25 files changed, 228 insertions, 137 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 21c7fa615bd3..91e53d04b6a9 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1056,7 +1056,7 @@ static inline void audit_get_stamp(struct audit_context *ctx,
 static void wait_for_auditd(unsigned long sleep_time)
 {
         DECLARE_WAITQUEUE(wait, current);
-        set_current_state(TASK_INTERRUPTIBLE);
+        set_current_state(TASK_UNINTERRUPTIBLE);
         add_wait_queue(&audit_backlog_wait, &wait);
 
         if (audit_backlog_limit &&
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index a291aa23fb3f..43c307dc9453 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -658,6 +658,7 @@ int audit_add_tree_rule(struct audit_krule *rule)
         struct vfsmount *mnt;
         int err;
 
+        rule->tree = NULL;
         list_for_each_entry(tree, &tree_list, list) {
                 if (!strcmp(seed->pathname, tree->pathname)) {
                         put_tree(seed);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2a9926275f80..a7c9e6ddb979 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1686,11 +1686,14 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                  */
                 cgroup_drop_root(opts.new_root);
 
-                if (((root->flags | opts.flags) & CGRP_ROOT_SANE_BEHAVIOR) &&
-                    root->flags != opts.flags) {
-                        pr_err("cgroup: sane_behavior: new mount options should match the existing superblock\n");
-                        ret = -EINVAL;
-                        goto drop_new_super;
+                if (root->flags != opts.flags) {
+                        if ((root->flags | opts.flags) & CGRP_ROOT_SANE_BEHAVIOR) {
+                                pr_err("cgroup: sane_behavior: new mount options should match the existing superblock\n");
+                                ret = -EINVAL;
+                                goto drop_new_super;
+                        } else {
+                                pr_warning("cgroup: new mount options do not match the existing superblock, will be ignored\n");
+                        }
                 }
 
                 /* no subsys rebinding, so refcounts don't change */
@@ -2699,13 +2702,14 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys,
                 goto out;
         }
 
+        cfe->type = (void *)cft;
+        cfe->dentry = dentry;
+        dentry->d_fsdata = cfe;
+        simple_xattrs_init(&cfe->xattrs);
+
         mode = cgroup_file_mode(cft);
         error = cgroup_create_file(dentry, mode | S_IFREG, cgrp->root->sb);
         if (!error) {
-                cfe->type = (void *)cft;
-                cfe->dentry = dentry;
-                dentry->d_fsdata = cfe;
-                simple_xattrs_init(&cfe->xattrs);
                 list_add_tail(&cfe->node, &parent->files);
                 cfe = NULL;
         }
@@ -2953,11 +2957,8 @@ struct cgroup *cgroup_next_descendant_pre(struct cgroup *pos,
         WARN_ON_ONCE(!rcu_read_lock_held());
 
         /* if first iteration, pretend we just visited @cgroup */
-        if (!pos) {
-                if (list_empty(&cgroup->children))
-                        return NULL;
+        if (!pos)
                 pos = cgroup;
-        }
 
         /* visit the first child if exists */
         next = list_first_or_null_rcu(&pos->children, struct cgroup, sibling);
@@ -2965,14 +2966,14 @@ struct cgroup *cgroup_next_descendant_pre(struct cgroup *pos,
                 return next;
 
         /* no child, visit my or the closest ancestor's next sibling */
-        do {
+        while (pos != cgroup) {
                 next = list_entry_rcu(pos->sibling.next, struct cgroup,
                                       sibling);
                 if (&next->sibling != &pos->parent->children)
                         return next;
 
                 pos = pos->parent;
-        } while (pos != cgroup);
+        }
 
         return NULL;
 }
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
index 65349f07b878..85bdde1137eb 100644
--- a/kernel/context_tracking.c
+++ b/kernel/context_tracking.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/context_tracking.h>
-#include <linux/kvm_host.h>
 #include <linux/rcupdate.h>
 #include <linux/sched.h>
 #include <linux/hardirq.h>
diff --git a/kernel/cpu.c b/kernel/cpu.c
index b5e4ab2d427e..198a38883e64 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -133,6 +133,27 @@ static void cpu_hotplug_done(void)
         mutex_unlock(&cpu_hotplug.lock);
 }
 
