127 files changed, 6206 insertions, 3269 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index 6aebdeb2aa34..149e18ef1ab1 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -10,7 +10,8 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o pm_qos_params.o sched_clock.o cred.o \
-            async.o
+            async.o range.o
+obj-$(CONFIG_HAVE_EARLY_RES) += early_res.o
 obj-y += groups.o
 
 ifdef CONFIG_FUNCTION_TRACER
@@ -67,7 +68,7 @@ obj-$(CONFIG_USER_NS) += user_namespace.o
 obj-$(CONFIG_PID_NS) += pid_namespace.o
 obj-$(CONFIG_IKCONFIG) += configs.o
 obj-$(CONFIG_RESOURCE_COUNTERS) += res_counter.o
-obj-$(CONFIG_STOP_MACHINE) += stop_machine.o
+obj-$(CONFIG_SMP) += stop_machine.o
 obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
 obj-$(CONFIG_AUDIT) += audit.o auditfilter.o audit_watch.o
 obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
@@ -90,6 +91,9 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
 obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
 obj-$(CONFIG_TRACEPOINTS) += tracepoint.o
 obj-$(CONFIG_LATENCYTOP) += latencytop.o
+obj-$(CONFIG_BINFMT_ELF) += elfcore.o
+obj-$(CONFIG_COMPAT_BINFMT_ELF) += elfcore.o
+obj-$(CONFIG_BINFMT_ELF_FDPIC) += elfcore.o
 obj-$(CONFIG_FUNCTION_TRACER) += trace/
 obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_X86_DS) += trace/
diff --git a/kernel/acct.c b/kernel/acct.c
index a6605ca921b6..e4c0e1fee9b0 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -353,17 +353,18 @@ restart:
 
 void acct_exit_ns(struct pid_namespace *ns)
 {
-        struct bsd_acct_struct *acct;
+        struct bsd_acct_struct *acct = ns->bacct;
 
-        spin_lock(&acct_lock);
-        acct = ns->bacct;
-        if (acct != NULL) {
-                if (acct->file != NULL)
-                        acct_file_reopen(acct, NULL, NULL);
+        if (acct == NULL)
+                return;
 
-                kfree(acct);
-        }
+        del_timer_sync(&acct->timer);
+        spin_lock(&acct_lock);
+        if (acct->file != NULL)
+                acct_file_reopen(acct, NULL, NULL);
         spin_unlock(&acct_lock);
+
+        kfree(acct);
 }
 
 /*
@@ -588,16 +589,6 @@ out:
 }
 
 /**
- * acct_init_pacct - initialize a new pacct_struct
- * @pacct: per-process accounting info struct to initialize
- */
-void acct_init_pacct(struct pacct_struct *pacct)
-{
-        memset(pacct, 0, sizeof(struct pacct_struct));
-        pacct->ac_utime = pacct->ac_stime = cputime_zero;
-}
-
-/**
  * acct_collect - collect accounting information into pacct_struct
  * @exitcode: task exit code
  * @group_dead: not 0, if this thread is the last one in the process.
diff --git a/kernel/async.c b/kernel/async.c
index 27235f5de198..15319d6c18fe 100644
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -56,6 +56,7 @@ asynchronous and synchronous parts of the kernel.
 #include <linux/init.h>
 #include <linux/kthread.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/atomic.h>
 
 static async_cookie_t next_cookie = 1;
diff --git a/kernel/audit.c b/kernel/audit.c
index 5feed232be9d..c71bd26631a2 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -46,6 +46,7 @@
 #include <asm/atomic.h>
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/kthread.h>
 
@@ -398,7 +399,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
         skb_get(skb);
         err = netlink_unicast(audit_sock, skb, audit_nlk_pid, 0);
         if (err < 0) {
-                BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
+                BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
                 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
                 audit_log_lost("auditd dissapeared\n");
                 audit_pid = 0;
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 4b05bd9479db..46a57b57a335 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -3,6 +3,7 @@
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 
 struct audit_tree;
 struct audit_chunk;
@@ -548,6 +549,11 @@ int audit_remove_tree_rule(struct audit_krule *rule)
         return 0;
 }
 
+static int compare_root(struct vfsmount *mnt, void *arg)
+{
+        return mnt->mnt_root->d_inode == arg;
+}
+
 void audit_trim_trees(void)
 {
         struct list_head cursor;
@@ -559,7 +565,6 @@ void audit_trim_trees(void)
                 struct path path;
                 struct vfsmount *root_mnt;
                 struct node *node;
-                struct list_head list;
                 int err;
 
                 tree = container_of(cursor.next, struct audit_tree, list);
@@ -577,24 +582,16 @@ void audit_trim_trees(void)
                 if (!root_mnt)
                         goto skip_it;
 
-                list_add_tail(&list, &root_mnt->mnt_list);
                 spin_lock(&hash_lock);
                 list_for_each_entry(node, &tree->chunks, list) {
-                        struct audit_chunk *chunk = find_chunk(node);
-                        struct inode *inode = chunk->watch.inode;
-                        struct vfsmount *mnt;
+                        struct inode *inode = find_chunk(node)->watch.inode;
                         node->index |= 1U<<31;
-                        list_for_each_entry(mnt, &list, mnt_list) {
-                                if (mnt->mnt_root->d_inode == inode) {
-                                        node->index &= ~(1U<<31);
-                                        break;
-                                }
-                        }
+                        if (iterate_mounts(compare_root, inode, root_mnt))
+                                node->index &= ~(1U<<31);
                 }
                 spin_unlock(&hash_lock);
                 trim_marked(tree);
                 put_tree(tree);
-                list_del_init(&list);
                 drop_collected_mounts(root_mnt);
 skip_it:
                 mutex_lock(&audit_filter_mutex);
@@ -603,22 +600,6 @@ skip_it:
         mutex_unlock(&audit_filter_mutex);
 }
 
-static int is_under(struct vfsmount *mnt, struct dentry *dentry,
-                    struct path *path)
-{
-        if (mnt != path->mnt) {
-                for (;;) {
-                        if (mnt->mnt_parent == mnt)
-                                return 0;
-                        if (mnt->mnt_parent == path->mnt)
-                                        break;
-                        mnt = mnt->mnt_parent;
-                }
-                dentry = mnt->mnt_mountpoint;
-        }
-        return is_subdir(dentry, path->dentry);
-}
-
 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
 {
 
@@ -638,13 +619,17 @@ void audit_put_tree(struct audit_tree *tree)
         put_tree(tree);
 }
 
+static int tag_mount(struct vfsmount *mnt, void *arg)
+{
+        return tag_chunk(mnt->mnt_root->d_inode, arg);
+}
+
 /* called with audit_filter_mutex */
 int audit_add_tree_rule(struct audit_krule *rule)
 {
         struct audit_tree *seed = rule->tree, *tree;
         struct path path;
-        struct vfsmount *mnt, *p;
-        struct list_head list;
+        struct vfsmount *mnt;
         int err;
 
         list_for_each_entry(tree, &tree_list, list) {
@@ -670,16 +655,9 @@ int audit_add_tree_rule(struct audit_krule *rule)
                 err = -ENOMEM;
                 goto Err;
         }
-        list_add_tail(&list, &mnt->mnt_list);
 
         get_tree(tree);
-        list_for_each_entry(p, &list, mnt_list) {
-                err = tag_chunk(p->mnt_root->d_inode, tree);
-                if (err)
-                        break;
-        }
-
-        list_del(&list);
+        err = iterate_mounts(tag_mount, tree, mnt);
         drop_collected_mounts(mnt);
 
         if (!err) {
@@ -714,31 +692,23 @@ int audit_tag_tree(char *old, char *new)
 {
         struct list_head cursor, barrier;
         int failed = 0;
-        struct path path;
+        struct path path1, path2;
         struct vfsmount *tagged;
-        struct list_head list;
-        struct vfsmount *mnt;
-        struct dentry *dentry;
         int err;
 
-        err = kern_path(new, 0, &path);
+        err = kern_path(new, 0, &path2);
         if (err)
                 return err;
-        tagged = collect_mounts(&path);
-        path_put(&path);
+        tagged = collect_mounts(&path2);
+        path_put(&path2);
         if (!tagged)
                 return -ENOMEM;
 
-        err = kern_path(old, 0, &path);
+        err = kern_path(old, 0, &path1);
         if (err) {
                 drop_collected_mounts(tagged);
                 return err;
         }
-        mnt = mntget(path.mnt);
-        dentry = dget(path.dentry);
-        path_put(&path);
-
-        list_add_tail(&list, &tagged->mnt_list);
 
         mutex_lock(&audit_filter_mutex);
         list_add(&barrier, &tree_list);
@@ -746,7 +716,7 @@ int audit_tag_tree(char *old, char *new)
 
         while (cursor.next != &tree_list) {
                 struct audit_tree *tree;
-                struct vfsmount *p;
+                int good_one = 0;
 
                 tree = container_of(cursor.next, struct audit_tree, list);
                 get_tree(tree);
@@ -754,30 +724,19 @@ int audit_tag_tree(char *old, char *new)
                 list_add(&cursor, &tree->list);
                 mutex_unlock(&audit_filter_mutex);
 
-                err = kern_path(tree->pathname, 0, &path);
-                if (err) {
-                        put_tree(tree);
-                        mutex_lock(&audit_filter_mutex);
-                        continue;
+                err = kern_path(tree->pathname, 0, &path2);
+                if (!err) {
+                        good_one = path_is_under(&path1, &path2);
+                        path_put(&path2);
                 }
 
-                spin_lock(&vfsmount_lock);
-                if (!is_under(mnt, dentry, &path)) {
-                        spin_unlock(&vfsmount_lock);
-                        path_put(&path);
+                if (!good_one) {
                         put_tree(tree);
                         mutex_lock(&audit_filter_mutex);
                         continue;
                 }
-                spin_unlock(&vfsmount_lock);
-                path_put(&path);
-
-                list_for_each_entry(p, &list, mnt_list) {
-                        failed = tag_chunk(p->mnt_root->d_inode, tree);
-                        if (failed)
-                                break;
-                }
 
+                failed = iterate_mounts(tag_mount, tree, tagged);
                 if (failed) {
                         put_tree(tree);
                         mutex_lock(&audit_filter_mutex);
@@ -818,10 +777,8 @@ int audit_tag_tree(char *old, char *new)
         }
         list_del(&barrier);
         list_del(&cursor);
-        list_del(&list);
         mutex_unlock(&audit_filter_mutex);
-        dput(dentry);
-        mntput(mnt);
+        path_put(&path1);
         drop_collected_mounts(tagged);
         return failed;
 }
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index cc7e87936cbc..8df43696f4ba 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -27,6 +27,7 @@
 #include <linux/namei.h>
 #include <linux/netlink.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/inotify.h>
 #include <linux/security.h>
 #include "audit.h"
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index a70604047f3c..ce08041f578d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -27,6 +27,7 @@
 #include <linux/namei.h>
 #include <linux/netlink.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/security.h>
 #include "audit.h"
 
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index fc0f928167e7..3828ad5fb8f1 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -49,6 +49,7 @@
 #include <linux/namei.h>
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/socket.h>
 #include <linux/mqueue.h>
@@ -1893,7 +1894,7 @@ static int audit_inc_name_count(struct audit_context *context,
 {
         if (context->name_count >= AUDIT_NAMES) {
                 if (inode)
-                        printk(KERN_DEBUG "name_count maxed, losing inode data: "
+                        printk(KERN_DEBUG "audit: name_count maxed, losing inode data: "
                                "dev=%02x:%02x, inode=%lu\n",
                                MAJOR(inode->i_sb->s_dev),
                                MINOR(inode->i_sb->s_dev),
@@ -1988,7 +1989,6 @@ void __audit_inode(const char *name, const struct dentry *dentry)
 
 /**
  * audit_inode_child - collect inode info for created/removed objects
- * @dname: inode's dentry name
  * @dentry: dentry being audited
  * @parent: inode of dentry parent
  *
@@ -2000,13 +2000,14 @@ void __audit_inode(const char *name, const struct dentry *dentry)
  * must be hooked prior, in order to capture the target inode during
  * unsuccessful attempts.
  */
-void __audit_inode_child(const char *dname, const struct dentry *dentry,
+void __audit_inode_child(const struct dentry *dentry,
                          const struct inode *parent)
 {
         int idx;
         struct audit_context *context = current->audit_context;
         const char *found_parent = NULL, *found_child = NULL;
         const struct inode *inode = dentry->d_inode;
+        const char *dname = dentry->d_name.name;
         int dirlen = 0;
 
         if (!context->in_syscall)
@@ -2014,9 +2015,6 @@ void __audit_inode_child(const char *dname, const struct dentry *dentry,
 
         if (inode)
                 handle_one(inode);
-        /* determine matching parent */
-        if (!dname)
-                goto add_names;
 
         /* parent is more likely, look for it first */
         for (idx = 0; idx < context->name_count; idx++) {
diff --git a/kernel/capability.c b/kernel/capability.c
index 7f876e60521f..2f05303715a5 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -15,7 +15,6 @@
 #include <linux/syscalls.h>
 #include <linux/pid_namespace.h>
 #include <asm/uaccess.h>
-#include "cred-internals.h"
 
 /*
  * Leveraged for setting/resetting capabilities
@@ -135,7 +134,7 @@ static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
         if (pid && (pid != task_pid_vnr(current))) {
                 struct task_struct *target;
 
-                read_lock(&tasklist_lock);
+                rcu_read_lock();
 
                 target = find_task_by_vpid(pid);
                 if (!target)
@@ -143,7 +142,7 @@ static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
                 else
                         ret = security_capget(target, pEp, pIp, pPp);
 
-                read_unlock(&tasklist_lock);
+                rcu_read_unlock();
         } else
                 ret = security_capget(current, pEp, pIp, pPp);
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 4fd90e129772..e9ec642932ee 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4,6 +4,10 @@
  *  Based originally on the cpuset system, extracted by Paul Menage
  *  Copyright (C) 2006 Google, Inc
  *
+ *  Notifications support
+ *  Copyright (C) 2009 Nokia Corporation
+ *  Author: Kirill A. Shutemov
+ *
  *  Copyright notices from the original cpuset code:
  *  --------------------------------------------------
  *  Copyright (C) 2003 BULL SA.
@@ -23,7 +27,6 @@
  */
 
 #include <linux/cgroup.h>
-#include <linux/module.h>
 #include <linux/ctype.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
@@ -44,6 +47,7 @@
 #include <linux/string.h>
 #include <linux/sort.h>
 #include <linux/kmod.h>
+#include <linux/module.h>
 #include <linux/delayacct.h>
 #include <linux/cgroupstats.h>
 #include <linux/hash.h>
@@ -52,15 +56,21 @@
 #include <linux/pid_namespace.h>
 #include <linux/idr.h>
 #include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
+#include <linux/eventfd.h>
+#include <linux/poll.h>
 
 #include <asm/atomic.h>
 
 static DEFINE_MUTEX(cgroup_mutex);
 
-/* Generate an array of cgroup subsystem pointers */
+/*
+ * Generate an array of cgroup subsystem pointers. At boot time, this is
+ * populated up to CGROUP_BUILTIN_SUBSYS_COUNT, and modular subsystems are
+ * registered after that. The mutable section of this array is protected by
+ * cgroup_mutex.
+ */
 #define SUBSYS(_x) &_x ## _subsys,
-
-static struct cgroup_subsys *subsys[] = {
+static struct cgroup_subsys *subsys[CGROUP_SUBSYS_COUNT] = {
 #include <linux/cgroup_subsys.h>
 };
 
@@ -147,6 +157,35 @@ struct css_id {
         unsigned short stack[0]; /* Array of Length (depth+1) */
 };
 
+/*
+ * cgroup_event represents events which userspace want to recieve.
+ */
+struct cgroup_event {
+        /*
+         * Cgroup which the event belongs to.
+         */
+        struct cgroup *cgrp;
+        /*
+         * Control file which the event associated.
+         */
+        struct cftype *cft;
+        /*
+         * eventfd to signal userspace about the event.
+         */
+        struct eventfd_ctx *eventfd;
+        /*
+         * Each of these stored in a list by the cgroup.
+         */
+        struct list_head list;
+        /*
+         * All fields below needed to unregister event when
+         * userspace closes eventfd.
+         */
+        poll_table pt;
+        wait_queue_head_t *wqh;
+        wait_queue_t wait;
+        struct work_struct remove;
+};
 
 /* The list of hierarchy roots */
 
@@ -250,7 +289,8 @@ struct cg_cgroup_link {
 static struct css_set init_css_set;
 static struct cg_cgroup_link init_css_set_link;
 
-static int cgroup_subsys_init_idr(struct cgroup_subsys *ss);
+static int cgroup_init_idr(struct cgroup_subsys *ss,
+                           struct cgroup_subsys_state *css);
 
 /* css_set_lock protects the list of css_set objects, and the
  * chain of tasks off each css_set.  Nests outside task->alloc_lock
@@ -448,8 +488,11 @@ static struct css_set *find_existing_css_set(
         struct hlist_node *node;
         struct css_set *cg;
 
-        /* Built the set of subsystem state objects that we want to
-         * see in the new css_set */
+        /*
+         * Build the set of subsystem state objects that we want to see in the
+         * new css_set. while subsystems can change globally, the entries here
+         * won't change, so no need for locking.
+         */
         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                 if (root->subsys_bits & (1UL << i)) {
                         /* Subsystem is in this hierarchy. So we want
@@ -696,6 +739,7 @@ void cgroup_lock(void)
 {
         mutex_lock(&cgroup_mutex);
 }
+EXPORT_SYMBOL_GPL(cgroup_lock);
 
 /**
  * cgroup_unlock - release lock on cgroup changes
@@ -706,6 +750,7 @@ void cgroup_unlock(void)
 {
         mutex_unlock(&cgroup_mutex);
 }
+EXPORT_SYMBOL_GPL(cgroup_unlock);
 
 /*
  * A couple of forward declarations required, due to cyclic reference loop:
@@ -757,6 +802,7 @@ static int cgroup_call_pre_destroy(struct cgroup *cgrp)
                         if (ret)
                                 break;
                 }
+
         return ret;
 }
 
@@ -884,7 +930,11 @@ void cgroup_release_and_wakeup_rmdir(struct cgroup_subsys_state *css)
         css_put(css);
 }
 
-
+/*
+ * Call with cgroup_mutex held. Drops reference counts on modules, including
+ * any duplicate ones that parse_cgroupfs_options took. If this function
+ * returns an error, no reference counts are touched.
+ */
 static int rebind_subsystems(struct cgroupfs_root *root,
                               unsigned long final_bits)
 {
@@ -892,6 +942,8 @@ static int rebind_subsystems(struct cgroupfs_root *root,
         struct cgroup *cgrp = &root->top_cgroup;
         int i;
 
+        BUG_ON(!mutex_is_locked(&cgroup_mutex));
+
         removed_bits = root->actual_subsys_bits & ~final_bits;
         added_bits = final_bits & ~root->actual_subsys_bits;
         /* Check that any added subsystems are currently free */
@@ -900,6 +952,12 @@ static int rebind_subsystems(struct cgroupfs_root *root,
                 struct cgroup_subsys *ss = subsys[i];
                 if (!(bit & added_bits))
                         continue;
+                /*
+                 * Nobody should tell us to do a subsys that doesn't exist:
+                 * parse_cgroupfs_options should catch that case and refcounts
+                 * ensure that subsystems won't disappear once selected.
+                 */
+                BUG_ON(ss == NULL);
                 if (ss->root != &rootnode) {
                         /* Subsystem isn't free */
                         return -EBUSY;
@@ -919,6 +977,7 @@ static int rebind_subsystems(struct cgroupfs_root *root,
                 unsigned long bit = 1UL << i;
                 if (bit & added_bits) {
                         /* We're binding this subsystem to this hierarchy */
+                        BUG_ON(ss == NULL);
                         BUG_ON(cgrp->subsys[i]);
                         BUG_ON(!dummytop->subsys[i]);
                         BUG_ON(dummytop->subsys[i]->cgroup != dummytop);
@@ -930,8 +989,10 @@ static int rebind_subsystems(struct cgroupfs_root *root,
                         if (ss->bind)
                                 ss->bind(ss, cgrp);
                         mutex_unlock(&ss->hierarchy_mutex);
+                        /* refcount was already taken, and we're keeping it */
                 } else if (bit & removed_bits) {
                         /* We're removing this subsystem */
+                        BUG_ON(ss == NULL);
                         BUG_ON(cgrp->subsys[i] != dummytop->subsys[i]);
                         BUG_ON(cgrp->subsys[i]->cgroup != cgrp);
                         mutex_lock(&ss->hierarchy_mutex);
@@ -942,9 +1003,20 @@ static int rebind_subsystems(struct cgroupfs_root *root,
                         subsys[i]->root = &rootnode;
                         list_move(&ss->sibling, &rootnode.subsys_list);
                         mutex_unlock(&ss->hierarchy_mutex);
+                        /* subsystem is now free - drop reference on module */
+                        module_put(ss->module);
                 } else if (bit & final_bits) {
                         /* Subsystem state should already exist */
+                        BUG_ON(ss == NULL);
                         BUG_ON(!cgrp->subsys[i]);
+                        /*
+                         * a refcount was taken, but we already had one, so
+                         * drop the extra reference.
+                         */
+                        module_put(ss->module);
+#ifdef CONFIG_MODULE_UNLOAD
+                        BUG_ON(ss->module && !module_refcount(ss->module));
+#endif
                 } else {
                         /* Subsystem state shouldn't exist */
                         BUG_ON(cgrp->subsys[i]);
@@ -986,13 +1058,20 @@ struct cgroup_sb_opts {
 
 };
 
-/* Convert a hierarchy specifier into a bitmask of subsystems and
- * flags. */
-static int parse_cgroupfs_options(char *data,
-                                     struct cgroup_sb_opts *opts)
+/*
+ * Convert a hierarchy specifier into a bitmask of subsystems and flags. Call
+ * with cgroup_mutex held to protect the subsys[] array. This function takes
+ * refcounts on subsystems to be used, unless it returns error, in which case
+ * no refcounts are taken.
+ */
+static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
 {
         char *token, *o = data ?: "all";
         unsigned long mask = (unsigned long)-1;
+        int i;
+        bool module_pin_failed = false;
+
+        BUG_ON(!mutex_is_locked(&cgroup_mutex));
 
 #ifdef CONFIG_CPUSETS
         mask = ~(1UL << cpuset_subsys_id);
@@ -1005,10 +1084,11 @@ static int parse_cgroupfs_options(char *data,
                         return -EINVAL;
                 if (!strcmp(token, "all")) {
                         /* Add all non-disabled subsystems */
-                        int i;
                         opts->subsys_bits = 0;
                         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                                 struct cgroup_subsys *ss = subsys[i];
+                                if (ss == NULL)
+                                        continue;
                                 if (!ss->disabled)
                                         opts->subsys_bits |= 1ul << i;
                         }
@@ -1026,7 +1106,6 @@ static int parse_cgroupfs_options(char *data,
                         if (!opts->release_agent)
                                 return -ENOMEM;
                 } else if (!strncmp(token, "name=", 5)) {
-                        int i;
                         const char *name = token + 5;
                         /* Can't specify an empty name */
                         if (!strlen(name))
@@ -1050,9 +1129,10 @@ static int parse_cgroupfs_options(char *data,
                                 return -ENOMEM;
                 } else {
                         struct cgroup_subsys *ss;
-                        int i;
                         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                                 ss = subsys[i];
+                                if (ss == NULL)
+                                        continue;
                                 if (!strcmp(token, ss->name)) {
                                         if (!ss->disabled)
                                                 set_bit(i, &opts->subsys_bits);
@@ -1087,9 +1167,54 @@ static int parse_cgroupfs_options(char *data,
         if (!opts->subsys_bits && !opts->name)
                 return -EINVAL;
 
+        /*
+         * Grab references on all the modules we'll need, so the subsystems
+         * don't dance around before rebind_subsystems attaches them. This may
+         * take duplicate reference counts on a subsystem that's already used,
+         * but rebind_subsystems handles this case.
+         */
+        for (i = CGROUP_BUILTIN_SUBSYS_COUNT; i < CGROUP_SUBSYS_COUNT; i++) {
+                unsigned long bit = 1UL << i;
+
+                if (!(bit & opts->subsys_bits))
+                        continue;
+                if (!try_module_get(subsys[i]->module)) {
+                        module_pin_failed = true;
+                        break;
+                }
+        }
+        if (module_pin_failed) {
+                /*
+                 * oops, one of the modules was going away. this means that we
+                 * raced with a module_delete call, and to the user this is
+                 * essentially a "subsystem doesn't exist" case.
+                 */
+                for (i--; i >= CGROUP_BUILTIN_SUBSYS_COUNT; i--) {
+                        /* drop refcounts only on the ones we took */
+                        unsigned long bit = 1UL << i;
+
+                        if (!(bit & opts->subsys_bits))
+                                continue;
+                        module_put(subsys[i]->module);
+                }
+                return -ENOENT;
+        }
+
         return 0;
 }
 
+static void drop_parsed_module_refcounts(unsigned long subsys_bits)
+{
+        int i;
+        for (i = CGROUP_BUILTIN_SUBSYS_COUNT; i < CGROUP_SUBSYS_COUNT; i++) {
+                unsigned long bit = 1UL << i;
+
+                if (!(bit & subsys_bits))
+                        continue;
+                module_put(subsys[i]->module);
+        }
+}
+
 static int cgroup_remount(struct super_block *sb, int *flags, char *data)
 {
         int ret = 0;
@@ -1106,21 +1231,19 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
         if (ret)
                 goto out_unlock;
 
-        /* Don't allow flags to change at remount */
-        if (opts.flags != root->flags) {
-                ret = -EINVAL;
-                goto out_unlock;
-        }
-
-        /* Don't allow name to change at remount */
-        if (opts.name && strcmp(opts.name, root->name)) {
+        /* Don't allow flags or name to change at remount */
+        if (opts.flags != root->flags ||
+            (opts.name && strcmp(opts.name, root->name))) {
                 ret = -EINVAL;
+                drop_parsed_module_refcounts(opts.subsys_bits);
                 goto out_unlock;
         }
 
         ret = rebind_subsystems(root, opts.subsys_bits);
-        if (ret)
+        if (ret) {
+                drop_parsed_module_refcounts(opts.subsys_bits);
                 goto out_unlock;
+        }
 
         /* (re)populate subsystem files */
         cgroup_populate_dir(cgrp);
@@ -1151,6 +1274,8 @@ static void init_cgroup_housekeeping(struct cgroup *cgrp)
         INIT_LIST_HEAD(&cgrp->release_list);
         INIT_LIST_HEAD(&cgrp->pidlists);
         mutex_init(&cgrp->pidlist_mutex);
+        INIT_LIST_HEAD(&cgrp->event_list);
+        spin_lock_init(&cgrp->event_list_lock);
 }
 
 static void init_cgroup_root(struct cgroupfs_root *root)
@@ -1306,7 +1431,9 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
         struct cgroupfs_root *new_root;
 
         /* First find the desired set of subsystems */
+        mutex_lock(&cgroup_mutex);
         ret = parse_cgroupfs_options(data, &opts);
+        mutex_unlock(&cgroup_mutex);
         if (ret)
                 goto out_err;
 
@@ -1317,7 +1444,7 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
         new_root = cgroup_root_from_opts(&opts);
         if (IS_ERR(new_root)) {
                 ret = PTR_ERR(new_root);
-                goto out_err;
+                goto drop_modules;
         }
         opts.new_root = new_root;
 
@@ -1326,7 +1453,7 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
         if (IS_ERR(sb)) {
                 ret = PTR_ERR(sb);
                 cgroup_drop_root(opts.new_root);
-                goto out_err;
+                goto drop_modules;
         }
 
         root = sb->s_fs_info;
@@ -1382,6 +1509,11 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                         free_cg_links(&tmp_cg_links);
                         goto drop_new_super;
                 }
+                /*
+                 * There must be no failure case after here, since rebinding
+                 * takes care of subsystems' refcounts, which are explicitly
+                 * dropped in the failure exit path.
+                 */
 
                 /* EBUSY should be the only error here */
                 BUG_ON(ret);
@@ -1420,6 +1552,8 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                  * any) is not needed
                  */
                 cgroup_drop_root(opts.new_root);
+                /* no subsys rebinding, so refcounts don't change */
+                drop_parsed_module_refcounts(opts.subsys_bits);
         }
 
         simple_set_mnt(mnt, sb);
@@ -1429,6 +1563,8 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
 
  drop_new_super:
         deactivate_locked_super(sb);
+ drop_modules:
+        drop_parsed_module_refcounts(opts.subsys_bits);
  out_err:
         kfree(opts.release_agent);
         kfree(opts.name);
@@ -1510,7 +1646,9 @@ static inline struct cftype *__d_cft(struct dentry *dentry)
 int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
 {
         char *start;
-        struct dentry *dentry = rcu_dereference(cgrp->dentry);
+        struct dentry *dentry = rcu_dereference_check(cgrp->dentry,
+                                                      rcu_read_lock_held() ||
+                                                      cgroup_lock_is_held());
 
         if (!dentry || cgrp == dummytop) {
                 /*
@@ -1526,13 +1664,17 @@ int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
         *--start = '\0';
         for (;;) {
                 int len = dentry->d_name.len;
+
                 if ((start -= len) < buf)
                         return -ENAMETOOLONG;
-                memcpy(start, cgrp->dentry->d_name.name, len);
+                memcpy(start, dentry->d_name.name, len);
                 cgrp = cgrp->parent;
                 if (!cgrp)
                         break;
-                dentry = rcu_dereference(cgrp->dentry);
+
+                dentry = rcu_dereference_check(cgrp->dentry,
+                                               rcu_read_lock_held() ||
+                                               cgroup_lock_is_held());
                 if (!cgrp->parent)
                         continue;
                 if (--start < buf)
@@ -1542,6 +1684,7 @@ int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
         memmove(buf, start, buf + buflen - start);
         return 0;
 }
+EXPORT_SYMBOL_GPL(cgroup_path);
 
 /**
  * cgroup_attach_task - attach task 'tsk' to cgroup 'cgrp'
@@ -1554,7 +1697,7 @@ int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
 int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
 {
         int retval = 0;
-        struct cgroup_subsys *ss;
+        struct cgroup_subsys *ss, *failed_ss = NULL;
         struct cgroup *oldcgrp;
         struct css_set *cg;
         struct css_set *newcg;
@@ -1568,8 +1711,16 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
         for_each_subsys(root, ss) {
                 if (ss->can_attach) {
                         retval = ss->can_attach(ss, cgrp, tsk, false);
-                        if (retval)
-                                return retval;
+                        if (retval) {
+                                /*
+                                 * Remember on which subsystem the can_attach()
+                                 * failed, so that we only call cancel_attach()
+                                 * against the subsystems whose can_attach()
+                                 * succeeded. (See below)
+                                 */
+                                failed_ss = ss;
+                                goto out;
+                        }
                 }
         }
 
@@ -1583,14 +1734,17 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
          */
         newcg = find_css_set(cg, cgrp);
         put_css_set(cg);
-        if (!newcg)
-                return -ENOMEM;
+        if (!newcg) {
+                retval = -ENOMEM;
+                goto out;
+        }
 
         task_lock(tsk);
         if (tsk->flags & PF_EXITING) {
                 task_unlock(tsk);
                 put_css_set(newcg);
-                return -ESRCH;
+                retval = -ESRCH;
+                goto out;
         }
         rcu_assign_pointer(tsk->cgroups, newcg);
         task_unlock(tsk);
@@ -1616,7 +1770,22 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
          * is no longer empty.
          */
         cgroup_wakeup_rmdir_waiter(cgrp);
-        return 0;
+out:
+        if (retval) {
+                for_each_subsys(root, ss) {
+                        if (ss == failed_ss)
+                                /*
+                                 * This subsystem was the one that failed the
+                                 * can_attach() check earlier, so we don't need
+                                 * to call cancel_attach() against it or any
+                                 * remaining subsystems.
+                                 */
+                                break;
+                        if (ss->cancel_attach)
+                                ss->cancel_attach(ss, cgrp, tsk, false);
+                }
+        }
+        return retval;
 }
 
 /*
@@ -1682,6 +1851,7 @@ bool cgroup_lock_live_group(struct cgroup *cgrp)
         }
         return true;
 }
+EXPORT_SYMBOL_GPL(cgroup_lock_live_group);
 
 static int cgroup_release_agent_write(struct cgroup *cgrp, struct cftype *cft,
                                       const char *buffer)
@@ -1950,6 +2120,16 @@ static const struct inode_operations cgroup_dir_inode_operations = {
         .rename = cgroup_rename,
 };
 
+/*
+ * Check if a file is a control file
+ */
+static inline struct cftype *__file_cft(struct file *file)
+{
+        if (file->f_dentry->d_inode->i_fop != &cgroup_file_operations)
+                return ERR_PTR(-EINVAL);
+        return __d_cft(file->f_dentry);
+}
+
 static int cgroup_create_file(struct dentry *dentry, mode_t mode,
                                 struct super_block *sb)
 {
@@ -2069,6 +2249,7 @@ int cgroup_add_file(struct cgroup *cgrp,
                 error = PTR_ERR(dentry);
         return error;
 }
+EXPORT_SYMBOL_GPL(cgroup_add_file);
 
 int cgroup_add_files(struct cgroup *cgrp,
                         struct cgroup_subsys *subsys,
@@ -2083,6 +2264,7 @@ int cgroup_add_files(struct cgroup *cgrp,
         }
         return 0;
 }
+EXPORT_SYMBOL_GPL(cgroup_add_files);
 
 /**
  * cgroup_task_count - count the number of tasks in a cgroup.
@@ -2468,7 +2650,8 @@ static struct cgroup_pidlist *cgroup_pidlist_find(struct cgroup *cgrp,
 {
         struct cgroup_pidlist *l;
         /* don't need task_nsproxy() if we're looking at ourself */
-        struct pid_namespace *ns = get_pid_ns(current->nsproxy->pid_ns);
+        struct pid_namespace *ns = current->nsproxy->pid_ns;
+
         /*
          * We can't drop the pidlist_mutex before taking the l->mutex in case
          * the last ref-holder is trying to remove l from the list at the same
@@ -2478,8 +2661,6 @@ static struct cgroup_pidlist *cgroup_pidlist_find(struct cgroup *cgrp,
         mutex_lock(&cgrp->pidlist_mutex);
         list_for_each_entry(l, &cgrp->pidlists, links) {
                 if (l->key.type == type && l->key.ns == ns) {
-                        /* found a matching list - drop the extra refcount */
-                        put_pid_ns(ns);
                         /* make sure l doesn't vanish out from under us */
                         down_write(&l->mutex);
                         mutex_unlock(&cgrp->pidlist_mutex);
@@ -2490,13 +2671,12 @@ static struct cgroup_pidlist *cgroup_pidlist_find(struct cgroup *cgrp,
         l = kmalloc(sizeof(struct cgroup_pidlist), GFP_KERNEL);
         if (!l) {
                 mutex_unlock(&cgrp->pidlist_mutex);
-                put_pid_ns(ns);
                 return l;
         }
         init_rwsem(&l->mutex);
         down_write(&l->mutex);
         l->key.type = type;
-        l->key.ns = ns;
+        l->key.ns = get_pid_ns(ns);
         l->use_count = 0; /* don't increment here */
         l->list = NULL;
         l->owner = cgrp;
@@ -2804,6 +2984,174 @@ static int cgroup_write_notify_on_release(struct cgroup *cgrp,
 }
 
 /*
+ * Unregister event and free resources.
+ *
+ * Gets called from workqueue.
+ */
+static void cgroup_event_remove(struct work_struct *work)
+{
+        struct cgroup_event *event = container_of(work, struct cgroup_event,
+                        remove);
+        struct cgroup *cgrp = event->cgrp;
+
+        /* TODO: check return code */
+        event->cft->unregister_event(cgrp, event->cft, event->eventfd);
+
+        eventfd_ctx_put(event->eventfd);
+        kfree(event);
+        dput(cgrp->dentry);
+}
+
+/*
+ * Gets called on POLLHUP on eventfd when user closes it.
+ *
+ * Called with wqh->lock held and interrupts disabled.
+ */
+static int cgroup_event_wake(wait_queue_t *wait, unsigned mode,
+                int sync, void *key)
+{
+        struct cgroup_event *event = container_of(wait,
+                        struct cgroup_event, wait);
+        struct cgroup *cgrp = event->cgrp;
+        unsigned long flags = (unsigned long)key;
+
+        if (flags & POLLHUP) {
+                __remove_wait_queue(event->wqh, &event->wait);
+                spin_lock(&cgrp->event_list_lock);
+                list_del(&event->list);
+                spin_unlock(&cgrp->event_list_lock);
+                /*
+                 * We are in atomic context, but cgroup_event_remove() may
+                 * sleep, so we have to call it in workqueue.
+                 */
+                schedule_work(&event->remove);
+        }
+
+        return 0;
+}
+
+static void cgroup_event_ptable_queue_proc(struct file *file,
+                wait_queue_head_t *wqh, poll_table *pt)
+{
+        struct cgroup_event *event = container_of(pt,
+                        struct cgroup_event, pt);
+
+        event->wqh = wqh;
+        add_wait_queue(wqh, &event->wait);
+}
+
+/*
+ * Parse input and register new cgroup event handler.
+ *
+ * Input must be in format '<event_fd> <control_fd> <args>'.
+ * Interpretation of args is defined by control file implementation.
+ */
+static int cgroup_write_event_control(struct cgroup *cgrp, struct cftype *cft,
+                                      const char *buffer)
+{
+        struct cgroup_event *event = NULL;
+        unsigned int efd, cfd;
+        struct file *efile = NULL;
+        struct file *cfile = NULL;
+        char *endp;
+        int ret;
+
+        efd = simple_strtoul(buffer, &endp, 10);
+        if (*endp != ' ')
+                return -EINVAL;
+        buffer = endp + 1;
+
+        cfd = simple_strtoul(buffer, &endp, 10);
+        if ((*endp != ' ') && (*endp != '\0'))
+                return -EINVAL;
+        buffer = endp + 1;
+
+        event = kzalloc(sizeof(*event), GFP_KERNEL);
+        if (!event)
+                return -ENOMEM;
+        event->cgrp = cgrp;
+        INIT_LIST_HEAD(&event->list);
+        init_poll_funcptr(&event->pt, cgroup_event_ptable_queue_proc);
+        init_waitqueue_func_entry(&event->wait, cgroup_event_wake);
+        INIT_WORK(&event->remove, cgroup_event_remove);
+
+        efile = eventfd_fget(efd);
+        if (IS_ERR(efile)) {
+                ret = PTR_ERR(efile);
+                goto fail;
+        }
+
+        event->eventfd = eventfd_ctx_fileget(efile);
+        if (IS_ERR(event->eventfd)) {
+                ret = PTR_ERR(event->eventfd);
+                goto fail;
+        }
+
+        cfile = fget(cfd);
+        if (!cfile) {
+                ret = -EBADF;
+                goto fail;
+        }
+
+        /* the process need read permission on control file */
+        ret = file_permission(cfile, MAY_READ);
+        if (ret < 0)
+                goto fail;
+
+        event->cft = __file_cft(cfile);
+        if (IS_ERR(event->cft)) {
+                ret = PTR_ERR(event->cft);
+                goto fail;
+        }
+
+        if (!event->cft->register_event || !event->cft->unregister_event) {
+                ret = -EINVAL;
+                goto fail;
+        }
+
+        ret = event->cft->register_event(cgrp, event->cft,
+                        event->eventfd, buffer);
+        if (ret)
+                goto fail;
+
+        if (efile->f_op->poll(efile, &event->pt) & POLLHUP) {
+                event->cft->unregister_event(cgrp, event->cft, event->eventfd);
+                ret = 0;
+                goto fail;
+        }
+
+        /*
+         * Events should be removed after rmdir of cgroup directory, but before
+         * destroying subsystem state objects. Let's take reference to cgroup
+         * directory dentry to do that.
+         */
+        dget(cgrp->dentry);
+
+        spin_lock(&cgrp->event_list_lock);
+        list_add(&event->list, &cgrp->event_list);
+        spin_unlock(&cgrp->event_list_lock);
+
+        fput(cfile);
+        fput(efile);
+
+        return 0;
+
+fail:
+        if (cfile)
+                fput(cfile);
+
+        if (event && event->eventfd && !IS_ERR(event->eventfd))
+                eventfd_ctx_put(event->eventfd);
+
+        if (!IS_ERR_OR_NULL(efile))
+                fput(efile);
+
+        kfree(event);
+
+        return ret;
+}
+
+/*
  * for the common functions, 'private' gives the type of file
  */
 /* for hysterical raisins, we can't put this on the older files */
@@ -2828,6 +3176,11 @@ static struct cftype files[] = {
                 .read_u64 = cgroup_read_notify_on_release,
                 .write_u64 = cgroup_write_notify_on_release,
         },
+        {
+                .name = CGROUP_FILE_GENERIC_PREFIX "event_control",
+                .write_string = cgroup_write_event_control,
+                .mode = S_IWUGO,
+        },
 };
 
 static struct cftype cft_release_agent = {
@@ -2892,8 +3245,14 @@ static void cgroup_lock_hierarchy(struct cgroupfs_root *root)
         /* We need to take each hierarchy_mutex in a consistent order */
         int i;
 
+        /*
+         * No worry about a race with rebind_subsystems that might mess up the
+         * locking order, since both parties are under cgroup_mutex.
+         */
         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
+                if (ss == NULL)
+                        continue;
                 if (ss->root == root)
                         mutex_lock(&ss->hierarchy_mutex);
         }
@@ -2905,6 +3264,8 @@ static void cgroup_unlock_hierarchy(struct cgroupfs_root *root)
 
         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
+                if (ss == NULL)
+                        continue;
                 if (ss->root == root)
                         mutex_unlock(&ss->hierarchy_mutex);
         }
@@ -3028,11 +3389,16 @@ static int cgroup_has_css_refs(struct cgroup *cgrp)
          * synchronization other than RCU, and the subsystem linked
          * list isn't RCU-safe */
         int i;
+        /*
+         * We won't need to lock the subsys array, because the subsystems
+         * we're concerned about aren't going anywhere since our cgroup root
+         * has a reference on them.
+         */
         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
                 struct cgroup_subsys_state *css;
-                /* Skip subsystems not in this hierarchy */
-                if (ss->root != cgrp->root)
+                /* Skip subsystems not present or not in this hierarchy */
+                if (ss == NULL || ss->root != cgrp->root)
                         continue;
                 css = cgrp->subsys[ss->subsys_id];
                 /* When called from check_for_release() it's possible
@@ -3106,6 +3472,7 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
         struct dentry *d;
         struct cgroup *parent;
         DEFINE_WAIT(wait);
+        struct cgroup_event *event, *tmp;
         int ret;
 
         /* the vfs holds both inode->i_mutex already */
@@ -3189,6 +3556,20 @@ again:
         set_bit(CGRP_RELEASABLE, &parent->flags);
         check_for_release(parent);
 
+        /*
+         * Unregister events and notify userspace.
+         * Notify userspace about cgroup removing only after rmdir of cgroup
+         * directory to avoid race between userspace and kernelspace
+         */
+        spin_lock(&cgrp->event_list_lock);
+        list_for_each_entry_safe(event, tmp, &cgrp->event_list, list) {
+                list_del(&event->list);
+                remove_wait_queue(event->wqh, &event->wait);
+                eventfd_signal(event->eventfd, 1);
+                schedule_work(&event->remove);
+        }
+        spin_unlock(&cgrp->event_list_lock);
+
         mutex_unlock(&cgroup_mutex);
         return 0;
 }
@@ -3223,7 +3604,196 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
         mutex_init(&ss->hierarchy_mutex);
         lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
         ss->active = 1;
+
+        /* this function shouldn't be used with modular subsystems, since they
+         * need to register a subsys_id, among other things */
+        BUG_ON(ss->module);
+}
+
+/**
+ * cgroup_load_subsys: load and register a modular subsystem at runtime
+ * @ss: the subsystem to load
+ *
+ * This function should be called in a modular subsystem's initcall. If the
+ * subsytem is built as a module, it will be assigned a new subsys_id and set
+ * up for use. If the subsystem is built-in anyway, work is delegated to the
+ * simpler cgroup_init_subsys.
+ */
+int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
+{
+        int i;
+        struct cgroup_subsys_state *css;
+
+        /* check name and function validity */
+        if (ss->name == NULL || strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN ||
+            ss->create == NULL || ss->destroy == NULL)
+                return -EINVAL;
+
+        /*
+         * we don't support callbacks in modular subsystems. this check is
+         * before the ss->module check for consistency; a subsystem that could
+         * be a module should still have no callbacks even if the user isn't
+         * compiling it as one.
+         */
+        if (ss->fork || ss->exit)
+                return -EINVAL;
+
+        /*
+         * an optionally modular subsystem is built-in: we want to do nothing,
+         * since cgroup_init_subsys will have already taken care of it.
+         */
+        if (ss->module == NULL) {
+                /* a few sanity checks */
+                BUG_ON(ss->subsys_id >= CGROUP_BUILTIN_SUBSYS_COUNT);
+                BUG_ON(subsys[ss->subsys_id] != ss);
+                return 0;
+        }
+
+        /*
+         * need to register a subsys id before anything else - for example,
+         * init_cgroup_css needs it.
+         */
+        mutex_lock(&cgroup_mutex);
+        /* find the first empty slot in the array */
+        for (i = CGROUP_BUILTIN_SUBSYS_COUNT; i < CGROUP_SUBSYS_COUNT; i++) {
+                if (subsys[i] == NULL)
+                        break;
+        }
+        if (i == CGROUP_SUBSYS_COUNT) {
+                /* maximum number of subsystems already registered! */
+                mutex_unlock(&cgroup_mutex);
+                return -EBUSY;
+        }
+        /* assign ourselves the subsys_id */
+        ss->subsys_id = i;
+        subsys[i] = ss;
+
+        /*
+         * no ss->create seems to need anything important in the ss struct, so
+         * this can happen first (i.e. before the rootnode attachment).
+         */
+        css = ss->create(ss, dummytop);
+        if (IS_ERR(css)) {
+                /* failure case - need to deassign the subsys[] slot. */
+                subsys[i] = NULL;
+                mutex_unlock(&cgroup_mutex);
+                return PTR_ERR(css);
+        }
+
+        list_add(&ss->sibling, &rootnode.subsys_list);
+        ss->root = &rootnode;
+
+        /* our new subsystem will be attached to the dummy hierarchy. */
+        init_cgroup_css(css, ss, dummytop);
+        /* init_idr must be after init_cgroup_css because it sets css->id. */
+        if (ss->use_id) {
+                int ret = cgroup_init_idr(ss, css);
+                if (ret) {
+                        dummytop->subsys[ss->subsys_id] = NULL;
+                        ss->destroy(ss, dummytop);
+                        subsys[i] = NULL;
+                        mutex_unlock(&cgroup_mutex);
+                        return ret;
+                }
+        }
+
+        /*
+         * Now we need to entangle the css into the existing css_sets. unlike
+         * in cgroup_init_subsys, there are now multiple css_sets, so each one
+         * will need a new pointer to it; done by iterating the css_set_table.
+         * furthermore, modifying the existing css_sets will corrupt the hash
+         * table state, so each changed css_set will need its hash recomputed.
+         * this is all done under the css_set_lock.
+         */
+        write_lock(&css_set_lock);
+        for (i = 0; i < CSS_SET_TABLE_SIZE; i++) {
+                struct css_set *cg;
+                struct hlist_node *node, *tmp;
+                struct hlist_head *bucket = &css_set_table[i], *new_bucket;
+
+                hlist_for_each_entry_safe(cg, node, tmp, bucket, hlist) {
+                        /* skip entries that we already rehashed */
+                        if (cg->subsys[ss->subsys_id])
+                                continue;
+                        /* remove existing entry */
+                        hlist_del(&cg->hlist);
+                        /* set new value */
+                        cg->subsys[ss->subsys_id] = css;
+                        /* recompute hash and restore entry */
+                        new_bucket = css_set_hash(cg->subsys);
+                        hlist_add_head(&cg->hlist, new_bucket);
+                }
+        }
+        write_unlock(&css_set_lock);
+
+        mutex_init(&ss->hierarchy_mutex);
+        lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
+        ss->active = 1;
+
+        /* success! */
+        mutex_unlock(&cgroup_mutex);
+        return 0;
 }
+EXPORT_SYMBOL_GPL(cgroup_load_subsys);
+
+/**
+ * cgroup_unload_subsys: unload a modular subsystem
+ * @ss: the subsystem to unload
+ *
+ * This function should be called in a modular subsystem's exitcall. When this
+ * function is invoked, the refcount on the subsystem's module will be 0, so
+ * the subsystem will not be attached to any hierarchy.
+ */
+void cgroup_unload_subsys(struct cgroup_subsys *ss)
+{
+        struct cg_cgroup_link *link;
+        struct hlist_head *hhead;
+
+        BUG_ON(ss->module == NULL);
+
+        /*
+         * we shouldn't be called if the subsystem is in use, and the use of
+         * try_module_get in parse_cgroupfs_options should ensure that it
+         * doesn't start being used while we're killing it off.
+         */
+        BUG_ON(ss->root != &rootnode);
+
+        mutex_lock(&cgroup_mutex);
+        /* deassign the subsys_id */
+        BUG_ON(ss->subsys_id < CGROUP_BUILTIN_SUBSYS_COUNT);
+        subsys[ss->subsys_id] = NULL;
+
+        /* remove subsystem from rootnode's list of subsystems */
+        list_del(&ss->sibling);
+
+        /*
+         * disentangle the css from all css_sets attached to the dummytop. as
+         * in loading, we need to pay our respects to the hashtable gods.
+         */
+        write_lock(&css_set_lock);
+        list_for_each_entry(link, &dummytop->css_sets, cgrp_link_list) {
+                struct css_set *cg = link->cg;
+
+                hlist_del(&cg->hlist);
+                BUG_ON(!cg->subsys[ss->subsys_id]);
+                cg->subsys[ss->subsys_id] = NULL;
+                hhead = css_set_hash(cg->subsys);
+                hlist_add_head(&cg->hlist, hhead);
+        }
+        write_unlock(&css_set_lock);
+
+        /*
+         * remove subsystem's css from the dummytop and free it - need to free
+         * before marking as null because ss->destroy needs the cgrp->subsys
+         * pointer to find their state. note that this also takes care of
+         * freeing the css_id.
+         */
+        ss->destroy(ss, dummytop);
+        dummytop->subsys[ss->subsys_id] = NULL;
+
+        mutex_unlock(&cgroup_mutex);
+}
+EXPORT_SYMBOL_GPL(cgroup_unload_subsys);
 
 /**
  * cgroup_init_early - cgroup initialization at system boot
@@ -3253,7 +3823,8 @@ int __init cgroup_init_early(void)
         for (i = 0; i < CSS_SET_TABLE_SIZE; i++)
                 INIT_HLIST_HEAD(&css_set_table[i]);
 
-        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+        /* at bootup time, we don't worry about modular subsystems */
+        for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
 
                 BUG_ON(!ss->name);
@@ -3288,12 +3859,13 @@ int __init cgroup_init(void)
         if (err)
                 return err;
 
-        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+        /* at bootup time, we don't worry about modular subsystems */
+        for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
                 if (!ss->early_init)
                         cgroup_init_subsys(ss);
                 if (ss->use_id)
-                        cgroup_subsys_init_idr(ss);
+                        cgroup_init_idr(ss, init_css_set.subsys[ss->subsys_id]);
         }
 
         /* Add init_css_set to the hash table */
@@ -3397,9 +3969,16 @@ static int proc_cgroupstats_show(struct seq_file *m, void *v)
         int i;
 
         seq_puts(m, "#subsys_name\thierarchy\tnum_cgroups\tenabled\n");
+        /*
+         * ideally we don't want subsystems moving around while we do this.
+         * cgroup_mutex is also necessary to guarantee an atomic snapshot of
+         * subsys/hierarchy state.
+         */
         mutex_lock(&cgroup_mutex);
         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
+                if (ss == NULL)
+                        continue;
                 seq_printf(m, "%s\t%d\t%d\t%d\n",
                            ss->name, ss->root->hierarchy_id,
                            ss->root->number_of_cgroups, !ss->disabled);
@@ -3457,7 +4036,12 @@ void cgroup_fork_callbacks(struct task_struct *child)
 {
         if (need_forkexit_callback) {
                 int i;
-                for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+                /*
+                 * forkexit callbacks are only supported for builtin
+                 * subsystems, and the builtin section of the subsys array is
+                 * immutable, so we don't need to lock the subsys array here.
+                 */
+                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
                         struct cgroup_subsys *ss = subsys[i];
                         if (ss->fork)
                                 ss->fork(ss, child);
@@ -3526,7 +4110,11 @@ void cgroup_exit(struct task_struct *tsk, int run_callbacks)
         struct css_set *cg;
 
         if (run_callbacks && need_forkexit_callback) {
-                for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+                /*
+                 * modular subsystems can't use callbacks, so no need to lock
+                 * the subsys array
+                 */
+                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
                         struct cgroup_subsys *ss = subsys[i];
                         if (ss->exit)
                                 ss->exit(ss, tsk);
@@ -3720,12 +4308,13 @@ static void check_for_release(struct cgroup *cgrp)
         }
 }
 
-void __css_put(struct cgroup_subsys_state *css)
+/* Caller must verify that the css is not for root cgroup */
+void __css_put(struct cgroup_subsys_state *css, int count)
 {
         struct cgroup *cgrp = css->cgroup;
         int val;
         rcu_read_lock();
-        val = atomic_dec_return(&css->refcnt);
+        val = atomic_sub_return(count, &css->refcnt);
         if (val == 1) {
                 if (notify_on_release(cgrp)) {
                         set_bit(CGRP_RELEASABLE, &cgrp->flags);
@@ -3736,6 +4325,7 @@ void __css_put(struct cgroup_subsys_state *css)
         rcu_read_unlock();
         WARN_ON_ONCE(val < 1);
 }
+EXPORT_SYMBOL_GPL(__css_put);
 
 /*
  * Notify userspace when a cgroup is released, by running the
@@ -3817,8 +4407,11 @@ static int __init cgroup_disable(char *str)
         while ((token = strsep(&str, ",")) != NULL) {
                 if (!*token)
                         continue;
-
-                for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+                /*
+                 * cgroup_disable, being at boot time, can't know about module
+                 * subsystems, so we don't worry about them.
+                 */
+                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
                         struct cgroup_subsys *ss = subsys[i];
 
                         if (!strcmp(token, ss->name)) {
@@ -3842,31 +4435,65 @@ __setup("cgroup_disable=", cgroup_disable);
  */
 unsigned short css_id(struct cgroup_subsys_state *css)
 {
-        struct css_id *cssid = rcu_dereference(css->id);
+        struct css_id *cssid;
+
+        /*
+         * This css_id() can return correct value when somone has refcnt
+         * on this or this is under rcu_read_lock(). Once css->id is allocated,
+         * it's unchanged until freed.
+         */
+        cssid = rcu_dereference_check(css->id,
+                        rcu_read_lock_held() || atomic_read(&css->refcnt));
 
         if (cssid)
                 return cssid->id;
         return 0;
 }
+EXPORT_SYMBOL_GPL(css_id);
 
 unsigned short css_depth(struct cgroup_subsys_state *css)
 {
-        struct css_id *cssid = rcu_dereference(css->id);
+        struct css_id *cssid;
+
+        cssid = rcu_dereference_check(css->id,
+                        rcu_read_lock_held() || atomic_read(&css->refcnt));
 
         if (cssid)
                 return cssid->depth;
         return 0;
 }
+EXPORT_SYMBOL_GPL(css_depth);
+
+/**
+ *  css_is_ancestor - test "root" css is an ancestor of "child"
+ * @child: the css to be tested.
+ * @root: the css supporsed to be an ancestor of the child.
+ *
+ * Returns true if "root" is an ancestor of "child" in its hierarchy. Because
+ * this function reads css->id, this use rcu_dereference() and rcu_read_lock().
+ * But, considering usual usage, the csses should be valid objects after test.
+ * Assuming that the caller will do some action to the child if this returns
+ * returns true, the caller must take "child";s reference count.
+ * If "child" is valid object and this returns true, "root" is valid, too.
+ */
 
 bool css_is_ancestor(struct cgroup_subsys_state *child,
                     const struct cgroup_subsys_state *root)
 {
-        struct css_id *child_id = rcu_dereference(child->id);
-        struct css_id *root_id = rcu_dereference(root->id);
+        struct css_id *child_id;
+        struct css_id *root_id;
+        bool ret = true;
 
-        if (!child_id || !root_id || (child_id->depth < root_id->depth))
-                return false;
-        return child_id->stack[root_id->depth] == root_id->id;
+        rcu_read_lock();
+        child_id  = rcu_dereference(child->id);
+        root_id = rcu_dereference(root->id);
+        if (!child_id
+            || !root_id
+            || (child_id->depth < root_id->depth)
+            || (child_id->stack[root_id->depth] != root_id->id))
+                ret = false;
+        rcu_read_unlock();
+        return ret;
 }
 
 static void __free_css_id_cb(struct rcu_head *head)
@@ -3893,6 +4520,7 @@ void free_css_id(struct cgroup_subsys *ss, struct cgroup_subsys_state *css)
         spin_unlock(&ss->id_lock);
         call_rcu(&id->rcu_head, __free_css_id_cb);
 }
+EXPORT_SYMBOL_GPL(free_css_id);
 
 /*
  * This is called by init or create(). Then, calls to this function are
@@ -3942,15 +4570,14 @@ err_out:
 
 }
 
-static int __init cgroup_subsys_init_idr(struct cgroup_subsys *ss)
+static int __init_or_module cgroup_init_idr(struct cgroup_subsys *ss,
+                                            struct cgroup_subsys_state *rootcss)
 {
         struct css_id *newid;
-        struct cgroup_subsys_state *rootcss;
 
         spin_lock_init(&ss->id_lock);
         idr_init(&ss->idr);
 
-        rootcss = init_css_set.subsys[ss->subsys_id];
         newid = get_new_cssid(ss, 0);
         if (IS_ERR(newid))
                 return PTR_ERR(newid);
@@ -3966,13 +4593,13 @@ static int alloc_css_id(struct cgroup_subsys *ss, struct cgroup *parent,
 {
         int subsys_id, i, depth = 0;
         struct cgroup_subsys_state *parent_css, *child_css;
-        struct css_id *child_id, *parent_id = NULL;
+        struct css_id *child_id, *parent_id;
 
         subsys_id = ss->subsys_id;
         parent_css = parent->subsys[subsys_id];
         child_css = child->subsys[subsys_id];
-        depth = css_depth(parent_css) + 1;
         parent_id = parent_css->id;
+        depth = parent_id->depth;
 
         child_id = get_new_cssid(ss, depth);
         if (IS_ERR(child_id))
@@ -4010,6 +4637,7 @@ struct cgroup_subsys_state *css_lookup(struct cgroup_subsys *ss, int id)
 
         return rcu_dereference(cssid->css);
 }
+EXPORT_SYMBOL_GPL(css_lookup);
 
 /**
  * css_get_next - lookup next cgroup under specified hierarchy.
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index 59e9ef6aab40..e5c0244962b0 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/cgroup.h>
 #include <linux/fs.h>
 #include <linux/uaccess.h>
@@ -47,17 +48,20 @@ static inline struct freezer *task_freezer(struct task_struct *task)
                             struct freezer, css);
 }
 
-int cgroup_frozen(struct task_struct *task)
+int cgroup_freezing_or_frozen(struct task_struct *task)
 {
         struct freezer *freezer;
         enum freezer_state state;
 
         task_lock(task);
         freezer = task_freezer(task);
-        state = freezer->state;
+        if (!freezer->css.cgroup->parent)
+                state = CGROUP_THAWED; /* root cgroup can't be frozen */
+        else
+                state = freezer->state;
         task_unlock(task);
 
-        return state == CGROUP_FROZEN;
+        return (state == CGROUP_FREEZING) || (state == CGROUP_FROZEN);
 }
 
 /*
@@ -201,9 +205,12 @@ static void freezer_fork(struct cgroup_subsys *ss, struct task_struct *task)
          * No lock is needed, since the task isn't on tasklist yet,
          * so it can't be moved to another cgroup, which means the
          * freezer won't be removed and will be valid during this
-         * function call.
+         * function call.  Nevertheless, apply RCU read-side critical
+         * section to suppress RCU lockdep false positives.
          */
+        rcu_read_lock();
         freezer = task_freezer(task);
+        rcu_read_unlock();
 
         /*
          * The root cgroup is non-freezable, so we can skip the
diff --git a/kernel/compat.c b/kernel/compat.c
index f6c204f07ea6..7f40e9275fd9 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -25,6 +25,7 @@
 #include <linux/posix-timers.h>
 #include <linux/times.h>
 #include <linux/ptrace.h>
+#include <linux/gfp.h>
 
 #include <asm/uaccess.h>
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 677f25376a38..545777574779 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -14,6 +14,7 @@
 #include <linux/kthread.h>
 #include <linux/stop_machine.h>
 #include <linux/mutex.h>
+#include <linux/gfp.h>
 
 #ifdef CONFIG_SMP
 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
@@ -163,6 +164,7 @@ static inline void check_for_tasks(int cpu)
 }
 
 struct take_cpu_down_param {
+        struct task_struct *caller;
         unsigned long mod;
         void *hcpu;
 };
@@ -171,6 +173,7 @@ struct take_cpu_down_param {
 static int __ref take_cpu_down(void *_param)
 {
         struct take_cpu_down_param *param = _param;
+        unsigned int cpu = (unsigned long)param->hcpu;
         int err;
 
         /* Ensure this CPU doesn't handle any more interrupts. */
@@ -181,6 +184,8 @@ static int __ref take_cpu_down(void *_param)
         raw_notifier_call_chain(&cpu_chain, CPU_DYING | param->mod,
                                 param->hcpu);
 
+        if (task_cpu(param->caller) == cpu)
+                move_task_off_dead_cpu(cpu, param->caller);
         /* Force idle task to run as soon as we yield: it should
            immediately notice cpu is offline and die quickly. */
         sched_idle_next();
@@ -191,10 +196,10 @@ static int __ref take_cpu_down(void *_param)
 static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
 {
         int err, nr_calls = 0;
-        cpumask_var_t old_allowed;
         void *hcpu = (void *)(long)cpu;
         unsigned long mod = tasks_frozen ? CPU_TASKS_FROZEN : 0;
         struct take_cpu_down_param tcd_param = {
+                .caller = current,
                 .mod = mod,
                 .hcpu = hcpu,
         };
@@ -205,9 +210,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
         if (!cpu_online(cpu))
                 return -EINVAL;
 
-        if (!alloc_cpumask_var(&old_allowed, GFP_KERNEL))
-                return -ENOMEM;
-
         cpu_hotplug_begin();
         set_cpu_active(cpu, false);
         err = __raw_notifier_call_chain(&cpu_chain, CPU_DOWN_PREPARE | mod,
@@ -224,10 +226,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
                 goto out_release;
         }
 
-        /* Ensure that we are not runnable on dying cpu */
-        cpumask_copy(old_allowed, &current->cpus_allowed);
-        set_cpus_allowed_ptr(current, cpu_active_mask);
-
         err = __stop_machine(take_cpu_down, &tcd_param, cpumask_of(cpu));
         if (err) {
                 set_cpu_active(cpu, true);
@@ -236,7 +234,7 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
                                             hcpu) == NOTIFY_BAD)
                         BUG();
 
-                goto out_allowed;
+                goto out_release;
         }
         BUG_ON(cpu_online(cpu));
 
@@ -254,8 +252,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
 
         check_for_tasks(cpu);
 
-out_allowed:
-        set_cpus_allowed_ptr(current, old_allowed);
 out_release:
         cpu_hotplug_done();
         if (!err) {
@@ -263,7 +259,6 @@ out_release:
                                             hcpu) == NOTIFY_BAD)
                         BUG();
         }
-        free_cpumask_var(old_allowed);
         return err;
 }
 
@@ -271,9 +266,6 @@ int __ref cpu_down(unsigned int cpu)
 {
         int err;
 
-        err = stop_machine_create();
-        if (err)
-                return err;
         cpu_maps_update_begin();
 
         if (cpu_hotplug_disabled) {
@@ -285,7 +277,6 @@ int __ref cpu_down(unsigned int cpu)
 
 out:
         cpu_maps_update_done();
-        stop_machine_destroy();
         return err;
 }
 EXPORT_SYMBOL(cpu_down);
@@ -338,7 +329,7 @@ int __cpuinit cpu_up(unsigned int cpu)
         if (!cpu_possible(cpu)) {
                 printk(KERN_ERR "can't online cpu %d because it is not "
                         "configured as may-hotadd at boot time\n", cpu);
-#if defined(CONFIG_IA64) || defined(CONFIG_X86_64)
+#if defined(CONFIG_IA64)
                 printk(KERN_ERR "please check additional_cpus= boot "
                                 "parameter\n");
 #endif
@@ -366,9 +357,6 @@ int disable_nonboot_cpus(void)
 {
         int cpu, first_cpu, error;
 
-        error = stop_machine_create();
-        if (error)
-                return error;
         cpu_maps_update_begin();
         first_cpu = cpumask_first(cpu_online_mask);
         /*
@@ -399,7 +387,6 @@ int disable_nonboot_cpus(void)
                 printk(KERN_ERR "Non-boot CPUs are not disabled\n");
         }
         cpu_maps_update_done();
-        stop_machine_destroy();
         return error;
 }
 
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index ba401fab459f..9a50c5f6e727 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -920,9 +920,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
  *    call to guarantee_online_mems(), as we know no one is changing
  *    our task's cpuset.
  *
- *    Hold callback_mutex around the two modifications of our tasks
- *    mems_allowed to synchronize with cpuset_mems_allowed().
- *
  *    While the mm_struct we are migrating is typically from some
  *    other task, the task_struct mems_allowed that we are hacking
  *    is for our current task, which must allocate new pages for that
@@ -973,15 +970,20 @@ static void cpuset_change_nodemask(struct task_struct *p,
         struct cpuset *cs;
         int migrate;
         const nodemask_t *oldmem = scan->data;
-        nodemask_t newmems;
+        NODEMASK_ALLOC(nodemask_t, newmems, GFP_KERNEL);
+
+        if (!newmems)
+                return;
 
         cs = cgroup_cs(scan->cg);
-        guarantee_online_mems(cs, &newmems);
+        guarantee_online_mems(cs, newmems);
 
         task_lock(p);
-        cpuset_change_task_nodemask(p, &newmems);
+        cpuset_change_task_nodemask(p, newmems);
         task_unlock(p);
 
+        NODEMASK_FREE(newmems);
+
         mm = get_task_mm(p);
         if (!mm)
                 return;
@@ -1051,16 +1053,21 @@ static void update_tasks_nodemask(struct cpuset *cs, const nodemask_t *oldmem,
 static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
                            const char *buf)
 {
-        nodemask_t oldmem;
+        NODEMASK_ALLOC(nodemask_t, oldmem, GFP_KERNEL);
         int retval;
         struct ptr_heap heap;
 
+        if (!oldmem)
+                return -ENOMEM;
+
         /*
          * top_cpuset.mems_allowed tracks node_stats[N_HIGH_MEMORY];
          * it's read-only
          */
-        if (cs == &top_cpuset)
-                return -EACCES;
+        if (cs == &top_cpuset) {
+                retval = -EACCES;
+                goto done;
+        }
 
         /*
          * An empty mems_allowed is ok iff there are no tasks in the cpuset.
@@ -1076,11 +1083,13 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
                         goto done;
 
                 if (!nodes_subset(trialcs->mems_allowed,
-                                node_states[N_HIGH_MEMORY]))
-                        return -EINVAL;
+                                node_states[N_HIGH_MEMORY])) {
+                        retval =  -EINVAL;
+                        goto done;
+                }
         }
-        oldmem = cs->mems_allowed;
-        if (nodes_equal(oldmem, trialcs->mems_allowed)) {
+        *oldmem = cs->mems_allowed;
+        if (nodes_equal(*oldmem, trialcs->mems_allowed)) {
                 retval = 0;             /* Too easy - nothing to do */
                 goto done;
         }
@@ -1096,10 +1105,11 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
         cs->mems_allowed = trialcs->mems_allowed;
         mutex_unlock(&callback_mutex);
 
-        update_tasks_nodemask(cs, &oldmem, &heap);
+        update_tasks_nodemask(cs, oldmem, &heap);
 
         heap_free(&heap);
 done:
+        NODEMASK_FREE(oldmem);
         return retval;
 }
 
@@ -1384,40 +1394,47 @@ static void cpuset_attach(struct cgroup_subsys *ss, struct cgroup *cont,
                           struct cgroup *oldcont, struct task_struct *tsk,
                           bool threadgroup)
 {
-        nodemask_t from, to;
         struct mm_struct *mm;
         struct cpuset *cs = cgroup_cs(cont);
         struct cpuset *oldcs = cgroup_cs(oldcont);
+        NODEMASK_ALLOC(nodemask_t, from, GFP_KERNEL);
+        NODEMASK_ALLOC(nodemask_t, to, GFP_KERNEL);
+
+        if (from == NULL || to == NULL)
+                goto alloc_fail;
 
         if (cs == &top_cpuset) {
                 cpumask_copy(cpus_attach, cpu_possible_mask);
-                to = node_possible_map;
         } else {
                 guarantee_online_cpus(cs, cpus_attach);
-                guarantee_online_mems(cs, &to);
         }
+        guarantee_online_mems(cs, to);
 
         /* do per-task migration stuff possibly for each in the threadgroup */
-        cpuset_attach_task(tsk, &to, cs);
+        cpuset_attach_task(tsk, to, cs);
         if (threadgroup) {
                 struct task_struct *c;
                 rcu_read_lock();
                 list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
-                        cpuset_attach_task(c, &to, cs);
+                        cpuset_attach_task(c, to, cs);
                 }
                 rcu_read_unlock();
         }
 
         /* change mm; only needs to be done once even if threadgroup */
-        from = oldcs->mems_allowed;
-        to = cs->mems_allowed;
+        *from = oldcs->mems_allowed;
+        *to = cs->mems_allowed;
         mm = get_task_mm(tsk);
         if (mm) {
-                mpol_rebind_mm(mm, &to);
+                mpol_rebind_mm(mm, to);
                 if (is_memory_migrate(cs))
-                        cpuset_migrate_mm(mm, &from, &to);
+                        cpuset_migrate_mm(mm, from, to);
                 mmput(mm);
         }
+
+alloc_fail:
+        NODEMASK_FREE(from);
+        NODEMASK_FREE(to);
 }
 
 /* The various types of files and directories in a cpuset file system */
@@ -1562,13 +1579,21 @@ static int cpuset_sprintf_cpulist(char *page, struct cpuset *cs)
 
 static int cpuset_sprintf_memlist(char *page, struct cpuset *cs)
 {
-        nodemask_t mask;
+        NODEMASK_ALLOC(nodemask_t, mask, GFP_KERNEL);
+        int retval;
+
+        if (mask == NULL)
+                return -ENOMEM;
 
         mutex_lock(&callback_mutex);
-        mask = cs->mems_allowed;
+        *mask = cs->mems_allowed;
         mutex_unlock(&callback_mutex);
 
-        return nodelist_scnprintf(page, PAGE_SIZE, mask);
+        retval = nodelist_scnprintf(page, PAGE_SIZE, *mask);
+
+        NODEMASK_FREE(mask);
+
+        return retval;
 }
 
 static ssize_t cpuset_common_file_read(struct cgroup *cont,
@@ -1997,7 +2022,10 @@ static void scan_for_empty_cpusets(struct cpuset *root)
         struct cpuset *cp;      /* scans cpusets being updated */
         struct cpuset *child;   /* scans child cpusets of cp */
         struct cgroup *cont;
-        nodemask_t oldmems;
+        NODEMASK_ALLOC(nodemask_t, oldmems, GFP_KERNEL);
+
+        if (oldmems == NULL)
+                return;
 
         list_add_tail((struct list_head *)&root->stack_list, &queue);
 
@@ -2014,7 +2042,7 @@ static void scan_for_empty_cpusets(struct cpuset *root)
                     nodes_subset(cp->mems_allowed, node_states[N_HIGH_MEMORY]))
                         continue;
 
-                oldmems = cp->mems_allowed;
+                *oldmems = cp->mems_allowed;
 
                 /* Remove offline cpus and mems from this cpuset. */
                 mutex_lock(&callback_mutex);
@@ -2030,9 +2058,10 @@ static void scan_for_empty_cpusets(struct cpuset *root)
                         remove_tasks_in_empty_cpuset(cp);
                 else {
                         update_tasks_cpumask(cp, NULL);
-                        update_tasks_nodemask(cp, &oldmems, NULL);
+                        update_tasks_nodemask(cp, oldmems, NULL);
                 }
         }
+        NODEMASK_FREE(oldmems);
 }
 
 /*
@@ -2090,20 +2119,33 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
 static int cpuset_track_online_nodes(struct notifier_block *self,
                                 unsigned long action, void *arg)
 {
+        NODEMASK_ALLOC(nodemask_t, oldmems, GFP_KERNEL);
+
+        if (oldmems == NULL)
+                return NOTIFY_DONE;
+
         cgroup_lock();
         switch (action) {
         case MEM_ONLINE:
-        case MEM_OFFLINE:
+                *oldmems = top_cpuset.mems_allowed;
                 mutex_lock(&callback_mutex);
                 top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
                 mutex_unlock(&callback_mutex);
-                if (action == MEM_OFFLINE)
-                        scan_for_empty_cpusets(&top_cpuset);
+                update_tasks_nodemask(&top_cpuset, oldmems, NULL);
+                break;
+        case MEM_OFFLINE:
+                /*
+                 * needn't update top_cpuset.mems_allowed explicitly because
+                 * scan_for_empty_cpusets() will update it.
+                 */
+                scan_for_empty_cpusets(&top_cpuset);
                 break;
         default:
                 break;
         }
         cgroup_unlock();
+
+        NODEMASK_FREE(oldmems);
         return NOTIFY_OK;
 }
 #endif
@@ -2140,19 +2182,52 @@ void __init cpuset_init_smp(void)
 void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask)
 {
         mutex_lock(&callback_mutex);
-        cpuset_cpus_allowed_locked(tsk, pmask);
+        task_lock(tsk);
+        guarantee_online_cpus(task_cs(tsk), pmask);
+        task_unlock(tsk);
         mutex_unlock(&callback_mutex);
 }
 
-/**
- * cpuset_cpus_allowed_locked - return cpus_allowed mask from a tasks cpuset.
- * Must be called with callback_mutex held.
- **/
-void cpuset_cpus_allowed_locked(struct task_struct *tsk, struct cpumask *pmask)
+int cpuset_cpus_allowed_fallback(struct task_struct *tsk)
 {
-        task_lock(tsk);
-        guarantee_online_cpus(task_cs(tsk), pmask);
-        task_unlock(tsk);
+        const struct cpuset *cs;
+        int cpu;
+
+        rcu_read_lock();
+        cs = task_cs(tsk);
+        if (cs)
+                cpumask_copy(&tsk->cpus_allowed, cs->cpus_allowed);
+        rcu_read_unlock();
+
+        /*
+         * We own tsk->cpus_allowed, nobody can change it under us.
+         *
+         * But we used cs && cs->cpus_allowed lockless and thus can
+         * race with cgroup_attach_task() or update_cpumask() and get
+         * the wrong tsk->cpus_allowed. However, both cases imply the
+         * subsequent cpuset_change_cpumask()->set_cpus_allowed_ptr()
+         * which takes task_rq_lock().
+         *
+         * If we are called after it dropped the lock we must see all
+         * changes in tsk_cs()->cpus_allowed. Otherwise we can temporary
+         * set any mask even if it is not right from task_cs() pov,
+         * the pending set_cpus_allowed_ptr() will fix things.
+         */
+
+        cpu = cpumask_any_and(&tsk->cpus_allowed, cpu_active_mask);
+        if (cpu >= nr_cpu_ids) {
+                /*
+                 * Either tsk->cpus_allowed is wrong (see above) or it
+                 * is actually empty. The latter case is only possible
+                 * if we are racing with remove_tasks_in_empty_cpuset().
+                 * Like above we can temporary set any mask and rely on
+                 * set_cpus_allowed_ptr() as synchronization point.
+                 */
+                cpumask_copy(&tsk->cpus_allowed, cpu_possible_mask);
+                cpu = cpumask_any(cpu_active_mask);
+        }
+
+        return cpu;
 }
 
 void cpuset_init_current_mems_allowed(void)
@@ -2341,22 +2416,6 @@ int __cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask)
 }
 
 /**
- * cpuset_lock - lock out any changes to cpuset structures
- *
- * The out of memory (oom) code needs to mutex_lock cpusets
- * from being changed while it scans the tasklist looking for a
- * task in an overlapping cpuset.  Expose callback_mutex via this
- * cpuset_lock() routine, so the oom code can lock it, before
- * locking the task list.  The tasklist_lock is a spinlock, so
- * must be taken inside callback_mutex.
- */
-
-void cpuset_lock(void)
-{
-        mutex_lock(&callback_mutex);
-}
-
-/**
  * cpuset_unlock - release lock on cpuset changes
  *
  * Undo the lock taken in a previous cpuset_lock() call.
diff --git a/kernel/cred-internals.h b/kernel/cred-internals.h
deleted file mode 100644
index 2dc4fc2d0bf1..000000000000
--- a/kernel/cred-internals.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* Internal credentials stuff
- *
- * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-
-/*
- * user.c
- */
-static inline void sched_switch_user(struct task_struct *p)
-{
-#ifdef CONFIG_USER_SCHED
-        sched_move_task(p);
-#endif  /* CONFIG_USER_SCHED */
-}
-
diff --git a/kernel/cred.c b/kernel/cred.c
index 1ed8ca18790c..8f3672a58a1e 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -10,13 +10,13 @@
  */
 #include <linux/module.h>
 #include <linux/cred.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/key.h>
 #include <linux/keyctl.h>
 #include <linux/init_task.h>
 #include <linux/security.h>
 #include <linux/cn_proc.h>
-#include "cred-internals.h"
 
 #if 0
 #define kdebug(FMT, ...) \
@@ -364,7 +364,7 @@ struct cred *prepare_usermodehelper_creds(void)
 
         new = kmem_cache_alloc(cred_jar, GFP_ATOMIC);
         if (!new)
-                return NULL;
+                goto free_tgcred;
 
         kdebug("prepare_usermodehelper_creds() alloc %p", new);
 
@@ -398,6 +398,12 @@ struct cred *prepare_usermodehelper_creds(void)
 error:
         put_cred(new);
         return NULL;
+
+free_tgcred:
+#ifdef CONFIG_KEYS
+        kfree(tgcred);
+#endif
+        return NULL;
 }
 
