Merge branch 'sched/urgent' into sched/core, to avoid conflicts

Signed-off-by: Ingo Molnar <mingo@kernel.org>

77 files changed, 3318 insertions, 3585 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 95a20f3f52f1..7c2893602d06 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -182,7 +182,7 @@ struct audit_buffer {
 
 struct audit_reply {
         __u32 portid;
-        struct net *net;        
+        struct net *net;
         struct sk_buff *skb;
 };
 
@@ -396,7 +396,7 @@ static void audit_printk_skb(struct sk_buff *skb)
                 if (printk_ratelimit())
                         pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
                 else
-                        audit_log_lost("printk limit exceeded\n");
+                        audit_log_lost("printk limit exceeded");
         }
 
         audit_hold_skb(skb);
@@ -412,7 +412,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
                 BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
                 if (audit_pid) {
                         pr_err("*NO* daemon at audit_pid=%d\n", audit_pid);
-                        audit_log_lost("auditd disappeared\n");
+                        audit_log_lost("auditd disappeared");
                         audit_pid = 0;
                         audit_sock = NULL;
                 }
@@ -607,7 +607,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
 {
         int err = 0;
 
-        /* Only support the initial namespaces for now. */
+        /* Only support initial user namespace for now. */
         /*
          * We return ECONNREFUSED because it tricks userspace into thinking
          * that audit was not configured into the kernel.  Lots of users
@@ -618,8 +618,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
          * userspace will reject all logins.  This should be removed when we
          * support non init namespaces!!
          */
-        if ((current_user_ns() != &init_user_ns) ||
-            (task_active_pid_ns(current) != &init_pid_ns))
+        if (current_user_ns() != &init_user_ns)
                 return -ECONNREFUSED;
 
         switch (msg_type) {
@@ -639,6 +638,11 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
         case AUDIT_TTY_SET:
         case AUDIT_TRIM:
         case AUDIT_MAKE_EQUIV:
+                /* Only support auditd and auditctl in initial pid namespace
+                 * for now. */
+                if ((task_active_pid_ns(current) != &init_pid_ns))
+                        return -EPERM;
+
                 if (!capable(CAP_AUDIT_CONTROL))
                         err = -EPERM;
                 break;
@@ -659,6 +663,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
 {
         int rc = 0;
         uid_t uid = from_kuid(&init_user_ns, current_uid());
+        pid_t pid = task_tgid_nr(current);
 
         if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
                 *ab = NULL;
@@ -668,7 +673,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
         *ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
         if (unlikely(!*ab))
                 return rc;
-        audit_log_format(*ab, "pid=%d uid=%u", task_tgid_vnr(current), uid);
+        audit_log_format(*ab, "pid=%d uid=%u", pid, uid);
         audit_log_session_info(*ab);
         audit_log_task_context(*ab);
 
@@ -1097,7 +1102,7 @@ static void __net_exit audit_net_exit(struct net *net)
                 audit_sock = NULL;
         }
 
-        rcu_assign_pointer(aunet->nlsk, NULL);
+        RCU_INIT_POINTER(aunet->nlsk, NULL);
         synchronize_net();
         netlink_kernel_release(sock);
 }
@@ -1829,11 +1834,11 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
         spin_unlock_irq(&tsk->sighand->siglock);
 
         audit_log_format(ab,
-                         " ppid=%ld pid=%d auid=%u uid=%u gid=%u"
+                         " ppid=%d pid=%d auid=%u uid=%u gid=%u"
                          " euid=%u suid=%u fsuid=%u"
                          " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
-                         sys_getppid(),
-                         tsk->pid,
+                         task_ppid_nr(tsk),
+                         task_pid_nr(tsk),
                          from_kuid(&init_user_ns, audit_get_loginuid(tsk)),
                          from_kuid(&init_user_ns, cred->uid),
                          from_kgid(&init_user_ns, cred->gid),
diff --git a/kernel/audit.h b/kernel/audit.h
index 8df132214606..7bb65730c890 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -106,6 +106,11 @@ struct audit_names {
         bool                    should_free;
 };
 
+struct audit_proctitle {
+        int     len;    /* length of the cmdline field. */
+        char    *value; /* the cmdline field */
+};
+
 /* The per-task audit context. */
 struct audit_context {
         int                 dummy;      /* must be the first element */
@@ -202,6 +207,7 @@ struct audit_context {
                 } execve;
         };
         int fds[2];
+        struct audit_proctitle proctitle;
 
 #if AUDIT_DEBUG
         int                 put_count;
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 92062fd6cc8c..8e9bc9c3dbb7 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -19,6 +19,8 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/audit.h>
 #include <linux/kthread.h>
@@ -226,7 +228,7 @@ static int audit_match_signal(struct audit_entry *entry)
 #endif
 
 /* Common user-space to kernel rule translation. */
-static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
+static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)
 {
         unsigned listnr;
         struct audit_entry *entry;
@@ -249,7 +251,7 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
                 ;
         }
         if (unlikely(rule->action == AUDIT_POSSIBLE)) {
-                printk(KERN_ERR "AUDIT_POSSIBLE is deprecated\n");
+                pr_err("AUDIT_POSSIBLE is deprecated\n");
                 goto exit_err;
         }
         if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
@@ -403,7 +405,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
         int i;
         char *str;
 
-        entry = audit_to_entry_common((struct audit_rule *)data);
+        entry = audit_to_entry_common(data);
         if (IS_ERR(entry))
                 goto exit_nofree;
 
@@ -431,6 +433,19 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                         f->val = 0;
                 }
 
+                if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
+                        struct pid *pid;
+                        rcu_read_lock();
+                        pid = find_vpid(f->val);
+                        if (!pid) {
+                                rcu_read_unlock();
+                                err = -ESRCH;
+                                goto exit_free;
+                        }
+                        f->val = pid_nr(pid);
+                        rcu_read_unlock();
+                }
+
                 err = audit_field_valid(entry, f);
                 if (err)
                         goto exit_free;
@@ -479,8 +494,8 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                         /* Keep currently invalid fields around in case they
                          * become valid after a policy reload. */
                         if (err == -EINVAL) {
-                                printk(KERN_WARNING "audit rule for LSM "
-                                       "\'%s\' is invalid\n",  str);
+                                pr_warn("audit rule for LSM \'%s\' is invalid\n",
+                                        str);
                                 err = 0;
                         }
                         if (err) {
@@ -709,8 +724,8 @@ static inline int audit_dupe_lsm_field(struct audit_field *df,
         /* Keep currently invalid fields around in case they
          * become valid after a policy reload. */
         if (ret == -EINVAL) {
-                printk(KERN_WARNING "audit rule for LSM \'%s\' is "
-                       "invalid\n", df->lsm_str);
+                pr_warn("audit rule for LSM \'%s\' is invalid\n",
+                        df->lsm_str);
                 ret = 0;
         }
 
@@ -1240,12 +1255,14 @@ static int audit_filter_user_rules(struct audit_krule *rule, int type,
 
         for (i = 0; i < rule->field_count; i++) {
                 struct audit_field *f = &rule->fields[i];
+                pid_t pid;
                 int result = 0;
                 u32 sid;
 
                 switch (f->type) {
                 case AUDIT_PID:
-                        result = audit_comparator(task_pid_vnr(current), f->op, f->val);
+                        pid = task_pid_nr(current);
+                        result = audit_comparator(pid, f->op, f->val);
                         break;
                 case AUDIT_UID:
                         result = audit_uid_comparator(current_uid(), f->op, f->uid);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 7aef2f4b6c64..f251a5e8d17a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -42,6 +42,8 @@
  * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/init.h>
 #include <asm/types.h>
 #include <linux/atomic.h>
@@ -68,6 +70,7 @@
 #include <linux/capability.h>
 #include <linux/fs_struct.h>
 #include <linux/compat.h>
+#include <linux/ctype.h>
 
 #include "audit.h"
 
@@ -79,6 +82,9 @@
 /* no execve audit message should be longer than this (userspace limits) */
 #define MAX_EXECVE_AUDIT_LEN 7500
 
+/* max length to print of cmdline/proctitle value during audit */
+#define MAX_PROCTITLE_AUDIT_LEN 128
+
 /* number of audit rules */
 int audit_n_rules;
 
@@ -451,15 +457,17 @@ static int audit_filter_rules(struct task_struct *tsk,
                 struct audit_field *f = &rule->fields[i];
                 struct audit_names *n;
                 int result = 0;
+                pid_t pid;
 
                 switch (f->type) {
                 case AUDIT_PID:
-                        result = audit_comparator(tsk->pid, f->op, f->val);
+                        pid = task_pid_nr(tsk);
+                        result = audit_comparator(pid, f->op, f->val);
                         break;
                 case AUDIT_PPID:
                         if (ctx) {
                                 if (!ctx->ppid)
-                                        ctx->ppid = sys_getppid();
+                                        ctx->ppid = task_ppid_nr(tsk);
                                 result = audit_comparator(ctx->ppid, f->op, f->val);
                         }
                         break;
@@ -805,7 +813,8 @@ void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
         rcu_read_unlock();
 }
 
-static inline struct audit_context *audit_get_context(struct task_struct *tsk,
+/* Transfer the audit context pointer to the caller, clearing it in the tsk's struct */
+static inline struct audit_context *audit_take_context(struct task_struct *tsk,
                                                       int return_valid,
                                                       long return_code)
 {
@@ -842,6 +851,13 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
         return context;
 }
 
+static inline void audit_proctitle_free(struct audit_context *context)
+{
+        kfree(context->proctitle.value);
+        context->proctitle.value = NULL;
+        context->proctitle.len = 0;
+}
+
 static inline void audit_free_names(struct audit_context *context)
 {
         struct audit_names *n, *next;
@@ -850,16 +866,15 @@ static inline void audit_free_names(struct audit_context *context)
         if (context->put_count + context->ino_count != context->name_count) {
                 int i = 0;
 
-                printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
-                       " name_count=%d put_count=%d"
-                       " ino_count=%d [NOT freeing]\n",
-                       __FILE__, __LINE__,
+                pr_err("%s:%d(:%d): major=%d in_syscall=%d"
+                       " name_count=%d put_count=%d ino_count=%d"
+                       " [NOT freeing]\n", __FILE__, __LINE__,
                        context->serial, context->major, context->in_syscall,
                        context->name_count, context->put_count,
                        context->ino_count);
                 list_for_each_entry(n, &context->names_list, list) {
-                        printk(KERN_ERR "names[%d] = %p = %s\n", i++,
-                               n->name, n->name->name ?: "(null)");
+                        pr_err("names[%d] = %p = %s\n", i++, n->name,
+                               n->name->name ?: "(null)");
                 }
                 dump_stack();
                 return;
@@ -955,6 +970,7 @@ static inline void audit_free_context(struct audit_context *context)
         audit_free_aux(context);
         kfree(context->filterkey);
         kfree(context->sockaddr);
+        audit_proctitle_free(context);
         kfree(context);
 }
 
@@ -1157,7 +1173,7 @@ static void audit_log_execve_info(struct audit_context *context,
          */
         buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
         if (!buf) {
-                audit_panic("out of memory for argv string\n");
+                audit_panic("out of memory for argv string");
                 return;
         }
 
@@ -1271,6 +1287,59 @@ static void show_special(struct audit_context *context, int *call_panic)
         audit_log_end(ab);
 }
 
+static inline int audit_proctitle_rtrim(char *proctitle, int len)
+{
+        char *end = proctitle + len - 1;
+        while (end > proctitle && !isprint(*end))
+                end--;
+
+        /* catch the case where proctitle is only 1 non-print character */
+        len = end - proctitle + 1;
+        len -= isprint(proctitle[len-1]) == 0;
+        return len;
+}
+
+static void audit_log_proctitle(struct task_struct *tsk,
+                         struct audit_context *context)
+{
+        int res;
+        char *buf;
+        char *msg = "(null)";
+        int len = strlen(msg);
+        struct audit_buffer *ab;
+
+        ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
+        if (!ab)
+                return; /* audit_panic or being filtered */
+
+        audit_log_format(ab, "proctitle=");
+
+        /* Not  cached */
+        if (!context->proctitle.value) {
+                buf = kmalloc(MAX_PROCTITLE_AUDIT_LEN, GFP_KERNEL);
+                if (!buf)
+                        goto out;
+                /* Historically called this from procfs naming */
+                res = get_cmdline(tsk, buf, MAX_PROCTITLE_AUDIT_LEN);
+                if (res == 0) {
+                        kfree(buf);
+                        goto out;
+                }
+                res = audit_proctitle_rtrim(buf, res);
+                if (res == 0) {
+                        kfree(buf);
+                        goto out;
+                }
+                context->proctitle.value = buf;
+                context->proctitle.len = res;
+        }
+        msg = context->proctitle.value;
+        len = context->proctitle.len;
+out:
+        audit_log_n_untrustedstring(ab, msg, len);
+        audit_log_end(ab);
+}
+
 static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
 {
         int i, call_panic = 0;
@@ -1388,6 +1457,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                 audit_log_name(context, n, NULL, i++, &call_panic);
         }
 
+        audit_log_proctitle(tsk, context);
+
         /* Send end of event record to help user space know we are finished */
         ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
         if (ab)
@@ -1406,7 +1477,7 @@ void __audit_free(struct task_struct *tsk)
 {
         struct audit_context *context;
 
-        context = audit_get_context(tsk, 0, 0);
+        context = audit_take_context(tsk, 0, 0);
         if (!context)
                 return;
 
@@ -1500,7 +1571,7 @@ void __audit_syscall_exit(int success, long return_code)
         else
                 success = AUDITSC_FAILURE;
 
-        context = audit_get_context(tsk, success, return_code);
+        context = audit_take_context(tsk, success, return_code);
         if (!context)
                 return;
 
@@ -1550,7 +1621,7 @@ static inline void handle_one(const struct inode *inode)
         if (likely(put_tree_ref(context, chunk)))
                 return;
         if (unlikely(!grow_tree_refs(context))) {
-                printk(KERN_WARNING "out of memory, audit has lost a tree reference\n");
+                pr_warn("out of memory, audit has lost a tree reference\n");
                 audit_set_auditable(context);
                 audit_put_chunk(chunk);
                 unroll_tree_refs(context, p, count);
@@ -1609,8 +1680,7 @@ retry:
                         goto retry;
                 }
                 /* too bad */
-                printk(KERN_WARNING
-                        "out of memory, audit has lost a tree reference\n");
+                pr_warn("out of memory, audit has lost a tree reference\n");
                 unroll_tree_refs(context, p, count);
                 audit_set_auditable(context);
                 return;
@@ -1682,7 +1752,7 @@ void __audit_getname(struct filename *name)
 
         if (!context->in_syscall) {
 #if AUDIT_DEBUG == 2
-                printk(KERN_ERR "%s:%d(:%d): ignoring getname(%p)\n",
+                pr_err("%s:%d(:%d): ignoring getname(%p)\n",
                        __FILE__, __LINE__, context->serial, name);
                 dump_stack();
 #endif
@@ -1721,15 +1791,15 @@ void audit_putname(struct filename *name)
         BUG_ON(!context);
         if (!name->aname || !context->in_syscall) {
 #if AUDIT_DEBUG == 2
-                printk(KERN_ERR "%s:%d(:%d): final_putname(%p)\n",
+                pr_err("%s:%d(:%d): final_putname(%p)\n",
                        __FILE__, __LINE__, context->serial, name);
                 if (context->name_count) {
                         struct audit_names *n;
                         int i = 0;
 
                         list_for_each_entry(n, &context->names_list, list)
-                                printk(KERN_ERR "name[%d] = %p = %s\n", i++,
-                                       n->name, n->name->name ?: "(null)");
+                                pr_err("name[%d] = %p = %s\n", i++, n->name,
+                                       n->name->name ?: "(null)");
                         }
 #endif
                 final_putname(name);
@@ -1738,9 +1808,8 @@ void audit_putname(struct filename *name)
         else {
                 ++context->put_count;
                 if (context->put_count > context->name_count) {
-                        printk(KERN_ERR "%s:%d(:%d): major=%d"
-                               " in_syscall=%d putname(%p) name_count=%d"
-                               " put_count=%d\n",
+                        pr_err("%s:%d(:%d): major=%d in_syscall=%d putname(%p)"
+                               " name_count=%d put_count=%d\n",
                                __FILE__, __LINE__,
                                context->serial, context->major,
                                context->in_syscall, name->name,
@@ -1981,12 +2050,10 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
         if (!ab)
                 return;
-        audit_log_format(ab, "pid=%d uid=%u"
-                         " old-auid=%u new-auid=%u old-ses=%u new-ses=%u"
-                         " res=%d",
-                         current->pid, uid,
-                         oldloginuid, loginuid, oldsessionid, sessionid,
-                         !rc);
+        audit_log_format(ab, "pid=%d uid=%u", task_pid_nr(current), uid);
+        audit_log_task_context(ab);
+        audit_log_format(ab, " old-auid=%u auid=%u old-ses=%u ses=%u res=%d",
+                         oldloginuid, loginuid, oldsessionid, sessionid, !rc);
         audit_log_end(ab);
 }
 
@@ -2208,7 +2275,7 @@ void __audit_ptrace(struct task_struct *t)
 {
         struct audit_context *context = current->audit_context;
 
-        context->target_pid = t->pid;
+        context->target_pid = task_pid_nr(t);
         context->target_auid = audit_get_loginuid(t);
         context->target_uid = task_uid(t);
         context->target_sessionid = audit_get_sessionid(t);
@@ -2233,7 +2300,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
         if (audit_pid && t->tgid == audit_pid) {
                 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
-                        audit_sig_pid = tsk->pid;
+                        audit_sig_pid = task_pid_nr(tsk);
                         if (uid_valid(tsk->loginuid))
                                 audit_sig_uid = tsk->loginuid;
                         else
@@ -2247,7 +2314,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
         /* optimize the common case by putting first signal recipient directly
          * in audit_context */
         if (!ctx->target_pid) {
-                ctx->target_pid = t->tgid;
+                ctx->target_pid = task_tgid_nr(t);
                 ctx->target_auid = audit_get_loginuid(t);
                 ctx->target_uid = t_uid;
                 ctx->target_sessionid = audit_get_sessionid(t);
@@ -2268,7 +2335,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
         }
         BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
 
-        axp->target_pid[axp->pid_count] = t->tgid;
+        axp->target_pid[axp->pid_count] = task_tgid_nr(t);
         axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
         axp->target_uid[axp->pid_count] = t_uid;
         axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
@@ -2368,7 +2435,7 @@ static void audit_log_task(struct audit_buffer *ab)
                          from_kgid(&init_user_ns, gid),
                          sessionid);
         audit_log_task_context(ab);
-        audit_log_format(ab, " pid=%d comm=", current->pid);
+        audit_log_format(ab, " pid=%d comm=", task_pid_nr(current));
         audit_log_untrustedstring(ab, current->comm);
         if (mm) {
                 down_read(&mm->mmap_sem);
diff --git a/kernel/capability.c b/kernel/capability.c
index 34019c57888d..a8d63df0c322 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -7,6 +7,8 @@
  * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/audit.h>
 #include <linux/capability.h>
 #include <linux/mm.h>
@@ -42,15 +44,10 @@ __setup("no_file_caps", file_caps_disable);
 
 static void warn_legacy_capability_use(void)
 {
-        static int warned;
-        if (!warned) {
-                char name[sizeof(current->comm)];
-
-                printk(KERN_INFO "warning: `%s' uses 32-bit capabilities"
-                       " (legacy support in use)\n",
-                       get_task_comm(name, current));
-                warned = 1;
-        }
+        char name[sizeof(current->comm)];
+
+        pr_info_once("warning: `%s' uses 32-bit capabilities (legacy support in use)\n",
+                     get_task_comm(name, current));
 }
 
 /*
@@ -71,16 +68,10 @@ static void warn_legacy_capability_use(void)
 
 static void warn_deprecated_v2(void)
 {
-        static int warned;
+        char name[sizeof(current->comm)];
 
-        if (!warned) {
-                char name[sizeof(current->comm)];
-
-                printk(KERN_INFO "warning: `%s' uses deprecated v2"
-                       " capabilities in a way that may be insecure.\n",
-                       get_task_comm(name, current));
-                warned = 1;
-        }
+        pr_info_once("warning: `%s' uses deprecated v2 capabilities in a way that may be insecure\n",
+                     get_task_comm(name, current));
 }
 
 /*
@@ -380,7 +371,7 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
 bool ns_capable(struct user_namespace *ns, int cap)
 {
         if (unlikely(!cap_valid(cap))) {
-                printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
+                pr_crit("capable() called with invalid cap=%u\n", cap);
                 BUG();
         }
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 0c753ddd223b..9fcdaa705b6c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -40,23 +40,20 @@
 #include <linux/proc_fs.h>
 #include <linux/rcupdate.h>
 #include <linux/sched.h>
-#include <linux/backing-dev.h>
 #include <linux/slab.h>
-#include <linux/magic.h>
 #include <linux/spinlock.h>
+#include <linux/rwsem.h>
 #include <linux/string.h>
 #include <linux/sort.h>
 #include <linux/kmod.h>
-#include <linux/module.h>
 #include <linux/delayacct.h>
 #include <linux/cgroupstats.h>
 #include <linux/hashtable.h>
-#include <linux/namei.h>
 #include <linux/pid_namespace.h>
 #include <linux/idr.h>
 #include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
-#include <linux/flex_array.h> /* used in cgroup_attach_task */
 #include <linux/kthread.h>
+#include <linux/delay.h>
 
 #include <linux/atomic.h>
 
@@ -68,43 +65,49 @@
  */
 #define CGROUP_PIDLIST_DESTROY_DELAY    HZ
 
+#define CGROUP_FILE_NAME_MAX            (MAX_CGROUP_TYPE_NAMELEN +      \
+                                         MAX_CFTYPE_NAME + 2)
+
+/*
+ * cgroup_tree_mutex nests above cgroup_mutex and protects cftypes, file
+ * creation/removal and hierarchy changing operations including cgroup
+ * creation, removal, css association and controller rebinding.  This outer
+ * lock is needed mainly to resolve the circular dependency between kernfs
+ * active ref and cgroup_mutex.  cgroup_tree_mutex nests above both.
+ */
+static DEFINE_MUTEX(cgroup_tree_mutex);
+
 /*
  * cgroup_mutex is the master lock.  Any modification to cgroup or its
  * hierarchy must be performed while holding it.
  *
- * cgroup_root_mutex nests inside cgroup_mutex and should be held to modify
- * cgroupfs_root of any cgroup hierarchy - subsys list, flags,
- * release_agent_path and so on.  Modifying requires both cgroup_mutex and
- * cgroup_root_mutex.  Readers can acquire either of the two.  This is to
- * break the following locking order cycle.
- *
- *  A. cgroup_mutex -> cred_guard_mutex -> s_type->i_mutex_key -> namespace_sem
- *  B. namespace_sem -> cgroup_mutex
+ * css_set_rwsem protects task->cgroups pointer, the list of css_set
+ * objects, and the chain of tasks off each css_set.
  *
- * B happens only through cgroup_show_options() and using cgroup_root_mutex
- * breaks it.
+ * These locks are exported if CONFIG_PROVE_RCU so that accessors in
+ * cgroup.h can use them for lockdep annotations.
  */
 #ifdef CONFIG_PROVE_RCU
 DEFINE_MUTEX(cgroup_mutex);
-EXPORT_SYMBOL_GPL(cgroup_mutex);        /* only for lockdep */
+DECLARE_RWSEM(css_set_rwsem);
+EXPORT_SYMBOL_GPL(cgroup_mutex);
+EXPORT_SYMBOL_GPL(css_set_rwsem);
 #else
 static DEFINE_MUTEX(cgroup_mutex);
+static DECLARE_RWSEM(css_set_rwsem);
 #endif
 
-static DEFINE_MUTEX(cgroup_root_mutex);
+/*
+ * Protects cgroup_subsys->release_agent_path.  Modifying it also requires
+ * cgroup_mutex.  Reading requires either cgroup_mutex or this spinlock.
+ */
+static DEFINE_SPINLOCK(release_agent_path_lock);
 
-#define cgroup_assert_mutex_or_rcu_locked()                             \
+#define cgroup_assert_mutexes_or_rcu_locked()                           \
         rcu_lockdep_assert(rcu_read_lock_held() ||                      \
+                           lockdep_is_held(&cgroup_tree_mutex) ||       \
                            lockdep_is_held(&cgroup_mutex),              \
-                           "cgroup_mutex or RCU read lock required");
-
-#ifdef CONFIG_LOCKDEP
-#define cgroup_assert_mutex_or_root_locked()                            \
-        WARN_ON_ONCE(debug_locks && (!lockdep_is_held(&cgroup_mutex) && \
-                                     !lockdep_is_held(&cgroup_root_mutex)))
-#else
-#define cgroup_assert_mutex_or_root_locked()    do { } while (0)
-#endif
+                           "cgroup_[tree_]mutex or RCU read lock required");
 
 /*
  * cgroup destruction makes heavy use of work items and there can be a lot
@@ -120,42 +123,41 @@ static struct workqueue_struct *cgroup_destroy_wq;
  */
 static struct workqueue_struct *cgroup_pidlist_destroy_wq;
 
-/*
- * Generate an array of cgroup subsystem pointers. At boot time, this is
- * populated with the built in subsystems, and modular subsystems are
- * registered after that. The mutable section of this array is protected by
- * cgroup_mutex.
- */
-#define SUBSYS(_x) [_x ## _subsys_id] = &_x ## _subsys,
-#define IS_SUBSYS_ENABLED(option) IS_BUILTIN(option)
-static struct cgroup_subsys *cgroup_subsys[CGROUP_SUBSYS_COUNT] = {
+/* generate an array of cgroup subsystem pointers */
+#define SUBSYS(_x) [_x ## _cgrp_id] = &_x ## _cgrp_subsys,
+static struct cgroup_subsys *cgroup_subsys[] = {
+#include <linux/cgroup_subsys.h>
+};
+#undef SUBSYS
+
+/* array of cgroup subsystem names */
+#define SUBSYS(_x) [_x ## _cgrp_id] = #_x,
+static const char *cgroup_subsys_name[] = {
 #include <linux/cgroup_subsys.h>
 };
+#undef SUBSYS
 
 /*
- * The dummy hierarchy, reserved for the subsystems that are otherwise
+ * The default hierarchy, reserved for the subsystems that are otherwise
  * unattached - it never has more than a single cgroup, and all tasks are
  * part of that cgroup.
  */
-static struct cgroupfs_root cgroup_dummy_root;
+struct cgroup_root cgrp_dfl_root;
 
-/* dummy_top is a shorthand for the dummy hierarchy's top cgroup */
-static struct cgroup * const cgroup_dummy_top = &cgroup_dummy_root.top_cgroup;
+/*
+ * The default hierarchy always exists but is hidden until mounted for the
+ * first time.  This is for backward compatibility.
+ */
+static bool cgrp_dfl_root_visible;
 
 /* The list of hierarchy roots */
 
 static LIST_HEAD(cgroup_roots);
 static int cgroup_root_count;
 
-/*
- * Hierarchy ID allocation and mapping.  It follows the same exclusion
- * rules as other root ops - both cgroup_mutex and cgroup_root_mutex for
- * writes, either for reads.
- */
+/* hierarchy ID allocation and mapping, protected by cgroup_mutex */
 static DEFINE_IDR(cgroup_hierarchy_idr);
 
-static struct cgroup_name root_cgroup_name = { .name = "/" };
-
 /*
  * Assign a monotonically increasing serial number to cgroups.  It
  * guarantees cgroups with bigger numbers are newer than those with smaller
@@ -175,11 +177,13 @@ static int need_forkexit_callback __read_mostly;
 
 static struct cftype cgroup_base_files[];
 
+static void cgroup_put(struct cgroup *cgrp);
+static int rebind_subsystems(struct cgroup_root *dst_root,
+                             unsigned long ss_mask);
 static void cgroup_destroy_css_killed(struct cgroup *cgrp);
 static int cgroup_destroy_locked(struct cgroup *cgrp);
 static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
                               bool is_add);
-static int cgroup_file_release(struct inode *inode, struct file *file);
 static void cgroup_pidlist_destroy_all(struct cgroup *cgrp);
 
 /**
@@ -197,8 +201,9 @@ static struct cgroup_subsys_state *cgroup_css(struct cgroup *cgrp,
                                               struct cgroup_subsys *ss)
 {
         if (ss)
-                return rcu_dereference_check(cgrp->subsys[ss->subsys_id],
-                                             lockdep_is_held(&cgroup_mutex));
+                return rcu_dereference_check(cgrp->subsys[ss->id],
+                                        lockdep_is_held(&cgroup_tree_mutex) ||
+                                        lockdep_is_held(&cgroup_mutex));
         else
                 return &cgrp->dummy_css;
 }
@@ -209,6 +214,27 @@ static inline bool cgroup_is_dead(const struct cgroup *cgrp)
         return test_bit(CGRP_DEAD, &cgrp->flags);
 }
 
+struct cgroup_subsys_state *seq_css(struct seq_file *seq)
+{
+        struct kernfs_open_file *of = seq->private;
+        struct cgroup *cgrp = of->kn->parent->priv;
+        struct cftype *cft = seq_cft(seq);
+
+        /*
+         * This is open and unprotected implementation of cgroup_css().
+         * seq_css() is only called from a kernfs file operation which has
+         * an active reference on the file.  Because all the subsystem
+         * files are drained before a css is disassociated with a cgroup,
+         * the matching css from the cgroup's subsys table is guaranteed to
+         * be and stay valid until the enclosing operation is complete.
+         */
+        if (cft->ss)
+                return rcu_dereference_raw(cgrp->subsys[cft->ss->id]);
+        else
+                return &cgrp->dummy_css;
+}
+EXPORT_SYMBOL_GPL(seq_css);
+
 /**
  * cgroup_is_descendant - test ancestry
  * @cgrp: the cgroup to be tested
@@ -227,7 +253,6 @@ bool cgroup_is_descendant(struct cgroup *cgrp, struct cgroup *ancestor)
         }
         return false;
 }
-EXPORT_SYMBOL_GPL(cgroup_is_descendant);
 
 static int cgroup_is_releasable(const struct cgroup *cgrp)
 {
@@ -254,54 +279,23 @@ static int notify_on_release(const struct cgroup *cgrp)
         for ((ssid) = 0; (ssid) < CGROUP_SUBSYS_COUNT; (ssid)++)        \
                 if (!((css) = rcu_dereference_check(                    \
                                 (cgrp)->subsys[(ssid)],                 \
+                                lockdep_is_held(&cgroup_tree_mutex) ||  \
                                 lockdep_is_held(&cgroup_mutex)))) { }   \
                 else
 
 /**
- * for_each_subsys - iterate all loaded cgroup subsystems
+ * for_each_subsys - iterate all enabled cgroup subsystems
  * @ss: the iteration cursor
  * @ssid: the index of @ss, CGROUP_SUBSYS_COUNT after reaching the end
- *
- * Iterates through all loaded subsystems.  Should be called under
- * cgroup_mutex or cgroup_root_mutex.
  */
 #define for_each_subsys(ss, ssid)                                       \
-        for (({ cgroup_assert_mutex_or_root_locked(); (ssid) = 0; });   \
-             (ssid) < CGROUP_SUBSYS_COUNT; (ssid)++)                    \
-                if (!((ss) = cgroup_subsys[(ssid)])) { }                \
-                else
+        for ((ssid) = 0; (ssid) < CGROUP_SUBSYS_COUNT &&                \
+             (((ss) = cgroup_subsys[ssid]) || true); (ssid)++)
 
-/**
- * for_each_builtin_subsys - iterate all built-in cgroup subsystems
- * @ss: the iteration cursor
- * @i: the index of @ss, CGROUP_BUILTIN_SUBSYS_COUNT after reaching the end
- *
- * Bulit-in subsystems are always present and iteration itself doesn't
- * require any synchronization.
- */
-#define for_each_builtin_subsys(ss, i)                                  \
-        for ((i) = 0; (i) < CGROUP_BUILTIN_SUBSYS_COUNT &&              \
-             (((ss) = cgroup_subsys[i]) || true); (i)++)
-
-/* iterate across the active hierarchies */
-#define for_each_active_root(root)                                      \
+/* iterate across the hierarchies */
+#define for_each_root(root)                                             \
         list_for_each_entry((root), &cgroup_roots, root_list)
 
-static inline struct cgroup *__d_cgrp(struct dentry *dentry)
-{
-        return dentry->d_fsdata;
-}
-
-static inline struct cfent *__d_cfe(struct dentry *dentry)
-{
-        return dentry->d_fsdata;
-}
-
-static inline struct cftype *__d_cft(struct dentry *dentry)
-{
-        return __d_cfe(dentry)->type;
-}
-
 /**
  * cgroup_lock_live_group - take cgroup_mutex and check that cgrp is alive.
  * @cgrp: the cgroup to be checked for liveness
@@ -347,23 +341,23 @@ struct cgrp_cset_link {
         struct list_head        cgrp_link;
 };
 
-/* The default css_set - used by init and its children prior to any
+/*
+ * The default css_set - used by init and its children prior to any
  * hierarchies being mounted. It contains a pointer to the root state
  * for each subsystem. Also used to anchor the list of css_sets. Not
  * reference-counted, to improve performance when child cgroups
  * haven't been created.
  */
+static struct css_set init_css_set = {
+        .refcount               = ATOMIC_INIT(1),
+        .cgrp_links             = LIST_HEAD_INIT(init_css_set.cgrp_links),
+        .tasks                  = LIST_HEAD_INIT(init_css_set.tasks),
+        .mg_tasks               = LIST_HEAD_INIT(init_css_set.mg_tasks),
+        .mg_preload_node        = LIST_HEAD_INIT(init_css_set.mg_preload_node),
+        .mg_node                = LIST_HEAD_INIT(init_css_set.mg_node),
+};
 
-static struct css_set init_css_set;
-static struct cgrp_cset_link init_cgrp_cset_link;
-
-/*
- * css_set_lock protects the list of css_set objects, and the chain of
- * tasks off each css_set.  Nests outside task->alloc_lock due to
- * css_task_iter_start().
- */
-static DEFINE_RWLOCK(css_set_lock);
-static int css_set_count;
+static int css_set_count        = 1;    /* 1 for init_css_set */
 
 /*
  * hash table for cgroup groups. This improves the performance to find
@@ -386,30 +380,14 @@ static unsigned long css_set_hash(struct cgroup_subsys_state *css[])
         return key;
 }
 
-/*
- * We don't maintain the lists running through each css_set to its task
- * until after the first call to css_task_iter_start().  This reduces the
- * fork()/exit() overhead for people who have cgroups compiled into their
- * kernel but not actually in use.
- */
-static int use_task_css_set_links __read_mostly;
-
-static void __put_css_set(struct css_set *cset, int taskexit)
+static void put_css_set_locked(struct css_set *cset, bool taskexit)
 {
         struct cgrp_cset_link *link, *tmp_link;
 
-        /*
-         * Ensure that the refcount doesn't hit zero while any readers
-         * can see it. Similar to atomic_dec_and_lock(), but for an
-         * rwlock
-         */
-        if (atomic_add_unless(&cset->refcount, -1, 1))
-                return;
-        write_lock(&css_set_lock);
-        if (!atomic_dec_and_test(&cset->refcount)) {
-                write_unlock(&css_set_lock);
+        lockdep_assert_held(&css_set_rwsem);
+
+        if (!atomic_dec_and_test(&cset->refcount))
                 return;
-        }
 
         /* This css_set is dead. unlink it and release cgroup refcounts */
         hash_del(&cset->hlist);
@@ -421,7 +399,7 @@ static void __put_css_set(struct css_set *cset, int taskexit)
                 list_del(&link->cset_link);
                 list_del(&link->cgrp_link);
 
-                /* @cgrp can't go away while we're holding css_set_lock */
+                /* @cgrp can't go away while we're holding css_set_rwsem */
                 if (list_empty(&cgrp->cset_links) && notify_on_release(cgrp)) {
                         if (taskexit)
                                 set_bit(CGRP_RELEASABLE, &cgrp->flags);
@@ -431,10 +409,24 @@ static void __put_css_set(struct css_set *cset, int taskexit)
                 kfree(link);
         }
 
-        write_unlock(&css_set_lock);
         kfree_rcu(cset, rcu_head);
 }
 
+static void put_css_set(struct css_set *cset, bool taskexit)
+{
+        /*
+         * Ensure that the refcount doesn't hit zero while any readers
+         * can see it. Similar to atomic_dec_and_lock(), but for an
+         * rwlock
+         */
+        if (atomic_add_unless(&cset->refcount, -1, 1))
+                return;
+
+        down_write(&css_set_rwsem);
+        put_css_set_locked(cset, taskexit);
+        up_write(&css_set_rwsem);
+}
+
 /*
  * refcounted get/put for css_set objects
  */
@@ -443,16 +435,6 @@ static inline void get_css_set(struct css_set *cset)
         atomic_inc(&cset->refcount);
 }
 
-static inline void put_css_set(struct css_set *cset)
-{
-        __put_css_set(cset, 0);
-}
-
-static inline void put_css_set_taskexit(struct css_set *cset)
-{
-        __put_css_set(cset, 1);
-}
-
 /**
  * compare_css_sets - helper function for find_existing_css_set().
  * @cset: candidate css_set being tested
@@ -535,7 +517,7 @@ static struct css_set *find_existing_css_set(struct css_set *old_cset,
                                         struct cgroup *cgrp,
                                         struct cgroup_subsys_state *template[])
 {
-        struct cgroupfs_root *root = cgrp->root;
+        struct cgroup_root *root = cgrp->root;
         struct cgroup_subsys *ss;
         struct css_set *cset;
         unsigned long key;
@@ -547,7 +529,7 @@ static struct css_set *find_existing_css_set(struct css_set *old_cset,
          * won't change, so no need for locking.
          */
         for_each_subsys(ss, i) {
-                if (root->subsys_mask & (1UL << i)) {
+                if (root->cgrp.subsys_mask & (1UL << i)) {
                         /* Subsystem is in this hierarchy. So we want
                          * the subsystem state from the new
                          * cgroup */
@@ -652,11 +634,11 @@ static struct css_set *find_css_set(struct css_set *old_cset,
 
         /* First see if we already have a cgroup group that matches
          * the desired set */
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
         cset = find_existing_css_set(old_cset, cgrp, template);
         if (cset)
                 get_css_set(cset);
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
 
         if (cset)
                 return cset;
@@ -674,13 +656,16 @@ static struct css_set *find_css_set(struct css_set *old_cset,
         atomic_set(&cset->refcount, 1);
         INIT_LIST_HEAD(&cset->cgrp_links);
         INIT_LIST_HEAD(&cset->tasks);
+        INIT_LIST_HEAD(&cset->mg_tasks);
+        INIT_LIST_HEAD(&cset->mg_preload_node);
+        INIT_LIST_HEAD(&cset->mg_node);
         INIT_HLIST_NODE(&cset->hlist);
 
         /* Copy the set of subsystem state objects generated in
          * find_existing_css_set() */
         memcpy(cset->subsys, template, sizeof(cset->subsys));
 
-        write_lock(&css_set_lock);
+        down_write(&css_set_rwsem);
         /* Add reference counts and links from the new css_set. */
         list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) {
                 struct cgroup *c = link->cgrp;
@@ -698,31 +683,105 @@ static struct css_set *find_css_set(struct css_set *old_cset,
         key = css_set_hash(cset->subsys);
         hash_add(css_set_table, &cset->hlist, key);
 
-        write_unlock(&css_set_lock);
+        up_write(&css_set_rwsem);
 
         return cset;
 }
 
-/*
- * Return the cgroup for "task" from the given hierarchy. Must be
- * called with cgroup_mutex held.
- */
-static struct cgroup *task_cgroup_from_root(struct task_struct *task,
-                                            struct cgroupfs_root *root)
+static struct cgroup_root *cgroup_root_from_kf(struct kernfs_root *kf_root)
 {
-        struct css_set *cset;
-        struct cgroup *res = NULL;
+        struct cgroup *root_cgrp = kf_root->kn->priv;
+
+        return root_cgrp->root;
+}
+
+static int cgroup_init_root_id(struct cgroup_root *root)
+{
+        int id;
+
+        lockdep_assert_held(&cgroup_mutex);
+
+        id = idr_alloc_cyclic(&cgroup_hierarchy_idr, root, 0, 0, GFP_KERNEL);
+        if (id < 0)
+                return id;
+
+        root->hierarchy_id = id;
+        return 0;
+}
+
+static void cgroup_exit_root_id(struct cgroup_root *root)
+{
+        lockdep_assert_held(&cgroup_mutex);
+
+        if (root->hierarchy_id) {
+                idr_remove(&cgroup_hierarchy_idr, root->hierarchy_id);
+                root->hierarchy_id = 0;
+        }
+}
+
+static void cgroup_free_root(struct cgroup_root *root)
+{
+        if (root) {
+                /* hierarhcy ID shoulid already have been released */
+                WARN_ON_ONCE(root->hierarchy_id);
+
+                idr_destroy(&root->cgroup_idr);
+                kfree(root);
+        }
+}
+
+static void cgroup_destroy_root(struct cgroup_root *root)
+{
+        struct cgroup *cgrp = &root->cgrp;
+        struct cgrp_cset_link *link, *tmp_link;
+
+        mutex_lock(&cgroup_tree_mutex);
+        mutex_lock(&cgroup_mutex);
+
+        BUG_ON(atomic_read(&root->nr_cgrps));
+        BUG_ON(!list_empty(&cgrp->children));
+
+        /* Rebind all subsystems back to the default hierarchy */
+        rebind_subsystems(&cgrp_dfl_root, cgrp->subsys_mask);
 
-        BUG_ON(!mutex_is_locked(&cgroup_mutex));
-        read_lock(&css_set_lock);
         /*
-         * No need to lock the task - since we hold cgroup_mutex the
-         * task can't change groups, so the only thing that can happen
-         * is that it exits and its css is set back to init_css_set.
+         * Release all the links from cset_links to this hierarchy's
+         * root cgroup
          */
-        cset = task_css_set(task);
+        down_write(&css_set_rwsem);
+
+        list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
+                list_del(&link->cset_link);
+                list_del(&link->cgrp_link);
+                kfree(link);
+        }
+        up_write(&css_set_rwsem);
+
+        if (!list_empty(&root->root_list)) {
+                list_del(&root->root_list);
+                cgroup_root_count--;
+        }
+
+        cgroup_exit_root_id(root);
+
+        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
+
+        kernfs_destroy_root(root->kf_root);
+        cgroup_free_root(root);
+}
+
+/* look up cgroup associated with given css_set on the specified hierarchy */
+static struct cgroup *cset_cgroup_from_root(struct css_set *cset,
+                                            struct cgroup_root *root)
+{
+        struct cgroup *res = NULL;
+
+        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&css_set_rwsem);
+
         if (cset == &init_css_set) {
-                res = &root->top_cgroup;
+                res = &root->cgrp;
         } else {
                 struct cgrp_cset_link *link;
 
@@ -735,16 +794,27 @@ static struct cgroup *task_cgroup_from_root(struct task_struct *task,
                         }
                 }
         }
-        read_unlock(&css_set_lock);
+
         BUG_ON(!res);
         return res;
 }
 
 /*
- * There is one global cgroup mutex. We also require taking
- * task_lock() when dereferencing a task's cgroup subsys pointers.
- * See "The task_lock() exception", at the end of this comment.
- *
+ * Return the cgroup for "task" from the given hierarchy. Must be
+ * called with cgroup_mutex and css_set_rwsem held.
+ */
+static struct cgroup *task_cgroup_from_root(struct task_struct *task,
+                                            struct cgroup_root *root)
+{
+        /*
+         * No need to lock the task - since we hold cgroup_mutex the
+         * task can't change groups, so the only thing that can happen
+         * is that it exits and its css is set back to init_css_set.
+         */
+        return cset_cgroup_from_root(task_css_set(task), root);
+}
+
+/*
  * A task must hold cgroup_mutex to modify cgroups.
  *
  * Any task can increment and decrement the count field without lock.
@@ -770,98 +840,79 @@ static struct cgroup *task_cgroup_from_root(struct task_struct *task,
  * A cgroup can only be deleted if both its 'count' of using tasks
  * is zero, and its list of 'children' cgroups is empty.  Since all
  * tasks in the system use _some_ cgroup, and since there is always at
- * least one task in the system (init, pid == 1), therefore, top_cgroup
+ * least one task in the system (init, pid == 1), therefore, root cgroup
  * always has either children cgroups and/or using tasks.  So we don't
- * need a special hack to ensure that top_cgroup cannot be deleted.
- *
- *      The task_lock() exception
- *
- * The need for this exception arises from the action of
- * cgroup_attach_task(), which overwrites one task's cgroup pointer with
- * another.  It does so using cgroup_mutex, however there are
- * several performance critical places that need to reference
- * task->cgroup without the expense of grabbing a system global
- * mutex.  Therefore except as noted below, when dereferencing or, as
- * in cgroup_attach_task(), modifying a task's cgroup pointer we use
- * task_lock(), which acts on a spinlock (task->alloc_lock) already in
- * the task_struct routinely used for such matters.
+ * need a special hack to ensure that root cgroup cannot be deleted.
  *
  * P.S.  One more locking exception.  RCU is used to guard the
  * update of a tasks cgroup pointer by cgroup_attach_task()
  */
 
-/*
- * A couple of forward declarations required, due to cyclic reference loop:
- * cgroup_mkdir -> cgroup_create -> cgroup_populate_dir ->
- * cgroup_add_file -> cgroup_create_file -> cgroup_dir_inode_operations
- * -> cgroup_mkdir.
- */
-
-static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
-static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry);
 static int cgroup_populate_dir(struct cgroup *cgrp, unsigned long subsys_mask);
-static const struct inode_operations cgroup_dir_inode_operations;
+static struct kernfs_syscall_ops cgroup_kf_syscall_ops;
 static const struct file_operations proc_cgroupstats_operations;
 
-static struct backing_dev_info cgroup_backing_dev_info = {
-        .name           = "cgroup",
-        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
-};
-
-static struct inode *cgroup_new_inode(umode_t mode, struct super_block *sb)
+static char *cgroup_file_name(struct cgroup *cgrp, const struct cftype *cft,
+                              char *buf)
 {
-        struct inode *inode = new_inode(sb);
-
-        if (inode) {
-                inode->i_ino = get_next_ino();
-                inode->i_mode = mode;
-                inode->i_uid = current_fsuid();
-                inode->i_gid = current_fsgid();
-                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-                inode->i_mapping->backing_dev_info = &cgroup_backing_dev_info;
-        }
-        return inode;
+        if (cft->ss && !(cft->flags & CFTYPE_NO_PREFIX) &&
+            !(cgrp->root->flags & CGRP_ROOT_NOPREFIX))
+                snprintf(buf, CGROUP_FILE_NAME_MAX, "%s.%s",
+                         cft->ss->name, cft->name);
+        else
+                strncpy(buf, cft->name, CGROUP_FILE_NAME_MAX);
+        return buf;
 }
 
-static struct cgroup_name *cgroup_alloc_name(struct dentry *dentry)
+/**
+ * cgroup_file_mode - deduce file mode of a control file
+ * @cft: the control file in question
+ *
+ * returns cft->mode if ->mode is not 0
+ * returns S_IRUGO|S_IWUSR if it has both a read and a write handler
+ * returns S_IRUGO if it has only a read handler
+ * returns S_IWUSR if it has only a write hander
+ */
+static umode_t cgroup_file_mode(const struct cftype *cft)
 {
-        struct cgroup_name *name;
+        umode_t mode = 0;
 
-        name = kmalloc(sizeof(*name) + dentry->d_name.len + 1, GFP_KERNEL);
-        if (!name)
-                return NULL;
-        strcpy(name->name, dentry->d_name.name);
-        return name;
+        if (cft->mode)
+                return cft->mode;
+
+        if (cft->read_u64 || cft->read_s64 || cft->seq_show)
+                mode |= S_IRUGO;
+
+        if (cft->write_u64 || cft->write_s64 || cft->write_string ||
+            cft->trigger)
+                mode |= S_IWUSR;
+
+        return mode;
 }
 
 static void cgroup_free_fn(struct work_struct *work)
 {
         struct cgroup *cgrp = container_of(work, struct cgroup, destroy_work);
 
-        mutex_lock(&cgroup_mutex);
-        cgrp->root->number_of_cgroups--;
-        mutex_unlock(&cgroup_mutex);
-
-        /*
-         * We get a ref to the parent's dentry, and put the ref when
-         * this cgroup is being freed, so it's guaranteed that the
-         * parent won't be destroyed before its children.
-         */
-        dput(cgrp->parent->dentry);
-
-        /*
-         * Drop the active superblock reference that we took when we
-         * created the cgroup. This will free cgrp->root, if we are
-         * holding the last reference to @sb.
-         */
-        deactivate_super(cgrp->root->sb);
-
+        atomic_dec(&cgrp->root->nr_cgrps);
         cgroup_pidlist_destroy_all(cgrp);
 
-        simple_xattrs_free(&cgrp->xattrs);
-
-        kfree(rcu_dereference_raw(cgrp->name));
-        kfree(cgrp);
+        if (cgrp->parent) {
+                /*
+                 * We get a ref to the parent, and put the ref when this
+                 * cgroup is being freed, so it's guaranteed that the
+                 * parent won't be destroyed before its children.
+                 */
+                cgroup_put(cgrp->parent);
+                kernfs_put(cgrp->kn);
+                kfree(cgrp);
+        } else {
+                /*
+                 * This is root cgroup's refcnt reaching zero, which
+                 * indicates that the root should be released.
+                 */
+                cgroup_destroy_root(cgrp->root);
+        }
 }
 
 static void cgroup_free_rcu(struct rcu_head *head)
@@ -872,73 +923,40 @@ static void cgroup_free_rcu(struct rcu_head *head)
         queue_work(cgroup_destroy_wq, &cgrp->destroy_work);
 }
 
-static void cgroup_diput(struct dentry *dentry, struct inode *inode)
-{
-        /* is dentry a directory ? if so, kfree() associated cgroup */
-        if (S_ISDIR(inode->i_mode)) {
-                struct cgroup *cgrp = dentry->d_fsdata;
-
-                BUG_ON(!(cgroup_is_dead(cgrp)));
-
-                /*
-                 * XXX: cgrp->id is only used to look up css's.  As cgroup
-                 * and css's lifetimes will be decoupled, it should be made
-                 * per-subsystem and moved to css->id so that lookups are
-                 * successful until the target css is released.
-                 */
-                mutex_lock(&cgroup_mutex);
-                idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
-                mutex_unlock(&cgroup_mutex);
-                cgrp->id = -1;
-
-                call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
-        } else {
-                struct cfent *cfe = __d_cfe(dentry);
-                struct cgroup *cgrp = dentry->d_parent->d_fsdata;
-
-                WARN_ONCE(!list_empty(&cfe->node) &&
-                          cgrp != &cgrp->root->top_cgroup,
-                          "cfe still linked for %s\n", cfe->type->name);
-                simple_xattrs_free(&cfe->xattrs);
-                kfree(cfe);
-        }
-        iput(inode);
-}
-
-static void remove_dir(struct dentry *d)
+static void cgroup_get(struct cgroup *cgrp)
 {
-        struct dentry *parent = dget(d->d_parent);
-
-        d_delete(d);
-        simple_rmdir(parent->d_inode, d);
-        dput(parent);
+        WARN_ON_ONCE(cgroup_is_dead(cgrp));
+        WARN_ON_ONCE(atomic_read(&cgrp->refcnt) <= 0);
+        atomic_inc(&cgrp->refcnt);
 }
 
-static void cgroup_rm_file(struct cgroup *cgrp, const struct cftype *cft)
+static void cgroup_put(struct cgroup *cgrp)
 {
-        struct cfent *cfe;
-
-        lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
-        lockdep_assert_held(&cgroup_mutex);
+        if (!atomic_dec_and_test(&cgrp->refcnt))
+                return;
+        if (WARN_ON_ONCE(cgrp->parent && !cgroup_is_dead(cgrp)))
+                return;
 
         /*
-         * If we're doing cleanup due to failure of cgroup_create(),
-         * the corresponding @cfe may not exist.
+         * XXX: cgrp->id is only used to look up css's.  As cgroup and
+         * css's lifetimes will be decoupled, it should be made
+         * per-subsystem and moved to css->id so that lookups are
+         * successful until the target css is released.
          */
-        list_for_each_entry(cfe, &cgrp->files, node) {
-                struct dentry *d = cfe->dentry;
+        mutex_lock(&cgroup_mutex);
+        idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+        mutex_unlock(&cgroup_mutex);
+        cgrp->id = -1;
 
-                if (cft && cfe->type != cft)
-                        continue;
+        call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
+}
 
-                dget(d);
-                d_delete(d);
-                simple_unlink(cgrp->dentry->d_inode, d);
-                list_del_init(&cfe->node);
-                dput(d);
+static void cgroup_rm_file(struct cgroup *cgrp, const struct cftype *cft)
+{
+        char name[CGROUP_FILE_NAME_MAX];
 
-                break;
-        }
+        lockdep_assert_held(&cgroup_tree_mutex);
+        kernfs_remove_by_name(cgrp->kn, cgroup_file_name(cgrp, cft, name));
 }
 