+/*
+ * Wait for currently running CPU hotplug operations to complete (if any) and
+ * disable future CPU hotplug (from sysfs). The 'cpu_add_remove_lock' protects
+ * the 'cpu_hotplug_disabled' flag. The same lock is also acquired by the
+ * hotplug path before performing hotplug operations. So acquiring that lock
+ * guarantees mutual exclusion from any currently running hotplug operations.
+ */
+void cpu_hotplug_disable(void)
+{
+        cpu_maps_update_begin();
+        cpu_hotplug_disabled = 1;
+        cpu_maps_update_done();
+}
+
+void cpu_hotplug_enable(void)
+{
+        cpu_maps_update_begin();
+        cpu_hotplug_disabled = 0;
+        cpu_maps_update_done();
+}
+
 #else /* #if CONFIG_HOTPLUG_CPU */
 static void cpu_hotplug_begin(void) {}
 static void cpu_hotplug_done(void) {}
@@ -541,36 +562,6 @@ static int __init alloc_frozen_cpus(void)
 core_initcall(alloc_frozen_cpus);
 
 /*
- * Prevent regular CPU hotplug from racing with the freezer, by disabling CPU
- * hotplug when tasks are about to be frozen. Also, don't allow the freezer
- * to continue until any currently running CPU hotplug operation gets
- * completed.
- * To modify the 'cpu_hotplug_disabled' flag, we need to acquire the
- * 'cpu_add_remove_lock'. And this same lock is also taken by the regular
- * CPU hotplug path and released only after it is complete. Thus, we
- * (and hence the freezer) will block here until any currently running CPU
- * hotplug operation gets completed.
- */
-void cpu_hotplug_disable_before_freeze(void)
-{
-        cpu_maps_update_begin();
-        cpu_hotplug_disabled = 1;
-        cpu_maps_update_done();
-}
-
-
-/*
- * When tasks have been thawed, re-enable regular CPU hotplug (which had been
- * disabled while beginning to freeze tasks).
- */
-void cpu_hotplug_enable_after_thaw(void)
-{
-        cpu_maps_update_begin();
-        cpu_hotplug_disabled = 0;
-        cpu_maps_update_done();
-}
-
-/*
  * When callbacks for CPU hotplug notifications are being executed, we must
  * ensure that the state of the system with respect to the tasks being frozen
  * or not, as reported by the notification, remains unchanged *throughout the
@@ -589,12 +580,12 @@ cpu_hotplug_pm_callback(struct notifier_block *nb,
 
         case PM_SUSPEND_PREPARE:
         case PM_HIBERNATION_PREPARE:
-                cpu_hotplug_disable_before_freeze();
+                cpu_hotplug_disable();
                 break;
 
         case PM_POST_SUSPEND:
         case PM_POST_HIBERNATION:
-                cpu_hotplug_enable_after_thaw();
+                cpu_hotplug_enable();
                 break;
 
         default:
diff --git a/kernel/cpu/idle.c b/kernel/cpu/idle.c
index d5585f5e038e..e695c0a0bcb5 100644
--- a/kernel/cpu/idle.c
+++ b/kernel/cpu/idle.c
@@ -5,6 +5,7 @@
 #include <linux/cpu.h>
 #include <linux/tick.h>
 #include <linux/mm.h>
+#include <linux/stackprotector.h>
 
 #include <asm/tlb.h>
 
@@ -58,6 +59,7 @@ void __weak arch_cpu_idle_dead(void) { }
 void __weak arch_cpu_idle(void)
 {
         cpu_idle_force_poll = 1;
+        local_irq_enable();
 }
 
 /*
@@ -112,6 +114,21 @@ static void cpu_idle_loop(void)
 
 void cpu_startup_entry(enum cpuhp_state state)
 {
+        /*
+         * This #ifdef needs to die, but it's too late in the cycle to
+         * make this generic (arm and sh have never invoked the canary
+         * init for the non boot cpus!). Will be fixed in 3.11
+         */
+#ifdef CONFIG_X86
+        /*
+         * If we're the non-boot CPU, nothing set the stack canary up
+         * for us. The boot CPU already has it initialized but no harm
+         * in doing it again. This is a good place for updating it, as
+         * we wont ever return from this function (so the invalid
+         * canaries already on the stack wont ever trigger).
+         */
+        boot_init_stack_canary();
+#endif
         current_set_polling();
         arch_cpu_idle_prepare();
         cpu_idle_loop();
diff --git a/kernel/exit.c b/kernel/exit.c
index af2eb3cbd499..7bb73f9d09db 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -649,7 +649,6 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
          *      jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
          */
         forget_original_parent(tsk);
-        exit_task_namespaces(tsk);
 
