109 files changed, 6720 insertions, 3126 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index 0b5ff083fa22..353d3fe8ba33 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -43,7 +43,7 @@ obj-$(CONFIG_RT_MUTEXES) += rtmutex.o
 obj-$(CONFIG_DEBUG_RT_MUTEXES) += rtmutex-debug.o
 obj-$(CONFIG_RT_MUTEX_TESTER) += rtmutex-tester.o
 obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o
-obj-$(CONFIG_USE_GENERIC_SMP_HELPERS) += smp.o
+obj-$(CONFIG_SMP) += smp.o
 ifneq ($(CONFIG_SMP),y)
 obj-y += up.o
 endif
@@ -100,6 +100,7 @@ obj-$(CONFIG_FUNCTION_TRACER) += trace/
 obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_X86_DS) += trace/
 obj-$(CONFIG_RING_BUFFER) += trace/
+obj-$(CONFIG_TRACEPOINTS) += trace/
 obj-$(CONFIG_SMP) += sched_cpupri.o
 obj-$(CONFIG_IRQ_WORK) += irq_work.o
 obj-$(CONFIG_PERF_EVENTS) += perf_event.o
@@ -121,7 +122,7 @@ $(obj)/configs.o: $(obj)/config_data.h
 # config_data.h contains the same information as ikconfig.h but gzipped.
 # Info from config_data can be extracted from /proc/config*
 targets += config_data.gz
-$(obj)/config_data.gz: .config FORCE
+$(obj)/config_data.gz: $(KCONFIG_CONFIG) FORCE
         $(call if_changed,gzip)
 
 quiet_cmd_ikconfiggz = IKCFG   $@
diff --git a/kernel/audit.c b/kernel/audit.c
index 77770a034d59..e4956244ae50 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -400,7 +400,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
         if (err < 0) {
                 BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
                 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
-                audit_log_lost("auditd dissapeared\n");
+                audit_log_lost("auditd disappeared\n");
                 audit_pid = 0;
                 /* we might get lucky and get this in the next auditd */
                 audit_hold_skb(skb);
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index d2e3c7866460..e683869365d9 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -144,9 +144,9 @@ int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
 }
 
 /* Initialize a parent watch entry. */
-static struct audit_parent *audit_init_parent(struct nameidata *ndp)
+static struct audit_parent *audit_init_parent(struct path *path)
 {
-        struct inode *inode = ndp->path.dentry->d_inode;
+        struct inode *inode = path->dentry->d_inode;
         struct audit_parent *parent;
         int ret;
 
@@ -353,53 +353,40 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
 }
 
 /* Get path information necessary for adding watches. */
-static int audit_get_nd(char *path, struct nameidata **ndp, struct nameidata **ndw)
+static int audit_get_nd(struct audit_watch *watch, struct path *parent)
 {
-        struct nameidata *ndparent, *ndwatch;
+        struct nameidata nd;
+        struct dentry *d;
         int err;
 
-        ndparent = kmalloc(sizeof(*ndparent), GFP_KERNEL);
-        if (unlikely(!ndparent))
-                return -ENOMEM;
+        err = kern_path_parent(watch->path, &nd);
+        if (err)
+                return err;
 
-        ndwatch = kmalloc(sizeof(*ndwatch), GFP_KERNEL);
-        if (unlikely(!ndwatch)) {
-                kfree(ndparent);
-                return -ENOMEM;
+        if (nd.last_type != LAST_NORM) {
+                path_put(&nd.path);
+                return -EINVAL;
         }
 
-        err = path_lookup(path, LOOKUP_PARENT, ndparent);
-        if (err) {
-                kfree(ndparent);
-                kfree(ndwatch);
-                return err;
+        mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
+        d = lookup_one_len(nd.last.name, nd.path.dentry, nd.last.len);
+        if (IS_ERR(d)) {
+                mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
+                path_put(&nd.path);
+                return PTR_ERR(d);
         }
-
-        err = path_lookup(path, 0, ndwatch);
-        if (err) {
-                kfree(ndwatch);
-                ndwatch = NULL;
+        if (d->d_inode) {
+                /* update watch filter fields */
+                watch->dev = d->d_inode->i_sb->s_dev;
+                watch->ino = d->d_inode->i_ino;
         }
+        mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 
-        *ndp = ndparent;
-        *ndw = ndwatch;
-
+        *parent = nd.path;
+        dput(d);
         return 0;
 }
 
-/* Release resources used for watch path information. */
-static void audit_put_nd(struct nameidata *ndp, struct nameidata *ndw)
-{
-        if (ndp) {
-                path_put(&ndp->path);
-                kfree(ndp);
-        }
-        if (ndw) {
-                path_put(&ndw->path);
-                kfree(ndw);
-        }
-}
-
 /* Associate the given rule with an existing parent.
  * Caller must hold audit_filter_mutex. */
 static void audit_add_to_parent(struct audit_krule *krule,
@@ -440,31 +427,24 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
 {
         struct audit_watch *watch = krule->watch;
         struct audit_parent *parent;
-        struct nameidata *ndp = NULL, *ndw = NULL;
+        struct path parent_path;
         int h, ret = 0;
 
         mutex_unlock(&audit_filter_mutex);
 
         /* Avoid calling path_lookup under audit_filter_mutex. */
-        ret = audit_get_nd(watch->path, &ndp, &ndw);
-        if (ret) {
-                /* caller expects mutex locked */
-                mutex_lock(&audit_filter_mutex);
-                goto error;
-        }
+        ret = audit_get_nd(watch, &parent_path);
 
+        /* caller expects mutex locked */
         mutex_lock(&audit_filter_mutex);
 
-        /* update watch filter fields */
-        if (ndw) {
-                watch->dev = ndw->path.dentry->d_inode->i_sb->s_dev;
-                watch->ino = ndw->path.dentry->d_inode->i_ino;
-        }
+        if (ret)
+                return ret;
 
         /* either find an old parent or attach a new one */
-        parent = audit_find_parent(ndp->path.dentry->d_inode);
+        parent = audit_find_parent(parent_path.dentry->d_inode);
         if (!parent) {
-                parent = audit_init_parent(ndp);
+                parent = audit_init_parent(&parent_path);
                 if (IS_ERR(parent)) {
                         ret = PTR_ERR(parent);
                         goto error;
@@ -479,9 +459,8 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
         h = audit_hash_ino((u32)watch->ino);
         *list = &audit_inode_hash[h];
 error:
-        audit_put_nd(ndp, ndw);         /* NULL args OK */
+        path_put(&parent_path);
         return ret;
-
 }
 
 void audit_remove_watch_rule(struct audit_krule *krule)
diff --git a/kernel/capability.c b/kernel/capability.c
index 2f05303715a5..9e9385f132c8 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -306,7 +306,7 @@ int capable(int cap)
                 BUG();
         }
 
-        if (security_capable(cap) == 0) {
+        if (security_capable(current_cred(), cap) == 0) {
                 current->flags |= PF_SUPERPRIV;
                 return 1;
         }
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 66a416b42c18..95362d15128c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -764,6 +764,7 @@ EXPORT_SYMBOL_GPL(cgroup_unlock);
  */
 
 static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, int mode);
+static struct dentry *cgroup_lookup(struct inode *, struct dentry *, struct nameidata *);
 static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry);
 static int cgroup_populate_dir(struct cgroup *cgrp);
 static const struct inode_operations cgroup_dir_inode_operations;
@@ -860,6 +861,11 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
         iput(inode);
 }
 
+static int cgroup_delete(const struct dentry *d)
+{
+        return 1;
+}
+
 static void remove_dir(struct dentry *d)
 {
         struct dentry *parent = dget(d->d_parent);
@@ -874,25 +880,29 @@ static void cgroup_clear_directory(struct dentry *dentry)
         struct list_head *node;
 
         BUG_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
-        spin_lock(&dcache_lock);
+        spin_lock(&dentry->d_lock);
         node = dentry->d_subdirs.next;
         while (node != &dentry->d_subdirs) {
                 struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
+
+                spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
                 list_del_init(node);
                 if (d->d_inode) {
                         /* This should never be called on a cgroup
                          * directory with child cgroups */
                         BUG_ON(d->d_inode->i_mode & S_IFDIR);
-                        d = dget_locked(d);
-                        spin_unlock(&dcache_lock);
+                        dget_dlock(d);
+                        spin_unlock(&d->d_lock);
+                        spin_unlock(&dentry->d_lock);
                         d_delete(d);
                         simple_unlink(dentry->d_inode, d);
                         dput(d);
-                        spin_lock(&dcache_lock);
-                }
+                        spin_lock(&dentry->d_lock);
+                } else
+                        spin_unlock(&d->d_lock);
                 node = dentry->d_subdirs.next;
         }
-        spin_unlock(&dcache_lock);
+        spin_unlock(&dentry->d_lock);
 }
 
 /*
@@ -900,11 +910,16 @@ static void cgroup_clear_directory(struct dentry *dentry)
  */
 static void cgroup_d_remove_dir(struct dentry *dentry)
 {
+        struct dentry *parent;
+
         cgroup_clear_directory(dentry);
 
-        spin_lock(&dcache_lock);
+        parent = dentry->d_parent;
+        spin_lock(&parent->d_lock);
+        spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
         list_del_init(&dentry->d_u.d_child);
-        spin_unlock(&dcache_lock);
+        spin_unlock(&dentry->d_lock);
+        spin_unlock(&parent->d_lock);
         remove_dir(dentry);
 }
 
@@ -1440,6 +1455,11 @@ static int cgroup_set_super(struct super_block *sb, void *data)
 
 static int cgroup_get_rootdir(struct super_block *sb)
 {
+        static const struct dentry_operations cgroup_dops = {
+                .d_iput = cgroup_diput,
+                .d_delete = cgroup_delete,
+        };
+
         struct inode *inode =
                 cgroup_new_inode(S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR, sb);
         struct dentry *dentry;
@@ -1457,6 +1477,8 @@ static int cgroup_get_rootdir(struct super_block *sb)
                 return -ENOMEM;
         }
         sb->s_root = dentry;
+        /* for everything else we want ->d_op set */
+        sb->s_d_op = &cgroup_dops;
         return 0;
 }
 
@@ -2180,12 +2202,20 @@ static const struct file_operations cgroup_file_operations = {
 };
 
 static const struct inode_operations cgroup_dir_inode_operations = {
-        .lookup = simple_lookup,
+        .lookup = cgroup_lookup,
         .mkdir = cgroup_mkdir,
         .rmdir = cgroup_rmdir,
         .rename = cgroup_rename,
 };
 
+static struct dentry *cgroup_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
+{
+        if (dentry->d_name.len > NAME_MAX)
+                return ERR_PTR(-ENAMETOOLONG);
+        d_add(dentry, NULL);
+        return NULL;
+}
+
 /*
  * Check if a file is a control file
  */
@@ -2199,10 +2229,6 @@ static inline struct cftype *__file_cft(struct file *file)
 static int cgroup_create_file(struct dentry *dentry, mode_t mode,
                                 struct super_block *sb)
 {
-        static const struct dentry_operations cgroup_dops = {
-                .d_iput = cgroup_diput,
-        };
-
         struct inode *inode;
 
         if (!dentry)
@@ -2228,7 +2254,6 @@ static int cgroup_create_file(struct dentry *dentry, mode_t mode,
                 inode->i_size = 0;
                 inode->i_fop = &cgroup_file_operations;
         }
-        dentry->d_op = &cgroup_dops;
         d_instantiate(dentry, inode);
         dget(dentry);   /* Extra count - pin the dentry in core */
         return 0;
@@ -3638,9 +3663,7 @@ again:
         list_del(&cgrp->sibling);
         cgroup_unlock_hierarchy(cgrp->root);
 
-        spin_lock(&cgrp->dentry->d_lock);
         d = dget(cgrp->dentry);
-        spin_unlock(&d->d_lock);
 
         cgroup_d_remove_dir(d);
         dput(d);
@@ -4207,20 +4230,8 @@ void cgroup_post_fork(struct task_struct *child)
  */
 void cgroup_exit(struct task_struct *tsk, int run_callbacks)
 {
-        int i;
         struct css_set *cg;
-
-        if (run_callbacks && need_forkexit_callback) {
-                /*
-                 * modular subsystems can't use callbacks, so no need to lock
-                 * the subsys array
-                 */
-                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
-                        struct cgroup_subsys *ss = subsys[i];
-                        if (ss->exit)
-                                ss->exit(ss, tsk);
-                }
-        }
+        int i;
 
         /*
          * Unlink from the css_set task list if necessary.
@@ -4238,7 +4249,24 @@ void cgroup_exit(struct task_struct *tsk, int run_callbacks)
         task_lock(tsk);
         cg = tsk->cgroups;
         tsk->cgroups = &init_css_set;
+
+        if (run_callbacks && need_forkexit_callback) {
+                /*
+                 * modular subsystems can't use callbacks, so no need to lock
+                 * the subsys array
+                 */
+                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
+                        struct cgroup_subsys *ss = subsys[i];
+                        if (ss->exit) {
+                                struct cgroup *old_cgrp =
+                                        rcu_dereference_raw(cg->subsys[i])->cgroup;
+                                struct cgroup *cgrp = task_cgroup(tsk, i);
+                                ss->exit(ss, cgrp, old_cgrp, tsk);
+                        }
+                }
+        }
         task_unlock(tsk);
+
         if (cg)
                 put_css_set_taskexit(cg);
 }
@@ -4790,6 +4818,29 @@ css_get_next(struct cgroup_subsys *ss, int id,
         return ret;
 }
 
+/*
+ * get corresponding css from file open on cgroupfs directory
+ */
+struct cgroup_subsys_state *cgroup_css_from_dir(struct file *f, int id)
+{
+        struct cgroup *cgrp;
+        struct inode *inode;
+        struct cgroup_subsys_state *css;
+
+        inode = f->f_dentry->d_inode;
+        /* check in cgroup filesystem dir */
+        if (inode->i_op != &cgroup_dir_inode_operations)
+                return ERR_PTR(-EBADF);
+
+        if (id < 0 || id >= CGROUP_SUBSYS_COUNT)
+                return ERR_PTR(-EINVAL);
+
+        /* get cgroup */
+        cgrp = __d_cgrp(f->f_dentry);
+        css = cgrp->subsys[id];
+        return css ? css : ERR_PTR(-ENOENT);
+}
+
 #ifdef CONFIG_CGROUP_DEBUG
 static struct cgroup_subsys_state *debug_create(struct cgroup_subsys *ss,
                                                    struct cgroup *cont)
diff --git a/kernel/compat.c b/kernel/compat.c
index c9e2ec0b34a8..38b1d2c1cbe8 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -52,6 +52,64 @@ static int compat_put_timeval(struct compat_timeval __user *o,
                 put_user(i->tv_usec, &o->tv_usec)) ? -EFAULT : 0;
 }
 
+static int compat_get_timex(struct timex *txc, struct compat_timex __user *utp)
+{
+        memset(txc, 0, sizeof(struct timex));
+
+        if (!access_ok(VERIFY_READ, utp, sizeof(struct compat_timex)) ||
+                        __get_user(txc->modes, &utp->modes) ||
+                        __get_user(txc->offset, &utp->offset) ||
+                        __get_user(txc->freq, &utp->freq) ||
+                        __get_user(txc->maxerror, &utp->maxerror) ||
+                        __get_user(txc->esterror, &utp->esterror) ||
+                        __get_user(txc->status, &utp->status) ||
+                        __get_user(txc->constant, &utp->constant) ||
+                        __get_user(txc->precision, &utp->precision) ||
+                        __get_user(txc->tolerance, &utp->tolerance) ||
+                        __get_user(txc->time.tv_sec, &utp->time.tv_sec) ||
+                        __get_user(txc->time.tv_usec, &utp->time.tv_usec) ||
+                        __get_user(txc->tick, &utp->tick) ||
+                        __get_user(txc->ppsfreq, &utp->ppsfreq) ||
+                        __get_user(txc->jitter, &utp->jitter) ||
+                        __get_user(txc->shift, &utp->shift) ||
+                        __get_user(txc->stabil, &utp->stabil) ||
+                        __get_user(txc->jitcnt, &utp->jitcnt) ||
+                        __get_user(txc->calcnt, &utp->calcnt) ||
+                        __get_user(txc->errcnt, &utp->errcnt) ||
+                        __get_user(txc->stbcnt, &utp->stbcnt))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int compat_put_timex(struct compat_timex __user *utp, struct timex *txc)
+{
+        if (!access_ok(VERIFY_WRITE, utp, sizeof(struct compat_timex)) ||
+                        __put_user(txc->modes, &utp->modes) ||
+                        __put_user(txc->offset, &utp->offset) ||
+                        __put_user(txc->freq, &utp->freq) ||
+                        __put_user(txc->maxerror, &utp->maxerror) ||
+                        __put_user(txc->esterror, &utp->esterror) ||
+                        __put_user(txc->status, &utp->status) ||
+                        __put_user(txc->constant, &utp->constant) ||
+                        __put_user(txc->precision, &utp->precision) ||
+                        __put_user(txc->tolerance, &utp->tolerance) ||
+                        __put_user(txc->time.tv_sec, &utp->time.tv_sec) ||
+                        __put_user(txc->time.tv_usec, &utp->time.tv_usec) ||
+                        __put_user(txc->tick, &utp->tick) ||
+                        __put_user(txc->ppsfreq, &utp->ppsfreq) ||
+                        __put_user(txc->jitter, &utp->jitter) ||
+                        __put_user(txc->shift, &utp->shift) ||
+                        __put_user(txc->stabil, &utp->stabil) ||
+                        __put_user(txc->jitcnt, &utp->jitcnt) ||
+                        __put_user(txc->calcnt, &utp->calcnt) ||
+                        __put_user(txc->errcnt, &utp->errcnt) ||
+                        __put_user(txc->stbcnt, &utp->stbcnt) ||
+                        __put_user(txc->tai, &utp->tai))
+                return -EFAULT;
+        return 0;
+}
+
 asmlinkage long compat_sys_gettimeofday(struct compat_timeval __user *tv,
                 struct timezone __user *tz)
 {
@@ -617,6 +675,29 @@ long compat_sys_clock_gettime(clockid_t which_clock,
         return err;
 }
 
+long compat_sys_clock_adjtime(clockid_t which_clock,
+                struct compat_timex __user *utp)
+{
+        struct timex txc;
+        mm_segment_t oldfs;
+        int err, ret;
+
+        err = compat_get_timex(&txc, utp);
+        if (err)
+                return err;
+
+        oldfs = get_fs();
+        set_fs(KERNEL_DS);
+        ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
+        set_fs(oldfs);
+
+        err = compat_put_timex(utp, &txc);
+        if (err)
+                return err;
+
+        return ret;
+}
+
 long compat_sys_clock_getres(clockid_t which_clock,
                 struct compat_timespec __user *tp)
 {
@@ -951,58 +1032,17 @@ asmlinkage long compat_sys_rt_sigsuspend(compat_sigset_t __user *unewset, compat
 asmlinkage long compat_sys_adjtimex(struct compat_timex __user *utp)
 {
         struct timex txc;
-        int ret;
-
-        memset(&txc, 0, sizeof(struct timex));
+        int err, ret;
 
-        if (!access_ok(VERIFY_READ, utp, sizeof(struct compat_timex)) ||
-                        __get_user(txc.modes, &utp->modes) ||
-                        __get_user(txc.offset, &utp->offset) ||
-                        __get_user(txc.freq, &utp->freq) ||
-                        __get_user(txc.maxerror, &utp->maxerror) ||
-                        __get_user(txc.esterror, &utp->esterror) ||
-                        __get_user(txc.status, &utp->status) ||
-                        __get_user(txc.constant, &utp->constant) ||
-                        __get_user(txc.precision, &utp->precision) ||
-                        __get_user(txc.tolerance, &utp->tolerance) ||
-                        __get_user(txc.time.tv_sec, &utp->time.tv_sec) ||
-                        __get_user(txc.time.tv_usec, &utp->time.tv_usec) ||
-                        __get_user(txc.tick, &utp->tick) ||
-                        __get_user(txc.ppsfreq, &utp->ppsfreq) ||
-                        __get_user(txc.jitter, &utp->jitter) ||
-                        __get_user(txc.shift, &utp->shift) ||
-                        __get_user(txc.stabil, &utp->stabil) ||
-                        __get_user(txc.jitcnt, &utp->jitcnt) ||
-                        __get_user(txc.calcnt, &utp->calcnt) ||
-                        __get_user(txc.errcnt, &utp->errcnt) ||
-                        __get_user(txc.stbcnt, &utp->stbcnt))
-                return -EFAULT;
+        err = compat_get_timex(&txc, utp);
+        if (err)
+                return err;
 
         ret = do_adjtimex(&txc);
 
-        if (!access_ok(VERIFY_WRITE, utp, sizeof(struct compat_timex)) ||
-                        __put_user(txc.modes, &utp->modes) ||
-                        __put_user(txc.offset, &utp->offset) ||
-                        __put_user(txc.freq, &utp->freq) ||
-                        __put_user(txc.maxerror, &utp->maxerror) ||
-                        __put_user(txc.esterror, &utp->esterror) ||
-                        __put_user(txc.status, &utp->status) ||
-                        __put_user(txc.constant, &utp->constant) ||
-                        __put_user(txc.precision, &utp->precision) ||
-                        __put_user(txc.tolerance, &utp->tolerance) ||
-                        __put_user(txc.time.tv_sec, &utp->time.tv_sec) ||
-                        __put_user(txc.time.tv_usec, &utp->time.tv_usec) ||
-                        __put_user(txc.tick, &utp->tick) ||
-                        __put_user(txc.ppsfreq, &utp->ppsfreq) ||
-                        __put_user(txc.jitter, &utp->jitter) ||
-                        __put_user(txc.shift, &utp->shift) ||
-                        __put_user(txc.stabil, &utp->stabil) ||
-                        __put_user(txc.jitcnt, &utp->jitcnt) ||
-                        __put_user(txc.calcnt, &utp->calcnt) ||
-                        __put_user(txc.errcnt, &utp->errcnt) ||
-                        __put_user(txc.stbcnt, &utp->stbcnt) ||
-                        __put_user(txc.tai, &utp->tai))
-                ret = -EFAULT;
+        err = compat_put_timex(utp, &txc);
+        if (err)
+                return err;
 
         return ret;
 }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 4349935c2ad8..e92e98189032 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1575,8 +1575,10 @@ static int cpuset_write_resmask(struct cgroup *cgrp, struct cftype *cft,
                 return -ENODEV;
 
         trialcs = alloc_trial_cpuset(cs);
-        if (!trialcs)
-                return -ENOMEM;
+        if (!trialcs) {
+                retval = -ENOMEM;
+                goto out;
+        }
 
         switch (cft->private) {
         case FILE_CPULIST:
@@ -1591,6 +1593,7 @@ static int cpuset_write_resmask(struct cgroup *cgrp, struct cftype *cft,
         }
 
         free_trial_cpuset(trialcs);
+out:
         cgroup_unlock();
         return retval;
 }
diff --git a/kernel/cred.c b/kernel/cred.c
index 6a1aa004e376..2343c132c5a7 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -35,7 +35,7 @@ static struct kmem_cache *cred_jar;
 static struct thread_group_cred init_tgcred = {
         .usage  = ATOMIC_INIT(2),
         .tgid   = 0,
-        .lock   = SPIN_LOCK_UNLOCKED,
+        .lock   = __SPIN_LOCK_UNLOCKED(init_cred.tgcred.lock),
 };
 #endif
 
@@ -252,13 +252,13 @@ struct cred *cred_alloc_blank(void)
 #endif
 
         atomic_set(&new->usage, 1);
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        new->magic = CRED_MAGIC;
+#endif
 
         if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
                 goto error;
 
-#ifdef CONFIG_DEBUG_CREDENTIALS
-        new->magic = CRED_MAGIC;
-#endif
         return new;
 
 error:
@@ -657,6 +657,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         validate_creds(old);
 
         *new = *old;
+        atomic_set(&new->usage, 1);
+        set_cred_subscribers(new, 0);
         get_uid(new->user);
         get_group_info(new->group_info);
 
@@ -674,8 +676,6 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
                 goto error;
 
-        atomic_set(&new->usage, 1);
-        set_cred_subscribers(new, 0);
         put_cred(old);
         validate_creds(new);
         return new;
@@ -748,7 +748,11 @@ bool creds_are_invalid(const struct cred *cred)
         if (cred->magic != CRED_MAGIC)
                 return true;
 #ifdef CONFIG_SECURITY_SELINUX
-        if (selinux_is_enabled()) {
+        /*
+         * cred->security == NULL if security_cred_alloc_blank() or
+         * security_prepare_creds() returned an error.
+         */
+        if (selinux_is_enabled() && cred->security) {
                 if ((unsigned long) cred->security < PAGE_SIZE)
                         return true;
                 if ((*(u32 *)cred->security & 0xffffff00) ==
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index a6e729766821..bd3e8e29caa3 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -2914,7 +2914,7 @@ static void __init kdb_cmd_init(void)
         }
 }
 
-/* Intialize kdb_printf, breakpoint tables and kdb state */
+/* Initialize kdb_printf, breakpoint tables and kdb state */
 void __init kdb_init(int lvl)
 {
         static int kdb_init_lvl = KDB_NOT_INITIALIZED;
diff --git a/kernel/exit.c b/kernel/exit.c
index 676149a4ac5f..f9a45ebcc7b1 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -69,7 +69,7 @@ static void __unhash_process(struct task_struct *p, bool group_dead)
 
                 list_del_rcu(&p->tasks);
                 list_del_init(&p->sibling);
-                __get_cpu_var(process_counts)--;
+                __this_cpu_dec(process_counts);
         }
         list_del_rcu(&p->thread_group);
 }
@@ -994,6 +994,15 @@ NORET_TYPE void do_exit(long code)
         exit_fs(tsk);
         check_stack_usage();
         exit_thread();
+
+        /*
+         * Flush inherited counters to the parent - before the parent
+         * gets woken up by child-exit notifications.
+         *
+         * because of cgroup mode, must be called before cgroup_exit()
+         */
+        perf_event_exit_task(tsk);
+
         cgroup_exit(tsk, 1);
 
         if (group_dead)
@@ -1007,11 +1016,6 @@ NORET_TYPE void do_exit(long code)
          * FIXME: do that only when needed, using sched_exit tracepoint
          */
         flush_ptrace_hw_breakpoint(tsk);
-        /*
-         * Flush inherited counters to the parent - before the parent
-         * gets woken up by child-exit notifications.
-         */
-        perf_event_exit_task(tsk);
 
         exit_notify(tsk, group_dead);
 #ifdef CONFIG_NUMA
diff --git a/kernel/fork.c b/kernel/fork.c
index 7d164e25b0f0..25e429152ddc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -66,6 +66,7 @@
 #include <linux/posix-timers.h>
 #include <linux/user-return-notifier.h>
 #include <linux/oom.h>
+#include <linux/khugepaged.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -169,15 +170,14 @@ EXPORT_SYMBOL(free_task);
 static inline void free_signal_struct(struct signal_struct *sig)
 {
         taskstats_tgid_free(sig);
+        sched_autogroup_exit(sig);
         kmem_cache_free(signal_cachep, sig);
 }
 
 static inline void put_signal_struct(struct signal_struct *sig)
 {
-        if (atomic_dec_and_test(&sig->sigcnt)) {
-                sched_autogroup_exit(sig);
+        if (atomic_dec_and_test(&sig->sigcnt))
                 free_signal_struct(sig);
-        }
 }
 
 void __put_task_struct(struct task_struct *tsk)
@@ -331,6 +331,9 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
         retval = ksm_fork(mm, oldmm);
         if (retval)
                 goto out;
+        retval = khugepaged_fork(mm, oldmm);
+        if (retval)
+                goto out;
 
         prev = NULL;
         for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
@@ -530,6 +533,9 @@ void __mmdrop(struct mm_struct *mm)
         mm_free_pgd(mm);
         destroy_context(mm);
         mmu_notifier_mm_destroy(mm);
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        VM_BUG_ON(mm->pmd_huge_pte);
+#endif
         free_mm(mm);
 }
 EXPORT_SYMBOL_GPL(__mmdrop);
@@ -544,6 +550,7 @@ void mmput(struct mm_struct *mm)
         if (atomic_dec_and_test(&mm->mm_users)) {
                 exit_aio(mm);
                 ksm_exit(mm);
+                khugepaged_exit(mm); /* must run before exit_mmap */
                 exit_mmap(mm);
                 set_mm_exe_file(mm, NULL);
                 if (!list_empty(&mm->mmlist)) {
@@ -670,6 +677,10 @@ struct mm_struct *dup_mm(struct task_struct *tsk)
         mm->token_priority = 0;
         mm->last_interval = 0;
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        mm->pmd_huge_pte = NULL;
+#endif
+
         if (!mm_init(mm, tsk))
                 goto fail_nomem;
 
@@ -911,6 +922,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
 
         sig->oom_adj = current->signal->oom_adj;
         sig->oom_score_adj = current->signal->oom_score_adj;
+        sig->oom_score_adj_min = current->signal->oom_score_adj_min;
 
         mutex_init(&sig->cred_guard_mutex);
 
@@ -1286,7 +1298,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                         attach_pid(p, PIDTYPE_SID, task_session(current));
                         list_add_tail(&p->sibling, &p->real_parent->children);
                         list_add_tail_rcu(&p->tasks, &init_task.tasks);
-                        __get_cpu_var(process_counts)++;
+                        __this_cpu_inc(process_counts);
                 }
                 attach_pid(p, PIDTYPE_PID, pid);
                 nr_threads++;
@@ -1318,7 +1330,7 @@ bad_fork_cleanup_mm:
         }
 bad_fork_cleanup_signal:
         if (!(clone_flags & CLONE_THREAD))
-                put_signal_struct(p->signal);
+                free_signal_struct(p->signal);
 bad_fork_cleanup_sighand:
         __cleanup_sighand(p->sighand);
 bad_fork_cleanup_fs:
@@ -1411,23 +1423,6 @@ long do_fork(unsigned long clone_flags,
         }
 
         /*
-         * We hope to recycle these flags after 2.6.26
-         */
-        if (unlikely(clone_flags & CLONE_STOPPED)) {
-                static int __read_mostly count = 100;
-
-                if (count > 0 && printk_ratelimit()) {
-                        char comm[TASK_COMM_LEN];
-
-                        count--;
-                        printk(KERN_INFO "fork(): process `%s' used deprecated "
-                                        "clone flags 0x%lx\n",
-                                get_task_comm(comm, current),
-                                clone_flags & CLONE_STOPPED);
-                }
-        }
-
-        /*
          * When called from kernel_thread, don't do user tracing stuff.
          */
         if (likely(user_mode(regs)))
@@ -1465,16 +1460,7 @@ long do_fork(unsigned long clone_flags,
                  */
                 p->flags &= ~PF_STARTING;
 
-                if (unlikely(clone_flags & CLONE_STOPPED)) {
-                        /*
-                         * We'll start up with an immediate SIGSTOP.
-                         */
-                        sigaddset(&p->pending.signal, SIGSTOP);
-                        set_tsk_thread_flag(p, TIF_SIGPENDING);
-                        __set_task_state(p, TASK_STOPPED);
-                } else {
-                        wake_up_new_task(p, clone_flags);
-                }
+                wake_up_new_task(p, clone_flags);
 
                 tracehook_report_clone_complete(trace, regs,
                                                 clone_flags, nr, p);
diff --git a/kernel/freezer.c b/kernel/freezer.c
index bd1d42b17cb2..66ecd2ead215 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -104,8 +104,13 @@ bool freeze_task(struct task_struct *p, bool sig_only)
         }
 
         if (should_send_signal(p)) {
-                if (!signal_pending(p))
-                        fake_signal_wake_up(p);
+                fake_signal_wake_up(p);
+                /*
+                 * fake_signal_wake_up() goes through p's scheduler
+                 * lock and guarantees that TASK_STOPPED/TRACED ->
+                 * TASK_RUNNING transition can't race with task state
+                 * testing in try_to_freeze_tasks().
+                 */
         } else if (sig_only) {
                 return false;
         } else {
diff --git a/kernel/futex.c b/kernel/futex.c
index 3019b92e6917..bda415715382 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -233,7 +233,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key)
 {
         unsigned long address = (unsigned long)uaddr;
         struct mm_struct *mm = current->mm;
-        struct page *page;
+        struct page *page, *page_head;
         int err;
 
         /*
@@ -265,11 +265,46 @@ again:
         if (err < 0)
                 return err;
 
-        page = compound_head(page);
-        lock_page(page);
-        if (!page->mapping) {
-                unlock_page(page);
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        page_head = page;
+        if (unlikely(PageTail(page))) {
                 put_page(page);
+                /* serialize against __split_huge_page_splitting() */
+                local_irq_disable();
+                if (likely(__get_user_pages_fast(address, 1, 1, &page) == 1)) {
+                        page_head = compound_head(page);
+                        /*
+                         * page_head is valid pointer but we must pin
+                         * it before taking the PG_lock and/or
+                         * PG_compound_lock. The moment we re-enable
+                         * irqs __split_huge_page_splitting() can
+                         * return and the head page can be freed from
+                         * under us. We can't take the PG_lock and/or
+                         * PG_compound_lock on a page that could be
+                         * freed from under us.
+                         */
+                        if (page != page_head) {
+                                get_page(page_head);
+                                put_page(page);
+                        }
+                        local_irq_enable();
+                } else {
+                        local_irq_enable();
+                        goto again;
+                }
+        }
+#else
+        page_head = compound_head(page);
+        if (page != page_head) {
+                get_page(page_head);
+                put_page(page);
+        }
+#endif
+
+        lock_page(page_head);
+        if (!page_head->mapping) {
+                unlock_page(page_head);
+                put_page(page_head);
                 goto again;
         }
 
@@ -280,20 +315,20 @@ again:
          * it's a read-only handle, it's expected that futexes attach to
          * the object not the particular process.
          */
-        if (PageAnon(page)) {
+        if (PageAnon(page_head)) {
                 key->both.offset |= FUT_OFF_MMSHARED; /* ref taken on mm */
                 key->private.mm = mm;
                 key->private.address = address;
         } else {
                 key->both.offset |= FUT_OFF_INODE; /* inode-based key */
-                key->shared.inode = page->mapping->host;
-                key->shared.pgoff = page->index;
+                key->shared.inode = page_head->mapping->host;
+                key->shared.pgoff = page_head->index;
         }
 
         get_futex_key_refs(key);
 
-        unlock_page(page);
-        put_page(page);
+        unlock_page(page_head);
+        put_page(page_head);
         return 0;
 }
 
@@ -346,15 +381,16 @@ static struct futex_q *futex_top_waiter(struct futex_hash_bucket *hb,
         return NULL;
 }
 
-static u32 cmpxchg_futex_value_locked(u32 __user *uaddr, u32 uval, u32 newval)
+static int cmpxchg_futex_value_locked(u32 *curval, u32 __user *uaddr,
+                                      u32 uval, u32 newval)
 {
-        u32 curval;
+        int ret;
 
         pagefault_disable();
-        curval = futex_atomic_cmpxchg_inatomic(uaddr, uval, newval);
+        ret = futex_atomic_cmpxchg_inatomic(curval, uaddr, uval, newval);
         pagefault_enable();
 
-        return curval;
+        return ret;
 }
 
 static int get_futex_value_locked(u32 *dest, u32 __user *from)
@@ -639,7 +675,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
                                 struct task_struct *task, int set_waiters)
 {
         int lock_taken, ret, ownerdied = 0;
-        u32 uval, newval, curval;
+        u32 uval, newval, curval, vpid = task_pid_vnr(task);
 
 retry:
         ret = lock_taken = 0;
@@ -649,19 +685,17 @@ retry:
          * (by doing a 0 -> TID atomic cmpxchg), while holding all
          * the locks. It will most likely not succeed.
          */
-        newval = task_pid_vnr(task);
+        newval = vpid;
         if (set_waiters)
                 newval |= FUTEX_WAITERS;
 
-        curval = cmpxchg_futex_value_locked(uaddr, 0, newval);
-
-        if (unlikely(curval == -EFAULT))
+        if (unlikely(cmpxchg_futex_value_locked(&curval, uaddr, 0, newval)))
                 return -EFAULT;
 
         /*
          * Detect deadlocks.
          */
-        if ((unlikely((curval & FUTEX_TID_MASK) == task_pid_vnr(task))))
+        if ((unlikely((curval & FUTEX_TID_MASK) == vpid)))
                 return -EDEADLK;
 
         /*
@@ -688,14 +722,12 @@ retry:
          */
         if (unlikely(ownerdied || !(curval & FUTEX_TID_MASK))) {
                 /* Keep the OWNER_DIED bit */
-                newval = (curval & ~FUTEX_TID_MASK) | task_pid_vnr(task);
+                newval = (curval & ~FUTEX_TID_MASK) | vpid;
                 ownerdied = 0;
                 lock_taken = 1;
         }
 
-        curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
-
-        if (unlikely(curval == -EFAULT))
+        if (unlikely(cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)))
                 return -EFAULT;
         if (unlikely(curval != uval))
                 goto retry;
@@ -740,6 +772,24 @@ retry:
         return ret;
 }
 
+/**
+ * __unqueue_futex() - Remove the futex_q from its futex_hash_bucket
+ * @q:  The futex_q to unqueue
+ *
+ * The q->lock_ptr must not be NULL and must be held by the caller.
+ */
+static void __unqueue_futex(struct futex_q *q)
+{
+        struct futex_hash_bucket *hb;
+
+        if (WARN_ON(!q->lock_ptr || !spin_is_locked(q->lock_ptr)
+                        || plist_node_empty(&q->list)))
+                return;
+
+        hb = container_of(q->lock_ptr, struct futex_hash_bucket, lock);
+        plist_del(&q->list, &hb->chain);
+}
+
 /*
  * The hash bucket lock must be held when this is called.
  * Afterwards, the futex_q must not be accessed.
@@ -757,7 +807,7 @@ static void wake_futex(struct futex_q *q)
          */
         get_task_struct(p);
 
-        plist_del(&q->list, &q->list.plist);
+        __unqueue_futex(q);
         /*
          * The waiting task can free the futex_q as soon as
          * q->lock_ptr = NULL is written, without taking any locks. A
@@ -791,10 +841,9 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
         new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
         /*
-         * This happens when we have stolen the lock and the original
-         * pending owner did not enqueue itself back on the rt_mutex.
-         * Thats not a tragedy. We know that way, that a lock waiter
-         * is on the fly. We make the futex_q waiter the pending owner.
+         * It is possible that the next waiter (the one that brought
+         * this owner to the kernel) timed out and is no longer
+         * waiting on the lock.
          */
         if (!new_owner)
                 new_owner = this->task;
@@ -809,9 +858,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
 
                 newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
 
-                curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
-
-                if (curval == -EFAULT)
+                if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
                         ret = -EFAULT;
                 else if (curval != uval)
                         ret = -EINVAL;
@@ -846,10 +893,8 @@ static int unlock_futex_pi(u32 __user *uaddr, u32 uval)
          * There is no waiter, so we unlock the futex. The owner died
          * bit has not to be preserved here. We are the owner:
          */
-        oldval = cmpxchg_futex_value_locked(uaddr, uval, 0);
-
-        if (oldval == -EFAULT)
-                return oldval;
+        if (cmpxchg_futex_value_locked(&oldval, uaddr, uval, 0))
+                return -EFAULT;
         if (oldval != uval)
                 return -EAGAIN;
 
@@ -1037,9 +1082,6 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
                 plist_del(&q->list, &hb1->chain);
                 plist_add(&q->list, &hb2->chain);
                 q->lock_ptr = &hb2->lock;
-#ifdef CONFIG_DEBUG_PI_LIST
-                q->list.plist.spinlock = &hb2->lock;
-#endif
         }
         get_futex_key_refs(key2);
         q->key = *key2;
@@ -1066,16 +1108,12 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
         get_futex_key_refs(key);
         q->key = *key;
 
-        WARN_ON(plist_node_empty(&q->list));
-        plist_del(&q->list, &q->list.plist);
+        __unqueue_futex(q);
 
         WARN_ON(!q->rt_waiter);
         q->rt_waiter = NULL;
 
         q->lock_ptr = &hb->lock;
-#ifdef CONFIG_DEBUG_PI_LIST
-        q->list.plist.spinlock = &hb->lock;
-#endif
 
         wake_up_state(q->task, TASK_NORMAL);
 }
@@ -1423,9 +1461,6 @@ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
         prio = min(current->normal_prio, MAX_RT_PRIO);
 
         plist_node_init(&q->list, prio);
-#ifdef CONFIG_DEBUG_PI_LIST
-        q->list.plist.spinlock = &hb->lock;
-#endif
         plist_add(&q->list, &hb->chain);
         q->task = current;
         spin_unlock(&hb->lock);
@@ -1470,8 +1505,7 @@ retry:
                         spin_unlock(lock_ptr);
                         goto retry;
                 }
-                WARN_ON(plist_node_empty(&q->list));
-                plist_del(&q->list, &q->list.plist);
+                __unqueue_futex(q);
 
                 BUG_ON(q->pi_state);
 
@@ -1491,8 +1525,7 @@ retry:
 static void unqueue_me_pi(struct futex_q *q)
         __releases(q->lock_ptr)
 {
-        WARN_ON(plist_node_empty(&q->list));
-        plist_del(&q->list, &q->list.plist);
+        __unqueue_futex(q);
 
         BUG_ON(!q->pi_state);
         free_pi_state(q->pi_state);
@@ -1522,10 +1555,10 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 
         /*
          * We are here either because we stole the rtmutex from the
-         * pending owner or we are the pending owner which failed to
-         * get the rtmutex. We have to replace the pending owner TID
-         * in the user space variable. This must be atomic as we have
-         * to preserve the owner died bit here.
+         * previous highest priority waiter or we are the highest priority
+         * waiter but failed to get the rtmutex the first time.
+         * We have to replace the newowner TID in the user space variable.
+         * This must be atomic as we have to preserve the owner died bit here.
          *
          * Note: We write the user space value _before_ changing the pi_state
          * because we can fault here. Imagine swapped out pages or a fork
@@ -1544,9 +1577,7 @@ retry:
         while (1) {
                 newval = (uval & FUTEX_OWNER_DIED) | newtid;
 
-                curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
-
-                if (curval == -EFAULT)
+                if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
                         goto handle_fault;
                 if (curval == uval)
                         break;
@@ -1574,8 +1605,8 @@ retry:
 
         /*
          * To handle the page fault we need to drop the hash bucket
-         * lock here. That gives the other task (either the pending
-         * owner itself or the task which stole the rtmutex) the
+         * lock here. That gives the other task (either the highest priority
+         * waiter itself or the task which stole the rtmutex) the
          * chance to try the fixup of the pi_state. So once we are
          * back from handling the fault we need to check the pi_state
          * after reacquiring the hash bucket lock and before trying to
@@ -1651,18 +1682,20 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
                 /*
                  * pi_state is incorrect, some other task did a lock steal and
                  * we returned due to timeout or signal without taking the
-                 * rt_mutex. Too late. We can access the rt_mutex_owner without
-                 * locking, as the other task is now blocked on the hash bucket
-                 * lock. Fix the state up.
+                 * rt_mutex. Too late.
                  */
+                raw_spin_lock(&q->pi_state->pi_mutex.wait_lock);
                 owner = rt_mutex_owner(&q->pi_state->pi_mutex);
+                if (!owner)
+                        owner = rt_mutex_next_owner(&q->pi_state->pi_mutex);
+                raw_spin_unlock(&q->pi_state->pi_mutex.wait_lock);
                 ret = fixup_pi_state_owner(uaddr, q, owner);
                 goto out;
         }
 
         /*
          * Paranoia check. If we did not take the lock, then we should not be
-         * the owner, nor the pending owner, of the rt_mutex.
+         * the owner of the rt_mutex.
          */
         if (rt_mutex_owner(&q->pi_state->pi_mutex) == current)
                 printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "
@@ -1747,13 +1780,14 @@ static int futex_wait_setup(u32 __user *uaddr, u32 val, unsigned int flags,
          *
          * The basic logical guarantee of a futex is that it blocks ONLY
          * if cond(var) is known to be true at the time of blocking, for
-         * any cond.  If we queued after testing *uaddr, that would open
-         * a race condition where we could block indefinitely with
+         * any cond.  If we locked the hash-bucket after testing *uaddr, that
+         * would open a race condition where we could block indefinitely with
          * cond(var) false, which would violate the guarantee.
          *
-         * A consequence is that futex_wait() can return zero and absorb
-         * a wakeup when *uaddr != val on entry to the syscall.  This is
-         * rare, but normal.
+         * On the other hand, we insert q and release the hash-bucket only
+         * after testing *uaddr.  This guarantees that futex_wait() will NOT
+         * absorb a wakeup if *uaddr does not match the desired values
+         * while the syscall executes.
          */
 retry:
         ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q->key);
@@ -2012,9 +2046,9 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 {
         struct futex_hash_bucket *hb;
         struct futex_q *this, *next;
-        u32 uval;
         struct plist_head *head;
         union futex_key key = FUTEX_KEY_INIT;
+        u32 uval, vpid = task_pid_vnr(current);
         int ret;
 
 retry:
@@ -2023,7 +2057,7 @@ retry:
         /*
          * We release only a lock we actually own:
          */
-        if ((uval & FUTEX_TID_MASK) != task_pid_vnr(current))
+        if ((uval & FUTEX_TID_MASK) != vpid)
                 return -EPERM;
 
         ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &key);
@@ -2038,17 +2072,14 @@ retry:
          * again. If it succeeds then we can return without waking
          * anyone else up:
          */
-        if (!(uval & FUTEX_OWNER_DIED))
-                uval = cmpxchg_futex_value_locked(uaddr, task_pid_vnr(current), 0);
-
-
-        if (unlikely(uval == -EFAULT))
+        if (!(uval & FUTEX_OWNER_DIED) &&
+            cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
                 goto pi_faulted;
         /*
          * Rare case: we managed to release the lock atomically,
          * no need to wake anyone else up:
          */
-        if (unlikely(uval == task_pid_vnr(current)))
+        if (unlikely(uval == vpid))
                 goto out_unlock;
 
         /*
@@ -2133,7 +2164,7 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                  * We were woken prior to requeue by a timeout or a signal.
                  * Unqueue the futex_q and determine which it was.
                  */
-                plist_del(&q->list, &q->list.plist);
+                plist_del(&q->list, &hb->chain);
 
                 /* Handle spurious wakeups gracefully */
                 ret = -EWOULDBLOCK;
@@ -2429,11 +2460,20 @@ retry:
                  * userspace.
                  */
                 mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
-                nval = futex_atomic_cmpxchg_inatomic(uaddr, uval, mval);
-
-                if (nval == -EFAULT)
-                        return -1;
-
+                /*
+                 * We are not holding a lock here, but we want to have
+                 * the pagefault_disable/enable() protection because
+                 * we want to handle the fault gracefully. If the
+                 * access fails we try to fault in the futex with R/W
+                 * verification via get_user_pages. get_user() above
+                 * does not guarantee R/W access. If that fails we
+                 * give up and leave the futex locked.
+                 */
+                if (cmpxchg_futex_value_locked(&nval, uaddr, uval, mval)) {
+                        if (fault_in_user_writeable(uaddr))
+                                return -1;
+                        goto retry;
+                }
                 if (nval != uval)
                         goto retry;
 
@@ -2644,8 +2684,7 @@ static int __init futex_init(void)
          * implementation, the non-functional ones will return
          * -ENOSYS.
          */
-        curval = cmpxchg_futex_value_locked(NULL, 0, 0);
-        if (curval == -EFAULT)
+        if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
                 futex_cmpxchg_enabled = 1;
 
         for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index f2429fc3438c..9017478c5d4c 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -53,11 +53,10 @@
 /*
  * The timer bases:
  *
- * Note: If we want to add new timer bases, we have to skip the two
- * clock ids captured by the cpu-timers. We do this by holding empty
- * entries rather than doing math adjustment of the clock ids.
- * This ensures that we capture erroneous accesses to these clock ids
- * rather than moving them into the range of valid clock id's.
+ * There are more clockids then hrtimer bases. Thus, we index
+ * into the timer bases by the hrtimer_base_type enum. When trying
+ * to reach a base using a clockid, hrtimer_clockid_to_base()
+ * is used to convert from clockid to the proper hrtimer_base_type.
  */
 DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
 {
@@ -74,30 +73,39 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
                         .get_time = &ktime_get,
                         .resolution = KTIME_LOW_RES,
                 },
+                {
+                        .index = CLOCK_BOOTTIME,
+                        .get_time = &ktime_get_boottime,
+                        .resolution = KTIME_LOW_RES,
+                },
         }
 };
 
+static int hrtimer_clock_to_base_table[MAX_CLOCKS];
+
+static inline int hrtimer_clockid_to_base(clockid_t clock_id)
+{
+        return hrtimer_clock_to_base_table[clock_id];
+}
+
+
 /*
  * Get the coarse grained time at the softirq based on xtime and
  * wall_to_monotonic.
  */
 static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 {
-        ktime_t xtim, tomono;
-        struct timespec xts, tom;
-        unsigned long seq;
+        ktime_t xtim, mono, boot;
+        struct timespec xts, tom, slp;
 
-        do {
-                seq = read_seqbegin(&xtime_lock);
-                xts = __current_kernel_time();
-                tom = __get_wall_to_monotonic();
-        } while (read_seqretry(&xtime_lock, seq));
+        get_xtime_and_monotonic_and_sleep_offset(&xts, &tom, &slp);
 
         xtim = timespec_to_ktime(xts);
-        tomono = timespec_to_ktime(tom);
-        base->clock_base[CLOCK_REALTIME].softirq_time = xtim;
-        base->clock_base[CLOCK_MONOTONIC].softirq_time =
-                ktime_add(xtim, tomono);
+        mono = ktime_add(xtim, timespec_to_ktime(tom));
+        boot = ktime_add(mono, timespec_to_ktime(slp));
+        base->clock_base[HRTIMER_BASE_REALTIME].softirq_time = xtim;
+        base->clock_base[HRTIMER_BASE_MONOTONIC].softirq_time = mono;
+        base->clock_base[HRTIMER_BASE_BOOTTIME].softirq_time = boot;
 }
 
 /*
@@ -184,10 +192,11 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,
         struct hrtimer_cpu_base *new_cpu_base;
         int this_cpu = smp_processor_id();
         int cpu = hrtimer_get_target(this_cpu, pinned);
+        int basenum = hrtimer_clockid_to_base(base->index);
 
 again:
         new_cpu_base = &per_cpu(hrtimer_bases, cpu);
-        new_base = &new_cpu_base->clock_base[base->index];
+        new_base = &new_cpu_base->clock_base[basenum];
 
         if (base != new_base) {
                 /*
@@ -334,6 +343,11 @@ EXPORT_SYMBOL_GPL(ktime_add_safe);
 
 static struct debug_obj_descr hrtimer_debug_descr;
 
+static void *hrtimer_debug_hint(void *addr)
+{
+        return ((struct hrtimer *) addr)->function;
+}
+
 /*
  * fixup_init is called when:
  * - an active object is initialized
@@ -393,6 +407,7 @@ static int hrtimer_fixup_free(void *addr, enum debug_obj_state state)
 
 static struct debug_obj_descr hrtimer_debug_descr = {
         .name           = "hrtimer",
+        .debug_hint     = hrtimer_debug_hint,
         .fixup_init     = hrtimer_fixup_init,
         .fixup_activate = hrtimer_fixup_activate,
         .fixup_free     = hrtimer_fixup_free,
@@ -497,7 +512,7 @@ static inline int hrtimer_is_hres_enabled(void)
  */
 static inline int hrtimer_hres_active(void)
 {
-        return __get_cpu_var(hrtimer_bases).hres_active;
+        return __this_cpu_read(hrtimer_bases.hres_active);
 }
 
 /*
@@ -611,24 +626,23 @@ static int hrtimer_reprogram(struct hrtimer *timer,
 static void retrigger_next_event(void *arg)
 {
         struct hrtimer_cpu_base *base;
-        struct timespec realtime_offset, wtm;
-        unsigned long seq;
+        struct timespec realtime_offset, wtm, sleep;
 
         if (!hrtimer_hres_active())
                 return;
 
-        do {
-                seq = read_seqbegin(&xtime_lock);
-                wtm = __get_wall_to_monotonic();
-        } while (read_seqretry(&xtime_lock, seq));
+        get_xtime_and_monotonic_and_sleep_offset(&realtime_offset, &wtm,
+                                                        &sleep);
         set_normalized_timespec(&realtime_offset, -wtm.tv_sec, -wtm.tv_nsec);
 
         base = &__get_cpu_var(hrtimer_bases);
 
         /* Adjust CLOCK_REALTIME offset */
         raw_spin_lock(&base->lock);
-        base->clock_base[CLOCK_REALTIME].offset =
+        base->clock_base[HRTIMER_BASE_REALTIME].offset =
                 timespec_to_ktime(realtime_offset);
+        base->clock_base[HRTIMER_BASE_BOOTTIME].offset =
+                timespec_to_ktime(sleep);
 
         hrtimer_force_reprogram(base, 0);
         raw_spin_unlock(&base->lock);
@@ -673,14 +687,6 @@ static inline void hrtimer_init_hres(struct hrtimer_cpu_base *base)
 }
 
 /*
- * Initialize the high resolution related parts of a hrtimer
- */
-static inline void hrtimer_init_timer_hres(struct hrtimer *timer)
-{
-}
-
-
-/*
  * When High resolution timers are active, try to reprogram. Note, that in case
  * the state has HRTIMER_STATE_CALLBACK set, no reprogramming and no expiry
  * check happens. The timer gets enqueued into the rbtree. The reprogramming
@@ -725,8 +731,9 @@ static int hrtimer_switch_to_hres(void)
                 return 0;
         }
         base->hres_active = 1;
-        base->clock_base[CLOCK_REALTIME].resolution = KTIME_HIGH_RES;
-        base->clock_base[CLOCK_MONOTONIC].resolution = KTIME_HIGH_RES;
+        base->clock_base[HRTIMER_BASE_REALTIME].resolution = KTIME_HIGH_RES;
+        base->clock_base[HRTIMER_BASE_MONOTONIC].resolution = KTIME_HIGH_RES;
+        base->clock_base[HRTIMER_BASE_BOOTTIME].resolution = KTIME_HIGH_RES;
 
         tick_setup_sched_timer();
 
@@ -750,7 +757,6 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
         return 0;
 }
 static inline void hrtimer_init_hres(struct hrtimer_cpu_base *base) { }
-static inline void hrtimer_init_timer_hres(struct hrtimer *timer) { }
 
 #endif /* CONFIG_HIGH_RES_TIMERS */
 
@@ -1121,6 +1127,7 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
                            enum hrtimer_mode mode)
 {
         struct hrtimer_cpu_base *cpu_base;
+        int base;
 
         memset(timer, 0, sizeof(struct hrtimer));
 
@@ -1129,8 +1136,8 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
         if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS)
                 clock_id = CLOCK_MONOTONIC;
 
-        timer->base = &cpu_base->clock_base[clock_id];
-        hrtimer_init_timer_hres(timer);
+        base = hrtimer_clockid_to_base(clock_id);
+        timer->base = &cpu_base->clock_base[base];
         timerqueue_init(&timer->node);
 
 #ifdef CONFIG_TIMER_STATS
@@ -1165,9 +1172,10 @@ EXPORT_SYMBOL_GPL(hrtimer_init);
 int hrtimer_get_res(const clockid_t which_clock, struct timespec *tp)
 {
         struct hrtimer_cpu_base *cpu_base;
+        int base = hrtimer_clockid_to_base(which_clock);
 
         cpu_base = &__raw_get_cpu_var(hrtimer_bases);
-        *tp = ktime_to_timespec(cpu_base->clock_base[which_clock].resolution);
+        *tp = ktime_to_timespec(cpu_base->clock_base[base].resolution);
 
         return 0;
 }
@@ -1714,6 +1722,10 @@ static struct notifier_block __cpuinitdata hrtimers_nb = {
 
 void __init hrtimers_init(void)
 {
+        hrtimer_clock_to_base_table[CLOCK_REALTIME] = HRTIMER_BASE_REALTIME;
+        hrtimer_clock_to_base_table[CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC;
+        hrtimer_clock_to_base_table[CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME;
+
         hrtimer_cpu_notify(&hrtimers_nb, (unsigned long)CPU_UP_PREPARE,
                           (void *)(long)smp_processor_id());
         register_cpu_notifier(&hrtimers_nb);
@@ -1745,7 +1757,7 @@ schedule_hrtimeout_range_clock(ktime_t *expires, unsigned long delta,
         }
 
         /*
-         * A NULL parameter means "inifinte"
+         * A NULL parameter means "infinite"
          */
         if (!expires) {
                 schedule();
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index 31d766bf5d2e..09bef82d74cb 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -1,5 +1,6 @@
+# Select this to activate the generic irq options below
 config HAVE_GENERIC_HARDIRQS
-        def_bool n
+        bool
 
 if HAVE_GENERIC_HARDIRQS
 menu "IRQ subsystem"
@@ -9,31 +10,46 @@ menu "IRQ subsystem"
 config GENERIC_HARDIRQS
        def_bool y
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-       def_bool y
-
 # Select this to disable the deprecated stuff
 config GENERIC_HARDIRQS_NO_DEPRECATED
-       def_bool n
+       bool
+
+config GENERIC_HARDIRQS_NO_COMPAT
+       bool
 
 # Options selectable by the architecture code
+
+# Make sparse irq Kconfig switch below available
 config HAVE_SPARSE_IRQ
-       def_bool n
+       bool
 
+# Enable the generic irq autoprobe mechanism
 config GENERIC_IRQ_PROBE
-        def_bool n
+        bool
 
+# Use the generic /proc/interrupts implementation
+config GENERIC_IRQ_SHOW
+       bool
+
+# Support for delayed migration from interrupt context
 config GENERIC_PENDING_IRQ
-        def_bool n
+        bool
 
+# Alpha specific irq affinity mechanism
 config AUTO_IRQ_AFFINITY
-       def_bool n
-
-config IRQ_PER_CPU
-       def_bool n
+       bool
 
+# Tasklet based software resend for pending interrupts on enable_irq()
 config HARDIRQS_SW_RESEND
-       def_bool n
+       bool
+
+# Preflow handler support for fasteoi (sparc64)
+config IRQ_PREFLOW_FASTEOI
+       bool
+
+# Support forced irq threading
+config IRQ_FORCED_THREADING
+       bool
 
 config SPARSE_IRQ
         bool "Support sparse irq numbering"
diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
index 505798f86c36..394784c57060 100644
--- a/kernel/irq/autoprobe.c
+++ b/kernel/irq/autoprobe.c
@@ -17,7 +17,7 @@
 /*
  * Autodetection depends on the fact that any interrupt that
  * comes in on to an unassigned handler will get stuck with
- * "IRQ_WAITING" cleared and the interrupt disabled.
+ * "IRQS_WAITING" cleared and the interrupt disabled.
  */
 static DEFINE_MUTEX(probing_active);
 
@@ -32,7 +32,6 @@ unsigned long probe_irq_on(void)
 {
         struct irq_desc *desc;
         unsigned long mask = 0;
-        unsigned int status;
         int i;
 
         /*
@@ -46,13 +45,7 @@ unsigned long probe_irq_on(void)
          */
         for_each_irq_desc_reverse(i, desc) {
                 raw_spin_lock_irq(&desc->lock);
-                if (!desc->action && !(desc->status & IRQ_NOPROBE)) {
-                        /*
-                         * An old-style architecture might still have
-                         * the handle_bad_irq handler there:
-                         */
-                        compat_irq_chip_set_default_handler(desc);
-
+                if (!desc->action && irq_settings_can_probe(desc)) {
                         /*
                          * Some chips need to know about probing in
                          * progress:
@@ -60,7 +53,7 @@ unsigned long probe_irq_on(void)
                         if (desc->irq_data.chip->irq_set_type)
                                 desc->irq_data.chip->irq_set_type(&desc->irq_data,
                                                          IRQ_TYPE_PROBE);
-                        desc->irq_data.chip->irq_startup(&desc->irq_data);
+                        irq_startup(desc);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -75,10 +68,12 @@ unsigned long probe_irq_on(void)
          */
         for_each_irq_desc_reverse(i, desc) {
                 raw_spin_lock_irq(&desc->lock);
-                if (!desc->action && !(desc->status & IRQ_NOPROBE)) {
-                        desc->status |= IRQ_AUTODETECT | IRQ_WAITING;
-                        if (desc->irq_data.chip->irq_startup(&desc->irq_data))
-                                desc->status |= IRQ_PENDING;
+                if (!desc->action && irq_settings_can_probe(desc)) {
+                        desc->istate |= IRQS_AUTODETECT | IRQS_WAITING;
+                        if (irq_startup(desc)) {
+                                irq_compat_set_pending(desc);
+                                desc->istate |= IRQS_PENDING;
+                        }
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -93,13 +88,12 @@ unsigned long probe_irq_on(void)
          */
         for_each_irq_desc(i, desc) {
                 raw_spin_lock_irq(&desc->lock);
-                status = desc->status;
 
-                if (status & IRQ_AUTODETECT) {
+                if (desc->istate & IRQS_AUTODETECT) {
                         /* It triggered already - consider it spurious. */
-                        if (!(status & IRQ_WAITING)) {
-                                desc->status = status & ~IRQ_AUTODETECT;
-                                desc->irq_data.chip->irq_shutdown(&desc->irq_data);
+                        if (!(desc->istate & IRQS_WAITING)) {
+                                desc->istate &= ~IRQS_AUTODETECT;
+                                irq_shutdown(desc);
                         } else
                                 if (i < 32)
                                         mask |= 1 << i;
@@ -125,20 +119,18 @@ EXPORT_SYMBOL(probe_irq_on);
  */
 unsigned int probe_irq_mask(unsigned long val)
 {
-        unsigned int status, mask = 0;
+        unsigned int mask = 0;
         struct irq_desc *desc;
         int i;
 
         for_each_irq_desc(i, desc) {
                 raw_spin_lock_irq(&desc->lock);
-                status = desc->status;
-
-                if (status & IRQ_AUTODETECT) {
-                        if (i < 16 && !(status & IRQ_WAITING))
+                if (desc->istate & IRQS_AUTODETECT) {
+                        if (i < 16 && !(desc->istate & IRQS_WAITING))
                                 mask |= 1 << i;
 
-                        desc->status = status & ~IRQ_AUTODETECT;
-                        desc->irq_data.chip->irq_shutdown(&desc->irq_data);
+                        desc->istate &= ~IRQS_AUTODETECT;
+                        irq_shutdown(desc);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -169,20 +161,18 @@ int probe_irq_off(unsigned long val)
 {
         int i, irq_found = 0, nr_of_irqs = 0;
         struct irq_desc *desc;
-        unsigned int status;
 
         for_each_irq_desc(i, desc) {
                 raw_spin_lock_irq(&desc->lock);
-                status = desc->status;
 
-                if (status & IRQ_AUTODETECT) {
-                        if (!(status & IRQ_WAITING)) {
+                if (desc->istate & IRQS_AUTODETECT) {
+                        if (!(desc->istate & IRQS_WAITING)) {
                                 if (!nr_of_irqs)
                                         irq_found = i;
                                 nr_of_irqs++;
                         }
-                        desc->status = status & ~IRQ_AUTODETECT;
-                        desc->irq_data.chip->irq_shutdown(&desc->irq_data);
+                        desc->istate &= ~IRQS_AUTODETECT;
+                        irq_shutdown(desc);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index baa5c4acad83..c9c0601f0615 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -19,140 +19,110 @@
 #include "internals.h"
 
 /**
- *      set_irq_chip - set the irq chip for an irq
+ *      irq_set_chip - set the irq chip for an irq
  *      @irq:   irq number
  *      @chip:  pointer to irq chip description structure
  */
-int set_irq_chip(unsigned int irq, struct irq_chip *chip)
+int irq_set_chip(unsigned int irq, struct irq_chip *chip)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
 
-        if (!desc) {
-                WARN(1, KERN_ERR "Trying to install chip for IRQ%d\n", irq);
+        if (!desc)
                 return -EINVAL;
-        }
 
         if (!chip)
                 chip = &no_irq_chip;
 
-        raw_spin_lock_irqsave(&desc->lock, flags);
         irq_chip_set_defaults(chip);
         desc->irq_data.chip = chip;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-
+        irq_put_desc_unlock(desc, flags);
         return 0;
 }
-EXPORT_SYMBOL(set_irq_chip);
+EXPORT_SYMBOL(irq_set_chip);
 
 /**
- *      set_irq_type - set the irq trigger type for an irq
+ *      irq_set_type - set the irq trigger type for an irq
  *      @irq:   irq number
  *      @type:  IRQ_TYPE_{LEVEL,EDGE}_* value - see include/linux/irq.h
  */
-int set_irq_type(unsigned int irq, unsigned int type)
+int irq_set_irq_type(unsigned int irq, unsigned int type)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
-        int ret = -ENXIO;
+        struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
+        int ret = 0;
 
-        if (!desc) {
-                printk(KERN_ERR "Trying to set irq type for IRQ%d\n", irq);
-                return -ENODEV;
-        }
+        if (!desc)
+                return -EINVAL;
 
         type &= IRQ_TYPE_SENSE_MASK;
-        if (type == IRQ_TYPE_NONE)
-                return 0;
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        ret = __irq_set_trigger(desc, irq, type);
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        if (type != IRQ_TYPE_NONE)
+                ret = __irq_set_trigger(desc, irq, type);
+        irq_put_desc_busunlock(desc, flags);
         return ret;
 }
-EXPORT_SYMBOL(set_irq_type);
+EXPORT_SYMBOL(irq_set_irq_type);
 
 /**
- *      set_irq_data - set irq type data for an irq
+ *      irq_set_handler_data - set irq handler data for an irq
  *      @irq:   Interrupt number
  *      @data:  Pointer to interrupt specific data
  *
  *      Set the hardware irq controller data for an irq
  */
-int set_irq_data(unsigned int irq, void *data)
+int irq_set_handler_data(unsigned int irq, void *data)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
 
-        if (!desc) {
-                printk(KERN_ERR
-                       "Trying to install controller data for IRQ%d\n", irq);
+        if (!desc)
                 return -EINVAL;
-        }
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
         desc->irq_data.handler_data = data;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        irq_put_desc_unlock(desc, flags);
         return 0;
 }
-EXPORT_SYMBOL(set_irq_data);
+EXPORT_SYMBOL(irq_set_handler_data);
 
 /**
- *      set_irq_msi - set MSI descriptor data for an irq
+ *      irq_set_msi_desc - set MSI descriptor data for an irq
  *      @irq:   Interrupt number
  *      @entry: Pointer to MSI descriptor data
  *
  *      Set the MSI descriptor entry for an irq
  */
-int set_irq_msi(unsigned int irq, struct msi_desc *entry)
+int irq_set_msi_desc(unsigned int irq, struct msi_desc *entry)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
 
-        if (!desc) {
-                printk(KERN_ERR
-                       "Trying to install msi data for IRQ%d\n", irq);
+        if (!desc)
                 return -EINVAL;
-        }
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
         desc->irq_data.msi_desc = entry;
         if (entry)
                 entry->irq = irq;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        irq_put_desc_unlock(desc, flags);
         return 0;
 }
 
 /**
- *      set_irq_chip_data - set irq chip data for an irq
+ *      irq_set_chip_data - set irq chip data for an irq
  *      @irq:   Interrupt number
  *      @data:  Pointer to chip specific data
  *
  *      Set the hardware irq chip data for an irq
  */
-int set_irq_chip_data(unsigned int irq, void *data)
+int irq_set_chip_data(unsigned int irq, void *data)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
 
-        if (!desc) {
-                printk(KERN_ERR
-                       "Trying to install chip data for IRQ%d\n", irq);
-                return -EINVAL;
-        }
-
-        if (!desc->irq_data.chip) {
-                printk(KERN_ERR "BUG: bad set_irq_chip_data(IRQ#%d)\n", irq);
+        if (!desc)
                 return -EINVAL;
-        }
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
         desc->irq_data.chip_data = data;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-
+        irq_put_desc_unlock(desc, flags);
         return 0;
 }
-EXPORT_SYMBOL(set_irq_chip_data);
+EXPORT_SYMBOL(irq_set_chip_data);
 
 struct irq_data *irq_get_irq_data(unsigned int irq)
 {
@@ -162,72 +132,75 @@ struct irq_data *irq_get_irq_data(unsigned int irq)
 }
 EXPORT_SYMBOL_GPL(irq_get_irq_data);
 
-/**
- *      set_irq_nested_thread - Set/Reset the IRQ_NESTED_THREAD flag of an irq
- *
- *      @irq:   Interrupt number
- *      @nest:  0 to clear / 1 to set the IRQ_NESTED_THREAD flag
- *
- *      The IRQ_NESTED_THREAD flag indicates that on
- *      request_threaded_irq() no separate interrupt thread should be
- *      created for the irq as the handler are called nested in the
- *      context of a demultiplexing interrupt handler thread.
- */
-void set_irq_nested_thread(unsigned int irq, int nest)
+static void irq_state_clr_disabled(struct irq_desc *desc)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
-        unsigned long flags;
-
-        if (!desc)
-                return;
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        if (nest)
-                desc->status |= IRQ_NESTED_THREAD;
-        else
-                desc->status &= ~IRQ_NESTED_THREAD;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        desc->istate &= ~IRQS_DISABLED;
+        irq_compat_clr_disabled(desc);
 }
-EXPORT_SYMBOL_GPL(set_irq_nested_thread);
 
-/*
- * default enable function
- */
-static void default_enable(struct irq_data *data)
+static void irq_state_set_disabled(struct irq_desc *desc)
 {
-        struct irq_desc *desc = irq_data_to_desc(data);
+        desc->istate |= IRQS_DISABLED;
+        irq_compat_set_disabled(desc);
+}
 
-        desc->irq_data.chip->irq_unmask(&desc->irq_data);
-        desc->status &= ~IRQ_MASKED;
+static void irq_state_clr_masked(struct irq_desc *desc)
+{
+        desc->istate &= ~IRQS_MASKED;
+        irq_compat_clr_masked(desc);
 }
 
-/*
- * default disable function
- */
-static void default_disable(struct irq_data *data)
+static void irq_state_set_masked(struct irq_desc *desc)
 {
+        desc->istate |= IRQS_MASKED;
+        irq_compat_set_masked(desc);
 }
 
-/*
- * default startup function
- */
-static unsigned int default_startup(struct irq_data *data)
+int irq_startup(struct irq_desc *desc)
 {
-        struct irq_desc *desc = irq_data_to_desc(data);
+        irq_state_clr_disabled(desc);
+        desc->depth = 0;
+
+        if (desc->irq_data.chip->irq_startup) {
+                int ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
+                irq_state_clr_masked(desc);
+                return ret;
+        }
 
-        desc->irq_data.chip->irq_enable(data);
+        irq_enable(desc);
         return 0;
 }
 
-/*
- * default shutdown function
- */
-static void default_shutdown(struct irq_data *data)
+void irq_shutdown(struct irq_desc *desc)
 {
-        struct irq_desc *desc = irq_data_to_desc(data);
+        irq_state_set_disabled(desc);
+        desc->depth = 1;
+        if (desc->irq_data.chip->irq_shutdown)
+                desc->irq_data.chip->irq_shutdown(&desc->irq_data);
+        if (desc->irq_data.chip->irq_disable)
+                desc->irq_data.chip->irq_disable(&desc->irq_data);
+        else
+                desc->irq_data.chip->irq_mask(&desc->irq_data);
+        irq_state_set_masked(desc);
+}
 
-        desc->irq_data.chip->irq_mask(&desc->irq_data);
-        desc->status |= IRQ_MASKED;
+void irq_enable(struct irq_desc *desc)
+{
+        irq_state_clr_disabled(desc);
+        if (desc->irq_data.chip->irq_enable)
+                desc->irq_data.chip->irq_enable(&desc->irq_data);
+        else
+                desc->irq_data.chip->irq_unmask(&desc->irq_data);
+        irq_state_clr_masked(desc);
+}
+
+void irq_disable(struct irq_desc *desc)
+{
+        irq_state_set_disabled(desc);
+        if (desc->irq_data.chip->irq_disable) {
+                desc->irq_data.chip->irq_disable(&desc->irq_data);
+                irq_state_set_masked(desc);
+        }
 }
 
 #ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
@@ -315,10 +288,6 @@ static void compat_bus_sync_unlock(struct irq_data *data)
 void irq_chip_set_defaults(struct irq_chip *chip)
 {
 #ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
-        /*
-         * Compat fixup functions need to be before we set the
-         * defaults for enable/disable/startup/shutdown
-         */
         if (chip->enable)
                 chip->irq_enable = compat_irq_enable;
         if (chip->disable)
@@ -327,33 +296,8 @@ void irq_chip_set_defaults(struct irq_chip *chip)
                 chip->irq_shutdown = compat_irq_shutdown;
         if (chip->startup)
                 chip->irq_startup = compat_irq_startup;
-#endif
-        /*
-         * The real defaults
-         */
-        if (!chip->irq_enable)
-                chip->irq_enable = default_enable;
-        if (!chip->irq_disable)
-                chip->irq_disable = default_disable;
-        if (!chip->irq_startup)
-                chip->irq_startup = default_startup;
-        /*
-         * We use chip->irq_disable, when the user provided its own. When
-         * we have default_disable set for chip->irq_disable, then we need
-         * to use default_shutdown, otherwise the irq line is not
-         * disabled on free_irq():
-         */
-        if (!chip->irq_shutdown)
-                chip->irq_shutdown = chip->irq_disable != default_disable ?
-                        chip->irq_disable : default_shutdown;
-
-#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
         if (!chip->end)
                 chip->end = dummy_irq_chip.end;
-
-        /*
-         * Now fix up the remaining compat handlers
-         */
         if (chip->bus_lock)
                 chip->irq_bus_lock = compat_bus_lock;
         if (chip->bus_sync_unlock)
@@ -388,22 +332,22 @@ static inline void mask_ack_irq(struct irq_desc *desc)
                 if (desc->irq_data.chip->irq_ack)
                         desc->irq_data.chip->irq_ack(&desc->irq_data);
         }
-        desc->status |= IRQ_MASKED;
+        irq_state_set_masked(desc);
 }
 
-static inline void mask_irq(struct irq_desc *desc)
+void mask_irq(struct irq_desc *desc)
 {
         if (desc->irq_data.chip->irq_mask) {
                 desc->irq_data.chip->irq_mask(&desc->irq_data);
-                desc->status |= IRQ_MASKED;
+                irq_state_set_masked(desc);
         }
 }
 
-static inline void unmask_irq(struct irq_desc *desc)
+void unmask_irq(struct irq_desc *desc)
 {
         if (desc->irq_data.chip->irq_unmask) {
                 desc->irq_data.chip->irq_unmask(&desc->irq_data);
-                desc->status &= ~IRQ_MASKED;
+                irq_state_clr_masked(desc);
         }
 }
 
@@ -428,10 +372,11 @@ void handle_nested_irq(unsigned int irq)
         kstat_incr_irqs_this_cpu(irq, desc);
 
         action = desc->action;
-        if (unlikely(!action || (desc->status & IRQ_DISABLED)))
+        if (unlikely(!action || (desc->istate & IRQS_DISABLED)))
                 goto out_unlock;
 
