50 files changed, 1236 insertions, 777 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 7ccba4bc5e3b..0249f4be9b5c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -703,7 +703,7 @@ static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, int mode);
 static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry);
 static int cgroup_populate_dir(struct cgroup *cgrp);
 static const struct inode_operations cgroup_dir_inode_operations;
-static struct file_operations proc_cgroupstats_operations;
+static const struct file_operations proc_cgroupstats_operations;
 static struct backing_dev_info cgroup_backing_dev_info = {
        .name           = "cgroup",
@@ -1710,14 +1710,13 @@ static ssize_t cgroup_write_X64(struct cgroup *cgrp, struct cftype *cft,
                return -EFAULT;
        buffer[nbytes] = 0;     /* nul-terminate */
-        strstrip(buffer);
        if (cft->write_u64) {
-                u64 val = simple_strtoull(buffer, &end, 0);
+                u64 val = simple_strtoull(strstrip(buffer), &end, 0);
                if (*end)
                        return -EINVAL;
                retval = cft->write_u64(cgrp, cft, val);
        } else {
-                s64 val = simple_strtoll(buffer, &end, 0);
+                s64 val = simple_strtoll(strstrip(buffer), &end, 0);
                if (*end)
                        return -EINVAL;
                retval = cft->write_s64(cgrp, cft, val);
@@ -1753,8 +1752,7 @@ static ssize_t cgroup_write_string(struct cgroup *cgrp, struct cftype *cft,
        }
        buffer[nbytes] = 0;     /* nul-terminate */
-        strstrip(buffer);
+        retval = cft->write_string(cgrp, cft, strstrip(buffer));
-        retval = cft->write_string(cgrp, cft, buffer);
        if (!retval)
                retval = nbytes;
 out:
@@ -1863,7 +1861,7 @@ static int cgroup_seqfile_release(struct inode *inode, struct file *file)
        return single_release(inode, file);
 }
-static struct file_operations cgroup_seqfile_operations = {
+static const struct file_operations cgroup_seqfile_operations = {
        .read = seq_read,
        .write = cgroup_file_write,
        .llseek = seq_lseek,
@@ -1922,7 +1920,7 @@ static int cgroup_rename(struct inode *old_dir, struct dentry *old_dentry,
        return simple_rename(old_dir, old_dentry, new_dir, new_dentry);
 }
-static struct file_operations cgroup_file_operations = {
+static const struct file_operations cgroup_file_operations = {
        .read = cgroup_file_read,
        .write = cgroup_file_write,
        .llseek = generic_file_llseek,
@@ -3369,7 +3367,7 @@ static int cgroup_open(struct inode *inode, struct file *file)
        return single_open(file, proc_cgroup_show, pid);
 }
-struct file_operations proc_cgroup_operations = {
+const struct file_operations proc_cgroup_operations = {
        .open           = cgroup_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
@@ -3398,7 +3396,7 @@ static int cgroupstats_open(struct inode *inode, struct file *file)
        return single_open(file, proc_cgroupstats_show, NULL);
 }
-static struct file_operations proc_cgroupstats_operations = {
+static const struct file_operations proc_cgroupstats_operations = {
        .open = cgroupstats_open,
        .read = seq_read,
        .llseek = seq_lseek,
@@ -3708,8 +3706,10 @@ static void check_for_release(struct cgroup *cgrp)
 void __css_put(struct cgroup_subsys_state *css)
 {
        struct cgroup *cgrp = css->cgroup;
+        int val;
        rcu_read_lock();
-        if (atomic_dec_return(&css->refcnt) == 1) {
+        val = atomic_dec_return(&css->refcnt);
+        if (val == 1) {
                if (notify_on_release(cgrp)) {
                        set_bit(CGRP_RELEASABLE, &cgrp->flags);
                        check_for_release(cgrp);
@@ -3717,6 +3717,7 @@ void __css_put(struct cgroup_subsys_state *css)
                cgroup_wakeup_rmdir_waiter(cgrp);
        }
        rcu_read_unlock();
+        WARN_ON_ONCE(val < 1);
 }
 /*
diff --git a/kernel/exit.c b/kernel/exit.c
index 5859f598c951..f7864ac2ecc1 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -359,10 +359,8 @@ void __set_special_pids(struct pid *pid)
 {
        struct task_struct *curr = current->group_leader;
-        if (task_session(curr) != pid) {
+        if (task_session(curr) != pid)
                change_pid(curr, PIDTYPE_SID, pid);
-                proc_sid_connector(curr);
-        }
        if (task_pgrp(curr) != pid)
                change_pid(curr, PIDTYPE_PGID, pid);
@@ -991,8 +989,6 @@ NORET_TYPE void do_exit(long code)
        tsk->mempolicy = NULL;
 #endif
 #ifdef CONFIG_FUTEX
-        if (unlikely(!list_empty(&tsk->pi_state_list)))
-                exit_pi_state_list(tsk);
        if (unlikely(current->pi_state_cache))
                kfree(current->pi_state_cache);
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index 266c6af6ef1b..166b8c49257c 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -91,7 +91,7 @@ int nr_processes(void)
        int cpu;
        int total = 0;
-        for_each_online_cpu(cpu)
+        for_each_possible_cpu(cpu)
                total += per_cpu(process_counts, cpu);
        return total;
@@ -570,12 +570,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
        /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
-        if (unlikely(tsk->robust_list))
+        if (unlikely(tsk->robust_list)) {
                exit_robust_list(tsk);
+                tsk->robust_list = NULL;
+        }
 #ifdef CONFIG_COMPAT
-        if (unlikely(tsk->compat_robust_list))
+        if (unlikely(tsk->compat_robust_list)) {
                compat_exit_robust_list(tsk);
+                tsk->compat_robust_list = NULL;
+        }
 #endif
+        if (unlikely(!list_empty(&tsk->pi_state_list)))
+                exit_pi_state_list(tsk);
 #endif
        /* Get rid of any cached register state */
diff --git a/kernel/futex.c b/kernel/futex.c
index 248dd119a86e..fb65e822fc41 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -89,36 +89,36 @@ struct futex_pi_state {
        union futex_key key;
 };
-/*
+/**
- * We use this hashed waitqueue instead of a normal wait_queue_t, so
+ * struct futex_q - The hashed futex queue entry, one per waiting task
+ * @task:               the task waiting on the futex
+ * @lock_ptr:           the hash bucket lock
+ * @key:                the key the futex is hashed on
+ * @pi_state:           optional priority inheritance state
+ * @rt_waiter:          rt_waiter storage for use with requeue_pi
+ * @requeue_pi_key:     the requeue_pi target futex key
+ * @bitset:             bitset for the optional bitmasked wakeup
+ *
+ * We use this hashed waitqueue, instead of a normal wait_queue_t, so
 * we can wake only the relevant ones (hashed queues may be shared).
 *
 * A futex_q has a woken state, just like tasks have TASK_RUNNING.
 * It is considered woken when plist_node_empty(&q->list) || q->lock_ptr == 0.
 * The order of wakup is always to make the first condition true, then
- * wake up q->waiter, then make the second condition true.
+ * the second.
+ *
+ * PI futexes are typically woken before they are removed from the hash list via
+ * the rt_mutex code. See unqueue_me_pi().
 */
 struct futex_q {
        struct plist_node list;
-        /* Waiter reference */
-        struct task_struct *task;
-        /* Which hash list lock to use: */
+        struct task_struct *task;
        spinlock_t *lock_ptr;
-        /* Key which the futex is hashed on: */
        union futex_key key;
-        /* Optional priority inheritance state: */
        struct futex_pi_state *pi_state;
-        /* rt_waiter storage for requeue_pi: */
        struct rt_mutex_waiter *rt_waiter;
-        /* The expected requeue pi target futex key: */
        union futex_key *requeue_pi_key;
-        /* Bitset for the optional bitmasked wakeup */
        u32 bitset;
 };
@@ -150,7 +150,8 @@ static struct futex_hash_bucket *hash_futex(union futex_key *key)
 */
 static inline int match_futex(union futex_key *key1, union futex_key *key2)
 {
-        return (key1->both.word == key2->both.word
+        return (key1 && key2
+                && key1->both.word == key2->both.word
                && key1->both.ptr == key2->both.ptr
                && key1->both.offset == key2->both.offset);
 }
@@ -198,11 +199,12 @@ static void drop_futex_key_refs(union futex_key *key)
 }
 /**
- * get_futex_key - Get parameters which are the keys for a futex.
+ * get_futex_key() - Get parameters which are the keys for a futex
- * @uaddr: virtual address of the futex
+ * @uaddr:      virtual address of the futex
- * @fshared: 0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
+ * @fshared:    0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
- * @key: address where result is stored.
+ * @key:        address where result is stored.
- * @rw: mapping needs to be read/write (values: VERIFY_READ, VERIFY_WRITE)
+ * @rw:         mapping needs to be read/write (values: VERIFY_READ,
+ *              VERIFY_WRITE)
 *
 * Returns a negative error code or 0
 * The key words are stored in *key on success.
@@ -288,8 +290,8 @@ void put_futex_key(int fshared, union futex_key *key)
        drop_futex_key_refs(key);
 }
-/*
+/**
- * fault_in_user_writeable - fault in user address and verify RW access
+ * fault_in_user_writeable() - Fault in user address and verify RW access
 * @uaddr:      pointer to faulting user space address
 *
 * Slow path to fixup the fault we just took in the atomic write
@@ -309,8 +311,8 @@ static int fault_in_user_writeable(u32 __user *uaddr)
 /**
 * futex_top_waiter() - Return the highest priority waiter on a futex
- * @hb:     the hash bucket the futex_q's reside in
+ * @hb:         the hash bucket the futex_q's reside in
- * @key:    the futex key (to distinguish it from other futex futex_q's)
+ * @key:        the futex key (to distinguish it from other futex futex_q's)
 *
 * Must be called with the hb lock held.
 */
@@ -588,7 +590,7 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 }
 /**
- * futex_lock_pi_atomic() - atomic work required to acquire a pi aware futex
+ * futex_lock_pi_atomic() - Atomic work required to acquire a pi aware futex
 * @uaddr:              the pi futex user address
 * @hb:                 the pi futex hash bucket
 * @key:                the futex key associated with uaddr and hb
@@ -915,8 +917,8 @@ retry:
        hb1 = hash_futex(&key1);
        hb2 = hash_futex(&key2);
-        double_lock_hb(hb1, hb2);
 retry_private:
+        double_lock_hb(hb1, hb2);
        op_ret = futex_atomic_op_inuser(op, uaddr2);
        if (unlikely(op_ret < 0)) {
@@ -1011,9 +1013,9 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
 /**
 * requeue_pi_wake_futex() - Wake a task that acquired the lock during requeue
- * q:   the futex_q
+ * @q:          the futex_q
- * key: the key of the requeue target futex
+ * @key:        the key of the requeue target futex
- * hb:  the hash_bucket of the requeue target futex
+ * @hb:         the hash_bucket of the requeue target futex
 *
 * During futex_requeue, with requeue_pi=1, it is possible to acquire the
 * target futex if it is uncontended or via a lock steal.  Set the futex_q key
@@ -1027,7 +1029,6 @@ static inline
 void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
                           struct futex_hash_bucket *hb)
 {
-        drop_futex_key_refs(&q->key);
        get_futex_key_refs(key);
        q->key = *key;
@@ -1225,6 +1226,7 @@ retry_private:
                 */
                if (ret == 1) {
                        WARN_ON(pi_state);
+                        drop_count++;
                        task_count++;
                        ret = get_futex_value_locked(&curval2, uaddr2);
                        if (!ret)
@@ -1303,6 +1305,7 @@ retry_private:
                        if (ret == 1) {
                                /* We got the lock. */
                                requeue_pi_wake_futex(this, &key2, hb2);
+                                drop_count++;
                                continue;
                        } else if (ret) {
                                /* -EDEADLK */
@@ -1350,6 +1353,25 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
        return hb;
 }
+static inline void
+queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+{
+        spin_unlock(&hb->lock);
+        drop_futex_key_refs(&q->key);
+}
+/**
+ * queue_me() - Enqueue the futex_q on the futex_hash_bucket
+ * @q:  The futex_q to enqueue
+ * @hb: The destination hash bucket
+ *
+ * The hb->lock must be held by the caller, and is released here. A call to
+ * queue_me() is typically paired with exactly one call to unqueue_me().  The
+ * exceptions involve the PI related operations, which may use unqueue_me_pi()
+ * or nothing if the unqueue is done as part of the wake process and the unqueue
+ * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
+ * an example).
+ */
 static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
 {
        int prio;
@@ -1373,19 +1395,17 @@ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
        spin_unlock(&hb->lock);
 }
-static inline void
+/**
-queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+ * unqueue_me() - Remove the futex_q from its futex_hash_bucket
-{
+ * @q:  The futex_q to unqueue
-        spin_unlock(&hb->lock);
+ *
-        drop_futex_key_refs(&q->key);
+ * The q->lock_ptr must not be held by the caller. A call to unqueue_me() must
-}
+ * be paired with exactly one earlier call to queue_me().
+ *
-/*
+ * Returns:
- * queue_me and unqueue_me must be called as a pair, each
+ *   1 - if the futex_q was still queued (and we removed unqueued it)
- * exactly once.  They are called with the hashed spinlock held.
+ *   0 - if the futex_q was already removed by the waking thread
 */
-/* Return 1 if we were still queued (ie. 0 means we were woken) */
 static int unqueue_me(struct futex_q *q)
 {
        spinlock_t *lock_ptr;
@@ -1638,17 +1658,14 @@ out:
 static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
                                struct hrtimer_sleeper *timeout)
 {
-        queue_me(q, hb);
        /*
-         * There might have been scheduling since the queue_me(), as we
+         * The task state is guaranteed to be set before another task can
-         * cannot hold a spinlock across the get_user() in case it
+         * wake it. set_current_state() is implemented using set_mb() and
-         * faults, and we cannot just set TASK_INTERRUPTIBLE state when
+         * queue_me() calls spin_unlock() upon completion, both serializing
-         * queueing ourselves into the futex hash. This code thus has to
+         * access to the hash list and forcing another memory barrier.
-         * rely on the futex_wake() code removing us from hash when it
-         * wakes us up.
         */
        set_current_state(TASK_INTERRUPTIBLE);
+        queue_me(q, hb);
        /* Arm the timer */
        if (timeout) {
@@ -1658,8 +1675,8 @@ static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
        }
        /*
-         * !plist_node_empty() is safe here without any lock.
+         * If we have been removed from the hash list, then another task
-         * q.lock_ptr != 0 is not safe, because of ordering against wakeup.
+         * has tried to wake us, and we can skip the call to schedule().
         */
        if (likely(!plist_node_empty(&q->list))) {
                /*
@@ -1776,6 +1793,7 @@ static int futex_wait(u32 __user *uaddr, int fshared,
                                             current->timer_slack_ns);
        }
+retry:
        /* Prepare to wait on uaddr. */
        ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
        if (ret)
@@ -1793,9 +1811,14 @@ static int futex_wait(u32 __user *uaddr, int fshared,
                goto out_put_key;
        /*
-         * We expect signal_pending(current), but another thread may
+         * We expect signal_pending(current), but we might be the
-         * have handled it for us already.
+         * victim of a spurious wakeup as well.
         */
+        if (!signal_pending(current)) {
+                put_futex_key(fshared, &q.key);
+                goto retry;
+        }
        ret = -ERESTARTSYS;
        if (!abs_time)
                goto out_put_key;
@@ -2102,11 +2125,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                 * Unqueue the futex_q and determine which it was.
                 */
                plist_del(&q->list, &q->list.plist);
-                drop_futex_key_refs(&q->key);
+                /* Handle spurious wakeups gracefully */
+                ret = -EWOULDBLOCK;
                if (timeout && !timeout->task)
                        ret = -ETIMEDOUT;
-                else
+                else if (signal_pending(current))
                        ret = -ERESTARTNOINTR;
        }
        return ret;
@@ -2114,12 +2138,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
 /**
 * futex_wait_requeue_pi() - Wait on uaddr and take uaddr2
- * @uaddr:      the futex we initialyl wait on (non-pi)
+ * @uaddr:      the futex we initially wait on (non-pi)
 * @fshared:    whether the futexes are shared (1) or not (0).  They must be
 *              the same type, no requeueing from private to shared, etc.
 * @val:        the expected value of uaddr
 * @abs_time:   absolute timeout
- * @bitset:     32 bit wakeup bitset set by userspace, defaults to all.
+ * @bitset:     32 bit wakeup bitset set by userspace, defaults to all
 * @clockrt:    whether to use CLOCK_REALTIME (1) or CLOCK_MONOTONIC (0)
 * @uaddr2:     the pi futex we will take prior to returning to user-space
 *
@@ -2246,7 +2270,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
                res = fixup_owner(uaddr2, fshared, &q, !ret);
                /*
                 * If fixup_owner() returned an error, proprogate that.  If it
-                 * acquired the lock, clear our -ETIMEDOUT or -EINTR.
+                 * acquired the lock, clear -ETIMEDOUT or -EINTR.
                 */
                if (res)
                        ret = (res < 0) ? res : 0;
@@ -2302,9 +2326,9 @@ out:
 */
 /**
- * sys_set_robust_list - set the robust-futex list head of a task
+ * sys_set_robust_list() - Set the robust-futex list head of a task
- * @head: pointer to the list-head
+ * @head:       pointer to the list-head
- * @len: length of the list-head, as userspace expects
+ * @len:        length of the list-head, as userspace expects
 */
 SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
                size_t, len)
@@ -2323,10 +2347,10 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
 }
 /**
- * sys_get_robust_list - get the robust-futex list head of a task
+ * sys_get_robust_list() - Get the robust-futex list head of a task
- * @pid: pid of the process [zero for current task]
+ * @pid:        pid of the process [zero for current task]
- * @head_ptr: pointer to a list-head pointer, the kernel fills it in
+ * @head_ptr:   pointer to a list-head pointer, the kernel fills it in
- * @len_ptr: pointer to a length field, the kernel fills in the header size
+ * @len_ptr:    pointer to a length field, the kernel fills in the header size
 */
 SYSCALL_DEFINE3(get_robust_list, int, pid,
                struct robust_list_head __user * __user *, head_ptr,
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index e5d98ce50f89..3e1c36e7998f 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -509,13 +509,14 @@ static inline int hrtimer_hres_active(void)
 * next event
 * Called with interrupts disabled and base->lock held
 */
-static void hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base)
+static void
+hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
 {
        int i;
        struct hrtimer_clock_base *base = cpu_base->clock_base;
-        ktime_t expires;
+        ktime_t expires, expires_next;
-        cpu_base->expires_next.tv64 = KTIME_MAX;
+        expires_next.tv64 = KTIME_MAX;
        for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++, base++) {
                struct hrtimer *timer;
@@ -531,10 +532,15 @@ static void hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base)
                 */
                if (expires.tv64 < 0)
                        expires.tv64 = 0;
-                if (expires.tv64 < cpu_base->expires_next.tv64)
+                if (expires.tv64 < expires_next.tv64)
-                        cpu_base->expires_next = expires;
+                        expires_next = expires;
        }
+        if (skip_equal && expires_next.tv64 == cpu_base->expires_next.tv64)
+                return;
+        cpu_base->expires_next.tv64 = expires_next.tv64;
        if (cpu_base->expires_next.tv64 != KTIME_MAX)
                tick_program_event(cpu_base->expires_next, 1);
 }
@@ -617,7 +623,7 @@ static void retrigger_next_event(void *arg)
        base->clock_base[CLOCK_REALTIME].offset =
                timespec_to_ktime(realtime_offset);
-        hrtimer_force_reprogram(base);
+        hrtimer_force_reprogram(base, 0);
        spin_unlock(&base->lock);
 }
@@ -720,8 +726,6 @@ static int hrtimer_switch_to_hres(void)
        /* "Retrigger" the interrupt to get things going */
        retrigger_next_event(NULL);
        local_irq_restore(flags);
-        printk(KERN_DEBUG "Switched to high resolution mode on CPU %d\n",
-               smp_processor_id());
        return 1;
 }
@@ -730,7 +734,8 @@ static int hrtimer_switch_to_hres(void)
 static inline int hrtimer_hres_active(void) { return 0; }
 static inline int hrtimer_is_hres_enabled(void) { return 0; }
 static inline int hrtimer_switch_to_hres(void) { return 0; }
-static inline void hrtimer_force_reprogram(struct hrtimer_cpu_base *base) { }
+static inline void
+hrtimer_force_reprogram(struct hrtimer_cpu_base *base, int skip_equal) { }
 static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
                                            struct hrtimer_clock_base *base,
                                            int wakeup)
@@ -873,19 +878,29 @@ static void __remove_hrtimer(struct hrtimer *timer,
                             struct hrtimer_clock_base *base,
                             unsigned long newstate, int reprogram)
 {
-        if (timer->state & HRTIMER_STATE_ENQUEUED) {
+        if (!(timer->state & HRTIMER_STATE_ENQUEUED))
-                /*
+                goto out;
-                 * Remove the timer from the rbtree and replace the
-                 * first entry pointer if necessary.