         write_lock_irq(&tasklist_lock);
         if (group_dead)
@@ -795,6 +794,7 @@ void do_exit(long code)
         exit_shm(tsk);
         exit_files(tsk);
         exit_fs(tsk);
+        exit_task_namespaces(tsk);
         exit_task_work(tsk);
         check_stack_usage();
         exit_thread();
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 5a83dde8ca0c..54a4d5223238 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -143,7 +143,10 @@ static unsigned int irq_domain_legacy_revmap(struct irq_domain *domain,
  * irq_domain_add_simple() - Allocate and register a simple irq_domain.
  * @of_node: pointer to interrupt controller's device tree node.
  * @size: total number of irqs in mapping
- * @first_irq: first number of irq block assigned to the domain
+ * @first_irq: first number of irq block assigned to the domain,
+ *      pass zero to assign irqs on-the-fly. This will result in a
+ *      linear IRQ domain so it is important to use irq_create_mapping()
+ *      for each used IRQ, especially when SPARSE_IRQ is enabled.
  * @ops: map/unmap domain callbacks
  * @host_data: Controller private data pointer
  *
@@ -191,6 +194,7 @@ struct irq_domain *irq_domain_add_simple(struct device_node *of_node,
         /* A linear domain is the default */
         return irq_domain_add_linear(of_node, size, ops, host_data);
 }
+EXPORT_SYMBOL_GPL(irq_domain_add_simple);
 
 /**
  * irq_domain_add_legacy() - Allocate and register a legacy revmap irq_domain.
@@ -397,11 +401,12 @@ static void irq_domain_disassociate_many(struct irq_domain *domain,
         while (count--) {
                 int irq = irq_base + count;
                 struct irq_data *irq_data = irq_get_irq_data(irq);
-                irq_hw_number_t hwirq = irq_data->hwirq;
+                irq_hw_number_t hwirq;
 
                 if (WARN_ON(!irq_data || irq_data->domain != domain))
                         continue;
 
+                hwirq = irq_data->hwirq;
                 irq_set_status_flags(irq, IRQ_NOREQUEST);
 
                 /* remove chip and handler */
diff --git a/kernel/printk.c b/kernel/printk.c
index fa36e1494420..8212c1aef125 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -363,6 +363,53 @@ static void log_store(int facility, int level,
         log_next_seq++;
 }
 
+#ifdef CONFIG_SECURITY_DMESG_RESTRICT
+int dmesg_restrict = 1;
+#else
+int dmesg_restrict;
+#endif
+
+static int syslog_action_restricted(int type)
+{
+        if (dmesg_restrict)
+                return 1;
+        /*
+         * Unless restricted, we allow "read all" and "get buffer size"
+         * for everybody.
+         */
+        return type != SYSLOG_ACTION_READ_ALL &&
+               type != SYSLOG_ACTION_SIZE_BUFFER;
+}
+
+static int check_syslog_permissions(int type, bool from_file)
+{
+        /*
+         * If this is from /proc/kmsg and we've already opened it, then we've
+         * already done the capabilities checks at open time.
+         */
+        if (from_file && type != SYSLOG_ACTION_OPEN)
+                return 0;
+
+        if (syslog_action_restricted(type)) {
+                if (capable(CAP_SYSLOG))
+                        return 0;
+                /*
+                 * For historical reasons, accept CAP_SYS_ADMIN too, with
+                 * a warning.
+                 */
+                if (capable(CAP_SYS_ADMIN)) {
+                        pr_warn_once("%s (%d): Attempt to access syslog with "
+                                     "CAP_SYS_ADMIN but no CAP_SYSLOG "
+                                     "(deprecated).\n",
+                                 current->comm, task_pid_nr(current));
+                        return 0;
+                }
+                return -EPERM;
+        }
+        return security_syslog(type);
+}
+
+
 /* /dev/kmsg - userspace message inject/listen interface */
 struct devkmsg_user {
         u64 seq;
@@ -620,7 +667,8 @@ static int devkmsg_open(struct inode *inode, struct file *file)
         if ((file->f_flags & O_ACCMODE) == O_WRONLY)
                 return 0;
 
