91 files changed, 3458 insertions, 3479 deletions
diff --git a/kernel/capability.c b/kernel/capability.c
index 34019c57888d..a8d63df0c322 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -7,6 +7,8 @@
 * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
 */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/audit.h>
 #include <linux/capability.h>
 #include <linux/mm.h>
@@ -42,15 +44,10 @@ __setup("no_file_caps", file_caps_disable);
 static void warn_legacy_capability_use(void)
 {
-        static int warned;
+        char name[sizeof(current->comm)];
-        if (!warned) {
-                char name[sizeof(current->comm)];
+        pr_info_once("warning: `%s' uses 32-bit capabilities (legacy support in use)\n",
+                     get_task_comm(name, current));
-                printk(KERN_INFO "warning: `%s' uses 32-bit capabilities"
-                       " (legacy support in use)\n",
-                       get_task_comm(name, current));
-                warned = 1;
-        }
 }
 /*
@@ -71,16 +68,10 @@ static void warn_legacy_capability_use(void)
 static void warn_deprecated_v2(void)
 {
-        static int warned;
+        char name[sizeof(current->comm)];
-        if (!warned) {
+        pr_info_once("warning: `%s' uses deprecated v2 capabilities in a way that may be insecure\n",
-                char name[sizeof(current->comm)];
+                     get_task_comm(name, current));
-                printk(KERN_INFO "warning: `%s' uses deprecated v2"
-                       " capabilities in a way that may be insecure.\n",
-                       get_task_comm(name, current));
-                warned = 1;
-        }
 }
 /*
@@ -380,7 +371,7 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
 bool ns_capable(struct user_namespace *ns, int cap)
 {
        if (unlikely(!cap_valid(cap))) {
-                printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
+                pr_crit("capable() called with invalid cap=%u\n", cap);
                BUG();
        }
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 0c753ddd223b..9fcdaa705b6c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -40,23 +40,20 @@
 #include <linux/proc_fs.h>
 #include <linux/rcupdate.h>
 #include <linux/sched.h>
-#include <linux/backing-dev.h>
 #include <linux/slab.h>
-#include <linux/magic.h>
 #include <linux/spinlock.h>
+#include <linux/rwsem.h>
 #include <linux/string.h>
 #include <linux/sort.h>
 #include <linux/kmod.h>
-#include <linux/module.h>
 #include <linux/delayacct.h>
 #include <linux/cgroupstats.h>
 #include <linux/hashtable.h>
-#include <linux/namei.h>
 #include <linux/pid_namespace.h>
 #include <linux/idr.h>
 #include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
-#include <linux/flex_array.h> /* used in cgroup_attach_task */
 #include <linux/kthread.h>
+#include <linux/delay.h>
 #include <linux/atomic.h>
@@ -68,43 +65,49 @@
 */
 #define CGROUP_PIDLIST_DESTROY_DELAY    HZ
+#define CGROUP_FILE_NAME_MAX            (MAX_CGROUP_TYPE_NAMELEN +      \
+                                         MAX_CFTYPE_NAME + 2)
+/*
+ * cgroup_tree_mutex nests above cgroup_mutex and protects cftypes, file
+ * creation/removal and hierarchy changing operations including cgroup
+ * creation, removal, css association and controller rebinding.  This outer
+ * lock is needed mainly to resolve the circular dependency between kernfs
+ * active ref and cgroup_mutex.  cgroup_tree_mutex nests above both.
+ */
+static DEFINE_MUTEX(cgroup_tree_mutex);
 /*
 * cgroup_mutex is the master lock.  Any modification to cgroup or its
 * hierarchy must be performed while holding it.
 *
- * cgroup_root_mutex nests inside cgroup_mutex and should be held to modify
+ * css_set_rwsem protects task->cgroups pointer, the list of css_set
- * cgroupfs_root of any cgroup hierarchy - subsys list, flags,
+ * objects, and the chain of tasks off each css_set.
- * release_agent_path and so on.  Modifying requires both cgroup_mutex and
- * cgroup_root_mutex.  Readers can acquire either of the two.  This is to
- * break the following locking order cycle.
- *
- *  A. cgroup_mutex -> cred_guard_mutex -> s_type->i_mutex_key -> namespace_sem
- *  B. namespace_sem -> cgroup_mutex
 *
- * B happens only through cgroup_show_options() and using cgroup_root_mutex
+ * These locks are exported if CONFIG_PROVE_RCU so that accessors in
- * breaks it.
+ * cgroup.h can use them for lockdep annotations.
 */
 #ifdef CONFIG_PROVE_RCU
 DEFINE_MUTEX(cgroup_mutex);
-EXPORT_SYMBOL_GPL(cgroup_mutex);        /* only for lockdep */
+DECLARE_RWSEM(css_set_rwsem);
+EXPORT_SYMBOL_GPL(cgroup_mutex);
+EXPORT_SYMBOL_GPL(css_set_rwsem);
 #else
 static DEFINE_MUTEX(cgroup_mutex);
+static DECLARE_RWSEM(css_set_rwsem);
 #endif
-static DEFINE_MUTEX(cgroup_root_mutex);
+/*
+ * Protects cgroup_subsys->release_agent_path.  Modifying it also requires
+ * cgroup_mutex.  Reading requires either cgroup_mutex or this spinlock.
+ */
+static DEFINE_SPINLOCK(release_agent_path_lock);
-#define cgroup_assert_mutex_or_rcu_locked()                             \
+#define cgroup_assert_mutexes_or_rcu_locked()                           \
        rcu_lockdep_assert(rcu_read_lock_held() ||                      \
+                           lockdep_is_held(&cgroup_tree_mutex) ||       \
                           lockdep_is_held(&cgroup_mutex),              \
-                           "cgroup_mutex or RCU read lock required");
+                           "cgroup_[tree_]mutex or RCU read lock required");
-#ifdef CONFIG_LOCKDEP
-#define cgroup_assert_mutex_or_root_locked()                            \
-        WARN_ON_ONCE(debug_locks && (!lockdep_is_held(&cgroup_mutex) && \
-                                     !lockdep_is_held(&cgroup_root_mutex)))
-#else
-#define cgroup_assert_mutex_or_root_locked()    do { } while (0)
-#endif
 /*
 * cgroup destruction makes heavy use of work items and there can be a lot
@@ -120,42 +123,41 @@ static struct workqueue_struct *cgroup_destroy_wq;
 */
 static struct workqueue_struct *cgroup_pidlist_destroy_wq;
-/*
+/* generate an array of cgroup subsystem pointers */
- * Generate an array of cgroup subsystem pointers. At boot time, this is
+#define SUBSYS(_x) [_x ## _cgrp_id] = &_x ## _cgrp_subsys,
- * populated with the built in subsystems, and modular subsystems are
+static struct cgroup_subsys *cgroup_subsys[] = {
- * registered after that. The mutable section of this array is protected by
+#include <linux/cgroup_subsys.h>
- * cgroup_mutex.
+};
- */
+#undef SUBSYS
-#define SUBSYS(_x) [_x ## _subsys_id] = &_x ## _subsys,
-#define IS_SUBSYS_ENABLED(option) IS_BUILTIN(option)
+/* array of cgroup subsystem names */
-static struct cgroup_subsys *cgroup_subsys[CGROUP_SUBSYS_COUNT] = {
+#define SUBSYS(_x) [_x ## _cgrp_id] = #_x,
+static const char *cgroup_subsys_name[] = {
 #include <linux/cgroup_subsys.h>
 };
+#undef SUBSYS
 /*
- * The dummy hierarchy, reserved for the subsystems that are otherwise
+ * The default hierarchy, reserved for the subsystems that are otherwise
 * unattached - it never has more than a single cgroup, and all tasks are
 * part of that cgroup.
 */
-static struct cgroupfs_root cgroup_dummy_root;
+struct cgroup_root cgrp_dfl_root;
-/* dummy_top is a shorthand for the dummy hierarchy's top cgroup */
+/*
-static struct cgroup * const cgroup_dummy_top = &cgroup_dummy_root.top_cgroup;
+ * The default hierarchy always exists but is hidden until mounted for the
+ * first time.  This is for backward compatibility.
+ */
+static bool cgrp_dfl_root_visible;
 /* The list of hierarchy roots */
 static LIST_HEAD(cgroup_roots);
 static int cgroup_root_count;
-/*
+/* hierarchy ID allocation and mapping, protected by cgroup_mutex */
- * Hierarchy ID allocation and mapping.  It follows the same exclusion
- * rules as other root ops - both cgroup_mutex and cgroup_root_mutex for
- * writes, either for reads.
- */
 static DEFINE_IDR(cgroup_hierarchy_idr);
-static struct cgroup_name root_cgroup_name = { .name = "/" };
 /*
 * Assign a monotonically increasing serial number to cgroups.  It
 * guarantees cgroups with bigger numbers are newer than those with smaller
@@ -175,11 +177,13 @@ static int need_forkexit_callback __read_mostly;
 static struct cftype cgroup_base_files[];
+static void cgroup_put(struct cgroup *cgrp);
+static int rebind_subsystems(struct cgroup_root *dst_root,
+                             unsigned long ss_mask);
 static void cgroup_destroy_css_killed(struct cgroup *cgrp);
 static int cgroup_destroy_locked(struct cgroup *cgrp);
 static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
                              bool is_add);
-static int cgroup_file_release(struct inode *inode, struct file *file);
 static void cgroup_pidlist_destroy_all(struct cgroup *cgrp);
 /**
@@ -197,8 +201,9 @@ static struct cgroup_subsys_state *cgroup_css(struct cgroup *cgrp,
                                              struct cgroup_subsys *ss)
 {
        if (ss)
-                return rcu_dereference_check(cgrp->subsys[ss->subsys_id],
+                return rcu_dereference_check(cgrp->subsys[ss->id],
-                                             lockdep_is_held(&cgroup_mutex));
+                                        lockdep_is_held(&cgroup_tree_mutex) ||
+                                        lockdep_is_held(&cgroup_mutex));
        else
                return &cgrp->dummy_css;
 }
@@ -209,6 +214,27 @@ static inline bool cgroup_is_dead(const struct cgroup *cgrp)
        return test_bit(CGRP_DEAD, &cgrp->flags);
 }
+struct cgroup_subsys_state *seq_css(struct seq_file *seq)
+{
+        struct kernfs_open_file *of = seq->private;
+        struct cgroup *cgrp = of->kn->parent->priv;
+        struct cftype *cft = seq_cft(seq);
+        /*
+         * This is open and unprotected implementation of cgroup_css().
+         * seq_css() is only called from a kernfs file operation which has
+         * an active reference on the file.  Because all the subsystem
+         * files are drained before a css is disassociated with a cgroup,
+         * the matching css from the cgroup's subsys table is guaranteed to
+         * be and stay valid until the enclosing operation is complete.
+         */
+        if (cft->ss)
+                return rcu_dereference_raw(cgrp->subsys[cft->ss->id]);
+        else
+                return &cgrp->dummy_css;
+}
+EXPORT_SYMBOL_GPL(seq_css);
 /**
 * cgroup_is_descendant - test ancestry
 * @cgrp: the cgroup to be tested
@@ -227,7 +253,6 @@ bool cgroup_is_descendant(struct cgroup *cgrp, struct cgroup *ancestor)
        }
        return false;
 }
-EXPORT_SYMBOL_GPL(cgroup_is_descendant);
 static int cgroup_is_releasable(const struct cgroup *cgrp)
 {
@@ -254,54 +279,23 @@ static int notify_on_release(const struct cgroup *cgrp)
        for ((ssid) = 0; (ssid) < CGROUP_SUBSYS_COUNT; (ssid)++)        \
                if (!((css) = rcu_dereference_check(                    \
                                (cgrp)->subsys[(ssid)],                 \
+                                lockdep_is_held(&cgroup_tree_mutex) ||  \
                                lockdep_is_held(&cgroup_mutex)))) { }   \
                else
 /**
- * for_each_subsys - iterate all loaded cgroup subsystems
+ * for_each_subsys - iterate all enabled cgroup subsystems
 * @ss: the iteration cursor
 * @ssid: the index of @ss, CGROUP_SUBSYS_COUNT after reaching the end
- *
- * Iterates through all loaded subsystems.  Should be called under
- * cgroup_mutex or cgroup_root_mutex.
 */
 #define for_each_subsys(ss, ssid)                                       \
-        for (({ cgroup_assert_mutex_or_root_locked(); (ssid) = 0; });   \
+        for ((ssid) = 0; (ssid) < CGROUP_SUBSYS_COUNT &&                \
-             (ssid) < CGROUP_SUBSYS_COUNT; (ssid)++)                    \
+             (((ss) = cgroup_subsys[ssid]) || true); (ssid)++)
-                if (!((ss) = cgroup_subsys[(ssid)])) { }                \
-                else
-/**
+/* iterate across the hierarchies */
- * for_each_builtin_subsys - iterate all built-in cgroup subsystems
+#define for_each_root(root)                                             \
- * @ss: the iteration cursor
- * @i: the index of @ss, CGROUP_BUILTIN_SUBSYS_COUNT after reaching the end
- *
- * Bulit-in subsystems are always present and iteration itself doesn't
- * require any synchronization.
- */
-#define for_each_builtin_subsys(ss, i)                                  \
-        for ((i) = 0; (i) < CGROUP_BUILTIN_SUBSYS_COUNT &&              \
-             (((ss) = cgroup_subsys[i]) || true); (i)++)
-/* iterate across the active hierarchies */
-#define for_each_active_root(root)                                      \
        list_for_each_entry((root), &cgroup_roots, root_list)
-static inline struct cgroup *__d_cgrp(struct dentry *dentry)
-{
-        return dentry->d_fsdata;
-}
-static inline struct cfent *__d_cfe(struct dentry *dentry)
-{
-        return dentry->d_fsdata;
-}
-static inline struct cftype *__d_cft(struct dentry *dentry)
-{
-        return __d_cfe(dentry)->type;
-}
 /**
 * cgroup_lock_live_group - take cgroup_mutex and check that cgrp is alive.
 * @cgrp: the cgroup to be checked for liveness
@@ -347,23 +341,23 @@ struct cgrp_cset_link {
        struct list_head        cgrp_link;
 };
-/* The default css_set - used by init and its children prior to any
+/*
+ * The default css_set - used by init and its children prior to any
 * hierarchies being mounted. It contains a pointer to the root state
 * for each subsystem. Also used to anchor the list of css_sets. Not
 * reference-counted, to improve performance when child cgroups
 * haven't been created.
 */
+static struct css_set init_css_set = {
+        .refcount               = ATOMIC_INIT(1),
+        .cgrp_links             = LIST_HEAD_INIT(init_css_set.cgrp_links),
+        .tasks                  = LIST_HEAD_INIT(init_css_set.tasks),
+        .mg_tasks               = LIST_HEAD_INIT(init_css_set.mg_tasks),
+        .mg_preload_node        = LIST_HEAD_INIT(init_css_set.mg_preload_node),
+        .mg_node                = LIST_HEAD_INIT(init_css_set.mg_node),
+};
-static struct css_set init_css_set;
+static int css_set_count        = 1;    /* 1 for init_css_set */
-static struct cgrp_cset_link init_cgrp_cset_link;
-/*
- * css_set_lock protects the list of css_set objects, and the chain of
- * tasks off each css_set.  Nests outside task->alloc_lock due to
- * css_task_iter_start().
- */
-static DEFINE_RWLOCK(css_set_lock);
-static int css_set_count;
 /*
 * hash table for cgroup groups. This improves the performance to find
@@ -386,30 +380,14 @@ static unsigned long css_set_hash(struct cgroup_subsys_state *css[])
        return key;
 }
-/*
+static void put_css_set_locked(struct css_set *cset, bool taskexit)
- * We don't maintain the lists running through each css_set to its task
- * until after the first call to css_task_iter_start().  This reduces the
- * fork()/exit() overhead for people who have cgroups compiled into their
- * kernel but not actually in use.
- */
-static int use_task_css_set_links __read_mostly;
-static void __put_css_set(struct css_set *cset, int taskexit)
 {
        struct cgrp_cset_link *link, *tmp_link;
-        /*
+        lockdep_assert_held(&css_set_rwsem);
-         * Ensure that the refcount doesn't hit zero while any readers
-         * can see it. Similar to atomic_dec_and_lock(), but for an
+        if (!atomic_dec_and_test(&cset->refcount))
-         * rwlock
-         */
-        if (atomic_add_unless(&cset->refcount, -1, 1))
-                return;
-        write_lock(&css_set_lock);
-        if (!atomic_dec_and_test(&cset->refcount)) {
-                write_unlock(&css_set_lock);
                return;
-        }
        /* This css_set is dead. unlink it and release cgroup refcounts */
        hash_del(&cset->hlist);
@@ -421,7 +399,7 @@ static void __put_css_set(struct css_set *cset, int taskexit)
                list_del(&link->cset_link);
                list_del(&link->cgrp_link);
-                /* @cgrp can't go away while we're holding css_set_lock */
+                /* @cgrp can't go away while we're holding css_set_rwsem */
                if (list_empty(&cgrp->cset_links) && notify_on_release(cgrp)) {
                        if (taskexit)
                                set_bit(CGRP_RELEASABLE, &cgrp->flags);
@@ -431,10 +409,24 @@ static void __put_css_set(struct css_set *cset, int taskexit)
                kfree(link);
        }
-        write_unlock(&css_set_lock);
        kfree_rcu(cset, rcu_head);
 }
+static void put_css_set(struct css_set *cset, bool taskexit)
+{
+        /*
+         * Ensure that the refcount doesn't hit zero while any readers
+         * can see it. Similar to atomic_dec_and_lock(), but for an
+         * rwlock
+         */
+        if (atomic_add_unless(&cset->refcount, -1, 1))
+                return;
+        down_write(&css_set_rwsem);
+        put_css_set_locked(cset, taskexit);
+        up_write(&css_set_rwsem);
+}
 /*
 * refcounted get/put for css_set objects
 */
@@ -443,16 +435,6 @@ static inline void get_css_set(struct css_set *cset)
        atomic_inc(&cset->refcount);
 }
-static inline void put_css_set(struct css_set *cset)
-{
-        __put_css_set(cset, 0);
-}
-static inline void put_css_set_taskexit(struct css_set *cset)
-{
-        __put_css_set(cset, 1);
-}
 /**
 * compare_css_sets - helper function for find_existing_css_set().
 * @cset: candidate css_set being tested
@@ -535,7 +517,7 @@ static struct css_set *find_existing_css_set(struct css_set *old_cset,
                                        struct cgroup *cgrp,
                                        struct cgroup_subsys_state *template[])
 {
-        struct cgroupfs_root *root = cgrp->root;
+        struct cgroup_root *root = cgrp->root;
        struct cgroup_subsys *ss;
        struct css_set *cset;
        unsigned long key;
@@ -547,7 +529,7 @@ static struct css_set *find_existing_css_set(struct css_set *old_cset,
         * won't change, so no need for locking.
         */
        for_each_subsys(ss, i) {
-                if (root->subsys_mask & (1UL << i)) {
+                if (root->cgrp.subsys_mask & (1UL << i)) {
                        /* Subsystem is in this hierarchy. So we want
                         * the subsystem state from the new
                         * cgroup */
@@ -652,11 +634,11 @@ static struct css_set *find_css_set(struct css_set *old_cset,
        /* First see if we already have a cgroup group that matches
         * the desired set */
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
        cset = find_existing_css_set(old_cset, cgrp, template);
        if (cset)
                get_css_set(cset);
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
        if (cset)
                return cset;
@@ -674,13 +656,16 @@ static struct css_set *find_css_set(struct css_set *old_cset,
        atomic_set(&cset->refcount, 1);
        INIT_LIST_HEAD(&cset->cgrp_links);
        INIT_LIST_HEAD(&cset->tasks);
+        INIT_LIST_HEAD(&cset->mg_tasks);
+        INIT_LIST_HEAD(&cset->mg_preload_node);
+        INIT_LIST_HEAD(&cset->mg_node);
        INIT_HLIST_NODE(&cset->hlist);
        /* Copy the set of subsystem state objects generated in
         * find_existing_css_set() */
        memcpy(cset->subsys, template, sizeof(cset->subsys));
-        write_lock(&css_set_lock);
+        down_write(&css_set_rwsem);
        /* Add reference counts and links from the new css_set. */
        list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) {
                struct cgroup *c = link->cgrp;
@@ -698,31 +683,105 @@ static struct css_set *find_css_set(struct css_set *old_cset,
        key = css_set_hash(cset->subsys);
        hash_add(css_set_table, &cset->hlist, key);
-        write_unlock(&css_set_lock);
+        up_write(&css_set_rwsem);
        return cset;
 }
-/*
+static struct cgroup_root *cgroup_root_from_kf(struct kernfs_root *kf_root)
- * Return the cgroup for "task" from the given hierarchy. Must be
- * called with cgroup_mutex held.
- */
-static struct cgroup *task_cgroup_from_root(struct task_struct *task,
-                                            struct cgroupfs_root *root)
 {
-        struct css_set *cset;
+        struct cgroup *root_cgrp = kf_root->kn->priv;
-        struct cgroup *res = NULL;
+        return root_cgrp->root;
+}
+static int cgroup_init_root_id(struct cgroup_root *root)
+{
+        int id;
+        lockdep_assert_held(&cgroup_mutex);
+        id = idr_alloc_cyclic(&cgroup_hierarchy_idr, root, 0, 0, GFP_KERNEL);
+        if (id < 0)
+                return id;
+        root->hierarchy_id = id;
+        return 0;
+}
+static void cgroup_exit_root_id(struct cgroup_root *root)
+{
+        lockdep_assert_held(&cgroup_mutex);
+        if (root->hierarchy_id) {
+                idr_remove(&cgroup_hierarchy_idr, root->hierarchy_id);
+                root->hierarchy_id = 0;
+        }
+}
+static void cgroup_free_root(struct cgroup_root *root)
+{
+        if (root) {
+                /* hierarhcy ID shoulid already have been released */
+                WARN_ON_ONCE(root->hierarchy_id);
+                idr_destroy(&root->cgroup_idr);
+                kfree(root);
+        }
+}
+static void cgroup_destroy_root(struct cgroup_root *root)
+{
+        struct cgroup *cgrp = &root->cgrp;
+        struct cgrp_cset_link *link, *tmp_link;
+        mutex_lock(&cgroup_tree_mutex);
+        mutex_lock(&cgroup_mutex);
+        BUG_ON(atomic_read(&root->nr_cgrps));
+        BUG_ON(!list_empty(&cgrp->children));
+        /* Rebind all subsystems back to the default hierarchy */
+        rebind_subsystems(&cgrp_dfl_root, cgrp->subsys_mask);
-        BUG_ON(!mutex_is_locked(&cgroup_mutex));
-        read_lock(&css_set_lock);
        /*
-         * No need to lock the task - since we hold cgroup_mutex the
+         * Release all the links from cset_links to this hierarchy's
-         * task can't change groups, so the only thing that can happen
+         * root cgroup
-         * is that it exits and its css is set back to init_css_set.
         */
-        cset = task_css_set(task);
+        down_write(&css_set_rwsem);
+        list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
+                list_del(&link->cset_link);
+                list_del(&link->cgrp_link);
+                kfree(link);
+        }
+        up_write(&css_set_rwsem);
+        if (!list_empty(&root->root_list)) {
+                list_del(&root->root_list);
+                cgroup_root_count--;
+        }
+        cgroup_exit_root_id(root);
+        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
+        kernfs_destroy_root(root->kf_root);
+        cgroup_free_root(root);
+}
+/* look up cgroup associated with given css_set on the specified hierarchy */
+static struct cgroup *cset_cgroup_from_root(struct css_set *cset,
+                                            struct cgroup_root *root)
+{
+        struct cgroup *res = NULL;
+        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&css_set_rwsem);
        if (cset == &init_css_set) {
-                res = &root->top_cgroup;
+                res = &root->cgrp;
        } else {
                struct cgrp_cset_link *link;
@@ -735,16 +794,27 @@ static struct cgroup *task_cgroup_from_root(struct task_struct *task,
                        }
                }
        }
-        read_unlock(&css_set_lock);
        BUG_ON(!res);
        return res;
 }
 /*
- * There is one global cgroup mutex. We also require taking
+ * Return the cgroup for "task" from the given hierarchy. Must be
- * task_lock() when dereferencing a task's cgroup subsys pointers.
+ * called with cgroup_mutex and css_set_rwsem held.
- * See "The task_lock() exception", at the end of this comment.
+ */
- *
+static struct cgroup *task_cgroup_from_root(struct task_struct *task,
+                                            struct cgroup_root *root)
+{
+        /*
+         * No need to lock the task - since we hold cgroup_mutex the
+         * task can't change groups, so the only thing that can happen
+         * is that it exits and its css is set back to init_css_set.
+         */
+        return cset_cgroup_from_root(task_css_set(task), root);
+}
+/*
 * A task must hold cgroup_mutex to modify cgroups.
 *
 * Any task can increment and decrement the count field without lock.
@@ -770,98 +840,79 @@ static struct cgroup *task_cgroup_from_root(struct task_struct *task,
 * A cgroup can only be deleted if both its 'count' of using tasks
 * is zero, and its list of 'children' cgroups is empty.  Since all
 * tasks in the system use _some_ cgroup, and since there is always at
- * least one task in the system (init, pid == 1), therefore, top_cgroup
+ * least one task in the system (init, pid == 1), therefore, root cgroup
 * always has either children cgroups and/or using tasks.  So we don't
- * need a special hack to ensure that top_cgroup cannot be deleted.
+ * need a special hack to ensure that root cgroup cannot be deleted.
- *
- *      The task_lock() exception
- *
- * The need for this exception arises from the action of
- * cgroup_attach_task(), which overwrites one task's cgroup pointer with
- * another.  It does so using cgroup_mutex, however there are
- * several performance critical places that need to reference
- * task->cgroup without the expense of grabbing a system global
- * mutex.  Therefore except as noted below, when dereferencing or, as
- * in cgroup_attach_task(), modifying a task's cgroup pointer we use
- * task_lock(), which acts on a spinlock (task->alloc_lock) already in
- * the task_struct routinely used for such matters.
 *
 * P.S.  One more locking exception.  RCU is used to guard the
 * update of a tasks cgroup pointer by cgroup_attach_task()
 */
-/*
- * A couple of forward declarations required, due to cyclic reference loop:
- * cgroup_mkdir -> cgroup_create -> cgroup_populate_dir ->
- * cgroup_add_file -> cgroup_create_file -> cgroup_dir_inode_operations
- * -> cgroup_mkdir.
- */
-static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
-static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry);
 static int cgroup_populate_dir(struct cgroup *cgrp, unsigned long subsys_mask);
-static const struct inode_operations cgroup_dir_inode_operations;
+static struct kernfs_syscall_ops cgroup_kf_syscall_ops;
 static const struct file_operations proc_cgroupstats_operations;
-static struct backing_dev_info cgroup_backing_dev_info = {
+static char *cgroup_file_name(struct cgroup *cgrp, const struct cftype *cft,
-        .name           = "cgroup",
+                              char *buf)
-        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
-};
-static struct inode *cgroup_new_inode(umode_t mode, struct super_block *sb)
 {
-        struct inode *inode = new_inode(sb);
+        if (cft->ss && !(cft->flags & CFTYPE_NO_PREFIX) &&
+            !(cgrp->root->flags & CGRP_ROOT_NOPREFIX))
-        if (inode) {
+                snprintf(buf, CGROUP_FILE_NAME_MAX, "%s.%s",
-                inode->i_ino = get_next_ino();
+                         cft->ss->name, cft->name);
-                inode->i_mode = mode;
+        else
-                inode->i_uid = current_fsuid();
+                strncpy(buf, cft->name, CGROUP_FILE_NAME_MAX);
-                inode->i_gid = current_fsgid();
+        return buf;
-                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-                inode->i_mapping->backing_dev_info = &cgroup_backing_dev_info;
-        }
-        return inode;
 }
-static struct cgroup_name *cgroup_alloc_name(struct dentry *dentry)
+/**
+ * cgroup_file_mode - deduce file mode of a control file
+ * @cft: the control file in question
+ *
+ * returns cft->mode if ->mode is not 0
+ * returns S_IRUGO|S_IWUSR if it has both a read and a write handler
+ * returns S_IRUGO if it has only a read handler
+ * returns S_IWUSR if it has only a write hander
+ */
+static umode_t cgroup_file_mode(const struct cftype *cft)
 {
-        struct cgroup_name *name;
+        umode_t mode = 0;
-        name = kmalloc(sizeof(*name) + dentry->d_name.len + 1, GFP_KERNEL);
+        if (cft->mode)
-        if (!name)
+                return cft->mode;
-                return NULL;
-        strcpy(name->name, dentry->d_name.name);
+        if (cft->read_u64 || cft->read_s64 || cft->seq_show)
-        return name;
+                mode |= S_IRUGO;
+        if (cft->write_u64 || cft->write_s64 || cft->write_string ||
+            cft->trigger)
+                mode |= S_IWUSR;
+        return mode;
 }
 static void cgroup_free_fn(struct work_struct *work)
 {
        struct cgroup *cgrp = container_of(work, struct cgroup, destroy_work);
-        mutex_lock(&cgroup_mutex);
+        atomic_dec(&cgrp->root->nr_cgrps);
-        cgrp->root->number_of_cgroups--;
-        mutex_unlock(&cgroup_mutex);
-        /*
-         * We get a ref to the parent's dentry, and put the ref when
-         * this cgroup is being freed, so it's guaranteed that the
-         * parent won't be destroyed before its children.
-         */
-        dput(cgrp->parent->dentry);
-        /*
-         * Drop the active superblock reference that we took when we
-         * created the cgroup. This will free cgrp->root, if we are
-         * holding the last reference to @sb.
-         */
-        deactivate_super(cgrp->root->sb);
        cgroup_pidlist_destroy_all(cgrp);
-        simple_xattrs_free(&cgrp->xattrs);
+        if (cgrp->parent) {
+                /*
-        kfree(rcu_dereference_raw(cgrp->name));
+                 * We get a ref to the parent, and put the ref when this
-        kfree(cgrp);
+                 * cgroup is being freed, so it's guaranteed that the
+                 * parent won't be destroyed before its children.
+                 */
+                cgroup_put(cgrp->parent);
+                kernfs_put(cgrp->kn);
+                kfree(cgrp);
+        } else {
+                /*
+                 * This is root cgroup's refcnt reaching zero, which
+                 * indicates that the root should be released.
+                 */
+                cgroup_destroy_root(cgrp->root);
+        }
 }
 static void cgroup_free_rcu(struct rcu_head *head)
@@ -872,73 +923,40 @@ static void cgroup_free_rcu(struct rcu_head *head)
        queue_work(cgroup_destroy_wq, &cgrp->destroy_work);
 }
-static void cgroup_diput(struct dentry *dentry, struct inode *inode)
+static void cgroup_get(struct cgroup *cgrp)
-{
-        /* is dentry a directory ? if so, kfree() associated cgroup */
-        if (S_ISDIR(inode->i_mode)) {
-                struct cgroup *cgrp = dentry->d_fsdata;
-                BUG_ON(!(cgroup_is_dead(cgrp)));
-                /*
-                 * XXX: cgrp->id is only used to look up css's.  As cgroup
-                 * and css's lifetimes will be decoupled, it should be made
-                 * per-subsystem and moved to css->id so that lookups are
-                 * successful until the target css is released.
-                 */
-                mutex_lock(&cgroup_mutex);
-                idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
-                mutex_unlock(&cgroup_mutex);
-                cgrp->id = -1;
-                call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
-        } else {
-                struct cfent *cfe = __d_cfe(dentry);
-                struct cgroup *cgrp = dentry->d_parent->d_fsdata;
-                WARN_ONCE(!list_empty(&cfe->node) &&
-                          cgrp != &cgrp->root->top_cgroup,
-                          "cfe still linked for %s\n", cfe->type->name);
-                simple_xattrs_free(&cfe->xattrs);
-                kfree(cfe);
-        }
-        iput(inode);
-}
-static void remove_dir(struct dentry *d)
 {
-        struct dentry *parent = dget(d->d_parent);
+        WARN_ON_ONCE(cgroup_is_dead(cgrp));
+        WARN_ON_ONCE(atomic_read(&cgrp->refcnt) <= 0);
-        d_delete(d);
+        atomic_inc(&cgrp->refcnt);
-        simple_rmdir(parent->d_inode, d);
-        dput(parent);
 }
-static void cgroup_rm_file(struct cgroup *cgrp, const struct cftype *cft)
+static void cgroup_put(struct cgroup *cgrp)
 {
-        struct cfent *cfe;
+        if (!atomic_dec_and_test(&cgrp->refcnt))
+                return;
-        lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
+        if (WARN_ON_ONCE(cgrp->parent && !cgroup_is_dead(cgrp)))
-        lockdep_assert_held(&cgroup_mutex);
+                return;
        /*
-         * If we're doing cleanup due to failure of cgroup_create(),
+         * XXX: cgrp->id is only used to look up css's.  As cgroup and
-         * the corresponding @cfe may not exist.
+         * css's lifetimes will be decoupled, it should be made
+         * per-subsystem and moved to css->id so that lookups are
+         * successful until the target css is released.
         */
-        list_for_each_entry(cfe, &cgrp->files, node) {
+        mutex_lock(&cgroup_mutex);
-                struct dentry *d = cfe->dentry;
+        idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+        mutex_unlock(&cgroup_mutex);
+        cgrp->id = -1;
-                if (cft && cfe->type != cft)
+        call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
-                        continue;
+}
-                dget(d);
+static void cgroup_rm_file(struct cgroup *cgrp, const struct cftype *cft)
-                d_delete(d);
+{
-                simple_unlink(cgrp->dentry->d_inode, d);
+        char name[CGROUP_FILE_NAME_MAX];
-                list_del_init(&cfe->node);
-                dput(d);
-                break;
+        lockdep_assert_held(&cgroup_tree_mutex);
-        }
+        kernfs_remove_by_name(cgrp->kn, cgroup_file_name(cgrp, cft, name));
 }
 /**
@@ -952,144 +970,106 @@ static void cgroup_clear_dir(struct cgroup *cgrp, unsigned long subsys_mask)
        int i;
        for_each_subsys(ss, i) {
-                struct cftype_set *set;
+                struct cftype *cfts;
                if (!test_bit(i, &subsys_mask))
                        continue;
-                list_for_each_entry(set, &ss->cftsets, node)
+                list_for_each_entry(cfts, &ss->cfts, node)
-                        cgroup_addrm_files(cgrp, set->cfts, false);
+                        cgroup_addrm_files(cgrp, cfts, false);
        }
 }
-/*
+static int rebind_subsystems(struct cgroup_root *dst_root,
- * NOTE : the dentry must have been dget()'ed
+                             unsigned long ss_mask)
- */
-static void cgroup_d_remove_dir(struct dentry *dentry)
-{
-        struct dentry *parent;
-        parent = dentry->d_parent;
-        spin_lock(&parent->d_lock);
-        spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
-        list_del_init(&dentry->d_u.d_child);
-        spin_unlock(&dentry->d_lock);
-        spin_unlock(&parent->d_lock);
-        remove_dir(dentry);
-}
-/*
- * Call with cgroup_mutex held. Drops reference counts on modules, including
- * any duplicate ones that parse_cgroupfs_options took. If this function
- * returns an error, no reference counts are touched.
- */
-static int rebind_subsystems(struct cgroupfs_root *root,
-                             unsigned long added_mask, unsigned removed_mask)
 {
-        struct cgroup *cgrp = &root->top_cgroup;
        struct cgroup_subsys *ss;
-        unsigned long pinned = 0;
+        int ssid, ret;
-        int i, ret;
-        BUG_ON(!mutex_is_locked(&cgroup_mutex));
+        lockdep_assert_held(&cgroup_tree_mutex);
-        BUG_ON(!mutex_is_locked(&cgroup_root_mutex));
+        lockdep_assert_held(&cgroup_mutex);
-        /* Check that any added subsystems are currently free */
+        for_each_subsys(ss, ssid) {
-        for_each_subsys(ss, i) {
+                if (!(ss_mask & (1 << ssid)))
-                if (!(added_mask & (1 << i)))
                        continue;
-                /* is the subsystem mounted elsewhere? */
+                /* if @ss is on the dummy_root, we can always move it */
-                if (ss->root != &cgroup_dummy_root) {
+                if (ss->root == &cgrp_dfl_root)
-                        ret = -EBUSY;
+                        continue;
-                        goto out_put;
-                }
-                /* pin the module */
+                /* if @ss has non-root cgroups attached to it, can't move */
-                if (!try_module_get(ss->module)) {
+                if (!list_empty(&ss->root->cgrp.children))
-                        ret = -ENOENT;
+                        return -EBUSY;
-                        goto out_put;
-                }
-                pinned |= 1 << i;
-        }
-        /* subsys could be missing if unloaded between parsing and here */
+                /* can't move between two non-dummy roots either */
-        if (added_mask != pinned) {
+                if (dst_root != &cgrp_dfl_root)
-                ret = -ENOENT;
+                        return -EBUSY;
-                goto out_put;
        }
-        ret = cgroup_populate_dir(cgrp, added_mask);
+        ret = cgroup_populate_dir(&dst_root->cgrp, ss_mask);
-        if (ret)
+        if (ret) {
-                goto out_put;
+                if (dst_root != &cgrp_dfl_root)
+                        return ret;
+                /*
+                 * Rebinding back to the default root is not allowed to
+                 * fail.  Using both default and non-default roots should
+                 * be rare.  Moving subsystems back and forth even more so.
+                 * Just warn about it and continue.