+        /*
-                 */
+         * Remove the timer from the rbtree and replace the first
-                if (base->first == &timer->node) {
+         * entry pointer if necessary.
-                        base->first = rb_next(&timer->node);
+         */
-                        /* Reprogram the clock event device. if enabled */
+        if (base->first == &timer->node) {
-                        if (reprogram && hrtimer_hres_active())
+                base->first = rb_next(&timer->node);
-                                hrtimer_force_reprogram(base->cpu_base);
+#ifdef CONFIG_HIGH_RES_TIMERS
+                /* Reprogram the clock event device. if enabled */
+                if (reprogram && hrtimer_hres_active()) {
+                        ktime_t expires;
+                        expires = ktime_sub(hrtimer_get_expires(timer),
+                                            base->offset);
+                        if (base->cpu_base->expires_next.tv64 == expires.tv64)
+                                hrtimer_force_reprogram(base->cpu_base, 1);
                }
-                rb_erase(&timer->node, &base->active);
+#endif
        }
+        rb_erase(&timer->node, &base->active);
+out:
        timer->state = newstate;
 }
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index a81cf80554db..17c71bb565c6 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -11,6 +11,7 @@
 */
 #include <linux/irq.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/random.h>
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 114e704760fe..bd7273e6282e 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -121,7 +121,9 @@ static void poll_all_shared_irqs(void)
                if (!(status & IRQ_SPURIOUS_DISABLED))
                        continue;
+                local_irq_disable();
                try_one_irq(i, desc);
+                local_irq_enable();
        }
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index cfadc1291d0b..5240d75f4c60 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1333,7 +1333,7 @@ static int __kprobes kprobes_open(struct inode *inode, struct file *filp)
        return seq_open(filp, &kprobes_seq_ops);
 }
-static struct file_operations debugfs_kprobes_operations = {
+static const struct file_operations debugfs_kprobes_operations = {
        .open           = kprobes_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
@@ -1515,7 +1515,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
        return count;
 }
-static struct file_operations fops_kp = {
+static const struct file_operations fops_kp = {
        .read =         read_enabled_file_bool,
        .write =        write_enabled_file_bool,
 };
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 5fe709982caa..ab7ae57773e1 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -150,29 +150,6 @@ struct task_struct *kthread_create(int (*threadfn)(void *data),
 EXPORT_SYMBOL(kthread_create);
 /**
- * kthread_bind - bind a just-created kthread to a cpu.
- * @k: thread created by kthread_create().
- * @cpu: cpu (might not be online, must be possible) for @k to run on.
- *
- * Description: This function is equivalent to set_cpus_allowed(),
- * except that @cpu doesn't need to be online, and the thread must be
- * stopped (i.e., just returned from kthread_create()).
- */
-void kthread_bind(struct task_struct *k, unsigned int cpu)
-{
-        /* Must have done schedule() in kthread() before we set_task_cpu */
-        if (!wait_task_inactive(k, TASK_UNINTERRUPTIBLE)) {
-                WARN_ON(1);
-                return;
-        }
-        set_task_cpu(k, cpu);
-        k->cpus_allowed = cpumask_of_cpu(cpu);
-        k->rt.nr_cpus_allowed = 1;
-        k->flags |= PF_THREAD_BOUND;
-}
-EXPORT_SYMBOL(kthread_bind);
-/**
 * kthread_stop - stop a thread created by kthread_create().
 * @k: thread created by kthread_create().
 *
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 3815ac1d58b2..9af56723c096 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -142,6 +142,11 @@ static inline struct lock_class *hlock_class(struct held_lock *hlock)
 #ifdef CONFIG_LOCK_STAT
 static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], lock_stats);
+static inline u64 lockstat_clock(void)
+{
+        return cpu_clock(smp_processor_id());
+}
 static int lock_point(unsigned long points[], unsigned long ip)
 {
        int i;
@@ -158,7 +163,7 @@ static int lock_point(unsigned long points[], unsigned long ip)
        return i;
 }
-static void lock_time_inc(struct lock_time *lt, s64 time)
+static void lock_time_inc(struct lock_time *lt, u64 time)
 {
        if (time > lt->max)
                lt->max = time;
@@ -234,12 +239,12 @@ static void put_lock_stats(struct lock_class_stats *stats)
 static void lock_release_holdtime(struct held_lock *hlock)
 {
        struct lock_class_stats *stats;
-        s64 holdtime;
+        u64 holdtime;
        if (!lock_stat)
                return;
-        holdtime = sched_clock() - hlock->holdtime_stamp;
+        holdtime = lockstat_clock() - hlock->holdtime_stamp;
        stats = get_lock_stats(hlock_class(hlock));
        if (hlock->read)
@@ -2792,7 +2797,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
        hlock->references = references;
 #ifdef CONFIG_LOCK_STAT
        hlock->waittime_stamp = 0;
-        hlock->holdtime_stamp = sched_clock();
+        hlock->holdtime_stamp = lockstat_clock();
 #endif
        if (check == 2 && !mark_irqflags(curr, hlock))
@@ -3322,7 +3327,7 @@ found_it:
        if (hlock->instance != lock)
                return;
-        hlock->waittime_stamp = sched_clock();
+        hlock->waittime_stamp = lockstat_clock();
        contention_point = lock_point(hlock_class(hlock)->contention_point, ip);
        contending_point = lock_point(hlock_class(hlock)->contending_point,
@@ -3345,8 +3350,7 @@ __lock_acquired(struct lockdep_map *lock, unsigned long ip)
        struct held_lock *hlock, *prev_hlock;
        struct lock_class_stats *stats;
        unsigned int depth;
-        u64 now;
+        u64 now, waittime = 0;
-        s64 waittime = 0;
        int i, cpu;
        depth = curr->lockdep_depth;
@@ -3374,7 +3378,7 @@ found_it:
        cpu = smp_processor_id();
        if (hlock->waittime_stamp) {
-                now = sched_clock();
+                now = lockstat_clock();
                waittime = now - hlock->waittime_stamp;
                hlock->holdtime_stamp = now;
        }
diff --git a/kernel/module.c b/kernel/module.c
index 5a29397ca4b6..8b7d8805819d 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1992,12 +1992,14 @@ static inline unsigned long layout_symtab(struct module *mod,
                                          Elf_Shdr *sechdrs,
                                          unsigned int symindex,
                                          unsigned int strindex,
-                                          const Elf_Hdr *hdr,
+                                          const Elf_Ehdr *hdr,
                                          const char *secstrings,
                                          unsigned long *pstroffs,
                                          unsigned long *strmap)
 {
+        return 0;
 }
 static inline void add_kallsyms(struct module *mod,
                                Elf_Shdr *sechdrs,
                                unsigned int shnum,
@@ -2081,9 +2083,8 @@ static noinline struct module *load_module(void __user *umod,
        struct module *mod;
        long err = 0;
        void *percpu = NULL, *ptr = NULL; /* Stops spurious gcc warning */
-#ifdef CONFIG_KALLSYMS
        unsigned long symoffs, stroffs, *strmap;
-#endif
        mm_segment_t old_fs;
        DEBUGP("load_module: umod=%p, len=%lu, uargs=%p\n",
@@ -3091,7 +3092,6 @@ void module_layout(struct module *mod,
                   struct modversion_info *ver,
                   struct kernel_param *kp,
                   struct kernel_symbol *ks,
-                   struct marker *marker,
                   struct tracepoint *tp)
 {
 }
diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
index 50d022e5a560..ec815a960b5d 100644
--- a/kernel/mutex-debug.c
+++ b/kernel/mutex-debug.c
@@ -16,6 +16,7 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/poison.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/kallsyms.h>
 #include <linux/interrupt.h>
diff --git a/kernel/panic.c b/kernel/panic.c
index bcdef26e3332..96b45d0b4ba5 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -90,6 +90,8 @@ NORET_TYPE void panic(const char * fmt, ...)
        atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
+        bust_spinlocks(0);
        if (!panic_blink)
                panic_blink = no_blink;
@@ -136,7 +138,6 @@ NORET_TYPE void panic(const char * fmt, ...)
                mdelay(1);
                i++;
        }
-        bust_spinlocks(0);
 }
 EXPORT_SYMBOL(panic);
diff --git a/kernel/params.c b/kernel/params.c
index 9da58eabdcb2..d656c276508d 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -218,15 +218,11 @@ int param_set_charp(const char *val, struct kernel_param *kp)
                return -ENOSPC;
        }
-        if (kp->flags & KPARAM_KMALLOCED)
-                kfree(*(char **)kp->arg);
        /* This is a hack.  We can't need to strdup in early boot, and we
         * don't need to; this mangled commandline is preserved. */
        if (slab_is_available()) {
-                kp->flags |= KPARAM_KMALLOCED;
                *(char **)kp->arg = kstrdup(val, GFP_KERNEL);
-                if (!kp->arg)
+                if (!*(char **)kp->arg)
                        return -ENOMEM;
        } else
                *(const char **)kp->arg = val;
@@ -304,6 +300,7 @@ static int param_array(const char *name,
                       unsigned int min, unsigned int max,
                       void *elem, int elemsize,
                       int (*set)(const char *, struct kernel_param *kp),
+                       u16 flags,
                       unsigned int *num)
 {
        int ret;
@@ -313,6 +310,7 @@ static int param_array(const char *name,
        /* Get the name right for errors. */
        kp.name = name;
        kp.arg = elem;
+        kp.flags = flags;
        /* No equals sign? */
        if (!val) {
@@ -358,7 +356,8 @@ int param_array_set(const char *val, struct kernel_param *kp)
        unsigned int temp_num;
        return param_array(kp->name, val, 1, arr->max, arr->elem,
-                           arr->elemsize, arr->set, arr->num ?: &temp_num);
+                           arr->elemsize, arr->set, kp->flags,
+                           arr->num ?: &temp_num);
 }
 int param_array_get(char *buffer, struct kernel_param *kp)
@@ -605,11 +604,7 @@ void module_param_sysfs_remove(struct module *mod)
 void destroy_params(const struct kernel_param *params, unsigned num)
 {
-        unsigned int i;
+        /* FIXME: This should free kmalloced charp parameters.  It doesn't. */
-        for (i = 0; i < num; i++)
-                if (params[i].flags & KPARAM_KMALLOCED)
-                        kfree(*(char **)params[i].arg);
 }
 static void __init kernel_add_sysfs_param(const char *name,
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 76ac4db405e9..7f29643c8985 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -20,6 +20,7 @@
 #include <linux/percpu.h>
 #include <linux/ptrace.h>
 #include <linux/vmstat.h>
+#include <linux/vmalloc.h>
 #include <linux/hardirq.h>
 #include <linux/rculist.h>
 #include <linux/uaccess.h>
@@ -1030,14 +1031,10 @@ void __perf_event_sched_out(struct perf_event_context *ctx,
        update_context_time(ctx);
        perf_disable();
-        if (ctx->nr_active) {
+        if (ctx->nr_active)
-                list_for_each_entry(event, &ctx->group_list, group_entry) {
+                list_for_each_entry(event, &ctx->group_list, group_entry)
-                        if (event != event->group_leader)
+                        group_sched_out(event, cpuctx, ctx);
-                                event_sched_out(event, cpuctx, ctx);
-                        else
-                                group_sched_out(event, cpuctx, ctx);
-                }
-        }
        perf_enable();
 out:
        spin_unlock(&ctx->lock);
@@ -1258,12 +1255,8 @@ __perf_event_sched_in(struct perf_event_context *ctx,
                if (event->cpu != -1 && event->cpu != cpu)
                        continue;
-                if (event != event->group_leader)
+                if (group_can_go_on(event, cpuctx, 1))
-                        event_sched_in(event, cpuctx, ctx, cpu);
+                        group_sched_in(event, cpuctx, ctx, cpu);
-                else {
-                        if (group_can_go_on(event, cpuctx, 1))
-                                group_sched_in(event, cpuctx, ctx, cpu);
-                }
                /*
                 * If this pinned group hasn't been scheduled,
@@ -1291,15 +1284,9 @@ __perf_event_sched_in(struct perf_event_context *ctx,
                if (event->cpu != -1 && event->cpu != cpu)
                        continue;
-                if (event != event->group_leader) {
+                if (group_can_go_on(event, cpuctx, can_add_hw))
-                        if (event_sched_in(event, cpuctx, ctx, cpu))
+                        if (group_sched_in(event, cpuctx, ctx, cpu))
                                can_add_hw = 0;
-                } else {
-                        if (group_can_go_on(event, cpuctx, can_add_hw)) {
-                                if (group_sched_in(event, cpuctx, ctx, cpu))
-                                        can_add_hw = 0;
-                        }
-                }
        }
        perf_enable();
 out:
@@ -1368,7 +1355,7 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
        u64 interrupts, freq;
        spin_lock(&ctx->lock);
-        list_for_each_entry(event, &ctx->group_list, group_entry) {
+        list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
                if (event->state != PERF_EVENT_STATE_ACTIVE)
                        continue;
@@ -2105,49 +2092,31 @@ unlock:
        rcu_read_unlock();
 }
-static int perf_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+static unsigned long perf_data_size(struct perf_mmap_data *data)
 {
-        struct perf_event *event = vma->vm_file->private_data;
+        return data->nr_pages << (PAGE_SHIFT + data->data_order);
-        struct perf_mmap_data *data;
+}
-        int ret = VM_FAULT_SIGBUS;
-        if (vmf->flags & FAULT_FLAG_MKWRITE) {
-                if (vmf->pgoff == 0)
-                        ret = 0;
-                return ret;
-        }
-        rcu_read_lock();
-        data = rcu_dereference(event->data);
-        if (!data)
-                goto unlock;
-        if (vmf->pgoff == 0) {
-                vmf->page = virt_to_page(data->user_page);
-        } else {
-                int nr = vmf->pgoff - 1;
-                if ((unsigned)nr > data->nr_pages)
-                        goto unlock;
-                if (vmf->flags & FAULT_FLAG_WRITE)
+#ifndef CONFIG_PERF_USE_VMALLOC
-                        goto unlock;
-                vmf->page = virt_to_page(data->data_pages[nr]);
+/*
-        }
+ * Back perf_mmap() with regular GFP_KERNEL-0 pages.
+ */
-        get_page(vmf->page);
+static struct page *
-        vmf->page->mapping = vma->vm_file->f_mapping;
+perf_mmap_to_page(struct perf_mmap_data *data, unsigned long pgoff)
-        vmf->page->index   = vmf->pgoff;
+{
+        if (pgoff > data->nr_pages)
+                return NULL;
-        ret = 0;
+        if (pgoff == 0)
-unlock:
+                return virt_to_page(data->user_page);
-        rcu_read_unlock();
-        return ret;
+        return virt_to_page(data->data_pages[pgoff - 1]);
 }
-static int perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
+static struct perf_mmap_data *
+perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
 {
        struct perf_mmap_data *data;
        unsigned long size;
@@ -2172,19 +2141,10 @@ static int perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
                        goto fail_data_pages;
        }
+        data->data_order = 0;
        data->nr_pages = nr_pages;
-        atomic_set(&data->lock, -1);
-        if (event->attr.watermark) {
-                data->watermark = min_t(long, PAGE_SIZE * nr_pages,
-                                      event->attr.wakeup_watermark);
-        }
-        if (!data->watermark)
-                data->watermark = max(PAGE_SIZE, PAGE_SIZE * nr_pages / 4);
-        rcu_assign_pointer(event->data, data);
-        return 0;
+        return data;
 fail_data_pages:
        for (i--; i >= 0; i--)
@@ -2196,7 +2156,7 @@ fail_user_page:
        kfree(data);
 fail:
-        return -ENOMEM;
+        return NULL;
 }
 static void perf_mmap_free_page(unsigned long addr)
@@ -2207,28 +2167,169 @@ static void perf_mmap_free_page(unsigned long addr)
        __free_page(page);
 }
-static void __perf_mmap_data_free(struct rcu_head *rcu_head)
+static void perf_mmap_data_free(struct perf_mmap_data *data)
 {
-        struct perf_mmap_data *data;
        int i;
-        data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
        perf_mmap_free_page((unsigned long)data->user_page);
        for (i = 0; i < data->nr_pages; i++)
                perf_mmap_free_page((unsigned long)data->data_pages[i]);
+}
+#else
+/*
+ * Back perf_mmap() with vmalloc memory.
+ *
+ * Required for architectures that have d-cache aliasing issues.
