23 files changed, 322 insertions, 144 deletions

diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c
index 75bd9b3ebbb7..20059ef4459a 100644
--- a/kernel/debug/kdb/kdb_bp.c
+++ b/kernel/debug/kdb/kdb_bp.c
@@ -274,7 +274,6 @@ static int kdb_bp(int argc, const char **argv)
         int i, bpno;
         kdb_bp_t *bp, *bp_check;
         int diag;
-        int free;
         char *symname = NULL;
         long offset = 0ul;
         int nextarg;
@@ -305,7 +304,6 @@ static int kdb_bp(int argc, const char **argv)
         /*
          * Find an empty bp structure to allocate
          */
-        free = KDB_MAXBPT;
         for (bpno = 0, bp = kdb_breakpoints; bpno < KDB_MAXBPT; bpno++, bp++) {
                 if (bp->bp_free)
                         break;
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index c438f545a321..be775f7e81e0 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -255,7 +255,14 @@ extern void kdb_ps1(const struct task_struct *p);
 extern void kdb_print_nameval(const char *name, unsigned long val);
 extern void kdb_send_sig_info(struct task_struct *p, struct siginfo *info);
 extern void kdb_meminfo_proc_show(void);
+#ifdef CONFIG_KALLSYMS
 extern const char *kdb_walk_kallsyms(loff_t *pos);
+#else /* ! CONFIG_KALLSYMS */
+static inline const char *kdb_walk_kallsyms(loff_t *pos)
+{
+        return NULL;
+}
+#endif /* ! CONFIG_KALLSYMS */
 extern char *kdb_getstr(char *, size_t, char *);
 
 /* Defines for kdb_symbol_print */
diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
index 45344d5c53dd..6b2485dcb050 100644
--- a/kernel/debug/kdb/kdb_support.c
+++ b/kernel/debug/kdb/kdb_support.c
@@ -82,8 +82,8 @@ static char *kdb_name_table[100];	/* arbitrary size */
 int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
 {
         int ret = 0;
-        unsigned long symbolsize;
-        unsigned long offset;
+        unsigned long symbolsize = 0;
+        unsigned long offset = 0;
 #define knt1_size 128           /* must be >= kallsyms table size */
         char *knt1 = NULL;
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 671ed56e0a49..03120229db28 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1386,8 +1386,7 @@ static int wait_task_stopped(struct wait_opts *wo,
         if (!unlikely(wo->wo_flags & WNOWAIT))
                 *p_code = 0;
 
-        /* don't need the RCU readlock here as we're holding a spinlock */
-        uid = __task_cred(p)->uid;
+        uid = task_uid(p);
 unlock_sig:
         spin_unlock_irq(&p->sighand->siglock);
         if (!exit_code)
@@ -1460,7 +1459,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
         }
         if (!unlikely(wo->wo_flags & WNOWAIT))
                 p->signal->flags &= ~SIGNAL_STOP_CONTINUED;
-        uid = __task_cred(p)->uid;
+        uid = task_uid(p);
         spin_unlock_irq(&p->sighand->siglock);
 
         pid = task_pid_vnr(p);
diff --git a/kernel/fork.c b/kernel/fork.c
index 98b450876f93..b7e9d60a675d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -300,7 +300,7 @@ out:
 #ifdef CONFIG_MMU
 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
 {
-        struct vm_area_struct *mpnt, *tmp, **pprev;
+        struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
         struct rb_node **rb_link, *rb_parent;
         int retval;
         unsigned long charge;
@@ -328,6 +328,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
         if (retval)
                 goto out;
 
+        prev = NULL;
         for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
                 struct file *file;
 
@@ -359,7 +360,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                         goto fail_nomem_anon_vma_fork;
                 tmp->vm_flags &= ~VM_LOCKED;
                 tmp->vm_mm = mm;
-                tmp->vm_next = NULL;
+                tmp->vm_next = tmp->vm_prev = NULL;
                 file = tmp->vm_file;
                 if (file) {
                         struct inode *inode = file->f_path.dentry->d_inode;
@@ -392,6 +393,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                  */
                 *pprev = tmp;
                 pprev = &tmp->vm_next;
+                tmp->vm_prev = prev;
+                prev = tmp;
 
