would require using
+         * atomic ops.
+         */
+        if (irq_delta > delta)
+                irq_delta = delta;
+
+        rq->prev_irq_time += irq_delta;
+        delta -= irq_delta;
+        rq->clock_task += delta;
+
+        if (irq_delta && sched_feat(NONIRQ_POWER))
+                sched_rt_avg_update(rq, irq_delta);
+}
+
+#else /* CONFIG_IRQ_TIME_ACCOUNTING */
+
+static void update_rq_clock_task(struct rq *rq, s64 delta)
+{
+        rq->clock_task += delta;
+}
+
+#endif /* CONFIG_IRQ_TIME_ACCOUNTING */
+
 #include "sched_idletask.c"
 #include "sched_fair.c"
 #include "sched_rt.c"
+#include "sched_stoptask.c"
 #ifdef CONFIG_SCHED_DEBUG
 # include "sched_debug.c"
 #endif
 
+void sched_set_stop_task(int cpu, struct task_struct *stop)
+{
+        struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
+        struct task_struct *old_stop = cpu_rq(cpu)->stop;
+
+        if (stop) {
+                /*
+                 * Make it appear like a SCHED_FIFO task, its something
+                 * userspace knows about and won't get confused about.
+                 *
+                 * Also, it will make PI more or less work without too
+                 * much confusion -- but then, stop work should not
+                 * rely on PI working anyway.
+                 */
+                sched_setscheduler_nocheck(stop, SCHED_FIFO, &param);
+
+                stop->sched_class = &stop_sched_class;
+        }
+
+        cpu_rq(cpu)->stop = stop;
+
+        if (old_stop) {
+                /*
+                 * Reset it back to a normal scheduling class so that
+                 * it can die in pieces.
+                 */
+                old_stop->sched_class = &rt_sched_class;
+        }
+}
+
 /*
  * __normal_prio - return the priority that is based on the static prio
  */
@@ -1987,6 +2165,31 @@ static inline void check_class_changed(struct rq *rq, struct task_struct *p,
                 p->sched_class->prio_changed(rq, p, oldprio, running);
 }
 
+static void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
+{
+        const struct sched_class *class;
+
+        if (p->sched_class == rq->curr->sched_class) {
+                rq->curr->sched_class->check_preempt_curr(rq, p, flags);
+        } else {
+                for_each_class(class) {
+                        if (class == rq->curr->sched_class)
+                                break;
+                        if (class == p->sched_class) {
+                                resched_task(rq->curr);
+                                break;
+                        }
+                }
+        }
+
+        /*
+         * A queue event has occurred, and we're going to schedule.  In
+         * this case, we can save a useless back to back clock update.
+         */
+        if (rq->curr->se.on_rq && test_tsk_need_resched(rq->curr))
+                rq->skip_clock_update = 1;
+}
+
 #ifdef CONFIG_SMP
 /*
  * Is this task likely cache-hot:
@@ -1999,6 +2202,9 @@ task_hot(struct task_struct *p, u64 now, struct sched_domain *sd)
         if (p->sched_class != &fair_sched_class)
                 return 0;
 
+        if (unlikely(p->policy == SCHED_IDLE))
+                return 0;
+
         /*
          * Buddy candidates are cache hot:
          */
@@ -2848,14 +3054,14 @@ context_switch(struct rq *rq, struct task_struct *prev,
          */
         arch_start_context_switch(prev);
 
-        if (likely(!mm)) {
+        if (!mm) {
                 next->active_mm = oldmm;
                 atomic_inc(&oldmm->mm_count);
                 enter_lazy_tlb(oldmm, next);
         } else
                 switch_mm(oldmm, mm, next);
 
-        if (likely(!prev->mm)) {
+        if (!prev->mm) {
                 prev->active_mm = NULL;
                 rq->prev_mm = oldmm;
         }
@@ -2970,6 +3176,15 @@ static long calc_load_fold_active(struct rq *this_rq)
         return delta;
 }
 
+static unsigned long
+calc_load(unsigned long load, unsigned long exp, unsigned long active)
+{
+        load *= exp;
+        load += active * (FIXED_1 - exp);
+        load += 1UL << (FSHIFT - 1);
+        return load >> FSHIFT;
+}
+
 #ifdef CONFIG_NO_HZ
 /*
  * For NO_HZ we delay the active fold to the next LOAD_FREQ update.
@@ -2999,6 +3214,128 @@ static long calc_load_fold_idle(void)
 
         return delta;
 }
+
+/**
+ * fixed_power_int - compute: x^n, in O(log n) time
+ *
+ * @x:         base of the power
+ * @frac_bits: fractional bits of @x
+ * @n:         power to raise @x to.
+ *
+ * By exploiting the relation between the definition of the natural power
+ * function: x^n := x*x*...*x (x multiplied by itself for n times), and
+ * the binary encoding of numbers used by computers: n := \Sum n_i * 2^i,
+ * (where: n_i \elem {0, 1}, the binary vector representing n),
+ * we find: x^n := x^(\Sum n_i * 2^i) := \Prod x^(n_i * 2^i), which is
+ * of course trivially computable in O(log_2 n), the length of our binary
+ * vector.
+ */
+static unsigned long
+fixed_power_int(unsigned long x, unsigned int frac_bits, unsigned int n)
+{
+        unsigned long result = 1UL << frac_bits;
+
+        if (n) for (;;) {
+                if (n & 1) {
+                        result *= x;
+                        result += 1UL << (frac_bits - 1);
+                        result >>= frac_bits;
+                }
+                n >>= 1;
+                if (!n)
+                        break;
+                x *= x;
+                x += 1UL << (frac_bits - 1);
+                x >>= frac_bits;
+        }
+
+        return result;
+}
+
+/*
+ * a1 = a0 * e + a * (1 - e)
+ *
+ * a2 = a1 * e + a * (1 - e)
+ *    = (a0 * e + a * (1 - e)) * e + a * (1 - e)
+ *    = a0 * e^2 + a * (1 - e) * (1 + e)
+ *
+ * a3 = a2 * e + a * (1 - e)
+ *    = (a0 * e^2 + a * (1 - e) * (1 + e)) * e + a * (1 - e)
+ *    = a0 * e^3 + a * (1 - e) * (1 + e + e^2)
+ *
+ *  ...
+ *
+ * an = a0 * e^n + a * (1 - e) * (1 + e + ... + e^n-1) [1]
+ *    = a0 * e^n + a * (1 - e) * (1 - e^n)/(1 - e)
+ *    = a0 * e^n + a * (1 - e^n)
+ *
+ * [1] application of the geometric series:
+ *
+ *              n         1 - x^(n+1)
+ *     S_n := \Sum x^i = -------------
+ *             i=0          1 - x
+ */
+static unsigned long
+calc_load_n(unsigned long load, unsigned long exp,
+            unsigned long active, unsigned int n)
+{
+
+        return calc_load(load, fixed_power_int(exp, FSHIFT, n), active);
+}
+
+/*
+ * NO_HZ can leave us missing all per-cpu ticks calling
+ * calc_load_account_active(), but since an idle CPU folds its delta into
+ * calc_load_tasks_idle per calc_load_account_idle(), all we need to do is fold
+ * in the pending idle delta if our idle period crossed a load cycle boundary.
+ *
+ * Once we've updated the global active value, we need to apply the exponential
+ * weights adjusted to the number of cycles missed.
+ */
+static void calc_global_nohz(unsigned long ticks)
+{
+        long delta, active, n;
+
+        if (time_before(jiffies, calc_load_update))
+                return;
+
+        /*
+         * If we crossed a calc_load_update boundary, make sure to fold
+         * any pending idle changes, the respective CPUs might have
+         * missed the tick driven calc_load_account_active() update
+         * due to NO_HZ.
+         */
+        delta = calc_load_fold_idle();
+        if (delta)
+                atomic_long_add(delta, &calc_load_tasks);
+
+        /*
+         * If we were idle for multiple load cycles, apply them.
+         */
+        if (ticks >= LOAD_FREQ) {
+                n = ticks / LOAD_FREQ;
+
+                active = atomic_long_read(&calc_load_tasks);
+                active = active > 0 ? active * FIXED_1 : 0;
+
+                avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
+                avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
+                avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
+
+                calc_load_update += n * LOAD_FREQ;
+        }
+
+        /*
+         * Its possible the remainder of the above division also crosses
+         * a LOAD_FREQ period, the regular check in calc_global_load()
+         * which comes after this will take care of that.
+         *
+         * Consider us being 11 ticks before a cycle completion, and us
+         * sleeping for 4*LOAD_FREQ + 22 ticks, then the above code will
+         * age us 4 cycles, and the test in calc_global_load() will
+         * pick up the final one.
+         */
+}
 #else
 static void calc_load_account_idle(struct rq *this_rq)
 {
@@ -3008,6 +3345,10 @@ static inline long calc_load_fold_idle(void)
 {
         return 0;
 }
+
+static void calc_global_nohz(unsigned long ticks)
+{
+}
 #endif
 
 /**
@@ -3025,24 +3366,17 @@ void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
         loads[2] = (avenrun[2] + offset) << shift;
 }
 
-static unsigned long
-calc_load(unsigned long load, unsigned long exp, unsigned long active)
-{
-        load *= exp;
-        load += active * (FIXED_1 - exp);
-        return load >> FSHIFT;
-}
-
 /*
  * calc_load - update the avenrun load estimates 10 ticks after the
  * CPUs have updated calc_load_tasks.
  */
-void calc_global_load(void)
+void calc_global_load(unsigned long ticks)
 {
-        unsigned long upd = calc_load_update + 10;
         long active;
 
-        if (time_before(jiffies, upd))
+        calc_global_nohz(ticks);
+
+        if (time_before(jiffies, calc_load_update + 10))
                 return;
 
         active = atomic_long_read(&calc_load_tasks);
@@ -3182,6 +3516,8 @@ static void update_cpu_load(struct rq *this_rq)
 
                 this_rq->cpu_load[i] = (old_load * (scale - 1) + new_load) >> i;
         }
+
+        sched_avg_update(this_rq);
 }
 
 static void update_cpu_load_active(struct rq *this_rq)
@@ -3242,7 +3578,7 @@ static u64 do_task_delta_exec(struct task_struct *p, struct rq *rq)
 
         if (task_current(rq, p)) {
                 update_rq_clock(rq);
-                ns = rq->clock - p->se.exec_start;
+                ns = rq->clock_task - p->se.exec_start;
                 if ((s64)ns < 0)
                         ns = 0;
         }
@@ -3391,7 +3727,7 @@ void account_system_time(struct task_struct *p, int hardirq_offset,
         tmp = cputime_to_cputime64(cputime);
         if (hardirq_count() - hardirq_offset)
                 cpustat->irq = cputime64_add(cpustat->irq, tmp);
-        else if (softirq_count())
+        else if (in_serving_softirq())
                 cpustat->softirq = cputime64_add(cpustat->softirq, tmp);
         else
                 cpustat->system = cputime64_add(cpustat->system, tmp);
@@ -3507,9 +3843,9 @@ void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
         rtime = nsecs_to_cputime(p->se.sum_exec_runtime);
 
         if (total) {
-                u64 temp;
+                u64 temp = rtime;
 
-                temp = (u64)(rtime * utime);
+                temp *= utime;
                 do_div(temp, total);
                 utime = (cputime_t)temp;
         } else
@@ -3540,9 +3876,9 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
         rtime = nsecs_to_cputime(cputime.sum_exec_runtime);
 
         if (total) {
-                u64 temp;
+                u64 temp = rtime;
 
-                temp = (u64)(rtime * cputime.utime);
+                temp *= cputime.utime;
                 do_div(temp, total);
                 utime = (cputime_t)temp;
         } else
@@ -3578,7 +3914,7 @@ void scheduler_tick(void)
         curr->sched_class->task_tick(rq, curr, 0);
         raw_spin_unlock(&rq->lock);
 
-        perf_event_task_tick(curr);
+        perf_event_task_tick();
 
 #ifdef CONFIG_SMP
         rq->idle_at_tick = idle_cpu(cpu);
@@ -3694,7 +4030,6 @@ static void put_prev_task(struct rq *rq, struct task_struct *prev)
 {
         if (prev->se.on_rq)
                 update_rq_clock(rq);
-        rq->skip_clock_update = 0;
         prev->sched_class->put_prev_task(rq, prev);
 }
 
@@ -3717,17 +4052,13 @@ pick_next_task(struct rq *rq)
                         return p;
         }
 
-        class = sched_class_highest;
-        for ( ; ; ) {
+        for_each_class(class) {
                 p = class->pick_next_task(rq);
                 if (p)
                         return p;
-                /*
-                 * Will never be NULL as the idle class always
-                 * returns a non-NULL p:
-                 */
-                class = class->next;
         }
+
+        BUG(); /* the idle class will always have a runnable task */
 }
 
 /*
@@ -3756,7 +4087,6 @@ need_resched_nonpreemptible:
                 hrtick_clear(rq);
 
         raw_spin_lock_irq(&rq->lock);
-        clear_tsk_need_resched(prev);
 
         switch_count = &prev->nivcsw;
         if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
@@ -3788,6 +4118,8 @@ need_resched_nonpreemptible:
 
         put_prev_task(rq, prev);
         next = pick_next_task(rq);
+        clear_tsk_need_resched(prev);
+        rq->skip_clock_update = 0;
 
         if (likely(prev != next)) {
                 sched_info_switch(prev, next);
@@ -3865,8 +4197,16 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
                 /*
                  * Owner changed, break to re-assess state.
                  */
-                if (lock->owner != owner)
+                if (lock->owner != owner) {
+                        /*
+                         * If the lock has switched to a different owner,
+                         * we likely have heavy contention. Return 0 to quit
+                         * optimistic spinning and not contend further:
+                         */
+                        if (lock->owner)
+                                return 0;
                         break;
+                }
 
                 /*
                  * Is that owner really running on that cpu?
@@ -4344,6 +4684,7 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
 
         rq = task_rq_lock(p, &flags);
 
+        trace_sched_pi_setprio(p, prio);
         oldprio = p->prio;
         prev_class = p->sched_class;
         on_rq = p->se.on_rq;
@@ -4631,7 +4972,7 @@ recheck:
         }
 
         if (user) {
-                retval = security_task_setscheduler(p, policy, param);
+                retval = security_task_setscheduler(p);
                 if (retval)
                         return retval;
         }
@@ -4647,6 +4988,15 @@ recheck:
          */
         rq = __task_rq_lock(p);
 
+        /*
+         * Changing the policy of the stop threads its a very bad idea
+         */
+        if (p == rq->stop) {
+                __task_rq_unlock(rq);
+                raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+                return -EINVAL;
+        }
+
 #ifdef CONFIG_RT_GROUP_SCHED
         if (user) {
                 /*
@@ -4873,13 +5223,13 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
         if (!check_same_owner(p) && !capable(CAP_SYS_NICE))
                 goto out_unlock;
 
-        retval = security_task_setscheduler(p, 0, NULL);
+        retval = security_task_setscheduler(p);
         if (retval)
                 goto out_unlock;
 
         cpuset_cpus_allowed(p, cpus_allowed);
         cpumask_and(new_mask, in_mask, cpus_allowed);
- again:
+again:
         retval = set_cpus_allowed_ptr(p, new_mask);
 
         if (!retval) {
@@ -5323,7 +5673,19 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
         idle->se.exec_start = sched_clock();
 
         cpumask_copy(&idle->cpus_allowed, cpumask_of(cpu));
+        /*
+         * We're having a chicken and egg problem, even though we are
+         * holding rq->lock, the cpu isn't yet set to this cpu so the
+         * lockdep check in task_group() will fail.
+         *
+         * Similar case to sched_fork(). / Alternatively we could
+         * use task_rq_lock() here and obtain the other rq->lock.
+         *
+         * Silence PROVE_RCU
+         */
+        rcu_read_lock();
         __set_task_cpu(idle, cpu);
+        rcu_read_unlock();
 
         rq->curr = rq->idle = idle;
 #if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
@@ -6500,6 +6862,7 @@ struct s_data {
         cpumask_var_t           nodemask;
         cpumask_var_t           this_sibling_map;
         cpumask_var_t           this_core_map;
+        cpumask_var_t           this_book_map;
         cpumask_var_t           send_covered;
         cpumask_var_t           tmpmask;
         struct sched_group      **sched_group_nodes;
@@ -6511,6 +6874,7 @@ enum s_alloc {
         sa_rootdomain,
         sa_tmpmask,
         sa_send_covered,
+        sa_this_book_map,
         sa_this_core_map,
         sa_this_sibling_map,
         sa_nodemask,
@@ -6546,31 +6910,48 @@ cpu_to_cpu_group(int cpu, const struct cpumask *cpu_map,
 #ifdef CONFIG_SCHED_MC
 static DEFINE_PER_CPU(struct static_sched_domain, core_domains);
 static DEFINE_PER_CPU(struct static_sched_group, sched_group_core);
-#endif /* CONFIG_SCHED_MC */
 
-#if defined(CONFIG_SCHED_MC) && defined(CONFIG_SCHED_SMT)
 static int
 cpu_to_core_group(int cpu, const struct cpumask *cpu_map,
                   struct sched_group **sg, struct cpumask *mask)
 {
         int group;
-
+#ifdef CONFIG_SCHED_SMT
         cpumask_and(mask, topology_thread_cpumask(cpu), cpu_map);
         group = cpumask_first(mask);
+#else
+        group = cpu;
+#endif
         if (sg)
                 *sg = &per_cpu(sched_group_core, group).sg;
         return group;
 }
-#elif defined(CONFIG_SCHED_MC)
+#endif /* CONFIG_SCHED_MC */
+
+/*
+ * book sched-domains:
+ */
+#ifdef CONFIG_SCHED_BOOK
+static DEFINE_PER_CPU(struct static_sched_domain, book_domains);
+static DEFINE_PER_CPU(struct static_sched_group, sched_group_book);
+
 static int
-cpu_to_core_group(int cpu, const struct cpumask *cpu_map,
-                  struct sched_group **sg, struct cpumask *unused)
+cpu_to_book_group(int cpu, const struct cpumask *cpu_map,
+                  struct sched_group **sg, struct cpumask *mask)
 {
+        int group = cpu;
+#ifdef CONFIG_SCHED_MC
+        cpumask_and(mask, cpu_coregroup_mask(cpu), cpu_map);
+        group = cpumask_first(mask);
+#elif defined(CONFIG_SCHED_SMT)
+        cpumask_and(mask, topology_thread_cpumask(cpu), cpu_map);
+        group = cpumask_first(mask);
+#endif
         if (sg)
-                *sg = &per_cpu(sched_group_core, cpu).sg;
-        return cpu;
+                *sg = &per_cpu(sched_group_book, group).sg;
+        return group;
 }
-#endif
+#endif /* CONFIG_SCHED_BOOK */
 
 static DEFINE_PER_CPU(struct static_sched_domain, phys_domains);
 static DEFINE_PER_CPU(struct static_sched_group, sched_group_phys);
@@ -6580,7 +6961,10 @@ cpu_to_phys_group(int cpu, const struct cpumask *cpu_map,
                   struct sched_group **sg, struct cpumask *mask)
 {
         int group;
-#ifdef CONFIG_SCHED_MC
+#ifdef CONFIG_SCHED_BOOK
+        cpumask_and(mask, cpu_book_mask(cpu), cpu_map);
+        group = cpumask_first(mask);
+#elif defined(CONFIG_SCHED_MC)
         cpumask_and(mask, cpu_coregroup_mask(cpu), cpu_map);
         group = cpumask_first(mask);
 #elif defined(CONFIG_SCHED_SMT)
@@ -6776,6 +7160,8 @@ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
         if (cpu != group_first_cpu(sd->groups))
                 return;
 
+        sd->groups->group_weight = cpumask_weight(sched_group_cpus(sd->groups));
+
         child = sd->child;
 
         sd->groups->cpu_power = 0;
@@ -6841,6 +7227,9 @@ SD_INIT_FUNC(CPU)
 #ifdef CONFIG_SCHED_MC
  SD_INIT_FUNC(MC)
 #endif
+#ifdef CONFIG_SCHED_BOOK
+ SD_INIT_FUNC(BOOK)
+#endif
 
 static int default_relax_domain_level = -1;
 
@@ -6890,6 +7279,8 @@ static void __free_domain_allocs(struct s_data *d, enum s_alloc what,
                 free_cpumask_var(d->tmpmask); /* fall through */
         case sa_send_covered:
                 free_cpumask_var(d->send_covered); /* fall through */
+        case sa_this_book_map:
+                free_cpumask_var(d->this_book_map); /* fall through */
         case sa_this_core_map:
                 free_cpumask_var(d->this_core_map); /* fall through */
         case sa_this_sibling_map:
@@ -6936,8 +7327,10 @@ static enum s_alloc __visit_domain_allocation_hell(struct s_data *d,
                 return sa_nodemask;
         if (!alloc_cpumask_var(&d->this_core_map, GFP_KERNEL))
                 return sa_this_sibling_map;
-        if (!alloc_cpumask_var(&d->send_covered, GFP_KERNEL))
+        if (!alloc_cpumask_var(&d->this_book_map, GFP_KERNEL))
                 return sa_this_core_map;
+        if (!alloc_cpumask_var(&d->send_covered, GFP_KERNEL))
+                return sa_this_book_map;
         if (!alloc_cpumask_var(&d->tmpmask, GFP_KERNEL))
                 return sa_send_covered;
         d->rd = alloc_rootdomain();
@@ -6995,6 +7388,23 @@ static struct sched_domain *__build_cpu_sched_domain(struct s_data *d,
         return sd;
 }
 
+static struct sched_domain *__build_book_sched_domain(struct s_data *d,
+        const struct cpumask *cpu_map, struct sched_domain_attr *attr,
+        struct sched_domain *parent, int i)
+{
+        struct sched_domain *sd = parent;
+#ifdef CONFIG_SCHED_BOOK
+        sd = &per_cpu(book_domains, i).sd;
+        SD_INIT(sd, BOOK);
+        set_domain_attribute(sd, attr);
+        cpumask_and(sched_domain_span(sd), cpu_map, cpu_book_mask(i));
+        sd->parent = parent;
+        parent->child = sd;
+        cpu_to_book_group(i, cpu_map, &sd->groups, d->tmpmask);
+#endif
+        return sd;
+}
+
 static struct sched_domain *__build_mc_sched_domain(struct s_data *d,
         const struct cpumask *cpu_map, struct sched_domain_attr *attr,
         struct sched_domain *parent, int i)
@@ -7052,6 +7462,15 @@ static void build_sched_groups(struct s_data *d, enum sched_domain_level l,
                                                 d->send_covered, d->tmpmask);
                 break;
 #endif
+#ifdef CONFIG_SCHED_BOOK
+        case SD_LV_BOOK: /* set up book groups */
+                cpumask_and(d->this_book_map, cpu_map, cpu_book_mask(cpu));
+                if (cpu == cpumask_first(d->this_book_map))
+                        init_sched_build_groups(d->this_book_map, cpu_map,
+                                                &cpu_to_book_group,
+                                                d->send_covered, d->tmpmask);
+                break;
+#endif
         case SD_LV_CPU: /* set up physical groups */
                 cpumask_and(d->nodemask, cpumask_of_node(cpu), cpu_map);
                 if (!cpumask_empty(d->nodemask))
@@ -7099,12 +7518,14 @@ static int __build_sched_domains(const struct cpumask *cpu_map,
 
                 sd = __build_numa_sched_domains(&d, cpu_map, attr, i);
                 sd = __build_cpu_sched_domain(&d, cpu_map, attr, sd, i);
+                sd = __build_book_sched_domain(&d, cpu_map, attr, sd, i);
                 sd = __build_mc_sched_domain(&d, cpu_map, attr, sd, i);
                 sd = __build_smt_sched_domain(&d, cpu_map, attr, sd, i);
         }
 
         for_each_cpu(i, cpu_map) {
                 build_sched_groups(&d, SD_LV_SIBLING, cpu_map, i);
+                build_sched_groups(&d, SD_LV_BOOK, cpu_map, i);
                 build_sched_groups(&d, SD_LV_MC, cpu_map, i);
         }
 
@@ -7135,6 +7556,12 @@ static int __build_sched_domains(const struct cpumask *cpu_map,
                 init_sched_groups_power(i, sd);
         }
 #endif
+#ifdef CONFIG_SCHED_BOOK
+        for_each_cpu(i, cpu_map) {
+                sd = &per_cpu(book_domains, i).sd;
+                init_sched_groups_power(i, sd);
+        }
+#endif
 
         for_each_cpu(i, cpu_map) {
                 sd = &per_cpu(phys_domains, i).sd;
@@ -7160,6 +7587,8 @@ static int __build_sched_domains(const struct cpumask *cpu_map,
                 sd = &per_cpu(cpu_domains, i).sd;
 #elif defined(CONFIG_SCHED_MC)
                 sd = &per_cpu(core_domains, i).sd;
+#elif defined(CONFIG_SCHED_BOOK)
+                sd = &per_cpu(book_domains, i).sd;
 #else
                 sd = &per_cpu(phys_domains, i).sd;
 #endif
@@ -8064,9 +8493,9 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
 
         return 1;
 
- err_free_rq:
+err_free_rq:
         kfree(cfs_rq);
- err:
+err:
         return 0;
 }
 
@@ -8154,9 +8583,9 @@ int alloc_rt_sched_group(struct task_group *tg, struct task_group *parent)
 
         return 1;
 
- err_free_rq:
+err_free_rq:
         kfree(rt_rq);
- err:
+err:
         return 0;
 }
 
@@ -8283,12 +8712,12 @@ void sched_move_task(struct task_struct *tsk)
         if (unlikely(running))
                 tsk->sched_class->put_prev_task(rq, tsk);
 
-        set_task_rq(tsk, task_cpu(tsk));
-
 #ifdef CONFIG_FAIR_GROUP_SCHED
-        if (tsk->sched_class->moved_group)
-                tsk->sched_class->moved_group(tsk, on_rq);
+        if (tsk->sched_class->task_move_group)
+                tsk->sched_class->task_move_group(tsk, on_rq);
+        else
 #endif
+                set_task_rq(tsk, task_cpu(tsk));
 
         if (unlikely(running))
                 tsk->sched_class->set_curr_task(rq);
@@ -8514,7 +8943,7 @@ static int tg_set_bandwidth(struct task_group *tg,
                 raw_spin_unlock(&rt_rq->rt_runtime_lock);
         }
         raw_spin_unlock_irq(&tg->rt_bandwidth.rt_runtime_lock);
- unlock:
+unlock:
         read_unlock(&tasklist_lock);
         mutex_unlock(&rt_constraints_mutex);
 
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 806d1b227a21..00ebd7686676 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -25,7 +25,7 @@
 
 /*
  * Targeted preemption latency for CPU-bound tasks:
- * (default: 5ms * (1 + ilog(ncpus)), units: nanoseconds)
+ * (default: 6ms * (1 + ilog(ncpus)), units: nanoseconds)
  *
  * NOTE: this latency value is not the same as the concept of
  * 'timeslice length' - timeslices in CFS are of variable length
@@ -52,15 +52,15 @@ enum sched_tunable_scaling sysctl_sched_tunable_scaling
 
 /*
  * Minimal preemption granularity for CPU-bound tasks:
- * (default: 2 msec * (1 + ilog(ncpus)), units: nanoseconds)
+ * (default: 0.75 msec * (1 + ilog(ncpus)), units: nanoseconds)
  */
-unsigned int sysctl_sched_min_granularity = 2000000ULL;
-unsigned int normalized_sysctl_sched_min_granularity = 2000000ULL;
+unsigned int sysctl_sched_min_granularity = 750000ULL;
+unsigned int normalized_sysctl_sched_min_granularity = 750000ULL;
 
 /*
  * is kept at sysctl_sched_latency / sysctl_sched_min_granularity
  */
-static unsigned int sched_nr_latency = 3;
+static unsigned int sched_nr_latency = 8;
 
 /*
  * After fork, child runs first. If set to 0 (default) then
@@ -519,7 +519,7 @@ __update_curr(struct cfs_rq *cfs_rq, struct sched_entity *curr,
 static void update_curr(struct cfs_rq *cfs_rq)
 {
         struct sched_entity *curr = cfs_rq->curr;
-        u64 now = rq_of(cfs_rq)->clock;
+        u64 now = rq_of(cfs_rq)->clock_task;
         unsigned long delta_exec;
 
         if (unlikely(!curr))
@@ -602,7 +602,7 @@ update_stats_curr_start(struct cfs_rq *cfs_rq, struct sched_entity *se)
         /*
          * We are starting a new run period:
          */
-        se->exec_start = rq_of(cfs_rq)->clock;
+        se->exec_start = rq_of(cfs_rq)->clock_task;
 }
 