+ */
+static struct page *
+perf_mmap_to_page(struct perf_mmap_data *data, unsigned long pgoff)
+{
+        if (pgoff > (1UL << data->data_order))
+                return NULL;
+        return vmalloc_to_page((void *)data->user_page + pgoff * PAGE_SIZE);
+}
+static void perf_mmap_unmark_page(void *addr)
+{
+        struct page *page = vmalloc_to_page(addr);
+        page->mapping = NULL;
+}
+static void perf_mmap_data_free_work(struct work_struct *work)
+{
+        struct perf_mmap_data *data;
+        void *base;
+        int i, nr;
+        data = container_of(work, struct perf_mmap_data, work);
+        nr = 1 << data->data_order;
+        base = data->user_page;
+        for (i = 0; i < nr + 1; i++)
+                perf_mmap_unmark_page(base + (i * PAGE_SIZE));
+        vfree(base);
+}
+static void perf_mmap_data_free(struct perf_mmap_data *data)
+{
+        schedule_work(&data->work);
+}
+static struct perf_mmap_data *
+perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
+{
+        struct perf_mmap_data *data;
+        unsigned long size;
+        void *all_buf;
+        WARN_ON(atomic_read(&event->mmap_count));
+        size = sizeof(struct perf_mmap_data);
+        size += sizeof(void *);
+        data = kzalloc(size, GFP_KERNEL);
+        if (!data)
+                goto fail;
+        INIT_WORK(&data->work, perf_mmap_data_free_work);
+        all_buf = vmalloc_user((nr_pages + 1) * PAGE_SIZE);
+        if (!all_buf)
+                goto fail_all_buf;
+        data->user_page = all_buf;
+        data->data_pages[0] = all_buf + PAGE_SIZE;
+        data->data_order = ilog2(nr_pages);
+        data->nr_pages = 1;
+        return data;
+fail_all_buf:
        kfree(data);
+fail:
+        return NULL;
 }
-static void perf_mmap_data_free(struct perf_event *event)
+#endif
+static int perf_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct perf_event *event = vma->vm_file->private_data;
+        struct perf_mmap_data *data;
+        int ret = VM_FAULT_SIGBUS;
+        if (vmf->flags & FAULT_FLAG_MKWRITE) {
+                if (vmf->pgoff == 0)
+                        ret = 0;
+                return ret;
+        }
+        rcu_read_lock();
+        data = rcu_dereference(event->data);
+        if (!data)
+                goto unlock;
+        if (vmf->pgoff && (vmf->flags & FAULT_FLAG_WRITE))
+                goto unlock;
+        vmf->page = perf_mmap_to_page(data, vmf->pgoff);
+        if (!vmf->page)
+                goto unlock;
+        get_page(vmf->page);
+        vmf->page->mapping = vma->vm_file->f_mapping;
+        vmf->page->index   = vmf->pgoff;
+        ret = 0;
+unlock:
+        rcu_read_unlock();
+        return ret;
+}
+static void
+perf_mmap_data_init(struct perf_event *event, struct perf_mmap_data *data)
+{
+        long max_size = perf_data_size(data);
+        atomic_set(&data->lock, -1);
+        if (event->attr.watermark) {
+                data->watermark = min_t(long, max_size,
+                                        event->attr.wakeup_watermark);
+        }
+        if (!data->watermark)
+                data->watermark = max_t(long, PAGE_SIZE, max_size / 2);
+        rcu_assign_pointer(event->data, data);
+}
+static void perf_mmap_data_free_rcu(struct rcu_head *rcu_head)
+{
+        struct perf_mmap_data *data;
+        data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
+        perf_mmap_data_free(data);
+        kfree(data);
+}
+static void perf_mmap_data_release(struct perf_event *event)
 {
        struct perf_mmap_data *data = event->data;
        WARN_ON(atomic_read(&event->mmap_count));
        rcu_assign_pointer(event->data, NULL);
-        call_rcu(&data->rcu_head, __perf_mmap_data_free);
+        call_rcu(&data->rcu_head, perf_mmap_data_free_rcu);
 }
 static void perf_mmap_open(struct vm_area_struct *vma)
@@ -2244,16 +2345,17 @@ static void perf_mmap_close(struct vm_area_struct *vma)
        WARN_ON_ONCE(event->ctx->parent_ctx);
        if (atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) {
+                unsigned long size = perf_data_size(event->data);
                struct user_struct *user = current_user();
-                atomic_long_sub(event->data->nr_pages + 1, &user->locked_vm);
+                atomic_long_sub((size >> PAGE_SHIFT) + 1, &user->locked_vm);
                vma->vm_mm->locked_vm -= event->data->nr_locked;
-                perf_mmap_data_free(event);
+                perf_mmap_data_release(event);
                mutex_unlock(&event->mmap_mutex);
        }
 }
-static struct vm_operations_struct perf_mmap_vmops = {
+static const struct vm_operations_struct perf_mmap_vmops = {
        .open           = perf_mmap_open,
        .close          = perf_mmap_close,
        .fault          = perf_mmap_fault,
@@ -2266,6 +2368,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
        unsigned long user_locked, user_lock_limit;
        struct user_struct *user = current_user();
        unsigned long locked, lock_limit;
+        struct perf_mmap_data *data;
        unsigned long vma_size;
        unsigned long nr_pages;
        long user_extra, extra;
@@ -2328,10 +2431,15 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
        }
        WARN_ON(event->data);
-        ret = perf_mmap_data_alloc(event, nr_pages);
-        if (ret)
+        data = perf_mmap_data_alloc(event, nr_pages);
+        ret = -ENOMEM;
+        if (!data)
                goto unlock;
+        ret = 0;
+        perf_mmap_data_init(event, data);
        atomic_set(&event->mmap_count, 1);
        atomic_long_add(user_extra, &user->locked_vm);
        vma->vm_mm->locked_vm += extra;
@@ -2519,7 +2627,7 @@ static bool perf_output_space(struct perf_mmap_data *data, unsigned long tail,
        if (!data->writable)
                return true;
-        mask = (data->nr_pages << PAGE_SHIFT) - 1;
+        mask = perf_data_size(data) - 1;
        offset = (offset - tail) & mask;
        head   = (head   - tail) & mask;
@@ -2624,7 +2732,7 @@ void perf_output_copy(struct perf_output_handle *handle,
                      const void *buf, unsigned int len)
 {
        unsigned int pages_mask;
-        unsigned int offset;
+        unsigned long offset;
        unsigned int size;
        void **pages;
@@ -2633,12 +2741,14 @@ void perf_output_copy(struct perf_output_handle *handle,
        pages           = handle->data->data_pages;
        do {
-                unsigned int page_offset;
+                unsigned long page_offset;
+                unsigned long page_size;
                int nr;
                nr          = (offset >> PAGE_SHIFT) & pages_mask;
-                page_offset = offset & (PAGE_SIZE - 1);
+                page_size   = 1UL << (handle->data->data_order + PAGE_SHIFT);
-                size        = min_t(unsigned int, PAGE_SIZE - page_offset, len);
+                page_offset = offset & (page_size - 1);
+                size        = min_t(unsigned int, page_size - page_offset, len);
                memcpy(pages[nr] + page_offset, buf, size);
@@ -3849,8 +3959,9 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
                regs = task_pt_regs(current);
        if (regs) {
-                if (perf_event_overflow(event, 0, &data, regs))
+                if (!(event->attr.exclude_idle && current->pid == 0))
-                        ret = HRTIMER_NORESTART;
+                        if (perf_event_overflow(event, 0, &data, regs))
+                                ret = HRTIMER_NORESTART;
        }
        period = max_t(u64, 10000, event->hw.sample_period);
@@ -3859,6 +3970,42 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
        return ret;
 }
+static void perf_swevent_start_hrtimer(struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hwc->hrtimer.function = perf_swevent_hrtimer;
+        if (hwc->sample_period) {
+                u64 period;
+                if (hwc->remaining) {
+                        if (hwc->remaining < 0)
+                                period = 10000;
+                        else
+                                period = hwc->remaining;
+                        hwc->remaining = 0;
+                } else {
+                        period = max_t(u64, 10000, hwc->sample_period);
+                }
+                __hrtimer_start_range_ns(&hwc->hrtimer,
+                                ns_to_ktime(period), 0,
+                                HRTIMER_MODE_REL, 0);
+        }
+}
+static void perf_swevent_cancel_hrtimer(struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        if (hwc->sample_period) {
+                ktime_t remaining = hrtimer_get_remaining(&hwc->hrtimer);
+                hwc->remaining = ktime_to_ns(remaining);
+                hrtimer_cancel(&hwc->hrtimer);
+        }
+}
 /*
 * Software event: cpu wall time clock
 */
@@ -3881,22 +4028,14 @@ static int cpu_clock_perf_event_enable(struct perf_event *event)
        int cpu = raw_smp_processor_id();
        atomic64_set(&hwc->prev_count, cpu_clock(cpu));
-        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        perf_swevent_start_hrtimer(event);
-        hwc->hrtimer.function = perf_swevent_hrtimer;
-        if (hwc->sample_period) {
-                u64 period = max_t(u64, 10000, hwc->sample_period);
-                __hrtimer_start_range_ns(&hwc->hrtimer,
-                                ns_to_ktime(period), 0,
-                                HRTIMER_MODE_REL, 0);
-        }
        return 0;
 }
 static void cpu_clock_perf_event_disable(struct perf_event *event)
 {
-        if (event->hw.sample_period)
+        perf_swevent_cancel_hrtimer(event);
-                hrtimer_cancel(&event->hw.hrtimer);
        cpu_clock_perf_event_update(event);
 }
@@ -3933,22 +4072,15 @@ static int task_clock_perf_event_enable(struct perf_event *event)
        now = event->ctx->time;
        atomic64_set(&hwc->prev_count, now);
-        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        hwc->hrtimer.function = perf_swevent_hrtimer;
+        perf_swevent_start_hrtimer(event);
-        if (hwc->sample_period) {
-                u64 period = max_t(u64, 10000, hwc->sample_period);
-                __hrtimer_start_range_ns(&hwc->hrtimer,
-                                ns_to_ktime(period), 0,
-                                HRTIMER_MODE_REL, 0);
-        }
        return 0;
 }
 static void task_clock_perf_event_disable(struct perf_event *event)
 {
-        if (event->hw.sample_period)
+        perf_swevent_cancel_hrtimer(event);
-                hrtimer_cancel(&event->hw.hrtimer);
        task_clock_perf_event_update(event, event->ctx->time);
 }
@@ -4781,9 +4913,7 @@ int perf_event_init_task(struct task_struct *child)
         * We dont have to disable NMIs - we are only looking at
         * the list, not manipulating it:
         */
-        list_for_each_entry_rcu(event, &parent_ctx->event_list, event_entry) {
+        list_for_each_entry(event, &parent_ctx->group_list, group_entry) {
-                if (event != event->group_leader)
-                        continue;
                if (!event->attr.inherit) {
                        inherited_all = 0;
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 04b3a83d686f..04a9e90d248f 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -693,21 +693,22 @@ static int software_resume(void)
        /* The snapshot device should not be opened while we're running */
        if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
                error = -EBUSY;
+                swsusp_close(FMODE_READ);
                goto Unlock;
        }
        pm_prepare_console();
        error = pm_notifier_call_chain(PM_RESTORE_PREPARE);
        if (error)
-                goto Finish;
+                goto close_finish;
        error = usermodehelper_disable();
        if (error)
-                goto Finish;
+                goto close_finish;
        error = create_basic_memory_bitmaps();
        if (error)
-                goto Finish;
+                goto close_finish;
        pr_debug("PM: Preparing processes for restore.\n");
        error = prepare_processes();
@@ -719,6 +720,7 @@ static int software_resume(void)
        pr_debug("PM: Reading hibernation image.\n");
        error = swsusp_read(&flags);
+        swsusp_close(FMODE_READ);
        if (!error)
                hibernation_restore(flags & SF_PLATFORM_MODE);
@@ -737,6 +739,9 @@ static int software_resume(void)
        mutex_unlock(&pm_mutex);
        pr_debug("PM: Resume from disk failed.\n");
        return error;
+close_finish:
+        swsusp_close(FMODE_READ);
+        goto Finish;
 }
 late_initcall(software_resume);
diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
index 17d8bb1acf9c..25596e450ac7 100644
--- a/kernel/power/suspend_test.c
+++ b/kernel/power/suspend_test.c
@@ -19,7 +19,7 @@
 * The time it takes is system-specific though, so when we test this
 * during system bootup we allow a LOT of time.
 */
-#define TEST_SUSPEND_SECONDS    5
+#define TEST_SUSPEND_SECONDS    10
 static unsigned long suspend_test_start_time;
@@ -49,7 +49,8 @@ void suspend_test_finish(const char *label)
         * has some performance issues.  The stack dump of a WARN_ON
         * is more likely to get the right attention than a printk...
         */
-        WARN(msec > (TEST_SUSPEND_SECONDS * 1000), "Component: %s\n", label);
+        WARN(msec > (TEST_SUSPEND_SECONDS * 1000),
+             "Component: %s, time: %u\n", label, msec);
 }
 /*
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index b101cdc4df3f..890f6b11b1d3 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -314,7 +314,6 @@ static int save_image(struct swap_map_handle *handle,
 {
        unsigned int m;
        int ret;
-        int error = 0;
        int nr_pages;
        int err2;
        struct bio *bio;
@@ -329,26 +328,27 @@ static int save_image(struct swap_map_handle *handle,
        nr_pages = 0;
        bio = NULL;
        do_gettimeofday(&start);
-        do {
+        while (1) {
                ret = snapshot_read_next(snapshot, PAGE_SIZE);
-                if (ret > 0) {
+                if (ret <= 0)
-                        error = swap_write_page(handle, data_of(*snapshot),
+                        break;
-                                                &bio);
+                ret = swap_write_page(handle, data_of(*snapshot), &bio);
-                        if (error)
+                if (ret)
-                                break;
+                        break;
-                        if (!(nr_pages % m))
+                if (!(nr_pages % m))
-                                printk("\b\b\b\b%3d%%", nr_pages / m);
+                        printk("\b\b\b\b%3d%%", nr_pages / m);
-                        nr_pages++;
+                nr_pages++;
-                }
+        }
-        } while (ret > 0);
        err2 = wait_on_bio_chain(&bio);
        do_gettimeofday(&stop);
-        if (!error)
+        if (!ret)
-                error = err2;
+                ret = err2;
-        if (!error)
+        if (!ret)
                printk("\b\b\b\bdone\n");
+        else
+                printk("\n");
        swsusp_show_speed(&start, &stop, nr_to_write, "Wrote");
-        return error;
+        return ret;
 }
 /**
@@ -536,7 +536,8 @@ static int load_image(struct swap_map_handle *handle,
                snapshot_write_finalize(snapshot);
                if (!snapshot_image_loaded(snapshot))
                        error = -ENODATA;
-        }
+        } else
+                printk("\n");
        swsusp_show_speed(&start, &stop, nr_to_read, "Read");
        return error;
 }
@@ -572,8 +573,6 @@ int swsusp_read(unsigned int *flags_p)
                error = load_image(&handle, &snapshot, header->pages - 1);
        release_swap_reader(&handle);
-        blkdev_put(resume_bdev, FMODE_READ);
        if (!error)
                pr_debug("PM: Image successfully loaded\n");
        else
@@ -596,7 +595,7 @@ int swsusp_check(void)
                error = bio_read_page(swsusp_resume_block,
                                        swsusp_header, NULL);
                if (error)
-                        return error;
+                        goto put;
                if (!memcmp(SWSUSP_SIG, swsusp_header->sig, 10)) {
                        memcpy(swsusp_header->sig, swsusp_header->orig_sig, 10);
@@ -604,8 +603,10 @@ int swsusp_check(void)
                        error = bio_write_page(swsusp_resume_block,
                                                swsusp_header, NULL);
                } else {
-                        return -EINVAL;
+                        error = -EINVAL;
                }
+put:
                if (error)
                        blkdev_put(resume_bdev, FMODE_READ);
                else
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 37ac45483082..400183346ad2 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -46,22 +46,15 @@
 #include <linux/module.h>
 #include <linux/kernel_stat.h>
-enum rcu_barrier {
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        RCU_BARRIER_STD,
+static struct lock_class_key rcu_lock_key;
-        RCU_BARRIER_BH,
+struct lockdep_map rcu_lock_map =
-        RCU_BARRIER_SCHED,
+        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock", &rcu_lock_key);
-};
+EXPORT_SYMBOL_GPL(rcu_lock_map);
+#endif
-static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
-static atomic_t rcu_barrier_cpu_count;
-static DEFINE_MUTEX(rcu_barrier_mutex);
-static struct completion rcu_barrier_completion;
 int rcu_scheduler_active __read_mostly;
-static atomic_t rcu_migrate_type_count = ATOMIC_INIT(0);
-static struct rcu_head rcu_migrate_head[3];
-static DECLARE_WAIT_QUEUE_HEAD(rcu_migrate_wq);
 /*
 * Awaken the corresponding synchronize_rcu() instance now that a
 * grace period has elapsed.
@@ -164,129 +157,10 @@ void synchronize_rcu_bh(void)
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_bh);
-static void rcu_barrier_callback(struct rcu_head *notused)
-{
-        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
-                complete(&rcu_barrier_completion);
-}
-/*
- * Called with preemption disabled, and from cross-cpu IRQ context.
- */
-static void rcu_barrier_func(void *type)
-{
-        int cpu = smp_processor_id();
-        struct rcu_head *head = &per_cpu(rcu_barrier_head, cpu);
-        atomic_inc(&rcu_barrier_cpu_count);
-        switch ((enum rcu_barrier)type) {
-        case RCU_BARRIER_STD:
-                call_rcu(head, rcu_barrier_callback);
-                break;
-        case RCU_BARRIER_BH:
-                call_rcu_bh(head, rcu_barrier_callback);
-                break;
-        case RCU_BARRIER_SCHED:
-                call_rcu_sched(head, rcu_barrier_callback);
-                break;
-        }
-}
-static inline void wait_migrated_callbacks(void)
-{
-        wait_event(rcu_migrate_wq, !atomic_read(&rcu_migrate_type_count));
-        smp_mb(); /* In case we didn't sleep. */
-}
-/*
- * Orchestrate the specified type of RCU barrier, waiting for all
- * RCU callbacks of the specified type to complete.
- */
-static void _rcu_barrier(enum rcu_barrier type)
-{
-        BUG_ON(in_interrupt());
-        /* Take cpucontrol mutex to protect against CPU hotplug */
-        mutex_lock(&rcu_barrier_mutex);
-        init_completion(&rcu_barrier_completion);
-        /*
-         * Initialize rcu_barrier_cpu_count to 1, then invoke
-         * rcu_barrier_func() on each CPU, so that each CPU also has
-         * incremented rcu_barrier_cpu_count.  Only then is it safe to
-         * decrement rcu_barrier_cpu_count -- otherwise the first CPU
-         * might complete its grace period before all of the other CPUs
-         * did their increment, causing this function to return too
-         * early.
-         */
-        atomic_set(&rcu_barrier_cpu_count, 1);
-        on_each_cpu(rcu_barrier_func, (void *)type, 1);
-        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
-                complete(&rcu_barrier_completion);
-        wait_for_completion(&rcu_barrier_completion);
-        mutex_unlock(&rcu_barrier_mutex);
-        wait_migrated_callbacks();
-}
-/**
- * rcu_barrier - Wait until all in-flight call_rcu() callbacks complete.
- */
-void rcu_barrier(void)
-{
-        _rcu_barrier(RCU_BARRIER_STD);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier);
-/**
- * rcu_barrier_bh - Wait until all in-flight call_rcu_bh() callbacks complete.
- */
-void rcu_barrier_bh(void)
-{
-        _rcu_barrier(RCU_BARRIER_BH);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier_bh);
-/**
- * rcu_barrier_sched - Wait for in-flight call_rcu_sched() callbacks.
