72 files changed, 2713 insertions, 1475 deletions
diff --git a/kernel/Makefile b/kernel/Makefile
index 187c89b4783d..b8d4cd8ac0b9 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -58,7 +58,6 @@ obj-$(CONFIG_KEXEC) += kexec.o
 obj-$(CONFIG_BACKTRACE_SELF_TEST) += backtracetest.o
 obj-$(CONFIG_COMPAT) += compat.o
 obj-$(CONFIG_CGROUPS) += cgroup.o
-obj-$(CONFIG_CGROUP_DEBUG) += cgroup_debug.o
 obj-$(CONFIG_CGROUP_FREEZER) += cgroup_freezer.o
 obj-$(CONFIG_CPUSETS) += cpuset.o
 obj-$(CONFIG_CGROUP_NS) += ns_cgroup.o
diff --git a/kernel/audit.c b/kernel/audit.c
index defc2e6f1e3b..5feed232be9d 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -855,18 +855,24 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                break;
        }
        case AUDIT_SIGNAL_INFO:
-                err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
+                len = 0;
-                if (err)
+                if (audit_sig_sid) {
-                        return err;
+                        err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
+                        if (err)
+                                return err;
+                }
                sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
                if (!sig_data) {
-                        security_release_secctx(ctx, len);
+                        if (audit_sig_sid)
+                                security_release_secctx(ctx, len);
                        return -ENOMEM;
                }
                sig_data->uid = audit_sig_uid;
                sig_data->pid = audit_sig_pid;
-                memcpy(sig_data->ctx, ctx, len);
+                if (audit_sig_sid) {
-                security_release_secctx(ctx, len);
+                        memcpy(sig_data->ctx, ctx, len);
+                        security_release_secctx(ctx, len);
+                }
                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
                                0, 0, sig_data, sizeof(*sig_data) + len);
                kfree(sig_data);
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 0e96dbc60ea9..cc7e87936cbc 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -45,8 +45,8 @@
 struct audit_watch {
        atomic_t                count;  /* reference count */
-        char                    *path;  /* insertion path */
        dev_t                   dev;    /* associated superblock device */
+        char                    *path;  /* insertion path */
        unsigned long           ino;    /* associated inode number */
        struct audit_parent     *parent; /* associated parent */
        struct list_head        wlist;  /* entry in parent->watches list */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 68d3c6a0ecd6..267e484f0198 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -168,12 +168,12 @@ struct audit_context {
        int                 in_syscall; /* 1 if task is in a syscall */
        enum audit_state    state, current_state;
        unsigned int        serial;     /* serial number for record */
-        struct timespec     ctime;      /* time of syscall entry */
        int                 major;      /* syscall number */
+        struct timespec     ctime;      /* time of syscall entry */
        unsigned long       argv[4];    /* syscall arguments */
-        int                 return_valid; /* return code is valid */
        long                return_code;/* syscall return code */
        u64                 prio;
+        int                 return_valid; /* return code is valid */
        int                 name_count;
        struct audit_names  names[AUDIT_NAMES];
        char *              filterkey;  /* key for rule that triggered record */
@@ -198,8 +198,8 @@ struct audit_context {
        char                target_comm[TASK_COMM_LEN];
        struct audit_tree_refs *trees, *first_trees;
-        int tree_count;
        struct list_head killed_trees;
+        int tree_count;
        int type;
        union {
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 213b7f92fcdd..ca83b73fba19 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -23,6 +23,7 @@
 */
 #include <linux/cgroup.h>
+#include <linux/ctype.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
@@ -48,6 +49,8 @@
 #include <linux/namei.h>
 #include <linux/smp_lock.h>
 #include <linux/pid_namespace.h>
+#include <linux/idr.h>
+#include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
 #include <asm/atomic.h>
@@ -60,6 +63,8 @@ static struct cgroup_subsys *subsys[] = {
 #include <linux/cgroup_subsys.h>
 };
+#define MAX_CGROUP_ROOT_NAMELEN 64
 /*
 * A cgroupfs_root represents the root of a cgroup hierarchy,
 * and may be associated with a superblock to form an active
@@ -74,6 +79,9 @@ struct cgroupfs_root {
         */
        unsigned long subsys_bits;
+        /* Unique id for this hierarchy. */
+        int hierarchy_id;
        /* The bitmask of subsystems currently attached to this hierarchy */
        unsigned long actual_subsys_bits;
@@ -94,6 +102,9 @@ struct cgroupfs_root {
        /* The path to use for release notifications. */
        char release_agent_path[PATH_MAX];
+        /* The name for this hierarchy - may be empty */
+        char name[MAX_CGROUP_ROOT_NAMELEN];
 };
 /*
@@ -141,6 +152,10 @@ struct css_id {
 static LIST_HEAD(roots);
 static int root_count;
+static DEFINE_IDA(hierarchy_ida);
+static int next_hierarchy_id;
+static DEFINE_SPINLOCK(hierarchy_id_lock);
 /* dummytop is a shorthand for the dummy hierarchy's top cgroup */
 #define dummytop (&rootnode.top_cgroup)
@@ -201,6 +216,7 @@ struct cg_cgroup_link {
         * cgroup, anchored on cgroup->css_sets
         */
        struct list_head cgrp_link_list;
+        struct cgroup *cgrp;
        /*
         * List running through cg_cgroup_links pointing at a
         * single css_set object, anchored on css_set->cg_links
@@ -227,8 +243,11 @@ static int cgroup_subsys_init_idr(struct cgroup_subsys *ss);
 static DEFINE_RWLOCK(css_set_lock);
 static int css_set_count;
-/* hash table for cgroup groups. This improves the performance to
+/*
- * find an existing css_set */
+ * hash table for cgroup groups. This improves the performance to find
+ * an existing css_set. This hash doesn't (currently) take into
+ * account cgroups in empty hierarchies.
+ */
 #define CSS_SET_HASH_BITS       7
 #define CSS_SET_TABLE_SIZE      (1 << CSS_SET_HASH_BITS)
 static struct hlist_head css_set_table[CSS_SET_TABLE_SIZE];
@@ -248,48 +267,22 @@ static struct hlist_head *css_set_hash(struct cgroup_subsys_state *css[])
        return &css_set_table[index];
 }
+static void free_css_set_rcu(struct rcu_head *obj)
+{
+        struct css_set *cg = container_of(obj, struct css_set, rcu_head);
+        kfree(cg);
+}
 /* We don't maintain the lists running through each css_set to its
 * task until after the first call to cgroup_iter_start(). This
 * reduces the fork()/exit() overhead for people who have cgroups
 * compiled into their kernel but not actually in use */
 static int use_task_css_set_links __read_mostly;
-/* When we create or destroy a css_set, the operation simply
+static void __put_css_set(struct css_set *cg, int taskexit)
- * takes/releases a reference count on all the cgroups referenced
- * by subsystems in this css_set. This can end up multiple-counting
- * some cgroups, but that's OK - the ref-count is just a
- * busy/not-busy indicator; ensuring that we only count each cgroup
- * once would require taking a global lock to ensure that no
- * subsystems moved between hierarchies while we were doing so.
- *
- * Possible TODO: decide at boot time based on the number of
- * registered subsystems and the number of CPUs or NUMA nodes whether
- * it's better for performance to ref-count every subsystem, or to
- * take a global lock and only add one ref count to each hierarchy.
- */
-/*
- * unlink a css_set from the list and free it
- */
-static void unlink_css_set(struct css_set *cg)
 {
        struct cg_cgroup_link *link;
        struct cg_cgroup_link *saved_link;
-        hlist_del(&cg->hlist);
-        css_set_count--;
-        list_for_each_entry_safe(link, saved_link, &cg->cg_links,
-                                 cg_link_list) {
-                list_del(&link->cg_link_list);
-                list_del(&link->cgrp_link_list);
-                kfree(link);
-        }
-}
-static void __put_css_set(struct css_set *cg, int taskexit)
-{
-        int i;
        /*
         * Ensure that the refcount doesn't hit zero while any readers
         * can see it. Similar to atomic_dec_and_lock(), but for an
@@ -302,21 +295,28 @@ static void __put_css_set(struct css_set *cg, int taskexit)
                write_unlock(&css_set_lock);
                return;
        }
-        unlink_css_set(cg);
-        write_unlock(&css_set_lock);
-        rcu_read_lock();
+        /* This css_set is dead. unlink it and release cgroup refcounts */
-        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+        hlist_del(&cg->hlist);
-                struct cgroup *cgrp = rcu_dereference(cg->subsys[i]->cgroup);
+        css_set_count--;
+        list_for_each_entry_safe(link, saved_link, &cg->cg_links,
+                                 cg_link_list) {
+                struct cgroup *cgrp = link->cgrp;
+                list_del(&link->cg_link_list);
+                list_del(&link->cgrp_link_list);
                if (atomic_dec_and_test(&cgrp->count) &&
                    notify_on_release(cgrp)) {
                        if (taskexit)
                                set_bit(CGRP_RELEASABLE, &cgrp->flags);
                        check_for_release(cgrp);
                }
+                kfree(link);
        }
-        rcu_read_unlock();
-        kfree(cg);
+        write_unlock(&css_set_lock);
+        call_rcu(&cg->rcu_head, free_css_set_rcu);
 }
 /*
@@ -338,6 +338,78 @@ static inline void put_css_set_taskexit(struct css_set *cg)
 }
 /*
+ * compare_css_sets - helper function for find_existing_css_set().
+ * @cg: candidate css_set being tested
+ * @old_cg: existing css_set for a task
+ * @new_cgrp: cgroup that's being entered by the task
+ * @template: desired set of css pointers in css_set (pre-calculated)
+ *
+ * Returns true if "cg" matches "old_cg" except for the hierarchy
+ * which "new_cgrp" belongs to, for which it should match "new_cgrp".
+ */
+static bool compare_css_sets(struct css_set *cg,
+                             struct css_set *old_cg,
+                             struct cgroup *new_cgrp,
+                             struct cgroup_subsys_state *template[])
+{
+        struct list_head *l1, *l2;
+        if (memcmp(template, cg->subsys, sizeof(cg->subsys))) {
+                /* Not all subsystems matched */
+                return false;
+        }
+        /*
+         * Compare cgroup pointers in order to distinguish between
+         * different cgroups in heirarchies with no subsystems. We
+         * could get by with just this check alone (and skip the
+         * memcmp above) but on most setups the memcmp check will
+         * avoid the need for this more expensive check on almost all
+         * candidates.
+         */
+        l1 = &cg->cg_links;
+        l2 = &old_cg->cg_links;
+        while (1) {
+                struct cg_cgroup_link *cgl1, *cgl2;
+                struct cgroup *cg1, *cg2;
+                l1 = l1->next;
+                l2 = l2->next;
+                /* See if we reached the end - both lists are equal length. */
+                if (l1 == &cg->cg_links) {
+                        BUG_ON(l2 != &old_cg->cg_links);
+                        break;
+                } else {
+                        BUG_ON(l2 == &old_cg->cg_links);
+                }
+                /* Locate the cgroups associated with these links. */
+                cgl1 = list_entry(l1, struct cg_cgroup_link, cg_link_list);
+                cgl2 = list_entry(l2, struct cg_cgroup_link, cg_link_list);
+                cg1 = cgl1->cgrp;
+                cg2 = cgl2->cgrp;
+                /* Hierarchies should be linked in the same order. */
+                BUG_ON(cg1->root != cg2->root);
+                /*
+                 * If this hierarchy is the hierarchy of the cgroup
+                 * that's changing, then we need to check that this
+                 * css_set points to the new cgroup; if it's any other
+                 * hierarchy, then this css_set should point to the
+                 * same cgroup as the old css_set.
+                 */
+                if (cg1->root == new_cgrp->root) {
+                        if (cg1 != new_cgrp)
+                                return false;
+                } else {
+                        if (cg1 != cg2)
+                                return false;
+                }
+        }
+        return true;
+}
+/*
 * find_existing_css_set() is a helper for
 * find_css_set(), and checks to see whether an existing
 * css_set is suitable.
@@ -378,10 +450,11 @@ static struct css_set *find_existing_css_set(
        hhead = css_set_hash(template);
        hlist_for_each_entry(cg, node, hhead, hlist) {
-                if (!memcmp(template, cg->subsys, sizeof(cg->subsys))) {
+                if (!compare_css_sets(cg, oldcg, cgrp, template))
-                        /* All subsystems matched */
+                        continue;
-                        return cg;
-                }
+                /* This css_set matches what we need */
+                return cg;
        }
        /* No existing cgroup group matched */
@@ -435,8 +508,14 @@ static void link_css_set(struct list_head *tmp_cg_links,
        link = list_first_entry(tmp_cg_links, struct cg_cgroup_link,
                                cgrp_link_list);
        link->cg = cg;
+        link->cgrp = cgrp;
+        atomic_inc(&cgrp->count);
        list_move(&link->cgrp_link_list, &cgrp->css_sets);
-        list_add(&link->cg_link_list, &cg->cg_links);
+        /*
+         * Always add links to the tail of the list so that the list
+         * is sorted by order of hierarchy creation
+         */
+        list_add_tail(&link->cg_link_list, &cg->cg_links);
 }
 /*
@@ -451,11 +530,11 @@ static struct css_set *find_css_set(
 {
        struct css_set *res;
        struct cgroup_subsys_state *template[CGROUP_SUBSYS_COUNT];
-        int i;
        struct list_head tmp_cg_links;
        struct hlist_head *hhead;
+        struct cg_cgroup_link *link;
        /* First see if we already have a cgroup group that matches
         * the desired set */
@@ -489,20 +568,12 @@ static struct css_set *find_css_set(
        write_lock(&css_set_lock);
        /* Add reference counts and links from the new css_set. */
-        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+        list_for_each_entry(link, &oldcg->cg_links, cg_link_list) {
-                struct cgroup *cgrp = res->subsys[i]->cgroup;
+                struct cgroup *c = link->cgrp;
-                struct cgroup_subsys *ss = subsys[i];
+                if (c->root == cgrp->root)
-                atomic_inc(&cgrp->count);
+                        c = cgrp;
-                /*
+                link_css_set(&tmp_cg_links, res, c);
-                 * We want to add a link once per cgroup, so we
-                 * only do it for the first subsystem in each
-                 * hierarchy
-                 */
-                if (ss->root->subsys_list.next == &ss->sibling)
-                        link_css_set(&tmp_cg_links, res, cgrp);
        }
-        if (list_empty(&rootnode.subsys_list))
-                link_css_set(&tmp_cg_links, res, dummytop);
        BUG_ON(!list_empty(&tmp_cg_links));
@@ -518,6 +589,41 @@ static struct css_set *find_css_set(
 }
 /*
+ * Return the cgroup for "task" from the given hierarchy. Must be
+ * called with cgroup_mutex held.
+ */
+static struct cgroup *task_cgroup_from_root(struct task_struct *task,
+                                            struct cgroupfs_root *root)
+{
+        struct css_set *css;
+        struct cgroup *res = NULL;
+        BUG_ON(!mutex_is_locked(&cgroup_mutex));
+        read_lock(&css_set_lock);
+        /*
+         * No need to lock the task - since we hold cgroup_mutex the
+         * task can't change groups, so the only thing that can happen
+         * is that it exits and its css is set back to init_css_set.
+         */
+        css = task->cgroups;
+        if (css == &init_css_set) {
+                res = &root->top_cgroup;
+        } else {
+                struct cg_cgroup_link *link;
+                list_for_each_entry(link, &css->cg_links, cg_link_list) {
+                        struct cgroup *c = link->cgrp;
+                        if (c->root == root) {
+                                res = c;
+                                break;
+                        }
+                }
+        }
+        read_unlock(&css_set_lock);
+        BUG_ON(!res);
+        return res;
+}
+/*
 * There is one global cgroup mutex. We also require taking
 * task_lock() when dereferencing a task's cgroup subsys pointers.
 * See "The task_lock() exception", at the end of this comment.
@@ -597,7 +703,7 @@ static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, int mode);
 static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry);
 static int cgroup_populate_dir(struct cgroup *cgrp);
 static const struct inode_operations cgroup_dir_inode_operations;
-static struct file_operations proc_cgroupstats_operations;
+static const struct file_operations proc_cgroupstats_operations;
 static struct backing_dev_info cgroup_backing_dev_info = {
        .name           = "cgroup",
@@ -677,6 +783,12 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                 */
                deactivate_super(cgrp->root->sb);
+                /*
+                 * if we're getting rid of the cgroup, refcount should ensure
+                 * that there are no pidlists left.
+                 */
+                BUG_ON(!list_empty(&cgrp->pidlists));
                call_rcu(&cgrp->rcu_head, free_cgroup_rcu);
        }
        iput(inode);
@@ -841,6 +953,8 @@ static int cgroup_show_options(struct seq_file *seq, struct vfsmount *vfs)
                seq_puts(seq, ",noprefix");
        if (strlen(root->release_agent_path))
                seq_printf(seq, ",release_agent=%s", root->release_agent_path);
+        if (strlen(root->name))
+                seq_printf(seq, ",name=%s", root->name);
        mutex_unlock(&cgroup_mutex);
        return 0;
 }
@@ -849,6 +963,12 @@ struct cgroup_sb_opts {
        unsigned long subsys_bits;
        unsigned long flags;
        char *release_agent;
+        char *name;
+        /* User explicitly requested empty subsystem */
+        bool none;
+        struct cgroupfs_root *new_root;
 };
 /* Convert a hierarchy specifier into a bitmask of subsystems and
@@ -863,9 +983,7 @@ static int parse_cgroupfs_options(char *data,
        mask = ~(1UL << cpuset_subsys_id);
 #endif
-        opts->subsys_bits = 0;
+        memset(opts, 0, sizeof(*opts));
-        opts->flags = 0;
-        opts->release_agent = NULL;
        while ((token = strsep(&o, ",")) != NULL) {
                if (!*token)
@@ -879,17 +997,42 @@ static int parse_cgroupfs_options(char *data,
                                if (!ss->disabled)
                                        opts->subsys_bits |= 1ul << i;
                        }
+                } else if (!strcmp(token, "none")) {
+                        /* Explicitly have no subsystems */
+                        opts->none = true;
                } else if (!strcmp(token, "noprefix")) {
                        set_bit(ROOT_NOPREFIX, &opts->flags);
                } else if (!strncmp(token, "release_agent=", 14)) {
                        /* Specifying two release agents is forbidden */
                        if (opts->release_agent)
                                return -EINVAL;
-                        opts->release_agent = kzalloc(PATH_MAX, GFP_KERNEL);
+                        opts->release_agent =
+                                kstrndup(token + 14, PATH_MAX, GFP_KERNEL);
                        if (!opts->release_agent)
                                return -ENOMEM;
-                        strncpy(opts->release_agent, token + 14, PATH_MAX - 1);
+                } else if (!strncmp(token, "name=", 5)) {
-                        opts->release_agent[PATH_MAX - 1] = 0;
+                        int i;
+                        const char *name = token + 5;
+                        /* Can't specify an empty name */
+                        if (!strlen(name))
+                                return -EINVAL;
+                        /* Must match [\w.-]+ */
+                        for (i = 0; i < strlen(name); i++) {
+                                char c = name[i];
+                                if (isalnum(c))
+                                        continue;
+                                if ((c == '.') || (c == '-') || (c == '_'))
+                                        continue;
+                                return -EINVAL;
+                        }
+                        /* Specifying two names is forbidden */
+                        if (opts->name)
+                                return -EINVAL;
+                        opts->name = kstrndup(name,
+                                              MAX_CGROUP_ROOT_NAMELEN,
+                                              GFP_KERNEL);
+                        if (!opts->name)
+                                return -ENOMEM;
                } else {
                        struct cgroup_subsys *ss;
                        int i;
@@ -906,6 +1049,8 @@ static int parse_cgroupfs_options(char *data,
                }
        }
+        /* Consistency checks */
        /*
         * Option noprefix was introduced just for backward compatibility
         * with the old cpuset, so we allow noprefix only if mounting just
@@ -915,8 +1060,16 @@ static int parse_cgroupfs_options(char *data,
            (opts->subsys_bits & mask))
                return -EINVAL;
-        /* We can't have an empty hierarchy */
-        if (!opts->subsys_bits)
+        /* Can't specify "none" and some subsystems */
+        if (opts->subsys_bits && opts->none)
+                return -EINVAL;
+        /*
+         * We either have to specify by name or by subsystems. (So all
+         * empty hierarchies must have a name).
+         */
+        if (!opts->subsys_bits && !opts->name)
                return -EINVAL;
        return 0;
@@ -944,6 +1097,12 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
                goto out_unlock;
        }
+        /* Don't allow name to change at remount */
+        if (opts.name && strcmp(opts.name, root->name)) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
        ret = rebind_subsystems(root, opts.subsys_bits);
        if (ret)
                goto out_unlock;
@@ -955,6 +1114,7 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
                strcpy(root->release_agent_path, opts.release_agent);
 out_unlock:
        kfree(opts.release_agent);
+        kfree(opts.name);
        mutex_unlock(&cgroup_mutex);
        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
        unlock_kernel();
@@ -974,9 +1134,10 @@ static void init_cgroup_housekeeping(struct cgroup *cgrp)
        INIT_LIST_HEAD(&cgrp->children);
        INIT_LIST_HEAD(&cgrp->css_sets);
        INIT_LIST_HEAD(&cgrp->release_list);
-        INIT_LIST_HEAD(&cgrp->pids_list);
+        INIT_LIST_HEAD(&cgrp->pidlists);
-        init_rwsem(&cgrp->pids_mutex);
+        mutex_init(&cgrp->pidlist_mutex);
 }
 static void init_cgroup_root(struct cgroupfs_root *root)
 {
        struct cgroup *cgrp = &root->top_cgroup;
@@ -988,33 +1149,106 @@ static void init_cgroup_root(struct cgroupfs_root *root)
        init_cgroup_housekeeping(cgrp);
 }
+static bool init_root_id(struct cgroupfs_root *root)
+{
+        int ret = 0;
+        do {
+                if (!ida_pre_get(&hierarchy_ida, GFP_KERNEL))
+                        return false;
+                spin_lock(&hierarchy_id_lock);
+                /* Try to allocate the next unused ID */
+                ret = ida_get_new_above(&hierarchy_ida, next_hierarchy_id,
+                                        &root->hierarchy_id);
+                if (ret == -ENOSPC)
+                        /* Try again starting from 0 */
+                        ret = ida_get_new(&hierarchy_ida, &root->hierarchy_id);
+                if (!ret) {
+                        next_hierarchy_id = root->hierarchy_id + 1;
+                } else if (ret != -EAGAIN) {
+                        /* Can only get here if the 31-bit IDR is full ... */
+                        BUG_ON(ret);
+                }
+                spin_unlock(&hierarchy_id_lock);
+        } while (ret);
+        return true;
+}
 static int cgroup_test_super(struct super_block *sb, void *data)
 {
-        struct cgroupfs_root *new = data;
+        struct cgroup_sb_opts *opts = data;
        struct cgroupfs_root *root = sb->s_fs_info;
-        /* First check subsystems */
+        /* If we asked for a name then it must match */
-        if (new->subsys_bits != root->subsys_bits)
+        if (opts->name && strcmp(opts->name, root->name))
-            return 0;
+                return 0;
-        /* Next check flags */
+        /*
-        if (new->flags != root->flags)
+         * If we asked for subsystems (or explicitly for no
+         * subsystems) then they must match
+         */
+        if ((opts->subsys_bits || opts->none)
+            && (opts->subsys_bits != root->subsys_bits))
                return 0;
        return 1;
 }
+static struct cgroupfs_root *cgroup_root_from_opts(struct cgroup_sb_opts *opts)
+{
+        struct cgroupfs_root *root;
+        if (!opts->subsys_bits && !opts->none)
+                return NULL;
+        root = kzalloc(sizeof(*root), GFP_KERNEL);
+        if (!root)
+                return ERR_PTR(-ENOMEM);
+        if (!init_root_id(root)) {
+                kfree(root);
+                return ERR_PTR(-ENOMEM);
+        }
+        init_cgroup_root(root);
+        root->subsys_bits = opts->subsys_bits;
+        root->flags = opts->flags;
+        if (opts->release_agent)
+                strcpy(root->release_agent_path, opts->release_agent);
+        if (opts->name)
+                strcpy(root->name, opts->name);
+        return root;
+}
+static void cgroup_drop_root(struct cgroupfs_root *root)
+{
+        if (!root)
+                return;
+        BUG_ON(!root->hierarchy_id);
+        spin_lock(&hierarchy_id_lock);
+        ida_remove(&hierarchy_ida, root->hierarchy_id);
+        spin_unlock(&hierarchy_id_lock);
+        kfree(root);
+}
 static int cgroup_set_super(struct super_block *sb, void *data)
 {
        int ret;
-        struct cgroupfs_root *root = data;
+        struct cgroup_sb_opts *opts = data;
+        /* If we don't have a new root, we can't set up a new sb */
+        if (!opts->new_root)
+                return -EINVAL;
+        BUG_ON(!opts->subsys_bits && !opts->none);
        ret = set_anon_super(sb, NULL);
        if (ret)
                return ret;
-        sb->s_fs_info = root;
+        sb->s_fs_info = opts->new_root;
-        root->sb = sb;
+        opts->new_root->sb = sb;
        sb->s_blocksize = PAGE_CACHE_SIZE;
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
@@ -1051,48 +1285,43 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                         void *data, struct vfsmount *mnt)
 {
        struct cgroup_sb_opts opts;
+        struct cgroupfs_root *root;
        int ret = 0;
        struct super_block *sb;
-        struct cgroupfs_root *root;
+        struct cgroupfs_root *new_root;
-        struct list_head tmp_cg_links;
        /* First find the desired set of subsystems */
        ret = parse_cgroupfs_options(data, &opts);
-        if (ret) {
+        if (ret)
-                kfree(opts.release_agent);
+                goto out_err;
-                return ret;
-        }
-        root = kzalloc(sizeof(*root), GFP_KERNEL);
-        if (!root) {
-                kfree(opts.release_agent);
-                return -ENOMEM;
-        }
-        init_cgroup_root(root);
+        /*
-        root->subsys_bits = opts.subsys_bits;
+         * Allocate a new cgroup root. We may not need it if we're
-        root->flags = opts.flags;
+         * reusing an existing hierarchy.
-        if (opts.release_agent) {
+         */
-                strcpy(root->release_agent_path, opts.release_agent);
+        new_root = cgroup_root_from_opts(&opts);
-                kfree(opts.release_agent);
+        if (IS_ERR(new_root)) {
+                ret = PTR_ERR(new_root);
+                goto out_err;
        }
+        opts.new_root = new_root;
-        sb = sget(fs_type, cgroup_test_super, cgroup_set_super, root);
+        /* Locate an existing or new sb for this hierarchy */
+        sb = sget(fs_type, cgroup_test_super, cgroup_set_super, &opts);
        if (IS_ERR(sb)) {
-                kfree(root);
+                ret = PTR_ERR(sb);
-                return PTR_ERR(sb);
+                cgroup_drop_root(opts.new_root);
+                goto out_err;
        }
-        if (sb->s_fs_info != root) {
+        root = sb->s_fs_info;
-                /* Reusing an existing superblock */
+        BUG_ON(!root);
-                BUG_ON(sb->s_root == NULL);
+        if (root == opts.new_root) {
-                kfree(root);
+                /* We used the new root structure, so this is a new hierarchy */
-                root = NULL;
+                struct list_head tmp_cg_links;
-        } else {
-                /* New superblock */
                struct cgroup *root_cgrp = &root->top_cgroup;
                struct inode *inode;
+                struct cgroupfs_root *existing_root;
                int i;
                BUG_ON(sb->s_root != NULL);
@@ -1105,6 +1334,18 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                mutex_lock(&inode->i_mutex);
                mutex_lock(&cgroup_mutex);
+                if (strlen(root->name)) {
+                        /* Check for name clashes with existing mounts */
+                        for_each_active_root(existing_root) {
+                                if (!strcmp(existing_root->name, root->name)) {
+                                        ret = -EBUSY;
+                                        mutex_unlock(&cgroup_mutex);
+                                        mutex_unlock(&inode->i_mutex);
+                                        goto drop_new_super;
+                                }
+                        }
+                }
                /*
                 * We're accessing css_set_count without locking
                 * css_set_lock here, but that's OK - it can only be
@@ -1123,7 +1364,8 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                if (ret == -EBUSY) {
                        mutex_unlock(&cgroup_mutex);
                        mutex_unlock(&inode->i_mutex);
-                        goto free_cg_links;
+                        free_cg_links(&tmp_cg_links);
+                        goto drop_new_super;
                }
                /* EBUSY should be the only error here */
@@ -1155,17 +1397,27 @@ static int cgroup_get_sb(struct file_system_type *fs_type,
                BUG_ON(root->number_of_cgroups != 1);
                cgroup_populate_dir(root_cgrp);
-                mutex_unlock(&inode->i_mutex);
                mutex_unlock(&cgroup_mutex);
+                mutex_unlock(&inode->i_mutex);
+        } else {
+                /*
+                 * We re-used an existing hierarchy - the new root (if
+                 * any) is not needed
+                 */
+                cgroup_drop_root(opts.new_root);
        }
        simple_set_mnt(mnt, sb);
+        kfree(opts.release_agent);
+        kfree(opts.name);
        return 0;
- free_cg_links:
-        free_cg_links(&tmp_cg_links);
 drop_new_super:
        deactivate_locked_super(sb);
+ out_err:
+        kfree(opts.release_agent);
+        kfree(opts.name);
        return ret;
 }
@@ -1211,7 +1463,7 @@ static void cgroup_kill_sb(struct super_block *sb) {
        mutex_unlock(&cgroup_mutex);
        kill_litter_super(sb);
-        kfree(root);
+        cgroup_drop_root(root);
 }
 static struct file_system_type cgroup_fs_type = {
@@ -1276,27 +1528,6 @@ int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
        return 0;
 }
-/*
- * Return the first subsystem attached to a cgroup's hierarchy, and
- * its subsystem id.
- */
-static void get_first_subsys(const struct cgroup *cgrp,
-                        struct cgroup_subsys_state **css, int *subsys_id)
-{
-        const struct cgroupfs_root *root = cgrp->root;
-        const struct cgroup_subsys *test_ss;
-        BUG_ON(list_empty(&root->subsys_list));
-        test_ss = list_entry(root->subsys_list.next,
-                             struct cgroup_subsys, sibling);
-        if (css) {
-                *css = cgrp->subsys[test_ss->subsys_id];
-                BUG_ON(!*css);
-        }
-        if (subsys_id)
-                *subsys_id = test_ss->subsys_id;
-}
 /**
 * cgroup_attach_task - attach task 'tsk' to cgroup 'cgrp'
 * @cgrp: the cgroup the task is attaching to
@@ -1313,18 +1544,15 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
        struct css_set *cg;
        struct css_set *newcg;
        struct cgroupfs_root *root = cgrp->root;
-        int subsys_id;
-        get_first_subsys(cgrp, NULL, &subsys_id);
        /* Nothing to do if the task is already in that cgroup */
-        oldcgrp = task_cgroup(tsk, subsys_id);
+        oldcgrp = task_cgroup_from_root(tsk, root);
        if (cgrp == oldcgrp)
                return 0;
        for_each_subsys(root, ss) {
                if (ss->can_attach) {
-                        retval = ss->can_attach(ss, cgrp, tsk);
+                        retval = ss->can_attach(ss, cgrp, tsk, false);
                        if (retval)
                                return retval;
                }
@@ -1362,7 +1590,7 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
        for_each_subsys(root, ss) {
                if (ss->attach)
-                        ss->attach(ss, cgrp, oldcgrp, tsk);
+                        ss->attach(ss, cgrp, oldcgrp, tsk, false);
        }
        set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
        synchronize_rcu();
@@ -1423,15 +1651,6 @@ static int cgroup_tasks_write(struct cgroup *cgrp, struct cftype *cft, u64 pid)
        return ret;
 }
-/* The various types of files and directories in a cgroup file system */
-enum cgroup_filetype {
-        FILE_ROOT,
-        FILE_DIR,
-        FILE_TASKLIST,
-        FILE_NOTIFY_ON_RELEASE,
-        FILE_RELEASE_AGENT,
-};
 /**
 * cgroup_lock_live_group - take cgroup_mutex and check that cgrp is alive.
 * @cgrp: the cgroup to be checked for liveness
@@ -1644,7 +1863,7 @@ static int cgroup_seqfile_release(struct inode *inode, struct file *file)
        return single_release(inode, file);
 }
-static struct file_operations cgroup_seqfile_operations = {
+static const struct file_operations cgroup_seqfile_operations = {
        .read = seq_read,
        .write = cgroup_file_write,
        .llseek = seq_lseek,
@@ -1703,7 +1922,7 @@ static int cgroup_rename(struct inode *old_dir, struct dentry *old_dentry,
        return simple_rename(old_dir, old_dentry, new_dir, new_dentry);
 }
-static struct file_operations cgroup_file_operations = {
+static const struct file_operations cgroup_file_operations = {
        .read = cgroup_file_read,
        .write = cgroup_file_write,
        .llseek = generic_file_llseek,
@@ -1876,7 +2095,7 @@ int cgroup_task_count(const struct cgroup *cgrp)
 * the start of a css_set
 */
 static void cgroup_advance_iter(struct cgroup *cgrp,
-                                          struct cgroup_iter *it)
+                                struct cgroup_iter *it)
 {
        struct list_head *l = it->cg_link;
        struct cg_cgroup_link *link;
@@ -2129,7 +2348,7 @@ int cgroup_scan_tasks(struct cgroup_scanner *scan)
 }
 /*
- * Stuff for reading the 'tasks' file.
+ * Stuff for reading the 'tasks'/'procs' files.