+                 */
+                if (cgrp_dfl_root_visible) {
+                        pr_warning("cgroup: failed to create files (%d) while rebinding 0x%lx to default root\n",
+                                   ret, ss_mask);
+                        pr_warning("cgroup: you may retry by moving them to a different hierarchy and unbinding\n");
+                }
+        }
        /*
         * Nothing can fail from this point on.  Remove files for the
         * removed subsystems and rebind each subsystem.
         */
-        cgroup_clear_dir(cgrp, removed_mask);
+        mutex_unlock(&cgroup_mutex);
+        for_each_subsys(ss, ssid)
-        for_each_subsys(ss, i) {
+                if (ss_mask & (1 << ssid))
-                unsigned long bit = 1UL << i;
+                        cgroup_clear_dir(&ss->root->cgrp, 1 << ssid);
+        mutex_lock(&cgroup_mutex);
-                if (bit & added_mask) {
-                        /* We're binding this subsystem to this hierarchy */
-                        BUG_ON(cgroup_css(cgrp, ss));
-                        BUG_ON(!cgroup_css(cgroup_dummy_top, ss));
-                        BUG_ON(cgroup_css(cgroup_dummy_top, ss)->cgroup != cgroup_dummy_top);
-                        rcu_assign_pointer(cgrp->subsys[i],
+        for_each_subsys(ss, ssid) {
-                                           cgroup_css(cgroup_dummy_top, ss));
+                struct cgroup_root *src_root;
-                        cgroup_css(cgrp, ss)->cgroup = cgrp;
+                struct cgroup_subsys_state *css;
-                        ss->root = root;
+                if (!(ss_mask & (1 << ssid)))
-                        if (ss->bind)
+                        continue;
-                                ss->bind(cgroup_css(cgrp, ss));
-                        /* refcount was already taken, and we're keeping it */
+                src_root = ss->root;
-                        root->subsys_mask |= bit;
+                css = cgroup_css(&src_root->cgrp, ss);
-                } else if (bit & removed_mask) {
-                        /* We're removing this subsystem */
-                        BUG_ON(cgroup_css(cgrp, ss) != cgroup_css(cgroup_dummy_top, ss));
-                        BUG_ON(cgroup_css(cgrp, ss)->cgroup != cgrp);
-                        if (ss->bind)
+                WARN_ON(!css || cgroup_css(&dst_root->cgrp, ss));
-                                ss->bind(cgroup_css(cgroup_dummy_top, ss));
-                        cgroup_css(cgroup_dummy_top, ss)->cgroup = cgroup_dummy_top;
+                RCU_INIT_POINTER(src_root->cgrp.subsys[ssid], NULL);
-                        RCU_INIT_POINTER(cgrp->subsys[i], NULL);
+                rcu_assign_pointer(dst_root->cgrp.subsys[ssid], css);
+                ss->root = dst_root;
+                css->cgroup = &dst_root->cgrp;
-                        cgroup_subsys[i]->root = &cgroup_dummy_root;
+                src_root->cgrp.subsys_mask &= ~(1 << ssid);
+                dst_root->cgrp.subsys_mask |= 1 << ssid;
-                        /* subsystem is now free - drop reference on module */
+                if (ss->bind)
-                        module_put(ss->module);
+                        ss->bind(css);
-                        root->subsys_mask &= ~bit;
-                }
        }
-        /*
+        kernfs_activate(dst_root->cgrp.kn);
-         * Mark @root has finished binding subsystems.  @root->subsys_mask
-         * now matches the bound subsystems.
-         */
-        root->flags |= CGRP_ROOT_SUBSYS_BOUND;
        return 0;
-out_put:
-        for_each_subsys(ss, i)
-                if (pinned & (1 << i))
-                        module_put(ss->module);
-        return ret;
 }
-static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
+static int cgroup_show_options(struct seq_file *seq,
+                               struct kernfs_root *kf_root)
 {
-        struct cgroupfs_root *root = dentry->d_sb->s_fs_info;
+        struct cgroup_root *root = cgroup_root_from_kf(kf_root);
        struct cgroup_subsys *ss;
        int ssid;
-        mutex_lock(&cgroup_root_mutex);
        for_each_subsys(ss, ssid)
-                if (root->subsys_mask & (1 << ssid))
+                if (root->cgrp.subsys_mask & (1 << ssid))
                        seq_printf(seq, ",%s", ss->name);
        if (root->flags & CGRP_ROOT_SANE_BEHAVIOR)
                seq_puts(seq, ",sane_behavior");
@@ -1097,13 +1077,16 @@ static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
                seq_puts(seq, ",noprefix");
        if (root->flags & CGRP_ROOT_XATTR)
                seq_puts(seq, ",xattr");
+        spin_lock(&release_agent_path_lock);
        if (strlen(root->release_agent_path))
                seq_printf(seq, ",release_agent=%s", root->release_agent_path);
-        if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags))
+        spin_unlock(&release_agent_path_lock);
+        if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags))
                seq_puts(seq, ",clone_children");
        if (strlen(root->name))
                seq_printf(seq, ",name=%s", root->name);
-        mutex_unlock(&cgroup_root_mutex);
        return 0;
 }
@@ -1115,9 +1098,6 @@ struct cgroup_sb_opts {
        char *name;
        /* User explicitly requested empty subsystem */
        bool none;
-        struct cgroupfs_root *new_root;
 };
 /*
@@ -1137,7 +1117,7 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
        BUG_ON(!mutex_is_locked(&cgroup_mutex));
 #ifdef CONFIG_CPUSETS
-        mask = ~(1UL << cpuset_subsys_id);
+        mask = ~(1UL << cpuset_cgrp_id);
 #endif
        memset(opts, 0, sizeof(*opts));
@@ -1227,30 +1207,34 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
                        return -ENOENT;
        }
-        /*
-         * If the 'all' option was specified select all the subsystems,
-         * otherwise if 'none', 'name=' and a subsystem name options
-         * were not specified, let's default to 'all'
-         */
-        if (all_ss || (!one_ss && !opts->none && !opts->name))
-                for_each_subsys(ss, i)
-                        if (!ss->disabled)
-                                set_bit(i, &opts->subsys_mask);
        /* Consistency checks */
        if (opts->flags & CGRP_ROOT_SANE_BEHAVIOR) {
                pr_warning("cgroup: sane_behavior: this is still under development and its behaviors will change, proceed at your own risk\n");
-                if (opts->flags & CGRP_ROOT_NOPREFIX) {
+                if ((opts->flags & (CGRP_ROOT_NOPREFIX | CGRP_ROOT_XATTR)) ||
-                        pr_err("cgroup: sane_behavior: noprefix is not allowed\n");
+                    opts->cpuset_clone_children || opts->release_agent ||
+                    opts->name) {
+                        pr_err("cgroup: sane_behavior: noprefix, xattr, clone_children, release_agent and name are not allowed\n");
                        return -EINVAL;
                }
+        } else {
+                /*
+                 * If the 'all' option was specified select all the
+                 * subsystems, otherwise if 'none', 'name=' and a subsystem
+                 * name options were not specified, let's default to 'all'
+                 */
+                if (all_ss || (!one_ss && !opts->none && !opts->name))
+                        for_each_subsys(ss, i)
+                                if (!ss->disabled)
+                                        set_bit(i, &opts->subsys_mask);
-                if (opts->cpuset_clone_children) {
+                /*
-                        pr_err("cgroup: sane_behavior: clone_children is not allowed\n");
+                 * We either have to specify by name or by subsystems. (So
+                 * all empty hierarchies must have a name).
+                 */
+                if (!opts->subsys_mask && !opts->name)
                        return -EINVAL;
-                }
        }
        /*
@@ -1266,21 +1250,13 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
        if (opts->subsys_mask && opts->none)
                return -EINVAL;
-        /*
-         * We either have to specify by name or by subsystems. (So all
-         * empty hierarchies must have a name).
-         */
-        if (!opts->subsys_mask && !opts->name)
-                return -EINVAL;
        return 0;
 }
-static int cgroup_remount(struct super_block *sb, int *flags, char *data)
+static int cgroup_remount(struct kernfs_root *kf_root, int *flags, char *data)
 {
        int ret = 0;
-        struct cgroupfs_root *root = sb->s_fs_info;
+        struct cgroup_root *root = cgroup_root_from_kf(kf_root);
-        struct cgroup *cgrp = &root->top_cgroup;
        struct cgroup_sb_opts opts;
        unsigned long added_mask, removed_mask;
@@ -1289,21 +1265,20 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
                return -EINVAL;
        }
-        mutex_lock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
        /* See what subsystems are wanted */
        ret = parse_cgroupfs_options(data, &opts);
        if (ret)
                goto out_unlock;
-        if (opts.subsys_mask != root->subsys_mask || opts.release_agent)
+        if (opts.subsys_mask != root->cgrp.subsys_mask || opts.release_agent)
                pr_warning("cgroup: option changes via remount are deprecated (pid=%d comm=%s)\n",
                           task_tgid_nr(current), current->comm);
-        added_mask = opts.subsys_mask & ~root->subsys_mask;
+        added_mask = opts.subsys_mask & ~root->cgrp.subsys_mask;
-        removed_mask = root->subsys_mask & ~opts.subsys_mask;
+        removed_mask = root->cgrp.subsys_mask & ~opts.subsys_mask;
        /* Don't allow flags or name to change at remount */
        if (((opts.flags ^ root->flags) & CGRP_ROOT_OPTION_MASK) ||
@@ -1316,422 +1291,332 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
        }
        /* remounting is not allowed for populated hierarchies */
-        if (root->number_of_cgroups > 1) {
+        if (!list_empty(&root->cgrp.children)) {
                ret = -EBUSY;
                goto out_unlock;
        }
-        ret = rebind_subsystems(root, added_mask, removed_mask);
+        ret = rebind_subsystems(root, added_mask);
        if (ret)
                goto out_unlock;
-        if (opts.release_agent)
+        rebind_subsystems(&cgrp_dfl_root, removed_mask);
+        if (opts.release_agent) {
+                spin_lock(&release_agent_path_lock);
                strcpy(root->release_agent_path, opts.release_agent);
+                spin_unlock(&release_agent_path_lock);
+        }
 out_unlock:
        kfree(opts.release_agent);
        kfree(opts.name);
-        mutex_unlock(&cgroup_root_mutex);
        mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
        return ret;
 }
-static const struct super_operations cgroup_ops = {
+/*
-        .statfs = simple_statfs,
+ * To reduce the fork() overhead for systems that are not actually using
-        .drop_inode = generic_delete_inode,
+ * their cgroups capability, we don't maintain the lists running through
-        .show_options = cgroup_show_options,
+ * each css_set to its tasks until we see the list actually used - in other
-        .remount_fs = cgroup_remount,
+ * words after the first mount.
-};
+ */
+static bool use_task_css_set_links __read_mostly;
+static void cgroup_enable_task_cg_lists(void)
+{
+        struct task_struct *p, *g;
+        down_write(&css_set_rwsem);
+        if (use_task_css_set_links)
+                goto out_unlock;
+        use_task_css_set_links = true;
+        /*
+         * We need tasklist_lock because RCU is not safe against
+         * while_each_thread(). Besides, a forking task that has passed
+         * cgroup_post_fork() without seeing use_task_css_set_links = 1
+         * is not guaranteed to have its child immediately visible in the
+         * tasklist if we walk through it with RCU.
+         */
+        read_lock(&tasklist_lock);
+        do_each_thread(g, p) {
+                WARN_ON_ONCE(!list_empty(&p->cg_list) ||
+                             task_css_set(p) != &init_css_set);
+                /*
+                 * We should check if the process is exiting, otherwise
+                 * it will race with cgroup_exit() in that the list
+                 * entry won't be deleted though the process has exited.
+                 * Do it while holding siglock so that we don't end up
+                 * racing against cgroup_exit().
+                 */
+                spin_lock_irq(&p->sighand->siglock);
+                if (!(p->flags & PF_EXITING)) {
+                        struct css_set *cset = task_css_set(p);
+                        list_add(&p->cg_list, &cset->tasks);
+                        get_css_set(cset);
+                }
+                spin_unlock_irq(&p->sighand->siglock);
+        } while_each_thread(g, p);
+        read_unlock(&tasklist_lock);
+out_unlock:
+        up_write(&css_set_rwsem);
+}
 static void init_cgroup_housekeeping(struct cgroup *cgrp)
 {
+        atomic_set(&cgrp->refcnt, 1);
        INIT_LIST_HEAD(&cgrp->sibling);
        INIT_LIST_HEAD(&cgrp->children);
-        INIT_LIST_HEAD(&cgrp->files);
        INIT_LIST_HEAD(&cgrp->cset_links);
        INIT_LIST_HEAD(&cgrp->release_list);
        INIT_LIST_HEAD(&cgrp->pidlists);
        mutex_init(&cgrp->pidlist_mutex);
        cgrp->dummy_css.cgroup = cgrp;
-        simple_xattrs_init(&cgrp->xattrs);
 }
-static void init_cgroup_root(struct cgroupfs_root *root)
+static void init_cgroup_root(struct cgroup_root *root,
+                             struct cgroup_sb_opts *opts)
 {
-        struct cgroup *cgrp = &root->top_cgroup;
+        struct cgroup *cgrp = &root->cgrp;
        INIT_LIST_HEAD(&root->root_list);
-        root->number_of_cgroups = 1;
+        atomic_set(&root->nr_cgrps, 1);
        cgrp->root = root;
-        RCU_INIT_POINTER(cgrp->name, &root_cgroup_name);
        init_cgroup_housekeeping(cgrp);
        idr_init(&root->cgroup_idr);
-}
-static int cgroup_init_root_id(struct cgroupfs_root *root, int start, int end)
-{
-        int id;
-        lockdep_assert_held(&cgroup_mutex);
-        lockdep_assert_held(&cgroup_root_mutex);
-        id = idr_alloc_cyclic(&cgroup_hierarchy_idr, root, start, end,
-                              GFP_KERNEL);
-        if (id < 0)
-                return id;
-        root->hierarchy_id = id;
-        return 0;
-}
-static void cgroup_exit_root_id(struct cgroupfs_root *root)
-{
-        lockdep_assert_held(&cgroup_mutex);
-        lockdep_assert_held(&cgroup_root_mutex);
-        if (root->hierarchy_id) {
-                idr_remove(&cgroup_hierarchy_idr, root->hierarchy_id);
-                root->hierarchy_id = 0;
-        }
-}
-static int cgroup_test_super(struct super_block *sb, void *data)
-{
-        struct cgroup_sb_opts *opts = data;
-        struct cgroupfs_root *root = sb->s_fs_info;
-        /* If we asked for a name then it must match */
-        if (opts->name && strcmp(opts->name, root->name))
-                return 0;
-        /*
-         * If we asked for subsystems (or explicitly for no
-         * subsystems) then they must match
-         */
-        if ((opts->subsys_mask || opts->none)
-            && (opts->subsys_mask != root->subsys_mask))
-                return 0;
-        return 1;
-}
-static struct cgroupfs_root *cgroup_root_from_opts(struct cgroup_sb_opts *opts)
-{
-        struct cgroupfs_root *root;
-        if (!opts->subsys_mask && !opts->none)
-                return NULL;
-        root = kzalloc(sizeof(*root), GFP_KERNEL);
-        if (!root)
-                return ERR_PTR(-ENOMEM);
-        init_cgroup_root(root);
-        /*
-         * We need to set @root->subsys_mask now so that @root can be
-         * matched by cgroup_test_super() before it finishes
-         * initialization; otherwise, competing mounts with the same
-         * options may try to bind the same subsystems instead of waiting
-         * for the first one leading to unexpected mount errors.
-         * SUBSYS_BOUND will be set once actual binding is complete.
-         */
-        root->subsys_mask = opts->subsys_mask;
        root->flags = opts->flags;
        if (opts->release_agent)
                strcpy(root->release_agent_path, opts->release_agent);
        if (opts->name)
                strcpy(root->name, opts->name);
        if (opts->cpuset_clone_children)
-                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags);
+                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);
-        return root;
 }
-static void cgroup_free_root(struct cgroupfs_root *root)
+static int cgroup_setup_root(struct cgroup_root *root, unsigned long ss_mask)
 {
-        if (root) {
+        LIST_HEAD(tmp_links);
-                /* hierarhcy ID shoulid already have been released */
+        struct cgroup *root_cgrp = &root->cgrp;
-                WARN_ON_ONCE(root->hierarchy_id);
+        struct css_set *cset;
+        int i, ret;
-                idr_destroy(&root->cgroup_idr);
-                kfree(root);
-        }
-}
-static int cgroup_set_super(struct super_block *sb, void *data)
+        lockdep_assert_held(&cgroup_tree_mutex);
-{
+        lockdep_assert_held(&cgroup_mutex);
-        int ret;
-        struct cgroup_sb_opts *opts = data;
-        /* If we don't have a new root, we can't set up a new sb */
+        ret = idr_alloc(&root->cgroup_idr, root_cgrp, 0, 1, GFP_KERNEL);
-        if (!opts->new_root)
+        if (ret < 0)
-                return -EINVAL;
+                goto out;
+        root_cgrp->id = ret;
-        BUG_ON(!opts->subsys_mask && !opts->none);
+        /*
+         * We're accessing css_set_count without locking css_set_rwsem here,
+         * but that's OK - it can only be increased by someone holding
+         * cgroup_lock, and that's us. The worst that can happen is that we
+         * have some link structures left over
+         */
+        ret = allocate_cgrp_cset_links(css_set_count, &tmp_links);
+        if (ret)
+                goto out;
-        ret = set_anon_super(sb, NULL);
+        ret = cgroup_init_root_id(root);
        if (ret)
-                return ret;
+                goto out;
-        sb->s_fs_info = opts->new_root;
+        root->kf_root = kernfs_create_root(&cgroup_kf_syscall_ops,
-        opts->new_root->sb = sb;
+                                           KERNFS_ROOT_CREATE_DEACTIVATED,
+                                           root_cgrp);
+        if (IS_ERR(root->kf_root)) {
+                ret = PTR_ERR(root->kf_root);
+                goto exit_root_id;
+        }
+        root_cgrp->kn = root->kf_root->kn;
-        sb->s_blocksize = PAGE_CACHE_SIZE;
+        ret = cgroup_addrm_files(root_cgrp, cgroup_base_files, true);
-        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
+        if (ret)
-        sb->s_magic = CGROUP_SUPER_MAGIC;
+                goto destroy_root;
-        sb->s_op = &cgroup_ops;
-        return 0;
+        ret = rebind_subsystems(root, ss_mask);
-}
+        if (ret)
+                goto destroy_root;
-static int cgroup_get_rootdir(struct super_block *sb)
+        /*
-{
+         * There must be no failure case after here, since rebinding takes
-        static const struct dentry_operations cgroup_dops = {
+         * care of subsystems' refcounts, which are explicitly dropped in
-                .d_iput = cgroup_diput,
+         * the failure exit path.
-                .d_delete = always_delete_dentry,
+         */
-        };
+        list_add(&root->root_list, &cgroup_roots);
+        cgroup_root_count++;
-        struct inode *inode =
+        /*
-                cgroup_new_inode(S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR, sb);
+         * Link the root cgroup in this hierarchy into all the css_set
+         * objects.
+         */
+        down_write(&css_set_rwsem);
+        hash_for_each(css_set_table, i, cset, hlist)
+                link_css_set(&tmp_links, cset, root_cgrp);
+        up_write(&css_set_rwsem);
-        if (!inode)
+        BUG_ON(!list_empty(&root_cgrp->children));
-                return -ENOMEM;
+        BUG_ON(atomic_read(&root->nr_cgrps) != 1);
-        inode->i_fop = &simple_dir_operations;
+        kernfs_activate(root_cgrp->kn);
-        inode->i_op = &cgroup_dir_inode_operations;
+        ret = 0;
-        /* directories start off with i_nlink == 2 (for "." entry) */
+        goto out;
-        inc_nlink(inode);
-        sb->s_root = d_make_root(inode);
+destroy_root:
-        if (!sb->s_root)
+        kernfs_destroy_root(root->kf_root);
-                return -ENOMEM;
+        root->kf_root = NULL;
-        /* for everything else we want ->d_op set */
+exit_root_id:
-        sb->s_d_op = &cgroup_dops;
+        cgroup_exit_root_id(root);
-        return 0;
+out:
+        free_cgrp_cset_links(&tmp_links);
+        return ret;
 }
 static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                         int flags, const char *unused_dev_name,
                         void *data)
 {
+        struct cgroup_root *root;
        struct cgroup_sb_opts opts;
-        struct cgroupfs_root *root;
+        struct dentry *dentry;
-        int ret = 0;
+        int ret;
-        struct super_block *sb;
+        bool new_sb;
-        struct cgroupfs_root *new_root;
-        struct list_head tmp_links;
-        struct inode *inode;
-        const struct cred *cred;
-        /* First find the desired set of subsystems */
+        /*
+         * The first time anyone tries to mount a cgroup, enable the list
+         * linking each css_set to its tasks and fix up all existing tasks.
+         */
+        if (!use_task_css_set_links)
+                cgroup_enable_task_cg_lists();
+retry:
+        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
+        /* First find the desired set of subsystems */
        ret = parse_cgroupfs_options(data, &opts);
-        mutex_unlock(&cgroup_mutex);
        if (ret)
-                goto out_err;
+                goto out_unlock;
-        /*
-         * Allocate a new cgroup root. We may not need it if we're
-         * reusing an existing hierarchy.
-         */
-        new_root = cgroup_root_from_opts(&opts);
-        if (IS_ERR(new_root)) {
-                ret = PTR_ERR(new_root);
-                goto out_err;
-        }
-        opts.new_root = new_root;
-        /* Locate an existing or new sb for this hierarchy */
+        /* look for a matching existing root */
-        sb = sget(fs_type, cgroup_test_super, cgroup_set_super, 0, &opts);
+        if (!opts.subsys_mask && !opts.none && !opts.name) {
-        if (IS_ERR(sb)) {
+                cgrp_dfl_root_visible = true;
-                ret = PTR_ERR(sb);
+                root = &cgrp_dfl_root;
-                cgroup_free_root(opts.new_root);
+                cgroup_get(&root->cgrp);
-                goto out_err;
+                ret = 0;
+                goto out_unlock;
        }
-        root = sb->s_fs_info;
+        for_each_root(root) {
-        BUG_ON(!root);
+                bool name_match = false;
-        if (root == opts.new_root) {
-                /* We used the new root structure, so this is a new hierarchy */
-                struct cgroup *root_cgrp = &root->top_cgroup;
-                struct cgroupfs_root *existing_root;
-                int i;
-                struct css_set *cset;
-                BUG_ON(sb->s_root != NULL);
-                ret = cgroup_get_rootdir(sb);
+                if (root == &cgrp_dfl_root)
-                if (ret)
+                        continue;
-                        goto drop_new_super;
-                inode = sb->s_root->d_inode;
-                mutex_lock(&inode->i_mutex);
-                mutex_lock(&cgroup_mutex);
-                mutex_lock(&cgroup_root_mutex);
-                ret = idr_alloc(&root->cgroup_idr, root_cgrp, 0, 1, GFP_KERNEL);
-                if (ret < 0)
-                        goto unlock_drop;
-                root_cgrp->id = ret;
-                /* Check for name clashes with existing mounts */
-                ret = -EBUSY;
-                if (strlen(root->name))
-                        for_each_active_root(existing_root)
-                                if (!strcmp(existing_root->name, root->name))
-                                        goto unlock_drop;
-                /*
-                 * We're accessing css_set_count without locking
-                 * css_set_lock here, but that's OK - it can only be
-                 * increased by someone holding cgroup_lock, and
-                 * that's us. The worst that can happen is that we
-                 * have some link structures left over
-                 */
-                ret = allocate_cgrp_cset_links(css_set_count, &tmp_links);
-                if (ret)
-                        goto unlock_drop;
-                /* ID 0 is reserved for dummy root, 1 for unified hierarchy */
-                ret = cgroup_init_root_id(root, 2, 0);
-                if (ret)
-                        goto unlock_drop;
-                sb->s_root->d_fsdata = root_cgrp;
-                root_cgrp->dentry = sb->s_root;
-                /*
-                 * We're inside get_sb() and will call lookup_one_len() to
-                 * create the root files, which doesn't work if SELinux is
-                 * in use.  The following cred dancing somehow works around
-                 * it.  See 2ce9738ba ("cgroupfs: use init_cred when
-                 * populating new cgroupfs mount") for more details.
-                 */
-                cred = override_creds(&init_cred);
-                ret = cgroup_addrm_files(root_cgrp, cgroup_base_files, true);
-                if (ret)
-                        goto rm_base_files;
-                ret = rebind_subsystems(root, root->subsys_mask, 0);
-                if (ret)
-                        goto rm_base_files;
-                revert_creds(cred);
                /*
-                 * There must be no failure case after here, since rebinding
+                 * If we asked for a name then it must match.  Also, if
-                 * takes care of subsystems' refcounts, which are explicitly
+                 * name matches but sybsys_mask doesn't, we should fail.
-                 * dropped in the failure exit path.
+                 * Remember whether name matched.
                 */
+                if (opts.name) {
+                        if (strcmp(opts.name, root->name))
+                                continue;
+                        name_match = true;
+                }
-                list_add(&root->root_list, &cgroup_roots);
-                cgroup_root_count++;
-                /* Link the top cgroup in this hierarchy into all
-                 * the css_set objects */
-                write_lock(&css_set_lock);
-                hash_for_each(css_set_table, i, cset, hlist)
-                        link_css_set(&tmp_links, cset, root_cgrp);
-                write_unlock(&css_set_lock);
-                free_cgrp_cset_links(&tmp_links);
-                BUG_ON(!list_empty(&root_cgrp->children));
-                BUG_ON(root->number_of_cgroups != 1);
-                mutex_unlock(&cgroup_root_mutex);
-                mutex_unlock(&cgroup_mutex);
-                mutex_unlock(&inode->i_mutex);
-        } else {
                /*
-                 * We re-used an existing hierarchy - the new root (if
+                 * If we asked for subsystems (or explicitly for no
-                 * any) is not needed
+                 * subsystems) then they must match.
                 */
-                cgroup_free_root(opts.new_root);
+                if ((opts.subsys_mask || opts.none) &&
+                    (opts.subsys_mask != root->cgrp.subsys_mask)) {
+                        if (!name_match)
+                                continue;
+                        ret = -EBUSY;
+                        goto out_unlock;
+                }
                if ((root->flags ^ opts.flags) & CGRP_ROOT_OPTION_MASK) {
                        if ((root->flags | opts.flags) & CGRP_ROOT_SANE_BEHAVIOR) {
                                pr_err("cgroup: sane_behavior: new mount options should match the existing superblock\n");
                                ret = -EINVAL;
-                                goto drop_new_super;
+                                goto out_unlock;
                        } else {
                                pr_warning("cgroup: new mount options do not match the existing superblock, will be ignored\n");
                        }
                }
-        }
-        kfree(opts.release_agent);
-        kfree(opts.name);
-        return dget(sb->s_root);
- rm_base_files:
+                /*
-        free_cgrp_cset_links(&tmp_links);
+                 * A root's lifetime is governed by its root cgroup.  Zero
-        cgroup_addrm_files(&root->top_cgroup, cgroup_base_files, false);
+                 * ref indicate that the root is being destroyed.  Wait for
-        revert_creds(cred);
+                 * destruction to complete so that the subsystems are free.
- unlock_drop:
+                 * We can use wait_queue for the wait but this path is
-        cgroup_exit_root_id(root);
+                 * super cold.  Let's just sleep for a bit and retry.
-        mutex_unlock(&cgroup_root_mutex);
+                 */
-        mutex_unlock(&cgroup_mutex);
+                if (!atomic_inc_not_zero(&root->cgrp.refcnt)) {
-        mutex_unlock(&inode->i_mutex);
+                        mutex_unlock(&cgroup_mutex);
- drop_new_super:
+                        mutex_unlock(&cgroup_tree_mutex);
-        deactivate_locked_super(sb);
+                        kfree(opts.release_agent);
- out_err:
+                        kfree(opts.name);
-        kfree(opts.release_agent);
+                        msleep(10);
-        kfree(opts.name);
+                        goto retry;
-        return ERR_PTR(ret);
+                }
-}
-static void cgroup_kill_sb(struct super_block *sb)
-{
-        struct cgroupfs_root *root = sb->s_fs_info;
-        struct cgroup *cgrp = &root->top_cgroup;
-        struct cgrp_cset_link *link, *tmp_link;
-        int ret;
-        BUG_ON(!root);
-        BUG_ON(root->number_of_cgroups != 1);
-        BUG_ON(!list_empty(&cgrp->children));
-        mutex_lock(&cgrp->dentry->d_inode->i_mutex);
-        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
-        /* Rebind all subsystems back to the default hierarchy */
+                ret = 0;
-        if (root->flags & CGRP_ROOT_SUBSYS_BOUND) {
+                goto out_unlock;
-                ret = rebind_subsystems(root, 0, root->subsys_mask);
-                /* Shouldn't be able to fail ... */
-                BUG_ON(ret);
        }
        /*
-         * Release all the links from cset_links to this hierarchy's
+         * No such thing, create a new one.  name= matching without subsys
-         * root cgroup
+         * specification is allowed for already existing hierarchies but we
+         * can't create new one without subsys specification.
         */
-        write_lock(&css_set_lock);
+        if (!opts.subsys_mask && !opts.none) {
+                ret = -EINVAL;
-        list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
+                goto out_unlock;
-                list_del(&link->cset_link);
-                list_del(&link->cgrp_link);
-                kfree(link);
        }
-        write_unlock(&css_set_lock);
-        if (!list_empty(&root->root_list)) {
+        root = kzalloc(sizeof(*root), GFP_KERNEL);
-                list_del(&root->root_list);
+        if (!root) {
-                cgroup_root_count--;
+                ret = -ENOMEM;
+                goto out_unlock;
        }
-        cgroup_exit_root_id(root);
+        init_cgroup_root(root, &opts);
+        ret = cgroup_setup_root(root, opts.subsys_mask);
+        if (ret)
+                cgroup_free_root(root);
-        mutex_unlock(&cgroup_root_mutex);
+out_unlock:
        mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
+        kfree(opts.release_agent);
+        kfree(opts.name);
-        simple_xattrs_free(&cgrp->xattrs);
+        if (ret)
+                return ERR_PTR(ret);
-        kill_litter_super(sb);
+        dentry = kernfs_mount(fs_type, flags, root->kf_root, &new_sb);
-        cgroup_free_root(root);
+        if (IS_ERR(dentry) || !new_sb)
+                cgroup_put(&root->cgrp);
+        return dentry;
+}
+static void cgroup_kill_sb(struct super_block *sb)
+{
+        struct kernfs_root *kf_root = kernfs_root_from_sb(sb);
+        struct cgroup_root *root = cgroup_root_from_kf(kf_root);
+        cgroup_put(&root->cgrp);
+        kernfs_kill_sb(sb);
 }
 static struct file_system_type cgroup_fs_type = {
@@ -1743,57 +1628,6 @@ static struct file_system_type cgroup_fs_type = {
 static struct kobject *cgroup_kobj;
 /**
- * cgroup_path - generate the path of a cgroup
- * @cgrp: the cgroup in question
- * @buf: the buffer to write the path into
- * @buflen: the length of the buffer
- *
- * Writes path of cgroup into buf.  Returns 0 on success, -errno on error.
- *
- * We can't generate cgroup path using dentry->d_name, as accessing
- * dentry->name must be protected by irq-unsafe dentry->d_lock or parent
- * inode's i_mutex, while on the other hand cgroup_path() can be called
- * with some irq-safe spinlocks held.
- */
-int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
-{
-        int ret = -ENAMETOOLONG;
-        char *start;
-        if (!cgrp->parent) {
-                if (strlcpy(buf, "/", buflen) >= buflen)
-                        return -ENAMETOOLONG;
-                return 0;
-        }
-        start = buf + buflen - 1;
-        *start = '\0';
-        rcu_read_lock();
-        do {
-                const char *name = cgroup_name(cgrp);
-                int len;
-                len = strlen(name);
-                if ((start -= len) < buf)
-                        goto out;
-                memcpy(start, name, len);
-                if (--start < buf)
-                        goto out;
-                *start = '/';
-                cgrp = cgrp->parent;
-        } while (cgrp->parent);
-        ret = 0;
-        memmove(buf, start, buf + buflen - start);
-out:
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cgroup_path);
-/**
 * task_cgroup_path - cgroup path of a task in the first cgroup hierarchy
 * @task: target task
 * @buf: the buffer to write the path into
@@ -1804,49 +1638,55 @@ EXPORT_SYMBOL_GPL(cgroup_path);
 * function grabs cgroup_mutex and shouldn't be used inside locks used by
 * cgroup controller callbacks.
 *
- * Returns 0 on success, fails with -%ENAMETOOLONG if @buflen is too short.
+ * Return value is the same as kernfs_path().
 */
-int task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
+char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
 {
-        struct cgroupfs_root *root;
+        struct cgroup_root *root;
        struct cgroup *cgrp;
-        int hierarchy_id = 1, ret = 0;
+        int hierarchy_id = 1;
+        char *path = NULL;
-        if (buflen < 2)
-                return -ENAMETOOLONG;
        mutex_lock(&cgroup_mutex);
+        down_read(&css_set_rwsem);
        root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id);
        if (root) {
                cgrp = task_cgroup_from_root(task, root);
-                ret = cgroup_path(cgrp, buf, buflen);
+                path = cgroup_path(cgrp, buf, buflen);
        } else {
                /* if no hierarchy exists, everyone is in "/" */
-                memcpy(buf, "/", 2);
+                if (strlcpy(buf, "/", buflen) < buflen)
+                        path = buf;
        }
+        up_read(&css_set_rwsem);
        mutex_unlock(&cgroup_mutex);
-        return ret;
+        return path;
 }
 EXPORT_SYMBOL_GPL(task_cgroup_path);
-/*
+/* used to track tasks and other necessary states during migration */
- * Control Group taskset
- */
-struct task_and_cgroup {
-        struct task_struct      *task;
-        struct cgroup           *cgrp;
-        struct css_set          *cset;
-};
 struct cgroup_taskset {
-        struct task_and_cgroup  single;
+        /* the src and dst cset list running through cset->mg_node */
-        struct flex_array       *tc_array;
+        struct list_head        src_csets;
-        int                     tc_array_len;
+        struct list_head        dst_csets;
-        int                     idx;
-        struct cgroup           *cur_cgrp;
+        /*
+         * Fields for cgroup_taskset_*() iteration.
+         *
+         * Before migration is committed, the target migration tasks are on
+         * ->mg_tasks of the csets on ->src_csets.  After, on ->mg_tasks of
+         * the csets on ->dst_csets.  ->csets point to either ->src_csets
+         * or ->dst_csets depending on whether migration is committed.
+         *
+         * ->cur_csets and ->cur_task point to the current task position
+         * during iteration.
+         */
+        struct list_head        *csets;
+        struct css_set          *cur_cset;
+        struct task_struct      *cur_task;
 };
 /**
@@ -1857,15 +1697,11 @@ struct cgroup_taskset {
 */
 struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset)
 {
-        if (tset->tc_array) {
+        tset->cur_cset = list_first_entry(tset->csets, struct css_set, mg_node);
-                tset->idx = 0;
+        tset->cur_task = NULL;
-                return cgroup_taskset_next(tset);
-        } else {
+        return cgroup_taskset_next(tset);
-                tset->cur_cgrp = tset->single.cgrp;
-                return tset->single.task;
-        }
 }
-EXPORT_SYMBOL_GPL(cgroup_taskset_first);
 /**
 * cgroup_taskset_next - iterate to the next task in taskset
@@ -1876,48 +1712,36 @@ EXPORT_SYMBOL_GPL(cgroup_taskset_first);
 */
 struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset)
 {
-        struct task_and_cgroup *tc;
+        struct css_set *cset = tset->cur_cset;
+        struct task_struct *task = tset->cur_task;
-        if (!tset->tc_array || tset->idx >= tset->tc_array_len)
+        while (&cset->mg_node != tset->csets) {
-                return NULL;
+                if (!task)
+                        task = list_first_entry(&cset->mg_tasks,
+                                                struct task_struct, cg_list);
+                else
+                        task = list_next_entry(task, cg_list);
-        tc = flex_array_get(tset->tc_array, tset->idx++);
+                if (&task->cg_list != &cset->mg_tasks) {
-        tset->cur_cgrp = tc->cgrp;
+                        tset->cur_cset = cset;
-        return tc->task;
+                        tset->cur_task = task;
-}
+                        return task;
-EXPORT_SYMBOL_GPL(cgroup_taskset_next);
+                }
-/**
+                cset = list_next_entry(cset, mg_node);
- * cgroup_taskset_cur_css - return the matching css for the current task
+                task = NULL;
- * @tset: taskset of interest
+        }
- * @subsys_id: the ID of the target subsystem
- *
- * Return the css for the current (last returned) task of @tset for
- * subsystem specified by @subsys_id.  This function must be preceded by
- * either cgroup_taskset_first() or cgroup_taskset_next().
- */
-struct cgroup_subsys_state *cgroup_taskset_cur_css(struct cgroup_taskset *tset,
-                                                   int subsys_id)
-{
-        return cgroup_css(tset->cur_cgrp, cgroup_subsys[subsys_id]);
-}
-EXPORT_SYMBOL_GPL(cgroup_taskset_cur_css);
-/**
+        return NULL;
- * cgroup_taskset_size - return the number of tasks in taskset
- * @tset: taskset of interest
- */
-int cgroup_taskset_size(struct cgroup_taskset *tset)
-{
-        return tset->tc_array ? tset->tc_array_len : 1;
 }
-EXPORT_SYMBOL_GPL(cgroup_taskset_size);
-/*
+/**
 * cgroup_task_migrate - move a task from one cgroup to another.