- */
-void rcu_barrier_sched(void)
-{
-        _rcu_barrier(RCU_BARRIER_SCHED);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier_sched);
-static void rcu_migrate_callback(struct rcu_head *notused)
-{
-        if (atomic_dec_and_test(&rcu_migrate_type_count))
-                wake_up(&rcu_migrate_wq);
-}
-extern int rcu_cpu_notify(struct notifier_block *self,
-                          unsigned long action, void *hcpu);
 static int __cpuinit rcu_barrier_cpu_hotplug(struct notifier_block *self,
                unsigned long action, void *hcpu)
 {
-        rcu_cpu_notify(self, action, hcpu);
+        return rcu_cpu_notify(self, action, hcpu);
-        if (action == CPU_DYING) {
-                /*
-                 * preempt_disable() in on_each_cpu() prevents stop_machine(),
-                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
-                 * returns, all online cpus have queued rcu_barrier_func(),
-                 * and the dead cpu(if it exist) queues rcu_migrate_callback()s.
-                 *
-                 * These callbacks ensure _rcu_barrier() waits for all
-                 * RCU callbacks of the specified type to complete.
-                 */
-                atomic_set(&rcu_migrate_type_count, 3);
-                call_rcu_bh(rcu_migrate_head, rcu_migrate_callback);
-                call_rcu_sched(rcu_migrate_head + 1, rcu_migrate_callback);
-                call_rcu(rcu_migrate_head + 2, rcu_migrate_callback);
-        } else if (action == CPU_DOWN_PREPARE) {
-                /* Don't need to wait until next removal operation. */
-                /* rcu_migrate_head is protected by cpu_add_remove_lock */
-                wait_migrated_callbacks();
-        }
-        return NOTIFY_OK;
 }
 void __init rcu_init(void)
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 233768f21f97..697c0a0229d4 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -606,8 +606,6 @@ static struct rcu_torture_ops sched_ops_sync = {
        .name           = "sched_sync"
 };
-extern int rcu_expedited_torture_stats(char *page);
 static struct rcu_torture_ops sched_expedited_ops = {
        .init           = rcu_sync_torture_init,
        .cleanup        = NULL,
@@ -650,7 +648,7 @@ rcu_torture_writer(void *arg)
                old_rp = rcu_torture_current;
                rp->rtort_mbtest = 1;
                rcu_assign_pointer(rcu_torture_current, rp);
-                smp_wmb();
+                smp_wmb(); /* Mods to old_rp must follow rcu_assign_pointer() */
                if (old_rp) {
                        i = old_rp->rtort_pipe_count;
                        if (i > RCU_TORTURE_PIPE_LEN)
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 52b06f6e158c..f3077c0ab181 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -49,13 +49,6 @@
 #include "rcutree.h"
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-static struct lock_class_key rcu_lock_key;
-struct lockdep_map rcu_lock_map =
-        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock", &rcu_lock_key);
-EXPORT_SYMBOL_GPL(rcu_lock_map);
-#endif
 /* Data structures. */
 #define RCU_STATE_INITIALIZER(name) { \
@@ -66,10 +59,13 @@ EXPORT_SYMBOL_GPL(rcu_lock_map);
                NUM_RCU_LVL_2, \
                NUM_RCU_LVL_3, /* == MAX_RCU_LVLS */ \
        }, \
-        .signaled = RCU_SIGNAL_INIT, \
+        .signaled = RCU_GP_IDLE, \
        .gpnum = -300, \
        .completed = -300, \
        .onofflock = __SPIN_LOCK_UNLOCKED(&name.onofflock), \
+        .orphan_cbs_list = NULL, \
+        .orphan_cbs_tail = &name.orphan_cbs_list, \
+        .orphan_qlen = 0, \
        .fqslock = __SPIN_LOCK_UNLOCKED(&name.fqslock), \
        .n_force_qs = 0, \
        .n_force_qs_ngp = 0, \
@@ -81,24 +77,16 @@ DEFINE_PER_CPU(struct rcu_data, rcu_sched_data);
 struct rcu_state rcu_bh_state = RCU_STATE_INITIALIZER(rcu_bh_state);
 DEFINE_PER_CPU(struct rcu_data, rcu_bh_data);
-extern long rcu_batches_completed_sched(void);
-static struct rcu_node *rcu_get_root(struct rcu_state *rsp);
-static void cpu_quiet_msk(unsigned long mask, struct rcu_state *rsp,
-                          struct rcu_node *rnp, unsigned long flags);
-static void cpu_quiet_msk_finish(struct rcu_state *rsp, unsigned long flags);
-#ifdef CONFIG_HOTPLUG_CPU
-static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp);
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
-static void __rcu_process_callbacks(struct rcu_state *rsp,
-                                    struct rcu_data *rdp);
-static void __call_rcu(struct rcu_head *head,
-                       void (*func)(struct rcu_head *rcu),
-                       struct rcu_state *rsp);
-static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp);
-static void __cpuinit rcu_init_percpu_data(int cpu, struct rcu_state *rsp,
-                                           int preemptable);
-#include "rcutree_plugin.h"
+/*
+ * Return true if an RCU grace period is in progress.  The ACCESS_ONCE()s
+ * permit this function to be invoked without holding the root rcu_node
+ * structure's ->lock, but of course results can be subject to change.
+ */
+static int rcu_gp_in_progress(struct rcu_state *rsp)
+{
+        return ACCESS_ONCE(rsp->completed) != ACCESS_ONCE(rsp->gpnum);
+}
 /*
 * Note a quiescent state.  Because we do not need to know
@@ -137,6 +125,10 @@ static int blimit = 10;		/* Maximum callbacks per softirq. */
 static int qhimark = 10000;     /* If this many pending, ignore blimit. */
 static int qlowmark = 100;      /* Once only this many pending, use blimit. */
+module_param(blimit, int, 0);
+module_param(qhimark, int, 0);
+module_param(qlowmark, int, 0);
 static void force_quiescent_state(struct rcu_state *rsp, int relaxed);
 static int rcu_pending(int cpu);
@@ -173,9 +165,7 @@ cpu_has_callbacks_ready_to_invoke(struct rcu_data *rdp)
 static int
 cpu_needs_another_gp(struct rcu_state *rsp, struct rcu_data *rdp)
 {
-        /* ACCESS_ONCE() because we are accessing outside of lock. */
+        return *rdp->nxttail[RCU_DONE_TAIL] && !rcu_gp_in_progress(rsp);
-        return *rdp->nxttail[RCU_DONE_TAIL] &&
-               ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum);
 }
 /*
@@ -369,7 +359,7 @@ static long dyntick_recall_completed(struct rcu_state *rsp)
 /*
 * Snapshot the specified CPU's dynticks counter so that we can later
 * credit them with an implicit quiescent state.  Return 1 if this CPU
- * is already in a quiescent state courtesy of dynticks idle mode.
+ * is in dynticks idle mode, which is an extended quiescent state.
 */
 static int dyntick_save_progress_counter(struct rcu_data *rdp)
 {
@@ -475,30 +465,34 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
        long delta;
        unsigned long flags;
        struct rcu_node *rnp = rcu_get_root(rsp);
-        struct rcu_node *rnp_cur = rsp->level[NUM_RCU_LVLS - 1];
-        struct rcu_node *rnp_end = &rsp->node[NUM_RCU_NODES];
        /* Only let one CPU complain about others per time interval. */
        spin_lock_irqsave(&rnp->lock, flags);
        delta = jiffies - rsp->jiffies_stall;
-        if (delta < RCU_STALL_RAT_DELAY || rsp->gpnum == rsp->completed) {
+        if (delta < RCU_STALL_RAT_DELAY || !rcu_gp_in_progress(rsp)) {
                spin_unlock_irqrestore(&rnp->lock, flags);
                return;
        }
        rsp->jiffies_stall = jiffies + RCU_SECONDS_TILL_STALL_RECHECK;
+        /*
+         * Now rat on any tasks that got kicked up to the root rcu_node
+         * due to CPU offlining.
+         */
+        rcu_print_task_stall(rnp);
        spin_unlock_irqrestore(&rnp->lock, flags);
        /* OK, time to rat on our buddy... */
        printk(KERN_ERR "INFO: RCU detected CPU stalls:");
-        for (; rnp_cur < rnp_end; rnp_cur++) {
+        rcu_for_each_leaf_node(rsp, rnp) {
                rcu_print_task_stall(rnp);
-                if (rnp_cur->qsmask == 0)
+                if (rnp->qsmask == 0)
                        continue;
-                for (cpu = 0; cpu <= rnp_cur->grphi - rnp_cur->grplo; cpu++)
+                for (cpu = 0; cpu <= rnp->grphi - rnp->grplo; cpu++)
-                        if (rnp_cur->qsmask & (1UL << cpu))
+                        if (rnp->qsmask & (1UL << cpu))
-                                printk(" %d", rnp_cur->grplo + cpu);
+                                printk(" %d", rnp->grplo + cpu);
        }
        printk(" (detected by %d, t=%ld jiffies)\n",
               smp_processor_id(), (long)(jiffies - rsp->gp_start));
@@ -537,8 +531,7 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
                /* We haven't checked in, so go dump stack. */
                print_cpu_stall(rsp);
-        } else if (rsp->gpnum != rsp->completed &&
+        } else if (rcu_gp_in_progress(rsp) && delta >= RCU_STALL_RAT_DELAY) {
-                   delta >= RCU_STALL_RAT_DELAY) {
                /* They had two time units to dump stack, so complain. */
                print_other_cpu_stall(rsp);
@@ -617,9 +610,15 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
        note_new_gpnum(rsp, rdp);
        /*
-         * Because we are first, we know that all our callbacks will
+         * Because this CPU just now started the new grace period, we know
-         * be covered by this upcoming grace period, even the ones
+         * that all of its callbacks will be covered by this upcoming grace
-         * that were registered arbitrarily recently.
+         * period, even the ones that were registered arbitrarily recently.
+         * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL.
+         *
+         * Other CPUs cannot be sure exactly when the grace period started.
+         * Therefore, their recently registered callbacks must pass through
+         * an additional RCU_NEXT_READY stage, so that they will be handled
+         * by the next RCU grace period.
         */
        rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
        rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
@@ -657,15 +656,18 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
         * one corresponding to this CPU, due to the fact that we have
         * irqs disabled.
         */
-        for (rnp = &rsp->node[0]; rnp < &rsp->node[NUM_RCU_NODES]; rnp++) {
+        rcu_for_each_node_breadth_first(rsp, rnp) {
-                spin_lock(&rnp->lock);  /* irqs already disabled. */
+                spin_lock(&rnp->lock);          /* irqs already disabled. */
                rcu_preempt_check_blocked_tasks(rnp);
                rnp->qsmask = rnp->qsmaskinit;
                rnp->gpnum = rsp->gpnum;
-                spin_unlock(&rnp->lock);        /* irqs already disabled. */
+                spin_unlock(&rnp->lock);        /* irqs remain disabled. */
        }
+        rnp = rcu_get_root(rsp);
+        spin_lock(&rnp->lock);                  /* irqs already disabled. */
        rsp->signaled = RCU_SIGNAL_INIT; /* force_quiescent_state now OK. */
+        spin_unlock(&rnp->lock);                /* irqs remain disabled. */
        spin_unlock_irqrestore(&rsp->onofflock, flags);
 }
@@ -703,10 +705,11 @@ rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp)
 * hold rnp->lock, as required by rcu_start_gp(), which will release it.
 */
 static void cpu_quiet_msk_finish(struct rcu_state *rsp, unsigned long flags)
-        __releases(rnp->lock)
+        __releases(rcu_get_root(rsp)->lock)
 {
-        WARN_ON_ONCE(rsp->completed == rsp->gpnum);
+        WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
        rsp->completed = rsp->gpnum;
+        rsp->signaled = RCU_GP_IDLE;
        rcu_process_gp_end(rsp, rsp->rda[smp_processor_id()]);
        rcu_start_gp(rsp, flags);  /* releases root node's rnp->lock. */
 }
@@ -842,17 +845,63 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
 #ifdef CONFIG_HOTPLUG_CPU
 /*
+ * Move a dying CPU's RCU callbacks to the ->orphan_cbs_list for the
+ * specified flavor of RCU.  The callbacks will be adopted by the next
+ * _rcu_barrier() invocation or by the CPU_DEAD notifier, whichever
+ * comes first.  Because this is invoked from the CPU_DYING notifier,
+ * irqs are already disabled.
+ */
+static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
+{
+        int i;
+        struct rcu_data *rdp = rsp->rda[smp_processor_id()];
+        if (rdp->nxtlist == NULL)
+                return;  /* irqs disabled, so comparison is stable. */
+        spin_lock(&rsp->onofflock);  /* irqs already disabled. */
+        *rsp->orphan_cbs_tail = rdp->nxtlist;
+        rsp->orphan_cbs_tail = rdp->nxttail[RCU_NEXT_TAIL];
+        rdp->nxtlist = NULL;
+        for (i = 0; i < RCU_NEXT_SIZE; i++)
+                rdp->nxttail[i] = &rdp->nxtlist;
+        rsp->orphan_qlen += rdp->qlen;
+        rdp->qlen = 0;
+        spin_unlock(&rsp->onofflock);  /* irqs remain disabled. */
+}
+/*
+ * Adopt previously orphaned RCU callbacks.
+ */
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+{
+        unsigned long flags;
+        struct rcu_data *rdp;
+        spin_lock_irqsave(&rsp->onofflock, flags);
+        rdp = rsp->rda[smp_processor_id()];
+        if (rsp->orphan_cbs_list == NULL) {
+                spin_unlock_irqrestore(&rsp->onofflock, flags);
+                return;
+        }
+        *rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_list;
+        rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_tail;
+        rdp->qlen += rsp->orphan_qlen;
+        rsp->orphan_cbs_list = NULL;
+        rsp->orphan_cbs_tail = &rsp->orphan_cbs_list;
+        rsp->orphan_qlen = 0;
+        spin_unlock_irqrestore(&rsp->onofflock, flags);
+}
+/*
 * Remove the outgoing CPU from the bitmasks in the rcu_node hierarchy
 * and move all callbacks from the outgoing CPU to the current one.
 */
 static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
 {
-        int i;
        unsigned long flags;
        long lastcomp;
        unsigned long mask;
        struct rcu_data *rdp = rsp->rda[cpu];
-        struct rcu_data *rdp_me;
        struct rcu_node *rnp;
        /* Exclude any attempts to start a new grace period. */
@@ -868,39 +917,29 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
                        spin_unlock(&rnp->lock); /* irqs remain disabled. */
                        break;
                }
-                rcu_preempt_offline_tasks(rsp, rnp, rdp);
+                /*
+                 * If there was a task blocking the current grace period,
+                 * and if all CPUs have checked in, we need to propagate
+                 * the quiescent state up the rcu_node hierarchy.  But that
+                 * is inconvenient at the moment due to deadlock issues if
+                 * this should end the current grace period.  So set the
+                 * offlined CPU's bit in ->qsmask in order to force the
+                 * next force_quiescent_state() invocation to clean up this
+                 * mess in a deadlock-free manner.
+                 */
+                if (rcu_preempt_offline_tasks(rsp, rnp, rdp) && !rnp->qsmask)
+                        rnp->qsmask |= mask;
                mask = rnp->grpmask;
                spin_unlock(&rnp->lock);        /* irqs remain disabled. */
                rnp = rnp->parent;
        } while (rnp != NULL);
        lastcomp = rsp->completed;
-        spin_unlock(&rsp->onofflock);           /* irqs remain disabled. */
+        spin_unlock_irqrestore(&rsp->onofflock, flags);
-        /*
+        rcu_adopt_orphan_cbs(rsp);
-         * Move callbacks from the outgoing CPU to the running CPU.
-         * Note that the outgoing CPU is now quiscent, so it is now
-         * (uncharacteristically) safe to access its rcu_data structure.
-         * Note also that we must carefully retain the order of the
-         * outgoing CPU's callbacks in order for rcu_barrier() to work
-         * correctly.  Finally, note that we start all the callbacks
-         * afresh, even those that have passed through a grace period
-         * and are therefore ready to invoke.  The theory is that hotplug
-         * events are rare, and that if they are frequent enough to
-         * indefinitely delay callbacks, you have far worse things to
-         * be worrying about.
-         */
-        rdp_me = rsp->rda[smp_processor_id()];
-        if (rdp->nxtlist != NULL) {
-                *rdp_me->nxttail[RCU_NEXT_TAIL] = rdp->nxtlist;
-                rdp_me->nxttail[RCU_NEXT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
-                rdp->nxtlist = NULL;
-                for (i = 0; i < RCU_NEXT_SIZE; i++)
-                        rdp->nxttail[i] = &rdp->nxtlist;
-                rdp_me->qlen += rdp->qlen;
-                rdp->qlen = 0;
-        }
-        local_irq_restore(flags);
 }
 /*
@@ -918,6 +957,14 @@ static void rcu_offline_cpu(int cpu)
 #else /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
+{
+}
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+{
+}
 static void rcu_offline_cpu(int cpu)
 {
 }
@@ -928,7 +975,7 @@ static void rcu_offline_cpu(int cpu)
 * Invoke any RCU callbacks that have made it to the end of their grace
 * period.  Thottle as specified by rdp->blimit.
