38 files changed, 2146 insertions, 959 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index e4791b3ba55d..bab1dffe37e9 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -93,6 +93,7 @@ obj-$(CONFIG_HAVE_GENERIC_DMA_COHERENT) += dma-coherent.o
 obj-$(CONFIG_FUNCTION_TRACER) += trace/
 obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_SMP) += sched_cpupri.o
+obj-$(CONFIG_SLOW_WORK) += slow-work.o
 
 ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
 # According to Alan Modra <alan@linuxcare.com.au>, the -fno-omit-frame-pointer is
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 8cbddff6c283..2bfc64786765 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -66,6 +66,7 @@
 #include <linux/syscalls.h>
 #include <linux/inotify.h>
 #include <linux/capability.h>
+#include <linux/fs_struct.h>
 
 #include "audit.h"
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index c500ca7239b2..382109b5baeb 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -94,7 +94,6 @@ struct cgroupfs_root {
         char release_agent_path[PATH_MAX];
 };
 
-
 /*
  * The "rootnode" hierarchy is the "dummy hierarchy", reserved for the
  * subsystems that are otherwise unattached - it never has more than a
@@ -102,6 +101,39 @@ struct cgroupfs_root {
  */
 static struct cgroupfs_root rootnode;
 
+/*
+ * CSS ID -- ID per subsys's Cgroup Subsys State(CSS). used only when
+ * cgroup_subsys->use_id != 0.
+ */
+#define CSS_ID_MAX      (65535)
+struct css_id {
+        /*
+         * The css to which this ID points. This pointer is set to valid value
+         * after cgroup is populated. If cgroup is removed, this will be NULL.
+         * This pointer is expected to be RCU-safe because destroy()
+         * is called after synchronize_rcu(). But for safe use, css_is_removed()
+         * css_tryget() should be used for avoiding race.
+         */
+        struct cgroup_subsys_state *css;
+        /*
+         * ID of this css.
+         */
+        unsigned short id;
+        /*
+         * Depth in hierarchy which this ID belongs to.
+         */
+        unsigned short depth;
+        /*
+         * ID is freed by RCU. (and lookup routine is RCU safe.)
+         */
+        struct rcu_head rcu_head;
+        /*
+         * Hierarchy of CSS ID belongs to.
+         */
+        unsigned short stack[0]; /* Array of Length (depth+1) */
+};
+
+
 /* The list of hierarchy roots */
 
 static LIST_HEAD(roots);
@@ -185,6 +217,8 @@ struct cg_cgroup_link {
 static struct css_set init_css_set;
 static struct cg_cgroup_link init_css_set_link;
 
+static int cgroup_subsys_init_idr(struct cgroup_subsys *ss);
+
 /* css_set_lock protects the list of css_set objects, and the
  * chain of tasks off each css_set.  Nests outside task->alloc_lock
  * due to cgroup_iter_start() */
@@ -567,6 +601,9 @@ static struct backing_dev_info cgroup_backing_dev_info = {
         .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 
+static int alloc_css_id(struct cgroup_subsys *ss,
+                        struct cgroup *parent, struct cgroup *child);
+
 static struct inode *cgroup_new_inode(mode_t mode, struct super_block *sb)
 {
         struct inode *inode = new_inode(sb);
@@ -585,13 +622,18 @@ static struct inode *cgroup_new_inode(mode_t mode, struct super_block *sb)
  * Call subsys's pre_destroy handler.
  * This is called before css refcnt check.
  */
-static void cgroup_call_pre_destroy(struct cgroup *cgrp)
+static int cgroup_call_pre_destroy(struct cgroup *cgrp)
 {
         struct cgroup_subsys *ss;
+        int ret = 0;
+
         for_each_subsys(cgrp->root, ss)
-                if (ss->pre_destroy)
-                        ss->pre_destroy(ss, cgrp);
-        return;
+                if (ss->pre_destroy) {
+                        ret = ss->pre_destroy(ss, cgrp);
+                        if (ret)
+                                break;
+                }
+        return ret;
 }
 
 static void free_cgroup_rcu(struct rcu_head *obj)
@@ -685,6 +727,22 @@ static void cgroup_d_remove_dir(struct dentry *dentry)
         remove_dir(dentry);
 }
 
+/*
+ * A queue for waiters to do rmdir() cgroup. A tasks will sleep when
+ * cgroup->count == 0 && list_empty(&cgroup->children) && subsys has some
+ * reference to css->refcnt. In general, this refcnt is expected to goes down
+ * to zero, soon.
+ *
+ * CGRP_WAIT_ON_RMDIR flag is modified under cgroup's inode->i_mutex;
+ */
+DECLARE_WAIT_QUEUE_HEAD(cgroup_rmdir_waitq);
+
+static void cgroup_wakeup_rmdir_waiters(const struct cgroup *cgrp)
+{
+        if (unlikely(test_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags)))
+                wake_up_all(&cgroup_rmdir_waitq);
+}
+
 static int rebind_subsystems(struct cgroupfs_root *root,
                               unsigned long final_bits)
 {
@@ -857,16 +915,16 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
         }
 
         ret = rebind_subsystems(root, opts.subsys_bits);
+        if (ret)
+                goto out_unlock;
 
         /* (re)populate subsystem files */
-        if (!ret)
-                cgroup_populate_dir(cgrp);
+        cgroup_populate_dir(cgrp);
 
         if (opts.release_agent)
                 strcpy(root->release_agent_path, opts.release_agent);
  out_unlock:
-        if (opts.release_agent)
-                kfree(opts.release_agent);
+        kfree(opts.release_agent);
         mutex_unlock(&cgroup_mutex);
         mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
         return ret;
@@ -969,15 +1027,13 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
         /* First find the desired set of subsystems */
         ret = parse_cgroupfs_options(data, &opts);
         if (ret) {
-                if (opts.release_agent)
-                        kfree(opts.release_agent);
+                kfree(opts.release_agent);
                 return ret;
         }
 
         root = kzalloc(sizeof(*root), GFP_KERNEL);
         if (!root) {
-                if (opts.release_agent)
-                        kfree(opts.release_agent);
+                kfree(opts.release_agent);
                 return -ENOMEM;
         }
 
@@ -1280,6 +1336,12 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
         set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
         synchronize_rcu();
         put_css_set(cg);
+
+        /*
+         * wake up rmdir() waiter. the rmdir should fail since the cgroup
+         * is no longer empty.
+         */
+        cgroup_wakeup_rmdir_waiters(cgrp);
         return 0;
 }
 
@@ -1625,7 +1687,7 @@ static struct inode_operations cgroup_dir_inode_operations = {
         .rename = cgroup_rename,
 };
 
-static int cgroup_create_file(struct dentry *dentry, int mode,
+static int cgroup_create_file(struct dentry *dentry, mode_t mode,
                                 struct super_block *sb)
 {
         static const struct dentry_operations cgroup_dops = {
@@ -1671,7 +1733,7 @@ static int cgroup_create_file(struct dentry *dentry, int mode,
  * @mode: mode to set on new directory.
  */
 static int cgroup_create_dir(struct cgroup *cgrp, struct dentry *dentry,
-                                int mode)
+                                mode_t mode)
 {
         struct dentry *parent;
         int error = 0;
@@ -1689,6 +1751,33 @@ static int cgroup_create_dir(struct cgroup *cgrp, struct dentry *dentry,
         return error;
 }
 
+/**
+ * cgroup_file_mode - deduce file mode of a control file
+ * @cft: the control file in question
+ *
+ * returns cft->mode if ->mode is not 0
+ * returns S_IRUGO|S_IWUSR if it has both a read and a write handler
+ * returns S_IRUGO if it has only a read handler
+ * returns S_IWUSR if it has only a write hander
+ */
+static mode_t cgroup_file_mode(const struct cftype *cft)
+{
+        mode_t mode = 0;
+
+        if (cft->mode)
+                return cft->mode;
+
+        if (cft->read || cft->read_u64 || cft->read_s64 ||
+            cft->read_map || cft->read_seq_string)
+                mode |= S_IRUGO;
+
+        if (cft->write || cft->write_u64 || cft->write_s64 ||
+            cft->write_string || cft->trigger)
+                mode |= S_IWUSR;
+
+        return mode;
+}
+
 int cgroup_add_file(struct cgroup *cgrp,
                        struct cgroup_subsys *subsys,
                        const struct cftype *cft)
@@ -1696,6 +1785,7 @@ int cgroup_add_file(struct cgroup *cgrp,
         struct dentry *dir = cgrp->dentry;
         struct dentry *dentry;
         int error;
+        mode_t mode;
 
         char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
         if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) {
@@ -1706,7 +1796,8 @@ int cgroup_add_file(struct cgroup *cgrp,
         BUG_ON(!mutex_is_locked(&dir->d_inode->i_mutex));
         dentry = lookup_one_len(name, dir, strlen(name));
         if (!IS_ERR(dentry)) {
-                error = cgroup_create_file(dentry, 0644 | S_IFREG,
+                mode = cgroup_file_mode(cft);
+                error = cgroup_create_file(dentry, mode | S_IFREG,
                                                 cgrp->root->sb);
                 if (!error)
                         dentry->d_fsdata = (void *)cft;
@@ -2288,6 +2379,7 @@ static struct cftype files[] = {
                 .write_u64 = cgroup_tasks_write,
                 .release = cgroup_tasks_release,
                 .private = FILE_TASKLIST,
+                .mode = S_IRUGO | S_IWUSR,
         },
 
         {
@@ -2327,6 +2419,17 @@ static int cgroup_populate_dir(struct cgroup *cgrp)
                 if (ss->populate && (err = ss->populate(ss, cgrp)) < 0)
                         return err;
         }
+        /* This cgroup is ready now */
+        for_each_subsys(cgrp->root, ss) {
+                struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
+                /*
+                 * Update id->css pointer and make this css visible from
+                 * CSS ID functions. This pointer will be dereferened
+                 * from RCU-read-side without locks.
+                 */
+                if (css->id)
+                        rcu_assign_pointer(css->id->css, css);
+        }
 
         return 0;
 }
@@ -2338,6 +2441,7 @@ static void init_cgroup_css(struct cgroup_subsys_state *css,
         css->cgroup = cgrp;
         atomic_set(&css->refcnt, 1);
         css->flags = 0;
+        css->id = NULL;
         if (cgrp == dummytop)
                 set_bit(CSS_ROOT, &css->flags);
         BUG_ON(cgrp->subsys[ss->subsys_id]);
@@ -2376,7 +2480,7 @@ static void cgroup_unlock_hierarchy(struct cgroupfs_root *root)
  * Must be called with the mutex on the parent inode held
  */
 static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
-                             int mode)
+                             mode_t mode)
 {
         struct cgroup *cgrp;
         struct cgroupfs_root *root = parent->root;
@@ -2413,6 +2517,10 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                         goto err_destroy;
                 }
                 init_cgroup_css(css, ss, cgrp);
+                if (ss->use_id)
+                        if (alloc_css_id(ss, parent, cgrp))
+                                goto err_destroy;
+                /* At error, ->destroy() callback has to free assigned ID. */
         }
 
         cgroup_lock_hierarchy(root);
@@ -2555,9 +2663,11 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
         struct cgroup *cgrp = dentry->d_fsdata;
         struct dentry *d;
         struct cgroup *parent;
+        DEFINE_WAIT(wait);
+        int ret;
 
         /* the vfs holds both inode->i_mutex already */
-
+again:
         mutex_lock(&cgroup_mutex);
         if (atomic_read(&cgrp->count) != 0) {
                 mutex_unlock(&cgroup_mutex);
@@ -2573,17 +2683,39 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
          * Call pre_destroy handlers of subsys. Notify subsystems
          * that rmdir() request comes.
          */
-        cgroup_call_pre_destroy(cgrp);
+        ret = cgroup_call_pre_destroy(cgrp);
+        if (ret)
+                return ret;
 
         mutex_lock(&cgroup_mutex);
         parent = cgrp->parent;
-
-        if (atomic_read(&cgrp->count)
-            || !list_empty(&cgrp->children)
-            || !cgroup_clear_css_refs(cgrp)) {
+        if (atomic_read(&cgrp->count) || !list_empty(&cgrp->children)) {
                 mutex_unlock(&cgroup_mutex);
                 return -EBUSY;
         }
+        /*
+         * css_put/get is provided for subsys to grab refcnt to css. In typical
+         * case, subsystem has no reference after pre_destroy(). But, under
+         * hierarchy management, some *temporal* refcnt can be hold.
+         * To avoid returning -EBUSY to a user, waitqueue is used. If subsys
+         * is really busy, it should return -EBUSY at pre_destroy(). wake_up
+         * is called when css_put() is called and refcnt goes down to 0.
+         */
+        set_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
+        prepare_to_wait(&cgroup_rmdir_waitq, &wait, TASK_INTERRUPTIBLE);
+
+        if (!cgroup_clear_css_refs(cgrp)) {
+                mutex_unlock(&cgroup_mutex);
+                schedule();
+                finish_wait(&cgroup_rmdir_waitq, &wait);
+                clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
+                if (signal_pending(current))
+                        return -EINTR;
+                goto again;
+        }
+        /* NO css_tryget() can success after here. */
+        finish_wait(&cgroup_rmdir_waitq, &wait);
+        clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
 
         spin_lock(&release_list_lock);
         set_bit(CGRP_REMOVED, &cgrp->flags);
@@ -2708,6 +2840,8 @@ int __init cgroup_init(void)
                 struct cgroup_subsys *ss = subsys[i];
                 if (!ss->early_init)
                         cgroup_init_subsys(ss);
+                if (ss->use_id)
+                        cgroup_subsys_init_idr(ss);
         }
 
         /* Add init_css_set to the hash table */
@@ -3084,18 +3218,19 @@ int cgroup_clone(struct task_struct *tsk, struct cgroup_subsys *subsys,
 }
 
 /**
- * cgroup_is_descendant - see if @cgrp is a descendant of current task's cgrp
+ * cgroup_is_descendant - see if @cgrp is a descendant of @task's cgrp
  * @cgrp: the cgroup in question
+ * @task: the task in question
  *
- * See if @cgrp is a descendant of the current task's cgroup in
- * the appropriate hierarchy.
+ * See if @cgrp is a descendant of @task's cgroup in the appropriate
+ * hierarchy.
  *
  * If we are sending in dummytop, then presumably we are creating
  * the top cgroup in the subsystem.
  *
  * Called only by the ns (nsproxy) cgroup.
  */
-int cgroup_is_descendant(const struct cgroup *cgrp)
+int cgroup_is_descendant(const struct cgroup *cgrp, struct task_struct *task)
 {
         int ret;
         struct cgroup *target;
@@ -3105,7 +3240,7 @@ int cgroup_is_descendant(const struct cgroup *cgrp)
                 return 1;
 
         get_first_subsys(cgrp, NULL, &subsys_id);
-        target = task_cgroup(current, subsys_id);
+        target = task_cgroup(task, subsys_id);
         while (cgrp != target && cgrp!= cgrp->top_cgroup)
                 cgrp = cgrp->parent;
         ret = (cgrp == target);
@@ -3138,10 +3273,12 @@ void __css_put(struct cgroup_subsys_state *css)
 {
         struct cgroup *cgrp = css->cgroup;
         rcu_read_lock();
-        if ((atomic_dec_return(&css->refcnt) == 1) &&
-            notify_on_release(cgrp)) {
-                set_bit(CGRP_RELEASABLE, &cgrp->flags);
-                check_for_release(cgrp);
+        if (atomic_dec_return(&css->refcnt) == 1) {
+                if (notify_on_release(cgrp)) {
+                        set_bit(CGRP_RELEASABLE, &cgrp->flags);
+                        check_for_release(cgrp);
+                }
+                cgroup_wakeup_rmdir_waiters(cgrp);
         }
         rcu_read_unlock();
 }
@@ -3241,3 +3378,232 @@ static int __init cgroup_disable(char *str)
         return 1;
 }
 __setup("cgroup_disable=", cgroup_disable);
+
+/*
+ * Functons for CSS ID.
+ */
+
+/*
+ *To get ID other than 0, this should be called when !cgroup_is_removed().
+ */
+unsigned short css_id(struct cgroup_subsys_state *css)
+{
+        struct css_id *cssid = rcu_dereference(css->id);
+
+        if (cssid)
+                return cssid->id;
+        return 0;
+}
+
+unsigned short css_depth(struct cgroup_subsys_state *css)
+{
+        struct css_id *cssid = rcu_dereference(css->id);
+
+        if (cssid)
+                return cssid->depth;
+        return 0;
+}
+
+bool css_is_ancestor(struct cgroup_subsys_state *child,
+                    const struct cgroup_subsys_state *root)
+{
+        struct css_id *child_id = rcu_dereference(child->id);
+        struct css_id *root_id = rcu_dereference(root->id);
+
+        if (!child_id || !root_id || (child_id->depth < root_id->depth))
+                return false;
+        return child_id->stack[root_id->depth] == root_id->id;
+}
+
+static void __free_css_id_cb(struct rcu_head *head)
+{
+        struct css_id *id;
+
+        id = container_of(head, struct css_id, rcu_head);
+        kfree(id);
+}
+
+void free_css_id(struct cgroup_subsys *ss, struct cgroup_subsys_state *css)
+{
+        struct css_id *id = css->id;
+        /* When this is called before css_id initialization, id can be NULL */
+        if (!id)
+                return;
+
+        BUG_ON(!ss->use_id);
+
+        rcu_assign_pointer(id->css, NULL);
+        rcu_assign_pointer(css->id, NULL);
+        spin_lock(&ss->id_lock);
+        idr_remove(&ss->idr, id->id);
+        spin_unlock(&ss->id_lock);
+        call_rcu(&id->rcu_head, __free_css_id_cb);
+}
+
+/*
+ * This is called by init or create(). Then, calls to this function are
+ * always serialized (By cgroup_mutex() at create()).
+ */
+
+static struct css_id *get_new_cssid(struct cgroup_subsys *ss, int depth)
+{
+        struct css_id *newid;
+        int myid, error, size;
+
+        BUG_ON(!ss->use_id);
+
+        size = sizeof(*newid) + sizeof(unsigned short) * (depth + 1);
+        newid = kzalloc(size, GFP_KERNEL);
+        if (!newid)
+                return ERR_PTR(-ENOMEM);
+        /* get id */
+        if (unlikely(!idr_pre_get(&ss->idr, GFP_KERNEL))) {
+                error = -ENOMEM;
+                goto err_out;
+        }
+        spin_lock(&ss->id_lock);
+        /* Don't use 0. allocates an ID of 1-65535 */
+        error = idr_get_new_above(&ss->idr, newid, 1, &myid);
+        spin_unlock(&ss->id_lock);
+
+        /* Returns error when there are no free spaces for new ID.*/
+        if (error) {
+                error = -ENOSPC;
+                goto err_out;
+        }
+        if (myid > CSS_ID_MAX)
+                goto remove_idr;
+
+        newid->id = myid;
+        newid->depth = depth;
+        return newid;
+remove_idr:
+        error = -ENOSPC;
+        spin_lock(&ss->id_lock);
+        idr_remove(&ss->idr, myid);
+        spin_unlock(&ss->id_lock);
+err_out:
+        kfree(newid);
+        return ERR_PTR(error);
+
+}
+
+static int __init cgroup_subsys_init_idr(struct cgroup_subsys *ss)
+{
+        struct css_id *newid;
+        struct cgroup_subsys_state *rootcss;
+
+        spin_lock_init(&ss->id_lock);
+        idr_init(&ss->idr);
+
+        rootcss = init_css_set.subsys[ss->subsys_id];
+        newid = get_new_cssid(ss, 0);
+        if (IS_ERR(newid))
+                return PTR_ERR(newid);
+
+        newid->stack[0] = newid->id;
+        newid->css = rootcss;
+        rootcss->id = newid;
+        return 0;
+}
+
+static int alloc_css_id(struct cgroup_subsys *ss, struct cgroup *parent,
+                        struct cgroup *child)
+{
+        int subsys_id, i, depth = 0;
+        struct cgroup_subsys_state *parent_css, *child_css;
+        struct css_id *child_id, *parent_id = NULL;
+
+        subsys_id = ss->subsys_id;
+        parent_css = parent->subsys[subsys_id];
+        child_css = child->subsys[subsys_id];
+        depth = css_depth(parent_css) + 1;
+        parent_id = parent_css->id;
+
+        child_id = get_new_cssid(ss, depth);
+        if (IS_ERR(child_id))
+                return PTR_ERR(child_id);
+
+        for (i = 0; i < depth; i++)
+                child_id->stack[i] = parent_id->stack[i];
+        child_id->stack[depth] = child_id->id;
+        /*
+         * child_id->css pointer will be set after this cgroup is available
+         * see cgroup_populate_dir()
+         */
+        rcu_assign_pointer(child_css->id, child_id);
+
+        return 0;
+}
+
+/**
+ * css_lookup - lookup css by id
+ * @ss: cgroup subsys to be looked into.
+ * @id: the id
+ *
+ * Returns pointer to cgroup_subsys_state if there is valid one with id.
+ * NULL if not. Should be called under rcu_read_lock()
+ */
+struct cgroup_subsys_state *css_lookup(struct cgroup_subsys *ss, int id)
+{
+        struct css_id *cssid = NULL;
+
+        BUG_ON(!ss->use_id);
+        cssid = idr_find(&ss->idr, id);
+
+        if (unlikely(!cssid))
+                return NULL;
+
+        return rcu_dereference(cssid->css);
+}
+
+/**
+ * css_get_next - lookup next cgroup under specified hierarchy.
+ * @ss: pointer to subsystem
+ * @id: current position of iteration.
+ * @root: pointer to css. search tree under this.
+ * @foundid: position of found object.
+ *
+ * Search next css under the specified hierarchy of rootid. Calling under
+ * rcu_read_lock() is necessary. Returns NULL if it reaches the end.
+ */
+struct cgroup_subsys_state *
+css_get_next(struct cgroup_subsys *ss, int id,
+             struct cgroup_subsys_state *root, int *foundid)
+{
+        struct cgroup_subsys_state *ret = NULL;
+        struct css_id *tmp;
+        int tmpid;
+        int rootid = css_id(root);
+        int depth = css_depth(root);
+
+        if (!rootid)
+                return NULL;
+
+        BUG_ON(!ss->use_id);
+        /* fill start point for scan */
+        tmpid = id;
+        while (1) {
+                /*
+                 * scan next entry from bitmap(tree), tmpid is updated after
+                 * idr_get_next().
+                 */
+                spin_lock(&ss->id_lock);
+                tmp = idr_get_next(&ss->idr, &tmpid);
+                spin_unlock(&ss->id_lock);
+
+                if (!tmp)
+                        break;
+                if (tmp->depth >= depth && tmp->stack[depth] == rootid) {
+                        ret = rcu_dereference(tmp->css);
+                        if (ret) {
+                                *foundid = tmpid;
+                                break;
+                        }
+                }
+                /* continue to scan from next id */
+                tmpid = tmpid + 1;
+        }
+        return ret;
+}
+
diff --git a/kernel/cgroup_debug.c b/kernel/cgroup_debug.c
index daca6209202d..0c92d797baa6 100644
--- a/kernel/cgroup_debug.c
+++ b/kernel/cgroup_debug.c
@@ -40,9 +40,7 @@ static u64 taskcount_read(struct cgroup *cont, struct cftype *cft)
 {
         u64 count;
 