+ * @old_cgrp; the cgroup @tsk is being migrated from
+ * @tsk: the task being migrated
+ * @new_cset: the new css_set @tsk is being attached to
 *
- * Must be called with cgroup_mutex and threadgroup locked.
+ * Must be called with cgroup_mutex, threadgroup and css_set_rwsem locked.
 */
 static void cgroup_task_migrate(struct cgroup *old_cgrp,
                                struct task_struct *tsk,
@@ -1925,6 +1749,9 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
 {
        struct css_set *old_cset;
+        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&css_set_rwsem);
        /*
         * We are synchronized through threadgroup_lock() against PF_EXITING
         * setting such that we can't race against cgroup_exit() changing the
@@ -1933,15 +1760,16 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
        WARN_ON_ONCE(tsk->flags & PF_EXITING);
        old_cset = task_css_set(tsk);
-        task_lock(tsk);
+        get_css_set(new_cset);
        rcu_assign_pointer(tsk->cgroups, new_cset);
-        task_unlock(tsk);
-        /* Update the css_set linked lists if we're using them */
+        /*
-        write_lock(&css_set_lock);
+         * Use move_tail so that cgroup_taskset_first() still returns the
-        if (!list_empty(&tsk->cg_list))
+         * leader after migration.  This works because cgroup_migrate()
-                list_move(&tsk->cg_list, &new_cset->tasks);
+         * ensures that the dst_cset of the leader is the first on the
-        write_unlock(&css_set_lock);
+         * tset's dst_csets list.
+         */
+        list_move_tail(&tsk->cg_list, &new_cset->mg_tasks);
        /*
         * We just gained a reference on old_cset by taking it from the
@@ -1949,100 +1777,199 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
         * we're safe to drop it here; it will be freed under RCU.
         */
        set_bit(CGRP_RELEASABLE, &old_cgrp->flags);
-        put_css_set(old_cset);
+        put_css_set_locked(old_cset, false);
 }
 /**
- * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
+ * cgroup_migrate_finish - cleanup after attach
- * @cgrp: the cgroup to attach to
+ * @preloaded_csets: list of preloaded css_sets
- * @tsk: the task or the leader of the threadgroup to be attached
- * @threadgroup: attach the whole threadgroup?
 *
- * Call holding cgroup_mutex and the group_rwsem of the leader. Will take
+ * Undo cgroup_migrate_add_src() and cgroup_migrate_prepare_dst().  See
- * task_lock of @tsk or each thread in the threadgroup individually in turn.
+ * those functions for details.
 */
-static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
+static void cgroup_migrate_finish(struct list_head *preloaded_csets)
-                              bool threadgroup)
 {
-        int retval, i, group_size;
+        struct css_set *cset, *tmp_cset;
-        struct cgroupfs_root *root = cgrp->root;
-        struct cgroup_subsys_state *css, *failed_css = NULL;
-        /* threadgroup list cursor and array */
-        struct task_struct *leader = tsk;
-        struct task_and_cgroup *tc;
-        struct flex_array *group;
-        struct cgroup_taskset tset = { };
-        /*
+        lockdep_assert_held(&cgroup_mutex);
-         * step 0: in order to do expensive, possibly blocking operations for
-         * every thread, we cannot iterate the thread group list, since it needs
+        down_write(&css_set_rwsem);
-         * rcu or tasklist locked. instead, build an array of all threads in the
+        list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) {
-         * group - group_rwsem prevents new threads from appearing, and if
+                cset->mg_src_cgrp = NULL;
-         * threads exit, this will just be an over-estimate.
+                cset->mg_dst_cset = NULL;
-         */
+                list_del_init(&cset->mg_preload_node);
-        if (threadgroup)
+                put_css_set_locked(cset, false);
-                group_size = get_nr_threads(tsk);
+        }
-        else
+        up_write(&css_set_rwsem);
-                group_size = 1;
+}
-        /* flex_array supports very large thread-groups better than kmalloc. */
-        group = flex_array_alloc(sizeof(*tc), group_size, GFP_KERNEL);
+/**
-        if (!group)
+ * cgroup_migrate_add_src - add a migration source css_set
-                return -ENOMEM;
+ * @src_cset: the source css_set to add
-        /* pre-allocate to guarantee space while iterating in rcu read-side. */
+ * @dst_cgrp: the destination cgroup
-        retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL);
+ * @preloaded_csets: list of preloaded css_sets
-        if (retval)
+ *
-                goto out_free_group_list;
+ * Tasks belonging to @src_cset are about to be migrated to @dst_cgrp.  Pin
+ * @src_cset and add it to @preloaded_csets, which should later be cleaned
+ * up by cgroup_migrate_finish().
+ *
+ * This function may be called without holding threadgroup_lock even if the
+ * target is a process.  Threads may be created and destroyed but as long
+ * as cgroup_mutex is not dropped, no new css_set can be put into play and
+ * the preloaded css_sets are guaranteed to cover all migrations.
+ */
+static void cgroup_migrate_add_src(struct css_set *src_cset,
+                                   struct cgroup *dst_cgrp,
+                                   struct list_head *preloaded_csets)
+{
+        struct cgroup *src_cgrp;
+        lockdep_assert_held(&cgroup_mutex);
+        lockdep_assert_held(&css_set_rwsem);
+        src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root);
+        /* nothing to do if this cset already belongs to the cgroup */
+        if (src_cgrp == dst_cgrp)
+                return;
+        if (!list_empty(&src_cset->mg_preload_node))
+                return;
+        WARN_ON(src_cset->mg_src_cgrp);
+        WARN_ON(!list_empty(&src_cset->mg_tasks));
+        WARN_ON(!list_empty(&src_cset->mg_node));
+        src_cset->mg_src_cgrp = src_cgrp;
+        get_css_set(src_cset);
+        list_add(&src_cset->mg_preload_node, preloaded_csets);
+}
+/**
+ * cgroup_migrate_prepare_dst - prepare destination css_sets for migration
+ * @dst_cgrp: the destination cgroup
+ * @preloaded_csets: list of preloaded source css_sets
+ *
+ * Tasks are about to be moved to @dst_cgrp and all the source css_sets
+ * have been preloaded to @preloaded_csets.  This function looks up and
+ * pins all destination css_sets, links each to its source, and put them on
+ * @preloaded_csets.
+ *
+ * This function must be called after cgroup_migrate_add_src() has been
+ * called on each migration source css_set.  After migration is performed
+ * using cgroup_migrate(), cgroup_migrate_finish() must be called on
+ * @preloaded_csets.
+ */
+static int cgroup_migrate_prepare_dst(struct cgroup *dst_cgrp,
+                                      struct list_head *preloaded_csets)
+{
+        LIST_HEAD(csets);
+        struct css_set *src_cset;
+        lockdep_assert_held(&cgroup_mutex);
+        /* look up the dst cset for each src cset and link it to src */
+        list_for_each_entry(src_cset, preloaded_csets, mg_preload_node) {
+                struct css_set *dst_cset;
+                dst_cset = find_css_set(src_cset, dst_cgrp);
+                if (!dst_cset)
+                        goto err;
+                WARN_ON_ONCE(src_cset->mg_dst_cset || dst_cset->mg_dst_cset);
+                src_cset->mg_dst_cset = dst_cset;
+                if (list_empty(&dst_cset->mg_preload_node))
+                        list_add(&dst_cset->mg_preload_node, &csets);
+                else
+                        put_css_set(dst_cset, false);
+        }
+        list_splice(&csets, preloaded_csets);
+        return 0;
+err:
+        cgroup_migrate_finish(&csets);
+        return -ENOMEM;
+}
+/**
+ * cgroup_migrate - migrate a process or task to a cgroup
+ * @cgrp: the destination cgroup
+ * @leader: the leader of the process or the task to migrate
+ * @threadgroup: whether @leader points to the whole process or a single task
+ *
+ * Migrate a process or task denoted by @leader to @cgrp.  If migrating a
+ * process, the caller must be holding threadgroup_lock of @leader.  The
+ * caller is also responsible for invoking cgroup_migrate_add_src() and
+ * cgroup_migrate_prepare_dst() on the targets before invoking this
+ * function and following up with cgroup_migrate_finish().
+ *
+ * As long as a controller's ->can_attach() doesn't fail, this function is
+ * guaranteed to succeed.  This means that, excluding ->can_attach()
+ * failure, when migrating multiple targets, the success or failure can be
+ * decided for all targets by invoking group_migrate_prepare_dst() before
+ * actually starting migrating.
+ */
+static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
+                          bool threadgroup)
+{
+        struct cgroup_taskset tset = {
+                .src_csets      = LIST_HEAD_INIT(tset.src_csets),
+                .dst_csets      = LIST_HEAD_INIT(tset.dst_csets),
+                .csets          = &tset.src_csets,
+        };
+        struct cgroup_subsys_state *css, *failed_css = NULL;
+        struct css_set *cset, *tmp_cset;
+        struct task_struct *task, *tmp_task;
+        int i, ret;
-        i = 0;
        /*
         * Prevent freeing of tasks while we take a snapshot. Tasks that are
         * already PF_EXITING could be freed from underneath us unless we
         * take an rcu_read_lock.
         */
+        down_write(&css_set_rwsem);
        rcu_read_lock();
+        task = leader;
        do {
-                struct task_and_cgroup ent;
+                /* @task either already exited or can't exit until the end */
+                if (task->flags & PF_EXITING)
+                        goto next;
-                /* @tsk either already exited or can't exit until the end */
+                /* leave @task alone if post_fork() hasn't linked it yet */
-                if (tsk->flags & PF_EXITING)
+                if (list_empty(&task->cg_list))
                        goto next;
-                /* as per above, nr_threads may decrease, but not increase. */
+                cset = task_css_set(task);
-                BUG_ON(i >= group_size);
+                if (!cset->mg_src_cgrp)
-                ent.task = tsk;
-                ent.cgrp = task_cgroup_from_root(tsk, root);
-                /* nothing to do if this task is already in the cgroup */
-                if (ent.cgrp == cgrp)
                        goto next;
                /*
-                 * saying GFP_ATOMIC has no effect here because we did prealloc
+                 * cgroup_taskset_first() must always return the leader.
-                 * earlier, but it's good form to communicate our expectations.
+                 * Take care to avoid disturbing the ordering.
                 */
-                retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
+                list_move_tail(&task->cg_list, &cset->mg_tasks);
-                BUG_ON(retval != 0);
+                if (list_empty(&cset->mg_node))
-                i++;
+                        list_add_tail(&cset->mg_node, &tset.src_csets);
+                if (list_empty(&cset->mg_dst_cset->mg_node))
+                        list_move_tail(&cset->mg_dst_cset->mg_node,
+                                       &tset.dst_csets);
        next:
                if (!threadgroup)
                        break;
-        } while_each_thread(leader, tsk);
+        } while_each_thread(leader, task);
        rcu_read_unlock();
-        /* remember the number of threads in the array for later. */
+        up_write(&css_set_rwsem);
-        group_size = i;
-        tset.tc_array = group;
-        tset.tc_array_len = group_size;
        /* methods shouldn't be called if no task is actually migrating */
-        retval = 0;
+        if (list_empty(&tset.src_csets))
-        if (!group_size)
+                return 0;
-                goto out_free_group_list;
-        /*
+        /* check that we can legitimately attach to the cgroup */
-         * step 1: check that we can legitimately attach to the cgroup.
-         */
        for_each_css(css, i, cgrp) {
                if (css->ss->can_attach) {
-                        retval = css->ss->can_attach(css, &tset);
+                        ret = css->ss->can_attach(css, &tset);
-                        if (retval) {
+                        if (ret) {
                                failed_css = css;
                                goto out_cancel_attach;
                        }
@@ -2050,70 +1977,91 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
        }
        /*
-         * step 2: make sure css_sets exist for all threads to be migrated.
+         * Now that we're guaranteed success, proceed to move all tasks to
-         * we use find_css_set, which allocates a new one if necessary.
+         * the new cgroup.  There are no failure cases after here, so this
+         * is the commit point.
         */
-        for (i = 0; i < group_size; i++) {
+        down_write(&css_set_rwsem);
-                struct css_set *old_cset;
+        list_for_each_entry(cset, &tset.src_csets, mg_node) {
+                list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list)
-                tc = flex_array_get(group, i);
+                        cgroup_task_migrate(cset->mg_src_cgrp, task,
-                old_cset = task_css_set(tc->task);
+                                            cset->mg_dst_cset);
-                tc->cset = find_css_set(old_cset, cgrp);
-                if (!tc->cset) {
-                        retval = -ENOMEM;
-                        goto out_put_css_set_refs;
-                }
        }
+        up_write(&css_set_rwsem);
        /*
-         * step 3: now that we're guaranteed success wrt the css_sets,
+         * Migration is committed, all target tasks are now on dst_csets.
-         * proceed to move all tasks to the new cgroup.  There are no
+         * Nothing is sensitive to fork() after this point.  Notify
-         * failure cases after here, so this is the commit point.
+         * controllers that migration is complete.
         */
-        for (i = 0; i < group_size; i++) {
+        tset.csets = &tset.dst_csets;
-                tc = flex_array_get(group, i);
-                cgroup_task_migrate(tc->cgrp, tc->task, tc->cset);
-        }
-        /* nothing is sensitive to fork() after this point. */
-        /*
-         * step 4: do subsystem attach callbacks.
-         */
        for_each_css(css, i, cgrp)
                if (css->ss->attach)
                        css->ss->attach(css, &tset);
-        /*
+        ret = 0;
-         * step 5: success! and cleanup
+        goto out_release_tset;
-         */
-        retval = 0;
-out_put_css_set_refs:
-        if (retval) {
-                for (i = 0; i < group_size; i++) {
-                        tc = flex_array_get(group, i);
-                        if (!tc->cset)
-                                break;
-                        put_css_set(tc->cset);
-                }
-        }
 out_cancel_attach:
-        if (retval) {
+        for_each_css(css, i, cgrp) {
-                for_each_css(css, i, cgrp) {
+                if (css == failed_css)
-                        if (css == failed_css)
+                        break;
-                                break;
+                if (css->ss->cancel_attach)
-                        if (css->ss->cancel_attach)
+                        css->ss->cancel_attach(css, &tset);
-                                css->ss->cancel_attach(css, &tset);
-                }
        }
-out_free_group_list:
+out_release_tset:
-        flex_array_free(group);
+        down_write(&css_set_rwsem);
-        return retval;
+        list_splice_init(&tset.dst_csets, &tset.src_csets);
+        list_for_each_entry_safe(cset, tmp_cset, &tset.src_csets, mg_node) {
+                list_splice_tail_init(&cset->mg_tasks, &cset->tasks);
+                list_del_init(&cset->mg_node);
+        }
+        up_write(&css_set_rwsem);
+        return ret;
+}
+/**
+ * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
+ * @dst_cgrp: the cgroup to attach to
+ * @leader: the task or the leader of the threadgroup to be attached
+ * @threadgroup: attach the whole threadgroup?
+ *
+ * Call holding cgroup_mutex and threadgroup_lock of @leader.
+ */
+static int cgroup_attach_task(struct cgroup *dst_cgrp,
+                              struct task_struct *leader, bool threadgroup)
+{
+        LIST_HEAD(preloaded_csets);
+        struct task_struct *task;
+        int ret;
+        /* look up all src csets */
+        down_read(&css_set_rwsem);
+        rcu_read_lock();
+        task = leader;
+        do {
+                cgroup_migrate_add_src(task_css_set(task), dst_cgrp,
+                                       &preloaded_csets);
+                if (!threadgroup)
+                        break;
+        } while_each_thread(leader, task);
+        rcu_read_unlock();
+        up_read(&css_set_rwsem);
+        /* prepare dst csets and commit */
+        ret = cgroup_migrate_prepare_dst(dst_cgrp, &preloaded_csets);
+        if (!ret)
+                ret = cgroup_migrate(dst_cgrp, leader, threadgroup);
+        cgroup_migrate_finish(&preloaded_csets);
+        return ret;
 }
 /*
 * Find the task_struct of the task to attach by vpid and pass it along to the
 * function to attach either it or all tasks in its threadgroup. Will lock
- * cgroup_mutex and threadgroup; may take task_lock of task.
+ * cgroup_mutex and threadgroup.
 */
 static int attach_task_by_pid(struct cgroup *cgrp, u64 pid, bool threadgroup)
 {
@@ -2198,12 +2146,19 @@ out_unlock_cgroup:
 */
 int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
 {
-        struct cgroupfs_root *root;
+        struct cgroup_root *root;
        int retval = 0;
        mutex_lock(&cgroup_mutex);
-        for_each_active_root(root) {
+        for_each_root(root) {
-                struct cgroup *from_cgrp = task_cgroup_from_root(from, root);
+                struct cgroup *from_cgrp;
+                if (root == &cgrp_dfl_root)
+                        continue;
+                down_read(&css_set_rwsem);
+                from_cgrp = task_cgroup_from_root(from, root);
+                up_read(&css_set_rwsem);
                retval = cgroup_attach_task(from_cgrp, tsk, false);
                if (retval)
@@ -2228,16 +2183,17 @@ static int cgroup_procs_write(struct cgroup_subsys_state *css,
 }
 static int cgroup_release_agent_write(struct cgroup_subsys_state *css,
-                                      struct cftype *cft, const char *buffer)
+                                      struct cftype *cft, char *buffer)
 {
-        BUILD_BUG_ON(sizeof(css->cgroup->root->release_agent_path) < PATH_MAX);
+        struct cgroup_root *root = css->cgroup->root;
-        if (strlen(buffer) >= PATH_MAX)
-                return -EINVAL;
+        BUILD_BUG_ON(sizeof(root->release_agent_path) < PATH_MAX);
        if (!cgroup_lock_live_group(css->cgroup))
                return -ENODEV;
-        mutex_lock(&cgroup_root_mutex);
+        spin_lock(&release_agent_path_lock);
-        strcpy(css->cgroup->root->release_agent_path, buffer);
+        strlcpy(root->release_agent_path, buffer,
-        mutex_unlock(&cgroup_root_mutex);
+                sizeof(root->release_agent_path));
+        spin_unlock(&release_agent_path_lock);
        mutex_unlock(&cgroup_mutex);
        return 0;
 }
@@ -2262,32 +2218,23 @@ static int cgroup_sane_behavior_show(struct seq_file *seq, void *v)
        return 0;
 }
-/* A buffer size big enough for numbers or short strings */
+static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
-#define CGROUP_LOCAL_BUFFER_SIZE 64
+                                 size_t nbytes, loff_t off)
-static ssize_t cgroup_file_write(struct file *file, const char __user *userbuf,
-                                 size_t nbytes, loff_t *ppos)
 {
-        struct cfent *cfe = __d_cfe(file->f_dentry);
+        struct cgroup *cgrp = of->kn->parent->priv;
-        struct cftype *cft = __d_cft(file->f_dentry);
+        struct cftype *cft = of->kn->priv;
-        struct cgroup_subsys_state *css = cfe->css;
+        struct cgroup_subsys_state *css;
-        size_t max_bytes = cft->max_write_len ?: CGROUP_LOCAL_BUFFER_SIZE - 1;
-        char *buf;
        int ret;
-        if (nbytes >= max_bytes)
+        /*
-                return -E2BIG;
+         * kernfs guarantees that a file isn't deleted with operations in
+         * flight, which means that the matching css is and stays alive and
-        buf = kmalloc(nbytes + 1, GFP_KERNEL);
+         * doesn't need to be pinned.  The RCU locking is not necessary
-        if (!buf)
+         * either.  It's just for the convenience of using cgroup_css().
-                return -ENOMEM;
+         */
+        rcu_read_lock();
-        if (copy_from_user(buf, userbuf, nbytes)) {
+        css = cgroup_css(cgrp, cft->ss);
-                ret = -EFAULT;
+        rcu_read_unlock();
-                goto out_free;
-        }
-        buf[nbytes] = '\0';
        if (cft->write_string) {
                ret = cft->write_string(css, cft, strstrip(buf));
@@ -2306,53 +2253,23 @@ static ssize_t cgroup_file_write(struct file *file, const char __user *userbuf,
        } else {
                ret = -EINVAL;
        }
-out_free:
-        kfree(buf);
        return ret ?: nbytes;
 }
-/*
- * seqfile ops/methods for returning structured data. Currently just
- * supports string->u64 maps, but can be extended in future.
- */
 static void *cgroup_seqfile_start(struct seq_file *seq, loff_t *ppos)
 {
-        struct cftype *cft = seq_cft(seq);
+        return seq_cft(seq)->seq_start(seq, ppos);
-        if (cft->seq_start) {
-                return cft->seq_start(seq, ppos);
-        } else {
-                /*
-                 * The same behavior and code as single_open().  Returns
-                 * !NULL if pos is at the beginning; otherwise, NULL.
-                 */
-                return NULL + !*ppos;
-        }
 }
 static void *cgroup_seqfile_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct cftype *cft = seq_cft(seq);
+        return seq_cft(seq)->seq_next(seq, v, ppos);
-        if (cft->seq_next) {
-                return cft->seq_next(seq, v, ppos);
-        } else {
-                /*
-                 * The same behavior and code as single_open(), always
-                 * terminate after the initial read.
-                 */
-                ++*ppos;
-                return NULL;
-        }
 }
 static void cgroup_seqfile_stop(struct seq_file *seq, void *v)
 {
-        struct cftype *cft = seq_cft(seq);
+        seq_cft(seq)->seq_stop(seq, v);
-        if (cft->seq_stop)
-                cft->seq_stop(seq, v);
 }
 static int cgroup_seqfile_show(struct seq_file *m, void *arg)
@@ -2372,96 +2289,35 @@ static int cgroup_seqfile_show(struct seq_file *m, void *arg)
        return 0;
 }
-static struct seq_operations cgroup_seq_operations = {
+static struct kernfs_ops cgroup_kf_single_ops = {
-        .start          = cgroup_seqfile_start,
+        .atomic_write_len       = PAGE_SIZE,
-        .next           = cgroup_seqfile_next,
+        .write                  = cgroup_file_write,
-        .stop           = cgroup_seqfile_stop,
+        .seq_show               = cgroup_seqfile_show,
-        .show           = cgroup_seqfile_show,
 };
-static int cgroup_file_open(struct inode *inode, struct file *file)
+static struct kernfs_ops cgroup_kf_ops = {
-{
+        .atomic_write_len       = PAGE_SIZE,
-        struct cfent *cfe = __d_cfe(file->f_dentry);
+        .write                  = cgroup_file_write,
-        struct cftype *cft = __d_cft(file->f_dentry);
+        .seq_start              = cgroup_seqfile_start,
-        struct cgroup *cgrp = __d_cgrp(cfe->dentry->d_parent);
+        .seq_next               = cgroup_seqfile_next,
-        struct cgroup_subsys_state *css;
+        .seq_stop               = cgroup_seqfile_stop,
-        struct cgroup_open_file *of;
+        .seq_show               = cgroup_seqfile_show,
-        int err;
+};
-        err = generic_file_open(inode, file);
-        if (err)
-                return err;
-        /*
-         * If the file belongs to a subsystem, pin the css.  Will be
-         * unpinned either on open failure or release.  This ensures that
-         * @css stays alive for all file operations.
-         */
-        rcu_read_lock();
-        css = cgroup_css(cgrp, cft->ss);
-        if (cft->ss && !css_tryget(css))
-                css = NULL;
-        rcu_read_unlock();
-        if (!css)
-                return -ENODEV;
-        /*
-         * @cfe->css is used by read/write/close to determine the
-         * associated css.  @file->private_data would be a better place but
-         * that's already used by seqfile.  Multiple accessors may use it
-         * simultaneously which is okay as the association never changes.
-         */
-        WARN_ON_ONCE(cfe->css && cfe->css != css);
-        cfe->css = css;
-        of = __seq_open_private(file, &cgroup_seq_operations,
-                                sizeof(struct cgroup_open_file));
-        if (of) {
-                of->cfe = cfe;
-                return 0;
-        }
-        if (css->ss)
-                css_put(css);
-        return -ENOMEM;
-}
-static int cgroup_file_release(struct inode *inode, struct file *file)
-{
-        struct cfent *cfe = __d_cfe(file->f_dentry);
-        struct cgroup_subsys_state *css = cfe->css;
-        if (css->ss)
-                css_put(css);
-        return seq_release_private(inode, file);
-}
 /*
 * cgroup_rename - Only allow simple rename of directories in place.
 */
-static int cgroup_rename(struct inode *old_dir, struct dentry *old_dentry,
+static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent,
-                            struct inode *new_dir, struct dentry *new_dentry)
+                         const char *new_name_str)
 {
+        struct cgroup *cgrp = kn->priv;
        int ret;
-        struct cgroup_name *name, *old_name;
-        struct cgroup *cgrp;
-        /*
-         * It's convinient to use parent dir's i_mutex to protected
-         * cgrp->name.
-         */
-        lockdep_assert_held(&old_dir->i_mutex);
-        if (!S_ISDIR(old_dentry->d_inode->i_mode))
+        if (kernfs_type(kn) != KERNFS_DIR)
                return -ENOTDIR;
-        if (new_dentry->d_inode)
+        if (kn->parent != new_parent)
-                return -EEXIST;
-        if (old_dir != new_dir)
                return -EIO;
-        cgrp = __d_cgrp(old_dentry);
        /*
         * This isn't a proper migration and its usefulness is very
         * limited.  Disallow if sane_behavior.
@@ -2469,218 +2325,61 @@ static int cgroup_rename(struct inode *old_dir, struct dentry *old_dentry,
        if (cgroup_sane_behavior(cgrp))
                return -EPERM;
-        name = cgroup_alloc_name(new_dentry);
+        /*
-        if (!name)
+         * We're gonna grab cgroup_tree_mutex which nests outside kernfs
-                return -ENOMEM;
+         * active_ref.  kernfs_rename() doesn't require active_ref
+         * protection.  Break them before grabbing cgroup_tree_mutex.
-        ret = simple_rename(old_dir, old_dentry, new_dir, new_dentry);
+         */
-        if (ret) {
+        kernfs_break_active_protection(new_parent);
-                kfree(name);
+        kernfs_break_active_protection(kn);
-                return ret;
-        }
-        old_name = rcu_dereference_protected(cgrp->name, true);
-        rcu_assign_pointer(cgrp->name, name);
-        kfree_rcu(old_name, rcu_head);
-        return 0;
-}
-static struct simple_xattrs *__d_xattrs(struct dentry *dentry)
-{
-        if (S_ISDIR(dentry->d_inode->i_mode))
-                return &__d_cgrp(dentry)->xattrs;
-        else
-                return &__d_cfe(dentry)->xattrs;
-}
-static inline int xattr_enabled(struct dentry *dentry)
-{
-        struct cgroupfs_root *root = dentry->d_sb->s_fs_info;
-        return root->flags & CGRP_ROOT_XATTR;
-}
-static bool is_valid_xattr(const char *name)
-{
-        if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
-            !strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN))
-                return true;
-        return false;
-}
-static int cgroup_setxattr(struct dentry *dentry, const char *name,
-                           const void *val, size_t size, int flags)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        if (!is_valid_xattr(name))
-                return -EINVAL;
-        return simple_xattr_set(__d_xattrs(dentry), name, val, size, flags);
-}
-static int cgroup_removexattr(struct dentry *dentry, const char *name)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        if (!is_valid_xattr(name))
-                return -EINVAL;
-        return simple_xattr_remove(__d_xattrs(dentry), name);
-}
-static ssize_t cgroup_getxattr(struct dentry *dentry, const char *name,
-                               void *buf, size_t size)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        if (!is_valid_xattr(name))
-                return -EINVAL;
-        return simple_xattr_get(__d_xattrs(dentry), name, buf, size);
-}
-static ssize_t cgroup_listxattr(struct dentry *dentry, char *buf, size_t size)
-{
-        if (!xattr_enabled(dentry))
-                return -EOPNOTSUPP;
-        return simple_xattr_list(__d_xattrs(dentry), buf, size);
-}
-static const struct file_operations cgroup_file_operations = {
-        .read = seq_read,
-        .write = cgroup_file_write,
-        .llseek = generic_file_llseek,
-        .open = cgroup_file_open,
-        .release = cgroup_file_release,
-};
-static const struct inode_operations cgroup_file_inode_operations = {
-        .setxattr = cgroup_setxattr,
-        .getxattr = cgroup_getxattr,
-        .listxattr = cgroup_listxattr,
-        .removexattr = cgroup_removexattr,
-};
-static const struct inode_operations cgroup_dir_inode_operations = {
-        .lookup = simple_lookup,
-        .mkdir = cgroup_mkdir,
-        .rmdir = cgroup_rmdir,
-        .rename = cgroup_rename,
-        .setxattr = cgroup_setxattr,
-        .getxattr = cgroup_getxattr,
-        .listxattr = cgroup_listxattr,
-        .removexattr = cgroup_removexattr,
-};
-static int cgroup_create_file(struct dentry *dentry, umode_t mode,
-                                struct super_block *sb)
-{
-        struct inode *inode;
-        if (!dentry)
-                return -ENOENT;
-        if (dentry->d_inode)
-                return -EEXIST;
-        inode = cgroup_new_inode(mode, sb);
+        mutex_lock(&cgroup_tree_mutex);
-        if (!inode)
+        mutex_lock(&cgroup_mutex);
-                return -ENOMEM;
-        if (S_ISDIR(mode)) {
+        ret = kernfs_rename(kn, new_parent, new_name_str);
-                inode->i_op = &cgroup_dir_inode_operations;
-                inode->i_fop = &simple_dir_operations;
-                /* start off with i_nlink == 2 (for "." entry) */
+        mutex_unlock(&cgroup_mutex);
-                inc_nlink(inode);
+        mutex_unlock(&cgroup_tree_mutex);
-                inc_nlink(dentry->d_parent->d_inode);
-                /*
+        kernfs_unbreak_active_protection(kn);
-                 * Control reaches here with cgroup_mutex held.
+        kernfs_unbreak_active_protection(new_parent);
-                 * @inode->i_mutex should nest outside cgroup_mutex but we
+        return ret;
-                 * want to populate it immediately without releasing
-                 * cgroup_mutex.  As @inode isn't visible to anyone else
-                 * yet, trylock will always succeed without affecting
-                 * lockdep checks.
-                 */
-                WARN_ON_ONCE(!mutex_trylock(&inode->i_mutex));
-        } else if (S_ISREG(mode)) {
-                inode->i_size = 0;
-                inode->i_fop = &cgroup_file_operations;
-                inode->i_op = &cgroup_file_inode_operations;
-        }
-        d_instantiate(dentry, inode);
-        dget(dentry);   /* Extra count - pin the dentry in core */
-        return 0;
 }
-/**
+/* set uid and gid of cgroup dirs and files to that of the creator */
- * cgroup_file_mode - deduce file mode of a control file
+static int cgroup_kn_set_ugid(struct kernfs_node *kn)
- * @cft: the control file in question
- *
- * returns cft->mode if ->mode is not 0
- * returns S_IRUGO|S_IWUSR if it has both a read and a write handler
- * returns S_IRUGO if it has only a read handler
- * returns S_IWUSR if it has only a write hander
- */
-static umode_t cgroup_file_mode(const struct cftype *cft)
 {
-        umode_t mode = 0;
+        struct iattr iattr = { .ia_valid = ATTR_UID | ATTR_GID,
+                               .ia_uid = current_fsuid(),
-        if (cft->mode)
+                               .ia_gid = current_fsgid(), };
-                return cft->mode;
-        if (cft->read_u64 || cft->read_s64 || cft->seq_show)
-                mode |= S_IRUGO;
-        if (cft->write_u64 || cft->write_s64 || cft->write_string ||
+        if (uid_eq(iattr.ia_uid, GLOBAL_ROOT_UID) &&
-            cft->trigger)
+            gid_eq(iattr.ia_gid, GLOBAL_ROOT_GID))
-                mode |= S_IWUSR;
+                return 0;
-        return mode;
+        return kernfs_setattr(kn, &iattr);
 }
 static int cgroup_add_file(struct cgroup *cgrp, struct cftype *cft)
 {
-        struct dentry *dir = cgrp->dentry;
+        char name[CGROUP_FILE_NAME_MAX];
-        struct cgroup *parent = __d_cgrp(dir);
+        struct kernfs_node *kn;
-        struct dentry *dentry;
+        struct lock_class_key *key = NULL;
-        struct cfent *cfe;
+        int ret;
-        int error;
-        umode_t mode;
-        char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
-        if (cft->ss && !(cft->flags & CFTYPE_NO_PREFIX) &&
-            !(cgrp->root->flags & CGRP_ROOT_NOPREFIX)) {
-                strcpy(name, cft->ss->name);
-                strcat(name, ".");
-        }
-        strcat(name, cft->name);
-        BUG_ON(!mutex_is_locked(&dir->d_inode->i_mutex));
-        cfe = kzalloc(sizeof(*cfe), GFP_KERNEL);
-        if (!cfe)
-                return -ENOMEM;
-        dentry = lookup_one_len(name, dir, strlen(name));
-        if (IS_ERR(dentry)) {
-                error = PTR_ERR(dentry);
-                goto out;
-        }
-        cfe->type = (void *)cft;
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        cfe->dentry = dentry;
+        key = &cft->lockdep_key;
-        dentry->d_fsdata = cfe;
+#endif
-        simple_xattrs_init(&cfe->xattrs);
+        kn = __kernfs_create_file(cgrp->kn, cgroup_file_name(cgrp, cft, name),
+                                  cgroup_file_mode(cft), 0, cft->kf_ops, cft,
+                                  NULL, false, key);
+        if (IS_ERR(kn))
+                return PTR_ERR(kn);
-        mode = cgroup_file_mode(cft);
+        ret = cgroup_kn_set_ugid(kn);
-        error = cgroup_create_file(dentry, mode | S_IFREG, cgrp->root->sb);
+        if (ret)
-        if (!error) {
+                kernfs_remove(kn);
-                list_add_tail(&cfe->node, &parent->files);
+        return ret;
-                cfe = NULL;
-        }
-        dput(dentry);
-out:
-        kfree(cfe);
-        return error;
 }
 /**
@@ -2700,11 +2399,12 @@ static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
        struct cftype *cft;
        int ret;
-        lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
+        lockdep_assert_held(&cgroup_tree_mutex);
-        lockdep_assert_held(&cgroup_mutex);
        for (cft = cfts; cft->name[0] != '\0'; cft++) {
                /* does cft->flags tell us to skip this file on @cgrp? */
+                if ((cft->flags & CFTYPE_ONLY_ON_DFL) && !cgroup_on_dfl(cgrp))
+                        continue;
                if ((cft->flags & CFTYPE_INSANE) && cgroup_sane_behavior(cgrp))
                        continue;
                if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent)
@@ -2726,44 +2426,19 @@ static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
        return 0;
 }
-static void cgroup_cfts_prepare(void)
+static int cgroup_apply_cftypes(struct cftype *cfts, bool is_add)
-        __acquires(&cgroup_mutex)
-{
-        /*
-         * Thanks to the entanglement with vfs inode locking, we can't walk
-         * the existing cgroups under cgroup_mutex and create files.
-         * Instead, we use css_for_each_descendant_pre() and drop RCU read
-         * lock before calling cgroup_addrm_files().
-         */
-        mutex_lock(&cgroup_mutex);
-}
-static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
-        __releases(&cgroup_mutex)
 {
        LIST_HEAD(pending);
        struct cgroup_subsys *ss = cfts[0].ss;
-        struct cgroup *root = &ss->root->top_cgroup;
+        struct cgroup *root = &ss->root->cgrp;
-        struct super_block *sb = ss->root->sb;
-        struct dentry *prev = NULL;
-        struct inode *inode;
        struct cgroup_subsys_state *css;
-        u64 update_before;
        int ret = 0;
-        /* %NULL @cfts indicates abort and don't bother if @ss isn't attached */
+        lockdep_assert_held(&cgroup_tree_mutex);
-        if (!cfts || ss->root == &cgroup_dummy_root ||
-            !atomic_inc_not_zero(&sb->s_active)) {
-                mutex_unlock(&cgroup_mutex);
-                return 0;
-        }
-        /*
+        /* don't bother if @ss isn't attached */
-         * All cgroups which are created after we drop cgroup_mutex will
+        if (ss->root == &cgrp_dfl_root)
-         * have the updated set of files, so we only need to update the
+                return 0;
-         * cgroups created before the current @cgroup_serial_nr_next.
-         */
-        update_before = cgroup_serial_nr_next;
        /* add/rm files for all cgroups created before */
        css_for_each_descendant_pre(css, cgroup_css(root, ss)) {
@@ -2772,62 +2447,75 @@ static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
                if (cgroup_is_dead(cgrp))
                        continue;
-                inode = cgrp->dentry->d_inode;
+                ret = cgroup_addrm_files(cgrp, cfts, is_add);
-                dget(cgrp->dentry);
-                dput(prev);
-                prev = cgrp->dentry;
-                mutex_unlock(&cgroup_mutex);
-                mutex_lock(&inode->i_mutex);
-                mutex_lock(&cgroup_mutex);
-                if (cgrp->serial_nr < update_before && !cgroup_is_dead(cgrp))
-                        ret = cgroup_addrm_files(cgrp, cfts, is_add);
-                mutex_unlock(&inode->i_mutex);
                if (ret)
                        break;
        }
-        mutex_unlock(&cgroup_mutex);
-        dput(prev);
+        if (is_add && !ret)
-        deactivate_super(sb);
+                kernfs_activate(root->kn);
        return ret;
 }
-/**
+static void cgroup_exit_cftypes(struct cftype *cfts)
- * cgroup_add_cftypes - add an array of cftypes to a subsystem
- * @ss: target cgroup subsystem
- * @cfts: zero-length name terminated array of cftypes
- *
- * Register @cfts to @ss.  Files described by @cfts are created for all
- * existing cgroups to which @ss is attached and all future cgroups will
- * have them too.  This function can be called anytime whether @ss is
- * attached or not.