                 __vma_link_rb(mm, tmp, rb_link, rb_parent);
                 rb_link = &tmp->vm_rb.rb_right;
@@ -752,13 +755,13 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
         struct fs_struct *fs = current->fs;
         if (clone_flags & CLONE_FS) {
                 /* tsk->fs is already what we want */
-                write_lock(&fs->lock);
+                spin_lock(&fs->lock);
                 if (fs->in_exec) {
-                        write_unlock(&fs->lock);
+                        spin_unlock(&fs->lock);
                         return -EAGAIN;
                 }
                 fs->users++;
-                write_unlock(&fs->lock);
+                spin_unlock(&fs->lock);
                 return 0;
         }
         tsk->fs = copy_fs_struct(fs);
@@ -1676,13 +1679,13 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
 
                 if (new_fs) {
                         fs = current->fs;
-                        write_lock(&fs->lock);
+                        spin_lock(&fs->lock);
                         current->fs = new_fs;
                         if (--fs->users)
                                 new_fs = NULL;
                         else
                                 new_fs = fs;
-                        write_unlock(&fs->lock);
+                        spin_unlock(&fs->lock);
                 }
 
                 if (new_mm) {
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ce669174f355..1decafbb6b1a 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -1091,11 +1091,10 @@ EXPORT_SYMBOL_GPL(hrtimer_cancel);
  */
 ktime_t hrtimer_get_remaining(const struct hrtimer *timer)
 {
-        struct hrtimer_clock_base *base;
         unsigned long flags;
         ktime_t rem;
 
-        base = lock_hrtimer_base(timer, &flags);
+        lock_hrtimer_base(timer, &flags);
         rem = hrtimer_expires_remaining(timer);
         unlock_hrtimer_base(timer, &flags);
 
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 4502604ecadf..6b5580c57644 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -503,6 +503,15 @@ unsigned int __kfifo_out_r(struct __kfifo *fifo, void *buf,
 }
 EXPORT_SYMBOL(__kfifo_out_r);
 
+void __kfifo_skip_r(struct __kfifo *fifo, size_t recsize)
+{
+        unsigned int n;
+
+        n = __kfifo_peek_n(fifo, recsize);
+        fifo->out += n + recsize;
+}
+EXPORT_SYMBOL(__kfifo_skip_r);
+
 int __kfifo_from_user_r(struct __kfifo *fifo, const void __user *from,
         unsigned long len, unsigned int *copied, size_t recsize)
 {
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6e9b19667a8d..9cd0591c96a2 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -153,7 +153,9 @@ static int ____call_usermodehelper(void *data)
                         goto fail;
         }
 
-        retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
+        retval = kernel_execve(sub_info->path,
+                               (const char *const *)sub_info->argv,
+                               (const char *const *)sub_info->envp);
 
         /* Exec failed? */
 fail:
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 4c0b7b3e6d2e..200407c1502f 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -36,15 +36,6 @@
 # include <asm/mutex.h>
 #endif
 
-/***
- * mutex_init - initialize the mutex
- * @lock: the mutex to be initialized
- * @key: the lock_class_key for the class; used by mutex lock debugging
- *
- * Initialize the mutex to unlocked state.
- *
- * It is not allowed to initialize an already locked mutex.
- */
 void
 __mutex_init(struct mutex *lock, const char *name, struct lock_class_key *key)
 {
@@ -68,7 +59,7 @@ EXPORT_SYMBOL(__mutex_init);
 static __used noinline void __sched
 __mutex_lock_slowpath(atomic_t *lock_count);
 
-/***
+/**
  * mutex_lock - acquire the mutex
  * @lock: the mutex to be acquired
  *
@@ -105,7 +96,7 @@ EXPORT_SYMBOL(mutex_lock);
 
 static __used noinline void __sched __mutex_unlock_slowpath(atomic_t *lock_count);
 
-/***
+/**
  * mutex_unlock - release the mutex
  * @lock: the mutex to be released
  *
@@ -364,8 +355,8 @@ __mutex_lock_killable_slowpath(atomic_t *lock_count);
 static noinline int __sched
 __mutex_lock_interruptible_slowpath(atomic_t *lock_count);
 
-/***
- * mutex_lock_interruptible - acquire the mutex, interruptable
+/**
+ * mutex_lock_interruptible - acquire the mutex, interruptible
  * @lock: the mutex to be acquired
  *
  * Lock the mutex like mutex_lock(), and return 0 if the mutex has
@@ -456,15 +447,15 @@ static inline int __mutex_trylock_slowpath(atomic_t *lock_count)
         return prev == 1;
 }
 
-/***
- * mutex_trylock - try acquire the mutex, without waiting
+/**
+ * mutex_trylock - try to acquire the mutex, without waiting
  * @lock: the mutex to be acquired
  *
  * Try to acquire the mutex atomically. Returns 1 if the mutex
  * has been acquired successfully, and 0 on contention.
  *
  * NOTE: this function follows the spin_trylock() convention, so
- * it is negated to the down_trylock() return values! Be careful
+ * it is negated from the down_trylock() return values! Be careful
  * about this when converting semaphore users to mutexes.
  *
  * This function must not be used in interrupt context. The
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 403d1804b198..657555a5f30f 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -402,11 +402,31 @@ static void perf_group_detach(struct perf_event *event)
         }
 }
 