 /*
@@ -553,8 +559,6 @@ int commit_creds(struct cred *new)
                 atomic_dec(&old->user->processes);
         alter_cred_subscribers(old, -2);
 
-        sched_switch_user(task);
-
         /* send notifications */
         if (new->uid   != old->uid  ||
             new->euid  != old->euid ||
@@ -786,8 +790,6 @@ bool creds_are_invalid(const struct cred *cred)
 {
         if (cred->magic != CRED_MAGIC)
                 return true;
-        if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))
-                return true;
 #ifdef CONFIG_SECURITY_SELINUX
         if (selinux_is_enabled()) {
                 if ((unsigned long) cred->security < PAGE_SIZE)
diff --git a/kernel/early_res.c b/kernel/early_res.c
new file mode 100644
index 000000000000..31aa9332ef3f
--- /dev/null
+++ b/kernel/early_res.c
@@ -0,0 +1,584 @@
+/*
+ * early_res, could be used to replace bootmem
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/bootmem.h>
+#include <linux/mm.h>
+#include <linux/early_res.h>
+
+/*
+ * Early reserved memory areas.
+ */
+/*
+ * need to make sure this one is bigger enough before
+ * find_fw_memmap_area could be used
+ */
+#define MAX_EARLY_RES_X 32
+
+struct early_res {
+        u64 start, end;
+        char name[15];
+        char overlap_ok;
+};
+static struct early_res early_res_x[MAX_EARLY_RES_X] __initdata;
+
+static int max_early_res __initdata = MAX_EARLY_RES_X;
+static struct early_res *early_res __initdata = &early_res_x[0];
+static int early_res_count __initdata;
+
+static int __init find_overlapped_early(u64 start, u64 end)
+{
+        int i;
+        struct early_res *r;
+
+        for (i = 0; i < max_early_res && early_res[i].end; i++) {
+                r = &early_res[i];
+                if (end > r->start && start < r->end)
+                        break;
+        }
+
+        return i;
+}
+
+/*
+ * Drop the i-th range from the early reservation map,
+ * by copying any higher ranges down one over it, and
+ * clearing what had been the last slot.
+ */
+static void __init drop_range(int i)
+{
+        int j;
+
+        for (j = i + 1; j < max_early_res && early_res[j].end; j++)
+                ;
+
+        memmove(&early_res[i], &early_res[i + 1],
+               (j - 1 - i) * sizeof(struct early_res));
+
+        early_res[j - 1].end = 0;
+        early_res_count--;
+}
+
+static void __init drop_range_partial(int i, u64 start, u64 end)
+{
+        u64 common_start, common_end;
+        u64 old_start, old_end;
+
+        old_start = early_res[i].start;
+        old_end = early_res[i].end;
+        common_start = max(old_start, start);
+        common_end = min(old_end, end);
+
+        /* no overlap ? */
+        if (common_start >= common_end)
+                return;
+
+        if (old_start < common_start) {
+                /* make head segment */
+                early_res[i].end = common_start;
+                if (old_end > common_end) {
+                        char name[15];
+
+                        /*
+                         * Save a local copy of the name, since the
+                         * early_res array could get resized inside
+                         * reserve_early_without_check() ->
+                         * __check_and_double_early_res(), which would
+                         * make the current name pointer invalid.
+                         */
+                        strncpy(name, early_res[i].name,
+                                         sizeof(early_res[i].name) - 1);
+                        /* add another for left over on tail */
+                        reserve_early_without_check(common_end, old_end, name);
+                }
+                return;
+        } else {
+                if (old_end > common_end) {
+                        /* reuse the entry for tail left */
+                        early_res[i].start = common_end;
+                        return;
+                }
+                /* all covered */
+                drop_range(i);
+        }
+}
+
+/*
+ * Split any existing ranges that:
+ *  1) are marked 'overlap_ok', and
+ *  2) overlap with the stated range [start, end)
+ * into whatever portion (if any) of the existing range is entirely
+ * below or entirely above the stated range.  Drop the portion
+ * of the existing range that overlaps with the stated range,
+ * which will allow the caller of this routine to then add that
+ * stated range without conflicting with any existing range.
+ */
+static void __init drop_overlaps_that_are_ok(u64 start, u64 end)
+{
+        int i;
+        struct early_res *r;
+        u64 lower_start, lower_end;
+        u64 upper_start, upper_end;
+        char name[15];
+
+        for (i = 0; i < max_early_res && early_res[i].end; i++) {
+                r = &early_res[i];
+
+                /* Continue past non-overlapping ranges */
+                if (end <= r->start || start >= r->end)
+                        continue;
+
+                /*
+                 * Leave non-ok overlaps as is; let caller
+                 * panic "Overlapping early reservations"
+                 * when it hits this overlap.
+                 */
+                if (!r->overlap_ok)
+                        return;
+
+                /*
+                 * We have an ok overlap.  We will drop it from the early
+                 * reservation map, and add back in any non-overlapping
+                 * portions (lower or upper) as separate, overlap_ok,
+                 * non-overlapping ranges.
+                 */
+
+                /* 1. Note any non-overlapping (lower or upper) ranges. */
+                strncpy(name, r->name, sizeof(name) - 1);
+
+                lower_start = lower_end = 0;
+                upper_start = upper_end = 0;
+                if (r->start < start) {
+                        lower_start = r->start;
+                        lower_end = start;
+                }
+                if (r->end > end) {
+                        upper_start = end;
+                        upper_end = r->end;
+                }
+
+                /* 2. Drop the original ok overlapping range */
+                drop_range(i);
+
+                i--;            /* resume for-loop on copied down entry */
+
+                /* 3. Add back in any non-overlapping ranges. */
+                if (lower_end)
+                        reserve_early_overlap_ok(lower_start, lower_end, name);
+                if (upper_end)
+                        reserve_early_overlap_ok(upper_start, upper_end, name);
+        }
+}
+
+static void __init __reserve_early(u64 start, u64 end, char *name,
+                                                int overlap_ok)
+{
+        int i;
+        struct early_res *r;
+
+        i = find_overlapped_early(start, end);
+        if (i >= max_early_res)
+                panic("Too many early reservations");
+        r = &early_res[i];
+        if (r->end)
+                panic("Overlapping early reservations "
+                      "%llx-%llx %s to %llx-%llx %s\n",
+                      start, end - 1, name ? name : "", r->start,
+                      r->end - 1, r->name);
+        r->start = start;
+        r->end = end;
+        r->overlap_ok = overlap_ok;
+        if (name)
+                strncpy(r->name, name, sizeof(r->name) - 1);
+        early_res_count++;
+}
+
+/*
+ * A few early reservtations come here.
+ *
+ * The 'overlap_ok' in the name of this routine does -not- mean it
+ * is ok for these reservations to overlap an earlier reservation.
+ * Rather it means that it is ok for subsequent reservations to
+ * overlap this one.
+ *
+ * Use this entry point to reserve early ranges when you are doing
+ * so out of "Paranoia", reserving perhaps more memory than you need,
+ * just in case, and don't mind a subsequent overlapping reservation
+ * that is known to be needed.
+ *
+ * The drop_overlaps_that_are_ok() call here isn't really needed.
+ * It would be needed if we had two colliding 'overlap_ok'
+ * reservations, so that the second such would not panic on the
+ * overlap with the first.  We don't have any such as of this
+ * writing, but might as well tolerate such if it happens in
+ * the future.
+ */
+void __init reserve_early_overlap_ok(u64 start, u64 end, char *name)
+{
+        drop_overlaps_that_are_ok(start, end);
+        __reserve_early(start, end, name, 1);
+}
+
+static void __init __check_and_double_early_res(u64 ex_start, u64 ex_end)
+{
+        u64 start, end, size, mem;
+        struct early_res *new;
+
+        /* do we have enough slots left ? */
+        if ((max_early_res - early_res_count) > max(max_early_res/8, 2))
+                return;
+
+        /* double it */
+        mem = -1ULL;
+        size = sizeof(struct early_res) * max_early_res * 2;
+        if (early_res == early_res_x)
+                start = 0;
+        else
+                start = early_res[0].end;
+        end = ex_start;
+        if (start + size < end)
+                mem = find_fw_memmap_area(start, end, size,
+                                         sizeof(struct early_res));
+        if (mem == -1ULL) {
+                start = ex_end;
+                end = get_max_mapped();
+                if (start + size < end)
+                        mem = find_fw_memmap_area(start, end, size,
+                                                 sizeof(struct early_res));
+        }
+        if (mem == -1ULL)
+                panic("can not find more space for early_res array");
+
+        new = __va(mem);
+        /* save the first one for own */
+        new[0].start = mem;
+        new[0].end = mem + size;
+        new[0].overlap_ok = 0;
+        /* copy old to new */
+        if (early_res == early_res_x) {
+                memcpy(&new[1], &early_res[0],
+                         sizeof(struct early_res) * max_early_res);
+                memset(&new[max_early_res+1], 0,
+                         sizeof(struct early_res) * (max_early_res - 1));
+                early_res_count++;
+        } else {
+                memcpy(&new[1], &early_res[1],
+                         sizeof(struct early_res) * (max_early_res - 1));
+                memset(&new[max_early_res], 0,
+                         sizeof(struct early_res) * max_early_res);
+        }
+        memset(&early_res[0], 0, sizeof(struct early_res) * max_early_res);
+        early_res = new;
+        max_early_res *= 2;
+        printk(KERN_DEBUG "early_res array is doubled to %d at [%llx - %llx]\n",
+                max_early_res, mem, mem + size - 1);
+}
+
+/*
+ * Most early reservations come here.
+ *
+ * We first have drop_overlaps_that_are_ok() drop any pre-existing
+ * 'overlap_ok' ranges, so that we can then reserve this memory
+ * range without risk of panic'ing on an overlapping overlap_ok
+ * early reservation.
+ */
+void __init reserve_early(u64 start, u64 end, char *name)
+{
+        if (start >= end)
+                return;
+
+        __check_and_double_early_res(start, end);
+
+        drop_overlaps_that_are_ok(start, end);
+        __reserve_early(start, end, name, 0);
+}
+
+void __init reserve_early_without_check(u64 start, u64 end, char *name)
+{
+        struct early_res *r;
+
+        if (start >= end)
+                return;
+
+        __check_and_double_early_res(start, end);
+
+        r = &early_res[early_res_count];
+
+        r->start = start;
+        r->end = end;
+        r->overlap_ok = 0;
+        if (name)
+                strncpy(r->name, name, sizeof(r->name) - 1);
+        early_res_count++;
+}
+
+void __init free_early(u64 start, u64 end)
+{
+        struct early_res *r;
+        int i;
+
+        i = find_overlapped_early(start, end);
+        r = &early_res[i];
+        if (i >= max_early_res || r->end != end || r->start != start)
+                panic("free_early on not reserved area: %llx-%llx!",
+                         start, end - 1);
+
+        drop_range(i);
+}
+
+void __init free_early_partial(u64 start, u64 end)
+{
+        struct early_res *r;
+        int i;
+
+        if (start == end)
+                return;
+
+        if (WARN_ONCE(start > end, "  wrong range [%#llx, %#llx]\n", start, end))
+                return;
+
+try_next:
+        i = find_overlapped_early(start, end);
+        if (i >= max_early_res)
+                return;
+
+        r = &early_res[i];
+        /* hole ? */
+        if (r->end >= end && r->start <= start) {
+                drop_range_partial(i, start, end);
+                return;
+        }
+
+        drop_range_partial(i, start, end);
+        goto try_next;
+}
+
+#ifdef CONFIG_NO_BOOTMEM
+static void __init subtract_early_res(struct range *range, int az)
+{
+        int i, count;
+        u64 final_start, final_end;
+        int idx = 0;
+
+        count  = 0;
+        for (i = 0; i < max_early_res && early_res[i].end; i++)
+                count++;
+
+        /* need to skip first one ?*/
+        if (early_res != early_res_x)
+                idx = 1;
+
+#define DEBUG_PRINT_EARLY_RES 1
+
+#if DEBUG_PRINT_EARLY_RES
+        printk(KERN_INFO "Subtract (%d early reservations)\n", count);
+#endif
+        for (i = idx; i < count; i++) {
+                struct early_res *r = &early_res[i];
+#if DEBUG_PRINT_EARLY_RES
+                printk(KERN_INFO "  #%d [%010llx - %010llx] %15s\n", i,
+                        r->start, r->end, r->name);
+#endif
+                final_start = PFN_DOWN(r->start);
+                final_end = PFN_UP(r->end);
+                if (final_start >= final_end)
+                        continue;
+                subtract_range(range, az, final_start, final_end);
+        }
+
+}
+
+int __init get_free_all_memory_range(struct range **rangep, int nodeid)
+{
+        int i, count;
+        u64 start = 0, end;
+        u64 size;
+        u64 mem;
+        struct range *range;
+        int nr_range;
+
+        count  = 0;
+        for (i = 0; i < max_early_res && early_res[i].end; i++)
+                count++;
+
+        count *= 2;
+
+        size = sizeof(struct range) * count;
+        end = get_max_mapped();
+#ifdef MAX_DMA32_PFN
+        if (end > (MAX_DMA32_PFN << PAGE_SHIFT))
+                start = MAX_DMA32_PFN << PAGE_SHIFT;
+#endif
+        mem = find_fw_memmap_area(start, end, size, sizeof(struct range));
+        if (mem == -1ULL)
+                panic("can not find more space for range free");
+
+        range = __va(mem);
+        /* use early_node_map[] and early_res to get range array at first */
+        memset(range, 0, size);
+        nr_range = 0;
+
+        /* need to go over early_node_map to find out good range for node */
+        nr_range = add_from_early_node_map(range, count, nr_range, nodeid);
+#ifdef CONFIG_X86_32
+        subtract_range(range, count, max_low_pfn, -1ULL);
+#endif
+        subtract_early_res(range, count);
+        nr_range = clean_sort_range(range, count);
+
+        /* need to clear it ? */
+        if (nodeid == MAX_NUMNODES) {
+                memset(&early_res[0], 0,
+                         sizeof(struct early_res) * max_early_res);
+                early_res = NULL;
+                max_early_res = 0;
+        }
+
+        *rangep = range;
+        return nr_range;
+}
+#else
+void __init early_res_to_bootmem(u64 start, u64 end)
+{
+        int i, count;
+        u64 final_start, final_end;
+        int idx = 0;
+
+        count  = 0;
+        for (i = 0; i < max_early_res && early_res[i].end; i++)
+                count++;
+
+        /* need to skip first one ?*/
+        if (early_res != early_res_x)
+                idx = 1;
+
+        printk(KERN_INFO "(%d/%d early reservations) ==> bootmem [%010llx - %010llx]\n",
+                         count - idx, max_early_res, start, end);
+        for (i = idx; i < count; i++) {
+                struct early_res *r = &early_res[i];
+                printk(KERN_INFO "  #%d [%010llx - %010llx] %16s", i,
+                        r->start, r->end, r->name);
+                final_start = max(start, r->start);
+                final_end = min(end, r->end);
+                if (final_start >= final_end) {
+                        printk(KERN_CONT "\n");
+                        continue;
+                }
+                printk(KERN_CONT " ==> [%010llx - %010llx]\n",
+                        final_start, final_end);
+                reserve_bootmem_generic(final_start, final_end - final_start,
+                                BOOTMEM_DEFAULT);
+        }
+        /* clear them */
+        memset(&early_res[0], 0, sizeof(struct early_res) * max_early_res);
+        early_res = NULL;
+        max_early_res = 0;
+        early_res_count = 0;
+}
+#endif
+
+/* Check for already reserved areas */
+static inline int __init bad_addr(u64 *addrp, u64 size, u64 align)
+{
+        int i;
+        u64 addr = *addrp;
+        int changed = 0;
+        struct early_res *r;
+again:
+        i = find_overlapped_early(addr, addr + size);
+        r = &early_res[i];
+        if (i < max_early_res && r->end) {
+                *addrp = addr = round_up(r->end, align);
+                changed = 1;
+                goto again;
+        }
+        return changed;
+}
+
+/* Check for already reserved areas */
+static inline int __init bad_addr_size(u64 *addrp, u64 *sizep, u64 align)
+{
+        int i;
+        u64 addr = *addrp, last;
+        u64 size = *sizep;
+        int changed = 0;
+again:
+        last = addr + size;
+        for (i = 0; i < max_early_res && early_res[i].end; i++) {
+                struct early_res *r = &early_res[i];
+                if (last > r->start && addr < r->start) {
+                        size = r->start - addr;
+                        changed = 1;
+                        goto again;
+                }
+                if (last > r->end && addr < r->end) {
+                        addr = round_up(r->end, align);
+                        size = last - addr;
+                        changed = 1;
+                        goto again;
+                }
+                if (last <= r->end && addr >= r->start) {
+                        (*sizep)++;
+                        return 0;
+                }
+        }
+        if (changed) {
+                *addrp = addr;
+                *sizep = size;
+        }
+        return changed;
+}
+
+/*
+ * Find a free area with specified alignment in a specific range.
+ * only with the area.between start to end is active range from early_node_map
+ * so they are good as RAM
+ */
+u64 __init find_early_area(u64 ei_start, u64 ei_last, u64 start, u64 end,
+                         u64 size, u64 align)
+{
+        u64 addr, last;
+
+        addr = round_up(ei_start, align);
+        if (addr < start)
+                addr = round_up(start, align);
+        if (addr >= ei_last)
+                goto out;
+        while (bad_addr(&addr, size, align) && addr+size <= ei_last)
+                ;
+        last = addr + size;
+        if (last > ei_last)
+                goto out;
+        if (last > end)
+                goto out;
+
+        return addr;
+
+out:
+        return -1ULL;
+}
+
+u64 __init find_early_area_size(u64 ei_start, u64 ei_last, u64 start,
+                         u64 *sizep, u64 align)
+{
+        u64 addr, last;
+
+        addr = round_up(ei_start, align);
+        if (addr < start)
+                addr = round_up(start, align);
+        if (addr >= ei_last)
+                goto out;
+        *sizep = ei_last - addr;
+        while (bad_addr_size(&addr, sizep, align) && addr + *sizep <= ei_last)
+                ;
+        last = addr + *sizep;
+        if (last > ei_last)
+                goto out;
+
+        return addr;
+
+out:
+        return -1ULL;
+}
diff --git a/kernel/elfcore.c b/kernel/elfcore.c
new file mode 100644
index 000000000000..ff915efef66d
--- /dev/null
+++ b/kernel/elfcore.c
@@ -0,0 +1,28 @@
+#include <linux/elf.h>
+#include <linux/fs.h>
+#include <linux/mm.h>
+
+#include <asm/elf.h>
+
+
+Elf_Half __weak elf_core_extra_phdrs(void)
+{
+        return 0;
+}
+
+int __weak elf_core_write_extra_phdrs(struct file *file, loff_t offset, size_t *size,
+                                      unsigned long limit)
+{
+        return 1;
+}
+
+int __weak elf_core_write_extra_data(struct file *file, size_t *size,
+                                     unsigned long limit)
+{
+        return 1;
+}
+
+size_t __weak elf_core_extra_data_size(void)
+{
+        return 0;
+}
diff --git a/kernel/exit.c b/kernel/exit.c
index 45ed043b8bf5..eabca5a73a85 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -55,7 +55,6 @@
 #include <asm/unistd.h>
 #include <asm/pgtable.h>
 #include <asm/mmu_context.h>
-#include "cred-internals.h"
 
 static void exit_mm(struct task_struct * tsk);
 
@@ -87,7 +86,7 @@ static void __exit_signal(struct task_struct *tsk)
 
         sighand = rcu_dereference_check(tsk->sighand,
                                         rcu_read_lock_held() ||
-                                        lockdep_is_held(&tasklist_lock));
+                                        lockdep_tasklist_lock_is_held());
         spin_lock(&sighand->siglock);
 
         posix_cpu_timers_exit(tsk);
@@ -952,7 +951,9 @@ NORET_TYPE void do_exit(long code)
                                 preempt_count());
 
         acct_update_integrals(tsk);
-
+        /* sync mm's RSS info before statistics gathering */
+        if (tsk->mm)
+                sync_mm_rss(tsk, tsk->mm);
         group_dead = atomic_dec_and_test(&tsk->signal->live);
         if (group_dead) {
                 hrtimer_cancel(&tsk->signal->real_timer);
@@ -1188,7 +1189,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
 
         if (unlikely(wo->wo_flags & WNOWAIT)) {
                 int exit_code = p->exit_code;
-                int why, status;
+                int why;
 
                 get_task_struct(p);
                 read_unlock(&tasklist_lock);
diff --git a/kernel/fork.c b/kernel/fork.c
index 17bbf093356d..4d57d9e3a6e9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -86,7 +86,14 @@ int max_threads;		/* tunable limit on nr_threads */
 DEFINE_PER_CPU(unsigned long, process_counts) = 0;
 
 __cacheline_aligned DEFINE_RWLOCK(tasklist_lock);  /* outer */
-EXPORT_SYMBOL_GPL(tasklist_lock);
+
+#ifdef CONFIG_PROVE_RCU
+int lockdep_tasklist_lock_is_held(void)
+{
+        return lockdep_is_held(&tasklist_lock);
+}
+EXPORT_SYMBOL_GPL(lockdep_tasklist_lock_is_held);
+#endif /* #ifdef CONFIG_PROVE_RCU */
 
 int nr_processes(void)
 {
@@ -329,15 +336,17 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                 if (!tmp)
                         goto fail_nomem;
                 *tmp = *mpnt;
+                INIT_LIST_HEAD(&tmp->anon_vma_chain);
                 pol = mpol_dup(vma_policy(mpnt));
                 retval = PTR_ERR(pol);
                 if (IS_ERR(pol))
                         goto fail_nomem_policy;
                 vma_set_policy(tmp, pol);
+                if (anon_vma_fork(tmp, mpnt))
+                        goto fail_nomem_anon_vma_fork;
                 tmp->vm_flags &= ~VM_LOCKED;
                 tmp->vm_mm = mm;
                 tmp->vm_next = NULL;
-                anon_vma_link(tmp);
                 file = tmp->vm_file;
                 if (file) {
                         struct inode *inode = file->f_path.dentry->d_inode;
@@ -392,6 +401,8 @@ out:
         flush_tlb_mm(oldmm);
         up_write(&oldmm->mmap_sem);
         return retval;
+fail_nomem_anon_vma_fork:
+        mpol_put(pol);
 fail_nomem_policy:
         kmem_cache_free(vm_area_cachep, tmp);
 fail_nomem:
@@ -455,8 +466,7 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
                 (current->mm->flags & MMF_INIT_MASK) : default_dump_filter;
         mm->core_state = NULL;
         mm->nr_ptes = 0;
-        set_mm_counter(mm, file_rss, 0);
-        set_mm_counter(mm, anon_rss, 0);
+        memset(&mm->rss_stat, 0, sizeof(mm->rss_stat));
         spin_lock_init(&mm->page_table_lock);
         mm->free_area_cache = TASK_UNMAPPED_BASE;
         mm->cached_hole_size = ~0UL;
@@ -825,23 +835,14 @@ void __cleanup_sighand(struct sighand_struct *sighand)
  */
 static void posix_cpu_timers_init_group(struct signal_struct *sig)
 {
+        unsigned long cpu_limit;
+
         /* Thread group counters. */
         thread_group_cputime_init(sig);
 
-        /* Expiration times and increments. */
-        sig->it[CPUCLOCK_PROF].expires = cputime_zero;
-        sig->it[CPUCLOCK_PROF].incr = cputime_zero;
-        sig->it[CPUCLOCK_VIRT].expires = cputime_zero;
-        sig->it[CPUCLOCK_VIRT].incr = cputime_zero;
-
-        /* Cached expiration times. */
-        sig->cputime_expires.prof_exp = cputime_zero;
-        sig->cputime_expires.virt_exp = cputime_zero;
-        sig->cputime_expires.sched_exp = 0;
-
-        if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
-                sig->cputime_expires.prof_exp =
-                        secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur);
+        cpu_limit = ACCESS_ONCE(sig->rlim[RLIMIT_CPU].rlim_cur);
+        if (cpu_limit != RLIM_INFINITY) {
+                sig->cputime_expires.prof_exp = secs_to_cputime(cpu_limit);
                 sig->cputimer.running = 1;
         }
 
@@ -858,7 +859,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         if (clone_flags & CLONE_THREAD)
                 return 0;
 
-        sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
+        sig = kmem_cache_zalloc(signal_cachep, GFP_KERNEL);
         tsk->signal = sig;
         if (!sig)
                 return -ENOMEM;
@@ -866,46 +867,21 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         atomic_set(&sig->count, 1);
         atomic_set(&sig->live, 1);
         init_waitqueue_head(&sig->wait_chldexit);
-        sig->flags = 0;
         if (clone_flags & CLONE_NEWPID)
                 sig->flags |= SIGNAL_UNKILLABLE;
-        sig->group_exit_code = 0;
-        sig->group_exit_task = NULL;
-        sig->group_stop_count = 0;
         sig->curr_target = tsk;
         init_sigpending(&sig->shared_pending);
         INIT_LIST_HEAD(&sig->posix_timers);
 
         hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        sig->it_real_incr.tv64 = 0;
         sig->real_timer.function = it_real_fn;
 
-        sig->leader = 0;        /* session leadership doesn't inherit */
-        sig->tty_old_pgrp = NULL;
-        sig->tty = NULL;
-
-        sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
-        sig->gtime = cputime_zero;
-        sig->cgtime = cputime_zero;
-#ifndef CONFIG_VIRT_CPU_ACCOUNTING
-        sig->prev_utime = sig->prev_stime = cputime_zero;
-#endif
-        sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
-        sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
-        sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
-        sig->maxrss = sig->cmaxrss = 0;
-        task_io_accounting_init(&sig->ioac);
-        sig->sum_sched_runtime = 0;
-        taskstats_tgid_init(sig);
-
         task_lock(current->group_leader);
         memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
         task_unlock(current->group_leader);
 
         posix_cpu_timers_init_group(sig);
 
-        acct_init_pacct(&sig->pacct);
-
         tty_audit_fork(sig);
 
         sig->oom_adj = current->signal->oom_adj;
@@ -1034,7 +1010,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #endif
         retval = -EAGAIN;
         if (atomic_read(&p->real_cred->user->processes) >=
-                        p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
+                        task_rlimit(p, RLIMIT_NPROC)) {
                 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
                     p->real_cred->user != INIT_USER)
                         goto bad_fork_free;
@@ -1076,6 +1052,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->prev_utime = cputime_zero;
         p->prev_stime = cputime_zero;
 #endif
+#if defined(SPLIT_RSS_COUNTING)
+        memset(&p->rss_stat, 0, sizeof(p->rss_stat));
+#endif
 
         p->default_timer_slack_ns = current->timer_slack_ns;
 
@@ -1133,10 +1112,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->memcg_batch.memcg = NULL;
 #endif
 
-        p->bts = NULL;
-
-        p->stack_start = stack_start;
-
         /* Perform scheduler related setup. Assign this task to a CPU. */
         sched_fork(p, clone_flags);
 
diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
index 967e66143e11..7a56b22e0602 100644
--- a/kernel/hw_breakpoint.c
+++ b/kernel/hw_breakpoint.c
@@ -40,23 +40,29 @@
 #include <linux/percpu.h>
 #include <linux/sched.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/cpu.h>
 #include <linux/smp.h>
 
 #include <linux/hw_breakpoint.h>
 
+
 /*
  * Constraints data
  */
 
 /* Number of pinned cpu breakpoints in a cpu */
-static DEFINE_PER_CPU(unsigned int, nr_cpu_bp_pinned);
+static DEFINE_PER_CPU(unsigned int, nr_cpu_bp_pinned[TYPE_MAX]);
 
 /* Number of pinned task breakpoints in a cpu */
-static DEFINE_PER_CPU(unsigned int, nr_task_bp_pinned[HBP_NUM]);
+static DEFINE_PER_CPU(unsigned int *, nr_task_bp_pinned[TYPE_MAX]);
 
 /* Number of non-pinned cpu/task breakpoints in a cpu */
-static DEFINE_PER_CPU(unsigned int, nr_bp_flexible);
+static DEFINE_PER_CPU(unsigned int, nr_bp_flexible[TYPE_MAX]);
+
+static int nr_slots[TYPE_MAX];
+
+static int constraints_initialized;
 
 /* Gather the number of total pinned and un-pinned bp in a cpuset */
 struct bp_busy_slots {
@@ -67,16 +73,29 @@ struct bp_busy_slots {
 /* Serialize accesses to the above constraints */
 static DEFINE_MUTEX(nr_bp_mutex);
 
+__weak int hw_breakpoint_weight(struct perf_event *bp)
+{
+        return 1;
+}
+
+static inline enum bp_type_idx find_slot_idx(struct perf_event *bp)
+{
+        if (bp->attr.bp_type & HW_BREAKPOINT_RW)
+                return TYPE_DATA;
+
+        return TYPE_INST;
+}
+
 /*
  * Report the maximum number of pinned breakpoints a task
  * have in this cpu
  */
-static unsigned int max_task_bp_pinned(int cpu)
+static unsigned int max_task_bp_pinned(int cpu, enum bp_type_idx type)
 {
         int i;
-        unsigned int *tsk_pinned = per_cpu(nr_task_bp_pinned, cpu);
+        unsigned int *tsk_pinned = per_cpu(nr_task_bp_pinned[type], cpu);
 
-        for (i = HBP_NUM -1; i >= 0; i--) {
+        for (i = nr_slots[type] - 1; i >= 0; i--) {
                 if (tsk_pinned[i] > 0)
                         return i + 1;
         }
@@ -84,7 +103,7 @@ static unsigned int max_task_bp_pinned(int cpu)
         return 0;
 }
 
-static int task_bp_pinned(struct task_struct *tsk)
+static int task_bp_pinned(struct task_struct *tsk, enum bp_type_idx type)
 {
         struct perf_event_context *ctx = tsk->perf_event_ctxp;
         struct list_head *list;
@@ -105,7 +124,8 @@ static int task_bp_pinned(struct task_struct *tsk)
          */
         list_for_each_entry(bp, list, event_entry) {
                 if (bp->attr.type == PERF_TYPE_BREAKPOINT)
-                        count++;
+                        if (find_slot_idx(bp) == type)
+                                count += hw_breakpoint_weight(bp);
         }
 
         raw_spin_unlock_irqrestore(&ctx->lock, flags);
@@ -118,18 +138,19 @@ static int task_bp_pinned(struct task_struct *tsk)
  * a given cpu (cpu > -1) or in all of them (cpu = -1).
  */
 static void
-fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp)
+fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp,
+                    enum bp_type_idx type)
 {
         int cpu = bp->cpu;
         struct task_struct *tsk = bp->ctx->task;
 
         if (cpu >= 0) {
-                slots->pinned = per_cpu(nr_cpu_bp_pinned, cpu);
+                slots->pinned = per_cpu(nr_cpu_bp_pinned[type], cpu);
                 if (!tsk)
-                        slots->pinned += max_task_bp_pinned(cpu);
+                        slots->pinned += max_task_bp_pinned(cpu, type);
                 else
-                        slots->pinned += task_bp_pinned(tsk);
-                slots->flexible = per_cpu(nr_bp_flexible, cpu);
+                        slots->pinned += task_bp_pinned(tsk, type);
+                slots->flexible = per_cpu(nr_bp_flexible[type], cpu);
 
                 return;
         }
@@ -137,16 +158,16 @@ fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp)
         for_each_online_cpu(cpu) {
                 unsigned int nr;
 
-                nr = per_cpu(nr_cpu_bp_pinned, cpu);
+                nr = per_cpu(nr_cpu_bp_pinned[type], cpu);
                 if (!tsk)
-                        nr += max_task_bp_pinned(cpu);
+                        nr += max_task_bp_pinned(cpu, type);
                 else
-                        nr += task_bp_pinned(tsk);
+                        nr += task_bp_pinned(tsk, type);
 
                 if (nr > slots->pinned)
                         slots->pinned = nr;
 
-                nr = per_cpu(nr_bp_flexible, cpu);
+                nr = per_cpu(nr_bp_flexible[type], cpu);
 
                 if (nr > slots->flexible)
                         slots->flexible = nr;
@@ -154,31 +175,49 @@ fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp)
 }
 
 /*
+ * For now, continue to consider flexible as pinned, until we can
+ * ensure no flexible event can ever be scheduled before a pinned event
+ * in a same cpu.
+ */
+static void
+fetch_this_slot(struct bp_busy_slots *slots, int weight)
+{
+        slots->pinned += weight;
+}
+
+/*
  * Add a pinned breakpoint for the given task in our constraint table
  */
-static void toggle_bp_task_slot(struct task_struct *tsk, int cpu, bool enable)
+static void toggle_bp_task_slot(struct task_struct *tsk, int cpu, bool enable,
+                                enum bp_type_idx type, int weight)
 {
         unsigned int *tsk_pinned;
-        int count = 0;
+        int old_count = 0;
+        int old_idx = 0;
+        int idx = 0;
 
-        count = task_bp_pinned(tsk);
+        old_count = task_bp_pinned(tsk, type);
+        old_idx = old_count - 1;
+        idx = old_idx + weight;
 
-        tsk_pinned = per_cpu(nr_task_bp_pinned, cpu);
+        tsk_pinned = per_cpu(nr_task_bp_pinned[type], cpu);
         if (enable) {
-                tsk_pinned[count]++;
-                if (count > 0)
-                        tsk_pinned[count-1]--;
+                tsk_pinned[idx]++;
+                if (old_count > 0)
+                        tsk_pinned[old_idx]--;
         } else {
-                tsk_pinned[count]--;
-                if (count > 0)
-                        tsk_pinned[count-1]++;
+                tsk_pinned[idx]--;
+                if (old_count > 0)
+                        tsk_pinned[old_idx]++;
         }
 }
 
 /*
  * Add/remove the given breakpoint in our constraint table
  */
-static void toggle_bp_slot(struct perf_event *bp, bool enable)
+static void
+toggle_bp_slot(struct perf_event *bp, bool enable, enum bp_type_idx type,
+               int weight)
 {
         int cpu = bp->cpu;
         struct task_struct *tsk = bp->ctx->task;
@@ -186,20 +225,20 @@ static void toggle_bp_slot(struct perf_event *bp, bool enable)
         /* Pinned counter task profiling */
         if (tsk) {
                 if (cpu >= 0) {
-                        toggle_bp_task_slot(tsk, cpu, enable);
+                        toggle_bp_task_slot(tsk, cpu, enable, type, weight);
                         return;
                 }
 
                 for_each_online_cpu(cpu)
-                        toggle_bp_task_slot(tsk, cpu, enable);
+                        toggle_bp_task_slot(tsk, cpu, enable, type, weight);
                 return;
         }
 
         /* Pinned counter cpu profiling */
         if (enable)
-                per_cpu(nr_cpu_bp_pinned, bp->cpu)++;
+                per_cpu(nr_cpu_bp_pinned[type], bp->cpu) += weight;
         else
-                per_cpu(nr_cpu_bp_pinned, bp->cpu)--;
+                per_cpu(nr_cpu_bp_pinned[type], bp->cpu) -= weight;
 }
 
 /*
@@ -246,14 +285,29 @@ static void toggle_bp_slot(struct perf_event *bp, bool enable)
 static int __reserve_bp_slot(struct perf_event *bp)
 {
         struct bp_busy_slots slots = {0};
+        enum bp_type_idx type;
+        int weight;
 
-        fetch_bp_busy_slots(&slots, bp);
+        /* We couldn't initialize breakpoint constraints on boot */
+        if (!constraints_initialized)
+                return -ENOMEM;
+
+        /* Basic checks */
+        if (bp->attr.bp_type == HW_BREAKPOINT_EMPTY ||
+            bp->attr.bp_type == HW_BREAKPOINT_INVALID)
+                return -EINVAL;
+
+        type = find_slot_idx(bp);
+        weight = hw_breakpoint_weight(bp);
+
+        fetch_bp_busy_slots(&slots, bp, type);
+        fetch_this_slot(&slots, weight);
 
         /* Flexible counters need to keep at least one slot */
-        if (slots.pinned + (!!slots.flexible) == HBP_NUM)
+        if (slots.pinned + (!!slots.flexible) > nr_slots[type])
                 return -ENOSPC;
 
-        toggle_bp_slot(bp, true);
+        toggle_bp_slot(bp, true, type, weight);
 
         return 0;
 }
@@ -273,7 +327,12 @@ int reserve_bp_slot(struct perf_event *bp)
 
 static void __release_bp_slot(struct perf_event *bp)
 {
-        toggle_bp_slot(bp, false);
+        enum bp_type_idx type;
+        int weight;
+
+        type = find_slot_idx(bp);
+        weight = hw_breakpoint_weight(bp);
+        toggle_bp_slot(bp, false, type, weight);
 }
 
 void release_bp_slot(struct perf_event *bp)
@@ -308,6 +367,28 @@ int dbg_release_bp_slot(struct perf_event *bp)
         return 0;
 }
 
+static int validate_hw_breakpoint(struct perf_event *bp)
+{
+        int ret;
+
+        ret = arch_validate_hwbkpt_settings(bp);
+        if (ret)
+                return ret;
+
+        if (arch_check_bp_in_kernelspace(bp)) {
+                if (bp->attr.exclude_kernel)
+                        return -EINVAL;
+                /*
+                 * Don't let unprivileged users set a breakpoint in the trap
+                 * path to avoid trap recursion attacks.
+                 */
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+        }
+
+        return 0;
+}
+
 int register_perf_hw_breakpoint(struct perf_event *bp)
 {
         int ret;
@@ -316,17 +397,7 @@ int register_perf_hw_breakpoint(struct perf_event *bp)
         if (ret)
                 return ret;
 
-        /*
-         * Ptrace breakpoints can be temporary perf events only
-         * meant to reserve a slot. In this case, it is created disabled and
-         * we don't want to check the params right now (as we put a null addr)
-         * But perf tools create events as disabled and we want to check
-         * the params for them.
-         * This is a quick hack that will be removed soon, once we remove
-         * the tmp breakpoints from ptrace
-         */
-        if (!bp->attr.disabled || !bp->overflow_handler)
-                ret = arch_validate_hwbkpt_settings(bp, bp->ctx->task);
+        ret = validate_hw_breakpoint(bp);
 
         /* if arch_validate_hwbkpt_settings() fails then release bp slot */
         if (ret)
@@ -373,7 +444,7 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att
         if (attr->disabled)
                 goto end;
 
-        err = arch_validate_hwbkpt_settings(bp, bp->ctx->task);
+        err = validate_hw_breakpoint(bp);
         if (!err)
                 perf_event_enable(bp);
 
@@ -413,17 +484,17 @@ EXPORT_SYMBOL_GPL(unregister_hw_breakpoint);
  *
  * @return a set of per_cpu pointers to perf events
  */
-struct perf_event **
+struct perf_event * __percpu *
 register_wide_hw_breakpoint(struct perf_event_attr *attr,
                             perf_overflow_handler_t triggered)
 {
-        struct perf_event **cpu_events, **pevent, *bp;
+        struct perf_event * __percpu *cpu_events, **pevent, *bp;
         long err;
         int cpu;
 
         cpu_events = alloc_percpu(typeof(*cpu_events));
         if (!cpu_events)
-                return ERR_PTR(-ENOMEM);
+                return (void __percpu __force *)ERR_PTR(-ENOMEM);
 
         get_online_cpus();
         for_each_online_cpu(cpu) {
@@ -451,7 +522,7 @@ fail:
         put_online_cpus();
 
         free_percpu(cpu_events);
-        return ERR_PTR(err);
+        return (void __percpu __force *)ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(register_wide_hw_breakpoint);
 
@@ -459,7 +530,7 @@ EXPORT_SYMBOL_GPL(register_wide_hw_breakpoint);
  * unregister_wide_hw_breakpoint - unregister a wide breakpoint in the kernel
  * @cpu_events: the per cpu set of events to unregister
  */
-void unregister_wide_hw_breakpoint(struct perf_event **cpu_events)
+void unregister_wide_hw_breakpoint(struct perf_event * __percpu *cpu_events)
 {
         int cpu;
         struct perf_event **pevent;
@@ -480,7 +551,36 @@ static struct notifier_block hw_breakpoint_exceptions_nb = {
 
 static int __init init_hw_breakpoint(void)
 {
+        unsigned int **task_bp_pinned;
+        int cpu, err_cpu;
+        int i;
+
+        for (i = 0; i < TYPE_MAX; i++)
+                nr_slots[i] = hw_breakpoint_slots(i);
+
+        for_each_possible_cpu(cpu) {
+                for (i = 0; i < TYPE_MAX; i++) {
+                        task_bp_pinned = &per_cpu(nr_task_bp_pinned[i], cpu);
+                        *task_bp_pinned = kzalloc(sizeof(int) * nr_slots[i],
+                                                  GFP_KERNEL);
+                        if (!*task_bp_pinned)
+                                goto err_alloc;
+                }
+        }
+
+        constraints_initialized = 1;
+
         return register_die_notifier(&hw_breakpoint_exceptions_nb);
+
+ err_alloc:
+        for_each_possible_cpu(err_cpu) {
+                if (err_cpu == cpu)
+                        break;
+                for (i = 0; i < TYPE_MAX; i++)
+                        kfree(per_cpu(nr_task_bp_pinned[i], cpu));
+        }
+
+        return -ENOMEM;
 }
 core_initcall(init_hw_breakpoint);
 
@@ -489,5 +589,4 @@ struct pmu perf_ops_bp = {
         .enable         = arch_install_hw_breakpoint,
         .disable        = arch_uninstall_hw_breakpoint,
         .read           = hw_breakpoint_pmu_read,
-        .unthrottle     = hw_breakpoint_pmu_unthrottle
 };
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index ecc3fa28f666..b7091d5ca2f8 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -18,11 +18,7 @@
 
 #include "internals.h"
 
-/**
- *      dynamic_irq_init - initialize a dynamically allocated irq
- *      @irq:   irq number to initialize
- */
-void dynamic_irq_init(unsigned int irq)
+static void dynamic_irq_init_x(unsigned int irq, bool keep_chip_data)
 {
         struct irq_desc *desc;
         unsigned long flags;
@@ -41,7 +37,8 @@ void dynamic_irq_init(unsigned int irq)
         desc->depth = 1;
         desc->msi_desc = NULL;
         desc->handler_data = NULL;
-        desc->chip_data = NULL;
+        if (!keep_chip_data)
+                desc->chip_data = NULL;
         desc->action = NULL;
         desc->irq_count = 0;
         desc->irqs_unhandled = 0;
@@ -55,10 +52,26 @@ void dynamic_irq_init(unsigned int irq)
 }
 
 /**
- *      dynamic_irq_cleanup - cleanup a dynamically allocated irq
+ *      dynamic_irq_init - initialize a dynamically allocated irq
  *      @irq:   irq number to initialize
  */
-void dynamic_irq_cleanup(unsigned int irq)
+void dynamic_irq_init(unsigned int irq)
+{
+        dynamic_irq_init_x(irq, false);
+}
+
+/**
+ *      dynamic_irq_init_keep_chip_data - initialize a dynamically allocated irq
+ *      @irq:   irq number to initialize
+ *
+ *      does not set irq_to_desc(irq)->chip_data to NULL
+ */
+void dynamic_irq_init_keep_chip_data(unsigned int irq)
+{
+        dynamic_irq_init_x(irq, true);
+}
+
+static void dynamic_irq_cleanup_x(unsigned int irq, bool keep_chip_data)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
@@ -77,7 +90,8 @@ void dynamic_irq_cleanup(unsigned int irq)
         }
         desc->msi_desc = NULL;
         desc->handler_data = NULL;
-        desc->chip_data = NULL;
+        if (!keep_chip_data)
+                desc->chip_data = NULL;
         desc->handle_irq = handle_bad_irq;
         desc->chip = &no_irq_chip;
         desc->name = NULL;
@@ -85,6 +99,26 @@ void dynamic_irq_cleanup(unsigned int irq)
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
+/**
+ *      dynamic_irq_cleanup - cleanup a dynamically allocated irq
+ *      @irq:   irq number to initialize
+ */
+void dynamic_irq_cleanup(unsigned int irq)
+{
+        dynamic_irq_cleanup_x(irq, false);
+}
+
+/**
+ *      dynamic_irq_cleanup_keep_chip_data - cleanup a dynamically allocated irq
+ *      @irq:   irq number to initialize
+ *
+ *      does not set irq_to_desc(irq)->chip_data to NULL
+ */
+void dynamic_irq_cleanup_keep_chip_data(unsigned int irq)
+{
+        dynamic_irq_cleanup_x(irq, true);
+}
+
 
 /**
  *      set_irq_chip - set the irq chip for an irq
@@ -325,6 +359,23 @@ static inline void mask_ack_irq(struct irq_desc *desc, int irq)
                 if (desc->chip->ack)
                         desc->chip->ack(irq);
         }
+        desc->status |= IRQ_MASKED;
+}
+
+static inline void mask_irq(struct irq_desc *desc, int irq)
+{
+        if (desc->chip->mask) {
+                desc->chip->mask(irq);
+                desc->status |= IRQ_MASKED;
+        }
+}
+
+static inline void unmask_irq(struct irq_desc *desc, int irq)
+{
+        if (desc->chip->unmask) {
+                desc->chip->unmask(irq);
+                desc->status &= ~IRQ_MASKED;
+        }
 }
 
 /*
@@ -450,10 +501,8 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
         raw_spin_lock(&desc->lock);
         desc->status &= ~IRQ_INPROGRESS;
 
-        if (unlikely(desc->status & IRQ_ONESHOT))
-                desc->status |= IRQ_MASKED;
-        else if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
-                desc->chip->unmask(irq);
+        if (!(desc->status & (IRQ_DISABLED | IRQ_ONESHOT)))
+                unmask_irq(desc, irq);
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -490,8 +539,7 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
         action = desc->action;
         if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
                 desc->status |= IRQ_PENDING;
-                if (desc->chip->mask)
-                        desc->chip->mask(irq);
+                mask_irq(desc, irq);
                 goto out;
         }
 
@@ -520,7 +568,7 @@ out:
  *      signal. The occurence is latched into the irq controller hardware
  *      and must be acked in order to be reenabled. After the ack another
  *      interrupt can happen on the same source even before the first one
- *      is handled by the assosiacted event handler. If this happens it
+ *      is handled by the associated event handler. If this happens it
  *      might be necessary to disable (mask) the interrupt depending on the
  *      controller hardware. This requires to reenable the interrupt inside
  *      of the loop which handles the interrupts which have arrived while
@@ -559,7 +607,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                 irqreturn_t action_ret;
 
                 if (unlikely(!action)) {
-                        desc->chip->mask(irq);
+                        mask_irq(desc, irq);
                         goto out_unlock;
                 }
 
@@ -571,8 +619,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                 if (unlikely((desc->status &
                                (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
                               (IRQ_PENDING | IRQ_MASKED))) {
-                        desc->chip->unmask(irq);
-                        desc->status &= ~IRQ_MASKED;
+                        unmask_irq(desc, irq);
                 }
 
                 desc->status &= ~IRQ_PENDING;
@@ -682,7 +729,7 @@ set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
         __set_irq_handler(irq, handle, 0, name);
 }
 
-void __init set_irq_noprobe(unsigned int irq)
+void set_irq_noprobe(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
@@ -697,7 +744,7 @@ void __init set_irq_noprobe(unsigned int irq)
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
-void __init set_irq_probe(unsigned int irq)
+void set_irq_probe(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
index d06df9c41cba..1ef4ffcdfa55 100644
--- a/kernel/irq/devres.c
+++ b/kernel/irq/devres.c
@@ -42,7 +42,7 @@ static int devm_irq_match(struct device *dev, void *res, void *data)
  *      automatically freed on driver detach.
  *
  *      If an IRQ allocated with this function needs to be freed
- *      separately, dev_free_irq() must be used.
+ *      separately, devm_free_irq() must be used.
  */
 int devm_request_threaded_irq(struct device *dev, unsigned int irq,
                               irq_handler_t handler, irq_handler_t thread_fn,
@@ -81,7 +81,7 @@ EXPORT_SYMBOL(devm_request_threaded_irq);
  *      Except for the extra @dev argument, this function takes the
  *      same arguments and performs the same function as free_irq().
  *      This function instead of free_irq() should be used to manually
- *      free IRQs allocated with dev_request_irq().
+ *      free IRQs allocated with devm_request_irq().
  */
 void devm_free_irq(struct device *dev, unsigned int irq, void *dev_id)
 {
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 814940e7f485..76d5a671bfe1 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -19,7 +19,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/rculist.h>
 #include <linux/hash.h>
-#include <linux/bootmem.h>
+#include <linux/radix-tree.h>
 #include <trace/events/irq.h>
 
 #include "internals.h"
@@ -87,12 +87,8 @@ void __ref init_kstat_irqs(struct irq_desc *desc, int node, int nr)
 {
         void *ptr;
 
-        if (slab_is_available())
-                ptr = kzalloc_node(nr * sizeof(*desc->kstat_irqs),
-                                   GFP_ATOMIC, node);
-        else
-                ptr = alloc_bootmem_node(NODE_DATA(node),
-                                nr * sizeof(*desc->kstat_irqs));
+        ptr = kzalloc_node(nr * sizeof(*desc->kstat_irqs),
+                           GFP_ATOMIC, node);
 
         /*
          * don't overwite if can not get new one
@@ -132,7 +128,26 @@ static void init_one_irq_desc(int irq, struct irq_desc *desc, int node)
  */
 DEFINE_RAW_SPINLOCK(sparse_irq_lock);
 
-struct irq_desc **irq_desc_ptrs __read_mostly;
+static RADIX_TREE(irq_desc_tree, GFP_ATOMIC);
+
+static void set_irq_desc(unsigned int irq, struct irq_desc *desc)
+{
+        radix_tree_insert(&irq_desc_tree, irq, desc);
+}
+
+struct irq_desc *irq_to_desc(unsigned int irq)
+{
+        return radix_tree_lookup(&irq_desc_tree, irq);
+}
+
+void replace_irq_desc(unsigned int irq, struct irq_desc *desc)
+{
+        void **ptr;
+
+        ptr = radix_tree_lookup_slot(&irq_desc_tree, irq);
+        if (ptr)
+                radix_tree_replace_slot(ptr, desc);
+}
 
 static struct irq_desc irq_desc_legacy[NR_IRQS_LEGACY] __cacheline_aligned_in_smp = {
         [0 ... NR_IRQS_LEGACY-1] = {
@@ -164,9 +179,6 @@ int __init early_irq_init(void)
         legacy_count = ARRAY_SIZE(irq_desc_legacy);
         node = first_online_node;
 
-        /* allocate irq_desc_ptrs array based on nr_irqs */
-        irq_desc_ptrs = kcalloc(nr_irqs, sizeof(void *), GFP_NOWAIT);
-
         /* allocate based on nr_cpu_ids */
         kstat_irqs_legacy = kzalloc_node(NR_IRQS_LEGACY * nr_cpu_ids *
                                           sizeof(int), GFP_NOWAIT, node);
@@ -180,23 +192,12 @@ int __init early_irq_init(void)
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
                 alloc_desc_masks(&desc[i], node, true);
                 init_desc_masks(&desc[i]);
-                irq_desc_ptrs[i] = desc + i;
+                set_irq_desc(i, &desc[i]);
         }
 
-        for (i = legacy_count; i < nr_irqs; i++)
-                irq_desc_ptrs[i] = NULL;
-
         return arch_early_irq_init();
 }
 
-struct irq_desc *irq_to_desc(unsigned int irq)
-{
-        if (irq_desc_ptrs && irq < nr_irqs)
-                return irq_desc_ptrs[irq];
-
-        return NULL;
-}
-
 struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
 {
         struct irq_desc *desc;
@@ -208,21 +209,18 @@ struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
                 return NULL;
         }
 
-        desc = irq_desc_ptrs[irq];
+        desc = irq_to_desc(irq);
         if (desc)
                 return desc;
 
         raw_spin_lock_irqsave(&sparse_irq_lock, flags);
 
         /* We have to check it to avoid races with another CPU */
-        desc = irq_desc_ptrs[irq];
+        desc = irq_to_desc(irq);
         if (desc)
                 goto out_unlock;
 
-        if (slab_is_available())
-                desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
-        else
-                desc = alloc_bootmem_node(NODE_DATA(node), sizeof(*desc));
+        desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
 
         printk(KERN_DEBUG "  alloc irq_desc for %d on node %d\n", irq, node);
         if (!desc) {
@@ -231,7 +229,7 @@ struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
         }
         init_one_irq_desc(irq, desc, node);
 
-        irq_desc_ptrs[irq] = desc;
+        set_irq_desc(irq, desc);
 
 out_unlock:
         raw_spin_unlock_irqrestore(&sparse_irq_lock, flags);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index b2821f070a3d..c63f3bc88f0b 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -21,11 +21,7 @@ extern void clear_kstat_irqs(struct irq_desc *desc);
 extern raw_spinlock_t sparse_irq_lock;
 
 #ifdef CONFIG_SPARSE_IRQ
-/* irq_desc_ptrs allocated at boot time */
-extern struct irq_desc **irq_desc_ptrs;
-#else
-/* irq_desc_ptrs is a fixed size array */
-extern struct irq_desc *irq_desc_ptrs[NR_IRQS];
+void replace_irq_desc(unsigned int irq, struct irq_desc *desc);
 #endif
 
 #ifdef CONFIG_PROC_FS
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index eb6078ca60c7..704e488730a5 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -382,6 +382,7 @@ int can_request_irq(unsigned int irq, unsigned long irqflags)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         struct irqaction *action;
+        unsigned long flags;
 
         if (!desc)
                 return 0;
@@ -389,11 +390,14 @@ int can_request_irq(unsigned int irq, unsigned long irqflags)
         if (desc->status & IRQ_NOREQUEST)
                 return 0;
 
+        raw_spin_lock_irqsave(&desc->lock, flags);
         action = desc->action;
         if (action)
                 if (irqflags & action->flags & IRQF_SHARED)
                         action = NULL;
 
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+
         return !action;
 }
 
@@ -483,8 +487,26 @@ static int irq_wait_for_interrupt(struct irqaction *action)
  */
 static void irq_finalize_oneshot(unsigned int irq, struct irq_desc *desc)
 {
+again:
         chip_bus_lock(irq, desc);
         raw_spin_lock_irq(&desc->lock);
+
+        /*
+         * Implausible though it may be we need to protect us against
+         * the following scenario:
+         *
+         * The thread is faster done than the hard interrupt handler
+         * on the other CPU. If we unmask the irq line then the
+         * interrupt can come in again and masks the line, leaves due
+         * to IRQ_INPROGRESS and the irq line is masked forever.
+         */
+        if (unlikely(desc->status & IRQ_INPROGRESS)) {
+                raw_spin_unlock_irq(&desc->lock);
+                chip_bus_sync_unlock(irq, desc);
+                cpu_relax();
+                goto again;
+        }
+
         if (!(desc->status & IRQ_DISABLED) && (desc->status & IRQ_MASKED)) {
                 desc->status &= ~IRQ_MASKED;
                 desc->chip->unmask(irq);
@@ -735,6 +757,16 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                 if (new->flags & IRQF_ONESHOT)
                         desc->status |= IRQ_ONESHOT;
 
+                /*
+                 * Force MSI interrupts to run with interrupts
+                 * disabled. The multi vector cards can cause stack
+                 * overflows due to nested interrupts when enough of
+                 * them are directed to a core and fire at the same
+                 * time.
+                 */
+                if (desc->msi_desc)
+                        new->flags |= IRQF_DISABLED;
+
                 if (!(desc->status & IRQ_NOAUTOEN)) {
                         desc->depth = 0;
                         desc->status &= ~IRQ_DISABLED;
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
index 26bac9d8f860..65d3845665ac 100644
--- a/kernel/irq/numa_migrate.c
+++ b/kernel/irq/numa_migrate.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/irq.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/random.h>
 #include <linux/interrupt.h>
@@ -70,7 +71,7 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
         raw_spin_lock_irqsave(&sparse_irq_lock, flags);
 
         /* We have to check it to avoid races with another CPU */
-        desc = irq_desc_ptrs[irq];
+        desc = irq_to_desc(irq);
 
         if (desc && old_desc != desc)
                 goto out_unlock;
@@ -90,7 +91,7 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
                 goto out_unlock;
         }
 
-        irq_desc_ptrs[irq] = desc;
+        replace_irq_desc(irq, desc);
         raw_spin_unlock_irqrestore(&sparse_irq_lock, flags);
 
         /* free the old one */
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 6f50eccc79c0..7a6eb04ef6b5 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/irq.h>
+#include <linux/gfp.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/interrupt.h>
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 8e5288a8a355..13aff293f4de 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -21,6 +21,7 @@
 #include <linux/sched.h>        /* for cond_resched */
 #include <linux/mm.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 
 #include <asm/sections.h>
 
diff --git a/kernel/kexec.c b/kernel/kexec.c
index ef077fb73155..474a84715eac 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -41,7 +41,7 @@
 #include <asm/sections.h>
 
 /* Per cpu memory for storing cpu states in case of system crash. */
-note_buf_t* crash_notes;
+note_buf_t __percpu *crash_notes;
 
 /* vmcoreinfo stuff */
 static unsigned char vmcoreinfo_data[VMCOREINFO_BYTES];
@@ -1134,11 +1134,9 @@ int crash_shrink_memory(unsigned long new_size)
 
         free_reserved_phys_range(end, crashk_res.end);
 
-        if (start == end) {
-                crashk_res.end = end;
+        if (start == end)
                 release_resource(&crashk_res);
-        } else
-                crashk_res.end = end - 1;
+        crashk_res.end = end - 1;
 
 unlock:
         mutex_unlock(&kexec_mutex);
diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index 761fdd2b3034..11f3515ca83f 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -69,9 +69,16 @@ struct kgdb_state {
         struct pt_regs          *linux_regs;
 };
 
+/* Exception state values */
+#define DCPU_WANT_MASTER 0x1 /* Waiting to become a master kgdb cpu */
+#define DCPU_NEXT_MASTER 0x2 /* Transition from one master cpu to another */
+#define DCPU_IS_SLAVE    0x4 /* Slave cpu enter exception */
+#define DCPU_SSTEP       0x8 /* CPU is single stepping */
+
 static struct debuggerinfo_struct {
         void                    *debuggerinfo;
         struct task_struct      *task;
+        int                     exception_state;
 } kgdb_info[NR_CPUS];
 
 /**
@@ -391,27 +398,22 @@ int kgdb_mem2hex(char *mem, char *buf, int count)
 
 /*
  * Copy the binary array pointed to by buf into mem.  Fix $, #, and
- * 0x7d escaped with 0x7d.  Return a pointer to the character after
- * the last byte written.
+ * 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
+ * The input buf is overwitten with the result to write to mem.
  */
 static int kgdb_ebin2mem(char *buf, char *mem, int count)
 {
-        int err = 0;
-        char c;
+        int size = 0;
+        char *c = buf;
 
         while (count-- > 0) {
-                c = *buf++;
-                if (c == 0x7d)
-                        c = *buf++ ^ 0x20;
-
-                err = probe_kernel_write(mem, &c, 1);
-                if (err)
-                        break;
-
-                mem++;
+                c[size] = *buf++;
+                if (c[size] == 0x7d)
+                        c[size] = *buf++ ^ 0x20;
+                size++;
         }
 
-        return err;
+        return probe_kernel_write(mem, c, size);
 }
 
 /*
@@ -563,49 +565,6 @@ static struct task_struct *getthread(struct pt_regs *regs, int tid)
 }
 
 /*
- * CPU debug state control:
- */
-
-#ifdef CONFIG_SMP
-static void kgdb_wait(struct pt_regs *regs)
-{
-        unsigned long flags;
-        int cpu;
-
-        local_irq_save(flags);
-        cpu = raw_smp_processor_id();
-        kgdb_info[cpu].debuggerinfo = regs;
-        kgdb_info[cpu].task = current;
-        /*
-         * Make sure the above info reaches the primary CPU before
-         * our cpu_in_kgdb[] flag setting does:
-         */
-        smp_wmb();
-        atomic_set(&cpu_in_kgdb[cpu], 1);
-
-        /* Disable any cpu specific hw breakpoints */
-        kgdb_disable_hw_debug(regs);
-
-        /* Wait till primary CPU is done with debugging */
-        while (atomic_read(&passive_cpu_wait[cpu]))
-                cpu_relax();
-
-        kgdb_info[cpu].debuggerinfo = NULL;
-        kgdb_info[cpu].task = NULL;
-
-        /* fix up hardware debug registers on local cpu */
-        if (arch_kgdb_ops.correct_hw_break)
-                arch_kgdb_ops.correct_hw_break();
-
-        /* Signal the primary CPU that we are done: */
-        atomic_set(&cpu_in_kgdb[cpu], 0);
-        touch_softlockup_watchdog_sync();
-        clocksource_touch_watchdog();
-        local_irq_restore(flags);
-}
-#endif
-
-/*
  * Some architectures need cache flushes when we set/clear a
  * breakpoint:
  */
@@ -1400,34 +1359,13 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
         return 1;
 }
 
-/*
- * kgdb_handle_exception() - main entry point from a kernel exception
- *
- * Locking hierarchy:
- *      interface locks, if any (begin_session)
- *      kgdb lock (kgdb_active)
- */
-int
-kgdb_handle_exception(int evector, int signo, int ecode, struct pt_regs *regs)
+static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs)
 {
-        struct kgdb_state kgdb_var;
-        struct kgdb_state *ks = &kgdb_var;
         unsigned long flags;
         int sstep_tries = 100;
         int error = 0;
         int i, cpu;
-
-        ks->cpu                 = raw_smp_processor_id();
-        ks->ex_vector           = evector;
-        ks->signo               = signo;
-        ks->ex_vector           = evector;
-        ks->err_code            = ecode;
-        ks->kgdb_usethreadid    = 0;
-        ks->linux_regs          = regs;
-
-        if (kgdb_reenter_check(ks))
-                return 0; /* Ouch, double exception ! */
-
+        int trace_on = 0;
 acquirelock:
         /*
          * Interrupts will be restored by the 'trap return' code, except when
@@ -1435,13 +1373,43 @@ acquirelock:
          */
         local_irq_save(flags);
 
-        cpu = raw_smp_processor_id();
+        cpu = ks->cpu;
+        kgdb_info[cpu].debuggerinfo = regs;
+        kgdb_info[cpu].task = current;
+        /*
+         * Make sure the above info reaches the primary CPU before
+         * our cpu_in_kgdb[] flag setting does:
+         */
+        atomic_inc(&cpu_in_kgdb[cpu]);
 
         /*
-         * Acquire the kgdb_active lock:
+         * CPU will loop if it is a slave or request to become a kgdb
+         * master cpu and acquire the kgdb_active lock:
          */
-        while (atomic_cmpxchg(&kgdb_active, -1, cpu) != -1)
+        while (1) {
+                if (kgdb_info[cpu].exception_state & DCPU_WANT_MASTER) {
+                        if (atomic_cmpxchg(&kgdb_active, -1, cpu) == cpu)
+                                break;
+                } else if (kgdb_info[cpu].exception_state & DCPU_IS_SLAVE) {
+                        if (!atomic_read(&passive_cpu_wait[cpu]))
+                                goto return_normal;
+                } else {
+return_normal:
+                        /* Return to normal operation by executing any
+                         * hw breakpoint fixup.
+                         */
+                        if (arch_kgdb_ops.correct_hw_break)
+                                arch_kgdb_ops.correct_hw_break();
+                        if (trace_on)
+                                tracing_on();
+                        atomic_dec(&cpu_in_kgdb[cpu]);
+                        touch_softlockup_watchdog_sync();
+                        clocksource_touch_watchdog();
+                        local_irq_restore(flags);
+                        return 0;
+                }
                 cpu_relax();
+        }
 
         /*
          * For single stepping, try to only enter on the processor
@@ -1475,9 +1443,6 @@ acquirelock:
         if (kgdb_io_ops->pre_exception)
                 kgdb_io_ops->pre_exception();
 
-        kgdb_info[ks->cpu].debuggerinfo = ks->linux_regs;
-        kgdb_info[ks->cpu].task = current;
-
         kgdb_disable_hw_debug(ks->linux_regs);
 
         /*
@@ -1486,15 +1451,9 @@ acquirelock:
          */
         if (!kgdb_single_step) {
                 for (i = 0; i < NR_CPUS; i++)
-                        atomic_set(&passive_cpu_wait[i], 1);
+                        atomic_inc(&passive_cpu_wait[i]);
         }
 
-        /*
-         * spin_lock code is good enough as a barrier so we don't
-         * need one here:
-         */
-        atomic_set(&cpu_in_kgdb[ks->cpu], 1);
-
 #ifdef CONFIG_SMP
         /* Signal the other CPUs to enter kgdb_wait() */
         if ((!kgdb_single_step) && kgdb_do_roundup)
@@ -1518,6 +1477,9 @@ acquirelock:
         kgdb_single_step = 0;
         kgdb_contthread = current;
         exception_level = 0;
+        trace_on = tracing_is_on();
+        if (trace_on)
+                tracing_off();
 
         /* Talk to debugger with gdbserial protocol */
         error = gdb_serial_stub(ks);
@@ -1526,13 +1488,11 @@ acquirelock:
         if (kgdb_io_ops->post_exception)
                 kgdb_io_ops->post_exception();
 
-        kgdb_info[ks->cpu].debuggerinfo = NULL;
-        kgdb_info[ks->cpu].task = NULL;
-        atomic_set(&cpu_in_kgdb[ks->cpu], 0);
+        atomic_dec(&cpu_in_kgdb[ks->cpu]);
 
         if (!kgdb_single_step) {
                 for (i = NR_CPUS-1; i >= 0; i--)
-                        atomic_set(&passive_cpu_wait[i], 0);
+                        atomic_dec(&passive_cpu_wait[i]);
                 /*
                  * Wait till all the CPUs have quit
                  * from the debugger.
@@ -1551,6 +1511,8 @@ kgdb_restore:
                 else
                         kgdb_sstep_pid = 0;
         }
+        if (trace_on)
+                tracing_on();
         /* Free kgdb_active */
         atomic_set(&kgdb_active, -1);
         touch_softlockup_watchdog_sync();
@@ -1560,13 +1522,52 @@ kgdb_restore:
         return error;
 }
 
+/*
+ * kgdb_handle_exception() - main entry point from a kernel exception
+ *
+ * Locking hierarchy:
+ *      interface locks, if any (begin_session)
+ *      kgdb lock (kgdb_active)
+ */
+int
+kgdb_handle_exception(int evector, int signo, int ecode, struct pt_regs *regs)
+{
+        struct kgdb_state kgdb_var;
+        struct kgdb_state *ks = &kgdb_var;
+        int ret;
+
+        ks->cpu                 = raw_smp_processor_id();
+        ks->ex_vector           = evector;
+        ks->signo               = signo;
+        ks->ex_vector           = evector;
+        ks->err_code            = ecode;
+        ks->kgdb_usethreadid    = 0;
+        ks->linux_regs          = regs;
+
+        if (kgdb_reenter_check(ks))
+                return 0; /* Ouch, double exception ! */
+        kgdb_info[ks->cpu].exception_state |= DCPU_WANT_MASTER;
+        ret = kgdb_cpu_enter(ks, regs);
+        kgdb_info[ks->cpu].exception_state &= ~DCPU_WANT_MASTER;
+        return ret;
+}
+
 int kgdb_nmicallback(int cpu, void *regs)
 {
 #ifdef CONFIG_SMP
+        struct kgdb_state kgdb_var;
+        struct kgdb_state *ks = &kgdb_var;
+
+        memset(ks, 0, sizeof(struct kgdb_state));
+        ks->cpu                 = cpu;
+        ks->linux_regs          = regs;
+
         if (!atomic_read(&cpu_in_kgdb[cpu]) &&
-                        atomic_read(&kgdb_active) != cpu &&
-                        atomic_read(&cpu_in_kgdb[atomic_read(&kgdb_active)])) {
-                kgdb_wait((struct pt_regs *)regs);
+            atomic_read(&kgdb_active) != -1 &&
+            atomic_read(&kgdb_active) != cpu) {
+                kgdb_info[cpu].exception_state |= DCPU_IS_SLAVE;
+                kgdb_cpu_enter(ks, regs);
+                kgdb_info[cpu].exception_state &= ~DCPU_IS_SLAVE;
                 return 0;
         }
 #endif
@@ -1742,11 +1743,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
  */
 void kgdb_breakpoint(void)
 {
-        atomic_set(&kgdb_setting_breakpoint, 1);
+        atomic_inc(&kgdb_setting_breakpoint);
         wmb(); /* Sync point before breakpoint */
         arch_kgdb_breakpoint();
         wmb(); /* Sync point after breakpoint */
-        atomic_set(&kgdb_setting_breakpoint, 0);
+        atomic_dec(&kgdb_setting_breakpoint);
 }
 EXPORT_SYMBOL_GPL(kgdb_breakpoint);
 
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index ccec774c716d..282035f3ae96 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -42,9 +42,11 @@
 #include <linux/freezer.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
+#include <linux/sysctl.h>
 #include <linux/kdebug.h>
 #include <linux/memory.h>
 #include <linux/ftrace.h>
+#include <linux/cpu.h>
 
 #include <asm-generic/sections.h>
 #include <asm/cacheflush.h>
@@ -105,57 +107,74 @@ static struct kprobe_blackpoint kprobe_blacklist[] = {
  * stepping on the instruction on a vmalloced/kmalloced/data page
  * is a recipe for disaster
  */
-#define INSNS_PER_PAGE  (PAGE_SIZE/(MAX_INSN_SIZE * sizeof(kprobe_opcode_t)))
-
 struct kprobe_insn_page {
         struct list_head list;
         kprobe_opcode_t *insns;         /* Page of instruction slots */
-        char slot_used[INSNS_PER_PAGE];
         int nused;
         int ngarbage;
+        char slot_used[];
+};
+
+#define KPROBE_INSN_PAGE_SIZE(slots)                    \
+        (offsetof(struct kprobe_insn_page, slot_used) + \
+         (sizeof(char) * (slots)))
+
+struct kprobe_insn_cache {
+        struct list_head pages; /* list of kprobe_insn_page */
+        size_t insn_size;       /* size of instruction slot */
+        int nr_garbage;
 };
 
+static int slots_per_page(struct kprobe_insn_cache *c)
+{
+        return PAGE_SIZE/(c->insn_size * sizeof(kprobe_opcode_t));
+}
+
 enum kprobe_slot_state {
         SLOT_CLEAN = 0,
         SLOT_DIRTY = 1,
         SLOT_USED = 2,
 };
 
-static DEFINE_MUTEX(kprobe_insn_mutex); /* Protects kprobe_insn_pages */
-static LIST_HEAD(kprobe_insn_pages);
-static int kprobe_garbage_slots;
-static int collect_garbage_slots(void);
+static DEFINE_MUTEX(kprobe_insn_mutex); /* Protects kprobe_insn_slots */
+static struct kprobe_insn_cache kprobe_insn_slots = {
+        .pages = LIST_HEAD_INIT(kprobe_insn_slots.pages),
+        .insn_size = MAX_INSN_SIZE,
+        .nr_garbage = 0,
+};
+static int __kprobes collect_garbage_slots(struct kprobe_insn_cache *c);
 
 /**
  * __get_insn_slot() - Find a slot on an executable page for an instruction.
  * We allocate an executable page if there's no room on existing ones.
  */
-static kprobe_opcode_t __kprobes *__get_insn_slot(void)
+static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
 {
         struct kprobe_insn_page *kip;
 
  retry:
-        list_for_each_entry(kip, &kprobe_insn_pages, list) {
-                if (kip->nused < INSNS_PER_PAGE) {
+        list_for_each_entry(kip, &c->pages, list) {
+                if (kip->nused < slots_per_page(c)) {
                         int i;
-                        for (i = 0; i < INSNS_PER_PAGE; i++) {
+                        for (i = 0; i < slots_per_page(c); i++) {
                                 if (kip->slot_used[i] == SLOT_CLEAN) {
                                         kip->slot_used[i] = SLOT_USED;
                                         kip->nused++;
-                                        return kip->insns + (i * MAX_INSN_SIZE);
+                                        return kip->insns + (i * c->insn_size);
                                 }
                         }
-                        /* Surprise!  No unused slots.  Fix kip->nused. */
-                        kip->nused = INSNS_PER_PAGE;
+                        /* kip->nused is broken. Fix it. */
+                        kip->nused = slots_per_page(c);
+                        WARN_ON(1);
                 }
         }
 
         /* If there are any garbage slots, collect it and try again. */
-        if (kprobe_garbage_slots && collect_garbage_slots() == 0) {
+        if (c->nr_garbage && collect_garbage_slots(c) == 0)
                 goto retry;
-        }
-        /* All out of space.  Need to allocate a new page. Use slot 0. */
-        kip = kmalloc(sizeof(struct kprobe_insn_page), GFP_KERNEL);
+
+        /* All out of space.  Need to allocate a new page. */
+        kip = kmalloc(KPROBE_INSN_PAGE_SIZE(slots_per_page(c)), GFP_KERNEL);
         if (!kip)
                 return NULL;
 
@@ -170,20 +189,23 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(void)
                 return NULL;
         }
         INIT_LIST_HEAD(&kip->list);
-        list_add(&kip->list, &kprobe_insn_pages);
-        memset(kip->slot_used, SLOT_CLEAN, INSNS_PER_PAGE);
+        memset(kip->slot_used, SLOT_CLEAN, slots_per_page(c));
         kip->slot_used[0] = SLOT_USED;
         kip->nused = 1;
         kip->ngarbage = 0;
+        list_add(&kip->list, &c->pages);
         return kip->insns;
 }
 
+
 kprobe_opcode_t __kprobes *get_insn_slot(void)
 {
-        kprobe_opcode_t *ret;
+        kprobe_opcode_t *ret = NULL;
+
         mutex_lock(&kprobe_insn_mutex);
-        ret = __get_insn_slot();
+        ret = __get_insn_slot(&kprobe_insn_slots);
         mutex_unlock(&kprobe_insn_mutex);
+
         return ret;
 }
 
@@ -199,7 +221,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
                  * so as not to have to set it up again the
                  * next time somebody inserts a probe.
                  */
-                if (!list_is_singular(&kprobe_insn_pages)) {
+                if (!list_is_singular(&kip->list)) {
                         list_del(&kip->list);
                         module_free(NULL, kip->insns);
                         kfree(kip);
@@ -209,51 +231,85 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
         return 0;
 }
 
-static int __kprobes collect_garbage_slots(void)
+static int __kprobes collect_garbage_slots(struct kprobe_insn_cache *c)
 {
         struct kprobe_insn_page *kip, *next;
 
         /* Ensure no-one is interrupted on the garbages */
         synchronize_sched();
 
-        list_for_each_entry_safe(kip, next, &kprobe_insn_pages, list) {
+        list_for_each_entry_safe(kip, next, &c->pages, list) {
                 int i;
                 if (kip->ngarbage == 0)
                         continue;
                 kip->ngarbage = 0;      /* we will collect all garbages */
-                for (i = 0; i < INSNS_PER_PAGE; i++) {
+                for (i = 0; i < slots_per_page(c); i++) {
                         if (kip->slot_used[i] == SLOT_DIRTY &&
                             collect_one_slot(kip, i))
                                 break;
                 }
         }
-        kprobe_garbage_slots = 0;
+        c->nr_garbage = 0;
         return 0;
 }
 
-void __kprobes free_insn_slot(kprobe_opcode_t * slot, int dirty)
+static void __kprobes __free_insn_slot(struct kprobe_insn_cache *c,
+                                       kprobe_opcode_t *slot, int dirty)
 {
         struct kprobe_insn_page *kip;
 
-        mutex_lock(&kprobe_insn_mutex);
-        list_for_each_entry(kip, &kprobe_insn_pages, list) {
-                if (kip->insns <= slot &&
-                    slot < kip->insns + (INSNS_PER_PAGE * MAX_INSN_SIZE)) {
-                        int i = (slot - kip->insns) / MAX_INSN_SIZE;
+        list_for_each_entry(kip, &c->pages, list) {
+                long idx = ((long)slot - (long)kip->insns) /
+                                (c->insn_size * sizeof(kprobe_opcode_t));
+                if (idx >= 0 && idx < slots_per_page(c)) {
+                        WARN_ON(kip->slot_used[idx] != SLOT_USED);
                         if (dirty) {
-                                kip->slot_used[i] = SLOT_DIRTY;
+                                kip->slot_used[idx] = SLOT_DIRTY;
                                 kip->ngarbage++;
+                                if (++c->nr_garbage > slots_per_page(c))
+                                        collect_garbage_slots(c);
                         } else
-                                collect_one_slot(kip, i);
-                        break;
+                                collect_one_slot(kip, idx);
+                        return;
                 }
         }
+        /* Could not free this slot. */
+        WARN_ON(1);
+}
 
-        if (dirty && ++kprobe_garbage_slots > INSNS_PER_PAGE)
-                collect_garbage_slots();
-
+void __kprobes free_insn_slot(kprobe_opcode_t * slot, int dirty)
+{
+        mutex_lock(&kprobe_insn_mutex);
+        __free_insn_slot(&kprobe_insn_slots, slot, dirty);
         mutex_unlock(&kprobe_insn_mutex);
 }
+#ifdef CONFIG_OPTPROBES
+/* For optimized_kprobe buffer */
+static DEFINE_MUTEX(kprobe_optinsn_mutex); /* Protects kprobe_optinsn_slots */
+static struct kprobe_insn_cache kprobe_optinsn_slots = {
+        .pages = LIST_HEAD_INIT(kprobe_optinsn_slots.pages),
+        /* .insn_size is initialized later */
+        .nr_garbage = 0,
+};
+/* Get a slot for optimized_kprobe buffer */
+kprobe_opcode_t __kprobes *get_optinsn_slot(void)
+{
+        kprobe_opcode_t *ret = NULL;
+
+        mutex_lock(&kprobe_optinsn_mutex);
+        ret = __get_insn_slot(&kprobe_optinsn_slots);
+        mutex_unlock(&kprobe_optinsn_mutex);
+
+        return ret;
+}
+
+void __kprobes free_optinsn_slot(kprobe_opcode_t * slot, int dirty)
+{
+        mutex_lock(&kprobe_optinsn_mutex);
+        __free_insn_slot(&kprobe_optinsn_slots, slot, dirty);
+        mutex_unlock(&kprobe_optinsn_mutex);
+}
+#endif
 #endif
 
 /* We have preemption disabled.. so it is safe to use __ versions */
@@ -284,23 +340,401 @@ struct kprobe __kprobes *get_kprobe(void *addr)
                 if (p->addr == addr)
                         return p;
         }
+
         return NULL;
 }
 