-        desc->status |= IRQ_INPROGRESS;
+        irq_compat_set_progress(desc);
+        desc->istate |= IRQS_INPROGRESS;
         raw_spin_unlock_irq(&desc->lock);
 
         action_ret = action->thread_fn(action->irq, action->dev_id);
@@ -439,13 +384,21 @@ void handle_nested_irq(unsigned int irq)
                 note_interrupt(irq, desc, action_ret);
 
         raw_spin_lock_irq(&desc->lock);
-        desc->status &= ~IRQ_INPROGRESS;
+        desc->istate &= ~IRQS_INPROGRESS;
+        irq_compat_clr_progress(desc);
 
 out_unlock:
         raw_spin_unlock_irq(&desc->lock);
 }
 EXPORT_SYMBOL_GPL(handle_nested_irq);
 
+static bool irq_check_poll(struct irq_desc *desc)
+{
+        if (!(desc->istate & IRQS_POLL_INPROGRESS))
+                return false;
+        return irq_wait_for_poll(desc);
+}
+
 /**
  *      handle_simple_irq - Simple and software-decoded IRQs.
  *      @irq:   the interrupt number
@@ -461,29 +414,20 @@ EXPORT_SYMBOL_GPL(handle_nested_irq);
 void
 handle_simple_irq(unsigned int irq, struct irq_desc *desc)
 {
-        struct irqaction *action;
-        irqreturn_t action_ret;
-
         raw_spin_lock(&desc->lock);
 
-        if (unlikely(desc->status & IRQ_INPROGRESS))
-                goto out_unlock;
-        desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
+        if (unlikely(desc->istate & IRQS_INPROGRESS))
+                if (!irq_check_poll(desc))
+                        goto out_unlock;
+
+        desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
         kstat_incr_irqs_this_cpu(irq, desc);
 
-        action = desc->action;
-        if (unlikely(!action || (desc->status & IRQ_DISABLED)))
+        if (unlikely(!desc->action || (desc->istate & IRQS_DISABLED)))
                 goto out_unlock;
 
-        desc->status |= IRQ_INPROGRESS;
-        raw_spin_unlock(&desc->lock);
+        handle_irq_event(desc);
 
-        action_ret = handle_IRQ_event(irq, action);
-        if (!noirqdebug)
-                note_interrupt(irq, desc, action_ret);
-
-        raw_spin_lock(&desc->lock);
-        desc->status &= ~IRQ_INPROGRESS;
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -501,42 +445,42 @@ out_unlock:
 void
 handle_level_irq(unsigned int irq, struct irq_desc *desc)
 {
-        struct irqaction *action;
-        irqreturn_t action_ret;
-
         raw_spin_lock(&desc->lock);
         mask_ack_irq(desc);
 
-        if (unlikely(desc->status & IRQ_INPROGRESS))
-                goto out_unlock;
-        desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
+        if (unlikely(desc->istate & IRQS_INPROGRESS))
+                if (!irq_check_poll(desc))
+                        goto out_unlock;
+
+        desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
         kstat_incr_irqs_this_cpu(irq, desc);
 
         /*
          * If its disabled or no action available
          * keep it masked and get out of here
          */
-        action = desc->action;
-        if (unlikely(!action || (desc->status & IRQ_DISABLED)))
+        if (unlikely(!desc->action || (desc->istate & IRQS_DISABLED)))
                 goto out_unlock;
 
-        desc->status |= IRQ_INPROGRESS;
-        raw_spin_unlock(&desc->lock);
-
-        action_ret = handle_IRQ_event(irq, action);
-        if (!noirqdebug)
-                note_interrupt(irq, desc, action_ret);
+        handle_irq_event(desc);
 
-        raw_spin_lock(&desc->lock);
-        desc->status &= ~IRQ_INPROGRESS;
-
-        if (!(desc->status & (IRQ_DISABLED | IRQ_ONESHOT)))
+        if (!(desc->istate & (IRQS_DISABLED | IRQS_ONESHOT)))
                 unmask_irq(desc);
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
 EXPORT_SYMBOL_GPL(handle_level_irq);
 
+#ifdef CONFIG_IRQ_PREFLOW_FASTEOI
+static inline void preflow_handler(struct irq_desc *desc)
+{
+        if (desc->preflow_handler)
+                desc->preflow_handler(&desc->irq_data);
+}
+#else
+static inline void preflow_handler(struct irq_desc *desc) { }
+#endif
+
 /**
  *      handle_fasteoi_irq - irq handler for transparent controllers
  *      @irq:   the interrupt number
@@ -550,42 +494,41 @@ EXPORT_SYMBOL_GPL(handle_level_irq);
 void
 handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
 {
-        struct irqaction *action;
-        irqreturn_t action_ret;
-
         raw_spin_lock(&desc->lock);
 
-        if (unlikely(desc->status & IRQ_INPROGRESS))
-                goto out;
+        if (unlikely(desc->istate & IRQS_INPROGRESS))
+                if (!irq_check_poll(desc))
+                        goto out;
 
-        desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
+        desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
         kstat_incr_irqs_this_cpu(irq, desc);
 
         /*
          * If its disabled or no action available
          * then mask it and get out of here:
          */
-        action = desc->action;
-        if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
-                desc->status |= IRQ_PENDING;
+        if (unlikely(!desc->action || (desc->istate & IRQS_DISABLED))) {
+                irq_compat_set_pending(desc);
+                desc->istate |= IRQS_PENDING;
                 mask_irq(desc);
                 goto out;
         }
 
-        desc->status |= IRQ_INPROGRESS;
-        desc->status &= ~IRQ_PENDING;
-        raw_spin_unlock(&desc->lock);
+        if (desc->istate & IRQS_ONESHOT)
+                mask_irq(desc);
 
-        action_ret = handle_IRQ_event(irq, action);
-        if (!noirqdebug)
-                note_interrupt(irq, desc, action_ret);
+        preflow_handler(desc);
+        handle_irq_event(desc);
 
-        raw_spin_lock(&desc->lock);
-        desc->status &= ~IRQ_INPROGRESS;
-out:
+out_eoi:
         desc->irq_data.chip->irq_eoi(&desc->irq_data);
-
+out_unlock:
         raw_spin_unlock(&desc->lock);
+        return;
+out:
+        if (!(desc->irq_data.chip->flags & IRQCHIP_EOI_IF_HANDLED))
+                goto out_eoi;
+        goto out_unlock;
 }
 
 /**
@@ -609,32 +552,28 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
 {
         raw_spin_lock(&desc->lock);
 
-        desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
-
+        desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
         /*
          * If we're currently running this IRQ, or its disabled,
          * we shouldn't process the IRQ. Mark it pending, handle
          * the necessary masking and go out
          */
-        if (unlikely((desc->status & (IRQ_INPROGRESS | IRQ_DISABLED)) ||
-                    !desc->action)) {
-                desc->status |= (IRQ_PENDING | IRQ_MASKED);
-                mask_ack_irq(desc);
-                goto out_unlock;
+        if (unlikely((desc->istate & (IRQS_DISABLED | IRQS_INPROGRESS) ||
+                      !desc->action))) {
+                if (!irq_check_poll(desc)) {
+                        irq_compat_set_pending(desc);
+                        desc->istate |= IRQS_PENDING;
+                        mask_ack_irq(desc);
+                        goto out_unlock;
+                }
         }
         kstat_incr_irqs_this_cpu(irq, desc);
 
         /* Start handling the irq */
         desc->irq_data.chip->irq_ack(&desc->irq_data);
 
-        /* Mark the IRQ currently in progress.*/
-        desc->status |= IRQ_INPROGRESS;
-
         do {
-                struct irqaction *action = desc->action;
-                irqreturn_t action_ret;
-
-                if (unlikely(!action)) {
+                if (unlikely(!desc->action)) {
                         mask_irq(desc);
                         goto out_unlock;
                 }
@@ -644,22 +583,17 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                  * one, we could have masked the irq.
                  * Renable it, if it was not disabled in meantime.
                  */
-                if (unlikely((desc->status &
-                               (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
-                              (IRQ_PENDING | IRQ_MASKED))) {
-                        unmask_irq(desc);
+                if (unlikely(desc->istate & IRQS_PENDING)) {
+                        if (!(desc->istate & IRQS_DISABLED) &&
+                            (desc->istate & IRQS_MASKED))
+                                unmask_irq(desc);
                 }
 
-                desc->status &= ~IRQ_PENDING;
-                raw_spin_unlock(&desc->lock);
-                action_ret = handle_IRQ_event(irq, action);
-                if (!noirqdebug)
-                        note_interrupt(irq, desc, action_ret);
-                raw_spin_lock(&desc->lock);
+                handle_irq_event(desc);
 
-        } while ((desc->status & (IRQ_PENDING | IRQ_DISABLED)) == IRQ_PENDING);
+        } while ((desc->istate & IRQS_PENDING) &&
+                 !(desc->istate & IRQS_DISABLED));
 
-        desc->status &= ~IRQ_INPROGRESS;
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -674,103 +608,84 @@ out_unlock:
 void
 handle_percpu_irq(unsigned int irq, struct irq_desc *desc)
 {
-        irqreturn_t action_ret;
+        struct irq_chip *chip = irq_desc_get_chip(desc);
 
         kstat_incr_irqs_this_cpu(irq, desc);
 
-        if (desc->irq_data.chip->irq_ack)
-                desc->irq_data.chip->irq_ack(&desc->irq_data);
+        if (chip->irq_ack)
+                chip->irq_ack(&desc->irq_data);
 
-        action_ret = handle_IRQ_event(irq, desc->action);
-        if (!noirqdebug)
-                note_interrupt(irq, desc, action_ret);
+        handle_irq_event_percpu(desc, desc->action);
 
-        if (desc->irq_data.chip->irq_eoi)
-                desc->irq_data.chip->irq_eoi(&desc->irq_data);
+        if (chip->irq_eoi)
+                chip->irq_eoi(&desc->irq_data);
 }
 
 void
-__set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
+__irq_set_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
                   const char *name)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
 
-        if (!desc) {
-                printk(KERN_ERR
-                       "Trying to install type control for IRQ%d\n", irq);
+        if (!desc)
                 return;
-        }
 
-        if (!handle)
+        if (!handle) {
                 handle = handle_bad_irq;
-        else if (desc->irq_data.chip == &no_irq_chip) {
-                printk(KERN_WARNING "Trying to install %sinterrupt handler "
-                       "for IRQ%d\n", is_chained ? "chained " : "", irq);
-                /*
-                 * Some ARM implementations install a handler for really dumb
-                 * interrupt hardware without setting an irq_chip. This worked
-                 * with the ARM no_irq_chip but the check in setup_irq would
-                 * prevent us to setup the interrupt at all. Switch it to
-                 * dummy_irq_chip for easy transition.
-                 */
-                desc->irq_data.chip = &dummy_irq_chip;
+        } else {
+                if (WARN_ON(desc->irq_data.chip == &no_irq_chip))
+                        goto out;
         }
 
-        chip_bus_lock(desc);
-        raw_spin_lock_irqsave(&desc->lock, flags);
-
         /* Uninstall? */
         if (handle == handle_bad_irq) {
                 if (desc->irq_data.chip != &no_irq_chip)
                         mask_ack_irq(desc);
-                desc->status |= IRQ_DISABLED;
+                irq_compat_set_disabled(desc);
+                desc->istate |= IRQS_DISABLED;
                 desc->depth = 1;
         }
         desc->handle_irq = handle;
         desc->name = name;
 
         if (handle != handle_bad_irq && is_chained) {
-                desc->status &= ~IRQ_DISABLED;
-                desc->status |= IRQ_NOREQUEST | IRQ_NOPROBE;
-                desc->depth = 0;
-                desc->irq_data.chip->irq_startup(&desc->irq_data);
+                irq_settings_set_noprobe(desc);
+                irq_settings_set_norequest(desc);
+                irq_startup(desc);
         }
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(desc);
-}
-EXPORT_SYMBOL_GPL(__set_irq_handler);
-
-void
-set_irq_chip_and_handler(unsigned int irq, struct irq_chip *chip,
-                         irq_flow_handler_t handle)
-{
-        set_irq_chip(irq, chip);
-        __set_irq_handler(irq, handle, 0, NULL);
+out:
+        irq_put_desc_busunlock(desc, flags);
 }
+EXPORT_SYMBOL_GPL(__irq_set_handler);
 
 void
-set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
+irq_set_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
                               irq_flow_handler_t handle, const char *name)
 {
-        set_irq_chip(irq, chip);
-        __set_irq_handler(irq, handle, 0, name);
+        irq_set_chip(irq, chip);
+        __irq_set_handler(irq, handle, 0, name);
 }
 
 void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
 
         if (!desc)
                 return;
+        irq_settings_clr_and_set(desc, clr, set);
+
+        irqd_clear(&desc->irq_data, IRQD_NO_BALANCING | IRQD_PER_CPU |
+                   IRQD_TRIGGER_MASK | IRQD_LEVEL | IRQD_MOVE_PCNTXT);
+        if (irq_settings_has_no_balance_set(desc))
+                irqd_set(&desc->irq_data, IRQD_NO_BALANCING);
+        if (irq_settings_is_per_cpu(desc))
+                irqd_set(&desc->irq_data, IRQD_PER_CPU);
+        if (irq_settings_can_move_pcntxt(desc))
+                irqd_set(&desc->irq_data, IRQD_MOVE_PCNTXT);
 
-        /* Sanitize flags */
-        set &= IRQF_MODIFY_MASK;
-        clr &= IRQF_MODIFY_MASK;
+        irqd_set(&desc->irq_data, irq_settings_get_trigger_mask(desc));
 
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->status &= ~clr;
-        desc->status |= set;
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        irq_put_desc_unlock(desc, flags);
 }
diff --git a/kernel/irq/compat.h b/kernel/irq/compat.h
new file mode 100644
index 000000000000..6bbaf66aca85
--- /dev/null
+++ b/kernel/irq/compat.h
@@ -0,0 +1,72 @@
+/*
+ * Compat layer for transition period
+ */
+#ifndef CONFIG_GENERIC_HARDIRQS_NO_COMPAT
+static inline void irq_compat_set_progress(struct irq_desc *desc)
+{
+        desc->status |= IRQ_INPROGRESS;
+}
+
+static inline void irq_compat_clr_progress(struct irq_desc *desc)
+{
+        desc->status &= ~IRQ_INPROGRESS;
+}
+static inline void irq_compat_set_disabled(struct irq_desc *desc)
+{
+        desc->status |= IRQ_DISABLED;
+}
+static inline void irq_compat_clr_disabled(struct irq_desc *desc)
+{
+        desc->status &= ~IRQ_DISABLED;
+}
+static inline void irq_compat_set_pending(struct irq_desc *desc)
+{
+        desc->status |= IRQ_PENDING;
+}
+
+static inline void irq_compat_clr_pending(struct irq_desc *desc)
+{
+        desc->status &= ~IRQ_PENDING;
+}
+static inline void irq_compat_set_masked(struct irq_desc *desc)
+{
+        desc->status |= IRQ_MASKED;
+}
+
+static inline void irq_compat_clr_masked(struct irq_desc *desc)
+{
+        desc->status &= ~IRQ_MASKED;
+}
+static inline void irq_compat_set_move_pending(struct irq_desc *desc)
+{
+        desc->status |= IRQ_MOVE_PENDING;
+}
+
+static inline void irq_compat_clr_move_pending(struct irq_desc *desc)
+{
+        desc->status &= ~IRQ_MOVE_PENDING;
+}
+static inline void irq_compat_set_affinity(struct irq_desc *desc)
+{
+        desc->status |= IRQ_AFFINITY_SET;
+}
+
+static inline void irq_compat_clr_affinity(struct irq_desc *desc)
+{
+        desc->status &= ~IRQ_AFFINITY_SET;
+}
+#else
+static inline void irq_compat_set_progress(struct irq_desc *desc) { }
+static inline void irq_compat_clr_progress(struct irq_desc *desc) { }
+static inline void irq_compat_set_disabled(struct irq_desc *desc) { }
+static inline void irq_compat_clr_disabled(struct irq_desc *desc) { }
+static inline void irq_compat_set_pending(struct irq_desc *desc) { }
+static inline void irq_compat_clr_pending(struct irq_desc *desc) { }
+static inline void irq_compat_set_masked(struct irq_desc *desc) { }
+static inline void irq_compat_clr_masked(struct irq_desc *desc) { }
+static inline void irq_compat_set_move_pending(struct irq_desc *desc) { }
+static inline void irq_compat_clr_move_pending(struct irq_desc *desc) { }
+static inline void irq_compat_set_affinity(struct irq_desc *desc) { }
+static inline void irq_compat_clr_affinity(struct irq_desc *desc) { }
+#endif
+
diff --git a/kernel/irq/debug.h b/kernel/irq/debug.h
new file mode 100644
index 000000000000..d1a33b7fa61d
--- /dev/null
+++ b/kernel/irq/debug.h
@@ -0,0 +1,40 @@
+/*
+ * Debugging printout:
+ */
+
+#include <linux/kallsyms.h>
+
+#define P(f) if (desc->status & f) printk("%14s set\n", #f)
+#define PS(f) if (desc->istate & f) printk("%14s set\n", #f)
+
+static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
+{
+        printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n",
+                irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
+        printk("->handle_irq():  %p, ", desc->handle_irq);
+        print_symbol("%s\n", (unsigned long)desc->handle_irq);
+        printk("->irq_data.chip(): %p, ", desc->irq_data.chip);
+        print_symbol("%s\n", (unsigned long)desc->irq_data.chip);
+        printk("->action(): %p\n", desc->action);
+        if (desc->action) {
+                printk("->action->handler(): %p, ", desc->action->handler);
+                print_symbol("%s\n", (unsigned long)desc->action->handler);
+        }
+
+        P(IRQ_LEVEL);
+        P(IRQ_PER_CPU);
+        P(IRQ_NOPROBE);
+        P(IRQ_NOREQUEST);
+        P(IRQ_NOAUTOEN);
+
+        PS(IRQS_AUTODETECT);
+        PS(IRQS_INPROGRESS);
+        PS(IRQS_REPLAY);
+        PS(IRQS_WAITING);
+        PS(IRQS_DISABLED);
+        PS(IRQS_PENDING);
+        PS(IRQS_MASKED);
+}
+
+#undef P
+#undef PS
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index e2347eb63306..517561fc7317 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -51,30 +51,92 @@ static void warn_no_thread(unsigned int irq, struct irqaction *action)
                "but no thread function available.", irq, action->name);
 }
 
-/**
- * handle_IRQ_event - irq action chain handler
- * @irq:        the interrupt number
- * @action:     the interrupt action chain for this irq
- *
- * Handles the action chain of an irq event
- */
-irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
+static void irq_wake_thread(struct irq_desc *desc, struct irqaction *action)
+{
+        /*
+         * Wake up the handler thread for this action. In case the
+         * thread crashed and was killed we just pretend that we
+         * handled the interrupt. The hardirq handler has disabled the
+         * device interrupt, so no irq storm is lurking. If the
+         * RUNTHREAD bit is already set, nothing to do.
+         */
+        if (test_bit(IRQTF_DIED, &action->thread_flags) ||
+            test_and_set_bit(IRQTF_RUNTHREAD, &action->thread_flags))
+                return;
+
+        /*
+         * It's safe to OR the mask lockless here. We have only two
+         * places which write to threads_oneshot: This code and the
+         * irq thread.
+         *
+         * This code is the hard irq context and can never run on two
+         * cpus in parallel. If it ever does we have more serious
+         * problems than this bitmask.
+         *
+         * The irq threads of this irq which clear their "running" bit
+         * in threads_oneshot are serialized via desc->lock against
+         * each other and they are serialized against this code by
+         * IRQS_INPROGRESS.
+         *
+         * Hard irq handler:
+         *
+         *      spin_lock(desc->lock);
+         *      desc->state |= IRQS_INPROGRESS;
+         *      spin_unlock(desc->lock);
+         *      set_bit(IRQTF_RUNTHREAD, &action->thread_flags);
+         *      desc->threads_oneshot |= mask;
+         *      spin_lock(desc->lock);
+         *      desc->state &= ~IRQS_INPROGRESS;
+         *      spin_unlock(desc->lock);
+         *
+         * irq thread:
+         *
+         * again:
+         *      spin_lock(desc->lock);
+         *      if (desc->state & IRQS_INPROGRESS) {
+         *              spin_unlock(desc->lock);
+         *              while(desc->state & IRQS_INPROGRESS)
+         *                      cpu_relax();
+         *              goto again;
+         *      }
+         *      if (!test_bit(IRQTF_RUNTHREAD, &action->thread_flags))
+         *              desc->threads_oneshot &= ~mask;
+         *      spin_unlock(desc->lock);
+         *
+         * So either the thread waits for us to clear IRQS_INPROGRESS
+         * or we are waiting in the flow handler for desc->lock to be
+         * released before we reach this point. The thread also checks
+         * IRQTF_RUNTHREAD under desc->lock. If set it leaves
+         * threads_oneshot untouched and runs the thread another time.
+         */
+        desc->threads_oneshot |= action->thread_mask;
+        wake_up_process(action->thread);
+}
+
+irqreturn_t
+handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action)
 {
-        irqreturn_t ret, retval = IRQ_NONE;
-        unsigned int status = 0;
+        irqreturn_t retval = IRQ_NONE;
+        unsigned int random = 0, irq = desc->irq_data.irq;
 
         do {
+                irqreturn_t res;
+
                 trace_irq_handler_entry(irq, action);
-                ret = action->handler(irq, action->dev_id);
-                trace_irq_handler_exit(irq, action, ret);
+                res = action->handler(irq, action->dev_id);
+                trace_irq_handler_exit(irq, action, res);
+
+                if (WARN_ONCE(!irqs_disabled(),"irq %u handler %pF enabled interrupts\n",
+                              irq, action->handler))
+                        local_irq_disable();
 
-                switch (ret) {
+                switch (res) {
                 case IRQ_WAKE_THREAD:
                         /*
                          * Set result to handled so the spurious check
                          * does not trigger.
                          */
-                        ret = IRQ_HANDLED;
+                        res = IRQ_HANDLED;
 
                         /*
                          * Catch drivers which return WAKE_THREAD but
@@ -85,147 +147,56 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
                                 break;
                         }
 
-                        /*
-                         * Wake up the handler thread for this
-                         * action. In case the thread crashed and was
-                         * killed we just pretend that we handled the
-                         * interrupt. The hardirq handler above has
-                         * disabled the device interrupt, so no irq
-                         * storm is lurking.
-                         */
-                        if (likely(!test_bit(IRQTF_DIED,
-                                             &action->thread_flags))) {
-                                set_bit(IRQTF_RUNTHREAD, &action->thread_flags);
-                                wake_up_process(action->thread);
-                        }
+                        irq_wake_thread(desc, action);
 
                         /* Fall through to add to randomness */
                 case IRQ_HANDLED:
-                        status |= action->flags;
+                        random |= action->flags;
                         break;
 
                 default:
                         break;
                 }
 
-                retval |= ret;
+                retval |= res;
                 action = action->next;
         } while (action);
 
-        if (status & IRQF_SAMPLE_RANDOM)
+        if (random & IRQF_SAMPLE_RANDOM)
                 add_interrupt_randomness(irq);
-        local_irq_disable();
 
+        if (!noirqdebug)
+                note_interrupt(irq, desc, retval);
         return retval;
 }
 
-#ifndef CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ
+irqreturn_t handle_irq_event(struct irq_desc *desc)
+{
+        struct irqaction *action = desc->action;
+        irqreturn_t ret;
 
-#ifdef CONFIG_ENABLE_WARN_DEPRECATED
-# warning __do_IRQ is deprecated. Please convert to proper flow handlers
-#endif
+        irq_compat_clr_pending(desc);
+        desc->istate &= ~IRQS_PENDING;
+        irq_compat_set_progress(desc);
+        desc->istate |= IRQS_INPROGRESS;
+        raw_spin_unlock(&desc->lock);
+
+        ret = handle_irq_event_percpu(desc, action);
+
+        raw_spin_lock(&desc->lock);
+        desc->istate &= ~IRQS_INPROGRESS;
+        irq_compat_clr_progress(desc);
+        return ret;
+}
 
 /**
- * __do_IRQ - original all in one highlevel IRQ handler
+ * handle_IRQ_event - irq action chain handler
  * @irq:        the interrupt number
+ * @action:     the interrupt action chain for this irq
  *
- * __do_IRQ handles all normal device IRQ's (the special
- * SMP cross-CPU interrupts have their own specific
- * handlers).
- *
- * This is the original x86 implementation which is used for every
- * interrupt type.
+ * Handles the action chain of an irq event
  */
-unsigned int __do_IRQ(unsigned int irq)
+irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
-        struct irqaction *action;
-        unsigned int status;
-
-        kstat_incr_irqs_this_cpu(irq, desc);
-
-        if (CHECK_IRQ_PER_CPU(desc->status)) {
-                irqreturn_t action_ret;
-
-                /*
-                 * No locking required for CPU-local interrupts:
-                 */
-                if (desc->irq_data.chip->ack)
-                        desc->irq_data.chip->ack(irq);
-                if (likely(!(desc->status & IRQ_DISABLED))) {
-                        action_ret = handle_IRQ_event(irq, desc->action);
-                        if (!noirqdebug)
-                                note_interrupt(irq, desc, action_ret);
-                }
-                desc->irq_data.chip->end(irq);
-                return 1;
-        }
-
-        raw_spin_lock(&desc->lock);
-        if (desc->irq_data.chip->ack)
-                desc->irq_data.chip->ack(irq);
-        /*
-         * REPLAY is when Linux resends an IRQ that was dropped earlier
-         * WAITING is used by probe to mark irqs that are being tested
-         */
-        status = desc->status & ~(IRQ_REPLAY | IRQ_WAITING);
-        status |= IRQ_PENDING; /* we _want_ to handle it */
-
-        /*
-         * If the IRQ is disabled for whatever reason, we cannot
-         * use the action we have.
-         */
-        action = NULL;
-        if (likely(!(status & (IRQ_DISABLED | IRQ_INPROGRESS)))) {
-                action = desc->action;
-                status &= ~IRQ_PENDING; /* we commit to handling */
-                status |= IRQ_INPROGRESS; /* we are handling it */
-        }
-        desc->status = status;
-
-        /*
-         * If there is no IRQ handler or it was disabled, exit early.
-         * Since we set PENDING, if another processor is handling
-         * a different instance of this same irq, the other processor
-         * will take care of it.
-         */
-        if (unlikely(!action))
-                goto out;
-
-        /*
-         * Edge triggered interrupts need to remember
-         * pending events.
-         * This applies to any hw interrupts that allow a second
-         * instance of the same irq to arrive while we are in do_IRQ
-         * or in the handler. But the code here only handles the _second_
-         * instance of the irq, not the third or fourth. So it is mostly
-         * useful for irq hardware that does not mask cleanly in an
-         * SMP environment.
-         */
-        for (;;) {
-                irqreturn_t action_ret;
-
-                raw_spin_unlock(&desc->lock);
-
-                action_ret = handle_IRQ_event(irq, action);
-                if (!noirqdebug)
-                        note_interrupt(irq, desc, action_ret);
-
-                raw_spin_lock(&desc->lock);
-                if (likely(!(desc->status & IRQ_PENDING)))
-                        break;
-                desc->status &= ~IRQ_PENDING;
-        }
-        desc->status &= ~IRQ_INPROGRESS;
-
-out:
-        /*
-         * The ->end() handler has to deal with interrupts which got
-         * disabled while the handler was running.
-         */
-        desc->irq_data.chip->end(irq);
-        raw_spin_unlock(&desc->lock);
-
-        return 1;
+        return handle_irq_event_percpu(irq_to_desc(irq), action);
 }
-#endif
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 4571ae7e085a..6c6ec9a49027 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -1,27 +1,101 @@
 /*
  * IRQ subsystem internal functions and variables:
+ *
+ * Do not ever include this file from anything else than
+ * kernel/irq/. Do not even think about using any information outside
+ * of this file for your non core code.
  */
 #include <linux/irqdesc.h>
 
+#ifdef CONFIG_SPARSE_IRQ
+# define IRQ_BITMAP_BITS        (NR_IRQS + 8196)
+#else
+# define IRQ_BITMAP_BITS        NR_IRQS
+#endif
+
+#define istate core_internal_state__do_not_mess_with_it
+
+#ifdef CONFIG_GENERIC_HARDIRQS_NO_COMPAT
+# define status status_use_accessors
+#endif
+
 extern int noirqdebug;
 
+/*
+ * Bits used by threaded handlers:
+ * IRQTF_RUNTHREAD - signals that the interrupt handler thread should run
+ * IRQTF_DIED      - handler thread died
+ * IRQTF_WARNED    - warning "IRQ_WAKE_THREAD w/o thread_fn" has been printed
+ * IRQTF_AFFINITY  - irq thread is requested to adjust affinity
+ * IRQTF_FORCED_THREAD  - irq action is force threaded
+ */
+enum {
+        IRQTF_RUNTHREAD,
+        IRQTF_DIED,
+        IRQTF_WARNED,
+        IRQTF_AFFINITY,
+        IRQTF_FORCED_THREAD,
+};
+
+/*
+ * Bit masks for desc->state
+ *
+ * IRQS_AUTODETECT              - autodetection in progress
+ * IRQS_SPURIOUS_DISABLED       - was disabled due to spurious interrupt
+ *                                detection
+ * IRQS_POLL_INPROGRESS         - polling in progress
+ * IRQS_INPROGRESS              - Interrupt in progress
+ * IRQS_ONESHOT                 - irq is not unmasked in primary handler
+ * IRQS_REPLAY                  - irq is replayed
+ * IRQS_WAITING                 - irq is waiting
+ * IRQS_DISABLED                - irq is disabled
+ * IRQS_PENDING                 - irq is pending and replayed later
+ * IRQS_MASKED                  - irq is masked
+ * IRQS_SUSPENDED               - irq is suspended
+ */
+enum {
+        IRQS_AUTODETECT         = 0x00000001,
+        IRQS_SPURIOUS_DISABLED  = 0x00000002,
+        IRQS_POLL_INPROGRESS    = 0x00000008,
+        IRQS_INPROGRESS         = 0x00000010,
+        IRQS_ONESHOT            = 0x00000020,
+        IRQS_REPLAY             = 0x00000040,
+        IRQS_WAITING            = 0x00000080,
+        IRQS_DISABLED           = 0x00000100,
+        IRQS_PENDING            = 0x00000200,
+        IRQS_MASKED             = 0x00000400,
+        IRQS_SUSPENDED          = 0x00000800,
+};
+
+#include "compat.h"
+#include "debug.h"
+#include "settings.h"
+
 #define irq_data_to_desc(data)  container_of(data, struct irq_desc, irq_data)
 
 /* Set default functions for irq_chip structures: */
 extern void irq_chip_set_defaults(struct irq_chip *chip);
 
-/* Set default handler: */
-extern void compat_irq_chip_set_default_handler(struct irq_desc *desc);
-
 extern int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
                 unsigned long flags);
 extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp);
 extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume);
 
+extern int irq_startup(struct irq_desc *desc);
+extern void irq_shutdown(struct irq_desc *desc);
+extern void irq_enable(struct irq_desc *desc);
+extern void irq_disable(struct irq_desc *desc);
+extern void mask_irq(struct irq_desc *desc);
+extern void unmask_irq(struct irq_desc *desc);
+
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
 
+irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action);
+irqreturn_t handle_irq_event(struct irq_desc *desc);
+
 /* Resending of interrupts :*/
 void check_irq_resend(struct irq_desc *desc, unsigned int irq);
+bool irq_wait_for_poll(struct irq_desc *desc);
 
 #ifdef CONFIG_PROC_FS
 extern void register_irq_proc(unsigned int irq, struct irq_desc *desc);
@@ -37,20 +111,10 @@ static inline void unregister_handler_proc(unsigned int irq,
                                            struct irqaction *action) { }
 #endif
 
-extern int irq_select_affinity_usr(unsigned int irq);
+extern int irq_select_affinity_usr(unsigned int irq, struct cpumask *mask);
 
 extern void irq_set_thread_affinity(struct irq_desc *desc);
 
-#ifndef CONFIG_GENERIC_HARDIRQS_NO_DEPRECATED
-static inline void irq_end(unsigned int irq, struct irq_desc *desc)
-{
-        if (desc->irq_data.chip && desc->irq_data.chip->end)
-                desc->irq_data.chip->end(irq);
-}
-#else
-static inline void irq_end(unsigned int irq, struct irq_desc *desc) { }
-#endif
-
 /* Inline functions for support of irq chips on slow busses */
 static inline void chip_bus_lock(struct irq_desc *desc)
 {
@@ -64,43 +128,60 @@ static inline void chip_bus_sync_unlock(struct irq_desc *desc)
                 desc->irq_data.chip->irq_bus_sync_unlock(&desc->irq_data);
 }
 
+struct irq_desc *
+__irq_get_desc_lock(unsigned int irq, unsigned long *flags, bool bus);
+void __irq_put_desc_unlock(struct irq_desc *desc, unsigned long flags, bool bus);
+
+static inline struct irq_desc *
+irq_get_desc_buslock(unsigned int irq, unsigned long *flags)
+{
+        return __irq_get_desc_lock(irq, flags, true);
+}
+
+static inline void
+irq_put_desc_busunlock(struct irq_desc *desc, unsigned long flags)
+{
+        __irq_put_desc_unlock(desc, flags, true);
+}
+
+static inline struct irq_desc *
+irq_get_desc_lock(unsigned int irq, unsigned long *flags)
+{
+        return __irq_get_desc_lock(irq, flags, false);
+}
+
+static inline void
+irq_put_desc_unlock(struct irq_desc *desc, unsigned long flags)
+{
+        __irq_put_desc_unlock(desc, flags, false);
+}
+
 /*
- * Debugging printout:
+ * Manipulation functions for irq_data.state
  */
+static inline void irqd_set_move_pending(struct irq_data *d)
+{
+        d->state_use_accessors |= IRQD_SETAFFINITY_PENDING;
+        irq_compat_set_move_pending(irq_data_to_desc(d));
+}
 
-#include <linux/kallsyms.h>
-
-#define P(f) if (desc->status & f) printk("%14s set\n", #f)
+static inline void irqd_clr_move_pending(struct irq_data *d)
+{
+        d->state_use_accessors &= ~IRQD_SETAFFINITY_PENDING;
+        irq_compat_clr_move_pending(irq_data_to_desc(d));
+}
 
-static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
+static inline void irqd_clear(struct irq_data *d, unsigned int mask)
 {
-        printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n",
-                irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
-        printk("->handle_irq():  %p, ", desc->handle_irq);
-        print_symbol("%s\n", (unsigned long)desc->handle_irq);
-        printk("->irq_data.chip(): %p, ", desc->irq_data.chip);
-        print_symbol("%s\n", (unsigned long)desc->irq_data.chip);
-        printk("->action(): %p\n", desc->action);
-        if (desc->action) {
-                printk("->action->handler(): %p, ", desc->action->handler);
-                print_symbol("%s\n", (unsigned long)desc->action->handler);
-        }
-
-        P(IRQ_INPROGRESS);
-        P(IRQ_DISABLED);
-        P(IRQ_PENDING);
-        P(IRQ_REPLAY);
-        P(IRQ_AUTODETECT);
-        P(IRQ_WAITING);
-        P(IRQ_LEVEL);
-        P(IRQ_MASKED);
-#ifdef CONFIG_IRQ_PER_CPU
-        P(IRQ_PER_CPU);
-#endif
-        P(IRQ_NOPROBE);
-        P(IRQ_NOREQUEST);
-        P(IRQ_NOAUTOEN);
+        d->state_use_accessors &= ~mask;
 }
 
-#undef P
+static inline void irqd_set(struct irq_data *d, unsigned int mask)
+{
+        d->state_use_accessors |= mask;
+}
 
+static inline bool irqd_has_set(struct irq_data *d, unsigned int mask)
+{
+        return d->state_use_accessors & mask;
+}
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 9988d03797f5..dbccc799407f 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -72,18 +72,22 @@ static inline int desc_node(struct irq_desc *desc) { return 0; }
 
 static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
 {
+        int cpu;
+
         desc->irq_data.irq = irq;
         desc->irq_data.chip = &no_irq_chip;
         desc->irq_data.chip_data = NULL;
         desc->irq_data.handler_data = NULL;
         desc->irq_data.msi_desc = NULL;
-        desc->status = IRQ_DEFAULT_INIT_FLAGS;
+        irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
+        desc->istate = IRQS_DISABLED;
         desc->handle_irq = handle_bad_irq;
         desc->depth = 1;
         desc->irq_count = 0;
         desc->irqs_unhandled = 0;
         desc->name = NULL;
-        memset(desc->kstat_irqs, 0, nr_cpu_ids * sizeof(*(desc->kstat_irqs)));
+        for_each_possible_cpu(cpu)
+                *per_cpu_ptr(desc->kstat_irqs, cpu) = 0;
         desc_smp_init(desc, node);
 }
 
@@ -91,7 +95,7 @@ int nr_irqs = NR_IRQS;
 EXPORT_SYMBOL_GPL(nr_irqs);
 
 static DEFINE_MUTEX(sparse_irq_lock);
-static DECLARE_BITMAP(allocated_irqs, NR_IRQS);
+static DECLARE_BITMAP(allocated_irqs, IRQ_BITMAP_BITS);
 
 #ifdef CONFIG_SPARSE_IRQ
 
@@ -133,8 +137,7 @@ static struct irq_desc *alloc_desc(int irq, int node)
         if (!desc)
                 return NULL;
         /* allocate based on nr_cpu_ids */
-        desc->kstat_irqs = kzalloc_node(nr_cpu_ids * sizeof(*desc->kstat_irqs),
-                                         gfp, node);
+        desc->kstat_irqs = alloc_percpu(unsigned int);
         if (!desc->kstat_irqs)
                 goto err_desc;
 
@@ -149,7 +152,7 @@ static struct irq_desc *alloc_desc(int irq, int node)
         return desc;
 
 err_kstat:
-        kfree(desc->kstat_irqs);
+        free_percpu(desc->kstat_irqs);
 err_desc:
         kfree(desc);
         return NULL;
@@ -166,7 +169,7 @@ static void free_desc(unsigned int irq)
         mutex_unlock(&sparse_irq_lock);
 
         free_masks(desc);
-        kfree(desc->kstat_irqs);
+        free_percpu(desc->kstat_irqs);
         kfree(desc);
 }
 
@@ -204,6 +207,14 @@ struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
         return NULL;
 }
 
+static int irq_expand_nr_irqs(unsigned int nr)
+{
+        if (nr > IRQ_BITMAP_BITS)
+                return -ENOMEM;
+        nr_irqs = nr;
+        return 0;
+}
+
 int __init early_irq_init(void)
 {
         int i, initcnt, node = first_online_node;
@@ -215,6 +226,15 @@ int __init early_irq_init(void)
         initcnt = arch_probe_nr_irqs();
         printk(KERN_INFO "NR_IRQS:%d nr_irqs:%d %d\n", NR_IRQS, nr_irqs, initcnt);
 
+        if (WARN_ON(nr_irqs > IRQ_BITMAP_BITS))
+                nr_irqs = IRQ_BITMAP_BITS;
+
+        if (WARN_ON(initcnt > IRQ_BITMAP_BITS))
+                initcnt = IRQ_BITMAP_BITS;
+
+        if (initcnt > nr_irqs)
+                nr_irqs = initcnt;
+
         for (i = 0; i < initcnt; i++) {
                 desc = alloc_desc(i, node);
                 set_bit(i, allocated_irqs);
@@ -227,14 +247,13 @@ int __init early_irq_init(void)
 
 struct irq_desc irq_desc[NR_IRQS] __cacheline_aligned_in_smp = {
         [0 ... NR_IRQS-1] = {
-                .status         = IRQ_DEFAULT_INIT_FLAGS,
+                .istate         = IRQS_DISABLED,
                 .handle_irq     = handle_bad_irq,
                 .depth          = 1,
                 .lock           = __RAW_SPIN_LOCK_UNLOCKED(irq_desc->lock),
         }
 };
 
-static unsigned int kstat_irqs_all[NR_IRQS][NR_CPUS];
 int __init early_irq_init(void)
 {
         int count, i, node = first_online_node;
@@ -250,7 +269,8 @@ int __init early_irq_init(void)
         for (i = 0; i < count; i++) {
                 desc[i].irq_data.irq = i;
                 desc[i].irq_data.chip = &no_irq_chip;
-                desc[i].kstat_irqs = kstat_irqs_all[i];
+                desc[i].kstat_irqs = alloc_percpu(unsigned int);
+                irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
                 alloc_masks(desc + i, GFP_KERNEL, node);
                 desc_smp_init(desc + i, node);
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
@@ -277,6 +297,12 @@ static inline int alloc_descs(unsigned int start, unsigned int cnt, int node)
 {
         return start;
 }
+
+static int irq_expand_nr_irqs(unsigned int nr)
+{
+        return -ENOMEM;
+}
+
 #endif /* !CONFIG_SPARSE_IRQ */
 
 /* Dynamic interrupt handling */
@@ -320,14 +346,17 @@ irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
 
         mutex_lock(&sparse_irq_lock);
 
-        start = bitmap_find_next_zero_area(allocated_irqs, nr_irqs, from, cnt, 0);
+        start = bitmap_find_next_zero_area(allocated_irqs, IRQ_BITMAP_BITS,
+                                           from, cnt, 0);
         ret = -EEXIST;
         if (irq >=0 && start != irq)
                 goto err;
 
-        ret = -ENOMEM;
-        if (start >= nr_irqs)
-                goto err;
+        if (start + cnt > nr_irqs) {
+                ret = irq_expand_nr_irqs(start + cnt);
+                if (ret)
+                        goto err;
+        }
 
         bitmap_set(allocated_irqs, start, cnt);
         mutex_unlock(&sparse_irq_lock);
@@ -374,6 +403,26 @@ unsigned int irq_get_next_irq(unsigned int offset)
         return find_next_bit(allocated_irqs, nr_irqs, offset);
 }
 
+struct irq_desc *
+__irq_get_desc_lock(unsigned int irq, unsigned long *flags, bool bus)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+
+        if (desc) {
+                if (bus)
+                        chip_bus_lock(desc);
+                raw_spin_lock_irqsave(&desc->lock, *flags);
+        }
+        return desc;
+}
+
+void __irq_put_desc_unlock(struct irq_desc *desc, unsigned long flags, bool bus)
+{
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        if (bus)
+                chip_bus_sync_unlock(desc);
+}
+
 /**
  * dynamic_irq_cleanup - cleanup a dynamically allocated irq
  * @irq:        irq number to initialize
@@ -391,7 +440,9 @@ void dynamic_irq_cleanup(unsigned int irq)
 unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
 {
         struct irq_desc *desc = irq_to_desc(irq);
-        return desc ? desc->kstat_irqs[cpu] : 0;
+
+        return desc && desc->kstat_irqs ?
+                        *per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
 }
 
 #ifdef CONFIG_GENERIC_HARDIRQS
@@ -401,10 +452,10 @@ unsigned int kstat_irqs(unsigned int irq)
         int cpu;
         int sum = 0;
 
-        if (!desc)
+        if (!desc || !desc->kstat_irqs)
                 return 0;
         for_each_possible_cpu(cpu)
-                sum += desc->kstat_irqs[cpu];
+                sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
         return sum;
 }
 #endif /* CONFIG_GENERIC_HARDIRQS */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 91a5fa25054e..acd599a43bfb 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -17,6 +17,17 @@
 
 #include "internals.h"
 
+#ifdef CONFIG_IRQ_FORCED_THREADING
+__read_mostly bool force_irqthreads;
+
+static int __init setup_forced_irqthreads(char *arg)
+{
+        force_irqthreads = true;
+        return 0;
+}
+early_param("threadirqs", setup_forced_irqthreads);
+#endif
+
 /**
  *      synchronize_irq - wait for pending IRQ handlers (on other CPUs)
  *      @irq: interrupt number to wait for
@@ -30,7 +41,7 @@
 void synchronize_irq(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
-        unsigned int status;
+        unsigned int state;
 
         if (!desc)
                 return;
@@ -42,16 +53,16 @@ void synchronize_irq(unsigned int irq)
                  * Wait until we're out of the critical section.  This might
                  * give the wrong answer due to the lack of memory barriers.
                  */
-                while (desc->status & IRQ_INPROGRESS)
+                while (desc->istate & IRQS_INPROGRESS)
                         cpu_relax();
 
                 /* Ok, that indicated we're done: double-check carefully. */
                 raw_spin_lock_irqsave(&desc->lock, flags);
-                status = desc->status;
+                state = desc->istate;
                 raw_spin_unlock_irqrestore(&desc->lock, flags);
 
                 /* Oops, that failed? */
-        } while (status & IRQ_INPROGRESS);
+        } while (state & IRQS_INPROGRESS);
 
         /*
          * We made sure that no hardirq handler is running. Now verify
@@ -73,8 +84,8 @@ int irq_can_set_affinity(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
 
-        if (CHECK_IRQ_PER_CPU(desc->status) || !desc->irq_data.chip ||
-            !desc->irq_data.chip->irq_set_affinity)
+        if (!desc || !irqd_can_balance(&desc->irq_data) ||
+            !desc->irq_data.chip || !desc->irq_data.chip->irq_set_affinity)
                 return 0;
 
         return 1;
@@ -100,67 +111,169 @@ void irq_set_thread_affinity(struct irq_desc *desc)
         }
 }
 
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+static inline bool irq_can_move_pcntxt(struct irq_desc *desc)
+{
+        return irq_settings_can_move_pcntxt(desc);
+}
+static inline bool irq_move_pending(struct irq_desc *desc)
+{
+        return irqd_is_setaffinity_pending(&desc->irq_data);
+}
+static inline void
+irq_copy_pending(struct irq_desc *desc, const struct cpumask *mask)
+{
+        cpumask_copy(desc->pending_mask, mask);
+}
+static inline void
+irq_get_pending(struct cpumask *mask, struct irq_desc *desc)
+{
+        cpumask_copy(mask, desc->pending_mask);
+}
+#else
+static inline bool irq_can_move_pcntxt(struct irq_desc *desc) { return true; }
+static inline bool irq_move_pending(struct irq_desc *desc) { return false; }
+static inline void
+irq_copy_pending(struct irq_desc *desc, const struct cpumask *mask) { }
+static inline void
+irq_get_pending(struct cpumask *mask, struct irq_desc *desc) { }
+#endif
+
 /**
  *      irq_set_affinity - Set the irq affinity of a given irq
  *      @irq:           Interrupt to set affinity
  *      @cpumask:       cpumask
  *
  */
-int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
+int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         struct irq_chip *chip = desc->irq_data.chip;
         unsigned long flags;
+        int ret = 0;
 
         if (!chip->irq_set_affinity)
                 return -EINVAL;
 
         raw_spin_lock_irqsave(&desc->lock, flags);
 
-#ifdef CONFIG_GENERIC_PENDING_IRQ
-        if (desc->status & IRQ_MOVE_PCNTXT) {
-                if (!chip->irq_set_affinity(&desc->irq_data, cpumask, false)) {
-                        cpumask_copy(desc->irq_data.affinity, cpumask);
+        if (irq_can_move_pcntxt(desc)) {
+                ret = chip->irq_set_affinity(&desc->irq_data, mask, false);
+                switch (ret) {
+                case IRQ_SET_MASK_OK:
+                        cpumask_copy(desc->irq_data.affinity, mask);
+                case IRQ_SET_MASK_OK_NOCOPY:
                         irq_set_thread_affinity(desc);
+                        ret = 0;
                 }
+        } else {
+                irqd_set_move_pending(&desc->irq_data);
+                irq_copy_pending(desc, mask);
         }
-        else {
-                desc->status |= IRQ_MOVE_PENDING;
-                cpumask_copy(desc->pending_mask, cpumask);
-        }
-#else
-        if (!chip->irq_set_affinity(&desc->irq_data, cpumask, false)) {
-                cpumask_copy(desc->irq_data.affinity, cpumask);
-                irq_set_thread_affinity(desc);
+
+        if (desc->affinity_notify) {
+                kref_get(&desc->affinity_notify->kref);
+                schedule_work(&desc->affinity_notify->work);
         }
-#endif
-        desc->status |= IRQ_AFFINITY_SET;
+        irq_compat_set_affinity(desc);
+        irqd_set(&desc->irq_data, IRQD_AFFINITY_SET);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
-        return 0;
+        return ret;
 }
 
 int irq_set_affinity_hint(unsigned int irq, const struct cpumask *m)
 {
+        unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
+
+        if (!desc)
+                return -EINVAL;
+        desc->affinity_hint = m;
+        irq_put_desc_unlock(desc, flags);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(irq_set_affinity_hint);
+
+static void irq_affinity_notify(struct work_struct *work)
+{
+        struct irq_affinity_notify *notify =
+                container_of(work, struct irq_affinity_notify, work);
+        struct irq_desc *desc = irq_to_desc(notify->irq);
+        cpumask_var_t cpumask;
+        unsigned long flags;
+
+        if (!desc || !alloc_cpumask_var(&cpumask, GFP_KERNEL))
+                goto out;
+
+        raw_spin_lock_irqsave(&desc->lock, flags);
+        if (irq_move_pending(desc))
+                irq_get_pending(cpumask, desc);
+        else
+                cpumask_copy(cpumask, desc->irq_data.affinity);
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+
+        notify->notify(notify, cpumask);
+
+        free_cpumask_var(cpumask);
+out:
+        kref_put(&notify->kref, notify->release);
+}
+
+/**
+ *      irq_set_affinity_notifier - control notification of IRQ affinity changes
+ *      @irq:           Interrupt for which to enable/disable notification
+ *      @notify:        Context for notification, or %NULL to disable
+ *                      notification.  Function pointers must be initialised;
+ *                      the other fields will be initialised by this function.
+ *
+ *      Must be called in process context.  Notification may only be enabled
+ *      after the IRQ is allocated and must be disabled before the IRQ is
+ *      freed using free_irq().
+ */
+int
+irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
+{
         struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_affinity_notify *old_notify;
         unsigned long flags;
 
+        /* The release function is promised process context */
+        might_sleep();
+
         if (!desc)
                 return -EINVAL;
 
+        /* Complete initialisation of *notify */
+        if (notify) {
+                notify->irq = irq;
+                kref_init(&notify->kref);
+                INIT_WORK(&notify->work, irq_affinity_notify);
+        }
+
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc->affinity_hint = m;
+        old_notify = desc->affinity_notify;
+        desc->affinity_notify = notify;
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 
+        if (old_notify)
+                kref_put(&old_notify->kref, old_notify->release);
+
         return 0;
 }
-EXPORT_SYMBOL_GPL(irq_set_affinity_hint);
+EXPORT_SYMBOL_GPL(irq_set_affinity_notifier);
 
 #ifndef CONFIG_AUTO_IRQ_AFFINITY
 /*
  * Generic version of the affinity autoselector.
  */
-static int setup_affinity(unsigned int irq, struct irq_desc *desc)
+static int
+setup_affinity(unsigned int irq, struct irq_desc *desc, struct cpumask *mask)
 {
+        struct irq_chip *chip = irq_desc_get_chip(desc);
+        struct cpumask *set = irq_default_affinity;
+        int ret;
+
+        /* Excludes PER_CPU and NO_BALANCE interrupts */
         if (!irq_can_set_affinity(irq))
                 return 0;
 
@@ -168,22 +281,29 @@ static int setup_affinity(unsigned int irq, struct irq_desc *desc)
          * Preserve an userspace affinity setup, but make sure that
          * one of the targets is online.
          */
-        if (desc->status & (IRQ_AFFINITY_SET | IRQ_NO_BALANCING)) {
-                if (cpumask_any_and(desc->irq_data.affinity, cpu_online_mask)
-                    < nr_cpu_ids)
-                        goto set_affinity;
-                else
-                        desc->status &= ~IRQ_AFFINITY_SET;
+        if (irqd_has_set(&desc->irq_data, IRQD_AFFINITY_SET)) {
+                if (cpumask_intersects(desc->irq_data.affinity,
+                                       cpu_online_mask))
+                        set = desc->irq_data.affinity;
+                else {
+                        irq_compat_clr_affinity(desc);
+                        irqd_clear(&desc->irq_data, IRQD_AFFINITY_SET);
+                }
         }
 
-        cpumask_and(desc->irq_data.affinity, cpu_online_mask, irq_default_affinity);
-set_affinity:
-        desc->irq_data.chip->irq_set_affinity(&desc->irq_data, desc->irq_data.affinity, false);
-
+        cpumask_and(mask, cpu_online_mask, set);
+        ret = chip->irq_set_affinity(&desc->irq_data, mask, false);
+        switch (ret) {
+        case IRQ_SET_MASK_OK:
+                cpumask_copy(desc->irq_data.affinity, mask);
+        case IRQ_SET_MASK_OK_NOCOPY:
+                irq_set_thread_affinity(desc);
+        }
         return 0;
 }
 #else
-static inline int setup_affinity(unsigned int irq, struct irq_desc *d)
+static inline int
+setup_affinity(unsigned int irq, struct irq_desc *d, struct cpumask *mask)
 {
         return irq_select_affinity(irq);
 }
@@ -192,23 +312,21 @@ static inline int setup_affinity(unsigned int irq, struct irq_desc *d)
 /*
  * Called when affinity is set via /proc/irq
  */
-int irq_select_affinity_usr(unsigned int irq)
+int irq_select_affinity_usr(unsigned int irq, struct cpumask *mask)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
         int ret;
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        ret = setup_affinity(irq, desc);
-        if (!ret)
-                irq_set_thread_affinity(desc);
+        ret = setup_affinity(irq, desc, mask);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
-
         return ret;
 }
 
 #else
-static inline int setup_affinity(unsigned int irq, struct irq_desc *desc)
+static inline int
+setup_affinity(unsigned int irq, struct irq_desc *desc, struct cpumask *mask)
 {
         return 0;
 }
@@ -219,13 +337,23 @@ void __disable_irq(struct irq_desc *desc, unsigned int irq, bool suspend)
         if (suspend) {
                 if (!desc->action || (desc->action->flags & IRQF_NO_SUSPEND))
                         return;
-                desc->status |= IRQ_SUSPENDED;
+                desc->istate |= IRQS_SUSPENDED;
         }
 
-        if (!desc->depth++) {
-                desc->status |= IRQ_DISABLED;
-                desc->irq_data.chip->irq_disable(&desc->irq_data);
-        }
+        if (!desc->depth++)
+                irq_disable(desc);
+}
+
+static int __disable_irq_nosync(unsigned int irq)
+{
+        unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
+
+        if (!desc)
+                return -EINVAL;
+        __disable_irq(desc, irq, false);
+        irq_put_desc_busunlock(desc, flags);
+        return 0;
 }
 
 /**
@@ -241,17 +369,7 @@ void __disable_irq(struct irq_desc *desc, unsigned int irq, bool suspend)
  */
 void disable_irq_nosync(unsigned int irq)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
-        unsigned long flags;
-
-        if (!desc)
-                return;
-
-        chip_bus_lock(desc);
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        __disable_irq(desc, irq, false);
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(desc);
+        __disable_irq_nosync(irq);
 }
 EXPORT_SYMBOL(disable_irq_nosync);
 
@@ -269,21 +387,24 @@ EXPORT_SYMBOL(disable_irq_nosync);
  */
 void disable_irq(unsigned int irq)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
-
-        if (!desc)
-                return;
-
-        disable_irq_nosync(irq);
-        if (desc->action)
+        if (!__disable_irq_nosync(irq))
                 synchronize_irq(irq);
 }
 EXPORT_SYMBOL(disable_irq);
 
 void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume)
 {
-        if (resume)
-                desc->status &= ~IRQ_SUSPENDED;
+        if (resume) {
+                if (!(desc->istate & IRQS_SUSPENDED)) {
+                        if (!desc->action)
+                                return;
+                        if (!(desc->action->flags & IRQF_FORCE_RESUME))
+                                return;
+                        /* Pretend that it got disabled ! */
+                        desc->depth++;
+                }
+                desc->istate &= ~IRQS_SUSPENDED;
+        }
 
         switch (desc->depth) {
         case 0:
@@ -291,12 +412,11 @@ void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume)
                 WARN(1, KERN_WARNING "Unbalanced enable for IRQ %d\n", irq);
                 break;
         case 1: {
-                unsigned int status = desc->status & ~IRQ_DISABLED;
-
-                if (desc->status & IRQ_SUSPENDED)
+                if (desc->istate & IRQS_SUSPENDED)
                         goto err_out;
                 /* Prevent probing on this irq: */
-                desc->status = status | IRQ_NOPROBE;
+                irq_settings_set_noprobe(desc);
+                irq_enable(desc);
                 check_irq_resend(desc, irq);
                 /* fall-through */
         }
@@ -318,21 +438,18 @@ void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume)
  */
 void enable_irq(unsigned int irq)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
 
         if (!desc)
                 return;
+        if (WARN(!desc->irq_data.chip,
+                 KERN_ERR "enable_irq before setup/request_irq: irq %u\n", irq))
+                goto out;
 
-        if (WARN(!desc->irq_data.chip || !desc->irq_data.chip->irq_enable,
-            KERN_ERR "enable_irq before setup/request_irq: irq %u\n", irq))
-                return;
-
-        chip_bus_lock(desc);
-        raw_spin_lock_irqsave(&desc->lock, flags);
         __enable_irq(desc, irq, false);
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(desc);
+out:
+        irq_put_desc_busunlock(desc, flags);
 }
 EXPORT_SYMBOL(enable_irq);
 
@@ -348,7 +465,7 @@ static int set_irq_wake_real(unsigned int irq, unsigned int on)
 }
 
 /**
- *      set_irq_wake - control irq power management wakeup
+ *      irq_set_irq_wake - control irq power management wakeup
  *      @irq:   interrupt to control
  *      @on:    enable/disable power management wakeup
  *
@@ -359,23 +476,22 @@ static int set_irq_wake_real(unsigned int irq, unsigned int on)
  *      Wakeup mode lets this IRQ wake the system from sleep
  *      states like "suspend to RAM".
  */
-int set_irq_wake(unsigned int irq, unsigned int on)
+int irq_set_irq_wake(unsigned int irq, unsigned int on)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
         int ret = 0;
 
         /* wakeup-capable irqs can be shared between drivers that
          * don't need to have the same sleep mode behaviors.
          */
-        raw_spin_lock_irqsave(&desc->lock, flags);
         if (on) {
                 if (desc->wake_depth++ == 0) {
                         ret = set_irq_wake_real(irq, on);
                         if (ret)
                                 desc->wake_depth = 0;
                         else
-                                desc->status |= IRQ_WAKEUP;
+                                irqd_set(&desc->irq_data, IRQD_WAKEUP_STATE);
                 }
         } else {
                 if (desc->wake_depth == 0) {
@@ -385,14 +501,13 @@ int set_irq_wake(unsigned int irq, unsigned int on)
                         if (ret)
                                 desc->wake_depth = 1;
                         else
-                                desc->status &= ~IRQ_WAKEUP;
+                                irqd_clear(&desc->irq_data, IRQD_WAKEUP_STATE);
                 }
         }
-
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        irq_put_desc_busunlock(desc, flags);
         return ret;
 }
-EXPORT_SYMBOL(set_irq_wake);
+EXPORT_SYMBOL(irq_set_irq_wake);
 
 /*
  * Internal function that tells the architecture code whether a
@@ -401,43 +516,27 @@ EXPORT_SYMBOL(set_irq_wake);
  */
 int can_request_irq(unsigned int irq, unsigned long irqflags)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
-        struct irqaction *action;
         unsigned long flags;
+        struct irq_desc *desc = irq_get_desc_lock(irq, &flags);
+        int canrequest = 0;
 
         if (!desc)
                 return 0;
 
-        if (desc->status & IRQ_NOREQUEST)
-                return 0;
-
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        action = desc->action;
-        if (action)
-                if (irqflags & action->flags & IRQF_SHARED)
-                        action = NULL;
-
-        raw_spin_unlock_irqrestore(&desc->lock, flags);
-
-        return !action;
-}
-
-void compat_irq_chip_set_default_handler(struct irq_desc *desc)
-{
-        /*
-         * If the architecture still has not overriden
-         * the flow handler then zap the default. This
-         * should catch incorrect flow-type setting.
-         */
-        if (desc->handle_irq == &handle_bad_irq)
-                desc->handle_irq = NULL;
+        if (irq_settings_can_request(desc)) {
+                if (desc->action)
+                        if (irqflags & desc->action->flags & IRQF_SHARED)
+                                canrequest =1;
+        }
+        irq_put_desc_unlock(desc, flags);
+        return canrequest;
 }
 
 int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
                       unsigned long flags)
 {
-        int ret;
         struct irq_chip *chip = desc->irq_data.chip;
+        int ret, unmask = 0;
 
         if (!chip || !chip->irq_set_type) {
                 /*
@@ -449,23 +548,43 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
                 return 0;
         }
 
+        flags &= IRQ_TYPE_SENSE_MASK;
+
+        if (chip->flags & IRQCHIP_SET_TYPE_MASKED) {
+                if (!(desc->istate & IRQS_MASKED))
+                        mask_irq(desc);
+                if (!(desc->istate & IRQS_DISABLED))
+                        unmask = 1;
+        }
+
         /* caller masked out all except trigger mode flags */
         ret = chip->irq_set_type(&desc->irq_data, flags);
 
-        if (ret)
-                pr_err("setting trigger mode %lu for irq %u failed (%pF)\n",
-                       flags, irq, chip->irq_set_type);
-        else {
-                if (flags & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
-                        flags |= IRQ_LEVEL;
-                /* note that IRQF_TRIGGER_MASK == IRQ_TYPE_SENSE_MASK */
-                desc->status &= ~(IRQ_LEVEL | IRQ_TYPE_SENSE_MASK);
-                desc->status |= flags;
+        switch (ret) {
+        case IRQ_SET_MASK_OK:
+                irqd_clear(&desc->irq_data, IRQD_TRIGGER_MASK);
+                irqd_set(&desc->irq_data, flags);
+
+        case IRQ_SET_MASK_OK_NOCOPY:
+                flags = irqd_get_trigger_type(&desc->irq_data);
+                irq_settings_set_trigger_mask(desc, flags);
+                irqd_clear(&desc->irq_data, IRQD_LEVEL);
+                irq_settings_clr_level(desc);
+                if (flags & IRQ_TYPE_LEVEL_MASK) {
+                        irq_settings_set_level(desc);
+                        irqd_set(&desc->irq_data, IRQD_LEVEL);
+                }
 
                 if (chip != desc->irq_data.chip)
                         irq_chip_set_defaults(desc->irq_data.chip);
+                ret = 0;
+                break;
+        default:
+                pr_err("setting trigger mode %lu for irq %u failed (%pF)\n",
+                       flags, irq, chip->irq_set_type);
         }
-
+        if (unmask)
+                unmask_irq(desc);
         return ret;
 }
 
@@ -509,8 +628,11 @@ static int irq_wait_for_interrupt(struct irqaction *action)
  * handler finished. unmask if the interrupt has not been disabled and
  * is marked MASKED.
  */
-static void irq_finalize_oneshot(unsigned int irq, struct irq_desc *desc)
+static void irq_finalize_oneshot(struct irq_desc *desc,
+                                 struct irqaction *action, bool force)
 {
+        if (!(desc->istate & IRQS_ONESHOT))
+                return;
 again:
         chip_bus_lock(desc);
         raw_spin_lock_irq(&desc->lock);
@@ -522,26 +644,44 @@ again:
          * The thread is faster done than the hard interrupt handler
          * on the other CPU. If we unmask the irq line then the
          * interrupt can come in again and masks the line, leaves due
-         * to IRQ_INPROGRESS and the irq line is masked forever.
+         * to IRQS_INPROGRESS and the irq line is masked forever.
+         *
+         * This also serializes the state of shared oneshot handlers
+         * versus "desc->threads_onehsot |= action->thread_mask;" in
+         * irq_wake_thread(). See the comment there which explains the
+         * serialization.
          */
-        if (unlikely(desc->status & IRQ_INPROGRESS)) {
+        if (unlikely(desc->istate & IRQS_INPROGRESS)) {
                 raw_spin_unlock_irq(&desc->lock);
                 chip_bus_sync_unlock(desc);
                 cpu_relax();
                 goto again;
         }
 
-        if (!(desc->status & IRQ_DISABLED) && (desc->status & IRQ_MASKED)) {
-                desc->status &= ~IRQ_MASKED;
+        /*
+         * Now check again, whether the thread should run. Otherwise
+         * we would clear the threads_oneshot bit of this thread which
+         * was just set.
+         */
+        if (!force && test_bit(IRQTF_RUNTHREAD, &action->thread_flags))
+                goto out_unlock;
+
+        desc->threads_oneshot &= ~action->thread_mask;
+
+        if (!desc->threads_oneshot && !(desc->istate & IRQS_DISABLED) &&
+            (desc->istate & IRQS_MASKED)) {
+                irq_compat_clr_masked(desc);
+                desc->istate &= ~IRQS_MASKED;
                 desc->irq_data.chip->irq_unmask(&desc->irq_data);
         }
+out_unlock:
         raw_spin_unlock_irq(&desc->lock);
         chip_bus_sync_unlock(desc);
 }
 
 #ifdef CONFIG_SMP
 /*
- * Check whether we need to change the affinity of the interrupt thread.
+ * Check whether we need to chasnge the affinity of the interrupt thread.
  */
 static void
 irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
@@ -573,16 +713,49 @@ irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action) { }
 #endif
 
 /*
+ * Interrupts which are not explicitely requested as threaded
+ * interrupts rely on the implicit bh/preempt disable of the hard irq
+ * context. So we need to disable bh here to avoid deadlocks and other
+ * side effects.
+ */
+static void
+irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action)
+{
+        local_bh_disable();
+        action->thread_fn(action->irq, action->dev_id);
+        irq_finalize_oneshot(desc, action, false);
+        local_bh_enable();
+}
+
+/*
+ * Interrupts explicitely requested as threaded interupts want to be
+ * preemtible - many of them need to sleep and wait for slow busses to
+ * complete.
+ */
+static void irq_thread_fn(struct irq_desc *desc, struct irqaction *action)
+{
+        action->thread_fn(action->irq, action->dev_id);
+        irq_finalize_oneshot(desc, action, false);
+}
+
+/*
  * Interrupt handler thread
  */
 static int irq_thread(void *data)
 {
-        static struct sched_param param = {
+        static const struct sched_param param = {
                 .sched_priority = MAX_USER_RT_PRIO/2,
         };
         struct irqaction *action = data;
         struct irq_desc *desc = irq_to_desc(action->irq);
-        int wake, oneshot = desc->status & IRQ_ONESHOT;
+        void (*handler_fn)(struct irq_desc *desc, struct irqaction *action);
+        int wake;
+
+        if (force_irqthreads & test_bit(IRQTF_FORCED_THREAD,
+                                        &action->thread_flags))
+                handler_fn = irq_forced_thread_fn;
+        else
+                handler_fn = irq_thread_fn;
 
         sched_setscheduler(current, SCHED_FIFO, &param);
         current->irqaction = action;
@@ -594,23 +767,20 @@ static int irq_thread(void *data)
                 atomic_inc(&desc->threads_active);
 
                 raw_spin_lock_irq(&desc->lock);
-                if (unlikely(desc->status & IRQ_DISABLED)) {
+                if (unlikely(desc->istate & IRQS_DISABLED)) {
                         /*
                          * CHECKME: We might need a dedicated
                          * IRQ_THREAD_PENDING flag here, which
                          * retriggers the thread in check_irq_resend()
-                         * but AFAICT IRQ_PENDING should be fine as it
+                         * but AFAICT IRQS_PENDING should be fine as it
                          * retriggers the interrupt itself --- tglx
                          */
-                        desc->status |= IRQ_PENDING;
+                        irq_compat_set_pending(desc);
+                        desc->istate |= IRQS_PENDING;
                         raw_spin_unlock_irq(&desc->lock);
                 } else {
                         raw_spin_unlock_irq(&desc->lock);
-
-                        action->thread_fn(action->irq, action->dev_id);
-
-                        if (oneshot)
-                                irq_finalize_oneshot(action->irq, desc);
+                        handler_fn(desc, action);
                 }
 
                 wake = atomic_dec_and_test(&desc->threads_active);
@@ -619,6 +789,9 @@ static int irq_thread(void *data)
                         wake_up(&desc->wait_for_threads);
         }
 
+        /* Prevent a stale desc->threads_oneshot */
+        irq_finalize_oneshot(desc, action, true);
+
         /*
          * Clear irqaction. Otherwise exit_irq_thread() would make
          * fuzz about an active irq thread going into nirvana.
@@ -633,6 +806,7 @@ static int irq_thread(void *data)
 void exit_irq_thread(void)
 {
         struct task_struct *tsk = current;
+        struct irq_desc *desc;
 
         if (!tsk->irqaction)
                 return;
@@ -641,6 +815,14 @@ void exit_irq_thread(void)
                "exiting task \"%s\" (%d) is an active IRQ thread (irq %d)\n",
                tsk->comm ? tsk->comm : "", tsk->pid, tsk->irqaction->irq);
 
+        desc = irq_to_desc(tsk->irqaction->irq);
+
+        /*
+         * Prevent a stale desc->threads_oneshot. Must be called
+         * before setting the IRQTF_DIED flag.
+         */
+        irq_finalize_oneshot(desc, tsk->irqaction, true);
+
         /*
          * Set the THREAD DIED flag to prevent further wakeups of the
          * soon to be gone threaded handler.
@@ -648,6 +830,22 @@ void exit_irq_thread(void)
         set_bit(IRQTF_DIED, &tsk->irqaction->flags);
 }
 
+static void irq_setup_forced_threading(struct irqaction *new)
+{
+        if (!force_irqthreads)
+                return;
+        if (new->flags & (IRQF_NO_THREAD | IRQF_PERCPU | IRQF_ONESHOT))
+                return;
+
+        new->flags |= IRQF_ONESHOT;
+
+        if (!new->thread_fn) {
+                set_bit(IRQTF_FORCED_THREAD, &new->thread_flags);
+                new->thread_fn = new->handler;
+                new->handler = irq_default_primary_handler;
+        }
+}
+
 /*
  * Internal function to register an irqaction - typically used to
  * allocate special interrupts that are part of the architecture.
@@ -657,9 +855,9 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 {
         struct irqaction *old, **old_ptr;
         const char *old_name = NULL;
-        unsigned long flags;
-        int nested, shared = 0;
-        int ret;
+        unsigned long flags, thread_mask = 0;
+        int ret, nested, shared = 0;
+        cpumask_var_t mask;
 
         if (!desc)
                 return -EINVAL;
@@ -683,15 +881,11 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                 rand_initialize_irq(irq);
         }
 
-        /* Oneshot interrupts are not allowed with shared */
-        if ((new->flags & IRQF_ONESHOT) && (new->flags & IRQF_SHARED))
-                return -EINVAL;
-
         /*
          * Check whether the interrupt nests into another interrupt
          * thread.
          */
-        nested = desc->status & IRQ_NESTED_THREAD;
+        nested = irq_settings_is_nested_thread(desc);
         if (nested) {
                 if (!new->thread_fn)
                         return -EINVAL;
@@ -701,6 +895,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                  * dummy function which warns when called.
                  */
                 new->handler = irq_nested_primary_handler;
+        } else {
+                irq_setup_forced_threading(new);
         }
 
         /*
@@ -724,6 +920,11 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                 new->thread = t;
         }
 
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
+                ret = -ENOMEM;
+                goto out_thread;
+        }
+
         /*
          * The following block of code has to be executed atomically
          */
@@ -735,29 +936,40 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                  * Can't share interrupts unless both agree to and are
                  * the same type (level, edge, polarity). So both flag
                  * fields must have IRQF_SHARED set and the bits which
-                 * set the trigger type must match.
+                 * set the trigger type must match. Also all must
+                 * agree on ONESHOT.
                  */
                 if (!((old->flags & new->flags) & IRQF_SHARED) ||
-                    ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK)) {
+                    ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK) ||
+                    ((old->flags ^ new->flags) & IRQF_ONESHOT)) {
                         old_name = old->name;
                         goto mismatch;
                 }
 
-#if defined(CONFIG_IRQ_PER_CPU)
                 /* All handlers must agree on per-cpuness */
                 if ((old->flags & IRQF_PERCPU) !=
                     (new->flags & IRQF_PERCPU))
                         goto mismatch;
-#endif
 
                 /* add new interrupt at end of irq queue */
                 do {
+                        thread_mask |= old->thread_mask;
                         old_ptr = &old->next;
                         old = *old_ptr;
                 } while (old);
                 shared = 1;
         }
 
+        /*
+         * Setup the thread mask for this irqaction. Unlikely to have
+         * 32 resp 64 irqs sharing one line, but who knows.
+         */
+        if (new->flags & IRQF_ONESHOT && thread_mask == ~0UL) {
+                ret = -EBUSY;
+                goto out_mask;
+        }
+        new->thread_mask = 1 << ffz(thread_mask);
+
         if (!shared) {
                 irq_chip_set_defaults(desc->irq_data.chip);
 
@@ -769,42 +981,44 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                                         new->flags & IRQF_TRIGGER_MASK);
 
                         if (ret)
-                                goto out_thread;
-                } else
-                        compat_irq_chip_set_default_handler(desc);
-#if defined(CONFIG_IRQ_PER_CPU)
-                if (new->flags & IRQF_PERCPU)
-                        desc->status |= IRQ_PER_CPU;
-#endif
+                                goto out_mask;
+                }
 
-                desc->status &= ~(IRQ_AUTODETECT | IRQ_WAITING | IRQ_ONESHOT |
-                                  IRQ_INPROGRESS | IRQ_SPURIOUS_DISABLED);
+                desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \
+                                  IRQS_INPROGRESS | IRQS_ONESHOT | \
+                                  IRQS_WAITING);
+
+                if (new->flags & IRQF_PERCPU) {
+                        irqd_set(&desc->irq_data, IRQD_PER_CPU);
+                        irq_settings_set_per_cpu(desc);
+                }
 
                 if (new->flags & IRQF_ONESHOT)
-                        desc->status |= IRQ_ONESHOT;
+                        desc->istate |= IRQS_ONESHOT;
 
-                if (!(desc->status & IRQ_NOAUTOEN)) {
-                        desc->depth = 0;
-                        desc->status &= ~IRQ_DISABLED;
-                        desc->irq_data.chip->irq_startup(&desc->irq_data);
-                } else
+                if (irq_settings_can_autoenable(desc))
+                        irq_startup(desc);
+                else
                         /* Undo nested disables: */
                         desc->depth = 1;
 
                 /* Exclude IRQ from balancing if requested */
-                if (new->flags & IRQF_NOBALANCING)
-                        desc->status |= IRQ_NO_BALANCING;
+                if (new->flags & IRQF_NOBALANCING) {
+                        irq_settings_set_no_balancing(desc);
+                        irqd_set(&desc->irq_data, IRQD_NO_BALANCING);
+                }
 