 */
-static void rcu_do_batch(struct rcu_data *rdp)
+static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
 {
        unsigned long flags;
        struct rcu_head *next, *list, **tail;
@@ -981,6 +1028,13 @@ static void rcu_do_batch(struct rcu_data *rdp)
        if (rdp->blimit == LONG_MAX && rdp->qlen <= qlowmark)
                rdp->blimit = blimit;
+        /* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */
+        if (rdp->qlen == 0 && rdp->qlen_last_fqs_check != 0) {
+                rdp->qlen_last_fqs_check = 0;
+                rdp->n_force_qs_snap = rsp->n_force_qs;
+        } else if (rdp->qlen < rdp->qlen_last_fqs_check - qhimark)
+                rdp->qlen_last_fqs_check = rdp->qlen;
        local_irq_restore(flags);
        /* Re-raise the RCU softirq if there are callbacks remaining. */
@@ -1050,33 +1104,32 @@ static int rcu_process_dyntick(struct rcu_state *rsp, long lastcomp,
        int cpu;
        unsigned long flags;
        unsigned long mask;
-        struct rcu_node *rnp_cur = rsp->level[NUM_RCU_LVLS - 1];
+        struct rcu_node *rnp;
-        struct rcu_node *rnp_end = &rsp->node[NUM_RCU_NODES];
-        for (; rnp_cur < rnp_end; rnp_cur++) {
+        rcu_for_each_leaf_node(rsp, rnp) {
                mask = 0;
-                spin_lock_irqsave(&rnp_cur->lock, flags);
+                spin_lock_irqsave(&rnp->lock, flags);
                if (rsp->completed != lastcomp) {
-                        spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                        spin_unlock_irqrestore(&rnp->lock, flags);
                        return 1;
                }
-                if (rnp_cur->qsmask == 0) {
+                if (rnp->qsmask == 0) {
-                        spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                        spin_unlock_irqrestore(&rnp->lock, flags);
                        continue;
                }
-                cpu = rnp_cur->grplo;
+                cpu = rnp->grplo;
                bit = 1;
-                for (; cpu <= rnp_cur->grphi; cpu++, bit <<= 1) {
+                for (; cpu <= rnp->grphi; cpu++, bit <<= 1) {
-                        if ((rnp_cur->qsmask & bit) != 0 && f(rsp->rda[cpu]))
+                        if ((rnp->qsmask & bit) != 0 && f(rsp->rda[cpu]))
                                mask |= bit;
                }
                if (mask != 0 && rsp->completed == lastcomp) {
-                        /* cpu_quiet_msk() releases rnp_cur->lock. */
+                        /* cpu_quiet_msk() releases rnp->lock. */
-                        cpu_quiet_msk(mask, rsp, rnp_cur, flags);
+                        cpu_quiet_msk(mask, rsp, rnp, flags);
                        continue;
                }
-                spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                spin_unlock_irqrestore(&rnp->lock, flags);
        }
        return 0;
 }
@@ -1092,7 +1145,7 @@ static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
        struct rcu_node *rnp = rcu_get_root(rsp);
        u8 signaled;
-        if (ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum))
+        if (!rcu_gp_in_progress(rsp))
                return;  /* No grace period in progress, nothing to force. */
        if (!spin_trylock_irqsave(&rsp->fqslock, flags)) {
                rsp->n_force_qs_lh++; /* Inexact, can lose counts.  Tough! */
@@ -1113,9 +1166,10 @@ static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
        }
        spin_unlock(&rnp->lock);
        switch (signaled) {
+        case RCU_GP_IDLE:
        case RCU_GP_INIT:
-                break; /* grace period still initializing, ignore. */
+                break; /* grace period idle or initializing, ignore. */
        case RCU_SAVE_DYNTICK:
@@ -1129,7 +1183,8 @@ static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
                /* Update state, record completion counter. */
                spin_lock(&rnp->lock);
-                if (lastcomp == rsp->completed) {
+                if (lastcomp == rsp->completed &&
+                    rsp->signaled == RCU_SAVE_DYNTICK) {
                        rsp->signaled = RCU_FORCE_QS;
                        dyntick_record_completed(rsp, lastcomp);
                }
@@ -1195,7 +1250,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
        }
        /* If there are callbacks ready, invoke them. */
-        rcu_do_batch(rdp);
+        rcu_do_batch(rsp, rdp);
 }
 /*
@@ -1251,7 +1306,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
        rdp->nxttail[RCU_NEXT_TAIL] = &head->next;
        /* Start a new grace period if one not already started. */
-        if (ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum)) {
+        if (!rcu_gp_in_progress(rsp)) {
                unsigned long nestflag;
                struct rcu_node *rnp_root = rcu_get_root(rsp);
@@ -1259,10 +1314,20 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
                rcu_start_gp(rsp, nestflag);  /* releases rnp_root->lock. */
        }
-        /* Force the grace period if too many callbacks or too long waiting. */
+        /*
-        if (unlikely(++rdp->qlen > qhimark)) {
+         * Force the grace period if too many callbacks or too long waiting.
+         * Enforce hysteresis, and don't invoke force_quiescent_state()
+         * if some other CPU has recently done so.  Also, don't bother
+         * invoking force_quiescent_state() if the newly enqueued callback
+         * is the only one waiting for a grace period to complete.
+         */
+        if (unlikely(++rdp->qlen > rdp->qlen_last_fqs_check + qhimark)) {
                rdp->blimit = LONG_MAX;
-                force_quiescent_state(rsp, 0);
+                if (rsp->n_force_qs == rdp->n_force_qs_snap &&
+                    *rdp->nxttail[RCU_DONE_TAIL] != head)
+                        force_quiescent_state(rsp, 0);
+                rdp->n_force_qs_snap = rsp->n_force_qs;
+                rdp->qlen_last_fqs_check = rdp->qlen;
        } else if ((long)(ACCESS_ONCE(rsp->jiffies_force_qs) - jiffies) < 0)
                force_quiescent_state(rsp, 1);
        local_irq_restore(flags);
@@ -1331,7 +1396,7 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
        }
        /* Has an RCU GP gone long enough to send resched IPIs &c? */
-        if (ACCESS_ONCE(rsp->completed) != ACCESS_ONCE(rsp->gpnum) &&
+        if (rcu_gp_in_progress(rsp) &&
            ((long)(ACCESS_ONCE(rsp->jiffies_force_qs) - jiffies) < 0)) {
                rdp->n_rp_need_fqs++;
                return 1;
@@ -1368,6 +1433,82 @@ int rcu_needs_cpu(int cpu)
               rcu_preempt_needs_cpu(cpu);
 }
+static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
+static atomic_t rcu_barrier_cpu_count;
+static DEFINE_MUTEX(rcu_barrier_mutex);
+static struct completion rcu_barrier_completion;
+static void rcu_barrier_callback(struct rcu_head *notused)
+{
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+}
+/*
+ * Called with preemption disabled, and from cross-cpu IRQ context.
+ */
+static void rcu_barrier_func(void *type)
+{
+        int cpu = smp_processor_id();
+        struct rcu_head *head = &per_cpu(rcu_barrier_head, cpu);
+        void (*call_rcu_func)(struct rcu_head *head,
+                              void (*func)(struct rcu_head *head));
+        atomic_inc(&rcu_barrier_cpu_count);
+        call_rcu_func = type;
+        call_rcu_func(head, rcu_barrier_callback);
+}
+/*
+ * Orchestrate the specified type of RCU barrier, waiting for all
+ * RCU callbacks of the specified type to complete.
+ */
+static void _rcu_barrier(struct rcu_state *rsp,
+                         void (*call_rcu_func)(struct rcu_head *head,
+                                               void (*func)(struct rcu_head *head)))
+{
+        BUG_ON(in_interrupt());
+        /* Take mutex to serialize concurrent rcu_barrier() requests. */
+        mutex_lock(&rcu_barrier_mutex);
+        init_completion(&rcu_barrier_completion);
+        /*
+         * Initialize rcu_barrier_cpu_count to 1, then invoke
+         * rcu_barrier_func() on each CPU, so that each CPU also has
+         * incremented rcu_barrier_cpu_count.  Only then is it safe to
+         * decrement rcu_barrier_cpu_count -- otherwise the first CPU
+         * might complete its grace period before all of the other CPUs
+         * did their increment, causing this function to return too
+         * early.
+         */
+        atomic_set(&rcu_barrier_cpu_count, 1);
+        preempt_disable(); /* stop CPU_DYING from filling orphan_cbs_list */
+        rcu_adopt_orphan_cbs(rsp);
+        on_each_cpu(rcu_barrier_func, (void *)call_rcu_func, 1);
+        preempt_enable(); /* CPU_DYING can again fill orphan_cbs_list */
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+        wait_for_completion(&rcu_barrier_completion);
+        mutex_unlock(&rcu_barrier_mutex);
+}
+/**
+ * rcu_barrier_bh - Wait until all in-flight call_rcu_bh() callbacks complete.
+ */
+void rcu_barrier_bh(void)
+{
+        _rcu_barrier(&rcu_bh_state, call_rcu_bh);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier_bh);
+/**
+ * rcu_barrier_sched - Wait for in-flight call_rcu_sched() callbacks.
+ */
+void rcu_barrier_sched(void)
+{
+        _rcu_barrier(&rcu_sched_state, call_rcu_sched);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier_sched);
 /*
 * Do boot-time initialization of a CPU's per-CPU RCU data.
 */
@@ -1418,6 +1559,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptable)
        rdp->beenonline = 1;     /* We have now been online. */
        rdp->preemptable = preemptable;
        rdp->passed_quiesc_completed = lastcomp - 1;
+        rdp->qlen_last_fqs_check = 0;
+        rdp->n_force_qs_snap = rsp->n_force_qs;
        rdp->blimit = blimit;
        spin_unlock(&rnp->lock);                /* irqs remain disabled. */
@@ -1464,6 +1607,22 @@ int __cpuinit rcu_cpu_notify(struct notifier_block *self,
        case CPU_UP_PREPARE_FROZEN:
                rcu_online_cpu(cpu);
                break;
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                /*
+                 * preempt_disable() in _rcu_barrier() prevents stop_machine(),
+                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
+                 * returns, all online cpus have queued rcu_barrier_func().
+                 * The dying CPU clears its cpu_online_mask bit and
+                 * moves all of its RCU callbacks to ->orphan_cbs_list
+                 * in the context of stop_machine(), so subsequent calls
+                 * to _rcu_barrier() will adopt these callbacks and only
+                 * then queue rcu_barrier_func() on all remaining CPUs.
+                 */
+                rcu_send_cbs_to_orphanage(&rcu_bh_state);
+                rcu_send_cbs_to_orphanage(&rcu_sched_state);
+                rcu_preempt_send_cbs_to_orphanage();
+                break;
        case CPU_DEAD:
        case CPU_DEAD_FROZEN:
        case CPU_UP_CANCELED:
@@ -1526,7 +1685,8 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                cpustride *= rsp->levelspread[i];
                rnp = rsp->level[i];
                for (j = 0; j < rsp->levelcnt[i]; j++, rnp++) {
-                        spin_lock_init(&rnp->lock);
+                        if (rnp != rcu_get_root(rsp))
+                                spin_lock_init(&rnp->lock);
                        rnp->gpnum = 0;
                        rnp->qsmask = 0;
                        rnp->qsmaskinit = 0;
@@ -1549,6 +1709,7 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                        INIT_LIST_HEAD(&rnp->blocked_tasks[1]);
                }
        }
+        spin_lock_init(&rcu_get_root(rsp)->lock);
 }
 /*
@@ -1558,6 +1719,10 @@ static void __init rcu_init_one(struct rcu_state *rsp)
 */
 #define RCU_INIT_FLAVOR(rsp, rcu_data) \
 do { \
+        int i; \
+        int j; \
+        struct rcu_node *rnp; \
+        \
        rcu_init_one(rsp); \
        rnp = (rsp)->level[NUM_RCU_LVLS - 1]; \
        j = 0; \
@@ -1570,31 +1735,8 @@ do { \
        } \
 } while (0)
-#ifdef CONFIG_TREE_PREEMPT_RCU
-void __init __rcu_init_preempt(void)
-{
-        int i;                  /* All used by RCU_INIT_FLAVOR(). */
-        int j;
-        struct rcu_node *rnp;
-        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
-}
-#else /* #ifdef CONFIG_TREE_PREEMPT_RCU */
-void __init __rcu_init_preempt(void)
-{
-}
-#endif /* #else #ifdef CONFIG_TREE_PREEMPT_RCU */
 void __init __rcu_init(void)
 {
-        int i;                  /* All used by RCU_INIT_FLAVOR(). */
-        int j;
-        struct rcu_node *rnp;
        rcu_bootup_announce();
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
        printk(KERN_INFO "RCU-based detection of stalled CPUs is enabled.\n");
@@ -1605,6 +1747,4 @@ void __init __rcu_init(void)
        open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 }
-module_param(blimit, int, 0);
+#include "rcutree_plugin.h"
-module_param(qhimark, int, 0);
-module_param(qlowmark, int, 0);
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 8e8287a983c2..1899023b0962 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -48,14 +48,14 @@
 #elif NR_CPUS <= RCU_FANOUT_SQ
 #  define NUM_RCU_LVLS        2
 #  define NUM_RCU_LVL_0       1
-#  define NUM_RCU_LVL_1       (((NR_CPUS) + RCU_FANOUT - 1) / RCU_FANOUT)
+#  define NUM_RCU_LVL_1       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT)
 #  define NUM_RCU_LVL_2       (NR_CPUS)
 #  define NUM_RCU_LVL_3       0
 #elif NR_CPUS <= RCU_FANOUT_CUBE
 #  define NUM_RCU_LVLS        3
 #  define NUM_RCU_LVL_0       1
-#  define NUM_RCU_LVL_1       (((NR_CPUS) + RCU_FANOUT_SQ - 1) / RCU_FANOUT_SQ)
+#  define NUM_RCU_LVL_1       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT_SQ)
-#  define NUM_RCU_LVL_2       (((NR_CPUS) + (RCU_FANOUT) - 1) / (RCU_FANOUT))
+#  define NUM_RCU_LVL_2       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT)
 #  define NUM_RCU_LVL_3       NR_CPUS
 #else
 # error "CONFIG_RCU_FANOUT insufficient for NR_CPUS"
@@ -79,15 +79,21 @@ struct rcu_dynticks {
 * Definition for node within the RCU grace-period-detection hierarchy.
 */
 struct rcu_node {
-        spinlock_t lock;
+        spinlock_t lock;        /* Root rcu_node's lock protects some */
+                                /*  rcu_state fields as well as following. */
        long    gpnum;          /* Current grace period for this node. */
                                /*  This will either be equal to or one */
                                /*  behind the root rcu_node's gpnum. */
        unsigned long qsmask;   /* CPUs or groups that need to switch in */
                                /*  order for current grace period to proceed.*/
+                                /*  In leaf rcu_node, each bit corresponds to */
+                                /*  an rcu_data structure, otherwise, each */
+                                /*  bit corresponds to a child rcu_node */
+                                /*  structure. */
        unsigned long qsmaskinit;
                                /* Per-GP initialization for qsmask. */
        unsigned long grpmask;  /* Mask to apply to parent qsmask. */
+                                /*  Only one bit will be set in this mask. */
        int     grplo;          /* lowest-numbered CPU or group here. */
        int     grphi;          /* highest-numbered CPU or group here. */
        u8      grpnum;         /* CPU/group number for next level up. */
@@ -95,8 +101,23 @@ struct rcu_node {
        struct rcu_node *parent;
        struct list_head blocked_tasks[2];
                                /* Tasks blocked in RCU read-side critsect. */
+                                /*  Grace period number (->gpnum) x blocked */
+                                /*  by tasks on the (x & 0x1) element of the */
+                                /*  blocked_tasks[] array. */
 } ____cacheline_internodealigned_in_smp;
+/*
+ * Do a full breadth-first scan of the rcu_node structures for the
+ * specified rcu_state structure.
+ */
+#define rcu_for_each_node_breadth_first(rsp, rnp) \
+        for ((rnp) = &(rsp)->node[0]; \
+             (rnp) < &(rsp)->node[NUM_RCU_NODES]; (rnp)++)
+#define rcu_for_each_leaf_node(rsp, rnp) \
+        for ((rnp) = (rsp)->level[NUM_RCU_LVLS - 1]; \
+             (rnp) < &(rsp)->node[NUM_RCU_NODES]; (rnp)++)
 /* Index values for nxttail array in struct rcu_data. */
 #define RCU_DONE_TAIL           0       /* Also RCU_WAIT head. */
 #define RCU_WAIT_TAIL           1       /* Also RCU_NEXT_READY head. */
@@ -126,23 +147,30 @@ struct rcu_data {
         * Any of the partitions might be empty, in which case the
         * pointer to that partition will be equal to the pointer for
         * the following partition.  When the list is empty, all of
-         * the nxttail elements point to nxtlist, which is NULL.
+         * the nxttail elements point to the ->nxtlist pointer itself,
+         * which in that case is NULL.
         *
-         * [*nxttail[RCU_NEXT_READY_TAIL], NULL = *nxttail[RCU_NEXT_TAIL]):
-         *      Entries that might have arrived after current GP ended
-         * [*nxttail[RCU_WAIT_TAIL], *nxttail[RCU_NEXT_READY_TAIL]):
-         *      Entries known to have arrived before current GP ended
-         * [*nxttail[RCU_DONE_TAIL], *nxttail[RCU_WAIT_TAIL]):
-         *      Entries that batch # <= ->completed - 1: waiting for current GP
         * [nxtlist, *nxttail[RCU_DONE_TAIL]):
         *      Entries that batch # <= ->completed
         *      The grace period for these entries has completed, and
         *      the other grace-period-completed entries may be moved
         *      here temporarily in rcu_process_callbacks().
+         * [*nxttail[RCU_DONE_TAIL], *nxttail[RCU_WAIT_TAIL]):
+         *      Entries that batch # <= ->completed - 1: waiting for current GP
+         * [*nxttail[RCU_WAIT_TAIL], *nxttail[RCU_NEXT_READY_TAIL]):
+         *      Entries known to have arrived before current GP ended
+         * [*nxttail[RCU_NEXT_READY_TAIL], *nxttail[RCU_NEXT_TAIL]):
+         *      Entries that might have arrived after current GP ended
+         *      Note that the value of *nxttail[RCU_NEXT_TAIL] will
+         *      always be NULL, as this is the end of the list.
         */
        struct rcu_head *nxtlist;
        struct rcu_head **nxttail[RCU_NEXT_SIZE];
        long            qlen;           /* # of queued callbacks */
+        long            qlen_last_fqs_check;
+                                        /* qlen at last check for QS forcing */
+        unsigned long   n_force_qs_snap;
+                                        /* did other CPU force QS recently? */
        long            blimit;         /* Upper limit on a processed batch */
 #ifdef CONFIG_NO_HZ
@@ -173,9 +201,10 @@ struct rcu_data {
 };
 /* Values for signaled field in struct rcu_state. */
-#define RCU_GP_INIT             0       /* Grace period being initialized. */
+#define RCU_GP_IDLE             0       /* No grace period in progress. */
-#define RCU_SAVE_DYNTICK        1       /* Need to scan dyntick state. */
+#define RCU_GP_INIT             1       /* Grace period being initialized. */
-#define RCU_FORCE_QS            2       /* Need to force quiescent state. */
+#define RCU_SAVE_DYNTICK        2       /* Need to scan dyntick state. */
+#define RCU_FORCE_QS            3       /* Need to force quiescent state. */
 #ifdef CONFIG_NO_HZ
 #define RCU_SIGNAL_INIT         RCU_SAVE_DYNTICK
 #else /* #ifdef CONFIG_NO_HZ */
@@ -216,8 +245,19 @@ struct rcu_state {
                                                /* Force QS state. */
        long    gpnum;                          /* Current gp number. */
        long    completed;                      /* # of last completed gp. */
+        /* End  of fields guarded by root rcu_node's lock. */
        spinlock_t onofflock;                   /* exclude on/offline and */
-                                                /*  starting new GP. */
+                                                /*  starting new GP.  Also */
+                                                /*  protects the following */
+                                                /*  orphan_cbs fields. */
+        struct rcu_head *orphan_cbs_list;       /* list of rcu_head structs */
+                                                /*  orphaned by all CPUs in */
+                                                /*  a given leaf rcu_node */
+                                                /*  going offline. */
+        struct rcu_head **orphan_cbs_tail;      /* And tail pointer. */
+        long orphan_qlen;                       /* Number of orphaned cbs. */
        spinlock_t fqslock;                     /* Only one task forcing */
                                                /*  quiescent states. */
        unsigned long jiffies_force_qs;         /* Time at which to invoke */
@@ -255,5 +295,30 @@ extern struct rcu_state rcu_preempt_state;
 DECLARE_PER_CPU(struct rcu_data, rcu_preempt_data);
 #endif /* #ifdef CONFIG_TREE_PREEMPT_RCU */
-#endif /* #ifdef RCU_TREE_NONCORE */
+#else /* #ifdef RCU_TREE_NONCORE */
+/* Forward declarations for rcutree_plugin.h */
+static inline void rcu_bootup_announce(void);
+long rcu_batches_completed(void);
+static void rcu_preempt_note_context_switch(int cpu);
+static int rcu_preempted_readers(struct rcu_node *rnp);
+#ifdef CONFIG_RCU_CPU_STALL_DETECTOR
+static void rcu_print_task_stall(struct rcu_node *rnp);
+#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
+#ifdef CONFIG_HOTPLUG_CPU
+static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
+                                     struct rcu_node *rnp,
+                                     struct rcu_data *rdp);
+static void rcu_preempt_offline_cpu(int cpu);
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_preempt_check_callbacks(int cpu);
+static void rcu_preempt_process_callbacks(void);
+void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu));
+static int rcu_preempt_pending(int cpu);
+static int rcu_preempt_needs_cpu(int cpu);
+static void __cpuinit rcu_preempt_init_percpu_data(int cpu);
+static void rcu_preempt_send_cbs_to_orphanage(void);
+static void __init __rcu_init_preempt(void);
+#endif /* #else #ifdef RCU_TREE_NONCORE */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 1cee04f627eb..ef2a58c2b9d5 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -150,6 +150,16 @@ void __rcu_read_lock(void)
 }
 EXPORT_SYMBOL_GPL(__rcu_read_lock);
+/*
+ * Check for preempted RCU readers blocking the current grace period
+ * for the specified rcu_node structure.  If the caller needs a reliable
+ * answer, it must hold the rcu_node's ->lock.