 /**************************************************
@@ -1313,7 +1313,7 @@ static struct sched_group *
 find_idlest_group(struct sched_domain *sd, struct task_struct *p,
                   int this_cpu, int load_idx)
 {
-        struct sched_group *idlest = NULL, *this = NULL, *group = sd->groups;
+        struct sched_group *idlest = NULL, *group = sd->groups;
         unsigned long min_load = ULONG_MAX, this_load = 0;
         int imbalance = 100 + (sd->imbalance_pct-100)/2;
 
@@ -1348,7 +1348,6 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p,
 
                 if (local_group) {
                         this_load = avg_load;
-                        this = group;
                 } else if (avg_load < min_load) {
                         min_load = avg_load;
                         idlest = group;
@@ -1655,12 +1654,6 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
         struct cfs_rq *cfs_rq = task_cfs_rq(curr);
         int scale = cfs_rq->nr_running >= sched_nr_latency;
 
-        if (unlikely(rt_prio(p->prio)))
-                goto preempt;
-
-        if (unlikely(p->sched_class != &fair_sched_class))
-                return;
-
         if (unlikely(se == pse))
                 return;
 
@@ -1799,7 +1792,7 @@ int can_migrate_task(struct task_struct *p, struct rq *rq, int this_cpu,
          * 2) too many balance attempts have failed.
          */
 
-        tsk_cache_hot = task_hot(p, rq->clock, sd);
+        tsk_cache_hot = task_hot(p, rq->clock_task, sd);
         if (!tsk_cache_hot ||
                 sd->nr_balance_failed > sd->cache_nice_tries) {
 #ifdef CONFIG_SCHEDSTATS
@@ -2031,12 +2024,17 @@ struct sd_lb_stats {
         unsigned long this_load;
         unsigned long this_load_per_task;
         unsigned long this_nr_running;
+        unsigned long this_has_capacity;
+        unsigned int  this_idle_cpus;
 
         /* Statistics of the busiest group */
+        unsigned int  busiest_idle_cpus;
         unsigned long max_load;
         unsigned long busiest_load_per_task;
         unsigned long busiest_nr_running;
         unsigned long busiest_group_capacity;
+        unsigned long busiest_has_capacity;
+        unsigned int  busiest_group_weight;
 
         int group_imb; /* Is there imbalance in this sd */
 #if defined(CONFIG_SCHED_MC) || defined(CONFIG_SCHED_SMT)
@@ -2058,7 +2056,10 @@ struct sg_lb_stats {
         unsigned long sum_nr_running; /* Nr tasks running in the group */
         unsigned long sum_weighted_load; /* Weighted load of group's tasks */
         unsigned long group_capacity;
+        unsigned long idle_cpus;
+        unsigned long group_weight;
         int group_imb; /* Is there an imbalance in the group ? */
+        int group_has_capacity; /* Is there extra capacity in the group? */
 };
 
 /**
@@ -2268,10 +2269,14 @@ unsigned long scale_rt_power(int cpu)
         struct rq *rq = cpu_rq(cpu);
         u64 total, available;
 
-        sched_avg_update(rq);
-
         total = sched_avg_period() + (rq->clock - rq->age_stamp);
-        available = total - rq->rt_avg;
+
+        if (unlikely(total < rq->rt_avg)) {
+                /* Ensures that power won't end up being negative */
+                available = 0;
+        } else {
+                available = total - rq->rt_avg;
+        }
 
         if (unlikely((s64)total < SCHED_LOAD_SCALE))
                 total = SCHED_LOAD_SCALE;
@@ -2381,7 +2386,7 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
                         int local_group, const struct cpumask *cpus,
                         int *balance, struct sg_lb_stats *sgs)
 {
-        unsigned long load, max_cpu_load, min_cpu_load;
+        unsigned long load, max_cpu_load, min_cpu_load, max_nr_running;
         int i;
         unsigned int balance_cpu = -1, first_idle_cpu = 0;
         unsigned long avg_load_per_task = 0;
@@ -2392,6 +2397,7 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
         /* Tally up the load of all CPUs in the group */
         max_cpu_load = 0;
         min_cpu_load = ~0UL;
+        max_nr_running = 0;
 
         for_each_cpu_and(i, sched_group_cpus(group), cpus) {
                 struct rq *rq = cpu_rq(i);
@@ -2409,8 +2415,10 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
                         load = target_load(i, load_idx);
                 } else {
                         load = source_load(i, load_idx);
-                        if (load > max_cpu_load)
+                        if (load > max_cpu_load) {
                                 max_cpu_load = load;
+                                max_nr_running = rq->nr_running;
+                        }
                         if (min_cpu_load > load)
                                 min_cpu_load = load;
                 }
@@ -2418,7 +2426,8 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
                 sgs->group_load += load;
                 sgs->sum_nr_running += rq->nr_running;
                 sgs->sum_weighted_load += weighted_cpuload(i);
-
+                if (idle_cpu(i))
+                        sgs->idle_cpus++;
         }
 
         /*
@@ -2450,13 +2459,16 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
         if (sgs->sum_nr_running)
                 avg_load_per_task = sgs->sum_weighted_load / sgs->sum_nr_running;
 
-        if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task)
+        if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task && max_nr_running > 1)
                 sgs->group_imb = 1;
 
-        sgs->group_capacity =
-                DIV_ROUND_CLOSEST(group->cpu_power, SCHED_LOAD_SCALE);
+        sgs->group_capacity = DIV_ROUND_CLOSEST(group->cpu_power, SCHED_LOAD_SCALE);
         if (!sgs->group_capacity)
                 sgs->group_capacity = fix_small_capacity(sd, group);
+        sgs->group_weight = group->group_weight;
+
+        if (sgs->group_capacity > sgs->sum_nr_running)
+                sgs->group_has_capacity = 1;
 }
 
 /**
@@ -2545,9 +2557,14 @@ static inline void update_sd_lb_stats(struct sched_domain *sd, int this_cpu,
                 /*
                  * In case the child domain prefers tasks go to siblings
                  * first, lower the sg capacity to one so that we'll try
-                 * and move all the excess tasks away.
+                 * and move all the excess tasks away. We lower the capacity
+                 * of a group only if the local group has the capacity to fit
+                 * these excess tasks, i.e. nr_running < group_capacity. The
+                 * extra check prevents the case where you always pull from the
+                 * heaviest group when it is already under-utilized (possible
+                 * with a large weight task outweighs the tasks on the system).
                  */
-                if (prefer_sibling)
+                if (prefer_sibling && !local_group && sds->this_has_capacity)
                         sgs.group_capacity = min(sgs.group_capacity, 1UL);
 
                 if (local_group) {
@@ -2555,12 +2572,17 @@ static inline void update_sd_lb_stats(struct sched_domain *sd, int this_cpu,
                         sds->this = sg;
                         sds->this_nr_running = sgs.sum_nr_running;
                         sds->this_load_per_task = sgs.sum_weighted_load;
+                        sds->this_has_capacity = sgs.group_has_capacity;
+                        sds->this_idle_cpus = sgs.idle_cpus;
                 } else if (update_sd_pick_busiest(sd, sds, sg, &sgs, this_cpu)) {
                         sds->max_load = sgs.avg_load;
                         sds->busiest = sg;
                         sds->busiest_nr_running = sgs.sum_nr_running;
+                        sds->busiest_idle_cpus = sgs.idle_cpus;
                         sds->busiest_group_capacity = sgs.group_capacity;
                         sds->busiest_load_per_task = sgs.sum_weighted_load;
+                        sds->busiest_has_capacity = sgs.group_has_capacity;
+                        sds->busiest_group_weight = sgs.group_weight;
                         sds->group_imb = sgs.group_imb;
                 }
 
@@ -2757,6 +2779,7 @@ static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu,
                 return fix_small_imbalance(sds, this_cpu, imbalance);
 
 }
+
 /******* find_busiest_group() helpers end here *********************/
 
 /**
@@ -2808,6 +2831,11 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
          * 4) This group is more busy than the avg busieness at this
          *    sched_domain.
          * 5) The imbalance is within the specified limit.
+         *
+         * Note: when doing newidle balance, if the local group has excess
+         * capacity (i.e. nr_running < group_capacity) and the busiest group
+         * does not have any capacity, we force a load balance to pull tasks
+         * to the local group. In this case, we skip past checks 3, 4 and 5.
          */
         if (!(*balance))
                 goto ret;
@@ -2819,6 +2847,11 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
         if (!sds.busiest || sds.busiest_nr_running == 0)
                 goto out_balanced;
 
+        /*  SD_BALANCE_NEWIDLE trumps SMP nice when underutilized */
+        if (idle == CPU_NEWLY_IDLE && sds.this_has_capacity &&
+                        !sds.busiest_has_capacity)
+                goto force_balance;
+
         if (sds.this_load >= sds.max_load)
                 goto out_balanced;
 
@@ -2827,9 +2860,28 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
         if (sds.this_load >= sds.avg_load)
                 goto out_balanced;
 
-        if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load)
-                goto out_balanced;
+        /*
+         * In the CPU_NEWLY_IDLE, use imbalance_pct to be conservative.
+         * And to check for busy balance use !idle_cpu instead of
+         * CPU_NOT_IDLE. This is because HT siblings will use CPU_NOT_IDLE
+         * even when they are idle.
+         */
+        if (idle == CPU_NEWLY_IDLE || !idle_cpu(this_cpu)) {
+                if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load)
+                        goto out_balanced;
+        } else {
+                /*
+                 * This cpu is idle. If the busiest group load doesn't
+                 * have more tasks than the number of available cpu's and
+                 * there is no imbalance between this and busiest group
+                 * wrt to idle cpu's, it is balanced.
+                 */
+                if ((sds.this_idle_cpus  <= sds.busiest_idle_cpus + 1) &&
+                    sds.busiest_nr_running <= sds.busiest_group_weight)
+                        goto out_balanced;
+        }
 
+force_balance:
         /* Looks like there is an imbalance. Compute it */
         calculate_imbalance(&sds, this_cpu, imbalance);
         return sds.busiest;
@@ -3034,7 +3086,14 @@ redo:
 
         if (!ld_moved) {
                 schedstat_inc(sd, lb_failed[idle]);
-                sd->nr_balance_failed++;
+                /*
+                 * Increment the failure counter only on periodic balance.
+                 * We do not want newidle balance, which can be very
+                 * frequent, pollute the failure counter causing
+                 * excessive cache_hot migrations and active balances.
+                 */
+                if (idle != CPU_NEWLY_IDLE)
+                        sd->nr_balance_failed++;
 
                 if (need_active_balance(sd, sd_idle, idle, cpu_of(busiest),
                                         this_cpu)) {
@@ -3633,7 +3692,7 @@ static inline int nohz_kick_needed(struct rq *rq, int cpu)
         if (time_before(now, nohz.next_balance))
                 return 0;
 
-        if (!rq->nr_running)
+        if (rq->idle_at_tick)
                 return 0;
 
         first_pick_cpu = atomic_read(&nohz.first_pick_cpu);
@@ -3752,8 +3811,13 @@ static void task_fork_fair(struct task_struct *p)
 
         raw_spin_lock_irqsave(&rq->lock, flags);
 
-        if (unlikely(task_cpu(p) != this_cpu))
+        update_rq_clock(rq);
+
+        if (unlikely(task_cpu(p) != this_cpu)) {
+                rcu_read_lock();
                 __set_task_cpu(p, this_cpu);
+                rcu_read_unlock();
+        }
 
         update_curr(cfs_rq);
 
@@ -3825,13 +3889,26 @@ static void set_curr_task_fair(struct rq *rq)
 }
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
-static void moved_group_fair(struct task_struct *p, int on_rq)
+static void task_move_group_fair(struct task_struct *p, int on_rq)
 {
-        struct cfs_rq *cfs_rq = task_cfs_rq(p);
-
-        update_curr(cfs_rq);
+        /*
+         * If the task was not on the rq at the time of this cgroup movement
+         * it must have been asleep, sleeping tasks keep their ->vruntime
+         * absolute on their old rq until wakeup (needed for the fair sleeper
+         * bonus in place_entity()).
+         *
+         * If it was on the rq, we've just 'preempted' it, which does convert
+         * ->vruntime to a relative base.
+         *
+         * Make sure both cases convert their relative position when migrating
+         * to another cgroup's rq. This does somewhat interfere with the
+         * fair sleeper stuff for the first placement, but who cares.
+         */
+        if (!on_rq)
+                p->se.vruntime -= cfs_rq_of(&p->se)->min_vruntime;
+        set_task_rq(p, task_cpu(p));
         if (!on_rq)
-                place_entity(cfs_rq, &p->se, 1);
+                p->se.vruntime += cfs_rq_of(&p->se)->min_vruntime;
 }
 #endif
 
@@ -3883,7 +3960,7 @@ static const struct sched_class fair_sched_class = {
         .get_rr_interval        = get_rr_interval_fair,
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
-        .moved_group            = moved_group_fair,
+        .task_move_group        = task_move_group_fair,
 #endif
 };
 
diff --git a/kernel/sched_features.h b/kernel/sched_features.h
index 83c66e8ad3ee..185f920ec1a2 100644
--- a/kernel/sched_features.h
+++ b/kernel/sched_features.h
@@ -61,3 +61,8 @@ SCHED_FEAT(ASYM_EFF_LOAD, 1)
  * release the lock. Decreases scheduling overhead.
  */
 SCHED_FEAT(OWNER_SPIN, 1)
+
+/*
+ * Decrement CPU power based on irq activity
+ */
+SCHED_FEAT(NONIRQ_POWER, 1)
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index d10c80ebb67a..bea7d79f7e9c 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -609,7 +609,7 @@ static void update_curr_rt(struct rq *rq)
         if (!task_has_rt_policy(curr))
                 return;
 
-        delta_exec = rq->clock - curr->se.exec_start;
+        delta_exec = rq->clock_task - curr->se.exec_start;
         if (unlikely((s64)delta_exec < 0))
                 delta_exec = 0;
 
@@ -618,7 +618,7 @@ static void update_curr_rt(struct rq *rq)
         curr->se.sum_exec_runtime += delta_exec;
         account_group_exec_runtime(curr, delta_exec);
 
-        curr->se.exec_start = rq->clock;
+        curr->se.exec_start = rq->clock_task;
         cpuacct_charge(curr, delta_exec);
 
         sched_rt_avg_update(rq, delta_exec);
@@ -960,18 +960,19 @@ select_task_rq_rt(struct rq *rq, struct task_struct *p, int sd_flag, int flags)
          * runqueue. Otherwise simply start this RT task
          * on its current runqueue.
          *
-         * We want to avoid overloading runqueues. Even if
-         * the RT task is of higher priority than the current RT task.
-         * RT tasks behave differently than other tasks. If
-         * one gets preempted, we try to push it off to another queue.
-         * So trying to keep a preempting RT task on the same
-         * cache hot CPU will force the running RT task to
-         * a cold CPU. So we waste all the cache for the lower
-         * RT task in hopes of saving some of a RT task
-         * that is just being woken and probably will have
-         * cold cache anyway.
+         * We want to avoid overloading runqueues. If the woken
+         * task is a higher priority, then it will stay on this CPU
+         * and the lower prio task should be moved to another CPU.
+         * Even though this will probably make the lower prio task
+         * lose its cache, we do not want to bounce a higher task
+         * around just because it gave up its CPU, perhaps for a
+         * lock?
+         *
+         * For equal prio tasks, we just let the scheduler sort it out.
          */
         if (unlikely(rt_task(rq->curr)) &&
+            (rq->curr->rt.nr_cpus_allowed < 2 ||
+             rq->curr->prio < p->prio) &&
             (p->rt.nr_cpus_allowed > 1)) {
                 int cpu = find_lowest_rq(p);
 
@@ -1074,7 +1075,7 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)
         } while (rt_rq);
 
         p = rt_task_of(rt_se);
-        p->se.exec_start = rq->clock;
+        p->se.exec_start = rq->clock_task;
 
         return p;
 }
@@ -1139,7 +1140,7 @@ static struct task_struct *pick_next_highest_task_rt(struct rq *rq, int cpu)
         for_each_leaf_rt_rq(rt_rq, rq) {
                 array = &rt_rq->active;
                 idx = sched_find_first_bit(array->bitmap);
- next_idx:
+next_idx:
                 if (idx >= MAX_RT_PRIO)
                         continue;
                 if (next && next->prio < idx)
@@ -1315,7 +1316,7 @@ static int push_rt_task(struct rq *rq)
         if (!next_task)
                 return 0;
 
- retry:
+retry:
         if (unlikely(next_task == rq->curr)) {
                 WARN_ON(1);
                 return 0;
@@ -1463,7 +1464,7 @@ static int pull_rt_task(struct rq *this_rq)
                          * but possible)
                          */
                 }
- skip:
+skip:
                 double_unlock_balance(this_rq, src_rq);
         }
 
@@ -1491,7 +1492,10 @@ static void task_woken_rt(struct rq *rq, struct task_struct *p)
         if (!task_running(rq, p) &&
             !test_tsk_need_resched(rq->curr) &&
             has_pushable_tasks(rq) &&
-            p->rt.nr_cpus_allowed > 1)
+            p->rt.nr_cpus_allowed > 1 &&
+            rt_task(rq->curr) &&
+            (rq->curr->rt.nr_cpus_allowed < 2 ||
+             rq->curr->prio < p->prio))
                 push_rt_tasks(rq);
 }
 
@@ -1709,7 +1713,7 @@ static void set_curr_task_rt(struct rq *rq)
 {
         struct task_struct *p = rq->curr;
 
-        p->se.exec_start = rq->clock;
+        p->se.exec_start = rq->clock_task;
 
         /* The running task is never eligible for pushing */
         dequeue_pushable_task(rq, p);
diff --git a/kernel/sched_stats.h b/kernel/sched_stats.h
index 25c2f962f6fc..48ddf431db0e 100644
--- a/kernel/sched_stats.h
+++ b/kernel/sched_stats.h
@@ -157,15 +157,7 @@ static inline void sched_info_reset_dequeued(struct task_struct *t)
 }
 
 /*
- * Called when a process is dequeued from the active array and given
- * the cpu.  We should note that with the exception of interactive
- * tasks, the expired queue will become the active queue after the active
- * queue is empty, without explicitly dequeuing and requeuing tasks in the
- * expired queue.  (Interactive tasks may be requeued directly to the
- * active queue, thus delaying tasks in the expired queue from running;
- * see scheduler_tick()).
- *
- * Though we are interested in knowing how long it was from the *first* time a
+ * We are interested in knowing how long it was from the *first* time a
  * task was queued to the time that it finally hit a cpu, we call this routine
  * from dequeue_task() to account for possible rq->clock skew across cpus. The
  * delta taken on each cpu would annul the skew.
@@ -203,16 +195,6 @@ static void sched_info_arrive(struct task_struct *t)
 }
 
 /*
- * Called when a process is queued into either the active or expired
- * array.  The time is noted and later used to determine how long we
- * had to wait for us to reach the cpu.  Since the expired queue will
- * become the active queue after active queue is empty, without dequeuing
- * and requeuing any tasks, we are interested in queuing to either. It
- * is unusual but not impossible for tasks to be dequeued and immediately
- * requeued in the same or another array: this can happen in sched_yield(),
- * set_user_nice(), and even load_balance() as it moves tasks from runqueue
- * to runqueue.
- *
  * This function is only called from enqueue_task(), but also only updates
  * the timestamp if it is already not set.  It's assumed that
  * sched_info_dequeued() will clear that stamp when appropriate.
diff --git a/kernel/sched_stoptask.c b/kernel/sched_stoptask.c
new file mode 100644
index 000000000000..2bf6b47058c1
--- /dev/null
+++ b/kernel/sched_stoptask.c
@@ -0,0 +1,108 @@
+/*
+ * stop-task scheduling class.
+ *
+ * The stop task is the highest priority task in the system, it preempts
+ * everything and will be preempted by nothing.
+ *
+ * See kernel/stop_machine.c
+ */
+
+#ifdef CONFIG_SMP
+static int
+select_task_rq_stop(struct rq *rq, struct task_struct *p,
+                    int sd_flag, int flags)
+{
+        return task_cpu(p); /* stop tasks as never migrate */
+}
+#endif /* CONFIG_SMP */
+
+static void
+check_preempt_curr_stop(struct rq *rq, struct task_struct *p, int flags)
+{
+        /* we're never preempted */
+}
+
+static struct task_struct *pick_next_task_stop(struct rq *rq)
+{
+        struct task_struct *stop = rq->stop;
+
+        if (stop && stop->se.on_rq)
+                return stop;
+
+        return NULL;
+}
+
+static void
+enqueue_task_stop(struct rq *rq, struct task_struct *p, int flags)
+{
+}
+
+static void
+dequeue_task_stop(struct rq *rq, struct task_struct *p, int flags)
+{
+}
+
+static void yield_task_stop(struct rq *rq)
+{
+        BUG(); /* the stop task should never yield, its pointless. */
+}
+
+static void put_prev_task_stop(struct rq *rq, struct task_struct *prev)
+{
+}
+
+static void task_tick_stop(struct rq *rq, struct task_struct *curr, int queued)
+{
+}
+
+static void set_curr_task_stop(struct rq *rq)
+{
+}
+
+static void switched_to_stop(struct rq *rq, struct task_struct *p,
+                             int running)
+{
+        BUG(); /* its impossible to change to this class */
+}
+
+static void prio_changed_stop(struct rq *rq, struct task_struct *p,
+                              int oldprio, int running)
+{
+        BUG(); /* how!?, what priority? */
+}
+
+static unsigned int
+get_rr_interval_stop(struct rq *rq, struct task_struct *task)
+{
+        return 0;
+}
+
+/*
+ * Simple, special scheduling class for the per-CPU stop tasks:
+ */
+static const struct sched_class stop_sched_class = {
+        .next                   = &rt_sched_class,
+
+        .enqueue_task           = enqueue_task_stop,
+        .dequeue_task           = dequeue_task_stop,
+        .yield_task             = yield_task_stop,
+
+        .check_preempt_curr     = check_preempt_curr_stop,
+
+        .pick_next_task         = pick_next_task_stop,
+        .put_prev_task          = put_prev_task_stop,
+
+#ifdef CONFIG_SMP
+        .select_task_rq         = select_task_rq_stop,
+#endif
+
+        .set_curr_task          = set_curr_task_stop,
+        .task_tick              = task_tick_stop,
+
+        .get_rr_interval        = get_rr_interval_stop,
+
+        .prio_changed           = prio_changed_stop,
+        .switched_to            = switched_to_stop,
+
+        /* no .task_new for stop tasks */
+};
diff --git a/kernel/signal.c b/kernel/signal.c
index bded65187780..4e3cff10fdce 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1105,7 +1105,8 @@ int zap_other_threads(struct task_struct *p)
         return count;
 }
 
-struct sighand_struct *lock_task_sighand(struct task_struct *tsk, unsigned long *flags)
+struct sighand_struct *__lock_task_sighand(struct task_struct *tsk,
+                                           unsigned long *flags)
 {
         struct sighand_struct *sighand;
 
@@ -1617,6 +1618,8 @@ static int sigkill_pending(struct task_struct *tsk)
  * is gone, we keep current->exit_code unless clear_code.
  */
 static void ptrace_stop(int exit_code, int clear_code, siginfo_t *info)
+        __releases(&current->sighand->siglock)
+        __acquires(&current->sighand->siglock)
 {
         if (arch_ptrace_stop_needed(exit_code, info)) {
                 /*
@@ -2215,6 +2218,14 @@ int copy_siginfo_to_user(siginfo_t __user *to, siginfo_t *from)
 #ifdef __ARCH_SI_TRAPNO
                 err |= __put_user(from->si_trapno, &to->si_trapno);
 #endif
+#ifdef BUS_MCEERR_AO
+                /* 
+                 * Other callers might not initialize the si_lsb field,
+                 * so check explicitely for the right codes here.
+                 */
+                if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
+                        err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
+#endif
                 break;
         case __SI_CHLD:
                 err |= __put_user(from->si_pid, &to->si_pid);
diff --git a/kernel/smp.c b/kernel/smp.c
index 75c970c715d3..12ed8b013e2d 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -267,7 +267,7 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_single_data, csd_data);
  *
  * Returns 0 on success, else a negative status code.
  */
-int smp_call_function_single(int cpu, void (*func) (void *info), void *info,
+int smp_call_function_single(int cpu, smp_call_func_t func, void *info,
                              int wait)
 {
         struct call_single_data d = {
@@ -336,7 +336,7 @@ EXPORT_SYMBOL(smp_call_function_single);
  *      3) any other online cpu in @mask
  */
 int smp_call_function_any(const struct cpumask *mask,
-                          void (*func)(void *info), void *info, int wait)
+                          smp_call_func_t func, void *info, int wait)
 {
         unsigned int cpu;
         const struct cpumask *nodemask;
@@ -365,9 +365,10 @@ call:
 EXPORT_SYMBOL_GPL(smp_call_function_any);
 
 /**
- * __smp_call_function_single(): Run a function on another CPU
+ * __smp_call_function_single(): Run a function on a specific CPU
  * @cpu: The CPU to run on.
  * @data: Pre-allocated and setup data structure
+ * @wait: If true, wait until function has completed on specified CPU.
  *
  * Like smp_call_function_single(), but allow caller to pass in a
  * pre-allocated data structure. Useful for embedding @data inside
@@ -376,8 +377,10 @@ EXPORT_SYMBOL_GPL(smp_call_function_any);
 void __smp_call_function_single(int cpu, struct call_single_data *data,
                                 int wait)
 {
-        csd_lock(data);
+        unsigned int this_cpu;
+        unsigned long flags;
 
+        this_cpu = get_cpu();
         /*
          * Can deadlock when called with interrupts disabled.
          * We allow cpu's that are not yet online though, as no one else can
@@ -387,7 +390,15 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
         WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
                      && !oops_in_progress);
 
-        generic_exec_single(cpu, data, wait);
+        if (cpu == this_cpu) {
+                local_irq_save(flags);
+                data->func(data->info);
+                local_irq_restore(flags);
+        } else {
+                csd_lock(data);
+                generic_exec_single(cpu, data, wait);
+        }
+        put_cpu();
 }
 
 /**
@@ -405,7 +416,7 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
  * must be disabled when calling this function.
  */
 void smp_call_function_many(const struct cpumask *mask,
-                            void (*func)(void *), void *info, bool wait)
+                            smp_call_func_t func, void *info, bool wait)
 {
         struct call_function_data *data;
         unsigned long flags;
@@ -489,7 +500,7 @@ EXPORT_SYMBOL(smp_call_function_many);
  * You must not call this function with disabled interrupts or from a
  * hardware interrupt handler or from a bottom half handler.
  */
-int smp_call_function(void (*func)(void *), void *info, int wait)
+int smp_call_function(smp_call_func_t func, void *info, int wait)
 {
         preempt_disable();
         smp_call_function_many(cpu_online_mask, func, info, wait);
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 07b4f1b1a73a..18f4be0d5fe0 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -67,7 +67,7 @@ char *softirq_to_name[NR_SOFTIRQS] = {
  * to the pending events, so lets the scheduler to balance
  * the softirq load for us.
  */
-void wakeup_softirqd(void)
+static void wakeup_softirqd(void)
 {
         /* Interrupts are disabled: no need to stop preemption */
         struct task_struct *tsk = __get_cpu_var(ksoftirqd);
@@ -77,11 +77,21 @@ void wakeup_softirqd(void)
 }
 
 /*
+ * preempt_count and SOFTIRQ_OFFSET usage:
+ * - preempt_count is changed by SOFTIRQ_OFFSET on entering or leaving
+ *   softirq processing.
+ * - preempt_count is changed by SOFTIRQ_DISABLE_OFFSET (= 2 * SOFTIRQ_OFFSET)
+ *   on local_bh_disable or local_bh_enable.
+ * This lets us distinguish between whether we are currently processing
+ * softirq and whether we just have bh disabled.
+ */
+
+/*
  * This one is for softirq.c-internal use,
  * where hardirqs are disabled legitimately:
  */
 #ifdef CONFIG_TRACE_IRQFLAGS
-static void __local_bh_disable(unsigned long ip)
+static void __local_bh_disable(unsigned long ip, unsigned int cnt)
 {
         unsigned long flags;
 
@@ -95,32 +105,43 @@ static void __local_bh_disable(unsigned long ip)
          * We must manually increment preempt_count here and manually
          * call the trace_preempt_off later.
          */
-        preempt_count() += SOFTIRQ_OFFSET;
+        preempt_count() += cnt;
         /*
          * Were softirqs turned off above:
          */
-        if (softirq_count() == SOFTIRQ_OFFSET)
+        if (softirq_count() == cnt)
                 trace_softirqs_off(ip);
         raw_local_irq_restore(flags);
 