                 /* Set default affinity mask once everything is setup */
-                setup_affinity(irq, desc);
-
-        } else if ((new->flags & IRQF_TRIGGER_MASK)
-                        && (new->flags & IRQF_TRIGGER_MASK)
-                                != (desc->status & IRQ_TYPE_SENSE_MASK)) {
-                /* hope the handler works with the actual trigger mode... */
-                pr_warning("IRQ %d uses trigger mode %d; requested %d\n",
-                                irq, (int)(desc->status & IRQ_TYPE_SENSE_MASK),
-                                (int)(new->flags & IRQF_TRIGGER_MASK));
+                setup_affinity(irq, desc, mask);
+
+        } else if (new->flags & IRQF_TRIGGER_MASK) {
+                unsigned int nmsk = new->flags & IRQF_TRIGGER_MASK;
+                unsigned int omsk = irq_settings_get_trigger_mask(desc);
+
+                if (nmsk != omsk)
+                        /* hope the handler works with current  trigger mode */
+                        pr_warning("IRQ %d uses trigger mode %u; requested %u\n",
+                                   irq, nmsk, omsk);
         }
 
         new->irq = irq;
@@ -818,8 +1032,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
          * Check whether we disabled the irq via the spurious handler
          * before. Reenable it and give it another chance.
          */
-        if (shared && (desc->status & IRQ_SPURIOUS_DISABLED)) {
-                desc->status &= ~IRQ_SPURIOUS_DISABLED;
+        if (shared && (desc->istate & IRQS_SPURIOUS_DISABLED)) {
+                desc->istate &= ~IRQS_SPURIOUS_DISABLED;
                 __enable_irq(desc, irq, false);
         }
 
@@ -849,6 +1063,9 @@ mismatch:
 #endif
         ret = -EBUSY;
 
+out_mask:
+        free_cpumask_var(mask);
+
 out_thread:
         raw_spin_unlock_irqrestore(&desc->lock, flags);
         if (new->thread) {
@@ -871,9 +1088,14 @@ out_thread:
  */
 int setup_irq(unsigned int irq, struct irqaction *act)
 {
+        int retval;
         struct irq_desc *desc = irq_to_desc(irq);
 
-        return __setup_irq(irq, desc, act);
+        chip_bus_lock(desc);
+        retval = __setup_irq(irq, desc, act);
+        chip_bus_sync_unlock(desc);
+
+        return retval;
 }
 EXPORT_SYMBOL_GPL(setup_irq);
 
@@ -924,13 +1146,8 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 #endif
 
         /* If this was the last handler, shut down the IRQ line: */
-        if (!desc->action) {
-                desc->status |= IRQ_DISABLED;
-                if (desc->irq_data.chip->irq_shutdown)
-                        desc->irq_data.chip->irq_shutdown(&desc->irq_data);
-                else
-                        desc->irq_data.chip->irq_disable(&desc->irq_data);
-        }
+        if (!desc->action)
+                irq_shutdown(desc);
 
 #ifdef CONFIG_SMP
         /* make sure affinity_hint is cleaned up */
@@ -1004,6 +1221,11 @@ void free_irq(unsigned int irq, void *dev_id)
         if (!desc)
                 return;
 
+#ifdef CONFIG_SMP
+        if (WARN_ON(desc->affinity_notify))
+                desc->affinity_notify = NULL;
+#endif
+
         chip_bus_lock(desc);
         kfree(__free_irq(irq, dev_id));
         chip_bus_sync_unlock(desc);
@@ -1074,7 +1296,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
         if (!desc)
                 return -EINVAL;
 
-        if (desc->status & IRQ_NOREQUEST)
+        if (!irq_settings_can_request(desc))
                 return -EINVAL;
 
         if (!handler) {
@@ -1100,7 +1322,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
         if (retval)
                 kfree(action);
 
-#ifdef CONFIG_DEBUG_SHIRQ
+#ifdef CONFIG_DEBUG_SHIRQ_FIXME
         if (!retval && (irqflags & IRQF_SHARED)) {
                 /*
                  * It's a shared IRQ -- the driver ought to be prepared for it
@@ -1149,7 +1371,7 @@ int request_any_context_irq(unsigned int irq, irq_handler_t handler,
         if (!desc)
                 return -EINVAL;
 
-        if (desc->status & IRQ_NESTED_THREAD) {
+        if (irq_settings_is_nested_thread(desc)) {
                 ret = request_threaded_irq(irq, NULL, handler,
                                            flags, name, dev_id);
                 return !ret ? IRQC_IS_NESTED : ret;
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index 1d2541940480..ec4806d4778b 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -4,23 +4,23 @@
 
 #include "internals.h"
 
-void move_masked_irq(int irq)
+void irq_move_masked_irq(struct irq_data *idata)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
-        struct irq_chip *chip = desc->irq_data.chip;
+        struct irq_desc *desc = irq_data_to_desc(idata);
+        struct irq_chip *chip = idata->chip;
 
-        if (likely(!(desc->status & IRQ_MOVE_PENDING)))
+        if (likely(!irqd_is_setaffinity_pending(&desc->irq_data)))
                 return;
 
         /*
          * Paranoia: cpu-local interrupts shouldn't be calling in here anyway.
          */
-        if (CHECK_IRQ_PER_CPU(desc->status)) {
+        if (!irqd_can_balance(&desc->irq_data)) {
                 WARN_ON(1);
                 return;
         }
 
-        desc->status &= ~IRQ_MOVE_PENDING;
+        irqd_clr_move_pending(&desc->irq_data);
 
         if (unlikely(cpumask_empty(desc->pending_mask)))
                 return;
@@ -53,18 +53,36 @@ void move_masked_irq(int irq)
         cpumask_clear(desc->pending_mask);
 }
 
-void move_native_irq(int irq)
+void move_masked_irq(int irq)
+{
+        irq_move_masked_irq(irq_get_irq_data(irq));
+}
+
+void irq_move_irq(struct irq_data *idata)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct irq_desc *desc = irq_data_to_desc(idata);
+        bool masked;
 
-        if (likely(!(desc->status & IRQ_MOVE_PENDING)))
+        if (likely(!irqd_is_setaffinity_pending(idata)))
                 return;
 
-        if (unlikely(desc->status & IRQ_DISABLED))
+        if (unlikely(desc->istate & IRQS_DISABLED))
                 return;
 
-        desc->irq_data.chip->irq_mask(&desc->irq_data);
-        move_masked_irq(irq);
-        desc->irq_data.chip->irq_unmask(&desc->irq_data);
+        /*
+         * Be careful vs. already masked interrupts. If this is a
+         * threaded interrupt with ONESHOT set, we can end up with an
+         * interrupt storm.
+         */
+        masked = desc->istate & IRQS_MASKED;
+        if (!masked)
+                idata->chip->irq_mask(idata);
+        irq_move_masked_irq(idata);
+        if (!masked)
+                idata->chip->irq_unmask(idata);
 }
 
+void move_native_irq(int irq)
+{
+        irq_move_irq(irq_get_irq_data(irq));
+}
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index 0d4005d85b03..f76fc00c9877 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -18,7 +18,7 @@
  * During system-wide suspend or hibernation device drivers need to be prevented
  * from receiving interrupts and this function is provided for this purpose.
  * It marks all interrupt lines in use, except for the timer ones, as disabled
- * and sets the IRQ_SUSPENDED flag for each of them.
+ * and sets the IRQS_SUSPENDED flag for each of them.
  */
 void suspend_device_irqs(void)
 {
@@ -34,7 +34,7 @@ void suspend_device_irqs(void)
         }
 
         for_each_irq_desc(irq, desc)
-                if (desc->status & IRQ_SUSPENDED)
+                if (desc->istate & IRQS_SUSPENDED)
                         synchronize_irq(irq);
 }
 EXPORT_SYMBOL_GPL(suspend_device_irqs);
@@ -43,7 +43,7 @@ EXPORT_SYMBOL_GPL(suspend_device_irqs);
  * resume_device_irqs - enable interrupt lines disabled by suspend_device_irqs()
  *
  * Enable all interrupt lines previously disabled by suspend_device_irqs() that
- * have the IRQ_SUSPENDED flag set.
+ * have the IRQS_SUSPENDED flag set.
  */
 void resume_device_irqs(void)
 {
@@ -53,9 +53,6 @@ void resume_device_irqs(void)
         for_each_irq_desc(irq, desc) {
                 unsigned long flags;
 
-                if (!(desc->status & IRQ_SUSPENDED))
-                        continue;
-
                 raw_spin_lock_irqsave(&desc->lock, flags);
                 __enable_irq(desc, irq, true);
                 raw_spin_unlock_irqrestore(&desc->lock, flags);
@@ -71,9 +68,24 @@ int check_wakeup_irqs(void)
         struct irq_desc *desc;
         int irq;
 
-        for_each_irq_desc(irq, desc)
-                if ((desc->status & IRQ_WAKEUP) && (desc->status & IRQ_PENDING))
-                        return -EBUSY;
+        for_each_irq_desc(irq, desc) {
+                if (irqd_is_wakeup_set(&desc->irq_data)) {
+                        if (desc->istate & IRQS_PENDING)
+                                return -EBUSY;
+                        continue;
+                }
+                /*
+                 * Check the non wakeup interrupts whether they need
+                 * to be masked before finally going into suspend
+                 * state. That's for hardware which has no wakeup
+                 * source configuration facility. The chip
+                 * implementation indicates that with
+                 * IRQCHIP_MASK_ON_SUSPEND.
+                 */
+                if (desc->istate & IRQS_SUSPENDED &&
+                    irq_desc_get_chip(desc)->flags & IRQCHIP_MASK_ON_SUSPEND)
+                        mask_irq(desc);
+        }
 
         return 0;
 }
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 6c8a2a9f8a7b..4cc2e5ed0bec 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -11,6 +11,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/interrupt.h>
+#include <linux/kernel_stat.h>
 
 #include "internals.h"
 
@@ -24,7 +25,7 @@ static int irq_affinity_proc_show(struct seq_file *m, void *v)
         const struct cpumask *mask = desc->irq_data.affinity;
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
-        if (desc->status & IRQ_MOVE_PENDING)
+        if (irqd_is_setaffinity_pending(&desc->irq_data))
                 mask = desc->pending_mask;
 #endif
         seq_cpumask(m, mask);
@@ -65,8 +66,7 @@ static ssize_t irq_affinity_proc_write(struct file *file,
         cpumask_var_t new_value;
         int err;
 
-        if (!irq_to_desc(irq)->irq_data.chip->irq_set_affinity || no_irq_affinity ||
-            irq_balancing_disabled(irq))
+        if (!irq_can_set_affinity(irq) || no_irq_affinity)
                 return -EIO;
 
         if (!alloc_cpumask_var(&new_value, GFP_KERNEL))
@@ -89,7 +89,7 @@ static ssize_t irq_affinity_proc_write(struct file *file,
         if (!cpumask_intersects(new_value, cpu_online_mask)) {
                 /* Special case for empty set - allow the architecture
                    code to set default SMP affinity. */
-                err = irq_select_affinity_usr(irq) ? -EINVAL : count;
+                err = irq_select_affinity_usr(irq, new_value) ? -EINVAL : count;
         } else {
                 irq_set_affinity(irq, new_value);
                 err = count;
@@ -357,3 +357,65 @@ void init_irq_proc(void)
         }
 }
 
+#ifdef CONFIG_GENERIC_IRQ_SHOW
+
+int __weak arch_show_interrupts(struct seq_file *p, int prec)
+{
+        return 0;
+}
+
+int show_interrupts(struct seq_file *p, void *v)
+{
+        static int prec;
+
+        unsigned long flags, any_count = 0;
+        int i = *(loff_t *) v, j;
+        struct irqaction *action;
+        struct irq_desc *desc;
+
+        if (i > nr_irqs)
+                return 0;
+
+        if (i == nr_irqs)
+                return arch_show_interrupts(p, prec);
+
+        /* print header and calculate the width of the first column */
+        if (i == 0) {
+                for (prec = 3, j = 1000; prec < 10 && j <= nr_irqs; ++prec)
+                        j *= 10;
+
+                seq_printf(p, "%*s", prec + 8, "");
+                for_each_online_cpu(j)
+                        seq_printf(p, "CPU%-8d", j);
+                seq_putc(p, '\n');
+        }
+
+        desc = irq_to_desc(i);
+        if (!desc)
+                return 0;
+
+        raw_spin_lock_irqsave(&desc->lock, flags);
+        for_each_online_cpu(j)
+                any_count |= kstat_irqs_cpu(i, j);
+        action = desc->action;
+        if (!action && !any_count)
+                goto out;
+
+        seq_printf(p, "%*d: ", prec, i);
+        for_each_online_cpu(j)
+                seq_printf(p, "%10u ", kstat_irqs_cpu(i, j));
+        seq_printf(p, " %8s", desc->irq_data.chip->name);
+        seq_printf(p, "-%-8s", desc->name);
+
+        if (action) {
+                seq_printf(p, "  %s", action->name);
+                while ((action = action->next) != NULL)
+                        seq_printf(p, ", %s", action->name);
+        }
+
+        seq_putc(p, '\n');
+out:
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        return 0;
+}
+#endif
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index 891115a929aa..ad683a99b1ec 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -23,7 +23,7 @@
 #ifdef CONFIG_HARDIRQS_SW_RESEND
 
 /* Bitmap to handle software resend of interrupts: */
-static DECLARE_BITMAP(irqs_resend, NR_IRQS);
+static DECLARE_BITMAP(irqs_resend, IRQ_BITMAP_BITS);
 
 /*
  * Run software resends of IRQ's
@@ -55,20 +55,19 @@ static DECLARE_TASKLET(resend_tasklet, resend_irqs, 0);
  */
 void check_irq_resend(struct irq_desc *desc, unsigned int irq)
 {
-        unsigned int status = desc->status;
-
-        /*
-         * Make sure the interrupt is enabled, before resending it:
-         */
-        desc->irq_data.chip->irq_enable(&desc->irq_data);
-
         /*
          * We do not resend level type interrupts. Level type
          * interrupts are resent by hardware when they are still
          * active.
          */
-        if ((status & (IRQ_LEVEL | IRQ_PENDING | IRQ_REPLAY)) == IRQ_PENDING) {
-                desc->status = (status & ~IRQ_PENDING) | IRQ_REPLAY;
+        if (irq_settings_is_level(desc))
+                return;
+        if (desc->istate & IRQS_REPLAY)
+                return;
+        if (desc->istate & IRQS_PENDING) {
+                irq_compat_clr_pending(desc);
+                desc->istate &= ~IRQS_PENDING;
+                desc->istate |= IRQS_REPLAY;
 
                 if (!desc->irq_data.chip->irq_retrigger ||
                     !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
diff --git a/kernel/irq/settings.h b/kernel/irq/settings.h
new file mode 100644
index 000000000000..0227ad358272
--- /dev/null
+++ b/kernel/irq/settings.h
@@ -0,0 +1,138 @@
+/*
+ * Internal header to deal with irq_desc->status which will be renamed
+ * to irq_desc->settings.
+ */
+enum {
+        _IRQ_DEFAULT_INIT_FLAGS = IRQ_DEFAULT_INIT_FLAGS,
+        _IRQ_PER_CPU            = IRQ_PER_CPU,
+        _IRQ_LEVEL              = IRQ_LEVEL,
+        _IRQ_NOPROBE            = IRQ_NOPROBE,
+        _IRQ_NOREQUEST          = IRQ_NOREQUEST,
+        _IRQ_NOAUTOEN           = IRQ_NOAUTOEN,
+        _IRQ_MOVE_PCNTXT        = IRQ_MOVE_PCNTXT,
+        _IRQ_NO_BALANCING       = IRQ_NO_BALANCING,
+        _IRQ_NESTED_THREAD      = IRQ_NESTED_THREAD,
+        _IRQF_MODIFY_MASK       = IRQF_MODIFY_MASK,
+};
+
+#define IRQ_INPROGRESS          GOT_YOU_MORON
+#define IRQ_REPLAY              GOT_YOU_MORON
+#define IRQ_WAITING             GOT_YOU_MORON
+#define IRQ_DISABLED            GOT_YOU_MORON
+#define IRQ_PENDING             GOT_YOU_MORON
+#define IRQ_MASKED              GOT_YOU_MORON
+#define IRQ_WAKEUP              GOT_YOU_MORON
+#define IRQ_MOVE_PENDING        GOT_YOU_MORON
+#define IRQ_PER_CPU             GOT_YOU_MORON
+#define IRQ_NO_BALANCING        GOT_YOU_MORON
+#define IRQ_AFFINITY_SET        GOT_YOU_MORON
+#define IRQ_LEVEL               GOT_YOU_MORON
+#define IRQ_NOPROBE             GOT_YOU_MORON
+#define IRQ_NOREQUEST           GOT_YOU_MORON
+#define IRQ_NOAUTOEN            GOT_YOU_MORON
+#define IRQ_NESTED_THREAD       GOT_YOU_MORON
+#undef IRQF_MODIFY_MASK
+#define IRQF_MODIFY_MASK        GOT_YOU_MORON
+
+static inline void
+irq_settings_clr_and_set(struct irq_desc *desc, u32 clr, u32 set)
+{
+        desc->status &= ~(clr & _IRQF_MODIFY_MASK);
+        desc->status |= (set & _IRQF_MODIFY_MASK);
+}
+
+static inline bool irq_settings_is_per_cpu(struct irq_desc *desc)
+{
+        return desc->status & _IRQ_PER_CPU;
+}
+
+static inline void irq_settings_set_per_cpu(struct irq_desc *desc)
+{
+        desc->status |= _IRQ_PER_CPU;
+}
+
+static inline void irq_settings_set_no_balancing(struct irq_desc *desc)
+{
+        desc->status |= _IRQ_NO_BALANCING;
+}
+
+static inline bool irq_settings_has_no_balance_set(struct irq_desc *desc)
+{
+        return desc->status & _IRQ_NO_BALANCING;
+}
+
+static inline u32 irq_settings_get_trigger_mask(struct irq_desc *desc)
+{
+        return desc->status & IRQ_TYPE_SENSE_MASK;
+}
+
+static inline void
+irq_settings_set_trigger_mask(struct irq_desc *desc, u32 mask)
+{
+        desc->status &= ~IRQ_TYPE_SENSE_MASK;
+        desc->status |= mask & IRQ_TYPE_SENSE_MASK;
+}
+
+static inline bool irq_settings_is_level(struct irq_desc *desc)
+{
+        return desc->status & _IRQ_LEVEL;
+}
+
+static inline void irq_settings_clr_level(struct irq_desc *desc)
+{
+        desc->status &= ~_IRQ_LEVEL;
+}
+
+static inline void irq_settings_set_level(struct irq_desc *desc)
+{
+        desc->status |= _IRQ_LEVEL;
+}
+
+static inline bool irq_settings_can_request(struct irq_desc *desc)
+{
+        return !(desc->status & _IRQ_NOREQUEST);
+}
+
+static inline void irq_settings_clr_norequest(struct irq_desc *desc)
+{
+        desc->status &= ~_IRQ_NOREQUEST;
+}
+
+static inline void irq_settings_set_norequest(struct irq_desc *desc)
+{
+        desc->status |= _IRQ_NOREQUEST;
+}
+
+static inline bool irq_settings_can_probe(struct irq_desc *desc)
+{
+        return !(desc->status & _IRQ_NOPROBE);
+}
+
+static inline void irq_settings_clr_noprobe(struct irq_desc *desc)
+{
+        desc->status &= ~_IRQ_NOPROBE;
+}
+
+static inline void irq_settings_set_noprobe(struct irq_desc *desc)
+{
+        desc->status |= _IRQ_NOPROBE;
+}
+
+static inline bool irq_settings_can_move_pcntxt(struct irq_desc *desc)
+{
+        return desc->status & _IRQ_MOVE_PCNTXT;
+}
+
+static inline bool irq_settings_can_autoenable(struct irq_desc *desc)
+{
+        return !(desc->status & _IRQ_NOAUTOEN);
+}
+
+static inline bool irq_settings_is_nested_thread(struct irq_desc *desc)
+{
+        return desc->status & _IRQ_NESTED_THREAD;
+}
+
+/* Nothing should touch desc->status from now on */
+#undef status
+#define status          USE_THE_PROPER_WRAPPERS_YOU_MORON
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 3089d3b9d5f3..dd586ebf9c8c 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -21,70 +21,94 @@ static int irqfixup __read_mostly;
 #define POLL_SPURIOUS_IRQ_INTERVAL (HZ/10)
 static void poll_spurious_irqs(unsigned long dummy);
 static DEFINE_TIMER(poll_spurious_irq_timer, poll_spurious_irqs, 0, 0);
+static int irq_poll_cpu;
+static atomic_t irq_poll_active;
+
+/*
+ * We wait here for a poller to finish.
+ *
+ * If the poll runs on this CPU, then we yell loudly and return
+ * false. That will leave the interrupt line disabled in the worst
+ * case, but it should never happen.
+ *
+ * We wait until the poller is done and then recheck disabled and
+ * action (about to be disabled). Only if it's still active, we return
+ * true and let the handler run.
+ */
+bool irq_wait_for_poll(struct irq_desc *desc)
+{
+        if (WARN_ONCE(irq_poll_cpu == smp_processor_id(),
+                      "irq poll in progress on cpu %d for irq %d\n",
+                      smp_processor_id(), desc->irq_data.irq))
+                return false;
+
+#ifdef CONFIG_SMP
+        do {
+                raw_spin_unlock(&desc->lock);
+                while (desc->istate & IRQS_INPROGRESS)
+                        cpu_relax();
+                raw_spin_lock(&desc->lock);
+        } while (desc->istate & IRQS_INPROGRESS);
+        /* Might have been disabled in meantime */
+        return !(desc->istate & IRQS_DISABLED) && desc->action;
+#else
+        return false;
+#endif
+}
+
 
 /*
  * Recovery handler for misrouted interrupts.
  */
-static int try_one_irq(int irq, struct irq_desc *desc)
+static int try_one_irq(int irq, struct irq_desc *desc, bool force)
 {
+        irqreturn_t ret = IRQ_NONE;
         struct irqaction *action;
-        int ok = 0, work = 0;
 
         raw_spin_lock(&desc->lock);
-        /* Already running on another processor */
-        if (desc->status & IRQ_INPROGRESS) {
-                /*
-                 * Already running: If it is shared get the other
-                 * CPU to go looking for our mystery interrupt too
-                 */
-                if (desc->action && (desc->action->flags & IRQF_SHARED))
-                        desc->status |= IRQ_PENDING;
-                raw_spin_unlock(&desc->lock);
-                return ok;
-        }
-        /* Honour the normal IRQ locking */
-        desc->status |= IRQ_INPROGRESS;
-        action = desc->action;
-        raw_spin_unlock(&desc->lock);
 
-        while (action) {
-                /* Only shared IRQ handlers are safe to call */
-                if (action->flags & IRQF_SHARED) {
-                        if (action->handler(irq, action->dev_id) ==
-                                IRQ_HANDLED)
-                                ok = 1;
-                }
-                action = action->next;
-        }
-        local_irq_disable();
-        /* Now clean up the flags */
-        raw_spin_lock(&desc->lock);
-        action = desc->action;
+        /* PER_CPU and nested thread interrupts are never polled */
+        if (irq_settings_is_per_cpu(desc) || irq_settings_is_nested_thread(desc))
+                goto out;
 
         /*
-         * While we were looking for a fixup someone queued a real
-         * IRQ clashing with our walk:
+         * Do not poll disabled interrupts unless the spurious
+         * disabled poller asks explicitely.
          */
-        while ((desc->status & IRQ_PENDING) && action) {
+        if ((desc->istate & IRQS_DISABLED) && !force)
+                goto out;
+
+        /*
+         * All handlers must agree on IRQF_SHARED, so we test just the
+         * first. Check for action->next as well.
+         */
+        action = desc->action;
+        if (!action || !(action->flags & IRQF_SHARED) ||
+            (action->flags & __IRQF_TIMER) || !action->next)
+                goto out;
+
+        /* Already running on another processor */
+        if (desc->istate & IRQS_INPROGRESS) {
                 /*
-                 * Perform real IRQ processing for the IRQ we deferred
+                 * Already running: If it is shared get the other
+                 * CPU to go looking for our mystery interrupt too
                  */
-                work = 1;
-                raw_spin_unlock(&desc->lock);
-                handle_IRQ_event(irq, action);
-                raw_spin_lock(&desc->lock);
-                desc->status &= ~IRQ_PENDING;
+                irq_compat_set_pending(desc);
+                desc->istate |= IRQS_PENDING;
+                goto out;
         }
-        desc->status &= ~IRQ_INPROGRESS;
-        /*
-         * If we did actual work for the real IRQ line we must let the
-         * IRQ controller clean up too
-         */
-        if (work)
-                irq_end(irq, desc);
-        raw_spin_unlock(&desc->lock);
 
-        return ok;
+        /* Mark it poll in progress */
+        desc->istate |= IRQS_POLL_INPROGRESS;
+        do {
+                if (handle_irq_event(desc) == IRQ_HANDLED)
+                        ret = IRQ_HANDLED;
+                action = desc->action;
+        } while ((desc->istate & IRQS_PENDING) && action);
+        desc->istate &= ~IRQS_POLL_INPROGRESS;
+out:
+        raw_spin_unlock(&desc->lock);
+        return ret == IRQ_HANDLED;
 }
 
 static int misrouted_irq(int irq)
@@ -92,6 +116,11 @@ static int misrouted_irq(int irq)
         struct irq_desc *desc;
         int i, ok = 0;
 
+        if (atomic_inc_return(&irq_poll_active) == 1)
+                goto out;
+
+        irq_poll_cpu = smp_processor_id();
+
         for_each_irq_desc(i, desc) {
                 if (!i)
                          continue;
@@ -99,9 +128,11 @@ static int misrouted_irq(int irq)
                 if (i == irq)   /* Already tried */
                         continue;
 
-                if (try_one_irq(i, desc))
+                if (try_one_irq(i, desc, false))
                         ok = 1;
         }
+out:
+        atomic_dec(&irq_poll_active);
         /* So the caller can adjust the irq error counts */
         return ok;
 }
@@ -111,23 +142,28 @@ static void poll_spurious_irqs(unsigned long dummy)
         struct irq_desc *desc;
         int i;
 
+        if (atomic_inc_return(&irq_poll_active) != 1)
+                goto out;
+        irq_poll_cpu = smp_processor_id();
+
         for_each_irq_desc(i, desc) {
-                unsigned int status;
+                unsigned int state;
 
                 if (!i)
                          continue;
 
                 /* Racy but it doesn't matter */
-                status = desc->status;
+                state = desc->istate;
                 barrier();
-                if (!(status & IRQ_SPURIOUS_DISABLED))
+                if (!(state & IRQS_SPURIOUS_DISABLED))
                         continue;
 
                 local_irq_disable();
-                try_one_irq(i, desc);
+                try_one_irq(i, desc, true);
                 local_irq_enable();
         }
-
+out:
+        atomic_dec(&irq_poll_active);
         mod_timer(&poll_spurious_irq_timer,
                   jiffies + POLL_SPURIOUS_IRQ_INTERVAL);
 }
@@ -139,15 +175,13 @@ static void poll_spurious_irqs(unsigned long dummy)
  *
  * (The other 100-of-100,000 interrupts may have been a correctly
  *  functioning device sharing an IRQ with the failing one)
- *
- * Called under desc->lock
  */
-
 static void
 __report_bad_irq(unsigned int irq, struct irq_desc *desc,
                  irqreturn_t action_ret)
 {
         struct irqaction *action;
+        unsigned long flags;
 
         if (action_ret != IRQ_HANDLED && action_ret != IRQ_NONE) {
                 printk(KERN_ERR "irq event %d: bogus return value %x\n",
@@ -159,6 +193,13 @@ __report_bad_irq(unsigned int irq, struct irq_desc *desc,
         dump_stack();
         printk(KERN_ERR "handlers:\n");
 
+        /*
+         * We need to take desc->lock here. note_interrupt() is called
+         * w/o desc->lock held, but IRQ_PROGRESS set. We might race
+         * with something else removing an action. It's ok to take
+         * desc->lock here. See synchronize_irq().
+         */
+        raw_spin_lock_irqsave(&desc->lock, flags);
         action = desc->action;
         while (action) {
                 printk(KERN_ERR "[<%p>]", action->handler);
@@ -167,6 +208,7 @@ __report_bad_irq(unsigned int irq, struct irq_desc *desc,
                 printk("\n");
                 action = action->next;
         }
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
 static void
@@ -218,6 +260,9 @@ try_misrouted_irq(unsigned int irq, struct irq_desc *desc,
 void note_interrupt(unsigned int irq, struct irq_desc *desc,
                     irqreturn_t action_ret)
 {
+        if (desc->istate & IRQS_POLL_INPROGRESS)
+                return;
+
         if (unlikely(action_ret != IRQ_HANDLED)) {
                 /*
                  * If we are seeing only the odd spurious IRQ caused by
@@ -254,9 +299,9 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
                  * Now kill the IRQ
                  */
                 printk(KERN_EMERG "Disabling IRQ #%d\n", irq);
-                desc->status |= IRQ_DISABLED | IRQ_SPURIOUS_DISABLED;
+                desc->istate |= IRQS_SPURIOUS_DISABLED;
                 desc->depth++;
-                desc->irq_data.chip->irq_disable(&desc->irq_data);
+                irq_disable(desc);
 
                 mod_timer(&poll_spurious_irq_timer,
                           jiffies + POLL_SPURIOUS_IRQ_INTERVAL);
diff --git a/kernel/irq_work.c b/kernel/irq_work.c
index 90f881904bb1..c58fa7da8aef 100644
--- a/kernel/irq_work.c
+++ b/kernel/irq_work.c
@@ -77,21 +77,21 @@ void __weak arch_irq_work_raise(void)
  */
 static void __irq_work_queue(struct irq_work *entry)
 {
-        struct irq_work **head, *next;
+        struct irq_work *next;
 
-        head = &get_cpu_var(irq_work_list);
+        preempt_disable();
 
         do {
-                next = *head;
+                next = __this_cpu_read(irq_work_list);
                 /* Can assign non-atomic because we keep the flags set. */
                 entry->next = next_flags(next, IRQ_WORK_FLAGS);
-        } while (cmpxchg(head, next, entry) != next);
+        } while (this_cpu_cmpxchg(irq_work_list, next, entry) != next);
 
         /* The list was empty, raise self-interrupt to start processing. */
         if (!irq_work_next(entry))
                 arch_irq_work_raise();
 
-        put_cpu_var(irq_work_list);
+        preempt_enable();
 }
 
 /*
@@ -120,16 +120,16 @@ EXPORT_SYMBOL_GPL(irq_work_queue);
  */
 void irq_work_run(void)
 {
-        struct irq_work *list, **head;
+        struct irq_work *list;
 
-        head = &__get_cpu_var(irq_work_list);
-        if (*head == NULL)
+        if (this_cpu_read(irq_work_list) == NULL)
                 return;
 
         BUG_ON(!in_irq());
         BUG_ON(!irqs_disabled());
 
-        list = xchg(head, NULL);
+        list = this_cpu_xchg(irq_work_list, NULL);
+
         while (list != NULL) {
                 struct irq_work *entry = list;
 
diff --git a/kernel/kexec.c b/kernel/kexec.c
index b55045bc7563..ec19b92c7ebd 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -163,7 +163,7 @@ static int do_kimage_alloc(struct kimage **rimage, unsigned long entry,
          * just verifies it is an address we can use.
          *
          * Since the kernel does everything in page size chunks ensure
-         * the destination addreses are page aligned.  Too many
+         * the destination addresses are page aligned.  Too many
          * special cases crop of when we don't do this.  The most
          * insidious is getting overlapping destination addresses
          * simply because addresses are changed to page size
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 7663e5df0e6f..77981813a1e7 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -317,12 +317,12 @@ void __kprobes free_optinsn_slot(kprobe_opcode_t * slot, int dirty)
 /* We have preemption disabled.. so it is safe to use __ versions */
 static inline void set_kprobe_instance(struct kprobe *kp)
 {
-        __get_cpu_var(kprobe_instance) = kp;
+        __this_cpu_write(kprobe_instance, kp);
 }
 
 static inline void reset_kprobe_instance(void)
 {
-        __get_cpu_var(kprobe_instance) = NULL;
+        __this_cpu_write(kprobe_instance, NULL);
 }
 
 /*
@@ -965,7 +965,7 @@ static void __kprobes aggr_post_handler(struct kprobe *p, struct pt_regs *regs,
 static int __kprobes aggr_fault_handler(struct kprobe *p, struct pt_regs *regs,
                                         int trapnr)
 {
-        struct kprobe *cur = __get_cpu_var(kprobe_instance);
+        struct kprobe *cur = __this_cpu_read(kprobe_instance);
 
         /*
          * if we faulted "during" the execution of a user specified
@@ -980,7 +980,7 @@ static int __kprobes aggr_fault_handler(struct kprobe *p, struct pt_regs *regs,
 
 static int __kprobes aggr_break_handler(struct kprobe *p, struct pt_regs *regs)
 {
-        struct kprobe *cur = __get_cpu_var(kprobe_instance);
+        struct kprobe *cur = __this_cpu_read(kprobe_instance);
         int ret = 0;
 
         if (cur && cur->break_handler) {
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 5355cfd44a3f..c55afba990a3 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -148,7 +148,7 @@ struct task_struct *kthread_create(int (*threadfn)(void *data),
         wait_for_completion(&create.done);
 
         if (!IS_ERR(create.result)) {
-                static struct sched_param param = { .sched_priority = 0 };
+                static const struct sched_param param = { .sched_priority = 0 };
                 va_list args;
 
                 va_start(args, namefmt);
diff --git a/kernel/latencytop.c b/kernel/latencytop.c
index 17110a4a4fc2..ee74b35e528d 100644
--- a/kernel/latencytop.c
+++ b/kernel/latencytop.c
@@ -241,24 +241,19 @@ static int lstats_show(struct seq_file *m, void *v)
         seq_puts(m, "Latency Top version : v0.1\n");
 
         for (i = 0; i < MAXLR; i++) {
-                if (latency_record[i].backtrace[0]) {
+                struct latency_record *lr = &latency_record[i];
+
+                if (lr->backtrace[0]) {
                         int q;
-                        seq_printf(m, "%i %lu %lu ",
-                                latency_record[i].count,
-                                latency_record[i].time,
-                                latency_record[i].max);
+                        seq_printf(m, "%i %lu %lu",
+                                   lr->count, lr->time, lr->max);
                         for (q = 0; q < LT_BACKTRACEDEPTH; q++) {
-                                char sym[KSYM_SYMBOL_LEN];
-                                char *c;
-                                if (!latency_record[i].backtrace[q])
+                                unsigned long bt = lr->backtrace[q];
+                                if (!bt)
                                         break;
-                                if (latency_record[i].backtrace[q] == ULONG_MAX)
+                                if (bt == ULONG_MAX)
                                         break;
-                                sprint_symbol(sym, latency_record[i].backtrace[q]);
-                                c = strchr(sym, '+');
-                                if (c)
-                                        *c = 0;
-                                seq_printf(m, "%s ", sym);
+                                seq_printf(m, " %ps", (void *)bt);
                         }
                         seq_printf(m, "\n");
                 }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 42ba65dff7d9..0d2058da80f5 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -2292,22 +2292,6 @@ mark_held_locks(struct task_struct *curr, enum mark_type mark)
 }
 
 /*
- * Debugging helper: via this flag we know that we are in
- * 'early bootup code', and will warn about any invalid irqs-on event:
- */
-static int early_boot_irqs_enabled;
-
-void early_boot_irqs_off(void)
-{
-        early_boot_irqs_enabled = 0;
-}
-
-void early_boot_irqs_on(void)
-{
-        early_boot_irqs_enabled = 1;
-}
-
-/*
  * Hardirqs will be enabled:
  */
 void trace_hardirqs_on_caller(unsigned long ip)
@@ -2319,7 +2303,7 @@ void trace_hardirqs_on_caller(unsigned long ip)
         if (unlikely(!debug_locks || current->lockdep_recursion))
                 return;
 
-        if (DEBUG_LOCKS_WARN_ON(unlikely(!early_boot_irqs_enabled)))
+        if (DEBUG_LOCKS_WARN_ON(unlikely(early_boot_irqs_disabled)))
                 return;
 
         if (unlikely(curr->hardirqs_enabled)) {
diff --git a/kernel/module.c b/kernel/module.c
index 34e00b708fad..efa290ea94bf 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2460,9 +2460,9 @@ static void find_module_sections(struct module *mod, struct load_info *info)
 #endif
 
 #ifdef CONFIG_TRACEPOINTS
-        mod->tracepoints = section_objs(info, "__tracepoints",
-                                        sizeof(*mod->tracepoints),
-                                        &mod->num_tracepoints);
+        mod->tracepoints_ptrs = section_objs(info, "__tracepoints_ptrs",
+                                             sizeof(*mod->tracepoints_ptrs),
+                                             &mod->num_tracepoints);
 #endif
 #ifdef HAVE_JUMP_LABEL
         mod->jump_entries = section_objs(info, "__jump_table",
@@ -3393,7 +3393,7 @@ void module_layout(struct module *mod,
                    struct modversion_info *ver,
                    struct kernel_param *kp,
                    struct kernel_symbol *ks,
-                   struct tracepoint *tp)
+                   struct tracepoint * const *tp)
 {
 }
 EXPORT_SYMBOL(module_layout);
@@ -3407,8 +3407,8 @@ void module_update_tracepoints(void)
         mutex_lock(&module_mutex);
         list_for_each_entry(mod, &modules, list)
                 if (!mod->taints)
-                        tracepoint_update_probe_range(mod->tracepoints,
-                                mod->tracepoints + mod->num_tracepoints);
+                        tracepoint_update_probe_range(mod->tracepoints_ptrs,
+                                mod->tracepoints_ptrs + mod->num_tracepoints);
         mutex_unlock(&module_mutex);
 }
 
@@ -3432,8 +3432,8 @@ int module_get_iter_tracepoints(struct tracepoint_iter *iter)
                         else if (iter_mod > iter->module)
                                 iter->tracepoint = NULL;
                         found = tracepoint_get_iter_range(&iter->tracepoint,
-                                iter_mod->tracepoints,
-                                iter_mod->tracepoints
+                                iter_mod->tracepoints_ptrs,
+                                iter_mod->tracepoints_ptrs
                                         + iter_mod->num_tracepoints);
                         if (found) {
                                 iter->module = iter_mod;
diff --git a/kernel/panic.c b/kernel/panic.c
index 4c13b1a88ebb..991bb87a1704 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -34,6 +34,7 @@ static int pause_on_oops_flag;
 static DEFINE_SPINLOCK(pause_on_oops_lock);
 
 int panic_timeout;
+EXPORT_SYMBOL_GPL(panic_timeout);
 
 ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
 
diff --git a/kernel/params.c b/kernel/params.c
index 08107d181758..0da1411222b9 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -719,9 +719,7 @@ void destroy_params(const struct kernel_param *params, unsigned num)
                         params[i].ops->free(params[i].arg);
 }
 
-static void __init kernel_add_sysfs_param(const char *name,
-                                          struct kernel_param *kparam,
-                                          unsigned int name_skip)
+static struct module_kobject * __init locate_module_kobject(const char *name)
 {
         struct module_kobject *mk;
         struct kobject *kobj;
@@ -729,10 +727,7 @@ static void __init kernel_add_sysfs_param(const char *name,
 
         kobj = kset_find_obj(module_kset, name);
         if (kobj) {
-                /* We already have one.  Remove params so we can add more. */
                 mk = to_module_kobject(kobj);
-                /* We need to remove it before adding parameters. */
-                sysfs_remove_group(&mk->kobj, &mk->mp->grp);
         } else {
                 mk = kzalloc(sizeof(struct module_kobject), GFP_KERNEL);
                 BUG_ON(!mk);
@@ -743,15 +738,36 @@ static void __init kernel_add_sysfs_param(const char *name,
                                            "%s", name);
                 if (err) {
                         kobject_put(&mk->kobj);
-                        printk(KERN_ERR "Module '%s' failed add to sysfs, "
-                               "error number %d\n", name, err);
-                        printk(KERN_ERR "The system will be unstable now.\n");
-                        return;
+                        printk(KERN_ERR
+                                "Module '%s' failed add to sysfs, error number %d\n",
+                                name, err);
+                        printk(KERN_ERR
+                                "The system will be unstable now.\n");
+                        return NULL;
                 }
-                /* So that exit path is even. */
+
+                /* So that we hold reference in both cases. */
                 kobject_get(&mk->kobj);
         }
 
+        return mk;
+}
+
+static void __init kernel_add_sysfs_param(const char *name,
+                                          struct kernel_param *kparam,
+                                          unsigned int name_skip)
+{
+        struct module_kobject *mk;
+        int err;
+
+        mk = locate_module_kobject(name);
+        if (!mk)
+                return;
+
+        /* We need to remove old parameters before adding more. */
+        if (mk->mp)
+                sysfs_remove_group(&mk->kobj, &mk->mp->grp);
+
         /* These should not fail at boot. */
         err = add_sysfs_param(mk, kparam, kparam->name + name_skip);
         BUG_ON(err);
@@ -796,6 +812,32 @@ static void __init param_sysfs_builtin(void)
         }
 }
 
+ssize_t __modver_version_show(struct module_attribute *mattr,
+                              struct module *mod, char *buf)
+{
+        struct module_version_attribute *vattr =
+                container_of(mattr, struct module_version_attribute, mattr);
+
+        return sprintf(buf, "%s\n", vattr->version);
+}
+
+extern struct module_version_attribute __start___modver[], __stop___modver[];
+
+static void __init version_sysfs_builtin(void)
+{
+        const struct module_version_attribute *vattr;
+        struct module_kobject *mk;
+        int err;
+
+        for (vattr = __start___modver; vattr < __stop___modver; vattr++) {
+                mk = locate_module_kobject(vattr->module_name);
+                if (mk) {
+                        err = sysfs_create_file(&mk->kobj, &vattr->mattr.attr);
+                        kobject_uevent(&mk->kobj, KOBJ_ADD);
+                        kobject_put(&mk->kobj);
+                }
+        }
+}
 
 /* module-related sysfs stuff */
 
@@ -875,6 +917,7 @@ static int __init param_sysfs_init(void)
         }
         module_sysfs_initialized = 1;
 
+        version_sysfs_builtin();
         param_sysfs_builtin();
 
         return 0;
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 11847bf1e8cc..ed253aa24ba4 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -38,7 +38,96 @@
 
 #include <asm/irq_regs.h>
 
-atomic_t perf_task_events __read_mostly;
+struct remote_function_call {
+        struct task_struct *p;
+        int (*func)(void *info);
+        void *info;
+        int ret;
+};
+
+static void remote_function(void *data)
+{
+        struct remote_function_call *tfc = data;
+        struct task_struct *p = tfc->p;
+
+        if (p) {
+                tfc->ret = -EAGAIN;
+                if (task_cpu(p) != smp_processor_id() || !task_curr(p))
+                        return;
+        }
+
+        tfc->ret = tfc->func(tfc->info);
+}
+
+/**
+ * task_function_call - call a function on the cpu on which a task runs
+ * @p:          the task to evaluate
+ * @func:       the function to be called
+ * @info:       the function call argument
+ *
+ * Calls the function @func when the task is currently running. This might
+ * be on the current CPU, which just calls the function directly
+ *
+ * returns: @func return value, or
+ *          -ESRCH  - when the process isn't running
+ *          -EAGAIN - when the process moved away
+ */
+static int
+task_function_call(struct task_struct *p, int (*func) (void *info), void *info)
+{
+        struct remote_function_call data = {
+                .p = p,
+                .func = func,
+                .info = info,
+                .ret = -ESRCH, /* No such (running) process */
+        };
+
+        if (task_curr(p))
+                smp_call_function_single(task_cpu(p), remote_function, &data, 1);
+
+        return data.ret;
+}
+
+/**
+ * cpu_function_call - call a function on the cpu
+ * @func:       the function to be called
+ * @info:       the function call argument
+ *
+ * Calls the function @func on the remote cpu.
+ *
+ * returns: @func return value or -ENXIO when the cpu is offline
+ */
+static int cpu_function_call(int cpu, int (*func) (void *info), void *info)
+{
+        struct remote_function_call data = {
+                .p = NULL,
+                .func = func,
+                .info = info,
+                .ret = -ENXIO, /* No such CPU */
+        };
+
+        smp_call_function_single(cpu, remote_function, &data, 1);
+
+        return data.ret;
+}
+
+#define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
+                       PERF_FLAG_FD_OUTPUT  |\
+                       PERF_FLAG_PID_CGROUP)
+
+enum event_type_t {
+        EVENT_FLEXIBLE = 0x1,
+        EVENT_PINNED = 0x2,
+        EVENT_ALL = EVENT_FLEXIBLE | EVENT_PINNED,
+};
+
+/*
+ * perf_sched_events : >0 events exist
+ * perf_cgroup_events: >0 per-cpu cgroup events exist on this cpu
+ */
+atomic_t perf_sched_events __read_mostly;
+static DEFINE_PER_CPU(atomic_t, perf_cgroup_events);
+
 static atomic_t nr_mmap_events __read_mostly;
 static atomic_t nr_comm_events __read_mostly;
 static atomic_t nr_task_events __read_mostly;
@@ -61,10 +150,37 @@ int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
 /*
  * max perf event sample rate
  */
-int sysctl_perf_event_sample_rate __read_mostly = 100000;
+#define DEFAULT_MAX_SAMPLE_RATE 100000
+int sysctl_perf_event_sample_rate __read_mostly = DEFAULT_MAX_SAMPLE_RATE;
+static int max_samples_per_tick __read_mostly =
+        DIV_ROUND_UP(DEFAULT_MAX_SAMPLE_RATE, HZ);
+
+int perf_proc_update_handler(struct ctl_table *table, int write,
+                void __user *buffer, size_t *lenp,
+                loff_t *ppos)
+{
+        int ret = proc_dointvec(table, write, buffer, lenp, ppos);
+
+        if (ret || !write)
+                return ret;
+
+        max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ);
+
+        return 0;
+}
 
 static atomic64_t perf_event_id;
 
+static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
+                              enum event_type_t event_type);
+
+static void cpu_ctx_sched_in(struct perf_cpu_context *cpuctx,
+                             enum event_type_t event_type,
+                             struct task_struct *task);
+
+static void update_context_time(struct perf_event_context *ctx);
+static u64 perf_event_time(struct perf_event *event);
+
 void __weak perf_event_print_debug(void)        { }
 
 extern __weak const char *perf_pmu_name(void)
@@ -72,6 +188,365 @@ extern __weak const char *perf_pmu_name(void)
         return "pmu";
 }
 
+static inline u64 perf_clock(void)
+{
+        return local_clock();
+}
+
+static inline struct perf_cpu_context *
+__get_cpu_context(struct perf_event_context *ctx)
+{
+        return this_cpu_ptr(ctx->pmu->pmu_cpu_context);
+}
+
+#ifdef CONFIG_CGROUP_PERF
+
+/*
+ * Must ensure cgroup is pinned (css_get) before calling
+ * this function. In other words, we cannot call this function
+ * if there is no cgroup event for the current CPU context.
+ */
+static inline struct perf_cgroup *
+perf_cgroup_from_task(struct task_struct *task)
+{
+        return container_of(task_subsys_state(task, perf_subsys_id),
+                        struct perf_cgroup, css);
+}
+
+static inline bool
+perf_cgroup_match(struct perf_event *event)
+{
+        struct perf_event_context *ctx = event->ctx;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
+
+        return !event->cgrp || event->cgrp == cpuctx->cgrp;
+}
+
+static inline void perf_get_cgroup(struct perf_event *event)
+{
+        css_get(&event->cgrp->css);
+}
+
+static inline void perf_put_cgroup(struct perf_event *event)
+{
+        css_put(&event->cgrp->css);
+}
+
+static inline void perf_detach_cgroup(struct perf_event *event)
+{
+        perf_put_cgroup(event);
+        event->cgrp = NULL;
+}
+
+static inline int is_cgroup_event(struct perf_event *event)
+{
+        return event->cgrp != NULL;
+}
+
+static inline u64 perf_cgroup_event_time(struct perf_event *event)
+{
+        struct perf_cgroup_info *t;
+
+        t = per_cpu_ptr(event->cgrp->info, event->cpu);
+        return t->time;
+}
+
+static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
+{
+        struct perf_cgroup_info *info;
+        u64 now;
+
+        now = perf_clock();
+
+        info = this_cpu_ptr(cgrp->info);
+
+        info->time += now - info->timestamp;
+        info->timestamp = now;
+}
+
+static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
+{
+        struct perf_cgroup *cgrp_out = cpuctx->cgrp;
+        if (cgrp_out)
+                __update_cgrp_time(cgrp_out);
+}
+
+static inline void update_cgrp_time_from_event(struct perf_event *event)
+{
+        struct perf_cgroup *cgrp;
+
+        /*
+         * ensure we access cgroup data only when needed and
+         * when we know the cgroup is pinned (css_get)
+         */
+        if (!is_cgroup_event(event))
+                return;
+
+        cgrp = perf_cgroup_from_task(current);
+        /*
+         * Do not update time when cgroup is not active
+         */
+        if (cgrp == event->cgrp)
+                __update_cgrp_time(event->cgrp);
+}
+
+static inline void
+perf_cgroup_set_timestamp(struct task_struct *task,
+                          struct perf_event_context *ctx)
+{
+        struct perf_cgroup *cgrp;
+        struct perf_cgroup_info *info;
+
+        /*
+         * ctx->lock held by caller
+         * ensure we do not access cgroup data
+         * unless we have the cgroup pinned (css_get)
+         */
+        if (!task || !ctx->nr_cgroups)
+                return;
+
+        cgrp = perf_cgroup_from_task(task);
+        info = this_cpu_ptr(cgrp->info);
+        info->timestamp = ctx->timestamp;
+}
+
+#define PERF_CGROUP_SWOUT       0x1 /* cgroup switch out every event */
+#define PERF_CGROUP_SWIN        0x2 /* cgroup switch in events based on task */
+
+/*
+ * reschedule events based on the cgroup constraint of task.
+ *
+ * mode SWOUT : schedule out everything
+ * mode SWIN : schedule in based on cgroup for next
+ */
+void perf_cgroup_switch(struct task_struct *task, int mode)
+{
+        struct perf_cpu_context *cpuctx;
+        struct pmu *pmu;
+        unsigned long flags;
+
+        /*
+         * disable interrupts to avoid geting nr_cgroup
+         * changes via __perf_event_disable(). Also
+         * avoids preemption.
+         */
+        local_irq_save(flags);
+
+        /*
+         * we reschedule only in the presence of cgroup
+         * constrained events.
+         */
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(pmu, &pmus, entry) {
+
+                cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+
+                perf_pmu_disable(cpuctx->ctx.pmu);
+
+                /*
+                 * perf_cgroup_events says at least one
+                 * context on this CPU has cgroup events.
+                 *
+                 * ctx->nr_cgroups reports the number of cgroup
+                 * events for a context.
+                 */
+                if (cpuctx->ctx.nr_cgroups > 0) {
+
+                        if (mode & PERF_CGROUP_SWOUT) {
+                                cpu_ctx_sched_out(cpuctx, EVENT_ALL);
+                                /*
+                                 * must not be done before ctxswout due
+                                 * to event_filter_match() in event_sched_out()
+                                 */
+                                cpuctx->cgrp = NULL;
+                        }
+
+                        if (mode & PERF_CGROUP_SWIN) {
+                                /* set cgrp before ctxsw in to
+                                 * allow event_filter_match() to not
+                                 * have to pass task around
+                                 */
+                                cpuctx->cgrp = perf_cgroup_from_task(task);
+                                cpu_ctx_sched_in(cpuctx, EVENT_ALL, task);
+                        }
+                }
+
+                perf_pmu_enable(cpuctx->ctx.pmu);
+        }
+
+        rcu_read_unlock();
+
+        local_irq_restore(flags);
+}
+
+static inline void perf_cgroup_sched_out(struct task_struct *task)
+{
+        perf_cgroup_switch(task, PERF_CGROUP_SWOUT);
+}
+
+static inline void perf_cgroup_sched_in(struct task_struct *task)
+{
+        perf_cgroup_switch(task, PERF_CGROUP_SWIN);
+}
+
+static inline int perf_cgroup_connect(int fd, struct perf_event *event,
+                                      struct perf_event_attr *attr,
+                                      struct perf_event *group_leader)
+{
+        struct perf_cgroup *cgrp;
+        struct cgroup_subsys_state *css;
+        struct file *file;
+        int ret = 0, fput_needed;
+
+        file = fget_light(fd, &fput_needed);
+        if (!file)
+                return -EBADF;
+
+        css = cgroup_css_from_dir(file, perf_subsys_id);
+        if (IS_ERR(css)) {
+                ret = PTR_ERR(css);
+                goto out;
+        }
+
+        cgrp = container_of(css, struct perf_cgroup, css);
+        event->cgrp = cgrp;
+
+        /* must be done before we fput() the file */
+        perf_get_cgroup(event);
+
+        /*
+         * all events in a group must monitor
+         * the same cgroup because a task belongs
+         * to only one perf cgroup at a time
+         */
+        if (group_leader && group_leader->cgrp != cgrp) {
+                perf_detach_cgroup(event);
+                ret = -EINVAL;
+        }
+out:
+        fput_light(file, fput_needed);
+        return ret;
+}
+
+static inline void
+perf_cgroup_set_shadow_time(struct perf_event *event, u64 now)
+{
+        struct perf_cgroup_info *t;
+        t = per_cpu_ptr(event->cgrp->info, event->cpu);
+        event->shadow_ctx_time = now - t->timestamp;
+}
+
+static inline void
+perf_cgroup_defer_enabled(struct perf_event *event)
+{
+        /*
+         * when the current task's perf cgroup does not match
+         * the event's, we need to remember to call the
+         * perf_mark_enable() function the first time a task with
+         * a matching perf cgroup is scheduled in.
+         */
+        if (is_cgroup_event(event) && !perf_cgroup_match(event))
+                event->cgrp_defer_enabled = 1;
+}
+
+static inline void
+perf_cgroup_mark_enabled(struct perf_event *event,
+                         struct perf_event_context *ctx)
+{
+        struct perf_event *sub;
+        u64 tstamp = perf_event_time(event);
+
+        if (!event->cgrp_defer_enabled)
+                return;
+
+        event->cgrp_defer_enabled = 0;
+
+        event->tstamp_enabled = tstamp - event->total_time_enabled;
+        list_for_each_entry(sub, &event->sibling_list, group_entry) {
+                if (sub->state >= PERF_EVENT_STATE_INACTIVE) {
+                        sub->tstamp_enabled = tstamp - sub->total_time_enabled;
+                        sub->cgrp_defer_enabled = 0;
+                }
+        }
+}
+#else /* !CONFIG_CGROUP_PERF */
+
+static inline bool
+perf_cgroup_match(struct perf_event *event)
+{
+        return true;
+}
+
+static inline void perf_detach_cgroup(struct perf_event *event)
+{}
+
+static inline int is_cgroup_event(struct perf_event *event)
+{
+        return 0;
+}
+
+static inline u64 perf_cgroup_event_cgrp_time(struct perf_event *event)
+{
+        return 0;
+}
+
+static inline void update_cgrp_time_from_event(struct perf_event *event)
+{
+}
+
+static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
+{
+}
+
+static inline void perf_cgroup_sched_out(struct task_struct *task)
+{
+}
+
+static inline void perf_cgroup_sched_in(struct task_struct *task)
+{
+}
+
+static inline int perf_cgroup_connect(pid_t pid, struct perf_event *event,
+                                      struct perf_event_attr *attr,
+                                      struct perf_event *group_leader)
+{
+        return -EINVAL;
+}
+
+static inline void
+perf_cgroup_set_timestamp(struct task_struct *task,
+                          struct perf_event_context *ctx)
+{
+}
+
+void
+perf_cgroup_switch(struct task_struct *task, struct task_struct *next)
+{
+}
+
+static inline void
+perf_cgroup_set_shadow_time(struct perf_event *event, u64 now)
+{
+}
+
+static inline u64 perf_cgroup_event_time(struct perf_event *event)
+{
+        return 0;
+}
+
+static inline void
+perf_cgroup_defer_enabled(struct perf_event *event)
+{
+}
+
+static inline void
+perf_cgroup_mark_enabled(struct perf_event *event,
+                         struct perf_event_context *ctx)
+{
+}
+#endif
+
 void perf_pmu_disable(struct pmu *pmu)
 {
         int *count = this_cpu_ptr(pmu->pmu_disable_count);
@@ -237,12 +712,6 @@ static void perf_unpin_context(struct perf_event_context *ctx)
         raw_spin_lock_irqsave(&ctx->lock, flags);
         --ctx->pin_count;
         raw_spin_unlock_irqrestore(&ctx->lock, flags);
-        put_ctx(ctx);
-}
-
-static inline u64 perf_clock(void)
-{
-        return local_clock();
 }
 
 /*
@@ -256,6 +725,16 @@ static void update_context_time(struct perf_event_context *ctx)
         ctx->timestamp = now;
 }
 
+static u64 perf_event_time(struct perf_event *event)
+{
+        struct perf_event_context *ctx = event->ctx;
+
+        if (is_cgroup_event(event))
+                return perf_cgroup_event_time(event);
+
+        return ctx ? ctx->time : 0;
+}
+
 /*
  * Update the total_time_enabled and total_time_running fields for a event.
  */
@@ -267,8 +746,19 @@ static void update_event_times(struct perf_event *event)
         if (event->state < PERF_EVENT_STATE_INACTIVE ||
             event->group_leader->state < PERF_EVENT_STATE_INACTIVE)
                 return;
-
-        if (ctx->is_active)
+        /*
+         * in cgroup mode, time_enabled represents
+         * the time the event was enabled AND active
+         * tasks were in the monitored cgroup. This is
+         * independent of the activity of the context as
+         * there may be a mix of cgroup and non-cgroup events.
+         *
+         * That is why we treat cgroup events differently
+         * here.
+         */
+        if (is_cgroup_event(event))
+                run_end = perf_event_time(event);
+        else if (ctx->is_active)
                 run_end = ctx->time;
         else
                 run_end = event->tstamp_stopped;
@@ -278,9 +768,10 @@ static void update_event_times(struct perf_event *event)
         if (event->state == PERF_EVENT_STATE_INACTIVE)
                 run_end = event->tstamp_stopped;
         else
-                run_end = ctx->time;
+                run_end = perf_event_time(event);
 
         event->total_time_running = run_end - event->tstamp_running;
+
 }
 
 /*
@@ -329,6 +820,9 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
                 list_add_tail(&event->group_entry, list);
         }
 
+        if (is_cgroup_event(event))
+                ctx->nr_cgroups++;
+
         list_add_rcu(&event->event_entry, &ctx->event_list);
         if (!ctx->nr_events)
                 perf_pmu_rotate_start(ctx->pmu);
@@ -455,6 +949,9 @@ list_del_event(struct perf_event *event, struct perf_event_context *ctx)
 
         event->attach_state &= ~PERF_ATTACH_CONTEXT;
 
+        if (is_cgroup_event(event))
+                ctx->nr_cgroups--;
+
         ctx->nr_events--;
         if (event->attr.inherit_stat)
                 ctx->nr_stat--;
@@ -526,7 +1023,8 @@ out:
 static inline int
 event_filter_match(struct perf_event *event)
 {
-        return event->cpu == -1 || event->cpu == smp_processor_id();
+        return (event->cpu == -1 || event->cpu == smp_processor_id())
+            && perf_cgroup_match(event);
 }
 
 static void
@@ -534,6 +1032,7 @@ event_sched_out(struct perf_event *event,
                   struct perf_cpu_context *cpuctx,
                   struct perf_event_context *ctx)
 {
+        u64 tstamp = perf_event_time(event);
         u64 delta;
         /*
          * An event which could not be activated because of
@@ -543,9 +1042,9 @@ event_sched_out(struct perf_event *event,
          */
         if (event->state == PERF_EVENT_STATE_INACTIVE
             && !event_filter_match(event)) {
-                delta = ctx->time - event->tstamp_stopped;
+                delta = tstamp - event->tstamp_stopped;
                 event->tstamp_running += delta;
-                event->tstamp_stopped = ctx->time;
+                event->tstamp_stopped = tstamp;
         }
 
         if (event->state != PERF_EVENT_STATE_ACTIVE)
@@ -556,7 +1055,7 @@ event_sched_out(struct perf_event *event,
                 event->pending_disable = 0;
                 event->state = PERF_EVENT_STATE_OFF;
         }
-        event->tstamp_stopped = ctx->time;
+        event->tstamp_stopped = tstamp;
         event->pmu->del(event, 0);
         event->oncpu = -1;
 
@@ -587,47 +1086,30 @@ group_sched_out(struct perf_event *group_event,
                 cpuctx->exclusive = 0;
 }
 
-static inline struct perf_cpu_context *
-__get_cpu_context(struct perf_event_context *ctx)
-{
-        return this_cpu_ptr(ctx->pmu->pmu_cpu_context);
-}
-
 /*
  * Cross CPU call to remove a performance event
  *
  * We disable the event on the hardware level first. After that we
  * remove it from the context list.
  */
-static void __perf_event_remove_from_context(void *info)
+static int __perf_remove_from_context(void *info)
 {
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
         struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
-        /*
-         * If this is a task context, we need to check whether it is
-         * the current task context of this cpu. If not it has been
-         * scheduled out before the smp call arrived.
-         */
-        if (ctx->task && cpuctx->task_ctx != ctx)
-                return;
-
         raw_spin_lock(&ctx->lock);
-
         event_sched_out(event, cpuctx, ctx);
-
         list_del_event(event, ctx);
-
         raw_spin_unlock(&ctx->lock);
+
+        return 0;
 }
 
 
 /*
  * Remove the event from a task's (or a CPU's) list of events.
  *
- * Must be called with ctx->mutex held.
- *
  * CPU events are removed with a smp call. For task events we only
  * call when the task is on a CPU.
  *
@@ -638,49 +1120,48 @@ static void __perf_event_remove_from_context(void *info)
  * When called from perf_event_exit_task, it's OK because the
  * context has been detached from its task.
  */
-static void perf_event_remove_from_context(struct perf_event *event)
+static void perf_remove_from_context(struct perf_event *event)
 {
         struct perf_event_context *ctx = event->ctx;
         struct task_struct *task = ctx->task;
 
+        lockdep_assert_held(&ctx->mutex);
+
         if (!task) {
                 /*
                  * Per cpu events are removed via an smp call and
                  * the removal is always successful.
                  */
-                smp_call_function_single(event->cpu,
-                                         __perf_event_remove_from_context,
-                                         event, 1);
+                cpu_function_call(event->cpu, __perf_remove_from_context, event);
                 return;
         }
 
 retry:
-        task_oncpu_function_call(task, __perf_event_remove_from_context,
-                                 event);
+        if (!task_function_call(task, __perf_remove_from_context, event))
+                return;
 
         raw_spin_lock_irq(&ctx->lock);
         /*
-         * If the context is active we need to retry the smp call.
+         * If we failed to find a running task, but find the context active now
+         * that we've acquired the ctx->lock, retry.
          */
-        if (ctx->nr_active && !list_empty(&event->group_entry)) {
+        if (ctx->is_active) {
                 raw_spin_unlock_irq(&ctx->lock);
                 goto retry;
         }
 
         /*
-         * The lock prevents that this context is scheduled in so we
-         * can remove the event safely, if the call above did not
-         * succeed.
+         * Since the task isn't running, its safe to remove the event, us
+         * holding the ctx->lock ensures the task won't get scheduled in.
          */
-        if (!list_empty(&event->group_entry))
-                list_del_event(event, ctx);
+        list_del_event(event, ctx);
         raw_spin_unlock_irq(&ctx->lock);
 }
 
 /*
  * Cross CPU call to disable a performance event
  */
-static void __perf_event_disable(void *info)
+static int __perf_event_disable(void *info)
 {
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
@@ -689,9 +1170,12 @@ static void __perf_event_disable(void *info)
         /*
          * If this is a per-task event, need to check whether this
          * event's task is the current task on this cpu.
+         *
+         * Can trigger due to concurrent perf_event_context_sched_out()
+         * flipping contexts around.
          */
         if (ctx->task && cpuctx->task_ctx != ctx)
-                return;
+                return -EINVAL;
 
         raw_spin_lock(&ctx->lock);
 
@@ -701,6 +1185,7 @@ static void __perf_event_disable(void *info)
          */
         if (event->state >= PERF_EVENT_STATE_INACTIVE) {
                 update_context_time(ctx);
+                update_cgrp_time_from_event(event);
                 update_group_times(event);
                 if (event == event->group_leader)
                         group_sched_out(event, cpuctx, ctx);
@@ -710,6 +1195,8 @@ static void __perf_event_disable(void *info)
         }
 
         raw_spin_unlock(&ctx->lock);
+
+        return 0;
 }
 
 /*
@@ -734,13 +1221,13 @@ void perf_event_disable(struct perf_event *event)
                 /*
                  * Disable the event on the cpu that it's on
                  */
-                smp_call_function_single(event->cpu, __perf_event_disable,
-                                         event, 1);
+                cpu_function_call(event->cpu, __perf_event_disable, event);
                 return;
         }
 
 retry:
-        task_oncpu_function_call(task, __perf_event_disable, event);
+        if (!task_function_call(task, __perf_event_disable, event))
+                return;
 
         raw_spin_lock_irq(&ctx->lock);
         /*
@@ -748,6 +1235,11 @@ retry:
          */
         if (event->state == PERF_EVENT_STATE_ACTIVE) {
                 raw_spin_unlock_irq(&ctx->lock);
+                /*
+                 * Reload the task pointer, it might have been changed by
+                 * a concurrent perf_event_context_sched_out().
+                 */
+                task = ctx->task;
                 goto retry;
         }
 
@@ -759,20 +1251,71 @@ retry:
                 update_group_times(event);
                 event->state = PERF_EVENT_STATE_OFF;
         }
-
         raw_spin_unlock_irq(&ctx->lock);
 }
 
+static void perf_set_shadow_time(struct perf_event *event,
+                                 struct perf_event_context *ctx,
+                                 u64 tstamp)
+{
+        /*
+         * use the correct time source for the time snapshot
+         *
+         * We could get by without this by leveraging the
+         * fact that to get to this function, the caller
+         * has most likely already called update_context_time()
+         * and update_cgrp_time_xx() and thus both timestamp
+         * are identical (or very close). Given that tstamp is,
+         * already adjusted for cgroup, we could say that:
+         *    tstamp - ctx->timestamp
+         * is equivalent to
+         *    tstamp - cgrp->timestamp.
+         *
+         * Then, in perf_output_read(), the calculation would
+         * work with no changes because:
+         * - event is guaranteed scheduled in
+         * - no scheduled out in between
+         * - thus the timestamp would be the same
+         *
+         * But this is a bit hairy.
+         *
+         * So instead, we have an explicit cgroup call to remain
+         * within the time time source all along. We believe it
+         * is cleaner and simpler to understand.
+         */
+        if (is_cgroup_event(event))
+                perf_cgroup_set_shadow_time(event, tstamp);
+        else
+                event->shadow_ctx_time = tstamp - ctx->timestamp;
+}
+
+#define MAX_INTERRUPTS (~0ULL)
+
+static void perf_log_throttle(struct perf_event *event, int enable);
+
 static int
 event_sched_in(struct perf_event *event,
                  struct perf_cpu_context *cpuctx,
                  struct perf_event_context *ctx)
 {
+        u64 tstamp = perf_event_time(event);
+
         if (event->state <= PERF_EVENT_STATE_OFF)
                 return 0;
 
         event->state = PERF_EVENT_STATE_ACTIVE;
         event->oncpu = smp_processor_id();
+
+        /*
+         * Unthrottle events, since we scheduled we might have missed several
+         * ticks already, also for a heavily scheduling task there is little
+         * guarantee it'll get a tick in a timely manner.
+         */
+        if (unlikely(event->hw.interrupts == MAX_INTERRUPTS)) {
+                perf_log_throttle(event, 1);
+                event->hw.interrupts = 0;
+        }
+
         /*
          * The new state must be visible before we turn it on in the hardware:
          */
@@ -784,9 +1327,9 @@ event_sched_in(struct perf_event *event,
                 return -EAGAIN;
         }
 
-        event->tstamp_running += ctx->time - event->tstamp_stopped;
+        event->tstamp_running += tstamp - event->tstamp_stopped;
 
-        event->shadow_ctx_time = ctx->time - ctx->timestamp;
+        perf_set_shadow_time(event, ctx, tstamp);
 
         if (!is_software_event(event))
                 cpuctx->active_oncpu++;
@@ -898,19 +1441,24 @@ static int group_can_go_on(struct perf_event *event,
 static void add_event_to_ctx(struct perf_event *event,
                                struct perf_event_context *ctx)
 {
+        u64 tstamp = perf_event_time(event);
+
         list_add_event(event, ctx);
         perf_group_attach(event);
-        event->tstamp_enabled = ctx->time;
-        event->tstamp_running = ctx->time;
-        event->tstamp_stopped = ctx->time;
+        event->tstamp_enabled = tstamp;
+        event->tstamp_running = tstamp;
+        event->tstamp_stopped = tstamp;
 }
 
+static void perf_event_context_sched_in(struct perf_event_context *ctx,
+                                        struct task_struct *tsk);
+
 /*
  * Cross CPU call to install and enable a performance event
  *
  * Must be called with ctx->mutex held
  */
-static void __perf_install_in_context(void *info)
+static int  __perf_install_in_context(void *info)
 {
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
@@ -919,25 +1467,26 @@ static void __perf_install_in_context(void *info)
         int err;
 
         /*
-         * If this is a task context, we need to check whether it is
-         * the current task context of this cpu. If not it has been
-         * scheduled out before the smp call arrived.
-         * Or possibly this is the right context but it isn't
-         * on this cpu because it had no events.
+         * In case we're installing a new context to an already running task,
+         * could also happen before perf_event_task_sched_in() on architectures
+         * which do context switches with IRQs enabled.
          */
-        if (ctx->task && cpuctx->task_ctx != ctx) {
-                if (cpuctx->task_ctx || ctx->task != current)
-                        return;
-                cpuctx->task_ctx = ctx;
-        }
+        if (ctx->task && !cpuctx->task_ctx)
+                perf_event_context_sched_in(ctx, ctx->task);
 
         raw_spin_lock(&ctx->lock);
         ctx->is_active = 1;
         update_context_time(ctx);
+        /*
+         * update cgrp time only if current cgrp
+         * matches event->cgrp. Must be done before
+         * calling add_event_to_ctx()
+         */
+        update_cgrp_time_from_event(event);
 
         add_event_to_ctx(event, ctx);
 
-        if (event->cpu != -1 && event->cpu != smp_processor_id())
+        if (!event_filter_match(event))
                 goto unlock;
 
         /*
@@ -974,6 +1523,8 @@ static void __perf_install_in_context(void *info)
 
 unlock:
         raw_spin_unlock(&ctx->lock);
+
+        return 0;
 }
 
 /*
@@ -985,8 +1536,6 @@ unlock:
  * If the event is attached to a task which is on a CPU we use a smp
  * call to enable it in the task context. The task might have been
  * scheduled away, but we check this in the smp call again.
- *
- * Must be called with ctx->mutex held.
  */
 static void
 perf_install_in_context(struct perf_event_context *ctx,
@@ -995,6 +1544,8 @@ perf_install_in_context(struct perf_event_context *ctx,
 {
         struct task_struct *task = ctx->task;
 
+        lockdep_assert_held(&ctx->mutex);
+
         event->ctx = ctx;
 
         if (!task) {
@@ -1002,31 +1553,29 @@ perf_install_in_context(struct perf_event_context *ctx,
                  * Per cpu events are installed via an smp call and
                  * the install is always successful.
                  */
-                smp_call_function_single(cpu, __perf_install_in_context,
-                                         event, 1);
+                cpu_function_call(cpu, __perf_install_in_context, event);
                 return;
         }
 
 retry:
-        task_oncpu_function_call(task, __perf_install_in_context,
-                                 event);
+        if (!task_function_call(task, __perf_install_in_context, event))
+                return;
 
         raw_spin_lock_irq(&ctx->lock);
         /*
-         * we need to retry the smp call.
+         * If we failed to find a running task, but find the context active now
+         * that we've acquired the ctx->lock, retry.
          */
-        if (ctx->is_active && list_empty(&event->group_entry)) {
+        if (ctx->is_active) {
                 raw_spin_unlock_irq(&ctx->lock);
                 goto retry;
         }
 
         /*
-         * The lock prevents that this context is scheduled in so we
-         * can add the event safely, if it the call above did not
-         * succeed.
+         * Since the task isn't running, its safe to add the event, us holding
+         * the ctx->lock ensures the task won't get scheduled in.
          */
-        if (list_empty(&event->group_entry))
-                add_event_to_ctx(event, ctx);
+        add_event_to_ctx(event, ctx);
         raw_spin_unlock_irq(&ctx->lock);
 }
 
@@ -1042,21 +1591,20 @@ static void __perf_event_mark_enabled(struct perf_event *event,
                                         struct perf_event_context *ctx)
 {
         struct perf_event *sub;
+        u64 tstamp = perf_event_time(event);
 
         event->state = PERF_EVENT_STATE_INACTIVE;
-        event->tstamp_enabled = ctx->time - event->total_time_enabled;
+        event->tstamp_enabled = tstamp - event->total_time_enabled;
         list_for_each_entry(sub, &event->sibling_list, group_entry) {
-                if (sub->state >= PERF_EVENT_STATE_INACTIVE) {
-                        sub->tstamp_enabled =
-                                ctx->time - sub->total_time_enabled;
-                }
+                if (sub->state >= PERF_EVENT_STATE_INACTIVE)
+                        sub->tstamp_enabled = tstamp - sub->total_time_enabled;
         }
 }
 
 /*
  * Cross CPU call to enable a performance event
  */
-static void __perf_event_enable(void *info)
+static int __perf_event_enable(void *info)
 {
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
@@ -1064,26 +1612,27 @@ static void __perf_event_enable(void *info)
         struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
         int err;
 
-        /*
-         * If this is a per-task event, need to check whether this
-         * event's task is the current task on this cpu.
-         */
-        if (ctx->task && cpuctx->task_ctx != ctx) {
-                if (cpuctx->task_ctx || ctx->task != current)
-                        return;
-                cpuctx->task_ctx = ctx;
-        }
+        if (WARN_ON_ONCE(!ctx->is_active))
+                return -EINVAL;
 
         raw_spin_lock(&ctx->lock);
-        ctx->is_active = 1;
         update_context_time(ctx);
 
         if (event->state >= PERF_EVENT_STATE_INACTIVE)
                 goto unlock;
+
+        /*
+         * set current task's cgroup time reference point
+         */
+        perf_cgroup_set_timestamp(current, ctx);
+
         __perf_event_mark_enabled(event, ctx);
 
-        if (event->cpu != -1 && event->cpu != smp_processor_id())
+        if (!event_filter_match(event)) {
+                if (is_cgroup_event(event))
+                        perf_cgroup_defer_enabled(event);
                 goto unlock;
+        }
 
         /*
          * If the event is in a group and isn't the group leader,
@@ -1116,6 +1665,8 @@ static void __perf_event_enable(void *info)
 
 unlock:
         raw_spin_unlock(&ctx->lock);
+
+        return 0;
 }
 
 /*
@@ -1136,8 +1687,7 @@ void perf_event_enable(struct perf_event *event)
                 /*
                  * Enable the event on the cpu that it's on
                  */
-                smp_call_function_single(event->cpu, __perf_event_enable,
-                                         event, 1);
+                cpu_function_call(event->cpu, __perf_event_enable, event);
                 return;
         }
 