+static inline int
+event_filter_match(struct perf_event *event)
+{
+        return event->cpu == -1 || event->cpu == smp_processor_id();
+}
+
 static void
 event_sched_out(struct perf_event *event,
                   struct perf_cpu_context *cpuctx,
                   struct perf_event_context *ctx)
 {
+        u64 delta;
+        /*
+         * An event which could not be activated because of
+         * filter mismatch still needs to have its timings
+         * maintained, otherwise bogus information is return
+         * via read() for time_enabled, time_running:
+         */
+        if (event->state == PERF_EVENT_STATE_INACTIVE
+            && !event_filter_match(event)) {
+                delta = ctx->time - event->tstamp_stopped;
+                event->tstamp_running += delta;
+                event->tstamp_stopped = ctx->time;
+        }
+
         if (event->state != PERF_EVENT_STATE_ACTIVE)
                 return;
 
@@ -432,9 +452,7 @@ group_sched_out(struct perf_event *group_event,
                 struct perf_event_context *ctx)
 {
         struct perf_event *event;
-
-        if (group_event->state != PERF_EVENT_STATE_ACTIVE)
-                return;
+        int state = group_event->state;
 
         event_sched_out(group_event, cpuctx, ctx);
 
@@ -444,7 +462,7 @@ group_sched_out(struct perf_event *group_event,
         list_for_each_entry(event, &group_event->sibling_list, group_entry)
                 event_sched_out(event, cpuctx, ctx);
 
-        if (group_event->attr.exclusive)
+        if (state == PERF_EVENT_STATE_ACTIVE && group_event->attr.exclusive)
                 cpuctx->exclusive = 0;
 }
 
diff --git a/kernel/pm_qos_params.c b/kernel/pm_qos_params.c
index 996a4dec5f96..b7e4c362361b 100644
--- a/kernel/pm_qos_params.c
+++ b/kernel/pm_qos_params.c
@@ -212,15 +212,17 @@ EXPORT_SYMBOL_GPL(pm_qos_request_active);
 
 /**
  * pm_qos_add_request - inserts new qos request into the list
- * @pm_qos_class: identifies which list of qos request to us
+ * @dep: pointer to a preallocated handle
+ * @pm_qos_class: identifies which list of qos request to use
  * @value: defines the qos request
  *
  * This function inserts a new entry in the pm_qos_class list of requested qos
  * performance characteristics.  It recomputes the aggregate QoS expectations
- * for the pm_qos_class of parameters, and returns the pm_qos_request list
- * element as a handle for use in updating and removal.  Call needs to save
- * this handle for later use.
+ * for the pm_qos_class of parameters and initializes the pm_qos_request_list
+ * handle.  Caller needs to save this handle for later use in updates and
+ * removal.
  */
+
 void pm_qos_add_request(struct pm_qos_request_list *dep,
                         int pm_qos_class, s32 value)
 {
@@ -348,7 +350,7 @@ static int pm_qos_power_open(struct inode *inode, struct file *filp)
 
         pm_qos_class = find_pm_qos_object_by_minor(iminor(inode));
         if (pm_qos_class >= 0) {
-                struct pm_qos_request_list *req = kzalloc(GFP_KERNEL, sizeof(*req));
+               struct pm_qos_request_list *req = kzalloc(sizeof(*req), GFP_KERNEL);
                 if (!req)
                         return -ENOMEM;
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 41541d79e3c8..09b574e7f4df 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3865,8 +3865,16 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
                 /*
                  * Owner changed, break to re-assess state.
                  */
-                if (lock->owner != owner)
+                if (lock->owner != owner) {
+                        /*
+                         * If the lock has switched to a different owner,
+                         * we likely have heavy contention. Return 0 to quit
+                         * optimistic spinning and not contend further:
+                         */
+                        if (lock->owner)
+                                return 0;
                         break;
+                }
 
                 /*
                  * Is that owner really running on that cpu?
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 806d1b227a21..134f7edb30c6 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -1313,7 +1313,7 @@ static struct sched_group *
 find_idlest_group(struct sched_domain *sd, struct task_struct *p,
                   int this_cpu, int load_idx)
 {
-        struct sched_group *idlest = NULL, *this = NULL, *group = sd->groups;
+        struct sched_group *idlest = NULL, *group = sd->groups;
         unsigned long min_load = ULONG_MAX, this_load = 0;
         int imbalance = 100 + (sd->imbalance_pct-100)/2;
 
@@ -1348,7 +1348,6 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p,
 
                 if (local_group) {
                         this_load = avg_load;
-                        this = group;
                 } else if (avg_load < min_load) {
                         min_load = avg_load;
                         idlest = group;
@@ -3752,6 +3751,8 @@ static void task_fork_fair(struct task_struct *p)
 
         raw_spin_lock_irqsave(&rq->lock, flags);
 
+        update_rq_clock(rq);
+
         if (unlikely(task_cpu(p) != this_cpu))
                 __set_task_cpu(p, this_cpu);
 
diff --git a/kernel/sys.c b/kernel/sys.c
index e9ad44489828..7f5a0cd296a9 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -931,6 +931,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
                 pgid = pid;
         if (pgid < 0)
                 return -EINVAL;
+        rcu_read_lock();
 