-        if (preempt_count() == SOFTIRQ_OFFSET)
+        if (preempt_count() == cnt)
                 trace_preempt_off(CALLER_ADDR0, get_parent_ip(CALLER_ADDR1));
 }
 #else /* !CONFIG_TRACE_IRQFLAGS */
-static inline void __local_bh_disable(unsigned long ip)
+static inline void __local_bh_disable(unsigned long ip, unsigned int cnt)
 {
-        add_preempt_count(SOFTIRQ_OFFSET);
+        add_preempt_count(cnt);
         barrier();
 }
 #endif /* CONFIG_TRACE_IRQFLAGS */
 
 void local_bh_disable(void)
 {
-        __local_bh_disable((unsigned long)__builtin_return_address(0));
+        __local_bh_disable((unsigned long)__builtin_return_address(0),
+                                SOFTIRQ_DISABLE_OFFSET);
 }
 
 EXPORT_SYMBOL(local_bh_disable);
 
+static void __local_bh_enable(unsigned int cnt)
+{
+        WARN_ON_ONCE(in_irq());
+        WARN_ON_ONCE(!irqs_disabled());
+
+        if (softirq_count() == cnt)
+                trace_softirqs_on((unsigned long)__builtin_return_address(0));
+        sub_preempt_count(cnt);
+}
+
 /*
  * Special-case - softirqs can safely be enabled in
  * cond_resched_softirq(), or by __do_softirq(),
@@ -128,12 +149,7 @@ EXPORT_SYMBOL(local_bh_disable);
  */
 void _local_bh_enable(void)
 {
-        WARN_ON_ONCE(in_irq());
-        WARN_ON_ONCE(!irqs_disabled());
-
-        if (softirq_count() == SOFTIRQ_OFFSET)
-                trace_softirqs_on((unsigned long)__builtin_return_address(0));
-        sub_preempt_count(SOFTIRQ_OFFSET);
+        __local_bh_enable(SOFTIRQ_DISABLE_OFFSET);
 }
 
 EXPORT_SYMBOL(_local_bh_enable);
@@ -147,13 +163,13 @@ static inline void _local_bh_enable_ip(unsigned long ip)
         /*
          * Are softirqs going to be turned on now:
          */
-        if (softirq_count() == SOFTIRQ_OFFSET)
+        if (softirq_count() == SOFTIRQ_DISABLE_OFFSET)
                 trace_softirqs_on(ip);
         /*
          * Keep preemption disabled until we are done with
          * softirq processing:
          */
-        sub_preempt_count(SOFTIRQ_OFFSET - 1);
+        sub_preempt_count(SOFTIRQ_DISABLE_OFFSET - 1);
 
         if (unlikely(!in_interrupt() && local_softirq_pending()))
                 do_softirq();
@@ -198,7 +214,8 @@ asmlinkage void __do_softirq(void)
         pending = local_softirq_pending();
         account_system_vtime(current);
 
-        __local_bh_disable((unsigned long)__builtin_return_address(0));
+        __local_bh_disable((unsigned long)__builtin_return_address(0),
+                                SOFTIRQ_OFFSET);
         lockdep_softirq_enter();
 
         cpu = smp_processor_id();
@@ -212,18 +229,20 @@ restart:
 
         do {
                 if (pending & 1) {
+                        unsigned int vec_nr = h - softirq_vec;
                         int prev_count = preempt_count();
-                        kstat_incr_softirqs_this_cpu(h - softirq_vec);
 
-                        trace_softirq_entry(h, softirq_vec);
+                        kstat_incr_softirqs_this_cpu(vec_nr);
+
+                        trace_softirq_entry(vec_nr);
                         h->action(h);
-                        trace_softirq_exit(h, softirq_vec);
+                        trace_softirq_exit(vec_nr);
                         if (unlikely(prev_count != preempt_count())) {
-                                printk(KERN_ERR "huh, entered softirq %td %s %p"
+                                printk(KERN_ERR "huh, entered softirq %u %s %p"
                                        "with preempt_count %08x,"
-                                       " exited with %08x?\n", h - softirq_vec,
-                                       softirq_to_name[h - softirq_vec],
-                                       h->action, prev_count, preempt_count());
+                                       " exited with %08x?\n", vec_nr,
+                                       softirq_to_name[vec_nr], h->action,
+                                       prev_count, preempt_count());
                                 preempt_count() = prev_count;
                         }
 
@@ -245,7 +264,7 @@ restart:
         lockdep_softirq_exit();
 
         account_system_vtime(current);
-        _local_bh_enable();
+        __local_bh_enable(SOFTIRQ_OFFSET);
 }
 
 #ifndef __ARCH_HAS_DO_SOFTIRQ
@@ -279,10 +298,16 @@ void irq_enter(void)
 
         rcu_irq_enter();
         if (idle_cpu(cpu) && !in_interrupt()) {
-                __irq_enter();
+                /*
+                 * Prevent raise_softirq from needlessly waking up ksoftirqd
+                 * here, as softirq will be serviced on return from interrupt.
+                 */
+                local_bh_disable();
                 tick_check_idle(cpu);
-        } else
-                __irq_enter();
+                _local_bh_enable();
+        }
+
+        __irq_enter();
 }
 
 #ifdef __ARCH_IRQ_EXIT_IRQS_DISABLED
@@ -696,6 +721,7 @@ static int run_ksoftirqd(void * __bind_cpu)
 {
         set_current_state(TASK_INTERRUPTIBLE);
 
+        current->flags |= PF_KSOFTIRQD;
         while (!kthread_should_stop()) {
                 preempt_disable();
                 if (!local_softirq_pending()) {
@@ -886,17 +912,14 @@ int __init __weak early_irq_init(void)
         return 0;
 }
 
+#ifdef CONFIG_GENERIC_HARDIRQS
 int __init __weak arch_probe_nr_irqs(void)
 {
-        return 0;
+        return NR_IRQS_LEGACY;
 }
 
 int __init __weak arch_early_irq_init(void)
 {
         return 0;
 }
-
-int __weak arch_init_chip_data(struct irq_desc *desc, int node)
-{
-        return 0;
-}
+#endif
diff --git a/kernel/srcu.c b/kernel/srcu.c
index 2980da3fd509..c71e07500536 100644
--- a/kernel/srcu.c
+++ b/kernel/srcu.c
@@ -46,11 +46,9 @@ static int init_srcu_struct_fields(struct srcu_struct *sp)
 int __init_srcu_struct(struct srcu_struct *sp, const char *name,
                        struct lock_class_key *key)
 {
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
         /* Don't re-initialize a lock while it is held. */
         debug_check_no_locks_freed((void *)sp, sizeof(*sp));
         lockdep_init_map(&sp->dep_map, name, key, 0);
-#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
         return init_srcu_struct_fields(sp);
 }
 EXPORT_SYMBOL_GPL(__init_srcu_struct);
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 4372ccb25127..2df820b03beb 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -262,7 +262,7 @@ repeat:
                 cpu_stop_fn_t fn = work->fn;
                 void *arg = work->arg;
                 struct cpu_stop_done *done = work->done;
-                char ksym_buf[KSYM_NAME_LEN];
+                char ksym_buf[KSYM_NAME_LEN] __maybe_unused;
 
                 __set_current_state(TASK_RUNNING);
 
@@ -287,11 +287,12 @@ repeat:
         goto repeat;
 }
 
+extern void sched_set_stop_task(int cpu, struct task_struct *stop);
+
 /* manage stopper for a cpu, mostly lifted from sched migration thread mgmt */
 static int __cpuinit cpu_stop_cpu_callback(struct notifier_block *nfb,
                                            unsigned long action, void *hcpu)
 {
-        struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
         unsigned int cpu = (unsigned long)hcpu;
         struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu);
         struct task_struct *p;
@@ -303,14 +304,14 @@ static int __cpuinit cpu_stop_cpu_callback(struct notifier_block *nfb,
                 p = kthread_create(cpu_stopper_thread, stopper, "migration/%d",
                                    cpu);
                 if (IS_ERR(p))
-                        return NOTIFY_BAD;
-                sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
+                        return notifier_from_errno(PTR_ERR(p));
                 get_task_struct(p);
+                kthread_bind(p, cpu);
+                sched_set_stop_task(cpu, p);
                 stopper->thread = p;
                 break;
 
         case CPU_ONLINE:
-                kthread_bind(stopper->thread, cpu);
                 /* strictly unnecessary, as first user will wake it */
                 wake_up_process(stopper->thread);
                 /* mark enabled */
@@ -325,6 +326,7 @@ static int __cpuinit cpu_stop_cpu_callback(struct notifier_block *nfb,
         {
                 struct cpu_stop_work *work;
 
+                sched_set_stop_task(cpu, NULL);
                 /* kill the stopper */
                 kthread_stop(stopper->thread);
                 /* drain remaining works */
@@ -370,7 +372,7 @@ static int __init cpu_stop_init(void)
         /* start one for the boot cpu */
         err = cpu_stop_cpu_callback(&cpu_stop_cpu_notifier, CPU_UP_PREPARE,
                                     bcpu);
-        BUG_ON(err == NOTIFY_BAD);
+        BUG_ON(err != NOTIFY_OK);
         cpu_stop_cpu_callback(&cpu_stop_cpu_notifier, CPU_ONLINE, bcpu);
         register_cpu_notifier(&cpu_stop_cpu_notifier);
 
diff --git a/kernel/sys.c b/kernel/sys.c
index e83ddbbaf89d..7f5a0cd296a9 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -931,6 +931,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
                 pgid = pid;
         if (pgid < 0)
                 return -EINVAL;
+        rcu_read_lock();
 
         /* From this point forward we keep holding onto the tasklist lock
          * so that our parent does not change from under us. -DaveM
@@ -984,6 +985,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
 out:
         /* All paths lead to here, thus we are safe. -DaveM */
         write_unlock_irq(&tasklist_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -1236,15 +1238,14 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
 
 SYSCALL_DEFINE2(getrlimit, unsigned int, resource, struct rlimit __user *, rlim)
 {
-        if (resource >= RLIM_NLIMITS)
-                return -EINVAL;
-        else {
-                struct rlimit value;
-                task_lock(current->group_leader);
-                value = current->signal->rlim[resource];
-                task_unlock(current->group_leader);
-                return copy_to_user(rlim, &value, sizeof(*rlim)) ? -EFAULT : 0;
-        }
+        struct rlimit value;
+        int ret;
+
+        ret = do_prlimit(current, resource, NULL, &value);
+        if (!ret)
+                ret = copy_to_user(rlim, &value, sizeof(*rlim)) ? -EFAULT : 0;
+
+        return ret;
 }
 
 #ifdef __ARCH_WANT_SYS_OLD_GETRLIMIT
@@ -1272,44 +1273,89 @@ SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
 
 #endif
 
-SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
+static inline bool rlim64_is_infinity(__u64 rlim64)
 {
-        struct rlimit new_rlim, *old_rlim;
-        int retval;
+#if BITS_PER_LONG < 64
+        return rlim64 >= ULONG_MAX;
+#else
+        return rlim64 == RLIM64_INFINITY;
+#endif
+}
+
+static void rlim_to_rlim64(const struct rlimit *rlim, struct rlimit64 *rlim64)
+{
+        if (rlim->rlim_cur == RLIM_INFINITY)
+                rlim64->rlim_cur = RLIM64_INFINITY;
+        else
+                rlim64->rlim_cur = rlim->rlim_cur;
+        if (rlim->rlim_max == RLIM_INFINITY)
+                rlim64->rlim_max = RLIM64_INFINITY;
+        else
+                rlim64->rlim_max = rlim->rlim_max;
+}
+
+static void rlim64_to_rlim(const struct rlimit64 *rlim64, struct rlimit *rlim)
+{
+        if (rlim64_is_infinity(rlim64->rlim_cur))
+                rlim->rlim_cur = RLIM_INFINITY;
+        else
+                rlim->rlim_cur = (unsigned long)rlim64->rlim_cur;
+        if (rlim64_is_infinity(rlim64->rlim_max))
+                rlim->rlim_max = RLIM_INFINITY;
+        else
+                rlim->rlim_max = (unsigned long)rlim64->rlim_max;
+}
+
+/* make sure you are allowed to change @tsk limits before calling this */
+int do_prlimit(struct task_struct *tsk, unsigned int resource,
+                struct rlimit *new_rlim, struct rlimit *old_rlim)
+{
+        struct rlimit *rlim;
+        int retval = 0;
 
         if (resource >= RLIM_NLIMITS)
                 return -EINVAL;
-        if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
-                return -EFAULT;
-        if (new_rlim.rlim_cur > new_rlim.rlim_max)
-                return -EINVAL;
-        old_rlim = current->signal->rlim + resource;
-        if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
-            !capable(CAP_SYS_RESOURCE))
-                return -EPERM;
-        if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
-                return -EPERM;
-
-        retval = security_task_setrlimit(resource, &new_rlim);
-        if (retval)
-                return retval;
-
-        if (resource == RLIMIT_CPU && new_rlim.rlim_cur == 0) {
-                /*
-                 * The caller is asking for an immediate RLIMIT_CPU
-                 * expiry.  But we use the zero value to mean "it was
-                 * never set".  So let's cheat and make it one second
-                 * instead
-                 */
-                new_rlim.rlim_cur = 1;
+        if (new_rlim) {
+                if (new_rlim->rlim_cur > new_rlim->rlim_max)
+                        return -EINVAL;
+                if (resource == RLIMIT_NOFILE &&
+                                new_rlim->rlim_max > sysctl_nr_open)
+                        return -EPERM;
         }
 
-        task_lock(current->group_leader);
-        *old_rlim = new_rlim;
-        task_unlock(current->group_leader);
-
-        if (resource != RLIMIT_CPU)
+        /* protect tsk->signal and tsk->sighand from disappearing */
+        read_lock(&tasklist_lock);
+        if (!tsk->sighand) {
+                retval = -ESRCH;
                 goto out;
+        }
+
+        rlim = tsk->signal->rlim + resource;
+        task_lock(tsk->group_leader);
+        if (new_rlim) {
+                if (new_rlim->rlim_max > rlim->rlim_max &&
+                                !capable(CAP_SYS_RESOURCE))
+                        retval = -EPERM;
+                if (!retval)
+                        retval = security_task_setrlimit(tsk->group_leader,
+                                        resource, new_rlim);
+                if (resource == RLIMIT_CPU && new_rlim->rlim_cur == 0) {
+                        /*
+                         * The caller is asking for an immediate RLIMIT_CPU
+                         * expiry.  But we use the zero value to mean "it was
+                         * never set".  So let's cheat and make it one second
+                         * instead
+                         */
+                        new_rlim->rlim_cur = 1;
+                }
+        }
+        if (!retval) {
+                if (old_rlim)
+                        *old_rlim = *rlim;
+                if (new_rlim)
+                        *rlim = *new_rlim;
+        }
+        task_unlock(tsk->group_leader);
 
         /*
          * RLIMIT_CPU handling.   Note that the kernel fails to return an error
@@ -1317,14 +1363,84 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
          * very long-standing error, and fixing it now risks breakage of
          * applications, so we live with it
          */
-        if (new_rlim.rlim_cur == RLIM_INFINITY)
-                goto out;
-
-        update_rlimit_cpu(new_rlim.rlim_cur);
+         if (!retval && new_rlim && resource == RLIMIT_CPU &&
+                         new_rlim->rlim_cur != RLIM_INFINITY)
+                update_rlimit_cpu(tsk, new_rlim->rlim_cur);
 out:
+        read_unlock(&tasklist_lock);
+        return retval;
+}
+
+/* rcu lock must be held */
+static int check_prlimit_permission(struct task_struct *task)
+{
+        const struct cred *cred = current_cred(), *tcred;
+
+        tcred = __task_cred(task);
+        if ((cred->uid != tcred->euid ||
+             cred->uid != tcred->suid ||
+             cred->uid != tcred->uid  ||
+             cred->gid != tcred->egid ||
+             cred->gid != tcred->sgid ||
+             cred->gid != tcred->gid) &&
+             !capable(CAP_SYS_RESOURCE)) {
+                return -EPERM;
+        }
+
         return 0;
 }
 
+SYSCALL_DEFINE4(prlimit64, pid_t, pid, unsigned int, resource,
+                const struct rlimit64 __user *, new_rlim,
+                struct rlimit64 __user *, old_rlim)
+{
+        struct rlimit64 old64, new64;
+        struct rlimit old, new;
+        struct task_struct *tsk;
+        int ret;
+
+        if (new_rlim) {
+                if (copy_from_user(&new64, new_rlim, sizeof(new64)))
+                        return -EFAULT;
+                rlim64_to_rlim(&new64, &new);
+        }
+
+        rcu_read_lock();
+        tsk = pid ? find_task_by_vpid(pid) : current;
+        if (!tsk) {
+                rcu_read_unlock();
+                return -ESRCH;
+        }
+        ret = check_prlimit_permission(tsk);
+        if (ret) {
+                rcu_read_unlock();
+                return ret;
+        }
+        get_task_struct(tsk);
+        rcu_read_unlock();
+
+        ret = do_prlimit(tsk, resource, new_rlim ? &new : NULL,
+                        old_rlim ? &old : NULL);
+
+        if (!ret && old_rlim) {
+                rlim_to_rlim64(&old, &old64);
+                if (copy_to_user(old_rlim, &old64, sizeof(old64)))
+                        ret = -EFAULT;
+        }
+
+        put_task_struct(tsk);
+        return ret;
+}
+
+SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
+{
+        struct rlimit new_rlim;
+
+        if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
+                return -EFAULT;
+        return do_prlimit(current, resource, &new_rlim, NULL);
+}
+
 /*
  * It would make sense to put struct rusage in the task_struct,
  * except that would make the task_struct be *really big*.  After
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 70f2ea758ffe..c782fe9924c7 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -50,6 +50,7 @@ cond_syscall(compat_sys_sendmsg);
 cond_syscall(sys_recvmsg);
 cond_syscall(sys_recvmmsg);
 cond_syscall(compat_sys_recvmsg);
+cond_syscall(compat_sys_recv);
 cond_syscall(compat_sys_recvfrom);
 cond_syscall(compat_sys_recvmmsg);
 cond_syscall(sys_socketcall);
@@ -181,3 +182,7 @@ cond_syscall(sys_eventfd2);
 
 /* performance counters: */
 cond_syscall(sys_perf_event_open);
+
+/* fanotify! */
+cond_syscall(sys_fanotify_init);
+cond_syscall(sys_fanotify_mark);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 6b005e4912b5..5abfa1518554 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -44,6 +44,7 @@
 #include <linux/times.h>
 #include <linux/limits.h>
 #include <linux/dcache.h>
+#include <linux/dnotify.h>
 #include <linux/syscalls.h>
 #include <linux/vmstat.h>
 #include <linux/nfs_fs.h>
@@ -131,6 +132,9 @@ static int min_percpu_pagelist_fract = 8;
 
 static int ngroups_max = NGROUPS_MAX;
 
+#ifdef CONFIG_INOTIFY_USER
+#include <linux/inotify.h>
+#endif
 #ifdef CONFIG_SPARC
 #include <asm/system.h>
 #endif
@@ -157,8 +161,6 @@ extern int no_unaligned_warning;
 extern int unaligned_dump_stack;
 #endif
 
-extern struct ratelimit_state printk_ratelimit_state;
-
 #ifdef CONFIG_PROC_SYSCTL
 static int proc_do_cad_pid(struct ctl_table *table, int write,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
@@ -207,9 +209,6 @@ static struct ctl_table fs_table[];
 static struct ctl_table debug_table[];
 static struct ctl_table dev_table[];
 extern struct ctl_table random_table[];
-#ifdef CONFIG_INOTIFY_USER
-extern struct ctl_table inotify_table[];
-#endif
 #ifdef CONFIG_EPOLL
 extern struct ctl_table epoll_table[];
 #endif
@@ -703,6 +702,15 @@ static struct ctl_table kern_table[] = {
                 .extra1         = &zero,
                 .extra2         = &ten_thousand,
         },
+        {
+                .procname       = "dmesg_restrict",
+                .data           = &dmesg_restrict,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
 #endif
         {
                 .procname       = "ngroups_max",
@@ -1339,28 +1347,28 @@ static struct ctl_table fs_table[] = {
                 .data           = &inodes_stat,
                 .maxlen         = 2*sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_nr_inodes,
         },
         {
                 .procname       = "inode-state",
                 .data           = &inodes_stat,
                 .maxlen         = 7*sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_nr_inodes,
         },
         {
                 .procname       = "file-nr",
                 .data           = &files_stat,
-                .maxlen         = 3*sizeof(int),
+                .maxlen         = sizeof(files_stat),
                 .mode           = 0444,
                 .proc_handler   = proc_nr_files,
         },
         {
                 .procname       = "file-max",
                 .data           = &files_stat.max_files,
-                .maxlen         = sizeof(int),
+                .maxlen         = sizeof(files_stat.max_files),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_doulongvec_minmax,
         },
         {
                 .procname       = "nr_open",
@@ -1376,7 +1384,7 @@ static struct ctl_table fs_table[] = {
                 .data           = &dentry_stat,
                 .maxlen         = 6*sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_nr_dentry,
         },
         {
                 .procname       = "overflowuid",
@@ -1712,10 +1720,7 @@ static __init int sysctl_init(void)
 {
         sysctl_set_parent(NULL, root_table);
 #ifdef CONFIG_SYSCTL_SYSCALL_CHECK
-        {
-                int err;
-                err = sysctl_check_table(current->nsproxy, root_table);
-        }
+        sysctl_check_table(current->nsproxy, root_table);
 #endif
         return 0;
 }
@@ -2487,7 +2492,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
                 kbuf[left] = 0;
         }
 
-        for (; left && vleft--; i++, min++, max++, first=0) {
+        for (; left && vleft--; i++, first = 0) {
                 unsigned long val;
 
                 if (write) {
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index 04cdcf72c827..10b90d8a03c4 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -143,15 +143,6 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
                                 if (!table->maxlen)
                                         set_fail(&fail, table, "No maxlen");
                         }
-                        if ((table->proc_handler == proc_doulongvec_minmax) ||
-                            (table->proc_handler == proc_doulongvec_ms_jiffies_minmax)) {
-                                if (table->maxlen > sizeof (unsigned long)) {
-                                        if (!table->extra1)
-                                                set_fail(&fail, table, "No min");
-                                        if (!table->extra2)
-                                                set_fail(&fail, table, "No max");
-                                }
-                        }
 #ifdef CONFIG_PROC_SYSCTL
                         if (table->procname && !table->proc_handler)
                                 set_fail(&fail, table, "No proc_handler");
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 11281d5792bd..3308fd7f1b52 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -175,22 +175,8 @@ static void send_cpu_listeners(struct sk_buff *skb,
         up_write(&listeners->sem);
 }
 
-static int fill_pid(pid_t pid, struct task_struct *tsk,
-                struct taskstats *stats)
+static void fill_stats(struct task_struct *tsk, struct taskstats *stats)
 {
-        int rc = 0;
-
-        if (!tsk) {
-                rcu_read_lock();
-                tsk = find_task_by_vpid(pid);
-                if (tsk)
-                        get_task_struct(tsk);
-                rcu_read_unlock();
-                if (!tsk)
-                        return -ESRCH;
-        } else
-                get_task_struct(tsk);
-
         memset(stats, 0, sizeof(*stats));
         /*
          * Each accounting subsystem adds calls to its functions to
@@ -209,17 +195,27 @@ static int fill_pid(pid_t pid, struct task_struct *tsk,
 
         /* fill in extended acct fields */
         xacct_add_tsk(stats, tsk);
+}
 
-        /* Define err: label here if needed */
-        put_task_struct(tsk);
-        return rc;
+static int fill_stats_for_pid(pid_t pid, struct taskstats *stats)
+{
+        struct task_struct *tsk;
 
+        rcu_read_lock();
+        tsk = find_task_by_vpid(pid);
+        if (tsk)
+                get_task_struct(tsk);
+        rcu_read_unlock();
+        if (!tsk)
+                return -ESRCH;
+        fill_stats(tsk, stats);
+        put_task_struct(tsk);
+        return 0;
 }
 
-static int fill_tgid(pid_t tgid, struct task_struct *first,
-                struct taskstats *stats)
+static int fill_stats_for_tgid(pid_t tgid, struct taskstats *stats)
 {
-        struct task_struct *tsk;
+        struct task_struct *tsk, *first;
         unsigned long flags;
         int rc = -ESRCH;
 
@@ -228,8 +224,7 @@ static int fill_tgid(pid_t tgid, struct task_struct *first,
          * leaders who are already counted with the dead tasks
          */
         rcu_read_lock();
-        if (!first)
-                first = find_task_by_vpid(tgid);
+        first = find_task_by_vpid(tgid);
 
         if (!first || !lock_task_sighand(first, &flags))
                 goto out;
@@ -268,7 +263,6 @@ out:
         return rc;
 }
 
-
 static void fill_tgid_exit(struct task_struct *tsk)
 {
         unsigned long flags;
@@ -355,6 +349,10 @@ static int parse(struct nlattr *na, struct cpumask *mask)
         return ret;
 }
 
+#ifdef CONFIG_IA64
+#define TASKSTATS_NEEDS_PADDING 1
+#endif
+
 static struct taskstats *mk_reply(struct sk_buff *skb, int type, u32 pid)
 {
         struct nlattr *na, *ret;
@@ -364,9 +362,33 @@ static struct taskstats *mk_reply(struct sk_buff *skb, int type, u32 pid)
                         ? TASKSTATS_TYPE_AGGR_PID
                         : TASKSTATS_TYPE_AGGR_TGID;
 
+        /*
+         * The taskstats structure is internally aligned on 8 byte
+         * boundaries but the layout of the aggregrate reply, with
+         * two NLA headers and the pid (each 4 bytes), actually
+         * force the entire structure to be unaligned. This causes
+         * the kernel to issue unaligned access warnings on some
+         * architectures like ia64. Unfortunately, some software out there
+         * doesn't properly unroll the NLA packet and assumes that the start
+         * of the taskstats structure will always be 20 bytes from the start
+         * of the netlink payload. Aligning the start of the taskstats
+         * structure breaks this software, which we don't want. So, for now
+         * the alignment only happens on architectures that require it
+         * and those users will have to update to fixed versions of those
+         * packages. Space is reserved in the packet only when needed.
+         * This ifdef should be removed in several years e.g. 2012 once
+         * we can be confident that fixed versions are installed on most
+         * systems. We add the padding before the aggregate since the
+         * aggregate is already a defined type.
+         */
+#ifdef TASKSTATS_NEEDS_PADDING
+        if (nla_put(skb, TASKSTATS_TYPE_NULL, 0, NULL) < 0)
+                goto err;
+#endif
         na = nla_nest_start(skb, aggr);
         if (!na)
                 goto err;
+
         if (nla_put(skb, type, sizeof(pid), &pid) < 0)
                 goto err;
         ret = nla_reserve(skb, TASKSTATS_TYPE_STATS, sizeof(struct taskstats));
@@ -424,74 +446,122 @@ err:
         return rc;
 }
 
-static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
+static int cmd_attr_register_cpumask(struct genl_info *info)
 {
-        int rc;
-        struct sk_buff *rep_skb;
-        struct taskstats *stats;
-        size_t size;
         cpumask_var_t mask;
+        int rc;
 
         if (!alloc_cpumask_var(&mask, GFP_KERNEL))
                 return -ENOMEM;
-
         rc = parse(info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK], mask);
         if (rc < 0)
-                goto free_return_rc;
-        if (rc == 0) {
-                rc = add_del_listener(info->snd_pid, mask, REGISTER);
-                goto free_return_rc;
-        }
+                goto out;
+        rc = add_del_listener(info->snd_pid, mask, REGISTER);
+out:
+        free_cpumask_var(mask);
+        return rc;
+}
+
+static int cmd_attr_deregister_cpumask(struct genl_info *info)
+{
+        cpumask_var_t mask;
+        int rc;
 
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+                return -ENOMEM;
         rc = parse(info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK], mask);
         if (rc < 0)
-                goto free_return_rc;
-        if (rc == 0) {
-                rc = add_del_listener(info->snd_pid, mask, DEREGISTER);
-free_return_rc:
-                free_cpumask_var(mask);
-                return rc;
-        }
+                goto out;
+        rc = add_del_listener(info->snd_pid, mask, DEREGISTER);
+out:
         free_cpumask_var(mask);
+        return rc;
+}
+
+static size_t taskstats_packet_size(void)
+{
+        size_t size;
 