+static int __kprobes aggr_pre_handler(struct kprobe *p, struct pt_regs *regs);
+
+/* Return true if the kprobe is an aggregator */
+static inline int kprobe_aggrprobe(struct kprobe *p)
+{
+        return p->pre_handler == aggr_pre_handler;
+}
+
+/*
+ * Keep all fields in the kprobe consistent
+ */
+static inline void copy_kprobe(struct kprobe *old_p, struct kprobe *p)
+{
+        memcpy(&p->opcode, &old_p->opcode, sizeof(kprobe_opcode_t));
+        memcpy(&p->ainsn, &old_p->ainsn, sizeof(struct arch_specific_insn));
+}
+
+#ifdef CONFIG_OPTPROBES
+/* NOTE: change this value only with kprobe_mutex held */
+static bool kprobes_allow_optimization;
+
+/*
+ * Call all pre_handler on the list, but ignores its return value.
+ * This must be called from arch-dep optimized caller.
+ */
+void __kprobes opt_pre_handler(struct kprobe *p, struct pt_regs *regs)
+{
+        struct kprobe *kp;
+
+        list_for_each_entry_rcu(kp, &p->list, list) {
+                if (kp->pre_handler && likely(!kprobe_disabled(kp))) {
+                        set_kprobe_instance(kp);
+                        kp->pre_handler(kp, regs);
+                }
+                reset_kprobe_instance();
+        }
+}
+
+/* Return true(!0) if the kprobe is ready for optimization. */
+static inline int kprobe_optready(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        if (kprobe_aggrprobe(p)) {
+                op = container_of(p, struct optimized_kprobe, kp);
+                return arch_prepared_optinsn(&op->optinsn);
+        }
+
+        return 0;
+}
+
+/*
+ * Return an optimized kprobe whose optimizing code replaces
+ * instructions including addr (exclude breakpoint).
+ */
+struct kprobe *__kprobes get_optimized_kprobe(unsigned long addr)
+{
+        int i;
+        struct kprobe *p = NULL;
+        struct optimized_kprobe *op;
+
+        /* Don't check i == 0, since that is a breakpoint case. */
+        for (i = 1; !p && i < MAX_OPTIMIZED_LENGTH; i++)
+                p = get_kprobe((void *)(addr - i));
+
+        if (p && kprobe_optready(p)) {
+                op = container_of(p, struct optimized_kprobe, kp);
+                if (arch_within_optimized_kprobe(op, addr))
+                        return p;
+        }
+
+        return NULL;
+}
+
+/* Optimization staging list, protected by kprobe_mutex */
+static LIST_HEAD(optimizing_list);
+
+static void kprobe_optimizer(struct work_struct *work);
+static DECLARE_DELAYED_WORK(optimizing_work, kprobe_optimizer);
+#define OPTIMIZE_DELAY 5
+
+/* Kprobe jump optimizer */
+static __kprobes void kprobe_optimizer(struct work_struct *work)
+{
+        struct optimized_kprobe *op, *tmp;
+
+        /* Lock modules while optimizing kprobes */
+        mutex_lock(&module_mutex);
+        mutex_lock(&kprobe_mutex);
+        if (kprobes_all_disarmed || !kprobes_allow_optimization)
+                goto end;
+
+        /*
+         * Wait for quiesence period to ensure all running interrupts
+         * are done. Because optprobe may modify multiple instructions
+         * there is a chance that Nth instruction is interrupted. In that
+         * case, running interrupt can return to 2nd-Nth byte of jump
+         * instruction. This wait is for avoiding it.
+         */
+        synchronize_sched();
+
+        /*
+         * The optimization/unoptimization refers online_cpus via
+         * stop_machine() and cpu-hotplug modifies online_cpus.
+         * And same time, text_mutex will be held in cpu-hotplug and here.
+         * This combination can cause a deadlock (cpu-hotplug try to lock
+         * text_mutex but stop_machine can not be done because online_cpus
+         * has been changed)
+         * To avoid this deadlock, we need to call get_online_cpus()
+         * for preventing cpu-hotplug outside of text_mutex locking.
+         */
+        get_online_cpus();
+        mutex_lock(&text_mutex);
+        list_for_each_entry_safe(op, tmp, &optimizing_list, list) {
+                WARN_ON(kprobe_disabled(&op->kp));
+                if (arch_optimize_kprobe(op) < 0)
+                        op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+                list_del_init(&op->list);
+        }
+        mutex_unlock(&text_mutex);
+        put_online_cpus();
+end:
+        mutex_unlock(&kprobe_mutex);
+        mutex_unlock(&module_mutex);
+}
+
+/* Optimize kprobe if p is ready to be optimized */
+static __kprobes void optimize_kprobe(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        /* Check if the kprobe is disabled or not ready for optimization. */
+        if (!kprobe_optready(p) || !kprobes_allow_optimization ||
+            (kprobe_disabled(p) || kprobes_all_disarmed))
+                return;
+
+        /* Both of break_handler and post_handler are not supported. */
+        if (p->break_handler || p->post_handler)
+                return;
+
+        op = container_of(p, struct optimized_kprobe, kp);
+
+        /* Check there is no other kprobes at the optimized instructions */
+        if (arch_check_optimized_kprobe(op) < 0)
+                return;
+
+        /* Check if it is already optimized. */
+        if (op->kp.flags & KPROBE_FLAG_OPTIMIZED)
+                return;
+
+        op->kp.flags |= KPROBE_FLAG_OPTIMIZED;
+        list_add(&op->list, &optimizing_list);
+        if (!delayed_work_pending(&optimizing_work))
+                schedule_delayed_work(&optimizing_work, OPTIMIZE_DELAY);
+}
+
+/* Unoptimize a kprobe if p is optimized */
+static __kprobes void unoptimize_kprobe(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        if ((p->flags & KPROBE_FLAG_OPTIMIZED) && kprobe_aggrprobe(p)) {
+                op = container_of(p, struct optimized_kprobe, kp);
+                if (!list_empty(&op->list))
+                        /* Dequeue from the optimization queue */
+                        list_del_init(&op->list);
+                else
+                        /* Replace jump with break */
+                        arch_unoptimize_kprobe(op);
+                op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+        }
+}
+
+/* Remove optimized instructions */
+static void __kprobes kill_optimized_kprobe(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        op = container_of(p, struct optimized_kprobe, kp);
+        if (!list_empty(&op->list)) {
+                /* Dequeue from the optimization queue */
+                list_del_init(&op->list);
+                op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+        }
+        /* Don't unoptimize, because the target code will be freed. */
+        arch_remove_optimized_kprobe(op);
+}
+
+/* Try to prepare optimized instructions */
+static __kprobes void prepare_optimized_kprobe(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        op = container_of(p, struct optimized_kprobe, kp);
+        arch_prepare_optimized_kprobe(op);
+}
+
+/* Free optimized instructions and optimized_kprobe */
+static __kprobes void free_aggr_kprobe(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        op = container_of(p, struct optimized_kprobe, kp);
+        arch_remove_optimized_kprobe(op);
+        kfree(op);
+}
+
+/* Allocate new optimized_kprobe and try to prepare optimized instructions */
+static __kprobes struct kprobe *alloc_aggr_kprobe(struct kprobe *p)
+{
+        struct optimized_kprobe *op;
+
+        op = kzalloc(sizeof(struct optimized_kprobe), GFP_KERNEL);
+        if (!op)
+                return NULL;
+
+        INIT_LIST_HEAD(&op->list);
+        op->kp.addr = p->addr;
+        arch_prepare_optimized_kprobe(op);
+
+        return &op->kp;
+}
+
+static void __kprobes init_aggr_kprobe(struct kprobe *ap, struct kprobe *p);
+
+/*
+ * Prepare an optimized_kprobe and optimize it
+ * NOTE: p must be a normal registered kprobe
+ */
+static __kprobes void try_to_optimize_kprobe(struct kprobe *p)
+{
+        struct kprobe *ap;
+        struct optimized_kprobe *op;
+
+        ap = alloc_aggr_kprobe(p);
+        if (!ap)
+                return;
+
+        op = container_of(ap, struct optimized_kprobe, kp);
+        if (!arch_prepared_optinsn(&op->optinsn)) {
+                /* If failed to setup optimizing, fallback to kprobe */
+                free_aggr_kprobe(ap);
+                return;
+        }
+
+        init_aggr_kprobe(ap, p);
+        optimize_kprobe(ap);
+}
+
+#ifdef CONFIG_SYSCTL
+static void __kprobes optimize_all_kprobes(void)
+{
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct kprobe *p;
+        unsigned int i;
+
+        /* If optimization is already allowed, just return */
+        if (kprobes_allow_optimization)
+                return;
+
+        kprobes_allow_optimization = true;
+        mutex_lock(&text_mutex);
+        for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
+                head = &kprobe_table[i];
+                hlist_for_each_entry_rcu(p, node, head, hlist)
+                        if (!kprobe_disabled(p))
+                                optimize_kprobe(p);
+        }
+        mutex_unlock(&text_mutex);
+        printk(KERN_INFO "Kprobes globally optimized\n");
+}
+
+static void __kprobes unoptimize_all_kprobes(void)
+{
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct kprobe *p;
+        unsigned int i;
+
+        /* If optimization is already prohibited, just return */
+        if (!kprobes_allow_optimization)
+                return;
+
+        kprobes_allow_optimization = false;
+        printk(KERN_INFO "Kprobes globally unoptimized\n");
+        get_online_cpus();      /* For avoiding text_mutex deadlock */
+        mutex_lock(&text_mutex);
+        for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
+                head = &kprobe_table[i];
+                hlist_for_each_entry_rcu(p, node, head, hlist) {
+                        if (!kprobe_disabled(p))
+                                unoptimize_kprobe(p);
+                }
+        }
+
+        mutex_unlock(&text_mutex);
+        put_online_cpus();
+        /* Allow all currently running kprobes to complete */
+        synchronize_sched();
+}
+
+int sysctl_kprobes_optimization;
+int proc_kprobes_optimization_handler(struct ctl_table *table, int write,
+                                      void __user *buffer, size_t *length,
+                                      loff_t *ppos)
+{
+        int ret;
+
+        mutex_lock(&kprobe_mutex);
+        sysctl_kprobes_optimization = kprobes_allow_optimization ? 1 : 0;
+        ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
+
+        if (sysctl_kprobes_optimization)
+                optimize_all_kprobes();
+        else
+                unoptimize_all_kprobes();
+        mutex_unlock(&kprobe_mutex);
+
+        return ret;
+}
+#endif /* CONFIG_SYSCTL */
+
+static void __kprobes __arm_kprobe(struct kprobe *p)
+{
+        struct kprobe *old_p;
+
+        /* Check collision with other optimized kprobes */
+        old_p = get_optimized_kprobe((unsigned long)p->addr);
+        if (unlikely(old_p))
+                unoptimize_kprobe(old_p); /* Fallback to unoptimized kprobe */
+
+        arch_arm_kprobe(p);
+        optimize_kprobe(p);     /* Try to optimize (add kprobe to a list) */
+}
+
+static void __kprobes __disarm_kprobe(struct kprobe *p)
+{
+        struct kprobe *old_p;
+
+        unoptimize_kprobe(p);   /* Try to unoptimize */
+        arch_disarm_kprobe(p);
+
+        /* If another kprobe was blocked, optimize it. */
+        old_p = get_optimized_kprobe((unsigned long)p->addr);
+        if (unlikely(old_p))
+                optimize_kprobe(old_p);
+}
+
+#else /* !CONFIG_OPTPROBES */
+
+#define optimize_kprobe(p)                      do {} while (0)
+#define unoptimize_kprobe(p)                    do {} while (0)
+#define kill_optimized_kprobe(p)                do {} while (0)
+#define prepare_optimized_kprobe(p)             do {} while (0)
+#define try_to_optimize_kprobe(p)               do {} while (0)
+#define __arm_kprobe(p)                         arch_arm_kprobe(p)
+#define __disarm_kprobe(p)                      arch_disarm_kprobe(p)
+
+static __kprobes void free_aggr_kprobe(struct kprobe *p)
+{
+        kfree(p);
+}
+
+static __kprobes struct kprobe *alloc_aggr_kprobe(struct kprobe *p)
+{
+        return kzalloc(sizeof(struct kprobe), GFP_KERNEL);
+}
+#endif /* CONFIG_OPTPROBES */
+
 /* Arm a kprobe with text_mutex */
 static void __kprobes arm_kprobe(struct kprobe *kp)
 {
+        /*
+         * Here, since __arm_kprobe() doesn't use stop_machine(),
+         * this doesn't cause deadlock on text_mutex. So, we don't
+         * need get_online_cpus().
+         */
         mutex_lock(&text_mutex);
-        arch_arm_kprobe(kp);
+        __arm_kprobe(kp);
         mutex_unlock(&text_mutex);
 }
 
 /* Disarm a kprobe with text_mutex */
 static void __kprobes disarm_kprobe(struct kprobe *kp)
 {
+        get_online_cpus();      /* For avoiding text_mutex deadlock */
         mutex_lock(&text_mutex);
-        arch_disarm_kprobe(kp);
+        __disarm_kprobe(kp);
         mutex_unlock(&text_mutex);
+        put_online_cpus();
 }
 
 /*
@@ -369,7 +803,7 @@ static int __kprobes aggr_break_handler(struct kprobe *p, struct pt_regs *regs)
 void __kprobes kprobes_inc_nmissed_count(struct kprobe *p)
 {
         struct kprobe *kp;
-        if (p->pre_handler != aggr_pre_handler) {
+        if (!kprobe_aggrprobe(p)) {
                 p->nmissed++;
         } else {
                 list_for_each_entry_rcu(kp, &p->list, list)
@@ -493,21 +927,16 @@ static void __kprobes cleanup_rp_inst(struct kretprobe *rp)
 }
 
 /*
- * Keep all fields in the kprobe consistent
- */
-static inline void copy_kprobe(struct kprobe *old_p, struct kprobe *p)
-{
-        memcpy(&p->opcode, &old_p->opcode, sizeof(kprobe_opcode_t));
-        memcpy(&p->ainsn, &old_p->ainsn, sizeof(struct arch_specific_insn));
-}
-
-/*
 * Add the new probe to ap->list. Fail if this is the
 * second jprobe at the address - two jprobes can't coexist
 */
 static int __kprobes add_new_kprobe(struct kprobe *ap, struct kprobe *p)
 {
         BUG_ON(kprobe_gone(ap) || kprobe_gone(p));
+
+        if (p->break_handler || p->post_handler)
+                unoptimize_kprobe(ap);  /* Fall back to normal kprobe */
+
         if (p->break_handler) {
                 if (ap->break_handler)
                         return -EEXIST;
@@ -522,7 +951,7 @@ static int __kprobes add_new_kprobe(struct kprobe *ap, struct kprobe *p)
                 ap->flags &= ~KPROBE_FLAG_DISABLED;
                 if (!kprobes_all_disarmed)
                         /* Arm the breakpoint again. */
-                        arm_kprobe(ap);
+                        __arm_kprobe(ap);
         }
         return 0;
 }
@@ -531,12 +960,13 @@ static int __kprobes add_new_kprobe(struct kprobe *ap, struct kprobe *p)
  * Fill in the required fields of the "manager kprobe". Replace the
  * earlier kprobe in the hlist with the manager kprobe
  */
-static inline void add_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
+static void __kprobes init_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
 {
+        /* Copy p's insn slot to ap */
         copy_kprobe(p, ap);
         flush_insn_slot(ap);
         ap->addr = p->addr;
-        ap->flags = p->flags;
+        ap->flags = p->flags & ~KPROBE_FLAG_OPTIMIZED;
         ap->pre_handler = aggr_pre_handler;
         ap->fault_handler = aggr_fault_handler;
         /* We don't care the kprobe which has gone. */
@@ -546,8 +976,9 @@ static inline void add_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
                 ap->break_handler = aggr_break_handler;
 
         INIT_LIST_HEAD(&ap->list);
-        list_add_rcu(&p->list, &ap->list);
+        INIT_HLIST_NODE(&ap->hlist);
 
+        list_add_rcu(&p->list, &ap->list);
         hlist_replace_rcu(&p->hlist, &ap->hlist);
 }
 
@@ -561,12 +992,12 @@ static int __kprobes register_aggr_kprobe(struct kprobe *old_p,
         int ret = 0;
         struct kprobe *ap = old_p;
 
-        if (old_p->pre_handler != aggr_pre_handler) {
-                /* If old_p is not an aggr_probe, create new aggr_kprobe. */
-                ap = kzalloc(sizeof(struct kprobe), GFP_KERNEL);
+        if (!kprobe_aggrprobe(old_p)) {
+                /* If old_p is not an aggr_kprobe, create new aggr_kprobe. */
+                ap = alloc_aggr_kprobe(old_p);
                 if (!ap)
                         return -ENOMEM;
-                add_aggr_kprobe(ap, old_p);
+                init_aggr_kprobe(ap, old_p);
         }
 
         if (kprobe_gone(ap)) {
@@ -585,6 +1016,9 @@ static int __kprobes register_aggr_kprobe(struct kprobe *old_p,
                          */
                         return ret;
 
+                /* Prepare optimized instructions if possible. */
+                prepare_optimized_kprobe(ap);
+
                 /*
                  * Clear gone flag to prevent allocating new slot again, and
                  * set disabled flag because it is not armed yet.
@@ -593,6 +1027,7 @@ static int __kprobes register_aggr_kprobe(struct kprobe *old_p,
                             | KPROBE_FLAG_DISABLED;
         }
 
+        /* Copy ap's insn slot to p */
         copy_kprobe(ap, p);
         return add_new_kprobe(ap, p);
 }
@@ -743,27 +1178,34 @@ int __kprobes register_kprobe(struct kprobe *p)
         p->nmissed = 0;
         INIT_LIST_HEAD(&p->list);
         mutex_lock(&kprobe_mutex);
+
+        get_online_cpus();      /* For avoiding text_mutex deadlock. */
+        mutex_lock(&text_mutex);
+
         old_p = get_kprobe(p->addr);
         if (old_p) {
+                /* Since this may unoptimize old_p, locking text_mutex. */
                 ret = register_aggr_kprobe(old_p, p);
                 goto out;
         }
 
-        mutex_lock(&text_mutex);
         ret = arch_prepare_kprobe(p);
         if (ret)
-                goto out_unlock_text;
+                goto out;
 
         INIT_HLIST_NODE(&p->hlist);
         hlist_add_head_rcu(&p->hlist,
                        &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
 
         if (!kprobes_all_disarmed && !kprobe_disabled(p))
-                arch_arm_kprobe(p);
+                __arm_kprobe(p);
+
+        /* Try to optimize kprobe */
+        try_to_optimize_kprobe(p);
 
-out_unlock_text:
-        mutex_unlock(&text_mutex);
 out:
+        mutex_unlock(&text_mutex);
+        put_online_cpus();
         mutex_unlock(&kprobe_mutex);
 
         if (probed_mod)
@@ -785,7 +1227,7 @@ static int __kprobes __unregister_kprobe_top(struct kprobe *p)
                 return -EINVAL;
 
         if (old_p == p ||
-            (old_p->pre_handler == aggr_pre_handler &&
+            (kprobe_aggrprobe(old_p) &&
              list_is_singular(&old_p->list))) {
                 /*
                  * Only probe on the hash list. Disarm only if kprobes are
@@ -793,7 +1235,7 @@ static int __kprobes __unregister_kprobe_top(struct kprobe *p)
                  * already have been removed. We save on flushing icache.
                  */
                 if (!kprobes_all_disarmed && !kprobe_disabled(old_p))
-                        disarm_kprobe(p);
+                        disarm_kprobe(old_p);
                 hlist_del_rcu(&old_p->hlist);
         } else {
                 if (p->break_handler && !kprobe_gone(p))
@@ -809,8 +1251,13 @@ noclean:
                 list_del_rcu(&p->list);
                 if (!kprobe_disabled(old_p)) {
                         try_to_disable_aggr_kprobe(old_p);
-                        if (!kprobes_all_disarmed && kprobe_disabled(old_p))
-                                disarm_kprobe(old_p);
+                        if (!kprobes_all_disarmed) {
+                                if (kprobe_disabled(old_p))
+                                        disarm_kprobe(old_p);
+                                else
+                                        /* Try to optimize this probe again */
+                                        optimize_kprobe(old_p);
+                        }
                 }
         }
         return 0;
@@ -827,7 +1274,7 @@ static void __kprobes __unregister_kprobe_bottom(struct kprobe *p)
                 old_p = list_entry(p->list.next, struct kprobe, list);
                 list_del(&p->list);
                 arch_remove_kprobe(old_p);
-                kfree(old_p);
+                free_aggr_kprobe(old_p);
         }
 }
 
@@ -1123,7 +1570,7 @@ static void __kprobes kill_kprobe(struct kprobe *p)
         struct kprobe *kp;
 
         p->flags |= KPROBE_FLAG_GONE;
-        if (p->pre_handler == aggr_pre_handler) {
+        if (kprobe_aggrprobe(p)) {
                 /*
                  * If this is an aggr_kprobe, we have to list all the
                  * chained probes and mark them GONE.
@@ -1132,6 +1579,7 @@ static void __kprobes kill_kprobe(struct kprobe *p)
                         kp->flags |= KPROBE_FLAG_GONE;
                 p->post_handler = NULL;
                 p->break_handler = NULL;
+                kill_optimized_kprobe(p);
         }
         /*
          * Here, we can remove insn_slot safely, because no thread calls
@@ -1140,6 +1588,72 @@ static void __kprobes kill_kprobe(struct kprobe *p)
         arch_remove_kprobe(p);
 }
 
+/* Disable one kprobe */
+int __kprobes disable_kprobe(struct kprobe *kp)
+{
+        int ret = 0;
+        struct kprobe *p;
+
+        mutex_lock(&kprobe_mutex);
+
+        /* Check whether specified probe is valid. */
+        p = __get_valid_kprobe(kp);
+        if (unlikely(p == NULL)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /* If the probe is already disabled (or gone), just return */
+        if (kprobe_disabled(kp))
+                goto out;
+
+        kp->flags |= KPROBE_FLAG_DISABLED;
+        if (p != kp)
+                /* When kp != p, p is always enabled. */
+                try_to_disable_aggr_kprobe(p);
+
+        if (!kprobes_all_disarmed && kprobe_disabled(p))
+                disarm_kprobe(p);
+out:
+        mutex_unlock(&kprobe_mutex);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(disable_kprobe);
+
+/* Enable one kprobe */
+int __kprobes enable_kprobe(struct kprobe *kp)
+{
+        int ret = 0;
+        struct kprobe *p;
+
+        mutex_lock(&kprobe_mutex);
+
+        /* Check whether specified probe is valid. */
+        p = __get_valid_kprobe(kp);
+        if (unlikely(p == NULL)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (kprobe_gone(kp)) {
+                /* This kprobe has gone, we couldn't enable it. */
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (p != kp)
+                kp->flags &= ~KPROBE_FLAG_DISABLED;
+
+        if (!kprobes_all_disarmed && kprobe_disabled(p)) {
+                p->flags &= ~KPROBE_FLAG_DISABLED;
+                arm_kprobe(p);
+        }
+out:
+        mutex_unlock(&kprobe_mutex);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(enable_kprobe);
+
 void __kprobes dump_kprobe(struct kprobe *kp)
 {
         printk(KERN_WARNING "Dumping kprobe:\n");
@@ -1241,6 +1755,15 @@ static int __init init_kprobes(void)
                 }
         }
 
+#if defined(CONFIG_OPTPROBES)
+#if defined(__ARCH_WANT_KPROBES_INSN_SLOT)
+        /* Init kprobe_optinsn_slots */
+        kprobe_optinsn_slots.insn_size = MAX_OPTINSN_SIZE;
+#endif
+        /* By default, kprobes can be optimized */
+        kprobes_allow_optimization = true;
+#endif
+
         /* By default, kprobes are armed */
         kprobes_all_disarmed = false;
 
@@ -1259,7 +1782,7 @@ static int __init init_kprobes(void)
 
 #ifdef CONFIG_DEBUG_FS
 static void __kprobes report_probe(struct seq_file *pi, struct kprobe *p,
-                const char *sym, int offset,char *modname)
+                const char *sym, int offset, char *modname, struct kprobe *pp)
 {
         char *kprobe_type;
 
@@ -1269,19 +1792,21 @@ static void __kprobes report_probe(struct seq_file *pi, struct kprobe *p,
                 kprobe_type = "j";
         else
                 kprobe_type = "k";
+
         if (sym)
-                seq_printf(pi, "%p  %s  %s+0x%x  %s %s%s\n",
+                seq_printf(pi, "%p  %s  %s+0x%x  %s ",
                         p->addr, kprobe_type, sym, offset,
-                        (modname ? modname : " "),
-                        (kprobe_gone(p) ? "[GONE]" : ""),
-                        ((kprobe_disabled(p) && !kprobe_gone(p)) ?
-                         "[DISABLED]" : ""));
+                        (modname ? modname : " "));
         else
-                seq_printf(pi, "%p  %s  %p %s%s\n",
-                        p->addr, kprobe_type, p->addr,
-                        (kprobe_gone(p) ? "[GONE]" : ""),
-                        ((kprobe_disabled(p) && !kprobe_gone(p)) ?
-                         "[DISABLED]" : ""));
+                seq_printf(pi, "%p  %s  %p ",
+                        p->addr, kprobe_type, p->addr);
+
+        if (!pp)
+                pp = p;
+        seq_printf(pi, "%s%s%s\n",
+                (kprobe_gone(p) ? "[GONE]" : ""),
+                ((kprobe_disabled(p) && !kprobe_gone(p)) ?  "[DISABLED]" : ""),
+                (kprobe_optimized(pp) ? "[OPTIMIZED]" : ""));
 }
 
 static void __kprobes *kprobe_seq_start(struct seq_file *f, loff_t *pos)
@@ -1317,11 +1842,11 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
         hlist_for_each_entry_rcu(p, node, head, hlist) {
                 sym = kallsyms_lookup((unsigned long)p->addr, NULL,
                                         &offset, &modname, namebuf);
-                if (p->pre_handler == aggr_pre_handler) {
+                if (kprobe_aggrprobe(p)) {
                         list_for_each_entry_rcu(kp, &p->list, list)
-                                report_probe(pi, kp, sym, offset, modname);
+                                report_probe(pi, kp, sym, offset, modname, p);
                 } else
-                        report_probe(pi, p, sym, offset, modname);
+                        report_probe(pi, p, sym, offset, modname, NULL);
         }
         preempt_enable();
         return 0;
@@ -1346,71 +1871,6 @@ static const struct file_operations debugfs_kprobes_operations = {
         .release        = seq_release,
 };
 
-/* Disable one kprobe */
-int __kprobes disable_kprobe(struct kprobe *kp)
-{
-        int ret = 0;
-        struct kprobe *p;
-
-        mutex_lock(&kprobe_mutex);
-
-        /* Check whether specified probe is valid. */
-        p = __get_valid_kprobe(kp);
-        if (unlikely(p == NULL)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* If the probe is already disabled (or gone), just return */
-        if (kprobe_disabled(kp))
-                goto out;
-
-        kp->flags |= KPROBE_FLAG_DISABLED;
-        if (p != kp)
-                /* When kp != p, p is always enabled. */
-                try_to_disable_aggr_kprobe(p);
-
-        if (!kprobes_all_disarmed && kprobe_disabled(p))
-                disarm_kprobe(p);
-out:
-        mutex_unlock(&kprobe_mutex);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(disable_kprobe);
-
-/* Enable one kprobe */
-int __kprobes enable_kprobe(struct kprobe *kp)
-{
-        int ret = 0;
-        struct kprobe *p;
-
-        mutex_lock(&kprobe_mutex);
-
-        /* Check whether specified probe is valid. */
-        p = __get_valid_kprobe(kp);
-        if (unlikely(p == NULL)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (kprobe_gone(kp)) {
-                /* This kprobe has gone, we couldn't enable it. */
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (!kprobes_all_disarmed && kprobe_disabled(p))
-                arm_kprobe(p);
-
-        p->flags &= ~KPROBE_FLAG_DISABLED;
-        if (p != kp)
-                kp->flags &= ~KPROBE_FLAG_DISABLED;
-out:
-        mutex_unlock(&kprobe_mutex);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(enable_kprobe);
-
 static void __kprobes arm_all_kprobes(void)
 {
         struct hlist_head *head;
@@ -1424,12 +1884,13 @@ static void __kprobes arm_all_kprobes(void)
         if (!kprobes_all_disarmed)
                 goto already_enabled;
 
+        /* Arming kprobes doesn't optimize kprobe itself */
         mutex_lock(&text_mutex);
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
                 hlist_for_each_entry_rcu(p, node, head, hlist)
                         if (!kprobe_disabled(p))
-                                arch_arm_kprobe(p);
+                                __arm_kprobe(p);
         }
         mutex_unlock(&text_mutex);
 
@@ -1456,16 +1917,23 @@ static void __kprobes disarm_all_kprobes(void)
 
         kprobes_all_disarmed = true;
         printk(KERN_INFO "Kprobes globally disabled\n");
+
+        /*
+         * Here we call get_online_cpus() for avoiding text_mutex deadlock,
+         * because disarming may also unoptimize kprobes.
+         */
+        get_online_cpus();
         mutex_lock(&text_mutex);
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
                 hlist_for_each_entry_rcu(p, node, head, hlist) {
                         if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p))
-                                arch_disarm_kprobe(p);
+                                __disarm_kprobe(p);
                 }
         }
 
         mutex_unlock(&text_mutex);
+        put_online_cpus();
         mutex_unlock(&kprobe_mutex);
         /* Allow all currently running kprobes to complete */
         synchronize_sched();
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 6b1ccc3f0205..21fe3c426948 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -33,7 +33,7 @@ static ssize_t uevent_seqnum_show(struct kobject *kobj,
 }
 KERNEL_ATTR_RO(uevent_seqnum);
 
-/* uevent helper program, used during early boo */
+/* uevent helper program, used during early boot */
 static ssize_t uevent_helper_show(struct kobject *kobj,
                                   struct kobj_attribute *attr, char *buf)
 {
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 82ed0ea15194..83911c780175 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -219,7 +219,7 @@ int kthreadd(void *unused)
         set_task_comm(tsk, "kthreadd");
         ignore_signals(tsk);
         set_cpus_allowed_ptr(tsk, cpu_all_mask);
-        set_mems_allowed(node_possible_map);
+        set_mems_allowed(node_states[N_HIGH_MEMORY]);
 
         current->flags |= PF_NOFREEZE | PF_FREEZER_NOSIG;
 
diff --git a/kernel/latencytop.c b/kernel/latencytop.c
index ca07c5c0c914..877fb306d415 100644
--- a/kernel/latencytop.c
+++ b/kernel/latencytop.c
@@ -56,7 +56,6 @@
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/list.h>
-#include <linux/slab.h>
 #include <linux/stacktrace.h>
 
 static DEFINE_SPINLOCK(latency_lock);
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 0c30d0455de1..ec21304856d1 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -43,6 +43,7 @@
 #include <linux/ftrace.h>
 #include <linux/stringify.h>
 #include <linux/bitops.h>
+#include <linux/gfp.h>
 
 #include <asm/sections.h>
 
@@ -430,20 +431,7 @@ static struct stack_trace lockdep_init_trace = {
 /*
  * Various lockdep statistics:
  */
-atomic_t chain_lookup_hits;
-atomic_t chain_lookup_misses;
-atomic_t hardirqs_on_events;
-atomic_t hardirqs_off_events;
-atomic_t redundant_hardirqs_on;
-atomic_t redundant_hardirqs_off;
-atomic_t softirqs_on_events;
-atomic_t softirqs_off_events;
-atomic_t redundant_softirqs_on;
-atomic_t redundant_softirqs_off;
-atomic_t nr_unused_locks;
-atomic_t nr_cyclic_checks;
-atomic_t nr_find_usage_forwards_checks;
-atomic_t nr_find_usage_backwards_checks;
+DEFINE_PER_CPU(struct lockdep_stats, lockdep_stats);
 #endif
 
 /*
@@ -582,9 +570,6 @@ static int static_obj(void *obj)
         unsigned long start = (unsigned long) &_stext,
                       end   = (unsigned long) &_end,
                       addr  = (unsigned long) obj;
-#ifdef CONFIG_SMP
-        int i;
-#endif
 
         /*
          * static variable?
@@ -595,24 +580,16 @@ static int static_obj(void *obj)
         if (arch_is_kernel_data(addr))
                 return 1;
 
-#ifdef CONFIG_SMP
         /*
-         * percpu var?
+         * in-kernel percpu var?
          */
-        for_each_possible_cpu(i) {
-                start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-                end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
-                                        + per_cpu_offset(i);
-
-                if ((addr >= start) && (addr < end))
-                        return 1;
-        }
-#endif
+        if (is_kernel_percpu_address(addr))
+                return 1;
 
         /*
-         * module var?
+         * module static or percpu var?
          */
-        return is_module_address(addr);
+        return is_module_address(addr) || is_module_percpu_address(addr);
 }
 
 /*
@@ -758,7 +735,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
                 return NULL;
         }
         class = lock_classes + nr_lock_classes++;
-        debug_atomic_inc(&nr_unused_locks);
+        debug_atomic_inc(nr_unused_locks);
         class->key = key;
         class->name = lock->name;
         class->subclass = subclass;
@@ -828,7 +805,8 @@ static struct lock_list *alloc_list_entry(void)
  * Add a new dependency to the head of the list:
  */
 static int add_lock_to_list(struct lock_class *class, struct lock_class *this,
-                            struct list_head *head, unsigned long ip, int distance)
+                            struct list_head *head, unsigned long ip,
+                            int distance, struct stack_trace *trace)
 {
         struct lock_list *entry;
         /*
@@ -839,11 +817,9 @@ static int add_lock_to_list(struct lock_class *class, struct lock_class *this,
         if (!entry)
                 return 0;
 
-        if (!save_trace(&entry->trace))
-                return 0;
-
         entry->class = this;
         entry->distance = distance;
+        entry->trace = *trace;
         /*
          * Since we never remove from the dependency list, the list can
          * be walked lockless by other CPUs, it's only allocation
@@ -1215,7 +1191,7 @@ check_noncircular(struct lock_list *root, struct lock_class *target,
 {
         int result;
 
-        debug_atomic_inc(&nr_cyclic_checks);
+        debug_atomic_inc(nr_cyclic_checks);
 
         result = __bfs_forwards(root, target, class_equal, target_entry);
 
@@ -1252,7 +1228,7 @@ find_usage_forwards(struct lock_list *root, enum lock_usage_bit bit,
 {
         int result;
 
-        debug_atomic_inc(&nr_find_usage_forwards_checks);
+        debug_atomic_inc(nr_find_usage_forwards_checks);
 
         result = __bfs_forwards(root, (void *)bit, usage_match, target_entry);
 
@@ -1275,7 +1251,7 @@ find_usage_backwards(struct lock_list *root, enum lock_usage_bit bit,
 {
         int result;
 
-        debug_atomic_inc(&nr_find_usage_backwards_checks);
+        debug_atomic_inc(nr_find_usage_backwards_checks);
 
         result = __bfs_backwards(root, (void *)bit, usage_match, target_entry);
 
@@ -1645,12 +1621,20 @@ check_deadlock(struct task_struct *curr, struct held_lock *next,
  */
 static int
 check_prev_add(struct task_struct *curr, struct held_lock *prev,
-               struct held_lock *next, int distance)
+               struct held_lock *next, int distance, int trylock_loop)
 {
         struct lock_list *entry;
         int ret;
         struct lock_list this;
         struct lock_list *uninitialized_var(target_entry);
+        /*
+         * Static variable, serialized by the graph_lock().
+         *
+         * We use this static variable to save the stack trace in case
+         * we call into this function multiple times due to encountering
+         * trylocks in the held lock stack.
+         */
+        static struct stack_trace trace;
 
         /*
          * Prove that the new <prev> -> <next> dependency would not
@@ -1698,20 +1682,23 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                 }
         }
 
+        if (!trylock_loop && !save_trace(&trace))
+                return 0;
+
         /*
          * Ok, all validations passed, add the new lock
          * to the previous lock's dependency list:
          */
         ret = add_lock_to_list(hlock_class(prev), hlock_class(next),
                                &hlock_class(prev)->locks_after,
-                               next->acquire_ip, distance);
+                               next->acquire_ip, distance, &trace);
 
         if (!ret)
                 return 0;
 
         ret = add_lock_to_list(hlock_class(next), hlock_class(prev),
                                &hlock_class(next)->locks_before,
-                               next->acquire_ip, distance);
+                               next->acquire_ip, distance, &trace);
         if (!ret)
                 return 0;
 
@@ -1741,6 +1728,7 @@ static int
 check_prevs_add(struct task_struct *curr, struct held_lock *next)
 {
         int depth = curr->lockdep_depth;
+        int trylock_loop = 0;
         struct held_lock *hlock;
 
         /*
@@ -1766,7 +1754,8 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                  * added:
                  */
                 if (hlock->read != 2) {
-                        if (!check_prev_add(curr, hlock, next, distance))
+                        if (!check_prev_add(curr, hlock, next,
+                                                distance, trylock_loop))
                                 return 0;
                         /*
                          * Stop after the first non-trylock entry,
@@ -1789,6 +1778,7 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                 if (curr->held_locks[depth].irq_context !=
                                 curr->held_locks[depth-1].irq_context)
                         break;
+                trylock_loop = 1;
         }
         return 1;
 out_bug:
@@ -1835,7 +1825,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
         list_for_each_entry(chain, hash_head, entry) {
                 if (chain->chain_key == chain_key) {
 cache_hit:
-                        debug_atomic_inc(&chain_lookup_hits);
+                        debug_atomic_inc(chain_lookup_hits);
                         if (very_verbose(class))
                                 printk("\nhash chain already cached, key: "
                                         "%016Lx tail class: [%p] %s\n",
@@ -1900,7 +1890,7 @@ cache_hit:
                 chain_hlocks[chain->base + j] = class - lock_classes;
         }
         list_add_tail_rcu(&chain->entry, hash_head);
-        debug_atomic_inc(&chain_lookup_misses);
+        debug_atomic_inc(chain_lookup_misses);
         inc_chains();
 
         return 1;
@@ -2321,7 +2311,12 @@ void trace_hardirqs_on_caller(unsigned long ip)
                 return;
 
         if (unlikely(curr->hardirqs_enabled)) {
-                debug_atomic_inc(&redundant_hardirqs_on);
+                /*
+                 * Neither irq nor preemption are disabled here
+                 * so this is racy by nature but loosing one hit
+                 * in a stat is not a big deal.
+                 */
+                __debug_atomic_inc(redundant_hardirqs_on);
                 return;
         }
         /* we'll do an OFF -> ON transition: */
@@ -2348,7 +2343,7 @@ void trace_hardirqs_on_caller(unsigned long ip)
 
         curr->hardirq_enable_ip = ip;
         curr->hardirq_enable_event = ++curr->irq_events;
-        debug_atomic_inc(&hardirqs_on_events);
+        debug_atomic_inc(hardirqs_on_events);
 }
 EXPORT_SYMBOL(trace_hardirqs_on_caller);
 
@@ -2380,9 +2375,9 @@ void trace_hardirqs_off_caller(unsigned long ip)
                 curr->hardirqs_enabled = 0;
                 curr->hardirq_disable_ip = ip;
                 curr->hardirq_disable_event = ++curr->irq_events;
-                debug_atomic_inc(&hardirqs_off_events);
+                debug_atomic_inc(hardirqs_off_events);
         } else
-                debug_atomic_inc(&redundant_hardirqs_off);
+                debug_atomic_inc(redundant_hardirqs_off);
 }
 EXPORT_SYMBOL(trace_hardirqs_off_caller);
 
@@ -2406,7 +2401,7 @@ void trace_softirqs_on(unsigned long ip)
                 return;
 
         if (curr->softirqs_enabled) {
-                debug_atomic_inc(&redundant_softirqs_on);
+                debug_atomic_inc(redundant_softirqs_on);
                 return;
         }
 
@@ -2416,7 +2411,7 @@ void trace_softirqs_on(unsigned long ip)
         curr->softirqs_enabled = 1;
         curr->softirq_enable_ip = ip;
         curr->softirq_enable_event = ++curr->irq_events;
-        debug_atomic_inc(&softirqs_on_events);
+        debug_atomic_inc(softirqs_on_events);
         /*
          * We are going to turn softirqs on, so set the
          * usage bit for all held locks, if hardirqs are
@@ -2446,10 +2441,10 @@ void trace_softirqs_off(unsigned long ip)
                 curr->softirqs_enabled = 0;
                 curr->softirq_disable_ip = ip;
                 curr->softirq_disable_event = ++curr->irq_events;
-                debug_atomic_inc(&softirqs_off_events);
+                debug_atomic_inc(softirqs_off_events);
                 DEBUG_LOCKS_WARN_ON(!softirq_count());
         } else
-                debug_atomic_inc(&redundant_softirqs_off);
+                debug_atomic_inc(redundant_softirqs_off);
 }
 
 static void __lockdep_trace_alloc(gfp_t gfp_mask, unsigned long flags)
@@ -2654,7 +2649,7 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
                         return 0;
                 break;
         case LOCK_USED:
-                debug_atomic_dec(&nr_unused_locks);
+                debug_atomic_dec(nr_unused_locks);
                 break;
         default:
                 if (!debug_locks_off_graph_unlock())
@@ -2760,7 +2755,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
                 if (!class)
                         return 0;
         }
-        debug_atomic_inc((atomic_t *)&class->ops);
+        atomic_inc((atomic_t *)&class->ops);
         if (very_verbose(class)) {
                 printk("\nacquire class [%p] %s", class->key, class->name);
                 if (class->name_version > 1)
@@ -3211,8 +3206,6 @@ void lock_acquire(struct lockdep_map *lock, unsigned int subclass,
 {
         unsigned long flags;
 
-        trace_lock_acquire(lock, subclass, trylock, read, check, nest_lock, ip);
-
         if (unlikely(current->lockdep_recursion))
                 return;
 
@@ -3220,6 +3213,7 @@ void lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         check_flags(flags);
 
         current->lockdep_recursion = 1;
+        trace_lock_acquire(lock, subclass, trylock, read, check, nest_lock, ip);
         __lock_acquire(lock, subclass, trylock, read, check,
                        irqs_disabled_flags(flags), nest_lock, ip, 0);
         current->lockdep_recursion = 0;
@@ -3232,14 +3226,13 @@ void lock_release(struct lockdep_map *lock, int nested,
 {
         unsigned long flags;
 
-        trace_lock_release(lock, nested, ip);
-
         if (unlikely(current->lockdep_recursion))
                 return;
 
         raw_local_irq_save(flags);
         check_flags(flags);
         current->lockdep_recursion = 1;
+        trace_lock_release(lock, ip);
         __lock_release(lock, nested, ip);
         current->lockdep_recursion = 0;
         raw_local_irq_restore(flags);
@@ -3392,7 +3385,7 @@ found_it:
                 hlock->holdtime_stamp = now;
         }
 
-        trace_lock_acquired(lock, ip, waittime);
+        trace_lock_acquired(lock, ip);
 
         stats = get_lock_stats(hlock_class(hlock));
         if (waittime) {
@@ -3413,8 +3406,6 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip)
 {
         unsigned long flags;
 
-        trace_lock_contended(lock, ip);
-
         if (unlikely(!lock_stat))
                 return;
 
@@ -3424,6 +3415,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip)
         raw_local_irq_save(flags);
         check_flags(flags);
         current->lockdep_recursion = 1;
+        trace_lock_contended(lock, ip);
         __lock_contended(lock, ip);
         current->lockdep_recursion = 0;
         raw_local_irq_restore(flags);
@@ -3814,14 +3806,18 @@ void lockdep_rcu_dereference(const char *file, const int line)
 {
         struct task_struct *curr = current;
 
+#ifndef CONFIG_PROVE_RCU_REPEATEDLY
         if (!debug_locks_off())
                 return;
+#endif /* #ifdef CONFIG_PROVE_RCU_REPEATEDLY */
+        /* Note: the following can be executed concurrently, so be careful. */
         printk("\n===================================================\n");
         printk(  "[ INFO: suspicious rcu_dereference_check() usage. ]\n");
         printk(  "---------------------------------------------------\n");
         printk("%s:%d invoked rcu_dereference_check() without protection!\n",
                         file, line);
         printk("\nother info that might help us debug this:\n\n");
+        printk("\nrcu_scheduler_active = %d, debug_locks = %d\n", rcu_scheduler_active, debug_locks);
         lockdep_print_held_locks(curr);
         printk("\nstack backtrace:\n");
         dump_stack();
diff --git a/kernel/lockdep_internals.h b/kernel/lockdep_internals.h
index a2ee95ad1313..4f560cfedc8f 100644
--- a/kernel/lockdep_internals.h
+++ b/kernel/lockdep_internals.h
@@ -110,30 +110,60 @@ lockdep_count_backward_deps(struct lock_class *class)
 #endif
 
 #ifdef CONFIG_DEBUG_LOCKDEP
+
+#include <asm/local.h>
 /*
- * Various lockdep statistics:
+ * Various lockdep statistics.
+ * We want them per cpu as they are often accessed in fast path
+ * and we want to avoid too much cache bouncing.
  */
-extern atomic_t chain_lookup_hits;
-extern atomic_t chain_lookup_misses;
-extern atomic_t hardirqs_on_events;
-extern atomic_t hardirqs_off_events;
-extern atomic_t redundant_hardirqs_on;
-extern atomic_t redundant_hardirqs_off;
-extern atomic_t softirqs_on_events;
-extern atomic_t softirqs_off_events;
-extern atomic_t redundant_softirqs_on;
-extern atomic_t redundant_softirqs_off;
-extern atomic_t nr_unused_locks;
-extern atomic_t nr_cyclic_checks;
-extern atomic_t nr_cyclic_check_recursions;
-extern atomic_t nr_find_usage_forwards_checks;
-extern atomic_t nr_find_usage_forwards_recursions;
-extern atomic_t nr_find_usage_backwards_checks;
-extern atomic_t nr_find_usage_backwards_recursions;
-# define debug_atomic_inc(ptr)          atomic_inc(ptr)
-# define debug_atomic_dec(ptr)          atomic_dec(ptr)
-# define debug_atomic_read(ptr)         atomic_read(ptr)
+struct lockdep_stats {
+        int     chain_lookup_hits;
+        int     chain_lookup_misses;
+        int     hardirqs_on_events;
+        int     hardirqs_off_events;
+        int     redundant_hardirqs_on;
+        int     redundant_hardirqs_off;
+        int     softirqs_on_events;
+        int     softirqs_off_events;
+        int     redundant_softirqs_on;
+        int     redundant_softirqs_off;
+        int     nr_unused_locks;
+        int     nr_cyclic_checks;
+        int     nr_cyclic_check_recursions;
+        int     nr_find_usage_forwards_checks;
+        int     nr_find_usage_forwards_recursions;
+        int     nr_find_usage_backwards_checks;
+        int     nr_find_usage_backwards_recursions;
+};
+
+DECLARE_PER_CPU(struct lockdep_stats, lockdep_stats);
+
+#define __debug_atomic_inc(ptr)                                 \
+        this_cpu_inc(lockdep_stats.ptr);
+
+#define debug_atomic_inc(ptr)                   {               \
+        WARN_ON_ONCE(!irqs_disabled());                         \
+        __this_cpu_inc(lockdep_stats.ptr);                      \
+}
+
+#define debug_atomic_dec(ptr)                   {               \
+        WARN_ON_ONCE(!irqs_disabled());                         \
+        __this_cpu_dec(lockdep_stats.ptr);                      \
+}
+
+#define debug_atomic_read(ptr)          ({                              \
+        struct lockdep_stats *__cpu_lockdep_stats;                      \
+        unsigned long long __total = 0;                                 \
+        int __cpu;                                                      \
+        for_each_possible_cpu(__cpu) {                                  \
+                __cpu_lockdep_stats = &per_cpu(lockdep_stats, __cpu);   \
+                __total += __cpu_lockdep_stats->ptr;                    \
+        }                                                               \
+        __total;                                                        \
+})
 #else
+# define __debug_atomic_inc(ptr)        do { } while (0)
 # define debug_atomic_inc(ptr)          do { } while (0)
 # define debug_atomic_dec(ptr)          do { } while (0)
 # define debug_atomic_read(ptr)         0
diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
index d4aba4f3584c..59b76c8ce9d7 100644
--- a/kernel/lockdep_proc.c
+++ b/kernel/lockdep_proc.c
@@ -184,34 +184,34 @@ static const struct file_operations proc_lockdep_chains_operations = {
 static void lockdep_stats_debug_show(struct seq_file *m)
 {
 #ifdef CONFIG_DEBUG_LOCKDEP
-        unsigned int hi1 = debug_atomic_read(&hardirqs_on_events),
-                     hi2 = debug_atomic_read(&hardirqs_off_events),
-                     hr1 = debug_atomic_read(&redundant_hardirqs_on),
-                     hr2 = debug_atomic_read(&redundant_hardirqs_off),
-                     si1 = debug_atomic_read(&softirqs_on_events),
-                     si2 = debug_atomic_read(&softirqs_off_events),
-                     sr1 = debug_atomic_read(&redundant_softirqs_on),
-                     sr2 = debug_atomic_read(&redundant_softirqs_off);
-
-        seq_printf(m, " chain lookup misses:           %11u\n",
-                debug_atomic_read(&chain_lookup_misses));
-        seq_printf(m, " chain lookup hits:             %11u\n",
-                debug_atomic_read(&chain_lookup_hits));
-        seq_printf(m, " cyclic checks:                 %11u\n",
-                debug_atomic_read(&nr_cyclic_checks));
-        seq_printf(m, " find-mask forwards checks:     %11u\n",
-                debug_atomic_read(&nr_find_usage_forwards_checks));
-        seq_printf(m, " find-mask backwards checks:    %11u\n",
-                debug_atomic_read(&nr_find_usage_backwards_checks));
-
-        seq_printf(m, " hardirq on events:             %11u\n", hi1);
-        seq_printf(m, " hardirq off events:            %11u\n", hi2);
-        seq_printf(m, " redundant hardirq ons:         %11u\n", hr1);
-        seq_printf(m, " redundant hardirq offs:        %11u\n", hr2);
-        seq_printf(m, " softirq on events:             %11u\n", si1);
-        seq_printf(m, " softirq off events:            %11u\n", si2);
-        seq_printf(m, " redundant softirq ons:         %11u\n", sr1);
-        seq_printf(m, " redundant softirq offs:        %11u\n", sr2);
+        unsigned long long hi1 = debug_atomic_read(hardirqs_on_events),
+                           hi2 = debug_atomic_read(hardirqs_off_events),
+                           hr1 = debug_atomic_read(redundant_hardirqs_on),
+                           hr2 = debug_atomic_read(redundant_hardirqs_off),
+                           si1 = debug_atomic_read(softirqs_on_events),
+                           si2 = debug_atomic_read(softirqs_off_events),
+                           sr1 = debug_atomic_read(redundant_softirqs_on),
+                           sr2 = debug_atomic_read(redundant_softirqs_off);
+
+        seq_printf(m, " chain lookup misses:           %11llu\n",
+                debug_atomic_read(chain_lookup_misses));
+        seq_printf(m, " chain lookup hits:             %11llu\n",
+                debug_atomic_read(chain_lookup_hits));
+        seq_printf(m, " cyclic checks:                 %11llu\n",
+                debug_atomic_read(nr_cyclic_checks));
+        seq_printf(m, " find-mask forwards checks:     %11llu\n",
+                debug_atomic_read(nr_find_usage_forwards_checks));
+        seq_printf(m, " find-mask backwards checks:    %11llu\n",
+                debug_atomic_read(nr_find_usage_backwards_checks));
+
+        seq_printf(m, " hardirq on events:             %11llu\n", hi1);
+        seq_printf(m, " hardirq off events:            %11llu\n", hi2);
+        seq_printf(m, " redundant hardirq ons:         %11llu\n", hr1);
+        seq_printf(m, " redundant hardirq offs:        %11llu\n", hr2);
+        seq_printf(m, " softirq on events:             %11llu\n", si1);
+        seq_printf(m, " softirq off events:            %11llu\n", si2);
+        seq_printf(m, " redundant softirq ons:         %11llu\n", sr1);
+        seq_printf(m, " redundant softirq offs:        %11llu\n", sr2);
 #endif
 }
 
@@ -263,7 +263,7 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 #endif
         }
 #ifdef CONFIG_DEBUG_LOCKDEP
-        DEBUG_LOCKS_WARN_ON(debug_atomic_read(&nr_unused_locks) != nr_unused);
+        DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused);
 #endif
         seq_printf(m, " lock-classes:                  %11lu [max: %lu]\n",
                         nr_lock_classes, MAX_LOCKDEP_KEYS);
diff --git a/kernel/module.c b/kernel/module.c
index f82386bd9ee9..e2564580f3f1 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -59,8 +59,6 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
 
-EXPORT_TRACEPOINT_SYMBOL(module_get);
-
 #if 0
 #define DEBUGP printk
 #else
@@ -370,27 +368,33 @@ EXPORT_SYMBOL_GPL(find_module);
 
 #ifdef CONFIG_SMP
 
-static void *percpu_modalloc(unsigned long size, unsigned long align,
-                             const char *name)
+static inline void __percpu *mod_percpu(struct module *mod)
 {
-        void *ptr;
+        return mod->percpu;
+}
 
+static int percpu_modalloc(struct module *mod,
+                           unsigned long size, unsigned long align)
+{
         if (align > PAGE_SIZE) {
                 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
-                       name, align, PAGE_SIZE);
+                       mod->name, align, PAGE_SIZE);
                 align = PAGE_SIZE;
         }
 
-        ptr = __alloc_reserved_percpu(size, align);
-        if (!ptr)
+        mod->percpu = __alloc_reserved_percpu(size, align);
+        if (!mod->percpu) {
                 printk(KERN_WARNING
                        "Could not allocate %lu bytes percpu data\n", size);
-        return ptr;
+                return -ENOMEM;
+        }
+        mod->percpu_size = size;
+        return 0;
 }
 
-static void percpu_modfree(void *freeme)
+static void percpu_modfree(struct module *mod)
 {
-        free_percpu(freeme);
+        free_percpu(mod->percpu);
 }
 
 static unsigned int find_pcpusec(Elf_Ehdr *hdr,
@@ -400,24 +404,62 @@ static unsigned int find_pcpusec(Elf_Ehdr *hdr,
         return find_sec(hdr, sechdrs, secstrings, ".data.percpu");
 }
 
-static void percpu_modcopy(void *pcpudest, const void *from, unsigned long size)
+static void percpu_modcopy(struct module *mod,
+                           const void *from, unsigned long size)
 {
         int cpu;
 
         for_each_possible_cpu(cpu)
-                memcpy(pcpudest + per_cpu_offset(cpu), from, size);
+                memcpy(per_cpu_ptr(mod->percpu, cpu), from, size);
+}
+
+/**
+ * is_module_percpu_address - test whether address is from module static percpu
+ * @addr: address to test
+ *
+ * Test whether @addr belongs to module static percpu area.
+ *
+ * RETURNS:
+ * %true if @addr is from module static percpu area
+ */
+bool is_module_percpu_address(unsigned long addr)
+{
+        struct module *mod;
+        unsigned int cpu;
+
+        preempt_disable();
+
+        list_for_each_entry_rcu(mod, &modules, list) {
+                if (!mod->percpu_size)
+                        continue;
+                for_each_possible_cpu(cpu) {
+                        void *start = per_cpu_ptr(mod->percpu, cpu);
+
+                        if ((void *)addr >= start &&
+                            (void *)addr < start + mod->percpu_size) {
+                                preempt_enable();
+                                return true;
+                        }
+                }
+        }
+
+        preempt_enable();
+        return false;
 }
 
 #else /* ... !CONFIG_SMP */
 
-static inline void *percpu_modalloc(unsigned long size, unsigned long align,
-                                    const char *name)
+static inline void __percpu *mod_percpu(struct module *mod)
 {
         return NULL;
 }
-static inline void percpu_modfree(void *pcpuptr)
+static inline int percpu_modalloc(struct module *mod,
+                                  unsigned long size, unsigned long align)
+{
+        return -ENOMEM;
+}
+static inline void percpu_modfree(struct module *mod)
 {
-        BUG();
 }
 static inline unsigned int find_pcpusec(Elf_Ehdr *hdr,
                                         Elf_Shdr *sechdrs,
@@ -425,12 +467,16 @@ static inline unsigned int find_pcpusec(Elf_Ehdr *hdr,
 {
         return 0;
 }
-static inline void percpu_modcopy(void *pcpudst, const void *src,
-                                  unsigned long size)
+static inline void percpu_modcopy(struct module *mod,
+                                  const void *from, unsigned long size)
 {
         /* pcpusec should be 0, and size of that section should be 0. */
         BUG_ON(size != 0);
 }
+bool is_module_percpu_address(unsigned long addr)
+{
+        return false;
+}
 
 #endif /* CONFIG_SMP */
 
@@ -467,16 +513,22 @@ MODINFO_ATTR(srcversion);
 static char last_unloaded_module[MODULE_NAME_LEN+1];
 
 #ifdef CONFIG_MODULE_UNLOAD
+
+EXPORT_TRACEPOINT_SYMBOL(module_get);
+
 /* Init the unload section of the module. */
 static void module_unload_init(struct module *mod)
 {
         int cpu;
 
         INIT_LIST_HEAD(&mod->modules_which_use_me);
-        for_each_possible_cpu(cpu)
-                local_set(__module_ref_addr(mod, cpu), 0);
+        for_each_possible_cpu(cpu) {
+                per_cpu_ptr(mod->refptr, cpu)->incs = 0;
+                per_cpu_ptr(mod->refptr, cpu)->decs = 0;
+        }
+
         /* Hold reference count during initialization. */
-        local_set(__module_ref_addr(mod, raw_smp_processor_id()), 1);
+        __this_cpu_write(mod->refptr->incs, 1);
         /* Backwards compatibility macros put refcount during init. */
         mod->waiter = current;
 }
@@ -615,12 +667,28 @@ static int try_stop_module(struct module *mod, int flags, int *forced)
 
 unsigned int module_refcount(struct module *mod)
 {
-        unsigned int total = 0;
+        unsigned int incs = 0, decs = 0;
         int cpu;
 
         for_each_possible_cpu(cpu)
-                total += local_read(__module_ref_addr(mod, cpu));
-        return total;
+                decs += per_cpu_ptr(mod->refptr, cpu)->decs;
+        /*
+         * ensure the incs are added up after the decs.
+         * module_put ensures incs are visible before decs with smp_wmb.
+         *
+         * This 2-count scheme avoids the situation where the refcount
+         * for CPU0 is read, then CPU0 increments the module refcount,
+         * then CPU1 drops that refcount, then the refcount for CPU1 is
+         * read. We would record a decrement but not its corresponding
+         * increment so we would see a low count (disaster).
+         *
+         * Rare situation? But module_refcount can be preempted, and we
+         * might be tallying up 4096+ CPUs. So it is not impossible.
+         */
+        smp_rmb();
+        for_each_possible_cpu(cpu)
+                incs += per_cpu_ptr(mod->refptr, cpu)->incs;
+        return incs - decs;
 }
 EXPORT_SYMBOL(module_refcount);
 
@@ -656,16 +724,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
                 return -EFAULT;
         name[MODULE_NAME_LEN-1] = '\0';
 
-        /* Create stop_machine threads since free_module relies on
-         * a non-failing stop_machine call. */
-        ret = stop_machine_create();
-        if (ret)
-                return ret;
-
-        if (mutex_lock_interruptible(&module_mutex) != 0) {
-                ret = -EINTR;
-                goto out_stop;
-        }
+        if (mutex_lock_interruptible(&module_mutex) != 0)
+                return -EINTR;
 
         mod = find_module(name);
         if (!mod) {
@@ -725,8 +785,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
 
  out:
         mutex_unlock(&module_mutex);
-out_stop:
-        stop_machine_destroy();
         return ret;
 }
 
@@ -796,14 +854,15 @@ static struct module_attribute refcnt = {
 void module_put(struct module *module)
 {
         if (module) {
-                unsigned int cpu = get_cpu();
-                local_dec(__module_ref_addr(module, cpu));
-                trace_module_put(module, _RET_IP_,
-                                 local_read(__module_ref_addr(module, cpu)));
+                preempt_disable();
+                smp_wmb(); /* see comment in module_refcount */
+                __this_cpu_inc(module->refptr->decs);
+
+                trace_module_put(module, _RET_IP_);
                 /* Maybe they're waiting for us to drop reference? */
                 if (unlikely(!module_is_live(module)))
                         wake_up_process(module->waiter);
-                put_cpu();
+                preempt_enable();
         }
 }
 EXPORT_SYMBOL(module_put);
@@ -1083,6 +1142,7 @@ static void add_sect_attrs(struct module *mod, unsigned int nsect,
                 if (sattr->name == NULL)
                         goto out;
                 sect_attrs->nsections++;
+                sysfs_attr_init(&sattr->mattr.attr);
                 sattr->mattr.show = module_sect_show;
                 sattr->mattr.store = NULL;
                 sattr->mattr.attr.name = sattr->name;
@@ -1178,6 +1238,7 @@ static void add_notes_attrs(struct module *mod, unsigned int nsect,
                 if (sect_empty(&sechdrs[i]))
                         continue;
                 if (sechdrs[i].sh_type == SHT_NOTE) {
+                        sysfs_bin_attr_init(nattr);
                         nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
                         nattr->attr.mode = S_IRUGO;
                         nattr->size = sechdrs[i].sh_size;
@@ -1250,6 +1311,7 @@ int module_add_modinfo_attrs(struct module *mod)
                 if (!attr->test ||
                     (attr->test && attr->test(mod))) {
                         memcpy(temp_attr, attr, sizeof(*temp_attr));
+                        sysfs_attr_init(&temp_attr->attr);
                         error = sysfs_create_file(&mod->mkobj.kobj,&temp_attr->attr);
                         ++temp_attr;
                 }
@@ -1395,11 +1457,10 @@ static void free_module(struct module *mod)
         /* This may be NULL, but that's OK */
         module_free(mod, mod->module_init);
         kfree(mod->args);
-        if (mod->percpu)
-                percpu_modfree(mod->percpu);
-#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+        percpu_modfree(mod);
+#if defined(CONFIG_MODULE_UNLOAD)
         if (mod->refptr)
-                percpu_modfree(mod->refptr);
+                free_percpu(mod->refptr);
 #endif
         /* Free lock-classes: */
         lockdep_free_key_range(mod->module_core, mod->core_size);
@@ -1515,7 +1576,7 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
                 default:
                         /* Divert to percpu allocation if a percpu var. */
                         if (sym[i].st_shndx == pcpuindex)
-                                secbase = (unsigned long)mod->percpu;
+                                secbase = (unsigned long)mod_percpu(mod);
                         else
                                 secbase = sechdrs[sym[i].st_shndx].sh_addr;
                         sym[i].st_value += secbase;
@@ -1949,7 +2010,7 @@ static noinline struct module *load_module(void __user *umod,
         unsigned int modindex, versindex, infoindex, pcpuindex;
         struct module *mod;
         long err = 0;
-        void *percpu = NULL, *ptr = NULL; /* Stops spurious gcc warning */
+        void *ptr = NULL; /* Stops spurious gcc warning */
         unsigned long symoffs, stroffs, *strmap;
 
         mm_segment_t old_fs;
@@ -2089,15 +2150,11 @@ static noinline struct module *load_module(void __user *umod,
 
         if (pcpuindex) {
                 /* We have a special allocation for this section. */
-                percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size,
-                                         sechdrs[pcpuindex].sh_addralign,
-                                         mod->name);
-                if (!percpu) {
-                        err = -ENOMEM;
+                err = percpu_modalloc(mod, sechdrs[pcpuindex].sh_size,
+                                      sechdrs[pcpuindex].sh_addralign);
+                if (err)
                         goto free_mod;
-                }
                 sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
-                mod->percpu = percpu;
         }
 
         /* Determine total sizes, and put offsets in sh_entsize.  For now
@@ -2162,9 +2219,8 @@ static noinline struct module *load_module(void __user *umod,
         mod = (void *)sechdrs[modindex].sh_addr;
         kmemleak_load_module(mod, hdr, sechdrs, secstrings);
 
-#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-        mod->refptr = percpu_modalloc(sizeof(local_t), __alignof__(local_t),
-                                      mod->name);
+#if defined(CONFIG_MODULE_UNLOAD)
+        mod->refptr = alloc_percpu(struct module_ref);
         if (!mod->refptr) {
                 err = -ENOMEM;
                 goto free_init;
@@ -2313,7 +2369,7 @@ static noinline struct module *load_module(void __user *umod,
         sort_extable(mod->extable, mod->extable + mod->num_exentries);
 
         /* Finally, copy percpu area over. */
-        percpu_modcopy(mod->percpu, (void *)sechdrs[pcpuindex].sh_addr,
+        percpu_modcopy(mod, (void *)sechdrs[pcpuindex].sh_addr,
                        sechdrs[pcpuindex].sh_size);
 
         add_kallsyms(mod, sechdrs, hdr->e_shnum, symindex, strindex,
@@ -2396,8 +2452,8 @@ static noinline struct module *load_module(void __user *umod,
         kobject_put(&mod->mkobj.kobj);
  free_unload:
         module_unload_free(mod);
-#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-        percpu_modfree(mod->refptr);
+#if defined(CONFIG_MODULE_UNLOAD)
+        free_percpu(mod->refptr);
  free_init:
 #endif
         module_free(mod, mod->module_init);
@@ -2405,8 +2461,7 @@ static noinline struct module *load_module(void __user *umod,
         module_free(mod, mod->module_core);
         /* mod will be freed with core. Don't access it beyond this line! */
  free_percpu:
-        if (percpu)
-                percpu_modfree(percpu);
+        percpu_modfree(mod);
  free_mod:
         kfree(args);
         kfree(strmap);
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 09b4ff9711b2..f74e6c00e26d 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -13,6 +13,7 @@
  *             Pavel Emelianov <xemul@openvz.org>
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/nsproxy.h>
 #include <linux/init_task.h>
@@ -24,7 +25,18 @@
 
 static struct kmem_cache *nsproxy_cachep;
 
-struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy);
+struct nsproxy init_nsproxy = {
+        .count  = ATOMIC_INIT(1),
+        .uts_ns = &init_uts_ns,
+#if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
+        .ipc_ns = &init_ipc_ns,
+#endif
+        .mnt_ns = NULL,
+        .pid_ns = &init_pid_ns,
+#ifdef CONFIG_NET
+        .net_ns = &init_net,
+#endif
+};
 
 static inline struct nsproxy *create_nsproxy(void)
 {
diff --git a/kernel/padata.c b/kernel/padata.c
index 6f9bcb8313d6..fd03513c7327 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -25,6 +25,7 @@
 #include <linux/padata.h>
 #include <linux/mutex.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/rcupdate.h>
 
 #define MAX_SEQ_NR INT_MAX - NR_CPUS
@@ -642,6 +643,9 @@ struct padata_instance *padata_alloc(const struct cpumask *cpumask,
         if (!pd)
                 goto err_free_inst;
 
+        if (!alloc_cpumask_var(&pinst->cpumask, GFP_KERNEL))
+                goto err_free_pd;
+
         rcu_assign_pointer(pinst->pd, pd);
 
         pinst->wq = wq;
@@ -654,12 +658,14 @@ struct padata_instance *padata_alloc(const struct cpumask *cpumask,
         pinst->cpu_notifier.priority = 0;
         err = register_hotcpu_notifier(&pinst->cpu_notifier);
         if (err)
-                goto err_free_pd;
+                goto err_free_cpumask;
 
         mutex_init(&pinst->lock);
 
         return pinst;
 
+err_free_cpumask:
+        free_cpumask_var(pinst->cpumask);
 err_free_pd:
         padata_free_pd(pd);
 err_free_inst:
@@ -685,6 +691,7 @@ void padata_free(struct padata_instance *pinst)
 
         unregister_hotcpu_notifier(&pinst->cpu_notifier);
         padata_free_pd(pinst->pd);
+        free_cpumask_var(pinst->cpumask);
         kfree(pinst);
 }
 EXPORT_SYMBOL(padata_free);
diff --git a/kernel/panic.c b/kernel/panic.c
index c787333282b8..13d966b4c14a 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -36,15 +36,36 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
 
 EXPORT_SYMBOL(panic_notifier_list);
 
-static long no_blink(long time)
-{
-        return 0;
-}
-
 /* Returns how long it waited in ms */
 long (*panic_blink)(long time);
 EXPORT_SYMBOL(panic_blink);
 
+static void panic_blink_one_second(void)
+{
+        static long i = 0, end;
+
+        if (panic_blink) {
+                end = i + MSEC_PER_SEC;
+
+                while (i < end) {
+                        i += panic_blink(i);
+                        mdelay(1);
+                        i++;
+                }
+        } else {
+                /*
+                 * When running under a hypervisor a small mdelay may get
+                 * rounded up to the hypervisor timeslice. For example, with
+                 * a 1ms in 10ms hypervisor timeslice we might inflate a
+                 * mdelay(1) loop by 10x.
+                 *
+                 * If we have nothing to blink, spin on 1 second calls to
+                 * mdelay to avoid this.
+                 */
+                mdelay(MSEC_PER_SEC);
+        }
+}
+
 /**
  *      panic - halt the system
  *      @fmt: The text string to print
@@ -95,9 +116,6 @@ NORET_TYPE void panic(const char * fmt, ...)
 
         bust_spinlocks(0);
 
-        if (!panic_blink)
-                panic_blink = no_blink;
-
         if (panic_timeout > 0) {
                 /*
                  * Delay timeout seconds before rebooting the machine.
@@ -105,11 +123,9 @@ NORET_TYPE void panic(const char * fmt, ...)
                  */
                 printk(KERN_EMERG "Rebooting in %d seconds..", panic_timeout);
 
-                for (i = 0; i < panic_timeout*1000; ) {
+                for (i = 0; i < panic_timeout; i++) {
                         touch_nmi_watchdog();
-                        i += panic_blink(i);
-                        mdelay(1);
-                        i++;
+                        panic_blink_one_second();
                 }
                 /*
                  * This will not be a clean reboot, with everything
@@ -135,11 +151,9 @@ NORET_TYPE void panic(const char * fmt, ...)
         }
 #endif
         local_irq_enable();
-        for (i = 0; ; ) {
+        while (1) {
                 touch_softlockup_watchdog();
-                i += panic_blink(i);
-                mdelay(1);
-                i++;
+                panic_blink_one_second();
         }
 }
 
diff --git a/kernel/params.c b/kernel/params.c
index cf1b69183127..0b30ecd53a52 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -24,7 +24,6 @@
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <linux/ctype.h>
-#include <linux/string.h>
 
 #if 0
 #define DEBUGP printk
@@ -402,8 +401,8 @@ int param_get_string(char *buffer, struct kernel_param *kp)
 }
 
 /* sysfs output in /sys/modules/XYZ/parameters/ */
-#define to_module_attr(n) container_of(n, struct module_attribute, attr);
-#define to_module_kobject(n) container_of(n, struct module_kobject, kobj);
+#define to_module_attr(n) container_of(n, struct module_attribute, attr)
+#define to_module_kobject(n) container_of(n, struct module_kobject, kobj)
 
 extern struct kernel_param __start___param[], __stop___param[];
 
@@ -421,7 +420,7 @@ struct module_param_attrs
 };
 
 #ifdef CONFIG_SYSFS
-#define to_param_attr(n) container_of(n, struct param_attribute, mattr);
+#define to_param_attr(n) container_of(n, struct param_attribute, mattr)
 
 static ssize_t param_attr_show(struct module_attribute *mattr,
                                struct module *mod, char *buf)
@@ -517,6 +516,7 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
         new->grp.attrs = attrs;
 
         /* Tack new one on the end. */
+        sysfs_attr_init(&new->attrs[num].mattr.attr);
         new->attrs[num].param = kp;
         new->attrs[num].mattr.show = param_attr_show;
         new->attrs[num].mattr.store = param_attr_store;
@@ -723,7 +723,7 @@ static ssize_t module_attr_store(struct kobject *kobj,
         return ret;
 }
 
-static struct sysfs_ops module_sysfs_ops = {
+static const struct sysfs_ops module_sysfs_ops = {
         .show = module_attr_show,
         .store = module_attr_store,
 };
@@ -737,7 +737,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
         return 0;
 }
 
-static struct kset_uevent_ops module_uevent_ops = {
+static const struct kset_uevent_ops module_uevent_ops = {
         .filter = uevent_filter,
 };
 
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index a661e7991865..a4fa381db3c2 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -15,6 +15,8 @@
 #include <linux/smp.h>
 #include <linux/file.h>
 #include <linux/poll.h>
+#include <linux/slab.h>
+#include <linux/hash.h>
 #include <linux/sysfs.h>
 #include <linux/dcache.h>
 #include <linux/percpu.h>
@@ -56,21 +58,6 @@ static atomic_t nr_task_events __read_mostly;
  */
 int sysctl_perf_event_paranoid __read_mostly = 1;
 
-static inline bool perf_paranoid_tracepoint_raw(void)
-{
-        return sysctl_perf_event_paranoid > -1;
-}
-
-static inline bool perf_paranoid_cpu(void)
-{
-        return sysctl_perf_event_paranoid > 0;
-}
-
-static inline bool perf_paranoid_kernel(void)
-{
-        return sysctl_perf_event_paranoid > 1;
-}
-
 int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
 
 /*
@@ -96,41 +83,19 @@ extern __weak const struct pmu *hw_perf_event_init(struct perf_event *event)
 void __weak hw_perf_disable(void)               { barrier(); }
 void __weak hw_perf_enable(void)                { barrier(); }
 
-void __weak hw_perf_event_setup(int cpu)        { barrier(); }
-void __weak hw_perf_event_setup_online(int cpu) { barrier(); }
-void __weak hw_perf_event_setup_offline(int cpu)        { barrier(); }
-
-int __weak
-hw_perf_group_sched_in(struct perf_event *group_leader,
-               struct perf_cpu_context *cpuctx,
-               struct perf_event_context *ctx)
-{
-        return 0;
-}
-
 void __weak perf_event_print_debug(void)        { }
 
 static DEFINE_PER_CPU(int, perf_disable_count);
 
-void __perf_disable(void)
-{
-        __get_cpu_var(perf_disable_count)++;
-}
-
-bool __perf_enable(void)
-{
-        return !--__get_cpu_var(perf_disable_count);
-}
-
 void perf_disable(void)
 {
-        __perf_disable();
-        hw_perf_disable();
+        if (!__get_cpu_var(perf_disable_count)++)
+                hw_perf_disable();
 }
 
 void perf_enable(void)
 {
-        if (__perf_enable())
+        if (!--__get_cpu_var(perf_disable_count))
                 hw_perf_enable();
 }
 
@@ -290,6 +255,18 @@ static void update_event_times(struct perf_event *event)
         event->total_time_running = run_end - event->tstamp_running;
 }
 
+/*
+ * Update total_time_enabled and total_time_running for all events in a group.
+ */
+static void update_group_times(struct perf_event *leader)
+{
+        struct perf_event *event;
+
+        update_event_times(leader);
+        list_for_each_entry(event, &leader->sibling_list, group_entry)
+                update_event_times(event);
+}
+
 static struct list_head *
 ctx_group_list(struct perf_event *event, struct perf_event_context *ctx)
 {
@@ -343,8 +320,6 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
 static void
 list_del_event(struct perf_event *event, struct perf_event_context *ctx)
 {
-        struct perf_event *sibling, *tmp;
-
         if (list_empty(&event->group_entry))
                 return;
         ctx->nr_events--;
@@ -357,7 +332,7 @@ list_del_event(struct perf_event *event, struct perf_event_context *ctx)
         if (event->group_leader != event)
                 event->group_leader->nr_siblings--;
 
-        update_event_times(event);
+        update_group_times(event);
 
         /*
          * If event was in error state, then keep it
@@ -368,6 +343,12 @@ list_del_event(struct perf_event *event, struct perf_event_context *ctx)
          */
         if (event->state > PERF_EVENT_STATE_OFF)
                 event->state = PERF_EVENT_STATE_OFF;
+}
+
+static void
+perf_destroy_group(struct perf_event *event, struct perf_event_context *ctx)
+{
+        struct perf_event *sibling, *tmp;
 
         /*
          * If this was a group event with sibling events then
@@ -533,18 +514,6 @@ retry:
 }
 
 /*
- * Update total_time_enabled and total_time_running for all events in a group.
- */
-static void update_group_times(struct perf_event *leader)
-{
-        struct perf_event *event;
-
-        update_event_times(leader);
-        list_for_each_entry(event, &leader->sibling_list, group_entry)
-                update_event_times(event);
-}
-
-/*
  * Cross CPU call to disable a performance event
  */
 static void __perf_event_disable(void *info)
@@ -668,15 +637,20 @@ group_sched_in(struct perf_event *group_event,
                struct perf_cpu_context *cpuctx,
                struct perf_event_context *ctx)
 {
-        struct perf_event *event, *partial_group;
+        struct perf_event *event, *partial_group = NULL;
+        const struct pmu *pmu = group_event->pmu;
+        bool txn = false;
         int ret;
 
         if (group_event->state == PERF_EVENT_STATE_OFF)
                 return 0;
 
-        ret = hw_perf_group_sched_in(group_event, cpuctx, ctx);
-        if (ret)
-                return ret < 0 ? ret : 0;
+        /* Check if group transaction availabe */
+        if (pmu->start_txn)
+                txn = true;
+
+        if (txn)
+                pmu->start_txn(pmu);
 
         if (event_sched_in(group_event, cpuctx, ctx))
                 return -EAGAIN;
@@ -691,9 +665,19 @@ group_sched_in(struct perf_event *group_event,
                 }
         }
 
-        return 0;
+        if (!txn)
+                return 0;
+
+        ret = pmu->commit_txn(pmu);
+        if (!ret) {
+                pmu->cancel_txn(pmu);
+                return 0;
+        }
 
 group_error:
+        if (txn)
+                pmu->cancel_txn(pmu);
+
         /*
          * Groups can be scheduled in as one unit only, so undo any
          * partial group before returning:
@@ -1193,11 +1177,9 @@ void perf_event_task_sched_out(struct task_struct *task,
         struct perf_event_context *ctx = task->perf_event_ctxp;
         struct perf_event_context *next_ctx;
         struct perf_event_context *parent;
-        struct pt_regs *regs;
         int do_switch = 1;
 
-        regs = task_pt_regs(task);
-        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, regs, 0);
+        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0);
 
         if (likely(!ctx || !cpuctx->task_ctx))
                 return;
@@ -1397,6 +1379,8 @@ void perf_event_task_sched_in(struct task_struct *task)
         if (cpuctx->task_ctx == ctx)
                 return;
 