+ */
+static int rcu_preempted_readers(struct rcu_node *rnp)
+{
+        return !list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
+}
 static void rcu_read_unlock_special(struct task_struct *t)
 {
        int empty;
@@ -196,7 +206,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
                                break;
                        spin_unlock(&rnp->lock);  /* irqs remain disabled. */
                }
-                empty = list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
+                empty = !rcu_preempted_readers(rnp);
                list_del_init(&t->rcu_node_entry);
                t->rcu_blocked_node = NULL;
@@ -207,7 +217,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
                 * drop rnp->lock and restore irq.
                 */
                if (!empty && rnp->qsmask == 0 &&
-                    list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1])) {
+                    !rcu_preempted_readers(rnp)) {
                        struct rcu_node *rnp_p;
                        if (rnp->parent == NULL) {
@@ -257,12 +267,12 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
 {
        unsigned long flags;
        struct list_head *lp;
-        int phase = rnp->gpnum & 0x1;
+        int phase;
        struct task_struct *t;
-        if (!list_empty(&rnp->blocked_tasks[phase])) {
+        if (rcu_preempted_readers(rnp)) {
                spin_lock_irqsave(&rnp->lock, flags);
-                phase = rnp->gpnum & 0x1; /* re-read under lock. */
+                phase = rnp->gpnum & 0x1;
                lp = &rnp->blocked_tasks[phase];
                list_for_each_entry(t, lp, rcu_node_entry)
                        printk(" P%d", t->pid);
@@ -281,20 +291,10 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
 */
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
 {
-        WARN_ON_ONCE(!list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]));
+        WARN_ON_ONCE(rcu_preempted_readers(rnp));
        WARN_ON_ONCE(rnp->qsmask);
 }
-/*
- * Check for preempted RCU readers for the specified rcu_node structure.
- * If the caller needs a reliable answer, it must hold the rcu_node's
- * >lock.
- */
-static int rcu_preempted_readers(struct rcu_node *rnp)
-{
-        return !list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
-}
 #ifdef CONFIG_HOTPLUG_CPU
 /*
@@ -304,21 +304,25 @@ static int rcu_preempted_readers(struct rcu_node *rnp)
 * parent is to remove the need for rcu_read_unlock_special() to
 * make more than two attempts to acquire the target rcu_node's lock.
 *
+ * Returns 1 if there was previously a task blocking the current grace
+ * period on the specified rcu_node structure.
+ *
 * The caller must hold rnp->lock with irqs disabled.
 */
-static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
+static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                      struct rcu_node *rnp,
+                                     struct rcu_node *rnp,
-                                      struct rcu_data *rdp)
+                                     struct rcu_data *rdp)
 {
        int i;
        struct list_head *lp;
        struct list_head *lp_root;
+        int retval = rcu_preempted_readers(rnp);
        struct rcu_node *rnp_root = rcu_get_root(rsp);
        struct task_struct *tp;
        if (rnp == rnp_root) {
                WARN_ONCE(1, "Last CPU thought to be offlined?");
-                return;  /* Shouldn't happen: at least one CPU online. */
+                return 0;  /* Shouldn't happen: at least one CPU online. */
        }
        WARN_ON_ONCE(rnp != rdp->mynode &&
                     (!list_empty(&rnp->blocked_tasks[0]) ||
@@ -342,6 +346,8 @@ static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
                        spin_unlock(&rnp_root->lock); /* irqs remain disabled */
                }
        }
+        return retval;
 }
 /*
@@ -393,6 +399,17 @@ void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 EXPORT_SYMBOL_GPL(call_rcu);
 /*
+ * Wait for an rcu-preempt grace period.  We are supposed to expedite the
+ * grace period, but this is the crude slow compatability hack, so just
+ * invoke synchronize_rcu().
+ */
+void synchronize_rcu_expedited(void)
+{
+        synchronize_rcu();
+}
+EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+/*
 * Check to see if there is any immediate preemptable-RCU-related work
 * to be done.
 */
@@ -410,6 +427,15 @@ static int rcu_preempt_needs_cpu(int cpu)
        return !!per_cpu(rcu_preempt_data, cpu).nxtlist;
 }
+/**
+ * rcu_barrier - Wait until all in-flight call_rcu() callbacks complete.
+ */
+void rcu_barrier(void)
+{
+        _rcu_barrier(&rcu_preempt_state, call_rcu);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
 /*
 * Initialize preemptable RCU's per-CPU data.
 */
@@ -419,6 +445,22 @@ static void __cpuinit rcu_preempt_init_percpu_data(int cpu)
 }
 /*
+ * Move preemptable RCU's callbacks to ->orphan_cbs_list.
+ */
+static void rcu_preempt_send_cbs_to_orphanage(void)
+{
+        rcu_send_cbs_to_orphanage(&rcu_preempt_state);
+}
+/*
+ * Initialize preemptable RCU's state structures.
+ */
+static void __init __rcu_init_preempt(void)
+{
+        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
+}
+/*
 * Check for a task exiting while in a preemptable-RCU read-side
 * critical section, clean up if so.  No need to issue warnings,
 * as debug_check_no_locks_held() already does this if lockdep
@@ -461,6 +503,15 @@ static void rcu_preempt_note_context_switch(int cpu)
 {
 }
+/*
+ * Because preemptable RCU does not exist, there are never any preempted
+ * RCU readers.
+ */
+static int rcu_preempted_readers(struct rcu_node *rnp)
+{
+        return 0;
+}
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
 /*
@@ -483,25 +534,19 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
        WARN_ON_ONCE(rnp->qsmask);
 }
-/*
- * Because preemptable RCU does not exist, there are never any preempted
- * RCU readers.
- */
-static int rcu_preempted_readers(struct rcu_node *rnp)
-{
-        return 0;
-}
 #ifdef CONFIG_HOTPLUG_CPU
 /*
 * Because preemptable RCU does not exist, it never needs to migrate
- * tasks that were blocked within RCU read-side critical sections.
+ * tasks that were blocked within RCU read-side critical sections, and
+ * such non-existent tasks cannot possibly have been blocking the current
+ * grace period.
 */
-static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
+static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                      struct rcu_node *rnp,
+                                     struct rcu_node *rnp,
-                                      struct rcu_data *rdp)
+                                     struct rcu_data *rdp)
 {
+        return 0;
 }
 /*
@@ -518,7 +563,7 @@ static void rcu_preempt_offline_cpu(int cpu)
 * Because preemptable RCU does not exist, it never has any callbacks
 * to check.
 */
-void rcu_preempt_check_callbacks(int cpu)
+static void rcu_preempt_check_callbacks(int cpu)
 {
 }
@@ -526,7 +571,7 @@ void rcu_preempt_check_callbacks(int cpu)
 * Because preemptable RCU does not exist, it never has any callbacks
 * to process.
 */
-void rcu_preempt_process_callbacks(void)
+static void rcu_preempt_process_callbacks(void)
 {
 }
@@ -540,6 +585,16 @@ void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 EXPORT_SYMBOL_GPL(call_rcu);
 /*
+ * Wait for an rcu-preempt grace period, but make it happen quickly.
+ * But because preemptable RCU does not exist, map to rcu-sched.
+ */
+void synchronize_rcu_expedited(void)
+{
+        synchronize_sched_expedited();
+}
+EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+/*
 * Because preemptable RCU does not exist, it never has any work to do.
 */
 static int rcu_preempt_pending(int cpu)
@@ -556,6 +611,16 @@ static int rcu_preempt_needs_cpu(int cpu)
 }
 /*
+ * Because preemptable RCU does not exist, rcu_barrier() is just
+ * another name for rcu_barrier_sched().
+ */
+void rcu_barrier(void)
+{
+        rcu_barrier_sched();
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
+/*
 * Because preemptable RCU does not exist, there is no per-CPU
 * data to initialize.
 */
@@ -563,4 +628,18 @@ static void __cpuinit rcu_preempt_init_percpu_data(int cpu)
 {
 }
+/*
+ * Because there is no preemptable RCU, there are no callbacks to move.
+ */
+static void rcu_preempt_send_cbs_to_orphanage(void)
+{
+}
+/*
+ * Because preemptable RCU does not exist, it need not be initialized.
+ */
+static void __init __rcu_init_preempt(void)
+{
+}
 #endif /* #else #ifdef CONFIG_TREE_PREEMPT_RCU */
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index c89f5e9fd173..4b31c779e62e 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -93,7 +93,7 @@ static int rcudata_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcudata, NULL);
 }
-static struct file_operations rcudata_fops = {
+static const struct file_operations rcudata_fops = {
        .owner = THIS_MODULE,
        .open = rcudata_open,
        .read = seq_read,
@@ -145,7 +145,7 @@ static int rcudata_csv_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcudata_csv, NULL);
 }
-static struct file_operations rcudata_csv_fops = {
+static const struct file_operations rcudata_csv_fops = {
        .owner = THIS_MODULE,
        .open = rcudata_csv_open,
        .read = seq_read,
@@ -159,13 +159,13 @@ static void print_one_rcu_state(struct seq_file *m, struct rcu_state *rsp)
        struct rcu_node *rnp;
        seq_printf(m, "c=%ld g=%ld s=%d jfq=%ld j=%x "
-                      "nfqs=%lu/nfqsng=%lu(%lu) fqlh=%lu\n",
+                      "nfqs=%lu/nfqsng=%lu(%lu) fqlh=%lu oqlen=%ld\n",
                   rsp->completed, rsp->gpnum, rsp->signaled,
                   (long)(rsp->jiffies_force_qs - jiffies),
                   (int)(jiffies & 0xffff),
                   rsp->n_force_qs, rsp->n_force_qs_ngp,
                   rsp->n_force_qs - rsp->n_force_qs_ngp,
-                   rsp->n_force_qs_lh);
+                   rsp->n_force_qs_lh, rsp->orphan_qlen);
        for (rnp = &rsp->node[0]; rnp - &rsp->node[0] < NUM_RCU_NODES; rnp++) {
                if (rnp->level != level) {
                        seq_puts(m, "\n");
@@ -196,7 +196,7 @@ static int rcuhier_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcuhier, NULL);
 }
-static struct file_operations rcuhier_fops = {
+static const struct file_operations rcuhier_fops = {
        .owner = THIS_MODULE,
        .open = rcuhier_open,
        .read = seq_read,
@@ -222,7 +222,7 @@ static int rcugp_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcugp, NULL);
 }
-static struct file_operations rcugp_fops = {
+static const struct file_operations rcugp_fops = {
        .owner = THIS_MODULE,
        .open = rcugp_open,
        .read = seq_read,
@@ -276,7 +276,7 @@ static int rcu_pending_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcu_pending, NULL);
 }
-static struct file_operations rcu_pending_fops = {
+static const struct file_operations rcu_pending_fops = {
        .owner = THIS_MODULE,
        .open = rcu_pending_open,
        .read = seq_read,
diff --git a/kernel/relay.c b/kernel/relay.c
index bc188549788f..760c26209a3c 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -60,7 +60,7 @@ static int relay_buf_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 /*
 * vm_ops for relay file mappings.
 */
-static struct vm_operations_struct relay_file_mmap_ops = {
+static const struct vm_operations_struct relay_file_mmap_ops = {
        .fault = relay_buf_fault,
        .close = relay_file_mmap_close,
 };
diff --git a/kernel/res_counter.c b/kernel/res_counter.c
index 88faec23e833..bcdabf37c40b 100644
--- a/kernel/res_counter.c
+++ b/kernel/res_counter.c
@@ -37,27 +37,17 @@ int res_counter_charge_locked(struct res_counter *counter, unsigned long val)
 }
 int res_counter_charge(struct res_counter *counter, unsigned long val,
-                        struct res_counter **limit_fail_at,
+                        struct res_counter **limit_fail_at)
-                        struct res_counter **soft_limit_fail_at)
 {
        int ret;
        unsigned long flags;
        struct res_counter *c, *u;
        *limit_fail_at = NULL;
-        if (soft_limit_fail_at)
-                *soft_limit_fail_at = NULL;
        local_irq_save(flags);
        for (c = counter; c != NULL; c = c->parent) {
                spin_lock(&c->lock);
                ret = res_counter_charge_locked(c, val);
-                /*
-                 * With soft limits, we return the highest ancestor
-                 * that exceeds its soft limit
-                 */
-                if (soft_limit_fail_at &&
-                        !res_counter_soft_limit_check_locked(c))
-                        *soft_limit_fail_at = c;
                spin_unlock(&c->lock);
                if (ret < 0) {
                        *limit_fail_at = c;
@@ -85,8 +75,7 @@ void res_counter_uncharge_locked(struct res_counter *counter, unsigned long val)
        counter->usage -= val;
 }
-void res_counter_uncharge(struct res_counter *counter, unsigned long val,
+void res_counter_uncharge(struct res_counter *counter, unsigned long val)
-                                bool *was_soft_limit_excess)
 {
        unsigned long flags;
        struct res_counter *c;
@@ -94,9 +83,6 @@ void res_counter_uncharge(struct res_counter *counter, unsigned long val,
        local_irq_save(flags);
        for (c = counter; c != NULL; c = c->parent) {
                spin_lock(&c->lock);
-                if (was_soft_limit_excess)
-                        *was_soft_limit_excess =
-                                !res_counter_soft_limit_check_locked(c);
                res_counter_uncharge_locked(c, val);
                spin_unlock(&c->lock);
        }
diff --git a/kernel/sched.c b/kernel/sched.c
index ee61f454a98b..3c11ae0a948d 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -309,6 +309,8 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(struct rt_rq, init_rt_rq);
 */
 static DEFINE_SPINLOCK(task_group_lock);
+#ifdef CONFIG_FAIR_GROUP_SCHED
 #ifdef CONFIG_SMP
 static int root_task_group_empty(void)
 {
@@ -316,7 +318,6 @@ static int root_task_group_empty(void)
 }
 #endif
-#ifdef CONFIG_FAIR_GROUP_SCHED
 #ifdef CONFIG_USER_SCHED
 # define INIT_TASK_GROUP_LOAD   (2*NICE_0_LOAD)
 #else /* !CONFIG_USER_SCHED */
@@ -676,6 +677,7 @@ inline void update_rq_clock(struct rq *rq)
 /**
 * runqueue_is_locked
+ * @cpu: the processor in question.
 *
 * Returns true if the current cpu runqueue is locked.
 * This interface allows printk to be called with the runqueue lock
@@ -780,7 +782,7 @@ static int sched_feat_open(struct inode *inode, struct file *filp)
        return single_open(filp, sched_feat_show, NULL);
 }
-static struct file_operations sched_feat_fops = {
+static const struct file_operations sched_feat_fops = {
        .open           = sched_feat_open,
        .write          = sched_feat_write,
        .read           = seq_read,
@@ -1563,11 +1565,7 @@ static unsigned long cpu_avg_load_per_task(int cpu)
 #ifdef CONFIG_FAIR_GROUP_SCHED
-struct update_shares_data {
+static __read_mostly unsigned long *update_shares_data;
-        unsigned long rq_weight[NR_CPUS];
-};
-static DEFINE_PER_CPU(struct update_shares_data, update_shares_data);
 static void __set_se_shares(struct sched_entity *se, unsigned long shares);
@@ -1577,12 +1575,12 @@ static void __set_se_shares(struct sched_entity *se, unsigned long shares);
 static void update_group_shares_cpu(struct task_group *tg, int cpu,
                                    unsigned long sd_shares,
                                    unsigned long sd_rq_weight,
-                                    struct update_shares_data *usd)
+                                    unsigned long *usd_rq_weight)
 {
        unsigned long shares, rq_weight;
        int boost = 0;
-        rq_weight = usd->rq_weight[cpu];
+        rq_weight = usd_rq_weight[cpu];
        if (!rq_weight) {
                boost = 1;
                rq_weight = NICE_0_LOAD;
@@ -1617,7 +1615,7 @@ static void update_group_shares_cpu(struct task_group *tg, int cpu,
 static int tg_shares_up(struct task_group *tg, void *data)
 {
        unsigned long weight, rq_weight = 0, shares = 0;
-        struct update_shares_data *usd;
+        unsigned long *usd_rq_weight;
        struct sched_domain *sd = data;
        unsigned long flags;
        int i;
@@ -1626,11 +1624,11 @@ static int tg_shares_up(struct task_group *tg, void *data)
                return 0;
        local_irq_save(flags);
-        usd = &__get_cpu_var(update_shares_data);
+        usd_rq_weight = per_cpu_ptr(update_shares_data, smp_processor_id());
        for_each_cpu(i, sched_domain_span(sd)) {
                weight = tg->cfs_rq[i]->load.weight;
-                usd->rq_weight[i] = weight;
+                usd_rq_weight[i] = weight;
                /*
                 * If there are currently no tasks on the cpu pretend there
@@ -1651,7 +1649,7 @@ static int tg_shares_up(struct task_group *tg, void *data)
                shares = tg->shares;
        for_each_cpu(i, sched_domain_span(sd))
-                update_group_shares_cpu(tg, i, shares, rq_weight, usd);
+                update_group_shares_cpu(tg, i, shares, rq_weight, usd_rq_weight);
        local_irq_restore(flags);
@@ -1995,6 +1993,38 @@ static inline void check_class_changed(struct rq *rq, struct task_struct *p,
                p->sched_class->prio_changed(rq, p, oldprio, running);
 }
+/**
+ * kthread_bind - bind a just-created kthread to a cpu.
+ * @p: thread created by kthread_create().
+ * @cpu: cpu (might not be online, must be possible) for @k to run on.
+ *
+ * Description: This function is equivalent to set_cpus_allowed(),
+ * except that @cpu doesn't need to be online, and the thread must be
+ * stopped (i.e., just returned from kthread_create()).
+ *
+ * Function lives here instead of kthread.c because it messes with
+ * scheduler internals which require locking.