-        /*
-         * Size includes space for nested attributes
-         */
         size = nla_total_size(sizeof(u32)) +
                 nla_total_size(sizeof(struct taskstats)) + nla_total_size(0);
+#ifdef TASKSTATS_NEEDS_PADDING
+        size += nla_total_size(0); /* Padding for alignment */
+#endif
+        return size;
+}
+
+static int cmd_attr_pid(struct genl_info *info)
+{
+        struct taskstats *stats;
+        struct sk_buff *rep_skb;
+        size_t size;
+        u32 pid;
+        int rc;
+
+        size = taskstats_packet_size();
 
         rc = prepare_reply(info, TASKSTATS_CMD_NEW, &rep_skb, size);
         if (rc < 0)
                 return rc;
 
         rc = -EINVAL;
-        if (info->attrs[TASKSTATS_CMD_ATTR_PID]) {
-                u32 pid = nla_get_u32(info->attrs[TASKSTATS_CMD_ATTR_PID]);
-                stats = mk_reply(rep_skb, TASKSTATS_TYPE_PID, pid);
-                if (!stats)
-                        goto err;
-
-                rc = fill_pid(pid, NULL, stats);
-                if (rc < 0)
-                        goto err;
-        } else if (info->attrs[TASKSTATS_CMD_ATTR_TGID]) {
-                u32 tgid = nla_get_u32(info->attrs[TASKSTATS_CMD_ATTR_TGID]);
-                stats = mk_reply(rep_skb, TASKSTATS_TYPE_TGID, tgid);
-                if (!stats)
-                        goto err;
-
-                rc = fill_tgid(tgid, NULL, stats);
-                if (rc < 0)
-                        goto err;
-        } else
+        pid = nla_get_u32(info->attrs[TASKSTATS_CMD_ATTR_PID]);
+        stats = mk_reply(rep_skb, TASKSTATS_TYPE_PID, pid);
+        if (!stats)
                 goto err;
 
+        rc = fill_stats_for_pid(pid, stats);
+        if (rc < 0)
+                goto err;
         return send_reply(rep_skb, info);
 err:
         nlmsg_free(rep_skb);
         return rc;
 }
 
+static int cmd_attr_tgid(struct genl_info *info)
+{
+        struct taskstats *stats;
+        struct sk_buff *rep_skb;
+        size_t size;
+        u32 tgid;
+        int rc;
+
+        size = taskstats_packet_size();
+
+        rc = prepare_reply(info, TASKSTATS_CMD_NEW, &rep_skb, size);
+        if (rc < 0)
+                return rc;
+
+        rc = -EINVAL;
+        tgid = nla_get_u32(info->attrs[TASKSTATS_CMD_ATTR_TGID]);
+        stats = mk_reply(rep_skb, TASKSTATS_TYPE_TGID, tgid);
+        if (!stats)
+                goto err;
+
+        rc = fill_stats_for_tgid(tgid, stats);
+        if (rc < 0)
+                goto err;
+        return send_reply(rep_skb, info);
+err:
+        nlmsg_free(rep_skb);
+        return rc;
+}
+
+static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
+{
+        if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
+                return cmd_attr_register_cpumask(info);
+        else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
+                return cmd_attr_deregister_cpumask(info);
+        else if (info->attrs[TASKSTATS_CMD_ATTR_PID])
+                return cmd_attr_pid(info);
+        else if (info->attrs[TASKSTATS_CMD_ATTR_TGID])
+                return cmd_attr_tgid(info);
+        else
+                return -EINVAL;
+}
+
 static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk)
 {
         struct signal_struct *sig = tsk->signal;
@@ -532,8 +602,7 @@ void taskstats_exit(struct task_struct *tsk, int group_dead)
         /*
          * Size includes space for nested attributes
          */
-        size = nla_total_size(sizeof(u32)) +
-                nla_total_size(sizeof(struct taskstats)) + nla_total_size(0);
+        size = taskstats_packet_size();
 
         is_thread_group = !!taskstats_tgid_alloc(tsk);
         if (is_thread_group) {
@@ -555,9 +624,7 @@ void taskstats_exit(struct task_struct *tsk, int group_dead)
         if (!stats)
                 goto err;
 
-        rc = fill_pid(-1, tsk, stats);
-        if (rc < 0)
-                goto err;
+        fill_stats(tsk, stats);
 
         /*
          * Doesn't matter if tsk is the leader or the last group member leaving
diff --git a/kernel/test_kprobes.c b/kernel/test_kprobes.c
index 4f104515a19b..f8b11a283171 100644
--- a/kernel/test_kprobes.c
+++ b/kernel/test_kprobes.c
@@ -115,7 +115,9 @@ static int test_kprobes(void)
         int ret;
         struct kprobe *kps[2] = {&kp, &kp2};
 
-        kp.addr = 0; /* addr should be cleard for reusing kprobe. */
+        /* addr and flags should be cleard for reusing kprobe. */
+        kp.addr = NULL;
+        kp.flags = 0;
         ret = register_kprobes(kps, 2);
         if (ret < 0) {
                 printk(KERN_ERR "Kprobe smoke test failed: "
@@ -210,7 +212,9 @@ static int test_jprobes(void)
         int ret;
         struct jprobe *jps[2] = {&jp, &jp2};
 
-        jp.kp.addr = 0; /* addr should be cleard for reusing kprobe. */
+        /* addr and flags should be cleard for reusing kprobe. */
+        jp.kp.addr = NULL;
+        jp.kp.flags = 0;
         ret = register_jprobes(jps, 2);
         if (ret < 0) {
                 printk(KERN_ERR "Kprobe smoke test failed: "
@@ -323,7 +327,9 @@ static int test_kretprobes(void)
         int ret;
         struct kretprobe *rps[2] = {&rp, &rp2};
 
-        rp.kp.addr = 0; /* addr should be cleard for reusing kprobe. */
+        /* addr and flags should be cleard for reusing kprobe. */
+        rp.kp.addr = NULL;
+        rp.kp.flags = 0;
         ret = register_kretprobes(rps, 2);
         if (ret < 0) {
                 printk(KERN_ERR "Kprobe smoke test failed: "
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index c63116863a80..d2321891538f 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -149,10 +149,18 @@ static void ntp_update_offset(long offset)
         time_reftime = get_seconds();
 
         offset64    = offset;
-        freq_adj    = (offset64 * secs) <<
-                        (NTP_SCALE_SHIFT - 2 * (SHIFT_PLL + 2 + time_constant));
+        freq_adj    = ntp_update_offset_fll(offset64, secs);
 
-        freq_adj    += ntp_update_offset_fll(offset64, secs);
+        /*
+         * Clamp update interval to reduce PLL gain with low
+         * sampling rate (e.g. intermittent network connection)
+         * to avoid instability.
+         */
+        if (unlikely(secs > 1 << (SHIFT_PLL + 1 + time_constant)))
+                secs = 1 << (SHIFT_PLL + 1 + time_constant);
+
+        freq_adj    += (offset64 * secs) <<
+                        (NTP_SCALE_SHIFT - 2 * (SHIFT_PLL + 2 + time_constant));
 
         freq_adj    = min(freq_adj + time_freq, MAXFREQ_SCALED);
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index e14c839e9faa..49010d822f72 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -690,6 +690,7 @@ static void timekeeping_adjust(s64 offset)
 static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
 {
         u64 nsecps = (u64)NSEC_PER_SEC << timekeeper.shift;
+        u64 raw_nsecs;
 
         /* If the offset is smaller then a shifted interval, do nothing */
         if (offset < timekeeper.cycle_interval<<shift)
@@ -706,12 +707,15 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
                 second_overflow();
         }
 
-        /* Accumulate into raw time */
-        raw_time.tv_nsec += timekeeper.raw_interval << shift;;
-        while (raw_time.tv_nsec >= NSEC_PER_SEC) {
-                raw_time.tv_nsec -= NSEC_PER_SEC;
-                raw_time.tv_sec++;
+        /* Accumulate raw time */
+        raw_nsecs = timekeeper.raw_interval << shift;
+        raw_nsecs += raw_time.tv_nsec;
+        if (raw_nsecs >= NSEC_PER_SEC) {
+                u64 raw_secs = raw_nsecs;
+                raw_nsecs = do_div(raw_secs, NSEC_PER_SEC);
+                raw_time.tv_sec += raw_secs;
         }
+        raw_time.tv_nsec = raw_nsecs;
 
         /* Accumulate error between NTP and clock interval */
         timekeeper.ntp_error += tick_length << shift;
diff --git a/kernel/timer.c b/kernel/timer.c
index f1b8afe1ad86..353b9227c2ec 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -37,7 +37,7 @@
 #include <linux/delay.h>
 #include <linux/tick.h>
 #include <linux/kallsyms.h>
-#include <linux/perf_event.h>
+#include <linux/irq_work.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 
@@ -326,6 +326,7 @@ EXPORT_SYMBOL_GPL(round_jiffies_up_relative);
 
 /**
  * set_timer_slack - set the allowed slack for a timer
+ * @timer: the timer to be modified
  * @slack_hz: the amount of time (in jiffies) allowed for rounding
  *
  * Set the amount of time, in jiffies, that a certain timer has
@@ -1251,6 +1252,12 @@ unsigned long get_next_timer_interrupt(unsigned long now)
         struct tvec_base *base = __get_cpu_var(tvec_bases);
         unsigned long expires;
 
+        /*
+         * Pretend that there is no timer pending if the cpu is offline.
+         * Possible pending timers will be migrated later to an active cpu.
+         */
+        if (cpu_is_offline(smp_processor_id()))
+                return now + NEXT_TIMER_MAX_DELTA;
         spin_lock(&base->lock);
         if (time_before_eq(base->next_timer, base->timer_jiffies))
                 base->next_timer = __next_timer_interrupt(base);
@@ -1278,7 +1285,10 @@ void update_process_times(int user_tick)
         run_local_timers();
         rcu_check_callbacks(cpu, user_tick);
         printk_tick();
-        perf_event_do_pending();
+#ifdef CONFIG_IRQ_WORK
+        if (in_irq())
+                irq_work_run();
+#endif
         scheduler_tick();
         run_posix_cpu_timers(p);
 }
@@ -1315,7 +1325,7 @@ void do_timer(unsigned long ticks)
 {
         jiffies_64 += ticks;
         update_wall_time();
-        calc_global_load();
+        calc_global_load(ticks);
 }
 
 #ifdef __ARCH_WANT_SYS_ALARM
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 538501c6ea50..ea37e2ff4164 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -49,6 +49,11 @@ config HAVE_SYSCALL_TRACEPOINTS
         help
           See Documentation/trace/ftrace-design.txt
 
+config HAVE_C_RECORDMCOUNT
+        bool
+        help
+          C version of recordmcount available?
+
 config TRACER_MAX_TRACE
         bool
 
@@ -121,7 +126,7 @@ if FTRACE
 config FUNCTION_TRACER
         bool "Kernel Function Tracer"
         depends on HAVE_FUNCTION_TRACER
-        select FRAME_POINTER
+        select FRAME_POINTER if !ARM_UNWIND && !S390
         select KALLSYMS
         select GENERIC_TRACER
         select CONTEXT_SWITCH_TRACER
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 638711c17504..7b8ec0281548 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -23,7 +23,6 @@
 #include <linux/mutex.h>
 #include <linux/slab.h>
 #include <linux/debugfs.h>
-#include <linux/smp_lock.h>
 #include <linux/time.h>
 #include <linux/uaccess.h>
 
@@ -169,9 +168,11 @@ static int act_log_check(struct blk_trace *bt, u32 what, sector_t sector,
 static const u32 ddir_act[2] = { BLK_TC_ACT(BLK_TC_READ),
                                  BLK_TC_ACT(BLK_TC_WRITE) };
 
+#define BLK_TC_RAHEAD           BLK_TC_AHEAD
+
 /* The ilog2() calls fall out because they're constant */
-#define MASK_TC_BIT(rw, __name) ((rw & (1 << BIO_RW_ ## __name)) << \
-          (ilog2(BLK_TC_ ## __name) + BLK_TC_SHIFT - BIO_RW_ ## __name))
+#define MASK_TC_BIT(rw, __name) ((rw & REQ_ ## __name) << \
+          (ilog2(BLK_TC_ ## __name) + BLK_TC_SHIFT - __REQ_ ## __name))
 
 /*
  * The worker for the various blk_add_trace*() types. Fills out a
@@ -194,9 +195,8 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
                 return;
 
         what |= ddir_act[rw & WRITE];
-        what |= MASK_TC_BIT(rw, BARRIER);
-        what |= MASK_TC_BIT(rw, SYNCIO);
-        what |= MASK_TC_BIT(rw, AHEAD);
+        what |= MASK_TC_BIT(rw, SYNC);
+        what |= MASK_TC_BIT(rw, RAHEAD);
         what |= MASK_TC_BIT(rw, META);
         what |= MASK_TC_BIT(rw, DISCARD);
 
@@ -323,6 +323,7 @@ static const struct file_operations blk_dropped_fops = {
         .owner =        THIS_MODULE,
         .open =         blk_dropped_open,
         .read =         blk_dropped_read,
+        .llseek =       default_llseek,
 };
 
 static int blk_msg_open(struct inode *inode, struct file *filp)
@@ -362,6 +363,7 @@ static const struct file_operations blk_msg_fops = {
         .owner =        THIS_MODULE,
         .open =         blk_msg_open,
         .write =        blk_msg_write,
+        .llseek =       noop_llseek,
 };
 
 /*
@@ -549,6 +551,41 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 }
 EXPORT_SYMBOL_GPL(blk_trace_setup);
 
+#if defined(CONFIG_COMPAT) && defined(CONFIG_X86_64)
+static int compat_blk_trace_setup(struct request_queue *q, char *name,
+                                  dev_t dev, struct block_device *bdev,
+                                  char __user *arg)
+{
+        struct blk_user_trace_setup buts;
+        struct compat_blk_user_trace_setup cbuts;
+        int ret;
+
+        if (copy_from_user(&cbuts, arg, sizeof(cbuts)))
+                return -EFAULT;
+
+        buts = (struct blk_user_trace_setup) {
+                .act_mask = cbuts.act_mask,
+                .buf_size = cbuts.buf_size,
+                .buf_nr = cbuts.buf_nr,
+                .start_lba = cbuts.start_lba,
+                .end_lba = cbuts.end_lba,
+                .pid = cbuts.pid,
+        };
+        memcpy(&buts.name, &cbuts.name, 32);
+
+        ret = do_blk_trace_setup(q, name, dev, bdev, &buts);
+        if (ret)
+                return ret;
+
+        if (copy_to_user(arg, &buts.name, 32)) {
+                blk_trace_remove(q);
+                return -EFAULT;
+        }
+
+        return 0;
+}
+#endif
+
 int blk_trace_startstop(struct request_queue *q, int start)
 {
         int ret;
@@ -608,6 +645,12 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
                 bdevname(bdev, b);
                 ret = blk_trace_setup(q, b, bdev->bd_dev, bdev, arg);
                 break;
+#if defined(CONFIG_COMPAT) && defined(CONFIG_X86_64)
+        case BLKTRACESETUP32:
+                bdevname(bdev, b);
+                ret = compat_blk_trace_setup(q, b, bdev->bd_dev, bdev, arg);
+                break;
+#endif
         case BLKTRACESTART:
                 start = 1;
         case BLKTRACESTOP:
@@ -661,10 +704,13 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
         if (likely(!bt))
                 return;
 
-        if (blk_discard_rq(rq))
-                rw |= (1 << BIO_RW_DISCARD);
+        if (rq->cmd_flags & REQ_DISCARD)
+                rw |= REQ_DISCARD;
+
+        if (rq->cmd_flags & REQ_SECURE)
+                rw |= REQ_SECURE;
 
-        if (blk_pc_request(rq)) {
+        if (rq->cmd_type == REQ_TYPE_BLOCK_PC) {
                 what |= BLK_TC_ACT(BLK_TC_PC);
                 __blk_add_trace(bt, 0, blk_rq_bytes(rq), rw,
                                 what, rq->errors, rq->cmd_len, rq->cmd);
@@ -925,7 +971,7 @@ void blk_add_driver_data(struct request_queue *q,
         if (likely(!bt))
                 return;
 
-        if (blk_pc_request(rq))
+        if (rq->cmd_type == REQ_TYPE_BLOCK_PC)
                 __blk_add_trace(bt, 0, blk_rq_bytes(rq), 0,
                                 BLK_TA_DRV_DATA, rq->errors, len, data);
         else
@@ -1603,10 +1649,9 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
         struct block_device *bdev;
         ssize_t ret = -ENXIO;
 
-        lock_kernel();
         bdev = bdget(part_devt(p));
         if (bdev == NULL)
-                goto out_unlock_kernel;
+                goto out;
 
         q = blk_trace_get_queue(bdev);
         if (q == NULL)
@@ -1634,8 +1679,7 @@ out_unlock_bdev:
         mutex_unlock(&bdev->bd_mutex);
 out_bdput:
         bdput(bdev);
-out_unlock_kernel:
-        unlock_kernel();
+out:
         return ret;
 }
 
@@ -1665,11 +1709,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
 
         ret = -ENXIO;
 
-        lock_kernel();
         p = dev_to_part(dev);
         bdev = bdget(part_devt(p));
         if (bdev == NULL)
-                goto out_unlock_kernel;
+                goto out;
 
         q = blk_trace_get_queue(bdev);
         if (q == NULL)
@@ -1704,8 +1747,6 @@ out_unlock_bdev:
         mutex_unlock(&bdev->bd_mutex);
 out_bdput:
         bdput(bdev);
-out_unlock_kernel:
-        unlock_kernel();
 out:
         return ret ? ret : count;
 }
@@ -1730,7 +1771,7 @@ void blk_dump_cmd(char *buf, struct request *rq)
         int len = rq->cmd_len;
         unsigned char *cmd = rq->cmd;
 
-        if (!blk_pc_request(rq)) {
+        if (rq->cmd_type != REQ_TYPE_BLOCK_PC) {
                 buf[0] = '\0';
                 return;
         }
@@ -1755,21 +1796,21 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
 
         if (rw & WRITE)
                 rwbs[i++] = 'W';
-        else if (rw & 1 << BIO_RW_DISCARD)
+        else if (rw & REQ_DISCARD)
                 rwbs[i++] = 'D';
         else if (bytes)
                 rwbs[i++] = 'R';
         else
                 rwbs[i++] = 'N';
 
-        if (rw & 1 << BIO_RW_AHEAD)
+        if (rw & REQ_RAHEAD)
                 rwbs[i++] = 'A';
-        if (rw & 1 << BIO_RW_BARRIER)
-                rwbs[i++] = 'B';
-        if (rw & 1 << BIO_RW_SYNCIO)
+        if (rw & REQ_SYNC)
                 rwbs[i++] = 'S';
-        if (rw & 1 << BIO_RW_META)
+        if (rw & REQ_META)
                 rwbs[i++] = 'M';
+        if (rw & REQ_SECURE)
+                rwbs[i++] = 'E';
 
         rwbs[i] = '\0';
 }
@@ -1779,8 +1820,11 @@ void blk_fill_rwbs_rq(char *rwbs, struct request *rq)
         int rw = rq->cmd_flags & 0x03;
         int bytes;
 
-        if (blk_discard_rq(rq))
-                rw |= (1 << BIO_RW_DISCARD);
+        if (rq->cmd_flags & REQ_DISCARD)
+                rw |= REQ_DISCARD;
+
+        if (rq->cmd_flags & REQ_SECURE)
+                rw |= REQ_SECURE;
 
         bytes = blk_rq_bytes(rq);
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 0d88ce9b9fb8..f3dadae83883 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -381,12 +381,19 @@ static int function_stat_show(struct seq_file *m, void *v)
 {
         struct ftrace_profile *rec = v;
         char str[KSYM_SYMBOL_LEN];
+        int ret = 0;
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        static DEFINE_MUTEX(mutex);
         static struct trace_seq s;
         unsigned long long avg;
         unsigned long long stddev;
 #endif
+        mutex_lock(&ftrace_profile_lock);
+
+        /* we raced with function_profile_reset() */
+        if (unlikely(rec->counter == 0)) {
+                ret = -EBUSY;
+                goto out;
+        }
 
         kallsyms_lookup(rec->ip, NULL, NULL, NULL, str);
         seq_printf(m, "  %-30.30s  %10lu", str, rec->counter);
@@ -408,7 +415,6 @@ static int function_stat_show(struct seq_file *m, void *v)
                 do_div(stddev, (rec->counter - 1) * 1000);
         }
 
-        mutex_lock(&mutex);
         trace_seq_init(&s);
         trace_print_graph_duration(rec->time, &s);
         trace_seq_puts(&s, "    ");
@@ -416,11 +422,12 @@ static int function_stat_show(struct seq_file *m, void *v)
         trace_seq_puts(&s, "    ");
         trace_print_graph_duration(stddev, &s);
         trace_print_seq(m, &s);
-        mutex_unlock(&mutex);
 #endif
         seq_putc(m, '\n');
+out:
+        mutex_unlock(&ftrace_profile_lock);
 
-        return 0;
+        return ret;
 }
 
 static void ftrace_profile_reset(struct ftrace_profile_stat *stat)
@@ -793,6 +800,7 @@ static const struct file_operations ftrace_profile_fops = {
         .open           = tracing_open_generic,
         .read           = ftrace_profile_read,
         .write          = ftrace_profile_write,
+        .llseek         = default_llseek,
 };
 
 /* used to initialize the real stat files */
@@ -877,10 +885,8 @@ enum {
         FTRACE_ENABLE_CALLS             = (1 << 0),
         FTRACE_DISABLE_CALLS            = (1 << 1),
         FTRACE_UPDATE_TRACE_FUNC        = (1 << 2),
-        FTRACE_ENABLE_MCOUNT            = (1 << 3),
-        FTRACE_DISABLE_MCOUNT           = (1 << 4),
-        FTRACE_START_FUNC_RET           = (1 << 5),
-        FTRACE_STOP_FUNC_RET            = (1 << 6),
+        FTRACE_START_FUNC_RET           = (1 << 3),
+        FTRACE_STOP_FUNC_RET            = (1 << 4),
 };
 
 static int ftrace_filtered;
@@ -1219,8 +1225,6 @@ static void ftrace_shutdown(int command)
 
 static void ftrace_startup_sysctl(void)
 {
-        int command = FTRACE_ENABLE_MCOUNT;
-
         if (unlikely(ftrace_disabled))
                 return;
 
@@ -1228,23 +1232,17 @@ static void ftrace_startup_sysctl(void)
         saved_ftrace_func = NULL;
         /* ftrace_start_up is true if we want ftrace running */
         if (ftrace_start_up)
-                command |= FTRACE_ENABLE_CALLS;
-
-        ftrace_run_update_code(command);
+                ftrace_run_update_code(FTRACE_ENABLE_CALLS);
 }
 
 static void ftrace_shutdown_sysctl(void)
 {
-        int command = FTRACE_DISABLE_MCOUNT;
-
         if (unlikely(ftrace_disabled))
                 return;
 
         /* ftrace_start_up is true if ftrace is running */
         if (ftrace_start_up)
-                command |= FTRACE_DISABLE_CALLS;
-
-        ftrace_run_update_code(command);
+                ftrace_run_update_code(FTRACE_DISABLE_CALLS);
 }
 
 static cycle_t          ftrace_update_time;
@@ -1361,24 +1359,29 @@ enum {
 #define FTRACE_BUFF_MAX (KSYM_SYMBOL_LEN+4) /* room for wildcards */
 
 struct ftrace_iterator {
-        struct ftrace_page      *pg;
-        int                     hidx;
-        int                     idx;
-        unsigned                flags;
-        struct trace_parser     parser;
+        loff_t                          pos;
+        loff_t                          func_pos;
+        struct ftrace_page              *pg;
+        struct dyn_ftrace               *func;
+        struct ftrace_func_probe        *probe;
+        struct trace_parser             parser;
+        int                             hidx;
+        int                             idx;
+        unsigned                        flags;
 };
 
 static void *
-t_hash_next(struct seq_file *m, void *v, loff_t *pos)
+t_hash_next(struct seq_file *m, loff_t *pos)
 {
         struct ftrace_iterator *iter = m->private;
-        struct hlist_node *hnd = v;
+        struct hlist_node *hnd = NULL;
         struct hlist_head *hhd;
 
-        WARN_ON(!(iter->flags & FTRACE_ITER_HASH));
-
         (*pos)++;
+        iter->pos = *pos;
 
+        if (iter->probe)
+                hnd = &iter->probe->node;
  retry:
         if (iter->hidx >= FTRACE_FUNC_HASHSIZE)
                 return NULL;
@@ -1401,7 +1404,12 @@ t_hash_next(struct seq_file *m, void *v, loff_t *pos)
                 }
         }
 
-        return hnd;
+        if (WARN_ON_ONCE(!hnd))
+                return NULL;
+
+        iter->probe = hlist_entry(hnd, struct ftrace_func_probe, node);
+
+        return iter;
 }
 
 static void *t_hash_start(struct seq_file *m, loff_t *pos)
@@ -1410,26 +1418,32 @@ static void *t_hash_start(struct seq_file *m, loff_t *pos)
         void *p = NULL;
         loff_t l;
 
-        if (!(iter->flags & FTRACE_ITER_HASH))
-                *pos = 0;
-
-        iter->flags |= FTRACE_ITER_HASH;
+        if (iter->func_pos > *pos)
+                return NULL;
 
         iter->hidx = 0;
-        for (l = 0; l <= *pos; ) {
-                p = t_hash_next(m, p, &l);
+        for (l = 0; l <= (*pos - iter->func_pos); ) {
+                p = t_hash_next(m, &l);
                 if (!p)
                         break;
         }
-        return p;
+        if (!p)
+                return NULL;
+
+        /* Only set this if we have an item */
+        iter->flags |= FTRACE_ITER_HASH;
+
+        return iter;
 }
 
-static int t_hash_show(struct seq_file *m, void *v)
+static int
+t_hash_show(struct seq_file *m, struct ftrace_iterator *iter)
 {
         struct ftrace_func_probe *rec;
-        struct hlist_node *hnd = v;
 
-        rec = hlist_entry(hnd, struct ftrace_func_probe, node);
+        rec = iter->probe;
+        if (WARN_ON_ONCE(!rec))
+                return -EIO;
 
         if (rec->ops->print)
                 return rec->ops->print(m, rec->ip, rec->ops, rec->data);
@@ -1450,12 +1464,13 @@ t_next(struct seq_file *m, void *v, loff_t *pos)
         struct dyn_ftrace *rec = NULL;
 
         if (iter->flags & FTRACE_ITER_HASH)
-                return t_hash_next(m, v, pos);
+                return t_hash_next(m, pos);
 
         (*pos)++;
+        iter->pos = *pos;
 
         if (iter->flags & FTRACE_ITER_PRINTALL)
-                return NULL;
+                return t_hash_start(m, pos);
 
  retry:
         if (iter->idx >= iter->pg->index) {
@@ -1484,7 +1499,20 @@ t_next(struct seq_file *m, void *v, loff_t *pos)
                 }
         }
 
-        return rec;
+        if (!rec)
+                return t_hash_start(m, pos);
+
+        iter->func_pos = *pos;
+        iter->func = rec;
+
+        return iter;
+}
+
+static void reset_iter_read(struct ftrace_iterator *iter)
+{
+        iter->pos = 0;
+        iter->func_pos = 0;
+        iter->flags &= ~(FTRACE_ITER_PRINTALL & FTRACE_ITER_HASH);
 }
 
 static void *t_start(struct seq_file *m, loff_t *pos)
@@ -1495,6 +1523,12 @@ static void *t_start(struct seq_file *m, loff_t *pos)
 
         mutex_lock(&ftrace_lock);
         /*
+         * If an lseek was done, then reset and start from beginning.
+         */
+        if (*pos < iter->pos)
+                reset_iter_read(iter);
+
+        /*
          * For set_ftrace_filter reading, if we have the filter
          * off, we can short cut and just print out that all
          * functions are enabled.
@@ -1503,12 +1537,19 @@ static void *t_start(struct seq_file *m, loff_t *pos)
                 if (*pos > 0)
                         return t_hash_start(m, pos);
                 iter->flags |= FTRACE_ITER_PRINTALL;
+                /* reset in case of seek/pread */
+                iter->flags &= ~FTRACE_ITER_HASH;
                 return iter;
         }
 
         if (iter->flags & FTRACE_ITER_HASH)
                 return t_hash_start(m, pos);
 
+        /*
+         * Unfortunately, we need to restart at ftrace_pages_start
+         * every time we let go of the ftrace_mutex. This is because
+         * those pointers can change without the lock.
+         */
         iter->pg = ftrace_pages_start;
         iter->idx = 0;
         for (l = 0; l <= *pos; ) {
@@ -1517,10 +1558,14 @@ static void *t_start(struct seq_file *m, loff_t *pos)
                         break;
         }
 