 /**
@@ -952,144 +970,106 @@ static void cgroup_clear_dir(struct cgroup *cgrp, unsigned long subsys_mask)
         int i;
 
         for_each_subsys(ss, i) {
-                struct cftype_set *set;
+                struct cftype *cfts;
 
                 if (!test_bit(i, &subsys_mask))
                         continue;
-                list_for_each_entry(set, &ss->cftsets, node)
-                        cgroup_addrm_files(cgrp, set->cfts, false);
+                list_for_each_entry(cfts, &ss->cfts, node)
+                        cgroup_addrm_files(cgrp, cfts, false);
         }
 }
 
-/*
- * NOTE : the dentry must have been dget()'ed
- */
-static void cgroup_d_remove_dir(struct dentry *dentry)
-{
-        struct dentry *parent;
-
-        parent = dentry->d_parent;
-        spin_lock(&parent->d_lock);
-        spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
-        list_del_init(&dentry->d_u.d_child);
-        spin_unlock(&dentry->d_lock);
-        spin_unlock(&parent->d_lock);
-        remove_dir(dentry);
-}
-
-/*
- * Call with cgroup_mutex held. Drops reference counts on modules, including
- * any duplicate ones that parse_cgroupfs_options took. If this function
- * returns an error, no reference counts are touched.
- */
-static int rebind_subsystems(struct cgroupfs_root *root,
-                             unsigned long added_mask, unsigned removed_mask)
+static int rebind_subsystems(struct cgroup_root *dst_root,
+                             unsigned long ss_mask)
 {
-        struct cgroup *cgrp = &root->top_cgroup;
         struct cgroup_subsys *ss;
-        unsigned long pinned = 0;
-        int i, ret;
+        int ssid, ret;
 
-        BUG_ON(!mutex_is_locked(&cgroup_mutex));
-        BUG_ON(!mutex_is_locked(&cgroup_root_mutex));
+        lockdep_assert_held(&cgroup_tree_mutex);
+        lockdep_assert_held(&cgroup_mutex);
 
-        /* Check that any added subsystems are currently free */
-        for_each_subsys(ss, i) {
-                if (!(added_mask & (1 << i)))
+        for_each_subsys(ss, ssid) {
+                if (!(ss_mask & (1 << ssid)))
                         continue;
 
-                /* is the subsystem mounted elsewhere? */
-                if (ss->root != &cgroup_dummy_root) {
-                        ret = -EBUSY;
-                        goto out_put;
-                }
+                /* if @ss is on the dummy_root, we can always move it */
+                if (ss->root == &cgrp_dfl_root)
+                        continue;
 
-                /* pin the module */
-                if (!try_module_get(ss->module)) {
-                        ret = -ENOENT;
-                        goto out_put;
-                }
-                pinned |= 1 << i;
-        }
+                /* if @ss has non-root cgroups attached to it, can't move */
+                if (!list_empty(&ss->root->cgrp.children))
+                        return -EBUSY;
 
-        /* subsys could be missing if unloaded between parsing and here */
-        if (added_mask != pinned) {
-                ret = -ENOENT;
-                goto out_put;
+                /* can't move between two non-dummy roots either */
+                if (dst_root != &cgrp_dfl_root)
+                        return -EBUSY;
         }
 
-        ret = cgroup_populate_dir(cgrp, added_mask);
-        if (ret)
-                goto out_put;
+        ret = cgroup_populate_dir(&dst_root->cgrp, ss_mask);
+        if (ret) {
+                if (dst_root != &cgrp_dfl_root)
+                        return ret;
+
+                /*
+                 * Rebinding back to the default root is not allowed to
+                 * fail.  Using both default and non-default roots should
+                 * be rare.  Moving subsystems back and forth even more so.
+                 * Just warn about it and continue.
+                 */
+                if (cgrp_dfl_root_visible) {
+                        pr_warning("cgroup: failed to create files (%d) while rebinding 0x%lx to default root\n",
+                                   ret, ss_mask);
+                        pr_warning("cgroup: you may retry by moving them to a different hierarchy and unbinding\n");
+                }
+        }
 
         /*
          * Nothing can fail from this point on.  Remove files for the
          * removed subsystems and rebind each subsystem.
          */
-        cgroup_clear_dir(cgrp, removed_mask);
-
-        for_each_subsys(ss, i) {
-                unsigned long bit = 1UL << i;
-
-                if (bit & added_mask) {
-                        /* We're binding this subsystem to this hierarchy */
-                        BUG_ON(cgroup_css(cgrp, ss));
-                        BUG_ON(!cgroup_css(cgroup_dummy_top, ss));
-                        BUG_ON(cgroup_css(cgroup_dummy_top, ss)->cgroup != cgroup_dummy_top);
+        mutex_unlock(&cgroup_mutex);
+        for_each_subsys(ss, ssid)
+                if (ss_mask & (1 << ssid))
+                        cgroup_clear_dir(&ss->root->cgrp, 1 << ssid);
+        mutex_lock(&cgroup_mutex);
 
-                        rcu_assign_pointer(cgrp->subsys[i],
-                                           cgroup_css(cgroup_dummy_top, ss));
-                        cgroup_css(cgrp, ss)->cgroup = cgrp;
+        for_each_subsys(ss, ssid) {
+                struct cgroup_root *src_root;
+                struct cgroup_subsys_state *css;
 
-                        ss->root = root;
-                        if (ss->bind)
-                                ss->bind(cgroup_css(cgrp, ss));
+                if (!(ss_mask & (1 << ssid)))
+                        continue;
 
-                        /* refcount was already taken, and we're keeping it */
-                        root->subsys_mask |= bit;
-                } else if (bit & removed_mask) {
-                        /* We're removing this subsystem */
-                        BUG_ON(cgroup_css(cgrp, ss) != cgroup_css(cgroup_dummy_top, ss));
-                        BUG_ON(cgroup_css(cgrp, ss)->cgroup != cgrp);
+                src_root = ss->root;
+                css = cgroup_css(&src_root->cgrp, ss);
 
-                        if (ss->bind)
-                                ss->bind(cgroup_css(cgroup_dummy_top, ss));
+                WARN_ON(!css || cgroup_css(&dst_root->cgrp, ss));
 
-                        cgroup_css(cgroup_dummy_top, ss)->cgroup = cgroup_dummy_top;
-                        RCU_INIT_POINTER(cgrp->subsys[i], NULL);
+                RCU_INIT_POINTER(src_root->cgrp.subsys[ssid], NULL);
+                rcu_assign_pointer(dst_root->cgrp.subsys[ssid], css);
+                ss->root = dst_root;
+                css->cgroup = &dst_root->cgrp;
 
-                        cgroup_subsys[i]->root = &cgroup_dummy_root;
+                src_root->cgrp.subsys_mask &= ~(1 << ssid);
+                dst_root->cgrp.subsys_mask |= 1 << ssid;
 
-                        /* subsystem is now free - drop reference on module */
-                        module_put(ss->module);
-                        root->subsys_mask &= ~bit;
-                }
+                if (ss->bind)
+                        ss->bind(css);
         }
 
-        /*
-         * Mark @root has finished binding subsystems.  @root->subsys_mask
-         * now matches the bound subsystems.
-         */
-        root->flags |= CGRP_ROOT_SUBSYS_BOUND;
-
+        kernfs_activate(dst_root->cgrp.kn);
         return 0;
-
-out_put:
-        for_each_subsys(ss, i)
-                if (pinned & (1 << i))
-                        module_put(ss->module);
-        return ret;
 }
 
-static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
+static int cgroup_show_options(struct seq_file *seq,
+                               struct kernfs_root *kf_root)
 {
-        struct cgroupfs_root *root = dentry->d_sb->s_fs_info;
+        struct cgroup_root *root = cgroup_root_from_kf(kf_root);
         struct cgroup_subsys *ss;
         int ssid;
 
-        mutex_lock(&cgroup_root_mutex);
         for_each_subsys(ss, ssid)
-                if (root->subsys_mask & (1 << ssid))
+                if (root->cgrp.subsys_mask & (1 << ssid))
                         seq_printf(seq, ",%s", ss->name);
         if (root->flags & CGRP_ROOT_SANE_BEHAVIOR)
                 seq_puts(seq, ",sane_behavior");
@@ -1097,13 +1077,16 @@ static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
                 seq_puts(seq, ",noprefix");
         if (root->flags & CGRP_ROOT_XATTR)
                 seq_puts(seq, ",xattr");
+
+        spin_lock(&release_agent_path_lock);
         if (strlen(root->release_agent_path))
                 seq_printf(seq, ",release_agent=%s", root->release_agent_path);
-        if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags))
+        spin_unlock(&release_agent_path_lock);
+
+        if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags))
                 seq_puts(seq, ",clone_children");
         if (strlen(root->name))
                 seq_printf(seq, ",name=%s", root->name);
-        mutex_unlock(&cgroup_root_mutex);
         return 0;
 }
 
@@ -1115,9 +1098,6 @@ struct cgroup_sb_opts {
         char *name;
         /* User explicitly requested empty subsystem */
         bool none;
-
-        struct cgroupfs_root *new_root;
-
 };
 
 /*
@@ -1137,7 +1117,7 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
         BUG_ON(!mutex_is_locked(&cgroup_mutex));
 
 #ifdef CONFIG_CPUSETS
-        mask = ~(1UL << cpuset_subsys_id);
+        mask = ~(1UL << cpuset_cgrp_id);
 #endif
 
         memset(opts, 0, sizeof(*opts));
@@ -1227,30 +1207,34 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
                         return -ENOENT;
         }
 
-        /*
-         * If the 'all' option was specified select all the subsystems,
-         * otherwise if 'none', 'name=' and a subsystem name options
-         * were not specified, let's default to 'all'
-         */
-        if (all_ss || (!one_ss && !opts->none && !opts->name))
-                for_each_subsys(ss, i)
-                        if (!ss->disabled)
-                                set_bit(i, &opts->subsys_mask);
-
         /* Consistency checks */
 
         if (opts->flags & CGRP_ROOT_SANE_BEHAVIOR) {
                 pr_warning("cgroup: sane_behavior: this is still under development and its behaviors will change, proceed at your own risk\n");
 
-                if (opts->flags & CGRP_ROOT_NOPREFIX) {
-                        pr_err("cgroup: sane_behavior: noprefix is not allowed\n");
+                if ((opts->flags & (CGRP_ROOT_NOPREFIX | CGRP_ROOT_XATTR)) ||
+                    opts->cpuset_clone_children || opts->release_agent ||
+                    opts->name) {
+                        pr_err("cgroup: sane_behavior: noprefix, xattr, clone_children, release_agent and name are not allowed\n");
                         return -EINVAL;
                 }
+        } else {
+                /*
+                 * If the 'all' option was specified select all the
+                 * subsystems, otherwise if 'none', 'name=' and a subsystem
+                 * name options were not specified, let's default to 'all'
+                 */
+                if (all_ss || (!one_ss && !opts->none && !opts->name))
+                        for_each_subsys(ss, i)
+                                if (!ss->disabled)
+                                        set_bit(i, &opts->subsys_mask);
 
-                if (opts->cpuset_clone_children) {
-                        pr_err("cgroup: sane_behavior: clone_children is not allowed\n");
+                /*
+                 * We either have to specify by name or by subsystems. (So
+                 * all empty hierarchies must have a name).
+                 */
+                if (!opts->subsys_mask && !opts->name)
                         return -EINVAL;
-                }
         }
 
         /*
@@ -1266,21 +1250,13 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
         if (opts->subsys_mask && opts->none)
                 return -EINVAL;
 
-        /*
-         * We either have to specify by name or by subsystems. (So all
-         * empty hierarchies must have a name).
-         */
-        if (!opts->subsys_mask && !opts->name)
-                return -EINVAL;
-
         return 0;
 }
 
-static int cgroup_remount(struct super_block *sb, int *flags, char *data)
+static int cgroup_remount(struct kernfs_root *kf_root, int *flags, char *data)
 {
         int ret = 0;
-        struct cgroupfs_root *root = sb->s_fs_info;
-        struct cgroup *cgrp = &root->top_cgroup;
+        struct cgroup_root *root = cgroup_root_from_kf(kf_root);
         struct cgroup_sb_opts opts;
         unsigned long added_mask, removed_mask;
 
@@ -1289,21 +1265,20 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
                 return -EINVAL;
         }
 
-        mutex_lock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_lock(&cgroup_tree_mutex);
         mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
 
         /* See what subsystems are wanted */
         ret = parse_cgroupfs_options(data, &opts);
         if (ret)
                 goto out_unlock;
 
-        if (opts.subsys_mask != root->subsys_mask || opts.release_agent)
+        if (opts.subsys_mask != root->cgrp.subsys_mask || opts.release_agent)
                 pr_warning("cgroup: option changes via remount are deprecated (pid=%d comm=%s)\n",
                            task_tgid_nr(current), current->comm);
 
-        added_mask = opts.subsys_mask & ~root->subsys_mask;
-        removed_mask = root->subsys_mask & ~opts.subsys_mask;
+        added_mask = opts.subsys_mask & ~root->cgrp.subsys_mask;
+        removed_mask = root->cgrp.subsys_mask & ~opts.subsys_mask;
 
         /* Don't allow flags or name to change at remount */
         if (((opts.flags ^ root->flags) & CGRP_ROOT_OPTION_MASK) ||
@@ -1316,422 +1291,332 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
         }
 
         /* remounting is not allowed for populated hierarchies */
-        if (root->number_of_cgroups > 1) {
+        if (!list_empty(&root->cgrp.children)) {
                 ret = -EBUSY;
                 goto out_unlock;
         }
 
-        ret = rebind_subsystems(root, added_mask, removed_mask);
+        ret = rebind_subsystems(root, added_mask);
         if (ret)
                 goto out_unlock;
 
-        if (opts.release_agent)
+        rebind_subsystems(&cgrp_dfl_root, removed_mask);
+
+        if (opts.release_agent) {
+                spin_lock(&release_agent_path_lock);
                 strcpy(root->release_agent_path, opts.release_agent);
+                spin_unlock(&release_agent_path_lock);
+        }
  out_unlock:
         kfree(opts.release_agent);
         kfree(opts.name);
-        mutex_unlock(&cgroup_root_mutex);
         mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
         return ret;
 }
 
-static const struct super_operations cgroup_ops = {
-        .statfs = simple_statfs,
-        .drop_inode = generic_delete_inode,
-        .show_options = cgroup_show_options,
-        .remount_fs = cgroup_remount,
-};
+/*
+ * To reduce the fork() overhead for systems that are not actually using
+ * their cgroups capability, we don't maintain the lists running through
+ * each css_set to its tasks until we see the list actually used - in other
+ * words after the first mount.
+ */
+static bool use_task_css_set_links __read_mostly;
+
+static void cgroup_enable_task_cg_lists(void)
+{
+        struct task_struct *p, *g;
+
+        down_write(&css_set_rwsem);
+
+        if (use_task_css_set_links)
+                goto out_unlock;
+
+        use_task_css_set_links = true;
+
+        /*
+         * We need tasklist_lock because RCU is not safe against
+         * while_each_thread(). Besides, a forking task that has passed
+         * cgroup_post_fork() without seeing use_task_css_set_links = 1
+         * is not guaranteed to have its child immediately visible in the
+         * tasklist if we walk through it with RCU.
+         */
+        read_lock(&tasklist_lock);
+        do_each_thread(g, p) {
+                WARN_ON_ONCE(!list_empty(&p->cg_list) ||
+                             task_css_set(p) != &init_css_set);
+
+                /*
+                 * We should check if the process is exiting, otherwise
+                 * it will race with cgroup_exit() in that the list
+                 * entry won't be deleted though the process has exited.
+                 * Do it while holding siglock so that we don't end up
+                 * racing against cgroup_exit().
+                 */
+                spin_lock_irq(&p->sighand->siglock);
+                if (!(p->flags & PF_EXITING)) {
+                        struct css_set *cset = task_css_set(p);
+
+                        list_add(&p->cg_list, &cset->tasks);
+                        get_css_set(cset);
+                }
+                spin_unlock_irq(&p->sighand->siglock);
+        } while_each_thread(g, p);
+        read_unlock(&tasklist_lock);
+out_unlock:
+        up_write(&css_set_rwsem);
+}
 
 static void init_cgroup_housekeeping(struct cgroup *cgrp)
 {
+        atomic_set(&cgrp->refcnt, 1);
         INIT_LIST_HEAD(&cgrp->sibling);
         INIT_LIST_HEAD(&cgrp->children);
-        INIT_LIST_HEAD(&cgrp->files);
         INIT_LIST_HEAD(&cgrp->cset_links);
         INIT_LIST_HEAD(&cgrp->release_list);
         INIT_LIST_HEAD(&cgrp->pidlists);
         mutex_init(&cgrp->pidlist_mutex);
         cgrp->dummy_css.cgroup = cgrp;
-        simple_xattrs_init(&cgrp->xattrs);
 }
 
-static void init_cgroup_root(struct cgroupfs_root *root)
+static void init_cgroup_root(struct cgroup_root *root,
+                             struct cgroup_sb_opts *opts)
 {
-        struct cgroup *cgrp = &root->top_cgroup;
+        struct cgroup *cgrp = &root->cgrp;
 
         INIT_LIST_HEAD(&root->root_list);
-        root->number_of_cgroups = 1;
+        atomic_set(&root->nr_cgrps, 1);
         cgrp->root = root;
-        RCU_INIT_POINTER(cgrp->name, &root_cgroup_name);
         init_cgroup_housekeeping(cgrp);
         idr_init(&root->cgroup_idr);
-}
-
-static int cgroup_init_root_id(struct cgroupfs_root *root, int start, int end)
-{
-        int id;
 
-        lockdep_assert_held(&cgroup_mutex);
-        lockdep_assert_held(&cgroup_root_mutex);
-
-        id = idr_alloc_cyclic(&cgroup_hierarchy_idr, root, start, end,
-                              GFP_KERNEL);
-        if (id < 0)
-                return id;
-
-        root->hierarchy_id = id;
-        return 0;
-}
-
-static void cgroup_exit_root_id(struct cgroupfs_root *root)
-{
-        lockdep_assert_held(&cgroup_mutex);
-        lockdep_assert_held(&cgroup_root_mutex);
-
-        if (root->hierarchy_id) {
-                idr_remove(&cgroup_hierarchy_idr, root->hierarchy_id);
-                root->hierarchy_id = 0;
-        }
-}
-
-static int cgroup_test_super(struct super_block *sb, void *data)
-{
-        struct cgroup_sb_opts *opts = data;
-        struct cgroupfs_root *root = sb->s_fs_info;
-
-        /* If we asked for a name then it must match */
-        if (opts->name && strcmp(opts->name, root->name))
-                return 0;
-
-        /*
-         * If we asked for subsystems (or explicitly for no
-         * subsystems) then they must match
-         */
-        if ((opts->subsys_mask || opts->none)
-            && (opts->subsys_mask != root->subsys_mask))
-                return 0;
-
-        return 1;
-}
-
-static struct cgroupfs_root *cgroup_root_from_opts(struct cgroup_sb_opts *opts)
-{
-        struct cgroupfs_root *root;
-
-        if (!opts->subsys_mask && !opts->none)
-                return NULL;
-
-        root = kzalloc(sizeof(*root), GFP_KERNEL);
-        if (!root)
-                return ERR_PTR(-ENOMEM);
-
-        init_cgroup_root(root);
-
-        /*
-         * We need to set @root->subsys_mask now so that @root can be
-         * matched by cgroup_test_super() before it finishes
-         * initialization; otherwise, competing mounts with the same
-         * options may try to bind the same subsystems instead of waiting
-         * for the first one leading to unexpected mount errors.
-         * SUBSYS_BOUND will be set once actual binding is complete.
-         */
-        root->subsys_mask = opts->subsys_mask;
         root->flags = opts->flags;
         if (opts->release_agent)
                 strcpy(root->release_agent_path, opts->release_agent);
         if (opts->name)
                 strcpy(root->name, opts->name);
         if (opts->cpuset_clone_children)
-                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags);
-        return root;
+                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);
 }
 
-static void cgroup_free_root(struct cgroupfs_root *root)
+static int cgroup_setup_root(struct cgroup_root *root, unsigned long ss_mask)
 {
-        if (root) {
-                /* hierarhcy ID shoulid already have been released */
-                WARN_ON_ONCE(root->hierarchy_id);
-
-                idr_destroy(&root->cgroup_idr);
-                kfree(root);
-        }
-}
+        LIST_HEAD(tmp_links);
+        struct cgroup *root_cgrp = &root->cgrp;
+        struct css_set *cset;
+        int i, ret;
 
-static int cgroup_set_super(struct super_block *sb, void *data)
-{
-        int ret;
-        struct cgroup_sb_opts *opts = data;
+        lockdep_assert_held(&cgroup_tree_mutex);
+        lockdep_assert_held(&cgroup_mutex);
 
-        /* If we don't have a new root, we can't set up a new sb */
-        if (!opts->new_root)
-                return -EINVAL;
+        ret = idr_alloc(&root->cgroup_idr, root_cgrp, 0, 1, GFP_KERNEL);
+        if (ret < 0)
+                goto out;
+        root_cgrp->id = ret;
 
-        BUG_ON(!opts->subsys_mask && !opts->none);
+        /*
+         * We're accessing css_set_count without locking css_set_rwsem here,
+         * but that's OK - it can only be increased by someone holding
+         * cgroup_lock, and that's us. The worst that can happen is that we
+         * have some link structures left over
+         */
+        ret = allocate_cgrp_cset_links(css_set_count, &tmp_links);
+        if (ret)
+                goto out;
 
-        ret = set_anon_super(sb, NULL);
+        ret = cgroup_init_root_id(root);
         if (ret)
-                return ret;
+                goto out;
 
-        sb->s_fs_info = opts->new_root;
-        opts->new_root->sb = sb;
+        root->kf_root = kernfs_create_root(&cgroup_kf_syscall_ops,
+                                           KERNFS_ROOT_CREATE_DEACTIVATED,
+                                           root_cgrp);
+        if (IS_ERR(root->kf_root)) {
+                ret = PTR_ERR(root->kf_root);
+                goto exit_root_id;
+        }
+        root_cgrp->kn = root->kf_root->kn;
 
-        sb->s_blocksize = PAGE_CACHE_SIZE;
-        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
-        sb->s_magic = CGROUP_SUPER_MAGIC;
-        sb->s_op = &cgroup_ops;
+        ret = cgroup_addrm_files(root_cgrp, cgroup_base_files, true);
+        if (ret)
+                goto destroy_root;
 
-        return 0;
-}
+        ret = rebind_subsystems(root, ss_mask);
+        if (ret)
+                goto destroy_root;
 
-static int cgroup_get_rootdir(struct super_block *sb)
-{
-        static const struct dentry_operations cgroup_dops = {
-                .d_iput = cgroup_diput,
-                .d_delete = always_delete_dentry,
-        };
+        /*
+         * There must be no failure case after here, since rebinding takes
+         * care of subsystems' refcounts, which are explicitly dropped in
+         * the failure exit path.
+         */
+        list_add(&root->root_list, &cgroup_roots);
+        cgroup_root_count++;
 
-        struct inode *inode =
-                cgroup_new_inode(S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR, sb);
+        /*
+         * Link the root cgroup in this hierarchy into all the css_set
+         * objects.
+         */
+        down_write(&css_set_rwsem);
+        hash_for_each(css_set_table, i, cset, hlist)
+                link_css_set(&tmp_links, cset, root_cgrp);
+        up_write(&css_set_rwsem);
 
-        if (!inode)
-                return -ENOMEM;
+        BUG_ON(!list_empty(&root_cgrp->children));
+        BUG_ON(atomic_read(&root->nr_cgrps) != 1);
 
-        inode->i_fop = &simple_dir_operations;
-        inode->i_op = &cgroup_dir_inode_operations;
-        /* directories start off with i_nlink == 2 (for "." entry) */
-        inc_nlink(inode);
-        sb->s_root = d_make_root(inode);
-        if (!sb->s_root)
-                return -ENOMEM;
-        /* for everything else we want ->d_op set */
-        sb->s_d_op = &cgroup_dops;
-        return 0;
+        kernfs_activate(root_cgrp->kn);
+        ret = 0;
+        goto out;
+
+destroy_root:
+        kernfs_destroy_root(root->kf_root);
+        root->kf_root = NULL;
+exit_root_id:
+        cgroup_exit_root_id(root);
+out:
+        free_cgrp_cset_links(&tmp_links);
+        return ret;
 }
 
 static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                          int flags, const char *unused_dev_name,
                          void *data)
 {
+        struct cgroup_root *root;
         struct cgroup_sb_opts opts;
-        struct cgroupfs_root *root;
-        int ret = 0;
-        struct super_block *sb;
-        struct cgroupfs_root *new_root;
-        struct list_head tmp_links;
-        struct inode *inode;
-        const struct cred *cred;
+        struct dentry *dentry;
+        int ret;
+        bool new_sb;
 
-        /* First find the desired set of subsystems */
+        /*
+         * The first time anyone tries to mount a cgroup, enable the list
+         * linking each css_set to its tasks and fix up all existing tasks.
+         */
+        if (!use_task_css_set_links)
+                cgroup_enable_task_cg_lists();
+retry:
+        mutex_lock(&cgroup_tree_mutex);
         mutex_lock(&cgroup_mutex);
+
+        /* First find the desired set of subsystems */
         ret = parse_cgroupfs_options(data, &opts);
-        mutex_unlock(&cgroup_mutex);
         if (ret)
-                goto out_err;
-
-        /*
-         * Allocate a new cgroup root. We may not need it if we're
-         * reusing an existing hierarchy.
-         */
-        new_root = cgroup_root_from_opts(&opts);
-        if (IS_ERR(new_root)) {
-                ret = PTR_ERR(new_root);
-                goto out_err;
-        }
-        opts.new_root = new_root;
+                goto out_unlock;
 
-        /* Locate an existing or new sb for this hierarchy */
-        sb = sget(fs_type, cgroup_test_super, cgroup_set_super, 0, &opts);
-        if (IS_ERR(sb)) {
-                ret = PTR_ERR(sb);
-                cgroup_free_root(opts.new_root);
-                goto out_err;
+        /* look for a matching existing root */
+        if (!opts.subsys_mask && !opts.none && !opts.name) {
+                cgrp_dfl_root_visible = true;
+                root = &cgrp_dfl_root;
+                cgroup_get(&root->cgrp);
+                ret = 0;
+                goto out_unlock;
         }
 
-        root = sb->s_fs_info;
-        BUG_ON(!root);
-        if (root == opts.new_root) {
-                /* We used the new root structure, so this is a new hierarchy */
-                struct cgroup *root_cgrp = &root->top_cgroup;
-                struct cgroupfs_root *existing_root;
-                int i;
-                struct css_set *cset;
-
-                BUG_ON(sb->s_root != NULL);
+        for_each_root(root) {
+                bool name_match = false;
 
-                ret = cgroup_get_rootdir(sb);
-                if (ret)
-                        goto drop_new_super;
-                inode = sb->s_root->d_inode;
-
-                mutex_lock(&inode->i_mutex);
-                mutex_lock(&cgroup_mutex);
-                mutex_lock(&cgroup_root_mutex);
-
-                ret = idr_alloc(&root->cgroup_idr, root_cgrp, 0, 1, GFP_KERNEL);
-                if (ret < 0)
-                        goto unlock_drop;
-                root_cgrp->id = ret;
-
-                /* Check for name clashes with existing mounts */
-                ret = -EBUSY;
-                if (strlen(root->name))
-                        for_each_active_root(existing_root)
-                                if (!strcmp(existing_root->name, root->name))
-                                        goto unlock_drop;
-
-                /*
-                 * We're accessing css_set_count without locking
-                 * css_set_lock here, but that's OK - it can only be
-                 * increased by someone holding cgroup_lock, and
-                 * that's us. The worst that can happen is that we
-                 * have some link structures left over
-                 */
-                ret = allocate_cgrp_cset_links(css_set_count, &tmp_links);
-                if (ret)
-                        goto unlock_drop;
-
-                /* ID 0 is reserved for dummy root, 1 for unified hierarchy */
-                ret = cgroup_init_root_id(root, 2, 0);
-                if (ret)
-                        goto unlock_drop;
-
-                sb->s_root->d_fsdata = root_cgrp;
-                root_cgrp->dentry = sb->s_root;
-
-                /*
-                 * We're inside get_sb() and will call lookup_one_len() to
-                 * create the root files, which doesn't work if SELinux is
-                 * in use.  The following cred dancing somehow works around
-                 * it.  See 2ce9738ba ("cgroupfs: use init_cred when
-                 * populating new cgroupfs mount") for more details.
-                 */
-                cred = override_creds(&init_cred);
-
-                ret = cgroup_addrm_files(root_cgrp, cgroup_base_files, true);
-                if (ret)
-                        goto rm_base_files;
-
-                ret = rebind_subsystems(root, root->subsys_mask, 0);
-                if (ret)
-                        goto rm_base_files;
-
-                revert_creds(cred);
+                if (root == &cgrp_dfl_root)
+                        continue;
 
                 /*
-                 * There must be no failure case after here, since rebinding
-                 * takes care of subsystems' refcounts, which are explicitly
-                 * dropped in the failure exit path.
+                 * If we asked for a name then it must match.  Also, if
+                 * name matches but sybsys_mask doesn't, we should fail.
+                 * Remember whether name matched.
                  */
+                if (opts.name) {
+                        if (strcmp(opts.name, root->name))
+                                continue;
+                        name_match = true;
+                }
 
-                list_add(&root->root_list, &cgroup_roots);
-                cgroup_root_count++;
-
-                /* Link the top cgroup in this hierarchy into all
-                 * the css_set objects */
-                write_lock(&css_set_lock);
-                hash_for_each(css_set_table, i, cset, hlist)
-                        link_css_set(&tmp_links, cset, root_cgrp);
-                write_unlock(&css_set_lock);
-
-                free_cgrp_cset_links(&tmp_links);
-
-                BUG_ON(!list_empty(&root_cgrp->children));
-                BUG_ON(root->number_of_cgroups != 1);
-
-                mutex_unlock(&cgroup_root_mutex);
-                mutex_unlock(&cgroup_mutex);
-                mutex_unlock(&inode->i_mutex);
-        } else {
                 /*
-                 * We re-used an existing hierarchy - the new root (if
-                 * any) is not needed
+                 * If we asked for subsystems (or explicitly for no
+                 * subsystems) then they must match.
                  */
-                cgroup_free_root(opts.new_root);
+                if ((opts.subsys_mask || opts.none) &&
+                    (opts.subsys_mask != root->cgrp.subsys_mask)) {
+                        if (!name_match)
+                                continue;
+                        ret = -EBUSY;
+                        goto out_unlock;
+                }
 
                 if ((root->flags ^ opts.flags) & CGRP_ROOT_OPTION_MASK) {
                         if ((root->flags | opts.flags) & CGRP_ROOT_SANE_BEHAVIOR) {
                                 pr_err("cgroup: sane_behavior: new mount options should match the existing superblock\n");
                                 ret = -EINVAL;
-                                goto drop_new_super;
+                                goto out_unlock;
                         } else {
                                 pr_warning("cgroup: new mount options do not match the existing superblock, will be ignored\n");
                         }
                 }
-        }
-
-        kfree(opts.release_agent);
-        kfree(opts.name);
-        return dget(sb->s_root);
 
- rm_base_files:
-        free_cgrp_cset_links(&tmp_links);
-        cgroup_addrm_files(&root->top_cgroup, cgroup_base_files, false);
-        revert_creds(cred);
- unlock_drop:
-        cgroup_exit_root_id(root);
-        mutex_unlock(&cgroup_root_mutex);
-        mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&inode->i_mutex);
- drop_new_super:
-        deactivate_locked_super(sb);
- out_err:
-        kfree(opts.release_agent);
-        kfree(opts.name);
-        return ERR_PTR(ret);
-}
-
-static void cgroup_kill_sb(struct super_block *sb)
-{
-        struct cgroupfs_root *root = sb->s_fs_info;
-        struct cgroup *cgrp = &root->top_cgroup;
-        struct cgrp_cset_link *link, *tmp_link;
-        int ret;
-
-        BUG_ON(!root);
-
-        BUG_ON(root->number_of_cgroups != 1);
-        BUG_ON(!list_empty(&cgrp->children));
-
-        mutex_lock(&cgrp->dentry->d_inode->i_mutex);
-        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
+                /*
+                 * A root's lifetime is governed by its root cgroup.  Zero
+                 * ref indicate that the root is being destroyed.  Wait for
+                 * destruction to complete so that the subsystems are free.
+                 * We can use wait_queue for the wait but this path is
+                 * super cold.  Let's just sleep for a bit and retry.
+                 */
+                if (!atomic_inc_not_zero(&root->cgrp.refcnt)) {
+                        mutex_unlock(&cgroup_mutex);
+                        mutex_unlock(&cgroup_tree_mutex);
+                        kfree(opts.release_agent);
+                        kfree(opts.name);
+                        msleep(10);
+                        goto retry;
+                }
 
-        /* Rebind all subsystems back to the default hierarchy */
-        if (root->flags & CGRP_ROOT_SUBSYS_BOUND) {
-                ret = rebind_subsystems(root, 0, root->subsys_mask);
-                /* Shouldn't be able to fail ... */
-                BUG_ON(ret);
+                ret = 0;
+                goto out_unlock;
         }
 
         /*
-         * Release all the links from cset_links to this hierarchy's
-         * root cgroup
+         * No such thing, create a new one.  name= matching without subsys
+         * specification is allowed for already existing hierarchies but we
+         * can't create new one without subsys specification.
          */
-        write_lock(&css_set_lock);
-
-        list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
-                list_del(&link->cset_link);
-                list_del(&link->cgrp_link);
-                kfree(link);
+        if (!opts.subsys_mask && !opts.none) {
+                ret = -EINVAL;
+                goto out_unlock;
         }
-        write_unlock(&css_set_lock);
 
-        if (!list_empty(&root->root_list)) {
-                list_del(&root->root_list);
-                cgroup_root_count--;
+        root = kzalloc(sizeof(*root), GFP_KERNEL);
+        if (!root) {
+                ret = -ENOMEM;
+                goto out_unlock;
         }
 
-        cgroup_exit_root_id(root);
+        init_cgroup_root(root, &opts);
+
+        ret = cgroup_setup_root(root, opts.subsys_mask);
+        if (ret)
+                cgroup_free_root(root);
 
-        mutex_unlock(&cgroup_root_mutex);
+out_unlock:
         mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
+
+        kfree(opts.release_agent);
+        kfree(opts.name);
 
-        simple_xattrs_free(&cgrp->xattrs);
+        if (ret)
+                return ERR_PTR(ret);
 
-        kill_litter_super(sb);
-        cgroup_free_root(root);
+        dentry = kernfs_mount(fs_type, flags, root->kf_root, &new_sb);
+        if (IS_ERR(dentry) || !new_sb)
+                cgroup_put(&root->cgrp);
+        return dentry;
+}
+
+static void cgroup_kill_sb(struct super_block *sb)
+{
+        struct kernfs_root *kf_root = kernfs_root_from_sb(sb);
+        struct cgroup_root *root = cgroup_root_from_kf(kf_root);
+
+        cgroup_put(&root->cgrp);
+        kernfs_kill_sb(sb);
 }
 
 static struct file_system_type cgroup_fs_type = {
@@ -1743,57 +1628,6 @@ static struct file_system_type cgroup_fs_type = {
 static struct kobject *cgroup_kobj;
 
 /**
- * cgroup_path - generate the path of a cgroup
- * @cgrp: the cgroup in question
- * @buf: the buffer to write the path into
- * @buflen: the length of the buffer
- *
- * Writes path of cgroup into buf.  Returns 0 on success, -errno on error.
- *
- * We can't generate cgroup path using dentry->d_name, as accessing
- * dentry->name must be protected by irq-unsafe dentry->d_lock or parent
- * inode's i_mutex, while on the other hand cgroup_path() can be called
- * with some irq-safe spinlocks held.
- */
-int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
-{
-        int ret = -ENAMETOOLONG;
-        char *start;
-
-        if (!cgrp->parent) {
-                if (strlcpy(buf, "/", buflen) >= buflen)
-                        return -ENAMETOOLONG;
-                return 0;
-        }
-
-        start = buf + buflen - 1;
-        *start = '\0';
-
-        rcu_read_lock();
-        do {
-                const char *name = cgroup_name(cgrp);
-                int len;
-
-                len = strlen(name);
-                if ((start -= len) < buf)
-                        goto out;
-                memcpy(start, name, len);
-
-                if (--start < buf)
-                        goto out;
-                *start = '/';
-
-                cgrp = cgrp->parent;
-        } while (cgrp->parent);
-        ret = 0;
-        memmove(buf, start, buf + buflen - start);
-out:
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cgroup_path);
-
-/**
  * task_cgroup_path - cgroup path of a task in the first cgroup hierarchy
  * @task: target task
  * @buf: the buffer to write the path into
@@ -1804,49 +1638,55 @@ EXPORT_SYMBOL_GPL(cgroup_path);
  * function grabs cgroup_mutex and shouldn't be used inside locks used by
  * cgroup controller callbacks.
  *
- * Returns 0 on success, fails with -%ENAMETOOLONG if @buflen is too short.
+ * Return value is the same as kernfs_path().
  */
-int task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
+char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
 {
-        struct cgroupfs_root *root;
+        struct cgroup_root *root;
         struct cgroup *cgrp;
-        int hierarchy_id = 1, ret = 0;
-
-        if (buflen < 2)
-                return -ENAMETOOLONG;
+        int hierarchy_id = 1;
+        char *path = NULL;
 
         mutex_lock(&cgroup_mutex);
+        down_read(&css_set_rwsem);
 
         root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id);
 
         if (root) {
                 cgrp = task_cgroup_from_root(task, root);
-                ret = cgroup_path(cgrp, buf, buflen);
+                path = cgroup_path(cgrp, buf, buflen);
         } else {
                 /* if no hierarchy exists, everyone is in "/" */
-                memcpy(buf, "/", 2);
+                if (strlcpy(buf, "/", buflen) < buflen)
+                        path = buf;
         }
 
+        up_read(&css_set_rwsem);
         mutex_unlock(&cgroup_mutex);
-        return ret;
+        return path;
 }
 EXPORT_SYMBOL_GPL(task_cgroup_path);
 
-/*
- * Control Group taskset
- */
-struct task_and_cgroup {
-        struct task_struct      *task;
-        struct cgroup           *cgrp;
-        struct css_set          *cset;
-};
-
+/* used to track tasks and other necessary states during migration */
 struct cgroup_taskset {
-        struct task_and_cgroup  single;
-        struct flex_array       *tc_array;
-        int                     tc_array_len;
-        int                     idx;
-        struct cgroup           *cur_cgrp;
+        /* the src and dst cset list running through cset->mg_node */
+        struct list_head        src_csets;
+        struct list_head        dst_csets;
+
+        /*
+         * Fields for cgroup_taskset_*() iteration.
+         *
+         * Before migration is committed, the target migration tasks are on
+         * ->mg_tasks of the csets on ->src_csets.  After, on ->mg_tasks of
+         * the csets on ->dst_csets.  ->csets point to either ->src_csets
+         * or ->dst_csets depending on whether migration is committed.
+         *
+         * ->cur_csets and ->cur_task point to the current task position
+         * during iteration.
+         */
+        struct list_head        *csets;
+        struct css_set          *cur_cset;
+        struct task_struct      *cur_task;
 };
 
 /**
@@ -1857,15 +1697,11 @@ struct cgroup_taskset {
  */
 struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset)
 {
-        if (tset->tc_array) {
-                tset->idx = 0;
-                return cgroup_taskset_next(tset);
-        } else {
-                tset->cur_cgrp = tset->single.cgrp;
-                return tset->single.task;
-        }
+        tset->cur_cset = list_first_entry(tset->csets, struct css_set, mg_node);
+        tset->cur_task = NULL;
+
+        return cgroup_taskset_next(tset);
 }
-EXPORT_SYMBOL_GPL(cgroup_taskset_first);
 
 /**
  * cgroup_taskset_next - iterate to the next task in taskset
@@ -1876,48 +1712,36 @@ EXPORT_SYMBOL_GPL(cgroup_taskset_first);
  */
 struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset)
 {
-        struct task_and_cgroup *tc;
+        struct css_set *cset = tset->cur_cset;
+        struct task_struct *task = tset->cur_task;
 
-        if (!tset->tc_array || tset->idx >= tset->tc_array_len)
-                return NULL;
+        while (&cset->mg_node != tset->csets) {
+                if (!task)
+                        task = list_first_entry(&cset->mg_tasks,
+                                                struct task_struct, cg_list);
+                else
+                        task = list_next_entry(task, cg_list);
 
-        tc = flex_array_get(tset->tc_array, tset->idx++);
-        tset->cur_cgrp = tc->cgrp;
-        return tc->task;
-}
-EXPORT_SYMBOL_GPL(cgroup_taskset_next);
+                if (&task->cg_list != &cset->mg_tasks) {
+                        tset->cur_cset = cset;
+                        tset->cur_task = task;
+                        return task;
+                }
 
-/**
- * cgroup_taskset_cur_css - return the matching css for the current task
- * @tset: taskset of interest
- * @subsys_id: the ID of the target subsystem
- *
- * Return the css for the current (last returned) task of @tset for
- * subsystem specified by @subsys_id.  This function must be preceded by
- * either cgroup_taskset_first() or cgroup_taskset_next().
- */
-struct cgroup_subsys_state *cgroup_taskset_cur_css(struct cgroup_taskset *tset,
-                                                   int subsys_id)
-{
-        return cgroup_css(tset->cur_cgrp, cgroup_subsys[subsys_id]);
-}
-EXPORT_SYMBOL_GPL(cgroup_taskset_cur_css);
+                cset = list_next_entry(cset, mg_node);
+                task = NULL;
+        }
 
-/**
- * cgroup_taskset_size - return the number of tasks in taskset
- * @tset: taskset of interest
- */
-int cgroup_taskset_size(struct cgroup_taskset *tset)
-{
-        return tset->tc_array ? tset->tc_array_len : 1;
+        return NULL;
 }
-EXPORT_SYMBOL_GPL(cgroup_taskset_size);
-
 
-/*
+/**
  * cgroup_task_migrate - move a task from one cgroup to another.
+ * @old_cgrp; the cgroup @tsk is being migrated from
+ * @tsk: the task being migrated
+ * @new_cset: the new css_set @tsk is being attached to
  *
- * Must be called with cgroup_mutex and threadgroup locked.
+ * Must be called with cgroup_mutex, threadgroup and css_set_rwsem locked.
  */
 static void cgroup_task_migrate(struct cgroup *old_cgrp,
                                 struct task_struct *tsk,
@@ -1925,6 +1749,9 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
 {
         struct css_set *old_cset;
 
+        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&css_set_rwsem);
+
         /*
          * We are synchronized through threadgroup_lock() against PF_EXITING
          * setting such that we can't race against cgroup_exit() changing the
@@ -1933,15 +1760,16 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
         WARN_ON_ONCE(tsk->flags & PF_EXITING);
         old_cset = task_css_set(tsk);
 
-        task_lock(tsk);
+        get_css_set(new_cset);
         rcu_assign_pointer(tsk->cgroups, new_cset);
-        task_unlock(tsk);
 
-        /* Update the css_set linked lists if we're using them */
-        write_lock(&css_set_lock);
-        if (!list_empty(&tsk->cg_list))
-                list_move(&tsk->cg_list, &new_cset->tasks);
-        write_unlock(&css_set_lock);
+        /*
+         * Use move_tail so that cgroup_taskset_first() still returns the
+         * leader after migration.  This works because cgroup_migrate()
+         * ensures that the dst_cset of the leader is the first on the
+         * tset's dst_csets list.
+         */
+        list_move_tail(&tsk->cg_list, &new_cset->mg_tasks);
 
         /*
          * We just gained a reference on old_cset by taking it from the
@@ -1949,100 +1777,199 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
          * we're safe to drop it here; it will be freed under RCU.
          */
         set_bit(CGRP_RELEASABLE, &old_cgrp->flags);
-        put_css_set(old_cset);
+        put_css_set_locked(old_cset, false);
 }
 
 /**
- * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
- * @cgrp: the cgroup to attach to
- * @tsk: the task or the leader of the threadgroup to be attached
- * @threadgroup: attach the whole threadgroup?
+ * cgroup_migrate_finish - cleanup after attach
+ * @preloaded_csets: list of preloaded css_sets
  *
- * Call holding cgroup_mutex and the group_rwsem of the leader. Will take
- * task_lock of @tsk or each thread in the threadgroup individually in turn.
+ * Undo cgroup_migrate_add_src() and cgroup_migrate_prepare_dst().  See
+ * those functions for details.
  */
-static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
-                              bool threadgroup)
+static void cgroup_migrate_finish(struct list_head *preloaded_csets)
 {
-        int retval, i, group_size;
-        struct cgroupfs_root *root = cgrp->root;
-        struct cgroup_subsys_state *css, *failed_css = NULL;
-        /* threadgroup list cursor and array */
-        struct task_struct *leader = tsk;
-        struct task_and_cgroup *tc;
-        struct flex_array *group;
-        struct cgroup_taskset tset = { };
+        struct css_set *cset, *tmp_cset;
 
-        /*
-         * step 0: in order to do expensive, possibly blocking operations for
-         * every thread, we cannot iterate the thread group list, since it needs
-         * rcu or tasklist locked. instead, build an array of all threads in the
-         * group - group_rwsem prevents new threads from appearing, and if
-         * threads exit, this will just be an over-estimate.
-         */
-        if (threadgroup)
-                group_size = get_nr_threads(tsk);
-        else
-                group_size = 1;
-        /* flex_array supports very large thread-groups better than kmalloc. */
-        group = flex_array_alloc(sizeof(*tc), group_size, GFP_KERNEL);
-        if (!group)
-                return -ENOMEM;
-        /* pre-allocate to guarantee space while iterating in rcu read-side. */
-        retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL);
-        if (retval)
-                goto out_free_group_list;
+        lockdep_assert_held(&cgroup_mutex);
+
+        down_write(&css_set_rwsem);
+        list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) {
+                cset->mg_src_cgrp = NULL;
+                cset->mg_dst_cset = NULL;
+                list_del_init(&cset->mg_preload_node);
+                put_css_set_locked(cset, false);
+        }
+        up_write(&css_set_rwsem);
+}
+
+/**
+ * cgroup_migrate_add_src - add a migration source css_set
+ * @src_cset: the source css_set to add
+ * @dst_cgrp: the destination cgroup
+ * @preloaded_csets: list of preloaded css_sets
+ *
+ * Tasks belonging to @src_cset are about to be migrated to @dst_cgrp.  Pin
+ * @src_cset and add it to @preloaded_csets, which should later be cleaned
+ * up by cgroup_migrate_finish().
+ *
+ * This function may be called without holding threadgroup_lock even if the
+ * target is a process.  Threads may be created and destroyed but as long
+ * as cgroup_mutex is not dropped, no new css_set can be put into play and
+ * the preloaded css_sets are guaranteed to cover all migrations.
+ */
+static void cgroup_migrate_add_src(struct css_set *src_cset,
+                                   struct cgroup *dst_cgrp,
+                                   struct list_head *preloaded_csets)
+{
+        struct cgroup *src_cgrp;
+
+        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&css_set_rwsem);
+
+        src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root);
+
+        /* nothing to do if this cset already belongs to the cgroup */
+        if (src_cgrp == dst_cgrp)
+                return;
+
+        if (!list_empty(&src_cset->mg_preload_node))
+                return;
+
+        WARN_ON(src_cset->mg_src_cgrp);
+        WARN_ON(!list_empty(&src_cset->mg_tasks));
+        WARN_ON(!list_empty(&src_cset->mg_node));
+
+        src_cset->mg_src_cgrp = src_cgrp;
+        get_css_set(src_cset);
+        list_add(&src_cset->mg_preload_node, preloaded_csets);
+}
+
+/**
+ * cgroup_migrate_prepare_dst - prepare destination css_sets for migration
+ * @dst_cgrp: the destination cgroup
+ * @preloaded_csets: list of preloaded source css_sets
+ *
+ * Tasks are about to be moved to @dst_cgrp and all the source css_sets
+ * have been preloaded to @preloaded_csets.  This function looks up and
+ * pins all destination css_sets, links each to its source, and put them on
+ * @preloaded_csets.
+ *
+ * This function must be called after cgroup_migrate_add_src() has been
+ * called on each migration source css_set.  After migration is performed
+ * using cgroup_migrate(), cgroup_migrate_finish() must be called on
+ * @preloaded_csets.
+ */
+static int cgroup_migrate_prepare_dst(struct cgroup *dst_cgrp,
+                                      struct list_head *preloaded_csets)
+{
+        LIST_HEAD(csets);
+        struct css_set *src_cset;
+
+        lockdep_assert_held(&cgroup_mutex);
+
+        /* look up the dst cset for each src cset and link it to src */
+        list_for_each_entry(src_cset, preloaded_csets, mg_preload_node) {
+                struct css_set *dst_cset;
+
+                dst_cset = find_css_set(src_cset, dst_cgrp);
+                if (!dst_cset)
+                        goto err;
+
+                WARN_ON_ONCE(src_cset->mg_dst_cset || dst_cset->mg_dst_cset);
+                src_cset->mg_dst_cset = dst_cset;
+
+                if (list_empty(&dst_cset->mg_preload_node))
+                        list_add(&dst_cset->mg_preload_node, &csets);
+                else
+                        put_css_set(dst_cset, false);
+        }
+
+        list_splice(&csets, preloaded_csets);
+        return 0;
+err:
+        cgroup_migrate_finish(&csets);
+        return -ENOMEM;
+}
+
+/**
+ * cgroup_migrate - migrate a process or task to a cgroup
+ * @cgrp: the destination cgroup
+ * @leader: the leader of the process or the task to migrate
+ * @threadgroup: whether @leader points to the whole process or a single task
+ *
+ * Migrate a process or task denoted by @leader to @cgrp.  If migrating a
+ * process, the caller must be holding threadgroup_lock of @leader.  The
+ * caller is also responsible for invoking cgroup_migrate_add_src() and
+ * cgroup_migrate_prepare_dst() on the targets before invoking this
+ * function and following up with cgroup_migrate_finish().
+ *
+ * As long as a controller's ->can_attach() doesn't fail, this function is
+ * guaranteed to succeed.  This means that, excluding ->can_attach()
+ * failure, when migrating multiple targets, the success or failure can be
+ * decided for all targets by invoking group_migrate_prepare_dst() before
+ * actually starting migrating.
+ */
+static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
+                          bool threadgroup)
+{
+        struct cgroup_taskset tset = {
+                .src_csets      = LIST_HEAD_INIT(tset.src_csets),
+                .dst_csets      = LIST_HEAD_INIT(tset.dst_csets),
+                .csets          = &tset.src_csets,
+        };
+        struct cgroup_subsys_state *css, *failed_css = NULL;
+        struct css_set *cset, *tmp_cset;
+        struct task_struct *task, *tmp_task;
+        int i, ret;
 
-        i = 0;
         /*
          * Prevent freeing of tasks while we take a snapshot. Tasks that are
          * already PF_EXITING could be freed from underneath us unless we
          * take an rcu_read_lock.
          */
+        down_write(&css_set_rwsem);
         rcu_read_lock();
+        task = leader;
         do {
-                struct task_and_cgroup ent;
+                /* @task either already exited or can't exit until the end */
+                if (task->flags & PF_EXITING)
+                        goto next;
 
-                /* @tsk either already exited or can't exit until the end */
-                if (tsk->flags & PF_EXITING)
+                /* leave @task alone if post_fork() hasn't linked it yet */
+                if (list_empty(&task->cg_list))
                         goto next;
 
-                /* as per above, nr_threads may decrease, but not increase. */
-                BUG_ON(i >= group_size);
-                ent.task = tsk;
-                ent.cgrp = task_cgroup_from_root(tsk, root);
-                /* nothing to do if this task is already in the cgroup */
-                if (ent.cgrp == cgrp)
+                cset = task_css_set(task);
+                if (!cset->mg_src_cgrp)
                         goto next;
+
                 /*
-                 * saying GFP_ATOMIC has no effect here because we did prealloc
-                 * earlier, but it's good form to communicate our expectations.
+                 * cgroup_taskset_first() must always return the leader.
+                 * Take care to avoid disturbing the ordering.
                  */
-                retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
-                BUG_ON(retval != 0);
-                i++;
+                list_move_tail(&task->cg_list, &cset->mg_tasks);
+                if (list_empty(&cset->mg_node))
+                        list_add_tail(&cset->mg_node, &tset.src_csets);
+                if (list_empty(&cset->mg_dst_cset->mg_node))
+                        list_move_tail(&cset->mg_dst_cset->mg_node,
+                                       &tset.dst_csets);
         next:
                 if (!threadgroup)
                         break;
-        } while_each_thread(leader, tsk);
+        } while_each_thread(leader, task);
         rcu_read_unlock();
-        /* remember the number of threads in the array for later. */
-        group_size = i;
-        tset.tc_array = group;
-        tset.tc_array_len = group_size;
+        up_write(&css_set_rwsem);
 
         /* methods shouldn't be called if no task is actually migrating */
-        retval = 0;
-        if (!group_size)
-                goto out_free_group_list;
+        if (list_empty(&tset.src_csets))
+                return 0;
 
-        /*
-         * step 1: check that we can legitimately attach to the cgroup.
-         */
+        /* check that we can legitimately attach to the cgroup */
         for_each_css(css, i, cgrp) {
                 if (css->ss->can_attach) {
-                        retval = css->ss->can_attach(css, &tset);
-                        if (retval) {
+                        ret = css->ss->can_attach(css, &tset);
+                        if (ret) {
                                 failed_css = css;
                                 goto out_cancel_attach;
                         }
@@ -2050,70 +1977,91 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
         }
 