@@ -1156,8 +1706,15 @@ void perf_event_enable(struct perf_event *event)
                 event->state = PERF_EVENT_STATE_OFF;
 
 retry:
+        if (!ctx->is_active) {
+                __perf_event_mark_enabled(event, ctx);
+                goto out;
+        }
+
         raw_spin_unlock_irq(&ctx->lock);
-        task_oncpu_function_call(task, __perf_event_enable, event);
+
+        if (!task_function_call(task, __perf_event_enable, event))
+                return;
 
         raw_spin_lock_irq(&ctx->lock);
 
@@ -1165,15 +1722,14 @@ retry:
          * If the context is active and the event is still off,
          * we need to retry the cross-call.
          */
-        if (ctx->is_active && event->state == PERF_EVENT_STATE_OFF)
+        if (ctx->is_active && event->state == PERF_EVENT_STATE_OFF) {
+                /*
+                 * task could have been flipped by a concurrent
+                 * perf_event_context_sched_out()
+                 */
+                task = ctx->task;
                 goto retry;
-
-        /*
-         * Since we have the lock this context can't be scheduled
-         * in, so we can change the state safely.
-         */
-        if (event->state == PERF_EVENT_STATE_OFF)
-                __perf_event_mark_enabled(event, ctx);
+        }
 
 out:
         raw_spin_unlock_irq(&ctx->lock);
@@ -1193,12 +1749,6 @@ static int perf_event_refresh(struct perf_event *event, int refresh)
         return 0;
 }
 
-enum event_type_t {
-        EVENT_FLEXIBLE = 0x1,
-        EVENT_PINNED = 0x2,
-        EVENT_ALL = EVENT_FLEXIBLE | EVENT_PINNED,
-};
-
 static void ctx_sched_out(struct perf_event_context *ctx,
                           struct perf_cpu_context *cpuctx,
                           enum event_type_t event_type)
@@ -1211,6 +1761,7 @@ static void ctx_sched_out(struct perf_event_context *ctx,
         if (likely(!ctx->nr_events))
                 goto out;
         update_context_time(ctx);
+        update_cgrp_time_from_cpuctx(cpuctx);
 
         if (!ctx->nr_active)
                 goto out;
@@ -1323,8 +1874,8 @@ static void perf_event_sync_stat(struct perf_event_context *ctx,
         }
 }
 
-void perf_event_context_sched_out(struct task_struct *task, int ctxn,
-                                  struct task_struct *next)
+static void perf_event_context_sched_out(struct task_struct *task, int ctxn,
+                                         struct task_struct *next)
 {
         struct perf_event_context *ctx = task->perf_event_ctxp[ctxn];
         struct perf_event_context *next_ctx;
@@ -1400,6 +1951,14 @@ void __perf_event_task_sched_out(struct task_struct *task,
 
         for_each_task_context_nr(ctxn)
                 perf_event_context_sched_out(task, ctxn, next);
+
+        /*
+         * if cgroup events exist on this CPU, then we need
+         * to check if we have to switch out PMU state.
+         * cgroup event are system-wide mode only
+         */
+        if (atomic_read(&__get_cpu_var(perf_cgroup_events)))
+                perf_cgroup_sched_out(task);
 }
 
 static void task_ctx_sched_out(struct perf_event_context *ctx,
@@ -1435,9 +1994,13 @@ ctx_pinned_sched_in(struct perf_event_context *ctx,
         list_for_each_entry(event, &ctx->pinned_groups, group_entry) {
                 if (event->state <= PERF_EVENT_STATE_OFF)
                         continue;
-                if (event->cpu != -1 && event->cpu != smp_processor_id())
+                if (!event_filter_match(event))
                         continue;
 
+                /* may need to reset tstamp_enabled */
+                if (is_cgroup_event(event))
+                        perf_cgroup_mark_enabled(event, ctx);
+
                 if (group_can_go_on(event, cpuctx, 1))
                         group_sched_in(event, cpuctx, ctx);
 
@@ -1467,9 +2030,13 @@ ctx_flexible_sched_in(struct perf_event_context *ctx,
                  * Listen to the 'cpu' scheduling filter constraint
                  * of events:
                  */
-                if (event->cpu != -1 && event->cpu != smp_processor_id())
+                if (!event_filter_match(event))
                         continue;
 
+                /* may need to reset tstamp_enabled */
+                if (is_cgroup_event(event))
+                        perf_cgroup_mark_enabled(event, ctx);
+
                 if (group_can_go_on(event, cpuctx, can_add_hw)) {
                         if (group_sched_in(event, cpuctx, ctx))
                                 can_add_hw = 0;
@@ -1480,15 +2047,19 @@ ctx_flexible_sched_in(struct perf_event_context *ctx,
 static void
 ctx_sched_in(struct perf_event_context *ctx,
              struct perf_cpu_context *cpuctx,
-             enum event_type_t event_type)
+             enum event_type_t event_type,
+             struct task_struct *task)
 {
+        u64 now;
+
         raw_spin_lock(&ctx->lock);
         ctx->is_active = 1;
         if (likely(!ctx->nr_events))
                 goto out;
 
-        ctx->timestamp = perf_clock();
-
+        now = perf_clock();
+        ctx->timestamp = now;
+        perf_cgroup_set_timestamp(task, ctx);
         /*
          * First go through the list and put on any pinned groups
          * in order to give them the best chance of going on.
@@ -1505,11 +2076,12 @@ out:
 }
 
 static void cpu_ctx_sched_in(struct perf_cpu_context *cpuctx,
-                             enum event_type_t event_type)
+                             enum event_type_t event_type,
+                             struct task_struct *task)
 {
         struct perf_event_context *ctx = &cpuctx->ctx;
 
-        ctx_sched_in(ctx, cpuctx, event_type);
+        ctx_sched_in(ctx, cpuctx, event_type, task);
 }
 
 static void task_ctx_sched_in(struct perf_event_context *ctx,
@@ -1517,15 +2089,16 @@ static void task_ctx_sched_in(struct perf_event_context *ctx,
 {
         struct perf_cpu_context *cpuctx;
 
-        cpuctx = __get_cpu_context(ctx);
+        cpuctx = __get_cpu_context(ctx);
         if (cpuctx->task_ctx == ctx)
                 return;
 
-        ctx_sched_in(ctx, cpuctx, event_type);
+        ctx_sched_in(ctx, cpuctx, event_type, NULL);
         cpuctx->task_ctx = ctx;
 }
 
-void perf_event_context_sched_in(struct perf_event_context *ctx)
+static void perf_event_context_sched_in(struct perf_event_context *ctx,
+                                        struct task_struct *task)
 {
         struct perf_cpu_context *cpuctx;
 
@@ -1541,9 +2114,9 @@ void perf_event_context_sched_in(struct perf_event_context *ctx)
          */
         cpu_ctx_sched_out(cpuctx, EVENT_FLEXIBLE);
 
-        ctx_sched_in(ctx, cpuctx, EVENT_PINNED);
-        cpu_ctx_sched_in(cpuctx, EVENT_FLEXIBLE);
-        ctx_sched_in(ctx, cpuctx, EVENT_FLEXIBLE);
+        ctx_sched_in(ctx, cpuctx, EVENT_PINNED, task);
+        cpu_ctx_sched_in(cpuctx, EVENT_FLEXIBLE, task);
+        ctx_sched_in(ctx, cpuctx, EVENT_FLEXIBLE, task);
 
         cpuctx->task_ctx = ctx;
 
@@ -1576,14 +2149,17 @@ void __perf_event_task_sched_in(struct task_struct *task)
                 if (likely(!ctx))
                         continue;
 
-                perf_event_context_sched_in(ctx);
+                perf_event_context_sched_in(ctx, task);
         }
+        /*
+         * if cgroup events exist on this CPU, then we need
+         * to check if we have to switch in PMU state.
+         * cgroup event are system-wide mode only
+         */
+        if (atomic_read(&__get_cpu_var(perf_cgroup_events)))
+                perf_cgroup_sched_in(task);
 }
 
-#define MAX_INTERRUPTS (~0ULL)
-
-static void perf_log_throttle(struct perf_event *event, int enable);
-
 static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count)
 {
         u64 frequency = event->attr.sample_freq;
@@ -1611,7 +2187,7 @@ static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count)
          * Reduce accuracy by one bit such that @a and @b converge
          * to a similar magnitude.
          */
-#define REDUCE_FLS(a, b)                \
+#define REDUCE_FLS(a, b)                \
 do {                                    \
         if (a##_fls > b##_fls) {        \
                 a >>= 1;                \
@@ -1694,7 +2270,7 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx, u64 period)
                 if (event->state != PERF_EVENT_STATE_ACTIVE)
                         continue;
 
-                if (event->cpu != -1 && event->cpu != smp_processor_id())
+                if (!event_filter_match(event))
                         continue;
 
                 hwc = &event->hw;
@@ -1781,7 +2357,7 @@ static void perf_rotate_context(struct perf_cpu_context *cpuctx)
         if (ctx)
                 rotate_ctx(ctx);
 
-        cpu_ctx_sched_in(cpuctx, EVENT_FLEXIBLE);
+        cpu_ctx_sched_in(cpuctx, EVENT_FLEXIBLE, current);
         if (ctx)
                 task_ctx_sched_in(ctx, EVENT_FLEXIBLE);
 
@@ -1860,7 +2436,7 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
 
         raw_spin_unlock(&ctx->lock);
 
-        perf_event_context_sched_in(ctx);
+        perf_event_context_sched_in(ctx, ctx->task);
 out:
         local_irq_restore(flags);
 }
@@ -1885,11 +2461,14 @@ static void __perf_event_read(void *info)
                 return;
 
         raw_spin_lock(&ctx->lock);
-        update_context_time(ctx);
+        if (ctx->is_active) {
+                update_context_time(ctx);
+                update_cgrp_time_from_event(event);
+        }
         update_event_times(event);
+        if (event->state == PERF_EVENT_STATE_ACTIVE)
+                event->pmu->read(event);
         raw_spin_unlock(&ctx->lock);
-
-        event->pmu->read(event);
 }
 
 static inline u64 perf_event_count(struct perf_event *event)
@@ -1916,8 +2495,10 @@ static u64 perf_event_read(struct perf_event *event)
                  * (e.g., thread is blocked), in that case
                  * we cannot update context time
                  */
-                if (ctx->is_active)
+                if (ctx->is_active) {
                         update_context_time(ctx);
+                        update_cgrp_time_from_event(event);
+                }
                 update_event_times(event);
                 raw_spin_unlock_irqrestore(&ctx->lock, flags);
         }
@@ -1983,8 +2564,7 @@ static int alloc_callchain_buffers(void)
          * accessed from NMI. Use a temporary manual per cpu allocation
          * until that gets sorted out.
          */
-        size = sizeof(*entries) + sizeof(struct perf_callchain_entry *) *
-                num_possible_cpus();
+        size = offsetof(struct callchain_cpus_entries, cpu_entries[nr_cpu_ids]);
 
         entries = kzalloc(size, GFP_KERNEL);
         if (!entries)
@@ -2185,13 +2765,6 @@ find_lively_task_by_vpid(pid_t vpid)
         if (!task)
                 return ERR_PTR(-ESRCH);
 
-        /*
-         * Can't attach events to a dying task.
-         */
-        err = -ESRCH;
-        if (task->flags & PF_EXITING)
-                goto errout;
-
         /* Reuse ptrace permission checks for now. */
         err = -EACCES;
         if (!ptrace_may_access(task, PTRACE_MODE_READ))
@@ -2204,6 +2777,9 @@ errout:
 
 }
 
+/*
+ * Returns a matching context with refcount and pincount.
+ */
 static struct perf_event_context *
 find_get_context(struct pmu *pmu, struct task_struct *task, int cpu)
 {
@@ -2212,14 +2788,11 @@ find_get_context(struct pmu *pmu, struct task_struct *task, int cpu)
         unsigned long flags;
         int ctxn, err;
 
-        if (!task && cpu != -1) {
+        if (!task) {
                 /* Must be root to operate on a CPU event: */
                 if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
                         return ERR_PTR(-EACCES);
 
-                if (cpu < 0 || cpu >= nr_cpumask_bits)
-                        return ERR_PTR(-EINVAL);
-
                 /*
                  * We could be clever and allow to attach a event to an
                  * offline CPU and activate it when the CPU comes up, but
@@ -2231,6 +2804,7 @@ find_get_context(struct pmu *pmu, struct task_struct *task, int cpu)
                 cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
                 ctx = &cpuctx->ctx;
                 get_ctx(ctx);
+                ++ctx->pin_count;
 
                 return ctx;
         }
@@ -2244,6 +2818,7 @@ retry:
         ctx = perf_lock_task_context(task, ctxn, &flags);
         if (ctx) {
                 unclone_ctx(ctx);
+                ++ctx->pin_count;
                 raw_spin_unlock_irqrestore(&ctx->lock, flags);
         }
 
@@ -2255,14 +2830,29 @@ retry:
 
                 get_ctx(ctx);
 
-                if (cmpxchg(&task->perf_event_ctxp[ctxn], NULL, ctx)) {
-                        /*
-                         * We raced with some other task; use
-                         * the context they set.
-                         */
+                err = 0;
+                mutex_lock(&task->perf_event_mutex);
+                /*
+                 * If it has already passed perf_event_exit_task().
+                 * we must see PF_EXITING, it takes this mutex too.
+                 */
+                if (task->flags & PF_EXITING)
+                        err = -ESRCH;
+                else if (task->perf_event_ctxp[ctxn])
+                        err = -EAGAIN;
+                else {
+                        ++ctx->pin_count;
+                        rcu_assign_pointer(task->perf_event_ctxp[ctxn], ctx);
+                }
+                mutex_unlock(&task->perf_event_mutex);
+
+                if (unlikely(err)) {
                         put_task_struct(task);
                         kfree(ctx);
-                        goto retry;
+
+                        if (err == -EAGAIN)
+                                goto retry;
+                        goto errout;
                 }
         }
 
@@ -2293,7 +2883,7 @@ static void free_event(struct perf_event *event)
 
         if (!event->parent) {
                 if (event->attach_state & PERF_ATTACH_TASK)
-                        jump_label_dec(&perf_task_events);
+                        jump_label_dec(&perf_sched_events);
                 if (event->attr.mmap || event->attr.mmap_data)
                         atomic_dec(&nr_mmap_events);
                 if (event->attr.comm)
@@ -2302,6 +2892,10 @@ static void free_event(struct perf_event *event)
                         atomic_dec(&nr_task_events);
                 if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
                         put_callchain_buffers();
+                if (is_cgroup_event(event)) {
+                        atomic_dec(&per_cpu(perf_cgroup_events, event->cpu));
+                        jump_label_dec(&perf_sched_events);
+                }
         }
 
         if (event->buffer) {
@@ -2309,6 +2903,9 @@ static void free_event(struct perf_event *event)
                 event->buffer = NULL;
         }
 
+        if (is_cgroup_event(event))
+                perf_detach_cgroup(event);
+
         if (event->destroy)
                 event->destroy(event);
 
@@ -3893,7 +4490,7 @@ static int perf_event_task_match(struct perf_event *event)
         if (event->state < PERF_EVENT_STATE_INACTIVE)
                 return 0;
 
-        if (event->cpu != -1 && event->cpu != smp_processor_id())
+        if (!event_filter_match(event))
                 return 0;
 
         if (event->attr.comm || event->attr.mmap ||
@@ -4030,7 +4627,7 @@ static int perf_event_comm_match(struct perf_event *event)
         if (event->state < PERF_EVENT_STATE_INACTIVE)
                 return 0;
 
-        if (event->cpu != -1 && event->cpu != smp_processor_id())
+        if (!event_filter_match(event))
                 return 0;
 
         if (event->attr.comm)
@@ -4178,7 +4775,7 @@ static int perf_event_mmap_match(struct perf_event *event,
         if (event->state < PERF_EVENT_STATE_INACTIVE)
                 return 0;
 
-        if (event->cpu != -1 && event->cpu != smp_processor_id())
+        if (!event_filter_match(event))
                 return 0;
 
         if ((!executable && event->attr.mmap_data) ||
@@ -4376,26 +4973,14 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
         if (unlikely(!is_sampling_event(event)))
                 return 0;
 
-        if (!throttle) {
-                hwc->interrupts++;
-        } else {
-                if (hwc->interrupts != MAX_INTERRUPTS) {
-                        hwc->interrupts++;
-                        if (HZ * hwc->interrupts >
-                                        (u64)sysctl_perf_event_sample_rate) {
-                                hwc->interrupts = MAX_INTERRUPTS;
-                                perf_log_throttle(event, 0);
-                                ret = 1;
-                        }
-                } else {
-                        /*
-                         * Keep re-disabling events even though on the previous
-                         * pass we disabled it - just in case we raced with a
-                         * sched-in and the event got enabled again:
-                         */
+        if (unlikely(hwc->interrupts >= max_samples_per_tick)) {
+                if (throttle) {
+                        hwc->interrupts = MAX_INTERRUPTS;
+                        perf_log_throttle(event, 0);
                         ret = 1;
                 }
-        }
+        } else
+                hwc->interrupts++;
 
         if (event->attr.freq) {
                 u64 now = perf_clock();
@@ -4648,7 +5233,7 @@ int perf_swevent_get_recursion_context(void)
 }
 EXPORT_SYMBOL_GPL(perf_swevent_get_recursion_context);
 
-void inline perf_swevent_put_recursion_context(int rctx)
+inline void perf_swevent_put_recursion_context(int rctx)
 {
         struct swevent_htable *swhash = &__get_cpu_var(swevent_htable);
 
@@ -5032,6 +5617,10 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
         u64 period;
 
         event = container_of(hrtimer, struct perf_event, hw.hrtimer);
+
+        if (event->state != PERF_EVENT_STATE_ACTIVE)
+                return HRTIMER_NORESTART;
+
         event->pmu->read(event);
 
         perf_sample_data_init(&data, 0);
@@ -5058,9 +5647,6 @@ static void perf_swevent_start_hrtimer(struct perf_event *event)
         if (!is_sampling_event(event))
                 return;
 
-        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        hwc->hrtimer.function = perf_swevent_hrtimer;
-
         period = local64_read(&hwc->period_left);
         if (period) {
                 if (period < 0)
@@ -5087,6 +5673,30 @@ static void perf_swevent_cancel_hrtimer(struct perf_event *event)
         }
 }
 
+static void perf_swevent_init_hrtimer(struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+
+        if (!is_sampling_event(event))
+                return;
+
+        hrtimer_init(&hwc->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hwc->hrtimer.function = perf_swevent_hrtimer;
+
+        /*
+         * Since hrtimers have a fixed rate, we can do a static freq->period
+         * mapping and avoid the whole period adjust feedback stuff.
+         */
+        if (event->attr.freq) {
+                long freq = event->attr.sample_freq;
+
+                event->attr.sample_period = NSEC_PER_SEC / freq;
+                hwc->sample_period = event->attr.sample_period;
+                local64_set(&hwc->period_left, hwc->sample_period);
+                event->attr.freq = 0;
+        }
+}
+
 /*
  * Software event: cpu wall time clock
  */
@@ -5139,6 +5749,8 @@ static int cpu_clock_event_init(struct perf_event *event)
         if (event->attr.config != PERF_COUNT_SW_CPU_CLOCK)
                 return -ENOENT;
 
+        perf_swevent_init_hrtimer(event);
+
         return 0;
 }
 
@@ -5194,16 +5806,9 @@ static void task_clock_event_del(struct perf_event *event, int flags)
 
 static void task_clock_event_read(struct perf_event *event)
 {
-        u64 time;
-
-        if (!in_nmi()) {
-                update_context_time(event->ctx);
-                time = event->ctx->time;
-        } else {
-                u64 now = perf_clock();
-                u64 delta = now - event->ctx->timestamp;
-                time = event->ctx->time + delta;
-        }
+        u64 now = perf_clock();
+        u64 delta = now - event->ctx->timestamp;
+        u64 time = event->ctx->time + delta;
 
         task_clock_event_update(event, time);
 }
@@ -5216,6 +5821,8 @@ static int task_clock_event_init(struct perf_event *event)
         if (event->attr.config != PERF_COUNT_SW_TASK_CLOCK)
                 return -ENOENT;
 
+        perf_swevent_init_hrtimer(event);
+
         return 0;
 }
 
@@ -5361,6 +5968,8 @@ free_dev:
         goto out;
 }
 
+static struct lock_class_key cpuctx_mutex;
+
 int perf_pmu_register(struct pmu *pmu, char *name, int type)
 {
         int cpu, ret;
@@ -5409,6 +6018,7 @@ skip_type:
 
                 cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
                 __perf_event_init_context(&cpuctx->ctx);
+                lockdep_set_class(&cpuctx->ctx.mutex, &cpuctx_mutex);
                 cpuctx->ctx.type = cpu_context;
                 cpuctx->ctx.pmu = pmu;
                 cpuctx->jiffies_interval = 1;
@@ -5484,17 +6094,22 @@ struct pmu *perf_init_event(struct perf_event *event)
 {
         struct pmu *pmu = NULL;
         int idx;
+        int ret;
 
         idx = srcu_read_lock(&pmus_srcu);
 
         rcu_read_lock();
         pmu = idr_find(&pmu_idr, event->attr.type);
         rcu_read_unlock();
-        if (pmu)
+        if (pmu) {
+                ret = pmu->event_init(event);
+                if (ret)
+                        pmu = ERR_PTR(ret);
                 goto unlock;
+        }
 
         list_for_each_entry_rcu(pmu, &pmus, entry) {
-                int ret = pmu->event_init(event);
+                ret = pmu->event_init(event);
                 if (!ret)
                         goto unlock;
 
@@ -5525,6 +6140,11 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
         struct hw_perf_event *hwc;
         long err;
 
+        if ((unsigned)cpu >= nr_cpu_ids) {
+                if (!task || cpu != -1)
+                        return ERR_PTR(-EINVAL);
+        }
+
         event = kzalloc(sizeof(*event), GFP_KERNEL);
         if (!event)
                 return ERR_PTR(-ENOMEM);
@@ -5573,7 +6193,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 
         if (!overflow_handler && parent_event)
                 overflow_handler = parent_event->overflow_handler;
-        
+
         event->overflow_handler = overflow_handler;
 
         if (attr->disabled)
@@ -5615,7 +6235,7 @@ done:
 
         if (!event->parent) {
                 if (event->attach_state & PERF_ATTACH_TASK)
-                        jump_label_inc(&perf_task_events);
+                        jump_label_inc(&perf_sched_events);
                 if (event->attr.mmap || event->attr.mmap_data)
                         atomic_inc(&nr_mmap_events);
                 if (event->attr.comm)
@@ -5790,7 +6410,7 @@ SYSCALL_DEFINE5(perf_event_open,
         int err;
 
         /* for future expandability... */
-        if (flags & ~(PERF_FLAG_FD_NO_GROUP | PERF_FLAG_FD_OUTPUT))
+        if (flags & ~PERF_FLAG_ALL)
                 return -EINVAL;
 
         err = perf_copy_attr(attr_uptr, &attr);
@@ -5807,6 +6427,15 @@ SYSCALL_DEFINE5(perf_event_open,
                         return -EINVAL;
         }
 
+        /*
+         * In cgroup mode, the pid argument is used to pass the fd
+         * opened to the cgroup directory in cgroupfs. The cpu argument
+         * designates the cpu on which to monitor threads from that
+         * cgroup.
+         */
+        if ((flags & PERF_FLAG_PID_CGROUP) && (pid == -1 || cpu == -1))
+                return -EINVAL;
+
         event_fd = get_unused_fd_flags(O_RDWR);
         if (event_fd < 0)
                 return event_fd;
@@ -5824,7 +6453,7 @@ SYSCALL_DEFINE5(perf_event_open,
                         group_leader = NULL;
         }
 
-        if (pid != -1) {
+        if (pid != -1 && !(flags & PERF_FLAG_PID_CGROUP)) {
                 task = find_lively_task_by_vpid(pid);
                 if (IS_ERR(task)) {
                         err = PTR_ERR(task);
@@ -5838,6 +6467,19 @@ SYSCALL_DEFINE5(perf_event_open,
                 goto err_task;
         }
 
+        if (flags & PERF_FLAG_PID_CGROUP) {
+                err = perf_cgroup_connect(pid, event, &attr, group_leader);
+                if (err)
+                        goto err_alloc;
+                /*
+                 * one more event:
+                 * - that has cgroup constraint on event->cpu
+                 * - that may need work on context switch
+                 */
+                atomic_inc(&per_cpu(perf_cgroup_events, event->cpu));
+                jump_label_inc(&perf_sched_events);
+        }
+
         /*
          * Special case software events and allow them to be part of
          * any hardware group.
@@ -5923,10 +6565,10 @@ SYSCALL_DEFINE5(perf_event_open,
                 struct perf_event_context *gctx = group_leader->ctx;
 
                 mutex_lock(&gctx->mutex);
-                perf_event_remove_from_context(group_leader);
+                perf_remove_from_context(group_leader);
                 list_for_each_entry(sibling, &group_leader->sibling_list,
                                     group_entry) {
-                        perf_event_remove_from_context(sibling);
+                        perf_remove_from_context(sibling);
                         put_ctx(gctx);
                 }
                 mutex_unlock(&gctx->mutex);
@@ -5949,6 +6591,7 @@ SYSCALL_DEFINE5(perf_event_open,
 
         perf_install_in_context(ctx, event, cpu);
         ++ctx->generation;
+        perf_unpin_context(ctx);
         mutex_unlock(&ctx->mutex);
 
         event->owner = current;
@@ -5974,6 +6617,7 @@ SYSCALL_DEFINE5(perf_event_open,
         return event_fd;
 
 err_context:
+        perf_unpin_context(ctx);
         put_ctx(ctx);
 err_alloc:
         free_event(event);
@@ -6024,6 +6668,7 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
         mutex_lock(&ctx->mutex);
         perf_install_in_context(ctx, event, cpu);
         ++ctx->generation;
+        perf_unpin_context(ctx);
         mutex_unlock(&ctx->mutex);
 
         return event;
@@ -6077,7 +6722,7 @@ __perf_event_exit_task(struct perf_event *child_event,
 {
         struct perf_event *parent_event;
 
-        perf_event_remove_from_context(child_event);
+        perf_remove_from_context(child_event);
 
         parent_event = child_event->parent;
         /*
@@ -6109,7 +6754,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
          * scheduled, so we are now safe from rescheduling changing
          * our context.
          */
-        child_ctx = child->perf_event_ctxp[ctxn];
+        child_ctx = rcu_dereference_raw(child->perf_event_ctxp[ctxn]);
         task_ctx_sched_out(child_ctx, EVENT_ALL);
 
         /*
@@ -6384,7 +7029,7 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
                 return 0;
         }
 
-        child_ctx = child->perf_event_ctxp[ctxn];
+        child_ctx = child->perf_event_ctxp[ctxn];
         if (!child_ctx) {
                 /*
                  * This is executed from the parent task context, so
@@ -6422,11 +7067,6 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
         unsigned long flags;
         int ret = 0;
 
-        child->perf_event_ctxp[ctxn] = NULL;
-
-        mutex_init(&child->perf_event_mutex);
-        INIT_LIST_HEAD(&child->perf_event_list);
-
         if (likely(!parent->perf_event_ctxp[ctxn]))
                 return 0;
 
@@ -6478,7 +7118,6 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
 
         raw_spin_lock_irqsave(&parent_ctx->lock, flags);
         parent_ctx->rotate_disable = 0;
-        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
 
         child_ctx = child->perf_event_ctxp[ctxn];
 
@@ -6486,12 +7125,11 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
                 /*
                  * Mark the child context as a clone of the parent
                  * context, or of whatever the parent is a clone of.
-                 * Note that if the parent is a clone, it could get
-                 * uncloned at any point, but that doesn't matter
-                 * because the list of events and the generation
-                 * count can't have changed since we took the mutex.
+                 *
+                 * Note that if the parent is a clone, the holding of
+                 * parent_ctx->lock avoids it from being uncloned.
                  */
-                cloned_ctx = rcu_dereference(parent_ctx->parent_ctx);
+                cloned_ctx = parent_ctx->parent_ctx;
                 if (cloned_ctx) {
                         child_ctx->parent_ctx = cloned_ctx;
                         child_ctx->parent_gen = parent_ctx->parent_gen;
@@ -6502,9 +7140,11 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
                 get_ctx(child_ctx->parent_ctx);
         }
 
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
         mutex_unlock(&parent_ctx->mutex);
 
         perf_unpin_context(parent_ctx);
+        put_ctx(parent_ctx);
 
         return ret;
 }
@@ -6516,6 +7156,10 @@ int perf_event_init_task(struct task_struct *child)
 {
         int ctxn, ret;
 
+        memset(child->perf_event_ctxp, 0, sizeof(child->perf_event_ctxp));
+        mutex_init(&child->perf_event_mutex);
+        INIT_LIST_HEAD(&child->perf_event_list);
+
         for_each_task_context_nr(ctxn) {
                 ret = perf_event_init_context(child, ctxn);
                 if (ret)
@@ -6570,9 +7214,9 @@ static void __perf_event_exit_context(void *__info)
         perf_pmu_rotate_stop(ctx->pmu);
 
         list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
-                __perf_event_remove_from_context(event);
+                __perf_remove_from_context(event);
         list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry)
-                __perf_event_remove_from_context(event);
+                __perf_remove_from_context(event);
 }
 
 static void perf_event_exit_cpu_context(int cpu)
@@ -6696,3 +7340,83 @@ unlock:
         return ret;
 }
 device_initcall(perf_event_sysfs_init);
+
+#ifdef CONFIG_CGROUP_PERF
+static struct cgroup_subsys_state *perf_cgroup_create(
+        struct cgroup_subsys *ss, struct cgroup *cont)
+{
+        struct perf_cgroup *jc;
+
+        jc = kzalloc(sizeof(*jc), GFP_KERNEL);
+        if (!jc)
+                return ERR_PTR(-ENOMEM);
+
+        jc->info = alloc_percpu(struct perf_cgroup_info);
+        if (!jc->info) {
+                kfree(jc);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        return &jc->css;
+}
+
+static void perf_cgroup_destroy(struct cgroup_subsys *ss,
+                                struct cgroup *cont)
+{
+        struct perf_cgroup *jc;
+        jc = container_of(cgroup_subsys_state(cont, perf_subsys_id),
+                          struct perf_cgroup, css);
+        free_percpu(jc->info);
+        kfree(jc);
+}
+
+static int __perf_cgroup_move(void *info)
+{
+        struct task_struct *task = info;
+        perf_cgroup_switch(task, PERF_CGROUP_SWOUT | PERF_CGROUP_SWIN);
+        return 0;
+}
+
+static void perf_cgroup_move(struct task_struct *task)
+{
+        task_function_call(task, __perf_cgroup_move, task);
+}
+
+static void perf_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
+                struct cgroup *old_cgrp, struct task_struct *task,
+                bool threadgroup)
+{
+        perf_cgroup_move(task);
+        if (threadgroup) {
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &task->thread_group, thread_group) {
+                        perf_cgroup_move(c);
+                }
+                rcu_read_unlock();
+        }
+}
+
+static void perf_cgroup_exit(struct cgroup_subsys *ss, struct cgroup *cgrp,
+                struct cgroup *old_cgrp, struct task_struct *task)
+{
+        /*
+         * cgroup_exit() is called in the copy_process() failure path.
+         * Ignore this case since the task hasn't ran yet, this avoids
+         * trying to poke a half freed task state from generic code.
+         */
+        if (!(task->flags & PF_EXITING))
+                return;
+
+        perf_cgroup_move(task);
+}
+
+struct cgroup_subsys perf_subsys = {
+        .name = "perf_event",
+        .subsys_id = perf_subsys_id,
+        .create = perf_cgroup_create,
+        .destroy = perf_cgroup_destroy,
+        .exit = perf_cgroup_exit,
+        .attach = perf_cgroup_attach,
+};
+#endif /* CONFIG_CGROUP_PERF */
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 05bb7173850e..67fea9d25d55 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -176,7 +176,8 @@ static inline cputime_t virt_ticks(struct task_struct *p)
         return p->utime;
 }
 
-int posix_cpu_clock_getres(const clockid_t which_clock, struct timespec *tp)
+static int
+posix_cpu_clock_getres(const clockid_t which_clock, struct timespec *tp)
 {
         int error = check_clock(which_clock);
         if (!error) {
@@ -194,7 +195,8 @@ int posix_cpu_clock_getres(const clockid_t which_clock, struct timespec *tp)
         return error;
 }
 
-int posix_cpu_clock_set(const clockid_t which_clock, const struct timespec *tp)
+static int
+posix_cpu_clock_set(const clockid_t which_clock, const struct timespec *tp)
 {
         /*
          * You can never reset a CPU clock, but we check for other errors
@@ -317,7 +319,7 @@ static int cpu_clock_sample_group(const clockid_t which_clock,
 }
 
 
-int posix_cpu_clock_get(const clockid_t which_clock, struct timespec *tp)
+static int posix_cpu_clock_get(const clockid_t which_clock, struct timespec *tp)
 {
         const pid_t pid = CPUCLOCK_PID(which_clock);
         int error = -EINVAL;
@@ -379,7 +381,7 @@ int posix_cpu_clock_get(const clockid_t which_clock, struct timespec *tp)
  * This is called from sys_timer_create() and do_cpu_nanosleep() with the
  * new timer already all-zeros initialized.
  */
-int posix_cpu_timer_create(struct k_itimer *new_timer)
+static int posix_cpu_timer_create(struct k_itimer *new_timer)
 {
         int ret = 0;
         const pid_t pid = CPUCLOCK_PID(new_timer->it_clock);
@@ -425,7 +427,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
  * If we return TIMER_RETRY, it's necessary to release the timer's lock
  * and try again.  (This happens when the timer is in the middle of firing.)
  */
-int posix_cpu_timer_del(struct k_itimer *timer)
+static int posix_cpu_timer_del(struct k_itimer *timer)
 {
         struct task_struct *p = timer->it.cpu.task;
         int ret = 0;
@@ -665,8 +667,8 @@ static int cpu_timer_sample_group(const clockid_t which_clock,
  * If we return TIMER_RETRY, it's necessary to release the timer's lock
  * and try again.  (This happens when the timer is in the middle of firing.)
  */
-int posix_cpu_timer_set(struct k_itimer *timer, int flags,
-                        struct itimerspec *new, struct itimerspec *old)
+static int posix_cpu_timer_set(struct k_itimer *timer, int flags,
+                               struct itimerspec *new, struct itimerspec *old)
 {
         struct task_struct *p = timer->it.cpu.task;
         union cpu_time_count old_expires, new_expires, old_incr, val;
@@ -820,7 +822,7 @@ int posix_cpu_timer_set(struct k_itimer *timer, int flags,
         return ret;
 }
 
-void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
+static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
 {
         union cpu_time_count now;
         struct task_struct *p = timer->it.cpu.task;
@@ -1481,11 +1483,13 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
         return error;
 }
 
-int posix_cpu_nsleep(const clockid_t which_clock, int flags,
-                     struct timespec *rqtp, struct timespec __user *rmtp)
+static long posix_cpu_nsleep_restart(struct restart_block *restart_block);
+
+static int posix_cpu_nsleep(const clockid_t which_clock, int flags,
+                            struct timespec *rqtp, struct timespec __user *rmtp)
 {
         struct restart_block *restart_block =
-            &current_thread_info()->restart_block;
+                &current_thread_info()->restart_block;
         struct itimerspec it;
         int error;
 
@@ -1501,56 +1505,47 @@ int posix_cpu_nsleep(const clockid_t which_clock, int flags,
 
         if (error == -ERESTART_RESTARTBLOCK) {
 
-                if (flags & TIMER_ABSTIME)
+                if (flags & TIMER_ABSTIME)
                         return -ERESTARTNOHAND;
                 /*
-                 * Report back to the user the time still remaining.
-                 */
-                if (rmtp != NULL && copy_to_user(rmtp, &it.it_value, sizeof *rmtp))
+                 * Report back to the user the time still remaining.
+                 */
+                if (rmtp && copy_to_user(rmtp, &it.it_value, sizeof *rmtp))
                         return -EFAULT;
 
                 restart_block->fn = posix_cpu_nsleep_restart;
-                restart_block->arg0 = which_clock;
-                restart_block->arg1 = (unsigned long) rmtp;
-                restart_block->arg2 = rqtp->tv_sec;
-                restart_block->arg3 = rqtp->tv_nsec;
+                restart_block->nanosleep.index = which_clock;
+                restart_block->nanosleep.rmtp = rmtp;
+                restart_block->nanosleep.expires = timespec_to_ns(rqtp);
         }
         return error;
 }
 
-long posix_cpu_nsleep_restart(struct restart_block *restart_block)
+static long posix_cpu_nsleep_restart(struct restart_block *restart_block)
 {
-        clockid_t which_clock = restart_block->arg0;
-        struct timespec __user *rmtp;
+        clockid_t which_clock = restart_block->nanosleep.index;
         struct timespec t;
         struct itimerspec it;
         int error;
 
-        rmtp = (struct timespec __user *) restart_block->arg1;
-        t.tv_sec = restart_block->arg2;
-        t.tv_nsec = restart_block->arg3;
+        t = ns_to_timespec(restart_block->nanosleep.expires);
 
-        restart_block->fn = do_no_restart_syscall;
         error = do_cpu_nanosleep(which_clock, TIMER_ABSTIME, &t, &it);
 
         if (error == -ERESTART_RESTARTBLOCK) {
+                struct timespec __user *rmtp = restart_block->nanosleep.rmtp;
                 /*
-                 * Report back to the user the time still remaining.
-                 */
-                if (rmtp != NULL && copy_to_user(rmtp, &it.it_value, sizeof *rmtp))
+                 * Report back to the user the time still remaining.
+                 */
+                if (rmtp && copy_to_user(rmtp, &it.it_value, sizeof *rmtp))
                         return -EFAULT;
 
-                restart_block->fn = posix_cpu_nsleep_restart;
-                restart_block->arg0 = which_clock;
-                restart_block->arg1 = (unsigned long) rmtp;
-                restart_block->arg2 = t.tv_sec;
-                restart_block->arg3 = t.tv_nsec;
+                restart_block->nanosleep.expires = timespec_to_ns(&t);
         }
         return error;
 
 }
 
-
 #define PROCESS_CLOCK   MAKE_PROCESS_CPUCLOCK(0, CPUCLOCK_SCHED)
 #define THREAD_CLOCK    MAKE_THREAD_CPUCLOCK(0, CPUCLOCK_SCHED)
 
@@ -1594,38 +1589,37 @@ static int thread_cpu_timer_create(struct k_itimer *timer)
         timer->it_clock = THREAD_CLOCK;
         return posix_cpu_timer_create(timer);
 }
-static int thread_cpu_nsleep(const clockid_t which_clock, int flags,
-                              struct timespec *rqtp, struct timespec __user *rmtp)
-{
-        return -EINVAL;
-}
-static long thread_cpu_nsleep_restart(struct restart_block *restart_block)
-{
-        return -EINVAL;
-}
+
+struct k_clock clock_posix_cpu = {
+        .clock_getres   = posix_cpu_clock_getres,
+        .clock_set      = posix_cpu_clock_set,
+        .clock_get      = posix_cpu_clock_get,
+        .timer_create   = posix_cpu_timer_create,
+        .nsleep         = posix_cpu_nsleep,
+        .nsleep_restart = posix_cpu_nsleep_restart,
+        .timer_set      = posix_cpu_timer_set,
+        .timer_del      = posix_cpu_timer_del,
+        .timer_get      = posix_cpu_timer_get,
+};
 
 static __init int init_posix_cpu_timers(void)
 {
         struct k_clock process = {
-                .clock_getres = process_cpu_clock_getres,
-                .clock_get = process_cpu_clock_get,
-                .clock_set = do_posix_clock_nosettime,
-                .timer_create = process_cpu_timer_create,
-                .nsleep = process_cpu_nsleep,
-                .nsleep_restart = process_cpu_nsleep_restart,
+                .clock_getres   = process_cpu_clock_getres,
+                .clock_get      = process_cpu_clock_get,
+                .timer_create   = process_cpu_timer_create,
+                .nsleep         = process_cpu_nsleep,
+                .nsleep_restart = process_cpu_nsleep_restart,
         };
         struct k_clock thread = {
-                .clock_getres = thread_cpu_clock_getres,
-                .clock_get = thread_cpu_clock_get,
-                .clock_set = do_posix_clock_nosettime,
-                .timer_create = thread_cpu_timer_create,
-                .nsleep = thread_cpu_nsleep,
-                .nsleep_restart = thread_cpu_nsleep_restart,
+                .clock_getres   = thread_cpu_clock_getres,
+                .clock_get      = thread_cpu_clock_get,
+                .timer_create   = thread_cpu_timer_create,
         };
         struct timespec ts;
 
-        register_posix_clock(CLOCK_PROCESS_CPUTIME_ID, &process);
-        register_posix_clock(CLOCK_THREAD_CPUTIME_ID, &thread);
+        posix_timers_register_clock(CLOCK_PROCESS_CPUTIME_ID, &process);
+        posix_timers_register_clock(CLOCK_THREAD_CPUTIME_ID, &thread);
 
         cputime_to_timespec(cputime_one_jiffy, &ts);
         onecputick = ts.tv_nsec;
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 93bd2eb2bc53..4c0124919f9a 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -41,6 +41,7 @@
 #include <linux/init.h>
 #include <linux/compiler.h>
 #include <linux/idr.h>
+#include <linux/posix-clock.h>
 #include <linux/posix-timers.h>
 #include <linux/syscalls.h>
 #include <linux/wait.h>
@@ -81,6 +82,14 @@ static DEFINE_SPINLOCK(idr_lock);
 #error "SIGEV_THREAD_ID must not share bit with other SIGEV values!"
 #endif
 
+/*
+ * parisc wants ENOTSUP instead of EOPNOTSUPP
+ */
+#ifndef ENOTSUP
+# define ENANOSLEEP_NOTSUP EOPNOTSUPP
+#else
+# define ENANOSLEEP_NOTSUP ENOTSUP
+#endif
 
 /*
  * The timer ID is turned into a timer address by idr_find().
@@ -94,11 +103,7 @@ static DEFINE_SPINLOCK(idr_lock);
 /*
  * CLOCKs: The POSIX standard calls for a couple of clocks and allows us
  *          to implement others.  This structure defines the various
- *          clocks and allows the possibility of adding others.  We
- *          provide an interface to add clocks to the table and expect
- *          the "arch" code to add at least one clock that is high
- *          resolution.  Here we define the standard CLOCK_REALTIME as a
- *          1/HZ resolution clock.
+ *          clocks.
  *
  * RESOLUTION: Clock resolution is used to round up timer and interval
  *          times, NOT to report clock times, which are reported with as
@@ -108,20 +113,13 @@ static DEFINE_SPINLOCK(idr_lock);
  *          necessary code is written.  The standard says we should say
  *          something about this issue in the documentation...
  *
- * FUNCTIONS: The CLOCKs structure defines possible functions to handle
- *          various clock functions.  For clocks that use the standard
- *          system timer code these entries should be NULL.  This will
- *          allow dispatch without the overhead of indirect function
- *          calls.  CLOCKS that depend on other sources (e.g. WWV or GPS)
- *          must supply functions here, even if the function just returns
- *          ENOSYS.  The standard POSIX timer management code assumes the
- *          following: 1.) The k_itimer struct (sched.h) is used for the
- *          timer.  2.) The list, it_lock, it_clock, it_id and it_pid
- *          fields are not modified by timer code.
+ * FUNCTIONS: The CLOCKs structure defines possible functions to
+ *          handle various clock functions.
  *
- *          At this time all functions EXCEPT clock_nanosleep can be
- *          redirected by the CLOCKS structure.  Clock_nanosleep is in
- *          there, but the code ignores it.
+ *          The standard POSIX timer management code assumes the
+ *          following: 1.) The k_itimer struct (sched.h) is used for
+ *          the timer.  2.) The list, it_lock, it_clock, it_id and
+ *          it_pid fields are not modified by timer code.
  *
  * Permissions: It is assumed that the clock_settime() function defined
  *          for each clock will take care of permission checks.  Some
@@ -138,6 +136,7 @@ static struct k_clock posix_clocks[MAX_CLOCKS];
  */
 static int common_nsleep(const clockid_t, int flags, struct timespec *t,
                          struct timespec __user *rmtp);
+static int common_timer_create(struct k_itimer *new_timer);
 static void common_timer_get(struct k_itimer *, struct itimerspec *);
 static int common_timer_set(struct k_itimer *, int,
                             struct itimerspec *, struct itimerspec *);
@@ -158,76 +157,24 @@ static inline void unlock_timer(struct k_itimer *timr, unsigned long flags)
         spin_unlock_irqrestore(&timr->it_lock, flags);
 }
 
-/*
- * Call the k_clock hook function if non-null, or the default function.
- */
-#define CLOCK_DISPATCH(clock, call, arglist) \
-        ((clock) < 0 ? posix_cpu_##call arglist : \
-         (posix_clocks[clock].call != NULL \
-          ? (*posix_clocks[clock].call) arglist : common_##call arglist))
-
-/*
- * Default clock hook functions when the struct k_clock passed
- * to register_posix_clock leaves a function pointer null.
- *
- * The function common_CALL is the default implementation for
- * the function pointer CALL in struct k_clock.
- */
-
-static inline int common_clock_getres(const clockid_t which_clock,
-                                      struct timespec *tp)
-{
-        tp->tv_sec = 0;
-        tp->tv_nsec = posix_clocks[which_clock].res;
-        return 0;
-}
-
-/*
- * Get real time for posix timers
- */
-static int common_clock_get(clockid_t which_clock, struct timespec *tp)
+/* Get clock_realtime */
+static int posix_clock_realtime_get(clockid_t which_clock, struct timespec *tp)
 {
         ktime_get_real_ts(tp);
         return 0;
 }
 
-static inline int common_clock_set(const clockid_t which_clock,
-                                   struct timespec *tp)
+/* Set clock_realtime */
+static int posix_clock_realtime_set(const clockid_t which_clock,
+                                    const struct timespec *tp)
 {
         return do_sys_settimeofday(tp, NULL);
 }
 
-static int common_timer_create(struct k_itimer *new_timer)
-{
-        hrtimer_init(&new_timer->it.real.timer, new_timer->it_clock, 0);
-        return 0;
-}
-
-static int no_timer_create(struct k_itimer *new_timer)
-{
-        return -EOPNOTSUPP;
-}
-
-static int no_nsleep(const clockid_t which_clock, int flags,
-                     struct timespec *tsave, struct timespec __user *rmtp)
-{
-        return -EOPNOTSUPP;
-}
-
-/*
- * Return nonzero if we know a priori this clockid_t value is bogus.
- */
-static inline int invalid_clockid(const clockid_t which_clock)
+static int posix_clock_realtime_adj(const clockid_t which_clock,
+                                    struct timex *t)
 {
-        if (which_clock < 0)    /* CPU clock, posix_cpu_* will check it */
-                return 0;
-        if ((unsigned) which_clock >= MAX_CLOCKS)
-                return 1;
-        if (posix_clocks[which_clock].clock_getres != NULL)
-                return 0;
-        if (posix_clocks[which_clock].res != 0)
-                return 0;
-        return 1;
+        return do_adjtimex(t);
 }
 
 /*
@@ -240,7 +187,7 @@ static int posix_ktime_get_ts(clockid_t which_clock, struct timespec *tp)
 }
 
 /*
- * Get monotonic time for posix timers
+ * Get monotonic-raw time for posix timers
  */
 static int posix_get_monotonic_raw(clockid_t which_clock, struct timespec *tp)
 {
@@ -267,46 +214,70 @@ static int posix_get_coarse_res(const clockid_t which_clock, struct timespec *tp
         *tp = ktime_to_timespec(KTIME_LOW_RES);
         return 0;
 }
+
+static int posix_get_boottime(const clockid_t which_clock, struct timespec *tp)
+{
+        get_monotonic_boottime(tp);
+        return 0;
+}
+
+
 /*
  * Initialize everything, well, just everything in Posix clocks/timers ;)
  */
 static __init int init_posix_timers(void)
 {
         struct k_clock clock_realtime = {
-                .clock_getres = hrtimer_get_res,
+                .clock_getres   = hrtimer_get_res,
+                .clock_get      = posix_clock_realtime_get,
+                .clock_set      = posix_clock_realtime_set,
+                .clock_adj      = posix_clock_realtime_adj,
+                .nsleep         = common_nsleep,
+                .nsleep_restart = hrtimer_nanosleep_restart,
+                .timer_create   = common_timer_create,
+                .timer_set      = common_timer_set,
+                .timer_get      = common_timer_get,
+                .timer_del      = common_timer_del,
         };
         struct k_clock clock_monotonic = {
-                .clock_getres = hrtimer_get_res,
-                .clock_get = posix_ktime_get_ts,
-                .clock_set = do_posix_clock_nosettime,
+                .clock_getres   = hrtimer_get_res,
+                .clock_get      = posix_ktime_get_ts,
+                .nsleep         = common_nsleep,
+                .nsleep_restart = hrtimer_nanosleep_restart,
+                .timer_create   = common_timer_create,
+                .timer_set      = common_timer_set,
+                .timer_get      = common_timer_get,
+                .timer_del      = common_timer_del,
         };
         struct k_clock clock_monotonic_raw = {
-                .clock_getres = hrtimer_get_res,
-                .clock_get = posix_get_monotonic_raw,
-                .clock_set = do_posix_clock_nosettime,
-                .timer_create = no_timer_create,
-                .nsleep = no_nsleep,
+                .clock_getres   = hrtimer_get_res,
+                .clock_get      = posix_get_monotonic_raw,
         };
         struct k_clock clock_realtime_coarse = {
-                .clock_getres = posix_get_coarse_res,
-                .clock_get = posix_get_realtime_coarse,
-                .clock_set = do_posix_clock_nosettime,
-                .timer_create = no_timer_create,
-                .nsleep = no_nsleep,
+                .clock_getres   = posix_get_coarse_res,
+                .clock_get      = posix_get_realtime_coarse,
         };
         struct k_clock clock_monotonic_coarse = {
-                .clock_getres = posix_get_coarse_res,
-                .clock_get = posix_get_monotonic_coarse,
-                .clock_set = do_posix_clock_nosettime,
-                .timer_create = no_timer_create,
-                .nsleep = no_nsleep,
+                .clock_getres   = posix_get_coarse_res,
+                .clock_get      = posix_get_monotonic_coarse,
+        };
+        struct k_clock clock_boottime = {
+                .clock_getres   = hrtimer_get_res,
+                .clock_get      = posix_get_boottime,
+                .nsleep         = common_nsleep,
+                .nsleep_restart = hrtimer_nanosleep_restart,
+                .timer_create   = common_timer_create,
+                .timer_set      = common_timer_set,
+                .timer_get      = common_timer_get,
+                .timer_del      = common_timer_del,
         };
 
-        register_posix_clock(CLOCK_REALTIME, &clock_realtime);
-        register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
-        register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
-        register_posix_clock(CLOCK_REALTIME_COARSE, &clock_realtime_coarse);
-        register_posix_clock(CLOCK_MONOTONIC_COARSE, &clock_monotonic_coarse);
+        posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
+        posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
+        posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
+        posix_timers_register_clock(CLOCK_REALTIME_COARSE, &clock_realtime_coarse);
+        posix_timers_register_clock(CLOCK_MONOTONIC_COARSE, &clock_monotonic_coarse);
+        posix_timers_register_clock(CLOCK_BOOTTIME, &clock_boottime);
 
         posix_timers_cache = kmem_cache_create("posix_timers_cache",
                                         sizeof (struct k_itimer), 0, SLAB_PANIC,
@@ -482,17 +453,29 @@ static struct pid *good_sigevent(sigevent_t * event)
         return task_pid(rtn);
 }
 
-void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock)
+void posix_timers_register_clock(const clockid_t clock_id,
+                                 struct k_clock *new_clock)
 {
         if ((unsigned) clock_id >= MAX_CLOCKS) {
-                printk("POSIX clock register failed for clock_id %d\n",
+                printk(KERN_WARNING "POSIX clock register failed for clock_id %d\n",
+                       clock_id);
+                return;
+        }
+
+        if (!new_clock->clock_get) {
+                printk(KERN_WARNING "POSIX clock id %d lacks clock_get()\n",
+                       clock_id);
+                return;
+        }
+        if (!new_clock->clock_getres) {
+                printk(KERN_WARNING "POSIX clock id %d lacks clock_getres()\n",
                        clock_id);
                 return;
         }
 
         posix_clocks[clock_id] = *new_clock;
 }
-EXPORT_SYMBOL_GPL(register_posix_clock);
+EXPORT_SYMBOL_GPL(posix_timers_register_clock);
 
 static struct k_itimer * alloc_posix_timer(void)
 {
@@ -523,19 +506,39 @@ static void release_posix_timer(struct k_itimer *tmr, int it_id_set)
         kmem_cache_free(posix_timers_cache, tmr);
 }
 
+static struct k_clock *clockid_to_kclock(const clockid_t id)
+{
+        if (id < 0)
+                return (id & CLOCKFD_MASK) == CLOCKFD ?
+                        &clock_posix_dynamic : &clock_posix_cpu;
+
+        if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
+                return NULL;
+        return &posix_clocks[id];
+}
+
+static int common_timer_create(struct k_itimer *new_timer)
+{
+        hrtimer_init(&new_timer->it.real.timer, new_timer->it_clock, 0);
+        return 0;
+}
+
 /* Create a POSIX.1b interval timer. */
 
 SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
                 struct sigevent __user *, timer_event_spec,
                 timer_t __user *, created_timer_id)
 {
+        struct k_clock *kc = clockid_to_kclock(which_clock);
         struct k_itimer *new_timer;
         int error, new_timer_id;
         sigevent_t event;
         int it_id_set = IT_ID_NOT_SET;
 
-        if (invalid_clockid(which_clock))
+        if (!kc)
                 return -EINVAL;
+        if (!kc->timer_create)
+                return -EOPNOTSUPP;
 
         new_timer = alloc_posix_timer();
         if (unlikely(!new_timer))
@@ -597,7 +600,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
                 goto out;
         }
 
-        error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer));
+        error = kc->timer_create(new_timer);
         if (error)
                 goto out;
 
@@ -607,7 +610,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
         spin_unlock_irq(&current->sighand->siglock);
 
         return 0;
-        /*
+        /*
          * In the case of the timer belonging to another task, after
          * the task is unlocked, the timer is owned by the other task
          * and may cease to exist at any time.  Don't use or modify
@@ -709,22 +712,28 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting)
 SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
                 struct itimerspec __user *, setting)
 {
-        struct k_itimer *timr;
         struct itimerspec cur_setting;
+        struct k_itimer *timr;
+        struct k_clock *kc;
         unsigned long flags;
+        int ret = 0;
 
         timr = lock_timer(timer_id, &flags);
         if (!timr)
                 return -EINVAL;
 
-        CLOCK_DISPATCH(timr->it_clock, timer_get, (timr, &cur_setting));
+        kc = clockid_to_kclock(timr->it_clock);
+        if (WARN_ON_ONCE(!kc || !kc->timer_get))
+                ret = -EINVAL;
+        else
+                kc->timer_get(timr, &cur_setting);
 
         unlock_timer(timr, flags);
 
-        if (copy_to_user(setting, &cur_setting, sizeof (cur_setting)))
+        if (!ret && copy_to_user(setting, &cur_setting, sizeof (cur_setting)))
                 return -EFAULT;
 
-        return 0;
+        return ret;
 }
 
 /*
@@ -813,6 +822,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t, timer_id, int, flags,
         int error = 0;
         unsigned long flag;
         struct itimerspec *rtn = old_setting ? &old_spec : NULL;
+        struct k_clock *kc;
 
         if (!new_setting)
                 return -EINVAL;
@@ -828,8 +838,11 @@ retry:
         if (!timr)
                 return -EINVAL;
 
-        error = CLOCK_DISPATCH(timr->it_clock, timer_set,
-                               (timr, flags, &new_spec, rtn));
+        kc = clockid_to_kclock(timr->it_clock);
+        if (WARN_ON_ONCE(!kc || !kc->timer_set))
+                error = -EINVAL;
+        else
+                error = kc->timer_set(timr, flags, &new_spec, rtn);
 
         unlock_timer(timr, flag);
         if (error == TIMER_RETRY) {
@@ -844,7 +857,7 @@ retry:
         return error;
 }
 
-static inline int common_timer_del(struct k_itimer *timer)
+static int common_timer_del(struct k_itimer *timer)
 {
         timer->it.real.interval.tv64 = 0;
 
@@ -855,7 +868,11 @@ static inline int common_timer_del(struct k_itimer *timer)
 
 static inline int timer_delete_hook(struct k_itimer *timer)
 {
-        return CLOCK_DISPATCH(timer->it_clock, timer_del, (timer));
+        struct k_clock *kc = clockid_to_kclock(timer->it_clock);
+
+        if (WARN_ON_ONCE(!kc || !kc->timer_del))
+                return -EINVAL;
+        return kc->timer_del(timer);
 }
 
 /* Delete a POSIX.1b interval timer. */
@@ -927,69 +944,76 @@ void exit_itimers(struct signal_struct *sig)
         }
 }
 
-/* Not available / possible... functions */
-int do_posix_clock_nosettime(const clockid_t clockid, struct timespec *tp)
-{
-        return -EINVAL;
-}
-EXPORT_SYMBOL_GPL(do_posix_clock_nosettime);
-
-int do_posix_clock_nonanosleep(const clockid_t clock, int flags,
-                               struct timespec *t, struct timespec __user *r)
-{
-#ifndef ENOTSUP
-        return -EOPNOTSUPP;     /* aka ENOTSUP in userland for POSIX */
-#else  /*  parisc does define it separately.  */
-        return -ENOTSUP;
-#endif
-}
-EXPORT_SYMBOL_GPL(do_posix_clock_nonanosleep);
-
 SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
                 const struct timespec __user *, tp)
 {
+        struct k_clock *kc = clockid_to_kclock(which_clock);
         struct timespec new_tp;
 
-        if (invalid_clockid(which_clock))
+        if (!kc || !kc->clock_set)
                 return -EINVAL;
+
         if (copy_from_user(&new_tp, tp, sizeof (*tp)))
                 return -EFAULT;
 
-        return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
+        return kc->clock_set(which_clock, &new_tp);
 }
 
 SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
                 struct timespec __user *,tp)
 {
+        struct k_clock *kc = clockid_to_kclock(which_clock);
         struct timespec kernel_tp;
         int error;
 
-        if (invalid_clockid(which_clock))
+        if (!kc)
                 return -EINVAL;
-        error = CLOCK_DISPATCH(which_clock, clock_get,
-                               (which_clock, &kernel_tp));
+
+        error = kc->clock_get(which_clock, &kernel_tp);
+
         if (!error && copy_to_user(tp, &kernel_tp, sizeof (kernel_tp)))
                 error = -EFAULT;
 
         return error;
+}
+
+SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
+                struct timex __user *, utx)
+{
+        struct k_clock *kc = clockid_to_kclock(which_clock);
+        struct timex ktx;
+        int err;
+
+        if (!kc)
+                return -EINVAL;
+        if (!kc->clock_adj)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&ktx, utx, sizeof(ktx)))
+                return -EFAULT;
+
+        err = kc->clock_adj(which_clock, &ktx);
+
+        if (!err && copy_to_user(utx, &ktx, sizeof(ktx)))
+                return -EFAULT;
 
+        return err;
 }
 
 SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
                 struct timespec __user *, tp)
 {
+        struct k_clock *kc = clockid_to_kclock(which_clock);
         struct timespec rtn_tp;
         int error;
 
-        if (invalid_clockid(which_clock))
+        if (!kc)
                 return -EINVAL;
 
-        error = CLOCK_DISPATCH(which_clock, clock_getres,
-                               (which_clock, &rtn_tp));
+        error = kc->clock_getres(which_clock, &rtn_tp);
 
-        if (!error && tp && copy_to_user(tp, &rtn_tp, sizeof (rtn_tp))) {
+        if (!error && tp && copy_to_user(tp, &rtn_tp, sizeof (rtn_tp)))
                 error = -EFAULT;
-        }
 
         return error;
 }
@@ -1009,10 +1033,13 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
                 const struct timespec __user *, rqtp,
                 struct timespec __user *, rmtp)
 {
+        struct k_clock *kc = clockid_to_kclock(which_clock);
         struct timespec t;
 
-        if (invalid_clockid(which_clock))
+        if (!kc)
                 return -EINVAL;
+        if (!kc->nsleep)
+                return -ENANOSLEEP_NOTSUP;
 
         if (copy_from_user(&t, rqtp, sizeof (struct timespec)))
                 return -EFAULT;
@@ -1020,27 +1047,20 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
         if (!timespec_valid(&t))
                 return -EINVAL;
 
-        return CLOCK_DISPATCH(which_clock, nsleep,
-                              (which_clock, flags, &t, rmtp));
-}
-
-/*
- * nanosleep_restart for monotonic and realtime clocks
- */
-static int common_nsleep_restart(struct restart_block *restart_block)
-{
-        return hrtimer_nanosleep_restart(restart_block);
+        return kc->nsleep(which_clock, flags, &t, rmtp);
 }
 
 /*
  * This will restart clock_nanosleep. This is required only by
  * compat_clock_nanosleep_restart for now.
  */
-long
-clock_nanosleep_restart(struct restart_block *restart_block)
+long clock_nanosleep_restart(struct restart_block *restart_block)
 {
-        clockid_t which_clock = restart_block->arg0;
+        clockid_t which_clock = restart_block->nanosleep.index;
+        struct k_clock *kc = clockid_to_kclock(which_clock);
+
+        if (WARN_ON_ONCE(!kc || !kc->nsleep_restart))
+                return -EINVAL;
 
-        return CLOCK_DISPATCH(which_clock, nsleep_restart,
-                              (restart_block));
+        return kc->nsleep_restart(restart_block);
 }
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index a5aff3ebad38..265729966ece 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -100,13 +100,9 @@ config PM_SLEEP_ADVANCED_DEBUG
         depends on PM_ADVANCED_DEBUG
         default n
 
-config SUSPEND_NVS
-       bool
-
 config SUSPEND
         bool "Suspend to RAM and standby"
         depends on PM && ARCH_SUSPEND_POSSIBLE
-        select SUSPEND_NVS if HAS_IOMEM
         default y
         ---help---
           Allow the system to enter sleep states in which main memory is
@@ -140,7 +136,6 @@ config HIBERNATION
         depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
         select LZO_COMPRESS
         select LZO_DECOMPRESS
-        select SUSPEND_NVS if HAS_IOMEM
         ---help---
           Enable the suspend to disk (STD) functionality, which is usually
           called "hibernation" in user interfaces.  STD checkpoints the
diff --git a/kernel/power/Makefile b/kernel/power/Makefile
index f9063c6b185d..c350e18b53e3 100644
--- a/kernel/power/Makefile
+++ b/kernel/power/Makefile
@@ -1,7 +1,4 @@
-
-ifeq ($(CONFIG_PM_DEBUG),y)
-EXTRA_CFLAGS    +=      -DDEBUG
-endif
+ccflags-$(CONFIG_PM_DEBUG)      :=      -DDEBUG
 
 obj-$(CONFIG_PM)                += main.o
 obj-$(CONFIG_PM_SLEEP)          += console.o
@@ -10,6 +7,5 @@ obj-$(CONFIG_SUSPEND)		+= suspend.o
 obj-$(CONFIG_PM_TEST_SUSPEND)   += suspend_test.o
 obj-$(CONFIG_HIBERNATION)       += hibernate.o snapshot.o swap.o user.o \
                                    block_io.o
-obj-$(CONFIG_SUSPEND_NVS)       += nvs.o
 
 obj-$(CONFIG_MAGIC_SYSRQ)       += poweroff.o
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 048d0b514831..1832bd264219 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -51,18 +51,18 @@ enum {
 
 static int hibernation_mode = HIBERNATION_SHUTDOWN;
 
-static struct platform_hibernation_ops *hibernation_ops;
+static const struct platform_hibernation_ops *hibernation_ops;
 
 /**
  * hibernation_set_ops - set the global hibernate operations
  * @ops: the hibernation operations to use in subsequent hibernation transitions
  */
 
-void hibernation_set_ops(struct platform_hibernation_ops *ops)
+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
 {
         if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
             && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-            && ops->restore_cleanup)) {
+            && ops->restore_cleanup && ops->leave)) {
                 WARN_ON(1);
                 return;
         }
@@ -278,7 +278,7 @@ static int create_image(int platform_mode)
                 goto Enable_irqs;
         }
 
-        if (hibernation_test(TEST_CORE) || !pm_check_wakeup_events())
+        if (hibernation_test(TEST_CORE) || pm_wakeup_pending())
                 goto Power_up;
 
         in_suspend = 1;
@@ -516,7 +516,7 @@ int hibernation_platform_enter(void)
 
         local_irq_disable();
         sysdev_suspend(PMSG_HIBERNATE);
-        if (!pm_check_wakeup_events()) {
+        if (pm_wakeup_pending()) {
                 error = -EAGAIN;
                 goto Power_up;
         }
@@ -647,6 +647,7 @@ int hibernate(void)
                 swsusp_free();
                 if (!error)
                         power_down();
+                in_suspend = 0;
                 pm_restore_gfp_mask();
         } else {
                 pr_debug("PM: Image restored successfully.\n");
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 7b5db6a8561e..701853042c28 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -326,7 +326,7 @@ EXPORT_SYMBOL_GPL(pm_wq);
 
 static int __init pm_start_workqueue(void)
 {
-        pm_wq = alloc_workqueue("pm", WQ_FREEZEABLE, 0);
+        pm_wq = alloc_workqueue("pm", WQ_FREEZABLE, 0);
 
         return pm_wq ? 0 : -ENOMEM;
 }
diff --git a/kernel/power/nvs.c b/kernel/power/nvs.c
deleted file mode 100644
index 1836db60bbb6..000000000000
--- a/kernel/power/nvs.c
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * linux/kernel/power/hibernate_nvs.c - Routines for handling NVS memory
- *
- * Copyright (C) 2008,2009 Rafael J. Wysocki <rjw@sisk.pl>, Novell Inc.
- *
- * This file is released under the GPLv2.
- */
-
-#include <linux/io.h>
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/mm.h>
-#include <linux/slab.h>
-#include <linux/suspend.h>
-
-/*
- * Platforms, like ACPI, may want us to save some memory used by them during
- * suspend and to restore the contents of this memory during the subsequent
- * resume.  The code below implements a mechanism allowing us to do that.
- */
-
-struct nvs_page {
-        unsigned long phys_start;
-        unsigned int size;
-        void *kaddr;
-        void *data;
-        struct list_head node;
-};
-
-static LIST_HEAD(nvs_list);
-
-/**
- *      suspend_nvs_register - register platform NVS memory region to save
- *      @start - physical address of the region
- *      @size - size of the region
- *
- *      The NVS region need not be page-aligned (both ends) and we arrange
- *      things so that the data from page-aligned addresses in this region will
- *      be copied into separate RAM pages.
- */
-int suspend_nvs_register(unsigned long start, unsigned long size)
-{
-        struct nvs_page *entry, *next;
-
-        while (size > 0) {
-                unsigned int nr_bytes;
-
-                entry = kzalloc(sizeof(struct nvs_page), GFP_KERNEL);
-                if (!entry)
-                        goto Error;
-
-                list_add_tail(&entry->node, &nvs_list);
-                entry->phys_start = start;
-                nr_bytes = PAGE_SIZE - (start & ~PAGE_MASK);
-                entry->size = (size < nr_bytes) ? size : nr_bytes;
-
-                start += entry->size;
-                size -= entry->size;
-        }
-        return 0;
-
- Error:
-        list_for_each_entry_safe(entry, next, &nvs_list, node) {
-                list_del(&entry->node);
-                kfree(entry);
-        }
-        return -ENOMEM;
-}
-
-/**
- *      suspend_nvs_free - free data pages allocated for saving NVS regions
- */
-void suspend_nvs_free(void)
-{
-        struct nvs_page *entry;
-
-        list_for_each_entry(entry, &nvs_list, node)
-                if (entry->data) {
-                        free_page((unsigned long)entry->data);
-                        entry->data = NULL;
-                        if (entry->kaddr) {
-                                iounmap(entry->kaddr);
-                                entry->kaddr = NULL;
-                        }
-                }
-}
-
-/**
- *      suspend_nvs_alloc - allocate memory necessary for saving NVS regions
- */
-int suspend_nvs_alloc(void)
-{
-        struct nvs_page *entry;
-
-        list_for_each_entry(entry, &nvs_list, node) {
-                entry->data = (void *)__get_free_page(GFP_KERNEL);
-                if (!entry->data) {
-                        suspend_nvs_free();
-                        return -ENOMEM;
-                }
-        }
-        return 0;
-}
-
-/**
- *      suspend_nvs_save - save NVS memory regions
- */
-void suspend_nvs_save(void)
-{
-        struct nvs_page *entry;
-
-        printk(KERN_INFO "PM: Saving platform NVS memory\n");
-
-        list_for_each_entry(entry, &nvs_list, node)
-                if (entry->data) {
-                        entry->kaddr = ioremap(entry->phys_start, entry->size);
-                        memcpy(entry->data, entry->kaddr, entry->size);
-                }
-}
-
-/**
- *      suspend_nvs_restore - restore NVS memory regions
- *
- *      This function is going to be called with interrupts disabled, so it
- *      cannot iounmap the virtual addresses used to access the NVS region.
- */
-void suspend_nvs_restore(void)
-{
-        struct nvs_page *entry;
-
-        printk(KERN_INFO "PM: Restoring platform NVS memory\n");
-
-        list_for_each_entry(entry, &nvs_list, node)
-                if (entry->data)
-                        memcpy(entry->kaddr, entry->data, entry->size);
-}
diff --git a/kernel/power/process.c b/kernel/power/process.c
index e50b4c1b2a0f..0cf3a27a6c9d 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -22,7 +22,7 @@
  */
 #define TIMEOUT (20 * HZ)
 
-static inline int freezeable(struct task_struct * p)
+static inline int freezable(struct task_struct * p)
 {
         if ((p == current) ||
             (p->flags & PF_NOFREEZE) ||
@@ -53,7 +53,7 @@ static int try_to_freeze_tasks(bool sig_only)
                 todo = 0;
                 read_lock(&tasklist_lock);
                 do_each_thread(g, p) {
-                        if (frozen(p) || !freezeable(p))
+                        if (frozen(p) || !freezable(p))
                                 continue;
 
                         if (!freeze_task(p, sig_only))
@@ -64,6 +64,12 @@ static int try_to_freeze_tasks(bool sig_only)
                          * perturb a task in TASK_STOPPED or TASK_TRACED.
                          * It is "frozen enough".  If the task does wake
                          * up, it will immediately call try_to_freeze.
+                         *
+                         * Because freeze_task() goes through p's
+                         * scheduler lock after setting TIF_FREEZE, it's
+                         * guaranteed that either we see TASK_RUNNING or
+                         * try_to_stop() after schedule() in ptrace/signal
+                         * stop sees TIF_FREEZE.
                          */
                         if (!task_is_stopped_or_traced(p) &&
                             !freezer_should_skip(p))
@@ -79,7 +85,7 @@ static int try_to_freeze_tasks(bool sig_only)
                 if (!todo || time_after(jiffies, end_time))
                         break;
 
-                if (!pm_check_wakeup_events()) {
+                if (pm_wakeup_pending()) {
                         wakeup = true;
                         break;
                 }
@@ -161,7 +167,7 @@ static void thaw_tasks(bool nosig_only)
 
         read_lock(&tasklist_lock);
         do_each_thread(g, p) {
-                if (!freezeable(p))
+                if (!freezable(p))
                         continue;
 
                 if (nosig_only && should_send_signal(p))
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 0dac75ea4456..64db648ff911 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1519,11 +1519,8 @@ static int
 swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
                 unsigned int nr_pages, unsigned int nr_highmem)
 {
-        int error = 0;
-
         if (nr_highmem > 0) {
-                error = get_highmem_buffer(PG_ANY);
-                if (error)
+                if (get_highmem_buffer(PG_ANY))
                         goto err_out;
                 if (nr_highmem > alloc_highmem) {
                         nr_highmem -= alloc_highmem;
@@ -1546,7 +1543,7 @@ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
 
  err_out:
         swsusp_free();
-        return error;
+        return -ENOMEM;
 }
 
 asmlinkage int swsusp_save(void)
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 031d5e3a6197..de6f86bfa303 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -31,13 +31,13 @@ const char *const pm_states[PM_SUSPEND_MAX] = {
         [PM_SUSPEND_MEM]        = "mem",
 };
 
-static struct platform_suspend_ops *suspend_ops;
+static const struct platform_suspend_ops *suspend_ops;
 
 /**
  *      suspend_set_ops - Set the global suspend method table.
  *      @ops:   Pointer to ops structure.
  */
-void suspend_set_ops(struct platform_suspend_ops *ops)
+void suspend_set_ops(const struct platform_suspend_ops *ops)
 {
         mutex_lock(&pm_mutex);
         suspend_ops = ops;
@@ -164,7 +164,7 @@ static int suspend_enter(suspend_state_t state)
 
         error = sysdev_suspend(PMSG_SUSPEND);
         if (!error) {
-                if (!suspend_test(TEST_CORE) && pm_check_wakeup_events()) {
+                if (!(suspend_test(TEST_CORE) || pm_wakeup_pending())) {
                         error = suspend_ops->enter(state);
                         events_check_enabled = false;
                 }
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 8c7e4832b9be..7c97c3a0eee3 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -224,7 +224,7 @@ static int swsusp_swap_check(void)
                 return res;
 
         root_swap = res;
-        res = blkdev_get(hib_resume_bdev, FMODE_WRITE);
+        res = blkdev_get(hib_resume_bdev, FMODE_WRITE, NULL);
         if (res)
                 return res;
 
@@ -888,7 +888,7 @@ out_finish:
 /**
  *      swsusp_read - read the hibernation image.
  *      @flags_p: flags passed by the "frozen" kernel in the image header should
- *                be written into this memeory location
+ *                be written into this memory location
  */
 
 int swsusp_read(unsigned int *flags_p)
@@ -930,7 +930,8 @@ int swsusp_check(void)
 {
         int error;
 
-        hib_resume_bdev = open_by_devnum(swsusp_resume_device, FMODE_READ);
+        hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device,
+                                            FMODE_READ, NULL);
         if (!IS_ERR(hib_resume_bdev)) {
                 set_blocksize(hib_resume_bdev, PAGE_SIZE);
                 clear_page(swsusp_header);
diff --git a/kernel/printk.c b/kernel/printk.c
index ab3ffc5b3b64..36231525e22f 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -39,16 +39,11 @@
 #include <linux/syslog.h>
 #include <linux/cpu.h>
 #include <linux/notifier.h>
+#include <linux/rculist.h>
 
 #include <asm/uaccess.h>
 
 /*
- * for_each_console() allows you to iterate on each console
- */
-#define for_each_console(con) \
-        for (con = console_drivers; con != NULL; con = con->next)
-
-/*
  * Architectures can override it:
  */
 void asmlinkage __attribute__((weak)) early_printk(const char *fmt, ...)
@@ -102,7 +97,7 @@ static int console_locked, console_suspended;
 /*
  * logbuf_lock protects log_buf, log_start, log_end, con_start and logged_chars
  * It is also used in interesting ways to provide interlocking in
- * release_console_sem().
+ * console_unlock();.
  */
 static DEFINE_SPINLOCK(logbuf_lock);
 