 *
 * Reading this file can return large amounts of data if a cgroup has
 * *lots* of attached tasks. So it may need several calls to read(),
@@ -2139,27 +2358,196 @@ int cgroup_scan_tasks(struct cgroup_scanner *scan)
 */
 /*
- * Load into 'pidarray' up to 'npids' of the tasks using cgroup
+ * The following two functions "fix" the issue where there are more pids
- * 'cgrp'.  Return actual number of pids loaded.  No need to
+ * than kmalloc will give memory for; in such cases, we use vmalloc/vfree.
- * task_lock(p) when reading out p->cgroup, since we're in an RCU
+ * TODO: replace with a kernel-wide solution to this problem
- * read section, so the css_set can't go away, and is
+ */
- * immutable after creation.
+#define PIDLIST_TOO_LARGE(c) ((c) * sizeof(pid_t) > (PAGE_SIZE * 2))
+static void *pidlist_allocate(int count)
+{
+        if (PIDLIST_TOO_LARGE(count))
+                return vmalloc(count * sizeof(pid_t));
+        else
+                return kmalloc(count * sizeof(pid_t), GFP_KERNEL);
+}
+static void pidlist_free(void *p)
+{
+        if (is_vmalloc_addr(p))
+                vfree(p);
+        else
+                kfree(p);
+}
+static void *pidlist_resize(void *p, int newcount)
+{
+        void *newlist;
+        /* note: if new alloc fails, old p will still be valid either way */
+        if (is_vmalloc_addr(p)) {
+                newlist = vmalloc(newcount * sizeof(pid_t));
+                if (!newlist)
+                        return NULL;
+                memcpy(newlist, p, newcount * sizeof(pid_t));
+                vfree(p);
+        } else {
+                newlist = krealloc(p, newcount * sizeof(pid_t), GFP_KERNEL);
+        }
+        return newlist;
+}
+/*
+ * pidlist_uniq - given a kmalloc()ed list, strip out all duplicate entries
+ * If the new stripped list is sufficiently smaller and there's enough memory
+ * to allocate a new buffer, will let go of the unneeded memory. Returns the
+ * number of unique elements.
+ */
+/* is the size difference enough that we should re-allocate the array? */
+#define PIDLIST_REALLOC_DIFFERENCE(old, new) ((old) - PAGE_SIZE >= (new))
+static int pidlist_uniq(pid_t **p, int length)
+{
+        int src, dest = 1;
+        pid_t *list = *p;
+        pid_t *newlist;
+        /*
+         * we presume the 0th element is unique, so i starts at 1. trivial
+         * edge cases first; no work needs to be done for either
+         */
+        if (length == 0 || length == 1)
+                return length;
+        /* src and dest walk down the list; dest counts unique elements */
+        for (src = 1; src < length; src++) {
+                /* find next unique element */
+                while (list[src] == list[src-1]) {
+                        src++;
+                        if (src == length)
+                                goto after;
+                }
+                /* dest always points to where the next unique element goes */
+                list[dest] = list[src];
+                dest++;
+        }
+after:
+        /*
+         * if the length difference is large enough, we want to allocate a
+         * smaller buffer to save memory. if this fails due to out of memory,
+         * we'll just stay with what we've got.
+         */
+        if (PIDLIST_REALLOC_DIFFERENCE(length, dest)) {
+                newlist = pidlist_resize(list, dest);
+                if (newlist)
+                        *p = newlist;
+        }
+        return dest;
+}
+static int cmppid(const void *a, const void *b)
+{
+        return *(pid_t *)a - *(pid_t *)b;
+}
+/*
+ * find the appropriate pidlist for our purpose (given procs vs tasks)
+ * returns with the lock on that pidlist already held, and takes care
+ * of the use count, or returns NULL with no locks held if we're out of
+ * memory.
 */
-static int pid_array_load(pid_t *pidarray, int npids, struct cgroup *cgrp)
+static struct cgroup_pidlist *cgroup_pidlist_find(struct cgroup *cgrp,
+                                                  enum cgroup_filetype type)
 {
-        int n = 0, pid;
+        struct cgroup_pidlist *l;
+        /* don't need task_nsproxy() if we're looking at ourself */
+        struct pid_namespace *ns = get_pid_ns(current->nsproxy->pid_ns);
+        /*
+         * We can't drop the pidlist_mutex before taking the l->mutex in case
+         * the last ref-holder is trying to remove l from the list at the same
+         * time. Holding the pidlist_mutex precludes somebody taking whichever
+         * list we find out from under us - compare release_pid_array().
+         */
+        mutex_lock(&cgrp->pidlist_mutex);
+        list_for_each_entry(l, &cgrp->pidlists, links) {
+                if (l->key.type == type && l->key.ns == ns) {
+                        /* found a matching list - drop the extra refcount */
+                        put_pid_ns(ns);
+                        /* make sure l doesn't vanish out from under us */
+                        down_write(&l->mutex);
+                        mutex_unlock(&cgrp->pidlist_mutex);
+                        l->use_count++;
+                        return l;
+                }
+        }
+        /* entry not found; create a new one */
+        l = kmalloc(sizeof(struct cgroup_pidlist), GFP_KERNEL);
+        if (!l) {
+                mutex_unlock(&cgrp->pidlist_mutex);
+                put_pid_ns(ns);
+                return l;
+        }
+        init_rwsem(&l->mutex);
+        down_write(&l->mutex);
+        l->key.type = type;
+        l->key.ns = ns;
+        l->use_count = 0; /* don't increment here */
+        l->list = NULL;
+        l->owner = cgrp;
+        list_add(&l->links, &cgrp->pidlists);
+        mutex_unlock(&cgrp->pidlist_mutex);
+        return l;
+}
+/*
+ * Load a cgroup's pidarray with either procs' tgids or tasks' pids
+ */
+static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type,
+                              struct cgroup_pidlist **lp)
+{
+        pid_t *array;
+        int length;
+        int pid, n = 0; /* used for populating the array */
        struct cgroup_iter it;
        struct task_struct *tsk;
+        struct cgroup_pidlist *l;
+        /*
+         * If cgroup gets more users after we read count, we won't have
+         * enough space - tough.  This race is indistinguishable to the
+         * caller from the case that the additional cgroup users didn't
+         * show up until sometime later on.
+         */
+        length = cgroup_task_count(cgrp);
+        array = pidlist_allocate(length);
+        if (!array)
+                return -ENOMEM;
+        /* now, populate the array */
        cgroup_iter_start(cgrp, &it);
        while ((tsk = cgroup_iter_next(cgrp, &it))) {
-                if (unlikely(n == npids))
+                if (unlikely(n == length))
                        break;
-                pid = task_pid_vnr(tsk);
+                /* get tgid or pid for procs or tasks file respectively */
-                if (pid > 0)
+                if (type == CGROUP_FILE_PROCS)
-                        pidarray[n++] = pid;
+                        pid = task_tgid_vnr(tsk);
+                else
+                        pid = task_pid_vnr(tsk);
+                if (pid > 0) /* make sure to only use valid results */
+                        array[n++] = pid;
        }
        cgroup_iter_end(cgrp, &it);
-        return n;
+        length = n;
+        /* now sort & (if procs) strip out duplicates */
+        sort(array, length, sizeof(pid_t), cmppid, NULL);
+        if (type == CGROUP_FILE_PROCS)
+                length = pidlist_uniq(&array, length);
+        l = cgroup_pidlist_find(cgrp, type);
+        if (!l) {
+                pidlist_free(array);
+                return -ENOMEM;
+        }
+        /* store array, freeing old if necessary - lock already held */
+        pidlist_free(l->list);
+        l->list = array;
+        l->length = length;
+        l->use_count++;
+        up_write(&l->mutex);
+        *lp = l;
+        return 0;
 }
 /**
@@ -2216,37 +2604,14 @@ err:
        return ret;
 }
-/*
- * Cache pids for all threads in the same pid namespace that are
- * opening the same "tasks" file.
- */
-struct cgroup_pids {
-        /* The node in cgrp->pids_list */
-        struct list_head list;
-        /* The cgroup those pids belong to */
-        struct cgroup *cgrp;
-        /* The namepsace those pids belong to */
-        struct pid_namespace *ns;
-        /* Array of process ids in the cgroup */
-        pid_t *tasks_pids;
-        /* How many files are using the this tasks_pids array */
-        int use_count;
-        /* Length of the current tasks_pids array */
-        int length;
-};
-static int cmppid(const void *a, const void *b)
-{
-        return *(pid_t *)a - *(pid_t *)b;
-}
 /*
- * seq_file methods for the "tasks" file. The seq_file position is the
+ * seq_file methods for the tasks/procs files. The seq_file position is the
 * next pid to display; the seq_file iterator is a pointer to the pid
- * in the cgroup->tasks_pids array.
+ * in the cgroup->l->list array.
 */
-static void *cgroup_tasks_start(struct seq_file *s, loff_t *pos)
+static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 {
        /*
         * Initially we receive a position value that corresponds to
@@ -2254,48 +2619,45 @@ static void *cgroup_tasks_start(struct seq_file *s, loff_t *pos)
         * after a seek to the start). Use a binary-search to find the
         * next pid to display, if any
         */
-        struct cgroup_pids *cp = s->private;
+        struct cgroup_pidlist *l = s->private;
-        struct cgroup *cgrp = cp->cgrp;
        int index = 0, pid = *pos;
        int *iter;
-        down_read(&cgrp->pids_mutex);
+        down_read(&l->mutex);
        if (pid) {
-                int end = cp->length;
+                int end = l->length;
                while (index < end) {
                        int mid = (index + end) / 2;
-                        if (cp->tasks_pids[mid] == pid) {
+                        if (l->list[mid] == pid) {
                                index = mid;
                                break;
-                        } else if (cp->tasks_pids[mid] <= pid)
+                        } else if (l->list[mid] <= pid)
                                index = mid + 1;
                        else
                                end = mid;
                }
        }
        /* If we're off the end of the array, we're done */
-        if (index >= cp->length)
+        if (index >= l->length)
                return NULL;
        /* Update the abstract position to be the actual pid that we found */
-        iter = cp->tasks_pids + index;
+        iter = l->list + index;
        *pos = *iter;
        return iter;
 }
-static void cgroup_tasks_stop(struct seq_file *s, void *v)
+static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 {
-        struct cgroup_pids *cp = s->private;
+        struct cgroup_pidlist *l = s->private;
-        struct cgroup *cgrp = cp->cgrp;
+        up_read(&l->mutex);
-        up_read(&cgrp->pids_mutex);
 }
-static void *cgroup_tasks_next(struct seq_file *s, void *v, loff_t *pos)
+static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct cgroup_pids *cp = s->private;
+        struct cgroup_pidlist *l = s->private;
-        int *p = v;
+        pid_t *p = v;
-        int *end = cp->tasks_pids + cp->length;
+        pid_t *end = l->list + l->length;
        /*
         * Advance to the next pid in the array. If this goes off the
         * end, we're done
@@ -2309,124 +2671,107 @@ static void *cgroup_tasks_next(struct seq_file *s, void *v, loff_t *pos)
        }
 }
-static int cgroup_tasks_show(struct seq_file *s, void *v)
+static int cgroup_pidlist_show(struct seq_file *s, void *v)
 {
        return seq_printf(s, "%d\n", *(int *)v);
 }
-static struct seq_operations cgroup_tasks_seq_operations = {
+/*
-        .start = cgroup_tasks_start,
+ * seq_operations functions for iterating on pidlists through seq_file -
-        .stop = cgroup_tasks_stop,
+ * independent of whether it's tasks or procs
-        .next = cgroup_tasks_next,
+ */
-        .show = cgroup_tasks_show,
+static const struct seq_operations cgroup_pidlist_seq_operations = {
+        .start = cgroup_pidlist_start,
+        .stop = cgroup_pidlist_stop,
+        .next = cgroup_pidlist_next,
+        .show = cgroup_pidlist_show,
 };
-static void release_cgroup_pid_array(struct cgroup_pids *cp)
+static void cgroup_release_pid_array(struct cgroup_pidlist *l)
 {
-        struct cgroup *cgrp = cp->cgrp;
+        /*
+         * the case where we're the last user of this particular pidlist will
-        down_write(&cgrp->pids_mutex);
+         * have us remove it from the cgroup's list, which entails taking the
-        BUG_ON(!cp->use_count);
+         * mutex. since in pidlist_find the pidlist->lock depends on cgroup->
-        if (!--cp->use_count) {
+         * pidlist_mutex, we have to take pidlist_mutex first.
-                list_del(&cp->list);
+         */
-                put_pid_ns(cp->ns);
+        mutex_lock(&l->owner->pidlist_mutex);
-                kfree(cp->tasks_pids);
+        down_write(&l->mutex);
-                kfree(cp);
+        BUG_ON(!l->use_count);
+        if (!--l->use_count) {
+                /* we're the last user if refcount is 0; remove and free */
+                list_del(&l->links);
+                mutex_unlock(&l->owner->pidlist_mutex);
+                pidlist_free(l->list);
+                put_pid_ns(l->key.ns);
+                up_write(&l->mutex);
+                kfree(l);
+                return;
        }
-        up_write(&cgrp->pids_mutex);
+        mutex_unlock(&l->owner->pidlist_mutex);
+        up_write(&l->mutex);
 }
-static int cgroup_tasks_release(struct inode *inode, struct file *file)
+static int cgroup_pidlist_release(struct inode *inode, struct file *file)
 {
-        struct seq_file *seq;
+        struct cgroup_pidlist *l;
-        struct cgroup_pids *cp;
        if (!(file->f_mode & FMODE_READ))
                return 0;
+        /*
-        seq = file->private_data;
+         * the seq_file will only be initialized if the file was opened for
-        cp = seq->private;
+         * reading; hence we check if it's not null only in that case.
+         */
-        release_cgroup_pid_array(cp);
+        l = ((struct seq_file *)file->private_data)->private;
+        cgroup_release_pid_array(l);
        return seq_release(inode, file);
 }
-static struct file_operations cgroup_tasks_operations = {
+static const struct file_operations cgroup_pidlist_operations = {
        .read = seq_read,
        .llseek = seq_lseek,
        .write = cgroup_file_write,
-        .release = cgroup_tasks_release,
+        .release = cgroup_pidlist_release,
 };
 /*
- * Handle an open on 'tasks' file.  Prepare an array containing the
+ * The following functions handle opens on a file that displays a pidlist
- * process id's of tasks currently attached to the cgroup being opened.
+ * (tasks or procs). Prepare an array of the process/thread IDs of whoever's
+ * in the cgroup.
 */
+/* helper function for the two below it */
-static int cgroup_tasks_open(struct inode *unused, struct file *file)
+static int cgroup_pidlist_open(struct file *file, enum cgroup_filetype type)
 {
        struct cgroup *cgrp = __d_cgrp(file->f_dentry->d_parent);
-        struct pid_namespace *ns = current->nsproxy->pid_ns;
+        struct cgroup_pidlist *l;
-        struct cgroup_pids *cp;
-        pid_t *pidarray;
-        int npids;
        int retval;
        /* Nothing to do for write-only files */
        if (!(file->f_mode & FMODE_READ))
                return 0;
-        /*
+        /* have the array populated */
-         * If cgroup gets more users after we read count, we won't have
+        retval = pidlist_array_load(cgrp, type, &l);
-         * enough space - tough.  This race is indistinguishable to the
+        if (retval)
-         * caller from the case that the additional cgroup users didn't
+                return retval;
-         * show up until sometime later on.
+        /* configure file information */
-         */
+        file->f_op = &cgroup_pidlist_operations;
-        npids = cgroup_task_count(cgrp);
-        pidarray = kmalloc(npids * sizeof(pid_t), GFP_KERNEL);
-        if (!pidarray)
-                return -ENOMEM;
-        npids = pid_array_load(pidarray, npids, cgrp);
-        sort(pidarray, npids, sizeof(pid_t), cmppid, NULL);
-        /*
-         * Store the array in the cgroup, freeing the old
-         * array if necessary
-         */
-        down_write(&cgrp->pids_mutex);
-        list_for_each_entry(cp, &cgrp->pids_list, list) {
-                if (ns == cp->ns)
-                        goto found;
-        }
-        cp = kzalloc(sizeof(*cp), GFP_KERNEL);
-        if (!cp) {
-                up_write(&cgrp->pids_mutex);
-                kfree(pidarray);
-                return -ENOMEM;
-        }
-        cp->cgrp = cgrp;
-        cp->ns = ns;
-        get_pid_ns(ns);
-        list_add(&cp->list, &cgrp->pids_list);
-found:
-        kfree(cp->tasks_pids);
-        cp->tasks_pids = pidarray;
-        cp->length = npids;
-        cp->use_count++;
-        up_write(&cgrp->pids_mutex);
-        file->f_op = &cgroup_tasks_operations;
-        retval = seq_open(file, &cgroup_tasks_seq_operations);
+        retval = seq_open(file, &cgroup_pidlist_seq_operations);
        if (retval) {
-                release_cgroup_pid_array(cp);
+                cgroup_release_pid_array(l);
                return retval;
        }
-        ((struct seq_file *)file->private_data)->private = cp;
+        ((struct seq_file *)file->private_data)->private = l;
        return 0;
 }
+static int cgroup_tasks_open(struct inode *unused, struct file *file)
+{
+        return cgroup_pidlist_open(file, CGROUP_FILE_TASKS);
+}
+static int cgroup_procs_open(struct inode *unused, struct file *file)
+{
+        return cgroup_pidlist_open(file, CGROUP_FILE_PROCS);
+}
 static u64 cgroup_read_notify_on_release(struct cgroup *cgrp,
                                            struct cftype *cft)
@@ -2449,21 +2794,27 @@ static int cgroup_write_notify_on_release(struct cgroup *cgrp,
 /*
 * for the common functions, 'private' gives the type of file
 */
+/* for hysterical raisins, we can't put this on the older files */
+#define CGROUP_FILE_GENERIC_PREFIX "cgroup."
 static struct cftype files[] = {
        {
                .name = "tasks",
                .open = cgroup_tasks_open,
                .write_u64 = cgroup_tasks_write,
-                .release = cgroup_tasks_release,
+                .release = cgroup_pidlist_release,
-                .private = FILE_TASKLIST,
                .mode = S_IRUGO | S_IWUSR,
        },
+        {
+                .name = CGROUP_FILE_GENERIC_PREFIX "procs",
+                .open = cgroup_procs_open,
+                /* .write_u64 = cgroup_procs_write, TODO */
+                .release = cgroup_pidlist_release,
+                .mode = S_IRUGO,
+        },
        {
                .name = "notify_on_release",
                .read_u64 = cgroup_read_notify_on_release,
                .write_u64 = cgroup_write_notify_on_release,
-                .private = FILE_NOTIFY_ON_RELEASE,
        },
 };
@@ -2472,7 +2823,6 @@ static struct cftype cft_release_agent = {
        .read_seq_string = cgroup_release_agent_show,
        .write_string = cgroup_release_agent_write,
        .max_write_len = PATH_MAX,
-        .private = FILE_RELEASE_AGENT,
 };
 static int cgroup_populate_dir(struct cgroup *cgrp)
@@ -2879,6 +3229,7 @@ int __init cgroup_init_early(void)
        init_task.cgroups = &init_css_set;
        init_css_set_link.cg = &init_css_set;
+        init_css_set_link.cgrp = dummytop;
        list_add(&init_css_set_link.cgrp_link_list,
                 &rootnode.top_cgroup.css_sets);
        list_add(&init_css_set_link.cg_link_list,
@@ -2933,7 +3284,7 @@ int __init cgroup_init(void)
        /* Add init_css_set to the hash table */
        hhead = css_set_hash(init_css_set.subsys);
        hlist_add_head(&init_css_set.hlist, hhead);
+        BUG_ON(!init_root_id(&rootnode));
        err = register_filesystem(&cgroup_fs_type);
        if (err < 0)
                goto out;
@@ -2986,15 +3337,16 @@ static int proc_cgroup_show(struct seq_file *m, void *v)
        for_each_active_root(root) {
                struct cgroup_subsys *ss;
                struct cgroup *cgrp;
-                int subsys_id;
                int count = 0;
-                seq_printf(m, "%lu:", root->subsys_bits);
+                seq_printf(m, "%d:", root->hierarchy_id);
                for_each_subsys(root, ss)
                        seq_printf(m, "%s%s", count++ ? "," : "", ss->name);
+                if (strlen(root->name))
+                        seq_printf(m, "%sname=%s", count ? "," : "",
+                                   root->name);
                seq_putc(m, ':');
-                get_first_subsys(&root->top_cgroup, NULL, &subsys_id);
+                cgrp = task_cgroup_from_root(tsk, root);
-                cgrp = task_cgroup(tsk, subsys_id);
                retval = cgroup_path(cgrp, buf, PAGE_SIZE);
                if (retval < 0)
                        goto out_unlock;
@@ -3017,7 +3369,7 @@ static int cgroup_open(struct inode *inode, struct file *file)
        return single_open(file, proc_cgroup_show, pid);
 }
-struct file_operations proc_cgroup_operations = {
+const struct file_operations proc_cgroup_operations = {
        .open           = cgroup_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
@@ -3033,8 +3385,8 @@ static int proc_cgroupstats_show(struct seq_file *m, void *v)
        mutex_lock(&cgroup_mutex);
        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                struct cgroup_subsys *ss = subsys[i];
-                seq_printf(m, "%s\t%lu\t%d\t%d\n",
+                seq_printf(m, "%s\t%d\t%d\t%d\n",
-                           ss->name, ss->root->subsys_bits,
+                           ss->name, ss->root->hierarchy_id,
                           ss->root->number_of_cgroups, !ss->disabled);
        }
        mutex_unlock(&cgroup_mutex);
@@ -3046,7 +3398,7 @@ static int cgroupstats_open(struct inode *inode, struct file *file)
        return single_open(file, proc_cgroupstats_show, NULL);
 }
-static struct file_operations proc_cgroupstats_operations = {
+static const struct file_operations proc_cgroupstats_operations = {
        .open = cgroupstats_open,
        .read = seq_read,
        .llseek = seq_lseek,
@@ -3320,13 +3672,11 @@ int cgroup_is_descendant(const struct cgroup *cgrp, struct task_struct *task)
 {
        int ret;
        struct cgroup *target;
-        int subsys_id;
        if (cgrp == dummytop)
                return 1;
-        get_first_subsys(cgrp, NULL, &subsys_id);
+        target = task_cgroup_from_root(task, cgrp->root);
-        target = task_cgroup(task, subsys_id);
        while (cgrp != target && cgrp!= cgrp->top_cgroup)
                cgrp = cgrp->parent;
        ret = (cgrp == target);
@@ -3358,8 +3708,10 @@ static void check_for_release(struct cgroup *cgrp)
 void __css_put(struct cgroup_subsys_state *css)
 {
        struct cgroup *cgrp = css->cgroup;
+        int val;
        rcu_read_lock();
-        if (atomic_dec_return(&css->refcnt) == 1) {
+        val = atomic_dec_return(&css->refcnt);
+        if (val == 1) {
                if (notify_on_release(cgrp)) {
                        set_bit(CGRP_RELEASABLE, &cgrp->flags);
                        check_for_release(cgrp);
@@ -3367,6 +3719,7 @@ void __css_put(struct cgroup_subsys_state *css)
                cgroup_wakeup_rmdir_waiter(cgrp);
        }
        rcu_read_unlock();
+        WARN_ON_ONCE(val < 1);
 }
 /*
@@ -3693,3 +4046,154 @@ css_get_next(struct cgroup_subsys *ss, int id,
        return ret;
 }
+#ifdef CONFIG_CGROUP_DEBUG
+static struct cgroup_subsys_state *debug_create(struct cgroup_subsys *ss,
+                                                   struct cgroup *cont)
+{
+        struct cgroup_subsys_state *css = kzalloc(sizeof(*css), GFP_KERNEL);
+        if (!css)
+                return ERR_PTR(-ENOMEM);
+        return css;
+}
+static void debug_destroy(struct cgroup_subsys *ss, struct cgroup *cont)
+{
+        kfree(cont->subsys[debug_subsys_id]);
+}
+static u64 cgroup_refcount_read(struct cgroup *cont, struct cftype *cft)
+{
+        return atomic_read(&cont->count);
+}
+static u64 debug_taskcount_read(struct cgroup *cont, struct cftype *cft)
+{
+        return cgroup_task_count(cont);
+}
+static u64 current_css_set_read(struct cgroup *cont, struct cftype *cft)
+{
+        return (u64)(unsigned long)current->cgroups;
+}
+static u64 current_css_set_refcount_read(struct cgroup *cont,
+                                           struct cftype *cft)
+{
+        u64 count;
+        rcu_read_lock();
+        count = atomic_read(&current->cgroups->refcount);
+        rcu_read_unlock();
+        return count;
+}
+static int current_css_set_cg_links_read(struct cgroup *cont,
+                                         struct cftype *cft,
+                                         struct seq_file *seq)
+{
+        struct cg_cgroup_link *link;
+        struct css_set *cg;
+        read_lock(&css_set_lock);
+        rcu_read_lock();
+        cg = rcu_dereference(current->cgroups);
+        list_for_each_entry(link, &cg->cg_links, cg_link_list) {
+                struct cgroup *c = link->cgrp;
+                const char *name;
+                if (c->dentry)
+                        name = c->dentry->d_name.name;
+                else
+                        name = "?";
+                seq_printf(seq, "Root %d group %s\n",
+                           c->root->hierarchy_id, name);
+        }
+        rcu_read_unlock();
+        read_unlock(&css_set_lock);
+        return 0;
+}
+#define MAX_TASKS_SHOWN_PER_CSS 25
+static int cgroup_css_links_read(struct cgroup *cont,
+                                 struct cftype *cft,
+                                 struct seq_file *seq)
+{
+        struct cg_cgroup_link *link;
+        read_lock(&css_set_lock);
+        list_for_each_entry(link, &cont->css_sets, cgrp_link_list) {
+                struct css_set *cg = link->cg;
+                struct task_struct *task;
+                int count = 0;
+                seq_printf(seq, "css_set %p\n", cg);
+                list_for_each_entry(task, &cg->tasks, cg_list) {
+                        if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
+                                seq_puts(seq, "  ...\n");
+                                break;
+                        } else {
+                                seq_printf(seq, "  task %d\n",
+                                           task_pid_vnr(task));
+                        }
+                }
+        }
+        read_unlock(&css_set_lock);
+        return 0;
+}
+static u64 releasable_read(struct cgroup *cgrp, struct cftype *cft)
+{
+        return test_bit(CGRP_RELEASABLE, &cgrp->flags);
+}
+static struct cftype debug_files[] =  {
+        {
+                .name = "cgroup_refcount",
+                .read_u64 = cgroup_refcount_read,
+        },
+        {
+                .name = "taskcount",
+                .read_u64 = debug_taskcount_read,
+        },
+        {
+                .name = "current_css_set",
+                .read_u64 = current_css_set_read,
+        },
+        {
+                .name = "current_css_set_refcount",
+                .read_u64 = current_css_set_refcount_read,
+        },
+        {
+                .name = "current_css_set_cg_links",
+                .read_seq_string = current_css_set_cg_links_read,
+        },
+        {
+                .name = "cgroup_css_links",
+                .read_seq_string = cgroup_css_links_read,
+        },
+        {
+                .name = "releasable",
+                .read_u64 = releasable_read,
+        },
+};
+static int debug_populate(struct cgroup_subsys *ss, struct cgroup *cont)
+{
+        return cgroup_add_files(cont, ss, debug_files,
+                                ARRAY_SIZE(debug_files));
+}
+struct cgroup_subsys debug_subsys = {
+        .name = "debug",
+        .create = debug_create,
+        .destroy = debug_destroy,
+        .populate = debug_populate,
+        .subsys_id = debug_subsys_id,
+};
+#endif /* CONFIG_CGROUP_DEBUG */
diff --git a/kernel/cgroup_debug.c b/kernel/cgroup_debug.c
deleted file mode 100644
index 0c92d797baa6..000000000000
--- a/kernel/cgroup_debug.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * kernel/cgroup_debug.c - Example cgroup subsystem that
- * exposes debug info
- *
- * Copyright (C) Google Inc, 2007
- *
- * Developed by Paul Menage (menage@google.com)
- *
- */
-#include <linux/cgroup.h>
-#include <linux/fs.h>
-#include <linux/slab.h>
-#include <linux/rcupdate.h>
-#include <asm/atomic.h>
-static struct cgroup_subsys_state *debug_create(struct cgroup_subsys *ss,
-                                                   struct cgroup *cont)
-{
-        struct cgroup_subsys_state *css = kzalloc(sizeof(*css), GFP_KERNEL);
-        if (!css)
-                return ERR_PTR(-ENOMEM);
-        return css;
-}
-static void debug_destroy(struct cgroup_subsys *ss, struct cgroup *cont)
-{
-        kfree(cont->subsys[debug_subsys_id]);
-}
-static u64 cgroup_refcount_read(struct cgroup *cont, struct cftype *cft)
-{
-        return atomic_read(&cont->count);
-}
-static u64 taskcount_read(struct cgroup *cont, struct cftype *cft)
-{
-        u64 count;
-        count = cgroup_task_count(cont);
-        return count;
-}
-static u64 current_css_set_read(struct cgroup *cont, struct cftype *cft)
-{
-        return (u64)(long)current->cgroups;
-}
-static u64 current_css_set_refcount_read(struct cgroup *cont,
-                                           struct cftype *cft)
-{
-        u64 count;
-        rcu_read_lock();
-        count = atomic_read(&current->cgroups->refcount);
-        rcu_read_unlock();
-        return count;
-}
-static u64 releasable_read(struct cgroup *cgrp, struct cftype *cft)
-{
-        return test_bit(CGRP_RELEASABLE, &cgrp->flags);
-}
-static struct cftype files[] =  {
-        {
-                .name = "cgroup_refcount",
-                .read_u64 = cgroup_refcount_read,
-        },
-        {
-                .name = "taskcount",
-                .read_u64 = taskcount_read,
-        },
-        {
-                .name = "current_css_set",
-                .read_u64 = current_css_set_read,
-        },
-        {
-                .name = "current_css_set_refcount",
-                .read_u64 = current_css_set_refcount_read,
-        },
-        {
-                .name = "releasable",
-                .read_u64 = releasable_read,
-        },
-};
-static int debug_populate(struct cgroup_subsys *ss, struct cgroup *cont)
-{
-        return cgroup_add_files(cont, ss, files, ARRAY_SIZE(files));
-}
-struct cgroup_subsys debug_subsys = {
-        .name = "debug",
-        .create = debug_create,
-        .destroy = debug_destroy,
-        .populate = debug_populate,
-        .subsys_id = debug_subsys_id,
-};
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index fb249e2bcada..59e9ef6aab40 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -159,7 +159,7 @@ static bool is_task_frozen_enough(struct task_struct *task)
 */
 static int freezer_can_attach(struct cgroup_subsys *ss,
                              struct cgroup *new_cgroup,
-                              struct task_struct *task)
+                              struct task_struct *task, bool threadgroup)
 {
        struct freezer *freezer;
@@ -177,6 +177,19 @@ static int freezer_can_attach(struct cgroup_subsys *ss,
        if (freezer->state == CGROUP_FROZEN)
                return -EBUSY;
+        if (threadgroup) {
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &task->thread_group, thread_group) {
+                        if (is_task_frozen_enough(c)) {
+                                rcu_read_unlock();
+                                return -EBUSY;
+                        }
+                }
+                rcu_read_unlock();
+        }
        return 0;
 }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 7e75a41bd508..b5cb469d2545 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1324,9 +1324,10 @@ static int fmeter_getrate(struct fmeter *fmp)
 static cpumask_var_t cpus_attach;
 /* Called by cgroups to determine if a cpuset is usable; cgroup_mutex held */
-static int cpuset_can_attach(struct cgroup_subsys *ss,
+static int cpuset_can_attach(struct cgroup_subsys *ss, struct cgroup *cont,
-                             struct cgroup *cont, struct task_struct *tsk)
+                             struct task_struct *tsk, bool threadgroup)
 {
+        int ret;
        struct cpuset *cs = cgroup_cs(cont);
        if (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed))
@@ -1343,18 +1344,51 @@ static int cpuset_can_attach(struct cgroup_subsys *ss,
        if (tsk->flags & PF_THREAD_BOUND)
                return -EINVAL;
-        return security_task_setscheduler(tsk, 0, NULL);
+        ret = security_task_setscheduler(tsk, 0, NULL);
+        if (ret)
+                return ret;
+        if (threadgroup) {
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
+                        ret = security_task_setscheduler(c, 0, NULL);
+                        if (ret) {
+                                rcu_read_unlock();
+                                return ret;
+                        }
+                }
+                rcu_read_unlock();
+        }
+        return 0;
+}
+static void cpuset_attach_task(struct task_struct *tsk, nodemask_t *to,
+                               struct cpuset *cs)
+{
+        int err;
+        /*
+         * can_attach beforehand should guarantee that this doesn't fail.
