70 files changed, 3112 insertions, 1738 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index 642d4277c2ea..2a999836ca18 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -4,11 +4,12 @@
 
 obj-y     = sched.o fork.o exec_domain.o panic.o printk.o profile.o \
             exit.o itimer.o time.o softirq.o resource.o \
-            sysctl.o capability.o ptrace.o timer.o user.o \
+            sysctl.o capability.o ptrace.o timer.o user.o user_namespace.o \
             signal.o sys.o kmod.o workqueue.o pid.o \
             rcupdate.o extable.o params.o posix-timers.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
-            hrtimer.o rwsem.o latency.o nsproxy.o srcu.o die_notifier.o
+            hrtimer.o rwsem.o latency.o nsproxy.o srcu.o die_notifier.o \
+            utsname.o
 
 obj-$(CONFIG_STACKTRACE) += stacktrace.o
 obj-y += time/
@@ -48,7 +49,6 @@ obj-$(CONFIG_SECCOMP) += seccomp.o
 obj-$(CONFIG_RCU_TORTURE_TEST) += rcutorture.o
 obj-$(CONFIG_RELAY) += relay.o
 obj-$(CONFIG_SYSCTL) += utsname_sysctl.o
-obj-$(CONFIG_UTS_NS) += utsname.o
 obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
 obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
 
diff --git a/kernel/audit.c b/kernel/audit.c
index d13276d41410..eb0f9165b401 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -58,6 +58,7 @@
 #include <linux/selinux.h>
 #include <linux/inotify.h>
 #include <linux/freezer.h>
+#include <linux/tty.h>
 
 #include "audit.h"
 
@@ -391,6 +392,7 @@ static int kauditd_thread(void *dummy)
 {
         struct sk_buff *skb;
 
+        set_freezable();
         while (!kthread_should_stop()) {
                 skb = skb_dequeue(&audit_skb_queue);
                 wake_up(&audit_backlog_wait);
@@ -423,6 +425,31 @@ static int kauditd_thread(void *dummy)
         return 0;
 }
 
+static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
+{
+        struct task_struct *tsk;
+        int err;
+
+        read_lock(&tasklist_lock);
+        tsk = find_task_by_pid(pid);
+        err = -ESRCH;
+        if (!tsk)
+                goto out;
+        err = 0;
+
+        spin_lock_irq(&tsk->sighand->siglock);
+        if (!tsk->signal->audit_tty)
+                err = -EPERM;
+        spin_unlock_irq(&tsk->sighand->siglock);
+        if (err)
+                goto out;
+
+        tty_audit_push_task(tsk, loginuid);
+out:
+        read_unlock(&tasklist_lock);
+        return err;
+}
+
 int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
@@ -511,6 +538,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
         case AUDIT_DEL:
         case AUDIT_DEL_RULE:
         case AUDIT_SIGNAL_INFO:
+        case AUDIT_TTY_GET:
+        case AUDIT_TTY_SET:
                 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
                         err = -EPERM;
                 break;
@@ -622,6 +651,11 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 err = audit_filter_user(&NETLINK_CB(skb), msg_type);
                 if (err == 1) {
                         err = 0;
+                        if (msg_type == AUDIT_USER_TTY) {
+                                err = audit_prepare_user_tty(pid, loginuid);
+                                if (err)
+                                        break;
+                        }
                         ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
                         if (ab) {
                                 audit_log_format(ab,
@@ -638,8 +672,17 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                                         " subj=%s", ctx);
                                         kfree(ctx);
                                 }
-                                audit_log_format(ab, " msg='%.1024s'",
-                                         (char *)data);
+                                if (msg_type != AUDIT_USER_TTY)
+                                        audit_log_format(ab, " msg='%.1024s'",
+                                                         (char *)data);
+                                else {
+                                        int size;
+
+                                        audit_log_format(ab, " msg=");
+                                        size = nlmsg_len(nlh);
+                                        audit_log_n_untrustedstring(ab, size,
+                                                                    data);
+                                }
                                 audit_set_pid(ab, pid);
                                 audit_log_end(ab);
                         }
@@ -730,6 +773,45 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 0, 0, sig_data, sizeof(*sig_data) + len);
                 kfree(sig_data);
                 break;
+        case AUDIT_TTY_GET: {
+                struct audit_tty_status s;
+                struct task_struct *tsk;
+
+                read_lock(&tasklist_lock);
+                tsk = find_task_by_pid(pid);
+                if (!tsk)
+                        err = -ESRCH;
+                else {
+                        spin_lock_irq(&tsk->sighand->siglock);
+                        s.enabled = tsk->signal->audit_tty != 0;
+                        spin_unlock_irq(&tsk->sighand->siglock);
+                }
+                read_unlock(&tasklist_lock);
+                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
+                                 &s, sizeof(s));
+                break;
+        }
+        case AUDIT_TTY_SET: {
+                struct audit_tty_status *s;
+                struct task_struct *tsk;
+
+                if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
+                        return -EINVAL;
+                s = data;
+                if (s->enabled != 0 && s->enabled != 1)
+                        return -EINVAL;
+                read_lock(&tasklist_lock);
+                tsk = find_task_by_pid(pid);
+                if (!tsk)
+                        err = -ESRCH;
+                else {
+                        spin_lock_irq(&tsk->sighand->siglock);
+                        tsk->signal->audit_tty = s->enabled != 0;
+                        spin_unlock_irq(&tsk->sighand->siglock);
+                }
+                read_unlock(&tasklist_lock);
+                break;
+        }
         default:
                 err = -EINVAL;
                 break;
@@ -1185,7 +1267,7 @@ static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
 }
 
 /**
- * audit_log_n_unstrustedstring - log a string that may contain random characters
+ * audit_log_n_untrustedstring - log a string that may contain random characters
  * @ab: audit_buffer
  * @len: lenth of string (not including trailing null)
  * @string: string to be logged
@@ -1201,25 +1283,24 @@ static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
 const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
                                         const char *string)
 {
-        const unsigned char *p = string;
+        const unsigned char *p;
 
-        while (*p) {
+        for (p = string; p < (const unsigned char *)string + len && *p; p++) {
                 if (*p == '"' || *p < 0x21 || *p > 0x7f) {
                         audit_log_hex(ab, string, len);
                         return string + len + 1;
                 }
-                p++;
         }
         audit_log_n_string(ab, len, string);
         return p + 1;
 }
 
 /**
- * audit_log_unstrustedstring - log a string that may contain random characters
+ * audit_log_untrustedstring - log a string that may contain random characters
  * @ab: audit_buffer
  * @string: string to be logged
  *
- * Same as audit_log_n_unstrustedstring(), except that strlen is used to
+ * Same as audit_log_n_untrustedstring(), except that strlen is used to
  * determine string length.
  */
 const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
diff --git a/kernel/audit.h b/kernel/audit.h
index 815d6f5c04ee..95877435c347 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -115,7 +115,6 @@ extern struct sk_buff *	    audit_make_reply(int pid, int seq, int type,
 extern void                 audit_send_reply(int pid, int seq, int type,
                                              int done, int multi,
                                              void *payload, int size);
-extern void                 audit_log_lost(const char *message);
 extern void                 audit_panic(const char *message);
 
 struct audit_netlink_list {
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index ce61f423542c..359645cff5b2 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -304,7 +304,7 @@ int __init audit_register_class(int class, unsigned *list)
 
 int audit_match_class(int class, unsigned syscall)
 {
-        if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32)))
+        if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
                 return 0;
         if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
                 return 0;
@@ -456,6 +456,13 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
                 case AUDIT_DEVMINOR:
                 case AUDIT_EXIT:
                 case AUDIT_SUCCESS:
+                        /* bit ops are only useful on syscall args */
+                        if (f->op == AUDIT_BIT_MASK ||
+                                                f->op == AUDIT_BIT_TEST) {
+                                err = -EINVAL;
+                                goto exit_free;
+                        }
+                        break;
                 case AUDIT_ARG0:
                 case AUDIT_ARG1:
                 case AUDIT_ARG2:
@@ -1210,8 +1217,8 @@ static inline int audit_add_rule(struct audit_entry *entry,
         struct audit_entry *e;
         struct audit_field *inode_f = entry->rule.inode_f;
         struct audit_watch *watch = entry->rule.watch;
-        struct nameidata *ndp, *ndw;
-        int h, err, putnd_needed = 0;
+        struct nameidata *ndp = NULL, *ndw = NULL;
+        int h, err;
 #ifdef CONFIG_AUDITSYSCALL
         int dont_count = 0;
 
@@ -1239,7 +1246,6 @@ static inline int audit_add_rule(struct audit_entry *entry,
                 err = audit_get_nd(watch->path, &ndp, &ndw);
                 if (err)
                         goto error;
-                putnd_needed = 1;
         }
 
         mutex_lock(&audit_filter_mutex);
@@ -1269,14 +1275,11 @@ static inline int audit_add_rule(struct audit_entry *entry,
 #endif
         mutex_unlock(&audit_filter_mutex);
 
-        if (putnd_needed)
-                audit_put_nd(ndp, ndw);
-
+        audit_put_nd(ndp, ndw);         /* NULL args OK */
         return 0;
 
 error:
-        if (putnd_needed)
-                audit_put_nd(ndp, ndw);
+        audit_put_nd(ndp, ndw);         /* NULL args OK */
         if (watch)
                 audit_put_watch(watch); /* tmp watch, matches initial get */
         return err;
@@ -1570,6 +1573,10 @@ int audit_comparator(const u32 left, const u32 op, const u32 right)
                 return (left > right);
         case AUDIT_GREATER_THAN_OR_EQUAL:
                 return (left >= right);
+        case AUDIT_BIT_MASK:
+                return (left & right);
+        case AUDIT_BIT_TEST:
+                return ((left & right) == right);
         }
         BUG();
         return 0;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e36481ed61b4..bde1124d5908 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -71,9 +71,6 @@
 
 extern struct list_head audit_filter_list[];
 
-/* No syscall auditing will take place unless audit_enabled != 0. */
-extern int audit_enabled;
-
 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
  * for saving names from getname(). */
 #define AUDIT_NAMES    20
@@ -156,7 +153,7 @@ struct audit_aux_data_execve {
         struct audit_aux_data   d;
         int argc;
         int envc;
-        char mem[0];
+        struct mm_struct *mm;
 };
 
 struct audit_aux_data_socketcall {
@@ -176,12 +173,6 @@ struct audit_aux_data_fd_pair {
         int     fd[2];
 };
 
-struct audit_aux_data_path {
-        struct audit_aux_data   d;
-        struct dentry           *dentry;
-        struct vfsmount         *mnt;
-};
-
 struct audit_aux_data_pids {
         struct audit_aux_data   d;
         pid_t                   target_pid[AUDIT_AUX_PIDS];
@@ -657,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context)
         struct audit_aux_data *aux;
 
         while ((aux = context->aux)) {
-                if (aux->type == AUDIT_AVC_PATH) {
-                        struct audit_aux_data_path *axi = (void *)aux;
-                        dput(axi->dentry);
-                        mntput(axi->mnt);
-                }
-
                 context->aux = aux->next;
                 kfree(aux);
         }
@@ -834,6 +819,55 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
         return rc;
 }
 
+static void audit_log_execve_info(struct audit_buffer *ab,
+                struct audit_aux_data_execve *axi)
+{
+        int i;
+        long len, ret;
+        const char __user *p = (const char __user *)axi->mm->arg_start;
+        char *buf;
+
+        if (axi->mm != current->mm)
+                return; /* execve failed, no additional info */
+
+        for (i = 0; i < axi->argc; i++, p += len) {
+                len = strnlen_user(p, MAX_ARG_STRLEN);
+                /*
+                 * We just created this mm, if we can't find the strings
+                 * we just copied into it something is _very_ wrong. Similar
+                 * for strings that are too long, we should not have created
+                 * any.
+                 */
+                if (!len || len > MAX_ARG_STRLEN) {
+                        WARN_ON(1);
+                        send_sig(SIGKILL, current, 0);
+                }
+
+                buf = kmalloc(len, GFP_KERNEL);
+                if (!buf) {
+                        audit_panic("out of memory for argv string\n");
+                        break;
+                }
+
+                ret = copy_from_user(buf, p, len);
+                /*
+                 * There is no reason for this copy to be short. We just
+                 * copied them here, and the mm hasn't been exposed to user-
+                 * space yet.
+                 */
+                if (!ret) {
+                        WARN_ON(1);
+                        send_sig(SIGKILL, current, 0);
+                }
+
+                audit_log_format(ab, "a%d=", i);
+                audit_log_untrustedstring(ab, buf);
+                audit_log_format(ab, "\n");
+
+                kfree(buf);
+        }
+}
+
 static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
 {
         int i, call_panic = 0;
@@ -949,7 +983,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                 case AUDIT_IPC: {
                         struct audit_aux_data_ipcctl *axi = (void *)aux;
                         audit_log_format(ab, 
-                                 "ouid=%u ogid=%u mode=%x",
+                                 "ouid=%u ogid=%u mode=%#o",
                                  axi->uid, axi->gid, axi->mode);
                         if (axi->osid != 0) {
                                 char *ctx = NULL;
@@ -968,19 +1002,13 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                 case AUDIT_IPC_SET_PERM: {
                         struct audit_aux_data_ipcctl *axi = (void *)aux;
                         audit_log_format(ab,
-                                "qbytes=%lx ouid=%u ogid=%u mode=%x",
+                                "qbytes=%lx ouid=%u ogid=%u mode=%#o",
                                 axi->qbytes, axi->uid, axi->gid, axi->mode);
                         break; }
 
                 case AUDIT_EXECVE: {
                         struct audit_aux_data_execve *axi = (void *)aux;
-                        int i;
-                        const char *p;
-                        for (i = 0, p = axi->mem; i < axi->argc; i++) {
-                                audit_log_format(ab, "a%d=", i);
-                                p = audit_log_untrustedstring(ab, p);
-                                audit_log_format(ab, "\n");
-                        }
+                        audit_log_execve_info(ab, axi);
                         break; }
 
                 case AUDIT_SOCKETCALL: {
@@ -998,11 +1026,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                         audit_log_hex(ab, axs->a, axs->len);
                         break; }
 
-                case AUDIT_AVC_PATH: {
-                        struct audit_aux_data_path *axi = (void *)aux;
-                        audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
-                        break; }
-
                 case AUDIT_FD_PAIR: {
                         struct audit_aux_data_fd_pair *axs = (void *)aux;
                         audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
@@ -1824,32 +1847,31 @@ int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode
         return 0;
 }
 
+int audit_argv_kb = 32;
+
 int audit_bprm(struct linux_binprm *bprm)
 {
         struct audit_aux_data_execve *ax;
         struct audit_context *context = current->audit_context;
-        unsigned long p, next;
-        void *to;
 
         if (likely(!audit_enabled || !context || context->dummy))
                 return 0;
 
-        ax = kmalloc(sizeof(*ax) + PAGE_SIZE * MAX_ARG_PAGES - bprm->p,
-                                GFP_KERNEL);
+        /*
+         * Even though the stack code doesn't limit the arg+env size any more,
+         * the audit code requires that _all_ arguments be logged in a single
+         * netlink skb. Hence cap it :-(
+         */
+        if (bprm->argv_len > (audit_argv_kb << 10))
+                return -E2BIG;
+
+        ax = kmalloc(sizeof(*ax), GFP_KERNEL);
         if (!ax)
                 return -ENOMEM;
 
         ax->argc = bprm->argc;
         ax->envc = bprm->envc;
-        for (p = bprm->p, to = ax->mem; p < MAX_ARG_PAGES*PAGE_SIZE; p = next) {
-                struct page *page = bprm->page[p / PAGE_SIZE];
-                void *kaddr = kmap(page);
-                next = (p + PAGE_SIZE) & ~(PAGE_SIZE - 1);
-                memcpy(to, kaddr + (p & (PAGE_SIZE - 1)), next - p);
-                to += next - p;
-                kunmap(page);
-        }
-
+        ax->mm = bprm->mm;
         ax->d.type = AUDIT_EXECVE;
         ax->d.next = context->aux;
         context->aux = (void *)ax;
@@ -1952,36 +1974,6 @@ void __audit_ptrace(struct task_struct *t)
 }
 
 /**
- * audit_avc_path - record the granting or denial of permissions
- * @dentry: dentry to record
- * @mnt: mnt to record
- *
- * Returns 0 for success or NULL context or < 0 on error.
- *
- * Called from security/selinux/avc.c::avc_audit()
- */
-int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
-{
-        struct audit_aux_data_path *ax;
-        struct audit_context *context = current->audit_context;
-
-        if (likely(!context))
-                return 0;
-
-        ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
-        if (!ax)
-                return -ENOMEM;
-
-        ax->dentry = dget(dentry);
-        ax->mnt = mntget(mnt);
-
-        ax->d.type = AUDIT_AVC_PATH;
-        ax->d.next = context->aux;
-        context->aux = (void *)ax;
-        return 0;
-}
-
-/**
  * audit_signal_info - record signal info for shutting down audit subsystem
  * @sig: signal value
  * @t: task being signaled
@@ -2040,7 +2032,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
 /**
  * audit_core_dumps - record information about processes that end abnormally
- * @sig: signal value
+ * @signr: signal value
  *
  * If a process ends with a core dump, something fishy is going on and we
  * should record the event for investigation.
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 208cf3497c10..181ae7086029 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -103,11 +103,19 @@ static inline void check_for_tasks(int cpu)
         write_unlock_irq(&tasklist_lock);
 }
 
+struct take_cpu_down_param {
+        unsigned long mod;
+        void *hcpu;
+};
+
 /* Take this CPU down. */
-static int take_cpu_down(void *unused)
+static int take_cpu_down(void *_param)
 {
+        struct take_cpu_down_param *param = _param;
         int err;
 
+        raw_notifier_call_chain(&cpu_chain, CPU_DYING | param->mod,
+                                param->hcpu);
         /* Ensure this CPU doesn't handle any more interrupts. */
         err = __cpu_disable();
         if (err < 0)
@@ -127,6 +135,10 @@ static int _cpu_down(unsigned int cpu, int tasks_frozen)
         cpumask_t old_allowed, tmp;
         void *hcpu = (void *)(long)cpu;
         unsigned long mod = tasks_frozen ? CPU_TASKS_FROZEN : 0;
+        struct take_cpu_down_param tcd_param = {
+                .mod = mod,
+                .hcpu = hcpu,
+        };
 
         if (num_online_cpus() == 1)
                 return -EBUSY;
@@ -153,7 +165,7 @@ static int _cpu_down(unsigned int cpu, int tasks_frozen)
         set_cpus_allowed(current, tmp);
 
         mutex_lock(&cpu_bitmask_lock);
-        p = __stop_machine_run(take_cpu_down, NULL, cpu);
+        p = __stop_machine_run(take_cpu_down, &tcd_param, cpu);
         mutex_unlock(&cpu_bitmask_lock);
 
         if (IS_ERR(p) || cpu_online(cpu)) {
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 4c49188cc49b..57e6448b171e 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -516,7 +516,7 @@ static void cpuset_release_agent(const char *pathbuf)
         envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
         envp[i] = NULL;
 
-        call_usermodehelper(argv[0], argv, envp, 0);
+        call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
         kfree(pathbuf);
 }
 
@@ -981,10 +981,10 @@ static int update_nodemask(struct cpuset *cs, char *buf)
                 mmarray = kmalloc(ntasks * sizeof(*mmarray), GFP_KERNEL);
                 if (!mmarray)
                         goto done;
-                write_lock_irq(&tasklist_lock);         /* block fork */
+                read_lock(&tasklist_lock);              /* block fork */
                 if (atomic_read(&cs->count) <= ntasks)
                         break;                          /* got enough */
-                write_unlock_irq(&tasklist_lock);       /* try again */
+                read_unlock(&tasklist_lock);            /* try again */
                 kfree(mmarray);
         }
 
@@ -1006,7 +1006,7 @@ static int update_nodemask(struct cpuset *cs, char *buf)
                         continue;
                 mmarray[n++] = mm;
         } while_each_thread(g, p);
-        write_unlock_irq(&tasklist_lock);
+        read_unlock(&tasklist_lock);
 
         /*
          * Now that we've dropped the tasklist spinlock, we can
@@ -2138,6 +2138,9 @@ static void common_cpu_mem_hotplug_unplug(void)
 static int cpuset_handle_cpuhp(struct notifier_block *nb,
                                 unsigned long phase, void *cpu)
 {
+        if (phase == CPU_DYING || phase == CPU_DYING_FROZEN)
+                return NOTIFY_DONE;
+
         common_cpu_mem_hotplug_unplug();
         return 0;
 }
diff --git a/kernel/exit.c b/kernel/exit.c
index ca6a11b73023..464c2b172f07 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -31,6 +31,7 @@
 #include <linux/mempolicy.h>
 #include <linux/taskstats_kern.h>
 #include <linux/delayacct.h>
+#include <linux/freezer.h>
 #include <linux/cpuset.h>
 #include <linux/syscalls.h>
 #include <linux/signal.h>
@@ -44,6 +45,7 @@
 #include <linux/resource.h>
 #include <linux/blkdev.h>
 #include <linux/task_io_accounting_ops.h>
+#include <linux/freezer.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -387,6 +389,11 @@ void daemonize(const char *name, ...)
          * they would be locked into memory.
          */
         exit_mm(current);
+        /*
+         * We don't want to have TIF_FREEZE set if the system-wide hibernation
+         * or suspend transition begins right now.
+         */
+        current->flags |= PF_NOFREEZE;
 
         set_special_pids(1, 1);
         proc_clear_tty(current);
@@ -588,6 +595,8 @@ static void exit_mm(struct task_struct * tsk)
         tsk->mm = NULL;
         up_read(&mm->mmap_sem);
         enter_lazy_tlb(mm, current);
+        /* We don't want this task to be frozen prematurely */
+        clear_freeze_flag(tsk);
         task_unlock(tsk);
         mmput(mm);
 }
@@ -858,6 +867,34 @@ static void exit_notify(struct task_struct *tsk)
                 release_task(tsk);
 }
 
+#ifdef CONFIG_DEBUG_STACK_USAGE
+static void check_stack_usage(void)
+{
+        static DEFINE_SPINLOCK(low_water_lock);
+        static int lowest_to_date = THREAD_SIZE;
+        unsigned long *n = end_of_stack(current);
+        unsigned long free;
+
+        while (*n == 0)
+                n++;
+        free = (unsigned long)n - (unsigned long)end_of_stack(current);
+
+        if (free >= lowest_to_date)
+                return;
+
+        spin_lock(&low_water_lock);
+        if (free < lowest_to_date) {
+                printk(KERN_WARNING "%s used greatest stack depth: %lu bytes "
+                                "left\n",
+                                current->comm, free);
+                lowest_to_date = free;
+        }
+        spin_unlock(&low_water_lock);
+}
+#else
+static inline void check_stack_usage(void) {}
+#endif
+
 fastcall NORET_TYPE void do_exit(long code)
 {
         struct task_struct *tsk = current;
@@ -937,6 +974,8 @@ fastcall NORET_TYPE void do_exit(long code)
         if (unlikely(tsk->compat_robust_list))
                 compat_exit_robust_list(tsk);
 #endif
+        if (group_dead)
+                tty_audit_exit();
         if (unlikely(tsk->audit_context))
                 audit_free(tsk);
 
@@ -949,6 +988,7 @@ fastcall NORET_TYPE void do_exit(long code)
         exit_sem(tsk);
         __exit_files(tsk);
         __exit_fs(tsk);
+        check_stack_usage();
         exit_thread();
         cpuset_exit(tsk);
         exit_keys(tsk);
diff --git a/kernel/fork.c b/kernel/fork.c
index da3a155bba0d..7332e236d367 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -49,6 +49,7 @@
 #include <linux/delayacct.h>
 #include <linux/taskstats_kern.h>
 #include <linux/random.h>
+#include <linux/tty.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -136,7 +137,7 @@ void __init fork_init(unsigned long mempages)
         /* create a slab on which task_structs can be allocated */
         task_struct_cachep =
                 kmem_cache_create("task_struct", sizeof(struct task_struct),
-                        ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL, NULL);
+                        ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL);
 #endif
 
         /*
@@ -333,6 +334,8 @@ static struct mm_struct * mm_init(struct mm_struct * mm)
         atomic_set(&mm->mm_count, 1);
         init_rwsem(&mm->mmap_sem);
         INIT_LIST_HEAD(&mm->mmlist);
+        mm->flags = (current->mm) ? current->mm->flags
+                                  : MMF_DUMP_FILTER_DEFAULT;
         mm->core_waiters = 0;
         mm->nr_ptes = 0;
         set_mm_counter(mm, file_rss, 0);
@@ -897,6 +900,8 @@ static inline int copy_signal(unsigned long clone_flags, struct task_struct * ts
         }
         acct_init_pacct(&sig->pacct);
 
+        tty_audit_fork(sig);
+
         return 0;
 }
 
@@ -920,7 +925,7 @@ static inline void copy_flags(unsigned long clone_flags, struct task_struct *p)
 {
         unsigned long new_flags = p->flags;
 
-        new_flags &= ~(PF_SUPERPRIV | PF_NOFREEZE);
+        new_flags &= ~PF_SUPERPRIV;
         new_flags |= PF_FORKNOEXEC;
         if (!(clone_flags & CLONE_PTRACE))
                 p->ptrace = 0;
@@ -999,7 +1004,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         if (atomic_read(&p->user->processes) >=
                         p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
                 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-                                p->user != &root_user)
+                    p->user != current->nsproxy->user_ns->root_user)
                         goto bad_fork_free;
         }
 
@@ -1059,6 +1064,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
         p->lock_depth = -1;             /* -1 = no lock */
         do_posix_clock_monotonic_gettime(&p->start_time);
+        p->real_start_time = p->start_time;
+        monotonic_to_bootbased(&p->real_start_time);
         p->security = NULL;
         p->io_context = NULL;
         p->io_wait = NULL;
@@ -1439,22 +1446,22 @@ void __init proc_caches_init(void)
         sighand_cachep = kmem_cache_create("sighand_cache",
                         sizeof(struct sighand_struct), 0,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_DESTROY_BY_RCU,
-                        sighand_ctor, NULL);
+                        sighand_ctor);
         signal_cachep = kmem_cache_create("signal_cache",
                         sizeof(struct signal_struct), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
-        files_cachep = kmem_cache_create("files_cache", 
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+        files_cachep = kmem_cache_create("files_cache",
                         sizeof(struct files_struct), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
-        fs_cachep = kmem_cache_create("fs_cache", 
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+        fs_cachep = kmem_cache_create("fs_cache",
                         sizeof(struct fs_struct), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
         vm_area_cachep = kmem_cache_create("vm_area_struct",
                         sizeof(struct vm_area_struct), 0,
-                        SLAB_PANIC, NULL, NULL);
+                        SLAB_PANIC, NULL);
         mm_cachep = kmem_cache_create("mm_struct",
                         sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
 }
 
 /*
@@ -1601,7 +1608,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
         err = -EINVAL;
         if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                                 CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
-                                CLONE_NEWUTS|CLONE_NEWIPC))
+                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER))
                 goto bad_unshare_out;
 
         if ((err = unshare_thread(unshare_flags)))
diff --git a/kernel/futex.c b/kernel/futex.c
index 45490bec5831..a12425051ee9 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -121,6 +121,24 @@ static struct futex_hash_bucket futex_queues[1<<FUTEX_HASHBITS];
 static struct vfsmount *futex_mnt;
 
 /*
+ * Take mm->mmap_sem, when futex is shared
+ */
+static inline void futex_lock_mm(struct rw_semaphore *fshared)
+{
+        if (fshared)
+                down_read(fshared);
+}
+
+/*
+ * Release mm->mmap_sem, when the futex is shared
+ */
+static inline void futex_unlock_mm(struct rw_semaphore *fshared)
+{
+        if (fshared)
+                up_read(fshared);
+}
+
+/*
  * We hash on the keys returned from get_futex_key (see below).
  */
 static struct futex_hash_bucket *hash_futex(union futex_key *key)
@@ -287,7 +305,18 @@ void drop_futex_key_refs(union futex_key *key)
 }
 EXPORT_SYMBOL_GPL(drop_futex_key_refs);
 
-static inline int get_futex_value_locked(u32 *dest, u32 __user *from)
+static u32 cmpxchg_futex_value_locked(u32 __user *uaddr, u32 uval, u32 newval)
+{
+        u32 curval;
+
+        pagefault_disable();
+        curval = futex_atomic_cmpxchg_inatomic(uaddr, uval, newval);
+        pagefault_enable();
+
+        return curval;
+}
+
+static int get_futex_value_locked(u32 *dest, u32 __user *from)
 {
         int ret;
 
@@ -317,15 +346,20 @@ static int futex_handle_fault(unsigned long address,
         vma = find_vma(mm, address);
         if (vma && address >= vma->vm_start &&
             (vma->vm_flags & VM_WRITE)) {
-                switch (handle_mm_fault(mm, vma, address, 1)) {
-                case VM_FAULT_MINOR:
-                        ret = 0;
-                        current->min_flt++;
-                        break;
-                case VM_FAULT_MAJOR:
+                int fault;
+                fault = handle_mm_fault(mm, vma, address, 1);
+                if (unlikely((fault & VM_FAULT_ERROR))) {
+#if 0
+                        /* XXX: let's do this when we verify it is OK */
+                        if (ret & VM_FAULT_OOM)
+                                ret = -ENOMEM;
+#endif
+                } else {
                         ret = 0;
-                        current->maj_flt++;
-                        break;
+                        if (fault & VM_FAULT_MAJOR)
+                                current->maj_flt++;
+                        else
+                                current->min_flt++;
                 }
         }
         if (!fshared)
@@ -620,9 +654,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
 
                 newval = FUTEX_WAITERS | new_owner->pid;
 
-                pagefault_disable();
-                curval = futex_atomic_cmpxchg_inatomic(uaddr, uval, newval);
-                pagefault_enable();
+                curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
 
                 if (curval == -EFAULT)
                         ret = -EFAULT;
@@ -659,9 +691,7 @@ static int unlock_futex_pi(u32 __user *uaddr, u32 uval)
          * There is no waiter, so we unlock the futex. The owner died
          * bit has not to be preserved here. We are the owner:
          */
-        pagefault_disable();
-        oldval = futex_atomic_cmpxchg_inatomic(uaddr, uval, 0);
-        pagefault_enable();
+        oldval = cmpxchg_futex_value_locked(uaddr, uval, 0);
 
         if (oldval == -EFAULT)
                 return oldval;
@@ -700,8 +730,7 @@ static int futex_wake(u32 __user *uaddr, struct rw_semaphore *fshared,
         union futex_key key;
         int ret;
 
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr, fshared, &key);
         if (unlikely(ret != 0))
@@ -725,8 +754,7 @@ static int futex_wake(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         spin_unlock(&hb->lock);
 out:
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
         return ret;
 }
 
@@ -746,8 +774,7 @@ futex_wake_op(u32 __user *uaddr1, struct rw_semaphore *fshared,
         int ret, op_ret, attempt = 0;
 
 retryfull:
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr1, fshared, &key1);
         if (unlikely(ret != 0))
@@ -793,7 +820,7 @@ retry:
                  */
                 if (attempt++) {
                         ret = futex_handle_fault((unsigned long)uaddr2,
-                                                fshared, attempt);
+                                                 fshared, attempt);
                         if (ret)
                                 goto out;
                         goto retry;
@@ -803,8 +830,7 @@ retry:
                  * If we would have faulted, release mmap_sem,
                  * fault it in and start all over again.
                  */
-                if (fshared)
-                        up_read(fshared);
+                futex_unlock_mm(fshared);
 
                 ret = get_user(dummy, uaddr2);
                 if (ret)
@@ -841,8 +867,8 @@ retry:
         if (hb1 != hb2)
                 spin_unlock(&hb2->lock);
 out:
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
+
         return ret;
 }
 
@@ -861,8 +887,7 @@ static int futex_requeue(u32 __user *uaddr1, struct rw_semaphore *fshared,
         int ret, drop_count = 0;
 
  retry:
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr1, fshared, &key1);
         if (unlikely(ret != 0))
@@ -890,8 +915,7 @@ static int futex_requeue(u32 __user *uaddr1, struct rw_semaphore *fshared,
                          * If we would have faulted, release mmap_sem, fault
                          * it in and start all over again.
                          */
-                        if (fshared)
-                                up_read(fshared);
+                        futex_unlock_mm(fshared);
 
                         ret = get_user(curval, uaddr1);
 
@@ -944,8 +968,7 @@ out_unlock:
                 drop_futex_key_refs(&key1);
 
 out:
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
         return ret;
 }
 
@@ -1113,10 +1136,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
         while (!ret) {
                 newval = (uval & FUTEX_OWNER_DIED) | newtid;
 
-                pagefault_disable();
-                curval = futex_atomic_cmpxchg_inatomic(uaddr,
-                                                       uval, newval);
-                pagefault_enable();
+                curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
 
                 if (curval == -EFAULT)
                         ret = -EFAULT;
@@ -1134,6 +1154,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 #define ARG3_SHARED  1
 
 static long futex_wait_restart(struct restart_block *restart);
+
 static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
                       u32 val, ktime_t *abs_time)
 {
@@ -1148,8 +1169,7 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         q.pi_state = NULL;
  retry:
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr, fshared, &q.key);
         if (unlikely(ret != 0))
@@ -1186,8 +1206,7 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
                  * If we would have faulted, release mmap_sem, fault it in and
                  * start all over again.
                  */
-                if (fshared)
-                        up_read(fshared);
+                futex_unlock_mm(fshared);
 
                 ret = get_user(uval, uaddr);
 