-        if (!p && iter->flags & FTRACE_ITER_FILTER)
-                return t_hash_start(m, pos);
+        if (!p) {
+                if (iter->flags & FTRACE_ITER_FILTER)
+                        return t_hash_start(m, pos);
 
-        return p;
+                return NULL;
+        }
+
+        return iter;
 }
 
 static void t_stop(struct seq_file *m, void *p)
@@ -1531,16 +1576,18 @@ static void t_stop(struct seq_file *m, void *p)
 static int t_show(struct seq_file *m, void *v)
 {
         struct ftrace_iterator *iter = m->private;
-        struct dyn_ftrace *rec = v;
+        struct dyn_ftrace *rec;
 
         if (iter->flags & FTRACE_ITER_HASH)
-                return t_hash_show(m, v);
+                return t_hash_show(m, iter);
 
         if (iter->flags & FTRACE_ITER_PRINTALL) {
                 seq_printf(m, "#### all functions enabled ####\n");
                 return 0;
         }
 
+        rec = iter->func;
+
         if (!rec)
                 return 0;
 
@@ -1592,8 +1639,8 @@ ftrace_failures_open(struct inode *inode, struct file *file)
 
         ret = ftrace_avail_open(inode, file);
         if (!ret) {
-                m = (struct seq_file *)file->private_data;
-                iter = (struct ftrace_iterator *)m->private;
+                m = file->private_data;
+                iter = m->private;
                 iter->flags = FTRACE_ITER_FAILURES;
         }
 
@@ -2623,6 +2670,7 @@ static const struct file_operations ftrace_graph_fops = {
         .read           = seq_read,
         .write          = ftrace_graph_write,
         .release        = ftrace_graph_release,
+        .llseek         = seq_lseek,
 };
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 3632ce87674f..bd1c35a4fbcc 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -224,6 +224,9 @@ enum {
         RB_LEN_TIME_STAMP = 16,
 };
 
+#define skip_time_extend(event) \
+        ((struct ring_buffer_event *)((char *)event + RB_LEN_TIME_EXTEND))
+
 static inline int rb_null_event(struct ring_buffer_event *event)
 {
         return event->type_len == RINGBUF_TYPE_PADDING && !event->time_delta;
@@ -248,8 +251,12 @@ rb_event_data_length(struct ring_buffer_event *event)
         return length + RB_EVNT_HDR_SIZE;
 }
 
-/* inline for ring buffer fast paths */
-static unsigned
+/*
+ * Return the length of the given event. Will return
+ * the length of the time extend if the event is a
+ * time extend.
+ */
+static inline unsigned
 rb_event_length(struct ring_buffer_event *event)
 {
         switch (event->type_len) {
@@ -274,13 +281,41 @@ rb_event_length(struct ring_buffer_event *event)
         return 0;
 }
 
+/*
+ * Return total length of time extend and data,
+ *   or just the event length for all other events.
+ */
+static inline unsigned
+rb_event_ts_length(struct ring_buffer_event *event)
+{
+        unsigned len = 0;
+
+        if (event->type_len == RINGBUF_TYPE_TIME_EXTEND) {
+                /* time extends include the data event after it */
+                len = RB_LEN_TIME_EXTEND;
+                event = skip_time_extend(event);
+        }
+        return len + rb_event_length(event);
+}
+
 /**
  * ring_buffer_event_length - return the length of the event
  * @event: the event to get the length of
+ *
+ * Returns the size of the data load of a data event.
+ * If the event is something other than a data event, it
+ * returns the size of the event itself. With the exception
+ * of a TIME EXTEND, where it still returns the size of the
+ * data load of the data event after it.
  */
 unsigned ring_buffer_event_length(struct ring_buffer_event *event)
 {
-        unsigned length = rb_event_length(event);
+        unsigned length;
+
+        if (event->type_len == RINGBUF_TYPE_TIME_EXTEND)
+                event = skip_time_extend(event);
+
+        length = rb_event_length(event);
         if (event->type_len > RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
                 return length;
         length -= RB_EVNT_HDR_SIZE;
@@ -294,6 +329,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_length);
 static void *
 rb_event_data(struct ring_buffer_event *event)
 {
+        if (event->type_len == RINGBUF_TYPE_TIME_EXTEND)
+                event = skip_time_extend(event);
         BUG_ON(event->type_len > RINGBUF_TYPE_DATA_TYPE_LEN_MAX);
         /* If length is in len field, then array[0] has the data */
         if (event->type_len)
@@ -404,9 +441,6 @@ static inline int test_time_stamp(u64 delta)
 /* Max payload is BUF_PAGE_SIZE - header (8bytes) */
 #define BUF_MAX_DATA_SIZE (BUF_PAGE_SIZE - (sizeof(u32) * 2))
 
-/* Max number of timestamps that can fit on a page */
-#define RB_TIMESTAMPS_PER_PAGE  (BUF_PAGE_SIZE / RB_LEN_TIME_STAMP)
-
 int ring_buffer_print_page_header(struct trace_seq *s)
 {
         struct buffer_data_page field;
@@ -1546,6 +1580,25 @@ static void rb_inc_iter(struct ring_buffer_iter *iter)
         iter->head = 0;
 }
 
+/* Slow path, do not inline */
+static noinline struct ring_buffer_event *
+rb_add_time_stamp(struct ring_buffer_event *event, u64 delta)
+{
+        event->type_len = RINGBUF_TYPE_TIME_EXTEND;
+
+        /* Not the first event on the page? */
+        if (rb_event_index(event)) {
+                event->time_delta = delta & TS_MASK;
+                event->array[0] = delta >> TS_SHIFT;
+        } else {
+                /* nope, just zero it */
+                event->time_delta = 0;
+                event->array[0] = 0;
+        }
+
+        return skip_time_extend(event);
+}
+
 /**
  * ring_buffer_update_event - update event type and data
  * @event: the even to update
@@ -1558,28 +1611,31 @@ static void rb_inc_iter(struct ring_buffer_iter *iter)
  * data field.
  */
 static void
-rb_update_event(struct ring_buffer_event *event,
-                         unsigned type, unsigned length)
+rb_update_event(struct ring_buffer_per_cpu *cpu_buffer,
+                struct ring_buffer_event *event, unsigned length,
+                int add_timestamp, u64 delta)
 {
-        event->type_len = type;
-
-        switch (type) {
-
-        case RINGBUF_TYPE_PADDING:
-        case RINGBUF_TYPE_TIME_EXTEND:
-        case RINGBUF_TYPE_TIME_STAMP:
-                break;
+        /* Only a commit updates the timestamp */
+        if (unlikely(!rb_event_is_commit(cpu_buffer, event)))
+                delta = 0;
 
-        case 0:
-                length -= RB_EVNT_HDR_SIZE;
-                if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
-                        event->array[0] = length;
-                else
-                        event->type_len = DIV_ROUND_UP(length, RB_ALIGNMENT);
-                break;
-        default:
-                BUG();
+        /*
+         * If we need to add a timestamp, then we
+         * add it to the start of the resevered space.
+         */
+        if (unlikely(add_timestamp)) {
+                event = rb_add_time_stamp(event, delta);
+                length -= RB_LEN_TIME_EXTEND;
+                delta = 0;
         }
+
+        event->time_delta = delta;
+        length -= RB_EVNT_HDR_SIZE;
+        if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT) {
+                event->type_len = 0;
+                event->array[0] = length;
+        } else
+                event->type_len = DIV_ROUND_UP(length, RB_ALIGNMENT);
 }
 
 /*
@@ -1823,10 +1879,13 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
         local_sub(length, &tail_page->write);
 }
 
-static struct ring_buffer_event *
+/*
+ * This is the slow path, force gcc not to inline it.
+ */
+static noinline struct ring_buffer_event *
 rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
              unsigned long length, unsigned long tail,
-             struct buffer_page *tail_page, u64 *ts)
+             struct buffer_page *tail_page, u64 ts)
 {
         struct buffer_page *commit_page = cpu_buffer->commit_page;
         struct ring_buffer *buffer = cpu_buffer->buffer;
@@ -1909,8 +1968,8 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
                  * Nested commits always have zero deltas, so
                  * just reread the time stamp
                  */
-                *ts = rb_time_stamp(buffer);
-                next_page->page->time_stamp = *ts;
+                ts = rb_time_stamp(buffer);
+                next_page->page->time_stamp = ts;
         }
 
  out_again:
@@ -1929,12 +1988,21 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
 
 static struct ring_buffer_event *
 __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
-                  unsigned type, unsigned long length, u64 *ts)
+                  unsigned long length, u64 ts,
+                  u64 delta, int add_timestamp)
 {
         struct buffer_page *tail_page;
         struct ring_buffer_event *event;
         unsigned long tail, write;
 
+        /*
+         * If the time delta since the last event is too big to
+         * hold in the time field of the event, then we append a
+         * TIME EXTEND event ahead of the data event.
+         */
+        if (unlikely(add_timestamp))
+                length += RB_LEN_TIME_EXTEND;
+
         tail_page = cpu_buffer->tail_page;
         write = local_add_return(length, &tail_page->write);
 
@@ -1943,7 +2011,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
         tail = write - length;
 
         /* See if we shot pass the end of this buffer page */
-        if (write > BUF_PAGE_SIZE)
+        if (unlikely(write > BUF_PAGE_SIZE))
                 return rb_move_tail(cpu_buffer, length, tail,
                                     tail_page, ts);
 
@@ -1951,18 +2019,16 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
 
         event = __rb_page_index(tail_page, tail);
         kmemcheck_annotate_bitfield(event, bitfield);
-        rb_update_event(event, type, length);
+        rb_update_event(cpu_buffer, event, length, add_timestamp, delta);
 
-        /* The passed in type is zero for DATA */
-        if (likely(!type))
-                local_inc(&tail_page->entries);
+        local_inc(&tail_page->entries);
 
         /*
          * If this is the first commit on the page, then update
          * its timestamp.
          */
         if (!tail)
-                tail_page->page->time_stamp = *ts;
+                tail_page->page->time_stamp = ts;
 
         return event;
 }
@@ -1977,7 +2043,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
         unsigned long addr;
 
         new_index = rb_event_index(event);
-        old_index = new_index + rb_event_length(event);
+        old_index = new_index + rb_event_ts_length(event);
         addr = (unsigned long)event;
         addr &= PAGE_MASK;
 
@@ -2003,76 +2069,13 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
         return 0;
 }
 
-static int
-rb_add_time_stamp(struct ring_buffer_per_cpu *cpu_buffer,
-                  u64 *ts, u64 *delta)
-{
-        struct ring_buffer_event *event;
-        int ret;
-
-        WARN_ONCE(*delta > (1ULL << 59),
-                  KERN_WARNING "Delta way too big! %llu ts=%llu write stamp = %llu\n",
-                  (unsigned long long)*delta,
-                  (unsigned long long)*ts,
-                  (unsigned long long)cpu_buffer->write_stamp);
-
-        /*
-         * The delta is too big, we to add a
-         * new timestamp.
-         */
-        event = __rb_reserve_next(cpu_buffer,
-                                  RINGBUF_TYPE_TIME_EXTEND,
-                                  RB_LEN_TIME_EXTEND,
-                                  ts);
-        if (!event)
-                return -EBUSY;
-
-        if (PTR_ERR(event) == -EAGAIN)
-                return -EAGAIN;
-
-        /* Only a commited time event can update the write stamp */
-        if (rb_event_is_commit(cpu_buffer, event)) {
-                /*
-                 * If this is the first on the page, then it was
-                 * updated with the page itself. Try to discard it
-                 * and if we can't just make it zero.
-                 */
-                if (rb_event_index(event)) {
-                        event->time_delta = *delta & TS_MASK;
-                        event->array[0] = *delta >> TS_SHIFT;
-                } else {
-                        /* try to discard, since we do not need this */
-                        if (!rb_try_to_discard(cpu_buffer, event)) {
-                                /* nope, just zero it */
-                                event->time_delta = 0;
-                                event->array[0] = 0;
-                        }
-                }
-                cpu_buffer->write_stamp = *ts;
-                /* let the caller know this was the commit */
-                ret = 1;
-        } else {
-                /* Try to discard the event */
-                if (!rb_try_to_discard(cpu_buffer, event)) {
-                        /* Darn, this is just wasted space */
-                        event->time_delta = 0;
-                        event->array[0] = 0;
-                }
-                ret = 0;
-        }
-
-        *delta = 0;
-
-        return ret;
-}
-
 static void rb_start_commit(struct ring_buffer_per_cpu *cpu_buffer)
 {
         local_inc(&cpu_buffer->committing);
         local_inc(&cpu_buffer->commits);
 }
 
-static void rb_end_commit(struct ring_buffer_per_cpu *cpu_buffer)
+static inline void rb_end_commit(struct ring_buffer_per_cpu *cpu_buffer)
 {
         unsigned long commits;
 
@@ -2110,9 +2113,10 @@ rb_reserve_next_event(struct ring_buffer *buffer,
                       unsigned long length)
 {
         struct ring_buffer_event *event;
-        u64 ts, delta = 0;
-        int commit = 0;
+        u64 ts, delta;
         int nr_loops = 0;
+        int add_timestamp;
+        u64 diff;
 
         rb_start_commit(cpu_buffer);
 
@@ -2133,6 +2137,9 @@ rb_reserve_next_event(struct ring_buffer *buffer,
 
         length = rb_calculate_event_length(length);
  again:
+        add_timestamp = 0;
+        delta = 0;
+
         /*
          * We allow for interrupts to reenter here and do a trace.
          * If one does, it will cause this original code to loop
@@ -2146,56 +2153,32 @@ rb_reserve_next_event(struct ring_buffer *buffer,
                 goto out_fail;
 
         ts = rb_time_stamp(cpu_buffer->buffer);
+        diff = ts - cpu_buffer->write_stamp;
 
-        /*
-         * Only the first commit can update the timestamp.
-         * Yes there is a race here. If an interrupt comes in
-         * just after the conditional and it traces too, then it
-         * will also check the deltas. More than one timestamp may
-         * also be made. But only the entry that did the actual
-         * commit will be something other than zero.
-         */
-        if (likely(cpu_buffer->tail_page == cpu_buffer->commit_page &&
-                   rb_page_write(cpu_buffer->tail_page) ==
-                   rb_commit_index(cpu_buffer))) {
-                u64 diff;
-
-                diff = ts - cpu_buffer->write_stamp;
-
-                /* make sure this diff is calculated here */
-                barrier();
-
-                /* Did the write stamp get updated already? */
-                if (unlikely(ts < cpu_buffer->write_stamp))
-                        goto get_event;
+        /* make sure this diff is calculated here */
+        barrier();
 
+        /* Did the write stamp get updated already? */
+        if (likely(ts >= cpu_buffer->write_stamp)) {
                 delta = diff;
                 if (unlikely(test_time_stamp(delta))) {
-
-                        commit = rb_add_time_stamp(cpu_buffer, &ts, &delta);
-                        if (commit == -EBUSY)
-                                goto out_fail;
-
-                        if (commit == -EAGAIN)
-                                goto again;
-
-                        RB_WARN_ON(cpu_buffer, commit < 0);
+                        WARN_ONCE(delta > (1ULL << 59),
+                                  KERN_WARNING "Delta way too big! %llu ts=%llu write stamp = %llu\n",
+                                  (unsigned long long)delta,
+                                  (unsigned long long)ts,
+                                  (unsigned long long)cpu_buffer->write_stamp);
+                        add_timestamp = 1;
                 }
         }
 
- get_event:
-        event = __rb_reserve_next(cpu_buffer, 0, length, &ts);
+        event = __rb_reserve_next(cpu_buffer, length, ts,
+                                  delta, add_timestamp);
         if (unlikely(PTR_ERR(event) == -EAGAIN))
                 goto again;
 
         if (!event)
                 goto out_fail;
 
-        if (!rb_event_is_commit(cpu_buffer, event))
-                delta = 0;
-
-        event->time_delta = delta;
-
         return event;
 
  out_fail:
@@ -2207,13 +2190,9 @@ rb_reserve_next_event(struct ring_buffer *buffer,
 
 #define TRACE_RECURSIVE_DEPTH 16
 
-static int trace_recursive_lock(void)
+/* Keep this code out of the fast path cache */
+static noinline void trace_recursive_fail(void)
 {
-        current->trace_recursion++;
-
-        if (likely(current->trace_recursion < TRACE_RECURSIVE_DEPTH))
-                return 0;
-
         /* Disable all tracing before we do anything else */
         tracing_off_permanent();
 
@@ -2225,10 +2204,21 @@ static int trace_recursive_lock(void)
                     in_nmi());
 
         WARN_ON_ONCE(1);
+}
+
+static inline int trace_recursive_lock(void)
+{
+        current->trace_recursion++;
+
+        if (likely(current->trace_recursion < TRACE_RECURSIVE_DEPTH))
+                return 0;
+
+        trace_recursive_fail();
+
         return -1;
 }
 
-static void trace_recursive_unlock(void)
+static inline void trace_recursive_unlock(void)
 {
         WARN_ON_ONCE(!current->trace_recursion);
 
@@ -2308,12 +2298,28 @@ static void
 rb_update_write_stamp(struct ring_buffer_per_cpu *cpu_buffer,
                       struct ring_buffer_event *event)
 {
+        u64 delta;
+
         /*
          * The event first in the commit queue updates the
          * time stamp.
          */
-        if (rb_event_is_commit(cpu_buffer, event))
-                cpu_buffer->write_stamp += event->time_delta;
+        if (rb_event_is_commit(cpu_buffer, event)) {
+                /*
+                 * A commit event that is first on a page
+                 * updates the write timestamp with the page stamp
+                 */
+                if (!rb_event_index(event))
+                        cpu_buffer->write_stamp =
+                                cpu_buffer->commit_page->page->time_stamp;
+                else if (event->type_len == RINGBUF_TYPE_TIME_EXTEND) {
+                        delta = event->array[0];
+                        delta <<= TS_SHIFT;
+                        delta += event->time_delta;
+                        cpu_buffer->write_stamp += delta;
+                } else
+                        cpu_buffer->write_stamp += event->time_delta;
+        }
 }
 
 static void rb_commit(struct ring_buffer_per_cpu *cpu_buffer,
@@ -2353,6 +2359,9 @@ EXPORT_SYMBOL_GPL(ring_buffer_unlock_commit);
 
 static inline void rb_event_discard(struct ring_buffer_event *event)
 {
+        if (event->type_len == RINGBUF_TYPE_TIME_EXTEND)
+                event = skip_time_extend(event);
+
         /* array[0] holds the actual length for the discarded event */
         event->array[0] = rb_event_data_length(event) - RB_EVNT_HDR_SIZE;
         event->type_len = RINGBUF_TYPE_PADDING;
@@ -2606,6 +2615,19 @@ void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu)
 }
 EXPORT_SYMBOL_GPL(ring_buffer_record_enable_cpu);
 
+/*
+ * The total entries in the ring buffer is the running counter
+ * of entries entered into the ring buffer, minus the sum of
+ * the entries read from the ring buffer and the number of
+ * entries that were overwritten.
+ */
+static inline unsigned long
+rb_num_of_entries(struct ring_buffer_per_cpu *cpu_buffer)
+{
+        return local_read(&cpu_buffer->entries) -
+                (local_read(&cpu_buffer->overrun) + cpu_buffer->read);
+}
+
 /**
  * ring_buffer_entries_cpu - get the number of entries in a cpu buffer
  * @buffer: The ring buffer
@@ -2614,16 +2636,13 @@ EXPORT_SYMBOL_GPL(ring_buffer_record_enable_cpu);
 unsigned long ring_buffer_entries_cpu(struct ring_buffer *buffer, int cpu)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
-        unsigned long ret;
 
         if (!cpumask_test_cpu(cpu, buffer->cpumask))
                 return 0;
 
         cpu_buffer = buffer->buffers[cpu];
-        ret = (local_read(&cpu_buffer->entries) - local_read(&cpu_buffer->overrun))
-                - cpu_buffer->read;
 
-        return ret;
+        return rb_num_of_entries(cpu_buffer);
 }
 EXPORT_SYMBOL_GPL(ring_buffer_entries_cpu);
 
@@ -2684,8 +2703,7 @@ unsigned long ring_buffer_entries(struct ring_buffer *buffer)
         /* if you care about this being correct, lock the buffer */
         for_each_buffer_cpu(buffer, cpu) {
                 cpu_buffer = buffer->buffers[cpu];
-                entries += (local_read(&cpu_buffer->entries) -
-                            local_read(&cpu_buffer->overrun)) - cpu_buffer->read;
+                entries += rb_num_of_entries(cpu_buffer);
         }
 
         return entries;
@@ -2985,13 +3003,11 @@ static void rb_advance_reader(struct ring_buffer_per_cpu *cpu_buffer)
 
 static void rb_advance_iter(struct ring_buffer_iter *iter)
 {
-        struct ring_buffer *buffer;
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_event *event;
         unsigned length;
 
         cpu_buffer = iter->cpu_buffer;
-        buffer = cpu_buffer->buffer;
 
         /*
          * Check if we are at the end of the buffer.
@@ -3042,12 +3058,12 @@ rb_buffer_peek(struct ring_buffer_per_cpu *cpu_buffer, u64 *ts,
 
  again:
         /*
-         * We repeat when a timestamp is encountered. It is possible
-         * to get multiple timestamps from an interrupt entering just
-         * as one timestamp is about to be written, or from discarded
-         * commits. The most that we can have is the number on a single page.
+         * We repeat when a time extend is encountered.
+         * Since the time extend is always attached to a data event,
+         * we should never loop more than once.
+         * (We never hit the following condition more than twice).
          */
-        if (RB_WARN_ON(cpu_buffer, ++nr_loops > RB_TIMESTAMPS_PER_PAGE))
+        if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2))
                 return NULL;
 
         reader = rb_get_reader_page(cpu_buffer);
@@ -3123,14 +3139,12 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
                 return NULL;
 
         /*
-         * We repeat when a timestamp is encountered.
-         * We can get multiple timestamps by nested interrupts or also
-         * if filtering is on (discarding commits). Since discarding
-         * commits can be frequent we can get a lot of timestamps.
-         * But we limit them by not adding timestamps if they begin
-         * at the start of a page.
+         * We repeat when a time extend is encountered.
+         * Since the time extend is always attached to a data event,
+         * we should never loop more than once.
+         * (We never hit the following condition more than twice).
          */
-        if (RB_WARN_ON(cpu_buffer, ++nr_loops > RB_TIMESTAMPS_PER_PAGE))
+        if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2))
                 return NULL;
 
         if (rb_per_cpu_empty(cpu_buffer))
@@ -3828,7 +3842,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
                 if (len > (commit - read))
                         len = (commit - read);
 
-                size = rb_event_length(event);
+                /* Always keep the time extend and data together */
+                size = rb_event_ts_length(event);
 
                 if (len < size)
                         goto out_unlock;
@@ -3838,6 +3853,13 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
 
                 /* Need to copy one event at a time */
                 do {
+                        /* We need the size of one event, because
+                         * rb_advance_reader only advances by one event,
+                         * whereas rb_event_ts_length may include the size of
+                         * one or two events.
+                         * We have already ensured there's enough space if this
+                         * is a time extend. */
+                        size = rb_event_length(event);
                         memcpy(bpage->data + pos, rpage->data + rpos, size);
 
                         len -= size;
@@ -3846,9 +3868,13 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
                         rpos = reader->read;
                         pos += size;
 
+                        if (rpos >= commit)
+                                break;
+
                         event = rb_reader_event(cpu_buffer);
-                        size = rb_event_length(event);
-                } while (len > size);
+                        /* Always keep the time extend and data together */
+                        size = rb_event_ts_length(event);
+                } while (len >= size);
 
                 /* update bpage */
                 local_set(&bpage->commit, pos);
@@ -3964,6 +3990,7 @@ static const struct file_operations rb_simple_fops = {
         .open           = tracing_open_generic,
         .read           = rb_simple_read,
         .write          = rb_simple_write,
+        .llseek         = default_llseek,
 };
 
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index ba14a22be4cc..f8cf959bad45 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -17,7 +17,6 @@
 #include <linux/writeback.h>
 #include <linux/kallsyms.h>
 #include <linux/seq_file.h>
-#include <linux/smp_lock.h>
 #include <linux/notifier.h>
 #include <linux/irqflags.h>
 #include <linux/debugfs.h>
@@ -1284,6 +1283,8 @@ void trace_dump_stack(void)
         __ftrace_trace_stack(global_trace.buffer, flags, 3, preempt_count());
 }
 
+static DEFINE_PER_CPU(int, user_stack_count);
+
 void
 ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
 {
@@ -1302,6 +1303,18 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
         if (unlikely(in_nmi()))
                 return;
 
+        /*
+         * prevent recursion, since the user stack tracing may
+         * trigger other kernel events.
+         */
+        preempt_disable();
+        if (__this_cpu_read(user_stack_count))
+                goto out;
+
+        __this_cpu_inc(user_stack_count);
+
+
+
         event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
                                           sizeof(*entry), flags, pc);
         if (!event)
@@ -1319,6 +1332,11 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
         save_stack_trace_user(&trace);
         if (!filter_check_discard(call, entry, buffer, event))
                 ring_buffer_unlock_commit(buffer, event);
+
+        __this_cpu_dec(user_stack_count);
+
+ out:
+        preempt_enable();
 }
 
 #ifdef UNUSED
@@ -2196,7 +2214,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp)
 
 static int tracing_release(struct inode *inode, struct file *file)
 {
-        struct seq_file *m = (struct seq_file *)file->private_data;
+        struct seq_file *m = file->private_data;
         struct trace_iterator *iter;
         int cpu;
 
@@ -2320,11 +2338,19 @@ tracing_write_stub(struct file *filp, const char __user *ubuf,
         return count;
 }
 
+static loff_t tracing_seek(struct file *file, loff_t offset, int origin)
+{
+        if (file->f_mode & FMODE_READ)
+                return seq_lseek(file, offset, origin);
+        else
+                return 0;
+}
+
 static const struct file_operations tracing_fops = {
         .open           = tracing_open,
         .read           = seq_read,
         .write          = tracing_write_stub,
-        .llseek         = seq_lseek,
+        .llseek         = tracing_seek,
         .release        = tracing_release,
 };
 
@@ -3463,6 +3489,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
                                         size_t cnt, loff_t *fpos)
 {
         char *buf;
+        size_t written;
 
         if (tracing_disabled)
                 return -EINVAL;
@@ -3484,11 +3511,15 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
         } else
                 buf[cnt] = '\0';
 
-        cnt = mark_printk("%s", buf);
+        written = mark_printk("%s", buf);
         kfree(buf);
-        *fpos += cnt;
+        *fpos += written;
 
-        return cnt;
+        /* don't tell userspace we wrote more - it might confuse them */
+        if (written > cnt)
+                written = cnt;
+
+        return written;
 }
 
 static int tracing_clock_show(struct seq_file *m, void *v)
@@ -3991,13 +4022,9 @@ static void tracing_init_debugfs_percpu(long cpu)
 {
         struct dentry *d_percpu = tracing_dentry_percpu();
         struct dentry *d_cpu;
-        /* strlen(cpu) + MAX(log10(cpu)) + '\0' */
-        char cpu_dir[7];
-
-        if (cpu > 999 || cpu < 0)
-                return;
+        char cpu_dir[30]; /* 30 characters should be more than enough */
 
-        sprintf(cpu_dir, "cpu%ld", cpu);
+        snprintf(cpu_dir, 30, "cpu%ld", cpu);
         d_cpu = debugfs_create_dir(cpu_dir, d_percpu);
         if (!d_cpu) {
                 pr_warning("Could not create debugfs '%s' entry\n", cpu_dir);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index d39b3c5454a5..9021f8c0c0c3 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -343,6 +343,10 @@ void trace_function(struct trace_array *tr,
                     unsigned long ip,
                     unsigned long parent_ip,
                     unsigned long flags, int pc);
+void trace_graph_function(struct trace_array *tr,
+                    unsigned long ip,
+                    unsigned long parent_ip,
+                    unsigned long flags, int pc);
 void trace_default_header(struct seq_file *m);
 void print_trace_header(struct seq_file *m, struct trace_iterator *iter);
 int trace_empty(struct trace_iterator *iter);
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 000e6e85b445..39c059ca670e 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -9,7 +9,7 @@
 #include <linux/kprobes.h>
 #include "trace.h"
 
-static char *perf_trace_buf[4];
+static char __percpu *perf_trace_buf[PERF_NR_CONTEXTS];
 