+ */
+void kthread_bind(struct task_struct *p, unsigned int cpu)
+{
+        struct rq *rq = cpu_rq(cpu);
+        unsigned long flags;
+        /* Must have done schedule() in kthread() before we set_task_cpu */
+        if (!wait_task_inactive(p, TASK_UNINTERRUPTIBLE)) {
+                WARN_ON(1);
+                return;
+        }
+        spin_lock_irqsave(&rq->lock, flags);
+        set_task_cpu(p, cpu);
+        p->cpus_allowed = cpumask_of_cpu(cpu);
+        p->rt.nr_cpus_allowed = 1;
+        p->flags |= PF_THREAD_BOUND;
+        spin_unlock_irqrestore(&rq->lock, flags);
+}
+EXPORT_SYMBOL(kthread_bind);
 #ifdef CONFIG_SMP
 /*
 * Is this task likely cache-hot:
@@ -2007,7 +2037,7 @@ task_hot(struct task_struct *p, u64 now, struct sched_domain *sd)
        /*
         * Buddy candidates are cache hot:
         */
-        if (sched_feat(CACHE_HOT_BUDDY) &&
+        if (sched_feat(CACHE_HOT_BUDDY) && this_rq()->nr_running &&
                        (&p->se == cfs_rq_of(&p->se)->next ||
                         &p->se == cfs_rq_of(&p->se)->last))
                return 1;
@@ -2311,7 +2341,7 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
 {
        int cpu, orig_cpu, this_cpu, success = 0;
        unsigned long flags;
-        struct rq *rq;
+        struct rq *rq, *orig_rq;
        if (!sched_feat(SYNC_WAKEUPS))
                wake_flags &= ~WF_SYNC;
@@ -2319,7 +2349,7 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
        this_cpu = get_cpu();
        smp_wmb();
-        rq = task_rq_lock(p, &flags);
+        rq = orig_rq = task_rq_lock(p, &flags);
        update_rq_clock(rq);
        if (!(p->state & state))
                goto out;
@@ -2350,6 +2380,10 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
                set_task_cpu(p, cpu);
        rq = task_rq_lock(p, &flags);
+        if (rq != orig_rq)
+                update_rq_clock(rq);
        WARN_ON(p->state != TASK_WAKING);
        cpu = task_cpu(p);
@@ -2515,22 +2549,17 @@ void sched_fork(struct task_struct *p, int clone_flags)
        __sched_fork(p);
        /*
-         * Make sure we do not leak PI boosting priority to the child.
-         */
-        p->prio = current->normal_prio;
-        /*
         * Revert to default priority/policy on fork if requested.
         */
        if (unlikely(p->sched_reset_on_fork)) {
-                if (p->policy == SCHED_FIFO || p->policy == SCHED_RR)
+                if (p->policy == SCHED_FIFO || p->policy == SCHED_RR) {
                        p->policy = SCHED_NORMAL;
+                        p->normal_prio = p->static_prio;
-                if (p->normal_prio < DEFAULT_PRIO)
+                }
-                        p->prio = DEFAULT_PRIO;
                if (PRIO_TO_NICE(p->static_prio) < 0) {
                        p->static_prio = NICE_TO_PRIO(0);
+                        p->normal_prio = p->static_prio;
                        set_load_weight(p);
                }
@@ -2541,6 +2570,11 @@ void sched_fork(struct task_struct *p, int clone_flags)
                p->sched_reset_on_fork = 0;
        }
+        /*
+         * Make sure we do not leak PI boosting priority to the child.
+         */
+        p->prio = current->normal_prio;
        if (!rt_prio(p->prio))
                p->sched_class = &fair_sched_class;
@@ -2581,8 +2615,6 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags)
        BUG_ON(p->state != TASK_RUNNING);
        update_rq_clock(rq);
-        p->prio = effective_prio(p);
        if (!p->sched_class->task_new || !current->se.on_rq) {
                activate_task(rq, p, 0);
        } else {
@@ -3658,6 +3690,7 @@ static void update_group_power(struct sched_domain *sd, int cpu)
 /**
 * update_sg_lb_stats - Update sched_group's statistics for load balancing.
+ * @sd: The sched_domain whose statistics are to be updated.
 * @group: sched_group whose statistics are to be updated.
 * @this_cpu: Cpu for which load balance is currently performed.
 * @idle: Idle status of this_cpu
@@ -6720,9 +6753,6 @@ EXPORT_SYMBOL(yield);
 /*
 * This task is about to go to sleep on IO. Increment rq->nr_iowait so
 * that process accounting knows that this is a task in IO wait state.
- *
- * But don't do that if it is a deliberate, throttling IO wait (this task
- * has set its backing_dev_info: the queue against which it should throttle)
 */
 void __sched io_schedule(void)
 {
@@ -9406,6 +9436,10 @@ void __init sched_init(void)
 #endif /* CONFIG_USER_SCHED */
 #endif /* CONFIG_GROUP_SCHED */
+#if defined CONFIG_FAIR_GROUP_SCHED && defined CONFIG_SMP
+        update_shares_data = __alloc_percpu(nr_cpu_ids * sizeof(unsigned long),
+                                            __alignof__(unsigned long));
+#endif
        for_each_possible_cpu(i) {
                struct rq *rq;
@@ -9531,13 +9565,13 @@ void __init sched_init(void)
        current->sched_class = &fair_sched_class;
        /* Allocate the nohz_cpu_mask if CONFIG_CPUMASK_OFFSTACK */
-        alloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT);
+        zalloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT);
 #ifdef CONFIG_SMP
 #ifdef CONFIG_NO_HZ
-        alloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT);
+        zalloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT);
        alloc_cpumask_var(&nohz.ilb_grp_nohz_mask, GFP_NOWAIT);
 #endif
-        alloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT);
+        zalloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT);
 #endif /* SMP */
        perf_event_init();
diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
index ac2e1dc708bd..479ce5682d7c 100644
--- a/kernel/sched_clock.c
+++ b/kernel/sched_clock.c
@@ -127,7 +127,7 @@ again:
        clock = wrap_max(clock, min_clock);
        clock = wrap_min(clock, max_clock);
-        if (cmpxchg(&scd->clock, old_clock, clock) != old_clock)
+        if (cmpxchg64(&scd->clock, old_clock, clock) != old_clock)
                goto again;
        return clock;
@@ -163,7 +163,7 @@ again:
                val = remote_clock;
        }
-        if (cmpxchg(ptr, old_val, val) != old_val)
+        if (cmpxchg64(ptr, old_val, val) != old_val)
                goto again;
        return val;
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 4e777b47eeda..37087a7fac22 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -822,6 +822,26 @@ check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
                 * re-elected due to buddy favours.
                 */
                clear_buddies(cfs_rq, curr);
+                return;
+        }
+        /*
+         * Ensure that a task that missed wakeup preemption by a
+         * narrow margin doesn't have to wait for a full slice.
+         * This also mitigates buddy induced latencies under load.
+         */
+        if (!sched_feat(WAKEUP_PREEMPT))
+                return;
+        if (delta_exec < sysctl_sched_min_granularity)
+                return;
+        if (cfs_rq->nr_running > 1) {
+                struct sched_entity *se = __pick_next_entity(cfs_rq);
+                s64 delta = curr->vruntime - se->vruntime;
+                if (delta > ideal_runtime)
+                        resched_task(rq_of(cfs_rq)->curr);
        }
 }
@@ -861,12 +881,18 @@ wakeup_preempt_entity(struct sched_entity *curr, struct sched_entity *se);
 static struct sched_entity *pick_next_entity(struct cfs_rq *cfs_rq)
 {
        struct sched_entity *se = __pick_next_entity(cfs_rq);
+        struct sched_entity *left = se;
-        if (cfs_rq->next && wakeup_preempt_entity(cfs_rq->next, se) < 1)
+        if (cfs_rq->next && wakeup_preempt_entity(cfs_rq->next, left) < 1)
-                return cfs_rq->next;
+                se = cfs_rq->next;
-        if (cfs_rq->last && wakeup_preempt_entity(cfs_rq->last, se) < 1)
+        /*
-                return cfs_rq->last;
+         * Prefer last buddy, try to return the CPU to a preempted task.
+         */
+        if (cfs_rq->last && wakeup_preempt_entity(cfs_rq->last, left) < 1)
+                se = cfs_rq->last;
+        clear_buddies(cfs_rq, se);
        return se;
 }
@@ -1568,6 +1594,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
        struct sched_entity *se = &curr->se, *pse = &p->se;
        struct cfs_rq *cfs_rq = task_cfs_rq(curr);
        int sync = wake_flags & WF_SYNC;
+        int scale = cfs_rq->nr_running >= sched_nr_latency;
        update_curr(cfs_rq);
@@ -1582,18 +1609,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
        if (unlikely(se == pse))
                return;
-        /*
+        if (sched_feat(NEXT_BUDDY) && scale && !(wake_flags & WF_FORK))
-         * Only set the backward buddy when the current task is still on the
-         * rq. This can happen when a wakeup gets interleaved with schedule on
-         * the ->pre_schedule() or idle_balance() point, either of which can
-         * drop the rq lock.
-         *
-         * Also, during early boot the idle thread is in the fair class, for
-         * obvious reasons its a bad idea to schedule back to the idle thread.
-         */
-        if (sched_feat(LAST_BUDDY) && likely(se->on_rq && curr != rq->idle))
-                set_last_buddy(se);
-        if (sched_feat(NEXT_BUDDY) && !(wake_flags & WF_FORK))
                set_next_buddy(pse);
        /*
@@ -1639,8 +1655,22 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
        BUG_ON(!pse);
-        if (wakeup_preempt_entity(se, pse) == 1)
+        if (wakeup_preempt_entity(se, pse) == 1) {
                resched_task(curr);
+                /*
+                 * Only set the backward buddy when the current task is still
+                 * on the rq. This can happen when a wakeup gets interleaved
+                 * with schedule on the ->pre_schedule() or idle_balance()
+                 * point, either of which can * drop the rq lock.
+                 *
+                 * Also, during early boot the idle thread is in the fair class,
+                 * for obvious reasons its a bad idea to schedule back to it.
+                 */
+                if (unlikely(!se->on_rq || curr == rq->idle))
+                        return;
+                if (sched_feat(LAST_BUDDY) && scale && entity_is_task(se))
+                        set_last_buddy(se);
+        }
 }
 static struct task_struct *pick_next_task_fair(struct rq *rq)
@@ -1654,16 +1684,6 @@ static struct task_struct *pick_next_task_fair(struct rq *rq)
        do {
                se = pick_next_entity(cfs_rq);
-                /*
-                 * If se was a buddy, clear it so that it will have to earn
-                 * the favour again.
-                 *
-                 * If se was not a buddy, clear the buddies because neither
-                 * was elegible to run, let them earn it again.
-                 *
-                 * IOW. unconditionally clear buddies.
-                 */
-                __clear_buddies(cfs_rq, NULL);
                set_next_entity(cfs_rq, se);
                cfs_rq = group_cfs_rq(se);
        } while (cfs_rq);
diff --git a/kernel/sys.c b/kernel/sys.c
index 255475d163e0..ce17760d9c51 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1110,6 +1110,8 @@ SYSCALL_DEFINE0(setsid)
        err = session;
 out:
        write_unlock_irq(&tasklist_lock);
+        if (err > 0)
+                proc_sid_connector(group_leader);
        return err;
 }
@@ -1546,24 +1548,37 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                        if (arg4 | arg5)
                                return -EINVAL;
                        switch (arg2) {
-                        case 0:
+                        case PR_MCE_KILL_CLEAR:
                                if (arg3 != 0)
                                        return -EINVAL;
                                current->flags &= ~PF_MCE_PROCESS;
                                break;
-                        case 1:
+                        case PR_MCE_KILL_SET:
                                current->flags |= PF_MCE_PROCESS;
-                                if (arg3 != 0)
+                                if (arg3 == PR_MCE_KILL_EARLY)
                                        current->flags |= PF_MCE_EARLY;
-                                else
+                                else if (arg3 == PR_MCE_KILL_LATE)
                                        current->flags &= ~PF_MCE_EARLY;
+                                else if (arg3 == PR_MCE_KILL_DEFAULT)
+                                        current->flags &=
+                                                ~(PF_MCE_EARLY|PF_MCE_PROCESS);
+                                else
+                                        return -EINVAL;
                                break;
                        default:
                                return -EINVAL;
                        }
                        error = 0;
                        break;
+                case PR_MCE_KILL_GET:
+                        if (arg2 | arg3 | arg4 | arg5)
+                                return -EINVAL;
+                        if (current->flags & PF_MCE_PROCESS)
+                                error = (current->flags & PF_MCE_EARLY) ?
+                                        PR_MCE_KILL_EARLY : PR_MCE_KILL_LATE;
+                        else
+                                error = PR_MCE_KILL_DEFAULT;
+                        break;
                default:
                        error = -EINVAL;
                        break;
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index b38423ca711a..b6e7aaea4604 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -1521,7 +1521,7 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
                        if (!table->ctl_name && table->strategy)
                                set_fail(&fail, table, "Strategy without ctl_name");
 #endif
-#ifdef CONFIG_PROC_FS
+#ifdef CONFIG_PROC_SYSCTL
                        if (table->procname && !table->proc_handler)
                                set_fail(&fail, table, "No proc_handler");
 #endif
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 09113347d328..5e18c6ab2c6a 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -394,15 +394,11 @@ void clocksource_resume(void)
 {
        struct clocksource *cs;
-        mutex_lock(&clocksource_mutex);
        list_for_each_entry(cs, &clocksource_list, list)
                if (cs->resume)
                        cs->resume();
        clocksource_resume_watchdog();
-        mutex_unlock(&clocksource_mutex);
 }
 /**
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index e0f59a21c061..89aed5933ed4 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -231,6 +231,13 @@ void tick_nohz_stop_sched_tick(int inidle)
        if (!inidle && !ts->inidle)
                goto end;
+        /*
+         * Set ts->inidle unconditionally. Even if the system did not
+         * switch to NOHZ mode the cpu frequency governers rely on the
+         * update of the idle time accounting in tick_nohz_start_idle().
+         */
+        ts->inidle = 1;
        now = tick_nohz_start_idle(ts);
        /*
@@ -248,8 +255,6 @@ void tick_nohz_stop_sched_tick(int inidle)
        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
                goto end;
-        ts->inidle = 1;
        if (need_resched())
                goto end;
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index fb0f46fa1ecd..c3a4e2907eaa 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -13,6 +13,7 @@
 #include <linux/percpu.h>
 #include <linux/init.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <linux/sysdev.h>
 #include <linux/clocksource.h>
 #include <linux/jiffies.h>
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index fddd69d16e03..1b5b7aa2fdfd 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -275,7 +275,7 @@ static int timer_list_open(struct inode *inode, struct file *filp)
        return single_open(filp, timer_list_show, NULL);
 }
-static struct file_operations timer_list_fops = {
+static const struct file_operations timer_list_fops = {
        .open           = timer_list_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
index 4cde8b9c716f..ee5681f8d7ec 100644
--- a/kernel/time/timer_stats.c
+++ b/kernel/time/timer_stats.c
@@ -395,7 +395,7 @@ static int tstats_open(struct inode *inode, struct file *filp)
        return single_open(filp, tstats_show, NULL);
 }
-static struct file_operations tstats_fops = {
+static const struct file_operations tstats_fops = {
        .open           = tstats_open,
        .read           = seq_read,
        .write          = tstats_write,
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 3eb159c277c8..d9d6206e0b14 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -856,6 +856,37 @@ static void blk_add_trace_remap(struct request_queue *q, struct bio *bio,
 }
 /**
+ * blk_add_trace_rq_remap - Add a trace for a request-remap operation
+ * @q:          queue the io is for
+ * @rq:         the source request
+ * @dev:        target device
+ * @from:       source sector
+ *
+ * Description:
+ *     Device mapper remaps request to other devices.
+ *     Add a trace for that action.
+ *
+ **/
+static void blk_add_trace_rq_remap(struct request_queue *q,
+                                   struct request *rq, dev_t dev,
+                                   sector_t from)
+{
+        struct blk_trace *bt = q->blk_trace;
+        struct blk_io_trace_remap r;
+        if (likely(!bt))
+                return;
+        r.device_from = cpu_to_be32(dev);
+        r.device_to   = cpu_to_be32(disk_devt(rq->rq_disk));
+        r.sector_from = cpu_to_be64(from);
+        __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
+                        rq_data_dir(rq), BLK_TA_REMAP, !!rq->errors,
+                        sizeof(r), &r);
+}
+/**
 * blk_add_driver_data - Add binary message with driver-specific data
 * @q:          queue the io is for
 * @rq:         io request
@@ -922,10 +953,13 @@ static void blk_register_tracepoints(void)
        WARN_ON(ret);
        ret = register_trace_block_remap(blk_add_trace_remap);
        WARN_ON(ret);
+        ret = register_trace_block_rq_remap(blk_add_trace_rq_remap);
+        WARN_ON(ret);
 }
 static void blk_unregister_tracepoints(void)
 {
+        unregister_trace_block_rq_remap(blk_add_trace_rq_remap);
        unregister_trace_block_remap(blk_add_trace_remap);
        unregister_trace_block_split(blk_add_trace_split);
        unregister_trace_block_unplug_io(blk_add_trace_unplug_io);
@@ -1657,6 +1691,11 @@ int blk_trace_init_sysfs(struct device *dev)
        return sysfs_create_group(&dev->kobj, &blk_trace_attr_group);
 }
+void blk_trace_remove_sysfs(struct device *dev)
+{
+        sysfs_remove_group(&dev->kobj, &blk_trace_attr_group);
+}
 #endif /* CONFIG_BLK_DEV_IO_TRACE */
 #ifdef CONFIG_EVENT_TRACING
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index a142579765bf..6dc4e5ef7a01 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -225,7 +225,11 @@ static void ftrace_update_pid_func(void)
        if (ftrace_trace_function == ftrace_stub)
                return;
+#ifdef CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST
        func = ftrace_trace_function;
+#else
+        func = __ftrace_trace_function;
+#endif
        if (ftrace_pid_trace) {
                set_ftrace_pid_function(func);
@@ -736,7 +740,7 @@ ftrace_profile_write(struct file *filp, const char __user *ubuf,
 out:
        mutex_unlock(&ftrace_profile_lock);
-        filp->f_pos += cnt;
+        *ppos += cnt;
        return cnt;
 }
@@ -1074,14 +1078,9 @@ static void ftrace_replace_code(int enable)
                failed = __ftrace_replace_code(rec, enable);
                if (failed) {
                        rec->flags |= FTRACE_FL_FAILED;
-                        if ((system_state == SYSTEM_BOOTING) ||
+                        ftrace_bug(failed, rec->ip);
-                            !core_kernel_text(rec->ip)) {
+                        /* Stop processing */
-                                ftrace_free_rec(rec);
+                        return;
-                                } else {
-                                ftrace_bug(failed, rec->ip);
-                                        /* Stop processing */
-                                        return;
-                                }
                }
        } while_for_each_ftrace_rec();
 }
@@ -1621,8 +1620,10 @@ ftrace_regex_open(struct inode *inode, struct file *file, int enable)
                if (!ret) {
                        struct seq_file *m = file->private_data;
                        m->private = iter;
-                } else
+                } else {
+                        trace_parser_put(&iter->parser);
                        kfree(iter);
+                }
        } else
                file->private_data = iter;
        mutex_unlock(&ftrace_regex_lock);
@@ -2202,7 +2203,7 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
        struct trace_parser *parser;
        ssize_t ret, read;
-        if (!cnt || cnt < 0)
+        if (!cnt)
                return 0;
        mutex_lock(&ftrace_regex_lock);
@@ -2216,20 +2217,20 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
        parser = &iter->parser;
        read = trace_get_user(parser, ubuf, cnt, ppos);
-        if (trace_parser_loaded(parser) &&
+        if (read >= 0 && trace_parser_loaded(parser) &&
            !trace_parser_cont(parser)) {
                ret = ftrace_process_regex(parser->buffer,
                                           parser->idx, enable);
                if (ret)
-                        goto out;
+                        goto out_unlock;
                trace_parser_clear(parser);
        }
        ret = read;
+out_unlock:
        mutex_unlock(&ftrace_regex_lock);
-out:
        return ret;
 }
@@ -2552,8 +2553,7 @@ ftrace_graph_write(struct file *file, const char __user *ubuf,
                   size_t cnt, loff_t *ppos)
 {
        struct trace_parser parser;
-        size_t read = 0;
+        ssize_t read, ret;
-        ssize_t ret;
        if (!cnt || cnt < 0)
                return 0;
@@ -2562,29 +2562,31 @@ ftrace_graph_write(struct file *file, const char __user *ubuf,
        if (ftrace_graph_count >= FTRACE_GRAPH_MAX_FUNCS) {
                ret = -EBUSY;
-                goto out;
+                goto out_unlock;
        }
        if (trace_parser_get_init(&parser, FTRACE_BUFF_MAX)) {
                ret = -ENOMEM;
-                goto out;
+                goto out_unlock;
        }
        read = trace_get_user(&parser, ubuf, cnt, ppos);
-        if (trace_parser_loaded((&parser))) {
+        if (read >= 0 && trace_parser_loaded((&parser))) {
                parser.buffer[parser.idx] = 0;
                /* we allow only one expression at a time */
                ret = ftrace_set_func(ftrace_graph_funcs, &ftrace_graph_count,
                                        parser.buffer);
                if (ret)
-                        goto out;
+                        goto out_free;
        }
        ret = read;
- out:
+out_free:
        trace_parser_put(&parser);
+out_unlock:
        mutex_unlock(&graph_lock);
        return ret;
@@ -2655,19 +2657,17 @@ static int ftrace_convert_nops(struct module *mod,
 }
 #ifdef CONFIG_MODULES
-void ftrace_release(void *start, void *end)
+void ftrace_release_mod(struct module *mod)
 {
        struct dyn_ftrace *rec;
        struct ftrace_page *pg;
-        unsigned long s = (unsigned long)start;
-        unsigned long e = (unsigned long)end;
-        if (ftrace_disabled || !start || start == end)
+        if (ftrace_disabled)
                return;
        mutex_lock(&ftrace_lock);
        do_for_each_ftrace_rec(pg, rec) {
-                if ((rec->ip >= s) && (rec->ip < e)) {
+                if (within_module_core(rec->ip, mod)) {
                        /*
                         * rec->ip is changed in ftrace_free_rec()
                         * It should not between s and e if record was freed.