         /* From this point forward we keep holding onto the tasklist lock
          * so that our parent does not change from under us. -DaveM
@@ -984,6 +985,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
 out:
         /* All paths lead to here, thus we are safe. -DaveM */
         write_unlock_irq(&tasklist_lock);
+        rcu_read_unlock();
         return err;
 }
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ca38e8e3e907..f88552c6d227 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1713,10 +1713,7 @@ static __init int sysctl_init(void)
 {
         sysctl_set_parent(NULL, root_table);
 #ifdef CONFIG_SYSCTL_SYSCALL_CHECK
-        {
-                int err;
-                err = sysctl_check_table(current->nsproxy, root_table);
-        }
+        sysctl_check_table(current->nsproxy, root_table);
 #endif
         return 0;
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 0d88ce9b9fb8..7cb1f45a1de1 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -381,12 +381,19 @@ static int function_stat_show(struct seq_file *m, void *v)
 {
         struct ftrace_profile *rec = v;
         char str[KSYM_SYMBOL_LEN];
+        int ret = 0;
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        static DEFINE_MUTEX(mutex);
         static struct trace_seq s;
         unsigned long long avg;
         unsigned long long stddev;
 #endif
+        mutex_lock(&ftrace_profile_lock);
+
+        /* we raced with function_profile_reset() */
+        if (unlikely(rec->counter == 0)) {
+                ret = -EBUSY;
+                goto out;
+        }
 
         kallsyms_lookup(rec->ip, NULL, NULL, NULL, str);
         seq_printf(m, "  %-30.30s  %10lu", str, rec->counter);
@@ -408,7 +415,6 @@ static int function_stat_show(struct seq_file *m, void *v)
                 do_div(stddev, (rec->counter - 1) * 1000);
         }
 
-        mutex_lock(&mutex);
         trace_seq_init(&s);
         trace_print_graph_duration(rec->time, &s);
         trace_seq_puts(&s, "    ");
@@ -416,11 +422,12 @@ static int function_stat_show(struct seq_file *m, void *v)
         trace_seq_puts(&s, "    ");
         trace_print_graph_duration(stddev, &s);
         trace_print_seq(m, &s);
-        mutex_unlock(&mutex);
 #endif
         seq_putc(m, '\n');
+out:
+        mutex_unlock(&ftrace_profile_lock);
 
-        return 0;
+        return ret;
 }
 
 static void ftrace_profile_reset(struct ftrace_profile_stat *stat)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 3632ce87674f..492197e2f86c 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2985,13 +2985,11 @@ static void rb_advance_reader(struct ring_buffer_per_cpu *cpu_buffer)
 
 static void rb_advance_iter(struct ring_buffer_iter *iter)
 {
-        struct ring_buffer *buffer;
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_event *event;
         unsigned length;
 
         cpu_buffer = iter->cpu_buffer;
-        buffer = cpu_buffer->buffer;
 
         /*
          * Check if we are at the end of the buffer.
@@ -3846,6 +3844,9 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
                         rpos = reader->read;
                         pos += size;
 
+                        if (rpos >= commit)
+                                break;
+
                         event = rb_reader_event(cpu_buffer);
                         size = rb_event_length(event);
                 } while (len > size);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index ba14a22be4cc..9ec59f541156 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3463,6 +3463,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
                                         size_t cnt, loff_t *fpos)
 {
         char *buf;
+        size_t written;
 
         if (tracing_disabled)
                 return -EINVAL;
@@ -3484,11 +3485,15 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
         } else
                 buf[cnt] = '\0';
 
-        cnt = mark_printk("%s", buf);
+        written = mark_printk("%s", buf);
         kfree(buf);
-        *fpos += cnt;
+        *fpos += written;
 
-        return cnt;
+        /* don't tell userspace we wrote more - it might confuse them */
+        if (written > cnt)
+                written = cnt;
+
+        return written;
 }
 
 static int tracing_clock_show(struct seq_file *m, void *v)
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 09b4fa6e4d3b..4c758f146328 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -598,88 +598,165 @@ out:
         return ret;
 }
 
-static void print_event_fields(struct trace_seq *s, struct list_head *head)
+enum {
+        FORMAT_HEADER           = 1,
+        FORMAT_PRINTFMT         = 2,
+};
+
+static void *f_next(struct seq_file *m, void *v, loff_t *pos)
 {
+        struct ftrace_event_call *call = m->private;
         struct ftrace_event_field *field;
+        struct list_head *head;
 
-        list_for_each_entry_reverse(field, head, link) {
-                /*
-                 * Smartly shows the array type(except dynamic array).
-                 * Normal:
-                 *      field:TYPE VAR
-                 * If TYPE := TYPE[LEN], it is shown:
-                 *      field:TYPE VAR[LEN]
-                 */
-                const char *array_descriptor = strchr(field->type, '[');
+        (*pos)++;
 