@@ -1206,8 +1225,7 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
          * Now the futex is queued and we have checked the data, we
          * don't want to hold mmap_sem while we sleep.
          */
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
 
         /*
          * There might have been scheduling since the queue_me(), as we
@@ -1285,8 +1303,7 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
         queue_unlock(&q, hb);
 
  out_release_sem:
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
         return ret;
 }
 
@@ -1333,8 +1350,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         q.pi_state = NULL;
  retry:
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr, fshared, &q.key);
         if (unlikely(ret != 0))
@@ -1353,9 +1369,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
          */
         newval = current->pid;
 
-        pagefault_disable();
-        curval = futex_atomic_cmpxchg_inatomic(uaddr, 0, newval);
-        pagefault_enable();
+        curval = cmpxchg_futex_value_locked(uaddr, 0, newval);
 
         if (unlikely(curval == -EFAULT))
                 goto uaddr_faulted;
@@ -1398,9 +1412,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                 lock_taken = 1;
         }
 
-        pagefault_disable();
-        curval = futex_atomic_cmpxchg_inatomic(uaddr, uval, newval);
-        pagefault_enable();
+        curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
 
         if (unlikely(curval == -EFAULT))
                 goto uaddr_faulted;
@@ -1428,8 +1440,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                          * exit to complete.
                          */
                         queue_unlock(&q, hb);
-                        if (fshared)
-                                up_read(fshared);
+                        futex_unlock_mm(fshared);
                         cond_resched();
                         goto retry;
 
@@ -1465,8 +1476,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
          * Now the futex is queued and we have checked the data, we
          * don't want to hold mmap_sem while we sleep.
          */
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
 
         WARN_ON(!q.pi_state);
         /*
@@ -1480,8 +1490,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                 ret = ret ? 0 : -EWOULDBLOCK;
         }
 
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
         spin_lock(q.lock_ptr);
 
         if (!ret) {
@@ -1518,8 +1527,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         /* Unqueue and drop the lock */
         unqueue_me_pi(&q);
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
 
         return ret != -EINTR ? ret : -ERESTARTNOINTR;
 
@@ -1527,8 +1535,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
         queue_unlock(&q, hb);
 
  out_release_sem:
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
         return ret;
 
  uaddr_faulted:
@@ -1550,8 +1557,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                 goto retry_unlocked;
         }
 
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
 
         ret = get_user(uval, uaddr);
         if (!ret && (uval != -EFAULT))
@@ -1585,8 +1591,7 @@ retry:
         /*
          * First take all the futex related locks:
          */
-        if (fshared)
-                down_read(fshared);
+        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr, fshared, &key);
         if (unlikely(ret != 0))
@@ -1601,11 +1606,9 @@ retry_unlocked:
          * again. If it succeeds then we can return without waking
          * anyone else up:
          */
-        if (!(uval & FUTEX_OWNER_DIED)) {
-                pagefault_disable();
-                uval = futex_atomic_cmpxchg_inatomic(uaddr, current->pid, 0);
-                pagefault_enable();
-        }
+        if (!(uval & FUTEX_OWNER_DIED))
+                uval = cmpxchg_futex_value_locked(uaddr, current->pid, 0);
+
 
         if (unlikely(uval == -EFAULT))
                 goto pi_faulted;
@@ -1647,8 +1650,7 @@ retry_unlocked:
 out_unlock:
         spin_unlock(&hb->lock);
 out:
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
 
         return ret;
 
@@ -1671,8 +1673,7 @@ pi_faulted:
                 goto retry_unlocked;
         }
 
-        if (fshared)
-                up_read(fshared);
+        futex_unlock_mm(fshared);
 
         ret = get_user(uval, uaddr);
         if (!ret && (uval != -EFAULT))
@@ -1729,8 +1730,8 @@ static int futex_fd(u32 __user *uaddr, int signal)
 
         if (printk_timed_ratelimit(&printk_interval, 60 * 60 * 1000)) {
                 printk(KERN_WARNING "Process `%s' used FUTEX_FD, which "
-                        "will be removed from the kernel in June 2007\n",
-                        current->comm);
+                       "will be removed from the kernel in June 2007\n",
+                       current->comm);
         }
 
         ret = -EINVAL;
@@ -1908,10 +1909,8 @@ retry:
                  * Wake robust non-PI futexes here. The wakeup of
                  * PI futexes happens in exit_pi_state():
                  */
-                if (!pi) {
-                        if (uval & FUTEX_WAITERS)
+                if (!pi && (uval & FUTEX_WAITERS))
                                 futex_wake(uaddr, &curr->mm->mmap_sem, 1);
-                }
         }
         return 0;
 }
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 23c03f43e196..eb1ddebd2c04 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -558,7 +558,8 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
  */
 static int hrtimer_switch_to_hres(void)
 {
-        struct hrtimer_cpu_base *base = &__get_cpu_var(hrtimer_bases);
+        int cpu = smp_processor_id();
+        struct hrtimer_cpu_base *base = &per_cpu(hrtimer_bases, cpu);
         unsigned long flags;
 
         if (base->hres_active)
@@ -568,6 +569,8 @@ static int hrtimer_switch_to_hres(void)
 
         if (tick_init_highres()) {
                 local_irq_restore(flags);
+                printk(KERN_WARNING "Could not switch to high resolution "
+                                    "mode on CPU %d\n", cpu);
                 return 0;
         }
         base->hres_active = 1;
@@ -683,6 +686,7 @@ static void enqueue_hrtimer(struct hrtimer *timer,
         struct rb_node **link = &base->active.rb_node;
         struct rb_node *parent = NULL;
         struct hrtimer *entry;
+        int leftmost = 1;
 
         /*
          * Find the right place in the rbtree:
@@ -694,18 +698,19 @@ static void enqueue_hrtimer(struct hrtimer *timer,
                  * We dont care about collisions. Nodes with
                  * the same expiry time stay together.
                  */
-                if (timer->expires.tv64 < entry->expires.tv64)
+                if (timer->expires.tv64 < entry->expires.tv64) {
                         link = &(*link)->rb_left;
-                else
+                } else {
                         link = &(*link)->rb_right;
+                        leftmost = 0;
+                }
         }
 
         /*
          * Insert the timer to the rbtree and check whether it
          * replaces the first pending timer
          */
-        if (!base->first || timer->expires.tv64 <
-            rb_entry(base->first, struct hrtimer, node)->expires.tv64) {
+        if (leftmost) {
                 /*
                  * Reprogram the clock event device. When the timer is already
                  * expired hrtimer_enqueue_reprogram has either called the
@@ -1406,7 +1411,7 @@ static void migrate_hrtimers(int cpu)
 static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
                                         unsigned long action, void *hcpu)
 {
-        long cpu = (long)hcpu;
+        unsigned int cpu = (long)hcpu;
 
         switch (action) {
 
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index b4f1674fca79..50b81b98046a 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -19,7 +19,15 @@ static struct proc_dir_entry *root_irq_dir;
 static int irq_affinity_read_proc(char *page, char **start, off_t off,
                                   int count, int *eof, void *data)
 {
-        int len = cpumask_scnprintf(page, count, irq_desc[(long)data].affinity);
+        struct irq_desc *desc = irq_desc + (long)data;
+        cpumask_t *mask = &desc->affinity;
+        int len;
+
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        if (desc->status & IRQ_MOVE_PENDING)
+                mask = &desc->pending_mask;
+#endif
+        len = cpumask_scnprintf(page, count, *mask);
 
         if (count - len < 2)
                 return -EINVAL;
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index bd9e272d55e9..32b161972fad 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -172,7 +172,17 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
                     irqreturn_t action_ret)
 {
         if (unlikely(action_ret != IRQ_HANDLED)) {
-                desc->irqs_unhandled++;
+                /*
+                 * If we are seeing only the odd spurious IRQ caused by
+                 * bus asynchronicity then don't eventually trigger an error,
+                 * otherwise the couter becomes a doomsday timer for otherwise
+                 * working systems
+                 */
+                if (jiffies - desc->last_unhandled > HZ/10)
+                        desc->irqs_unhandled = 1;
+                else
+                        desc->irqs_unhandled++;
+                desc->last_unhandled = jiffies;
                 if (unlikely(action_ret != IRQ_NONE))
                         report_bad_irq(irq, desc, action_ret);
         }
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index fed54418626c..474219a41929 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -152,7 +152,7 @@ static unsigned int get_symbol_offset(unsigned long pos)
 /* Lookup the address for this symbol. Returns 0 if not found. */
 unsigned long kallsyms_lookup_name(const char *name)
 {
-        char namebuf[KSYM_NAME_LEN+1];
+        char namebuf[KSYM_NAME_LEN];
         unsigned long i;
         unsigned int off;
 
@@ -248,7 +248,7 @@ const char *kallsyms_lookup(unsigned long addr,
 {
         const char *msym;
 
-        namebuf[KSYM_NAME_LEN] = 0;
+        namebuf[KSYM_NAME_LEN - 1] = 0;
         namebuf[0] = 0;
 
         if (is_ksym_addr(addr)) {
@@ -265,7 +265,7 @@ const char *kallsyms_lookup(unsigned long addr,
         /* see if it's in a module */
         msym = module_address_lookup(addr, symbolsize, offset, modname);
         if (msym)
-                return strncpy(namebuf, msym, KSYM_NAME_LEN);
+                return strncpy(namebuf, msym, KSYM_NAME_LEN - 1);
 
         return NULL;
 }
@@ -273,7 +273,7 @@ const char *kallsyms_lookup(unsigned long addr,
 int lookup_symbol_name(unsigned long addr, char *symname)
 {
         symname[0] = '\0';
-        symname[KSYM_NAME_LEN] = '\0';
+        symname[KSYM_NAME_LEN - 1] = '\0';
 
         if (is_ksym_addr(addr)) {
                 unsigned long pos;
@@ -291,7 +291,7 @@ int lookup_symbol_attrs(unsigned long addr, unsigned long *size,
                         unsigned long *offset, char *modname, char *name)
 {
         name[0] = '\0';
-        name[KSYM_NAME_LEN] = '\0';
+        name[KSYM_NAME_LEN - 1] = '\0';
 
         if (is_ksym_addr(addr)) {
                 unsigned long pos;
@@ -312,18 +312,17 @@ int sprint_symbol(char *buffer, unsigned long address)
         char *modname;
         const char *name;
         unsigned long offset, size;
-        char namebuf[KSYM_NAME_LEN+1];
+        char namebuf[KSYM_NAME_LEN];
 
         name = kallsyms_lookup(address, &size, &offset, &modname, namebuf);
         if (!name)
                 return sprintf(buffer, "0x%lx", address);
-        else {
-                if (modname)
-                        return sprintf(buffer, "%s+%#lx/%#lx [%s]", name, offset,
+
+        if (modname)
+                return sprintf(buffer, "%s+%#lx/%#lx [%s]", name, offset,
                                 size, modname);
-                else
-                        return sprintf(buffer, "%s+%#lx/%#lx", name, offset, size);
-        }
+        else
+                return sprintf(buffer, "%s+%#lx/%#lx", name, offset, size);
 }
 
 /* Look up a kernel symbol and print it to the kernel messages. */
@@ -343,8 +342,8 @@ struct kallsym_iter
         unsigned long value;
         unsigned int nameoff; /* If iterating in core kernel symbols */
         char type;
-        char name[KSYM_NAME_LEN+1];
-        char module_name[MODULE_NAME_LEN + 1];
+        char name[KSYM_NAME_LEN];
+        char module_name[MODULE_NAME_LEN];
         int exported;
 };
 
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index cee419143fd4..bc41ad0f24f8 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/kfifo.h>
+#include <linux/log2.h>
 
 /**
  * kfifo_init - allocates a new FIFO using a preallocated buffer
@@ -41,7 +42,7 @@ struct kfifo *kfifo_init(unsigned char *buffer, unsigned int size,
         struct kfifo *fifo;
 
         /* size must be a power of 2 */
-        BUG_ON(size & (size - 1));
+        BUG_ON(!is_power_of_2(size));
 
         fifo = kmalloc(sizeof(struct kfifo), gfp_mask);
         if (!fifo)
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 4d32eb077179..beedbdc64608 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -33,6 +33,8 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/resource.h>
+#include <linux/notifier.h>
+#include <linux/suspend.h>
 #include <asm/uaccess.h>
 
 extern int max_threads;
@@ -119,9 +121,10 @@ struct subprocess_info {
         char **argv;
         char **envp;
         struct key *ring;
-        int wait;
+        enum umh_wait wait;
         int retval;
         struct file *stdin;
+        void (*cleanup)(char **argv, char **envp);
 };
 
 /*
@@ -180,6 +183,14 @@ static int ____call_usermodehelper(void *data)
         do_exit(0);
 }
 
+void call_usermodehelper_freeinfo(struct subprocess_info *info)
+{
+        if (info->cleanup)
+                (*info->cleanup)(info->argv, info->envp);
+        kfree(info);
+}
+EXPORT_SYMBOL(call_usermodehelper_freeinfo);
+
 /* Keventd can't block, but this (a child) can. */
 static int wait_for_helper(void *data)
 {
@@ -216,8 +227,8 @@ static int wait_for_helper(void *data)
                         sub_info->retval = ret;
         }
 
-        if (sub_info->wait < 0)
-                kfree(sub_info);
+        if (sub_info->wait == UMH_NO_WAIT)
+                call_usermodehelper_freeinfo(sub_info);
         else
                 complete(sub_info->complete);
         return 0;
@@ -229,34 +240,204 @@ static void __call_usermodehelper(struct work_struct *work)
         struct subprocess_info *sub_info =
                 container_of(work, struct subprocess_info, work);
         pid_t pid;
-        int wait = sub_info->wait;
+        enum umh_wait wait = sub_info->wait;
 
         /* CLONE_VFORK: wait until the usermode helper has execve'd
          * successfully We need the data structures to stay around
          * until that is done.  */
-        if (wait)
+        if (wait == UMH_WAIT_PROC || wait == UMH_NO_WAIT)
                 pid = kernel_thread(wait_for_helper, sub_info,
                                     CLONE_FS | CLONE_FILES | SIGCHLD);
         else
                 pid = kernel_thread(____call_usermodehelper, sub_info,
                                     CLONE_VFORK | SIGCHLD);
 
-        if (wait < 0)
-                return;
+        switch (wait) {
+        case UMH_NO_WAIT:
+                break;
 
-        if (pid < 0) {
+        case UMH_WAIT_PROC:
+                if (pid > 0)
+                        break;
                 sub_info->retval = pid;
+                /* FALLTHROUGH */
+
+        case UMH_WAIT_EXEC:
                 complete(sub_info->complete);
-        } else if (!wait)
-                complete(sub_info->complete);
+        }
+}
+
+#ifdef CONFIG_PM
+/*
+ * If set, call_usermodehelper_exec() will exit immediately returning -EBUSY
+ * (used for preventing user land processes from being created after the user
+ * land has been frozen during a system-wide hibernation or suspend operation).
+ */
+static int usermodehelper_disabled;
+
+/* Number of helpers running */
+static atomic_t running_helpers = ATOMIC_INIT(0);
+
+/*
+ * Wait queue head used by usermodehelper_pm_callback() to wait for all running
+ * helpers to finish.
+ */
+static DECLARE_WAIT_QUEUE_HEAD(running_helpers_waitq);
+
+/*
+ * Time to wait for running_helpers to become zero before the setting of
+ * usermodehelper_disabled in usermodehelper_pm_callback() fails
+ */
+#define RUNNING_HELPERS_TIMEOUT (5 * HZ)
+
+static int usermodehelper_pm_callback(struct notifier_block *nfb,
+                                        unsigned long action,
+                                        void *ignored)
+{
+        long retval;
+
+        switch (action) {
+        case PM_HIBERNATION_PREPARE:
+        case PM_SUSPEND_PREPARE:
+                usermodehelper_disabled = 1;
+                smp_mb();
+                /*
+                 * From now on call_usermodehelper_exec() won't start any new
+                 * helpers, so it is sufficient if running_helpers turns out to
+                 * be zero at one point (it may be increased later, but that
+                 * doesn't matter).
+                 */
+                retval = wait_event_timeout(running_helpers_waitq,
+                                        atomic_read(&running_helpers) == 0,
+                                        RUNNING_HELPERS_TIMEOUT);
+                if (retval) {
+                        return NOTIFY_OK;
+                } else {
+                        usermodehelper_disabled = 0;
+                        return NOTIFY_BAD;
+                }
+        case PM_POST_HIBERNATION:
+        case PM_POST_SUSPEND:
+                usermodehelper_disabled = 0;
+                return NOTIFY_OK;
+        }
+
+        return NOTIFY_DONE;
+}
+
+static void helper_lock(void)
+{
+        atomic_inc(&running_helpers);
+        smp_mb__after_atomic_inc();
+}
+
+static void helper_unlock(void)
+{
+        if (atomic_dec_and_test(&running_helpers))
+                wake_up(&running_helpers_waitq);
+}
+
+static void register_pm_notifier_callback(void)
+{
+        pm_notifier(usermodehelper_pm_callback, 0);
 }
+#else /* CONFIG_PM */
+#define usermodehelper_disabled 0
+
+static inline void helper_lock(void) {}
+static inline void helper_unlock(void) {}
+static inline void register_pm_notifier_callback(void) {}
+#endif /* CONFIG_PM */
 
 /**
- * call_usermodehelper_keys - start a usermode application
- * @path: pathname for the application
- * @argv: null-terminated argument list
- * @envp: null-terminated environment list
- * @session_keyring: session keyring for process (NULL for an empty keyring)
+ * call_usermodehelper_setup - prepare to call a usermode helper
+ * @path - path to usermode executable
+ * @argv - arg vector for process
+ * @envp - environment for process
+ *
+ * Returns either NULL on allocation failure, or a subprocess_info
+ * structure.  This should be passed to call_usermodehelper_exec to
+ * exec the process and free the structure.
+ */
+struct subprocess_info *call_usermodehelper_setup(char *path,
+                                                  char **argv, char **envp)
+{
+        struct subprocess_info *sub_info;
+        sub_info = kzalloc(sizeof(struct subprocess_info),  GFP_ATOMIC);
+        if (!sub_info)
+                goto out;
+
+        INIT_WORK(&sub_info->work, __call_usermodehelper);
+        sub_info->path = path;
+        sub_info->argv = argv;
+        sub_info->envp = envp;
+
+  out:
+        return sub_info;
+}
+EXPORT_SYMBOL(call_usermodehelper_setup);
+
+/**
+ * call_usermodehelper_setkeys - set the session keys for usermode helper
+ * @info: a subprocess_info returned by call_usermodehelper_setup
+ * @session_keyring: the session keyring for the process
+ */
+void call_usermodehelper_setkeys(struct subprocess_info *info,
+                                 struct key *session_keyring)
+{
+        info->ring = session_keyring;
+}
+EXPORT_SYMBOL(call_usermodehelper_setkeys);
+
+/**
+ * call_usermodehelper_setcleanup - set a cleanup function
+ * @info: a subprocess_info returned by call_usermodehelper_setup
+ * @cleanup: a cleanup function
+ *
+ * The cleanup function is just befor ethe subprocess_info is about to
+ * be freed.  This can be used for freeing the argv and envp.  The
+ * Function must be runnable in either a process context or the
+ * context in which call_usermodehelper_exec is called.
+ */
+void call_usermodehelper_setcleanup(struct subprocess_info *info,
+                                    void (*cleanup)(char **argv, char **envp))
+{
+        info->cleanup = cleanup;
+}
+EXPORT_SYMBOL(call_usermodehelper_setcleanup);
+
+/**
+ * call_usermodehelper_stdinpipe - set up a pipe to be used for stdin
+ * @sub_info: a subprocess_info returned by call_usermodehelper_setup
+ * @filp: set to the write-end of a pipe
+ *
+ * This constructs a pipe, and sets the read end to be the stdin of the
+ * subprocess, and returns the write-end in *@filp.
+ */
+int call_usermodehelper_stdinpipe(struct subprocess_info *sub_info,
+                                  struct file **filp)
+{
+        struct file *f;
+
+        f = create_write_pipe();
+        if (IS_ERR(f))
+                return PTR_ERR(f);
+        *filp = f;
+
+        f = create_read_pipe(f);
+        if (IS_ERR(f)) {
+                free_write_pipe(*filp);
+                return PTR_ERR(f);
+        }
+        sub_info->stdin = f;
+
+        return 0;
+}
+EXPORT_SYMBOL(call_usermodehelper_stdinpipe);
+
+/**
+ * call_usermodehelper_exec - start a usermode application
+ * @sub_info: information about the subprocessa
  * @wait: wait for the application to finish and return status.
  *        when -1 don't wait at all, but you get no useful error back when
  *        the program couldn't be exec'ed. This makes it safe to call
@@ -265,81 +446,70 @@ static void __call_usermodehelper(struct work_struct *work)
  * Runs a user-space application.  The application is started
  * asynchronously if wait is not set, and runs as a child of keventd.
  * (ie. it runs with full root capabilities).
- *
- * Must be called from process context.  Returns a negative error code
- * if program was not execed successfully, or 0.
  */
-int call_usermodehelper_keys(char *path, char **argv, char **envp,
-                             struct key *session_keyring, int wait)
+int call_usermodehelper_exec(struct subprocess_info *sub_info,
+                             enum umh_wait wait)
 {
         DECLARE_COMPLETION_ONSTACK(done);
-        struct subprocess_info *sub_info;
         int retval;
 
-        if (!khelper_wq)
-                return -EBUSY;
-
-        if (path[0] == '\0')
-                return 0;
+        helper_lock();
+        if (sub_info->path[0] == '\0') {
+                retval = 0;
+                goto out;
+        }
 
-        sub_info = kzalloc(sizeof(struct subprocess_info),  GFP_ATOMIC);
-        if (!sub_info)
-                return -ENOMEM;
+        if (!khelper_wq || usermodehelper_disabled) {
+                retval = -EBUSY;
+                goto out;
+        }
 
-        INIT_WORK(&sub_info->work, __call_usermodehelper);
         sub_info->complete = &done;
-        sub_info->path = path;
-        sub_info->argv = argv;
-        sub_info->envp = envp;
-        sub_info->ring = session_keyring;
         sub_info->wait = wait;
 
         queue_work(khelper_wq, &sub_info->work);
-        if (wait < 0) /* task has freed sub_info */
+        if (wait == UMH_NO_WAIT) /* task has freed sub_info */
                 return 0;
         wait_for_completion(&done);
         retval = sub_info->retval;
-        kfree(sub_info);
+
+  out:
+        call_usermodehelper_freeinfo(sub_info);
+        helper_unlock();
         return retval;
 }
-EXPORT_SYMBOL(call_usermodehelper_keys);
+EXPORT_SYMBOL(call_usermodehelper_exec);
 
+/**
+ * call_usermodehelper_pipe - call a usermode helper process with a pipe stdin
+ * @path: path to usermode executable
+ * @argv: arg vector for process
+ * @envp: environment for process
+ * @filp: set to the write-end of a pipe
+ *
+ * This is a simple wrapper which executes a usermode-helper function
+ * with a pipe as stdin.  It is implemented entirely in terms of
+ * lower-level call_usermodehelper_* functions.
+ */
 int call_usermodehelper_pipe(char *path, char **argv, char **envp,
                              struct file **filp)
 {
-        DECLARE_COMPLETION(done);
-        struct subprocess_info sub_info = {
-                .work           = __WORK_INITIALIZER(sub_info.work,
-                                                     __call_usermodehelper),
-                .complete       = &done,
-                .path           = path,
-                .argv           = argv,
-                .envp           = envp,
-                .retval         = 0,
-        };
-        struct file *f;
-
-        if (!khelper_wq)
-                return -EBUSY;
+        struct subprocess_info *sub_info;
+        int ret;
 
-        if (path[0] == '\0')
-                return 0;
+        sub_info = call_usermodehelper_setup(path, argv, envp);
+        if (sub_info == NULL)
+                return -ENOMEM;
 
-        f = create_write_pipe();
-        if (IS_ERR(f))
-                return PTR_ERR(f);
-        *filp = f;
+        ret = call_usermodehelper_stdinpipe(sub_info, filp);
+        if (ret < 0)
+                goto out;
 
-        f = create_read_pipe(f);
-        if (IS_ERR(f)) {
-                free_write_pipe(*filp);
-                return PTR_ERR(f);
-        }
-        sub_info.stdin = f;
+        return call_usermodehelper_exec(sub_info, 1);
 
-        queue_work(khelper_wq, &sub_info.work);
-        wait_for_completion(&done);
-        return sub_info.retval;
+  out:
+        call_usermodehelper_freeinfo(sub_info);
+        return ret;
 }
 EXPORT_SYMBOL(call_usermodehelper_pipe);
 
@@ -347,4 +517,5 @@ void __init usermodehelper_init(void)
 {
         khelper_wq = create_singlethread_workqueue("khelper");
         BUG_ON(!khelper_wq);
+        register_pm_notifier_callback();
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9e47d8c493f3..3e9f513a728d 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -675,9 +675,18 @@ static struct notifier_block kprobe_exceptions_nb = {
         .priority = 0x7fffffff /* we need to be notified first */
 };
 
+unsigned long __weak arch_deref_entry_point(void *entry)
+{
+        return (unsigned long)entry;
+}
 
 int __kprobes register_jprobe(struct jprobe *jp)
 {
+        unsigned long addr = arch_deref_entry_point(jp->entry);
+
+        if (!kernel_text_address(addr))
+                return -EINVAL;
+
         /* Todo: Verify probepoint is a function entry point */
         jp->kp.pre_handler = setjmp_pre_handler;
         jp->kp.break_handler = longjmp_break_handler;
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 559deca5ed15..d0e5c48e18c7 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -62,6 +62,28 @@ static ssize_t kexec_crash_loaded_show(struct kset *kset, char *page)
 KERNEL_ATTR_RO(kexec_crash_loaded);
 #endif /* CONFIG_KEXEC */
 
+/*
+ * Make /sys/kernel/notes give the raw contents of our kernel .notes section.
+ */
+extern const void __start_notes __attribute__((weak));
+extern const void __stop_notes __attribute__((weak));
+#define notes_size (&__stop_notes - &__start_notes)
+
+static ssize_t notes_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+                          char *buf, loff_t off, size_t count)
+{
+        memcpy(buf, &__start_notes + off, count);
+        return count;
+}
+
+static struct bin_attribute notes_attr = {
+        .attr = {
+                .name = "notes",
+                .mode = S_IRUGO,
+        },
+        .read = &notes_read,
+};
+
 decl_subsys(kernel, NULL, NULL);
 EXPORT_SYMBOL_GPL(kernel_subsys);
 
@@ -88,6 +110,12 @@ static int __init ksysfs_init(void)
                 error = sysfs_create_group(&kernel_subsys.kobj,
                                            &kernel_attr_group);
 
+        if (!error && notes_size > 0) {
+                notes_attr.size = notes_size;
+                error = sysfs_create_bin_file(&kernel_subsys.kobj,
+                                              &notes_attr);
+        }
+
         return error;
 }
 
diff --git a/kernel/kthread.c b/kernel/kthread.c
index bbd51b81a3e8..a404f7ee7395 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -215,7 +215,7 @@ int kthread_stop(struct task_struct *k)
 EXPORT_SYMBOL(kthread_stop);
 
 
-static __init void kthreadd_setup(void)
+static noinline __init_refok void kthreadd_setup(void)
 {
         struct task_struct *tsk = current;
 
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 1a5ff2211d88..734da579ad13 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -5,7 +5,8 @@
  *
  * Started by Ingo Molnar:
  *
- *  Copyright (C) 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *  Copyright (C) 2006,2007 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
  *
  * this code maps all the lock dependencies as they occur in a live kernel
  * and will warn about the following classes of locking bugs:
@@ -37,11 +38,26 @@
 #include <linux/debug_locks.h>
 #include <linux/irqflags.h>
 #include <linux/utsname.h>
+#include <linux/hash.h>
 
 #include <asm/sections.h>
 
 #include "lockdep_internals.h"
 
+#ifdef CONFIG_PROVE_LOCKING
+int prove_locking = 1;
+module_param(prove_locking, int, 0644);
+#else
+#define prove_locking 0
+#endif
+
+#ifdef CONFIG_LOCK_STAT
+int lock_stat = 1;
+module_param(lock_stat, int, 0644);
+#else
+#define lock_stat 0
+#endif
+
 /*
  * lockdep_lock: protects the lockdep graph, the hashes and the
  *               class/list/hash allocators.
@@ -96,23 +112,6 @@ unsigned long nr_list_entries;
 static struct lock_list list_entries[MAX_LOCKDEP_ENTRIES];
 
 /*
- * Allocate a lockdep entry. (assumes the graph_lock held, returns
- * with NULL on failure)
- */
-static struct lock_list *alloc_list_entry(void)
-{
-        if (nr_list_entries >= MAX_LOCKDEP_ENTRIES) {
-                if (!debug_locks_off_graph_unlock())
-                        return NULL;
-
-                printk("BUG: MAX_LOCKDEP_ENTRIES too low!\n");
-                printk("turning off the locking correctness validator.\n");
-                return NULL;
-        }
-        return list_entries + nr_list_entries++;
-}
-
-/*
  * All data structures here are protected by the global debug_lock.
  *
  * Mutex key structs only get allocated, once during bootup, and never
@@ -121,6 +120,117 @@ static struct lock_list *alloc_list_entry(void)
 unsigned long nr_lock_classes;
 static struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
 
+#ifdef CONFIG_LOCK_STAT
+static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], lock_stats);
+
+static int lock_contention_point(struct lock_class *class, unsigned long ip)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(class->contention_point); i++) {
+                if (class->contention_point[i] == 0) {
+                        class->contention_point[i] = ip;
+                        break;
+                }
+                if (class->contention_point[i] == ip)
+                        break;
+        }
+
+        return i;
+}
+
+static void lock_time_inc(struct lock_time *lt, s64 time)
+{
+        if (time > lt->max)
+                lt->max = time;
+
+        if (time < lt->min || !lt->min)
+                lt->min = time;
+
+        lt->total += time;
+        lt->nr++;
+}
+
+static inline void lock_time_add(struct lock_time *src, struct lock_time *dst)
+{
+        dst->min += src->min;
+        dst->max += src->max;
+        dst->total += src->total;
+        dst->nr += src->nr;
+}
+
+struct lock_class_stats lock_stats(struct lock_class *class)
+{
+        struct lock_class_stats stats;
+        int cpu, i;
+
+        memset(&stats, 0, sizeof(struct lock_class_stats));
+        for_each_possible_cpu(cpu) {
+                struct lock_class_stats *pcs =
+                        &per_cpu(lock_stats, cpu)[class - lock_classes];
+
+                for (i = 0; i < ARRAY_SIZE(stats.contention_point); i++)
+                        stats.contention_point[i] += pcs->contention_point[i];
+
+                lock_time_add(&pcs->read_waittime, &stats.read_waittime);
+                lock_time_add(&pcs->write_waittime, &stats.write_waittime);
+
+                lock_time_add(&pcs->read_holdtime, &stats.read_holdtime);
+                lock_time_add(&pcs->write_holdtime, &stats.write_holdtime);
+
+                for (i = 0; i < ARRAY_SIZE(stats.bounces); i++)
+                        stats.bounces[i] += pcs->bounces[i];
+        }
+
+        return stats;
+}
+
+void clear_lock_stats(struct lock_class *class)
+{
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct lock_class_stats *cpu_stats =
+                        &per_cpu(lock_stats, cpu)[class - lock_classes];
+
+                memset(cpu_stats, 0, sizeof(struct lock_class_stats));
+        }
+        memset(class->contention_point, 0, sizeof(class->contention_point));
+}
+
+static struct lock_class_stats *get_lock_stats(struct lock_class *class)
+{
+        return &get_cpu_var(lock_stats)[class - lock_classes];
+}
+
+static void put_lock_stats(struct lock_class_stats *stats)
+{
+        put_cpu_var(lock_stats);
+}
+
+static void lock_release_holdtime(struct held_lock *hlock)
+{
+        struct lock_class_stats *stats;
+        s64 holdtime;
+
+        if (!lock_stat)
+                return;
+
+        holdtime = sched_clock() - hlock->holdtime_stamp;
+
+        stats = get_lock_stats(hlock->class);
+        if (hlock->read)
+                lock_time_inc(&stats->read_holdtime, holdtime);
+        else
+                lock_time_inc(&stats->write_holdtime, holdtime);
+        put_lock_stats(stats);
+}
+#else
+static inline void lock_release_holdtime(struct held_lock *hlock)
+{
+}
+#endif
+
 /*
  * We keep a global list of all lock classes. The list only grows,
  * never shrinks. The list is only accessed with the lockdep
@@ -133,24 +243,18 @@ LIST_HEAD(all_lock_classes);
  */
 #define CLASSHASH_BITS          (MAX_LOCKDEP_KEYS_BITS - 1)
 #define CLASSHASH_SIZE          (1UL << CLASSHASH_BITS)
-#define CLASSHASH_MASK          (CLASSHASH_SIZE - 1)
-#define __classhashfn(key)      ((((unsigned long)key >> CLASSHASH_BITS) + (unsigned long)key) & CLASSHASH_MASK)
+#define __classhashfn(key)      hash_long((unsigned long)key, CLASSHASH_BITS)
 #define classhashentry(key)     (classhash_table + __classhashfn((key)))
 
 static struct list_head classhash_table[CLASSHASH_SIZE];
 