         /*
-         * step 2: make sure css_sets exist for all threads to be migrated.
-         * we use find_css_set, which allocates a new one if necessary.
+         * Now that we're guaranteed success, proceed to move all tasks to
+         * the new cgroup.  There are no failure cases after here, so this
+         * is the commit point.
          */
-        for (i = 0; i < group_size; i++) {
-                struct css_set *old_cset;
-
-                tc = flex_array_get(group, i);
-                old_cset = task_css_set(tc->task);
-                tc->cset = find_css_set(old_cset, cgrp);
-                if (!tc->cset) {
-                        retval = -ENOMEM;
-                        goto out_put_css_set_refs;
-                }
+        down_write(&css_set_rwsem);
+        list_for_each_entry(cset, &tset.src_csets, mg_node) {
+                list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list)
+                        cgroup_task_migrate(cset->mg_src_cgrp, task,
+                                            cset->mg_dst_cset);
         }
+        up_write(&css_set_rwsem);
 
         /*
-         * step 3: now that we're guaranteed success wrt the css_sets,
-         * proceed to move all tasks to the new cgroup.  There are no
-         * failure cases after here, so this is the commit point.
+         * Migration is committed, all target tasks are now on dst_csets.
+         * Nothing is sensitive to fork() after this point.  Notify
+         * controllers that migration is complete.
          */
-        for (i = 0; i < group_size; i++) {
-                tc = flex_array_get(group, i);
-                cgroup_task_migrate(tc->cgrp, tc->task, tc->cset);
-        }
-        /* nothing is sensitive to fork() after this point. */
+        tset.csets = &tset.dst_csets;
 
-        /*
-         * step 4: do subsystem attach callbacks.
-         */
         for_each_css(css, i, cgrp)
                 if (css->ss->attach)
                         css->ss->attach(css, &tset);
 
-        /*
-         * step 5: success! and cleanup
-         */
-        retval = 0;
-out_put_css_set_refs:
-        if (retval) {
-                for (i = 0; i < group_size; i++) {
-                        tc = flex_array_get(group, i);
-                        if (!tc->cset)
-                                break;
-                        put_css_set(tc->cset);
-                }
-        }
+        ret = 0;
+        goto out_release_tset;
+
 out_cancel_attach:
-        if (retval) {
-                for_each_css(css, i, cgrp) {
-                        if (css == failed_css)
-                                break;
-                        if (css->ss->cancel_attach)
-                                css->ss->cancel_attach(css, &tset);
-                }
+        for_each_css(css, i, cgrp) {
+                if (css == failed_css)
+                        break;
+                if (css->ss->cancel_attach)
+                        css->ss->cancel_attach(css, &tset);
         }
-out_free_group_list:
-        flex_array_free(group);
-        return retval;
+out_release_tset:
+        down_write(&css_set_rwsem);
+        list_splice_init(&tset.dst_csets, &tset.src_csets);
+        list_for_each_entry_safe(cset, tmp_cset, &tset.src_csets, mg_node) {
+                list_splice_tail_init(&cset->mg_tasks, &cset->tasks);
+                list_del_init(&cset->mg_node);
+        }
+        up_write(&css_set_rwsem);
+        return ret;
+}
+
+/**
+ * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
+ * @dst_cgrp: the cgroup to attach to
+ * @leader: the task or the leader of the threadgroup to be attached
+ * @threadgroup: attach the whole threadgroup?
+ *
+ * Call holding cgroup_mutex and threadgroup_lock of @leader.
+ */
+static int cgroup_attach_task(struct cgroup *dst_cgrp,
+                              struct task_struct *leader, bool threadgroup)
+{
+        LIST_HEAD(preloaded_csets);
+        struct task_struct *task;
+        int ret;
+
+        /* look up all src csets */
+        down_read(&css_set_rwsem);
+        rcu_read_lock();
+        task = leader;
+        do {
+                cgroup_migrate_add_src(task_css_set(task), dst_cgrp,
+                                       &preloaded_csets);
+                if (!threadgroup)
+                        break;
+        } while_each_thread(leader, task);
+        rcu_read_unlock();
+        up_read(&css_set_rwsem);
+
+        /* prepare dst csets and commit */
+        ret = cgroup_migrate_prepare_dst(dst_cgrp, &preloaded_csets);
+        if (!ret)
+                ret = cgroup_migrate(dst_cgrp, leader, threadgroup);
+
+        cgroup_migrate_finish(&preloaded_csets);
+        return ret;
 }
 
 /*
  * Find the task_struct of the task to attach by vpid and pass it along to the
  * function to attach either it or all tasks in its threadgroup. Will lock
- * cgroup_mutex and threadgroup; may take task_lock of task.
+ * cgroup_mutex and threadgroup.
  */
 static int attach_task_by_pid(struct cgroup *cgrp, u64 pid, bool threadgroup)
 {
@@ -2198,12 +2146,19 @@ out_unlock_cgroup:
  */
 int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
 {
-        struct cgroupfs_root *root;
+        struct cgroup_root *root;
         int retval = 0;
 
         mutex_lock(&cgroup_mutex);
-        for_each_active_root(root) {
-                struct cgroup *from_cgrp = task_cgroup_from_root(from, root);
+        for_each_root(root) {
+                struct cgroup *from_cgrp;
+
+                if (root == &cgrp_dfl_root)
+                        continue;
+
+                down_read(&css_set_rwsem);
+                from_cgrp = task_cgroup_from_root(from, root);
+                up_read(&css_set_rwsem);
 
                 retval = cgroup_attach_task(from_cgrp, tsk, false);
                 if (retval)
@@ -2228,16 +2183,17 @@ static int cgroup_procs_write(struct cgroup_subsys_state *css,
 }
 
 static int cgroup_release_agent_write(struct cgroup_subsys_state *css,
-                                      struct cftype *cft, const char *buffer)
+                                      struct cftype *cft, char *buffer)
 {
-        BUILD_BUG_ON(sizeof(css->cgroup->root->release_agent_path) < PATH_MAX);
-        if (strlen(buffer) >= PATH_MAX)
-                return -EINVAL;
+        struct cgroup_root *root = css->cgroup->root;
+
+        BUILD_BUG_ON(sizeof(root->release_agent_path) < PATH_MAX);
         if (!cgroup_lock_live_group(css->cgroup))
                 return -ENODEV;
-        mutex_lock(&cgroup_root_mutex);
-        strcpy(css->cgroup->root->release_agent_path, buffer);
-        mutex_unlock(&cgroup_root_mutex);
+        spin_lock(&release_agent_path_lock);
+        strlcpy(root->release_agent_path, buffer,
+                sizeof(root->release_agent_path));
+        spin_unlock(&release_agent_path_lock);
         mutex_unlock(&cgroup_mutex);
         return 0;
 }
@@ -2262,32 +2218,23 @@ static int cgroup_sane_behavior_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-/* A buffer size big enough for numbers or short strings */
-#define CGROUP_LOCAL_BUFFER_SIZE 64
-
-static ssize_t cgroup_file_write(struct file *file, const char __user *userbuf,
-                                 size_t nbytes, loff_t *ppos)
+static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
+                                 size_t nbytes, loff_t off)
 {
-        struct cfent *cfe = __d_cfe(file->f_dentry);
-        struct cftype *cft = __d_cft(file->f_dentry);
-        struct cgroup_subsys_state *css = cfe->css;
-        size_t max_bytes = cft->max_write_len ?: CGROUP_LOCAL_BUFFER_SIZE - 1;
-        char *buf;
+        struct cgroup *cgrp = of->kn->parent->priv;
+        struct cftype *cft = of->kn->priv;
+        struct cgroup_subsys_state *css;
         int ret;
 
-        if (nbytes >= max_bytes)
-                return -E2BIG;
-
-        buf = kmalloc(nbytes + 1, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        if (copy_from_user(buf, userbuf, nbytes)) {
-                ret = -EFAULT;
-                goto out_free;
-        }
-
-        buf[nbytes] = '\0';
+        /*
+         * kernfs guarantees that a file isn't deleted with operations in
+         * flight, which means that the matching css is and stays alive and
+         * doesn't need to be pinned.  The RCU locking is not necessary
+         * either.  It's just for the convenience of using cgroup_css().
+         */
+        rcu_read_lock();
+        css = cgroup_css(cgrp, cft->ss);
+        rcu_read_unlock();
 
         if (cft->write_string) {
                 ret = cft->write_string(css, cft, strstrip(buf));
@@ -2306,53 +2253,23 @@ static ssize_t cgroup_file_write(struct file *file, const char __user *userbuf,
         } else {
                 ret = -EINVAL;
         }
-out_free:
-        kfree(buf);
+
         return ret ?: nbytes;
 }
 
-/*
- * seqfile ops/methods for returning structured data. Currently just
- * supports string->u64 maps, but can be extended in future.
- */
-
 static void *cgroup_seqfile_start(struct seq_file *seq, loff_t *ppos)
 {
-        struct cftype *cft = seq_cft(seq);
-
-        if (cft->seq_start) {
-                return cft->seq_start(seq, ppos);
-        } else {
-                /*
-                 * The same behavior and code as single_open().  Returns
-                 * !NULL if pos is at the beginning; otherwise, NULL.
-                 */
-                return NULL + !*ppos;
-        }
+        return seq_cft(seq)->seq_start(seq, ppos);
 }
 
 static void *cgroup_seqfile_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct cftype *cft = seq_cft(seq);
-
-        if (cft->seq_next) {
-                return cft->seq_next(seq, v, ppos);
-        } else {
-                /*
-                 * The same behavior and code as single_open(), always
-                 * terminate after the initial read.
-                 */
-                ++*ppos;
-                return NULL;
-        }
+        return seq_cft(seq)->seq_next(seq, v, ppos);
 }
 
 static void cgroup_seqfile_stop(struct seq_file *seq, void *v)
 {
-        struct cftype *cft = seq_cft(seq);
-
-        if (cft->seq_stop)
-                cft->seq_stop(seq, v);
+        seq_cft(seq)->seq_stop(seq, v);
 }
 
 static int cgroup_seqfile_show(struct seq_file *m, void *arg)
@@ -2372,96 +2289,35 @@ static int cgroup_seqfile_show(struct seq_file *m, void *arg)
         return 0;
 }
 
-static struct seq_operations cgroup_seq_operations = {
-        .start          = cgroup_seqfile_start,
-        .next           = cgroup_seqfile_next,
-        .stop           = cgroup_seqfile_stop,
-        .show           = cgroup_seqfile_show,
+static struct kernfs_ops cgroup_kf_single_ops = {
+        .atomic_write_len       = PAGE_SIZE,
+        .write                  = cgroup_file_write,
+        .seq_show               = cgroup_seqfile_show,
 };
 
-static int cgroup_file_open(struct inode *inode, struct file *file)
-{
-        struct cfent *cfe = __d_cfe(file->f_dentry);
-        struct cftype *cft = __d_cft(file->f_dentry);
-        struct cgroup *cgrp = __d_cgrp(cfe->dentry->d_parent);
-        struct cgroup_subsys_state *css;
-        struct cgroup_open_file *of;
-        int err;
-
-        err = generic_file_open(inode, file);
-        if (err)
-                return err;
-
-        /*
-         * If the file belongs to a subsystem, pin the css.  Will be
-         * unpinned either on open failure or release.  This ensures that
-         * @css stays alive for all file operations.
-         */
-        rcu_read_lock();
-        css = cgroup_css(cgrp, cft->ss);
-        if (cft->ss && !css_tryget(css))
-                css = NULL;
-        rcu_read_unlock();
-
-        if (!css)
-                return -ENODEV;
-
-        /*
-         * @cfe->css is used by read/write/close to determine the
-         * associated css.  @file->private_data would be a better place but
-         * that's already used by seqfile.  Multiple accessors may use it
-         * simultaneously which is okay as the association never changes.
-         */
-        WARN_ON_ONCE(cfe->css && cfe->css != css);
-        cfe->css = css;
-
-        of = __seq_open_private(file, &cgroup_seq_operations,
-                                sizeof(struct cgroup_open_file));
-        if (of) {
-                of->cfe = cfe;
-                return 0;
-        }
-
-        if (css->ss)
-                css_put(css);
-        return -ENOMEM;
-}
-
-static int cgroup_file_release(struct inode *inode, struct file *file)
-{
-        struct cfent *cfe = __d_cfe(file->f_dentry);
-        struct cgroup_subsys_state *css = cfe->css;
-
-        if (css->ss)
-                css_put(css);
-        return seq_release_private(inode, file);
-}
+static struct kernfs_ops cgroup_kf_ops = {
+        .atomic_write_len       = PAGE_SIZE,
+        .write                  = cgroup_file_write,
+        .seq_start              = cgroup_seqfile_start,
+        .seq_next               = cgroup_seqfile_next,
+        .seq_stop               = cgroup_seqfile_stop,
+        .seq_show               = cgroup_seqfile_show,
+};
 
 /*
  * cgroup_rename - Only allow simple rename of directories in place.
  */
-static int cgroup_rename(struct inode *old_dir, struct dentry *old_dentry,
-                            struct inode *new_dir, struct dentry *new_dentry)
+static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent,
+                         const char *new_name_str)
 {
+        struct cgroup *cgrp = kn->priv;
         int ret;
-        struct cgroup_name *name, *old_name;
-        struct cgroup *cgrp;
-
-        /*
-         * It's convinient to use parent dir's i_mutex to protected
-         * cgrp->name.
-         */
-        lockdep_assert_held(&old_dir->i_mutex);
 
-        if (!S_ISDIR(old_dentry->d_inode->i_mode))
+        if (kernfs_type(kn) != KERNFS_DIR)
                 return -ENOTDIR;
-        if (new_dentry->d_inode)
-                return -EEXIST;
-        if (old_dir != new_dir)
+        if (kn->parent != new_parent)
                 return -EIO;
 
-        cgrp = __d_cgrp(old_dentry);
-
         /*
          * This isn't a proper migration and its usefulness is very
          * limited.  Disallow if sane_behavior.
@@ -2469,218 +2325,61 @@ static int cgroup_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (cgroup_sane_behavior(cgrp))
                 return -EPERM;
 
-        name = cgroup_alloc_name(new_dentry);
-        if (!name)
-                return -ENOMEM;
-
-        ret = simple_rename(old_dir, old_dentry, new_dir, new_dentry);
-        if (ret) {
-                kfree(name);
-                return ret;
-        }
-
-        old_name = rcu_dereference_protected(cgrp->name, true);
-        rcu_assign_pointer(cgrp->name, name);
-
-        kfree_rcu(old_name, rcu_head);
-        return 0;
-}
-
-static struct simple_xattrs *__d_xattrs(struct dentry *dentry)
-{
-        if (S_ISDIR(dentry->d_inode->i_mode))
-                return &__d_cgrp(dentry)->xattrs;
-        else
-                return &__d_cfe(dentry)->xattrs;
-}
-
-static inline int xattr_enabled(struct dentry *dentry)
-{
-        struct cgroupfs_root *root = dentry->d_sb->s_fs_info;
-        return root->flags & CGRP_ROOT_XATTR;
-}
-
-static bool is_valid_xattr(const char *name)
-{
-        if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
-            !strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN))
-                return true;
-        return false;
-}
-
-static int cgroup_setxattr(struct dentry *dentry, const char *name,
-                           const void *val, size_t size, int flags)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        if (!is_valid_xattr(name))
-                return -EINVAL;
-        return simple_xattr_set(__d_xattrs(dentry), name, val, size, flags);
-}
-
-static int cgroup_removexattr(struct dentry *dentry, const char *name)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        if (!is_valid_xattr(name))
-                return -EINVAL;
-        return simple_xattr_remove(__d_xattrs(dentry), name);
-}
-
-static ssize_t cgroup_getxattr(struct dentry *dentry, const char *name,
-                               void *buf, size_t size)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        if (!is_valid_xattr(name))
-                return -EINVAL;
-        return simple_xattr_get(__d_xattrs(dentry), name, buf, size);
-}
-
-static ssize_t cgroup_listxattr(struct dentry *dentry, char *buf, size_t size)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        return simple_xattr_list(__d_xattrs(dentry), buf, size);
-}
-
-static const struct file_operations cgroup_file_operations = {
-        .read = seq_read,
-        .write = cgroup_file_write,
-        .llseek = generic_file_llseek,
-        .open = cgroup_file_open,
-        .release = cgroup_file_release,
-};
-
-static const struct inode_operations cgroup_file_inode_operations = {
-        .setxattr = cgroup_setxattr,
-        .getxattr = cgroup_getxattr,
-        .listxattr = cgroup_listxattr,
-        .removexattr = cgroup_removexattr,
-};
-
-static const struct inode_operations cgroup_dir_inode_operations = {
-        .lookup = simple_lookup,
-        .mkdir = cgroup_mkdir,
-        .rmdir = cgroup_rmdir,
-        .rename = cgroup_rename,
-        .setxattr = cgroup_setxattr,
-        .getxattr = cgroup_getxattr,
-        .listxattr = cgroup_listxattr,
-        .removexattr = cgroup_removexattr,
-};
-
-static int cgroup_create_file(struct dentry *dentry, umode_t mode,
-                                struct super_block *sb)
-{
-        struct inode *inode;
-
-        if (!dentry)
-                return -ENOENT;
-        if (dentry->d_inode)
-                return -EEXIST;
+        /*
+         * We're gonna grab cgroup_tree_mutex which nests outside kernfs
+         * active_ref.  kernfs_rename() doesn't require active_ref
+         * protection.  Break them before grabbing cgroup_tree_mutex.
+         */
+        kernfs_break_active_protection(new_parent);
+        kernfs_break_active_protection(kn);
 
-        inode = cgroup_new_inode(mode, sb);
-        if (!inode)
-                return -ENOMEM;
+        mutex_lock(&cgroup_tree_mutex);
+        mutex_lock(&cgroup_mutex);
 
-        if (S_ISDIR(mode)) {
-                inode->i_op = &cgroup_dir_inode_operations;
-                inode->i_fop = &simple_dir_operations;
+        ret = kernfs_rename(kn, new_parent, new_name_str);
 
-                /* start off with i_nlink == 2 (for "." entry) */
-                inc_nlink(inode);
-                inc_nlink(dentry->d_parent->d_inode);
+        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 
-                /*
-                 * Control reaches here with cgroup_mutex held.
-                 * @inode->i_mutex should nest outside cgroup_mutex but we
-                 * want to populate it immediately without releasing
-                 * cgroup_mutex.  As @inode isn't visible to anyone else
-                 * yet, trylock will always succeed without affecting
-                 * lockdep checks.
-                 */
-                WARN_ON_ONCE(!mutex_trylock(&inode->i_mutex));
-        } else if (S_ISREG(mode)) {
-                inode->i_size = 0;
-                inode->i_fop = &cgroup_file_operations;
-                inode->i_op = &cgroup_file_inode_operations;
-        }
-        d_instantiate(dentry, inode);
-        dget(dentry);   /* Extra count - pin the dentry in core */
-        return 0;
+        kernfs_unbreak_active_protection(kn);
+        kernfs_unbreak_active_protection(new_parent);
+        return ret;
 }
 
-/**
- * cgroup_file_mode - deduce file mode of a control file
- * @cft: the control file in question
- *
- * returns cft->mode if ->mode is not 0
- * returns S_IRUGO|S_IWUSR if it has both a read and a write handler
- * returns S_IRUGO if it has only a read handler
- * returns S_IWUSR if it has only a write hander
- */
-static umode_t cgroup_file_mode(const struct cftype *cft)
+/* set uid and gid of cgroup dirs and files to that of the creator */
+static int cgroup_kn_set_ugid(struct kernfs_node *kn)
 {
-        umode_t mode = 0;
-
-        if (cft->mode)
-                return cft->mode;
-
-        if (cft->read_u64 || cft->read_s64 || cft->seq_show)
-                mode |= S_IRUGO;
+        struct iattr iattr = { .ia_valid = ATTR_UID | ATTR_GID,
+                               .ia_uid = current_fsuid(),
+                               .ia_gid = current_fsgid(), };
 
-        if (cft->write_u64 || cft->write_s64 || cft->write_string ||
-            cft->trigger)
-                mode |= S_IWUSR;
+        if (uid_eq(iattr.ia_uid, GLOBAL_ROOT_UID) &&
+            gid_eq(iattr.ia_gid, GLOBAL_ROOT_GID))
+                return 0;
 
-        return mode;
+        return kernfs_setattr(kn, &iattr);
 }
 
 static int cgroup_add_file(struct cgroup *cgrp, struct cftype *cft)
 {
-        struct dentry *dir = cgrp->dentry;
-        struct cgroup *parent = __d_cgrp(dir);
-        struct dentry *dentry;
-        struct cfent *cfe;
-        int error;
-        umode_t mode;
-        char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
-
-        if (cft->ss && !(cft->flags & CFTYPE_NO_PREFIX) &&
-            !(cgrp->root->flags & CGRP_ROOT_NOPREFIX)) {
-                strcpy(name, cft->ss->name);
-                strcat(name, ".");
-        }
-        strcat(name, cft->name);
-
-        BUG_ON(!mutex_is_locked(&dir->d_inode->i_mutex));
-
-        cfe = kzalloc(sizeof(*cfe), GFP_KERNEL);
-        if (!cfe)
-                return -ENOMEM;
-
-        dentry = lookup_one_len(name, dir, strlen(name));
-        if (IS_ERR(dentry)) {
-                error = PTR_ERR(dentry);
-                goto out;
-        }
+        char name[CGROUP_FILE_NAME_MAX];
+        struct kernfs_node *kn;
+        struct lock_class_key *key = NULL;
+        int ret;
 
-        cfe->type = (void *)cft;
-        cfe->dentry = dentry;
-        dentry->d_fsdata = cfe;
-        simple_xattrs_init(&cfe->xattrs);
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        key = &cft->lockdep_key;
+#endif
+        kn = __kernfs_create_file(cgrp->kn, cgroup_file_name(cgrp, cft, name),
+                                  cgroup_file_mode(cft), 0, cft->kf_ops, cft,
+                                  NULL, false, key);
+        if (IS_ERR(kn))
+                return PTR_ERR(kn);
 
-        mode = cgroup_file_mode(cft);
-        error = cgroup_create_file(dentry, mode | S_IFREG, cgrp->root->sb);
-        if (!error) {
-                list_add_tail(&cfe->node, &parent->files);
-                cfe = NULL;
-        }
-        dput(dentry);
-out:
-        kfree(cfe);
-        return error;
+        ret = cgroup_kn_set_ugid(kn);
+        if (ret)
+                kernfs_remove(kn);
+        return ret;
 }
 
 /**
@@ -2700,11 +2399,12 @@ static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
         struct cftype *cft;
         int ret;
 
-        lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
-        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&cgroup_tree_mutex);
 
         for (cft = cfts; cft->name[0] != '\0'; cft++) {
                 /* does cft->flags tell us to skip this file on @cgrp? */
+                if ((cft->flags & CFTYPE_ONLY_ON_DFL) && !cgroup_on_dfl(cgrp))
+                        continue;
                 if ((cft->flags & CFTYPE_INSANE) && cgroup_sane_behavior(cgrp))
                         continue;
                 if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent)
@@ -2726,44 +2426,19 @@ static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
         return 0;
 }
 
-static void cgroup_cfts_prepare(void)
-        __acquires(&cgroup_mutex)
-{
-        /*
-         * Thanks to the entanglement with vfs inode locking, we can't walk
-         * the existing cgroups under cgroup_mutex and create files.
-         * Instead, we use css_for_each_descendant_pre() and drop RCU read
-         * lock before calling cgroup_addrm_files().
-         */
-        mutex_lock(&cgroup_mutex);
-}
-
-static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
-        __releases(&cgroup_mutex)
+static int cgroup_apply_cftypes(struct cftype *cfts, bool is_add)
 {
         LIST_HEAD(pending);
         struct cgroup_subsys *ss = cfts[0].ss;
-        struct cgroup *root = &ss->root->top_cgroup;
-        struct super_block *sb = ss->root->sb;
-        struct dentry *prev = NULL;
-        struct inode *inode;
+        struct cgroup *root = &ss->root->cgrp;
         struct cgroup_subsys_state *css;
-        u64 update_before;
         int ret = 0;
 
-        /* %NULL @cfts indicates abort and don't bother if @ss isn't attached */
-        if (!cfts || ss->root == &cgroup_dummy_root ||
-            !atomic_inc_not_zero(&sb->s_active)) {
-                mutex_unlock(&cgroup_mutex);
-                return 0;
-        }
+        lockdep_assert_held(&cgroup_tree_mutex);
 
-        /*
-         * All cgroups which are created after we drop cgroup_mutex will
-         * have the updated set of files, so we only need to update the
-         * cgroups created before the current @cgroup_serial_nr_next.
-         */
-        update_before = cgroup_serial_nr_next;
+        /* don't bother if @ss isn't attached */
+        if (ss->root == &cgrp_dfl_root)
+                return 0;
 
         /* add/rm files for all cgroups created before */
         css_for_each_descendant_pre(css, cgroup_css(root, ss)) {
@@ -2772,62 +2447,75 @@ static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
                 if (cgroup_is_dead(cgrp))
                         continue;
 
-                inode = cgrp->dentry->d_inode;
-                dget(cgrp->dentry);
-                dput(prev);
-                prev = cgrp->dentry;
-
-                mutex_unlock(&cgroup_mutex);
-                mutex_lock(&inode->i_mutex);
-                mutex_lock(&cgroup_mutex);
-                if (cgrp->serial_nr < update_before && !cgroup_is_dead(cgrp))
-                        ret = cgroup_addrm_files(cgrp, cfts, is_add);
-                mutex_unlock(&inode->i_mutex);
+                ret = cgroup_addrm_files(cgrp, cfts, is_add);
                 if (ret)
                         break;
         }
-        mutex_unlock(&cgroup_mutex);
-        dput(prev);
-        deactivate_super(sb);
+
+        if (is_add && !ret)
+                kernfs_activate(root->kn);
         return ret;
 }
 
-/**
- * cgroup_add_cftypes - add an array of cftypes to a subsystem
- * @ss: target cgroup subsystem
- * @cfts: zero-length name terminated array of cftypes
- *
- * Register @cfts to @ss.  Files described by @cfts are created for all
- * existing cgroups to which @ss is attached and all future cgroups will
- * have them too.  This function can be called anytime whether @ss is
- * attached or not.
- *
- * Returns 0 on successful registration, -errno on failure.  Note that this
- * function currently returns 0 as long as @cfts registration is successful
- * even if some file creation attempts on existing cgroups fail.
- */
-int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+static void cgroup_exit_cftypes(struct cftype *cfts)
 {
-        struct cftype_set *set;
         struct cftype *cft;
-        int ret;
 
-        set = kzalloc(sizeof(*set), GFP_KERNEL);
-        if (!set)
-                return -ENOMEM;
+        for (cft = cfts; cft->name[0] != '\0'; cft++) {
+                /* free copy for custom atomic_write_len, see init_cftypes() */
+                if (cft->max_write_len && cft->max_write_len != PAGE_SIZE)
+                        kfree(cft->kf_ops);
+                cft->kf_ops = NULL;
+                cft->ss = NULL;
+        }
+}
+
+static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+{
+        struct cftype *cft;
+
+        for (cft = cfts; cft->name[0] != '\0'; cft++) {
+                struct kernfs_ops *kf_ops;
 
-        for (cft = cfts; cft->name[0] != '\0'; cft++)
+                WARN_ON(cft->ss || cft->kf_ops);
+
+                if (cft->seq_start)
+                        kf_ops = &cgroup_kf_ops;
+                else
+                        kf_ops = &cgroup_kf_single_ops;
+
+                /*
+                 * Ugh... if @cft wants a custom max_write_len, we need to
+                 * make a copy of kf_ops to set its atomic_write_len.
+                 */
+                if (cft->max_write_len && cft->max_write_len != PAGE_SIZE) {
+                        kf_ops = kmemdup(kf_ops, sizeof(*kf_ops), GFP_KERNEL);
+                        if (!kf_ops) {
+                                cgroup_exit_cftypes(cfts);
+                                return -ENOMEM;
+                        }
+                        kf_ops->atomic_write_len = cft->max_write_len;
+                }
+
+                cft->kf_ops = kf_ops;
                 cft->ss = ss;
+        }
 
-        cgroup_cfts_prepare();
-        set->cfts = cfts;
-        list_add_tail(&set->node, &ss->cftsets);
-        ret = cgroup_cfts_commit(cfts, true);
-        if (ret)
-                cgroup_rm_cftypes(cfts);
-        return ret;
+        return 0;
+}
+
+static int cgroup_rm_cftypes_locked(struct cftype *cfts)
+{
+        lockdep_assert_held(&cgroup_tree_mutex);
+
+        if (!cfts || !cfts[0].ss)
+                return -ENOENT;
+
+        list_del(&cfts->node);
+        cgroup_apply_cftypes(cfts, false);
+        cgroup_exit_cftypes(cfts);
+        return 0;
 }
-EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
 
 /**
  * cgroup_rm_cftypes - remove an array of cftypes from a subsystem
@@ -2842,24 +2530,48 @@ EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
  */
 int cgroup_rm_cftypes(struct cftype *cfts)
 {
-        struct cftype_set *set;
+        int ret;
 
-        if (!cfts || !cfts[0].ss)
-                return -ENOENT;
+        mutex_lock(&cgroup_tree_mutex);
+        ret = cgroup_rm_cftypes_locked(cfts);
+        mutex_unlock(&cgroup_tree_mutex);
+        return ret;
+}
 
-        cgroup_cfts_prepare();
+/**
+ * cgroup_add_cftypes - add an array of cftypes to a subsystem
+ * @ss: target cgroup subsystem
+ * @cfts: zero-length name terminated array of cftypes
+ *
+ * Register @cfts to @ss.  Files described by @cfts are created for all
+ * existing cgroups to which @ss is attached and all future cgroups will
+ * have them too.  This function can be called anytime whether @ss is
+ * attached or not.
+ *
+ * Returns 0 on successful registration, -errno on failure.  Note that this
+ * function currently returns 0 as long as @cfts registration is successful
+ * even if some file creation attempts on existing cgroups fail.
+ */
+int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+{
+        int ret;
 
-        list_for_each_entry(set, &cfts[0].ss->cftsets, node) {
-                if (set->cfts == cfts) {
-                        list_del(&set->node);
-                        kfree(set);
-                        cgroup_cfts_commit(cfts, false);
-                        return 0;
-                }
-        }
+        if (!cfts || cfts[0].name[0] == '\0')
+                return 0;
 
-        cgroup_cfts_commit(NULL, false);
-        return -ENOENT;
+        ret = cgroup_init_cftypes(ss, cfts);
+        if (ret)
+                return ret;
+
+        mutex_lock(&cgroup_tree_mutex);
+
+        list_add_tail(&cfts->node, &ss->cfts);
+        ret = cgroup_apply_cftypes(cfts, true);
+        if (ret)
+                cgroup_rm_cftypes_locked(cfts);
+
+        mutex_unlock(&cgroup_tree_mutex);
+        return ret;
 }
 
 /**
@@ -2868,57 +2580,18 @@ int cgroup_rm_cftypes(struct cftype *cfts)
  *
  * Return the number of tasks in the cgroup.
  */
-int cgroup_task_count(const struct cgroup *cgrp)
+static int cgroup_task_count(const struct cgroup *cgrp)
 {
         int count = 0;
         struct cgrp_cset_link *link;
 
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
         list_for_each_entry(link, &cgrp->cset_links, cset_link)
                 count += atomic_read(&link->cset->refcount);
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
         return count;
 }
 
-/*
- * To reduce the fork() overhead for systems that are not actually using
- * their cgroups capability, we don't maintain the lists running through
- * each css_set to its tasks until we see the list actually used - in other
- * words after the first call to css_task_iter_start().
- */
-static void cgroup_enable_task_cg_lists(void)
-{
-        struct task_struct *p, *g;
-        write_lock(&css_set_lock);
-        use_task_css_set_links = 1;
-        /*
-         * We need tasklist_lock because RCU is not safe against
-         * while_each_thread(). Besides, a forking task that has passed
-         * cgroup_post_fork() without seeing use_task_css_set_links = 1
-         * is not guaranteed to have its child immediately visible in the
-         * tasklist if we walk through it with RCU.
-         */
-        read_lock(&tasklist_lock);
-        do_each_thread(g, p) {
-                task_lock(p);
-                /*
-                 * We should check if the process is exiting, otherwise
-                 * it will race with cgroup_exit() in that the list
-                 * entry won't be deleted though the process has exited.
-                 * Do it while holding siglock so that we don't end up
-                 * racing against cgroup_exit().
-                 */
-                spin_lock_irq(&p->sighand->siglock);
-                if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
-                        list_add(&p->cg_list, &task_css_set(p)->tasks);
-                spin_unlock_irq(&p->sighand->siglock);
-
-                task_unlock(p);
-        } while_each_thread(g, p);
-        read_unlock(&tasklist_lock);
-        write_unlock(&css_set_lock);
-}
-
 /**
  * css_next_child - find the next child of a given css
  * @pos_css: the current position (%NULL to initiate traversal)
@@ -2937,7 +2610,7 @@ css_next_child(struct cgroup_subsys_state *pos_css,
         struct cgroup *cgrp = parent_css->cgroup;
         struct cgroup *next;
 
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
 
         /*
          * @pos could already have been removed.  Once a cgroup is removed,
@@ -2973,7 +2646,6 @@ css_next_child(struct cgroup_subsys_state *pos_css,
 
         return cgroup_css(next, parent_css->ss);
 }
-EXPORT_SYMBOL_GPL(css_next_child);
 
 /**
  * css_next_descendant_pre - find the next descendant for pre-order walk
@@ -2995,7 +2667,7 @@ css_next_descendant_pre(struct cgroup_subsys_state *pos,
 {
         struct cgroup_subsys_state *next;
 
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
 
         /* if first iteration, visit @root */
         if (!pos)
@@ -3016,7 +2688,6 @@ css_next_descendant_pre(struct cgroup_subsys_state *pos,
 
         return NULL;
 }
-EXPORT_SYMBOL_GPL(css_next_descendant_pre);
 
 /**
  * css_rightmost_descendant - return the rightmost descendant of a css
@@ -3036,7 +2707,7 @@ css_rightmost_descendant(struct cgroup_subsys_state *pos)
 {
         struct cgroup_subsys_state *last, *tmp;
 
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
 
         do {
                 last = pos;
@@ -3048,7 +2719,6 @@ css_rightmost_descendant(struct cgroup_subsys_state *pos)
 
         return last;
 }
-EXPORT_SYMBOL_GPL(css_rightmost_descendant);
 
 static struct cgroup_subsys_state *
 css_leftmost_descendant(struct cgroup_subsys_state *pos)
@@ -3084,7 +2754,7 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
 {
         struct cgroup_subsys_state *next;
 
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
 
         /* if first iteration, visit leftmost descendant which may be @root */
         if (!pos)
@@ -3102,7 +2772,6 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
         /* no sibling left, visit parent */
         return css_parent(pos);
 }
-EXPORT_SYMBOL_GPL(css_next_descendant_post);
 
 /**
  * css_advance_task_iter - advance a task itererator to the next css_set
@@ -3125,9 +2794,14 @@ static void css_advance_task_iter(struct css_task_iter *it)
                 }
                 link = list_entry(l, struct cgrp_cset_link, cset_link);
                 cset = link->cset;
-        } while (list_empty(&cset->tasks));
+        } while (list_empty(&cset->tasks) && list_empty(&cset->mg_tasks));
+
         it->cset_link = l;
-        it->task = cset->tasks.next;
+
+        if (!list_empty(&cset->tasks))
+                it->task = cset->tasks.next;
+        else
+                it->task = cset->mg_tasks.next;
 }
 
 /**
@@ -3146,17 +2820,12 @@ static void css_advance_task_iter(struct css_task_iter *it)
  */
 void css_task_iter_start(struct cgroup_subsys_state *css,
                          struct css_task_iter *it)
-        __acquires(css_set_lock)
+        __acquires(css_set_rwsem)
 {
-        /*
-         * The first time anyone tries to iterate across a css, we need to
-         * enable the list linking each css_set to its tasks, and fix up
-         * all existing tasks.
-         */
-        if (!use_task_css_set_links)
-                cgroup_enable_task_cg_lists();
+        /* no one should try to iterate before mounting cgroups */
+        WARN_ON_ONCE(!use_task_css_set_links);
 
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
 
         it->origin_css = css;
         it->cset_link = &css->cgroup->cset_links;
@@ -3176,24 +2845,29 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 {
         struct task_struct *res;
         struct list_head *l = it->task;
-        struct cgrp_cset_link *link;
+        struct cgrp_cset_link *link = list_entry(it->cset_link,
+                                        struct cgrp_cset_link, cset_link);
 
         /* If the iterator cg is NULL, we have no tasks */
         if (!it->cset_link)
                 return NULL;
         res = list_entry(l, struct task_struct, cg_list);
-        /* Advance iterator to find next entry */
+
+        /*
+         * Advance iterator to find next entry.  cset->tasks is consumed
+         * first and then ->mg_tasks.  After ->mg_tasks, we move onto the
+         * next cset.
+         */
         l = l->next;
-        link = list_entry(it->cset_link, struct cgrp_cset_link, cset_link);
-        if (l == &link->cset->tasks) {
-                /*
-                 * We reached the end of this task list - move on to the
-                 * next cgrp_cset_link.
-                 */
+
+        if (l == &link->cset->tasks)
+                l = link->cset->mg_tasks.next;
+
+        if (l == &link->cset->mg_tasks)
                 css_advance_task_iter(it);
-        } else {
+        else
                 it->task = l;
-        }
+
         return res;
 }
 
@@ -3204,191 +2878,62 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
  * Finish task iteration started by css_task_iter_start().
  */
 void css_task_iter_end(struct css_task_iter *it)
-        __releases(css_set_lock)
-{
-        read_unlock(&css_set_lock);
-}
-
-static inline int started_after_time(struct task_struct *t1,
-                                     struct timespec *time,
-                                     struct task_struct *t2)
-{
-        int start_diff = timespec_compare(&t1->start_time, time);
-        if (start_diff > 0) {
-                return 1;
-        } else if (start_diff < 0) {
-                return 0;
-        } else {
-                /*
-                 * Arbitrarily, if two processes started at the same
-                 * time, we'll say that the lower pointer value
-                 * started first. Note that t2 may have exited by now
-                 * so this may not be a valid pointer any longer, but
-                 * that's fine - it still serves to distinguish
-                 * between two tasks started (effectively) simultaneously.
-                 */
-                return t1 > t2;
-        }
-}
-
-/*
- * This function is a callback from heap_insert() and is used to order
- * the heap.
- * In this case we order the heap in descending task start time.
- */
-static inline int started_after(void *p1, void *p2)
+        __releases(css_set_rwsem)
 {
-        struct task_struct *t1 = p1;
-        struct task_struct *t2 = p2;
-        return started_after_time(t1, &t2->start_time, t2);
+        up_read(&css_set_rwsem);
 }
 
 /**
- * css_scan_tasks - iterate though all the tasks in a css
- * @css: the css to iterate tasks of
- * @test: optional test callback
- * @process: process callback
- * @data: data passed to @test and @process
- * @heap: optional pre-allocated heap used for task iteration
- *
- * Iterate through all the tasks in @css, calling @test for each, and if it
- * returns %true, call @process for it also.
- *
- * @test may be NULL, meaning always true (select all tasks), which
- * effectively duplicates css_task_iter_{start,next,end}() but does not
- * lock css_set_lock for the call to @process.
- *
- * It is guaranteed that @process will act on every task that is a member
- * of @css for the duration of this call.  This function may or may not
- * call @process for tasks that exit or move to a different css during the
- * call, or are forked or move into the css during the call.
- *
- * Note that @test may be called with locks held, and may in some
- * situations be called multiple times for the same task, so it should be
- * cheap.
+ * cgroup_trasnsfer_tasks - move tasks from one cgroup to another
+ * @to: cgroup to which the tasks will be moved
+ * @from: cgroup in which the tasks currently reside
  *
- * If @heap is non-NULL, a heap has been pre-allocated and will be used for
- * heap operations (and its "gt" member will be overwritten), else a
- * temporary heap will be used (allocation of which may cause this function
- * to fail).
+ * Locking rules between cgroup_post_fork() and the migration path
+ * guarantee that, if a task is forking while being migrated, the new child
+ * is guaranteed to be either visible in the source cgroup after the
+ * parent's migration is complete or put into the target cgroup.  No task
+ * can slip out of migration through forking.
  */
-int css_scan_tasks(struct cgroup_subsys_state *css,
-                   bool (*test)(struct task_struct *, void *),
-                   void (*process)(struct task_struct *, void *),
-                   void *data, struct ptr_heap *heap)
+int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
 {
-        int retval, i;
+        LIST_HEAD(preloaded_csets);
+        struct cgrp_cset_link *link;
         struct css_task_iter it;
-        struct task_struct *p, *dropped;
-        /* Never dereference latest_task, since it's not refcounted */
-        struct task_struct *latest_task = NULL;
-        struct ptr_heap tmp_heap;
-        struct timespec latest_time = { 0, 0 };
-
-        if (heap) {
-                /* The caller supplied our heap and pre-allocated its memory */
-                heap->gt = &started_after;
-        } else {
-                /* We need to allocate our own heap memory */
-                heap = &tmp_heap;
-                retval = heap_init(heap, PAGE_SIZE, GFP_KERNEL, &started_after);
-                if (retval)
-                        /* cannot allocate the heap */
-                        return retval;
-        }
+        struct task_struct *task;
+        int ret;
 
- again:
-        /*
-         * Scan tasks in the css, using the @test callback to determine
-         * which are of interest, and invoking @process callback on the
-         * ones which need an update.  Since we don't want to hold any
-         * locks during the task updates, gather tasks to be processed in a
-         * heap structure.  The heap is sorted by descending task start
-         * time.  If the statically-sized heap fills up, we overflow tasks
-         * that started later, and in future iterations only consider tasks
-         * that started after the latest task in the previous pass. This
-         * guarantees forward progress and that we don't miss any tasks.
-         */
-        heap->size = 0;
-        css_task_iter_start(css, &it);
-        while ((p = css_task_iter_next(&it))) {
-                /*
-                 * Only affect tasks that qualify per the caller's callback,
-                 * if he provided one
-                 */
-                if (test && !test(p, data))
-                        continue;
-                /*
-                 * Only process tasks that started after the last task
-                 * we processed
-                 */
-                if (!started_after_time(p, &latest_time, latest_task))
-                        continue;
-                dropped = heap_insert(heap, p);
-                if (dropped == NULL) {
-                        /*
-                         * The new task was inserted; the heap wasn't
-                         * previously full
-                         */
-                        get_task_struct(p);
-                } else if (dropped != p) {
-                        /*
-                         * The new task was inserted, and pushed out a
-                         * different task
-                         */
-                        get_task_struct(p);
-                        put_task_struct(dropped);
-                }
-                /*
-                 * Else the new task was newer than anything already in
-                 * the heap and wasn't inserted
-                 */
-        }
-        css_task_iter_end(&it);
+        mutex_lock(&cgroup_mutex);
 
-        if (heap->size) {
-                for (i = 0; i < heap->size; i++) {
-                        struct task_struct *q = heap->ptrs[i];
-                        if (i == 0) {
-                                latest_time = q->start_time;
-                                latest_task = q;
-                        }
-                        /* Process the task per the caller's callback */
-                        process(q, data);
-                        put_task_struct(q);
-                }
-                /*
-                 * If we had to process any tasks at all, scan again
-                 * in case some of them were in the middle of forking
-                 * children that didn't get processed.
-                 * Not the most efficient way to do it, but it avoids
-                 * having to take callback_mutex in the fork path
-                 */
-                goto again;
-        }
-        if (heap == &tmp_heap)
-                heap_free(&tmp_heap);
-        return 0;
-}
+        /* all tasks in @from are being moved, all csets are source */
+        down_read(&css_set_rwsem);
+        list_for_each_entry(link, &from->cset_links, cset_link)
+                cgroup_migrate_add_src(link->cset, to, &preloaded_csets);
+        up_read(&css_set_rwsem);
 
-static void cgroup_transfer_one_task(struct task_struct *task, void *data)
-{
-        struct cgroup *new_cgroup = data;
+        ret = cgroup_migrate_prepare_dst(to, &preloaded_csets);
+        if (ret)
+                goto out_err;
 
-        mutex_lock(&cgroup_mutex);
-        cgroup_attach_task(new_cgroup, task, false);
+        /*
+         * Migrate tasks one-by-one until @form is empty.  This fails iff
+         * ->can_attach() fails.
+         */
+        do {
+                css_task_iter_start(&from->dummy_css, &it);
+                task = css_task_iter_next(&it);
+                if (task)
+                        get_task_struct(task);
+                css_task_iter_end(&it);
+
+                if (task) {
+                        ret = cgroup_migrate(to, task, false);
+                        put_task_struct(task);
+                }
+        } while (task && !ret);
+out_err:
+        cgroup_migrate_finish(&preloaded_csets);
         mutex_unlock(&cgroup_mutex);
-}
-
-/**
- * cgroup_trasnsfer_tasks - move tasks from one cgroup to another
- * @to: cgroup to which the tasks will be moved
- * @from: cgroup in which the tasks currently reside
- */
-int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
-{
-        return css_scan_tasks(&from->dummy_css, NULL, cgroup_transfer_one_task,
-                              to, NULL);
+        return ret;
 }
 
 /*
@@ -3687,21 +3232,31 @@ static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type,
  */
 int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
 {
-        int ret = -EINVAL;
+        struct kernfs_node *kn = kernfs_node_from_dentry(dentry);
         struct cgroup *cgrp;
         struct css_task_iter it;
         struct task_struct *tsk;
 
+        /* it should be kernfs_node belonging to cgroupfs and is a directory */
+        if (dentry->d_sb->s_type != &cgroup_fs_type || !kn ||
+            kernfs_type(kn) != KERNFS_DIR)
+                return -EINVAL;
+
+        mutex_lock(&cgroup_mutex);
+
         /*
-         * Validate dentry by checking the superblock operations,
-         * and make sure it's a directory.
+         * We aren't being called from kernfs and there's no guarantee on
+         * @kn->priv's validity.  For this and css_tryget_from_dir(),
+         * @kn->priv is RCU safe.  Let's do the RCU dancing.
          */
-        if (dentry->d_sb->s_op != &cgroup_ops ||
-            !S_ISDIR(dentry->d_inode->i_mode))
-                 goto err;
-
-        ret = 0;
-        cgrp = dentry->d_fsdata;
+        rcu_read_lock();
+        cgrp = rcu_dereference(kn->priv);
+        if (!cgrp || cgroup_is_dead(cgrp)) {
+                rcu_read_unlock();
+                mutex_unlock(&cgroup_mutex);
+                return -ENOENT;
+        }
+        rcu_read_unlock();
 
         css_task_iter_start(&cgrp->dummy_css, &it);
         while ((tsk = css_task_iter_next(&it))) {
@@ -3726,8 +3281,8 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
         }
         css_task_iter_end(&it);
 
-err:
-        return ret;
+        mutex_unlock(&cgroup_mutex);
+        return 0;
 }
 
 
@@ -3745,7 +3300,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
          * after a seek to the start). Use a binary-search to find the
          * next pid to display, if any
          */
-        struct cgroup_open_file *of = s->private;
+        struct kernfs_open_file *of = s->private;
         struct cgroup *cgrp = seq_css(s)->cgroup;
         struct cgroup_pidlist *l;
         enum cgroup_filetype type = seq_cft(s)->private;
@@ -3800,7 +3355,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 
 static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 {
-        struct cgroup_open_file *of = s->private;
+        struct kernfs_open_file *of = s->private;
         struct cgroup_pidlist *l = of->priv;
 
         if (l)
@@ -3811,7 +3366,7 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 
 static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct cgroup_open_file *of = s->private;
+        struct kernfs_open_file *of = s->private;
         struct cgroup_pidlist *l = of->priv;
         pid_t *p = v;
         pid_t *end = l->list + l->length;
@@ -3861,23 +3416,6 @@ static int cgroup_write_notify_on_release(struct cgroup_subsys_state *css,
         return 0;
 }
 
-/*
- * When dput() is called asynchronously, if umount has been done and
- * then deactivate_super() in cgroup_free_fn() kills the superblock,
- * there's a small window that vfs will see the root dentry with non-zero
- * refcnt and trigger BUG().
- *
- * That's why we hold a reference before dput() and drop it right after.
- */
-static void cgroup_dput(struct cgroup *cgrp)
-{
-        struct super_block *sb = cgrp->root->sb;
-
-        atomic_inc(&sb->s_active);
-        dput(cgrp->dentry);
-        deactivate_super(sb);
-}
-
 static u64 cgroup_clone_children_read(struct cgroup_subsys_state *css,
                                       struct cftype *cft)
 {
@@ -3944,7 +3482,7 @@ static struct cftype cgroup_base_files[] = {
                 .flags = CFTYPE_INSANE | CFTYPE_ONLY_ON_ROOT,
                 .seq_show = cgroup_release_agent_show,
                 .write_string = cgroup_release_agent_write,
-                .max_write_len = PATH_MAX,
+                .max_write_len = PATH_MAX - 1,
         },
         { }     /* terminate */
 };
@@ -3963,13 +3501,13 @@ static int cgroup_populate_dir(struct cgroup *cgrp, unsigned long subsys_mask)
 
         /* process cftsets of each subsystem */
         for_each_subsys(ss, i) {
-                struct cftype_set *set;
+                struct cftype *cfts;
 
                 if (!test_bit(i, &subsys_mask))
                         continue;
 
-                list_for_each_entry(set, &ss->cftsets, node) {
-                        ret = cgroup_addrm_files(cgrp, set->cfts, true);
+                list_for_each_entry(cfts, &ss->cfts, node) {
+                        ret = cgroup_addrm_files(cgrp, cfts, true);
                         if (ret < 0)
                                 goto err;
                 }
@@ -4012,7 +3550,7 @@ static void css_free_work_fn(struct work_struct *work)
                 css_put(css->parent);
 
         css->ss->css_free(css);
-        cgroup_dput(cgrp);
+        cgroup_put(cgrp);
 }
 
 static void css_free_rcu_fn(struct rcu_head *rcu_head)
@@ -4020,10 +3558,6 @@ static void css_free_rcu_fn(struct rcu_head *rcu_head)
         struct cgroup_subsys_state *css =
                 container_of(rcu_head, struct cgroup_subsys_state, rcu_head);
 
-        /*
-         * css holds an extra ref to @cgrp->dentry which is put on the last
-         * css_put().  dput() requires process context which we don't have.
-         */
         INIT_WORK(&css->destroy_work, css_free_work_fn);
         queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
@@ -4033,7 +3567,7 @@ static void css_release(struct percpu_ref *ref)
         struct cgroup_subsys_state *css =
                 container_of(ref, struct cgroup_subsys_state, refcnt);
 
-        rcu_assign_pointer(css->cgroup->subsys[css->ss->subsys_id], NULL);
+        RCU_INIT_POINTER(css->cgroup->subsys[css->ss->id], NULL);
         call_rcu(&css->rcu_head, css_free_rcu_fn);
 }
 
@@ -4058,6 +3592,7 @@ static int online_css(struct cgroup_subsys_state *css)
         struct cgroup_subsys *ss = css->ss;
         int ret = 0;
 
+        lockdep_assert_held(&cgroup_tree_mutex);
         lockdep_assert_held(&cgroup_mutex);
 
         if (ss->css_online)
@@ -4065,7 +3600,7 @@ static int online_css(struct cgroup_subsys_state *css)
         if (!ret) {
                 css->flags |= CSS_ONLINE;
                 css->cgroup->nr_css++;
-                rcu_assign_pointer(css->cgroup->subsys[ss->subsys_id], css);
+                rcu_assign_pointer(css->cgroup->subsys[ss->id], css);
         }
         return ret;
 }
@@ -4075,6 +3610,7 @@ static void offline_css(struct cgroup_subsys_state *css)
 {
         struct cgroup_subsys *ss = css->ss;
 
+        lockdep_assert_held(&cgroup_tree_mutex);
         lockdep_assert_held(&cgroup_mutex);
 
         if (!(css->flags & CSS_ONLINE))
@@ -4085,7 +3621,7 @@ static void offline_css(struct cgroup_subsys_state *css)
 
         css->flags &= ~CSS_ONLINE;
         css->cgroup->nr_css--;
-        RCU_INIT_POINTER(css->cgroup->subsys[ss->subsys_id], css);
+        RCU_INIT_POINTER(css->cgroup->subsys[ss->id], css);
 }
 
 /**
@@ -4103,7 +3639,6 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
         struct cgroup_subsys_state *css;
         int err;
 
-        lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
         lockdep_assert_held(&cgroup_mutex);
 
         css = ss->css_alloc(cgroup_css(parent, ss));
@@ -4116,7 +3651,7 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
 
         init_css(css, ss, cgrp);
 
-        err = cgroup_populate_dir(cgrp, 1 << ss->subsys_id);
+        err = cgroup_populate_dir(cgrp, 1 << ss->id);
         if (err)
                 goto err_free_percpu_ref;
 
@@ -4124,9 +3659,11 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
         if (err)
                 goto err_clear_dir;
 
-        dget(cgrp->dentry);
+        cgroup_get(cgrp);
         css_get(css->parent);
 