+        perf_disable();
+
         /*
          * We want to keep the following priority order:
          * cpu pinned (that don't need to move), task pinned,
@@ -1409,6 +1393,8 @@ void perf_event_task_sched_in(struct task_struct *task)
         ctx_sched_in(ctx, cpuctx, EVENT_FLEXIBLE);
 
         cpuctx->task_ctx = ctx;
+
+        perf_enable();
 }
 
 #define MAX_INTERRUPTS (~0ULL)
@@ -1553,12 +1539,15 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
                  */
                 if (interrupts == MAX_INTERRUPTS) {
                         perf_log_throttle(event, 1);
+                        perf_disable();
                         event->pmu->unthrottle(event);
+                        perf_enable();
                 }
 
                 if (!event->attr.freq || !event->attr.sample_freq)
                         continue;
 
+                perf_disable();
                 event->pmu->read(event);
                 now = atomic64_read(&event->count);
                 delta = now - hwc->freq_count_stamp;
@@ -1566,6 +1555,7 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
 
                 if (delta > 0)
                         perf_adjust_period(event, TICK_NSEC, delta);
+                perf_enable();
         }
         raw_spin_unlock(&ctx->lock);
 }
@@ -1575,9 +1565,6 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
  */
 static void rotate_ctx(struct perf_event_context *ctx)
 {
-        if (!ctx->nr_events)
-                return;
-
         raw_spin_lock(&ctx->lock);
 
         /* Rotate the first entry last of non-pinned groups */
@@ -1590,19 +1577,28 @@ void perf_event_task_tick(struct task_struct *curr)
 {
         struct perf_cpu_context *cpuctx;
         struct perf_event_context *ctx;
+        int rotate = 0;
 
         if (!atomic_read(&nr_events))
                 return;
 
         cpuctx = &__get_cpu_var(perf_cpu_context);
-        ctx = curr->perf_event_ctxp;
+        if (cpuctx->ctx.nr_events &&
+            cpuctx->ctx.nr_events != cpuctx->ctx.nr_active)
+                rotate = 1;
 
-        perf_disable();
+        ctx = curr->perf_event_ctxp;
+        if (ctx && ctx->nr_events && ctx->nr_events != ctx->nr_active)
+                rotate = 1;
 
         perf_ctx_adjust_freq(&cpuctx->ctx);
         if (ctx)
                 perf_ctx_adjust_freq(ctx);
 
+        if (!rotate)
+                return;
+
+        perf_disable();
         cpu_ctx_sched_out(cpuctx, EVENT_FLEXIBLE);
         if (ctx)
                 task_ctx_sched_out(ctx, EVENT_FLEXIBLE);
@@ -1614,7 +1610,6 @@ void perf_event_task_tick(struct task_struct *curr)
         cpu_ctx_sched_in(cpuctx, EVENT_FLEXIBLE);
         if (ctx)
                 task_ctx_sched_in(curr, EVENT_FLEXIBLE);
-
         perf_enable();
 }
 
@@ -1877,9 +1872,30 @@ int perf_event_release_kernel(struct perf_event *event)
 {
         struct perf_event_context *ctx = event->ctx;
 
+        /*
+         * Remove from the PMU, can't get re-enabled since we got
+         * here because the last ref went.
+         */
+        perf_event_disable(event);
+
         WARN_ON_ONCE(ctx->parent_ctx);
-        mutex_lock(&ctx->mutex);
-        perf_event_remove_from_context(event);
+        /*
+         * There are two ways this annotation is useful:
+         *
+         *  1) there is a lock recursion from perf_event_exit_task
+         *     see the comment there.
+         *
+         *  2) there is a lock-inversion with mmap_sem through
+         *     perf_event_read_group(), which takes faults while
+         *     holding ctx->mutex, however this is called after
+         *     the last filedesc died, so there is no possibility
+         *     to trigger the AB-BA case.
+         */
+        mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING);
+        raw_spin_lock_irq(&ctx->lock);
+        list_del_event(event, ctx);
+        perf_destroy_group(event, ctx);
+        raw_spin_unlock_irq(&ctx->lock);
         mutex_unlock(&ctx->mutex);
 
         mutex_lock(&event->owner->perf_event_mutex);
@@ -2610,7 +2626,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
         if (user_locked > user_lock_limit)
                 extra = user_locked - user_lock_limit;
 
-        lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+        lock_limit = rlimit(RLIMIT_MEMLOCK);
         lock_limit >>= PAGE_SHIFT;
         locked = vma->vm_mm->locked_vm + extra;
 
@@ -2663,6 +2679,7 @@ static int perf_fasync(int fd, struct file *filp, int on)
 }
 
 static const struct file_operations perf_fops = {
+        .llseek                 = no_llseek,
         .release                = perf_release,
         .read                   = perf_read,
         .poll                   = perf_poll,
@@ -2806,6 +2823,33 @@ __weak struct perf_callchain_entry *perf_callchain(struct pt_regs *regs)
         return NULL;
 }
 
+__weak
+void perf_arch_fetch_caller_regs(struct pt_regs *regs, unsigned long ip, int skip)
+{
+}
+
+
+/*
+ * We assume there is only KVM supporting the callbacks.
+ * Later on, we might change it to a list if there is
+ * another virtualization implementation supporting the callbacks.
+ */
+struct perf_guest_info_callbacks *perf_guest_cbs;
+
+int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
+{
+        perf_guest_cbs = cbs;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks);
+
+int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
+{
+        perf_guest_cbs = NULL;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(perf_unregister_guest_info_callbacks);
+
 /*
  * Output
  */
@@ -3391,15 +3435,23 @@ static void perf_event_task_output(struct perf_event *event,
                                      struct perf_task_event *task_event)
 {
         struct perf_output_handle handle;
-        int size;
         struct task_struct *task = task_event->task;
-        int ret;
+        unsigned long flags;
+        int size, ret;
+
+        /*
+         * If this CPU attempts to acquire an rq lock held by a CPU spinning
+         * in perf_output_lock() from interrupt context, it's game over.
+         */
+        local_irq_save(flags);
 
         size  = task_event->event_id.header.size;
         ret = perf_output_begin(&handle, event, size, 0, 0);
 
-        if (ret)
+        if (ret) {
+                local_irq_restore(flags);
                 return;
+        }
 
         task_event->event_id.pid = perf_event_pid(event, task);
         task_event->event_id.ppid = perf_event_pid(event, current);
@@ -3410,6 +3462,7 @@ static void perf_event_task_output(struct perf_event *event,
         perf_output_put(&handle, task_event->event_id);
 
         perf_output_end(&handle);
+        local_irq_restore(flags);
 }
 
 static int perf_event_task_match(struct perf_event *event)
@@ -3749,7 +3802,7 @@ void __perf_event_mmap(struct vm_area_struct *vma)
                 .event_id  = {
                         .header = {
                                 .type = PERF_RECORD_MMAP,
-                                .misc = 0,
+                                .misc = PERF_RECORD_MISC_USER,
                                 /* .size */
                         },
                         /* .pid */
@@ -3967,36 +4020,6 @@ static void perf_swevent_add(struct perf_event *event, u64 nr,
         perf_swevent_overflow(event, 0, nmi, data, regs);
 }
 
-static int perf_swevent_is_counting(struct perf_event *event)
-{
-        /*
-         * The event is active, we're good!
-         */
-        if (event->state == PERF_EVENT_STATE_ACTIVE)
-                return 1;
-
-        /*
-         * The event is off/error, not counting.
-         */
-        if (event->state != PERF_EVENT_STATE_INACTIVE)
-                return 0;
-
-        /*
-         * The event is inactive, if the context is active
-         * we're part of a group that didn't make it on the 'pmu',
-         * not counting.
-         */
-        if (event->ctx->is_active)
-                return 0;
-
-        /*
-         * We're inactive and the context is too, this means the
-         * task is scheduled out, we're counting events that happen
-         * to us, like migration events.
-         */
-        return 1;
-}
-
 static int perf_tp_event_match(struct perf_event *event,
                                 struct perf_sample_data *data);
 
@@ -4020,12 +4043,6 @@ static int perf_swevent_match(struct perf_event *event,
                                 struct perf_sample_data *data,
                                 struct pt_regs *regs)
 {
-        if (event->cpu != -1 && event->cpu != smp_processor_id())
-                return 0;
-
-        if (!perf_swevent_is_counting(event))
-                return 0;
-
         if (event->attr.type != type)
                 return 0;
 
@@ -4042,18 +4059,53 @@ static int perf_swevent_match(struct perf_event *event,
         return 1;
 }
 
-static void perf_swevent_ctx_event(struct perf_event_context *ctx,
-                                     enum perf_type_id type,
-                                     u32 event_id, u64 nr, int nmi,
-                                     struct perf_sample_data *data,
-                                     struct pt_regs *regs)
+static inline u64 swevent_hash(u64 type, u32 event_id)
+{
+        u64 val = event_id | (type << 32);
+
+        return hash_64(val, SWEVENT_HLIST_BITS);
+}
+
+static struct hlist_head *
+find_swevent_head(struct perf_cpu_context *ctx, u64 type, u32 event_id)
+{
+        u64 hash;
+        struct swevent_hlist *hlist;
+
+        hash = swevent_hash(type, event_id);
+
+        hlist = rcu_dereference(ctx->swevent_hlist);
+        if (!hlist)
+                return NULL;
+
+        return &hlist->heads[hash];
+}
+
+static void do_perf_sw_event(enum perf_type_id type, u32 event_id,
+                                    u64 nr, int nmi,
+                                    struct perf_sample_data *data,
+                                    struct pt_regs *regs)
 {
+        struct perf_cpu_context *cpuctx;
         struct perf_event *event;
+        struct hlist_node *node;
+        struct hlist_head *head;
 
-        list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
+        cpuctx = &__get_cpu_var(perf_cpu_context);
+
+        rcu_read_lock();
+
+        head = find_swevent_head(cpuctx, type, event_id);
+
+        if (!head)
+                goto end;
+
+        hlist_for_each_entry_rcu(event, node, head, hlist_entry) {
                 if (perf_swevent_match(event, type, event_id, data, regs))
                         perf_swevent_add(event, nr, nmi, data, regs);
         }
+end:
+        rcu_read_unlock();
 }
 
 int perf_swevent_get_recursion_context(void)
@@ -4091,27 +4143,6 @@ void perf_swevent_put_recursion_context(int rctx)
 }
 EXPORT_SYMBOL_GPL(perf_swevent_put_recursion_context);
 
-static void do_perf_sw_event(enum perf_type_id type, u32 event_id,
-                                    u64 nr, int nmi,
-                                    struct perf_sample_data *data,
-                                    struct pt_regs *regs)
-{
-        struct perf_cpu_context *cpuctx;
-        struct perf_event_context *ctx;
-
-        cpuctx = &__get_cpu_var(perf_cpu_context);
-        rcu_read_lock();
-        perf_swevent_ctx_event(&cpuctx->ctx, type, event_id,
-                                 nr, nmi, data, regs);
-        /*
-         * doesn't really matter which of the child contexts the
-         * events ends up in.
-         */
-        ctx = rcu_dereference(current->perf_event_ctxp);
-        if (ctx)
-                perf_swevent_ctx_event(ctx, type, event_id, nr, nmi, data, regs);
-        rcu_read_unlock();
-}
 
 void __perf_sw_event(u32 event_id, u64 nr, int nmi,
                             struct pt_regs *regs, u64 addr)
@@ -4123,8 +4154,7 @@ void __perf_sw_event(u32 event_id, u64 nr, int nmi,
         if (rctx < 0)
                 return;
 
-        data.addr = addr;
-        data.raw  = NULL;
+        perf_sample_data_init(&data, addr);
 
         do_perf_sw_event(PERF_TYPE_SOFTWARE, event_id, nr, nmi, &data, regs);
 
@@ -4138,16 +4168,28 @@ static void perf_swevent_read(struct perf_event *event)
 static int perf_swevent_enable(struct perf_event *event)
 {
         struct hw_perf_event *hwc = &event->hw;
+        struct perf_cpu_context *cpuctx;
+        struct hlist_head *head;
+
+        cpuctx = &__get_cpu_var(perf_cpu_context);
 
         if (hwc->sample_period) {
                 hwc->last_period = hwc->sample_period;
                 perf_swevent_set_period(event);
         }
+
+        head = find_swevent_head(cpuctx, event->attr.type, event->attr.config);
+        if (WARN_ON_ONCE(!head))
+                return -EINVAL;
+
+        hlist_add_head_rcu(&event->hlist_entry, head);
+
         return 0;
 }
 
 static void perf_swevent_disable(struct perf_event *event)
 {
+        hlist_del_rcu(&event->hlist_entry);
 }
 
 static const struct pmu perf_ops_generic = {
@@ -4169,22 +4211,14 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
         struct perf_event *event;
         u64 period;
 
-        event   = container_of(hrtimer, struct perf_event, hw.hrtimer);
+        event = container_of(hrtimer, struct perf_event, hw.hrtimer);
         event->pmu->read(event);
 
-        data.addr = 0;
-        data.raw = NULL;
+        perf_sample_data_init(&data, 0);
         data.period = event->hw.last_period;
         regs = get_irq_regs();
-        /*
-         * In case we exclude kernel IPs or are somehow not in interrupt
-         * context, provide the next best thing, the user IP.
-         */
-        if ((event->attr.exclude_kernel || !regs) &&
-                        !event->attr.exclude_user)
-                regs = task_pt_regs(current);
 
-        if (regs) {
+        if (regs && !perf_exclude_event(event, regs)) {
                 if (!(event->attr.exclude_idle && current->pid == 0))
                         if (perf_event_overflow(event, 0, &data, regs))
                                 ret = HRTIMER_NORESTART;
@@ -4332,29 +4366,122 @@ static const struct pmu perf_ops_task_clock = {
         .read           = task_clock_perf_event_read,
 };
 
+static void swevent_hlist_release_rcu(struct rcu_head *rcu_head)
+{
+        struct swevent_hlist *hlist;
+
+        hlist = container_of(rcu_head, struct swevent_hlist, rcu_head);
+        kfree(hlist);
+}
+
+static void swevent_hlist_release(struct perf_cpu_context *cpuctx)
+{
+        struct swevent_hlist *hlist;
+
+        if (!cpuctx->swevent_hlist)
+                return;
+
+        hlist = cpuctx->swevent_hlist;
+        rcu_assign_pointer(cpuctx->swevent_hlist, NULL);
+        call_rcu(&hlist->rcu_head, swevent_hlist_release_rcu);
+}
+
+static void swevent_hlist_put_cpu(struct perf_event *event, int cpu)
+{
+        struct perf_cpu_context *cpuctx = &per_cpu(perf_cpu_context, cpu);
+
+        mutex_lock(&cpuctx->hlist_mutex);
+
+        if (!--cpuctx->hlist_refcount)
+                swevent_hlist_release(cpuctx);
+
+        mutex_unlock(&cpuctx->hlist_mutex);
+}
+
+static void swevent_hlist_put(struct perf_event *event)
+{
+        int cpu;
+
+        if (event->cpu != -1) {
+                swevent_hlist_put_cpu(event, event->cpu);
+                return;
+        }
+
+        for_each_possible_cpu(cpu)
+                swevent_hlist_put_cpu(event, cpu);
+}
+
+static int swevent_hlist_get_cpu(struct perf_event *event, int cpu)
+{
+        struct perf_cpu_context *cpuctx = &per_cpu(perf_cpu_context, cpu);
+        int err = 0;
+
+        mutex_lock(&cpuctx->hlist_mutex);
+
+        if (!cpuctx->swevent_hlist && cpu_online(cpu)) {
+                struct swevent_hlist *hlist;
+
+                hlist = kzalloc(sizeof(*hlist), GFP_KERNEL);
+                if (!hlist) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                rcu_assign_pointer(cpuctx->swevent_hlist, hlist);
+        }
+        cpuctx->hlist_refcount++;
+ exit:
+        mutex_unlock(&cpuctx->hlist_mutex);
+
+        return err;
+}
+
+static int swevent_hlist_get(struct perf_event *event)
+{
+        int err;
+        int cpu, failed_cpu;
+
+        if (event->cpu != -1)
+                return swevent_hlist_get_cpu(event, event->cpu);
+
+        get_online_cpus();
+        for_each_possible_cpu(cpu) {
+                err = swevent_hlist_get_cpu(event, cpu);
+                if (err) {
+                        failed_cpu = cpu;
+                        goto fail;
+                }
+        }
+        put_online_cpus();
+
+        return 0;
+ fail:
+        for_each_possible_cpu(cpu) {
+                if (cpu == failed_cpu)
+                        break;
+                swevent_hlist_put_cpu(event, cpu);
+        }
+
+        put_online_cpus();
+        return err;
+}
+
 #ifdef CONFIG_EVENT_TRACING
 
 void perf_tp_event(int event_id, u64 addr, u64 count, void *record,
-                          int entry_size)
+                   int entry_size, struct pt_regs *regs)
 {
+        struct perf_sample_data data;
         struct perf_raw_record raw = {
                 .size = entry_size,
                 .data = record,
         };
 
-        struct perf_sample_data data = {
-                .addr = addr,
-                .raw = &raw,
-        };
-
-        struct pt_regs *regs = get_irq_regs();
-
-        if (!regs)
-                regs = task_pt_regs(current);
+        perf_sample_data_init(&data, addr);
+        data.raw = &raw;
 
         /* Trace events already protected against recursion */
         do_perf_sw_event(PERF_TYPE_TRACEPOINT, event_id, count, 1,
-                                &data, regs);
+                         &data, regs);
 }
 EXPORT_SYMBOL_GPL(perf_tp_event);
 
@@ -4370,11 +4497,14 @@ static int perf_tp_event_match(struct perf_event *event,
 
 static void tp_perf_event_destroy(struct perf_event *event)
 {
-        ftrace_profile_disable(event->attr.config);
+        perf_trace_disable(event->attr.config);
+        swevent_hlist_put(event);
 }
 
 static const struct pmu *tp_perf_event_init(struct perf_event *event)
 {
+        int err;
+
         /*
          * Raw tracepoint data is a severe data leak, only allow root to
          * have these.
@@ -4384,10 +4514,15 @@ static const struct pmu *tp_perf_event_init(struct perf_event *event)
                         !capable(CAP_SYS_ADMIN))
                 return ERR_PTR(-EPERM);
 
-        if (ftrace_profile_enable(event->attr.config))
+        if (perf_trace_enable(event->attr.config))
                 return NULL;
 
         event->destroy = tp_perf_event_destroy;
+        err = swevent_hlist_get(event);
+        if (err) {
+                perf_trace_disable(event->attr.config);
+                return ERR_PTR(err);
+        }
 
         return &perf_ops_generic;
 }
@@ -4463,8 +4598,7 @@ void perf_bp_event(struct perf_event *bp, void *data)
         struct perf_sample_data sample;
         struct pt_regs *regs = data;
 
-        sample.raw = NULL;
-        sample.addr = bp->attr.bp_addr;
+        perf_sample_data_init(&sample, bp->attr.bp_addr);
 
         if (!perf_exclude_event(bp, regs))
                 perf_swevent_add(bp, 1, 1, &sample, regs);
@@ -4489,6 +4623,7 @@ static void sw_perf_event_destroy(struct perf_event *event)
         WARN_ON(event->parent);
 
         atomic_dec(&perf_swevent_enabled[event_id]);
+        swevent_hlist_put(event);
 }
 
 static const struct pmu *sw_perf_event_init(struct perf_event *event)
@@ -4527,6 +4662,12 @@ static const struct pmu *sw_perf_event_init(struct perf_event *event)
         case PERF_COUNT_SW_ALIGNMENT_FAULTS:
         case PERF_COUNT_SW_EMULATION_FAULTS:
                 if (!event->parent) {
+                        int err;
+
+                        err = swevent_hlist_get(event);
+                        if (err)
+                                return ERR_PTR(err);
+
                         atomic_inc(&perf_swevent_enabled[event_id]);
                         event->destroy = sw_perf_event_destroy;
                 }
@@ -4912,7 +5053,7 @@ err_fput_free_put_context:
 
 err_free_put_context:
         if (err < 0)
-                kfree(event);
+                free_event(event);
 
 err_put_context:
         if (err < 0)
@@ -5191,7 +5332,7 @@ void perf_event_exit_task(struct task_struct *child)
          *
          * But since its the parent context it won't be the same instance.
          */
-        mutex_lock_nested(&child_ctx->mutex, SINGLE_DEPTH_NESTING);
+        mutex_lock(&child_ctx->mutex);
 
 again:
         list_for_each_entry_safe(child_event, tmp, &child_ctx->pinned_groups,
@@ -5392,18 +5533,37 @@ int perf_event_init_task(struct task_struct *child)
         return ret;
 }
 
+static void __init perf_event_init_all_cpus(void)
+{
+        int cpu;
+        struct perf_cpu_context *cpuctx;
+
+        for_each_possible_cpu(cpu) {
+                cpuctx = &per_cpu(perf_cpu_context, cpu);
+                mutex_init(&cpuctx->hlist_mutex);
+                __perf_event_init_context(&cpuctx->ctx, NULL);
+        }
+}
+
 static void __cpuinit perf_event_init_cpu(int cpu)
 {
         struct perf_cpu_context *cpuctx;
 
         cpuctx = &per_cpu(perf_cpu_context, cpu);
-        __perf_event_init_context(&cpuctx->ctx, NULL);
 
         spin_lock(&perf_resource_lock);
         cpuctx->max_pertask = perf_max_events - perf_reserved_percpu;
         spin_unlock(&perf_resource_lock);
 
-        hw_perf_event_setup(cpu);
+        mutex_lock(&cpuctx->hlist_mutex);
+        if (cpuctx->hlist_refcount > 0) {
+                struct swevent_hlist *hlist;
+
+                hlist = kzalloc(sizeof(*hlist), GFP_KERNEL);
+                WARN_ON_ONCE(!hlist);
+                rcu_assign_pointer(cpuctx->swevent_hlist, hlist);
+        }
+        mutex_unlock(&cpuctx->hlist_mutex);
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -5423,6 +5583,10 @@ static void perf_event_exit_cpu(int cpu)
         struct perf_cpu_context *cpuctx = &per_cpu(perf_cpu_context, cpu);
         struct perf_event_context *ctx = &cpuctx->ctx;
 
+        mutex_lock(&cpuctx->hlist_mutex);
+        swevent_hlist_release(cpuctx);
+        mutex_unlock(&cpuctx->hlist_mutex);
+
         mutex_lock(&ctx->mutex);
         smp_call_function_single(cpu, __perf_event_exit_cpu, NULL, 1);
         mutex_unlock(&ctx->mutex);
@@ -5443,20 +5607,11 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
                 perf_event_init_cpu(cpu);
                 break;
 
-        case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
-                hw_perf_event_setup_online(cpu);
-                break;
-
         case CPU_DOWN_PREPARE:
         case CPU_DOWN_PREPARE_FROZEN:
                 perf_event_exit_cpu(cpu);
                 break;
 
-        case CPU_DEAD:
-                hw_perf_event_setup_offline(cpu);
-                break;
-
         default:
                 break;
         }
@@ -5474,6 +5629,7 @@ static struct notifier_block __cpuinitdata perf_cpu_nb = {
 
 void __init perf_event_init(void)
 {
+        perf_event_init_all_cpus();
         perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_UP_PREPARE,
                         (void *)(long)smp_processor_id());
         perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_ONLINE,
@@ -5481,13 +5637,16 @@ void __init perf_event_init(void)
         register_cpu_notifier(&perf_cpu_nb);
 }
 
-static ssize_t perf_show_reserve_percpu(struct sysdev_class *class, char *buf)
+static ssize_t perf_show_reserve_percpu(struct sysdev_class *class,
+                                        struct sysdev_class_attribute *attr,
+                                        char *buf)
 {
         return sprintf(buf, "%d\n", perf_reserved_percpu);
 }
 
 static ssize_t
 perf_set_reserve_percpu(struct sysdev_class *class,
+                        struct sysdev_class_attribute *attr,
                         const char *buf,
                         size_t count)
 {
@@ -5516,13 +5675,17 @@ perf_set_reserve_percpu(struct sysdev_class *class,
         return count;
 }
 
-static ssize_t perf_show_overcommit(struct sysdev_class *class, char *buf)
+static ssize_t perf_show_overcommit(struct sysdev_class *class,
+                                    struct sysdev_class_attribute *attr,
+                                    char *buf)
 {
         return sprintf(buf, "%d\n", perf_overcommit);
 }
 
 static ssize_t
-perf_set_overcommit(struct sysdev_class *class, const char *buf, size_t count)
+perf_set_overcommit(struct sysdev_class *class,
+                    struct sysdev_class_attribute *attr,
+                    const char *buf, size_t count)
 {
         unsigned long val;
         int err;
diff --git a/kernel/pid.c b/kernel/pid.c
index b08e697cd83f..aebb30d9c233 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -367,7 +367,9 @@ struct task_struct *pid_task(struct pid *pid, enum pid_type type)
         struct task_struct *result = NULL;
         if (pid) {
                 struct hlist_node *first;
-                first = rcu_dereference_check(pid->tasks[type].first, rcu_read_lock_held() || lockdep_is_held(&tasklist_lock));
+                first = rcu_dereference_check(pid->tasks[type].first,
+                                              rcu_read_lock_held() ||
+                                              lockdep_tasklist_lock_is_held());
                 if (first)
                         result = hlist_entry(first, struct task_struct, pids[(type)].node);
         }
@@ -376,7 +378,7 @@ struct task_struct *pid_task(struct pid *pid, enum pid_type type)
 EXPORT_SYMBOL(pid_task);
 
 /*
- * Must be called under rcu_read_lock() or with tasklist_lock read-held.
+ * Must be called under rcu_read_lock().
  */
 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
 {
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 86b3796b0436..a5aff94e1f0b 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -13,6 +13,7 @@
 #include <linux/syscalls.h>
 #include <linux/err.h>
 #include <linux/acct.h>
+#include <linux/slab.h>
 
 #define BITS_PER_PAGE           (PAGE_SIZE*8)
 
@@ -161,13 +162,12 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
                 rcu_read_lock();
 
                 /*
-                 * Use force_sig() since it clears SIGNAL_UNKILLABLE ensuring
-                 * any nested-container's init processes don't ignore the
-                 * signal
+                 * Any nested-container's init processes won't ignore the
+                 * SEND_SIG_NOINFO signal, see send_signal()->si_fromuser().
                  */
                 task = pid_task(find_vpid(nr), PIDTYPE_PID);
                 if (task)
-                        force_sig(SIGKILL, task);
+                        send_sig_info(SIGKILL, SEND_SIG_NOINFO, task);
 
                 rcu_read_unlock();
 
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 438ff4523513..bc7704b3a443 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -982,6 +982,7 @@ static void check_thread_timers(struct task_struct *tsk,
         int maxfire;
         struct list_head *timers = tsk->cpu_timers;
         struct signal_struct *const sig = tsk->signal;
+        unsigned long soft;
 
         maxfire = 20;
         tsk->cputime_expires.prof_exp = cputime_zero;
@@ -1030,9 +1031,10 @@ static void check_thread_timers(struct task_struct *tsk,
         /*
          * Check for the special case thread timers.
          */
-        if (sig->rlim[RLIMIT_RTTIME].rlim_cur != RLIM_INFINITY) {
-                unsigned long hard = sig->rlim[RLIMIT_RTTIME].rlim_max;
-                unsigned long *soft = &sig->rlim[RLIMIT_RTTIME].rlim_cur;
+        soft = ACCESS_ONCE(sig->rlim[RLIMIT_RTTIME].rlim_cur);
+        if (soft != RLIM_INFINITY) {
+                unsigned long hard =
+                        ACCESS_ONCE(sig->rlim[RLIMIT_RTTIME].rlim_max);
 
                 if (hard != RLIM_INFINITY &&
                     tsk->rt.timeout > DIV_ROUND_UP(hard, USEC_PER_SEC/HZ)) {
@@ -1043,14 +1045,13 @@ static void check_thread_timers(struct task_struct *tsk,
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
-                if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
+                if (tsk->rt.timeout > DIV_ROUND_UP(soft, USEC_PER_SEC/HZ)) {
                         /*
                          * At the soft limit, send a SIGXCPU every second.
                          */
-                        if (sig->rlim[RLIMIT_RTTIME].rlim_cur
-                            < sig->rlim[RLIMIT_RTTIME].rlim_max) {
-                                sig->rlim[RLIMIT_RTTIME].rlim_cur +=
-                                                                USEC_PER_SEC;
+                        if (soft < hard) {
+                                soft += USEC_PER_SEC;
+                                sig->rlim[RLIMIT_RTTIME].rlim_cur = soft;
                         }
                         printk(KERN_INFO
                                 "RT Watchdog Timeout: %s[%d]\n",
@@ -1060,9 +1061,9 @@ static void check_thread_timers(struct task_struct *tsk,
         }
 }
 
-static void stop_process_timers(struct task_struct *tsk)
+static void stop_process_timers(struct signal_struct *sig)
 {
-        struct thread_group_cputimer *cputimer = &tsk->signal->cputimer;
+        struct thread_group_cputimer *cputimer = &sig->cputimer;
         unsigned long flags;
 
         if (!cputimer->running)
@@ -1071,6 +1072,10 @@ static void stop_process_timers(struct task_struct *tsk)
         spin_lock_irqsave(&cputimer->lock, flags);
         cputimer->running = 0;
         spin_unlock_irqrestore(&cputimer->lock, flags);
+
+        sig->cputime_expires.prof_exp = cputime_zero;
+        sig->cputime_expires.virt_exp = cputime_zero;
+        sig->cputime_expires.sched_exp = 0;
 }
 
 static u32 onecputick;
@@ -1121,6 +1126,7 @@ static void check_process_timers(struct task_struct *tsk,
         unsigned long long sum_sched_runtime, sched_expires;
         struct list_head *timers = sig->cpu_timers;
         struct task_cputime cputime;
+        unsigned long soft;
 
         /*
          * Don't sample the current process CPU clocks if there are no timers.
@@ -1131,7 +1137,7 @@ static void check_process_timers(struct task_struct *tsk,
             list_empty(&timers[CPUCLOCK_VIRT]) &&
             cputime_eq(sig->it[CPUCLOCK_VIRT].expires, cputime_zero) &&
             list_empty(&timers[CPUCLOCK_SCHED])) {
-                stop_process_timers(tsk);
+                stop_process_timers(sig);
                 return;
         }
 
@@ -1193,11 +1199,13 @@ static void check_process_timers(struct task_struct *tsk,
                          SIGPROF);
         check_cpu_itimer(tsk, &sig->it[CPUCLOCK_VIRT], &virt_expires, utime,
                          SIGVTALRM);
-
-        if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
+        soft = ACCESS_ONCE(sig->rlim[RLIMIT_CPU].rlim_cur);
+        if (soft != RLIM_INFINITY) {
                 unsigned long psecs = cputime_to_secs(ptime);
+                unsigned long hard =
+                        ACCESS_ONCE(sig->rlim[RLIMIT_CPU].rlim_max);
                 cputime_t x;
-                if (psecs >= sig->rlim[RLIMIT_CPU].rlim_max) {
+                if (psecs >= hard) {
                         /*
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
@@ -1205,17 +1213,17 @@ static void check_process_timers(struct task_struct *tsk,
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
-                if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
+                if (psecs >= soft) {
                         /*
                          * At the soft limit, send a SIGXCPU every second.
                          */
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
-                        if (sig->rlim[RLIMIT_CPU].rlim_cur
-                            < sig->rlim[RLIMIT_CPU].rlim_max) {
-                                sig->rlim[RLIMIT_CPU].rlim_cur++;
+                        if (soft < hard) {
+                                soft++;
+                                sig->rlim[RLIMIT_CPU].rlim_cur = soft;
                         }
                 }
-                x = secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur);
+                x = secs_to_cputime(soft);
                 if (cputime_eq(prof_expires, cputime_zero) ||
                     cputime_lt(x, prof_expires)) {
                         prof_expires = x;
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index bbfe472d7524..aa9e916da4d5 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -22,6 +22,7 @@
 #include <linux/console.h>
 #include <linux/cpu.h>
 #include <linux/freezer.h>
+#include <linux/gfp.h>
 #include <scsi/scsi_scan.h>
 #include <asm/suspend.h>
 
@@ -323,6 +324,7 @@ static int create_image(int platform_mode)
 int hibernation_snapshot(int platform_mode)
 {
         int error;
+        gfp_t saved_mask;
 
         error = platform_begin(platform_mode);
         if (error)
@@ -334,6 +336,7 @@ int hibernation_snapshot(int platform_mode)
                 goto Close;
 
         suspend_console();
+        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
         error = dpm_suspend_start(PMSG_FREEZE);
         if (error)
                 goto Recover_platform;
@@ -351,6 +354,7 @@ int hibernation_snapshot(int platform_mode)
 
         dpm_resume_end(in_suspend ?
                 (error ? PMSG_RECOVER : PMSG_THAW) : PMSG_RESTORE);
+        set_gfp_allowed_mask(saved_mask);
         resume_console();
  Close:
         platform_end(platform_mode);
@@ -445,14 +449,17 @@ static int resume_target_kernel(bool platform_mode)
 int hibernation_restore(int platform_mode)
 {
         int error;
+        gfp_t saved_mask;
 
         pm_prepare_console();
         suspend_console();
+        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
         error = dpm_suspend_start(PMSG_QUIESCE);
         if (!error) {
                 error = resume_target_kernel(platform_mode);
                 dpm_resume_end(PMSG_RECOVER);
         }
+        set_gfp_allowed_mask(saved_mask);
         resume_console();
         pm_restore_console();
         return error;
@@ -466,6 +473,7 @@ int hibernation_restore(int platform_mode)
 int hibernation_platform_enter(void)
 {
         int error;
+        gfp_t saved_mask;
 
         if (!hibernation_ops)
                 return -ENOSYS;
@@ -481,6 +489,7 @@ int hibernation_platform_enter(void)
 
         entering_platform_hibernation = true;
         suspend_console();
+        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
         error = dpm_suspend_start(PMSG_HIBERNATE);
         if (error) {
                 if (hibernation_ops->recover)
@@ -518,6 +527,7 @@ int hibernation_platform_enter(void)
  Resume_devices:
         entering_platform_hibernation = false;
         dpm_resume_end(PMSG_RESTORE);
+        set_gfp_allowed_mask(saved_mask);
         resume_console();
 
  Close:
diff --git a/kernel/power/hibernate_nvs.c b/kernel/power/hibernate_nvs.c
index 39ac698ef836..fdcad9ed5a7b 100644
--- a/kernel/power/hibernate_nvs.c
+++ b/kernel/power/hibernate_nvs.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/suspend.h>
 
 /*
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 5ade1bdcf366..71ae29052ab6 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -88,12 +88,11 @@ static int try_to_freeze_tasks(bool sig_only)
                 printk(KERN_ERR "Freezing of tasks failed after %d.%02d seconds "
                                 "(%d tasks refusing to freeze):\n",
                                 elapsed_csecs / 100, elapsed_csecs % 100, todo);
-                show_state();
                 read_lock(&tasklist_lock);
                 do_each_thread(g, p) {
                         task_lock(p);
                         if (freezing(p) && !freezer_should_skip(p))
-                                printk(KERN_ERR " %s\n", p->comm);
+                                sched_show_task(p);
                         cancel_freezing(p);
                         task_unlock(p);
                 } while_each_thread(g, p);
@@ -145,7 +144,7 @@ static void thaw_tasks(bool nosig_only)
                 if (nosig_only && should_send_signal(p))
                         continue;
 
-                if (cgroup_frozen(p))
+                if (cgroup_freezing_or_frozen(p))
                         continue;
 
                 thaw_process(p);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 830cadecbdfc..be861c26dda7 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -26,6 +26,7 @@
 #include <linux/console.h>
 #include <linux/highmem.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 6f10dfc2d3e9..56e7dbb8b996 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -15,6 +15,7 @@
 #include <linux/console.h>
 #include <linux/cpu.h>
 #include <linux/syscalls.h>
+#include <linux/gfp.h>
 
 #include "power.h"
 
@@ -189,6 +190,7 @@ static int suspend_enter(suspend_state_t state)
 int suspend_devices_and_enter(suspend_state_t state)
 {
         int error;
+        gfp_t saved_mask;
 
         if (!suspend_ops)
                 return -ENOSYS;
@@ -199,6 +201,7 @@ int suspend_devices_and_enter(suspend_state_t state)
                         goto Close;
         }
         suspend_console();
+        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
         suspend_test_start();
         error = dpm_suspend_start(PMSG_SUSPEND);
         if (error) {
@@ -215,6 +218,7 @@ int suspend_devices_and_enter(suspend_state_t state)
         suspend_test_start();
         dpm_resume_end(PMSG_RESUME);
         suspend_test_finish("resume devices");
+        set_gfp_allowed_mask(saved_mask);
         resume_console();
  Close:
         if (suspend_ops->end)
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 1d575733d4e1..66824d71983a 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -23,6 +23,7 @@
 #include <linux/swap.h>
 #include <linux/swapops.h>
 #include <linux/pm.h>
+#include <linux/slab.h>
 
 #include "power.h"
 
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 4d2289626a84..a8c96212bc1b 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -420,7 +420,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                          * User space encodes device types as two-byte values,
                          * so we need to recode them
                          */
-                        swdev = old_decode_dev(swap_area.dev);
+                        swdev = new_decode_dev(swap_area.dev);
                         if (swdev) {
                                 offset = swap_area.offset;
                                 data->swap = swap_type_of(swdev, offset, NULL);
diff --git a/kernel/printk.c b/kernel/printk.c
index 1751c456b71f..75077ad0b537 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -35,6 +35,7 @@
 #include <linux/kexec.h>
 #include <linux/ratelimit.h>
 #include <linux/kmsg_dump.h>
+#include <linux/syslog.h>
 
 #include <asm/uaccess.h>
 
@@ -69,8 +70,6 @@ int console_printk[4] = {
         DEFAULT_CONSOLE_LOGLEVEL,       /* default_console_loglevel */
 };
 
-static int saved_console_loglevel = -1;
-
 /*
  * Low level drivers may need that to know if they can schedule in
  * their unblank() callback or not. So let's export it.
@@ -145,6 +144,7 @@ static char __log_buf[__LOG_BUF_LEN];
 static char *log_buf = __log_buf;
 static int log_buf_len = __LOG_BUF_LEN;
 static unsigned logged_chars; /* Number of chars produced since last read+clear operation */
+static int saved_console_loglevel = -1;
 
 #ifdef CONFIG_KEXEC
 /*
@@ -258,38 +258,23 @@ static inline void boot_delay_msec(void)
 }
 #endif
 
-/*
- * Commands to do_syslog:
- *
- *      0 -- Close the log.  Currently a NOP.
- *      1 -- Open the log. Currently a NOP.
- *      2 -- Read from the log.
- *      3 -- Read all messages remaining in the ring buffer.
- *      4 -- Read and clear all messages remaining in the ring buffer
- *      5 -- Clear ring buffer.
- *      6 -- Disable printk's to console
- *      7 -- Enable printk's to console
- *      8 -- Set level of messages printed to console
- *      9 -- Return number of unread characters in the log buffer
- *     10 -- Return size of the log buffer
- */
-int do_syslog(int type, char __user *buf, int len)
+int do_syslog(int type, char __user *buf, int len, bool from_file)
 {
         unsigned i, j, limit, count;
         int do_clear = 0;
         char c;
         int error = 0;
 
-        error = security_syslog(type);
+        error = security_syslog(type, from_file);
         if (error)
                 return error;
 
         switch (type) {
-        case 0:         /* Close log */
+        case SYSLOG_ACTION_CLOSE:       /* Close log */
                 break;
-        case 1:         /* Open log */
+        case SYSLOG_ACTION_OPEN:        /* Open log */
                 break;
-        case 2:         /* Read from log */
+        case SYSLOG_ACTION_READ:        /* Read from log */
                 error = -EINVAL;
                 if (!buf || len < 0)
                         goto out;
@@ -320,10 +305,12 @@ int do_syslog(int type, char __user *buf, int len)
                 if (!error)
                         error = i;
                 break;
-        case 4:         /* Read/clear last kernel messages */
+        /* Read/clear last kernel messages */
+        case SYSLOG_ACTION_READ_CLEAR:
                 do_clear = 1;
                 /* FALL THRU */
-        case 3:         /* Read last kernel messages */
+        /* Read last kernel messages */
+        case SYSLOG_ACTION_READ_ALL:
                 error = -EINVAL;
                 if (!buf || len < 0)
                         goto out;
@@ -376,21 +363,25 @@ int do_syslog(int type, char __user *buf, int len)
                         }
                 }
                 break;
-        case 5:         /* Clear ring buffer */
+        /* Clear ring buffer */
+        case SYSLOG_ACTION_CLEAR:
                 logged_chars = 0;
                 break;
-        case 6:         /* Disable logging to console */
+        /* Disable logging to console */
+        case SYSLOG_ACTION_CONSOLE_OFF:
                 if (saved_console_loglevel == -1)
                         saved_console_loglevel = console_loglevel;
                 console_loglevel = minimum_console_loglevel;
                 break;
-        case 7:         /* Enable logging to console */
+        /* Enable logging to console */
+        case SYSLOG_ACTION_CONSOLE_ON:
                 if (saved_console_loglevel != -1) {
                         console_loglevel = saved_console_loglevel;
                         saved_console_loglevel = -1;
                 }
                 break;
-        case 8:         /* Set level of messages printed to console */
+        /* Set level of messages printed to console */
+        case SYSLOG_ACTION_CONSOLE_LEVEL:
                 error = -EINVAL;
                 if (len < 1 || len > 8)
                         goto out;
@@ -401,10 +392,12 @@ int do_syslog(int type, char __user *buf, int len)
                 saved_console_loglevel = -1;
                 error = 0;
                 break;
-        case 9:         /* Number of chars in the log buffer */
+        /* Number of chars in the log buffer */
+        case SYSLOG_ACTION_SIZE_UNREAD:
                 error = log_end - log_start;
                 break;
-        case 10:        /* Size of the log buffer */
+        /* Size of the log buffer */
+        case SYSLOG_ACTION_SIZE_BUFFER:
                 error = log_buf_len;
                 break;
         default:
@@ -417,7 +410,7 @@ out:
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
-        return do_syslog(type, buf, len);
+        return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
 }
 
 /*
diff --git a/kernel/profile.c b/kernel/profile.c
index a55d3a367ae8..dfadc5b729f1 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -127,8 +127,10 @@ int __ref profile_init(void)
                 return 0;
 
         prof_buffer = vmalloc(buffer_bytes);
-        if (prof_buffer)
+        if (prof_buffer) {
+                memset(prof_buffer, 0, buffer_bytes);
                 return 0;
+        }
 
         free_cpumask_var(prof_cpu_mask);
         return -ENOMEM;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 42ad8ae729a0..6af9cdd558b7 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -14,7 +14,6 @@
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
-#include <linux/smp_lock.h>
 #include <linux/ptrace.h>
 #include <linux/security.h>
 #include <linux/signal.h>
@@ -76,7 +75,6 @@ void __ptrace_unlink(struct task_struct *child)
         child->parent = child->real_parent;
         list_del_init(&child->ptrace_entry);
 
-        arch_ptrace_untrace(child);
         if (task_is_traced(child))
                 ptrace_untrace(child);
 }
@@ -666,10 +664,6 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
         struct task_struct *child;
         long ret;
 
-        /*
-         * This lock_kernel fixes a subtle race with suid exec
-         */
-        lock_kernel();
         if (request == PTRACE_TRACEME) {
                 ret = ptrace_traceme();
                 if (!ret)
@@ -703,7 +697,6 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
  out_put_task_struct:
         put_task_struct(child);
  out:
-        unlock_kernel();
         return ret;
 }
 
@@ -813,10 +806,6 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
         struct task_struct *child;
         long ret;
 
-        /*
-         * This lock_kernel fixes a subtle race with suid exec
-         */
-        lock_kernel();
         if (request == PTRACE_TRACEME) {
                 ret = ptrace_traceme();
                 goto out;
@@ -846,7 +835,6 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
  out_put_task_struct:
         put_task_struct(child);
  out:
-        unlock_kernel();
         return ret;
 }
 #endif  /* CONFIG_COMPAT */
diff --git a/kernel/range.c b/kernel/range.c
new file mode 100644
index 000000000000..74e2e6114927
--- /dev/null
+++ b/kernel/range.c
@@ -0,0 +1,163 @@
+/*
+ * Range add and subtract
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sort.h>
+
+#include <linux/range.h>
+
+#ifndef ARRAY_SIZE
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
+int add_range(struct range *range, int az, int nr_range, u64 start, u64 end)
+{
+        if (start >= end)
+                return nr_range;
+
+        /* Out of slots: */
+        if (nr_range >= az)
+                return nr_range;
+
+        range[nr_range].start = start;
+        range[nr_range].end = end;
+
+        nr_range++;
+
+        return nr_range;
+}
+
+int add_range_with_merge(struct range *range, int az, int nr_range,
+                     u64 start, u64 end)
+{
+        int i;
+
+        if (start >= end)
+                return nr_range;
+
+        /* Try to merge it with old one: */
+        for (i = 0; i < nr_range; i++) {
+                u64 final_start, final_end;
+                u64 common_start, common_end;
+
+                if (!range[i].end)
+                        continue;
+
+                common_start = max(range[i].start, start);
+                common_end = min(range[i].end, end);
+                if (common_start > common_end)
+                        continue;
+
+                final_start = min(range[i].start, start);
+                final_end = max(range[i].end, end);
+
+                range[i].start = final_start;
+                range[i].end =  final_end;
+                return nr_range;
+        }
+
+        /* Need to add it: */
+        return add_range(range, az, nr_range, start, end);
+}
+
+void subtract_range(struct range *range, int az, u64 start, u64 end)
+{
+        int i, j;
+
+        if (start >= end)
+                return;
+
+        for (j = 0; j < az; j++) {
+                if (!range[j].end)
+                        continue;
+
+                if (start <= range[j].start && end >= range[j].end) {
+                        range[j].start = 0;
+                        range[j].end = 0;
+                        continue;
+                }
+
+                if (start <= range[j].start && end < range[j].end &&
+                    range[j].start < end) {
+                        range[j].start = end;
+                        continue;
+                }
+
+
+                if (start > range[j].start && end >= range[j].end &&
+                    range[j].end > start) {
+                        range[j].end = start;
+                        continue;
+                }
+
+                if (start > range[j].start && end < range[j].end) {
+                        /* Find the new spare: */
+                        for (i = 0; i < az; i++) {
+                                if (range[i].end == 0)
+                                        break;
+                        }
+                        if (i < az) {
+                                range[i].end = range[j].end;
+                                range[i].start = end;
+                        } else {
+                                printk(KERN_ERR "run of slot in ranges\n");
+                        }
+                        range[j].end = start;
+                        continue;
+                }
+        }
+}
+
+static int cmp_range(const void *x1, const void *x2)
+{
+        const struct range *r1 = x1;
+        const struct range *r2 = x2;
+        s64 start1, start2;
+
+        start1 = r1->start;
+        start2 = r2->start;
+
+        return start1 - start2;
+}
+
+int clean_sort_range(struct range *range, int az)
+{
+        int i, j, k = az - 1, nr_range = 0;
+
+        for (i = 0; i < k; i++) {
+                if (range[i].end)
+                        continue;
+                for (j = k; j > i; j--) {
+                        if (range[j].end) {
+                                k = j;
+                                break;
+                        }
+                }
+                if (j == i)
+                        break;
+                range[i].start = range[k].start;
+                range[i].end   = range[k].end;
+                range[k].start = 0;
+                range[k].end   = 0;
+                k--;
+        }
+        /* count it */
+        for (i = 0; i < az; i++) {
+                if (!range[i].end) {
+                        nr_range = i;
+                        break;
+                }
+        }
+
+        /* sort them */
+        sort(range, nr_range, sizeof(struct range), cmp_range, NULL);
+
+        return nr_range;
+}
+
+void sort_range(struct range *range, int nr_range)
+{
+        /* sort them */
+        sort(range, nr_range, sizeof(struct range), cmp_range, NULL);
+}
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index f1125c1a6321..72a8dc9567f5 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -44,7 +44,7 @@
 #include <linux/cpu.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
-#include <linux/kernel_stat.h>
+#include <linux/hardirq.h>
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key rcu_lock_key;
@@ -63,23 +63,34 @@ struct lockdep_map rcu_sched_lock_map =
 EXPORT_SYMBOL_GPL(rcu_sched_lock_map);
 #endif
 
-int rcu_scheduler_active __read_mostly;
-EXPORT_SYMBOL_GPL(rcu_scheduler_active);
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
 
-/*
- * This function is invoked towards the end of the scheduler's initialization
- * process.  Before this is called, the idle task might contain
- * RCU read-side critical sections (during which time, this idle
- * task is booting the system).  After this function is called, the
- * idle tasks are prohibited from containing RCU read-side critical
- * sections.
+int debug_lockdep_rcu_enabled(void)
+{
+        return rcu_scheduler_active && debug_locks &&
+               current->lockdep_recursion == 0;
+}
+EXPORT_SYMBOL_GPL(debug_lockdep_rcu_enabled);
+
+/**
+ * rcu_read_lock_bh_held - might we be in RCU-bh read-side critical section?
+ *
+ * Check for bottom half being disabled, which covers both the
+ * CONFIG_PROVE_RCU and not cases.  Note that if someone uses
+ * rcu_read_lock_bh(), but then later enables BH, lockdep (if enabled)
+ * will show the situation.
+ *
+ * Check debug_lockdep_rcu_enabled() to prevent false positives during boot.
  */
-void rcu_scheduler_starting(void)
+int rcu_read_lock_bh_held(void)
 {
-        WARN_ON(num_online_cpus() != 1);
-        WARN_ON(nr_context_switches() > 0);
-        rcu_scheduler_active = 1;
+        if (!debug_lockdep_rcu_enabled())
+                return 1;
+        return in_softirq();
 }
+EXPORT_SYMBOL_GPL(rcu_read_lock_bh_held);
+
+#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
 
 /*
  * Awaken the corresponding synchronize_rcu() instance now that a
@@ -92,3 +103,14 @@ void wakeme_after_rcu(struct rcu_head  *head)
         rcu = container_of(head, struct rcu_synchronize, head);
         complete(&rcu->completion);
 }
+
+#ifdef CONFIG_PROVE_RCU
+/*
+ * wrapper function to avoid #include problems.
+ */
+int rcu_my_thread_group_empty(void)
+{
+        return thread_group_empty(current);
+}
+EXPORT_SYMBOL_GPL(rcu_my_thread_group_empty);
+#endif /* #ifdef CONFIG_PROVE_RCU */
diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c
index 9f6d9ff2572c..38729d3cd236 100644
--- a/kernel/rcutiny.c
+++ b/kernel/rcutiny.c
@@ -44,9 +44,9 @@ struct rcu_ctrlblk {
 };
 
 /* Definition for rcupdate control block. */
-static struct rcu_ctrlblk rcu_ctrlblk = {
-        .donetail       = &rcu_ctrlblk.rcucblist,
-        .curtail        = &rcu_ctrlblk.rcucblist,
+static struct rcu_ctrlblk rcu_sched_ctrlblk = {
+        .donetail       = &rcu_sched_ctrlblk.rcucblist,
+        .curtail        = &rcu_sched_ctrlblk.rcucblist,
 };
 
 static struct rcu_ctrlblk rcu_bh_ctrlblk = {
@@ -54,6 +54,11 @@ static struct rcu_ctrlblk rcu_bh_ctrlblk = {
         .curtail        = &rcu_bh_ctrlblk.rcucblist,
 };
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+int rcu_scheduler_active __read_mostly;
+EXPORT_SYMBOL_GPL(rcu_scheduler_active);
+#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
+
 #ifdef CONFIG_NO_HZ
 
 static long rcu_dynticks_nesting = 1;
@@ -108,7 +113,8 @@ static int rcu_qsctr_help(struct rcu_ctrlblk *rcp)
  */
 void rcu_sched_qs(int cpu)
 {
-        if (rcu_qsctr_help(&rcu_ctrlblk) + rcu_qsctr_help(&rcu_bh_ctrlblk))
+        if (rcu_qsctr_help(&rcu_sched_ctrlblk) +
+            rcu_qsctr_help(&rcu_bh_ctrlblk))
                 raise_softirq(RCU_SOFTIRQ);
 }
 
@@ -173,7 +179,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
  */
 static void rcu_process_callbacks(struct softirq_action *unused)
 {
-        __rcu_process_callbacks(&rcu_ctrlblk);
+        __rcu_process_callbacks(&rcu_sched_ctrlblk);
         __rcu_process_callbacks(&rcu_bh_ctrlblk);
 }
 
@@ -187,7 +193,8 @@ static void rcu_process_callbacks(struct softirq_action *unused)
  *
  * Cool, huh?  (Due to Josh Triplett.)
  *
- * But we want to make this a static inline later.
+ * But we want to make this a static inline later.  The cond_resched()
+ * currently makes this problematic.
  */
 void synchronize_sched(void)
 {
@@ -195,12 +202,6 @@ void synchronize_sched(void)
 }
 EXPORT_SYMBOL_GPL(synchronize_sched);
 
-void synchronize_rcu_bh(void)
-{
-        synchronize_sched();
-}
-EXPORT_SYMBOL_GPL(synchronize_rcu_bh);
-
 /*
  * Helper function for call_rcu() and call_rcu_bh().
  */
@@ -226,7 +227,7 @@ static void __call_rcu(struct rcu_head *head,
  */
 void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 {
-        __call_rcu(head, func, &rcu_ctrlblk);
+        __call_rcu(head, func, &rcu_sched_ctrlblk);
 }
 EXPORT_SYMBOL_GPL(call_rcu);
 
@@ -244,11 +245,13 @@ void rcu_barrier(void)
 {
         struct rcu_synchronize rcu;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu(&rcu.head, wakeme_after_rcu);
         /* Wait for it. */
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 EXPORT_SYMBOL_GPL(rcu_barrier);
 
@@ -256,11 +259,13 @@ void rcu_barrier_bh(void)
 {
         struct rcu_synchronize rcu;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu_bh(&rcu.head, wakeme_after_rcu);
         /* Wait for it. */
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 EXPORT_SYMBOL_GPL(rcu_barrier_bh);
 
@@ -268,11 +273,13 @@ void rcu_barrier_sched(void)
 {
         struct rcu_synchronize rcu;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu_sched(&rcu.head, wakeme_after_rcu);
         /* Wait for it. */
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 EXPORT_SYMBOL_GPL(rcu_barrier_sched);
 
@@ -280,3 +287,5 @@ void __init rcu_init(void)
 {
         open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 }
+
+#include "rcutiny_plugin.h"
diff --git a/kernel/rcutiny_plugin.h b/kernel/rcutiny_plugin.h
new file mode 100644
index 000000000000..d223a92bc742
--- /dev/null
+++ b/kernel/rcutiny_plugin.h
@@ -0,0 +1,39 @@
+/*
+ * Read-Copy Update mechanism for mutual exclusion (tree-based version)
+ * Internal non-public definitions that provide either classic
+ * or preemptable semantics.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Copyright IBM Corporation, 2009
+ *
+ * Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+ */
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+
+#include <linux/kernel_stat.h>
+
+/*
+ * During boot, we forgive RCU lockdep issues.  After this function is
+ * invoked, we start taking RCU lockdep issues seriously.
+ */
+void rcu_scheduler_starting(void)
+{
+        WARN_ON(nr_context_switches() > 0);
+        rcu_scheduler_active = 1;
+}
+
+#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 258cdf0a91eb..6535ac8bc6a5 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -464,9 +464,11 @@ static void rcu_bh_torture_synchronize(void)
 {
         struct rcu_bh_torture_synchronize rcu;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         call_rcu_bh(&rcu.head, rcu_bh_torture_wakeme_after_cb);
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 
 static struct rcu_torture_ops rcu_bh_ops = {
@@ -669,7 +671,7 @@ static struct rcu_torture_ops sched_expedited_ops = {
         .sync           = synchronize_sched_expedited,
         .cb_barrier     = NULL,
         .fqs            = rcu_sched_force_quiescent_state,
-        .stats          = rcu_expedited_torture_stats,
+        .stats          = NULL,
         .irq_capable    = 1,
         .name           = "sched_expedited"
 };
@@ -818,13 +820,13 @@ static void rcu_torture_timer(unsigned long unused)
                 /* Should not happen, but... */
                 pipe_count = RCU_TORTURE_PIPE_LEN;
         }
-        __this_cpu_inc(per_cpu_var(rcu_torture_count)[pipe_count]);
+        __this_cpu_inc(rcu_torture_count[pipe_count]);
         completed = cur_ops->completed() - completed;
         if (completed > RCU_TORTURE_PIPE_LEN) {
                 /* Should not happen, but... */
                 completed = RCU_TORTURE_PIPE_LEN;
         }
-        __this_cpu_inc(per_cpu_var(rcu_torture_batch)[completed]);
+        __this_cpu_inc(rcu_torture_batch[completed]);
         preempt_enable();
         cur_ops->readunlock(idx);
 }
@@ -877,13 +879,13 @@ rcu_torture_reader(void *arg)
                         /* Should not happen, but... */
                         pipe_count = RCU_TORTURE_PIPE_LEN;
                 }
-                __this_cpu_inc(per_cpu_var(rcu_torture_count)[pipe_count]);
+                __this_cpu_inc(rcu_torture_count[pipe_count]);
                 completed = cur_ops->completed() - completed;
                 if (completed > RCU_TORTURE_PIPE_LEN) {
                         /* Should not happen, but... */
                         completed = RCU_TORTURE_PIPE_LEN;
                 }
-                __this_cpu_inc(per_cpu_var(rcu_torture_batch)[completed]);
+                __this_cpu_inc(rcu_torture_batch[completed]);
                 preempt_enable();
                 cur_ops->readunlock(idx);
                 schedule();
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 3ec8160fc75f..d4437345706f 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -46,6 +46,7 @@
 #include <linux/cpu.h>
 #include <linux/mutex.h>
 #include <linux/time.h>
+#include <linux/kernel_stat.h>
 
 #include "rcutree.h"
 
@@ -53,8 +54,8 @@
 
 static struct lock_class_key rcu_node_class[NUM_RCU_LVLS];
 
-#define RCU_STATE_INITIALIZER(name) { \
-        .level = { &name.node[0] }, \
+#define RCU_STATE_INITIALIZER(structname) { \
+        .level = { &structname.node[0] }, \
         .levelcnt = { \
                 NUM_RCU_LVL_0,  /* root of hierarchy. */ \
                 NUM_RCU_LVL_1, \
@@ -65,13 +66,14 @@ static struct lock_class_key rcu_node_class[NUM_RCU_LVLS];
         .signaled = RCU_GP_IDLE, \
         .gpnum = -300, \
         .completed = -300, \
-        .onofflock = __RAW_SPIN_LOCK_UNLOCKED(&name.onofflock), \
+        .onofflock = __RAW_SPIN_LOCK_UNLOCKED(&structname.onofflock), \
         .orphan_cbs_list = NULL, \
-        .orphan_cbs_tail = &name.orphan_cbs_list, \
+        .orphan_cbs_tail = &structname.orphan_cbs_list, \
         .orphan_qlen = 0, \
-        .fqslock = __RAW_SPIN_LOCK_UNLOCKED(&name.fqslock), \
+        .fqslock = __RAW_SPIN_LOCK_UNLOCKED(&structname.fqslock), \
         .n_force_qs = 0, \
         .n_force_qs_ngp = 0, \
+        .name = #structname, \
 }
 
 struct rcu_state rcu_sched_state = RCU_STATE_INITIALIZER(rcu_sched_state);
@@ -80,6 +82,9 @@ DEFINE_PER_CPU(struct rcu_data, rcu_sched_data);
 struct rcu_state rcu_bh_state = RCU_STATE_INITIALIZER(rcu_bh_state);
 DEFINE_PER_CPU(struct rcu_data, rcu_bh_data);
 
+int rcu_scheduler_active __read_mostly;
+EXPORT_SYMBOL_GPL(rcu_scheduler_active);
+
 /*
  * Return true if an RCU grace period is in progress.  The ACCESS_ONCE()s
  * permit this function to be invoked without holding the root rcu_node
@@ -97,25 +102,32 @@ static int rcu_gp_in_progress(struct rcu_state *rsp)
  */
 void rcu_sched_qs(int cpu)
 {
-        struct rcu_data *rdp;
+        struct rcu_data *rdp = &per_cpu(rcu_sched_data, cpu);
 
-        rdp = &per_cpu(rcu_sched_data, cpu);
         rdp->passed_quiesc_completed = rdp->gpnum - 1;
         barrier();
         rdp->passed_quiesc = 1;
-        rcu_preempt_note_context_switch(cpu);
 }
 
 void rcu_bh_qs(int cpu)
 {
-        struct rcu_data *rdp;
+        struct rcu_data *rdp = &per_cpu(rcu_bh_data, cpu);
 
-        rdp = &per_cpu(rcu_bh_data, cpu);
         rdp->passed_quiesc_completed = rdp->gpnum - 1;
         barrier();
         rdp->passed_quiesc = 1;
 }
 
+/*
+ * Note a context switch.  This is a quiescent state for RCU-sched,
+ * and requires special handling for preemptible RCU.
+ */
+void rcu_note_context_switch(int cpu)
+{
+        rcu_sched_qs(cpu);
+        rcu_preempt_note_context_switch(cpu);
+}
+
 #ifdef CONFIG_NO_HZ
 DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = {
         .dynticks_nesting = 1,
@@ -438,6 +450,8 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
 
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
 
+int rcu_cpu_stall_panicking __read_mostly;
+
 static void record_gp_stall_check_time(struct rcu_state *rsp)
 {
         rsp->gp_start = jiffies;
@@ -470,7 +484,8 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
 
         /* OK, time to rat on our buddy... */
 
-        printk(KERN_ERR "INFO: RCU detected CPU stalls:");
+        printk(KERN_ERR "INFO: %s detected stalls on CPUs/tasks: {",
+               rsp->name);
         rcu_for_each_leaf_node(rsp, rnp) {
                 raw_spin_lock_irqsave(&rnp->lock, flags);
                 rcu_print_task_stall(rnp);
@@ -481,7 +496,7 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
                         if (rnp->qsmask & (1UL << cpu))
                                 printk(" %d", rnp->grplo + cpu);
         }
-        printk(" (detected by %d, t=%ld jiffies)\n",
+        printk("} (detected by %d, t=%ld jiffies)\n",
                smp_processor_id(), (long)(jiffies - rsp->gp_start));
         trigger_all_cpu_backtrace();
 
@@ -497,8 +512,8 @@ static void print_cpu_stall(struct rcu_state *rsp)
         unsigned long flags;
         struct rcu_node *rnp = rcu_get_root(rsp);
 
-        printk(KERN_ERR "INFO: RCU detected CPU %d stall (t=%lu jiffies)\n",
-                        smp_processor_id(), jiffies - rsp->gp_start);
+        printk(KERN_ERR "INFO: %s detected stall on CPU %d (t=%lu jiffies)\n",
+               rsp->name, smp_processor_id(), jiffies - rsp->gp_start);
         trigger_all_cpu_backtrace();
 
         raw_spin_lock_irqsave(&rnp->lock, flags);
@@ -515,6 +530,8 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
         long delta;
         struct rcu_node *rnp;
 
+        if (rcu_cpu_stall_panicking)
+                return;
         delta = jiffies - rsp->jiffies_stall;
         rnp = rdp->mynode;
         if ((rnp->qsmask & rdp->grpmask) && delta >= 0) {
@@ -529,6 +546,21 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
         }
 }
 
+static int rcu_panic(struct notifier_block *this, unsigned long ev, void *ptr)
+{
+        rcu_cpu_stall_panicking = 1;
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block rcu_panic_block = {
+        .notifier_call = rcu_panic,
+};
+
+static void __init check_cpu_stall_init(void)
+{
+        atomic_notifier_chain_register(&panic_notifier_list, &rcu_panic_block);
+}
+
 #else /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
 static void record_gp_stall_check_time(struct rcu_state *rsp)
@@ -539,6 +571,10 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
 {
 }
 
+static void __init check_cpu_stall_init(void)
+{
+}
+
 #endif /* #else #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
 /*
@@ -1125,8 +1161,6 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
  */
 void rcu_check_callbacks(int cpu, int user)
 {
-        if (!rcu_pending(cpu))
-                return; /* if nothing for RCU to do. */
         if (user ||
             (idle_cpu(cpu) && rcu_scheduler_active &&
              !in_softirq() && hardirq_count() <= (1 << HARDIRQ_SHIFT))) {
@@ -1158,7 +1192,8 @@ void rcu_check_callbacks(int cpu, int user)
                 rcu_bh_qs(cpu);
         }
         rcu_preempt_check_callbacks(cpu);
-        raise_softirq(RCU_SOFTIRQ);
+        if (rcu_pending(cpu))
+                raise_softirq(RCU_SOFTIRQ);
 }
 
 #ifdef CONFIG_SMP
@@ -1236,11 +1271,11 @@ static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
                 break; /* grace period idle or initializing, ignore. */
 
         case RCU_SAVE_DYNTICK:
-
-                raw_spin_unlock(&rnp->lock);  /* irqs remain disabled */
                 if (RCU_SIGNAL_INIT != RCU_SAVE_DYNTICK)
                         break; /* So gcc recognizes the dead code. */
 
+                raw_spin_unlock(&rnp->lock);  /* irqs remain disabled */
+
                 /* Record dyntick-idle state. */
                 force_qs_rnp(rsp, dyntick_save_progress_counter);
                 raw_spin_lock(&rnp->lock);  /* irqs already disabled */
@@ -1449,11 +1484,13 @@ void synchronize_sched(void)
         if (rcu_blocking_is_gp())
                 return;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu_sched(&rcu.head, wakeme_after_rcu);
         /* Wait for it. */
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 EXPORT_SYMBOL_GPL(synchronize_sched);
 
@@ -1473,11 +1510,13 @@ void synchronize_rcu_bh(void)
         if (rcu_blocking_is_gp())
                 return;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu_bh(&rcu.head, wakeme_after_rcu);
         /* Wait for it. */
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_bh);
 
@@ -1498,8 +1537,20 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
         check_cpu_stall(rsp, rdp);
 
         /* Is the RCU core waiting for a quiescent state from this CPU? */
-        if (rdp->qs_pending) {
+        if (rdp->qs_pending && !rdp->passed_quiesc) {
+
+                /*
+                 * If force_quiescent_state() coming soon and this CPU
+                 * needs a quiescent state, and this is either RCU-sched
+                 * or RCU-bh, force a local reschedule.
+                 */
                 rdp->n_rp_qs_pending++;
+                if (!rdp->preemptable &&
+                    ULONG_CMP_LT(ACCESS_ONCE(rsp->jiffies_force_qs) - 1,
+                                 jiffies))
+                        set_need_resched();
+        } else if (rdp->qs_pending && rdp->passed_quiesc) {
+                rdp->n_rp_report_qs++;
                 return 1;
         }
 
@@ -1767,6 +1818,21 @@ static int __cpuinit rcu_cpu_notify(struct notifier_block *self,
 }
 
 /*
+ * This function is invoked towards the end of the scheduler's initialization
+ * process.  Before this is called, the idle task might contain
+ * RCU read-side critical sections (during which time, this idle
+ * task is booting the system).  After this function is called, the
+ * idle tasks are prohibited from containing RCU read-side critical
+ * sections.  This function also enables RCU lockdep checking.
+ */
+void rcu_scheduler_starting(void)
+{
+        WARN_ON(num_online_cpus() != 1);
+        WARN_ON(nr_context_switches() > 0);
+        rcu_scheduler_active = 1;
+}
+
+/*
  * Compute the per-level fanout, either using the exact fanout specified
  * or balancing the tree, depending on CONFIG_RCU_FANOUT_EXACT.
  */
@@ -1849,6 +1915,14 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                         INIT_LIST_HEAD(&rnp->blocked_tasks[3]);
                 }
         }
+
+        rnp = rsp->level[NUM_RCU_LVLS - 1];
+        for_each_possible_cpu(i) {
+                while (i > rnp->grphi)
+                        rnp++;
+                rsp->rda[i]->mynode = rnp;
+                rcu_boot_init_percpu_data(i, rsp);
+        }
 }
 
 /*
@@ -1859,19 +1933,11 @@ static void __init rcu_init_one(struct rcu_state *rsp)
 #define RCU_INIT_FLAVOR(rsp, rcu_data) \
 do { \
         int i; \
-        int j; \
-        struct rcu_node *rnp; \
         \
-        rcu_init_one(rsp); \
-        rnp = (rsp)->level[NUM_RCU_LVLS - 1]; \
-        j = 0; \
         for_each_possible_cpu(i) { \
-                if (i > rnp[j].grphi) \
-                        j++; \
-                per_cpu(rcu_data, i).mynode = &rnp[j]; \
                 (rsp)->rda[i] = &per_cpu(rcu_data, i); \
-                rcu_boot_init_percpu_data(i, rsp); \
         } \
+        rcu_init_one(rsp); \
 } while (0)
 
 void __init rcu_init(void)
@@ -1879,12 +1945,6 @@ void __init rcu_init(void)
         int cpu;
 
         rcu_bootup_announce();
-#ifdef CONFIG_RCU_CPU_STALL_DETECTOR
-        printk(KERN_INFO "RCU-based detection of stalled CPUs is enabled.\n");
-#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
-#if NUM_RCU_LVL_4 != 0
-        printk(KERN_INFO "Experimental four-level hierarchy is enabled.\n");
-#endif /* #if NUM_RCU_LVL_4 != 0 */
         RCU_INIT_FLAVOR(&rcu_sched_state, rcu_sched_data);
         RCU_INIT_FLAVOR(&rcu_bh_state, rcu_bh_data);
         __rcu_init_preempt();
@@ -1898,6 +1958,7 @@ void __init rcu_init(void)
         cpu_notifier(rcu_cpu_notify, 0);
         for_each_online_cpu(cpu)
                 rcu_cpu_notify(NULL, CPU_UP_PREPARE, (void *)(long)cpu);
+        check_cpu_stall_init();
 }
 
 #include "rcutree_plugin.h"
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 1439eb504c22..14c040b18ed0 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -223,6 +223,7 @@ struct rcu_data {
         /* 5) __rcu_pending() statistics. */
         unsigned long n_rcu_pending;    /* rcu_pending() calls since boot. */
         unsigned long n_rp_qs_pending;
+        unsigned long n_rp_report_qs;
         unsigned long n_rp_cb_ready;
         unsigned long n_rp_cpu_needs_gp;
         unsigned long n_rp_gp_completed;
@@ -246,12 +247,21 @@ struct rcu_data {
 
 #define RCU_JIFFIES_TILL_FORCE_QS        3      /* for rsp->jiffies_force_qs */
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
-#define RCU_SECONDS_TILL_STALL_CHECK   (10 * HZ)  /* for rsp->jiffies_stall */
-#define RCU_SECONDS_TILL_STALL_RECHECK (30 * HZ)  /* for rsp->jiffies_stall */
-#define RCU_STALL_RAT_DELAY             2         /* Allow other CPUs time */
-                                                  /*  to take at least one */
-                                                  /*  scheduling clock irq */
-                                                  /*  before ratting on them. */
+
+#ifdef CONFIG_PROVE_RCU
+#define RCU_STALL_DELAY_DELTA          (5 * HZ)
+#else
+#define RCU_STALL_DELAY_DELTA          0
+#endif
+
+#define RCU_SECONDS_TILL_STALL_CHECK   (10 * HZ + RCU_STALL_DELAY_DELTA)
+                                                /* for rsp->jiffies_stall */
+#define RCU_SECONDS_TILL_STALL_RECHECK (30 * HZ + RCU_STALL_DELAY_DELTA)
+                                                /* for rsp->jiffies_stall */
+#define RCU_STALL_RAT_DELAY             2       /* Allow other CPUs time */
+                                                /*  to take at least one */
+                                                /*  scheduling clock irq */
+                                                /*  before ratting on them. */
 
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
@@ -317,6 +327,7 @@ struct rcu_state {
         unsigned long jiffies_stall;            /* Time at which to check */
                                                 /*  for CPU stalls. */
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+        char *name;                             /* Name of structure. */
 };
 
 /* Return values for rcu_preempt_offline_tasks(). */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 464ad2cdee00..0e4f420245d9 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -26,6 +26,45 @@
 
 #include <linux/delay.h>
 
+/*
+ * Check the RCU kernel configuration parameters and print informative
+ * messages about anything out of the ordinary.  If you like #ifdef, you
+ * will love this function.
+ */
+static void __init rcu_bootup_announce_oddness(void)
+{
+#ifdef CONFIG_RCU_TRACE
+        printk(KERN_INFO "\tRCU debugfs-based tracing is enabled.\n");
+#endif
+#if (defined(CONFIG_64BIT) && CONFIG_RCU_FANOUT != 64) || (!defined(CONFIG_64BIT) && CONFIG_RCU_FANOUT != 32)
+        printk(KERN_INFO "\tCONFIG_RCU_FANOUT set to non-default value of %d\n",
+               CONFIG_RCU_FANOUT);
+#endif
+#ifdef CONFIG_RCU_FANOUT_EXACT
+        printk(KERN_INFO "\tHierarchical RCU autobalancing is disabled.\n");
+#endif
+#ifdef CONFIG_RCU_FAST_NO_HZ
+        printk(KERN_INFO
+               "\tRCU dyntick-idle grace-period acceleration is enabled.\n");
+#endif
+#ifdef CONFIG_PROVE_RCU
+        printk(KERN_INFO "\tRCU lockdep checking is enabled.\n");
+#endif
+#ifdef CONFIG_RCU_TORTURE_TEST_RUNNABLE
+        printk(KERN_INFO "\tRCU torture testing starts during boot.\n");
+#endif
+#ifndef CONFIG_RCU_CPU_STALL_DETECTOR
+        printk(KERN_INFO
+               "\tRCU-based detection of stalled CPUs is disabled.\n");
+#endif
+#ifndef CONFIG_RCU_CPU_STALL_VERBOSE
+        printk(KERN_INFO "\tVerbose stalled-CPUs detection is disabled.\n");
+#endif
+#if NUM_RCU_LVL_4 != 0
+        printk(KERN_INFO "\tExperimental four-level hierarchy is enabled.\n");
+#endif
+}
+
 #ifdef CONFIG_TREE_PREEMPT_RCU
 
 struct rcu_state rcu_preempt_state = RCU_STATE_INITIALIZER(rcu_preempt_state);
@@ -38,8 +77,8 @@ static int rcu_preempted_readers_exp(struct rcu_node *rnp);
  */
 static void __init rcu_bootup_announce(void)
 {
-        printk(KERN_INFO
-               "Experimental preemptable hierarchical RCU implementation.\n");
+        printk(KERN_INFO "Preemptable hierarchical RCU implementation.\n");
+        rcu_bootup_announce_oddness();
 }
 
 /*
@@ -75,13 +114,19 @@ EXPORT_SYMBOL_GPL(rcu_force_quiescent_state);
  * that this just means that the task currently running on the CPU is
  * not in a quiescent state.  There might be any number of tasks blocked
  * while in an RCU read-side critical section.
+ *
+ * Unlike the other rcu_*_qs() functions, callers to this function
+ * must disable irqs in order to protect the assignment to
+ * ->rcu_read_unlock_special.
  */
 static void rcu_preempt_qs(int cpu)
 {
         struct rcu_data *rdp = &per_cpu(rcu_preempt_data, cpu);
+
         rdp->passed_quiesc_completed = rdp->gpnum - 1;
         barrier();
         rdp->passed_quiesc = 1;
+        current->rcu_read_unlock_special &= ~RCU_READ_UNLOCK_NEED_QS;
 }
 
 /*
@@ -144,9 +189,8 @@ static void rcu_preempt_note_context_switch(int cpu)
          * grace period, then the fact that the task has been enqueued
          * means that we continue to block the current grace period.
          */
-        rcu_preempt_qs(cpu);
         local_irq_save(flags);
-        t->rcu_read_unlock_special &= ~RCU_READ_UNLOCK_NEED_QS;
+        rcu_preempt_qs(cpu);
         local_irq_restore(flags);
 }
 
@@ -236,7 +280,6 @@ static void rcu_read_unlock_special(struct task_struct *t)
          */
         special = t->rcu_read_unlock_special;
         if (special & RCU_READ_UNLOCK_NEED_QS) {
-                t->rcu_read_unlock_special &= ~RCU_READ_UNLOCK_NEED_QS;
                 rcu_preempt_qs(smp_processor_id());
         }
 
@@ -473,7 +516,6 @@ static void rcu_preempt_check_callbacks(int cpu)
         struct task_struct *t = current;
 
         if (t->rcu_read_lock_nesting == 0) {
-                t->rcu_read_unlock_special &= ~RCU_READ_UNLOCK_NEED_QS;
                 rcu_preempt_qs(cpu);
                 return;
         }
@@ -515,11 +557,13 @@ void synchronize_rcu(void)
         if (!rcu_scheduler_active)
                 return;
 
+        init_rcu_head_on_stack(&rcu.head);
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu(&rcu.head, wakeme_after_rcu);
         /* Wait for it. */
         wait_for_completion(&rcu.completion);
+        destroy_rcu_head_on_stack(&rcu.head);
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu);
 
@@ -754,6 +798,7 @@ void exit_rcu(void)
 static void __init rcu_bootup_announce(void)
 {
         printk(KERN_INFO "Hierarchical RCU implementation.\n");
+        rcu_bootup_announce_oddness();
 }
 
 /*
@@ -1008,15 +1053,27 @@ static DEFINE_PER_CPU(unsigned long, rcu_dyntick_holdoff);
 int rcu_needs_cpu(int cpu)
 {
         int c = 0;
+        int snap;
+        int snap_nmi;
         int thatcpu;
 
+        /* Check for being in the holdoff period. */
+        if (per_cpu(rcu_dyntick_holdoff, cpu) == jiffies)
+                return rcu_needs_cpu_quick_check(cpu);
+
         /* Don't bother unless we are the last non-dyntick-idle CPU. */
-        for_each_cpu_not(thatcpu, nohz_cpu_mask)
-                if (thatcpu != cpu) {
+        for_each_online_cpu(thatcpu) {
+                if (thatcpu == cpu)
+                        continue;
+                snap = per_cpu(rcu_dynticks, thatcpu).dynticks;
+                snap_nmi = per_cpu(rcu_dynticks, thatcpu).dynticks_nmi;
+                smp_mb(); /* Order sampling of snap with end of grace period. */
+                if (((snap & 0x1) != 0) || ((snap_nmi & 0x1) != 0)) {
                         per_cpu(rcu_dyntick_drain, cpu) = 0;
                         per_cpu(rcu_dyntick_holdoff, cpu) = jiffies - 1;
                         return rcu_needs_cpu_quick_check(cpu);
                 }
+        }
 
         /* Check and update the rcu_dyntick_drain sequencing. */
         if (per_cpu(rcu_dyntick_drain, cpu) <= 0) {
@@ -1041,10 +1098,8 @@ int rcu_needs_cpu(int cpu)
         }
 
         /* If RCU callbacks are still pending, RCU still needs this CPU. */
-        if (c) {
+        if (c)
                 raise_softirq(RCU_SOFTIRQ);
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies;
-        }
         return c;
 }
 