-unsigned long nr_lock_chains;
-static struct lock_chain lock_chains[MAX_LOCKDEP_CHAINS];
-
 /*
  * We put the lock dependency chains into a hash-table as well, to cache
  * their existence:
  */
 #define CHAINHASH_BITS          (MAX_LOCKDEP_CHAINS_BITS-1)
 #define CHAINHASH_SIZE          (1UL << CHAINHASH_BITS)
-#define CHAINHASH_MASK          (CHAINHASH_SIZE - 1)
-#define __chainhashfn(chain) \
-                (((chain >> CHAINHASH_BITS) + chain) & CHAINHASH_MASK)
+#define __chainhashfn(chain)    hash_long(chain, CHAINHASH_BITS)
 #define chainhashentry(chain)   (chainhash_table + __chainhashfn((chain)))
 
 static struct list_head chainhash_table[CHAINHASH_SIZE];
@@ -223,26 +327,6 @@ static int verbose(struct lock_class *class)
         return 0;
 }
 
-#ifdef CONFIG_TRACE_IRQFLAGS
-
-static int hardirq_verbose(struct lock_class *class)
-{
-#if HARDIRQ_VERBOSE
-        return class_filter(class);
-#endif
-        return 0;
-}
-
-static int softirq_verbose(struct lock_class *class)
-{
-#if SOFTIRQ_VERBOSE
-        return class_filter(class);
-#endif
-        return 0;
-}
-
-#endif
-
 /*
  * Stack-trace: tightly packed array of stack backtrace
  * addresses. Protected by the graph_lock.
@@ -291,6 +375,11 @@ unsigned int max_recursion_depth;
  * about it later on, in lockdep_info().
  */
 static int lockdep_init_error;
+static unsigned long lockdep_init_trace_data[20];
+static struct stack_trace lockdep_init_trace = {
+        .max_entries = ARRAY_SIZE(lockdep_init_trace_data),
+        .entries = lockdep_init_trace_data,
+};
 
 /*
  * Various lockdep statistics:
@@ -379,7 +468,7 @@ get_usage_chars(struct lock_class *class, char *c1, char *c2, char *c3, char *c4
 
 static void print_lock_name(struct lock_class *class)
 {
-        char str[KSYM_NAME_LEN + 1], c1, c2, c3, c4;
+        char str[KSYM_NAME_LEN], c1, c2, c3, c4;
         const char *name;
 
         get_usage_chars(class, &c1, &c2, &c3, &c4);
@@ -401,7 +490,7 @@ static void print_lock_name(struct lock_class *class)
 static void print_lockdep_cache(struct lockdep_map *lock)
 {
         const char *name;
-        char str[KSYM_NAME_LEN + 1];
+        char str[KSYM_NAME_LEN];
 
         name = lock->name;
         if (!name)
@@ -482,6 +571,262 @@ static void print_lock_dependencies(struct lock_class *class, int depth)
         }
 }
 
+static void print_kernel_version(void)
+{
+        printk("%s %.*s\n", init_utsname()->release,
+                (int)strcspn(init_utsname()->version, " "),
+                init_utsname()->version);
+}
+
+static int very_verbose(struct lock_class *class)
+{
+#if VERY_VERBOSE
+        return class_filter(class);
+#endif
+        return 0;
+}
+
+/*
+ * Is this the address of a static object:
+ */
+static int static_obj(void *obj)
+{
+        unsigned long start = (unsigned long) &_stext,
+                      end   = (unsigned long) &_end,
+                      addr  = (unsigned long) obj;
+#ifdef CONFIG_SMP
+        int i;
+#endif
+
+        /*
+         * static variable?
+         */
+        if ((addr >= start) && (addr < end))
+                return 1;
+
+#ifdef CONFIG_SMP
+        /*
+         * percpu var?
+         */
+        for_each_possible_cpu(i) {
+                start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
+                end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
+                                        + per_cpu_offset(i);
+
+                if ((addr >= start) && (addr < end))
+                        return 1;
+        }
+#endif
+
+        /*
+         * module var?
+         */
+        return is_module_address(addr);
+}
+
+/*
+ * To make lock name printouts unique, we calculate a unique
+ * class->name_version generation counter:
+ */
+static int count_matching_names(struct lock_class *new_class)
+{
+        struct lock_class *class;
+        int count = 0;
+
+        if (!new_class->name)
+                return 0;
+
+        list_for_each_entry(class, &all_lock_classes, lock_entry) {
+                if (new_class->key - new_class->subclass == class->key)
+                        return class->name_version;
+                if (class->name && !strcmp(class->name, new_class->name))
+                        count = max(count, class->name_version);
+        }
+
+        return count + 1;
+}
+
+/*
+ * Register a lock's class in the hash-table, if the class is not present
+ * yet. Otherwise we look it up. We cache the result in the lock object
+ * itself, so actual lookup of the hash should be once per lock object.
+ */
+static inline struct lock_class *
+look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
+{
+        struct lockdep_subclass_key *key;
+        struct list_head *hash_head;
+        struct lock_class *class;
+
+#ifdef CONFIG_DEBUG_LOCKDEP
+        /*
+         * If the architecture calls into lockdep before initializing
+         * the hashes then we'll warn about it later. (we cannot printk
+         * right now)
+         */
+        if (unlikely(!lockdep_initialized)) {
+                lockdep_init();
+                lockdep_init_error = 1;
+                save_stack_trace(&lockdep_init_trace);
+        }
+#endif
+
+        /*
+         * Static locks do not have their class-keys yet - for them the key
+         * is the lock object itself:
+         */
+        if (unlikely(!lock->key))
+                lock->key = (void *)lock;
+
+        /*
+         * NOTE: the class-key must be unique. For dynamic locks, a static
+         * lock_class_key variable is passed in through the mutex_init()
+         * (or spin_lock_init()) call - which acts as the key. For static
+         * locks we use the lock object itself as the key.
+         */
+        BUILD_BUG_ON(sizeof(struct lock_class_key) >
+                        sizeof(struct lockdep_map));
+
+        key = lock->key->subkeys + subclass;
+
+        hash_head = classhashentry(key);
+
+        /*
+         * We can walk the hash lockfree, because the hash only
+         * grows, and we are careful when adding entries to the end:
+         */
+        list_for_each_entry(class, hash_head, hash_entry) {
+                if (class->key == key) {
+                        WARN_ON_ONCE(class->name != lock->name);
+                        return class;
+                }
+        }
+
+        return NULL;
+}
+
+/*
+ * Register a lock's class in the hash-table, if the class is not present
+ * yet. Otherwise we look it up. We cache the result in the lock object
+ * itself, so actual lookup of the hash should be once per lock object.
+ */
+static inline struct lock_class *
+register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
+{
+        struct lockdep_subclass_key *key;
+        struct list_head *hash_head;
+        struct lock_class *class;
+        unsigned long flags;
+
+        class = look_up_lock_class(lock, subclass);
+        if (likely(class))
+                return class;
+
+        /*
+         * Debug-check: all keys must be persistent!
+         */
+        if (!static_obj(lock->key)) {
+                debug_locks_off();
+                printk("INFO: trying to register non-static key.\n");
+                printk("the code is fine but needs lockdep annotation.\n");
+                printk("turning off the locking correctness validator.\n");
+                dump_stack();
+
+                return NULL;
+        }
+
+        key = lock->key->subkeys + subclass;
+        hash_head = classhashentry(key);
+
+        raw_local_irq_save(flags);
+        if (!graph_lock()) {
+                raw_local_irq_restore(flags);
+                return NULL;
+        }
+        /*
+         * We have to do the hash-walk again, to avoid races
+         * with another CPU:
+         */
+        list_for_each_entry(class, hash_head, hash_entry)
+                if (class->key == key)
+                        goto out_unlock_set;
+        /*
+         * Allocate a new key from the static array, and add it to
+         * the hash:
+         */
+        if (nr_lock_classes >= MAX_LOCKDEP_KEYS) {
+                if (!debug_locks_off_graph_unlock()) {
+                        raw_local_irq_restore(flags);
+                        return NULL;
+                }
+                raw_local_irq_restore(flags);
+
+                printk("BUG: MAX_LOCKDEP_KEYS too low!\n");
+                printk("turning off the locking correctness validator.\n");
+                return NULL;
+        }
+        class = lock_classes + nr_lock_classes++;
+        debug_atomic_inc(&nr_unused_locks);
+        class->key = key;
+        class->name = lock->name;
+        class->subclass = subclass;
+        INIT_LIST_HEAD(&class->lock_entry);
+        INIT_LIST_HEAD(&class->locks_before);
+        INIT_LIST_HEAD(&class->locks_after);
+        class->name_version = count_matching_names(class);
+        /*
+         * We use RCU's safe list-add method to make
+         * parallel walking of the hash-list safe:
+         */
+        list_add_tail_rcu(&class->hash_entry, hash_head);
+
+        if (verbose(class)) {
+                graph_unlock();
+                raw_local_irq_restore(flags);
+
+                printk("\nnew class %p: %s", class->key, class->name);
+                if (class->name_version > 1)
+                        printk("#%d", class->name_version);
+                printk("\n");
+                dump_stack();
+
+                raw_local_irq_save(flags);
+                if (!graph_lock()) {
+                        raw_local_irq_restore(flags);
+                        return NULL;
+                }
+        }
+out_unlock_set:
+        graph_unlock();
+        raw_local_irq_restore(flags);
+
+        if (!subclass || force)
+                lock->class_cache = class;
+
+        if (DEBUG_LOCKS_WARN_ON(class->subclass != subclass))
+                return NULL;
+
+        return class;
+}
+
+#ifdef CONFIG_PROVE_LOCKING
+/*
+ * Allocate a lockdep entry. (assumes the graph_lock held, returns
+ * with NULL on failure)
+ */
+static struct lock_list *alloc_list_entry(void)
+{
+        if (nr_list_entries >= MAX_LOCKDEP_ENTRIES) {
+                if (!debug_locks_off_graph_unlock())
+                        return NULL;
+
+                printk("BUG: MAX_LOCKDEP_ENTRIES too low!\n");
+                printk("turning off the locking correctness validator.\n");
+                return NULL;
+        }
+        return list_entries + nr_list_entries++;
+}
+
 /*
  * Add a new dependency to the head of the list:
  */
@@ -542,13 +887,6 @@ print_circular_bug_entry(struct lock_list *target, unsigned int depth)
         return 0;
 }
 
-static void print_kernel_version(void)
-{
-        printk("%s %.*s\n", init_utsname()->release,
-                (int)strcspn(init_utsname()->version, " "),
-                init_utsname()->version);
-}
-
 /*
  * When a circular dependency is detected, print the
  * header first:
@@ -640,15 +978,7 @@ check_noncircular(struct lock_class *source, unsigned int depth)
         return 1;
 }
 
-static int very_verbose(struct lock_class *class)
-{
-#if VERY_VERBOSE
-        return class_filter(class);
-#endif
-        return 0;
-}
 #ifdef CONFIG_TRACE_IRQFLAGS
-
 /*
  * Forwards and backwards subgraph searching, for the purposes of
  * proving that two subgraphs can be connected by a new dependency
@@ -821,6 +1151,78 @@ check_usage(struct task_struct *curr, struct held_lock *prev,
                         bit_backwards, bit_forwards, irqclass);
 }
 
+static int
+check_prev_add_irq(struct task_struct *curr, struct held_lock *prev,
+                struct held_lock *next)
+{
+        /*
+         * Prove that the new dependency does not connect a hardirq-safe
+         * lock with a hardirq-unsafe lock - to achieve this we search
+         * the backwards-subgraph starting at <prev>, and the
+         * forwards-subgraph starting at <next>:
+         */
+        if (!check_usage(curr, prev, next, LOCK_USED_IN_HARDIRQ,
+                                        LOCK_ENABLED_HARDIRQS, "hard"))
+                return 0;
+
+        /*
+         * Prove that the new dependency does not connect a hardirq-safe-read
+         * lock with a hardirq-unsafe lock - to achieve this we search
+         * the backwards-subgraph starting at <prev>, and the
+         * forwards-subgraph starting at <next>:
+         */
+        if (!check_usage(curr, prev, next, LOCK_USED_IN_HARDIRQ_READ,
+                                        LOCK_ENABLED_HARDIRQS, "hard-read"))
+                return 0;
+
+        /*
+         * Prove that the new dependency does not connect a softirq-safe
+         * lock with a softirq-unsafe lock - to achieve this we search
+         * the backwards-subgraph starting at <prev>, and the
+         * forwards-subgraph starting at <next>:
+         */
+        if (!check_usage(curr, prev, next, LOCK_USED_IN_SOFTIRQ,
+                                        LOCK_ENABLED_SOFTIRQS, "soft"))
+                return 0;
+        /*
+         * Prove that the new dependency does not connect a softirq-safe-read
+         * lock with a softirq-unsafe lock - to achieve this we search
+         * the backwards-subgraph starting at <prev>, and the
+         * forwards-subgraph starting at <next>:
+         */
+        if (!check_usage(curr, prev, next, LOCK_USED_IN_SOFTIRQ_READ,
+                                        LOCK_ENABLED_SOFTIRQS, "soft"))
+                return 0;
+
+        return 1;
+}
+
+static void inc_chains(void)
+{
+        if (current->hardirq_context)
+                nr_hardirq_chains++;
+        else {
+                if (current->softirq_context)
+                        nr_softirq_chains++;
+                else
+                        nr_process_chains++;
+        }
+}
+
+#else
+
+static inline int
+check_prev_add_irq(struct task_struct *curr, struct held_lock *prev,
+                struct held_lock *next)
+{
+        return 1;
+}
+
+static inline void inc_chains(void)
+{
+        nr_process_chains++;
+}
+
 #endif
 
 static int
@@ -922,47 +1324,10 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
         if (!(check_noncircular(next->class, 0)))
                 return print_circular_bug_tail();
 
-#ifdef CONFIG_TRACE_IRQFLAGS
-        /*
-         * Prove that the new dependency does not connect a hardirq-safe
-         * lock with a hardirq-unsafe lock - to achieve this we search
-         * the backwards-subgraph starting at <prev>, and the
-         * forwards-subgraph starting at <next>:
-         */
-        if (!check_usage(curr, prev, next, LOCK_USED_IN_HARDIRQ,
-                                        LOCK_ENABLED_HARDIRQS, "hard"))
+        if (!check_prev_add_irq(curr, prev, next))
                 return 0;
 
         /*
-         * Prove that the new dependency does not connect a hardirq-safe-read
-         * lock with a hardirq-unsafe lock - to achieve this we search
-         * the backwards-subgraph starting at <prev>, and the
-         * forwards-subgraph starting at <next>:
-         */
-        if (!check_usage(curr, prev, next, LOCK_USED_IN_HARDIRQ_READ,
-                                        LOCK_ENABLED_HARDIRQS, "hard-read"))
-                return 0;
-
-        /*
-         * Prove that the new dependency does not connect a softirq-safe
-         * lock with a softirq-unsafe lock - to achieve this we search
-         * the backwards-subgraph starting at <prev>, and the
-         * forwards-subgraph starting at <next>:
-         */
-        if (!check_usage(curr, prev, next, LOCK_USED_IN_SOFTIRQ,
-                                        LOCK_ENABLED_SOFTIRQS, "soft"))
-                return 0;
-        /*
-         * Prove that the new dependency does not connect a softirq-safe-read
-         * lock with a softirq-unsafe lock - to achieve this we search
-         * the backwards-subgraph starting at <prev>, and the
-         * forwards-subgraph starting at <next>:
-         */
-        if (!check_usage(curr, prev, next, LOCK_USED_IN_SOFTIRQ_READ,
-                                        LOCK_ENABLED_SOFTIRQS, "soft"))
-                return 0;
-#endif
-        /*
          * For recursive read-locks we do all the dependency checks,
          * but we dont store read-triggered dependencies (only
          * write-triggered dependencies). This ensures that only the
@@ -1088,224 +1453,8 @@ out_bug:
         return 0;
 }
 
-
-/*
- * Is this the address of a static object:
- */
-static int static_obj(void *obj)
-{
-        unsigned long start = (unsigned long) &_stext,
-                      end   = (unsigned long) &_end,
-                      addr  = (unsigned long) obj;
-#ifdef CONFIG_SMP
-        int i;
-#endif
-
-        /*
-         * static variable?
-         */
-        if ((addr >= start) && (addr < end))
-                return 1;
-
-#ifdef CONFIG_SMP
-        /*
-         * percpu var?
-         */
-        for_each_possible_cpu(i) {
-                start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-                end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
-                                        + per_cpu_offset(i);
-
-                if ((addr >= start) && (addr < end))
-                        return 1;
-        }
-#endif
-
-        /*
-         * module var?
-         */
-        return is_module_address(addr);
-}
-
-/*
- * To make lock name printouts unique, we calculate a unique
- * class->name_version generation counter:
- */
-static int count_matching_names(struct lock_class *new_class)
-{
-        struct lock_class *class;
-        int count = 0;
-
-        if (!new_class->name)
-                return 0;
-
-        list_for_each_entry(class, &all_lock_classes, lock_entry) {
-                if (new_class->key - new_class->subclass == class->key)
-                        return class->name_version;
-                if (class->name && !strcmp(class->name, new_class->name))
-                        count = max(count, class->name_version);
-        }
-
-        return count + 1;
-}
-
-/*
- * Register a lock's class in the hash-table, if the class is not present
- * yet. Otherwise we look it up. We cache the result in the lock object
- * itself, so actual lookup of the hash should be once per lock object.
- */
-static inline struct lock_class *
-look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
-{
-        struct lockdep_subclass_key *key;
-        struct list_head *hash_head;
-        struct lock_class *class;
-
-#ifdef CONFIG_DEBUG_LOCKDEP
-        /*
-         * If the architecture calls into lockdep before initializing
-         * the hashes then we'll warn about it later. (we cannot printk
-         * right now)
-         */
-        if (unlikely(!lockdep_initialized)) {
-                lockdep_init();
-                lockdep_init_error = 1;
-        }
-#endif
-
-        /*
-         * Static locks do not have their class-keys yet - for them the key
-         * is the lock object itself:
-         */
-        if (unlikely(!lock->key))
-                lock->key = (void *)lock;
-
-        /*
-         * NOTE: the class-key must be unique. For dynamic locks, a static
-         * lock_class_key variable is passed in through the mutex_init()
-         * (or spin_lock_init()) call - which acts as the key. For static
-         * locks we use the lock object itself as the key.
-         */
-        BUILD_BUG_ON(sizeof(struct lock_class_key) > sizeof(struct lock_class));
-
-        key = lock->key->subkeys + subclass;
-
-        hash_head = classhashentry(key);
-
-        /*
-         * We can walk the hash lockfree, because the hash only
-         * grows, and we are careful when adding entries to the end:
-         */
-        list_for_each_entry(class, hash_head, hash_entry)
-                if (class->key == key)
-                        return class;
-
-        return NULL;
-}
-
-/*
- * Register a lock's class in the hash-table, if the class is not present
- * yet. Otherwise we look it up. We cache the result in the lock object
- * itself, so actual lookup of the hash should be once per lock object.
- */
-static inline struct lock_class *
-register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
-{
-        struct lockdep_subclass_key *key;
-        struct list_head *hash_head;
-        struct lock_class *class;
-        unsigned long flags;
-
-        class = look_up_lock_class(lock, subclass);
-        if (likely(class))
-                return class;
-
-        /*
-         * Debug-check: all keys must be persistent!
-         */
-        if (!static_obj(lock->key)) {
-                debug_locks_off();
-                printk("INFO: trying to register non-static key.\n");
-                printk("the code is fine but needs lockdep annotation.\n");
-                printk("turning off the locking correctness validator.\n");
-                dump_stack();
-
-                return NULL;
-        }
-
-        key = lock->key->subkeys + subclass;
-        hash_head = classhashentry(key);
-
-        raw_local_irq_save(flags);
-        if (!graph_lock()) {
-                raw_local_irq_restore(flags);
-                return NULL;
-        }
-        /*
-         * We have to do the hash-walk again, to avoid races
-         * with another CPU:
-         */
-        list_for_each_entry(class, hash_head, hash_entry)
-                if (class->key == key)
-                        goto out_unlock_set;
-        /*
-         * Allocate a new key from the static array, and add it to
-         * the hash:
-         */
-        if (nr_lock_classes >= MAX_LOCKDEP_KEYS) {
-                if (!debug_locks_off_graph_unlock()) {
-                        raw_local_irq_restore(flags);
-                        return NULL;
-                }
-                raw_local_irq_restore(flags);
-
-                printk("BUG: MAX_LOCKDEP_KEYS too low!\n");
-                printk("turning off the locking correctness validator.\n");
-                return NULL;
-        }
-        class = lock_classes + nr_lock_classes++;
-        debug_atomic_inc(&nr_unused_locks);
-        class->key = key;
-        class->name = lock->name;
-        class->subclass = subclass;
-        INIT_LIST_HEAD(&class->lock_entry);
-        INIT_LIST_HEAD(&class->locks_before);
-        INIT_LIST_HEAD(&class->locks_after);
-        class->name_version = count_matching_names(class);
-        /*
-         * We use RCU's safe list-add method to make
-         * parallel walking of the hash-list safe:
-         */
-        list_add_tail_rcu(&class->hash_entry, hash_head);
-
-        if (verbose(class)) {
-                graph_unlock();
-                raw_local_irq_restore(flags);
-
-                printk("\nnew class %p: %s", class->key, class->name);
-                if (class->name_version > 1)
-                        printk("#%d", class->name_version);
-                printk("\n");
-                dump_stack();
-
-                raw_local_irq_save(flags);
-                if (!graph_lock()) {
-                        raw_local_irq_restore(flags);
-                        return NULL;
-                }
-        }
-out_unlock_set:
-        graph_unlock();
-        raw_local_irq_restore(flags);
-
-        if (!subclass || force)
-                lock->class_cache = class;
-
-        if (DEBUG_LOCKS_WARN_ON(class->subclass != subclass))
-                return NULL;
-
-        return class;
-}
+unsigned long nr_lock_chains;
+static struct lock_chain lock_chains[MAX_LOCKDEP_CHAINS];
 
 /*
  * Look up a dependency chain. If the key is not present yet then
@@ -1366,21 +1515,72 @@ cache_hit:
         chain->chain_key = chain_key;
         list_add_tail_rcu(&chain->entry, hash_head);
         debug_atomic_inc(&chain_lookup_misses);
-#ifdef CONFIG_TRACE_IRQFLAGS
-        if (current->hardirq_context)
-                nr_hardirq_chains++;
-        else {
-                if (current->softirq_context)
-                        nr_softirq_chains++;
-                else
-                        nr_process_chains++;
-        }
-#else
-        nr_process_chains++;
-#endif
+        inc_chains();
+
+        return 1;
+}
+
+static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
+                struct held_lock *hlock, int chain_head)
+{
+        /*
+         * Trylock needs to maintain the stack of held locks, but it
+         * does not add new dependencies, because trylock can be done
+         * in any order.
+         *
+         * We look up the chain_key and do the O(N^2) check and update of
+         * the dependencies only if this is a new dependency chain.
+         * (If lookup_chain_cache() returns with 1 it acquires
+         * graph_lock for us)
+         */
+        if (!hlock->trylock && (hlock->check == 2) &&
+                        lookup_chain_cache(curr->curr_chain_key, hlock->class)) {
+                /*
+                 * Check whether last held lock:
+                 *
+                 * - is irq-safe, if this lock is irq-unsafe
+                 * - is softirq-safe, if this lock is hardirq-unsafe
+                 *
+                 * And check whether the new lock's dependency graph
+                 * could lead back to the previous lock.
+                 *
+                 * any of these scenarios could lead to a deadlock. If
+                 * All validations
+                 */
+                int ret = check_deadlock(curr, hlock, lock, hlock->read);
+
+                if (!ret)
+                        return 0;
+                /*
+                 * Mark recursive read, as we jump over it when
+                 * building dependencies (just like we jump over
+                 * trylock entries):
+                 */
+                if (ret == 2)
+                        hlock->read = 2;
+                /*
+                 * Add dependency only if this lock is not the head
+                 * of the chain, and if it's not a secondary read-lock:
+                 */
+                if (!chain_head && ret != 2)
+                        if (!check_prevs_add(curr, hlock))
+                                return 0;
+                graph_unlock();
+        } else
+                /* after lookup_chain_cache(): */
+                if (unlikely(!debug_locks))
+                        return 0;
 
         return 1;
 }
+#else
+static inline int validate_chain(struct task_struct *curr,
+                struct lockdep_map *lock, struct held_lock *hlock,
+                int chain_head)
+{
+        return 1;
+}
+#endif
 
 /*
  * We are building curr_chain_key incrementally, so double-check
@@ -1425,6 +1625,57 @@ static void check_chain_key(struct task_struct *curr)
 #endif
 }
 
+static int
+print_usage_bug(struct task_struct *curr, struct held_lock *this,
+                enum lock_usage_bit prev_bit, enum lock_usage_bit new_bit)
+{
+        if (!debug_locks_off_graph_unlock() || debug_locks_silent)
+                return 0;
+
+        printk("\n=================================\n");
+        printk(  "[ INFO: inconsistent lock state ]\n");
+        print_kernel_version();
+        printk(  "---------------------------------\n");
+
+        printk("inconsistent {%s} -> {%s} usage.\n",
+                usage_str[prev_bit], usage_str[new_bit]);
+
+        printk("%s/%d [HC%u[%lu]:SC%u[%lu]:HE%u:SE%u] takes:\n",
+                curr->comm, curr->pid,
+                trace_hardirq_context(curr), hardirq_count() >> HARDIRQ_SHIFT,
+                trace_softirq_context(curr), softirq_count() >> SOFTIRQ_SHIFT,
+                trace_hardirqs_enabled(curr),
+                trace_softirqs_enabled(curr));
+        print_lock(this);
+
+        printk("{%s} state was registered at:\n", usage_str[prev_bit]);
+        print_stack_trace(this->class->usage_traces + prev_bit, 1);
+
+        print_irqtrace_events(curr);
+        printk("\nother info that might help us debug this:\n");
+        lockdep_print_held_locks(curr);
+
+        printk("\nstack backtrace:\n");
+        dump_stack();
+
+        return 0;
+}
+
+/*
+ * Print out an error if an invalid bit is set:
+ */
+static inline int
+valid_state(struct task_struct *curr, struct held_lock *this,
+            enum lock_usage_bit new_bit, enum lock_usage_bit bad_bit)
+{
+        if (unlikely(this->class->usage_mask & (1 << bad_bit)))
+                return print_usage_bug(curr, this, bad_bit, new_bit);
+        return 1;
+}
+
+static int mark_lock(struct task_struct *curr, struct held_lock *this,
+                     enum lock_usage_bit new_bit);
+
 #ifdef CONFIG_TRACE_IRQFLAGS
 
 /*
@@ -1518,90 +1769,30 @@ void print_irqtrace_events(struct task_struct *curr)
         print_ip_sym(curr->softirq_disable_ip);
 }
 
-#endif
-
-static int
-print_usage_bug(struct task_struct *curr, struct held_lock *this,
-                enum lock_usage_bit prev_bit, enum lock_usage_bit new_bit)
+static int hardirq_verbose(struct lock_class *class)
 {
-        if (!debug_locks_off_graph_unlock() || debug_locks_silent)
-                return 0;
-
-        printk("\n=================================\n");
-        printk(  "[ INFO: inconsistent lock state ]\n");
-        print_kernel_version();
-        printk(  "---------------------------------\n");
-
-        printk("inconsistent {%s} -> {%s} usage.\n",
-                usage_str[prev_bit], usage_str[new_bit]);
-
-        printk("%s/%d [HC%u[%lu]:SC%u[%lu]:HE%u:SE%u] takes:\n",
-                curr->comm, curr->pid,
-                trace_hardirq_context(curr), hardirq_count() >> HARDIRQ_SHIFT,
-                trace_softirq_context(curr), softirq_count() >> SOFTIRQ_SHIFT,
-                trace_hardirqs_enabled(curr),
-                trace_softirqs_enabled(curr));
-        print_lock(this);
-
-        printk("{%s} state was registered at:\n", usage_str[prev_bit]);
-        print_stack_trace(this->class->usage_traces + prev_bit, 1);
-
-        print_irqtrace_events(curr);
-        printk("\nother info that might help us debug this:\n");
-        lockdep_print_held_locks(curr);
-
-        printk("\nstack backtrace:\n");
-        dump_stack();
-
+#if HARDIRQ_VERBOSE
+        return class_filter(class);
+#endif
         return 0;
 }
 
-/*
- * Print out an error if an invalid bit is set:
- */
-static inline int
-valid_state(struct task_struct *curr, struct held_lock *this,
-            enum lock_usage_bit new_bit, enum lock_usage_bit bad_bit)
+static int softirq_verbose(struct lock_class *class)
 {
-        if (unlikely(this->class->usage_mask & (1 << bad_bit)))
-                return print_usage_bug(curr, this, bad_bit, new_bit);
-        return 1;
+#if SOFTIRQ_VERBOSE
+        return class_filter(class);
+#endif
+        return 0;
 }
 
 #define STRICT_READ_CHECKS      1
 
-/*
- * Mark a lock with a usage bit, and validate the state transition:
- */
-static int mark_lock(struct task_struct *curr, struct held_lock *this,
-                     enum lock_usage_bit new_bit)
+static int mark_lock_irq(struct task_struct *curr, struct held_lock *this,
+                enum lock_usage_bit new_bit)
 {
-        unsigned int new_mask = 1 << new_bit, ret = 1;
-
-        /*
-         * If already set then do not dirty the cacheline,
-         * nor do any checks:
-         */
-        if (likely(this->class->usage_mask & new_mask))
-                return 1;
-
-        if (!graph_lock())
-                return 0;
-        /*
-         * Make sure we didnt race:
-         */
-        if (unlikely(this->class->usage_mask & new_mask)) {
-                graph_unlock();
-                return 1;
-        }
-
-        this->class->usage_mask |= new_mask;
+        int ret = 1;
 
-        if (!save_trace(this->class->usage_traces + new_bit))
-                return 0;
-
-        switch (new_bit) {
-#ifdef CONFIG_TRACE_IRQFLAGS
+        switch(new_bit) {
         case LOCK_USED_IN_HARDIRQ:
                 if (!valid_state(curr, this, new_bit, LOCK_ENABLED_HARDIRQS))
                         return 0;
@@ -1760,37 +1951,14 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
                 if (softirq_verbose(this->class))
                         ret = 2;
                 break;
-#endif
-        case LOCK_USED:
-                /*
-                 * Add it to the global list of classes:
-                 */
-                list_add_tail_rcu(&this->class->lock_entry, &all_lock_classes);
-                debug_atomic_dec(&nr_unused_locks);
-                break;
         default:
-                if (!debug_locks_off_graph_unlock())
-                        return 0;
                 WARN_ON(1);
-                return 0;
-        }
-
-        graph_unlock();
-
-        /*
-         * We must printk outside of the graph_lock:
-         */
-        if (ret == 2) {
-                printk("\nmarked lock as {%s}:\n", usage_str[new_bit]);
-                print_lock(this);
-                print_irqtrace_events(curr);
-                dump_stack();
+                break;
         }
 
         return ret;
 }
 
-#ifdef CONFIG_TRACE_IRQFLAGS
 /*
  * Mark all held locks with a usage bit:
  */
@@ -1973,9 +2141,176 @@ void trace_softirqs_off(unsigned long ip)
                 debug_atomic_inc(&redundant_softirqs_off);
 }
 