-        err = security_syslog(SYSLOG_ACTION_READ_ALL);
+        err = check_syslog_permissions(SYSLOG_ACTION_READ_ALL,
+                                       SYSLOG_FROM_READER);
         if (err)
                 return err;
 
@@ -813,45 +861,6 @@ static inline void boot_delay_msec(int level)
 }
 #endif
 
-#ifdef CONFIG_SECURITY_DMESG_RESTRICT
-int dmesg_restrict = 1;
-#else
-int dmesg_restrict;
-#endif
-
-static int syslog_action_restricted(int type)
-{
-        if (dmesg_restrict)
-                return 1;
-        /* Unless restricted, we allow "read all" and "get buffer size" for everybody */
-        return type != SYSLOG_ACTION_READ_ALL && type != SYSLOG_ACTION_SIZE_BUFFER;
-}
-
-static int check_syslog_permissions(int type, bool from_file)
-{
-        /*
-         * If this is from /proc/kmsg and we've already opened it, then we've
-         * already done the capabilities checks at open time.
-         */
-        if (from_file && type != SYSLOG_ACTION_OPEN)
-                return 0;
-
-        if (syslog_action_restricted(type)) {
-                if (capable(CAP_SYSLOG))
-                        return 0;
-                /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
-                if (capable(CAP_SYS_ADMIN)) {
-                        printk_once(KERN_WARNING "%s (%d): "
-                                 "Attempt to access syslog with CAP_SYS_ADMIN "
-                                 "but no CAP_SYSLOG (deprecated).\n",
-                                 current->comm, task_pid_nr(current));
-                        return 0;
-                }
-                return -EPERM;
-        }
-        return 0;
-}
-
 #if defined(CONFIG_PRINTK_TIME)
 static bool printk_time = 1;
 #else
@@ -1249,7 +1258,7 @@ out:
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
-        return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
+        return do_syslog(type, buf, len, SYSLOG_FROM_READER);
 }
 
 /*
diff --git a/kernel/range.c b/kernel/range.c
index 071b0ab455cb..eb911dbce267 100644
--- a/kernel/range.c
+++ b/kernel/range.c
@@ -48,9 +48,11 @@ int add_range_with_merge(struct range *range, int az, int nr_range,
                 final_start = min(range[i].start, start);
                 final_end = max(range[i].end, end);
 
-                range[i].start = final_start;
-                range[i].end =  final_end;
-                return nr_range;
+                /* clear it and add it back for further merge */
+                range[i].start = 0;
+                range[i].end =  0;
+                return add_range_with_merge(range, az, nr_range,
+                        final_start, final_end);
         }
 
         /* Need to add it: */
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 16ea67925015..35380019f0fc 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -1451,9 +1451,9 @@ static int rcu_gp_init(struct rcu_state *rsp)
                                             rnp->grphi, rnp->qsmask);
                 raw_spin_unlock_irq(&rnp->lock);
 #ifdef CONFIG_PROVE_RCU_DELAY
-                if ((prandom_u32() % (rcu_num_nodes * 8)) == 0 &&
+                if ((prandom_u32() % (rcu_num_nodes + 1)) == 0 &&
                     system_state == SYSTEM_RUNNING)
-                        schedule_timeout_uninterruptible(2);
+                        udelay(200);
 #endif /* #ifdef CONFIG_PROVE_RCU_DELAY */
                 cond_resched();
         }
@@ -1613,6 +1613,14 @@ static int __noreturn rcu_gp_kthread(void *arg)
         }
 }
 
+static void rsp_wakeup(struct irq_work *work)
+{
+        struct rcu_state *rsp = container_of(work, struct rcu_state, wakeup_work);
+
+        /* Wake up rcu_gp_kthread() to start the grace period. */
+        wake_up(&rsp->gp_wq);
+}
+
 /*
  * Start a new RCU grace period if warranted, re-initializing the hierarchy
  * in preparation for detecting the next grace period.  The caller must hold
@@ -1637,8 +1645,12 @@ rcu_start_gp_advanced(struct rcu_state *rsp, struct rcu_node *rnp,
         }
         rsp->gp_flags = RCU_GP_FLAG_INIT;
 