 /*
  * Force it to be aligned to unsigned long to avoid misaligned accesses
@@ -24,7 +24,7 @@ static int	total_ref_count;
 static int perf_trace_event_init(struct ftrace_event_call *tp_event,
                                  struct perf_event *p_event)
 {
-        struct hlist_head *list;
+        struct hlist_head __percpu *list;
         int ret = -ENOMEM;
         int cpu;
 
@@ -42,11 +42,11 @@ static int perf_trace_event_init(struct ftrace_event_call *tp_event,
         tp_event->perf_events = list;
 
         if (!total_ref_count) {
-                char *buf;
+                char __percpu *buf;
                 int i;
 
-                for (i = 0; i < 4; i++) {
-                        buf = (char *)alloc_percpu(perf_trace_t);
+                for (i = 0; i < PERF_NR_CONTEXTS; i++) {
+                        buf = (char __percpu *)alloc_percpu(perf_trace_t);
                         if (!buf)
                                 goto fail;
 
@@ -65,7 +65,7 @@ fail:
         if (!total_ref_count) {
                 int i;
 
-                for (i = 0; i < 4; i++) {
+                for (i = 0; i < PERF_NR_CONTEXTS; i++) {
                         free_percpu(perf_trace_buf[i]);
                         perf_trace_buf[i] = NULL;
                 }
@@ -91,6 +91,8 @@ int perf_trace_init(struct perf_event *p_event)
                     tp_event->class && tp_event->class->reg &&
                     try_module_get(tp_event->mod)) {
                         ret = perf_trace_event_init(tp_event, p_event);
+                        if (ret)
+                                module_put(tp_event->mod);
                         break;
                 }
         }
@@ -99,22 +101,26 @@ int perf_trace_init(struct perf_event *p_event)
         return ret;
 }
 
-int perf_trace_enable(struct perf_event *p_event)
+int perf_trace_add(struct perf_event *p_event, int flags)
 {
         struct ftrace_event_call *tp_event = p_event->tp_event;
+        struct hlist_head __percpu *pcpu_list;
         struct hlist_head *list;
 
-        list = tp_event->perf_events;
-        if (WARN_ON_ONCE(!list))
+        pcpu_list = tp_event->perf_events;
+        if (WARN_ON_ONCE(!pcpu_list))
                 return -EINVAL;
 
-        list = this_cpu_ptr(list);
+        if (!(flags & PERF_EF_START))
+                p_event->hw.state = PERF_HES_STOPPED;
+
+        list = this_cpu_ptr(pcpu_list);
         hlist_add_head_rcu(&p_event->hlist_entry, list);
 
         return 0;
 }
 
-void perf_trace_disable(struct perf_event *p_event)
+void perf_trace_del(struct perf_event *p_event, int flags)
 {
         hlist_del_rcu(&p_event->hlist_entry);
 }
@@ -140,12 +146,13 @@ void perf_trace_destroy(struct perf_event *p_event)
         tp_event->perf_events = NULL;
 
         if (!--total_ref_count) {
-                for (i = 0; i < 4; i++) {
+                for (i = 0; i < PERF_NR_CONTEXTS; i++) {
                         free_percpu(perf_trace_buf[i]);
                         perf_trace_buf[i] = NULL;
                 }
         }
 out:
+        module_put(tp_event->mod);
         mutex_unlock(&event_mutex);
 }
 
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 09b4fa6e4d3b..0725eeab1937 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -598,88 +598,146 @@ out:
         return ret;
 }
 
-static void print_event_fields(struct trace_seq *s, struct list_head *head)
+enum {
+        FORMAT_HEADER           = 1,
+        FORMAT_FIELD_SEPERATOR  = 2,
+        FORMAT_PRINTFMT         = 3,
+};
+
+static void *f_next(struct seq_file *m, void *v, loff_t *pos)
 {
+        struct ftrace_event_call *call = m->private;
         struct ftrace_event_field *field;
+        struct list_head *common_head = &ftrace_common_fields;
+        struct list_head *head = trace_get_fields(call);
 
-        list_for_each_entry_reverse(field, head, link) {
-                /*
-                 * Smartly shows the array type(except dynamic array).
-                 * Normal:
-                 *      field:TYPE VAR
-                 * If TYPE := TYPE[LEN], it is shown:
-                 *      field:TYPE VAR[LEN]
-                 */
-                const char *array_descriptor = strchr(field->type, '[');
+        (*pos)++;
 
-                if (!strncmp(field->type, "__data_loc", 10))
-                        array_descriptor = NULL;
+        switch ((unsigned long)v) {
+        case FORMAT_HEADER:
+                if (unlikely(list_empty(common_head)))
+                        return NULL;
 
-                if (!array_descriptor) {
-                        trace_seq_printf(s, "\tfield:%s %s;\toffset:%u;"
-                                        "\tsize:%u;\tsigned:%d;\n",
-                                        field->type, field->name, field->offset,
-                                        field->size, !!field->is_signed);
-                } else {
-                        trace_seq_printf(s, "\tfield:%.*s %s%s;\toffset:%u;"
-                                        "\tsize:%u;\tsigned:%d;\n",
-                                        (int)(array_descriptor - field->type),
-                                        field->type, field->name,
-                                        array_descriptor, field->offset,
-                                        field->size, !!field->is_signed);
-                }
+                field = list_entry(common_head->prev,
+                                   struct ftrace_event_field, link);
+                return field;
+
+        case FORMAT_FIELD_SEPERATOR:
+                if (unlikely(list_empty(head)))
+                        return NULL;
+
+                field = list_entry(head->prev, struct ftrace_event_field, link);
+                return field;
+
+        case FORMAT_PRINTFMT:
+                /* all done */
+                return NULL;
         }
+
+        field = v;
+        if (field->link.prev == common_head)
+                return (void *)FORMAT_FIELD_SEPERATOR;
+        else if (field->link.prev == head)
+                return (void *)FORMAT_PRINTFMT;
+
+        field = list_entry(field->link.prev, struct ftrace_event_field, link);
+
+        return field;
 }
 
-static ssize_t
-event_format_read(struct file *filp, char __user *ubuf, size_t cnt,
-                  loff_t *ppos)
+static void *f_start(struct seq_file *m, loff_t *pos)
 {
-        struct ftrace_event_call *call = filp->private_data;
-        struct list_head *head;
-        struct trace_seq *s;
-        char *buf;
-        int r;
+        loff_t l = 0;
+        void *p;
 
-        if (*ppos)
+        /* Start by showing the header */
+        if (!*pos)
+                return (void *)FORMAT_HEADER;
+
+        p = (void *)FORMAT_HEADER;
+        do {
+                p = f_next(m, p, &l);
+        } while (p && l < *pos);
+
+        return p;
+}
+
+static int f_show(struct seq_file *m, void *v)
+{
+        struct ftrace_event_call *call = m->private;
+        struct ftrace_event_field *field;
+        const char *array_descriptor;
+
+        switch ((unsigned long)v) {
+        case FORMAT_HEADER:
+                seq_printf(m, "name: %s\n", call->name);
+                seq_printf(m, "ID: %d\n", call->event.type);
+                seq_printf(m, "format:\n");
                 return 0;
 
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
-        if (!s)
-                return -ENOMEM;
+        case FORMAT_FIELD_SEPERATOR:
+                seq_putc(m, '\n');
+                return 0;
 
-        trace_seq_init(s);
+        case FORMAT_PRINTFMT:
+                seq_printf(m, "\nprint fmt: %s\n",
+                           call->print_fmt);
+                return 0;
+        }
 
-        trace_seq_printf(s, "name: %s\n", call->name);
-        trace_seq_printf(s, "ID: %d\n", call->event.type);
-        trace_seq_printf(s, "format:\n");
+        field = v;
 
-        /* print common fields */
-        print_event_fields(s, &ftrace_common_fields);
+        /*
+         * Smartly shows the array type(except dynamic array).
+         * Normal:
+         *      field:TYPE VAR
+         * If TYPE := TYPE[LEN], it is shown:
+         *      field:TYPE VAR[LEN]
+         */
+        array_descriptor = strchr(field->type, '[');
 
-        trace_seq_putc(s, '\n');
+        if (!strncmp(field->type, "__data_loc", 10))
+                array_descriptor = NULL;
 
-        /* print event specific fields */
-        head = trace_get_fields(call);
-        print_event_fields(s, head);
+        if (!array_descriptor)
+                seq_printf(m, "\tfield:%s %s;\toffset:%u;\tsize:%u;\tsigned:%d;\n",
+                           field->type, field->name, field->offset,
+                           field->size, !!field->is_signed);
+        else
+                seq_printf(m, "\tfield:%.*s %s%s;\toffset:%u;\tsize:%u;\tsigned:%d;\n",
+                           (int)(array_descriptor - field->type),
+                           field->type, field->name,
+                           array_descriptor, field->offset,
+                           field->size, !!field->is_signed);
 
-        r = trace_seq_printf(s, "\nprint fmt: %s\n", call->print_fmt);
+        return 0;
+}
 
-        if (!r) {
-                /*
-                 * ug!  The format output is bigger than a PAGE!!
-                 */
-                buf = "FORMAT TOO BIG\n";
-                r = simple_read_from_buffer(ubuf, cnt, ppos,
-                                              buf, strlen(buf));
-                goto out;
-        }
+static void f_stop(struct seq_file *m, void *p)
+{
+}
 
-        r = simple_read_from_buffer(ubuf, cnt, ppos,
-                                    s->buffer, s->len);
- out:
-        kfree(s);
-        return r;
+static const struct seq_operations trace_format_seq_ops = {
+        .start          = f_start,
+        .next           = f_next,
+        .stop           = f_stop,
+        .show           = f_show,
+};
+
+static int trace_format_open(struct inode *inode, struct file *file)
+{
+        struct ftrace_event_call *call = inode->i_private;
+        struct seq_file *m;
+        int ret;
+
+        ret = seq_open(file, &trace_format_seq_ops);
+        if (ret < 0)
+                return ret;
+
+        m = file->private_data;
+        m->private = call;
+
+        return 0;
 }
 
 static ssize_t
@@ -874,39 +932,47 @@ static const struct file_operations ftrace_enable_fops = {
         .open = tracing_open_generic,
         .read = event_enable_read,
         .write = event_enable_write,
+        .llseek = default_llseek,
 };
 
 static const struct file_operations ftrace_event_format_fops = {
-        .open = tracing_open_generic,
-        .read = event_format_read,
+        .open = trace_format_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release,
 };
 
 static const struct file_operations ftrace_event_id_fops = {
         .open = tracing_open_generic,
         .read = event_id_read,
+        .llseek = default_llseek,
 };
 
 static const struct file_operations ftrace_event_filter_fops = {
         .open = tracing_open_generic,
         .read = event_filter_read,
         .write = event_filter_write,
+        .llseek = default_llseek,
 };
 
 static const struct file_operations ftrace_subsystem_filter_fops = {
         .open = tracing_open_generic,
         .read = subsystem_filter_read,
         .write = subsystem_filter_write,
+        .llseek = default_llseek,
 };
 
 static const struct file_operations ftrace_system_enable_fops = {
         .open = tracing_open_generic,
         .read = system_enable_read,
         .write = system_enable_write,
+        .llseek = default_llseek,
 };
 
 static const struct file_operations ftrace_show_header_fops = {
         .open = tracing_open_generic,
         .read = show_header,
+        .llseek = default_llseek,
 };
 
 static struct dentry *event_trace_events_dir(void)
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 6bff23625781..76b05980225c 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -15,15 +15,19 @@
 #include "trace.h"
 #include "trace_output.h"
 
+/* When set, irq functions will be ignored */
+static int ftrace_graph_skip_irqs;
+
 struct fgraph_cpu_data {
         pid_t           last_pid;
         int             depth;
+        int             depth_irq;
         int             ignore;
         unsigned long   enter_funcs[FTRACE_RETFUNC_DEPTH];
 };
 
 struct fgraph_data {
-        struct fgraph_cpu_data          *cpu_data;
+        struct fgraph_cpu_data __percpu *cpu_data;
 
         /* Place to preserve last processed entry. */
         struct ftrace_graph_ent_entry   ent;
@@ -41,6 +45,7 @@ struct fgraph_data {
 #define TRACE_GRAPH_PRINT_PROC          0x8
 #define TRACE_GRAPH_PRINT_DURATION      0x10
 #define TRACE_GRAPH_PRINT_ABS_TIME      0x20
+#define TRACE_GRAPH_PRINT_IRQS          0x40
 
 static struct tracer_opt trace_opts[] = {
         /* Display overruns? (for self-debug purpose) */
@@ -55,13 +60,15 @@ static struct tracer_opt trace_opts[] = {
         { TRACER_OPT(funcgraph-duration, TRACE_GRAPH_PRINT_DURATION) },
         /* Display absolute time of an entry */
         { TRACER_OPT(funcgraph-abstime, TRACE_GRAPH_PRINT_ABS_TIME) },
+        /* Display interrupts */
+        { TRACER_OPT(funcgraph-irqs, TRACE_GRAPH_PRINT_IRQS) },
         { } /* Empty entry */
 };
 
 static struct tracer_flags tracer_flags = {
         /* Don't display overruns and proc by default */
         .val = TRACE_GRAPH_PRINT_CPU | TRACE_GRAPH_PRINT_OVERHEAD |
-               TRACE_GRAPH_PRINT_DURATION,
+               TRACE_GRAPH_PRINT_DURATION | TRACE_GRAPH_PRINT_IRQS,
         .opts = trace_opts
 };
 
@@ -204,6 +211,14 @@ int __trace_graph_entry(struct trace_array *tr,
         return 1;
 }
 
+static inline int ftrace_graph_ignore_irqs(void)
+{
+        if (!ftrace_graph_skip_irqs)
+                return 0;
+
+        return in_irq();
+}
+
 int trace_graph_entry(struct ftrace_graph_ent *trace)
 {
         struct trace_array *tr = graph_array;
@@ -218,7 +233,8 @@ int trace_graph_entry(struct ftrace_graph_ent *trace)
                 return 0;
 
         /* trace it when it is-nested-in or is a function enabled. */
-        if (!(trace->depth || ftrace_graph_addr(trace->func)))
+        if (!(trace->depth || ftrace_graph_addr(trace->func)) ||
+              ftrace_graph_ignore_irqs())
                 return 0;
 
         local_irq_save(flags);
@@ -246,6 +262,34 @@ int trace_graph_thresh_entry(struct ftrace_graph_ent *trace)
                 return trace_graph_entry(trace);
 }
 
+static void
+__trace_graph_function(struct trace_array *tr,
+                unsigned long ip, unsigned long flags, int pc)
+{
+        u64 time = trace_clock_local();
+        struct ftrace_graph_ent ent = {
+                .func  = ip,
+                .depth = 0,
+        };
+        struct ftrace_graph_ret ret = {
+                .func     = ip,
+                .depth    = 0,
+                .calltime = time,
+                .rettime  = time,
+        };
+
+        __trace_graph_entry(tr, &ent, flags, pc);
+        __trace_graph_return(tr, &ret, flags, pc);
+}
+
+void
+trace_graph_function(struct trace_array *tr,
+                unsigned long ip, unsigned long parent_ip,
+                unsigned long flags, int pc)
+{
+        __trace_graph_function(tr, ip, flags, pc);
+}
+
 void __trace_graph_return(struct trace_array *tr,
                                 struct ftrace_graph_ret *trace,
                                 unsigned long flags,
@@ -507,7 +551,15 @@ get_return_for_leaf(struct trace_iterator *iter,
                          * if the output fails.
                          */
                         data->ent = *curr;
-                        data->ret = *next;
+                        /*
+                         * If the next event is not a return type, then
+                         * we only care about what type it is. Otherwise we can
+                         * safely copy the entire event.
+                         */
+                        if (next->ent.type == TRACE_GRAPH_RET)
+                                data->ret = *next;
+                        else
+                                data->ret.ent.type = next->ent.type;
                 }
         }
 
@@ -641,8 +693,9 @@ trace_print_graph_duration(unsigned long long duration, struct trace_seq *s)
 
         /* Print nsecs (we don't want to exceed 7 numbers) */
         if (len < 7) {
-                snprintf(nsecs_str, min(sizeof(nsecs_str), 8UL - len), "%03lu",
-                         nsecs_rem);
+                size_t slen = min_t(size_t, sizeof(nsecs_str), 8UL - len);
+
+                snprintf(nsecs_str, slen, "%03lu", nsecs_rem);
                 ret = trace_seq_printf(s, ".%s", nsecs_str);
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -847,6 +900,108 @@ print_graph_prologue(struct trace_iterator *iter, struct trace_seq *s,
         return 0;
 }
 
+/*
+ * Entry check for irq code
+ *
+ * returns 1 if
+ *  - we are inside irq code
+ *  - we just extered irq code
+ *
+ * retunns 0 if
+ *  - funcgraph-interrupts option is set
+ *  - we are not inside irq code
+ */
+static int
+check_irq_entry(struct trace_iterator *iter, u32 flags,
+                unsigned long addr, int depth)
+{
+        int cpu = iter->cpu;
+        int *depth_irq;
+        struct fgraph_data *data = iter->private;
+
+        /*
+         * If we are either displaying irqs, or we got called as
+         * a graph event and private data does not exist,
+         * then we bypass the irq check.
+         */
+        if ((flags & TRACE_GRAPH_PRINT_IRQS) ||
+            (!data))
+                return 0;
+
+        depth_irq = &(per_cpu_ptr(data->cpu_data, cpu)->depth_irq);
+
+        /*
+         * We are inside the irq code
+         */
+        if (*depth_irq >= 0)
+                return 1;
+
+        if ((addr < (unsigned long)__irqentry_text_start) ||
+            (addr >= (unsigned long)__irqentry_text_end))
+                return 0;
+
+        /*
+         * We are entering irq code.
+         */
+        *depth_irq = depth;
+        return 1;
+}
+
+/*
+ * Return check for irq code
+ *
+ * returns 1 if
+ *  - we are inside irq code
+ *  - we just left irq code
+ *
+ * returns 0 if
+ *  - funcgraph-interrupts option is set
+ *  - we are not inside irq code
+ */
+static int
+check_irq_return(struct trace_iterator *iter, u32 flags, int depth)
+{
+        int cpu = iter->cpu;
+        int *depth_irq;
+        struct fgraph_data *data = iter->private;
+
+        /*
+         * If we are either displaying irqs, or we got called as
+         * a graph event and private data does not exist,
+         * then we bypass the irq check.
+         */
+        if ((flags & TRACE_GRAPH_PRINT_IRQS) ||
+            (!data))
+                return 0;
+
+        depth_irq = &(per_cpu_ptr(data->cpu_data, cpu)->depth_irq);
+
+        /*
+         * We are not inside the irq code.
+         */
+        if (*depth_irq == -1)
+                return 0;
+
+        /*
+         * We are inside the irq code, and this is returning entry.
+         * Let's not trace it and clear the entry depth, since
+         * we are out of irq code.
+         *
+         * This condition ensures that we 'leave the irq code' once
+         * we are out of the entry depth. Thus protecting us from
+         * the RETURN entry loss.
+         */
+        if (*depth_irq >= depth) {
+                *depth_irq = -1;
+                return 1;
+        }
+
+        /*
+         * We are inside the irq code, and this is not the entry.
+         */
+        return 1;
+}
+
 static enum print_line_t
 print_graph_entry(struct ftrace_graph_ent_entry *field, struct trace_seq *s,
                         struct trace_iterator *iter, u32 flags)
@@ -857,6 +1012,9 @@ print_graph_entry(struct ftrace_graph_ent_entry *field, struct trace_seq *s,
         static enum print_line_t ret;
         int cpu = iter->cpu;
 
+        if (check_irq_entry(iter, flags, call->func, call->depth))
+                return TRACE_TYPE_HANDLED;
+
         if (print_graph_prologue(iter, s, TRACE_GRAPH_ENT, call->func, flags))
                 return TRACE_TYPE_PARTIAL_LINE;
 
@@ -894,6 +1052,9 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
         int ret;
         int i;
 
+        if (check_irq_return(iter, flags, trace->depth))
+                return TRACE_TYPE_HANDLED;
+
         if (data) {
                 struct fgraph_cpu_data *cpu_data;
                 int cpu = iter->cpu;
@@ -1046,7 +1207,7 @@ print_graph_comment(struct trace_seq *s, struct trace_entry *ent,
 
 
 enum print_line_t
-print_graph_function_flags(struct trace_iterator *iter, u32 flags)
+__print_graph_function_flags(struct trace_iterator *iter, u32 flags)
 {
         struct ftrace_graph_ent_entry *field;
         struct fgraph_data *data = iter->private;
@@ -1109,7 +1270,18 @@ print_graph_function_flags(struct trace_iterator *iter, u32 flags)
 static enum print_line_t
 print_graph_function(struct trace_iterator *iter)
 {
-        return print_graph_function_flags(iter, tracer_flags.val);
+        return __print_graph_function_flags(iter, tracer_flags.val);
+}
+
+enum print_line_t print_graph_function_flags(struct trace_iterator *iter,
+                                             u32 flags)
+{
+        if (trace_flags & TRACE_ITER_LATENCY_FMT)
+                flags |= TRACE_GRAPH_PRINT_DURATION;
+        else
+                flags |= TRACE_GRAPH_PRINT_ABS_TIME;
+
+        return __print_graph_function_flags(iter, flags);
 }
 
 static enum print_line_t
@@ -1141,7 +1313,7 @@ static void print_lat_header(struct seq_file *s, u32 flags)
         seq_printf(s, "#%.*s|||| /                     \n", size, spaces);
 }
 
-void print_graph_headers_flags(struct seq_file *s, u32 flags)
+static void __print_graph_headers_flags(struct seq_file *s, u32 flags)
 {
         int lat = trace_flags & TRACE_ITER_LATENCY_FMT;
 
@@ -1182,6 +1354,23 @@ void print_graph_headers(struct seq_file *s)
         print_graph_headers_flags(s, tracer_flags.val);
 }
 
+void print_graph_headers_flags(struct seq_file *s, u32 flags)
+{
+        struct trace_iterator *iter = s->private;
+
+        if (trace_flags & TRACE_ITER_LATENCY_FMT) {
+                /* print nothing if the buffers are empty */
+                if (trace_empty(iter))
+                        return;
+
+                print_trace_header(s, iter);
+                flags |= TRACE_GRAPH_PRINT_DURATION;
+        } else
+                flags |= TRACE_GRAPH_PRINT_ABS_TIME;
+
+        __print_graph_headers_flags(s, flags);
+}
+
 void graph_trace_open(struct trace_iterator *iter)
 {
         /* pid and depth on the last trace processed */
@@ -1202,9 +1391,12 @@ void graph_trace_open(struct trace_iterator *iter)
                 pid_t *pid = &(per_cpu_ptr(data->cpu_data, cpu)->last_pid);
                 int *depth = &(per_cpu_ptr(data->cpu_data, cpu)->depth);
                 int *ignore = &(per_cpu_ptr(data->cpu_data, cpu)->ignore);
+                int *depth_irq = &(per_cpu_ptr(data->cpu_data, cpu)->depth_irq);
+
                 *pid = -1;
                 *depth = 0;
                 *ignore = 0;
+                *depth_irq = -1;
         }
 
         iter->private = data;
@@ -1227,6 +1419,14 @@ void graph_trace_close(struct trace_iterator *iter)
         }
 }
 
+static int func_graph_set_flag(u32 old_flags, u32 bit, int set)
+{
+        if (bit == TRACE_GRAPH_PRINT_IRQS)
+                ftrace_graph_skip_irqs = !set;
+
+        return 0;
+}
+
 static struct trace_event_functions graph_functions = {
         .trace          = print_graph_function_event,
 };
@@ -1253,6 +1453,7 @@ static struct tracer graph_trace __read_mostly = {
         .print_line     = print_graph_function,
         .print_header   = print_graph_headers,
         .flags          = &tracer_flags,
+        .set_flag       = func_graph_set_flag,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest       = trace_selftest_startup_function_graph,
 #endif
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 73a6b0601f2e..5cf8c602b880 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -87,14 +87,22 @@ static __cacheline_aligned_in_smp	unsigned long max_sequence;
 
 #ifdef CONFIG_FUNCTION_TRACER
 /*
- * irqsoff uses its own tracer function to keep the overhead down:
+ * Prologue for the preempt and irqs off function tracers.
+ *
+ * Returns 1 if it is OK to continue, and data->disabled is
+ *            incremented.
+ *         0 if the trace is to be ignored, and data->disabled
+ *            is kept the same.
+ *
+ * Note, this function is also used outside this ifdef but
+ *  inside the #ifdef of the function graph tracer below.
+ *  This is OK, since the function graph tracer is
+ *  dependent on the function tracer.
  */
-static void
-irqsoff_tracer_call(unsigned long ip, unsigned long parent_ip)
+static int func_prolog_dec(struct trace_array *tr,
+                           struct trace_array_cpu **data,
+                           unsigned long *flags)
 {
-        struct trace_array *tr = irqsoff_trace;
-        struct trace_array_cpu *data;
-        unsigned long flags;
         long disabled;
         int cpu;
 
@@ -106,18 +114,38 @@ irqsoff_tracer_call(unsigned long ip, unsigned long parent_ip)
          */
         cpu = raw_smp_processor_id();
         if (likely(!per_cpu(tracing_cpu, cpu)))
-                return;
+                return 0;
 
-        local_save_flags(flags);
+        local_save_flags(*flags);
         /* slight chance to get a false positive on tracing_cpu */
-        if (!irqs_disabled_flags(flags))
-                return;
+        if (!irqs_disabled_flags(*flags))
+                return 0;
 
-        data = tr->data[cpu];
-        disabled = atomic_inc_return(&data->disabled);
+        *data = tr->data[cpu];
+        disabled = atomic_inc_return(&(*data)->disabled);
 
         if (likely(disabled == 1))
-                trace_function(tr, ip, parent_ip, flags, preempt_count());
+                return 1;
+
+        atomic_dec(&(*data)->disabled);
+
+        return 0;
+}
+
+/*
+ * irqsoff uses its own tracer function to keep the overhead down:
+ */
+static void
+irqsoff_tracer_call(unsigned long ip, unsigned long parent_ip)
+{
+        struct trace_array *tr = irqsoff_trace;
+        struct trace_array_cpu *data;
+        unsigned long flags;
+
+        if (!func_prolog_dec(tr, &data, &flags))
+                return;
+
+        trace_function(tr, ip, parent_ip, flags, preempt_count());
 
         atomic_dec(&data->disabled);
 }
@@ -155,30 +183,16 @@ static int irqsoff_graph_entry(struct ftrace_graph_ent *trace)
         struct trace_array *tr = irqsoff_trace;
         struct trace_array_cpu *data;
         unsigned long flags;
-        long disabled;
         int ret;
-        int cpu;
         int pc;
 
-        cpu = raw_smp_processor_id();
-        if (likely(!per_cpu(tracing_cpu, cpu)))
+        if (!func_prolog_dec(tr, &data, &flags))
                 return 0;
 
-        local_save_flags(flags);
-        /* slight chance to get a false positive on tracing_cpu */
-        if (!irqs_disabled_flags(flags))
-                return 0;
-
-        data = tr->data[cpu];
-        disabled = atomic_inc_return(&data->disabled);
-
-        if (likely(disabled == 1)) {
-                pc = preempt_count();
-                ret = __trace_graph_entry(tr, trace, flags, pc);
-        } else
-                ret = 0;
-
+        pc = preempt_count();
+        ret = __trace_graph_entry(tr, trace, flags, pc);
         atomic_dec(&data->disabled);
+
         return ret;
 }
 
@@ -187,27 +201,13 @@ static void irqsoff_graph_return(struct ftrace_graph_ret *trace)
         struct trace_array *tr = irqsoff_trace;
         struct trace_array_cpu *data;
         unsigned long flags;
-        long disabled;
-        int cpu;
         int pc;
 
-        cpu = raw_smp_processor_id();
-        if (likely(!per_cpu(tracing_cpu, cpu)))
+        if (!func_prolog_dec(tr, &data, &flags))
                 return;
 
-        local_save_flags(flags);
-        /* slight chance to get a false positive on tracing_cpu */
-        if (!irqs_disabled_flags(flags))
-                return;
-
-        data = tr->data[cpu];
-        disabled = atomic_inc_return(&data->disabled);
-
-        if (likely(disabled == 1)) {
-                pc = preempt_count();
-                __trace_graph_return(tr, trace, flags, pc);
-        }
-
+        pc = preempt_count();
+        __trace_graph_return(tr, trace, flags, pc);
         atomic_dec(&data->disabled);
 }
 