+         * TODO: have a better way to handle failure here
+         */
+        err = set_cpus_allowed_ptr(tsk, cpus_attach);
+        WARN_ON_ONCE(err);
+        task_lock(tsk);
+        cpuset_change_task_nodemask(tsk, to);
+        task_unlock(tsk);
+        cpuset_update_task_spread_flag(cs, tsk);
 }
-static void cpuset_attach(struct cgroup_subsys *ss,
+static void cpuset_attach(struct cgroup_subsys *ss, struct cgroup *cont,
-                          struct cgroup *cont, struct cgroup *oldcont,
+                          struct cgroup *oldcont, struct task_struct *tsk,
-                          struct task_struct *tsk)
+                          bool threadgroup)
 {
        nodemask_t from, to;
        struct mm_struct *mm;
        struct cpuset *cs = cgroup_cs(cont);
        struct cpuset *oldcs = cgroup_cs(oldcont);
-        int err;
        if (cs == &top_cpuset) {
                cpumask_copy(cpus_attach, cpu_possible_mask);
@@ -1363,15 +1397,19 @@ static void cpuset_attach(struct cgroup_subsys *ss,
                guarantee_online_cpus(cs, cpus_attach);
                guarantee_online_mems(cs, &to);
        }
-        err = set_cpus_allowed_ptr(tsk, cpus_attach);
-        if (err)
-                return;
-        task_lock(tsk);
+        /* do per-task migration stuff possibly for each in the threadgroup */
-        cpuset_change_task_nodemask(tsk, &to);
+        cpuset_attach_task(tsk, &to, cs);
-        task_unlock(tsk);
+        if (threadgroup) {
-        cpuset_update_task_spread_flag(cs, tsk);
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
+                        cpuset_attach_task(c, &to, cs);
+                }
+                rcu_read_unlock();
+        }
+        /* change mm; only needs to be done once even if threadgroup */
        from = oldcs->mems_allowed;
        to = cs->mems_allowed;
        mm = get_task_mm(tsk);
diff --git a/kernel/cred.c b/kernel/cred.c
index d7f7a01082eb..dd76cfe5f5b0 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -782,6 +782,25 @@ EXPORT_SYMBOL(set_create_files_as);
 #ifdef CONFIG_DEBUG_CREDENTIALS
+bool creds_are_invalid(const struct cred *cred)
+{
+        if (cred->magic != CRED_MAGIC)
+                return true;
+        if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))
+                return true;
+#ifdef CONFIG_SECURITY_SELINUX
+        if (selinux_is_enabled()) {
+                if ((unsigned long) cred->security < PAGE_SIZE)
+                        return true;
+                if ((*(u32 *)cred->security & 0xffffff00) ==
+                    (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))
+                        return true;
+        }
+#endif
+        return false;
+}
+EXPORT_SYMBOL(creds_are_invalid);
 /*
 * dump invalid credentials
 */
diff --git a/kernel/exit.c b/kernel/exit.c
index e47ee8a06135..e61891f80123 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -359,8 +359,10 @@ void __set_special_pids(struct pid *pid)
 {
        struct task_struct *curr = current->group_leader;
-        if (task_session(curr) != pid)
+        if (task_session(curr) != pid) {
                change_pid(curr, PIDTYPE_SID, pid);
+                proc_sid_connector(curr);
+        }
        if (task_pgrp(curr) != pid)
                change_pid(curr, PIDTYPE_PGID, pid);
@@ -945,6 +947,8 @@ NORET_TYPE void do_exit(long code)
        if (group_dead) {
                hrtimer_cancel(&tsk->signal->real_timer);
                exit_itimers(tsk->signal);
+                if (tsk->mm)
+                        setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
        }
        acct_collect(code, group_dead);
        if (group_dead)
@@ -972,8 +976,6 @@ NORET_TYPE void do_exit(long code)
                disassociate_ctty(1);
        module_put(task_thread_info(tsk)->exec_domain->module);
-        if (tsk->binfmt)
-                module_put(tsk->binfmt->module);
        proc_exit_connector(tsk);
@@ -989,8 +991,6 @@ NORET_TYPE void do_exit(long code)
        tsk->mempolicy = NULL;
 #endif
 #ifdef CONFIG_FUTEX
-        if (unlikely(!list_empty(&tsk->pi_state_list)))
-                exit_pi_state_list(tsk);
        if (unlikely(current->pi_state_cache))
                kfree(current->pi_state_cache);
 #endif
@@ -1093,28 +1093,28 @@ struct wait_opts {
        int __user              *wo_stat;
        struct rusage __user    *wo_rusage;
+        wait_queue_t            child_wait;
        int                     notask_error;
 };
-static struct pid *task_pid_type(struct task_struct *task, enum pid_type type)
+static inline
+struct pid *task_pid_type(struct task_struct *task, enum pid_type type)
 {
-        struct pid *pid = NULL;
+        if (type != PIDTYPE_PID)
-        if (type == PIDTYPE_PID)
+                task = task->group_leader;
-                pid = task->pids[type].pid;
+        return task->pids[type].pid;
-        else if (type < PIDTYPE_MAX)
-                pid = task->group_leader->pids[type].pid;
-        return pid;
 }
-static int eligible_child(struct wait_opts *wo, struct task_struct *p)
+static int eligible_pid(struct wait_opts *wo, struct task_struct *p)
 {
-        int err;
+        return  wo->wo_type == PIDTYPE_MAX ||
+                task_pid_type(p, wo->wo_type) == wo->wo_pid;
-        if (wo->wo_type < PIDTYPE_MAX) {
+}
-                if (task_pid_type(p, wo->wo_type) != wo->wo_pid)
-                        return 0;
-        }
+static int eligible_child(struct wait_opts *wo, struct task_struct *p)
+{
+        if (!eligible_pid(wo, p))
+                return 0;
        /* Wait for all children (clone and not) if __WALL is set;
         * otherwise, wait for clone children *only* if __WCLONE is
         * set; otherwise, wait for non-clone children *only*.  (Note:
@@ -1124,10 +1124,6 @@ static int eligible_child(struct wait_opts *wo, struct task_struct *p)
            && !(wo->wo_flags & __WALL))
                return 0;
-        err = security_task_wait(p);
-        if (err)
-                return err;
        return 1;
 }
@@ -1140,18 +1136,20 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
        put_task_struct(p);
        infop = wo->wo_info;
-        if (!retval)
+        if (infop) {
-                retval = put_user(SIGCHLD, &infop->si_signo);
+                if (!retval)
-        if (!retval)
+                        retval = put_user(SIGCHLD, &infop->si_signo);
-                retval = put_user(0, &infop->si_errno);
+                if (!retval)
-        if (!retval)
+                        retval = put_user(0, &infop->si_errno);
-                retval = put_user((short)why, &infop->si_code);
+                if (!retval)
-        if (!retval)
+                        retval = put_user((short)why, &infop->si_code);
-                retval = put_user(pid, &infop->si_pid);
+                if (!retval)
-        if (!retval)
+                        retval = put_user(pid, &infop->si_pid);
-                retval = put_user(uid, &infop->si_uid);
+                if (!retval)
-        if (!retval)
+                        retval = put_user(uid, &infop->si_uid);
-                retval = put_user(status, &infop->si_status);
+                if (!retval)
+                        retval = put_user(status, &infop->si_status);
+        }
        if (!retval)
                retval = pid;
        return retval;
@@ -1208,6 +1206,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
        if (likely(!traced) && likely(!task_detached(p))) {
                struct signal_struct *psig;
                struct signal_struct *sig;
+                unsigned long maxrss;
                /*
                 * The resource counters for the group leader are in its
@@ -1256,6 +1255,9 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
                psig->coublock +=
                        task_io_get_oublock(p) +
                        sig->oublock + sig->coublock;
+                maxrss = max(sig->maxrss, sig->cmaxrss);
+                if (psig->cmaxrss < maxrss)
+                        psig->cmaxrss = maxrss;
                task_io_accounting_add(&psig->ioac, &p->ioac);
                task_io_accounting_add(&psig->ioac, &sig->ioac);
                spin_unlock_irq(&p->real_parent->sighand->siglock);
@@ -1477,13 +1479,14 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
 * then ->notask_error is 0 if @p is an eligible child,
 * or another error from security_task_wait(), or still -ECHILD.
 */
-static int wait_consider_task(struct wait_opts *wo, struct task_struct *parent,
+static int wait_consider_task(struct wait_opts *wo, int ptrace,
-                                int ptrace, struct task_struct *p)
+                                struct task_struct *p)
 {
        int ret = eligible_child(wo, p);
        if (!ret)
                return ret;
+        ret = security_task_wait(p);
        if (unlikely(ret < 0)) {
                /*
                 * If we have not yet seen any eligible child,
@@ -1545,7 +1548,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
                 * Do not consider detached threads.
                 */
                if (!task_detached(p)) {
-                        int ret = wait_consider_task(wo, tsk, 0, p);
+                        int ret = wait_consider_task(wo, 0, p);
                        if (ret)
                                return ret;
                }
@@ -1559,7 +1562,7 @@ static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
        struct task_struct *p;
        list_for_each_entry(p, &tsk->ptraced, ptrace_entry) {
-                int ret = wait_consider_task(wo, tsk, 1, p);
+                int ret = wait_consider_task(wo, 1, p);
                if (ret)
                        return ret;
        }
@@ -1567,15 +1570,38 @@ static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
        return 0;
 }
+static int child_wait_callback(wait_queue_t *wait, unsigned mode,
+                                int sync, void *key)
+{
+        struct wait_opts *wo = container_of(wait, struct wait_opts,
+                                                child_wait);
+        struct task_struct *p = key;
+        if (!eligible_pid(wo, p))
+                return 0;
+        if ((wo->wo_flags & __WNOTHREAD) && wait->private != p->parent)
+                return 0;
+        return default_wake_function(wait, mode, sync, key);
+}
+void __wake_up_parent(struct task_struct *p, struct task_struct *parent)
+{
+        __wake_up_sync_key(&parent->signal->wait_chldexit,
+                                TASK_INTERRUPTIBLE, 1, p);
+}
 static long do_wait(struct wait_opts *wo)
 {
-        DECLARE_WAITQUEUE(wait, current);
        struct task_struct *tsk;
        int retval;
        trace_sched_process_wait(wo->wo_pid);
-        add_wait_queue(&current->signal->wait_chldexit,&wait);
+        init_waitqueue_func_entry(&wo->child_wait, child_wait_callback);
+        wo->child_wait.private = current;
+        add_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
 repeat:
        /*
         * If there is nothing that can match our critiera just get out.
@@ -1616,32 +1642,7 @@ notask:
        }
 end:
        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(&current->signal->wait_chldexit,&wait);
+        remove_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
-        if (wo->wo_info) {
-                struct siginfo __user *infop = wo->wo_info;
-                if (retval > 0)
-                        retval = 0;
-                else {
-                        /*
-                         * For a WNOHANG return, clear out all the fields
-                         * we would set so the user can easily tell the
-                         * difference.
-                         */
-                        if (!retval)
-                                retval = put_user(0, &infop->si_signo);
-                        if (!retval)
-                                retval = put_user(0, &infop->si_errno);
-                        if (!retval)
-                                retval = put_user(0, &infop->si_code);
-                        if (!retval)
-                                retval = put_user(0, &infop->si_pid);
-                        if (!retval)
-                                retval = put_user(0, &infop->si_uid);
-                        if (!retval)
-                                retval = put_user(0, &infop->si_status);
-                }
-        }
        return retval;
 }
@@ -1686,6 +1687,29 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
        wo.wo_stat      = NULL;
        wo.wo_rusage    = ru;
        ret = do_wait(&wo);
+        if (ret > 0) {
+                ret = 0;
+        } else if (infop) {
+                /*
+                 * For a WNOHANG return, clear out all the fields
+                 * we would set so the user can easily tell the
+                 * difference.
+                 */
+                if (!ret)
+                        ret = put_user(0, &infop->si_signo);
+                if (!ret)
+                        ret = put_user(0, &infop->si_errno);
+                if (!ret)
+                        ret = put_user(0, &infop->si_code);
+                if (!ret)
+                        ret = put_user(0, &infop->si_pid);
+                if (!ret)
+                        ret = put_user(0, &infop->si_uid);
+                if (!ret)
+                        ret = put_user(0, &infop->si_status);
+        }
        put_pid(pid);
        /* avoid REGPARM breakage on x86: */
diff --git a/kernel/fork.c b/kernel/fork.c
index 1020977b57ca..4c20fff8c13a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -63,6 +63,7 @@
 #include <linux/fs_struct.h>
 #include <linux/magic.h>
 #include <linux/perf_event.h>
+#include <linux/posix-timers.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -433,6 +434,14 @@ __setup("coredump_filter=", coredump_filter_setup);
 #include <linux/init_task.h>
+static void mm_init_aio(struct mm_struct *mm)
+{
+#ifdef CONFIG_AIO
+        spin_lock_init(&mm->ioctx_lock);
+        INIT_HLIST_HEAD(&mm->ioctx_list);
+#endif
+}
 static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
 {
        atomic_set(&mm->mm_users, 1);
@@ -446,10 +455,9 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
        set_mm_counter(mm, file_rss, 0);
        set_mm_counter(mm, anon_rss, 0);
        spin_lock_init(&mm->page_table_lock);
-        spin_lock_init(&mm->ioctx_lock);
-        INIT_HLIST_HEAD(&mm->ioctx_list);
        mm->free_area_cache = TASK_UNMAPPED_BASE;
        mm->cached_hole_size = ~0UL;
+        mm_init_aio(mm);
        mm_init_owner(mm, p);
        if (likely(!mm_alloc_pgd(mm))) {
@@ -510,6 +518,8 @@ void mmput(struct mm_struct *mm)
                        spin_unlock(&mmlist_lock);
                }
                put_swap_token(mm);
+                if (mm->binfmt)
+                        module_put(mm->binfmt->module);
                mmdrop(mm);
        }
 }
@@ -560,12 +570,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
        /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
-        if (unlikely(tsk->robust_list))
+        if (unlikely(tsk->robust_list)) {
                exit_robust_list(tsk);
+                tsk->robust_list = NULL;
+        }
 #ifdef CONFIG_COMPAT
-        if (unlikely(tsk->compat_robust_list))
+        if (unlikely(tsk->compat_robust_list)) {
                compat_exit_robust_list(tsk);
+                tsk->compat_robust_list = NULL;
+        }
 #endif
+        if (unlikely(!list_empty(&tsk->pi_state_list)))
+                exit_pi_state_list(tsk);
 #endif
        /* Get rid of any cached register state */
@@ -635,9 +651,14 @@ struct mm_struct *dup_mm(struct task_struct *tsk)
        mm->hiwater_rss = get_mm_rss(mm);
        mm->hiwater_vm = mm->total_vm;
+        if (mm->binfmt && !try_module_get(mm->binfmt->module))
+                goto free_pt;
        return mm;
 free_pt:
+        /* don't put binfmt in mmput, we haven't got module yet */
+        mm->binfmt = NULL;
        mmput(mm);
 fail_nomem:
@@ -805,10 +826,10 @@ static void posix_cpu_timers_init_group(struct signal_struct *sig)
        thread_group_cputime_init(sig);
        /* Expiration times and increments. */
-        sig->it_virt_expires = cputime_zero;
+        sig->it[CPUCLOCK_PROF].expires = cputime_zero;
-        sig->it_virt_incr = cputime_zero;
+        sig->it[CPUCLOCK_PROF].incr = cputime_zero;
-        sig->it_prof_expires = cputime_zero;
+        sig->it[CPUCLOCK_VIRT].expires = cputime_zero;
-        sig->it_prof_incr = cputime_zero;
+        sig->it[CPUCLOCK_VIRT].incr = cputime_zero;
        /* Cached expiration times. */
        sig->cputime_expires.prof_exp = cputime_zero;
@@ -866,6 +887,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
        sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
        sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
        sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
+        sig->maxrss = sig->cmaxrss = 0;
        task_io_accounting_init(&sig->ioac);
        sig->sum_sched_runtime = 0;
        taskstats_tgid_init(sig);
@@ -977,6 +999,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
                return ERR_PTR(-EINVAL);
+        /*
+         * Siblings of global init remain as zombies on exit since they are
+         * not reaped by their parent (swapper). To solve this and to avoid
+         * multi-rooted process trees, prevent global and container-inits
+         * from creating siblings.
+         */
+        if ((clone_flags & CLONE_PARENT) &&
+                                current->signal->flags & SIGNAL_UNKILLABLE)
+                return ERR_PTR(-EINVAL);
        retval = security_task_create(clone_flags);
        if (retval)
                goto fork_out;
@@ -1018,9 +1050,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        if (!try_module_get(task_thread_info(p)->exec_domain->module))
                goto bad_fork_cleanup_count;
-        if (p->binfmt && !try_module_get(p->binfmt->module))
-                goto bad_fork_cleanup_put_domain;
        p->did_exec = 0;
        delayacct_tsk_init(p);  /* Must remain after dup_task_struct() */
        copy_flags(clone_flags, p);
@@ -1094,6 +1123,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        p->bts = NULL;
+        p->stack_start = stack_start;
        /* Perform scheduler related setup. Assign this task to a CPU. */
        sched_fork(p, clone_flags);
@@ -1306,9 +1337,6 @@ bad_fork_cleanup_cgroup:
 #endif
        cgroup_exit(p, cgroup_callbacks_done);
        delayacct_tsk_free(p);
-        if (p->binfmt)
-                module_put(p->binfmt->module);
-bad_fork_cleanup_put_domain:
        module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:
        atomic_dec(&p->cred->user->processes);
diff --git a/kernel/futex.c b/kernel/futex.c
index 248dd119a86e..4949d336d88d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -89,36 +89,36 @@ struct futex_pi_state {
        union futex_key key;
 };
-/*
+/**
- * We use this hashed waitqueue instead of a normal wait_queue_t, so
+ * struct futex_q - The hashed futex queue entry, one per waiting task
+ * @task:               the task waiting on the futex
+ * @lock_ptr:           the hash bucket lock
+ * @key:                the key the futex is hashed on
+ * @pi_state:           optional priority inheritance state
+ * @rt_waiter:          rt_waiter storage for use with requeue_pi
+ * @requeue_pi_key:     the requeue_pi target futex key
+ * @bitset:             bitset for the optional bitmasked wakeup
+ *
+ * We use this hashed waitqueue, instead of a normal wait_queue_t, so
 * we can wake only the relevant ones (hashed queues may be shared).
 *
 * A futex_q has a woken state, just like tasks have TASK_RUNNING.
 * It is considered woken when plist_node_empty(&q->list) || q->lock_ptr == 0.
 * The order of wakup is always to make the first condition true, then
- * wake up q->waiter, then make the second condition true.
+ * the second.
+ *
+ * PI futexes are typically woken before they are removed from the hash list via
+ * the rt_mutex code. See unqueue_me_pi().
 */
 struct futex_q {
        struct plist_node list;
-        /* Waiter reference */
-        struct task_struct *task;
-        /* Which hash list lock to use: */
+        struct task_struct *task;
        spinlock_t *lock_ptr;
-        /* Key which the futex is hashed on: */
        union futex_key key;
-        /* Optional priority inheritance state: */
        struct futex_pi_state *pi_state;
-        /* rt_waiter storage for requeue_pi: */
        struct rt_mutex_waiter *rt_waiter;
-        /* The expected requeue pi target futex key: */
        union futex_key *requeue_pi_key;
-        /* Bitset for the optional bitmasked wakeup */
        u32 bitset;
 };
@@ -198,11 +198,12 @@ static void drop_futex_key_refs(union futex_key *key)
 }
 /**
- * get_futex_key - Get parameters which are the keys for a futex.
+ * get_futex_key() - Get parameters which are the keys for a futex
- * @uaddr: virtual address of the futex
+ * @uaddr:      virtual address of the futex
- * @fshared: 0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
+ * @fshared:    0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
- * @key: address where result is stored.
+ * @key:        address where result is stored.
- * @rw: mapping needs to be read/write (values: VERIFY_READ, VERIFY_WRITE)
+ * @rw:         mapping needs to be read/write (values: VERIFY_READ,
+ *              VERIFY_WRITE)
 *
 * Returns a negative error code or 0
 * The key words are stored in *key on success.
@@ -288,8 +289,8 @@ void put_futex_key(int fshared, union futex_key *key)
        drop_futex_key_refs(key);
 }
-/*
+/**
- * fault_in_user_writeable - fault in user address and verify RW access
+ * fault_in_user_writeable() - Fault in user address and verify RW access
 * @uaddr:      pointer to faulting user space address
 *
 * Slow path to fixup the fault we just took in the atomic write
@@ -309,8 +310,8 @@ static int fault_in_user_writeable(u32 __user *uaddr)
 /**
 * futex_top_waiter() - Return the highest priority waiter on a futex
- * @hb:     the hash bucket the futex_q's reside in
+ * @hb:         the hash bucket the futex_q's reside in
- * @key:    the futex key (to distinguish it from other futex futex_q's)
+ * @key:        the futex key (to distinguish it from other futex futex_q's)
 *
 * Must be called with the hb lock held.
 */
@@ -588,7 +589,7 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 }
 /**
- * futex_lock_pi_atomic() - atomic work required to acquire a pi aware futex
+ * futex_lock_pi_atomic() - Atomic work required to acquire a pi aware futex
 * @uaddr:              the pi futex user address
 * @hb:                 the pi futex hash bucket
 * @key:                the futex key associated with uaddr and hb
@@ -915,8 +916,8 @@ retry:
        hb1 = hash_futex(&key1);
        hb2 = hash_futex(&key2);
-        double_lock_hb(hb1, hb2);
 retry_private:
+        double_lock_hb(hb1, hb2);
        op_ret = futex_atomic_op_inuser(op, uaddr2);
        if (unlikely(op_ret < 0)) {
@@ -1011,9 +1012,9 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
 /**
 * requeue_pi_wake_futex() - Wake a task that acquired the lock during requeue
- * q:   the futex_q
+ * @q:          the futex_q
- * key: the key of the requeue target futex
+ * @key:        the key of the requeue target futex
- * hb:  the hash_bucket of the requeue target futex
+ * @hb:         the hash_bucket of the requeue target futex
 *
 * During futex_requeue, with requeue_pi=1, it is possible to acquire the
 * target futex if it is uncontended or via a lock steal.  Set the futex_q key
@@ -1350,6 +1351,25 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
        return hb;
 }
+static inline void
+queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+{
+        spin_unlock(&hb->lock);
+        drop_futex_key_refs(&q->key);
+}
+/**
+ * queue_me() - Enqueue the futex_q on the futex_hash_bucket
+ * @q:  The futex_q to enqueue
+ * @hb: The destination hash bucket
+ *
+ * The hb->lock must be held by the caller, and is released here. A call to
+ * queue_me() is typically paired with exactly one call to unqueue_me().  The
+ * exceptions involve the PI related operations, which may use unqueue_me_pi()
+ * or nothing if the unqueue is done as part of the wake process and the unqueue
+ * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
+ * an example).
+ */
 static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
 {
        int prio;
@@ -1373,19 +1393,17 @@ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
        spin_unlock(&hb->lock);
 }
-static inline void
+/**
-queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+ * unqueue_me() - Remove the futex_q from its futex_hash_bucket
-{
+ * @q:  The futex_q to unqueue
-        spin_unlock(&hb->lock);
+ *
-        drop_futex_key_refs(&q->key);
+ * The q->lock_ptr must not be held by the caller. A call to unqueue_me() must
-}
+ * be paired with exactly one earlier call to queue_me().
+ *
-/*
+ * Returns:
- * queue_me and unqueue_me must be called as a pair, each
+ *   1 - if the futex_q was still queued (and we removed unqueued it)
- * exactly once.  They are called with the hashed spinlock held.
+ *   0 - if the futex_q was already removed by the waking thread
 */
-/* Return 1 if we were still queued (ie. 0 means we were woken) */
 static int unqueue_me(struct futex_q *q)
 {
        spinlock_t *lock_ptr;
@@ -1638,17 +1656,14 @@ out:
 static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
                                struct hrtimer_sleeper *timeout)
 {
-        queue_me(q, hb);
        /*
-         * There might have been scheduling since the queue_me(), as we
+         * The task state is guaranteed to be set before another task can
-         * cannot hold a spinlock across the get_user() in case it
+         * wake it. set_current_state() is implemented using set_mb() and
-         * faults, and we cannot just set TASK_INTERRUPTIBLE state when
+         * queue_me() calls spin_unlock() upon completion, both serializing
-         * queueing ourselves into the futex hash. This code thus has to
+         * access to the hash list and forcing another memory barrier.
-         * rely on the futex_wake() code removing us from hash when it
-         * wakes us up.
         */
        set_current_state(TASK_INTERRUPTIBLE);
+        queue_me(q, hb);
        /* Arm the timer */
        if (timeout) {
@@ -1658,8 +1673,8 @@ static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
        }
        /*
-         * !plist_node_empty() is safe here without any lock.
+         * If we have been removed from the hash list, then another task
-         * q.lock_ptr != 0 is not safe, because of ordering against wakeup.
+         * has tried to wake us, and we can skip the call to schedule().
         */
        if (likely(!plist_node_empty(&q->list))) {
                /*
@@ -2102,7 +2117,6 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                 * Unqueue the futex_q and determine which it was.
                 */
                plist_del(&q->list, &q->list.plist);
-                drop_futex_key_refs(&q->key);
                if (timeout && !timeout->task)
                        ret = -ETIMEDOUT;
@@ -2114,12 +2128,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
 /**
 * futex_wait_requeue_pi() - Wait on uaddr and take uaddr2
- * @uaddr:      the futex we initialyl wait on (non-pi)
+ * @uaddr:      the futex we initially wait on (non-pi)
 * @fshared:    whether the futexes are shared (1) or not (0).  They must be
 *              the same type, no requeueing from private to shared, etc.
 * @val:        the expected value of uaddr
 * @abs_time:   absolute timeout
- * @bitset:     32 bit wakeup bitset set by userspace, defaults to all.
+ * @bitset:     32 bit wakeup bitset set by userspace, defaults to all
 * @clockrt:    whether to use CLOCK_REALTIME (1) or CLOCK_MONOTONIC (0)
 * @uaddr2:     the pi futex we will take prior to returning to user-space
 *
@@ -2246,7 +2260,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
                res = fixup_owner(uaddr2, fshared, &q, !ret);
                /*
                 * If fixup_owner() returned an error, proprogate that.  If it
-                 * acquired the lock, clear our -ETIMEDOUT or -EINTR.
+                 * acquired the lock, clear -ETIMEDOUT or -EINTR.
                 */
                if (res)
                        ret = (res < 0) ? res : 0;
@@ -2302,9 +2316,9 @@ out:
 */
 /**
- * sys_set_robust_list - set the robust-futex list head of a task
+ * sys_set_robust_list() - Set the robust-futex list head of a task
- * @head: pointer to the list-head
+ * @head:       pointer to the list-head
- * @len: length of the list-head, as userspace expects
+ * @len:        length of the list-head, as userspace expects
 */
 SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
                size_t, len)
@@ -2323,10 +2337,10 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
 }
 /**
- * sys_get_robust_list - get the robust-futex list head of a task
+ * sys_get_robust_list() - Get the robust-futex list head of a task
- * @pid: pid of the process [zero for current task]
+ * @pid:        pid of the process [zero for current task]
- * @head_ptr: pointer to a list-head pointer, the kernel fills it in
+ * @head_ptr:   pointer to a list-head pointer, the kernel fills it in
- * @len_ptr: pointer to a length field, the kernel fills in the header size
+ * @len_ptr:    pointer to a length field, the kernel fills in the header size
 */
 SYSCALL_DEFINE3(get_robust_list, int, pid,
                struct robust_list_head __user * __user *, head_ptr,
diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
index 654efd09f6a9..70a298d6da71 100644
--- a/kernel/gcov/Kconfig
+++ b/kernel/gcov/Kconfig
@@ -34,7 +34,7 @@ config GCOV_KERNEL
 config GCOV_PROFILE_ALL
        bool "Profile entire Kernel"
        depends on GCOV_KERNEL
-        depends on S390 || X86 || (PPC && EXPERIMENTAL)
+        depends on S390 || X86 || (PPC && EXPERIMENTAL) || MICROBLAZE
        default n
        ---help---
        This options activates profiling for the entire kernel.
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index c03f221fee44..3e1c36e7998f 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -48,6 +48,8 @@
 #include <asm/uaccess.h>
+#include <trace/events/timer.h>
 /*
 * The timer bases:
 *
@@ -442,6 +444,26 @@ static inline void debug_hrtimer_activate(struct hrtimer *timer) { }
 static inline void debug_hrtimer_deactivate(struct hrtimer *timer) { }
 #endif
+static inline void
+debug_init(struct hrtimer *timer, clockid_t clockid,
+           enum hrtimer_mode mode)
+{
+        debug_hrtimer_init(timer);
+        trace_hrtimer_init(timer, clockid, mode);
+}
+static inline void debug_activate(struct hrtimer *timer)
+{
+        debug_hrtimer_activate(timer);
+        trace_hrtimer_start(timer);
+}
+static inline void debug_deactivate(struct hrtimer *timer)
+{
+        debug_hrtimer_deactivate(timer);
+        trace_hrtimer_cancel(timer);
+}
 /* High resolution timer related functions */
 #ifdef CONFIG_HIGH_RES_TIMERS
@@ -487,13 +509,14 @@ static inline int hrtimer_hres_active(void)
 * next event
 * Called with interrupts disabled and base->lock held
 */
-static void hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base)
+static void
+hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
 {
        int i;
        struct hrtimer_clock_base *base = cpu_base->clock_base;
-        ktime_t expires;
+        ktime_t expires, expires_next;
-        cpu_base->expires_next.tv64 = KTIME_MAX;
+        expires_next.tv64 = KTIME_MAX;
        for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++, base++) {
                struct hrtimer *timer;
@@ -509,10 +532,15 @@ static void hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base)
                 */
                if (expires.tv64 < 0)
                        expires.tv64 = 0;
-                if (expires.tv64 < cpu_base->expires_next.tv64)
+                if (expires.tv64 < expires_next.tv64)
-                        cpu_base->expires_next = expires;
+                        expires_next = expires;
        }
+        if (skip_equal && expires_next.tv64 == cpu_base->expires_next.tv64)
+                return;
+        cpu_base->expires_next.tv64 = expires_next.tv64;
        if (cpu_base->expires_next.tv64 != KTIME_MAX)
                tick_program_event(cpu_base->expires_next, 1);
 }
@@ -595,7 +623,7 @@ static void retrigger_next_event(void *arg)
        base->clock_base[CLOCK_REALTIME].offset =
                timespec_to_ktime(realtime_offset);
-        hrtimer_force_reprogram(base);
+        hrtimer_force_reprogram(base, 0);
        spin_unlock(&base->lock);
 }
@@ -698,8 +726,6 @@ static int hrtimer_switch_to_hres(void)
        /* "Retrigger" the interrupt to get things going */
        retrigger_next_event(NULL);
        local_irq_restore(flags);
-        printk(KERN_DEBUG "Switched to high resolution mode on CPU %d\n",
-               smp_processor_id());
        return 1;
 }
@@ -708,7 +734,8 @@ static int hrtimer_switch_to_hres(void)
 static inline int hrtimer_hres_active(void) { return 0; }
 static inline int hrtimer_is_hres_enabled(void) { return 0; }
 static inline int hrtimer_switch_to_hres(void) { return 0; }
-static inline void hrtimer_force_reprogram(struct hrtimer_cpu_base *base) { }
+static inline void
+hrtimer_force_reprogram(struct hrtimer_cpu_base *base, int skip_equal) { }
 static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
                                            struct hrtimer_clock_base *base,
                                            int wakeup)
@@ -798,7 +825,7 @@ static int enqueue_hrtimer(struct hrtimer *timer,
        struct hrtimer *entry;
        int leftmost = 1;
-        debug_hrtimer_activate(timer);
+        debug_activate(timer);
        /*
         * Find the right place in the rbtree:
@@ -851,19 +878,29 @@ static void __remove_hrtimer(struct hrtimer *timer,
                             struct hrtimer_clock_base *base,
                             unsigned long newstate, int reprogram)
 {
-        if (timer->state & HRTIMER_STATE_ENQUEUED) {
+        if (!(timer->state & HRTIMER_STATE_ENQUEUED))
-                /*
+                goto out;
-                 * Remove the timer from the rbtree and replace the
-                 * first entry pointer if necessary.
+        /*
-                 */
+         * Remove the timer from the rbtree and replace the first
-                if (base->first == &timer->node) {
+         * entry pointer if necessary.
-                        base->first = rb_next(&timer->node);
+         */
-                        /* Reprogram the clock event device. if enabled */
+        if (base->first == &timer->node) {
-                        if (reprogram && hrtimer_hres_active())
+                base->first = rb_next(&timer->node);
-                                hrtimer_force_reprogram(base->cpu_base);
+#ifdef CONFIG_HIGH_RES_TIMERS
+                /* Reprogram the clock event device. if enabled */
+                if (reprogram && hrtimer_hres_active()) {
+                        ktime_t expires;
+                        expires = ktime_sub(hrtimer_get_expires(timer),
+                                            base->offset);
+                        if (base->cpu_base->expires_next.tv64 == expires.tv64)
+                                hrtimer_force_reprogram(base->cpu_base, 1);
                }
-                rb_erase(&timer->node, &base->active);
+#endif
        }
+        rb_erase(&timer->node, &base->active);
+out:
        timer->state = newstate;
 }
@@ -884,7 +921,7 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
                 * reprogramming happens in the interrupt handler. This is a
                 * rare case and less expensive than a smp call.
                 */
-                debug_hrtimer_deactivate(timer);
+                debug_deactivate(timer);
                timer_stats_hrtimer_clear_start_info(timer);
                reprogram = base->cpu_base == &__get_cpu_var(hrtimer_bases);
                __remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE,
@@ -1117,7 +1154,7 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
 void hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
                  enum hrtimer_mode mode)
 {
-        debug_hrtimer_init(timer);
+        debug_init(timer, clock_id, mode);
        __hrtimer_init(timer, clock_id, mode);
 }
 EXPORT_SYMBOL_GPL(hrtimer_init);
@@ -1141,7 +1178,7 @@ int hrtimer_get_res(const clockid_t which_clock, struct timespec *tp)
 }
 EXPORT_SYMBOL_GPL(hrtimer_get_res);
-static void __run_hrtimer(struct hrtimer *timer)
+static void __run_hrtimer(struct hrtimer *timer, ktime_t *now)
 {
        struct hrtimer_clock_base *base = timer->base;
        struct hrtimer_cpu_base *cpu_base = base->cpu_base;
@@ -1150,7 +1187,7 @@ static void __run_hrtimer(struct hrtimer *timer)
        WARN_ON(!irqs_disabled());
-        debug_hrtimer_deactivate(timer);
+        debug_deactivate(timer);
        __remove_hrtimer(timer, base, HRTIMER_STATE_CALLBACK, 0);
        timer_stats_account_hrtimer(timer);
        fn = timer->function;
@@ -1161,7 +1198,9 @@ static void __run_hrtimer(struct hrtimer *timer)
         * the timer base.