-        /* Wake up rcu_gp_kthread() to start the grace period. */
-        wake_up(&rsp->gp_wq);
+        /*
+         * We can't do wakeups while holding the rnp->lock, as that
+         * could cause possible deadlocks with the rq->lock. Deter
+         * the wakeup to interrupt context.
+         */
+        irq_work_queue(&rsp->wakeup_work);
 }
 
 /*
@@ -3235,6 +3247,7 @@ static void __init rcu_init_one(struct rcu_state *rsp,
 
         rsp->rda = rda;
         init_waitqueue_head(&rsp->gp_wq);
+        init_irq_work(&rsp->wakeup_work, rsp_wakeup);
         rnp = rsp->level[rcu_num_lvls - 1];
         for_each_possible_cpu(i) {
                 while (i > rnp->grphi)
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index da77a8f57ff9..4df503470e42 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -27,6 +27,7 @@
 #include <linux/threads.h>
 #include <linux/cpumask.h>
 #include <linux/seqlock.h>
+#include <linux/irq_work.h>
 
 /*
  * Define shape of hierarchy based on NR_CPUS, CONFIG_RCU_FANOUT, and
@@ -442,6 +443,7 @@ struct rcu_state {
         char *name;                             /* Name of structure. */
         char abbr;                              /* Abbreviated name. */
         struct list_head flavors;               /* List of RCU flavors. */
+        struct irq_work wakeup_work;            /* Postponed wakeups */
 };
 
 /* Values for rcu_state structure's gp_flags field. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 58453b8272fd..e1a27f918723 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4745,7 +4745,7 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
          */
         idle->sched_class = &idle_sched_class;
         ftrace_graph_init_idle_task(idle, cpu);
-        vtime_init_idle(idle);
+        vtime_init_idle(idle, cpu);
 #if defined(CONFIG_SMP)
         sprintf(idle->comm, "%s/%d", INIT_TASK_COMM, cpu);
 #endif
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index cc2dc3eea8a3..b5ccba22603b 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -747,17 +747,17 @@ void arch_vtime_task_switch(struct task_struct *prev)
 
         write_seqlock(&current->vtime_seqlock);
         current->vtime_snap_whence = VTIME_SYS;
-        current->vtime_snap = sched_clock();
+        current->vtime_snap = sched_clock_cpu(smp_processor_id());
         write_sequnlock(&current->vtime_seqlock);
 }
 
-void vtime_init_idle(struct task_struct *t)
+void vtime_init_idle(struct task_struct *t, int cpu)
 {
         unsigned long flags;
 
         write_seqlock_irqsave(&t->vtime_seqlock, flags);
         t->vtime_snap_whence = VTIME_SYS;
-        t->vtime_snap = sched_clock();
+        t->vtime_snap = sched_clock_cpu(cpu);
         write_sequnlock_irqrestore(&t->vtime_seqlock, flags);
 }
 
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b5197dcb0dad..3d6833f125d3 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -195,8 +195,12 @@ void local_bh_enable_ip(unsigned long ip)
 EXPORT_SYMBOL(local_bh_enable_ip);
 
 /*
- * We restart softirq processing for at most 2 ms,
- * and if need_resched() is not set.
+ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
+ * but break the loop if need_resched() is set or after 2 ms.
+ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
+ * certain cases, such as stop_machine(), jiffies may cease to
+ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
+ * well to make sure we eventually return from this method.
  *
  * These limits have been established via experimentation.
  * The two things to balance is latency against fairness -
@@ -204,6 +208,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
  * should not be able to lock up the box.
  */
 #define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
+#define MAX_SOFTIRQ_RESTART 10
 
 asmlinkage void __do_softirq(void)
 {
@@ -212,6 +217,7 @@ asmlinkage void __do_softirq(void)
         unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
         int cpu;
         unsigned long old_flags = current->flags;
+        int max_restart = MAX_SOFTIRQ_RESTART;
 
         /*
          * Mask out PF_MEMALLOC s current task context is borrowed for the
@@ -265,7 +271,8 @@ restart:
 
         pending = local_softirq_pending();
         if (pending) {
-                if (time_before(jiffies, end) && !need_resched())
+                if (time_before(jiffies, end) && !need_resched() &&
+                    --max_restart)
                         goto restart;
 
                 wakeup_softirqd();
diff --git a/kernel/sys.c b/kernel/sys.c
index b95d3c72ba21..2bbd9a73b54c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -362,6 +362,29 @@ int unregister_reboot_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_reboot_notifier);
 