+        cgrp->subsys_mask |= 1 << ss->id;
+
         if (ss->broken_hierarchy && !ss->warned_broken_hierarchy &&
             parent->parent) {
                 pr_warning("cgroup: %s (%d) created nested cgroup for controller \"%s\" which has incomplete hierarchy support. Nested cgroups may change behavior in the future.\n",
@@ -4139,7 +3676,7 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
         return 0;
 
 err_clear_dir:
-        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->id);
 err_free_percpu_ref:
         percpu_ref_cancel_init(&css->refcnt);
 err_free_css:
@@ -4147,35 +3684,34 @@ err_free_css:
         return err;
 }
 
-/*
+/**
  * cgroup_create - create a cgroup
  * @parent: cgroup that will be parent of the new cgroup
- * @dentry: dentry of the new cgroup
- * @mode: mode to set on new inode
- *
- * Must be called with the mutex on the parent inode held
+ * @name: name of the new cgroup
+ * @mode: mode to set on new cgroup
  */
-static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
-                             umode_t mode)
+static long cgroup_create(struct cgroup *parent, const char *name,
+                          umode_t mode)
 {
         struct cgroup *cgrp;
-        struct cgroup_name *name;
-        struct cgroupfs_root *root = parent->root;
+        struct cgroup_root *root = parent->root;
         int ssid, err;
         struct cgroup_subsys *ss;
-        struct super_block *sb = root->sb;
+        struct kernfs_node *kn;
+
+        /*
+         * XXX: The default hierarchy isn't fully implemented yet.  Block
+         * !root cgroup creation on it for now.
+         */
+        if (root == &cgrp_dfl_root)
+                return -EINVAL;
 
         /* allocate the cgroup and its ID, 0 is reserved for the root */
         cgrp = kzalloc(sizeof(*cgrp), GFP_KERNEL);
         if (!cgrp)
                 return -ENOMEM;
 
-        name = cgroup_alloc_name(dentry);
-        if (!name) {
-                err = -ENOMEM;
-                goto err_free_cgrp;
-        }
-        rcu_assign_pointer(cgrp->name, name);
+        mutex_lock(&cgroup_tree_mutex);
 
         /*
          * Only live parents can have children.  Note that the liveliness
@@ -4186,7 +3722,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         if (!cgroup_lock_live_group(parent)) {
                 err = -ENODEV;
-                goto err_free_name;
+                goto err_unlock_tree;
         }
 
         /*
@@ -4199,18 +3735,8 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                 goto err_unlock;
         }
 
-        /* Grab a reference on the superblock so the hierarchy doesn't
-         * get deleted on unmount if there are child cgroups.  This
-         * can be done outside cgroup_mutex, since the sb can't
-         * disappear while someone has an open control file on the
-         * fs */
-        atomic_inc(&sb->s_active);
-
         init_cgroup_housekeeping(cgrp);
 
-        dentry->d_fsdata = cgrp;
-        cgrp->dentry = dentry;
-
         cgrp->parent = parent;
         cgrp->dummy_css.parent = &parent->dummy_css;
         cgrp->root = parent->root;
@@ -4221,24 +3747,26 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &parent->flags))
                 set_bit(CGRP_CPUSET_CLONE_CHILDREN, &cgrp->flags);
 
+        /* create the directory */
+        kn = kernfs_create_dir(parent->kn, name, mode, cgrp);
+        if (IS_ERR(kn)) {
+                err = PTR_ERR(kn);
+                goto err_free_id;
+        }
+        cgrp->kn = kn;
+
         /*
-         * Create directory.  cgroup_create_file() returns with the new
-         * directory locked on success so that it can be populated without
-         * dropping cgroup_mutex.
+         * This extra ref will be put in cgroup_free_fn() and guarantees
+         * that @cgrp->kn is always accessible.
          */
-        err = cgroup_create_file(dentry, S_IFDIR | mode, sb);
-        if (err < 0)
-                goto err_free_id;
-        lockdep_assert_held(&dentry->d_inode->i_mutex);
+        kernfs_get(kn);
 
         cgrp->serial_nr = cgroup_serial_nr_next++;
 
         /* allocation complete, commit to creation */
         list_add_tail_rcu(&cgrp->sibling, &cgrp->parent->children);
-        root->number_of_cgroups++;
-
-        /* hold a ref to the parent's dentry */
-        dget(parent->dentry);
+        atomic_inc(&root->nr_cgrps);
+        cgroup_get(parent);
 
         /*
          * @cgrp is now fully operational.  If something fails after this
@@ -4246,49 +3774,66 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         idr_replace(&root->cgroup_idr, cgrp, cgrp->id);
 
+        err = cgroup_kn_set_ugid(kn);
+        if (err)
+                goto err_destroy;
+
         err = cgroup_addrm_files(cgrp, cgroup_base_files, true);
         if (err)
                 goto err_destroy;
 
         /* let's create and online css's */
         for_each_subsys(ss, ssid) {
-                if (root->subsys_mask & (1 << ssid)) {
+                if (root->cgrp.subsys_mask & (1 << ssid)) {
                         err = create_css(cgrp, ss);
                         if (err)
                                 goto err_destroy;
                 }
         }
 
+        kernfs_activate(kn);
+
         mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 
         return 0;
 
 err_free_id:
         idr_remove(&root->cgroup_idr, cgrp->id);
-        /* Release the reference count that we took on the superblock */
-        deactivate_super(sb);
 err_unlock:
         mutex_unlock(&cgroup_mutex);
-err_free_name:
-        kfree(rcu_dereference_raw(cgrp->name));
-err_free_cgrp:
+err_unlock_tree:
+        mutex_unlock(&cgroup_tree_mutex);
         kfree(cgrp);
         return err;
 
 err_destroy:
         cgroup_destroy_locked(cgrp);
         mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
         return err;
 }
 
-static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
+                        umode_t mode)
 {
-        struct cgroup *c_parent = dentry->d_parent->d_fsdata;
+        struct cgroup *parent = parent_kn->priv;
+        int ret;
+
+        /*
+         * cgroup_create() grabs cgroup_tree_mutex which nests outside
+         * kernfs active_ref and cgroup_create() already synchronizes
+         * properly against removal through cgroup_lock_live_group().
+         * Break it before calling cgroup_create().
+         */
+        cgroup_get(parent);
+        kernfs_break_active_protection(parent_kn);
+
+        ret = cgroup_create(parent, name, mode);
 
-        /* the vfs holds inode->i_mutex already */
-        return cgroup_create(c_parent, dentry, mode | S_IFDIR);
+        kernfs_unbreak_active_protection(parent_kn);
+        cgroup_put(parent);
+        return ret;
 }
 
 /*
@@ -4301,6 +3846,7 @@ static void css_killed_work_fn(struct work_struct *work)
                 container_of(work, struct cgroup_subsys_state, destroy_work);
         struct cgroup *cgrp = css->cgroup;
 
+        mutex_lock(&cgroup_tree_mutex);
         mutex_lock(&cgroup_mutex);
 
         /*
@@ -4318,6 +3864,7 @@ static void css_killed_work_fn(struct work_struct *work)
                 cgroup_destroy_css_killed(cgrp);
 
         mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 
         /*
          * Put the css refs from kill_css().  Each css holds an extra
@@ -4339,18 +3886,15 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
         queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
 
-/**
- * kill_css - destroy a css
- * @css: css to destroy
- *
- * This function initiates destruction of @css by removing cgroup interface
- * files and putting its base reference.  ->css_offline() will be invoked
- * asynchronously once css_tryget() is guaranteed to fail and when the
- * reference count reaches zero, @css will be released.
- */
-static void kill_css(struct cgroup_subsys_state *css)
+static void __kill_css(struct cgroup_subsys_state *css)
 {
-        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+        lockdep_assert_held(&cgroup_tree_mutex);
+
+        /*
+         * This must happen before css is disassociated with its cgroup.
+         * See seq_css() for details.
+         */
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->id);
 
         /*
          * Killing would put the base ref, but we need to keep it alive
@@ -4372,6 +3916,28 @@ static void kill_css(struct cgroup_subsys_state *css)
 }
 
 /**
+ * kill_css - destroy a css
+ * @css: css to destroy
+ *
+ * This function initiates destruction of @css by removing cgroup interface
+ * files and putting its base reference.  ->css_offline() will be invoked
+ * asynchronously once css_tryget() is guaranteed to fail and when the
+ * reference count reaches zero, @css will be released.
+ */
+static void kill_css(struct cgroup_subsys_state *css)
+{
+        struct cgroup *cgrp = css->cgroup;
+
+        lockdep_assert_held(&cgroup_tree_mutex);
+
+        /* if already killed, noop */
+        if (cgrp->subsys_mask & (1 << css->ss->id)) {
+                cgrp->subsys_mask &= ~(1 << css->ss->id);
+                __kill_css(css);
+        }
+}
+
+/**
  * cgroup_destroy_locked - the first stage of cgroup destruction
  * @cgrp: cgroup to be destroyed
  *
@@ -4398,22 +3964,21 @@ static void kill_css(struct cgroup_subsys_state *css)
 static int cgroup_destroy_locked(struct cgroup *cgrp)
         __releases(&cgroup_mutex) __acquires(&cgroup_mutex)
 {
-        struct dentry *d = cgrp->dentry;
-        struct cgroup_subsys_state *css;
         struct cgroup *child;
+        struct cgroup_subsys_state *css;
         bool empty;
         int ssid;
 
-        lockdep_assert_held(&d->d_inode->i_mutex);
+        lockdep_assert_held(&cgroup_tree_mutex);
         lockdep_assert_held(&cgroup_mutex);
 
         /*
-         * css_set_lock synchronizes access to ->cset_links and prevents
-         * @cgrp from being removed while __put_css_set() is in progress.
+         * css_set_rwsem synchronizes access to ->cset_links and prevents
+         * @cgrp from being removed while put_css_set() is in progress.
          */
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
         empty = list_empty(&cgrp->cset_links);
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
         if (!empty)
                 return -EBUSY;
 
@@ -4434,14 +3999,6 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
                 return -EBUSY;
 
         /*
-         * Initiate massacre of all css's.  cgroup_destroy_css_killed()
-         * will be invoked to perform the rest of destruction once the
-         * percpu refs of all css's are confirmed to be killed.
-         */
-        for_each_css(css, ssid, cgrp)
-                kill_css(css);
-
-        /*
          * Mark @cgrp dead.  This prevents further task migration and child
          * creation by disabling cgroup_lock_live_group().  Note that
          * CGRP_DEAD assertion is depended upon by css_next_child() to
@@ -4450,6 +4007,17 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
          */
         set_bit(CGRP_DEAD, &cgrp->flags);
 
+        /*
+         * Initiate massacre of all css's.  cgroup_destroy_css_killed()
+         * will be invoked to perform the rest of destruction once the
+         * percpu refs of all css's are confirmed to be killed.  This
+         * involves removing the subsystem's files, drop cgroup_mutex.
+         */
+        mutex_unlock(&cgroup_mutex);
+        for_each_css(css, ssid, cgrp)
+                kill_css(css);
+        mutex_lock(&cgroup_mutex);
+
         /* CGRP_DEAD is set, remove from ->release_list for the last time */
         raw_spin_lock(&release_list_lock);
         if (!list_empty(&cgrp->release_list))
@@ -4465,14 +4033,20 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
         if (!cgrp->nr_css)
                 cgroup_destroy_css_killed(cgrp);
 
+        /* remove @cgrp directory along with the base files */
+        mutex_unlock(&cgroup_mutex);
+
         /*
-         * Clear the base files and remove @cgrp directory.  The removal
-         * puts the base ref but we aren't quite done with @cgrp yet, so
-         * hold onto it.
+         * There are two control paths which try to determine cgroup from
+         * dentry without going through kernfs - cgroupstats_build() and
+         * css_tryget_from_dir().  Those are supported by RCU protecting
+         * clearing of cgrp->kn->priv backpointer, which should happen
+         * after all files under it have been removed.
          */
-        cgroup_addrm_files(cgrp, cgroup_base_files, false);
-        dget(d);
-        cgroup_d_remove_dir(d);
+        kernfs_remove(cgrp->kn);        /* @cgrp has an extra ref on its kn */
+        RCU_INIT_POINTER(*(void __rcu __force **)&cgrp->kn->priv, NULL);
+
+        mutex_lock(&cgroup_mutex);
 
         return 0;
 };
@@ -4489,72 +4063,82 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
 static void cgroup_destroy_css_killed(struct cgroup *cgrp)
 {
         struct cgroup *parent = cgrp->parent;
-        struct dentry *d = cgrp->dentry;
 
+        lockdep_assert_held(&cgroup_tree_mutex);
         lockdep_assert_held(&cgroup_mutex);
 
         /* delete this cgroup from parent->children */
         list_del_rcu(&cgrp->sibling);
 
-        dput(d);
+        cgroup_put(cgrp);
 
         set_bit(CGRP_RELEASABLE, &parent->flags);
         check_for_release(parent);
 }
 
-static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
+static int cgroup_rmdir(struct kernfs_node *kn)
 {
-        int ret;
-
-        mutex_lock(&cgroup_mutex);
-        ret = cgroup_destroy_locked(dentry->d_fsdata);
-        mutex_unlock(&cgroup_mutex);
+        struct cgroup *cgrp = kn->priv;
+        int ret = 0;
 
-        return ret;
-}
+        /*
+         * This is self-destruction but @kn can't be removed while this
+         * callback is in progress.  Let's break active protection.  Once
+         * the protection is broken, @cgrp can be destroyed at any point.
+         * Pin it so that it stays accessible.
+         */
+        cgroup_get(cgrp);
+        kernfs_break_active_protection(kn);
 
-static void __init_or_module cgroup_init_cftsets(struct cgroup_subsys *ss)
-{
-        INIT_LIST_HEAD(&ss->cftsets);
+        mutex_lock(&cgroup_tree_mutex);
+        mutex_lock(&cgroup_mutex);
 
         /*
-         * base_cftset is embedded in subsys itself, no need to worry about
-         * deregistration.
+         * @cgrp might already have been destroyed while we're trying to
+         * grab the mutexes.
          */
-        if (ss->base_cftypes) {
-                struct cftype *cft;
+        if (!cgroup_is_dead(cgrp))
+                ret = cgroup_destroy_locked(cgrp);
 
-                for (cft = ss->base_cftypes; cft->name[0] != '\0'; cft++)
-                        cft->ss = ss;
+        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 
-                ss->base_cftset.cfts = ss->base_cftypes;
-                list_add_tail(&ss->base_cftset.node, &ss->cftsets);
-        }
+        kernfs_unbreak_active_protection(kn);
+        cgroup_put(cgrp);
+        return ret;
 }
 
+static struct kernfs_syscall_ops cgroup_kf_syscall_ops = {
+        .remount_fs             = cgroup_remount,
+        .show_options           = cgroup_show_options,
+        .mkdir                  = cgroup_mkdir,
+        .rmdir                  = cgroup_rmdir,
+        .rename                 = cgroup_rename,
+};
+
 static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
 {
         struct cgroup_subsys_state *css;
 
         printk(KERN_INFO "Initializing cgroup subsys %s\n", ss->name);
 
+        mutex_lock(&cgroup_tree_mutex);
         mutex_lock(&cgroup_mutex);
 
-        /* init base cftset */
-        cgroup_init_cftsets(ss);
+        INIT_LIST_HEAD(&ss->cfts);
 
-        /* Create the top cgroup state for this subsystem */
-        ss->root = &cgroup_dummy_root;
-        css = ss->css_alloc(cgroup_css(cgroup_dummy_top, ss));
+        /* Create the root cgroup state for this subsystem */
+        ss->root = &cgrp_dfl_root;
+        css = ss->css_alloc(cgroup_css(&cgrp_dfl_root.cgrp, ss));
         /* We don't handle early failures gracefully */
         BUG_ON(IS_ERR(css));
-        init_css(css, ss, cgroup_dummy_top);
+        init_css(css, ss, &cgrp_dfl_root.cgrp);
 
         /* Update the init_css_set to contain a subsys
          * pointer to this state - since the subsystem is
          * newly registered, all tasks and hence the
-         * init_css_set is in the subsystem's top cgroup. */
-        init_css_set.subsys[ss->subsys_id] = css;
+         * init_css_set is in the subsystem's root cgroup. */
+        init_css_set.subsys[ss->id] = css;
 
         need_forkexit_callback |= ss->fork || ss->exit;
 
@@ -4565,185 +4149,11 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
 
         BUG_ON(online_css(css));
 
-        mutex_unlock(&cgroup_mutex);
-
-        /* this function shouldn't be used with modular subsystems, since they
-         * need to register a subsys_id, among other things */
-        BUG_ON(ss->module);
-}
-
-/**
- * cgroup_load_subsys: load and register a modular subsystem at runtime
- * @ss: the subsystem to load
- *
- * This function should be called in a modular subsystem's initcall. If the
- * subsystem is built as a module, it will be assigned a new subsys_id and set
- * up for use. If the subsystem is built-in anyway, work is delegated to the
- * simpler cgroup_init_subsys.
- */
-int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
-{
-        struct cgroup_subsys_state *css;
-        int i, ret;
-        struct hlist_node *tmp;
-        struct css_set *cset;
-        unsigned long key;
-
-        /* check name and function validity */
-        if (ss->name == NULL || strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN ||
-            ss->css_alloc == NULL || ss->css_free == NULL)
-                return -EINVAL;
-
-        /*
-         * we don't support callbacks in modular subsystems. this check is
-         * before the ss->module check for consistency; a subsystem that could
-         * be a module should still have no callbacks even if the user isn't
-         * compiling it as one.
-         */
-        if (ss->fork || ss->exit)
-                return -EINVAL;
-
-        /*
-         * an optionally modular subsystem is built-in: we want to do nothing,
-         * since cgroup_init_subsys will have already taken care of it.
-         */
-        if (ss->module == NULL) {
-                /* a sanity check */
-                BUG_ON(cgroup_subsys[ss->subsys_id] != ss);
-                return 0;
-        }
-
-        /* init base cftset */
-        cgroup_init_cftsets(ss);
-
-        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
-        cgroup_subsys[ss->subsys_id] = ss;
-
-        /*
-         * no ss->css_alloc seems to need anything important in the ss
-         * struct, so this can happen first (i.e. before the dummy root
-         * attachment).
-         */
-        css = ss->css_alloc(cgroup_css(cgroup_dummy_top, ss));
-        if (IS_ERR(css)) {
-                /* failure case - need to deassign the cgroup_subsys[] slot. */
-                cgroup_subsys[ss->subsys_id] = NULL;
-                mutex_unlock(&cgroup_root_mutex);
-                mutex_unlock(&cgroup_mutex);
-                return PTR_ERR(css);
-        }
-
-        ss->root = &cgroup_dummy_root;
-
-        /* our new subsystem will be attached to the dummy hierarchy. */
-        init_css(css, ss, cgroup_dummy_top);
-
-        /*
-         * Now we need to entangle the css into the existing css_sets. unlike
-         * in cgroup_init_subsys, there are now multiple css_sets, so each one
-         * will need a new pointer to it; done by iterating the css_set_table.
-         * furthermore, modifying the existing css_sets will corrupt the hash
-         * table state, so each changed css_set will need its hash recomputed.
-         * this is all done under the css_set_lock.
-         */
-        write_lock(&css_set_lock);
-        hash_for_each_safe(css_set_table, i, tmp, cset, hlist) {
-                /* skip entries that we already rehashed */
-                if (cset->subsys[ss->subsys_id])
-                        continue;
-                /* remove existing entry */
-                hash_del(&cset->hlist);
-                /* set new value */
-                cset->subsys[ss->subsys_id] = css;
-                /* recompute hash and restore entry */
-                key = css_set_hash(cset->subsys);
-                hash_add(css_set_table, &cset->hlist, key);
-        }
-        write_unlock(&css_set_lock);
-
-        ret = online_css(css);
-        if (ret) {
-                ss->css_free(css);
-                goto err_unload;
-        }
-
-        /* success! */
-        mutex_unlock(&cgroup_root_mutex);
-        mutex_unlock(&cgroup_mutex);
-        return 0;
-
-err_unload:
-        mutex_unlock(&cgroup_root_mutex);
-        mutex_unlock(&cgroup_mutex);
-        /* @ss can't be mounted here as try_module_get() would fail */
-        cgroup_unload_subsys(ss);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cgroup_load_subsys);
-
-/**
- * cgroup_unload_subsys: unload a modular subsystem
- * @ss: the subsystem to unload
- *
- * This function should be called in a modular subsystem's exitcall. When this
- * function is invoked, the refcount on the subsystem's module will be 0, so
- * the subsystem will not be attached to any hierarchy.
- */
-void cgroup_unload_subsys(struct cgroup_subsys *ss)
-{
-        struct cgrp_cset_link *link;
-        struct cgroup_subsys_state *css;
-
-        BUG_ON(ss->module == NULL);
-
-        /*
-         * we shouldn't be called if the subsystem is in use, and the use of
-         * try_module_get() in rebind_subsystems() should ensure that it
-         * doesn't start being used while we're killing it off.
-         */
-        BUG_ON(ss->root != &cgroup_dummy_root);
-
-        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
-
-        css = cgroup_css(cgroup_dummy_top, ss);
-        if (css)
-                offline_css(css);
+        cgrp_dfl_root.cgrp.subsys_mask |= 1 << ss->id;
 
-        /* deassign the subsys_id */
-        cgroup_subsys[ss->subsys_id] = NULL;
-
-        /*
-         * disentangle the css from all css_sets attached to the dummy
-         * top. as in loading, we need to pay our respects to the hashtable
-         * gods.
-         */
-        write_lock(&css_set_lock);
-        list_for_each_entry(link, &cgroup_dummy_top->cset_links, cset_link) {
-                struct css_set *cset = link->cset;
-                unsigned long key;
-
-                hash_del(&cset->hlist);
-                cset->subsys[ss->subsys_id] = NULL;
-                key = css_set_hash(cset->subsys);
-                hash_add(css_set_table, &cset->hlist, key);
-        }
-        write_unlock(&css_set_lock);
-
-        /*
-         * remove subsystem's css from the cgroup_dummy_top and free it -
-         * need to free before marking as null because ss->css_free needs
-         * the cgrp->subsys pointer to find their state.
-         */
-        if (css)
-                ss->css_free(css);
-        RCU_INIT_POINTER(cgroup_dummy_top->subsys[ss->subsys_id], NULL);
-
-        mutex_unlock(&cgroup_root_mutex);
         mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 }
-EXPORT_SYMBOL_GPL(cgroup_unload_subsys);
 
 /**
  * cgroup_init_early - cgroup initialization at system boot
@@ -4753,34 +4163,24 @@ EXPORT_SYMBOL_GPL(cgroup_unload_subsys);
  */
 int __init cgroup_init_early(void)
 {
+        static struct cgroup_sb_opts __initdata opts =
+                { .flags = CGRP_ROOT_SANE_BEHAVIOR };
         struct cgroup_subsys *ss;
         int i;
 
-        atomic_set(&init_css_set.refcount, 1);
-        INIT_LIST_HEAD(&init_css_set.cgrp_links);
-        INIT_LIST_HEAD(&init_css_set.tasks);
-        INIT_HLIST_NODE(&init_css_set.hlist);
-        css_set_count = 1;
-        init_cgroup_root(&cgroup_dummy_root);
-        cgroup_root_count = 1;
+        init_cgroup_root(&cgrp_dfl_root, &opts);
         RCU_INIT_POINTER(init_task.cgroups, &init_css_set);
 
-        init_cgrp_cset_link.cset = &init_css_set;
-        init_cgrp_cset_link.cgrp = cgroup_dummy_top;
-        list_add(&init_cgrp_cset_link.cset_link, &cgroup_dummy_top->cset_links);
-        list_add(&init_cgrp_cset_link.cgrp_link, &init_css_set.cgrp_links);
-
-        /* at bootup time, we don't worry about modular subsystems */
-        for_each_builtin_subsys(ss, i) {
-                BUG_ON(!ss->name);
-                BUG_ON(strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN);
-                BUG_ON(!ss->css_alloc);
-                BUG_ON(!ss->css_free);
-                if (ss->subsys_id != i) {
-                        printk(KERN_ERR "cgroup: Subsys %s id == %d\n",
-                               ss->name, ss->subsys_id);
-                        BUG();
-                }
+        for_each_subsys(ss, i) {
+                WARN(!ss->css_alloc || !ss->css_free || ss->name || ss->id,
+                     "invalid cgroup_subsys %d:%s css_alloc=%p css_free=%p name:id=%d:%s\n",
+                     i, cgroup_subsys_name[i], ss->css_alloc, ss->css_free,
+                     ss->id, ss->name);
+                WARN(strlen(cgroup_subsys_name[i]) > MAX_CGROUP_TYPE_NAMELEN,
+                     "cgroup_subsys_name %s too long\n", cgroup_subsys_name[i]);
+
+                ss->id = i;
+                ss->name = cgroup_subsys_name[i];
 
                 if (ss->early_init)
                         cgroup_init_subsys(ss);
@@ -4798,53 +4198,46 @@ int __init cgroup_init(void)
 {
         struct cgroup_subsys *ss;
         unsigned long key;
-        int i, err;
+        int ssid, err;
 
-        err = bdi_init(&cgroup_backing_dev_info);
-        if (err)
-                return err;
+        BUG_ON(cgroup_init_cftypes(NULL, cgroup_base_files));
 
-        for_each_builtin_subsys(ss, i) {
-                if (!ss->early_init)
-                        cgroup_init_subsys(ss);
-        }
-
-        /* allocate id for the dummy hierarchy */
+        mutex_lock(&cgroup_tree_mutex);
         mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
 
         /* Add init_css_set to the hash table */
         key = css_set_hash(init_css_set.subsys);
         hash_add(css_set_table, &init_css_set.hlist, key);
 
-        BUG_ON(cgroup_init_root_id(&cgroup_dummy_root, 0, 1));
+        BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0));
 
-        err = idr_alloc(&cgroup_dummy_root.cgroup_idr, cgroup_dummy_top,
-                        0, 1, GFP_KERNEL);
-        BUG_ON(err < 0);
-
-        mutex_unlock(&cgroup_root_mutex);
         mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 
-        cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
-        if (!cgroup_kobj) {
-                err = -ENOMEM;
-                goto out;
+        for_each_subsys(ss, ssid) {
+                if (!ss->early_init)
+                        cgroup_init_subsys(ss);
+
+                /*
+                 * cftype registration needs kmalloc and can't be done
+                 * during early_init.  Register base cftypes separately.
+                 */
+                if (ss->base_cftypes)
+                        WARN_ON(cgroup_add_cftypes(ss, ss->base_cftypes));
         }
 
+        cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
+        if (!cgroup_kobj)
+                return -ENOMEM;
+
         err = register_filesystem(&cgroup_fs_type);
         if (err < 0) {
                 kobject_put(cgroup_kobj);
-                goto out;
+                return err;
         }
 
         proc_create("cgroups", 0, NULL, &proc_cgroupstats_operations);
-
-out:
-        if (err)
-                bdi_destroy(&cgroup_backing_dev_info);
-
-        return err;
+        return 0;
 }
 
 static int __init cgroup_wq_init(void)
@@ -4876,12 +4269,6 @@ core_initcall(cgroup_wq_init);
  * proc_cgroup_show()
  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
  *  - Used for /proc/<pid>/cgroup.
- *  - No need to task_lock(tsk) on this tsk->cgroup reference, as it
- *    doesn't really matter if tsk->cgroup changes after we read it,
- *    and we take cgroup_mutex, keeping cgroup_attach_task() from changing it
- *    anyway.  No need to check that tsk->cgroup != NULL, thanks to
- *    the_top_cgroup_hack in cgroup_exit(), which sets an exiting tasks
- *    cgroup to top_cgroup.
  */
 
 /* TODO: Use a proper seq_file iterator */
@@ -4889,12 +4276,12 @@ int proc_cgroup_show(struct seq_file *m, void *v)
 {
         struct pid *pid;
         struct task_struct *tsk;
-        char *buf;
+        char *buf, *path;
         int retval;
-        struct cgroupfs_root *root;
+        struct cgroup_root *root;
 
         retval = -ENOMEM;
-        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        buf = kmalloc(PATH_MAX, GFP_KERNEL);
         if (!buf)
                 goto out;
 
@@ -4907,29 +4294,36 @@ int proc_cgroup_show(struct seq_file *m, void *v)
         retval = 0;
 
         mutex_lock(&cgroup_mutex);
+        down_read(&css_set_rwsem);
 
-        for_each_active_root(root) {
+        for_each_root(root) {
                 struct cgroup_subsys *ss;
                 struct cgroup *cgrp;
                 int ssid, count = 0;
 
+                if (root == &cgrp_dfl_root && !cgrp_dfl_root_visible)
+                        continue;
+
                 seq_printf(m, "%d:", root->hierarchy_id);
                 for_each_subsys(ss, ssid)
-                        if (root->subsys_mask & (1 << ssid))
+                        if (root->cgrp.subsys_mask & (1 << ssid))
                                 seq_printf(m, "%s%s", count++ ? "," : "", ss->name);
                 if (strlen(root->name))
                         seq_printf(m, "%sname=%s", count ? "," : "",
                                    root->name);
                 seq_putc(m, ':');
                 cgrp = task_cgroup_from_root(tsk, root);
-                retval = cgroup_path(cgrp, buf, PAGE_SIZE);
-                if (retval < 0)
+                path = cgroup_path(cgrp, buf, PATH_MAX);
+                if (!path) {
+                        retval = -ENAMETOOLONG;
                         goto out_unlock;
-                seq_puts(m, buf);
+                }
+                seq_puts(m, path);
                 seq_putc(m, '\n');
         }
 
 out_unlock:
+        up_read(&css_set_rwsem);
         mutex_unlock(&cgroup_mutex);
         put_task_struct(tsk);
 out_free:
@@ -4955,7 +4349,7 @@ static int proc_cgroupstats_show(struct seq_file *m, void *v)
         for_each_subsys(ss, i)
                 seq_printf(m, "%s\t%d\t%d\t%d\n",
                            ss->name, ss->root->hierarchy_id,
-                           ss->root->number_of_cgroups, !ss->disabled);
+                           atomic_read(&ss->root->nr_cgrps), !ss->disabled);
 
         mutex_unlock(&cgroup_mutex);
         return 0;
@@ -4974,27 +4368,16 @@ static const struct file_operations proc_cgroupstats_operations = {
 };
 
 /**
- * cgroup_fork - attach newly forked task to its parents cgroup.
+ * cgroup_fork - initialize cgroup related fields during copy_process()
  * @child: pointer to task_struct of forking parent process.
  *
- * Description: A task inherits its parent's cgroup at fork().
- *
- * A pointer to the shared css_set was automatically copied in
- * fork.c by dup_task_struct().  However, we ignore that copy, since
- * it was not made under the protection of RCU or cgroup_mutex, so
- * might no longer be a valid cgroup pointer.  cgroup_attach_task() might
- * have already changed current->cgroups, allowing the previously
- * referenced cgroup group to be removed and freed.
- *
- * At the point that cgroup_fork() is called, 'current' is the parent
- * task, and the passed argument 'child' points to the child task.
+ * A task is associated with the init_css_set until cgroup_post_fork()
+ * attaches it to the parent's css_set.  Empty cg_list indicates that
+ * @child isn't holding reference to its css_set.
  */
 void cgroup_fork(struct task_struct *child)
 {
-        task_lock(current);
-        get_css_set(task_css_set(current));
-        child->cgroups = current->cgroups;
-        task_unlock(current);
+        RCU_INIT_POINTER(child->cgroups, &init_css_set);
         INIT_LIST_HEAD(&child->cg_list);
 }
 
@@ -5014,23 +4397,37 @@ void cgroup_post_fork(struct task_struct *child)
         int i;
 
         /*
-         * use_task_css_set_links is set to 1 before we walk the tasklist
-         * under the tasklist_lock and we read it here after we added the child
-         * to the tasklist under the tasklist_lock as well. If the child wasn't
-         * yet in the tasklist when we walked through it from
-         * cgroup_enable_task_cg_lists(), then use_task_css_set_links value
-         * should be visible now due to the paired locking and barriers implied
-         * by LOCK/UNLOCK: it is written before the tasklist_lock unlock
-         * in cgroup_enable_task_cg_lists() and read here after the tasklist_lock
-         * lock on fork.
+         * This may race against cgroup_enable_task_cg_links().  As that
+         * function sets use_task_css_set_links before grabbing
+         * tasklist_lock and we just went through tasklist_lock to add
+         * @child, it's guaranteed that either we see the set
+         * use_task_css_set_links or cgroup_enable_task_cg_lists() sees
+         * @child during its iteration.
+         *
+         * If we won the race, @child is associated with %current's
+         * css_set.  Grabbing css_set_rwsem guarantees both that the
+         * association is stable, and, on completion of the parent's
+         * migration, @child is visible in the source of migration or
+         * already in the destination cgroup.  This guarantee is necessary
+         * when implementing operations which need to migrate all tasks of
+         * a cgroup to another.
+         *
+         * Note that if we lose to cgroup_enable_task_cg_links(), @child
+         * will remain in init_css_set.  This is safe because all tasks are
+         * in the init_css_set before cg_links is enabled and there's no
+         * operation which transfers all tasks out of init_css_set.
          */
         if (use_task_css_set_links) {
-                write_lock(&css_set_lock);
-                task_lock(child);
-                if (list_empty(&child->cg_list))
-                        list_add(&child->cg_list, &task_css_set(child)->tasks);
-                task_unlock(child);
-                write_unlock(&css_set_lock);
+                struct css_set *cset;
+
+                down_write(&css_set_rwsem);
+                cset = task_css_set(current);
+                if (list_empty(&child->cg_list)) {
+                        rcu_assign_pointer(child->cgroups, cset);
+                        list_add(&child->cg_list, &cset->tasks);
+                        get_css_set(cset);
+                }
+                up_write(&css_set_rwsem);
         }
 
         /*
@@ -5039,15 +4436,7 @@ void cgroup_post_fork(struct task_struct *child)
          * and addition to css_set.
          */
         if (need_forkexit_callback) {
-                /*
-                 * fork/exit callbacks are supported only for builtin
-                 * subsystems, and the builtin section of the subsys
-                 * array is immutable, so we don't need to lock the
-                 * subsys array here. On the other hand, modular section
-                 * of the array can be freed at module unload, so we
-                 * can't touch that.
-                 */
-                for_each_builtin_subsys(ss, i)
+                for_each_subsys(ss, i)
                         if (ss->fork)
                                 ss->fork(child);
         }
@@ -5056,7 +4445,6 @@ void cgroup_post_fork(struct task_struct *child)
 /**
  * cgroup_exit - detach cgroup from exiting task
  * @tsk: pointer to task_struct of exiting process
- * @run_callback: run exit callbacks?
  *
  * Description: Detach cgroup from @tsk and release it.
  *
@@ -5066,57 +4454,38 @@ void cgroup_post_fork(struct task_struct *child)
  * use notify_on_release cgroups where very high task exit scaling
  * is required on large systems.
  *
- * the_top_cgroup_hack:
- *
- *    Set the exiting tasks cgroup to the root cgroup (top_cgroup).
- *
- *    We call cgroup_exit() while the task is still competent to
- *    handle notify_on_release(), then leave the task attached to the
- *    root cgroup in each hierarchy for the remainder of its exit.
- *
- *    To do this properly, we would increment the reference count on
- *    top_cgroup, and near the very end of the kernel/exit.c do_exit()
- *    code we would add a second cgroup function call, to drop that
- *    reference.  This would just create an unnecessary hot spot on
- *    the top_cgroup reference count, to no avail.
- *
- *    Normally, holding a reference to a cgroup without bumping its
- *    count is unsafe.   The cgroup could go away, or someone could
- *    attach us to a different cgroup, decrementing the count on
- *    the first cgroup that we never incremented.  But in this case,
- *    top_cgroup isn't going away, and either task has PF_EXITING set,
- *    which wards off any cgroup_attach_task() attempts, or task is a failed
- *    fork, never visible to cgroup_attach_task.
+ * We set the exiting tasks cgroup to the root cgroup (top_cgroup).  We
+ * call cgroup_exit() while the task is still competent to handle
+ * notify_on_release(), then leave the task attached to the root cgroup in
+ * each hierarchy for the remainder of its exit.  No need to bother with
+ * init_css_set refcnting.  init_css_set never goes away and we can't race
+ * with migration path - PF_EXITING is visible to migration path.
  */
-void cgroup_exit(struct task_struct *tsk, int run_callbacks)
+void cgroup_exit(struct task_struct *tsk)
 {
         struct cgroup_subsys *ss;
         struct css_set *cset;
+        bool put_cset = false;
         int i;
 
         /*
-         * Unlink from the css_set task list if necessary.
-         * Optimistically check cg_list before taking
-         * css_set_lock
+         * Unlink from @tsk from its css_set.  As migration path can't race
+         * with us, we can check cg_list without grabbing css_set_rwsem.
          */
         if (!list_empty(&tsk->cg_list)) {
-                write_lock(&css_set_lock);
-                if (!list_empty(&tsk->cg_list))
-                        list_del_init(&tsk->cg_list);
-                write_unlock(&css_set_lock);
+                down_write(&css_set_rwsem);
+                list_del_init(&tsk->cg_list);
+                up_write(&css_set_rwsem);
+                put_cset = true;
         }
 
         /* Reassign the task to the init_css_set. */
-        task_lock(tsk);
         cset = task_css_set(tsk);
         RCU_INIT_POINTER(tsk->cgroups, &init_css_set);
 
-        if (run_callbacks && need_forkexit_callback) {
-                /*
-                 * fork/exit callbacks are supported only for builtin
-                 * subsystems, see cgroup_post_fork() for details.
-                 */
-                for_each_builtin_subsys(ss, i) {
+        if (need_forkexit_callback) {
+                /* see cgroup_post_fork() for details */
+                for_each_subsys(ss, i) {
                         if (ss->exit) {
                                 struct cgroup_subsys_state *old_css = cset->subsys[i];
                                 struct cgroup_subsys_state *css = task_css(tsk, i);
@@ -5125,9 +4494,9 @@ void cgroup_exit(struct task_struct *tsk, int run_callbacks)
                         }
                 }
         }
-        task_unlock(tsk);
 
-        put_css_set_taskexit(cset);
+        if (put_cset)
+                put_css_set(cset, true);
 }
 
 static void check_for_release(struct cgroup *cgrp)
@@ -5184,16 +4553,17 @@ static void cgroup_release_agent(struct work_struct *work)
         while (!list_empty(&release_list)) {
                 char *argv[3], *envp[3];
                 int i;
-                char *pathbuf = NULL, *agentbuf = NULL;
+                char *pathbuf = NULL, *agentbuf = NULL, *path;
                 struct cgroup *cgrp = list_entry(release_list.next,
                                                     struct cgroup,
                                                     release_list);
                 list_del_init(&cgrp->release_list);
                 raw_spin_unlock(&release_list_lock);
-                pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+                pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
                 if (!pathbuf)
                         goto continue_free;
-                if (cgroup_path(cgrp, pathbuf, PAGE_SIZE) < 0)
+                path = cgroup_path(cgrp, pathbuf, PATH_MAX);
+                if (!path)
                         goto continue_free;
                 agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL);
                 if (!agentbuf)
@@ -5201,7 +4571,7 @@ static void cgroup_release_agent(struct work_struct *work)
 
                 i = 0;
                 argv[i++] = agentbuf;
-                argv[i++] = pathbuf;
+                argv[i++] = path;
                 argv[i] = NULL;
 
                 i = 0;
@@ -5235,11 +4605,7 @@ static int __init cgroup_disable(char *str)
                 if (!*token)
                         continue;
 
-                /*
-                 * cgroup_disable, being at boot time, can't know about
-                 * module subsystems, so we don't worry about them.
-                 */
-                for_each_builtin_subsys(ss, i) {
+                for_each_subsys(ss, i) {
                         if (!strcmp(token, ss->name)) {
                                 ss->disabled = 1;
                                 printk(KERN_INFO "Disabling %s control group"
@@ -5253,28 +4619,42 @@ static int __init cgroup_disable(char *str)
 __setup("cgroup_disable=", cgroup_disable);
 
 /**
- * css_from_dir - get corresponding css from the dentry of a cgroup dir
+ * css_tryget_from_dir - get corresponding css from the dentry of a cgroup dir
  * @dentry: directory dentry of interest
  * @ss: subsystem of interest
  *
- * Must be called under cgroup_mutex or RCU read lock.  The caller is
- * responsible for pinning the returned css if it needs to be accessed
- * outside the critical section.
+ * If @dentry is a directory for a cgroup which has @ss enabled on it, try
+ * to get the corresponding css and return it.  If such css doesn't exist
+ * or can't be pinned, an ERR_PTR value is returned.
  */
-struct cgroup_subsys_state *css_from_dir(struct dentry *dentry,
-                                         struct cgroup_subsys *ss)
+struct cgroup_subsys_state *css_tryget_from_dir(struct dentry *dentry,
+                                                struct cgroup_subsys *ss)
 {
+        struct kernfs_node *kn = kernfs_node_from_dentry(dentry);
+        struct cgroup_subsys_state *css = NULL;
         struct cgroup *cgrp;
 
-        cgroup_assert_mutex_or_rcu_locked();
-
         /* is @dentry a cgroup dir? */
-        if (!dentry->d_inode ||
-            dentry->d_inode->i_op != &cgroup_dir_inode_operations)
+        if (dentry->d_sb->s_type != &cgroup_fs_type || !kn ||
+            kernfs_type(kn) != KERNFS_DIR)
                 return ERR_PTR(-EBADF);
 
-        cgrp = __d_cgrp(dentry);
-        return cgroup_css(cgrp, ss) ?: ERR_PTR(-ENOENT);
+        rcu_read_lock();
+
+        /*
+         * This path doesn't originate from kernfs and @kn could already
+         * have been or be removed at any point.  @kn->priv is RCU
+         * protected for this access.  See destroy_locked() for details.
+         */
+        cgrp = rcu_dereference(kn->priv);
+        if (cgrp)
+                css = cgroup_css(cgrp, ss);
+
+        if (!css || !css_tryget(css))
+                css = ERR_PTR(-ENOENT);
+
+        rcu_read_unlock();
+        return css;
 }
 
 /**
@@ -5289,7 +4669,7 @@ struct cgroup_subsys_state *css_from_id(int id, struct cgroup_subsys *ss)
 {
         struct cgroup *cgrp;
 
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
 
         cgrp = idr_find(&ss->root->cgroup_idr, id);
         if (cgrp)
@@ -5341,23 +4721,25 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
 {
         struct cgrp_cset_link *link;
         struct css_set *cset;
+        char *name_buf;
 
-        read_lock(&css_set_lock);
+        name_buf = kmalloc(NAME_MAX + 1, GFP_KERNEL);
+        if (!name_buf)
+                return -ENOMEM;
+
+        down_read(&css_set_rwsem);
         rcu_read_lock();
         cset = rcu_dereference(current->cgroups);
         list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
                 struct cgroup *c = link->cgrp;
-                const char *name;
 
-                if (c->dentry)
-                        name = c->dentry->d_name.name;
-                else
-                        name = "?";
+                cgroup_name(c, name_buf, NAME_MAX + 1);
                 seq_printf(seq, "Root %d group %s\n",
-                           c->root->hierarchy_id, name);
+                           c->root->hierarchy_id, name_buf);
         }
         rcu_read_unlock();
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
+        kfree(name_buf);
         return 0;
 }
 
@@ -5367,23 +4749,30 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
         struct cgroup_subsys_state *css = seq_css(seq);
         struct cgrp_cset_link *link;
 
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
         list_for_each_entry(link, &css->cgroup->cset_links, cset_link) {
                 struct css_set *cset = link->cset;
                 struct task_struct *task;
                 int count = 0;
+
                 seq_printf(seq, "css_set %p\n", cset);
+
                 list_for_each_entry(task, &cset->tasks, cg_list) {
-                        if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
-                                seq_puts(seq, "  ...\n");
-                                break;
-                        } else {
-                                seq_printf(seq, "  task %d\n",
-                                           task_pid_vnr(task));
-                        }
+                        if (count++ > MAX_TASKS_SHOWN_PER_CSS)
+                                goto overflow;
+                        seq_printf(seq, "  task %d\n", task_pid_vnr(task));
+                }
+
+                list_for_each_entry(task, &cset->mg_tasks, cg_list) {
+                        if (count++ > MAX_TASKS_SHOWN_PER_CSS)
+                                goto overflow;
+                        seq_printf(seq, "  task %d\n", task_pid_vnr(task));
                 }
+                continue;
+        overflow:
+                seq_puts(seq, "  ...\n");
         }
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
         return 0;
 }
 
@@ -5426,11 +4815,9 @@ static struct cftype debug_files[] =  {
         { }     /* terminate */
 };
 
-struct cgroup_subsys debug_subsys = {
-        .name = "debug",
+struct cgroup_subsys debug_cgrp_subsys = {
         .css_alloc = debug_css_alloc,
         .css_free = debug_css_free,
-        .subsys_id = debug_subsys_id,
         .base_cftypes = debug_files,
 };
 #endif /* CONFIG_CGROUP_DEBUG */
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index 6c3154e477f6..2bc4a2256444 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -52,7 +52,7 @@ static inline struct freezer *css_freezer(struct cgroup_subsys_state *css)
 
 static inline struct freezer *task_freezer(struct task_struct *task)
 {
-        return css_freezer(task_css(task, freezer_subsys_id));
+        return css_freezer(task_css(task, freezer_cgrp_id));
 }
 
 static struct freezer *parent_freezer(struct freezer *freezer)
@@ -84,8 +84,6 @@ static const char *freezer_state_strs(unsigned int state)
         return "THAWED";
 };
 
-struct cgroup_subsys freezer_subsys;
-
 static struct cgroup_subsys_state *
 freezer_css_alloc(struct cgroup_subsys_state *parent_css)
 {
@@ -189,7 +187,7 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
          * current state before executing the following - !frozen tasks may
          * be visible in a FROZEN cgroup and frozen tasks in a THAWED one.
          */
-        cgroup_taskset_for_each(task, new_css, tset) {
+        cgroup_taskset_for_each(task, tset) {
                 if (!(freezer->state & CGROUP_FREEZING)) {
                         __thaw_task(task);
                 } else {
@@ -216,6 +214,16 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
         }
 }
 
+/**
+ * freezer_fork - cgroup post fork callback
+ * @task: a task which has just been forked
+ *
+ * @task has just been created and should conform to the current state of
+ * the cgroup_freezer it belongs to.  This function may race against
+ * freezer_attach().  Losing to freezer_attach() means that we don't have
+ * to do anything as freezer_attach() will put @task into the appropriate
+ * state.
+ */
 static void freezer_fork(struct task_struct *task)
 {
         struct freezer *freezer;
@@ -224,14 +232,26 @@ static void freezer_fork(struct task_struct *task)
         freezer = task_freezer(task);
 
         /*
-         * The root cgroup is non-freezable, so we can skip the
-         * following check.
+         * The root cgroup is non-freezable, so we can skip locking the
+         * freezer.  This is safe regardless of race with task migration.
+         * If we didn't race or won, skipping is obviously the right thing
+         * to do.  If we lost and root is the new cgroup, noop is still the
+         * right thing to do.
          */
         if (!parent_freezer(freezer))
                 goto out;
 
+        /*
+         * Grab @freezer->lock and freeze @task after verifying @task still
+         * belongs to @freezer and it's freezing.  The former is for the
+         * case where we have raced against task migration and lost and
+         * @task is already in a different cgroup which may not be frozen.
+         * This isn't strictly necessary as freeze_task() is allowed to be
+         * called spuriously but let's do it anyway for, if nothing else,
+         * documentation.
+         */
         spin_lock_irq(&freezer->lock);
-        if (freezer->state & CGROUP_FREEZING)
+        if (freezer == task_freezer(task) && (freezer->state & CGROUP_FREEZING))
                 freeze_task(task);
         spin_unlock_irq(&freezer->lock);
 out:
@@ -422,7 +442,7 @@ static void freezer_change_state(struct freezer *freezer, bool freeze)
 }
 
 static int freezer_write(struct cgroup_subsys_state *css, struct cftype *cft,
-                         const char *buffer)
+                         char *buffer)
 {
         bool freeze;
 
@@ -473,13 +493,11 @@ static struct cftype files[] = {
         { }     /* terminate */
 };
 
-struct cgroup_subsys freezer_subsys = {
-        .name           = "freezer",
+struct cgroup_subsys freezer_cgrp_subsys = {
         .css_alloc      = freezer_css_alloc,
         .css_online     = freezer_css_online,
         .css_offline    = freezer_css_offline,
         .css_free       = freezer_css_free,
-        .subsys_id      = freezer_subsys_id,
         .attach         = freezer_attach,
         .fork           = freezer_fork,
         .base_cftypes   = files,
diff --git a/kernel/cpu.c b/kernel/cpu.c
index deff2e693766..a9e710eef0e2 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/mutex.h>
 #include <linux/gfp.h>
 #include <linux/suspend.h>
+#include <linux/lockdep.h>
 
 #include "smpboot.h"
 
@@ -27,18 +28,23 @@
 static DEFINE_MUTEX(cpu_add_remove_lock);
 
 /*
- * The following two API's must be used when attempting
- * to serialize the updates to cpu_online_mask, cpu_present_mask.
+ * The following two APIs (cpu_maps_update_begin/done) must be used when
+ * attempting to serialize the updates to cpu_online_mask & cpu_present_mask.
+ * The APIs cpu_notifier_register_begin/done() must be used to protect CPU
+ * hotplug callback (un)registration performed using __register_cpu_notifier()
+ * or __unregister_cpu_notifier().
  */
 void cpu_maps_update_begin(void)
 {
         mutex_lock(&cpu_add_remove_lock);
 }
+EXPORT_SYMBOL(cpu_notifier_register_begin);
 
 void cpu_maps_update_done(void)
 {
         mutex_unlock(&cpu_add_remove_lock);
 }
+EXPORT_SYMBOL(cpu_notifier_register_done);
 
 static RAW_NOTIFIER_HEAD(cpu_chain);
 
@@ -57,17 +63,30 @@ static struct {
          * an ongoing cpu hotplug operation.
          */
         int refcount;
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map dep_map;
+#endif
 } cpu_hotplug = {
         .active_writer = NULL,
         .lock = __MUTEX_INITIALIZER(cpu_hotplug.lock),
         .refcount = 0,
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        .dep_map = {.name = "cpu_hotplug.lock" },
+#endif
 };
 
+/* Lockdep annotations for get/put_online_cpus() and cpu_hotplug_begin/end() */
+#define cpuhp_lock_acquire_read() lock_map_acquire_read(&cpu_hotplug.dep_map)
+#define cpuhp_lock_acquire()      lock_map_acquire(&cpu_hotplug.dep_map)
+#define cpuhp_lock_release()      lock_map_release(&cpu_hotplug.dep_map)
+
 void get_online_cpus(void)
 {
         might_sleep();
         if (cpu_hotplug.active_writer == current)
                 return;
+        cpuhp_lock_acquire_read();
         mutex_lock(&cpu_hotplug.lock);
         cpu_hotplug.refcount++;
         mutex_unlock(&cpu_hotplug.lock);
@@ -87,6 +106,7 @@ void put_online_cpus(void)
         if (!--cpu_hotplug.refcount && unlikely(cpu_hotplug.active_writer))
                 wake_up_process(cpu_hotplug.active_writer);
         mutex_unlock(&cpu_hotplug.lock);
+        cpuhp_lock_release();
 
 }
 EXPORT_SYMBOL_GPL(put_online_cpus);
@@ -117,6 +137,7 @@ void cpu_hotplug_begin(void)
 {
         cpu_hotplug.active_writer = current;
 
+        cpuhp_lock_acquire();
         for (;;) {
                 mutex_lock(&cpu_hotplug.lock);
                 if (likely(!cpu_hotplug.refcount))
@@ -131,6 +152,7 @@ void cpu_hotplug_done(void)
 {
         cpu_hotplug.active_writer = NULL;
         mutex_unlock(&cpu_hotplug.lock);
+        cpuhp_lock_release();
 }
 
 /*
@@ -166,6 +188,11 @@ int __ref register_cpu_notifier(struct notifier_block *nb)
         return ret;
 }
 
+int __ref __register_cpu_notifier(struct notifier_block *nb)
+{
+        return raw_notifier_chain_register(&cpu_chain, nb);
+}
+
 static int __cpu_notify(unsigned long val, void *v, int nr_to_call,
                         int *nr_calls)
 {
@@ -189,6 +216,7 @@ static void cpu_notify_nofail(unsigned long val, void *v)
         BUG_ON(cpu_notify(val, v));
 }
 EXPORT_SYMBOL(register_cpu_notifier);
+EXPORT_SYMBOL(__register_cpu_notifier);
 
 void __ref unregister_cpu_notifier(struct notifier_block *nb)
 {
@@ -198,6 +226,12 @@ void __ref unregister_cpu_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_cpu_notifier);
 
+void __ref __unregister_cpu_notifier(struct notifier_block *nb)
+{
+        raw_notifier_chain_unregister(&cpu_chain, nb);
+}
+EXPORT_SYMBOL(__unregister_cpu_notifier);
+
 /**
  * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
  * @cpu: a CPU id
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index e6b1b66afe52..3d54c418bd06 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -119,7 +119,7 @@ static inline struct cpuset *css_cs(struct cgroup_subsys_state *css)
 /* Retrieve the cpuset for a task */
 static inline struct cpuset *task_cs(struct task_struct *task)
 {
-        return css_cs(task_css(task, cpuset_subsys_id));
+        return css_cs(task_css(task, cpuset_cgrp_id));
 }
 
 static inline struct cpuset *parent_cs(struct cpuset *cs)
@@ -467,7 +467,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
          * be changed to have empty cpus_allowed or mems_allowed.
          */
         ret = -ENOSPC;
-        if ((cgroup_task_count(cur->css.cgroup) || cur->attach_in_progress)) {
+        if ((cgroup_has_tasks(cur->css.cgroup) || cur->attach_in_progress)) {
                 if (!cpumask_empty(cur->cpus_allowed) &&
                     cpumask_empty(trial->cpus_allowed))
                         goto out;
@@ -829,55 +829,36 @@ static struct cpuset *effective_nodemask_cpuset(struct cpuset *cs)
 }
 