@@ -2699,9 +2699,7 @@ static int ftrace_module_notify(struct notifier_block *self,
                                   mod->num_ftrace_callsites);
                break;
        case MODULE_STATE_GOING:
-                ftrace_release(mod->ftrace_callsites,
+                ftrace_release_mod(mod);
-                               mod->ftrace_callsites +
-                               mod->num_ftrace_callsites);
                break;
        }
diff --git a/kernel/trace/kmemtrace.c b/kernel/trace/kmemtrace.c
index 81b1645c8549..a91da69f153a 100644
--- a/kernel/trace/kmemtrace.c
+++ b/kernel/trace/kmemtrace.c
@@ -501,7 +501,7 @@ static int __init init_kmem_tracer(void)
                return 1;
        }
-        if (!register_tracer(&kmem_tracer)) {
+        if (register_tracer(&kmem_tracer) != 0) {
                pr_warning("Warning: could not register the kmem tracer\n");
                return 1;
        }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index d4ff01970547..5dd017fea6f5 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -483,7 +483,7 @@ struct ring_buffer_iter {
 /* Up this if you want to test the TIME_EXTENTS and normalization */
 #define DEBUG_SHIFT 0
-static inline u64 rb_time_stamp(struct ring_buffer *buffer, int cpu)
+static inline u64 rb_time_stamp(struct ring_buffer *buffer)
 {
        /* shift to debug/test normalization and TIME_EXTENTS */
        return buffer->clock() << DEBUG_SHIFT;
@@ -494,7 +494,7 @@ u64 ring_buffer_time_stamp(struct ring_buffer *buffer, int cpu)
        u64 time;
        preempt_disable_notrace();
-        time = rb_time_stamp(buffer, cpu);
+        time = rb_time_stamp(buffer);
        preempt_enable_no_resched_notrace();
        return time;
@@ -599,7 +599,7 @@ static struct list_head *rb_list_head(struct list_head *list)
 }
 /*
- * rb_is_head_page - test if the give page is the head page
+ * rb_is_head_page - test if the given page is the head page
 *
 * Because the reader may move the head_page pointer, we can
 * not trust what the head page is (it may be pointing to
@@ -1193,6 +1193,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned nr_pages)
        atomic_inc(&cpu_buffer->record_disabled);
        synchronize_sched();
+        spin_lock_irq(&cpu_buffer->reader_lock);
        rb_head_page_deactivate(cpu_buffer);
        for (i = 0; i < nr_pages; i++) {
@@ -1207,6 +1208,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned nr_pages)
                return;
        rb_reset_cpu(cpu_buffer);
+        spin_unlock_irq(&cpu_buffer->reader_lock);
        rb_check_pages(cpu_buffer);
@@ -1868,7 +1870,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
                 * Nested commits always have zero deltas, so
                 * just reread the time stamp
                 */
-                *ts = rb_time_stamp(buffer, cpu_buffer->cpu);
+                *ts = rb_time_stamp(buffer);
                next_page->page->time_stamp = *ts;
        }
@@ -2111,7 +2113,7 @@ rb_reserve_next_event(struct ring_buffer *buffer,
        if (RB_WARN_ON(cpu_buffer, ++nr_loops > 1000))
                goto out_fail;
-        ts = rb_time_stamp(cpu_buffer->buffer, cpu_buffer->cpu);
+        ts = rb_time_stamp(cpu_buffer->buffer);
        /*
         * Only the first commit can update the timestamp.
@@ -2681,7 +2683,7 @@ unsigned long ring_buffer_entries(struct ring_buffer *buffer)
 EXPORT_SYMBOL_GPL(ring_buffer_entries);
 /**
- * ring_buffer_overrun_cpu - get the number of overruns in buffer
+ * ring_buffer_overruns - get the number of overruns in buffer
 * @buffer: The ring buffer
 *
 * Returns the total number of overruns in the ring buffer
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 411af37f4be4..b20d3ec75de9 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -415,7 +415,7 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
        /* read the non-space input */
        while (cnt && !isspace(ch)) {
-                if (parser->idx < parser->size)
+                if (parser->idx < parser->size - 1)
                        parser->buffer[parser->idx++] = ch;
                else {
                        ret = -EINVAL;
@@ -1393,7 +1393,7 @@ int trace_array_vprintk(struct trace_array *tr,
 int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
 {
-        return trace_array_printk(&global_trace, ip, fmt, args);
+        return trace_array_vprintk(&global_trace, ip, fmt, args);
 }
 EXPORT_SYMBOL_GPL(trace_vprintk);
@@ -2440,7 +2440,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
                        return ret;
        }
-        filp->f_pos += cnt;
+        *ppos += cnt;
        return cnt;
 }
@@ -2582,7 +2582,7 @@ tracing_ctrl_write(struct file *filp, const char __user *ubuf,
        }
        mutex_unlock(&trace_types_lock);
-        filp->f_pos += cnt;
+        *ppos += cnt;
        return cnt;
 }
@@ -2764,7 +2764,7 @@ tracing_set_trace_write(struct file *filp, const char __user *ubuf,
        if (err)
                return err;
-        filp->f_pos += ret;
+        *ppos += ret;
        return ret;
 }
@@ -3299,7 +3299,7 @@ tracing_entries_write(struct file *filp, const char __user *ubuf,
                }
        }
-        filp->f_pos += cnt;
+        *ppos += cnt;
        /* If check pages failed, return ENOMEM */
        if (tracing_disabled)
diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
index 7a7a9fd249a9..4a194f08f88c 100644
--- a/kernel/trace/trace_branch.c
+++ b/kernel/trace/trace_branch.c
@@ -34,6 +34,7 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
        struct trace_array *tr = branch_tracer;
        struct ring_buffer_event *event;
        struct trace_branch *entry;
+        struct ring_buffer *buffer;
        unsigned long flags;
        int cpu, pc;
        const char *p;
@@ -54,7 +55,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
                goto out;
        pc = preempt_count();
-        event = trace_buffer_lock_reserve(tr, TRACE_BRANCH,
+        buffer = tr->buffer;
+        event = trace_buffer_lock_reserve(buffer, TRACE_BRANCH,
                                          sizeof(*entry), flags, pc);
        if (!event)
                goto out;
@@ -74,8 +76,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
        entry->line = f->line;
        entry->correct = val == expect;
-        if (!filter_check_discard(call, entry, tr->buffer, event))
+        if (!filter_check_discard(call, entry, buffer, event))
-                ring_buffer_unlock_commit(tr->buffer, event);
+                ring_buffer_unlock_commit(buffer, event);
 out:
        atomic_dec(&tr->data[cpu]->disabled);
diff --git a/kernel/trace/trace_event_profile.c b/kernel/trace/trace_event_profile.c
index dd44b8768867..8d5c171cc998 100644
--- a/kernel/trace/trace_event_profile.c
+++ b/kernel/trace/trace_event_profile.c
@@ -31,7 +31,7 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
        if (atomic_inc_return(&event->profile_count))
                return 0;
-        if (!total_profile_count++) {
+        if (!total_profile_count) {
                buf = (char *)alloc_percpu(profile_buf_t);
                if (!buf)
                        goto fail_buf;
@@ -46,14 +46,19 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
        }
        ret = event->profile_enable();
-        if (!ret)
+        if (!ret) {
+                total_profile_count++;
                return 0;
+        }
-        kfree(trace_profile_buf_nmi);
 fail_buf_nmi:
-        kfree(trace_profile_buf);
+        if (!total_profile_count) {
+                free_percpu(trace_profile_buf_nmi);
+                free_percpu(trace_profile_buf);
+                trace_profile_buf_nmi = NULL;
+                trace_profile_buf = NULL;
+        }
 fail_buf:
-        total_profile_count--;
        atomic_dec(&event->profile_count);
        return ret;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 6f03c8a1105e..d128f65778e6 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -232,10 +232,9 @@ ftrace_event_write(struct file *file, const char __user *ubuf,
                   size_t cnt, loff_t *ppos)
 {
        struct trace_parser parser;
-        size_t read = 0;
+        ssize_t read, ret;
-        ssize_t ret;
-        if (!cnt || cnt < 0)
+        if (!cnt)
                return 0;
        ret = tracing_update_buffers();
@@ -247,7 +246,7 @@ ftrace_event_write(struct file *file, const char __user *ubuf,
        read = trace_get_user(&parser, ubuf, cnt, ppos);
-        if (trace_parser_loaded((&parser))) {
+        if (read >= 0 && trace_parser_loaded((&parser))) {
                int set = 1;
                if (*parser.buffer == '!')
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 23245785927f..98a6cc5c64ed 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -933,8 +933,9 @@ static void postfix_clear(struct filter_parse_state *ps)
        while (!list_empty(&ps->postfix)) {
                elt = list_first_entry(&ps->postfix, struct postfix_elt, list);
-                kfree(elt->operand);
                list_del(&elt->list);
+                kfree(elt->operand);
+                kfree(elt);
        }
 }
diff --git a/kernel/trace/trace_hw_branches.c b/kernel/trace/trace_hw_branches.c
index 23b63859130e..69543a905cd5 100644
--- a/kernel/trace/trace_hw_branches.c
+++ b/kernel/trace/trace_hw_branches.c
@@ -165,6 +165,7 @@ void trace_hw_branch(u64 from, u64 to)
        struct ftrace_event_call *call = &event_hw_branch;
        struct trace_array *tr = hw_branch_trace;
        struct ring_buffer_event *event;
+        struct ring_buffer *buf;
        struct hw_branch_entry *entry;
        unsigned long irq1;
        int cpu;
@@ -180,7 +181,8 @@ void trace_hw_branch(u64 from, u64 to)
        if (atomic_inc_return(&tr->data[cpu]->disabled) != 1)
                goto out;
-        event = trace_buffer_lock_reserve(tr, TRACE_HW_BRANCHES,
+        buf = tr->buffer;
+        event = trace_buffer_lock_reserve(buf, TRACE_HW_BRANCHES,
                                          sizeof(*entry), 0, 0);
        if (!event)
                goto out;
@@ -189,8 +191,8 @@ void trace_hw_branch(u64 from, u64 to)
        entry->ent.type = TRACE_HW_BRANCHES;
        entry->from = from;
        entry->to   = to;
-        if (!filter_check_discard(call, entry, tr->buffer, event))
+        if (!filter_check_discard(call, entry, buf, event))
-                trace_buffer_unlock_commit(tr, event, 0, 0);
+                trace_buffer_unlock_commit(buf, event, 0, 0);
 out:
        atomic_dec(&tr->data[cpu]->disabled);
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index f572f44c6e1e..b6c12c6a1bcd 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -69,6 +69,9 @@ enum print_line_t trace_print_printk_msg_only(struct trace_iterator *iter)
 * @s: trace sequence descriptor
 * @fmt: printf format string
 *
+ * It returns 0 if the trace oversizes the buffer's free
+ * space, 1 otherwise.
+ *
 * The tracer may use either sequence operations or its own
 * copy to user routines. To simplify formating of a trace
 * trace_seq_printf is used to store strings into a special
@@ -95,7 +98,7 @@ trace_seq_printf(struct trace_seq *s, const char *fmt, ...)
        s->len += ret;
-        return len;
+        return 1;
 }
 EXPORT_SYMBOL_GPL(trace_seq_printf);
@@ -486,16 +489,18 @@ int trace_print_lat_fmt(struct trace_seq *s, struct trace_entry *entry)
                                hardirq ? 'h' : softirq ? 's' : '.'))
                return 0;
-        if (entry->lock_depth < 0)
+        if (entry->preempt_count)
-                ret = trace_seq_putc(s, '.');
+                ret = trace_seq_printf(s, "%x", entry->preempt_count);
        else
-                ret = trace_seq_printf(s, "%d", entry->lock_depth);
+                ret = trace_seq_putc(s, '.');
        if (!ret)
                return 0;
-        if (entry->preempt_count)
+        if (entry->lock_depth < 0)
-                return trace_seq_printf(s, "%x", entry->preempt_count);
+                return trace_seq_putc(s, '.');
-        return trace_seq_putc(s, '.');
+        return trace_seq_printf(s, "%d", entry->lock_depth);
 }
 static int
@@ -883,7 +888,7 @@ static int trace_ctxwake_raw(struct trace_iterator *iter, char S)
        trace_assign_type(field, iter->ent);
        if (!S)
-                task_state_char(field->prev_state);
+                S = task_state_char(field->prev_state);
        T = task_state_char(field->next_state);
        if (!trace_seq_printf(&iter->seq, "%d %d %c %d %d %d %c\n",
                              field->prev_pid,
@@ -918,7 +923,7 @@ static int trace_ctxwake_hex(struct trace_iterator *iter, char S)
        trace_assign_type(field, iter->ent);
        if (!S)
-                task_state_char(field->prev_state);
+                S = task_state_char(field->prev_state);
        T = task_state_char(field->next_state);
        SEQ_PUT_HEX_FIELD_RET(s, field->prev_pid);
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 9fbce6c9d2e1..527e17eae575 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -166,7 +166,7 @@ int syscall_exit_format(struct ftrace_event_call *call, struct trace_seq *s)
                               "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n"
                               "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n",
                               SYSCALL_FIELD(int, nr),
-                               SYSCALL_FIELD(unsigned long, ret));
+                               SYSCALL_FIELD(long, ret));
        if (!ret)
                return 0;
@@ -212,7 +212,7 @@ int syscall_exit_define_fields(struct ftrace_event_call *call)
        if (ret)
                return ret;
-        ret = trace_define_field(call, SYSCALL_FIELD(unsigned long, ret), 0,
+        ret = trace_define_field(call, SYSCALL_FIELD(long, ret), 0,
                                 FILTER_OTHER);
        return ret;
diff --git a/kernel/user.c b/kernel/user.c
index 2c000e7132ac..46d0165ca70c 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -330,9 +330,9 @@ done:
 */
 static void free_user(struct user_struct *up, unsigned long flags)
 {
-        spin_unlock_irqrestore(&uidhash_lock, flags);
        INIT_DELAYED_WORK(&up->work, cleanup_user_struct);
        schedule_delayed_work(&up->work, msecs_to_jiffies(1000));
+        spin_unlock_irqrestore(&uidhash_lock, flags);
 }
 #else   /* CONFIG_USER_SCHED && CONFIG_SYSFS */
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index addfe2df93b1..67e526b6ae81 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -640,6 +640,24 @@ int schedule_delayed_work(struct delayed_work *dwork,
 EXPORT_SYMBOL(schedule_delayed_work);
 /**
+ * flush_delayed_work - block until a dwork_struct's callback has terminated
+ * @dwork: the delayed work which is to be flushed
+ *
+ * Any timeout is cancelled, and any pending work is run immediately.
+ */
+void flush_delayed_work(struct delayed_work *dwork)
+{
+        if (del_timer_sync(&dwork->timer)) {
+                struct cpu_workqueue_struct *cwq;
+                cwq = wq_per_cpu(keventd_wq, get_cpu());
+                __queue_work(cwq, &dwork->work);
+                put_cpu();
+        }
+        flush_work(&dwork->work);
+}
+EXPORT_SYMBOL(flush_delayed_work);
+/**
 * schedule_delayed_work_on - queue work in global workqueue on CPU after delay
 * @cpu: cpu to use
 * @dwork: job to be done
@@ -667,6 +685,7 @@ EXPORT_SYMBOL(schedule_delayed_work_on);
 int schedule_on_each_cpu(work_func_t func)
 {
        int cpu;
+        int orig = -1;
        struct work_struct *works;
        works = alloc_percpu(struct work_struct);
@@ -674,14 +693,28 @@ int schedule_on_each_cpu(work_func_t func)
                return -ENOMEM;
        get_online_cpus();
+        /*
+         * When running in keventd don't schedule a work item on
+         * itself.  Can just call directly because the work queue is
+         * already bound.  This also is faster.
+         */
+        if (current_is_keventd())
+                orig = raw_smp_processor_id();
        for_each_online_cpu(cpu) {
                struct work_struct *work = per_cpu_ptr(works, cpu);
                INIT_WORK(work, func);
-                schedule_work_on(cpu, work);
+                if (cpu != orig)
+                        schedule_work_on(cpu, work);
        }
+        if (orig >= 0)
+                func(per_cpu_ptr(works, orig));
        for_each_online_cpu(cpu)
                flush_work(per_cpu_ptr(works, cpu));
        put_online_cpus();
        free_percpu(works);
        return 0;