+static int mark_irqflags(struct task_struct *curr, struct held_lock *hlock)
+{
+        /*
+         * If non-trylock use in a hardirq or softirq context, then
+         * mark the lock as used in these contexts:
+         */
+        if (!hlock->trylock) {
+                if (hlock->read) {
+                        if (curr->hardirq_context)
+                                if (!mark_lock(curr, hlock,
+                                                LOCK_USED_IN_HARDIRQ_READ))
+                                        return 0;
+                        if (curr->softirq_context)
+                                if (!mark_lock(curr, hlock,
+                                                LOCK_USED_IN_SOFTIRQ_READ))
+                                        return 0;
+                } else {
+                        if (curr->hardirq_context)
+                                if (!mark_lock(curr, hlock, LOCK_USED_IN_HARDIRQ))
+                                        return 0;
+                        if (curr->softirq_context)
+                                if (!mark_lock(curr, hlock, LOCK_USED_IN_SOFTIRQ))
+                                        return 0;
+                }
+        }
+        if (!hlock->hardirqs_off) {
+                if (hlock->read) {
+                        if (!mark_lock(curr, hlock,
+                                        LOCK_ENABLED_HARDIRQS_READ))
+                                return 0;
+                        if (curr->softirqs_enabled)
+                                if (!mark_lock(curr, hlock,
+                                                LOCK_ENABLED_SOFTIRQS_READ))
+                                        return 0;
+                } else {
+                        if (!mark_lock(curr, hlock,
+                                        LOCK_ENABLED_HARDIRQS))
+                                return 0;
+                        if (curr->softirqs_enabled)
+                                if (!mark_lock(curr, hlock,
+                                                LOCK_ENABLED_SOFTIRQS))
+                                        return 0;
+                }
+        }
+
+        return 1;
+}
+
+static int separate_irq_context(struct task_struct *curr,
+                struct held_lock *hlock)
+{
+        unsigned int depth = curr->lockdep_depth;
+
+        /*
+         * Keep track of points where we cross into an interrupt context:
+         */
+        hlock->irq_context = 2*(curr->hardirq_context ? 1 : 0) +
+                                curr->softirq_context;
+        if (depth) {
+                struct held_lock *prev_hlock;
+
+                prev_hlock = curr->held_locks + depth-1;
+                /*
+                 * If we cross into another context, reset the
+                 * hash key (this also prevents the checking and the
+                 * adding of the dependency to 'prev'):
+                 */
+                if (prev_hlock->irq_context != hlock->irq_context)
+                        return 1;
+        }
+        return 0;
+}
+
+#else
+
+static inline
+int mark_lock_irq(struct task_struct *curr, struct held_lock *this,
+                enum lock_usage_bit new_bit)
+{
+        WARN_ON(1);
+        return 1;
+}
+
+static inline int mark_irqflags(struct task_struct *curr,
+                struct held_lock *hlock)
+{
+        return 1;
+}
+
+static inline int separate_irq_context(struct task_struct *curr,
+                struct held_lock *hlock)
+{
+        return 0;
+}
+
 #endif
 
 /*
+ * Mark a lock with a usage bit, and validate the state transition:
+ */
+static int mark_lock(struct task_struct *curr, struct held_lock *this,
+                     enum lock_usage_bit new_bit)
+{
+        unsigned int new_mask = 1 << new_bit, ret = 1;
+
+        /*
+         * If already set then do not dirty the cacheline,
+         * nor do any checks:
+         */
+        if (likely(this->class->usage_mask & new_mask))
+                return 1;
+
+        if (!graph_lock())
+                return 0;
+        /*
+         * Make sure we didnt race:
+         */
+        if (unlikely(this->class->usage_mask & new_mask)) {
+                graph_unlock();
+                return 1;
+        }
+
+        this->class->usage_mask |= new_mask;
+
+        if (!save_trace(this->class->usage_traces + new_bit))
+                return 0;
+
+        switch (new_bit) {
+        case LOCK_USED_IN_HARDIRQ:
+        case LOCK_USED_IN_SOFTIRQ:
+        case LOCK_USED_IN_HARDIRQ_READ:
+        case LOCK_USED_IN_SOFTIRQ_READ:
+        case LOCK_ENABLED_HARDIRQS:
+        case LOCK_ENABLED_SOFTIRQS:
+        case LOCK_ENABLED_HARDIRQS_READ:
+        case LOCK_ENABLED_SOFTIRQS_READ:
+                ret = mark_lock_irq(curr, this, new_bit);
+                if (!ret)
+                        return 0;
+                break;
+        case LOCK_USED:
+                /*
+                 * Add it to the global list of classes:
+                 */
+                list_add_tail_rcu(&this->class->lock_entry, &all_lock_classes);
+                debug_atomic_dec(&nr_unused_locks);
+                break;
+        default:
+                if (!debug_locks_off_graph_unlock())
+                        return 0;
+                WARN_ON(1);
+                return 0;
+        }
+
+        graph_unlock();
+
+        /*
+         * We must printk outside of the graph_lock:
+         */
+        if (ret == 2) {
+                printk("\nmarked lock as {%s}:\n", usage_str[new_bit]);
+                print_lock(this);
+                print_irqtrace_events(curr);
+                dump_stack();
+        }
+
+        return ret;
+}
+
+/*
  * Initialize a lock instance's lock-class mapping info:
  */
 void lockdep_init_map(struct lockdep_map *lock, const char *name,
@@ -1999,6 +2334,9 @@ void lockdep_init_map(struct lockdep_map *lock, const char *name,
         lock->name = name;
         lock->key = key;
         lock->class_cache = NULL;
+#ifdef CONFIG_LOCK_STAT
+        lock->cpu = raw_smp_processor_id();
+#endif
         if (subclass)
                 register_lock_class(lock, subclass, 1);
 }
@@ -2020,6 +2358,9 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         int chain_head = 0;
         u64 chain_key;
 
+        if (!prove_locking)
+                check = 1;
+
         if (unlikely(!debug_locks))
                 return 0;
 
@@ -2070,57 +2411,18 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         hlock->read = read;
         hlock->check = check;
         hlock->hardirqs_off = hardirqs_off;
-
-        if (check != 2)
-                goto out_calc_hash;
-#ifdef CONFIG_TRACE_IRQFLAGS
-        /*
-         * If non-trylock use in a hardirq or softirq context, then
-         * mark the lock as used in these contexts:
-         */
-        if (!trylock) {
-                if (read) {
-                        if (curr->hardirq_context)
-                                if (!mark_lock(curr, hlock,
-                                                LOCK_USED_IN_HARDIRQ_READ))
-                                        return 0;
-                        if (curr->softirq_context)
-                                if (!mark_lock(curr, hlock,
-                                                LOCK_USED_IN_SOFTIRQ_READ))
-                                        return 0;
-                } else {
-                        if (curr->hardirq_context)
-                                if (!mark_lock(curr, hlock, LOCK_USED_IN_HARDIRQ))
-                                        return 0;
-                        if (curr->softirq_context)
-                                if (!mark_lock(curr, hlock, LOCK_USED_IN_SOFTIRQ))
-                                        return 0;
-                }
-        }
-        if (!hardirqs_off) {
-                if (read) {
-                        if (!mark_lock(curr, hlock,
-                                        LOCK_ENABLED_HARDIRQS_READ))
-                                return 0;
-                        if (curr->softirqs_enabled)
-                                if (!mark_lock(curr, hlock,
-                                                LOCK_ENABLED_SOFTIRQS_READ))
-                                        return 0;
-                } else {
-                        if (!mark_lock(curr, hlock,
-                                        LOCK_ENABLED_HARDIRQS))
-                                return 0;
-                        if (curr->softirqs_enabled)
-                                if (!mark_lock(curr, hlock,
-                                                LOCK_ENABLED_SOFTIRQS))
-                                        return 0;
-                }
-        }
+#ifdef CONFIG_LOCK_STAT
+        hlock->waittime_stamp = 0;
+        hlock->holdtime_stamp = sched_clock();
 #endif
+
+        if (check == 2 && !mark_irqflags(curr, hlock))
+                return 0;
+
         /* mark it as used: */
         if (!mark_lock(curr, hlock, LOCK_USED))
                 return 0;
-out_calc_hash:
+
         /*
          * Calculate the chain hash: it's the combined has of all the
          * lock keys along the dependency chain. We save the hash value
@@ -2143,77 +2445,15 @@ out_calc_hash:
         }
 
         hlock->prev_chain_key = chain_key;
-
-#ifdef CONFIG_TRACE_IRQFLAGS
-        /*
-         * Keep track of points where we cross into an interrupt context:
-         */
-        hlock->irq_context = 2*(curr->hardirq_context ? 1 : 0) +
-                                curr->softirq_context;
-        if (depth) {
-                struct held_lock *prev_hlock;
-
-                prev_hlock = curr->held_locks + depth-1;
-                /*
-                 * If we cross into another context, reset the
-                 * hash key (this also prevents the checking and the
-                 * adding of the dependency to 'prev'):
-                 */
-                if (prev_hlock->irq_context != hlock->irq_context) {
-                        chain_key = 0;
-                        chain_head = 1;
-                }
+        if (separate_irq_context(curr, hlock)) {
+                chain_key = 0;
+                chain_head = 1;
         }
-#endif
         chain_key = iterate_chain_key(chain_key, id);
         curr->curr_chain_key = chain_key;
 
-        /*
-         * Trylock needs to maintain the stack of held locks, but it
-         * does not add new dependencies, because trylock can be done
-         * in any order.
-         *
-         * We look up the chain_key and do the O(N^2) check and update of
-         * the dependencies only if this is a new dependency chain.
-         * (If lookup_chain_cache() returns with 1 it acquires
-         * graph_lock for us)
-         */
-        if (!trylock && (check == 2) && lookup_chain_cache(chain_key, class)) {
-                /*
-                 * Check whether last held lock:
-                 *
-                 * - is irq-safe, if this lock is irq-unsafe
-                 * - is softirq-safe, if this lock is hardirq-unsafe
-                 *
-                 * And check whether the new lock's dependency graph
-                 * could lead back to the previous lock.
-                 *
-                 * any of these scenarios could lead to a deadlock. If
-                 * All validations
-                 */
-                int ret = check_deadlock(curr, hlock, lock, read);
-
-                if (!ret)
-                        return 0;
-                /*
-                 * Mark recursive read, as we jump over it when
-                 * building dependencies (just like we jump over
-                 * trylock entries):
-                 */
-                if (ret == 2)
-                        hlock->read = 2;
-                /*
-                 * Add dependency only if this lock is not the head
-                 * of the chain, and if it's not a secondary read-lock:
-                 */
-                if (!chain_head && ret != 2)
-                        if (!check_prevs_add(curr, hlock))
-                                return 0;
-                graph_unlock();
-        } else
-                /* after lookup_chain_cache(): */
-                if (unlikely(!debug_locks))
-                        return 0;
+        if (!validate_chain(curr, lock, hlock, chain_head))
+                return 0;
 
         curr->lockdep_depth++;
         check_chain_key(curr);
@@ -2315,6 +2555,8 @@ lock_release_non_nested(struct task_struct *curr,
         return print_unlock_inbalance_bug(curr, lock, ip);
 
 found_it:
+        lock_release_holdtime(hlock);
+
         /*
          * We have the right lock to unlock, 'hlock' points to it.
          * Now we remove it from the stack, and add back the other
@@ -2367,6 +2609,8 @@ static int lock_release_nested(struct task_struct *curr,
 
         curr->curr_chain_key = hlock->prev_chain_key;
 
+        lock_release_holdtime(hlock);
+
 #ifdef CONFIG_DEBUG_LOCKDEP
         hlock->prev_chain_key = 0;
         hlock->class = NULL;
@@ -2441,6 +2685,9 @@ void lock_acquire(struct lockdep_map *lock, unsigned int subclass,
 {
         unsigned long flags;
 
+        if (unlikely(!lock_stat && !prove_locking))
+                return;
+
         if (unlikely(current->lockdep_recursion))
                 return;
 
@@ -2460,6 +2707,9 @@ void lock_release(struct lockdep_map *lock, int nested, unsigned long ip)
 {
         unsigned long flags;
 
+        if (unlikely(!lock_stat && !prove_locking))
+                return;
+
         if (unlikely(current->lockdep_recursion))
                 return;
 
@@ -2473,6 +2723,166 @@ void lock_release(struct lockdep_map *lock, int nested, unsigned long ip)
 
 EXPORT_SYMBOL_GPL(lock_release);
 
+#ifdef CONFIG_LOCK_STAT
+static int
+print_lock_contention_bug(struct task_struct *curr, struct lockdep_map *lock,
+                           unsigned long ip)
+{
+        if (!debug_locks_off())
+                return 0;
+        if (debug_locks_silent)
+                return 0;
+
+        printk("\n=================================\n");
+        printk(  "[ BUG: bad contention detected! ]\n");
+        printk(  "---------------------------------\n");
+        printk("%s/%d is trying to contend lock (",
+                curr->comm, curr->pid);
+        print_lockdep_cache(lock);
+        printk(") at:\n");
+        print_ip_sym(ip);
+        printk("but there are no locks held!\n");
+        printk("\nother info that might help us debug this:\n");
+        lockdep_print_held_locks(curr);
+
+        printk("\nstack backtrace:\n");
+        dump_stack();
+
+        return 0;
+}
+
+static void
+__lock_contended(struct lockdep_map *lock, unsigned long ip)
+{
+        struct task_struct *curr = current;
+        struct held_lock *hlock, *prev_hlock;
+        struct lock_class_stats *stats;
+        unsigned int depth;
+        int i, point;
+
+        depth = curr->lockdep_depth;
+        if (DEBUG_LOCKS_WARN_ON(!depth))
+                return;
+
+        prev_hlock = NULL;
+        for (i = depth-1; i >= 0; i--) {
+                hlock = curr->held_locks + i;
+                /*
+                 * We must not cross into another context:
+                 */
+                if (prev_hlock && prev_hlock->irq_context != hlock->irq_context)
+                        break;
+                if (hlock->instance == lock)
+                        goto found_it;
+                prev_hlock = hlock;
+        }
+        print_lock_contention_bug(curr, lock, ip);
+        return;
+
+found_it:
+        hlock->waittime_stamp = sched_clock();
+
+        point = lock_contention_point(hlock->class, ip);
+
+        stats = get_lock_stats(hlock->class);
+        if (point < ARRAY_SIZE(stats->contention_point))
+                stats->contention_point[i]++;
+        if (lock->cpu != smp_processor_id())
+                stats->bounces[bounce_contended + !!hlock->read]++;
+        put_lock_stats(stats);
+}
+
+static void
+__lock_acquired(struct lockdep_map *lock)
+{
+        struct task_struct *curr = current;
+        struct held_lock *hlock, *prev_hlock;
+        struct lock_class_stats *stats;
+        unsigned int depth;
+        u64 now;
+        s64 waittime = 0;
+        int i, cpu;
+
+        depth = curr->lockdep_depth;
+        if (DEBUG_LOCKS_WARN_ON(!depth))
+                return;
+
+        prev_hlock = NULL;
+        for (i = depth-1; i >= 0; i--) {
+                hlock = curr->held_locks + i;
+                /*
+                 * We must not cross into another context:
+                 */
+                if (prev_hlock && prev_hlock->irq_context != hlock->irq_context)
+                        break;
+                if (hlock->instance == lock)
+                        goto found_it;
+                prev_hlock = hlock;
+        }
+        print_lock_contention_bug(curr, lock, _RET_IP_);
+        return;
+
+found_it:
+        cpu = smp_processor_id();
+        if (hlock->waittime_stamp) {
+                now = sched_clock();
+                waittime = now - hlock->waittime_stamp;
+                hlock->holdtime_stamp = now;
+        }
+
+        stats = get_lock_stats(hlock->class);
+        if (waittime) {
+                if (hlock->read)
+                        lock_time_inc(&stats->read_waittime, waittime);
+                else
+                        lock_time_inc(&stats->write_waittime, waittime);
+        }
+        if (lock->cpu != cpu)
+                stats->bounces[bounce_acquired + !!hlock->read]++;
+        put_lock_stats(stats);
+
+        lock->cpu = cpu;
+}
+
+void lock_contended(struct lockdep_map *lock, unsigned long ip)
+{
+        unsigned long flags;
+
+        if (unlikely(!lock_stat))
+                return;
+
+        if (unlikely(current->lockdep_recursion))
+                return;
+
+        raw_local_irq_save(flags);
+        check_flags(flags);
+        current->lockdep_recursion = 1;
+        __lock_contended(lock, ip);
+        current->lockdep_recursion = 0;
+        raw_local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(lock_contended);
+
+void lock_acquired(struct lockdep_map *lock)
+{
+        unsigned long flags;
+
+        if (unlikely(!lock_stat))
+                return;
+
+        if (unlikely(current->lockdep_recursion))
+                return;
+
+        raw_local_irq_save(flags);
+        check_flags(flags);
+        current->lockdep_recursion = 1;
+        __lock_acquired(lock);
+        current->lockdep_recursion = 0;
+        raw_local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(lock_acquired);
+#endif
+
 /*
  * Used by the testsuite, sanitize the validator state
  * after a simulated failure:
@@ -2636,8 +3046,11 @@ void __init lockdep_info(void)
                 sizeof(struct held_lock) * MAX_LOCK_DEPTH);
 
 #ifdef CONFIG_DEBUG_LOCKDEP
-        if (lockdep_init_error)
-                printk("WARNING: lockdep init error! Arch code didnt call lockdep_init() early enough?\n");
+        if (lockdep_init_error) {
+                printk("WARNING: lockdep init error! Arch code didn't call lockdep_init() early enough?\n");
+                printk("Call stack leading to lockdep invocation was:\n");
+                print_stack_trace(&lockdep_init_trace, 0);
+        }
 #endif
 }
 
diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
index 58f35e586ee3..9f17af4a2490 100644
--- a/kernel/lockdep_proc.c
+++ b/kernel/lockdep_proc.c
@@ -5,7 +5,8 @@
  *
  * Started by Ingo Molnar:
  *
- *  Copyright (C) 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *  Copyright (C) 2006,2007 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
  *
  * Code for /proc/lockdep and /proc/lockdep_stats:
  *
@@ -15,6 +16,10 @@
 #include <linux/seq_file.h>
 #include <linux/kallsyms.h>
 #include <linux/debug_locks.h>
+#include <linux/vmalloc.h>
+#include <linux/sort.h>
+#include <asm/uaccess.h>
+#include <asm/div64.h>
 
 #include "lockdep_internals.h"
 
@@ -271,8 +276,10 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
         if (nr_list_entries)
                 factor = sum_forward_deps / nr_list_entries;
 
+#ifdef CONFIG_PROVE_LOCKING
         seq_printf(m, " dependency chains:             %11lu [max: %lu]\n",
                         nr_lock_chains, MAX_LOCKDEP_CHAINS);
+#endif
 
 #ifdef CONFIG_TRACE_IRQFLAGS
         seq_printf(m, " in-hardirq chains:             %11u\n",
@@ -342,6 +349,292 @@ static const struct file_operations proc_lockdep_stats_operations = {
         .release        = seq_release,
 };
 
+#ifdef CONFIG_LOCK_STAT
+
+struct lock_stat_data {
+        struct lock_class *class;
+        struct lock_class_stats stats;
+};
+
+struct lock_stat_seq {
+        struct lock_stat_data *iter;
+        struct lock_stat_data *iter_end;
+        struct lock_stat_data stats[MAX_LOCKDEP_KEYS];
+};
+
+/*
+ * sort on absolute number of contentions
+ */
+static int lock_stat_cmp(const void *l, const void *r)
+{
+        const struct lock_stat_data *dl = l, *dr = r;
+        unsigned long nl, nr;
+
+        nl = dl->stats.read_waittime.nr + dl->stats.write_waittime.nr;
+        nr = dr->stats.read_waittime.nr + dr->stats.write_waittime.nr;
+
+        return nr - nl;
+}
+
+static void seq_line(struct seq_file *m, char c, int offset, int length)
+{
+        int i;
+
+        for (i = 0; i < offset; i++)
+                seq_puts(m, " ");
+        for (i = 0; i < length; i++)
+                seq_printf(m, "%c", c);
+        seq_puts(m, "\n");
+}
+
+static void snprint_time(char *buf, size_t bufsiz, s64 nr)
+{
+        unsigned long rem;
+
+        rem = do_div(nr, 1000); /* XXX: do_div_signed */
+        snprintf(buf, bufsiz, "%lld.%02d", (long long)nr, ((int)rem+5)/10);
+}
+
+static void seq_time(struct seq_file *m, s64 time)
+{
+        char num[15];
+
+        snprint_time(num, sizeof(num), time);
+        seq_printf(m, " %14s", num);
+}
+
+static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
+{
+        seq_printf(m, "%14lu", lt->nr);
+        seq_time(m, lt->min);
+        seq_time(m, lt->max);
+        seq_time(m, lt->total);
+}
+
+static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
+{
+        char name[39];
+        struct lock_class *class;
+        struct lock_class_stats *stats;
+        int i, namelen;
+
+        class = data->class;
+        stats = &data->stats;
+
+        namelen = 38;
+        if (class->name_version > 1)
+                namelen -= 2; /* XXX truncates versions > 9 */
+        if (class->subclass)
+                namelen -= 2;
+
+        if (!class->name) {
+                char str[KSYM_NAME_LEN];
+                const char *key_name;
+
+                key_name = __get_key_name(class->key, str);
+                snprintf(name, namelen, "%s", key_name);
+        } else {
+                snprintf(name, namelen, "%s", class->name);
+        }
+        namelen = strlen(name);
+        if (class->name_version > 1) {
+                snprintf(name+namelen, 3, "#%d", class->name_version);
+                namelen += 2;
+        }
+        if (class->subclass) {
+                snprintf(name+namelen, 3, "/%d", class->subclass);
+                namelen += 2;
+        }
+
+        if (stats->write_holdtime.nr) {
+                if (stats->read_holdtime.nr)
+                        seq_printf(m, "%38s-W:", name);
+                else
+                        seq_printf(m, "%40s:", name);
+
+                seq_printf(m, "%14lu ", stats->bounces[bounce_contended_write]);
+                seq_lock_time(m, &stats->write_waittime);
+                seq_printf(m, " %14lu ", stats->bounces[bounce_acquired_write]);
+                seq_lock_time(m, &stats->write_holdtime);
+                seq_puts(m, "\n");
+        }
+
+        if (stats->read_holdtime.nr) {
+                seq_printf(m, "%38s-R:", name);
+                seq_printf(m, "%14lu ", stats->bounces[bounce_contended_read]);
+                seq_lock_time(m, &stats->read_waittime);
+                seq_printf(m, " %14lu ", stats->bounces[bounce_acquired_read]);
+                seq_lock_time(m, &stats->read_holdtime);
+                seq_puts(m, "\n");
+        }
+
+        if (stats->read_waittime.nr + stats->write_waittime.nr == 0)
+                return;
+
+        if (stats->read_holdtime.nr)
+                namelen += 2;
+
+        for (i = 0; i < ARRAY_SIZE(class->contention_point); i++) {
+                char sym[KSYM_SYMBOL_LEN];
+                char ip[32];
+
+                if (class->contention_point[i] == 0)
+                        break;
+
+                if (!i)
+                        seq_line(m, '-', 40-namelen, namelen);
+
+                sprint_symbol(sym, class->contention_point[i]);
+                snprintf(ip, sizeof(ip), "[<%p>]",
+                                (void *)class->contention_point[i]);
+                seq_printf(m, "%40s %14lu %29s %s\n", name,
+                                stats->contention_point[i],
+                                ip, sym);
+        }
+        if (i) {
+                seq_puts(m, "\n");
+                seq_line(m, '.', 0, 40 + 1 + 10 * (14 + 1));
+                seq_puts(m, "\n");
+        }
+}
+
+static void seq_header(struct seq_file *m)
+{
+        seq_printf(m, "lock_stat version 0.2\n");
+        seq_line(m, '-', 0, 40 + 1 + 10 * (14 + 1));
+        seq_printf(m, "%40s %14s %14s %14s %14s %14s %14s %14s %14s "
+                        "%14s %14s\n",
+                        "class name",
+                        "con-bounces",
+                        "contentions",
+                        "waittime-min",
+                        "waittime-max",
+                        "waittime-total",
+                        "acq-bounces",
+                        "acquisitions",
+                        "holdtime-min",
+                        "holdtime-max",
+                        "holdtime-total");
+        seq_line(m, '-', 0, 40 + 1 + 10 * (14 + 1));
+        seq_printf(m, "\n");
+}
+
+static void *ls_start(struct seq_file *m, loff_t *pos)
+{
+        struct lock_stat_seq *data = m->private;
+
+        if (data->iter == data->stats)
+                seq_header(m);
+
+        if (data->iter == data->iter_end)
+                data->iter = NULL;
+
+        return data->iter;
+}
+
+static void *ls_next(struct seq_file *m, void *v, loff_t *pos)
+{
+        struct lock_stat_seq *data = m->private;
+
+        (*pos)++;
+
+        data->iter = v;
+        data->iter++;
+        if (data->iter == data->iter_end)
+                data->iter = NULL;
+
+        return data->iter;
+}
+
+static void ls_stop(struct seq_file *m, void *v)
+{
+}
+
+static int ls_show(struct seq_file *m, void *v)
+{
+        struct lock_stat_seq *data = m->private;
+
+        seq_stats(m, data->iter);
+        return 0;
+}
+
+static struct seq_operations lockstat_ops = {
+        .start  = ls_start,
+        .next   = ls_next,
+        .stop   = ls_stop,
+        .show   = ls_show,
+};
+
+static int lock_stat_open(struct inode *inode, struct file *file)
+{
+        int res;
+        struct lock_class *class;
+        struct lock_stat_seq *data = vmalloc(sizeof(struct lock_stat_seq));
+
+        if (!data)
+                return -ENOMEM;
+
+        res = seq_open(file, &lockstat_ops);
+        if (!res) {
+                struct lock_stat_data *iter = data->stats;
+                struct seq_file *m = file->private_data;
+
+                data->iter = iter;
+                list_for_each_entry(class, &all_lock_classes, lock_entry) {
+                        iter->class = class;
+                        iter->stats = lock_stats(class);
+                        iter++;
+                }
+                data->iter_end = iter;
+
+                sort(data->stats, data->iter_end - data->iter,
+                                sizeof(struct lock_stat_data),
+                                lock_stat_cmp, NULL);
+
+                m->private = data;
+        } else
+                vfree(data);
+
+        return res;
+}
+
+static ssize_t lock_stat_write(struct file *file, const char __user *buf,
+                               size_t count, loff_t *ppos)
+{
+        struct lock_class *class;
+        char c;
+
+        if (count) {
+                if (get_user(c, buf))
+                        return -EFAULT;
+
+                if (c != '0')
+                        return count;
+
+                list_for_each_entry(class, &all_lock_classes, lock_entry)
+                        clear_lock_stats(class);
+        }
+        return count;
+}
+
+static int lock_stat_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+
+        vfree(seq->private);
+        seq->private = NULL;
+        return seq_release(inode, file);
+}
+
+static const struct file_operations proc_lock_stat_operations = {
+        .open           = lock_stat_open,
+        .write          = lock_stat_write,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = lock_stat_release,
+};
+#endif /* CONFIG_LOCK_STAT */
+
 static int __init lockdep_proc_init(void)
 {
         struct proc_dir_entry *entry;
@@ -354,6 +647,12 @@ static int __init lockdep_proc_init(void)
         if (entry)
                 entry->proc_fops = &proc_lockdep_stats_operations;
 
+#ifdef CONFIG_LOCK_STAT
+        entry = create_proc_entry("lock_stat", S_IRUSR, NULL);
+        if (entry)
+                entry->proc_fops = &proc_lock_stat_operations;
+#endif
+
         return 0;
 }
 
diff --git a/kernel/module.c b/kernel/module.c
index 015d60cfd90e..33c04ad51175 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -61,10 +61,8 @@ extern int module_sysfs_initialized;
 /* If this is set, the section belongs in the init part of the module */
 #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
 
-/* Protects module list */
-static DEFINE_SPINLOCK(modlist_lock);
-
-/* List of modules, protected by module_mutex AND modlist_lock */
+/* List of modules, protected by module_mutex or preempt_disable
+ * (add/delete uses stop_machine). */
 static DEFINE_MUTEX(module_mutex);
 static LIST_HEAD(modules);
 
@@ -760,14 +758,13 @@ static void print_unload_info(struct seq_file *m, struct module *mod)
 void __symbol_put(const char *symbol)
 {
         struct module *owner;
-        unsigned long flags;
         const unsigned long *crc;
 
-        spin_lock_irqsave(&modlist_lock, flags);
+        preempt_disable();
         if (!__find_symbol(symbol, &owner, &crc, 1))
                 BUG();
         module_put(owner);
-        spin_unlock_irqrestore(&modlist_lock, flags);
+        preempt_enable();
 }
 EXPORT_SYMBOL(__symbol_put);
 
@@ -1228,14 +1225,14 @@ static void free_module(struct module *mod)
 void *__symbol_get(const char *symbol)
 {
         struct module *owner;
-        unsigned long value, flags;
+        unsigned long value;
         const unsigned long *crc;
 
-        spin_lock_irqsave(&modlist_lock, flags);
+        preempt_disable();
         value = __find_symbol(symbol, &owner, &crc, 1);
         if (value && !strong_try_module_get(owner))
                 value = 0;
-        spin_unlock_irqrestore(&modlist_lock, flags);
+        preempt_enable();
 
         return (void *)value;
 }
@@ -2136,7 +2133,7 @@ int lookup_module_symbol_name(unsigned long addr, char *symname)
                         sym = get_ksymbol(mod, addr, NULL, NULL);
                         if (!sym)
                                 goto out;
-                        strlcpy(symname, sym, KSYM_NAME_LEN + 1);
+                        strlcpy(symname, sym, KSYM_NAME_LEN);
                         mutex_unlock(&module_mutex);
                         return 0;
                 }
@@ -2161,9 +2158,9 @@ int lookup_module_symbol_attrs(unsigned long addr, unsigned long *size,
                         if (!sym)
                                 goto out;
                         if (modname)
-                                strlcpy(modname, mod->name, MODULE_NAME_LEN + 1);
+                                strlcpy(modname, mod->name, MODULE_NAME_LEN);
                         if (name)
-                                strlcpy(name, sym, KSYM_NAME_LEN + 1);
+                                strlcpy(name, sym, KSYM_NAME_LEN);
                         mutex_unlock(&module_mutex);
                         return 0;
                 }
@@ -2184,8 +2181,8 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
                         *value = mod->symtab[symnum].st_value;
                         *type = mod->symtab[symnum].st_info;
                         strlcpy(name, mod->strtab + mod->symtab[symnum].st_name,
-                                KSYM_NAME_LEN + 1);
-                        strlcpy(module_name, mod->name, MODULE_NAME_LEN + 1);
+                                KSYM_NAME_LEN);
+                        strlcpy(module_name, mod->name, MODULE_NAME_LEN);
                         *exported = is_exported(name, mod);
                         mutex_unlock(&module_mutex);
                         return 0;
@@ -2232,26 +2229,13 @@ unsigned long module_kallsyms_lookup_name(const char *name)
 /* Called by the /proc file system to return a list of modules. */
 static void *m_start(struct seq_file *m, loff_t *pos)
 {
-        struct list_head *i;
-        loff_t n = 0;
-
         mutex_lock(&module_mutex);
-        list_for_each(i, &modules) {
-                if (n++ == *pos)
-                        break;
-        }
-        if (i == &modules)
-                return NULL;
-        return i;
+        return seq_list_start(&modules, *pos);
 }
 
 static void *m_next(struct seq_file *m, void *p, loff_t *pos)
 {
-        struct list_head *i = p;
-        (*pos)++;
-        if (i->next == &modules)
-                return NULL;
-        return i->next;
+        return seq_list_next(p, &modules, pos);
 }
 
 static void m_stop(struct seq_file *m, void *p)
@@ -2321,11 +2305,10 @@ const struct seq_operations modules_op = {
 /* Given an address, look for it in the module exception tables. */
 const struct exception_table_entry *search_module_extables(unsigned long addr)
 {
-        unsigned long flags;
         const struct exception_table_entry *e = NULL;
         struct module *mod;
 
-        spin_lock_irqsave(&modlist_lock, flags);
+        preempt_disable();
         list_for_each_entry(mod, &modules, list) {
                 if (mod->num_exentries == 0)
                         continue;
@@ -2336,7 +2319,7 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
                 if (e)
                         break;
         }
-        spin_unlock_irqrestore(&modlist_lock, flags);
+        preempt_enable();
 
         /* Now, if we found one, we are running inside it now, hence
            we cannot unload the module, hence no refcnt needed. */
@@ -2348,25 +2331,24 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
  */
 int is_module_address(unsigned long addr)
 {
-        unsigned long flags;
         struct module *mod;
 
-        spin_lock_irqsave(&modlist_lock, flags);
+        preempt_disable();
 
         list_for_each_entry(mod, &modules, list) {
                 if (within(addr, mod->module_core, mod->core_size)) {
-                        spin_unlock_irqrestore(&modlist_lock, flags);
+                        preempt_enable();
                         return 1;
                 }
         }
 
-        spin_unlock_irqrestore(&modlist_lock, flags);
+        preempt_enable();
 
         return 0;
 }
 
 
-/* Is this a valid kernel address?  We don't grab the lock: we are oopsing. */
+/* Is this a valid kernel address? */
 struct module *__module_text_address(unsigned long addr)
 {
         struct module *mod;
@@ -2381,11 +2363,10 @@ struct module *__module_text_address(unsigned long addr)
 struct module *module_text_address(unsigned long addr)
 {
         struct module *mod;
-        unsigned long flags;
 
-        spin_lock_irqsave(&modlist_lock, flags);
+        preempt_disable();
         mod = __module_text_address(addr);
-        spin_unlock_irqrestore(&modlist_lock, flags);
+        preempt_enable();
 
         return mod;
 }
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 303eab18484b..691b86564dd9 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -139,6 +139,12 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass)
         list_add_tail(&waiter.list, &lock->wait_list);
         waiter.task = task;
 
+        old_val = atomic_xchg(&lock->count, -1);
+        if (old_val == 1)
+                goto done;
+
+        lock_contended(&lock->dep_map, _RET_IP_);
+
         for (;;) {
                 /*
                  * Lets try to take the lock again - this is needed even if
@@ -174,6 +180,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass)
                 spin_lock_mutex(&lock->wait_lock, flags);
         }
 