+/* Add backwards compatibility for stable trees. */
+#ifndef PF_NO_SETAFFINITY
+#define PF_NO_SETAFFINITY               PF_THREAD_BOUND
+#endif
+
+static void migrate_to_reboot_cpu(void)
+{
+        /* The boot cpu is always logical cpu 0 */
+        int cpu = 0;
+
+        cpu_hotplug_disable();
+
+        /* Make certain the cpu I'm about to reboot on is online */
+        if (!cpu_online(cpu))
+                cpu = cpumask_first(cpu_online_mask);
+
+        /* Prevent races with other tasks migrating this task */
+        current->flags |= PF_NO_SETAFFINITY;
+
+        /* Make certain I only run on the appropriate processor */
+        set_cpus_allowed_ptr(current, cpumask_of(cpu));
+}
+
 /**
  *      kernel_restart - reboot the system
  *      @cmd: pointer to buffer containing command to execute for restart
@@ -373,7 +396,7 @@ EXPORT_SYMBOL(unregister_reboot_notifier);
 void kernel_restart(char *cmd)
 {
         kernel_restart_prepare(cmd);
-        disable_nonboot_cpus();
+        migrate_to_reboot_cpu();
         syscore_shutdown();
         if (!cmd)
                 printk(KERN_EMERG "Restarting system.\n");
@@ -400,7 +423,7 @@ static void kernel_shutdown_prepare(enum system_states state)
 void kernel_halt(void)
 {
         kernel_shutdown_prepare(SYSTEM_HALT);
-        disable_nonboot_cpus();
+        migrate_to_reboot_cpu();
         syscore_shutdown();
         printk(KERN_EMERG "System halted.\n");
         kmsg_dump(KMSG_DUMP_HALT);
@@ -419,7 +442,7 @@ void kernel_power_off(void)
         kernel_shutdown_prepare(SYSTEM_POWER_OFF);
         if (pm_power_off_prepare)
                 pm_power_off_prepare();
-        disable_nonboot_cpus();
+        migrate_to_reboot_cpu();
         syscore_shutdown();
         printk(KERN_EMERG "Power down.\n");
         kmsg_dump(KMSG_DUMP_POWEROFF);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 12ff13a838c6..8f5b3b98577b 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -874,7 +874,6 @@ static void hardpps_update_phase(long error)
 void __hardpps(const struct timespec *phase_ts, const struct timespec *raw_ts)
 {
         struct pps_normtime pts_norm, freq_norm;
-        unsigned long flags;
 
         pts_norm = pps_normalize_ts(*phase_ts);
 
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 24938d577669..b4c245580b79 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -511,6 +511,12 @@ again:
                 }
         }
 
+        /*
+         * Remove the current cpu from the pending mask. The event is
+         * delivered immediately in tick_do_broadcast() !
+         */
+        cpumask_clear_cpu(smp_processor_id(), tick_broadcast_pending_mask);
+
         /* Take care of enforced broadcast requests */
         cpumask_or(tmpmask, tmpmask, tick_broadcast_force_mask);
         cpumask_clear(tick_broadcast_force_mask);
@@ -575,8 +581,8 @@ void tick_broadcast_oneshot_control(unsigned long reason)
 
         raw_spin_lock_irqsave(&tick_broadcast_lock, flags);
         if (reason == CLOCK_EVT_NOTIFY_BROADCAST_ENTER) {
-                WARN_ON_ONCE(cpumask_test_cpu(cpu, tick_broadcast_pending_mask));
                 if (!cpumask_test_and_set_cpu(cpu, tick_broadcast_oneshot_mask)) {
+                        WARN_ON_ONCE(cpumask_test_cpu(cpu, tick_broadcast_pending_mask));
                         clockevents_set_mode(dev, CLOCK_EVT_MODE_SHUTDOWN);
                         /*
                          * We only reprogram the broadcast timer if we
@@ -692,10 +698,6 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 
                 bc->event_handler = tick_handle_oneshot_broadcast;
 