-        cgroup_lock();
         count = cgroup_task_count(cont);
-        cgroup_unlock();
         return count;
 }
 
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index f76db9dcaa05..026faccca869 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -128,10 +128,6 @@ static inline struct cpuset *task_cs(struct task_struct *task)
         return container_of(task_subsys_state(task, cpuset_subsys_id),
                             struct cpuset, css);
 }
-struct cpuset_hotplug_scanner {
-        struct cgroup_scanner scan;
-        struct cgroup *to;
-};
 
 /* bits in struct cpuset flags field */
 typedef enum {
@@ -521,6 +517,7 @@ static int validate_change(const struct cpuset *cur, const struct cpuset *trial)
         return 0;
 }
 
+#ifdef CONFIG_SMP
 /*
  * Helper routine for generate_sched_domains().
  * Do cpusets a, b have overlapping cpus_allowed masks?
@@ -815,6 +812,18 @@ static void do_rebuild_sched_domains(struct work_struct *unused)
 
         put_online_cpus();
 }
+#else /* !CONFIG_SMP */
+static void do_rebuild_sched_domains(struct work_struct *unused)
+{
+}
+
+static int generate_sched_domains(struct cpumask **domains,
+                        struct sched_domain_attr **attributes)
+{
+        *domains = NULL;
+        return 1;
+}
+#endif /* CONFIG_SMP */
 
 static DECLARE_WORK(rebuild_sched_domains_work, do_rebuild_sched_domains);
 
@@ -1026,101 +1035,70 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
         mutex_unlock(&callback_mutex);
 }
 
+/*
+ * Rebind task's vmas to cpuset's new mems_allowed, and migrate pages to new
+ * nodes if memory_migrate flag is set. Called with cgroup_mutex held.
+ */
+static void cpuset_change_nodemask(struct task_struct *p,
+                                   struct cgroup_scanner *scan)
+{
+        struct mm_struct *mm;
+        struct cpuset *cs;
+        int migrate;
+        const nodemask_t *oldmem = scan->data;
+
+        mm = get_task_mm(p);
+        if (!mm)
+                return;
+
+        cs = cgroup_cs(scan->cg);
+        migrate = is_memory_migrate(cs);
+
+        mpol_rebind_mm(mm, &cs->mems_allowed);
+        if (migrate)
+                cpuset_migrate_mm(mm, oldmem, &cs->mems_allowed);
+        mmput(mm);
+}
+
 static void *cpuset_being_rebound;
 
 /**
  * update_tasks_nodemask - Update the nodemasks of tasks in the cpuset.
  * @cs: the cpuset in which each task's mems_allowed mask needs to be changed
  * @oldmem: old mems_allowed of cpuset cs
+ * @heap: if NULL, defer allocating heap memory to cgroup_scan_tasks()
  *
  * Called with cgroup_mutex held
- * Return 0 if successful, -errno if not.
+ * No return value. It's guaranteed that cgroup_scan_tasks() always returns 0
+ * if @heap != NULL.
  */
-static int update_tasks_nodemask(struct cpuset *cs, const nodemask_t *oldmem)
+static void update_tasks_nodemask(struct cpuset *cs, const nodemask_t *oldmem,
+                                 struct ptr_heap *heap)
 {
-        struct task_struct *p;
-        struct mm_struct **mmarray;
-        int i, n, ntasks;
-        int migrate;
-        int fudge;
-        struct cgroup_iter it;
-        int retval;
+        struct cgroup_scanner scan;
 
         cpuset_being_rebound = cs;              /* causes mpol_dup() rebind */
 
-        fudge = 10;                             /* spare mmarray[] slots */
-        fudge += cpumask_weight(cs->cpus_allowed);/* imagine 1 fork-bomb/cpu */
-        retval = -ENOMEM;
-
-        /*
-         * Allocate mmarray[] to hold mm reference for each task
-         * in cpuset cs.  Can't kmalloc GFP_KERNEL while holding
-         * tasklist_lock.  We could use GFP_ATOMIC, but with a
-         * few more lines of code, we can retry until we get a big
-         * enough mmarray[] w/o using GFP_ATOMIC.
-         */
-        while (1) {
-                ntasks = cgroup_task_count(cs->css.cgroup);  /* guess */
-                ntasks += fudge;
-                mmarray = kmalloc(ntasks * sizeof(*mmarray), GFP_KERNEL);
-                if (!mmarray)
-                        goto done;
-                read_lock(&tasklist_lock);              /* block fork */
-                if (cgroup_task_count(cs->css.cgroup) <= ntasks)
-                        break;                          /* got enough */
-                read_unlock(&tasklist_lock);            /* try again */
-                kfree(mmarray);
-        }
-
-        n = 0;
-
-        /* Load up mmarray[] with mm reference for each task in cpuset. */
-        cgroup_iter_start(cs->css.cgroup, &it);
-        while ((p = cgroup_iter_next(cs->css.cgroup, &it))) {
-                struct mm_struct *mm;
-
-                if (n >= ntasks) {
-                        printk(KERN_WARNING
-                                "Cpuset mempolicy rebind incomplete.\n");
-                        break;
-                }
-                mm = get_task_mm(p);
-                if (!mm)
-                        continue;
-                mmarray[n++] = mm;
-        }
-        cgroup_iter_end(cs->css.cgroup, &it);
-        read_unlock(&tasklist_lock);
+        scan.cg = cs->css.cgroup;
+        scan.test_task = NULL;
+        scan.process_task = cpuset_change_nodemask;
+        scan.heap = heap;
+        scan.data = (nodemask_t *)oldmem;
 
         /*
-         * Now that we've dropped the tasklist spinlock, we can
-         * rebind the vma mempolicies of each mm in mmarray[] to their
-         * new cpuset, and release that mm.  The mpol_rebind_mm()
-         * call takes mmap_sem, which we couldn't take while holding
-         * tasklist_lock.  Forks can happen again now - the mpol_dup()
-         * cpuset_being_rebound check will catch such forks, and rebind
-         * their vma mempolicies too.  Because we still hold the global
-         * cgroup_mutex, we know that no other rebind effort will
-         * be contending for the global variable cpuset_being_rebound.
+         * The mpol_rebind_mm() call takes mmap_sem, which we couldn't
+         * take while holding tasklist_lock.  Forks can happen - the
+         * mpol_dup() cpuset_being_rebound check will catch such forks,
+         * and rebind their vma mempolicies too.  Because we still hold
+         * the global cgroup_mutex, we know that no other rebind effort
+         * will be contending for the global variable cpuset_being_rebound.
          * It's ok if we rebind the same mm twice; mpol_rebind_mm()
          * is idempotent.  Also migrate pages in each mm to new nodes.
          */
-        migrate = is_memory_migrate(cs);
-        for (i = 0; i < n; i++) {
-                struct mm_struct *mm = mmarray[i];
-
-                mpol_rebind_mm(mm, &cs->mems_allowed);
-                if (migrate)
-                        cpuset_migrate_mm(mm, oldmem, &cs->mems_allowed);
-                mmput(mm);
-        }
+        cgroup_scan_tasks(&scan);
 
         /* We're done rebinding vmas to this cpuset's new mems_allowed. */
-        kfree(mmarray);
         cpuset_being_rebound = NULL;
-        retval = 0;
-done:
-        return retval;
 }
 
 /*
@@ -1141,6 +1119,7 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
 {
         nodemask_t oldmem;
         int retval;
+        struct ptr_heap heap;
 
         /*
          * top_cpuset.mems_allowed tracks node_stats[N_HIGH_MEMORY];
@@ -1175,12 +1154,18 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
         if (retval < 0)
                 goto done;
 
+        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
+        if (retval < 0)
+                goto done;
+
         mutex_lock(&callback_mutex);
         cs->mems_allowed = trialcs->mems_allowed;
         cs->mems_generation = cpuset_mems_generation++;
         mutex_unlock(&callback_mutex);
 
-        retval = update_tasks_nodemask(cs, &oldmem);
+        update_tasks_nodemask(cs, &oldmem, &heap);
+
+        heap_free(&heap);
 done:
         return retval;
 }
@@ -1192,8 +1177,10 @@ int current_cpuset_is_being_rebound(void)
 
 static int update_relax_domain_level(struct cpuset *cs, s64 val)
 {
+#ifdef CONFIG_SMP
         if (val < -1 || val >= SD_LV_MAX)
                 return -EINVAL;
+#endif
 
         if (val != cs->relax_domain_level) {
                 cs->relax_domain_level = val;
@@ -1355,19 +1342,22 @@ static int cpuset_can_attach(struct cgroup_subsys *ss,
                              struct cgroup *cont, struct task_struct *tsk)
 {
         struct cpuset *cs = cgroup_cs(cont);
-        int ret = 0;
 
         if (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed))
                 return -ENOSPC;
 
-        if (tsk->flags & PF_THREAD_BOUND) {
-                mutex_lock(&callback_mutex);
-                if (!cpumask_equal(&tsk->cpus_allowed, cs->cpus_allowed))
-                        ret = -EINVAL;
-                mutex_unlock(&callback_mutex);
-        }
+        /*
+         * Kthreads bound to specific cpus cannot be moved to a new cpuset; we
+         * cannot change their cpu affinity and isolating such threads by their
+         * set of allowed nodes is unnecessary.  Thus, cpusets are not
+         * applicable for such threads.  This prevents checking for success of
+         * set_cpus_allowed_ptr() on all attached tasks before cpus_allowed may
+         * be changed.
+         */
+        if (tsk->flags & PF_THREAD_BOUND)
+                return -EINVAL;
 
-        return ret < 0 ? ret : security_task_setscheduler(tsk, 0, NULL);
+        return security_task_setscheduler(tsk, 0, NULL);
 }
 
 static void cpuset_attach(struct cgroup_subsys *ss,
@@ -1706,6 +1696,7 @@ static struct cftype files[] = {
                 .read_u64 = cpuset_read_u64,
                 .write_u64 = cpuset_write_u64,
                 .private = FILE_MEMORY_PRESSURE,
+                .mode = S_IRUGO,
         },
 
         {
@@ -1913,10 +1904,9 @@ int __init cpuset_init(void)
 static void cpuset_do_move_task(struct task_struct *tsk,
                                 struct cgroup_scanner *scan)
 {
-        struct cpuset_hotplug_scanner *chsp;
+        struct cgroup *new_cgroup = scan->data;
 
-        chsp = container_of(scan, struct cpuset_hotplug_scanner, scan);
-        cgroup_attach_task(chsp->to, tsk);
+        cgroup_attach_task(new_cgroup, tsk);
 }
 
 /**
@@ -1932,15 +1922,15 @@ static void cpuset_do_move_task(struct task_struct *tsk,
  */
 static void move_member_tasks_to_cpuset(struct cpuset *from, struct cpuset *to)
 {
-        struct cpuset_hotplug_scanner scan;
+        struct cgroup_scanner scan;
 
-        scan.scan.cg = from->css.cgroup;
-        scan.scan.test_task = NULL; /* select all tasks in cgroup */
-        scan.scan.process_task = cpuset_do_move_task;
-        scan.scan.heap = NULL;
-        scan.to = to->css.cgroup;
+        scan.cg = from->css.cgroup;
+        scan.test_task = NULL; /* select all tasks in cgroup */
+        scan.process_task = cpuset_do_move_task;
+        scan.heap = NULL;
+        scan.data = to->css.cgroup;
 
-        if (cgroup_scan_tasks(&scan.scan))
+        if (cgroup_scan_tasks(&scan))
                 printk(KERN_ERR "move_member_tasks_to_cpuset: "
                                 "cgroup_scan_tasks failed\n");
 }
@@ -2033,7 +2023,7 @@ static void scan_for_empty_cpusets(struct cpuset *root)
                         remove_tasks_in_empty_cpuset(cp);
                 else {
                         update_tasks_cpumask(cp, NULL);
-                        update_tasks_nodemask(cp, &oldmems);
+                        update_tasks_nodemask(cp, &oldmems, NULL);
                 }
         }
 }
@@ -2069,7 +2059,9 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
         }
 
         cgroup_lock();
+        mutex_lock(&callback_mutex);
         cpumask_copy(top_cpuset.cpus_allowed, cpu_online_mask);
+        mutex_unlock(&callback_mutex);
         scan_for_empty_cpusets(&top_cpuset);
         ndoms = generate_sched_domains(&doms, &attr);
         cgroup_unlock();
@@ -2092,11 +2084,12 @@ static int cpuset_track_online_nodes(struct notifier_block *self,
         cgroup_lock();
         switch (action) {
         case MEM_ONLINE:
-                top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
-                break;
         case MEM_OFFLINE:
+                mutex_lock(&callback_mutex);
                 top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
-                scan_for_empty_cpusets(&top_cpuset);
+                mutex_unlock(&callback_mutex);
+                if (action == MEM_OFFLINE)
+                        scan_for_empty_cpusets(&top_cpuset);
                 break;
         default:
                 break;
@@ -2206,26 +2199,24 @@ static const struct cpuset *nearest_hardwall_ancestor(const struct cpuset *cs)
 }
 
 /**
- * cpuset_zone_allowed_softwall - Can we allocate on zone z's memory node?
- * @z: is this zone on an allowed node?
+ * cpuset_node_allowed_softwall - Can we allocate on a memory node?
+ * @node: is this an allowed node?
  * @gfp_mask: memory allocation flags
  *
- * If we're in interrupt, yes, we can always allocate.  If
- * __GFP_THISNODE is set, yes, we can always allocate.  If zone
- * z's node is in our tasks mems_allowed, yes.  If it's not a
- * __GFP_HARDWALL request and this zone's nodes is in the nearest
- * hardwalled cpuset ancestor to this tasks cpuset, yes.
- * If the task has been OOM killed and has access to memory reserves
- * as specified by the TIF_MEMDIE flag, yes.
+ * If we're in interrupt, yes, we can always allocate.  If __GFP_THISNODE is
+ * set, yes, we can always allocate.  If node is in our task's mems_allowed,
+ * yes.  If it's not a __GFP_HARDWALL request and this node is in the nearest
+ * hardwalled cpuset ancestor to this task's cpuset, yes.  If the task has been
+ * OOM killed and has access to memory reserves as specified by the TIF_MEMDIE
+ * flag, yes.
  * Otherwise, no.
  *
- * If __GFP_HARDWALL is set, cpuset_zone_allowed_softwall()
- * reduces to cpuset_zone_allowed_hardwall().  Otherwise,
- * cpuset_zone_allowed_softwall() might sleep, and might allow a zone
- * from an enclosing cpuset.
+ * If __GFP_HARDWALL is set, cpuset_node_allowed_softwall() reduces to
+ * cpuset_node_allowed_hardwall().  Otherwise, cpuset_node_allowed_softwall()
+ * might sleep, and might allow a node from an enclosing cpuset.
  *
- * cpuset_zone_allowed_hardwall() only handles the simpler case of
- * hardwall cpusets, and never sleeps.
+ * cpuset_node_allowed_hardwall() only handles the simpler case of hardwall
+ * cpusets, and never sleeps.
  *
  * The __GFP_THISNODE placement logic is really handled elsewhere,
  * by forcibly using a zonelist starting at a specified node, and by
@@ -2264,20 +2255,17 @@ static const struct cpuset *nearest_hardwall_ancestor(const struct cpuset *cs)
  *      GFP_USER     - only nodes in current tasks mems allowed ok.
  *
  * Rule:
- *    Don't call cpuset_zone_allowed_softwall if you can't sleep, unless you
+ *    Don't call cpuset_node_allowed_softwall if you can't sleep, unless you
  *    pass in the __GFP_HARDWALL flag set in gfp_flag, which disables
  *    the code that might scan up ancestor cpusets and sleep.
  */
-
-int __cpuset_zone_allowed_softwall(struct zone *z, gfp_t gfp_mask)
+int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
 {
-        int node;                       /* node that zone z is on */
         const struct cpuset *cs;        /* current cpuset ancestors */
         int allowed;                    /* is allocation in zone z allowed? */
 
         if (in_interrupt() || (gfp_mask & __GFP_THISNODE))
                 return 1;
-        node = zone_to_nid(z);
         might_sleep_if(!(gfp_mask & __GFP_HARDWALL));
         if (node_isset(node, current->mems_allowed))
                 return 1;
@@ -2306,15 +2294,15 @@ int __cpuset_zone_allowed_softwall(struct zone *z, gfp_t gfp_mask)
 }
 
 /*
- * cpuset_zone_allowed_hardwall - Can we allocate on zone z's memory node?
- * @z: is this zone on an allowed node?
+ * cpuset_node_allowed_hardwall - Can we allocate on a memory node?
+ * @node: is this an allowed node?
  * @gfp_mask: memory allocation flags
  *
- * If we're in interrupt, yes, we can always allocate.
- * If __GFP_THISNODE is set, yes, we can always allocate.  If zone
- * z's node is in our tasks mems_allowed, yes.   If the task has been
- * OOM killed and has access to memory reserves as specified by the
- * TIF_MEMDIE flag, yes.  Otherwise, no.
+ * If we're in interrupt, yes, we can always allocate.  If __GFP_THISNODE is
+ * set, yes, we can always allocate.  If node is in our task's mems_allowed,
+ * yes.  If the task has been OOM killed and has access to memory reserves as
+ * specified by the TIF_MEMDIE flag, yes.
+ * Otherwise, no.
  *
  * The __GFP_THISNODE placement logic is really handled elsewhere,
  * by forcibly using a zonelist starting at a specified node, and by
@@ -2322,20 +2310,16 @@ int __cpuset_zone_allowed_softwall(struct zone *z, gfp_t gfp_mask)
  * any node on the zonelist except the first.  By the time any such
  * calls get to this routine, we should just shut up and say 'yes'.
  *
- * Unlike the cpuset_zone_allowed_softwall() variant, above,
- * this variant requires that the zone be in the current tasks
+ * Unlike the cpuset_node_allowed_softwall() variant, above,
+ * this variant requires that the node be in the current task's
  * mems_allowed or that we're in interrupt.  It does not scan up the
  * cpuset hierarchy for the nearest enclosing mem_exclusive cpuset.
  * It never sleeps.
  */
-
-int __cpuset_zone_allowed_hardwall(struct zone *z, gfp_t gfp_mask)
+int __cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask)
 {
-        int node;                       /* node that zone z is on */
-
         if (in_interrupt() || (gfp_mask & __GFP_THISNODE))
                 return 1;
-        node = zone_to_nid(z);
         if (node_isset(node, current->mems_allowed))
                 return 1;
         /*
diff --git a/kernel/exec_domain.c b/kernel/exec_domain.c
index 667c841c2952..c35452cadded 100644
--- a/kernel/exec_domain.c
+++ b/kernel/exec_domain.c
@@ -18,6 +18,7 @@
 #include <linux/syscalls.h>
 #include <linux/sysctl.h>
 #include <linux/types.h>
+#include <linux/fs_struct.h>
 
 
 static void default_handler(int, struct pt_regs *);
@@ -145,28 +146,6 @@ __set_personality(u_long personality)
                 return 0;
         }
 
-        if (atomic_read(&current->fs->count) != 1) {
-                struct fs_struct *fsp, *ofsp;
-
-                fsp = copy_fs_struct(current->fs);
-                if (fsp == NULL) {
-                        module_put(ep->module);
-                        return -ENOMEM;
-                }
-
-                task_lock(current);
-                ofsp = current->fs;
-                current->fs = fsp;
-                task_unlock(current);
-
-                put_fs_struct(ofsp);
-        }
-
-        /*
-         * At that point we are guaranteed to be the sole owner of
-         * current->fs.
-         */
-
         current->personality = personality;
         oep = current_thread_info()->exec_domain;
         current_thread_info()->exec_domain = ep;
diff --git a/kernel/exit.c b/kernel/exit.c
index 167e1e3ad7c6..6686ed1e4aa3 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -46,6 +46,7 @@
 #include <linux/blkdev.h>
 #include <linux/task_io_accounting_ops.h>
 #include <linux/tracehook.h>
+#include <linux/fs_struct.h>
 #include <linux/init_task.h>
 #include <trace/sched.h>
 
@@ -61,11 +62,6 @@ DEFINE_TRACE(sched_process_wait);
 
 static void exit_mm(struct task_struct * tsk);
 
-static inline int task_detached(struct task_struct *p)
-{
-        return p->exit_signal == -1;
-}
-
 static void __unhash_process(struct task_struct *p)
 {
         nr_threads--;
@@ -362,16 +358,12 @@ static void reparent_to_kthreadd(void)
 void __set_special_pids(struct pid *pid)
 {
         struct task_struct *curr = current->group_leader;
-        pid_t nr = pid_nr(pid);
 
-        if (task_session(curr) != pid) {
+        if (task_session(curr) != pid)
                 change_pid(curr, PIDTYPE_SID, pid);
-                set_task_session(curr, nr);
-        }
-        if (task_pgrp(curr) != pid) {
+
+        if (task_pgrp(curr) != pid)
                 change_pid(curr, PIDTYPE_PGID, pid);
-                set_task_pgrp(curr, nr);
-        }
 }
 
 static void set_special_pids(struct pid *pid)
@@ -429,7 +421,6 @@ EXPORT_SYMBOL(disallow_signal);
 void daemonize(const char *name, ...)
 {
         va_list args;
-        struct fs_struct *fs;
         sigset_t blocked;
 
         va_start(args, name);
@@ -462,11 +453,7 @@ void daemonize(const char *name, ...)
 