         */
        spin_unlock(&cpu_base->lock);
+        trace_hrtimer_expire_entry(timer, now);
        restart = fn(timer);
+        trace_hrtimer_expire_exit(timer);
        spin_lock(&cpu_base->lock);
        /*
@@ -1272,7 +1311,7 @@ void hrtimer_interrupt(struct clock_event_device *dev)
                                break;
                        }
-                        __run_hrtimer(timer);
+                        __run_hrtimer(timer, &basenow);
                }
                base++;
        }
@@ -1394,7 +1433,7 @@ void hrtimer_run_queues(void)
                                        hrtimer_get_expires_tv64(timer))
                                break;
-                        __run_hrtimer(timer);
+                        __run_hrtimer(timer, &base->softirq_time);
                }
                spin_unlock(&cpu_base->lock);
        }
@@ -1571,7 +1610,7 @@ static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
        while ((node = rb_first(&old_base->active))) {
                timer = rb_entry(node, struct hrtimer, node);
                BUG_ON(hrtimer_callback_running(timer));
-                debug_hrtimer_deactivate(timer);
+                debug_deactivate(timer);
                /*
                 * Mark it as STATE_MIGRATE not INACTIVE otherwise the
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 022a4927b785..d4e841747400 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -171,12 +171,12 @@ static unsigned long timeout_jiffies(unsigned long timeout)
 * Process updating of timeout sysctl
 */
 int proc_dohung_task_timeout_secs(struct ctl_table *table, int write,
-                                  struct file *filp, void __user *buffer,
+                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
        int ret;
-        ret = proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos);
+        ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
        if (ret || !write)
                goto out;
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index a81cf80554db..17c71bb565c6 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -11,6 +11,7 @@
 */
 #include <linux/irq.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/random.h>
diff --git a/kernel/itimer.c b/kernel/itimer.c
index 58762f7077ec..b03451ede528 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -12,6 +12,7 @@
 #include <linux/time.h>
 #include <linux/posix-timers.h>
 #include <linux/hrtimer.h>
+#include <trace/events/timer.h>
 #include <asm/uaccess.h>
@@ -41,10 +42,43 @@ static struct timeval itimer_get_remtime(struct hrtimer *timer)
        return ktime_to_timeval(rem);
 }
+static void get_cpu_itimer(struct task_struct *tsk, unsigned int clock_id,
+                           struct itimerval *const value)
+{
+        cputime_t cval, cinterval;
+        struct cpu_itimer *it = &tsk->signal->it[clock_id];
+        spin_lock_irq(&tsk->sighand->siglock);
+        cval = it->expires;
+        cinterval = it->incr;
+        if (!cputime_eq(cval, cputime_zero)) {
+                struct task_cputime cputime;
+                cputime_t t;
+                thread_group_cputimer(tsk, &cputime);
+                if (clock_id == CPUCLOCK_PROF)
+                        t = cputime_add(cputime.utime, cputime.stime);
+                else
+                        /* CPUCLOCK_VIRT */
+                        t = cputime.utime;
+                if (cputime_le(cval, t))
+                        /* about to fire */
+                        cval = cputime_one_jiffy;
+                else
+                        cval = cputime_sub(cval, t);
+        }
+        spin_unlock_irq(&tsk->sighand->siglock);
+        cputime_to_timeval(cval, &value->it_value);
+        cputime_to_timeval(cinterval, &value->it_interval);
+}
 int do_getitimer(int which, struct itimerval *value)
 {
        struct task_struct *tsk = current;
-        cputime_t cinterval, cval;
        switch (which) {
        case ITIMER_REAL:
@@ -55,44 +89,10 @@ int do_getitimer(int which, struct itimerval *value)
                spin_unlock_irq(&tsk->sighand->siglock);
                break;
        case ITIMER_VIRTUAL:
-                spin_lock_irq(&tsk->sighand->siglock);
+                get_cpu_itimer(tsk, CPUCLOCK_VIRT, value);
-                cval = tsk->signal->it_virt_expires;
-                cinterval = tsk->signal->it_virt_incr;
-                if (!cputime_eq(cval, cputime_zero)) {
-                        struct task_cputime cputime;
-                        cputime_t utime;
-                        thread_group_cputimer(tsk, &cputime);
-                        utime = cputime.utime;
-                        if (cputime_le(cval, utime)) { /* about to fire */
-                                cval = jiffies_to_cputime(1);
-                        } else {
-                                cval = cputime_sub(cval, utime);
-                        }
-                }
-                spin_unlock_irq(&tsk->sighand->siglock);
-                cputime_to_timeval(cval, &value->it_value);
-                cputime_to_timeval(cinterval, &value->it_interval);
                break;
        case ITIMER_PROF:
-                spin_lock_irq(&tsk->sighand->siglock);
+                get_cpu_itimer(tsk, CPUCLOCK_PROF, value);
-                cval = tsk->signal->it_prof_expires;
-                cinterval = tsk->signal->it_prof_incr;
-                if (!cputime_eq(cval, cputime_zero)) {
-                        struct task_cputime times;
-                        cputime_t ptime;
-                        thread_group_cputimer(tsk, &times);
-                        ptime = cputime_add(times.utime, times.stime);
-                        if (cputime_le(cval, ptime)) { /* about to fire */
-                                cval = jiffies_to_cputime(1);
-                        } else {
-                                cval = cputime_sub(cval, ptime);
-                        }
-                }
-                spin_unlock_irq(&tsk->sighand->siglock);
-                cputime_to_timeval(cval, &value->it_value);
-                cputime_to_timeval(cinterval, &value->it_interval);
                break;
        default:
                return(-EINVAL);
@@ -123,11 +123,62 @@ enum hrtimer_restart it_real_fn(struct hrtimer *timer)
        struct signal_struct *sig =
                container_of(timer, struct signal_struct, real_timer);
+        trace_itimer_expire(ITIMER_REAL, sig->leader_pid, 0);
        kill_pid_info(SIGALRM, SEND_SIG_PRIV, sig->leader_pid);
        return HRTIMER_NORESTART;
 }
+static inline u32 cputime_sub_ns(cputime_t ct, s64 real_ns)
+{
+        struct timespec ts;
+        s64 cpu_ns;
+        cputime_to_timespec(ct, &ts);
+        cpu_ns = timespec_to_ns(&ts);
+        return (cpu_ns <= real_ns) ? 0 : cpu_ns - real_ns;
+}
+static void set_cpu_itimer(struct task_struct *tsk, unsigned int clock_id,
+                           const struct itimerval *const value,
+                           struct itimerval *const ovalue)
+{
+        cputime_t cval, nval, cinterval, ninterval;
+        s64 ns_ninterval, ns_nval;
+        struct cpu_itimer *it = &tsk->signal->it[clock_id];
+        nval = timeval_to_cputime(&value->it_value);
+        ns_nval = timeval_to_ns(&value->it_value);
+        ninterval = timeval_to_cputime(&value->it_interval);
+        ns_ninterval = timeval_to_ns(&value->it_interval);
+        it->incr_error = cputime_sub_ns(ninterval, ns_ninterval);
+        it->error = cputime_sub_ns(nval, ns_nval);
+        spin_lock_irq(&tsk->sighand->siglock);
+        cval = it->expires;
+        cinterval = it->incr;
+        if (!cputime_eq(cval, cputime_zero) ||
+            !cputime_eq(nval, cputime_zero)) {
+                if (cputime_gt(nval, cputime_zero))
+                        nval = cputime_add(nval, cputime_one_jiffy);
+                set_process_cpu_timer(tsk, clock_id, &nval, &cval);
+        }
+        it->expires = nval;
+        it->incr = ninterval;
+        trace_itimer_state(clock_id == CPUCLOCK_VIRT ?
+                           ITIMER_VIRTUAL : ITIMER_PROF, value, nval);
+        spin_unlock_irq(&tsk->sighand->siglock);
+        if (ovalue) {
+                cputime_to_timeval(cval, &ovalue->it_value);
+                cputime_to_timeval(cinterval, &ovalue->it_interval);
+        }
+}
 /*
 * Returns true if the timeval is in canonical form
 */
@@ -139,7 +190,6 @@ int do_setitimer(int which, struct itimerval *value, struct itimerval *ovalue)
        struct task_struct *tsk = current;
        struct hrtimer *timer;
        ktime_t expires;
-        cputime_t cval, cinterval, nval, ninterval;
        /*
         * Validate the timevals in value.
@@ -171,51 +221,14 @@ again:
                } else
                        tsk->signal->it_real_incr.tv64 = 0;
+                trace_itimer_state(ITIMER_REAL, value, 0);
                spin_unlock_irq(&tsk->sighand->siglock);
                break;
        case ITIMER_VIRTUAL:
-                nval = timeval_to_cputime(&value->it_value);
+                set_cpu_itimer(tsk, CPUCLOCK_VIRT, value, ovalue);
-                ninterval = timeval_to_cputime(&value->it_interval);
-                spin_lock_irq(&tsk->sighand->siglock);
-                cval = tsk->signal->it_virt_expires;
-                cinterval = tsk->signal->it_virt_incr;
-                if (!cputime_eq(cval, cputime_zero) ||
-                    !cputime_eq(nval, cputime_zero)) {
-                        if (cputime_gt(nval, cputime_zero))
-                                nval = cputime_add(nval,
-                                                   jiffies_to_cputime(1));
-                        set_process_cpu_timer(tsk, CPUCLOCK_VIRT,
-                                              &nval, &cval);
-                }
-                tsk->signal->it_virt_expires = nval;
-                tsk->signal->it_virt_incr = ninterval;
-                spin_unlock_irq(&tsk->sighand->siglock);
-                if (ovalue) {
-                        cputime_to_timeval(cval, &ovalue->it_value);
-                        cputime_to_timeval(cinterval, &ovalue->it_interval);
-                }
                break;
        case ITIMER_PROF:
-                nval = timeval_to_cputime(&value->it_value);
+                set_cpu_itimer(tsk, CPUCLOCK_PROF, value, ovalue);
-                ninterval = timeval_to_cputime(&value->it_interval);
-                spin_lock_irq(&tsk->sighand->siglock);
-                cval = tsk->signal->it_prof_expires;
-                cinterval = tsk->signal->it_prof_incr;
-                if (!cputime_eq(cval, cputime_zero) ||
-                    !cputime_eq(nval, cputime_zero)) {
-                        if (cputime_gt(nval, cputime_zero))
-                                nval = cputime_add(nval,
-                                                   jiffies_to_cputime(1));
-                        set_process_cpu_timer(tsk, CPUCLOCK_PROF,
-                                              &nval, &cval);
-                }
-                tsk->signal->it_prof_expires = nval;
-                tsk->signal->it_prof_incr = ninterval;
-                spin_unlock_irq(&tsk->sighand->siglock);
-                if (ovalue) {
-                        cputime_to_timeval(cval, &ovalue->it_value);
-                        cputime_to_timeval(cinterval, &ovalue->it_interval);
-                }
                break;
        default:
                return -EINVAL;
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 3a29dbe7898e..8b6b8b697c68 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -59,7 +59,8 @@ static inline int is_kernel_inittext(unsigned long addr)
 static inline int is_kernel_text(unsigned long addr)
 {
-        if (addr >= (unsigned long)_stext && addr <= (unsigned long)_etext)
+        if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
+            arch_is_kernel_text(addr))
                return 1;
        return in_gate_area_no_task(addr);
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index ef177d653b2c..5240d75f4c60 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1321,7 +1321,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
        return 0;
 }
-static struct seq_operations kprobes_seq_ops = {
+static const struct seq_operations kprobes_seq_ops = {
        .start = kprobe_seq_start,
        .next  = kprobe_seq_next,
        .stop  = kprobe_seq_stop,
@@ -1333,7 +1333,7 @@ static int __kprobes kprobes_open(struct inode *inode, struct file *filp)
        return seq_open(filp, &kprobes_seq_ops);
 }
-static struct file_operations debugfs_kprobes_operations = {
+static const struct file_operations debugfs_kprobes_operations = {
        .open           = kprobes_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
@@ -1515,7 +1515,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
        return count;
 }
-static struct file_operations fops_kp = {
+static const struct file_operations fops_kp = {
        .read =         read_enabled_file_bool,
        .write =        write_enabled_file_bool,
 };
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index f74d2d7aa605..3815ac1d58b2 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -578,6 +578,9 @@ static int static_obj(void *obj)
        if ((addr >= start) && (addr < end))
                return 1;
+        if (arch_is_kernel_data(addr))
+                return 1;
 #ifdef CONFIG_SMP
        /*
         * percpu var?
diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
index d4b3dbc79fdb..d4aba4f3584c 100644
--- a/kernel/lockdep_proc.c
+++ b/kernel/lockdep_proc.c
@@ -594,7 +594,7 @@ static int ls_show(struct seq_file *m, void *v)
        return 0;
 }
-static struct seq_operations lockstat_ops = {
+static const struct seq_operations lockstat_ops = {
        .start  = ls_start,
        .next   = ls_next,
        .stop   = ls_stop,
diff --git a/kernel/module.c b/kernel/module.c
index e6bc4b28aa62..8b7d8805819d 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1797,6 +1797,17 @@ static void setup_modinfo(struct module *mod, Elf_Shdr *sechdrs,
        }
 }
+static void free_modinfo(struct module *mod)
+{
+        struct module_attribute *attr;
+        int i;
+        for (i = 0; (attr = modinfo_attrs[i]); i++) {
+                if (attr->free)
+                        attr->free(mod);
+        }
+}
 #ifdef CONFIG_KALLSYMS
 /* lookup symbol in given range of kernel_symbols */
@@ -1862,13 +1873,93 @@ static char elf_type(const Elf_Sym *sym,
        return '?';
 }
+static bool is_core_symbol(const Elf_Sym *src, const Elf_Shdr *sechdrs,
+                           unsigned int shnum)
+{
+        const Elf_Shdr *sec;
+        if (src->st_shndx == SHN_UNDEF
+            || src->st_shndx >= shnum
+            || !src->st_name)
+                return false;
+        sec = sechdrs + src->st_shndx;
+        if (!(sec->sh_flags & SHF_ALLOC)
+#ifndef CONFIG_KALLSYMS_ALL
+            || !(sec->sh_flags & SHF_EXECINSTR)
+#endif
+            || (sec->sh_entsize & INIT_OFFSET_MASK))
+                return false;
+        return true;
+}
+static unsigned long layout_symtab(struct module *mod,
+                                   Elf_Shdr *sechdrs,
+                                   unsigned int symindex,
+                                   unsigned int strindex,
+                                   const Elf_Ehdr *hdr,
+                                   const char *secstrings,
+                                   unsigned long *pstroffs,
+                                   unsigned long *strmap)
+{
+        unsigned long symoffs;
+        Elf_Shdr *symsect = sechdrs + symindex;
+        Elf_Shdr *strsect = sechdrs + strindex;
+        const Elf_Sym *src;
+        const char *strtab;
+        unsigned int i, nsrc, ndst;
+        /* Put symbol section at end of init part of module. */
+        symsect->sh_flags |= SHF_ALLOC;
+        symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
+                                         symindex) | INIT_OFFSET_MASK;
+        DEBUGP("\t%s\n", secstrings + symsect->sh_name);
+        src = (void *)hdr + symsect->sh_offset;
+        nsrc = symsect->sh_size / sizeof(*src);
+        strtab = (void *)hdr + strsect->sh_offset;
+        for (ndst = i = 1; i < nsrc; ++i, ++src)
+                if (is_core_symbol(src, sechdrs, hdr->e_shnum)) {
+                        unsigned int j = src->st_name;
+                        while(!__test_and_set_bit(j, strmap) && strtab[j])
+                                ++j;
+                        ++ndst;
+                }
+        /* Append room for core symbols at end of core part. */
+        symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
+        mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
+        /* Put string table section at end of init part of module. */
+        strsect->sh_flags |= SHF_ALLOC;
+        strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
+                                         strindex) | INIT_OFFSET_MASK;
+        DEBUGP("\t%s\n", secstrings + strsect->sh_name);
+        /* Append room for core symbols' strings at end of core part. */
+        *pstroffs = mod->core_size;
+        __set_bit(0, strmap);
+        mod->core_size += bitmap_weight(strmap, strsect->sh_size);
+        return symoffs;
+}
 static void add_kallsyms(struct module *mod,
                         Elf_Shdr *sechdrs,
+                         unsigned int shnum,
                         unsigned int symindex,
                         unsigned int strindex,
-                         const char *secstrings)
+                         unsigned long symoffs,
+                         unsigned long stroffs,
+                         const char *secstrings,
+                         unsigned long *strmap)
 {
-        unsigned int i;
+        unsigned int i, ndst;
+        const Elf_Sym *src;
+        Elf_Sym *dst;
+        char *s;
        mod->symtab = (void *)sechdrs[symindex].sh_addr;
        mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
@@ -1878,13 +1969,46 @@ static void add_kallsyms(struct module *mod,
        for (i = 0; i < mod->num_symtab; i++)
                mod->symtab[i].st_info
                        = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
+        mod->core_symtab = dst = mod->module_core + symoffs;
+        src = mod->symtab;
+        *dst = *src;
+        for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+                if (!is_core_symbol(src, sechdrs, shnum))
+                        continue;
+                dst[ndst] = *src;
+                dst[ndst].st_name = bitmap_weight(strmap, dst[ndst].st_name);
+                ++ndst;
+        }
+        mod->core_num_syms = ndst;
+        mod->core_strtab = s = mod->module_core + stroffs;
+        for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
+                if (test_bit(i, strmap))
+                        *++s = mod->strtab[i];
 }
 #else
+static inline unsigned long layout_symtab(struct module *mod,
+                                          Elf_Shdr *sechdrs,
+                                          unsigned int symindex,
+                                          unsigned int strindex,
+                                          const Elf_Ehdr *hdr,
+                                          const char *secstrings,
+                                          unsigned long *pstroffs,
+                                          unsigned long *strmap)
+{
+        return 0;
+}
 static inline void add_kallsyms(struct module *mod,
                                Elf_Shdr *sechdrs,
+                                unsigned int shnum,
                                unsigned int symindex,
                                unsigned int strindex,
-                                const char *secstrings)
+                                unsigned long symoffs,
+                                unsigned long stroffs,
+                                const char *secstrings,
+                                const unsigned long *strmap)
 {
 }
 #endif /* CONFIG_KALLSYMS */
@@ -1959,6 +2083,8 @@ static noinline struct module *load_module(void __user *umod,
        struct module *mod;
        long err = 0;
        void *percpu = NULL, *ptr = NULL; /* Stops spurious gcc warning */
+        unsigned long symoffs, stroffs, *strmap;
        mm_segment_t old_fs;
        DEBUGP("load_module: umod=%p, len=%lu, uargs=%p\n",
@@ -2040,11 +2166,6 @@ static noinline struct module *load_module(void __user *umod,
        /* Don't keep modinfo and version sections. */
        sechdrs[infoindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
        sechdrs[versindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
-#ifdef CONFIG_KALLSYMS
-        /* Keep symbol and string tables for decoding later. */
-        sechdrs[symindex].sh_flags |= SHF_ALLOC;
-        sechdrs[strindex].sh_flags |= SHF_ALLOC;
-#endif
        /* Check module struct version now, before we try to use module. */
        if (!check_modstruct_version(sechdrs, versindex, mod)) {
@@ -2080,6 +2201,13 @@ static noinline struct module *load_module(void __user *umod,
                goto free_hdr;
        }
+        strmap = kzalloc(BITS_TO_LONGS(sechdrs[strindex].sh_size)
+                         * sizeof(long), GFP_KERNEL);
+        if (!strmap) {
+                err = -ENOMEM;
+                goto free_mod;
+        }
        if (find_module(mod->name)) {
                err = -EEXIST;
                goto free_mod;
@@ -2109,6 +2237,8 @@ static noinline struct module *load_module(void __user *umod,
           this is done generically; there doesn't appear to be any
           special cases for the architectures. */
        layout_sections(mod, hdr, sechdrs, secstrings);
+        symoffs = layout_symtab(mod, sechdrs, symindex, strindex, hdr,
+                                secstrings, &stroffs, strmap);
        /* Do the allocs. */
        ptr = module_alloc_update_bounds(mod->core_size);
@@ -2313,7 +2443,10 @@ static noinline struct module *load_module(void __user *umod,
        percpu_modcopy(mod->percpu, (void *)sechdrs[pcpuindex].sh_addr,
                       sechdrs[pcpuindex].sh_size);
-        add_kallsyms(mod, sechdrs, symindex, strindex, secstrings);
+        add_kallsyms(mod, sechdrs, hdr->e_shnum, symindex, strindex,
+                     symoffs, stroffs, secstrings, strmap);
+        kfree(strmap);
+        strmap = NULL;
        if (!mod->taints) {
                struct _ddebug *debug;
@@ -2385,13 +2518,14 @@ static noinline struct module *load_module(void __user *umod,
        synchronize_sched();
        module_arch_cleanup(mod);
 cleanup:
+        free_modinfo(mod);
        kobject_del(&mod->mkobj.kobj);
        kobject_put(&mod->mkobj.kobj);
 free_unload:
        module_unload_free(mod);
 #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
- free_init:
        percpu_modfree(mod->refptr);
+ free_init:
 #endif
        module_free(mod, mod->module_init);
 free_core:
@@ -2402,6 +2536,7 @@ static noinline struct module *load_module(void __user *umod,
                percpu_modfree(percpu);
 free_mod:
        kfree(args);
+        kfree(strmap);
 free_hdr:
        vfree(hdr);
        return ERR_PTR(err);
@@ -2491,6 +2626,11 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
        /* Drop initial reference. */
        module_put(mod);
        trim_init_extable(mod);
+#ifdef CONFIG_KALLSYMS
+        mod->num_symtab = mod->core_num_syms;
+        mod->symtab = mod->core_symtab;
+        mod->strtab = mod->core_strtab;
+#endif
        module_free(mod, mod->module_init);
        mod->module_init = NULL;
        mod->init_size = 0;
@@ -2952,7 +3092,6 @@ void module_layout(struct module *mod,
                   struct modversion_info *ver,
                   struct kernel_param *kp,
                   struct kernel_symbol *ks,
-                   struct marker *marker,
                   struct tracepoint *tp)
 {
 }
diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
index 50d022e5a560..ec815a960b5d 100644
--- a/kernel/mutex-debug.c
+++ b/kernel/mutex-debug.c
@@ -16,6 +16,7 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/poison.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/kallsyms.h>
 #include <linux/interrupt.h>
diff --git a/kernel/ns_cgroup.c b/kernel/ns_cgroup.c
index 5aa854f9e5ae..2a5dfec8efe0 100644
--- a/kernel/ns_cgroup.c
+++ b/kernel/ns_cgroup.c
@@ -42,8 +42,8 @@ int ns_cgroup_clone(struct task_struct *task, struct pid *pid)
 *       (hence either you are in the same cgroup as task, or in an
 *        ancestor cgroup thereof)
 */
-static int ns_can_attach(struct cgroup_subsys *ss,
+static int ns_can_attach(struct cgroup_subsys *ss, struct cgroup *new_cgroup,
-                struct cgroup *new_cgroup, struct task_struct *task)
+                         struct task_struct *task, bool threadgroup)
 {
        if (current != task) {
                if (!capable(CAP_SYS_ADMIN))
@@ -56,6 +56,18 @@ static int ns_can_attach(struct cgroup_subsys *ss,
        if (!cgroup_is_descendant(new_cgroup, task))
                return -EPERM;
+        if (threadgroup) {
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &task->thread_group, thread_group) {
+                        if (!cgroup_is_descendant(new_cgroup, c)) {
+                                rcu_read_unlock();
+                                return -EPERM;
+                        }
+                }
+                rcu_read_unlock();
+        }
        return 0;
 }
diff --git a/kernel/panic.c b/kernel/panic.c
index bcdef26e3332..96b45d0b4ba5 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -90,6 +90,8 @@ NORET_TYPE void panic(const char * fmt, ...)
        atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
+        bust_spinlocks(0);
        if (!panic_blink)
                panic_blink = no_blink;
@@ -136,7 +138,6 @@ NORET_TYPE void panic(const char * fmt, ...)
                mdelay(1);
                i++;
        }
-        bust_spinlocks(0);
 }
 EXPORT_SYMBOL(panic);
diff --git a/kernel/params.c b/kernel/params.c
index 7f6912ced2ba..9da58eabdcb2 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -23,6 +23,7 @@
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/slab.h>
+#include <linux/ctype.h>
 #if 0
 #define DEBUGP printk
@@ -87,7 +88,7 @@ static char *next_arg(char *args, char **param, char **val)
        }
        for (i = 0; args[i]; i++) {
-                if (args[i] == ' ' && !in_quote)
+                if (isspace(args[i]) && !in_quote)
                        break;
                if (equals == 0) {
                        if (args[i] == '=')
@@ -121,7 +122,7 @@ static char *next_arg(char *args, char **param, char **val)
                next = args + i;
        /* Chew up trailing spaces. */
-        while (*next == ' ')
+        while (isspace(*next))
                next++;
        return next;
 }
@@ -138,7 +139,7 @@ int parse_args(const char *name,
        DEBUGP("Parsing ARGS: %s\n", args);
        /* Chew leading spaces */
-        while (*args == ' ')
+        while (isspace(*args))
                args++;
        while (*args) {
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 76ac4db405e9..9d0b5c665883 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -20,6 +20,7 @@
 #include <linux/percpu.h>
 #include <linux/ptrace.h>
 #include <linux/vmstat.h>
+#include <linux/vmalloc.h>
 #include <linux/hardirq.h>
 #include <linux/rculist.h>
 #include <linux/uaccess.h>
@@ -1030,14 +1031,10 @@ void __perf_event_sched_out(struct perf_event_context *ctx,
        update_context_time(ctx);
        perf_disable();
-        if (ctx->nr_active) {
+        if (ctx->nr_active)
-                list_for_each_entry(event, &ctx->group_list, group_entry) {
+                list_for_each_entry(event, &ctx->group_list, group_entry)
-                        if (event != event->group_leader)
+                        group_sched_out(event, cpuctx, ctx);
-                                event_sched_out(event, cpuctx, ctx);
-                        else
-                                group_sched_out(event, cpuctx, ctx);
-                }
-        }
        perf_enable();
 out:
        spin_unlock(&ctx->lock);
@@ -1258,12 +1255,8 @@ __perf_event_sched_in(struct perf_event_context *ctx,
                if (event->cpu != -1 && event->cpu != cpu)
                        continue;
-                if (event != event->group_leader)
+                if (group_can_go_on(event, cpuctx, 1))
-                        event_sched_in(event, cpuctx, ctx, cpu);
+                        group_sched_in(event, cpuctx, ctx, cpu);
-                else {
-                        if (group_can_go_on(event, cpuctx, 1))
-                                group_sched_in(event, cpuctx, ctx, cpu);
-                }
                /*
                 * If this pinned group hasn't been scheduled,
@@ -1291,15 +1284,9 @@ __perf_event_sched_in(struct perf_event_context *ctx,
                if (event->cpu != -1 && event->cpu != cpu)
                        continue;
-                if (event != event->group_leader) {
+                if (group_can_go_on(event, cpuctx, can_add_hw))
-                        if (event_sched_in(event, cpuctx, ctx, cpu))
+                        if (group_sched_in(event, cpuctx, ctx, cpu))
                                can_add_hw = 0;
-                } else {
-                        if (group_can_go_on(event, cpuctx, can_add_hw)) {
-                                if (group_sched_in(event, cpuctx, ctx, cpu))
-                                        can_add_hw = 0;
-                        }
-                }
        }
        perf_enable();
 out:
@@ -2105,49 +2092,31 @@ unlock:
        rcu_read_unlock();
 }
-static int perf_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+static unsigned long perf_data_size(struct perf_mmap_data *data)
 {
-        struct perf_event *event = vma->vm_file->private_data;
+        return data->nr_pages << (PAGE_SHIFT + data->data_order);
-        struct perf_mmap_data *data;
+}
-        int ret = VM_FAULT_SIGBUS;
-        if (vmf->flags & FAULT_FLAG_MKWRITE) {
-                if (vmf->pgoff == 0)
-                        ret = 0;
-                return ret;
-        }
-        rcu_read_lock();
-        data = rcu_dereference(event->data);
-        if (!data)
-                goto unlock;
-        if (vmf->pgoff == 0) {
-                vmf->page = virt_to_page(data->user_page);
-        } else {
-                int nr = vmf->pgoff - 1;
-                if ((unsigned)nr > data->nr_pages)
-                        goto unlock;
-                if (vmf->flags & FAULT_FLAG_WRITE)
+#ifndef CONFIG_PERF_USE_VMALLOC
-                        goto unlock;
-                vmf->page = virt_to_page(data->data_pages[nr]);
+/*
-        }
+ * Back perf_mmap() with regular GFP_KERNEL-0 pages.
+ */
-        get_page(vmf->page);
+static struct page *
-        vmf->page->mapping = vma->vm_file->f_mapping;
+perf_mmap_to_page(struct perf_mmap_data *data, unsigned long pgoff)
-        vmf->page->index   = vmf->pgoff;
+{
+        if (pgoff > data->nr_pages)
+                return NULL;
-        ret = 0;
+        if (pgoff == 0)
-unlock:
+                return virt_to_page(data->user_page);
-        rcu_read_unlock();
-        return ret;
+        return virt_to_page(data->data_pages[pgoff - 1]);
 }
-static int perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
+static struct perf_mmap_data *
+perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
 {
        struct perf_mmap_data *data;
        unsigned long size;
@@ -2172,19 +2141,10 @@ static int perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
                        goto fail_data_pages;
        }
+        data->data_order = 0;
        data->nr_pages = nr_pages;
-        atomic_set(&data->lock, -1);
-        if (event->attr.watermark) {
-                data->watermark = min_t(long, PAGE_SIZE * nr_pages,
-                                      event->attr.wakeup_watermark);
-        }
-        if (!data->watermark)
-                data->watermark = max(PAGE_SIZE, PAGE_SIZE * nr_pages / 4);
-        rcu_assign_pointer(event->data, data);
+        return data;
-        return 0;
 fail_data_pages:
        for (i--; i >= 0; i--)
@@ -2196,7 +2156,7 @@ fail_user_page:
        kfree(data);
 fail:
-        return -ENOMEM;
+        return NULL;
 }
 static void perf_mmap_free_page(unsigned long addr)
@@ -2207,28 +2167,169 @@ static void perf_mmap_free_page(unsigned long addr)
        __free_page(page);
 }
-static void __perf_mmap_data_free(struct rcu_head *rcu_head)
+static void perf_mmap_data_free(struct perf_mmap_data *data)
 {
-        struct perf_mmap_data *data;
        int i;
-        data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
        perf_mmap_free_page((unsigned long)data->user_page);
        for (i = 0; i < data->nr_pages; i++)
                perf_mmap_free_page((unsigned long)data->data_pages[i]);
+}
+#else
+/*
+ * Back perf_mmap() with vmalloc memory.
+ *
+ * Required for architectures that have d-cache aliasing issues.