+done:
+        lock_acquired(&lock->dep_map);
         /* got the lock - rejoice! */
         mutex_remove_waiter(lock, &waiter, task_thread_info(task));
         debug_mutex_set_owner(lock, task_thread_info(task));
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 9e83b589f754..a4fb7d46971f 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -21,6 +21,8 @@
 #include <linux/utsname.h>
 #include <linux/pid_namespace.h>
 
+static struct kmem_cache *nsproxy_cachep;
+
 struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy);
 
 static inline void get_nsproxy(struct nsproxy *ns)
@@ -43,9 +45,11 @@ static inline struct nsproxy *clone_nsproxy(struct nsproxy *orig)
 {
         struct nsproxy *ns;
 
-        ns = kmemdup(orig, sizeof(struct nsproxy), GFP_KERNEL);
-        if (ns)
+        ns = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL);
+        if (ns) {
+                memcpy(ns, orig, sizeof(struct nsproxy));
                 atomic_set(&ns->count, 1);
+        }
         return ns;
 }
 
@@ -54,33 +58,51 @@ static inline struct nsproxy *clone_nsproxy(struct nsproxy *orig)
  * Return the newly created nsproxy.  Do not attach this to the task,
  * leave it to the caller to do proper locking and attach it to task.
  */
-static struct nsproxy *create_new_namespaces(int flags, struct task_struct *tsk,
-                        struct fs_struct *new_fs)
+static struct nsproxy *create_new_namespaces(unsigned long flags,
+                        struct task_struct *tsk, struct fs_struct *new_fs)
 {
         struct nsproxy *new_nsp;
+        int err;
 
         new_nsp = clone_nsproxy(tsk->nsproxy);
         if (!new_nsp)
                 return ERR_PTR(-ENOMEM);
 
         new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, new_fs);
-        if (IS_ERR(new_nsp->mnt_ns))
+        if (IS_ERR(new_nsp->mnt_ns)) {
+                err = PTR_ERR(new_nsp->mnt_ns);
                 goto out_ns;
+        }
 
         new_nsp->uts_ns = copy_utsname(flags, tsk->nsproxy->uts_ns);
-        if (IS_ERR(new_nsp->uts_ns))
+        if (IS_ERR(new_nsp->uts_ns)) {
+                err = PTR_ERR(new_nsp->uts_ns);
                 goto out_uts;
+        }
 
         new_nsp->ipc_ns = copy_ipcs(flags, tsk->nsproxy->ipc_ns);
-        if (IS_ERR(new_nsp->ipc_ns))
+        if (IS_ERR(new_nsp->ipc_ns)) {
+                err = PTR_ERR(new_nsp->ipc_ns);
                 goto out_ipc;
+        }
 
         new_nsp->pid_ns = copy_pid_ns(flags, tsk->nsproxy->pid_ns);
-        if (IS_ERR(new_nsp->pid_ns))
+        if (IS_ERR(new_nsp->pid_ns)) {
+                err = PTR_ERR(new_nsp->pid_ns);
                 goto out_pid;
+        }
+
+        new_nsp->user_ns = copy_user_ns(flags, tsk->nsproxy->user_ns);
+        if (IS_ERR(new_nsp->user_ns)) {
+                err = PTR_ERR(new_nsp->user_ns);
+                goto out_user;
+        }
 
         return new_nsp;
 
+out_user:
+        if (new_nsp->pid_ns)
+                put_pid_ns(new_nsp->pid_ns);
 out_pid:
         if (new_nsp->ipc_ns)
                 put_ipc_ns(new_nsp->ipc_ns);
@@ -91,15 +113,15 @@ out_uts:
         if (new_nsp->mnt_ns)
                 put_mnt_ns(new_nsp->mnt_ns);
 out_ns:
-        kfree(new_nsp);
-        return ERR_PTR(-ENOMEM);
+        kmem_cache_free(nsproxy_cachep, new_nsp);
+        return ERR_PTR(err);
 }
 
 /*
  * called from clone.  This now handles copy for nsproxy and all
  * namespaces therein.
  */
-int copy_namespaces(int flags, struct task_struct *tsk)
+int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 {
         struct nsproxy *old_ns = tsk->nsproxy;
         struct nsproxy *new_ns;
@@ -110,7 +132,7 @@ int copy_namespaces(int flags, struct task_struct *tsk)
 
         get_nsproxy(old_ns);
 
-        if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC)))
+        if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER)))
                 return 0;
 
         if (!capable(CAP_SYS_ADMIN)) {
@@ -140,7 +162,9 @@ void free_nsproxy(struct nsproxy *ns)
                 put_ipc_ns(ns->ipc_ns);
         if (ns->pid_ns)
                 put_pid_ns(ns->pid_ns);
-        kfree(ns);
+        if (ns->user_ns)
+                put_user_ns(ns->user_ns);
+        kmem_cache_free(nsproxy_cachep, ns);
 }
 
 /*
@@ -152,19 +176,10 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
 {
         int err = 0;
 
-        if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC)))
+        if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
+                               CLONE_NEWUSER)))
                 return 0;
 
-#ifndef CONFIG_IPC_NS
-        if (unshare_flags & CLONE_NEWIPC)
-                return -EINVAL;
-#endif
-
-#ifndef CONFIG_UTS_NS
-        if (unshare_flags & CLONE_NEWUTS)
-                return -EINVAL;
-#endif
-
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
@@ -174,3 +189,12 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
                 err = PTR_ERR(*new_nsp);
         return err;
 }
+
+static int __init nsproxy_cache_init(void)
+{
+        nsproxy_cachep = kmem_cache_create("nsproxy", sizeof(struct nsproxy),
+                                           0, SLAB_PANIC, NULL);
+        return 0;
+}
+
+module_init(nsproxy_cache_init);
diff --git a/kernel/panic.c b/kernel/panic.c
index 623d1828259a..f64f4c1ac11f 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -159,14 +159,15 @@ const char *print_tainted(void)
 {
         static char buf[20];
         if (tainted) {
-                snprintf(buf, sizeof(buf), "Tainted: %c%c%c%c%c%c%c",
+                snprintf(buf, sizeof(buf), "Tainted: %c%c%c%c%c%c%c%c",
                         tainted & TAINT_PROPRIETARY_MODULE ? 'P' : 'G',
                         tainted & TAINT_FORCED_MODULE ? 'F' : ' ',
                         tainted & TAINT_UNSAFE_SMP ? 'S' : ' ',
                         tainted & TAINT_FORCED_RMMOD ? 'R' : ' ',
                         tainted & TAINT_MACHINE_CHECK ? 'M' : ' ',
                         tainted & TAINT_BAD_PAGE ? 'B' : ' ',
-                        tainted & TAINT_USER ? 'U' : ' ');
+                        tainted & TAINT_USER ? 'U' : ' ',
+                        tainted & TAINT_DIE ? 'D' : ' ');
         }
         else
                 snprintf(buf, sizeof(buf), "Not tainted");
diff --git a/kernel/pid.c b/kernel/pid.c
index eb66bd2953ab..c6e3f9ffff87 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -365,7 +365,7 @@ struct pid *find_ge_pid(int nr)
 }
 EXPORT_SYMBOL_GPL(find_get_pid);
 
-struct pid_namespace *copy_pid_ns(int flags, struct pid_namespace *old_ns)
+struct pid_namespace *copy_pid_ns(unsigned long flags, struct pid_namespace *old_ns)
 {
         BUG_ON(!old_ns);
         get_pid_ns(old_ns);
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 329ce0172074..55b3761edaa9 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -241,7 +241,7 @@ static __init int init_posix_timers(void)
         register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
 
         posix_timers_cache = kmem_cache_create("posix_timers_cache",
-                                        sizeof (struct k_itimer), 0, 0, NULL, NULL);
+                                        sizeof (struct k_itimer), 0, 0, NULL);
         idr_init(&posix_timers_id);
         return 0;
 }
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 495b7d4dd330..c1a106d87d90 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -33,13 +33,20 @@ config PM_DEBUG
         bool "Power Management Debug Support"
         depends on PM
         ---help---
-        This option enables verbose debugging support in the Power Management
-        code. This is helpful when debugging and reporting various PM bugs, 
-        like suspend support.
+        This option enables various debugging support in the Power Management
+        code. This is helpful when debugging and reporting PM bugs, like
+        suspend support.
+
+config PM_VERBOSE
+        bool "Verbose Power Management debugging"
+        depends on PM_DEBUG
+        default n
+        ---help---
+        This option enables verbose messages from the Power Management code.
 
 config DISABLE_CONSOLE_SUSPEND
         bool "Keep console(s) enabled during suspend/resume (DANGEROUS)"
-        depends on PM && PM_DEBUG
+        depends on PM_DEBUG
         default n
         ---help---
         This option turns off the console suspend mechanism that prevents
@@ -50,7 +57,7 @@ config DISABLE_CONSOLE_SUSPEND
 
 config PM_TRACE
         bool "Suspend/resume event tracing"
-        depends on PM && PM_DEBUG && X86_32 && EXPERIMENTAL
+        depends on PM_DEBUG && X86 && EXPERIMENTAL
         default n
         ---help---
         This enables some cheesy code to save the last PM event point in the
@@ -65,18 +72,6 @@ config PM_TRACE
         CAUTION: this option will cause your machine's real-time clock to be
         set to an invalid time after a resume.
 
-config PM_SYSFS_DEPRECATED
-        bool "Driver model /sys/devices/.../power/state files (DEPRECATED)"
-        depends on PM && SYSFS
-        default n
-        help
-          The driver model started out with a sysfs file intended to provide
-          a userspace hook for device power management.  This feature has never
-          worked very well, except for limited testing purposes, and so it will
-          be removed.   It's not clear that a generic mechanism could really
-          handle the wide variability of device power states; any replacements
-          are likely to be bus or driver specific.
-
 config SOFTWARE_SUSPEND
         bool "Software Suspend (Hibernation)"
         depends on PM && SWAP && (((X86 || PPC64_SWSUSP) && (!SMP || SUSPEND_SMP)) || ((FRV || PPC32) && !SMP))
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index f445b9cd60fb..324ac0188ce1 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -45,7 +45,7 @@ enum {
 
 static int hibernation_mode = HIBERNATION_SHUTDOWN;
 
-struct hibernation_ops *hibernation_ops;
+static struct hibernation_ops *hibernation_ops;
 
 /**
  * hibernation_set_ops - set the global hibernate operations
@@ -54,7 +54,8 @@ struct hibernation_ops *hibernation_ops;
 
 void hibernation_set_ops(struct hibernation_ops *ops)
 {
-        if (ops && !(ops->prepare && ops->enter && ops->finish)) {
+        if (ops && !(ops->prepare && ops->enter && ops->finish
+            && ops->pre_restore && ops->restore_cleanup)) {
                 WARN_ON(1);
                 return;
         }
@@ -74,9 +75,9 @@ void hibernation_set_ops(struct hibernation_ops *ops)
  *      platform driver if so configured and return an error code if it fails
  */
 
-static int platform_prepare(void)
+static int platform_prepare(int platform_mode)
 {
-        return (hibernation_mode == HIBERNATION_PLATFORM && hibernation_ops) ?
+        return (platform_mode && hibernation_ops) ?
                 hibernation_ops->prepare() : 0;
 }
 
@@ -85,13 +86,145 @@ static int platform_prepare(void)
  *      using the platform driver (must be called after platform_prepare())
  */
 
-static void platform_finish(void)
+static void platform_finish(int platform_mode)
 {
-        if (hibernation_mode == HIBERNATION_PLATFORM && hibernation_ops)
+        if (platform_mode && hibernation_ops)
                 hibernation_ops->finish();
 }
 
 /**
+ *      platform_pre_restore - prepare the platform for the restoration from a
+ *      hibernation image.  If the restore fails after this function has been
+ *      called, platform_restore_cleanup() must be called.
+ */
+
+static int platform_pre_restore(int platform_mode)
+{
+        return (platform_mode && hibernation_ops) ?
+                hibernation_ops->pre_restore() : 0;
+}
+
+/**
+ *      platform_restore_cleanup - switch the platform to the normal mode of
+ *      operation after a failing restore.  If platform_pre_restore() has been
+ *      called before the failing restore, this function must be called too,
+ *      regardless of the result of platform_pre_restore().
+ */
+
+static void platform_restore_cleanup(int platform_mode)
+{
+        if (platform_mode && hibernation_ops)
+                hibernation_ops->restore_cleanup();
+}
+
+/**
+ *      hibernation_snapshot - quiesce devices and create the hibernation
+ *      snapshot image.
+ *      @platform_mode - if set, use the platform driver, if available, to
+ *                       prepare the platform frimware for the power transition.
+ *
+ *      Must be called with pm_mutex held
+ */
+
+int hibernation_snapshot(int platform_mode)
+{
+        int error;
+
+        /* Free memory before shutting down devices. */
+        error = swsusp_shrink_memory();
+        if (error)
+                return error;
+
+        suspend_console();
+        error = device_suspend(PMSG_FREEZE);
+        if (error)
+                goto Resume_console;
+
+        error = platform_prepare(platform_mode);
+        if (error)
+                goto Resume_devices;
+
+        error = disable_nonboot_cpus();
+        if (!error) {
+                if (hibernation_mode != HIBERNATION_TEST) {
+                        in_suspend = 1;
+                        error = swsusp_suspend();
+                        /* Control returns here after successful restore */
+                } else {
+                        printk("swsusp debug: Waiting for 5 seconds.\n");
+                        mdelay(5000);
+                }
+        }
+        enable_nonboot_cpus();
+ Resume_devices:
+        platform_finish(platform_mode);
+        device_resume();
+ Resume_console:
+        resume_console();
+        return error;
+}
+
+/**
+ *      hibernation_restore - quiesce devices and restore the hibernation
+ *      snapshot image.  If successful, control returns in hibernation_snaphot()
+ *      @platform_mode - if set, use the platform driver, if available, to
+ *                       prepare the platform frimware for the transition.
+ *
+ *      Must be called with pm_mutex held
+ */
+
+int hibernation_restore(int platform_mode)
+{
+        int error;
+
+        pm_prepare_console();
+        suspend_console();
+        error = device_suspend(PMSG_PRETHAW);
+        if (error)
+                goto Finish;
+
+        error = platform_pre_restore(platform_mode);
+        if (!error) {
+                error = disable_nonboot_cpus();
+                if (!error)
+                        error = swsusp_resume();
+                enable_nonboot_cpus();
+        }
+        platform_restore_cleanup(platform_mode);
+        device_resume();
+ Finish:
+        resume_console();
+        pm_restore_console();
+        return error;
+}
+
+/**
+ *      hibernation_platform_enter - enter the hibernation state using the
+ *      platform driver (if available)
+ */
+
+int hibernation_platform_enter(void)
+{
+        int error;
+
+        if (hibernation_ops) {
+                kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
+                /*
+                 * We have cancelled the power transition by running
+                 * hibernation_ops->finish() before saving the image, so we
+                 * should let the firmware know that we're going to enter the
+                 * sleep state after all
+                 */
+                error = hibernation_ops->prepare();
+                if (!error)
+                        error = hibernation_ops->enter();
+        } else {
+                error = -ENOSYS;
+        }
+        return error;
+}
+
+/**
  *      power_down - Shut the machine down for hibernation.
  *
  *      Use the platform driver, if configured so; otherwise try
@@ -111,11 +244,7 @@ static void power_down(void)
                 kernel_restart(NULL);
                 break;
         case HIBERNATION_PLATFORM:
-                if (hibernation_ops) {
-                        kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
-                        hibernation_ops->enter();
-                        break;
-                }
+                hibernation_platform_enter();
         }
         kernel_halt();
         /*
@@ -152,9 +281,16 @@ int hibernate(void)
 {
         int error;
 
+        mutex_lock(&pm_mutex);
         /* The snapshot device should not be opened while we're running */
-        if (!atomic_add_unless(&snapshot_device_available, -1, 0))
-                return -EBUSY;
+        if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
+                error = -EBUSY;
+                goto Unlock;
+        }
+
+        error = pm_notifier_call_chain(PM_HIBERNATION_PREPARE);
+        if (error)
+                goto Exit;
 
         /* Allocate memory management structures */
         error = create_basic_memory_bitmaps();
@@ -165,75 +301,35 @@ int hibernate(void)
         if (error)
                 goto Finish;
 
-        mutex_lock(&pm_mutex);
         if (hibernation_mode == HIBERNATION_TESTPROC) {
                 printk("swsusp debug: Waiting for 5 seconds.\n");
                 mdelay(5000);
                 goto Thaw;
         }
+        error = hibernation_snapshot(hibernation_mode == HIBERNATION_PLATFORM);
+        if (in_suspend && !error) {
+                unsigned int flags = 0;
 
-        /* Free memory before shutting down devices. */
-        error = swsusp_shrink_memory();
-        if (error)
-                goto Thaw;
-
-        error = platform_prepare();
-        if (error)
-                goto Thaw;
-
-        suspend_console();
-        error = device_suspend(PMSG_FREEZE);
-        if (error) {
-                printk(KERN_ERR "PM: Some devices failed to suspend\n");
-                goto Resume_devices;
-        }
-        error = disable_nonboot_cpus();
-        if (error)
-                goto Enable_cpus;
-
-        if (hibernation_mode == HIBERNATION_TEST) {
-                printk("swsusp debug: Waiting for 5 seconds.\n");
-                mdelay(5000);
-                goto Enable_cpus;
-        }
-
-        pr_debug("PM: snapshotting memory.\n");
-        in_suspend = 1;
-        error = swsusp_suspend();
-        if (error)
-                goto Enable_cpus;
-
-        if (in_suspend) {
-                enable_nonboot_cpus();
-                platform_finish();
-                device_resume();
-                resume_console();
+                if (hibernation_mode == HIBERNATION_PLATFORM)
+                        flags |= SF_PLATFORM_MODE;
                 pr_debug("PM: writing image.\n");
-                error = swsusp_write();
+                error = swsusp_write(flags);
+                swsusp_free();
                 if (!error)
                         power_down();
-                else {
-                        swsusp_free();
-                        goto Thaw;
-                }
         } else {
                 pr_debug("PM: Image restored successfully.\n");
+                swsusp_free();
         }
-
-        swsusp_free();
- Enable_cpus:
-        enable_nonboot_cpus();
- Resume_devices:
-        platform_finish();
-        device_resume();
-        resume_console();
  Thaw:
-        mutex_unlock(&pm_mutex);
         unprepare_processes();
  Finish:
         free_basic_memory_bitmaps();
  Exit:
+        pm_notifier_call_chain(PM_POST_HIBERNATION);
         atomic_inc(&snapshot_device_available);
+ Unlock:
+        mutex_unlock(&pm_mutex);
         return error;
 }
 
@@ -253,6 +349,7 @@ int hibernate(void)
 static int software_resume(void)
 {
         int error;
+        unsigned int flags;
 
         mutex_lock(&pm_mutex);
         if (!swsusp_resume_device) {
@@ -300,30 +397,12 @@ static int software_resume(void)
 
         pr_debug("PM: Reading swsusp image.\n");
 
-        error = swsusp_read();
-        if (error) {
-                swsusp_free();
-                goto Thaw;
-        }
-
-        pr_debug("PM: Preparing devices for restore.\n");
-
-        suspend_console();
-        error = device_suspend(PMSG_PRETHAW);
-        if (error)
-                goto Free;
-
-        error = disable_nonboot_cpus();
+        error = swsusp_read(&flags);
         if (!error)
-                swsusp_resume();
+                hibernation_restore(flags & SF_PLATFORM_MODE);
 
-        enable_nonboot_cpus();
- Free:
-        swsusp_free();
-        device_resume();
-        resume_console();
- Thaw:
         printk(KERN_ERR "PM: Restore failed, recovering.\n");
+        swsusp_free();
         unprepare_processes();
  Done:
         free_basic_memory_bitmaps();
@@ -333,7 +412,7 @@ static int software_resume(void)
  Unlock:
         mutex_unlock(&pm_mutex);
         pr_debug("PM: Resume from disk failed.\n");
-        return 0;
+        return error;
 }
 
 late_initcall(software_resume);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index fc45ed22620f..32147b57c3bf 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -23,6 +23,8 @@
 
 #include "power.h"
 
+BLOCKING_NOTIFIER_HEAD(pm_chain_head);
+
 /*This is just an arbitrary number */
 #define FREE_PAGE_NUMBER (100)
 
@@ -63,14 +65,11 @@ static inline void pm_finish(suspend_state_t state)
 
 /**
  *      suspend_prepare - Do prep work before entering low-power state.
- *      @state:         State we're entering.
  *
- *      This is common code that is called for each state that we're 
- *      entering. Allocate a console, stop all processes, then make sure
- *      the platform can enter the requested state.
+ *      This is common code that is called for each state that we're entering.
+ *      Run suspend notifiers, allocate a console and stop all processes.
  */
-
-static int suspend_prepare(suspend_state_t state)
+static int suspend_prepare(void)
 {
         int error;
         unsigned int free_pages;
@@ -78,6 +77,10 @@ static int suspend_prepare(suspend_state_t state)
         if (!pm_ops || !pm_ops->enter)
                 return -EPERM;
 
+        error = pm_notifier_call_chain(PM_SUSPEND_PREPARE);
+        if (error)
+                goto Finish;
+
         pm_prepare_console();
 
         if (freeze_processes()) {
@@ -85,46 +88,23 @@ static int suspend_prepare(suspend_state_t state)
                 goto Thaw;
         }
 
-        if ((free_pages = global_page_state(NR_FREE_PAGES))
-                        < FREE_PAGE_NUMBER) {
+        free_pages = global_page_state(NR_FREE_PAGES);
+        if (free_pages < FREE_PAGE_NUMBER) {
                 pr_debug("PM: free some memory\n");
                 shrink_all_memory(FREE_PAGE_NUMBER - free_pages);
                 if (nr_free_pages() < FREE_PAGE_NUMBER) {
                         error = -ENOMEM;
                         printk(KERN_ERR "PM: No enough memory\n");
-                        goto Thaw;
                 }
         }
-
-        if (pm_ops->set_target) {
-                error = pm_ops->set_target(state);
-                if (error)
-                        goto Thaw;
-        }
-        suspend_console();
-        error = device_suspend(PMSG_SUSPEND);
-        if (error) {
-                printk(KERN_ERR "Some devices failed to suspend\n");
-                goto Resume_console;
-        }
-        if (pm_ops->prepare) {
-                if ((error = pm_ops->prepare(state)))
-                        goto Resume_devices;
-        }
-
-        error = disable_nonboot_cpus();
         if (!error)
                 return 0;
 
-        enable_nonboot_cpus();
-        pm_finish(state);
- Resume_devices:
-        device_resume();
- Resume_console:
-        resume_console();
  Thaw:
         thaw_processes();
         pm_restore_console();
+ Finish:
+        pm_notifier_call_chain(PM_POST_SUSPEND);
         return error;
 }
 
@@ -140,6 +120,12 @@ void __attribute__ ((weak)) arch_suspend_enable_irqs(void)
         local_irq_enable();
 }
 
+/**
+ *      suspend_enter - enter the desired system sleep state.
+ *      @state:         state to enter
+ *
+ *      This function should be called after devices have been suspended.
+ */
 int suspend_enter(suspend_state_t state)
 {
         int error = 0;
@@ -159,23 +145,58 @@ int suspend_enter(suspend_state_t state)
         return error;
 }
 
+/**
+ *      suspend_devices_and_enter - suspend devices and enter the desired system sleep
+ *                        state.
+ *      @state:           state to enter
+ */
+int suspend_devices_and_enter(suspend_state_t state)
+{
+        int error;
+
+        if (!pm_ops)
+                return -ENOSYS;
+
+        if (pm_ops->set_target) {
+                error = pm_ops->set_target(state);
+                if (error)
+                        return error;
+        }
+        suspend_console();
+        error = device_suspend(PMSG_SUSPEND);
+        if (error) {
+                printk(KERN_ERR "Some devices failed to suspend\n");
+                goto Resume_console;
+        }
+        if (pm_ops->prepare) {
+                error = pm_ops->prepare(state);
+                if (error)
+                        goto Resume_devices;
+        }
+        error = disable_nonboot_cpus();
+        if (!error)
+                suspend_enter(state);
+
+        enable_nonboot_cpus();
+        pm_finish(state);
+ Resume_devices:
+        device_resume();
+ Resume_console:
+        resume_console();
+        return error;
+}
 
 /**
  *      suspend_finish - Do final work before exiting suspend sequence.
- *      @state:         State we're coming out of.
  *
  *      Call platform code to clean up, restart processes, and free the 
  *      console that we've allocated. This is not called for suspend-to-disk.
  */
-
-static void suspend_finish(suspend_state_t state)
+static void suspend_finish(void)
 {
-        enable_nonboot_cpus();
-        pm_finish(state);
-        device_resume();
-        resume_console();
         thaw_processes();
         pm_restore_console();
+        pm_notifier_call_chain(PM_POST_SUSPEND);
 }
 
 
@@ -207,7 +228,6 @@ static inline int valid_state(suspend_state_t state)
  *      Then, do the setup for suspend, enter the state, and cleaup (after
  *      we've woken up).
  */
-
 static int enter_state(suspend_state_t state)
 {
         int error;
@@ -218,14 +238,14 @@ static int enter_state(suspend_state_t state)
                 return -EBUSY;
 
         pr_debug("PM: Preparing system for %s sleep\n", pm_states[state]);
-        if ((error = suspend_prepare(state)))
+        if ((error = suspend_prepare()))
                 goto Unlock;
 
         pr_debug("PM: Entering %s sleep\n", pm_states[state]);
-        error = suspend_enter(state);
+        error = suspend_devices_and_enter(state);
 
         pr_debug("PM: Finishing wakeup.\n");
-        suspend_finish(state);
+        suspend_finish();
  Unlock:
         mutex_unlock(&pm_mutex);
         return error;
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 51381487103f..5f24c786f8ec 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -25,7 +25,10 @@ struct swsusp_info {
  */
 #define SPARE_PAGES     ((1024 * 1024) >> PAGE_SHIFT)
 
-extern struct hibernation_ops *hibernation_ops;
+/* kernel/power/disk.c */
+extern int hibernation_snapshot(int platform_mode);
+extern int hibernation_restore(int platform_mode);
+extern int hibernation_platform_enter(void);
 #endif
 
 extern int pfn_is_nosave(unsigned long);
@@ -152,16 +155,34 @@ extern sector_t alloc_swapdev_block(int swap);
 extern void free_all_swap_pages(int swap);
 extern int swsusp_swap_in_use(void);
 
+/*
+ * Flags that can be passed from the hibernatig hernel to the "boot" kernel in
+ * the image header.
+ */
+#define SF_PLATFORM_MODE        1
+
+/* kernel/power/disk.c */
 extern int swsusp_check(void);
 extern int swsusp_shrink_memory(void);
 extern void swsusp_free(void);
 extern int swsusp_suspend(void);
 extern int swsusp_resume(void);
-extern int swsusp_read(void);
-extern int swsusp_write(void);
+extern int swsusp_read(unsigned int *flags_p);
+extern int swsusp_write(unsigned int flags);
 extern void swsusp_close(void);
-extern int suspend_enter(suspend_state_t state);
 
 struct timeval;
+/* kernel/power/swsusp.c */
 extern void swsusp_show_speed(struct timeval *, struct timeval *,
                                 unsigned int, char *);
+
+/* kernel/power/main.c */
+extern int suspend_enter(suspend_state_t state);
+extern int suspend_devices_and_enter(suspend_state_t state);
+extern struct blocking_notifier_head pm_chain_head;
+
+static inline int pm_notifier_call_chain(unsigned long val)
+{
+        return (blocking_notifier_call_chain(&pm_chain_head, val, NULL)
+                        == NOTIFY_BAD) ? -EINVAL : 0;
+}
diff --git a/kernel/power/process.c b/kernel/power/process.c
index e0233d8422b9..3434940a3df1 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -40,7 +40,7 @@ static inline void frozen_process(void)
                 current->flags |= PF_FROZEN;
                 wmb();
         }
-        clear_tsk_thread_flag(current, TIF_FREEZE);
+        clear_freeze_flag(current);
 }
 
 /* Refrigerator is place where frozen processes are stored :-). */
@@ -72,20 +72,19 @@ void refrigerator(void)
                 schedule();
         }
         pr_debug("%s left refrigerator\n", current->comm);
-        current->state = save;
+        __set_current_state(save);
 }
 
-static inline void freeze_process(struct task_struct *p)
+static void freeze_task(struct task_struct *p)
 {
         unsigned long flags;
 
         if (!freezing(p)) {
                 rmb();
                 if (!frozen(p)) {
+                        set_freeze_flag(p);
                         if (p->state == TASK_STOPPED)
                                 force_sig_specific(SIGSTOP, p);
-
-                        freeze(p);
                         spin_lock_irqsave(&p->sighand->siglock, flags);
                         signal_wake_up(p, p->state == TASK_STOPPED);
                         spin_unlock_irqrestore(&p->sighand->siglock, flags);
@@ -99,19 +98,14 @@ static void cancel_freezing(struct task_struct *p)
 
         if (freezing(p)) {
                 pr_debug("  clean up: %s\n", p->comm);
-                do_not_freeze(p);
+                clear_freeze_flag(p);
                 spin_lock_irqsave(&p->sighand->siglock, flags);
                 recalc_sigpending_and_wake(p);
                 spin_unlock_irqrestore(&p->sighand->siglock, flags);
         }
 }
 
-static inline int is_user_space(struct task_struct *p)
-{
-        return p->mm && !(p->flags & PF_BORROWED_MM);
-}
-
-static unsigned int try_to_freeze_tasks(int freeze_user_space)
+static int try_to_freeze_tasks(int freeze_user_space)
 {
         struct task_struct *g, *p;
         unsigned long end_time;
@@ -122,26 +116,40 @@ static unsigned int try_to_freeze_tasks(int freeze_user_space)
                 todo = 0;
                 read_lock(&tasklist_lock);
                 do_each_thread(g, p) {
-                        if (!freezeable(p))
+                        if (frozen(p) || !freezeable(p))
                                 continue;
 
-                        if (frozen(p))
-                                continue;
-
-                        if (p->state == TASK_TRACED && frozen(p->parent)) {
-                                cancel_freezing(p);
-                                continue;
+                        if (freeze_user_space) {
+                                if (p->state == TASK_TRACED &&
+                                    frozen(p->parent)) {
+                                        cancel_freezing(p);
+                                        continue;
+                                }
+                                /*
+                                 * Kernel threads should not have TIF_FREEZE set
+                                 * at this point, so we must ensure that either
+                                 * p->mm is not NULL *and* PF_BORROWED_MM is
+                                 * unset, or TIF_FRREZE is left unset.
+                                 * The task_lock() is necessary to prevent races
+                                 * with exit_mm() or use_mm()/unuse_mm() from
+                                 * occuring.
+                                 */
+                                task_lock(p);
+                                if (!p->mm || (p->flags & PF_BORROWED_MM)) {
+                                        task_unlock(p);
+                                        continue;
+                                }
+                                freeze_task(p);
+                                task_unlock(p);
+                        } else {
+                                freeze_task(p);
                         }
-                        if (freeze_user_space && !is_user_space(p))
-                                continue;
-
-                        freeze_process(p);
                         if (!freezer_should_skip(p))
                                 todo++;
                 } while_each_thread(g, p);
                 read_unlock(&tasklist_lock);
                 yield();                        /* Yield is okay here */
-                if (todo && time_after(jiffies, end_time))
+                if (time_after(jiffies, end_time))
                         break;
         } while (todo);
 
@@ -152,49 +160,41 @@ static unsigned int try_to_freeze_tasks(int freeze_user_space)
                  * but it cleans up leftover PF_FREEZE requests.
                  */
                 printk("\n");
-                printk(KERN_ERR "Stopping %s timed out after %d seconds "
+                printk(KERN_ERR "Freezing of %s timed out after %d seconds "
                                 "(%d tasks refusing to freeze):\n",
-                                freeze_user_space ? "user space processes" :
-                                        "kernel threads",
+                                freeze_user_space ? "user space " : "tasks ",
                                 TIMEOUT / HZ, todo);
+                show_state();
                 read_lock(&tasklist_lock);
                 do_each_thread(g, p) {
-                        if (freeze_user_space && !is_user_space(p))
-                                continue;
-
                         task_lock(p);
-                        if (freezeable(p) && !frozen(p) &&
-                            !freezer_should_skip(p))
+                        if (freezing(p) && !freezer_should_skip(p))
                                 printk(KERN_ERR " %s\n", p->comm);
-
                         cancel_freezing(p);
                         task_unlock(p);
                 } while_each_thread(g, p);
                 read_unlock(&tasklist_lock);
         }
 