@@ -267,25 +262,47 @@ int dmesg_restrict = 1;
 int dmesg_restrict;
 #endif
 
+static int syslog_action_restricted(int type)
+{
+        if (dmesg_restrict)
+                return 1;
+        /* Unless restricted, we allow "read all" and "get buffer size" for everybody */
+        return type != SYSLOG_ACTION_READ_ALL && type != SYSLOG_ACTION_SIZE_BUFFER;
+}
+
+static int check_syslog_permissions(int type, bool from_file)
+{
+        /*
+         * If this is from /proc/kmsg and we've already opened it, then we've
+         * already done the capabilities checks at open time.
+         */
+        if (from_file && type != SYSLOG_ACTION_OPEN)
+                return 0;
+
+        if (syslog_action_restricted(type)) {
+                if (capable(CAP_SYSLOG))
+                        return 0;
+                /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
+                if (capable(CAP_SYS_ADMIN)) {
+                        WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
+                                 "but no CAP_SYSLOG (deprecated).\n");
+                        return 0;
+                }
+                return -EPERM;
+        }
+        return 0;
+}
+
 int do_syslog(int type, char __user *buf, int len, bool from_file)
 {
         unsigned i, j, limit, count;
         int do_clear = 0;
         char c;
-        int error = 0;
+        int error;
 
-        /*
-         * If this is from /proc/kmsg we only do the capabilities checks
-         * at open time.
-         */
-        if (type == SYSLOG_ACTION_OPEN || !from_file) {
-                if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
-                        return -EPERM;
-                if ((type != SYSLOG_ACTION_READ_ALL &&
-                     type != SYSLOG_ACTION_SIZE_BUFFER) &&
-                    !capable(CAP_SYS_ADMIN))
-                        return -EPERM;
-        }
+        error = check_syslog_permissions(type, from_file);
+        if (error)
+                goto out;
 
         error = security_syslog(type);
         if (error)
@@ -500,7 +517,7 @@ static void _call_console_drivers(unsigned start,
 /*
  * Call the console drivers, asking them to write out
  * log_buf[start] to log_buf[end - 1].
- * The console_sem must be held.
+ * The console_lock must be held.
  */
 static void call_console_drivers(unsigned start, unsigned end)
 {
@@ -603,11 +620,11 @@ static int have_callable_console(void)
  *
  * This is printk().  It can be called from any context.  We want it to work.
  *
- * We try to grab the console_sem.  If we succeed, it's easy - we log the output and
+ * We try to grab the console_lock.  If we succeed, it's easy - we log the output and
  * call the console drivers.  If we fail to get the semaphore we place the output
  * into the log buffer and return.  The current holder of the console_sem will
- * notice the new output in release_console_sem() and will send it to the
- * consoles before releasing the semaphore.
+ * notice the new output in console_unlock(); and will send it to the
+ * consoles before releasing the lock.
  *
  * One effect of this deferred printing is that code which calls printk() and
  * then changes console_loglevel may break. This is because console_loglevel
@@ -658,19 +675,19 @@ static inline int can_use_console(unsigned int cpu)
 /*
  * Try to get console ownership to actually show the kernel
  * messages from a 'printk'. Return true (and with the
- * console_semaphore held, and 'console_locked' set) if it
+ * console_lock held, and 'console_locked' set) if it
  * is successful, false otherwise.
  *
  * This gets called with the 'logbuf_lock' spinlock held and
  * interrupts disabled. It should return with 'lockbuf_lock'
  * released but interrupts still disabled.
  */
-static int acquire_console_semaphore_for_printk(unsigned int cpu)
+static int console_trylock_for_printk(unsigned int cpu)
         __releases(&logbuf_lock)
 {
         int retval = 0;
 
-        if (!try_acquire_console_sem()) {
+        if (console_trylock()) {
                 retval = 1;
 
                 /*
@@ -826,12 +843,12 @@ asmlinkage int vprintk(const char *fmt, va_list args)
          * actual magic (print out buffers, wake up klogd,
          * etc). 
          *
-         * The acquire_console_semaphore_for_printk() function
+         * The console_trylock_for_printk() function
          * will release 'logbuf_lock' regardless of whether it
          * actually gets the semaphore or not.
          */
-        if (acquire_console_semaphore_for_printk(this_cpu))
-                release_console_sem();
+        if (console_trylock_for_printk(this_cpu))
+                console_unlock();
 
         lockdep_on();
 out_restore_irqs:
@@ -992,7 +1009,7 @@ void suspend_console(void)
         if (!console_suspend_enabled)
                 return;
         printk("Suspending console(s) (use no_console_suspend to debug)\n");
-        acquire_console_sem();
+        console_lock();
         console_suspended = 1;
         up(&console_sem);
 }
@@ -1003,7 +1020,7 @@ void resume_console(void)
                 return;
         down(&console_sem);
         console_suspended = 0;
-        release_console_sem();
+        console_unlock();
 }
 
 /**
@@ -1026,21 +1043,21 @@ static int __cpuinit console_cpu_notify(struct notifier_block *self,
         case CPU_DYING:
         case CPU_DOWN_FAILED:
         case CPU_UP_CANCELED:
-                acquire_console_sem();
-                release_console_sem();
+                console_lock();
+                console_unlock();
         }
         return NOTIFY_OK;
 }
 
 /**
- * acquire_console_sem - lock the console system for exclusive use.
+ * console_lock - lock the console system for exclusive use.
  *
- * Acquires a semaphore which guarantees that the caller has
+ * Acquires a lock which guarantees that the caller has
  * exclusive access to the console system and the console_drivers list.
  *
  * Can sleep, returns nothing.
  */
-void acquire_console_sem(void)
+void console_lock(void)
 {
         BUG_ON(in_interrupt());
         down(&console_sem);
@@ -1049,21 +1066,29 @@ void acquire_console_sem(void)
         console_locked = 1;
         console_may_schedule = 1;
 }
-EXPORT_SYMBOL(acquire_console_sem);
+EXPORT_SYMBOL(console_lock);
 
-int try_acquire_console_sem(void)
+/**
+ * console_trylock - try to lock the console system for exclusive use.
+ *
+ * Tried to acquire a lock which guarantees that the caller has
+ * exclusive access to the console system and the console_drivers list.
+ *
+ * returns 1 on success, and 0 on failure to acquire the lock.
+ */
+int console_trylock(void)
 {
         if (down_trylock(&console_sem))
-                return -1;
+                return 0;
         if (console_suspended) {
                 up(&console_sem);
-                return -1;
+                return 0;
         }
         console_locked = 1;
         console_may_schedule = 0;
-        return 0;
+        return 1;
 }
-EXPORT_SYMBOL(try_acquire_console_sem);
+EXPORT_SYMBOL(console_trylock);
 
 int is_console_locked(void)
 {
@@ -1094,20 +1119,20 @@ void wake_up_klogd(void)
 }
 
 /**
- * release_console_sem - unlock the console system
+ * console_unlock - unlock the console system
  *
- * Releases the semaphore which the caller holds on the console system
+ * Releases the console_lock which the caller holds on the console system
  * and the console driver list.
  *
- * While the semaphore was held, console output may have been buffered
- * by printk().  If this is the case, release_console_sem() emits
- * the output prior to releasing the semaphore.
+ * While the console_lock was held, console output may have been buffered
+ * by printk().  If this is the case, console_unlock(); emits
+ * the output prior to releasing the lock.
  *
  * If there is output waiting for klogd, we wake it up.
  *
- * release_console_sem() may be called from any context.
+ * console_unlock(); may be called from any context.
  */
-void release_console_sem(void)
+void console_unlock(void)
 {
         unsigned long flags;
         unsigned _con_start, _log_end;
@@ -1140,7 +1165,7 @@ void release_console_sem(void)
         if (wake_klogd)
                 wake_up_klogd();
 }
-EXPORT_SYMBOL(release_console_sem);
+EXPORT_SYMBOL(console_unlock);
 
 /**
  * console_conditional_schedule - yield the CPU if required
@@ -1149,7 +1174,7 @@ EXPORT_SYMBOL(release_console_sem);
  * if this CPU should yield the CPU to another task, do
  * so here.
  *
- * Must be called within acquire_console_sem().
+ * Must be called within console_lock();.
  */
 void __sched console_conditional_schedule(void)
 {
@@ -1170,14 +1195,14 @@ void console_unblank(void)
                 if (down_trylock(&console_sem) != 0)
                         return;
         } else
-                acquire_console_sem();
+                console_lock();
 
         console_locked = 1;
         console_may_schedule = 0;
         for_each_console(c)
                 if ((c->flags & CON_ENABLED) && c->unblank)
                         c->unblank();
-        release_console_sem();
+        console_unlock();
 }
 
 /*
@@ -1188,7 +1213,7 @@ struct tty_driver *console_device(int *index)
         struct console *c;
         struct tty_driver *driver = NULL;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(c) {
                 if (!c->device)
                         continue;
@@ -1196,7 +1221,7 @@ struct tty_driver *console_device(int *index)
                 if (driver)
                         break;
         }
-        release_console_sem();
+        console_unlock();
         return driver;
 }
 
@@ -1207,17 +1232,17 @@ struct tty_driver *console_device(int *index)
  */
 void console_stop(struct console *console)
 {
-        acquire_console_sem();
+        console_lock();
         console->flags &= ~CON_ENABLED;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(console_stop);
 
 void console_start(struct console *console)
 {
-        acquire_console_sem();
+        console_lock();
         console->flags |= CON_ENABLED;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(console_start);
 
@@ -1339,7 +1364,7 @@ void register_console(struct console *newcon)
          *      Put this console in the list - keep the
          *      preferred driver at the head of the list.
          */
-        acquire_console_sem();
+        console_lock();
         if ((newcon->flags & CON_CONSDEV) || console_drivers == NULL) {
                 newcon->next = console_drivers;
                 console_drivers = newcon;
@@ -1351,14 +1376,15 @@ void register_console(struct console *newcon)
         }
         if (newcon->flags & CON_PRINTBUFFER) {
                 /*
-                 * release_console_sem() will print out the buffered messages
+                 * console_unlock(); will print out the buffered messages
                  * for us.
                  */
                 spin_lock_irqsave(&logbuf_lock, flags);
                 con_start = log_start;
                 spin_unlock_irqrestore(&logbuf_lock, flags);
         }
-        release_console_sem();
+        console_unlock();
+        console_sysfs_notify();
 
         /*
          * By unregistering the bootconsoles after we enable the real console
@@ -1394,7 +1420,7 @@ int unregister_console(struct console *console)
                 return braille_unregister_console(console);
 #endif
 
-        acquire_console_sem();
+        console_lock();
         if (console_drivers == console) {
                 console_drivers=console->next;
                 res = 0;
@@ -1416,7 +1442,8 @@ int unregister_console(struct console *console)
         if (console_drivers != NULL && console->flags & CON_CONSDEV)
                 console_drivers->flags |= CON_CONSDEV;
 
-        release_console_sem();
+        console_unlock();
+        console_sysfs_notify();
         return res;
 }
 EXPORT_SYMBOL(unregister_console);
@@ -1500,7 +1527,7 @@ int kmsg_dump_register(struct kmsg_dumper *dumper)
         /* Don't allow registering multiple times */
         if (!dumper->registered) {
                 dumper->registered = 1;
-                list_add_tail(&dumper->list, &dump_list);
+                list_add_tail_rcu(&dumper->list, &dump_list);
                 err = 0;
         }
         spin_unlock_irqrestore(&dump_list_lock, flags);
@@ -1524,29 +1551,16 @@ int kmsg_dump_unregister(struct kmsg_dumper *dumper)
         spin_lock_irqsave(&dump_list_lock, flags);
         if (dumper->registered) {
                 dumper->registered = 0;
-                list_del(&dumper->list);
+                list_del_rcu(&dumper->list);
                 err = 0;
         }
         spin_unlock_irqrestore(&dump_list_lock, flags);
+        synchronize_rcu();
 
         return err;
 }
 EXPORT_SYMBOL_GPL(kmsg_dump_unregister);
 
-static const char * const kmsg_reasons[] = {
-        [KMSG_DUMP_OOPS]        = "oops",
-        [KMSG_DUMP_PANIC]       = "panic",
-        [KMSG_DUMP_KEXEC]       = "kexec",
-};
-
-static const char *kmsg_to_str(enum kmsg_dump_reason reason)
-{
-        if (reason >= ARRAY_SIZE(kmsg_reasons) || reason < 0)
-                return "unknown";
-
-        return kmsg_reasons[reason];
-}
-
 /**
  * kmsg_dump - dump kernel log to kernel message dumpers.
  * @reason: the reason (oops, panic etc) for dumping
@@ -1585,13 +1599,9 @@ void kmsg_dump(enum kmsg_dump_reason reason)
                 l2 = chars;
         }
 
-        if (!spin_trylock_irqsave(&dump_list_lock, flags)) {
-                printk(KERN_ERR "dump_kmsg: dump list lock is held during %s, skipping dump\n",
-                                kmsg_to_str(reason));
-                return;
-        }
-        list_for_each_entry(dumper, &dump_list, list)
+        rcu_read_lock();
+        list_for_each_entry_rcu(dumper, &dump_list, list)
                 dumper->dump(dumper, reason, s1, l1, s2, l2);
-        spin_unlock_irqrestore(&dump_list_lock, flags);
+        rcu_read_unlock();
 }
 #endif
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 99bbaa3e5b0d..e2302e40b360 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -163,7 +163,7 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
         return !err;
 }
 
-int ptrace_attach(struct task_struct *task)
+static int ptrace_attach(struct task_struct *task)
 {
         int retval;
 
@@ -219,7 +219,7 @@ out:
  * Performs checks and sets PT_PTRACED.
  * Should be used by all ptrace implementations for PTRACE_TRACEME.
  */
-int ptrace_traceme(void)
+static int ptrace_traceme(void)
 {
         int ret = -EPERM;
 
@@ -293,7 +293,7 @@ static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
         return false;
 }
 
-int ptrace_detach(struct task_struct *child, unsigned int data)
+static int ptrace_detach(struct task_struct *child, unsigned int data)
 {
         bool dead = false;
 
@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *child, unsigned int data)
                 child->exit_code = data;
                 dead = __ptrace_detach(current, child);
                 if (!child->exit_state)
-                        wake_up_process(child);
+                        wake_up_state(child, TASK_TRACED | TASK_STOPPED);
         }
         write_unlock_irq(&tasklist_lock);
 
diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c
index 034493724749..0c343b9a46d5 100644
--- a/kernel/rcutiny.c
+++ b/kernel/rcutiny.c
@@ -189,7 +189,8 @@ static int rcu_kthread(void *arg)
         unsigned long flags;
 
         for (;;) {
-                wait_event(rcu_kthread_wq, have_rcu_kthread_work != 0);
+                wait_event_interruptible(rcu_kthread_wq,
+                                         have_rcu_kthread_work != 0);
                 morework = rcu_boost();
                 local_irq_save(flags);
                 work = have_rcu_kthread_work;
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index d0ddfea6579d..dd4aea806f8e 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -364,8 +364,8 @@ void rcu_irq_exit(void)
         WARN_ON_ONCE(rdtp->dynticks & 0x1);
 
         /* If the interrupt queued a callback, get out of dyntick mode. */
-        if (__get_cpu_var(rcu_sched_data).nxtlist ||
-            __get_cpu_var(rcu_bh_data).nxtlist)
+        if (__this_cpu_read(rcu_sched_data.nxtlist) ||
+            __this_cpu_read(rcu_bh_data.nxtlist))
                 set_need_resched();
 }
 
diff --git a/kernel/rtmutex-debug.c b/kernel/rtmutex-debug.c
index ddabb54bb5c8..3c7cbc2c33be 100644
--- a/kernel/rtmutex-debug.c
+++ b/kernel/rtmutex-debug.c
@@ -215,7 +215,6 @@ void debug_rt_mutex_free_waiter(struct rt_mutex_waiter *waiter)
         put_pid(waiter->deadlock_task_pid);
         TRACE_WARN_ON(!plist_node_empty(&waiter->list_entry));
         TRACE_WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
-        TRACE_WARN_ON(waiter->task);
         memset(waiter, 0x22, sizeof(*waiter));
 }
 
diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
index 66cb89bc5ef1..5c9ccd380966 100644
--- a/kernel/rtmutex-tester.c
+++ b/kernel/rtmutex-tester.c
@@ -9,7 +9,6 @@
 #include <linux/kthread.h>
 #include <linux/module.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/sysdev.h>
 #include <linux/timer.h>
@@ -27,7 +26,6 @@ struct test_thread_data {
         int                     opcode;
         int                     opdata;
         int                     mutexes[MAX_RT_TEST_MUTEXES];
-        int                     bkl;
         int                     event;
         struct sys_device       sysdev;
 };
@@ -46,9 +44,8 @@ enum test_opcodes {
         RTTEST_LOCKINTNOWAIT,   /* 6 Lock interruptible no wait in wakeup, data = lockindex */
         RTTEST_LOCKCONT,        /* 7 Continue locking after the wakeup delay */
         RTTEST_UNLOCK,          /* 8 Unlock, data = lockindex */
-        RTTEST_LOCKBKL,         /* 9 Lock BKL */
-        RTTEST_UNLOCKBKL,       /* 10 Unlock BKL */
-        RTTEST_SIGNAL,          /* 11 Signal other test thread, data = thread id */
+        /* 9, 10 - reserved for BKL commemoration */
+        RTTEST_SIGNAL = 11,     /* 11 Signal other test thread, data = thread id */
         RTTEST_RESETEVENT = 98, /* 98 Reset event counter */
         RTTEST_RESET = 99,      /* 99 Reset all pending operations */
 };
@@ -74,13 +71,6 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
                                 td->mutexes[i] = 0;
                         }
                 }
-
-                if (!lockwakeup && td->bkl == 4) {
-#ifdef CONFIG_LOCK_KERNEL
-                        unlock_kernel();
-#endif
-                        td->bkl = 0;
-                }
                 return 0;
 
         case RTTEST_RESETEVENT:
@@ -131,25 +121,6 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
                 td->mutexes[id] = 0;
                 return 0;
 
-        case RTTEST_LOCKBKL:
-                if (td->bkl)
-                        return 0;
-                td->bkl = 1;
-#ifdef CONFIG_LOCK_KERNEL
-                lock_kernel();
-#endif
-                td->bkl = 4;
-                return 0;
-
-        case RTTEST_UNLOCKBKL:
-                if (td->bkl != 4)
-                        break;
-#ifdef CONFIG_LOCK_KERNEL
-                unlock_kernel();
-#endif
-                td->bkl = 0;
-                return 0;
-
         default:
                 break;
         }
@@ -196,7 +167,6 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
                 td->event = atomic_add_return(1, &rttest_event);
                 break;
 
-        case RTTEST_LOCKBKL:
         default:
                 break;
         }
@@ -229,8 +199,6 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
                 td->event = atomic_add_return(1, &rttest_event);
                 return;
 
-        case RTTEST_LOCKBKL:
-                return;
         default:
                 return;
         }
@@ -380,11 +348,11 @@ static ssize_t sysfs_test_status(struct sys_device *dev, struct sysdev_attribute
         spin_lock(&rttest_lock);
 
         curr += sprintf(curr,
-                "O: %4d, E:%8d, S: 0x%08lx, P: %4d, N: %4d, B: %p, K: %d, M:",
+                "O: %4d, E:%8d, S: 0x%08lx, P: %4d, N: %4d, B: %p, M:",
                 td->opcode, td->event, tsk->state,
                         (MAX_RT_PRIO - 1) - tsk->prio,
                         (MAX_RT_PRIO - 1) - tsk->normal_prio,
-                tsk->pi_blocked_on, td->bkl);
+                tsk->pi_blocked_on);
 
         for (i = MAX_RT_TEST_MUTEXES - 1; i >=0 ; i--)
                 curr += sprintf(curr, "%d", td->mutexes[i]);
diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
index a9604815786a..ab449117aaf2 100644
--- a/kernel/rtmutex.c
+++ b/kernel/rtmutex.c
@@ -20,41 +20,34 @@
 /*
  * lock->owner state tracking:
  *
- * lock->owner holds the task_struct pointer of the owner. Bit 0 and 1
- * are used to keep track of the "owner is pending" and "lock has
- * waiters" state.
+ * lock->owner holds the task_struct pointer of the owner. Bit 0
+ * is used to keep track of the "lock has waiters" state.
  *
- * owner        bit1    bit0
- * NULL         0       0       lock is free (fast acquire possible)
- * NULL         0       1       invalid state
- * NULL         1       0       Transitional State*
- * NULL         1       1       invalid state
- * taskpointer  0       0       lock is held (fast release possible)
- * taskpointer  0       1       task is pending owner
- * taskpointer  1       0       lock is held and has waiters
- * taskpointer  1       1       task is pending owner and lock has more waiters
- *
- * Pending ownership is assigned to the top (highest priority)
- * waiter of the lock, when the lock is released. The thread is woken
- * up and can now take the lock. Until the lock is taken (bit 0
- * cleared) a competing higher priority thread can steal the lock
- * which puts the woken up thread back on the waiters list.
+ * owner        bit0
+ * NULL         0       lock is free (fast acquire possible)
+ * NULL         1       lock is free and has waiters and the top waiter
+ *                              is going to take the lock*
+ * taskpointer  0       lock is held (fast release possible)
+ * taskpointer  1       lock is held and has waiters**
  *
  * The fast atomic compare exchange based acquire and release is only
- * possible when bit 0 and 1 of lock->owner are 0.
+ * possible when bit 0 of lock->owner is 0.
+ *
+ * (*) It also can be a transitional state when grabbing the lock
+ * with ->wait_lock is held. To prevent any fast path cmpxchg to the lock,
+ * we need to set the bit0 before looking at the lock, and the owner may be
+ * NULL in this small time, hence this can be a transitional state.
  *
- * (*) There's a small time where the owner can be NULL and the
- * "lock has waiters" bit is set.  This can happen when grabbing the lock.
- * To prevent a cmpxchg of the owner releasing the lock, we need to set this
- * bit before looking at the lock, hence the reason this is a transitional
- * state.
+ * (**) There is a small time when bit 0 is set but there are no
+ * waiters. This can happen when grabbing the lock in the slow path.
+ * To prevent a cmpxchg of the owner releasing the lock, we need to
+ * set this bit before looking at the lock.
  */
 
 static void
-rt_mutex_set_owner(struct rt_mutex *lock, struct task_struct *owner,
-                   unsigned long mask)
+rt_mutex_set_owner(struct rt_mutex *lock, struct task_struct *owner)
 {
-        unsigned long val = (unsigned long)owner | mask;
+        unsigned long val = (unsigned long)owner;
 
         if (rt_mutex_has_waiters(lock))
                 val |= RT_MUTEX_HAS_WAITERS;
@@ -203,15 +196,14 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
          * reached or the state of the chain has changed while we
          * dropped the locks.
          */
-        if (!waiter || !waiter->task)
+        if (!waiter)
                 goto out_unlock_pi;
 
         /*
          * Check the orig_waiter state. After we dropped the locks,
-         * the previous owner of the lock might have released the lock
-         * and made us the pending owner:
+         * the previous owner of the lock might have released the lock.
          */
-        if (orig_waiter && !orig_waiter->task)
+        if (orig_waiter && !rt_mutex_owner(orig_lock))
                 goto out_unlock_pi;
 
         /*
@@ -254,6 +246,17 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 
         /* Release the task */
         raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+        if (!rt_mutex_owner(lock)) {
+                /*
+                 * If the requeue above changed the top waiter, then we need
+                 * to wake the new top waiter up to try to get the lock.
+                 */
+
+                if (top_waiter != rt_mutex_top_waiter(lock))
+                        wake_up_process(rt_mutex_top_waiter(lock)->task);
+                raw_spin_unlock(&lock->wait_lock);
+                goto out_put_task;
+        }
         put_task_struct(task);
 
         /* Grab the next task */
@@ -296,78 +299,16 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 }
 
 /*
- * Optimization: check if we can steal the lock from the
- * assigned pending owner [which might not have taken the
- * lock yet]:
- */
-static inline int try_to_steal_lock(struct rt_mutex *lock,
-                                    struct task_struct *task)
-{
-        struct task_struct *pendowner = rt_mutex_owner(lock);
-        struct rt_mutex_waiter *next;
-        unsigned long flags;
-
-        if (!rt_mutex_owner_pending(lock))
-                return 0;
-
-        if (pendowner == task)
-                return 1;
-
-        raw_spin_lock_irqsave(&pendowner->pi_lock, flags);
-        if (task->prio >= pendowner->prio) {
-                raw_spin_unlock_irqrestore(&pendowner->pi_lock, flags);
-                return 0;
-        }
-
-        /*
-         * Check if a waiter is enqueued on the pending owners
-         * pi_waiters list. Remove it and readjust pending owners
-         * priority.
-         */
-        if (likely(!rt_mutex_has_waiters(lock))) {
-                raw_spin_unlock_irqrestore(&pendowner->pi_lock, flags);
-                return 1;
-        }
-
-        /* No chain handling, pending owner is not blocked on anything: */
-        next = rt_mutex_top_waiter(lock);
-        plist_del(&next->pi_list_entry, &pendowner->pi_waiters);
-        __rt_mutex_adjust_prio(pendowner);
-        raw_spin_unlock_irqrestore(&pendowner->pi_lock, flags);
-
-        /*
-         * We are going to steal the lock and a waiter was
-         * enqueued on the pending owners pi_waiters queue. So
-         * we have to enqueue this waiter into
-         * task->pi_waiters list. This covers the case,
-         * where task is boosted because it holds another
-         * lock and gets unboosted because the booster is
-         * interrupted, so we would delay a waiter with higher
-         * priority as task->normal_prio.
-         *
-         * Note: in the rare case of a SCHED_OTHER task changing
-         * its priority and thus stealing the lock, next->task
-         * might be task:
-         */
-        if (likely(next->task != task)) {
-                raw_spin_lock_irqsave(&task->pi_lock, flags);
-                plist_add(&next->pi_list_entry, &task->pi_waiters);
-                __rt_mutex_adjust_prio(task);
-                raw_spin_unlock_irqrestore(&task->pi_lock, flags);
-        }
-        return 1;
-}
-
-/*
  * Try to take an rt-mutex
  *
- * This fails
- * - when the lock has a real owner
- * - when a different pending owner exists and has higher priority than current
- *
  * Must be called with lock->wait_lock held.
+ *
+ * @lock:   the lock to be acquired.
+ * @task:   the task which wants to acquire the lock
+ * @waiter: the waiter that is queued to the lock's wait list. (could be NULL)
  */
-static int try_to_take_rt_mutex(struct rt_mutex *lock)
+static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
+                struct rt_mutex_waiter *waiter)
 {
         /*
          * We have to be careful here if the atomic speedups are
@@ -390,15 +331,52 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock)
          */
         mark_rt_mutex_waiters(lock);
 
-        if (rt_mutex_owner(lock) && !try_to_steal_lock(lock, current))
+        if (rt_mutex_owner(lock))
                 return 0;
 
+        /*
+         * It will get the lock because of one of these conditions:
+         * 1) there is no waiter
+         * 2) higher priority than waiters
+         * 3) it is top waiter
+         */
+        if (rt_mutex_has_waiters(lock)) {
+                if (task->prio >= rt_mutex_top_waiter(lock)->list_entry.prio) {
+                        if (!waiter || waiter != rt_mutex_top_waiter(lock))
+                                return 0;
+                }
+        }
+
+        if (waiter || rt_mutex_has_waiters(lock)) {
+                unsigned long flags;
+                struct rt_mutex_waiter *top;
+
+                raw_spin_lock_irqsave(&task->pi_lock, flags);
+
+                /* remove the queued waiter. */
+                if (waiter) {
+                        plist_del(&waiter->list_entry, &lock->wait_list);
+                        task->pi_blocked_on = NULL;
+                }
+
+                /*
+                 * We have to enqueue the top waiter(if it exists) into
+                 * task->pi_waiters list.
+                 */
+                if (rt_mutex_has_waiters(lock)) {
+                        top = rt_mutex_top_waiter(lock);
+                        top->pi_list_entry.prio = top->list_entry.prio;
+                        plist_add(&top->pi_list_entry, &task->pi_waiters);
+                }
+                raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+        }
+
         /* We got the lock. */
         debug_rt_mutex_lock(lock);
 
-        rt_mutex_set_owner(lock, current, 0);
+        rt_mutex_set_owner(lock, task);
 
-        rt_mutex_deadlock_account_lock(lock, current);
+        rt_mutex_deadlock_account_lock(lock, task);
 
         return 1;
 }
@@ -436,6 +414,9 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 
         raw_spin_unlock_irqrestore(&task->pi_lock, flags);
 
+        if (!owner)
+                return 0;
+
         if (waiter == rt_mutex_top_waiter(lock)) {
                 raw_spin_lock_irqsave(&owner->pi_lock, flags);
                 plist_del(&top_waiter->pi_list_entry, &owner->pi_waiters);
@@ -472,21 +453,18 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 /*
  * Wake up the next waiter on the lock.
  *
- * Remove the top waiter from the current tasks waiter list and from
- * the lock waiter list. Set it as pending owner. Then wake it up.
+ * Remove the top waiter from the current tasks waiter list and wake it up.
  *
  * Called with lock->wait_lock held.
  */
 static void wakeup_next_waiter(struct rt_mutex *lock)
 {
         struct rt_mutex_waiter *waiter;
-        struct task_struct *pendowner;
         unsigned long flags;
 
         raw_spin_lock_irqsave(&current->pi_lock, flags);
 
         waiter = rt_mutex_top_waiter(lock);
-        plist_del(&waiter->list_entry, &lock->wait_list);
 
         /*
          * Remove it from current->pi_waiters. We do not adjust a
@@ -495,43 +473,19 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
          * lock->wait_lock.
          */
         plist_del(&waiter->pi_list_entry, &current->pi_waiters);
-        pendowner = waiter->task;
-        waiter->task = NULL;
 
-        rt_mutex_set_owner(lock, pendowner, RT_MUTEX_OWNER_PENDING);
+        rt_mutex_set_owner(lock, NULL);
 
         raw_spin_unlock_irqrestore(&current->pi_lock, flags);
 
-        /*
-         * Clear the pi_blocked_on variable and enqueue a possible
-         * waiter into the pi_waiters list of the pending owner. This
-         * prevents that in case the pending owner gets unboosted a
-         * waiter with higher priority than pending-owner->normal_prio
-         * is blocked on the unboosted (pending) owner.
-         */
-        raw_spin_lock_irqsave(&pendowner->pi_lock, flags);
-
-        WARN_ON(!pendowner->pi_blocked_on);
-        WARN_ON(pendowner->pi_blocked_on != waiter);
-        WARN_ON(pendowner->pi_blocked_on->lock != lock);
-
-        pendowner->pi_blocked_on = NULL;
-
-        if (rt_mutex_has_waiters(lock)) {
-                struct rt_mutex_waiter *next;
-
-                next = rt_mutex_top_waiter(lock);
-                plist_add(&next->pi_list_entry, &pendowner->pi_waiters);
-        }
-        raw_spin_unlock_irqrestore(&pendowner->pi_lock, flags);
-
-        wake_up_process(pendowner);
+        wake_up_process(waiter->task);
 }
 
 /*
- * Remove a waiter from a lock
+ * Remove a waiter from a lock and give up
  *
- * Must be called with lock->wait_lock held
+ * Must be called with lock->wait_lock held and
+ * have just failed to try_to_take_rt_mutex().
  */
 static void remove_waiter(struct rt_mutex *lock,
                           struct rt_mutex_waiter *waiter)
@@ -543,11 +497,13 @@ static void remove_waiter(struct rt_mutex *lock,
 
         raw_spin_lock_irqsave(&current->pi_lock, flags);
         plist_del(&waiter->list_entry, &lock->wait_list);
-        waiter->task = NULL;
         current->pi_blocked_on = NULL;
         raw_spin_unlock_irqrestore(&current->pi_lock, flags);
 
-        if (first && owner != current) {
+        if (!owner)
+                return;
+
+        if (first) {
 
                 raw_spin_lock_irqsave(&owner->pi_lock, flags);
 
@@ -614,21 +570,19 @@ void rt_mutex_adjust_pi(struct task_struct *task)
  *                       or TASK_UNINTERRUPTIBLE)
  * @timeout:             the pre-initialized and started timer, or NULL for none
  * @waiter:              the pre-initialized rt_mutex_waiter
- * @detect_deadlock:     passed to task_blocks_on_rt_mutex
  *
  * lock->wait_lock must be held by the caller.
  */
 static int __sched
 __rt_mutex_slowlock(struct rt_mutex *lock, int state,
                     struct hrtimer_sleeper *timeout,
-                    struct rt_mutex_waiter *waiter,
-                    int detect_deadlock)
+                    struct rt_mutex_waiter *waiter)
 {
         int ret = 0;
 
         for (;;) {
                 /* Try to acquire the lock: */
-                if (try_to_take_rt_mutex(lock))
+                if (try_to_take_rt_mutex(lock, current, waiter))
                         break;
 
                 /*
@@ -645,39 +599,11 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
                                 break;
                 }
 
-                /*
-                 * waiter->task is NULL the first time we come here and
-                 * when we have been woken up by the previous owner
-                 * but the lock got stolen by a higher prio task.
-                 */
-                if (!waiter->task) {
-                        ret = task_blocks_on_rt_mutex(lock, waiter, current,
-                                                      detect_deadlock);
-                        /*
-                         * If we got woken up by the owner then start loop
-                         * all over without going into schedule to try
-                         * to get the lock now:
-                         */
-                        if (unlikely(!waiter->task)) {
-                                /*
-                                 * Reset the return value. We might
-                                 * have returned with -EDEADLK and the
-                                 * owner released the lock while we
-                                 * were walking the pi chain.
-                                 */
-                                ret = 0;
-                                continue;
-                        }
-                        if (unlikely(ret))
-                                break;
-                }
-
                 raw_spin_unlock(&lock->wait_lock);
 
                 debug_rt_mutex_print_deadlock(waiter);
 
-                if (waiter->task)
-                        schedule_rt_mutex(lock);
+                schedule_rt_mutex(lock);
 
                 raw_spin_lock(&lock->wait_lock);
                 set_current_state(state);
@@ -698,12 +624,11 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
         int ret = 0;
 
         debug_rt_mutex_init_waiter(&waiter);
-        waiter.task = NULL;
 
         raw_spin_lock(&lock->wait_lock);
 
         /* Try to acquire the lock again: */
-        if (try_to_take_rt_mutex(lock)) {
+        if (try_to_take_rt_mutex(lock, current, NULL)) {
                 raw_spin_unlock(&lock->wait_lock);
                 return 0;
         }
@@ -717,12 +642,14 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
                         timeout->task = NULL;
         }
 
-        ret = __rt_mutex_slowlock(lock, state, timeout, &waiter,
-                                  detect_deadlock);
+        ret = task_blocks_on_rt_mutex(lock, &waiter, current, detect_deadlock);
+
+        if (likely(!ret))
+                ret = __rt_mutex_slowlock(lock, state, timeout, &waiter);
 
         set_current_state(TASK_RUNNING);
 
-        if (unlikely(waiter.task))
+        if (unlikely(ret))
                 remove_waiter(lock, &waiter);
 
         /*
@@ -737,14 +664,6 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
         if (unlikely(timeout))
                 hrtimer_cancel(&timeout->timer);
 
-        /*
-         * Readjust priority, when we did not get the lock. We might
-         * have been the pending owner and boosted. Since we did not
-         * take the lock, the PI boost has to go.
-         */
-        if (unlikely(ret))
-                rt_mutex_adjust_prio(current);
-
         debug_rt_mutex_free_waiter(&waiter);
 
         return ret;
@@ -762,7 +681,7 @@ rt_mutex_slowtrylock(struct rt_mutex *lock)
 
         if (likely(rt_mutex_owner(lock) != current)) {
 
-                ret = try_to_take_rt_mutex(lock);
+                ret = try_to_take_rt_mutex(lock, current, NULL);
                 /*
                  * try_to_take_rt_mutex() sets the lock waiters
                  * bit unconditionally. Clean this up.
@@ -992,7 +911,7 @@ void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
 {
         __rt_mutex_init(lock, NULL);
         debug_rt_mutex_proxy_lock(lock, proxy_owner);
-        rt_mutex_set_owner(lock, proxy_owner, 0);
+        rt_mutex_set_owner(lock, proxy_owner);
         rt_mutex_deadlock_account_lock(lock, proxy_owner);
 }
 
@@ -1008,7 +927,7 @@ void rt_mutex_proxy_unlock(struct rt_mutex *lock,
                            struct task_struct *proxy_owner)
 {
         debug_rt_mutex_proxy_unlock(lock);
-        rt_mutex_set_owner(lock, NULL, 0);
+        rt_mutex_set_owner(lock, NULL);
         rt_mutex_deadlock_account_unlock(proxy_owner);
 }
 
@@ -1034,20 +953,14 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_lock(&lock->wait_lock);
 
-        mark_rt_mutex_waiters(lock);
-
-        if (!rt_mutex_owner(lock) || try_to_steal_lock(lock, task)) {
-                /* We got the lock for task. */
-                debug_rt_mutex_lock(lock);
-                rt_mutex_set_owner(lock, task, 0);
+        if (try_to_take_rt_mutex(lock, task, NULL)) {
                 raw_spin_unlock(&lock->wait_lock);
-                rt_mutex_deadlock_account_lock(lock, task);
                 return 1;
         }
 
         ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock);
 
-        if (ret && !waiter->task) {
+        if (ret && !rt_mutex_owner(lock)) {
                 /*
                  * Reset the return value. We might have
                  * returned with -EDEADLK and the owner
@@ -1056,6 +969,10 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                  */
                 ret = 0;
         }
+
+        if (unlikely(ret))
+                remove_waiter(lock, waiter);
+
         raw_spin_unlock(&lock->wait_lock);
 
         debug_rt_mutex_print_deadlock(waiter);
@@ -1110,12 +1027,11 @@ int rt_mutex_finish_proxy_lock(struct rt_mutex *lock,
 
         set_current_state(TASK_INTERRUPTIBLE);
 
-        ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter,
-                                  detect_deadlock);
+        ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
 
         set_current_state(TASK_RUNNING);
 
-        if (unlikely(waiter->task))
+        if (unlikely(ret))
                 remove_waiter(lock, waiter);
 
         /*
@@ -1126,13 +1042,5 @@ int rt_mutex_finish_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_unlock(&lock->wait_lock);
 
-        /*
-         * Readjust priority, when we did not get the lock. We might have been
-         * the pending owner and boosted. Since we did not take the lock, the
-         * PI boost has to go.
-         */
-        if (unlikely(ret))
-                rt_mutex_adjust_prio(current);
-
         return ret;
 }
diff --git a/kernel/rtmutex_common.h b/kernel/rtmutex_common.h
index 97a2f81866af..53a66c85261b 100644
--- a/kernel/rtmutex_common.h
+++ b/kernel/rtmutex_common.h
@@ -91,9 +91,8 @@ task_top_pi_waiter(struct task_struct *p)
 /*
  * lock->owner state tracking:
  */
-#define RT_MUTEX_OWNER_PENDING  1UL
-#define RT_MUTEX_HAS_WAITERS    2UL
-#define RT_MUTEX_OWNER_MASKALL  3UL
+#define RT_MUTEX_HAS_WAITERS    1UL
+#define RT_MUTEX_OWNER_MASKALL  1UL
 
 static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock)
 {
@@ -101,17 +100,6 @@ static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock)
                 ((unsigned long)lock->owner & ~RT_MUTEX_OWNER_MASKALL);
 }
 
-static inline struct task_struct *rt_mutex_real_owner(struct rt_mutex *lock)
-{
-        return (struct task_struct *)
-                ((unsigned long)lock->owner & ~RT_MUTEX_HAS_WAITERS);
-}
-
-static inline unsigned long rt_mutex_owner_pending(struct rt_mutex *lock)
-{
-        return (unsigned long)lock->owner & RT_MUTEX_OWNER_PENDING;
-}
-
 /*
  * PI-futex support (proxy locking functions, etc.):
  */
diff --git a/kernel/sched.c b/kernel/sched.c
index 04949089e760..c8e40b7005c0 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -278,14 +278,12 @@ struct task_group {
 #endif
 };
 
-#define root_task_group init_task_group
-
 /* task_group_lock serializes the addition/removal of task groups */
 static DEFINE_SPINLOCK(task_group_lock);
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
 
-# define INIT_TASK_GROUP_LOAD   NICE_0_LOAD
+# define ROOT_TASK_GROUP_LOAD   NICE_0_LOAD
 
 /*
  * A weight of 0 or 1 can cause arithmetics problems.
@@ -298,13 +296,13 @@ static DEFINE_SPINLOCK(task_group_lock);
 #define MIN_SHARES      2
 #define MAX_SHARES      (1UL << 18)
 
-static int init_task_group_load = INIT_TASK_GROUP_LOAD;
+static int root_task_group_load = ROOT_TASK_GROUP_LOAD;
 #endif
 
 /* Default task group.
  *      Every task in system belong to this group at bootup.
  */
-struct task_group init_task_group;
+struct task_group root_task_group;
 
 #endif  /* CONFIG_CGROUP_SCHED */
 
@@ -326,7 +324,7 @@ struct cfs_rq {
          * 'curr' points to currently running entity on this cfs_rq.
          * It is set to NULL otherwise (i.e when none are currently running).
          */
-        struct sched_entity *curr, *next, *last;
+        struct sched_entity *curr, *next, *last, *skip;
 
         unsigned int nr_spread_over;
 
@@ -555,9 +553,6 @@ struct rq {
         /* try_to_wake_up() stats */
         unsigned int ttwu_count;
         unsigned int ttwu_local;
-
-        /* BKL stats */
-        unsigned int bkl_count;
 #endif
 };
 
@@ -743,7 +738,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
         buf[cnt] = 0;
         cmp = strstrip(buf);
 
-        if (strncmp(buf, "NO_", 3) == 0) {
+        if (strncmp(cmp, "NO_", 3) == 0) {
                 neg = 1;
                 cmp += 3;
         }
@@ -1688,6 +1683,39 @@ static void double_rq_unlock(struct rq *rq1, struct rq *rq2)
                 __release(rq2->lock);
 }
 
+#else /* CONFIG_SMP */
+
+/*
+ * double_rq_lock - safely lock two runqueues
+ *
+ * Note this does not disable interrupts like task_rq_lock,
+ * you need to do so manually before calling.
+ */
+static void double_rq_lock(struct rq *rq1, struct rq *rq2)
+        __acquires(rq1->lock)
+        __acquires(rq2->lock)
+{
+        BUG_ON(!irqs_disabled());
+        BUG_ON(rq1 != rq2);
+        raw_spin_lock(&rq1->lock);
+        __acquire(rq2->lock);   /* Fake it out ;) */
+}
+
+/*
+ * double_rq_unlock - safely unlock two runqueues
+ *
+ * Note this does not restore interrupts like task_rq_unlock,
+ * you need to do so manually after calling.
+ */
+static void double_rq_unlock(struct rq *rq1, struct rq *rq2)
+        __releases(rq1->lock)
+        __releases(rq2->lock)
+{
+        BUG_ON(rq1 != rq2);
+        raw_spin_unlock(&rq1->lock);
+        __release(rq2->lock);
+}
+
 #endif
 
 static void calc_load_account_idle(struct rq *this_rq);
@@ -1882,7 +1910,7 @@ void account_system_vtime(struct task_struct *curr)
          */
         if (hardirq_count())
                 __this_cpu_add(cpu_hardirq_time, delta);
-        else if (in_serving_softirq() && !(curr->flags & PF_KSOFTIRQD))
+        else if (in_serving_softirq() && curr != this_cpu_ksoftirqd())
                 __this_cpu_add(cpu_softirq_time, delta);
 
         irq_time_write_end();
@@ -1922,8 +1950,40 @@ static void update_rq_clock_task(struct rq *rq, s64 delta)
                 sched_rt_avg_update(rq, irq_delta);
 }
 
+static int irqtime_account_hi_update(void)
+{
+        struct cpu_usage_stat *cpustat = &kstat_this_cpu.cpustat;
+        unsigned long flags;
+        u64 latest_ns;
+        int ret = 0;
+
+        local_irq_save(flags);
+        latest_ns = this_cpu_read(cpu_hardirq_time);
+        if (cputime64_gt(nsecs_to_cputime64(latest_ns), cpustat->irq))
+                ret = 1;
+        local_irq_restore(flags);
+        return ret;
+}
+
+static int irqtime_account_si_update(void)
+{
+        struct cpu_usage_stat *cpustat = &kstat_this_cpu.cpustat;
+        unsigned long flags;
+        u64 latest_ns;
+        int ret = 0;
+
+        local_irq_save(flags);
+        latest_ns = this_cpu_read(cpu_softirq_time);
+        if (cputime64_gt(nsecs_to_cputime64(latest_ns), cpustat->softirq))
+                ret = 1;
+        local_irq_restore(flags);
+        return ret;
+}
+
 #else /* CONFIG_IRQ_TIME_ACCOUNTING */
 
+#define sched_clock_irqtime     (0)
+
 static void update_rq_clock_task(struct rq *rq, s64 delta)
 {
         rq->clock_task += delta;
@@ -2027,14 +2087,14 @@ inline int task_curr(const struct task_struct *p)
 
 static inline void check_class_changed(struct rq *rq, struct task_struct *p,
                                        const struct sched_class *prev_class,
-                                       int oldprio, int running)
+                                       int oldprio)
 {
         if (prev_class != p->sched_class) {
                 if (prev_class->switched_from)
-                        prev_class->switched_from(rq, p, running);
-                p->sched_class->switched_to(rq, p, running);
-        } else
-                p->sched_class->prio_changed(rq, p, oldprio, running);
+                        prev_class->switched_from(rq, p);
+                p->sched_class->switched_to(rq, p);
+        } else if (oldprio != p->prio)
+                p->sched_class->prio_changed(rq, p, oldprio);
 }
 
 static void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
@@ -2226,7 +2286,10 @@ unsigned long wait_task_inactive(struct task_struct *p, long match_state)
                  * yield - it could be a while.
                  */
                 if (unlikely(on_rq)) {
-                        schedule_timeout_uninterruptible(1);
+                        ktime_t to = ktime_set(0, NSEC_PER_SEC/HZ);
+
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+                        schedule_hrtimeout(&to, HRTIMER_MODE_REL);
                         continue;
                 }
 
@@ -2267,27 +2330,6 @@ void kick_process(struct task_struct *p)
 EXPORT_SYMBOL_GPL(kick_process);
 #endif /* CONFIG_SMP */
 
-/**
- * task_oncpu_function_call - call a function on the cpu on which a task runs
- * @p:          the task to evaluate
- * @func:       the function to be called
- * @info:       the function call argument
- *
- * Calls the function @func when the task is currently running. This might
- * be on the current CPU, which just calls the function directly
- */
-void task_oncpu_function_call(struct task_struct *p,
-                              void (*func) (void *info), void *info)
-{
-        int cpu;
-
-        preempt_disable();
-        cpu = task_cpu(p);
-        if (task_curr(p))
-                smp_call_function_single(cpu, func, info, 1);
-        preempt_enable();
-}
-
 #ifdef CONFIG_SMP
 /*
  * ->cpus_allowed is protected by either TASK_WAKING or rq->lock held.
@@ -2507,7 +2549,7 @@ out:
  * try_to_wake_up_local - try to wake up a local task with rq lock held
  * @p: the thread to be awakened
  *
- * Put @p on the run-queue if it's not alredy there.  The caller must
+ * Put @p on the run-queue if it's not already there.  The caller must
  * ensure that this_rq() is locked, @p is bound to this_rq() and not
  * the current task.  this_rq() stays locked over invocation.
  */
@@ -2568,6 +2610,7 @@ static void __sched_fork(struct task_struct *p)
         p->se.sum_exec_runtime          = 0;
         p->se.prev_sum_exec_runtime     = 0;
         p->se.nr_migrations             = 0;
+        p->se.vruntime                  = 0;
 
 #ifdef CONFIG_SCHEDSTATS
         memset(&p->se.statistics, 0, sizeof(p->se.statistics));
@@ -2778,9 +2821,12 @@ static inline void
 prepare_task_switch(struct rq *rq, struct task_struct *prev,
                     struct task_struct *next)
 {
+        sched_info_switch(prev, next);
+        perf_event_task_sched_out(prev, next);
         fire_sched_out_preempt_notifiers(prev, next);
         prepare_lock_switch(rq, next);
         prepare_arch_switch(next);
+        trace_sched_switch(prev, next);
 }
 
 /**
@@ -2913,7 +2959,7 @@ context_switch(struct rq *rq, struct task_struct *prev,
         struct mm_struct *mm, *oldmm;
 
         prepare_task_switch(rq, prev, next);
-        trace_sched_switch(prev, next);
+
         mm = next->mm;
         oldmm = prev->active_mm;
         /*
@@ -3570,6 +3616,32 @@ static void account_guest_time(struct task_struct *p, cputime_t cputime,
 }
 
 /*
+ * Account system cpu time to a process and desired cpustat field
+ * @p: the process that the cpu time gets accounted to
+ * @cputime: the cpu time spent in kernel space since the last update
+ * @cputime_scaled: cputime scaled by cpu frequency
+ * @target_cputime64: pointer to cpustat field that has to be updated
+ */
+static inline
+void __account_system_time(struct task_struct *p, cputime_t cputime,
+                        cputime_t cputime_scaled, cputime64_t *target_cputime64)
+{
+        cputime64_t tmp = cputime_to_cputime64(cputime);
+
+        /* Add system time to process. */
+        p->stime = cputime_add(p->stime, cputime);
+        p->stimescaled = cputime_add(p->stimescaled, cputime_scaled);
+        account_group_system_time(p, cputime);
+
+        /* Add system time to cpustat. */
+        *target_cputime64 = cputime64_add(*target_cputime64, tmp);
+        cpuacct_update_stats(p, CPUACCT_STAT_SYSTEM, cputime);
+
+        /* Account for system time used */
+        acct_update_integrals(p);
+}
+
+/*
  * Account system cpu time to a process.
  * @p: the process that the cpu time gets accounted to
  * @hardirq_offset: the offset to subtract from hardirq_count()
@@ -3580,36 +3652,26 @@ void account_system_time(struct task_struct *p, int hardirq_offset,
                          cputime_t cputime, cputime_t cputime_scaled)
 {
         struct cpu_usage_stat *cpustat = &kstat_this_cpu.cpustat;
-        cputime64_t tmp;
+        cputime64_t *target_cputime64;
 
         if ((p->flags & PF_VCPU) && (irq_count() - hardirq_offset == 0)) {
                 account_guest_time(p, cputime, cputime_scaled);
                 return;
         }
 
-        /* Add system time to process. */
-        p->stime = cputime_add(p->stime, cputime);
-        p->stimescaled = cputime_add(p->stimescaled, cputime_scaled);
-        account_group_system_time(p, cputime);
-
-        /* Add system time to cpustat. */
-        tmp = cputime_to_cputime64(cputime);
         if (hardirq_count() - hardirq_offset)
-                cpustat->irq = cputime64_add(cpustat->irq, tmp);
+                target_cputime64 = &cpustat->irq;
         else if (in_serving_softirq())
-                cpustat->softirq = cputime64_add(cpustat->softirq, tmp);
+                target_cputime64 = &cpustat->softirq;
         else
-                cpustat->system = cputime64_add(cpustat->system, tmp);
+                target_cputime64 = &cpustat->system;
 
-        cpuacct_update_stats(p, CPUACCT_STAT_SYSTEM, cputime);
-
-        /* Account for system time used */
-        acct_update_integrals(p);
+        __account_system_time(p, cputime, cputime_scaled, target_cputime64);
 }
 
 /*
  * Account for involuntary wait time.
- * @steal: the cpu time spent in involuntary wait
+ * @cputime: the cpu time spent in involuntary wait
  */
 void account_steal_time(cputime_t cputime)
 {
@@ -3637,6 +3699,73 @@ void account_idle_time(cputime_t cputime)
 
 #ifndef CONFIG_VIRT_CPU_ACCOUNTING
 
+#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+/*
+ * Account a tick to a process and cpustat
+ * @p: the process that the cpu time gets accounted to
+ * @user_tick: is the tick from userspace
+ * @rq: the pointer to rq
+ *
+ * Tick demultiplexing follows the order
+ * - pending hardirq update
+ * - pending softirq update
+ * - user_time
+ * - idle_time
+ * - system time
+ *   - check for guest_time
+ *   - else account as system_time
+ *
+ * Check for hardirq is done both for system and user time as there is
+ * no timer going off while we are on hardirq and hence we may never get an
+ * opportunity to update it solely in system time.
+ * p->stime and friends are only updated on system time and not on irq
+ * softirq as those do not count in task exec_runtime any more.
+ */
+static void irqtime_account_process_tick(struct task_struct *p, int user_tick,
+                                                struct rq *rq)
+{
+        cputime_t one_jiffy_scaled = cputime_to_scaled(cputime_one_jiffy);
+        cputime64_t tmp = cputime_to_cputime64(cputime_one_jiffy);
+        struct cpu_usage_stat *cpustat = &kstat_this_cpu.cpustat;
+
+        if (irqtime_account_hi_update()) {
+                cpustat->irq = cputime64_add(cpustat->irq, tmp);
+        } else if (irqtime_account_si_update()) {
+                cpustat->softirq = cputime64_add(cpustat->softirq, tmp);
+        } else if (this_cpu_ksoftirqd() == p) {
+                /*
+                 * ksoftirqd time do not get accounted in cpu_softirq_time.
+                 * So, we have to handle it separately here.
+                 * Also, p->stime needs to be updated for ksoftirqd.
+                 */
+                __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled,
+                                        &cpustat->softirq);
+        } else if (user_tick) {
+                account_user_time(p, cputime_one_jiffy, one_jiffy_scaled);
+        } else if (p == rq->idle) {
+                account_idle_time(cputime_one_jiffy);
+        } else if (p->flags & PF_VCPU) { /* System time or guest time */
+                account_guest_time(p, cputime_one_jiffy, one_jiffy_scaled);
+        } else {
+                __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled,
+                                        &cpustat->system);
+        }
+}
+
+static void irqtime_account_idle_ticks(int ticks)
+{
+        int i;
+        struct rq *rq = this_rq();
+
+        for (i = 0; i < ticks; i++)
+                irqtime_account_process_tick(current, 0, rq);
+}
+#else /* CONFIG_IRQ_TIME_ACCOUNTING */
+static void irqtime_account_idle_ticks(int ticks) {}
+static void irqtime_account_process_tick(struct task_struct *p, int user_tick,
+                                                struct rq *rq) {}
+#endif /* CONFIG_IRQ_TIME_ACCOUNTING */
+
 /*
  * Account a single tick of cpu time.
  * @p: the process that the cpu time gets accounted to
@@ -3647,6 +3776,11 @@ void account_process_tick(struct task_struct *p, int user_tick)
         cputime_t one_jiffy_scaled = cputime_to_scaled(cputime_one_jiffy);
         struct rq *rq = this_rq();
 
+        if (sched_clock_irqtime) {
+                irqtime_account_process_tick(p, user_tick, rq);
+                return;
+        }
+
         if (user_tick)
                 account_user_time(p, cputime_one_jiffy, one_jiffy_scaled);
         else if ((p != rq->idle) || (irq_count() != HARDIRQ_OFFSET))
@@ -3672,6 +3806,12 @@ void account_steal_ticks(unsigned long ticks)
  */
 void account_idle_ticks(unsigned long ticks)
 {
+
+        if (sched_clock_irqtime) {
+                irqtime_account_idle_ticks(ticks);
+                return;
+        }
+
         account_idle_time(jiffies_to_cputime(ticks));
 }
 
@@ -3889,7 +4029,7 @@ static inline void schedule_debug(struct task_struct *prev)
         schedstat_inc(this_rq(), sched_count);
 #ifdef CONFIG_SCHEDSTATS
         if (unlikely(prev->lock_depth >= 0)) {
-                schedstat_inc(this_rq(), bkl_count);
+                schedstat_inc(this_rq(), rq_sched_info.bkl_count);
                 schedstat_inc(prev, sched_info.bkl_count);
         }
 #endif
@@ -3991,9 +4131,6 @@ need_resched_nonpreemptible:
         rq->skip_clock_update = 0;
 
         if (likely(prev != next)) {
-                sched_info_switch(prev, next);
-                perf_event_task_sched_out(prev, next);
-
                 rq->nr_switches++;
                 rq->curr = next;
                 ++*switch_count;
@@ -4215,6 +4352,7 @@ void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key)
 {
         __wake_up_common(q, mode, 1, 0, key);
 }
+EXPORT_SYMBOL_GPL(__wake_up_locked_key);
 
 /**
  * __wake_up_sync_key - wake up threads blocked on a waitqueue.
@@ -4572,11 +4710,10 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
 
         if (running)
                 p->sched_class->set_curr_task(rq);
-        if (on_rq) {
+        if (on_rq)
                 enqueue_task(rq, p, oldprio < prio ? ENQUEUE_HEAD : 0);
 
-                check_class_changed(rq, p, prev_class, oldprio, running);
-        }
+        check_class_changed(rq, p, prev_class, oldprio);
         task_rq_unlock(rq, &flags);
 }
 
@@ -4824,12 +4961,15 @@ recheck:
                             param->sched_priority > rlim_rtprio)
                                 return -EPERM;
                 }
+
                 /*
-                 * Like positive nice levels, dont allow tasks to
-                 * move out of SCHED_IDLE either:
+                 * Treat SCHED_IDLE as nice 20. Only allow a switch to
+                 * SCHED_NORMAL if the RLIMIT_NICE would normally permit it.
                  */
-                if (p->policy == SCHED_IDLE && policy != SCHED_IDLE)
-                        return -EPERM;
+                if (p->policy == SCHED_IDLE && policy != SCHED_IDLE) {
+                        if (!can_nice(p, TASK_NICE(p)))
+                                return -EPERM;
+                }
 
                 /* can't change other user's priorities */
                 if (!check_same_owner(p))
@@ -4873,7 +5013,8 @@ recheck:
                  * assigned.
                  */
                 if (rt_bandwidth_enabled() && rt_policy(policy) &&
-                                task_group(p)->rt_bandwidth.rt_runtime == 0) {
+                                task_group(p)->rt_bandwidth.rt_runtime == 0 &&
+                                !task_group_is_autogroup(task_group(p))) {
                         __task_rq_unlock(rq);
                         raw_spin_unlock_irqrestore(&p->pi_lock, flags);
                         return -EPERM;
@@ -4903,11 +5044,10 @@ recheck:
 
         if (running)
                 p->sched_class->set_curr_task(rq);
-        if (on_rq) {
+        if (on_rq)
                 activate_task(rq, p, 0);
 
-                check_class_changed(rq, p, prev_class, oldprio, running);
-        }
+        check_class_changed(rq, p, prev_class, oldprio);
         __task_rq_unlock(rq);
         raw_spin_unlock_irqrestore(&p->pi_lock, flags);
 
@@ -5324,6 +5464,65 @@ void __sched yield(void)
 }
 EXPORT_SYMBOL(yield);
 
+/**
+ * yield_to - yield the current processor to another thread in
+ * your thread group, or accelerate that thread toward the
+ * processor it's on.
+ *
+ * It's the caller's job to ensure that the target task struct
+ * can't go away on us before we can do any checks.
+ *
+ * Returns true if we indeed boosted the target task.
+ */
+bool __sched yield_to(struct task_struct *p, bool preempt)
+{
+        struct task_struct *curr = current;
+        struct rq *rq, *p_rq;
+        unsigned long flags;
+        bool yielded = 0;
+
+        local_irq_save(flags);
+        rq = this_rq();
+
+again:
+        p_rq = task_rq(p);
+        double_rq_lock(rq, p_rq);
+        while (task_rq(p) != p_rq) {
+                double_rq_unlock(rq, p_rq);
+                goto again;
+        }
+
+        if (!curr->sched_class->yield_to_task)
+                goto out;
+
+        if (curr->sched_class != p->sched_class)
+                goto out;
+
+        if (task_running(p_rq, p) || p->state)
+                goto out;
+
+        yielded = curr->sched_class->yield_to_task(rq, p, preempt);
+        if (yielded) {
+                schedstat_inc(rq, yld_count);
+                /*
+                 * Make p's CPU reschedule; pick_next_entity takes care of
+                 * fairness.
+                 */
+                if (preempt && rq != p_rq)
+                        resched_task(p_rq->curr);
+        }
+
+out:
+        double_rq_unlock(rq, p_rq);
+        local_irq_restore(flags);
+
+        if (yielded)
+                schedule();
+
+        return yielded;
+}
+EXPORT_SYMBOL_GPL(yield_to);
+
 /*
  * This task is about to go to sleep on IO. Increment rq->nr_iowait so
  * that process accounting knows that this is a task in IO wait state.
@@ -5572,7 +5771,7 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
          * The idle tasks have their own, simple scheduling class:
          */
         idle->sched_class = &idle_sched_class;
-        ftrace_graph_init_task(idle);
+        ftrace_graph_init_idle_task(idle, cpu);
 }
 
 /*
@@ -7797,6 +7996,10 @@ static void init_cfs_rq(struct cfs_rq *cfs_rq, struct rq *rq)
         INIT_LIST_HEAD(&cfs_rq->tasks);
 #ifdef CONFIG_FAIR_GROUP_SCHED
         cfs_rq->rq = rq;
+        /* allow initial update_cfs_load() to truncate */
+#ifdef CONFIG_SMP
+        cfs_rq->load_stamp = 1;
+#endif
 #endif
         cfs_rq->min_vruntime = (u64)(-(1LL << 20));
 }
@@ -7848,7 +8051,7 @@ static void init_tg_cfs_entry(struct task_group *tg, struct cfs_rq *cfs_rq,
         cfs_rq->tg = tg;
 
         tg->se[cpu] = se;
-        /* se could be NULL for init_task_group */
+        /* se could be NULL for root_task_group */
         if (!se)
                 return;
 
@@ -7908,18 +8111,18 @@ void __init sched_init(void)
                 ptr = (unsigned long)kzalloc(alloc_size, GFP_NOWAIT);
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
-                init_task_group.se = (struct sched_entity **)ptr;
+                root_task_group.se = (struct sched_entity **)ptr;
                 ptr += nr_cpu_ids * sizeof(void **);
 
-                init_task_group.cfs_rq = (struct cfs_rq **)ptr;
+                root_task_group.cfs_rq = (struct cfs_rq **)ptr;
                 ptr += nr_cpu_ids * sizeof(void **);
 
 #endif /* CONFIG_FAIR_GROUP_SCHED */
 #ifdef CONFIG_RT_GROUP_SCHED
-                init_task_group.rt_se = (struct sched_rt_entity **)ptr;
+                root_task_group.rt_se = (struct sched_rt_entity **)ptr;
                 ptr += nr_cpu_ids * sizeof(void **);
 
-                init_task_group.rt_rq = (struct rt_rq **)ptr;
+                root_task_group.rt_rq = (struct rt_rq **)ptr;
                 ptr += nr_cpu_ids * sizeof(void **);
 
 #endif /* CONFIG_RT_GROUP_SCHED */
@@ -7939,13 +8142,13 @@ void __init sched_init(void)
                         global_rt_period(), global_rt_runtime());
 
 #ifdef CONFIG_RT_GROUP_SCHED
-        init_rt_bandwidth(&init_task_group.rt_bandwidth,
+        init_rt_bandwidth(&root_task_group.rt_bandwidth,
                         global_rt_period(), global_rt_runtime());
 #endif /* CONFIG_RT_GROUP_SCHED */
 
 #ifdef CONFIG_CGROUP_SCHED
-        list_add(&init_task_group.list, &task_groups);
-        INIT_LIST_HEAD(&init_task_group.children);
+        list_add(&root_task_group.list, &task_groups);
+        INIT_LIST_HEAD(&root_task_group.children);
         autogroup_init(&init_task);
 #endif /* CONFIG_CGROUP_SCHED */
 
@@ -7960,34 +8163,34 @@ void __init sched_init(void)
                 init_cfs_rq(&rq->cfs, rq);
                 init_rt_rq(&rq->rt, rq);
 #ifdef CONFIG_FAIR_GROUP_SCHED
-                init_task_group.shares = init_task_group_load;
+                root_task_group.shares = root_task_group_load;
                 INIT_LIST_HEAD(&rq->leaf_cfs_rq_list);
                 /*
-                 * How much cpu bandwidth does init_task_group get?
+                 * How much cpu bandwidth does root_task_group get?
                  *
                  * In case of task-groups formed thr' the cgroup filesystem, it
                  * gets 100% of the cpu resources in the system. This overall
                  * system cpu resource is divided among the tasks of
-                 * init_task_group and its child task-groups in a fair manner,
+                 * root_task_group and its child task-groups in a fair manner,
                  * based on each entity's (task or task-group's) weight
                  * (se->load.weight).
                  *
-                 * In other words, if init_task_group has 10 tasks of weight
+                 * In other words, if root_task_group has 10 tasks of weight
                  * 1024) and two child groups A0 and A1 (of weight 1024 each),
                  * then A0's share of the cpu resource is:
                  *
                  *      A0's bandwidth = 1024 / (10*1024 + 1024 + 1024) = 8.33%
                  *
-                 * We achieve this by letting init_task_group's tasks sit
-                 * directly in rq->cfs (i.e init_task_group->se[] = NULL).
+                 * We achieve this by letting root_task_group's tasks sit
+                 * directly in rq->cfs (i.e root_task_group->se[] = NULL).
                  */
-                init_tg_cfs_entry(&init_task_group, &rq->cfs, NULL, i, NULL);
+                init_tg_cfs_entry(&root_task_group, &rq->cfs, NULL, i, NULL);
 #endif /* CONFIG_FAIR_GROUP_SCHED */
 
                 rq->rt.rt_runtime = def_rt_bandwidth.rt_runtime;
 #ifdef CONFIG_RT_GROUP_SCHED
                 INIT_LIST_HEAD(&rq->leaf_rt_rq_list);
-                init_tg_rt_entry(&init_task_group, &rq->rt, NULL, i, NULL);
+                init_tg_rt_entry(&root_task_group, &rq->rt, NULL, i, NULL);
 #endif
 
                 for (j = 0; j < CPU_LOAD_IDX_MAX; j++)
@@ -8110,6 +8313,8 @@ EXPORT_SYMBOL(__might_sleep);
 #ifdef CONFIG_MAGIC_SYSRQ
 static void normalize_task(struct rq *rq, struct task_struct *p)
 {
+        const struct sched_class *prev_class = p->sched_class;
+        int old_prio = p->prio;
         int on_rq;
 
         on_rq = p->se.on_rq;
@@ -8120,6 +8325,8 @@ static void normalize_task(struct rq *rq, struct task_struct *p)
                 activate_task(rq, p, 0);
                 resched_task(rq->curr);
         }
+
+        check_class_changed(rq, p, prev_class, old_prio);
 }
 
 void normalize_rt_tasks(void)
@@ -8379,6 +8586,7 @@ static void free_sched_group(struct task_group *tg)
 {
         free_fair_sched_group(tg);
         free_rt_sched_group(tg);
+        autogroup_free(tg);
         kfree(tg);
 }
 
@@ -8510,7 +8718,7 @@ int sched_group_set_shares(struct task_group *tg, unsigned long shares)
                 /* Propagate contribution to hierarchy */
                 raw_spin_lock_irqsave(&rq->lock, flags);
                 for_each_sched_entity(se)
-                        update_cfs_shares(group_cfs_rq(se), 0);
+                        update_cfs_shares(group_cfs_rq(se));
                 raw_spin_unlock_irqrestore(&rq->lock, flags);
         }
 
@@ -8812,7 +9020,7 @@ cpu_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cgrp)
 
         if (!cgrp->parent) {
                 /* This is early initialization for the top cgroup */
-                return &init_task_group.css;
+                return &root_task_group.css;
         }
 
         parent = cgroup_tg(cgrp->parent);
@@ -8883,6 +9091,21 @@ cpu_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
         }
 }
 
+static void
+cpu_cgroup_exit(struct cgroup_subsys *ss, struct cgroup *cgrp,
+                struct cgroup *old_cgrp, struct task_struct *task)
+{
+        /*
+         * cgroup_exit() is called in the copy_process() failure path.
+         * Ignore this case since the task hasn't ran yet, this avoids
+         * trying to poke a half freed task state from generic code.
+         */
+        if (!(task->flags & PF_EXITING))
+                return;
+
+        sched_move_task(task);
+}
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
 static int cpu_shares_write_u64(struct cgroup *cgrp, struct cftype *cftype,
                                 u64 shareval)
@@ -8955,6 +9178,7 @@ struct cgroup_subsys cpu_cgroup_subsys = {
         .destroy        = cpu_cgroup_destroy,
         .can_attach     = cpu_cgroup_can_attach,
         .attach         = cpu_cgroup_attach,
+        .exit           = cpu_cgroup_exit,
         .populate       = cpu_cgroup_populate,
         .subsys_id      = cpu_cgroup_subsys_id,
         .early_init     = 1,
diff --git a/kernel/sched_autogroup.c b/kernel/sched_autogroup.c
index c80fedcd476b..5946ac515602 100644
--- a/kernel/sched_autogroup.c
+++ b/kernel/sched_autogroup.c
@@ -9,10 +9,9 @@ unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
 static struct autogroup autogroup_default;
 static atomic_t autogroup_seq_nr;
 
-static void autogroup_init(struct task_struct *init_task)
+static void __init autogroup_init(struct task_struct *init_task)
 {
-        autogroup_default.tg = &init_task_group;
-        init_task_group.autogroup = &autogroup_default;
+        autogroup_default.tg = &root_task_group;
         kref_init(&autogroup_default.kref);
         init_rwsem(&autogroup_default.lock);
         init_task->signal->autogroup = &autogroup_default;
@@ -27,6 +26,11 @@ static inline void autogroup_destroy(struct kref *kref)
 {
         struct autogroup *ag = container_of(kref, struct autogroup, kref);
 
+#ifdef CONFIG_RT_GROUP_SCHED
+        /* We've redirected RT tasks to the root task group... */
+        ag->tg->rt_se = NULL;
+        ag->tg->rt_rq = NULL;
+#endif
         sched_destroy_group(ag->tg);
 }
 
@@ -55,6 +59,10 @@ static inline struct autogroup *autogroup_task_get(struct task_struct *p)
         return ag;
 }
 
+#ifdef CONFIG_RT_GROUP_SCHED
+static void free_rt_sched_group(struct task_group *tg);
+#endif
+
 static inline struct autogroup *autogroup_create(void)
 {
         struct autogroup *ag = kzalloc(sizeof(*ag), GFP_KERNEL);
@@ -63,7 +71,7 @@ static inline struct autogroup *autogroup_create(void)
         if (!ag)
                 goto out_fail;
 
-        tg = sched_create_group(&init_task_group);
+        tg = sched_create_group(&root_task_group);
 
         if (IS_ERR(tg))
                 goto out_free;
@@ -72,6 +80,19 @@ static inline struct autogroup *autogroup_create(void)
         init_rwsem(&ag->lock);
         ag->id = atomic_inc_return(&autogroup_seq_nr);
         ag->tg = tg;
+#ifdef CONFIG_RT_GROUP_SCHED
+        /*
+         * Autogroup RT tasks are redirected to the root task group
+         * so we don't have to move tasks around upon policy change,
+         * or flail around trying to allocate bandwidth on the fly.
+         * A bandwidth exception in __sched_setscheduler() allows
+         * the policy change to proceed.  Thereafter, task_group()
+         * returns &root_task_group, so zero bandwidth is required.
+         */
+        free_rt_sched_group(tg);
+        tg->rt_se = root_task_group.rt_se;
+        tg->rt_rq = root_task_group.rt_rq;
+#endif
         tg->autogroup = ag;
 
         return ag;
@@ -106,6 +127,11 @@ task_wants_autogroup(struct task_struct *p, struct task_group *tg)
         return true;
 }
 
+static inline bool task_group_is_autogroup(struct task_group *tg)
+{
+        return !!tg->autogroup;
+}
+
 static inline struct task_group *
 autogroup_task_group(struct task_struct *p, struct task_group *tg)
 {
@@ -134,11 +160,15 @@ autogroup_move_group(struct task_struct *p, struct autogroup *ag)
 
         p->signal->autogroup = autogroup_kref_get(ag);
 
+        if (!ACCESS_ONCE(sysctl_sched_autogroup_enabled))
+                goto out;
+
         t = p;
         do {
                 sched_move_task(t);
         } while_each_thread(p, t);
 
+out:
         unlock_task_sighand(p, &flags);
         autogroup_kref_put(prev);
 }
@@ -220,10 +250,14 @@ void proc_sched_autogroup_show_task(struct task_struct *p, struct seq_file *m)
 {
         struct autogroup *ag = autogroup_task_get(p);
 
+        if (!task_group_is_autogroup(ag->tg))
+                goto out;
+
         down_read(&ag->lock);
         seq_printf(m, "/autogroup-%ld nice %d\n", ag->id, ag->nice);
         up_read(&ag->lock);
 
+out:
         autogroup_kref_put(ag);
 }
 #endif /* CONFIG_PROC_FS */
@@ -231,6 +265,9 @@ void proc_sched_autogroup_show_task(struct task_struct *p, struct seq_file *m)
 #ifdef CONFIG_SCHED_DEBUG
 static inline int autogroup_path(struct task_group *tg, char *buf, int buflen)
 {
+        if (!task_group_is_autogroup(tg))
+                return 0;
+
         return snprintf(buf, buflen, "%s-%ld", "/autogroup", tg->autogroup->id);
 }
 #endif /* CONFIG_SCHED_DEBUG */
diff --git a/kernel/sched_autogroup.h b/kernel/sched_autogroup.h
index 5358e241cb20..05577055cfca 100644
--- a/kernel/sched_autogroup.h
+++ b/kernel/sched_autogroup.h
@@ -1,6 +1,11 @@
 #ifdef CONFIG_SCHED_AUTOGROUP
 
 struct autogroup {
+        /*
+         * reference doesn't mean how many thread attach to this
+         * autogroup now. It just stands for the number of task
+         * could use this autogroup.
+         */
         struct kref             kref;
         struct task_group       *tg;
         struct rw_semaphore     lock;
@@ -15,6 +20,10 @@ autogroup_task_group(struct task_struct *p, struct task_group *tg);
 
 static inline void autogroup_init(struct task_struct *init_task) {  }
 static inline void autogroup_free(struct task_group *tg) { }
+static inline bool task_group_is_autogroup(struct task_group *tg)
+{
+        return 0;
+}
 
 static inline struct task_group *
 autogroup_task_group(struct task_struct *p, struct task_group *tg)
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 1dfae3d014b5..7bacd83a4158 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -16,6 +16,8 @@
 #include <linux/kallsyms.h>
 #include <linux/utsname.h>
 
+static DEFINE_SPINLOCK(sched_debug_lock);
+
 /*
  * This allows printing both to /proc/sched_debug and
  * to the console
@@ -86,6 +88,26 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group
 }
 #endif
 