         /* Become as one with the init task */
 
-        exit_fs(current);       /* current->fs->count--; */
-        fs = init_task.fs;
-        current->fs = fs;
-        atomic_inc(&fs->count);
-
+        daemonize_fs_struct();
         exit_files(current);
         current->files = init_task.files;
         atomic_inc(&current->files->count);
@@ -565,30 +552,6 @@ void exit_files(struct task_struct *tsk)
         }
 }
 
-void put_fs_struct(struct fs_struct *fs)
-{
-        /* No need to hold fs->lock if we are killing it */
-        if (atomic_dec_and_test(&fs->count)) {
-                path_put(&fs->root);
-                path_put(&fs->pwd);
-                kmem_cache_free(fs_cachep, fs);
-        }
-}
-
-void exit_fs(struct task_struct *tsk)
-{
-        struct fs_struct * fs = tsk->fs;
-
-        if (fs) {
-                task_lock(tsk);
-                tsk->fs = NULL;
-                task_unlock(tsk);
-                put_fs_struct(fs);
-        }
-}
-
-EXPORT_SYMBOL_GPL(exit_fs);
-
 #ifdef CONFIG_MM_OWNER
 /*
  * Task p is exiting and it owned mm, lets find a new owner for it
@@ -732,119 +695,6 @@ static void exit_mm(struct task_struct * tsk)
 }
 
 /*
- * Return nonzero if @parent's children should reap themselves.
- *
- * Called with write_lock_irq(&tasklist_lock) held.
- */
-static int ignoring_children(struct task_struct *parent)
-{
-        int ret;
-        struct sighand_struct *psig = parent->sighand;
-        unsigned long flags;
-        spin_lock_irqsave(&psig->siglock, flags);
-        ret = (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN ||
-               (psig->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT));
-        spin_unlock_irqrestore(&psig->siglock, flags);
-        return ret;
-}
-
-/*
- * Detach all tasks we were using ptrace on.
- * Any that need to be release_task'd are put on the @dead list.
- *
- * Called with write_lock(&tasklist_lock) held.
- */
-static void ptrace_exit(struct task_struct *parent, struct list_head *dead)
-{
-        struct task_struct *p, *n;
-        int ign = -1;
-
-        list_for_each_entry_safe(p, n, &parent->ptraced, ptrace_entry) {
-                __ptrace_unlink(p);
-
-                if (p->exit_state != EXIT_ZOMBIE)
-                        continue;
-
-                /*
-                 * If it's a zombie, our attachedness prevented normal
-                 * parent notification or self-reaping.  Do notification
-                 * now if it would have happened earlier.  If it should
-                 * reap itself, add it to the @dead list.  We can't call
-                 * release_task() here because we already hold tasklist_lock.
-                 *
-                 * If it's our own child, there is no notification to do.
-                 * But if our normal children self-reap, then this child
-                 * was prevented by ptrace and we must reap it now.
-                 */
-                if (!task_detached(p) && thread_group_empty(p)) {
-                        if (!same_thread_group(p->real_parent, parent))
-                                do_notify_parent(p, p->exit_signal);
-                        else {
-                                if (ign < 0)
-                                        ign = ignoring_children(parent);
-                                if (ign)
-                                        p->exit_signal = -1;
-                        }
-                }
-
-                if (task_detached(p)) {
-                        /*
-                         * Mark it as in the process of being reaped.
-                         */
-                        p->exit_state = EXIT_DEAD;
-                        list_add(&p->ptrace_entry, dead);
-                }
-        }
-}
-
-/*
- * Finish up exit-time ptrace cleanup.
- *
- * Called without locks.
- */
-static void ptrace_exit_finish(struct task_struct *parent,
-                               struct list_head *dead)
-{
-        struct task_struct *p, *n;
-
-        BUG_ON(!list_empty(&parent->ptraced));
-
-        list_for_each_entry_safe(p, n, dead, ptrace_entry) {
-                list_del_init(&p->ptrace_entry);
-                release_task(p);
-        }
-}
-
-static void reparent_thread(struct task_struct *p, struct task_struct *father)
-{
-        if (p->pdeath_signal)
-                /* We already hold the tasklist_lock here.  */
-                group_send_sig_info(p->pdeath_signal, SEND_SIG_NOINFO, p);
-
-        list_move_tail(&p->sibling, &p->real_parent->children);
-
-        /* If this is a threaded reparent there is no need to
-         * notify anyone anything has happened.
-         */
-        if (same_thread_group(p->real_parent, father))
-                return;
-
-        /* We don't want people slaying init.  */
-        if (!task_detached(p))
-                p->exit_signal = SIGCHLD;
-
-        /* If we'd notified the old parent about this child's death,
-         * also notify the new parent.
-         */
-        if (!ptrace_reparented(p) &&
-            p->exit_state == EXIT_ZOMBIE &&
-            !task_detached(p) && thread_group_empty(p))
-                do_notify_parent(p, p->exit_signal);
-
-        kill_orphaned_pgrp(p, father);
-}
-
-/*
  * When we die, we re-parent all our children.
  * Try to give them to another thread in our thread
  * group, and if no such member exists, give it to
@@ -883,17 +733,51 @@ static struct task_struct *find_new_reaper(struct task_struct *father)
         return pid_ns->child_reaper;
 }
 
+/*
+* Any that need to be release_task'd are put on the @dead list.
+ */
+static void reparent_thread(struct task_struct *father, struct task_struct *p,
+                                struct list_head *dead)
+{
+        if (p->pdeath_signal)
+                group_send_sig_info(p->pdeath_signal, SEND_SIG_NOINFO, p);
+
+        list_move_tail(&p->sibling, &p->real_parent->children);
+
+        if (task_detached(p))
+                return;
+        /*
+         * If this is a threaded reparent there is no need to
+         * notify anyone anything has happened.
+         */
+        if (same_thread_group(p->real_parent, father))
+                return;
+
+        /* We don't want people slaying init.  */
+        p->exit_signal = SIGCHLD;
+
+        /* If it has exited notify the new parent about this child's death. */
+        if (!p->ptrace &&
+            p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
+                do_notify_parent(p, p->exit_signal);
+                if (task_detached(p)) {
+                        p->exit_state = EXIT_DEAD;
+                        list_move_tail(&p->sibling, dead);
+                }
+        }
+
+        kill_orphaned_pgrp(p, father);
+}
+
 static void forget_original_parent(struct task_struct *father)
 {
         struct task_struct *p, *n, *reaper;
-        LIST_HEAD(ptrace_dead);
+        LIST_HEAD(dead_children);
+
+        exit_ptrace(father);
 
         write_lock_irq(&tasklist_lock);
         reaper = find_new_reaper(father);
-        /*
-         * First clean up ptrace if we were using it.
-         */
-        ptrace_exit(father, &ptrace_dead);
 
         list_for_each_entry_safe(p, n, &father->children, sibling) {
                 p->real_parent = reaper;
@@ -901,13 +785,16 @@ static void forget_original_parent(struct task_struct *father)
                         BUG_ON(p->ptrace);
                         p->parent = p->real_parent;
                 }
-                reparent_thread(p, father);
+                reparent_thread(father, p, &dead_children);
         }
-
         write_unlock_irq(&tasklist_lock);
+
         BUG_ON(!list_empty(&father->children));
 
-        ptrace_exit_finish(father, &ptrace_dead);
+        list_for_each_entry_safe(p, n, &dead_children, sibling) {
+                list_del_init(&p->sibling);
+                release_task(p);
+        }
 }
 
 /*
@@ -1417,6 +1304,18 @@ static int wait_task_zombie(struct task_struct *p, int options,
         return retval;
 }
 
+static int *task_stopped_code(struct task_struct *p, bool ptrace)
+{
+        if (ptrace) {
+                if (task_is_stopped_or_traced(p))
+                        return &p->exit_code;
+        } else {
+                if (p->signal->flags & SIGNAL_STOP_STOPPED)
+                        return &p->signal->group_exit_code;
+        }
+        return NULL;
+}
+
 /*
  * Handle sys_wait4 work for one task in state TASK_STOPPED.  We hold
  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
@@ -1427,7 +1326,7 @@ static int wait_task_stopped(int ptrace, struct task_struct *p,
                              int options, struct siginfo __user *infop,
                              int __user *stat_addr, struct rusage __user *ru)
 {
-        int retval, exit_code, why;
+        int retval, exit_code, *p_code, why;
         uid_t uid = 0; /* unneeded, required by compiler */
         pid_t pid;
 
@@ -1437,22 +1336,16 @@ static int wait_task_stopped(int ptrace, struct task_struct *p,
         exit_code = 0;
         spin_lock_irq(&p->sighand->siglock);
 
-        if (unlikely(!task_is_stopped_or_traced(p)))
-                goto unlock_sig;
-
-        if (!ptrace && p->signal->group_stop_count > 0)
-                /*
-                 * A group stop is in progress and this is the group leader.
-                 * We won't report until all threads have stopped.
-                 */
+        p_code = task_stopped_code(p, ptrace);
+        if (unlikely(!p_code))
                 goto unlock_sig;
 
-        exit_code = p->exit_code;
+        exit_code = *p_code;
         if (!exit_code)
                 goto unlock_sig;
 
         if (!unlikely(options & WNOWAIT))
-                p->exit_code = 0;
+                *p_code = 0;
 
         /* don't need the RCU readlock here as we're holding a spinlock */
         uid = __task_cred(p)->uid;
@@ -1608,7 +1501,7 @@ static int wait_consider_task(struct task_struct *parent, int ptrace,
          */
         *notask_error = 0;
 
-        if (task_is_stopped_or_traced(p))
+        if (task_stopped_code(p, ptrace))
                 return wait_task_stopped(ptrace, p, options,
                                          infop, stat_addr, ru);
 
@@ -1812,7 +1705,7 @@ SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr,
                 pid = find_get_pid(-upid);
         } else if (upid == 0) {
                 type = PIDTYPE_PGID;
-                pid = get_pid(task_pgrp(current));
+                pid = get_task_pid(current, PIDTYPE_PGID);
         } else /* upid > 0 */ {
                 type = PIDTYPE_PID;
                 pid = find_get_pid(upid);
diff --git a/kernel/extable.c b/kernel/extable.c
index e136ed8d82ba..81e99d1f0d5b 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -41,6 +41,14 @@ const struct exception_table_entry *search_exception_tables(unsigned long addr)
         return e;
 }
 
+static inline int init_kernel_text(unsigned long addr)
+{
+        if (addr >= (unsigned long)_sinittext &&
+            addr <= (unsigned long)_einittext)
+                return 1;
+        return 0;
+}
+
 __notrace_funcgraph int core_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_stext &&
@@ -48,8 +56,7 @@ __notrace_funcgraph int core_kernel_text(unsigned long addr)
                 return 1;
 
         if (system_state == SYSTEM_BOOTING &&
-            addr >= (unsigned long)_sinittext &&
-            addr <= (unsigned long)_einittext)
+            init_kernel_text(addr))
                 return 1;
         return 0;
 }
@@ -58,14 +65,26 @@ __notrace_funcgraph int __kernel_text_address(unsigned long addr)
 {
         if (core_kernel_text(addr))
                 return 1;
-        return __module_text_address(addr) != NULL;
+        if (is_module_text_address(addr))
+                return 1;
+        /*
+         * There might be init symbols in saved stacktraces.
+         * Give those symbols a chance to be printed in
+         * backtraces (such as lockdep traces).
+         *
+         * Since we are after the module-symbols check, there's
+         * no danger of address overlap:
+         */
+        if (init_kernel_text(addr))
+                return 1;
+        return 0;
 }
 
 int kernel_text_address(unsigned long addr)
 {
         if (core_kernel_text(addr))
                 return 1;
-        return module_text_address(addr) != NULL;
+        return is_module_text_address(addr);
 }
 
 /*
@@ -81,5 +100,5 @@ int func_ptr_is_kernel_text(void *ptr)
         addr = (unsigned long) dereference_function_descriptor(ptr);
         if (core_kernel_text(addr))
                 return 1;
-        return module_text_address(addr) != NULL;
+        return is_module_text_address(addr);
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 47c15840a381..660c2b8765bc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -60,6 +60,7 @@
 #include <linux/tty.h>
 #include <linux/proc_fs.h>
 #include <linux/blkdev.h>
+#include <linux/fs_struct.h>
 #include <trace/sched.h>
 #include <linux/magic.h>
 
@@ -681,38 +682,21 @@ fail_nomem:
         return retval;
 }
 
-static struct fs_struct *__copy_fs_struct(struct fs_struct *old)
-{
-        struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
-        /* We don't need to lock fs - think why ;-) */
-        if (fs) {
-                atomic_set(&fs->count, 1);
-                rwlock_init(&fs->lock);
-                fs->umask = old->umask;
-                read_lock(&old->lock);
-                fs->root = old->root;
-                path_get(&old->root);
-                fs->pwd = old->pwd;
-                path_get(&old->pwd);
-                read_unlock(&old->lock);
-        }
-        return fs;
-}
-
-struct fs_struct *copy_fs_struct(struct fs_struct *old)
-{
-        return __copy_fs_struct(old);
-}
-
-EXPORT_SYMBOL_GPL(copy_fs_struct);
-
 static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
 {
+        struct fs_struct *fs = current->fs;
         if (clone_flags & CLONE_FS) {
-                atomic_inc(&current->fs->count);
+                /* tsk->fs is already what we want */
+                write_lock(&fs->lock);
+                if (fs->in_exec) {
+                        write_unlock(&fs->lock);
+                        return -EAGAIN;
+                }
+                fs->users++;
+                write_unlock(&fs->lock);
                 return 0;
         }
-        tsk->fs = __copy_fs_struct(current->fs);
+        tsk->fs = copy_fs_struct(fs);
         if (!tsk->fs)
                 return -ENOMEM;
         return 0;
@@ -841,6 +825,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         atomic_set(&sig->live, 1);
         init_waitqueue_head(&sig->wait_chldexit);
         sig->flags = 0;
+        if (clone_flags & CLONE_NEWPID)
+                sig->flags |= SIGNAL_UNKILLABLE;
         sig->group_exit_code = 0;
         sig->group_exit_task = NULL;
         sig->group_stop_count = 0;
@@ -1125,7 +1111,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 goto bad_fork_cleanup_mm;
         if ((retval = copy_io(clone_flags, p)))
                 goto bad_fork_cleanup_namespaces;
-        retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);
+        retval = copy_thread(clone_flags, stack_start, stack_size, p, regs);
         if (retval)
                 goto bad_fork_cleanup_io;
 
@@ -1263,8 +1249,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                         p->signal->leader_pid = pid;
                         tty_kref_put(p->signal->tty);
                         p->signal->tty = tty_kref_get(current->signal->tty);
-                        set_task_pgrp(p, task_pgrp_nr(current));
-                        set_task_session(p, task_session_nr(current));
                         attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
                         attach_pid(p, PIDTYPE_SID, task_session(current));
                         list_add_tail_rcu(&p->tasks, &init_task.tasks);
@@ -1488,6 +1472,7 @@ void __init proc_caches_init(void)
         mm_cachep = kmem_cache_create("mm_struct",
                         sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+        vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC);
         mmap_init();
 }
 
@@ -1543,12 +1528,16 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
 {
         struct fs_struct *fs = current->fs;
 
-        if ((unshare_flags & CLONE_FS) &&
-            (fs && atomic_read(&fs->count) > 1)) {
-                *new_fsp = __copy_fs_struct(current->fs);
-                if (!*new_fsp)
-                        return -ENOMEM;
-        }
+        if (!(unshare_flags & CLONE_FS) || !fs)
+                return 0;
+
+        /* don't need lock here; in the worst case we'll do useless copy */
+        if (fs->users == 1)
+                return 0;
+
+        *new_fsp = copy_fs_struct(fs);
+        if (!*new_fsp)
+                return -ENOMEM;
 
         return 0;
 }
@@ -1664,8 +1653,13 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
 
                 if (new_fs) {
                         fs = current->fs;
+                        write_lock(&fs->lock);
                         current->fs = new_fs;
-                        new_fs = fs;
+                        if (--fs->users)
+                                new_fs = NULL;
+                        else
+                                new_fs = fs;
+                        write_unlock(&fs->lock);
                 }
 
                 if (new_mm) {
@@ -1704,7 +1698,7 @@ bad_unshare_cleanup_sigh:
 
 bad_unshare_cleanup_fs:
         if (new_fs)
-                put_fs_struct(new_fs);
+                free_fs_struct(new_fs);
 
 bad_unshare_cleanup_thread:
 bad_unshare_out:
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 7b8b0f21a5b1..374faf9bfdc7 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -161,6 +161,25 @@ unsigned long kallsyms_lookup_name(const char *name)
         return module_kallsyms_lookup_name(name);
 }
 
+int kallsyms_on_each_symbol(int (*fn)(void *, const char *, struct module *,
+                                      unsigned long),
+                            void *data)
+{
+        char namebuf[KSYM_NAME_LEN];
+        unsigned long i;
+        unsigned int off;
+        int ret;
+
+        for (i = 0, off = 0; i < kallsyms_num_syms; i++) {
+                off = kallsyms_expand_symbol(off, namebuf);
+                ret = fn(data, namebuf, NULL, kallsyms_addresses[i]);
+                if (ret != 0)
+                        return ret;
+        }
+        return module_kallsyms_on_each_symbol(fn, data);
+}
+EXPORT_SYMBOL_GPL(kallsyms_on_each_symbol);
+
 static unsigned long get_symbol_pos(unsigned long addr,
                                     unsigned long *symbolsize,
                                     unsigned long *offset)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 93eed85fe017..5a758c6e4950 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -42,7 +42,7 @@
 note_buf_t* crash_notes;
 
 /* vmcoreinfo stuff */
-unsigned char vmcoreinfo_data[VMCOREINFO_BYTES];
+static unsigned char vmcoreinfo_data[VMCOREINFO_BYTES];
 u32 vmcoreinfo_note[VMCOREINFO_NOTE_SIZE/4];
 size_t vmcoreinfo_size;
 size_t vmcoreinfo_max_size = sizeof(vmcoreinfo_data);
@@ -1409,6 +1409,7 @@ static int __init crash_save_vmcoreinfo_init(void)
         VMCOREINFO_OFFSET(list_head, prev);
         VMCOREINFO_OFFSET(vm_struct, addr);
         VMCOREINFO_LENGTH(zone.free_area, MAX_ORDER);
+        log_buf_kexec_setup();
         VMCOREINFO_LENGTH(free_area.free_list, MIGRATE_TYPES);
         VMCOREINFO_NUMBER(NR_FREE_PAGES);
         VMCOREINFO_NUMBER(PG_lru);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index f0c8f545180d..b750675251e5 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -50,7 +50,8 @@ static struct workqueue_struct *khelper_wq;
 char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
 
 /**
- * request_module - try to load a kernel module
+ * __request_module - try to load a kernel module
+ * @wait: wait (or not) for the operation to complete
  * @fmt: printf style format string for the name of the module
  * @...: arguments as specified in the format string
  *
@@ -63,7 +64,7 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
  * If module auto-loading support is disabled then this function
  * becomes a no-operation.
  */
-int request_module(const char *fmt, ...)
+int __request_module(bool wait, const char *fmt, ...)
 {
         va_list args;
         char module_name[MODULE_NAME_LEN];
@@ -108,11 +109,12 @@ int request_module(const char *fmt, ...)
                 return -ENOMEM;
         }
 
-        ret = call_usermodehelper(modprobe_path, argv, envp, 1);
+        ret = call_usermodehelper(modprobe_path, argv, envp,
+                        wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
         atomic_dec(&kmod_concurrent);
         return ret;
 }
-EXPORT_SYMBOL(request_module);
+EXPORT_SYMBOL(__request_module);
 #endif /* CONFIG_MODULES */
 
 struct subprocess_info {
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 3673a3f44d9d..981cd4854281 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -433,13 +433,6 @@ atomic_t nr_find_usage_forwards_checks;
 atomic_t nr_find_usage_forwards_recursions;
 atomic_t nr_find_usage_backwards_checks;
 atomic_t nr_find_usage_backwards_recursions;
-# define debug_atomic_inc(ptr)          atomic_inc(ptr)
-# define debug_atomic_dec(ptr)          atomic_dec(ptr)
-# define debug_atomic_read(ptr)         atomic_read(ptr)
-#else
-# define debug_atomic_inc(ptr)          do { } while (0)
-# define debug_atomic_dec(ptr)          do { } while (0)
-# define debug_atomic_read(ptr)         0
 #endif
 
 /*
@@ -1900,9 +1893,9 @@ print_irq_inversion_bug(struct task_struct *curr, struct lock_class *other,
                 curr->comm, task_pid_nr(curr));
         print_lock(this);
         if (forwards)
-                printk("but this lock took another, %s-irq-unsafe lock in the past:\n", irqclass);
+                printk("but this lock took another, %s-unsafe lock in the past:\n", irqclass);
         else
-                printk("but this lock was taken by another, %s-irq-safe lock in the past:\n", irqclass);
+                printk("but this lock was taken by another, %s-safe lock in the past:\n", irqclass);
         print_lock_name(other);
         printk("\n\nand interrupts could create inverse lock ordering between them.\n\n");
 
@@ -2015,7 +2008,8 @@ typedef int (*check_usage_f)(struct task_struct *, struct held_lock *,
                              enum lock_usage_bit bit, const char *name);
 
 static int
-mark_lock_irq(struct task_struct *curr, struct held_lock *this, int new_bit)
+mark_lock_irq(struct task_struct *curr, struct held_lock *this,
+                enum lock_usage_bit new_bit)
 {
         int excl_bit = exclusive_bit(new_bit);
         int read = new_bit & 1;
@@ -2043,7 +2037,7 @@ mark_lock_irq(struct task_struct *curr, struct held_lock *this, int new_bit)
          * states.
          */
         if ((!read || !dir || STRICT_READ_CHECKS) &&
-                        !usage(curr, this, excl_bit, state_name(new_bit)))
+                        !usage(curr, this, excl_bit, state_name(new_bit & ~1)))
                 return 0;
 
         /*
diff --git a/kernel/module.c b/kernel/module.c
index f77ac320d0b5..f6e08b7cff7c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -68,7 +68,8 @@
 
 /* List of modules, protected by module_mutex or preempt_disable
  * (delete uses stop_machine/add uses RCU list operations). */
-static DEFINE_MUTEX(module_mutex);
+DEFINE_MUTEX(module_mutex);
+EXPORT_SYMBOL_GPL(module_mutex);
 static LIST_HEAD(modules);
 
 /* Waiting for a module to finish initializing? */
@@ -76,7 +77,7 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq);
 
 static BLOCKING_NOTIFIER_HEAD(module_notify_list);
 
-/* Bounds of module allocation, for speeding __module_text_address */
+/* Bounds of module allocation, for speeding __module_address */
 static unsigned long module_addr_min = -1UL, module_addr_max = 0;
 
 int register_module_notifier(struct notifier_block * nb)
@@ -186,17 +187,6 @@ extern const unsigned long __start___kcrctab_unused_gpl[];
 #define symversion(base, idx) ((base != NULL) ? ((base) + (idx)) : NULL)
 #endif
 
-struct symsearch {
-        const struct kernel_symbol *start, *stop;
-        const unsigned long *crcs;
-        enum {
-                NOT_GPL_ONLY,
-                GPL_ONLY,
-                WILL_BE_GPL_ONLY,
-        } licence;
-        bool unused;
-};
-
 static bool each_symbol_in_section(const struct symsearch *arr,
                                    unsigned int arrsize,
                                    struct module *owner,
@@ -217,10 +207,8 @@ static bool each_symbol_in_section(const struct symsearch *arr,
 }
 
 /* Returns true as soon as fn returns true, otherwise false. */
-static bool each_symbol(bool (*fn)(const struct symsearch *arr,
-                                   struct module *owner,
-                                   unsigned int symnum, void *data),
-                        void *data)
+bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
+                            unsigned int symnum, void *data), void *data)
 {
         struct module *mod;
         const struct symsearch arr[] = {
@@ -273,6 +261,7 @@ static bool each_symbol(bool (*fn)(const struct symsearch *arr,
         }
         return false;
 }
+EXPORT_SYMBOL_GPL(each_symbol);
 
 struct find_symbol_arg {
         /* Input */
@@ -283,7 +272,7 @@ struct find_symbol_arg {
         /* Output */
         struct module *owner;
         const unsigned long *crc;
-        unsigned long value;
+        const struct kernel_symbol *sym;
 };
 
 static bool find_symbol_in_section(const struct symsearch *syms,
@@ -324,17 +313,17 @@ static bool find_symbol_in_section(const struct symsearch *syms,
 
         fsa->owner = owner;
         fsa->crc = symversion(syms->crcs, symnum);
-        fsa->value = syms->start[symnum].value;
+        fsa->sym = &syms->start[symnum];
         return true;
 }
 