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index d45db2e35d27..36c95b45738e 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -241,11 +241,13 @@ static const struct file_operations rcugp_fops = {
 static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp)
 {
         seq_printf(m, "%3d%cnp=%ld "
-                   "qsp=%ld cbr=%ld cng=%ld gpc=%ld gps=%ld nf=%ld nn=%ld\n",
+                   "qsp=%ld rpq=%ld cbr=%ld cng=%ld "
+                   "gpc=%ld gps=%ld nf=%ld nn=%ld\n",
                    rdp->cpu,
                    cpu_is_offline(rdp->cpu) ? '!' : ' ',
                    rdp->n_rcu_pending,
                    rdp->n_rp_qs_pending,
+                   rdp->n_rp_report_qs,
                    rdp->n_rp_cb_ready,
                    rdp->n_rp_cpu_needs_gp,
                    rdp->n_rp_gp_completed,
diff --git a/kernel/relay.c b/kernel/relay.c
index c705a41b4ba3..3d97f2821611 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1215,14 +1215,14 @@ static void relay_page_release(struct splice_pipe_desc *spd, unsigned int i)
 /*
  *      subbuf_splice_actor - splice up to one subbuf's worth of data
  */
-static int subbuf_splice_actor(struct file *in,
+static ssize_t subbuf_splice_actor(struct file *in,
                                loff_t *ppos,
                                struct pipe_inode_info *pipe,
                                size_t len,
                                unsigned int flags,
                                int *nonpad_ret)
 {
-        unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
+        unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
         struct rchan_buf *rbuf = in->private_data;
         unsigned int subbuf_size = rbuf->chan->subbuf_size;
         uint64_t pos = (uint64_t) *ppos;
@@ -1241,6 +1241,7 @@ static int subbuf_splice_actor(struct file *in,
                 .ops = &relay_pipe_buf_ops,
                 .spd_release = relay_page_release,
         };
+        ssize_t ret;
 
         if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
                 return 0;
diff --git a/kernel/res_counter.c b/kernel/res_counter.c
index bcdabf37c40b..c7eaa37a768b 100644
--- a/kernel/res_counter.c
+++ b/kernel/res_counter.c
@@ -10,7 +10,6 @@
 #include <linux/types.h>
 #include <linux/parser.h>
 #include <linux/fs.h>
-#include <linux/slab.h>
 #include <linux/res_counter.h>
 #include <linux/uaccess.h>
 #include <linux/mm.h>
diff --git a/kernel/resource.c b/kernel/resource.c
index 4e9d87fd7bc5..9c358e263534 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -219,19 +219,34 @@ void release_child_resources(struct resource *r)
 }
 
 /**
- * request_resource - request and reserve an I/O or memory resource
+ * request_resource_conflict - request and reserve an I/O or memory resource
  * @root: root resource descriptor
  * @new: resource descriptor desired by caller
  *
- * Returns 0 for success, negative error code on error.
+ * Returns 0 for success, conflict resource on error.
  */
-int request_resource(struct resource *root, struct resource *new)
+struct resource *request_resource_conflict(struct resource *root, struct resource *new)
 {
         struct resource *conflict;
 
         write_lock(&resource_lock);
         conflict = __request_resource(root, new);
         write_unlock(&resource_lock);
+        return conflict;
+}
+
+/**
+ * request_resource - request and reserve an I/O or memory resource
+ * @root: root resource descriptor
+ * @new: resource descriptor desired by caller
+ *
+ * Returns 0 for success, negative error code on error.
+ */
+int request_resource(struct resource *root, struct resource *new)
+{
+        struct resource *conflict;
+
+        conflict = request_resource_conflict(root, new);
         return conflict ? -EBUSY : 0;
 }
 
@@ -304,7 +319,7 @@ int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
                 void *arg, int (*func)(unsigned long, unsigned long, void *))
 {
         struct resource res;
-        unsigned long pfn, len;
+        unsigned long pfn, end_pfn;
         u64 orig_end;
         int ret = -1;
 
@@ -314,9 +329,10 @@ int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
         orig_end = res.end;
         while ((res.start < res.end) &&
                 (find_next_system_ram(&res, "System RAM") >= 0)) {
-                pfn = (unsigned long)(res.start >> PAGE_SHIFT);
-                len = (unsigned long)((res.end + 1 - res.start) >> PAGE_SHIFT);
-                ret = (*func)(pfn, len, arg);
+                pfn = (res.start + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                end_pfn = (res.end + 1) >> PAGE_SHIFT;
+                if (end_pfn > pfn)
+                        ret = (*func)(pfn, end_pfn - pfn, arg);
                 if (ret)
                         break;
                 res.start = res.end + 1;
@@ -473,25 +489,40 @@ static struct resource * __insert_resource(struct resource *parent, struct resou
 }
 
 /**
- * insert_resource - Inserts a resource in the resource tree
+ * insert_resource_conflict - Inserts resource in the resource tree
  * @parent: parent of the new resource
  * @new: new resource to insert
  *
- * Returns 0 on success, -EBUSY if the resource can't be inserted.
+ * Returns 0 on success, conflict resource if the resource can't be inserted.
  *
- * This function is equivalent to request_resource when no conflict
+ * This function is equivalent to request_resource_conflict when no conflict
  * happens. If a conflict happens, and the conflicting resources
  * entirely fit within the range of the new resource, then the new
  * resource is inserted and the conflicting resources become children of
  * the new resource.
  */
-int insert_resource(struct resource *parent, struct resource *new)
+struct resource *insert_resource_conflict(struct resource *parent, struct resource *new)
 {
         struct resource *conflict;
 
         write_lock(&resource_lock);
         conflict = __insert_resource(parent, new);
         write_unlock(&resource_lock);
+        return conflict;
+}
+
+/**
+ * insert_resource - Inserts a resource in the resource tree
+ * @parent: parent of the new resource
+ * @new: new resource to insert
+ *
+ * Returns 0 on success, -EBUSY if the resource can't be inserted.
+ */
+int insert_resource(struct resource *parent, struct resource *new)
+{
+        struct resource *conflict;
+
+        conflict = insert_resource_conflict(parent, new);
         return conflict ? -EBUSY : 0;
 }
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 6a212c97f523..1d93cd0ae4d3 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -55,9 +55,9 @@
 #include <linux/cpu.h>
 #include <linux/cpuset.h>
 #include <linux/percpu.h>
-#include <linux/kthread.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/stop_machine.h>
 #include <linux/sysctl.h>
 #include <linux/syscalls.h>
 #include <linux/times.h>
@@ -71,6 +71,7 @@
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
 #include <linux/ftrace.h>
+#include <linux/slab.h>
 
 #include <asm/tlb.h>
 #include <asm/irq_regs.h>
@@ -322,6 +323,15 @@ static inline struct task_group *task_group(struct task_struct *p)
 /* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
 static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
 {
+        /*
+         * Strictly speaking this rcu_read_lock() is not needed since the
+         * task_group is tied to the cgroup, which in turn can never go away
+         * as long as there are tasks attached to it.
+         *
+         * However since task_group() uses task_subsys_state() which is an
+         * rcu_dereference() user, this quiets CONFIG_PROVE_RCU.
+         */
+        rcu_read_lock();
 #ifdef CONFIG_FAIR_GROUP_SCHED
         p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
         p->se.parent = task_group(p)->se[cpu];
@@ -331,6 +341,7 @@ static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
         p->rt.rt_rq  = task_group(p)->rt_rq[cpu];
         p->rt.parent = task_group(p)->rt_se[cpu];
 #endif
+        rcu_read_unlock();
 }
 
 #else
@@ -492,8 +503,11 @@ struct rq {
         #define CPU_LOAD_IDX_MAX 5
         unsigned long cpu_load[CPU_LOAD_IDX_MAX];
 #ifdef CONFIG_NO_HZ
+        u64 nohz_stamp;
         unsigned char in_nohz_recently;
 #endif
+        unsigned int skip_clock_update;
+
         /* capture load from *all* tasks on this cpu: */
         struct load_weight load;
         unsigned long nr_load_updates;
@@ -535,15 +549,13 @@ struct rq {
         int post_schedule;
         int active_balance;
         int push_cpu;
+        struct cpu_stop_work active_balance_work;
         /* cpu of this runqueue: */
         int cpu;
         int online;
 
         unsigned long avg_load_per_task;
 
-        struct task_struct *migration_thread;
-        struct list_head migration_queue;
-
         u64 rt_avg;
         u64 age_stamp;
         u64 idle_stamp;
@@ -591,6 +603,13 @@ static inline
 void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
 {
         rq->curr->sched_class->check_preempt_curr(rq, p, flags);
+
+        /*
+         * A queue event has occurred, and we're going to schedule.  In
+         * this case, we can save a useless back to back clock update.
+         */
+        if (test_tsk_need_resched(p))
+                rq->skip_clock_update = 1;
 }
 
 static inline int cpu_of(struct rq *rq)
@@ -625,7 +644,8 @@ static inline int cpu_of(struct rq *rq)
 
 inline void update_rq_clock(struct rq *rq)
 {
-        rq->clock = sched_clock_cpu(cpu_of(rq));
+        if (!rq->skip_clock_update)
+                rq->clock = sched_clock_cpu(cpu_of(rq));
 }
 
 /*
@@ -903,16 +923,12 @@ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev)
 #endif /* __ARCH_WANT_UNLOCKED_CTXSW */
 
 /*
- * Check whether the task is waking, we use this to synchronize against
- * ttwu() so that task_cpu() reports a stable number.
- *
- * We need to make an exception for PF_STARTING tasks because the fork
- * path might require task_rq_lock() to work, eg. it can call
- * set_cpus_allowed_ptr() from the cpuset clone_ns code.
+ * Check whether the task is waking, we use this to synchronize ->cpus_allowed
+ * against ttwu().
  */
 static inline int task_is_waking(struct task_struct *p)
 {
-        return unlikely((p->state == TASK_WAKING) && !(p->flags & PF_STARTING));
+        return unlikely(p->state == TASK_WAKING);
 }
 
 /*
@@ -925,11 +941,9 @@ static inline struct rq *__task_rq_lock(struct task_struct *p)
         struct rq *rq;
 
         for (;;) {
-                while (task_is_waking(p))
-                        cpu_relax();
                 rq = task_rq(p);
                 raw_spin_lock(&rq->lock);
-                if (likely(rq == task_rq(p) && !task_is_waking(p)))
+                if (likely(rq == task_rq(p)))
                         return rq;
                 raw_spin_unlock(&rq->lock);
         }
@@ -946,12 +960,10 @@ static struct rq *task_rq_lock(struct task_struct *p, unsigned long *flags)
         struct rq *rq;
 
         for (;;) {
-                while (task_is_waking(p))
-                        cpu_relax();
                 local_irq_save(*flags);
                 rq = task_rq(p);
                 raw_spin_lock(&rq->lock);
-                if (likely(rq == task_rq(p) && !task_is_waking(p)))
+                if (likely(rq == task_rq(p)))
                         return rq;
                 raw_spin_unlock_irqrestore(&rq->lock, *flags);
         }
@@ -1228,6 +1240,17 @@ void wake_up_idle_cpu(int cpu)
         if (!tsk_is_polling(rq->idle))
                 smp_send_reschedule(cpu);
 }
+
+int nohz_ratelimit(int cpu)
+{
+        struct rq *rq = cpu_rq(cpu);
+        u64 diff = rq->clock - rq->nohz_stamp;
+
+        rq->nohz_stamp = rq->clock;
+
+        return diff < (NSEC_PER_SEC / HZ) >> 1;
+}
+
 #endif /* CONFIG_NO_HZ */
 
 static u64 sched_avg_period(void)
@@ -1521,7 +1544,7 @@ static unsigned long cpu_avg_load_per_task(int cpu)
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
 
-static __read_mostly unsigned long *update_shares_data;
+static __read_mostly unsigned long __percpu *update_shares_data;
 
 static void __set_se_shares(struct sched_entity *se, unsigned long shares);
 
@@ -1770,8 +1793,6 @@ static void double_rq_lock(struct rq *rq1, struct rq *rq2)
                         raw_spin_lock_nested(&rq1->lock, SINGLE_DEPTH_NESTING);
                 }
         }
-        update_rq_clock(rq1);
-        update_rq_clock(rq2);
 }
 
 /*
@@ -1802,7 +1823,7 @@ static void cfs_rq_set_shares(struct cfs_rq *cfs_rq, unsigned long shares)
 }
 #endif
 
-static void calc_load_account_active(struct rq *this_rq);
+static void calc_load_account_idle(struct rq *this_rq);
 static void update_sysctl(void);
 static int get_update_sysctl_factor(void);
 
@@ -1859,62 +1880,43 @@ static void set_load_weight(struct task_struct *p)
         p->se.load.inv_weight = prio_to_wmult[p->static_prio - MAX_RT_PRIO];
 }
 
-static void update_avg(u64 *avg, u64 sample)
-{
-        s64 diff = sample - *avg;
-        *avg += diff >> 3;
-}
-
-static void
-enqueue_task(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+static void enqueue_task(struct rq *rq, struct task_struct *p, int flags)
 {
-        if (wakeup)
-                p->se.start_runtime = p->se.sum_exec_runtime;
-
+        update_rq_clock(rq);
         sched_info_queued(p);
-        p->sched_class->enqueue_task(rq, p, wakeup, head);
+        p->sched_class->enqueue_task(rq, p, flags);
         p->se.on_rq = 1;
 }
 
-static void dequeue_task(struct rq *rq, struct task_struct *p, int sleep)
+static void dequeue_task(struct rq *rq, struct task_struct *p, int flags)
 {
-        if (sleep) {
-                if (p->se.last_wakeup) {
-                        update_avg(&p->se.avg_overlap,
-                                p->se.sum_exec_runtime - p->se.last_wakeup);
-                        p->se.last_wakeup = 0;
-                } else {
-                        update_avg(&p->se.avg_wakeup,
-                                sysctl_sched_wakeup_granularity);
-                }
-        }
-
+        update_rq_clock(rq);
         sched_info_dequeued(p);
-        p->sched_class->dequeue_task(rq, p, sleep);
+        p->sched_class->dequeue_task(rq, p, flags);
         p->se.on_rq = 0;
 }
 
 /*
  * activate_task - move a task to the runqueue.
  */
-static void activate_task(struct rq *rq, struct task_struct *p, int wakeup)
+static void activate_task(struct rq *rq, struct task_struct *p, int flags)
 {
         if (task_contributes_to_load(p))
                 rq->nr_uninterruptible--;
 
-        enqueue_task(rq, p, wakeup, false);
+        enqueue_task(rq, p, flags);
         inc_nr_running(rq);
 }
 
 /*
  * deactivate_task - remove a task from the runqueue.
  */
-static void deactivate_task(struct rq *rq, struct task_struct *p, int sleep)
+static void deactivate_task(struct rq *rq, struct task_struct *p, int flags)
 {
         if (task_contributes_to_load(p))
                 rq->nr_uninterruptible++;
 
-        dequeue_task(rq, p, sleep);
+        dequeue_task(rq, p, flags);
         dec_nr_running(rq);
 }
 
@@ -2043,21 +2045,18 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu)
         __set_task_cpu(p, new_cpu);
 }
 
-struct migration_req {
-        struct list_head list;
-
+struct migration_arg {
         struct task_struct *task;
         int dest_cpu;
-
-        struct completion done;
 };
 
+static int migration_cpu_stop(void *data);
+
 /*
  * The task's runqueue lock must be held.
  * Returns true if you have to wait for migration thread.
  */
-static int
-migrate_task(struct task_struct *p, int dest_cpu, struct migration_req *req)
+static bool migrate_task(struct task_struct *p, int dest_cpu)
 {
         struct rq *rq = task_rq(p);
 
@@ -2065,58 +2064,7 @@ migrate_task(struct task_struct *p, int dest_cpu, struct migration_req *req)
          * If the task is not on a runqueue (and not running), then
          * the next wake-up will properly place the task.
          */
-        if (!p->se.on_rq && !task_running(rq, p))
-                return 0;
-
-        init_completion(&req->done);
-        req->task = p;
-        req->dest_cpu = dest_cpu;
-        list_add(&req->list, &rq->migration_queue);
-
-        return 1;
-}
-
-/*
- * wait_task_context_switch -   wait for a thread to complete at least one
- *                              context switch.
- *
- * @p must not be current.
- */
-void wait_task_context_switch(struct task_struct *p)
-{
-        unsigned long nvcsw, nivcsw, flags;
-        int running;
-        struct rq *rq;
-
-        nvcsw   = p->nvcsw;
-        nivcsw  = p->nivcsw;
-        for (;;) {
-                /*
-                 * The runqueue is assigned before the actual context
-                 * switch. We need to take the runqueue lock.
-                 *
-                 * We could check initially without the lock but it is
-                 * very likely that we need to take the lock in every
-                 * iteration.
-                 */
-                rq = task_rq_lock(p, &flags);
-                running = task_running(rq, p);
-                task_rq_unlock(rq, &flags);
-
-                if (likely(!running))
-                        break;
-                /*
-                 * The switch count is incremented before the actual
-                 * context switch. We thus wait for two switches to be
-                 * sure at least one completed.
-                 */
-                if ((p->nvcsw - nvcsw) > 1)
-                        break;
-                if ((p->nivcsw - nivcsw) > 1)
-                        break;
-
-                cpu_relax();
-        }
+        return p->se.on_rq || task_running(rq, p);
 }
 
 /*
@@ -2174,7 +2122,7 @@ unsigned long wait_task_inactive(struct task_struct *p, long match_state)
                  * just go back and repeat.
                  */
                 rq = task_rq_lock(p, &flags);
-                trace_sched_wait_task(rq, p);
+                trace_sched_wait_task(p);
                 running = task_running(rq, p);
                 on_rq = p->se.on_rq;
                 ncsw = 0;
@@ -2272,6 +2220,9 @@ void task_oncpu_function_call(struct task_struct *p,
 }
 
 #ifdef CONFIG_SMP
+/*
+ * ->cpus_allowed is protected by either TASK_WAKING or rq->lock held.
+ */
 static int select_fallback_rq(int cpu, struct task_struct *p)
 {
         int dest_cpu;
@@ -2288,12 +2239,8 @@ static int select_fallback_rq(int cpu, struct task_struct *p)
                 return dest_cpu;
 
         /* No more Mr. Nice Guy. */
-        if (dest_cpu >= nr_cpu_ids) {
-                rcu_read_lock();
-                cpuset_cpus_allowed_locked(p, &p->cpus_allowed);
-                rcu_read_unlock();
-                dest_cpu = cpumask_any_and(cpu_active_mask, &p->cpus_allowed);
-
+        if (unlikely(dest_cpu >= nr_cpu_ids)) {
+                dest_cpu = cpuset_cpus_allowed_fallback(p);
                 /*
                  * Don't tell them about moving exiting tasks or
                  * kernel threads (both mm NULL), since they never
@@ -2310,17 +2257,12 @@ static int select_fallback_rq(int cpu, struct task_struct *p)
 }
 
 /*
- * Gets called from 3 sites (exec, fork, wakeup), since it is called without
- * holding rq->lock we need to ensure ->cpus_allowed is stable, this is done
- * by:
- *
- *  exec:           is unstable, retry loop
- *  fork & wake-up: serialize ->cpus_allowed against TASK_WAKING
+ * The caller (fork, wakeup) owns TASK_WAKING, ->cpus_allowed is stable.
  */
 static inline
-int select_task_rq(struct task_struct *p, int sd_flags, int wake_flags)
+int select_task_rq(struct rq *rq, struct task_struct *p, int sd_flags, int wake_flags)
 {
-        int cpu = p->sched_class->select_task_rq(p, sd_flags, wake_flags);
+        int cpu = p->sched_class->select_task_rq(rq, p, sd_flags, wake_flags);
 
         /*
          * In order not to call set_task_cpu() on a blocking task we need
@@ -2338,6 +2280,12 @@ int select_task_rq(struct task_struct *p, int sd_flags, int wake_flags)
 
         return cpu;
 }
+
+static void update_avg(u64 *avg, u64 sample)
+{
+        s64 diff = sample - *avg;
+        *avg += diff >> 3;
+}
 #endif
 
 /***
@@ -2359,16 +2307,13 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
 {
         int cpu, orig_cpu, this_cpu, success = 0;
         unsigned long flags;
-        struct rq *rq, *orig_rq;
-
-        if (!sched_feat(SYNC_WAKEUPS))
-                wake_flags &= ~WF_SYNC;
+        unsigned long en_flags = ENQUEUE_WAKEUP;
+        struct rq *rq;
 
         this_cpu = get_cpu();
 
         smp_wmb();
-        rq = orig_rq = task_rq_lock(p, &flags);
-        update_rq_clock(rq);
+        rq = task_rq_lock(p, &flags);
         if (!(p->state & state))
                 goto out;
 
@@ -2388,28 +2333,26 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
          *
          * First fix up the nr_uninterruptible count:
          */
-        if (task_contributes_to_load(p))
-                rq->nr_uninterruptible--;
+        if (task_contributes_to_load(p)) {
+                if (likely(cpu_online(orig_cpu)))
+                        rq->nr_uninterruptible--;
+                else
+                        this_rq()->nr_uninterruptible--;
+        }
         p->state = TASK_WAKING;
 
-        if (p->sched_class->task_waking)
+        if (p->sched_class->task_waking) {
                 p->sched_class->task_waking(rq, p);
+                en_flags |= ENQUEUE_WAKING;
+        }
 
-        __task_rq_unlock(rq);
-
-        cpu = select_task_rq(p, SD_BALANCE_WAKE, wake_flags);
-        if (cpu != orig_cpu) {
-                /*
-                 * Since we migrate the task without holding any rq->lock,
-                 * we need to be careful with task_rq_lock(), since that
-                 * might end up locking an invalid rq.
-                 */
+        cpu = select_task_rq(rq, p, SD_BALANCE_WAKE, wake_flags);
+        if (cpu != orig_cpu)
                 set_task_cpu(p, cpu);
-        }
+        __task_rq_unlock(rq);
 
         rq = cpu_rq(cpu);
         raw_spin_lock(&rq->lock);
-        update_rq_clock(rq);
 
         /*
          * We migrated the task without holding either rq->lock, however
@@ -2437,36 +2380,20 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state,
 
 out_activate:
 #endif /* CONFIG_SMP */
-        schedstat_inc(p, se.nr_wakeups);
+        schedstat_inc(p, se.statistics.nr_wakeups);
         if (wake_flags & WF_SYNC)
-                schedstat_inc(p, se.nr_wakeups_sync);
+                schedstat_inc(p, se.statistics.nr_wakeups_sync);
         if (orig_cpu != cpu)
-                schedstat_inc(p, se.nr_wakeups_migrate);
+                schedstat_inc(p, se.statistics.nr_wakeups_migrate);
         if (cpu == this_cpu)
-                schedstat_inc(p, se.nr_wakeups_local);
+                schedstat_inc(p, se.statistics.nr_wakeups_local);
         else
-                schedstat_inc(p, se.nr_wakeups_remote);
-        activate_task(rq, p, 1);
+                schedstat_inc(p, se.statistics.nr_wakeups_remote);
+        activate_task(rq, p, en_flags);
         success = 1;
 
-        /*
-         * Only attribute actual wakeups done by this task.
-         */
-        if (!in_interrupt()) {
-                struct sched_entity *se = &current->se;
-                u64 sample = se->sum_exec_runtime;
-
-                if (se->last_wakeup)
-                        sample -= se->last_wakeup;
-                else
-                        sample -= se->start_runtime;
-                update_avg(&se->avg_wakeup, sample);
-
-                se->last_wakeup = se->sum_exec_runtime;
-        }
-
 out_running:
-        trace_sched_wakeup(rq, p, success);
+        trace_sched_wakeup(p, success);
         check_preempt_curr(rq, p, wake_flags);
 
         p->state = TASK_RUNNING;
@@ -2526,42 +2453,9 @@ static void __sched_fork(struct task_struct *p)
         p->se.sum_exec_runtime          = 0;
         p->se.prev_sum_exec_runtime     = 0;
         p->se.nr_migrations             = 0;
-        p->se.last_wakeup               = 0;
-        p->se.avg_overlap               = 0;
-        p->se.start_runtime             = 0;
-        p->se.avg_wakeup                = sysctl_sched_wakeup_granularity;
 
 #ifdef CONFIG_SCHEDSTATS
-        p->se.wait_start                        = 0;
-        p->se.wait_max                          = 0;
-        p->se.wait_count                        = 0;
-        p->se.wait_sum                          = 0;
-
-        p->se.sleep_start                       = 0;
-        p->se.sleep_max                         = 0;
-        p->se.sum_sleep_runtime                 = 0;
-
-        p->se.block_start                       = 0;
-        p->se.block_max                         = 0;
-        p->se.exec_max                          = 0;
-        p->se.slice_max                         = 0;
-
-        p->se.nr_migrations_cold                = 0;
-        p->se.nr_failed_migrations_affine       = 0;
-        p->se.nr_failed_migrations_running      = 0;
-        p->se.nr_failed_migrations_hot          = 0;
-        p->se.nr_forced_migrations              = 0;
-
-        p->se.nr_wakeups                        = 0;
-        p->se.nr_wakeups_sync                   = 0;
-        p->se.nr_wakeups_migrate                = 0;
-        p->se.nr_wakeups_local                  = 0;
-        p->se.nr_wakeups_remote                 = 0;
-        p->se.nr_wakeups_affine                 = 0;
-        p->se.nr_wakeups_affine_attempts        = 0;
-        p->se.nr_wakeups_passive                = 0;
-        p->se.nr_wakeups_idle                   = 0;
-
+        memset(&p->se.statistics, 0, sizeof(p->se.statistics));
 #endif
 
         INIT_LIST_HEAD(&p->rt.run_list);
@@ -2582,11 +2476,11 @@ void sched_fork(struct task_struct *p, int clone_flags)
 
         __sched_fork(p);
         /*
-         * We mark the process as waking here. This guarantees that
+         * We mark the process as running here. This guarantees that
          * nobody will actually run it, and a signal or other external
          * event cannot wake it up and insert it on the runqueue either.
          */
-        p->state = TASK_WAKING;
+        p->state = TASK_RUNNING;
 
         /*
          * Revert to default priority/policy on fork if requested.
@@ -2650,34 +2544,30 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags)
 {
         unsigned long flags;
         struct rq *rq;
-        int cpu = get_cpu();
+        int cpu __maybe_unused = get_cpu();
 
 #ifdef CONFIG_SMP
+        rq = task_rq_lock(p, &flags);
+        p->state = TASK_WAKING;
+
         /*
          * Fork balancing, do it here and not earlier because:
          *  - cpus_allowed can change in the fork path
          *  - any previously selected cpu might disappear through hotplug
          *
-         * We still have TASK_WAKING but PF_STARTING is gone now, meaning
-         * ->cpus_allowed is stable, we have preemption disabled, meaning
-         * cpu_online_mask is stable.
+         * We set TASK_WAKING so that select_task_rq() can drop rq->lock
+         * without people poking at ->cpus_allowed.
          */
-        cpu = select_task_rq(p, SD_BALANCE_FORK, 0);
+        cpu = select_task_rq(rq, p, SD_BALANCE_FORK, 0);
         set_task_cpu(p, cpu);
-#endif
-
-        /*
-         * Since the task is not on the rq and we still have TASK_WAKING set
-         * nobody else will migrate this task.
-         */
-        rq = cpu_rq(cpu);
-        raw_spin_lock_irqsave(&rq->lock, flags);
 
-        BUG_ON(p->state != TASK_WAKING);
         p->state = TASK_RUNNING;
-        update_rq_clock(rq);
+        task_rq_unlock(rq, &flags);
+#endif
+
+        rq = task_rq_lock(p, &flags);
         activate_task(rq, p, 0);
-        trace_sched_wakeup_new(rq, p, 1);
+        trace_sched_wakeup_new(p, 1);
         check_preempt_curr(rq, p, WF_FORK);
 #ifdef CONFIG_SMP
         if (p->sched_class->task_woken)
@@ -2897,7 +2787,7 @@ context_switch(struct rq *rq, struct task_struct *prev,
         struct mm_struct *mm, *oldmm;
 
         prepare_task_switch(rq, prev, next);
-        trace_sched_switch(rq, prev, next);
+        trace_sched_switch(prev, next);
         mm = next->mm;
         oldmm = prev->active_mm;
         /*
@@ -3014,6 +2904,61 @@ static unsigned long calc_load_update;
 unsigned long avenrun[3];
 EXPORT_SYMBOL(avenrun);
 
+static long calc_load_fold_active(struct rq *this_rq)
+{
+        long nr_active, delta = 0;
+
+        nr_active = this_rq->nr_running;
+        nr_active += (long) this_rq->nr_uninterruptible;
+
+        if (nr_active != this_rq->calc_load_active) {
+                delta = nr_active - this_rq->calc_load_active;
+                this_rq->calc_load_active = nr_active;
+        }
+
+        return delta;
+}
+
+#ifdef CONFIG_NO_HZ
+/*
+ * For NO_HZ we delay the active fold to the next LOAD_FREQ update.
+ *
+ * When making the ILB scale, we should try to pull this in as well.
+ */
+static atomic_long_t calc_load_tasks_idle;
+
+static void calc_load_account_idle(struct rq *this_rq)
+{
+        long delta;
+
+        delta = calc_load_fold_active(this_rq);
+        if (delta)
+                atomic_long_add(delta, &calc_load_tasks_idle);
+}
+
+static long calc_load_fold_idle(void)
+{
+        long delta = 0;
+
+        /*
+         * Its got a race, we don't care...
+         */
+        if (atomic_long_read(&calc_load_tasks_idle))
+                delta = atomic_long_xchg(&calc_load_tasks_idle, 0);
+
+        return delta;
+}
+#else
+static void calc_load_account_idle(struct rq *this_rq)
+{
+}
+
+static inline long calc_load_fold_idle(void)
+{
+        return 0;
+}
+#endif
+
 /**
  * get_avenrun - get the load average array
  * @loads:      pointer to dest load array
@@ -3060,20 +3005,22 @@ void calc_global_load(void)
 }
 
 /*
- * Either called from update_cpu_load() or from a cpu going idle
+ * Called from update_cpu_load() to periodically update this CPU's
+ * active count.
  */
 static void calc_load_account_active(struct rq *this_rq)
 {
-        long nr_active, delta;
+        long delta;
 
-        nr_active = this_rq->nr_running;
-        nr_active += (long) this_rq->nr_uninterruptible;
+        if (time_before(jiffies, this_rq->calc_load_update))
+                return;
 
-        if (nr_active != this_rq->calc_load_active) {
-                delta = nr_active - this_rq->calc_load_active;
-                this_rq->calc_load_active = nr_active;
+        delta  = calc_load_fold_active(this_rq);
+        delta += calc_load_fold_idle();
+        if (delta)
                 atomic_long_add(delta, &calc_load_tasks);
-        }
+
+        this_rq->calc_load_update += LOAD_FREQ;
 }
 
 /*
@@ -3105,10 +3052,7 @@ static void update_cpu_load(struct rq *this_rq)
                 this_rq->cpu_load[i] = (old_load*(scale-1) + new_load) >> i;
         }
 
-        if (time_after_eq(jiffies, this_rq->calc_load_update)) {
-                this_rq->calc_load_update += LOAD_FREQ;
-                calc_load_account_active(this_rq);
-        }
+        calc_load_account_active(this_rq);
 }
 
 #ifdef CONFIG_SMP
@@ -3120,44 +3064,27 @@ static void update_cpu_load(struct rq *this_rq)
 void sched_exec(void)
 {
         struct task_struct *p = current;
-        struct migration_req req;
-        int dest_cpu, this_cpu;
         unsigned long flags;
         struct rq *rq;
-
-again:
-        this_cpu = get_cpu();
-        dest_cpu = select_task_rq(p, SD_BALANCE_EXEC, 0);
-        if (dest_cpu == this_cpu) {
-                put_cpu();
-                return;
-        }
+        int dest_cpu;
 
         rq = task_rq_lock(p, &flags);
-        put_cpu();
+        dest_cpu = p->sched_class->select_task_rq(rq, p, SD_BALANCE_EXEC, 0);
+        if (dest_cpu == smp_processor_id())
+                goto unlock;
 
         /*
          * select_task_rq() can race against ->cpus_allowed
          */
-        if (!cpumask_test_cpu(dest_cpu, &p->cpus_allowed)
-            || unlikely(!cpu_active(dest_cpu))) {
-                task_rq_unlock(rq, &flags);
-                goto again;
-        }
+        if (cpumask_test_cpu(dest_cpu, &p->cpus_allowed) &&
+            likely(cpu_active(dest_cpu)) && migrate_task(p, dest_cpu)) {
+                struct migration_arg arg = { p, dest_cpu };
 
-        /* force the process onto the specified CPU */
-        if (migrate_task(p, dest_cpu, &req)) {
-                /* Need to wait for migration thread (might exit: take ref). */
-                struct task_struct *mt = rq->migration_thread;
-
-                get_task_struct(mt);
                 task_rq_unlock(rq, &flags);
-                wake_up_process(mt);
-                put_task_struct(mt);
-                wait_for_completion(&req.done);
-
+                stop_one_cpu(cpu_of(rq), migration_cpu_stop, &arg);
                 return;
         }
+unlock:
         task_rq_unlock(rq, &flags);
 }
 
@@ -3629,23 +3556,9 @@ static inline void schedule_debug(struct task_struct *prev)
 
 static void put_prev_task(struct rq *rq, struct task_struct *prev)
 {
-        if (prev->state == TASK_RUNNING) {
-                u64 runtime = prev->se.sum_exec_runtime;
-
-                runtime -= prev->se.prev_sum_exec_runtime;
-                runtime = min_t(u64, runtime, 2*sysctl_sched_migration_cost);
-
-                /*
-                 * In order to avoid avg_overlap growing stale when we are
-                 * indeed overlapping and hence not getting put to sleep, grow
-                 * the avg_overlap on preemption.
-                 *
-                 * We use the average preemption runtime because that
-                 * correlates to the amount of cache footprint a task can
-                 * build up.
-                 */
-                update_avg(&prev->se.avg_overlap, runtime);
-        }
+        if (prev->se.on_rq)
+                update_rq_clock(rq);
+        rq->skip_clock_update = 0;
         prev->sched_class->put_prev_task(rq, prev);
 }
 
@@ -3695,7 +3608,7 @@ need_resched:
         preempt_disable();
         cpu = smp_processor_id();
         rq = cpu_rq(cpu);
-        rcu_sched_qs(cpu);
+        rcu_note_context_switch(cpu);
         prev = rq->curr;
         switch_count = &prev->nivcsw;
 
@@ -3708,14 +3621,13 @@ need_resched_nonpreemptible:
                 hrtick_clear(rq);
 
         raw_spin_lock_irq(&rq->lock);
-        update_rq_clock(rq);
         clear_tsk_need_resched(prev);
 
         if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
                 if (unlikely(signal_pending_state(prev->state, prev)))
                         prev->state = TASK_RUNNING;
                 else
-                        deactivate_task(rq, prev, 1);
+                        deactivate_task(rq, prev, DEQUEUE_SLEEP);
                 switch_count = &prev->nvcsw;
         }
 
@@ -3779,7 +3691,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
          * the mutex owner just released it and exited.
          */
         if (probe_kernel_address(&owner->cpu, cpu))
-                goto out;
+                return 0;
 #else
         cpu = owner->cpu;
 #endif
@@ -3789,14 +3701,14 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
          * the cpu field may no longer be valid.
          */
         if (cpu >= nr_cpumask_bits)
-                goto out;
+                return 0;
 
         /*
          * We need to validate that we can do a
          * get_cpu() and that we have the percpu area.
          */
         if (!cpu_online(cpu))
-                goto out;
+                return 0;
 
         rq = cpu_rq(cpu);
 
@@ -3815,7 +3727,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
 
                 cpu_relax();
         }
-out:
+
         return 1;
 }
 #endif
@@ -4038,8 +3950,7 @@ do_wait_for_common(struct completion *x, long timeout, int state)
         if (!x->done) {
                 DECLARE_WAITQUEUE(wait, current);
 
-                wait.flags |= WQ_FLAG_EXCLUSIVE;
-                __add_wait_queue_tail(&x->wait, &wait);
+                __add_wait_queue_tail_exclusive(&x->wait, &wait);
                 do {
                         if (signal_pending_state(state, current)) {
                                 timeout = -ERESTARTSYS;
@@ -4265,7 +4176,6 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
         BUG_ON(prio < 0 || prio > MAX_PRIO);
 
         rq = task_rq_lock(p, &flags);
-        update_rq_clock(rq);
 
         oldprio = p->prio;
         prev_class = p->sched_class;
@@ -4286,7 +4196,7 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
         if (running)
                 p->sched_class->set_curr_task(rq);
         if (on_rq) {
-                enqueue_task(rq, p, 0, oldprio < prio);
+                enqueue_task(rq, p, oldprio < prio ? ENQUEUE_HEAD : 0);
 
                 check_class_changed(rq, p, prev_class, oldprio, running);
         }
@@ -4308,7 +4218,6 @@ void set_user_nice(struct task_struct *p, long nice)
          * the task might be in the middle of scheduling on another CPU.
          */
         rq = task_rq_lock(p, &flags);
-        update_rq_clock(rq);
         /*
          * The RT priorities are set via sched_setscheduler(), but we still
          * allow the 'normal' nice value to be set - but as expected
@@ -4330,7 +4239,7 @@ void set_user_nice(struct task_struct *p, long nice)
         delta = p->prio - old_prio;
 
         if (on_rq) {
-                enqueue_task(rq, p, 0, false);
+                enqueue_task(rq, p, 0);
                 /*
                  * If the task increased its priority or is running and
                  * lowered its priority, then reschedule its CPU:
@@ -4353,7 +4262,7 @@ int can_nice(const struct task_struct *p, const int nice)
         /* convert nice value [19,-20] to rlimit style value [1,40] */
         int nice_rlim = 20 - nice;
 
-        return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
+        return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
                 capable(CAP_SYS_NICE));
 }
 
@@ -4530,7 +4439,7 @@ recheck:
 
                         if (!lock_task_sighand(p, &flags))
                                 return -ESRCH;
-                        rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
+                        rlim_rtprio = task_rlimit(p, RLIMIT_RTPRIO);
                         unlock_task_sighand(p, &flags);
 
                         /* can't set/change the rt policy */
@@ -4591,7 +4500,6 @@ recheck:
                 raw_spin_unlock_irqrestore(&p->pi_lock, flags);
                 goto recheck;
         }
-        update_rq_clock(rq);
         on_rq = p->se.on_rq;
         running = task_current(rq, p);
         if (on_rq)
@@ -4902,7 +4810,9 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
         int ret;
         cpumask_var_t mask;
 
-        if (len < cpumask_size())
+        if ((len * BITS_PER_BYTE) < nr_cpu_ids)
+                return -EINVAL;
+        if (len & (sizeof(unsigned long)-1))
                 return -EINVAL;
 
         if (!alloc_cpumask_var(&mask, GFP_KERNEL))
@@ -4910,10 +4820,12 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
 
         ret = sched_getaffinity(pid, mask);
         if (ret == 0) {
-                if (copy_to_user(user_mask_ptr, mask, cpumask_size()))
+                size_t retlen = min_t(size_t, len, cpumask_size());
+
+                if (copy_to_user(user_mask_ptr, mask, retlen))
                         ret = -EFAULT;
                 else
-                        ret = cpumask_size();
+                        ret = retlen;
         }
         free_cpumask_var(mask);
 
@@ -5324,17 +5236,15 @@ static inline void sched_init_granularity(void)
 /*
  * This is how migration works:
  *
- * 1) we queue a struct migration_req structure in the source CPU's
- *    runqueue and wake up that CPU's migration thread.
- * 2) we down() the locked semaphore => thread blocks.
- * 3) migration thread wakes up (implicitly it forces the migrated
- *    thread off the CPU)
- * 4) it gets the migration request and checks whether the migrated
- *    task is still in the wrong runqueue.
- * 5) if it's in the wrong runqueue then the migration thread removes
+ * 1) we invoke migration_cpu_stop() on the target CPU using
+ *    stop_one_cpu().
+ * 2) stopper starts to run (implicitly forcing the migrated thread
+ *    off the CPU)
+ * 3) it checks whether the migrated task is still in the wrong runqueue.
+ * 4) if it's in the wrong runqueue then the migration thread removes
  *    it and puts it into the right queue.
- * 6) migration thread up()s the semaphore.
- * 7) we wake up and the migration is done.
+ * 5) stopper completes and stop_one_cpu() returns and the migration
+ *    is done.
  */
 
 /*
@@ -5348,12 +5258,23 @@ static inline void sched_init_granularity(void)
  */
 int set_cpus_allowed_ptr(struct task_struct *p, const struct cpumask *new_mask)
 {
-        struct migration_req req;
         unsigned long flags;
         struct rq *rq;
+        unsigned int dest_cpu;
         int ret = 0;
 
+        /*
+         * Serialize against TASK_WAKING so that ttwu() and wunt() can
+         * drop the rq->lock and still rely on ->cpus_allowed.
+         */
+again:
+        while (task_is_waking(p))
+                cpu_relax();
         rq = task_rq_lock(p, &flags);
+        if (task_is_waking(p)) {
+                task_rq_unlock(rq, &flags);
+                goto again;
+        }
 
         if (!cpumask_intersects(new_mask, cpu_active_mask)) {
                 ret = -EINVAL;
@@ -5377,15 +5298,12 @@ int set_cpus_allowed_ptr(struct task_struct *p, const struct cpumask *new_mask)
         if (cpumask_test_cpu(task_cpu(p), new_mask))
                 goto out;
 
-        if (migrate_task(p, cpumask_any_and(cpu_active_mask, new_mask), &req)) {
+        dest_cpu = cpumask_any_and(cpu_active_mask, new_mask);
+        if (migrate_task(p, dest_cpu)) {
+                struct migration_arg arg = { p, dest_cpu };
                 /* Need help from migration thread: drop lock and wait. */
-                struct task_struct *mt = rq->migration_thread;
-
-                get_task_struct(mt);
                 task_rq_unlock(rq, &flags);
-                wake_up_process(rq->migration_thread);
-                put_task_struct(mt);
-                wait_for_completion(&req.done);
+                stop_one_cpu(cpu_of(rq), migration_cpu_stop, &arg);
                 tlb_migrate_finish(p->mm);
                 return 0;
         }
@@ -5443,98 +5361,49 @@ fail:
         return ret;
 }
 
-#define RCU_MIGRATION_IDLE      0
-#define RCU_MIGRATION_NEED_QS   1
-#define RCU_MIGRATION_GOT_QS    2
-#define RCU_MIGRATION_MUST_SYNC 3
-
 /*
- * migration_thread - this is a highprio system thread that performs
- * thread migration by bumping thread off CPU then 'pushing' onto
- * another runqueue.
+ * migration_cpu_stop - this will be executed by a highprio stopper thread
+ * and performs thread migration by bumping thread off CPU then
+ * 'pushing' onto another runqueue.
  */
-static int migration_thread(void *data)
+static int migration_cpu_stop(void *data)
 {
-        int badcpu;
-        int cpu = (long)data;
-        struct rq *rq;
-
-        rq = cpu_rq(cpu);
-        BUG_ON(rq->migration_thread != current);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-        while (!kthread_should_stop()) {
-                struct migration_req *req;
-                struct list_head *head;
-
-                raw_spin_lock_irq(&rq->lock);
-
-                if (cpu_is_offline(cpu)) {
-                        raw_spin_unlock_irq(&rq->lock);
-                        break;
-                }
-
-                if (rq->active_balance) {
-                        active_load_balance(rq, cpu);
-                        rq->active_balance = 0;
-                }
-
-                head = &rq->migration_queue;
-
-                if (list_empty(head)) {
-                        raw_spin_unlock_irq(&rq->lock);
-                        schedule();
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        continue;
-                }
-                req = list_entry(head->next, struct migration_req, list);
-                list_del_init(head->next);
-
-                if (req->task != NULL) {
-                        raw_spin_unlock(&rq->lock);
-                        __migrate_task(req->task, cpu, req->dest_cpu);
-                } else if (likely(cpu == (badcpu = smp_processor_id()))) {
-                        req->dest_cpu = RCU_MIGRATION_GOT_QS;
-                        raw_spin_unlock(&rq->lock);
-                } else {
-                        req->dest_cpu = RCU_MIGRATION_MUST_SYNC;
-                        raw_spin_unlock(&rq->lock);
-                        WARN_ONCE(1, "migration_thread() on CPU %d, expected %d\n", badcpu, cpu);
-                }
-                local_irq_enable();
-
-                complete(&req->done);
-        }
-        __set_current_state(TASK_RUNNING);
-
-        return 0;
-}
-
-#ifdef CONFIG_HOTPLUG_CPU
-
-static int __migrate_task_irq(struct task_struct *p, int src_cpu, int dest_cpu)
-{
-        int ret;
+        struct migration_arg *arg = data;
 
+        /*
+         * The original target cpu might have gone down and we might
+         * be on another cpu but it doesn't matter.
+         */
         local_irq_disable();
-        ret = __migrate_task(p, src_cpu, dest_cpu);
+        __migrate_task(arg->task, raw_smp_processor_id(), arg->dest_cpu);
         local_irq_enable();
-        return ret;
+        return 0;
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 /*
  * Figure out where task on dead CPU should go, use force if necessary.
  */
-static void move_task_off_dead_cpu(int dead_cpu, struct task_struct *p)
+void move_task_off_dead_cpu(int dead_cpu, struct task_struct *p)
 {
-        int dest_cpu;
+        struct rq *rq = cpu_rq(dead_cpu);
+        int needs_cpu, uninitialized_var(dest_cpu);
+        unsigned long flags;
 
-again:
-        dest_cpu = select_fallback_rq(dead_cpu, p);
+        local_irq_save(flags);
 
-        /* It can have affinity changed while we were choosing. */
-        if (unlikely(!__migrate_task_irq(p, dead_cpu, dest_cpu)))
-                goto again;
+        raw_spin_lock(&rq->lock);
+        needs_cpu = (task_cpu(p) == dead_cpu) && (p->state != TASK_WAKING);
+        if (needs_cpu)
+                dest_cpu = select_fallback_rq(dead_cpu, p);
+        raw_spin_unlock(&rq->lock);
+        /*
+         * It can only fail if we race with set_cpus_allowed(),
+         * in the racer should migrate the task anyway.
+         */
+        if (needs_cpu)
+                __migrate_task(p, dead_cpu, dest_cpu);
+        local_irq_restore(flags);
 }
 
 /*
@@ -5598,7 +5467,6 @@ void sched_idle_next(void)
 
         __setscheduler(rq, p, SCHED_FIFO, MAX_RT_PRIO-1);
 
-        update_rq_clock(rq);
         activate_task(rq, p, 0);
 
         raw_spin_unlock_irqrestore(&rq->lock, flags);
@@ -5653,7 +5521,6 @@ static void migrate_dead_tasks(unsigned int dead_cpu)
         for ( ; ; ) {
                 if (!rq->nr_running)
                         break;
-                update_rq_clock(rq);
                 next = pick_next_task(rq);
                 if (!next)
                         break;
@@ -5876,35 +5743,20 @@ static void set_rq_offline(struct rq *rq)
 static int __cpuinit
 migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
-        struct task_struct *p;
         int cpu = (long)hcpu;
         unsigned long flags;
-        struct rq *rq;
+        struct rq *rq = cpu_rq(cpu);
 
         switch (action) {
 
         case CPU_UP_PREPARE:
         case CPU_UP_PREPARE_FROZEN:
-                p = kthread_create(migration_thread, hcpu, "migration/%d", cpu);
-                if (IS_ERR(p))
-                        return NOTIFY_BAD;
-                kthread_bind(p, cpu);
-                /* Must be high prio: stop_machine expects to yield to it. */
-                rq = task_rq_lock(p, &flags);
-                __setscheduler(rq, p, SCHED_FIFO, MAX_RT_PRIO-1);
-                task_rq_unlock(rq, &flags);
-                get_task_struct(p);
-                cpu_rq(cpu)->migration_thread = p;
                 rq->calc_load_update = calc_load_update;
                 break;
 
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
-                /* Strictly unnecessary, as first user will wake it. */
-                wake_up_process(cpu_rq(cpu)->migration_thread);
-
                 /* Update our root-domain */
-                rq = cpu_rq(cpu);
                 raw_spin_lock_irqsave(&rq->lock, flags);
                 if (rq->rd) {
                         BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
@@ -5915,61 +5767,24 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 break;
 
 #ifdef CONFIG_HOTPLUG_CPU
-        case CPU_UP_CANCELED:
-        case CPU_UP_CANCELED_FROZEN:
-                if (!cpu_rq(cpu)->migration_thread)
-                        break;
-                /* Unbind it from offline cpu so it can run. Fall thru. */
-                kthread_bind(cpu_rq(cpu)->migration_thread,
-                             cpumask_any(cpu_online_mask));
-                kthread_stop(cpu_rq(cpu)->migration_thread);
-                put_task_struct(cpu_rq(cpu)->migration_thread);
-                cpu_rq(cpu)->migration_thread = NULL;
-                break;
-
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
-                cpuset_lock(); /* around calls to cpuset_cpus_allowed_lock() */
                 migrate_live_tasks(cpu);
-                rq = cpu_rq(cpu);
-                kthread_stop(rq->migration_thread);
-                put_task_struct(rq->migration_thread);
-                rq->migration_thread = NULL;
                 /* Idle task back to normal (off runqueue, low prio) */
                 raw_spin_lock_irq(&rq->lock);
-                update_rq_clock(rq);
                 deactivate_task(rq, rq->idle, 0);
                 __setscheduler(rq, rq->idle, SCHED_NORMAL, 0);
                 rq->idle->sched_class = &idle_sched_class;
                 migrate_dead_tasks(cpu);
                 raw_spin_unlock_irq(&rq->lock);
-                cpuset_unlock();
                 migrate_nr_uninterruptible(rq);
                 BUG_ON(rq->nr_running != 0);
                 calc_global_load_remove(rq);
-                /*
-                 * No need to migrate the tasks: it was best-effort if
-                 * they didn't take sched_hotcpu_mutex. Just wake up
-                 * the requestors.
-                 */
-                raw_spin_lock_irq(&rq->lock);
-                while (!list_empty(&rq->migration_queue)) {
-                        struct migration_req *req;
-
-                        req = list_entry(rq->migration_queue.next,
-                                         struct migration_req, list);
-                        list_del_init(&req->list);
-                        raw_spin_unlock_irq(&rq->lock);
-                        complete(&req->done);
-                        raw_spin_lock_irq(&rq->lock);
-                }
-                raw_spin_unlock_irq(&rq->lock);
                 break;
 
         case CPU_DYING:
         case CPU_DYING_FROZEN:
                 /* Update our root-domain */
-                rq = cpu_rq(cpu);
                 raw_spin_lock_irqsave(&rq->lock, flags);
                 if (rq->rd) {
                         BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
@@ -6300,6 +6115,9 @@ cpu_attach_domain(struct sched_domain *sd, struct root_domain *rd, int cpu)
         struct rq *rq = cpu_rq(cpu);
         struct sched_domain *tmp;
 
+        for (tmp = sd; tmp; tmp = tmp->parent)
+                tmp->span_weight = cpumask_weight(sched_domain_span(tmp));
+
         /* Remove the sched domains which do not contribute to scheduling. */
         for (tmp = sd; tmp; ) {
                 struct sched_domain *parent = tmp->parent;
@@ -7406,11 +7224,13 @@ static ssize_t sched_power_savings_store(const char *buf, size_t count, int smt)
 
 #ifdef CONFIG_SCHED_MC
 static ssize_t sched_mc_power_savings_show(struct sysdev_class *class,
+                                           struct sysdev_class_attribute *attr,
                                            char *page)
 {
         return sprintf(page, "%u\n", sched_mc_power_savings);
 }
 static ssize_t sched_mc_power_savings_store(struct sysdev_class *class,
+                                            struct sysdev_class_attribute *attr,
                                             const char *buf, size_t count)
 {
         return sched_power_savings_store(buf, count, 0);
@@ -7422,11 +7242,13 @@ static SYSDEV_CLASS_ATTR(sched_mc_power_savings, 0644,
 
 #ifdef CONFIG_SCHED_SMT
 static ssize_t sched_smt_power_savings_show(struct sysdev_class *dev,
+                                            struct sysdev_class_attribute *attr,
                                             char *page)
 {
         return sprintf(page, "%u\n", sched_smt_power_savings);
 }
 static ssize_t sched_smt_power_savings_store(struct sysdev_class *dev,
+                                             struct sysdev_class_attribute *attr,
                                              const char *buf, size_t count)
 {
         return sched_power_savings_store(buf, count, 1);
@@ -7779,10 +7601,8 @@ void __init sched_init(void)
                 rq->push_cpu = 0;
                 rq->cpu = i;
                 rq->online = 0;
-                rq->migration_thread = NULL;
                 rq->idle_stamp = 0;
                 rq->avg_idle = 2*sysctl_sched_migration_cost;
-                INIT_LIST_HEAD(&rq->migration_queue);
                 rq_attach_root(rq, &def_root_domain);
 #endif
                 init_rq_hrtick(rq);
@@ -7883,7 +7703,6 @@ static void normalize_task(struct rq *rq, struct task_struct *p)
 {
         int on_rq;
 
-        update_rq_clock(rq);
         on_rq = p->se.on_rq;
         if (on_rq)
                 deactivate_task(rq, p, 0);
@@ -7910,9 +7729,9 @@ void normalize_rt_tasks(void)
 
                 p->se.exec_start                = 0;
 #ifdef CONFIG_SCHEDSTATS
-                p->se.wait_start                = 0;
-                p->se.sleep_start               = 0;
-                p->se.block_start               = 0;
+                p->se.statistics.wait_start     = 0;
+                p->se.statistics.sleep_start    = 0;
+                p->se.statistics.block_start    = 0;
 #endif
 
                 if (!rt_task(p)) {
@@ -8245,8 +8064,6 @@ void sched_move_task(struct task_struct *tsk)
 
         rq = task_rq_lock(tsk, &flags);
 
-        update_rq_clock(rq);
-
         running = task_current(rq, tsk);
         on_rq = tsk->se.on_rq;
 
@@ -8265,7 +8082,7 @@ void sched_move_task(struct task_struct *tsk)
         if (unlikely(running))
                 tsk->sched_class->set_curr_task(rq);
         if (on_rq)
-                enqueue_task(rq, tsk, 0, false);
+                enqueue_task(rq, tsk, 0);
 
         task_rq_unlock(rq, &flags);
 }
@@ -8813,7 +8630,7 @@ struct cgroup_subsys cpu_cgroup_subsys = {
 struct cpuacct {
         struct cgroup_subsys_state css;
         /* cpuusage holds pointer to a u64-type object on every cpu */
-        u64 *cpuusage;
+        u64 __percpu *cpuusage;
         struct percpu_counter cpustat[CPUACCT_STAT_NSTATS];
         struct cpuacct *parent;
 };
@@ -9079,43 +8896,32 @@ struct cgroup_subsys cpuacct_subsys = {
 
 #ifndef CONFIG_SMP
 
-int rcu_expedited_torture_stats(char *page)
-{
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rcu_expedited_torture_stats);
-
 void synchronize_sched_expedited(void)
 {
+        barrier();
 }
 EXPORT_SYMBOL_GPL(synchronize_sched_expedited);
 
 #else /* #ifndef CONFIG_SMP */
 
-static DEFINE_PER_CPU(struct migration_req, rcu_migration_req);
-static DEFINE_MUTEX(rcu_sched_expedited_mutex);
-
-#define RCU_EXPEDITED_STATE_POST -2
-#define RCU_EXPEDITED_STATE_IDLE -1
+static atomic_t synchronize_sched_expedited_count = ATOMIC_INIT(0);
 
-static int rcu_expedited_state = RCU_EXPEDITED_STATE_IDLE;
-
-int rcu_expedited_torture_stats(char *page)
+static int synchronize_sched_expedited_cpu_stop(void *data)
 {
-        int cnt = 0;
-        int cpu;
-
-        cnt += sprintf(&page[cnt], "state: %d /", rcu_expedited_state);
-        for_each_online_cpu(cpu) {
-                 cnt += sprintf(&page[cnt], " %d:%d",
-                                cpu, per_cpu(rcu_migration_req, cpu).dest_cpu);
-        }
-        cnt += sprintf(&page[cnt], "\n");
-        return cnt;
+        /*
+         * There must be a full memory barrier on each affected CPU
+         * between the time that try_stop_cpus() is called and the
+         * time that it returns.
+         *
+         * In the current initial implementation of cpu_stop, the
+         * above condition is already met when the control reaches
+         * this point and the following smp_mb() is not strictly
+         * necessary.  Do smp_mb() anyway for documentation and
+         * robustness against future implementation changes.
+         */
+        smp_mb(); /* See above comment block. */
+        return 0;
 }
-EXPORT_SYMBOL_GPL(rcu_expedited_torture_stats);
-
-static long synchronize_sched_expedited_count;
 
 /*
  * Wait for an rcu-sched grace period to elapse, but use "big hammer"
@@ -9129,18 +8935,14 @@ static long synchronize_sched_expedited_count;
  */
 void synchronize_sched_expedited(void)
 {
-        int cpu;
-        unsigned long flags;
-        bool need_full_sync = 0;
-        struct rq *rq;
-        struct migration_req *req;
-        long snap;
-        int trycount = 0;
+        int snap, trycount = 0;
 
         smp_mb();  /* ensure prior mod happens before capturing snap. */
-        snap = ACCESS_ONCE(synchronize_sched_expedited_count) + 1;
+        snap = atomic_read(&synchronize_sched_expedited_count) + 1;
         get_online_cpus();
-        while (!mutex_trylock(&rcu_sched_expedited_mutex)) {
+        while (try_stop_cpus(cpu_online_mask,
+                             synchronize_sched_expedited_cpu_stop,
+                             NULL) == -EAGAIN) {
                 put_online_cpus();
                 if (trycount++ < 10)
                         udelay(trycount * num_online_cpus());
@@ -9148,41 +8950,15 @@ void synchronize_sched_expedited(void)
                         synchronize_sched();
                         return;
                 }
-                if (ACCESS_ONCE(synchronize_sched_expedited_count) - snap > 0) {
+                if (atomic_read(&synchronize_sched_expedited_count) - snap > 0) {
                         smp_mb(); /* ensure test happens before caller kfree */
                         return;
                 }
                 get_online_cpus();
         }
-        rcu_expedited_state = RCU_EXPEDITED_STATE_POST;
-        for_each_online_cpu(cpu) {
-                rq = cpu_rq(cpu);
-                req = &per_cpu(rcu_migration_req, cpu);
-                init_completion(&req->done);
-                req->task = NULL;
-                req->dest_cpu = RCU_MIGRATION_NEED_QS;
-                raw_spin_lock_irqsave(&rq->lock, flags);
-                list_add(&req->list, &rq->migration_queue);
-                raw_spin_unlock_irqrestore(&rq->lock, flags);
-                wake_up_process(rq->migration_thread);
-        }
-        for_each_online_cpu(cpu) {
-                rcu_expedited_state = cpu;
-                req = &per_cpu(rcu_migration_req, cpu);
-                rq = cpu_rq(cpu);
-                wait_for_completion(&req->done);
-                raw_spin_lock_irqsave(&rq->lock, flags);
-                if (unlikely(req->dest_cpu == RCU_MIGRATION_MUST_SYNC))
-                        need_full_sync = 1;
-                req->dest_cpu = RCU_MIGRATION_IDLE;
-                raw_spin_unlock_irqrestore(&rq->lock, flags);
-        }
-        rcu_expedited_state = RCU_EXPEDITED_STATE_IDLE;
-        synchronize_sched_expedited_count++;
-        mutex_unlock(&rcu_sched_expedited_mutex);
+        atomic_inc(&synchronize_sched_expedited_count);
+        smp_mb__after_atomic_inc(); /* ensure post-GP actions seen after GP. */
         put_online_cpus();
-        if (need_full_sync)
-                synchronize_sched();
 }
 EXPORT_SYMBOL_GPL(synchronize_sched_expedited);
 
diff --git a/kernel/sched_cpupri.c b/kernel/sched_cpupri.c
index eeb3506c4834..e6871cb3fc83 100644
--- a/kernel/sched_cpupri.c
+++ b/kernel/sched_cpupri.c
@@ -27,6 +27,7 @@
  *  of the License.
  */
 
+#include <linux/gfp.h>
 #include "sched_cpupri.h"
 
 /* Convert between a 140 based task->prio, and our 102 based cpupri */
@@ -47,7 +48,7 @@ static int convert_prio(int prio)
 }
 
 #define for_each_cpupri_active(array, idx)                    \
-        for_each_bit(idx, array, CPUPRI_NR_PRIORITIES)
+        for_each_set_bit(idx, array, CPUPRI_NR_PRIORITIES)
 
 /**
  * cpupri_find - find the best (lowest-pri) CPU in the system
@@ -56,7 +57,7 @@ static int convert_prio(int prio)
  * @lowest_mask: A mask to fill in with selected CPUs (or NULL)
  *
  * Note: This function returns the recommended CPUs as calculated during the
- * current invokation.  By the time the call returns, the CPUs may have in
+ * current invocation.  By the time the call returns, the CPUs may have in
  * fact changed priorities any number of times.  While not ideal, it is not
  * an issue of correctness since the normal rebalancer logic will correct
  * any discrepancies created by racing against the uncertainty of the current
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 67f95aada4b9..87a330a7185f 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -70,16 +70,16 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu,
         PN(se->vruntime);
         PN(se->sum_exec_runtime);
 #ifdef CONFIG_SCHEDSTATS
-        PN(se->wait_start);
-        PN(se->sleep_start);
-        PN(se->block_start);
-        PN(se->sleep_max);
-        PN(se->block_max);
-        PN(se->exec_max);
-        PN(se->slice_max);
-        PN(se->wait_max);
-        PN(se->wait_sum);
-        P(se->wait_count);
+        PN(se->statistics.wait_start);
+        PN(se->statistics.sleep_start);
+        PN(se->statistics.block_start);
+        PN(se->statistics.sleep_max);
+        PN(se->statistics.block_max);
+        PN(se->statistics.exec_max);
+        PN(se->statistics.slice_max);
+        PN(se->statistics.wait_max);
+        PN(se->statistics.wait_sum);
+        P(se->statistics.wait_count);
 #endif
         P(se->load.weight);
 #undef PN
@@ -104,7 +104,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
         SEQ_printf(m, "%9Ld.%06ld %9Ld.%06ld %9Ld.%06ld",
                 SPLIT_NS(p->se.vruntime),
                 SPLIT_NS(p->se.sum_exec_runtime),
-                SPLIT_NS(p->se.sum_sleep_runtime));
+                SPLIT_NS(p->se.statistics.sum_sleep_runtime));
 #else
         SEQ_printf(m, "%15Ld %15Ld %15Ld.%06ld %15Ld.%06ld %15Ld.%06ld",
                 0LL, 0LL, 0LL, 0L, 0LL, 0L, 0LL, 0L);
@@ -114,7 +114,9 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
         {
                 char path[64];
 
+                rcu_read_lock();
                 cgroup_path(task_group(p)->css.cgroup, path, sizeof(path));
+                rcu_read_unlock();
                 SEQ_printf(m, " %s", path);
         }
 #endif
@@ -173,11 +175,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
         task_group_path(tg, path, sizeof(path));
 
         SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, path);
-#elif defined(CONFIG_USER_SCHED) && defined(CONFIG_FAIR_GROUP_SCHED)
-        {
-                uid_t uid = cfs_rq->tg->uid;
-                SEQ_printf(m, "\ncfs_rq[%d] for UID: %u\n", cpu, uid);
-        }
 #else
         SEQ_printf(m, "\ncfs_rq[%d]:\n", cpu);
 #endif
@@ -407,40 +404,38 @@ void proc_sched_show_task(struct task_struct *p, struct seq_file *m)
         PN(se.exec_start);
         PN(se.vruntime);
         PN(se.sum_exec_runtime);
-        PN(se.avg_overlap);
-        PN(se.avg_wakeup);
 
         nr_switches = p->nvcsw + p->nivcsw;
 
 #ifdef CONFIG_SCHEDSTATS
-        PN(se.wait_start);
-        PN(se.sleep_start);
-        PN(se.block_start);
-        PN(se.sleep_max);
-        PN(se.block_max);
-        PN(se.exec_max);
-        PN(se.slice_max);
-        PN(se.wait_max);
-        PN(se.wait_sum);
-        P(se.wait_count);
-        PN(se.iowait_sum);
-        P(se.iowait_count);
+        PN(se.statistics.wait_start);
+        PN(se.statistics.sleep_start);
+        PN(se.statistics.block_start);
+        PN(se.statistics.sleep_max);
+        PN(se.statistics.block_max);
+        PN(se.statistics.exec_max);
+        PN(se.statistics.slice_max);
+        PN(se.statistics.wait_max);
+        PN(se.statistics.wait_sum);
+        P(se.statistics.wait_count);
+        PN(se.statistics.iowait_sum);
+        P(se.statistics.iowait_count);
         P(sched_info.bkl_count);
         P(se.nr_migrations);
-        P(se.nr_migrations_cold);
-        P(se.nr_failed_migrations_affine);
-        P(se.nr_failed_migrations_running);
-        P(se.nr_failed_migrations_hot);
-        P(se.nr_forced_migrations);
-        P(se.nr_wakeups);
-        P(se.nr_wakeups_sync);
-        P(se.nr_wakeups_migrate);
-        P(se.nr_wakeups_local);
-        P(se.nr_wakeups_remote);
-        P(se.nr_wakeups_affine);
-        P(se.nr_wakeups_affine_attempts);
-        P(se.nr_wakeups_passive);
-        P(se.nr_wakeups_idle);
+        P(se.statistics.nr_migrations_cold);
+        P(se.statistics.nr_failed_migrations_affine);
+        P(se.statistics.nr_failed_migrations_running);
+        P(se.statistics.nr_failed_migrations_hot);
+        P(se.statistics.nr_forced_migrations);
+        P(se.statistics.nr_wakeups);
+        P(se.statistics.nr_wakeups_sync);
+        P(se.statistics.nr_wakeups_migrate);
+        P(se.statistics.nr_wakeups_local);
+        P(se.statistics.nr_wakeups_remote);
+        P(se.statistics.nr_wakeups_affine);
+        P(se.statistics.nr_wakeups_affine_attempts);
+        P(se.statistics.nr_wakeups_passive);
+        P(se.statistics.nr_wakeups_idle);
 
         {
                 u64 avg_atom, avg_per_cpu;
@@ -491,35 +486,6 @@ void proc_sched_show_task(struct task_struct *p, struct seq_file *m)
 void proc_sched_set_task(struct task_struct *p)
 {
 #ifdef CONFIG_SCHEDSTATS
-        p->se.wait_max                          = 0;
-        p->se.wait_sum                          = 0;
-        p->se.wait_count                        = 0;
-        p->se.iowait_sum                        = 0;
-        p->se.iowait_count                      = 0;
-        p->se.sleep_max                         = 0;
-        p->se.sum_sleep_runtime                 = 0;
-        p->se.block_max                         = 0;
-        p->se.exec_max                          = 0;
-        p->se.slice_max                         = 0;
-        p->se.nr_migrations                     = 0;
-        p->se.nr_migrations_cold                = 0;
-        p->se.nr_failed_migrations_affine       = 0;
-        p->se.nr_failed_migrations_running      = 0;
-        p->se.nr_failed_migrations_hot          = 0;
-        p->se.nr_forced_migrations              = 0;
-        p->se.nr_wakeups                        = 0;
-        p->se.nr_wakeups_sync                   = 0;
-        p->se.nr_wakeups_migrate                = 0;
-        p->se.nr_wakeups_local                  = 0;
-        p->se.nr_wakeups_remote                 = 0;
-        p->se.nr_wakeups_affine                 = 0;
-        p->se.nr_wakeups_affine_attempts        = 0;
-        p->se.nr_wakeups_passive                = 0;
-        p->se.nr_wakeups_idle                   = 0;
-        p->sched_info.bkl_count                 = 0;
+        memset(&p->se.statistics, 0, sizeof(p->se.statistics));
 #endif
-        p->se.sum_exec_runtime                  = 0;
-        p->se.prev_sum_exec_runtime             = 0;
-        p->nvcsw                                = 0;
-        p->nivcsw                               = 0;
 }
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 3e1fd96c6cf9..217e4a9393e4 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -35,8 +35,8 @@
  * (to see the precise effective timeslice length of your workload,
  *  run vmstat and monitor the context-switches (cs) field)
  */
-unsigned int sysctl_sched_latency = 5000000ULL;
-unsigned int normalized_sysctl_sched_latency = 5000000ULL;
+unsigned int sysctl_sched_latency = 6000000ULL;
+unsigned int normalized_sysctl_sched_latency = 6000000ULL;
 
 /*
  * The initial- and re-scaling of tunables is configurable
@@ -52,15 +52,15 @@ enum sched_tunable_scaling sysctl_sched_tunable_scaling
 
 /*
  * Minimal preemption granularity for CPU-bound tasks:
- * (default: 1 msec * (1 + ilog(ncpus)), units: nanoseconds)
+ * (default: 2 msec * (1 + ilog(ncpus)), units: nanoseconds)
  */
-unsigned int sysctl_sched_min_granularity = 1000000ULL;
-unsigned int normalized_sysctl_sched_min_granularity = 1000000ULL;
+unsigned int sysctl_sched_min_granularity = 2000000ULL;
+unsigned int normalized_sysctl_sched_min_granularity = 2000000ULL;
 
 /*
  * is kept at sysctl_sched_latency / sysctl_sched_min_granularity
  */
-static unsigned int sched_nr_latency = 5;
+static unsigned int sched_nr_latency = 3;
 
 /*
  * After fork, child runs first. If set to 0 (default) then
@@ -505,7 +505,8 @@ __update_curr(struct cfs_rq *cfs_rq, struct sched_entity *curr,
 {
         unsigned long delta_exec_weighted;
 
-        schedstat_set(curr->exec_max, max((u64)delta_exec, curr->exec_max));
+        schedstat_set(curr->statistics.exec_max,
+                      max((u64)delta_exec, curr->statistics.exec_max));
 
         curr->sum_exec_runtime += delta_exec;
         schedstat_add(cfs_rq, exec_clock, delta_exec);
@@ -548,7 +549,7 @@ static void update_curr(struct cfs_rq *cfs_rq)
 static inline void
 update_stats_wait_start(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
-        schedstat_set(se->wait_start, rq_of(cfs_rq)->clock);
+        schedstat_set(se->statistics.wait_start, rq_of(cfs_rq)->clock);
 }
 
 /*
@@ -567,18 +568,18 @@ static void update_stats_enqueue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 static void
 update_stats_wait_end(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
-        schedstat_set(se->wait_max, max(se->wait_max,
-                        rq_of(cfs_rq)->clock - se->wait_start));
-        schedstat_set(se->wait_count, se->wait_count + 1);
-        schedstat_set(se->wait_sum, se->wait_sum +
-                        rq_of(cfs_rq)->clock - se->wait_start);
+        schedstat_set(se->statistics.wait_max, max(se->statistics.wait_max,
+                        rq_of(cfs_rq)->clock - se->statistics.wait_start));
+        schedstat_set(se->statistics.wait_count, se->statistics.wait_count + 1);
+        schedstat_set(se->statistics.wait_sum, se->statistics.wait_sum +
+                        rq_of(cfs_rq)->clock - se->statistics.wait_start);
 #ifdef CONFIG_SCHEDSTATS
         if (entity_is_task(se)) {
                 trace_sched_stat_wait(task_of(se),
-                        rq_of(cfs_rq)->clock - se->wait_start);
+                        rq_of(cfs_rq)->clock - se->statistics.wait_start);
         }
 #endif
-        schedstat_set(se->wait_start, 0);
+        schedstat_set(se->statistics.wait_start, 0);
 }
 
 static inline void
@@ -657,39 +658,39 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
         if (entity_is_task(se))
                 tsk = task_of(se);
 
-        if (se->sleep_start) {
-                u64 delta = rq_of(cfs_rq)->clock - se->sleep_start;
+        if (se->statistics.sleep_start) {
+                u64 delta = rq_of(cfs_rq)->clock - se->statistics.sleep_start;
 
                 if ((s64)delta < 0)
                         delta = 0;
 
-                if (unlikely(delta > se->sleep_max))
-                        se->sleep_max = delta;
+                if (unlikely(delta > se->statistics.sleep_max))
+                        se->statistics.sleep_max = delta;
 
-                se->sleep_start = 0;
-                se->sum_sleep_runtime += delta;
+                se->statistics.sleep_start = 0;
+                se->statistics.sum_sleep_runtime += delta;
 
                 if (tsk) {
                         account_scheduler_latency(tsk, delta >> 10, 1);
                         trace_sched_stat_sleep(tsk, delta);
                 }
         }
-        if (se->block_start) {
-                u64 delta = rq_of(cfs_rq)->clock - se->block_start;
+        if (se->statistics.block_start) {
+                u64 delta = rq_of(cfs_rq)->clock - se->statistics.block_start;
 
                 if ((s64)delta < 0)
                         delta = 0;
 
-                if (unlikely(delta > se->block_max))
-                        se->block_max = delta;
+                if (unlikely(delta > se->statistics.block_max))
+                        se->statistics.block_max = delta;
 
-                se->block_start = 0;
-                se->sum_sleep_runtime += delta;
+                se->statistics.block_start = 0;
+                se->statistics.sum_sleep_runtime += delta;
 
                 if (tsk) {
                         if (tsk->in_iowait) {
-                                se->iowait_sum += delta;
-                                se->iowait_count++;
+                                se->statistics.iowait_sum += delta;
+                                se->statistics.iowait_count++;
                                 trace_sched_stat_iowait(tsk, delta);
                         }
 
@@ -737,20 +738,10 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
                 vruntime += sched_vslice(cfs_rq, se);
 
         /* sleeps up to a single latency don't count. */
-        if (!initial && sched_feat(FAIR_SLEEPERS)) {
+        if (!initial) {
                 unsigned long thresh = sysctl_sched_latency;
 
                 /*
-                 * Convert the sleeper threshold into virtual time.
-                 * SCHED_IDLE is a special sub-class.  We care about
-                 * fairness only relative to other SCHED_IDLE tasks,
-                 * all of which have the same weight.
-                 */
-                if (sched_feat(NORMALIZED_SLEEPER) && (!entity_is_task(se) ||
-                                 task_of(se)->policy != SCHED_IDLE))
-                        thresh = calc_delta_fair(thresh, se);
-
-                /*
                  * Halve their sleep time's effect, to allow
                  * for a gentler effect of sleepers:
                  */
@@ -766,9 +757,6 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
         se->vruntime = vruntime;
 }
 
-#define ENQUEUE_WAKEUP  1
-#define ENQUEUE_MIGRATE 2
-
 static void
 enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
 {
@@ -776,7 +764,7 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
          * Update the normalized vruntime before updating min_vruntime
          * through callig update_curr().
          */
-        if (!(flags & ENQUEUE_WAKEUP) || (flags & ENQUEUE_MIGRATE))
+        if (!(flags & ENQUEUE_WAKEUP) || (flags & ENQUEUE_WAKING))
                 se->vruntime += cfs_rq->min_vruntime;
 
         /*
@@ -812,7 +800,7 @@ static void clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
 }
 
 static void
-dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int sleep)
+dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
 {
         /*
          * Update run-time statistics of the 'current'.
@@ -820,15 +808,15 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int sleep)
         update_curr(cfs_rq);
 
         update_stats_dequeue(cfs_rq, se);
-        if (sleep) {
+        if (flags & DEQUEUE_SLEEP) {
 #ifdef CONFIG_SCHEDSTATS
                 if (entity_is_task(se)) {
                         struct task_struct *tsk = task_of(se);
 
                         if (tsk->state & TASK_INTERRUPTIBLE)
-                                se->sleep_start = rq_of(cfs_rq)->clock;
+                                se->statistics.sleep_start = rq_of(cfs_rq)->clock;
                         if (tsk->state & TASK_UNINTERRUPTIBLE)
-                                se->block_start = rq_of(cfs_rq)->clock;
+                                se->statistics.block_start = rq_of(cfs_rq)->clock;
                 }
 #endif
         }
@@ -845,7 +833,7 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int sleep)
          * update can refer to the ->curr item and we need to reflect this
          * movement in our normalized position.
          */
-        if (!sleep)
+        if (!(flags & DEQUEUE_SLEEP))
                 se->vruntime -= cfs_rq->min_vruntime;
 }
 
@@ -912,7 +900,7 @@ set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
          * when there are only lesser-weight tasks around):
          */
         if (rq_of(cfs_rq)->load.weight >= 2*se->load.weight) {
-                se->slice_max = max(se->slice_max,
+                se->statistics.slice_max = max(se->statistics.slice_max,
                         se->sum_exec_runtime - se->prev_sum_exec_runtime);
         }
 #endif
@@ -1054,16 +1042,10 @@ static inline void hrtick_update(struct rq *rq)
  * then put the task into the rbtree:
  */
 static void
-enqueue_task_fair(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
 {
         struct cfs_rq *cfs_rq;
         struct sched_entity *se = &p->se;
-        int flags = 0;
-
-        if (wakeup)
-                flags |= ENQUEUE_WAKEUP;
-        if (p->state == TASK_WAKING)
-                flags |= ENQUEUE_MIGRATE;
 
         for_each_sched_entity(se) {
                 if (se->on_rq)
@@ -1081,18 +1063,18 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int wakeup, bool head)
  * decreased. We remove the task from the rbtree and
  * update the fair scheduling stats:
  */
-static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int sleep)
+static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
 {
         struct cfs_rq *cfs_rq;
         struct sched_entity *se = &p->se;
 
         for_each_sched_entity(se) {
                 cfs_rq = cfs_rq_of(se);
-                dequeue_entity(cfs_rq, se, sleep);
+                dequeue_entity(cfs_rq, se, flags);
                 /* Don't dequeue parent if it has other entities besides us */
                 if (cfs_rq->load.weight)
                         break;
-                sleep = 1;
+                flags |= DEQUEUE_SLEEP;
         }
 
         hrtick_update(rq);
@@ -1240,7 +1222,6 @@ static inline unsigned long effective_load(struct task_group *tg, int cpu,
 
 static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
 {
-        struct task_struct *curr = current;
         unsigned long this_load, load;
         int idx, this_cpu, prev_cpu;
         unsigned long tl_per_task;
@@ -1255,18 +1236,6 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
         load      = source_load(prev_cpu, idx);
         this_load = target_load(this_cpu, idx);
 