+#ifdef CONFIG_CGROUP_SCHED
+static char group_path[PATH_MAX];
+
+static char *task_group_path(struct task_group *tg)
+{
+        if (autogroup_path(tg, group_path, PATH_MAX))
+                return group_path;
+
+        /*
+         * May be NULL if the underlying cgroup isn't fully-created yet
+         */
+        if (!tg->css.cgroup) {
+                group_path[0] = '\0';
+                return group_path;
+        }
+        cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
+        return group_path;
+}
+#endif
+
 static void
 print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
 {
@@ -108,6 +130,9 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
         SEQ_printf(m, "%15Ld %15Ld %15Ld.%06ld %15Ld.%06ld %15Ld.%06ld",
                 0LL, 0LL, 0LL, 0L, 0LL, 0L, 0LL, 0L);
 #endif
+#ifdef CONFIG_CGROUP_SCHED
+        SEQ_printf(m, " %s", task_group_path(task_group(p)));
+#endif
 
         SEQ_printf(m, "\n");
 }
@@ -144,13 +169,17 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
         struct sched_entity *last;
         unsigned long flags;
 
+#ifdef CONFIG_FAIR_GROUP_SCHED
+        SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
+#else
         SEQ_printf(m, "\ncfs_rq[%d]:\n", cpu);
+#endif
         SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "exec_clock",
                         SPLIT_NS(cfs_rq->exec_clock));
 
         raw_spin_lock_irqsave(&rq->lock, flags);
         if (cfs_rq->rb_leftmost)
-                MIN_vruntime = (__pick_next_entity(cfs_rq))->vruntime;
+                MIN_vruntime = (__pick_first_entity(cfs_rq))->vruntime;
         last = __pick_last_entity(cfs_rq);
         if (last)
                 max_vruntime = last->vruntime;
@@ -191,7 +220,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 
 void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
 {
+#ifdef CONFIG_RT_GROUP_SCHED
+        SEQ_printf(m, "\nrt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
+#else
         SEQ_printf(m, "\nrt_rq[%d]:\n", cpu);
+#endif
 
 #define P(x) \
         SEQ_printf(m, "  .%-30s: %Ld\n", #x, (long long)(rt_rq->x))
@@ -212,6 +245,7 @@ extern __read_mostly int sched_clock_running;
 static void print_cpu(struct seq_file *m, int cpu)
 {
         struct rq *rq = cpu_rq(cpu);
+        unsigned long flags;
 
 #ifdef CONFIG_X86
         {
@@ -262,14 +296,20 @@ static void print_cpu(struct seq_file *m, int cpu)
         P(ttwu_count);
         P(ttwu_local);
 
-        P(bkl_count);
+        SEQ_printf(m, "  .%-30s: %d\n", "bkl_count",
+                                rq->rq_sched_info.bkl_count);
 
 #undef P
+#undef P64
 #endif
+        spin_lock_irqsave(&sched_debug_lock, flags);
         print_cfs_stats(m, cpu);
         print_rt_stats(m, cpu);
 
+        rcu_read_lock();
         print_rq(m, rq, cpu);
+        rcu_read_unlock();
+        spin_unlock_irqrestore(&sched_debug_lock, flags);
 }
 
 static const char *sched_tunable_scaling_names[] = {
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index c62ebae65cf0..3f7ec9e27ee1 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -69,14 +69,6 @@ static unsigned int sched_nr_latency = 8;
 unsigned int sysctl_sched_child_runs_first __read_mostly;
 
 /*
- * sys_sched_yield() compat mode
- *
- * This option switches the agressive yield implementation of the
- * old scheduler back on.
- */
-unsigned int __read_mostly sysctl_sched_compat_yield;
-
-/*
  * SCHED_OTHER wake-up granularity.
  * (default: 1 msec * (1 + ilog(ncpus)), units: nanoseconds)
  *
@@ -419,7 +411,7 @@ static void __dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
         rb_erase(&se->run_node, &cfs_rq->tasks_timeline);
 }
 
-static struct sched_entity *__pick_next_entity(struct cfs_rq *cfs_rq)
+static struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq)
 {
         struct rb_node *left = cfs_rq->rb_leftmost;
 
@@ -429,6 +421,17 @@ static struct sched_entity *__pick_next_entity(struct cfs_rq *cfs_rq)
         return rb_entry(left, struct sched_entity, run_node);
 }
 
+static struct sched_entity *__pick_next_entity(struct sched_entity *se)
+{
+        struct rb_node *next = rb_next(&se->run_node);
+
+        if (!next)
+                return NULL;
+
+        return rb_entry(next, struct sched_entity, run_node);
+}
+
+#ifdef CONFIG_SCHED_DEBUG
 static struct sched_entity *__pick_last_entity(struct cfs_rq *cfs_rq)
 {
         struct rb_node *last = rb_last(&cfs_rq->tasks_timeline);
@@ -443,7 +446,6 @@ static struct sched_entity *__pick_last_entity(struct cfs_rq *cfs_rq)
  * Scheduling class statistics methods:
  */
 
-#ifdef CONFIG_SCHED_DEBUG
 int sched_proc_update_handler(struct ctl_table *table, int write,
                 void __user *buffer, size_t *lenp,
                 loff_t *ppos)
@@ -540,7 +542,7 @@ static u64 sched_vslice(struct cfs_rq *cfs_rq, struct sched_entity *se)
 }
 
 static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update);
-static void update_cfs_shares(struct cfs_rq *cfs_rq, long weight_delta);
+static void update_cfs_shares(struct cfs_rq *cfs_rq);
 
 /*
  * Update the current task's runtime statistics. Skip current tasks that
@@ -699,7 +701,8 @@ account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
         cfs_rq->nr_running--;
 }
 
-#if defined CONFIG_SMP && defined CONFIG_FAIR_GROUP_SCHED
+#ifdef CONFIG_FAIR_GROUP_SCHED
+# ifdef CONFIG_SMP
 static void update_cfs_rq_load_contribution(struct cfs_rq *cfs_rq,
                                             int global_update)
 {
@@ -721,10 +724,10 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
         u64 now, delta;
         unsigned long load = cfs_rq->load.weight;
 
-        if (!cfs_rq)
+        if (cfs_rq->tg == &root_task_group)
                 return;
 
-        now = rq_of(cfs_rq)->clock;
+        now = rq_of(cfs_rq)->clock_task;
         delta = now - cfs_rq->load_stamp;
 
         /* truncate load history at 4 idle periods */
@@ -732,6 +735,7 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
             now - cfs_rq->load_last > 4 * period) {
                 cfs_rq->load_period = 0;
                 cfs_rq->load_avg = 0;
+                delta = period - 1;
         }
 
         cfs_rq->load_stamp = now;
@@ -762,6 +766,49 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
                 list_del_leaf_cfs_rq(cfs_rq);
 }
 
+static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
+{
+        long load_weight, load, shares;
+
+        load = cfs_rq->load.weight;
+
+        load_weight = atomic_read(&tg->load_weight);
+        load_weight += load;
+        load_weight -= cfs_rq->load_contribution;
+
+        shares = (tg->shares * load);
+        if (load_weight)
+                shares /= load_weight;
+
+        if (shares < MIN_SHARES)
+                shares = MIN_SHARES;
+        if (shares > tg->shares)
+                shares = tg->shares;
+
+        return shares;
+}
+
+static void update_entity_shares_tick(struct cfs_rq *cfs_rq)
+{
+        if (cfs_rq->load_unacc_exec_time > sysctl_sched_shares_window) {
+                update_cfs_load(cfs_rq, 0);
+                update_cfs_shares(cfs_rq);
+        }
+}
+# else /* CONFIG_SMP */
+static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
+{
+}
+
+static inline long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
+{
+        return tg->shares;
+}
+
+static inline void update_entity_shares_tick(struct cfs_rq *cfs_rq)
+{
+}
+# endif /* CONFIG_SMP */
 static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
                             unsigned long weight)
 {
@@ -778,51 +825,30 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
                 account_entity_enqueue(cfs_rq, se);
 }
 
-static void update_cfs_shares(struct cfs_rq *cfs_rq, long weight_delta)
+static void update_cfs_shares(struct cfs_rq *cfs_rq)
 {
         struct task_group *tg;
         struct sched_entity *se;
-        long load_weight, load, shares;
-
-        if (!cfs_rq)
-                return;
+        long shares;
 
         tg = cfs_rq->tg;
         se = tg->se[cpu_of(rq_of(cfs_rq))];
         if (!se)
                 return;
-
-        load = cfs_rq->load.weight + weight_delta;
-
-        load_weight = atomic_read(&tg->load_weight);
-        load_weight -= cfs_rq->load_contribution;
-        load_weight += load;
-
-        shares = (tg->shares * load);
-        if (load_weight)
-                shares /= load_weight;
-
-        if (shares < MIN_SHARES)
-                shares = MIN_SHARES;
-        if (shares > tg->shares)
-                shares = tg->shares;
+#ifndef CONFIG_SMP
+        if (likely(se->load.weight == tg->shares))
+                return;
+#endif
+        shares = calc_cfs_shares(cfs_rq, tg);
 
         reweight_entity(cfs_rq_of(se), se, shares);
 }
-
-static void update_entity_shares_tick(struct cfs_rq *cfs_rq)
-{
-        if (cfs_rq->load_unacc_exec_time > sysctl_sched_shares_window) {
-                update_cfs_load(cfs_rq, 0);
-                update_cfs_shares(cfs_rq, 0);
-        }
-}
 #else /* CONFIG_FAIR_GROUP_SCHED */
 static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
 {
 }
 
-static inline void update_cfs_shares(struct cfs_rq *cfs_rq, long weight_delta)
+static inline void update_cfs_shares(struct cfs_rq *cfs_rq)
 {
 }
 
@@ -953,8 +979,8 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
          */
         update_curr(cfs_rq);
         update_cfs_load(cfs_rq, 0);
-        update_cfs_shares(cfs_rq, se->load.weight);
         account_entity_enqueue(cfs_rq, se);
+        update_cfs_shares(cfs_rq);
 
         if (flags & ENQUEUE_WAKEUP) {
                 place_entity(cfs_rq, se, 0);
@@ -971,19 +997,49 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
                 list_add_leaf_cfs_rq(cfs_rq);
 }
 
-static void __clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
+static void __clear_buddies_last(struct sched_entity *se)
 {
-        if (!se || cfs_rq->last == se)
-                cfs_rq->last = NULL;
+        for_each_sched_entity(se) {
+                struct cfs_rq *cfs_rq = cfs_rq_of(se);
+                if (cfs_rq->last == se)
+                        cfs_rq->last = NULL;
+                else
+                        break;
+        }
+}
 
-        if (!se || cfs_rq->next == se)
-                cfs_rq->next = NULL;
+static void __clear_buddies_next(struct sched_entity *se)
+{
+        for_each_sched_entity(se) {
+                struct cfs_rq *cfs_rq = cfs_rq_of(se);
+                if (cfs_rq->next == se)
+                        cfs_rq->next = NULL;
+                else
+                        break;
+        }
+}
+
+static void __clear_buddies_skip(struct sched_entity *se)
+{
+        for_each_sched_entity(se) {
+                struct cfs_rq *cfs_rq = cfs_rq_of(se);
+                if (cfs_rq->skip == se)
+                        cfs_rq->skip = NULL;
+                else
+                        break;
+        }
 }
 
 static void clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
-        for_each_sched_entity(se)
-                __clear_buddies(cfs_rq_of(se), se);
+        if (cfs_rq->last == se)
+                __clear_buddies_last(se);
+
+        if (cfs_rq->next == se)
+                __clear_buddies_next(se);
+
+        if (cfs_rq->skip == se)
+                __clear_buddies_skip(se);
 }
 
 static void
@@ -1016,7 +1072,7 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
         update_cfs_load(cfs_rq, 0);
         account_entity_dequeue(cfs_rq, se);
         update_min_vruntime(cfs_rq);
-        update_cfs_shares(cfs_rq, 0);
+        update_cfs_shares(cfs_rq);
 
         /*
          * Normalize the entity after updating the min_vruntime because the
@@ -1059,9 +1115,12 @@ check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
                 return;
 
         if (cfs_rq->nr_running > 1) {
-                struct sched_entity *se = __pick_next_entity(cfs_rq);
+                struct sched_entity *se = __pick_first_entity(cfs_rq);
                 s64 delta = curr->vruntime - se->vruntime;
 
+                if (delta < 0)
+                        return;
+
                 if (delta > ideal_runtime)
                         resched_task(rq_of(cfs_rq)->curr);
         }
@@ -1100,13 +1159,27 @@ set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
 static int
 wakeup_preempt_entity(struct sched_entity *curr, struct sched_entity *se);
 
+/*
+ * Pick the next process, keeping these things in mind, in this order:
+ * 1) keep things fair between processes/task groups
+ * 2) pick the "next" process, since someone really wants that to run
+ * 3) pick the "last" process, for cache locality
+ * 4) do not run the "skip" process, if something else is available
+ */
 static struct sched_entity *pick_next_entity(struct cfs_rq *cfs_rq)
 {
-        struct sched_entity *se = __pick_next_entity(cfs_rq);
+        struct sched_entity *se = __pick_first_entity(cfs_rq);
         struct sched_entity *left = se;
 
-        if (cfs_rq->next && wakeup_preempt_entity(cfs_rq->next, left) < 1)
-                se = cfs_rq->next;
+        /*
+         * Avoid running the skip buddy, if running something else can
+         * be done without getting too unfair.
+         */
+        if (cfs_rq->skip == se) {
+                struct sched_entity *second = __pick_next_entity(se);
+                if (second && wakeup_preempt_entity(second, left) < 1)
+                        se = second;
+        }
 
         /*
          * Prefer last buddy, try to return the CPU to a preempted task.
@@ -1114,6 +1187,12 @@ static struct sched_entity *pick_next_entity(struct cfs_rq *cfs_rq)
         if (cfs_rq->last && wakeup_preempt_entity(cfs_rq->last, left) < 1)
                 se = cfs_rq->last;
 
+        /*
+         * Someone really wants this to run. If it's not unfair, run it.
+         */
+        if (cfs_rq->next && wakeup_preempt_entity(cfs_rq->next, left) < 1)
+                se = cfs_rq->next;
+
         clear_buddies(cfs_rq, se);
 
         return se;
@@ -1254,7 +1333,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
                 struct cfs_rq *cfs_rq = cfs_rq_of(se);
 
                 update_cfs_load(cfs_rq, 0);
-                update_cfs_shares(cfs_rq, 0);
+                update_cfs_shares(cfs_rq);
         }
 
         hrtick_update(rq);
@@ -1284,58 +1363,12 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
                 struct cfs_rq *cfs_rq = cfs_rq_of(se);
 
                 update_cfs_load(cfs_rq, 0);
-                update_cfs_shares(cfs_rq, 0);
+                update_cfs_shares(cfs_rq);
         }
 
         hrtick_update(rq);
 }
 
-/*
- * sched_yield() support is very simple - we dequeue and enqueue.
- *
- * If compat_yield is turned on then we requeue to the end of the tree.
- */
-static void yield_task_fair(struct rq *rq)
-{
-        struct task_struct *curr = rq->curr;
-        struct cfs_rq *cfs_rq = task_cfs_rq(curr);
-        struct sched_entity *rightmost, *se = &curr->se;
-
-        /*
-         * Are we the only task in the tree?
-         */
-        if (unlikely(cfs_rq->nr_running == 1))
-                return;
-
-        clear_buddies(cfs_rq, se);
-
-        if (likely(!sysctl_sched_compat_yield) && curr->policy != SCHED_BATCH) {
-                update_rq_clock(rq);
-                /*
-                 * Update run-time statistics of the 'current'.
-                 */
-                update_curr(cfs_rq);
-
-                return;
-        }
-        /*
-         * Find the rightmost entry in the rbtree:
-         */
-        rightmost = __pick_last_entity(cfs_rq);
-        /*
-         * Already in the rightmost position?
-         */
-        if (unlikely(!rightmost || entity_before(rightmost, se)))
-                return;
-
-        /*
-         * Minimally necessary key value to be last in the tree:
-         * Upon rescheduling, sched_class::put_prev_task() will place
-         * 'current' within the tree based on its new key value.
-         */
-        se->vruntime = rightmost->vruntime + 1;
-}
-
 #ifdef CONFIG_SMP
 
 static void task_waking_fair(struct rq *rq, struct task_struct *p)
@@ -1362,27 +1395,27 @@ static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
                 return wl;
 
         for_each_sched_entity(se) {
-                long S, rw, s, a, b;
+                long lw, w;
 
-                S = se->my_q->tg->shares;
-                s = se->load.weight;
-                rw = se->my_q->load.weight;
+                tg = se->my_q->tg;
+                w = se->my_q->load.weight;
 
-                a = S*(rw + wl);
-                b = S*rw + s*wg;
+                /* use this cpu's instantaneous contribution */
+                lw = atomic_read(&tg->load_weight);
+                lw -= se->my_q->load_contribution;
+                lw += w + wg;
 
-                wl = s*(a-b);
+                wl += w;
 
-                if (likely(b))
-                        wl /= b;
+                if (lw > 0 && wl < lw)
+                        wl = (wl * tg->shares) / lw;
+                else
+                        wl = tg->shares;
 
-                /*
-                 * Assume the group is already running and will
-                 * thus already be accounted for in the weight.
-                 *
-                 * That is, moving shares between CPUs, does not
-                 * alter the group weight.
-                 */
+                /* zero point is MIN_SHARES */
+                if (wl < MIN_SHARES)
+                        wl = MIN_SHARES;
+                wl -= se->load.weight;
                 wg = 0;
         }
 
@@ -1401,7 +1434,7 @@ static inline unsigned long effective_load(struct task_group *tg, int cpu,
 
 static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
 {
-        unsigned long this_load, load;
+        s64 this_load, load;
         int idx, this_cpu, prev_cpu;
         unsigned long tl_per_task;
         struct task_group *tg;
@@ -1440,8 +1473,8 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
          * Otherwise check if either cpus are near enough in load to allow this
          * task to be woken on this_cpu.
          */
-        if (this_load) {
-                unsigned long this_eff_load, prev_eff_load;
+        if (this_load > 0) {
+                s64 this_eff_load, prev_eff_load;
 
                 this_eff_load = 100;
                 this_eff_load *= power_of(prev_cpu);
@@ -1806,6 +1839,14 @@ static void set_next_buddy(struct sched_entity *se)
         }
 }
 
+static void set_skip_buddy(struct sched_entity *se)
+{
+        if (likely(task_of(se)->policy != SCHED_IDLE)) {
+                for_each_sched_entity(se)
+                        cfs_rq_of(se)->skip = se;
+        }
+}
+
 /*
  * Preempt the current task with a newly woken task if needed:
  */
@@ -1829,16 +1870,18 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
         if (test_tsk_need_resched(curr))
                 return;
 
+        /* Idle tasks are by definition preempted by non-idle tasks. */
+        if (unlikely(curr->policy == SCHED_IDLE) &&
+            likely(p->policy != SCHED_IDLE))
+                goto preempt;
+
         /*
-         * Batch and idle tasks do not preempt (their preemption is driven by
-         * the tick):
+         * Batch and idle tasks do not preempt non-idle tasks (their preemption
+         * is driven by the tick):
          */
         if (unlikely(p->policy != SCHED_NORMAL))
                 return;
 
-        /* Idle tasks are by definition preempted by everybody. */
-        if (unlikely(curr->policy == SCHED_IDLE))
-                goto preempt;
 
         if (!sched_feat(WAKEUP_PREEMPT))
                 return;
@@ -1904,6 +1947,51 @@ static void put_prev_task_fair(struct rq *rq, struct task_struct *prev)
         }
 }
 
+/*
+ * sched_yield() is very simple
+ *
+ * The magic of dealing with the ->skip buddy is in pick_next_entity.
+ */
+static void yield_task_fair(struct rq *rq)
+{
+        struct task_struct *curr = rq->curr;
+        struct cfs_rq *cfs_rq = task_cfs_rq(curr);
+        struct sched_entity *se = &curr->se;
+
+        /*
+         * Are we the only task in the tree?
+         */
+        if (unlikely(rq->nr_running == 1))
+                return;
+
+        clear_buddies(cfs_rq, se);
+
+        if (curr->policy != SCHED_BATCH) {
+                update_rq_clock(rq);
+                /*
+                 * Update run-time statistics of the 'current'.
+                 */
+                update_curr(cfs_rq);
+        }
+
+        set_skip_buddy(se);
+}
+
+static bool yield_to_task_fair(struct rq *rq, struct task_struct *p, bool preempt)
+{
+        struct sched_entity *se = &p->se;
+
+        if (!se->on_rq)
+                return false;
+
+        /* Tell the scheduler that we'd really like pse to run next. */
+        set_next_buddy(se);
+
+        yield_task_fair(rq);
+
+        return true;
+}
+
 #ifdef CONFIG_SMP
 /**************************************************
  * Fair scheduling class load-balancing methods:
@@ -2095,7 +2183,7 @@ static int update_shares_cpu(struct task_group *tg, int cpu)
          * We need to update shares after updating tg->load_weight in
          * order to adjust the weight of groups with long running tasks.
          */
-        update_cfs_shares(cfs_rq, 0);
+        update_cfs_shares(cfs_rq);
 
         raw_spin_unlock_irqrestore(&rq->lock, flags);
 
@@ -2582,7 +2670,6 @@ fix_small_capacity(struct sched_domain *sd, struct sched_group *group)
  * @this_cpu: Cpu for which load balance is currently performed.
  * @idle: Idle status of this_cpu
  * @load_idx: Load index of sched_domain of this_cpu for load calc.
- * @sd_idle: Idle status of the sched_domain containing group.
  * @local_group: Does group contain this_cpu.
  * @cpus: Set of cpus considered for load balancing.
  * @balance: Should we balance.
@@ -2590,7 +2677,7 @@ fix_small_capacity(struct sched_domain *sd, struct sched_group *group)
  */
 static inline void update_sg_lb_stats(struct sched_domain *sd,
                         struct sched_group *group, int this_cpu,
-                        enum cpu_idle_type idle, int load_idx, int *sd_idle,
+                        enum cpu_idle_type idle, int load_idx,
                         int local_group, const struct cpumask *cpus,
                         int *balance, struct sg_lb_stats *sgs)
 {
@@ -2610,9 +2697,6 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
         for_each_cpu_and(i, sched_group_cpus(group), cpus) {
                 struct rq *rq = cpu_rq(i);
 
-                if (*sd_idle && rq->nr_running)
-                        *sd_idle = 0;
-
                 /* Bias balancing toward cpus of our domain */
                 if (local_group) {
                         if (idle_cpu(i) && !first_idle_cpu) {
@@ -2657,7 +2741,7 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
 
         /*
          * Consider the group unbalanced when the imbalance is larger
-         * than the average weight of two tasks.
+         * than the average weight of a task.
          *
          * APZ: with cgroup the avg task weight can vary wildly and
          *      might not be a suitable number - should we keep a
@@ -2667,7 +2751,7 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
         if (sgs->sum_nr_running)
                 avg_load_per_task = sgs->sum_weighted_load / sgs->sum_nr_running;
 
-        if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task && max_nr_running > 1)
+        if ((max_cpu_load - min_cpu_load) >= avg_load_per_task && max_nr_running > 1)
                 sgs->group_imb = 1;
 
         sgs->group_capacity = DIV_ROUND_CLOSEST(group->cpu_power, SCHED_LOAD_SCALE);
@@ -2727,15 +2811,13 @@ static bool update_sd_pick_busiest(struct sched_domain *sd,
  * @sd: sched_domain whose statistics are to be updated.
  * @this_cpu: Cpu for which load balance is currently performed.
  * @idle: Idle status of this_cpu
- * @sd_idle: Idle status of the sched_domain containing sg.
  * @cpus: Set of cpus considered for load balancing.
  * @balance: Should we balance.
  * @sds: variable to hold the statistics for this sched_domain.
  */
 static inline void update_sd_lb_stats(struct sched_domain *sd, int this_cpu,
-                        enum cpu_idle_type idle, int *sd_idle,
-                        const struct cpumask *cpus, int *balance,
-                        struct sd_lb_stats *sds)
+                        enum cpu_idle_type idle, const struct cpumask *cpus,
+                        int *balance, struct sd_lb_stats *sds)
 {
         struct sched_domain *child = sd->child;
         struct sched_group *sg = sd->groups;
@@ -2753,7 +2835,7 @@ static inline void update_sd_lb_stats(struct sched_domain *sd, int this_cpu,
 
                 local_group = cpumask_test_cpu(this_cpu, sched_group_cpus(sg));
                 memset(&sgs, 0, sizeof(sgs));
-                update_sg_lb_stats(sd, sg, this_cpu, idle, load_idx, sd_idle,
+                update_sg_lb_stats(sd, sg, this_cpu, idle, load_idx,
                                 local_group, cpus, balance, &sgs);
 
                 if (local_group && !(*balance))
@@ -3005,7 +3087,6 @@ static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu,
  * @imbalance: Variable which stores amount of weighted load which should
  *              be moved to restore balance/put a group to idle.
  * @idle: The idle status of this_cpu.
- * @sd_idle: The idleness of sd
  * @cpus: The set of CPUs under consideration for load-balancing.
  * @balance: Pointer to a variable indicating if this_cpu
  *      is the appropriate cpu to perform load balancing at this_level.
@@ -3018,7 +3099,7 @@ static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu,
 static struct sched_group *
 find_busiest_group(struct sched_domain *sd, int this_cpu,
                    unsigned long *imbalance, enum cpu_idle_type idle,
-                   int *sd_idle, const struct cpumask *cpus, int *balance)
+                   const struct cpumask *cpus, int *balance)
 {
         struct sd_lb_stats sds;
 
@@ -3028,22 +3109,11 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
          * Compute the various statistics relavent for load balancing at
          * this level.
          */
-        update_sd_lb_stats(sd, this_cpu, idle, sd_idle, cpus,
-                                        balance, &sds);
-
-        /* Cases where imbalance does not exist from POV of this_cpu */
-        /* 1) this_cpu is not the appropriate cpu to perform load balancing
-         *    at this level.
-         * 2) There is no busy sibling group to pull from.
-         * 3) This group is the busiest group.
-         * 4) This group is more busy than the avg busieness at this
-         *    sched_domain.
-         * 5) The imbalance is within the specified limit.
-         *
-         * Note: when doing newidle balance, if the local group has excess
-         * capacity (i.e. nr_running < group_capacity) and the busiest group
-         * does not have any capacity, we force a load balance to pull tasks
-         * to the local group. In this case, we skip past checks 3, 4 and 5.
+        update_sd_lb_stats(sd, this_cpu, idle, cpus, balance, &sds);
+
+        /*
+         * this_cpu is not the appropriate cpu to perform load balancing at
+         * this level.
          */
         if (!(*balance))
                 goto ret;
@@ -3052,41 +3122,55 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
             check_asym_packing(sd, &sds, this_cpu, imbalance))
                 return sds.busiest;
 
+        /* There is no busy sibling group to pull tasks from */
         if (!sds.busiest || sds.busiest_nr_running == 0)
                 goto out_balanced;
 
-        /*  SD_BALANCE_NEWIDLE trumps SMP nice when underutilized */
+        /*
+         * If the busiest group is imbalanced the below checks don't
+         * work because they assumes all things are equal, which typically
+         * isn't true due to cpus_allowed constraints and the like.
+         */
+        if (sds.group_imb)
+                goto force_balance;
+
+        /* SD_BALANCE_NEWIDLE trumps SMP nice when underutilized */
         if (idle == CPU_NEWLY_IDLE && sds.this_has_capacity &&
                         !sds.busiest_has_capacity)
                 goto force_balance;
 
+        /*
+         * If the local group is more busy than the selected busiest group
+         * don't try and pull any tasks.
+         */
         if (sds.this_load >= sds.max_load)
                 goto out_balanced;
 
+        /*
+         * Don't pull any tasks if this group is already above the domain
+         * average load.
+         */
         sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
-
         if (sds.this_load >= sds.avg_load)
                 goto out_balanced;
 
-        /*
-         * In the CPU_NEWLY_IDLE, use imbalance_pct to be conservative.
-         * And to check for busy balance use !idle_cpu instead of
-         * CPU_NOT_IDLE. This is because HT siblings will use CPU_NOT_IDLE
-         * even when they are idle.
-         */
-        if (idle == CPU_NEWLY_IDLE || !idle_cpu(this_cpu)) {
-                if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load)
-                        goto out_balanced;
-        } else {
+        if (idle == CPU_IDLE) {
                 /*
                  * This cpu is idle. If the busiest group load doesn't
                  * have more tasks than the number of available cpu's and
                  * there is no imbalance between this and busiest group
                  * wrt to idle cpu's, it is balanced.
                  */
-                if ((sds.this_idle_cpus  <= sds.busiest_idle_cpus + 1) &&
+                if ((sds.this_idle_cpus <= sds.busiest_idle_cpus + 1) &&
                     sds.busiest_nr_running <= sds.busiest_group_weight)
                         goto out_balanced;
+        } else {
+                /*
+                 * In the CPU_NEWLY_IDLE, CPU_NOT_IDLE cases, use
+                 * imbalance_pct to be conservative.
+                 */
+                if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load)
+                        goto out_balanced;
         }
 
 force_balance:
@@ -3165,7 +3249,7 @@ find_busiest_queue(struct sched_domain *sd, struct sched_group *group,
 /* Working cpumask for load_balance and load_balance_newidle. */
 static DEFINE_PER_CPU(cpumask_var_t, load_balance_tmpmask);
 
-static int need_active_balance(struct sched_domain *sd, int sd_idle, int idle,
+static int need_active_balance(struct sched_domain *sd, int idle,
                                int busiest_cpu, int this_cpu)
 {
         if (idle == CPU_NEWLY_IDLE) {
@@ -3197,10 +3281,6 @@ static int need_active_balance(struct sched_domain *sd, int sd_idle, int idle,
                  * move_tasks() will succeed.  ld_moved will be true and this
                  * active balance code will not be triggered.
                  */
-                if (!sd_idle && sd->flags & SD_SHARE_CPUPOWER &&
-                    !test_sd_parent(sd, SD_POWERSAVINGS_BALANCE))
-                        return 0;
-
                 if (sched_mc_power_savings < POWERSAVINGS_BALANCE_WAKEUP)
                         return 0;
         }
@@ -3218,7 +3298,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
                         struct sched_domain *sd, enum cpu_idle_type idle,
                         int *balance)
 {
-        int ld_moved, all_pinned = 0, active_balance = 0, sd_idle = 0;
+        int ld_moved, all_pinned = 0, active_balance = 0;
         struct sched_group *group;
         unsigned long imbalance;
         struct rq *busiest;
@@ -3227,20 +3307,10 @@ static int load_balance(int this_cpu, struct rq *this_rq,
 
         cpumask_copy(cpus, cpu_active_mask);
 
-        /*
-         * When power savings policy is enabled for the parent domain, idle
-         * sibling can pick up load irrespective of busy siblings. In this case,
-         * let the state of idle sibling percolate up as CPU_IDLE, instead of
-         * portraying it as CPU_NOT_IDLE.
-         */
-        if (idle != CPU_NOT_IDLE && sd->flags & SD_SHARE_CPUPOWER &&
-            !test_sd_parent(sd, SD_POWERSAVINGS_BALANCE))
-                sd_idle = 1;
-
         schedstat_inc(sd, lb_count[idle]);
 
 redo:
-        group = find_busiest_group(sd, this_cpu, &imbalance, idle, &sd_idle,
+        group = find_busiest_group(sd, this_cpu, &imbalance, idle,
                                    cpus, balance);
 
         if (*balance == 0)
@@ -3302,8 +3372,7 @@ redo:
                 if (idle != CPU_NEWLY_IDLE)
                         sd->nr_balance_failed++;
 
-                if (need_active_balance(sd, sd_idle, idle, cpu_of(busiest),
-                                        this_cpu)) {
+                if (need_active_balance(sd, idle, cpu_of(busiest), this_cpu)) {
                         raw_spin_lock_irqsave(&busiest->lock, flags);
 
                         /* don't kick the active_load_balance_cpu_stop,
@@ -3358,10 +3427,6 @@ redo:
                         sd->balance_interval *= 2;
         }
 
-        if (!ld_moved && !sd_idle && sd->flags & SD_SHARE_CPUPOWER &&
-            !test_sd_parent(sd, SD_POWERSAVINGS_BALANCE))
-                ld_moved = -1;
-
         goto out;
 
 out_balanced:
@@ -3375,11 +3440,7 @@ out_one_pinned:
                         (sd->balance_interval < sd->max_interval))
                 sd->balance_interval *= 2;
 
-        if (!sd_idle && sd->flags & SD_SHARE_CPUPOWER &&
-            !test_sd_parent(sd, SD_POWERSAVINGS_BALANCE))
-                ld_moved = -1;
-        else
-                ld_moved = 0;
+        ld_moved = 0;
 out:
         return ld_moved;
 }
@@ -3803,8 +3864,7 @@ static void rebalance_domains(int cpu, enum cpu_idle_type idle)
                         if (load_balance(cpu, rq, sd, idle, &balance)) {
                                 /*
                                  * We've pulled tasks over so either we're no
-                                 * longer idle, or one of our SMT siblings is
-                                 * not idle.
+                                 * longer idle.
                                  */
                                 idle = CPU_NOT_IDLE;
                         }
@@ -4051,33 +4111,62 @@ static void task_fork_fair(struct task_struct *p)
  * Priority of the task has changed. Check to see if we preempt
  * the current task.
  */
-static void prio_changed_fair(struct rq *rq, struct task_struct *p,
-                              int oldprio, int running)
+static void
+prio_changed_fair(struct rq *rq, struct task_struct *p, int oldprio)
 {
+        if (!p->se.on_rq)
+                return;
+
         /*
          * Reschedule if we are currently running on this runqueue and
          * our priority decreased, or if we are not currently running on
          * this runqueue and our priority is higher than the current's
          */
-        if (running) {
+        if (rq->curr == p) {
                 if (p->prio > oldprio)
                         resched_task(rq->curr);
         } else
                 check_preempt_curr(rq, p, 0);
 }
 
+static void switched_from_fair(struct rq *rq, struct task_struct *p)
+{
+        struct sched_entity *se = &p->se;
+        struct cfs_rq *cfs_rq = cfs_rq_of(se);
+
+        /*
+         * Ensure the task's vruntime is normalized, so that when its
+         * switched back to the fair class the enqueue_entity(.flags=0) will
+         * do the right thing.
+         *
+         * If it was on_rq, then the dequeue_entity(.flags=0) will already
+         * have normalized the vruntime, if it was !on_rq, then only when
+         * the task is sleeping will it still have non-normalized vruntime.
+         */
+        if (!se->on_rq && p->state != TASK_RUNNING) {
+                /*
+                 * Fix up our vruntime so that the current sleep doesn't
+                 * cause 'unlimited' sleep bonus.
+                 */
+                place_entity(cfs_rq, se, 0);
+                se->vruntime -= cfs_rq->min_vruntime;
+        }
+}
+
 /*
  * We switched to the sched_fair class.
  */
-static void switched_to_fair(struct rq *rq, struct task_struct *p,
-                             int running)
+static void switched_to_fair(struct rq *rq, struct task_struct *p)
 {
+        if (!p->se.on_rq)
+                return;
+
         /*
          * We were most likely switched from sched_rt, so
          * kick off the schedule if running, otherwise just see
          * if we can still preempt the current task.
          */
-        if (running)
+        if (rq->curr == p)
                 resched_task(rq->curr);
         else
                 check_preempt_curr(rq, p, 0);
@@ -4143,6 +4232,7 @@ static const struct sched_class fair_sched_class = {
         .enqueue_task           = enqueue_task_fair,
         .dequeue_task           = dequeue_task_fair,
         .yield_task             = yield_task_fair,
+        .yield_to_task          = yield_to_task_fair,
 
         .check_preempt_curr     = check_preempt_wakeup,
 
@@ -4163,6 +4253,7 @@ static const struct sched_class fair_sched_class = {
         .task_fork              = task_fork_fair,
 
         .prio_changed           = prio_changed_fair,
+        .switched_from          = switched_from_fair,
         .switched_to            = switched_to_fair,
 
         .get_rr_interval        = get_rr_interval_fair,
diff --git a/kernel/sched_idletask.c b/kernel/sched_idletask.c
index 9fa0f402c87c..c82f26c1b7c3 100644
--- a/kernel/sched_idletask.c
+++ b/kernel/sched_idletask.c
@@ -52,31 +52,15 @@ static void set_curr_task_idle(struct rq *rq)
 {
 }
 
-static void switched_to_idle(struct rq *rq, struct task_struct *p,
-                             int running)
+static void switched_to_idle(struct rq *rq, struct task_struct *p)
 {
-        /* Can this actually happen?? */
-        if (running)
-                resched_task(rq->curr);
-        else
-                check_preempt_curr(rq, p, 0);
+        BUG();
 }
 
-static void prio_changed_idle(struct rq *rq, struct task_struct *p,
-                              int oldprio, int running)
+static void
+prio_changed_idle(struct rq *rq, struct task_struct *p, int oldprio)
 {
-        /* This can happen for hot plug CPUS */
-
-        /*
-         * Reschedule if we are currently running on this runqueue and
-         * our priority decreased, or if we are not currently running on
-         * this runqueue and our priority is higher than the current's
-         */
-        if (running) {
-                if (p->prio > oldprio)
-                        resched_task(rq->curr);
-        } else
-                check_preempt_curr(rq, p, 0);
+        BUG();
 }
 
 static unsigned int get_rr_interval_idle(struct rq *rq, struct task_struct *task)
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index c914ec747ca6..db308cb08b75 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -210,11 +210,12 @@ static void dequeue_rt_entity(struct sched_rt_entity *rt_se);
 
 static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
 {
-        int this_cpu = smp_processor_id();
         struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
         struct sched_rt_entity *rt_se;
 
-        rt_se = rt_rq->tg->rt_se[this_cpu];
+        int cpu = cpu_of(rq_of_rt_rq(rt_rq));
+
+        rt_se = rt_rq->tg->rt_se[cpu];
 
         if (rt_rq->rt_nr_running) {
                 if (rt_se && !on_rt_rq(rt_se))
@@ -226,10 +227,10 @@ static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
 
 static void sched_rt_rq_dequeue(struct rt_rq *rt_rq)
 {
-        int this_cpu = smp_processor_id();
         struct sched_rt_entity *rt_se;
+        int cpu = cpu_of(rq_of_rt_rq(rt_rq));
 
-        rt_se = rt_rq->tg->rt_se[this_cpu];
+        rt_se = rt_rq->tg->rt_se[cpu];
 
         if (rt_se && on_rt_rq(rt_se))
                 dequeue_rt_entity(rt_se);
@@ -565,8 +566,11 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
                         if (rt_rq->rt_time || rt_rq->rt_nr_running)
                                 idle = 0;
                         raw_spin_unlock(&rt_rq->rt_runtime_lock);
-                } else if (rt_rq->rt_nr_running)
+                } else if (rt_rq->rt_nr_running) {
                         idle = 0;
+                        if (!rt_rq_throttled(rt_rq))
+                                enqueue = 1;
+                }
 
                 if (enqueue)
                         sched_rt_rq_enqueue(rt_rq);
@@ -625,7 +629,7 @@ static void update_curr_rt(struct rq *rq)
         struct rt_rq *rt_rq = rt_rq_of_se(rt_se);
         u64 delta_exec;
 
-        if (!task_has_rt_policy(curr))
+        if (curr->sched_class != &rt_sched_class)
                 return;
 
         delta_exec = rq->clock_task - curr->se.exec_start;
@@ -1595,8 +1599,7 @@ static void rq_offline_rt(struct rq *rq)
  * When switch from the rt queue, we bring ourselves to a position
  * that we might want to pull RT tasks from other runqueues.
  */
-static void switched_from_rt(struct rq *rq, struct task_struct *p,
-                           int running)
+static void switched_from_rt(struct rq *rq, struct task_struct *p)
 {
         /*
          * If there are other RT tasks then we will reschedule
@@ -1605,7 +1608,7 @@ static void switched_from_rt(struct rq *rq, struct task_struct *p,
          * we may need to handle the pulling of RT tasks
          * now.
          */
-        if (!rq->rt.rt_nr_running)
+        if (p->se.on_rq && !rq->rt.rt_nr_running)
                 pull_rt_task(rq);
 }
 
@@ -1624,8 +1627,7 @@ static inline void init_sched_rt_class(void)
  * with RT tasks. In this case we try to push them off to
  * other runqueues.
  */
-static void switched_to_rt(struct rq *rq, struct task_struct *p,
-                           int running)
+static void switched_to_rt(struct rq *rq, struct task_struct *p)
 {
         int check_resched = 1;
 
@@ -1636,7 +1638,7 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p,
          * If that current running task is also an RT task
          * then see if we can move to another run queue.
          */
-        if (!running) {
+        if (p->se.on_rq && rq->curr != p) {
 #ifdef CONFIG_SMP
                 if (rq->rt.overloaded && push_rt_task(rq) &&
                     /* Don't resched if we changed runqueues */
@@ -1652,10 +1654,13 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p,
  * Priority of the task has changed. This may cause
  * us to initiate a push or pull.
  */
-static void prio_changed_rt(struct rq *rq, struct task_struct *p,
-                            int oldprio, int running)
+static void
+prio_changed_rt(struct rq *rq, struct task_struct *p, int oldprio)
 {
-        if (running) {
+        if (!p->se.on_rq)
+                return;
+
+        if (rq->curr == p) {
 #ifdef CONFIG_SMP
                 /*
                  * If our priority decreases while running, we
diff --git a/kernel/sched_stoptask.c b/kernel/sched_stoptask.c
index 2bf6b47058c1..84ec9bcf82d9 100644
--- a/kernel/sched_stoptask.c
+++ b/kernel/sched_stoptask.c
@@ -59,14 +59,13 @@ static void set_curr_task_stop(struct rq *rq)
 {
 }
 
-static void switched_to_stop(struct rq *rq, struct task_struct *p,
-                             int running)
+static void switched_to_stop(struct rq *rq, struct task_struct *p)
 {
         BUG(); /* its impossible to change to this class */
 }
 
-static void prio_changed_stop(struct rq *rq, struct task_struct *p,
-                              int oldprio, int running)
+static void
+prio_changed_stop(struct rq *rq, struct task_struct *p, int oldprio)
 {
         BUG(); /* how!?, what priority? */
 }
diff --git a/kernel/smp.c b/kernel/smp.c
index 12ed8b013e2d..9910744f0856 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -13,6 +13,7 @@
 #include <linux/smp.h>
 #include <linux/cpu.h>
 
+#ifdef CONFIG_USE_GENERIC_SMP_HELPERS
 static struct {
         struct list_head        queue;
         raw_spinlock_t          lock;
@@ -193,23 +194,52 @@ void generic_smp_call_function_interrupt(void)
          */
         list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
                 int refs;
+                void (*func) (void *info);
 
-                if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
+                /*
+                 * Since we walk the list without any locks, we might
+                 * see an entry that was completed, removed from the
+                 * list and is in the process of being reused.
+                 *
+                 * We must check that the cpu is in the cpumask before
+                 * checking the refs, and both must be set before
+                 * executing the callback on this cpu.
+                 */
+
+                if (!cpumask_test_cpu(cpu, data->cpumask))
+                        continue;
+
+                smp_rmb();
+
+                if (atomic_read(&data->refs) == 0)
                         continue;
 
+                func = data->csd.func;                  /* for later warn */
                 data->csd.func(data->csd.info);
 
+                /*
+                 * If the cpu mask is not still set then it enabled interrupts,
+                 * we took another smp interrupt, and executed the function
+                 * twice on this cpu.  In theory that copy decremented refs.
+                 */
+                if (!cpumask_test_and_clear_cpu(cpu, data->cpumask)) {
+                        WARN(1, "%pS enabled interrupts and double executed\n",
+                             func);
+                        continue;
+                }
+
                 refs = atomic_dec_return(&data->refs);
                 WARN_ON(refs < 0);
-                if (!refs) {
-                        raw_spin_lock(&call_function.lock);
-                        list_del_rcu(&data->csd.list);
-                        raw_spin_unlock(&call_function.lock);
-                }
 
                 if (refs)
                         continue;
 
+                WARN_ON(!cpumask_empty(data->cpumask));
+
+                raw_spin_lock(&call_function.lock);
+                list_del_rcu(&data->csd.list);
+                raw_spin_unlock(&call_function.lock);
+
                 csd_unlock(&data->csd);
         }
 
@@ -429,7 +459,7 @@ void smp_call_function_many(const struct cpumask *mask,
          * can't happen.
          */
         WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled()
-                     && !oops_in_progress);
+                     && !oops_in_progress && !early_boot_irqs_disabled);
 
         /* So, what's a CPU they want? Ignoring this one. */
         cpu = cpumask_first_and(mask, cpu_online_mask);
@@ -453,11 +483,21 @@ void smp_call_function_many(const struct cpumask *mask,
 
         data = &__get_cpu_var(cfd_data);
         csd_lock(&data->csd);
+        BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
 
         data->csd.func = func;
         data->csd.info = info;
         cpumask_and(data->cpumask, mask, cpu_online_mask);
         cpumask_clear_cpu(this_cpu, data->cpumask);
+
+        /*
+         * To ensure the interrupt handler gets an complete view
+         * we order the cpumask and refs writes and order the read
+         * of them in the interrupt handler.  In addition we may
+         * only clear our own cpu bit from the mask.
+         */
+        smp_wmb();
+
         atomic_set(&data->refs, cpumask_weight(data->cpumask));
 
         raw_spin_lock_irqsave(&call_function.lock, flags);
@@ -529,3 +569,24 @@ void ipi_call_unlock_irq(void)
 {
         raw_spin_unlock_irq(&call_function.lock);
 }
+#endif /* USE_GENERIC_SMP_HELPERS */
+
+/*
+ * Call a function on all processors.  May be used during early boot while
+ * early_boot_irqs_disabled is set.  Use local_irq_save/restore() instead
+ * of local_irq_disable/enable().
+ */
+int on_each_cpu(void (*func) (void *info), void *info, int wait)
+{
+        unsigned long flags;
+        int ret = 0;
+
+        preempt_disable();
+        ret = smp_call_function(func, info, wait);
+        local_irq_save(flags);
+        func(info);
+        local_irq_restore(flags);
+        preempt_enable();
+        return ret;
+}
+EXPORT_SYMBOL(on_each_cpu);
diff --git a/kernel/softirq.c b/kernel/softirq.c
index d4d918a91881..56e5dec837f0 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -54,7 +54,7 @@ EXPORT_SYMBOL(irq_stat);
 
 static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
 
-static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
 
 char *softirq_to_name[NR_SOFTIRQS] = {
         "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
@@ -70,7 +70,7 @@ char *softirq_to_name[NR_SOFTIRQS] = {
 static void wakeup_softirqd(void)
 {
         /* Interrupts are disabled: no need to stop preemption */
-        struct task_struct *tsk = __get_cpu_var(ksoftirqd);
+        struct task_struct *tsk = __this_cpu_read(ksoftirqd);
 
         if (tsk && tsk->state != TASK_RUNNING)
                 wake_up_process(tsk);
@@ -311,9 +311,21 @@ void irq_enter(void)
 }
 
 #ifdef __ARCH_IRQ_EXIT_IRQS_DISABLED
-# define invoke_softirq()       __do_softirq()
+static inline void invoke_softirq(void)
+{
+        if (!force_irqthreads)
+                __do_softirq();
+        else
+                wakeup_softirqd();
+}
 #else
-# define invoke_softirq()       do_softirq()
+static inline void invoke_softirq(void)
+{
+        if (!force_irqthreads)
+                do_softirq();
+        else
+                wakeup_softirqd();
+}
 #endif
 
 /*
@@ -388,8 +400,8 @@ void __tasklet_schedule(struct tasklet_struct *t)
 
         local_irq_save(flags);
         t->next = NULL;
-        *__get_cpu_var(tasklet_vec).tail = t;
-        __get_cpu_var(tasklet_vec).tail = &(t->next);
+        *__this_cpu_read(tasklet_vec.tail) = t;
+        __this_cpu_write(tasklet_vec.tail, &(t->next));
         raise_softirq_irqoff(TASKLET_SOFTIRQ);
         local_irq_restore(flags);
 }
@@ -402,8 +414,8 @@ void __tasklet_hi_schedule(struct tasklet_struct *t)
 
         local_irq_save(flags);
         t->next = NULL;
-        *__get_cpu_var(tasklet_hi_vec).tail = t;
-        __get_cpu_var(tasklet_hi_vec).tail = &(t->next);
+        *__this_cpu_read(tasklet_hi_vec.tail) = t;
+        __this_cpu_write(tasklet_hi_vec.tail,  &(t->next));
         raise_softirq_irqoff(HI_SOFTIRQ);
         local_irq_restore(flags);
 }
@@ -414,8 +426,8 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
 {
         BUG_ON(!irqs_disabled());
 
-        t->next = __get_cpu_var(tasklet_hi_vec).head;
-        __get_cpu_var(tasklet_hi_vec).head = t;
+        t->next = __this_cpu_read(tasklet_hi_vec.head);
+        __this_cpu_write(tasklet_hi_vec.head, t);
         __raise_softirq_irqoff(HI_SOFTIRQ);
 }
 
@@ -426,9 +438,9 @@ static void tasklet_action(struct softirq_action *a)
         struct tasklet_struct *list;
 
         local_irq_disable();
-        list = __get_cpu_var(tasklet_vec).head;
-        __get_cpu_var(tasklet_vec).head = NULL;
-        __get_cpu_var(tasklet_vec).tail = &__get_cpu_var(tasklet_vec).head;
+        list = __this_cpu_read(tasklet_vec.head);
+        __this_cpu_write(tasklet_vec.head, NULL);
+        __this_cpu_write(tasklet_vec.tail, &__get_cpu_var(tasklet_vec).head);
         local_irq_enable();
 
         while (list) {
@@ -449,8 +461,8 @@ static void tasklet_action(struct softirq_action *a)
 
                 local_irq_disable();
                 t->next = NULL;
-                *__get_cpu_var(tasklet_vec).tail = t;
-                __get_cpu_var(tasklet_vec).tail = &(t->next);
+                *__this_cpu_read(tasklet_vec.tail) = t;
+                __this_cpu_write(tasklet_vec.tail, &(t->next));
                 __raise_softirq_irqoff(TASKLET_SOFTIRQ);
                 local_irq_enable();
         }
@@ -461,9 +473,9 @@ static void tasklet_hi_action(struct softirq_action *a)
         struct tasklet_struct *list;
 
         local_irq_disable();
-        list = __get_cpu_var(tasklet_hi_vec).head;
-        __get_cpu_var(tasklet_hi_vec).head = NULL;
-        __get_cpu_var(tasklet_hi_vec).tail = &__get_cpu_var(tasklet_hi_vec).head;
+        list = __this_cpu_read(tasklet_hi_vec.head);
+        __this_cpu_write(tasklet_hi_vec.head, NULL);
+        __this_cpu_write(tasklet_hi_vec.tail, &__get_cpu_var(tasklet_hi_vec).head);
         local_irq_enable();
 
         while (list) {
@@ -484,8 +496,8 @@ static void tasklet_hi_action(struct softirq_action *a)
 
                 local_irq_disable();
                 t->next = NULL;
-                *__get_cpu_var(tasklet_hi_vec).tail = t;
-                __get_cpu_var(tasklet_hi_vec).tail = &(t->next);
+                *__this_cpu_read(tasklet_hi_vec.tail) = t;
+                __this_cpu_write(tasklet_hi_vec.tail, &(t->next));
                 __raise_softirq_irqoff(HI_SOFTIRQ);
                 local_irq_enable();
         }
@@ -721,7 +733,6 @@ static int run_ksoftirqd(void * __bind_cpu)
 {
         set_current_state(TASK_INTERRUPTIBLE);
 
-        current->flags |= PF_KSOFTIRQD;
         while (!kthread_should_stop()) {
                 preempt_disable();
                 if (!local_softirq_pending()) {
@@ -738,7 +749,10 @@ static int run_ksoftirqd(void * __bind_cpu)
                            don't process */
                         if (cpu_is_offline((long)__bind_cpu))
                                 goto wait_to_die;
-                        do_softirq();
+                        local_irq_disable();
+                        if (local_softirq_pending())
+                                __do_softirq();
+                        local_irq_enable();
                         preempt_enable_no_resched();
                         cond_resched();
                         preempt_disable();
@@ -802,16 +816,16 @@ static void takeover_tasklets(unsigned int cpu)
 
         /* Find end, append list for that CPU. */
         if (&per_cpu(tasklet_vec, cpu).head != per_cpu(tasklet_vec, cpu).tail) {
-                *(__get_cpu_var(tasklet_vec).tail) = per_cpu(tasklet_vec, cpu).head;
-                __get_cpu_var(tasklet_vec).tail = per_cpu(tasklet_vec, cpu).tail;
+                *__this_cpu_read(tasklet_vec.tail) = per_cpu(tasklet_vec, cpu).head;
+                this_cpu_write(tasklet_vec.tail, per_cpu(tasklet_vec, cpu).tail);
                 per_cpu(tasklet_vec, cpu).head = NULL;
                 per_cpu(tasklet_vec, cpu).tail = &per_cpu(tasklet_vec, cpu).head;
         }
         raise_softirq_irqoff(TASKLET_SOFTIRQ);
 
         if (&per_cpu(tasklet_hi_vec, cpu).head != per_cpu(tasklet_hi_vec, cpu).tail) {
-                *__get_cpu_var(tasklet_hi_vec).tail = per_cpu(tasklet_hi_vec, cpu).head;
-                __get_cpu_var(tasklet_hi_vec).tail = per_cpu(tasklet_hi_vec, cpu).tail;
+                *__this_cpu_read(tasklet_hi_vec.tail) = per_cpu(tasklet_hi_vec, cpu).head;
+                __this_cpu_write(tasklet_hi_vec.tail, per_cpu(tasklet_hi_vec, cpu).tail);
                 per_cpu(tasklet_hi_vec, cpu).head = NULL;
                 per_cpu(tasklet_hi_vec, cpu).tail = &per_cpu(tasklet_hi_vec, cpu).head;
         }
@@ -853,7 +867,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
                              cpumask_any(cpu_online_mask));
         case CPU_DEAD:
         case CPU_DEAD_FROZEN: {
-                static struct sched_param param = {
+                static const struct sched_param param = {
                         .sched_priority = MAX_RT_PRIO-1
                 };
 
@@ -885,25 +899,6 @@ static __init int spawn_ksoftirqd(void)
 }
 early_initcall(spawn_ksoftirqd);
 
-#ifdef CONFIG_SMP
-/*
- * Call a function on all processors
- */
-int on_each_cpu(void (*func) (void *info), void *info, int wait)
-{
-        int ret = 0;
-
-        preempt_disable();
-        ret = smp_call_function(func, info, wait);
-        local_irq_disable();
-        func(info);
-        local_irq_enable();
-        preempt_enable();
-        return ret;
-}
-EXPORT_SYMBOL(on_each_cpu);
-#endif
-
 /*
  * [ These __weak aliases are kept in a separate compilation unit, so that
  *   GCC does not inline them incorrectly. ]
diff --git a/kernel/srcu.c b/kernel/srcu.c
index 98d8c1e80edb..73ce23feaea9 100644
--- a/kernel/srcu.c
+++ b/kernel/srcu.c
@@ -156,6 +156,16 @@ void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 EXPORT_SYMBOL_GPL(__srcu_read_unlock);
 
 /*
+ * We use an adaptive strategy for synchronize_srcu() and especially for
+ * synchronize_srcu_expedited().  We spin for a fixed time period
+ * (defined below) to allow SRCU readers to exit their read-side critical
+ * sections.  If there are still some readers after 10 microseconds,
+ * we repeatedly block for 1-millisecond time periods.  This approach
+ * has done well in testing, so there is no need for a config parameter.
+ */
+#define SYNCHRONIZE_SRCU_READER_DELAY 10
+
+/*
  * Helper function for synchronize_srcu() and synchronize_srcu_expedited().
  */
 static void __synchronize_srcu(struct srcu_struct *sp, void (*sync_func)(void))
@@ -207,11 +217,12 @@ static void __synchronize_srcu(struct srcu_struct *sp, void (*sync_func)(void))
          * will have finished executing.  We initially give readers
          * an arbitrarily chosen 10 microseconds to get out of their
          * SRCU read-side critical sections, then loop waiting 1/HZ
-         * seconds per iteration.
+         * seconds per iteration.  The 10-microsecond value has done
+         * very well in testing.
          */
 
         if (srcu_readers_active_idx(sp, idx))
-                udelay(CONFIG_SRCU_SYNCHRONIZE_DELAY);
+                udelay(SYNCHRONIZE_SRCU_READER_DELAY);
         while (srcu_readers_active_idx(sp, idx))
                 schedule_timeout_interruptible(1);
 
diff --git a/kernel/sys.c b/kernel/sys.c
index 2745dcdb6c6c..18da702ec813 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -43,6 +43,8 @@
 #include <linux/kprobes.h>
 #include <linux/user_namespace.h>
 
+#include <linux/kmsg_dump.h>
+
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/unistd.h>
@@ -285,6 +287,7 @@ out_unlock:
  */
 void emergency_restart(void)
 {
+        kmsg_dump(KMSG_DUMP_EMERG);
         machine_emergency_restart();
 }
 EXPORT_SYMBOL_GPL(emergency_restart);
@@ -312,6 +315,7 @@ void kernel_restart(char *cmd)
                 printk(KERN_EMERG "Restarting system.\n");
         else
                 printk(KERN_EMERG "Restarting system with command '%s'.\n", cmd);
+        kmsg_dump(KMSG_DUMP_RESTART);
         machine_restart(cmd);
 }
 EXPORT_SYMBOL_GPL(kernel_restart);
@@ -333,6 +337,7 @@ void kernel_halt(void)
         kernel_shutdown_prepare(SYSTEM_HALT);
         sysdev_shutdown();
         printk(KERN_EMERG "System halted.\n");
+        kmsg_dump(KMSG_DUMP_HALT);
         machine_halt();
 }
 
@@ -351,6 +356,7 @@ void kernel_power_off(void)
         disable_nonboot_cpus();
         sysdev_shutdown();
         printk(KERN_EMERG "Power down.\n");
+        kmsg_dump(KMSG_DUMP_POWEROFF);
         machine_power_off();
 }
 EXPORT_SYMBOL_GPL(kernel_power_off);
@@ -1379,7 +1385,8 @@ static int check_prlimit_permission(struct task_struct *task)
         const struct cred *cred = current_cred(), *tcred;
 
         tcred = __task_cred(task);
-        if ((cred->uid != tcred->euid ||
+        if (current != task &&
+            (cred->uid != tcred->euid ||
              cred->uid != tcred->suid ||
              cred->uid != tcred->uid  ||
              cred->gid != tcred->egid ||
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index c782fe9924c7..25cc41cd8f33 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -186,3 +186,8 @@ cond_syscall(sys_perf_event_open);
 /* fanotify! */
 cond_syscall(sys_fanotify_init);
 cond_syscall(sys_fanotify_mark);
+
+/* open by handle */
+cond_syscall(sys_name_to_handle_at);
+cond_syscall(sys_open_by_handle_at);
+cond_syscall(compat_sys_open_by_handle_at);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ae5cbb1e3ced..51054fea5d99 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/signal.h>
+#include <linux/printk.h>
 #include <linux/proc_fs.h>
 #include <linux/security.h>
 #include <linux/ctype.h>
@@ -169,7 +170,8 @@ static int proc_taint(struct ctl_table *table, int write,
 #endif
 
 #ifdef CONFIG_MAGIC_SYSRQ
-static int __sysrq_enabled; /* Note: sysrq code ises it's own private copy */
+/* Note: sysrq code uses it's own private copy */
+static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
 
 static int sysrq_sysctl_handler(ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp,
@@ -192,9 +194,9 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
 static struct ctl_table root_table[];
 static struct ctl_table_root sysctl_table_root;
 static struct ctl_table_header root_table_header = {
-        .count = 1,
+        {{.count = 1,
         .ctl_table = root_table,
-        .ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),
+        .ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),}},
         .root = &sysctl_table_root,
         .set = &sysctl_table_root.default_set,
 };
@@ -245,10 +247,6 @@ static struct ctl_table root_table[] = {
                 .mode           = 0555,
                 .child          = dev_table,
         },
-/*
- * NOTE: do not add new entries to this table unless you have read
- * Documentation/sysctl/ctl_unnumbered.txt
- */
         { }
 };
 
@@ -363,20 +361,13 @@ static struct ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = sched_rt_handler,
         },
-        {
-                .procname       = "sched_compat_yield",
-                .data           = &sysctl_sched_compat_yield,
-                .maxlen         = sizeof(unsigned int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
 #ifdef CONFIG_SCHED_AUTOGROUP
         {
                 .procname       = "sched_autogroup_enabled",
                 .data           = &sysctl_sched_autogroup_enabled,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &zero,
                 .extra2         = &one,
         },
@@ -710,6 +701,15 @@ static struct ctl_table kern_table[] = {
                 .extra1         = &zero,
                 .extra2         = &one,
         },
+        {
+                .procname       = "kptr_restrict",
+                .data           = &kptr_restrict,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &two,
+        },
 #endif
         {
                 .procname       = "ngroups_max",
@@ -941,7 +941,7 @@ static struct ctl_table kern_table[] = {
                 .data           = &sysctl_perf_event_sample_rate,
                 .maxlen         = sizeof(sysctl_perf_event_sample_rate),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = perf_proc_update_handler,
         },
 #endif
 #ifdef CONFIG_KMEMCHECK
@@ -962,10 +962,6 @@ static struct ctl_table kern_table[] = {
                 .proc_handler   = proc_dointvec,
         },
 #endif
-/*
- * NOTE: do not add new entries to this table unless you have read
- * Documentation/sysctl/ctl_unnumbered.txt
- */
         { }
 };
 
@@ -1326,11 +1322,6 @@ static struct ctl_table vm_table[] = {
                 .extra2         = &one,
         },
 #endif
-
-/*
- * NOTE: do not add new entries to this table unless you have read
- * Documentation/sysctl/ctl_unnumbered.txt
- */
         { }
 };
 
@@ -1486,10 +1477,6 @@ static struct ctl_table fs_table[] = {
                 .proc_handler   = &pipe_proc_fn,
                 .extra1         = &pipe_min_size,
         },
-/*
- * NOTE: do not add new entries to this table unless you have read
- * Documentation/sysctl/ctl_unnumbered.txt
- */
         { }
 };
 
@@ -1573,11 +1560,16 @@ void sysctl_head_get(struct ctl_table_header *head)
         spin_unlock(&sysctl_lock);
 }
 
+static void free_head(struct rcu_head *rcu)
+{
+        kfree(container_of(rcu, struct ctl_table_header, rcu));
+}
+
 void sysctl_head_put(struct ctl_table_header *head)
 {
         spin_lock(&sysctl_lock);
         if (!--head->count)
-                kfree(head);
+                call_rcu(&head->rcu, free_head);
         spin_unlock(&sysctl_lock);
 }
 
@@ -1954,10 +1946,10 @@ void unregister_sysctl_table(struct ctl_table_header * header)
         start_unregistering(header);
         if (!--header->parent->count) {
                 WARN_ON(1);
-                kfree(header->parent);
+                call_rcu(&header->parent->rcu, free_head);
         }
         if (!--header->count)
-                kfree(header);
+                call_rcu(&header->rcu, free_head);
         spin_unlock(&sysctl_lock);
 }
 
@@ -2899,7 +2891,7 @@ int proc_do_large_bitmap(struct ctl_table *table, int write,
         }
 }
 
-#else /* CONFIG_PROC_FS */
+#else /* CONFIG_PROC_SYSCTL */
 
 int proc_dostring(struct ctl_table *table, int write,
                   void __user *buffer, size_t *lenp, loff_t *ppos)
@@ -2951,7 +2943,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
 }
 
 
-#endif /* CONFIG_PROC_FS */
+#endif /* CONFIG_PROC_SYSCTL */
 
 /*
  * No sense putting this after each symbol definition, twice,
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 4b2545a136ff..3b8e028b9601 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1192,7 +1192,7 @@ static ssize_t bin_dn_node_address(struct file *file,
 
                 buf[result] = '\0';
 
-                /* Convert the decnet addresss to binary */
+                /* Convert the decnet address to binary */
                 result = -EIO;
                 nodep = strchr(buf, '.') + 1;
                 if (!nodep)
@@ -1321,13 +1321,11 @@ static ssize_t binary_sysctl(const int *name, int nlen,
         void __user *oldval, size_t oldlen, void __user *newval, size_t newlen)
 {
         const struct bin_table *table = NULL;
-        struct nameidata nd;
         struct vfsmount *mnt;
         struct file *file;
         ssize_t result;
         char *pathname;
         int flags;
-        int acc_mode;
 
         pathname = sysctl_getname(name, nlen, &table);
         result = PTR_ERR(pathname);
@@ -1337,28 +1335,17 @@ static ssize_t binary_sysctl(const int *name, int nlen,
         /* How should the sysctl be accessed? */
         if (oldval && oldlen && newval && newlen) {
                 flags = O_RDWR;
-                acc_mode = MAY_READ | MAY_WRITE;
         } else if (newval && newlen) {
                 flags = O_WRONLY;
-                acc_mode = MAY_WRITE;
         } else if (oldval && oldlen) {
                 flags = O_RDONLY;
-                acc_mode = MAY_READ;
         } else {
                 result = 0;
                 goto out_putname;
         }
 
         mnt = current->nsproxy->pid_ns->proc_mnt;
-        result = vfs_path_lookup(mnt->mnt_root, mnt, pathname, 0, &nd);
-        if (result)
-                goto out_putname;
-
-        result = may_open(&nd.path, acc_mode, flags);
-        if (result)
-                goto out_putpath;
-
-        file = dentry_open(nd.path.dentry, nd.path.mnt, flags, current_cred());
+        file = file_open_root(mnt->mnt_root, mnt, pathname, flags);
         result = PTR_ERR(file);
         if (IS_ERR(file))
                 goto out_putname;
@@ -1370,10 +1357,6 @@ out_putname:
         putname(pathname);
 out:
         return result;
-
-out_putpath:
-        path_put(&nd.path);
-        goto out_putname;
 }
 
 
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 3308fd7f1b52..3971c6b9d58d 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -89,8 +89,7 @@ static int prepare_reply(struct genl_info *info, u8 cmd, struct sk_buff **skbp,
                 return -ENOMEM;
 
         if (!info) {
-                int seq = get_cpu_var(taskstats_seqnum)++;
-                put_cpu_var(taskstats_seqnum);
+                int seq = this_cpu_inc_return(taskstats_seqnum) - 1;
 
                 reply = genlmsg_put(skb, 0, seq, &family, 0, cmd);
         } else
@@ -349,7 +348,7 @@ static int parse(struct nlattr *na, struct cpumask *mask)
         return ret;
 }
 
-#ifdef CONFIG_IA64
+#if defined(CONFIG_64BIT) && !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 #define TASKSTATS_NEEDS_PADDING 1
 #endif
 
@@ -612,7 +611,7 @@ void taskstats_exit(struct task_struct *tsk, int group_dead)
                 fill_tgid_exit(tsk);
         }
 
-        listeners = &__raw_get_cpu_var(listener_array);
+        listeners = __this_cpu_ptr(&listener_array);
         if (list_empty(&listeners->list))
                 return;
 
diff --git a/kernel/time.c b/kernel/time.c
index ba9b338d1835..8e8dc6d705c9 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -150,7 +150,7 @@ static inline void warp_clock(void)
  * various programs will get confused when the clock gets warped.
  */
 
-int do_sys_settimeofday(struct timespec *tv, struct timezone *tz)
+int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
 {
         static int firsttime = 1;
         int error = 0;
@@ -238,7 +238,7 @@ EXPORT_SYMBOL(current_fs_time);
  * Avoid unnecessary multiplications/divisions in the
  * two most common HZ cases:
  */
-unsigned int inline jiffies_to_msecs(const unsigned long j)
+inline unsigned int jiffies_to_msecs(const unsigned long j)
 {
 #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
         return (MSEC_PER_SEC / HZ) * j;
@@ -254,7 +254,7 @@ unsigned int inline jiffies_to_msecs(const unsigned long j)
 }
 EXPORT_SYMBOL(jiffies_to_msecs);
 
-unsigned int inline jiffies_to_usecs(const unsigned long j)
+inline unsigned int jiffies_to_usecs(const unsigned long j)
 {
 #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
         return (USEC_PER_SEC / HZ) * j;
@@ -645,7 +645,7 @@ u64 nsec_to_clock_t(u64 x)
 }
 
 /**
- * nsecs_to_jiffies - Convert nsecs in u64 to jiffies
+ * nsecs_to_jiffies64 - Convert nsecs in u64 to jiffies64
  *
  * @n:  nsecs in u64
  *
@@ -657,7 +657,7 @@ u64 nsec_to_clock_t(u64 x)
  *   NSEC_PER_SEC = 10^9 = (5^9 * 2^9) = (1953125 * 512)
  *   ULLONG_MAX ns = 18446744073.709551615 secs = about 584 years
  */
-unsigned long nsecs_to_jiffies(u64 n)
+u64 nsecs_to_jiffies64(u64 n)
 {
 #if (NSEC_PER_SEC % HZ) == 0
         /* Common case, HZ = 100, 128, 200, 250, 256, 500, 512, 1000 etc. */
@@ -674,22 +674,23 @@ unsigned long nsecs_to_jiffies(u64 n)
 #endif
 }
 
-#if (BITS_PER_LONG < 64)
-u64 get_jiffies_64(void)
+/**
+ * nsecs_to_jiffies - Convert nsecs in u64 to jiffies
+ *
+ * @n:  nsecs in u64
+ *
+ * Unlike {m,u}secs_to_jiffies, type of input is not unsigned int but u64.
+ * And this doesn't return MAX_JIFFY_OFFSET since this function is designed
+ * for scheduler, not for use in device drivers to calculate timeout value.
+ *
+ * note:
+ *   NSEC_PER_SEC = 10^9 = (5^9 * 2^9) = (1953125 * 512)
+ *   ULLONG_MAX ns = 18446744073.709551615 secs = about 584 years
+ */
+unsigned long nsecs_to_jiffies(u64 n)
 {
-        unsigned long seq;
-        u64 ret;
-
-        do {
-                seq = read_seqbegin(&xtime_lock);
-                ret = jiffies_64;
-        } while (read_seqretry(&xtime_lock, seq));
-        return ret;
+        return (unsigned long)nsecs_to_jiffies64(n);
 }
-EXPORT_SYMBOL(get_jiffies_64);
-#endif
-
-EXPORT_SYMBOL(jiffies);
 
 /*
  * Add two timespec values and do a safety check for overflow.
diff --git a/kernel/time/Makefile b/kernel/time/Makefile
index ee266620b06c..b0425991e9ac 100644
--- a/kernel/time/Makefile
+++ b/kernel/time/Makefile
@@ -1,4 +1,5 @@
-obj-y += timekeeping.o ntp.o clocksource.o jiffies.o timer_list.o timecompare.o timeconv.o
+obj-y += timekeeping.o ntp.o clocksource.o jiffies.o timer_list.o timecompare.o
+obj-y += timeconv.o posix-clock.o
 
 obj-$(CONFIG_GENERIC_CLOCKEVENTS_BUILD)         += clockevents.o
 obj-$(CONFIG_GENERIC_CLOCKEVENTS)               += tick-common.o
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index d7395fdfb9f3..0d74b9ba90c8 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -18,7 +18,6 @@
 #include <linux/notifier.h>
 #include <linux/smp.h>
 #include <linux/sysdev.h>
-#include <linux/tick.h>
 
 #include "tick-internal.h"
 
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index c18d7efa1b4b..6519cf62d9cd 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -113,7 +113,7 @@ EXPORT_SYMBOL_GPL(timecounter_cyc2time);
  * @shift:      pointer to shift variable
  * @from:       frequency to convert from
  * @to:         frequency to convert to
- * @minsec:     guaranteed runtime conversion range in seconds
+ * @maxsec:     guaranteed runtime conversion range in seconds
  *
  * The function evaluates the shift/mult pair for the scaled math
  * operations of clocksources and clockevents.
@@ -122,7 +122,7 @@ EXPORT_SYMBOL_GPL(timecounter_cyc2time);
  * NSEC_PER_SEC == 1GHz and @from is the counter frequency. For clock
  * event @to is the counter frequency and @from is NSEC_PER_SEC.
  *
- * The @minsec conversion range argument controls the time frame in
+ * The @maxsec conversion range argument controls the time frame in
  * seconds which must be covered by the runtime conversion with the
  * calculated mult and shift factors. This guarantees that no 64bit
  * overflow happens when the input value of the conversion is
@@ -131,7 +131,7 @@ EXPORT_SYMBOL_GPL(timecounter_cyc2time);
  * factors.
  */
 void
-clocks_calc_mult_shift(u32 *mult, u32 *shift, u32 from, u32 to, u32 minsec)
+clocks_calc_mult_shift(u32 *mult, u32 *shift, u32 from, u32 to, u32 maxsec)
 {
         u64 tmp;
         u32 sft, sftacc= 32;
@@ -140,7 +140,7 @@ clocks_calc_mult_shift(u32 *mult, u32 *shift, u32 from, u32 to, u32 minsec)
          * Calculate the shift factor which is limiting the conversion
          * range:
          */
-        tmp = ((u64)minsec * from) >> 32;
+        tmp = ((u64)maxsec * from) >> 32;
         while (tmp) {
                 tmp >>=1;
                 sftacc--;
@@ -152,6 +152,7 @@ clocks_calc_mult_shift(u32 *mult, u32 *shift, u32 from, u32 to, u32 minsec)
          */
         for (sft = 32; sft > 0; sft--) {
                 tmp = (u64) to << sft;
+                tmp += from / 2;
                 do_div(tmp, from);
                 if ((tmp >> sftacc) == 0)
                         break;
@@ -678,7 +679,7 @@ EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
 int __clocksource_register_scale(struct clocksource *cs, u32 scale, u32 freq)
 {
 
-        /* Intialize mult/shift and max_idle_ns */
+        /* Initialize mult/shift and max_idle_ns */
         __clocksource_updatefreq_scale(cs, scale, freq);
 
         /* Add clocksource to the clcoksource list */
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 5404a8456909..b2fa506667c0 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -22,8 +22,11 @@
 ************************************************************************/
 #include <linux/clocksource.h>
 #include <linux/jiffies.h>
+#include <linux/module.h>
 #include <linux/init.h>
 
+#include "tick-internal.h"
+
 /* The Jiffies based clocksource is the lowest common
  * denominator clock source which should function on
  * all systems. It has the same coarse resolution as
@@ -64,6 +67,23 @@ struct clocksource clocksource_jiffies = {
         .shift          = JIFFIES_SHIFT,
 };
 
+#if (BITS_PER_LONG < 64)
+u64 get_jiffies_64(void)
+{
+        unsigned long seq;
+        u64 ret;
+
+        do {
+                seq = read_seqbegin(&xtime_lock);
+                ret = jiffies_64;
+        } while (read_seqretry(&xtime_lock, seq));
+        return ret;
+}
+EXPORT_SYMBOL(get_jiffies_64);
+#endif
+
+EXPORT_SYMBOL(jiffies);
+
 static int __init init_jiffies_clocksource(void)
 {
         return clocksource_register(&clocksource_jiffies);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index d2321891538f..5f1bb8e2008f 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -14,6 +14,9 @@
 #include <linux/timex.h>
 #include <linux/time.h>
 #include <linux/mm.h>
+#include <linux/module.h>
+
+#include "tick-internal.h"
 