+ */
+static struct page *
+perf_mmap_to_page(struct perf_mmap_data *data, unsigned long pgoff)
+{
+        if (pgoff > (1UL << data->data_order))
+                return NULL;
+        return vmalloc_to_page((void *)data->user_page + pgoff * PAGE_SIZE);
+}
+static void perf_mmap_unmark_page(void *addr)
+{
+        struct page *page = vmalloc_to_page(addr);
+        page->mapping = NULL;
+}
+static void perf_mmap_data_free_work(struct work_struct *work)
+{
+        struct perf_mmap_data *data;
+        void *base;
+        int i, nr;
+        data = container_of(work, struct perf_mmap_data, work);
+        nr = 1 << data->data_order;
+        base = data->user_page;
+        for (i = 0; i < nr + 1; i++)
+                perf_mmap_unmark_page(base + (i * PAGE_SIZE));
+        vfree(base);
+}
+static void perf_mmap_data_free(struct perf_mmap_data *data)
+{
+        schedule_work(&data->work);
+}
+static struct perf_mmap_data *
+perf_mmap_data_alloc(struct perf_event *event, int nr_pages)
+{
+        struct perf_mmap_data *data;
+        unsigned long size;
+        void *all_buf;
+        WARN_ON(atomic_read(&event->mmap_count));
+        size = sizeof(struct perf_mmap_data);
+        size += sizeof(void *);
+        data = kzalloc(size, GFP_KERNEL);
+        if (!data)
+                goto fail;
+        INIT_WORK(&data->work, perf_mmap_data_free_work);
+        all_buf = vmalloc_user((nr_pages + 1) * PAGE_SIZE);
+        if (!all_buf)
+                goto fail_all_buf;
+        data->user_page = all_buf;
+        data->data_pages[0] = all_buf + PAGE_SIZE;
+        data->data_order = ilog2(nr_pages);
+        data->nr_pages = 1;
+        return data;
+fail_all_buf:
+        kfree(data);
+fail:
+        return NULL;
+}
+#endif
+static int perf_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct perf_event *event = vma->vm_file->private_data;
+        struct perf_mmap_data *data;
+        int ret = VM_FAULT_SIGBUS;
+        if (vmf->flags & FAULT_FLAG_MKWRITE) {
+                if (vmf->pgoff == 0)
+                        ret = 0;
+                return ret;
+        }
+        rcu_read_lock();
+        data = rcu_dereference(event->data);
+        if (!data)
+                goto unlock;
+        if (vmf->pgoff && (vmf->flags & FAULT_FLAG_WRITE))
+                goto unlock;
+        vmf->page = perf_mmap_to_page(data, vmf->pgoff);
+        if (!vmf->page)
+                goto unlock;
+        get_page(vmf->page);
+        vmf->page->mapping = vma->vm_file->f_mapping;
+        vmf->page->index   = vmf->pgoff;
+        ret = 0;
+unlock:
+        rcu_read_unlock();
+        return ret;
+}
+static void
+perf_mmap_data_init(struct perf_event *event, struct perf_mmap_data *data)
+{
+        long max_size = perf_data_size(data);
+        atomic_set(&data->lock, -1);
+        if (event->attr.watermark) {
+                data->watermark = min_t(long, max_size,
+                                        event->attr.wakeup_watermark);
+        }
+        if (!data->watermark)
+                data->watermark = max_t(long, PAGE_SIZE, max_size / 2);
+        rcu_assign_pointer(event->data, data);
+}
+static void perf_mmap_data_free_rcu(struct rcu_head *rcu_head)
+{
+        struct perf_mmap_data *data;
+        data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
+        perf_mmap_data_free(data);
        kfree(data);
 }
-static void perf_mmap_data_free(struct perf_event *event)
+static void perf_mmap_data_release(struct perf_event *event)
 {
        struct perf_mmap_data *data = event->data;
        WARN_ON(atomic_read(&event->mmap_count));
        rcu_assign_pointer(event->data, NULL);
-        call_rcu(&data->rcu_head, __perf_mmap_data_free);
+        call_rcu(&data->rcu_head, perf_mmap_data_free_rcu);
 }
 static void perf_mmap_open(struct vm_area_struct *vma)
@@ -2244,16 +2345,17 @@ static void perf_mmap_close(struct vm_area_struct *vma)
        WARN_ON_ONCE(event->ctx->parent_ctx);
        if (atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) {
+                unsigned long size = perf_data_size(event->data);
                struct user_struct *user = current_user();
-                atomic_long_sub(event->data->nr_pages + 1, &user->locked_vm);
+                atomic_long_sub((size >> PAGE_SHIFT) + 1, &user->locked_vm);
                vma->vm_mm->locked_vm -= event->data->nr_locked;
-                perf_mmap_data_free(event);
+                perf_mmap_data_release(event);
                mutex_unlock(&event->mmap_mutex);
        }
 }
-static struct vm_operations_struct perf_mmap_vmops = {
+static const struct vm_operations_struct perf_mmap_vmops = {
        .open           = perf_mmap_open,
        .close          = perf_mmap_close,
        .fault          = perf_mmap_fault,
@@ -2266,6 +2368,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
        unsigned long user_locked, user_lock_limit;
        struct user_struct *user = current_user();
        unsigned long locked, lock_limit;
+        struct perf_mmap_data *data;
        unsigned long vma_size;
        unsigned long nr_pages;
        long user_extra, extra;
@@ -2328,10 +2431,15 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
        }
        WARN_ON(event->data);
-        ret = perf_mmap_data_alloc(event, nr_pages);
-        if (ret)
+        data = perf_mmap_data_alloc(event, nr_pages);
+        ret = -ENOMEM;
+        if (!data)
                goto unlock;
+        ret = 0;
+        perf_mmap_data_init(event, data);
        atomic_set(&event->mmap_count, 1);
        atomic_long_add(user_extra, &user->locked_vm);
        vma->vm_mm->locked_vm += extra;
@@ -2519,7 +2627,7 @@ static bool perf_output_space(struct perf_mmap_data *data, unsigned long tail,
        if (!data->writable)
                return true;
-        mask = (data->nr_pages << PAGE_SHIFT) - 1;
+        mask = perf_data_size(data) - 1;
        offset = (offset - tail) & mask;
        head   = (head   - tail) & mask;
@@ -2624,7 +2732,7 @@ void perf_output_copy(struct perf_output_handle *handle,
                      const void *buf, unsigned int len)
 {
        unsigned int pages_mask;
-        unsigned int offset;
+        unsigned long offset;
        unsigned int size;
        void **pages;
@@ -2633,12 +2741,14 @@ void perf_output_copy(struct perf_output_handle *handle,
        pages           = handle->data->data_pages;
        do {
-                unsigned int page_offset;
+                unsigned long page_offset;
+                unsigned long page_size;
                int nr;
                nr          = (offset >> PAGE_SHIFT) & pages_mask;
-                page_offset = offset & (PAGE_SIZE - 1);
+                page_size   = 1UL << (handle->data->data_order + PAGE_SHIFT);
-                size        = min_t(unsigned int, PAGE_SIZE - page_offset, len);
+                page_offset = offset & (page_size - 1);
+                size        = min_t(unsigned int, page_size - page_offset, len);
                memcpy(pages[nr] + page_offset, buf, size);
@@ -4781,9 +4891,7 @@ int perf_event_init_task(struct task_struct *child)
         * We dont have to disable NMIs - we are only looking at
         * the list, not manipulating it:
         */
-        list_for_each_entry_rcu(event, &parent_ctx->event_list, event_entry) {
+        list_for_each_entry(event, &parent_ctx->group_list, group_entry) {
-                if (event != event->group_leader)
-                        continue;
                if (!event->attr.inherit) {
                        inherited_all = 0;
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 821722ae58a7..86b3796b0436 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -118,7 +118,7 @@ struct pid_namespace *copy_pid_ns(unsigned long flags, struct pid_namespace *old
 {
        if (!(flags & CLONE_NEWPID))
                return get_pid_ns(old_ns);
-        if (flags & CLONE_THREAD)
+        if (flags & (CLONE_THREAD|CLONE_PARENT))
                return ERR_PTR(-EINVAL);
        return create_pid_namespace(old_ns);
 }
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index e33a21cb9407..5c9dc228747b 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -8,17 +8,18 @@
 #include <linux/math64.h>
 #include <asm/uaccess.h>
 #include <linux/kernel_stat.h>
+#include <trace/events/timer.h>
 /*
 * Called after updating RLIMIT_CPU to set timer expiration if necessary.
 */
 void update_rlimit_cpu(unsigned long rlim_new)
 {
-        cputime_t cputime;
+        cputime_t cputime = secs_to_cputime(rlim_new);
+        struct signal_struct *const sig = current->signal;
-        cputime = secs_to_cputime(rlim_new);
+        if (cputime_eq(sig->it[CPUCLOCK_PROF].expires, cputime_zero) ||
-        if (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
+            cputime_gt(sig->it[CPUCLOCK_PROF].expires, cputime)) {
-            cputime_gt(current->signal->it_prof_expires, cputime)) {
                spin_lock_irq(&current->sighand->siglock);
                set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime, NULL);
                spin_unlock_irq(&current->sighand->siglock);
@@ -542,6 +543,17 @@ static void clear_dead_task(struct k_itimer *timer, union cpu_time_count now)
                                             now);
 }
+static inline int expires_gt(cputime_t expires, cputime_t new_exp)
+{
+        return cputime_eq(expires, cputime_zero) ||
+               cputime_gt(expires, new_exp);
+}
+static inline int expires_le(cputime_t expires, cputime_t new_exp)
+{
+        return !cputime_eq(expires, cputime_zero) &&
+               cputime_le(expires, new_exp);
+}
 /*
 * Insert the timer on the appropriate list before any timers that
 * expire later.  This must be called with the tasklist_lock held
@@ -586,34 +598,32 @@ static void arm_timer(struct k_itimer *timer, union cpu_time_count now)
                 */
                if (CPUCLOCK_PERTHREAD(timer->it_clock)) {
+                        union cpu_time_count *exp = &nt->expires;
                        switch (CPUCLOCK_WHICH(timer->it_clock)) {
                        default:
                                BUG();
                        case CPUCLOCK_PROF:
-                                if (cputime_eq(p->cputime_expires.prof_exp,
+                                if (expires_gt(p->cputime_expires.prof_exp,
-                                               cputime_zero) ||
+                                               exp->cpu))
-                                    cputime_gt(p->cputime_expires.prof_exp,
+                                        p->cputime_expires.prof_exp = exp->cpu;
-                                               nt->expires.cpu))
-                                        p->cputime_expires.prof_exp =
-                                                nt->expires.cpu;
                                break;
                        case CPUCLOCK_VIRT:
-                                if (cputime_eq(p->cputime_expires.virt_exp,
+                                if (expires_gt(p->cputime_expires.virt_exp,
-                                               cputime_zero) ||
+                                               exp->cpu))
-                                    cputime_gt(p->cputime_expires.virt_exp,
+                                        p->cputime_expires.virt_exp = exp->cpu;
-                                               nt->expires.cpu))
-                                        p->cputime_expires.virt_exp =
-                                                nt->expires.cpu;
                                break;
                        case CPUCLOCK_SCHED:
                                if (p->cputime_expires.sched_exp == 0 ||
-                                    p->cputime_expires.sched_exp >
+                                    p->cputime_expires.sched_exp > exp->sched)
-                                                        nt->expires.sched)
                                        p->cputime_expires.sched_exp =
-                                                nt->expires.sched;
+                                                                exp->sched;
                                break;
                        }
                } else {
+                        struct signal_struct *const sig = p->signal;
+                        union cpu_time_count *exp = &timer->it.cpu.expires;
                        /*
                         * For a process timer, set the cached expiration time.
                         */
@@ -621,30 +631,23 @@ static void arm_timer(struct k_itimer *timer, union cpu_time_count now)
                        default:
                                BUG();
                        case CPUCLOCK_VIRT:
-                                if (!cputime_eq(p->signal->it_virt_expires,
+                                if (expires_le(sig->it[CPUCLOCK_VIRT].expires,
-                                                cputime_zero) &&
+                                               exp->cpu))
-                                    cputime_lt(p->signal->it_virt_expires,
-                                               timer->it.cpu.expires.cpu))
                                        break;
-                                p->signal->cputime_expires.virt_exp =
+                                sig->cputime_expires.virt_exp = exp->cpu;
-                                        timer->it.cpu.expires.cpu;
                                break;
                        case CPUCLOCK_PROF:
-                                if (!cputime_eq(p->signal->it_prof_expires,
+                                if (expires_le(sig->it[CPUCLOCK_PROF].expires,
-                                                cputime_zero) &&
+                                               exp->cpu))
-                                    cputime_lt(p->signal->it_prof_expires,
-                                               timer->it.cpu.expires.cpu))
                                        break;
-                                i = p->signal->rlim[RLIMIT_CPU].rlim_cur;
+                                i = sig->rlim[RLIMIT_CPU].rlim_cur;
                                if (i != RLIM_INFINITY &&
-                                    i <= cputime_to_secs(timer->it.cpu.expires.cpu))
+                                    i <= cputime_to_secs(exp->cpu))
                                        break;
-                                p->signal->cputime_expires.prof_exp =
+                                sig->cputime_expires.prof_exp = exp->cpu;
-                                        timer->it.cpu.expires.cpu;
                                break;
                        case CPUCLOCK_SCHED:
-                                p->signal->cputime_expires.sched_exp =
+                                sig->cputime_expires.sched_exp = exp->sched;
-                                        timer->it.cpu.expires.sched;
                                break;
                        }
                }
@@ -1071,6 +1074,40 @@ static void stop_process_timers(struct task_struct *tsk)
        spin_unlock_irqrestore(&cputimer->lock, flags);
 }
+static u32 onecputick;
+static void check_cpu_itimer(struct task_struct *tsk, struct cpu_itimer *it,
+                             cputime_t *expires, cputime_t cur_time, int signo)
+{
+        if (cputime_eq(it->expires, cputime_zero))
+                return;
+        if (cputime_ge(cur_time, it->expires)) {
+                if (!cputime_eq(it->incr, cputime_zero)) {
+                        it->expires = cputime_add(it->expires, it->incr);
+                        it->error += it->incr_error;
+                        if (it->error >= onecputick) {
+                                it->expires = cputime_sub(it->expires,
+                                                          cputime_one_jiffy);
+                                it->error -= onecputick;
+                        }
+                } else {
+                        it->expires = cputime_zero;
+                }
+                trace_itimer_expire(signo == SIGPROF ?
+                                    ITIMER_PROF : ITIMER_VIRTUAL,
+                                    tsk->signal->leader_pid, cur_time);
+                __group_send_sig_info(signo, SEND_SIG_PRIV, tsk);
+        }
+        if (!cputime_eq(it->expires, cputime_zero) &&
+            (cputime_eq(*expires, cputime_zero) ||
+             cputime_lt(it->expires, *expires))) {
+                *expires = it->expires;
+        }
+}
 /*
 * Check for any per-thread CPU timers that have fired and move them
 * off the tsk->*_timers list onto the firing list.  Per-thread timers
@@ -1090,10 +1127,10 @@ static void check_process_timers(struct task_struct *tsk,
         * Don't sample the current process CPU clocks if there are no timers.
         */
        if (list_empty(&timers[CPUCLOCK_PROF]) &&
-            cputime_eq(sig->it_prof_expires, cputime_zero) &&
+            cputime_eq(sig->it[CPUCLOCK_PROF].expires, cputime_zero) &&
            sig->rlim[RLIMIT_CPU].rlim_cur == RLIM_INFINITY &&
            list_empty(&timers[CPUCLOCK_VIRT]) &&
-            cputime_eq(sig->it_virt_expires, cputime_zero) &&
+            cputime_eq(sig->it[CPUCLOCK_VIRT].expires, cputime_zero) &&
            list_empty(&timers[CPUCLOCK_SCHED])) {
                stop_process_timers(tsk);
                return;
@@ -1153,38 +1190,11 @@ static void check_process_timers(struct task_struct *tsk,
        /*
         * Check for the special case process timers.
         */
-        if (!cputime_eq(sig->it_prof_expires, cputime_zero)) {
+        check_cpu_itimer(tsk, &sig->it[CPUCLOCK_PROF], &prof_expires, ptime,
-                if (cputime_ge(ptime, sig->it_prof_expires)) {
+                         SIGPROF);
-                        /* ITIMER_PROF fires and reloads.  */
+        check_cpu_itimer(tsk, &sig->it[CPUCLOCK_VIRT], &virt_expires, utime,
-                        sig->it_prof_expires = sig->it_prof_incr;
+                         SIGVTALRM);
-                        if (!cputime_eq(sig->it_prof_expires, cputime_zero)) {
-                                sig->it_prof_expires = cputime_add(
-                                        sig->it_prof_expires, ptime);
-                        }
-                        __group_send_sig_info(SIGPROF, SEND_SIG_PRIV, tsk);
-                }
-                if (!cputime_eq(sig->it_prof_expires, cputime_zero) &&
-                    (cputime_eq(prof_expires, cputime_zero) ||
-                     cputime_lt(sig->it_prof_expires, prof_expires))) {
-                        prof_expires = sig->it_prof_expires;
-                }
-        }
-        if (!cputime_eq(sig->it_virt_expires, cputime_zero)) {
-                if (cputime_ge(utime, sig->it_virt_expires)) {
-                        /* ITIMER_VIRTUAL fires and reloads.  */
-                        sig->it_virt_expires = sig->it_virt_incr;
-                        if (!cputime_eq(sig->it_virt_expires, cputime_zero)) {
-                                sig->it_virt_expires = cputime_add(
-                                        sig->it_virt_expires, utime);
-                        }
-                        __group_send_sig_info(SIGVTALRM, SEND_SIG_PRIV, tsk);
-                }
-                if (!cputime_eq(sig->it_virt_expires, cputime_zero) &&
-                    (cputime_eq(virt_expires, cputime_zero) ||
-                     cputime_lt(sig->it_virt_expires, virt_expires))) {
-                        virt_expires = sig->it_virt_expires;
-                }
-        }
        if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
                unsigned long psecs = cputime_to_secs(ptime);
                cputime_t x;
@@ -1457,7 +1467,7 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
                if (!cputime_eq(*oldval, cputime_zero)) {
                        if (cputime_le(*oldval, now.cpu)) {
                                /* Just about to fire. */
-                                *oldval = jiffies_to_cputime(1);
+                                *oldval = cputime_one_jiffy;
                        } else {
                                *oldval = cputime_sub(*oldval, now.cpu);
                        }
@@ -1703,10 +1713,15 @@ static __init int init_posix_cpu_timers(void)
                .nsleep = thread_cpu_nsleep,
                .nsleep_restart = thread_cpu_nsleep_restart,
        };
+        struct timespec ts;
        register_posix_clock(CLOCK_PROCESS_CPUTIME_ID, &process);
        register_posix_clock(CLOCK_THREAD_CPUTIME_ID, &thread);
+        cputime_to_timespec(cputime_one_jiffy, &ts);
+        onecputick = ts.tv_nsec;
+        WARN_ON(ts.tv_sec != 0);
        return 0;
 }
 __initcall(init_posix_cpu_timers);
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 8ba052c86d48..b101cdc4df3f 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/file.h>
-#include <linux/utsname.h>
 #include <linux/delay.h>
 #include <linux/bitops.h>
 #include <linux/genhd.h>
diff --git a/kernel/printk.c b/kernel/printk.c
index 602033acd6c7..f38b07f78a4e 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -206,12 +206,11 @@ __setup("log_buf_len=", log_buf_len_setup);
 #ifdef CONFIG_BOOT_PRINTK_DELAY
 static unsigned int boot_delay; /* msecs delay after each printk during bootup */
-static unsigned long long printk_delay_msec; /* per msec, based on boot_delay */
+static unsigned long long loops_per_msec;       /* based on boot_delay */
 static int __init boot_delay_setup(char *str)
 {
        unsigned long lpj;
-        unsigned long long loops_per_msec;
        lpj = preset_lpj ? preset_lpj : 1000000;        /* some guess */
        loops_per_msec = (unsigned long long)lpj / 1000 * HZ;
@@ -220,10 +219,9 @@ static int __init boot_delay_setup(char *str)
        if (boot_delay > 10 * 1000)
                boot_delay = 0;
-        printk_delay_msec = loops_per_msec;
+        pr_debug("boot_delay: %u, preset_lpj: %ld, lpj: %lu, "
-        printk(KERN_DEBUG "boot_delay: %u, preset_lpj: %ld, lpj: %lu, "
+                "HZ: %d, loops_per_msec: %llu\n",
-                "HZ: %d, printk_delay_msec: %llu\n",
+                boot_delay, preset_lpj, lpj, HZ, loops_per_msec);
-                boot_delay, preset_lpj, lpj, HZ, printk_delay_msec);
        return 1;
 }
 __setup("boot_delay=", boot_delay_setup);
@@ -236,7 +234,7 @@ static void boot_delay_msec(void)
        if (boot_delay == 0 || system_state != SYSTEM_BOOTING)
                return;
-        k = (unsigned long long)printk_delay_msec * boot_delay;
+        k = (unsigned long long)loops_per_msec * boot_delay;
        timeout = jiffies + msecs_to_jiffies(boot_delay);
        while (k) {
@@ -655,6 +653,20 @@ static int recursion_bug;
 static int new_text_line = 1;
 static char printk_buf[1024];
+int printk_delay_msec __read_mostly;
+static inline void printk_delay(void)
+{
+        if (unlikely(printk_delay_msec)) {
+                int m = printk_delay_msec;
+                while (m--) {
+                        mdelay(1);
+                        touch_nmi_watchdog();
+                }
+        }
+}
 asmlinkage int vprintk(const char *fmt, va_list args)
 {
        int printed_len = 0;
@@ -664,6 +676,7 @@ asmlinkage int vprintk(const char *fmt, va_list args)
        char *p;
        boot_delay_msec();
+        printk_delay();
        preempt_disable();
        /* This stops the holder of console_sem just where we want him */
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 307c285af59e..23bd09cd042e 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -266,9 +266,10 @@ static int ignoring_children(struct sighand_struct *sigh)
 * or self-reaping.  Do notification now if it would have happened earlier.
 * If it should reap itself, return true.
 *
- * If it's our own child, there is no notification to do.
+ * If it's our own child, there is no notification to do. But if our normal
- * But if our normal children self-reap, then this child
+ * children self-reap, then this child was prevented by ptrace and we must
- * was prevented by ptrace and we must reap it now.
+ * reap it now, in that case we must also wake up sub-threads sleeping in
+ * do_wait().
 */
 static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
 {
@@ -278,8 +279,10 @@ static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
                if (!task_detached(p) && thread_group_empty(p)) {
                        if (!same_thread_group(p->real_parent, tracer))
                                do_notify_parent(p, p->exit_signal);
-                        else if (ignoring_children(tracer->sighand))
+                        else if (ignoring_children(tracer->sighand)) {
+                                __wake_up_parent(p, tracer);
                                p->exit_signal = -1;
+                        }
                }
                if (task_detached(p)) {
                        /* Mark it as in the process of being reaped. */
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 37ac45483082..400183346ad2 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -46,22 +46,15 @@
 #include <linux/module.h>
 #include <linux/kernel_stat.h>
-enum rcu_barrier {
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        RCU_BARRIER_STD,
+static struct lock_class_key rcu_lock_key;
-        RCU_BARRIER_BH,
+struct lockdep_map rcu_lock_map =
-        RCU_BARRIER_SCHED,
+        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock", &rcu_lock_key);
-};
+EXPORT_SYMBOL_GPL(rcu_lock_map);
+#endif
-static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
-static atomic_t rcu_barrier_cpu_count;
-static DEFINE_MUTEX(rcu_barrier_mutex);
-static struct completion rcu_barrier_completion;
 int rcu_scheduler_active __read_mostly;
-static atomic_t rcu_migrate_type_count = ATOMIC_INIT(0);
-static struct rcu_head rcu_migrate_head[3];
-static DECLARE_WAIT_QUEUE_HEAD(rcu_migrate_wq);
 /*
 * Awaken the corresponding synchronize_rcu() instance now that a
 * grace period has elapsed.
@@ -164,129 +157,10 @@ void synchronize_rcu_bh(void)
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_bh);
-static void rcu_barrier_callback(struct rcu_head *notused)
-{
-        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
-                complete(&rcu_barrier_completion);
-}
-/*
- * Called with preemption disabled, and from cross-cpu IRQ context.
- */
-static void rcu_barrier_func(void *type)
-{
-        int cpu = smp_processor_id();
-        struct rcu_head *head = &per_cpu(rcu_barrier_head, cpu);
-        atomic_inc(&rcu_barrier_cpu_count);
-        switch ((enum rcu_barrier)type) {
-        case RCU_BARRIER_STD:
-                call_rcu(head, rcu_barrier_callback);
-                break;
-        case RCU_BARRIER_BH:
-                call_rcu_bh(head, rcu_barrier_callback);
-                break;
-        case RCU_BARRIER_SCHED:
-                call_rcu_sched(head, rcu_barrier_callback);
-                break;
-        }
-}
-static inline void wait_migrated_callbacks(void)
-{
-        wait_event(rcu_migrate_wq, !atomic_read(&rcu_migrate_type_count));
-        smp_mb(); /* In case we didn't sleep. */
-}
-/*
- * Orchestrate the specified type of RCU barrier, waiting for all
- * RCU callbacks of the specified type to complete.
- */
-static void _rcu_barrier(enum rcu_barrier type)
-{
-        BUG_ON(in_interrupt());
-        /* Take cpucontrol mutex to protect against CPU hotplug */
-        mutex_lock(&rcu_barrier_mutex);
-        init_completion(&rcu_barrier_completion);
-        /*
-         * Initialize rcu_barrier_cpu_count to 1, then invoke
-         * rcu_barrier_func() on each CPU, so that each CPU also has
-         * incremented rcu_barrier_cpu_count.  Only then is it safe to
-         * decrement rcu_barrier_cpu_count -- otherwise the first CPU
-         * might complete its grace period before all of the other CPUs
-         * did their increment, causing this function to return too
-         * early.
-         */
-        atomic_set(&rcu_barrier_cpu_count, 1);
-        on_each_cpu(rcu_barrier_func, (void *)type, 1);
-        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
-                complete(&rcu_barrier_completion);
-        wait_for_completion(&rcu_barrier_completion);
-        mutex_unlock(&rcu_barrier_mutex);
-        wait_migrated_callbacks();
-}
-/**
- * rcu_barrier - Wait until all in-flight call_rcu() callbacks complete.
- */
-void rcu_barrier(void)
-{
-        _rcu_barrier(RCU_BARRIER_STD);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier);
-/**
- * rcu_barrier_bh - Wait until all in-flight call_rcu_bh() callbacks complete.
- */
-void rcu_barrier_bh(void)
-{
-        _rcu_barrier(RCU_BARRIER_BH);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier_bh);
-/**
- * rcu_barrier_sched - Wait for in-flight call_rcu_sched() callbacks.
- */
-void rcu_barrier_sched(void)
-{
-        _rcu_barrier(RCU_BARRIER_SCHED);
-}
-EXPORT_SYMBOL_GPL(rcu_barrier_sched);
-static void rcu_migrate_callback(struct rcu_head *notused)
-{
-        if (atomic_dec_and_test(&rcu_migrate_type_count))
-                wake_up(&rcu_migrate_wq);
-}
-extern int rcu_cpu_notify(struct notifier_block *self,
-                          unsigned long action, void *hcpu);
 static int __cpuinit rcu_barrier_cpu_hotplug(struct notifier_block *self,
                unsigned long action, void *hcpu)
 {
-        rcu_cpu_notify(self, action, hcpu);
+        return rcu_cpu_notify(self, action, hcpu);
-        if (action == CPU_DYING) {
-                /*
-                 * preempt_disable() in on_each_cpu() prevents stop_machine(),
-                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
-                 * returns, all online cpus have queued rcu_barrier_func(),
-                 * and the dead cpu(if it exist) queues rcu_migrate_callback()s.
-                 *
-                 * These callbacks ensure _rcu_barrier() waits for all
-                 * RCU callbacks of the specified type to complete.
-                 */
-                atomic_set(&rcu_migrate_type_count, 3);
-                call_rcu_bh(rcu_migrate_head, rcu_migrate_callback);
-                call_rcu_sched(rcu_migrate_head + 1, rcu_migrate_callback);
-                call_rcu(rcu_migrate_head + 2, rcu_migrate_callback);
-        } else if (action == CPU_DOWN_PREPARE) {
-                /* Don't need to wait until next removal operation. */
-                /* rcu_migrate_head is protected by cpu_add_remove_lock */
-                wait_migrated_callbacks();
-        }
-        return NOTIFY_OK;
 }
 void __init rcu_init(void)
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 233768f21f97..697c0a0229d4 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -606,8 +606,6 @@ static struct rcu_torture_ops sched_ops_sync = {
        .name           = "sched_sync"
 };
-extern int rcu_expedited_torture_stats(char *page);
 static struct rcu_torture_ops sched_expedited_ops = {
        .init           = rcu_sync_torture_init,
        .cleanup        = NULL,
@@ -650,7 +648,7 @@ rcu_torture_writer(void *arg)
                old_rp = rcu_torture_current;
                rp->rtort_mbtest = 1;
                rcu_assign_pointer(rcu_torture_current, rp);
-                smp_wmb();
+                smp_wmb(); /* Mods to old_rp must follow rcu_assign_pointer() */
                if (old_rp) {
                        i = old_rp->rtort_pipe_count;
                        if (i > RCU_TORTURE_PIPE_LEN)
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 52b06f6e158c..705f02ac7433 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -49,13 +49,6 @@
 #include "rcutree.h"
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-static struct lock_class_key rcu_lock_key;
-struct lockdep_map rcu_lock_map =
-        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock", &rcu_lock_key);
-EXPORT_SYMBOL_GPL(rcu_lock_map);
-#endif
 /* Data structures. */
 #define RCU_STATE_INITIALIZER(name) { \
@@ -70,6 +63,9 @@ EXPORT_SYMBOL_GPL(rcu_lock_map);
        .gpnum = -300, \
        .completed = -300, \
        .onofflock = __SPIN_LOCK_UNLOCKED(&name.onofflock), \
+        .orphan_cbs_list = NULL, \
+        .orphan_cbs_tail = &name.orphan_cbs_list, \
+        .orphan_qlen = 0, \
        .fqslock = __SPIN_LOCK_UNLOCKED(&name.fqslock), \
        .n_force_qs = 0, \
        .n_force_qs_ngp = 0, \
@@ -81,24 +77,16 @@ DEFINE_PER_CPU(struct rcu_data, rcu_sched_data);
 struct rcu_state rcu_bh_state = RCU_STATE_INITIALIZER(rcu_bh_state);
 DEFINE_PER_CPU(struct rcu_data, rcu_bh_data);
-extern long rcu_batches_completed_sched(void);
-static struct rcu_node *rcu_get_root(struct rcu_state *rsp);
-static void cpu_quiet_msk(unsigned long mask, struct rcu_state *rsp,
-                          struct rcu_node *rnp, unsigned long flags);
-static void cpu_quiet_msk_finish(struct rcu_state *rsp, unsigned long flags);
-#ifdef CONFIG_HOTPLUG_CPU
-static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp);
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
-static void __rcu_process_callbacks(struct rcu_state *rsp,
-                                    struct rcu_data *rdp);
-static void __call_rcu(struct rcu_head *head,
-                       void (*func)(struct rcu_head *rcu),
-                       struct rcu_state *rsp);
-static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp);
-static void __cpuinit rcu_init_percpu_data(int cpu, struct rcu_state *rsp,
-                                           int preemptable);
-#include "rcutree_plugin.h"
+/*
+ * Return true if an RCU grace period is in progress.  The ACCESS_ONCE()s
+ * permit this function to be invoked without holding the root rcu_node
+ * structure's ->lock, but of course results can be subject to change.
+ */
+static int rcu_gp_in_progress(struct rcu_state *rsp)
+{
+        return ACCESS_ONCE(rsp->completed) != ACCESS_ONCE(rsp->gpnum);
+}
 /*
 * Note a quiescent state.  Because we do not need to know
@@ -137,6 +125,10 @@ static int blimit = 10;		/* Maximum callbacks per softirq. */
 static int qhimark = 10000;     /* If this many pending, ignore blimit. */
 static int qlowmark = 100;      /* Once only this many pending, use blimit. */
+module_param(blimit, int, 0);
+module_param(qhimark, int, 0);
+module_param(qlowmark, int, 0);
 static void force_quiescent_state(struct rcu_state *rsp, int relaxed);
 static int rcu_pending(int cpu);
@@ -173,9 +165,7 @@ cpu_has_callbacks_ready_to_invoke(struct rcu_data *rdp)
 static int
 cpu_needs_another_gp(struct rcu_state *rsp, struct rcu_data *rdp)
 {
-        /* ACCESS_ONCE() because we are accessing outside of lock. */
+        return *rdp->nxttail[RCU_DONE_TAIL] && !rcu_gp_in_progress(rsp);
-        return *rdp->nxttail[RCU_DONE_TAIL] &&
-               ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum);
 }
 /*
@@ -369,7 +359,7 @@ static long dyntick_recall_completed(struct rcu_state *rsp)
 /*
 * Snapshot the specified CPU's dynticks counter so that we can later
 * credit them with an implicit quiescent state.  Return 1 if this CPU
- * is already in a quiescent state courtesy of dynticks idle mode.
+ * is in dynticks idle mode, which is an extended quiescent state.
 */
 static int dyntick_save_progress_counter(struct rcu_data *rdp)
 {
@@ -475,30 +465,34 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
        long delta;
        unsigned long flags;
        struct rcu_node *rnp = rcu_get_root(rsp);
-        struct rcu_node *rnp_cur = rsp->level[NUM_RCU_LVLS - 1];
-        struct rcu_node *rnp_end = &rsp->node[NUM_RCU_NODES];
        /* Only let one CPU complain about others per time interval. */
        spin_lock_irqsave(&rnp->lock, flags);
        delta = jiffies - rsp->jiffies_stall;
-        if (delta < RCU_STALL_RAT_DELAY || rsp->gpnum == rsp->completed) {
+        if (delta < RCU_STALL_RAT_DELAY || !rcu_gp_in_progress(rsp)) {
                spin_unlock_irqrestore(&rnp->lock, flags);
                return;
        }
        rsp->jiffies_stall = jiffies + RCU_SECONDS_TILL_STALL_RECHECK;
+        /*
+         * Now rat on any tasks that got kicked up to the root rcu_node
+         * due to CPU offlining.
+         */
+        rcu_print_task_stall(rnp);
        spin_unlock_irqrestore(&rnp->lock, flags);
        /* OK, time to rat on our buddy... */
        printk(KERN_ERR "INFO: RCU detected CPU stalls:");
-        for (; rnp_cur < rnp_end; rnp_cur++) {
+        rcu_for_each_leaf_node(rsp, rnp) {
                rcu_print_task_stall(rnp);
-                if (rnp_cur->qsmask == 0)
+                if (rnp->qsmask == 0)
                        continue;
-                for (cpu = 0; cpu <= rnp_cur->grphi - rnp_cur->grplo; cpu++)
+                for (cpu = 0; cpu <= rnp->grphi - rnp->grplo; cpu++)
-                        if (rnp_cur->qsmask & (1UL << cpu))
+                        if (rnp->qsmask & (1UL << cpu))
-                                printk(" %d", rnp_cur->grplo + cpu);
+                                printk(" %d", rnp->grplo + cpu);
        }
        printk(" (detected by %d, t=%ld jiffies)\n",
               smp_processor_id(), (long)(jiffies - rsp->gp_start));
@@ -537,8 +531,7 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
                /* We haven't checked in, so go dump stack. */
                print_cpu_stall(rsp);
-        } else if (rsp->gpnum != rsp->completed &&
+        } else if (rcu_gp_in_progress(rsp) && delta >= RCU_STALL_RAT_DELAY) {
-                   delta >= RCU_STALL_RAT_DELAY) {
                /* They had two time units to dump stack, so complain. */
                print_other_cpu_stall(rsp);
@@ -617,9 +610,15 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
        note_new_gpnum(rsp, rdp);
        /*
-         * Because we are first, we know that all our callbacks will
+         * Because this CPU just now started the new grace period, we know
-         * be covered by this upcoming grace period, even the ones
+         * that all of its callbacks will be covered by this upcoming grace
-         * that were registered arbitrarily recently.
+         * period, even the ones that were registered arbitrarily recently.
+         * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL.
+         *
+         * Other CPUs cannot be sure exactly when the grace period started.
+         * Therefore, their recently registered callbacks must pass through
+         * an additional RCU_NEXT_READY stage, so that they will be handled
+         * by the next RCU grace period.