-        return todo;
+        return todo ? -EBUSY : 0;
 }
 
 /**
  *      freeze_processes - tell processes to enter the refrigerator
- *
- *      Returns 0 on success, or the number of processes that didn't freeze,
- *      although they were told to.
  */
 int freeze_processes(void)
 {
-        unsigned int nr_unfrozen;
+        int error;
 
         printk("Stopping tasks ... ");
-        nr_unfrozen = try_to_freeze_tasks(FREEZER_USER_SPACE);
-        if (nr_unfrozen)
-                return nr_unfrozen;
+        error = try_to_freeze_tasks(FREEZER_USER_SPACE);
+        if (error)
+                return error;
 
         sys_sync();
-        nr_unfrozen = try_to_freeze_tasks(FREEZER_KERNEL_THREADS);
-        if (nr_unfrozen)
-                return nr_unfrozen;
+        error = try_to_freeze_tasks(FREEZER_KERNEL_THREADS);
+        if (error)
+                return error;
 
         printk("done.\n");
         BUG_ON(in_atomic());
@@ -210,7 +210,7 @@ static void thaw_tasks(int thaw_user_space)
                 if (!freezeable(p))
                         continue;
 
-                if (is_user_space(p) == !thaw_user_space)
+                if (!p->mm == thaw_user_space)
                         continue;
 
                 thaw_process(p);
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 8b1a1b837145..917aba100575 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -33,8 +33,9 @@ extern char resume_file[];
 #define SWSUSP_SIG      "S1SUSPEND"
 
 struct swsusp_header {
-        char reserved[PAGE_SIZE - 20 - sizeof(sector_t)];
+        char reserved[PAGE_SIZE - 20 - sizeof(sector_t) - sizeof(int)];
         sector_t image;
+        unsigned int flags;     /* Flags to pass to the "boot" kernel */
         char    orig_sig[10];
         char    sig[10];
 } __attribute__((packed));
@@ -138,7 +139,7 @@ static int wait_on_bio_chain(struct bio **bio_chain)
  * Saving part
  */
 
-static int mark_swapfiles(sector_t start)
+static int mark_swapfiles(sector_t start, unsigned int flags)
 {
         int error;
 
@@ -148,6 +149,7 @@ static int mark_swapfiles(sector_t start)
                 memcpy(swsusp_header->orig_sig,swsusp_header->sig, 10);
                 memcpy(swsusp_header->sig,SWSUSP_SIG, 10);
                 swsusp_header->image = start;
+                swsusp_header->flags = flags;
                 error = bio_write_page(swsusp_resume_block,
                                         swsusp_header, NULL);
         } else {
@@ -369,6 +371,7 @@ static int enough_swap(unsigned int nr_pages)
 
 /**
  *      swsusp_write - Write entire image and metadata.
+ *      @flags: flags to pass to the "boot" kernel in the image header
  *
  *      It is important _NOT_ to umount filesystems at this point. We want
  *      them synced (in case something goes wrong) but we DO not want to mark
@@ -376,7 +379,7 @@ static int enough_swap(unsigned int nr_pages)
  *      correctly, we'll mark system clean, anyway.)
  */
 
-int swsusp_write(void)
+int swsusp_write(unsigned int flags)
 {
         struct swap_map_handle handle;
         struct snapshot_handle snapshot;
@@ -415,7 +418,7 @@ int swsusp_write(void)
                 if (!error) {
                         flush_swap_writer(&handle);
                         printk("S");
-                        error = mark_swapfiles(start);
+                        error = mark_swapfiles(start, flags);
                         printk("|\n");
                 }
         }
@@ -540,13 +543,20 @@ static int load_image(struct swap_map_handle *handle,
         return error;
 }
 
-int swsusp_read(void)
+/**
+ *      swsusp_read - read the hibernation image.
+ *      @flags_p: flags passed by the "frozen" kernel in the image header should
+ *                be written into this memeory location
+ */
+
+int swsusp_read(unsigned int *flags_p)
 {
         int error;
         struct swap_map_handle handle;
         struct snapshot_handle snapshot;
         struct swsusp_info *header;
 
+        *flags_p = swsusp_header->flags;
         if (IS_ERR(resume_bdev)) {
                 pr_debug("swsusp: block device not initialised\n");
                 return PTR_ERR(resume_bdev);
diff --git a/kernel/power/user.c b/kernel/power/user.c
index d65305b515b1..bd0723a7df3f 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -128,92 +128,6 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf,
         return res;
 }
 
-static inline int platform_prepare(void)
-{
-        int error = 0;
-
-        if (hibernation_ops)
-                error = hibernation_ops->prepare();
-
-        return error;
-}
-
-static inline void platform_finish(void)
-{
-        if (hibernation_ops)
-                hibernation_ops->finish();
-}
-
-static inline int snapshot_suspend(int platform_suspend)
-{
-        int error;
-
-        mutex_lock(&pm_mutex);
-        /* Free memory before shutting down devices. */
-        error = swsusp_shrink_memory();
-        if (error)
-                goto Finish;
-
-        if (platform_suspend) {
-                error = platform_prepare();
-                if (error)
-                        goto Finish;
-        }
-        suspend_console();
-        error = device_suspend(PMSG_FREEZE);
-        if (error)
-                goto Resume_devices;
-
-        error = disable_nonboot_cpus();
-        if (!error) {
-                in_suspend = 1;
-                error = swsusp_suspend();
-        }
-        enable_nonboot_cpus();
- Resume_devices:
-        if (platform_suspend)
-                platform_finish();
-
-        device_resume();
-        resume_console();
- Finish:
-        mutex_unlock(&pm_mutex);
-        return error;
-}
-
-static inline int snapshot_restore(int platform_suspend)
-{
-        int error;
-
-        mutex_lock(&pm_mutex);
-        pm_prepare_console();
-        if (platform_suspend) {
-                error = platform_prepare();
-                if (error)
-                        goto Finish;
-        }
-        suspend_console();
-        error = device_suspend(PMSG_PRETHAW);
-        if (error)
-                goto Resume_devices;
-
-        error = disable_nonboot_cpus();
-        if (!error)
-                error = swsusp_resume();
-
-        enable_nonboot_cpus();
- Resume_devices:
-        if (platform_suspend)
-                platform_finish();
-
-        device_resume();
-        resume_console();
- Finish:
-        pm_restore_console();
-        mutex_unlock(&pm_mutex);
-        return error;
-}
-
 static int snapshot_ioctl(struct inode *inode, struct file *filp,
                           unsigned int cmd, unsigned long arg)
 {
@@ -237,10 +151,14 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 if (data->frozen)
                         break;
                 mutex_lock(&pm_mutex);
-                if (freeze_processes()) {
-                        thaw_processes();
-                        error = -EBUSY;
+                error = pm_notifier_call_chain(PM_HIBERNATION_PREPARE);
+                if (!error) {
+                        error = freeze_processes();
+                        if (error)
+                                thaw_processes();
                 }
+                if (error)
+                        pm_notifier_call_chain(PM_POST_HIBERNATION);
                 mutex_unlock(&pm_mutex);
                 if (!error)
                         data->frozen = 1;
@@ -251,6 +169,7 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                         break;
                 mutex_lock(&pm_mutex);
                 thaw_processes();
+                pm_notifier_call_chain(PM_POST_HIBERNATION);
                 mutex_unlock(&pm_mutex);
                 data->frozen = 0;
                 break;
@@ -260,7 +179,7 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                         error = -EPERM;
                         break;
                 }
-                error = snapshot_suspend(data->platform_suspend);
+                error = hibernation_snapshot(data->platform_suspend);
                 if (!error)
                         error = put_user(in_suspend, (unsigned int __user *)arg);
                 if (!error)
@@ -274,7 +193,7 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                         error = -EPERM;
                         break;
                 }
-                error = snapshot_restore(data->platform_suspend);
+                error = hibernation_restore(data->platform_suspend);
                 break;
 
         case SNAPSHOT_FREE:
@@ -336,47 +255,19 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 break;
 
         case SNAPSHOT_S2RAM:
-                if (!pm_ops) {
-                        error = -ENOSYS;
-                        break;
-                }
-
                 if (!data->frozen) {
                         error = -EPERM;
                         break;
                 }
-
                 if (!mutex_trylock(&pm_mutex)) {
                         error = -EBUSY;
                         break;
                 }
-
-                if (pm_ops->prepare) {
-                        error = pm_ops->prepare(PM_SUSPEND_MEM);
-                        if (error)
-                                goto OutS3;
-                }
-
-                /* Put devices to sleep */
-                suspend_console();
-                error = device_suspend(PMSG_SUSPEND);
-                if (error) {
-                        printk(KERN_ERR "Failed to suspend some devices.\n");
-                } else {
-                        error = disable_nonboot_cpus();
-                        if (!error) {
-                                /* Enter S3, system is already frozen */
-                                suspend_enter(PM_SUSPEND_MEM);
-                                enable_nonboot_cpus();
-                        }
-                        /* Wake up devices */
-                        device_resume();
-                }
-                resume_console();
-                if (pm_ops->finish)
-                        pm_ops->finish(PM_SUSPEND_MEM);
-
- OutS3:
+                /*
+                 * Tasks are frozen and the notifiers have been called with
+                 * PM_HIBERNATION_PREPARE
+                 */
+                error = suspend_devices_and_enter(PM_SUSPEND_MEM);
                 mutex_unlock(&pm_mutex);
                 break;
 
@@ -386,19 +277,14 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 switch (arg) {
 
                 case PMOPS_PREPARE:
-                        if (hibernation_ops) {
-                                data->platform_suspend = 1;
-                                error = 0;
-                        } else {
-                                error = -ENOSYS;
-                        }
+                        data->platform_suspend = 1;
+                        error = 0;
                         break;
 
                 case PMOPS_ENTER:
-                        if (data->platform_suspend) {
-                                kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
-                                error = hibernation_ops->enter();
-                        }
+                        if (data->platform_suspend)
+                                error = hibernation_platform_enter();
+
                         break;
 
                 case PMOPS_FINISH:
diff --git a/kernel/printk.c b/kernel/printk.c
index 0bbdeac2810c..051d27e36a6c 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -449,13 +449,16 @@ static int printk_time = 1;
 #else
 static int printk_time = 0;
 #endif
-module_param(printk_time, int, S_IRUGO | S_IWUSR);
+module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
 
 static int __init printk_time_setup(char *str)
 {
         if (*str)
                 return 0;
         printk_time = 1;
+        printk(KERN_NOTICE "The 'time' option is deprecated and "
+                "is scheduled for removal in early 2008\n");
+        printk(KERN_NOTICE "Use 'printk.time=<value>' instead\n");
         return 1;
 }
 
@@ -483,6 +486,9 @@ static int have_callable_console(void)
  * @fmt: format string
  *
  * This is printk().  It can be called from any context.  We want it to work.
+ * Be aware of the fact that if oops_in_progress is not set, we might try to
+ * wake klogd up which could deadlock on runqueue lock if printk() is called
+ * from scheduler code.
  *
  * We try to grab the console_sem.  If we succeed, it's easy - we log the output and
  * call the console drivers.  If we fail to get the semaphore we place the output
@@ -654,7 +660,7 @@ static void call_console_drivers(unsigned long start, unsigned long end)
  */
 static int __init console_setup(char *str)
 {
-        char name[sizeof(console_cmdline[0].name)];
+        char buf[sizeof(console_cmdline[0].name) + 4]; /* 4 for index */
         char *s, *options;
         int idx;
 
@@ -662,27 +668,27 @@ static int __init console_setup(char *str)
          * Decode str into name, index, options.
          */
         if (str[0] >= '0' && str[0] <= '9') {
-                strcpy(name, "ttyS");
-                strncpy(name + 4, str, sizeof(name) - 5);
+                strcpy(buf, "ttyS");
+                strncpy(buf + 4, str, sizeof(buf) - 5);
         } else {
-                strncpy(name, str, sizeof(name) - 1);
+                strncpy(buf, str, sizeof(buf) - 1);
         }
-        name[sizeof(name) - 1] = 0;
+        buf[sizeof(buf) - 1] = 0;
         if ((options = strchr(str, ',')) != NULL)
                 *(options++) = 0;
 #ifdef __sparc__
         if (!strcmp(str, "ttya"))
-                strcpy(name, "ttyS0");
+                strcpy(buf, "ttyS0");
         if (!strcmp(str, "ttyb"))
-                strcpy(name, "ttyS1");
+                strcpy(buf, "ttyS1");
 #endif
-        for (s = name; *s; s++)
+        for (s = buf; *s; s++)
                 if ((*s >= '0' && *s <= '9') || *s == ',')
                         break;
         idx = simple_strtoul(s, NULL, 10);
         *s = 0;
 
-        add_preferred_console(name, idx, options);
+        add_preferred_console(buf, idx, options);
         return 1;
 }
 __setup("console=", console_setup);
@@ -709,7 +715,7 @@ int __init add_preferred_console(char *name, int idx, char *options)
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for(i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
+        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
                 if (strcmp(console_cmdline[i].name, name) == 0 &&
                           console_cmdline[i].index == idx) {
                                 selected_console = i;
@@ -726,6 +732,25 @@ int __init add_preferred_console(char *name, int idx, char *options)
         return 0;
 }
 
+int __init update_console_cmdline(char *name, int idx, char *name_new, int idx_new, char *options)
+{
+        struct console_cmdline *c;
+        int i;
+
+        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
+                if (strcmp(console_cmdline[i].name, name) == 0 &&
+                          console_cmdline[i].index == idx) {
+                                c = &console_cmdline[i];
+                                memcpy(c->name, name_new, sizeof(c->name));
+                                c->name[sizeof(c->name) - 1] = 0;
+                                c->options = options;
+                                c->index = idx_new;
+                                return i;
+                }
+        /* not found */
+        return -1;
+}
+
 #ifndef CONFIG_DISABLE_CONSOLE_SUSPEND
 /**
  * suspend_console - suspend the console subsystem
@@ -942,6 +967,9 @@ void register_console(struct console *console)
         if (preferred_console < 0 || bootconsole || !console_drivers)
                 preferred_console = selected_console;
 
+        if (console->early_setup)
+                console->early_setup();
+
         /*
          *      See if we want to use this console driver. If we
          *      didn't select a console we take the first one
@@ -985,12 +1013,15 @@ void register_console(struct console *console)
         if (!(console->flags & CON_ENABLED))
                 return;
 
-        if (bootconsole) {
+        if (bootconsole && (console->flags & CON_CONSDEV)) {
                 printk(KERN_INFO "console handover: boot [%s%d] -> real [%s%d]\n",
                        bootconsole->name, bootconsole->index,
                        console->name, console->index);
                 unregister_console(bootconsole);
                 console->flags &= ~CON_PRINTBUFFER;
+        } else {
+                printk(KERN_INFO "console [%s%d] enabled\n",
+                       console->name, console->index);
         }
 
         /*
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index ad7949a589dd..82a558b655da 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -142,7 +142,7 @@ static int may_attach(struct task_struct *task)
                 return -EPERM;
         smp_rmb();
         if (task->mm)
-                dumpable = task->mm->dumpable;
+                dumpable = get_dumpable(task->mm);
         if (!dumpable && !capable(CAP_SYS_PTRACE))
                 return -EPERM;
 
@@ -161,6 +161,7 @@ int ptrace_may_attach(struct task_struct *task)
 int ptrace_attach(struct task_struct *task)
 {
         int retval;
+        unsigned long flags;
 
         audit_ptrace(task);
 
@@ -181,9 +182,7 @@ repeat:
          * cpu's that may have task_lock).
          */
         task_lock(task);
-        local_irq_disable();
-        if (!write_trylock(&tasklist_lock)) {
-                local_irq_enable();
+        if (!write_trylock_irqsave(&tasklist_lock, flags)) {
                 task_unlock(task);
                 do {
                         cpu_relax();
@@ -211,7 +210,7 @@ repeat:
         force_sig_specific(SIGSTOP, task);
 
 bad:
-        write_unlock_irq(&tasklist_lock);
+        write_unlock_irqrestore(&tasklist_lock, flags);
         task_unlock(task);
 out:
         return retval;
@@ -491,3 +490,22 @@ asmlinkage long sys_ptrace(long request, long pid, long addr, long data)
         return ret;
 }
 #endif /* __ARCH_SYS_PTRACE */
+
+int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
+{
+        unsigned long tmp;
+        int copied;
+
+        copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
+        if (copied != sizeof(tmp))
+                return -EIO;
+        return put_user(tmp, (unsigned long __user *)data);
+}
+
+int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
+{
+        int copied;
+
+        copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);
+        return (copied == sizeof(data)) ? 0 : -EIO;
+}
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 55ba82a85a66..ddff33247785 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -40,6 +40,7 @@
 #include <linux/moduleparam.h>
 #include <linux/percpu.h>
 #include <linux/notifier.h>
+#include <linux/freezer.h>
 #include <linux/cpu.h>
 #include <linux/random.h>
 #include <linux/delay.h>
@@ -518,7 +519,6 @@ rcu_torture_writer(void *arg)
 
         VERBOSE_PRINTK_STRING("rcu_torture_writer task started");
         set_user_nice(current, 19);
-        current->flags |= PF_NOFREEZE;
 
         do {
                 schedule_timeout_uninterruptible(1);
@@ -558,7 +558,6 @@ rcu_torture_fakewriter(void *arg)
 
         VERBOSE_PRINTK_STRING("rcu_torture_fakewriter task started");
         set_user_nice(current, 19);
-        current->flags |= PF_NOFREEZE;
 
         do {
                 schedule_timeout_uninterruptible(1 + rcu_random(&rand)%10);
@@ -589,7 +588,6 @@ rcu_torture_reader(void *arg)
 
         VERBOSE_PRINTK_STRING("rcu_torture_reader task started");
         set_user_nice(current, 19);
-        current->flags |= PF_NOFREEZE;
 
         do {
                 idx = cur_ops->readlock();
diff --git a/kernel/relay.c b/kernel/relay.c
index a615a8f513fc..510fbbd7b500 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -80,7 +80,7 @@ static struct vm_operations_struct relay_file_mmap_ops = {
  *
  *      Caller should already have grabbed mmap_sem.
  */
-int relay_mmap_buf(struct rchan_buf *buf, struct vm_area_struct *vma)
+static int relay_mmap_buf(struct rchan_buf *buf, struct vm_area_struct *vma)
 {
         unsigned long length = vma->vm_end - vma->vm_start;
         struct file *filp = vma->vm_file;
@@ -145,7 +145,7 @@ depopulate:
  *
  *      Returns channel buffer if successful, %NULL otherwise.
  */
-struct rchan_buf *relay_create_buf(struct rchan *chan)
+static struct rchan_buf *relay_create_buf(struct rchan *chan)
 {
         struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
         if (!buf)
@@ -175,7 +175,7 @@ free_buf:
  *
  *      Should only be called from kref_put().
  */
-void relay_destroy_channel(struct kref *kref)
+static void relay_destroy_channel(struct kref *kref)
 {
         struct rchan *chan = container_of(kref, struct rchan, kref);
         kfree(chan);
@@ -185,7 +185,7 @@ void relay_destroy_channel(struct kref *kref)
  *      relay_destroy_buf - destroy an rchan_buf struct and associated buffer
  *      @buf: the buffer struct
  */
-void relay_destroy_buf(struct rchan_buf *buf)
+static void relay_destroy_buf(struct rchan_buf *buf)
 {
         struct rchan *chan = buf->chan;
         unsigned int i;
@@ -210,7 +210,7 @@ void relay_destroy_buf(struct rchan_buf *buf)
  *      rchan_buf_struct and the channel buffer.  Should only be called from
  *      kref_put().
  */
-void relay_remove_buf(struct kref *kref)
+static void relay_remove_buf(struct kref *kref)
 {
         struct rchan_buf *buf = container_of(kref, struct rchan_buf, kref);
         buf->chan->cb->remove_buf_file(buf->dentry);
@@ -223,11 +223,10 @@ void relay_remove_buf(struct kref *kref)
  *
  *      Returns 1 if the buffer is empty, 0 otherwise.
  */
-int relay_buf_empty(struct rchan_buf *buf)
+static int relay_buf_empty(struct rchan_buf *buf)
 {
         return (buf->subbufs_produced - buf->subbufs_consumed) ? 0 : 1;
 }
-EXPORT_SYMBOL_GPL(relay_buf_empty);
 
 /**
  *      relay_buf_full - boolean, is the channel buffer full?
diff --git a/kernel/rtmutex-debug.c b/kernel/rtmutex-debug.c
index da8d6bf46457..5aedbee014df 100644
--- a/kernel/rtmutex-debug.c
+++ b/kernel/rtmutex-debug.c
@@ -29,12 +29,6 @@
 
 #include "rtmutex_common.h"
 
-#ifdef CONFIG_DEBUG_RT_MUTEXES
-# include "rtmutex-debug.h"
-#else
-# include "rtmutex.h"
-#endif
-
 # define TRACE_WARN_ON(x)                       WARN_ON(x)
 # define TRACE_BUG_ON(x)                        BUG_ON(x)
 
diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
index 015fc633c96c..e3055ba69159 100644
--- a/kernel/rtmutex-tester.c
+++ b/kernel/rtmutex-tester.c
@@ -260,6 +260,7 @@ static int test_func(void *data)
         int ret;
 
         current->flags |= PF_MUTEX_TESTER;
+        set_freezable();
         allow_signal(SIGHUP);
 
         for(;;) {
diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
index 17d28ce20300..8cd9bd2cdb34 100644
--- a/kernel/rtmutex.c
+++ b/kernel/rtmutex.c
@@ -17,12 +17,6 @@
 
 #include "rtmutex_common.h"
 
-#ifdef CONFIG_DEBUG_RT_MUTEXES
-# include "rtmutex-debug.h"
-#else
-# include "rtmutex.h"
-#endif
-
 /*
  * lock->owner state tracking:
  *
diff --git a/kernel/rtmutex_common.h b/kernel/rtmutex_common.h
index 9c75856e791e..2d3b83593ca3 100644
--- a/kernel/rtmutex_common.h
+++ b/kernel/rtmutex_common.h
@@ -103,7 +103,7 @@ static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock)
 
 static inline struct task_struct *rt_mutex_real_owner(struct rt_mutex *lock)
 {
-        return (struct task_struct *)
+        return (struct task_struct *)
                 ((unsigned long)lock->owner & ~RT_MUTEX_HAS_WAITERS);
 }
 
@@ -120,4 +120,11 @@ extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
                                        struct task_struct *proxy_owner);
 extern void rt_mutex_proxy_unlock(struct rt_mutex *lock,
                                   struct task_struct *proxy_owner);
+
+#ifdef CONFIG_DEBUG_RT_MUTEXES
+# include "rtmutex-debug.h"
+#else
+# include "rtmutex.h"
+#endif
+
 #endif
diff --git a/kernel/rwsem.c b/kernel/rwsem.c
index 9a87886b022e..1ec620c03064 100644
--- a/kernel/rwsem.c
+++ b/kernel/rwsem.c
@@ -20,7 +20,7 @@ void down_read(struct rw_semaphore *sem)
         might_sleep();
         rwsem_acquire_read(&sem->dep_map, 0, 0, _RET_IP_);
 
-        __down_read(sem);
+        LOCK_CONTENDED(sem, __down_read_trylock, __down_read);
 }
 
 EXPORT_SYMBOL(down_read);
@@ -47,7 +47,7 @@ void down_write(struct rw_semaphore *sem)
         might_sleep();
         rwsem_acquire(&sem->dep_map, 0, 0, _RET_IP_);
 
-        __down_write(sem);
+        LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
 }
 
 EXPORT_SYMBOL(down_write);
@@ -111,7 +111,7 @@ void down_read_nested(struct rw_semaphore *sem, int subclass)
         might_sleep();
         rwsem_acquire_read(&sem->dep_map, subclass, 0, _RET_IP_);
 
-        __down_read(sem);
+        LOCK_CONTENDED(sem, __down_read_trylock, __down_read);
 }
 
 EXPORT_SYMBOL(down_read_nested);
@@ -130,7 +130,7 @@ void down_write_nested(struct rw_semaphore *sem, int subclass)
         might_sleep();
         rwsem_acquire(&sem->dep_map, subclass, 0, _RET_IP_);
 
-        __down_write_nested(sem, subclass);
+        LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
 }
 
 EXPORT_SYMBOL(down_write_nested);
diff --git a/kernel/sched.c b/kernel/sched.c
index 3332bbb5d5cf..93cf241cfbe9 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -301,7 +301,7 @@ struct rq {
         struct lock_class_key rq_lock_key;
 };
 
-static DEFINE_PER_CPU(struct rq, runqueues) ____cacheline_aligned_in_smp;
+static DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
 static DEFINE_MUTEX(sched_hotcpu_mutex);
 
 static inline void check_preempt_curr(struct rq *rq, struct task_struct *p)
@@ -379,6 +379,23 @@ static inline unsigned long long rq_clock(struct rq *rq)
 #define task_rq(p)              cpu_rq(task_cpu(p))
 #define cpu_curr(cpu)           (cpu_rq(cpu)->curr)
 
+/*
+ * For kernel-internal use: high-speed (but slightly incorrect) per-cpu
+ * clock constructed from sched_clock():
+ */
+unsigned long long cpu_clock(int cpu)
+{
+        struct rq *rq = cpu_rq(cpu);
+        unsigned long long now;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rq->lock, flags);
+        now = rq_clock(rq);
+        spin_unlock_irqrestore(&rq->lock, flags);
+
+        return now;
+}
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
 /* Change a task's ->cfs_rq if it moves across CPUs */
 static inline void set_task_cfs_rq(struct task_struct *p)
@@ -736,7 +753,9 @@ static void update_curr_load(struct rq *rq, u64 now)
  *
  * The "10% effect" is relative and cumulative: from _any_ nice level,
  * if you go up 1 level, it's -10% CPU usage, if you go down 1 level
- * it's +10% CPU usage.
+ * it's +10% CPU usage. (to achieve that we use a multiplier of 1.25.
+ * If a task goes up by ~10% and another task goes down by ~10% then
+ * the relative distance between them is ~25%.)
  */
 static const int prio_to_weight[40] = {
 /* -20 */ 88818, 71054, 56843, 45475, 36380, 29104, 23283, 18626, 14901, 11921,
@@ -746,15 +765,22 @@ static const int prio_to_weight[40] = {
 /*  10 */   110,    87,    70,    56,    45,    36,    29,    23,    18,    15,
 };
 
+/*
+ * Inverse (2^32/x) values of the prio_to_weight[] array, precalculated.
+ *
+ * In cases where the weight does not change often, we can use the
+ * precalculated inverse to speed up arithmetics by turning divisions
+ * into multiplications:
+ */
 static const u32 prio_to_wmult[40] = {
-        48356,   60446,   75558,   94446,  118058,  147573,
-        184467,  230589,  288233,  360285,  450347,
-        562979,  703746,  879575, 1099582, 1374389,
-        1717986, 2147483, 2684354, 3355443, 4194304,
-        5244160, 6557201, 8196502, 10250518, 12782640,
-        16025997, 19976592, 24970740, 31350126, 39045157,
-        49367440, 61356675, 76695844, 95443717, 119304647,
-        148102320, 186737708, 238609294, 286331153,
+/* -20 */     48356,     60446,     75558,     94446,    118058,
+/* -15 */    147573,    184467,    230589,    288233,    360285,
+/* -10 */    450347,    562979,    703746,    879575,   1099582,
+/*  -5 */   1374389,   1717986,   2147483,   2684354,   3355443,
+/*   0 */   4194304,   5244160,   6557201,   8196502,  10250518,
+/*   5 */  12782640,  16025997,  19976592,  24970740,  31350126,
+/*  10 */  39045157,  49367440,  61356675,  76695844,  95443717,
+/*  15 */ 119304647, 148102320, 186737708, 238609294, 286331153,
 };
 
 static inline void
@@ -2226,7 +2252,7 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
 
                         rq = cpu_rq(i);
 
-                        if (*sd_idle && !idle_cpu(i))
+                        if (*sd_idle && rq->nr_running)
                                 *sd_idle = 0;
 
                         /* Bias balancing toward cpus of our domain */
@@ -2248,9 +2274,11 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
                 /*
                  * First idle cpu or the first cpu(busiest) in this sched group
                  * is eligible for doing load balancing at this and above
-                 * domains.
+                 * domains. In the newly idle case, we will allow all the cpu's
+                 * to do the newly idle load balance.
                  */
-                if (local_group && balance_cpu != this_cpu && balance) {
+                if (idle != CPU_NEWLY_IDLE && local_group &&
+                    balance_cpu != this_cpu && balance) {
                         *balance = 0;
                         goto ret;
                 }
@@ -2668,6 +2696,7 @@ load_balance_newidle(int this_cpu, struct rq *this_rq, struct sched_domain *sd)
         unsigned long imbalance;
         int nr_moved = 0;
         int sd_idle = 0;
+        int all_pinned = 0;
         cpumask_t cpus = CPU_MASK_ALL;
 
         /*
@@ -2706,10 +2735,11 @@ redo:
                 double_lock_balance(this_rq, busiest);
                 nr_moved = move_tasks(this_rq, this_cpu, busiest,
                                         minus_1_or_zero(busiest->nr_running),
-                                        imbalance, sd, CPU_NEWLY_IDLE, NULL);
+                                        imbalance, sd, CPU_NEWLY_IDLE,
+                                        &all_pinned);
                 spin_unlock(&busiest->lock);
 
-                if (!nr_moved) {
+                if (unlikely(all_pinned)) {
                         cpu_clear(cpu_of(busiest), cpus);
                         if (!cpus_empty(cpus))
                                 goto redo;
@@ -4903,8 +4933,6 @@ static int migration_thread(void *data)
                 struct migration_req *req;
                 struct list_head *head;
 
-                try_to_freeze();
-
                 spin_lock_irq(&rq->lock);
 
                 if (cpu_is_offline(cpu)) {
@@ -5138,7 +5166,6 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 p = kthread_create(migration_thread, hcpu, "migration/%d", cpu);
                 if (IS_ERR(p))
                         return NOTIFY_BAD;
-                p->flags |= PF_NOFREEZE;
                 kthread_bind(p, cpu);
                 /* Must be high prio: stop_machine expects to yield to it. */
                 rq = task_rq_lock(p, &flags);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index c3391b6020e8..ad64fcb731f2 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -10,6 +10,7 @@
 #include <linux/sched.h>
 
 /* #define SECCOMP_DEBUG 1 */
+#define NR_SECCOMP_MODES 1
 
 /*
  * Secure computing mode 1 allows only read/write/exit/sigreturn.
@@ -54,3 +55,31 @@ void __secure_computing(int this_syscall)
 #endif
         do_exit(SIGKILL);
 }
+
+long prctl_get_seccomp(void)
+{
+        return current->seccomp.mode;
+}
+
+long prctl_set_seccomp(unsigned long seccomp_mode)
+{
+        long ret;
+
+        /* can set it only once to be even more secure */
+        ret = -EPERM;
+        if (unlikely(current->seccomp.mode))
+                goto out;
+
+        ret = -EINVAL;
+        if (seccomp_mode && seccomp_mode <= NR_SECCOMP_MODES) {
+                current->seccomp.mode = seccomp_mode;
+                set_thread_flag(TIF_SECCOMP);
+#ifdef TIF_NOTSC
+                disable_TSC();
+#endif
+                ret = 0;
+        }
+
+ out:
+        return ret;
+}
diff --git a/kernel/signal.c b/kernel/signal.c
index f9405609774e..ef8156a6aad5 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -255,6 +255,16 @@ flush_signal_handlers(struct task_struct *t, int force_default)
         }
 }
 
+int unhandled_signal(struct task_struct *tsk, int sig)
+{
+        if (is_init(tsk))
+                return 1;
+        if (tsk->ptrace & PT_PTRACED)
+                return 0;
+        return (tsk->sighand->action[sig-1].sa.sa_handler == SIG_IGN) ||
+                (tsk->sighand->action[sig-1].sa.sa_handler == SIG_DFL);
+}
+
 
 /* Notify the system that a driver wants to block all signals for this
  * process, and wants to be notified if any signals at all were to be
@@ -718,6 +728,37 @@ out_set:
 #define LEGACY_QUEUE(sigptr, sig) \
         (((sig) < SIGRTMIN) && sigismember(&(sigptr)->signal, (sig)))
 