-/* Find a symbol, return value, (optional) crc and (optional) module
- * which owns it */
-static unsigned long find_symbol(const char *name,
-                                 struct module **owner,
-                                 const unsigned long **crc,
-                                 bool gplok,
-                                 bool warn)
+/* Find a symbol and return it, along with, (optional) crc and
+ * (optional) module which owns it */
+const struct kernel_symbol *find_symbol(const char *name,
+                                        struct module **owner,
+                                        const unsigned long **crc,
+                                        bool gplok,
+                                        bool warn)
 {
         struct find_symbol_arg fsa;
 
@@ -347,15 +336,16 @@ static unsigned long find_symbol(const char *name,
                         *owner = fsa.owner;
                 if (crc)
                         *crc = fsa.crc;
-                return fsa.value;
+                return fsa.sym;
         }
 
         DEBUGP("Failed to find symbol %s\n", name);
-        return -ENOENT;
+        return NULL;
 }
+EXPORT_SYMBOL_GPL(find_symbol);
 
 /* Search for module by name: must hold module_mutex. */
-static struct module *find_module(const char *name)
+struct module *find_module(const char *name)
 {
         struct module *mod;
 
@@ -365,6 +355,7 @@ static struct module *find_module(const char *name)
         }
         return NULL;
 }
+EXPORT_SYMBOL_GPL(find_module);
 
 #ifdef CONFIG_SMP
 
@@ -641,7 +632,7 @@ static int already_uses(struct module *a, struct module *b)
 }
 
 /* Module a uses b */
-static int use_module(struct module *a, struct module *b)
+int use_module(struct module *a, struct module *b)
 {
         struct module_use *use;
         int no_warn, err;
@@ -674,6 +665,7 @@ static int use_module(struct module *a, struct module *b)
         no_warn = sysfs_create_link(b->holders_dir, &a->mkobj.kobj, a->name);
         return 1;
 }
+EXPORT_SYMBOL_GPL(use_module);
 
 /* Clear the unload stuff of the module. */
 static void module_unload_free(struct module *mod)
@@ -894,7 +886,7 @@ void __symbol_put(const char *symbol)
         struct module *owner;
 
         preempt_disable();
-        if (IS_ERR_VALUE(find_symbol(symbol, &owner, NULL, true, false)))
+        if (!find_symbol(symbol, &owner, NULL, true, false))
                 BUG();
         module_put(owner);
         preempt_enable();
@@ -908,8 +900,10 @@ void symbol_put_addr(void *addr)
         if (core_kernel_text((unsigned long)addr))
                 return;
 
-        if (!(modaddr = module_text_address((unsigned long)addr)))
-                BUG();
+        /* module_text_address is safe here: we're supposed to have reference
+         * to module from symbol_get, so it can't go away. */
+        modaddr = __module_text_address((unsigned long)addr);
+        BUG_ON(!modaddr);
         module_put(modaddr);
 }
 EXPORT_SYMBOL_GPL(symbol_put_addr);
@@ -949,10 +943,11 @@ static inline void module_unload_free(struct module *mod)
 {
 }
 
-static inline int use_module(struct module *a, struct module *b)
+int use_module(struct module *a, struct module *b)
 {
         return strong_try_module_get(b) == 0;
 }
+EXPORT_SYMBOL_GPL(use_module);
 
 static inline void module_unload_init(struct module *mod)
 {
@@ -995,12 +990,12 @@ static struct module_attribute *modinfo_attrs[] = {
 
 static const char vermagic[] = VERMAGIC_STRING;
 
-static int try_to_force_load(struct module *mod, const char *symname)
+static int try_to_force_load(struct module *mod, const char *reason)
 {
 #ifdef CONFIG_MODULE_FORCE_LOAD
         if (!test_taint(TAINT_FORCED_MODULE))
-                printk("%s: no version for \"%s\" found: kernel tainted.\n",
-                       mod->name, symname);
+                printk(KERN_WARNING "%s: %s: kernel tainted.\n",
+                       mod->name, reason);
         add_taint_module(mod, TAINT_FORCED_MODULE);
         return 0;
 #else
@@ -1057,9 +1052,9 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
 {
         const unsigned long *crc;
 
-        if (IS_ERR_VALUE(find_symbol("struct_module", NULL, &crc, true, false)))
+        if (!find_symbol("module_layout", NULL, &crc, true, false))
                 BUG();
-        return check_version(sechdrs, versindex, "struct_module", mod, crc);
+        return check_version(sechdrs, versindex, "module_layout", mod, crc);
 }
 
 /* First part is kernel version, which we ignore if module has crcs. */
@@ -1098,25 +1093,25 @@ static inline int same_magic(const char *amagic, const char *bmagic,
 
 /* Resolve a symbol for this module.  I.e. if we find one, record usage.
    Must be holding module_mutex. */
-static unsigned long resolve_symbol(Elf_Shdr *sechdrs,
-                                    unsigned int versindex,
-                                    const char *name,
-                                    struct module *mod)
+static const struct kernel_symbol *resolve_symbol(Elf_Shdr *sechdrs,
+                                                  unsigned int versindex,
+                                                  const char *name,
+                                                  struct module *mod)
 {
         struct module *owner;
-        unsigned long ret;
+        const struct kernel_symbol *sym;
         const unsigned long *crc;
 
-        ret = find_symbol(name, &owner, &crc,
+        sym = find_symbol(name, &owner, &crc,
                           !(mod->taints & (1 << TAINT_PROPRIETARY_MODULE)), true);
-        if (!IS_ERR_VALUE(ret)) {
-                /* use_module can fail due to OOM,
-                   or module initialization or unloading */
+        /* use_module can fail due to OOM,
+           or module initialization or unloading */
+        if (sym) {
                 if (!check_version(sechdrs, versindex, name, mod, crc) ||
                     !use_module(mod, owner))
-                        ret = -EINVAL;
+                        sym = NULL;
         }
-        return ret;
+        return sym;
 }
 
 /*
@@ -1491,6 +1486,9 @@ static void free_module(struct module *mod)
         /* Module unload stuff */
         module_unload_free(mod);
 
+        /* Free any allocated parameters. */
+        destroy_params(mod->kp, mod->num_kp);
+
         /* release any pointers to mcount in this module */
         ftrace_release(mod->module_core, mod->core_size);
 
@@ -1513,17 +1511,15 @@ static void free_module(struct module *mod)
 void *__symbol_get(const char *symbol)
 {
         struct module *owner;
-        unsigned long value;
+        const struct kernel_symbol *sym;
 
         preempt_disable();
-        value = find_symbol(symbol, &owner, NULL, true, true);
-        if (IS_ERR_VALUE(value))
-                value = 0;
-        else if (strong_try_module_get(owner))
-                value = 0;
+        sym = find_symbol(symbol, &owner, NULL, true, true);
+        if (sym && strong_try_module_get(owner))
+                sym = NULL;
         preempt_enable();
 
-        return (void *)value;
+        return sym ? (void *)sym->value : NULL;
 }
 EXPORT_SYMBOL_GPL(__symbol_get);
 
@@ -1551,8 +1547,7 @@ static int verify_export_symbols(struct module *mod)
 
         for (i = 0; i < ARRAY_SIZE(arr); i++) {
                 for (s = arr[i].sym; s < arr[i].sym + arr[i].num; s++) {
-                        if (!IS_ERR_VALUE(find_symbol(s->name, &owner,
-                                                      NULL, true, false))) {
+                        if (find_symbol(s->name, &owner, NULL, true, false)) {
                                 printk(KERN_ERR
                                        "%s: exports duplicate symbol %s"
                                        " (owned by %s)\n",
@@ -1576,6 +1571,7 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
         unsigned long secbase;
         unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
         int ret = 0;
+        const struct kernel_symbol *ksym;
 
         for (i = 1; i < n; i++) {
                 switch (sym[i].st_shndx) {
@@ -1595,13 +1591,14 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
                         break;
 
                 case SHN_UNDEF:
-                        sym[i].st_value
-                          = resolve_symbol(sechdrs, versindex,
-                                           strtab + sym[i].st_name, mod);
-
+                        ksym = resolve_symbol(sechdrs, versindex,
+                                              strtab + sym[i].st_name, mod);
                         /* Ok if resolved.  */
-                        if (!IS_ERR_VALUE(sym[i].st_value))
+                        if (ksym) {
+                                sym[i].st_value = ksym->value;
                                 break;
+                        }
+
                         /* Ok if weak.  */
                         if (ELF_ST_BIND(sym[i].st_info) == STB_WEAK)
                                 break;
@@ -1676,8 +1673,7 @@ static void layout_sections(struct module *mod,
                         if ((s->sh_flags & masks[m][0]) != masks[m][0]
                             || (s->sh_flags & masks[m][1])
                             || s->sh_entsize != ~0UL
-                            || strncmp(secstrings + s->sh_name,
-                                       ".init", 5) == 0)
+                            || strstarts(secstrings + s->sh_name, ".init"))
                                 continue;
                         s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
                         DEBUGP("\t%s\n", secstrings + s->sh_name);
@@ -1694,8 +1690,7 @@ static void layout_sections(struct module *mod,
                         if ((s->sh_flags & masks[m][0]) != masks[m][0]
                             || (s->sh_flags & masks[m][1])
                             || s->sh_entsize != ~0UL
-                            || strncmp(secstrings + s->sh_name,
-                                       ".init", 5) != 0)
+                            || !strstarts(secstrings + s->sh_name, ".init"))
                                 continue;
                         s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
                                          | INIT_OFFSET_MASK);
@@ -1828,8 +1823,7 @@ static char elf_type(const Elf_Sym *sym,
                 else
                         return 'b';
         }
-        if (strncmp(secstrings + sechdrs[sym->st_shndx].sh_name,
-                    ".debug", strlen(".debug")) == 0)
+        if (strstarts(secstrings + sechdrs[sym->st_shndx].sh_name, ".debug"))
                 return 'n';
         return '?';
 }
@@ -1898,8 +1892,7 @@ static noinline struct module *load_module(void __user *umod,
         unsigned int symindex = 0;
         unsigned int strindex = 0;
         unsigned int modindex, versindex, infoindex, pcpuindex;
-        unsigned int num_kp, num_mcount;
-        struct kernel_param *kp;
+        unsigned int num_mcount;
         struct module *mod;
         long err = 0;
         void *percpu = NULL, *ptr = NULL; /* Stops spurious gcc warning */
@@ -1916,12 +1909,6 @@ static noinline struct module *load_module(void __user *umod,
         if (len > 64 * 1024 * 1024 || (hdr = vmalloc(len)) == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        /* Create stop_machine threads since the error path relies on
-         * a non-failing stop_machine call. */
-        err = stop_machine_create();
-        if (err)
-                goto free_hdr;
-
         if (copy_from_user(hdr, umod, len) != 0) {
                 err = -EFAULT;
                 goto free_hdr;
@@ -1962,9 +1949,12 @@ static noinline struct module *load_module(void __user *umod,
                 }
 #ifndef CONFIG_MODULE_UNLOAD
                 /* Don't load .exit sections */
-                if (strncmp(secstrings+sechdrs[i].sh_name, ".exit", 5) == 0)
+                if (strstarts(secstrings+sechdrs[i].sh_name, ".exit"))
                         sechdrs[i].sh_flags &= ~(unsigned long)SHF_ALLOC;
 #endif
+                /* Don't keep __versions around; it's just for loading. */
+                if (strcmp(secstrings + sechdrs[i].sh_name, "__versions") == 0)
+                        sechdrs[i].sh_flags &= ~(unsigned long)SHF_ALLOC;
         }
 
         modindex = find_sec(hdr, sechdrs, secstrings,
@@ -2006,7 +1996,7 @@ static noinline struct module *load_module(void __user *umod,
         modmagic = get_modinfo(sechdrs, infoindex, "vermagic");
         /* This is allowed: modprobe --force will invalidate it. */
         if (!modmagic) {
-                err = try_to_force_load(mod, "magic");
+                err = try_to_force_load(mod, "bad vermagic");
                 if (err)
                         goto free_hdr;
         } else if (!same_magic(modmagic, vermagic, versindex)) {
@@ -2144,8 +2134,8 @@ static noinline struct module *load_module(void __user *umod,
 
         /* Now we've got everything in the final locations, we can
          * find optional sections. */
-        kp = section_objs(hdr, sechdrs, secstrings, "__param", sizeof(*kp),
-                          &num_kp);
+        mod->kp = section_objs(hdr, sechdrs, secstrings, "__param",
+                               sizeof(*mod->kp), &mod->num_kp);
         mod->syms = section_objs(hdr, sechdrs, secstrings, "__ksymtab",
                                  sizeof(*mod->syms), &mod->num_syms);
         mod->crcs = section_addr(hdr, sechdrs, secstrings, "__kcrctab");
@@ -2195,8 +2185,8 @@ static noinline struct module *load_module(void __user *umod,
             || (mod->num_unused_gpl_syms && !mod->unused_gpl_crcs)
 #endif
                 ) {
-                printk(KERN_WARNING "%s: No versions for exported symbols.\n", mod->name);
-                err = try_to_force_load(mod, "nocrc");
+                err = try_to_force_load(mod,
+                                        "no versions for exported symbols");
                 if (err)
                         goto cleanup;
         }
@@ -2291,11 +2281,11 @@ static noinline struct module *load_module(void __user *umod,
          */
         list_add_rcu(&mod->list, &modules);
 
-        err = parse_args(mod->name, mod->args, kp, num_kp, NULL);
+        err = parse_args(mod->name, mod->args, mod->kp, mod->num_kp, NULL);
         if (err < 0)
                 goto unlink;
 
-        err = mod_sysfs_setup(mod, kp, num_kp);
+        err = mod_sysfs_setup(mod, mod->kp, mod->num_kp);
         if (err < 0)
                 goto unlink;
         add_sect_attrs(mod, hdr->e_shnum, secstrings, sechdrs);
@@ -2304,12 +2294,13 @@ static noinline struct module *load_module(void __user *umod,
         /* Get rid of temporary copy */
         vfree(hdr);
 
-        stop_machine_destroy();
         /* Done! */
         return mod;
 
  unlink:
-        stop_machine(__unlink_module, mod, NULL);
+        /* Unlink carefully: kallsyms could be walking list. */
+        list_del_rcu(&mod->list);
+        synchronize_sched();
         module_arch_cleanup(mod);
  cleanup:
         kobject_del(&mod->mkobj.kobj);
@@ -2317,8 +2308,8 @@ static noinline struct module *load_module(void __user *umod,
         ftrace_release(mod->module_core, mod->core_size);
  free_unload:
         module_unload_free(mod);
- free_init:
 #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+ free_init:
         percpu_modfree(mod->refptr);
 #endif
         module_free(mod, mod->module_init);
@@ -2332,7 +2323,6 @@ static noinline struct module *load_module(void __user *umod,
         kfree(args);
  free_hdr:
         vfree(hdr);
-        stop_machine_destroy();
         return ERR_PTR(err);
 
  truncated:
@@ -2609,6 +2599,25 @@ unsigned long module_kallsyms_lookup_name(const char *name)
         preempt_enable();
         return ret;
 }
+
+int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
+                                             struct module *, unsigned long),
+                                   void *data)
+{
+        struct module *mod;
+        unsigned int i;
+        int ret;
+
+        list_for_each_entry(mod, &modules, list) {
+                for (i = 0; i < mod->num_symtab; i++) {
+                        ret = fn(data, mod->strtab + mod->symtab[i].st_name,
+                                 mod, mod->symtab[i].st_value);
+                        if (ret != 0)
+                                return ret;
+                }
+        }
+        return 0;
+}
 #endif /* CONFIG_KALLSYMS */
 
 static char *module_flags(struct module *mod, char *buf)
@@ -2744,29 +2753,31 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
 }
 
 /*
- * Is this a valid module address?
+ * is_module_address - is this address inside a module?
+ * @addr: the address to check.
+ *
+ * See is_module_text_address() if you simply want to see if the address
+ * is code (not data).
  */
-int is_module_address(unsigned long addr)
+bool is_module_address(unsigned long addr)
 {
-        struct module *mod;
+        bool ret;
 
         preempt_disable();
-
-        list_for_each_entry_rcu(mod, &modules, list) {
-                if (within_module_core(addr, mod)) {
-                        preempt_enable();
-                        return 1;
-                }
-        }
-
+        ret = __module_address(addr) != NULL;
         preempt_enable();
 
-        return 0;
+        return ret;
 }
 
-
-/* Is this a valid kernel address? */
-__notrace_funcgraph struct module *__module_text_address(unsigned long addr)
+/*
+ * __module_address - get the module which contains an address.
+ * @addr: the address.
+ *
+ * Must be called with preempt disabled or module mutex held so that
+ * module doesn't get freed during this.
+ */
+__notrace_funcgraph struct module *__module_address(unsigned long addr)
 {
         struct module *mod;
 
@@ -2774,22 +2785,51 @@ __notrace_funcgraph struct module *__module_text_address(unsigned long addr)
                 return NULL;
 
         list_for_each_entry_rcu(mod, &modules, list)
-                if (within(addr, mod->module_init, mod->init_text_size)
-                    || within(addr, mod->module_core, mod->core_text_size))
+                if (within_module_core(addr, mod)
+                    || within_module_init(addr, mod))
                         return mod;
         return NULL;
 }
+EXPORT_SYMBOL_GPL(__module_address);
 
-struct module *module_text_address(unsigned long addr)
+/*
+ * is_module_text_address - is this address inside module code?
+ * @addr: the address to check.
+ *
+ * See is_module_address() if you simply want to see if the address is
+ * anywhere in a module.  See kernel_text_address() for testing if an
+ * address corresponds to kernel or module code.
+ */
+bool is_module_text_address(unsigned long addr)
 {
-        struct module *mod;
+        bool ret;
 
         preempt_disable();
-        mod = __module_text_address(addr);
+        ret = __module_text_address(addr) != NULL;
         preempt_enable();
 
+        return ret;
+}
+
+/*
+ * __module_text_address - get the module whose code contains an address.
+ * @addr: the address.
+ *
+ * Must be called with preempt disabled or module mutex held so that
+ * module doesn't get freed during this.
+ */
+struct module *__module_text_address(unsigned long addr)
+{
+        struct module *mod = __module_address(addr);
+        if (mod) {
+                /* Make sure it's within the text section. */
+                if (!within(addr, mod->module_init, mod->init_text_size)
+                    && !within(addr, mod->module_core, mod->core_text_size))
+                        mod = NULL;
+        }
         return mod;
 }
+EXPORT_SYMBOL_GPL(__module_text_address);
 
 /* Don't grab lock, we're oopsing. */
 void print_modules(void)
@@ -2809,9 +2849,17 @@ void print_modules(void)
 }
 
 #ifdef CONFIG_MODVERSIONS
-/* Generate the signature for struct module here, too, for modversions. */
-void struct_module(struct module *mod) { return; }
-EXPORT_SYMBOL(struct_module);
+/* Generate the signature for all relevant module structures here.
+ * If these change, we don't want to try to parse the module. */
+void module_layout(struct module *mod,
+                   struct modversion_info *ver,
+                   struct kernel_param *kp,
+                   struct kernel_symbol *ks,
+                   struct marker *marker,
+                   struct tracepoint *tp)
+{
+}
+EXPORT_SYMBOL(module_layout);
 #endif
 
 #ifdef CONFIG_MARKERS
diff --git a/kernel/ns_cgroup.c b/kernel/ns_cgroup.c
index 78bc3fdac0d2..5aa854f9e5ae 100644
--- a/kernel/ns_cgroup.c
+++ b/kernel/ns_cgroup.c
@@ -34,7 +34,7 @@ int ns_cgroup_clone(struct task_struct *task, struct pid *pid)
 
 /*
  * Rules:
- *   1. you can only enter a cgroup which is a child of your current
+ *   1. you can only enter a cgroup which is a descendant of your current
  *     cgroup
  *   2. you can only place another process into a cgroup if
  *     a. you have CAP_SYS_ADMIN
@@ -45,21 +45,15 @@ int ns_cgroup_clone(struct task_struct *task, struct pid *pid)
 static int ns_can_attach(struct cgroup_subsys *ss,
                 struct cgroup *new_cgroup, struct task_struct *task)
 {
-        struct cgroup *orig;
-
         if (current != task) {
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
 
-                if (!cgroup_is_descendant(new_cgroup))
+                if (!cgroup_is_descendant(new_cgroup, current))
                         return -EPERM;
         }
 
-        if (atomic_read(&new_cgroup->count) != 0)
-                return -EPERM;
-
-        orig = task_cgroup(task, ns_subsys_id);
-        if (orig && orig != new_cgroup->parent)
+        if (!cgroup_is_descendant(new_cgroup, task))
                 return -EPERM;
 
         return 0;
@@ -77,7 +71,7 @@ static struct cgroup_subsys_state *ns_create(struct cgroup_subsys *ss,
 
         if (!capable(CAP_SYS_ADMIN))
                 return ERR_PTR(-EPERM);
-        if (!cgroup_is_descendant(cgroup))
+        if (!cgroup_is_descendant(cgroup, current))
                 return ERR_PTR(-EPERM);
 
         ns_cgroup = kzalloc(sizeof(*ns_cgroup), GFP_KERNEL);
diff --git a/kernel/panic.c b/kernel/panic.c
index 32fe4eff1b89..3fd8c5bf8b39 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -8,19 +8,19 @@
  * This function is used through-out the kernel (including mm and fs)
  * to indicate a major problem.
  */
+#include <linux/debug_locks.h>
+#include <linux/interrupt.h>
+#include <linux/kallsyms.h>
+#include <linux/notifier.h>
 #include <linux/module.h>
-#include <linux/sched.h>
-#include <linux/delay.h>
+#include <linux/random.h>
 #include <linux/reboot.h>
-#include <linux/notifier.h>
-#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/kexec.h>
+#include <linux/sched.h>
 #include <linux/sysrq.h>
-#include <linux/interrupt.h>
+#include <linux/init.h>
 #include <linux/nmi.h>
-#include <linux/kexec.h>
-#include <linux/debug_locks.h>
-#include <linux/random.h>
-#include <linux/kallsyms.h>
 #include <linux/dmi.h>
 
 int panic_on_oops;
@@ -52,19 +52,15 @@ EXPORT_SYMBOL(panic_blink);
  *
  *      This function never returns.
  */
-
 NORET_TYPE void panic(const char * fmt, ...)
 {
-        long i;
         static char buf[1024];
         va_list args;
-#if defined(CONFIG_S390)
-        unsigned long caller = (unsigned long) __builtin_return_address(0);
-#endif
+        long i;
 