-        if (sync) {
-               if (sched_feat(SYNC_LESS) &&
-                   (curr->se.avg_overlap > sysctl_sched_migration_cost ||
-                    p->se.avg_overlap > sysctl_sched_migration_cost))
-                       sync = 0;
-        } else {
-                if (sched_feat(SYNC_MORE) &&
-                    (curr->se.avg_overlap < sysctl_sched_migration_cost &&
-                     p->se.avg_overlap < sysctl_sched_migration_cost))
-                        sync = 1;
-        }
-
         /*
          * If sync wakeup then subtract the (maximum possible)
          * effect of the currently running task from the load
@@ -1306,7 +1275,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
         if (sync && balanced)
                 return 1;
 
-        schedstat_inc(p, se.nr_wakeups_affine_attempts);
+        schedstat_inc(p, se.statistics.nr_wakeups_affine_attempts);
         tl_per_task = cpu_avg_load_per_task(this_cpu);
 
         if (balanced ||
@@ -1318,7 +1287,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
                  * there is no bad imbalance.
                  */
                 schedstat_inc(sd, ttwu_move_affine);
-                schedstat_inc(p, se.nr_wakeups_affine);
+                schedstat_inc(p, se.statistics.nr_wakeups_affine);
 
                 return 1;
         }
@@ -1406,29 +1375,48 @@ find_idlest_cpu(struct sched_group *group, struct task_struct *p, int this_cpu)
 /*
  * Try and locate an idle CPU in the sched_domain.
  */
-static int
-select_idle_sibling(struct task_struct *p, struct sched_domain *sd, int target)
+static int select_idle_sibling(struct task_struct *p, int target)
 {
         int cpu = smp_processor_id();
         int prev_cpu = task_cpu(p);
+        struct sched_domain *sd;
         int i;
 
         /*
-         * If this domain spans both cpu and prev_cpu (see the SD_WAKE_AFFINE
-         * test in select_task_rq_fair) and the prev_cpu is idle then that's
-         * always a better target than the current cpu.
+         * If the task is going to be woken-up on this cpu and if it is
+         * already idle, then it is the right target.
          */
-        if (target == cpu && !cpu_rq(prev_cpu)->cfs.nr_running)
+        if (target == cpu && idle_cpu(cpu))
+                return cpu;
+
+        /*
+         * If the task is going to be woken-up on the cpu where it previously
+         * ran and if it is currently idle, then it the right target.
+         */
+        if (target == prev_cpu && idle_cpu(prev_cpu))
                 return prev_cpu;
 
         /*
-         * Otherwise, iterate the domain and find an elegible idle cpu.
+         * Otherwise, iterate the domains and find an elegible idle cpu.
          */
-        for_each_cpu_and(i, sched_domain_span(sd), &p->cpus_allowed) {
-                if (!cpu_rq(i)->cfs.nr_running) {
-                        target = i;
+        for_each_domain(target, sd) {
+                if (!(sd->flags & SD_SHARE_PKG_RESOURCES))
                         break;
+
+                for_each_cpu_and(i, sched_domain_span(sd), &p->cpus_allowed) {
+                        if (idle_cpu(i)) {
+                                target = i;
+                                break;
+                        }
                 }
+
+                /*
+                 * Lets stop looking for an idle sibling when we reached
+                 * the domain that spans the current cpu and prev_cpu.
+                 */
+                if (cpumask_test_cpu(cpu, sched_domain_span(sd)) &&
+                    cpumask_test_cpu(prev_cpu, sched_domain_span(sd)))
+                        break;
         }
 
         return target;
@@ -1445,7 +1433,8 @@ select_idle_sibling(struct task_struct *p, struct sched_domain *sd, int target)
  *
  * preempt must be disabled.
  */
-static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flags)
+static int
+select_task_rq_fair(struct rq *rq, struct task_struct *p, int sd_flag, int wake_flags)
 {
         struct sched_domain *tmp, *affine_sd = NULL, *sd = NULL;
         int cpu = smp_processor_id();
@@ -1456,8 +1445,7 @@ static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flag
         int sync = wake_flags & WF_SYNC;
 
         if (sd_flag & SD_BALANCE_WAKE) {
-                if (sched_feat(AFFINE_WAKEUPS) &&
-                    cpumask_test_cpu(cpu, &p->cpus_allowed))
+                if (cpumask_test_cpu(cpu, &p->cpus_allowed))
                         want_affine = 1;
                 new_cpu = prev_cpu;
         }
@@ -1491,34 +1479,13 @@ static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flag
                 }
 
                 /*
-                 * While iterating the domains looking for a spanning
-                 * WAKE_AFFINE domain, adjust the affine target to any idle cpu
-                 * in cache sharing domains along the way.
+                 * If both cpu and prev_cpu are part of this domain,
+                 * cpu is a valid SD_WAKE_AFFINE target.
                  */
-                if (want_affine) {
-                        int target = -1;
-
-                        /*
-                         * If both cpu and prev_cpu are part of this domain,
-                         * cpu is a valid SD_WAKE_AFFINE target.
-                         */
-                        if (cpumask_test_cpu(prev_cpu, sched_domain_span(tmp)))
-                                target = cpu;
-
-                        /*
-                         * If there's an idle sibling in this domain, make that
-                         * the wake_affine target instead of the current cpu.
-                         */
-                        if (tmp->flags & SD_SHARE_PKG_RESOURCES)
-                                target = select_idle_sibling(p, tmp, target);
-
-                        if (target >= 0) {
-                                if (tmp->flags & SD_WAKE_AFFINE) {
-                                        affine_sd = tmp;
-                                        want_affine = 0;
-                                }
-                                cpu = target;
-                        }
+                if (want_affine && (tmp->flags & SD_WAKE_AFFINE) &&
+                    cpumask_test_cpu(prev_cpu, sched_domain_span(tmp))) {
+                        affine_sd = tmp;
+                        want_affine = 0;
                 }
 
                 if (!want_sd && !want_affine)
@@ -1531,22 +1498,29 @@ static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flag
                         sd = tmp;
         }
 
+#ifdef CONFIG_FAIR_GROUP_SCHED
         if (sched_feat(LB_SHARES_UPDATE)) {
                 /*
                  * Pick the largest domain to update shares over
                  */
                 tmp = sd;
-                if (affine_sd && (!tmp ||
-                                  cpumask_weight(sched_domain_span(affine_sd)) >
-                                  cpumask_weight(sched_domain_span(sd))))
+                if (affine_sd && (!tmp || affine_sd->span_weight > sd->span_weight))
                         tmp = affine_sd;
 
-                if (tmp)
+                if (tmp) {
+                        raw_spin_unlock(&rq->lock);
                         update_shares(tmp);
+                        raw_spin_lock(&rq->lock);
+                }
         }
+#endif
 
-        if (affine_sd && wake_affine(affine_sd, p, sync))
-                return cpu;
+        if (affine_sd) {
+                if (cpu == prev_cpu || wake_affine(affine_sd, p, sync))
+                        return select_idle_sibling(p, cpu);
+                else
+                        return select_idle_sibling(p, prev_cpu);
+        }
 
         while (sd) {
                 int load_idx = sd->forkexec_idx;
@@ -1576,10 +1550,10 @@ static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flag
 
                 /* Now try balancing at a lower domain level of new_cpu */
                 cpu = new_cpu;
-                weight = cpumask_weight(sched_domain_span(sd));
+                weight = sd->span_weight;
                 sd = NULL;
                 for_each_domain(cpu, tmp) {
-                        if (weight <= cpumask_weight(sched_domain_span(tmp)))
+                        if (weight <= tmp->span_weight)
                                 break;
                         if (tmp->flags & sd_flag)
                                 sd = tmp;
@@ -1591,63 +1565,26 @@ static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flag
 }
 #endif /* CONFIG_SMP */
 
-/*
- * Adaptive granularity
- *
- * se->avg_wakeup gives the average time a task runs until it does a wakeup,
- * with the limit of wakeup_gran -- when it never does a wakeup.
- *
- * So the smaller avg_wakeup is the faster we want this task to preempt,
- * but we don't want to treat the preemptee unfairly and therefore allow it
- * to run for at least the amount of time we'd like to run.
- *
- * NOTE: we use 2*avg_wakeup to increase the probability of actually doing one
- *
- * NOTE: we use *nr_running to scale with load, this nicely matches the
- *       degrading latency on load.
- */
-static unsigned long
-adaptive_gran(struct sched_entity *curr, struct sched_entity *se)
-{
-        u64 this_run = curr->sum_exec_runtime - curr->prev_sum_exec_runtime;
-        u64 expected_wakeup = 2*se->avg_wakeup * cfs_rq_of(se)->nr_running;
-        u64 gran = 0;
-
-        if (this_run < expected_wakeup)
-                gran = expected_wakeup - this_run;
-
-        return min_t(s64, gran, sysctl_sched_wakeup_granularity);
-}
-
 static unsigned long
 wakeup_gran(struct sched_entity *curr, struct sched_entity *se)
 {
         unsigned long gran = sysctl_sched_wakeup_granularity;
 
-        if (cfs_rq_of(curr)->curr && sched_feat(ADAPTIVE_GRAN))
-                gran = adaptive_gran(curr, se);
-
         /*
          * Since its curr running now, convert the gran from real-time
          * to virtual-time in his units.
+         *
+         * By using 'se' instead of 'curr' we penalize light tasks, so
+         * they get preempted easier. That is, if 'se' < 'curr' then
+         * the resulting gran will be larger, therefore penalizing the
+         * lighter, if otoh 'se' > 'curr' then the resulting gran will
+         * be smaller, again penalizing the lighter task.
+         *
+         * This is especially important for buddies when the leftmost
+         * task is higher priority than the buddy.
          */
-        if (sched_feat(ASYM_GRAN)) {
-                /*
-                 * By using 'se' instead of 'curr' we penalize light tasks, so
-                 * they get preempted easier. That is, if 'se' < 'curr' then
-                 * the resulting gran will be larger, therefore penalizing the
-                 * lighter, if otoh 'se' > 'curr' then the resulting gran will
-                 * be smaller, again penalizing the lighter task.
-                 *
-                 * This is especially important for buddies when the leftmost
-                 * task is higher priority than the buddy.
-                 */
-                if (unlikely(se->load.weight != NICE_0_LOAD))
-                        gran = calc_delta_fair(gran, se);
-        } else {
-                if (unlikely(curr->load.weight != NICE_0_LOAD))
-                        gran = calc_delta_fair(gran, curr);
-        }
+        if (unlikely(se->load.weight != NICE_0_LOAD))
+                gran = calc_delta_fair(gran, se);
 
         return gran;
 }
@@ -1705,7 +1642,6 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
         struct task_struct *curr = rq->curr;
         struct sched_entity *se = &curr->se, *pse = &p->se;
         struct cfs_rq *cfs_rq = task_cfs_rq(curr);
-        int sync = wake_flags & WF_SYNC;
         int scale = cfs_rq->nr_running >= sched_nr_latency;
 
         if (unlikely(rt_prio(p->prio)))
@@ -1738,14 +1674,6 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_
         if (unlikely(curr->policy == SCHED_IDLE))
                 goto preempt;
 
-        if (sched_feat(WAKEUP_SYNC) && sync)
-                goto preempt;
-
-        if (sched_feat(WAKEUP_OVERLAP) &&
-                        se->avg_overlap < sysctl_sched_migration_cost &&
-                        pse->avg_overlap < sysctl_sched_migration_cost)
-                goto preempt;
-
         if (!sched_feat(WAKEUP_PREEMPT))
                 return;
 
@@ -1844,13 +1772,13 @@ int can_migrate_task(struct task_struct *p, struct rq *rq, int this_cpu,
          * 3) are cache-hot on their current CPU.
          */
         if (!cpumask_test_cpu(this_cpu, &p->cpus_allowed)) {
-                schedstat_inc(p, se.nr_failed_migrations_affine);
+                schedstat_inc(p, se.statistics.nr_failed_migrations_affine);
                 return 0;
         }
         *all_pinned = 0;
 
         if (task_running(rq, p)) {
-                schedstat_inc(p, se.nr_failed_migrations_running);
+                schedstat_inc(p, se.statistics.nr_failed_migrations_running);
                 return 0;
         }
 
@@ -1866,14 +1794,14 @@ int can_migrate_task(struct task_struct *p, struct rq *rq, int this_cpu,
 #ifdef CONFIG_SCHEDSTATS
                 if (tsk_cache_hot) {
                         schedstat_inc(sd, lb_hot_gained[idle]);
-                        schedstat_inc(p, se.nr_forced_migrations);
+                        schedstat_inc(p, se.statistics.nr_forced_migrations);
                 }
 #endif
                 return 1;
         }
 
         if (tsk_cache_hot) {
-                schedstat_inc(p, se.nr_failed_migrations_hot);
+                schedstat_inc(p, se.statistics.nr_failed_migrations_hot);
                 return 0;
         }
         return 1;
@@ -2311,7 +2239,7 @@ unsigned long __weak arch_scale_freq_power(struct sched_domain *sd, int cpu)
 
 unsigned long default_scale_smt_power(struct sched_domain *sd, int cpu)
 {
-        unsigned long weight = cpumask_weight(sched_domain_span(sd));
+        unsigned long weight = sd->span_weight;
         unsigned long smt_gain = sd->smt_gain;
 
         smt_gain /= weight;
@@ -2344,7 +2272,7 @@ unsigned long scale_rt_power(int cpu)
 
 static void update_cpu_power(struct sched_domain *sd, int cpu)
 {
-        unsigned long weight = cpumask_weight(sched_domain_span(sd));
+        unsigned long weight = sd->span_weight;
         unsigned long power = SCHED_LOAD_SCALE;
         struct sched_group *sdg = sd->groups;
 
@@ -2870,6 +2798,8 @@ static int need_active_balance(struct sched_domain *sd, int sd_idle, int idle)
         return unlikely(sd->nr_balance_failed > sd->cache_nice_tries+2);
 }
 
+static int active_load_balance_cpu_stop(void *data);
+
 /*
  * Check this_cpu to ensure it is balanced within domain. Attempt to move
  * tasks if there is an imbalance.
@@ -2959,8 +2889,9 @@ redo:
                 if (need_active_balance(sd, sd_idle, idle)) {
                         raw_spin_lock_irqsave(&busiest->lock, flags);
 
-                        /* don't kick the migration_thread, if the curr
-                         * task on busiest cpu can't be moved to this_cpu
+                        /* don't kick the active_load_balance_cpu_stop,
+                         * if the curr task on busiest cpu can't be
+                         * moved to this_cpu
                          */
                         if (!cpumask_test_cpu(this_cpu,
                                               &busiest->curr->cpus_allowed)) {
@@ -2970,14 +2901,22 @@ redo:
                                 goto out_one_pinned;
                         }
 
+                        /*
+                         * ->active_balance synchronizes accesses to
+                         * ->active_balance_work.  Once set, it's cleared
+                         * only after active load balance is finished.
+                         */
                         if (!busiest->active_balance) {
                                 busiest->active_balance = 1;
                                 busiest->push_cpu = this_cpu;
                                 active_balance = 1;
                         }
                         raw_spin_unlock_irqrestore(&busiest->lock, flags);
+
                         if (active_balance)
-                                wake_up_process(busiest->migration_thread);
+                                stop_one_cpu_nowait(cpu_of(busiest),
+                                        active_load_balance_cpu_stop, busiest,
+                                        &busiest->active_balance_work);
 
                         /*
                          * We've kicked active balancing, reset the failure
@@ -3084,24 +3023,29 @@ static void idle_balance(int this_cpu, struct rq *this_rq)
 }
 
 /*
- * active_load_balance is run by migration threads. It pushes running tasks
- * off the busiest CPU onto idle CPUs. It requires at least 1 task to be
- * running on each physical CPU where possible, and avoids physical /
- * logical imbalances.
- *
- * Called with busiest_rq locked.
+ * active_load_balance_cpu_stop is run by cpu stopper. It pushes
+ * running tasks off the busiest CPU onto idle CPUs. It requires at
+ * least 1 task to be running on each physical CPU where possible, and
+ * avoids physical / logical imbalances.
  */
-static void active_load_balance(struct rq *busiest_rq, int busiest_cpu)
+static int active_load_balance_cpu_stop(void *data)
 {
+        struct rq *busiest_rq = data;
+        int busiest_cpu = cpu_of(busiest_rq);
         int target_cpu = busiest_rq->push_cpu;
+        struct rq *target_rq = cpu_rq(target_cpu);
         struct sched_domain *sd;
-        struct rq *target_rq;
+
+        raw_spin_lock_irq(&busiest_rq->lock);
+
+        /* make sure the requested cpu hasn't gone down in the meantime */
+        if (unlikely(busiest_cpu != smp_processor_id() ||
+                     !busiest_rq->active_balance))
+                goto out_unlock;
 
         /* Is there any task to move? */
         if (busiest_rq->nr_running <= 1)
-                return;
-
-        target_rq = cpu_rq(target_cpu);
+                goto out_unlock;
 
         /*
          * This condition is "impossible", if it occurs
@@ -3112,8 +3056,6 @@ static void active_load_balance(struct rq *busiest_rq, int busiest_cpu)
 
         /* move a task from busiest_rq to target_rq */
         double_lock_balance(busiest_rq, target_rq);
-        update_rq_clock(busiest_rq);
-        update_rq_clock(target_rq);
 
         /* Search for an sd spanning us and the target CPU. */
         for_each_domain(target_cpu, sd) {
@@ -3132,6 +3074,10 @@ static void active_load_balance(struct rq *busiest_rq, int busiest_cpu)
                         schedstat_inc(sd, alb_failed);
         }
         double_unlock_balance(busiest_rq, target_rq);
+out_unlock:
+        busiest_rq->active_balance = 0;
+        raw_spin_unlock_irq(&busiest_rq->lock);
+        return 0;
 }
 
 #ifdef CONFIG_NO_HZ
@@ -3476,7 +3422,7 @@ static void run_rebalance_domains(struct softirq_action *h)
 
 static inline int on_null_domain(int cpu)
 {
-        return !rcu_dereference(cpu_rq(cpu)->sd);
+        return !rcu_dereference_sched(cpu_rq(cpu)->sd);
 }
 
 /*
diff --git a/kernel/sched_features.h b/kernel/sched_features.h
index d5059fd761d9..83c66e8ad3ee 100644
--- a/kernel/sched_features.h
+++ b/kernel/sched_features.h
@@ -1,11 +1,4 @@
 /*
- * Disregards a certain amount of sleep time (sched_latency_ns) and
- * considers the task to be running during that period. This gives it
- * a service deficit on wakeup, allowing it to run sooner.
- */
-SCHED_FEAT(FAIR_SLEEPERS, 1)
-
-/*
  * Only give sleepers 50% of their service deficit. This allows
  * them to run sooner, but does not allow tons of sleepers to
  * rip the spread apart.
@@ -13,13 +6,6 @@ SCHED_FEAT(FAIR_SLEEPERS, 1)
 SCHED_FEAT(GENTLE_FAIR_SLEEPERS, 1)
 
 /*
- * By not normalizing the sleep time, heavy tasks get an effective
- * longer period, and lighter task an effective shorter period they
- * are considered running.
- */
-SCHED_FEAT(NORMALIZED_SLEEPER, 0)
-
-/*
  * Place new tasks ahead so that they do not starve already running
  * tasks
  */
@@ -31,37 +17,6 @@ SCHED_FEAT(START_DEBIT, 1)
 SCHED_FEAT(WAKEUP_PREEMPT, 1)
 
 /*
- * Compute wakeup_gran based on task behaviour, clipped to
- *  [0, sched_wakeup_gran_ns]
- */
-SCHED_FEAT(ADAPTIVE_GRAN, 1)
-
-/*
- * When converting the wakeup granularity to virtual time, do it such
- * that heavier tasks preempting a lighter task have an edge.
- */
-SCHED_FEAT(ASYM_GRAN, 1)
-
-/*
- * Always wakeup-preempt SYNC wakeups, see SYNC_WAKEUPS.
- */
-SCHED_FEAT(WAKEUP_SYNC, 0)
-
-/*
- * Wakeup preempt based on task behaviour. Tasks that do not overlap
- * don't get preempted.
- */
-SCHED_FEAT(WAKEUP_OVERLAP, 0)
-
-/*
- * Use the SYNC wakeup hint, pipes and the likes use this to indicate
- * the remote end is likely to consume the data we just wrote, and
- * therefore has cache benefit from being placed on the same cpu, see
- * also AFFINE_WAKEUPS.
- */
-SCHED_FEAT(SYNC_WAKEUPS, 1)
-
-/*
  * Based on load and program behaviour, see if it makes sense to place
  * a newly woken task on the same cpu as the task that woke it --
  * improve cache locality. Typically used with SYNC wakeups as
@@ -70,16 +25,6 @@ SCHED_FEAT(SYNC_WAKEUPS, 1)
 SCHED_FEAT(AFFINE_WAKEUPS, 1)
 
 /*
- * Weaken SYNC hint based on overlap
- */
-SCHED_FEAT(SYNC_LESS, 1)
-
-/*
- * Add SYNC hint based on overlap
- */
-SCHED_FEAT(SYNC_MORE, 0)
-
-/*
  * Prefer to schedule the task we woke last (assuming it failed
  * wakeup-preemption), since its likely going to consume data we
  * touched, increases cache locality.
diff --git a/kernel/sched_idletask.c b/kernel/sched_idletask.c
index a8a6d8a50947..9fa0f402c87c 100644
--- a/kernel/sched_idletask.c
+++ b/kernel/sched_idletask.c
@@ -6,7 +6,8 @@
  */
 
 #ifdef CONFIG_SMP
-static int select_task_rq_idle(struct task_struct *p, int sd_flag, int flags)
+static int
+select_task_rq_idle(struct rq *rq, struct task_struct *p, int sd_flag, int flags)
 {
         return task_cpu(p); /* IDLE tasks as never migrated */
 }
@@ -22,8 +23,7 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl
 static struct task_struct *pick_next_task_idle(struct rq *rq)
 {
         schedstat_inc(rq, sched_goidle);
-        /* adjust the active tasks as we might go into a long sleep */
-        calc_load_account_active(rq);
+        calc_load_account_idle(rq);
         return rq->idle;
 }
 
@@ -32,7 +32,7 @@ static struct task_struct *pick_next_task_idle(struct rq *rq)
  * message if some code attempts to do it:
  */
 static void
-dequeue_task_idle(struct rq *rq, struct task_struct *p, int sleep)
+dequeue_task_idle(struct rq *rq, struct task_struct *p, int flags)
 {
         raw_spin_unlock_irq(&rq->lock);
         printk(KERN_ERR "bad: scheduling from the idle thread!\n");
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index bf3e38fdbe6d..8afb953e31c6 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -613,7 +613,7 @@ static void update_curr_rt(struct rq *rq)
         if (unlikely((s64)delta_exec < 0))
                 delta_exec = 0;
 
-        schedstat_set(curr->se.exec_max, max(curr->se.exec_max, delta_exec));
+        schedstat_set(curr->se.statistics.exec_max, max(curr->se.statistics.exec_max, delta_exec));
 
         curr->se.sum_exec_runtime += delta_exec;
         account_group_exec_runtime(curr, delta_exec);
@@ -888,20 +888,20 @@ static void dequeue_rt_entity(struct sched_rt_entity *rt_se)
  * Adding/removing a task to/from a priority array:
  */
 static void
-enqueue_task_rt(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+enqueue_task_rt(struct rq *rq, struct task_struct *p, int flags)
 {
         struct sched_rt_entity *rt_se = &p->rt;
 
-        if (wakeup)
+        if (flags & ENQUEUE_WAKEUP)
                 rt_se->timeout = 0;
 
-        enqueue_rt_entity(rt_se, head);
+        enqueue_rt_entity(rt_se, flags & ENQUEUE_HEAD);
 
         if (!task_current(rq, p) && p->rt.nr_cpus_allowed > 1)
                 enqueue_pushable_task(rq, p);
 }
 
-static void dequeue_task_rt(struct rq *rq, struct task_struct *p, int sleep)
+static void dequeue_task_rt(struct rq *rq, struct task_struct *p, int flags)
 {
         struct sched_rt_entity *rt_se = &p->rt;
 
@@ -948,10 +948,9 @@ static void yield_task_rt(struct rq *rq)
 #ifdef CONFIG_SMP
 static int find_lowest_rq(struct task_struct *task);
 
-static int select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
+static int
+select_task_rq_rt(struct rq *rq, struct task_struct *p, int sd_flag, int flags)
 {
-        struct rq *rq = task_rq(p);
-
         if (sd_flag != SD_BALANCE_WAKE)
                 return smp_processor_id();
 
@@ -1146,7 +1145,12 @@ static struct task_struct *pick_next_highest_task_rt(struct rq *rq, int cpu)
                 if (next && next->prio < idx)
                         continue;
                 list_for_each_entry(rt_se, array->queue + idx, run_list) {
-                        struct task_struct *p = rt_task_of(rt_se);
+                        struct task_struct *p;
+
+                        if (!rt_entity_is_task(rt_se))
+                                continue;
+
+                        p = rt_task_of(rt_se);
                         if (pick_rt_task(rq, p, cpu)) {
                                 next = p;
                                 break;
@@ -1662,8 +1666,9 @@ static void watchdog(struct rq *rq, struct task_struct *p)
         if (!p->signal)
                 return;
 
-        soft = p->signal->rlim[RLIMIT_RTTIME].rlim_cur;
-        hard = p->signal->rlim[RLIMIT_RTTIME].rlim_max;
+        /* max may change after cur was read, this will be fixed next tick */
+        soft = task_rlimit(p, RLIMIT_RTTIME);
+        hard = task_rlimit_max(p, RLIMIT_RTTIME);
 
         if (soft != RLIM_INFINITY) {
                 unsigned long next;
diff --git a/kernel/signal.c b/kernel/signal.c
index 934ae5e687b9..dbd7fe073c55 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -159,6 +159,10 @@ void recalc_sigpending(void)
 
 /* Given the mask, find the first available signal that should be serviced. */
 
+#define SYNCHRONOUS_MASK \
+        (sigmask(SIGSEGV) | sigmask(SIGBUS) | sigmask(SIGILL) | \
+         sigmask(SIGTRAP) | sigmask(SIGFPE))
+
 int next_signal(struct sigpending *pending, sigset_t *mask)
 {
         unsigned long i, *s, *m, x;
@@ -166,26 +170,39 @@ int next_signal(struct sigpending *pending, sigset_t *mask)
 
         s = pending->signal.sig;
         m = mask->sig;
+
+        /*
+         * Handle the first word specially: it contains the
+         * synchronous signals that need to be dequeued first.
+         */
+        x = *s &~ *m;
+        if (x) {
+                if (x & SYNCHRONOUS_MASK)
+                        x &= SYNCHRONOUS_MASK;
+                sig = ffz(~x) + 1;
+                return sig;
+        }
+
         switch (_NSIG_WORDS) {
         default:
-                for (i = 0; i < _NSIG_WORDS; ++i, ++s, ++m)
-                        if ((x = *s &~ *m) != 0) {
-                                sig = ffz(~x) + i*_NSIG_BPW + 1;
-                                break;
-                        }
+                for (i = 1; i < _NSIG_WORDS; ++i) {
+                        x = *++s &~ *++m;
+                        if (!x)
+                                continue;
+                        sig = ffz(~x) + i*_NSIG_BPW + 1;
+                        break;
+                }
                 break;
 
-        case 2: if ((x = s[0] &~ m[0]) != 0)
-                        sig = 1;
-                else if ((x = s[1] &~ m[1]) != 0)
-                        sig = _NSIG_BPW + 1;
-                else
+        case 2:
+                x = s[1] &~ m[1];
+                if (!x)
                         break;
-                sig += ffz(~x);
+                sig = ffz(~x) + _NSIG_BPW + 1;
                 break;
 
-        case 1: if ((x = *s &~ *m) != 0)
-                        sig = ffz(~x) + 1;
+        case 1:
+                /* Nothing to do */
                 break;
         }
 
@@ -228,7 +245,7 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
 
         if (override_rlimit ||
             atomic_read(&user->sigpending) <=
-                        t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur) {
+                        task_rlimit(t, RLIMIT_SIGPENDING)) {
                 q = kmem_cache_alloc(sigqueue_cachep, flags);
         } else {
                 print_dropped_signal(sig);
diff --git a/kernel/slow-work.c b/kernel/slow-work.c
index 7494bbf5a270..7d3f4fa9ef4f 100644
--- a/kernel/slow-work.c
+++ b/kernel/slow-work.c
@@ -637,7 +637,7 @@ int delayed_slow_work_enqueue(struct delayed_slow_work *dwork,
                         goto cancelled;
 
                 /* the timer holds a reference whilst it is pending */
-                ret = work->ops->get_ref(work);
+                ret = slow_work_get_ref(work);
                 if (ret < 0)
                         goto cant_get_ref;
 
diff --git a/kernel/slow-work.h b/kernel/slow-work.h
index 321f3c59d732..a29ebd1ef41d 100644
--- a/kernel/slow-work.h
+++ b/kernel/slow-work.h
@@ -43,28 +43,28 @@ extern void slow_work_new_thread_desc(struct slow_work *, struct seq_file *);
  */
 static inline void slow_work_set_thread_pid(int id, pid_t pid)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         slow_work_pids[id] = pid;
 #endif
 }
 
 static inline void slow_work_mark_time(struct slow_work *work)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         work->mark = CURRENT_TIME;
 #endif
 }
 
 static inline void slow_work_begin_exec(int id, struct slow_work *work)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         slow_work_execs[id] = work;
 #endif
 }
 
 static inline void slow_work_end_exec(int id, struct slow_work *work)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         write_lock(&slow_work_execs_lock);
         slow_work_execs[id] = NULL;
         write_unlock(&slow_work_execs_lock);
diff --git a/kernel/smp.c b/kernel/smp.c
index 9867b6bfefce..3fc697336183 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/percpu.h>
 #include <linux/init.h>
+#include <linux/gfp.h>
 #include <linux/smp.h>
 #include <linux/cpu.h>
 
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 7c1a67ef0274..0db913a5c60f 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -716,7 +716,7 @@ static int run_ksoftirqd(void * __bind_cpu)
                         preempt_enable_no_resched();
                         cond_resched();
                         preempt_disable();
-                        rcu_sched_qs((long)__bind_cpu);
+                        rcu_note_context_switch((long)__bind_cpu);
                 }
                 preempt_enable();
                 set_current_state(TASK_INTERRUPTIBLE);
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 0d4c7898ab80..4b493f67dcb5 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -155,11 +155,11 @@ void softlockup_tick(void)
          * Wake up the high-prio watchdog task twice per
          * threshold timespan.
          */
-        if (now > touch_ts + softlockup_thresh/2)
+        if (time_after(now - softlockup_thresh/2, touch_ts))
                 wake_up_process(per_cpu(softlockup_watchdog, this_cpu));
 
         /* Warn about unreasonable delays: */
-        if (now <= (touch_ts + softlockup_thresh))
+        if (time_before_eq(now - softlockup_thresh, touch_ts))
                 return;
 
         per_cpu(softlockup_print_ts, this_cpu) = touch_ts;
diff --git a/kernel/srcu.c b/kernel/srcu.c
index bde4295774c8..2980da3fd509 100644
--- a/kernel/srcu.c
+++ b/kernel/srcu.c
@@ -30,7 +30,6 @@
 #include <linux/preempt.h>
 #include <linux/rcupdate.h>
 #include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/srcu.h>
 
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 912823e2a11b..b4e7431e7c78 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -1,17 +1,384 @@
-/* Copyright 2008, 2005 Rusty Russell rusty@rustcorp.com.au IBM Corporation.
- * GPL v2 and any later version.
+/*
+ * kernel/stop_machine.c
+ *
+ * Copyright (C) 2008, 2005     IBM Corporation.
+ * Copyright (C) 2008, 2005     Rusty Russell rusty@rustcorp.com.au
+ * Copyright (C) 2010           SUSE Linux Products GmbH
+ * Copyright (C) 2010           Tejun Heo <tj@kernel.org>
+ *
+ * This file is released under the GPLv2 and any later version.
  */
+#include <linux/completion.h>
 #include <linux/cpu.h>
-#include <linux/err.h>
+#include <linux/init.h>
 #include <linux/kthread.h>
 #include <linux/module.h>
+#include <linux/percpu.h>
 #include <linux/sched.h>
 #include <linux/stop_machine.h>
-#include <linux/syscalls.h>
 #include <linux/interrupt.h>
+#include <linux/kallsyms.h>
 
 #include <asm/atomic.h>
-#include <asm/uaccess.h>
+
+/*
+ * Structure to determine completion condition and record errors.  May
+ * be shared by works on different cpus.
+ */
+struct cpu_stop_done {
+        atomic_t                nr_todo;        /* nr left to execute */
+        bool                    executed;       /* actually executed? */
+        int                     ret;            /* collected return value */
+        struct completion       completion;     /* fired if nr_todo reaches 0 */
+};
+
+/* the actual stopper, one per every possible cpu, enabled on online cpus */
+struct cpu_stopper {
+        spinlock_t              lock;
+        struct list_head        works;          /* list of pending works */
+        struct task_struct      *thread;        /* stopper thread */
+        bool                    enabled;        /* is this stopper enabled? */
+};
+
+static DEFINE_PER_CPU(struct cpu_stopper, cpu_stopper);
+
+static void cpu_stop_init_done(struct cpu_stop_done *done, unsigned int nr_todo)
+{
+        memset(done, 0, sizeof(*done));
+        atomic_set(&done->nr_todo, nr_todo);
+        init_completion(&done->completion);
+}
+
+/* signal completion unless @done is NULL */
+static void cpu_stop_signal_done(struct cpu_stop_done *done, bool executed)
+{
+        if (done) {
+                if (executed)
+                        done->executed = true;
+                if (atomic_dec_and_test(&done->nr_todo))
+                        complete(&done->completion);
+        }
+}
+
+/* queue @work to @stopper.  if offline, @work is completed immediately */
+static void cpu_stop_queue_work(struct cpu_stopper *stopper,
+                                struct cpu_stop_work *work)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&stopper->lock, flags);
+
+        if (stopper->enabled) {
+                list_add_tail(&work->list, &stopper->works);
+                wake_up_process(stopper->thread);
+        } else
+                cpu_stop_signal_done(work->done, false);
+
+        spin_unlock_irqrestore(&stopper->lock, flags);
+}
+
+/**
+ * stop_one_cpu - stop a cpu
+ * @cpu: cpu to stop
+ * @fn: function to execute
+ * @arg: argument to @fn
+ *
+ * Execute @fn(@arg) on @cpu.  @fn is run in a process context with
+ * the highest priority preempting any task on the cpu and
+ * monopolizing it.  This function returns after the execution is
+ * complete.
+ *
+ * This function doesn't guarantee @cpu stays online till @fn
+ * completes.  If @cpu goes down in the middle, execution may happen
+ * partially or fully on different cpus.  @fn should either be ready
+ * for that or the caller should ensure that @cpu stays online until
+ * this function completes.
+ *
+ * CONTEXT:
+ * Might sleep.
+ *
+ * RETURNS:
+ * -ENOENT if @fn(@arg) was not executed because @cpu was offline;
+ * otherwise, the return value of @fn.
+ */
+int stop_one_cpu(unsigned int cpu, cpu_stop_fn_t fn, void *arg)
+{
+        struct cpu_stop_done done;
+        struct cpu_stop_work work = { .fn = fn, .arg = arg, .done = &done };
+
+        cpu_stop_init_done(&done, 1);
+        cpu_stop_queue_work(&per_cpu(cpu_stopper, cpu), &work);
+        wait_for_completion(&done.completion);
+        return done.executed ? done.ret : -ENOENT;
+}
+
+/**
+ * stop_one_cpu_nowait - stop a cpu but don't wait for completion
+ * @cpu: cpu to stop
+ * @fn: function to execute
+ * @arg: argument to @fn
+ *
+ * Similar to stop_one_cpu() but doesn't wait for completion.  The
+ * caller is responsible for ensuring @work_buf is currently unused
+ * and will remain untouched until stopper starts executing @fn.
+ *
+ * CONTEXT:
+ * Don't care.
+ */
+void stop_one_cpu_nowait(unsigned int cpu, cpu_stop_fn_t fn, void *arg,
+                        struct cpu_stop_work *work_buf)
+{
+        *work_buf = (struct cpu_stop_work){ .fn = fn, .arg = arg, };
+        cpu_stop_queue_work(&per_cpu(cpu_stopper, cpu), work_buf);
+}
+
+/* static data for stop_cpus */
+static DEFINE_MUTEX(stop_cpus_mutex);
+static DEFINE_PER_CPU(struct cpu_stop_work, stop_cpus_work);
+
+int __stop_cpus(const struct cpumask *cpumask, cpu_stop_fn_t fn, void *arg)
+{
+        struct cpu_stop_work *work;
+        struct cpu_stop_done done;
+        unsigned int cpu;
+
+        /* initialize works and done */
+        for_each_cpu(cpu, cpumask) {
+                work = &per_cpu(stop_cpus_work, cpu);
+                work->fn = fn;
+                work->arg = arg;
+                work->done = &done;
+        }
+        cpu_stop_init_done(&done, cpumask_weight(cpumask));
+
+        /*
+         * Disable preemption while queueing to avoid getting
+         * preempted by a stopper which might wait for other stoppers
+         * to enter @fn which can lead to deadlock.
+         */
+        preempt_disable();
+        for_each_cpu(cpu, cpumask)
+                cpu_stop_queue_work(&per_cpu(cpu_stopper, cpu),
+                                    &per_cpu(stop_cpus_work, cpu));
+        preempt_enable();
+
+        wait_for_completion(&done.completion);
+        return done.executed ? done.ret : -ENOENT;
+}
+
+/**
+ * stop_cpus - stop multiple cpus
+ * @cpumask: cpus to stop
+ * @fn: function to execute
+ * @arg: argument to @fn
+ *
+ * Execute @fn(@arg) on online cpus in @cpumask.  On each target cpu,
+ * @fn is run in a process context with the highest priority
+ * preempting any task on the cpu and monopolizing it.  This function
+ * returns after all executions are complete.
+ *
+ * This function doesn't guarantee the cpus in @cpumask stay online
+ * till @fn completes.  If some cpus go down in the middle, execution
+ * on the cpu may happen partially or fully on different cpus.  @fn
+ * should either be ready for that or the caller should ensure that
+ * the cpus stay online until this function completes.
+ *
+ * All stop_cpus() calls are serialized making it safe for @fn to wait
+ * for all cpus to start executing it.
+ *
+ * CONTEXT:
+ * Might sleep.
+ *
+ * RETURNS:
+ * -ENOENT if @fn(@arg) was not executed at all because all cpus in
+ * @cpumask were offline; otherwise, 0 if all executions of @fn
+ * returned 0, any non zero return value if any returned non zero.
+ */
+int stop_cpus(const struct cpumask *cpumask, cpu_stop_fn_t fn, void *arg)
+{
+        int ret;
+
+        /* static works are used, process one request at a time */
+        mutex_lock(&stop_cpus_mutex);
+        ret = __stop_cpus(cpumask, fn, arg);
+        mutex_unlock(&stop_cpus_mutex);
+        return ret;
+}
+
+/**
+ * try_stop_cpus - try to stop multiple cpus
+ * @cpumask: cpus to stop
+ * @fn: function to execute
+ * @arg: argument to @fn
+ *
+ * Identical to stop_cpus() except that it fails with -EAGAIN if
+ * someone else is already using the facility.
+ *
+ * CONTEXT:
+ * Might sleep.
+ *
+ * RETURNS:
+ * -EAGAIN if someone else is already stopping cpus, -ENOENT if
+ * @fn(@arg) was not executed at all because all cpus in @cpumask were
+ * offline; otherwise, 0 if all executions of @fn returned 0, any non
+ * zero return value if any returned non zero.
+ */
+int try_stop_cpus(const struct cpumask *cpumask, cpu_stop_fn_t fn, void *arg)
+{
+        int ret;
+
+        /* static works are used, process one request at a time */
+        if (!mutex_trylock(&stop_cpus_mutex))
+                return -EAGAIN;
+        ret = __stop_cpus(cpumask, fn, arg);
+        mutex_unlock(&stop_cpus_mutex);
+        return ret;
+}
+
+static int cpu_stopper_thread(void *data)
+{
+        struct cpu_stopper *stopper = data;
+        struct cpu_stop_work *work;
+        int ret;
+
+repeat:
+        set_current_state(TASK_INTERRUPTIBLE);  /* mb paired w/ kthread_stop */
+
+        if (kthread_should_stop()) {
+                __set_current_state(TASK_RUNNING);
+                return 0;
+        }
+
+        work = NULL;
+        spin_lock_irq(&stopper->lock);
+        if (!list_empty(&stopper->works)) {
+                work = list_first_entry(&stopper->works,
+                                        struct cpu_stop_work, list);
+                list_del_init(&work->list);
+        }
+        spin_unlock_irq(&stopper->lock);
+
+        if (work) {
+                cpu_stop_fn_t fn = work->fn;
+                void *arg = work->arg;
+                struct cpu_stop_done *done = work->done;
+                char ksym_buf[KSYM_NAME_LEN];
+
+                __set_current_state(TASK_RUNNING);
+
+                /* cpu stop callbacks are not allowed to sleep */
+                preempt_disable();
+
+                ret = fn(arg);
+                if (ret)
+                        done->ret = ret;
+
+                /* restore preemption and check it's still balanced */
+                preempt_enable();
+                WARN_ONCE(preempt_count(),
+                          "cpu_stop: %s(%p) leaked preempt count\n",
+                          kallsyms_lookup((unsigned long)fn, NULL, NULL, NULL,
+                                          ksym_buf), arg);
+
+                cpu_stop_signal_done(done, true);
+        } else
+                schedule();
+
+        goto repeat;
+}
+
+/* manage stopper for a cpu, mostly lifted from sched migration thread mgmt */
+static int __cpuinit cpu_stop_cpu_callback(struct notifier_block *nfb,
+                                           unsigned long action, void *hcpu)
+{
+        struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
+        unsigned int cpu = (unsigned long)hcpu;
+        struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu);
+        struct task_struct *p;
+
+        switch (action & ~CPU_TASKS_FROZEN) {
+        case CPU_UP_PREPARE:
+                BUG_ON(stopper->thread || stopper->enabled ||
+                       !list_empty(&stopper->works));
+                p = kthread_create(cpu_stopper_thread, stopper, "migration/%d",
+                                   cpu);
+                if (IS_ERR(p))
+                        return NOTIFY_BAD;
+                sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
+                get_task_struct(p);
+                stopper->thread = p;
+                break;
+
+        case CPU_ONLINE:
+                kthread_bind(stopper->thread, cpu);
+                /* strictly unnecessary, as first user will wake it */
+                wake_up_process(stopper->thread);
+                /* mark enabled */
+                spin_lock_irq(&stopper->lock);
+                stopper->enabled = true;
+                spin_unlock_irq(&stopper->lock);
+                break;
+
+#ifdef CONFIG_HOTPLUG_CPU
+        case CPU_UP_CANCELED:
+        case CPU_DEAD:
+        {
+                struct cpu_stop_work *work;
+
+                /* kill the stopper */
+                kthread_stop(stopper->thread);
+                /* drain remaining works */
+                spin_lock_irq(&stopper->lock);
+                list_for_each_entry(work, &stopper->works, list)
+                        cpu_stop_signal_done(work->done, false);
+                stopper->enabled = false;
+                spin_unlock_irq(&stopper->lock);
+                /* release the stopper */
+                put_task_struct(stopper->thread);
+                stopper->thread = NULL;
+                break;
+        }
+#endif
+        }
+
+        return NOTIFY_OK;
+}
+
+/*
+ * Give it a higher priority so that cpu stopper is available to other
+ * cpu notifiers.  It currently shares the same priority as sched
+ * migration_notifier.
+ */
+static struct notifier_block __cpuinitdata cpu_stop_cpu_notifier = {
+        .notifier_call  = cpu_stop_cpu_callback,
+        .priority       = 10,
+};
+
+static int __init cpu_stop_init(void)
+{
+        void *bcpu = (void *)(long)smp_processor_id();
+        unsigned int cpu;
+        int err;
+
+        for_each_possible_cpu(cpu) {
+                struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu);
+
+                spin_lock_init(&stopper->lock);
+                INIT_LIST_HEAD(&stopper->works);
+        }
+
+        /* start one for the boot cpu */
+        err = cpu_stop_cpu_callback(&cpu_stop_cpu_notifier, CPU_UP_PREPARE,
+                                    bcpu);
+        BUG_ON(err == NOTIFY_BAD);
+        cpu_stop_cpu_callback(&cpu_stop_cpu_notifier, CPU_ONLINE, bcpu);
+        register_cpu_notifier(&cpu_stop_cpu_notifier);
+
+        return 0;
+}
+early_initcall(cpu_stop_init);
+
+#ifdef CONFIG_STOP_MACHINE
 
 /* This controls the threads on each CPU. */
 enum stopmachine_state {
@@ -26,174 +393,94 @@ enum stopmachine_state {
         /* Exit */
         STOPMACHINE_EXIT,
 };
-static enum stopmachine_state state;
 
 struct stop_machine_data {
-        int (*fn)(void *);
-        void *data;
-        int fnret;
+        int                     (*fn)(void *);
+        void                    *data;
+        /* Like num_online_cpus(), but hotplug cpu uses us, so we need this. */
+        unsigned int            num_threads;
+        const struct cpumask    *active_cpus;
+
+        enum stopmachine_state  state;
+        atomic_t                thread_ack;
 };
 
-/* Like num_online_cpus(), but hotplug cpu uses us, so we need this. */
-static unsigned int num_threads;
-static atomic_t thread_ack;
-static DEFINE_MUTEX(lock);
-/* setup_lock protects refcount, stop_machine_wq and stop_machine_work. */
-static DEFINE_MUTEX(setup_lock);
-/* Users of stop_machine. */
-static int refcount;
-static struct workqueue_struct *stop_machine_wq;
-static struct stop_machine_data active, idle;
-static const struct cpumask *active_cpus;
-static void *stop_machine_work;
-
-static void set_state(enum stopmachine_state newstate)
+static void set_state(struct stop_machine_data *smdata,
+                      enum stopmachine_state newstate)
 {
         /* Reset ack counter. */
-        atomic_set(&thread_ack, num_threads);
+        atomic_set(&smdata->thread_ack, smdata->num_threads);
         smp_wmb();
-        state = newstate;
+        smdata->state = newstate;
 }
 
 /* Last one to ack a state moves to the next state. */
-static void ack_state(void)
+static void ack_state(struct stop_machine_data *smdata)
 {
-        if (atomic_dec_and_test(&thread_ack))
-                set_state(state + 1);
+        if (atomic_dec_and_test(&smdata->thread_ack))
+                set_state(smdata, smdata->state + 1);
 }
 
-/* This is the actual function which stops the CPU. It runs
- * in the context of a dedicated stopmachine workqueue. */
-static void stop_cpu(struct work_struct *unused)
+/* This is the cpu_stop function which stops the CPU. */
+static int stop_machine_cpu_stop(void *data)
 {
+        struct stop_machine_data *smdata = data;
         enum stopmachine_state curstate = STOPMACHINE_NONE;
-        struct stop_machine_data *smdata = &idle;
-        int cpu = smp_processor_id();
-        int err;
+        int cpu = smp_processor_id(), err = 0;
+        bool is_active;
+
+        if (!smdata->active_cpus)
+                is_active = cpu == cpumask_first(cpu_online_mask);
+        else
+                is_active = cpumask_test_cpu(cpu, smdata->active_cpus);
 
-        if (!active_cpus) {
-                if (cpu == cpumask_first(cpu_online_mask))
-                        smdata = &active;
-        } else {
-                if (cpumask_test_cpu(cpu, active_cpus))
-                        smdata = &active;
-        }
         /* Simple state machine */
         do {
                 /* Chill out and ensure we re-read stopmachine_state. */
                 cpu_relax();
-                if (state != curstate) {
-                        curstate = state;
+                if (smdata->state != curstate) {
+                        curstate = smdata->state;
                         switch (curstate) {
                         case STOPMACHINE_DISABLE_IRQ:
                                 local_irq_disable();
                                 hard_irq_disable();
                                 break;
                         case STOPMACHINE_RUN:
-                                /* On multiple CPUs only a single error code
-                                 * is needed to tell that something failed. */
-                                err = smdata->fn(smdata->data);
-                                if (err)
-                                        smdata->fnret = err;
+                                if (is_active)
+                                        err = smdata->fn(smdata->data);
                                 break;
                         default:
                                 break;
                         }
-                        ack_state();
+                        ack_state(smdata);
                 }
         } while (curstate != STOPMACHINE_EXIT);
 
         local_irq_enable();
+        return err;
 }
 
-/* Callback for CPUs which aren't supposed to do anything. */
-static int chill(void *unused)
-{
-        return 0;
-}
-
-int stop_machine_create(void)
-{
-        mutex_lock(&setup_lock);
-        if (refcount)
-                goto done;
-        stop_machine_wq = create_rt_workqueue("kstop");
-        if (!stop_machine_wq)
-                goto err_out;
-        stop_machine_work = alloc_percpu(struct work_struct);
-        if (!stop_machine_work)
-                goto err_out;
-done:
-        refcount++;
-        mutex_unlock(&setup_lock);
-        return 0;
-
-err_out:
-        if (stop_machine_wq)
-                destroy_workqueue(stop_machine_wq);
-        mutex_unlock(&setup_lock);
-        return -ENOMEM;
-}
-EXPORT_SYMBOL_GPL(stop_machine_create);
-
-void stop_machine_destroy(void)
-{
-        mutex_lock(&setup_lock);
-        refcount--;
-        if (refcount)
-                goto done;
-        destroy_workqueue(stop_machine_wq);
-        free_percpu(stop_machine_work);
-done:
-        mutex_unlock(&setup_lock);
-}
-EXPORT_SYMBOL_GPL(stop_machine_destroy);
-
 int __stop_machine(int (*fn)(void *), void *data, const struct cpumask *cpus)
 {
-        struct work_struct *sm_work;
-        int i, ret;
-
-        /* Set up initial state. */
-        mutex_lock(&lock);
-        num_threads = num_online_cpus();
-        active_cpus = cpus;
-        active.fn = fn;
-        active.data = data;
-        active.fnret = 0;
-        idle.fn = chill;
-        idle.data = NULL;
-
-        set_state(STOPMACHINE_PREPARE);
-
-        /* Schedule the stop_cpu work on all cpus: hold this CPU so one
-         * doesn't hit this CPU until we're ready. */
-        get_cpu();
-        for_each_online_cpu(i) {
-                sm_work = per_cpu_ptr(stop_machine_work, i);
-                INIT_WORK(sm_work, stop_cpu);
-                queue_work_on(i, stop_machine_wq, sm_work);
-        }
-        /* This will release the thread on our CPU. */
-        put_cpu();
-        flush_workqueue(stop_machine_wq);
-        ret = active.fnret;
-        mutex_unlock(&lock);
-        return ret;
+        struct stop_machine_data smdata = { .fn = fn, .data = data,
+                                            .num_threads = num_online_cpus(),
+                                            .active_cpus = cpus };
+
+        /* Set the initial state and stop all online cpus. */
+        set_state(&smdata, STOPMACHINE_PREPARE);
+        return stop_cpus(cpu_online_mask, stop_machine_cpu_stop, &smdata);
 }
 
 int stop_machine(int (*fn)(void *), void *data, const struct cpumask *cpus)
 {
         int ret;
 
-        ret = stop_machine_create();
-        if (ret)
-                return ret;
         /* No CPUs can come up or down during this. */
         get_online_cpus();
         ret = __stop_machine(fn, data, cpus);
         put_online_cpus();
-        stop_machine_destroy();
         return ret;
 }
 EXPORT_SYMBOL_GPL(stop_machine);
+
+#endif  /* CONFIG_STOP_MACHINE */
diff --git a/kernel/sys.c b/kernel/sys.c
index 877fe4f8e05e..7cb426a58965 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -33,8 +33,10 @@
 #include <linux/task_io_accounting_ops.h>
 #include <linux/seccomp.h>
 #include <linux/cpu.h>
+#include <linux/personality.h>
 #include <linux/ptrace.h>
 #include <linux/fs_struct.h>
+#include <linux/gfp.h>
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -571,8 +573,7 @@ static int set_user(struct cred *new)
         if (!new_user)
                 return -EAGAIN;
 
-        if (atomic_read(&new_user->processes) >=
-                                current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
+        if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
                         new_user != INIT_USER) {
                 free_uid(new_user);
                 return -EAGAIN;
@@ -1115,6 +1116,15 @@ out:
 
 DECLARE_RWSEM(uts_sem);
 
+#ifdef COMPAT_UTS_MACHINE
+#define override_architecture(name) \
+        (personality(current->personality) == PER_LINUX32 && \
+         copy_to_user(name->machine, COMPAT_UTS_MACHINE, \
+                      sizeof(COMPAT_UTS_MACHINE)))
+#else
+#define override_architecture(name)     0
+#endif
+
 SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
 {
         int errno = 0;
@@ -1123,9 +1133,66 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
         if (copy_to_user(name, utsname(), sizeof *name))
                 errno = -EFAULT;
         up_read(&uts_sem);
+
+        if (!errno && override_architecture(name))
+                errno = -EFAULT;
         return errno;
 }
 
+#ifdef __ARCH_WANT_SYS_OLD_UNAME
+/*
+ * Old cruft
+ */
+SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
+{
+        int error = 0;
+
+        if (!name)
+                return -EFAULT;
+
+        down_read(&uts_sem);
+        if (copy_to_user(name, utsname(), sizeof(*name)))
+                error = -EFAULT;
+        up_read(&uts_sem);
+
+        if (!error && override_architecture(name))
+                error = -EFAULT;
+        return error;
+}
+
+SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+{
+        int error;
+
+        if (!name)
+                return -EFAULT;
+        if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname)))
+                return -EFAULT;
+
+        down_read(&uts_sem);
+        error = __copy_to_user(&name->sysname, &utsname()->sysname,
+                               __OLD_UTS_LEN);
+        error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
+        error |= __copy_to_user(&name->nodename, &utsname()->nodename,
+                                __OLD_UTS_LEN);
+        error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
+        error |= __copy_to_user(&name->release, &utsname()->release,
+                                __OLD_UTS_LEN);
+        error |= __put_user(0, name->release + __OLD_UTS_LEN);
+        error |= __copy_to_user(&name->version, &utsname()->version,
+                                __OLD_UTS_LEN);
+        error |= __put_user(0, name->version + __OLD_UTS_LEN);
+        error |= __copy_to_user(&name->machine, &utsname()->machine,
+                                __OLD_UTS_LEN);
+        error |= __put_user(0, name->machine + __OLD_UTS_LEN);
+        up_read(&uts_sem);
+
+        if (!error && override_architecture(name))
+                error = -EFAULT;
+        return error ? -EFAULT : 0;
+}
+#endif
+
 SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
 {
         int errno;
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 695384f12a7d..70f2ea758ffe 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -126,6 +126,7 @@ cond_syscall(sys_setreuid16);
 cond_syscall(sys_setuid16);
 cond_syscall(sys_vm86old);
 cond_syscall(sys_vm86);
+cond_syscall(sys_ipc);
 cond_syscall(compat_sys_ipc);
 cond_syscall(compat_sys_sysctl);
 cond_syscall(sys_flock);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8a68b2448468..8686b0f5fc12 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -23,6 +23,7 @@
 #include <linux/swap.h>
 #include <linux/slab.h>
 #include <linux/sysctl.h>
+#include <linux/signal.h>
 #include <linux/proc_fs.h>
 #include <linux/security.h>
 #include <linux/ctype.h>
@@ -50,6 +51,7 @@
 #include <linux/ftrace.h>
 #include <linux/slow-work.h>
 #include <linux/perf_event.h>
+#include <linux/kprobes.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>
@@ -59,13 +61,23 @@
 #include <asm/stacktrace.h>
 #include <asm/io.h>
 #endif
+#ifdef CONFIG_BSD_PROCESS_ACCT
+#include <linux/acct.h>
+#endif
+#ifdef CONFIG_RT_MUTEXES
+#include <linux/rtmutex.h>
+#endif
+#if defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_LOCK_STAT)
+#include <linux/lockdep.h>
+#endif
+#ifdef CONFIG_CHR_DEV_SG
+#include <scsi/sg.h>
+#endif
 
 
 #if defined(CONFIG_SYSCTL)
 
 /* External variables not in a header file. */
-extern int C_A_D;
-extern int print_fatal_signals;
 extern int sysctl_overcommit_memory;
 extern int sysctl_overcommit_ratio;
 extern int sysctl_panic_on_oom;
@@ -87,9 +99,6 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
 #ifndef CONFIG_MMU
 extern int sysctl_nr_trim_pages;
 #endif
-#ifdef CONFIG_RCU_TORTURE_TEST
-extern int rcutorture_runnable;
-#endif /* #ifdef CONFIG_RCU_TORTURE_TEST */
 #ifdef CONFIG_BLOCK
 extern int blk_iopoll_enabled;
 #endif
@@ -119,14 +128,6 @@ static int min_percpu_pagelist_fract = 8;
 
 static int ngroups_max = NGROUPS_MAX;
 
-#ifdef CONFIG_MODULES
-extern char modprobe_path[];
-extern int modules_disabled;
-#endif
-#ifdef CONFIG_CHR_DEV_SG
-extern int sg_big_buff;
-#endif
-
 #ifdef CONFIG_SPARC
 #include <asm/system.h>
 #endif
@@ -148,10 +149,6 @@ extern int sysctl_userprocess_debug;
 extern int spin_retry;
 #endif
 
-#ifdef CONFIG_BSD_PROCESS_ACCT
-extern int acct_parm[];
-#endif
-
 #ifdef CONFIG_IA64
 extern int no_unaligned_warning;
 extern int unaligned_dump_stack;
@@ -159,10 +156,6 @@ extern int unaligned_dump_stack;
 
 extern struct ratelimit_state printk_ratelimit_state;
 
-#ifdef CONFIG_RT_MUTEXES
-extern int max_lock_depth;
-#endif
-
 #ifdef CONFIG_PROC_SYSCTL
 static int proc_do_cad_pid(struct ctl_table *table, int write,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
@@ -201,9 +194,6 @@ extern struct ctl_table epoll_table[];
 int sysctl_legacy_va_layout;
 #endif
 
-extern int prove_locking;
-extern int lock_stat;
-
 /* The default sysctl tables: */
 
 static struct ctl_table root_table[] = {
@@ -1441,7 +1431,7 @@ static struct ctl_table fs_table[] = {
 };
 
 static struct ctl_table debug_table[] = {
-#if defined(CONFIG_X86) || defined(CONFIG_PPC)
+#if defined(CONFIG_X86) || defined(CONFIG_PPC) || defined(CONFIG_SPARC)
         {
                 .procname       = "exception-trace",
                 .data           = &show_unhandled_signals,
@@ -1450,6 +1440,17 @@ static struct ctl_table debug_table[] = {
                 .proc_handler   = proc_dointvec
         },
 #endif
+#if defined(CONFIG_OPTPROBES)
+        {
+                .procname       = "kprobes-optimization",
+                .data           = &sysctl_kprobes_optimization,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_kprobes_optimization_handler,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+#endif
         { }
 };
 
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 8f5d16e0707a..59030570f5ca 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -13,6 +13,7 @@
 #include <linux/file.h>
 #include <linux/ctype.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 
 #ifdef CONFIG_SYSCTL_SYSCALL
 
@@ -1331,7 +1332,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
         ssize_t result;
         char *pathname;
         int flags;
-        int acc_mode, fmode;
+        int acc_mode;
 
         pathname = sysctl_getname(name, nlen, &table);
         result = PTR_ERR(pathname);
@@ -1342,15 +1343,12 @@ static ssize_t binary_sysctl(const int *name, int nlen,
         if (oldval && oldlen && newval && newlen) {
                 flags = O_RDWR;
                 acc_mode = MAY_READ | MAY_WRITE;
-                fmode = FMODE_READ | FMODE_WRITE;
         } else if (newval && newlen) {
                 flags = O_WRONLY;
                 acc_mode = MAY_WRITE;
-                fmode = FMODE_WRITE;
         } else if (oldval && oldlen) {
                 flags = O_RDONLY;
                 acc_mode = MAY_READ;
-                fmode = FMODE_READ;
         } else {
                 result = 0;
                 goto out_putname;
@@ -1361,7 +1359,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
         if (result)
                 goto out_putname;
 
-        result = may_open(&nd.path, acc_mode, fmode);
+        result = may_open(&nd.path, acc_mode, flags);
         if (result)
                 goto out_putpath;
 
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index ea8384d3caa7..11281d5792bd 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -22,6 +22,7 @@
 #include <linux/delayacct.h>
 #include <linux/cpumask.h>
 #include <linux/percpu.h>
+#include <linux/slab.h>
 #include <linux/cgroupstats.h>
 #include <linux/cgroup.h>
 #include <linux/fs.h>
@@ -46,15 +47,13 @@ static struct genl_family family = {
         .maxattr        = TASKSTATS_CMD_ATTR_MAX,
 };
 
-static struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1]
-__read_mostly = {
+static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = {
         [TASKSTATS_CMD_ATTR_PID]  = { .type = NLA_U32 },
         [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_U32 },
         [TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING },
         [TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },};
 
-static struct nla_policy
-cgroupstats_cmd_get_policy[CGROUPSTATS_CMD_ATTR_MAX+1] __read_mostly = {
+static const struct nla_policy cgroupstats_cmd_get_policy[CGROUPSTATS_CMD_ATTR_MAX+1] = {
         [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 },
 };
 
diff --git a/kernel/time.c b/kernel/time.c
index 804798005d19..656dccfe1cbb 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -35,7 +35,6 @@
 #include <linux/syscalls.h>
 #include <linux/security.h>
 #include <linux/fs.h>
-#include <linux/slab.h>
 #include <linux/math64.h>
 #include <linux/ptrace.h>
 
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 1f663d23e85e..1f5dde637457 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -592,6 +592,10 @@ static inline void clocksource_select(void) { }
  */
 static int __init clocksource_done_booting(void)
 {
+        mutex_lock(&clocksource_mutex);
+        curr_clocksource = clocksource_default_clock();
+        mutex_unlock(&clocksource_mutex);
+
         finished_booting = 1;
 
         /*
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index 0a8a213016f0..aada0e52680a 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -22,6 +22,29 @@
 
 #include "tick-internal.h"
 
+/* Limit min_delta to a jiffie */
+#define MIN_DELTA_LIMIT         (NSEC_PER_SEC / HZ)
+
+static int tick_increase_min_delta(struct clock_event_device *dev)
+{
+        /* Nothing to do if we already reached the limit */
+        if (dev->min_delta_ns >= MIN_DELTA_LIMIT)
+                return -ETIME;
+
+        if (dev->min_delta_ns < 5000)
+                dev->min_delta_ns = 5000;
+        else
+                dev->min_delta_ns += dev->min_delta_ns >> 1;
+
+        if (dev->min_delta_ns > MIN_DELTA_LIMIT)
+                dev->min_delta_ns = MIN_DELTA_LIMIT;
+
+        printk(KERN_WARNING "CE: %s increased min_delta_ns to %llu nsec\n",
+               dev->name ? dev->name : "?",
+               (unsigned long long) dev->min_delta_ns);
+        return 0;
+}
+
 /**
  * tick_program_event internal worker function
  */
@@ -37,23 +60,28 @@ int tick_dev_program_event(struct clock_event_device *dev, ktime_t expires,
                 if (!ret || !force)
                         return ret;
 
+                dev->retries++;
                 /*
-                 * We tried 2 times to program the device with the given
-                 * min_delta_ns. If that's not working then we double it
+                 * We tried 3 times to program the device with the given
+                 * min_delta_ns. If that's not working then we increase it
                  * and emit a warning.
                  */
                 if (++i > 2) {
                         /* Increase the min. delta and try again */
-                        if (!dev->min_delta_ns)
-                                dev->min_delta_ns = 5000;
-                        else
-                                dev->min_delta_ns += dev->min_delta_ns >> 1;
-
-                        printk(KERN_WARNING
-                               "CE: %s increasing min_delta_ns to %llu nsec\n",
-                               dev->name ? dev->name : "?",
-                               (unsigned long long) dev->min_delta_ns << 1);
-
+                        if (tick_increase_min_delta(dev)) {
+                                /*
+                                 * Get out of the loop if min_delta_ns
+                                 * hit the limit already. That's
+                                 * better than staying here forever.
+                                 *
+                                 * We clear next_event so we have a
+                                 * chance that the box survives.
+                                 */
+                                printk(KERN_WARNING
+                                       "CE: Reprogramming failure. Giving up\n");
+                                dev->next_event.tv64 = KTIME_MAX;
+                                return -ETIME;
+                        }
                         i = 0;
                 }
 
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index f992762d7f51..1d7b9bc1c034 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -150,14 +150,32 @@ static void tick_nohz_update_jiffies(ktime_t now)
         touch_softlockup_watchdog();
 }
 
+/*
+ * Updates the per cpu time idle statistics counters
+ */
+static void
+update_ts_time_stats(struct tick_sched *ts, ktime_t now, u64 *last_update_time)
+{
+        ktime_t delta;
+
+        if (ts->idle_active) {
+                delta = ktime_sub(now, ts->idle_entrytime);
+                ts->idle_sleeptime = ktime_add(ts->idle_sleeptime, delta);
+                if (nr_iowait_cpu() > 0)
+                        ts->iowait_sleeptime = ktime_add(ts->iowait_sleeptime, delta);
+                ts->idle_entrytime = now;
+        }
+
+        if (last_update_time)
+                *last_update_time = ktime_to_us(now);
+
+}
+
 static void tick_nohz_stop_idle(int cpu, ktime_t now)
 {
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
-        ktime_t delta;
 
-        delta = ktime_sub(now, ts->idle_entrytime);
-        ts->idle_lastupdate = now;
-        ts->idle_sleeptime = ktime_add(ts->idle_sleeptime, delta);
+        update_ts_time_stats(ts, now, NULL);
         ts->idle_active = 0;
 
         sched_clock_idle_wakeup_event(0);
@@ -165,20 +183,32 @@ static void tick_nohz_stop_idle(int cpu, ktime_t now)
 
 static ktime_t tick_nohz_start_idle(struct tick_sched *ts)
 {
-        ktime_t now, delta;
+        ktime_t now;
 
         now = ktime_get();
-        if (ts->idle_active) {
-                delta = ktime_sub(now, ts->idle_entrytime);
-                ts->idle_lastupdate = now;
-                ts->idle_sleeptime = ktime_add(ts->idle_sleeptime, delta);
-        }
+
+        update_ts_time_stats(ts, now, NULL);
+
         ts->idle_entrytime = now;
         ts->idle_active = 1;
         sched_clock_idle_sleep_event();
         return now;
 }
 
+/**
+ * get_cpu_idle_time_us - get the total idle time of a cpu
+ * @cpu: CPU number to query
+ * @last_update_time: variable to store update time in
+ *
+ * Return the cummulative idle time (since boot) for a given
+ * CPU, in microseconds. The idle time returned includes
+ * the iowait time (unlike what "top" and co report).
+ *
+ * This time is measured via accounting rather than sampling,
+ * and is as accurate as ktime_get() is.
+ *
+ * This function returns -1 if NOHZ is not enabled.
+ */
 u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
 {
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
@@ -186,15 +216,38 @@ u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
         if (!tick_nohz_enabled)
                 return -1;
 
-        if (ts->idle_active)
-                *last_update_time = ktime_to_us(ts->idle_lastupdate);
-        else
-                *last_update_time = ktime_to_us(ktime_get());
+        update_ts_time_stats(ts, ktime_get(), last_update_time);
 
         return ktime_to_us(ts->idle_sleeptime);
 }
 EXPORT_SYMBOL_GPL(get_cpu_idle_time_us);
 
+/*
+ * get_cpu_iowait_time_us - get the total iowait time of a cpu
+ * @cpu: CPU number to query
+ * @last_update_time: variable to store update time in
+ *
+ * Return the cummulative iowait time (since boot) for a given
+ * CPU, in microseconds.
+ *
+ * This time is measured via accounting rather than sampling,
+ * and is as accurate as ktime_get() is.
+ *
+ * This function returns -1 if NOHZ is not enabled.
+ */
+u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time)
+{
+        struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+
+        if (!tick_nohz_enabled)
+                return -1;
+
+        update_ts_time_stats(ts, ktime_get(), last_update_time);
+
+        return ktime_to_us(ts->iowait_sleeptime);
+}
+EXPORT_SYMBOL_GPL(get_cpu_iowait_time_us);
+
 /**
  * tick_nohz_stop_sched_tick - stop the idle tick from the idle task
  *
@@ -262,6 +315,9 @@ void tick_nohz_stop_sched_tick(int inidle)
                 goto end;
         }
 
+        if (nohz_ratelimit(cpu))
+                goto end;
+
         ts->idle_calls++;
         /* Read jiffies and the time when jiffies were updated last */
         do {
diff --git a/kernel/time/timecompare.c b/kernel/time/timecompare.c
index 12f5c55090be..ac38fbb176cc 100644
--- a/kernel/time/timecompare.c
+++ b/kernel/time/timecompare.c
@@ -19,6 +19,7 @@
 
 #include <linux/timecompare.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/math64.h>
 
 /*
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 16736379a9ca..39f6177fafac 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -818,7 +818,8 @@ void update_wall_time(void)
         shift = min(shift, maxshift);
         while (offset >= timekeeper.cycle_interval) {
                 offset = logarithmic_accumulation(offset, shift);
-                shift--;
+                if(offset < timekeeper.cycle_interval<<shift)
+                        shift--;
         }
 
         /* correct the clock when NTP error is too big */
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index bdfb8dd1050c..ab8f5e33fa92 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -176,6 +176,7 @@ static void print_cpu(struct seq_file *m, int cpu, u64 now)
                 P_ns(idle_waketime);
                 P_ns(idle_exittime);
                 P_ns(idle_sleeptime);
+                P_ns(iowait_sleeptime);
                 P(last_jiffies);
                 P(next_jiffies);
                 P_ns(idle_expires);
@@ -228,6 +229,7 @@ print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu)
         SEQ_printf(m, " event_handler:  ");
         print_name_offset(m, dev->event_handler);
         SEQ_printf(m, "\n");
+        SEQ_printf(m, " retries:        %lu\n", dev->retries);
 }
 
 static void timer_list_show_tickdevices(struct seq_file *m)
@@ -257,7 +259,7 @@ static int timer_list_show(struct seq_file *m, void *v)
         u64 now = ktime_to_ns(ktime_get());
         int cpu;
 
-        SEQ_printf(m, "Timer List Version: v0.5\n");
+        SEQ_printf(m, "Timer List Version: v0.6\n");
         SEQ_printf(m, "HRTIMER_MAX_CLOCK_BASES: %d\n", HRTIMER_MAX_CLOCK_BASES);
         SEQ_printf(m, "now at %Ld nsecs\n", (unsigned long long)now);
 
diff --git a/kernel/timer.c b/kernel/timer.c
index c61a7949387f..aeb6a54f2771 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -39,6 +39,7 @@
 #include <linux/kallsyms.h>
 #include <linux/perf_event.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -880,6 +881,7 @@ int try_to_del_timer_sync(struct timer_list *timer)
         if (base->running_timer == timer)
                 goto out;
 
+        timer_stats_timer_clear_start_info(timer);
         ret = 0;
         if (timer_pending(timer)) {
                 detach_timer(timer, 1);
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 13e13d428cd3..8b1797c4545b 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -44,9 +44,6 @@ config HAVE_FTRACE_MCOUNT_RECORD
         help
           See Documentation/trace/ftrace-design.txt
 
-config HAVE_HW_BRANCH_TRACER
-        bool
-
 config HAVE_SYSCALL_TRACEPOINTS
         bool
         help
@@ -374,14 +371,6 @@ config STACK_TRACER
 
           Say N if unsure.
 