         */
        rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
        rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
@@ -657,7 +656,7 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
         * one corresponding to this CPU, due to the fact that we have
         * irqs disabled.
         */
-        for (rnp = &rsp->node[0]; rnp < &rsp->node[NUM_RCU_NODES]; rnp++) {
+        rcu_for_each_node_breadth_first(rsp, rnp) {
                spin_lock(&rnp->lock);  /* irqs already disabled. */
                rcu_preempt_check_blocked_tasks(rnp);
                rnp->qsmask = rnp->qsmaskinit;
@@ -703,9 +702,9 @@ rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp)
 * hold rnp->lock, as required by rcu_start_gp(), which will release it.
 */
 static void cpu_quiet_msk_finish(struct rcu_state *rsp, unsigned long flags)
-        __releases(rnp->lock)
+        __releases(rcu_get_root(rsp)->lock)
 {
-        WARN_ON_ONCE(rsp->completed == rsp->gpnum);
+        WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
        rsp->completed = rsp->gpnum;
        rcu_process_gp_end(rsp, rsp->rda[smp_processor_id()]);
        rcu_start_gp(rsp, flags);  /* releases root node's rnp->lock. */
@@ -842,17 +841,63 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
 #ifdef CONFIG_HOTPLUG_CPU
 /*
+ * Move a dying CPU's RCU callbacks to the ->orphan_cbs_list for the
+ * specified flavor of RCU.  The callbacks will be adopted by the next
+ * _rcu_barrier() invocation or by the CPU_DEAD notifier, whichever
+ * comes first.  Because this is invoked from the CPU_DYING notifier,
+ * irqs are already disabled.
+ */
+static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
+{
+        int i;
+        struct rcu_data *rdp = rsp->rda[smp_processor_id()];
+        if (rdp->nxtlist == NULL)
+                return;  /* irqs disabled, so comparison is stable. */
+        spin_lock(&rsp->onofflock);  /* irqs already disabled. */
+        *rsp->orphan_cbs_tail = rdp->nxtlist;
+        rsp->orphan_cbs_tail = rdp->nxttail[RCU_NEXT_TAIL];
+        rdp->nxtlist = NULL;
+        for (i = 0; i < RCU_NEXT_SIZE; i++)
+                rdp->nxttail[i] = &rdp->nxtlist;
+        rsp->orphan_qlen += rdp->qlen;
+        rdp->qlen = 0;
+        spin_unlock(&rsp->onofflock);  /* irqs remain disabled. */
+}
+/*
+ * Adopt previously orphaned RCU callbacks.
+ */
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+{
+        unsigned long flags;
+        struct rcu_data *rdp;
+        spin_lock_irqsave(&rsp->onofflock, flags);
+        rdp = rsp->rda[smp_processor_id()];
+        if (rsp->orphan_cbs_list == NULL) {
+                spin_unlock_irqrestore(&rsp->onofflock, flags);
+                return;
+        }
+        *rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_list;
+        rdp->nxttail[RCU_NEXT_TAIL] = rsp->orphan_cbs_tail;
+        rdp->qlen += rsp->orphan_qlen;
+        rsp->orphan_cbs_list = NULL;
+        rsp->orphan_cbs_tail = &rsp->orphan_cbs_list;
+        rsp->orphan_qlen = 0;
+        spin_unlock_irqrestore(&rsp->onofflock, flags);
+}
+/*
 * Remove the outgoing CPU from the bitmasks in the rcu_node hierarchy
 * and move all callbacks from the outgoing CPU to the current one.
 */
 static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
 {
-        int i;
        unsigned long flags;
        long lastcomp;
        unsigned long mask;
        struct rcu_data *rdp = rsp->rda[cpu];
-        struct rcu_data *rdp_me;
        struct rcu_node *rnp;
        /* Exclude any attempts to start a new grace period. */
@@ -875,32 +920,9 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
        } while (rnp != NULL);
        lastcomp = rsp->completed;
-        spin_unlock(&rsp->onofflock);           /* irqs remain disabled. */
+        spin_unlock_irqrestore(&rsp->onofflock, flags);
-        /*
+        rcu_adopt_orphan_cbs(rsp);
-         * Move callbacks from the outgoing CPU to the running CPU.
-         * Note that the outgoing CPU is now quiscent, so it is now
-         * (uncharacteristically) safe to access its rcu_data structure.
-         * Note also that we must carefully retain the order of the
-         * outgoing CPU's callbacks in order for rcu_barrier() to work
-         * correctly.  Finally, note that we start all the callbacks
-         * afresh, even those that have passed through a grace period
-         * and are therefore ready to invoke.  The theory is that hotplug
-         * events are rare, and that if they are frequent enough to
-         * indefinitely delay callbacks, you have far worse things to
-         * be worrying about.
-         */
-        rdp_me = rsp->rda[smp_processor_id()];
-        if (rdp->nxtlist != NULL) {
-                *rdp_me->nxttail[RCU_NEXT_TAIL] = rdp->nxtlist;
-                rdp_me->nxttail[RCU_NEXT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
-                rdp->nxtlist = NULL;
-                for (i = 0; i < RCU_NEXT_SIZE; i++)
-                        rdp->nxttail[i] = &rdp->nxtlist;
-                rdp_me->qlen += rdp->qlen;
-                rdp->qlen = 0;
-        }
-        local_irq_restore(flags);
 }
 /*
@@ -918,6 +940,14 @@ static void rcu_offline_cpu(int cpu)
 #else /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_send_cbs_to_orphanage(struct rcu_state *rsp)
+{
+}
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+{
+}
 static void rcu_offline_cpu(int cpu)
 {
 }
@@ -1050,33 +1080,32 @@ static int rcu_process_dyntick(struct rcu_state *rsp, long lastcomp,
        int cpu;
        unsigned long flags;
        unsigned long mask;
-        struct rcu_node *rnp_cur = rsp->level[NUM_RCU_LVLS - 1];
+        struct rcu_node *rnp;
-        struct rcu_node *rnp_end = &rsp->node[NUM_RCU_NODES];
-        for (; rnp_cur < rnp_end; rnp_cur++) {
+        rcu_for_each_leaf_node(rsp, rnp) {
                mask = 0;
-                spin_lock_irqsave(&rnp_cur->lock, flags);
+                spin_lock_irqsave(&rnp->lock, flags);
                if (rsp->completed != lastcomp) {
-                        spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                        spin_unlock_irqrestore(&rnp->lock, flags);
                        return 1;
                }
-                if (rnp_cur->qsmask == 0) {
+                if (rnp->qsmask == 0) {
-                        spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                        spin_unlock_irqrestore(&rnp->lock, flags);
                        continue;
                }
-                cpu = rnp_cur->grplo;
+                cpu = rnp->grplo;
                bit = 1;
-                for (; cpu <= rnp_cur->grphi; cpu++, bit <<= 1) {
+                for (; cpu <= rnp->grphi; cpu++, bit <<= 1) {
-                        if ((rnp_cur->qsmask & bit) != 0 && f(rsp->rda[cpu]))
+                        if ((rnp->qsmask & bit) != 0 && f(rsp->rda[cpu]))
                                mask |= bit;
                }
                if (mask != 0 && rsp->completed == lastcomp) {
-                        /* cpu_quiet_msk() releases rnp_cur->lock. */
+                        /* cpu_quiet_msk() releases rnp->lock. */
-                        cpu_quiet_msk(mask, rsp, rnp_cur, flags);
+                        cpu_quiet_msk(mask, rsp, rnp, flags);
                        continue;
                }
-                spin_unlock_irqrestore(&rnp_cur->lock, flags);
+                spin_unlock_irqrestore(&rnp->lock, flags);
        }
        return 0;
 }
@@ -1092,7 +1121,7 @@ static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
        struct rcu_node *rnp = rcu_get_root(rsp);
        u8 signaled;
-        if (ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum))
+        if (!rcu_gp_in_progress(rsp))
                return;  /* No grace period in progress, nothing to force. */
        if (!spin_trylock_irqsave(&rsp->fqslock, flags)) {
                rsp->n_force_qs_lh++; /* Inexact, can lose counts.  Tough! */
@@ -1251,7 +1280,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
        rdp->nxttail[RCU_NEXT_TAIL] = &head->next;
        /* Start a new grace period if one not already started. */
-        if (ACCESS_ONCE(rsp->completed) == ACCESS_ONCE(rsp->gpnum)) {
+        if (!rcu_gp_in_progress(rsp)) {
                unsigned long nestflag;
                struct rcu_node *rnp_root = rcu_get_root(rsp);
@@ -1331,7 +1360,7 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
        }
        /* Has an RCU GP gone long enough to send resched IPIs &c? */
-        if (ACCESS_ONCE(rsp->completed) != ACCESS_ONCE(rsp->gpnum) &&
+        if (rcu_gp_in_progress(rsp) &&
            ((long)(ACCESS_ONCE(rsp->jiffies_force_qs) - jiffies) < 0)) {
                rdp->n_rp_need_fqs++;
                return 1;
@@ -1368,6 +1397,82 @@ int rcu_needs_cpu(int cpu)
               rcu_preempt_needs_cpu(cpu);
 }
+static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
+static atomic_t rcu_barrier_cpu_count;
+static DEFINE_MUTEX(rcu_barrier_mutex);
+static struct completion rcu_barrier_completion;
+static void rcu_barrier_callback(struct rcu_head *notused)
+{
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+}
+/*
+ * Called with preemption disabled, and from cross-cpu IRQ context.
+ */
+static void rcu_barrier_func(void *type)
+{
+        int cpu = smp_processor_id();
+        struct rcu_head *head = &per_cpu(rcu_barrier_head, cpu);
+        void (*call_rcu_func)(struct rcu_head *head,
+                              void (*func)(struct rcu_head *head));
+        atomic_inc(&rcu_barrier_cpu_count);
+        call_rcu_func = type;
+        call_rcu_func(head, rcu_barrier_callback);
+}
+/*
+ * Orchestrate the specified type of RCU barrier, waiting for all
+ * RCU callbacks of the specified type to complete.
+ */
+static void _rcu_barrier(struct rcu_state *rsp,
+                         void (*call_rcu_func)(struct rcu_head *head,
+                                               void (*func)(struct rcu_head *head)))
+{
+        BUG_ON(in_interrupt());
+        /* Take mutex to serialize concurrent rcu_barrier() requests. */
+        mutex_lock(&rcu_barrier_mutex);
+        init_completion(&rcu_barrier_completion);
+        /*
+         * Initialize rcu_barrier_cpu_count to 1, then invoke
+         * rcu_barrier_func() on each CPU, so that each CPU also has
+         * incremented rcu_barrier_cpu_count.  Only then is it safe to
+         * decrement rcu_barrier_cpu_count -- otherwise the first CPU
+         * might complete its grace period before all of the other CPUs
+         * did their increment, causing this function to return too
+         * early.
+         */
+        atomic_set(&rcu_barrier_cpu_count, 1);
+        preempt_disable(); /* stop CPU_DYING from filling orphan_cbs_list */
+        rcu_adopt_orphan_cbs(rsp);
+        on_each_cpu(rcu_barrier_func, (void *)call_rcu_func, 1);
+        preempt_enable(); /* CPU_DYING can again fill orphan_cbs_list */
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+        wait_for_completion(&rcu_barrier_completion);
+        mutex_unlock(&rcu_barrier_mutex);
+}
+/**
+ * rcu_barrier_bh - Wait until all in-flight call_rcu_bh() callbacks complete.
+ */
+void rcu_barrier_bh(void)
+{
+        _rcu_barrier(&rcu_bh_state, call_rcu_bh);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier_bh);
+/**
+ * rcu_barrier_sched - Wait for in-flight call_rcu_sched() callbacks.
+ */
+void rcu_barrier_sched(void)
+{
+        _rcu_barrier(&rcu_sched_state, call_rcu_sched);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier_sched);
 /*
 * Do boot-time initialization of a CPU's per-CPU RCU data.
 */
@@ -1464,6 +1569,22 @@ int __cpuinit rcu_cpu_notify(struct notifier_block *self,
        case CPU_UP_PREPARE_FROZEN:
                rcu_online_cpu(cpu);
                break;
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                /*
+                 * preempt_disable() in _rcu_barrier() prevents stop_machine(),
+                 * so when "on_each_cpu(rcu_barrier_func, (void *)type, 1);"
+                 * returns, all online cpus have queued rcu_barrier_func().
+                 * The dying CPU clears its cpu_online_mask bit and
+                 * moves all of its RCU callbacks to ->orphan_cbs_list
+                 * in the context of stop_machine(), so subsequent calls
+                 * to _rcu_barrier() will adopt these callbacks and only
+                 * then queue rcu_barrier_func() on all remaining CPUs.
+                 */
+                rcu_send_cbs_to_orphanage(&rcu_bh_state);
+                rcu_send_cbs_to_orphanage(&rcu_sched_state);
+                rcu_preempt_send_cbs_to_orphanage();
+                break;
        case CPU_DEAD:
        case CPU_DEAD_FROZEN:
        case CPU_UP_CANCELED:
@@ -1526,7 +1647,8 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                cpustride *= rsp->levelspread[i];
                rnp = rsp->level[i];
                for (j = 0; j < rsp->levelcnt[i]; j++, rnp++) {
-                        spin_lock_init(&rnp->lock);
+                        if (rnp != rcu_get_root(rsp))
+                                spin_lock_init(&rnp->lock);
                        rnp->gpnum = 0;
                        rnp->qsmask = 0;
                        rnp->qsmaskinit = 0;
@@ -1549,6 +1671,7 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                        INIT_LIST_HEAD(&rnp->blocked_tasks[1]);
                }
        }
+        spin_lock_init(&rcu_get_root(rsp)->lock);
 }
 /*
@@ -1558,6 +1681,10 @@ static void __init rcu_init_one(struct rcu_state *rsp)
 */
 #define RCU_INIT_FLAVOR(rsp, rcu_data) \
 do { \
+        int i; \
+        int j; \
+        struct rcu_node *rnp; \
+        \
        rcu_init_one(rsp); \
        rnp = (rsp)->level[NUM_RCU_LVLS - 1]; \
        j = 0; \
@@ -1570,31 +1697,8 @@ do { \
        } \
 } while (0)
-#ifdef CONFIG_TREE_PREEMPT_RCU
-void __init __rcu_init_preempt(void)
-{
-        int i;                  /* All used by RCU_INIT_FLAVOR(). */
-        int j;
-        struct rcu_node *rnp;
-        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
-}
-#else /* #ifdef CONFIG_TREE_PREEMPT_RCU */
-void __init __rcu_init_preempt(void)
-{
-}
-#endif /* #else #ifdef CONFIG_TREE_PREEMPT_RCU */
 void __init __rcu_init(void)
 {
-        int i;                  /* All used by RCU_INIT_FLAVOR(). */
-        int j;
-        struct rcu_node *rnp;
        rcu_bootup_announce();
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
        printk(KERN_INFO "RCU-based detection of stalled CPUs is enabled.\n");
@@ -1605,6 +1709,4 @@ void __init __rcu_init(void)
        open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 }
-module_param(blimit, int, 0);
+#include "rcutree_plugin.h"
-module_param(qhimark, int, 0);
-module_param(qlowmark, int, 0);
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 8e8287a983c2..b40ac5706040 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -48,14 +48,14 @@
 #elif NR_CPUS <= RCU_FANOUT_SQ
 #  define NUM_RCU_LVLS        2
 #  define NUM_RCU_LVL_0       1
-#  define NUM_RCU_LVL_1       (((NR_CPUS) + RCU_FANOUT - 1) / RCU_FANOUT)
+#  define NUM_RCU_LVL_1       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT)
 #  define NUM_RCU_LVL_2       (NR_CPUS)
 #  define NUM_RCU_LVL_3       0
 #elif NR_CPUS <= RCU_FANOUT_CUBE
 #  define NUM_RCU_LVLS        3
 #  define NUM_RCU_LVL_0       1
-#  define NUM_RCU_LVL_1       (((NR_CPUS) + RCU_FANOUT_SQ - 1) / RCU_FANOUT_SQ)
+#  define NUM_RCU_LVL_1       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT_SQ)
-#  define NUM_RCU_LVL_2       (((NR_CPUS) + (RCU_FANOUT) - 1) / (RCU_FANOUT))
+#  define NUM_RCU_LVL_2       DIV_ROUND_UP(NR_CPUS, RCU_FANOUT)
 #  define NUM_RCU_LVL_3       NR_CPUS
 #else
 # error "CONFIG_RCU_FANOUT insufficient for NR_CPUS"
@@ -79,15 +79,21 @@ struct rcu_dynticks {
 * Definition for node within the RCU grace-period-detection hierarchy.
 */
 struct rcu_node {
-        spinlock_t lock;
+        spinlock_t lock;        /* Root rcu_node's lock protects some */
+                                /*  rcu_state fields as well as following. */
        long    gpnum;          /* Current grace period for this node. */
                                /*  This will either be equal to or one */
                                /*  behind the root rcu_node's gpnum. */
        unsigned long qsmask;   /* CPUs or groups that need to switch in */
                                /*  order for current grace period to proceed.*/
+                                /*  In leaf rcu_node, each bit corresponds to */
+                                /*  an rcu_data structure, otherwise, each */
+                                /*  bit corresponds to a child rcu_node */
+                                /*  structure. */
        unsigned long qsmaskinit;
                                /* Per-GP initialization for qsmask. */
        unsigned long grpmask;  /* Mask to apply to parent qsmask. */
+                                /*  Only one bit will be set in this mask. */
        int     grplo;          /* lowest-numbered CPU or group here. */
        int     grphi;          /* highest-numbered CPU or group here. */
        u8      grpnum;         /* CPU/group number for next level up. */
@@ -95,8 +101,23 @@ struct rcu_node {
        struct rcu_node *parent;
        struct list_head blocked_tasks[2];
                                /* Tasks blocked in RCU read-side critsect. */
+                                /*  Grace period number (->gpnum) x blocked */
+                                /*  by tasks on the (x & 0x1) element of the */
+                                /*  blocked_tasks[] array. */
 } ____cacheline_internodealigned_in_smp;
+/*
+ * Do a full breadth-first scan of the rcu_node structures for the
+ * specified rcu_state structure.
+ */
+#define rcu_for_each_node_breadth_first(rsp, rnp) \
+        for ((rnp) = &(rsp)->node[0]; \
+             (rnp) < &(rsp)->node[NUM_RCU_NODES]; (rnp)++)
+#define rcu_for_each_leaf_node(rsp, rnp) \
+        for ((rnp) = (rsp)->level[NUM_RCU_LVLS - 1]; \
+             (rnp) < &(rsp)->node[NUM_RCU_NODES]; (rnp)++)
 /* Index values for nxttail array in struct rcu_data. */
 #define RCU_DONE_TAIL           0       /* Also RCU_WAIT head. */
 #define RCU_WAIT_TAIL           1       /* Also RCU_NEXT_READY head. */
@@ -126,19 +147,22 @@ struct rcu_data {
         * Any of the partitions might be empty, in which case the
         * pointer to that partition will be equal to the pointer for
         * the following partition.  When the list is empty, all of
-         * the nxttail elements point to nxtlist, which is NULL.
+         * the nxttail elements point to the ->nxtlist pointer itself,
+         * which in that case is NULL.
         *
-         * [*nxttail[RCU_NEXT_READY_TAIL], NULL = *nxttail[RCU_NEXT_TAIL]):
-         *      Entries that might have arrived after current GP ended
-         * [*nxttail[RCU_WAIT_TAIL], *nxttail[RCU_NEXT_READY_TAIL]):
-         *      Entries known to have arrived before current GP ended
-         * [*nxttail[RCU_DONE_TAIL], *nxttail[RCU_WAIT_TAIL]):
-         *      Entries that batch # <= ->completed - 1: waiting for current GP
         * [nxtlist, *nxttail[RCU_DONE_TAIL]):
         *      Entries that batch # <= ->completed
         *      The grace period for these entries has completed, and
         *      the other grace-period-completed entries may be moved
         *      here temporarily in rcu_process_callbacks().
+         * [*nxttail[RCU_DONE_TAIL], *nxttail[RCU_WAIT_TAIL]):
+         *      Entries that batch # <= ->completed - 1: waiting for current GP
+         * [*nxttail[RCU_WAIT_TAIL], *nxttail[RCU_NEXT_READY_TAIL]):
+         *      Entries known to have arrived before current GP ended
+         * [*nxttail[RCU_NEXT_READY_TAIL], *nxttail[RCU_NEXT_TAIL]):
+         *      Entries that might have arrived after current GP ended
+         *      Note that the value of *nxttail[RCU_NEXT_TAIL] will
+         *      always be NULL, as this is the end of the list.
         */
        struct rcu_head *nxtlist;
        struct rcu_head **nxttail[RCU_NEXT_SIZE];
@@ -216,8 +240,19 @@ struct rcu_state {
                                                /* Force QS state. */
        long    gpnum;                          /* Current gp number. */
        long    completed;                      /* # of last completed gp. */
+        /* End  of fields guarded by root rcu_node's lock. */
        spinlock_t onofflock;                   /* exclude on/offline and */
-                                                /*  starting new GP. */
+                                                /*  starting new GP.  Also */
+                                                /*  protects the following */
+                                                /*  orphan_cbs fields. */
+        struct rcu_head *orphan_cbs_list;       /* list of rcu_head structs */
+                                                /*  orphaned by all CPUs in */
+                                                /*  a given leaf rcu_node */
+                                                /*  going offline. */
+        struct rcu_head **orphan_cbs_tail;      /* And tail pointer. */
+        long orphan_qlen;                       /* Number of orphaned cbs. */
        spinlock_t fqslock;                     /* Only one task forcing */
                                                /*  quiescent states. */
        unsigned long jiffies_force_qs;         /* Time at which to invoke */
@@ -255,5 +290,30 @@ extern struct rcu_state rcu_preempt_state;
 DECLARE_PER_CPU(struct rcu_data, rcu_preempt_data);
 #endif /* #ifdef CONFIG_TREE_PREEMPT_RCU */
-#endif /* #ifdef RCU_TREE_NONCORE */
+#else /* #ifdef RCU_TREE_NONCORE */
+/* Forward declarations for rcutree_plugin.h */
+static inline void rcu_bootup_announce(void);
+long rcu_batches_completed(void);
+static void rcu_preempt_note_context_switch(int cpu);
+static int rcu_preempted_readers(struct rcu_node *rnp);
+#ifdef CONFIG_RCU_CPU_STALL_DETECTOR
+static void rcu_print_task_stall(struct rcu_node *rnp);
+#endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
+#ifdef CONFIG_HOTPLUG_CPU
+static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
+                                      struct rcu_node *rnp,
+                                      struct rcu_data *rdp);
+static void rcu_preempt_offline_cpu(int cpu);
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_preempt_check_callbacks(int cpu);
+static void rcu_preempt_process_callbacks(void);
+void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu));
+static int rcu_preempt_pending(int cpu);
+static int rcu_preempt_needs_cpu(int cpu);
+static void __cpuinit rcu_preempt_init_percpu_data(int cpu);
+static void rcu_preempt_send_cbs_to_orphanage(void);
+static void __init __rcu_init_preempt(void);
+#endif /* #else #ifdef RCU_TREE_NONCORE */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 1cee04f627eb..c0cb783aa16a 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -150,6 +150,16 @@ void __rcu_read_lock(void)
 }
 EXPORT_SYMBOL_GPL(__rcu_read_lock);
+/*
+ * Check for preempted RCU readers blocking the current grace period
+ * for the specified rcu_node structure.  If the caller needs a reliable
+ * answer, it must hold the rcu_node's ->lock.
+ */
+static int rcu_preempted_readers(struct rcu_node *rnp)
+{
+        return !list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
+}
 static void rcu_read_unlock_special(struct task_struct *t)
 {
        int empty;
@@ -196,7 +206,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
                                break;
                        spin_unlock(&rnp->lock);  /* irqs remain disabled. */
                }
-                empty = list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
+                empty = !rcu_preempted_readers(rnp);
                list_del_init(&t->rcu_node_entry);
                t->rcu_blocked_node = NULL;
@@ -207,7 +217,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
                 * drop rnp->lock and restore irq.
                 */
                if (!empty && rnp->qsmask == 0 &&
-                    list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1])) {
+                    !rcu_preempted_readers(rnp)) {
                        struct rcu_node *rnp_p;
                        if (rnp->parent == NULL) {
@@ -257,12 +267,12 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
 {
        unsigned long flags;
        struct list_head *lp;
-        int phase = rnp->gpnum & 0x1;
+        int phase;
        struct task_struct *t;
-        if (!list_empty(&rnp->blocked_tasks[phase])) {
+        if (rcu_preempted_readers(rnp)) {
                spin_lock_irqsave(&rnp->lock, flags);
-                phase = rnp->gpnum & 0x1; /* re-read under lock. */
+                phase = rnp->gpnum & 0x1;
                lp = &rnp->blocked_tasks[phase];
                list_for_each_entry(t, lp, rcu_node_entry)
                        printk(" P%d", t->pid);
@@ -281,20 +291,10 @@ static void rcu_print_task_stall(struct rcu_node *rnp)
 */
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
 {
-        WARN_ON_ONCE(!list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]));
+        WARN_ON_ONCE(rcu_preempted_readers(rnp));
        WARN_ON_ONCE(rnp->qsmask);
 }
-/*
- * Check for preempted RCU readers for the specified rcu_node structure.
- * If the caller needs a reliable answer, it must hold the rcu_node's
- * >lock.
- */
-static int rcu_preempted_readers(struct rcu_node *rnp)
-{
-        return !list_empty(&rnp->blocked_tasks[rnp->gpnum & 0x1]);
-}
 #ifdef CONFIG_HOTPLUG_CPU
 /*
@@ -410,6 +410,15 @@ static int rcu_preempt_needs_cpu(int cpu)
        return !!per_cpu(rcu_preempt_data, cpu).nxtlist;
 }
+/**
+ * rcu_barrier - Wait until all in-flight call_rcu() callbacks complete.
+ */
+void rcu_barrier(void)
+{
+        _rcu_barrier(&rcu_preempt_state, call_rcu);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
 /*
 * Initialize preemptable RCU's per-CPU data.
 */
@@ -419,6 +428,22 @@ static void __cpuinit rcu_preempt_init_percpu_data(int cpu)
 }
 /*
+ * Move preemptable RCU's callbacks to ->orphan_cbs_list.
+ */
+static void rcu_preempt_send_cbs_to_orphanage(void)
+{
+        rcu_send_cbs_to_orphanage(&rcu_preempt_state);
+}
+/*
+ * Initialize preemptable RCU's state structures.
+ */
+static void __init __rcu_init_preempt(void)
+{
+        RCU_INIT_FLAVOR(&rcu_preempt_state, rcu_preempt_data);
+}
+/*
 * Check for a task exiting while in a preemptable-RCU read-side
 * critical section, clean up if so.  No need to issue warnings,
 * as debug_check_no_locks_held() already does this if lockdep
@@ -461,6 +486,15 @@ static void rcu_preempt_note_context_switch(int cpu)
 {
 }
+/*
+ * Because preemptable RCU does not exist, there are never any preempted
+ * RCU readers.
+ */
+static int rcu_preempted_readers(struct rcu_node *rnp)
+{
+        return 0;
+}
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
 /*
@@ -483,15 +517,6 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
        WARN_ON_ONCE(rnp->qsmask);
 }
-/*
- * Because preemptable RCU does not exist, there are never any preempted
- * RCU readers.
- */
-static int rcu_preempted_readers(struct rcu_node *rnp)
-{
-        return 0;
-}
 #ifdef CONFIG_HOTPLUG_CPU
 /*
@@ -518,7 +543,7 @@ static void rcu_preempt_offline_cpu(int cpu)
 * Because preemptable RCU does not exist, it never has any callbacks
 * to check.
 */
-void rcu_preempt_check_callbacks(int cpu)
+static void rcu_preempt_check_callbacks(int cpu)
 {
 }
@@ -526,7 +551,7 @@ void rcu_preempt_check_callbacks(int cpu)
 * Because preemptable RCU does not exist, it never has any callbacks
 * to process.
 */
-void rcu_preempt_process_callbacks(void)
+static void rcu_preempt_process_callbacks(void)
 {
 }
@@ -556,6 +581,16 @@ static int rcu_preempt_needs_cpu(int cpu)
 }
 /*
+ * Because preemptable RCU does not exist, rcu_barrier() is just
+ * another name for rcu_barrier_sched().
+ */
+void rcu_barrier(void)
+{
+        rcu_barrier_sched();
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
+/*
 * Because preemptable RCU does not exist, there is no per-CPU
 * data to initialize.
 */
@@ -563,4 +598,18 @@ static void __cpuinit rcu_preempt_init_percpu_data(int cpu)
 {
 }
+/*
+ * Because there is no preemptable RCU, there are no callbacks to move.
+ */
+static void rcu_preempt_send_cbs_to_orphanage(void)
+{
+}
+/*
+ * Because preemptable RCU does not exist, it need not be initialized.
+ */
+static void __init __rcu_init_preempt(void)
+{
+}
 #endif /* #else #ifdef CONFIG_TREE_PREEMPT_RCU */
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index c89f5e9fd173..4b31c779e62e 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -93,7 +93,7 @@ static int rcudata_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcudata, NULL);
 }
-static struct file_operations rcudata_fops = {
+static const struct file_operations rcudata_fops = {
        .owner = THIS_MODULE,
        .open = rcudata_open,
        .read = seq_read,
@@ -145,7 +145,7 @@ static int rcudata_csv_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcudata_csv, NULL);
 }
-static struct file_operations rcudata_csv_fops = {
+static const struct file_operations rcudata_csv_fops = {
        .owner = THIS_MODULE,
        .open = rcudata_csv_open,
        .read = seq_read,
@@ -159,13 +159,13 @@ static void print_one_rcu_state(struct seq_file *m, struct rcu_state *rsp)
        struct rcu_node *rnp;
        seq_printf(m, "c=%ld g=%ld s=%d jfq=%ld j=%x "
-                      "nfqs=%lu/nfqsng=%lu(%lu) fqlh=%lu\n",
+                      "nfqs=%lu/nfqsng=%lu(%lu) fqlh=%lu oqlen=%ld\n",
                   rsp->completed, rsp->gpnum, rsp->signaled,
                   (long)(rsp->jiffies_force_qs - jiffies),
                   (int)(jiffies & 0xffff),
                   rsp->n_force_qs, rsp->n_force_qs_ngp,
                   rsp->n_force_qs - rsp->n_force_qs_ngp,
-                   rsp->n_force_qs_lh);
+                   rsp->n_force_qs_lh, rsp->orphan_qlen);
        for (rnp = &rsp->node[0]; rnp - &rsp->node[0] < NUM_RCU_NODES; rnp++) {
                if (rnp->level != level) {
                        seq_puts(m, "\n");
@@ -196,7 +196,7 @@ static int rcuhier_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcuhier, NULL);
 }
-static struct file_operations rcuhier_fops = {
+static const struct file_operations rcuhier_fops = {
        .owner = THIS_MODULE,
        .open = rcuhier_open,
        .read = seq_read,
@@ -222,7 +222,7 @@ static int rcugp_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcugp, NULL);
 }
-static struct file_operations rcugp_fops = {
+static const struct file_operations rcugp_fops = {
        .owner = THIS_MODULE,
        .open = rcugp_open,
        .read = seq_read,
@@ -276,7 +276,7 @@ static int rcu_pending_open(struct inode *inode, struct file *file)
        return single_open(file, show_rcu_pending, NULL);
 }
-static struct file_operations rcu_pending_fops = {
+static const struct file_operations rcu_pending_fops = {
        .owner = THIS_MODULE,
        .open = rcu_pending_open,
        .read = seq_read,
diff --git a/kernel/relay.c b/kernel/relay.c
index bc188549788f..760c26209a3c 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -60,7 +60,7 @@ static int relay_buf_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 /*
 * vm_ops for relay file mappings.
 */
-static struct vm_operations_struct relay_file_mmap_ops = {
+static const struct vm_operations_struct relay_file_mmap_ops = {
        .fault = relay_buf_fault,
        .close = relay_file_mmap_close,
 };
diff --git a/kernel/res_counter.c b/kernel/res_counter.c
index e1338f074314..bcdabf37c40b 100644
--- a/kernel/res_counter.c
+++ b/kernel/res_counter.c
@@ -19,6 +19,7 @@ void res_counter_init(struct res_counter *counter, struct res_counter *parent)
 {
        spin_lock_init(&counter->lock);
        counter->limit = RESOURCE_MAX;
+        counter->soft_limit = RESOURCE_MAX;
        counter->parent = parent;
 }
@@ -101,6 +102,8 @@ res_counter_member(struct res_counter *counter, int member)
                return &counter->limit;
        case RES_FAILCNT:
                return &counter->failcnt;
+        case RES_SOFT_LIMIT:
+                return &counter->soft_limit;
        };
        BUG();
diff --git a/kernel/resource.c b/kernel/resource.c
index 78b087221c15..fb11a58b9594 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -223,13 +223,13 @@ int release_resource(struct resource *old)
 EXPORT_SYMBOL(release_resource);
-#if defined(CONFIG_MEMORY_HOTPLUG) && !defined(CONFIG_ARCH_HAS_WALK_MEMORY)
+#if !defined(CONFIG_ARCH_HAS_WALK_MEMORY)
 /*
 * Finds the lowest memory reosurce exists within [res->start.res->end)
- * the caller must specify res->start, res->end, res->flags.
+ * the caller must specify res->start, res->end, res->flags and "name".
 * If found, returns 0, res is overwritten, if not found, returns -1.