- *
- * Returns 0 on successful registration, -errno on failure.  Note that this
- * function currently returns 0 as long as @cfts registration is successful
- * even if some file creation attempts on existing cgroups fail.
- */
-int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
 {
-        struct cftype_set *set;
        struct cftype *cft;
-        int ret;
-        set = kzalloc(sizeof(*set), GFP_KERNEL);
+        for (cft = cfts; cft->name[0] != '\0'; cft++) {
-        if (!set)
+                /* free copy for custom atomic_write_len, see init_cftypes() */
-                return -ENOMEM;
+                if (cft->max_write_len && cft->max_write_len != PAGE_SIZE)
+                        kfree(cft->kf_ops);
+                cft->kf_ops = NULL;
+                cft->ss = NULL;
+        }
+}
+static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+{
+        struct cftype *cft;
+        for (cft = cfts; cft->name[0] != '\0'; cft++) {
+                struct kernfs_ops *kf_ops;
-        for (cft = cfts; cft->name[0] != '\0'; cft++)
+                WARN_ON(cft->ss || cft->kf_ops);
+                if (cft->seq_start)
+                        kf_ops = &cgroup_kf_ops;
+                else
+                        kf_ops = &cgroup_kf_single_ops;
+                /*
+                 * Ugh... if @cft wants a custom max_write_len, we need to
+                 * make a copy of kf_ops to set its atomic_write_len.
+                 */
+                if (cft->max_write_len && cft->max_write_len != PAGE_SIZE) {
+                        kf_ops = kmemdup(kf_ops, sizeof(*kf_ops), GFP_KERNEL);
+                        if (!kf_ops) {
+                                cgroup_exit_cftypes(cfts);
+                                return -ENOMEM;
+                        }
+                        kf_ops->atomic_write_len = cft->max_write_len;
+                }
+                cft->kf_ops = kf_ops;
                cft->ss = ss;
+        }
-        cgroup_cfts_prepare();
+        return 0;
-        set->cfts = cfts;
+}
-        list_add_tail(&set->node, &ss->cftsets);
-        ret = cgroup_cfts_commit(cfts, true);
+static int cgroup_rm_cftypes_locked(struct cftype *cfts)
-        if (ret)
+{
-                cgroup_rm_cftypes(cfts);
+        lockdep_assert_held(&cgroup_tree_mutex);
-        return ret;
+        if (!cfts || !cfts[0].ss)
+                return -ENOENT;
+        list_del(&cfts->node);
+        cgroup_apply_cftypes(cfts, false);
+        cgroup_exit_cftypes(cfts);
+        return 0;
 }
-EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
 /**
 * cgroup_rm_cftypes - remove an array of cftypes from a subsystem
@@ -2842,24 +2530,48 @@ EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
 */
 int cgroup_rm_cftypes(struct cftype *cfts)
 {
-        struct cftype_set *set;
+        int ret;
-        if (!cfts || !cfts[0].ss)
+        mutex_lock(&cgroup_tree_mutex);
-                return -ENOENT;
+        ret = cgroup_rm_cftypes_locked(cfts);
+        mutex_unlock(&cgroup_tree_mutex);
+        return ret;
+}
-        cgroup_cfts_prepare();
+/**
+ * cgroup_add_cftypes - add an array of cftypes to a subsystem
+ * @ss: target cgroup subsystem
+ * @cfts: zero-length name terminated array of cftypes
+ *
+ * Register @cfts to @ss.  Files described by @cfts are created for all
+ * existing cgroups to which @ss is attached and all future cgroups will
+ * have them too.  This function can be called anytime whether @ss is
+ * attached or not.
+ *
+ * Returns 0 on successful registration, -errno on failure.  Note that this
+ * function currently returns 0 as long as @cfts registration is successful
+ * even if some file creation attempts on existing cgroups fail.
+ */
+int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+{
+        int ret;
-        list_for_each_entry(set, &cfts[0].ss->cftsets, node) {
+        if (!cfts || cfts[0].name[0] == '\0')
-                if (set->cfts == cfts) {
+                return 0;
-                        list_del(&set->node);
-                        kfree(set);
-                        cgroup_cfts_commit(cfts, false);
-                        return 0;
-                }
-        }
-        cgroup_cfts_commit(NULL, false);
+        ret = cgroup_init_cftypes(ss, cfts);
-        return -ENOENT;
+        if (ret)
+                return ret;
+        mutex_lock(&cgroup_tree_mutex);
+        list_add_tail(&cfts->node, &ss->cfts);
+        ret = cgroup_apply_cftypes(cfts, true);
+        if (ret)
+                cgroup_rm_cftypes_locked(cfts);
+        mutex_unlock(&cgroup_tree_mutex);
+        return ret;
 }
 /**
@@ -2868,57 +2580,18 @@ int cgroup_rm_cftypes(struct cftype *cfts)
 *
 * Return the number of tasks in the cgroup.
 */
-int cgroup_task_count(const struct cgroup *cgrp)
+static int cgroup_task_count(const struct cgroup *cgrp)
 {
        int count = 0;
        struct cgrp_cset_link *link;
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
        list_for_each_entry(link, &cgrp->cset_links, cset_link)
                count += atomic_read(&link->cset->refcount);
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
        return count;
 }
-/*
- * To reduce the fork() overhead for systems that are not actually using
- * their cgroups capability, we don't maintain the lists running through
- * each css_set to its tasks until we see the list actually used - in other
- * words after the first call to css_task_iter_start().
- */
-static void cgroup_enable_task_cg_lists(void)
-{
-        struct task_struct *p, *g;
-        write_lock(&css_set_lock);
-        use_task_css_set_links = 1;
-        /*
-         * We need tasklist_lock because RCU is not safe against
-         * while_each_thread(). Besides, a forking task that has passed
-         * cgroup_post_fork() without seeing use_task_css_set_links = 1
-         * is not guaranteed to have its child immediately visible in the
-         * tasklist if we walk through it with RCU.
-         */
-        read_lock(&tasklist_lock);
-        do_each_thread(g, p) {
-                task_lock(p);
-                /*
-                 * We should check if the process is exiting, otherwise
-                 * it will race with cgroup_exit() in that the list
-                 * entry won't be deleted though the process has exited.
-                 * Do it while holding siglock so that we don't end up
-                 * racing against cgroup_exit().
-                 */
-                spin_lock_irq(&p->sighand->siglock);
-                if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
-                        list_add(&p->cg_list, &task_css_set(p)->tasks);
-                spin_unlock_irq(&p->sighand->siglock);
-                task_unlock(p);
-        } while_each_thread(g, p);
-        read_unlock(&tasklist_lock);
-        write_unlock(&css_set_lock);
-}
 /**
 * css_next_child - find the next child of a given css
 * @pos_css: the current position (%NULL to initiate traversal)
@@ -2937,7 +2610,7 @@ css_next_child(struct cgroup_subsys_state *pos_css,
        struct cgroup *cgrp = parent_css->cgroup;
        struct cgroup *next;
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
        /*
         * @pos could already have been removed.  Once a cgroup is removed,
@@ -2973,7 +2646,6 @@ css_next_child(struct cgroup_subsys_state *pos_css,
        return cgroup_css(next, parent_css->ss);
 }
-EXPORT_SYMBOL_GPL(css_next_child);
 /**
 * css_next_descendant_pre - find the next descendant for pre-order walk
@@ -2995,7 +2667,7 @@ css_next_descendant_pre(struct cgroup_subsys_state *pos,
 {
        struct cgroup_subsys_state *next;
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
        /* if first iteration, visit @root */
        if (!pos)
@@ -3016,7 +2688,6 @@ css_next_descendant_pre(struct cgroup_subsys_state *pos,
        return NULL;
 }
-EXPORT_SYMBOL_GPL(css_next_descendant_pre);
 /**
 * css_rightmost_descendant - return the rightmost descendant of a css
@@ -3036,7 +2707,7 @@ css_rightmost_descendant(struct cgroup_subsys_state *pos)
 {
        struct cgroup_subsys_state *last, *tmp;
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
        do {
                last = pos;
@@ -3048,7 +2719,6 @@ css_rightmost_descendant(struct cgroup_subsys_state *pos)
        return last;
 }
-EXPORT_SYMBOL_GPL(css_rightmost_descendant);
 static struct cgroup_subsys_state *
 css_leftmost_descendant(struct cgroup_subsys_state *pos)
@@ -3084,7 +2754,7 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
 {
        struct cgroup_subsys_state *next;
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
        /* if first iteration, visit leftmost descendant which may be @root */
        if (!pos)
@@ -3102,7 +2772,6 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
        /* no sibling left, visit parent */
        return css_parent(pos);
 }
-EXPORT_SYMBOL_GPL(css_next_descendant_post);
 /**
 * css_advance_task_iter - advance a task itererator to the next css_set
@@ -3125,9 +2794,14 @@ static void css_advance_task_iter(struct css_task_iter *it)
                }
                link = list_entry(l, struct cgrp_cset_link, cset_link);
                cset = link->cset;
-        } while (list_empty(&cset->tasks));
+        } while (list_empty(&cset->tasks) && list_empty(&cset->mg_tasks));
        it->cset_link = l;
-        it->task = cset->tasks.next;
+        if (!list_empty(&cset->tasks))
+                it->task = cset->tasks.next;
+        else
+                it->task = cset->mg_tasks.next;
 }
 /**
@@ -3146,17 +2820,12 @@ static void css_advance_task_iter(struct css_task_iter *it)
 */
 void css_task_iter_start(struct cgroup_subsys_state *css,
                         struct css_task_iter *it)
-        __acquires(css_set_lock)
+        __acquires(css_set_rwsem)
 {
-        /*
+        /* no one should try to iterate before mounting cgroups */
-         * The first time anyone tries to iterate across a css, we need to
+        WARN_ON_ONCE(!use_task_css_set_links);
-         * enable the list linking each css_set to its tasks, and fix up
-         * all existing tasks.
-         */
-        if (!use_task_css_set_links)
-                cgroup_enable_task_cg_lists();
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
        it->origin_css = css;
        it->cset_link = &css->cgroup->cset_links;
@@ -3176,24 +2845,29 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 {
        struct task_struct *res;
        struct list_head *l = it->task;
-        struct cgrp_cset_link *link;
+        struct cgrp_cset_link *link = list_entry(it->cset_link,
+                                        struct cgrp_cset_link, cset_link);
        /* If the iterator cg is NULL, we have no tasks */
        if (!it->cset_link)
                return NULL;
        res = list_entry(l, struct task_struct, cg_list);
-        /* Advance iterator to find next entry */
+        /*
+         * Advance iterator to find next entry.  cset->tasks is consumed
+         * first and then ->mg_tasks.  After ->mg_tasks, we move onto the
+         * next cset.
+         */
        l = l->next;
-        link = list_entry(it->cset_link, struct cgrp_cset_link, cset_link);
-        if (l == &link->cset->tasks) {
+        if (l == &link->cset->tasks)
-                /*
+                l = link->cset->mg_tasks.next;
-                 * We reached the end of this task list - move on to the
-                 * next cgrp_cset_link.
+        if (l == &link->cset->mg_tasks)
-                 */
                css_advance_task_iter(it);
-        } else {
+        else
                it->task = l;
-        }
        return res;
 }
@@ -3204,191 +2878,62 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 * Finish task iteration started by css_task_iter_start().
 */
 void css_task_iter_end(struct css_task_iter *it)
-        __releases(css_set_lock)
+        __releases(css_set_rwsem)
-{
-        read_unlock(&css_set_lock);
-}
-static inline int started_after_time(struct task_struct *t1,
-                                     struct timespec *time,
-                                     struct task_struct *t2)
-{
-        int start_diff = timespec_compare(&t1->start_time, time);
-        if (start_diff > 0) {
-                return 1;
-        } else if (start_diff < 0) {
-                return 0;
-        } else {
-                /*
-                 * Arbitrarily, if two processes started at the same
-                 * time, we'll say that the lower pointer value
-                 * started first. Note that t2 may have exited by now
-                 * so this may not be a valid pointer any longer, but
-                 * that's fine - it still serves to distinguish
-                 * between two tasks started (effectively) simultaneously.
-                 */
-                return t1 > t2;
-        }
-}
-/*
- * This function is a callback from heap_insert() and is used to order
- * the heap.
- * In this case we order the heap in descending task start time.
- */
-static inline int started_after(void *p1, void *p2)
 {
-        struct task_struct *t1 = p1;
+        up_read(&css_set_rwsem);
-        struct task_struct *t2 = p2;
-        return started_after_time(t1, &t2->start_time, t2);
 }
 /**
- * css_scan_tasks - iterate though all the tasks in a css
+ * cgroup_trasnsfer_tasks - move tasks from one cgroup to another
- * @css: the css to iterate tasks of
+ * @to: cgroup to which the tasks will be moved
- * @test: optional test callback
+ * @from: cgroup in which the tasks currently reside
- * @process: process callback
- * @data: data passed to @test and @process
- * @heap: optional pre-allocated heap used for task iteration
- *
- * Iterate through all the tasks in @css, calling @test for each, and if it
- * returns %true, call @process for it also.
- *
- * @test may be NULL, meaning always true (select all tasks), which
- * effectively duplicates css_task_iter_{start,next,end}() but does not
- * lock css_set_lock for the call to @process.
- *
- * It is guaranteed that @process will act on every task that is a member
- * of @css for the duration of this call.  This function may or may not
- * call @process for tasks that exit or move to a different css during the
- * call, or are forked or move into the css during the call.
- *
- * Note that @test may be called with locks held, and may in some
- * situations be called multiple times for the same task, so it should be
- * cheap.
 *
- * If @heap is non-NULL, a heap has been pre-allocated and will be used for
+ * Locking rules between cgroup_post_fork() and the migration path
- * heap operations (and its "gt" member will be overwritten), else a
+ * guarantee that, if a task is forking while being migrated, the new child
- * temporary heap will be used (allocation of which may cause this function
+ * is guaranteed to be either visible in the source cgroup after the
- * to fail).
+ * parent's migration is complete or put into the target cgroup.  No task
+ * can slip out of migration through forking.
 */
-int css_scan_tasks(struct cgroup_subsys_state *css,
+int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
-                   bool (*test)(struct task_struct *, void *),
-                   void (*process)(struct task_struct *, void *),
-                   void *data, struct ptr_heap *heap)
 {
-        int retval, i;
+        LIST_HEAD(preloaded_csets);
+        struct cgrp_cset_link *link;
        struct css_task_iter it;
-        struct task_struct *p, *dropped;
+        struct task_struct *task;
-        /* Never dereference latest_task, since it's not refcounted */
+        int ret;
-        struct task_struct *latest_task = NULL;
-        struct ptr_heap tmp_heap;
-        struct timespec latest_time = { 0, 0 };
-        if (heap) {
-                /* The caller supplied our heap and pre-allocated its memory */
-                heap->gt = &started_after;
-        } else {
-                /* We need to allocate our own heap memory */
-                heap = &tmp_heap;
-                retval = heap_init(heap, PAGE_SIZE, GFP_KERNEL, &started_after);
-                if (retval)
-                        /* cannot allocate the heap */
-                        return retval;
-        }
- again:
+        mutex_lock(&cgroup_mutex);
-        /*
-         * Scan tasks in the css, using the @test callback to determine
-         * which are of interest, and invoking @process callback on the
-         * ones which need an update.  Since we don't want to hold any
-         * locks during the task updates, gather tasks to be processed in a
-         * heap structure.  The heap is sorted by descending task start
-         * time.  If the statically-sized heap fills up, we overflow tasks
-         * that started later, and in future iterations only consider tasks
-         * that started after the latest task in the previous pass. This
-         * guarantees forward progress and that we don't miss any tasks.
-         */
-        heap->size = 0;
-        css_task_iter_start(css, &it);
-        while ((p = css_task_iter_next(&it))) {
-                /*
-                 * Only affect tasks that qualify per the caller's callback,
-                 * if he provided one
-                 */
-                if (test && !test(p, data))
-                        continue;
-                /*
-                 * Only process tasks that started after the last task
-                 * we processed
-                 */
-                if (!started_after_time(p, &latest_time, latest_task))
-                        continue;
-                dropped = heap_insert(heap, p);
-                if (dropped == NULL) {
-                        /*
-                         * The new task was inserted; the heap wasn't
-                         * previously full
-                         */
-                        get_task_struct(p);
-                } else if (dropped != p) {
-                        /*
-                         * The new task was inserted, and pushed out a
-                         * different task
-                         */
-                        get_task_struct(p);
-                        put_task_struct(dropped);
-                }
-                /*
-                 * Else the new task was newer than anything already in
-                 * the heap and wasn't inserted
-                 */
-        }
-        css_task_iter_end(&it);
-        if (heap->size) {
+        /* all tasks in @from are being moved, all csets are source */
-                for (i = 0; i < heap->size; i++) {
+        down_read(&css_set_rwsem);
-                        struct task_struct *q = heap->ptrs[i];
+        list_for_each_entry(link, &from->cset_links, cset_link)
-                        if (i == 0) {
+                cgroup_migrate_add_src(link->cset, to, &preloaded_csets);
-                                latest_time = q->start_time;
+        up_read(&css_set_rwsem);
-                                latest_task = q;
-                        }
-                        /* Process the task per the caller's callback */
-                        process(q, data);
-                        put_task_struct(q);
-                }
-                /*
-                 * If we had to process any tasks at all, scan again
-                 * in case some of them were in the middle of forking
-                 * children that didn't get processed.
-                 * Not the most efficient way to do it, but it avoids
-                 * having to take callback_mutex in the fork path
-                 */
-                goto again;
-        }
-        if (heap == &tmp_heap)
-                heap_free(&tmp_heap);
-        return 0;
-}
-static void cgroup_transfer_one_task(struct task_struct *task, void *data)
+        ret = cgroup_migrate_prepare_dst(to, &preloaded_csets);
-{
+        if (ret)
-        struct cgroup *new_cgroup = data;
+                goto out_err;
-        mutex_lock(&cgroup_mutex);
+        /*
-        cgroup_attach_task(new_cgroup, task, false);
+         * Migrate tasks one-by-one until @form is empty.  This fails iff
+         * ->can_attach() fails.
+         */
+        do {
+                css_task_iter_start(&from->dummy_css, &it);
+                task = css_task_iter_next(&it);
+                if (task)
+                        get_task_struct(task);
+                css_task_iter_end(&it);
+                if (task) {
+                        ret = cgroup_migrate(to, task, false);
+                        put_task_struct(task);
+                }
+        } while (task && !ret);
+out_err:
+        cgroup_migrate_finish(&preloaded_csets);
        mutex_unlock(&cgroup_mutex);
-}
+        return ret;
-/**
- * cgroup_trasnsfer_tasks - move tasks from one cgroup to another
- * @to: cgroup to which the tasks will be moved
- * @from: cgroup in which the tasks currently reside
- */
-int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
-{
-        return css_scan_tasks(&from->dummy_css, NULL, cgroup_transfer_one_task,
-                              to, NULL);
 }
 /*
@@ -3687,21 +3232,31 @@ static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type,
 */
 int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
 {
-        int ret = -EINVAL;
+        struct kernfs_node *kn = kernfs_node_from_dentry(dentry);
        struct cgroup *cgrp;
        struct css_task_iter it;
        struct task_struct *tsk;
+        /* it should be kernfs_node belonging to cgroupfs and is a directory */
+        if (dentry->d_sb->s_type != &cgroup_fs_type || !kn ||
+            kernfs_type(kn) != KERNFS_DIR)
+                return -EINVAL;
+        mutex_lock(&cgroup_mutex);
        /*
-         * Validate dentry by checking the superblock operations,
+         * We aren't being called from kernfs and there's no guarantee on
-         * and make sure it's a directory.
+         * @kn->priv's validity.  For this and css_tryget_from_dir(),
+         * @kn->priv is RCU safe.  Let's do the RCU dancing.
         */
-        if (dentry->d_sb->s_op != &cgroup_ops ||
+        rcu_read_lock();
-            !S_ISDIR(dentry->d_inode->i_mode))
+        cgrp = rcu_dereference(kn->priv);
-                 goto err;
+        if (!cgrp || cgroup_is_dead(cgrp)) {
+                rcu_read_unlock();
-        ret = 0;
+                mutex_unlock(&cgroup_mutex);
-        cgrp = dentry->d_fsdata;
+                return -ENOENT;
+        }
+        rcu_read_unlock();
        css_task_iter_start(&cgrp->dummy_css, &it);
        while ((tsk = css_task_iter_next(&it))) {
@@ -3726,8 +3281,8 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
        }
        css_task_iter_end(&it);
-err:
+        mutex_unlock(&cgroup_mutex);
-        return ret;
+        return 0;
 }
@@ -3745,7 +3300,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
         * after a seek to the start). Use a binary-search to find the
         * next pid to display, if any
         */
-        struct cgroup_open_file *of = s->private;
+        struct kernfs_open_file *of = s->private;
        struct cgroup *cgrp = seq_css(s)->cgroup;
        struct cgroup_pidlist *l;
        enum cgroup_filetype type = seq_cft(s)->private;
@@ -3800,7 +3355,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 {
-        struct cgroup_open_file *of = s->private;
+        struct kernfs_open_file *of = s->private;
        struct cgroup_pidlist *l = of->priv;
        if (l)
@@ -3811,7 +3366,7 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct cgroup_open_file *of = s->private;
+        struct kernfs_open_file *of = s->private;
        struct cgroup_pidlist *l = of->priv;
        pid_t *p = v;
        pid_t *end = l->list + l->length;
@@ -3861,23 +3416,6 @@ static int cgroup_write_notify_on_release(struct cgroup_subsys_state *css,
        return 0;
 }
-/*
- * When dput() is called asynchronously, if umount has been done and
- * then deactivate_super() in cgroup_free_fn() kills the superblock,
- * there's a small window that vfs will see the root dentry with non-zero
- * refcnt and trigger BUG().
- *
- * That's why we hold a reference before dput() and drop it right after.
- */
-static void cgroup_dput(struct cgroup *cgrp)
-{
-        struct super_block *sb = cgrp->root->sb;
-        atomic_inc(&sb->s_active);
-        dput(cgrp->dentry);
-        deactivate_super(sb);
-}
 static u64 cgroup_clone_children_read(struct cgroup_subsys_state *css,
                                      struct cftype *cft)
 {
@@ -3944,7 +3482,7 @@ static struct cftype cgroup_base_files[] = {
                .flags = CFTYPE_INSANE | CFTYPE_ONLY_ON_ROOT,
                .seq_show = cgroup_release_agent_show,
                .write_string = cgroup_release_agent_write,
-                .max_write_len = PATH_MAX,
+                .max_write_len = PATH_MAX - 1,
        },
        { }     /* terminate */
 };
@@ -3963,13 +3501,13 @@ static int cgroup_populate_dir(struct cgroup *cgrp, unsigned long subsys_mask)
        /* process cftsets of each subsystem */
        for_each_subsys(ss, i) {
-                struct cftype_set *set;
+                struct cftype *cfts;
                if (!test_bit(i, &subsys_mask))
                        continue;
-                list_for_each_entry(set, &ss->cftsets, node) {
+                list_for_each_entry(cfts, &ss->cfts, node) {
-                        ret = cgroup_addrm_files(cgrp, set->cfts, true);
+                        ret = cgroup_addrm_files(cgrp, cfts, true);
                        if (ret < 0)
                                goto err;
                }
@@ -4012,7 +3550,7 @@ static void css_free_work_fn(struct work_struct *work)
                css_put(css->parent);
        css->ss->css_free(css);
-        cgroup_dput(cgrp);
+        cgroup_put(cgrp);
 }
 static void css_free_rcu_fn(struct rcu_head *rcu_head)
@@ -4020,10 +3558,6 @@ static void css_free_rcu_fn(struct rcu_head *rcu_head)
        struct cgroup_subsys_state *css =
                container_of(rcu_head, struct cgroup_subsys_state, rcu_head);
-        /*
-         * css holds an extra ref to @cgrp->dentry which is put on the last
-         * css_put().  dput() requires process context which we don't have.
-         */
        INIT_WORK(&css->destroy_work, css_free_work_fn);
        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
@@ -4033,7 +3567,7 @@ static void css_release(struct percpu_ref *ref)
        struct cgroup_subsys_state *css =
                container_of(ref, struct cgroup_subsys_state, refcnt);
-        rcu_assign_pointer(css->cgroup->subsys[css->ss->subsys_id], NULL);
+        RCU_INIT_POINTER(css->cgroup->subsys[css->ss->id], NULL);
        call_rcu(&css->rcu_head, css_free_rcu_fn);
 }
@@ -4058,6 +3592,7 @@ static int online_css(struct cgroup_subsys_state *css)
        struct cgroup_subsys *ss = css->ss;
        int ret = 0;
+        lockdep_assert_held(&cgroup_tree_mutex);
        lockdep_assert_held(&cgroup_mutex);
        if (ss->css_online)
@@ -4065,7 +3600,7 @@ static int online_css(struct cgroup_subsys_state *css)
        if (!ret) {
                css->flags |= CSS_ONLINE;
                css->cgroup->nr_css++;
-                rcu_assign_pointer(css->cgroup->subsys[ss->subsys_id], css);
+                rcu_assign_pointer(css->cgroup->subsys[ss->id], css);
        }
        return ret;
 }
@@ -4075,6 +3610,7 @@ static void offline_css(struct cgroup_subsys_state *css)
 {
        struct cgroup_subsys *ss = css->ss;
+        lockdep_assert_held(&cgroup_tree_mutex);
        lockdep_assert_held(&cgroup_mutex);
        if (!(css->flags & CSS_ONLINE))
@@ -4085,7 +3621,7 @@ static void offline_css(struct cgroup_subsys_state *css)
        css->flags &= ~CSS_ONLINE;
        css->cgroup->nr_css--;
-        RCU_INIT_POINTER(css->cgroup->subsys[ss->subsys_id], css);
+        RCU_INIT_POINTER(css->cgroup->subsys[ss->id], css);
 }
 /**
@@ -4103,7 +3639,6 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        struct cgroup_subsys_state *css;
        int err;
-        lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
        lockdep_assert_held(&cgroup_mutex);
        css = ss->css_alloc(cgroup_css(parent, ss));
@@ -4116,7 +3651,7 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        init_css(css, ss, cgrp);
-        err = cgroup_populate_dir(cgrp, 1 << ss->subsys_id);
+        err = cgroup_populate_dir(cgrp, 1 << ss->id);
        if (err)
                goto err_free_percpu_ref;
@@ -4124,9 +3659,11 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        if (err)
                goto err_clear_dir;
-        dget(cgrp->dentry);
+        cgroup_get(cgrp);
        css_get(css->parent);
+        cgrp->subsys_mask |= 1 << ss->id;
        if (ss->broken_hierarchy && !ss->warned_broken_hierarchy &&
            parent->parent) {
                pr_warning("cgroup: %s (%d) created nested cgroup for controller \"%s\" which has incomplete hierarchy support. Nested cgroups may change behavior in the future.\n",
@@ -4139,7 +3676,7 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        return 0;
 err_clear_dir:
-        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->id);
 err_free_percpu_ref:
        percpu_ref_cancel_init(&css->refcnt);
 err_free_css:
@@ -4147,35 +3684,34 @@ err_free_css:
        return err;
 }
-/*
+/**
 * cgroup_create - create a cgroup
 * @parent: cgroup that will be parent of the new cgroup
- * @dentry: dentry of the new cgroup
+ * @name: name of the new cgroup
- * @mode: mode to set on new inode
+ * @mode: mode to set on new cgroup
- *
- * Must be called with the mutex on the parent inode held
 */
-static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
+static long cgroup_create(struct cgroup *parent, const char *name,
-                             umode_t mode)
+                          umode_t mode)
 {
        struct cgroup *cgrp;
-        struct cgroup_name *name;
+        struct cgroup_root *root = parent->root;
-        struct cgroupfs_root *root = parent->root;
        int ssid, err;
        struct cgroup_subsys *ss;
-        struct super_block *sb = root->sb;
+        struct kernfs_node *kn;
+        /*
+         * XXX: The default hierarchy isn't fully implemented yet.  Block
+         * !root cgroup creation on it for now.
+         */
+        if (root == &cgrp_dfl_root)
+                return -EINVAL;
        /* allocate the cgroup and its ID, 0 is reserved for the root */
        cgrp = kzalloc(sizeof(*cgrp), GFP_KERNEL);
        if (!cgrp)
                return -ENOMEM;
-        name = cgroup_alloc_name(dentry);
+        mutex_lock(&cgroup_tree_mutex);
-        if (!name) {
-                err = -ENOMEM;
-                goto err_free_cgrp;
-        }
-        rcu_assign_pointer(cgrp->name, name);
        /*
         * Only live parents can have children.  Note that the liveliness
@@ -4186,7 +3722,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         */
        if (!cgroup_lock_live_group(parent)) {
                err = -ENODEV;
-                goto err_free_name;
+                goto err_unlock_tree;
        }
        /*
@@ -4199,18 +3735,8 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                goto err_unlock;
        }
-        /* Grab a reference on the superblock so the hierarchy doesn't
-         * get deleted on unmount if there are child cgroups.  This
-         * can be done outside cgroup_mutex, since the sb can't
-         * disappear while someone has an open control file on the
-         * fs */
-        atomic_inc(&sb->s_active);
        init_cgroup_housekeeping(cgrp);
-        dentry->d_fsdata = cgrp;
-        cgrp->dentry = dentry;
        cgrp->parent = parent;
        cgrp->dummy_css.parent = &parent->dummy_css;
        cgrp->root = parent->root;
@@ -4221,24 +3747,26 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
        if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &parent->flags))
                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &cgrp->flags);
+        /* create the directory */
+        kn = kernfs_create_dir(parent->kn, name, mode, cgrp);
+        if (IS_ERR(kn)) {
+                err = PTR_ERR(kn);
+                goto err_free_id;
+        }
+        cgrp->kn = kn;
        /*
-         * Create directory.  cgroup_create_file() returns with the new
+         * This extra ref will be put in cgroup_free_fn() and guarantees
-         * directory locked on success so that it can be populated without
+         * that @cgrp->kn is always accessible.
-         * dropping cgroup_mutex.
         */
-        err = cgroup_create_file(dentry, S_IFDIR | mode, sb);
+        kernfs_get(kn);
-        if (err < 0)
-                goto err_free_id;
-        lockdep_assert_held(&dentry->d_inode->i_mutex);
        cgrp->serial_nr = cgroup_serial_nr_next++;
        /* allocation complete, commit to creation */
        list_add_tail_rcu(&cgrp->sibling, &cgrp->parent->children);
-        root->number_of_cgroups++;
+        atomic_inc(&root->nr_cgrps);
+        cgroup_get(parent);
-        /* hold a ref to the parent's dentry */
-        dget(parent->dentry);
        /*
         * @cgrp is now fully operational.  If something fails after this
@@ -4246,49 +3774,66 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         */
        idr_replace(&root->cgroup_idr, cgrp, cgrp->id);
+        err = cgroup_kn_set_ugid(kn);
+        if (err)
+                goto err_destroy;
        err = cgroup_addrm_files(cgrp, cgroup_base_files, true);
        if (err)
                goto err_destroy;
        /* let's create and online css's */
        for_each_subsys(ss, ssid) {
-                if (root->subsys_mask & (1 << ssid)) {
+                if (root->cgrp.subsys_mask & (1 << ssid)) {
                        err = create_css(cgrp, ss);
                        if (err)
                                goto err_destroy;
                }
        }
+        kernfs_activate(kn);
        mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
        return 0;
 err_free_id:
        idr_remove(&root->cgroup_idr, cgrp->id);
-        /* Release the reference count that we took on the superblock */
-        deactivate_super(sb);
 err_unlock:
        mutex_unlock(&cgroup_mutex);
-err_free_name:
+err_unlock_tree:
-        kfree(rcu_dereference_raw(cgrp->name));
+        mutex_unlock(&cgroup_tree_mutex);
-err_free_cgrp:
        kfree(cgrp);
        return err;
 err_destroy:
        cgroup_destroy_locked(cgrp);
        mutex_unlock(&cgroup_mutex);
-        mutex_unlock(&dentry->d_inode->i_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
        return err;
 }
-static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
+                        umode_t mode)
 {
-        struct cgroup *c_parent = dentry->d_parent->d_fsdata;
+        struct cgroup *parent = parent_kn->priv;
+        int ret;
+        /*
+         * cgroup_create() grabs cgroup_tree_mutex which nests outside
+         * kernfs active_ref and cgroup_create() already synchronizes
+         * properly against removal through cgroup_lock_live_group().
+         * Break it before calling cgroup_create().
+         */
+        cgroup_get(parent);
+        kernfs_break_active_protection(parent_kn);
+        ret = cgroup_create(parent, name, mode);
-        /* the vfs holds inode->i_mutex already */
+        kernfs_unbreak_active_protection(parent_kn);
-        return cgroup_create(c_parent, dentry, mode | S_IFDIR);
+        cgroup_put(parent);
+        return ret;
 }
 /*
@@ -4301,6 +3846,7 @@ static void css_killed_work_fn(struct work_struct *work)
                container_of(work, struct cgroup_subsys_state, destroy_work);
        struct cgroup *cgrp = css->cgroup;
+        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
        /*
@@ -4318,6 +3864,7 @@ static void css_killed_work_fn(struct work_struct *work)
                cgroup_destroy_css_killed(cgrp);
        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
        /*
         * Put the css refs from kill_css().  Each css holds an extra
@@ -4339,18 +3886,15 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
-/**
+static void __kill_css(struct cgroup_subsys_state *css)
- * kill_css - destroy a css
- * @css: css to destroy
- *
- * This function initiates destruction of @css by removing cgroup interface
- * files and putting its base reference.  ->css_offline() will be invoked
- * asynchronously once css_tryget() is guaranteed to fail and when the
- * reference count reaches zero, @css will be released.
- */
-static void kill_css(struct cgroup_subsys_state *css)
 {
-        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+        lockdep_assert_held(&cgroup_tree_mutex);
+        /*
+         * This must happen before css is disassociated with its cgroup.
+         * See seq_css() for details.
+         */
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->id);
        /*
         * Killing would put the base ref, but we need to keep it alive
@@ -4372,6 +3916,28 @@ static void kill_css(struct cgroup_subsys_state *css)
 }
 /**
+ * kill_css - destroy a css
+ * @css: css to destroy
+ *
+ * This function initiates destruction of @css by removing cgroup interface
+ * files and putting its base reference.  ->css_offline() will be invoked
+ * asynchronously once css_tryget() is guaranteed to fail and when the
+ * reference count reaches zero, @css will be released.
+ */
+static void kill_css(struct cgroup_subsys_state *css)
+{
+        struct cgroup *cgrp = css->cgroup;
+        lockdep_assert_held(&cgroup_tree_mutex);
+        /* if already killed, noop */
+        if (cgrp->subsys_mask & (1 << css->ss->id)) {
+                cgrp->subsys_mask &= ~(1 << css->ss->id);
+                __kill_css(css);
+        }
+}
+/**
 * cgroup_destroy_locked - the first stage of cgroup destruction
 * @cgrp: cgroup to be destroyed
 *
@@ -4398,22 +3964,21 @@ static void kill_css(struct cgroup_subsys_state *css)
 static int cgroup_destroy_locked(struct cgroup *cgrp)
        __releases(&cgroup_mutex) __acquires(&cgroup_mutex)
 {
-        struct dentry *d = cgrp->dentry;
-        struct cgroup_subsys_state *css;
        struct cgroup *child;
+        struct cgroup_subsys_state *css;
        bool empty;
        int ssid;
-        lockdep_assert_held(&d->d_inode->i_mutex);
+        lockdep_assert_held(&cgroup_tree_mutex);
        lockdep_assert_held(&cgroup_mutex);
        /*
-         * css_set_lock synchronizes access to ->cset_links and prevents
+         * css_set_rwsem synchronizes access to ->cset_links and prevents
-         * @cgrp from being removed while __put_css_set() is in progress.
+         * @cgrp from being removed while put_css_set() is in progress.
         */
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
        empty = list_empty(&cgrp->cset_links);
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
        if (!empty)
                return -EBUSY;
@@ -4434,14 +3999,6 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
                return -EBUSY;
        /*
-         * Initiate massacre of all css's.  cgroup_destroy_css_killed()
-         * will be invoked to perform the rest of destruction once the
-         * percpu refs of all css's are confirmed to be killed.
-         */
-        for_each_css(css, ssid, cgrp)
-                kill_css(css);
-        /*
         * Mark @cgrp dead.  This prevents further task migration and child
         * creation by disabling cgroup_lock_live_group().  Note that
         * CGRP_DEAD assertion is depended upon by css_next_child() to
@@ -4450,6 +4007,17 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
         */
        set_bit(CGRP_DEAD, &cgrp->flags);
+        /*
+         * Initiate massacre of all css's.  cgroup_destroy_css_killed()
+         * will be invoked to perform the rest of destruction once the
+         * percpu refs of all css's are confirmed to be killed.  This
+         * involves removing the subsystem's files, drop cgroup_mutex.
+         */
+        mutex_unlock(&cgroup_mutex);
+        for_each_css(css, ssid, cgrp)
+                kill_css(css);
+        mutex_lock(&cgroup_mutex);
        /* CGRP_DEAD is set, remove from ->release_list for the last time */
        raw_spin_lock(&release_list_lock);
        if (!list_empty(&cgrp->release_list))
@@ -4465,14 +4033,20 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
        if (!cgrp->nr_css)
                cgroup_destroy_css_killed(cgrp);
+        /* remove @cgrp directory along with the base files */
+        mutex_unlock(&cgroup_mutex);
        /*
-         * Clear the base files and remove @cgrp directory.  The removal
+         * There are two control paths which try to determine cgroup from
-         * puts the base ref but we aren't quite done with @cgrp yet, so
+         * dentry without going through kernfs - cgroupstats_build() and
-         * hold onto it.