@@ -229,75 +229,33 @@ static void irqsoff_trace_close(struct trace_iterator *iter)
 
 static enum print_line_t irqsoff_print_line(struct trace_iterator *iter)
 {
-        u32 flags = GRAPH_TRACER_FLAGS;
-
-        if (trace_flags & TRACE_ITER_LATENCY_FMT)
-                flags |= TRACE_GRAPH_PRINT_DURATION;
-        else
-                flags |= TRACE_GRAPH_PRINT_ABS_TIME;
-
         /*
          * In graph mode call the graph tracer output function,
          * otherwise go with the TRACE_FN event handler
          */
         if (is_graph())
-                return print_graph_function_flags(iter, flags);
+                return print_graph_function_flags(iter, GRAPH_TRACER_FLAGS);
 
         return TRACE_TYPE_UNHANDLED;
 }
 
 static void irqsoff_print_header(struct seq_file *s)
 {
-        if (is_graph()) {
-                struct trace_iterator *iter = s->private;
-                u32 flags = GRAPH_TRACER_FLAGS;
-
-                if (trace_flags & TRACE_ITER_LATENCY_FMT) {
-                        /* print nothing if the buffers are empty */
-                        if (trace_empty(iter))
-                                return;
-
-                        print_trace_header(s, iter);
-                        flags |= TRACE_GRAPH_PRINT_DURATION;
-                } else
-                        flags |= TRACE_GRAPH_PRINT_ABS_TIME;
-
-                print_graph_headers_flags(s, flags);
-        } else
+        if (is_graph())
+                print_graph_headers_flags(s, GRAPH_TRACER_FLAGS);
+        else
                 trace_default_header(s);
 }
 
 static void
-trace_graph_function(struct trace_array *tr,
-                 unsigned long ip, unsigned long flags, int pc)
-{
-        u64 time = trace_clock_local();
-        struct ftrace_graph_ent ent = {
-                .func  = ip,
-                .depth = 0,
-        };
-        struct ftrace_graph_ret ret = {
-                .func     = ip,
-                .depth    = 0,
-                .calltime = time,
-                .rettime  = time,
-        };
-
-        __trace_graph_entry(tr, &ent, flags, pc);
-        __trace_graph_return(tr, &ret, flags, pc);
-}
-
-static void
 __trace_function(struct trace_array *tr,
                  unsigned long ip, unsigned long parent_ip,
                  unsigned long flags, int pc)
 {
-        if (!is_graph())
+        if (is_graph())
+                trace_graph_function(tr, ip, parent_ip, flags, pc);
+        else
                 trace_function(tr, ip, parent_ip, flags, pc);
-        else {
-                trace_graph_function(tr, parent_ip, flags, pc);
-                trace_graph_function(tr, ip, flags, pc);
-        }
 }
 
 #else
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index 7b8ecd751d93..3c5c5dfea0b3 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -13,7 +13,6 @@
 #include <linux/kdb.h>
 #include <linux/ftrace.h>
 
-#include "../debug/kdb/kdb_private.h"
 #include "trace.h"
 #include "trace_output.h"
 
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 8b27c9849b42..2dec9bcde8b4 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -31,7 +31,6 @@
 #include <linux/perf_event.h>
 #include <linux/stringify.h>
 #include <linux/limits.h>
-#include <linux/uaccess.h>
 #include <asm/bitsperlong.h>
 
 #include "trace.h"
@@ -514,8 +513,8 @@ static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs);
 static int kretprobe_dispatcher(struct kretprobe_instance *ri,
                                 struct pt_regs *regs);
 
-/* Check the name is good for event/group */
-static int check_event_name(const char *name)
+/* Check the name is good for event/group/fields */
+static int is_good_name(const char *name)
 {
         if (!isalpha(*name) && *name != '_')
                 return 0;
@@ -557,7 +556,7 @@ static struct trace_probe *alloc_trace_probe(const char *group,
         else
                 tp->rp.kp.pre_handler = kprobe_dispatcher;
 
-        if (!event || !check_event_name(event)) {
+        if (!event || !is_good_name(event)) {
                 ret = -EINVAL;
                 goto error;
         }
@@ -567,7 +566,7 @@ static struct trace_probe *alloc_trace_probe(const char *group,
         if (!tp->call.name)
                 goto error;
 
-        if (!group || !check_event_name(group)) {
+        if (!group || !is_good_name(group)) {
                 ret = -EINVAL;
                 goto error;
         }
@@ -648,7 +647,7 @@ static int register_trace_probe(struct trace_probe *tp)
         }
         ret = register_probe_event(tp);
         if (ret) {
-                pr_warning("Faild to register probe event(%d)\n", ret);
+                pr_warning("Failed to register probe event(%d)\n", ret);
                 goto end;
         }
 
@@ -883,7 +882,7 @@ static int create_trace_probe(int argc, char **argv)
         int i, ret = 0;
         int is_return = 0, is_delete = 0;
         char *symbol = NULL, *event = NULL, *group = NULL;
-        char *arg, *tmp;
+        char *arg;
         unsigned long offset = 0;
         void *addr = NULL;
         char buf[MAX_EVENT_NAME_LEN];
@@ -992,26 +991,36 @@ static int create_trace_probe(int argc, char **argv)
         /* parse arguments */
         ret = 0;
         for (i = 0; i < argc && i < MAX_TRACE_ARGS; i++) {
+                /* Increment count for freeing args in error case */
+                tp->nr_args++;
+
                 /* Parse argument name */
                 arg = strchr(argv[i], '=');
-                if (arg)
+                if (arg) {
                         *arg++ = '\0';
-                else
+                        tp->args[i].name = kstrdup(argv[i], GFP_KERNEL);
+                } else {
                         arg = argv[i];
+                        /* If argument name is omitted, set "argN" */
+                        snprintf(buf, MAX_EVENT_NAME_LEN, "arg%d", i + 1);
+                        tp->args[i].name = kstrdup(buf, GFP_KERNEL);
+                }
 
-                tp->args[i].name = kstrdup(argv[i], GFP_KERNEL);
                 if (!tp->args[i].name) {
-                        pr_info("Failed to allocate argument%d name '%s'.\n",
-                                i, argv[i]);
+                        pr_info("Failed to allocate argument[%d] name.\n", i);
                         ret = -ENOMEM;
                         goto error;
                 }
-                tmp = strchr(tp->args[i].name, ':');
-                if (tmp)
-                        *tmp = '_';     /* convert : to _ */
+
+                if (!is_good_name(tp->args[i].name)) {
+                        pr_info("Invalid argument[%d] name: %s\n",
+                                i, tp->args[i].name);
+                        ret = -EINVAL;
+                        goto error;
+                }
 
                 if (conflict_field_name(tp->args[i].name, tp->args, i)) {
-                        pr_info("Argument%d name '%s' conflicts with "
+                        pr_info("Argument[%d] name '%s' conflicts with "
                                 "another field.\n", i, argv[i]);
                         ret = -EINVAL;
                         goto error;
@@ -1020,12 +1029,9 @@ static int create_trace_probe(int argc, char **argv)
                 /* Parse fetch argument */
                 ret = parse_probe_arg(arg, tp, &tp->args[i], is_return);
                 if (ret) {
-                        pr_info("Parse error at argument%d. (%d)\n", i, ret);
-                        kfree(tp->args[i].name);
+                        pr_info("Parse error at argument[%d]. (%d)\n", i, ret);
                         goto error;
                 }
-
-                tp->nr_args++;
         }
 
         ret = register_trace_probe(tp);
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index 4086eae6e81b..7319559ed59f 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -31,48 +31,98 @@ static int			wakeup_rt;
 static arch_spinlock_t wakeup_lock =
         (arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;
 
+static void wakeup_reset(struct trace_array *tr);
 static void __wakeup_reset(struct trace_array *tr);
+static int wakeup_graph_entry(struct ftrace_graph_ent *trace);
+static void wakeup_graph_return(struct ftrace_graph_ret *trace);
 
 static int save_lat_flag;
 
+#define TRACE_DISPLAY_GRAPH     1
+
+static struct tracer_opt trace_opts[] = {
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* display latency trace as call graph */
+        { TRACER_OPT(display-graph, TRACE_DISPLAY_GRAPH) },
+#endif
+        { } /* Empty entry */
+};
+
+static struct tracer_flags tracer_flags = {
+        .val  = 0,
+        .opts = trace_opts,
+};
+
+#define is_graph() (tracer_flags.val & TRACE_DISPLAY_GRAPH)
+
 #ifdef CONFIG_FUNCTION_TRACER
+
 /*
- * irqsoff uses its own tracer function to keep the overhead down:
+ * Prologue for the wakeup function tracers.
+ *
+ * Returns 1 if it is OK to continue, and preemption
+ *            is disabled and data->disabled is incremented.
+ *         0 if the trace is to be ignored, and preemption
+ *            is not disabled and data->disabled is
+ *            kept the same.
+ *
+ * Note, this function is also used outside this ifdef but
+ *  inside the #ifdef of the function graph tracer below.
+ *  This is OK, since the function graph tracer is
+ *  dependent on the function tracer.
  */
-static void
-wakeup_tracer_call(unsigned long ip, unsigned long parent_ip)
+static int
+func_prolog_preempt_disable(struct trace_array *tr,
+                            struct trace_array_cpu **data,
+                            int *pc)
 {
-        struct trace_array *tr = wakeup_trace;
-        struct trace_array_cpu *data;
-        unsigned long flags;
         long disabled;
         int cpu;
-        int pc;
 
         if (likely(!wakeup_task))
-                return;
+                return 0;
 
-        pc = preempt_count();
+        *pc = preempt_count();
         preempt_disable_notrace();
 
         cpu = raw_smp_processor_id();
         if (cpu != wakeup_current_cpu)
                 goto out_enable;
 
-        data = tr->data[cpu];
-        disabled = atomic_inc_return(&data->disabled);
+        *data = tr->data[cpu];
+        disabled = atomic_inc_return(&(*data)->disabled);
         if (unlikely(disabled != 1))
                 goto out;
 
-        local_irq_save(flags);
+        return 1;
 
-        trace_function(tr, ip, parent_ip, flags, pc);
+out:
+        atomic_dec(&(*data)->disabled);
+
+out_enable:
+        preempt_enable_notrace();
+        return 0;
+}
 
+/*
+ * wakeup uses its own tracer function to keep the overhead down:
+ */
+static void
+wakeup_tracer_call(unsigned long ip, unsigned long parent_ip)
+{
+        struct trace_array *tr = wakeup_trace;
+        struct trace_array_cpu *data;
+        unsigned long flags;
+        int pc;
+
+        if (!func_prolog_preempt_disable(tr, &data, &pc))
+                return;
+
+        local_irq_save(flags);
+        trace_function(tr, ip, parent_ip, flags, pc);
         local_irq_restore(flags);
 
- out:
         atomic_dec(&data->disabled);
- out_enable:
         preempt_enable_notrace();
 }
 
@@ -82,6 +132,156 @@ static struct ftrace_ops trace_ops __read_mostly =
 };
 #endif /* CONFIG_FUNCTION_TRACER */
 
+static int start_func_tracer(int graph)
+{
+        int ret;
+
+        if (!graph)
+                ret = register_ftrace_function(&trace_ops);
+        else
+                ret = register_ftrace_graph(&wakeup_graph_return,
+                                            &wakeup_graph_entry);
+
+        if (!ret && tracing_is_enabled())
+                tracer_enabled = 1;
+        else
+                tracer_enabled = 0;
+
+        return ret;
+}
+
+static void stop_func_tracer(int graph)
+{
+        tracer_enabled = 0;
+
+        if (!graph)
+                unregister_ftrace_function(&trace_ops);
+        else
+                unregister_ftrace_graph();
+}
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+static int wakeup_set_flag(u32 old_flags, u32 bit, int set)
+{
+
+        if (!(bit & TRACE_DISPLAY_GRAPH))
+                return -EINVAL;
+
+        if (!(is_graph() ^ set))
+                return 0;
+
+        stop_func_tracer(!set);
+
+        wakeup_reset(wakeup_trace);
+        tracing_max_latency = 0;
+
+        return start_func_tracer(set);
+}
+
+static int wakeup_graph_entry(struct ftrace_graph_ent *trace)
+{
+        struct trace_array *tr = wakeup_trace;
+        struct trace_array_cpu *data;
+        unsigned long flags;
+        int pc, ret = 0;
+
+        if (!func_prolog_preempt_disable(tr, &data, &pc))
+                return 0;
+
+        local_save_flags(flags);
+        ret = __trace_graph_entry(tr, trace, flags, pc);
+        atomic_dec(&data->disabled);
+        preempt_enable_notrace();
+
+        return ret;
+}
+
+static void wakeup_graph_return(struct ftrace_graph_ret *trace)
+{
+        struct trace_array *tr = wakeup_trace;
+        struct trace_array_cpu *data;
+        unsigned long flags;
+        int pc;
+
+        if (!func_prolog_preempt_disable(tr, &data, &pc))
+                return;
+
+        local_save_flags(flags);
+        __trace_graph_return(tr, trace, flags, pc);
+        atomic_dec(&data->disabled);
+
+        preempt_enable_notrace();
+        return;
+}
+
+static void wakeup_trace_open(struct trace_iterator *iter)
+{
+        if (is_graph())
+                graph_trace_open(iter);
+}
+
+static void wakeup_trace_close(struct trace_iterator *iter)
+{
+        if (iter->private)
+                graph_trace_close(iter);
+}
+
+#define GRAPH_TRACER_FLAGS (TRACE_GRAPH_PRINT_PROC)
+
+static enum print_line_t wakeup_print_line(struct trace_iterator *iter)
+{
+        /*
+         * In graph mode call the graph tracer output function,
+         * otherwise go with the TRACE_FN event handler
+         */
+        if (is_graph())
+                return print_graph_function_flags(iter, GRAPH_TRACER_FLAGS);
+
+        return TRACE_TYPE_UNHANDLED;
+}
+
+static void wakeup_print_header(struct seq_file *s)
+{
+        if (is_graph())
+                print_graph_headers_flags(s, GRAPH_TRACER_FLAGS);
+        else
+                trace_default_header(s);
+}
+
+static void
+__trace_function(struct trace_array *tr,
+                 unsigned long ip, unsigned long parent_ip,
+                 unsigned long flags, int pc)
+{
+        if (is_graph())
+                trace_graph_function(tr, ip, parent_ip, flags, pc);
+        else
+                trace_function(tr, ip, parent_ip, flags, pc);
+}
+#else
+#define __trace_function trace_function
+
+static int wakeup_set_flag(u32 old_flags, u32 bit, int set)
+{
+        return -EINVAL;
+}
+
+static int wakeup_graph_entry(struct ftrace_graph_ent *trace)
+{
+        return -1;
+}
+
+static enum print_line_t wakeup_print_line(struct trace_iterator *iter)
+{
+        return TRACE_TYPE_UNHANDLED;
+}
+
+static void wakeup_graph_return(struct ftrace_graph_ret *trace) { }
+static void wakeup_print_header(struct seq_file *s) { }
+static void wakeup_trace_open(struct trace_iterator *iter) { }
+static void wakeup_trace_close(struct trace_iterator *iter) { }
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
 /*
  * Should this new latency be reported/recorded?
  */
@@ -152,7 +352,7 @@ probe_wakeup_sched_switch(void *ignore,
         /* The task we are waiting for is waking up */
         data = wakeup_trace->data[wakeup_cpu];
 
-        trace_function(wakeup_trace, CALLER_ADDR0, CALLER_ADDR1, flags, pc);
+        __trace_function(wakeup_trace, CALLER_ADDR0, CALLER_ADDR1, flags, pc);
         tracing_sched_switch_trace(wakeup_trace, prev, next, flags, pc);
 
         T0 = data->preempt_timestamp;
@@ -252,7 +452,7 @@ probe_wakeup(void *ignore, struct task_struct *p, int success)
          * is not called by an assembly function  (where as schedule is)
          * it should be safe to use it here.
          */
-        trace_function(wakeup_trace, CALLER_ADDR1, CALLER_ADDR2, flags, pc);
+        __trace_function(wakeup_trace, CALLER_ADDR1, CALLER_ADDR2, flags, pc);
 
 out_locked:
         arch_spin_unlock(&wakeup_lock);
@@ -303,12 +503,8 @@ static void start_wakeup_tracer(struct trace_array *tr)
          */
         smp_wmb();
 
-        register_ftrace_function(&trace_ops);
-
-        if (tracing_is_enabled())
-                tracer_enabled = 1;
-        else
-                tracer_enabled = 0;
+        if (start_func_tracer(is_graph()))
+                printk(KERN_ERR "failed to start wakeup tracer\n");
 
         return;
 fail_deprobe_wake_new:
@@ -320,7 +516,7 @@ fail_deprobe:
 static void stop_wakeup_tracer(struct trace_array *tr)
 {
         tracer_enabled = 0;
-        unregister_ftrace_function(&trace_ops);
+        stop_func_tracer(is_graph());
         unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL);
         unregister_trace_sched_wakeup_new(probe_wakeup, NULL);
         unregister_trace_sched_wakeup(probe_wakeup, NULL);
@@ -379,9 +575,15 @@ static struct tracer wakeup_tracer __read_mostly =
         .start          = wakeup_tracer_start,
         .stop           = wakeup_tracer_stop,
         .print_max      = 1,
+        .print_header   = wakeup_print_header,
+        .print_line     = wakeup_print_line,
+        .flags          = &tracer_flags,
+        .set_flag       = wakeup_set_flag,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest    = trace_selftest_startup_wakeup,
 #endif
+        .open           = wakeup_trace_open,
+        .close          = wakeup_trace_close,
         .use_max_tr     = 1,
 };
 
@@ -394,9 +596,15 @@ static struct tracer wakeup_rt_tracer __read_mostly =
         .stop           = wakeup_tracer_stop,
         .wait_pipe      = poll_wait_pipe,
         .print_max      = 1,
+        .print_header   = wakeup_print_header,
+        .print_line     = wakeup_print_line,
+        .flags          = &tracer_flags,
+        .set_flag       = wakeup_set_flag,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest    = trace_selftest_startup_wakeup,
 #endif
+        .open           = wakeup_trace_open,
+        .close          = wakeup_trace_close,
         .use_max_tr     = 1,
 };
 
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 056468eae7cf..4c5dead0c239 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -195,6 +195,7 @@ static const struct file_operations stack_max_size_fops = {
         .open           = tracing_open_generic,
         .read           = stack_max_size_read,
         .write          = stack_max_size_write,
+        .llseek         = default_llseek,
 };
 
 static void *
@@ -249,7 +250,7 @@ static int trace_lookup_stack(struct seq_file *m, long i)
 {
         unsigned long addr = stack_dump_trace[i];
 
-        return seq_printf(m, "%pF\n", (void *)addr);
+        return seq_printf(m, "%pS\n", (void *)addr);
 }
 
 static void print_disabled(struct seq_file *m)
diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
index a7cc3793baf6..209b379a4721 100644
--- a/kernel/trace/trace_workqueue.c
+++ b/kernel/trace/trace_workqueue.c
@@ -263,6 +263,11 @@ int __init trace_workqueue_early_init(void)
 {
         int ret, cpu;
 
+        for_each_possible_cpu(cpu) {
+                spin_lock_init(&workqueue_cpu_stat(cpu)->lock);
+                INIT_LIST_HEAD(&workqueue_cpu_stat(cpu)->list);
+        }
+
         ret = register_trace_workqueue_insertion(probe_workqueue_insertion, NULL);
         if (ret)
                 goto out;
@@ -279,11 +284,6 @@ int __init trace_workqueue_early_init(void)
         if (ret)
                 goto no_creation;
 
-        for_each_possible_cpu(cpu) {
-                spin_lock_init(&workqueue_cpu_stat(cpu)->lock);
-                INIT_LIST_HEAD(&workqueue_cpu_stat(cpu)->list);
-        }
-
         return 0;
 
 no_creation:
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index c77f3eceea25..e95ee7f31d43 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -25,6 +25,7 @@
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/jump_label.h>
 
 extern struct tracepoint __start___tracepoints[];
 extern struct tracepoint __stop___tracepoints[];
@@ -263,7 +264,13 @@ static void set_tracepoint(struct tracepoint_entry **entry,
          * is used.
          */
         rcu_assign_pointer(elem->funcs, (*entry)->funcs);
-        elem->state = active;
+        if (!elem->state && active) {
+                jump_label_enable(&elem->state);
+                elem->state = active;
+        } else if (elem->state && !active) {
+                jump_label_disable(&elem->state);
+                elem->state = active;
+        }
 }
 
 /*
@@ -277,7 +284,10 @@ static void disable_tracepoint(struct tracepoint *elem)
         if (elem->unregfunc && elem->state)
                 elem->unregfunc();
 
-        elem->state = 0;
+        if (elem->state) {
+                jump_label_disable(&elem->state);
+                elem->state = 0;
+        }
         rcu_assign_pointer(elem->funcs, NULL);
 }
 
diff --git a/kernel/tsacct.c b/kernel/tsacct.c
index 0a67e041edf8..24dc60d9fa1f 100644
--- a/kernel/tsacct.c
+++ b/kernel/tsacct.c
@@ -63,12 +63,10 @@ void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)
         stats->ac_ppid   = pid_alive(tsk) ?
                                 rcu_dereference(tsk->real_parent)->tgid : 0;
         rcu_read_unlock();
-        stats->ac_utime  = cputime_to_msecs(tsk->utime) * USEC_PER_MSEC;
-        stats->ac_stime  = cputime_to_msecs(tsk->stime) * USEC_PER_MSEC;
-        stats->ac_utimescaled =
-                cputime_to_msecs(tsk->utimescaled) * USEC_PER_MSEC;
-        stats->ac_stimescaled =
-                cputime_to_msecs(tsk->stimescaled) * USEC_PER_MSEC;
+        stats->ac_utime = cputime_to_usecs(tsk->utime);
+        stats->ac_stime = cputime_to_usecs(tsk->stime);
+        stats->ac_utimescaled = cputime_to_usecs(tsk->utimescaled);
+        stats->ac_stimescaled = cputime_to_usecs(tsk->stimescaled);
         stats->ac_minflt = tsk->min_flt;
         stats->ac_majflt = tsk->maj_flt;
 
diff --git a/kernel/user.c b/kernel/user.c
index 7e72614b736d..2c7d8d5914b1 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -91,6 +91,7 @@ static struct user_struct *uid_hash_find(uid_t uid, struct hlist_head *hashent)
  * upon function exit.
  */
 static void free_user(struct user_struct *up, unsigned long flags)
+        __releases(&uidhash_lock)
 {
         uid_hash_remove(up);
         spin_unlock_irqrestore(&uidhash_lock, flags);
diff --git a/kernel/wait.c b/kernel/wait.c
index c4bd3d825f35..b0310eb6cc1e 100644
--- a/kernel/wait.c
+++ b/kernel/wait.c
@@ -92,7 +92,7 @@ prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state)
 }
 EXPORT_SYMBOL(prepare_to_wait_exclusive);
 
-/*
+/**
  * finish_wait - clean up after waiting in a queue
  * @q: waitqueue waited on
  * @wait: wait descriptor
@@ -127,11 +127,11 @@ void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
 }
 EXPORT_SYMBOL(finish_wait);
 
-/*
+/**
  * abort_exclusive_wait - abort exclusive waiting in a queue
  * @q: waitqueue waited on
  * @wait: wait descriptor
- * @state: runstate of the waiter to be woken
+ * @mode: runstate of the waiter to be woken
  * @key: key to identify a wait bit queue or %NULL
  *
  * Sets current thread back to running state and removes
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 613bc1f04610..6e3c41a4024c 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -43,8 +43,7 @@ static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
 
-static int __read_mostly did_panic;
-static int __initdata no_watchdog;
+static int no_watchdog;
 
 
 /* boot commands */
@@ -122,7 +121,7 @@ static void __touch_watchdog(void)
 
 void touch_softlockup_watchdog(void)
 {
-        __get_cpu_var(watchdog_touch_ts) = 0;
+        __raw_get_cpu_var(watchdog_touch_ts) = 0;
 }
 EXPORT_SYMBOL(touch_softlockup_watchdog);
 
@@ -142,7 +141,14 @@ void touch_all_softlockup_watchdogs(void)
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 void touch_nmi_watchdog(void)
 {
-        __get_cpu_var(watchdog_nmi_touch) = true;
+        if (watchdog_enabled) {
+                unsigned cpu;
+
+                for_each_present_cpu(cpu) {
+                        if (per_cpu(watchdog_nmi_touch, cpu) != true)
+                                per_cpu(watchdog_nmi_touch, cpu) = true;
+                }
+        }
         touch_softlockup_watchdog();
 }
 EXPORT_SYMBOL(touch_nmi_watchdog);
@@ -180,18 +186,6 @@ static int is_softlockup(unsigned long touch_ts)
         return 0;
 }
 
-static int
-watchdog_panic(struct notifier_block *this, unsigned long event, void *ptr)
-{
-        did_panic = 1;
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block panic_block = {
-        .notifier_call = watchdog_panic,
-};
-
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 static struct perf_event_attr wd_hw_attr = {
         .type           = PERF_TYPE_HARDWARE,
@@ -202,10 +196,13 @@ static struct perf_event_attr wd_hw_attr = {
 };
 
 /* Callback function for perf event subsystem */
-void watchdog_overflow_callback(struct perf_event *event, int nmi,
+static void watchdog_overflow_callback(struct perf_event *event, int nmi,
                  struct perf_sample_data *data,
                  struct pt_regs *regs)
 {
+        /* Ensure the watchdog never gets throttled */
+        event->hw.interrupts = 0;
+
         if (__get_cpu_var(watchdog_nmi_touch) == true) {
                 __get_cpu_var(watchdog_nmi_touch) = false;
                 return;
@@ -361,14 +358,14 @@ static int watchdog_nmi_enable(int cpu)
         /* Try to register using hardware perf events */
         wd_attr = &wd_hw_attr;
         wd_attr->sample_period = hw_nmi_get_sample_period();
-        event = perf_event_create_kernel_counter(wd_attr, cpu, -1, watchdog_overflow_callback);
+        event = perf_event_create_kernel_counter(wd_attr, cpu, NULL, watchdog_overflow_callback);
         if (!IS_ERR(event)) {
                 printk(KERN_INFO "NMI watchdog enabled, takes one hw-pmu counter.\n");
                 goto out_save;
         }
 
         printk(KERN_ERR "NMI watchdog failed to create perf event on cpu%i: %p\n", cpu, event);
-        return -1;
+        return PTR_ERR(event);
 
         /* success path */
 out_save:
@@ -412,17 +409,19 @@ static int watchdog_prepare_cpu(int cpu)
 static int watchdog_enable(int cpu)
 {
         struct task_struct *p = per_cpu(softlockup_watchdog, cpu);
+        int err;
 
         /* enable the perf event */
-        if (watchdog_nmi_enable(cpu) != 0)
-                return -1;
+        err = watchdog_nmi_enable(cpu);
+        if (err)
+                return err;
 
         /* create the watchdog thread */
         if (!p) {
                 p = kthread_create(watchdog, (void *)(unsigned long)cpu, "watchdog/%d", cpu);
                 if (IS_ERR(p)) {
                         printk(KERN_ERR "softlockup watchdog for %i failed\n", cpu);
-                        return -1;
+                        return PTR_ERR(p);
                 }
                 kthread_bind(p, cpu);
                 per_cpu(watchdog_touch_ts, cpu) = 0;
@@ -430,6 +429,9 @@ static int watchdog_enable(int cpu)
                 wake_up_process(p);
         }
 
+        /* if any cpu succeeds, watchdog is considered enabled for the system */
+        watchdog_enabled = 1;
+
         return 0;
 }
 
@@ -452,9 +454,6 @@ static void watchdog_disable(int cpu)
                 per_cpu(softlockup_watchdog, cpu) = NULL;
                 kthread_stop(p);
         }
-
-        /* if any cpu succeeds, watchdog is considered enabled for the system */
-        watchdog_enabled = 1;
 }
 
 static void watchdog_enable_all_cpus(void)
@@ -474,6 +473,9 @@ static void watchdog_disable_all_cpus(void)
 {
         int cpu;
 
+        if (no_watchdog)
+                return;
+
         for_each_online_cpu(cpu)
                 watchdog_disable(cpu);
 