         /*
-         * It's possible to come here directly from a panic-assertion and not
-         * have preempt disabled. Some functions called from here want
+         * It's possible to come here directly from a panic-assertion and
+         * not have preempt disabled. Some functions called from here want
          * preempt to be disabled. No point enabling it later though...
          */
         preempt_disable();
@@ -77,7 +73,6 @@ NORET_TYPE void panic(const char * fmt, ...)
 #ifdef CONFIG_DEBUG_BUGVERBOSE
         dump_stack();
 #endif
-        bust_spinlocks(0);
 
         /*
          * If we have crashed and we have a crash kernel loaded let it handle
@@ -86,14 +81,12 @@ NORET_TYPE void panic(const char * fmt, ...)
          */
         crash_kexec(NULL);
 
-#ifdef CONFIG_SMP
         /*
          * Note smp_send_stop is the usual smp shutdown function, which
          * unfortunately means it may not be hardened to work in a panic
          * situation.
          */
         smp_send_stop();
-#endif
 
         atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 
@@ -102,19 +95,21 @@ NORET_TYPE void panic(const char * fmt, ...)
 
         if (panic_timeout > 0) {
                 /*
-                 * Delay timeout seconds before rebooting the machine. 
-                 * We can't use the "normal" timers since we just panicked..
-                 */
-                printk(KERN_EMERG "Rebooting in %d seconds..",panic_timeout);
+                 * Delay timeout seconds before rebooting the machine.
+                 * We can't use the "normal" timers since we just panicked.
+                 */
+                printk(KERN_EMERG "Rebooting in %d seconds..", panic_timeout);
+
                 for (i = 0; i < panic_timeout*1000; ) {
                         touch_nmi_watchdog();
                         i += panic_blink(i);
                         mdelay(1);
                         i++;
                 }
-                /*      This will not be a clean reboot, with everything
-                 *      shutting down.  But if there is a chance of
-                 *      rebooting the system it will be rebooted.
+                /*
+                 * This will not be a clean reboot, with everything
+                 * shutting down.  But if there is a chance of
+                 * rebooting the system it will be rebooted.
                  */
                 emergency_restart();
         }
@@ -127,38 +122,44 @@ NORET_TYPE void panic(const char * fmt, ...)
         }
 #endif
 #if defined(CONFIG_S390)
-        disabled_wait(caller);
+        {
+                unsigned long caller;
+
+                caller = (unsigned long)__builtin_return_address(0);
+                disabled_wait(caller);
+        }
 #endif
         local_irq_enable();
-        for (i = 0;;) {
+        for (i = 0; ; ) {
                 touch_softlockup_watchdog();
                 i += panic_blink(i);
                 mdelay(1);
                 i++;
         }
+        bust_spinlocks(0);
 }
 
 EXPORT_SYMBOL(panic);
 
 
 struct tnt {
-        u8 bit;
-        char true;
-        char false;
+        u8      bit;
+        char    true;
+        char    false;
 };
 
 static const struct tnt tnts[] = {
-        { TAINT_PROPRIETARY_MODULE, 'P', 'G' },
-        { TAINT_FORCED_MODULE, 'F', ' ' },
-        { TAINT_UNSAFE_SMP, 'S', ' ' },
-        { TAINT_FORCED_RMMOD, 'R', ' ' },
-        { TAINT_MACHINE_CHECK, 'M', ' ' },
-        { TAINT_BAD_PAGE, 'B', ' ' },
-        { TAINT_USER, 'U', ' ' },
-        { TAINT_DIE, 'D', ' ' },
-        { TAINT_OVERRIDDEN_ACPI_TABLE, 'A', ' ' },
-        { TAINT_WARN, 'W', ' ' },
-        { TAINT_CRAP, 'C', ' ' },
+        { TAINT_PROPRIETARY_MODULE,     'P', 'G' },
+        { TAINT_FORCED_MODULE,          'F', ' ' },
+        { TAINT_UNSAFE_SMP,             'S', ' ' },
+        { TAINT_FORCED_RMMOD,           'R', ' ' },
+        { TAINT_MACHINE_CHECK,          'M', ' ' },
+        { TAINT_BAD_PAGE,               'B', ' ' },
+        { TAINT_USER,                   'U', ' ' },
+        { TAINT_DIE,                    'D', ' ' },
+        { TAINT_OVERRIDDEN_ACPI_TABLE,  'A', ' ' },
+        { TAINT_WARN,                   'W', ' ' },
+        { TAINT_CRAP,                   'C', ' ' },
 };
 
 /**
@@ -195,7 +196,8 @@ const char *print_tainted(void)
                 *s = 0;
         } else
                 snprintf(buf, sizeof(buf), "Not tainted");
-        return(buf);
+
+        return buf;
 }
 
 int test_taint(unsigned flag)
@@ -211,7 +213,8 @@ unsigned long get_taint(void)
 
 void add_taint(unsigned flag)
 {
-        debug_locks = 0; /* can't trust the integrity of the kernel anymore */
+        /* can't trust the integrity of the kernel anymore: */
+        debug_locks = 0;
         set_bit(flag, &tainted_mask);
 }
 EXPORT_SYMBOL(add_taint);
@@ -266,8 +269,8 @@ static void do_oops_enter_exit(void)
 }
 
 /*
- * Return true if the calling CPU is allowed to print oops-related info.  This
- * is a bit racy..
+ * Return true if the calling CPU is allowed to print oops-related info.
+ * This is a bit racy..
  */
 int oops_may_print(void)
 {
@@ -276,20 +279,22 @@ int oops_may_print(void)
 
 /*
  * Called when the architecture enters its oops handler, before it prints
- * anything.  If this is the first CPU to oops, and it's oopsing the first time
- * then let it proceed.
+ * anything.  If this is the first CPU to oops, and it's oopsing the first
+ * time then let it proceed.
  *
- * This is all enabled by the pause_on_oops kernel boot option.  We do all this
- * to ensure that oopses don't scroll off the screen.  It has the side-effect
- * of preventing later-oopsing CPUs from mucking up the display, too.
+ * This is all enabled by the pause_on_oops kernel boot option.  We do all
+ * this to ensure that oopses don't scroll off the screen.  It has the
+ * side-effect of preventing later-oopsing CPUs from mucking up the display,
+ * too.
  *
- * It turns out that the CPU which is allowed to print ends up pausing for the
- * right duration, whereas all the other CPUs pause for twice as long: once in
- * oops_enter(), once in oops_exit().
+ * It turns out that the CPU which is allowed to print ends up pausing for
+ * the right duration, whereas all the other CPUs pause for twice as long:
+ * once in oops_enter(), once in oops_exit().
  */
 void oops_enter(void)
 {
-        debug_locks_off(); /* can't trust the integrity of the kernel anymore */
+        /* can't trust the integrity of the kernel anymore: */
+        debug_locks_off();
         do_oops_enter_exit();
 }
 
diff --git a/kernel/params.c b/kernel/params.c
index a1e3025b19a9..de273ec85bd2 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -24,6 +24,9 @@
 #include <linux/err.h>
 #include <linux/slab.h>
 
+/* We abuse the high bits of "perm" to record whether we kmalloc'ed. */
+#define KPARAM_KMALLOCED        0x80000000
+
 #if 0
 #define DEBUGP printk
 #else
@@ -217,7 +220,19 @@ int param_set_charp(const char *val, struct kernel_param *kp)
                 return -ENOSPC;
         }
 
-        *(char **)kp->arg = (char *)val;
+        if (kp->perm & KPARAM_KMALLOCED)
+                kfree(*(char **)kp->arg);
+
+        /* This is a hack.  We can't need to strdup in early boot, and we
+         * don't need to; this mangled commandline is preserved. */
+        if (slab_is_available()) {
+                kp->perm |= KPARAM_KMALLOCED;
+                *(char **)kp->arg = kstrdup(val, GFP_KERNEL);
+                if (!kp->arg)
+                        return -ENOMEM;
+        } else
+                *(const char **)kp->arg = val;
+
         return 0;
 }
 
@@ -571,6 +586,15 @@ void module_param_sysfs_remove(struct module *mod)
 }
 #endif
 
+void destroy_params(const struct kernel_param *params, unsigned num)
+{
+        unsigned int i;
+
+        for (i = 0; i < num; i++)
+                if (params[i].perm & KPARAM_KMALLOCED)
+                        kfree(*(char **)params[i].arg);
+}
+
 static void __init kernel_add_sysfs_param(const char *name,
                                           struct kernel_param *kparam,
                                           unsigned int name_skip)
diff --git a/kernel/pid.c b/kernel/pid.c
index 1b3586fe753a..b2e5f78fd281 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -403,6 +403,8 @@ struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
 {
         struct pid *pid;
         rcu_read_lock();
+        if (type != PIDTYPE_PID)
+                task = task->group_leader;
         pid = get_pid(task->pids[type].pid);
         rcu_read_unlock();
         return pid;
@@ -450,11 +452,24 @@ pid_t pid_vnr(struct pid *pid)
 }
 EXPORT_SYMBOL_GPL(pid_vnr);
 
-pid_t task_pid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
+pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
+                        struct pid_namespace *ns)
 {
-        return pid_nr_ns(task_pid(tsk), ns);
+        pid_t nr = 0;
+
+        rcu_read_lock();
+        if (!ns)
+                ns = current->nsproxy->pid_ns;
+        if (likely(pid_alive(task))) {
+                if (type != PIDTYPE_PID)
+                        task = task->group_leader;
+                nr = pid_nr_ns(task->pids[type].pid, ns);
+        }
+        rcu_read_unlock();
+
+        return nr;
 }
-EXPORT_SYMBOL(task_pid_nr_ns);
+EXPORT_SYMBOL(__task_pid_nr_ns);
 
 pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
 {
@@ -462,18 +477,6 @@ pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
 }
 EXPORT_SYMBOL(task_tgid_nr_ns);
 
-pid_t task_pgrp_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
-{
-        return pid_nr_ns(task_pgrp(tsk), ns);
-}
-EXPORT_SYMBOL(task_pgrp_nr_ns);
-
-pid_t task_session_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
-{
-        return pid_nr_ns(task_session(tsk), ns);
-}
-EXPORT_SYMBOL(task_session_nr_ns);
-
 struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
 {
         return ns_of_pid(task_pid(tsk));
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index fab8ea86fac3..2d1001b4858d 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -152,6 +152,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
 {
         int nr;
         int rc;
+        struct task_struct *task;
 
         /*
          * The last thread in the cgroup-init thread group is terminating.
@@ -169,7 +170,19 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
         read_lock(&tasklist_lock);
         nr = next_pidmap(pid_ns, 1);
         while (nr > 0) {
-                kill_proc_info(SIGKILL, SEND_SIG_PRIV, nr);
+                rcu_read_lock();
+
+                /*
+                 * Use force_sig() since it clears SIGNAL_UNKILLABLE ensuring
+                 * any nested-container's init processes don't ignore the
+                 * signal
+                 */
+                task = pid_task(find_vpid(nr), PIDTYPE_PID);
+                if (task)
+                        force_sig(SIGKILL, task);
+
+                rcu_read_unlock();
+
                 nr = next_pidmap(pid_ns, nr);
         }
         read_unlock(&tasklist_lock);
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index e886d1332a10..5f21ab2bbcdf 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -22,6 +22,7 @@
 #include <linux/console.h>
 #include <linux/cpu.h>
 #include <linux/freezer.h>
+#include <asm/suspend.h>
 
 #include "power.h"
 
@@ -288,7 +289,7 @@ static int create_image(int platform_mode)
  *      hibernation_snapshot - quiesce devices and create the hibernation
  *      snapshot image.
  *      @platform_mode - if set, use the platform driver, if available, to
- *                       prepare the platform frimware for the power transition.
+ *                       prepare the platform firmware for the power transition.
  *
  *      Must be called with pm_mutex held
  */
@@ -411,7 +412,7 @@ static int resume_target_kernel(bool platform_mode)
  *      hibernation_restore - quiesce devices and restore the hibernation
  *      snapshot image.  If successful, control returns in hibernation_snaphot()
  *      @platform_mode - if set, use the platform driver, if available, to
- *                       prepare the platform frimware for the transition.
+ *                       prepare the platform firmware for the transition.
  *
  *      Must be called with pm_mutex held
  */
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index f5fc2d7680f2..33e2e4a819f9 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -321,13 +321,10 @@ static int create_mem_extents(struct list_head *list, gfp_t gfp_mask)
 
         INIT_LIST_HEAD(list);
 
-        for_each_zone(zone) {
+        for_each_populated_zone(zone) {
                 unsigned long zone_start, zone_end;
                 struct mem_extent *ext, *cur, *aux;
 
-                if (!populated_zone(zone))
-                        continue;
-
                 zone_start = zone->zone_start_pfn;
                 zone_end = zone->zone_start_pfn + zone->spanned_pages;
 
@@ -804,8 +801,8 @@ static unsigned int count_free_highmem_pages(void)
         struct zone *zone;
         unsigned int cnt = 0;
 
-        for_each_zone(zone)
-                if (populated_zone(zone) && is_highmem(zone))
+        for_each_populated_zone(zone)
+                if (is_highmem(zone))
                         cnt += zone_page_state(zone, NR_FREE_PAGES);
 
         return cnt;
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index a92c91451559..78c35047586d 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -51,6 +51,7 @@
 #include <linux/highmem.h>
 #include <linux/time.h>
 #include <linux/rbtree.h>
+#include <linux/io.h>
 
 #include "power.h"
 
@@ -229,17 +230,16 @@ int swsusp_shrink_memory(void)
                 size = count_data_pages() + PAGES_FOR_IO + SPARE_PAGES;
                 tmp = size;
                 size += highmem_size;
-                for_each_zone (zone)
-                        if (populated_zone(zone)) {
-                                tmp += snapshot_additional_pages(zone);
-                                if (is_highmem(zone)) {
-                                        highmem_size -=
+                for_each_populated_zone(zone) {
+                        tmp += snapshot_additional_pages(zone);
+                        if (is_highmem(zone)) {
+                                highmem_size -=
                                         zone_page_state(zone, NR_FREE_PAGES);
-                                } else {
-                                        tmp -= zone_page_state(zone, NR_FREE_PAGES);
-                                        tmp += zone->lowmem_reserve[ZONE_NORMAL];
-                                }
+                        } else {
+                                tmp -= zone_page_state(zone, NR_FREE_PAGES);
+                                tmp += zone->lowmem_reserve[ZONE_NORMAL];
                         }
+                }
 
                 if (highmem_size < 0)
                         highmem_size = 0;
diff --git a/kernel/printk.c b/kernel/printk.c
index e3602d0755b0..5052b5497c67 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -32,6 +32,7 @@
 #include <linux/security.h>
 #include <linux/bootmem.h>
 #include <linux/syscalls.h>
+#include <linux/kexec.h>
 
 #include <asm/uaccess.h>
 
@@ -135,6 +136,24 @@ static char *log_buf = __log_buf;
 static int log_buf_len = __LOG_BUF_LEN;
 static unsigned logged_chars; /* Number of chars produced since last read+clear operation */
 
+#ifdef CONFIG_KEXEC
+/*
+ * This appends the listed symbols to /proc/vmcoreinfo
+ *
+ * /proc/vmcoreinfo is used by various utiilties, like crash and makedumpfile to
+ * obtain access to symbols that are otherwise very difficult to locate.  These
+ * symbols are specifically used so that utilities can access and extract the
+ * dmesg log from a vmcore file after a crash.
+ */
+void log_buf_kexec_setup(void)
+{
+        VMCOREINFO_SYMBOL(log_buf);
+        VMCOREINFO_SYMBOL(log_end);
+        VMCOREINFO_SYMBOL(log_buf_len);
+        VMCOREINFO_SYMBOL(logged_chars);
+}
+#endif
+
 static int __init log_buf_len_setup(char *str)
 {
         unsigned size = memparse(str, &str);
@@ -1292,8 +1311,11 @@ EXPORT_SYMBOL(printk_ratelimit);
 bool printk_timed_ratelimit(unsigned long *caller_jiffies,
                         unsigned int interval_msecs)
 {
-        if (*caller_jiffies == 0 || time_after(jiffies, *caller_jiffies)) {
-                *caller_jiffies = jiffies + msecs_to_jiffies(interval_msecs);
+        if (*caller_jiffies == 0
+                        || !time_in_range(jiffies, *caller_jiffies,
+                                        *caller_jiffies
+                                        + msecs_to_jiffies(interval_msecs))) {
+                *caller_jiffies = jiffies;
                 return true;
         }
         return false;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index c9cf48b21f05..aaad0ec34194 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -60,11 +60,15 @@ static void ptrace_untrace(struct task_struct *child)
 {
         spin_lock(&child->sighand->siglock);
         if (task_is_traced(child)) {
-                if (child->signal->flags & SIGNAL_STOP_STOPPED) {
+                /*
+                 * If the group stop is completed or in progress,
+                 * this thread was already counted as stopped.
+                 */
+                if (child->signal->flags & SIGNAL_STOP_STOPPED ||
+                    child->signal->group_stop_count)
                         __set_task_state(child, TASK_STOPPED);
-                } else {
+                else
                         signal_wake_up(child, 1);
-                }
         }
         spin_unlock(&child->sighand->siglock);
 }
@@ -235,18 +239,58 @@ out:
         return retval;
 }
 
-static inline void __ptrace_detach(struct task_struct *child, unsigned int data)
+/*
+ * Called with irqs disabled, returns true if childs should reap themselves.
+ */
+static int ignoring_children(struct sighand_struct *sigh)
 {
-        child->exit_code = data;
-        /* .. re-parent .. */
-        __ptrace_unlink(child);
-        /* .. and wake it up. */
-        if (child->exit_state != EXIT_ZOMBIE)
-                wake_up_process(child);
+        int ret;
+        spin_lock(&sigh->siglock);
+        ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) ||
+              (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT);
+        spin_unlock(&sigh->siglock);
+        return ret;
+}
+
+/*
+ * Called with tasklist_lock held for writing.
+ * Unlink a traced task, and clean it up if it was a traced zombie.
+ * Return true if it needs to be reaped with release_task().
+ * (We can't call release_task() here because we already hold tasklist_lock.)
+ *
+ * If it's a zombie, our attachedness prevented normal parent notification
+ * or self-reaping.  Do notification now if it would have happened earlier.
+ * If it should reap itself, return true.
+ *
+ * If it's our own child, there is no notification to do.
+ * But if our normal children self-reap, then this child
+ * was prevented by ptrace and we must reap it now.
+ */
+static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
+{
+        __ptrace_unlink(p);
+
+        if (p->exit_state == EXIT_ZOMBIE) {
+                if (!task_detached(p) && thread_group_empty(p)) {
+                        if (!same_thread_group(p->real_parent, tracer))
+                                do_notify_parent(p, p->exit_signal);
+                        else if (ignoring_children(tracer->sighand))
+                                p->exit_signal = -1;
+                }
+                if (task_detached(p)) {
+                        /* Mark it as in the process of being reaped. */
+                        p->exit_state = EXIT_DEAD;
+                        return true;
+                }
+        }
+
+        return false;
 }
 
 int ptrace_detach(struct task_struct *child, unsigned int data)
 {
+        bool dead = false;
+
         if (!valid_signal(data))
                 return -EIO;
 
@@ -255,14 +299,45 @@ int ptrace_detach(struct task_struct *child, unsigned int data)
         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 
         write_lock_irq(&tasklist_lock);
-        /* protect against de_thread()->release_task() */
-        if (child->ptrace)
-                __ptrace_detach(child, data);
+        /*
+         * This child can be already killed. Make sure de_thread() or
+         * our sub-thread doing do_wait() didn't do release_task() yet.
+         */
+        if (child->ptrace) {
+                child->exit_code = data;
+                dead = __ptrace_detach(current, child);
+        }
         write_unlock_irq(&tasklist_lock);
 
+        if (unlikely(dead))
+                release_task(child);
+
         return 0;
 }
 
+/*
+ * Detach all tasks we were using ptrace on.
+ */
+void exit_ptrace(struct task_struct *tracer)
+{
+        struct task_struct *p, *n;
+        LIST_HEAD(ptrace_dead);
+
+        write_lock_irq(&tasklist_lock);
+        list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
+                if (__ptrace_detach(tracer, p))
+                        list_add(&p->ptrace_entry, &ptrace_dead);
+        }
+        write_unlock_irq(&tasklist_lock);
+
+        BUG_ON(!list_empty(&tracer->ptraced));
+
+        list_for_each_entry_safe(p, n, &ptrace_dead, ptrace_entry) {
+                list_del_init(&p->ptrace_entry);
+                release_task(p);
+        }
+}
+
 int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
 {
         int copied = 0;
@@ -612,8 +687,6 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
                 goto out_put_task_struct;
 
         ret = arch_ptrace(child, request, addr, data);
-        if (ret < 0)
-                goto out_put_task_struct;
 
  out_put_task_struct:
         put_task_struct(child);
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index cae8a059cf47..2c7b8457d0d2 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -122,6 +122,8 @@ static void rcu_barrier_func(void *type)
         }
 }
 
+static inline void wait_migrated_callbacks(void);
+
 /*
  * Orchestrate the specified type of RCU barrier, waiting for all
  * RCU callbacks of the specified type to complete.
@@ -147,6 +149,7 @@ static void _rcu_barrier(enum rcu_barrier type)
                 complete(&rcu_barrier_completion);
         wait_for_completion(&rcu_barrier_completion);
         mutex_unlock(&rcu_barrier_mutex);
+        wait_migrated_callbacks();
 }
 
 /**
@@ -176,9 +179,50 @@ void rcu_barrier_sched(void)
 }
 EXPORT_SYMBOL_GPL(rcu_barrier_sched);
 
+static atomic_t rcu_migrate_type_count = ATOMIC_INIT(0);
+static struct rcu_head rcu_migrate_head[3];
+static DECLARE_WAIT_QUEUE_HEAD(rcu_migrate_wq);
+
+static void rcu_migrate_callback(struct rcu_head *notused)
+{
+        if (atomic_dec_and_test(&rcu_migrate_type_count))
+                wake_up(&rcu_migrate_wq);
+}
+
+static inline void wait_migrated_callbacks(void)
+{
+        wait_event(rcu_migrate_wq, !atomic_read(&rcu_migrate_type_count));
+}
+
+static int __cpuinit rcu_barrier_cpu_hotplug(struct notifier_block *self,
+                unsigned long action, void *hcpu)
+{
+        if (action == CPU_DYING) {
+                /*
+                 * preempt_disable() in on_each_cpu() prevents stop_machine(),
+                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
+                 * returns, all online cpus have queued rcu_barrier_func(),
+                 * and the dead cpu(if it exist) queues rcu_migrate_callback()s.
+                 *
+                 * These callbacks ensure _rcu_barrier() waits for all
+                 * RCU callbacks of the specified type to complete.
+                 */
+                atomic_set(&rcu_migrate_type_count, 3);
+                call_rcu_bh(rcu_migrate_head, rcu_migrate_callback);
+                call_rcu_sched(rcu_migrate_head + 1, rcu_migrate_callback);
+                call_rcu(rcu_migrate_head + 2, rcu_migrate_callback);
+        } else if (action == CPU_POST_DEAD) {
+                /* rcu_migrate_head is protected by cpu_add_remove_lock */
+                wait_migrated_callbacks();
+        }
+
+        return NOTIFY_OK;
+}
+
 void __init rcu_init(void)
 {
         __rcu_init();
+        hotcpu_notifier(rcu_barrier_cpu_hotplug, 0);
 }
 
 void rcu_scheduler_starting(void)
diff --git a/kernel/relay.c b/kernel/relay.c
index 8f2179c8056f..e92db8c06acf 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -797,13 +797,15 @@ void relay_subbufs_consumed(struct rchan *chan,
         if (!chan)
                 return;
 