+         * css_tryget_from_dir().  Those are supported by RCU protecting
+         * clearing of cgrp->kn->priv backpointer, which should happen
+         * after all files under it have been removed.
         */
-        cgroup_addrm_files(cgrp, cgroup_base_files, false);
+        kernfs_remove(cgrp->kn);        /* @cgrp has an extra ref on its kn */
-        dget(d);
+        RCU_INIT_POINTER(*(void __rcu __force **)&cgrp->kn->priv, NULL);
-        cgroup_d_remove_dir(d);
+        mutex_lock(&cgroup_mutex);
        return 0;
 };
@@ -4489,72 +4063,82 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
 static void cgroup_destroy_css_killed(struct cgroup *cgrp)
 {
        struct cgroup *parent = cgrp->parent;
-        struct dentry *d = cgrp->dentry;
+        lockdep_assert_held(&cgroup_tree_mutex);
        lockdep_assert_held(&cgroup_mutex);
        /* delete this cgroup from parent->children */
        list_del_rcu(&cgrp->sibling);
-        dput(d);
+        cgroup_put(cgrp);
        set_bit(CGRP_RELEASABLE, &parent->flags);
        check_for_release(parent);
 }
-static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
+static int cgroup_rmdir(struct kernfs_node *kn)
 {
-        int ret;
+        struct cgroup *cgrp = kn->priv;
+        int ret = 0;
-        mutex_lock(&cgroup_mutex);
-        ret = cgroup_destroy_locked(dentry->d_fsdata);
-        mutex_unlock(&cgroup_mutex);
-        return ret;
+        /*
-}
+         * This is self-destruction but @kn can't be removed while this
+         * callback is in progress.  Let's break active protection.  Once
+         * the protection is broken, @cgrp can be destroyed at any point.
+         * Pin it so that it stays accessible.
+         */
+        cgroup_get(cgrp);
+        kernfs_break_active_protection(kn);
-static void __init_or_module cgroup_init_cftsets(struct cgroup_subsys *ss)
+        mutex_lock(&cgroup_tree_mutex);
-{
+        mutex_lock(&cgroup_mutex);
-        INIT_LIST_HEAD(&ss->cftsets);
        /*
-         * base_cftset is embedded in subsys itself, no need to worry about
+         * @cgrp might already have been destroyed while we're trying to
-         * deregistration.
+         * grab the mutexes.
         */
-        if (ss->base_cftypes) {
+        if (!cgroup_is_dead(cgrp))
-                struct cftype *cft;
+                ret = cgroup_destroy_locked(cgrp);
-                for (cft = ss->base_cftypes; cft->name[0] != '\0'; cft++)
+        mutex_unlock(&cgroup_mutex);
-                        cft->ss = ss;
+        mutex_unlock(&cgroup_tree_mutex);
-                ss->base_cftset.cfts = ss->base_cftypes;
+        kernfs_unbreak_active_protection(kn);
-                list_add_tail(&ss->base_cftset.node, &ss->cftsets);
+        cgroup_put(cgrp);
-        }
+        return ret;
 }
+static struct kernfs_syscall_ops cgroup_kf_syscall_ops = {
+        .remount_fs             = cgroup_remount,
+        .show_options           = cgroup_show_options,
+        .mkdir                  = cgroup_mkdir,
+        .rmdir                  = cgroup_rmdir,
+        .rename                 = cgroup_rename,
+};
 static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
 {
        struct cgroup_subsys_state *css;
        printk(KERN_INFO "Initializing cgroup subsys %s\n", ss->name);
+        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
-        /* init base cftset */
+        INIT_LIST_HEAD(&ss->cfts);
-        cgroup_init_cftsets(ss);
-        /* Create the top cgroup state for this subsystem */
+        /* Create the root cgroup state for this subsystem */
-        ss->root = &cgroup_dummy_root;
+        ss->root = &cgrp_dfl_root;
-        css = ss->css_alloc(cgroup_css(cgroup_dummy_top, ss));
+        css = ss->css_alloc(cgroup_css(&cgrp_dfl_root.cgrp, ss));
        /* We don't handle early failures gracefully */
        BUG_ON(IS_ERR(css));
-        init_css(css, ss, cgroup_dummy_top);
+        init_css(css, ss, &cgrp_dfl_root.cgrp);
        /* Update the init_css_set to contain a subsys
         * pointer to this state - since the subsystem is
         * newly registered, all tasks and hence the
-         * init_css_set is in the subsystem's top cgroup. */
+         * init_css_set is in the subsystem's root cgroup. */
-        init_css_set.subsys[ss->subsys_id] = css;
+        init_css_set.subsys[ss->id] = css;
        need_forkexit_callback |= ss->fork || ss->exit;
@@ -4565,185 +4149,11 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
        BUG_ON(online_css(css));
-        mutex_unlock(&cgroup_mutex);
+        cgrp_dfl_root.cgrp.subsys_mask |= 1 << ss->id;
-        /* this function shouldn't be used with modular subsystems, since they
-         * need to register a subsys_id, among other things */
-        BUG_ON(ss->module);
-}
-/**
- * cgroup_load_subsys: load and register a modular subsystem at runtime
- * @ss: the subsystem to load
- *
- * This function should be called in a modular subsystem's initcall. If the
- * subsystem is built as a module, it will be assigned a new subsys_id and set
- * up for use. If the subsystem is built-in anyway, work is delegated to the
- * simpler cgroup_init_subsys.
- */
-int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
-{
-        struct cgroup_subsys_state *css;
-        int i, ret;
-        struct hlist_node *tmp;
-        struct css_set *cset;
-        unsigned long key;
-        /* check name and function validity */
-        if (ss->name == NULL || strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN ||
-            ss->css_alloc == NULL || ss->css_free == NULL)
-                return -EINVAL;
-        /*
-         * we don't support callbacks in modular subsystems. this check is
-         * before the ss->module check for consistency; a subsystem that could
-         * be a module should still have no callbacks even if the user isn't
-         * compiling it as one.
-         */
-        if (ss->fork || ss->exit)
-                return -EINVAL;
-        /*
-         * an optionally modular subsystem is built-in: we want to do nothing,
-         * since cgroup_init_subsys will have already taken care of it.
-         */
-        if (ss->module == NULL) {
-                /* a sanity check */
-                BUG_ON(cgroup_subsys[ss->subsys_id] != ss);
-                return 0;
-        }
-        /* init base cftset */
-        cgroup_init_cftsets(ss);
-        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
-        cgroup_subsys[ss->subsys_id] = ss;
-        /*
-         * no ss->css_alloc seems to need anything important in the ss
-         * struct, so this can happen first (i.e. before the dummy root
-         * attachment).
-         */
-        css = ss->css_alloc(cgroup_css(cgroup_dummy_top, ss));
-        if (IS_ERR(css)) {
-                /* failure case - need to deassign the cgroup_subsys[] slot. */
-                cgroup_subsys[ss->subsys_id] = NULL;
-                mutex_unlock(&cgroup_root_mutex);
-                mutex_unlock(&cgroup_mutex);
-                return PTR_ERR(css);
-        }
-        ss->root = &cgroup_dummy_root;
-        /* our new subsystem will be attached to the dummy hierarchy. */
-        init_css(css, ss, cgroup_dummy_top);
-        /*
-         * Now we need to entangle the css into the existing css_sets. unlike
-         * in cgroup_init_subsys, there are now multiple css_sets, so each one
-         * will need a new pointer to it; done by iterating the css_set_table.
-         * furthermore, modifying the existing css_sets will corrupt the hash
-         * table state, so each changed css_set will need its hash recomputed.
-         * this is all done under the css_set_lock.
-         */
-        write_lock(&css_set_lock);
-        hash_for_each_safe(css_set_table, i, tmp, cset, hlist) {
-                /* skip entries that we already rehashed */
-                if (cset->subsys[ss->subsys_id])
-                        continue;
-                /* remove existing entry */
-                hash_del(&cset->hlist);
-                /* set new value */
-                cset->subsys[ss->subsys_id] = css;
-                /* recompute hash and restore entry */
-                key = css_set_hash(cset->subsys);
-                hash_add(css_set_table, &cset->hlist, key);
-        }
-        write_unlock(&css_set_lock);
-        ret = online_css(css);
-        if (ret) {
-                ss->css_free(css);
-                goto err_unload;
-        }
-        /* success! */
-        mutex_unlock(&cgroup_root_mutex);
-        mutex_unlock(&cgroup_mutex);
-        return 0;
-err_unload:
-        mutex_unlock(&cgroup_root_mutex);
-        mutex_unlock(&cgroup_mutex);
-        /* @ss can't be mounted here as try_module_get() would fail */
-        cgroup_unload_subsys(ss);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cgroup_load_subsys);
-/**
- * cgroup_unload_subsys: unload a modular subsystem
- * @ss: the subsystem to unload
- *
- * This function should be called in a modular subsystem's exitcall. When this
- * function is invoked, the refcount on the subsystem's module will be 0, so
- * the subsystem will not be attached to any hierarchy.
- */
-void cgroup_unload_subsys(struct cgroup_subsys *ss)
-{
-        struct cgrp_cset_link *link;
-        struct cgroup_subsys_state *css;
-        BUG_ON(ss->module == NULL);
-        /*
-         * we shouldn't be called if the subsystem is in use, and the use of
-         * try_module_get() in rebind_subsystems() should ensure that it
-         * doesn't start being used while we're killing it off.
-         */
-        BUG_ON(ss->root != &cgroup_dummy_root);
-        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
-        css = cgroup_css(cgroup_dummy_top, ss);
-        if (css)
-                offline_css(css);
-        /* deassign the subsys_id */
-        cgroup_subsys[ss->subsys_id] = NULL;
-        /*
-         * disentangle the css from all css_sets attached to the dummy
-         * top. as in loading, we need to pay our respects to the hashtable
-         * gods.
-         */
-        write_lock(&css_set_lock);
-        list_for_each_entry(link, &cgroup_dummy_top->cset_links, cset_link) {
-                struct css_set *cset = link->cset;
-                unsigned long key;
-                hash_del(&cset->hlist);
-                cset->subsys[ss->subsys_id] = NULL;
-                key = css_set_hash(cset->subsys);
-                hash_add(css_set_table, &cset->hlist, key);
-        }
-        write_unlock(&css_set_lock);
-        /*
-         * remove subsystem's css from the cgroup_dummy_top and free it -
-         * need to free before marking as null because ss->css_free needs
-         * the cgrp->subsys pointer to find their state.
-         */
-        if (css)
-                ss->css_free(css);
-        RCU_INIT_POINTER(cgroup_dummy_top->subsys[ss->subsys_id], NULL);
-        mutex_unlock(&cgroup_root_mutex);
        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
 }
-EXPORT_SYMBOL_GPL(cgroup_unload_subsys);
 /**
 * cgroup_init_early - cgroup initialization at system boot
@@ -4753,34 +4163,24 @@ EXPORT_SYMBOL_GPL(cgroup_unload_subsys);
 */
 int __init cgroup_init_early(void)
 {
+        static struct cgroup_sb_opts __initdata opts =
+                { .flags = CGRP_ROOT_SANE_BEHAVIOR };
        struct cgroup_subsys *ss;
        int i;
-        atomic_set(&init_css_set.refcount, 1);
+        init_cgroup_root(&cgrp_dfl_root, &opts);
-        INIT_LIST_HEAD(&init_css_set.cgrp_links);
-        INIT_LIST_HEAD(&init_css_set.tasks);
-        INIT_HLIST_NODE(&init_css_set.hlist);
-        css_set_count = 1;
-        init_cgroup_root(&cgroup_dummy_root);
-        cgroup_root_count = 1;
        RCU_INIT_POINTER(init_task.cgroups, &init_css_set);
-        init_cgrp_cset_link.cset = &init_css_set;
+        for_each_subsys(ss, i) {
-        init_cgrp_cset_link.cgrp = cgroup_dummy_top;
+                WARN(!ss->css_alloc || !ss->css_free || ss->name || ss->id,
-        list_add(&init_cgrp_cset_link.cset_link, &cgroup_dummy_top->cset_links);
+                     "invalid cgroup_subsys %d:%s css_alloc=%p css_free=%p name:id=%d:%s\n",
-        list_add(&init_cgrp_cset_link.cgrp_link, &init_css_set.cgrp_links);
+                     i, cgroup_subsys_name[i], ss->css_alloc, ss->css_free,
+                     ss->id, ss->name);
-        /* at bootup time, we don't worry about modular subsystems */
+                WARN(strlen(cgroup_subsys_name[i]) > MAX_CGROUP_TYPE_NAMELEN,
-        for_each_builtin_subsys(ss, i) {
+                     "cgroup_subsys_name %s too long\n", cgroup_subsys_name[i]);
-                BUG_ON(!ss->name);
-                BUG_ON(strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN);
+                ss->id = i;
-                BUG_ON(!ss->css_alloc);
+                ss->name = cgroup_subsys_name[i];
-                BUG_ON(!ss->css_free);
-                if (ss->subsys_id != i) {
-                        printk(KERN_ERR "cgroup: Subsys %s id == %d\n",
-                               ss->name, ss->subsys_id);
-                        BUG();
-                }
                if (ss->early_init)
                        cgroup_init_subsys(ss);
@@ -4798,53 +4198,46 @@ int __init cgroup_init(void)
 {
        struct cgroup_subsys *ss;
        unsigned long key;
-        int i, err;
+        int ssid, err;
-        err = bdi_init(&cgroup_backing_dev_info);
+        BUG_ON(cgroup_init_cftypes(NULL, cgroup_base_files));
-        if (err)
-                return err;
-        for_each_builtin_subsys(ss, i) {
+        mutex_lock(&cgroup_tree_mutex);
-                if (!ss->early_init)
-                        cgroup_init_subsys(ss);
-        }
-        /* allocate id for the dummy hierarchy */
        mutex_lock(&cgroup_mutex);
-        mutex_lock(&cgroup_root_mutex);
        /* Add init_css_set to the hash table */
        key = css_set_hash(init_css_set.subsys);
        hash_add(css_set_table, &init_css_set.hlist, key);
-        BUG_ON(cgroup_init_root_id(&cgroup_dummy_root, 0, 1));
+        BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0));
-        err = idr_alloc(&cgroup_dummy_root.cgroup_idr, cgroup_dummy_top,
-                        0, 1, GFP_KERNEL);
-        BUG_ON(err < 0);
-        mutex_unlock(&cgroup_root_mutex);
        mutex_unlock(&cgroup_mutex);
+        mutex_unlock(&cgroup_tree_mutex);
-        cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
+        for_each_subsys(ss, ssid) {
-        if (!cgroup_kobj) {
+                if (!ss->early_init)
-                err = -ENOMEM;
+                        cgroup_init_subsys(ss);
-                goto out;
+                /*
+                 * cftype registration needs kmalloc and can't be done
+                 * during early_init.  Register base cftypes separately.
+                 */
+                if (ss->base_cftypes)
+                        WARN_ON(cgroup_add_cftypes(ss, ss->base_cftypes));
        }
+        cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
+        if (!cgroup_kobj)
+                return -ENOMEM;
        err = register_filesystem(&cgroup_fs_type);
        if (err < 0) {
                kobject_put(cgroup_kobj);
-                goto out;
+                return err;
        }
        proc_create("cgroups", 0, NULL, &proc_cgroupstats_operations);
+        return 0;
-out:
-        if (err)
-                bdi_destroy(&cgroup_backing_dev_info);
-        return err;
 }
 static int __init cgroup_wq_init(void)
@@ -4876,12 +4269,6 @@ core_initcall(cgroup_wq_init);
 * proc_cgroup_show()
 *  - Print task's cgroup paths into seq_file, one line for each hierarchy
 *  - Used for /proc/<pid>/cgroup.
- *  - No need to task_lock(tsk) on this tsk->cgroup reference, as it
- *    doesn't really matter if tsk->cgroup changes after we read it,
- *    and we take cgroup_mutex, keeping cgroup_attach_task() from changing it
- *    anyway.  No need to check that tsk->cgroup != NULL, thanks to
- *    the_top_cgroup_hack in cgroup_exit(), which sets an exiting tasks
- *    cgroup to top_cgroup.
 */
 /* TODO: Use a proper seq_file iterator */
@@ -4889,12 +4276,12 @@ int proc_cgroup_show(struct seq_file *m, void *v)
 {
        struct pid *pid;
        struct task_struct *tsk;
-        char *buf;
+        char *buf, *path;
        int retval;
-        struct cgroupfs_root *root;
+        struct cgroup_root *root;
        retval = -ENOMEM;
-        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        buf = kmalloc(PATH_MAX, GFP_KERNEL);
        if (!buf)
                goto out;
@@ -4907,29 +4294,36 @@ int proc_cgroup_show(struct seq_file *m, void *v)
        retval = 0;
        mutex_lock(&cgroup_mutex);
+        down_read(&css_set_rwsem);
-        for_each_active_root(root) {
+        for_each_root(root) {
                struct cgroup_subsys *ss;
                struct cgroup *cgrp;
                int ssid, count = 0;
+                if (root == &cgrp_dfl_root && !cgrp_dfl_root_visible)
+                        continue;
                seq_printf(m, "%d:", root->hierarchy_id);
                for_each_subsys(ss, ssid)
-                        if (root->subsys_mask & (1 << ssid))
+                        if (root->cgrp.subsys_mask & (1 << ssid))
                                seq_printf(m, "%s%s", count++ ? "," : "", ss->name);
                if (strlen(root->name))
                        seq_printf(m, "%sname=%s", count ? "," : "",
                                   root->name);
                seq_putc(m, ':');
                cgrp = task_cgroup_from_root(tsk, root);
-                retval = cgroup_path(cgrp, buf, PAGE_SIZE);
+                path = cgroup_path(cgrp, buf, PATH_MAX);
-                if (retval < 0)
+                if (!path) {
+                        retval = -ENAMETOOLONG;
                        goto out_unlock;
-                seq_puts(m, buf);
+                }
+                seq_puts(m, path);
                seq_putc(m, '\n');
        }
 out_unlock:
+        up_read(&css_set_rwsem);
        mutex_unlock(&cgroup_mutex);
        put_task_struct(tsk);
 out_free:
@@ -4955,7 +4349,7 @@ static int proc_cgroupstats_show(struct seq_file *m, void *v)
        for_each_subsys(ss, i)
                seq_printf(m, "%s\t%d\t%d\t%d\n",
                           ss->name, ss->root->hierarchy_id,
-                           ss->root->number_of_cgroups, !ss->disabled);
+                           atomic_read(&ss->root->nr_cgrps), !ss->disabled);
        mutex_unlock(&cgroup_mutex);
        return 0;
@@ -4974,27 +4368,16 @@ static const struct file_operations proc_cgroupstats_operations = {
 };
 /**
- * cgroup_fork - attach newly forked task to its parents cgroup.
+ * cgroup_fork - initialize cgroup related fields during copy_process()
 * @child: pointer to task_struct of forking parent process.
 *
- * Description: A task inherits its parent's cgroup at fork().
+ * A task is associated with the init_css_set until cgroup_post_fork()
- *
+ * attaches it to the parent's css_set.  Empty cg_list indicates that
- * A pointer to the shared css_set was automatically copied in
+ * @child isn't holding reference to its css_set.
- * fork.c by dup_task_struct().  However, we ignore that copy, since
- * it was not made under the protection of RCU or cgroup_mutex, so
- * might no longer be a valid cgroup pointer.  cgroup_attach_task() might
- * have already changed current->cgroups, allowing the previously
- * referenced cgroup group to be removed and freed.
- *
- * At the point that cgroup_fork() is called, 'current' is the parent
- * task, and the passed argument 'child' points to the child task.
 */
 void cgroup_fork(struct task_struct *child)
 {
-        task_lock(current);
+        RCU_INIT_POINTER(child->cgroups, &init_css_set);
-        get_css_set(task_css_set(current));
-        child->cgroups = current->cgroups;
-        task_unlock(current);
        INIT_LIST_HEAD(&child->cg_list);
 }
@@ -5014,23 +4397,37 @@ void cgroup_post_fork(struct task_struct *child)
        int i;
        /*
-         * use_task_css_set_links is set to 1 before we walk the tasklist
+         * This may race against cgroup_enable_task_cg_links().  As that
-         * under the tasklist_lock and we read it here after we added the child
+         * function sets use_task_css_set_links before grabbing
-         * to the tasklist under the tasklist_lock as well. If the child wasn't
+         * tasklist_lock and we just went through tasklist_lock to add
-         * yet in the tasklist when we walked through it from
+         * @child, it's guaranteed that either we see the set
-         * cgroup_enable_task_cg_lists(), then use_task_css_set_links value
+         * use_task_css_set_links or cgroup_enable_task_cg_lists() sees
-         * should be visible now due to the paired locking and barriers implied
+         * @child during its iteration.
-         * by LOCK/UNLOCK: it is written before the tasklist_lock unlock
+         *
-         * in cgroup_enable_task_cg_lists() and read here after the tasklist_lock
+         * If we won the race, @child is associated with %current's
-         * lock on fork.
+         * css_set.  Grabbing css_set_rwsem guarantees both that the
+         * association is stable, and, on completion of the parent's
+         * migration, @child is visible in the source of migration or
+         * already in the destination cgroup.  This guarantee is necessary
+         * when implementing operations which need to migrate all tasks of
+         * a cgroup to another.
+         *
+         * Note that if we lose to cgroup_enable_task_cg_links(), @child
+         * will remain in init_css_set.  This is safe because all tasks are
+         * in the init_css_set before cg_links is enabled and there's no
+         * operation which transfers all tasks out of init_css_set.
         */
        if (use_task_css_set_links) {
-                write_lock(&css_set_lock);
+                struct css_set *cset;
-                task_lock(child);
-                if (list_empty(&child->cg_list))
+                down_write(&css_set_rwsem);
-                        list_add(&child->cg_list, &task_css_set(child)->tasks);
+                cset = task_css_set(current);
-                task_unlock(child);
+                if (list_empty(&child->cg_list)) {
-                write_unlock(&css_set_lock);
+                        rcu_assign_pointer(child->cgroups, cset);
+                        list_add(&child->cg_list, &cset->tasks);
+                        get_css_set(cset);
+                }
+                up_write(&css_set_rwsem);
        }
        /*
@@ -5039,15 +4436,7 @@ void cgroup_post_fork(struct task_struct *child)
         * and addition to css_set.
         */
        if (need_forkexit_callback) {
-                /*
+                for_each_subsys(ss, i)
-                 * fork/exit callbacks are supported only for builtin
-                 * subsystems, and the builtin section of the subsys
-                 * array is immutable, so we don't need to lock the
-                 * subsys array here. On the other hand, modular section
-                 * of the array can be freed at module unload, so we
-                 * can't touch that.
-                 */
-                for_each_builtin_subsys(ss, i)
                        if (ss->fork)
                                ss->fork(child);
        }
@@ -5056,7 +4445,6 @@ void cgroup_post_fork(struct task_struct *child)
 /**
 * cgroup_exit - detach cgroup from exiting task
 * @tsk: pointer to task_struct of exiting process
- * @run_callback: run exit callbacks?
 *
 * Description: Detach cgroup from @tsk and release it.
 *
@@ -5066,57 +4454,38 @@ void cgroup_post_fork(struct task_struct *child)
 * use notify_on_release cgroups where very high task exit scaling
 * is required on large systems.
 *
- * the_top_cgroup_hack:
+ * We set the exiting tasks cgroup to the root cgroup (top_cgroup).  We
- *
+ * call cgroup_exit() while the task is still competent to handle
- *    Set the exiting tasks cgroup to the root cgroup (top_cgroup).
+ * notify_on_release(), then leave the task attached to the root cgroup in
- *
+ * each hierarchy for the remainder of its exit.  No need to bother with
- *    We call cgroup_exit() while the task is still competent to
+ * init_css_set refcnting.  init_css_set never goes away and we can't race
- *    handle notify_on_release(), then leave the task attached to the
+ * with migration path - PF_EXITING is visible to migration path.
- *    root cgroup in each hierarchy for the remainder of its exit.
- *
- *    To do this properly, we would increment the reference count on
- *    top_cgroup, and near the very end of the kernel/exit.c do_exit()
- *    code we would add a second cgroup function call, to drop that
- *    reference.  This would just create an unnecessary hot spot on
- *    the top_cgroup reference count, to no avail.
- *
- *    Normally, holding a reference to a cgroup without bumping its
- *    count is unsafe.   The cgroup could go away, or someone could
- *    attach us to a different cgroup, decrementing the count on
- *    the first cgroup that we never incremented.  But in this case,
- *    top_cgroup isn't going away, and either task has PF_EXITING set,
- *    which wards off any cgroup_attach_task() attempts, or task is a failed
- *    fork, never visible to cgroup_attach_task.
 */
-void cgroup_exit(struct task_struct *tsk, int run_callbacks)
+void cgroup_exit(struct task_struct *tsk)
 {
        struct cgroup_subsys *ss;
        struct css_set *cset;
+        bool put_cset = false;
        int i;
        /*
-         * Unlink from the css_set task list if necessary.
+         * Unlink from @tsk from its css_set.  As migration path can't race
-         * Optimistically check cg_list before taking
+         * with us, we can check cg_list without grabbing css_set_rwsem.
-         * css_set_lock
         */
        if (!list_empty(&tsk->cg_list)) {
-                write_lock(&css_set_lock);
+                down_write(&css_set_rwsem);
-                if (!list_empty(&tsk->cg_list))
+                list_del_init(&tsk->cg_list);
-                        list_del_init(&tsk->cg_list);
+                up_write(&css_set_rwsem);
-                write_unlock(&css_set_lock);
+                put_cset = true;
        }
        /* Reassign the task to the init_css_set. */
-        task_lock(tsk);
        cset = task_css_set(tsk);
        RCU_INIT_POINTER(tsk->cgroups, &init_css_set);
-        if (run_callbacks && need_forkexit_callback) {
+        if (need_forkexit_callback) {
-                /*
+                /* see cgroup_post_fork() for details */
-                 * fork/exit callbacks are supported only for builtin
+                for_each_subsys(ss, i) {
-                 * subsystems, see cgroup_post_fork() for details.
-                 */
-                for_each_builtin_subsys(ss, i) {
                        if (ss->exit) {
                                struct cgroup_subsys_state *old_css = cset->subsys[i];
                                struct cgroup_subsys_state *css = task_css(tsk, i);
@@ -5125,9 +4494,9 @@ void cgroup_exit(struct task_struct *tsk, int run_callbacks)
                        }
                }
        }
-        task_unlock(tsk);
-        put_css_set_taskexit(cset);
+        if (put_cset)
+                put_css_set(cset, true);
 }
 static void check_for_release(struct cgroup *cgrp)
@@ -5184,16 +4553,17 @@ static void cgroup_release_agent(struct work_struct *work)
        while (!list_empty(&release_list)) {
                char *argv[3], *envp[3];
                int i;
-                char *pathbuf = NULL, *agentbuf = NULL;
+                char *pathbuf = NULL, *agentbuf = NULL, *path;
                struct cgroup *cgrp = list_entry(release_list.next,
                                                    struct cgroup,
                                                    release_list);
                list_del_init(&cgrp->release_list);
                raw_spin_unlock(&release_list_lock);
-                pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+                pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
                if (!pathbuf)
                        goto continue_free;
-                if (cgroup_path(cgrp, pathbuf, PAGE_SIZE) < 0)
+                path = cgroup_path(cgrp, pathbuf, PATH_MAX);
+                if (!path)
                        goto continue_free;
                agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL);
                if (!agentbuf)
@@ -5201,7 +4571,7 @@ static void cgroup_release_agent(struct work_struct *work)
                i = 0;
                argv[i++] = agentbuf;
-                argv[i++] = pathbuf;
+                argv[i++] = path;
                argv[i] = NULL;
                i = 0;
@@ -5235,11 +4605,7 @@ static int __init cgroup_disable(char *str)
                if (!*token)
                        continue;
-                /*
+                for_each_subsys(ss, i) {
-                 * cgroup_disable, being at boot time, can't know about
-                 * module subsystems, so we don't worry about them.
-                 */
-                for_each_builtin_subsys(ss, i) {
                        if (!strcmp(token, ss->name)) {
                                ss->disabled = 1;
                                printk(KERN_INFO "Disabling %s control group"
@@ -5253,28 +4619,42 @@ static int __init cgroup_disable(char *str)
 __setup("cgroup_disable=", cgroup_disable);
 /**
- * css_from_dir - get corresponding css from the dentry of a cgroup dir
+ * css_tryget_from_dir - get corresponding css from the dentry of a cgroup dir
 * @dentry: directory dentry of interest
 * @ss: subsystem of interest
 *
- * Must be called under cgroup_mutex or RCU read lock.  The caller is
+ * If @dentry is a directory for a cgroup which has @ss enabled on it, try
- * responsible for pinning the returned css if it needs to be accessed
+ * to get the corresponding css and return it.  If such css doesn't exist
- * outside the critical section.
+ * or can't be pinned, an ERR_PTR value is returned.
 */
-struct cgroup_subsys_state *css_from_dir(struct dentry *dentry,
+struct cgroup_subsys_state *css_tryget_from_dir(struct dentry *dentry,
-                                         struct cgroup_subsys *ss)
+                                                struct cgroup_subsys *ss)
 {
+        struct kernfs_node *kn = kernfs_node_from_dentry(dentry);
+        struct cgroup_subsys_state *css = NULL;
        struct cgroup *cgrp;
-        cgroup_assert_mutex_or_rcu_locked();
        /* is @dentry a cgroup dir? */
-        if (!dentry->d_inode ||
+        if (dentry->d_sb->s_type != &cgroup_fs_type || !kn ||
-            dentry->d_inode->i_op != &cgroup_dir_inode_operations)
+            kernfs_type(kn) != KERNFS_DIR)
                return ERR_PTR(-EBADF);
-        cgrp = __d_cgrp(dentry);
+        rcu_read_lock();
-        return cgroup_css(cgrp, ss) ?: ERR_PTR(-ENOENT);
+        /*
+         * This path doesn't originate from kernfs and @kn could already
+         * have been or be removed at any point.  @kn->priv is RCU
+         * protected for this access.  See destroy_locked() for details.
+         */
+        cgrp = rcu_dereference(kn->priv);
+        if (cgrp)
+                css = cgroup_css(cgrp, ss);
+        if (!css || !css_tryget(css))
+                css = ERR_PTR(-ENOENT);
+        rcu_read_unlock();
+        return css;
 }
 /**
@@ -5289,7 +4669,7 @@ struct cgroup_subsys_state *css_from_id(int id, struct cgroup_subsys *ss)
 {
        struct cgroup *cgrp;
-        cgroup_assert_mutex_or_rcu_locked();
+        cgroup_assert_mutexes_or_rcu_locked();
        cgrp = idr_find(&ss->root->cgroup_idr, id);
        if (cgrp)
@@ -5341,23 +4721,25 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
 {
        struct cgrp_cset_link *link;
        struct css_set *cset;
+        char *name_buf;
-        read_lock(&css_set_lock);
+        name_buf = kmalloc(NAME_MAX + 1, GFP_KERNEL);
+        if (!name_buf)
+                return -ENOMEM;
+        down_read(&css_set_rwsem);
        rcu_read_lock();
        cset = rcu_dereference(current->cgroups);
        list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
                struct cgroup *c = link->cgrp;
-                const char *name;
-                if (c->dentry)
+                cgroup_name(c, name_buf, NAME_MAX + 1);
-                        name = c->dentry->d_name.name;
-                else
-                        name = "?";
                seq_printf(seq, "Root %d group %s\n",
-                           c->root->hierarchy_id, name);
+                           c->root->hierarchy_id, name_buf);
        }
        rcu_read_unlock();
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
+        kfree(name_buf);
        return 0;
 }
@@ -5367,23 +4749,30 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
        struct cgroup_subsys_state *css = seq_css(seq);
        struct cgrp_cset_link *link;
-        read_lock(&css_set_lock);
+        down_read(&css_set_rwsem);
        list_for_each_entry(link, &css->cgroup->cset_links, cset_link) {
                struct css_set *cset = link->cset;
                struct task_struct *task;
                int count = 0;
                seq_printf(seq, "css_set %p\n", cset);
                list_for_each_entry(task, &cset->tasks, cg_list) {
-                        if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
+                        if (count++ > MAX_TASKS_SHOWN_PER_CSS)
-                                seq_puts(seq, "  ...\n");
+                                goto overflow;
-                                break;
+                        seq_printf(seq, "  task %d\n", task_pid_vnr(task));
-                        } else {
+                }
-                                seq_printf(seq, "  task %d\n",
-                                           task_pid_vnr(task));
+                list_for_each_entry(task, &cset->mg_tasks, cg_list) {
-                        }
+                        if (count++ > MAX_TASKS_SHOWN_PER_CSS)
+                                goto overflow;
+                        seq_printf(seq, "  task %d\n", task_pid_vnr(task));
                }
+                continue;
+        overflow:
+                seq_puts(seq, "  ...\n");
        }
-        read_unlock(&css_set_lock);
+        up_read(&css_set_rwsem);
        return 0;
 }
@@ -5426,11 +4815,9 @@ static struct cftype debug_files[] =  {
        { }     /* terminate */
 };
-struct cgroup_subsys debug_subsys = {
+struct cgroup_subsys debug_cgrp_subsys = {
-        .name = "debug",
        .css_alloc = debug_css_alloc,
        .css_free = debug_css_free,
-        .subsys_id = debug_subsys_id,
        .base_cftypes = debug_files,
 };
 #endif /* CONFIG_CGROUP_DEBUG */
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index 6c3154e477f6..2bc4a2256444 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -52,7 +52,7 @@ static inline struct freezer *css_freezer(struct cgroup_subsys_state *css)
 static inline struct freezer *task_freezer(struct task_struct *task)
 {
-        return css_freezer(task_css(task, freezer_subsys_id));
+        return css_freezer(task_css(task, freezer_cgrp_id));
 }
 static struct freezer *parent_freezer(struct freezer *freezer)
@@ -84,8 +84,6 @@ static const char *freezer_state_strs(unsigned int state)
        return "THAWED";
 };
-struct cgroup_subsys freezer_subsys;
 static struct cgroup_subsys_state *
 freezer_css_alloc(struct cgroup_subsys_state *parent_css)
 {
@@ -189,7 +187,7 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
         * current state before executing the following - !frozen tasks may
         * be visible in a FROZEN cgroup and frozen tasks in a THAWED one.
         */
-        cgroup_taskset_for_each(task, new_css, tset) {
+        cgroup_taskset_for_each(task, tset) {
                if (!(freezer->state & CGROUP_FREEZING)) {
                        __thaw_task(task);
                } else {
@@ -216,6 +214,16 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
        }
 }
+/**
+ * freezer_fork - cgroup post fork callback
+ * @task: a task which has just been forked
+ *
+ * @task has just been created and should conform to the current state of
+ * the cgroup_freezer it belongs to.  This function may race against
+ * freezer_attach().  Losing to freezer_attach() means that we don't have
+ * to do anything as freezer_attach() will put @task into the appropriate
+ * state.
+ */
 static void freezer_fork(struct task_struct *task)
 {
        struct freezer *freezer;
@@ -224,14 +232,26 @@ static void freezer_fork(struct task_struct *task)
        freezer = task_freezer(task);
        /*
-         * The root cgroup is non-freezable, so we can skip the
+         * The root cgroup is non-freezable, so we can skip locking the
-         * following check.
+         * freezer.  This is safe regardless of race with task migration.
+         * If we didn't race or won, skipping is obviously the right thing
+         * to do.  If we lost and root is the new cgroup, noop is still the
+         * right thing to do.
         */
        if (!parent_freezer(freezer))
                goto out;
+        /*
+         * Grab @freezer->lock and freeze @task after verifying @task still
+         * belongs to @freezer and it's freezing.  The former is for the
+         * case where we have raced against task migration and lost and
+         * @task is already in a different cgroup which may not be frozen.
+         * This isn't strictly necessary as freeze_task() is allowed to be
+         * called spuriously but let's do it anyway for, if nothing else,
+         * documentation.