-                /* Take the do_timer update */
-                if (!tick_nohz_full_cpu(cpu))
-                        tick_do_timer_cpu = cpu;
-
                 /*
                  * We must be careful here. There might be other CPUs
                  * waiting for periodic broadcast. We need to set the
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index f4208138fbf4..0cf1c1453181 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -306,7 +306,7 @@ static int __cpuinit tick_nohz_cpu_down_callback(struct notifier_block *nfb,
                  * we can't safely shutdown that CPU.
                  */
                 if (have_nohz_full_mask && tick_do_timer_cpu == cpu)
-                        return -EINVAL;
+                        return NOTIFY_BAD;
                 break;
         }
         return NOTIFY_OK;
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 98cd470bbe49..baeeb5c87cf1 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -975,6 +975,14 @@ static int timekeeping_suspend(void)
 
         read_persistent_clock(&timekeeping_suspend_time);
 
+        /*
+         * On some systems the persistent_clock can not be detected at
+         * timekeeping_init by its return value, so if we see a valid
+         * value returned, update the persistent_clock_exists flag.
+         */
+        if (timekeeping_suspend_time.tv_sec || timekeeping_suspend_time.tv_nsec)
+                persistent_clock_exist = true;
+
         raw_spin_lock_irqsave(&timekeeper_lock, flags);
         write_seqcount_begin(&timekeeper_seq);
         timekeeping_forward_now(tk);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index b549b0f5b977..6c508ff33c62 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -120,22 +120,22 @@ static void ftrace_ops_no_ops(unsigned long ip, unsigned long parent_ip);
 
 /*
  * Traverse the ftrace_global_list, invoking all entries.  The reason that we
- * can use rcu_dereference_raw() is that elements removed from this list
+ * can use rcu_dereference_raw_notrace() is that elements removed from this list
  * are simply leaked, so there is no need to interact with a grace-period
- * mechanism.  The rcu_dereference_raw() calls are needed to handle
+ * mechanism.  The rcu_dereference_raw_notrace() calls are needed to handle
  * concurrent insertions into the ftrace_global_list.
  *
  * Silly Alpha and silly pointer-speculation compiler optimizations!
  */
 #define do_for_each_ftrace_op(op, list)                 \
-        op = rcu_dereference_raw(list);                 \
+        op = rcu_dereference_raw_notrace(list);                 \
         do
 
 /*
  * Optimized for just a single item in the list (as that is the normal case).
  */
 #define while_for_each_ftrace_op(op)                            \
-        while (likely(op = rcu_dereference_raw((op)->next)) &&  \
+        while (likely(op = rcu_dereference_raw_notrace((op)->next)) &&  \
                unlikely((op) != &ftrace_list_end))
 
 static inline void ftrace_ops_init(struct ftrace_ops *ops)
@@ -779,7 +779,7 @@ ftrace_find_profiled_func(struct ftrace_profile_stat *stat, unsigned long ip)
         if (hlist_empty(hhd))
                 return NULL;
 
-        hlist_for_each_entry_rcu(rec, hhd, node) {
+        hlist_for_each_entry_rcu_notrace(rec, hhd, node) {
                 if (rec->ip == ip)
                         return rec;
         }
@@ -1165,7 +1165,7 @@ ftrace_lookup_ip(struct ftrace_hash *hash, unsigned long ip)
 
         hhd = &hash->buckets[key];
 
-        hlist_for_each_entry_rcu(entry, hhd, hlist) {
+        hlist_for_each_entry_rcu_notrace(entry, hhd, hlist) {
                 if (entry->ip == ip)
                         return entry;
         }
@@ -1422,8 +1422,8 @@ ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip)
         struct ftrace_hash *notrace_hash;
         int ret;
 
-        filter_hash = rcu_dereference_raw(ops->filter_hash);
-        notrace_hash = rcu_dereference_raw(ops->notrace_hash);
+        filter_hash = rcu_dereference_raw_notrace(ops->filter_hash);
+        notrace_hash = rcu_dereference_raw_notrace(ops->notrace_hash);
 