@@ -516,17 +518,16 @@ static int __cpuinit
 cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
         int hotcpu = (unsigned long)hcpu;
+        int err = 0;
 
         switch (action) {
         case CPU_UP_PREPARE:
         case CPU_UP_PREPARE_FROZEN:
-                if (watchdog_prepare_cpu(hotcpu))
-                        return NOTIFY_BAD;
+                err = watchdog_prepare_cpu(hotcpu);
                 break;
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
-                if (watchdog_enable(hotcpu))
-                        return NOTIFY_BAD;
+                err = watchdog_enable(hotcpu);
                 break;
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_UP_CANCELED:
@@ -539,7 +540,7 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 break;
 #endif /* CONFIG_HOTPLUG_CPU */
         }
-        return NOTIFY_OK;
+        return notifier_from_errno(err);
 }
 
 static struct notifier_block __cpuinitdata cpu_nfb = {
@@ -555,13 +556,11 @@ static int __init spawn_watchdog_task(void)
                 return 0;
 
         err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
-        WARN_ON(err == NOTIFY_BAD);
+        WARN_ON(notifier_to_errno(err));
 
         cpu_callback(&cpu_nfb, CPU_ONLINE, cpu);
         register_cpu_notifier(&cpu_nfb);
 
-        atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
-
         return 0;
 }
 early_initcall(spawn_watchdog_task);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 2994a0e3a61c..e785b0f2aea5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1,19 +1,26 @@
 /*
- * linux/kernel/workqueue.c
+ * kernel/workqueue.c - generic async execution with shared worker pool
  *
- * Generic mechanism for defining kernel helper threads for running
- * arbitrary tasks in process context.
+ * Copyright (C) 2002           Ingo Molnar
  *
- * Started by Ingo Molnar, Copyright (C) 2002
+ *   Derived from the taskqueue/keventd code by:
+ *     David Woodhouse <dwmw2@infradead.org>
+ *     Andrew Morton
+ *     Kai Petzke <wpp@marie.physik.tu-berlin.de>
+ *     Theodore Ts'o <tytso@mit.edu>
  *
- * Derived from the taskqueue/keventd code by:
+ * Made to use alloc_percpu by Christoph Lameter.
  *
- *   David Woodhouse <dwmw2@infradead.org>
- *   Andrew Morton
- *   Kai Petzke <wpp@marie.physik.tu-berlin.de>
- *   Theodore Ts'o <tytso@mit.edu>
+ * Copyright (C) 2010           SUSE Linux Products GmbH
+ * Copyright (C) 2010           Tejun Heo <tj@kernel.org>
  *
- * Made to use alloc_percpu by Christoph Lameter.
+ * This is the generic async execution mechanism.  Work items as are
+ * executed in process context.  The worker pool is shared and
+ * automatically managed.  There is one worker pool for each CPU and
+ * one extra for works which are better served by workers which are
+ * not bound to any specific CPU.
+ *
+ * Please read Documentation/workqueue.txt for details.
  */
 
 #include <linux/module.h>
@@ -87,7 +94,8 @@ enum {
 /*
  * Structure fields follow one of the following exclusion rules.
  *
- * I: Set during initialization and read-only afterwards.
+ * I: Modifiable by initialization/destruction paths and read-only for
+ *    everyone else.
  *
  * P: Preemption protected.  Disabling preemption is enough and should
  *    only be modified and accessed from the local cpu.
@@ -195,7 +203,7 @@ typedef cpumask_var_t mayday_mask_t;
         cpumask_test_and_set_cpu((cpu), (mask))
 #define mayday_clear_cpu(cpu, mask)             cpumask_clear_cpu((cpu), (mask))
 #define for_each_mayday_cpu(cpu, mask)          for_each_cpu((cpu), (mask))
-#define alloc_mayday_mask(maskp, gfp)           alloc_cpumask_var((maskp), (gfp))
+#define alloc_mayday_mask(maskp, gfp)           zalloc_cpumask_var((maskp), (gfp))
 #define free_mayday_mask(mask)                  free_cpumask_var((mask))
 #else
 typedef unsigned long mayday_mask_t;
@@ -246,6 +254,9 @@ EXPORT_SYMBOL_GPL(system_long_wq);
 EXPORT_SYMBOL_GPL(system_nrt_wq);
 EXPORT_SYMBOL_GPL(system_unbound_wq);
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/workqueue.h>
+
 #define for_each_busy_worker(worker, i, pos, gcwq)                      \
         for (i = 0; i < BUSY_WORKER_HASH_SIZE; i++)                     \
                 hlist_for_each_entry(worker, pos, &gcwq->busy_hash[i], hentry)
@@ -299,21 +310,6 @@ static inline int __next_wq_cpu(int cpu, const struct cpumask *mask,
              (cpu) < WORK_CPU_NONE;                                     \
              (cpu) = __next_wq_cpu((cpu), cpu_possible_mask, (wq)))
 
-#ifdef CONFIG_LOCKDEP
-/**
- * in_workqueue_context() - in context of specified workqueue?
- * @wq: the workqueue of interest
- *
- * Checks lockdep state to see if the current task is executing from
- * within a workqueue item.  This function exists only if lockdep is
- * enabled.
- */
-int in_workqueue_context(struct workqueue_struct *wq)
-{
-        return lock_is_held(&wq->lockdep_map);
-}
-#endif
-
 #ifdef CONFIG_DEBUG_OBJECTS_WORK
 
 static struct debug_obj_descr work_debug_descr;
@@ -593,7 +589,9 @@ static bool keep_working(struct global_cwq *gcwq)
 {
         atomic_t *nr_running = get_gcwq_nr_running(gcwq->cpu);
 
-        return !list_empty(&gcwq->worklist) && atomic_read(nr_running) <= 1;
+        return !list_empty(&gcwq->worklist) &&
+                (atomic_read(nr_running) <= 1 ||
+                 gcwq->flags & GCWQ_HIGHPRI_PENDING);
 }
 
 /* Do we need a new worker?  Called from manager. */
@@ -663,7 +661,7 @@ void wq_worker_waking_up(struct task_struct *task, unsigned int cpu)
 {
         struct worker *worker = kthread_data(task);
 
-        if (likely(!(worker->flags & WORKER_NOT_RUNNING)))
+        if (!(worker->flags & WORKER_NOT_RUNNING))
                 atomic_inc(get_gcwq_nr_running(cpu));
 }
 
@@ -689,7 +687,7 @@ struct task_struct *wq_worker_sleeping(struct task_struct *task,
         struct global_cwq *gcwq = get_gcwq(cpu);
         atomic_t *nr_running = get_gcwq_nr_running(cpu);
 
-        if (unlikely(worker->flags & WORKER_NOT_RUNNING))
+        if (worker->flags & WORKER_NOT_RUNNING)
                 return NULL;
 
         /* this can only happen on the local cpu */
@@ -940,10 +938,14 @@ static void __queue_work(unsigned int cpu, struct workqueue_struct *wq,
         struct global_cwq *gcwq;
         struct cpu_workqueue_struct *cwq;
         struct list_head *worklist;
+        unsigned int work_flags;
         unsigned long flags;
 
         debug_work_activate(work);
 
+        if (WARN_ON_ONCE(wq->flags & WQ_DYING))
+                return;
+
         /* determine gcwq to use */
         if (!(wq->flags & WQ_UNBOUND)) {
                 struct global_cwq *last_gcwq;
@@ -982,18 +984,23 @@ static void __queue_work(unsigned int cpu, struct workqueue_struct *wq,
 
         /* gcwq determined, get cwq and queue */
         cwq = get_cwq(gcwq->cpu, wq);
+        trace_workqueue_queue_work(cpu, cwq, work);
 
         BUG_ON(!list_empty(&work->entry));
 
         cwq->nr_in_flight[cwq->work_color]++;
+        work_flags = work_color_to_flags(cwq->work_color);
 
         if (likely(cwq->nr_active < cwq->max_active)) {
+                trace_workqueue_activate_work(work);
                 cwq->nr_active++;
                 worklist = gcwq_determine_ins_pos(gcwq, cwq);
-        } else
+        } else {
+                work_flags |= WORK_STRUCT_DELAYED;
                 worklist = &cwq->delayed_works;
+        }
 
-        insert_work(cwq, work, worklist, work_color_to_flags(cwq->work_color));
+        insert_work(cwq, work, worklist, work_flags);
 
         spin_unlock_irqrestore(&gcwq->lock, flags);
 }
@@ -1212,6 +1219,7 @@ static void worker_leave_idle(struct worker *worker)
  * bound), %false if offline.
  */
 static bool worker_maybe_bind_and_lock(struct worker *worker)
+__acquires(&gcwq->lock)
 {
         struct global_cwq *gcwq = worker->gcwq;
         struct task_struct *task = worker->task;
@@ -1485,6 +1493,8 @@ static void gcwq_mayday_timeout(unsigned long __gcwq)
  * otherwise.
  */
 static bool maybe_create_worker(struct global_cwq *gcwq)
+__releases(&gcwq->lock)
+__acquires(&gcwq->lock)
 {
         if (!need_to_create_worker(gcwq))
                 return false;
@@ -1658,7 +1668,9 @@ static void cwq_activate_first_delayed(struct cpu_workqueue_struct *cwq)
                                                     struct work_struct, entry);
         struct list_head *pos = gcwq_determine_ins_pos(cwq->gcwq, cwq);
 
+        trace_workqueue_activate_work(work);
         move_linked_works(work, pos, NULL);
+        __clear_bit(WORK_STRUCT_DELAYED_BIT, work_data_bits(work));
         cwq->nr_active++;
 }
 
@@ -1666,6 +1678,7 @@ static void cwq_activate_first_delayed(struct cpu_workqueue_struct *cwq)
  * cwq_dec_nr_in_flight - decrement cwq's nr_in_flight
  * @cwq: cwq of interest
  * @color: color of work which left the queue
+ * @delayed: for a delayed work
  *
  * A work either has completed or is removed from pending queue,
  * decrement nr_in_flight of its cwq and handle workqueue flushing.
@@ -1673,19 +1686,22 @@ static void cwq_activate_first_delayed(struct cpu_workqueue_struct *cwq)
  * CONTEXT:
  * spin_lock_irq(gcwq->lock).
  */
-static void cwq_dec_nr_in_flight(struct cpu_workqueue_struct *cwq, int color)
+static void cwq_dec_nr_in_flight(struct cpu_workqueue_struct *cwq, int color,
+                                 bool delayed)
 {
         /* ignore uncolored works */
         if (color == WORK_NO_COLOR)
                 return;
 
         cwq->nr_in_flight[color]--;
-        cwq->nr_active--;
 
-        if (!list_empty(&cwq->delayed_works)) {
-                /* one down, submit a delayed one */
-                if (cwq->nr_active < cwq->max_active)
-                        cwq_activate_first_delayed(cwq);
+        if (!delayed) {
+                cwq->nr_active--;
+                if (!list_empty(&cwq->delayed_works)) {
+                        /* one down, submit a delayed one */
+                        if (cwq->nr_active < cwq->max_active)
+                                cwq_activate_first_delayed(cwq);
+                }
         }
 
         /* is flush in progress and are we at the flushing tip? */
@@ -1722,6 +1738,8 @@ static void cwq_dec_nr_in_flight(struct cpu_workqueue_struct *cwq, int color)
  * spin_lock_irq(gcwq->lock) which is released and regrabbed.
  */
 static void process_one_work(struct worker *worker, struct work_struct *work)
+__releases(&gcwq->lock)
+__acquires(&gcwq->lock)
 {
         struct cpu_workqueue_struct *cwq = get_work_cwq(work);
         struct global_cwq *gcwq = cwq->gcwq;
@@ -1790,7 +1808,13 @@ static void process_one_work(struct worker *worker, struct work_struct *work)
         work_clear_pending(work);
         lock_map_acquire(&cwq->wq->lockdep_map);
         lock_map_acquire(&lockdep_map);
+        trace_workqueue_execute_start(work);
         f(work);
+        /*
+         * While we must be careful to not use "work" after this, the trace
+         * point will only record its address.
+         */
+        trace_workqueue_execute_end(work);
         lock_map_release(&lockdep_map);
         lock_map_release(&cwq->wq->lockdep_map);
 
@@ -1814,7 +1838,7 @@ static void process_one_work(struct worker *worker, struct work_struct *work)
         hlist_del_init(&worker->hentry);
         worker->current_work = NULL;
         worker->current_cwq = NULL;
-        cwq_dec_nr_in_flight(cwq, work_color);
+        cwq_dec_nr_in_flight(cwq, work_color, false);
 }
 
 /**
@@ -2040,7 +2064,7 @@ static void insert_wq_barrier(struct cpu_workqueue_struct *cwq,
          * checks and call back into the fixup functions where we
          * might deadlock.
          */
-        INIT_WORK_ON_STACK(&barr->work, wq_barrier_func);
+        INIT_WORK_ONSTACK(&barr->work, wq_barrier_func);
         __set_bit(WORK_STRUCT_PENDING_BIT, work_data_bits(&barr->work));
         init_completion(&barr->done);
 
@@ -2292,27 +2316,17 @@ out_unlock:
 }
 EXPORT_SYMBOL_GPL(flush_workqueue);
 
-/**
- * flush_work - block until a work_struct's callback has terminated
- * @work: the work which is to be flushed
- *
- * Returns false if @work has already terminated.
- *
- * It is expected that, prior to calling flush_work(), the caller has
- * arranged for the work to not be requeued, otherwise it doesn't make
- * sense to use this function.
- */
-int flush_work(struct work_struct *work)
+static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr,
+                             bool wait_executing)
 {
         struct worker *worker = NULL;
         struct global_cwq *gcwq;
         struct cpu_workqueue_struct *cwq;
-        struct wq_barrier barr;
 
         might_sleep();
         gcwq = get_work_gcwq(work);
         if (!gcwq)
-                return 0;
+                return false;
 
         spin_lock_irq(&gcwq->lock);
         if (!list_empty(&work->entry)) {
@@ -2325,28 +2339,127 @@ int flush_work(struct work_struct *work)
                 cwq = get_work_cwq(work);
                 if (unlikely(!cwq || gcwq != cwq->gcwq))
                         goto already_gone;
-        } else {
+        } else if (wait_executing) {
                 worker = find_worker_executing_work(gcwq, work);
                 if (!worker)
                         goto already_gone;
                 cwq = worker->current_cwq;
-        }
+        } else
+                goto already_gone;
 
-        insert_wq_barrier(cwq, &barr, work, worker);
+        insert_wq_barrier(cwq, barr, work, worker);
         spin_unlock_irq(&gcwq->lock);
 
         lock_map_acquire(&cwq->wq->lockdep_map);
         lock_map_release(&cwq->wq->lockdep_map);
-
-        wait_for_completion(&barr.done);
-        destroy_work_on_stack(&barr.work);
-        return 1;
+        return true;
 already_gone:
         spin_unlock_irq(&gcwq->lock);
-        return 0;
+        return false;
+}
+
+/**
+ * flush_work - wait for a work to finish executing the last queueing instance
+ * @work: the work to flush
+ *
+ * Wait until @work has finished execution.  This function considers
+ * only the last queueing instance of @work.  If @work has been
+ * enqueued across different CPUs on a non-reentrant workqueue or on
+ * multiple workqueues, @work might still be executing on return on
+ * some of the CPUs from earlier queueing.
+ *
+ * If @work was queued only on a non-reentrant, ordered or unbound
+ * workqueue, @work is guaranteed to be idle on return if it hasn't
+ * been requeued since flush started.
+ *
+ * RETURNS:
+ * %true if flush_work() waited for the work to finish execution,
+ * %false if it was already idle.
+ */
+bool flush_work(struct work_struct *work)
+{
+        struct wq_barrier barr;
+
+        if (start_flush_work(work, &barr, true)) {
+                wait_for_completion(&barr.done);
+                destroy_work_on_stack(&barr.work);
+                return true;
+        } else
+                return false;
 }
 EXPORT_SYMBOL_GPL(flush_work);
 
+static bool wait_on_cpu_work(struct global_cwq *gcwq, struct work_struct *work)
+{
+        struct wq_barrier barr;
+        struct worker *worker;
+
+        spin_lock_irq(&gcwq->lock);
+
+        worker = find_worker_executing_work(gcwq, work);
+        if (unlikely(worker))
+                insert_wq_barrier(worker->current_cwq, &barr, work, worker);
+
+        spin_unlock_irq(&gcwq->lock);
+
+        if (unlikely(worker)) {
+                wait_for_completion(&barr.done);
+                destroy_work_on_stack(&barr.work);
+                return true;
+        } else
+                return false;
+}
+
+static bool wait_on_work(struct work_struct *work)
+{
+        bool ret = false;
+        int cpu;
+
+        might_sleep();
+
+        lock_map_acquire(&work->lockdep_map);
+        lock_map_release(&work->lockdep_map);
+
+        for_each_gcwq_cpu(cpu)
+                ret |= wait_on_cpu_work(get_gcwq(cpu), work);
+        return ret;
+}
+
+/**
+ * flush_work_sync - wait until a work has finished execution
+ * @work: the work to flush
+ *
+ * Wait until @work has finished execution.  On return, it's
+ * guaranteed that all queueing instances of @work which happened
+ * before this function is called are finished.  In other words, if
+ * @work hasn't been requeued since this function was called, @work is
+ * guaranteed to be idle on return.
+ *
+ * RETURNS:
+ * %true if flush_work_sync() waited for the work to finish execution,
+ * %false if it was already idle.
+ */
+bool flush_work_sync(struct work_struct *work)
+{
+        struct wq_barrier barr;
+        bool pending, waited;
+
+        /* we'll wait for executions separately, queue barr only if pending */
+        pending = start_flush_work(work, &barr, false);
+
+        /* wait for executions to finish */
+        waited = wait_on_work(work);
+
+        /* wait for the pending one */
+        if (pending) {
+                wait_for_completion(&barr.done);
+                destroy_work_on_stack(&barr.work);
+        }
+
+        return pending || waited;
+}
+EXPORT_SYMBOL_GPL(flush_work_sync);
+
 /*
  * Upon a successful return (>= 0), the caller "owns" WORK_STRUCT_PENDING bit,
  * so this work can't be re-armed in any way.
@@ -2379,7 +2492,8 @@ static int try_to_grab_pending(struct work_struct *work)
                         debug_work_deactivate(work);
                         list_del_init(&work->entry);
                         cwq_dec_nr_in_flight(get_work_cwq(work),
-                                             get_work_color(work));
+                                get_work_color(work),
+                                *work_data_bits(work) & WORK_STRUCT_DELAYED);
                         ret = 1;
                 }
         }
@@ -2388,39 +2502,7 @@ static int try_to_grab_pending(struct work_struct *work)
         return ret;
 }
 
-static void wait_on_cpu_work(struct global_cwq *gcwq, struct work_struct *work)
-{
-        struct wq_barrier barr;
-        struct worker *worker;
-
-        spin_lock_irq(&gcwq->lock);
-
-        worker = find_worker_executing_work(gcwq, work);
-        if (unlikely(worker))
-                insert_wq_barrier(worker->current_cwq, &barr, work, worker);
-
-        spin_unlock_irq(&gcwq->lock);
-
-        if (unlikely(worker)) {
-                wait_for_completion(&barr.done);
-                destroy_work_on_stack(&barr.work);
-        }
-}
-
-static void wait_on_work(struct work_struct *work)
-{
-        int cpu;
-
-        might_sleep();
-
-        lock_map_acquire(&work->lockdep_map);
-        lock_map_release(&work->lockdep_map);
-
-        for_each_gcwq_cpu(cpu)
-                wait_on_cpu_work(get_gcwq(cpu), work);
-}
-
-static int __cancel_work_timer(struct work_struct *work,
+static bool __cancel_work_timer(struct work_struct *work,
                                 struct timer_list* timer)
 {
         int ret;
@@ -2437,42 +2519,81 @@ static int __cancel_work_timer(struct work_struct *work,
 }
 
 /**
- * cancel_work_sync - block until a work_struct's callback has terminated
- * @work: the work which is to be flushed
- *
- * Returns true if @work was pending.
- *
- * cancel_work_sync() will cancel the work if it is queued. If the work's
- * callback appears to be running, cancel_work_sync() will block until it
- * has completed.
+ * cancel_work_sync - cancel a work and wait for it to finish
+ * @work: the work to cancel
  *
- * It is possible to use this function if the work re-queues itself. It can
- * cancel the work even if it migrates to another workqueue, however in that
- * case it only guarantees that work->func() has completed on the last queued
- * workqueue.
+ * Cancel @work and wait for its execution to finish.  This function
+ * can be used even if the work re-queues itself or migrates to
+ * another workqueue.  On return from this function, @work is
+ * guaranteed to be not pending or executing on any CPU.
  *
- * cancel_work_sync(&delayed_work->work) should be used only if ->timer is not
- * pending, otherwise it goes into a busy-wait loop until the timer expires.
+ * cancel_work_sync(&delayed_work->work) must not be used for
+ * delayed_work's.  Use cancel_delayed_work_sync() instead.
  *
- * The caller must ensure that workqueue_struct on which this work was last
+ * The caller must ensure that the workqueue on which @work was last
  * queued can't be destroyed before this function returns.
+ *
+ * RETURNS:
+ * %true if @work was pending, %false otherwise.
  */
-int cancel_work_sync(struct work_struct *work)
+bool cancel_work_sync(struct work_struct *work)
 {
         return __cancel_work_timer(work, NULL);
 }
 EXPORT_SYMBOL_GPL(cancel_work_sync);
 
 /**
- * cancel_delayed_work_sync - reliably kill off a delayed work.
- * @dwork: the delayed work struct
+ * flush_delayed_work - wait for a dwork to finish executing the last queueing
+ * @dwork: the delayed work to flush
  *
- * Returns true if @dwork was pending.
+ * Delayed timer is cancelled and the pending work is queued for
+ * immediate execution.  Like flush_work(), this function only
+ * considers the last queueing instance of @dwork.
  *
- * It is possible to use this function if @dwork rearms itself via queue_work()
- * or queue_delayed_work(). See also the comment for cancel_work_sync().
+ * RETURNS:
+ * %true if flush_work() waited for the work to finish execution,
+ * %false if it was already idle.
  */
-int cancel_delayed_work_sync(struct delayed_work *dwork)
+bool flush_delayed_work(struct delayed_work *dwork)
+{
+        if (del_timer_sync(&dwork->timer))
+                __queue_work(raw_smp_processor_id(),
+                             get_work_cwq(&dwork->work)->wq, &dwork->work);
+        return flush_work(&dwork->work);
+}
+EXPORT_SYMBOL(flush_delayed_work);
+
+/**
+ * flush_delayed_work_sync - wait for a dwork to finish
+ * @dwork: the delayed work to flush
+ *
+ * Delayed timer is cancelled and the pending work is queued for
+ * execution immediately.  Other than timer handling, its behavior
+ * is identical to flush_work_sync().
+ *
+ * RETURNS:
+ * %true if flush_work_sync() waited for the work to finish execution,
+ * %false if it was already idle.
+ */
+bool flush_delayed_work_sync(struct delayed_work *dwork)
+{
+        if (del_timer_sync(&dwork->timer))
+                __queue_work(raw_smp_processor_id(),
+                             get_work_cwq(&dwork->work)->wq, &dwork->work);
+        return flush_work_sync(&dwork->work);
+}
+EXPORT_SYMBOL(flush_delayed_work_sync);
+
+/**
+ * cancel_delayed_work_sync - cancel a delayed work and wait for it to finish
+ * @dwork: the delayed work cancel
+ *
+ * This is cancel_work_sync() for delayed works.
+ *
+ * RETURNS:
+ * %true if @dwork was pending, %false otherwise.
+ */
+bool cancel_delayed_work_sync(struct delayed_work *dwork)
 {
         return __cancel_work_timer(&dwork->work, &dwork->timer);
 }
@@ -2524,23 +2645,6 @@ int schedule_delayed_work(struct delayed_work *dwork,
 EXPORT_SYMBOL(schedule_delayed_work);
 
 /**
- * flush_delayed_work - block until a dwork_struct's callback has terminated
- * @dwork: the delayed work which is to be flushed
- *
- * Any timeout is cancelled, and any pending work is run immediately.
- */
-void flush_delayed_work(struct delayed_work *dwork)
-{
-        if (del_timer_sync(&dwork->timer)) {
-                __queue_work(get_cpu(), get_work_cwq(&dwork->work)->wq,
-                             &dwork->work);
-                put_cpu();
-        }
-        flush_work(&dwork->work);
-}
-EXPORT_SYMBOL(flush_delayed_work);
-
-/**
  * schedule_delayed_work_on - queue work in global workqueue on CPU after delay
  * @cpu: cpu to use
  * @dwork: job to be done
@@ -2557,13 +2661,15 @@ int schedule_delayed_work_on(int cpu,
 EXPORT_SYMBOL(schedule_delayed_work_on);
 
 /**
- * schedule_on_each_cpu - call a function on each online CPU from keventd
+ * schedule_on_each_cpu - execute a function synchronously on each online CPU
  * @func: the function to call
  *
- * Returns zero on success.
- * Returns -ve errno on failure.
- *
+ * schedule_on_each_cpu() executes @func on each online CPU using the
+ * system workqueue and blocks until all CPUs have completed.
  * schedule_on_each_cpu() is very slow.
+ *
+ * RETURNS:
+ * 0 on success, -errno on failure.
  */
 int schedule_on_each_cpu(work_func_t func)
 {
@@ -2685,7 +2791,9 @@ static int alloc_cwqs(struct workqueue_struct *wq)
                 }
         }
 
-        /* just in case, make sure it's actually aligned */
+        /* just in case, make sure it's actually aligned
+         * - this is affected by PERCPU() alignment in vmlinux.lds.S
+         */
         BUG_ON(!IS_ALIGNED(wq->cpu_wq.v, align));
         return wq->cpu_wq.v ? 0 : -ENOMEM;
 }
@@ -2729,6 +2837,13 @@ struct workqueue_struct *__alloc_workqueue_key(const char *name,
         unsigned int cpu;
 
         /*
+         * Workqueues which may be used during memory reclaim should
+         * have a rescuer to guarantee forward progress.
+         */
+        if (flags & WQ_MEM_RECLAIM)
+                flags |= WQ_RESCUER;
+
+        /*
          * Unbound workqueues aren't concurrency managed and should be
          * dispatched to workers immediately.
          */
@@ -2782,7 +2897,6 @@ struct workqueue_struct *__alloc_workqueue_key(const char *name,
                 if (IS_ERR(rescuer->task))
                         goto err;
 
-                wq->rescuer = rescuer;
                 rescuer->task->flags |= PF_THREAD_BOUND;
                 wake_up_process(rescuer->task);
         }
@@ -2824,6 +2938,7 @@ void destroy_workqueue(struct workqueue_struct *wq)
 {
         unsigned int cpu;
 
+        wq->flags |= WQ_DYING;
         flush_workqueue(wq);
 
         /*
@@ -2848,6 +2963,7 @@ void destroy_workqueue(struct workqueue_struct *wq)
         if (wq->flags & WQ_RESCUER) {
                 kthread_stop(wq->rescuer->task);
                 free_mayday_mask(wq->mayday_mask);
+                kfree(wq->rescuer);
         }
 
         free_cwqs(wq);
@@ -3230,6 +3346,8 @@ static int __cpuinit trustee_thread(void *__gcwq)
  * multiple times.  To be used by cpu_callback.
  */
 static void __cpuinit wait_trustee_state(struct global_cwq *gcwq, int state)
+__releases(&gcwq->lock)
+__acquires(&gcwq->lock)
 {
         if (!(gcwq->trustee_state == state ||
               gcwq->trustee_state == TRUSTEE_DONE)) {
@@ -3536,8 +3654,7 @@ static int __init init_workqueues(void)
                 spin_lock_init(&gcwq->lock);
                 INIT_LIST_HEAD(&gcwq->worklist);
                 gcwq->cpu = cpu;
-                if (cpu == WORK_CPU_UNBOUND)
-                        gcwq->flags |= GCWQ_DISASSOCIATED;
+                gcwq->flags |= GCWQ_DISASSOCIATED;
 
                 INIT_LIST_HEAD(&gcwq->idle_list);
                 for (i = 0; i < BUSY_WORKER_HASH_SIZE; i++)
@@ -3561,6 +3678,8 @@ static int __init init_workqueues(void)
                 struct global_cwq *gcwq = get_gcwq(cpu);
                 struct worker *worker;
 
+                if (cpu != WORK_CPU_UNBOUND)
+                        gcwq->flags &= ~GCWQ_DISASSOCIATED;
                 worker = create_worker(gcwq, true);
                 BUG_ON(!worker);
                 spin_lock_irq(&gcwq->lock);
@@ -3573,7 +3692,8 @@ static int __init init_workqueues(void)
         system_nrt_wq = alloc_workqueue("events_nrt", WQ_NON_REENTRANT, 0);
         system_unbound_wq = alloc_workqueue("events_unbound", WQ_UNBOUND,
                                             WQ_UNBOUND_MAX_ACTIVE);
-        BUG_ON(!system_wq || !system_long_wq || !system_nrt_wq);
+        BUG_ON(!system_wq || !system_long_wq || !system_nrt_wq ||
+               !system_unbound_wq);
         return 0;
 }
 early_initcall(init_workqueues);