 /**
- * cpuset_change_cpumask - make a task's cpus_allowed the same as its cpuset's
- * @tsk: task to test
- * @data: cpuset to @tsk belongs to
- *
- * Called by css_scan_tasks() for each task in a cgroup whose cpus_allowed
- * mask needs to be changed.
- *
- * We don't need to re-check for the cgroup/cpuset membership, since we're
- * holding cpuset_mutex at this point.
- */
-static void cpuset_change_cpumask(struct task_struct *tsk, void *data)
-{
-        struct cpuset *cs = data;
-        struct cpuset *cpus_cs = effective_cpumask_cpuset(cs);
-
-        set_cpus_allowed_ptr(tsk, cpus_cs->cpus_allowed);
-}
-
-/**
  * update_tasks_cpumask - Update the cpumasks of tasks in the cpuset.
  * @cs: the cpuset in which each task's cpus_allowed mask needs to be changed
- * @heap: if NULL, defer allocating heap memory to css_scan_tasks()
- *
- * Called with cpuset_mutex held
  *
- * The css_scan_tasks() function will scan all the tasks in a cgroup,
- * calling callback functions for each.
- *
- * No return value. It's guaranteed that css_scan_tasks() always returns 0
- * if @heap != NULL.
+ * Iterate through each task of @cs updating its cpus_allowed to the
+ * effective cpuset's.  As this function is called with cpuset_mutex held,
+ * cpuset membership stays stable.
  */
-static void update_tasks_cpumask(struct cpuset *cs, struct ptr_heap *heap)
+static void update_tasks_cpumask(struct cpuset *cs)
 {
-        css_scan_tasks(&cs->css, NULL, cpuset_change_cpumask, cs, heap);
+        struct cpuset *cpus_cs = effective_cpumask_cpuset(cs);
+        struct css_task_iter it;
+        struct task_struct *task;
+
+        css_task_iter_start(&cs->css, &it);
+        while ((task = css_task_iter_next(&it)))
+                set_cpus_allowed_ptr(task, cpus_cs->cpus_allowed);
+        css_task_iter_end(&it);
 }
 
 /*
  * update_tasks_cpumask_hier - Update the cpumasks of tasks in the hierarchy.
  * @root_cs: the root cpuset of the hierarchy
  * @update_root: update root cpuset or not?
- * @heap: the heap used by css_scan_tasks()
  *
  * This will update cpumasks of tasks in @root_cs and all other empty cpusets
  * which take on cpumask of @root_cs.
  *
  * Called with cpuset_mutex held
  */
-static void update_tasks_cpumask_hier(struct cpuset *root_cs,
-                                      bool update_root, struct ptr_heap *heap)
+static void update_tasks_cpumask_hier(struct cpuset *root_cs, bool update_root)
 {
         struct cpuset *cp;
         struct cgroup_subsys_state *pos_css;
@@ -898,7 +879,7 @@ static void update_tasks_cpumask_hier(struct cpuset *root_cs,
                         continue;
                 rcu_read_unlock();
 
-                update_tasks_cpumask(cp, heap);
+                update_tasks_cpumask(cp);
 
                 rcu_read_lock();
                 css_put(&cp->css);
@@ -914,7 +895,6 @@ static void update_tasks_cpumask_hier(struct cpuset *root_cs,
 static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
                           const char *buf)
 {
-        struct ptr_heap heap;
         int retval;
         int is_load_balanced;
 
@@ -947,19 +927,13 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
         if (retval < 0)
                 return retval;
 
-        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (retval)
-                return retval;
-
         is_load_balanced = is_sched_load_balance(trialcs);
 
         mutex_lock(&callback_mutex);
         cpumask_copy(cs->cpus_allowed, trialcs->cpus_allowed);
         mutex_unlock(&callback_mutex);
 
-        update_tasks_cpumask_hier(cs, true, &heap);
-
-        heap_free(&heap);
+        update_tasks_cpumask_hier(cs, true);
 
         if (is_load_balanced)
                 rebuild_sched_domains_locked();
@@ -1022,7 +996,7 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
         task_lock(tsk);
         /*
          * Determine if a loop is necessary if another thread is doing
-         * get_mems_allowed().  If at least one node remains unchanged and
+         * read_mems_allowed_begin().  If at least one node remains unchanged and
          * tsk does not have a mempolicy, then an empty nodemask will not be
          * possible when mems_allowed is larger than a word.
          */
@@ -1048,53 +1022,22 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
         task_unlock(tsk);
 }
 
-struct cpuset_change_nodemask_arg {
-        struct cpuset           *cs;
-        nodemask_t              *newmems;
-};
-
-/*
- * Update task's mems_allowed and rebind its mempolicy and vmas' mempolicy
- * of it to cpuset's new mems_allowed, and migrate pages to new nodes if
- * memory_migrate flag is set. Called with cpuset_mutex held.
- */
-static void cpuset_change_nodemask(struct task_struct *p, void *data)
-{
-        struct cpuset_change_nodemask_arg *arg = data;
-        struct cpuset *cs = arg->cs;
-        struct mm_struct *mm;
-        int migrate;
-
-        cpuset_change_task_nodemask(p, arg->newmems);
-
-        mm = get_task_mm(p);
-        if (!mm)
-                return;
-
-        migrate = is_memory_migrate(cs);
-
-        mpol_rebind_mm(mm, &cs->mems_allowed);
-        if (migrate)
-                cpuset_migrate_mm(mm, &cs->old_mems_allowed, arg->newmems);
-        mmput(mm);
-}
-
 static void *cpuset_being_rebound;
 
 /**
  * update_tasks_nodemask - Update the nodemasks of tasks in the cpuset.
  * @cs: the cpuset in which each task's mems_allowed mask needs to be changed
- * @heap: if NULL, defer allocating heap memory to css_scan_tasks()
  *
- * Called with cpuset_mutex held.  No return value. It's guaranteed that
- * css_scan_tasks() always returns 0 if @heap != NULL.
+ * Iterate through each task of @cs updating its mems_allowed to the
+ * effective cpuset's.  As this function is called with cpuset_mutex held,
+ * cpuset membership stays stable.
  */
-static void update_tasks_nodemask(struct cpuset *cs, struct ptr_heap *heap)
+static void update_tasks_nodemask(struct cpuset *cs)
 {
         static nodemask_t newmems;      /* protected by cpuset_mutex */
         struct cpuset *mems_cs = effective_nodemask_cpuset(cs);
-        struct cpuset_change_nodemask_arg arg = { .cs = cs,
-                                                  .newmems = &newmems };
+        struct css_task_iter it;
+        struct task_struct *task;
 
         cpuset_being_rebound = cs;              /* causes mpol_dup() rebind */
 
@@ -1110,7 +1053,25 @@ static void update_tasks_nodemask(struct cpuset *cs, struct ptr_heap *heap)
          * It's ok if we rebind the same mm twice; mpol_rebind_mm()
          * is idempotent.  Also migrate pages in each mm to new nodes.
          */
-        css_scan_tasks(&cs->css, NULL, cpuset_change_nodemask, &arg, heap);
+        css_task_iter_start(&cs->css, &it);
+        while ((task = css_task_iter_next(&it))) {
+                struct mm_struct *mm;
+                bool migrate;
+
+                cpuset_change_task_nodemask(task, &newmems);
+
+                mm = get_task_mm(task);
+                if (!mm)
+                        continue;
+
+                migrate = is_memory_migrate(cs);
+
+                mpol_rebind_mm(mm, &cs->mems_allowed);
+                if (migrate)
+                        cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
+                mmput(mm);
+        }
+        css_task_iter_end(&it);
 
         /*
          * All the tasks' nodemasks have been updated, update
@@ -1126,15 +1087,13 @@ static void update_tasks_nodemask(struct cpuset *cs, struct ptr_heap *heap)
  * update_tasks_nodemask_hier - Update the nodemasks of tasks in the hierarchy.
  * @cs: the root cpuset of the hierarchy
  * @update_root: update the root cpuset or not?
- * @heap: the heap used by css_scan_tasks()
  *
  * This will update nodemasks of tasks in @root_cs and all other empty cpusets
  * which take on nodemask of @root_cs.
  *
  * Called with cpuset_mutex held
  */
-static void update_tasks_nodemask_hier(struct cpuset *root_cs,
-                                       bool update_root, struct ptr_heap *heap)
+static void update_tasks_nodemask_hier(struct cpuset *root_cs, bool update_root)
 {
         struct cpuset *cp;
         struct cgroup_subsys_state *pos_css;
@@ -1155,7 +1114,7 @@ static void update_tasks_nodemask_hier(struct cpuset *root_cs,
                         continue;
                 rcu_read_unlock();
 
-                update_tasks_nodemask(cp, heap);
+                update_tasks_nodemask(cp);
 
                 rcu_read_lock();
                 css_put(&cp->css);
@@ -1180,7 +1139,6 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
                            const char *buf)
 {
         int retval;
-        struct ptr_heap heap;
 
         /*
          * top_cpuset.mems_allowed tracks node_stats[N_MEMORY];
@@ -1219,17 +1177,11 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
         if (retval < 0)
                 goto done;
 
-        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (retval < 0)
-                goto done;
-
         mutex_lock(&callback_mutex);
         cs->mems_allowed = trialcs->mems_allowed;
         mutex_unlock(&callback_mutex);
 
-        update_tasks_nodemask_hier(cs, true, &heap);
-
-        heap_free(&heap);
+        update_tasks_nodemask_hier(cs, true);
 done:
         return retval;
 }
@@ -1257,38 +1209,22 @@ static int update_relax_domain_level(struct cpuset *cs, s64 val)
 }
 
 /**
- * cpuset_change_flag - make a task's spread flags the same as its cpuset's
- * @tsk: task to be updated
- * @data: cpuset to @tsk belongs to
- *
- * Called by css_scan_tasks() for each task in a cgroup.
- *
- * We don't need to re-check for the cgroup/cpuset membership, since we're
- * holding cpuset_mutex at this point.
- */
-static void cpuset_change_flag(struct task_struct *tsk, void *data)
-{
-        struct cpuset *cs = data;
-
-        cpuset_update_task_spread_flag(cs, tsk);
-}
-
-/**
  * update_tasks_flags - update the spread flags of tasks in the cpuset.
  * @cs: the cpuset in which each task's spread flags needs to be changed
- * @heap: if NULL, defer allocating heap memory to css_scan_tasks()
- *
- * Called with cpuset_mutex held
  *
- * The css_scan_tasks() function will scan all the tasks in a cgroup,
- * calling callback functions for each.
- *
- * No return value. It's guaranteed that css_scan_tasks() always returns 0
- * if @heap != NULL.
+ * Iterate through each task of @cs updating its spread flags.  As this
+ * function is called with cpuset_mutex held, cpuset membership stays
+ * stable.
  */
-static void update_tasks_flags(struct cpuset *cs, struct ptr_heap *heap)
+static void update_tasks_flags(struct cpuset *cs)
 {
-        css_scan_tasks(&cs->css, NULL, cpuset_change_flag, cs, heap);
+        struct css_task_iter it;
+        struct task_struct *task;
+
+        css_task_iter_start(&cs->css, &it);
+        while ((task = css_task_iter_next(&it)))
+                cpuset_update_task_spread_flag(cs, task);
+        css_task_iter_end(&it);
 }
 
 /*
@@ -1306,7 +1242,6 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
         struct cpuset *trialcs;
         int balance_flag_changed;
         int spread_flag_changed;
-        struct ptr_heap heap;
         int err;
 
         trialcs = alloc_trial_cpuset(cs);
@@ -1322,10 +1257,6 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
         if (err < 0)
                 goto out;
 
-        err = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (err < 0)
-                goto out;
-
         balance_flag_changed = (is_sched_load_balance(cs) !=
                                 is_sched_load_balance(trialcs));
 
@@ -1340,8 +1271,7 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
                 rebuild_sched_domains_locked();
 
         if (spread_flag_changed)
-                update_tasks_flags(cs, &heap);
-        heap_free(&heap);
+                update_tasks_flags(cs);
 out:
         free_trial_cpuset(trialcs);
         return err;
@@ -1445,6 +1375,8 @@ static int fmeter_getrate(struct fmeter *fmp)
         return val;
 }
 
+static struct cpuset *cpuset_attach_old_cs;
+
 /* Called by cgroups to determine if a cpuset is usable; cpuset_mutex held */
 static int cpuset_can_attach(struct cgroup_subsys_state *css,
                              struct cgroup_taskset *tset)
@@ -1453,6 +1385,9 @@ static int cpuset_can_attach(struct cgroup_subsys_state *css,
         struct task_struct *task;
         int ret;
 
+        /* used later by cpuset_attach() */
+        cpuset_attach_old_cs = task_cs(cgroup_taskset_first(tset));
+
         mutex_lock(&cpuset_mutex);
 
         /*
@@ -1464,7 +1399,7 @@ static int cpuset_can_attach(struct cgroup_subsys_state *css,
             (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed)))
                 goto out_unlock;
 
-        cgroup_taskset_for_each(task, css, tset) {
+        cgroup_taskset_for_each(task, tset) {
                 /*
                  * Kthreads which disallow setaffinity shouldn't be moved
                  * to a new cpuset; we don't want to change their cpu
@@ -1516,10 +1451,8 @@ static void cpuset_attach(struct cgroup_subsys_state *css,
         struct mm_struct *mm;
         struct task_struct *task;
         struct task_struct *leader = cgroup_taskset_first(tset);
-        struct cgroup_subsys_state *oldcss = cgroup_taskset_cur_css(tset,
-                                                        cpuset_subsys_id);
         struct cpuset *cs = css_cs(css);
-        struct cpuset *oldcs = css_cs(oldcss);
+        struct cpuset *oldcs = cpuset_attach_old_cs;
         struct cpuset *cpus_cs = effective_cpumask_cpuset(cs);
         struct cpuset *mems_cs = effective_nodemask_cpuset(cs);
 
@@ -1533,7 +1466,7 @@ static void cpuset_attach(struct cgroup_subsys_state *css,
 
         guarantee_online_mems(mems_cs, &cpuset_attach_nodemask_to);
 
-        cgroup_taskset_for_each(task, css, tset) {
+        cgroup_taskset_for_each(task, tset) {
                 /*
                  * can_attach beforehand should guarantee that this doesn't
                  * fail.  TODO: have a better way to handle failure here
@@ -1673,7 +1606,7 @@ out_unlock:
  * Common handling for a write to a "cpus" or "mems" file.
  */
 static int cpuset_write_resmask(struct cgroup_subsys_state *css,
-                                struct cftype *cft, const char *buf)
+                                struct cftype *cft, char *buf)
 {
         struct cpuset *cs = css_cs(css);
         struct cpuset *trialcs;
@@ -2020,8 +1953,7 @@ static void cpuset_css_free(struct cgroup_subsys_state *css)
         kfree(cs);
 }
 
-struct cgroup_subsys cpuset_subsys = {
-        .name = "cpuset",
+struct cgroup_subsys cpuset_cgrp_subsys = {
         .css_alloc = cpuset_css_alloc,
         .css_online = cpuset_css_online,
         .css_offline = cpuset_css_offline,
@@ -2029,7 +1961,6 @@ struct cgroup_subsys cpuset_subsys = {
         .can_attach = cpuset_can_attach,
         .cancel_attach = cpuset_cancel_attach,
         .attach = cpuset_attach,
-        .subsys_id = cpuset_subsys_id,
         .base_cftypes = files,
         .early_init = 1,
 };
@@ -2086,10 +2017,9 @@ static void remove_tasks_in_empty_cpuset(struct cpuset *cs)
                 parent = parent_cs(parent);
 
         if (cgroup_transfer_tasks(parent->css.cgroup, cs->css.cgroup)) {
-                rcu_read_lock();
-                printk(KERN_ERR "cpuset: failed to transfer tasks out of empty cpuset %s\n",
-                       cgroup_name(cs->css.cgroup));
-                rcu_read_unlock();
+                printk(KERN_ERR "cpuset: failed to transfer tasks out of empty cpuset ");
+                pr_cont_cgroup_name(cs->css.cgroup);
+                pr_cont("\n");
         }
 }
 
@@ -2137,7 +2067,7 @@ retry:
          */
         if ((sane && cpumask_empty(cs->cpus_allowed)) ||
             (!cpumask_empty(&off_cpus) && !cpumask_empty(cs->cpus_allowed)))
-                update_tasks_cpumask(cs, NULL);
+                update_tasks_cpumask(cs);
 
         mutex_lock(&callback_mutex);
         nodes_andnot(cs->mems_allowed, cs->mems_allowed, off_mems);
@@ -2151,7 +2081,7 @@ retry:
          */
         if ((sane && nodes_empty(cs->mems_allowed)) ||
             (!nodes_empty(off_mems) && !nodes_empty(cs->mems_allowed)))
-                update_tasks_nodemask(cs, NULL);
+                update_tasks_nodemask(cs);
 
         is_empty = cpumask_empty(cs->cpus_allowed) ||
                 nodes_empty(cs->mems_allowed);
@@ -2213,7 +2143,7 @@ static void cpuset_hotplug_workfn(struct work_struct *work)
                 mutex_lock(&callback_mutex);
                 top_cpuset.mems_allowed = new_mems;
                 mutex_unlock(&callback_mutex);
-                update_tasks_nodemask(&top_cpuset, NULL);
+                update_tasks_nodemask(&top_cpuset);
         }
 
         mutex_unlock(&cpuset_mutex);
@@ -2305,10 +2235,10 @@ void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask)
         struct cpuset *cpus_cs;
 
         mutex_lock(&callback_mutex);
-        task_lock(tsk);
+        rcu_read_lock();
         cpus_cs = effective_cpumask_cpuset(task_cs(tsk));
         guarantee_online_cpus(cpus_cs, pmask);
-        task_unlock(tsk);
+        rcu_read_unlock();
         mutex_unlock(&callback_mutex);
 }
 
@@ -2361,10 +2291,10 @@ nodemask_t cpuset_mems_allowed(struct task_struct *tsk)
         nodemask_t mask;
 
         mutex_lock(&callback_mutex);
-        task_lock(tsk);
+        rcu_read_lock();
         mems_cs = effective_nodemask_cpuset(task_cs(tsk));
         guarantee_online_mems(mems_cs, &mask);
-        task_unlock(tsk);
+        rcu_read_unlock();
         mutex_unlock(&callback_mutex);
 
         return mask;
@@ -2480,10 +2410,10 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
         /* Not hardwall and node outside mems_allowed: scan up cpusets */
         mutex_lock(&callback_mutex);
 
-        task_lock(current);
+        rcu_read_lock();
         cs = nearest_hardwall_ancestor(task_cs(current));
         allowed = node_isset(node, cs->mems_allowed);
-        task_unlock(current);
+        rcu_read_unlock();
 
         mutex_unlock(&callback_mutex);
         return allowed;
@@ -2609,27 +2539,27 @@ int cpuset_mems_allowed_intersects(const struct task_struct *tsk1,
  * @task: pointer to task_struct of some task.
  *
  * Description: Prints @task's name, cpuset name, and cached copy of its
- * mems_allowed to the kernel log.  Must hold task_lock(task) to allow
- * dereferencing task_cs(task).
+ * mems_allowed to the kernel log.
  */
 void cpuset_print_task_mems_allowed(struct task_struct *tsk)
 {
          /* Statically allocated to prevent using excess stack. */
         static char cpuset_nodelist[CPUSET_NODELIST_LEN];
         static DEFINE_SPINLOCK(cpuset_buffer_lock);
+        struct cgroup *cgrp;
 
-        struct cgroup *cgrp = task_cs(tsk)->css.cgroup;
-
-        rcu_read_lock();
         spin_lock(&cpuset_buffer_lock);
+        rcu_read_lock();
 
+        cgrp = task_cs(tsk)->css.cgroup;
         nodelist_scnprintf(cpuset_nodelist, CPUSET_NODELIST_LEN,
                            tsk->mems_allowed);
-        printk(KERN_INFO "%s cpuset=%s mems_allowed=%s\n",
-               tsk->comm, cgroup_name(cgrp), cpuset_nodelist);
+        printk(KERN_INFO "%s cpuset=", tsk->comm);
+        pr_cont_cgroup_name(cgrp);
+        pr_cont(" mems_allowed=%s\n", cpuset_nodelist);
 
-        spin_unlock(&cpuset_buffer_lock);
         rcu_read_unlock();
+        spin_unlock(&cpuset_buffer_lock);
 }
 
 /*
@@ -2660,9 +2590,9 @@ int cpuset_memory_pressure_enabled __read_mostly;
 
 void __cpuset_memory_pressure_bump(void)
 {
-        task_lock(current);
+        rcu_read_lock();
         fmeter_markevent(&task_cs(current)->fmeter);
-        task_unlock(current);
+        rcu_read_unlock();
 }
 
 #ifdef CONFIG_PROC_PID_CPUSET
@@ -2679,12 +2609,12 @@ int proc_cpuset_show(struct seq_file *m, void *unused_v)
 {
         struct pid *pid;
         struct task_struct *tsk;
-        char *buf;
+        char *buf, *p;
         struct cgroup_subsys_state *css;
         int retval;
 
         retval = -ENOMEM;
-        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        buf = kmalloc(PATH_MAX, GFP_KERNEL);
         if (!buf)
                 goto out;
 
@@ -2694,14 +2624,16 @@ int proc_cpuset_show(struct seq_file *m, void *unused_v)
         if (!tsk)
                 goto out_free;
 
+        retval = -ENAMETOOLONG;
         rcu_read_lock();
-        css = task_css(tsk, cpuset_subsys_id);
-        retval = cgroup_path(css->cgroup, buf, PAGE_SIZE);
+        css = task_css(tsk, cpuset_cgrp_id);
+        p = cgroup_path(css->cgroup, buf, PATH_MAX);
         rcu_read_unlock();
-        if (retval < 0)
+        if (!p)
                 goto out_put_task;
-        seq_puts(m, buf);
+        seq_puts(m, p);
         seq_putc(m, '\n');
+        retval = 0;
 out_put_task:
         put_task_struct(tsk);
 out_free:
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 99982a70ddad..2956c8da1605 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -49,6 +49,7 @@
 #include <linux/pid.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
+#include <linux/vmacache.h>
 #include <linux/rcupdate.h>
 
 #include <asm/cacheflush.h>
@@ -224,10 +225,17 @@ static void kgdb_flush_swbreak_addr(unsigned long addr)
         if (!CACHE_FLUSH_IS_SAFE)
                 return;
 
-        if (current->mm && current->mm->mmap_cache) {
-                flush_cache_range(current->mm->mmap_cache,
-                                  addr, addr + BREAK_INSTR_SIZE);
+        if (current->mm) {
+                int i;
+
+                for (i = 0; i < VMACACHE_SIZE; i++) {
+                        if (!current->vmacache[i])
+                                continue;
+                        flush_cache_range(current->vmacache[i],
+                                          addr, addr + BREAK_INSTR_SIZE);
+                }
         }
+
         /* Force flush instruction cache if it was outside the mm */
         flush_icache_range(addr, addr + BREAK_INSTR_SIZE);
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 661951ab8ae7..f83a71a3e46d 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -361,7 +361,7 @@ struct perf_cgroup {
 static inline struct perf_cgroup *
 perf_cgroup_from_task(struct task_struct *task)
 {
-        return container_of(task_css(task, perf_subsys_id),
+        return container_of(task_css(task, perf_event_cgrp_id),
                             struct perf_cgroup, css);
 }
 
@@ -389,11 +389,6 @@ perf_cgroup_match(struct perf_event *event)
                                     event->cgrp->css.cgroup);
 }
 
-static inline bool perf_tryget_cgroup(struct perf_event *event)
-{
-        return css_tryget(&event->cgrp->css);
-}
-
 static inline void perf_put_cgroup(struct perf_event *event)
 {
         css_put(&event->cgrp->css);
@@ -612,9 +607,7 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
         if (!f.file)
                 return -EBADF;
 
-        rcu_read_lock();
-
-        css = css_from_dir(f.file->f_dentry, &perf_subsys);
+        css = css_tryget_from_dir(f.file->f_dentry, &perf_event_cgrp_subsys);
         if (IS_ERR(css)) {
                 ret = PTR_ERR(css);
                 goto out;
@@ -623,13 +616,6 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
         cgrp = container_of(css, struct perf_cgroup, css);
         event->cgrp = cgrp;
 
-        /* must be done before we fput() the file */
-        if (!perf_tryget_cgroup(event)) {
-                event->cgrp = NULL;
-                ret = -ENOENT;
-                goto out;
-        }
-
         /*
          * all events in a group must monitor
          * the same cgroup because a task belongs
@@ -640,7 +626,6 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
                 ret = -EINVAL;
         }
 out:
-        rcu_read_unlock();
         fdput(f);
         return ret;
 }
@@ -8053,7 +8038,7 @@ static void perf_cgroup_attach(struct cgroup_subsys_state *css,
 {
         struct task_struct *task;
 
-        cgroup_taskset_for_each(task, css, tset)
+        cgroup_taskset_for_each(task, tset)
                 task_function_call(task, __perf_cgroup_move, task);
 }
 
@@ -8072,9 +8057,7 @@ static void perf_cgroup_exit(struct cgroup_subsys_state *css,
         task_function_call(task, __perf_cgroup_move, task);
 }
 
-struct cgroup_subsys perf_subsys = {
-        .name           = "perf_event",
-        .subsys_id      = perf_subsys_id,
+struct cgroup_subsys perf_event_cgrp_subsys = {
         .css_alloc      = perf_cgroup_css_alloc,
         .css_free       = perf_cgroup_css_free,
         .exit           = perf_cgroup_exit,
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 307d87c0991a..04709b66369d 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1804,6 +1804,11 @@ static bool handle_trampoline(struct pt_regs *regs)
         return true;
 }
 
+bool __weak arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *regs)
+{
+        return false;
+}
+
 /*
  * Run handler and ask thread to singlestep.
  * Ensure all non-fatal signals cannot interrupt thread while it singlesteps.
@@ -1858,7 +1863,11 @@ static void handle_swbp(struct pt_regs *regs)
         if (!get_utask())
                 goto out;
 
+        if (arch_uprobe_ignore(&uprobe->arch, regs))
+                goto out;
+
         handler_chain(uprobe, regs);
+
         if (can_skip_sstep(uprobe, regs))
                 goto out;
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 1e77fc645317..6ed6a1d552b5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -570,7 +570,7 @@ static void reparent_leader(struct task_struct *father, struct task_struct *p,
         if (same_thread_group(p->real_parent, father))
                 return;
 
-        /* We don't want people slaying init.  */
+        /* We don't want people slaying init. */
         p->exit_signal = SIGCHLD;
 
         /* If it has exited notify the new parent about this child's death. */
@@ -784,9 +784,10 @@ void do_exit(long code)
         exit_shm(tsk);
         exit_files(tsk);
         exit_fs(tsk);
+        if (group_dead)
+                disassociate_ctty(1);
         exit_task_namespaces(tsk);
         exit_task_work(tsk);
-        check_stack_usage();
         exit_thread();
 
         /*
@@ -797,21 +798,17 @@ void do_exit(long code)
          */
         perf_event_exit_task(tsk);
 
-        cgroup_exit(tsk, 1);
-
-        if (group_dead)
-                disassociate_ctty(1);
+        cgroup_exit(tsk);
 
         module_put(task_thread_info(tsk)->exec_domain->module);
 
-        proc_exit_connector(tsk);
-
         /*
          * FIXME: do that only when needed, using sched_exit tracepoint
          */
         flush_ptrace_hw_breakpoint(tsk);
 
         exit_notify(tsk, group_dead);
+        proc_exit_connector(tsk);
 #ifdef CONFIG_NUMA
         task_lock(tsk);
         mpol_put(tsk->mempolicy);
@@ -844,6 +841,7 @@ void do_exit(long code)
 
         validate_creds_for_do_exit(tsk);
 
+        check_stack_usage();
         preempt_disable();
         if (tsk->nr_dirtied)
                 __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
@@ -1038,17 +1036,13 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
                 return wait_noreap_copyout(wo, p, pid, uid, why, status);
         }
 
+        traced = ptrace_reparented(p);
         /*
-         * Try to move the task's state to DEAD
-         * only one thread is allowed to do this:
+         * Move the task's state to DEAD/TRACE, only one thread can do this.
          */
-        state = xchg(&p->exit_state, EXIT_DEAD);
-        if (state != EXIT_ZOMBIE) {
-                BUG_ON(state != EXIT_DEAD);
+        state = traced && thread_group_leader(p) ? EXIT_TRACE : EXIT_DEAD;
+        if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
                 return 0;
-        }
-
-        traced = ptrace_reparented(p);
         /*
          * It can be ptraced but not reparented, check
          * thread_group_leader() to filter out sub-threads.
@@ -1109,7 +1103,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
 
         /*
          * Now we are sure this task is interesting, and no other
-         * thread can reap it because we set its state to EXIT_DEAD.
+         * thread can reap it because we its state == DEAD/TRACE.
          */
         read_unlock(&tasklist_lock);
 
@@ -1146,22 +1140,19 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
         if (!retval)
                 retval = pid;
 
-        if (traced) {
+        if (state == EXIT_TRACE) {
                 write_lock_irq(&tasklist_lock);
                 /* We dropped tasklist, ptracer could die and untrace */
                 ptrace_unlink(p);
-                /*
-                 * If this is not a sub-thread, notify the parent.
-                 * If parent wants a zombie, don't release it now.
-                 */
-                if (thread_group_leader(p) &&
-                    !do_notify_parent(p, p->exit_signal)) {
-                        p->exit_state = EXIT_ZOMBIE;
-                        p = NULL;
-                }
+
+                /* If parent wants a zombie, don't release it now */
+                state = EXIT_ZOMBIE;
+                if (do_notify_parent(p, p->exit_signal))
+                        state = EXIT_DEAD;
+                p->exit_state = state;
                 write_unlock_irq(&tasklist_lock);
         }
-        if (p != NULL)
+        if (state == EXIT_DEAD)
                 release_task(p);
 
         return retval;
@@ -1338,7 +1329,12 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
 static int wait_consider_task(struct wait_opts *wo, int ptrace,
                                 struct task_struct *p)
 {
-        int ret = eligible_child(wo, p);
+        int ret;
+
+        if (unlikely(p->exit_state == EXIT_DEAD))
+                return 0;
+
+        ret = eligible_child(wo, p);
         if (!ret)
                 return ret;
 
@@ -1356,33 +1352,44 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                 return 0;
         }
 
-        /* dead body doesn't have much to contribute */
-        if (unlikely(p->exit_state == EXIT_DEAD)) {
+        if (unlikely(p->exit_state == EXIT_TRACE)) {
                 /*
-                 * But do not ignore this task until the tracer does
-                 * wait_task_zombie()->do_notify_parent().
+                 * ptrace == 0 means we are the natural parent. In this case
+                 * we should clear notask_error, debugger will notify us.
                  */
-                if (likely(!ptrace) && unlikely(ptrace_reparented(p)))
+                if (likely(!ptrace))
                         wo->notask_error = 0;
                 return 0;
         }
 
-        /* slay zombie? */
-        if (p->exit_state == EXIT_ZOMBIE) {
+        if (likely(!ptrace) && unlikely(p->ptrace)) {
                 /*
-                 * A zombie ptracee is only visible to its ptracer.
-                 * Notification and reaping will be cascaded to the real
-                 * parent when the ptracer detaches.
+                 * If it is traced by its real parent's group, just pretend
+                 * the caller is ptrace_do_wait() and reap this child if it
+                 * is zombie.
+                 *
+                 * This also hides group stop state from real parent; otherwise
+                 * a single stop can be reported twice as group and ptrace stop.
+                 * If a ptracer wants to distinguish these two events for its
+                 * own children it should create a separate process which takes
+                 * the role of real parent.
                  */
-                if (likely(!ptrace) && unlikely(p->ptrace)) {
-                        /* it will become visible, clear notask_error */
-                        wo->notask_error = 0;
-                        return 0;
-                }
+                if (!ptrace_reparented(p))
+                        ptrace = 1;
+        }
 
+        /* slay zombie? */
+        if (p->exit_state == EXIT_ZOMBIE) {
                 /* we don't reap group leaders with subthreads */
-                if (!delay_group_leader(p))
-                        return wait_task_zombie(wo, p);
+                if (!delay_group_leader(p)) {
+                        /*
+                         * A zombie ptracee is only visible to its ptracer.
+                         * Notification and reaping will be cascaded to the
+                         * real parent when the ptracer detaches.
+                         */
+                        if (unlikely(ptrace) || likely(!p->ptrace))
+                                return wait_task_zombie(wo, p);
+                }
 
                 /*
                  * Allow access to stopped/continued state via zombie by
@@ -1408,19 +1415,6 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                         wo->notask_error = 0;
         } else {
                 /*
-                 * If @p is ptraced by a task in its real parent's group,
-                 * hide group stop/continued state when looking at @p as
-                 * the real parent; otherwise, a single stop can be
-                 * reported twice as group and ptrace stops.
-                 *
-                 * If a ptracer wants to distinguish the two events for its
-                 * own children, it should create a separate process which
-                 * takes the role of real parent.
-                 */
-                if (likely(!ptrace) && p->ptrace && !ptrace_reparented(p))
-                        return 0;
-
-                /*
                  * @p is alive and it's gonna stop, continue or exit, so
                  * there always is something to wait for.
                  */
diff --git a/kernel/fork.c b/kernel/fork.c
index 332688e5e7b4..54a8d26f612f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -28,6 +28,8 @@
 #include <linux/mman.h>
 #include <linux/mmu_notifier.h>
 #include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/vmacache.h>
 #include <linux/nsproxy.h>
 #include <linux/capability.h>
 #include <linux/cpu.h>
@@ -71,6 +73,7 @@
 #include <linux/signalfd.h>
 #include <linux/uprobes.h>
 #include <linux/aio.h>
+#include <linux/compiler.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -284,7 +287,7 @@ void __init fork_init(unsigned long mempages)
                 init_task.signal->rlim[RLIMIT_NPROC];
 }
 
-int __attribute__((weak)) arch_dup_task_struct(struct task_struct *dst,
+int __weak arch_dup_task_struct(struct task_struct *dst,
                                                struct task_struct *src)
 {
         *dst = *src;
@@ -364,7 +367,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
 
         mm->locked_vm = 0;
         mm->mmap = NULL;
-        mm->mmap_cache = NULL;
+        mm->vmacache_seqnum = 0;
         mm->map_count = 0;
         cpumask_clear(mm_cpumask(mm));
         mm->mm_rb = RB_ROOT;
@@ -530,8 +533,6 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
         atomic_set(&mm->mm_count, 1);
         init_rwsem(&mm->mmap_sem);
         INIT_LIST_HEAD(&mm->mmlist);
-        mm->flags = (current->mm) ?
-                (current->mm->flags & MMF_INIT_MASK) : default_dump_filter;
         mm->core_state = NULL;
         atomic_long_set(&mm->nr_ptes, 0);
         memset(&mm->rss_stat, 0, sizeof(mm->rss_stat));
@@ -540,8 +541,15 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
         mm_init_owner(mm, p);
         clear_tlb_flush_pending(mm);
 
-        if (likely(!mm_alloc_pgd(mm))) {
+        if (current->mm) {
+                mm->flags = current->mm->flags & MMF_INIT_MASK;
+                mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK;
+        } else {
+                mm->flags = default_dump_filter;
                 mm->def_flags = 0;
+        }
+
+        if (likely(!mm_alloc_pgd(mm))) {
                 mmu_notifier_mm_init(mm);
                 return mm;
         }
@@ -877,6 +885,9 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk)
         if (!oldmm)
                 return 0;
 
+        /* initialize the new vmacache entries */
+        vmacache_flush(tsk);
+
         if (clone_flags & CLONE_VM) {
                 atomic_inc(&oldmm->mm_users);
                 mm = oldmm;
@@ -1070,15 +1081,6 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         return 0;
 }
 
-static void copy_flags(unsigned long clone_flags, struct task_struct *p)
-{
-        unsigned long new_flags = p->flags;
-
-        new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
-        new_flags |= PF_FORKNOEXEC;
-        p->flags = new_flags;
-}
-
 SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
 {
         current->clear_child_tid = tidptr;
@@ -1228,7 +1230,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 goto bad_fork_cleanup_count;
 
         delayacct_tsk_init(p);  /* Must remain after dup_task_struct() */
-        copy_flags(clone_flags, p);
+        p->flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
+        p->flags |= PF_FORKNOEXEC;
         INIT_LIST_HEAD(&p->children);
         INIT_LIST_HEAD(&p->sibling);
         rcu_copy_process(p);
@@ -1272,9 +1275,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         if (IS_ERR(p->mempolicy)) {
                 retval = PTR_ERR(p->mempolicy);
                 p->mempolicy = NULL;
-                goto bad_fork_cleanup_cgroup;
+                goto bad_fork_cleanup_threadgroup_lock;
         }
-        mpol_fix_fork_child_flag(p);
 #endif
 #ifdef CONFIG_CPUSETS
         p->cpuset_mem_spread_rotor = NUMA_NO_NODE;
@@ -1525,11 +1527,10 @@ bad_fork_cleanup_policy:
         perf_event_free_task(p);
 #ifdef CONFIG_NUMA
         mpol_put(p->mempolicy);
-bad_fork_cleanup_cgroup:
+bad_fork_cleanup_threadgroup_lock:
 #endif
         if (clone_flags & CLONE_THREAD)
                 threadgroup_change_end(current);
-        cgroup_exit(p, 0);
         delayacct_tsk_free(p);
         module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:
diff --git a/kernel/futex.c b/kernel/futex.c
index 67dacaf93e56..5f589279e462 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -70,7 +70,10 @@
 #include "locking/rtmutex_common.h"
 
 /*
- * Basic futex operation and ordering guarantees:
+ * READ this before attempting to hack on futexes!
+ *
+ * Basic futex operation and ordering guarantees
+ * =============================================
  *
  * The waiter reads the futex value in user space and calls
  * futex_wait(). This function computes the hash bucket and acquires
@@ -119,7 +122,7 @@
  * sys_futex(WAIT, futex, val);
  *   futex_wait(futex, val);
  *
- *   waiters++;
+ *   waiters++; (a)
  *   mb(); (A) <-- paired with -.
  *                              |
  *   lock(hash_bucket(futex));  |
@@ -135,14 +138,14 @@
  *     unlock(hash_bucket(futex));
  *     schedule();                         if (waiters)
  *                                           lock(hash_bucket(futex));
- *                                           wake_waiters(futex);
- *                                           unlock(hash_bucket(futex));
+ *   else                                    wake_waiters(futex);
+ *     waiters--; (b)                        unlock(hash_bucket(futex));
  *
- * Where (A) orders the waiters increment and the futex value read -- this
- * is guaranteed by the head counter in the hb spinlock; and where (B)
- * orders the write to futex and the waiters read -- this is done by the
- * barriers in get_futex_key_refs(), through either ihold or atomic_inc,
- * depending on the futex type.
+ * Where (A) orders the waiters increment and the futex value read through
+ * atomic operations (see hb_waiters_inc) and where (B) orders the write
+ * to futex and the waiters read -- this is done by the barriers in
+ * get_futex_key_refs(), through either ihold or atomic_inc, depending on the
+ * futex type.
  *
  * This yields the following case (where X:=waiters, Y:=futex):
  *
@@ -155,6 +158,17 @@
  * Which guarantees that x==0 && y==0 is impossible; which translates back into
  * the guarantee that we cannot both miss the futex variable change and the
  * enqueue.
+ *
+ * Note that a new waiter is accounted for in (a) even when it is possible that
+ * the wait call can return error, in which case we backtrack from it in (b).
+ * Refer to the comment in queue_lock().
+ *
+ * Similarly, in order to account for waiters being requeued on another
+ * address we always increment the waiters for the destination bucket before
+ * acquiring the lock. It then decrements them again  after releasing it -
+ * the code that actually moves the futex(es) between hash buckets (requeue_futex)
+ * will do the additional required waiter count housekeeping. This is done for
+ * double_lock_hb() and double_unlock_hb(), respectively.
  */
 
 #ifndef CONFIG_HAVE_FUTEX_CMPXCHG
@@ -1452,6 +1466,7 @@ retry:
         hb2 = hash_futex(&key2);
 
 retry_private:
+        hb_waiters_inc(hb2);
         double_lock_hb(hb1, hb2);
 
         if (likely(cmpval != NULL)) {
@@ -1461,6 +1476,7 @@ retry_private:
 
                 if (unlikely(ret)) {
                         double_unlock_hb(hb1, hb2);
+                        hb_waiters_dec(hb2);
 
                         ret = get_user(curval, uaddr1);
                         if (ret)
@@ -1510,6 +1526,7 @@ retry_private:
                         break;
                 case -EFAULT:
                         double_unlock_hb(hb1, hb2);
+                        hb_waiters_dec(hb2);
                         put_futex_key(&key2);
                         put_futex_key(&key1);
                         ret = fault_in_user_writeable(uaddr2);
@@ -1519,6 +1536,7 @@ retry_private:
                 case -EAGAIN:
                         /* The owner was exiting, try again. */
                         double_unlock_hb(hb1, hb2);
+                        hb_waiters_dec(hb2);
                         put_futex_key(&key2);
                         put_futex_key(&key1);
                         cond_resched();
@@ -1594,6 +1612,7 @@ retry_private:
 
 out_unlock:
         double_unlock_hb(hb1, hb2);
+        hb_waiters_dec(hb2);
 
         /*
          * drop_futex_key_refs() must be called outside the spinlocks. During
diff --git a/kernel/groups.c b/kernel/groups.c
index 90cf1c38c8ea..451698f86cfa 100644
--- a/kernel/groups.c
+++ b/kernel/groups.c
@@ -157,17 +157,13 @@ int groups_search(const struct group_info *group_info, kgid_t grp)
  * set_groups - Change a group subscription in a set of credentials
  * @new: The newly prepared set of credentials to alter
  * @group_info: The group list to install
- *
- * Validate a group subscription and, if valid, insert it into a set
- * of credentials.
  */
-int set_groups(struct cred *new, struct group_info *group_info)
+void set_groups(struct cred *new, struct group_info *group_info)
 {
         put_group_info(new->group_info);
         groups_sort(group_info);
         get_group_info(group_info);
         new->group_info = group_info;
-        return 0;
 }
 
 EXPORT_SYMBOL(set_groups);
@@ -182,18 +178,12 @@ EXPORT_SYMBOL(set_groups);
 int set_current_groups(struct group_info *group_info)
 {
         struct cred *new;
-        int ret;
 
         new = prepare_creds();
         if (!new)
                 return -ENOMEM;
 
-        ret = set_groups(new, group_info);
-        if (ret < 0) {
-                abort_creds(new);
-                return ret;
-        }
-
+        set_groups(new, group_info);
         return commit_creds(new);
 }
 
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 0b9c169d577f..06bb1417b063 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -246,5 +246,4 @@ static int __init hung_task_init(void)
 
         return 0;
 }
-
-module_init(hung_task_init);
+subsys_initcall(hung_task_init);
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 3127ad52cdb2..cb0cf37dac3a 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -23,6 +23,7 @@
 #include <linux/mm.h>
 #include <linux/ctype.h>
 #include <linux/slab.h>
+#include <linux/compiler.h>
 
 #include <asm/sections.h>
 
@@ -36,8 +37,8 @@
  * These will be re-linked against their real values
  * during the second link stage.
  */
-extern const unsigned long kallsyms_addresses[] __attribute__((weak));
-extern const u8 kallsyms_names[] __attribute__((weak));
+extern const unsigned long kallsyms_addresses[] __weak;
+extern const u8 kallsyms_names[] __weak;
 
 /*
  * Tell the compiler that the count isn't in the small data section if the arch
@@ -46,10 +47,10 @@ extern const u8 kallsyms_names[] __attribute__((weak));
 extern const unsigned long kallsyms_num_syms
 __attribute__((weak, section(".rodata")));
 
-extern const u8 kallsyms_token_table[] __attribute__((weak));
-extern const u16 kallsyms_token_index[] __attribute__((weak));
+extern const u8 kallsyms_token_table[] __weak;
+extern const u16 kallsyms_token_index[] __weak;
 
-extern const unsigned long kallsyms_markers[] __attribute__((weak));
+extern const unsigned long kallsyms_markers[] __weak;
 
 static inline int is_kernel_inittext(unsigned long addr)
 {
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 45601cf41bee..c8380ad203bc 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -32,6 +32,7 @@
 #include <linux/vmalloc.h>
 #include <linux/swap.h>
 #include <linux/syscore_ops.h>
+#include <linux/compiler.h>
 
 #include <asm/page.h>
 #include <asm/uaccess.h>
@@ -1235,7 +1236,7 @@ static int __init crash_notes_memory_init(void)
         }
         return 0;
 }
-module_init(crash_notes_memory_init)
+subsys_initcall(crash_notes_memory_init);
 
 
 /*
@@ -1551,10 +1552,10 @@ void vmcoreinfo_append_str(const char *fmt, ...)
  * provide an empty default implementation here -- architecture
  * code may override this
  */
-void __attribute__ ((weak)) arch_crash_save_vmcoreinfo(void)
+void __weak arch_crash_save_vmcoreinfo(void)
 {}
 
-unsigned long __attribute__ ((weak)) paddr_vmcoreinfo_note(void)
+unsigned long __weak paddr_vmcoreinfo_note(void)
 {
         return __pa((unsigned long)(char *)&vmcoreinfo_note);
 }
@@ -1629,7 +1630,7 @@ static int __init crash_save_vmcoreinfo_init(void)
         return 0;
 }
 
-module_init(crash_save_vmcoreinfo_init)
+subsys_initcall(crash_save_vmcoreinfo_init);
 
 /*
  * Move into place and start executing a preloaded standalone
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index e660964086e2..2495a9b14ac8 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -18,6 +18,7 @@
 #include <linux/stat.h>
 #include <linux/sched.h>
 #include <linux/capability.h>
+#include <linux/compiler.h>
 
 #include <linux/rcupdate.h>     /* rcu_expedited */
 
@@ -162,8 +163,8 @@ KERNEL_ATTR_RW(rcu_expedited);
 /*
  * Make /sys/kernel/notes give the raw contents of our kernel .notes section.
  */
-extern const void __start_notes __attribute__((weak));
-extern const void __stop_notes __attribute__((weak));
+extern const void __start_notes __weak;
+extern const void __stop_notes __weak;
 #define notes_size (&__stop_notes - &__start_notes)
 
 static ssize_t notes_read(struct file *filp, struct kobject *kobj,
diff --git a/kernel/kthread.c b/kernel/kthread.c
index b5ae3ee860a9..9a130ec06f7a 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -217,7 +217,7 @@ int tsk_fork_get_node(struct task_struct *tsk)
         if (tsk == kthreadd_task)
                 return tsk->pref_node_fork;
 #endif
-        return numa_node_id();
+        return NUMA_NO_NODE;
 }
 
 static void create_kthread(struct kthread_create_info *create)
@@ -369,7 +369,7 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
 {
         struct task_struct *p;
 
-        p = kthread_create_on_node(threadfn, data, cpu_to_node(cpu), namefmt,
+        p = kthread_create_on_node(threadfn, data, cpu_to_mem(cpu), namefmt,
                                    cpu);
         if (IS_ERR(p))
                 return p;
diff --git a/kernel/locking/Makefile b/kernel/locking/Makefile
index 306a76b51e0f..b8bdcd4785b7 100644
--- a/kernel/locking/Makefile
+++ b/kernel/locking/Makefile
@@ -1,5 +1,5 @@
 
-obj-y += mutex.o semaphore.o rwsem.o lglock.o mcs_spinlock.o
+obj-y += mutex.o semaphore.o rwsem.o mcs_spinlock.o
 
 ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_lockdep.o = -pg
@@ -14,6 +14,7 @@ ifeq ($(CONFIG_PROC_FS),y)
 obj-$(CONFIG_LOCKDEP) += lockdep_proc.o
 endif
 obj-$(CONFIG_SMP) += spinlock.o
+obj-$(CONFIG_SMP) += lglock.o
 obj-$(CONFIG_PROVE_LOCKING) += spinlock.o
 obj-$(CONFIG_RT_MUTEXES) += rtmutex.o
 obj-$(CONFIG_DEBUG_RT_MUTEXES) += rtmutex-debug.o
diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
index e1191c996c59..5cf6731b98e9 100644
--- a/kernel/locking/mutex-debug.c
+++ b/kernel/locking/mutex-debug.c
@@ -71,18 +71,17 @@ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
 
 void debug_mutex_unlock(struct mutex *lock)
 {
-        if (unlikely(!debug_locks))
-                return;
+        if (likely(debug_locks)) {
+                DEBUG_LOCKS_WARN_ON(lock->magic != lock);
 
-        DEBUG_LOCKS_WARN_ON(lock->magic != lock);
+                if (!lock->owner)
+                        DEBUG_LOCKS_WARN_ON(!lock->owner);
+                else
+                        DEBUG_LOCKS_WARN_ON(lock->owner != current);
 
-        if (!lock->owner)
-                DEBUG_LOCKS_WARN_ON(!lock->owner);
-        else
-                DEBUG_LOCKS_WARN_ON(lock->owner != current);
-
-        DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
-        mutex_clear_owner(lock);
+                DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
+                mutex_clear_owner(lock);
+        }
 
         /*
          * __mutex_slowpath_needs_to_unlock() is explicitly 0 for debug
diff --git a/kernel/module.c b/kernel/module.c
index 8dc7f5e80dd8..11869408f79b 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -640,7 +640,7 @@ static int module_unload_init(struct module *mod)
         INIT_LIST_HEAD(&mod->target_list);
 
         /* Hold reference count during initialization. */
-        __this_cpu_write(mod->refptr->incs, 1);
+        raw_cpu_write(mod->refptr->incs, 1);
 
         return 0;
 }
@@ -1013,6 +1013,8 @@ static size_t module_flags_taint(struct module *mod, char *buf)
                 buf[l++] = 'F';
         if (mod->taints & (1 << TAINT_CRAP))
                 buf[l++] = 'C';
+        if (mod->taints & (1 << TAINT_UNSIGNED_MODULE))
+                buf[l++] = 'E';
         /*
          * TAINT_FORCED_RMMOD: could be added.
          * TAINT_CPU_OUT_OF_SPEC, TAINT_MACHINE_CHECK, TAINT_BAD_PAGE don't
@@ -3218,7 +3220,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
                 pr_notice_once("%s: module verification failed: signature "
                                "and/or  required key missing - tainting "
                                "kernel\n", mod->name);
-                add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_STILL_OK);
+                add_taint_module(mod, TAINT_UNSIGNED_MODULE, LOCKDEP_STILL_OK);
         }
 #endif
 
@@ -3813,12 +3815,12 @@ void print_modules(void)
         list_for_each_entry_rcu(mod, &modules, list) {
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
-                printk(" %s%s", mod->name, module_flags(mod, buf));
+                pr_cont(" %s%s", mod->name, module_flags(mod, buf));
         }
         preempt_enable();
         if (last_unloaded_module[0])
-                printk(" [last unloaded: %s]", last_unloaded_module);
-        printk("\n");
+                pr_cont(" [last unloaded: %s]", last_unloaded_module);
+        pr_cont("\n");
 }
 
 #ifdef CONFIG_MODVERSIONS
diff --git a/kernel/panic.c b/kernel/panic.c
index cca8a913ae7c..d02fa9fef46a 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -100,7 +100,7 @@ void panic(const char *fmt, ...)
         va_start(args, fmt);
         vsnprintf(buf, sizeof(buf), fmt, args);
         va_end(args);
-        printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
+        pr_emerg("Kernel panic - not syncing: %s\n", buf);
 #ifdef CONFIG_DEBUG_BUGVERBOSE
         /*
          * Avoid nested stack-dumping if a panic occurs during oops processing
@@ -141,7 +141,7 @@ void panic(const char *fmt, ...)
                  * Delay timeout seconds before rebooting the machine.
                  * We can't use the "normal" timers since we just panicked.
                  */
-                printk(KERN_EMERG "Rebooting in %d seconds..", panic_timeout);
+                pr_emerg("Rebooting in %d seconds..", panic_timeout);
 
                 for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
                         touch_nmi_watchdog();
@@ -165,7 +165,7 @@ void panic(const char *fmt, ...)
                 extern int stop_a_enabled;
                 /* Make sure the user can actually press Stop-A (L1-A) */
                 stop_a_enabled = 1;
-                printk(KERN_EMERG "Press Stop-A (L1-A) to return to the boot prom\n");
+                pr_emerg("Press Stop-A (L1-A) to return to the boot prom\n");
         }
 #endif
 #if defined(CONFIG_S390)
@@ -176,6 +176,7 @@ void panic(const char *fmt, ...)
                 disabled_wait(caller);
         }
 #endif
+        pr_emerg("---[ end Kernel panic - not syncing: %s\n", buf);
         local_irq_enable();
         for (i = 0; ; i += PANIC_TIMER_STEP) {
                 touch_softlockup_watchdog();
@@ -210,6 +211,7 @@ static const struct tnt tnts[] = {
         { TAINT_CRAP,                   'C', ' ' },
         { TAINT_FIRMWARE_WORKAROUND,    'I', ' ' },
         { TAINT_OOT_MODULE,             'O', ' ' },
+        { TAINT_UNSIGNED_MODULE,        'E', ' ' },
 };
 