-                if (!strncmp(field->type, "__data_loc", 10))
-                        array_descriptor = NULL;
+        switch ((unsigned long)v) {
+        case FORMAT_HEADER:
+                head = &ftrace_common_fields;
 
-                if (!array_descriptor) {
-                        trace_seq_printf(s, "\tfield:%s %s;\toffset:%u;"
-                                        "\tsize:%u;\tsigned:%d;\n",
-                                        field->type, field->name, field->offset,
-                                        field->size, !!field->is_signed);
-                } else {
-                        trace_seq_printf(s, "\tfield:%.*s %s%s;\toffset:%u;"
-                                        "\tsize:%u;\tsigned:%d;\n",
-                                        (int)(array_descriptor - field->type),
-                                        field->type, field->name,
-                                        array_descriptor, field->offset,
-                                        field->size, !!field->is_signed);
-                }
+                if (unlikely(list_empty(head)))
+                        return NULL;
+
+                field = list_entry(head->prev, struct ftrace_event_field, link);
+                return field;
+
+        case FORMAT_PRINTFMT:
+                /* all done */
+                return NULL;
+        }
+
+        head = trace_get_fields(call);
+
+        /*
+         * To separate common fields from event fields, the
+         * LSB is set on the first event field. Clear it in case.
+         */
+        v = (void *)((unsigned long)v & ~1L);
+
+        field = v;
+        /*
+         * If this is a common field, and at the end of the list, then
+         * continue with main list.
+         */
+        if (field->link.prev == &ftrace_common_fields) {
+                if (unlikely(list_empty(head)))
+                        return NULL;
+                field = list_entry(head->prev, struct ftrace_event_field, link);
+                /* Set the LSB to notify f_show to print an extra newline */
+                field = (struct ftrace_event_field *)
+                        ((unsigned long)field | 1);
+                return field;
         }
+
+        /* If we are done tell f_show to print the format */
+        if (field->link.prev == head)
+                return (void *)FORMAT_PRINTFMT;
+
+        field = list_entry(field->link.prev, struct ftrace_event_field, link);
+
+        return field;
 }
 
-static ssize_t
-event_format_read(struct file *filp, char __user *ubuf, size_t cnt,
-                  loff_t *ppos)
+static void *f_start(struct seq_file *m, loff_t *pos)
 {
-        struct ftrace_event_call *call = filp->private_data;
-        struct list_head *head;
-        struct trace_seq *s;
-        char *buf;
-        int r;
+        loff_t l = 0;
+        void *p;
 
-        if (*ppos)
+        /* Start by showing the header */
+        if (!*pos)
+                return (void *)FORMAT_HEADER;
+
+        p = (void *)FORMAT_HEADER;
+        do {
+                p = f_next(m, p, &l);
+        } while (p && l < *pos);
+
+        return p;
+}
+
+static int f_show(struct seq_file *m, void *v)
+{
+        struct ftrace_event_call *call = m->private;
+        struct ftrace_event_field *field;
+        const char *array_descriptor;
+
+        switch ((unsigned long)v) {
+        case FORMAT_HEADER:
+                seq_printf(m, "name: %s\n", call->name);
+                seq_printf(m, "ID: %d\n", call->event.type);
+                seq_printf(m, "format:\n");
                 return 0;
 
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
-        if (!s)
-                return -ENOMEM;
+        case FORMAT_PRINTFMT:
+                seq_printf(m, "\nprint fmt: %s\n",
+                           call->print_fmt);
+                return 0;
+        }
 
-        trace_seq_init(s);
+        /*
+         * To separate common fields from event fields, the
+         * LSB is set on the first event field. Clear it and
+         * print a newline if it is set.
+         */
+        if ((unsigned long)v & 1) {
+                seq_putc(m, '\n');
+                v = (void *)((unsigned long)v & ~1L);
+        }
 
-        trace_seq_printf(s, "name: %s\n", call->name);
-        trace_seq_printf(s, "ID: %d\n", call->event.type);
-        trace_seq_printf(s, "format:\n");
+        field = v;
 
-        /* print common fields */
-        print_event_fields(s, &ftrace_common_fields);
+        /*
+         * Smartly shows the array type(except dynamic array).
+         * Normal:
+         *      field:TYPE VAR
+         * If TYPE := TYPE[LEN], it is shown:
+         *      field:TYPE VAR[LEN]
+         */
+        array_descriptor = strchr(field->type, '[');
 
-        trace_seq_putc(s, '\n');
+        if (!strncmp(field->type, "__data_loc", 10))
+                array_descriptor = NULL;
 
-        /* print event specific fields */
-        head = trace_get_fields(call);
-        print_event_fields(s, head);
+        if (!array_descriptor)
+                seq_printf(m, "\tfield:%s %s;\toffset:%u;\tsize:%u;\tsigned:%d;\n",
+                           field->type, field->name, field->offset,
+                           field->size, !!field->is_signed);
+        else
+                seq_printf(m, "\tfield:%.*s %s%s;\toffset:%u;\tsize:%u;\tsigned:%d;\n",
+                           (int)(array_descriptor - field->type),
+                           field->type, field->name,
+                           array_descriptor, field->offset,
+                           field->size, !!field->is_signed);
 