 */
-static int find_next_system_ram(struct resource *res)
+static int find_next_system_ram(struct resource *res, char *name)
 {
        resource_size_t start, end;
        struct resource *p;
@@ -245,6 +245,8 @@ static int find_next_system_ram(struct resource *res)
                /* system ram is just marked as IORESOURCE_MEM */
                if (p->flags != res->flags)
                        continue;
+                if (name && strcmp(p->name, name))
+                        continue;
                if (p->start > end) {
                        p = NULL;
                        break;
@@ -262,19 +264,26 @@ static int find_next_system_ram(struct resource *res)
                res->end = p->end;
        return 0;
 }
-int
-walk_memory_resource(unsigned long start_pfn, unsigned long nr_pages, void *arg,
+/*
-                        int (*func)(unsigned long, unsigned long, void *))
+ * This function calls callback against all memory range of "System RAM"
+ * which are marked as IORESOURCE_MEM and IORESOUCE_BUSY.
+ * Now, this function is only for "System RAM".
+ */
+int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
+                void *arg, int (*func)(unsigned long, unsigned long, void *))
 {
        struct resource res;
        unsigned long pfn, len;
        u64 orig_end;
        int ret = -1;
        res.start = (u64) start_pfn << PAGE_SHIFT;
        res.end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1;
        res.flags = IORESOURCE_MEM | IORESOURCE_BUSY;
        orig_end = res.end;
-        while ((res.start < res.end) && (find_next_system_ram(&res) >= 0)) {
+        while ((res.start < res.end) &&
+                (find_next_system_ram(&res, "System RAM") >= 0)) {
                pfn = (unsigned long)(res.start >> PAGE_SHIFT);
                len = (unsigned long)((res.end + 1 - res.start) >> PAGE_SHIFT);
                ret = (*func)(pfn, len, arg);
diff --git a/kernel/sched.c b/kernel/sched.c
index 0ac9053c21d6..76c0e9691fc0 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -780,7 +780,7 @@ static int sched_feat_open(struct inode *inode, struct file *filp)
        return single_open(filp, sched_feat_show, NULL);
 }
-static struct file_operations sched_feat_fops = {
+static const struct file_operations sched_feat_fops = {
        .open           = sched_feat_open,
        .write          = sched_feat_write,
        .read           = seq_read,
@@ -2515,22 +2515,17 @@ void sched_fork(struct task_struct *p, int clone_flags)
        __sched_fork(p);
        /*
-         * Make sure we do not leak PI boosting priority to the child.
-         */
-        p->prio = current->normal_prio;
-        /*
         * Revert to default priority/policy on fork if requested.
         */
        if (unlikely(p->sched_reset_on_fork)) {
-                if (p->policy == SCHED_FIFO || p->policy == SCHED_RR)
+                if (p->policy == SCHED_FIFO || p->policy == SCHED_RR) {
                        p->policy = SCHED_NORMAL;
+                        p->normal_prio = p->static_prio;
-                if (p->normal_prio < DEFAULT_PRIO)
+                }
-                        p->prio = DEFAULT_PRIO;
                if (PRIO_TO_NICE(p->static_prio) < 0) {
                        p->static_prio = NICE_TO_PRIO(0);
+                        p->normal_prio = p->static_prio;
                        set_load_weight(p);
                }
@@ -2541,6 +2536,11 @@ void sched_fork(struct task_struct *p, int clone_flags)
                p->sched_reset_on_fork = 0;
        }
+        /*
+         * Make sure we do not leak PI boosting priority to the child.
+         */
+        p->prio = current->normal_prio;
        if (!rt_prio(p->prio))
                p->sched_class = &fair_sched_class;
@@ -2581,8 +2581,6 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags)
        BUG_ON(p->state != TASK_RUNNING);
        update_rq_clock(rq);
-        p->prio = effective_prio(p);
        if (!p->sched_class->task_new || !current->se.on_rq) {
                activate_task(rq, p, 0);
        } else {
@@ -5092,17 +5090,16 @@ void account_idle_time(cputime_t cputime)
 */
 void account_process_tick(struct task_struct *p, int user_tick)
 {
-        cputime_t one_jiffy = jiffies_to_cputime(1);
+        cputime_t one_jiffy_scaled = cputime_to_scaled(cputime_one_jiffy);
-        cputime_t one_jiffy_scaled = cputime_to_scaled(one_jiffy);
        struct rq *rq = this_rq();
        if (user_tick)
-                account_user_time(p, one_jiffy, one_jiffy_scaled);
+                account_user_time(p, cputime_one_jiffy, one_jiffy_scaled);
        else if ((p != rq->idle) || (irq_count() != HARDIRQ_OFFSET))
-                account_system_time(p, HARDIRQ_OFFSET, one_jiffy,
+                account_system_time(p, HARDIRQ_OFFSET, cputime_one_jiffy,
                                    one_jiffy_scaled);
        else
-                account_idle_time(one_jiffy);
+                account_idle_time(cputime_one_jiffy);
 }
 /*
@@ -10313,7 +10310,7 @@ static int sched_rt_global_constraints(void)
 #endif /* CONFIG_RT_GROUP_SCHED */
 int sched_rt_handler(struct ctl_table *table, int write,
-                struct file *filp, void __user *buffer, size_t *lenp,
+                void __user *buffer, size_t *lenp,
                loff_t *ppos)
 {
        int ret;
@@ -10324,7 +10321,7 @@ int sched_rt_handler(struct ctl_table *table, int write,
        old_period = sysctl_sched_rt_period;
        old_runtime = sysctl_sched_rt_runtime;
-        ret = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(table, write, buffer, lenp, ppos);
        if (!ret && write) {
                ret = sched_rt_global_constraints();
@@ -10378,8 +10375,7 @@ cpu_cgroup_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp)
 }
 static int
-cpu_cgroup_can_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
+cpu_cgroup_can_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
-                      struct task_struct *tsk)
 {
 #ifdef CONFIG_RT_GROUP_SCHED
        if (!sched_rt_can_attach(cgroup_tg(cgrp), tsk))
@@ -10389,15 +10385,45 @@ cpu_cgroup_can_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
        if (tsk->sched_class != &fair_sched_class)
                return -EINVAL;
 #endif
+        return 0;
+}
+static int
+cpu_cgroup_can_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
+                      struct task_struct *tsk, bool threadgroup)
+{
+        int retval = cpu_cgroup_can_attach_task(cgrp, tsk);
+        if (retval)
+                return retval;
+        if (threadgroup) {
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
+                        retval = cpu_cgroup_can_attach_task(cgrp, c);
+                        if (retval) {
+                                rcu_read_unlock();
+                                return retval;
+                        }
+                }
+                rcu_read_unlock();
+        }
        return 0;
 }
 static void
 cpu_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
-                        struct cgroup *old_cont, struct task_struct *tsk)
+                  struct cgroup *old_cont, struct task_struct *tsk,
+                  bool threadgroup)
 {
        sched_move_task(tsk);
+        if (threadgroup) {
+                struct task_struct *c;
+                rcu_read_lock();
+                list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
+                        sched_move_task(c);
+                }
+                rcu_read_unlock();
+        }
 }
 #ifdef CONFIG_FAIR_GROUP_SCHED
diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
index ac2e1dc708bd..479ce5682d7c 100644
--- a/kernel/sched_clock.c
+++ b/kernel/sched_clock.c
@@ -127,7 +127,7 @@ again:
        clock = wrap_max(clock, min_clock);
        clock = wrap_min(clock, max_clock);
-        if (cmpxchg(&scd->clock, old_clock, clock) != old_clock)
+        if (cmpxchg64(&scd->clock, old_clock, clock) != old_clock)
                goto again;
        return clock;
@@ -163,7 +163,7 @@ again:
                val = remote_clock;
        }
-        if (cmpxchg(ptr, old_val, val) != old_val)
+        if (cmpxchg64(ptr, old_val, val) != old_val)
                goto again;
        return val;
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index ecc637a0d591..4e777b47eeda 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -384,10 +384,10 @@ static struct sched_entity *__pick_last_entity(struct cfs_rq *cfs_rq)
 #ifdef CONFIG_SCHED_DEBUG
 int sched_nr_latency_handler(struct ctl_table *table, int write,
-                struct file *filp, void __user *buffer, size_t *lenp,
+                void __user *buffer, size_t *lenp,
                loff_t *ppos)
 {
-        int ret = proc_dointvec_minmax(table, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
        if (ret || !write)
                return ret;
diff --git a/kernel/signal.c b/kernel/signal.c
index 64c5deeaca5d..6705320784fd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -705,7 +705,7 @@ static int prepare_signal(int sig, struct task_struct *p, int from_ancestor_ns)
                if (why) {
                        /*
-                         * The first thread which returns from finish_stop()
+                         * The first thread which returns from do_signal_stop()
                         * will take ->siglock, notice SIGNAL_CLD_MASK, and
                         * notify its parent. See get_signal_to_deliver().
                         */
@@ -971,6 +971,20 @@ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
        return send_signal(sig, info, t, 0);
 }
+int do_send_sig_info(int sig, struct siginfo *info, struct task_struct *p,
+                        bool group)
+{
+        unsigned long flags;
+        int ret = -ESRCH;
+        if (lock_task_sighand(p, &flags)) {
+                ret = send_signal(sig, info, p, group);
+                unlock_task_sighand(p, &flags);
+        }
+        return ret;
+}
 /*
 * Force a signal that the process can't ignore: if necessary
 * we unblock the signal and change any SIG_IGN to SIG_DFL.
@@ -1036,12 +1050,6 @@ void zap_other_threads(struct task_struct *p)
        }
 }
-int __fatal_signal_pending(struct task_struct *tsk)
-{
-        return sigismember(&tsk->pending.signal, SIGKILL);
-}
-EXPORT_SYMBOL(__fatal_signal_pending);
 struct sighand_struct *lock_task_sighand(struct task_struct *tsk, unsigned long *flags)
 {
        struct sighand_struct *sighand;
@@ -1068,18 +1076,10 @@ struct sighand_struct *lock_task_sighand(struct task_struct *tsk, unsigned long
 */
 int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 {
-        unsigned long flags;
+        int ret = check_kill_permission(sig, info, p);
-        int ret;
-        ret = check_kill_permission(sig, info, p);
+        if (!ret && sig)
+                ret = do_send_sig_info(sig, info, p, true);
-        if (!ret && sig) {
-                ret = -ESRCH;
-                if (lock_task_sighand(p, &flags)) {
-                        ret = __group_send_sig_info(sig, info, p);
-                        unlock_task_sighand(p, &flags);
-                }
-        }
        return ret;
 }
@@ -1224,15 +1224,9 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t pid)
 * These are for backward compatibility with the rest of the kernel source.
 */
-/*
- * The caller must ensure the task can't exit.
- */
 int
 send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 {
-        int ret;
-        unsigned long flags;
        /*
         * Make sure legacy kernel users don't send in bad values
         * (normal paths check this in check_kill_permission).
@@ -1240,10 +1234,7 @@ send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
        if (!valid_signal(sig))
                return -EINVAL;
-        spin_lock_irqsave(&p->sighand->siglock, flags);
+        return do_send_sig_info(sig, info, p, false);
-        ret = specific_send_sig_info(sig, info, p);
-        spin_unlock_irqrestore(&p->sighand->siglock, flags);
-        return ret;
 }
 #define __si_special(priv) \
@@ -1383,15 +1374,6 @@ ret:
 }
 /*
- * Wake up any threads in the parent blocked in wait* syscalls.
- */
-static inline void __wake_up_parent(struct task_struct *p,
-                                    struct task_struct *parent)
-{
-        wake_up_interruptible_sync(&parent->signal->wait_chldexit);
-}
-/*
 * Let a parent know about the death of a child.
 * For a stopped/continued status change, use do_notify_parent_cldstop instead.
 *
@@ -1673,29 +1655,6 @@ void ptrace_notify(int exit_code)
        spin_unlock_irq(&current->sighand->siglock);
 }
-static void
-finish_stop(int stop_count)
-{
-        /*
-         * If there are no other threads in the group, or if there is
-         * a group stop in progress and we are the last to stop,
-         * report to the parent.  When ptraced, every thread reports itself.
-         */
-        if (tracehook_notify_jctl(stop_count == 0, CLD_STOPPED)) {
-                read_lock(&tasklist_lock);
-                do_notify_parent_cldstop(current, CLD_STOPPED);
-                read_unlock(&tasklist_lock);
-        }
-        do {
-                schedule();
-        } while (try_to_freeze());
-        /*
-         * Now we don't run again until continued.
-         */
-        current->exit_code = 0;
-}
 /*
 * This performs the stopping for SIGSTOP and other stop signals.
 * We have to stop all threads in the thread group.
@@ -1705,15 +1664,9 @@ finish_stop(int stop_count)
 static int do_signal_stop(int signr)
 {
        struct signal_struct *sig = current->signal;
-        int stop_count;
+        int notify;
-        if (sig->group_stop_count > 0) {
+        if (!sig->group_stop_count) {
-                /*
-                 * There is a group stop in progress.  We don't need to
-                 * start another one.
-                 */
-                stop_count = --sig->group_stop_count;
-        } else {
                struct task_struct *t;
                if (!likely(sig->flags & SIGNAL_STOP_DEQUEUED) ||
@@ -1725,7 +1678,7 @@ static int do_signal_stop(int signr)
                 */
                sig->group_exit_code = signr;
-                stop_count = 0;
+                sig->group_stop_count = 1;
                for (t = next_thread(current); t != current; t = next_thread(t))
                        /*
                         * Setting state to TASK_STOPPED for a group
@@ -1734,19 +1687,44 @@ static int do_signal_stop(int signr)
                         */
                        if (!(t->flags & PF_EXITING) &&
                            !task_is_stopped_or_traced(t)) {
-                                stop_count++;
+                                sig->group_stop_count++;
                                signal_wake_up(t, 0);
                        }
-                sig->group_stop_count = stop_count;
        }
+        /*
+         * If there are no other threads in the group, or if there is
+         * a group stop in progress and we are the last to stop, report
+         * to the parent.  When ptraced, every thread reports itself.
+         */
+        notify = sig->group_stop_count == 1 ? CLD_STOPPED : 0;
+        notify = tracehook_notify_jctl(notify, CLD_STOPPED);
+        /*
+         * tracehook_notify_jctl() can drop and reacquire siglock, so
+         * we keep ->group_stop_count != 0 before the call. If SIGCONT
+         * or SIGKILL comes in between ->group_stop_count == 0.
+         */
+        if (sig->group_stop_count) {
+                if (!--sig->group_stop_count)
+                        sig->flags = SIGNAL_STOP_STOPPED;
+                current->exit_code = sig->group_exit_code;
+                __set_current_state(TASK_STOPPED);
+        }
+        spin_unlock_irq(&current->sighand->siglock);
-        if (stop_count == 0)
+        if (notify) {
-                sig->flags = SIGNAL_STOP_STOPPED;
+                read_lock(&tasklist_lock);
-        current->exit_code = sig->group_exit_code;
+                do_notify_parent_cldstop(current, notify);
-        __set_current_state(TASK_STOPPED);
+                read_unlock(&tasklist_lock);
+        }
+        /* Now we don't run again until woken by SIGCONT or SIGKILL */
+        do {
+                schedule();
+        } while (try_to_freeze());
+        tracehook_finish_jctl();
+        current->exit_code = 0;
-        spin_unlock_irq(&current->sighand->siglock);
-        finish_stop(stop_count);
        return 1;
 }
@@ -1815,14 +1793,15 @@ relock:
                int why = (signal->flags & SIGNAL_STOP_CONTINUED)
                                ? CLD_CONTINUED : CLD_STOPPED;
                signal->flags &= ~SIGNAL_CLD_MASK;
-                spin_unlock_irq(&sighand->siglock);
-                if (unlikely(!tracehook_notify_jctl(1, why)))
+                why = tracehook_notify_jctl(why, CLD_CONTINUED);
-                        goto relock;
+                spin_unlock_irq(&sighand->siglock);
-                read_lock(&tasklist_lock);
+                if (why) {
-                do_notify_parent_cldstop(current->group_leader, why);
+                        read_lock(&tasklist_lock);
-                read_unlock(&tasklist_lock);
+                        do_notify_parent_cldstop(current->group_leader, why);
+                        read_unlock(&tasklist_lock);
+                }
                goto relock;
        }
@@ -1987,14 +1966,14 @@ void exit_signals(struct task_struct *tsk)
        if (unlikely(tsk->signal->group_stop_count) &&
                        !--tsk->signal->group_stop_count) {
                tsk->signal->flags = SIGNAL_STOP_STOPPED;
-                group_stop = 1;
+                group_stop = tracehook_notify_jctl(CLD_STOPPED, CLD_STOPPED);
        }
 out:
        spin_unlock_irq(&tsk->sighand->siglock);
-        if (unlikely(group_stop) && tracehook_notify_jctl(1, CLD_STOPPED)) {
+        if (unlikely(group_stop)) {
                read_lock(&tasklist_lock);
-                do_notify_parent_cldstop(tsk, CLD_STOPPED);
+                do_notify_parent_cldstop(tsk, group_stop);
                read_unlock(&tasklist_lock);
        }
 }
@@ -2290,7 +2269,6 @@ static int
 do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
 {
        struct task_struct *p;
-        unsigned long flags;
        int error = -ESRCH;
        rcu_read_lock();
@@ -2300,14 +2278,16 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
                /*
                 * The null signal is a permissions and process existence
                 * probe.  No signal is actually delivered.
-                 *
-                 * If lock_task_sighand() fails we pretend the task dies
-                 * after receiving the signal. The window is tiny, and the
-                 * signal is private anyway.
                 */
-                if (!error && sig && lock_task_sighand(p, &flags)) {
+                if (!error && sig) {
-                        error = specific_send_sig_info(sig, info, p);
+                        error = do_send_sig_info(sig, info, p, false);
-                        unlock_task_sighand(p, &flags);
+                        /*
+                         * If lock_task_sighand() failed we pretend the task
+                         * dies after receiving the signal. The window is tiny,
+                         * and the signal is private anyway.
+                         */
+                        if (unlikely(error == -ESRCH))
+                                error = 0;
                }
        }
        rcu_read_unlock();
diff --git a/kernel/slow-work.c b/kernel/slow-work.c
index 09d7519557d3..0d31135efbf4 100644
--- a/kernel/slow-work.c
+++ b/kernel/slow-work.c
@@ -26,10 +26,10 @@ static void slow_work_cull_timeout(unsigned long);
 static void slow_work_oom_timeout(unsigned long);
 #ifdef CONFIG_SYSCTL
-static int slow_work_min_threads_sysctl(struct ctl_table *, int, struct file *,
+static int slow_work_min_threads_sysctl(struct ctl_table *, int,
                                        void __user *, size_t *, loff_t *);
-static int slow_work_max_threads_sysctl(struct ctl_table *, int , struct file *,
+static int slow_work_max_threads_sysctl(struct ctl_table *, int ,
                                        void __user *, size_t *, loff_t *);
 #endif
@@ -493,10 +493,10 @@ static void slow_work_oom_timeout(unsigned long data)
 * Handle adjustment of the minimum number of threads
 */
 static int slow_work_min_threads_sysctl(struct ctl_table *table, int write,
-                                        struct file *filp, void __user *buffer,
+                                        void __user *buffer,
                                        size_t *lenp, loff_t *ppos)
 {
-        int ret = proc_dointvec_minmax(table, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
        int n;
        if (ret == 0) {
@@ -521,10 +521,10 @@ static int slow_work_min_threads_sysctl(struct ctl_table *table, int write,
 * Handle adjustment of the maximum number of threads
 */
 static int slow_work_max_threads_sysctl(struct ctl_table *table, int write,
-                                        struct file *filp, void __user *buffer,
+                                        void __user *buffer,
                                        size_t *lenp, loff_t *ppos)
 {
-        int ret = proc_dointvec_minmax(table, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
        int n;
        if (ret == 0) {
diff --git a/kernel/smp.c b/kernel/smp.c
index 8e218500ab14..c9d1c7835c2f 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -29,8 +29,7 @@ enum {
 struct call_function_data {
        struct call_single_data csd;
-        spinlock_t              lock;
+        atomic_t                refs;
-        unsigned int            refs;
        cpumask_var_t           cpumask;
 };
@@ -39,9 +38,7 @@ struct call_single_queue {
        spinlock_t              lock;
 };
-static DEFINE_PER_CPU(struct call_function_data, cfd_data) = {
+static DEFINE_PER_CPU(struct call_function_data, cfd_data);
-        .lock                   = __SPIN_LOCK_UNLOCKED(cfd_data.lock),
-};
 static int
 hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
@@ -196,25 +193,18 @@ void generic_smp_call_function_interrupt(void)
        list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
                int refs;
-                spin_lock(&data->lock);
+                if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
-                if (!cpumask_test_cpu(cpu, data->cpumask)) {
-                        spin_unlock(&data->lock);
                        continue;
-                }
-                cpumask_clear_cpu(cpu, data->cpumask);
-                spin_unlock(&data->lock);
                data->csd.func(data->csd.info);
-                spin_lock(&data->lock);
+                refs = atomic_dec_return(&data->refs);
-                WARN_ON(data->refs == 0);
+                WARN_ON(refs < 0);
-                refs = --data->refs;
                if (!refs) {
                        spin_lock(&call_function.lock);
                        list_del_rcu(&data->csd.list);
                        spin_unlock(&call_function.lock);
                }
-                spin_unlock(&data->lock);
                if (refs)
                        continue;
@@ -357,13 +347,6 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
        generic_exec_single(cpu, data, wait);
 }
-/* Deprecated: shim for archs using old arch_send_call_function_ipi API. */
-#ifndef arch_send_call_function_ipi_mask
-# define arch_send_call_function_ipi_mask(maskp) \
-         arch_send_call_function_ipi(*(maskp))
-#endif
 /**
 * smp_call_function_many(): Run a function on a set of other CPUs.
 * @mask: The set of cpus to run on (only runs on online subset).
@@ -419,23 +402,20 @@ void smp_call_function_many(const struct cpumask *mask,
        data = &__get_cpu_var(cfd_data);
        csd_lock(&data->csd);
-        spin_lock_irqsave(&data->lock, flags);
        data->csd.func = func;
        data->csd.info = info;
        cpumask_and(data->cpumask, mask, cpu_online_mask);
        cpumask_clear_cpu(this_cpu, data->cpumask);
-        data->refs = cpumask_weight(data->cpumask);
+        atomic_set(&data->refs, cpumask_weight(data->cpumask));
-        spin_lock(&call_function.lock);
+        spin_lock_irqsave(&call_function.lock, flags);
        /*
         * Place entry at the _HEAD_ of the list, so that any cpu still
         * observing the entry in generic_smp_call_function_interrupt()
         * will not miss any other list entries:
         */
        list_add_rcu(&data->csd.list, &call_function.queue);
-        spin_unlock(&call_function.lock);
+        spin_unlock_irqrestore(&call_function.lock, flags);
-        spin_unlock_irqrestore(&data->lock, flags);
        /*
         * Make the list addition visible before sending the ipi.
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 88796c330838..81324d12eb35 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -90,11 +90,11 @@ void touch_all_softlockup_watchdogs(void)
 EXPORT_SYMBOL(touch_all_softlockup_watchdogs);
 int proc_dosoftlockup_thresh(struct ctl_table *table, int write,
-                             struct file *filp, void __user *buffer,
+                             void __user *buffer,
                             size_t *lenp, loff_t *ppos)
 {
        touch_all_softlockup_watchdogs();
-        return proc_dointvec_minmax(table, write, filp, buffer, lenp, ppos);
+        return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 }
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index ea5c3bcac881..255475d163e0 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1338,6 +1338,7 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
        unsigned long flags;
        cputime_t utime, stime;
        struct task_cputime cputime;
+        unsigned long maxrss = 0;
        memset((char *) r, 0, sizeof *r);
        utime = stime = cputime_zero;
@@ -1346,6 +1347,7 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
                utime = task_utime(current);
                stime = task_stime(current);
                accumulate_thread_rusage(p, r);
+                maxrss = p->signal->maxrss;
                goto out;
        }
@@ -1363,6 +1365,7 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
                        r->ru_majflt = p->signal->cmaj_flt;
                        r->ru_inblock = p->signal->cinblock;
                        r->ru_oublock = p->signal->coublock;
+                        maxrss = p->signal->cmaxrss;
                        if (who == RUSAGE_CHILDREN)
                                break;
@@ -1377,6 +1380,8 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
                        r->ru_majflt += p->signal->maj_flt;
                        r->ru_inblock += p->signal->inblock;
                        r->ru_oublock += p->signal->oublock;
+                        if (maxrss < p->signal->maxrss)
+                                maxrss = p->signal->maxrss;
                        t = p;
                        do {
                                accumulate_thread_rusage(t, r);
@@ -1392,6 +1397,15 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
 out:
        cputime_to_timeval(utime, &r->ru_utime);
        cputime_to_timeval(stime, &r->ru_stime);
+        if (who != RUSAGE_CHILDREN) {
+                struct mm_struct *mm = get_task_mm(p);
+                if (mm) {
+                        setmax_mm_hiwater_rss(&maxrss, mm);
+                        mmput(mm);
+                }
+        }
+        r->ru_maxrss = maxrss * (PAGE_SIZE / 1024); /* convert pages to KBs */
 }
 int getrusage(struct task_struct *p, int who, struct rusage __user *ru)
@@ -1528,6 +1542,28 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                current->timer_slack_ns = arg2;
                        error = 0;
                        break;
+                case PR_MCE_KILL:
+                        if (arg4 | arg5)
+                                return -EINVAL;
+                        switch (arg2) {
+                        case 0:
+                                if (arg3 != 0)
+                                        return -EINVAL;
+                                current->flags &= ~PF_MCE_PROCESS;
+                                break;
+                        case 1:
+                                current->flags |= PF_MCE_PROCESS;
+                                if (arg3 != 0)
+                                        current->flags |= PF_MCE_EARLY;
+                                else
+                                        current->flags &= ~PF_MCE_EARLY;
+                                break;
+                        default:
+                                return -EINVAL;
+                        }
+                        error = 0;
+                        break;
                default:
                        error = -EINVAL;
                        break;
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 515bc230ac2a..e06d0b8d1951 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -49,6 +49,7 @@ cond_syscall(sys_sendmsg);
 cond_syscall(compat_sys_sendmsg);
 cond_syscall(sys_recvmsg);
 cond_syscall(compat_sys_recvmsg);
+cond_syscall(compat_sys_recvfrom);
 cond_syscall(sys_socketcall);
 cond_syscall(sys_futex);
 cond_syscall(compat_sys_futex);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 6ba49c7cb128..0d949c517412 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -26,7 +26,6 @@
 #include <linux/proc_fs.h>
 #include <linux/security.h>
 #include <linux/ctype.h>
-#include <linux/utsname.h>
 #include <linux/kmemcheck.h>
 #include <linux/smp_lock.h>
 #include <linux/fs.h>
@@ -77,6 +76,7 @@ extern int max_threads;
 extern int core_uses_pid;
 extern int suid_dumpable;
 extern char core_pattern[];
+extern unsigned int core_pipe_limit;
 extern int pid_max;
 extern int min_free_kbytes;
 extern int pid_max_min, pid_max_max;
@@ -106,6 +106,9 @@ static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static unsigned long one_ul = 1;
 static int one_hundred = 100;
+#ifdef CONFIG_PRINTK
+static int ten_thousand = 10000;
+#endif
 /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
 static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
@@ -160,9 +163,9 @@ extern int max_lock_depth;
 #endif
 #ifdef CONFIG_PROC_SYSCTL
-static int proc_do_cad_pid(struct ctl_table *table, int write, struct file *filp,
+static int proc_do_cad_pid(struct ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos);
-static int proc_taint(struct ctl_table *table, int write, struct file *filp,
+static int proc_taint(struct ctl_table *table, int write,
                               void __user *buffer, size_t *lenp, loff_t *ppos);
 #endif
@@ -421,6 +424,14 @@ static struct ctl_table kern_table[] = {
                .proc_handler   = &proc_dostring,
                .strategy       = &sysctl_string,
        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "core_pipe_limit",
+                .data           = &core_pipe_limit,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
 #ifdef CONFIG_PROC_SYSCTL
        {
                .procname       = "tainted",
@@ -722,6 +733,17 @@ static struct ctl_table kern_table[] = {
                .mode           = 0644,
                .proc_handler   = &proc_dointvec,
        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "printk_delay",
+                .data           = &printk_delay_msec,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+                .extra2         = &ten_thousand,
+        },
 #endif
        {
                .ctl_name       = KERN_NGROUPS_MAX,
@@ -1376,6 +1398,31 @@ static struct ctl_table vm_table[] = {
                .mode           = 0644,
                .proc_handler   = &scan_unevictable_handler,
        },
+#ifdef CONFIG_MEMORY_FAILURE
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "memory_failure_early_kill",
+                .data           = &sysctl_memory_failure_early_kill,
+                .maxlen         = sizeof(sysctl_memory_failure_early_kill),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "memory_failure_recovery",
+                .data           = &sysctl_memory_failure_recovery,
+                .maxlen         = sizeof(sysctl_memory_failure_recovery),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+#endif
 /*
 * NOTE: do not add new entries to this table unless you have read
 * Documentation/sysctl/ctl_unnumbered.txt
@@ -2204,7 +2251,7 @@ void sysctl_head_put(struct ctl_table_header *head)
 #ifdef CONFIG_PROC_SYSCTL
 static int _proc_do_string(void* data, int maxlen, int write,
-                           struct file *filp, void __user *buffer,
+                           void __user *buffer,
                           size_t *lenp, loff_t *ppos)
 {
        size_t len;
@@ -2265,7 +2312,6 @@ static int _proc_do_string(void* data, int maxlen, int write,
 * proc_dostring - read a string sysctl
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2279,10 +2325,10 @@ static int _proc_do_string(void* data, int maxlen, int write,
 *
 * Returns 0 on success.
 */
-int proc_dostring(struct ctl_table *table, int write, struct file *filp,
+int proc_dostring(struct ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        return _proc_do_string(table->data, table->maxlen, write, filp,
+        return _proc_do_string(table->data, table->maxlen, write,
                               buffer, lenp, ppos);
 }
@@ -2307,7 +2353,7 @@ static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
 }
 static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
-                  int write, struct file *filp, void __user *buffer,
+                  int write, void __user *buffer,
                  size_t *lenp, loff_t *ppos,
                  int (*conv)(int *negp, unsigned long *lvalp, int *valp,
                              int write, void *data),
@@ -2414,13 +2460,13 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
 #undef TMPBUFLEN
 }
-static int do_proc_dointvec(struct ctl_table *table, int write, struct file *filp,
+static int do_proc_dointvec(struct ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos,
                  int (*conv)(int *negp, unsigned long *lvalp, int *valp,
                              int write, void *data),
                  void *data)
 {
-        return __do_proc_dointvec(table->data, table, write, filp,
+        return __do_proc_dointvec(table->data, table, write,
                        buffer, lenp, ppos, conv, data);
 }
@@ -2428,7 +2474,6 @@ static int do_proc_dointvec(struct ctl_table *table, int write, struct file *fil
 * proc_dointvec - read a vector of integers
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2438,10 +2483,10 @@ static int do_proc_dointvec(struct ctl_table *table, int write, struct file *fil
 *
 * Returns 0 on success.
 */
-int proc_dointvec(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec(struct ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,filp,buffer,lenp,ppos,
+    return do_proc_dointvec(table,write,buffer,lenp,ppos,
                            NULL,NULL);
 }
@@ -2449,7 +2494,7 @@ int proc_dointvec(struct ctl_table *table, int write, struct file *filp,
 * Taint values can only be increased
 * This means we can safely use a temporary.
 */
-static int proc_taint(struct ctl_table *table, int write, struct file *filp,
+static int proc_taint(struct ctl_table *table, int write,
                               void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct ctl_table t;
@@ -2461,7 +2506,7 @@ static int proc_taint(struct ctl_table *table, int write, struct file *filp,
        t = *table;
        t.data = &tmptaint;
-        err = proc_doulongvec_minmax(&t, write, filp, buffer, lenp, ppos);
+        err = proc_doulongvec_minmax(&t, write, buffer, lenp, ppos);
        if (err < 0)
                return err;
@@ -2513,7 +2558,6 @@ static int do_proc_dointvec_minmax_conv(int *negp, unsigned long *lvalp,
 * proc_dointvec_minmax - read a vector of integers with min/max values
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2526,19 +2570,18 @@ static int do_proc_dointvec_minmax_conv(int *negp, unsigned long *lvalp,
 *
 * Returns 0 on success.
 */
-int proc_dointvec_minmax(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_minmax(struct ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct do_proc_dointvec_minmax_conv_param param = {
                .min = (int *) table->extra1,
                .max = (int *) table->extra2,
        };
-        return do_proc_dointvec(table, write, filp, buffer, lenp, ppos,
+        return do_proc_dointvec(table, write, buffer, lenp, ppos,
                                do_proc_dointvec_minmax_conv, &param);
 }
 static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int write,
-                                     struct file *filp,
                                     void __user *buffer,
                                     size_t *lenp, loff_t *ppos,
                                     unsigned long convmul,
@@ -2643,21 +2686,19 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
 }
 static int do_proc_doulongvec_minmax(struct ctl_table *table, int write,
-                                     struct file *filp,
                                     void __user *buffer,
                                     size_t *lenp, loff_t *ppos,
                                     unsigned long convmul,
                                     unsigned long convdiv)
 {
        return __do_proc_doulongvec_minmax(table->data, table, write,
-                        filp, buffer, lenp, ppos, convmul, convdiv);
+                        buffer, lenp, ppos, convmul, convdiv);
 }
 /**
 * proc_doulongvec_minmax - read a vector of long integers with min/max values
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2670,17 +2711,16 @@ static int do_proc_doulongvec_minmax(struct ctl_table *table, int write,
 *
 * Returns 0 on success.
 */
-int proc_doulongvec_minmax(struct ctl_table *table, int write, struct file *filp,
+int proc_doulongvec_minmax(struct ctl_table *table, int write,
                           void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos, 1l, 1l);
+    return do_proc_doulongvec_minmax(table, write, buffer, lenp, ppos, 1l, 1l);
 }
 /**
 * proc_doulongvec_ms_jiffies_minmax - read a vector of millisecond values with min/max values
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2695,11 +2735,10 @@ int proc_doulongvec_minmax(struct ctl_table *table, int write, struct file *filp
 * Returns 0 on success.