+         */
        spin_lock_irq(&freezer->lock);
-        if (freezer->state & CGROUP_FREEZING)
+        if (freezer == task_freezer(task) && (freezer->state & CGROUP_FREEZING))
                freeze_task(task);
        spin_unlock_irq(&freezer->lock);
 out:
@@ -422,7 +442,7 @@ static void freezer_change_state(struct freezer *freezer, bool freeze)
 }
 static int freezer_write(struct cgroup_subsys_state *css, struct cftype *cft,
-                         const char *buffer)
+                         char *buffer)
 {
        bool freeze;
@@ -473,13 +493,11 @@ static struct cftype files[] = {
        { }     /* terminate */
 };
-struct cgroup_subsys freezer_subsys = {
+struct cgroup_subsys freezer_cgrp_subsys = {
-        .name           = "freezer",
        .css_alloc      = freezer_css_alloc,
        .css_online     = freezer_css_online,
        .css_offline    = freezer_css_offline,
        .css_free       = freezer_css_free,
-        .subsys_id      = freezer_subsys_id,
        .attach         = freezer_attach,
        .fork           = freezer_fork,
        .base_cftypes   = files,
diff --git a/kernel/compat.c b/kernel/compat.c
index 488ff8c4cf48..e40b0430b562 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -30,28 +30,6 @@
 #include <asm/uaccess.h>
-/*
- * Get/set struct timeval with struct timespec on the native side
- */
-static int compat_get_timeval_convert(struct timespec *o,
-                                      struct compat_timeval __user *i)
-{
-        long usec;
-        if (get_user(o->tv_sec, &i->tv_sec) ||
-            get_user(usec, &i->tv_usec))
-                return -EFAULT;
-        o->tv_nsec = usec * 1000;
-        return 0;
-}
-static int compat_put_timeval_convert(struct compat_timeval __user *o,
-                                      struct timeval *i)
-{
-        return (put_user(i->tv_sec, &o->tv_sec) ||
-                put_user(i->tv_usec, &o->tv_usec)) ? -EFAULT : 0;
-}
 static int compat_get_timex(struct timex *txc, struct compat_timex __user *utp)
 {
        memset(txc, 0, sizeof(struct timex));
@@ -116,7 +94,7 @@ COMPAT_SYSCALL_DEFINE2(gettimeofday, struct compat_timeval __user *, tv,
        if (tv) {
                struct timeval ktv;
                do_gettimeofday(&ktv);
-                if (compat_put_timeval_convert(tv, &ktv))
+                if (compat_put_timeval(&ktv, tv))
                        return -EFAULT;
        }
        if (tz) {
@@ -130,59 +108,58 @@ COMPAT_SYSCALL_DEFINE2(gettimeofday, struct compat_timeval __user *, tv,
 COMPAT_SYSCALL_DEFINE2(settimeofday, struct compat_timeval __user *, tv,
                       struct timezone __user *, tz)
 {
-        struct timespec kts;
+        struct timeval user_tv;
-        struct timezone ktz;
+        struct timespec new_ts;
+        struct timezone new_tz;
        if (tv) {
-                if (compat_get_timeval_convert(&kts, tv))
+                if (compat_get_timeval(&user_tv, tv))
                        return -EFAULT;
+                new_ts.tv_sec = user_tv.tv_sec;
+                new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
        }
        if (tz) {
-                if (copy_from_user(&ktz, tz, sizeof(ktz)))
+                if (copy_from_user(&new_tz, tz, sizeof(*tz)))
                        return -EFAULT;
        }
-        return do_sys_settimeofday(tv ? &kts : NULL, tz ? &ktz : NULL);
+        return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
 }
-int get_compat_timeval(struct timeval *tv, const struct compat_timeval __user *ctv)
+static int __compat_get_timeval(struct timeval *tv, const struct compat_timeval __user *ctv)
 {
        return (!access_ok(VERIFY_READ, ctv, sizeof(*ctv)) ||
                        __get_user(tv->tv_sec, &ctv->tv_sec) ||
                        __get_user(tv->tv_usec, &ctv->tv_usec)) ? -EFAULT : 0;
 }
-EXPORT_SYMBOL_GPL(get_compat_timeval);
-int put_compat_timeval(const struct timeval *tv, struct compat_timeval __user *ctv)
+static int __compat_put_timeval(const struct timeval *tv, struct compat_timeval __user *ctv)
 {
        return (!access_ok(VERIFY_WRITE, ctv, sizeof(*ctv)) ||
                        __put_user(tv->tv_sec, &ctv->tv_sec) ||
                        __put_user(tv->tv_usec, &ctv->tv_usec)) ? -EFAULT : 0;
 }
-EXPORT_SYMBOL_GPL(put_compat_timeval);
-int get_compat_timespec(struct timespec *ts, const struct compat_timespec __user *cts)
+static int __compat_get_timespec(struct timespec *ts, const struct compat_timespec __user *cts)
 {
        return (!access_ok(VERIFY_READ, cts, sizeof(*cts)) ||
                        __get_user(ts->tv_sec, &cts->tv_sec) ||
                        __get_user(ts->tv_nsec, &cts->tv_nsec)) ? -EFAULT : 0;
 }
-EXPORT_SYMBOL_GPL(get_compat_timespec);
-int put_compat_timespec(const struct timespec *ts, struct compat_timespec __user *cts)
+static int __compat_put_timespec(const struct timespec *ts, struct compat_timespec __user *cts)
 {
        return (!access_ok(VERIFY_WRITE, cts, sizeof(*cts)) ||
                        __put_user(ts->tv_sec, &cts->tv_sec) ||
                        __put_user(ts->tv_nsec, &cts->tv_nsec)) ? -EFAULT : 0;
 }
-EXPORT_SYMBOL_GPL(put_compat_timespec);
 int compat_get_timeval(struct timeval *tv, const void __user *utv)
 {
        if (COMPAT_USE_64BIT_TIME)
                return copy_from_user(tv, utv, sizeof *tv) ? -EFAULT : 0;
        else
-                return get_compat_timeval(tv, utv);
+                return __compat_get_timeval(tv, utv);
 }
 EXPORT_SYMBOL_GPL(compat_get_timeval);
@@ -191,7 +168,7 @@ int compat_put_timeval(const struct timeval *tv, void __user *utv)
        if (COMPAT_USE_64BIT_TIME)
                return copy_to_user(utv, tv, sizeof *tv) ? -EFAULT : 0;
        else
-                return put_compat_timeval(tv, utv);
+                return __compat_put_timeval(tv, utv);
 }
 EXPORT_SYMBOL_GPL(compat_put_timeval);
@@ -200,7 +177,7 @@ int compat_get_timespec(struct timespec *ts, const void __user *uts)
        if (COMPAT_USE_64BIT_TIME)
                return copy_from_user(ts, uts, sizeof *ts) ? -EFAULT : 0;
        else
-                return get_compat_timespec(ts, uts);
+                return __compat_get_timespec(ts, uts);
 }
 EXPORT_SYMBOL_GPL(compat_get_timespec);
@@ -209,10 +186,33 @@ int compat_put_timespec(const struct timespec *ts, void __user *uts)
        if (COMPAT_USE_64BIT_TIME)
                return copy_to_user(uts, ts, sizeof *ts) ? -EFAULT : 0;
        else
-                return put_compat_timespec(ts, uts);
+                return __compat_put_timespec(ts, uts);
 }
 EXPORT_SYMBOL_GPL(compat_put_timespec);
+int compat_convert_timespec(struct timespec __user **kts,
+                            const void __user *cts)
+{
+        struct timespec ts;
+        struct timespec __user *uts;
+        if (!cts || COMPAT_USE_64BIT_TIME) {
+                *kts = (struct timespec __user *)cts;
+                return 0;
+        }
+        uts = compat_alloc_user_space(sizeof(ts));
+        if (!uts)
+                return -EFAULT;
+        if (compat_get_timespec(&ts, cts))
+                return -EFAULT;
+        if (copy_to_user(uts, &ts, sizeof(ts)))
+                return -EFAULT;
+        *kts = uts;
+        return 0;
+}
 static long compat_nanosleep_restart(struct restart_block *restart)
 {
        struct compat_timespec __user *rmtp;
@@ -229,7 +229,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
        if (ret) {
                rmtp = restart->nanosleep.compat_rmtp;
-                if (rmtp && put_compat_timespec(&rmt, rmtp))
+                if (rmtp && compat_put_timespec(&rmt, rmtp))
                        return -EFAULT;
        }
@@ -243,7 +243,7 @@ COMPAT_SYSCALL_DEFINE2(nanosleep, struct compat_timespec __user *, rqtp,
        mm_segment_t oldfs;
        long ret;
-        if (get_compat_timespec(&tu, rqtp))
+        if (compat_get_timespec(&tu, rqtp))
                return -EFAULT;
        if (!timespec_valid(&tu))
@@ -263,7 +263,7 @@ COMPAT_SYSCALL_DEFINE2(nanosleep, struct compat_timespec __user *, rqtp,
                restart->fn = compat_nanosleep_restart;
                restart->nanosleep.compat_rmtp = rmtp;
-                if (rmtp && put_compat_timespec(&rmt, rmtp))
+                if (rmtp && compat_put_timespec(&rmt, rmtp))
                        return -EFAULT;
        }
@@ -451,7 +451,7 @@ COMPAT_SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
        mm_segment_t old_fs = get_fs();
        set_fs(KERNEL_DS);
-        ret = sys_old_getrlimit(resource, &r);
+        ret = sys_old_getrlimit(resource, (struct rlimit __user *)&r);
        set_fs(old_fs);
        if (!ret) {
@@ -647,8 +647,8 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t,  pid, unsigned int, len,
 int get_compat_itimerspec(struct itimerspec *dst,
                          const struct compat_itimerspec __user *src)
 {
-        if (get_compat_timespec(&dst->it_interval, &src->it_interval) ||
+        if (__compat_get_timespec(&dst->it_interval, &src->it_interval) ||
-            get_compat_timespec(&dst->it_value, &src->it_value))
+            __compat_get_timespec(&dst->it_value, &src->it_value))
                return -EFAULT;
        return 0;
 }
@@ -656,8 +656,8 @@ int get_compat_itimerspec(struct itimerspec *dst,
 int put_compat_itimerspec(struct compat_itimerspec __user *dst,
                          const struct itimerspec *src)
 {
-        if (put_compat_timespec(&src->it_interval, &dst->it_interval) ||
+        if (__compat_put_timespec(&src->it_interval, &dst->it_interval) ||
-            put_compat_timespec(&src->it_value, &dst->it_value))
+            __compat_put_timespec(&src->it_value, &dst->it_value))
                return -EFAULT;
        return 0;
 }
@@ -727,7 +727,7 @@ COMPAT_SYSCALL_DEFINE2(clock_settime, clockid_t, which_clock,
        mm_segment_t oldfs;
        struct timespec ts;
-        if (get_compat_timespec(&ts, tp))
+        if (compat_get_timespec(&ts, tp))
                return -EFAULT;
        oldfs = get_fs();
        set_fs(KERNEL_DS);
@@ -749,7 +749,7 @@ COMPAT_SYSCALL_DEFINE2(clock_gettime, clockid_t, which_clock,
        err = sys_clock_gettime(which_clock,
                                (struct timespec __user *) &ts);
        set_fs(oldfs);
-        if (!err && put_compat_timespec(&ts, tp))
+        if (!err && compat_put_timespec(&ts, tp))
                return -EFAULT;
        return err;
 }
@@ -789,7 +789,7 @@ COMPAT_SYSCALL_DEFINE2(clock_getres, clockid_t, which_clock,
        err = sys_clock_getres(which_clock,
                               (struct timespec __user *) &ts);
        set_fs(oldfs);
-        if (!err && tp && put_compat_timespec(&ts, tp))
+        if (!err && tp && compat_put_timespec(&ts, tp))
                return -EFAULT;
        return err;
 }
@@ -799,7 +799,7 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
        long err;
        mm_segment_t oldfs;
        struct timespec tu;
-        struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
+        struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
        restart->nanosleep.rmtp = (struct timespec __user *) &tu;
        oldfs = get_fs();
@@ -808,7 +808,7 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
        set_fs(oldfs);
        if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
-            put_compat_timespec(&tu, rmtp))
+            compat_put_timespec(&tu, rmtp))
                return -EFAULT;
        if (err == -ERESTART_RESTARTBLOCK) {
@@ -827,7 +827,7 @@ COMPAT_SYSCALL_DEFINE4(clock_nanosleep, clockid_t, which_clock, int, flags,
        struct timespec in, out;
        struct restart_block *restart;
-        if (get_compat_timespec(&in, rqtp))
+        if (compat_get_timespec(&in, rqtp))
                return -EFAULT;
        oldfs = get_fs();
@@ -838,7 +838,7 @@ COMPAT_SYSCALL_DEFINE4(clock_nanosleep, clockid_t, which_clock, int, flags,
        set_fs(oldfs);
        if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
-            put_compat_timespec(&out, rmtp))
+            compat_put_timespec(&out, rmtp))
                return -EFAULT;
        if (err == -ERESTART_RESTARTBLOCK) {
@@ -1130,7 +1130,7 @@ COMPAT_SYSCALL_DEFINE2(sched_rr_get_interval,
        set_fs(KERNEL_DS);
        ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
        set_fs(old_fs);
-        if (put_compat_timespec(&t, interval))
+        if (compat_put_timespec(&t, interval))
                return -EFAULT;
        return ret;
 }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index deff2e693766..a9e710eef0e2 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/mutex.h>
 #include <linux/gfp.h>
 #include <linux/suspend.h>
+#include <linux/lockdep.h>
 #include "smpboot.h"
@@ -27,18 +28,23 @@
 static DEFINE_MUTEX(cpu_add_remove_lock);
 /*
- * The following two API's must be used when attempting
+ * The following two APIs (cpu_maps_update_begin/done) must be used when
- * to serialize the updates to cpu_online_mask, cpu_present_mask.
+ * attempting to serialize the updates to cpu_online_mask & cpu_present_mask.
+ * The APIs cpu_notifier_register_begin/done() must be used to protect CPU
+ * hotplug callback (un)registration performed using __register_cpu_notifier()
+ * or __unregister_cpu_notifier().
 */
 void cpu_maps_update_begin(void)
 {
        mutex_lock(&cpu_add_remove_lock);
 }
+EXPORT_SYMBOL(cpu_notifier_register_begin);
 void cpu_maps_update_done(void)
 {
        mutex_unlock(&cpu_add_remove_lock);
 }
+EXPORT_SYMBOL(cpu_notifier_register_done);
 static RAW_NOTIFIER_HEAD(cpu_chain);
@@ -57,17 +63,30 @@ static struct {
         * an ongoing cpu hotplug operation.
         */
        int refcount;
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map dep_map;
+#endif
 } cpu_hotplug = {
        .active_writer = NULL,
        .lock = __MUTEX_INITIALIZER(cpu_hotplug.lock),
        .refcount = 0,
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        .dep_map = {.name = "cpu_hotplug.lock" },
+#endif
 };
+/* Lockdep annotations for get/put_online_cpus() and cpu_hotplug_begin/end() */
+#define cpuhp_lock_acquire_read() lock_map_acquire_read(&cpu_hotplug.dep_map)
+#define cpuhp_lock_acquire()      lock_map_acquire(&cpu_hotplug.dep_map)
+#define cpuhp_lock_release()      lock_map_release(&cpu_hotplug.dep_map)
 void get_online_cpus(void)
 {
        might_sleep();
        if (cpu_hotplug.active_writer == current)
                return;
+        cpuhp_lock_acquire_read();
        mutex_lock(&cpu_hotplug.lock);
        cpu_hotplug.refcount++;
        mutex_unlock(&cpu_hotplug.lock);
@@ -87,6 +106,7 @@ void put_online_cpus(void)
        if (!--cpu_hotplug.refcount && unlikely(cpu_hotplug.active_writer))
                wake_up_process(cpu_hotplug.active_writer);
        mutex_unlock(&cpu_hotplug.lock);
+        cpuhp_lock_release();
 }
 EXPORT_SYMBOL_GPL(put_online_cpus);
@@ -117,6 +137,7 @@ void cpu_hotplug_begin(void)
 {
        cpu_hotplug.active_writer = current;
+        cpuhp_lock_acquire();
        for (;;) {
                mutex_lock(&cpu_hotplug.lock);
                if (likely(!cpu_hotplug.refcount))
@@ -131,6 +152,7 @@ void cpu_hotplug_done(void)
 {
        cpu_hotplug.active_writer = NULL;
        mutex_unlock(&cpu_hotplug.lock);
+        cpuhp_lock_release();
 }
 /*
@@ -166,6 +188,11 @@ int __ref register_cpu_notifier(struct notifier_block *nb)
        return ret;
 }
+int __ref __register_cpu_notifier(struct notifier_block *nb)
+{
+        return raw_notifier_chain_register(&cpu_chain, nb);
+}
 static int __cpu_notify(unsigned long val, void *v, int nr_to_call,
                        int *nr_calls)
 {
@@ -189,6 +216,7 @@ static void cpu_notify_nofail(unsigned long val, void *v)
        BUG_ON(cpu_notify(val, v));
 }
 EXPORT_SYMBOL(register_cpu_notifier);
+EXPORT_SYMBOL(__register_cpu_notifier);
 void __ref unregister_cpu_notifier(struct notifier_block *nb)
 {
@@ -198,6 +226,12 @@ void __ref unregister_cpu_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_cpu_notifier);
+void __ref __unregister_cpu_notifier(struct notifier_block *nb)
+{
+        raw_notifier_chain_unregister(&cpu_chain, nb);
+}
+EXPORT_SYMBOL(__unregister_cpu_notifier);
 /**
 * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
 * @cpu: a CPU id
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index e6b1b66afe52..3d54c418bd06 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -119,7 +119,7 @@ static inline struct cpuset *css_cs(struct cgroup_subsys_state *css)
 /* Retrieve the cpuset for a task */
 static inline struct cpuset *task_cs(struct task_struct *task)
 {
-        return css_cs(task_css(task, cpuset_subsys_id));
+        return css_cs(task_css(task, cpuset_cgrp_id));
 }
 static inline struct cpuset *parent_cs(struct cpuset *cs)
@@ -467,7 +467,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
         * be changed to have empty cpus_allowed or mems_allowed.
         */
        ret = -ENOSPC;
-        if ((cgroup_task_count(cur->css.cgroup) || cur->attach_in_progress)) {
+        if ((cgroup_has_tasks(cur->css.cgroup) || cur->attach_in_progress)) {
                if (!cpumask_empty(cur->cpus_allowed) &&
                    cpumask_empty(trial->cpus_allowed))
                        goto out;
@@ -829,55 +829,36 @@ static struct cpuset *effective_nodemask_cpuset(struct cpuset *cs)
 }
 /**
- * cpuset_change_cpumask - make a task's cpus_allowed the same as its cpuset's
- * @tsk: task to test
- * @data: cpuset to @tsk belongs to
- *
- * Called by css_scan_tasks() for each task in a cgroup whose cpus_allowed
- * mask needs to be changed.
- *
- * We don't need to re-check for the cgroup/cpuset membership, since we're
- * holding cpuset_mutex at this point.
- */
-static void cpuset_change_cpumask(struct task_struct *tsk, void *data)
-{
-        struct cpuset *cs = data;
-        struct cpuset *cpus_cs = effective_cpumask_cpuset(cs);
-        set_cpus_allowed_ptr(tsk, cpus_cs->cpus_allowed);
-}
-/**
 * update_tasks_cpumask - Update the cpumasks of tasks in the cpuset.
 * @cs: the cpuset in which each task's cpus_allowed mask needs to be changed
- * @heap: if NULL, defer allocating heap memory to css_scan_tasks()
- *
- * Called with cpuset_mutex held
 *
- * The css_scan_tasks() function will scan all the tasks in a cgroup,
+ * Iterate through each task of @cs updating its cpus_allowed to the
- * calling callback functions for each.
+ * effective cpuset's.  As this function is called with cpuset_mutex held,
- *
+ * cpuset membership stays stable.
- * No return value. It's guaranteed that css_scan_tasks() always returns 0
- * if @heap != NULL.
 */
-static void update_tasks_cpumask(struct cpuset *cs, struct ptr_heap *heap)
+static void update_tasks_cpumask(struct cpuset *cs)
 {
-        css_scan_tasks(&cs->css, NULL, cpuset_change_cpumask, cs, heap);
+        struct cpuset *cpus_cs = effective_cpumask_cpuset(cs);
+        struct css_task_iter it;
+        struct task_struct *task;
+        css_task_iter_start(&cs->css, &it);
+        while ((task = css_task_iter_next(&it)))
+                set_cpus_allowed_ptr(task, cpus_cs->cpus_allowed);
+        css_task_iter_end(&it);
 }
 /*
 * update_tasks_cpumask_hier - Update the cpumasks of tasks in the hierarchy.
 * @root_cs: the root cpuset of the hierarchy
 * @update_root: update root cpuset or not?
- * @heap: the heap used by css_scan_tasks()
 *
 * This will update cpumasks of tasks in @root_cs and all other empty cpusets
 * which take on cpumask of @root_cs.
 *
 * Called with cpuset_mutex held
 */
-static void update_tasks_cpumask_hier(struct cpuset *root_cs,
+static void update_tasks_cpumask_hier(struct cpuset *root_cs, bool update_root)
-                                      bool update_root, struct ptr_heap *heap)
 {
        struct cpuset *cp;
        struct cgroup_subsys_state *pos_css;
@@ -898,7 +879,7 @@ static void update_tasks_cpumask_hier(struct cpuset *root_cs,
                        continue;
                rcu_read_unlock();
-                update_tasks_cpumask(cp, heap);
+                update_tasks_cpumask(cp);
                rcu_read_lock();
                css_put(&cp->css);
@@ -914,7 +895,6 @@ static void update_tasks_cpumask_hier(struct cpuset *root_cs,
 static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
                          const char *buf)
 {
-        struct ptr_heap heap;
        int retval;
        int is_load_balanced;
@@ -947,19 +927,13 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
        if (retval < 0)
                return retval;
-        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (retval)
-                return retval;
        is_load_balanced = is_sched_load_balance(trialcs);
        mutex_lock(&callback_mutex);
        cpumask_copy(cs->cpus_allowed, trialcs->cpus_allowed);
        mutex_unlock(&callback_mutex);
-        update_tasks_cpumask_hier(cs, true, &heap);
+        update_tasks_cpumask_hier(cs, true);
-        heap_free(&heap);
        if (is_load_balanced)
                rebuild_sched_domains_locked();
@@ -1022,7 +996,7 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
        task_lock(tsk);
        /*
         * Determine if a loop is necessary if another thread is doing
-         * get_mems_allowed().  If at least one node remains unchanged and
+         * read_mems_allowed_begin().  If at least one node remains unchanged and
         * tsk does not have a mempolicy, then an empty nodemask will not be
         * possible when mems_allowed is larger than a word.
         */
@@ -1048,53 +1022,22 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
        task_unlock(tsk);
 }
-struct cpuset_change_nodemask_arg {
-        struct cpuset           *cs;
-        nodemask_t              *newmems;
-};
-/*
- * Update task's mems_allowed and rebind its mempolicy and vmas' mempolicy
- * of it to cpuset's new mems_allowed, and migrate pages to new nodes if
- * memory_migrate flag is set. Called with cpuset_mutex held.
- */
-static void cpuset_change_nodemask(struct task_struct *p, void *data)
-{
-        struct cpuset_change_nodemask_arg *arg = data;
-        struct cpuset *cs = arg->cs;
-        struct mm_struct *mm;
-        int migrate;
-        cpuset_change_task_nodemask(p, arg->newmems);
-        mm = get_task_mm(p);
-        if (!mm)
-                return;
-        migrate = is_memory_migrate(cs);
-        mpol_rebind_mm(mm, &cs->mems_allowed);
-        if (migrate)
-                cpuset_migrate_mm(mm, &cs->old_mems_allowed, arg->newmems);
-        mmput(mm);
-}
 static void *cpuset_being_rebound;
 /**
 * update_tasks_nodemask - Update the nodemasks of tasks in the cpuset.
 * @cs: the cpuset in which each task's mems_allowed mask needs to be changed
- * @heap: if NULL, defer allocating heap memory to css_scan_tasks()
 *
- * Called with cpuset_mutex held.  No return value. It's guaranteed that
+ * Iterate through each task of @cs updating its mems_allowed to the
- * css_scan_tasks() always returns 0 if @heap != NULL.
+ * effective cpuset's.  As this function is called with cpuset_mutex held,
+ * cpuset membership stays stable.
 */
-static void update_tasks_nodemask(struct cpuset *cs, struct ptr_heap *heap)
+static void update_tasks_nodemask(struct cpuset *cs)
 {
        static nodemask_t newmems;      /* protected by cpuset_mutex */
        struct cpuset *mems_cs = effective_nodemask_cpuset(cs);
-        struct cpuset_change_nodemask_arg arg = { .cs = cs,
+        struct css_task_iter it;
-                                                  .newmems = &newmems };
+        struct task_struct *task;
        cpuset_being_rebound = cs;              /* causes mpol_dup() rebind */
@@ -1110,7 +1053,25 @@ static void update_tasks_nodemask(struct cpuset *cs, struct ptr_heap *heap)
         * It's ok if we rebind the same mm twice; mpol_rebind_mm()
         * is idempotent.  Also migrate pages in each mm to new nodes.
         */
-        css_scan_tasks(&cs->css, NULL, cpuset_change_nodemask, &arg, heap);
+        css_task_iter_start(&cs->css, &it);
+        while ((task = css_task_iter_next(&it))) {
+                struct mm_struct *mm;
+                bool migrate;
+                cpuset_change_task_nodemask(task, &newmems);
+                mm = get_task_mm(task);
+                if (!mm)
+                        continue;
+                migrate = is_memory_migrate(cs);
+                mpol_rebind_mm(mm, &cs->mems_allowed);
+                if (migrate)
+                        cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
+                mmput(mm);
+        }
+        css_task_iter_end(&it);
        /*
         * All the tasks' nodemasks have been updated, update
@@ -1126,15 +1087,13 @@ static void update_tasks_nodemask(struct cpuset *cs, struct ptr_heap *heap)
 * update_tasks_nodemask_hier - Update the nodemasks of tasks in the hierarchy.
 * @cs: the root cpuset of the hierarchy
 * @update_root: update the root cpuset or not?
- * @heap: the heap used by css_scan_tasks()
 *
 * This will update nodemasks of tasks in @root_cs and all other empty cpusets
 * which take on nodemask of @root_cs.
 *
 * Called with cpuset_mutex held
 */
-static void update_tasks_nodemask_hier(struct cpuset *root_cs,
+static void update_tasks_nodemask_hier(struct cpuset *root_cs, bool update_root)
-                                       bool update_root, struct ptr_heap *heap)
 {
        struct cpuset *cp;
        struct cgroup_subsys_state *pos_css;
@@ -1155,7 +1114,7 @@ static void update_tasks_nodemask_hier(struct cpuset *root_cs,
                        continue;
                rcu_read_unlock();
-                update_tasks_nodemask(cp, heap);
+                update_tasks_nodemask(cp);
                rcu_read_lock();
                css_put(&cp->css);
@@ -1180,7 +1139,6 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
                           const char *buf)
 {
        int retval;
-        struct ptr_heap heap;
        /*
         * top_cpuset.mems_allowed tracks node_stats[N_MEMORY];
@@ -1219,17 +1177,11 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
        if (retval < 0)
                goto done;
-        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (retval < 0)
-                goto done;
        mutex_lock(&callback_mutex);
        cs->mems_allowed = trialcs->mems_allowed;
        mutex_unlock(&callback_mutex);
-        update_tasks_nodemask_hier(cs, true, &heap);
+        update_tasks_nodemask_hier(cs, true);
-        heap_free(&heap);
 done:
        return retval;
 }
@@ -1257,38 +1209,22 @@ static int update_relax_domain_level(struct cpuset *cs, s64 val)
 }
 /**
- * cpuset_change_flag - make a task's spread flags the same as its cpuset's
- * @tsk: task to be updated
- * @data: cpuset to @tsk belongs to
- *
- * Called by css_scan_tasks() for each task in a cgroup.
- *
- * We don't need to re-check for the cgroup/cpuset membership, since we're
- * holding cpuset_mutex at this point.
- */
-static void cpuset_change_flag(struct task_struct *tsk, void *data)
-{
-        struct cpuset *cs = data;
-        cpuset_update_task_spread_flag(cs, tsk);
-}
-/**
 * update_tasks_flags - update the spread flags of tasks in the cpuset.
 * @cs: the cpuset in which each task's spread flags needs to be changed
- * @heap: if NULL, defer allocating heap memory to css_scan_tasks()
- *
- * Called with cpuset_mutex held
 *
- * The css_scan_tasks() function will scan all the tasks in a cgroup,
+ * Iterate through each task of @cs updating its spread flags.  As this
- * calling callback functions for each.
+ * function is called with cpuset_mutex held, cpuset membership stays
- *
+ * stable.
- * No return value. It's guaranteed that css_scan_tasks() always returns 0
- * if @heap != NULL.
 */
-static void update_tasks_flags(struct cpuset *cs, struct ptr_heap *heap)
+static void update_tasks_flags(struct cpuset *cs)
 {
-        css_scan_tasks(&cs->css, NULL, cpuset_change_flag, cs, heap);
+        struct css_task_iter it;
+        struct task_struct *task;
+        css_task_iter_start(&cs->css, &it);
+        while ((task = css_task_iter_next(&it)))
+                cpuset_update_task_spread_flag(cs, task);
+        css_task_iter_end(&it);
 }
 /*
@@ -1306,7 +1242,6 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
        struct cpuset *trialcs;
        int balance_flag_changed;
        int spread_flag_changed;
-        struct ptr_heap heap;
        int err;
        trialcs = alloc_trial_cpuset(cs);
@@ -1322,10 +1257,6 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
        if (err < 0)
                goto out;
-        err = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (err < 0)
-                goto out;
        balance_flag_changed = (is_sched_load_balance(cs) !=
                                is_sched_load_balance(trialcs));
@@ -1340,8 +1271,7 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
                rebuild_sched_domains_locked();
        if (spread_flag_changed)
-                update_tasks_flags(cs, &heap);
+                update_tasks_flags(cs);
-        heap_free(&heap);
 out:
        free_trial_cpuset(trialcs);
        return err;
@@ -1445,6 +1375,8 @@ static int fmeter_getrate(struct fmeter *fmp)
        return val;
 }
+static struct cpuset *cpuset_attach_old_cs;
 /* Called by cgroups to determine if a cpuset is usable; cpuset_mutex held */
 static int cpuset_can_attach(struct cgroup_subsys_state *css,
                             struct cgroup_taskset *tset)
@@ -1453,6 +1385,9 @@ static int cpuset_can_attach(struct cgroup_subsys_state *css,
        struct task_struct *task;
        int ret;
+        /* used later by cpuset_attach() */
+        cpuset_attach_old_cs = task_cs(cgroup_taskset_first(tset));
        mutex_lock(&cpuset_mutex);
        /*
@@ -1464,7 +1399,7 @@ static int cpuset_can_attach(struct cgroup_subsys_state *css,
            (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed)))
                goto out_unlock;
-        cgroup_taskset_for_each(task, css, tset) {
+        cgroup_taskset_for_each(task, tset) {
                /*
                 * Kthreads which disallow setaffinity shouldn't be moved
                 * to a new cpuset; we don't want to change their cpu
@@ -1516,10 +1451,8 @@ static void cpuset_attach(struct cgroup_subsys_state *css,
        struct mm_struct *mm;
        struct task_struct *task;
        struct task_struct *leader = cgroup_taskset_first(tset);
-        struct cgroup_subsys_state *oldcss = cgroup_taskset_cur_css(tset,
-                                                        cpuset_subsys_id);
        struct cpuset *cs = css_cs(css);
-        struct cpuset *oldcs = css_cs(oldcss);
+        struct cpuset *oldcs = cpuset_attach_old_cs;
        struct cpuset *cpus_cs = effective_cpumask_cpuset(cs);
        struct cpuset *mems_cs = effective_nodemask_cpuset(cs);
@@ -1533,7 +1466,7 @@ static void cpuset_attach(struct cgroup_subsys_state *css,
        guarantee_online_mems(mems_cs, &cpuset_attach_nodemask_to);
-        cgroup_taskset_for_each(task, css, tset) {
+        cgroup_taskset_for_each(task, tset) {
                /*
                 * can_attach beforehand should guarantee that this doesn't
                 * fail.  TODO: have a better way to handle failure here
@@ -1673,7 +1606,7 @@ out_unlock:
 * Common handling for a write to a "cpus" or "mems" file.
 */
 static int cpuset_write_resmask(struct cgroup_subsys_state *css,
-                                struct cftype *cft, const char *buf)
+                                struct cftype *cft, char *buf)
 {
        struct cpuset *cs = css_cs(css);
        struct cpuset *trialcs;
@@ -2020,8 +1953,7 @@ static void cpuset_css_free(struct cgroup_subsys_state *css)
        kfree(cs);
 }
-struct cgroup_subsys cpuset_subsys = {
+struct cgroup_subsys cpuset_cgrp_subsys = {
-        .name = "cpuset",
        .css_alloc = cpuset_css_alloc,
        .css_online = cpuset_css_online,
        .css_offline = cpuset_css_offline,
@@ -2029,7 +1961,6 @@ struct cgroup_subsys cpuset_subsys = {
        .can_attach = cpuset_can_attach,
        .cancel_attach = cpuset_cancel_attach,
        .attach = cpuset_attach,
-        .subsys_id = cpuset_subsys_id,
        .base_cftypes = files,
        .early_init = 1,
 };
@@ -2086,10 +2017,9 @@ static void remove_tasks_in_empty_cpuset(struct cpuset *cs)
                parent = parent_cs(parent);
        if (cgroup_transfer_tasks(parent->css.cgroup, cs->css.cgroup)) {
-                rcu_read_lock();
+                printk(KERN_ERR "cpuset: failed to transfer tasks out of empty cpuset ");
-                printk(KERN_ERR "cpuset: failed to transfer tasks out of empty cpuset %s\n",
+                pr_cont_cgroup_name(cs->css.cgroup);
-                       cgroup_name(cs->css.cgroup));
+                pr_cont("\n");
-                rcu_read_unlock();
        }
 }
@@ -2137,7 +2067,7 @@ retry:
         */
        if ((sane && cpumask_empty(cs->cpus_allowed)) ||
            (!cpumask_empty(&off_cpus) && !cpumask_empty(cs->cpus_allowed)))
-                update_tasks_cpumask(cs, NULL);
+                update_tasks_cpumask(cs);
        mutex_lock(&callback_mutex);
        nodes_andnot(cs->mems_allowed, cs->mems_allowed, off_mems);
@@ -2151,7 +2081,7 @@ retry:
         */
        if ((sane && nodes_empty(cs->mems_allowed)) ||
            (!nodes_empty(off_mems) && !nodes_empty(cs->mems_allowed)))
-                update_tasks_nodemask(cs, NULL);
+                update_tasks_nodemask(cs);
        is_empty = cpumask_empty(cs->cpus_allowed) ||
                nodes_empty(cs->mems_allowed);
@@ -2213,7 +2143,7 @@ static void cpuset_hotplug_workfn(struct work_struct *work)
                mutex_lock(&callback_mutex);
                top_cpuset.mems_allowed = new_mems;
                mutex_unlock(&callback_mutex);
-                update_tasks_nodemask(&top_cpuset, NULL);
+                update_tasks_nodemask(&top_cpuset);
        }
        mutex_unlock(&cpuset_mutex);
@@ -2305,10 +2235,10 @@ void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask)
        struct cpuset *cpus_cs;
        mutex_lock(&callback_mutex);
-        task_lock(tsk);
+        rcu_read_lock();
        cpus_cs = effective_cpumask_cpuset(task_cs(tsk));
        guarantee_online_cpus(cpus_cs, pmask);
-        task_unlock(tsk);
+        rcu_read_unlock();
        mutex_unlock(&callback_mutex);
 }
@@ -2361,10 +2291,10 @@ nodemask_t cpuset_mems_allowed(struct task_struct *tsk)
        nodemask_t mask;
        mutex_lock(&callback_mutex);
-        task_lock(tsk);
+        rcu_read_lock();
        mems_cs = effective_nodemask_cpuset(task_cs(tsk));
        guarantee_online_mems(mems_cs, &mask);
-        task_unlock(tsk);
+        rcu_read_unlock();
        mutex_unlock(&callback_mutex);
        return mask;
@@ -2480,10 +2410,10 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
        /* Not hardwall and node outside mems_allowed: scan up cpusets */
        mutex_lock(&callback_mutex);
-        task_lock(current);
+        rcu_read_lock();
        cs = nearest_hardwall_ancestor(task_cs(current));
        allowed = node_isset(node, cs->mems_allowed);
-        task_unlock(current);
+        rcu_read_unlock();
        mutex_unlock(&callback_mutex);
        return allowed;
@@ -2609,27 +2539,27 @@ int cpuset_mems_allowed_intersects(const struct task_struct *tsk1,
 * @task: pointer to task_struct of some task.
 *
 * Description: Prints @task's name, cpuset name, and cached copy of its
- * mems_allowed to the kernel log.  Must hold task_lock(task) to allow
+ * mems_allowed to the kernel log.
- * dereferencing task_cs(task).