-        if (cpu >= NR_CPUS || !chan->buf[cpu])
+        if (cpu >= NR_CPUS || !chan->buf[cpu] ||
+                                        subbufs_consumed > chan->n_subbufs)
                 return;
 
         buf = chan->buf[cpu];
-        buf->subbufs_consumed += subbufs_consumed;
-        if (buf->subbufs_consumed > buf->subbufs_produced)
+        if (subbufs_consumed > buf->subbufs_produced - buf->subbufs_consumed)
                 buf->subbufs_consumed = buf->subbufs_produced;
+        else
+                buf->subbufs_consumed += subbufs_consumed;
 }
 EXPORT_SYMBOL_GPL(relay_subbufs_consumed);
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 196d48babbef..55a10b8e31bb 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -1110,7 +1110,7 @@ static void hrtick_start(struct rq *rq, u64 delay)
         if (rq == this_rq()) {
                 hrtimer_restart(timer);
         } else if (!rq->hrtick_csd_pending) {
-                __smp_call_function_single(cpu_of(rq), &rq->hrtick_csd);
+                __smp_call_function_single(cpu_of(rq), &rq->hrtick_csd, 0);
                 rq->hrtick_csd_pending = 1;
         }
 }
@@ -3818,19 +3818,23 @@ find_busiest_queue(struct sched_group *group, enum cpu_idle_type idle,
  */
 #define MAX_PINNED_INTERVAL     512
 
+/* Working cpumask for load_balance and load_balance_newidle. */
+static DEFINE_PER_CPU(cpumask_var_t, load_balance_tmpmask);
+
 /*
  * Check this_cpu to ensure it is balanced within domain. Attempt to move
  * tasks if there is an imbalance.
  */
 static int load_balance(int this_cpu, struct rq *this_rq,
                         struct sched_domain *sd, enum cpu_idle_type idle,
-                        int *balance, struct cpumask *cpus)
+                        int *balance)
 {
         int ld_moved, all_pinned = 0, active_balance = 0, sd_idle = 0;
         struct sched_group *group;
         unsigned long imbalance;
         struct rq *busiest;
         unsigned long flags;
+        struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask);
 
         cpumask_setall(cpus);
 
@@ -3985,8 +3989,7 @@ out:
  * this_rq is locked.
  */
 static int
-load_balance_newidle(int this_cpu, struct rq *this_rq, struct sched_domain *sd,
-                        struct cpumask *cpus)
+load_balance_newidle(int this_cpu, struct rq *this_rq, struct sched_domain *sd)
 {
         struct sched_group *group;
         struct rq *busiest = NULL;
@@ -3994,6 +3997,7 @@ load_balance_newidle(int this_cpu, struct rq *this_rq, struct sched_domain *sd,
         int ld_moved = 0;
         int sd_idle = 0;
         int all_pinned = 0;
+        struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask);
 
         cpumask_setall(cpus);
 
@@ -4134,10 +4138,6 @@ static void idle_balance(int this_cpu, struct rq *this_rq)
         struct sched_domain *sd;
         int pulled_task = 0;
         unsigned long next_balance = jiffies + HZ;
-        cpumask_var_t tmpmask;
-
-        if (!alloc_cpumask_var(&tmpmask, GFP_ATOMIC))
-                return;
 
         for_each_domain(this_cpu, sd) {
                 unsigned long interval;
@@ -4148,7 +4148,7 @@ static void idle_balance(int this_cpu, struct rq *this_rq)
                 if (sd->flags & SD_BALANCE_NEWIDLE)
                         /* If we've pulled tasks over stop searching: */
                         pulled_task = load_balance_newidle(this_cpu, this_rq,
-                                                           sd, tmpmask);
+                                                           sd);
 
                 interval = msecs_to_jiffies(sd->balance_interval);
                 if (time_after(next_balance, sd->last_balance + interval))
@@ -4163,7 +4163,6 @@ static void idle_balance(int this_cpu, struct rq *this_rq)
                  */
                 this_rq->next_balance = next_balance;
         }
-        free_cpumask_var(tmpmask);
 }
 
 /*
@@ -4313,11 +4312,6 @@ static void rebalance_domains(int cpu, enum cpu_idle_type idle)
         unsigned long next_balance = jiffies + 60*HZ;
         int update_next_balance = 0;
         int need_serialize;
-        cpumask_var_t tmp;
-
-        /* Fails alloc?  Rebalancing probably not a priority right now. */
-        if (!alloc_cpumask_var(&tmp, GFP_ATOMIC))
-                return;
 
         for_each_domain(cpu, sd) {
                 if (!(sd->flags & SD_LOAD_BALANCE))
@@ -4342,7 +4336,7 @@ static void rebalance_domains(int cpu, enum cpu_idle_type idle)
                 }
 
                 if (time_after_eq(jiffies, sd->last_balance + interval)) {
-                        if (load_balance(cpu, rq, sd, idle, &balance, tmp)) {
+                        if (load_balance(cpu, rq, sd, idle, &balance)) {
                                 /*
                                  * We've pulled tasks over so either we're no
                                  * longer idle, or one of our SMT siblings is
@@ -4376,8 +4370,6 @@ out:
          */
         if (likely(update_next_balance))
                 rq->next_balance = next_balance;
-
-        free_cpumask_var(tmp);
 }
 
 /*
@@ -5196,11 +5188,17 @@ void __wake_up_locked(wait_queue_head_t *q, unsigned int mode)
         __wake_up_common(q, mode, 1, 0, NULL);
 }
 
+void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key)
+{
+        __wake_up_common(q, mode, 1, 0, key);
+}
+
 /**
- * __wake_up_sync - wake up threads blocked on a waitqueue.
+ * __wake_up_sync_key - wake up threads blocked on a waitqueue.
  * @q: the waitqueue
  * @mode: which threads
  * @nr_exclusive: how many wake-one or wake-many threads to wake up
+ * @key: opaque value to be passed to wakeup targets
  *
  * The sync wakeup differs that the waker knows that it will schedule
  * away soon, so while the target thread will be woken up, it will not
@@ -5209,8 +5207,8 @@ void __wake_up_locked(wait_queue_head_t *q, unsigned int mode)
  *
  * On UP it can prevent extra preemption.
  */
-void
-__wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr_exclusive)
+void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode,
+                        int nr_exclusive, void *key)
 {
         unsigned long flags;
         int sync = 1;
@@ -5222,9 +5220,18 @@ __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr_exclusive)
                 sync = 0;
 
         spin_lock_irqsave(&q->lock, flags);
-        __wake_up_common(q, mode, nr_exclusive, sync, NULL);
+        __wake_up_common(q, mode, nr_exclusive, sync, key);
         spin_unlock_irqrestore(&q->lock, flags);
 }
+EXPORT_SYMBOL_GPL(__wake_up_sync_key);
+
+/*
+ * __wake_up_sync - see __wake_up_sync_key()
+ */
+void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr_exclusive)
+{
+        __wake_up_sync_key(q, mode, nr_exclusive, NULL);
+}
 EXPORT_SYMBOL_GPL(__wake_up_sync);      /* For internal use only */
 
 /**
@@ -7713,7 +7720,7 @@ cpu_to_core_group(int cpu, const struct cpumask *cpu_map,
 {
         int group;
 
-        cpumask_and(mask, &per_cpu(cpu_sibling_map, cpu), cpu_map);
+        cpumask_and(mask, topology_thread_cpumask(cpu), cpu_map);
         group = cpumask_first(mask);
         if (sg)
                 *sg = &per_cpu(sched_group_core, group).sg;
@@ -7742,7 +7749,7 @@ cpu_to_phys_group(int cpu, const struct cpumask *cpu_map,
         cpumask_and(mask, cpu_coregroup_mask(cpu), cpu_map);
         group = cpumask_first(mask);
 #elif defined(CONFIG_SCHED_SMT)
-        cpumask_and(mask, &per_cpu(cpu_sibling_map, cpu), cpu_map);
+        cpumask_and(mask, topology_thread_cpumask(cpu), cpu_map);
         group = cpumask_first(mask);
 #else
         group = cpu;
@@ -8085,7 +8092,7 @@ static int __build_sched_domains(const struct cpumask *cpu_map,
                 SD_INIT(sd, SIBLING);
                 set_domain_attribute(sd, attr);
                 cpumask_and(sched_domain_span(sd),
-                            &per_cpu(cpu_sibling_map, i), cpu_map);
+                            topology_thread_cpumask(i), cpu_map);
                 sd->parent = p;
                 p->child = sd;
                 cpu_to_cpu_group(i, cpu_map, &sd->groups, tmpmask);
@@ -8096,7 +8103,7 @@ static int __build_sched_domains(const struct cpumask *cpu_map,
         /* Set up CPU (sibling) groups */
         for_each_cpu(i, cpu_map) {
                 cpumask_and(this_sibling_map,
-                            &per_cpu(cpu_sibling_map, i), cpu_map);
+                            topology_thread_cpumask(i), cpu_map);
                 if (i != cpumask_first(this_sibling_map))
                         continue;
 
@@ -8772,6 +8779,9 @@ void __init sched_init(void)
 #ifdef CONFIG_USER_SCHED
         alloc_size *= 2;
 #endif
+#ifdef CONFIG_CPUMASK_OFFSTACK
+        alloc_size += num_possible_cpus() * cpumask_size();
+#endif
         /*
          * As sched_init() is called before page_alloc is setup,
          * we use alloc_bootmem().
@@ -8809,6 +8819,12 @@ void __init sched_init(void)
                 ptr += nr_cpu_ids * sizeof(void **);
 #endif /* CONFIG_USER_SCHED */
 #endif /* CONFIG_RT_GROUP_SCHED */
+#ifdef CONFIG_CPUMASK_OFFSTACK
+                for_each_possible_cpu(i) {
+                        per_cpu(load_balance_tmpmask, i) = (void *)ptr;
+                        ptr += cpumask_size();
+                }
+#endif /* CONFIG_CPUMASK_OFFSTACK */
         }
 
 #ifdef CONFIG_SMP
diff --git a/kernel/signal.c b/kernel/signal.c
index 1c8814481a11..d8034737db4c 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -55,10 +55,22 @@ static int sig_handler_ignored(void __user *handler, int sig)
                 (handler == SIG_DFL && sig_kernel_ignore(sig));
 }
 
-static int sig_ignored(struct task_struct *t, int sig)
+static int sig_task_ignored(struct task_struct *t, int sig,
+                int from_ancestor_ns)
 {
         void __user *handler;
 
+        handler = sig_handler(t, sig);
+
+        if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) &&
+                        handler == SIG_DFL && !from_ancestor_ns)
+                return 1;
+
+        return sig_handler_ignored(handler, sig);
+}
+
+static int sig_ignored(struct task_struct *t, int sig, int from_ancestor_ns)
+{
         /*
          * Blocked signals are never ignored, since the
          * signal handler may change by the time it is
@@ -67,14 +79,13 @@ static int sig_ignored(struct task_struct *t, int sig)
         if (sigismember(&t->blocked, sig) || sigismember(&t->real_blocked, sig))
                 return 0;
 
-        handler = sig_handler(t, sig);
-        if (!sig_handler_ignored(handler, sig))
+        if (!sig_task_ignored(t, sig, from_ancestor_ns))
                 return 0;
 
         /*
          * Tracers may want to know about even ignored signals.
          */
-        return !tracehook_consider_ignored_signal(t, sig, handler);
+        return !tracehook_consider_ignored_signal(t, sig);
 }
 
 /*
@@ -318,7 +329,7 @@ int unhandled_signal(struct task_struct *tsk, int sig)
                 return 1;
         if (handler != SIG_IGN && handler != SIG_DFL)
                 return 0;
-        return !tracehook_consider_fatal_signal(tsk, sig, handler);
+        return !tracehook_consider_fatal_signal(tsk, sig);
 }
 
 
@@ -624,7 +635,7 @@ static int check_kill_permission(int sig, struct siginfo *info,
  * Returns true if the signal should be actually delivered, otherwise
  * it should be dropped.
  */
-static int prepare_signal(int sig, struct task_struct *p)
+static int prepare_signal(int sig, struct task_struct *p, int from_ancestor_ns)
 {
         struct signal_struct *signal = p->signal;
         struct task_struct *t;
@@ -708,7 +719,7 @@ static int prepare_signal(int sig, struct task_struct *p)
                 }
         }
 
-        return !sig_ignored(p, sig);
+        return !sig_ignored(p, sig, from_ancestor_ns);
 }
 
 /*
@@ -777,7 +788,7 @@ static void complete_signal(int sig, struct task_struct *p, int group)
             !(signal->flags & (SIGNAL_UNKILLABLE | SIGNAL_GROUP_EXIT)) &&
             !sigismember(&t->real_blocked, sig) &&
             (sig == SIGKILL ||
-             !tracehook_consider_fatal_signal(t, sig, SIG_DFL))) {
+             !tracehook_consider_fatal_signal(t, sig))) {
                 /*
                  * This signal will be fatal to the whole group.
                  */
@@ -813,8 +824,8 @@ static inline int legacy_queue(struct sigpending *signals, int sig)
         return (sig < SIGRTMIN) && sigismember(&signals->signal, sig);
 }
 
-static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
-                        int group)
+static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
+                        int group, int from_ancestor_ns)
 {
         struct sigpending *pending;
         struct sigqueue *q;
@@ -822,7 +833,8 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
         trace_sched_signal_send(sig, t);
 
         assert_spin_locked(&t->sighand->siglock);
-        if (!prepare_signal(sig, t))
+
+        if (!prepare_signal(sig, t, from_ancestor_ns))
                 return 0;
 
         pending = group ? &t->signal->shared_pending : &t->pending;
@@ -871,6 +883,8 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
                         break;
                 default:
                         copy_siginfo(&q->info, info);
+                        if (from_ancestor_ns)
+                                q->info.si_pid = 0;
                         break;
                 }
         } else if (!is_si_special(info)) {
@@ -889,6 +903,20 @@ out_set:
         return 0;
 }
 
+static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
+                        int group)
+{
+        int from_ancestor_ns = 0;
+
+#ifdef CONFIG_PID_NS
+        if (!is_si_special(info) && SI_FROMUSER(info) &&
+                        task_pid_nr_ns(current, task_active_pid_ns(t)) <= 0)
+                from_ancestor_ns = 1;
+#endif
+
+        return __send_signal(sig, info, t, group, from_ancestor_ns);
+}
+
 int print_fatal_signals;
 
 static void print_fatal_signal(struct pt_regs *regs, int signr)
@@ -1133,7 +1161,7 @@ int kill_pid_info_as_uid(int sig, struct siginfo *info, struct pid *pid,
         if (sig && p->sighand) {
                 unsigned long flags;
                 spin_lock_irqsave(&p->sighand->siglock, flags);
-                ret = __group_send_sig_info(sig, info, p);
+                ret = __send_signal(sig, info, p, 1, 0);
                 spin_unlock_irqrestore(&p->sighand->siglock, flags);
         }
 out_unlock:
@@ -1320,7 +1348,7 @@ int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group)
                 goto ret;
 
         ret = 1; /* the signal is ignored */
-        if (!prepare_signal(sig, t))
+        if (!prepare_signal(sig, t, 0))
                 goto out;
 
         ret = 0;
@@ -1844,9 +1872,16 @@ relock:
 
                 /*
                  * Global init gets no signals it doesn't want.
+                 * Container-init gets no signals it doesn't want from same
+                 * container.
+                 *
+                 * Note that if global/container-init sees a sig_kernel_only()
+                 * signal here, the signal must have been generated internally
+                 * or must have come from an ancestor namespace. In either
+                 * case, the signal cannot be dropped.
                  */
                 if (unlikely(signal->flags & SIGNAL_UNKILLABLE) &&
-                    !signal_group_exit(signal))
+                                !sig_kernel_only(signr))
                         continue;
 