 /**
@@ -228,6 +230,7 @@ static const struct tnt tnts[] = {
  *  'C' - modules from drivers/staging are loaded.
  *  'I' - Working around severe firmware bug.
  *  'O' - Out-of-tree module has been loaded.
+ *  'E' - Unsigned module has been loaded.
  *
  *      The string is overwritten by the next call to print_tainted().
  */
@@ -274,8 +277,7 @@ unsigned long get_taint(void)
 void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
 {
         if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
-                printk(KERN_WARNING
-                       "Disabling lock debugging due to kernel taint\n");
+                pr_warn("Disabling lock debugging due to kernel taint\n");
 
         set_bit(flag, &tainted_mask);
 }
@@ -380,8 +382,7 @@ late_initcall(init_oops_id);
 void print_oops_end_marker(void)
 {
         init_oops_id();
-        printk(KERN_WARNING "---[ end trace %016llx ]---\n",
-                (unsigned long long)oops_id);
+        pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id);
 }
 
 /*
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 06c62de9c711..db95d8eb761b 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -318,7 +318,9 @@ static void *pidns_get(struct task_struct *task)
         struct pid_namespace *ns;
 
         rcu_read_lock();
-        ns = get_pid_ns(task_active_pid_ns(task));
+        ns = task_active_pid_ns(task);
+        if (ns)
+                get_pid_ns(ns);
         rcu_read_unlock();
 
         return ns;
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 1ca753106557..15f37ea08719 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -2,6 +2,7 @@
 #include <linux/suspend_ioctls.h>
 #include <linux/utsname.h>
 #include <linux/freezer.h>
+#include <linux/compiler.h>
 
 struct swsusp_info {
         struct new_utsname      uts;
@@ -11,7 +12,7 @@ struct swsusp_info {
         unsigned long           image_pages;
         unsigned long           pages;
         unsigned long           size;
-} __attribute__((aligned(PAGE_SIZE)));
+} __aligned(PAGE_SIZE);
 
 #ifdef CONFIG_HIBERNATION
 /* kernel/power/snapshot.c */
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 149e745eaa52..18fb7a2fb14b 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -27,6 +27,7 @@
 #include <linux/highmem.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/compiler.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -155,7 +156,7 @@ static inline void free_image_page(void *addr, int clear_nosave_free)
 struct linked_page {
         struct linked_page *next;
         char data[LINKED_PAGE_DATA_SIZE];
-} __attribute__((packed));
+} __packed;
 
 static inline void
 free_list_of_pages(struct linked_page *list, int clear_page_nosave)
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 90b3d9366d1a..c3ad9cafe930 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -26,6 +26,7 @@
 #include <linux/syscore_ops.h>
 #include <linux/ftrace.h>
 #include <trace/events/power.h>
+#include <linux/compiler.h>
 
 #include "power.h"
 
@@ -156,13 +157,13 @@ static int suspend_prepare(suspend_state_t state)
 }
 
 /* default implementation */
-void __attribute__ ((weak)) arch_suspend_disable_irqs(void)
+void __weak arch_suspend_disable_irqs(void)
 {
         local_irq_disable();
 }
 
 /* default implementation */
-void __attribute__ ((weak)) arch_suspend_enable_irqs(void)
+void __weak arch_suspend_enable_irqs(void)
 {
         local_irq_enable();
 }
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 7c33ed200410..8c9a4819f798 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -101,7 +101,7 @@ struct swsusp_header {
         unsigned int flags;     /* Flags to pass to the "boot" kernel */
         char    orig_sig[10];
         char    sig[10];
-} __attribute__((packed));
+} __packed;
 
 static struct swsusp_header *swsusp_header;
 
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 4dae9cbe9259..a45b50962295 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -319,7 +319,7 @@ static void log_store(int facility, int level,
                 else
                         free = log_first_idx - log_next_idx;
 
-                if (free > size + sizeof(struct printk_log))
+                if (free >= size + sizeof(struct printk_log))
                         break;
 
                 /* drop old messages until we have enough contiuous space */
@@ -327,7 +327,7 @@ static void log_store(int facility, int level,
                 log_first_seq++;
         }
 
-        if (log_next_idx + size + sizeof(struct printk_log) >= log_buf_len) {
+        if (log_next_idx + size + sizeof(struct printk_log) > log_buf_len) {
                 /*
                  * This message + an additional empty header does not fit
                  * at the end of the buffer. Add an empty header with len == 0
@@ -351,7 +351,7 @@ static void log_store(int facility, int level,
         else
                 msg->ts_nsec = local_clock();
         memset(log_dict(msg) + dict_len, 0, pad_len);
-        msg->len = sizeof(struct printk_log) + text_len + dict_len + pad_len;
+        msg->len = size;
 
         /* insert message */
         log_next_idx += msg->len;
@@ -1560,9 +1560,12 @@ asmlinkage int vprintk_emit(int facility, int level,
                                         level = kern_level - '0';
                         case 'd':       /* KERN_DEFAULT */
                                 lflags |= LOG_PREFIX;
-                        case 'c':       /* KERN_CONT */
-                                break;
                         }
+                        /*
+                         * No need to check length here because vscnprintf
+                         * put '\0' at the end of the string. Only valid and
+                         * newly printed level is detected.
+                         */
                         text_len -= end_of_header - text;
                         text = (char *)end_of_header;
                 }
@@ -1880,6 +1883,7 @@ void suspend_console(void)
         console_lock();
         console_suspended = 1;
         up(&console_sem);
+        mutex_release(&console_lock_dep_map, 1, _RET_IP_);
 }
 
 void resume_console(void)
@@ -1887,6 +1891,7 @@ void resume_console(void)
         if (!console_suspend_enabled)
                 return;
         down(&console_sem);
+        mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);
         console_suspended = 0;
         console_unlock();
 }
diff --git a/kernel/profile.c b/kernel/profile.c
index ebdd9c1a86b4..cb980f0c731b 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -591,18 +591,28 @@ out_cleanup:
 int __ref create_proc_profile(void) /* false positive from hotcpu_notifier */
 {
         struct proc_dir_entry *entry;
+        int err = 0;
 
         if (!prof_on)
                 return 0;
-        if (create_hash_tables())
-                return -ENOMEM;
+
+        cpu_notifier_register_begin();
+
+        if (create_hash_tables()) {
+                err = -ENOMEM;
+                goto out;
+        }
+
         entry = proc_create("profile", S_IWUSR | S_IRUGO,
                             NULL, &proc_profile_operations);
         if (!entry)
-                return 0;
+                goto out;
         proc_set_size(entry, (1 + prof_len) * sizeof(atomic_t));
-        hotcpu_notifier(profile_cpu_callback, 0);
-        return 0;
+        __hotcpu_notifier(profile_cpu_callback, 0);
+
+out:
+        cpu_notifier_register_done();
+        return err;
 }
-module_init(create_proc_profile);
+subsys_initcall(create_proc_profile);
 #endif /* CONFIG_PROC_FS */
diff --git a/kernel/relay.c b/kernel/relay.c
index 5001c9887db1..5a56d3c8dc03 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -227,7 +227,7 @@ static void relay_destroy_buf(struct rchan_buf *buf)
  *      relay_remove_buf - remove a channel buffer
  *      @kref: target kernel reference that contains the relay buffer
  *
- *      Removes the file from the fileystem, which also frees the
+ *      Removes the file from the filesystem, which also frees the
  *      rchan_buf_struct and the channel buffer.  Should only be called from
  *      kref_put().
  */
@@ -1195,8 +1195,6 @@ static void relay_pipe_buf_release(struct pipe_inode_info *pipe,
 
 static const struct pipe_buf_operations relay_pipe_buf_ops = {
         .can_merge = 0,
-        .map = generic_pipe_buf_map,
-        .unmap = generic_pipe_buf_unmap,
         .confirm = generic_pipe_buf_confirm,
         .release = relay_pipe_buf_release,
         .steal = generic_pipe_buf_steal,
@@ -1253,7 +1251,7 @@ static ssize_t subbuf_splice_actor(struct file *in,
         subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
         pidx = (read_start / PAGE_SIZE) % subbuf_pages;
         poff = read_start & ~PAGE_MASK;
-        nr_pages = min_t(unsigned int, subbuf_pages, pipe->buffers);
+        nr_pages = min_t(unsigned int, subbuf_pages, spd.nr_pages_max);
 
         for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
                 unsigned int this_len, this_end, private;
diff --git a/kernel/res_counter.c b/kernel/res_counter.c
index 4aa8a305aede..51dbac6a3633 100644
--- a/kernel/res_counter.c
+++ b/kernel/res_counter.c
@@ -22,8 +22,18 @@ void res_counter_init(struct res_counter *counter, struct res_counter *parent)
         counter->parent = parent;
 }
 
-int res_counter_charge_locked(struct res_counter *counter, unsigned long val,
-                              bool force)
+static u64 res_counter_uncharge_locked(struct res_counter *counter,
+                                       unsigned long val)
+{
+        if (WARN_ON(counter->usage < val))
+                val = counter->usage;
+
+        counter->usage -= val;
+        return counter->usage;
+}
+
+static int res_counter_charge_locked(struct res_counter *counter,
+                                     unsigned long val, bool force)
 {
         int ret = 0;
 
@@ -86,15 +96,6 @@ int res_counter_charge_nofail(struct res_counter *counter, unsigned long val,
         return __res_counter_charge(counter, val, limit_fail_at, true);
 }
 
-u64 res_counter_uncharge_locked(struct res_counter *counter, unsigned long val)
-{
-        if (WARN_ON(counter->usage < val))
-                val = counter->usage;
-
-        counter->usage -= val;
-        return counter->usage;
-}
-
 u64 res_counter_uncharge_until(struct res_counter *counter,
                                struct res_counter *top,
                                unsigned long val)
diff --git a/kernel/resource.c b/kernel/resource.c
index 673061c06da1..8957d686e29b 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -511,7 +511,7 @@ static int find_resource(struct resource *root, struct resource *new,
  * @newsize: new size of the resource descriptor
  * @constraint: the size and alignment constraints to be met.
  */
-int reallocate_resource(struct resource *root, struct resource *old,
+static int reallocate_resource(struct resource *root, struct resource *old,
                         resource_size_t newsize,
                         struct resource_constraint  *constraint)
 {
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index b30a2924ef14..3ef6451e972e 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -60,13 +60,14 @@
 #include <linux/sched.h>
 #include <linux/static_key.h>
 #include <linux/workqueue.h>
+#include <linux/compiler.h>
 
 /*
  * Scheduler clock - returns current time in nanosec units.
  * This is default implementation.
  * Architectures and sub-architectures can override this.
  */
-unsigned long long __attribute__((weak)) sched_clock(void)
+unsigned long long __weak sched_clock(void)
 {
         return (unsigned long long)(jiffies - INITIAL_JIFFIES)
                                         * (NSEC_PER_SEC / HZ);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 9cae286824bb..13584f1cccfc 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -73,6 +73,7 @@
 #include <linux/init_task.h>
 #include <linux/binfmts.h>
 #include <linux/context_tracking.h>
+#include <linux/compiler.h>
 
 #include <asm/switch_to.h>
 #include <asm/tlb.h>
@@ -2591,8 +2592,14 @@ pick_next_task(struct rq *rq, struct task_struct *prev)
         if (likely(prev->sched_class == class &&
                    rq->nr_running == rq->cfs.h_nr_running)) {
                 p = fair_sched_class.pick_next_task(rq, prev);
-                if (likely(p && p != RETRY_TASK))
-                        return p;
+                if (unlikely(p == RETRY_TASK))
+                        goto again;
+
+                /* assumes fair_sched_class->next == idle_sched_class */
+                if (unlikely(!p))
+                        p = idle_sched_class.pick_next_task(rq, prev);
+
+                return p;
         }
 
 again:
@@ -2845,52 +2852,6 @@ int default_wake_function(wait_queue_t *curr, unsigned mode, int wake_flags,
 }
 EXPORT_SYMBOL(default_wake_function);
 
-static long __sched
-sleep_on_common(wait_queue_head_t *q, int state, long timeout)
-{
-        unsigned long flags;
-        wait_queue_t wait;
-
-        init_waitqueue_entry(&wait, current);
-
-        __set_current_state(state);
-
-        spin_lock_irqsave(&q->lock, flags);
-        __add_wait_queue(q, &wait);
-        spin_unlock(&q->lock);
-        timeout = schedule_timeout(timeout);
-        spin_lock_irq(&q->lock);
-        __remove_wait_queue(q, &wait);
-        spin_unlock_irqrestore(&q->lock, flags);
-
-        return timeout;
-}
-
-void __sched interruptible_sleep_on(wait_queue_head_t *q)
-{
-        sleep_on_common(q, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
-}
-EXPORT_SYMBOL(interruptible_sleep_on);
-
-long __sched
-interruptible_sleep_on_timeout(wait_queue_head_t *q, long timeout)
-{
-        return sleep_on_common(q, TASK_INTERRUPTIBLE, timeout);
-}
-EXPORT_SYMBOL(interruptible_sleep_on_timeout);
-
-void __sched sleep_on(wait_queue_head_t *q)
-{
-        sleep_on_common(q, TASK_UNINTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
-}
-EXPORT_SYMBOL(sleep_on);
-
-long __sched sleep_on_timeout(wait_queue_head_t *q, long timeout)
-{
-        return sleep_on_common(q, TASK_UNINTERRUPTIBLE, timeout);
-}
-EXPORT_SYMBOL(sleep_on_timeout);
-
 #ifdef CONFIG_RT_MUTEXES
 
 /*
@@ -3169,6 +3130,7 @@ __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
         dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
         dl_se->dl_throttled = 0;
         dl_se->dl_new = 1;
+        dl_se->dl_yielded = 0;
 }
 
 static void __setscheduler_params(struct task_struct *p,
@@ -3684,6 +3646,7 @@ SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
  * sys_sched_setattr - same as above, but with extended sched_attr
  * @pid: the pid in question.
  * @uattr: structure containing the extended parameters.
+ * @flags: for future extension.
  */
 SYSCALL_DEFINE3(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr,
                                unsigned int, flags)
@@ -3828,6 +3791,7 @@ err_size:
  * @pid: the pid in question.
  * @uattr: structure containing the extended parameters.
  * @size: sizeof(attr) for fwd/bwd comp.
+ * @flags: for future extension.
  */
 SYSCALL_DEFINE4(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
                 unsigned int, size, unsigned int, flags)
@@ -6062,6 +6026,8 @@ sd_numa_init(struct sched_domain_topology_level *tl, int cpu)
                                         ,
                 .last_balance           = jiffies,
                 .balance_interval       = sd_weight,
+                .max_newidle_lb_cost    = 0,
+                .next_decay_max_lb_cost = jiffies,
         };
         SD_INIT_NAME(sd, NUMA);
         sd->private = &tl->data;
@@ -6498,7 +6464,7 @@ static cpumask_var_t fallback_doms;
  * cpu core maps. It is supposed to return 1 if the topology changed
  * or 0 if it stayed the same.
  */
-int __attribute__((weak)) arch_update_cpu_topology(void)
+int __weak arch_update_cpu_topology(void)
 {
         return 0;
 }
@@ -7230,7 +7196,7 @@ void sched_move_task(struct task_struct *tsk)
         if (unlikely(running))
                 tsk->sched_class->put_prev_task(rq, tsk);
 
-        tg = container_of(task_css_check(tsk, cpu_cgroup_subsys_id,
+        tg = container_of(task_css_check(tsk, cpu_cgrp_id,
                                 lockdep_is_held(&tsk->sighand->siglock)),
                           struct task_group, css);
         tg = autogroup_task_group(tsk, tg);
@@ -7657,7 +7623,7 @@ static int cpu_cgroup_can_attach(struct cgroup_subsys_state *css,
 {
         struct task_struct *task;
 
-        cgroup_taskset_for_each(task, css, tset) {
+        cgroup_taskset_for_each(task, tset) {
 #ifdef CONFIG_RT_GROUP_SCHED
                 if (!sched_rt_can_attach(css_tg(css), task))
                         return -EINVAL;
@@ -7675,7 +7641,7 @@ static void cpu_cgroup_attach(struct cgroup_subsys_state *css,
 {
         struct task_struct *task;
 
-        cgroup_taskset_for_each(task, css, tset)
+        cgroup_taskset_for_each(task, tset)
                 sched_move_task(task);
 }
 
@@ -8014,8 +7980,7 @@ static struct cftype cpu_files[] = {
         { }     /* terminate */
 };
 
-struct cgroup_subsys cpu_cgroup_subsys = {
-        .name           = "cpu",
+struct cgroup_subsys cpu_cgrp_subsys = {
         .css_alloc      = cpu_cgroup_css_alloc,
         .css_free       = cpu_cgroup_css_free,
         .css_online     = cpu_cgroup_css_online,
@@ -8023,7 +7988,6 @@ struct cgroup_subsys cpu_cgroup_subsys = {
         .can_attach     = cpu_cgroup_can_attach,
         .attach         = cpu_cgroup_attach,
         .exit           = cpu_cgroup_exit,
-        .subsys_id      = cpu_cgroup_subsys_id,
         .base_cftypes   = cpu_files,
         .early_init     = 1,
 };
diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
index 622e0818f905..c143ee380e3a 100644
--- a/kernel/sched/cpuacct.c
+++ b/kernel/sched/cpuacct.c
@@ -41,7 +41,7 @@ static inline struct cpuacct *css_ca(struct cgroup_subsys_state *css)
 /* return cpu accounting group to which this task belongs */
 static inline struct cpuacct *task_ca(struct task_struct *tsk)
 {
-        return css_ca(task_css(tsk, cpuacct_subsys_id));
+        return css_ca(task_css(tsk, cpuacct_cgrp_id));
 }
 
 static inline struct cpuacct *parent_ca(struct cpuacct *ca)
@@ -275,11 +275,9 @@ void cpuacct_account_field(struct task_struct *p, int index, u64 val)
         rcu_read_unlock();
 }
 
-struct cgroup_subsys cpuacct_subsys = {
-        .name           = "cpuacct",
+struct cgroup_subsys cpuacct_cgrp_subsys = {
         .css_alloc      = cpuacct_css_alloc,
         .css_free       = cpuacct_css_free,
-        .subsys_id      = cpuacct_subsys_id,
         .base_cftypes   = files,
         .early_init     = 1,
 };
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 5b9bb42b2d47..ab001b5d5048 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -210,7 +210,5 @@ int cpudl_init(struct cpudl *cp)
  */
 void cpudl_cleanup(struct cpudl *cp)
 {
-        /*
-         * nothing to do for the moment
-         */
+        free_cpumask_var(cp->free_cpus);
 }
diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c
index 8b836b376d91..3031bac8aa3e 100644
--- a/kernel/sched/cpupri.c
+++ b/kernel/sched/cpupri.c
@@ -70,8 +70,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,
         int idx = 0;
         int task_pri = convert_prio(p->prio);
 
-        if (task_pri >= MAX_RT_PRIO)
-                return 0;
+        BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES);
 
         for (idx = 0; idx < task_pri; idx++) {
                 struct cpupri_vec *vec  = &cp->pri_to_cpu[idx];
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index a95097cb4591..72fdf06ef865 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -332,50 +332,50 @@ out:
  * softirq as those do not count in task exec_runtime any more.
  */
 static void irqtime_account_process_tick(struct task_struct *p, int user_tick,
-                                                struct rq *rq)
+                                         struct rq *rq, int ticks)
 {
-        cputime_t one_jiffy_scaled = cputime_to_scaled(cputime_one_jiffy);
+        cputime_t scaled = cputime_to_scaled(cputime_one_jiffy);
+        u64 cputime = (__force u64) cputime_one_jiffy;
         u64 *cpustat = kcpustat_this_cpu->cpustat;
 
         if (steal_account_process_tick())
                 return;
 
+        cputime *= ticks;
+        scaled *= ticks;
+
         if (irqtime_account_hi_update()) {
-                cpustat[CPUTIME_IRQ] += (__force u64) cputime_one_jiffy;
+                cpustat[CPUTIME_IRQ] += cputime;
         } else if (irqtime_account_si_update()) {
-                cpustat[CPUTIME_SOFTIRQ] += (__force u64) cputime_one_jiffy;
+                cpustat[CPUTIME_SOFTIRQ] += cputime;
         } else if (this_cpu_ksoftirqd() == p) {
                 /*
                  * ksoftirqd time do not get accounted in cpu_softirq_time.
                  * So, we have to handle it separately here.
                  * Also, p->stime needs to be updated for ksoftirqd.
                  */
-                __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled,
-                                        CPUTIME_SOFTIRQ);
+                __account_system_time(p, cputime, scaled, CPUTIME_SOFTIRQ);
         } else if (user_tick) {
-                account_user_time(p, cputime_one_jiffy, one_jiffy_scaled);
+                account_user_time(p, cputime, scaled);
         } else if (p == rq->idle) {
-                account_idle_time(cputime_one_jiffy);
+                account_idle_time(cputime);
         } else if (p->flags & PF_VCPU) { /* System time or guest time */
-                account_guest_time(p, cputime_one_jiffy, one_jiffy_scaled);
+                account_guest_time(p, cputime, scaled);
         } else {
-                __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled,
-                                        CPUTIME_SYSTEM);
+                __account_system_time(p, cputime, scaled,       CPUTIME_SYSTEM);
         }
 }
 
 static void irqtime_account_idle_ticks(int ticks)
 {
-        int i;
         struct rq *rq = this_rq();
 
-        for (i = 0; i < ticks; i++)
-                irqtime_account_process_tick(current, 0, rq);
+        irqtime_account_process_tick(current, 0, rq, ticks);
 }
 #else /* CONFIG_IRQ_TIME_ACCOUNTING */
 static inline void irqtime_account_idle_ticks(int ticks) {}
 static inline void irqtime_account_process_tick(struct task_struct *p, int user_tick,
-                                                struct rq *rq) {}
+                                                struct rq *rq, int nr_ticks) {}
 #endif /* CONFIG_IRQ_TIME_ACCOUNTING */
 
 /*
@@ -464,7 +464,7 @@ void account_process_tick(struct task_struct *p, int user_tick)
                 return;
 
         if (sched_clock_irqtime) {
-                irqtime_account_process_tick(p, user_tick, rq);
+                irqtime_account_process_tick(p, user_tick, rq, 1);
                 return;
         }
 
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index b08095786cb8..800e99b99075 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -528,6 +528,7 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
         sched_clock_tick();
         update_rq_clock(rq);
         dl_se->dl_throttled = 0;
+        dl_se->dl_yielded = 0;
         if (p->on_rq) {
                 enqueue_task_dl(rq, p, ENQUEUE_REPLENISH);
                 if (task_has_dl_policy(rq->curr))
@@ -893,10 +894,10 @@ static void yield_task_dl(struct rq *rq)
          * We make the task go to sleep until its current deadline by
          * forcing its runtime to zero. This way, update_curr_dl() stops
          * it and the bandwidth timer will wake it up and will give it
-         * new scheduling parameters (thanks to dl_new=1).
+         * new scheduling parameters (thanks to dl_yielded=1).
          */
         if (p->dl.runtime > 0) {
-                rq->curr->dl.dl_new = 1;
+                rq->curr->dl.dl_yielded = 1;
                 p->dl.runtime = 0;
         }
         update_curr_dl(rq);
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index f3344c31632a..695f9773bb60 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -111,8 +111,7 @@ static char *task_group_path(struct task_group *tg)
         if (autogroup_path(tg, group_path, PATH_MAX))
                 return group_path;
 
-        cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
-        return group_path;
+        return cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
 }
 #endif
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 43232b8bacde..5d859ec975c2 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6658,6 +6658,7 @@ static int idle_balance(struct rq *this_rq)
         int this_cpu = this_rq->cpu;
 
         idle_enter_fair(this_rq);
+
         /*
          * We must set idle_stamp _before_ calling idle_balance(), such that we
          * measure the duration of idle_balance() as idle time.
@@ -6710,14 +6711,16 @@ static int idle_balance(struct rq *this_rq)
 
         raw_spin_lock(&this_rq->lock);
 
+        if (curr_cost > this_rq->max_idle_balance_cost)
+                this_rq->max_idle_balance_cost = curr_cost;
+
         /*
-         * While browsing the domains, we released the rq lock.
-         * A task could have be enqueued in the meantime
+         * While browsing the domains, we released the rq lock, a task could
+         * have been enqueued in the meantime. Since we're not going idle,
+         * pretend we pulled a task.
          */
-        if (this_rq->cfs.h_nr_running && !pulled_task) {
+        if (this_rq->cfs.h_nr_running && !pulled_task)
                 pulled_task = 1;
-                goto out;
-        }
 
         if (pulled_task || time_after(jiffies, this_rq->next_balance)) {
                 /*
@@ -6727,9 +6730,6 @@ static int idle_balance(struct rq *this_rq)
                 this_rq->next_balance = next_balance;
         }
 
-        if (curr_cost > this_rq->max_idle_balance_cost)
-                this_rq->max_idle_balance_cost = curr_cost;
-
 out:
         /* Is there a task of a high priority class? */
         if (this_rq->nr_running != this_rq->cfs.h_nr_running)
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index b7976a127178..8f4390a079c7 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -63,6 +63,136 @@ void __weak arch_cpu_idle(void)
         local_irq_enable();
 }
 
+/**
+ * cpuidle_idle_call - the main idle function
+ *
+ * NOTE: no locks or semaphores should be used here
+ * return non-zero on failure
+ */
+static int cpuidle_idle_call(void)
+{
+        struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
+        struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
+        int next_state, entered_state, ret;
+        bool broadcast;
+
+        /*
+         * Check if the idle task must be rescheduled. If it is the
+         * case, exit the function after re-enabling the local irq and
+         * set again the polling flag
+         */
+        if (current_clr_polling_and_test()) {
+                local_irq_enable();
+                __current_set_polling();
+                return 0;
+        }
+
+        /*
+         * During the idle period, stop measuring the disabled irqs
+         * critical sections latencies
+         */
+        stop_critical_timings();
+
+        /*
+         * Tell the RCU framework we are entering an idle section,
+         * so no more rcu read side critical sections and one more
+         * step to the grace period
+         */
+        rcu_idle_enter();
+
+        /*
+         * Check if the cpuidle framework is ready, otherwise fallback
+         * to the default arch specific idle method
+         */
+        ret = cpuidle_enabled(drv, dev);
+
+        if (!ret) {
+                /*
+                 * Ask the governor to choose an idle state it thinks
+                 * it is convenient to go to. There is *always* a
+                 * convenient idle state
+                 */
+                next_state = cpuidle_select(drv, dev);
+
+                /*
+                 * The idle task must be scheduled, it is pointless to
+                 * go to idle, just update no idle residency and get
+                 * out of this function
+                 */
+                if (current_clr_polling_and_test()) {
+                        dev->last_residency = 0;
+                        entered_state = next_state;
+                        local_irq_enable();
+                } else {
+                        broadcast = !!(drv->states[next_state].flags &
+                                       CPUIDLE_FLAG_TIMER_STOP);
+
+                        if (broadcast)
+                                /*
+                                 * Tell the time framework to switch
+                                 * to a broadcast timer because our
+                                 * local timer will be shutdown. If a
+                                 * local timer is used from another
+                                 * cpu as a broadcast timer, this call
+                                 * may fail if it is not available
+                                 */
+                                ret = clockevents_notify(
+                                        CLOCK_EVT_NOTIFY_BROADCAST_ENTER,
+                                        &dev->cpu);
+
+                        if (!ret) {
+                                trace_cpu_idle_rcuidle(next_state, dev->cpu);
+
+                                /*
+                                 * Enter the idle state previously
+                                 * returned by the governor
+                                 * decision. This function will block
+                                 * until an interrupt occurs and will
+                                 * take care of re-enabling the local
+                                 * interrupts
+                                 */
+                                entered_state = cpuidle_enter(drv, dev,
+                                                              next_state);
+
+                                trace_cpu_idle_rcuidle(PWR_EVENT_EXIT,
+                                                       dev->cpu);
+
+                                if (broadcast)
+                                        clockevents_notify(
+                                                CLOCK_EVT_NOTIFY_BROADCAST_EXIT,
+                                                &dev->cpu);
+
+                                /*
+                                 * Give the governor an opportunity to reflect on the
+                                 * outcome
+                                 */
+                                cpuidle_reflect(dev, entered_state);
+                        }
+                }
+        }
+
+        /*
+         * We can't use the cpuidle framework, let's use the default
+         * idle routine
+         */
+        if (ret)
+                arch_cpu_idle();
+
+        __current_set_polling();
+
+        /*
+         * It is up to the idle functions to enable back the local
+         * interrupt
+         */
+        if (WARN_ON_ONCE(irqs_disabled()))
+                local_irq_enable();
+
+        rcu_idle_exit();
+        start_critical_timings();
+
+        return 0;
+}
+
 /*
  * Generic idle loop implementation
  */
@@ -90,23 +220,11 @@ static void cpu_idle_loop(void)
                          * know that the IPI is going to arrive right
                          * away
                          */
-                        if (cpu_idle_force_poll || tick_check_broadcast_expired()) {
+                        if (cpu_idle_force_poll || tick_check_broadcast_expired())
                                 cpu_idle_poll();
-                        } else {
-                                if (!current_clr_polling_and_test()) {
-                                        stop_critical_timings();
-                                        rcu_idle_enter();
-                                        if (cpuidle_idle_call())
-                                                arch_cpu_idle();
-                                        if (WARN_ON_ONCE(irqs_disabled()))
-                                                local_irq_enable();
-                                        rcu_idle_exit();
-                                        start_critical_timings();
-                                } else {
-                                        local_irq_enable();
-                                }
-                                __current_set_polling();
-                        }
+                        else
+                                cpuidle_idle_call();
+
                         arch_cpu_idle_exit();
                 }
 
diff --git a/kernel/sched/stats.c b/kernel/sched/stats.c
index da98af347e8b..a476bea17fbc 100644
--- a/kernel/sched/stats.c
+++ b/kernel/sched/stats.c
@@ -142,4 +142,4 @@ static int __init proc_schedstat_init(void)
         proc_create("schedstat", 0, NULL, &proc_schedstat_operations);
         return 0;
 }
-module_init(proc_schedstat_init);
+subsys_initcall(proc_schedstat_init);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index b7a10048a32c..b35c21503a36 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -55,60 +55,32 @@ struct seccomp_filter {
         atomic_t usage;
         struct seccomp_filter *prev;
         unsigned short len;  /* Instruction count */
-        struct sock_filter insns[];
+        struct sock_filter_int insnsi[];
 };
 
 /* Limit any path through the tree to 256KB worth of instructions. */
 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 
-/**
- * get_u32 - returns a u32 offset into data
- * @data: a unsigned 64 bit value
- * @index: 0 or 1 to return the first or second 32-bits
- *
- * This inline exists to hide the length of unsigned long.  If a 32-bit
- * unsigned long is passed in, it will be extended and the top 32-bits will be
- * 0. If it is a 64-bit unsigned long, then whatever data is resident will be
- * properly returned.
- *
+/*
  * Endianness is explicitly ignored and left for BPF program authors to manage
  * as per the specific architecture.
  */
-static inline u32 get_u32(u64 data, int index)
-{
-        return ((u32 *)&data)[index];
-}
-
-/* Helper for bpf_load below. */
-#define BPF_DATA(_name) offsetof(struct seccomp_data, _name)
-/**
- * bpf_load: checks and returns a pointer to the requested offset
- * @off: offset into struct seccomp_data to load from
- *
- * Returns the requested 32-bits of data.
- * seccomp_check_filter() should assure that @off is 32-bit aligned
- * and not out of bounds.  Failure to do so is a BUG.
- */
-u32 seccomp_bpf_load(int off)
+static void populate_seccomp_data(struct seccomp_data *sd)
 {
-        struct pt_regs *regs = task_pt_regs(current);
-        if (off == BPF_DATA(nr))
-                return syscall_get_nr(current, regs);
-        if (off == BPF_DATA(arch))
-                return syscall_get_arch(current, regs);
-        if (off >= BPF_DATA(args[0]) && off < BPF_DATA(args[6])) {
-                unsigned long value;
-                int arg = (off - BPF_DATA(args[0])) / sizeof(u64);
-                int index = !!(off % sizeof(u64));
-                syscall_get_arguments(current, regs, arg, 1, &value);
-                return get_u32(value, index);
-        }
-        if (off == BPF_DATA(instruction_pointer))
-                return get_u32(KSTK_EIP(current), 0);
-        if (off == BPF_DATA(instruction_pointer) + sizeof(u32))
-                return get_u32(KSTK_EIP(current), 1);
-        /* seccomp_check_filter should make this impossible. */
-        BUG();
+        struct task_struct *task = current;
+        struct pt_regs *regs = task_pt_regs(task);
+        unsigned long args[6];
+
+        sd->nr = syscall_get_nr(task, regs);
+        sd->arch = syscall_get_arch();
+        syscall_get_arguments(task, regs, 0, 6, args);
+        sd->args[0] = args[0];
+        sd->args[1] = args[1];
+        sd->args[2] = args[2];
+        sd->args[3] = args[3];
+        sd->args[4] = args[4];
+        sd->args[5] = args[5];
+        sd->instruction_pointer = KSTK_EIP(task);
 }
 
 /**
@@ -133,17 +105,17 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 
                 switch (code) {
                 case BPF_S_LD_W_ABS:
-                        ftest->code = BPF_S_ANC_SECCOMP_LD_W;
+                        ftest->code = BPF_LDX | BPF_W | BPF_ABS;
                         /* 32-bit aligned and not out of bounds. */
                         if (k >= sizeof(struct seccomp_data) || k & 3)
                                 return -EINVAL;
                         continue;
                 case BPF_S_LD_W_LEN:
-                        ftest->code = BPF_S_LD_IMM;
+                        ftest->code = BPF_LD | BPF_IMM;
                         ftest->k = sizeof(struct seccomp_data);
                         continue;
                 case BPF_S_LDX_W_LEN:
-                        ftest->code = BPF_S_LDX_IMM;
+                        ftest->code = BPF_LDX | BPF_IMM;
                         ftest->k = sizeof(struct seccomp_data);
                         continue;
                 /* Explicitly include allowed calls. */
@@ -185,6 +157,7 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
                 case BPF_S_JMP_JGT_X:
                 case BPF_S_JMP_JSET_K:
                 case BPF_S_JMP_JSET_X:
+                        sk_decode_filter(ftest, ftest);
                         continue;
                 default:
                         return -EINVAL;
@@ -202,18 +175,21 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 static u32 seccomp_run_filters(int syscall)
 {
         struct seccomp_filter *f;
+        struct seccomp_data sd;
         u32 ret = SECCOMP_RET_ALLOW;
 
         /* Ensure unexpected behavior doesn't result in failing open. */
         if (WARN_ON(current->seccomp.filter == NULL))
                 return SECCOMP_RET_KILL;
 
+        populate_seccomp_data(&sd);
+
         /*
          * All filters in the list are evaluated and the lowest BPF return
          * value always takes priority (ignoring the DATA).
          */
         for (f = current->seccomp.filter; f; f = f->prev) {
-                u32 cur_ret = sk_run_filter(NULL, f->insns);
+                u32 cur_ret = sk_run_filter_int_seccomp(&sd, f->insnsi);
                 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
                         ret = cur_ret;
         }
@@ -231,6 +207,8 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
         struct seccomp_filter *filter;
         unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
         unsigned long total_insns = fprog->len;
+        struct sock_filter *fp;
+        int new_len;
         long ret;
 
         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
@@ -252,28 +230,45 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
                                      CAP_SYS_ADMIN) != 0)
                 return -EACCES;
 
-        /* Allocate a new seccomp_filter */
-        filter = kzalloc(sizeof(struct seccomp_filter) + fp_size,
-                         GFP_KERNEL|__GFP_NOWARN);
-        if (!filter)
+        fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
+        if (!fp)
                 return -ENOMEM;
-        atomic_set(&filter->usage, 1);
-        filter->len = fprog->len;
 
         /* Copy the instructions from fprog. */
         ret = -EFAULT;
-        if (copy_from_user(filter->insns, fprog->filter, fp_size))
-                goto fail;
+        if (copy_from_user(fp, fprog->filter, fp_size))
+                goto free_prog;
 
         /* Check and rewrite the fprog via the skb checker */
-        ret = sk_chk_filter(filter->insns, filter->len);
+        ret = sk_chk_filter(fp, fprog->len);
         if (ret)
-                goto fail;
+                goto free_prog;
 
         /* Check and rewrite the fprog for seccomp use */
-        ret = seccomp_check_filter(filter->insns, filter->len);
+        ret = seccomp_check_filter(fp, fprog->len);
+        if (ret)
+                goto free_prog;
+
+        /* Convert 'sock_filter' insns to 'sock_filter_int' insns */
+        ret = sk_convert_filter(fp, fprog->len, NULL, &new_len);
         if (ret)
-                goto fail;
+                goto free_prog;
+
+        /* Allocate a new seccomp_filter */
+        ret = -ENOMEM;
+        filter = kzalloc(sizeof(struct seccomp_filter) +
+                         sizeof(struct sock_filter_int) * new_len,
+                         GFP_KERNEL|__GFP_NOWARN);
+        if (!filter)
+                goto free_prog;
+
+        ret = sk_convert_filter(fp, fprog->len, filter->insnsi, &new_len);
+        if (ret)
+                goto free_filter;
+        kfree(fp);
+
+        atomic_set(&filter->usage, 1);
+        filter->len = new_len;
 
         /*
          * If there is an existing filter, make it the prev and don't drop its
@@ -282,8 +277,11 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
         filter->prev = current->seccomp.filter;
         current->seccomp.filter = filter;
         return 0;
-fail:
+
+free_filter:
         kfree(filter);
+free_prog:
+        kfree(fp);
         return ret;
 }
 
@@ -293,7 +291,7 @@ fail:
  *
  * Returns 0 on success and non-zero otherwise.
  */
-long seccomp_attach_user_filter(char __user *user_filter)
+static long seccomp_attach_user_filter(char __user *user_filter)
 {
         struct sock_fprog fprog;
         long ret = -EFAULT;
@@ -351,7 +349,7 @@ static void seccomp_send_sigsys(int syscall, int reason)
         info.si_code = SYS_SECCOMP;
         info.si_call_addr = (void __user *)KSTK_EIP(current);
         info.si_errno = reason;
-        info.si_arch = syscall_get_arch(current, task_pt_regs(current));
+        info.si_arch = syscall_get_arch();
         info.si_syscall = syscall;
         force_sig_info(SIGSYS, &info, current);
 }
diff --git a/kernel/signal.c b/kernel/signal.c
index 52f881db1ca0..6ea13c09ae56 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -33,6 +33,8 @@
 #include <linux/uprobes.h>
 #include <linux/compat.h>
 #include <linux/cn_proc.h>
+#include <linux/compiler.h>
+
 #define CREATE_TRACE_POINTS
 #include <trace/events/signal.h>
 
@@ -2382,7 +2384,7 @@ relock:
  * @regs:               user register state
  * @stepping:           nonzero if debugger single-step or block-step in use
  *
- * This function should be called when a signal has succesfully been
+ * This function should be called when a signal has successfully been
  * delivered. It updates the blocked signals accordingly (@ka->sa.sa_mask
  * is always blocked, and the signal itself is blocked unless %SA_NODEFER
  * is set in @ka->sa.sa_flags.  Tracing is notified.
@@ -3618,7 +3620,7 @@ SYSCALL_DEFINE3(sigsuspend, int, unused1, int, unused2, old_sigset_t, mask)
 }
 #endif
 
-__attribute__((weak)) const char *arch_vma_name(struct vm_area_struct *vma)
+__weak const char *arch_vma_name(struct vm_area_struct *vma)
 {
         return NULL;
 }
diff --git a/kernel/sys.c b/kernel/sys.c
index adaeab6f7a87..fba0f29401ea 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1996,6 +1996,21 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                 if (arg2 || arg3 || arg4 || arg5)
                         return -EINVAL;
                 return current->no_new_privs ? 1 : 0;
+        case PR_GET_THP_DISABLE:
+                if (arg2 || arg3 || arg4 || arg5)
+                        return -EINVAL;
+                error = !!(me->mm->def_flags & VM_NOHUGEPAGE);
+                break;
+        case PR_SET_THP_DISABLE:
+                if (arg3 || arg4 || arg5)
+                        return -EINVAL;
+                down_write(&me->mm->mmap_sem);
+                if (arg2)
+                        me->mm->def_flags |= VM_NOHUGEPAGE;
+                else
+                        me->mm->def_flags &= ~VM_NOHUGEPAGE;
+                up_write(&me->mm->mmap_sem);
+                break;
         default:
                 error = -EINVAL;
                 break;
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 7078052284fd..bc8d1b74a6b9 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -146,11 +146,13 @@ cond_syscall(sys_io_destroy);
 cond_syscall(sys_io_submit);
 cond_syscall(sys_io_cancel);
 cond_syscall(sys_io_getevents);
+cond_syscall(sys_sysfs);
 cond_syscall(sys_syslog);
 cond_syscall(sys_process_vm_readv);
 cond_syscall(sys_process_vm_writev);
 cond_syscall(compat_sys_process_vm_readv);
 cond_syscall(compat_sys_process_vm_writev);
+cond_syscall(sys_uselib);
 
 /* arch-specific weak syscall entries */
 cond_syscall(sys_pciconfig_read);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 09d2e2413605..74f5b580fe34 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -123,7 +123,7 @@ static int __maybe_unused neg_one = -1;
 static int zero;
 static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
-static int __maybe_unused three = 3;
+static int __maybe_unused four = 4;
 static unsigned long one_ul = 1;
 static int one_hundred = 100;
 #ifdef CONFIG_PRINTK
@@ -141,6 +141,11 @@ static int min_percpu_pagelist_fract = 8;
 static int ngroups_max = NGROUPS_MAX;
 static const int cap_last_cap = CAP_LAST_CAP;
 
+/*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */
+#ifdef CONFIG_DETECT_HUNG_TASK
+static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
+#endif
+
 #ifdef CONFIG_INOTIFY_USER
 #include <linux/inotify.h>
 #endif
@@ -985,6 +990,7 @@ static struct ctl_table kern_table[] = {
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
                 .proc_handler   = proc_dohung_task_timeout_secs,
+                .extra2         = &hung_task_timeout_max,
         },
         {
                 .procname       = "hung_task_warnings",
@@ -1264,7 +1270,7 @@ static struct ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = drop_caches_sysctl_handler,
                 .extra1         = &one,
-                .extra2         = &three,
+                .extra2         = &four,
         },
 #ifdef CONFIG_COMPACTION
         {
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 015661279b68..0a0608edeb26 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -276,7 +276,7 @@ static bool tick_check_preferred(struct clock_event_device *curdev,
 bool tick_check_replacement(struct clock_event_device *curdev,
                             struct clock_event_device *newdev)
 {
-        if (tick_check_percpu(curdev, newdev, smp_processor_id()))
+        if (!tick_check_percpu(curdev, newdev, smp_processor_id()))
                 return false;
 
         return tick_check_preferred(curdev, newdev);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 9f8af69c67ec..6558b7ac112d 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -84,6 +84,9 @@ static void tick_do_update_jiffies64(ktime_t now)
 
                 /* Keep the tick_next_period variable up to date */
                 tick_next_period = ktime_add(last_jiffies_update, tick_period);
+        } else {
+                write_sequnlock(&jiffies_lock);
+                return;
         }
         write_sequnlock(&jiffies_lock);
         update_wall_time();
@@ -967,7 +970,7 @@ static void tick_nohz_switch_to_nohz(void)
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
         ktime_t next;
 
-        if (!tick_nohz_active)
+        if (!tick_nohz_enabled)
                 return;
 
         local_irq_disable();
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 5b40279ecd71..f7df8ea21707 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -22,6 +22,7 @@
 #include <linux/tick.h>
 #include <linux/stop_machine.h>
 #include <linux/pvclock_gtod.h>
+#include <linux/compiler.h>
 
 #include "tick-internal.h"
 #include "ntp_internal.h"
@@ -760,7 +761,7 @@ u64 timekeeping_max_deferment(void)
  *
  *  XXX - Do be sure to remove it once all arches implement it.
  */
-void __attribute__((weak)) read_persistent_clock(struct timespec *ts)
+void __weak read_persistent_clock(struct timespec *ts)
 {
         ts->tv_sec = 0;
         ts->tv_nsec = 0;
@@ -775,7 +776,7 @@ void __attribute__((weak)) read_persistent_clock(struct timespec *ts)
  *
  *  XXX - Do be sure to remove it once all arches implement it.
  */
-void __attribute__((weak)) read_boot_clock(struct timespec *ts)
+void __weak read_boot_clock(struct timespec *ts)
 {
         ts->tv_sec = 0;
         ts->tv_nsec = 0;
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 015f85aaca08..8639819f6cef 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -424,6 +424,7 @@ config UPROBE_EVENT
         bool "Enable uprobes-based dynamic events"
         depends on ARCH_SUPPORTS_UPROBES
         depends on MMU
+        depends on PERF_EVENTS
         select UPROBES
         select PROBE_EVENTS
         select TRACING
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 4f3a3c03eadb..c1bd4ada2a04 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1429,7 +1429,8 @@ static enum print_line_t blk_tracer_print_line(struct trace_iterator *iter)
         return print_one_line(iter, true);
 }
 
-static int blk_tracer_set_flag(u32 old_flags, u32 bit, int set)
+static int
+blk_tracer_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         /* don't output context-info for blk_classic output */
         if (bit == TRACE_BLK_OPT_CLASSIC) {
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index cd7f76d1eb86..1fd4b9479210 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -237,14 +237,13 @@ static int control_ops_alloc(struct ftrace_ops *ops)
         return 0;
 }
 
-static void control_ops_free(struct ftrace_ops *ops)
-{
-        free_percpu(ops->disabled);
-}
-
 static void update_global_ops(void)
 {
-        ftrace_func_t func;
+        ftrace_func_t func = ftrace_global_list_func;
+        void *private = NULL;
+
+        /* The list has its own recursion protection. */
+        global_ops.flags |= FTRACE_OPS_FL_RECURSION_SAFE;
 
         /*
          * If there's only one function registered, then call that
@@ -254,23 +253,17 @@ static void update_global_ops(void)
         if (ftrace_global_list == &ftrace_list_end ||
             ftrace_global_list->next == &ftrace_list_end) {
                 func = ftrace_global_list->func;
+                private = ftrace_global_list->private;
                 /*
                  * As we are calling the function directly.
                  * If it does not have recursion protection,
                  * the function_trace_op needs to be updated
                  * accordingly.
                  */
-                if (ftrace_global_list->flags & FTRACE_OPS_FL_RECURSION_SAFE)
-                        global_ops.flags |= FTRACE_OPS_FL_RECURSION_SAFE;
-                else
+                if (!(ftrace_global_list->flags & FTRACE_OPS_FL_RECURSION_SAFE))
                         global_ops.flags &= ~FTRACE_OPS_FL_RECURSION_SAFE;
-        } else {
-                func = ftrace_global_list_func;
-                /* The list has its own recursion protection. */
-                global_ops.flags |= FTRACE_OPS_FL_RECURSION_SAFE;
         }
 
-
         /* If we filter on pids, update to use the pid function */
         if (!list_empty(&ftrace_pids)) {
                 set_ftrace_pid_function(func);
@@ -278,6 +271,7 @@ static void update_global_ops(void)
         }
 
         global_ops.func = func;
+        global_ops.private = private;
 }
 
 static void ftrace_sync(struct work_struct *work)
@@ -437,6 +431,9 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
 
 static int __register_ftrace_function(struct ftrace_ops *ops)
 {
+        if (ops->flags & FTRACE_OPS_FL_DELETED)
+                return -EINVAL;
+
         if (FTRACE_WARN_ON(ops == &global_ops))
                 return -EINVAL;
 
@@ -1172,8 +1169,6 @@ struct ftrace_page {
         int                     size;
 };
 
-static struct ftrace_page *ftrace_new_pgs;
-
 #define ENTRY_SIZE sizeof(struct dyn_ftrace)
 #define ENTRIES_PER_PAGE (PAGE_SIZE / ENTRY_SIZE)
 
@@ -1560,7 +1555,7 @@ unsigned long ftrace_location(unsigned long ip)
  * the function tracer. It checks the ftrace internal tables to
  * determine if the address belongs or not.
  */
-int ftrace_text_reserved(void *start, void *end)
+int ftrace_text_reserved(const void *start, const void *end)
 {
         unsigned long ret;
 
@@ -1994,6 +1989,7 @@ int __weak ftrace_arch_code_modify_post_process(void)
 void ftrace_modify_all_code(int command)
 {
         int update = command & FTRACE_UPDATE_TRACE_FUNC;
+        int err = 0;
 
         /*
          * If the ftrace_caller calls a ftrace_ops func directly,
@@ -2005,8 +2001,11 @@ void ftrace_modify_all_code(int command)
          * to make sure the ops are having the right functions
          * traced.
          */
-        if (update)
-                ftrace_update_ftrace_func(ftrace_ops_list_func);
+        if (update) {
+                err = ftrace_update_ftrace_func(ftrace_ops_list_func);
+                if (FTRACE_WARN_ON(err))
+                        return;
+        }
 
         if (command & FTRACE_UPDATE_CALLS)
                 ftrace_replace_code(1);
@@ -2019,13 +2018,16 @@ void ftrace_modify_all_code(int command)
                 /* If irqs are disabled, we are in stop machine */
                 if (!irqs_disabled())
                         smp_call_function(ftrace_sync_ipi, NULL, 1);
-                ftrace_update_ftrace_func(ftrace_trace_function);
+                err = ftrace_update_ftrace_func(ftrace_trace_function);
+                if (FTRACE_WARN_ON(err))
+                        return;
         }
 
         if (command & FTRACE_START_FUNC_RET)
-                ftrace_enable_ftrace_graph_caller();
+                err = ftrace_enable_ftrace_graph_caller();
         else if (command & FTRACE_STOP_FUNC_RET)
-                ftrace_disable_ftrace_graph_caller();
+                err = ftrace_disable_ftrace_graph_caller();
+        FTRACE_WARN_ON(err);
 }
 
 static int __ftrace_modify_code(void *data)
@@ -2093,6 +2095,11 @@ static ftrace_func_t saved_ftrace_func;
 static int ftrace_start_up;
 static int global_start_up;
 
+static void control_ops_free(struct ftrace_ops *ops)
+{
+        free_percpu(ops->disabled);
+}
+
 static void ftrace_startup_enable(int command)
 {
         if (saved_ftrace_func != ftrace_trace_function) {
@@ -2244,7 +2251,6 @@ static void ftrace_shutdown_sysctl(void)
 }
 
 static cycle_t          ftrace_update_time;
-static unsigned long    ftrace_update_cnt;
 unsigned long           ftrace_update_tot_cnt;
 
 static inline int ops_traces_mod(struct ftrace_ops *ops)
@@ -2300,11 +2306,12 @@ static int referenced_filters(struct dyn_ftrace *rec)
         return cnt;
 }
 
-static int ftrace_update_code(struct module *mod)
+static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs)
 {
         struct ftrace_page *pg;
         struct dyn_ftrace *p;
         cycle_t start, stop;
+        unsigned long update_cnt = 0;
         unsigned long ref = 0;
         bool test = false;
         int i;
@@ -2330,9 +2337,8 @@ static int ftrace_update_code(struct module *mod)
         }
 
         start = ftrace_now(raw_smp_processor_id());
-        ftrace_update_cnt = 0;
 
-        for (pg = ftrace_new_pgs; pg; pg = pg->next) {
+        for (pg = new_pgs; pg; pg = pg->next) {
 
                 for (i = 0; i < pg->index; i++) {
                         int cnt = ref;
@@ -2353,7 +2359,7 @@ static int ftrace_update_code(struct module *mod)
                         if (!ftrace_code_disable(mod, p))
                                 break;
 
-                        ftrace_update_cnt++;
+                        update_cnt++;
 
                         /*
                          * If the tracing is enabled, go ahead and enable the record.
@@ -2372,11 +2378,9 @@ static int ftrace_update_code(struct module *mod)
                 }
         }
 
-        ftrace_new_pgs = NULL;
-
         stop = ftrace_now(raw_smp_processor_id());
         ftrace_update_time = stop - start;
-        ftrace_update_tot_cnt += ftrace_update_cnt;
+        ftrace_update_tot_cnt += update_cnt;
 
         return 0;
 }
@@ -2468,22 +2472,6 @@ ftrace_allocate_pages(unsigned long num_to_init)
         return NULL;
 }
 