 */
 void cpuset_print_task_mems_allowed(struct task_struct *tsk)
 {
         /* Statically allocated to prevent using excess stack. */
        static char cpuset_nodelist[CPUSET_NODELIST_LEN];
        static DEFINE_SPINLOCK(cpuset_buffer_lock);
+        struct cgroup *cgrp;
-        struct cgroup *cgrp = task_cs(tsk)->css.cgroup;
-        rcu_read_lock();
        spin_lock(&cpuset_buffer_lock);
+        rcu_read_lock();
+        cgrp = task_cs(tsk)->css.cgroup;
        nodelist_scnprintf(cpuset_nodelist, CPUSET_NODELIST_LEN,
                           tsk->mems_allowed);
-        printk(KERN_INFO "%s cpuset=%s mems_allowed=%s\n",
+        printk(KERN_INFO "%s cpuset=", tsk->comm);
-               tsk->comm, cgroup_name(cgrp), cpuset_nodelist);
+        pr_cont_cgroup_name(cgrp);
+        pr_cont(" mems_allowed=%s\n", cpuset_nodelist);
-        spin_unlock(&cpuset_buffer_lock);
        rcu_read_unlock();
+        spin_unlock(&cpuset_buffer_lock);
 }
 /*
@@ -2660,9 +2590,9 @@ int cpuset_memory_pressure_enabled __read_mostly;
 void __cpuset_memory_pressure_bump(void)
 {
-        task_lock(current);
+        rcu_read_lock();
        fmeter_markevent(&task_cs(current)->fmeter);
-        task_unlock(current);
+        rcu_read_unlock();
 }
 #ifdef CONFIG_PROC_PID_CPUSET
@@ -2679,12 +2609,12 @@ int proc_cpuset_show(struct seq_file *m, void *unused_v)
 {
        struct pid *pid;
        struct task_struct *tsk;
-        char *buf;
+        char *buf, *p;
        struct cgroup_subsys_state *css;
        int retval;
        retval = -ENOMEM;
-        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        buf = kmalloc(PATH_MAX, GFP_KERNEL);
        if (!buf)
                goto out;
@@ -2694,14 +2624,16 @@ int proc_cpuset_show(struct seq_file *m, void *unused_v)
        if (!tsk)
                goto out_free;
+        retval = -ENAMETOOLONG;
        rcu_read_lock();
-        css = task_css(tsk, cpuset_subsys_id);
+        css = task_css(tsk, cpuset_cgrp_id);
-        retval = cgroup_path(css->cgroup, buf, PAGE_SIZE);
+        p = cgroup_path(css->cgroup, buf, PATH_MAX);
        rcu_read_unlock();
-        if (retval < 0)
+        if (!p)
                goto out_put_task;
-        seq_puts(m, buf);
+        seq_puts(m, p);
        seq_putc(m, '\n');
+        retval = 0;
 out_put_task:
        put_task_struct(tsk);
 out_free:
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 99982a70ddad..2956c8da1605 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -49,6 +49,7 @@
 #include <linux/pid.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
+#include <linux/vmacache.h>
 #include <linux/rcupdate.h>
 #include <asm/cacheflush.h>
@@ -224,10 +225,17 @@ static void kgdb_flush_swbreak_addr(unsigned long addr)
        if (!CACHE_FLUSH_IS_SAFE)
                return;
-        if (current->mm && current->mm->mmap_cache) {
+        if (current->mm) {
-                flush_cache_range(current->mm->mmap_cache,
+                int i;
-                                  addr, addr + BREAK_INSTR_SIZE);
+                for (i = 0; i < VMACACHE_SIZE; i++) {
+                        if (!current->vmacache[i])
+                                continue;
+                        flush_cache_range(current->vmacache[i],
+                                          addr, addr + BREAK_INSTR_SIZE);
+                }
        }
        /* Force flush instruction cache if it was outside the mm */
        flush_icache_range(addr, addr + BREAK_INSTR_SIZE);
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 661951ab8ae7..f83a71a3e46d 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -361,7 +361,7 @@ struct perf_cgroup {
 static inline struct perf_cgroup *
 perf_cgroup_from_task(struct task_struct *task)
 {
-        return container_of(task_css(task, perf_subsys_id),
+        return container_of(task_css(task, perf_event_cgrp_id),
                            struct perf_cgroup, css);
 }
@@ -389,11 +389,6 @@ perf_cgroup_match(struct perf_event *event)
                                    event->cgrp->css.cgroup);
 }
-static inline bool perf_tryget_cgroup(struct perf_event *event)
-{
-        return css_tryget(&event->cgrp->css);
-}
 static inline void perf_put_cgroup(struct perf_event *event)
 {
        css_put(&event->cgrp->css);
@@ -612,9 +607,7 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
        if (!f.file)
                return -EBADF;
-        rcu_read_lock();
+        css = css_tryget_from_dir(f.file->f_dentry, &perf_event_cgrp_subsys);
-        css = css_from_dir(f.file->f_dentry, &perf_subsys);
        if (IS_ERR(css)) {
                ret = PTR_ERR(css);
                goto out;
@@ -623,13 +616,6 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
        cgrp = container_of(css, struct perf_cgroup, css);
        event->cgrp = cgrp;
-        /* must be done before we fput() the file */
-        if (!perf_tryget_cgroup(event)) {
-                event->cgrp = NULL;
-                ret = -ENOENT;
-                goto out;
-        }
        /*
         * all events in a group must monitor
         * the same cgroup because a task belongs
@@ -640,7 +626,6 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
                ret = -EINVAL;
        }
 out:
-        rcu_read_unlock();
        fdput(f);
        return ret;
 }
@@ -8053,7 +8038,7 @@ static void perf_cgroup_attach(struct cgroup_subsys_state *css,
 {
        struct task_struct *task;
-        cgroup_taskset_for_each(task, css, tset)
+        cgroup_taskset_for_each(task, tset)
                task_function_call(task, __perf_cgroup_move, task);
 }
@@ -8072,9 +8057,7 @@ static void perf_cgroup_exit(struct cgroup_subsys_state *css,
        task_function_call(task, __perf_cgroup_move, task);
 }
-struct cgroup_subsys perf_subsys = {
+struct cgroup_subsys perf_event_cgrp_subsys = {
-        .name           = "perf_event",
-        .subsys_id      = perf_subsys_id,
        .css_alloc      = perf_cgroup_css_alloc,
        .css_free       = perf_cgroup_css_free,
        .exit           = perf_cgroup_exit,
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 307d87c0991a..04709b66369d 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1804,6 +1804,11 @@ static bool handle_trampoline(struct pt_regs *regs)
        return true;
 }
+bool __weak arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *regs)
+{
+        return false;
+}
 /*
 * Run handler and ask thread to singlestep.
 * Ensure all non-fatal signals cannot interrupt thread while it singlesteps.
@@ -1858,7 +1863,11 @@ static void handle_swbp(struct pt_regs *regs)
        if (!get_utask())
                goto out;
+        if (arch_uprobe_ignore(&uprobe->arch, regs))
+                goto out;
        handler_chain(uprobe, regs);
        if (can_skip_sstep(uprobe, regs))
                goto out;
diff --git a/kernel/exit.c b/kernel/exit.c
index 1e77fc645317..6ed6a1d552b5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -570,7 +570,7 @@ static void reparent_leader(struct task_struct *father, struct task_struct *p,
        if (same_thread_group(p->real_parent, father))
                return;
-        /* We don't want people slaying init.  */
+        /* We don't want people slaying init. */
        p->exit_signal = SIGCHLD;
        /* If it has exited notify the new parent about this child's death. */
@@ -784,9 +784,10 @@ void do_exit(long code)
        exit_shm(tsk);
        exit_files(tsk);
        exit_fs(tsk);
+        if (group_dead)
+                disassociate_ctty(1);
        exit_task_namespaces(tsk);
        exit_task_work(tsk);
-        check_stack_usage();
        exit_thread();
        /*
@@ -797,21 +798,17 @@ void do_exit(long code)
         */
        perf_event_exit_task(tsk);
-        cgroup_exit(tsk, 1);
+        cgroup_exit(tsk);
-        if (group_dead)
-                disassociate_ctty(1);
        module_put(task_thread_info(tsk)->exec_domain->module);
-        proc_exit_connector(tsk);
        /*
         * FIXME: do that only when needed, using sched_exit tracepoint
         */
        flush_ptrace_hw_breakpoint(tsk);
        exit_notify(tsk, group_dead);
+        proc_exit_connector(tsk);
 #ifdef CONFIG_NUMA
        task_lock(tsk);
        mpol_put(tsk->mempolicy);
@@ -844,6 +841,7 @@ void do_exit(long code)
        validate_creds_for_do_exit(tsk);
+        check_stack_usage();
        preempt_disable();
        if (tsk->nr_dirtied)
                __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
@@ -1038,17 +1036,13 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
                return wait_noreap_copyout(wo, p, pid, uid, why, status);
        }
+        traced = ptrace_reparented(p);
        /*
-         * Try to move the task's state to DEAD
+         * Move the task's state to DEAD/TRACE, only one thread can do this.
-         * only one thread is allowed to do this:
         */
-        state = xchg(&p->exit_state, EXIT_DEAD);
+        state = traced && thread_group_leader(p) ? EXIT_TRACE : EXIT_DEAD;
-        if (state != EXIT_ZOMBIE) {
+        if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
-                BUG_ON(state != EXIT_DEAD);
                return 0;
-        }
-        traced = ptrace_reparented(p);
        /*
         * It can be ptraced but not reparented, check
         * thread_group_leader() to filter out sub-threads.
@@ -1109,7 +1103,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
        /*
         * Now we are sure this task is interesting, and no other
-         * thread can reap it because we set its state to EXIT_DEAD.
+         * thread can reap it because we its state == DEAD/TRACE.
         */
        read_unlock(&tasklist_lock);
@@ -1146,22 +1140,19 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
        if (!retval)
                retval = pid;
-        if (traced) {
+        if (state == EXIT_TRACE) {
                write_lock_irq(&tasklist_lock);
                /* We dropped tasklist, ptracer could die and untrace */
                ptrace_unlink(p);
-                /*
-                 * If this is not a sub-thread, notify the parent.
+                /* If parent wants a zombie, don't release it now */
-                 * If parent wants a zombie, don't release it now.
+                state = EXIT_ZOMBIE;
-                 */
+                if (do_notify_parent(p, p->exit_signal))
-                if (thread_group_leader(p) &&
+                        state = EXIT_DEAD;
-                    !do_notify_parent(p, p->exit_signal)) {
+                p->exit_state = state;
-                        p->exit_state = EXIT_ZOMBIE;
-                        p = NULL;
-                }
                write_unlock_irq(&tasklist_lock);
        }
-        if (p != NULL)
+        if (state == EXIT_DEAD)
                release_task(p);
        return retval;
@@ -1338,7 +1329,12 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
 static int wait_consider_task(struct wait_opts *wo, int ptrace,
                                struct task_struct *p)
 {
-        int ret = eligible_child(wo, p);
+        int ret;
+        if (unlikely(p->exit_state == EXIT_DEAD))
+                return 0;
+        ret = eligible_child(wo, p);
        if (!ret)
                return ret;
@@ -1356,33 +1352,44 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                return 0;
        }
-        /* dead body doesn't have much to contribute */
+        if (unlikely(p->exit_state == EXIT_TRACE)) {
-        if (unlikely(p->exit_state == EXIT_DEAD)) {
                /*
-                 * But do not ignore this task until the tracer does
+                 * ptrace == 0 means we are the natural parent. In this case
-                 * wait_task_zombie()->do_notify_parent().
+                 * we should clear notask_error, debugger will notify us.
                 */
-                if (likely(!ptrace) && unlikely(ptrace_reparented(p)))
+                if (likely(!ptrace))
                        wo->notask_error = 0;
                return 0;
        }
-        /* slay zombie? */
+        if (likely(!ptrace) && unlikely(p->ptrace)) {
-        if (p->exit_state == EXIT_ZOMBIE) {
                /*
-                 * A zombie ptracee is only visible to its ptracer.
+                 * If it is traced by its real parent's group, just pretend
-                 * Notification and reaping will be cascaded to the real
+                 * the caller is ptrace_do_wait() and reap this child if it
-                 * parent when the ptracer detaches.
+                 * is zombie.
+                 *
+                 * This also hides group stop state from real parent; otherwise
+                 * a single stop can be reported twice as group and ptrace stop.
+                 * If a ptracer wants to distinguish these two events for its
+                 * own children it should create a separate process which takes
+                 * the role of real parent.
                 */
-                if (likely(!ptrace) && unlikely(p->ptrace)) {
+                if (!ptrace_reparented(p))
-                        /* it will become visible, clear notask_error */
+                        ptrace = 1;
-                        wo->notask_error = 0;
+        }
-                        return 0;
-                }
+        /* slay zombie? */
+        if (p->exit_state == EXIT_ZOMBIE) {
                /* we don't reap group leaders with subthreads */
-                if (!delay_group_leader(p))
+                if (!delay_group_leader(p)) {
-                        return wait_task_zombie(wo, p);
+                        /*
+                         * A zombie ptracee is only visible to its ptracer.
+                         * Notification and reaping will be cascaded to the
+                         * real parent when the ptracer detaches.
+                         */
+                        if (unlikely(ptrace) || likely(!p->ptrace))
+                                return wait_task_zombie(wo, p);
+                }
                /*
                 * Allow access to stopped/continued state via zombie by
@@ -1408,19 +1415,6 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
                        wo->notask_error = 0;
        } else {
                /*
-                 * If @p is ptraced by a task in its real parent's group,
-                 * hide group stop/continued state when looking at @p as
-                 * the real parent; otherwise, a single stop can be
-                 * reported twice as group and ptrace stops.
-                 *
-                 * If a ptracer wants to distinguish the two events for its
-                 * own children, it should create a separate process which
-                 * takes the role of real parent.
-                 */
-                if (likely(!ptrace) && p->ptrace && !ptrace_reparented(p))
-                        return 0;
-                /*
                 * @p is alive and it's gonna stop, continue or exit, so
                 * there always is something to wait for.
                 */
diff --git a/kernel/fork.c b/kernel/fork.c
index 332688e5e7b4..54a8d26f612f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -28,6 +28,8 @@
 #include <linux/mman.h>
 #include <linux/mmu_notifier.h>
 #include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/vmacache.h>
 #include <linux/nsproxy.h>
 #include <linux/capability.h>
 #include <linux/cpu.h>
@@ -71,6 +73,7 @@
 #include <linux/signalfd.h>
 #include <linux/uprobes.h>
 #include <linux/aio.h>
+#include <linux/compiler.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -284,7 +287,7 @@ void __init fork_init(unsigned long mempages)
                init_task.signal->rlim[RLIMIT_NPROC];
 }
-int __attribute__((weak)) arch_dup_task_struct(struct task_struct *dst,
+int __weak arch_dup_task_struct(struct task_struct *dst,
                                               struct task_struct *src)
 {
        *dst = *src;
@@ -364,7 +367,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
        mm->locked_vm = 0;
        mm->mmap = NULL;
-        mm->mmap_cache = NULL;
+        mm->vmacache_seqnum = 0;
        mm->map_count = 0;
        cpumask_clear(mm_cpumask(mm));
        mm->mm_rb = RB_ROOT;
@@ -530,8 +533,6 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
        atomic_set(&mm->mm_count, 1);
        init_rwsem(&mm->mmap_sem);
        INIT_LIST_HEAD(&mm->mmlist);
-        mm->flags = (current->mm) ?
-                (current->mm->flags & MMF_INIT_MASK) : default_dump_filter;
        mm->core_state = NULL;
        atomic_long_set(&mm->nr_ptes, 0);
        memset(&mm->rss_stat, 0, sizeof(mm->rss_stat));
@@ -540,8 +541,15 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
        mm_init_owner(mm, p);
        clear_tlb_flush_pending(mm);
-        if (likely(!mm_alloc_pgd(mm))) {
+        if (current->mm) {
+                mm->flags = current->mm->flags & MMF_INIT_MASK;
+                mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK;
+        } else {
+                mm->flags = default_dump_filter;
                mm->def_flags = 0;
+        }
+        if (likely(!mm_alloc_pgd(mm))) {
                mmu_notifier_mm_init(mm);
                return mm;
        }
@@ -877,6 +885,9 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk)
        if (!oldmm)
                return 0;
+        /* initialize the new vmacache entries */
+        vmacache_flush(tsk);
        if (clone_flags & CLONE_VM) {
                atomic_inc(&oldmm->mm_users);
                mm = oldmm;
@@ -1070,15 +1081,6 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
        return 0;
 }
-static void copy_flags(unsigned long clone_flags, struct task_struct *p)
-{
-        unsigned long new_flags = p->flags;
-        new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
-        new_flags |= PF_FORKNOEXEC;
-        p->flags = new_flags;
-}
 SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
 {
        current->clear_child_tid = tidptr;
@@ -1228,7 +1230,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                goto bad_fork_cleanup_count;
        delayacct_tsk_init(p);  /* Must remain after dup_task_struct() */
-        copy_flags(clone_flags, p);
+        p->flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
+        p->flags |= PF_FORKNOEXEC;
        INIT_LIST_HEAD(&p->children);
        INIT_LIST_HEAD(&p->sibling);
        rcu_copy_process(p);
@@ -1272,9 +1275,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        if (IS_ERR(p->mempolicy)) {
                retval = PTR_ERR(p->mempolicy);
                p->mempolicy = NULL;
-                goto bad_fork_cleanup_cgroup;
+                goto bad_fork_cleanup_threadgroup_lock;
        }
-        mpol_fix_fork_child_flag(p);
 #endif
 #ifdef CONFIG_CPUSETS
        p->cpuset_mem_spread_rotor = NUMA_NO_NODE;
@@ -1525,11 +1527,10 @@ bad_fork_cleanup_policy:
        perf_event_free_task(p);
 #ifdef CONFIG_NUMA
        mpol_put(p->mempolicy);
-bad_fork_cleanup_cgroup:
+bad_fork_cleanup_threadgroup_lock:
 #endif
        if (clone_flags & CLONE_THREAD)
                threadgroup_change_end(current);
-        cgroup_exit(p, 0);
        delayacct_tsk_free(p);
        module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index f9f44fd4d34d..55c8c9349cfe 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -183,7 +183,7 @@ COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
        if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
                      cmd == FUTEX_WAIT_BITSET ||
                      cmd == FUTEX_WAIT_REQUEUE_PI)) {
-                if (get_compat_timespec(&ts, utime))
+                if (compat_get_timespec(&ts, utime))
                        return -EFAULT;
                if (!timespec_valid(&ts))
                        return -EINVAL;
diff --git a/kernel/groups.c b/kernel/groups.c
index 90cf1c38c8ea..451698f86cfa 100644
--- a/kernel/groups.c
+++ b/kernel/groups.c
@@ -157,17 +157,13 @@ int groups_search(const struct group_info *group_info, kgid_t grp)
 * set_groups - Change a group subscription in a set of credentials
 * @new: The newly prepared set of credentials to alter
 * @group_info: The group list to install
- *
- * Validate a group subscription and, if valid, insert it into a set
- * of credentials.
 */
-int set_groups(struct cred *new, struct group_info *group_info)
+void set_groups(struct cred *new, struct group_info *group_info)
 {
        put_group_info(new->group_info);
        groups_sort(group_info);
        get_group_info(group_info);
        new->group_info = group_info;
-        return 0;
 }
 EXPORT_SYMBOL(set_groups);
@@ -182,18 +178,12 @@ EXPORT_SYMBOL(set_groups);
 int set_current_groups(struct group_info *group_info)
 {
        struct cred *new;
-        int ret;
        new = prepare_creds();
        if (!new)
                return -ENOMEM;
-        ret = set_groups(new, group_info);
+        set_groups(new, group_info);
-        if (ret < 0) {
-                abort_creds(new);
-                return ret;
-        }
        return commit_creds(new);
 }
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 09094361dce5..d55092ceee29 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -168,19 +168,6 @@ struct hrtimer_clock_base *lock_hrtimer_base(const struct hrtimer *timer,
        }
 }
-/*
- * Get the preferred target CPU for NOHZ
- */
-static int hrtimer_get_target(int this_cpu, int pinned)
-{
-#ifdef CONFIG_NO_HZ_COMMON
-        if (!pinned && get_sysctl_timer_migration() && idle_cpu(this_cpu))
-                return get_nohz_timer_target();
-#endif
-        return this_cpu;
-}
 /*
 * With HIGHRES=y we do not migrate the timer when it is expiring
 * before the next event on the target cpu because we cannot reprogram
@@ -214,7 +201,7 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,
        struct hrtimer_clock_base *new_base;
        struct hrtimer_cpu_base *new_cpu_base;
        int this_cpu = smp_processor_id();
-        int cpu = hrtimer_get_target(this_cpu, pinned);
+        int cpu = get_nohz_timer_target(pinned);
        int basenum = base->index;
 again:
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 0b9c169d577f..06bb1417b063 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -246,5 +246,4 @@ static int __init hung_task_init(void)
        return 0;
 }
+subsys_initcall(hung_task_init);
-module_init(hung_task_init);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index dc04c166c54d..6397df2d6945 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -281,6 +281,19 @@ void unmask_irq(struct irq_desc *desc)
        }
 }
+void unmask_threaded_irq(struct irq_desc *desc)
+{
+        struct irq_chip *chip = desc->irq_data.chip;
+        if (chip->flags & IRQCHIP_EOI_THREADED)
+                chip->irq_eoi(&desc->irq_data);
+        if (chip->irq_unmask) {
+                chip->irq_unmask(&desc->irq_data);
+                irq_state_clr_masked(desc);
+        }
+}
 /*
 *      handle_nested_irq - Handle a nested irq from a irq thread
 *      @irq:   the interrupt number
@@ -435,6 +448,27 @@ static inline void preflow_handler(struct irq_desc *desc)
 static inline void preflow_handler(struct irq_desc *desc) { }
 #endif
+static void cond_unmask_eoi_irq(struct irq_desc *desc, struct irq_chip *chip)
+{
+        if (!(desc->istate & IRQS_ONESHOT)) {
+                chip->irq_eoi(&desc->irq_data);
+                return;
+        }
+        /*
+         * We need to unmask in the following cases:
+         * - Oneshot irq which did not wake the thread (caused by a
+         *   spurious interrupt or a primary handler handling it
+         *   completely).
+         */
+        if (!irqd_irq_disabled(&desc->irq_data) &&
+            irqd_irq_masked(&desc->irq_data) && !desc->threads_oneshot) {
+                chip->irq_eoi(&desc->irq_data);
+                unmask_irq(desc);
+        } else if (!(chip->flags & IRQCHIP_EOI_THREADED)) {
+                chip->irq_eoi(&desc->irq_data);
+        }
+}
 /**
 *      handle_fasteoi_irq - irq handler for transparent controllers
 *      @irq:   the interrupt number
@@ -448,6 +482,8 @@ static inline void preflow_handler(struct irq_desc *desc) { }
 void
 handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = desc->irq_data.chip;
        raw_spin_lock(&desc->lock);
        if (unlikely(irqd_irq_inprogress(&desc->irq_data)))
@@ -473,18 +509,14 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
        preflow_handler(desc);
        handle_irq_event(desc);
-        if (desc->istate & IRQS_ONESHOT)
+        cond_unmask_eoi_irq(desc, chip);
-                cond_unmask_irq(desc);
-out_eoi:
-        desc->irq_data.chip->irq_eoi(&desc->irq_data);
-out_unlock:
        raw_spin_unlock(&desc->lock);
        return;
 out:
-        if (!(desc->irq_data.chip->flags & IRQCHIP_EOI_IF_HANDLED))
+        if (!(chip->flags & IRQCHIP_EOI_IF_HANDLED))
-                goto out_eoi;
+                chip->irq_eoi(&desc->irq_data);
-        goto out_unlock;
+        raw_spin_unlock(&desc->lock);
 }
 /**
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 131ca176b497..635480270858 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -41,6 +41,7 @@ irqreturn_t no_action(int cpl, void *dev_id)
 {
        return IRQ_NONE;
 }
+EXPORT_SYMBOL_GPL(no_action);
 static void warn_no_thread(unsigned int irq, struct irqaction *action)
 {
@@ -51,7 +52,7 @@ static void warn_no_thread(unsigned int irq, struct irqaction *action)
               "but no thread function available.", irq, action->name);
 }
-static void irq_wake_thread(struct irq_desc *desc, struct irqaction *action)
+void __irq_wake_thread(struct irq_desc *desc, struct irqaction *action)
 {
        /*
         * In case the thread crashed and was killed we just pretend that
@@ -157,7 +158,7 @@ handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action)
                                break;
                        }
-                        irq_wake_thread(desc, action);
+                        __irq_wake_thread(desc, action);
                        /* Fall through to add to randomness */
                case IRQ_HANDLED:
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 001fa5bab490..ddf1ffeb79f1 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -6,6 +6,7 @@
 * of this file for your non core code.
 */
 #include <linux/irqdesc.h>
+#include <linux/kernel_stat.h>
 #ifdef CONFIG_SPARSE_IRQ
 # define IRQ_BITMAP_BITS        (NR_IRQS + 8196)
@@ -73,6 +74,7 @@ extern void irq_percpu_enable(struct irq_desc *desc, unsigned int cpu);
 extern void irq_percpu_disable(struct irq_desc *desc, unsigned int cpu);
 extern void mask_irq(struct irq_desc *desc);
 extern void unmask_irq(struct irq_desc *desc);
+extern void unmask_threaded_irq(struct irq_desc *desc);
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
@@ -82,6 +84,7 @@ irqreturn_t handle_irq_event(struct irq_desc *desc);
 /* Resending of interrupts :*/
 void check_irq_resend(struct irq_desc *desc, unsigned int irq);
 bool irq_wait_for_poll(struct irq_desc *desc);
+void __irq_wake_thread(struct irq_desc *desc, struct irqaction *action);
 #ifdef CONFIG_PROC_FS
 extern void register_irq_proc(unsigned int irq, struct irq_desc *desc);
@@ -179,3 +182,9 @@ static inline bool irqd_has_set(struct irq_data *d, unsigned int mask)
 {
        return d->state_use_accessors & mask;
 }
+static inline void kstat_incr_irqs_this_cpu(unsigned int irq, struct irq_desc *desc)
+{
+        __this_cpu_inc(*desc->kstat_irqs);
+        __this_cpu_inc(kstat.irqs_sum);
+}
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 8ab8e9390297..a7174617616b 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -489,6 +489,11 @@ void dynamic_irq_cleanup(unsigned int irq)
        raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
+void kstat_incr_irq_this_cpu(unsigned int irq)
+{
+        kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
+}
 unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
 {
        struct irq_desc *desc = irq_to_desc(irq);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index d3bf660cb57f..2486a4c1a710 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -32,24 +32,10 @@ static int __init setup_forced_irqthreads(char *arg)
 early_param("threadirqs", setup_forced_irqthreads);
 #endif
-/**
+static void __synchronize_hardirq(struct irq_desc *desc)
- *      synchronize_irq - wait for pending IRQ handlers (on other CPUs)
- *      @irq: interrupt number to wait for
- *
- *      This function waits for any pending IRQ handlers for this interrupt
- *      to complete before returning. If you use this function while
- *      holding a resource the IRQ handler may need you will deadlock.
- *
- *      This function may be called - with care - from IRQ context.
- */
-void synchronize_irq(unsigned int irq)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
        bool inprogress;
-        if (!desc)
-                return;
        do {
                unsigned long flags;
@@ -67,12 +53,56 @@ void synchronize_irq(unsigned int irq)
                /* Oops, that failed? */
        } while (inprogress);
+}
-        /*
+/**
-         * We made sure that no hardirq handler is running. Now verify
+ *      synchronize_hardirq - wait for pending hard IRQ handlers (on other CPUs)
-         * that no threaded handlers are active.
+ *      @irq: interrupt number to wait for
-         */
+ *
-        wait_event(desc->wait_for_threads, !atomic_read(&desc->threads_active));
+ *      This function waits for any pending hard IRQ handlers for this
+ *      interrupt to complete before returning. If you use this
+ *      function while holding a resource the IRQ handler may need you
+ *      will deadlock. It does not take associated threaded handlers
+ *      into account.
+ *
+ *      Do not use this for shutdown scenarios where you must be sure
+ *      that all parts (hardirq and threaded handler) have completed.
+ *
+ *      This function may be called - with care - from IRQ context.
+ */
+void synchronize_hardirq(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+        if (desc)
+                __synchronize_hardirq(desc);
+}
+EXPORT_SYMBOL(synchronize_hardirq);
+/**
+ *      synchronize_irq - wait for pending IRQ handlers (on other CPUs)
+ *      @irq: interrupt number to wait for
+ *
+ *      This function waits for any pending IRQ handlers for this interrupt
+ *      to complete before returning. If you use this function while
+ *      holding a resource the IRQ handler may need you will deadlock.
+ *
+ *      This function may be called - with care - from IRQ context.
+ */
+void synchronize_irq(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+        if (desc) {
+                __synchronize_hardirq(desc);
+                /*
+                 * We made sure that no hardirq handler is
+                 * running. Now verify that no threaded handlers are
+                 * active.
+                 */
+                wait_event(desc->wait_for_threads,
+                           !atomic_read(&desc->threads_active));
+        }
 }
 EXPORT_SYMBOL(synchronize_irq);
@@ -718,7 +748,7 @@ again:
        if (!desc->threads_oneshot && !irqd_irq_disabled(&desc->irq_data) &&
            irqd_irq_masked(&desc->irq_data))
-                unmask_irq(desc);
+                unmask_threaded_irq(desc);
 out_unlock:
        raw_spin_unlock_irq(&desc->lock);
@@ -727,7 +757,7 @@ out_unlock:
 #ifdef CONFIG_SMP
 /*
- * Check whether we need to chasnge the affinity of the interrupt thread.
+ * Check whether we need to change the affinity of the interrupt thread.
 */
 static void
 irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
@@ -880,6 +910,33 @@ static int irq_thread(void *data)
        return 0;
 }
+/**
+ *      irq_wake_thread - wake the irq thread for the action identified by dev_id
+ *      @irq:           Interrupt line
+ *      @dev_id:        Device identity for which the thread should be woken
+ *
+ */
+void irq_wake_thread(unsigned int irq, void *dev_id)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+        struct irqaction *action;
+        unsigned long flags;
+        if (!desc || WARN_ON(irq_settings_is_per_cpu_devid(desc)))
+                return;
+        raw_spin_lock_irqsave(&desc->lock, flags);
+        for (action = desc->action; action; action = action->next) {
+                if (action->dev_id == dev_id) {
+                        if (action->thread)
+                                __irq_wake_thread(desc, action);
+                        break;
+                }
+        }
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+}
+EXPORT_SYMBOL_GPL(irq_wake_thread);
 static void irq_setup_forced_threading(struct irqaction *new)
 {
        if (!force_irqthreads)
@@ -896,6 +953,23 @@ static void irq_setup_forced_threading(struct irqaction *new)
        }
 }
+static int irq_request_resources(struct irq_desc *desc)
+{
+        struct irq_data *d = &desc->irq_data;
+        struct irq_chip *c = d->chip;
+        return c->irq_request_resources ? c->irq_request_resources(d) : 0;
+}
+static void irq_release_resources(struct irq_desc *desc)
+{
+        struct irq_data *d = &desc->irq_data;
+        struct irq_chip *c = d->chip;
+        if (c->irq_release_resources)
+                c->irq_release_resources(d);
+}
 /*
 * Internal function to register an irqaction - typically used to
 * allocate special interrupts that are part of the architecture.
@@ -1091,6 +1165,13 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
        }
        if (!shared) {
+                ret = irq_request_resources(desc);
+                if (ret) {
+                        pr_err("Failed to request resources for %s (irq %d) on irqchip %s\n",
+                               new->name, irq, desc->irq_data.chip->name);
+                        goto out_mask;
+                }
                init_waitqueue_head(&desc->wait_for_threads);
                /* Setup the type (level, edge polarity) if configured: */
@@ -1261,8 +1342,10 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
        *action_ptr = action->next;
        /* If this was the last handler, shut down the IRQ line: */
-        if (!desc->action)
+        if (!desc->action) {
                irq_shutdown(desc);
+                irq_release_resources(desc);
+        }
 #ifdef CONFIG_SMP
        /* make sure affinity_hint is cleaned up */
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 36f6ee181b0c..ac1ba2f11032 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -324,15 +324,15 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
 #ifdef CONFIG_SMP
        /* create /proc/irq/<irq>/smp_affinity */
-        proc_create_data("smp_affinity", 0600, desc->dir,
+        proc_create_data("smp_affinity", 0644, desc->dir,
                         &irq_affinity_proc_fops, (void *)(long)irq);
        /* create /proc/irq/<irq>/affinity_hint */
-        proc_create_data("affinity_hint", 0400, desc->dir,
+        proc_create_data("affinity_hint", 0444, desc->dir,
                         &irq_affinity_hint_proc_fops, (void *)(long)irq);
        /* create /proc/irq/<irq>/smp_affinity_list */
-        proc_create_data("smp_affinity_list", 0600, desc->dir,
+        proc_create_data("smp_affinity_list", 0644, desc->dir,
                         &irq_affinity_list_proc_fops, (void *)(long)irq);
        proc_create_data("node", 0444, desc->dir,
@@ -372,7 +372,7 @@ void unregister_handler_proc(unsigned int irq, struct irqaction *action)
 static void register_default_affinity_proc(void)
 {
 #ifdef CONFIG_SMP
-        proc_create("irq/default_smp_affinity", 0600, NULL,
+        proc_create("irq/default_smp_affinity", 0644, NULL,
                    &default_affinity_proc_fops);
 #endif
 }
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 3127ad52cdb2..cb0cf37dac3a 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -23,6 +23,7 @@
 #include <linux/mm.h>
 #include <linux/ctype.h>
 #include <linux/slab.h>
+#include <linux/compiler.h>
 #include <asm/sections.h>
@@ -36,8 +37,8 @@
 * These will be re-linked against their real values
 * during the second link stage.
 */
-extern const unsigned long kallsyms_addresses[] __attribute__((weak));
+extern const unsigned long kallsyms_addresses[] __weak;
-extern const u8 kallsyms_names[] __attribute__((weak));
+extern const u8 kallsyms_names[] __weak;
 /*
 * Tell the compiler that the count isn't in the small data section if the arch
@@ -46,10 +47,10 @@ extern const u8 kallsyms_names[] __attribute__((weak));
 extern const unsigned long kallsyms_num_syms
 __attribute__((weak, section(".rodata")));
-extern const u8 kallsyms_token_table[] __attribute__((weak));
+extern const u8 kallsyms_token_table[] __weak;
-extern const u16 kallsyms_token_index[] __attribute__((weak));
+extern const u16 kallsyms_token_index[] __weak;
-extern const unsigned long kallsyms_markers[] __attribute__((weak));
+extern const unsigned long kallsyms_markers[] __weak;
 static inline int is_kernel_inittext(unsigned long addr)
 {
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 45601cf41bee..c8380ad203bc 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -32,6 +32,7 @@
 #include <linux/vmalloc.h>
 #include <linux/swap.h>
 #include <linux/syscore_ops.h>
+#include <linux/compiler.h>
 #include <asm/page.h>
 #include <asm/uaccess.h>
@@ -1235,7 +1236,7 @@ static int __init crash_notes_memory_init(void)
        }
        return 0;
 }
-module_init(crash_notes_memory_init)
+subsys_initcall(crash_notes_memory_init);
 /*
@@ -1551,10 +1552,10 @@ void vmcoreinfo_append_str(const char *fmt, ...)
 * provide an empty default implementation here -- architecture
 * code may override this
 */
-void __attribute__ ((weak)) arch_crash_save_vmcoreinfo(void)
+void __weak arch_crash_save_vmcoreinfo(void)
 {}
-unsigned long __attribute__ ((weak)) paddr_vmcoreinfo_note(void)
+unsigned long __weak paddr_vmcoreinfo_note(void)
 {
        return __pa((unsigned long)(char *)&vmcoreinfo_note);
 }
@@ -1629,7 +1630,7 @@ static int __init crash_save_vmcoreinfo_init(void)
        return 0;
 }
-module_init(crash_save_vmcoreinfo_init)
+subsys_initcall(crash_save_vmcoreinfo_init);
 /*
 * Move into place and start executing a preloaded standalone
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index e660964086e2..2495a9b14ac8 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -18,6 +18,7 @@
 #include <linux/stat.h>
 #include <linux/sched.h>
 #include <linux/capability.h>
+#include <linux/compiler.h>
 #include <linux/rcupdate.h>     /* rcu_expedited */
@@ -162,8 +163,8 @@ KERNEL_ATTR_RW(rcu_expedited);
 /*
 * Make /sys/kernel/notes give the raw contents of our kernel .notes section.
 */
-extern const void __start_notes __attribute__((weak));
+extern const void __start_notes __weak;
-extern const void __stop_notes __attribute__((weak));
+extern const void __stop_notes __weak;
 #define notes_size (&__stop_notes - &__start_notes)
 static ssize_t notes_read(struct file *filp, struct kobject *kobj,
diff --git a/kernel/kthread.c b/kernel/kthread.c
index b5ae3ee860a9..9a130ec06f7a 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -217,7 +217,7 @@ int tsk_fork_get_node(struct task_struct *tsk)
        if (tsk == kthreadd_task)
                return tsk->pref_node_fork;
 #endif
-        return numa_node_id();
+        return NUMA_NO_NODE;
 }
 static void create_kthread(struct kthread_create_info *create)
@@ -369,7 +369,7 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
 {
        struct task_struct *p;
-        p = kthread_create_on_node(threadfn, data, cpu_to_node(cpu), namefmt,
+        p = kthread_create_on_node(threadfn, data, cpu_to_mem(cpu), namefmt,
                                   cpu);
        if (IS_ERR(p))
                return p;
diff --git a/kernel/locking/Makefile b/kernel/locking/Makefile
index 306a76b51e0f..b8bdcd4785b7 100644
--- a/kernel/locking/Makefile
+++ b/kernel/locking/Makefile
@@ -1,5 +1,5 @@
-obj-y += mutex.o semaphore.o rwsem.o lglock.o mcs_spinlock.o
+obj-y += mutex.o semaphore.o rwsem.o mcs_spinlock.o
 ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_lockdep.o = -pg
@@ -14,6 +14,7 @@ ifeq ($(CONFIG_PROC_FS),y)
 obj-$(CONFIG_LOCKDEP) += lockdep_proc.o
 endif
 obj-$(CONFIG_SMP) += spinlock.o
+obj-$(CONFIG_SMP) += lglock.o
 obj-$(CONFIG_PROVE_LOCKING) += spinlock.o
 obj-$(CONFIG_RT_MUTEXES) += rtmutex.o
 obj-$(CONFIG_DEBUG_RT_MUTEXES) += rtmutex-debug.o
diff --git a/kernel/module.c b/kernel/module.c
index 8dc7f5e80dd8..11869408f79b 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -640,7 +640,7 @@ static int module_unload_init(struct module *mod)
        INIT_LIST_HEAD(&mod->target_list);
        /* Hold reference count during initialization. */
-        __this_cpu_write(mod->refptr->incs, 1);
+        raw_cpu_write(mod->refptr->incs, 1);
        return 0;
 }
@@ -1013,6 +1013,8 @@ static size_t module_flags_taint(struct module *mod, char *buf)
                buf[l++] = 'F';
        if (mod->taints & (1 << TAINT_CRAP))
                buf[l++] = 'C';
+        if (mod->taints & (1 << TAINT_UNSIGNED_MODULE))
+                buf[l++] = 'E';
        /*
         * TAINT_FORCED_RMMOD: could be added.