                 if (sig_kernel_stop(signr)) {
diff --git a/kernel/slow-work.c b/kernel/slow-work.c
new file mode 100644
index 000000000000..cf2bc01186ef
--- /dev/null
+++ b/kernel/slow-work.c
@@ -0,0 +1,640 @@
+/* Worker thread pool for slow items, such as filesystem lookups or mkdirs
+ *
+ * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ *
+ * See Documentation/slow-work.txt
+ */
+
+#include <linux/module.h>
+#include <linux/slow-work.h>
+#include <linux/kthread.h>
+#include <linux/freezer.h>
+#include <linux/wait.h>
+
+#define SLOW_WORK_CULL_TIMEOUT (5 * HZ) /* cull threads 5s after running out of
+                                         * things to do */
+#define SLOW_WORK_OOM_TIMEOUT (5 * HZ)  /* can't start new threads for 5s after
+                                         * OOM */
+
+static void slow_work_cull_timeout(unsigned long);
+static void slow_work_oom_timeout(unsigned long);
+
+#ifdef CONFIG_SYSCTL
+static int slow_work_min_threads_sysctl(struct ctl_table *, int, struct file *,
+                                        void __user *, size_t *, loff_t *);
+
+static int slow_work_max_threads_sysctl(struct ctl_table *, int , struct file *,
+                                        void __user *, size_t *, loff_t *);
+#endif
+
+/*
+ * The pool of threads has at least min threads in it as long as someone is
+ * using the facility, and may have as many as max.
+ *
+ * A portion of the pool may be processing very slow operations.
+ */
+static unsigned slow_work_min_threads = 2;
+static unsigned slow_work_max_threads = 4;
+static unsigned vslow_work_proportion = 50; /* % of threads that may process
+                                             * very slow work */
+
+#ifdef CONFIG_SYSCTL
+static const int slow_work_min_min_threads = 2;
+static int slow_work_max_max_threads = 255;
+static const int slow_work_min_vslow = 1;
+static const int slow_work_max_vslow = 99;
+
+ctl_table slow_work_sysctls[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "min-threads",
+                .data           = &slow_work_min_threads,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = slow_work_min_threads_sysctl,
+                .extra1         = (void *) &slow_work_min_min_threads,
+                .extra2         = &slow_work_max_threads,
+        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "max-threads",
+                .data           = &slow_work_max_threads,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = slow_work_max_threads_sysctl,
+                .extra1         = &slow_work_min_threads,
+                .extra2         = (void *) &slow_work_max_max_threads,
+        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "vslow-percentage",
+                .data           = &vslow_work_proportion,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .extra1         = (void *) &slow_work_min_vslow,
+                .extra2         = (void *) &slow_work_max_vslow,
+        },
+        { .ctl_name = 0 }
+};
+#endif
+
+/*
+ * The active state of the thread pool
+ */
+static atomic_t slow_work_thread_count;
+static atomic_t vslow_work_executing_count;
+
+static bool slow_work_may_not_start_new_thread;
+static bool slow_work_cull; /* cull a thread due to lack of activity */
+static DEFINE_TIMER(slow_work_cull_timer, slow_work_cull_timeout, 0, 0);
+static DEFINE_TIMER(slow_work_oom_timer, slow_work_oom_timeout, 0, 0);
+static struct slow_work slow_work_new_thread; /* new thread starter */
+
+/*
+ * The queues of work items and the lock governing access to them.  These are
+ * shared between all the CPUs.  It doesn't make sense to have per-CPU queues
+ * as the number of threads bears no relation to the number of CPUs.
+ *
+ * There are two queues of work items: one for slow work items, and one for
+ * very slow work items.
+ */
+static LIST_HEAD(slow_work_queue);
+static LIST_HEAD(vslow_work_queue);
+static DEFINE_SPINLOCK(slow_work_queue_lock);
+
+/*
+ * The thread controls.  A variable used to signal to the threads that they
+ * should exit when the queue is empty, a waitqueue used by the threads to wait
+ * for signals, and a completion set by the last thread to exit.
+ */
+static bool slow_work_threads_should_exit;
+static DECLARE_WAIT_QUEUE_HEAD(slow_work_thread_wq);
+static DECLARE_COMPLETION(slow_work_last_thread_exited);
+
+/*
+ * The number of users of the thread pool and its lock.  Whilst this is zero we
+ * have no threads hanging around, and when this reaches zero, we wait for all
+ * active or queued work items to complete and kill all the threads we do have.
+ */
+static int slow_work_user_count;
+static DEFINE_MUTEX(slow_work_user_lock);
+
+/*
+ * Calculate the maximum number of active threads in the pool that are
+ * permitted to process very slow work items.
+ *
+ * The answer is rounded up to at least 1, but may not equal or exceed the
+ * maximum number of the threads in the pool.  This means we always have at
+ * least one thread that can process slow work items, and we always have at
+ * least one thread that won't get tied up doing so.
+ */
+static unsigned slow_work_calc_vsmax(void)
+{
+        unsigned vsmax;
+
+        vsmax = atomic_read(&slow_work_thread_count) * vslow_work_proportion;
+        vsmax /= 100;
+        vsmax = max(vsmax, 1U);
+        return min(vsmax, slow_work_max_threads - 1);
+}
+
+/*
+ * Attempt to execute stuff queued on a slow thread.  Return true if we managed
+ * it, false if there was nothing to do.
+ */
+static bool slow_work_execute(void)
+{
+        struct slow_work *work = NULL;
+        unsigned vsmax;
+        bool very_slow;
+
+        vsmax = slow_work_calc_vsmax();
+
+        /* see if we can schedule a new thread to be started if we're not
+         * keeping up with the work */
+        if (!waitqueue_active(&slow_work_thread_wq) &&
+            (!list_empty(&slow_work_queue) || !list_empty(&vslow_work_queue)) &&
+            atomic_read(&slow_work_thread_count) < slow_work_max_threads &&
+            !slow_work_may_not_start_new_thread)
+                slow_work_enqueue(&slow_work_new_thread);
+
+        /* find something to execute */
+        spin_lock_irq(&slow_work_queue_lock);
+        if (!list_empty(&vslow_work_queue) &&
+            atomic_read(&vslow_work_executing_count) < vsmax) {
+                work = list_entry(vslow_work_queue.next,
+                                  struct slow_work, link);
+                if (test_and_set_bit_lock(SLOW_WORK_EXECUTING, &work->flags))
+                        BUG();
+                list_del_init(&work->link);
+                atomic_inc(&vslow_work_executing_count);
+                very_slow = true;
+        } else if (!list_empty(&slow_work_queue)) {
+                work = list_entry(slow_work_queue.next,
+                                  struct slow_work, link);
+                if (test_and_set_bit_lock(SLOW_WORK_EXECUTING, &work->flags))
+                        BUG();
+                list_del_init(&work->link);
+                very_slow = false;
+        } else {
+                very_slow = false; /* avoid the compiler warning */
+        }
+        spin_unlock_irq(&slow_work_queue_lock);
+
+        if (!work)
+                return false;
+
+        if (!test_and_clear_bit(SLOW_WORK_PENDING, &work->flags))
+                BUG();
+
+        work->ops->execute(work);
+
+        if (very_slow)
+                atomic_dec(&vslow_work_executing_count);
+        clear_bit_unlock(SLOW_WORK_EXECUTING, &work->flags);
+
+        /* if someone tried to enqueue the item whilst we were executing it,
+         * then it'll be left unenqueued to avoid multiple threads trying to
+         * execute it simultaneously
+         *
+         * there is, however, a race between us testing the pending flag and
+         * getting the spinlock, and between the enqueuer setting the pending
+         * flag and getting the spinlock, so we use a deferral bit to tell us
+         * if the enqueuer got there first
+         */
+        if (test_bit(SLOW_WORK_PENDING, &work->flags)) {
+                spin_lock_irq(&slow_work_queue_lock);
+
+                if (!test_bit(SLOW_WORK_EXECUTING, &work->flags) &&
+                    test_and_clear_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags))
+                        goto auto_requeue;
+
+                spin_unlock_irq(&slow_work_queue_lock);
+        }
+
+        work->ops->put_ref(work);
+        return true;
+
+auto_requeue:
+        /* we must complete the enqueue operation
+         * - we transfer our ref on the item back to the appropriate queue
+         * - don't wake another thread up as we're awake already
+         */
+        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags))
+                list_add_tail(&work->link, &vslow_work_queue);
+        else
+                list_add_tail(&work->link, &slow_work_queue);
+        spin_unlock_irq(&slow_work_queue_lock);
+        return true;
+}
+
+/**
+ * slow_work_enqueue - Schedule a slow work item for processing
+ * @work: The work item to queue
+ *
+ * Schedule a slow work item for processing.  If the item is already undergoing
+ * execution, this guarantees not to re-enter the execution routine until the
+ * first execution finishes.
+ *
+ * The item is pinned by this function as it retains a reference to it, managed
+ * through the item operations.  The item is unpinned once it has been
+ * executed.
+ *
+ * An item may hog the thread that is running it for a relatively large amount
+ * of time, sufficient, for example, to perform several lookup, mkdir, create
+ * and setxattr operations.  It may sleep on I/O and may sleep to obtain locks.
+ *
+ * Conversely, if a number of items are awaiting processing, it may take some
+ * time before any given item is given attention.  The number of threads in the
+ * pool may be increased to deal with demand, but only up to a limit.
+ *
+ * If SLOW_WORK_VERY_SLOW is set on the work item, then it will be placed in
+ * the very slow queue, from which only a portion of the threads will be
+ * allowed to pick items to execute.  This ensures that very slow items won't
+ * overly block ones that are just ordinarily slow.
+ *
+ * Returns 0 if successful, -EAGAIN if not.
+ */
+int slow_work_enqueue(struct slow_work *work)
+{
+        unsigned long flags;
+
+        BUG_ON(slow_work_user_count <= 0);
+        BUG_ON(!work);
+        BUG_ON(!work->ops);
+        BUG_ON(!work->ops->get_ref);
+
+        /* when honouring an enqueue request, we only promise that we will run
+         * the work function in the future; we do not promise to run it once
+         * per enqueue request
+         *
+         * we use the PENDING bit to merge together repeat requests without
+         * having to disable IRQs and take the spinlock, whilst still
+         * maintaining our promise
+         */
+        if (!test_and_set_bit_lock(SLOW_WORK_PENDING, &work->flags)) {
+                spin_lock_irqsave(&slow_work_queue_lock, flags);
+
+                /* we promise that we will not attempt to execute the work
+                 * function in more than one thread simultaneously
+                 *
+                 * this, however, leaves us with a problem if we're asked to
+                 * enqueue the work whilst someone is executing the work
+                 * function as simply queueing the work immediately means that
+                 * another thread may try executing it whilst it is already
+                 * under execution
+                 *
+                 * to deal with this, we set the ENQ_DEFERRED bit instead of
+                 * enqueueing, and the thread currently executing the work
+                 * function will enqueue the work item when the work function
+                 * returns and it has cleared the EXECUTING bit
+                 */
+                if (test_bit(SLOW_WORK_EXECUTING, &work->flags)) {
+                        set_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags);
+                } else {
+                        if (work->ops->get_ref(work) < 0)
+                                goto cant_get_ref;
+                        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags))
+                                list_add_tail(&work->link, &vslow_work_queue);
+                        else
+                                list_add_tail(&work->link, &slow_work_queue);
+                        wake_up(&slow_work_thread_wq);
+                }
+
+                spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        }
+        return 0;
+
+cant_get_ref:
+        spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        return -EAGAIN;
+}
+EXPORT_SYMBOL(slow_work_enqueue);
+
+/*
+ * Worker thread culling algorithm
+ */
+static bool slow_work_cull_thread(void)
+{
+        unsigned long flags;
+        bool do_cull = false;
+
+        spin_lock_irqsave(&slow_work_queue_lock, flags);
+
+        if (slow_work_cull) {
+                slow_work_cull = false;
+
+                if (list_empty(&slow_work_queue) &&
+                    list_empty(&vslow_work_queue) &&
+                    atomic_read(&slow_work_thread_count) >
+                    slow_work_min_threads) {
+                        mod_timer(&slow_work_cull_timer,
+                                  jiffies + SLOW_WORK_CULL_TIMEOUT);
+                        do_cull = true;
+                }
+        }
+
+        spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        return do_cull;
+}
+
+/*
+ * Determine if there is slow work available for dispatch
+ */
+static inline bool slow_work_available(int vsmax)
+{
+        return !list_empty(&slow_work_queue) ||
+                (!list_empty(&vslow_work_queue) &&
+                 atomic_read(&vslow_work_executing_count) < vsmax);
+}
+
+/*
+ * Worker thread dispatcher
+ */
+static int slow_work_thread(void *_data)
+{
+        int vsmax;
+
+        DEFINE_WAIT(wait);
+
+        set_freezable();
+        set_user_nice(current, -5);
+
+        for (;;) {
+                vsmax = vslow_work_proportion;
+                vsmax *= atomic_read(&slow_work_thread_count);
+                vsmax /= 100;
+
+                prepare_to_wait(&slow_work_thread_wq, &wait,
+                                TASK_INTERRUPTIBLE);
+                if (!freezing(current) &&
+                    !slow_work_threads_should_exit &&
+                    !slow_work_available(vsmax) &&
+                    !slow_work_cull)
+                        schedule();
+                finish_wait(&slow_work_thread_wq, &wait);
+
+                try_to_freeze();
+
+                vsmax = vslow_work_proportion;
+                vsmax *= atomic_read(&slow_work_thread_count);
+                vsmax /= 100;
+
+                if (slow_work_available(vsmax) && slow_work_execute()) {
+                        cond_resched();
+                        if (list_empty(&slow_work_queue) &&
+                            list_empty(&vslow_work_queue) &&
+                            atomic_read(&slow_work_thread_count) >
+                            slow_work_min_threads)
+                                mod_timer(&slow_work_cull_timer,
+                                          jiffies + SLOW_WORK_CULL_TIMEOUT);
+                        continue;
+                }
+
+                if (slow_work_threads_should_exit)
+                        break;
+
+                if (slow_work_cull && slow_work_cull_thread())
+                        break;
+        }
+
+        if (atomic_dec_and_test(&slow_work_thread_count))
+                complete_and_exit(&slow_work_last_thread_exited, 0);
+        return 0;
+}
+
+/*
+ * Handle thread cull timer expiration
+ */
+static void slow_work_cull_timeout(unsigned long data)
+{
+        slow_work_cull = true;
+        wake_up(&slow_work_thread_wq);
+}
+
+/*
+ * Get a reference on slow work thread starter
+ */
+static int slow_work_new_thread_get_ref(struct slow_work *work)
+{
+        return 0;
+}
+
+/*
+ * Drop a reference on slow work thread starter
+ */
+static void slow_work_new_thread_put_ref(struct slow_work *work)
+{
+}
+
+/*
+ * Start a new slow work thread
+ */
+static void slow_work_new_thread_execute(struct slow_work *work)
+{
+        struct task_struct *p;
+
+        if (slow_work_threads_should_exit)
+                return;
+
+        if (atomic_read(&slow_work_thread_count) >= slow_work_max_threads)
+                return;
+
+        if (!mutex_trylock(&slow_work_user_lock))
+                return;
+
+        slow_work_may_not_start_new_thread = true;
+        atomic_inc(&slow_work_thread_count);
+        p = kthread_run(slow_work_thread, NULL, "kslowd");
+        if (IS_ERR(p)) {
+                printk(KERN_DEBUG "Slow work thread pool: OOM\n");
+                if (atomic_dec_and_test(&slow_work_thread_count))
+                        BUG(); /* we're running on a slow work thread... */
+                mod_timer(&slow_work_oom_timer,
+                          jiffies + SLOW_WORK_OOM_TIMEOUT);
+        } else {
+                /* ratelimit the starting of new threads */
+                mod_timer(&slow_work_oom_timer, jiffies + 1);
+        }
+
+        mutex_unlock(&slow_work_user_lock);
+}
+
+static const struct slow_work_ops slow_work_new_thread_ops = {
+        .get_ref        = slow_work_new_thread_get_ref,
+        .put_ref        = slow_work_new_thread_put_ref,
+        .execute        = slow_work_new_thread_execute,
+};
+
+/*
+ * post-OOM new thread start suppression expiration
+ */
+static void slow_work_oom_timeout(unsigned long data)
+{
+        slow_work_may_not_start_new_thread = false;
+}
+
+#ifdef CONFIG_SYSCTL
+/*
+ * Handle adjustment of the minimum number of threads
+ */
+static int slow_work_min_threads_sysctl(struct ctl_table *table, int write,
+                                        struct file *filp, void __user *buffer,
+                                        size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec_minmax(table, write, filp, buffer, lenp, ppos);
+        int n;
+
+        if (ret == 0) {
+                mutex_lock(&slow_work_user_lock);
+                if (slow_work_user_count > 0) {
+                        /* see if we need to start or stop threads */
+                        n = atomic_read(&slow_work_thread_count) -
+                                slow_work_min_threads;
+
+                        if (n < 0 && !slow_work_may_not_start_new_thread)
+                                slow_work_enqueue(&slow_work_new_thread);
+                        else if (n > 0)
+                                mod_timer(&slow_work_cull_timer,
+                                          jiffies + SLOW_WORK_CULL_TIMEOUT);
+                }
+                mutex_unlock(&slow_work_user_lock);
+        }
+
+        return ret;
+}
+
+/*
+ * Handle adjustment of the maximum number of threads
+ */
+static int slow_work_max_threads_sysctl(struct ctl_table *table, int write,
+                                        struct file *filp, void __user *buffer,
+                                        size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec_minmax(table, write, filp, buffer, lenp, ppos);
+        int n;
+
+        if (ret == 0) {
+                mutex_lock(&slow_work_user_lock);
+                if (slow_work_user_count > 0) {
+                        /* see if we need to stop threads */
+                        n = slow_work_max_threads -
+                                atomic_read(&slow_work_thread_count);
+
+                        if (n < 0)
+                                mod_timer(&slow_work_cull_timer,
+                                          jiffies + SLOW_WORK_CULL_TIMEOUT);
+                }
+                mutex_unlock(&slow_work_user_lock);
+        }
+
+        return ret;
+}
+#endif /* CONFIG_SYSCTL */
+
+/**
+ * slow_work_register_user - Register a user of the facility
+ *
+ * Register a user of the facility, starting up the initial threads if there
+ * aren't any other users at this point.  This will return 0 if successful, or
+ * an error if not.
+ */
+int slow_work_register_user(void)
+{
+        struct task_struct *p;
+        int loop;
+
+        mutex_lock(&slow_work_user_lock);
+
+        if (slow_work_user_count == 0) {
+                printk(KERN_NOTICE "Slow work thread pool: Starting up\n");
+                init_completion(&slow_work_last_thread_exited);
+
+                slow_work_threads_should_exit = false;
+                slow_work_init(&slow_work_new_thread,
+                               &slow_work_new_thread_ops);
+                slow_work_may_not_start_new_thread = false;
+                slow_work_cull = false;
+
+                /* start the minimum number of threads */
+                for (loop = 0; loop < slow_work_min_threads; loop++) {
+                        atomic_inc(&slow_work_thread_count);
+                        p = kthread_run(slow_work_thread, NULL, "kslowd");
+                        if (IS_ERR(p))
+                                goto error;
+                }
+                printk(KERN_NOTICE "Slow work thread pool: Ready\n");
+        }
+
+        slow_work_user_count++;
+        mutex_unlock(&slow_work_user_lock);
+        return 0;
+
+error:
+        if (atomic_dec_and_test(&slow_work_thread_count))
+                complete(&slow_work_last_thread_exited);
+        if (loop > 0) {
+                printk(KERN_ERR "Slow work thread pool:"
+                       " Aborting startup on ENOMEM\n");
+                slow_work_threads_should_exit = true;
+                wake_up_all(&slow_work_thread_wq);
+                wait_for_completion(&slow_work_last_thread_exited);
+                printk(KERN_ERR "Slow work thread pool: Aborted\n");
+        }
+        mutex_unlock(&slow_work_user_lock);
+        return PTR_ERR(p);
+}
+EXPORT_SYMBOL(slow_work_register_user);
+
+/**
+ * slow_work_unregister_user - Unregister a user of the facility
+ *
+ * Unregister a user of the facility, killing all the threads if this was the
+ * last one.
+ */
+void slow_work_unregister_user(void)
+{
+        mutex_lock(&slow_work_user_lock);
+
+        BUG_ON(slow_work_user_count <= 0);
+
+        slow_work_user_count--;
+        if (slow_work_user_count == 0) {
+                printk(KERN_NOTICE "Slow work thread pool: Shutting down\n");
+                slow_work_threads_should_exit = true;
+                wake_up_all(&slow_work_thread_wq);
+                wait_for_completion(&slow_work_last_thread_exited);
+                printk(KERN_NOTICE "Slow work thread pool:"
+                       " Shut down complete\n");
+        }
+
+        del_timer_sync(&slow_work_cull_timer);
+
+        mutex_unlock(&slow_work_user_lock);
+}
+EXPORT_SYMBOL(slow_work_unregister_user);
+
+/*
+ * Initialise the slow work facility
+ */
+static int __init init_slow_work(void)
+{
+        unsigned nr_cpus = num_possible_cpus();
+
+        if (slow_work_max_threads < nr_cpus)
+                slow_work_max_threads = nr_cpus;
+#ifdef CONFIG_SYSCTL
+        if (slow_work_max_max_threads < nr_cpus * 2)
+                slow_work_max_max_threads = nr_cpus * 2;
+#endif
+        return 0;
+}
+
+subsys_initcall(init_slow_work);
diff --git a/kernel/smp.c b/kernel/smp.c
index bbedbb7efe32..858baac568ee 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -2,40 +2,82 @@
  * Generic helpers for smp ipi calls
  *
  * (C) Jens Axboe <jens.axboe@oracle.com> 2008
- *
  */
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/percpu.h>
 #include <linux/rcupdate.h>
 #include <linux/rculist.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/percpu.h>
+#include <linux/init.h>
 #include <linux/smp.h>
+#include <linux/cpu.h>
 
 static DEFINE_PER_CPU(struct call_single_queue, call_single_queue);
-static LIST_HEAD(call_function_queue);
-__cacheline_aligned_in_smp DEFINE_SPINLOCK(call_function_lock);
+
+static struct {
+        struct list_head        queue;
+        spinlock_t              lock;
+} call_function __cacheline_aligned_in_smp =
+        {
+                .queue          = LIST_HEAD_INIT(call_function.queue),
+                .lock           = __SPIN_LOCK_UNLOCKED(call_function.lock),
+        };
 
 enum {
-        CSD_FLAG_WAIT           = 0x01,
-        CSD_FLAG_ALLOC          = 0x02,
-        CSD_FLAG_LOCK           = 0x04,
+        CSD_FLAG_LOCK           = 0x01,
 };
 
 struct call_function_data {
-        struct call_single_data csd;
-        spinlock_t lock;
-        unsigned int refs;
-        struct rcu_head rcu_head;
-        unsigned long cpumask_bits[];
+        struct call_single_data csd;
+        spinlock_t              lock;
+        unsigned int            refs;
+        cpumask_var_t           cpumask;
 };
 
 struct call_single_queue {
-        struct list_head list;
-        spinlock_t lock;
+        struct list_head        list;
+        spinlock_t              lock;
+};
+
+static DEFINE_PER_CPU(struct call_function_data, cfd_data) = {
+        .lock                   = __SPIN_LOCK_UNLOCKED(cfd_data.lock),
+};
+
+static int
+hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
+{
+        long cpu = (long)hcpu;
+        struct call_function_data *cfd = &per_cpu(cfd_data, cpu);
+
+        switch (action) {
+        case CPU_UP_PREPARE:
+        case CPU_UP_PREPARE_FROZEN:
+                if (!alloc_cpumask_var_node(&cfd->cpumask, GFP_KERNEL,
+                                cpu_to_node(cpu)))
+                        return NOTIFY_BAD;
+                break;
+
+#ifdef CONFIG_CPU_HOTPLUG
+        case CPU_UP_CANCELED:
+        case CPU_UP_CANCELED_FROZEN:
+
+        case CPU_DEAD:
+        case CPU_DEAD_FROZEN:
+                free_cpumask_var(cfd->cpumask);
+                break;
+#endif
+        };
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata hotplug_cfd_notifier = {
+        .notifier_call          = hotplug_cfd,
 };
 
 static int __cpuinit init_call_single_data(void)
 {
+        void *cpu = (void *)(long)smp_processor_id();
         int i;
 
         for_each_possible_cpu(i) {
@@ -44,29 +86,63 @@ static int __cpuinit init_call_single_data(void)
                 spin_lock_init(&q->lock);
                 INIT_LIST_HEAD(&q->list);
         }
+
+        hotplug_cfd(&hotplug_cfd_notifier, CPU_UP_PREPARE, cpu);
+        register_cpu_notifier(&hotplug_cfd_notifier);
+
         return 0;
 }
 early_initcall(init_call_single_data);
 
-static void csd_flag_wait(struct call_single_data *data)
+/*
+ * csd_lock/csd_unlock used to serialize access to per-cpu csd resources
+ *
+ * For non-synchronous ipi calls the csd can still be in use by the
+ * previous function call. For multi-cpu calls its even more interesting
+ * as we'll have to ensure no other cpu is observing our csd.
+ */
+static void csd_lock_wait(struct call_single_data *data)
 {
-        /* Wait for response */
-        do {
-                if (!(data->flags & CSD_FLAG_WAIT))
-                        break;
+        while (data->flags & CSD_FLAG_LOCK)
                 cpu_relax();
-        } while (1);
+}
+
+static void csd_lock(struct call_single_data *data)
+{
+        csd_lock_wait(data);
+        data->flags = CSD_FLAG_LOCK;
+
+        /*
+         * prevent CPU from reordering the above assignment
+         * to ->flags with any subsequent assignments to other
+         * fields of the specified call_single_data structure:
+         */
+        smp_mb();
+}
+
+static void csd_unlock(struct call_single_data *data)
+{
+        WARN_ON(!(data->flags & CSD_FLAG_LOCK));
+
+        /*
+         * ensure we're all done before releasing data:
+         */
+        smp_mb();
+
+        data->flags &= ~CSD_FLAG_LOCK;
 }
 
 /*
- * Insert a previously allocated call_single_data element for execution
- * on the given CPU. data must already have ->func, ->info, and ->flags set.
+ * Insert a previously allocated call_single_data element
+ * for execution on the given CPU. data must already have
+ * ->func, ->info, and ->flags set.
  */
-static void generic_exec_single(int cpu, struct call_single_data *data)
+static
+void generic_exec_single(int cpu, struct call_single_data *data, int wait)
 {
         struct call_single_queue *dst = &per_cpu(call_single_queue, cpu);
-        int wait = data->flags & CSD_FLAG_WAIT, ipi;
         unsigned long flags;
+        int ipi;
 
         spin_lock_irqsave(&dst->lock, flags);
         ipi = list_empty(&dst->list);
@@ -74,24 +150,21 @@ static void generic_exec_single(int cpu, struct call_single_data *data)
         spin_unlock_irqrestore(&dst->lock, flags);
 
         /*
-         * Make the list addition visible before sending the ipi.
+         * The list addition should be visible before sending the IPI
+         * handler locks the list to pull the entry off it because of
+         * normal cache coherency rules implied by spinlocks.
+         *
+         * If IPIs can go out of order to the cache coherency protocol
+         * in an architecture, sufficient synchronisation should be added
+         * to arch code to make it appear to obey cache coherency WRT
+         * locking and barrier primitives. Generic code isn't really
+         * equipped to do the right thing...
          */
-        smp_mb();
-
         if (ipi)
                 arch_send_call_function_single_ipi(cpu);
 
         if (wait)
-                csd_flag_wait(data);
-}
-
-static void rcu_free_call_data(struct rcu_head *head)
-{
-        struct call_function_data *data;
-
-        data = container_of(head, struct call_function_data, rcu_head);
-
-        kfree(data);
+                csd_lock_wait(data);
 }
 
 /*
@@ -104,99 +177,83 @@ void generic_smp_call_function_interrupt(void)
         int cpu = get_cpu();
 
         /*
-         * It's ok to use list_for_each_rcu() here even though we may delete
-         * 'pos', since list_del_rcu() doesn't clear ->next
+         * Ensure entry is visible on call_function_queue after we have
+         * entered the IPI. See comment in smp_call_function_many.
+         * If we don't have this, then we may miss an entry on the list
+         * and never get another IPI to process it.
+         */
+        smp_mb();
+
+        /*
+         * It's ok to use list_for_each_rcu() here even though we may
+         * delete 'pos', since list_del_rcu() doesn't clear ->next
          */
-        rcu_read_lock();
-        list_for_each_entry_rcu(data, &call_function_queue, csd.list) {
+        list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
                 int refs;
 
-                if (!cpumask_test_cpu(cpu, to_cpumask(data->cpumask_bits)))
+                spin_lock(&data->lock);
+                if (!cpumask_test_cpu(cpu, data->cpumask)) {
+                        spin_unlock(&data->lock);
                         continue;
+                }
+                cpumask_clear_cpu(cpu, data->cpumask);
+                spin_unlock(&data->lock);
 
                 data->csd.func(data->csd.info);
 
                 spin_lock(&data->lock);
-                cpumask_clear_cpu(cpu, to_cpumask(data->cpumask_bits));
                 WARN_ON(data->refs == 0);
-                data->refs--;
-                refs = data->refs;
+                refs = --data->refs;
+                if (!refs) {
+                        spin_lock(&call_function.lock);
+                        list_del_rcu(&data->csd.list);
+                        spin_unlock(&call_function.lock);
+                }
                 spin_unlock(&data->lock);
 
                 if (refs)
                         continue;
 