-config HW_BRANCH_TRACER
-        depends on HAVE_HW_BRANCH_TRACER
-        bool "Trace hw branches"
-        select GENERIC_TRACER
-        help
-          This tracer records all branches on the system in a circular
-          buffer, giving access to the last N branches for each cpu.
-
 config KMEMTRACE
         bool "Trace SLAB allocations"
         select GENERIC_TRACER
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index d00c6fe23f54..ffb1a5b0550e 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -41,7 +41,6 @@ obj-$(CONFIG_MMIOTRACE) += trace_mmiotrace.o
 obj-$(CONFIG_BOOT_TRACER) += trace_boot.o
 obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += trace_functions_graph.o
 obj-$(CONFIG_TRACE_BRANCH_PROFILING) += trace_branch.o
-obj-$(CONFIG_HW_BRANCH_TRACER) += trace_hw_branches.o
 obj-$(CONFIG_KMEMTRACE) += kmemtrace.o
 obj-$(CONFIG_WORKQUEUE_TRACER) += trace_workqueue.o
 obj-$(CONFIG_BLK_DEV_IO_TRACE) += blktrace.o
@@ -52,7 +51,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_events.o
 obj-$(CONFIG_EVENT_TRACING) += trace_export.o
 obj-$(CONFIG_FTRACE_SYSCALLS) += trace_syscalls.o
 ifeq ($(CONFIG_PERF_EVENTS),y)
-obj-$(CONFIG_EVENT_TRACING) += trace_event_profile.o
+obj-$(CONFIG_EVENT_TRACING) += trace_event_perf.o
 endif
 obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
 obj-$(CONFIG_KPROBE_EVENT) += trace_kprobe.o
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 07f945a99430..b3bc91a3f510 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -21,6 +21,7 @@
 #include <linux/percpu.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/debugfs.h>
 #include <linux/smp_lock.h>
 #include <linux/time.h>
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 83783579378f..32837e19e3bd 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -24,9 +24,11 @@
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
 #include <linux/sysctl.h>
+#include <linux/slab.h>
 #include <linux/ctype.h>
 #include <linux/list.h>
 #include <linux/hash.h>
+#include <linux/rcupdate.h>
 
 #include <trace/events/sched.h>
 
@@ -84,22 +86,22 @@ ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
 ftrace_func_t __ftrace_trace_function __read_mostly = ftrace_stub;
 ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
 
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-static int ftrace_set_func(unsigned long *array, int *idx, char *buffer);
-#endif
-
+/*
+ * Traverse the ftrace_list, invoking all entries.  The reason that we
+ * can use rcu_dereference_raw() is that elements removed from this list
+ * are simply leaked, so there is no need to interact with a grace-period
+ * mechanism.  The rcu_dereference_raw() calls are needed to handle
+ * concurrent insertions into the ftrace_list.
+ *
+ * Silly Alpha and silly pointer-speculation compiler optimizations!
+ */
 static void ftrace_list_func(unsigned long ip, unsigned long parent_ip)
 {
-        struct ftrace_ops *op = ftrace_list;
-
-        /* in case someone actually ports this to alpha! */
-        read_barrier_depends();
+        struct ftrace_ops *op = rcu_dereference_raw(ftrace_list); /*see above*/
 
         while (op != &ftrace_list_end) {
-                /* silly alpha */
-                read_barrier_depends();
                 op->func(ip, parent_ip);
-                op = op->next;
+                op = rcu_dereference_raw(op->next); /*see above*/
         };
 }
 
@@ -154,8 +156,7 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
          * the ops->next pointer is valid before another CPU sees
          * the ops pointer included into the ftrace_list.
          */
-        smp_wmb();
-        ftrace_list = ops;
+        rcu_assign_pointer(ftrace_list, ops);
 
         if (ftrace_enabled) {
                 ftrace_func_t func;
@@ -263,6 +264,7 @@ struct ftrace_profile {
         unsigned long                   counter;
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         unsigned long long              time;
+        unsigned long long              time_squared;
 #endif
 };
 
@@ -365,9 +367,9 @@ static int function_stat_headers(struct seq_file *m)
 {
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         seq_printf(m, "  Function                               "
-                   "Hit    Time            Avg\n"
+                   "Hit    Time            Avg             s^2\n"
                       "  --------                               "
-                   "---    ----            ---\n");
+                   "---    ----            ---             ---\n");
 #else
         seq_printf(m, "  Function                               Hit\n"
                       "  --------                               ---\n");
@@ -383,6 +385,7 @@ static int function_stat_show(struct seq_file *m, void *v)
         static DEFINE_MUTEX(mutex);
         static struct trace_seq s;
         unsigned long long avg;
+        unsigned long long stddev;
 #endif
 
         kallsyms_lookup(rec->ip, NULL, NULL, NULL, str);
@@ -393,11 +396,25 @@ static int function_stat_show(struct seq_file *m, void *v)
         avg = rec->time;
         do_div(avg, rec->counter);
 
+        /* Sample standard deviation (s^2) */
+        if (rec->counter <= 1)
+                stddev = 0;
+        else {
+                stddev = rec->time_squared - rec->counter * avg * avg;
+                /*
+                 * Divide only 1000 for ns^2 -> us^2 conversion.
+                 * trace_print_graph_duration will divide 1000 again.
+                 */
+                do_div(stddev, (rec->counter - 1) * 1000);
+        }
+
         mutex_lock(&mutex);
         trace_seq_init(&s);
         trace_print_graph_duration(rec->time, &s);
         trace_seq_puts(&s, "    ");
         trace_print_graph_duration(avg, &s);
+        trace_seq_puts(&s, "    ");
+        trace_print_graph_duration(stddev, &s);
         trace_print_seq(m, &s);
         mutex_unlock(&mutex);
 #endif
@@ -649,6 +666,10 @@ static void profile_graph_return(struct ftrace_graph_ret *trace)
         if (!stat->hash || !ftrace_profile_enabled)
                 goto out;
 
+        /* If the calltime was zero'd ignore it */
+        if (!trace->calltime)
+                goto out;
+
         calltime = trace->rettime - trace->calltime;
 
         if (!(trace_flags & TRACE_ITER_GRAPH_TIME)) {
@@ -667,8 +688,10 @@ static void profile_graph_return(struct ftrace_graph_ret *trace)
         }
 
         rec = ftrace_find_profiled_func(stat, trace->func);
-        if (rec)
+        if (rec) {
                 rec->time += calltime;
+                rec->time_squared += calltime * calltime;
+        }
 
  out:
         local_irq_restore(flags);
@@ -2276,6 +2299,8 @@ __setup("ftrace_filter=", set_ftrace_filter);
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata;
+static int ftrace_set_func(unsigned long *array, int *idx, char *buffer);
+
 static int __init set_graph_function(char *str)
 {
         strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE);
@@ -3209,8 +3234,7 @@ free:
 }
 
 static void
-ftrace_graph_probe_sched_switch(struct rq *__rq, struct task_struct *prev,
-                                struct task_struct *next)
+ftrace_graph_probe_sched_switch(struct task_struct *prev, struct task_struct *next)
 {
         unsigned long long timestamp;
         int index;
@@ -3336,11 +3360,11 @@ void unregister_ftrace_graph(void)
                 goto out;
 
         ftrace_graph_active--;
-        unregister_trace_sched_switch(ftrace_graph_probe_sched_switch);
         ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
         ftrace_graph_entry = ftrace_graph_entry_stub;
         ftrace_shutdown(FTRACE_STOP_FUNC_RET);
         unregister_pm_notifier(&ftrace_suspend_notifier);
+        unregister_trace_sched_switch(ftrace_graph_probe_sched_switch);
 
  out:
         mutex_unlock(&ftrace_lock);
@@ -3351,6 +3375,7 @@ void ftrace_graph_init_task(struct task_struct *t)
 {
         /* Make sure we do not use the parent ret_stack */
         t->ret_stack = NULL;
+        t->curr_ret_stack = -1;
 
         if (ftrace_graph_active) {
                 struct ftrace_ret_stack *ret_stack;
@@ -3360,7 +3385,6 @@ void ftrace_graph_init_task(struct task_struct *t)
                                 GFP_KERNEL);
                 if (!ret_stack)
                         return;
-                t->curr_ret_stack = -1;
                 atomic_set(&t->tracing_graph_pause, 0);
                 atomic_set(&t->trace_overrun, 0);
                 t->ftrace_timestamp = 0;
diff --git a/kernel/trace/power-traces.c b/kernel/trace/power-traces.c
index 9f4f565b01e6..a22582a06161 100644
--- a/kernel/trace/power-traces.c
+++ b/kernel/trace/power-traces.c
@@ -9,7 +9,6 @@
 #include <linux/workqueue.h>
 #include <linux/sched.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/power.h>
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 8c1b2d290718..7f6059c5aa94 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -14,12 +14,14 @@
 #include <linux/module.h>
 #include <linux/percpu.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/hash.h>
 #include <linux/list.h>
 #include <linux/cpu.h>
 #include <linux/fs.h>
 
+#include <asm/local.h>
 #include "trace.h"
 
 /*
@@ -206,6 +208,14 @@ EXPORT_SYMBOL_GPL(tracing_is_on);
 #define RB_MAX_SMALL_DATA       (RB_ALIGNMENT * RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
 #define RB_EVNT_MIN_SIZE        8U      /* two 32bit words */
 
+#if !defined(CONFIG_64BIT) || defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+# define RB_FORCE_8BYTE_ALIGNMENT       0
+# define RB_ARCH_ALIGNMENT              RB_ALIGNMENT
+#else
+# define RB_FORCE_8BYTE_ALIGNMENT       1
+# define RB_ARCH_ALIGNMENT              8U
+#endif
+
 /* define RINGBUF_TYPE_DATA for 'case RINGBUF_TYPE_DATA:' */
 #define RINGBUF_TYPE_DATA 0 ... RINGBUF_TYPE_DATA_TYPE_LEN_MAX
 
@@ -309,6 +319,11 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data);
 #define TS_MASK         ((1ULL << TS_SHIFT) - 1)
 #define TS_DELTA_TEST   (~TS_MASK)
 
+/* Flag when events were overwritten */
+#define RB_MISSED_EVENTS        (1 << 31)
+/* Missed count stored at end */
+#define RB_MISSED_STORED        (1 << 30)
+
 struct buffer_data_page {
         u64              time_stamp;    /* page time stamp */
         local_t          commit;        /* write committed index */
@@ -328,6 +343,7 @@ struct buffer_page {
         local_t          write;         /* index for next write */
         unsigned         read;          /* index for next read */
         local_t          entries;       /* entries on this page */
+        unsigned long    real_end;      /* real end of data */
         struct buffer_data_page *page;  /* Actual data page */
 };
 
@@ -407,6 +423,12 @@ int ring_buffer_print_page_header(struct trace_seq *s)
                                (unsigned int)sizeof(field.commit),
                                (unsigned int)is_signed_type(long));
 
+        ret = trace_seq_printf(s, "\tfield: int overwrite;\t"
+                               "offset:%u;\tsize:%u;\tsigned:%u;\n",
+                               (unsigned int)offsetof(typeof(field), commit),
+                               1,
+                               (unsigned int)is_signed_type(long));
+
         ret = trace_seq_printf(s, "\tfield: char data;\t"
                                "offset:%u;\tsize:%u;\tsigned:%u;\n",
                                (unsigned int)offsetof(typeof(field), data),
@@ -430,6 +452,8 @@ struct ring_buffer_per_cpu {
         struct buffer_page              *tail_page;     /* write to tail */
         struct buffer_page              *commit_page;   /* committed pages */
         struct buffer_page              *reader_page;
+        unsigned long                   lost_events;
+        unsigned long                   last_overrun;
         local_t                         commit_overrun;
         local_t                         overrun;
         local_t                         entries;
@@ -1200,18 +1224,19 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned nr_pages)
 
         for (i = 0; i < nr_pages; i++) {
                 if (RB_WARN_ON(cpu_buffer, list_empty(cpu_buffer->pages)))
-                        return;
+                        goto out;
                 p = cpu_buffer->pages->next;
                 bpage = list_entry(p, struct buffer_page, list);
                 list_del_init(&bpage->list);
                 free_buffer_page(bpage);
         }
         if (RB_WARN_ON(cpu_buffer, list_empty(cpu_buffer->pages)))
-                return;
+                goto out;
 
         rb_reset_cpu(cpu_buffer);
         rb_check_pages(cpu_buffer);
 
+out:
         spin_unlock_irq(&cpu_buffer->reader_lock);
 }
 
@@ -1228,7 +1253,7 @@ rb_insert_pages(struct ring_buffer_per_cpu *cpu_buffer,
 
         for (i = 0; i < nr_pages; i++) {
                 if (RB_WARN_ON(cpu_buffer, list_empty(pages)))
-                        return;
+                        goto out;
                 p = pages->next;
                 bpage = list_entry(p, struct buffer_page, list);
                 list_del_init(&bpage->list);
@@ -1237,6 +1262,7 @@ rb_insert_pages(struct ring_buffer_per_cpu *cpu_buffer,
         rb_reset_cpu(cpu_buffer);
         rb_check_pages(cpu_buffer);
 
+out:
         spin_unlock_irq(&cpu_buffer->reader_lock);
 }
 
@@ -1546,7 +1572,7 @@ rb_update_event(struct ring_buffer_event *event,
 
         case 0:
                 length -= RB_EVNT_HDR_SIZE;
-                if (length > RB_MAX_SMALL_DATA)
+                if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
                         event->array[0] = length;
                 else
                         event->type_len = DIV_ROUND_UP(length, RB_ALIGNMENT);
@@ -1721,11 +1747,11 @@ static unsigned rb_calculate_event_length(unsigned length)
         if (!length)
                 length = 1;
 
-        if (length > RB_MAX_SMALL_DATA)
+        if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
                 length += sizeof(event.array[0]);
 
         length += RB_EVNT_HDR_SIZE;
-        length = ALIGN(length, RB_ALIGNMENT);
+        length = ALIGN(length, RB_ARCH_ALIGNMENT);
 
         return length;
 }
@@ -1750,6 +1776,13 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
         kmemcheck_annotate_bitfield(event, bitfield);
 
         /*
+         * Save the original length to the meta data.
+         * This will be used by the reader to add lost event
+         * counter.
+         */
+        tail_page->real_end = tail;
+
+        /*
          * If this event is bigger than the minimum size, then
          * we need to be careful that we don't subtract the
          * write counter enough to allow another writer to slip
@@ -1967,17 +2000,13 @@ rb_add_time_stamp(struct ring_buffer_per_cpu *cpu_buffer,
                   u64 *ts, u64 *delta)
 {
         struct ring_buffer_event *event;
-        static int once;
         int ret;
 
-        if (unlikely(*delta > (1ULL << 59) && !once++)) {
-                printk(KERN_WARNING "Delta way too big! %llu"
-                       " ts=%llu write stamp = %llu\n",
-                       (unsigned long long)*delta,
-                       (unsigned long long)*ts,
-                       (unsigned long long)cpu_buffer->write_stamp);
-                WARN_ON(1);
-        }
+        WARN_ONCE(*delta > (1ULL << 59),
+                  KERN_WARNING "Delta way too big! %llu ts=%llu write stamp = %llu\n",
+                  (unsigned long long)*delta,
+                  (unsigned long long)*ts,
+                  (unsigned long long)cpu_buffer->write_stamp);
 
         /*
          * The delta is too big, we to add a
@@ -2232,12 +2261,12 @@ ring_buffer_lock_reserve(struct ring_buffer *buffer, unsigned long length)
         if (ring_buffer_flags != RB_BUFFERS_ON)
                 return NULL;
 
-        if (atomic_read(&buffer->record_disabled))
-                return NULL;
-
         /* If we are tracing schedule, we don't want to recurse */
         resched = ftrace_preempt_disable();
 
+        if (atomic_read(&buffer->record_disabled))
+                goto out_nocheck;
+
         if (trace_recursive_lock())
                 goto out_nocheck;
 
@@ -2469,11 +2498,11 @@ int ring_buffer_write(struct ring_buffer *buffer,
         if (ring_buffer_flags != RB_BUFFERS_ON)
                 return -EBUSY;
 
-        if (atomic_read(&buffer->record_disabled))
-                return -EBUSY;
-
         resched = ftrace_preempt_disable();
 
+        if (atomic_read(&buffer->record_disabled))
+                goto out;
+
         cpu = raw_smp_processor_id();
 
         if (!cpumask_test_cpu(cpu, buffer->cpumask))
@@ -2541,7 +2570,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_record_disable);
  * @buffer: The ring buffer to enable writes
  *
  * Note, multiple disables will need the same number of enables
- * to truely enable the writing (much like preempt_disable).
+ * to truly enable the writing (much like preempt_disable).
  */
 void ring_buffer_record_enable(struct ring_buffer *buffer)
 {
@@ -2577,7 +2606,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_record_disable_cpu);
  * @cpu: The CPU to enable.
  *
  * Note, multiple disables will need the same number of enables
- * to truely enable the writing (much like preempt_disable).
+ * to truly enable the writing (much like preempt_disable).
  */
 void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu)
 {
@@ -2826,6 +2855,7 @@ static struct buffer_page *
 rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
 {
         struct buffer_page *reader = NULL;
+        unsigned long overwrite;
         unsigned long flags;
         int nr_loops = 0;
         int ret;
@@ -2867,6 +2897,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
         local_set(&cpu_buffer->reader_page->write, 0);
         local_set(&cpu_buffer->reader_page->entries, 0);
         local_set(&cpu_buffer->reader_page->page->commit, 0);
+        cpu_buffer->reader_page->real_end = 0;
 
  spin:
         /*
@@ -2887,6 +2918,18 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
         rb_set_list_to_head(cpu_buffer, &cpu_buffer->reader_page->list);
 
         /*
+         * We want to make sure we read the overruns after we set up our
+         * pointers to the next object. The writer side does a
+         * cmpxchg to cross pages which acts as the mb on the writer
+         * side. Note, the reader will constantly fail the swap
+         * while the writer is updating the pointers, so this
+         * guarantees that the overwrite recorded here is the one we
+         * want to compare with the last_overrun.
+         */
+        smp_mb();
+        overwrite = local_read(&(cpu_buffer->overrun));
+
+        /*
          * Here's the tricky part.
          *
          * We need to move the pointer past the header page.
@@ -2917,6 +2960,11 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
         cpu_buffer->reader_page = reader;
         rb_reset_reader_page(cpu_buffer);
 
+        if (overwrite != cpu_buffer->last_overrun) {
+                cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun;
+                cpu_buffer->last_overrun = overwrite;
+        }
+
         goto again;
 
  out:
@@ -2993,8 +3041,14 @@ static void rb_advance_iter(struct ring_buffer_iter *iter)
                 rb_advance_iter(iter);
 }
 
+static int rb_lost_events(struct ring_buffer_per_cpu *cpu_buffer)
+{
+        return cpu_buffer->lost_events;
+}
+
 static struct ring_buffer_event *
-rb_buffer_peek(struct ring_buffer_per_cpu *cpu_buffer, u64 *ts)
+rb_buffer_peek(struct ring_buffer_per_cpu *cpu_buffer, u64 *ts,
+               unsigned long *lost_events)
 {
         struct ring_buffer_event *event;
         struct buffer_page *reader;
@@ -3046,6 +3100,8 @@ rb_buffer_peek(struct ring_buffer_per_cpu *cpu_buffer, u64 *ts)
                         ring_buffer_normalize_time_stamp(cpu_buffer->buffer,
                                                          cpu_buffer->cpu, ts);
                 }
+                if (lost_events)
+                        *lost_events = rb_lost_events(cpu_buffer);
                 return event;
 
         default:
@@ -3156,12 +3212,14 @@ static inline int rb_ok_to_lock(void)
  * @buffer: The ring buffer to read
  * @cpu: The cpu to peak at
  * @ts: The timestamp counter of this event.
+ * @lost_events: a variable to store if events were lost (may be NULL)
  *
  * This will return the event that will be read next, but does
  * not consume the data.
  */
 struct ring_buffer_event *
-ring_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
+ring_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts,
+                 unsigned long *lost_events)
 {
         struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
         struct ring_buffer_event *event;
@@ -3176,7 +3234,7 @@ ring_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
         local_irq_save(flags);
         if (dolock)
                 spin_lock(&cpu_buffer->reader_lock);
-        event = rb_buffer_peek(cpu_buffer, ts);
+        event = rb_buffer_peek(cpu_buffer, ts, lost_events);
         if (event && event->type_len == RINGBUF_TYPE_PADDING)
                 rb_advance_reader(cpu_buffer);
         if (dolock)
@@ -3218,13 +3276,17 @@ ring_buffer_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
 /**
  * ring_buffer_consume - return an event and consume it
  * @buffer: The ring buffer to get the next event from
+ * @cpu: the cpu to read the buffer from
+ * @ts: a variable to store the timestamp (may be NULL)
+ * @lost_events: a variable to store if events were lost (may be NULL)
  *
  * Returns the next event in the ring buffer, and that event is consumed.
  * Meaning, that sequential reads will keep returning a different event,
  * and eventually empty the ring buffer if the producer is slower.
  */
 struct ring_buffer_event *
-ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts)
+ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts,
+                    unsigned long *lost_events)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_event *event = NULL;
@@ -3245,9 +3307,11 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts)
         if (dolock)
                 spin_lock(&cpu_buffer->reader_lock);
 
-        event = rb_buffer_peek(cpu_buffer, ts);
-        if (event)
+        event = rb_buffer_peek(cpu_buffer, ts, lost_events);
+        if (event) {
+                cpu_buffer->lost_events = 0;
                 rb_advance_reader(cpu_buffer);
+        }
 
         if (dolock)
                 spin_unlock(&cpu_buffer->reader_lock);
@@ -3264,23 +3328,30 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts)
 EXPORT_SYMBOL_GPL(ring_buffer_consume);
 
 /**
- * ring_buffer_read_start - start a non consuming read of the buffer
+ * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
  * @buffer: The ring buffer to read from
  * @cpu: The cpu buffer to iterate over
  *
- * This starts up an iteration through the buffer. It also disables
- * the recording to the buffer until the reading is finished.
- * This prevents the reading from being corrupted. This is not
- * a consuming read, so a producer is not expected.
+ * This performs the initial preparations necessary to iterate
+ * through the buffer.  Memory is allocated, buffer recording
+ * is disabled, and the iterator pointer is returned to the caller.
  *
- * Must be paired with ring_buffer_finish.
+ * Disabling buffer recordng prevents the reading from being
+ * corrupted. This is not a consuming read, so a producer is not
+ * expected.
+ *
+ * After a sequence of ring_buffer_read_prepare calls, the user is
+ * expected to make at least one call to ring_buffer_prepare_sync.
+ * Afterwards, ring_buffer_read_start is invoked to get things going
+ * for real.
+ *
+ * This overall must be paired with ring_buffer_finish.
  */
 struct ring_buffer_iter *
-ring_buffer_read_start(struct ring_buffer *buffer, int cpu)
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_iter *iter;
-        unsigned long flags;
 
         if (!cpumask_test_cpu(cpu, buffer->cpumask))
                 return NULL;
@@ -3294,15 +3365,52 @@ ring_buffer_read_start(struct ring_buffer *buffer, int cpu)
         iter->cpu_buffer = cpu_buffer;
 
         atomic_inc(&cpu_buffer->record_disabled);
+
+        return iter;
+}
+EXPORT_SYMBOL_GPL(ring_buffer_read_prepare);
+
+/**
+ * ring_buffer_read_prepare_sync - Synchronize a set of prepare calls
+ *
+ * All previously invoked ring_buffer_read_prepare calls to prepare
+ * iterators will be synchronized.  Afterwards, read_buffer_read_start
+ * calls on those iterators are allowed.
+ */
+void
+ring_buffer_read_prepare_sync(void)
+{
         synchronize_sched();
+}
+EXPORT_SYMBOL_GPL(ring_buffer_read_prepare_sync);
+
+/**
+ * ring_buffer_read_start - start a non consuming read of the buffer
+ * @iter: The iterator returned by ring_buffer_read_prepare
+ *
+ * This finalizes the startup of an iteration through the buffer.
+ * The iterator comes from a call to ring_buffer_read_prepare and
+ * an intervening ring_buffer_read_prepare_sync must have been
+ * performed.
+ *
+ * Must be paired with ring_buffer_finish.
+ */
+void
+ring_buffer_read_start(struct ring_buffer_iter *iter)
+{
+        struct ring_buffer_per_cpu *cpu_buffer;
+        unsigned long flags;
+
+        if (!iter)
+                return;
+
+        cpu_buffer = iter->cpu_buffer;
 
         spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
         arch_spin_lock(&cpu_buffer->lock);
         rb_iter_reset(iter);
         arch_spin_unlock(&cpu_buffer->lock);
         spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
-
-        return iter;
 }
 EXPORT_SYMBOL_GPL(ring_buffer_read_start);
 
@@ -3396,6 +3504,9 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
         cpu_buffer->write_stamp = 0;
         cpu_buffer->read_stamp = 0;
 
+        cpu_buffer->lost_events = 0;
+        cpu_buffer->last_overrun = 0;
+
         rb_head_page_activate(cpu_buffer);
 }
 
@@ -3671,6 +3782,7 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
         struct ring_buffer_event *event;
         struct buffer_data_page *bpage;
         struct buffer_page *reader;
+        unsigned long missed_events;
         unsigned long flags;
         unsigned int commit;
         unsigned int read;
@@ -3707,6 +3819,9 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
         read = reader->read;
         commit = rb_page_commit(reader);
 
+        /* Check if any events were dropped */
+        missed_events = cpu_buffer->lost_events;
+
         /*
          * If this page has been partially read or
          * if len is not big enough to read the rest of the page or
@@ -3767,9 +3882,35 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
                 local_set(&reader->entries, 0);
                 reader->read = 0;
                 *data_page = bpage;
+
+                /*
+                 * Use the real_end for the data size,
+                 * This gives us a chance to store the lost events
+                 * on the page.
+                 */
+                if (reader->real_end)
+                        local_set(&bpage->commit, reader->real_end);
         }
         ret = read;
 
+        cpu_buffer->lost_events = 0;
+        /*
+         * Set a flag in the commit field if we lost events
+         */
+        if (missed_events) {
+                commit = local_read(&bpage->commit);
+
+                /* If there is room at the end of the page to save the
+                 * missed events, then record it there.
+                 */
+                if (BUF_PAGE_SIZE - commit >= sizeof(missed_events)) {
+                        memcpy(&bpage->data[commit], &missed_events,
+                               sizeof(missed_events));
+                        local_add(RB_MISSED_STORED, &bpage->commit);
+                }
+                local_add(RB_MISSED_EVENTS, &bpage->commit);
+        }
+
  out_unlock:
         spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 
diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
index b2477caf09c2..302f8a614635 100644
--- a/kernel/trace/ring_buffer_benchmark.c
+++ b/kernel/trace/ring_buffer_benchmark.c
@@ -8,6 +8,7 @@
 #include <linux/kthread.h>
 #include <linux/module.h>
 #include <linux/time.h>
+#include <asm/local.h>
 
 struct rb_page {
         u64             ts;
@@ -80,7 +81,7 @@ static enum event_status read_event(int cpu)
         int *entry;
         u64 ts;
 
-        event = ring_buffer_consume(buffer, cpu, &ts);
+        event = ring_buffer_consume(buffer, cpu, &ts, NULL);
         if (!event)
                 return EVENT_DROPPED;
 
@@ -112,7 +113,8 @@ static enum event_status read_page(int cpu)
         ret = ring_buffer_read_page(buffer, &bpage, PAGE_SIZE, cpu, 1);
         if (ret >= 0) {
                 rpage = bpage;
-                commit = local_read(&rpage->commit);
+                /* The commit may have missed event flags set, clear them */
+                commit = local_read(&rpage->commit) & 0xfffff;
                 for (i = 0; i < commit && !kill_test; i += inc) {
 
                         if (i >= (PAGE_SIZE - offsetof(struct rb_page, data))) {
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 032c57ca6502..756d7283318b 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -33,10 +33,10 @@
 #include <linux/kdebug.h>
 #include <linux/string.h>
 #include <linux/rwsem.h>
+#include <linux/slab.h>
 #include <linux/ctype.h>
 #include <linux/init.h>
 #include <linux/poll.h>
-#include <linux/gfp.h>
 #include <linux/fs.h>
 
 #include "trace.h"
@@ -92,12 +92,12 @@ DEFINE_PER_CPU(int, ftrace_cpu_disabled);
 static inline void ftrace_disable_cpu(void)
 {
         preempt_disable();
-        __this_cpu_inc(per_cpu_var(ftrace_cpu_disabled));
+        __this_cpu_inc(ftrace_cpu_disabled);
 }
 
 static inline void ftrace_enable_cpu(void)
 {
-        __this_cpu_dec(per_cpu_var(ftrace_cpu_disabled));
+        __this_cpu_dec(ftrace_cpu_disabled);
         preempt_enable();
 }
 
@@ -117,9 +117,12 @@ static cpumask_var_t __read_mostly	tracing_buffer_mask;
  *
  * It is default off, but you can enable it with either specifying
  * "ftrace_dump_on_oops" in the kernel command line, or setting
- * /proc/sys/kernel/ftrace_dump_on_oops to true.
+ * /proc/sys/kernel/ftrace_dump_on_oops
+ * Set 1 if you want to dump buffers of all CPUs
+ * Set 2 if you want to dump the buffer of the CPU that triggered oops
  */
-int ftrace_dump_on_oops;
+
+enum ftrace_dump_mode ftrace_dump_on_oops;
 
 static int tracing_set_tracer(const char *buf);
 
@@ -139,8 +142,17 @@ __setup("ftrace=", set_cmdline_ftrace);
 
 static int __init set_ftrace_dump_on_oops(char *str)
 {
-        ftrace_dump_on_oops = 1;
-        return 1;
+        if (*str++ != '=' || !*str) {
+                ftrace_dump_on_oops = DUMP_ALL;
+                return 1;
+        }
+
+        if (!strcmp("orig_cpu", str)) {
+                ftrace_dump_on_oops = DUMP_ORIG;
+                return 1;
+        }
+
+        return 0;
 }
 __setup("ftrace_dump_on_oops", set_ftrace_dump_on_oops);
 
@@ -374,6 +386,21 @@ static int __init set_buf_size(char *str)
 }
 __setup("trace_buf_size=", set_buf_size);
 
+static int __init set_tracing_thresh(char *str)
+{
+        unsigned long threshhold;
+        int ret;
+
+        if (!str)
+                return 0;
+        ret = strict_strtoul(str, 0, &threshhold);
+        if (ret < 0)
+                return 0;
+        tracing_thresh = threshhold * 1000;
+        return 1;
+}
+__setup("tracing_thresh=", set_tracing_thresh);
+
 unsigned long nsecs_to_usecs(unsigned long nsecs)
 {
         return nsecs / 1000;
@@ -579,9 +606,10 @@ static ssize_t trace_seq_to_buffer(struct trace_seq *s, void *buf, size_t cnt)
 static arch_spinlock_t ftrace_max_lock =
         (arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;
 
+unsigned long __read_mostly     tracing_thresh;
+
 #ifdef CONFIG_TRACER_MAX_TRACE
 unsigned long __read_mostly     tracing_max_latency;
-unsigned long __read_mostly     tracing_thresh;
 
 /*
  * Copy the new maximum trace into the separate maximum-trace
@@ -592,7 +620,7 @@ static void
 __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 {
         struct trace_array_cpu *data = tr->data[cpu];
-        struct trace_array_cpu *max_data = tr->data[cpu];
+        struct trace_array_cpu *max_data;
 
         max_tr.cpu = cpu;
         max_tr.time_start = data->preempt_timestamp;
@@ -602,7 +630,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
         max_data->critical_start = data->critical_start;
         max_data->critical_end = data->critical_end;
 
-        memcpy(data->comm, tsk->comm, TASK_COMM_LEN);
+        memcpy(max_data->comm, tsk->comm, TASK_COMM_LEN);
         max_data->pid = tsk->pid;
         max_data->uid = task_uid(tsk);
         max_data->nice = tsk->static_prio - 20 - MAX_RT_PRIO;
@@ -824,10 +852,10 @@ out:
         mutex_unlock(&trace_types_lock);
 }
 
-static void __tracing_reset(struct trace_array *tr, int cpu)
+static void __tracing_reset(struct ring_buffer *buffer, int cpu)
 {
         ftrace_disable_cpu();
-        ring_buffer_reset_cpu(tr->buffer, cpu);
+        ring_buffer_reset_cpu(buffer, cpu);
         ftrace_enable_cpu();
 }
 
@@ -839,7 +867,7 @@ void tracing_reset(struct trace_array *tr, int cpu)
 
         /* Make sure all commits have finished */
         synchronize_sched();
-        __tracing_reset(tr, cpu);
+        __tracing_reset(buffer, cpu);
 
         ring_buffer_record_enable(buffer);
 }
@@ -857,7 +885,7 @@ void tracing_reset_online_cpus(struct trace_array *tr)
         tr->time_start = ftrace_now(tr->cpu);
 
         for_each_online_cpu(cpu)
-                __tracing_reset(tr, cpu);
+                __tracing_reset(buffer, cpu);
 
         ring_buffer_record_enable(buffer);
 }
@@ -934,6 +962,8 @@ void tracing_start(void)
                 goto out;
         }
 
+        /* Prevent the buffers from switching */
+        arch_spin_lock(&ftrace_max_lock);
 
         buffer = global_trace.buffer;
         if (buffer)
@@ -943,6 +973,8 @@ void tracing_start(void)
         if (buffer)
                 ring_buffer_record_enable(buffer);
 
+        arch_spin_unlock(&ftrace_max_lock);
+
         ftrace_start();
  out:
         spin_unlock_irqrestore(&tracing_start_lock, flags);
@@ -964,6 +996,9 @@ void tracing_stop(void)
         if (trace_stop_count++)
                 goto out;
 
+        /* Prevent the buffers from switching */
+        arch_spin_lock(&ftrace_max_lock);
+
         buffer = global_trace.buffer;
         if (buffer)
                 ring_buffer_record_disable(buffer);
@@ -972,6 +1007,8 @@ void tracing_stop(void)
         if (buffer)
                 ring_buffer_record_disable(buffer);
 
+        arch_spin_unlock(&ftrace_max_lock);
+
  out:
         spin_unlock_irqrestore(&tracing_start_lock, flags);
 }
@@ -1166,7 +1203,7 @@ trace_function(struct trace_array *tr,
         struct ftrace_entry *entry;
 
         /* If we are reading the ring buffer, don't trace */
-        if (unlikely(__this_cpu_read(per_cpu_var(ftrace_cpu_disabled))))
+        if (unlikely(__this_cpu_read(ftrace_cpu_disabled)))
                 return;
 
         event = trace_buffer_lock_reserve(buffer, TRACE_FN, sizeof(*entry),
@@ -1259,6 +1296,13 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
         if (!(trace_flags & TRACE_ITER_USERSTACKTRACE))
                 return;
 
+        /*
+         * NMIs can not handle page faults, even with fix ups.
+         * The save user stack can (and often does) fault.
+         */
+        if (unlikely(in_nmi()))
+                return;
+
         event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
                                           sizeof(*entry), flags, pc);
         if (!event)
@@ -1513,7 +1557,8 @@ static void trace_iterator_increment(struct trace_iterator *iter)
 }
 
 static struct trace_entry *
-peek_next_entry(struct trace_iterator *iter, int cpu, u64 *ts)
+peek_next_entry(struct trace_iterator *iter, int cpu, u64 *ts,
+                unsigned long *lost_events)
 {
         struct ring_buffer_event *event;
         struct ring_buffer_iter *buf_iter = iter->buffer_iter[cpu];
@@ -1524,7 +1569,8 @@ peek_next_entry(struct trace_iterator *iter, int cpu, u64 *ts)
         if (buf_iter)
                 event = ring_buffer_iter_peek(buf_iter, ts);
         else
-                event = ring_buffer_peek(iter->tr->buffer, cpu, ts);
+                event = ring_buffer_peek(iter->tr->buffer, cpu, ts,
+                                         lost_events);
 
         ftrace_enable_cpu();
 
@@ -1532,10 +1578,12 @@ peek_next_entry(struct trace_iterator *iter, int cpu, u64 *ts)
 }
 
 static struct trace_entry *
-__find_next_entry(struct trace_iterator *iter, int *ent_cpu, u64 *ent_ts)
+__find_next_entry(struct trace_iterator *iter, int *ent_cpu,
+                  unsigned long *missing_events, u64 *ent_ts)
 {
         struct ring_buffer *buffer = iter->tr->buffer;
         struct trace_entry *ent, *next = NULL;
+        unsigned long lost_events = 0, next_lost = 0;
         int cpu_file = iter->cpu_file;
         u64 next_ts = 0, ts;
         int next_cpu = -1;
@@ -1548,7 +1596,7 @@ __find_next_entry(struct trace_iterator *iter, int *ent_cpu, u64 *ent_ts)
         if (cpu_file > TRACE_PIPE_ALL_CPU) {
                 if (ring_buffer_empty_cpu(buffer, cpu_file))
                         return NULL;
-                ent = peek_next_entry(iter, cpu_file, ent_ts);
+                ent = peek_next_entry(iter, cpu_file, ent_ts, missing_events);
                 if (ent_cpu)
                         *ent_cpu = cpu_file;
 
@@ -1560,7 +1608,7 @@ __find_next_entry(struct trace_iterator *iter, int *ent_cpu, u64 *ent_ts)
                 if (ring_buffer_empty_cpu(buffer, cpu))
                         continue;
 
-                ent = peek_next_entry(iter, cpu, &ts);
+                ent = peek_next_entry(iter, cpu, &ts, &lost_events);
 
                 /*
                  * Pick the entry with the smallest timestamp:
@@ -1569,6 +1617,7 @@ __find_next_entry(struct trace_iterator *iter, int *ent_cpu, u64 *ent_ts)
                         next = ent;
                         next_cpu = cpu;
                         next_ts = ts;
+                        next_lost = lost_events;
                 }
         }
 
@@ -1578,6 +1627,9 @@ __find_next_entry(struct trace_iterator *iter, int *ent_cpu, u64 *ent_ts)
         if (ent_ts)
                 *ent_ts = next_ts;
 
+        if (missing_events)
+                *missing_events = next_lost;
+
         return next;
 }
 
@@ -1585,13 +1637,14 @@ __find_next_entry(struct trace_iterator *iter, int *ent_cpu, u64 *ent_ts)
 struct trace_entry *trace_find_next_entry(struct trace_iterator *iter,
                                           int *ent_cpu, u64 *ent_ts)
 {
-        return __find_next_entry(iter, ent_cpu, ent_ts);
+        return __find_next_entry(iter, ent_cpu, NULL, ent_ts);
 }
 
 /* Find the next real entry, and increment the iterator to the next entry */
 static void *find_next_entry_inc(struct trace_iterator *iter)
 {
-        iter->ent = __find_next_entry(iter, &iter->cpu, &iter->ts);
+        iter->ent = __find_next_entry(iter, &iter->cpu,
+                                      &iter->lost_events, &iter->ts);
 
         if (iter->ent)
                 trace_iterator_increment(iter);
@@ -1603,7 +1656,8 @@ static void trace_consume(struct trace_iterator *iter)
 {
         /* Don't allow ftrace to trace into the ring buffers */
         ftrace_disable_cpu();
-        ring_buffer_consume(iter->tr->buffer, iter->cpu, &iter->ts);
+        ring_buffer_consume(iter->tr->buffer, iter->cpu, &iter->ts,
+                            &iter->lost_events);
         ftrace_enable_cpu();
 }
 
@@ -1703,6 +1757,7 @@ static void *s_start(struct seq_file *m, loff_t *pos)
 
                 ftrace_enable_cpu();
 
+                iter->leftover = 0;
                 for (p = iter; p && l < *pos; p = s_next(m, p, &l))
                         ;
 
@@ -1753,7 +1808,7 @@ static void print_func_help_header(struct seq_file *m)
 }
 
 
-static void
+void
 print_trace_header(struct seq_file *m, struct trace_iterator *iter)
 {
         unsigned long sym_flags = (trace_flags & TRACE_ITER_SYM_MASK);
@@ -1962,7 +2017,7 @@ static enum print_line_t print_bin_fmt(struct trace_iterator *iter)
         return event ? event->binary(iter, 0) : TRACE_TYPE_HANDLED;
 }
 
-static int trace_empty(struct trace_iterator *iter)
+int trace_empty(struct trace_iterator *iter)
 {
         int cpu;
 
@@ -1997,6 +2052,10 @@ static enum print_line_t print_trace_line(struct trace_iterator *iter)
 {
         enum print_line_t ret;
 
+        if (iter->lost_events)
+                trace_seq_printf(&iter->seq, "CPU:%d [LOST %lu EVENTS]\n",
+                                 iter->cpu, iter->lost_events);
+
         if (iter->trace && iter->trace->print_line) {
                 ret = iter->trace->print_line(iter);
                 if (ret != TRACE_TYPE_UNHANDLED)
@@ -2025,6 +2084,23 @@ static enum print_line_t print_trace_line(struct trace_iterator *iter)
         return print_trace_fmt(iter);
 }
 
+void trace_default_header(struct seq_file *m)
+{
+        struct trace_iterator *iter = m->private;
+
+        if (iter->iter_flags & TRACE_FILE_LAT_FMT) {
+                /* print nothing if the buffers are empty */
+                if (trace_empty(iter))
+                        return;
+                print_trace_header(m, iter);
+                if (!(trace_flags & TRACE_ITER_VERBOSE))
+                        print_lat_help_header(m);
+        } else {
+                if (!(trace_flags & TRACE_ITER_VERBOSE))
+                        print_func_help_header(m);
+        }
+}
+
 static int s_show(struct seq_file *m, void *v)
 {
         struct trace_iterator *iter = v;
@@ -2037,17 +2113,9 @@ static int s_show(struct seq_file *m, void *v)
                 }
                 if (iter->trace && iter->trace->print_header)
                         iter->trace->print_header(m);
-                else if (iter->iter_flags & TRACE_FILE_LAT_FMT) {
-                        /* print nothing if the buffers are empty */
-                        if (trace_empty(iter))
-                                return 0;
-                        print_trace_header(m, iter);
-                        if (!(trace_flags & TRACE_ITER_VERBOSE))
-                                print_lat_help_header(m);
-                } else {
-                        if (!(trace_flags & TRACE_ITER_VERBOSE))
-                                print_func_help_header(m);
-                }
+                else
+                        trace_default_header(m);
+
         } else if (iter->leftover) {
                 /*
                  * If we filled the seq_file buffer earlier, we
@@ -2133,15 +2201,20 @@ __tracing_open(struct inode *inode, struct file *file)
 
         if (iter->cpu_file == TRACE_PIPE_ALL_CPU) {
                 for_each_tracing_cpu(cpu) {
-
                         iter->buffer_iter[cpu] =
-                                ring_buffer_read_start(iter->tr->buffer, cpu);
+                                ring_buffer_read_prepare(iter->tr->buffer, cpu);
+                }
+                ring_buffer_read_prepare_sync();
+                for_each_tracing_cpu(cpu) {
+                        ring_buffer_read_start(iter->buffer_iter[cpu]);
                         tracing_iter_reset(iter, cpu);
                 }
         } else {
                 cpu = iter->cpu_file;
                 iter->buffer_iter[cpu] =
-                                ring_buffer_read_start(iter->tr->buffer, cpu);
+                        ring_buffer_read_prepare(iter->tr->buffer, cpu);
+                ring_buffer_read_prepare_sync();
+                ring_buffer_read_start(iter->buffer_iter[cpu]);
                 tracing_iter_reset(iter, cpu);
         }
 
@@ -4248,10 +4321,10 @@ static __init int tracer_init_debugfs(void)
 #ifdef CONFIG_TRACER_MAX_TRACE
         trace_create_file("tracing_max_latency", 0644, d_tracer,
                         &tracing_max_latency, &tracing_max_lat_fops);
+#endif
 
         trace_create_file("tracing_thresh", 0644, d_tracer,
                         &tracing_thresh, &tracing_max_lat_fops);
-#endif
 
         trace_create_file("README", 0444, d_tracer,
                         NULL, &tracing_readme_fops);
@@ -4291,7 +4364,7 @@ static int trace_panic_handler(struct notifier_block *this,
                                unsigned long event, void *unused)
 {
         if (ftrace_dump_on_oops)
-                ftrace_dump();
+                ftrace_dump(ftrace_dump_on_oops);
         return NOTIFY_OK;
 }
 
@@ -4308,7 +4381,7 @@ static int trace_die_handler(struct notifier_block *self,
         switch (val) {
         case DIE_OOPS:
                 if (ftrace_dump_on_oops)
-                        ftrace_dump();
+                        ftrace_dump(ftrace_dump_on_oops);
                 break;
         default:
                 break;
@@ -4349,7 +4422,8 @@ trace_printk_seq(struct trace_seq *s)
         trace_seq_init(s);
 }
 
-static void __ftrace_dump(bool disable_tracing)
+static void
+__ftrace_dump(bool disable_tracing, enum ftrace_dump_mode oops_dump_mode)
 {
         static arch_spinlock_t ftrace_dump_lock =
                 (arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;
@@ -4382,12 +4456,25 @@ static void __ftrace_dump(bool disable_tracing)
         /* don't look at user memory in panic mode */
         trace_flags &= ~TRACE_ITER_SYM_USEROBJ;
 
-        printk(KERN_TRACE "Dumping ftrace buffer:\n");
-
         /* Simulate the iterator */
         iter.tr = &global_trace;
         iter.trace = current_trace;
-        iter.cpu_file = TRACE_PIPE_ALL_CPU;
+
+        switch (oops_dump_mode) {
+        case DUMP_ALL:
+                iter.cpu_file = TRACE_PIPE_ALL_CPU;
+                break;
+        case DUMP_ORIG:
+                iter.cpu_file = raw_smp_processor_id();
+                break;
+        case DUMP_NONE:
+                goto out_enable;
+        default:
+                printk(KERN_TRACE "Bad dumping mode, switching to all CPUs dump\n");
+                iter.cpu_file = TRACE_PIPE_ALL_CPU;
+        }
+
+        printk(KERN_TRACE "Dumping ftrace buffer:\n");
 
         /*
          * We need to stop all tracing on all CPUS to read the
@@ -4426,6 +4513,7 @@ static void __ftrace_dump(bool disable_tracing)
         else
                 printk(KERN_TRACE "---------------------------------\n");
 
+ out_enable:
         /* Re-enable tracing if requested */
         if (!disable_tracing) {
                 trace_flags |= old_userobj;
@@ -4442,9 +4530,9 @@ static void __ftrace_dump(bool disable_tracing)
 }
 
 /* By default: disable tracing after the dump */
-void ftrace_dump(void)
+void ftrace_dump(enum ftrace_dump_mode oops_dump_mode)
 {
-        __ftrace_dump(true);
+        __ftrace_dump(true, oops_dump_mode);
 }
 
 __init static int tracer_alloc_buffers(void)
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index fd05bcaf91b0..d1ce0bec1b3f 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -34,7 +34,6 @@ enum trace_type {
         TRACE_GRAPH_RET,
         TRACE_GRAPH_ENT,
         TRACE_USER_STACK,
-        TRACE_HW_BRANCHES,
         TRACE_KMEM_ALLOC,
         TRACE_KMEM_FREE,
         TRACE_BLK,
@@ -103,29 +102,17 @@ struct syscall_trace_exit {
         long                    ret;
 };
 
-struct kprobe_trace_entry {
+struct kprobe_trace_entry_head {
         struct trace_entry      ent;
         unsigned long           ip;
-        int                     nargs;
-        unsigned long           args[];
 };
 
-#define SIZEOF_KPROBE_TRACE_ENTRY(n)                    \
-        (offsetof(struct kprobe_trace_entry, args) +    \
-        (sizeof(unsigned long) * (n)))
-
-struct kretprobe_trace_entry {
+struct kretprobe_trace_entry_head {
         struct trace_entry      ent;
         unsigned long           func;
         unsigned long           ret_ip;
-        int                     nargs;
-        unsigned long           args[];
 };
 
-#define SIZEOF_KRETPROBE_TRACE_ENTRY(n)                 \
-        (offsetof(struct kretprobe_trace_entry, args) + \
-        (sizeof(unsigned long) * (n)))
-
 /*
  * trace_flag_type is an enumeration that holds different
  * states when a trace occurs. These are:
@@ -229,7 +216,6 @@ extern void __ftrace_bad_type(void);
                           TRACE_GRAPH_ENT);             \
                 IF_ASSIGN(var, ent, struct ftrace_graph_ret_entry,      \
                           TRACE_GRAPH_RET);             \
-                IF_ASSIGN(var, ent, struct hw_branch_entry, TRACE_HW_BRANCHES);\
                 IF_ASSIGN(var, ent, struct kmemtrace_alloc_entry,       \
                           TRACE_KMEM_ALLOC);    \
                 IF_ASSIGN(var, ent, struct kmemtrace_free_entry,        \
@@ -378,6 +364,9 @@ void trace_function(struct trace_array *tr,
                     unsigned long ip,
                     unsigned long parent_ip,
                     unsigned long flags, int pc);
+void trace_default_header(struct seq_file *m);
+void print_trace_header(struct seq_file *m, struct trace_iterator *iter);
+int trace_empty(struct trace_iterator *iter);
 
 void trace_graph_return(struct ftrace_graph_ret *trace);
 int trace_graph_entry(struct ftrace_graph_ent *trace);
@@ -396,9 +385,10 @@ extern int process_new_ksym_entry(char *ksymname, int op, unsigned long addr);
 
 extern unsigned long nsecs_to_usecs(unsigned long nsecs);
 
+extern unsigned long tracing_thresh;
+
 #ifdef CONFIG_TRACER_MAX_TRACE
 extern unsigned long tracing_max_latency;
-extern unsigned long tracing_thresh;
 
 void update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu);
 void update_max_tr_single(struct trace_array *tr,
@@ -466,8 +456,6 @@ extern int trace_selftest_startup_sysprof(struct tracer *trace,
                                                struct trace_array *tr);
 extern int trace_selftest_startup_branch(struct tracer *trace,
                                          struct trace_array *tr);
-extern int trace_selftest_startup_hw_branches(struct tracer *trace,
-                                              struct trace_array *tr);
 extern int trace_selftest_startup_ksym(struct tracer *trace,
                                          struct trace_array *tr);
 #endif /* CONFIG_FTRACE_STARTUP_TEST */
@@ -490,9 +478,29 @@ extern int trace_clock_id;
 
 /* Standard output formatting function used for function return traces */
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-extern enum print_line_t print_graph_function(struct trace_iterator *iter);
+
+/* Flag options */
+#define TRACE_GRAPH_PRINT_OVERRUN       0x1
+#define TRACE_GRAPH_PRINT_CPU           0x2
+#define TRACE_GRAPH_PRINT_OVERHEAD      0x4
+#define TRACE_GRAPH_PRINT_PROC          0x8
+#define TRACE_GRAPH_PRINT_DURATION      0x10
+#define TRACE_GRAPH_PRINT_ABS_TIME      0x20
+
+extern enum print_line_t
+print_graph_function_flags(struct trace_iterator *iter, u32 flags);
+extern void print_graph_headers_flags(struct seq_file *s, u32 flags);
 extern enum print_line_t
 trace_print_graph_duration(unsigned long long duration, struct trace_seq *s);
+extern void graph_trace_open(struct trace_iterator *iter);
+extern void graph_trace_close(struct trace_iterator *iter);
+extern int __trace_graph_entry(struct trace_array *tr,
+                               struct ftrace_graph_ent *trace,
+                               unsigned long flags, int pc);
+extern void __trace_graph_return(struct trace_array *tr,
+                                 struct ftrace_graph_ret *trace,
+                                 unsigned long flags, int pc);
+
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 /* TODO: make this variable */
@@ -523,7 +531,7 @@ static inline int ftrace_graph_addr(unsigned long addr)
 #endif /* CONFIG_DYNAMIC_FTRACE */
 #else /* CONFIG_FUNCTION_GRAPH_TRACER */
 static inline enum print_line_t
-print_graph_function(struct trace_iterator *iter)
+print_graph_function_flags(struct trace_iterator *iter, u32 flags)
 {
         return TRACE_TYPE_UNHANDLED;
 }
@@ -550,7 +558,7 @@ static inline int ftrace_trace_task(struct task_struct *task)
  * struct trace_parser - servers for reading the user input separated by spaces
  * @cont: set if the input is not complete - no final space char was found
  * @buffer: holds the parsed user input
- * @idx: user input lenght
+ * @idx: user input length
  * @size: buffer size
  */
 struct trace_parser {
diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
index 84a3a7ba072a..9d589d8dcd1a 100644
--- a/kernel/trace/trace_clock.c
+++ b/kernel/trace/trace_clock.c
@@ -13,6 +13,7 @@
  * Tracer plugins will chose a default from these clocks.
  */
 #include <linux/spinlock.h>
+#include <linux/irqflags.h>
 #include <linux/hardirq.h>
 #include <linux/module.h>
 #include <linux/percpu.h>
@@ -83,7 +84,7 @@ u64 notrace trace_clock_global(void)
         int this_cpu;
         u64 now;
 
-        raw_local_irq_save(flags);
+        local_irq_save(flags);
 
         this_cpu = raw_smp_processor_id();
         now = cpu_clock(this_cpu);
@@ -109,7 +110,7 @@ u64 notrace trace_clock_global(void)
         arch_spin_unlock(&trace_clock_struct.lock);
 
  out:
-        raw_local_irq_restore(flags);
+        local_irq_restore(flags);
 
         return now;
 }
diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index c16a08f399df..dc008c1240da 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -318,18 +318,6 @@ FTRACE_ENTRY(branch, trace_branch,
                  __entry->func, __entry->file, __entry->correct)
 );
 
-FTRACE_ENTRY(hw_branch, hw_branch_entry,
-
-        TRACE_HW_BRANCHES,
-
-        F_STRUCT(
-                __field(        u64,    from    )
-                __field(        u64,    to      )
-        ),
-
-        F_printk("from: %llx to: %llx", __entry->from, __entry->to)
-);
-
 FTRACE_ENTRY(kmem_alloc, kmemtrace_alloc_entry,
 
         TRACE_KMEM_ALLOC,
diff --git a/kernel/trace/trace_event_profile.c b/kernel/trace/trace_event_perf.c
index f0d693005075..0565bb42566f 100644
--- a/kernel/trace/trace_event_profile.c
+++ b/kernel/trace/trace_event_perf.c
@@ -1,32 +1,41 @@
 /*
- * trace event based perf counter profiling
+ * trace event based perf event profiling/tracing
  *
  * Copyright (C) 2009 Red Hat Inc, Peter Zijlstra <pzijlstr@redhat.com>
- *
+ * Copyright (C) 2009-2010 Frederic Weisbecker <fweisbec@gmail.com>
  */
 
 #include <linux/module.h>
 #include <linux/kprobes.h>
 #include "trace.h"
 
+DEFINE_PER_CPU(struct pt_regs, perf_trace_regs);
+EXPORT_PER_CPU_SYMBOL_GPL(perf_trace_regs);
+
+EXPORT_SYMBOL_GPL(perf_arch_fetch_caller_regs);
 
 static char *perf_trace_buf;
 static char *perf_trace_buf_nmi;
 
-typedef typeof(char [FTRACE_MAX_PROFILE_SIZE]) perf_trace_t ;
+/*
+ * Force it to be aligned to unsigned long to avoid misaligned accesses
+ * suprises
+ */
+typedef typeof(unsigned long [PERF_MAX_TRACE_SIZE / sizeof(unsigned long)])
+        perf_trace_t;
 
 /* Count the events in use (per event id, not per instance) */
-static int      total_profile_count;
+static int      total_ref_count;
 
-static int ftrace_profile_enable_event(struct ftrace_event_call *event)
+static int perf_trace_event_enable(struct ftrace_event_call *event)
 {
         char *buf;
         int ret = -ENOMEM;
 
-        if (event->profile_count++ > 0)
+        if (event->perf_refcount++ > 0)
                 return 0;
 
-        if (!total_profile_count) {
+        if (!total_ref_count) {
                 buf = (char *)alloc_percpu(perf_trace_t);
                 if (!buf)
                         goto fail_buf;
@@ -40,35 +49,35 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
                 rcu_assign_pointer(perf_trace_buf_nmi, buf);
         }
 
-        ret = event->profile_enable(event);
+        ret = event->perf_event_enable(event);
         if (!ret) {
-                total_profile_count++;
+                total_ref_count++;
                 return 0;
         }
 
 fail_buf_nmi:
-        if (!total_profile_count) {
+        if (!total_ref_count) {
                 free_percpu(perf_trace_buf_nmi);
                 free_percpu(perf_trace_buf);
                 perf_trace_buf_nmi = NULL;
                 perf_trace_buf = NULL;
         }
 fail_buf:
-        event->profile_count--;
+        event->perf_refcount--;
 
         return ret;
 }
 
-int ftrace_profile_enable(int event_id)
+int perf_trace_enable(int event_id)
 {
         struct ftrace_event_call *event;
         int ret = -EINVAL;
 
         mutex_lock(&event_mutex);
         list_for_each_entry(event, &ftrace_events, list) {
-                if (event->id == event_id && event->profile_enable &&
+                if (event->id == event_id && event->perf_event_enable &&
                     try_module_get(event->mod)) {
-                        ret = ftrace_profile_enable_event(event);
+                        ret = perf_trace_event_enable(event);
                         break;
                 }
         }
@@ -77,16 +86,16 @@ int ftrace_profile_enable(int event_id)
         return ret;
 }
 
-static void ftrace_profile_disable_event(struct ftrace_event_call *event)
+static void perf_trace_event_disable(struct ftrace_event_call *event)
 {
         char *buf, *nmi_buf;
 
-        if (--event->profile_count > 0)
+        if (--event->perf_refcount > 0)
                 return;
 
-        event->profile_disable(event);
+        event->perf_event_disable(event);
 
-        if (!--total_profile_count) {
+        if (!--total_ref_count) {
                 buf = perf_trace_buf;
                 rcu_assign_pointer(perf_trace_buf, NULL);
 
@@ -104,14 +113,14 @@ static void ftrace_profile_disable_event(struct ftrace_event_call *event)
         }
 }
 
-void ftrace_profile_disable(int event_id)
+void perf_trace_disable(int event_id)
 {
         struct ftrace_event_call *event;
 
         mutex_lock(&event_mutex);
         list_for_each_entry(event, &ftrace_events, list) {
                 if (event->id == event_id) {
-                        ftrace_profile_disable_event(event);
+                        perf_trace_event_disable(event);
                         module_put(event->mod);
                         break;
                 }
@@ -119,13 +128,15 @@ void ftrace_profile_disable(int event_id)
         mutex_unlock(&event_mutex);
 }
 
-__kprobes void *ftrace_perf_buf_prepare(int size, unsigned short type,
-                                        int *rctxp, unsigned long *irq_flags)
+__kprobes void *perf_trace_buf_prepare(int size, unsigned short type,
+                                       int *rctxp, unsigned long *irq_flags)
 {
         struct trace_entry *entry;
         char *trace_buf, *raw_data;
         int pc, cpu;
 
+        BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(unsigned long));
+
         pc = preempt_count();
 
         /* Protect the per cpu buffer, begin the rcu read side */
@@ -138,9 +149,9 @@ __kprobes void *ftrace_perf_buf_prepare(int size, unsigned short type,
         cpu = smp_processor_id();
 
         if (in_nmi())
-                trace_buf = rcu_dereference(perf_trace_buf_nmi);
+                trace_buf = rcu_dereference_sched(perf_trace_buf_nmi);
         else
-                trace_buf = rcu_dereference(perf_trace_buf);
+                trace_buf = rcu_dereference_sched(perf_trace_buf);
 
         if (!trace_buf)
                 goto err;
@@ -148,7 +159,7 @@ __kprobes void *ftrace_perf_buf_prepare(int size, unsigned short type,
         raw_data = per_cpu_ptr(trace_buf, cpu);
 
         /* zero the dead bytes from align to not leak stack to user */
-        *(u64 *)(&raw_data[size - sizeof(u64)]) = 0ULL;
+        memset(&raw_data[size - sizeof(u64)], 0, sizeof(u64));
 
         entry = (struct trace_entry *)raw_data;
         tracing_generic_entry_update(entry, *irq_flags, pc);
@@ -161,4 +172,4 @@ err_recursion:
         local_irq_restore(*irq_flags);
         return NULL;
 }
-EXPORT_SYMBOL_GPL(ftrace_perf_buf_prepare);
+EXPORT_SYMBOL_GPL(perf_trace_buf_prepare);
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 3f972ad98d04..c697c7043349 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -15,6 +15,7 @@
 #include <linux/uaccess.h>
 #include <linux/module.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 #include <linux/delay.h>
 
 #include <asm/setup.h>
@@ -938,7 +939,7 @@ event_create_dir(struct ftrace_event_call *call, struct dentry *d_events,
                 trace_create_file("enable", 0644, call->dir, call,
                                   enable);
 
-        if (call->id && call->profile_enable)
+        if (call->id && call->perf_event_enable)
                 trace_create_file("id", 0444, call->dir, call,
                                   id);
 
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 4615f62a04f1..58092d844a1f 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -22,6 +22,7 @@
 #include <linux/ctype.h>
 #include <linux/mutex.h>
 #include <linux/perf_event.h>
+#include <linux/slab.h>
 
 #include "trace.h"
 #include "trace_output.h"
@@ -1397,7 +1398,7 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
         }
 
         err = -EINVAL;
-        if (!call)
+        if (&call->list == &ftrace_events)
                 goto out_unlock;
 
         err = -EEXIST;
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index e998a824e9db..dd11c830eb84 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -9,6 +9,7 @@
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 
 #include "trace.h"
@@ -39,7 +40,7 @@ struct fgraph_data {
 #define TRACE_GRAPH_PRINT_OVERHEAD      0x4
 #define TRACE_GRAPH_PRINT_PROC          0x8
 #define TRACE_GRAPH_PRINT_DURATION      0x10
-#define TRACE_GRAPH_PRINT_ABS_TIME      0X20
+#define TRACE_GRAPH_PRINT_ABS_TIME      0x20
 
 static struct tracer_opt trace_opts[] = {
         /* Display overruns? (for self-debug purpose) */
@@ -178,7 +179,7 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
         return ret;
 }
 
-static int __trace_graph_entry(struct trace_array *tr,
+int __trace_graph_entry(struct trace_array *tr,
                                 struct ftrace_graph_ent *trace,
                                 unsigned long flags,
                                 int pc)
@@ -188,7 +189,7 @@ static int __trace_graph_entry(struct trace_array *tr,
         struct ring_buffer *buffer = tr->buffer;
         struct ftrace_graph_ent_entry *entry;
 
-        if (unlikely(__this_cpu_read(per_cpu_var(ftrace_cpu_disabled))))
+        if (unlikely(__this_cpu_read(ftrace_cpu_disabled)))
                 return 0;
 
         event = trace_buffer_lock_reserve(buffer, TRACE_GRAPH_ENT,
@@ -237,7 +238,15 @@ int trace_graph_entry(struct ftrace_graph_ent *trace)
         return ret;
 }
 
-static void __trace_graph_return(struct trace_array *tr,
+int trace_graph_thresh_entry(struct ftrace_graph_ent *trace)
+{
+        if (tracing_thresh)
+                return 1;
+        else
+                return trace_graph_entry(trace);
+}
+
+void __trace_graph_return(struct trace_array *tr,
                                 struct ftrace_graph_ret *trace,
                                 unsigned long flags,
                                 int pc)
@@ -247,7 +256,7 @@ static void __trace_graph_return(struct trace_array *tr,
         struct ring_buffer *buffer = tr->buffer;
         struct ftrace_graph_ret_entry *entry;
 
-        if (unlikely(__this_cpu_read(per_cpu_var(ftrace_cpu_disabled))))
+        if (unlikely(__this_cpu_read(ftrace_cpu_disabled)))
                 return;
 
         event = trace_buffer_lock_reserve(buffer, TRACE_GRAPH_RET,
@@ -290,13 +299,26 @@ void set_graph_array(struct trace_array *tr)
         smp_mb();
 }
 
+void trace_graph_thresh_return(struct ftrace_graph_ret *trace)
+{
+        if (tracing_thresh &&
+            (trace->rettime - trace->calltime < tracing_thresh))
+                return;
+        else
+                trace_graph_return(trace);
+}
+
 static int graph_trace_init(struct trace_array *tr)
 {
         int ret;
 
         set_graph_array(tr);
-        ret = register_ftrace_graph(&trace_graph_return,
-                                    &trace_graph_entry);
+        if (tracing_thresh)
+                ret = register_ftrace_graph(&trace_graph_thresh_return,
+                                            &trace_graph_thresh_entry);
+        else
+                ret = register_ftrace_graph(&trace_graph_return,
+                                            &trace_graph_entry);
         if (ret)
                 return ret;
         tracing_start_cmdline_record();
@@ -468,9 +490,10 @@ get_return_for_leaf(struct trace_iterator *iter,
                          * We need to consume the current entry to see
                          * the next one.
                          */
-                        ring_buffer_consume(iter->tr->buffer, iter->cpu, NULL);
+                        ring_buffer_consume(iter->tr->buffer, iter->cpu,
+                                            NULL, NULL);
                         event = ring_buffer_peek(iter->tr->buffer, iter->cpu,
-                                                 NULL);
+                                                 NULL, NULL);
                 }
 
                 if (!event)
@@ -504,17 +527,18 @@ get_return_for_leaf(struct trace_iterator *iter,
 
 /* Signal a overhead of time execution to the output */
 static int
-print_graph_overhead(unsigned long long duration, struct trace_seq *s)
+print_graph_overhead(unsigned long long duration, struct trace_seq *s,
+                     u32 flags)
 {
         /* If duration disappear, we don't need anything */
-        if (!(tracer_flags.val & TRACE_GRAPH_PRINT_DURATION))
+        if (!(flags & TRACE_GRAPH_PRINT_DURATION))
                 return 1;
 
         /* Non nested entry or return */
         if (duration == -1)
                 return trace_seq_printf(s, "  ");
 
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_OVERHEAD) {
+        if (flags & TRACE_GRAPH_PRINT_OVERHEAD) {
                 /* Duration exceeded 100 msecs */
                 if (duration > 100000ULL)
                         return trace_seq_printf(s, "! ");
@@ -540,7 +564,7 @@ static int print_graph_abs_time(u64 t, struct trace_seq *s)
 
 static enum print_line_t
 print_graph_irq(struct trace_iterator *iter, unsigned long addr,
-                enum trace_type type, int cpu, pid_t pid)
+                enum trace_type type, int cpu, pid_t pid, u32 flags)
 {
         int ret;
         struct trace_seq *s = &iter->seq;
@@ -550,21 +574,21 @@ print_graph_irq(struct trace_iterator *iter, unsigned long addr,
                 return TRACE_TYPE_UNHANDLED;
 
         /* Absolute time */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME) {
+        if (flags & TRACE_GRAPH_PRINT_ABS_TIME) {
                 ret = print_graph_abs_time(iter->ts, s);
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
         /* Cpu */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU) {
+        if (flags & TRACE_GRAPH_PRINT_CPU) {
                 ret = print_graph_cpu(s, cpu);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
         /* Proc */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC) {
+        if (flags & TRACE_GRAPH_PRINT_PROC) {
                 ret = print_graph_proc(s, pid);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -574,7 +598,7 @@ print_graph_irq(struct trace_iterator *iter, unsigned long addr,
         }
 
         /* No overhead */
-        ret = print_graph_overhead(-1, s);
+        ret = print_graph_overhead(-1, s, flags);
         if (!ret)
                 return TRACE_TYPE_PARTIAL_LINE;
 
@@ -587,7 +611,7 @@ print_graph_irq(struct trace_iterator *iter, unsigned long addr,
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* Don't close the duration column if haven't one */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION)
+        if (flags & TRACE_GRAPH_PRINT_DURATION)
                 trace_seq_printf(s, " |");
         ret = trace_seq_printf(s, "\n");
 
@@ -657,7 +681,8 @@ print_graph_duration(unsigned long long duration, struct trace_seq *s)
 static enum print_line_t
 print_graph_entry_leaf(struct trace_iterator *iter,
                 struct ftrace_graph_ent_entry *entry,
-                struct ftrace_graph_ret_entry *ret_entry, struct trace_seq *s)
+                struct ftrace_graph_ret_entry *ret_entry,
+                struct trace_seq *s, u32 flags)
 {
         struct fgraph_data *data = iter->private;
         struct ftrace_graph_ret *graph_ret;
@@ -689,12 +714,12 @@ print_graph_entry_leaf(struct trace_iterator *iter,
         }
 
         /* Overhead */
-        ret = print_graph_overhead(duration, s);
+        ret = print_graph_overhead(duration, s, flags);
         if (!ret)
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* Duration */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION) {
+        if (flags & TRACE_GRAPH_PRINT_DURATION) {
                 ret = print_graph_duration(duration, s);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -717,7 +742,7 @@ print_graph_entry_leaf(struct trace_iterator *iter,
 static enum print_line_t
 print_graph_entry_nested(struct trace_iterator *iter,
                          struct ftrace_graph_ent_entry *entry,
-                         struct trace_seq *s, int cpu)
+                         struct trace_seq *s, int cpu, u32 flags)
 {
         struct ftrace_graph_ent *call = &entry->graph_ent;
         struct fgraph_data *data = iter->private;
@@ -737,12 +762,12 @@ print_graph_entry_nested(struct trace_iterator *iter,
         }
 
         /* No overhead */
-        ret = print_graph_overhead(-1, s);
+        ret = print_graph_overhead(-1, s, flags);
         if (!ret)
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* No time */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION) {
+        if (flags & TRACE_GRAPH_PRINT_DURATION) {
                 ret = trace_seq_printf(s, "            |  ");
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -768,7 +793,7 @@ print_graph_entry_nested(struct trace_iterator *iter,
 
 static enum print_line_t
 print_graph_prologue(struct trace_iterator *iter, struct trace_seq *s,
-                     int type, unsigned long addr)
+                     int type, unsigned long addr, u32 flags)
 {
         struct fgraph_data *data = iter->private;
         struct trace_entry *ent = iter->ent;
@@ -781,27 +806,27 @@ print_graph_prologue(struct trace_iterator *iter, struct trace_seq *s,
 
         if (type) {
                 /* Interrupt */
-                ret = print_graph_irq(iter, addr, type, cpu, ent->pid);
+                ret = print_graph_irq(iter, addr, type, cpu, ent->pid, flags);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
         /* Absolute time */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME) {
+        if (flags & TRACE_GRAPH_PRINT_ABS_TIME) {
                 ret = print_graph_abs_time(iter->ts, s);
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
         /* Cpu */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU) {
+        if (flags & TRACE_GRAPH_PRINT_CPU) {
                 ret = print_graph_cpu(s, cpu);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
         /* Proc */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC) {
+        if (flags & TRACE_GRAPH_PRINT_PROC) {
                 ret = print_graph_proc(s, ent->pid);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -823,7 +848,7 @@ print_graph_prologue(struct trace_iterator *iter, struct trace_seq *s,
 
 static enum print_line_t
 print_graph_entry(struct ftrace_graph_ent_entry *field, struct trace_seq *s,
-                        struct trace_iterator *iter)
+                        struct trace_iterator *iter, u32 flags)
 {
         struct fgraph_data *data = iter->private;
         struct ftrace_graph_ent *call = &field->graph_ent;
@@ -831,14 +856,14 @@ print_graph_entry(struct ftrace_graph_ent_entry *field, struct trace_seq *s,
         static enum print_line_t ret;
         int cpu = iter->cpu;
 
-        if (print_graph_prologue(iter, s, TRACE_GRAPH_ENT, call->func))
+        if (print_graph_prologue(iter, s, TRACE_GRAPH_ENT, call->func, flags))
                 return TRACE_TYPE_PARTIAL_LINE;
 
         leaf_ret = get_return_for_leaf(iter, field);
         if (leaf_ret)
-                ret = print_graph_entry_leaf(iter, field, leaf_ret, s);
+                ret = print_graph_entry_leaf(iter, field, leaf_ret, s, flags);
         else
-                ret = print_graph_entry_nested(iter, field, s, cpu);
+                ret = print_graph_entry_nested(iter, field, s, cpu, flags);
 
         if (data) {
                 /*
@@ -857,7 +882,8 @@ print_graph_entry(struct ftrace_graph_ent_entry *field, struct trace_seq *s,
 
 static enum print_line_t
 print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
-                   struct trace_entry *ent, struct trace_iterator *iter)
+                   struct trace_entry *ent, struct trace_iterator *iter,
+                   u32 flags)
 {
         unsigned long long duration = trace->rettime - trace->calltime;
         struct fgraph_data *data = iter->private;
@@ -887,16 +913,16 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
                 }
         }
 
-        if (print_graph_prologue(iter, s, 0, 0))
+        if (print_graph_prologue(iter, s, 0, 0, flags))
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* Overhead */
-        ret = print_graph_overhead(duration, s);
+        ret = print_graph_overhead(duration, s, flags);
         if (!ret)
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* Duration */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION) {
+        if (flags & TRACE_GRAPH_PRINT_DURATION) {
                 ret = print_graph_duration(duration, s);
                 if (ret == TRACE_TYPE_PARTIAL_LINE)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -920,20 +946,21 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
         } else {
-                ret = trace_seq_printf(s, "} (%ps)\n", (void *)trace->func);
+                ret = trace_seq_printf(s, "} /* %ps */\n", (void *)trace->func);
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
         /* Overrun */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_OVERRUN) {
+        if (flags & TRACE_GRAPH_PRINT_OVERRUN) {
                 ret = trace_seq_printf(s, " (Overruns: %lu)\n",
                                         trace->overrun);
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
         }
 
-        ret = print_graph_irq(iter, trace->func, TRACE_GRAPH_RET, cpu, pid);
+        ret = print_graph_irq(iter, trace->func, TRACE_GRAPH_RET,
+                              cpu, pid, flags);
         if (ret == TRACE_TYPE_PARTIAL_LINE)
                 return TRACE_TYPE_PARTIAL_LINE;
 
@@ -941,8 +968,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
 }
 
 static enum print_line_t
-print_graph_comment(struct trace_seq *s,  struct trace_entry *ent,
-                    struct trace_iterator *iter)
+print_graph_comment(struct trace_seq *s, struct trace_entry *ent,
+                    struct trace_iterator *iter, u32 flags)
 {
         unsigned long sym_flags = (trace_flags & TRACE_ITER_SYM_MASK);
         struct fgraph_data *data = iter->private;
@@ -954,16 +981,16 @@ print_graph_comment(struct trace_seq *s,  struct trace_entry *ent,
         if (data)
                 depth = per_cpu_ptr(data->cpu_data, iter->cpu)->depth;
 
-        if (print_graph_prologue(iter, s, 0, 0))
+        if (print_graph_prologue(iter, s, 0, 0, flags))
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* No overhead */
-        ret = print_graph_overhead(-1, s);
+        ret = print_graph_overhead(-1, s, flags);
         if (!ret)
                 return TRACE_TYPE_PARTIAL_LINE;
 
         /* No time */
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION) {
+        if (flags & TRACE_GRAPH_PRINT_DURATION) {
                 ret = trace_seq_printf(s, "            |  ");
                 if (!ret)
                         return TRACE_TYPE_PARTIAL_LINE;
@@ -1018,7 +1045,7 @@ print_graph_comment(struct trace_seq *s,  struct trace_entry *ent,
 
 
 enum print_line_t
-print_graph_function(struct trace_iterator *iter)
+print_graph_function_flags(struct trace_iterator *iter, u32 flags)
 {
         struct ftrace_graph_ent_entry *field;
         struct fgraph_data *data = iter->private;
@@ -1039,7 +1066,7 @@ print_graph_function(struct trace_iterator *iter)
         if (data && data->failed) {
                 field = &data->ent;
                 iter->cpu = data->cpu;
-                ret = print_graph_entry(field, s, iter);
+                ret = print_graph_entry(field, s, iter, flags);
                 if (ret == TRACE_TYPE_HANDLED && iter->cpu != cpu) {
                         per_cpu_ptr(data->cpu_data, iter->cpu)->ignore = 1;
                         ret = TRACE_TYPE_NO_CONSUME;
@@ -1059,32 +1086,49 @@ print_graph_function(struct trace_iterator *iter)
                 struct ftrace_graph_ent_entry saved;
                 trace_assign_type(field, entry);
                 saved = *field;
-                return print_graph_entry(&saved, s, iter);
+                return print_graph_entry(&saved, s, iter, flags);
         }
         case TRACE_GRAPH_RET: {
                 struct ftrace_graph_ret_entry *field;
                 trace_assign_type(field, entry);
-                return print_graph_return(&field->ret, s, entry, iter);
+                return print_graph_return(&field->ret, s, entry, iter, flags);
         }
+        case TRACE_STACK:
+        case TRACE_FN:
+                /* dont trace stack and functions as comments */
+                return TRACE_TYPE_UNHANDLED;
+
         default:
-                return print_graph_comment(s, entry, iter);
+                return print_graph_comment(s, entry, iter, flags);
         }
 
         return TRACE_TYPE_HANDLED;
 }
 
-static void print_lat_header(struct seq_file *s)
+static enum print_line_t
+print_graph_function(struct trace_iterator *iter)
+{
+        return print_graph_function_flags(iter, tracer_flags.val);
+}
+
+static enum print_line_t
+print_graph_function_event(struct trace_iterator *iter, int flags)
+{
+        return print_graph_function(iter);
+}
+
+static void print_lat_header(struct seq_file *s, u32 flags)
 {
         static const char spaces[] = "                " /* 16 spaces */
                 "    "                                  /* 4 spaces */
                 "                 ";                    /* 17 spaces */
         int size = 0;
 
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME)
+        if (flags & TRACE_GRAPH_PRINT_ABS_TIME)
                 size += 16;
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU)
+        if (flags & TRACE_GRAPH_PRINT_CPU)
                 size += 4;
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC)
+        if (flags & TRACE_GRAPH_PRINT_PROC)
                 size += 17;
 
         seq_printf(s, "#%.*s  _-----=> irqs-off        \n", size, spaces);
@@ -1095,43 +1139,48 @@ static void print_lat_header(struct seq_file *s)
         seq_printf(s, "#%.*s|||| /                     \n", size, spaces);
 }
 
-static void print_graph_headers(struct seq_file *s)
+void print_graph_headers_flags(struct seq_file *s, u32 flags)
 {
         int lat = trace_flags & TRACE_ITER_LATENCY_FMT;
 
         if (lat)
-                print_lat_header(s);
+                print_lat_header(s, flags);
 
         /* 1st line */
         seq_printf(s, "#");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME)
+        if (flags & TRACE_GRAPH_PRINT_ABS_TIME)
                 seq_printf(s, "     TIME       ");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU)
+        if (flags & TRACE_GRAPH_PRINT_CPU)
                 seq_printf(s, " CPU");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC)
+        if (flags & TRACE_GRAPH_PRINT_PROC)
                 seq_printf(s, "  TASK/PID       ");
         if (lat)
                 seq_printf(s, "|||||");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION)
+        if (flags & TRACE_GRAPH_PRINT_DURATION)
                 seq_printf(s, "  DURATION   ");
         seq_printf(s, "               FUNCTION CALLS\n");
 
         /* 2nd line */
         seq_printf(s, "#");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME)
+        if (flags & TRACE_GRAPH_PRINT_ABS_TIME)
                 seq_printf(s, "      |         ");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU)
+        if (flags & TRACE_GRAPH_PRINT_CPU)
                 seq_printf(s, " |  ");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC)
+        if (flags & TRACE_GRAPH_PRINT_PROC)
                 seq_printf(s, "   |    |        ");
         if (lat)
                 seq_printf(s, "|||||");
-        if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION)
+        if (flags & TRACE_GRAPH_PRINT_DURATION)
                 seq_printf(s, "   |   |      ");
         seq_printf(s, "               |   |   |   |\n");
 }
 
-static void graph_trace_open(struct trace_iterator *iter)
+void print_graph_headers(struct seq_file *s)
+{
+        print_graph_headers_flags(s, tracer_flags.val);
+}
+
+void graph_trace_open(struct trace_iterator *iter)
 {
         /* pid and depth on the last trace processed */
         struct fgraph_data *data;
@@ -1166,7 +1215,7 @@ static void graph_trace_open(struct trace_iterator *iter)
         pr_warning("function graph tracer: not enough memory\n");
 }
 
-static void graph_trace_close(struct trace_iterator *iter)
+void graph_trace_close(struct trace_iterator *iter)
 {
         struct fgraph_data *data = iter->private;
 
@@ -1176,6 +1225,16 @@ static void graph_trace_close(struct trace_iterator *iter)
         }
 }
 
+static struct trace_event graph_trace_entry_event = {
+        .type           = TRACE_GRAPH_ENT,
+        .trace          = print_graph_function_event,
+};
+
+static struct trace_event graph_trace_ret_event = {
+        .type           = TRACE_GRAPH_RET,
+        .trace          = print_graph_function_event,
+};
+
 static struct tracer graph_trace __read_mostly = {
         .name           = "function_graph",
         .open           = graph_trace_open,
@@ -1197,6 +1256,16 @@ static __init int init_graph_trace(void)
 {
         max_bytes_for_cpu = snprintf(NULL, 0, "%d", nr_cpu_ids - 1);
 