-        r = trace_seq_printf(s, "\nprint fmt: %s\n", call->print_fmt);
+        return 0;
+}
 
-        if (!r) {
-                /*
-                 * ug!  The format output is bigger than a PAGE!!
-                 */
-                buf = "FORMAT TOO BIG\n";
-                r = simple_read_from_buffer(ubuf, cnt, ppos,
-                                              buf, strlen(buf));
-                goto out;
-        }
+static void f_stop(struct seq_file *m, void *p)
+{
+}
 
-        r = simple_read_from_buffer(ubuf, cnt, ppos,
-                                    s->buffer, s->len);
- out:
-        kfree(s);
-        return r;
+static const struct seq_operations trace_format_seq_ops = {
+        .start          = f_start,
+        .next           = f_next,
+        .stop           = f_stop,
+        .show           = f_show,
+};
+
+static int trace_format_open(struct inode *inode, struct file *file)
+{
+        struct ftrace_event_call *call = inode->i_private;
+        struct seq_file *m;
+        int ret;
+
+        ret = seq_open(file, &trace_format_seq_ops);
+        if (ret < 0)
+                return ret;
+
+        m = file->private_data;
+        m->private = call;
+
+        return 0;
 }
 
 static ssize_t
@@ -877,8 +954,10 @@ static const struct file_operations ftrace_enable_fops = {
 };
 
 static const struct file_operations ftrace_event_format_fops = {
-        .open = tracing_open_generic,
-        .read = event_format_read,
+        .open = trace_format_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release,
 };
 
 static const struct file_operations ftrace_event_id_fops = {
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 6bff23625781..6f233698518e 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -507,7 +507,15 @@ get_return_for_leaf(struct trace_iterator *iter,
                          * if the output fails.
                          */
                         data->ent = *curr;
-                        data->ret = *next;
+                        /*
+                         * If the next event is not a return type, then
+                         * we only care about what type it is. Otherwise we can
+                         * safely copy the entire event.
+                         */
+                        if (next->ent.type == TRACE_GRAPH_RET)
+                                data->ret = *next;
+                        else
+                                data->ret.ent.type = next->ent.type;
                 }
         }
 
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 056468eae7cf..a6b7e0e0f3eb 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -249,7 +249,7 @@ static int trace_lookup_stack(struct seq_file *m, long i)
 {
         unsigned long addr = stack_dump_trace[i];
 
-        return seq_printf(m, "%pF\n", (void *)addr);
+        return seq_printf(m, "%pS\n", (void *)addr);
 }
 
 static void print_disabled(struct seq_file *m)
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 613bc1f04610..7f9c3c52ecc1 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -122,7 +122,7 @@ static void __touch_watchdog(void)
 
 void touch_softlockup_watchdog(void)
 {
-        __get_cpu_var(watchdog_touch_ts) = 0;
+        __raw_get_cpu_var(watchdog_touch_ts) = 0;
 }
 EXPORT_SYMBOL(touch_softlockup_watchdog);
 
@@ -142,7 +142,14 @@ void touch_all_softlockup_watchdogs(void)
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 void touch_nmi_watchdog(void)
 {
-        __get_cpu_var(watchdog_nmi_touch) = true;
+        if (watchdog_enabled) {
+                unsigned cpu;
+
+                for_each_present_cpu(cpu) {
+                        if (per_cpu(watchdog_nmi_touch, cpu) != true)
+                                per_cpu(watchdog_nmi_touch, cpu) = true;
+                }
+        }
         touch_softlockup_watchdog();
 }
 EXPORT_SYMBOL(touch_nmi_watchdog);
@@ -206,6 +213,9 @@ void watchdog_overflow_callback(struct perf_event *event, int nmi,
                  struct perf_sample_data *data,
                  struct pt_regs *regs)
 {
+        /* Ensure the watchdog never gets throttled */
+        event->hw.interrupts = 0;
+
         if (__get_cpu_var(watchdog_nmi_touch) == true) {
                 __get_cpu_var(watchdog_nmi_touch) = false;
                 return;
@@ -430,6 +440,9 @@ static int watchdog_enable(int cpu)
                 wake_up_process(p);
         }
 
+        /* if any cpu succeeds, watchdog is considered enabled for the system */
+        watchdog_enabled = 1;
+
         return 0;
 }
 