-                spin_lock(&call_function_lock);
-                list_del_rcu(&data->csd.list);
-                spin_unlock(&call_function_lock);
-
-                if (data->csd.flags & CSD_FLAG_WAIT) {
-                        /*
-                         * serialize stores to data with the flag clear
-                         * and wakeup
-                         */
-                        smp_wmb();
-                        data->csd.flags &= ~CSD_FLAG_WAIT;
-                }
-                if (data->csd.flags & CSD_FLAG_ALLOC)
-                        call_rcu(&data->rcu_head, rcu_free_call_data);
+                csd_unlock(&data->csd);
         }
-        rcu_read_unlock();
 
         put_cpu();
 }
 
 /*
- * Invoked by arch to handle an IPI for call function single. Must be called
- * from the arch with interrupts disabled.
+ * Invoked by arch to handle an IPI for call function single. Must be
+ * called from the arch with interrupts disabled.
  */
 void generic_smp_call_function_single_interrupt(void)
 {
         struct call_single_queue *q = &__get_cpu_var(call_single_queue);
+        unsigned int data_flags;
         LIST_HEAD(list);
 
-        /*
-         * Need to see other stores to list head for checking whether
-         * list is empty without holding q->lock
-         */
-        smp_read_barrier_depends();
-        while (!list_empty(&q->list)) {
-                unsigned int data_flags;
-
-                spin_lock(&q->lock);
-                list_replace_init(&q->list, &list);
-                spin_unlock(&q->lock);
-
-                while (!list_empty(&list)) {
-                        struct call_single_data *data;
-
-                        data = list_entry(list.next, struct call_single_data,
-                                                list);
-                        list_del(&data->list);
-
-                        /*
-                         * 'data' can be invalid after this call if
-                         * flags == 0 (when called through
-                         * generic_exec_single(), so save them away before
-                         * making the call.
-                         */
-                        data_flags = data->flags;
-
-                        data->func(data->info);
-
-                        if (data_flags & CSD_FLAG_WAIT) {
-                                smp_wmb();
-                                data->flags &= ~CSD_FLAG_WAIT;
-                        } else if (data_flags & CSD_FLAG_LOCK) {
-                                smp_wmb();
-                                data->flags &= ~CSD_FLAG_LOCK;
-                        } else if (data_flags & CSD_FLAG_ALLOC)
-                                kfree(data);
-                }
+        spin_lock(&q->lock);
+        list_replace_init(&q->list, &list);
+        spin_unlock(&q->lock);
+
+        while (!list_empty(&list)) {
+                struct call_single_data *data;
+
+                data = list_entry(list.next, struct call_single_data, list);
+                list_del(&data->list);
+
+                /*
+                 * 'data' can be invalid after this call if flags == 0
+                 * (when called through generic_exec_single()),
+                 * so save them away before making the call:
+                 */
+                data_flags = data->flags;
+
+                data->func(data->info);
+
                 /*
-                 * See comment on outer loop
+                 * Unlocked CSDs are valid through generic_exec_single():
                  */
-                smp_read_barrier_depends();
+                if (data_flags & CSD_FLAG_LOCK)
+                        csd_unlock(data);
         }
 }
 
@@ -215,65 +272,45 @@ static DEFINE_PER_CPU(struct call_single_data, csd_data);
 int smp_call_function_single(int cpu, void (*func) (void *info), void *info,
                              int wait)
 {
-        struct call_single_data d;
+        struct call_single_data d = {
+                .flags = 0,
+        };
         unsigned long flags;
-        /* prevent preemption and reschedule on another processor,
-           as well as CPU removal */
-        int me = get_cpu();
+        int this_cpu;
         int err = 0;
 
+        /*
+         * prevent preemption and reschedule on another processor,
+         * as well as CPU removal
+         */
+        this_cpu = get_cpu();
+
         /* Can deadlock when called with interrupts disabled */
-        WARN_ON(irqs_disabled());
+        WARN_ON_ONCE(irqs_disabled() && !oops_in_progress);
 
-        if (cpu == me) {
+        if (cpu == this_cpu) {
                 local_irq_save(flags);
                 func(info);
                 local_irq_restore(flags);
-        } else if ((unsigned)cpu < nr_cpu_ids && cpu_online(cpu)) {
-                struct call_single_data *data;
+        } else {
+                if ((unsigned)cpu < nr_cpu_ids && cpu_online(cpu)) {
+                        struct call_single_data *data = &d;
+
+                        if (!wait)
+                                data = &__get_cpu_var(csd_data);
 
-                if (!wait) {
-                        /*
-                         * We are calling a function on a single CPU
-                         * and we are not going to wait for it to finish.
-                         * We first try to allocate the data, but if we
-                         * fail, we fall back to use a per cpu data to pass
-                         * the information to that CPU. Since all callers
-                         * of this code will use the same data, we must
-                         * synchronize the callers to prevent a new caller
-                         * from corrupting the data before the callee
-                         * can access it.
-                         *
-                         * The CSD_FLAG_LOCK is used to let us know when
-                         * the IPI handler is done with the data.
-                         * The first caller will set it, and the callee
-                         * will clear it. The next caller must wait for
-                         * it to clear before we set it again. This
-                         * will make sure the callee is done with the
-                         * data before a new caller will use it.
-                         */
-                        data = kmalloc(sizeof(*data), GFP_ATOMIC);
-                        if (data)
-                                data->flags = CSD_FLAG_ALLOC;
-                        else {
-                                data = &per_cpu(csd_data, me);
-                                while (data->flags & CSD_FLAG_LOCK)
-                                        cpu_relax();
-                                data->flags = CSD_FLAG_LOCK;
-                        }
+                        csd_lock(data);
+
+                        data->func = func;
+                        data->info = info;
+                        generic_exec_single(cpu, data, wait);
                 } else {
-                        data = &d;
-                        data->flags = CSD_FLAG_WAIT;
+                        err = -ENXIO;   /* CPU not online */
                 }
-
-                data->func = func;
-                data->info = info;
-                generic_exec_single(cpu, data);
-        } else {
-                err = -ENXIO;   /* CPU not online */
         }
 
         put_cpu();
+
         return err;
 }
 EXPORT_SYMBOL(smp_call_function_single);
@@ -283,23 +320,26 @@ EXPORT_SYMBOL(smp_call_function_single);
  * @cpu: The CPU to run on.
  * @data: Pre-allocated and setup data structure
  *
- * Like smp_call_function_single(), but allow caller to pass in a pre-allocated
- * data structure. Useful for embedding @data inside other structures, for
- * instance.
- *
+ * Like smp_call_function_single(), but allow caller to pass in a
+ * pre-allocated data structure. Useful for embedding @data inside
+ * other structures, for instance.
  */
-void __smp_call_function_single(int cpu, struct call_single_data *data)
+void __smp_call_function_single(int cpu, struct call_single_data *data,
+                                int wait)
 {
+        csd_lock(data);
+
         /* Can deadlock when called with interrupts disabled */
-        WARN_ON((data->flags & CSD_FLAG_WAIT) && irqs_disabled());
+        WARN_ON_ONCE(wait && irqs_disabled() && !oops_in_progress);
 
-        generic_exec_single(cpu, data);
+        generic_exec_single(cpu, data, wait);
 }
 
-/* FIXME: Shim for archs using old arch_send_call_function_ipi API. */
+/* Deprecated: shim for archs using old arch_send_call_function_ipi API. */
+
 #ifndef arch_send_call_function_ipi_mask
-#define arch_send_call_function_ipi_mask(maskp) \
-        arch_send_call_function_ipi(*(maskp))
+# define arch_send_call_function_ipi_mask(maskp) \
+         arch_send_call_function_ipi(*(maskp))
 #endif
 
 /**
@@ -307,7 +347,8 @@ void __smp_call_function_single(int cpu, struct call_single_data *data)
  * @mask: The set of cpus to run on (only runs on online subset).
  * @func: The function to run. This must be fast and non-blocking.
  * @info: An arbitrary pointer to pass to the function.
- * @wait: If true, wait (atomically) until function has completed on other CPUs.
+ * @wait: If true, wait (atomically) until function has completed
+ *        on other CPUs.
  *
  * If @wait is true, then returns once @func has returned. Note that @wait
  * will be implicitly turned on in case of allocation failures, since
@@ -318,27 +359,27 @@ void __smp_call_function_single(int cpu, struct call_single_data *data)
  * must be disabled when calling this function.
  */
 void smp_call_function_many(const struct cpumask *mask,
-                            void (*func)(void *), void *info,
-                            bool wait)
+                            void (*func)(void *), void *info, bool wait)
 {
         struct call_function_data *data;
         unsigned long flags;
-        int cpu, next_cpu;
+        int cpu, next_cpu, this_cpu = smp_processor_id();
 
         /* Can deadlock when called with interrupts disabled */
-        WARN_ON(irqs_disabled());
+        WARN_ON_ONCE(irqs_disabled() && !oops_in_progress);
 
-        /* So, what's a CPU they want?  Ignoring this one. */
+        /* So, what's a CPU they want? Ignoring this one. */
         cpu = cpumask_first_and(mask, cpu_online_mask);
-        if (cpu == smp_processor_id())
+        if (cpu == this_cpu)
                 cpu = cpumask_next_and(cpu, mask, cpu_online_mask);
+
         /* No online cpus?  We're done. */
         if (cpu >= nr_cpu_ids)
                 return;
 
         /* Do we have another CPU which isn't us? */
         next_cpu = cpumask_next_and(cpu, mask, cpu_online_mask);
-        if (next_cpu == smp_processor_id())
+        if (next_cpu == this_cpu)
                 next_cpu = cpumask_next_and(next_cpu, mask, cpu_online_mask);
 
         /* Fastpath: do that cpu by itself. */
@@ -347,43 +388,40 @@ void smp_call_function_many(const struct cpumask *mask,
                 return;
         }
 
-        data = kmalloc(sizeof(*data) + cpumask_size(), GFP_ATOMIC);
-        if (unlikely(!data)) {
-                /* Slow path. */
-                for_each_online_cpu(cpu) {
-                        if (cpu == smp_processor_id())
-                                continue;
-                        if (cpumask_test_cpu(cpu, mask))
-                                smp_call_function_single(cpu, func, info, wait);
-                }
-                return;
-        }
+        data = &__get_cpu_var(cfd_data);
+        csd_lock(&data->csd);
 
-        spin_lock_init(&data->lock);
-        data->csd.flags = CSD_FLAG_ALLOC;
-        if (wait)
-                data->csd.flags |= CSD_FLAG_WAIT;
+        spin_lock_irqsave(&data->lock, flags);
         data->csd.func = func;
         data->csd.info = info;
-        cpumask_and(to_cpumask(data->cpumask_bits), mask, cpu_online_mask);
-        cpumask_clear_cpu(smp_processor_id(), to_cpumask(data->cpumask_bits));
-        data->refs = cpumask_weight(to_cpumask(data->cpumask_bits));
+        cpumask_and(data->cpumask, mask, cpu_online_mask);
+        cpumask_clear_cpu(this_cpu, data->cpumask);
+        data->refs = cpumask_weight(data->cpumask);
 
-        spin_lock_irqsave(&call_function_lock, flags);
-        list_add_tail_rcu(&data->csd.list, &call_function_queue);
-        spin_unlock_irqrestore(&call_function_lock, flags);
+        spin_lock(&call_function.lock);
+        /*
+         * Place entry at the _HEAD_ of the list, so that any cpu still
+         * observing the entry in generic_smp_call_function_interrupt()
+         * will not miss any other list entries:
+         */
+        list_add_rcu(&data->csd.list, &call_function.queue);
+        spin_unlock(&call_function.lock);
+
+        spin_unlock_irqrestore(&data->lock, flags);
 
         /*
          * Make the list addition visible before sending the ipi.
+         * (IPIs must obey or appear to obey normal Linux cache
+         * coherency rules -- see comment in generic_exec_single).
          */
         smp_mb();
 
         /* Send a message to all CPUs in the map */
-        arch_send_call_function_ipi_mask(to_cpumask(data->cpumask_bits));
+        arch_send_call_function_ipi_mask(data->cpumask);
 
-        /* optionally wait for the CPUs to complete */
+        /* Optionally wait for the CPUs to complete */
         if (wait)
-                csd_flag_wait(&data->csd);
+                csd_lock_wait(&data->csd);
 }
 EXPORT_SYMBOL(smp_call_function_many);
 
@@ -391,7 +429,8 @@ EXPORT_SYMBOL(smp_call_function_many);
  * smp_call_function(): Run a function on all other CPUs.
  * @func: The function to run. This must be fast and non-blocking.
  * @info: An arbitrary pointer to pass to the function.
- * @wait: If true, wait (atomically) until function has completed on other CPUs.
+ * @wait: If true, wait (atomically) until function has completed
+ *        on other CPUs.
  *
  * Returns 0.
  *
@@ -407,26 +446,27 @@ int smp_call_function(void (*func)(void *), void *info, int wait)
         preempt_disable();
         smp_call_function_many(cpu_online_mask, func, info, wait);
         preempt_enable();
+
         return 0;
 }
 EXPORT_SYMBOL(smp_call_function);
 
 void ipi_call_lock(void)
 {
-        spin_lock(&call_function_lock);
+        spin_lock(&call_function.lock);
 }
 
 void ipi_call_unlock(void)
 {
-        spin_unlock(&call_function_lock);
+        spin_unlock(&call_function.lock);
 }
 
 void ipi_call_lock_irq(void)
 {
-        spin_lock_irq(&call_function_lock);
+        spin_lock_irq(&call_function.lock);
 }
 
 void ipi_call_unlock_irq(void)
 {
-        spin_unlock_irq(&call_function_lock);
+        spin_unlock_irq(&call_function.lock);
 }
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 57d3f67f6f38..ea23ec087ee9 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -180,7 +180,7 @@ asmlinkage void __do_softirq(void)
         account_system_vtime(current);
 
         __local_bh_disable((unsigned long)__builtin_return_address(0));
-        trace_softirq_enter();
+        lockdep_softirq_enter();
 
         cpu = smp_processor_id();
 restart:
@@ -220,7 +220,7 @@ restart:
         if (pending)
                 wakeup_softirqd();
 
-        trace_softirq_exit();
+        lockdep_softirq_exit();
 
         account_system_vtime(current);
         _local_bh_enable();
@@ -496,7 +496,7 @@ static int __try_remote_softirq(struct call_single_data *cp, int cpu, int softir
                 cp->flags = 0;
                 cp->priv = softirq;
 
-                __smp_call_function_single(cpu, cp);
+                __smp_call_function_single(cpu, cp, 0);
                 return 0;
         }
         return 1;
diff --git a/kernel/spinlock.c b/kernel/spinlock.c
index 29ab20749dd3..7932653c4ebd 100644
--- a/kernel/spinlock.c
+++ b/kernel/spinlock.c
@@ -121,7 +121,8 @@ unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
         local_irq_save(flags);
         preempt_disable();
         rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
-        LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
+        LOCK_CONTENDED_FLAGS(lock, _raw_read_trylock, _raw_read_lock,
+                             _raw_read_lock_flags, &flags);
         return flags;
 }
 EXPORT_SYMBOL(_read_lock_irqsave);
@@ -151,7 +152,8 @@ unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
         local_irq_save(flags);
         preempt_disable();
         rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
+        LOCK_CONTENDED_FLAGS(lock, _raw_write_trylock, _raw_write_lock,
+                             _raw_write_lock_flags, &flags);
         return flags;
 }
 EXPORT_SYMBOL(_write_lock_irqsave);
@@ -299,16 +301,8 @@ unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclas
         local_irq_save(flags);
         preempt_disable();
         spin_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
-        /*
-         * On lockdep we dont want the hand-coded irq-enable of
-         * _raw_spin_lock_flags() code, because lockdep assumes
-         * that interrupts are not re-enabled during lock-acquire:
-         */
-#ifdef CONFIG_LOCKDEP
-        LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
-#else
-        _raw_spin_lock_flags(lock, &flags);
-#endif
+        LOCK_CONTENDED_FLAGS(lock, _raw_spin_trylock, _raw_spin_lock,
+                                _raw_spin_lock_flags, &flags);
         return flags;
 }
 EXPORT_SYMBOL(_spin_lock_irqsave_nested);
diff --git a/kernel/sys.c b/kernel/sys.c
index 37f458e6882a..51dbb55604e8 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -34,6 +34,7 @@
 #include <linux/seccomp.h>
 #include <linux/cpu.h>
 #include <linux/ptrace.h>
+#include <linux/fs_struct.h>
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -1013,10 +1014,8 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
         if (err)
                 goto out;
 
-        if (task_pgrp(p) != pgrp) {
+        if (task_pgrp(p) != pgrp)
                 change_pid(p, PIDTYPE_PGID, pgrp);
-                set_task_pgrp(p, pid_nr(pgrp));
-        }
 
         err = 0;
 out:
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index c5ef44ff850f..82350f8f04f6 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -48,6 +48,7 @@
 #include <linux/acpi.h>
 #include <linux/reboot.h>
 #include <linux/ftrace.h>
+#include <linux/slow-work.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>
@@ -95,12 +96,9 @@ static int sixty = 60;
 static int neg_one = -1;
 #endif
 
-#if defined(CONFIG_MMU) && defined(CONFIG_FILE_LOCKING)
-static int two = 2;
-#endif
-
 static int zero;
 static int one = 1;
+static int two = 2;
 static unsigned long one_ul = 1;
 static int one_hundred = 100;
 
@@ -900,6 +898,14 @@ static struct ctl_table kern_table[] = {
                 .proc_handler   = &scan_unevictable_handler,
         },
 #endif
+#ifdef CONFIG_SLOW_WORK
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "slow-work",
+                .mode           = 0555,
+                .child          = slow_work_sysctls,
+        },
+#endif
 /*
  * NOTE: do not add new entries to this table unless you have read
  * Documentation/sysctl/ctl_unnumbered.txt
@@ -1010,7 +1016,7 @@ static struct ctl_table vm_table[] = {
                 .data           = &dirty_expire_interval,
                 .maxlen         = sizeof(dirty_expire_interval),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_userhz_jiffies,
+                .proc_handler   = &proc_dointvec,
         },
         {
                 .ctl_name       = VM_NR_PDFLUSH_THREADS,
@@ -1373,10 +1379,7 @@ static struct ctl_table fs_table[] = {
                 .data           = &lease_break_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
-                .extra1         = &zero,
-                .extra2         = &two,
+                .proc_handler   = &proc_dointvec,
         },
 #endif
 #ifdef CONFIG_AIO
@@ -1417,7 +1420,10 @@ static struct ctl_table fs_table[] = {
                 .data           = &suid_dumpable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+                .extra2         = &two,
         },
 #if defined(CONFIG_BINFMT_MISC) || defined(CONFIG_BINFMT_MISC_MODULE)
         {
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 34e707e5ab87..504086ab4443 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -72,11 +72,10 @@ config FUNCTION_GRAPH_TRACER
         help
           Enable the kernel to trace a function at both its return
           and its entry.
-          It's first purpose is to trace the duration of functions and
-          draw a call graph for each thread with some informations like
-          the return value.
-          This is done by setting the current return address on the current
-          task structure into a stack of calls.
+          Its first purpose is to trace the duration of functions and
+          draw a call graph for each thread with some information like
+          the return value. This is done by setting the current return 
+          address on the current task structure into a stack of calls.
 
 config IRQSOFF_TRACER
         bool "Interrupts-off Latency Tracer"
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index fdf913dfc7e8..53e8c8bc0c98 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1908,7 +1908,7 @@ int register_ftrace_function(struct ftrace_ops *ops)
 }
 
 /**
- * unregister_ftrace_function - unresgister a function for profiling.
+ * unregister_ftrace_function - unregister a function for profiling.
  * @ops - ops structure that holds the function to unregister
  *
  * Unregister a function that was added to be called by ftrace profiling.
diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
index 3b34b3545936..92359cc747a7 100644
--- a/kernel/utsname_sysctl.c
+++ b/kernel/utsname_sysctl.c
@@ -37,7 +37,7 @@ static void put_uts(ctl_table *table, int write, void *which)
                 up_write(&uts_sem);
 }
 
-#ifdef CONFIG_PROC_FS
+#ifdef CONFIG_PROC_SYSCTL
 /*
  *      Special case of dostring for the UTS structure. This has locks
  *      to observe. Should this be in kernel/sys.c ????
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 9aedd9fd825b..32f8e0d2bf5a 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -48,8 +48,6 @@ struct cpu_workqueue_struct {
 
         struct workqueue_struct *wq;
         struct task_struct *thread;
-
-        int run_depth;          /* Detect run_workqueue() recursion depth */
 } ____cacheline_aligned;
 
 /*
@@ -262,13 +260,6 @@ EXPORT_SYMBOL_GPL(queue_delayed_work_on);
 static void run_workqueue(struct cpu_workqueue_struct *cwq)
 {
         spin_lock_irq(&cwq->lock);
-        cwq->run_depth++;
-        if (cwq->run_depth > 3) {
-                /* morton gets to eat his hat */
-                printk("%s: recursion depth exceeded: %d\n",
-                        __func__, cwq->run_depth);
-                dump_stack();
-        }
         while (!list_empty(&cwq->worklist)) {
                 struct work_struct *work = list_entry(cwq->worklist.next,
                                                 struct work_struct, entry);
@@ -311,7 +302,6 @@ static void run_workqueue(struct cpu_workqueue_struct *cwq)
                 spin_lock_irq(&cwq->lock);
                 cwq->current_work = NULL;
         }
-        cwq->run_depth--;
         spin_unlock_irq(&cwq->lock);
 }
 
@@ -368,29 +358,20 @@ static void insert_wq_barrier(struct cpu_workqueue_struct *cwq,
 
 static int flush_cpu_workqueue(struct cpu_workqueue_struct *cwq)
 {
-        int active;
+        int active = 0;
+        struct wq_barrier barr;
 
-        if (cwq->thread == current) {
-                /*
-                 * Probably keventd trying to flush its own queue. So simply run
-                 * it by hand rather than deadlocking.
-                 */
-                run_workqueue(cwq);
-                active = 1;
-        } else {
-                struct wq_barrier barr;
+        WARN_ON(cwq->thread == current);
 
-                active = 0;
-                spin_lock_irq(&cwq->lock);
-                if (!list_empty(&cwq->worklist) || cwq->current_work != NULL) {
-                        insert_wq_barrier(cwq, &barr, &cwq->worklist);
-                        active = 1;
-                }
-                spin_unlock_irq(&cwq->lock);
-
-                if (active)
-                        wait_for_completion(&barr.done);
+        spin_lock_irq(&cwq->lock);
+        if (!list_empty(&cwq->worklist) || cwq->current_work != NULL) {
+                insert_wq_barrier(cwq, &barr, &cwq->worklist);
+                active = 1;
         }
+        spin_unlock_irq(&cwq->lock);
+
+        if (active)
+                wait_for_completion(&barr.done);
 
         return active;
 }