+        if (!register_ftrace_event(&graph_trace_entry_event)) {
+                pr_warning("Warning: could not register graph trace events\n");
+                return 1;
+        }
+
+        if (!register_ftrace_event(&graph_trace_ret_event)) {
+                pr_warning("Warning: could not register graph trace events\n");
+                return 1;
+        }
+
         return register_tracer(&graph_trace);
 }
 
diff --git a/kernel/trace/trace_hw_branches.c b/kernel/trace/trace_hw_branches.c
deleted file mode 100644
index 7b97000745f5..000000000000
--- a/kernel/trace/trace_hw_branches.c
+++ /dev/null
@@ -1,312 +0,0 @@
-/*
- * h/w branch tracer for x86 based on BTS
- *
- * Copyright (C) 2008-2009 Intel Corporation.
- * Markus Metzger <markus.t.metzger@gmail.com>, 2008-2009
- */
-#include <linux/kallsyms.h>
-#include <linux/debugfs.h>
-#include <linux/ftrace.h>
-#include <linux/module.h>
-#include <linux/cpu.h>
-#include <linux/smp.h>
-#include <linux/fs.h>
-
-#include <asm/ds.h>
-
-#include "trace_output.h"
-#include "trace.h"
-
-
-#define BTS_BUFFER_SIZE (1 << 13)
-
-static DEFINE_PER_CPU(struct bts_tracer *, hwb_tracer);
-static DEFINE_PER_CPU(unsigned char[BTS_BUFFER_SIZE], hwb_buffer);
-
-#define this_tracer per_cpu(hwb_tracer, smp_processor_id())
-
-static int trace_hw_branches_enabled __read_mostly;
-static int trace_hw_branches_suspended __read_mostly;
-static struct trace_array *hw_branch_trace __read_mostly;
-
-
-static void bts_trace_init_cpu(int cpu)
-{
-        per_cpu(hwb_tracer, cpu) =
-                ds_request_bts_cpu(cpu, per_cpu(hwb_buffer, cpu),
-                                   BTS_BUFFER_SIZE, NULL, (size_t)-1,
-                                   BTS_KERNEL);
-
-        if (IS_ERR(per_cpu(hwb_tracer, cpu)))
-                per_cpu(hwb_tracer, cpu) = NULL;
-}
-
-static int bts_trace_init(struct trace_array *tr)
-{
-        int cpu;
-
-        hw_branch_trace = tr;
-        trace_hw_branches_enabled = 0;
-
-        get_online_cpus();
-        for_each_online_cpu(cpu) {
-                bts_trace_init_cpu(cpu);
-
-                if (likely(per_cpu(hwb_tracer, cpu)))
-                        trace_hw_branches_enabled = 1;
-        }
-        trace_hw_branches_suspended = 0;
-        put_online_cpus();
-
-        /* If we could not enable tracing on a single cpu, we fail. */
-        return trace_hw_branches_enabled ? 0 : -EOPNOTSUPP;
-}
-
-static void bts_trace_reset(struct trace_array *tr)
-{
-        int cpu;
-
-        get_online_cpus();
-        for_each_online_cpu(cpu) {
-                if (likely(per_cpu(hwb_tracer, cpu))) {
-                        ds_release_bts(per_cpu(hwb_tracer, cpu));
-                        per_cpu(hwb_tracer, cpu) = NULL;
-                }
-        }
-        trace_hw_branches_enabled = 0;
-        trace_hw_branches_suspended = 0;
-        put_online_cpus();
-}
-
-static void bts_trace_start(struct trace_array *tr)
-{
-        int cpu;
-
-        get_online_cpus();
-        for_each_online_cpu(cpu)
-                if (likely(per_cpu(hwb_tracer, cpu)))
-                        ds_resume_bts(per_cpu(hwb_tracer, cpu));
-        trace_hw_branches_suspended = 0;
-        put_online_cpus();
-}
-
-static void bts_trace_stop(struct trace_array *tr)
-{
-        int cpu;
-
-        get_online_cpus();
-        for_each_online_cpu(cpu)
-                if (likely(per_cpu(hwb_tracer, cpu)))
-                        ds_suspend_bts(per_cpu(hwb_tracer, cpu));
-        trace_hw_branches_suspended = 1;
-        put_online_cpus();
-}
-
-static int __cpuinit bts_hotcpu_handler(struct notifier_block *nfb,
-                                     unsigned long action, void *hcpu)
-{
-        int cpu = (long)hcpu;
-
-        switch (action) {
-        case CPU_ONLINE:
-        case CPU_DOWN_FAILED:
-                /* The notification is sent with interrupts enabled. */
-                if (trace_hw_branches_enabled) {
-                        bts_trace_init_cpu(cpu);
-
-                        if (trace_hw_branches_suspended &&
-                            likely(per_cpu(hwb_tracer, cpu)))
-                                ds_suspend_bts(per_cpu(hwb_tracer, cpu));
-                }
-                break;
-
-        case CPU_DOWN_PREPARE:
-                /* The notification is sent with interrupts enabled. */
-                if (likely(per_cpu(hwb_tracer, cpu))) {
-                        ds_release_bts(per_cpu(hwb_tracer, cpu));
-                        per_cpu(hwb_tracer, cpu) = NULL;
-                }
-        }
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block bts_hotcpu_notifier __cpuinitdata = {
-        .notifier_call = bts_hotcpu_handler
-};
-
-static void bts_trace_print_header(struct seq_file *m)
-{
-        seq_puts(m, "# CPU#        TO  <-  FROM\n");
-}
-
-static enum print_line_t bts_trace_print_line(struct trace_iterator *iter)
-{
-        unsigned long symflags = TRACE_ITER_SYM_OFFSET;
-        struct trace_entry *entry = iter->ent;
-        struct trace_seq *seq = &iter->seq;
-        struct hw_branch_entry *it;
-
-        trace_assign_type(it, entry);
-
-        if (entry->type == TRACE_HW_BRANCHES) {
-                if (trace_seq_printf(seq, "%4d  ", iter->cpu) &&
-                    seq_print_ip_sym(seq, it->to, symflags) &&
-                    trace_seq_printf(seq, "\t  <-  ") &&
-                    seq_print_ip_sym(seq, it->from, symflags) &&
-                    trace_seq_printf(seq, "\n"))
-                        return TRACE_TYPE_HANDLED;
-                return TRACE_TYPE_PARTIAL_LINE;
-        }
-        return TRACE_TYPE_UNHANDLED;
-}
-
-void trace_hw_branch(u64 from, u64 to)
-{
-        struct ftrace_event_call *call = &event_hw_branch;
-        struct trace_array *tr = hw_branch_trace;
-        struct ring_buffer_event *event;
-        struct ring_buffer *buf;
-        struct hw_branch_entry *entry;
-        unsigned long irq1;
-        int cpu;
-
-        if (unlikely(!tr))
-                return;
-
-        if (unlikely(!trace_hw_branches_enabled))
-                return;
-
-        local_irq_save(irq1);
-        cpu = raw_smp_processor_id();
-        if (atomic_inc_return(&tr->data[cpu]->disabled) != 1)
-                goto out;
-
-        buf = tr->buffer;
-        event = trace_buffer_lock_reserve(buf, TRACE_HW_BRANCHES,
-                                          sizeof(*entry), 0, 0);
-        if (!event)
-                goto out;
-        entry   = ring_buffer_event_data(event);
-        tracing_generic_entry_update(&entry->ent, 0, from);
-        entry->ent.type = TRACE_HW_BRANCHES;
-        entry->from = from;
-        entry->to   = to;
-        if (!filter_check_discard(call, entry, buf, event))
-                trace_buffer_unlock_commit(buf, event, 0, 0);
-
- out:
-        atomic_dec(&tr->data[cpu]->disabled);
-        local_irq_restore(irq1);
-}
-
-static void trace_bts_at(const struct bts_trace *trace, void *at)
-{
-        struct bts_struct bts;
-        int err = 0;
-
-        WARN_ON_ONCE(!trace->read);
-        if (!trace->read)
-                return;
-
-        err = trace->read(this_tracer, at, &bts);
-        if (err < 0)
-                return;
-
-        switch (bts.qualifier) {
-        case BTS_BRANCH:
-                trace_hw_branch(bts.variant.lbr.from, bts.variant.lbr.to);
-                break;
-        }
-}
-
-/*
- * Collect the trace on the current cpu and write it into the ftrace buffer.
- *
- * pre: tracing must be suspended on the current cpu
- */
-static void trace_bts_cpu(void *arg)
-{
-        struct trace_array *tr = (struct trace_array *)arg;
-        const struct bts_trace *trace;
-        unsigned char *at;
-
-        if (unlikely(!tr))
-                return;
-
-        if (unlikely(atomic_read(&tr->data[raw_smp_processor_id()]->disabled)))
-                return;
-
-        if (unlikely(!this_tracer))
-                return;
-
-        trace = ds_read_bts(this_tracer);
-        if (!trace)
-                return;
-
-        for (at = trace->ds.top; (void *)at < trace->ds.end;
-             at += trace->ds.size)
-                trace_bts_at(trace, at);
-
-        for (at = trace->ds.begin; (void *)at < trace->ds.top;
-             at += trace->ds.size)
-                trace_bts_at(trace, at);
-}
-
-static void trace_bts_prepare(struct trace_iterator *iter)
-{
-        int cpu;
-
-        get_online_cpus();
-        for_each_online_cpu(cpu)
-                if (likely(per_cpu(hwb_tracer, cpu)))
-                        ds_suspend_bts(per_cpu(hwb_tracer, cpu));
-        /*
-         * We need to collect the trace on the respective cpu since ftrace
-         * implicitly adds the record for the current cpu.
-         * Once that is more flexible, we could collect the data from any cpu.
-         */
-        on_each_cpu(trace_bts_cpu, iter->tr, 1);
-
-        for_each_online_cpu(cpu)
-                if (likely(per_cpu(hwb_tracer, cpu)))
-                        ds_resume_bts(per_cpu(hwb_tracer, cpu));
-        put_online_cpus();
-}
-
-static void trace_bts_close(struct trace_iterator *iter)
-{
-        tracing_reset_online_cpus(iter->tr);
-}
-
-void trace_hw_branch_oops(void)
-{
-        if (this_tracer) {
-                ds_suspend_bts_noirq(this_tracer);
-                trace_bts_cpu(hw_branch_trace);
-                ds_resume_bts_noirq(this_tracer);
-        }
-}
-
-struct tracer bts_tracer __read_mostly =
-{
-        .name           = "hw-branch-tracer",
-        .init           = bts_trace_init,
-        .reset          = bts_trace_reset,
-        .print_header   = bts_trace_print_header,
-        .print_line     = bts_trace_print_line,
-        .start          = bts_trace_start,
-        .stop           = bts_trace_stop,
-        .open           = trace_bts_prepare,
-        .close          = trace_bts_close,
-#ifdef CONFIG_FTRACE_SELFTEST
-        .selftest       = trace_selftest_startup_hw_branches,
-#endif /* CONFIG_FTRACE_SELFTEST */
-};
-
-__init static int init_bts_trace(void)
-{
-        register_hotcpu_notifier(&bts_hotcpu_notifier);
-        return register_tracer(&bts_tracer);
-}
-device_initcall(init_bts_trace);
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 2974bc7538c7..6fd486e0cef4 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -34,6 +34,9 @@ static int trace_type __read_mostly;
 
 static int save_lat_flag;
 
+static void stop_irqsoff_tracer(struct trace_array *tr, int graph);
+static int start_irqsoff_tracer(struct trace_array *tr, int graph);
+
 #ifdef CONFIG_PREEMPT_TRACER
 static inline int
 preempt_trace(void)
@@ -55,6 +58,23 @@ irq_trace(void)
 # define irq_trace() (0)
 #endif
 
+#define TRACE_DISPLAY_GRAPH     1
+
+static struct tracer_opt trace_opts[] = {
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* display latency trace as call graph */
+        { TRACER_OPT(display-graph, TRACE_DISPLAY_GRAPH) },
+#endif
+        { } /* Empty entry */
+};
+
+static struct tracer_flags tracer_flags = {
+        .val  = 0,
+        .opts = trace_opts,
+};
+
+#define is_graph() (tracer_flags.val & TRACE_DISPLAY_GRAPH)
+
 /*
  * Sequence count - we record it when starting a measurement and
  * skip the latency if the sequence has changed - some other section
@@ -108,6 +128,202 @@ static struct ftrace_ops trace_ops __read_mostly =
 };
 #endif /* CONFIG_FUNCTION_TRACER */
 
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+static int irqsoff_set_flag(u32 old_flags, u32 bit, int set)
+{
+        int cpu;
+
+        if (!(bit & TRACE_DISPLAY_GRAPH))
+                return -EINVAL;
+
+        if (!(is_graph() ^ set))
+                return 0;
+
+        stop_irqsoff_tracer(irqsoff_trace, !set);
+
+        for_each_possible_cpu(cpu)
+                per_cpu(tracing_cpu, cpu) = 0;
+
+        tracing_max_latency = 0;
+        tracing_reset_online_cpus(irqsoff_trace);
+
+        return start_irqsoff_tracer(irqsoff_trace, set);
+}
+
+static int irqsoff_graph_entry(struct ftrace_graph_ent *trace)
+{
+        struct trace_array *tr = irqsoff_trace;
+        struct trace_array_cpu *data;
+        unsigned long flags;
+        long disabled;
+        int ret;
+        int cpu;
+        int pc;
+
+        cpu = raw_smp_processor_id();
+        if (likely(!per_cpu(tracing_cpu, cpu)))
+                return 0;
+
+        local_save_flags(flags);
+        /* slight chance to get a false positive on tracing_cpu */
+        if (!irqs_disabled_flags(flags))
+                return 0;
+
+        data = tr->data[cpu];
+        disabled = atomic_inc_return(&data->disabled);
+
+        if (likely(disabled == 1)) {
+                pc = preempt_count();
+                ret = __trace_graph_entry(tr, trace, flags, pc);
+        } else
+                ret = 0;
+
+        atomic_dec(&data->disabled);
+        return ret;
+}
+
+static void irqsoff_graph_return(struct ftrace_graph_ret *trace)
+{
+        struct trace_array *tr = irqsoff_trace;
+        struct trace_array_cpu *data;
+        unsigned long flags;
+        long disabled;
+        int cpu;
+        int pc;
+
+        cpu = raw_smp_processor_id();
+        if (likely(!per_cpu(tracing_cpu, cpu)))
+                return;
+
+        local_save_flags(flags);
+        /* slight chance to get a false positive on tracing_cpu */
+        if (!irqs_disabled_flags(flags))
+                return;
+
+        data = tr->data[cpu];
+        disabled = atomic_inc_return(&data->disabled);
+
+        if (likely(disabled == 1)) {
+                pc = preempt_count();
+                __trace_graph_return(tr, trace, flags, pc);
+        }
+
+        atomic_dec(&data->disabled);
+}
+
+static void irqsoff_trace_open(struct trace_iterator *iter)
+{
+        if (is_graph())
+                graph_trace_open(iter);
+
+}
+
+static void irqsoff_trace_close(struct trace_iterator *iter)
+{
+        if (iter->private)
+                graph_trace_close(iter);
+}
+
+#define GRAPH_TRACER_FLAGS (TRACE_GRAPH_PRINT_CPU | \
+                            TRACE_GRAPH_PRINT_PROC)
+
+static enum print_line_t irqsoff_print_line(struct trace_iterator *iter)
+{
+        u32 flags = GRAPH_TRACER_FLAGS;
+
+        if (trace_flags & TRACE_ITER_LATENCY_FMT)
+                flags |= TRACE_GRAPH_PRINT_DURATION;
+        else
+                flags |= TRACE_GRAPH_PRINT_ABS_TIME;
+
+        /*
+         * In graph mode call the graph tracer output function,
+         * otherwise go with the TRACE_FN event handler
+         */
+        if (is_graph())
+                return print_graph_function_flags(iter, flags);
+
+        return TRACE_TYPE_UNHANDLED;
+}
+
+static void irqsoff_print_header(struct seq_file *s)
+{
+        if (is_graph()) {
+                struct trace_iterator *iter = s->private;
+                u32 flags = GRAPH_TRACER_FLAGS;
+
+                if (trace_flags & TRACE_ITER_LATENCY_FMT) {
+                        /* print nothing if the buffers are empty */
+                        if (trace_empty(iter))
+                                return;
+
+                        print_trace_header(s, iter);
+                        flags |= TRACE_GRAPH_PRINT_DURATION;
+                } else
+                        flags |= TRACE_GRAPH_PRINT_ABS_TIME;
+
+                print_graph_headers_flags(s, flags);
+        } else
+                trace_default_header(s);
+}
+
+static void
+trace_graph_function(struct trace_array *tr,
+                 unsigned long ip, unsigned long flags, int pc)
+{
+        u64 time = trace_clock_local();
+        struct ftrace_graph_ent ent = {
+                .func  = ip,
+                .depth = 0,
+        };
+        struct ftrace_graph_ret ret = {
+                .func     = ip,
+                .depth    = 0,
+                .calltime = time,
+                .rettime  = time,
+        };
+
+        __trace_graph_entry(tr, &ent, flags, pc);
+        __trace_graph_return(tr, &ret, flags, pc);
+}
+
+static void
+__trace_function(struct trace_array *tr,
+                 unsigned long ip, unsigned long parent_ip,
+                 unsigned long flags, int pc)
+{
+        if (!is_graph())
+                trace_function(tr, ip, parent_ip, flags, pc);
+        else {
+                trace_graph_function(tr, parent_ip, flags, pc);
+                trace_graph_function(tr, ip, flags, pc);
+        }
+}
+
+#else
+#define __trace_function trace_function
+
+static int irqsoff_set_flag(u32 old_flags, u32 bit, int set)
+{
+        return -EINVAL;
+}
+
+static int irqsoff_graph_entry(struct ftrace_graph_ent *trace)
+{
+        return -1;
+}
+
+static enum print_line_t irqsoff_print_line(struct trace_iterator *iter)
+{
+        return TRACE_TYPE_UNHANDLED;
+}
+
+static void irqsoff_graph_return(struct ftrace_graph_ret *trace) { }
+static void irqsoff_print_header(struct seq_file *s) { }
+static void irqsoff_trace_open(struct trace_iterator *iter) { }
+static void irqsoff_trace_close(struct trace_iterator *iter) { }
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
 /*
  * Should this new latency be reported/recorded?
  */
@@ -150,7 +366,7 @@ check_critical_timing(struct trace_array *tr,
         if (!report_latency(delta))
                 goto out_unlock;
 
-        trace_function(tr, CALLER_ADDR0, parent_ip, flags, pc);
+        __trace_function(tr, CALLER_ADDR0, parent_ip, flags, pc);
         /* Skip 5 functions to get to the irq/preempt enable function */
         __trace_stack(tr, flags, 5, pc);
 
@@ -172,7 +388,7 @@ out_unlock:
 out:
         data->critical_sequence = max_sequence;
         data->preempt_timestamp = ftrace_now(cpu);
-        trace_function(tr, CALLER_ADDR0, parent_ip, flags, pc);
+        __trace_function(tr, CALLER_ADDR0, parent_ip, flags, pc);
 }
 
 static inline void
@@ -204,7 +420,7 @@ start_critical_timing(unsigned long ip, unsigned long parent_ip)
 
         local_save_flags(flags);
 
-        trace_function(tr, ip, parent_ip, flags, preempt_count());
+        __trace_function(tr, ip, parent_ip, flags, preempt_count());
 
         per_cpu(tracing_cpu, cpu) = 1;
 
@@ -238,7 +454,7 @@ stop_critical_timing(unsigned long ip, unsigned long parent_ip)
         atomic_inc(&data->disabled);
 
         local_save_flags(flags);
-        trace_function(tr, ip, parent_ip, flags, preempt_count());
+        __trace_function(tr, ip, parent_ip, flags, preempt_count());
         check_critical_timing(tr, data, parent_ip ? : ip, cpu);
         data->critical_start = 0;
         atomic_dec(&data->disabled);
@@ -347,19 +563,32 @@ void trace_preempt_off(unsigned long a0, unsigned long a1)
 }
 #endif /* CONFIG_PREEMPT_TRACER */
 
-static void start_irqsoff_tracer(struct trace_array *tr)
+static int start_irqsoff_tracer(struct trace_array *tr, int graph)
 {
-        register_ftrace_function(&trace_ops);
-        if (tracing_is_enabled())
+        int ret = 0;
+
+        if (!graph)
+                ret = register_ftrace_function(&trace_ops);
+        else
+                ret = register_ftrace_graph(&irqsoff_graph_return,
+                                            &irqsoff_graph_entry);
+
+        if (!ret && tracing_is_enabled())
                 tracer_enabled = 1;
         else
                 tracer_enabled = 0;
+
+        return ret;
 }
 
-static void stop_irqsoff_tracer(struct trace_array *tr)
+static void stop_irqsoff_tracer(struct trace_array *tr, int graph)
 {
         tracer_enabled = 0;
-        unregister_ftrace_function(&trace_ops);
+
+        if (!graph)
+                unregister_ftrace_function(&trace_ops);
+        else
+                unregister_ftrace_graph();
 }
 
 static void __irqsoff_tracer_init(struct trace_array *tr)
@@ -372,12 +601,14 @@ static void __irqsoff_tracer_init(struct trace_array *tr)
         /* make sure that the tracer is visible */
         smp_wmb();
         tracing_reset_online_cpus(tr);
-        start_irqsoff_tracer(tr);
+
+        if (start_irqsoff_tracer(tr, is_graph()))
+                printk(KERN_ERR "failed to start irqsoff tracer\n");
 }
 
 static void irqsoff_tracer_reset(struct trace_array *tr)
 {
-        stop_irqsoff_tracer(tr);
+        stop_irqsoff_tracer(tr, is_graph());
 
         if (!save_lat_flag)
                 trace_flags &= ~TRACE_ITER_LATENCY_FMT;
@@ -409,9 +640,15 @@ static struct tracer irqsoff_tracer __read_mostly =
         .start          = irqsoff_tracer_start,
         .stop           = irqsoff_tracer_stop,
         .print_max      = 1,
+        .print_header   = irqsoff_print_header,
+        .print_line     = irqsoff_print_line,
+        .flags          = &tracer_flags,
+        .set_flag       = irqsoff_set_flag,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest    = trace_selftest_startup_irqsoff,
 #endif
+        .open           = irqsoff_trace_open,
+        .close          = irqsoff_trace_close,
 };
 # define register_irqsoff(trace) register_tracer(&trace)
 #else
@@ -435,9 +672,15 @@ static struct tracer preemptoff_tracer __read_mostly =
         .start          = irqsoff_tracer_start,
         .stop           = irqsoff_tracer_stop,
         .print_max      = 1,
+        .print_header   = irqsoff_print_header,
+        .print_line     = irqsoff_print_line,
+        .flags          = &tracer_flags,
+        .set_flag       = irqsoff_set_flag,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest    = trace_selftest_startup_preemptoff,
 #endif
+        .open           = irqsoff_trace_open,
+        .close          = irqsoff_trace_close,
 };
 # define register_preemptoff(trace) register_tracer(&trace)
 #else
@@ -463,9 +706,15 @@ static struct tracer preemptirqsoff_tracer __read_mostly =
         .start          = irqsoff_tracer_start,
         .stop           = irqsoff_tracer_stop,
         .print_max      = 1,
+        .print_header   = irqsoff_print_header,
+        .print_line     = irqsoff_print_line,
+        .flags          = &tracer_flags,
+        .set_flag       = irqsoff_set_flag,
 #ifdef CONFIG_FTRACE_SELFTEST
         .selftest    = trace_selftest_startup_preemptirqsoff,
 #endif
+        .open           = irqsoff_trace_open,
+        .close          = irqsoff_trace_close,
 };
 
 # define register_preemptirqsoff(trace) register_tracer(&trace)
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 505c92273b1a..a7514326052b 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -29,6 +29,8 @@
 #include <linux/ctype.h>
 #include <linux/ptrace.h>
 #include <linux/perf_event.h>
+#include <linux/stringify.h>
+#include <asm/bitsperlong.h>
 
 #include "trace.h"
 #include "trace_output.h"
@@ -40,7 +42,6 @@
 
 /* Reserved field names */
 #define FIELD_STRING_IP "__probe_ip"
-#define FIELD_STRING_NARGS "__probe_nargs"
 #define FIELD_STRING_RETIP "__probe_ret_ip"
 #define FIELD_STRING_FUNC "__probe_func"
 
@@ -52,56 +53,102 @@ const char *reserved_field_names[] = {
         "common_tgid",
         "common_lock_depth",
         FIELD_STRING_IP,
-        FIELD_STRING_NARGS,
         FIELD_STRING_RETIP,
         FIELD_STRING_FUNC,
 };
 
-struct fetch_func {
-        unsigned long (*func)(struct pt_regs *, void *);
+/* Printing function type */
+typedef int (*print_type_func_t)(struct trace_seq *, const char *, void *);
+#define PRINT_TYPE_FUNC_NAME(type)      print_type_##type
+#define PRINT_TYPE_FMT_NAME(type)       print_type_format_##type
+
+/* Printing  in basic type function template */
+#define DEFINE_BASIC_PRINT_TYPE_FUNC(type, fmt, cast)                   \
+static __kprobes int PRINT_TYPE_FUNC_NAME(type)(struct trace_seq *s,    \
+                                                const char *name, void *data)\
+{                                                                       \
+        return trace_seq_printf(s, " %s=" fmt, name, (cast)*(type *)data);\
+}                                                                       \
+static const char PRINT_TYPE_FMT_NAME(type)[] = fmt;
+
+DEFINE_BASIC_PRINT_TYPE_FUNC(u8, "%x", unsigned int)
+DEFINE_BASIC_PRINT_TYPE_FUNC(u16, "%x", unsigned int)
+DEFINE_BASIC_PRINT_TYPE_FUNC(u32, "%lx", unsigned long)
+DEFINE_BASIC_PRINT_TYPE_FUNC(u64, "%llx", unsigned long long)
+DEFINE_BASIC_PRINT_TYPE_FUNC(s8, "%d", int)
+DEFINE_BASIC_PRINT_TYPE_FUNC(s16, "%d", int)
+DEFINE_BASIC_PRINT_TYPE_FUNC(s32, "%ld", long)
+DEFINE_BASIC_PRINT_TYPE_FUNC(s64, "%lld", long long)
+
+/* Data fetch function type */
+typedef void (*fetch_func_t)(struct pt_regs *, void *, void *);
+
+struct fetch_param {
+        fetch_func_t    fn;
         void *data;
 };
 
-static __kprobes unsigned long call_fetch(struct fetch_func *f,
-                                          struct pt_regs *regs)
+static __kprobes void call_fetch(struct fetch_param *fprm,
+                                 struct pt_regs *regs, void *dest)
 {
-        return f->func(regs, f->data);
+        return fprm->fn(regs, fprm->data, dest);
 }
 
-/* fetch handlers */
-static __kprobes unsigned long fetch_register(struct pt_regs *regs,
-                                              void *offset)
-{
-        return regs_get_register(regs, (unsigned int)((unsigned long)offset));
+#define FETCH_FUNC_NAME(kind, type)     fetch_##kind##_##type
+/*
+ * Define macro for basic types - we don't need to define s* types, because
+ * we have to care only about bitwidth at recording time.
+ */
+#define DEFINE_BASIC_FETCH_FUNCS(kind)  \
+DEFINE_FETCH_##kind(u8)                 \
+DEFINE_FETCH_##kind(u16)                \
+DEFINE_FETCH_##kind(u32)                \
+DEFINE_FETCH_##kind(u64)
+
+#define CHECK_BASIC_FETCH_FUNCS(kind, fn)       \
+        ((FETCH_FUNC_NAME(kind, u8) == fn) ||   \
+         (FETCH_FUNC_NAME(kind, u16) == fn) ||  \
+         (FETCH_FUNC_NAME(kind, u32) == fn) ||  \
+         (FETCH_FUNC_NAME(kind, u64) == fn))
+
+/* Data fetch function templates */
+#define DEFINE_FETCH_reg(type)                                          \
+static __kprobes void FETCH_FUNC_NAME(reg, type)(struct pt_regs *regs,  \
+                                          void *offset, void *dest)     \
+{                                                                       \
+        *(type *)dest = (type)regs_get_register(regs,                   \
+                                (unsigned int)((unsigned long)offset)); \
 }
-
-static __kprobes unsigned long fetch_stack(struct pt_regs *regs,
-                                           void *num)
-{
-        return regs_get_kernel_stack_nth(regs,
-                                         (unsigned int)((unsigned long)num));
+DEFINE_BASIC_FETCH_FUNCS(reg)
+
+#define DEFINE_FETCH_stack(type)                                        \
+static __kprobes void FETCH_FUNC_NAME(stack, type)(struct pt_regs *regs,\
+                                          void *offset, void *dest)     \
+{                                                                       \
+        *(type *)dest = (type)regs_get_kernel_stack_nth(regs,           \
+                                (unsigned int)((unsigned long)offset)); \
 }
+DEFINE_BASIC_FETCH_FUNCS(stack)
 
-static __kprobes unsigned long fetch_memory(struct pt_regs *regs, void *addr)
-{
-        unsigned long retval;
-
-        if (probe_kernel_address(addr, retval))
-                return 0;
-        return retval;
+#define DEFINE_FETCH_retval(type)                                       \
+static __kprobes void FETCH_FUNC_NAME(retval, type)(struct pt_regs *regs,\
+                                          void *dummy, void *dest)      \
+{                                                                       \
+        *(type *)dest = (type)regs_return_value(regs);                  \
 }
-
-static __kprobes unsigned long fetch_retvalue(struct pt_regs *regs,
-                                              void *dummy)
-{
-        return regs_return_value(regs);
-}
-
-static __kprobes unsigned long fetch_stack_address(struct pt_regs *regs,
-                                                   void *dummy)
-{
-        return kernel_stack_pointer(regs);
+DEFINE_BASIC_FETCH_FUNCS(retval)
+
+#define DEFINE_FETCH_memory(type)                                       \
+static __kprobes void FETCH_FUNC_NAME(memory, type)(struct pt_regs *regs,\
+                                          void *addr, void *dest)       \
+{                                                                       \
+        type retval;                                                    \
+        if (probe_kernel_address(addr, retval))                         \
+                *(type *)dest = 0;                                      \
+        else                                                            \
+                *(type *)dest = retval;                                 \
 }
+DEFINE_BASIC_FETCH_FUNCS(memory)
 
 /* Memory fetching by symbol */
 struct symbol_cache {
@@ -145,51 +192,126 @@ static struct symbol_cache *alloc_symbol_cache(const char *sym, long offset)
         return sc;
 }
 
-static __kprobes unsigned long fetch_symbol(struct pt_regs *regs, void *data)
-{
-        struct symbol_cache *sc = data;
-
-        if (sc->addr)
-                return fetch_memory(regs, (void *)sc->addr);
-        else
-                return 0;
+#define DEFINE_FETCH_symbol(type)                                       \
+static __kprobes void FETCH_FUNC_NAME(symbol, type)(struct pt_regs *regs,\
+                                          void *data, void *dest)       \
+{                                                                       \
+        struct symbol_cache *sc = data;                                 \
+        if (sc->addr)                                                   \
+                fetch_memory_##type(regs, (void *)sc->addr, dest);      \
+        else                                                            \
+                *(type *)dest = 0;                                      \
 }
+DEFINE_BASIC_FETCH_FUNCS(symbol)
 
-/* Special indirect memory access interface */
-struct indirect_fetch_data {
-        struct fetch_func orig;
+/* Dereference memory access function */
+struct deref_fetch_param {
+        struct fetch_param orig;
         long offset;
 };
 
-static __kprobes unsigned long fetch_indirect(struct pt_regs *regs, void *data)
-{
-        struct indirect_fetch_data *ind = data;
-        unsigned long addr;
-
-        addr = call_fetch(&ind->orig, regs);
-        if (addr) {
-                addr += ind->offset;
-                return fetch_memory(regs, (void *)addr);
-        } else
-                return 0;
+#define DEFINE_FETCH_deref(type)                                        \
+static __kprobes void FETCH_FUNC_NAME(deref, type)(struct pt_regs *regs,\
+                                            void *data, void *dest)     \
+{                                                                       \
+        struct deref_fetch_param *dprm = data;                          \
+        unsigned long addr;                                             \
+        call_fetch(&dprm->orig, regs, &addr);                           \
+        if (addr) {                                                     \
+                addr += dprm->offset;                                   \
+                fetch_memory_##type(regs, (void *)addr, dest);          \
+        } else                                                          \
+                *(type *)dest = 0;                                      \
 }
+DEFINE_BASIC_FETCH_FUNCS(deref)
 
-static __kprobes void free_indirect_fetch_data(struct indirect_fetch_data *data)
+static __kprobes void free_deref_fetch_param(struct deref_fetch_param *data)
 {
-        if (data->orig.func == fetch_indirect)
-                free_indirect_fetch_data(data->orig.data);
-        else if (data->orig.func == fetch_symbol)
+        if (CHECK_BASIC_FETCH_FUNCS(deref, data->orig.fn))
+                free_deref_fetch_param(data->orig.data);
+        else if (CHECK_BASIC_FETCH_FUNCS(symbol, data->orig.fn))
                 free_symbol_cache(data->orig.data);
         kfree(data);
 }
 
+/* Default (unsigned long) fetch type */
+#define __DEFAULT_FETCH_TYPE(t) u##t
+#define _DEFAULT_FETCH_TYPE(t) __DEFAULT_FETCH_TYPE(t)
+#define DEFAULT_FETCH_TYPE _DEFAULT_FETCH_TYPE(BITS_PER_LONG)
+#define DEFAULT_FETCH_TYPE_STR __stringify(DEFAULT_FETCH_TYPE)
+
+#define ASSIGN_FETCH_FUNC(kind, type)   \
+        .kind = FETCH_FUNC_NAME(kind, type)
+
+#define ASSIGN_FETCH_TYPE(ptype, ftype, sign)   \
+        {.name = #ptype,                        \
+         .size = sizeof(ftype),                 \
+         .is_signed = sign,                     \
+         .print = PRINT_TYPE_FUNC_NAME(ptype),  \
+         .fmt = PRINT_TYPE_FMT_NAME(ptype),     \
+ASSIGN_FETCH_FUNC(reg, ftype),                  \
+ASSIGN_FETCH_FUNC(stack, ftype),                \
+ASSIGN_FETCH_FUNC(retval, ftype),               \
+ASSIGN_FETCH_FUNC(memory, ftype),               \
+ASSIGN_FETCH_FUNC(symbol, ftype),               \
+ASSIGN_FETCH_FUNC(deref, ftype),                \
+        }
+
+/* Fetch type information table */
+static const struct fetch_type {
+        const char      *name;          /* Name of type */
+        size_t          size;           /* Byte size of type */
+        int             is_signed;      /* Signed flag */
+        print_type_func_t       print;  /* Print functions */
+        const char      *fmt;           /* Fromat string */
+        /* Fetch functions */
+        fetch_func_t    reg;
+        fetch_func_t    stack;
+        fetch_func_t    retval;
+        fetch_func_t    memory;
+        fetch_func_t    symbol;
+        fetch_func_t    deref;
+} fetch_type_table[] = {
+        ASSIGN_FETCH_TYPE(u8,  u8,  0),
+        ASSIGN_FETCH_TYPE(u16, u16, 0),
+        ASSIGN_FETCH_TYPE(u32, u32, 0),
+        ASSIGN_FETCH_TYPE(u64, u64, 0),
+        ASSIGN_FETCH_TYPE(s8,  u8,  1),
+        ASSIGN_FETCH_TYPE(s16, u16, 1),
+        ASSIGN_FETCH_TYPE(s32, u32, 1),
+        ASSIGN_FETCH_TYPE(s64, u64, 1),
+};
+
+static const struct fetch_type *find_fetch_type(const char *type)
+{
+        int i;
+
+        if (!type)
+                type = DEFAULT_FETCH_TYPE_STR;
+
+        for (i = 0; i < ARRAY_SIZE(fetch_type_table); i++)
+                if (strcmp(type, fetch_type_table[i].name) == 0)
+                        return &fetch_type_table[i];
+        return NULL;
+}
+
+/* Special function : only accept unsigned long */
+static __kprobes void fetch_stack_address(struct pt_regs *regs,
+                                          void *dummy, void *dest)
+{
+        *(unsigned long *)dest = kernel_stack_pointer(regs);
+}
+
 /**
  * Kprobe event core functions
  */
 
 struct probe_arg {
-        struct fetch_func       fetch;
-        const char              *name;
+        struct fetch_param      fetch;
+        unsigned int            offset; /* Offset from argument entry */
+        const char              *name;  /* Name of this argument */
+        const char              *comm;  /* Command of this argument */
+        const struct fetch_type *type;  /* Type of this argument */
 };
 
 /* Flags for trace_probe */
@@ -204,6 +326,7 @@ struct trace_probe {
         const char              *symbol;        /* symbol name */
         struct ftrace_event_call        call;
         struct trace_event              event;
+        ssize_t                 size;           /* trace entry size */
         unsigned int            nr_args;
         struct probe_arg        args[];
 };
@@ -212,6 +335,7 @@ struct trace_probe {
         (offsetof(struct trace_probe, args) +   \
         (sizeof(struct probe_arg) * (n)))
 
+
 static __kprobes int probe_is_return(struct trace_probe *tp)
 {
         return tp->rp.handler != NULL;
@@ -222,49 +346,6 @@ static __kprobes const char *probe_symbol(struct trace_probe *tp)
         return tp->symbol ? tp->symbol : "unknown";
 }
 
-static int probe_arg_string(char *buf, size_t n, struct fetch_func *ff)
-{
-        int ret = -EINVAL;
-
-        if (ff->func == fetch_register) {
-                const char *name;
-                name = regs_query_register_name((unsigned int)((long)ff->data));
-                ret = snprintf(buf, n, "%%%s", name);
-        } else if (ff->func == fetch_stack)
-                ret = snprintf(buf, n, "$stack%lu", (unsigned long)ff->data);
-        else if (ff->func == fetch_memory)
-                ret = snprintf(buf, n, "@0x%p", ff->data);
-        else if (ff->func == fetch_symbol) {
-                struct symbol_cache *sc = ff->data;
-                if (sc->offset)
-                        ret = snprintf(buf, n, "@%s%+ld", sc->symbol,
-                                        sc->offset);
-                else
-                        ret = snprintf(buf, n, "@%s", sc->symbol);
-        } else if (ff->func == fetch_retvalue)
-                ret = snprintf(buf, n, "$retval");
-        else if (ff->func == fetch_stack_address)
-                ret = snprintf(buf, n, "$stack");
-        else if (ff->func == fetch_indirect) {
-                struct indirect_fetch_data *id = ff->data;
-                size_t l = 0;
-                ret = snprintf(buf, n, "%+ld(", id->offset);
-                if (ret >= n)
-                        goto end;
-                l += ret;
-                ret = probe_arg_string(buf + l, n - l, &id->orig);
-                if (ret < 0)
-                        goto end;
-                l += ret;
-                ret = snprintf(buf + l, n - l, ")");
-                ret += l;
-        }
-end:
-        if (ret >= n)
-                return -ENOSPC;
-        return ret;
-}
-
 static int register_probe_event(struct trace_probe *tp);
 static void unregister_probe_event(struct trace_probe *tp);
 
@@ -347,11 +428,12 @@ error:
 
 static void free_probe_arg(struct probe_arg *arg)
 {
-        if (arg->fetch.func == fetch_symbol)
+        if (CHECK_BASIC_FETCH_FUNCS(deref, arg->fetch.fn))
+                free_deref_fetch_param(arg->fetch.data);
+        else if (CHECK_BASIC_FETCH_FUNCS(symbol, arg->fetch.fn))
                 free_symbol_cache(arg->fetch.data);
-        else if (arg->fetch.func == fetch_indirect)
-                free_indirect_fetch_data(arg->fetch.data);
         kfree(arg->name);
+        kfree(arg->comm);
 }
 
 static void free_trace_probe(struct trace_probe *tp)
@@ -457,28 +539,30 @@ static int split_symbol_offset(char *symbol, unsigned long *offset)
 #define PARAM_MAX_ARGS 16
 #define PARAM_MAX_STACK (THREAD_SIZE / sizeof(unsigned long))
 
-static int parse_probe_vars(char *arg, struct fetch_func *ff, int is_return)
+static int parse_probe_vars(char *arg, const struct fetch_type *t,
+                            struct fetch_param *f, int is_return)
 {
         int ret = 0;
         unsigned long param;
 
         if (strcmp(arg, "retval") == 0) {
-                if (is_return) {
-                        ff->func = fetch_retvalue;
-                        ff->data = NULL;
-                } else
+                if (is_return)
+                        f->fn = t->retval;
+                else
                         ret = -EINVAL;
         } else if (strncmp(arg, "stack", 5) == 0) {
                 if (arg[5] == '\0') {
-                        ff->func = fetch_stack_address;
-                        ff->data = NULL;
+                        if (strcmp(t->name, DEFAULT_FETCH_TYPE_STR) == 0)
+                                f->fn = fetch_stack_address;
+                        else
+                                ret = -EINVAL;
                 } else if (isdigit(arg[5])) {
                         ret = strict_strtoul(arg + 5, 10, &param);
                         if (ret || param > PARAM_MAX_STACK)
                                 ret = -EINVAL;
                         else {
-                                ff->func = fetch_stack;
-                                ff->data = (void *)param;
+                                f->fn = t->stack;
+                                f->data = (void *)param;
                         }
                 } else
                         ret = -EINVAL;
@@ -488,7 +572,8 @@ static int parse_probe_vars(char *arg, struct fetch_func *ff, int is_return)
 }
 
 /* Recursive argument parser */
-static int __parse_probe_arg(char *arg, struct fetch_func *ff, int is_return)
+static int __parse_probe_arg(char *arg, const struct fetch_type *t,
+                             struct fetch_param *f, int is_return)
 {
         int ret = 0;
         unsigned long param;
@@ -497,13 +582,13 @@ static int __parse_probe_arg(char *arg, struct fetch_func *ff, int is_return)
 
         switch (arg[0]) {
         case '$':
-                ret = parse_probe_vars(arg + 1, ff, is_return);
+                ret = parse_probe_vars(arg + 1, t, f, is_return);
                 break;
         case '%':       /* named register */
                 ret = regs_query_register_offset(arg + 1);
                 if (ret >= 0) {
-                        ff->func = fetch_register;
-                        ff->data = (void *)(unsigned long)ret;
+                        f->fn = t->reg;
+                        f->data = (void *)(unsigned long)ret;
                         ret = 0;
                 }
                 break;
@@ -512,26 +597,22 @@ static int __parse_probe_arg(char *arg, struct fetch_func *ff, int is_return)
                         ret = strict_strtoul(arg + 1, 0, &param);
                         if (ret)
                                 break;
-                        ff->func = fetch_memory;
-                        ff->data = (void *)param;
+                        f->fn = t->memory;
+                        f->data = (void *)param;
                 } else {
                         ret = split_symbol_offset(arg + 1, &offset);
                         if (ret)
                                 break;
-                        ff->data = alloc_symbol_cache(arg + 1, offset);
-                        if (ff->data)
-                                ff->func = fetch_symbol;
-                        else
-                                ret = -EINVAL;
+                        f->data = alloc_symbol_cache(arg + 1, offset);
+                        if (f->data)
+                                f->fn = t->symbol;
                 }
                 break;
-        case '+':       /* indirect memory */
+        case '+':       /* deref memory */
         case '-':
                 tmp = strchr(arg, '(');
-                if (!tmp) {
-                        ret = -EINVAL;
+                if (!tmp)
                         break;
-                }
                 *tmp = '\0';
                 ret = strict_strtol(arg + 1, 0, &offset);
                 if (ret)
@@ -541,38 +622,58 @@ static int __parse_probe_arg(char *arg, struct fetch_func *ff, int is_return)
                 arg = tmp + 1;
                 tmp = strrchr(arg, ')');
                 if (tmp) {
-                        struct indirect_fetch_data *id;
+                        struct deref_fetch_param *dprm;
+                        const struct fetch_type *t2 = find_fetch_type(NULL);
                         *tmp = '\0';
-                        id = kzalloc(sizeof(struct indirect_fetch_data),
-                                     GFP_KERNEL);
-                        if (!id)
+                        dprm = kzalloc(sizeof(struct deref_fetch_param),
+                                       GFP_KERNEL);
+                        if (!dprm)
                                 return -ENOMEM;
-                        id->offset = offset;
-                        ret = __parse_probe_arg(arg, &id->orig, is_return);
+                        dprm->offset = offset;
+                        ret = __parse_probe_arg(arg, t2, &dprm->orig,
+                                                is_return);
                         if (ret)
-                                kfree(id);
+                                kfree(dprm);
                         else {
-                                ff->func = fetch_indirect;
-                                ff->data = (void *)id;
+                                f->fn = t->deref;
+                                f->data = (void *)dprm;
                         }
-                } else
-                        ret = -EINVAL;
+                }
                 break;
-        default:
-                /* TODO: support custom handler */
-                ret = -EINVAL;
         }
+        if (!ret && !f->fn)
+                ret = -EINVAL;
         return ret;
 }
 
 /* String length checking wrapper */
-static int parse_probe_arg(char *arg, struct fetch_func *ff, int is_return)
+static int parse_probe_arg(char *arg, struct trace_probe *tp,
+                           struct probe_arg *parg, int is_return)
 {
+        const char *t;
+
         if (strlen(arg) > MAX_ARGSTR_LEN) {
                 pr_info("Argument is too long.: %s\n",  arg);
                 return -ENOSPC;
         }
-        return __parse_probe_arg(arg, ff, is_return);
+        parg->comm = kstrdup(arg, GFP_KERNEL);
+        if (!parg->comm) {
+                pr_info("Failed to allocate memory for command '%s'.\n", arg);
+                return -ENOMEM;
+        }
+        t = strchr(parg->comm, ':');
+        if (t) {
+                arg[t - parg->comm] = '\0';
+                t++;
+        }
+        parg->type = find_fetch_type(t);
+        if (!parg->type) {
+                pr_info("Unsupported type: %s\n", t);
+                return -EINVAL;
+        }
+        parg->offset = tp->size;
+        tp->size += parg->type->size;
+        return __parse_probe_arg(arg, parg->type, &parg->fetch, is_return);
 }
 
 /* Return 1 if name is reserved or already used by another argument */
@@ -602,15 +703,18 @@ static int create_trace_probe(int argc, char **argv)
          *  @ADDR       : fetch memory at ADDR (ADDR should be in kernel)
          *  @SYM[+|-offs] : fetch memory at SYM +|- offs (SYM is a data symbol)
          *  %REG        : fetch register REG
-         * Indirect memory fetch:
+         * Dereferencing memory fetch:
          *  +|-offs(ARG) : fetch memory at ARG +|- offs address.
          * Alias name of args:
          *  NAME=FETCHARG : set NAME as alias of FETCHARG.
+         * Type of args:
+         *  FETCHARG:TYPE : use TYPE instead of unsigned long.
          */
         struct trace_probe *tp;
         int i, ret = 0;
         int is_return = 0, is_delete = 0;
-        char *symbol = NULL, *event = NULL, *arg = NULL, *group = NULL;
+        char *symbol = NULL, *event = NULL, *group = NULL;
+        char *arg, *tmp;
         unsigned long offset = 0;
         void *addr = NULL;
         char buf[MAX_EVENT_NAME_LEN];
@@ -723,13 +827,6 @@ static int create_trace_probe(int argc, char **argv)
                 else
                         arg = argv[i];
 
-                if (conflict_field_name(argv[i], tp->args, i)) {
-                        pr_info("Argument%d name '%s' conflicts with "
-                                "another field.\n", i, argv[i]);
-                        ret = -EINVAL;
-                        goto error;
-                }
-
                 tp->args[i].name = kstrdup(argv[i], GFP_KERNEL);
                 if (!tp->args[i].name) {
                         pr_info("Failed to allocate argument%d name '%s'.\n",
@@ -737,9 +834,19 @@ static int create_trace_probe(int argc, char **argv)
                         ret = -ENOMEM;
                         goto error;
                 }
+                tmp = strchr(tp->args[i].name, ':');
+                if (tmp)
+                        *tmp = '_';     /* convert : to _ */
+
+                if (conflict_field_name(tp->args[i].name, tp->args, i)) {
+                        pr_info("Argument%d name '%s' conflicts with "
+                                "another field.\n", i, argv[i]);
+                        ret = -EINVAL;
+                        goto error;
+                }
 
                 /* Parse fetch argument */
-                ret = parse_probe_arg(arg, &tp->args[i].fetch, is_return);
+                ret = parse_probe_arg(arg, tp, &tp->args[i], is_return);
                 if (ret) {
                         pr_info("Parse error at argument%d. (%d)\n", i, ret);
                         kfree(tp->args[i].name);
@@ -794,8 +901,7 @@ static void probes_seq_stop(struct seq_file *m, void *v)
 static int probes_seq_show(struct seq_file *m, void *v)
 {
         struct trace_probe *tp = v;
-        int i, ret;
-        char buf[MAX_ARGSTR_LEN + 1];
+        int i;
 
         seq_printf(m, "%c", probe_is_return(tp) ? 'r' : 'p');
         seq_printf(m, ":%s/%s", tp->call.system, tp->call.name);
@@ -807,15 +913,10 @@ static int probes_seq_show(struct seq_file *m, void *v)
         else
                 seq_printf(m, " %s", probe_symbol(tp));
 
-        for (i = 0; i < tp->nr_args; i++) {
-                ret = probe_arg_string(buf, MAX_ARGSTR_LEN, &tp->args[i].fetch);
-                if (ret < 0) {
-                        pr_warning("Argument%d decoding error(%d).\n", i, ret);
-                        return ret;
-                }
-                seq_printf(m, " %s=%s", tp->args[i].name, buf);
-        }
+        for (i = 0; i < tp->nr_args; i++)
+                seq_printf(m, " %s=%s", tp->args[i].name, tp->args[i].comm);
         seq_printf(m, "\n");
+
         return 0;
 }
 
@@ -945,9 +1046,10 @@ static const struct file_operations kprobe_profile_ops = {
 static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
 {
         struct trace_probe *tp = container_of(kp, struct trace_probe, rp.kp);
-        struct kprobe_trace_entry *entry;
+        struct kprobe_trace_entry_head *entry;
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
+        u8 *data;
         int size, i, pc;
         unsigned long irq_flags;
         struct ftrace_event_call *call = &tp->call;
@@ -957,7 +1059,7 @@ static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
         local_save_flags(irq_flags);
         pc = preempt_count();
 
-        size = SIZEOF_KPROBE_TRACE_ENTRY(tp->nr_args);
+        size = sizeof(*entry) + tp->size;
 
         event = trace_current_buffer_lock_reserve(&buffer, call->id, size,
                                                   irq_flags, pc);
@@ -965,10 +1067,10 @@ static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
                 return;
 
         entry = ring_buffer_event_data(event);
-        entry->nargs = tp->nr_args;
         entry->ip = (unsigned long)kp->addr;
+        data = (u8 *)&entry[1];
         for (i = 0; i < tp->nr_args; i++)
-                entry->args[i] = call_fetch(&tp->args[i].fetch, regs);
+                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
 
         if (!filter_current_check_discard(buffer, call, entry, event))
                 trace_nowake_buffer_unlock_commit(buffer, event, irq_flags, pc);
@@ -979,9 +1081,10 @@ static __kprobes void kretprobe_trace_func(struct kretprobe_instance *ri,
                                           struct pt_regs *regs)
 {
         struct trace_probe *tp = container_of(ri->rp, struct trace_probe, rp);
-        struct kretprobe_trace_entry *entry;
+        struct kretprobe_trace_entry_head *entry;
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
+        u8 *data;
         int size, i, pc;
         unsigned long irq_flags;
         struct ftrace_event_call *call = &tp->call;
@@ -989,7 +1092,7 @@ static __kprobes void kretprobe_trace_func(struct kretprobe_instance *ri,
         local_save_flags(irq_flags);
         pc = preempt_count();
 
-        size = SIZEOF_KRETPROBE_TRACE_ENTRY(tp->nr_args);
+        size = sizeof(*entry) + tp->size;
 
         event = trace_current_buffer_lock_reserve(&buffer, call->id, size,
                                                   irq_flags, pc);
@@ -997,11 +1100,11 @@ static __kprobes void kretprobe_trace_func(struct kretprobe_instance *ri,
                 return;
 
         entry = ring_buffer_event_data(event);
-        entry->nargs = tp->nr_args;
         entry->func = (unsigned long)tp->rp.kp.addr;
         entry->ret_ip = (unsigned long)ri->ret_addr;
+        data = (u8 *)&entry[1];
         for (i = 0; i < tp->nr_args; i++)
-                entry->args[i] = call_fetch(&tp->args[i].fetch, regs);
+                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
 
         if (!filter_current_check_discard(buffer, call, entry, event))
                 trace_nowake_buffer_unlock_commit(buffer, event, irq_flags, pc);
@@ -1011,13 +1114,14 @@ static __kprobes void kretprobe_trace_func(struct kretprobe_instance *ri,
 enum print_line_t
 print_kprobe_event(struct trace_iterator *iter, int flags)
 {
-        struct kprobe_trace_entry *field;
+        struct kprobe_trace_entry_head *field;
         struct trace_seq *s = &iter->seq;
         struct trace_event *event;
         struct trace_probe *tp;
+        u8 *data;
         int i;
 
-        field = (struct kprobe_trace_entry *)iter->ent;
+        field = (struct kprobe_trace_entry_head *)iter->ent;
         event = ftrace_find_event(field->ent.type);
         tp = container_of(event, struct trace_probe, event);
 
@@ -1030,9 +1134,10 @@ print_kprobe_event(struct trace_iterator *iter, int flags)
         if (!trace_seq_puts(s, ")"))
                 goto partial;
 
-        for (i = 0; i < field->nargs; i++)
-                if (!trace_seq_printf(s, " %s=%lx",
-                                      tp->args[i].name, field->args[i]))
+        data = (u8 *)&field[1];
+        for (i = 0; i < tp->nr_args; i++)
+                if (!tp->args[i].type->print(s, tp->args[i].name,
+                                             data + tp->args[i].offset))
                         goto partial;
 
         if (!trace_seq_puts(s, "\n"))
@@ -1046,13 +1151,14 @@ partial:
 enum print_line_t
 print_kretprobe_event(struct trace_iterator *iter, int flags)
 {
-        struct kretprobe_trace_entry *field;
+        struct kretprobe_trace_entry_head *field;
         struct trace_seq *s = &iter->seq;
         struct trace_event *event;
         struct trace_probe *tp;
+        u8 *data;
         int i;
 
-        field = (struct kretprobe_trace_entry *)iter->ent;
+        field = (struct kretprobe_trace_entry_head *)iter->ent;
         event = ftrace_find_event(field->ent.type);
         tp = container_of(event, struct trace_probe, event);
 
@@ -1071,9 +1177,10 @@ print_kretprobe_event(struct trace_iterator *iter, int flags)
         if (!trace_seq_puts(s, ")"))
                 goto partial;
 
-        for (i = 0; i < field->nargs; i++)
-                if (!trace_seq_printf(s, " %s=%lx",
-                                      tp->args[i].name, field->args[i]))
+        data = (u8 *)&field[1];
+        for (i = 0; i < tp->nr_args; i++)
+                if (!tp->args[i].type->print(s, tp->args[i].name,
+                                             data + tp->args[i].offset))
                         goto partial;
 
         if (!trace_seq_puts(s, "\n"))
@@ -1129,29 +1236,43 @@ static int probe_event_raw_init(struct ftrace_event_call *event_call)
 static int kprobe_event_define_fields(struct ftrace_event_call *event_call)
 {
         int ret, i;
-        struct kprobe_trace_entry field;
+        struct kprobe_trace_entry_head field;
         struct trace_probe *tp = (struct trace_probe *)event_call->data;
 
         DEFINE_FIELD(unsigned long, ip, FIELD_STRING_IP, 0);
-        DEFINE_FIELD(int, nargs, FIELD_STRING_NARGS, 1);
         /* Set argument names as fields */
-        for (i = 0; i < tp->nr_args; i++)
-                DEFINE_FIELD(unsigned long, args[i], tp->args[i].name, 0);
+        for (i = 0; i < tp->nr_args; i++) {
+                ret = trace_define_field(event_call, tp->args[i].type->name,
+                                         tp->args[i].name,
+                                         sizeof(field) + tp->args[i].offset,
+                                         tp->args[i].type->size,
+                                         tp->args[i].type->is_signed,
+                                         FILTER_OTHER);
+                if (ret)
+                        return ret;
+        }
         return 0;
 }
 
 static int kretprobe_event_define_fields(struct ftrace_event_call *event_call)
 {
         int ret, i;
-        struct kretprobe_trace_entry field;
+        struct kretprobe_trace_entry_head field;
         struct trace_probe *tp = (struct trace_probe *)event_call->data;
 
         DEFINE_FIELD(unsigned long, func, FIELD_STRING_FUNC, 0);
         DEFINE_FIELD(unsigned long, ret_ip, FIELD_STRING_RETIP, 0);
-        DEFINE_FIELD(int, nargs, FIELD_STRING_NARGS, 1);
         /* Set argument names as fields */
-        for (i = 0; i < tp->nr_args; i++)
-                DEFINE_FIELD(unsigned long, args[i], tp->args[i].name, 0);
+        for (i = 0; i < tp->nr_args; i++) {
+                ret = trace_define_field(event_call, tp->args[i].type->name,
+                                         tp->args[i].name,
+                                         sizeof(field) + tp->args[i].offset,
+                                         tp->args[i].type->size,
+                                         tp->args[i].type->is_signed,
+                                         FILTER_OTHER);
+                if (ret)
+                        return ret;
+        }
         return 0;
 }
 
@@ -1176,8 +1297,8 @@ static int __set_print_fmt(struct trace_probe *tp, char *buf, int len)
         pos += snprintf(buf + pos, LEN_OR_ZERO, "\"%s", fmt);
 
         for (i = 0; i < tp->nr_args; i++) {
-                pos += snprintf(buf + pos, LEN_OR_ZERO, " %s=%%lx",
-                                tp->args[i].name);
+                pos += snprintf(buf + pos, LEN_OR_ZERO, " %s=%s",
+                                tp->args[i].name, tp->args[i].type->fmt);
         }
 
         pos += snprintf(buf + pos, LEN_OR_ZERO, "\", %s", arg);
@@ -1214,67 +1335,70 @@ static int set_print_fmt(struct trace_probe *tp)
 #ifdef CONFIG_PERF_EVENTS
 
 /* Kprobe profile handler */
-static __kprobes void kprobe_profile_func(struct kprobe *kp,
+static __kprobes void kprobe_perf_func(struct kprobe *kp,
                                          struct pt_regs *regs)
 {
         struct trace_probe *tp = container_of(kp, struct trace_probe, rp.kp);
         struct ftrace_event_call *call = &tp->call;
-        struct kprobe_trace_entry *entry;
+        struct kprobe_trace_entry_head *entry;
+        u8 *data;
         int size, __size, i;
         unsigned long irq_flags;
         int rctx;
 
-        __size = SIZEOF_KPROBE_TRACE_ENTRY(tp->nr_args);
+        __size = sizeof(*entry) + tp->size;
         size = ALIGN(__size + sizeof(u32), sizeof(u64));
         size -= sizeof(u32);
-        if (WARN_ONCE(size > FTRACE_MAX_PROFILE_SIZE,
+        if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
                      "profile buffer not large enough"))
                 return;
 
-        entry = ftrace_perf_buf_prepare(size, call->id, &rctx, &irq_flags);
+        entry = perf_trace_buf_prepare(size, call->id, &rctx, &irq_flags);
         if (!entry)
                 return;
 
-        entry->nargs = tp->nr_args;
         entry->ip = (unsigned long)kp->addr;
+        data = (u8 *)&entry[1];
         for (i = 0; i < tp->nr_args; i++)
-                entry->args[i] = call_fetch(&tp->args[i].fetch, regs);
+                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
 
-        ftrace_perf_buf_submit(entry, size, rctx, entry->ip, 1, irq_flags);
+        perf_trace_buf_submit(entry, size, rctx, entry->ip, 1, irq_flags, regs);
 }
 
 /* Kretprobe profile handler */
-static __kprobes void kretprobe_profile_func(struct kretprobe_instance *ri,
+static __kprobes void kretprobe_perf_func(struct kretprobe_instance *ri,
                                             struct pt_regs *regs)
 {
         struct trace_probe *tp = container_of(ri->rp, struct trace_probe, rp);
         struct ftrace_event_call *call = &tp->call;
-        struct kretprobe_trace_entry *entry;
+        struct kretprobe_trace_entry_head *entry;
+        u8 *data;
         int size, __size, i;
         unsigned long irq_flags;
         int rctx;
 
-        __size = SIZEOF_KRETPROBE_TRACE_ENTRY(tp->nr_args);
+        __size = sizeof(*entry) + tp->size;
         size = ALIGN(__size + sizeof(u32), sizeof(u64));
         size -= sizeof(u32);
-        if (WARN_ONCE(size > FTRACE_MAX_PROFILE_SIZE,
+        if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
                      "profile buffer not large enough"))
                 return;
 
-        entry = ftrace_perf_buf_prepare(size, call->id, &rctx, &irq_flags);
+        entry = perf_trace_buf_prepare(size, call->id, &rctx, &irq_flags);
         if (!entry)
                 return;
 
-        entry->nargs = tp->nr_args;
         entry->func = (unsigned long)tp->rp.kp.addr;
         entry->ret_ip = (unsigned long)ri->ret_addr;
+        data = (u8 *)&entry[1];
         for (i = 0; i < tp->nr_args; i++)
-                entry->args[i] = call_fetch(&tp->args[i].fetch, regs);
+                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
 
-        ftrace_perf_buf_submit(entry, size, rctx, entry->ret_ip, 1, irq_flags);
+        perf_trace_buf_submit(entry, size, rctx, entry->ret_ip, 1,
+                               irq_flags, regs);
 }
 
-static int probe_profile_enable(struct ftrace_event_call *call)
+static int probe_perf_enable(struct ftrace_event_call *call)
 {
         struct trace_probe *tp = (struct trace_probe *)call->data;
 
@@ -1286,7 +1410,7 @@ static int probe_profile_enable(struct ftrace_event_call *call)
                 return enable_kprobe(&tp->rp.kp);
 }
 
-static void probe_profile_disable(struct ftrace_event_call *call)
+static void probe_perf_disable(struct ftrace_event_call *call)
 {
         struct trace_probe *tp = (struct trace_probe *)call->data;
 
@@ -1311,7 +1435,7 @@ int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs)
                 kprobe_trace_func(kp, regs);
 #ifdef CONFIG_PERF_EVENTS
         if (tp->flags & TP_FLAG_PROFILE)
-                kprobe_profile_func(kp, regs);
+                kprobe_perf_func(kp, regs);
 #endif
         return 0;       /* We don't tweek kernel, so just return 0 */
 }
@@ -1325,7 +1449,7 @@ int kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs)
                 kretprobe_trace_func(ri, regs);
 #ifdef CONFIG_PERF_EVENTS
         if (tp->flags & TP_FLAG_PROFILE)
-                kretprobe_profile_func(ri, regs);
+                kretprobe_perf_func(ri, regs);
 #endif
         return 0;       /* We don't tweek kernel, so just return 0 */
 }
@@ -1358,8 +1482,8 @@ static int register_probe_event(struct trace_probe *tp)
         call->unregfunc = probe_event_disable;
 
 #ifdef CONFIG_PERF_EVENTS
-        call->profile_enable = probe_profile_enable;
-        call->profile_disable = probe_profile_disable;
+        call->perf_event_enable = probe_perf_enable;
+        call->perf_event_disable = probe_perf_disable;
 #endif
         call->data = tp;
         ret = trace_add_event_call(call);
diff --git a/kernel/trace/trace_ksym.c b/kernel/trace/trace_ksym.c
index 94103cdcf9d8..8eaf00749b65 100644
--- a/kernel/trace/trace_ksym.c
+++ b/kernel/trace/trace_ksym.c
@@ -23,6 +23,7 @@
 #include <linux/debugfs.h>
 #include <linux/ftrace.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 
 #include "trace_output.h"
@@ -33,12 +34,6 @@
 
 #include <asm/atomic.h>
 
-/*
- * For now, let us restrict the no. of symbols traced simultaneously to number
- * of available hardware breakpoint registers.
- */
-#define KSYM_TRACER_MAX HBP_NUM
-
 #define KSYM_TRACER_OP_LEN 3 /* rw- */
 
 struct trace_ksym {
@@ -52,7 +47,6 @@ struct trace_ksym {
 
 static struct trace_array *ksym_trace_array;
 
-static unsigned int ksym_filter_entry_count;
 static unsigned int ksym_tracing_enabled;
 
 static HLIST_HEAD(ksym_filter_head);
@@ -180,13 +174,6 @@ int process_new_ksym_entry(char *ksymname, int op, unsigned long addr)
         struct trace_ksym *entry;
         int ret = -ENOMEM;
 
-        if (ksym_filter_entry_count >= KSYM_TRACER_MAX) {
-                printk(KERN_ERR "ksym_tracer: Maximum limit:(%d) reached. No"
-                " new requests for tracing can be accepted now.\n",
-                        KSYM_TRACER_MAX);
-                return -ENOSPC;
-        }
-
         entry = kzalloc(sizeof(struct trace_ksym), GFP_KERNEL);
         if (!entry)
                 return -ENOMEM;
@@ -202,13 +189,17 @@ int process_new_ksym_entry(char *ksymname, int op, unsigned long addr)
 
         if (IS_ERR(entry->ksym_hbp)) {
                 ret = PTR_ERR(entry->ksym_hbp);
-                printk(KERN_INFO "ksym_tracer request failed. Try again"
-                                        " later!!\n");
+                if (ret == -ENOSPC) {
+                        printk(KERN_ERR "ksym_tracer: Maximum limit reached."
+                        " No new requests for tracing can be accepted now.\n");
+                } else {
+                        printk(KERN_INFO "ksym_tracer request failed. Try again"
+                                         " later!!\n");
+                }
                 goto err;
         }
 
         hlist_add_head_rcu(&(entry->ksym_hlist), &ksym_filter_head);
-        ksym_filter_entry_count++;
 
         return 0;
 
@@ -264,7 +255,6 @@ static void __ksym_trace_reset(void)
         hlist_for_each_entry_safe(entry, node, node1, &ksym_filter_head,
                                                                 ksym_hlist) {
                 unregister_wide_hw_breakpoint(entry->ksym_hbp);
-                ksym_filter_entry_count--;
                 hlist_del_rcu(&(entry->ksym_hlist));
                 synchronize_rcu();
                 kfree(entry);
@@ -337,7 +327,6 @@ static ssize_t ksym_trace_filter_write(struct file *file,
                                 goto out_unlock;
                 }
                 /* Error or "symbol:---" case: drop it */
-                ksym_filter_entry_count--;
                 hlist_del_rcu(&(entry->ksym_hlist));
                 synchronize_rcu();
                 kfree(entry);
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index 0acd834659ed..017fa376505d 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -9,6 +9,7 @@
 #include <linux/kernel.h>
 #include <linux/mmiotrace.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/time.h>
 
 #include <asm/atomic.h>
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 8e46b3323cdc..2404c129a8c9 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -253,7 +253,7 @@ void *trace_seq_reserve(struct trace_seq *s, size_t len)
         void *ret;
 
         if (s->full)
-                return 0;
+                return NULL;
 
         if (len > ((PAGE_SIZE - 1) - s->len)) {
                 s->full = 1;
diff --git a/kernel/trace/trace_sched_switch.c b/kernel/trace/trace_sched_switch.c
index 5fca0f51fde4..a55fccfede5d 100644
--- a/kernel/trace/trace_sched_switch.c
+++ b/kernel/trace/trace_sched_switch.c
@@ -50,8 +50,7 @@ tracing_sched_switch_trace(struct trace_array *tr,
 }
 
 static void
-probe_sched_switch(struct rq *__rq, struct task_struct *prev,
-                        struct task_struct *next)
+probe_sched_switch(struct task_struct *prev, struct task_struct *next)
 {
         struct trace_array_cpu *data;
         unsigned long flags;
@@ -109,7 +108,7 @@ tracing_sched_wakeup_trace(struct trace_array *tr,
 }
 
 static void
-probe_sched_wakeup(struct rq *__rq, struct task_struct *wakee, int success)
+probe_sched_wakeup(struct task_struct *wakee, int success)
 {
         struct trace_array_cpu *data;
         unsigned long flags;
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index 0271742abb8d..8052446ceeaa 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -107,8 +107,7 @@ static void probe_wakeup_migrate_task(struct task_struct *task, int cpu)
 }
 
 static void notrace
-probe_wakeup_sched_switch(struct rq *rq, struct task_struct *prev,
-        struct task_struct *next)
+probe_wakeup_sched_switch(struct task_struct *prev, struct task_struct *next)
 {
         struct trace_array_cpu *data;
         cycle_t T0, T1, delta;
@@ -200,7 +199,7 @@ static void wakeup_reset(struct trace_array *tr)
 }
 
 static void
-probe_wakeup(struct rq *rq, struct task_struct *p, int success)
+probe_wakeup(struct task_struct *p, int success)
 {
         struct trace_array_cpu *data;
         int cpu = smp_processor_id();
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index 280fea470d67..250e7f9bd2f0 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -3,6 +3,7 @@
 #include <linux/stringify.h>
 #include <linux/kthread.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 
 static inline int trace_valid_entry(struct trace_entry *entry)
 {
@@ -16,7 +17,6 @@ static inline int trace_valid_entry(struct trace_entry *entry)
         case TRACE_BRANCH:
         case TRACE_GRAPH_ENT:
         case TRACE_GRAPH_RET:
-        case TRACE_HW_BRANCHES:
         case TRACE_KSYM:
                 return 1;
         }
@@ -29,7 +29,7 @@ static int trace_test_buffer_cpu(struct trace_array *tr, int cpu)
         struct trace_entry *entry;
         unsigned int loops = 0;
 
-        while ((event = ring_buffer_consume(tr->buffer, cpu, NULL))) {
+        while ((event = ring_buffer_consume(tr->buffer, cpu, NULL, NULL))) {
                 entry = ring_buffer_event_data(event);
 
                 /*
@@ -255,7 +255,8 @@ trace_selftest_startup_function(struct tracer *trace, struct trace_array *tr)
 /* Maximum number of functions to trace before diagnosing a hang */
 #define GRAPH_MAX_FUNC_TEST     100000000
 
-static void __ftrace_dump(bool disable_tracing);
+static void
+__ftrace_dump(bool disable_tracing, enum ftrace_dump_mode oops_dump_mode);
 static unsigned int graph_hang_thresh;
 
 /* Wrap the real function entry probe to avoid possible hanging */
@@ -266,7 +267,7 @@ static int trace_graph_entry_watchdog(struct ftrace_graph_ent *trace)
                 ftrace_graph_stop();
                 printk(KERN_WARNING "BUG: Function graph tracer hang!\n");
                 if (ftrace_dump_on_oops)
-                        __ftrace_dump(false);
+                        __ftrace_dump(false, DUMP_ALL);
                 return 0;
         }
 
@@ -754,62 +755,6 @@ trace_selftest_startup_branch(struct tracer *trace, struct trace_array *tr)
 }
 #endif /* CONFIG_BRANCH_TRACER */
 
-#ifdef CONFIG_HW_BRANCH_TRACER
-int
-trace_selftest_startup_hw_branches(struct tracer *trace,
-                                   struct trace_array *tr)
-{
-        struct trace_iterator *iter;
-        struct tracer tracer;
-        unsigned long count;
-        int ret;
-
-        if (!trace->open) {
-                printk(KERN_CONT "missing open function...");
-                return -1;
-        }
-
-        ret = tracer_init(trace, tr);
-        if (ret) {
-                warn_failed_init_tracer(trace, ret);
-                return ret;
-        }
-
-        /*
-         * The hw-branch tracer needs to collect the trace from the various
-         * cpu trace buffers - before tracing is stopped.
-         */
-        iter = kzalloc(sizeof(*iter), GFP_KERNEL);
-        if (!iter)
-                return -ENOMEM;
-
-        memcpy(&tracer, trace, sizeof(tracer));
-
-        iter->trace = &tracer;
-        iter->tr = tr;
-        iter->pos = -1;
-        mutex_init(&iter->mutex);
-
-        trace->open(iter);
-
-        mutex_destroy(&iter->mutex);
-        kfree(iter);
-
-        tracing_stop();
-
-        ret = trace_test_buffer(tr, &count);
-        trace->reset(tr);
-        tracing_start();
-
-        if (!ret && !count) {
-                printk(KERN_CONT "no entries found..");
-                ret = -1;
-        }
-
-        return ret;
-}
-#endif /* CONFIG_HW_BRANCH_TRACER */
-
 #ifdef CONFIG_KSYM_TRACER
 static int ksym_selftest_dummy;
 
diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
index a4bb239eb987..96cffb269e73 100644
--- a/kernel/trace/trace_stat.c
+++ b/kernel/trace/trace_stat.c
@@ -10,6 +10,7 @@
 
 
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/rbtree.h>
 #include <linux/debugfs.h>
 #include "trace_stat.h"
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index cba47d7935cc..4d6d711717f2 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -1,5 +1,6 @@
 #include <trace/syscall.h>
 #include <trace/events/syscalls.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/ftrace.h>
 #include <linux/perf_event.h>
@@ -428,12 +429,12 @@ core_initcall(init_ftrace_syscalls);
 
 #ifdef CONFIG_PERF_EVENTS
 
-static DECLARE_BITMAP(enabled_prof_enter_syscalls, NR_syscalls);
-static DECLARE_BITMAP(enabled_prof_exit_syscalls, NR_syscalls);
-static int sys_prof_refcount_enter;
-static int sys_prof_refcount_exit;
+static DECLARE_BITMAP(enabled_perf_enter_syscalls, NR_syscalls);
+static DECLARE_BITMAP(enabled_perf_exit_syscalls, NR_syscalls);
+static int sys_perf_refcount_enter;
+static int sys_perf_refcount_exit;
 
-static void prof_syscall_enter(struct pt_regs *regs, long id)
+static void perf_syscall_enter(struct pt_regs *regs, long id)
 {
         struct syscall_metadata *sys_data;
         struct syscall_trace_enter *rec;
@@ -443,7 +444,7 @@ static void prof_syscall_enter(struct pt_regs *regs, long id)
         int size;
 
         syscall_nr = syscall_get_nr(current, regs);
-        if (!test_bit(syscall_nr, enabled_prof_enter_syscalls))
+        if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
                 return;
 
         sys_data = syscall_nr_to_meta(syscall_nr);
@@ -455,11 +456,11 @@ static void prof_syscall_enter(struct pt_regs *regs, long id)
         size = ALIGN(size + sizeof(u32), sizeof(u64));
         size -= sizeof(u32);
 
-        if (WARN_ONCE(size > FTRACE_MAX_PROFILE_SIZE,
-                      "profile buffer not large enough"))
+        if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
+                      "perf buffer not large enough"))
                 return;
 
-        rec = (struct syscall_trace_enter *)ftrace_perf_buf_prepare(size,
+        rec = (struct syscall_trace_enter *)perf_trace_buf_prepare(size,
                                 sys_data->enter_event->id, &rctx, &flags);
         if (!rec)
                 return;
@@ -467,10 +468,10 @@ static void prof_syscall_enter(struct pt_regs *regs, long id)
         rec->nr = syscall_nr;
         syscall_get_arguments(current, regs, 0, sys_data->nb_args,
                                (unsigned long *)&rec->args);
-        ftrace_perf_buf_submit(rec, size, rctx, 0, 1, flags);
+        perf_trace_buf_submit(rec, size, rctx, 0, 1, flags, regs);
 }
 
-int prof_sysenter_enable(struct ftrace_event_call *call)
+int perf_sysenter_enable(struct ftrace_event_call *call)
 {
         int ret = 0;
         int num;
@@ -478,34 +479,34 @@ int prof_sysenter_enable(struct ftrace_event_call *call)
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
 
         mutex_lock(&syscall_trace_lock);
-        if (!sys_prof_refcount_enter)
-                ret = register_trace_sys_enter(prof_syscall_enter);
+        if (!sys_perf_refcount_enter)
+                ret = register_trace_sys_enter(perf_syscall_enter);
         if (ret) {
                 pr_info("event trace: Could not activate"
                                 "syscall entry trace point");
         } else {
-                set_bit(num, enabled_prof_enter_syscalls);
-                sys_prof_refcount_enter++;
+                set_bit(num, enabled_perf_enter_syscalls);
+                sys_perf_refcount_enter++;
         }
         mutex_unlock(&syscall_trace_lock);
         return ret;
 }
 
-void prof_sysenter_disable(struct ftrace_event_call *call)
+void perf_sysenter_disable(struct ftrace_event_call *call)
 {
         int num;
 
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
 
         mutex_lock(&syscall_trace_lock);
-        sys_prof_refcount_enter--;
-        clear_bit(num, enabled_prof_enter_syscalls);
-        if (!sys_prof_refcount_enter)
-                unregister_trace_sys_enter(prof_syscall_enter);
+        sys_perf_refcount_enter--;
+        clear_bit(num, enabled_perf_enter_syscalls);
+        if (!sys_perf_refcount_enter)
+                unregister_trace_sys_enter(perf_syscall_enter);
         mutex_unlock(&syscall_trace_lock);
 }
 
-static void prof_syscall_exit(struct pt_regs *regs, long ret)
+static void perf_syscall_exit(struct pt_regs *regs, long ret)
 {
         struct syscall_metadata *sys_data;
         struct syscall_trace_exit *rec;
@@ -515,7 +516,7 @@ static void prof_syscall_exit(struct pt_regs *regs, long ret)
         int size;
 
         syscall_nr = syscall_get_nr(current, regs);
-        if (!test_bit(syscall_nr, enabled_prof_exit_syscalls))
+        if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
                 return;
 
         sys_data = syscall_nr_to_meta(syscall_nr);
@@ -530,11 +531,11 @@ static void prof_syscall_exit(struct pt_regs *regs, long ret)
          * Impossible, but be paranoid with the future
          * How to put this check outside runtime?
          */
-        if (WARN_ONCE(size > FTRACE_MAX_PROFILE_SIZE,
-                "exit event has grown above profile buffer size"))
+        if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
+                "exit event has grown above perf buffer size"))
                 return;
 
-        rec = (struct syscall_trace_exit *)ftrace_perf_buf_prepare(size,
+        rec = (struct syscall_trace_exit *)perf_trace_buf_prepare(size,
                                 sys_data->exit_event->id, &rctx, &flags);
         if (!rec)
                 return;
@@ -542,10 +543,10 @@ static void prof_syscall_exit(struct pt_regs *regs, long ret)
         rec->nr = syscall_nr;
         rec->ret = syscall_get_return_value(current, regs);
 
-        ftrace_perf_buf_submit(rec, size, rctx, 0, 1, flags);
+        perf_trace_buf_submit(rec, size, rctx, 0, 1, flags, regs);
 }
 
-int prof_sysexit_enable(struct ftrace_event_call *call)
+int perf_sysexit_enable(struct ftrace_event_call *call)
 {
         int ret = 0;
         int num;
@@ -553,30 +554,30 @@ int prof_sysexit_enable(struct ftrace_event_call *call)
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
 
         mutex_lock(&syscall_trace_lock);
-        if (!sys_prof_refcount_exit)
-                ret = register_trace_sys_exit(prof_syscall_exit);
+        if (!sys_perf_refcount_exit)
+                ret = register_trace_sys_exit(perf_syscall_exit);
         if (ret) {
                 pr_info("event trace: Could not activate"
                                 "syscall exit trace point");
         } else {
-                set_bit(num, enabled_prof_exit_syscalls);
-                sys_prof_refcount_exit++;
+                set_bit(num, enabled_perf_exit_syscalls);
+                sys_perf_refcount_exit++;
         }
         mutex_unlock(&syscall_trace_lock);
         return ret;
 }
 
-void prof_sysexit_disable(struct ftrace_event_call *call)
+void perf_sysexit_disable(struct ftrace_event_call *call)
 {
         int num;
 
         num = ((struct syscall_metadata *)call->data)->syscall_nr;
 
         mutex_lock(&syscall_trace_lock);
-        sys_prof_refcount_exit--;
-        clear_bit(num, enabled_prof_exit_syscalls);
-        if (!sys_prof_refcount_exit)
-                unregister_trace_sys_exit(prof_syscall_exit);
+        sys_perf_refcount_exit--;
+        clear_bit(num, enabled_perf_exit_syscalls);
+        if (!sys_perf_refcount_exit)
+                unregister_trace_sys_exit(perf_syscall_exit);
         mutex_unlock(&syscall_trace_lock);
 }
 
diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
index 40cafb07dffd..cc2d2faa7d9e 100644
--- a/kernel/trace/trace_workqueue.c
+++ b/kernel/trace/trace_workqueue.c
@@ -9,6 +9,7 @@
 #include <trace/events/workqueue.h>
 #include <linux/list.h>
 #include <linux/percpu.h>
+#include <linux/slab.h>
 #include <linux/kref.h>
 #include "trace_stat.h"
 #include "trace.h"
diff --git a/kernel/tsacct.c b/kernel/tsacct.c
index 00d59d048edf..0a67e041edf8 100644
--- a/kernel/tsacct.c
+++ b/kernel/tsacct.c
@@ -21,6 +21,7 @@
 #include <linux/tsacct_kern.h>
 #include <linux/acct.h>
 #include <linux/jiffies.h>
+#include <linux/mm.h>
 
 /*
  * fill in basic accounting fields
diff --git a/kernel/user.c b/kernel/user.c
index 766467b3bcb7..7e72614b736d 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -16,7 +16,6 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/user_namespace.h>
-#include "cred-internals.h"
 
 struct user_namespace init_user_ns = {
         .kref = {
@@ -137,9 +136,6 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
         struct hlist_head *hashent = uidhashentry(ns, uid);
         struct user_struct *up, *new;
 
-        /* Make uid_hash_find() + uids_user_create() + uid_hash_insert()
-         * atomic.
-         */
         spin_lock_irq(&uidhash_lock);
         up = uid_hash_find(uid, hashent);
         spin_unlock_irq(&uidhash_lock);
@@ -161,11 +157,6 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
                 spin_lock_irq(&uidhash_lock);
                 up = uid_hash_find(uid, hashent);
                 if (up) {
-                        /* This case is not possible when CONFIG_USER_SCHED
-                         * is defined, since we serialize alloc_uid() using
-                         * uids_mutex. Hence no need to call
-                         * sched_destroy_user() or remove_user_sysfs_dir().
-                         */
                         key_put(new->uid_keyring);
                         key_put(new->session_keyring);
                         kmem_cache_free(uid_cachep, new);
@@ -178,8 +169,6 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
 
         return up;
 
-        put_user_ns(new->user_ns);
-        kmem_cache_free(uid_cachep, new);
 out_unlock:
         return NULL;
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index dee48658805c..5bfb213984b2 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -774,7 +774,7 @@ void flush_delayed_work(struct delayed_work *dwork)
 {
         if (del_timer_sync(&dwork->timer)) {
                 struct cpu_workqueue_struct *cwq;
-                cwq = wq_per_cpu(keventd_wq, get_cpu());
+                cwq = wq_per_cpu(get_wq_data(&dwork->work)->wq, get_cpu());
                 __queue_work(cwq, &dwork->work);
                 put_cpu();
         }