 */
 int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
-                                      struct file *filp,
                                      void __user *buffer,
                                      size_t *lenp, loff_t *ppos)
 {
-    return do_proc_doulongvec_minmax(table, write, filp, buffer,
+    return do_proc_doulongvec_minmax(table, write, buffer,
                                     lenp, ppos, HZ, 1000l);
 }
@@ -2775,7 +2814,6 @@ static int do_proc_dointvec_ms_jiffies_conv(int *negp, unsigned long *lvalp,
 * proc_dointvec_jiffies - read a vector of integers as seconds
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2787,10 +2825,10 @@ static int do_proc_dointvec_ms_jiffies_conv(int *negp, unsigned long *lvalp,
 *
 * Returns 0 on success.
 */
-int proc_dointvec_jiffies(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_jiffies(struct ctl_table *table, int write,
                          void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,filp,buffer,lenp,ppos,
+    return do_proc_dointvec(table,write,buffer,lenp,ppos,
                            do_proc_dointvec_jiffies_conv,NULL);
 }
@@ -2798,7 +2836,6 @@ int proc_dointvec_jiffies(struct ctl_table *table, int write, struct file *filp,
 * proc_dointvec_userhz_jiffies - read a vector of integers as 1/USER_HZ seconds
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: pointer to the file position
@@ -2810,10 +2847,10 @@ int proc_dointvec_jiffies(struct ctl_table *table, int write, struct file *filp,
 *
 * Returns 0 on success.
 */
-int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,filp,buffer,lenp,ppos,
+    return do_proc_dointvec(table,write,buffer,lenp,ppos,
                            do_proc_dointvec_userhz_jiffies_conv,NULL);
 }
@@ -2821,7 +2858,6 @@ int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write, struct file
 * proc_dointvec_ms_jiffies - read a vector of integers as 1 milliseconds
 * @table: the sysctl table
 * @write: %TRUE if this is a write to the sysctl file
- * @filp: the file structure
 * @buffer: the user buffer
 * @lenp: the size of the user buffer
 * @ppos: file position
@@ -2834,14 +2870,14 @@ int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write, struct file
 *
 * Returns 0 on success.
 */
-int proc_dointvec_ms_jiffies(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_ms_jiffies(struct ctl_table *table, int write,
                             void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        return do_proc_dointvec(table, write, filp, buffer, lenp, ppos,
+        return do_proc_dointvec(table, write, buffer, lenp, ppos,
                                do_proc_dointvec_ms_jiffies_conv, NULL);
 }
-static int proc_do_cad_pid(struct ctl_table *table, int write, struct file *filp,
+static int proc_do_cad_pid(struct ctl_table *table, int write,
                           void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct pid *new_pid;
@@ -2850,7 +2886,7 @@ static int proc_do_cad_pid(struct ctl_table *table, int write, struct file *filp
        tmp = pid_vnr(cad_pid);
-        r = __do_proc_dointvec(&tmp, table, write, filp, buffer,
+        r = __do_proc_dointvec(&tmp, table, write, buffer,
                               lenp, ppos, NULL, NULL);
        if (r || !write)
                return r;
@@ -2865,50 +2901,49 @@ static int proc_do_cad_pid(struct ctl_table *table, int write, struct file *filp
 #else /* CONFIG_PROC_FS */
-int proc_dostring(struct ctl_table *table, int write, struct file *filp,
+int proc_dostring(struct ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
-int proc_dointvec(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec(struct ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
-int proc_dointvec_minmax(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_minmax(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
-int proc_dointvec_jiffies(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_jiffies(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
-int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
-int proc_dointvec_ms_jiffies(struct ctl_table *table, int write, struct file *filp,
+int proc_dointvec_ms_jiffies(struct ctl_table *table, int write,
                             void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
-int proc_doulongvec_minmax(struct ctl_table *table, int write, struct file *filp,
+int proc_doulongvec_minmax(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
 }
 int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
-                                      struct file *filp,
                                      void __user *buffer,
                                      size_t *lenp, loff_t *ppos)
 {
diff --git a/kernel/time/Makefile b/kernel/time/Makefile
index 0b0a6366c9d4..ee266620b06c 100644
--- a/kernel/time/Makefile
+++ b/kernel/time/Makefile
@@ -1,4 +1,4 @@
-obj-y += timekeeping.o ntp.o clocksource.o jiffies.o timer_list.o timecompare.o
+obj-y += timekeeping.o ntp.o clocksource.o jiffies.o timer_list.o timecompare.o timeconv.o
 obj-$(CONFIG_GENERIC_CLOCKEVENTS_BUILD)         += clockevents.o
 obj-$(CONFIG_GENERIC_CLOCKEVENTS)               += tick-common.o
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 09113347d328..5e18c6ab2c6a 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -394,15 +394,11 @@ void clocksource_resume(void)
 {
        struct clocksource *cs;
-        mutex_lock(&clocksource_mutex);
        list_for_each_entry(cs, &clocksource_list, list)
                if (cs->resume)
                        cs->resume();
        clocksource_resume_watchdog();
-        mutex_unlock(&clocksource_mutex);
 }
 /**
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index e0f59a21c061..89aed5933ed4 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -231,6 +231,13 @@ void tick_nohz_stop_sched_tick(int inidle)
        if (!inidle && !ts->inidle)
                goto end;
+        /*
+         * Set ts->inidle unconditionally. Even if the system did not
+         * switch to NOHZ mode the cpu frequency governers rely on the
+         * update of the idle time accounting in tick_nohz_start_idle().
+         */
+        ts->inidle = 1;
        now = tick_nohz_start_idle(ts);
        /*
@@ -248,8 +255,6 @@ void tick_nohz_stop_sched_tick(int inidle)
        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
                goto end;
-        ts->inidle = 1;
        if (need_resched())
                goto end;
diff --git a/kernel/time/timeconv.c b/kernel/time/timeconv.c
new file mode 100644
index 000000000000..86628e755f38
--- /dev/null
+++ b/kernel/time/timeconv.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 1993, 1994, 1995, 1996, 1997 Free Software Foundation, Inc.
+ * This file is part of the GNU C Library.
+ * Contributed by Paul Eggert (eggert@twinsun.com).
+ *
+ * The GNU C Library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * The GNU C Library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with the GNU C Library; see the file COPYING.LIB.  If not,
+ * write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+/*
+ * Converts the calendar time to broken-down time representation
+ * Based on code from glibc-2.6
+ *
+ * 2009-7-14:
+ *   Moved from glibc-2.6 to kernel by Zhaolei<zhaolei@cn.fujitsu.com>
+ */
+#include <linux/time.h>
+#include <linux/module.h>
+/*
+ * Nonzero if YEAR is a leap year (every 4 years,
+ * except every 100th isn't, and every 400th is).
+ */
+static int __isleap(long year)
+{
+        return (year) % 4 == 0 && ((year) % 100 != 0 || (year) % 400 == 0);
+}
+/* do a mathdiv for long type */
+static long math_div(long a, long b)
+{
+        return a / b - (a % b < 0);
+}
+/* How many leap years between y1 and y2, y1 must less or equal to y2 */
+static long leaps_between(long y1, long y2)
+{
+        long leaps1 = math_div(y1 - 1, 4) - math_div(y1 - 1, 100)
+                + math_div(y1 - 1, 400);
+        long leaps2 = math_div(y2 - 1, 4) - math_div(y2 - 1, 100)
+                + math_div(y2 - 1, 400);
+        return leaps2 - leaps1;
+}
+/* How many days come before each month (0-12). */
+static const unsigned short __mon_yday[2][13] = {
+        /* Normal years. */
+        {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334, 365},
+        /* Leap years. */
+        {0, 31, 60, 91, 121, 152, 182, 213, 244, 274, 305, 335, 366}
+};
+#define SECS_PER_HOUR   (60 * 60)
+#define SECS_PER_DAY    (SECS_PER_HOUR * 24)
+/**
+ * time_to_tm - converts the calendar time to local broken-down time
+ *
+ * @totalsecs   the number of seconds elapsed since 00:00:00 on January 1, 1970,
+ *              Coordinated Universal Time (UTC).
+ * @offset      offset seconds adding to totalsecs.
+ * @result      pointer to struct tm variable to receive broken-down time
+ */
+void time_to_tm(time_t totalsecs, int offset, struct tm *result)
+{
+        long days, rem, y;
+        const unsigned short *ip;
+        days = totalsecs / SECS_PER_DAY;
+        rem = totalsecs % SECS_PER_DAY;
+        rem += offset;
+        while (rem < 0) {
+                rem += SECS_PER_DAY;
+                --days;
+        }
+        while (rem >= SECS_PER_DAY) {
+                rem -= SECS_PER_DAY;
+                ++days;
+        }
+        result->tm_hour = rem / SECS_PER_HOUR;
+        rem %= SECS_PER_HOUR;
+        result->tm_min = rem / 60;
+        result->tm_sec = rem % 60;
+        /* January 1, 1970 was a Thursday. */
+        result->tm_wday = (4 + days) % 7;
+        if (result->tm_wday < 0)
+                result->tm_wday += 7;
+        y = 1970;
+        while (days < 0 || days >= (__isleap(y) ? 366 : 365)) {
+                /* Guess a corrected year, assuming 365 days per year. */
+                long yg = y + math_div(days, 365);
+                /* Adjust DAYS and Y to match the guessed year. */
+                days -= (yg - y) * 365 + leaps_between(y, yg);
+                y = yg;
+        }
+        result->tm_year = y - 1900;
+        result->tm_yday = days;
+        ip = __mon_yday[__isleap(y)];
+        for (y = 11; days < ip[y]; y--)
+                continue;
+        days -= ip[y];
+        result->tm_mon = y;
+        result->tm_mday = days + 1;
+}
+EXPORT_SYMBOL(time_to_tm);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index fb0f46fa1ecd..c3a4e2907eaa 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -13,6 +13,7 @@
 #include <linux/percpu.h>
 #include <linux/init.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <linux/sysdev.h>
 #include <linux/clocksource.h>
 #include <linux/jiffies.h>
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index fddd69d16e03..1b5b7aa2fdfd 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -275,7 +275,7 @@ static int timer_list_open(struct inode *inode, struct file *filp)
        return single_open(filp, timer_list_show, NULL);
 }
-static struct file_operations timer_list_fops = {
+static const struct file_operations timer_list_fops = {
        .open           = timer_list_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
index 4cde8b9c716f..ee5681f8d7ec 100644
--- a/kernel/time/timer_stats.c
+++ b/kernel/time/timer_stats.c
@@ -395,7 +395,7 @@ static int tstats_open(struct inode *inode, struct file *filp)
        return single_open(filp, tstats_show, NULL);
 }
-static struct file_operations tstats_fops = {
+static const struct file_operations tstats_fops = {
        .open           = tstats_open,
        .read           = seq_read,
        .write          = tstats_write,
diff --git a/kernel/timer.c b/kernel/timer.c
index 811e5c391456..5db5a8d26811 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -46,6 +46,9 @@
 #include <asm/timex.h>
 #include <asm/io.h>
+#define CREATE_TRACE_POINTS
+#include <trace/events/timer.h>
 u64 jiffies_64 __cacheline_aligned_in_smp = INITIAL_JIFFIES;
 EXPORT_SYMBOL(jiffies_64);
@@ -521,6 +524,25 @@ static inline void debug_timer_activate(struct timer_list *timer) { }
 static inline void debug_timer_deactivate(struct timer_list *timer) { }
 #endif
+static inline void debug_init(struct timer_list *timer)
+{
+        debug_timer_init(timer);
+        trace_timer_init(timer);
+}
+static inline void
+debug_activate(struct timer_list *timer, unsigned long expires)
+{
+        debug_timer_activate(timer);
+        trace_timer_start(timer, expires);
+}
+static inline void debug_deactivate(struct timer_list *timer)
+{
+        debug_timer_deactivate(timer);
+        trace_timer_cancel(timer);
+}
 static void __init_timer(struct timer_list *timer,
                         const char *name,
                         struct lock_class_key *key)
@@ -549,7 +571,7 @@ void init_timer_key(struct timer_list *timer,
                    const char *name,
                    struct lock_class_key *key)
 {
-        debug_timer_init(timer);
+        debug_init(timer);
        __init_timer(timer, name, key);
 }
 EXPORT_SYMBOL(init_timer_key);
@@ -568,7 +590,7 @@ static inline void detach_timer(struct timer_list *timer,
 {
        struct list_head *entry = &timer->entry;
-        debug_timer_deactivate(timer);
+        debug_deactivate(timer);
        __list_del(entry->prev, entry->next);
        if (clear_pending)
@@ -632,7 +654,7 @@ __mod_timer(struct timer_list *timer, unsigned long expires,
                        goto out_unlock;
        }
-        debug_timer_activate(timer);
+        debug_activate(timer, expires);
        new_base = __get_cpu_var(tvec_bases);
@@ -787,7 +809,7 @@ void add_timer_on(struct timer_list *timer, int cpu)
        BUG_ON(timer_pending(timer) || !timer->function);
        spin_lock_irqsave(&base->lock, flags);
        timer_set_base(timer, base);
-        debug_timer_activate(timer);
+        debug_activate(timer, timer->expires);
        if (time_before(timer->expires, base->next_timer) &&
            !tbase_get_deferrable(timer->base))
                base->next_timer = timer->expires;
@@ -1000,7 +1022,9 @@ static inline void __run_timers(struct tvec_base *base)
                                 */
                                lock_map_acquire(&lockdep_map);
+                                trace_timer_expire_entry(timer);
                                fn(data);
+                                trace_timer_expire_exit(timer);
                                lock_map_release(&lockdep_map);
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 3eb159c277c8..d9d6206e0b14 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -856,6 +856,37 @@ static void blk_add_trace_remap(struct request_queue *q, struct bio *bio,
 }
 /**
+ * blk_add_trace_rq_remap - Add a trace for a request-remap operation
+ * @q:          queue the io is for
+ * @rq:         the source request
+ * @dev:        target device
+ * @from:       source sector
+ *
+ * Description:
+ *     Device mapper remaps request to other devices.
+ *     Add a trace for that action.
+ *
+ **/
+static void blk_add_trace_rq_remap(struct request_queue *q,
+                                   struct request *rq, dev_t dev,
+                                   sector_t from)
+{
+        struct blk_trace *bt = q->blk_trace;
+        struct blk_io_trace_remap r;
+        if (likely(!bt))
+                return;
+        r.device_from = cpu_to_be32(dev);
+        r.device_to   = cpu_to_be32(disk_devt(rq->rq_disk));
+        r.sector_from = cpu_to_be64(from);
+        __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
+                        rq_data_dir(rq), BLK_TA_REMAP, !!rq->errors,
+                        sizeof(r), &r);
+}
+/**
 * blk_add_driver_data - Add binary message with driver-specific data
 * @q:          queue the io is for
 * @rq:         io request
@@ -922,10 +953,13 @@ static void blk_register_tracepoints(void)
        WARN_ON(ret);
        ret = register_trace_block_remap(blk_add_trace_remap);
        WARN_ON(ret);
+        ret = register_trace_block_rq_remap(blk_add_trace_rq_remap);
+        WARN_ON(ret);
 }
 static void blk_unregister_tracepoints(void)
 {
+        unregister_trace_block_rq_remap(blk_add_trace_rq_remap);
        unregister_trace_block_remap(blk_add_trace_remap);
        unregister_trace_block_split(blk_add_trace_split);
        unregister_trace_block_unplug_io(blk_add_trace_unplug_io);
@@ -1657,6 +1691,11 @@ int blk_trace_init_sysfs(struct device *dev)
        return sysfs_create_group(&dev->kobj, &blk_trace_attr_group);
 }
+void blk_trace_remove_sysfs(struct device *dev)
+{
+        sysfs_remove_group(&dev->kobj, &blk_trace_attr_group);
+}
 #endif /* CONFIG_BLK_DEV_IO_TRACE */
 #ifdef CONFIG_EVENT_TRACING
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index c71e91bf7372..37ba67e33265 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -225,7 +225,11 @@ static void ftrace_update_pid_func(void)
        if (ftrace_trace_function == ftrace_stub)
                return;
+#ifdef CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST
        func = ftrace_trace_function;
+#else
+        func = __ftrace_trace_function;
+#endif
        if (ftrace_pid_trace) {
                set_ftrace_pid_function(func);
@@ -1074,14 +1078,9 @@ static void ftrace_replace_code(int enable)
                failed = __ftrace_replace_code(rec, enable);
                if (failed) {
                        rec->flags |= FTRACE_FL_FAILED;
-                        if ((system_state == SYSTEM_BOOTING) ||
+                        ftrace_bug(failed, rec->ip);
-                            !core_kernel_text(rec->ip)) {
+                        /* Stop processing */
-                                ftrace_free_rec(rec);
+                        return;
-                                } else {
-                                ftrace_bug(failed, rec->ip);
-                                        /* Stop processing */
-                                        return;
-                                }
                }
        } while_for_each_ftrace_rec();
 }
@@ -1520,7 +1519,7 @@ static int t_show(struct seq_file *m, void *v)
        return 0;
 }
-static struct seq_operations show_ftrace_seq_ops = {
+static const struct seq_operations show_ftrace_seq_ops = {
        .start = t_start,
        .next = t_next,
        .stop = t_stop,
@@ -1621,8 +1620,10 @@ ftrace_regex_open(struct inode *inode, struct file *file, int enable)
                if (!ret) {
                        struct seq_file *m = file->private_data;
                        m->private = iter;
-                } else
+                } else {
+                        trace_parser_put(&iter->parser);
                        kfree(iter);
+                }
        } else
                file->private_data = iter;
        mutex_unlock(&ftrace_regex_lock);
@@ -2202,7 +2203,7 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
        struct trace_parser *parser;
        ssize_t ret, read;
-        if (!cnt || cnt < 0)
+        if (!cnt)
                return 0;
        mutex_lock(&ftrace_regex_lock);
@@ -2216,7 +2217,7 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
        parser = &iter->parser;
        read = trace_get_user(parser, ubuf, cnt, ppos);
-        if (trace_parser_loaded(parser) &&
+        if (read >= 0 && trace_parser_loaded(parser) &&
            !trace_parser_cont(parser)) {
                ret = ftrace_process_regex(parser->buffer,
                                           parser->idx, enable);
@@ -2459,7 +2460,7 @@ static int g_show(struct seq_file *m, void *v)
        return 0;
 }
-static struct seq_operations ftrace_graph_seq_ops = {
+static const struct seq_operations ftrace_graph_seq_ops = {
        .start = g_start,
        .next = g_next,
        .stop = g_stop,
@@ -2552,8 +2553,7 @@ ftrace_graph_write(struct file *file, const char __user *ubuf,
                   size_t cnt, loff_t *ppos)
 {
        struct trace_parser parser;
-        size_t read = 0;
+        ssize_t read, ret;
-        ssize_t ret;
        if (!cnt || cnt < 0)
                return 0;
@@ -2562,29 +2562,31 @@ ftrace_graph_write(struct file *file, const char __user *ubuf,
        if (ftrace_graph_count >= FTRACE_GRAPH_MAX_FUNCS) {
                ret = -EBUSY;
-                goto out;
+                goto out_unlock;
        }
        if (trace_parser_get_init(&parser, FTRACE_BUFF_MAX)) {
                ret = -ENOMEM;
-                goto out;
+                goto out_unlock;
        }
        read = trace_get_user(&parser, ubuf, cnt, ppos);
-        if (trace_parser_loaded((&parser))) {
+        if (read >= 0 && trace_parser_loaded((&parser))) {
                parser.buffer[parser.idx] = 0;
                /* we allow only one expression at a time */
                ret = ftrace_set_func(ftrace_graph_funcs, &ftrace_graph_count,
                                        parser.buffer);
                if (ret)
-                        goto out;
+                        goto out_free;
        }
        ret = read;
- out:
+out_free:
        trace_parser_put(&parser);
+out_unlock:
        mutex_unlock(&graph_lock);
        return ret;
@@ -2655,19 +2657,17 @@ static int ftrace_convert_nops(struct module *mod,
 }
 #ifdef CONFIG_MODULES
-void ftrace_release(void *start, void *end)
+void ftrace_release_mod(struct module *mod)
 {
        struct dyn_ftrace *rec;
        struct ftrace_page *pg;
-        unsigned long s = (unsigned long)start;
-        unsigned long e = (unsigned long)end;
-        if (ftrace_disabled || !start || start == end)
+        if (ftrace_disabled)
                return;
        mutex_lock(&ftrace_lock);
        do_for_each_ftrace_rec(pg, rec) {
-                if ((rec->ip >= s) && (rec->ip < e)) {
+                if (within_module_core(rec->ip, mod)) {
                        /*
                         * rec->ip is changed in ftrace_free_rec()
                         * It should not between s and e if record was freed.
@@ -2699,9 +2699,7 @@ static int ftrace_module_notify(struct notifier_block *self,
                                   mod->num_ftrace_callsites);
                break;
        case MODULE_STATE_GOING:
-                ftrace_release(mod->ftrace_callsites,
+                ftrace_release_mod(mod);
-                               mod->ftrace_callsites +
-                               mod->num_ftrace_callsites);
                break;
        }
@@ -3015,7 +3013,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops)
 int
 ftrace_enable_sysctl(struct ctl_table *table, int write,
-                     struct file *file, void __user *buffer, size_t *lenp,
+                     void __user *buffer, size_t *lenp,
                     loff_t *ppos)
 {
        int ret;
@@ -3025,7 +3023,7 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
        mutex_lock(&ftrace_lock);
-        ret  = proc_dointvec(table, write, file, buffer, lenp, ppos);
+        ret  = proc_dointvec(table, write, buffer, lenp, ppos);
        if (ret || !write || (last_ftrace_enabled == !!ftrace_enabled))
                goto out;
diff --git a/kernel/trace/kmemtrace.c b/kernel/trace/kmemtrace.c
index 81b1645c8549..a91da69f153a 100644
--- a/kernel/trace/kmemtrace.c
+++ b/kernel/trace/kmemtrace.c
@@ -501,7 +501,7 @@ static int __init init_kmem_tracer(void)
                return 1;
        }
-        if (!register_tracer(&kmem_tracer)) {
+        if (register_tracer(&kmem_tracer) != 0) {
                pr_warning("Warning: could not register the kmem tracer\n");
                return 1;
        }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index a35925d222ba..45068269ebb1 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -415,7 +415,7 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
        /* read the non-space input */
        while (cnt && !isspace(ch)) {
-                if (parser->idx < parser->size)
+                if (parser->idx < parser->size - 1)
                        parser->buffer[parser->idx++] = ch;
                else {
                        ret = -EINVAL;
@@ -1949,7 +1949,7 @@ static int s_show(struct seq_file *m, void *v)
        return 0;
 }
-static struct seq_operations tracer_seq_ops = {
+static const struct seq_operations tracer_seq_ops = {
        .start          = s_start,
        .next           = s_next,
        .stop           = s_stop,
@@ -1984,11 +1984,9 @@ __tracing_open(struct inode *inode, struct file *file)
        if (current_trace)
                *iter->trace = *current_trace;
-        if (!alloc_cpumask_var(&iter->started, GFP_KERNEL))
+        if (!zalloc_cpumask_var(&iter->started, GFP_KERNEL))
                goto fail;
-        cpumask_clear(iter->started);
        if (current_trace && current_trace->print_max)
                iter->tr = &max_tr;
        else
@@ -2163,7 +2161,7 @@ static int t_show(struct seq_file *m, void *v)
        return 0;
 }
-static struct seq_operations show_traces_seq_ops = {
+static const struct seq_operations show_traces_seq_ops = {
        .start          = t_start,
        .next           = t_next,
        .stop           = t_stop,
@@ -4389,7 +4387,7 @@ __init static int tracer_alloc_buffers(void)
        if (!alloc_cpumask_var(&tracing_cpumask, GFP_KERNEL))
                goto out_free_buffer_mask;
-        if (!alloc_cpumask_var(&tracing_reader_cpumask, GFP_KERNEL))
+        if (!zalloc_cpumask_var(&tracing_reader_cpumask, GFP_KERNEL))
                goto out_free_tracing_cpumask;
        /* To save memory, keep the ring buffer size to its minimum */
@@ -4400,7 +4398,6 @@ __init static int tracer_alloc_buffers(void)
        cpumask_copy(tracing_buffer_mask, cpu_possible_mask);
        cpumask_copy(tracing_cpumask, cpu_all_mask);
-        cpumask_clear(tracing_reader_cpumask);
        /* TODO: make the number of buffers hot pluggable with CPUS */
        global_trace.buffer = ring_buffer_alloc(ring_buf_size,
diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
index 7a7a9fd249a9..4a194f08f88c 100644
--- a/kernel/trace/trace_branch.c
+++ b/kernel/trace/trace_branch.c
@@ -34,6 +34,7 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
        struct trace_array *tr = branch_tracer;
        struct ring_buffer_event *event;
        struct trace_branch *entry;
+        struct ring_buffer *buffer;
        unsigned long flags;
        int cpu, pc;
        const char *p;
@@ -54,7 +55,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
                goto out;
        pc = preempt_count();
-        event = trace_buffer_lock_reserve(tr, TRACE_BRANCH,
+        buffer = tr->buffer;
+        event = trace_buffer_lock_reserve(buffer, TRACE_BRANCH,
                                          sizeof(*entry), flags, pc);
        if (!event)
                goto out;
@@ -74,8 +76,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
        entry->line = f->line;
        entry->correct = val == expect;
-        if (!filter_check_discard(call, entry, tr->buffer, event))
+        if (!filter_check_discard(call, entry, buffer, event))
-                ring_buffer_unlock_commit(tr->buffer, event);
+                ring_buffer_unlock_commit(buffer, event);
 out:
        atomic_dec(&tr->data[cpu]->disabled);
diff --git a/kernel/trace/trace_event_profile.c b/kernel/trace/trace_event_profile.c
index dd44b8768867..8d5c171cc998 100644
--- a/kernel/trace/trace_event_profile.c
+++ b/kernel/trace/trace_event_profile.c
@@ -31,7 +31,7 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
        if (atomic_inc_return(&event->profile_count))
                return 0;
-        if (!total_profile_count++) {
+        if (!total_profile_count) {
                buf = (char *)alloc_percpu(profile_buf_t);
                if (!buf)
                        goto fail_buf;
@@ -46,14 +46,19 @@ static int ftrace_profile_enable_event(struct ftrace_event_call *event)
        }
        ret = event->profile_enable();
-        if (!ret)
+        if (!ret) {
+                total_profile_count++;
                return 0;
+        }
-        kfree(trace_profile_buf_nmi);
 fail_buf_nmi:
-        kfree(trace_profile_buf);
+        if (!total_profile_count) {
+                free_percpu(trace_profile_buf_nmi);
+                free_percpu(trace_profile_buf);
+                trace_profile_buf_nmi = NULL;
+                trace_profile_buf = NULL;
+        }
 fail_buf:
-        total_profile_count--;
        atomic_dec(&event->profile_count);
        return ret;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 6f03c8a1105e..d128f65778e6 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -232,10 +232,9 @@ ftrace_event_write(struct file *file, const char __user *ubuf,
                   size_t cnt, loff_t *ppos)
 {
        struct trace_parser parser;
-        size_t read = 0;
+        ssize_t read, ret;
-        ssize_t ret;
-        if (!cnt || cnt < 0)
+        if (!cnt)
                return 0;
        ret = tracing_update_buffers();
@@ -247,7 +246,7 @@ ftrace_event_write(struct file *file, const char __user *ubuf,
        read = trace_get_user(&parser, ubuf, cnt, ppos);
-        if (trace_parser_loaded((&parser))) {
+        if (read >= 0 && trace_parser_loaded((&parser))) {
                int set = 1;
                if (*parser.buffer == '!')
diff --git a/kernel/trace/trace_hw_branches.c b/kernel/trace/trace_hw_branches.c
index 23b63859130e..69543a905cd5 100644
--- a/kernel/trace/trace_hw_branches.c
+++ b/kernel/trace/trace_hw_branches.c
@@ -165,6 +165,7 @@ void trace_hw_branch(u64 from, u64 to)
        struct ftrace_event_call *call = &event_hw_branch;
        struct trace_array *tr = hw_branch_trace;
        struct ring_buffer_event *event;
+        struct ring_buffer *buf;
        struct hw_branch_entry *entry;
        unsigned long irq1;
        int cpu;
@@ -180,7 +181,8 @@ void trace_hw_branch(u64 from, u64 to)
        if (atomic_inc_return(&tr->data[cpu]->disabled) != 1)
                goto out;
-        event = trace_buffer_lock_reserve(tr, TRACE_HW_BRANCHES,
+        buf = tr->buffer;
+        event = trace_buffer_lock_reserve(buf, TRACE_HW_BRANCHES,
                                          sizeof(*entry), 0, 0);
        if (!event)
                goto out;
@@ -189,8 +191,8 @@ void trace_hw_branch(u64 from, u64 to)
        entry->ent.type = TRACE_HW_BRANCHES;
        entry->from = from;
        entry->to   = to;
-        if (!filter_check_discard(call, entry, tr->buffer, event))
+        if (!filter_check_discard(call, entry, buf, event))
-                trace_buffer_unlock_commit(tr, event, 0, 0);
+                trace_buffer_unlock_commit(buf, event, 0, 0);
 out:
        atomic_dec(&tr->data[cpu]->disabled);
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index f572f44c6e1e..ed17565826b0 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -486,16 +486,18 @@ int trace_print_lat_fmt(struct trace_seq *s, struct trace_entry *entry)
                                hardirq ? 'h' : softirq ? 's' : '.'))
                return 0;
-        if (entry->lock_depth < 0)
+        if (entry->preempt_count)
-                ret = trace_seq_putc(s, '.');
+                ret = trace_seq_printf(s, "%x", entry->preempt_count);
        else
-                ret = trace_seq_printf(s, "%d", entry->lock_depth);
+                ret = trace_seq_putc(s, '.');
        if (!ret)
                return 0;
-        if (entry->preempt_count)
+        if (entry->lock_depth < 0)
-                return trace_seq_printf(s, "%x", entry->preempt_count);
+                return trace_seq_putc(s, '.');
-        return trace_seq_putc(s, '.');
+        return trace_seq_printf(s, "%d", entry->lock_depth);
 }
 static int
@@ -883,7 +885,7 @@ static int trace_ctxwake_raw(struct trace_iterator *iter, char S)
        trace_assign_type(field, iter->ent);
        if (!S)
-                task_state_char(field->prev_state);
+                S = task_state_char(field->prev_state);
        T = task_state_char(field->next_state);
        if (!trace_seq_printf(&iter->seq, "%d %d %c %d %d %d %c\n",
                              field->prev_pid,
@@ -918,7 +920,7 @@ static int trace_ctxwake_hex(struct trace_iterator *iter, char S)
        trace_assign_type(field, iter->ent);
        if (!S)
-                task_state_char(field->prev_state);
+                S = task_state_char(field->prev_state);
        T = task_state_char(field->next_state);
        SEQ_PUT_HEX_FIELD_RET(s, field->prev_pid);
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 0f6facb050a1..8504ac71e4e8 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -296,14 +296,14 @@ static const struct file_operations stack_trace_fops = {
 int
 stack_trace_sysctl(struct ctl_table *table, int write,
-                   struct file *file, void __user *buffer, size_t *lenp,
+                   void __user *buffer, size_t *lenp,
                   loff_t *ppos)
 {
        int ret;
        mutex_lock(&stack_sysctl_mutex);
-        ret = proc_dointvec(table, write, file, buffer, lenp, ppos);
+        ret = proc_dointvec(table, write, buffer, lenp, ppos);
        if (ret || !write ||
            (last_stack_tracer_enabled == !!stack_tracer_enabled))
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 9fbce6c9d2e1..527e17eae575 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -166,7 +166,7 @@ int syscall_exit_format(struct ftrace_event_call *call, struct trace_seq *s)
                               "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n"
                               "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n",
                               SYSCALL_FIELD(int, nr),
-                               SYSCALL_FIELD(unsigned long, ret));
+                               SYSCALL_FIELD(long, ret));
        if (!ret)
                return 0;
@@ -212,7 +212,7 @@ int syscall_exit_define_fields(struct ftrace_event_call *call)
        if (ret)
                return ret;
-        ret = trace_define_field(call, SYSCALL_FIELD(unsigned long, ret), 0,
+        ret = trace_define_field(call, SYSCALL_FIELD(long, ret), 0,
                                 FILTER_OTHER);
        return ret;
diff --git a/kernel/uid16.c b/kernel/uid16.c
index 0314501688b9..419209893d87 100644
--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -4,7 +4,6 @@
 */
 #include <linux/mm.h>
-#include <linux/utsname.h>
 #include <linux/mman.h>
 #include <linux/notifier.h>
 #include <linux/reboot.h>
diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
index 92359cc747a7..69eae358a726 100644
--- a/kernel/utsname_sysctl.c
+++ b/kernel/utsname_sysctl.c
@@ -42,14 +42,14 @@ static void put_uts(ctl_table *table, int write, void *which)
 *      Special case of dostring for the UTS structure. This has locks
 *      to observe. Should this be in kernel/sys.c ????
 */
-static int proc_do_uts_string(ctl_table *table, int write, struct file *filp,
+static int proc_do_uts_string(ctl_table *table, int write,
                  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct ctl_table uts_table;
        int r;
        memcpy(&uts_table, table, sizeof(uts_table));
        uts_table.data = get_uts(table, write);
-        r = proc_dostring(&uts_table,write,filp,buffer,lenp, ppos);
+        r = proc_dostring(&uts_table,write,buffer,lenp, ppos);
        put_uts(table, write, uts_table.data);
        return r;
 }