         if ((ftrace_hash_empty(filter_hash) ||
              ftrace_lookup_ip(filter_hash, ip)) &&
@@ -2920,7 +2920,7 @@ static void function_trace_probe_call(unsigned long ip, unsigned long parent_ip,
          * on the hash. rcu_read_lock is too dangerous here.
          */
         preempt_disable_notrace();
-        hlist_for_each_entry_rcu(entry, hhd, node) {
+        hlist_for_each_entry_rcu_notrace(entry, hhd, node) {
                 if (entry->ip == ip)
                         entry->ops->func(ip, parent_ip, &entry->data);
         }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index b59aea2c48c2..e444ff88f0a4 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -620,6 +620,9 @@ int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
         if (cpu == RING_BUFFER_ALL_CPUS)
                 work = &buffer->irq_work;
         else {
+                if (!cpumask_test_cpu(cpu, buffer->cpumask))
+                        return -EINVAL;
+
                 cpu_buffer = buffer->buffers[cpu];
                 work = &cpu_buffer->irq_work;
         }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index ae6fa2d1cdf7..e71a8be4a6ee 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -652,8 +652,6 @@ static struct {
         ARCH_TRACE_CLOCKS
 };
 
-int trace_clock_id;
-
 /*
  * trace_parser_get_init - gets the buffer for trace parser
  */
@@ -843,7 +841,15 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 
         memcpy(max_data->comm, tsk->comm, TASK_COMM_LEN);
         max_data->pid = tsk->pid;
-        max_data->uid = task_uid(tsk);
+        /*
+         * If tsk == current, then use current_uid(), as that does not use
+         * RCU. The irq tracer can be called out of RCU scope.
+         */
+        if (tsk == current)
+                max_data->uid = current_uid();
+        else
+                max_data->uid = task_uid(tsk);
+
         max_data->nice = tsk->static_prio - 20 - MAX_RT_PRIO;
         max_data->policy = tsk->policy;
         max_data->rt_priority = tsk->rt_priority;
@@ -2818,7 +2824,7 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
                 iter->iter_flags |= TRACE_FILE_ANNOTATE;
 
         /* Output in nanoseconds only if we are using a clock in nanoseconds. */
-        if (trace_clocks[trace_clock_id].in_ns)
+        if (trace_clocks[tr->clock_id].in_ns)
                 iter->iter_flags |= TRACE_FILE_TIME_IN_NS;
 
         /* stop the trace while dumping if we are not opening "snapshot" */
@@ -3817,7 +3823,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
                 iter->iter_flags |= TRACE_FILE_LAT_FMT;
 
         /* Output in nanoseconds only if we are using a clock in nanoseconds. */
-        if (trace_clocks[trace_clock_id].in_ns)
+        if (trace_clocks[tr->clock_id].in_ns)
                 iter->iter_flags |= TRACE_FILE_TIME_IN_NS;
 
         iter->cpu_file = tc->cpu;
@@ -5087,7 +5093,7 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
         cnt = ring_buffer_bytes_cpu(trace_buf->buffer, cpu);
         trace_seq_printf(s, "bytes: %ld\n", cnt);
 
-        if (trace_clocks[trace_clock_id].in_ns) {
+        if (trace_clocks[tr->clock_id].in_ns) {
                 /* local or global for trace_clock */
                 t = ns2usecs(ring_buffer_oldest_event_ts(trace_buf->buffer, cpu));
                 usec_rem = do_div(t, USEC_PER_SEC);
@@ -6216,10 +6222,15 @@ __init static int tracer_alloc_buffers(void)
 
         trace_init_cmdlines();
 
-        register_tracer(&nop_trace);
-
+        /*
+         * register_tracer() might reference current_trace, so it
+         * needs to be set before we register anything. This is
+         * just a bootstrap of current_trace anyway.
+         */
         global_trace.current_trace = &nop_trace;
 
+        register_tracer(&nop_trace);
+
         /* All seems OK, enable tracing */
         tracing_disabled = 0;
 
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 711ca7d3e7f1..20572ed88c5c 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -700,8 +700,6 @@ enum print_line_t print_trace_line(struct trace_iterator *iter);
 
 extern unsigned long trace_flags;
 
-extern int trace_clock_id;
-
 /* Standard output formatting function used for function return traces */
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index 55e2cf66967b..2901e3b88590 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -1159,7 +1159,7 @@ trace_selftest_startup_branch(struct tracer *trace, struct trace_array *tr)
         /* stop the tracing. */
         tracing_stop();
         /* check the trace buffer */
-        ret = trace_test_buffer(tr, &count);
+        ret = trace_test_buffer(&tr->trace_buffer, &count);
         trace->reset(tr);
         tracing_start();