-static int __init ftrace_dyn_table_alloc(unsigned long num_to_init)
-{
-        int cnt;
-
-        if (!num_to_init) {
-                pr_info("ftrace: No functions to be traced?\n");
-                return -1;
-        }
-
-        cnt = num_to_init / ENTRIES_PER_PAGE;
-        pr_info("ftrace: allocating %ld entries in %d pages\n",
-                num_to_init, cnt + 1);
-
-        return 0;
-}
-
 #define FTRACE_BUFF_MAX (KSYM_SYMBOL_LEN+4) /* room for wildcards */
 
 struct ftrace_iterator {
@@ -2871,7 +2859,9 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
 static int
 ftrace_filter_open(struct inode *inode, struct file *file)
 {
-        return ftrace_regex_open(&global_ops,
+        struct ftrace_ops *ops = inode->i_private;
+
+        return ftrace_regex_open(ops,
                         FTRACE_ITER_FILTER | FTRACE_ITER_DO_HASH,
                         inode, file);
 }
@@ -2879,7 +2869,9 @@ ftrace_filter_open(struct inode *inode, struct file *file)
 static int
 ftrace_notrace_open(struct inode *inode, struct file *file)
 {
-        return ftrace_regex_open(&global_ops, FTRACE_ITER_NOTRACE,
+        struct ftrace_ops *ops = inode->i_private;
+
+        return ftrace_regex_open(ops, FTRACE_ITER_NOTRACE,
                                  inode, file);
 }
 
@@ -4109,6 +4101,36 @@ static const struct file_operations ftrace_graph_notrace_fops = {
 };
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
+void ftrace_create_filter_files(struct ftrace_ops *ops,
+                                struct dentry *parent)
+{
+
+        trace_create_file("set_ftrace_filter", 0644, parent,
+                          ops, &ftrace_filter_fops);
+
+        trace_create_file("set_ftrace_notrace", 0644, parent,
+                          ops, &ftrace_notrace_fops);
+}
+
+/*
+ * The name "destroy_filter_files" is really a misnomer. Although
+ * in the future, it may actualy delete the files, but this is
+ * really intended to make sure the ops passed in are disabled
+ * and that when this function returns, the caller is free to
+ * free the ops.
+ *
+ * The "destroy" name is only to match the "create" name that this
+ * should be paired with.
+ */
+void ftrace_destroy_filter_files(struct ftrace_ops *ops)
+{
+        mutex_lock(&ftrace_lock);
+        if (ops->flags & FTRACE_OPS_FL_ENABLED)
+                ftrace_shutdown(ops, 0);
+        ops->flags |= FTRACE_OPS_FL_DELETED;
+        mutex_unlock(&ftrace_lock);
+}
+
 static __init int ftrace_init_dyn_debugfs(struct dentry *d_tracer)
 {
 
@@ -4118,11 +4140,7 @@ static __init int ftrace_init_dyn_debugfs(struct dentry *d_tracer)
         trace_create_file("enabled_functions", 0444,
                         d_tracer, NULL, &ftrace_enabled_fops);
 
-        trace_create_file("set_ftrace_filter", 0644, d_tracer,
-                        NULL, &ftrace_filter_fops);
-
-        trace_create_file("set_ftrace_notrace", 0644, d_tracer,
-                                    NULL, &ftrace_notrace_fops);
+        ftrace_create_filter_files(&global_ops, d_tracer);
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         trace_create_file("set_graph_function", 0444, d_tracer,
@@ -4238,9 +4256,6 @@ static int ftrace_process_locs(struct module *mod,
         /* Assign the last page to ftrace_pages */
         ftrace_pages = pg;
 
-        /* These new locations need to be initialized */
-        ftrace_new_pgs = start_pg;
-
         /*
          * We only need to disable interrupts on start up
          * because we are modifying code that an interrupt
@@ -4251,7 +4266,7 @@ static int ftrace_process_locs(struct module *mod,
          */
         if (!mod)
                 local_irq_save(flags);
-        ftrace_update_code(mod);
+        ftrace_update_code(mod, start_pg);
         if (!mod)
                 local_irq_restore(flags);
         ret = 0;
@@ -4360,30 +4375,27 @@ struct notifier_block ftrace_module_exit_nb = {
         .priority = INT_MIN,    /* Run after anything that can remove kprobes */
 };
 
-extern unsigned long __start_mcount_loc[];
-extern unsigned long __stop_mcount_loc[];
-
 void __init ftrace_init(void)
 {
-        unsigned long count, addr, flags;
+        extern unsigned long __start_mcount_loc[];
+        extern unsigned long __stop_mcount_loc[];
+        unsigned long count, flags;
         int ret;
 
-        /* Keep the ftrace pointer to the stub */
-        addr = (unsigned long)ftrace_stub;
-
         local_irq_save(flags);
-        ftrace_dyn_arch_init(&addr);
+        ret = ftrace_dyn_arch_init();
         local_irq_restore(flags);
-
-        /* ftrace_dyn_arch_init places the return code in addr */
-        if (addr)
+        if (ret)
                 goto failed;
 
         count = __stop_mcount_loc - __start_mcount_loc;
-
-        ret = ftrace_dyn_table_alloc(count);
-        if (ret)
+        if (!count) {
+                pr_info("ftrace: No functions to be traced?\n");
                 goto failed;
+        }
+
+        pr_info("ftrace: allocating %ld entries in %ld pages\n",
+                count, count / ENTRIES_PER_PAGE + 1);
 
         last_ftrace_enabled = ftrace_enabled = 1;
 
@@ -4431,7 +4443,13 @@ static inline void ftrace_startup_enable(int command) { }
                         (ops)->flags |= FTRACE_OPS_FL_ENABLED;          \
                 ___ret;                                                 \
         })
-# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
+# define ftrace_shutdown(ops, command)                                  \
+        ({                                                              \
+                int ___ret = __unregister_ftrace_function(ops);         \
+                if (!___ret)                                            \
+                        (ops)->flags &= ~FTRACE_OPS_FL_ENABLED;         \
+                ___ret;                                                 \
+        })
 
 # define ftrace_startup_sysctl()        do { } while (0)
 # define ftrace_shutdown_sysctl()       do { } while (0)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index fc4da2d97f9b..c634868c2921 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1301,7 +1301,7 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
          * In that off case, we need to allocate for all possible cpus.
          */
 #ifdef CONFIG_HOTPLUG_CPU
-        get_online_cpus();
+        cpu_notifier_register_begin();
         cpumask_copy(buffer->cpumask, cpu_online_mask);
 #else
         cpumask_copy(buffer->cpumask, cpu_possible_mask);
@@ -1324,10 +1324,10 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
 #ifdef CONFIG_HOTPLUG_CPU
         buffer->cpu_notify.notifier_call = rb_cpu_notify;
         buffer->cpu_notify.priority = 0;
-        register_cpu_notifier(&buffer->cpu_notify);
+        __register_cpu_notifier(&buffer->cpu_notify);
+        cpu_notifier_register_done();
 #endif
 
-        put_online_cpus();
         mutex_init(&buffer->mutex);
 
         return buffer;
@@ -1341,7 +1341,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
 
  fail_free_cpumask:
         free_cpumask_var(buffer->cpumask);
-        put_online_cpus();
+#ifdef CONFIG_HOTPLUG_CPU
+        cpu_notifier_register_done();
+#endif
 
  fail_free_buffer:
         kfree(buffer);
@@ -1358,16 +1360,17 @@ ring_buffer_free(struct ring_buffer *buffer)
 {
         int cpu;
 
-        get_online_cpus();
-
 #ifdef CONFIG_HOTPLUG_CPU
-        unregister_cpu_notifier(&buffer->cpu_notify);
+        cpu_notifier_register_begin();
+        __unregister_cpu_notifier(&buffer->cpu_notify);
 #endif
 
         for_each_buffer_cpu(buffer, cpu)
                 rb_free_cpu_buffer(buffer->buffers[cpu]);
 
-        put_online_cpus();
+#ifdef CONFIG_HOTPLUG_CPU
+        cpu_notifier_register_done();
+#endif
 
         kfree(buffer->buffers);
         free_cpumask_var(buffer->cpumask);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 24c1f2382557..737b0efa1a62 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -73,7 +73,8 @@ static struct tracer_flags dummy_tracer_flags = {
         .opts = dummy_tracer_opt
 };
 
-static int dummy_set_flag(u32 old_flags, u32 bit, int set)
+static int
+dummy_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         return 0;
 }
@@ -118,7 +119,7 @@ enum ftrace_dump_mode ftrace_dump_on_oops;
 /* When set, tracing will stop when a WARN*() is hit */
 int __disable_trace_on_warning;
 
-static int tracing_set_tracer(const char *buf);
+static int tracing_set_tracer(struct trace_array *tr, const char *buf);
 
 #define MAX_TRACER_SIZE         100
 static char bootup_tracer_buf[MAX_TRACER_SIZE] __initdata;
@@ -180,6 +181,17 @@ static int __init set_trace_boot_options(char *str)
 }
 __setup("trace_options=", set_trace_boot_options);
 
+static char trace_boot_clock_buf[MAX_TRACER_SIZE] __initdata;
+static char *trace_boot_clock __initdata;
+
+static int __init set_trace_boot_clock(char *str)
+{
+        strlcpy(trace_boot_clock_buf, str, MAX_TRACER_SIZE);
+        trace_boot_clock = trace_boot_clock_buf;
+        return 0;
+}
+__setup("trace_clock=", set_trace_boot_clock);
+
 
 unsigned long long ns2usecs(cycle_t nsec)
 {
@@ -1230,7 +1242,7 @@ int register_tracer(struct tracer *type)
 
         printk(KERN_INFO "Starting tracer '%s'\n", type->name);
         /* Do we want this tracer to start on bootup? */
-        tracing_set_tracer(type->name);
+        tracing_set_tracer(&global_trace, type->name);
         default_bootup_tracer = NULL;
         /* disable other selftests, since this will break it. */
         tracing_selftest_disabled = true;
@@ -3137,27 +3149,52 @@ static int tracing_open(struct inode *inode, struct file *file)
         return ret;
 }
 
+/*
+ * Some tracers are not suitable for instance buffers.
+ * A tracer is always available for the global array (toplevel)
+ * or if it explicitly states that it is.
+ */
+static bool
+trace_ok_for_array(struct tracer *t, struct trace_array *tr)
+{
+        return (tr->flags & TRACE_ARRAY_FL_GLOBAL) || t->allow_instances;
+}
+
+/* Find the next tracer that this trace array may use */
+static struct tracer *
+get_tracer_for_array(struct trace_array *tr, struct tracer *t)
+{
+        while (t && !trace_ok_for_array(t, tr))
+                t = t->next;
+
+        return t;
+}
+
 static void *
 t_next(struct seq_file *m, void *v, loff_t *pos)
 {
+        struct trace_array *tr = m->private;
         struct tracer *t = v;
 
         (*pos)++;
 
         if (t)
-                t = t->next;
+                t = get_tracer_for_array(tr, t->next);
 
         return t;
 }
 
 static void *t_start(struct seq_file *m, loff_t *pos)
 {
+        struct trace_array *tr = m->private;
         struct tracer *t;
         loff_t l = 0;
 
         mutex_lock(&trace_types_lock);
-        for (t = trace_types; t && l < *pos; t = t_next(m, t, &l))
-                ;
+
+        t = get_tracer_for_array(tr, trace_types);
+        for (; t && l < *pos; t = t_next(m, t, &l))
+                        ;
 
         return t;
 }
@@ -3192,10 +3229,21 @@ static const struct seq_operations show_traces_seq_ops = {
 
 static int show_traces_open(struct inode *inode, struct file *file)
 {
+        struct trace_array *tr = inode->i_private;
+        struct seq_file *m;
+        int ret;
+
         if (tracing_disabled)
                 return -ENODEV;
 
-        return seq_open(file, &show_traces_seq_ops);
+        ret = seq_open(file, &show_traces_seq_ops);
+        if (ret)
+                return ret;
+
+        m = file->private_data;
+        m->private = tr;
+
+        return 0;
 }
 
 static ssize_t
@@ -3355,13 +3403,14 @@ static int tracing_trace_options_show(struct seq_file *m, void *v)
         return 0;
 }
 
-static int __set_tracer_option(struct tracer *trace,
+static int __set_tracer_option(struct trace_array *tr,
                                struct tracer_flags *tracer_flags,
                                struct tracer_opt *opts, int neg)
 {
+        struct tracer *trace = tr->current_trace;
         int ret;
 
-        ret = trace->set_flag(tracer_flags->val, opts->bit, !neg);
+        ret = trace->set_flag(tr, tracer_flags->val, opts->bit, !neg);
         if (ret)
                 return ret;
 
@@ -3373,8 +3422,9 @@ static int __set_tracer_option(struct tracer *trace,
 }
 
 /* Try to assign a tracer specific option */
-static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
+static int set_tracer_option(struct trace_array *tr, char *cmp, int neg)
 {
+        struct tracer *trace = tr->current_trace;
         struct tracer_flags *tracer_flags = trace->flags;
         struct tracer_opt *opts = NULL;
         int i;
@@ -3383,8 +3433,7 @@ static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
                 opts = &tracer_flags->opts[i];
 
                 if (strcmp(cmp, opts->name) == 0)
-                        return __set_tracer_option(trace, trace->flags,
-                                                   opts, neg);
+                        return __set_tracer_option(tr, trace->flags, opts, neg);
         }
 
         return -EINVAL;
@@ -3407,7 +3456,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
 
         /* Give the tracer a chance to approve the change */
         if (tr->current_trace->flag_changed)
-                if (tr->current_trace->flag_changed(tr->current_trace, mask, !!enabled))
+                if (tr->current_trace->flag_changed(tr, mask, !!enabled))
                         return -EINVAL;
 
         if (enabled)
@@ -3456,7 +3505,7 @@ static int trace_set_options(struct trace_array *tr, char *option)
 
         /* If no option could be set, test the specific tracer options */
         if (!trace_options[i])
-                ret = set_tracer_option(tr->current_trace, cmp, neg);
+                ret = set_tracer_option(tr, cmp, neg);
 
         mutex_unlock(&trace_types_lock);
 
@@ -3562,6 +3611,8 @@ static const char readme_msg[] =
 #ifdef CONFIG_TRACER_SNAPSHOT
         "\t\t      snapshot\n"
 #endif
+        "\t\t      dump\n"
+        "\t\t      cpudump\n"
         "\t     example: echo do_fault:traceoff > set_ftrace_filter\n"
         "\t              echo do_trap:traceoff:3 > set_ftrace_filter\n"
         "\t     The first one will disable tracing every time do_fault is hit\n"
@@ -3885,10 +3936,26 @@ create_trace_option_files(struct trace_array *tr, struct tracer *tracer);
 static void
 destroy_trace_option_files(struct trace_option_dentry *topts);
 
-static int tracing_set_tracer(const char *buf)
+/*
+ * Used to clear out the tracer before deletion of an instance.
+ * Must have trace_types_lock held.
+ */
+static void tracing_set_nop(struct trace_array *tr)
+{
+        if (tr->current_trace == &nop_trace)
+                return;
+        
+        tr->current_trace->enabled--;
+
+        if (tr->current_trace->reset)
+                tr->current_trace->reset(tr);
+
+        tr->current_trace = &nop_trace;
+}
+
+static int tracing_set_tracer(struct trace_array *tr, const char *buf)
 {
         static struct trace_option_dentry *topts;
-        struct trace_array *tr = &global_trace;
         struct tracer *t;
 #ifdef CONFIG_TRACER_MAX_TRACE
         bool had_max_tr;
@@ -3916,9 +3983,15 @@ static int tracing_set_tracer(const char *buf)
         if (t == tr->current_trace)
                 goto out;
 
+        /* Some tracers are only allowed for the top level buffer */
+        if (!trace_ok_for_array(t, tr)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         trace_branch_disable();
 
-        tr->current_trace->enabled = false;
+        tr->current_trace->enabled--;
 
         if (tr->current_trace->reset)
                 tr->current_trace->reset(tr);
@@ -3941,9 +4014,11 @@ static int tracing_set_tracer(const char *buf)
                 free_snapshot(tr);
         }
 #endif
-        destroy_trace_option_files(topts);
-
-        topts = create_trace_option_files(tr, t);
+        /* Currently, only the top instance has options */
+        if (tr->flags & TRACE_ARRAY_FL_GLOBAL) {
+                destroy_trace_option_files(topts);
+                topts = create_trace_option_files(tr, t);
+        }
 
 #ifdef CONFIG_TRACER_MAX_TRACE
         if (t->use_max_tr && !had_max_tr) {
@@ -3960,7 +4035,7 @@ static int tracing_set_tracer(const char *buf)
         }
 
         tr->current_trace = t;
-        tr->current_trace->enabled = true;
+        tr->current_trace->enabled++;
         trace_branch_enable(tr);
  out:
         mutex_unlock(&trace_types_lock);
@@ -3972,6 +4047,7 @@ static ssize_t
 tracing_set_trace_write(struct file *filp, const char __user *ubuf,
                         size_t cnt, loff_t *ppos)
 {
+        struct trace_array *tr = filp->private_data;
         char buf[MAX_TRACER_SIZE+1];
         int i;
         size_t ret;
@@ -3991,7 +4067,7 @@ tracing_set_trace_write(struct file *filp, const char __user *ubuf,
         for (i = cnt - 1; i > 0 && isspace(buf[i]); i--)
                 buf[i] = 0;
 
-        err = tracing_set_tracer(buf);
+        err = tracing_set_tracer(tr, buf);
         if (err)
                 return err;
 
@@ -4316,8 +4392,6 @@ static void tracing_spd_release_pipe(struct splice_pipe_desc *spd,
 
 static const struct pipe_buf_operations tracing_pipe_buf_ops = {
         .can_merge              = 0,
-        .map                    = generic_pipe_buf_map,
-        .unmap                  = generic_pipe_buf_unmap,
         .confirm                = generic_pipe_buf_confirm,
         .release                = generic_pipe_buf_release,
         .steal                  = generic_pipe_buf_steal,
@@ -4412,7 +4486,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
         trace_access_lock(iter->cpu_file);
 
         /* Fill as many pages as possible. */
-        for (i = 0, rem = len; i < pipe->buffers && rem; i++) {
+        for (i = 0, rem = len; i < spd.nr_pages_max && rem; i++) {
                 spd.pages[i] = alloc_page(GFP_KERNEL);
                 if (!spd.pages[i])
                         break;
@@ -4699,25 +4773,10 @@ static int tracing_clock_show(struct seq_file *m, void *v)
         return 0;
 }
 
-static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
-                                   size_t cnt, loff_t *fpos)
+static int tracing_set_clock(struct trace_array *tr, const char *clockstr)
 {
-        struct seq_file *m = filp->private_data;
-        struct trace_array *tr = m->private;
-        char buf[64];
-        const char *clockstr;
         int i;
 
-        if (cnt >= sizeof(buf))
-                return -EINVAL;
-
-        if (copy_from_user(&buf, ubuf, cnt))
-                return -EFAULT;
-
-        buf[cnt] = 0;
-
-        clockstr = strstrip(buf);
-
         for (i = 0; i < ARRAY_SIZE(trace_clocks); i++) {
                 if (strcmp(trace_clocks[i].name, clockstr) == 0)
                         break;
@@ -4745,6 +4804,32 @@ static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
 
         mutex_unlock(&trace_types_lock);
 
+        return 0;
+}
+
+static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
+                                   size_t cnt, loff_t *fpos)
+{
+        struct seq_file *m = filp->private_data;
+        struct trace_array *tr = m->private;
+        char buf[64];
+        const char *clockstr;
+        int ret;
+
+        if (cnt >= sizeof(buf))
+                return -EINVAL;
+
+        if (copy_from_user(&buf, ubuf, cnt))
+                return -EFAULT;
+
+        buf[cnt] = 0;
+
+        clockstr = strstrip(buf);
+
+        ret = tracing_set_clock(tr, clockstr);
+        if (ret)
+                return ret;
+
         *fpos += cnt;
 
         return cnt;
@@ -5194,8 +5279,6 @@ static void buffer_pipe_buf_get(struct pipe_inode_info *pipe,
 /* Pipe buffer operations for a buffer. */
 static const struct pipe_buf_operations buffer_pipe_buf_ops = {
         .can_merge              = 0,
-        .map                    = generic_pipe_buf_map,
-        .unmap                  = generic_pipe_buf_unmap,
         .confirm                = generic_pipe_buf_confirm,
         .release                = buffer_pipe_buf_release,
         .steal                  = generic_pipe_buf_steal,
@@ -5271,7 +5354,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
         trace_access_lock(iter->cpu_file);
         entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);
 
-        for (i = 0; i < pipe->buffers && len && entries; i++, len -= PAGE_SIZE) {
+        for (i = 0; i < spd.nr_pages_max && len && entries; i++, len -= PAGE_SIZE) {
                 struct page *page;
                 int r;
 
@@ -5705,7 +5788,7 @@ trace_options_write(struct file *filp, const char __user *ubuf, size_t cnt,
 
         if (!!(topt->flags->val & topt->opt->bit) != val) {
                 mutex_lock(&trace_types_lock);
-                ret = __set_tracer_option(topt->tr->current_trace, topt->flags,
+                ret = __set_tracer_option(topt->tr, topt->flags,
                                           topt->opt, !val);
                 mutex_unlock(&trace_types_lock);
                 if (ret)
@@ -6112,7 +6195,9 @@ static int instance_delete(const char *name)
 
         list_del(&tr->list);
 
+        tracing_set_nop(tr);
         event_trace_del_tracer(tr);
+        ftrace_destroy_function_files(tr);
         debugfs_remove_recursive(tr->dir);
         free_percpu(tr->trace_buffer.data);
         ring_buffer_free(tr->trace_buffer.buffer);
@@ -6207,6 +6292,12 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
 {
         int cpu;
 
+        trace_create_file("available_tracers", 0444, d_tracer,
+                        tr, &show_traces_fops);
+
+        trace_create_file("current_tracer", 0644, d_tracer,
+                        tr, &set_tracer_fops);
+
         trace_create_file("tracing_cpumask", 0644, d_tracer,
                           tr, &tracing_cpumask_fops);
 
@@ -6237,6 +6328,9 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
         trace_create_file("tracing_on", 0644, d_tracer,
                           tr, &rb_simple_fops);
 
+        if (ftrace_create_function_files(tr, d_tracer))
+                WARN(1, "Could not allocate function filter files");
+
 #ifdef CONFIG_TRACER_SNAPSHOT
         trace_create_file("snapshot", 0644, d_tracer,
                           tr, &snapshot_fops);
@@ -6259,12 +6353,6 @@ static __init int tracer_init_debugfs(void)
 
         init_tracer_debugfs(&global_trace, d_tracer);
 
-        trace_create_file("available_tracers", 0444, d_tracer,
-                        &global_trace, &show_traces_fops);
-
-        trace_create_file("current_tracer", 0644, d_tracer,
-                        &global_trace, &set_tracer_fops);
-
 #ifdef CONFIG_TRACER_MAX_TRACE
         trace_create_file("tracing_max_latency", 0644, d_tracer,
                         &tracing_max_latency, &tracing_max_lat_fops);
@@ -6527,6 +6615,13 @@ __init static int tracer_alloc_buffers(void)
 
         trace_init_cmdlines();
 
+        if (trace_boot_clock) {
+                ret = tracing_set_clock(&global_trace, trace_boot_clock);
+                if (ret < 0)
+                        pr_warning("Trace clock %s not defined, going back to default\n",
+                                   trace_boot_clock);
+        }
+
         /*
          * register_tracer() might reference current_trace, so it
          * needs to be set before we register anything. This is
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 02b592f2d4b7..2e29d7ba5a52 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -13,6 +13,7 @@
 #include <linux/hw_breakpoint.h>
 #include <linux/trace_seq.h>
 #include <linux/ftrace_event.h>
+#include <linux/compiler.h>
 
 #ifdef CONFIG_FTRACE_SYSCALLS
 #include <asm/unistd.h>         /* For NR_SYSCALLS           */
@@ -210,6 +211,11 @@ struct trace_array {
         struct list_head        events;
         cpumask_var_t           tracing_cpumask; /* only trace on set CPUs */
         int                     ref;
+#ifdef CONFIG_FUNCTION_TRACER
+        struct ftrace_ops       *ops;
+        /* function tracing enabled */
+        int                     function_enabled;
+#endif
 };
 
 enum {
@@ -355,14 +361,16 @@ struct tracer {
         void                    (*print_header)(struct seq_file *m);
         enum print_line_t       (*print_line)(struct trace_iterator *iter);
         /* If you handled the flag setting, return 0 */
-        int                     (*set_flag)(u32 old_flags, u32 bit, int set);
+        int                     (*set_flag)(struct trace_array *tr,
+                                            u32 old_flags, u32 bit, int set);
         /* Return 0 if OK with change, else return non-zero */
-        int                     (*flag_changed)(struct tracer *tracer,
+        int                     (*flag_changed)(struct trace_array *tr,
                                                 u32 mask, int set);
         struct tracer           *next;
         struct tracer_flags     *flags;
+        int                     enabled;
         bool                    print_max;
-        bool                    enabled;
+        bool                    allow_instances;
 #ifdef CONFIG_TRACER_MAX_TRACE
         bool                    use_max_tr;
 #endif
@@ -812,13 +820,36 @@ static inline int ftrace_trace_task(struct task_struct *task)
         return test_tsk_trace_trace(task);
 }
 extern int ftrace_is_dead(void);
+int ftrace_create_function_files(struct trace_array *tr,
+                                 struct dentry *parent);
+void ftrace_destroy_function_files(struct trace_array *tr);
 #else
 static inline int ftrace_trace_task(struct task_struct *task)
 {
         return 1;
 }
 static inline int ftrace_is_dead(void) { return 0; }
-#endif
+static inline int
+ftrace_create_function_files(struct trace_array *tr,
+                             struct dentry *parent)
+{
+        return 0;
+}
+static inline void ftrace_destroy_function_files(struct trace_array *tr) { }
+#endif /* CONFIG_FUNCTION_TRACER */
+
+#if defined(CONFIG_FUNCTION_TRACER) && defined(CONFIG_DYNAMIC_FTRACE)
+void ftrace_create_filter_files(struct ftrace_ops *ops,
+                                struct dentry *parent);
+void ftrace_destroy_filter_files(struct ftrace_ops *ops);
+#else
+/*
+ * The ops parameter passed in is usually undefined.
+ * This must be a macro.
+ */
+#define ftrace_create_filter_files(ops, parent) do { } while (0)
+#define ftrace_destroy_filter_files(ops) do { } while (0)
+#endif /* CONFIG_FUNCTION_TRACER && CONFIG_DYNAMIC_FTRACE */
 
 int ftrace_event_is_function(struct ftrace_event_call *call);
 
@@ -1249,7 +1280,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled);
 #undef FTRACE_ENTRY
 #define FTRACE_ENTRY(call, struct_name, id, tstruct, print, filter)     \
         extern struct ftrace_event_call                                 \
-        __attribute__((__aligned__(4))) event_##call;
+        __aligned(4) event_##call;
 #undef FTRACE_ENTRY_DUP
 #define FTRACE_ENTRY_DUP(call, struct_name, id, tstruct, print, filter) \
         FTRACE_ENTRY(call, struct_name, id, PARAMS(tstruct), PARAMS(print), \
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 7b16d40bd64d..3ddfd8f62c05 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -188,29 +188,60 @@ int trace_event_raw_init(struct ftrace_event_call *call)
 }
 EXPORT_SYMBOL_GPL(trace_event_raw_init);
 
+void *ftrace_event_buffer_reserve(struct ftrace_event_buffer *fbuffer,
+                                  struct ftrace_event_file *ftrace_file,
+                                  unsigned long len)
+{
+        struct ftrace_event_call *event_call = ftrace_file->event_call;
+
+        local_save_flags(fbuffer->flags);
+        fbuffer->pc = preempt_count();
+        fbuffer->ftrace_file = ftrace_file;
+
+        fbuffer->event =
+                trace_event_buffer_lock_reserve(&fbuffer->buffer, ftrace_file,
+                                                event_call->event.type, len,
+                                                fbuffer->flags, fbuffer->pc);
+        if (!fbuffer->event)
+                return NULL;
+
+        fbuffer->entry = ring_buffer_event_data(fbuffer->event);
+        return fbuffer->entry;
+}
+EXPORT_SYMBOL_GPL(ftrace_event_buffer_reserve);
+
+void ftrace_event_buffer_commit(struct ftrace_event_buffer *fbuffer)
+{
+        event_trigger_unlock_commit(fbuffer->ftrace_file, fbuffer->buffer,
+                                    fbuffer->event, fbuffer->entry,
+                                    fbuffer->flags, fbuffer->pc);
+}
+EXPORT_SYMBOL_GPL(ftrace_event_buffer_commit);
+
 int ftrace_event_reg(struct ftrace_event_call *call,
                      enum trace_reg type, void *data)
 {
         struct ftrace_event_file *file = data;
 
+        WARN_ON(!(call->flags & TRACE_EVENT_FL_TRACEPOINT));
         switch (type) {
         case TRACE_REG_REGISTER:
-                return tracepoint_probe_register(call->name,
+                return tracepoint_probe_register(call->tp,
                                                  call->class->probe,
                                                  file);
         case TRACE_REG_UNREGISTER:
-                tracepoint_probe_unregister(call->name,
+                tracepoint_probe_unregister(call->tp,
                                             call->class->probe,
                                             file);
                 return 0;
 
 #ifdef CONFIG_PERF_EVENTS
         case TRACE_REG_PERF_REGISTER:
-                return tracepoint_probe_register(call->name,
+                return tracepoint_probe_register(call->tp,
                                                  call->class->perf_probe,
                                                  call);
         case TRACE_REG_PERF_UNREGISTER:
-                tracepoint_probe_unregister(call->name,
+                tracepoint_probe_unregister(call->tp,
                                             call->class->perf_probe,
                                             call);
                 return 0;
@@ -322,7 +353,7 @@ static int __ftrace_event_enable_disable(struct ftrace_event_file *file,
                         if (ret) {
                                 tracing_stop_cmdline_record();
                                 pr_info("event trace: Could not enable event "
-                                        "%s\n", call->name);
+                                        "%s\n", ftrace_event_name(call));
                                 break;
                         }
                         set_bit(FTRACE_EVENT_FL_ENABLED_BIT, &file->flags);
@@ -451,27 +482,29 @@ __ftrace_set_clr_event_nolock(struct trace_array *tr, const char *match,
 {
         struct ftrace_event_file *file;
         struct ftrace_event_call *call;
+        const char *name;
         int ret = -EINVAL;
 
         list_for_each_entry(file, &tr->events, list) {
 
                 call = file->event_call;
+                name = ftrace_event_name(call);
 
-                if (!call->name || !call->class || !call->class->reg)
+                if (!name || !call->class || !call->class->reg)
                         continue;
 
                 if (call->flags & TRACE_EVENT_FL_IGNORE_ENABLE)
                         continue;
 
                 if (match &&
-                    strcmp(match, call->name) != 0 &&
+                    strcmp(match, name) != 0 &&
                     strcmp(match, call->class->system) != 0)
                         continue;
 
                 if (sub && strcmp(sub, call->class->system) != 0)
                         continue;
 
-                if (event && strcmp(event, call->name) != 0)
+                if (event && strcmp(event, name) != 0)
                         continue;
 
                 ftrace_event_enable_disable(file, set);
@@ -669,7 +702,7 @@ static int t_show(struct seq_file *m, void *v)
 
         if (strcmp(call->class->system, TRACE_SYSTEM) != 0)
                 seq_printf(m, "%s:", call->class->system);
-        seq_printf(m, "%s\n", call->name);
+        seq_printf(m, "%s\n", ftrace_event_name(call));
 
         return 0;
 }
@@ -762,7 +795,7 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
         mutex_lock(&event_mutex);
         list_for_each_entry(file, &tr->events, list) {
                 call = file->event_call;
-                if (!call->name || !call->class || !call->class->reg)
+                if (!ftrace_event_name(call) || !call->class || !call->class->reg)
                         continue;
 
                 if (system && strcmp(call->class->system, system->name) != 0)
@@ -877,7 +910,7 @@ static int f_show(struct seq_file *m, void *v)
 
         switch ((unsigned long)v) {
         case FORMAT_HEADER:
-                seq_printf(m, "name: %s\n", call->name);
+                seq_printf(m, "name: %s\n", ftrace_event_name(call));
                 seq_printf(m, "ID: %d\n", call->event.type);
                 seq_printf(m, "format:\n");
                 return 0;
@@ -1497,6 +1530,7 @@ event_create_dir(struct dentry *parent, struct ftrace_event_file *file)
         struct trace_array *tr = file->tr;
         struct list_head *head;
         struct dentry *d_events;
+        const char *name;
         int ret;
 
         /*
@@ -1510,10 +1544,11 @@ event_create_dir(struct dentry *parent, struct ftrace_event_file *file)
         } else
                 d_events = parent;
 
-        file->dir = debugfs_create_dir(call->name, d_events);
+        name = ftrace_event_name(call);
+        file->dir = debugfs_create_dir(name, d_events);
         if (!file->dir) {
                 pr_warning("Could not create debugfs '%s' directory\n",
-                           call->name);
+                           name);
                 return -1;
         }
 
@@ -1537,7 +1572,7 @@ event_create_dir(struct dentry *parent, struct ftrace_event_file *file)
                 ret = call->class->define_fields(call);
                 if (ret < 0) {
                         pr_warning("Could not initialize trace point"
-                                   " events/%s\n", call->name);
+                                   " events/%s\n", name);
                         return -1;
                 }
         }
@@ -1601,15 +1636,17 @@ static void event_remove(struct ftrace_event_call *call)
 static int event_init(struct ftrace_event_call *call)
 {
         int ret = 0;
+        const char *name;
 
-        if (WARN_ON(!call->name))
+        name = ftrace_event_name(call);
+        if (WARN_ON(!name))
                 return -EINVAL;
 
         if (call->class->raw_init) {
                 ret = call->class->raw_init(call);
                 if (ret < 0 && ret != -ENOSYS)
                         pr_warn("Could not initialize trace events/%s\n",
-                                call->name);
+                                name);
         }
 
         return ret;
@@ -1855,7 +1892,7 @@ __trace_add_event_dirs(struct trace_array *tr)
                 ret = __trace_add_new_event(call, tr);
                 if (ret < 0)
                         pr_warning("Could not create directory for event %s\n",
-                                   call->name);
+                                   ftrace_event_name(call));
         }
 }
 
@@ -1864,18 +1901,20 @@ find_event_file(struct trace_array *tr, const char *system,  const char *event)
 {
         struct ftrace_event_file *file;
         struct ftrace_event_call *call;
+        const char *name;
 
         list_for_each_entry(file, &tr->events, list) {
 
                 call = file->event_call;
+                name = ftrace_event_name(call);
 
-                if (!call->name || !call->class || !call->class->reg)
+                if (!name || !call->class || !call->class->reg)
                         continue;
 
                 if (call->flags & TRACE_EVENT_FL_IGNORE_ENABLE)
                         continue;
 
-                if (strcmp(event, call->name) == 0 &&
+                if (strcmp(event, name) == 0 &&
                     strcmp(system, call->class->system) == 0)
                         return file;
         }
@@ -1943,7 +1982,7 @@ event_enable_print(struct seq_file *m, unsigned long ip,
         seq_printf(m, "%s:%s:%s",
                    data->enable ? ENABLE_EVENT_STR : DISABLE_EVENT_STR,
                    data->file->event_call->class->system,
-                   data->file->event_call->name);
+                   ftrace_event_name(data->file->event_call));
 
         if (data->count == -1)
                 seq_printf(m, ":unlimited\n");
@@ -2163,7 +2202,7 @@ __trace_early_add_event_dirs(struct trace_array *tr)
                 ret = event_create_dir(tr->event_dir, file);
                 if (ret < 0)
                         pr_warning("Could not create directory for event %s\n",
-                                   file->event_call->name);
+                                   ftrace_event_name(file->event_call));
         }
 }
 
@@ -2187,7 +2226,7 @@ __trace_early_add_events(struct trace_array *tr)
                 ret = __trace_early_add_new_event(call, tr);
                 if (ret < 0)
                         pr_warning("Could not create early event %s\n",
-                                   call->name);
+                                   ftrace_event_name(call));
         }
 }
 
@@ -2519,7 +2558,7 @@ static __init void event_trace_self_tests(void)
                         continue;
 #endif
 
-                pr_info("Testing event %s: ", call->name);
+                pr_info("Testing event %s: ", ftrace_event_name(call));
 
                 /*
                  * If an event is already enabled, someone is using
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 8efbb69b04f0..925f537f07d1 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1095,7 +1095,7 @@ event_enable_trigger_print(struct seq_file *m, struct event_trigger_ops *ops,
         seq_printf(m, "%s:%s:%s",
                    enable_data->enable ? ENABLE_EVENT_STR : DISABLE_EVENT_STR,
                    enable_data->file->event_call->class->system,
-                   enable_data->file->event_call->name);
+                   ftrace_event_name(enable_data->file->event_call));
 
         if (data->count == -1)
                 seq_puts(m, ":unlimited");
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index ee0a5098ac43..d4ddde28a81a 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -173,9 +173,11 @@ struct ftrace_event_class __refdata event_class_ftrace_##call = {	\
 };                                                                      \
                                                                         \
 struct ftrace_event_call __used event_##call = {                        \
-        .name                   = #call,                                \
-        .event.type             = etype,                                \
         .class                  = &event_class_ftrace_##call,           \
+        {                                                               \
+                .name                   = #call,                        \
+        },                                                              \
+        .event.type             = etype,                                \
         .print_fmt              = print,                                \
         .flags                  = TRACE_EVENT_FL_IGNORE_ENABLE | TRACE_EVENT_FL_USE_CALL_FILTER, \
 };                                                                      \
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index 38fe1483c508..ffd56351b521 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -13,32 +13,110 @@
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 
 #include "trace.h"
 
-/* function tracing enabled */
-static int                      ftrace_function_enabled;
+static void tracing_start_function_trace(struct trace_array *tr);
+static void tracing_stop_function_trace(struct trace_array *tr);
+static void
+function_trace_call(unsigned long ip, unsigned long parent_ip,
+                    struct ftrace_ops *op, struct pt_regs *pt_regs);
+static void
+function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
+                          struct ftrace_ops *op, struct pt_regs *pt_regs);
+static struct ftrace_ops trace_ops;
+static struct ftrace_ops trace_stack_ops;
+static struct tracer_flags func_flags;
+
+/* Our option */
+enum {
+        TRACE_FUNC_OPT_STACK    = 0x1,
+};
+
+static int allocate_ftrace_ops(struct trace_array *tr)
+{
+        struct ftrace_ops *ops;
+
+        ops = kzalloc(sizeof(*ops), GFP_KERNEL);
+        if (!ops)
+                return -ENOMEM;
+
+        /* Currently only the non stack verision is supported */
+        ops->func = function_trace_call;
+        ops->flags = FTRACE_OPS_FL_RECURSION_SAFE;
 
-static struct trace_array       *func_trace;
+        tr->ops = ops;
+        ops->private = tr;
+        return 0;
+}
+
+
+int ftrace_create_function_files(struct trace_array *tr,
+                                 struct dentry *parent)
+{
+        int ret;
+
+        /*
+         * The top level array uses the "global_ops", and the files are
+         * created on boot up.
+         */
+        if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
+                return 0;
 
-static void tracing_start_function_trace(void);
-static void tracing_stop_function_trace(void);
+        ret = allocate_ftrace_ops(tr);
+        if (ret)
+                return ret;
+
+        ftrace_create_filter_files(tr->ops, parent);
+
+        return 0;
+}
+
+void ftrace_destroy_function_files(struct trace_array *tr)
+{
+        ftrace_destroy_filter_files(tr->ops);
+        kfree(tr->ops);
+        tr->ops = NULL;
+}
 
 static int function_trace_init(struct trace_array *tr)
 {
-        func_trace = tr;
+        struct ftrace_ops *ops;
+
+        if (tr->flags & TRACE_ARRAY_FL_GLOBAL) {
+                /* There's only one global tr */
+                if (!trace_ops.private) {
+                        trace_ops.private = tr;
+                        trace_stack_ops.private = tr;
+                }
+
+                if (func_flags.val & TRACE_FUNC_OPT_STACK)
+                        ops = &trace_stack_ops;
+                else
+                        ops = &trace_ops;
+                tr->ops = ops;
+        } else if (!tr->ops) {
+                /*
+                 * Instance trace_arrays get their ops allocated
+                 * at instance creation. Unless it failed
+                 * the allocation.
+                 */
+                return -ENOMEM;
+        }
+
         tr->trace_buffer.cpu = get_cpu();
         put_cpu();
 
         tracing_start_cmdline_record();
-        tracing_start_function_trace();
+        tracing_start_function_trace(tr);
         return 0;
 }
 
 static void function_trace_reset(struct trace_array *tr)
 {
-        tracing_stop_function_trace();
+        tracing_stop_function_trace(tr);
         tracing_stop_cmdline_record();
 }
 
@@ -47,25 +125,18 @@ static void function_trace_start(struct trace_array *tr)
         tracing_reset_online_cpus(&tr->trace_buffer);
 }
 
-/* Our option */
-enum {
-        TRACE_FUNC_OPT_STACK    = 0x1,
-};
-
-static struct tracer_flags func_flags;
-
 static void
 function_trace_call(unsigned long ip, unsigned long parent_ip,
                     struct ftrace_ops *op, struct pt_regs *pt_regs)
 {
-        struct trace_array *tr = func_trace;
+        struct trace_array *tr = op->private;
         struct trace_array_cpu *data;
         unsigned long flags;
         int bit;
         int cpu;
         int pc;
 
-        if (unlikely(!ftrace_function_enabled))
+        if (unlikely(!tr->function_enabled))
                 return;
 
         pc = preempt_count();
@@ -91,14 +162,14 @@ static void
 function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
                           struct ftrace_ops *op, struct pt_regs *pt_regs)
 {
-        struct trace_array *tr = func_trace;
+        struct trace_array *tr = op->private;
         struct trace_array_cpu *data;
         unsigned long flags;
         long disabled;
         int cpu;
         int pc;
 
-        if (unlikely(!ftrace_function_enabled))
+        if (unlikely(!tr->function_enabled))
                 return;
 
         /*
@@ -128,7 +199,6 @@ function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
         local_irq_restore(flags);
 }
 
-
 static struct ftrace_ops trace_ops __read_mostly =
 {
         .func = function_trace_call,
@@ -153,29 +223,21 @@ static struct tracer_flags func_flags = {
         .opts = func_opts
 };
 
-static void tracing_start_function_trace(void)
+static void tracing_start_function_trace(struct trace_array *tr)
 {
-        ftrace_function_enabled = 0;
-
-        if (func_flags.val & TRACE_FUNC_OPT_STACK)
-                register_ftrace_function(&trace_stack_ops);
-        else
-                register_ftrace_function(&trace_ops);
-
-        ftrace_function_enabled = 1;
+        tr->function_enabled = 0;
+        register_ftrace_function(tr->ops);
+        tr->function_enabled = 1;
 }
 
-static void tracing_stop_function_trace(void)
+static void tracing_stop_function_trace(struct trace_array *tr)
 {
-        ftrace_function_enabled = 0;
-
-        if (func_flags.val & TRACE_FUNC_OPT_STACK)
-                unregister_ftrace_function(&trace_stack_ops);
-        else
-                unregister_ftrace_function(&trace_ops);
+        tr->function_enabled = 0;
+        unregister_ftrace_function(tr->ops);
 }
 
-static int func_set_flag(u32 old_flags, u32 bit, int set)
+static int
+func_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         switch (bit) {
         case TRACE_FUNC_OPT_STACK:
@@ -183,12 +245,14 @@ static int func_set_flag(u32 old_flags, u32 bit, int set)
                 if (!!set == !!(func_flags.val & TRACE_FUNC_OPT_STACK))
                         break;
 
+                unregister_ftrace_function(tr->ops);
+
                 if (set) {
-                        unregister_ftrace_function(&trace_ops);
-                        register_ftrace_function(&trace_stack_ops);
+                        tr->ops = &trace_stack_ops;
+                        register_ftrace_function(tr->ops);
                 } else {
-                        unregister_ftrace_function(&trace_stack_ops);
-                        register_ftrace_function(&trace_ops);
+                        tr->ops = &trace_ops;
+                        register_ftrace_function(tr->ops);
                 }
 
                 break;
@@ -208,6 +272,7 @@ static struct tracer function_trace __tracer_data =
         .wait_pipe      = poll_wait_pipe,
         .flags          = &func_flags,
         .set_flag       = func_set_flag,
+        .allow_instances = true,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest       = trace_selftest_startup_function,
 #endif
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 0b99120d395c..deff11200261 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -1476,7 +1476,8 @@ void graph_trace_close(struct trace_iterator *iter)
         }
 }
 
-static int func_graph_set_flag(u32 old_flags, u32 bit, int set)
+static int
+func_graph_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         if (bit == TRACE_GRAPH_PRINT_IRQS)
                 ftrace_graph_skip_irqs = !set;
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 887ef88b0bc7..8ff02cbb892f 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -160,7 +160,8 @@ static struct ftrace_ops trace_ops __read_mostly =
 #endif /* CONFIG_FUNCTION_TRACER */
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-static int irqsoff_set_flag(u32 old_flags, u32 bit, int set)
+static int
+irqsoff_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         int cpu;
 
@@ -266,7 +267,8 @@ __trace_function(struct trace_array *tr,
 #else
 #define __trace_function trace_function
 
-static int irqsoff_set_flag(u32 old_flags, u32 bit, int set)
+static int
+irqsoff_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         return -EINVAL;
 }
@@ -570,8 +572,10 @@ static void irqsoff_function_set(int set)
                 unregister_irqsoff_function(is_graph());
 }
 
-static int irqsoff_flag_changed(struct tracer *tracer, u32 mask, int set)
+static int irqsoff_flag_changed(struct trace_array *tr, u32 mask, int set)
 {
+        struct tracer *tracer = tr->current_trace;
+
         if (mask & TRACE_ITER_FUNCTION)
                 irqsoff_function_set(set);
 
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index bdbae450c13e..903ae28962be 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -35,11 +35,6 @@ struct trace_kprobe {
         struct trace_probe      tp;
 };
 
-struct event_file_link {
-        struct ftrace_event_file        *file;
-        struct list_head                list;
-};
-
 #define SIZEOF_TRACE_KPROBE(n)                          \
         (offsetof(struct trace_kprobe, tp.args) +       \
         (sizeof(struct probe_arg) * (n)))
@@ -346,7 +341,7 @@ static struct trace_kprobe *find_trace_kprobe(const char *event,
         struct trace_kprobe *tk;
 
         list_for_each_entry(tk, &probe_list, list)
-                if (strcmp(tk->tp.call.name, event) == 0 &&
+                if (strcmp(ftrace_event_name(&tk->tp.call), event) == 0 &&
                     strcmp(tk->tp.call.class->system, group) == 0)
                         return tk;
         return NULL;
@@ -387,18 +382,6 @@ enable_trace_kprobe(struct trace_kprobe *tk, struct ftrace_event_file *file)
         return ret;
 }
 
-static struct event_file_link *
-find_event_file_link(struct trace_probe *tp, struct ftrace_event_file *file)
-{
-        struct event_file_link *link;
-
-        list_for_each_entry(link, &tp->files, list)
-                if (link->file == file)
-                        return link;
-
-        return NULL;
-}
-
 /*
  * Disable trace_probe
  * if the file is NULL, disable "perf" handler, or disable "trace" handler.
@@ -533,7 +516,8 @@ static int register_trace_kprobe(struct trace_kprobe *tk)
         mutex_lock(&probe_lock);
 
         /* Delete old (same name) event if exist */
-        old_tk = find_trace_kprobe(tk->tp.call.name, tk->tp.call.class->system);
+        old_tk = find_trace_kprobe(ftrace_event_name(&tk->tp.call),
+                        tk->tp.call.class->system);
         if (old_tk) {
                 ret = unregister_trace_kprobe(old_tk);
                 if (ret < 0)
@@ -581,7 +565,8 @@ static int trace_kprobe_module_callback(struct notifier_block *nb,
                         if (ret)
                                 pr_warning("Failed to re-register probe %s on"
                                            "%s: %d\n",
-                                           tk->tp.call.name, mod->name, ret);
+                                           ftrace_event_name(&tk->tp.call),
+                                           mod->name, ret);
                 }
         }
         mutex_unlock(&probe_lock);
@@ -835,7 +820,8 @@ static int probes_seq_show(struct seq_file *m, void *v)
         int i;
 
         seq_printf(m, "%c", trace_kprobe_is_return(tk) ? 'r' : 'p');
-        seq_printf(m, ":%s/%s", tk->tp.call.class->system, tk->tp.call.name);
+        seq_printf(m, ":%s/%s", tk->tp.call.class->system,
+                        ftrace_event_name(&tk->tp.call));
 
         if (!tk->symbol)
                 seq_printf(m, " 0x%p", tk->rp.kp.addr);
@@ -893,7 +879,8 @@ static int probes_profile_seq_show(struct seq_file *m, void *v)
 {
         struct trace_kprobe *tk = v;
 
-        seq_printf(m, "  %-44s %15lu %15lu\n", tk->tp.call.name, tk->nhit,
+        seq_printf(m, "  %-44s %15lu %15lu\n",
+                   ftrace_event_name(&tk->tp.call), tk->nhit,
                    tk->rp.kp.nmissed);
 
         return 0;
@@ -1028,7 +1015,7 @@ print_kprobe_event(struct trace_iterator *iter, int flags,
         field = (struct kprobe_trace_entry_head *)iter->ent;
         tp = container_of(event, struct trace_probe, call.event);
 
-        if (!trace_seq_printf(s, "%s: (", tp->call.name))
+        if (!trace_seq_printf(s, "%s: (", ftrace_event_name(&tp->call)))
                 goto partial;
 
         if (!seq_print_ip_sym(s, field->ip, flags | TRACE_ITER_SYM_OFFSET))
@@ -1064,7 +1051,7 @@ print_kretprobe_event(struct trace_iterator *iter, int flags,
         field = (struct kretprobe_trace_entry_head *)iter->ent;
         tp = container_of(event, struct trace_probe, call.event);
 
-        if (!trace_seq_printf(s, "%s: (", tp->call.name))
+        if (!trace_seq_printf(s, "%s: (", ftrace_event_name(&tp->call)))
                 goto partial;
 
         if (!seq_print_ip_sym(s, field->ret_ip, flags | TRACE_ITER_SYM_OFFSET))
@@ -1303,7 +1290,8 @@ static int register_kprobe_event(struct trace_kprobe *tk)
         call->data = tk;
         ret = trace_add_event_call(call);
         if (ret) {
-                pr_info("Failed to register kprobe event: %s\n", call->name);
+                pr_info("Failed to register kprobe event: %s\n",
+                        ftrace_event_name(call));
                 kfree(call->print_fmt);
                 unregister_ftrace_event(&call->event);
         }
diff --git a/kernel/trace/trace_nop.c b/kernel/trace/trace_nop.c
index 394f94417e2f..69a5cc94c01a 100644
--- a/kernel/trace/trace_nop.c
+++ b/kernel/trace/trace_nop.c
@@ -62,7 +62,7 @@ static void nop_trace_reset(struct trace_array *tr)
  * If you don't implement it, then the flag setting will be
  * automatically accepted.
  */
-static int nop_set_flag(u32 old_flags, u32 bit, int set)
+static int nop_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         /*
          * Note that you don't need to update nop_flags.val yourself.
@@ -96,6 +96,7 @@ struct tracer nop_trace __read_mostly =
         .selftest       = trace_selftest_startup_nop,
 #endif
         .flags          = &nop_flags,
-        .set_flag       = nop_set_flag
+        .set_flag       = nop_set_flag,
+        .allow_instances = true,
 };
 
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index ed32284fbe32..a436de18aa99 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -431,7 +431,7 @@ int ftrace_raw_output_prep(struct trace_iterator *iter,
         }
 
         trace_seq_init(p);
-        ret = trace_seq_printf(s, "%s: ", event->name);
+        ret = trace_seq_printf(s, "%s: ", ftrace_event_name(event));
         if (!ret)
                 return TRACE_TYPE_PARTIAL_LINE;
 
@@ -439,6 +439,37 @@ int ftrace_raw_output_prep(struct trace_iterator *iter,
 }
 EXPORT_SYMBOL(ftrace_raw_output_prep);
 
+static int ftrace_output_raw(struct trace_iterator *iter, char *name,
+                             char *fmt, va_list ap)
+{
+        struct trace_seq *s = &iter->seq;
+        int ret;
+
+        ret = trace_seq_printf(s, "%s: ", name);
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+
+        ret = trace_seq_vprintf(s, fmt, ap);
+
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+
+        return TRACE_TYPE_HANDLED;
+}
+
+int ftrace_output_call(struct trace_iterator *iter, char *name, char *fmt, ...)
+{
+        va_list ap;
+        int ret;
+
+        va_start(ap, fmt);
+        ret = ftrace_output_raw(iter, name, fmt, ap);
+        va_end(ap);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ftrace_output_call);
+
 #ifdef CONFIG_KRETPROBES
 static inline const char *kretprobed(const char *name)
 {
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index b73574a5f429..fb1ab5dfbd42 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -288,6 +288,11 @@ struct trace_probe {
         struct probe_arg                args[];
 };
 
+struct event_file_link {
+        struct ftrace_event_file        *file;
+        struct list_head                list;
+};
+
 static inline bool trace_probe_is_enabled(struct trace_probe *tp)
 {
         return !!(tp->flags & (TP_FLAG_TRACE | TP_FLAG_PROFILE));
@@ -316,6 +321,18 @@ static inline int is_good_name(const char *name)
         return 1;
 }
 
+static inline struct event_file_link *
+find_event_file_link(struct trace_probe *tp, struct ftrace_event_file *file)
+{
+        struct event_file_link *link;
+
+        list_for_each_entry(link, &tp->files, list)
+                if (link->file == file)
+                        return link;
+
+        return NULL;
+}
+
 extern int traceprobe_parse_probe_arg(char *arg, ssize_t *size,
                    struct probe_arg *parg, bool is_return, bool is_kprobe);
 