+int print_fatal_signals;
+
+static void print_fatal_signal(struct pt_regs *regs, int signr)
+{
+        printk("%s/%d: potentially unexpected fatal signal %d.\n",
+                current->comm, current->pid, signr);
+
+#ifdef __i386__
+        printk("code at %08lx: ", regs->eip);
+        {
+                int i;
+                for (i = 0; i < 16; i++) {
+                        unsigned char insn;
+
+                        __get_user(insn, (unsigned char *)(regs->eip + i));
+                        printk("%02x ", insn);
+                }
+        }
+#endif
+        printk("\n");
+        show_regs(regs);
+}
+
+static int __init setup_print_fatal_signals(char *str)
+{
+        get_option (&str, &print_fatal_signals);
+
+        return 1;
+}
+
+__setup("print-fatal-signals=", setup_print_fatal_signals);
 
 static int
 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
@@ -1855,6 +1896,8 @@ relock:
                  * Anything else is fatal, maybe with a core dump.
                  */
                 current->flags |= PF_SIGNALED;
+                if ((signr != SIGKILL) && print_fatal_signals)
+                        print_fatal_signal(regs, signr);
                 if (sig_kernel_coredump(signr)) {
                         /*
                          * If it was able to dump core, this kills all
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 73217a9e2875..0f546ddea43d 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -14,6 +14,7 @@
 #include <linux/notifier.h>
 #include <linux/percpu.h>
 #include <linux/cpu.h>
+#include <linux/freezer.h>
 #include <linux/kthread.h>
 #include <linux/rcupdate.h>
 #include <linux/smp.h>
@@ -488,8 +489,6 @@ void __init softirq_init(void)
 
 static int ksoftirqd(void * __bind_cpu)
 {
-        current->flags |= PF_NOFREEZE;
-
         set_current_state(TASK_INTERRUPTIBLE);
 
         while (!kthread_should_stop()) {
@@ -614,12 +613,16 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
                 kthread_bind(per_cpu(ksoftirqd, hotcpu),
                              any_online_cpu(cpu_online_map));
         case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
+        case CPU_DEAD_FROZEN: {
+                struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
+
                 p = per_cpu(ksoftirqd, hotcpu);
                 per_cpu(ksoftirqd, hotcpu) = NULL;
+                sched_setscheduler(p, SCHED_FIFO, &param);
                 kthread_stop(p);
                 takeover_tasklets(hotcpu);
                 break;
+        }
 #endif /* CONFIG_HOTPLUG_CPU */
         }
         return NOTIFY_OK;
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 0131e296ffb4..708d4882c0c3 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -10,6 +10,7 @@
 #include <linux/cpu.h>
 #include <linux/init.h>
 #include <linux/delay.h>
+#include <linux/freezer.h>
 #include <linux/kthread.h>
 #include <linux/notifier.h>
 #include <linux/module.h>
@@ -116,7 +117,6 @@ static int watchdog(void * __bind_cpu)
         struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
 
         sched_setscheduler(current, SCHED_FIFO, &param);
-        current->flags |= PF_NOFREEZE;
 
         /* initialize timestamp */
         touch_softlockup_watchdog();
diff --git a/kernel/spinlock.c b/kernel/spinlock.c
index 2c6c2bf85514..cd72424c2662 100644
--- a/kernel/spinlock.c
+++ b/kernel/spinlock.c
@@ -72,7 +72,7 @@ void __lockfunc _read_lock(rwlock_t *lock)
 {
         preempt_disable();
         rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_read_lock(lock);
+        LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
 }
 EXPORT_SYMBOL(_read_lock);
 
@@ -88,8 +88,8 @@ unsigned long __lockfunc _spin_lock_irqsave(spinlock_t *lock)
          * _raw_spin_lock_flags() code, because lockdep assumes
          * that interrupts are not re-enabled during lock-acquire:
          */
-#ifdef CONFIG_PROVE_LOCKING
-        _raw_spin_lock(lock);
+#ifdef CONFIG_LOCKDEP
+        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
 #else
         _raw_spin_lock_flags(lock, &flags);
 #endif
@@ -102,7 +102,7 @@ void __lockfunc _spin_lock_irq(spinlock_t *lock)
         local_irq_disable();
         preempt_disable();
         spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_spin_lock(lock);
+        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
 }
 EXPORT_SYMBOL(_spin_lock_irq);
 
@@ -111,7 +111,7 @@ void __lockfunc _spin_lock_bh(spinlock_t *lock)
         local_bh_disable();
         preempt_disable();
         spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_spin_lock(lock);
+        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
 }
 EXPORT_SYMBOL(_spin_lock_bh);
 
@@ -122,7 +122,7 @@ unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
         local_irq_save(flags);
         preempt_disable();
         rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_read_lock(lock);
+        LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
         return flags;
 }
 EXPORT_SYMBOL(_read_lock_irqsave);
@@ -132,7 +132,7 @@ void __lockfunc _read_lock_irq(rwlock_t *lock)
         local_irq_disable();
         preempt_disable();
         rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_read_lock(lock);
+        LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
 }
 EXPORT_SYMBOL(_read_lock_irq);
 
@@ -141,7 +141,7 @@ void __lockfunc _read_lock_bh(rwlock_t *lock)
         local_bh_disable();
         preempt_disable();
         rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_read_lock(lock);
+        LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
 }
 EXPORT_SYMBOL(_read_lock_bh);
 
@@ -152,7 +152,7 @@ unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
         local_irq_save(flags);
         preempt_disable();
         rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_write_lock(lock);
+        LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
         return flags;
 }
 EXPORT_SYMBOL(_write_lock_irqsave);
@@ -162,7 +162,7 @@ void __lockfunc _write_lock_irq(rwlock_t *lock)
         local_irq_disable();
         preempt_disable();
         rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_write_lock(lock);
+        LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
 }
 EXPORT_SYMBOL(_write_lock_irq);
 
@@ -171,7 +171,7 @@ void __lockfunc _write_lock_bh(rwlock_t *lock)
         local_bh_disable();
         preempt_disable();
         rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_write_lock(lock);
+        LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
 }
 EXPORT_SYMBOL(_write_lock_bh);
 
@@ -179,7 +179,7 @@ void __lockfunc _spin_lock(spinlock_t *lock)
 {
         preempt_disable();
         spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_spin_lock(lock);
+        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
 }
 
 EXPORT_SYMBOL(_spin_lock);
@@ -188,7 +188,7 @@ void __lockfunc _write_lock(rwlock_t *lock)
 {
         preempt_disable();
         rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        _raw_write_lock(lock);
+        LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
 }
 
 EXPORT_SYMBOL(_write_lock);
@@ -289,7 +289,7 @@ void __lockfunc _spin_lock_nested(spinlock_t *lock, int subclass)
 {
         preempt_disable();
         spin_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
-        _raw_spin_lock(lock);
+        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
 }
 
 EXPORT_SYMBOL(_spin_lock_nested);
@@ -305,8 +305,8 @@ unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclas
          * _raw_spin_lock_flags() code, because lockdep assumes
          * that interrupts are not re-enabled during lock-acquire:
          */
-#ifdef CONFIG_PROVE_SPIN_LOCKING
-        _raw_spin_lock(lock);
+#ifdef CONFIG_LOCKDEP
+        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
 #else
         _raw_spin_lock_flags(lock, &flags);
 #endif
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index fcee2a8e6da3..319821ef78af 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -93,10 +93,6 @@ static void stopmachine_set_state(enum stopmachine_state state)
 static int stop_machine(void)
 {
         int i, ret = 0;
-        struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
-
-        /* One high-prio thread per cpu.  We'll do this one. */
-        sched_setscheduler(current, SCHED_FIFO, &param);
 
         atomic_set(&stopmachine_thread_ack, 0);
         stopmachine_num_threads = 0;
@@ -189,6 +185,10 @@ struct task_struct *__stop_machine_run(int (*fn)(void *), void *data,
 
         p = kthread_create(do_stop, &smdata, "kstopmachine");
         if (!IS_ERR(p)) {
+                struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
+
+                /* One high-prio thread per cpu.  We'll do this one. */
+                sched_setscheduler(p, SCHED_FIFO, &param);
                 kthread_bind(p, cpu);
                 wake_up_process(p);
                 wait_for_completion(&smdata.done);
diff --git a/kernel/sys.c b/kernel/sys.c
index 872271ccc384..08562f419768 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -31,10 +31,12 @@
 #include <linux/cn_proc.h>
 #include <linux/getcpu.h>
 #include <linux/task_io_accounting_ops.h>
+#include <linux/seccomp.h>
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
 #include <linux/kprobes.h>
+#include <linux/user_namespace.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -98,6 +100,13 @@ struct pid *cad_pid;
 EXPORT_SYMBOL(cad_pid);
 
 /*
+ * If set, this is used for preparing the system to power off.
+ */
+
+void (*pm_power_off_prepare)(void);
+EXPORT_SYMBOL(pm_power_off_prepare);
+
+/*
  *      Notifier list for kernel code which wants to be called
  *      at shutdown. This is used to stop any idling DMA operations
  *      and the like. 
@@ -865,6 +874,8 @@ EXPORT_SYMBOL_GPL(kernel_halt);
 void kernel_power_off(void)
 {
         kernel_shutdown_prepare(SYSTEM_POWER_OFF);
+        if (pm_power_off_prepare)
+                pm_power_off_prepare();
         printk(KERN_EMERG "Power down.\n");
         machine_power_off();
 }
@@ -1025,7 +1036,7 @@ asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
                         return -EPERM;
         }
         if (new_egid != old_egid) {
-                current->mm->dumpable = suid_dumpable;
+                set_dumpable(current->mm, suid_dumpable);
                 smp_wmb();
         }
         if (rgid != (gid_t) -1 ||
@@ -1055,13 +1066,13 @@ asmlinkage long sys_setgid(gid_t gid)
 
         if (capable(CAP_SETGID)) {
                 if (old_egid != gid) {
-                        current->mm->dumpable = suid_dumpable;
+                        set_dumpable(current->mm, suid_dumpable);
                         smp_wmb();
                 }
                 current->gid = current->egid = current->sgid = current->fsgid = gid;
         } else if ((gid == current->gid) || (gid == current->sgid)) {
                 if (old_egid != gid) {
-                        current->mm->dumpable = suid_dumpable;
+                        set_dumpable(current->mm, suid_dumpable);
                         smp_wmb();
                 }
                 current->egid = current->fsgid = gid;
@@ -1078,13 +1089,13 @@ static int set_user(uid_t new_ruid, int dumpclear)
 {
         struct user_struct *new_user;
 
-        new_user = alloc_uid(new_ruid);
+        new_user = alloc_uid(current->nsproxy->user_ns, new_ruid);
         if (!new_user)
                 return -EAGAIN;
 
         if (atomic_read(&new_user->processes) >=
                                 current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
-                        new_user != &root_user) {
+                        new_user != current->nsproxy->user_ns->root_user) {
                 free_uid(new_user);
                 return -EAGAIN;
         }
@@ -1092,7 +1103,7 @@ static int set_user(uid_t new_ruid, int dumpclear)
         switch_uid(new_user);
 
         if (dumpclear) {
-                current->mm->dumpable = suid_dumpable;
+                set_dumpable(current->mm, suid_dumpable);
                 smp_wmb();
         }
         current->uid = new_ruid;
@@ -1148,7 +1159,7 @@ asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
                 return -EAGAIN;
 
         if (new_euid != old_euid) {
-                current->mm->dumpable = suid_dumpable;
+                set_dumpable(current->mm, suid_dumpable);
                 smp_wmb();
         }
         current->fsuid = current->euid = new_euid;
@@ -1198,7 +1209,7 @@ asmlinkage long sys_setuid(uid_t uid)
                 return -EPERM;
 
         if (old_euid != uid) {
-                current->mm->dumpable = suid_dumpable;
+                set_dumpable(current->mm, suid_dumpable);
                 smp_wmb();
         }
         current->fsuid = current->euid = uid;
@@ -1243,7 +1254,7 @@ asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
         }
         if (euid != (uid_t) -1) {
                 if (euid != current->euid) {
-                        current->mm->dumpable = suid_dumpable;
+                        set_dumpable(current->mm, suid_dumpable);
                         smp_wmb();
                 }
                 current->euid = euid;
@@ -1293,7 +1304,7 @@ asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
         }
         if (egid != (gid_t) -1) {
                 if (egid != current->egid) {
-                        current->mm->dumpable = suid_dumpable;
+                        set_dumpable(current->mm, suid_dumpable);
                         smp_wmb();
                 }
                 current->egid = egid;
@@ -1339,7 +1350,7 @@ asmlinkage long sys_setfsuid(uid_t uid)
             uid == current->suid || uid == current->fsuid || 
             capable(CAP_SETUID)) {
                 if (uid != old_fsuid) {
-                        current->mm->dumpable = suid_dumpable;
+                        set_dumpable(current->mm, suid_dumpable);
                         smp_wmb();
                 }
                 current->fsuid = uid;
@@ -1368,7 +1379,7 @@ asmlinkage long sys_setfsgid(gid_t gid)
             gid == current->sgid || gid == current->fsgid || 
             capable(CAP_SETGID)) {
                 if (gid != old_fsgid) {
-                        current->mm->dumpable = suid_dumpable;
+                        set_dumpable(current->mm, suid_dumpable);
                         smp_wmb();
                 }
                 current->fsgid = gid;
@@ -2165,14 +2176,14 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                         error = put_user(current->pdeath_signal, (int __user *)arg2);
                         break;
                 case PR_GET_DUMPABLE:
-                        error = current->mm->dumpable;
+                        error = get_dumpable(current->mm);
                         break;
                 case PR_SET_DUMPABLE:
                         if (arg2 < 0 || arg2 > 1) {
                                 error = -EINVAL;
                                 break;
                         }
-                        current->mm->dumpable = arg2;
+                        set_dumpable(current->mm, arg2);
                         break;
 
                 case PR_SET_UNALIGN:
@@ -2241,6 +2252,13 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                         error = SET_ENDIAN(current, arg2);
                         break;
 
+                case PR_GET_SECCOMP:
+                        error = prctl_get_seccomp();
+                        break;
+                case PR_SET_SECCOMP:
+                        error = prctl_set_seccomp(arg2);
+                        break;
+
                 default:
                         error = -EINVAL;
                         break;
@@ -2277,3 +2295,61 @@ asmlinkage long sys_getcpu(unsigned __user *cpup, unsigned __user *nodep,
         }
         return err ? -EFAULT : 0;
 }
+
+char poweroff_cmd[POWEROFF_CMD_PATH_LEN] = "/sbin/poweroff";
+
+static void argv_cleanup(char **argv, char **envp)
+{
+        argv_free(argv);
+}
+
+/**
+ * orderly_poweroff - Trigger an orderly system poweroff
+ * @force: force poweroff if command execution fails
+ *
+ * This may be called from any context to trigger a system shutdown.
+ * If the orderly shutdown fails, it will force an immediate shutdown.
+ */
+int orderly_poweroff(bool force)
+{
+        int argc;
+        char **argv = argv_split(GFP_ATOMIC, poweroff_cmd, &argc);
+        static char *envp[] = {
+                "HOME=/",
+                "PATH=/sbin:/bin:/usr/sbin:/usr/bin",
+                NULL
+        };
+        int ret = -ENOMEM;
+        struct subprocess_info *info;
+
+        if (argv == NULL) {
+                printk(KERN_WARNING "%s failed to allocate memory for \"%s\"\n",
+                       __func__, poweroff_cmd);
+                goto out;
+        }
+
+        info = call_usermodehelper_setup(argv[0], argv, envp);
+        if (info == NULL) {
+                argv_free(argv);
+                goto out;
+        }
+
+        call_usermodehelper_setcleanup(info, argv_cleanup);
+
+        ret = call_usermodehelper_exec(info, UMH_NO_WAIT);
+
+  out:
+        if (ret && force) {
+                printk(KERN_WARNING "Failed to start orderly shutdown: "
+                       "forcing the issue\n");
+
+                /* I guess this should try to kick off some daemon to
+                   sync and poweroff asap.  Or not even bother syncing
+                   if we're doing an emergency shutdown? */
+                emergency_sync();
+                kernel_power_off();
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(orderly_poweroff);
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 7e11e2c98bf9..b0ec498a18d9 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -14,6 +14,7 @@ asmlinkage long sys_ni_syscall(void)
 
 cond_syscall(sys_nfsservctl);
 cond_syscall(sys_quotactl);
+cond_syscall(sys32_quotactl);
 cond_syscall(sys_acct);
 cond_syscall(sys_lookup_dcookie);
 cond_syscall(sys_swapon);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index d93e13d93f24..ddebf3f2affe 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -29,6 +29,7 @@
 #include <linux/utsname.h>
 #include <linux/capability.h>
 #include <linux/smp_lock.h>
+#include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/kobject.h>
@@ -45,13 +46,11 @@
 #include <linux/syscalls.h>
 #include <linux/nfs_fs.h>
 #include <linux/acpi.h>
+#include <linux/reboot.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>
 
-extern int proc_nr_files(ctl_table *table, int write, struct file *filp,
-                     void __user *buffer, size_t *lenp, loff_t *ppos);
-
 #ifdef CONFIG_X86
 #include <asm/nmi.h>
 #include <asm/stacktrace.h>
@@ -61,6 +60,7 @@ extern int proc_nr_files(ctl_table *table, int write, struct file *filp,
 
 /* External variables not in a header file. */
 extern int C_A_D;
+extern int print_fatal_signals;
 extern int sysctl_overcommit_memory;
 extern int sysctl_overcommit_ratio;
 extern int sysctl_panic_on_oom;
@@ -78,6 +78,7 @@ extern int percpu_pagelist_fraction;
 extern int compat_log;
 extern int maps_protect;
 extern int sysctl_stat_interval;
+extern int audit_argv_kb;
 
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
 static int maxolduid = 65535;
@@ -160,6 +161,8 @@ extern ctl_table inotify_table[];
 int sysctl_legacy_va_layout;
 #endif
 
+extern int prove_locking;
+extern int lock_stat;
 
 /* The default sysctl tables: */
 
@@ -202,7 +205,10 @@ static ctl_table root_table[] = {
                 .mode           = 0555,
                 .child          = dev_table,
         },
-
+/*
+ * NOTE: do not add new entries to this table unless you have read
+ * Documentation/sysctl/ctl_unnumbered.txt
+ */
         { .ctl_name = 0 }
 };
 
@@ -278,6 +284,26 @@ static ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
         },
+#ifdef CONFIG_PROVE_LOCKING
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "prove_locking",
+                .data           = &prove_locking,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
+#endif
+#ifdef CONFIG_LOCK_STAT
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "lock_stat",
+                .data           = &lock_stat,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
+#endif
         {
                 .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "sched_features",
@@ -303,6 +329,16 @@ static ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
         },
+#ifdef CONFIG_AUDITSYSCALL
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "audit_argv_kb",
+                .data           = &audit_argv_kb,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
+#endif
         {
                 .ctl_name       = KERN_CORE_PATTERN,
                 .procname       = "core_pattern",
@@ -340,6 +376,14 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "print-fatal-signals",
+                .data           = &print_fatal_signals,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
 #ifdef __sparc__
         {
                 .ctl_name       = KERN_SPARC_REBOOT,
@@ -649,7 +693,7 @@ static ctl_table kern_table[] = {
         {
                 .ctl_name       = KERN_ACPI_VIDEO_FLAGS,
                 .procname       = "acpi_video_flags",
-                .data           = &acpi_video_flags,
+                .data           = &acpi_realmode_flags,
                 .maxlen         = sizeof (unsigned long),
                 .mode           = 0644,
                 .proc_handler   = &proc_doulongvec_minmax,
@@ -695,13 +739,26 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
-
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "poweroff_cmd",
+                .data           = &poweroff_cmd,
+                .maxlen         = POWEROFF_CMD_PATH_LEN,
+                .mode           = 0644,
+                .proc_handler   = &proc_dostring,
+                .strategy       = &sysctl_string,
+        },
+/*
+ * NOTE: do not add new entries to this table unless you have read
+ * Documentation/sysctl/ctl_unnumbered.txt
+ */
         { .ctl_name = 0 }
 };
 
 /* Constants for minimum and maximum testing in vm_table.
    We use these as one-element integer vectors. */
 static int zero;
+static int two = 2;
 static int one_hundred = 100;
 
 
@@ -814,6 +871,14 @@ static ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
          },
+         {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "hugepages_treat_as_movable",
+                .data           = &hugepages_treat_as_movable,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &hugetlb_treat_movable_handler,
+        },
 #endif
         {
                 .ctl_name       = VM_LOWMEM_RESERVE_RATIO,
@@ -958,6 +1023,17 @@ static ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_doulongvec_minmax,
         },
+#ifdef CONFIG_NUMA
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "numa_zonelist_order",
+                .data           = &numa_zonelist_order,
+                .maxlen         = NUMA_ZONELIST_ORDER_LEN,
+                .mode           = 0644,
+                .proc_handler   = &numa_zonelist_order_handler,
+                .strategy       = &sysctl_string,
+        },
+#endif
 #endif
 #if defined(CONFIG_X86_32) || \
    (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL))
@@ -972,6 +1048,10 @@ static ctl_table vm_table[] = {
                 .extra1         = &zero,
         },
 #endif
+/*
+ * NOTE: do not add new entries to this table unless you have read
+ * Documentation/sysctl/ctl_unnumbered.txt
+ */
         { .ctl_name = 0 }
 };
 
@@ -1069,7 +1149,10 @@ static ctl_table fs_table[] = {
                 .data           = &lease_break_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+                .extra2         = &two,
         },
         {
                 .ctl_name       = FS_AIO_NR,
@@ -1112,10 +1195,24 @@ static ctl_table fs_table[] = {
                 .child          = binfmt_misc_table,
         },
 #endif
+/*
+ * NOTE: do not add new entries to this table unless you have read
+ * Documentation/sysctl/ctl_unnumbered.txt
+ */
         { .ctl_name = 0 }
 };
 
 static ctl_table debug_table[] = {
+#ifdef CONFIG_X86
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "exception-trace",
+                .data           = &show_unhandled_signals,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+#endif
         { .ctl_name = 0 }
 };
 
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 906cae771585..059431ed67db 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -196,6 +196,8 @@ static int fill_pid(pid_t pid, struct task_struct *tsk,
 
         /* fill in basic acct fields */
         stats->version = TASKSTATS_VERSION;
+        stats->nvcsw = tsk->nvcsw;
+        stats->nivcsw = tsk->nivcsw;
         bacct_add_tsk(stats, tsk);
 
         /* fill in extended acct fields */
@@ -242,6 +244,8 @@ static int fill_tgid(pid_t tgid, struct task_struct *first,
                  */
                 delayacct_add_tsk(stats, tsk);
 
+                stats->nvcsw += tsk->nvcsw;
+                stats->nivcsw += tsk->nivcsw;
         } while_each_thread(first, tsk);
 
         unlock_task_sighand(first, &flags);
diff --git a/kernel/time.c b/kernel/time.c
index f04791f69408..5b81da08bbdb 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -58,9 +58,9 @@ EXPORT_SYMBOL(sys_tz);
 asmlinkage long sys_time(time_t __user * tloc)
 {
         time_t i;
-        struct timeval tv;
+        struct timespec tv;
 
-        do_gettimeofday(&tv);
+        getnstimeofday(&tv);
         i = tv.tv_sec;
 
         if (tloc) {
@@ -133,7 +133,6 @@ static inline void warp_clock(void)
         write_seqlock_irq(&xtime_lock);
         wall_to_monotonic.tv_sec -= sys_tz.tz_minuteswest * 60;
         xtime.tv_sec += sys_tz.tz_minuteswest * 60;
-        time_interpolator_reset();
         write_sequnlock_irq(&xtime_lock);
         clock_was_set();
 }
@@ -306,79 +305,6 @@ struct timespec timespec_trunc(struct timespec t, unsigned gran)
 }
 EXPORT_SYMBOL(timespec_trunc);
 
-#ifdef CONFIG_TIME_INTERPOLATION
-void getnstimeofday (struct timespec *tv)
-{
-        unsigned long seq,sec,nsec;
-
-        do {
-                seq = read_seqbegin(&xtime_lock);
-                sec = xtime.tv_sec;
-                nsec = xtime.tv_nsec+time_interpolator_get_offset();
-        } while (unlikely(read_seqretry(&xtime_lock, seq)));
-
-        while (unlikely(nsec >= NSEC_PER_SEC)) {
-                nsec -= NSEC_PER_SEC;
-                ++sec;
-        }
-        tv->tv_sec = sec;
-        tv->tv_nsec = nsec;
-}
-EXPORT_SYMBOL_GPL(getnstimeofday);
-
-int do_settimeofday (struct timespec *tv)
-{
-        time_t wtm_sec, sec = tv->tv_sec;
-        long wtm_nsec, nsec = tv->tv_nsec;
-
-        if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
-                return -EINVAL;
-
-        write_seqlock_irq(&xtime_lock);
-        {
-                wtm_sec  = wall_to_monotonic.tv_sec + (xtime.tv_sec - sec);
-                wtm_nsec = wall_to_monotonic.tv_nsec + (xtime.tv_nsec - nsec);
-
-                set_normalized_timespec(&xtime, sec, nsec);
-                set_normalized_timespec(&wall_to_monotonic, wtm_sec, wtm_nsec);
-
-                time_adjust = 0;                /* stop active adjtime() */
-                time_status |= STA_UNSYNC;
-                time_maxerror = NTP_PHASE_LIMIT;
-                time_esterror = NTP_PHASE_LIMIT;
-                time_interpolator_reset();
-        }
-        write_sequnlock_irq(&xtime_lock);
-        clock_was_set();
-        return 0;
-}
-EXPORT_SYMBOL(do_settimeofday);
-
-void do_gettimeofday (struct timeval *tv)
-{
-        unsigned long seq, nsec, usec, sec, offset;
-        do {
-                seq = read_seqbegin(&xtime_lock);
-                offset = time_interpolator_get_offset();
-                sec = xtime.tv_sec;
-                nsec = xtime.tv_nsec;
-        } while (unlikely(read_seqretry(&xtime_lock, seq)));
-
-        usec = (nsec + offset) / 1000;
-
-        while (unlikely(usec >= USEC_PER_SEC)) {
-                usec -= USEC_PER_SEC;
-                ++sec;
-        }
-
-        tv->tv_sec = sec;
-        tv->tv_usec = usec;
-}
-
-EXPORT_SYMBOL(do_gettimeofday);
-
-
-#else
 #ifndef CONFIG_GENERIC_TIME
 /*
  * Simulate gettimeofday using do_gettimeofday which only allows a timeval
@@ -394,7 +320,6 @@ void getnstimeofday(struct timespec *tv)
 }
 EXPORT_SYMBOL_GPL(getnstimeofday);
 #endif
-#endif
 
 /* Converts Gregorian date to seconds since 1970-01-01 00:00:00.
  * Assumes input in normal date format, i.e. 1980-12-31 23:59:59
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 76212b2a99de..2ad1c37b8dfe 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -205,47 +205,6 @@ void clockevents_exchange_device(struct clock_event_device *old,
 }
 
 /**
- * clockevents_request_device
- */
-struct clock_event_device *clockevents_request_device(unsigned int features,
-                                                      cpumask_t cpumask)
-{
-        struct clock_event_device *cur, *dev = NULL;
-        struct list_head *tmp;
-
-        spin_lock(&clockevents_lock);
-
-        list_for_each(tmp, &clockevent_devices) {
-                cur = list_entry(tmp, struct clock_event_device, list);
-
-                if ((cur->features & features) == features &&
-                    cpus_equal(cpumask, cur->cpumask)) {
-                        if (!dev || dev->rating < cur->rating)
-                                dev = cur;
-                }
-        }
-
-        clockevents_exchange_device(NULL, dev);
-
-        spin_unlock(&clockevents_lock);
-
-        return dev;
-}
-
-/**
- * clockevents_release_device
- */
-void clockevents_release_device(struct clock_event_device *dev)
-{
-        spin_lock(&clockevents_lock);
-
-        clockevents_exchange_device(dev, NULL);
-        clockevents_notify_released();
-
-        spin_unlock(&clockevents_lock);
-}
-
-/**
  * clockevents_notify - notification about relevant events
  */
 void clockevents_notify(unsigned long reason, void *arg)
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index cf53bb5814cb..cd91237dbfe3 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -10,10 +10,11 @@
 
 #include <linux/mm.h>
 #include <linux/time.h>
+#include <linux/timer.h>
 #include <linux/timex.h>
 #include <linux/jiffies.h>
 #include <linux/hrtimer.h>
-
+#include <linux/capability.h>
 #include <asm/div64.h>
 #include <asm/timex.h>
 
@@ -116,11 +117,6 @@ void second_overflow(void)
                 if (xtime.tv_sec % 86400 == 0) {
                         xtime.tv_sec--;
                         wall_to_monotonic.tv_sec++;
-                        /*
-                         * The timer interpolator will make time change
-                         * gradually instead of an immediate jump by one second
-                         */
-                        time_interpolator_update(-NSEC_PER_SEC);
                         time_state = TIME_OOP;
                         printk(KERN_NOTICE "Clock: inserting leap second "
                                         "23:59:60 UTC\n");
@@ -130,11 +126,6 @@ void second_overflow(void)
                 if ((xtime.tv_sec + 1) % 86400 == 0) {
                         xtime.tv_sec++;
                         wall_to_monotonic.tv_sec--;
-                        /*
-                         * Use of time interpolator for a gradual change of
-                         * time
-                         */
-                        time_interpolator_update(NSEC_PER_SEC);
                         time_state = TIME_WAIT;
                         printk(KERN_NOTICE "Clock: deleting leap second "
                                         "23:59:59 UTC\n");
@@ -185,12 +176,64 @@ u64 current_tick_length(void)
         return tick_length;
 }
 
+#ifdef CONFIG_GENERIC_CMOS_UPDATE
+
+/* Disable the cmos update - used by virtualization and embedded */
+int no_sync_cmos_clock  __read_mostly;
+
+static void sync_cmos_clock(unsigned long dummy);
+
+static DEFINE_TIMER(sync_cmos_timer, sync_cmos_clock, 0, 0);
 
-void __attribute__ ((weak)) notify_arch_cmos_timer(void)
+static void sync_cmos_clock(unsigned long dummy)
 {
-        return;
+        struct timespec now, next;
+        int fail = 1;
+
+        /*
+         * If we have an externally synchronized Linux clock, then update
+         * CMOS clock accordingly every ~11 minutes. Set_rtc_mmss() has to be
+         * called as close as possible to 500 ms before the new second starts.
+         * This code is run on a timer.  If the clock is set, that timer
+         * may not expire at the correct time.  Thus, we adjust...
+         */
+        if (!ntp_synced())
+                /*
+                 * Not synced, exit, do not restart a timer (if one is
+                 * running, let it run out).
+                 */
+                return;
+
+        getnstimeofday(&now);
+        if (abs(xtime.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2)
+                fail = update_persistent_clock(now);
+
+        next.tv_nsec = (NSEC_PER_SEC / 2) - now.tv_nsec;
+        if (next.tv_nsec <= 0)
+                next.tv_nsec += NSEC_PER_SEC;
+
+        if (!fail)
+                next.tv_sec = 659;
+        else
+                next.tv_sec = 0;
+
+        if (next.tv_nsec >= NSEC_PER_SEC) {
+                next.tv_sec++;
+                next.tv_nsec -= NSEC_PER_SEC;
+        }
+        mod_timer(&sync_cmos_timer, jiffies + timespec_to_jiffies(&next));
 }
 
+static void notify_cmos_timer(void)
+{
+        if (no_sync_cmos_clock)
+                mod_timer(&sync_cmos_timer, jiffies + 1);
+}
+
+#else
+static inline void notify_cmos_timer(void) { }
+#endif
+
 /* adjtimex mainly allows reading (and writing, if superuser) of
  * kernel time-keeping variables. used by xntpd.
  */
@@ -355,6 +398,6 @@ leave:	if ((time_status & (STA_UNSYNC|STA_CLOCKERR)) != 0)
         txc->stbcnt        = 0;
         write_sequnlock_irq(&xtime_lock);
         do_gettimeofday(&txc->time);
-        notify_arch_cmos_timer();
+        notify_cmos_timer();
         return(result);
 }
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 8001d37071f5..db8e0f3d409b 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -31,6 +31,12 @@ struct tick_device tick_broadcast_device;
 static cpumask_t tick_broadcast_mask;
 static DEFINE_SPINLOCK(tick_broadcast_lock);
 
+#ifdef CONFIG_TICK_ONESHOT
+static void tick_broadcast_clear_oneshot(int cpu);
+#else
+static inline void tick_broadcast_clear_oneshot(int cpu) { }
+#endif
+
 /*
  * Debugging: see timer_list.c
  */
@@ -49,7 +55,7 @@ cpumask_t *tick_get_broadcast_mask(void)
  */
 static void tick_broadcast_start_periodic(struct clock_event_device *bc)
 {
-        if (bc && bc->mode == CLOCK_EVT_MODE_SHUTDOWN)
+        if (bc)
                 tick_setup_periodic(bc, 1);
 }
 
@@ -99,8 +105,19 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
                 cpu_set(cpu, tick_broadcast_mask);
                 tick_broadcast_start_periodic(tick_broadcast_device.evtdev);
                 ret = 1;
-        }
+        } else {
+                /*
+                 * When the new device is not affected by the stop
+                 * feature and the cpu is marked in the broadcast mask
+                 * then clear the broadcast bit.
+                 */
+                if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+                        int cpu = smp_processor_id();
 
+                        cpu_clear(cpu, tick_broadcast_mask);
+                        tick_broadcast_clear_oneshot(cpu);
+                }
+        }
         spin_unlock_irqrestore(&tick_broadcast_lock, flags);
         return ret;
 }
@@ -299,7 +316,7 @@ void tick_suspend_broadcast(void)
         spin_lock_irqsave(&tick_broadcast_lock, flags);
 
         bc = tick_broadcast_device.evtdev;
-        if (bc && tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
+        if (bc)
                 clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
 
         spin_unlock_irqrestore(&tick_broadcast_lock, flags);
@@ -316,6 +333,8 @@ int tick_resume_broadcast(void)
         bc = tick_broadcast_device.evtdev;
 
         if (bc) {
+                clockevents_set_mode(bc, CLOCK_EVT_MODE_RESUME);
+
                 switch (tick_broadcast_device.mode) {
                 case TICKDEV_MODE_PERIODIC:
                         if(!cpus_empty(tick_broadcast_mask))
@@ -485,6 +504,16 @@ out:
         spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 }
 