@@ -452,9 +465,6 @@ static void watchdog_disable(int cpu)
                 per_cpu(softlockup_watchdog, cpu) = NULL;
                 kthread_stop(p);
         }
-
-        /* if any cpu succeeds, watchdog is considered enabled for the system */
-        watchdog_enabled = 1;
 }
 
 static void watchdog_enable_all_cpus(void)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 2994a0e3a61c..727f24e563ae 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -35,6 +35,9 @@
 #include <linux/lockdep.h>
 #include <linux/idr.h>
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/workqueue.h>
+
 #include "workqueue_sched.h"
 
 enum {
@@ -87,7 +90,8 @@ enum {
 /*
  * Structure fields follow one of the following exclusion rules.
  *
- * I: Set during initialization and read-only afterwards.
+ * I: Modifiable by initialization/destruction paths and read-only for
+ *    everyone else.
  *
  * P: Preemption protected.  Disabling preemption is enough and should
  *    only be modified and accessed from the local cpu.
@@ -195,7 +199,7 @@ typedef cpumask_var_t mayday_mask_t;
         cpumask_test_and_set_cpu((cpu), (mask))
 #define mayday_clear_cpu(cpu, mask)             cpumask_clear_cpu((cpu), (mask))
 #define for_each_mayday_cpu(cpu, mask)          for_each_cpu((cpu), (mask))
-#define alloc_mayday_mask(maskp, gfp)           alloc_cpumask_var((maskp), (gfp))
+#define alloc_mayday_mask(maskp, gfp)           zalloc_cpumask_var((maskp), (gfp))
 #define free_mayday_mask(mask)                  free_cpumask_var((mask))
 #else
 typedef unsigned long mayday_mask_t;
@@ -940,10 +944,14 @@ static void __queue_work(unsigned int cpu, struct workqueue_struct *wq,
         struct global_cwq *gcwq;
         struct cpu_workqueue_struct *cwq;
         struct list_head *worklist;
+        unsigned int work_flags;
         unsigned long flags;
 
         debug_work_activate(work);
 
+        if (WARN_ON_ONCE(wq->flags & WQ_DYING))
+                return;
+
         /* determine gcwq to use */
         if (!(wq->flags & WQ_UNBOUND)) {
                 struct global_cwq *last_gcwq;
@@ -986,14 +994,17 @@ static void __queue_work(unsigned int cpu, struct workqueue_struct *wq,
         BUG_ON(!list_empty(&work->entry));
 
         cwq->nr_in_flight[cwq->work_color]++;
+        work_flags = work_color_to_flags(cwq->work_color);
 
         if (likely(cwq->nr_active < cwq->max_active)) {
                 cwq->nr_active++;
                 worklist = gcwq_determine_ins_pos(gcwq, cwq);
-        } else
+        } else {
+                work_flags |= WORK_STRUCT_DELAYED;
                 worklist = &cwq->delayed_works;
+        }
 
-        insert_work(cwq, work, worklist, work_color_to_flags(cwq->work_color));
+        insert_work(cwq, work, worklist, work_flags);
 
         spin_unlock_irqrestore(&gcwq->lock, flags);
 }
@@ -1212,6 +1223,7 @@ static void worker_leave_idle(struct worker *worker)
  * bound), %false if offline.
  */
 static bool worker_maybe_bind_and_lock(struct worker *worker)
+__acquires(&gcwq->lock)
 {
         struct global_cwq *gcwq = worker->gcwq;
         struct task_struct *task = worker->task;
@@ -1485,6 +1497,8 @@ static void gcwq_mayday_timeout(unsigned long __gcwq)
  * otherwise.
  */
 static bool maybe_create_worker(struct global_cwq *gcwq)
+__releases(&gcwq->lock)
+__acquires(&gcwq->lock)
 {
         if (!need_to_create_worker(gcwq))
                 return false;
@@ -1659,6 +1673,7 @@ static void cwq_activate_first_delayed(struct cpu_workqueue_struct *cwq)
         struct list_head *pos = gcwq_determine_ins_pos(cwq->gcwq, cwq);
 
         move_linked_works(work, pos, NULL);
+        __clear_bit(WORK_STRUCT_DELAYED_BIT, work_data_bits(work));
         cwq->nr_active++;
 }
 
@@ -1666,6 +1681,7 @@ static void cwq_activate_first_delayed(struct cpu_workqueue_struct *cwq)
  * cwq_dec_nr_in_flight - decrement cwq's nr_in_flight
  * @cwq: cwq of interest
  * @color: color of work which left the queue
+ * @delayed: for a delayed work
  *
  * A work either has completed or is removed from pending queue,
  * decrement nr_in_flight of its cwq and handle workqueue flushing.
@@ -1673,19 +1689,22 @@ static void cwq_activate_first_delayed(struct cpu_workqueue_struct *cwq)
  * CONTEXT:
  * spin_lock_irq(gcwq->lock).
  */
-static void cwq_dec_nr_in_flight(struct cpu_workqueue_struct *cwq, int color)
+static void cwq_dec_nr_in_flight(struct cpu_workqueue_struct *cwq, int color,
+                                 bool delayed)
 {
         /* ignore uncolored works */
         if (color == WORK_NO_COLOR)
                 return;
 
         cwq->nr_in_flight[color]--;
-        cwq->nr_active--;
 