 /*
  * NTP timekeeping variables:
@@ -74,6 +77,162 @@ static long			time_adjust;
 /* constant (boot-param configurable) NTP tick adjustment (upscaled)    */
 static s64                      ntp_tick_adj;
 
+#ifdef CONFIG_NTP_PPS
+
+/*
+ * The following variables are used when a pulse-per-second (PPS) signal
+ * is available. They establish the engineering parameters of the clock
+ * discipline loop when controlled by the PPS signal.
+ */
+#define PPS_VALID       10      /* PPS signal watchdog max (s) */
+#define PPS_POPCORN     4       /* popcorn spike threshold (shift) */
+#define PPS_INTMIN      2       /* min freq interval (s) (shift) */
+#define PPS_INTMAX      8       /* max freq interval (s) (shift) */
+#define PPS_INTCOUNT    4       /* number of consecutive good intervals to
+                                   increase pps_shift or consecutive bad
+                                   intervals to decrease it */
+#define PPS_MAXWANDER   100000  /* max PPS freq wander (ns/s) */
+
+static int pps_valid;           /* signal watchdog counter */
+static long pps_tf[3];          /* phase median filter */
+static long pps_jitter;         /* current jitter (ns) */
+static struct timespec pps_fbase; /* beginning of the last freq interval */
+static int pps_shift;           /* current interval duration (s) (shift) */
+static int pps_intcnt;          /* interval counter */
+static s64 pps_freq;            /* frequency offset (scaled ns/s) */
+static long pps_stabil;         /* current stability (scaled ns/s) */
+
+/*
+ * PPS signal quality monitors
+ */
+static long pps_calcnt;         /* calibration intervals */
+static long pps_jitcnt;         /* jitter limit exceeded */
+static long pps_stbcnt;         /* stability limit exceeded */
+static long pps_errcnt;         /* calibration errors */
+
+
+/* PPS kernel consumer compensates the whole phase error immediately.
+ * Otherwise, reduce the offset by a fixed factor times the time constant.
+ */
+static inline s64 ntp_offset_chunk(s64 offset)
+{
+        if (time_status & STA_PPSTIME && time_status & STA_PPSSIGNAL)
+                return offset;
+        else
+                return shift_right(offset, SHIFT_PLL + time_constant);
+}
+
+static inline void pps_reset_freq_interval(void)
+{
+        /* the PPS calibration interval may end
+           surprisingly early */
+        pps_shift = PPS_INTMIN;
+        pps_intcnt = 0;
+}
+
+/**
+ * pps_clear - Clears the PPS state variables
+ *
+ * Must be called while holding a write on the xtime_lock
+ */
+static inline void pps_clear(void)
+{
+        pps_reset_freq_interval();
+        pps_tf[0] = 0;
+        pps_tf[1] = 0;
+        pps_tf[2] = 0;
+        pps_fbase.tv_sec = pps_fbase.tv_nsec = 0;
+        pps_freq = 0;
+}
+
+/* Decrease pps_valid to indicate that another second has passed since
+ * the last PPS signal. When it reaches 0, indicate that PPS signal is
+ * missing.
+ *
+ * Must be called while holding a write on the xtime_lock
+ */
+static inline void pps_dec_valid(void)
+{
+        if (pps_valid > 0)
+                pps_valid--;
+        else {
+                time_status &= ~(STA_PPSSIGNAL | STA_PPSJITTER |
+                                 STA_PPSWANDER | STA_PPSERROR);
+                pps_clear();
+        }
+}
+
+static inline void pps_set_freq(s64 freq)
+{
+        pps_freq = freq;
+}
+
+static inline int is_error_status(int status)
+{
+        return (time_status & (STA_UNSYNC|STA_CLOCKERR))
+                /* PPS signal lost when either PPS time or
+                 * PPS frequency synchronization requested
+                 */
+                || ((time_status & (STA_PPSFREQ|STA_PPSTIME))
+                        && !(time_status & STA_PPSSIGNAL))
+                /* PPS jitter exceeded when
+                 * PPS time synchronization requested */
+                || ((time_status & (STA_PPSTIME|STA_PPSJITTER))
+                        == (STA_PPSTIME|STA_PPSJITTER))
+                /* PPS wander exceeded or calibration error when
+                 * PPS frequency synchronization requested
+                 */
+                || ((time_status & STA_PPSFREQ)
+                        && (time_status & (STA_PPSWANDER|STA_PPSERROR)));
+}
+
+static inline void pps_fill_timex(struct timex *txc)
+{
+        txc->ppsfreq       = shift_right((pps_freq >> PPM_SCALE_INV_SHIFT) *
+                                         PPM_SCALE_INV, NTP_SCALE_SHIFT);
+        txc->jitter        = pps_jitter;
+        if (!(time_status & STA_NANO))
+                txc->jitter /= NSEC_PER_USEC;
+        txc->shift         = pps_shift;
+        txc->stabil        = pps_stabil;
+        txc->jitcnt        = pps_jitcnt;
+        txc->calcnt        = pps_calcnt;
+        txc->errcnt        = pps_errcnt;
+        txc->stbcnt        = pps_stbcnt;
+}
+
+#else /* !CONFIG_NTP_PPS */
+
+static inline s64 ntp_offset_chunk(s64 offset)
+{
+        return shift_right(offset, SHIFT_PLL + time_constant);
+}
+
+static inline void pps_reset_freq_interval(void) {}
+static inline void pps_clear(void) {}
+static inline void pps_dec_valid(void) {}
+static inline void pps_set_freq(s64 freq) {}
+
+static inline int is_error_status(int status)
+{
+        return status & (STA_UNSYNC|STA_CLOCKERR);
+}
+
+static inline void pps_fill_timex(struct timex *txc)
+{
+        /* PPS is not implemented, so these are zero */
+        txc->ppsfreq       = 0;
+        txc->jitter        = 0;
+        txc->shift         = 0;
+        txc->stabil        = 0;
+        txc->jitcnt        = 0;
+        txc->calcnt        = 0;
+        txc->errcnt        = 0;
+        txc->stbcnt        = 0;
+}
+
+#endif /* CONFIG_NTP_PPS */
+
 /*
  * NTP methods:
  */
@@ -185,6 +344,9 @@ void ntp_clear(void)
 
         tick_length     = tick_length_base;
         time_offset     = 0;
+
+        /* Clear PPS state variables */
+        pps_clear();
 }
 
 /*
@@ -250,16 +412,16 @@ void second_overflow(void)
                 time_status |= STA_UNSYNC;
         }
 
-        /*
-         * Compute the phase adjustment for the next second. The offset is
-         * reduced by a fixed factor times the time constant.
-         */
+        /* Compute the phase adjustment for the next second */
         tick_length      = tick_length_base;
 
-        delta            = shift_right(time_offset, SHIFT_PLL + time_constant);
+        delta            = ntp_offset_chunk(time_offset);
         time_offset     -= delta;
         tick_length     += delta;
 
+        /* Check PPS signal */
+        pps_dec_valid();
+
         if (!time_adjust)
                 return;
 
@@ -369,6 +531,8 @@ static inline void process_adj_status(struct timex *txc, struct timespec *ts)
         if ((time_status & STA_PLL) && !(txc->status & STA_PLL)) {
                 time_state = TIME_OK;
                 time_status = STA_UNSYNC;
+                /* restart PPS frequency calibration */
+                pps_reset_freq_interval();
         }
 
         /*
@@ -418,6 +582,8 @@ static inline void process_adjtimex_modes(struct timex *txc, struct timespec *ts
                 time_freq = txc->freq * PPM_SCALE;
                 time_freq = min(time_freq, MAXFREQ_SCALED);
                 time_freq = max(time_freq, -MAXFREQ_SCALED);
+                /* update pps_freq */
+                pps_set_freq(time_freq);
         }
 
         if (txc->modes & ADJ_MAXERROR)
@@ -482,6 +648,17 @@ int do_adjtimex(struct timex *txc)
                         hrtimer_cancel(&leap_timer);
         }
 
+        if (txc->modes & ADJ_SETOFFSET) {
+                struct timespec delta;
+                delta.tv_sec  = txc->time.tv_sec;
+                delta.tv_nsec = txc->time.tv_usec;
+                if (!(txc->modes & ADJ_NANO))
+                        delta.tv_nsec *= 1000;
+                result = timekeeping_inject_offset(&delta);
+                if (result)
+                        return result;
+        }
+
         getnstimeofday(&ts);
 
         write_seqlock_irq(&xtime_lock);
@@ -508,7 +685,8 @@ int do_adjtimex(struct timex *txc)
         }
 
         result = time_state;    /* mostly `TIME_OK' */
-        if (time_status & (STA_UNSYNC|STA_CLOCKERR))
+        /* check for errors */
+        if (is_error_status(time_status))
                 result = TIME_ERROR;
 
         txc->freq          = shift_right((time_freq >> PPM_SCALE_INV_SHIFT) *
@@ -522,15 +700,8 @@ int do_adjtimex(struct timex *txc)
         txc->tick          = tick_usec;
         txc->tai           = time_tai;
 
-        /* PPS is not implemented, so these are zero */
-        txc->ppsfreq       = 0;
-        txc->jitter        = 0;
-        txc->shift         = 0;
-        txc->stabil        = 0;
-        txc->jitcnt        = 0;
-        txc->calcnt        = 0;
-        txc->errcnt        = 0;
-        txc->stbcnt        = 0;
+        /* fill PPS status fields */
+        pps_fill_timex(txc);
 
         write_sequnlock_irq(&xtime_lock);
 
@@ -544,6 +715,243 @@ int do_adjtimex(struct timex *txc)
         return result;
 }
 
+#ifdef  CONFIG_NTP_PPS
+
+/* actually struct pps_normtime is good old struct timespec, but it is
+ * semantically different (and it is the reason why it was invented):
+ * pps_normtime.nsec has a range of ( -NSEC_PER_SEC / 2, NSEC_PER_SEC / 2 ]
+ * while timespec.tv_nsec has a range of [0, NSEC_PER_SEC) */
+struct pps_normtime {
+        __kernel_time_t sec;    /* seconds */
+        long            nsec;   /* nanoseconds */
+};
+
+/* normalize the timestamp so that nsec is in the
+   ( -NSEC_PER_SEC / 2, NSEC_PER_SEC / 2 ] interval */
+static inline struct pps_normtime pps_normalize_ts(struct timespec ts)
+{
+        struct pps_normtime norm = {
+                .sec = ts.tv_sec,
+                .nsec = ts.tv_nsec
+        };
+
+        if (norm.nsec > (NSEC_PER_SEC >> 1)) {
+                norm.nsec -= NSEC_PER_SEC;
+                norm.sec++;
+        }
+
+        return norm;
+}
+
+/* get current phase correction and jitter */
+static inline long pps_phase_filter_get(long *jitter)
+{
+        *jitter = pps_tf[0] - pps_tf[1];
+        if (*jitter < 0)
+                *jitter = -*jitter;
+
+        /* TODO: test various filters */
+        return pps_tf[0];
+}
+
+/* add the sample to the phase filter */
+static inline void pps_phase_filter_add(long err)
+{
+        pps_tf[2] = pps_tf[1];
+        pps_tf[1] = pps_tf[0];
+        pps_tf[0] = err;
+}
+
+/* decrease frequency calibration interval length.
+ * It is halved after four consecutive unstable intervals.
+ */
+static inline void pps_dec_freq_interval(void)
+{
+        if (--pps_intcnt <= -PPS_INTCOUNT) {
+                pps_intcnt = -PPS_INTCOUNT;
+                if (pps_shift > PPS_INTMIN) {
+                        pps_shift--;
+                        pps_intcnt = 0;
+                }
+        }
+}
+
+/* increase frequency calibration interval length.
+ * It is doubled after four consecutive stable intervals.
+ */
+static inline void pps_inc_freq_interval(void)
+{
+        if (++pps_intcnt >= PPS_INTCOUNT) {
+                pps_intcnt = PPS_INTCOUNT;
+                if (pps_shift < PPS_INTMAX) {
+                        pps_shift++;
+                        pps_intcnt = 0;
+                }
+        }
+}
+
+/* update clock frequency based on MONOTONIC_RAW clock PPS signal
+ * timestamps
+ *
+ * At the end of the calibration interval the difference between the
+ * first and last MONOTONIC_RAW clock timestamps divided by the length
+ * of the interval becomes the frequency update. If the interval was
+ * too long, the data are discarded.
+ * Returns the difference between old and new frequency values.
+ */
+static long hardpps_update_freq(struct pps_normtime freq_norm)
+{
+        long delta, delta_mod;
+        s64 ftemp;
+
+        /* check if the frequency interval was too long */
+        if (freq_norm.sec > (2 << pps_shift)) {
+                time_status |= STA_PPSERROR;
+                pps_errcnt++;
+                pps_dec_freq_interval();
+                pr_err("hardpps: PPSERROR: interval too long - %ld s\n",
+                                freq_norm.sec);
+                return 0;
+        }
+
+        /* here the raw frequency offset and wander (stability) is
+         * calculated. If the wander is less than the wander threshold
+         * the interval is increased; otherwise it is decreased.
+         */
+        ftemp = div_s64(((s64)(-freq_norm.nsec)) << NTP_SCALE_SHIFT,
+                        freq_norm.sec);
+        delta = shift_right(ftemp - pps_freq, NTP_SCALE_SHIFT);
+        pps_freq = ftemp;
+        if (delta > PPS_MAXWANDER || delta < -PPS_MAXWANDER) {
+                pr_warning("hardpps: PPSWANDER: change=%ld\n", delta);
+                time_status |= STA_PPSWANDER;
+                pps_stbcnt++;
+                pps_dec_freq_interval();
+        } else {        /* good sample */
+                pps_inc_freq_interval();
+        }
+
+        /* the stability metric is calculated as the average of recent
+         * frequency changes, but is used only for performance
+         * monitoring
+         */
+        delta_mod = delta;
+        if (delta_mod < 0)
+                delta_mod = -delta_mod;
+        pps_stabil += (div_s64(((s64)delta_mod) <<
+                                (NTP_SCALE_SHIFT - SHIFT_USEC),
+                                NSEC_PER_USEC) - pps_stabil) >> PPS_INTMIN;
+
+        /* if enabled, the system clock frequency is updated */
+        if ((time_status & STA_PPSFREQ) != 0 &&
+            (time_status & STA_FREQHOLD) == 0) {
+                time_freq = pps_freq;
+                ntp_update_frequency();
+        }
+
+        return delta;
+}
+
+/* correct REALTIME clock phase error against PPS signal */
+static void hardpps_update_phase(long error)
+{
+        long correction = -error;
+        long jitter;
+
+        /* add the sample to the median filter */
+        pps_phase_filter_add(correction);
+        correction = pps_phase_filter_get(&jitter);
+
+        /* Nominal jitter is due to PPS signal noise. If it exceeds the
+         * threshold, the sample is discarded; otherwise, if so enabled,
+         * the time offset is updated.
+         */
+        if (jitter > (pps_jitter << PPS_POPCORN)) {
+                pr_warning("hardpps: PPSJITTER: jitter=%ld, limit=%ld\n",
+                       jitter, (pps_jitter << PPS_POPCORN));
+                time_status |= STA_PPSJITTER;
+                pps_jitcnt++;
+        } else if (time_status & STA_PPSTIME) {
+                /* correct the time using the phase offset */
+                time_offset = div_s64(((s64)correction) << NTP_SCALE_SHIFT,
+                                NTP_INTERVAL_FREQ);
+                /* cancel running adjtime() */
+                time_adjust = 0;
+        }
+        /* update jitter */
+        pps_jitter += (jitter - pps_jitter) >> PPS_INTMIN;
+}
+
+/*
+ * hardpps() - discipline CPU clock oscillator to external PPS signal
+ *
+ * This routine is called at each PPS signal arrival in order to
+ * discipline the CPU clock oscillator to the PPS signal. It takes two
+ * parameters: REALTIME and MONOTONIC_RAW clock timestamps. The former
+ * is used to correct clock phase error and the latter is used to
+ * correct the frequency.
+ *
+ * This code is based on David Mills's reference nanokernel
+ * implementation. It was mostly rewritten but keeps the same idea.
+ */
+void hardpps(const struct timespec *phase_ts, const struct timespec *raw_ts)
+{
+        struct pps_normtime pts_norm, freq_norm;
+        unsigned long flags;
+
+        pts_norm = pps_normalize_ts(*phase_ts);
+
+        write_seqlock_irqsave(&xtime_lock, flags);
+
+        /* clear the error bits, they will be set again if needed */
+        time_status &= ~(STA_PPSJITTER | STA_PPSWANDER | STA_PPSERROR);
+
+        /* indicate signal presence */
+        time_status |= STA_PPSSIGNAL;
+        pps_valid = PPS_VALID;
+
+        /* when called for the first time,
+         * just start the frequency interval */
+        if (unlikely(pps_fbase.tv_sec == 0)) {
+                pps_fbase = *raw_ts;
+                write_sequnlock_irqrestore(&xtime_lock, flags);
+                return;
+        }
+
+        /* ok, now we have a base for frequency calculation */
+        freq_norm = pps_normalize_ts(timespec_sub(*raw_ts, pps_fbase));
+
+        /* check that the signal is in the range
+         * [1s - MAXFREQ us, 1s + MAXFREQ us], otherwise reject it */
+        if ((freq_norm.sec == 0) ||
+                        (freq_norm.nsec > MAXFREQ * freq_norm.sec) ||
+                        (freq_norm.nsec < -MAXFREQ * freq_norm.sec)) {
+                time_status |= STA_PPSJITTER;
+                /* restart the frequency calibration interval */
+                pps_fbase = *raw_ts;
+                write_sequnlock_irqrestore(&xtime_lock, flags);
+                pr_err("hardpps: PPSJITTER: bad pulse\n");
+                return;
+        }
+
+        /* signal is ok */
+
+        /* check if the current frequency interval is finished */
+        if (freq_norm.sec >= (1 << pps_shift)) {
+                pps_calcnt++;
+                /* restart the frequency calibration interval */
+                pps_fbase = *raw_ts;
+                hardpps_update_freq(freq_norm);
+        }
+
+        hardpps_update_phase(pts_norm.nsec);
+
+        write_sequnlock_irqrestore(&xtime_lock, flags);
+}
+EXPORT_SYMBOL(hardpps);
+
+#endif  /* CONFIG_NTP_PPS */
+
 static int __init ntp_tick_adj_setup(char *str)
 {
         ntp_tick_adj = simple_strtol(str, NULL, 0);
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
new file mode 100644
index 000000000000..25028dd4fa18
--- /dev/null
+++ b/kernel/time/posix-clock.c
@@ -0,0 +1,451 @@
+/*
+ * posix-clock.c - support for dynamic clock devices
+ *
+ * Copyright (C) 2010 OMICRON electronics GmbH
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/device.h>
+#include <linux/file.h>
+#include <linux/mutex.h>
+#include <linux/posix-clock.h>
+#include <linux/slab.h>
+#include <linux/syscalls.h>
+#include <linux/uaccess.h>
+
+static void delete_clock(struct kref *kref);
+
+/*
+ * Returns NULL if the posix_clock instance attached to 'fp' is old and stale.
+ */
+static struct posix_clock *get_posix_clock(struct file *fp)
+{
+        struct posix_clock *clk = fp->private_data;
+
+        mutex_lock(&clk->mutex);
+
+        if (!clk->zombie)
+                return clk;
+
+        mutex_unlock(&clk->mutex);
+
+        return NULL;
+}
+
+static void put_posix_clock(struct posix_clock *clk)
+{
+        mutex_unlock(&clk->mutex);
+}
+
+static ssize_t posix_clock_read(struct file *fp, char __user *buf,
+                                size_t count, loff_t *ppos)
+{
+        struct posix_clock *clk = get_posix_clock(fp);
+        int err = -EINVAL;
+
+        if (!clk)
+                return -ENODEV;
+
+        if (clk->ops.read)
+                err = clk->ops.read(clk, fp->f_flags, buf, count);
+
+        put_posix_clock(clk);
+
+        return err;
+}
+
+static unsigned int posix_clock_poll(struct file *fp, poll_table *wait)
+{
+        struct posix_clock *clk = get_posix_clock(fp);
+        int result = 0;
+
+        if (!clk)
+                return -ENODEV;
+
+        if (clk->ops.poll)
+                result = clk->ops.poll(clk, fp, wait);
+
+        put_posix_clock(clk);
+
+        return result;
+}
+
+static int posix_clock_fasync(int fd, struct file *fp, int on)
+{
+        struct posix_clock *clk = get_posix_clock(fp);
+        int err = 0;
+
+        if (!clk)
+                return -ENODEV;
+
+        if (clk->ops.fasync)
+                err = clk->ops.fasync(clk, fd, fp, on);
+
+        put_posix_clock(clk);
+
+        return err;
+}
+
+static int posix_clock_mmap(struct file *fp, struct vm_area_struct *vma)
+{
+        struct posix_clock *clk = get_posix_clock(fp);
+        int err = -ENODEV;
+
+        if (!clk)
+                return -ENODEV;
+
+        if (clk->ops.mmap)
+                err = clk->ops.mmap(clk, vma);
+
+        put_posix_clock(clk);
+
+        return err;
+}
+
+static long posix_clock_ioctl(struct file *fp,
+                              unsigned int cmd, unsigned long arg)
+{
+        struct posix_clock *clk = get_posix_clock(fp);
+        int err = -ENOTTY;
+
+        if (!clk)
+                return -ENODEV;
+
+        if (clk->ops.ioctl)
+                err = clk->ops.ioctl(clk, cmd, arg);
+
+        put_posix_clock(clk);
+
+        return err;
+}
+
+#ifdef CONFIG_COMPAT
+static long posix_clock_compat_ioctl(struct file *fp,
+                                     unsigned int cmd, unsigned long arg)
+{
+        struct posix_clock *clk = get_posix_clock(fp);
+        int err = -ENOTTY;
+
+        if (!clk)
+                return -ENODEV;
+
+        if (clk->ops.ioctl)
+                err = clk->ops.ioctl(clk, cmd, arg);
+
+        put_posix_clock(clk);
+
+        return err;
+}
+#endif
+
+static int posix_clock_open(struct inode *inode, struct file *fp)
+{
+        int err;
+        struct posix_clock *clk =
+                container_of(inode->i_cdev, struct posix_clock, cdev);
+
+        mutex_lock(&clk->mutex);
+
+        if (clk->zombie) {
+                err = -ENODEV;
+                goto out;
+        }
+        if (clk->ops.open)
+                err = clk->ops.open(clk, fp->f_mode);
+        else
+                err = 0;
+
+        if (!err) {
+                kref_get(&clk->kref);
+                fp->private_data = clk;
+        }
+out:
+        mutex_unlock(&clk->mutex);
+        return err;
+}
+
+static int posix_clock_release(struct inode *inode, struct file *fp)
+{
+        struct posix_clock *clk = fp->private_data;
+        int err = 0;
+
+        if (clk->ops.release)
+                err = clk->ops.release(clk);
+
+        kref_put(&clk->kref, delete_clock);
+
+        fp->private_data = NULL;
+
+        return err;
+}
+
+static const struct file_operations posix_clock_file_operations = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .read           = posix_clock_read,
+        .poll           = posix_clock_poll,
+        .unlocked_ioctl = posix_clock_ioctl,
+        .open           = posix_clock_open,
+        .release        = posix_clock_release,
+        .fasync         = posix_clock_fasync,
+        .mmap           = posix_clock_mmap,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = posix_clock_compat_ioctl,
+#endif
+};
+
+int posix_clock_register(struct posix_clock *clk, dev_t devid)
+{
+        int err;
+
+        kref_init(&clk->kref);
+        mutex_init(&clk->mutex);
+
+        cdev_init(&clk->cdev, &posix_clock_file_operations);
+        clk->cdev.owner = clk->ops.owner;
+        err = cdev_add(&clk->cdev, devid, 1);
+        if (err)
+                goto no_cdev;
+
+        return err;
+no_cdev:
+        mutex_destroy(&clk->mutex);
+        return err;
+}
+EXPORT_SYMBOL_GPL(posix_clock_register);
+
+static void delete_clock(struct kref *kref)
+{
+        struct posix_clock *clk = container_of(kref, struct posix_clock, kref);
+        mutex_destroy(&clk->mutex);
+        if (clk->release)
+                clk->release(clk);
+}
+
+void posix_clock_unregister(struct posix_clock *clk)
+{
+        cdev_del(&clk->cdev);
+
+        mutex_lock(&clk->mutex);
+        clk->zombie = true;
+        mutex_unlock(&clk->mutex);
+
+        kref_put(&clk->kref, delete_clock);
+}
+EXPORT_SYMBOL_GPL(posix_clock_unregister);
+
+struct posix_clock_desc {
+        struct file *fp;
+        struct posix_clock *clk;
+};
+
+static int get_clock_desc(const clockid_t id, struct posix_clock_desc *cd)
+{
+        struct file *fp = fget(CLOCKID_TO_FD(id));
+        int err = -EINVAL;
+
+        if (!fp)
+                return err;
+
+        if (fp->f_op->open != posix_clock_open || !fp->private_data)
+                goto out;
+
+        cd->fp = fp;
+        cd->clk = get_posix_clock(fp);
+
+        err = cd->clk ? 0 : -ENODEV;
+out:
+        if (err)
+                fput(fp);
+        return err;
+}
+
+static void put_clock_desc(struct posix_clock_desc *cd)
+{
+        put_posix_clock(cd->clk);
+        fput(cd->fp);
+}
+
+static int pc_clock_adjtime(clockid_t id, struct timex *tx)
+{
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if ((cd.fp->f_mode & FMODE_WRITE) == 0) {
+                err = -EACCES;
+                goto out;
+        }
+
+        if (cd.clk->ops.clock_adjtime)
+                err = cd.clk->ops.clock_adjtime(cd.clk, tx);
+        else
+                err = -EOPNOTSUPP;
+out:
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+static int pc_clock_gettime(clockid_t id, struct timespec *ts)
+{
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if (cd.clk->ops.clock_gettime)
+                err = cd.clk->ops.clock_gettime(cd.clk, ts);
+        else
+                err = -EOPNOTSUPP;
+
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+static int pc_clock_getres(clockid_t id, struct timespec *ts)
+{
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if (cd.clk->ops.clock_getres)
+                err = cd.clk->ops.clock_getres(cd.clk, ts);
+        else
+                err = -EOPNOTSUPP;
+
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+static int pc_clock_settime(clockid_t id, const struct timespec *ts)
+{
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if ((cd.fp->f_mode & FMODE_WRITE) == 0) {
+                err = -EACCES;
+                goto out;
+        }
+
+        if (cd.clk->ops.clock_settime)
+                err = cd.clk->ops.clock_settime(cd.clk, ts);
+        else
+                err = -EOPNOTSUPP;
+out:
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+static int pc_timer_create(struct k_itimer *kit)
+{
+        clockid_t id = kit->it_clock;
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if (cd.clk->ops.timer_create)
+                err = cd.clk->ops.timer_create(cd.clk, kit);
+        else
+                err = -EOPNOTSUPP;
+
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+static int pc_timer_delete(struct k_itimer *kit)
+{
+        clockid_t id = kit->it_clock;
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if (cd.clk->ops.timer_delete)
+                err = cd.clk->ops.timer_delete(cd.clk, kit);
+        else
+                err = -EOPNOTSUPP;
+
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+static void pc_timer_gettime(struct k_itimer *kit, struct itimerspec *ts)
+{
+        clockid_t id = kit->it_clock;
+        struct posix_clock_desc cd;
+
+        if (get_clock_desc(id, &cd))
+                return;
+
+        if (cd.clk->ops.timer_gettime)
+                cd.clk->ops.timer_gettime(cd.clk, kit, ts);
+
+        put_clock_desc(&cd);
+}
+
+static int pc_timer_settime(struct k_itimer *kit, int flags,
+                            struct itimerspec *ts, struct itimerspec *old)
+{
+        clockid_t id = kit->it_clock;
+        struct posix_clock_desc cd;
+        int err;
+
+        err = get_clock_desc(id, &cd);
+        if (err)
+                return err;
+
+        if (cd.clk->ops.timer_settime)
+                err = cd.clk->ops.timer_settime(cd.clk, kit, flags, ts, old);
+        else
+                err = -EOPNOTSUPP;
+
+        put_clock_desc(&cd);
+
+        return err;
+}
+
+struct k_clock clock_posix_dynamic = {
+        .clock_getres   = pc_clock_getres,
+        .clock_set      = pc_clock_settime,
+        .clock_get      = pc_clock_gettime,
+        .clock_adj      = pc_clock_adjtime,
+        .timer_create   = pc_timer_create,
+        .timer_set      = pc_timer_settime,
+        .timer_del      = pc_timer_delete,
+        .timer_get      = pc_timer_gettime,
+};
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 48b2761b5668..da800ffa810c 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -18,7 +18,6 @@
 #include <linux/percpu.h>
 #include <linux/profile.h>
 #include <linux/sched.h>
-#include <linux/tick.h>
 
 #include "tick-internal.h"
 
@@ -600,4 +599,14 @@ int tick_broadcast_oneshot_active(void)
         return tick_broadcast_device.mode == TICKDEV_MODE_ONESHOT;
 }
 
+/*
+ * Check whether the broadcast device supports oneshot.
+ */
+bool tick_broadcast_oneshot_available(void)
+{
+        struct clock_event_device *bc = tick_broadcast_device.evtdev;
+
+        return bc ? bc->features & CLOCK_EVT_FEAT_ONESHOT : false;
+}
+
 #endif
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index b6b898d2eeef..119528de8235 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -18,7 +18,6 @@
 #include <linux/percpu.h>
 #include <linux/profile.h>
 #include <linux/sched.h>
-#include <linux/tick.h>
 
 #include <asm/irq_regs.h>
 
@@ -49,9 +48,13 @@ struct tick_device *tick_get_device(int cpu)
  */
 int tick_is_oneshot_available(void)
 {
-        struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
+        struct clock_event_device *dev = __this_cpu_read(tick_cpu_device.evtdev);
 
-        return dev && (dev->features & CLOCK_EVT_FEAT_ONESHOT);
+        if (!dev || !(dev->features & CLOCK_EVT_FEAT_ONESHOT))
+                return 0;
+        if (!(dev->features & CLOCK_EVT_FEAT_C3STOP))
+                return 1;
+        return tick_broadcast_oneshot_available();
 }
 
 /*
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 290eefbc1f60..1009b06d6f89 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -1,6 +1,10 @@
 /*
  * tick internal variable and functions used by low/high res code
  */
+#include <linux/hrtimer.h>
+#include <linux/tick.h>
+
+#ifdef CONFIG_GENERIC_CLOCKEVENTS_BUILD
 
 #define TICK_DO_TIMER_NONE      -1
 #define TICK_DO_TIMER_BOOT      -2
@@ -36,6 +40,7 @@ extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
 extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 extern int tick_broadcast_oneshot_active(void);
 extern void tick_check_oneshot_broadcast(int cpu);
+bool tick_broadcast_oneshot_available(void);
 # else /* BROADCAST */
 static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
@@ -46,6 +51,7 @@ static inline void tick_broadcast_switch_to_oneshot(void) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
 static inline int tick_broadcast_oneshot_active(void) { return 0; }
 static inline void tick_check_oneshot_broadcast(int cpu) { }
+static inline bool tick_broadcast_oneshot_available(void) { return true; }
 # endif /* !BROADCAST */
 
 #else /* !ONESHOT */
@@ -76,6 +82,7 @@ static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
         return 0;
 }
 static inline int tick_broadcast_oneshot_active(void) { return 0; }
+static inline bool tick_broadcast_oneshot_available(void) { return false; }
 #endif /* !TICK_ONESHOT */
 
 /*
@@ -132,3 +139,8 @@ static inline int tick_device_is_functional(struct clock_event_device *dev)
 {
         return !(dev->features & CLOCK_EVT_FEAT_DUMMY);
 }
+
+#endif
+
+extern void do_timer(unsigned long ticks);
+extern seqlock_t xtime_lock;
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index aada0e52680a..2d04411a5f05 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -18,7 +18,6 @@
 #include <linux/percpu.h>
 #include <linux/profile.h>
 #include <linux/sched.h>
-#include <linux/tick.h>
 
 #include "tick-internal.h"
 
@@ -95,7 +94,7 @@ int tick_dev_program_event(struct clock_event_device *dev, ktime_t expires,
  */
 int tick_program_event(ktime_t expires, int force)
 {
-        struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
+        struct clock_event_device *dev = __this_cpu_read(tick_cpu_device.evtdev);
 
         return tick_dev_program_event(dev, expires, force);
 }
@@ -167,7 +166,7 @@ int tick_oneshot_mode_active(void)
         int ret;
 
         local_irq_save(flags);
-        ret = __get_cpu_var(tick_cpu_device).mode == TICKDEV_MODE_ONESHOT;
+        ret = __this_cpu_read(tick_cpu_device.mode) == TICKDEV_MODE_ONESHOT;
         local_irq_restore(flags);
 
         return ret;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3e216e01bbd1..d5097c44b407 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -19,7 +19,6 @@
 #include <linux/percpu.h>
 #include <linux/profile.h>
 #include <linux/sched.h>
-#include <linux/tick.h>
 #include <linux/module.h>
 
 #include <asm/irq_regs.h>
@@ -642,8 +641,7 @@ static void tick_nohz_switch_to_nohz(void)
         }
         local_irq_enable();
 
-        printk(KERN_INFO "Switched to NOHz mode on CPU #%d\n",
-               smp_processor_id());
+        printk(KERN_INFO "Switched to NOHz mode on CPU #%d\n", smp_processor_id());
 }
 
 /*
@@ -795,8 +793,10 @@ void tick_setup_sched_timer(void)
         }
 
 #ifdef CONFIG_NO_HZ
-        if (tick_nohz_enabled)
+        if (tick_nohz_enabled) {
                 ts->nohz_mode = NOHZ_MODE_HIGHRES;
+                printk(KERN_INFO "Switched to NOHz mode on CPU #%d\n", smp_processor_id());
+        }
 #endif
 }
 #endif /* HIGH_RES_TIMERS */
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 5bb86da82003..3bd7e3d5c632 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -49,7 +49,7 @@ struct timekeeper {
         u32     mult;
 };
 
-struct timekeeper timekeeper;
+static struct timekeeper timekeeper;
 
 /**
  * timekeeper_setup_internals - Set up internals to use clocksource clock.
@@ -164,7 +164,7 @@ static struct timespec total_sleep_time;
 /*
  * The raw monotonic time for the CLOCK_MONOTONIC_RAW posix clock.
  */
-struct timespec raw_time;
+static struct timespec raw_time;
 
 /* flag for if timekeeping is suspended */
 int __read_mostly timekeeping_suspended;
@@ -288,6 +288,49 @@ void ktime_get_ts(struct timespec *ts)
 }
 EXPORT_SYMBOL_GPL(ktime_get_ts);
 
+#ifdef CONFIG_NTP_PPS
+
+/**
+ * getnstime_raw_and_real - get day and raw monotonic time in timespec format
+ * @ts_raw:     pointer to the timespec to be set to raw monotonic time
+ * @ts_real:    pointer to the timespec to be set to the time of day
+ *
+ * This function reads both the time of day and raw monotonic time at the
+ * same time atomically and stores the resulting timestamps in timespec
+ * format.
+ */
+void getnstime_raw_and_real(struct timespec *ts_raw, struct timespec *ts_real)
+{
+        unsigned long seq;
+        s64 nsecs_raw, nsecs_real;
+
+        WARN_ON_ONCE(timekeeping_suspended);
+
+        do {
+                u32 arch_offset;
+
+                seq = read_seqbegin(&xtime_lock);
+
+                *ts_raw = raw_time;
+                *ts_real = xtime;
+
+                nsecs_raw = timekeeping_get_ns_raw();
+                nsecs_real = timekeeping_get_ns();
+
+                /* If arch requires, add in gettimeoffset() */
+                arch_offset = arch_gettimeoffset();
+                nsecs_raw += arch_offset;
+                nsecs_real += arch_offset;
+
+        } while (read_seqretry(&xtime_lock, seq));
+
+        timespec_add_ns(ts_raw, nsecs_raw);
+        timespec_add_ns(ts_real, nsecs_real);
+}
+EXPORT_SYMBOL(getnstime_raw_and_real);
+
+#endif /* CONFIG_NTP_PPS */
+
 /**
  * do_gettimeofday - Returns the time of day in a timeval
  * @tv:         pointer to the timeval to be set
@@ -310,7 +353,7 @@ EXPORT_SYMBOL(do_gettimeofday);
  *
  * Sets the time of day to the new time and update NTP and notify hrtimers
  */
-int do_settimeofday(struct timespec *tv)
+int do_settimeofday(const struct timespec *tv)
 {
         struct timespec ts_delta;
         unsigned long flags;
@@ -344,6 +387,42 @@ int do_settimeofday(struct timespec *tv)
 
 EXPORT_SYMBOL(do_settimeofday);
 
+
+/**
+ * timekeeping_inject_offset - Adds or subtracts from the current time.
+ * @tv:         pointer to the timespec variable containing the offset
+ *
+ * Adds or subtracts an offset value from the current time.
+ */
+int timekeeping_inject_offset(struct timespec *ts)
+{
+        unsigned long flags;
+
+        if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
+                return -EINVAL;
+
+        write_seqlock_irqsave(&xtime_lock, flags);
+
+        timekeeping_forward_now();
+
+        xtime = timespec_add(xtime, *ts);
+        wall_to_monotonic = timespec_sub(wall_to_monotonic, *ts);
+
+        timekeeper.ntp_error = 0;
+        ntp_clear();
+
+        update_vsyscall(&xtime, &wall_to_monotonic, timekeeper.clock,
+                                timekeeper.mult);
+
+        write_sequnlock_irqrestore(&xtime_lock, flags);
+
+        /* signal hrtimers about time change */
+        clock_was_set();
+
+        return 0;
+}
+EXPORT_SYMBOL(timekeeping_inject_offset);
+
 /**
  * change_clocksource - Swaps clocksources if a new one is available
  *
@@ -736,7 +815,7 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
  *
  * Called from the timer interrupt, must hold a write on xtime_lock.
  */
-void update_wall_time(void)
+static void update_wall_time(void)
 {
         struct clocksource *clock;
         cycle_t offset;
@@ -828,7 +907,7 @@ void update_wall_time(void)
  * getboottime - Return the real time of system boot.
  * @ts:         pointer to the timespec to be set
  *
- * Returns the time of day in a timespec.
+ * Returns the wall-time of boot in a timespec.
  *
  * This is based on the wall_to_monotonic offset and the total suspend
  * time. Calls to settimeofday will affect the value returned (which
@@ -846,6 +925,55 @@ void getboottime(struct timespec *ts)
 }
 EXPORT_SYMBOL_GPL(getboottime);
 
+
+/**
+ * get_monotonic_boottime - Returns monotonic time since boot
+ * @ts:         pointer to the timespec to be set
+ *
+ * Returns the monotonic time since boot in a timespec.
+ *
+ * This is similar to CLOCK_MONTONIC/ktime_get_ts, but also
+ * includes the time spent in suspend.
+ */
+void get_monotonic_boottime(struct timespec *ts)
+{
+        struct timespec tomono, sleep;
+        unsigned int seq;
+        s64 nsecs;
+
+        WARN_ON(timekeeping_suspended);
+
+        do {
+                seq = read_seqbegin(&xtime_lock);
+                *ts = xtime;
+                tomono = wall_to_monotonic;
+                sleep = total_sleep_time;
+                nsecs = timekeeping_get_ns();
+
+        } while (read_seqretry(&xtime_lock, seq));
+
+        set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec + sleep.tv_sec,
+                        ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec + nsecs);
+}
+EXPORT_SYMBOL_GPL(get_monotonic_boottime);
+
+/**
+ * ktime_get_boottime - Returns monotonic time since boot in a ktime
+ *
+ * Returns the monotonic time since boot in a ktime
+ *
+ * This is similar to CLOCK_MONTONIC/ktime_get, but also
+ * includes the time spent in suspend.
+ */
+ktime_t ktime_get_boottime(void)
+{
+        struct timespec ts;
+
+        get_monotonic_boottime(&ts);
+        return timespec_to_ktime(ts);
+}
+EXPORT_SYMBOL_GPL(ktime_get_boottime);
+
 /**
  * monotonic_to_bootbased - Convert the monotonic time to boot based.
  * @ts:         pointer to the timespec to be converted
@@ -867,11 +995,6 @@ struct timespec __current_kernel_time(void)
         return xtime;
 }
 
-struct timespec __get_wall_to_monotonic(void)
-{
-        return wall_to_monotonic;
-}
-
 struct timespec current_kernel_time(void)
 {
         struct timespec now;
@@ -903,3 +1026,48 @@ struct timespec get_monotonic_coarse(void)
                                 now.tv_nsec + mono.tv_nsec);
         return now;
 }
+
+/*
+ * The 64-bit jiffies value is not atomic - you MUST NOT read it
+ * without sampling the sequence number in xtime_lock.
+ * jiffies is defined in the linker script...
+ */
+void do_timer(unsigned long ticks)
+{
+        jiffies_64 += ticks;
+        update_wall_time();
+        calc_global_load(ticks);
+}
+
+/**
+ * get_xtime_and_monotonic_and_sleep_offset() - get xtime, wall_to_monotonic,
+ *    and sleep offsets.
+ * @xtim:       pointer to timespec to be set with xtime
+ * @wtom:       pointer to timespec to be set with wall_to_monotonic
+ * @sleep:      pointer to timespec to be set with time in suspend
+ */
+void get_xtime_and_monotonic_and_sleep_offset(struct timespec *xtim,
+                                struct timespec *wtom, struct timespec *sleep)
+{
+        unsigned long seq;
+
+        do {
+                seq = read_seqbegin(&xtime_lock);
+                *xtim = xtime;
+                *wtom = wall_to_monotonic;
+                *sleep = total_sleep_time;
+        } while (read_seqretry(&xtime_lock, seq));
+}
+
+/**
+ * xtime_update() - advances the timekeeping infrastructure
+ * @ticks:      number of ticks, that have elapsed since the last call.
+ *
+ * Must be called with interrupts disabled.
+ */
+void xtime_update(unsigned long ticks)
+{
+        write_seqlock(&xtime_lock);
+        do_timer(ticks);
+        write_sequnlock(&xtime_lock);
+}
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 32a19f9397fc..3258455549f4 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -41,7 +41,7 @@ static void print_name_offset(struct seq_file *m, void *sym)
         char symname[KSYM_NAME_LEN];
 
         if (lookup_symbol_name((unsigned long)sym, symname) < 0)
-                SEQ_printf(m, "<%p>", sym);
+                SEQ_printf(m, "<%pK>", sym);
         else
                 SEQ_printf(m, "%s", symname);
 }
@@ -112,7 +112,7 @@ next_one:
 static void
 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
 {
-        SEQ_printf(m, "  .base:       %p\n", base);
+        SEQ_printf(m, "  .base:       %pK\n", base);
         SEQ_printf(m, "  .index:      %d\n",
                         base->index);
         SEQ_printf(m, "  .resolution: %Lu nsecs\n",
diff --git a/kernel/timer.c b/kernel/timer.c
index 43ca9936f2d0..fd6198692b57 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -404,6 +404,11 @@ static void timer_stats_account_timer(struct timer_list *timer) {}
 
 static struct debug_obj_descr timer_debug_descr;
 
+static void *timer_debug_hint(void *addr)
+{
+        return ((struct timer_list *) addr)->function;
+}
+
 /*
  * fixup_init is called when:
  * - an active object is initialized
@@ -477,6 +482,7 @@ static int timer_fixup_free(void *addr, enum debug_obj_state state)
 
 static struct debug_obj_descr timer_debug_descr = {
         .name           = "timer_list",
+        .debug_hint     = timer_debug_hint,
         .fixup_init     = timer_fixup_init,
         .fixup_activate = timer_fixup_activate,
         .fixup_free     = timer_fixup_free,
@@ -959,20 +965,45 @@ EXPORT_SYMBOL(try_to_del_timer_sync);
  *
  * Synchronization rules: Callers must prevent restarting of the timer,
  * otherwise this function is meaningless. It must not be called from
- * hardirq contexts. The caller must not hold locks which would prevent
+ * interrupt contexts. The caller must not hold locks which would prevent
  * completion of the timer's handler. The timer's handler must not call
  * add_timer_on(). Upon exit the timer is not queued and the handler is
  * not running on any CPU.
  *
+ * Note: You must not hold locks that are held in interrupt context
+ *   while calling this function. Even if the lock has nothing to do
+ *   with the timer in question.  Here's why:
+ *
+ *    CPU0                             CPU1
+ *    ----                             ----
+ *                                   <SOFTIRQ>
+ *                                   call_timer_fn();
+ *                                     base->running_timer = mytimer;
+ *  spin_lock_irq(somelock);
+ *                                     <IRQ>
+ *                                        spin_lock(somelock);
+ *  del_timer_sync(mytimer);
+ *   while (base->running_timer == mytimer);
+ *
+ * Now del_timer_sync() will never return and never release somelock.
+ * The interrupt on the other CPU is waiting to grab somelock but
+ * it has interrupted the softirq that CPU0 is waiting to finish.
+ *
  * The function returns whether it has deactivated a pending timer or not.
  */
 int del_timer_sync(struct timer_list *timer)
 {
 #ifdef CONFIG_LOCKDEP
-        local_bh_disable();
+        unsigned long flags;
+
+        /*
+         * If lockdep gives a backtrace here, please reference
+         * the synchronization rules above.
+         */
+        local_irq_save(flags);
         lock_map_acquire(&timer->lockdep_map);
         lock_map_release(&timer->lockdep_map);
-        local_bh_enable();
+        local_irq_restore(flags);
 #endif
         /*
          * don't use it in hardirq context, because it
@@ -1293,19 +1324,6 @@ void run_local_timers(void)
         raise_softirq(TIMER_SOFTIRQ);
 }
 
-/*
- * The 64-bit jiffies value is not atomic - you MUST NOT read it
- * without sampling the sequence number in xtime_lock.
- * jiffies is defined in the linker script...
- */
-
-void do_timer(unsigned long ticks)
-{
-        jiffies_64 += ticks;
-        update_wall_time();
-        calc_global_load(ticks);
-}
-
 #ifdef __ARCH_WANT_SYS_ALARM
 
 /*
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index 53f338190b26..761c510a06c5 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -52,7 +52,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_event_perf.o
 endif
 obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
 obj-$(CONFIG_KPROBE_EVENT) += trace_kprobe.o
-obj-$(CONFIG_EVENT_TRACING) += power-traces.o
+obj-$(CONFIG_TRACEPOINTS) += power-traces.o
 ifeq ($(CONFIG_TRACING),y)
 obj-$(CONFIG_KGDB_KDB) += trace_kdb.o
 endif
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7b8ec0281548..cbafed7d4f38 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -138,6 +138,13 @@ void __trace_note_message(struct blk_trace *bt, const char *fmt, ...)
                      !blk_tracer_enabled))
                 return;
 
+        /*
+         * If the BLK_TC_NOTIFY action mask isn't set, don't send any note
+         * message to the trace.
+         */
+        if (!(bt->act_mask & BLK_TC_NOTIFY))
+                return;
+
         local_irq_save(flags);
         buf = per_cpu_ptr(bt->msg_data, smp_processor_id());
         va_start(args, fmt);
@@ -758,53 +765,58 @@ static void blk_add_trace_rq_complete(void *ignore,
  * @q:          queue the io is for
  * @bio:        the source bio
  * @what:       the action
+ * @error:      error, if any
  *
  * Description:
  *     Records an action against a bio. Will log the bio offset + size.
  *
  **/
 static void blk_add_trace_bio(struct request_queue *q, struct bio *bio,
-                                     u32 what)
+                              u32 what, int error)
 {
         struct blk_trace *bt = q->blk_trace;
 
         if (likely(!bt))
                 return;
 
+        if (!error && !bio_flagged(bio, BIO_UPTODATE))
+                error = EIO;
+
         __blk_add_trace(bt, bio->bi_sector, bio->bi_size, bio->bi_rw, what,
-                        !bio_flagged(bio, BIO_UPTODATE), 0, NULL);
+                        error, 0, NULL);
 }
 
 static void blk_add_trace_bio_bounce(void *ignore,
                                      struct request_queue *q, struct bio *bio)
 {
-        blk_add_trace_bio(q, bio, BLK_TA_BOUNCE);
+        blk_add_trace_bio(q, bio, BLK_TA_BOUNCE, 0);
 }
 
 static void blk_add_trace_bio_complete(void *ignore,
-                                       struct request_queue *q, struct bio *bio)
+                                       struct request_queue *q, struct bio *bio,
+                                       int error)
 {
-        blk_add_trace_bio(q, bio, BLK_TA_COMPLETE);
+        blk_add_trace_bio(q, bio, BLK_TA_COMPLETE, error);
 }
 
 static void blk_add_trace_bio_backmerge(void *ignore,
                                         struct request_queue *q,
                                         struct bio *bio)
 {
-        blk_add_trace_bio(q, bio, BLK_TA_BACKMERGE);
+        blk_add_trace_bio(q, bio, BLK_TA_BACKMERGE, 0);
 }
 
 static void blk_add_trace_bio_frontmerge(void *ignore,
                                          struct request_queue *q,
                                          struct bio *bio)
 {
-        blk_add_trace_bio(q, bio, BLK_TA_FRONTMERGE);
+        blk_add_trace_bio(q, bio, BLK_TA_FRONTMERGE, 0);
 }
 
 static void blk_add_trace_bio_queue(void *ignore,
                                     struct request_queue *q, struct bio *bio)
 {
-        blk_add_trace_bio(q, bio, BLK_TA_QUEUE);
+        blk_add_trace_bio(q, bio, BLK_TA_QUEUE, 0);
 }
 
 static void blk_add_trace_getrq(void *ignore,
@@ -812,7 +824,7 @@ static void blk_add_trace_getrq(void *ignore,
                                 struct bio *bio, int rw)
 {
         if (bio)
-                blk_add_trace_bio(q, bio, BLK_TA_GETRQ);
+                blk_add_trace_bio(q, bio, BLK_TA_GETRQ, 0);
         else {
                 struct blk_trace *bt = q->blk_trace;
 
@@ -827,7 +839,7 @@ static void blk_add_trace_sleeprq(void *ignore,
                                   struct bio *bio, int rw)
 {
         if (bio)
-                blk_add_trace_bio(q, bio, BLK_TA_SLEEPRQ);
+                blk_add_trace_bio(q, bio, BLK_TA_SLEEPRQ, 0);
         else {
                 struct blk_trace *bt = q->blk_trace;
 
@@ -887,7 +899,7 @@ static void blk_add_trace_split(void *ignore,
 }
 
 /**
- * blk_add_trace_remap - Add a trace for a remap operation
+ * blk_add_trace_bio_remap - Add a trace for a bio-remap operation
  * @ignore:     trace callback data parameter (not used)
  * @q:          queue the io is for
  * @bio:        the source bio
@@ -899,9 +911,9 @@ static void blk_add_trace_split(void *ignore,
  *     it spans a stripe (or similar). Add a trace for that action.
  *
  **/
-static void blk_add_trace_remap(void *ignore,
-                                struct request_queue *q, struct bio *bio,
-                                dev_t dev, sector_t from)
+static void blk_add_trace_bio_remap(void *ignore,
+                                    struct request_queue *q, struct bio *bio,
+                                    dev_t dev, sector_t from)
 {
         struct blk_trace *bt = q->blk_trace;
         struct blk_io_trace_remap r;
@@ -1016,7 +1028,7 @@ static void blk_register_tracepoints(void)
         WARN_ON(ret);
         ret = register_trace_block_split(blk_add_trace_split, NULL);
         WARN_ON(ret);
-        ret = register_trace_block_remap(blk_add_trace_remap, NULL);
+        ret = register_trace_block_bio_remap(blk_add_trace_bio_remap, NULL);
         WARN_ON(ret);
         ret = register_trace_block_rq_remap(blk_add_trace_rq_remap, NULL);
         WARN_ON(ret);
@@ -1025,7 +1037,7 @@ static void blk_register_tracepoints(void)
 static void blk_unregister_tracepoints(void)
 {
         unregister_trace_block_rq_remap(blk_add_trace_rq_remap, NULL);
-        unregister_trace_block_remap(blk_add_trace_remap, NULL);
+        unregister_trace_block_bio_remap(blk_add_trace_bio_remap, NULL);
         unregister_trace_block_split(blk_add_trace_split, NULL);
         unregister_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
         unregister_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
@@ -1815,21 +1827,5 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
         rwbs[i] = '\0';
 }
 
-void blk_fill_rwbs_rq(char *rwbs, struct request *rq)
-{
-        int rw = rq->cmd_flags & 0x03;
-        int bytes;
-
-        if (rq->cmd_flags & REQ_DISCARD)
-                rw |= REQ_DISCARD;
-
-        if (rq->cmd_flags & REQ_SECURE)
-                rw |= REQ_SECURE;
-
-        bytes = blk_rq_bytes(rq);
-
-        blk_fill_rwbs(rwbs, rw, bytes);
-}
-
 #endif /* CONFIG_EVENT_TRACING */
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f3dadae83883..888b611897d3 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3328,7 +3328,7 @@ static int start_graph_tracing(void)
         /* The cpu_boot init_task->ret_stack will never be freed */
         for_each_online_cpu(cpu) {
                 if (!idle_task(cpu)->ret_stack)
-                        ftrace_graph_init_task(idle_task(cpu));
+                        ftrace_graph_init_idle_task(idle_task(cpu), cpu);
         }
 
         do {
@@ -3418,6 +3418,49 @@ void unregister_ftrace_graph(void)
         mutex_unlock(&ftrace_lock);
 }
 
+static DEFINE_PER_CPU(struct ftrace_ret_stack *, idle_ret_stack);
+
+static void
+graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
+{
+        atomic_set(&t->tracing_graph_pause, 0);
+        atomic_set(&t->trace_overrun, 0);
+        t->ftrace_timestamp = 0;
+        /* make curr_ret_stack visable before we add the ret_stack */
+        smp_wmb();
+        t->ret_stack = ret_stack;
+}
+
+/*
+ * Allocate a return stack for the idle task. May be the first
+ * time through, or it may be done by CPU hotplug online.
+ */
+void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
+{
+        t->curr_ret_stack = -1;
+        /*
+         * The idle task has no parent, it either has its own
+         * stack or no stack at all.
+         */
+        if (t->ret_stack)
+                WARN_ON(t->ret_stack != per_cpu(idle_ret_stack, cpu));
+
+        if (ftrace_graph_active) {
+                struct ftrace_ret_stack *ret_stack;
+
+                ret_stack = per_cpu(idle_ret_stack, cpu);
+                if (!ret_stack) {
+                        ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH
+                                            * sizeof(struct ftrace_ret_stack),
+                                            GFP_KERNEL);
+                        if (!ret_stack)
+                                return;
+                        per_cpu(idle_ret_stack, cpu) = ret_stack;
+                }
+                graph_init_task(t, ret_stack);
+        }
+}
+
 /* Allocate a return stack for newly created task */
 void ftrace_graph_init_task(struct task_struct *t)
 {
@@ -3433,12 +3476,7 @@ void ftrace_graph_init_task(struct task_struct *t)
                                 GFP_KERNEL);
                 if (!ret_stack)
                         return;
-                atomic_set(&t->tracing_graph_pause, 0);
-                atomic_set(&t->trace_overrun, 0);
-                t->ftrace_timestamp = 0;
-                /* make curr_ret_stack visable before we add the ret_stack */
-                smp_wmb();
-                t->ret_stack = ret_stack;
+                graph_init_task(t, ret_stack);
         }
 }
 
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index bd1c35a4fbcc..db7b439d23ee 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5,7 +5,6 @@
  */
 #include <linux/ring_buffer.h>
 #include <linux/trace_clock.h>
-#include <linux/ftrace_irq.h>
 #include <linux/spinlock.h>
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
@@ -1429,6 +1428,17 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size)
 }
 EXPORT_SYMBOL_GPL(ring_buffer_resize);
 
+void ring_buffer_change_overwrite(struct ring_buffer *buffer, int val)
+{
+        mutex_lock(&buffer->mutex);
+        if (val)
+                buffer->flags |= RB_FL_OVERWRITE;
+        else
+                buffer->flags &= ~RB_FL_OVERWRITE;
+        mutex_unlock(&buffer->mutex);
+}
+EXPORT_SYMBOL_GPL(ring_buffer_change_overwrite);
+
 static inline void *
 __rb_data_page_index(struct buffer_data_page *bpage, unsigned index)
 {
@@ -2162,11 +2172,19 @@ rb_reserve_next_event(struct ring_buffer *buffer,
         if (likely(ts >= cpu_buffer->write_stamp)) {
                 delta = diff;
                 if (unlikely(test_time_stamp(delta))) {
+                        int local_clock_stable = 1;
+#ifdef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
+                        local_clock_stable = sched_clock_stable;
+#endif
                         WARN_ONCE(delta > (1ULL << 59),
-                                  KERN_WARNING "Delta way too big! %llu ts=%llu write stamp = %llu\n",
+                                  KERN_WARNING "Delta way too big! %llu ts=%llu write stamp = %llu\n%s",
                                   (unsigned long long)delta,
                                   (unsigned long long)ts,
-                                  (unsigned long long)cpu_buffer->write_stamp);
+                                  (unsigned long long)cpu_buffer->write_stamp,
+                                  local_clock_stable ? "" :
+                                  "If you just came from a suspend/resume,\n"
+                                  "please switch to the trace global clock:\n"
+                                  "  echo global > /sys/kernel/debug/tracing/trace_clock\n");
                         add_timestamp = 1;
                 }
         }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index f8cf959bad45..9541c27c1cf2 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -41,8 +41,6 @@
 #include "trace.h"
 #include "trace_output.h"
 
-#define TRACE_BUFFER_FLAGS      (RB_FL_OVERWRITE)
-
 /*
  * On boot up, the ring buffer is set to the minimum size, so that
  * we do not waste memory on systems that are not using tracing.
@@ -340,7 +338,7 @@ static DECLARE_WAIT_QUEUE_HEAD(trace_wait);
 /* trace_flags holds trace_options default values */
 unsigned long trace_flags = TRACE_ITER_PRINT_PARENT | TRACE_ITER_PRINTK |
         TRACE_ITER_ANNOTATE | TRACE_ITER_CONTEXT_INFO | TRACE_ITER_SLEEP_TIME |
-        TRACE_ITER_GRAPH_TIME | TRACE_ITER_RECORD_CMD;
+        TRACE_ITER_GRAPH_TIME | TRACE_ITER_RECORD_CMD | TRACE_ITER_OVERWRITE;
 
 static int trace_stop_count;
 static DEFINE_SPINLOCK(tracing_start_lock);
@@ -425,6 +423,7 @@ static const char *trace_options[] = {
         "sleep-time",
         "graph-time",
         "record-cmd",
+        "overwrite",
         NULL
 };
 
@@ -780,6 +779,11 @@ __acquires(kernel_lock)
                 tracing_reset_online_cpus(tr);
 
                 current_trace = type;
+
+                /* If we expanded the buffers, make sure the max is expanded too */
+                if (ring_buffer_expanded && type->use_max_tr)
+                        ring_buffer_resize(max_tr.buffer, trace_buf_size);
+
                 /* the test is responsible for initializing and enabling */
                 pr_info("Testing tracer %s: ", type->name);
                 ret = type->selftest(type, tr);
@@ -792,6 +796,10 @@ __acquires(kernel_lock)
                 /* Only reset on passing, to avoid touching corrupted buffers */
                 tracing_reset_online_cpus(tr);
 
+                /* Shrink the max buffer again */
+                if (ring_buffer_expanded && type->use_max_tr)
+                        ring_buffer_resize(max_tr.buffer, 1);
+
                 printk(KERN_CONT "PASSED\n");
         }
 #endif
@@ -1102,7 +1110,6 @@ tracing_generic_entry_update(struct trace_entry *entry, unsigned long flags,
 
         entry->preempt_count            = pc & 0xff;
         entry->pid                      = (tsk) ? tsk->pid : 0;
-        entry->lock_depth               = (tsk) ? tsk->lock_depth : 0;
         entry->flags =
 #ifdef CONFIG_TRACE_IRQFLAGS_SUPPORT
                 (irqs_disabled_flags(flags) ? TRACE_FLAG_IRQS_OFF : 0) |
@@ -1313,12 +1320,10 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
 
         __this_cpu_inc(user_stack_count);
 
-
-
         event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
                                           sizeof(*entry), flags, pc);
         if (!event)
-                return;
+                goto out_drop_count;
         entry   = ring_buffer_event_data(event);
 
         entry->tgid             = current->tgid;
@@ -1333,8 +1338,8 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
         if (!filter_check_discard(call, entry, buffer, event))
                 ring_buffer_unlock_commit(buffer, event);
 
+ out_drop_count:
         __this_cpu_dec(user_stack_count);
-
  out:
         preempt_enable();
 }
@@ -1751,10 +1756,9 @@ static void print_lat_help_header(struct seq_file *m)
         seq_puts(m, "#                | / _----=> need-resched    \n");
         seq_puts(m, "#                || / _---=> hardirq/softirq \n");
         seq_puts(m, "#                ||| / _--=> preempt-depth   \n");
-        seq_puts(m, "#                |||| /_--=> lock-depth       \n");
-        seq_puts(m, "#                |||||/     delay             \n");
-        seq_puts(m, "#  cmd     pid   |||||| time  |   caller      \n");
-        seq_puts(m, "#     \\   /      ||||||   \\   |   /           \n");
+        seq_puts(m, "#                |||| /     delay             \n");
+        seq_puts(m, "#  cmd     pid   ||||| time  |   caller      \n");
+        seq_puts(m, "#     \\   /      |||||  \\    |   /           \n");
 }
 
 static void print_func_help_header(struct seq_file *m)
@@ -2531,6 +2535,9 @@ static void set_tracer_flags(unsigned int mask, int enabled)
 
         if (mask == TRACE_ITER_RECORD_CMD)
                 trace_event_enable_cmd_record(enabled);
+
+        if (mask == TRACE_ITER_OVERWRITE)
+                ring_buffer_change_overwrite(global_trace.buffer, enabled);
 }
 
 static ssize_t
@@ -2712,6 +2719,10 @@ tracing_ctrl_write(struct file *filp, const char __user *ubuf,
 
         mutex_lock(&trace_types_lock);
         if (tracer_enabled ^ val) {
+
+                /* Only need to warn if this is used to change the state */
+                WARN_ONCE(1, "tracing_enabled is deprecated. Use tracing_on");
+
                 if (val) {
                         tracer_enabled = 1;
                         if (current_trace->start)
@@ -4553,9 +4564,11 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode)
 __init static int tracer_alloc_buffers(void)
 {
         int ring_buf_size;
+        enum ring_buffer_flags rb_flags;
         int i;
         int ret = -ENOMEM;
 
+
         if (!alloc_cpumask_var(&tracing_buffer_mask, GFP_KERNEL))
                 goto out;
 
@@ -4568,12 +4581,13 @@ __init static int tracer_alloc_buffers(void)
         else
                 ring_buf_size = 1;
 
+        rb_flags = trace_flags & TRACE_ITER_OVERWRITE ? RB_FL_OVERWRITE : 0;
+
         cpumask_copy(tracing_buffer_mask, cpu_possible_mask);
         cpumask_copy(tracing_cpumask, cpu_all_mask);
 
         /* TODO: make the number of buffers hot pluggable with CPUS */
-        global_trace.buffer = ring_buffer_alloc(ring_buf_size,
-                                                   TRACE_BUFFER_FLAGS);
+        global_trace.buffer = ring_buffer_alloc(ring_buf_size, rb_flags);
         if (!global_trace.buffer) {
                 printk(KERN_ERR "tracer: failed to allocate ring buffer!\n");
                 WARN_ON(1);
@@ -4583,7 +4597,7 @@ __init static int tracer_alloc_buffers(void)
 
 
 #ifdef CONFIG_TRACER_MAX_TRACE
-        max_tr.buffer = ring_buffer_alloc(1, TRACE_BUFFER_FLAGS);
+        max_tr.buffer = ring_buffer_alloc(1, rb_flags);
         if (!max_tr.buffer) {
                 printk(KERN_ERR "tracer: failed to allocate max ring buffer!\n");
                 WARN_ON(1);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 9021f8c0c0c3..5e9dfc6286dd 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -272,8 +272,8 @@ struct tracer {
         /* If you handled the flag setting, return 0 */
         int                     (*set_flag)(u32 old_flags, u32 bit, int set);
         struct tracer           *next;
-        int                     print_max;
         struct tracer_flags     *flags;
+        int                     print_max;
         int                     use_max_tr;
 };
 
@@ -606,6 +606,7 @@ enum trace_iterator_flags {
         TRACE_ITER_SLEEP_TIME           = 0x40000,
         TRACE_ITER_GRAPH_TIME           = 0x80000,
         TRACE_ITER_RECORD_CMD           = 0x100000,
+        TRACE_ITER_OVERWRITE            = 0x200000,
 };
 
 /*
@@ -661,8 +662,10 @@ struct ftrace_event_field {
 };
 
 struct event_filter {
-        int                     n_preds;
-        struct filter_pred      **preds;
+        int                     n_preds;        /* Number assigned */
+        int                     a_preds;        /* allocated */
+        struct filter_pred      *preds;
+        struct filter_pred      *root;
         char                    *filter_string;
 };
 
@@ -674,11 +677,23 @@ struct event_subsystem {
         int                     nr_events;
 };
 
+#define FILTER_PRED_INVALID     ((unsigned short)-1)
+#define FILTER_PRED_IS_RIGHT    (1 << 15)
+#define FILTER_PRED_FOLD        (1 << 15)
+
+/*
+ * The max preds is the size of unsigned short with
+ * two flags at the MSBs. One bit is used for both the IS_RIGHT
+ * and FOLD flags. The other is reserved.
+ *
+ * 2^14 preds is way more than enough.
+ */
+#define MAX_FILTER_PRED         16384
+
 struct filter_pred;
 struct regex;
 
-typedef int (*filter_pred_fn_t) (struct filter_pred *pred, void *event,
-                                 int val1, int val2);
+typedef int (*filter_pred_fn_t) (struct filter_pred *pred, void *event);
 
 typedef int (*regex_match_func)(char *str, struct regex *r, int len);
 
@@ -700,11 +715,23 @@ struct filter_pred {
         filter_pred_fn_t        fn;
         u64                     val;
         struct regex            regex;
-        char                    *field_name;
+        /*
+         * Leaf nodes use field_name, ops is used by AND and OR
+         * nodes. The field_name is always freed when freeing a pred.
+         * We can overload field_name for ops and have it freed
+         * as well.
+         */
+        union {
+                char            *field_name;
+                unsigned short  *ops;
+        };
         int                     offset;
         int                     not;
         int                     op;
-        int                     pop_n;
+        unsigned short          index;
+        unsigned short          parent;
+        unsigned short          left;
+        unsigned short          right;
 };
 
 extern struct list_head ftrace_common_fields;
diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index e3dfecaf13e6..1516cb3ec549 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -53,7 +53,7 @@
  */
 
 /*
- * Function trace entry - function address and parent function addres:
+ * Function trace entry - function address and parent function address:
  */
 FTRACE_ENTRY(function, ftrace_entry,
 
@@ -109,12 +109,12 @@ FTRACE_ENTRY(funcgraph_exit, ftrace_graph_ret_entry,
  */
 #define FTRACE_CTX_FIELDS                                       \
         __field(        unsigned int,   prev_pid        )       \
+        __field(        unsigned int,   next_pid        )       \
+        __field(        unsigned int,   next_cpu        )       \
         __field(        unsigned char,  prev_prio       )       \
         __field(        unsigned char,  prev_state      )       \
-        __field(        unsigned int,   next_pid        )       \
         __field(        unsigned char,  next_prio       )       \
-        __field(        unsigned char,  next_state      )       \
-        __field(        unsigned int,   next_cpu        )
+        __field(        unsigned char,  next_state      )
 
 FTRACE_ENTRY(context_switch, ctx_switch_entry,
 
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 35fde09b81de..e88f74fe1d4c 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -116,7 +116,6 @@ static int trace_define_common_fields(void)
         __common_field(unsigned char, flags);
         __common_field(unsigned char, preempt_count);
         __common_field(int, pid);
-        __common_field(int, lock_depth);
 
         return ret;
 }
@@ -326,6 +325,7 @@ int trace_set_clr_event(const char *system, const char *event, int set)
 {
         return __ftrace_set_clr_event(NULL, system, event, set);
 }
+EXPORT_SYMBOL_GPL(trace_set_clr_event);
 
 /* 128 should be much more than enough */
 #define EVENT_BUF_SIZE          127
@@ -1284,7 +1284,7 @@ trace_create_file_ops(struct module *mod)
 static void trace_module_add_events(struct module *mod)
 {
         struct ftrace_module_file_ops *file_ops = NULL;
-        struct ftrace_event_call *call, *start, *end;
+        struct ftrace_event_call **call, **start, **end;
 
         start = mod->trace_events;
         end = mod->trace_events + mod->num_trace_events;
@@ -1297,7 +1297,7 @@ static void trace_module_add_events(struct module *mod)
                 return;
 
         for_each_event(call, start, end) {
-                __trace_add_event_call(call, mod,
+                __trace_add_event_call(*call, mod,
                                        &file_ops->id, &file_ops->enable,
                                        &file_ops->filter, &file_ops->format);
         }
@@ -1367,8 +1367,8 @@ static struct notifier_block trace_module_nb = {
         .priority = 0,
 };
 
-extern struct ftrace_event_call __start_ftrace_events[];
-extern struct ftrace_event_call __stop_ftrace_events[];
+extern struct ftrace_event_call *__start_ftrace_events[];
+extern struct ftrace_event_call *__stop_ftrace_events[];
 
 static char bootup_event_buf[COMMAND_LINE_SIZE] __initdata;
 
@@ -1384,7 +1384,7 @@ __setup("trace_event=", setup_trace_event);
 
 static __init int event_trace_init(void)
 {
-        struct ftrace_event_call *call;
+        struct ftrace_event_call **call;
         struct dentry *d_tracer;
         struct dentry *entry;
         struct dentry *d_events;
@@ -1430,7 +1430,7 @@ static __init int event_trace_init(void)
                 pr_warning("tracing: Failed to allocate common fields");
 
         for_each_event(call, __start_ftrace_events, __stop_ftrace_events) {
-                __trace_add_event_call(call, NULL, &ftrace_event_id_fops,
+                __trace_add_event_call(*call, NULL, &ftrace_event_id_fops,
                                        &ftrace_enable_fops,
                                        &ftrace_event_filter_fops,
                                        &ftrace_event_format_fops);
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 36d40104b17f..3249b4f77ef0 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -123,9 +123,13 @@ struct filter_parse_state {
         } operand;
 };
 
+struct pred_stack {
+        struct filter_pred      **preds;
+        int                     index;
+};
+
 #define DEFINE_COMPARISON_PRED(type)                                    \
-static int filter_pred_##type(struct filter_pred *pred, void *event,    \
-                              int val1, int val2)                       \
+static int filter_pred_##type(struct filter_pred *pred, void *event)    \
 {                                                                       \
         type *addr = (type *)(event + pred->offset);                    \
         type val = (type)pred->val;                                     \
@@ -152,8 +156,7 @@ static int filter_pred_##type(struct filter_pred *pred, void *event,	\
 }
 
 #define DEFINE_EQUALITY_PRED(size)                                      \
-static int filter_pred_##size(struct filter_pred *pred, void *event,    \
-                              int val1, int val2)                       \
+static int filter_pred_##size(struct filter_pred *pred, void *event)    \
 {                                                                       \
         u##size *addr = (u##size *)(event + pred->offset);              \
         u##size val = (u##size)pred->val;                               \
@@ -178,23 +181,8 @@ DEFINE_EQUALITY_PRED(32);
 DEFINE_EQUALITY_PRED(16);
 DEFINE_EQUALITY_PRED(8);
 
-static int filter_pred_and(struct filter_pred *pred __attribute((unused)),
-                           void *event __attribute((unused)),
-                           int val1, int val2)
-{
-        return val1 && val2;
-}
-
-static int filter_pred_or(struct filter_pred *pred __attribute((unused)),
-                          void *event __attribute((unused)),
-                          int val1, int val2)
-{
-        return val1 || val2;
-}
-
 /* Filter predicate for fixed sized arrays of characters */
-static int filter_pred_string(struct filter_pred *pred, void *event,
-                              int val1, int val2)
+static int filter_pred_string(struct filter_pred *pred, void *event)
 {
         char *addr = (char *)(event + pred->offset);
         int cmp, match;
@@ -207,8 +195,7 @@ static int filter_pred_string(struct filter_pred *pred, void *event,
 }
 
 /* Filter predicate for char * pointers */
-static int filter_pred_pchar(struct filter_pred *pred, void *event,
-                             int val1, int val2)
+static int filter_pred_pchar(struct filter_pred *pred, void *event)
 {
         char **addr = (char **)(event + pred->offset);
         int cmp, match;
@@ -231,8 +218,7 @@ static int filter_pred_pchar(struct filter_pred *pred, void *event,
  * and add it to the address of the entry, and at last we have
  * the address of the string.
  */
-static int filter_pred_strloc(struct filter_pred *pred, void *event,
-                              int val1, int val2)
+static int filter_pred_strloc(struct filter_pred *pred, void *event)
 {
         u32 str_item = *(u32 *)(event + pred->offset);
         int str_loc = str_item & 0xffff;
@@ -247,8 +233,7 @@ static int filter_pred_strloc(struct filter_pred *pred, void *event,
         return match;
 }
 
-static int filter_pred_none(struct filter_pred *pred, void *event,
-                            int val1, int val2)
+static int filter_pred_none(struct filter_pred *pred, void *event)
 {
         return 0;
 }
@@ -377,32 +362,147 @@ static void filter_build_regex(struct filter_pred *pred)
         pred->not ^= not;
 }
 
+enum move_type {
+        MOVE_DOWN,
+        MOVE_UP_FROM_LEFT,
+        MOVE_UP_FROM_RIGHT
+};
+
+static struct filter_pred *
+get_pred_parent(struct filter_pred *pred, struct filter_pred *preds,
+                int index, enum move_type *move)
+{
+        if (pred->parent & FILTER_PRED_IS_RIGHT)
+                *move = MOVE_UP_FROM_RIGHT;
+        else
+                *move = MOVE_UP_FROM_LEFT;
+        pred = &preds[pred->parent & ~FILTER_PRED_IS_RIGHT];
+
+        return pred;
+}
+
+/*
+ * A series of AND or ORs where found together. Instead of
+ * climbing up and down the tree branches, an array of the
+ * ops were made in order of checks. We can just move across
+ * the array and short circuit if needed.
+ */
+static int process_ops(struct filter_pred *preds,
+                       struct filter_pred *op, void *rec)
+{
+        struct filter_pred *pred;
+        int type;
+        int match;
+        int i;
+
+        /*
+         * Micro-optimization: We set type to true if op
+         * is an OR and false otherwise (AND). Then we
+         * just need to test if the match is equal to
+         * the type, and if it is, we can short circuit the
+         * rest of the checks:
+         *
+         * if ((match && op->op == OP_OR) ||
+         *     (!match && op->op == OP_AND))
+         *        return match;
+         */
+        type = op->op == OP_OR;
+
+        for (i = 0; i < op->val; i++) {
+                pred = &preds[op->ops[i]];
+                match = pred->fn(pred, rec);
+                if (!!match == type)
+                        return match;
+        }
+        return match;
+}
+
 /* return 1 if event matches, 0 otherwise (discard) */
 int filter_match_preds(struct event_filter *filter, void *rec)
 {
-        int match, top = 0, val1 = 0, val2 = 0;
-        int stack[MAX_FILTER_PRED];
+        int match = -1;
+        enum move_type move = MOVE_DOWN;
+        struct filter_pred *preds;
         struct filter_pred *pred;
-        int i;
+        struct filter_pred *root;
+        int n_preds;
+        int done = 0;
+
+        /* no filter is considered a match */
+        if (!filter)
+                return 1;
+
+        n_preds = filter->n_preds;
+
+        if (!n_preds)
+                return 1;
+
+        /*
+         * n_preds, root and filter->preds are protect with preemption disabled.
+         */
+        preds = rcu_dereference_sched(filter->preds);
+        root = rcu_dereference_sched(filter->root);
+        if (!root)
+                return 1;
+
+        pred = root;
 