+/*
+ * Reset the one shot broadcast for a cpu
+ *
+ * Called with tick_broadcast_lock held
+ */
+static void tick_broadcast_clear_oneshot(int cpu)
+{
+        cpu_clear(cpu, tick_broadcast_oneshot_mask);
+}
+
 /**
  * tick_broadcast_setup_highres - setup the broadcast device for highres
  */
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index a96ec9ab3454..77a21abc8716 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -318,12 +318,17 @@ static void tick_resume(void)
 {
         struct tick_device *td = &__get_cpu_var(tick_cpu_device);
         unsigned long flags;
+        int broadcast = tick_resume_broadcast();
 
         spin_lock_irqsave(&tick_device_lock, flags);
-        if (td->mode == TICKDEV_MODE_PERIODIC)
-                tick_setup_periodic(td->evtdev, 0);
-        else
-                tick_resume_oneshot();
+        clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_RESUME);
+
+        if (!broadcast) {
+                if (td->mode == TICKDEV_MODE_PERIODIC)
+                        tick_setup_periodic(td->evtdev, 0);
+                else
+                        tick_resume_oneshot();
+        }
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
@@ -360,8 +365,7 @@ static int tick_notify(struct notifier_block *nb, unsigned long reason,
                 break;
 
         case CLOCK_EVT_NOTIFY_RESUME:
-                if (!tick_resume_broadcast())
-                        tick_resume();
+                tick_resume();
                 break;
 
         default:
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index f6997ab0c3c9..0258d3115d54 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -73,8 +73,21 @@ int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *))
         struct clock_event_device *dev = td->evtdev;
 
         if (!dev || !(dev->features & CLOCK_EVT_FEAT_ONESHOT) ||
-            !tick_device_is_functional(dev))
+                    !tick_device_is_functional(dev)) {
+
+                printk(KERN_INFO "Clockevents: "
+                       "could not switch to one-shot mode:");
+                if (!dev) {
+                        printk(" no tick device\n");
+                } else {
+                        if (!tick_device_is_functional(dev))
+                                printk(" %s is not functional.\n", dev->name);
+                        else
+                                printk(" %s does not support one-shot mode.\n",
+                                       dev->name);
+                }
                 return -EINVAL;
+        }
 
         td->mode = TICKDEV_MODE_ONESHOT;
         dev->event_handler = handler;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 52db9e3c526e..b416995b9757 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -546,6 +546,7 @@ void tick_setup_sched_timer(void)
 {
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
         ktime_t now = ktime_get();
+        u64 offset;
 
         /*
          * Emulate tick processing via per-CPU hrtimers:
@@ -554,8 +555,12 @@ void tick_setup_sched_timer(void)
         ts->sched_timer.function = tick_sched_timer;
         ts->sched_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
 
-        /* Get the next period */
+        /* Get the next period (per cpu) */
         ts->sched_timer.expires = tick_init_jiffy_update();
+        offset = ktime_to_ns(tick_period) >> 1;
+        do_div(offset, NR_CPUS);
+        offset *= smp_processor_id();
+        ts->sched_timer.expires = ktime_add_ns(ts->sched_timer.expires, offset);
 
         for (;;) {
                 hrtimer_forward(&ts->sched_timer, now, tick_period);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 3d1042f82a68..88c81026e003 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -36,9 +36,17 @@ EXPORT_SYMBOL(xtime_lock);
  * at zero at system boot time, so wall_to_monotonic will be negative,
  * however, we will ALWAYS keep the tv_nsec part positive so we can use
  * the usual normalization.
+ *
+ * wall_to_monotonic is moved after resume from suspend for the monotonic
+ * time not to jump. We need to add total_sleep_time to wall_to_monotonic
+ * to get the real boot based time offset.
+ *
+ * - wall_to_monotonic is no longer the boot time, getboottime must be
+ * used instead.
  */
 struct timespec xtime __attribute__ ((aligned (16)));
 struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
+static unsigned long total_sleep_time;          /* seconds */
 
 EXPORT_SYMBOL(xtime);
 
@@ -251,6 +259,7 @@ void __init timekeeping_init(void)
         xtime.tv_nsec = 0;
         set_normalized_timespec(&wall_to_monotonic,
                 -xtime.tv_sec, -xtime.tv_nsec);
+        total_sleep_time = 0;
 
         write_sequnlock_irqrestore(&xtime_lock, flags);
 }
@@ -282,6 +291,7 @@ static int timekeeping_resume(struct sys_device *dev)
 
                 xtime.tv_sec += sleep_length;
                 wall_to_monotonic.tv_sec -= sleep_length;
+                total_sleep_time += sleep_length;
         }
         /* re-base the last cycle value */
         clock->cycle_last = clocksource_read(clock);
@@ -391,7 +401,7 @@ static __always_inline int clocksource_bigadjust(s64 error, s64 *interval,
  * this is optimized for the most common adjustments of -1,0,1,
  * for other values we can do a bit more work.
  */
-static void clocksource_adjust(struct clocksource *clock, s64 offset)
+static void clocksource_adjust(s64 offset)
 {
         s64 error, interval = clock->cycle_interval;
         int adj;
@@ -456,17 +466,13 @@ void update_wall_time(void)
                         second_overflow();
                 }
 
-                /* interpolator bits */
-                time_interpolator_update(clock->xtime_interval
-                                                >> clock->shift);
-
                 /* accumulate error between NTP and clock interval */
                 clock->error += current_tick_length();
                 clock->error -= clock->xtime_interval << (TICK_LENGTH_SHIFT - clock->shift);
         }
 
         /* correct the clock when NTP error is too big */
-        clocksource_adjust(clock, offset);
+        clocksource_adjust(offset);
 
         /* store full nanoseconds into xtime */
         xtime.tv_nsec = (s64)clock->xtime_nsec >> clock->shift;
@@ -476,3 +482,30 @@ void update_wall_time(void)
         change_clocksource();
         update_vsyscall(&xtime, clock);
 }
+
+/**
+ * getboottime - Return the real time of system boot.
+ * @ts:         pointer to the timespec to be set
+ *
+ * Returns the time of day in a timespec.
+ *
+ * This is based on the wall_to_monotonic offset and the total suspend
+ * time. Calls to settimeofday will affect the value returned (which
+ * basically means that however wrong your real time clock is at boot time,
+ * you get the right time here).
+ */
+void getboottime(struct timespec *ts)
+{
+        set_normalized_timespec(ts,
+                - (wall_to_monotonic.tv_sec + total_sleep_time),
+                - wall_to_monotonic.tv_nsec);
+}
+
+/**
+ * monotonic_to_bootbased - Convert the monotonic time to boot based.
+ * @ts:         pointer to the timespec to be converted
+ */
+void monotonic_to_bootbased(struct timespec *ts)
+{
+        ts->tv_sec += total_sleep_time;
+}
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 8bbcfb77f7d2..e5edc3a22a08 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -38,7 +38,7 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
 
 static void print_name_offset(struct seq_file *m, void *sym)
 {
-        char symname[KSYM_NAME_LEN+1];
+        char symname[KSYM_NAME_LEN];
 
         if (lookup_symbol_name((unsigned long)sym, symname) < 0)
                 SEQ_printf(m, "<%p>", sym);
diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
index 321693724ad7..8ed62fda16c6 100644
--- a/kernel/time/timer_stats.c
+++ b/kernel/time/timer_stats.c
@@ -68,6 +68,7 @@ struct entry {
          * Number of timeout events:
          */
         unsigned long           count;
+        unsigned int            timer_flag;
 
         /*
          * We save the command-line string to preserve
@@ -231,7 +232,8 @@ static struct entry *tstat_lookup(struct entry *entry, char *comm)
  * incremented. Otherwise the timer is registered in a free slot.
  */
 void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
-                              void *timerf, char * comm)
+                              void *timerf, char *comm,
+                              unsigned int timer_flag)
 {
         /*
          * It doesnt matter which lock we take:
@@ -249,6 +251,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
         input.start_func = startf;
         input.expire_func = timerf;
         input.pid = pid;
+        input.timer_flag = timer_flag;
 
         spin_lock_irqsave(lock, flags);
         if (!active)
@@ -266,7 +269,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
 
 static void print_name_offset(struct seq_file *m, unsigned long addr)
 {
-        char symname[KSYM_NAME_LEN+1];
+        char symname[KSYM_NAME_LEN];
 
         if (lookup_symbol_name(addr, symname) < 0)
                 seq_printf(m, "<%p>", (void *)addr);
@@ -295,7 +298,7 @@ static int tstats_show(struct seq_file *m, void *v)
         period = ktime_to_timespec(time);
         ms = period.tv_nsec / 1000000;
 
-        seq_puts(m, "Timer Stats Version: v0.1\n");
+        seq_puts(m, "Timer Stats Version: v0.2\n");
         seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
         if (atomic_read(&overflow_count))
                 seq_printf(m, "Overflow: %d entries\n",
@@ -303,8 +306,13 @@ static int tstats_show(struct seq_file *m, void *v)
 
         for (i = 0; i < nr_entries; i++) {
                 entry = entries + i;
-                seq_printf(m, "%4lu, %5d %-16s ",
+                if (entry->timer_flag & TIMER_STATS_FLAG_DEFERRABLE) {
+                        seq_printf(m, "%4luD, %5d %-16s ",
                                 entry->count, entry->pid, entry->comm);
+                } else {
+                        seq_printf(m, " %4lu, %5d %-16s ",
+                                entry->count, entry->pid, entry->comm);
+                }
 
                 print_name_offset(m, (unsigned long)entry->start_func);
                 seq_puts(m, " (");
diff --git a/kernel/timer.c b/kernel/timer.c
index 1a69705c2fb9..6ce1952eea7d 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -103,14 +103,14 @@ static inline tvec_base_t *tbase_get_base(tvec_base_t *base)
 static inline void timer_set_deferrable(struct timer_list *timer)
 {
         timer->base = ((tvec_base_t *)((unsigned long)(timer->base) |
-                                       TBASE_DEFERRABLE_FLAG));
+                                       TBASE_DEFERRABLE_FLAG));
 }
 
 static inline void
 timer_set_base(struct timer_list *timer, tvec_base_t *new_base)
 {
         timer->base = (tvec_base_t *)((unsigned long)(new_base) |
-                                      tbase_get_deferrable(timer->base));
+                                      tbase_get_deferrable(timer->base));
 }
 
 /**
@@ -305,6 +305,20 @@ void __timer_stats_timer_set_start_info(struct timer_list *timer, void *addr)
         memcpy(timer->start_comm, current->comm, TASK_COMM_LEN);
         timer->start_pid = current->pid;
 }
+
+static void timer_stats_account_timer(struct timer_list *timer)
+{
+        unsigned int flag = 0;
+
+        if (unlikely(tbase_get_deferrable(timer->base)))
+                flag |= TIMER_STATS_FLAG_DEFERRABLE;
+
+        timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
+                                 timer->function, timer->start_comm, flag);
+}
+
+#else
+static void timer_stats_account_timer(struct timer_list *timer) {}
 #endif
 
 /**
@@ -431,10 +445,10 @@ EXPORT_SYMBOL(__mod_timer);
 void add_timer_on(struct timer_list *timer, int cpu)
 {
         tvec_base_t *base = per_cpu(tvec_bases, cpu);
-        unsigned long flags;
+        unsigned long flags;
 
         timer_stats_timer_set_start_info(timer);
-        BUG_ON(timer_pending(timer) || !timer->function);
+        BUG_ON(timer_pending(timer) || !timer->function);
         spin_lock_irqsave(&base->lock, flags);
         timer_set_base(timer, base);
         internal_add_timer(base, timer);
@@ -613,7 +627,7 @@ static inline void __run_timers(tvec_base_t *base)
         while (time_after_eq(jiffies, base->timer_jiffies)) {
                 struct list_head work_list;
                 struct list_head *head = &work_list;
-                int index = base->timer_jiffies & TVR_MASK;
+                int index = base->timer_jiffies & TVR_MASK;
 
                 /*
                  * Cascade timers:
@@ -630,8 +644,8 @@ static inline void __run_timers(tvec_base_t *base)
                         unsigned long data;
 
                         timer = list_first_entry(head, struct timer_list,entry);
-                        fn = timer->function;
-                        data = timer->data;
+                        fn = timer->function;
+                        data = timer->data;
 
                         timer_stats_account_timer(timer);
 
@@ -675,8 +689,8 @@ static unsigned long __next_timer_interrupt(tvec_base_t *base)
         index = slot = timer_jiffies & TVR_MASK;
         do {
                 list_for_each_entry(nte, base->tv1.vec + slot, entry) {
-                        if (tbase_get_deferrable(nte->base))
-                                continue;
+                        if (tbase_get_deferrable(nte->base))
+                                continue;
 
                         found = 1;
                         expires = nte->expires;
@@ -820,7 +834,7 @@ void update_process_times(int user_tick)
         if (rcu_pending(cpu))
                 rcu_check_callbacks(cpu, user_tick);
         scheduler_tick();
-        run_posix_cpu_timers(p);
+        run_posix_cpu_timers(p);
 }
 
 /*
@@ -895,7 +909,7 @@ static inline void update_times(unsigned long ticks)
         update_wall_time();
         calc_load(ticks);
 }
-  
+
 /*
  * The 64-bit jiffies value is not atomic - you MUST NOT read it
  * without sampling the sequence number in xtime_lock.
@@ -1091,7 +1105,7 @@ asmlinkage long sys_gettid(void)
 /**
  * do_sysinfo - fill in sysinfo struct
  * @info: pointer to buffer to fill
- */ 
+ */
 int do_sysinfo(struct sysinfo *info)
 {
         unsigned long mem_total, sav_total;
@@ -1114,6 +1128,7 @@ int do_sysinfo(struct sysinfo *info)
                 getnstimeofday(&tp);
                 tp.tv_sec += wall_to_monotonic.tv_sec;
                 tp.tv_nsec += wall_to_monotonic.tv_nsec;
+                monotonic_to_bootbased(&tp);
                 if (tp.tv_nsec - NSEC_PER_SEC >= 0) {
                         tp.tv_nsec = tp.tv_nsec - NSEC_PER_SEC;
                         tp.tv_sec++;
@@ -1206,7 +1221,8 @@ static int __devinit init_timers_cpu(int cpu)
                         /*
                          * The APs use this path later in boot
                          */
-                        base = kmalloc_node(sizeof(*base), GFP_KERNEL,
+                        base = kmalloc_node(sizeof(*base),
+                                                GFP_KERNEL | __GFP_ZERO,
                                                 cpu_to_node(cpu));
                         if (!base)
                                 return -ENOMEM;
@@ -1217,7 +1233,6 @@ static int __devinit init_timers_cpu(int cpu)
                                 kfree(base);
                                 return -ENOMEM;
                         }
-                        memset(base, 0, sizeof(*base));
                         per_cpu(tvec_bases, cpu) = base;
                 } else {
                         /*
@@ -1334,194 +1349,6 @@ void __init init_timers(void)
         open_softirq(TIMER_SOFTIRQ, run_timer_softirq, NULL);
 }
 
-#ifdef CONFIG_TIME_INTERPOLATION
-
-struct time_interpolator *time_interpolator __read_mostly;
-static struct time_interpolator *time_interpolator_list __read_mostly;
-static DEFINE_SPINLOCK(time_interpolator_lock);
-
-static inline cycles_t time_interpolator_get_cycles(unsigned int src)
-{
-        unsigned long (*x)(void);
-
-        switch (src)
-        {
-                case TIME_SOURCE_FUNCTION:
-                        x = time_interpolator->addr;
-                        return x();
-
-                case TIME_SOURCE_MMIO64 :
-                        return readq_relaxed((void __iomem *)time_interpolator->addr);
-
-                case TIME_SOURCE_MMIO32 :
-                        return readl_relaxed((void __iomem *)time_interpolator->addr);
-
-                default: return get_cycles();
-        }
-}
-
-static inline u64 time_interpolator_get_counter(int writelock)
-{
-        unsigned int src = time_interpolator->source;
-
-        if (time_interpolator->jitter)
-        {
-                cycles_t lcycle;
-                cycles_t now;
-
-                do {
-                        lcycle = time_interpolator->last_cycle;
-                        now = time_interpolator_get_cycles(src);
-                        if (lcycle && time_after(lcycle, now))
-                                return lcycle;
-
-                        /* When holding the xtime write lock, there's no need
-                         * to add the overhead of the cmpxchg.  Readers are
-                         * force to retry until the write lock is released.
-                         */
-                        if (writelock) {
-                                time_interpolator->last_cycle = now;
-                                return now;
-                        }
-                        /* Keep track of the last timer value returned. The use of cmpxchg here
-                         * will cause contention in an SMP environment.
-                         */
-                } while (unlikely(cmpxchg(&time_interpolator->last_cycle, lcycle, now) != lcycle));
-                return now;
-        }
-        else
-                return time_interpolator_get_cycles(src);
-}
-
-void time_interpolator_reset(void)
-{
-        time_interpolator->offset = 0;
-        time_interpolator->last_counter = time_interpolator_get_counter(1);
-}
-
-#define GET_TI_NSECS(count,i) (((((count) - i->last_counter) & (i)->mask) * (i)->nsec_per_cyc) >> (i)->shift)
-
-unsigned long time_interpolator_get_offset(void)
-{
-        /* If we do not have a time interpolator set up then just return zero */
-        if (!time_interpolator)
-                return 0;
-
-        return time_interpolator->offset +
-                GET_TI_NSECS(time_interpolator_get_counter(0), time_interpolator);
-}
-
-#define INTERPOLATOR_ADJUST 65536
-#define INTERPOLATOR_MAX_SKIP 10*INTERPOLATOR_ADJUST
-
-void time_interpolator_update(long delta_nsec)
-{
-        u64 counter;
-        unsigned long offset;
-
-        /* If there is no time interpolator set up then do nothing */
-        if (!time_interpolator)
-                return;
-
-        /*
-         * The interpolator compensates for late ticks by accumulating the late
-         * time in time_interpolator->offset. A tick earlier than expected will
-         * lead to a reset of the offset and a corresponding jump of the clock
-         * forward. Again this only works if the interpolator clock is running
-         * slightly slower than the regular clock and the tuning logic insures
-         * that.
-         */
-
-        counter = time_interpolator_get_counter(1);
-        offset = time_interpolator->offset +
-                        GET_TI_NSECS(counter, time_interpolator);
-
-        if (delta_nsec < 0 || (unsigned long) delta_nsec < offset)
-                time_interpolator->offset = offset - delta_nsec;
-        else {
-                time_interpolator->skips++;
-                time_interpolator->ns_skipped += delta_nsec - offset;
-                time_interpolator->offset = 0;
-        }
-        time_interpolator->last_counter = counter;
-
-        /* Tuning logic for time interpolator invoked every minute or so.
-         * Decrease interpolator clock speed if no skips occurred and an offset is carried.
-         * Increase interpolator clock speed if we skip too much time.
-         */
-        if (jiffies % INTERPOLATOR_ADJUST == 0)
-        {
-                if (time_interpolator->skips == 0 && time_interpolator->offset > tick_nsec)
-                        time_interpolator->nsec_per_cyc--;
-                if (time_interpolator->ns_skipped > INTERPOLATOR_MAX_SKIP && time_interpolator->offset == 0)
-                        time_interpolator->nsec_per_cyc++;
-                time_interpolator->skips = 0;
-                time_interpolator->ns_skipped = 0;
-        }
-}
-
-static inline int
-is_better_time_interpolator(struct time_interpolator *new)
-{
-        if (!time_interpolator)
-                return 1;
-        return new->frequency > 2*time_interpolator->frequency ||
-            (unsigned long)new->drift < (unsigned long)time_interpolator->drift;
-}
-
-void
-register_time_interpolator(struct time_interpolator *ti)
-{
-        unsigned long flags;
-
-        /* Sanity check */
-        BUG_ON(ti->frequency == 0 || ti->mask == 0);
-
-        ti->nsec_per_cyc = ((u64)NSEC_PER_SEC << ti->shift) / ti->frequency;
-        spin_lock(&time_interpolator_lock);
-        write_seqlock_irqsave(&xtime_lock, flags);
-        if (is_better_time_interpolator(ti)) {
-                time_interpolator = ti;
-                time_interpolator_reset();
-        }
-        write_sequnlock_irqrestore(&xtime_lock, flags);
-
-        ti->next = time_interpolator_list;
-        time_interpolator_list = ti;
-        spin_unlock(&time_interpolator_lock);
-}
-
-void
-unregister_time_interpolator(struct time_interpolator *ti)
-{
-        struct time_interpolator *curr, **prev;
-        unsigned long flags;
-
-        spin_lock(&time_interpolator_lock);
-        prev = &time_interpolator_list;
-        for (curr = *prev; curr; curr = curr->next) {
-                if (curr == ti) {
-                        *prev = curr->next;
-                        break;
-                }
-                prev = &curr->next;
-        }
-
-        write_seqlock_irqsave(&xtime_lock, flags);
-        if (ti == time_interpolator) {
-                /* we lost the best time-interpolator: */
-                time_interpolator = NULL;
-                /* find the next-best interpolator */
-                for (curr = time_interpolator_list; curr; curr = curr->next)
-                        if (is_better_time_interpolator(curr))
-                                time_interpolator = curr;
-                time_interpolator_reset();
-        }
-        write_sequnlock_irqrestore(&xtime_lock, flags);
-        spin_unlock(&time_interpolator_lock);
-}
-#endif /* CONFIG_TIME_INTERPOLATION */
-
 /**
  * msleep - sleep safely even with waitqueue interruptions
  * @msecs: Time in milliseconds to sleep for
diff --git a/kernel/user.c b/kernel/user.c
index 4869563080e9..e7d11cef6998 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -14,20 +14,19 @@
 #include <linux/bitops.h>
 #include <linux/key.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/user_namespace.h>
 
 /*
  * UID task count cache, to get fast user lookup in "alloc_uid"
  * when changing user ID's (ie setuid() and friends).
  */
 
-#define UIDHASH_BITS (CONFIG_BASE_SMALL ? 3 : 8)
-#define UIDHASH_SZ              (1 << UIDHASH_BITS)
 #define UIDHASH_MASK            (UIDHASH_SZ - 1)
 #define __uidhashfn(uid)        (((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK)
-#define uidhashentry(uid)       (uidhash_table + __uidhashfn((uid)))
+#define uidhashentry(ns, uid)   ((ns)->uidhash_table + __uidhashfn((uid)))
 
 static struct kmem_cache *uid_cachep;
-static struct list_head uidhash_table[UIDHASH_SZ];
 
 /*
  * The uidhash_lock is mostly taken from process context, but it is
@@ -94,9 +93,10 @@ struct user_struct *find_user(uid_t uid)
 {
         struct user_struct *ret;
         unsigned long flags;
+        struct user_namespace *ns = current->nsproxy->user_ns;
 
         spin_lock_irqsave(&uidhash_lock, flags);
-        ret = uid_hash_find(uid, uidhashentry(uid));
+        ret = uid_hash_find(uid, uidhashentry(ns, uid));
         spin_unlock_irqrestore(&uidhash_lock, flags);
         return ret;
 }
@@ -120,9 +120,9 @@ void free_uid(struct user_struct *up)
         }
 }
 
-struct user_struct * alloc_uid(uid_t uid)
+struct user_struct * alloc_uid(struct user_namespace *ns, uid_t uid)
 {
-        struct list_head *hashent = uidhashentry(uid);
+        struct list_head *hashent = uidhashentry(ns, uid);
         struct user_struct *up;
 
         spin_lock_irq(&uidhash_lock);
@@ -208,14 +208,14 @@ static int __init uid_cache_init(void)
         int n;
 
         uid_cachep = kmem_cache_create("uid_cache", sizeof(struct user_struct),
-                        0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+                        0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
 
         for(n = 0; n < UIDHASH_SZ; ++n)
-                INIT_LIST_HEAD(uidhash_table + n);
+                INIT_LIST_HEAD(init_user_ns.uidhash_table + n);
 
         /* Insert the root user immediately (init already runs as root) */
         spin_lock_irq(&uidhash_lock);
-        uid_hash_insert(&root_user, uidhashentry(0));
+        uid_hash_insert(&root_user, uidhashentry(&init_user_ns, 0));
         spin_unlock_irq(&uidhash_lock);
 
         return 0;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
new file mode 100644
index 000000000000..d055d987850c
--- /dev/null
+++ b/kernel/user_namespace.c
@@ -0,0 +1,87 @@
+/*
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License as
+ *  published by the Free Software Foundation, version 2 of the
+ *  License.
+ */
+
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/nsproxy.h>
+#include <linux/user_namespace.h>
+
+struct user_namespace init_user_ns = {
+        .kref = {
+                .refcount       = ATOMIC_INIT(2),
+        },
+        .root_user = &root_user,
+};
+
+EXPORT_SYMBOL_GPL(init_user_ns);
+
+#ifdef CONFIG_USER_NS
+
+/*
+ * Clone a new ns copying an original user ns, setting refcount to 1
+ * @old_ns: namespace to clone
+ * Return NULL on error (failure to kmalloc), new ns otherwise
+ */
+static struct user_namespace *clone_user_ns(struct user_namespace *old_ns)
+{
+        struct user_namespace *ns;
+        struct user_struct *new_user;
+        int n;
+
+        ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
+        if (!ns)
+                return ERR_PTR(-ENOMEM);
+
+        kref_init(&ns->kref);
+
+        for (n = 0; n < UIDHASH_SZ; ++n)
+                INIT_LIST_HEAD(ns->uidhash_table + n);
+
+        /* Insert new root user.  */
+        ns->root_user = alloc_uid(ns, 0);
+        if (!ns->root_user) {
+                kfree(ns);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        /* Reset current->user with a new one */
+        new_user = alloc_uid(ns, current->uid);
+        if (!new_user) {
+                free_uid(ns->root_user);
+                kfree(ns);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        switch_uid(new_user);
+        return ns;
+}
+
+struct user_namespace * copy_user_ns(int flags, struct user_namespace *old_ns)
+{
+        struct user_namespace *new_ns;
+
+        BUG_ON(!old_ns);
+        get_user_ns(old_ns);
+
+        if (!(flags & CLONE_NEWUSER))
+                return old_ns;
+
+        new_ns = clone_user_ns(old_ns);
+
+        put_user_ns(old_ns);
+        return new_ns;
+}
+
+void free_user_ns(struct kref *kref)
+{
+        struct user_namespace *ns;
+
+        ns = container_of(kref, struct user_namespace, kref);
+        kfree(ns);
+}
+
+#endif /* CONFIG_USER_NS */
diff --git a/kernel/utsname.c b/kernel/utsname.c
index 160c8c5136bd..9d8180a0f0d8 100644
--- a/kernel/utsname.c
+++ b/kernel/utsname.c
@@ -13,6 +13,7 @@
 #include <linux/uts.h>
 #include <linux/utsname.h>
 #include <linux/version.h>
+#include <linux/err.h>
 
 /*
  * Clone a new ns copying an original utsname, setting refcount to 1
@@ -24,10 +25,11 @@ static struct uts_namespace *clone_uts_ns(struct uts_namespace *old_ns)
         struct uts_namespace *ns;
 
         ns = kmalloc(sizeof(struct uts_namespace), GFP_KERNEL);
-        if (ns) {
-                memcpy(&ns->name, &old_ns->name, sizeof(ns->name));
-                kref_init(&ns->kref);
-        }
+        if (!ns)
+                return ERR_PTR(-ENOMEM);
+
+        memcpy(&ns->name, &old_ns->name, sizeof(ns->name));
+        kref_init(&ns->kref);
         return ns;
 }
 
@@ -37,7 +39,7 @@ static struct uts_namespace *clone_uts_ns(struct uts_namespace *old_ns)
  * utsname of this process won't be seen by parent, and vice
  * versa.
  */
-struct uts_namespace *copy_utsname(int flags, struct uts_namespace *old_ns)
+struct uts_namespace *copy_utsname(unsigned long flags, struct uts_namespace *old_ns)
 {
         struct uts_namespace *new_ns;
 
diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
index f22b9dbd2a9c..c76c06466bfd 100644
--- a/kernel/utsname_sysctl.c
+++ b/kernel/utsname_sysctl.c
@@ -18,10 +18,7 @@
 static void *get_uts(ctl_table *table, int write)
 {
         char *which = table->data;
-#ifdef CONFIG_UTS_NS
-        struct uts_namespace *uts_ns = current->nsproxy->uts_ns;
-        which = (which - (char *)&init_uts_ns) + (char *)uts_ns;
-#endif
+
         if (!write)
                 down_read(&uts_sem);
         else
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 3bebf73be976..58e5c152a6bb 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -282,8 +282,8 @@ static int worker_thread(void *__cwq)
         struct cpu_workqueue_struct *cwq = __cwq;
         DEFINE_WAIT(wait);
 
-        if (!cwq->wq->freezeable)
-                current->flags |= PF_NOFREEZE;
+        if (cwq->wq->freezeable)
+                set_freezable();
 
         set_user_nice(current, -5);
 
@@ -382,16 +382,16 @@ void fastcall flush_workqueue(struct workqueue_struct *wq)
 EXPORT_SYMBOL_GPL(flush_workqueue);
 
 /*
- * Upon a successful return, the caller "owns" WORK_STRUCT_PENDING bit,
+ * Upon a successful return (>= 0), the caller "owns" WORK_STRUCT_PENDING bit,
  * so this work can't be re-armed in any way.
  */
 static int try_to_grab_pending(struct work_struct *work)
 {
         struct cpu_workqueue_struct *cwq;
-        int ret = 0;
+        int ret = -1;
 
         if (!test_and_set_bit(WORK_STRUCT_PENDING, work_data_bits(work)))
-                return 1;
+                return 0;
 
         /*
          * The queueing is in progress, or it is already queued. Try to
@@ -457,10 +457,28 @@ static void wait_on_work(struct work_struct *work)
                 wait_on_cpu_work(per_cpu_ptr(wq->cpu_wq, cpu), work);
 }
 
+static int __cancel_work_timer(struct work_struct *work,
+                                struct timer_list* timer)
+{
+        int ret;
+
+        do {
+                ret = (timer && likely(del_timer(timer)));
+                if (!ret)
+                        ret = try_to_grab_pending(work);
+                wait_on_work(work);
+        } while (unlikely(ret < 0));
+
+        work_clear_pending(work);
+        return ret;
+}
+
 /**
  * cancel_work_sync - block until a work_struct's callback has terminated
  * @work: the work which is to be flushed
  *
+ * Returns true if @work was pending.
+ *
  * cancel_work_sync() will cancel the work if it is queued. If the work's
  * callback appears to be running, cancel_work_sync() will block until it
  * has completed.
@@ -476,31 +494,26 @@ static void wait_on_work(struct work_struct *work)
  * The caller must ensure that workqueue_struct on which this work was last
  * queued can't be destroyed before this function returns.
  */
-void cancel_work_sync(struct work_struct *work)
+int cancel_work_sync(struct work_struct *work)
 {
-        while (!try_to_grab_pending(work))
-                cpu_relax();
-        wait_on_work(work);
-        work_clear_pending(work);
+        return __cancel_work_timer(work, NULL);
 }
 EXPORT_SYMBOL_GPL(cancel_work_sync);
 
 /**
- * cancel_rearming_delayed_work - reliably kill off a delayed work.
+ * cancel_delayed_work_sync - reliably kill off a delayed work.
  * @dwork: the delayed work struct
  *
+ * Returns true if @dwork was pending.
+ *
  * It is possible to use this function if @dwork rearms itself via queue_work()
  * or queue_delayed_work(). See also the comment for cancel_work_sync().
  */
-void cancel_rearming_delayed_work(struct delayed_work *dwork)
+int cancel_delayed_work_sync(struct delayed_work *dwork)
 {
-        while (!del_timer(&dwork->timer) &&
-               !try_to_grab_pending(&dwork->work))
-                cpu_relax();
-        wait_on_work(&dwork->work);
-        work_clear_pending(&dwork->work);
+        return __cancel_work_timer(&dwork->work, &dwork->timer);
 }
-EXPORT_SYMBOL(cancel_rearming_delayed_work);
+EXPORT_SYMBOL(cancel_delayed_work_sync);
 
 static struct workqueue_struct *keventd_wq __read_mostly;
 
@@ -739,18 +752,17 @@ static void cleanup_workqueue_thread(struct cpu_workqueue_struct *cwq, int cpu)
         if (cwq->thread == NULL)
                 return;
 
+        flush_cpu_workqueue(cwq);
         /*
-         * If the caller is CPU_DEAD the single flush_cpu_workqueue()
-         * is not enough, a concurrent flush_workqueue() can insert a
-         * barrier after us.
+         * If the caller is CPU_DEAD and cwq->worklist was not empty,
+         * a concurrent flush_workqueue() can insert a barrier after us.
+         * However, in that case run_workqueue() won't return and check
+         * kthread_should_stop() until it flushes all work_struct's.
          * When ->worklist becomes empty it is safe to exit because no
          * more work_structs can be queued on this cwq: flush_workqueue
          * checks list_empty(), and a "normal" queue_work() can't use
          * a dead CPU.
          */
-        while (flush_cpu_workqueue(cwq))
-                ;
-
         kthread_stop(cwq->thread);
         cwq->thread = NULL;
 }