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index 6e32635e5e57..e14da5e97a69 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -179,8 +179,10 @@ static void wakeup_function_set(int set)
                 unregister_wakeup_function(is_graph());
 }
 
-static int wakeup_flag_changed(struct tracer *tracer, u32 mask, int set)
+static int wakeup_flag_changed(struct trace_array *tr, u32 mask, int set)
 {
+        struct tracer *tracer = tr->current_trace;
+
         if (mask & TRACE_ITER_FUNCTION)
                 wakeup_function_set(set);
 
@@ -209,7 +211,8 @@ static void stop_func_tracer(int graph)
 }
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-static int wakeup_set_flag(u32 old_flags, u32 bit, int set)
+static int
+wakeup_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
 
         if (!(bit & TRACE_DISPLAY_GRAPH))
@@ -311,7 +314,8 @@ __trace_function(struct trace_array *tr,
 #else
 #define __trace_function trace_function
 
-static int wakeup_set_flag(u32 old_flags, u32 bit, int set)
+static int
+wakeup_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
         return -EINVAL;
 }
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index e6be585cf06a..21b320e5d163 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -13,6 +13,7 @@
 #include <linux/sysctl.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/magic.h>
 
 #include <asm/setup.h>
 
@@ -144,6 +145,8 @@ check_stack(unsigned long ip, unsigned long *stack)
                         i++;
         }
 
+        BUG_ON(current != &init_task &&
+                *(end_of_stack(current)) != STACK_END_MAGIC);
  out:
         arch_spin_unlock(&max_stack_lock);
         local_irq_restore(flags);
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 79e52d93860b..c082a7441345 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -260,6 +260,7 @@ alloc_trace_uprobe(const char *group, const char *event, int nargs, bool is_ret)
                 goto error;
 
         INIT_LIST_HEAD(&tu->list);
+        INIT_LIST_HEAD(&tu->tp.files);
         tu->consumer.handler = uprobe_dispatcher;
         if (is_ret)
                 tu->consumer.ret_handler = uretprobe_dispatcher;
@@ -293,7 +294,7 @@ static struct trace_uprobe *find_probe_event(const char *event, const char *grou
         struct trace_uprobe *tu;
 
         list_for_each_entry(tu, &uprobe_list, list)
-                if (strcmp(tu->tp.call.name, event) == 0 &&
+                if (strcmp(ftrace_event_name(&tu->tp.call), event) == 0 &&
                     strcmp(tu->tp.call.class->system, group) == 0)
                         return tu;
 
@@ -323,7 +324,8 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
         mutex_lock(&uprobe_lock);
 
         /* register as an event */
-        old_tu = find_probe_event(tu->tp.call.name, tu->tp.call.class->system);
+        old_tu = find_probe_event(ftrace_event_name(&tu->tp.call),
+                        tu->tp.call.class->system);
         if (old_tu) {
                 /* delete old event */
                 ret = unregister_trace_uprobe(old_tu);
@@ -598,7 +600,8 @@ static int probes_seq_show(struct seq_file *m, void *v)
         char c = is_ret_probe(tu) ? 'r' : 'p';
         int i;
 
-        seq_printf(m, "%c:%s/%s", c, tu->tp.call.class->system, tu->tp.call.name);
+        seq_printf(m, "%c:%s/%s", c, tu->tp.call.class->system,
+                        ftrace_event_name(&tu->tp.call));
         seq_printf(m, " %s:0x%p", tu->filename, (void *)tu->offset);
 
         for (i = 0; i < tu->tp.nr_args; i++)
@@ -648,7 +651,8 @@ static int probes_profile_seq_show(struct seq_file *m, void *v)
 {
         struct trace_uprobe *tu = v;
 
-        seq_printf(m, "  %s %-44s %15lu\n", tu->filename, tu->tp.call.name, tu->nhit);
+        seq_printf(m, "  %s %-44s %15lu\n", tu->filename,
+                        ftrace_event_name(&tu->tp.call), tu->nhit);
         return 0;
 }
 
@@ -728,9 +732,15 @@ static int uprobe_buffer_enable(void)
 
 static void uprobe_buffer_disable(void)
 {
+        int cpu;
+
         BUG_ON(!mutex_is_locked(&event_mutex));
 
         if (--uprobe_buffer_refcnt == 0) {
+                for_each_possible_cpu(cpu)
+                        free_page((unsigned long)per_cpu_ptr(uprobe_cpu_buffer,
+                                                             cpu)->buf);
+
                 free_percpu(uprobe_cpu_buffer);
                 uprobe_cpu_buffer = NULL;
         }
@@ -758,31 +768,32 @@ static void uprobe_buffer_put(struct uprobe_cpu_buffer *ucb)
         mutex_unlock(&ucb->mutex);
 }
 
-static void uprobe_trace_print(struct trace_uprobe *tu,
-                                unsigned long func, struct pt_regs *regs)
+static void __uprobe_trace_func(struct trace_uprobe *tu,
+                                unsigned long func, struct pt_regs *regs,
+                                struct uprobe_cpu_buffer *ucb, int dsize,
+                                struct ftrace_event_file *ftrace_file)
 {
         struct uprobe_trace_entry_head *entry;
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
-        struct uprobe_cpu_buffer *ucb;
         void *data;
-        int size, dsize, esize;
+        int size, esize;
         struct ftrace_event_call *call = &tu->tp.call;
 
-        dsize = __get_data_size(&tu->tp, regs);
-        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
+        WARN_ON(call != ftrace_file->event_call);
 
-        if (WARN_ON_ONCE(!uprobe_cpu_buffer || tu->tp.size + dsize > PAGE_SIZE))
+        if (WARN_ON_ONCE(tu->tp.size + dsize > PAGE_SIZE))
                 return;
 
-        ucb = uprobe_buffer_get();
-        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
+        if (ftrace_trigger_soft_disabled(ftrace_file))
+                return;
 
+        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
         size = esize + tu->tp.size + dsize;
-        event = trace_current_buffer_lock_reserve(&buffer, call->event.type,
-                                                  size, 0, 0);
+        event = trace_event_buffer_lock_reserve(&buffer, ftrace_file,
+                                                call->event.type, size, 0, 0);
         if (!event)
-                goto out;
+                return;
 
         entry = ring_buffer_event_data(event);
         if (is_ret_probe(tu)) {
@@ -796,25 +807,36 @@ static void uprobe_trace_print(struct trace_uprobe *tu,
 
         memcpy(data, ucb->buf, tu->tp.size + dsize);
 
-        if (!call_filter_check_discard(call, entry, buffer, event))
-                trace_buffer_unlock_commit(buffer, event, 0, 0);
-
-out:
-        uprobe_buffer_put(ucb);
+        event_trigger_unlock_commit(ftrace_file, buffer, event, entry, 0, 0);
 }
 
 /* uprobe handler */
-static int uprobe_trace_func(struct trace_uprobe *tu, struct pt_regs *regs)
+static int uprobe_trace_func(struct trace_uprobe *tu, struct pt_regs *regs,
+                             struct uprobe_cpu_buffer *ucb, int dsize)
 {
-        if (!is_ret_probe(tu))
-                uprobe_trace_print(tu, 0, regs);
+        struct event_file_link *link;
+
+        if (is_ret_probe(tu))
+                return 0;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(link, &tu->tp.files, list)
+                __uprobe_trace_func(tu, 0, regs, ucb, dsize, link->file);
+        rcu_read_unlock();
+
         return 0;
 }
 
 static void uretprobe_trace_func(struct trace_uprobe *tu, unsigned long func,
-                                struct pt_regs *regs)
+                                 struct pt_regs *regs,
+                                 struct uprobe_cpu_buffer *ucb, int dsize)
 {
-        uprobe_trace_print(tu, func, regs);
+        struct event_file_link *link;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(link, &tu->tp.files, list)
+                __uprobe_trace_func(tu, func, regs, ucb, dsize, link->file);
+        rcu_read_unlock();
 }
 
 /* Event entry printers */
@@ -831,12 +853,14 @@ print_uprobe_event(struct trace_iterator *iter, int flags, struct trace_event *e
         tu = container_of(event, struct trace_uprobe, tp.call.event);
 
         if (is_ret_probe(tu)) {
-                if (!trace_seq_printf(s, "%s: (0x%lx <- 0x%lx)", tu->tp.call.name,
+                if (!trace_seq_printf(s, "%s: (0x%lx <- 0x%lx)",
+                                        ftrace_event_name(&tu->tp.call),
                                         entry->vaddr[1], entry->vaddr[0]))
                         goto partial;
                 data = DATAOF_TRACE_ENTRY(entry, true);
         } else {
-                if (!trace_seq_printf(s, "%s: (0x%lx)", tu->tp.call.name,
+                if (!trace_seq_printf(s, "%s: (0x%lx)",
+                                        ftrace_event_name(&tu->tp.call),
                                         entry->vaddr[0]))
                         goto partial;
                 data = DATAOF_TRACE_ENTRY(entry, false);
@@ -861,12 +885,24 @@ typedef bool (*filter_func_t)(struct uprobe_consumer *self,
                                 struct mm_struct *mm);
 
 static int
-probe_event_enable(struct trace_uprobe *tu, int flag, filter_func_t filter)
+probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
+                   filter_func_t filter)
 {
-        int ret = 0;
+        bool enabled = trace_probe_is_enabled(&tu->tp);
+        struct event_file_link *link = NULL;
+        int ret;
+
+        if (file) {
+                link = kmalloc(sizeof(*link), GFP_KERNEL);
+                if (!link)
+                        return -ENOMEM;
 
-        if (trace_probe_is_enabled(&tu->tp))
-                return -EINTR;
+                link->file = file;
+                list_add_tail_rcu(&link->list, &tu->tp.files);
+
+                tu->tp.flags |= TP_FLAG_TRACE;
+        } else
+                tu->tp.flags |= TP_FLAG_PROFILE;
 
         ret = uprobe_buffer_enable();
         if (ret < 0)
@@ -874,24 +910,49 @@ probe_event_enable(struct trace_uprobe *tu, int flag, filter_func_t filter)
 
         WARN_ON(!uprobe_filter_is_empty(&tu->filter));
 
-        tu->tp.flags |= flag;
+        if (enabled)
+                return 0;
+
         tu->consumer.filter = filter;
         ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
-        if (ret)
-                tu->tp.flags &= ~flag;
+        if (ret) {
+                if (file) {
+                        list_del(&link->list);
+                        kfree(link);
+                        tu->tp.flags &= ~TP_FLAG_TRACE;
+                } else
+                        tu->tp.flags &= ~TP_FLAG_PROFILE;
+        }
 
         return ret;
 }
 
-static void probe_event_disable(struct trace_uprobe *tu, int flag)
+static void
+probe_event_disable(struct trace_uprobe *tu, struct ftrace_event_file *file)
 {
         if (!trace_probe_is_enabled(&tu->tp))
                 return;
 
+        if (file) {
+                struct event_file_link *link;
+
+                link = find_event_file_link(&tu->tp, file);
+                if (!link)
+                        return;
+
+                list_del_rcu(&link->list);
+                /* synchronize with u{,ret}probe_trace_func */
+                synchronize_sched();
+                kfree(link);
+
+                if (!list_empty(&tu->tp.files))
+                        return;
+        }
+
         WARN_ON(!uprobe_filter_is_empty(&tu->filter));
 
         uprobe_unregister(tu->inode, tu->offset, &tu->consumer);
-        tu->tp.flags &= ~flag;
+        tu->tp.flags &= file ? ~TP_FLAG_TRACE : ~TP_FLAG_PROFILE;
 
         uprobe_buffer_disable();
 }
@@ -1014,31 +1075,24 @@ static bool uprobe_perf_filter(struct uprobe_consumer *uc,
         return ret;
 }
 
-static void uprobe_perf_print(struct trace_uprobe *tu,
-                                unsigned long func, struct pt_regs *regs)
+static void __uprobe_perf_func(struct trace_uprobe *tu,
+                               unsigned long func, struct pt_regs *regs,
+                               struct uprobe_cpu_buffer *ucb, int dsize)
 {
         struct ftrace_event_call *call = &tu->tp.call;
         struct uprobe_trace_entry_head *entry;
         struct hlist_head *head;
-        struct uprobe_cpu_buffer *ucb;
         void *data;
-        int size, dsize, esize;
+        int size, esize;
         int rctx;
 
-        dsize = __get_data_size(&tu->tp, regs);
         esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
 
-        if (WARN_ON_ONCE(!uprobe_cpu_buffer))
-                return;
-
         size = esize + tu->tp.size + dsize;
         size = ALIGN(size + sizeof(u32), sizeof(u64)) - sizeof(u32);
         if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE, "profile buffer not large enough"))
                 return;
 
-        ucb = uprobe_buffer_get();
-        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
-
         preempt_disable();
         head = this_cpu_ptr(call->perf_events);
         if (hlist_empty(head))
@@ -1068,46 +1122,49 @@ static void uprobe_perf_print(struct trace_uprobe *tu,
         perf_trace_buf_submit(entry, size, rctx, 0, 1, regs, head, NULL);
  out:
         preempt_enable();
-        uprobe_buffer_put(ucb);
 }
 
 /* uprobe profile handler */
-static int uprobe_perf_func(struct trace_uprobe *tu, struct pt_regs *regs)
+static int uprobe_perf_func(struct trace_uprobe *tu, struct pt_regs *regs,
+                            struct uprobe_cpu_buffer *ucb, int dsize)
 {
         if (!uprobe_perf_filter(&tu->consumer, 0, current->mm))
                 return UPROBE_HANDLER_REMOVE;
 
         if (!is_ret_probe(tu))
-                uprobe_perf_print(tu, 0, regs);
+                __uprobe_perf_func(tu, 0, regs, ucb, dsize);
         return 0;
 }
 
 static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
-                                struct pt_regs *regs)
+                                struct pt_regs *regs,
+                                struct uprobe_cpu_buffer *ucb, int dsize)
 {
-        uprobe_perf_print(tu, func, regs);
+        __uprobe_perf_func(tu, func, regs, ucb, dsize);
 }
 #endif  /* CONFIG_PERF_EVENTS */
 
-static
-int trace_uprobe_register(struct ftrace_event_call *event, enum trace_reg type, void *data)
+static int
+trace_uprobe_register(struct ftrace_event_call *event, enum trace_reg type,
+                      void *data)
 {
         struct trace_uprobe *tu = event->data;
+        struct ftrace_event_file *file = data;
 
         switch (type) {
         case TRACE_REG_REGISTER:
-                return probe_event_enable(tu, TP_FLAG_TRACE, NULL);
+                return probe_event_enable(tu, file, NULL);
 
         case TRACE_REG_UNREGISTER:
-                probe_event_disable(tu, TP_FLAG_TRACE);
+                probe_event_disable(tu, file);
                 return 0;
 
 #ifdef CONFIG_PERF_EVENTS
         case TRACE_REG_PERF_REGISTER:
-                return probe_event_enable(tu, TP_FLAG_PROFILE, uprobe_perf_filter);
+                return probe_event_enable(tu, NULL, uprobe_perf_filter);
 
         case TRACE_REG_PERF_UNREGISTER:
-                probe_event_disable(tu, TP_FLAG_PROFILE);
+                probe_event_disable(tu, NULL);
                 return 0;
 
         case TRACE_REG_PERF_OPEN:
@@ -1127,8 +1184,11 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs)
 {
         struct trace_uprobe *tu;
         struct uprobe_dispatch_data udd;
+        struct uprobe_cpu_buffer *ucb;
+        int dsize, esize;
         int ret = 0;
 
+
         tu = container_of(con, struct trace_uprobe, consumer);
         tu->nhit++;
 
@@ -1137,13 +1197,29 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs)
 
         current->utask->vaddr = (unsigned long) &udd;
 
+#ifdef CONFIG_PERF_EVENTS
+        if ((tu->tp.flags & TP_FLAG_TRACE) == 0 &&
+            !uprobe_perf_filter(&tu->consumer, 0, current->mm))
+                return UPROBE_HANDLER_REMOVE;
+#endif
+
+        if (WARN_ON_ONCE(!uprobe_cpu_buffer))
+                return 0;
+
+        dsize = __get_data_size(&tu->tp, regs);
+        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
+
+        ucb = uprobe_buffer_get();
+        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
+
         if (tu->tp.flags & TP_FLAG_TRACE)
-                ret |= uprobe_trace_func(tu, regs);
+                ret |= uprobe_trace_func(tu, regs, ucb, dsize);
 
 #ifdef CONFIG_PERF_EVENTS
         if (tu->tp.flags & TP_FLAG_PROFILE)
-                ret |= uprobe_perf_func(tu, regs);
+                ret |= uprobe_perf_func(tu, regs, ucb, dsize);
 #endif
+        uprobe_buffer_put(ucb);
         return ret;
 }
 
@@ -1152,6 +1228,8 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con,
 {
         struct trace_uprobe *tu;
         struct uprobe_dispatch_data udd;
+        struct uprobe_cpu_buffer *ucb;
+        int dsize, esize;
 
         tu = container_of(con, struct trace_uprobe, consumer);
 
@@ -1160,13 +1238,23 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con,
 
         current->utask->vaddr = (unsigned long) &udd;
 
+        if (WARN_ON_ONCE(!uprobe_cpu_buffer))
+                return 0;
+
+        dsize = __get_data_size(&tu->tp, regs);
+        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
+
+        ucb = uprobe_buffer_get();
+        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
+
         if (tu->tp.flags & TP_FLAG_TRACE)
-                uretprobe_trace_func(tu, func, regs);
+                uretprobe_trace_func(tu, func, regs, ucb, dsize);
 
 #ifdef CONFIG_PERF_EVENTS
         if (tu->tp.flags & TP_FLAG_PROFILE)
-                uretprobe_perf_func(tu, func, regs);
+                uretprobe_perf_func(tu, func, regs, ucb, dsize);
 #endif
+        uprobe_buffer_put(ucb);
         return 0;
 }
 
@@ -1198,7 +1286,8 @@ static int register_uprobe_event(struct trace_uprobe *tu)
         ret = trace_add_event_call(call);
 
         if (ret) {
-                pr_info("Failed to register uprobe event: %s\n", call->name);
+                pr_info("Failed to register uprobe event: %s\n",
+                        ftrace_event_name(call));
                 kfree(call->print_fmt);
                 unregister_ftrace_event(&call->event);
         }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 031cc5655a51..ac5b23cf7212 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Mathieu Desnoyers
+ * Copyright (C) 2008-2014 Mathieu Desnoyers
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -33,43 +33,29 @@ extern struct tracepoint * const __stop___tracepoints_ptrs[];
 /* Set to 1 to enable tracepoint debug output */
 static const int tracepoint_debug;
 
+#ifdef CONFIG_MODULES
 /*
- * Tracepoints mutex protects the builtin and module tracepoints and the hash
- * table, as well as the local module list.
+ * Tracepoint module list mutex protects the local module list.
  */
-static DEFINE_MUTEX(tracepoints_mutex);
+static DEFINE_MUTEX(tracepoint_module_list_mutex);
 
-#ifdef CONFIG_MODULES
-/* Local list of struct module */
+/* Local list of struct tp_module */
 static LIST_HEAD(tracepoint_module_list);
 #endif /* CONFIG_MODULES */
 
 /*
- * Tracepoint hash table, containing the active tracepoints.
- * Protected by tracepoints_mutex.
+ * tracepoints_mutex protects the builtin and module tracepoints.
+ * tracepoints_mutex nests inside tracepoint_module_list_mutex.
  */
-#define TRACEPOINT_HASH_BITS 6
-#define TRACEPOINT_TABLE_SIZE (1 << TRACEPOINT_HASH_BITS)
-static struct hlist_head tracepoint_table[TRACEPOINT_TABLE_SIZE];
+static DEFINE_MUTEX(tracepoints_mutex);
 
 /*
  * Note about RCU :
  * It is used to delay the free of multiple probes array until a quiescent
  * state is reached.
- * Tracepoint entries modifications are protected by the tracepoints_mutex.
  */
-struct tracepoint_entry {
-        struct hlist_node hlist;
-        struct tracepoint_func *funcs;
-        int refcount;   /* Number of times armed. 0 if disarmed. */
-        char name[0];
-};
-
 struct tp_probes {
-        union {
-                struct rcu_head rcu;
-                struct list_head list;
-        } u;
+        struct rcu_head rcu;
         struct tracepoint_func probes[0];
 };
 
@@ -82,7 +68,7 @@ static inline void *allocate_probes(int count)
 
 static void rcu_free_old_probes(struct rcu_head *head)
 {
-        kfree(container_of(head, struct tp_probes, u.rcu));
+        kfree(container_of(head, struct tp_probes, rcu));
 }
 
 static inline void release_probes(struct tracepoint_func *old)
@@ -90,38 +76,37 @@ static inline void release_probes(struct tracepoint_func *old)
         if (old) {
                 struct tp_probes *tp_probes = container_of(old,
                         struct tp_probes, probes[0]);
-                call_rcu_sched(&tp_probes->u.rcu, rcu_free_old_probes);
+                call_rcu_sched(&tp_probes->rcu, rcu_free_old_probes);
         }
 }
 
-static void debug_print_probes(struct tracepoint_entry *entry)
+static void debug_print_probes(struct tracepoint_func *funcs)
 {
         int i;
 
-        if (!tracepoint_debug || !entry->funcs)
+        if (!tracepoint_debug || !funcs)
                 return;
 
-        for (i = 0; entry->funcs[i].func; i++)
-                printk(KERN_DEBUG "Probe %d : %p\n", i, entry->funcs[i].func);
+        for (i = 0; funcs[i].func; i++)
+                printk(KERN_DEBUG "Probe %d : %p\n", i, funcs[i].func);
 }
 
-static struct tracepoint_func *
-tracepoint_entry_add_probe(struct tracepoint_entry *entry,
-                           void *probe, void *data)
+static struct tracepoint_func *func_add(struct tracepoint_func **funcs,
+                struct tracepoint_func *tp_func)
 {
         int nr_probes = 0;
         struct tracepoint_func *old, *new;
 
-        if (WARN_ON(!probe))
+        if (WARN_ON(!tp_func->func))
                 return ERR_PTR(-EINVAL);
 
-        debug_print_probes(entry);
-        old = entry->funcs;
+        debug_print_probes(*funcs);
+        old = *funcs;
         if (old) {
                 /* (N -> N+1), (N != 0, 1) probes */
                 for (nr_probes = 0; old[nr_probes].func; nr_probes++)
-                        if (old[nr_probes].func == probe &&
-                            old[nr_probes].data == data)
+                        if (old[nr_probes].func == tp_func->func &&
+                            old[nr_probes].data == tp_func->data)
                                 return ERR_PTR(-EEXIST);
         }
         /* + 2 : one for new probe, one for NULL func */
@@ -130,33 +115,30 @@ tracepoint_entry_add_probe(struct tracepoint_entry *entry,
                 return ERR_PTR(-ENOMEM);
         if (old)
                 memcpy(new, old, nr_probes * sizeof(struct tracepoint_func));
-        new[nr_probes].func = probe;
-        new[nr_probes].data = data;
+        new[nr_probes] = *tp_func;
         new[nr_probes + 1].func = NULL;
-        entry->refcount = nr_probes + 1;
-        entry->funcs = new;
-        debug_print_probes(entry);
+        *funcs = new;
+        debug_print_probes(*funcs);
         return old;
 }
 
-static void *
-tracepoint_entry_remove_probe(struct tracepoint_entry *entry,
-                              void *probe, void *data)
+static void *func_remove(struct tracepoint_func **funcs,
+                struct tracepoint_func *tp_func)
 {
         int nr_probes = 0, nr_del = 0, i;
         struct tracepoint_func *old, *new;
 
-        old = entry->funcs;
+        old = *funcs;
 
         if (!old)
                 return ERR_PTR(-ENOENT);
 
-        debug_print_probes(entry);
+        debug_print_probes(*funcs);
         /* (N -> M), (N > 1, M >= 0) probes */
-        if (probe) {
+        if (tp_func->func) {
                 for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
-                        if (old[nr_probes].func == probe &&
-                             old[nr_probes].data == data)
+                        if (old[nr_probes].func == tp_func->func &&
+                             old[nr_probes].data == tp_func->data)
                                 nr_del++;
                 }
         }
@@ -167,9 +149,8 @@ tracepoint_entry_remove_probe(struct tracepoint_entry *entry,
          */
         if (nr_probes - nr_del == 0) {
                 /* N -> 0, (N > 1) */
-                entry->funcs = NULL;
-                entry->refcount = 0;
-                debug_print_probes(entry);
+                *funcs = NULL;
+                debug_print_probes(*funcs);
                 return old;
         } else {
                 int j = 0;
@@ -179,90 +160,35 @@ tracepoint_entry_remove_probe(struct tracepoint_entry *entry,
                 if (new == NULL)
                         return ERR_PTR(-ENOMEM);
                 for (i = 0; old[i].func; i++)
-                        if (old[i].func != probe || old[i].data != data)
+                        if (old[i].func != tp_func->func
+                                        || old[i].data != tp_func->data)
                                 new[j++] = old[i];
                 new[nr_probes - nr_del].func = NULL;
-                entry->refcount = nr_probes - nr_del;
-                entry->funcs = new;
+                *funcs = new;
         }
-        debug_print_probes(entry);
+        debug_print_probes(*funcs);
         return old;
 }
 
 /*
- * Get tracepoint if the tracepoint is present in the tracepoint hash table.
- * Must be called with tracepoints_mutex held.
- * Returns NULL if not present.
+ * Add the probe function to a tracepoint.
  */
-static struct tracepoint_entry *get_tracepoint(const char *name)
+static int tracepoint_add_func(struct tracepoint *tp,
+                struct tracepoint_func *func)
 {
-        struct hlist_head *head;
-        struct tracepoint_entry *e;
-        u32 hash = jhash(name, strlen(name), 0);
-
-        head = &tracepoint_table[hash & (TRACEPOINT_TABLE_SIZE - 1)];
-        hlist_for_each_entry(e, head, hlist) {
-                if (!strcmp(name, e->name))
-                        return e;
-        }
-        return NULL;
-}
+        struct tracepoint_func *old, *tp_funcs;
 
-/*
- * Add the tracepoint to the tracepoint hash table. Must be called with
- * tracepoints_mutex held.
- */
-static struct tracepoint_entry *add_tracepoint(const char *name)
-{
-        struct hlist_head *head;
-        struct tracepoint_entry *e;
-        size_t name_len = strlen(name) + 1;
-        u32 hash = jhash(name, name_len-1, 0);
-
-        head = &tracepoint_table[hash & (TRACEPOINT_TABLE_SIZE - 1)];
-        hlist_for_each_entry(e, head, hlist) {
-                if (!strcmp(name, e->name)) {
-                        printk(KERN_NOTICE
-                                "tracepoint %s busy\n", name);
-                        return ERR_PTR(-EEXIST);        /* Already there */
-                }
-        }
-        /*
-         * Using kmalloc here to allocate a variable length element. Could
-         * cause some memory fragmentation if overused.
-         */
-        e = kmalloc(sizeof(struct tracepoint_entry) + name_len, GFP_KERNEL);
-        if (!e)
-                return ERR_PTR(-ENOMEM);
-        memcpy(&e->name[0], name, name_len);
-        e->funcs = NULL;
-        e->refcount = 0;
-        hlist_add_head(&e->hlist, head);
-        return e;
-}
-
-/*
- * Remove the tracepoint from the tracepoint hash table. Must be called with
- * mutex_lock held.
- */
-static inline void remove_tracepoint(struct tracepoint_entry *e)
-{
-        hlist_del(&e->hlist);
-        kfree(e);
-}
-
-/*
- * Sets the probe callback corresponding to one tracepoint.
- */
-static void set_tracepoint(struct tracepoint_entry **entry,
-        struct tracepoint *elem, int active)
-{
-        WARN_ON(strcmp((*entry)->name, elem->name) != 0);
+        if (tp->regfunc && !static_key_enabled(&tp->key))
+                tp->regfunc();
 
-        if (elem->regfunc && !static_key_enabled(&elem->key) && active)
-                elem->regfunc();
-        else if (elem->unregfunc && static_key_enabled(&elem->key) && !active)
-                elem->unregfunc();
+        tp_funcs = rcu_dereference_protected(tp->funcs,
+                        lockdep_is_held(&tracepoints_mutex));
+        old = func_add(&tp_funcs, func);
+        if (IS_ERR(old)) {
+                WARN_ON_ONCE(1);
+                return PTR_ERR(old);
+        }
+        release_probes(old);
 
         /*
          * rcu_assign_pointer has a smp_wmb() which makes sure that the new
@@ -271,426 +197,215 @@ static void set_tracepoint(struct tracepoint_entry **entry,
          * include/linux/tracepoints.h. A matching smp_read_barrier_depends()
          * is used.
          */
-        rcu_assign_pointer(elem->funcs, (*entry)->funcs);
-        if (active && !static_key_enabled(&elem->key))
-                static_key_slow_inc(&elem->key);
-        else if (!active && static_key_enabled(&elem->key))
-                static_key_slow_dec(&elem->key);
+        rcu_assign_pointer(tp->funcs, tp_funcs);
+        if (!static_key_enabled(&tp->key))
+                static_key_slow_inc(&tp->key);
+        return 0;
 }
 
 /*
- * Disable a tracepoint and its probe callback.
+ * Remove a probe function from a tracepoint.
  * Note: only waiting an RCU period after setting elem->call to the empty
  * function insures that the original callback is not used anymore. This insured
  * by preempt_disable around the call site.
  */
-static void disable_tracepoint(struct tracepoint *elem)
+static int tracepoint_remove_func(struct tracepoint *tp,
+                struct tracepoint_func *func)
 {
-        if (elem->unregfunc && static_key_enabled(&elem->key))
-                elem->unregfunc();
+        struct tracepoint_func *old, *tp_funcs;
 
-        if (static_key_enabled(&elem->key))
-                static_key_slow_dec(&elem->key);
-        rcu_assign_pointer(elem->funcs, NULL);
-}
-
-/**
- * tracepoint_update_probe_range - Update a probe range
- * @begin: beginning of the range
- * @end: end of the range
- *
- * Updates the probe callback corresponding to a range of tracepoints.
- * Called with tracepoints_mutex held.
- */
-static void tracepoint_update_probe_range(struct tracepoint * const *begin,
-                                          struct tracepoint * const *end)
-{
-        struct tracepoint * const *iter;
-        struct tracepoint_entry *mark_entry;
-
-        if (!begin)
-                return;
-
-        for (iter = begin; iter < end; iter++) {
-                mark_entry = get_tracepoint((*iter)->name);
-                if (mark_entry) {
-                        set_tracepoint(&mark_entry, *iter,
-                                        !!mark_entry->refcount);
-                } else {
-                        disable_tracepoint(*iter);
-                }
+        tp_funcs = rcu_dereference_protected(tp->funcs,
+                        lockdep_is_held(&tracepoints_mutex));
+        old = func_remove(&tp_funcs, func);
+        if (IS_ERR(old)) {
+                WARN_ON_ONCE(1);
+                return PTR_ERR(old);
         }
-}
-
-#ifdef CONFIG_MODULES
-void module_update_tracepoints(void)
-{
-        struct tp_module *tp_mod;
-
-        list_for_each_entry(tp_mod, &tracepoint_module_list, list)
-                tracepoint_update_probe_range(tp_mod->tracepoints_ptrs,
-                        tp_mod->tracepoints_ptrs + tp_mod->num_tracepoints);
-}
-#else /* CONFIG_MODULES */
-void module_update_tracepoints(void)
-{
-}
-#endif /* CONFIG_MODULES */
-
+        release_probes(old);
 
-/*
- * Update probes, removing the faulty probes.
- * Called with tracepoints_mutex held.
- */
-static void tracepoint_update_probes(void)
-{
-        /* Core kernel tracepoints */
-        tracepoint_update_probe_range(__start___tracepoints_ptrs,
-                __stop___tracepoints_ptrs);
-        /* tracepoints in modules. */
-        module_update_tracepoints();
-}
+        if (!tp_funcs) {
+                /* Removed last function */
+                if (tp->unregfunc && static_key_enabled(&tp->key))
+                        tp->unregfunc();
 
-static struct tracepoint_func *
-tracepoint_add_probe(const char *name, void *probe, void *data)
-{
-        struct tracepoint_entry *entry;
-        struct tracepoint_func *old;
-
-        entry = get_tracepoint(name);
-        if (!entry) {
-                entry = add_tracepoint(name);
-                if (IS_ERR(entry))
-                        return (struct tracepoint_func *)entry;
+                if (static_key_enabled(&tp->key))
+                        static_key_slow_dec(&tp->key);
         }
-        old = tracepoint_entry_add_probe(entry, probe, data);
-        if (IS_ERR(old) && !entry->refcount)
-                remove_tracepoint(entry);
-        return old;
+        rcu_assign_pointer(tp->funcs, tp_funcs);
+        return 0;
 }
 
 /**
  * tracepoint_probe_register -  Connect a probe to a tracepoint
- * @name: tracepoint name
+ * @tp: tracepoint
  * @probe: probe handler
  *
  * Returns 0 if ok, error value on error.
- * The probe address must at least be aligned on the architecture pointer size.
+ * Note: if @tp is within a module, the caller is responsible for
+ * unregistering the probe before the module is gone. This can be
+ * performed either with a tracepoint module going notifier, or from
+ * within module exit functions.
  */
-int tracepoint_probe_register(const char *name, void *probe, void *data)
+int tracepoint_probe_register(struct tracepoint *tp, void *probe, void *data)
 {
-        struct tracepoint_func *old;
+        struct tracepoint_func tp_func;
+        int ret;
 
         mutex_lock(&tracepoints_mutex);
-        old = tracepoint_add_probe(name, probe, data);
-        if (IS_ERR(old)) {
-                mutex_unlock(&tracepoints_mutex);
-                return PTR_ERR(old);
-        }
-        tracepoint_update_probes();             /* may update entry */
+        tp_func.func = probe;
+        tp_func.data = data;
+        ret = tracepoint_add_func(tp, &tp_func);
         mutex_unlock(&tracepoints_mutex);
-        release_probes(old);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(tracepoint_probe_register);
 
-static struct tracepoint_func *
-tracepoint_remove_probe(const char *name, void *probe, void *data)
-{
-        struct tracepoint_entry *entry;
-        struct tracepoint_func *old;
-
-        entry = get_tracepoint(name);
-        if (!entry)
-                return ERR_PTR(-ENOENT);
-        old = tracepoint_entry_remove_probe(entry, probe, data);
-        if (IS_ERR(old))
-                return old;
-        if (!entry->refcount)
-                remove_tracepoint(entry);
-        return old;
-}
-
 /**
  * tracepoint_probe_unregister -  Disconnect a probe from a tracepoint
- * @name: tracepoint name
+ * @tp: tracepoint
  * @probe: probe function pointer
  *
- * We do not need to call a synchronize_sched to make sure the probes have
- * finished running before doing a module unload, because the module unload
- * itself uses stop_machine(), which insures that every preempt disabled section
- * have finished.
+ * Returns 0 if ok, error value on error.
  */
-int tracepoint_probe_unregister(const char *name, void *probe, void *data)
+int tracepoint_probe_unregister(struct tracepoint *tp, void *probe, void *data)
 {
-        struct tracepoint_func *old;
+        struct tracepoint_func tp_func;
+        int ret;
 
         mutex_lock(&tracepoints_mutex);
-        old = tracepoint_remove_probe(name, probe, data);
-        if (IS_ERR(old)) {
-                mutex_unlock(&tracepoints_mutex);
-                return PTR_ERR(old);
-        }
-        tracepoint_update_probes();             /* may update entry */
+        tp_func.func = probe;
+        tp_func.data = data;
+        ret = tracepoint_remove_func(tp, &tp_func);
         mutex_unlock(&tracepoints_mutex);
-        release_probes(old);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(tracepoint_probe_unregister);
 
-static LIST_HEAD(old_probes);
-static int need_update;
-
-static void tracepoint_add_old_probes(void *old)
+#ifdef CONFIG_MODULES
+bool trace_module_has_bad_taint(struct module *mod)
 {
-        need_update = 1;
-        if (old) {
-                struct tp_probes *tp_probes = container_of(old,
-                        struct tp_probes, probes[0]);
-                list_add(&tp_probes->u.list, &old_probes);
-        }
+        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP) |
+                               (1 << TAINT_UNSIGNED_MODULE));
 }
 
-/**
- * tracepoint_probe_register_noupdate -  register a probe but not connect
- * @name: tracepoint name
- * @probe: probe handler
- *
- * caller must call tracepoint_probe_update_all()
- */
-int tracepoint_probe_register_noupdate(const char *name, void *probe,
-                                       void *data)
-{
-        struct tracepoint_func *old;
-
-        mutex_lock(&tracepoints_mutex);
-        old = tracepoint_add_probe(name, probe, data);
-        if (IS_ERR(old)) {
-                mutex_unlock(&tracepoints_mutex);
-                return PTR_ERR(old);
-        }
-        tracepoint_add_old_probes(old);
-        mutex_unlock(&tracepoints_mutex);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(tracepoint_probe_register_noupdate);
+static BLOCKING_NOTIFIER_HEAD(tracepoint_notify_list);
 
 /**
- * tracepoint_probe_unregister_noupdate -  remove a probe but not disconnect
- * @name: tracepoint name
- * @probe: probe function pointer
+ * register_tracepoint_notifier - register tracepoint coming/going notifier
+ * @nb: notifier block
  *
- * caller must call tracepoint_probe_update_all()
+ * Notifiers registered with this function are called on module
+ * coming/going with the tracepoint_module_list_mutex held.
+ * The notifier block callback should expect a "struct tp_module" data
+ * pointer.
  */
-int tracepoint_probe_unregister_noupdate(const char *name, void *probe,
-                                         void *data)
+int register_tracepoint_module_notifier(struct notifier_block *nb)
 {
-        struct tracepoint_func *old;
-
-        mutex_lock(&tracepoints_mutex);
-        old = tracepoint_remove_probe(name, probe, data);
-        if (IS_ERR(old)) {
-                mutex_unlock(&tracepoints_mutex);
-                return PTR_ERR(old);
-        }
-        tracepoint_add_old_probes(old);
-        mutex_unlock(&tracepoints_mutex);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(tracepoint_probe_unregister_noupdate);
-
-/**
- * tracepoint_probe_update_all -  update tracepoints
- */
-void tracepoint_probe_update_all(void)
-{
-        LIST_HEAD(release_probes);
-        struct tp_probes *pos, *next;
+        struct tp_module *tp_mod;
+        int ret;
 
-        mutex_lock(&tracepoints_mutex);
-        if (!need_update) {
-                mutex_unlock(&tracepoints_mutex);
-                return;
-        }
-        if (!list_empty(&old_probes))
-                list_replace_init(&old_probes, &release_probes);
-        need_update = 0;
-        tracepoint_update_probes();
-        mutex_unlock(&tracepoints_mutex);
-        list_for_each_entry_safe(pos, next, &release_probes, u.list) {
-                list_del(&pos->u.list);
-                call_rcu_sched(&pos->u.rcu, rcu_free_old_probes);
-        }
+        mutex_lock(&tracepoint_module_list_mutex);
+        ret = blocking_notifier_chain_register(&tracepoint_notify_list, nb);
+        if (ret)
+                goto end;
+        list_for_each_entry(tp_mod, &tracepoint_module_list, list)
+                (void) nb->notifier_call(nb, MODULE_STATE_COMING, tp_mod);
+end:
+        mutex_unlock(&tracepoint_module_list_mutex);
+        return ret;
 }
-EXPORT_SYMBOL_GPL(tracepoint_probe_update_all);
+EXPORT_SYMBOL_GPL(register_tracepoint_module_notifier);
 
 /**
- * tracepoint_get_iter_range - Get a next tracepoint iterator given a range.
- * @tracepoint: current tracepoints (in), next tracepoint (out)
- * @begin: beginning of the range
- * @end: end of the range
+ * unregister_tracepoint_notifier - unregister tracepoint coming/going notifier
+ * @nb: notifier block
  *
- * Returns whether a next tracepoint has been found (1) or not (0).
- * Will return the first tracepoint in the range if the input tracepoint is
- * NULL.
+ * The notifier block callback should expect a "struct tp_module" data
+ * pointer.
  */
-static int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
-        struct tracepoint * const *begin, struct tracepoint * const *end)
+int unregister_tracepoint_module_notifier(struct notifier_block *nb)
 {
-        if (!*tracepoint && begin != end) {
-                *tracepoint = begin;
-                return 1;
-        }
-        if (*tracepoint >= begin && *tracepoint < end)
-                return 1;
-        return 0;
-}
+        struct tp_module *tp_mod;
+        int ret;
 
-#ifdef CONFIG_MODULES
-static void tracepoint_get_iter(struct tracepoint_iter *iter)
-{
-        int found = 0;
-        struct tp_module *iter_mod;
-
-        /* Core kernel tracepoints */
-        if (!iter->module) {
-                found = tracepoint_get_iter_range(&iter->tracepoint,
-                                __start___tracepoints_ptrs,
-                                __stop___tracepoints_ptrs);
-                if (found)
-                        goto end;
-        }
-        /* Tracepoints in modules */
-        mutex_lock(&tracepoints_mutex);
-        list_for_each_entry(iter_mod, &tracepoint_module_list, list) {
-                /*
-                 * Sorted module list
-                 */
-                if (iter_mod < iter->module)
-                        continue;
-                else if (iter_mod > iter->module)
-                        iter->tracepoint = NULL;
-                found = tracepoint_get_iter_range(&iter->tracepoint,
-                        iter_mod->tracepoints_ptrs,
-                        iter_mod->tracepoints_ptrs
-                                + iter_mod->num_tracepoints);
-                if (found) {
-                        iter->module = iter_mod;
-                        break;
-                }
-        }
-        mutex_unlock(&tracepoints_mutex);
+        mutex_lock(&tracepoint_module_list_mutex);
+        ret = blocking_notifier_chain_unregister(&tracepoint_notify_list, nb);
+        if (ret)
+                goto end;
+        list_for_each_entry(tp_mod, &tracepoint_module_list, list)
+                (void) nb->notifier_call(nb, MODULE_STATE_GOING, tp_mod);
 end:
-        if (!found)
-                tracepoint_iter_reset(iter);
-}
-#else /* CONFIG_MODULES */
-static void tracepoint_get_iter(struct tracepoint_iter *iter)
-{
-        int found = 0;
-
-        /* Core kernel tracepoints */
-        found = tracepoint_get_iter_range(&iter->tracepoint,
-                        __start___tracepoints_ptrs,
-                        __stop___tracepoints_ptrs);
-        if (!found)
-                tracepoint_iter_reset(iter);
-}
-#endif /* CONFIG_MODULES */
-
-void tracepoint_iter_start(struct tracepoint_iter *iter)
-{
-        tracepoint_get_iter(iter);
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_start);
-
-void tracepoint_iter_next(struct tracepoint_iter *iter)
-{
-        iter->tracepoint++;
-        /*
-         * iter->tracepoint may be invalid because we blindly incremented it.
-         * Make sure it is valid by marshalling on the tracepoints, getting the
-         * tracepoints from following modules if necessary.
-         */
-        tracepoint_get_iter(iter);
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_next);
+        mutex_unlock(&tracepoint_module_list_mutex);
+        return ret;
 
-void tracepoint_iter_stop(struct tracepoint_iter *iter)
-{
 }
-EXPORT_SYMBOL_GPL(tracepoint_iter_stop);
+EXPORT_SYMBOL_GPL(unregister_tracepoint_module_notifier);
 
-void tracepoint_iter_reset(struct tracepoint_iter *iter)
+/*
+ * Ensure the tracer unregistered the module's probes before the module
+ * teardown is performed. Prevents leaks of probe and data pointers.
+ */
+static void tp_module_going_check_quiescent(struct tracepoint * const *begin,
+                struct tracepoint * const *end)
 {
-#ifdef CONFIG_MODULES
-        iter->module = NULL;
-#endif /* CONFIG_MODULES */
-        iter->tracepoint = NULL;
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
+        struct tracepoint * const *iter;
 
-#ifdef CONFIG_MODULES
-bool trace_module_has_bad_taint(struct module *mod)
-{
-        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
+        if (!begin)
+                return;
+        for (iter = begin; iter < end; iter++)
+                WARN_ON_ONCE((*iter)->funcs);
 }
 
 static int tracepoint_module_coming(struct module *mod)
 {
-        struct tp_module *tp_mod, *iter;
+        struct tp_module *tp_mod;
         int ret = 0;
 
+        if (!mod->num_tracepoints)
+                return 0;
+
         /*
          * We skip modules that taint the kernel, especially those with different
          * module headers (for forced load), to make sure we don't cause a crash.
-         * Staging and out-of-tree GPL modules are fine.
+         * Staging, out-of-tree, and unsigned GPL modules are fine.
          */
         if (trace_module_has_bad_taint(mod))
                 return 0;
-        mutex_lock(&tracepoints_mutex);
+        mutex_lock(&tracepoint_module_list_mutex);
         tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
         if (!tp_mod) {
                 ret = -ENOMEM;
                 goto end;
         }
-        tp_mod->num_tracepoints = mod->num_tracepoints;
-        tp_mod->tracepoints_ptrs = mod->tracepoints_ptrs;
-
-        /*
-         * tracepoint_module_list is kept sorted by struct module pointer
-         * address for iteration on tracepoints from a seq_file that can release
-         * the mutex between calls.
-         */
-        list_for_each_entry_reverse(iter, &tracepoint_module_list, list) {
-                BUG_ON(iter == tp_mod); /* Should never be in the list twice */
-                if (iter < tp_mod) {
-                        /* We belong to the location right after iter. */
-                        list_add(&tp_mod->list, &iter->list);
-                        goto module_added;
-                }
-        }
-        /* We belong to the beginning of the list */
-        list_add(&tp_mod->list, &tracepoint_module_list);
-module_added:
-        tracepoint_update_probe_range(mod->tracepoints_ptrs,
-                mod->tracepoints_ptrs + mod->num_tracepoints);
+        tp_mod->mod = mod;
+        list_add_tail(&tp_mod->list, &tracepoint_module_list);
+        blocking_notifier_call_chain(&tracepoint_notify_list,
+                        MODULE_STATE_COMING, tp_mod);
 end:
-        mutex_unlock(&tracepoints_mutex);
+        mutex_unlock(&tracepoint_module_list_mutex);
         return ret;
 }
 
-static int tracepoint_module_going(struct module *mod)
+static void tracepoint_module_going(struct module *mod)
 {
-        struct tp_module *pos;
+        struct tp_module *tp_mod;
 
-        mutex_lock(&tracepoints_mutex);
-        tracepoint_update_probe_range(mod->tracepoints_ptrs,
-                mod->tracepoints_ptrs + mod->num_tracepoints);
-        list_for_each_entry(pos, &tracepoint_module_list, list) {
-                if (pos->tracepoints_ptrs == mod->tracepoints_ptrs) {
-                        list_del(&pos->list);
-                        kfree(pos);
+        if (!mod->num_tracepoints)
+                return;
+
+        mutex_lock(&tracepoint_module_list_mutex);
+        list_for_each_entry(tp_mod, &tracepoint_module_list, list) {
+                if (tp_mod->mod == mod) {
+                        blocking_notifier_call_chain(&tracepoint_notify_list,
+                                        MODULE_STATE_GOING, tp_mod);
+                        list_del(&tp_mod->list);
+                        kfree(tp_mod);
+                        /*
+                         * Called the going notifier before checking for
+                         * quiescence.
+                         */
+                        tp_module_going_check_quiescent(mod->tracepoints_ptrs,
+                                mod->tracepoints_ptrs + mod->num_tracepoints);
                         break;
                 }
         }
@@ -700,12 +415,11 @@ static int tracepoint_module_going(struct module *mod)
          * flag on "going", in case a module taints the kernel only after being
          * loaded.
          */
-        mutex_unlock(&tracepoints_mutex);
-        return 0;
+        mutex_unlock(&tracepoint_module_list_mutex);
 }
 
-int tracepoint_module_notify(struct notifier_block *self,
-                             unsigned long val, void *data)
+static int tracepoint_module_notify(struct notifier_block *self,
+                unsigned long val, void *data)
 {
         struct module *mod = data;
         int ret = 0;
@@ -717,24 +431,58 @@ int tracepoint_module_notify(struct notifier_block *self,
         case MODULE_STATE_LIVE:
                 break;
         case MODULE_STATE_GOING:
-                ret = tracepoint_module_going(mod);
+                tracepoint_module_going(mod);
+                break;
+        case MODULE_STATE_UNFORMED:
                 break;
         }
         return ret;
 }
 
-struct notifier_block tracepoint_module_nb = {
+static struct notifier_block tracepoint_module_nb = {
         .notifier_call = tracepoint_module_notify,
         .priority = 0,
 };
 
-static int init_tracepoints(void)
+static __init int init_tracepoints(void)
 {
-        return register_module_notifier(&tracepoint_module_nb);
+        int ret;
+
+        ret = register_module_notifier(&tracepoint_module_nb);
+        if (ret)
+                pr_warning("Failed to register tracepoint module enter notifier\n");
+
+        return ret;
 }
 __initcall(init_tracepoints);
 #endif /* CONFIG_MODULES */
 
+static void for_each_tracepoint_range(struct tracepoint * const *begin,
+                struct tracepoint * const *end,
+                void (*fct)(struct tracepoint *tp, void *priv),
+                void *priv)
+{
+        struct tracepoint * const *iter;
+
+        if (!begin)
+                return;
+        for (iter = begin; iter < end; iter++)
+                fct(*iter, priv);
+}
+
+/**
+ * for_each_kernel_tracepoint - iteration on all kernel tracepoints
+ * @fct: callback
+ * @priv: private data
+ */
+void for_each_kernel_tracepoint(void (*fct)(struct tracepoint *tp, void *priv),
+                void *priv)
+{
+        for_each_tracepoint_range(__start___tracepoints_ptrs,
+                __stop___tracepoints_ptrs, fct, priv);
+}
+EXPORT_SYMBOL_GPL(for_each_kernel_tracepoint);
+
 #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
 
 /* NB: reg/unreg are called while guarded with the tracepoints_mutex */
diff --git a/kernel/user.c b/kernel/user.c
index c006131beb77..294fc6a94168 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -222,5 +222,4 @@ static int __init uid_cache_init(void)
 
         return 0;
 }
-
-module_init(uid_cache_init);
+subsys_initcall(uid_cache_init);
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index dd06439b9c84..bf71b4b2d632 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -152,7 +152,7 @@ static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
 
         /* Find the matching extent */
         extents = map->nr_extents;
-        smp_read_barrier_depends();
+        smp_rmb();
         for (idx = 0; idx < extents; idx++) {
                 first = map->extent[idx].first;
                 last = first + map->extent[idx].count - 1;
@@ -176,7 +176,7 @@ static u32 map_id_down(struct uid_gid_map *map, u32 id)
 
         /* Find the matching extent */
         extents = map->nr_extents;
-        smp_read_barrier_depends();
+        smp_rmb();
         for (idx = 0; idx < extents; idx++) {
                 first = map->extent[idx].first;
                 last = first + map->extent[idx].count - 1;
@@ -199,7 +199,7 @@ static u32 map_id_up(struct uid_gid_map *map, u32 id)
 
         /* Find the matching extent */
         extents = map->nr_extents;
-        smp_read_barrier_depends();
+        smp_rmb();
         for (idx = 0; idx < extents; idx++) {
                 first = map->extent[idx].lower_first;
                 last = first + map->extent[idx].count - 1;
@@ -615,9 +615,8 @@ static ssize_t map_write(struct file *file, const char __user *buf,
          * were written before the count of the extents.
          *
          * To achieve this smp_wmb() is used on guarantee the write
-         * order and smp_read_barrier_depends() is guaranteed that we
-         * don't have crazy architectures returning stale data.
-         *
+         * order and smp_rmb() is guaranteed that we don't have crazy
+         * architectures returning stale data.
          */
         mutex_lock(&id_map_mutex);
 
@@ -902,4 +901,4 @@ static __init int user_namespaces_init(void)
         user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
         return 0;
 }
-module_init(user_namespaces_init);
+subsys_initcall(user_namespaces_init);
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 01c6f979486f..516203e665fc 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -138,7 +138,11 @@ static void __touch_watchdog(void)
 
 void touch_softlockup_watchdog(void)
 {
-        __this_cpu_write(watchdog_touch_ts, 0);
+        /*
+         * Preemption can be enabled.  It doesn't matter which CPU's timestamp
+         * gets zeroed here, so use the raw_ operation.
+         */
+        raw_cpu_write(watchdog_touch_ts, 0);
 }
 EXPORT_SYMBOL(touch_softlockup_watchdog);
 
@@ -158,14 +162,14 @@ void touch_all_softlockup_watchdogs(void)
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 void touch_nmi_watchdog(void)
 {
-        if (watchdog_user_enabled) {
-                unsigned cpu;
-
-                for_each_present_cpu(cpu) {
-                        if (per_cpu(watchdog_nmi_touch, cpu) != true)
-                                per_cpu(watchdog_nmi_touch, cpu) = true;
-                }
-        }
+        /*
+         * Using __raw here because some code paths have
+         * preemption enabled.  If preemption is enabled
+         * then interrupts should be enabled too, in which
+         * case we shouldn't have to worry about the watchdog
+         * going off.
+         */
+        __raw_get_cpu_var(watchdog_nmi_touch) = true;
         touch_softlockup_watchdog();
 }
 EXPORT_SYMBOL(touch_nmi_watchdog);