-        for (i = 0; i < filter->n_preds; i++) {
-                pred = filter->preds[i];
-                if (!pred->pop_n) {
-                        match = pred->fn(pred, rec, val1, val2);
-                        stack[top++] = match;
+        /* match is currently meaningless */
+        match = -1;
+
+        do {
+                switch (move) {
+                case MOVE_DOWN:
+                        /* only AND and OR have children */
+                        if (pred->left != FILTER_PRED_INVALID) {
+                                /* If ops is set, then it was folded. */
+                                if (!pred->ops) {
+                                        /* keep going to down the left side */
+                                        pred = &preds[pred->left];
+                                        continue;
+                                }
+                                /* We can treat folded ops as a leaf node */
+                                match = process_ops(preds, pred, rec);
+                        } else
+                                match = pred->fn(pred, rec);
+                        /* If this pred is the only pred */
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                case MOVE_UP_FROM_LEFT:
+                        /*
+                         * Check for short circuits.
+                         *
+                         * Optimization: !!match == (pred->op == OP_OR)
+                         *   is the same as:
+                         * if ((match && pred->op == OP_OR) ||
+                         *     (!match && pred->op == OP_AND))
+                         */
+                        if (!!match == (pred->op == OP_OR)) {
+                                if (pred == root)
+                                        break;
+                                pred = get_pred_parent(pred, preds,
+                                                       pred->parent, &move);
+                                continue;
+                        }
+                        /* now go down the right side of the tree. */
+                        pred = &preds[pred->right];
+                        move = MOVE_DOWN;
+                        continue;
+                case MOVE_UP_FROM_RIGHT:
+                        /* We finished this equation. */
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
                         continue;
                 }
-                if (pred->pop_n > top) {
-                        WARN_ON_ONCE(1);
-                        return 0;
-                }
-                val1 = stack[--top];
-                val2 = stack[--top];
-                match = pred->fn(pred, rec, val1, val2);
-                stack[top++] = match;
-        }
+                done = 1;
+        } while (!done);
 
-        return stack[--top];
+        return match;
 }
 EXPORT_SYMBOL_GPL(filter_match_preds);
 
@@ -414,6 +514,9 @@ static void parse_error(struct filter_parse_state *ps, int err, int pos)
 
 static void remove_filter_string(struct event_filter *filter)
 {
+        if (!filter)
+                return;
+
         kfree(filter->filter_string);
         filter->filter_string = NULL;
 }
@@ -473,9 +576,10 @@ static void append_filter_err(struct filter_parse_state *ps,
 
 void print_event_filter(struct ftrace_event_call *call, struct trace_seq *s)
 {
-        struct event_filter *filter = call->filter;
+        struct event_filter *filter;
 
         mutex_lock(&event_mutex);
+        filter = call->filter;
         if (filter && filter->filter_string)
                 trace_seq_printf(s, "%s\n", filter->filter_string);
         else
@@ -486,9 +590,10 @@ void print_event_filter(struct ftrace_event_call *call, struct trace_seq *s)
 void print_subsystem_event_filter(struct event_subsystem *system,
                                   struct trace_seq *s)
 {
-        struct event_filter *filter = system->filter;
+        struct event_filter *filter;
 
         mutex_lock(&event_mutex);
+        filter = system->filter;
         if (filter && filter->filter_string)
                 trace_seq_printf(s, "%s\n", filter->filter_string);
         else
@@ -539,10 +644,58 @@ static void filter_clear_pred(struct filter_pred *pred)
         pred->regex.len = 0;
 }
 
-static int filter_set_pred(struct filter_pred *dest,
+static int __alloc_pred_stack(struct pred_stack *stack, int n_preds)
+{
+        stack->preds = kzalloc(sizeof(*stack->preds)*(n_preds + 1), GFP_KERNEL);
+        if (!stack->preds)
+                return -ENOMEM;
+        stack->index = n_preds;
+        return 0;
+}
+
+static void __free_pred_stack(struct pred_stack *stack)
+{
+        kfree(stack->preds);
+        stack->index = 0;
+}
+
+static int __push_pred_stack(struct pred_stack *stack,
+                             struct filter_pred *pred)
+{
+        int index = stack->index;
+
+        if (WARN_ON(index == 0))
+                return -ENOSPC;
+
+        stack->preds[--index] = pred;
+        stack->index = index;
+        return 0;
+}
+
+static struct filter_pred *
+__pop_pred_stack(struct pred_stack *stack)
+{
+        struct filter_pred *pred;
+        int index = stack->index;
+
+        pred = stack->preds[index++];
+        if (!pred)
+                return NULL;
+
+        stack->index = index;
+        return pred;
+}
+
+static int filter_set_pred(struct event_filter *filter,
+                           int idx,
+                           struct pred_stack *stack,
                            struct filter_pred *src,
                            filter_pred_fn_t fn)
 {
+        struct filter_pred *dest = &filter->preds[idx];
+        struct filter_pred *left;
+        struct filter_pred *right;
+
         *dest = *src;
         if (src->field_name) {
                 dest->field_name = kstrdup(src->field_name, GFP_KERNEL);
@@ -550,116 +703,140 @@ static int filter_set_pred(struct filter_pred *dest,
                         return -ENOMEM;
         }
         dest->fn = fn;
+        dest->index = idx;
 
-        return 0;
+        if (dest->op == OP_OR || dest->op == OP_AND) {
+                right = __pop_pred_stack(stack);
+                left = __pop_pred_stack(stack);
+                if (!left || !right)
+                        return -EINVAL;
+                /*
+                 * If both children can be folded
+                 * and they are the same op as this op or a leaf,
+                 * then this op can be folded.
+                 */
+                if (left->index & FILTER_PRED_FOLD &&
+                    (left->op == dest->op ||
+                     left->left == FILTER_PRED_INVALID) &&
+                    right->index & FILTER_PRED_FOLD &&
+                    (right->op == dest->op ||
+                     right->left == FILTER_PRED_INVALID))
+                        dest->index |= FILTER_PRED_FOLD;
+
+                dest->left = left->index & ~FILTER_PRED_FOLD;
+                dest->right = right->index & ~FILTER_PRED_FOLD;
+                left->parent = dest->index & ~FILTER_PRED_FOLD;
+                right->parent = dest->index | FILTER_PRED_IS_RIGHT;
+        } else {
+                /*
+                 * Make dest->left invalid to be used as a quick
+                 * way to know this is a leaf node.
+                 */
+                dest->left = FILTER_PRED_INVALID;
+
+                /* All leafs allow folding the parent ops. */
+                dest->index |= FILTER_PRED_FOLD;
+        }
+
+        return __push_pred_stack(stack, dest);
 }
 
-static void filter_disable_preds(struct ftrace_event_call *call)
+static void __free_preds(struct event_filter *filter)
 {
-        struct event_filter *filter = call->filter;
         int i;
 
-        call->flags &= ~TRACE_EVENT_FL_FILTERED;
+        if (filter->preds) {
+                for (i = 0; i < filter->a_preds; i++)
+                        kfree(filter->preds[i].field_name);
+                kfree(filter->preds);
+                filter->preds = NULL;
+        }
+        filter->a_preds = 0;
         filter->n_preds = 0;
-
-        for (i = 0; i < MAX_FILTER_PRED; i++)
-                filter->preds[i]->fn = filter_pred_none;
 }
 
-static void __free_preds(struct event_filter *filter)
+static void filter_disable(struct ftrace_event_call *call)
 {
-        int i;
+        call->flags &= ~TRACE_EVENT_FL_FILTERED;
+}
 
+static void __free_filter(struct event_filter *filter)
+{
         if (!filter)
                 return;
 
-        for (i = 0; i < MAX_FILTER_PRED; i++) {
-                if (filter->preds[i])
-                        filter_free_pred(filter->preds[i]);
-        }
-        kfree(filter->preds);
+        __free_preds(filter);
         kfree(filter->filter_string);
         kfree(filter);
 }
 
+/*
+ * Called when destroying the ftrace_event_call.
+ * The call is being freed, so we do not need to worry about
+ * the call being currently used. This is for module code removing
+ * the tracepoints from within it.
+ */
 void destroy_preds(struct ftrace_event_call *call)
 {
-        __free_preds(call->filter);
+        __free_filter(call->filter);
         call->filter = NULL;
-        call->flags &= ~TRACE_EVENT_FL_FILTERED;
 }
 
-static struct event_filter *__alloc_preds(void)
+static struct event_filter *__alloc_filter(void)
 {
         struct event_filter *filter;
+
+        filter = kzalloc(sizeof(*filter), GFP_KERNEL);
+        return filter;
+}
+
+static int __alloc_preds(struct event_filter *filter, int n_preds)
+{
         struct filter_pred *pred;
         int i;
 
-        filter = kzalloc(sizeof(*filter), GFP_KERNEL);
-        if (!filter)
-                return ERR_PTR(-ENOMEM);
+        if (filter->preds)
+                __free_preds(filter);
 
-        filter->n_preds = 0;
+        filter->preds =
+                kzalloc(sizeof(*filter->preds) * n_preds, GFP_KERNEL);
 
-        filter->preds = kzalloc(MAX_FILTER_PRED * sizeof(pred), GFP_KERNEL);
         if (!filter->preds)
-                goto oom;
+                return -ENOMEM;
 
-        for (i = 0; i < MAX_FILTER_PRED; i++) {
-                pred = kzalloc(sizeof(*pred), GFP_KERNEL);
-                if (!pred)
-                        goto oom;
+        filter->a_preds = n_preds;
+        filter->n_preds = 0;
+
+        for (i = 0; i < n_preds; i++) {
+                pred = &filter->preds[i];
                 pred->fn = filter_pred_none;
-                filter->preds[i] = pred;
         }
 
-        return filter;
-
-oom:
-        __free_preds(filter);
-        return ERR_PTR(-ENOMEM);
-}
-
-static int init_preds(struct ftrace_event_call *call)
-{
-        if (call->filter)
-                return 0;
-
-        call->flags &= ~TRACE_EVENT_FL_FILTERED;
-        call->filter = __alloc_preds();
-        if (IS_ERR(call->filter))
-                return PTR_ERR(call->filter);
-
         return 0;
 }
 
-static int init_subsystem_preds(struct event_subsystem *system)
+static void filter_free_subsystem_preds(struct event_subsystem *system)
 {
         struct ftrace_event_call *call;
-        int err;
 
         list_for_each_entry(call, &ftrace_events, list) {
                 if (strcmp(call->class->system, system->name) != 0)
                         continue;
 
-                err = init_preds(call);
-                if (err)
-                        return err;
+                filter_disable(call);
+                remove_filter_string(call->filter);
         }
-
-        return 0;
 }
 
-static void filter_free_subsystem_preds(struct event_subsystem *system)
+static void filter_free_subsystem_filters(struct event_subsystem *system)
 {
         struct ftrace_event_call *call;
 
         list_for_each_entry(call, &ftrace_events, list) {
                 if (strcmp(call->class->system, system->name) != 0)
                         continue;
-
-                filter_disable_preds(call);
-                remove_filter_string(call->filter);
+                __free_filter(call->filter);
+                call->filter = NULL;
         }
 }
 
@@ -667,18 +844,19 @@ static int filter_add_pred_fn(struct filter_parse_state *ps,
                               struct ftrace_event_call *call,
                               struct event_filter *filter,
                               struct filter_pred *pred,
+                              struct pred_stack *stack,
                               filter_pred_fn_t fn)
 {
         int idx, err;
 
-        if (filter->n_preds == MAX_FILTER_PRED) {
+        if (WARN_ON(filter->n_preds == filter->a_preds)) {
                 parse_error(ps, FILT_ERR_TOO_MANY_PREDS, 0);
                 return -ENOSPC;
         }
 
         idx = filter->n_preds;
-        filter_clear_pred(filter->preds[idx]);
-        err = filter_set_pred(filter->preds[idx], pred, fn);
+        filter_clear_pred(&filter->preds[idx]);
+        err = filter_set_pred(filter, idx, stack, pred, fn);
         if (err)
                 return err;
 
@@ -763,6 +941,7 @@ static int filter_add_pred(struct filter_parse_state *ps,
                            struct ftrace_event_call *call,
                            struct event_filter *filter,
                            struct filter_pred *pred,
+                           struct pred_stack *stack,
                            bool dry_run)
 {
         struct ftrace_event_field *field;
@@ -770,17 +949,12 @@ static int filter_add_pred(struct filter_parse_state *ps,
         unsigned long long val;
         int ret;
 
-        pred->fn = filter_pred_none;
+        fn = pred->fn = filter_pred_none;
 
-        if (pred->op == OP_AND) {
-                pred->pop_n = 2;
-                fn = filter_pred_and;
+        if (pred->op == OP_AND)
                 goto add_pred_fn;
-        } else if (pred->op == OP_OR) {
-                pred->pop_n = 2;
-                fn = filter_pred_or;
+        else if (pred->op == OP_OR)
                 goto add_pred_fn;
-        }
 
         field = find_event_field(call, pred->field_name);
         if (!field) {
@@ -829,7 +1003,7 @@ static int filter_add_pred(struct filter_parse_state *ps,
 
 add_pred_fn:
         if (!dry_run)
-                return filter_add_pred_fn(ps, call, filter, pred, fn);
+                return filter_add_pred_fn(ps, call, filter, pred, stack, fn);
         return 0;
 }
 
@@ -1187,6 +1361,234 @@ static int check_preds(struct filter_parse_state *ps)
         return 0;
 }
 
+static int count_preds(struct filter_parse_state *ps)
+{
+        struct postfix_elt *elt;
+        int n_preds = 0;
+
+        list_for_each_entry(elt, &ps->postfix, list) {
+                if (elt->op == OP_NONE)
+                        continue;
+                n_preds++;
+        }
+
+        return n_preds;
+}
+
+/*
+ * The tree is walked at filtering of an event. If the tree is not correctly
+ * built, it may cause an infinite loop. Check here that the tree does
+ * indeed terminate.
+ */
+static int check_pred_tree(struct event_filter *filter,
+                           struct filter_pred *root)
+{
+        struct filter_pred *preds;
+        struct filter_pred *pred;
+        enum move_type move = MOVE_DOWN;
+        int count = 0;
+        int done = 0;
+        int max;
+
+        /*
+         * The max that we can hit a node is three times.
+         * Once going down, once coming up from left, and
+         * once coming up from right. This is more than enough
+         * since leafs are only hit a single time.
+         */
+        max = 3 * filter->n_preds;
+
+        preds = filter->preds;
+        if  (!preds)
+                return -EINVAL;
+        pred = root;
+
+        do {
+                if (WARN_ON(count++ > max))
+                        return -EINVAL;
+
+                switch (move) {
+                case MOVE_DOWN:
+                        if (pred->left != FILTER_PRED_INVALID) {
+                                pred = &preds[pred->left];
+                                continue;
+                        }
+                        /* A leaf at the root is just a leaf in the tree */
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                case MOVE_UP_FROM_LEFT:
+                        pred = &preds[pred->right];
+                        move = MOVE_DOWN;
+                        continue;
+                case MOVE_UP_FROM_RIGHT:
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                }
+                done = 1;
+        } while (!done);
+
+        /* We are fine. */
+        return 0;
+}
+
+static int count_leafs(struct filter_pred *preds, struct filter_pred *root)
+{
+        struct filter_pred *pred;
+        enum move_type move = MOVE_DOWN;
+        int count = 0;
+        int done = 0;
+
+        pred = root;
+
+        do {
+                switch (move) {
+                case MOVE_DOWN:
+                        if (pred->left != FILTER_PRED_INVALID) {
+                                pred = &preds[pred->left];
+                                continue;
+                        }
+                        /* A leaf at the root is just a leaf in the tree */
+                        if (pred == root)
+                                return 1;
+                        count++;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                case MOVE_UP_FROM_LEFT:
+                        pred = &preds[pred->right];
+                        move = MOVE_DOWN;
+                        continue;
+                case MOVE_UP_FROM_RIGHT:
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                }
+                done = 1;
+        } while (!done);
+
+        return count;
+}
+
+static int fold_pred(struct filter_pred *preds, struct filter_pred *root)
+{
+        struct filter_pred *pred;
+        enum move_type move = MOVE_DOWN;
+        int count = 0;
+        int children;
+        int done = 0;
+
+        /* No need to keep the fold flag */
+        root->index &= ~FILTER_PRED_FOLD;
+
+        /* If the root is a leaf then do nothing */
+        if (root->left == FILTER_PRED_INVALID)
+                return 0;
+
+        /* count the children */
+        children = count_leafs(preds, &preds[root->left]);
+        children += count_leafs(preds, &preds[root->right]);
+
+        root->ops = kzalloc(sizeof(*root->ops) * children, GFP_KERNEL);
+        if (!root->ops)
+                return -ENOMEM;
+
+        root->val = children;
+
+        pred = root;
+        do {
+                switch (move) {
+                case MOVE_DOWN:
+                        if (pred->left != FILTER_PRED_INVALID) {
+                                pred = &preds[pred->left];
+                                continue;
+                        }
+                        if (WARN_ON(count == children))
+                                return -EINVAL;
+                        pred->index &= ~FILTER_PRED_FOLD;
+                        root->ops[count++] = pred->index;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                case MOVE_UP_FROM_LEFT:
+                        pred = &preds[pred->right];
+                        move = MOVE_DOWN;
+                        continue;
+                case MOVE_UP_FROM_RIGHT:
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                }
+                done = 1;
+        } while (!done);
+
+        return 0;
+}
+
+/*
+ * To optimize the processing of the ops, if we have several "ors" or
+ * "ands" together, we can put them in an array and process them all
+ * together speeding up the filter logic.
+ */
+static int fold_pred_tree(struct event_filter *filter,
+                           struct filter_pred *root)
+{
+        struct filter_pred *preds;
+        struct filter_pred *pred;
+        enum move_type move = MOVE_DOWN;
+        int done = 0;
+        int err;
+
+        preds = filter->preds;
+        if  (!preds)
+                return -EINVAL;
+        pred = root;
+
+        do {
+                switch (move) {
+                case MOVE_DOWN:
+                        if (pred->index & FILTER_PRED_FOLD) {
+                                err = fold_pred(preds, pred);
+                                if (err)
+                                        return err;
+                                /* Folded nodes are like leafs */
+                        } else if (pred->left != FILTER_PRED_INVALID) {
+                                pred = &preds[pred->left];
+                                continue;
+                        }
+
+                        /* A leaf at the root is just a leaf in the tree */
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                case MOVE_UP_FROM_LEFT:
+                        pred = &preds[pred->right];
+                        move = MOVE_DOWN;
+                        continue;
+                case MOVE_UP_FROM_RIGHT:
+                        if (pred == root)
+                                break;
+                        pred = get_pred_parent(pred, preds,
+                                               pred->parent, &move);
+                        continue;
+                }
+                done = 1;
+        } while (!done);
+
+        return 0;
+}
+
 static int replace_preds(struct ftrace_event_call *call,
                          struct event_filter *filter,
                          struct filter_parse_state *ps,
@@ -1195,14 +1597,32 @@ static int replace_preds(struct ftrace_event_call *call,
 {
         char *operand1 = NULL, *operand2 = NULL;
         struct filter_pred *pred;
+        struct filter_pred *root;
         struct postfix_elt *elt;
+        struct pred_stack stack = { }; /* init to NULL */
         int err;
         int n_preds = 0;
 
+        n_preds = count_preds(ps);
+        if (n_preds >= MAX_FILTER_PRED) {
+                parse_error(ps, FILT_ERR_TOO_MANY_PREDS, 0);
+                return -ENOSPC;
+        }
+
         err = check_preds(ps);
         if (err)
                 return err;
 
+        if (!dry_run) {
+                err = __alloc_pred_stack(&stack, n_preds);
+                if (err)
+                        return err;
+                err = __alloc_preds(filter, n_preds);
+                if (err)
+                        goto fail;
+        }
+
+        n_preds = 0;
         list_for_each_entry(elt, &ps->postfix, list) {
                 if (elt->op == OP_NONE) {
                         if (!operand1)
@@ -1211,14 +1631,16 @@ static int replace_preds(struct ftrace_event_call *call,
                                 operand2 = elt->operand;
                         else {
                                 parse_error(ps, FILT_ERR_TOO_MANY_OPERANDS, 0);
-                                return -EINVAL;
+                                err = -EINVAL;
+                                goto fail;
                         }
                         continue;
                 }
 
-                if (n_preds++ == MAX_FILTER_PRED) {
+                if (WARN_ON(n_preds++ == MAX_FILTER_PRED)) {
                         parse_error(ps, FILT_ERR_TOO_MANY_PREDS, 0);
-                        return -ENOSPC;
+                        err = -ENOSPC;
+                        goto fail;
                 }
 
                 if (elt->op == OP_AND || elt->op == OP_OR) {
@@ -1228,76 +1650,181 @@ static int replace_preds(struct ftrace_event_call *call,
 
                 if (!operand1 || !operand2) {
                         parse_error(ps, FILT_ERR_MISSING_FIELD, 0);
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto fail;
                 }
 
                 pred = create_pred(elt->op, operand1, operand2);
 add_pred:
-                if (!pred)
-                        return -ENOMEM;
-                err = filter_add_pred(ps, call, filter, pred, dry_run);
+                if (!pred) {
+                        err = -ENOMEM;
+                        goto fail;
+                }
+                err = filter_add_pred(ps, call, filter, pred, &stack, dry_run);
                 filter_free_pred(pred);
                 if (err)
-                        return err;
+                        goto fail;
 
                 operand1 = operand2 = NULL;
         }
 
-        return 0;
+        if (!dry_run) {
+                /* We should have one item left on the stack */
+                pred = __pop_pred_stack(&stack);
+                if (!pred)
+                        return -EINVAL;
+                /* This item is where we start from in matching */
+                root = pred;
+                /* Make sure the stack is empty */
+                pred = __pop_pred_stack(&stack);
+                if (WARN_ON(pred)) {
+                        err = -EINVAL;
+                        filter->root = NULL;
+                        goto fail;
+                }
+                err = check_pred_tree(filter, root);
+                if (err)
+                        goto fail;
+
+                /* Optimize the tree */
+                err = fold_pred_tree(filter, root);
+                if (err)
+                        goto fail;
+
+                /* We don't set root until we know it works */
+                barrier();
+                filter->root = root;
+        }
+
+        err = 0;
+fail:
+        __free_pred_stack(&stack);
+        return err;
 }
 
+struct filter_list {
+        struct list_head        list;
+        struct event_filter     *filter;
+};
+
 static int replace_system_preds(struct event_subsystem *system,
                                 struct filter_parse_state *ps,
                                 char *filter_string)
 {
         struct ftrace_event_call *call;
+        struct filter_list *filter_item;
+        struct filter_list *tmp;
+        LIST_HEAD(filter_list);
         bool fail = true;
         int err;
 
         list_for_each_entry(call, &ftrace_events, list) {
-                struct event_filter *filter = call->filter;
 
                 if (strcmp(call->class->system, system->name) != 0)
                         continue;
 
-                /* try to see if the filter can be applied */
-                err = replace_preds(call, filter, ps, filter_string, true);
+                /*
+                 * Try to see if the filter can be applied
+                 *  (filter arg is ignored on dry_run)
+                 */
+                err = replace_preds(call, NULL, ps, filter_string, true);
                 if (err)
+                        goto fail;
+        }
+
+        list_for_each_entry(call, &ftrace_events, list) {
+                struct event_filter *filter;
+
+                if (strcmp(call->class->system, system->name) != 0)
                         continue;
 
-                /* really apply the filter */
-                filter_disable_preds(call);
-                err = replace_preds(call, filter, ps, filter_string, false);
+                filter_item = kzalloc(sizeof(*filter_item), GFP_KERNEL);
+                if (!filter_item)
+                        goto fail_mem;
+
+                list_add_tail(&filter_item->list, &filter_list);
+
+                filter_item->filter = __alloc_filter();
+                if (!filter_item->filter)
+                        goto fail_mem;
+                filter = filter_item->filter;
+
+                /* Can only fail on no memory */
+                err = replace_filter_string(filter, filter_string);
                 if (err)
-                        filter_disable_preds(call);
-                else {
+                        goto fail_mem;
+
+                err = replace_preds(call, filter, ps, filter_string, false);
+                if (err) {
+                        filter_disable(call);
+                        parse_error(ps, FILT_ERR_BAD_SUBSYS_FILTER, 0);
+                        append_filter_err(ps, filter);
+                } else
                         call->flags |= TRACE_EVENT_FL_FILTERED;
-                        replace_filter_string(filter, filter_string);
-                }
+                /*
+                 * Regardless of if this returned an error, we still
+                 * replace the filter for the call.
+                 */
+                filter = call->filter;
+                call->filter = filter_item->filter;
+                filter_item->filter = filter;
+
                 fail = false;
         }
 
-        if (fail) {
-                parse_error(ps, FILT_ERR_BAD_SUBSYS_FILTER, 0);
-                return -EINVAL;
+        if (fail)
+                goto fail;
+
+        /*
+         * The calls can still be using the old filters.
+         * Do a synchronize_sched() to ensure all calls are
+         * done with them before we free them.
+         */
+        synchronize_sched();
+        list_for_each_entry_safe(filter_item, tmp, &filter_list, list) {
+                __free_filter(filter_item->filter);
+                list_del(&filter_item->list);
+                kfree(filter_item);
         }
         return 0;
+ fail:
+        /* No call succeeded */
+        list_for_each_entry_safe(filter_item, tmp, &filter_list, list) {
+                list_del(&filter_item->list);
+                kfree(filter_item);
+        }
+        parse_error(ps, FILT_ERR_BAD_SUBSYS_FILTER, 0);
+        return -EINVAL;
+ fail_mem:
+        /* If any call succeeded, we still need to sync */
+        if (!fail)
+                synchronize_sched();
+        list_for_each_entry_safe(filter_item, tmp, &filter_list, list) {
+                __free_filter(filter_item->filter);
+                list_del(&filter_item->list);
+                kfree(filter_item);
+        }
+        return -ENOMEM;
 }
 
 int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
 {
-        int err;
         struct filter_parse_state *ps;
+        struct event_filter *filter;
+        struct event_filter *tmp;
+        int err = 0;
 
         mutex_lock(&event_mutex);
 
-        err = init_preds(call);
-        if (err)
-                goto out_unlock;
-
         if (!strcmp(strstrip(filter_string), "0")) {
-                filter_disable_preds(call);
-                remove_filter_string(call->filter);
+                filter_disable(call);
+                filter = call->filter;
+                if (!filter)
+                        goto out_unlock;
+                call->filter = NULL;
+                /* Make sure the filter is not being used */
+                synchronize_sched();
+                __free_filter(filter);
                 goto out_unlock;
         }
 
@@ -1306,22 +1833,41 @@ int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
         if (!ps)
                 goto out_unlock;
 
-        filter_disable_preds(call);
-        replace_filter_string(call->filter, filter_string);
+        filter = __alloc_filter();
+        if (!filter) {
+                kfree(ps);
+                goto out_unlock;
+        }
+
+        replace_filter_string(filter, filter_string);
 
         parse_init(ps, filter_ops, filter_string);
         err = filter_parse(ps);
         if (err) {
-                append_filter_err(ps, call->filter);
+                append_filter_err(ps, filter);
                 goto out;
         }
 
-        err = replace_preds(call, call->filter, ps, filter_string, false);
-        if (err)
-                append_filter_err(ps, call->filter);
-        else
+        err = replace_preds(call, filter, ps, filter_string, false);
+        if (err) {
+                filter_disable(call);
+                append_filter_err(ps, filter);
+        } else
                 call->flags |= TRACE_EVENT_FL_FILTERED;
 out:
+        /*
+         * Always swap the call filter with the new filter
+         * even if there was an error. If there was an error
+         * in the filter, we disable the filter and show the error
+         * string
+         */
+        tmp = call->filter;
+        call->filter = filter;
+        if (tmp) {
+                /* Make sure the call is done with the filter */
+                synchronize_sched();
+                __free_filter(tmp);
+        }
         filter_opstack_clear(ps);
         postfix_clear(ps);
         kfree(ps);
@@ -1334,18 +1880,21 @@ out_unlock:
 int apply_subsystem_event_filter(struct event_subsystem *system,
                                  char *filter_string)
 {
-        int err;
         struct filter_parse_state *ps;
+        struct event_filter *filter;
+        int err = 0;
 
         mutex_lock(&event_mutex);
 
-        err = init_subsystem_preds(system);
-        if (err)
-                goto out_unlock;
-
         if (!strcmp(strstrip(filter_string), "0")) {
                 filter_free_subsystem_preds(system);
                 remove_filter_string(system->filter);
+                filter = system->filter;
+                system->filter = NULL;
+                /* Ensure all filters are no longer used */
+                synchronize_sched();
+                filter_free_subsystem_filters(system);
+                __free_filter(filter);
                 goto out_unlock;
         }
 
@@ -1354,7 +1903,17 @@ int apply_subsystem_event_filter(struct event_subsystem *system,
         if (!ps)
                 goto out_unlock;
 
-        replace_filter_string(system->filter, filter_string);
+        filter = __alloc_filter();
+        if (!filter)
+                goto out;
+
+        replace_filter_string(filter, filter_string);
+        /*
+         * No event actually uses the system filter
+         * we can free it without synchronize_sched().
+         */
+        __free_filter(system->filter);
+        system->filter = filter;
 
         parse_init(ps, filter_ops, filter_string);
         err = filter_parse(ps);
@@ -1384,7 +1943,7 @@ void ftrace_profile_free_filter(struct perf_event *event)
         struct event_filter *filter = event->filter;
 
         event->filter = NULL;
-        __free_preds(filter);
+        __free_filter(filter);
 }
 
 int ftrace_profile_set_filter(struct perf_event *event, int event_id,
@@ -1410,8 +1969,8 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
         if (event->filter)
                 goto out_unlock;
 
-        filter = __alloc_preds();
-        if (IS_ERR(filter)) {
+        filter = __alloc_filter();
+        if (!filter) {
                 err = PTR_ERR(filter);
                 goto out_unlock;
         }
@@ -1419,7 +1978,7 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
         err = -ENOMEM;
         ps = kzalloc(sizeof(*ps), GFP_KERNEL);
         if (!ps)
-                goto free_preds;
+                goto free_filter;
 
         parse_init(ps, filter_ops, filter_str);
         err = filter_parse(ps);
@@ -1435,9 +1994,9 @@ free_ps:
         postfix_clear(ps);
         kfree(ps);
 
-free_preds:
+free_filter:
         if (err)
-                __free_preds(filter);
+                __free_filter(filter);
 
 out_unlock:
         mutex_unlock(&event_mutex);
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 4b74d71705c0..bbeec31e0ae3 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -161,13 +161,13 @@ struct ftrace_event_class event_class_ftrace_##call = {			\
         .fields                 = LIST_HEAD_INIT(event_class_ftrace_##call.fields),\
 };                                                                      \
                                                                         \
-struct ftrace_event_call __used                                         \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+struct ftrace_event_call __used event_##call = {                        \
         .name                   = #call,                                \
         .event.type             = etype,                                \
         .class                  = &event_class_ftrace_##call,           \
         .print_fmt              = print,                                \
 };                                                                      \
+struct ftrace_event_call __used                                         \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call;
 
 #include "trace_entries.h"
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 5cf8c602b880..92b6e1e12d98 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -453,14 +453,6 @@ void time_hardirqs_off(unsigned long a0, unsigned long a1)
  * Stubs:
  */
 
-void early_boot_irqs_off(void)
-{
-}
-
-void early_boot_irqs_on(void)
-{
-}
-
 void trace_softirqs_on(unsigned long ip)
 {
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 2dec9bcde8b4..8435b43b1782 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -353,6 +353,43 @@ static __kprobes void free_deref_fetch_param(struct deref_fetch_param *data)
         kfree(data);
 }
 
+/* Bitfield fetch function */
+struct bitfield_fetch_param {
+        struct fetch_param orig;
+        unsigned char hi_shift;
+        unsigned char low_shift;
+};
+
+#define DEFINE_FETCH_bitfield(type)                                     \
+static __kprobes void FETCH_FUNC_NAME(bitfield, type)(struct pt_regs *regs,\
+                                            void *data, void *dest)     \
+{                                                                       \
+        struct bitfield_fetch_param *bprm = data;                       \
+        type buf = 0;                                                   \
+        call_fetch(&bprm->orig, regs, &buf);                            \
+        if (buf) {                                                      \
+                buf <<= bprm->hi_shift;                                 \
+                buf >>= bprm->low_shift;                                \
+        }                                                               \
+        *(type *)dest = buf;                                            \
+}
+DEFINE_BASIC_FETCH_FUNCS(bitfield)
+#define fetch_bitfield_string NULL
+#define fetch_bitfield_string_size NULL
+
+static __kprobes void
+free_bitfield_fetch_param(struct bitfield_fetch_param *data)
+{
+        /*
+         * Don't check the bitfield itself, because this must be the
+         * last fetch function.
+         */
+        if (CHECK_FETCH_FUNCS(deref, data->orig.fn))
+                free_deref_fetch_param(data->orig.data);
+        else if (CHECK_FETCH_FUNCS(symbol, data->orig.fn))
+                free_symbol_cache(data->orig.data);
+        kfree(data);
+}
 /* Default (unsigned long) fetch type */
 #define __DEFAULT_FETCH_TYPE(t) u##t
 #define _DEFAULT_FETCH_TYPE(t) __DEFAULT_FETCH_TYPE(t)
@@ -367,6 +404,7 @@ enum {
         FETCH_MTD_memory,
         FETCH_MTD_symbol,
         FETCH_MTD_deref,
+        FETCH_MTD_bitfield,
         FETCH_MTD_END,
 };
 
@@ -387,6 +425,7 @@ ASSIGN_FETCH_FUNC(retval, ftype),			\
 ASSIGN_FETCH_FUNC(memory, ftype),                       \
 ASSIGN_FETCH_FUNC(symbol, ftype),                       \
 ASSIGN_FETCH_FUNC(deref, ftype),                        \
+ASSIGN_FETCH_FUNC(bitfield, ftype),                     \
           }                                             \
         }
 
@@ -430,9 +469,33 @@ static const struct fetch_type *find_fetch_type(const char *type)
         if (!type)
                 type = DEFAULT_FETCH_TYPE_STR;
 
+        /* Special case: bitfield */
+        if (*type == 'b') {
+                unsigned long bs;
+                type = strchr(type, '/');
+                if (!type)
+                        goto fail;
+                type++;
+                if (strict_strtoul(type, 0, &bs))
+                        goto fail;
+                switch (bs) {
+                case 8:
+                        return find_fetch_type("u8");
+                case 16:
+                        return find_fetch_type("u16");
+                case 32:
+                        return find_fetch_type("u32");
+                case 64:
+                        return find_fetch_type("u64");
+                default:
+                        goto fail;
+                }
+        }
+
         for (i = 0; i < ARRAY_SIZE(fetch_type_table); i++)
                 if (strcmp(type, fetch_type_table[i].name) == 0)
                         return &fetch_type_table[i];
+fail:
         return NULL;
 }
 
@@ -586,7 +649,9 @@ error:
 
 static void free_probe_arg(struct probe_arg *arg)
 {
-        if (CHECK_FETCH_FUNCS(deref, arg->fetch.fn))
+        if (CHECK_FETCH_FUNCS(bitfield, arg->fetch.fn))
+                free_bitfield_fetch_param(arg->fetch.data);
+        else if (CHECK_FETCH_FUNCS(deref, arg->fetch.fn))
                 free_deref_fetch_param(arg->fetch.data);
         else if (CHECK_FETCH_FUNCS(symbol, arg->fetch.fn))
                 free_symbol_cache(arg->fetch.data);
@@ -767,16 +832,15 @@ static int __parse_probe_arg(char *arg, const struct fetch_type *t,
                 }
                 break;
         case '+':       /* deref memory */
+                arg++;  /* Skip '+', because strict_strtol() rejects it. */
         case '-':
                 tmp = strchr(arg, '(');
                 if (!tmp)
                         break;
                 *tmp = '\0';
-                ret = strict_strtol(arg + 1, 0, &offset);
+                ret = strict_strtol(arg, 0, &offset);
                 if (ret)
                         break;
-                if (arg[0] == '-')
-                        offset = -offset;
                 arg = tmp + 1;
                 tmp = strrchr(arg, ')');
                 if (tmp) {
@@ -807,6 +871,41 @@ static int __parse_probe_arg(char *arg, const struct fetch_type *t,
         return ret;
 }
 
+#define BYTES_TO_BITS(nb)       ((BITS_PER_LONG * (nb)) / sizeof(long))
+
+/* Bitfield type needs to be parsed into a fetch function */
+static int __parse_bitfield_probe_arg(const char *bf,
+                                      const struct fetch_type *t,
+                                      struct fetch_param *f)
+{
+        struct bitfield_fetch_param *bprm;
+        unsigned long bw, bo;
+        char *tail;
+
+        if (*bf != 'b')
+                return 0;
+
+        bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
+        if (!bprm)
+                return -ENOMEM;
+        bprm->orig = *f;
+        f->fn = t->fetch[FETCH_MTD_bitfield];
+        f->data = (void *)bprm;
+
+        bw = simple_strtoul(bf + 1, &tail, 0);  /* Use simple one */
+        if (bw == 0 || *tail != '@')
+                return -EINVAL;
+
+        bf = tail + 1;
+        bo = simple_strtoul(bf, &tail, 0);
+        if (tail == bf || *tail != '/')
+                return -EINVAL;
+
+        bprm->hi_shift = BYTES_TO_BITS(t->size) - (bw + bo);
+        bprm->low_shift = bprm->hi_shift + bo;
+        return (BYTES_TO_BITS(t->size) < (bw + bo)) ? -EINVAL : 0;
+}
+
 /* String length checking wrapper */
 static int parse_probe_arg(char *arg, struct trace_probe *tp,
                            struct probe_arg *parg, int is_return)
@@ -836,6 +935,8 @@ static int parse_probe_arg(char *arg, struct trace_probe *tp,
         parg->offset = tp->size;
         tp->size += parg->type->size;
         ret = __parse_probe_arg(arg, parg->type, &parg->fetch, is_return);
+        if (ret >= 0 && t != NULL)
+                ret = __parse_bitfield_probe_arg(t, parg->type, &parg->fetch);
         if (ret >= 0) {
                 parg->fetch_size.fn = get_fetch_size_function(parg->type,
                                                               parg->fetch.fn);
@@ -1130,7 +1231,7 @@ static int command_trace_probe(const char *buf)
         return ret;
 }
 
-#define WRITE_BUFSIZE 128
+#define WRITE_BUFSIZE 4096
 
 static ssize_t probes_write(struct file *file, const char __user *buffer,
                             size_t count, loff_t *ppos)
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 02272baa2206..456be9063c2d 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -529,24 +529,34 @@ seq_print_ip_sym(struct trace_seq *s, unsigned long ip, unsigned long sym_flags)
  * @entry: The trace entry field from the ring buffer
  *
  * Prints the generic fields of irqs off, in hard or softirq, preempt
- * count and lock depth.
+ * count.
  */
 int trace_print_lat_fmt(struct trace_seq *s, struct trace_entry *entry)
 {
-        int hardirq, softirq;
+        char hardsoft_irq;
+        char need_resched;
+        char irqs_off;
+        int hardirq;
+        int softirq;
         int ret;
 
         hardirq = entry->flags & TRACE_FLAG_HARDIRQ;
         softirq = entry->flags & TRACE_FLAG_SOFTIRQ;
 
+        irqs_off =
+                (entry->flags & TRACE_FLAG_IRQS_OFF) ? 'd' :
+                (entry->flags & TRACE_FLAG_IRQS_NOSUPPORT) ? 'X' :
+                '.';
+        need_resched =
+                (entry->flags & TRACE_FLAG_NEED_RESCHED) ? 'N' : '.';
+        hardsoft_irq =
+                (hardirq && softirq) ? 'H' :
+                hardirq ? 'h' :
+                softirq ? 's' :
+                '.';
+
         if (!trace_seq_printf(s, "%c%c%c",
-                              (entry->flags & TRACE_FLAG_IRQS_OFF) ? 'd' :
-                                (entry->flags & TRACE_FLAG_IRQS_NOSUPPORT) ?
-                                  'X' : '.',
-                              (entry->flags & TRACE_FLAG_NEED_RESCHED) ?
-                                'N' : '.',
-                              (hardirq && softirq) ? 'H' :
-                                hardirq ? 'h' : softirq ? 's' : '.'))
+                              irqs_off, need_resched, hardsoft_irq))
                 return 0;
 
         if (entry->preempt_count)
@@ -554,13 +564,7 @@ int trace_print_lat_fmt(struct trace_seq *s, struct trace_entry *entry)
         else
                 ret = trace_seq_putc(s, '.');
 
-        if (!ret)
-                return 0;
-
-        if (entry->lock_depth < 0)
-                return trace_seq_putc(s, '.');
-
-        return trace_seq_printf(s, "%d", entry->lock_depth);
+        return ret;
 }
 
 static int
diff --git a/kernel/trace/trace_sched_switch.c b/kernel/trace/trace_sched_switch.c
index 8f758d070c43..7e62c0a18456 100644
--- a/kernel/trace/trace_sched_switch.c
+++ b/kernel/trace/trace_sched_switch.c
@@ -247,51 +247,3 @@ void tracing_sched_switch_assign_trace(struct trace_array *tr)
         ctx_trace = tr;
 }
 
-static void stop_sched_trace(struct trace_array *tr)
-{
-        tracing_stop_sched_switch_record();
-}
-
-static int sched_switch_trace_init(struct trace_array *tr)
-{
-        ctx_trace = tr;
-        tracing_reset_online_cpus(tr);
-        tracing_start_sched_switch_record();
-        return 0;
-}
-
-static void sched_switch_trace_reset(struct trace_array *tr)
-{
-        if (sched_ref)
-                stop_sched_trace(tr);
-}
-
-static void sched_switch_trace_start(struct trace_array *tr)
-{
-        sched_stopped = 0;
-}
-
-static void sched_switch_trace_stop(struct trace_array *tr)
-{
-        sched_stopped = 1;
-}
-
-static struct tracer sched_switch_trace __read_mostly =
-{
-        .name           = "sched_switch",
-        .init           = sched_switch_trace_init,
-        .reset          = sched_switch_trace_reset,
-        .start          = sched_switch_trace_start,
-        .stop           = sched_switch_trace_stop,
-        .wait_pipe      = poll_wait_pipe,
-#ifdef CONFIG_FTRACE_SELFTEST
-        .selftest    = trace_selftest_startup_sched_switch,
-#endif
-};
-
-__init static int init_sched_switch_trace(void)
-{
-        return register_tracer(&sched_switch_trace);
-}
-device_initcall(init_sched_switch_trace);
-
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index 562c56e048fd..659732eba07c 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -558,7 +558,7 @@ trace_selftest_startup_nop(struct tracer *trace, struct trace_array *tr)
 static int trace_wakeup_test_thread(void *data)
 {
         /* Make this a RT thread, doesn't need to be too high */
-        static struct sched_param param = { .sched_priority = 5 };
+        static const struct sched_param param = { .sched_priority = 5 };
         struct completion *x = data;
 
         sched_setscheduler(current, SCHED_FIFO, &param);
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index bac752f0cfb5..ee7b5a0bb9f8 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -23,9 +23,6 @@ static int syscall_exit_register(struct ftrace_event_call *event,
 static int syscall_enter_define_fields(struct ftrace_event_call *call);
 static int syscall_exit_define_fields(struct ftrace_event_call *call);
 
-/* All syscall exit events have the same fields */
-static LIST_HEAD(syscall_exit_fields);
-
 static struct list_head *
 syscall_get_enter_fields(struct ftrace_event_call *call)
 {
@@ -34,61 +31,66 @@ syscall_get_enter_fields(struct ftrace_event_call *call)
         return &entry->enter_fields;
 }
 
-static struct list_head *
-syscall_get_exit_fields(struct ftrace_event_call *call)
-{
-        return &syscall_exit_fields;
-}
-
 struct trace_event_functions enter_syscall_print_funcs = {
-        .trace                  = print_syscall_enter,
+        .trace          = print_syscall_enter,
 };
 
 struct trace_event_functions exit_syscall_print_funcs = {
-        .trace                  = print_syscall_exit,
+        .trace          = print_syscall_exit,
 };
 
 struct ftrace_event_class event_class_syscall_enter = {
-        .system                 = "syscalls",
-        .reg                    = syscall_enter_register,
-        .define_fields          = syscall_enter_define_fields,
-        .get_fields             = syscall_get_enter_fields,
-        .raw_init               = init_syscall_trace,
+        .system         = "syscalls",
+        .reg            = syscall_enter_register,
+        .define_fields  = syscall_enter_define_fields,
+        .get_fields     = syscall_get_enter_fields,
+        .raw_init       = init_syscall_trace,
 };
 
 struct ftrace_event_class event_class_syscall_exit = {
-        .system                 = "syscalls",
-        .reg                    = syscall_exit_register,
-        .define_fields          = syscall_exit_define_fields,
-        .get_fields             = syscall_get_exit_fields,
-        .raw_init               = init_syscall_trace,
+        .system         = "syscalls",
+        .reg            = syscall_exit_register,
+        .define_fields  = syscall_exit_define_fields,
+        .fields         = LIST_HEAD_INIT(event_class_syscall_exit.fields),
+        .raw_init       = init_syscall_trace,
 };
 
-extern unsigned long __start_syscalls_metadata[];
-extern unsigned long __stop_syscalls_metadata[];
+extern struct syscall_metadata *__start_syscalls_metadata[];
+extern struct syscall_metadata *__stop_syscalls_metadata[];
 
 static struct syscall_metadata **syscalls_metadata;
 
-static struct syscall_metadata *find_syscall_meta(unsigned long syscall)
+#ifndef ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+{
+        /*
+         * Only compare after the "sys" prefix. Archs that use
+         * syscall wrappers may have syscalls symbols aliases prefixed
+         * with "SyS" instead of "sys", leading to an unwanted
+         * mismatch.
+         */
+        return !strcmp(sym + 3, name + 3);
+}
+#endif
+
+static __init struct syscall_metadata *
+find_syscall_meta(unsigned long syscall)
 {
-        struct syscall_metadata *start;
-        struct syscall_metadata *stop;
+        struct syscall_metadata **start;
+        struct syscall_metadata **stop;
         char str[KSYM_SYMBOL_LEN];
 
 
-        start = (struct syscall_metadata *)__start_syscalls_metadata;
-        stop = (struct syscall_metadata *)__stop_syscalls_metadata;
+        start = __start_syscalls_metadata;
+        stop = __stop_syscalls_metadata;
         kallsyms_lookup(syscall, NULL, NULL, NULL, str);
 
+        if (arch_syscall_match_sym_name(str, "sys_ni_syscall"))
+                return NULL;
+
         for ( ; start < stop; start++) {
-                /*
-                 * Only compare after the "sys" prefix. Archs that use
-                 * syscall wrappers may have syscalls symbols aliases prefixed
-                 * with "SyS" instead of "sys", leading to an unwanted
-                 * mismatch.
-                 */
-                if (start->name && !strcmp(start->name + 3, str + 3))
-                        return start;
+                if ((*start)->name && arch_syscall_match_sym_name(str, (*start)->name))
+                        return *start;
         }
         return NULL;
 }
@@ -367,7 +369,7 @@ int reg_event_syscall_enter(struct ftrace_event_call *call)
         int num;
 
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
-        if (num < 0 || num >= NR_syscalls)
+        if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
                 return -ENOSYS;
         mutex_lock(&syscall_trace_lock);
         if (!sys_refcount_enter)
@@ -385,7 +387,7 @@ void unreg_event_syscall_enter(struct ftrace_event_call *call)
         int num;
 
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
-        if (num < 0 || num >= NR_syscalls)
+        if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
                 return;
         mutex_lock(&syscall_trace_lock);
         sys_refcount_enter--;
@@ -401,7 +403,7 @@ int reg_event_syscall_exit(struct ftrace_event_call *call)
         int num;
 
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
-        if (num < 0 || num >= NR_syscalls)
+        if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
                 return -ENOSYS;
         mutex_lock(&syscall_trace_lock);
         if (!sys_refcount_exit)
@@ -419,7 +421,7 @@ void unreg_event_syscall_exit(struct ftrace_event_call *call)
         int num;
 
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
-        if (num < 0 || num >= NR_syscalls)
+        if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
                 return;
         mutex_lock(&syscall_trace_lock);
         sys_refcount_exit--;
@@ -432,6 +434,14 @@ void unreg_event_syscall_exit(struct ftrace_event_call *call)
 int init_syscall_trace(struct ftrace_event_call *call)
 {
         int id;
+        int num;
+
+        num = ((struct syscall_metadata *)call->data)->syscall_nr;
+        if (num < 0 || num >= NR_syscalls) {
+                pr_debug("syscall %s metadata not mapped, disabling ftrace event\n",
+                                ((struct syscall_metadata *)call->data)->name);
+                return -ENOSYS;
+        }
 
         if (set_syscall_print_fmt(call) < 0)
                 return -ENOMEM;
@@ -446,7 +456,7 @@ int init_syscall_trace(struct ftrace_event_call *call)
         return id;
 }
 
-unsigned long __init arch_syscall_addr(int nr)
+unsigned long __init __weak arch_syscall_addr(int nr)
 {
         return (unsigned long)sys_call_table[nr];
 }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index e95ee7f31d43..68187af4889e 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -27,8 +27,8 @@
 #include <linux/sched.h>
 #include <linux/jump_label.h>
 
-extern struct tracepoint __start___tracepoints[];
-extern struct tracepoint __stop___tracepoints[];
+extern struct tracepoint * const __start___tracepoints_ptrs[];
+extern struct tracepoint * const __stop___tracepoints_ptrs[];
 
 /* Set to 1 to enable tracepoint debug output */
 static const int tracepoint_debug;
@@ -298,10 +298,10 @@ static void disable_tracepoint(struct tracepoint *elem)
  *
  * Updates the probe callback corresponding to a range of tracepoints.
  */
-void
-tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+                                   struct tracepoint * const *end)
 {
-        struct tracepoint *iter;
+        struct tracepoint * const *iter;
         struct tracepoint_entry *mark_entry;
 
         if (!begin)
@@ -309,12 +309,12 @@ tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
 
         mutex_lock(&tracepoints_mutex);
         for (iter = begin; iter < end; iter++) {
-                mark_entry = get_tracepoint(iter->name);
+                mark_entry = get_tracepoint((*iter)->name);
                 if (mark_entry) {
-                        set_tracepoint(&mark_entry, iter,
+                        set_tracepoint(&mark_entry, *iter,
                                         !!mark_entry->refcount);
                 } else {
-                        disable_tracepoint(iter);
+                        disable_tracepoint(*iter);
                 }
         }
         mutex_unlock(&tracepoints_mutex);
@@ -326,8 +326,8 @@ tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
 static void tracepoint_update_probes(void)
 {
         /* Core kernel tracepoints */
-        tracepoint_update_probe_range(__start___tracepoints,
-                __stop___tracepoints);
+        tracepoint_update_probe_range(__start___tracepoints_ptrs,
+                __stop___tracepoints_ptrs);
         /* tracepoints in modules. */
         module_update_tracepoints();
 }
@@ -514,8 +514,8 @@ EXPORT_SYMBOL_GPL(tracepoint_probe_update_all);
  * Will return the first tracepoint in the range if the input tracepoint is
  * NULL.
  */
-int tracepoint_get_iter_range(struct tracepoint **tracepoint,
-        struct tracepoint *begin, struct tracepoint *end)
+int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
+        struct tracepoint * const *begin, struct tracepoint * const *end)
 {
         if (!*tracepoint && begin != end) {
                 *tracepoint = begin;
@@ -534,7 +534,8 @@ static void tracepoint_get_iter(struct tracepoint_iter *iter)
         /* Core kernel tracepoints */
         if (!iter->module) {
                 found = tracepoint_get_iter_range(&iter->tracepoint,
-                                __start___tracepoints, __stop___tracepoints);
+                                __start___tracepoints_ptrs,
+                                __stop___tracepoints_ptrs);
                 if (found)
                         goto end;
         }
@@ -585,8 +586,8 @@ int tracepoint_module_notify(struct notifier_block *self,
         switch (val) {
         case MODULE_STATE_COMING:
         case MODULE_STATE_GOING:
-                tracepoint_update_probe_range(mod->tracepoints,
-                        mod->tracepoints + mod->num_tracepoints);
+                tracepoint_update_probe_range(mod->tracepoints_ptrs,
+                        mod->tracepoints_ptrs + mod->num_tracepoints);
                 break;
         }
         return 0;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 25915832291a..9da289c34f22 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -12,6 +12,8 @@
 #include <linux/highuid.h>
 #include <linux/cred.h>
 
+static struct kmem_cache *user_ns_cachep __read_mostly;
+
 /*
  * Create a new user namespace, deriving the creator from the user in the
  * passed credentials, and replacing that user with the new root user for the
@@ -26,7 +28,7 @@ int create_user_ns(struct cred *new)
         struct user_struct *root_user;
         int n;
 
-        ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
+        ns = kmem_cache_alloc(user_ns_cachep, GFP_KERNEL);
         if (!ns)
                 return -ENOMEM;
 
@@ -38,7 +40,7 @@ int create_user_ns(struct cred *new)
         /* Alloc new root user.  */
         root_user = alloc_uid(ns, 0);
         if (!root_user) {
-                kfree(ns);
+                kmem_cache_free(user_ns_cachep, ns);
                 return -ENOMEM;
         }
 
@@ -71,7 +73,7 @@ static void free_user_ns_work(struct work_struct *work)
         struct user_namespace *ns =
                 container_of(work, struct user_namespace, destroyer);
         free_uid(ns->creator);
-        kfree(ns);
+        kmem_cache_free(user_ns_cachep, ns);
 }
 
 void free_user_ns(struct kref *kref)
@@ -126,3 +128,10 @@ gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t
         /* No useful relationship so no mapping */
         return overflowgid;
 }
+
+static __init int user_namespaces_init(void)
+{
+        user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
+        return 0;
+}
+module_init(user_namespaces_init);
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 6e7b575ac33c..18bb15776c57 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -27,7 +27,7 @@
 #include <asm/irq_regs.h>
 #include <linux/perf_event.h>
 
-int watchdog_enabled;
+int watchdog_enabled = 1;
 int __read_mostly softlockup_thresh = 60;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
@@ -43,9 +43,6 @@ static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
 
-static int no_watchdog;
-
-
 /* boot commands */
 /*
  * Should we panic when a soft-lockup or hard-lockup occurs:
@@ -58,7 +55,7 @@ static int __init hardlockup_panic_setup(char *str)
         if (!strncmp(str, "panic", 5))
                 hardlockup_panic = 1;
         else if (!strncmp(str, "0", 1))
-                no_watchdog = 1;
+                watchdog_enabled = 0;
         return 1;
 }
 __setup("nmi_watchdog=", hardlockup_panic_setup);
@@ -77,7 +74,7 @@ __setup("softlockup_panic=", softlockup_panic_setup);
 
 static int __init nowatchdog_setup(char *str)
 {
-        no_watchdog = 1;
+        watchdog_enabled = 0;
         return 1;
 }
 __setup("nowatchdog", nowatchdog_setup);
@@ -85,7 +82,7 @@ __setup("nowatchdog", nowatchdog_setup);
 /* deprecated */
 static int __init nosoftlockup_setup(char *str)
 {
-        no_watchdog = 1;
+        watchdog_enabled = 0;
         return 1;
 }
 __setup("nosoftlockup", nosoftlockup_setup);
@@ -118,12 +115,12 @@ static void __touch_watchdog(void)
 {
         int this_cpu = smp_processor_id();
 
-        __get_cpu_var(watchdog_touch_ts) = get_timestamp(this_cpu);
+        __this_cpu_write(watchdog_touch_ts, get_timestamp(this_cpu));
 }
 
 void touch_softlockup_watchdog(void)
 {
-        __raw_get_cpu_var(watchdog_touch_ts) = 0;
+        __this_cpu_write(watchdog_touch_ts, 0);
 }
 EXPORT_SYMBOL(touch_softlockup_watchdog);
 
@@ -167,12 +164,12 @@ void touch_softlockup_watchdog_sync(void)
 /* watchdog detector functions */
 static int is_hardlockup(void)
 {
-        unsigned long hrint = __get_cpu_var(hrtimer_interrupts);
+        unsigned long hrint = __this_cpu_read(hrtimer_interrupts);
 
-        if (__get_cpu_var(hrtimer_interrupts_saved) == hrint)
+        if (__this_cpu_read(hrtimer_interrupts_saved) == hrint)
                 return 1;
 
-        __get_cpu_var(hrtimer_interrupts_saved) = hrint;
+        __this_cpu_write(hrtimer_interrupts_saved, hrint);
         return 0;
 }
 #endif
@@ -205,8 +202,8 @@ static void watchdog_overflow_callback(struct perf_event *event, int nmi,
         /* Ensure the watchdog never gets throttled */
         event->hw.interrupts = 0;
 
-        if (__get_cpu_var(watchdog_nmi_touch) == true) {
-                __get_cpu_var(watchdog_nmi_touch) = false;
+        if (__this_cpu_read(watchdog_nmi_touch) == true) {
+                __this_cpu_write(watchdog_nmi_touch, false);
                 return;
         }
 
@@ -220,7 +217,7 @@ static void watchdog_overflow_callback(struct perf_event *event, int nmi,
                 int this_cpu = smp_processor_id();
 
                 /* only print hardlockups once */
-                if (__get_cpu_var(hard_watchdog_warn) == true)
+                if (__this_cpu_read(hard_watchdog_warn) == true)
                         return;
 
                 if (hardlockup_panic)
@@ -228,16 +225,16 @@ static void watchdog_overflow_callback(struct perf_event *event, int nmi,
                 else
                         WARN(1, "Watchdog detected hard LOCKUP on cpu %d", this_cpu);
 
-                __get_cpu_var(hard_watchdog_warn) = true;
+                __this_cpu_write(hard_watchdog_warn, true);
                 return;
         }
 
-        __get_cpu_var(hard_watchdog_warn) = false;
+        __this_cpu_write(hard_watchdog_warn, false);
         return;
 }
 static void watchdog_interrupt_count(void)
 {
-        __get_cpu_var(hrtimer_interrupts)++;
+        __this_cpu_inc(hrtimer_interrupts);
 }
 #else
 static inline void watchdog_interrupt_count(void) { return; }
@@ -246,7 +243,7 @@ static inline void watchdog_interrupt_count(void) { return; }
 /* watchdog kicker functions */
 static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
 {
-        unsigned long touch_ts = __get_cpu_var(watchdog_touch_ts);
+        unsigned long touch_ts = __this_cpu_read(watchdog_touch_ts);
         struct pt_regs *regs = get_irq_regs();
         int duration;
 
@@ -254,18 +251,18 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         watchdog_interrupt_count();
 
         /* kick the softlockup detector */
-        wake_up_process(__get_cpu_var(softlockup_watchdog));
+        wake_up_process(__this_cpu_read(softlockup_watchdog));
 
         /* .. and repeat */
         hrtimer_forward_now(hrtimer, ns_to_ktime(get_sample_period()));
 
         if (touch_ts == 0) {
-                if (unlikely(__get_cpu_var(softlockup_touch_sync))) {
+                if (unlikely(__this_cpu_read(softlockup_touch_sync))) {
                         /*
                          * If the time stamp was touched atomically
                          * make sure the scheduler tick is up to date.
                          */
-                        __get_cpu_var(softlockup_touch_sync) = false;
+                        __this_cpu_write(softlockup_touch_sync, false);
                         sched_clock_tick();
                 }
                 __touch_watchdog();
@@ -281,7 +278,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         duration = is_softlockup(touch_ts);
         if (unlikely(duration)) {
                 /* only warn once */
-                if (__get_cpu_var(soft_watchdog_warn) == true)
+                if (__this_cpu_read(soft_watchdog_warn) == true)
                         return HRTIMER_RESTART;
 
                 printk(KERN_ERR "BUG: soft lockup - CPU#%d stuck for %us! [%s:%d]\n",
@@ -296,9 +293,9 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
 
                 if (softlockup_panic)
                         panic("softlockup: hung tasks");
-                __get_cpu_var(soft_watchdog_warn) = true;
+                __this_cpu_write(soft_watchdog_warn, true);
         } else
-                __get_cpu_var(soft_watchdog_warn) = false;
+                __this_cpu_write(soft_watchdog_warn, false);
 
         return HRTIMER_RESTART;
 }
@@ -366,8 +363,14 @@ static int watchdog_nmi_enable(int cpu)
                 goto out_save;
         }
 
-        printk(KERN_ERR "NMI watchdog disabled for cpu%i: unable to create perf event: %ld\n",
-               cpu, PTR_ERR(event));
+
+        /* vary the KERN level based on the returned errno */
+        if (PTR_ERR(event) == -EOPNOTSUPP)
+                printk(KERN_INFO "NMI watchdog disabled (cpu%i): not supported (no LAPIC?)\n", cpu);
+        else if (PTR_ERR(event) == -ENOENT)
+                printk(KERN_WARNING "NMI watchdog disabled (cpu%i): hardware events not enabled\n", cpu);
+        else
+                printk(KERN_ERR "NMI watchdog disabled (cpu%i): unable to create perf event: %ld\n", cpu, PTR_ERR(event));
         return PTR_ERR(event);
 
         /* success path */
@@ -432,9 +435,6 @@ static int watchdog_enable(int cpu)
                 wake_up_process(p);
         }
 
-        /* if any cpu succeeds, watchdog is considered enabled for the system */
-        watchdog_enabled = 1;
-
         return 0;
 }
 
@@ -462,12 +462,16 @@ static void watchdog_disable(int cpu)
 static void watchdog_enable_all_cpus(void)
 {
         int cpu;
-        int result = 0;
+
+        watchdog_enabled = 0;
 
         for_each_online_cpu(cpu)
-                result += watchdog_enable(cpu);
+                if (!watchdog_enable(cpu))
+                        /* if any cpu succeeds, watchdog is considered
+                           enabled for the system */
+                        watchdog_enabled = 1;
 
-        if (result)
+        if (!watchdog_enabled)
                 printk(KERN_ERR "watchdog: failed to be enabled on some cpus\n");
 
 }
@@ -476,9 +480,6 @@ static void watchdog_disable_all_cpus(void)
 {
         int cpu;
 
-        if (no_watchdog)
-                return;
-
         for_each_online_cpu(cpu)
                 watchdog_disable(cpu);
 
@@ -498,10 +499,12 @@ int proc_dowatchdog_enabled(struct ctl_table *table, int write,
 {
         proc_dointvec(table, write, buffer, length, ppos);
 
-        if (watchdog_enabled)
-                watchdog_enable_all_cpus();
-        else
-                watchdog_disable_all_cpus();
+        if (write) {
+                if (watchdog_enabled)
+                        watchdog_enable_all_cpus();
+                else
+                        watchdog_disable_all_cpus();
+        }
         return 0;
 }
 
@@ -530,7 +533,8 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 break;
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
-                err = watchdog_enable(hotcpu);
+                if (watchdog_enabled)
+                        err = watchdog_enable(hotcpu);
                 break;
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_UP_CANCELED:
@@ -555,9 +559,6 @@ void __init lockup_detector_init(void)
         void *cpu = (void *)(long)smp_processor_id();
         int err;
 
-        if (no_watchdog)
-                return;
-
         err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
         WARN_ON(notifier_to_errno(err));
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index e785b0f2aea5..b5fe4c00eb3c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -79,7 +79,9 @@ enum {
         MAX_IDLE_WORKERS_RATIO  = 4,            /* 1/4 of busy can be idle */
         IDLE_WORKER_TIMEOUT     = 300 * HZ,     /* keep idle ones for 5 mins */
 
-        MAYDAY_INITIAL_TIMEOUT  = HZ / 100,     /* call for help after 10ms */
+        MAYDAY_INITIAL_TIMEOUT  = HZ / 100 >= 2 ? HZ / 100 : 2,
+                                                /* call for help after 10ms
+                                                   (min two ticks) */
         MAYDAY_INTERVAL         = HZ / 10,      /* and then every 100ms */
         CREATE_COOLDOWN         = HZ,           /* time to breath after fail */
         TRUSTEE_COOLDOWN        = HZ / 10,      /* for trustee draining */
@@ -314,6 +316,11 @@ static inline int __next_wq_cpu(int cpu, const struct cpumask *mask,
 
 static struct debug_obj_descr work_debug_descr;
 
+static void *work_debug_hint(void *addr)
+{
+        return ((struct work_struct *) addr)->func;
+}
+
 /*
  * fixup_init is called when:
  * - an active object is initialized
@@ -385,6 +392,7 @@ static int work_fixup_free(void *addr, enum debug_obj_state state)
 
 static struct debug_obj_descr work_debug_descr = {
         .name           = "work_struct",
+        .debug_hint     = work_debug_hint,
         .fixup_init     = work_fixup_init,
         .fixup_activate = work_fixup_activate,
         .fixup_free     = work_fixup_free,
@@ -768,7 +776,11 @@ static inline void worker_clr_flags(struct worker *worker, unsigned int flags)
 
         worker->flags &= ~flags;
 
-        /* if transitioning out of NOT_RUNNING, increment nr_running */
+        /*
+         * If transitioning out of NOT_RUNNING, increment nr_running.  Note
+         * that the nested NOT_RUNNING is not a noop.  NOT_RUNNING is mask
+         * of multiple flags, not a single flag.
+         */
         if ((flags & WORKER_NOT_RUNNING) && (oflags & WORKER_NOT_RUNNING))
                 if (!(worker->flags & WORKER_NOT_RUNNING))
                         atomic_inc(get_gcwq_nr_running(gcwq->cpu));
@@ -932,6 +944,38 @@ static void insert_work(struct cpu_workqueue_struct *cwq,
                 wake_up_worker(gcwq);
 }
 
+/*
+ * Test whether @work is being queued from another work executing on the
+ * same workqueue.  This is rather expensive and should only be used from
+ * cold paths.
+ */
+static bool is_chained_work(struct workqueue_struct *wq)
+{
+        unsigned long flags;
+        unsigned int cpu;
+
+        for_each_gcwq_cpu(cpu) {
+                struct global_cwq *gcwq = get_gcwq(cpu);
+                struct worker *worker;
+                struct hlist_node *pos;
+                int i;
+
+                spin_lock_irqsave(&gcwq->lock, flags);
+                for_each_busy_worker(worker, i, pos, gcwq) {
+                        if (worker->task != current)
+                                continue;
+                        spin_unlock_irqrestore(&gcwq->lock, flags);
+                        /*
+                         * I'm @worker, no locking necessary.  See if @work
+                         * is headed to the same workqueue.
+                         */
+                        return worker->current_cwq->wq == wq;
+                }
+                spin_unlock_irqrestore(&gcwq->lock, flags);
+        }
+        return false;
+}
+
 static void __queue_work(unsigned int cpu, struct workqueue_struct *wq,
                          struct work_struct *work)
 {
@@ -943,7 +987,9 @@ static void __queue_work(unsigned int cpu, struct workqueue_struct *wq,
 
         debug_work_activate(work);
 
-        if (WARN_ON_ONCE(wq->flags & WQ_DYING))
+        /* if dying, only works from the same workqueue are allowed */
+        if (unlikely(wq->flags & WQ_DYING) &&
+            WARN_ON_ONCE(!is_chained_work(wq)))
                 return;
 
         /* determine gcwq to use */
@@ -1806,7 +1852,7 @@ __acquires(&gcwq->lock)
         spin_unlock_irq(&gcwq->lock);
 
         work_clear_pending(work);
-        lock_map_acquire(&cwq->wq->lockdep_map);
+        lock_map_acquire_read(&cwq->wq->lockdep_map);
         lock_map_acquire(&lockdep_map);
         trace_workqueue_execute_start(work);
         f(work);
@@ -2009,6 +2055,15 @@ repeat:
                                 move_linked_works(work, scheduled, &n);
 
                 process_scheduled_works(rescuer);
+
+                /*
+                 * Leave this gcwq.  If keep_working() is %true, notify a
+                 * regular worker; otherwise, we end up with 0 concurrency
+                 * and stalling the execution.
+                 */
+                if (keep_working(gcwq))
+                        wake_up_worker(gcwq);
+
                 spin_unlock_irq(&gcwq->lock);
         }
 
@@ -2350,8 +2405,18 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr,
         insert_wq_barrier(cwq, barr, work, worker);
         spin_unlock_irq(&gcwq->lock);
 
-        lock_map_acquire(&cwq->wq->lockdep_map);
+        /*
+         * If @max_active is 1 or rescuer is in use, flushing another work
+         * item on the same workqueue may lead to deadlock.  Make sure the
+         * flusher is not running on the same workqueue by verifying write
+         * access.
+         */
+        if (cwq->wq->saved_max_active == 1 || cwq->wq->flags & WQ_RESCUER)
+                lock_map_acquire(&cwq->wq->lockdep_map);
+        else
+                lock_map_acquire_read(&cwq->wq->lockdep_map);
         lock_map_release(&cwq->wq->lockdep_map);
+
         return true;
 already_gone:
         spin_unlock_irq(&gcwq->lock);
@@ -2908,7 +2973,7 @@ struct workqueue_struct *__alloc_workqueue_key(const char *name,
          */
         spin_lock(&workqueue_lock);
 
-        if (workqueue_freezing && wq->flags & WQ_FREEZEABLE)
+        if (workqueue_freezing && wq->flags & WQ_FREEZABLE)
                 for_each_cwq_cpu(cpu, wq)
                         get_cwq(cpu, wq)->max_active = 0;
 
@@ -2936,11 +3001,35 @@ EXPORT_SYMBOL_GPL(__alloc_workqueue_key);
  */
 void destroy_workqueue(struct workqueue_struct *wq)
 {
+        unsigned int flush_cnt = 0;
         unsigned int cpu;
 
+        /*
+         * Mark @wq dying and drain all pending works.  Once WQ_DYING is
+         * set, only chain queueing is allowed.  IOW, only currently
+         * pending or running work items on @wq can queue further work
+         * items on it.  @wq is flushed repeatedly until it becomes empty.
+         * The number of flushing is detemined by the depth of chaining and
+         * should be relatively short.  Whine if it takes too long.
+         */
         wq->flags |= WQ_DYING;
+reflush:
         flush_workqueue(wq);
 
+        for_each_cwq_cpu(cpu, wq) {
+                struct cpu_workqueue_struct *cwq = get_cwq(cpu, wq);
+
+                if (!cwq->nr_active && list_empty(&cwq->delayed_works))
+                        continue;
+
+                if (++flush_cnt == 10 ||
+                    (flush_cnt % 100 == 0 && flush_cnt <= 1000))
+                        printk(KERN_WARNING "workqueue %s: flush on "
+                               "destruction isn't complete after %u tries\n",
+                               wq->name, flush_cnt);
+                goto reflush;
+        }
+
         /*
          * wq list is used to freeze wq, remove from list after
          * flushing is complete in case freeze races us.
@@ -2996,7 +3085,7 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
 
                 spin_lock_irq(&gcwq->lock);
 
-                if (!(wq->flags & WQ_FREEZEABLE) ||
+                if (!(wq->flags & WQ_FREEZABLE) ||
                     !(gcwq->flags & GCWQ_FREEZING))
                         get_cwq(gcwq->cpu, wq)->max_active = max_active;
 
@@ -3246,7 +3335,7 @@ static int __cpuinit trustee_thread(void *__gcwq)
          * want to get it over with ASAP - spam rescuers, wake up as
          * many idlers as necessary and create new ones till the
          * worklist is empty.  Note that if the gcwq is frozen, there
-         * may be frozen works in freezeable cwqs.  Don't declare
+         * may be frozen works in freezable cwqs.  Don't declare
          * completion while frozen.
          */
         while (gcwq->nr_workers != gcwq->nr_idle ||
@@ -3504,9 +3593,9 @@ EXPORT_SYMBOL_GPL(work_on_cpu);
 /**
  * freeze_workqueues_begin - begin freezing workqueues
  *
- * Start freezing workqueues.  After this function returns, all
- * freezeable workqueues will queue new works to their frozen_works
- * list instead of gcwq->worklist.
+ * Start freezing workqueues.  After this function returns, all freezable
+ * workqueues will queue new works to their frozen_works list instead of
+ * gcwq->worklist.
  *
  * CONTEXT:
  * Grabs and releases workqueue_lock and gcwq->lock's.
@@ -3532,7 +3621,7 @@ void freeze_workqueues_begin(void)
                 list_for_each_entry(wq, &workqueues, list) {
                         struct cpu_workqueue_struct *cwq = get_cwq(cpu, wq);
 
-                        if (cwq && wq->flags & WQ_FREEZEABLE)
+                        if (cwq && wq->flags & WQ_FREEZABLE)
                                 cwq->max_active = 0;
                 }
 
@@ -3543,7 +3632,7 @@ void freeze_workqueues_begin(void)
 }
 
 /**
- * freeze_workqueues_busy - are freezeable workqueues still busy?
+ * freeze_workqueues_busy - are freezable workqueues still busy?
  *
  * Check whether freezing is complete.  This function must be called
  * between freeze_workqueues_begin() and thaw_workqueues().
@@ -3552,8 +3641,8 @@ void freeze_workqueues_begin(void)
  * Grabs and releases workqueue_lock.
  *
  * RETURNS:
- * %true if some freezeable workqueues are still busy.  %false if
- * freezing is complete.
+ * %true if some freezable workqueues are still busy.  %false if freezing
+ * is complete.
  */
 bool freeze_workqueues_busy(void)
 {
@@ -3573,7 +3662,7 @@ bool freeze_workqueues_busy(void)
                 list_for_each_entry(wq, &workqueues, list) {
                         struct cpu_workqueue_struct *cwq = get_cwq(cpu, wq);
 
-                        if (!cwq || !(wq->flags & WQ_FREEZEABLE))
+                        if (!cwq || !(wq->flags & WQ_FREEZABLE))
                                 continue;
 
                         BUG_ON(cwq->nr_active < 0);
@@ -3618,7 +3707,7 @@ void thaw_workqueues(void)
                 list_for_each_entry(wq, &workqueues, list) {
                         struct cpu_workqueue_struct *cwq = get_cwq(cpu, wq);
 
-                        if (!cwq || !(wq->flags & WQ_FREEZEABLE))
+                        if (!cwq || !(wq->flags & WQ_FREEZABLE))
                                 continue;
 
                         /* restore max_active and repopulate worklist */