-        if (!list_empty(&cwq->delayed_works)) {
-                /* one down, submit a delayed one */
-                if (cwq->nr_active < cwq->max_active)
-                        cwq_activate_first_delayed(cwq);
+        if (!delayed) {
+                cwq->nr_active--;
+                if (!list_empty(&cwq->delayed_works)) {
+                        /* one down, submit a delayed one */
+                        if (cwq->nr_active < cwq->max_active)
+                                cwq_activate_first_delayed(cwq);
+                }
         }
 
         /* is flush in progress and are we at the flushing tip? */
@@ -1722,6 +1741,8 @@ static void cwq_dec_nr_in_flight(struct cpu_workqueue_struct *cwq, int color)
  * spin_lock_irq(gcwq->lock) which is released and regrabbed.
  */
 static void process_one_work(struct worker *worker, struct work_struct *work)
+__releases(&gcwq->lock)
+__acquires(&gcwq->lock)
 {
         struct cpu_workqueue_struct *cwq = get_work_cwq(work);
         struct global_cwq *gcwq = cwq->gcwq;
@@ -1790,7 +1811,13 @@ static void process_one_work(struct worker *worker, struct work_struct *work)
         work_clear_pending(work);
         lock_map_acquire(&cwq->wq->lockdep_map);
         lock_map_acquire(&lockdep_map);
+        trace_workqueue_execute_start(work);
         f(work);
+        /*
+         * While we must be careful to not use "work" after this, the trace
+         * point will only record its address.
+         */
+        trace_workqueue_execute_end(work);
         lock_map_release(&lockdep_map);
         lock_map_release(&cwq->wq->lockdep_map);
 
@@ -1814,7 +1841,7 @@ static void process_one_work(struct worker *worker, struct work_struct *work)
         hlist_del_init(&worker->hentry);
         worker->current_work = NULL;
         worker->current_cwq = NULL;
-        cwq_dec_nr_in_flight(cwq, work_color);
+        cwq_dec_nr_in_flight(cwq, work_color, false);
 }
 
 /**
@@ -2379,7 +2406,8 @@ static int try_to_grab_pending(struct work_struct *work)
                         debug_work_deactivate(work);
                         list_del_init(&work->entry);
                         cwq_dec_nr_in_flight(get_work_cwq(work),
-                                             get_work_color(work));
+                                get_work_color(work),
+                                *work_data_bits(work) & WORK_STRUCT_DELAYED);
                         ret = 1;
                 }
         }
@@ -2782,7 +2810,6 @@ struct workqueue_struct *__alloc_workqueue_key(const char *name,
                 if (IS_ERR(rescuer->task))
                         goto err;
 
-                wq->rescuer = rescuer;
                 rescuer->task->flags |= PF_THREAD_BOUND;
                 wake_up_process(rescuer->task);
         }
@@ -2824,6 +2851,7 @@ void destroy_workqueue(struct workqueue_struct *wq)
 {
         unsigned int cpu;
 
+        wq->flags |= WQ_DYING;
         flush_workqueue(wq);
 
         /*
@@ -2848,6 +2876,7 @@ void destroy_workqueue(struct workqueue_struct *wq)
         if (wq->flags & WQ_RESCUER) {
                 kthread_stop(wq->rescuer->task);
                 free_mayday_mask(wq->mayday_mask);
+                kfree(wq->rescuer);
         }
 
         free_cwqs(wq);
@@ -3230,6 +3259,8 @@ static int __cpuinit trustee_thread(void *__gcwq)
  * multiple times.  To be used by cpu_callback.
  */
 static void __cpuinit wait_trustee_state(struct global_cwq *gcwq, int state)
+__releases(&gcwq->lock)
+__acquires(&gcwq->lock)
 {
         if (!(gcwq->trustee_state == state ||
               gcwq->trustee_state == TRUSTEE_DONE)) {
@@ -3536,8 +3567,7 @@ static int __init init_workqueues(void)
                 spin_lock_init(&gcwq->lock);
                 INIT_LIST_HEAD(&gcwq->worklist);
                 gcwq->cpu = cpu;
-                if (cpu == WORK_CPU_UNBOUND)
-                        gcwq->flags |= GCWQ_DISASSOCIATED;
+                gcwq->flags |= GCWQ_DISASSOCIATED;
 
                 INIT_LIST_HEAD(&gcwq->idle_list);
                 for (i = 0; i < BUSY_WORKER_HASH_SIZE; i++)
@@ -3561,6 +3591,8 @@ static int __init init_workqueues(void)
                 struct global_cwq *gcwq = get_gcwq(cpu);
                 struct worker *worker;
 
+                if (cpu != WORK_CPU_UNBOUND)
+                        gcwq->flags &= ~GCWQ_DISASSOCIATED;
                 worker = create_worker(gcwq, true);
                 BUG_ON(!worker);
                 spin_lock_irq(&gcwq->lock);