         * TAINT_CPU_OUT_OF_SPEC, TAINT_MACHINE_CHECK, TAINT_BAD_PAGE don't
@@ -3218,7 +3220,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
                pr_notice_once("%s: module verification failed: signature "
                               "and/or  required key missing - tainting "
                               "kernel\n", mod->name);
-                add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_STILL_OK);
+                add_taint_module(mod, TAINT_UNSIGNED_MODULE, LOCKDEP_STILL_OK);
        }
 #endif
@@ -3813,12 +3815,12 @@ void print_modules(void)
        list_for_each_entry_rcu(mod, &modules, list) {
                if (mod->state == MODULE_STATE_UNFORMED)
                        continue;
-                printk(" %s%s", mod->name, module_flags(mod, buf));
+                pr_cont(" %s%s", mod->name, module_flags(mod, buf));
        }
        preempt_enable();
        if (last_unloaded_module[0])
-                printk(" [last unloaded: %s]", last_unloaded_module);
+                pr_cont(" [last unloaded: %s]", last_unloaded_module);
-        printk("\n");
+        pr_cont("\n");
 }
 #ifdef CONFIG_MODVERSIONS
diff --git a/kernel/panic.c b/kernel/panic.c
index cca8a913ae7c..d02fa9fef46a 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -100,7 +100,7 @@ void panic(const char *fmt, ...)
        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);
-        printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
+        pr_emerg("Kernel panic - not syncing: %s\n", buf);
 #ifdef CONFIG_DEBUG_BUGVERBOSE
        /*
         * Avoid nested stack-dumping if a panic occurs during oops processing
@@ -141,7 +141,7 @@ void panic(const char *fmt, ...)
                 * Delay timeout seconds before rebooting the machine.
                 * We can't use the "normal" timers since we just panicked.
                 */
-                printk(KERN_EMERG "Rebooting in %d seconds..", panic_timeout);
+                pr_emerg("Rebooting in %d seconds..", panic_timeout);
                for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
                        touch_nmi_watchdog();
@@ -165,7 +165,7 @@ void panic(const char *fmt, ...)
                extern int stop_a_enabled;
                /* Make sure the user can actually press Stop-A (L1-A) */
                stop_a_enabled = 1;
-                printk(KERN_EMERG "Press Stop-A (L1-A) to return to the boot prom\n");
+                pr_emerg("Press Stop-A (L1-A) to return to the boot prom\n");
        }
 #endif
 #if defined(CONFIG_S390)
@@ -176,6 +176,7 @@ void panic(const char *fmt, ...)
                disabled_wait(caller);
        }
 #endif
+        pr_emerg("---[ end Kernel panic - not syncing: %s\n", buf);
        local_irq_enable();
        for (i = 0; ; i += PANIC_TIMER_STEP) {
                touch_softlockup_watchdog();
@@ -210,6 +211,7 @@ static const struct tnt tnts[] = {
        { TAINT_CRAP,                   'C', ' ' },
        { TAINT_FIRMWARE_WORKAROUND,    'I', ' ' },
        { TAINT_OOT_MODULE,             'O', ' ' },
+        { TAINT_UNSIGNED_MODULE,        'E', ' ' },
 };
 /**
@@ -228,6 +230,7 @@ static const struct tnt tnts[] = {
 *  'C' - modules from drivers/staging are loaded.
 *  'I' - Working around severe firmware bug.
 *  'O' - Out-of-tree module has been loaded.
+ *  'E' - Unsigned module has been loaded.
 *
 *      The string is overwritten by the next call to print_tainted().
 */
@@ -274,8 +277,7 @@ unsigned long get_taint(void)
 void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
 {
        if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
-                printk(KERN_WARNING
+                pr_warn("Disabling lock debugging due to kernel taint\n");
-                       "Disabling lock debugging due to kernel taint\n");
        set_bit(flag, &tainted_mask);
 }
@@ -380,8 +382,7 @@ late_initcall(init_oops_id);
 void print_oops_end_marker(void)
 {
        init_oops_id();
-        printk(KERN_WARNING "---[ end trace %016llx ]---\n",
+        pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id);
-                (unsigned long long)oops_id);
 }
 /*
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 06c62de9c711..db95d8eb761b 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -318,7 +318,9 @@ static void *pidns_get(struct task_struct *task)
        struct pid_namespace *ns;
        rcu_read_lock();
-        ns = get_pid_ns(task_active_pid_ns(task));
+        ns = task_active_pid_ns(task);
+        if (ns)
+                get_pid_ns(ns);
        rcu_read_unlock();
        return ns;
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 37170d4dd9a6..f4f2073711d3 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -973,16 +973,20 @@ static ssize_t resume_show(struct kobject *kobj, struct kobj_attribute *attr,
 static ssize_t resume_store(struct kobject *kobj, struct kobj_attribute *attr,
                            const char *buf, size_t n)
 {
-        unsigned int maj, min;
        dev_t res;
-        int ret = -EINVAL;
+        int len = n;
+        char *name;
-        if (sscanf(buf, "%u:%u", &maj, &min) != 2)
+        if (len && buf[len-1] == '\n')
-                goto out;
+                len--;
+        name = kstrndup(buf, len, GFP_KERNEL);
+        if (!name)
+                return -ENOMEM;
-        res = MKDEV(maj,min);
+        res = name_to_dev_t(name);
-        if (maj != MAJOR(res) || min != MINOR(res))
+        kfree(name);
-                goto out;
+        if (!res)
+                return -EINVAL;
        lock_system_sleep();
        swsusp_resume_device = res;
@@ -990,9 +994,7 @@ static ssize_t resume_store(struct kobject *kobj, struct kobj_attribute *attr,
        printk(KERN_INFO "PM: Starting manual resume from disk\n");
        noresume = 0;
        software_resume();
-        ret = n;
+        return n;
- out:
-        return ret;
 }
 power_attr(resume);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 1d1bf630e6e9..6271bc4073ef 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -282,8 +282,8 @@ struct kobject *power_kobj;
 *      state - control system power state.
 *
 *      show() returns what states are supported, which is hard-coded to
- *      'standby' (Power-On Suspend), 'mem' (Suspend-to-RAM), and
+ *      'freeze' (Low-Power Idle), 'standby' (Power-On Suspend),
- *      'disk' (Suspend-to-Disk).
+ *      'mem' (Suspend-to-RAM), and 'disk' (Suspend-to-Disk).
 *
 *      store() accepts one of those strings, translates it into the
 *      proper enumerated value, and initiates a suspend transition.
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 7d4b7ffb3c1d..15f37ea08719 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -2,6 +2,7 @@
 #include <linux/suspend_ioctls.h>
 #include <linux/utsname.h>
 #include <linux/freezer.h>
+#include <linux/compiler.h>
 struct swsusp_info {
        struct new_utsname      uts;
@@ -11,7 +12,7 @@ struct swsusp_info {
        unsigned long           image_pages;
        unsigned long           pages;
        unsigned long           size;
-} __attribute__((aligned(PAGE_SIZE)));
+} __aligned(PAGE_SIZE);
 #ifdef CONFIG_HIBERNATION
 /* kernel/power/snapshot.c */
@@ -49,6 +50,8 @@ static inline char *check_image_kernel(struct swsusp_info *info)
 */
 #define SPARE_PAGES     ((1024 * 1024) >> PAGE_SHIFT)
+asmlinkage int swsusp_save(void);
 /* kernel/power/hibernate.c */
 extern bool freezer_test_done;
diff --git a/kernel/power/qos.c b/kernel/power/qos.c
index 8dff9b48075a..884b77058864 100644
--- a/kernel/power/qos.c
+++ b/kernel/power/qos.c
@@ -66,6 +66,7 @@ static struct pm_qos_constraints cpu_dma_constraints = {
        .list = PLIST_HEAD_INIT(cpu_dma_constraints.list),
        .target_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
        .default_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
+        .no_constraint_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
        .type = PM_QOS_MIN,
        .notifiers = &cpu_dma_lat_notifier,
 };
@@ -79,6 +80,7 @@ static struct pm_qos_constraints network_lat_constraints = {
        .list = PLIST_HEAD_INIT(network_lat_constraints.list),
        .target_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
        .default_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
+        .no_constraint_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
        .type = PM_QOS_MIN,
        .notifiers = &network_lat_notifier,
 };
@@ -93,6 +95,7 @@ static struct pm_qos_constraints network_tput_constraints = {
        .list = PLIST_HEAD_INIT(network_tput_constraints.list),
        .target_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
        .default_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
+        .no_constraint_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
        .type = PM_QOS_MAX,
        .notifiers = &network_throughput_notifier,
 };
@@ -128,7 +131,7 @@ static const struct file_operations pm_qos_power_fops = {
 static inline int pm_qos_get_value(struct pm_qos_constraints *c)
 {
        if (plist_head_empty(&c->list))
-                return c->default_value;
+                return c->no_constraint_value;
        switch (c->type) {
        case PM_QOS_MIN:
@@ -170,6 +173,7 @@ int pm_qos_update_target(struct pm_qos_constraints *c, struct plist_node *node,
 {
        unsigned long flags;
        int prev_value, curr_value, new_value;
+        int ret;
        spin_lock_irqsave(&pm_qos_lock, flags);
        prev_value = pm_qos_get_value(c);
@@ -205,13 +209,15 @@ int pm_qos_update_target(struct pm_qos_constraints *c, struct plist_node *node,
        trace_pm_qos_update_target(action, prev_value, curr_value);
        if (prev_value != curr_value) {
-                blocking_notifier_call_chain(c->notifiers,
+                ret = 1;
-                                             (unsigned long)curr_value,
+                if (c->notifiers)
-                                             NULL);
+                        blocking_notifier_call_chain(c->notifiers,
-                return 1;
+                                                     (unsigned long)curr_value,
+                                                     NULL);
        } else {
-                return 0;
+                ret = 0;
        }
+        return ret;
 }
 /**
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index d9f61a145802..18fb7a2fb14b 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -27,6 +27,7 @@
 #include <linux/highmem.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/compiler.h>
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -155,7 +156,7 @@ static inline void free_image_page(void *addr, int clear_nosave_free)
 struct linked_page {
        struct linked_page *next;
        char data[LINKED_PAGE_DATA_SIZE];
-} __attribute__((packed));
+} __packed;
 static inline void
 free_list_of_pages(struct linked_page *list, int clear_page_nosave)
@@ -1268,7 +1269,7 @@ static void free_unnecessary_pages(void)
 * [number of saveable pages] - [number of pages that can be freed in theory]
 *
 * where the second term is the sum of (1) reclaimable slab pages, (2) active
- * and (3) inactive anonymouns pages, (4) active and (5) inactive file pages,
+ * and (3) inactive anonymous pages, (4) active and (5) inactive file pages,
 * minus mapped file pages.
 */
 static unsigned long minimum_image_size(unsigned long saveable)
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 62ee437b5c7e..c3ad9cafe930 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -26,6 +26,7 @@
 #include <linux/syscore_ops.h>
 #include <linux/ftrace.h>
 #include <trace/events/power.h>
+#include <linux/compiler.h>
 #include "power.h"
@@ -39,7 +40,7 @@ static const struct platform_suspend_ops *suspend_ops;
 static bool need_suspend_ops(suspend_state_t state)
 {
-        return !!(state > PM_SUSPEND_FREEZE);
+        return state > PM_SUSPEND_FREEZE;
 }
 static DECLARE_WAIT_QUEUE_HEAD(suspend_freeze_wait_head);
@@ -156,13 +157,13 @@ static int suspend_prepare(suspend_state_t state)
 }
 /* default implementation */
-void __attribute__ ((weak)) arch_suspend_disable_irqs(void)
+void __weak arch_suspend_disable_irqs(void)
 {
        local_irq_disable();
 }
 /* default implementation */
-void __attribute__ ((weak)) arch_suspend_enable_irqs(void)
+void __weak arch_suspend_enable_irqs(void)
 {
        local_irq_enable();
 }
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 7c33ed200410..8c9a4819f798 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -101,7 +101,7 @@ struct swsusp_header {
        unsigned int flags;     /* Flags to pass to the "boot" kernel */
        char    orig_sig[10];
        char    sig[10];
-} __attribute__((packed));
+} __packed;
 static struct swsusp_header *swsusp_header;
diff --git a/kernel/power/wakelock.c b/kernel/power/wakelock.c
index 8f50de394d22..019069c84ff6 100644
--- a/kernel/power/wakelock.c
+++ b/kernel/power/wakelock.c
@@ -18,6 +18,8 @@
 #include <linux/rbtree.h>
 #include <linux/slab.h>
+#include "power.h"
 static DEFINE_MUTEX(wakelocks_lock);
 struct wakelock {
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 4dae9cbe9259..a45b50962295 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -319,7 +319,7 @@ static void log_store(int facility, int level,
                else
                        free = log_first_idx - log_next_idx;
-                if (free > size + sizeof(struct printk_log))
+                if (free >= size + sizeof(struct printk_log))
                        break;
                /* drop old messages until we have enough contiuous space */
@@ -327,7 +327,7 @@ static void log_store(int facility, int level,
                log_first_seq++;
        }
-        if (log_next_idx + size + sizeof(struct printk_log) >= log_buf_len) {
+        if (log_next_idx + size + sizeof(struct printk_log) > log_buf_len) {
                /*
                 * This message + an additional empty header does not fit
                 * at the end of the buffer. Add an empty header with len == 0
@@ -351,7 +351,7 @@ static void log_store(int facility, int level,
        else
                msg->ts_nsec = local_clock();
        memset(log_dict(msg) + dict_len, 0, pad_len);
-        msg->len = sizeof(struct printk_log) + text_len + dict_len + pad_len;
+        msg->len = size;
        /* insert message */
        log_next_idx += msg->len;
@@ -1560,9 +1560,12 @@ asmlinkage int vprintk_emit(int facility, int level,
                                        level = kern_level - '0';
                        case 'd':       /* KERN_DEFAULT */
                                lflags |= LOG_PREFIX;
-                        case 'c':       /* KERN_CONT */
-                                break;
                        }
+                        /*
+                         * No need to check length here because vscnprintf
+                         * put '\0' at the end of the string. Only valid and
+                         * newly printed level is detected.
+                         */
                        text_len -= end_of_header - text;
                        text = (char *)end_of_header;
                }
@@ -1880,6 +1883,7 @@ void suspend_console(void)
        console_lock();
        console_suspended = 1;
        up(&console_sem);
+        mutex_release(&console_lock_dep_map, 1, _RET_IP_);
 }
 void resume_console(void)
@@ -1887,6 +1891,7 @@ void resume_console(void)
        if (!console_suspend_enabled)
                return;
        down(&console_sem);
+        mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);
        console_suspended = 0;
        console_unlock();
 }
diff --git a/kernel/profile.c b/kernel/profile.c
index ebdd9c1a86b4..cb980f0c731b 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -591,18 +591,28 @@ out_cleanup:
 int __ref create_proc_profile(void) /* false positive from hotcpu_notifier */
 {
        struct proc_dir_entry *entry;
+        int err = 0;
        if (!prof_on)
                return 0;
-        if (create_hash_tables())
-                return -ENOMEM;
+        cpu_notifier_register_begin();
+        if (create_hash_tables()) {
+                err = -ENOMEM;
+                goto out;
+        }
        entry = proc_create("profile", S_IWUSR | S_IRUGO,
                            NULL, &proc_profile_operations);
        if (!entry)
-                return 0;
+                goto out;
        proc_set_size(entry, (1 + prof_len) * sizeof(atomic_t));
-        hotcpu_notifier(profile_cpu_callback, 0);
+        __hotcpu_notifier(profile_cpu_callback, 0);
-        return 0;
+out:
+        cpu_notifier_register_done();
+        return err;
 }
-module_init(create_proc_profile);
+subsys_initcall(create_proc_profile);
 #endif /* CONFIG_PROC_FS */
diff --git a/kernel/relay.c b/kernel/relay.c
index 5001c9887db1..52d6a6f56261 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -227,7 +227,7 @@ static void relay_destroy_buf(struct rchan_buf *buf)
 *      relay_remove_buf - remove a channel buffer
 *      @kref: target kernel reference that contains the relay buffer
 *
- *      Removes the file from the fileystem, which also frees the
+ *      Removes the file from the filesystem, which also frees the
 *      rchan_buf_struct and the channel buffer.  Should only be called from
 *      kref_put().
 */
diff --git a/kernel/res_counter.c b/kernel/res_counter.c
index 4aa8a305aede..51dbac6a3633 100644
--- a/kernel/res_counter.c
+++ b/kernel/res_counter.c
@@ -22,8 +22,18 @@ void res_counter_init(struct res_counter *counter, struct res_counter *parent)
        counter->parent = parent;
 }
-int res_counter_charge_locked(struct res_counter *counter, unsigned long val,
+static u64 res_counter_uncharge_locked(struct res_counter *counter,
-                              bool force)
+                                       unsigned long val)
+{
+        if (WARN_ON(counter->usage < val))
+                val = counter->usage;
+        counter->usage -= val;
+        return counter->usage;
+}
+static int res_counter_charge_locked(struct res_counter *counter,
+                                     unsigned long val, bool force)
 {
        int ret = 0;
@@ -86,15 +96,6 @@ int res_counter_charge_nofail(struct res_counter *counter, unsigned long val,
        return __res_counter_charge(counter, val, limit_fail_at, true);
 }
-u64 res_counter_uncharge_locked(struct res_counter *counter, unsigned long val)
-{
-        if (WARN_ON(counter->usage < val))
-                val = counter->usage;
-        counter->usage -= val;
-        return counter->usage;
-}
 u64 res_counter_uncharge_until(struct res_counter *counter,
                               struct res_counter *top,
                               unsigned long val)
diff --git a/kernel/resource.c b/kernel/resource.c
index 3f285dce9347..8957d686e29b 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -432,11 +432,6 @@ static void resource_clip(struct resource *res, resource_size_t min,
                res->end = max;
 }
-static bool resource_contains(struct resource *res1, struct resource *res2)
-{
-        return res1->start <= res2->start && res1->end >= res2->end;
-}
 /*
 * Find empty slot in the resource tree with the given range and
 * alignment constraints
@@ -471,10 +466,11 @@ static int __find_resource(struct resource *root, struct resource *old,
                arch_remove_reservations(&tmp);
                /* Check for overflow after ALIGN() */
-                avail = *new;
                avail.start = ALIGN(tmp.start, constraint->align);
                avail.end = tmp.end;
+                avail.flags = new->flags & ~IORESOURCE_UNSET;
                if (avail.start >= tmp.start) {
+                        alloc.flags = avail.flags;
                        alloc.start = constraint->alignf(constraint->alignf_data, &avail,
                                        size, constraint->align);
                        alloc.end = alloc.start + size - 1;
@@ -515,7 +511,7 @@ static int find_resource(struct resource *root, struct resource *new,
 * @newsize: new size of the resource descriptor
 * @constraint: the size and alignment constraints to be met.
 */
-int reallocate_resource(struct resource *root, struct resource *old,
+static int reallocate_resource(struct resource *root, struct resource *old,
                        resource_size_t newsize,
                        struct resource_constraint  *constraint)
 {
@@ -949,8 +945,8 @@ struct resource * __request_region(struct resource *parent,
        res->name = name;
        res->start = start;
        res->end = start + n - 1;
-        res->flags = IORESOURCE_BUSY;
+        res->flags = resource_type(parent);
-        res->flags |= flags;
+        res->flags |= IORESOURCE_BUSY | flags;
        write_lock(&resource_lock);
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index b30a2924ef14..3ef6451e972e 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -60,13 +60,14 @@
 #include <linux/sched.h>
 #include <linux/static_key.h>
 #include <linux/workqueue.h>
+#include <linux/compiler.h>
 /*
 * Scheduler clock - returns current time in nanosec units.
 * This is default implementation.
 * Architectures and sub-architectures can override this.
 */
-unsigned long long __attribute__((weak)) sched_clock(void)
+unsigned long long __weak sched_clock(void)
 {
        return (unsigned long long)(jiffies - INITIAL_JIFFIES)
                                        * (NSEC_PER_SEC / HZ);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index a47902c687ae..268a45ea238c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -73,6 +73,7 @@
 #include <linux/init_task.h>
 #include <linux/binfmts.h>
 #include <linux/context_tracking.h>
+#include <linux/compiler.h>
 #include <asm/switch_to.h>
 #include <asm/tlb.h>
@@ -432,7 +433,7 @@ void hrtick_start(struct rq *rq, u64 delay)
        if (rq == this_rq()) {
                __hrtick_restart(rq);
        } else if (!rq->hrtick_csd_pending) {
-                __smp_call_function_single(cpu_of(rq), &rq->hrtick_csd, 0);
+                smp_call_function_single_async(cpu_of(rq), &rq->hrtick_csd);
                rq->hrtick_csd_pending = 1;
        }
 }
@@ -555,12 +556,15 @@ void resched_cpu(int cpu)
 * selecting an idle cpu will add more delays to the timers than intended
 * (as that cpu's timer base may not be uptodate wrt jiffies etc).
 */
-int get_nohz_timer_target(void)
+int get_nohz_timer_target(int pinned)
 {
        int cpu = smp_processor_id();
        int i;
        struct sched_domain *sd;
+        if (pinned || !get_sysctl_timer_migration() || !idle_cpu(cpu))
+                return cpu;
        rcu_read_lock();
        for_each_domain(cpu, sd) {
                for_each_cpu(i, sched_domain_span(sd)) {
@@ -823,19 +827,13 @@ static void update_rq_clock_task(struct rq *rq, s64 delta)
 #endif
 #ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
        if (static_key_false((&paravirt_steal_rq_enabled))) {
-                u64 st;
                steal = paravirt_steal_clock(cpu_of(rq));
                steal -= rq->prev_steal_time_rq;
                if (unlikely(steal > delta))
                        steal = delta;
-                st = steal_ticks(steal);
-                steal = st * TICK_NSEC;
                rq->prev_steal_time_rq += steal;
                delta -= steal;
        }
 #endif
@@ -2848,52 +2846,6 @@ int default_wake_function(wait_queue_t *curr, unsigned mode, int wake_flags,
 }
 EXPORT_SYMBOL(default_wake_function);
-static long __sched
-sleep_on_common(wait_queue_head_t *q, int state, long timeout)
-{
-        unsigned long flags;
-        wait_queue_t wait;
-        init_waitqueue_entry(&wait, current);
-        __set_current_state(state);
-        spin_lock_irqsave(&q->lock, flags);
-        __add_wait_queue(q, &wait);
-        spin_unlock(&q->lock);
-        timeout = schedule_timeout(timeout);
-        spin_lock_irq(&q->lock);
-        __remove_wait_queue(q, &wait);
-        spin_unlock_irqrestore(&q->lock, flags);
-        return timeout;
-}
-void __sched interruptible_sleep_on(wait_queue_head_t *q)
-{
-        sleep_on_common(q, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
-}
-EXPORT_SYMBOL(interruptible_sleep_on);
-long __sched
-interruptible_sleep_on_timeout(wait_queue_head_t *q, long timeout)
-{
-        return sleep_on_common(q, TASK_INTERRUPTIBLE, timeout);
-}
-EXPORT_SYMBOL(interruptible_sleep_on_timeout);
-void __sched sleep_on(wait_queue_head_t *q)
-{
-        sleep_on_common(q, TASK_UNINTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
-}
-EXPORT_SYMBOL(sleep_on);
-long __sched sleep_on_timeout(wait_queue_head_t *q, long timeout)
-{
-        return sleep_on_common(q, TASK_UNINTERRUPTIBLE, timeout);
-}
-EXPORT_SYMBOL(sleep_on_timeout);
 #ifdef CONFIG_RT_MUTEXES
 /*
@@ -6501,7 +6453,7 @@ static cpumask_var_t fallback_doms;
 * cpu core maps. It is supposed to return 1 if the topology changed
 * or 0 if it stayed the same.
 */
-int __attribute__((weak)) arch_update_cpu_topology(void)
+int __weak arch_update_cpu_topology(void)
 {
        return 0;
 }
@@ -7233,7 +7185,7 @@ void sched_move_task(struct task_struct *tsk)
        if (unlikely(running))
                tsk->sched_class->put_prev_task(rq, tsk);
-        tg = container_of(task_css_check(tsk, cpu_cgroup_subsys_id,
+        tg = container_of(task_css_check(tsk, cpu_cgrp_id,
                                lockdep_is_held(&tsk->sighand->siglock)),
                          struct task_group, css);
        tg = autogroup_task_group(tsk, tg);
@@ -7660,7 +7612,7 @@ static int cpu_cgroup_can_attach(struct cgroup_subsys_state *css,
 {
        struct task_struct *task;
-        cgroup_taskset_for_each(task, css, tset) {
+        cgroup_taskset_for_each(task, tset) {
 #ifdef CONFIG_RT_GROUP_SCHED
                if (!sched_rt_can_attach(css_tg(css), task))
                        return -EINVAL;
@@ -7678,7 +7630,7 @@ static void cpu_cgroup_attach(struct cgroup_subsys_state *css,
 {
        struct task_struct *task;
-        cgroup_taskset_for_each(task, css, tset)
+        cgroup_taskset_for_each(task, tset)
                sched_move_task(task);
 }
@@ -8017,8 +7969,7 @@ static struct cftype cpu_files[] = {
        { }     /* terminate */
 };
-struct cgroup_subsys cpu_cgroup_subsys = {
+struct cgroup_subsys cpu_cgrp_subsys = {
-        .name           = "cpu",
        .css_alloc      = cpu_cgroup_css_alloc,
        .css_free       = cpu_cgroup_css_free,
        .css_online     = cpu_cgroup_css_online,
@@ -8026,7 +7977,6 @@ struct cgroup_subsys cpu_cgroup_subsys = {
        .can_attach     = cpu_cgroup_can_attach,
        .attach         = cpu_cgroup_attach,
        .exit           = cpu_cgroup_exit,
-        .subsys_id      = cpu_cgroup_subsys_id,
        .base_cftypes   = cpu_files,
        .early_init     = 1,
 };
diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
index 622e0818f905..c143ee380e3a 100644
--- a/kernel/sched/cpuacct.c
+++ b/kernel/sched/cpuacct.c
@@ -41,7 +41,7 @@ static inline struct cpuacct *css_ca(struct cgroup_subsys_state *css)
 /* return cpu accounting group to which this task belongs */
 static inline struct cpuacct *task_ca(struct task_struct *tsk)
 {
-        return css_ca(task_css(tsk, cpuacct_subsys_id));
+        return css_ca(task_css(tsk, cpuacct_cgrp_id));
 }
 static inline struct cpuacct *parent_ca(struct cpuacct *ca)
@@ -275,11 +275,9 @@ void cpuacct_account_field(struct task_struct *p, int index, u64 val)
        rcu_read_unlock();
 }
-struct cgroup_subsys cpuacct_subsys = {
+struct cgroup_subsys cpuacct_cgrp_subsys = {
-        .name           = "cpuacct",
        .css_alloc      = cpuacct_css_alloc,
        .css_free       = cpuacct_css_free,
-        .subsys_id      = cpuacct_subsys_id,
        .base_cftypes   = files,
        .early_init     = 1,
 };
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index 58624a65f124..a95097cb4591 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -258,16 +258,22 @@ static __always_inline bool steal_account_process_tick(void)
 {
 #ifdef CONFIG_PARAVIRT
        if (static_key_false(&paravirt_steal_enabled)) {
-                u64 steal, st = 0;
+                u64 steal;
+                cputime_t steal_ct;
                steal = paravirt_steal_clock(smp_processor_id());
                steal -= this_rq()->prev_steal_time;
-                st = steal_ticks(steal);
+                /*
-                this_rq()->prev_steal_time += st * TICK_NSEC;
+                 * cputime_t may be less precise than nsecs (eg: if it's
+                 * based on jiffies). Lets cast the result to cputime
+                 * granularity and account the rest on the next rounds.
+                 */
+                steal_ct = nsecs_to_cputime(steal);
+                this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct);
-                account_steal_time(st);
+                account_steal_time(steal_ct);
-                return st;
+                return steal_ct;
        }
 #endif
        return false;
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index f3344c31632a..695f9773bb60 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -111,8 +111,7 @@ static char *task_group_path(struct task_group *tg)
        if (autogroup_path(tg, group_path, PATH_MAX))
                return group_path;
-        cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
+        return cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
-        return group_path;
 }
 #endif
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index b7976a127178..8f4390a079c7 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -63,6 +63,136 @@ void __weak arch_cpu_idle(void)
        local_irq_enable();
 }
+/**
+ * cpuidle_idle_call - the main idle function
+ *
+ * NOTE: no locks or semaphores should be used here
+ * return non-zero on failure
+ */
+static int cpuidle_idle_call(void)
+{
+        struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
+        struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
+        int next_state, entered_state, ret;
+        bool broadcast;
+        /*
+         * Check if the idle task must be rescheduled. If it is the
+         * case, exit the function after re-enabling the local irq and
+         * set again the polling flag
+         */
+        if (current_clr_polling_and_test()) {
+                local_irq_enable();
+                __current_set_polling();
+                return 0;
+        }
+        /*
+         * During the idle period, stop measuring the disabled irqs
+         * critical sections latencies
+         */
+        stop_critical_timings();
+        /*
+         * Tell the RCU framework we are entering an idle section,
+         * so no more rcu read side critical sections and one more
+         * step to the grace period
+         */
+        rcu_idle_enter();
+        /*
+         * Check if the cpuidle framework is ready, otherwise fallback
+         * to the default arch specific idle method
+         */
+        ret = cpuidle_enabled(drv, dev);
+        if (!ret) {
+                /*
+                 * Ask the governor to choose an idle state it thinks
+                 * it is convenient to go to. There is *always* a
+                 * convenient idle state
+                 */
+                next_state = cpuidle_select(drv, dev);
+                /*
+                 * The idle task must be scheduled, it is pointless to
+                 * go to idle, just update no idle residency and get
+                 * out of this function
+                 */
+                if (current_clr_polling_and_test()) {
+                        dev->last_residency = 0;
+                        entered_state = next_state;
+                        local_irq_enable();
+                } else {
+                        broadcast = !!(drv->states[next_state].flags &
+                                       CPUIDLE_FLAG_TIMER_STOP);
+                        if (broadcast)
+                                /*
+                                 * Tell the time framework to switch
+                                 * to a broadcast timer because our
+                                 * local timer will be shutdown. If a
+                                 * local timer is used from another
+                                 * cpu as a broadcast timer, this call
+                                 * may fail if it is not available
+                                 */
+                                ret = clockevents_notify(
+                                        CLOCK_EVT_NOTIFY_BROADCAST_ENTER,
+                                        &dev->cpu);
+                        if (!ret) {
+                                trace_cpu_idle_rcuidle(next_state, dev->cpu);
+                                /*
+                                 * Enter the idle state previously
+                                 * returned by the governor
+                                 * decision. This function will block
+                                 * until an interrupt occurs and will
+                                 * take care of re-enabling the local
+                                 * interrupts
+                                 */
+                                entered_state = cpuidle_enter(drv, dev,
+                                                              next_state);
+                                trace_cpu_idle_rcuidle(PWR_EVENT_EXIT,
+                                                       dev->cpu);
+                                if (broadcast)
+                                        clockevents_notify(
+                                                CLOCK_EVT_NOTIFY_BROADCAST_EXIT,
+                                                &dev->cpu);
+                                /*
+                                 * Give the governor an opportunity to reflect on the
+                                 * outcome
+                                 */
+                                cpuidle_reflect(dev, entered_state);
+                        }
+                }
+        }
+        /*
+         * We can't use the cpuidle framework, let's use the default
+         * idle routine
+         */
+        if (ret)
+                arch_cpu_idle();
+        __current_set_polling();
+        /*
+         * It is up to the idle functions to enable back the local
+         * interrupt
+         */
+        if (WARN_ON_ONCE(irqs_disabled()))
+                local_irq_enable();
+        rcu_idle_exit();
+        start_critical_timings();
+        return 0;
+}
 /*
 * Generic idle loop implementation
 */
@@ -90,23 +220,11 @@ static void cpu_idle_loop(void)
                         * know that the IPI is going to arrive right
                         * away
                         */
-                        if (cpu_idle_force_poll || tick_check_broadcast_expired()) {
+                        if (cpu_idle_force_poll || tick_check_broadcast_expired())
                                cpu_idle_poll();
-                        } else {
+                        else
-                                if (!current_clr_polling_and_test()) {
+                                cpuidle_idle_call();
-                                        stop_critical_timings();
-                                        rcu_idle_enter();
-                                        if (cpuidle_idle_call())
-                                                arch_cpu_idle();
-                                        if (WARN_ON_ONCE(irqs_disabled()))
-                                                local_irq_enable();
-                                        rcu_idle_exit();
-                                        start_critical_timings();
-                                } else {
-                                        local_irq_enable();
-                                }
-                                __current_set_polling();
-                        }
                        arch_cpu_idle_exit();
                }
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index f2de7a175620..c9007f28d3a2 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1216,16 +1216,6 @@ extern void update_idle_cpu_load(struct rq *this_rq);
 extern void init_task_runnable_average(struct task_struct *p);
-#ifdef CONFIG_PARAVIRT
-static inline u64 steal_ticks(u64 steal)
-{
-        if (unlikely(steal > NSEC_PER_SEC))
-                return div_u64(steal, TICK_NSEC);
-        return __iter_div_u64_rem(steal, TICK_NSEC, &steal);
-}
-#endif
 static inline void inc_nr_running(struct rq *rq)
 {
        rq->nr_running++;
diff --git a/kernel/sched/stats.c b/kernel/sched/stats.c
index da98af347e8b..a476bea17fbc 100644
--- a/kernel/sched/stats.c
+++ b/kernel/sched/stats.c
@@ -142,4 +142,4 @@ static int __init proc_schedstat_init(void)
        proc_create("schedstat", 0, NULL, &proc_schedstat_operations);
        return 0;
 }
-module_init(proc_schedstat_init);
+subsys_initcall(proc_schedstat_init);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index b7a10048a32c..fd609bd9d6dd 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -55,60 +55,33 @@ struct seccomp_filter {
        atomic_t usage;
        struct seccomp_filter *prev;
        unsigned short len;  /* Instruction count */
-        struct sock_filter insns[];
+        struct sock_filter_int insnsi[];
 };
 /* Limit any path through the tree to 256KB worth of instructions. */
 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
-/**
+/*
- * get_u32 - returns a u32 offset into data
- * @data: a unsigned 64 bit value
- * @index: 0 or 1 to return the first or second 32-bits
- *
- * This inline exists to hide the length of unsigned long.  If a 32-bit
- * unsigned long is passed in, it will be extended and the top 32-bits will be
- * 0. If it is a 64-bit unsigned long, then whatever data is resident will be
- * properly returned.
- *
 * Endianness is explicitly ignored and left for BPF program authors to manage
 * as per the specific architecture.
 */
-static inline u32 get_u32(u64 data, int index)
+static void populate_seccomp_data(struct seccomp_data *sd)
 {
-        return ((u32 *)&data)[index];
+        struct task_struct *task = current;
-}
+        struct pt_regs *regs = task_pt_regs(task);
-/* Helper for bpf_load below. */
+        sd->nr = syscall_get_nr(task, regs);
-#define BPF_DATA(_name) offsetof(struct seccomp_data, _name)
+        sd->arch = syscall_get_arch(task, regs);
-/**
- * bpf_load: checks and returns a pointer to the requested offset
+        /* Unroll syscall_get_args to help gcc on arm. */
- * @off: offset into struct seccomp_data to load from
+        syscall_get_arguments(task, regs, 0, 1, (unsigned long *) &sd->args[0]);
- *
+        syscall_get_arguments(task, regs, 1, 1, (unsigned long *) &sd->args[1]);
- * Returns the requested 32-bits of data.
+        syscall_get_arguments(task, regs, 2, 1, (unsigned long *) &sd->args[2]);
- * seccomp_check_filter() should assure that @off is 32-bit aligned
+        syscall_get_arguments(task, regs, 3, 1, (unsigned long *) &sd->args[3]);
- * and not out of bounds.  Failure to do so is a BUG.
+        syscall_get_arguments(task, regs, 4, 1, (unsigned long *) &sd->args[4]);
- */
+        syscall_get_arguments(task, regs, 5, 1, (unsigned long *) &sd->args[5]);
-u32 seccomp_bpf_load(int off)
-{
+        sd->instruction_pointer = KSTK_EIP(task);
-        struct pt_regs *regs = task_pt_regs(current);
-        if (off == BPF_DATA(nr))
-                return syscall_get_nr(current, regs);
-        if (off == BPF_DATA(arch))
-                return syscall_get_arch(current, regs);
-        if (off >= BPF_DATA(args[0]) && off < BPF_DATA(args[6])) {
-                unsigned long value;
-                int arg = (off - BPF_DATA(args[0])) / sizeof(u64);
-                int index = !!(off % sizeof(u64));
-                syscall_get_arguments(current, regs, arg, 1, &value);
-                return get_u32(value, index);
-        }
-        if (off == BPF_DATA(instruction_pointer))
-                return get_u32(KSTK_EIP(current), 0);
-        if (off == BPF_DATA(instruction_pointer) + sizeof(u32))
-                return get_u32(KSTK_EIP(current), 1);
-        /* seccomp_check_filter should make this impossible. */
-        BUG();
 }
 /**
@@ -133,17 +106,17 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
                switch (code) {
                case BPF_S_LD_W_ABS:
-                        ftest->code = BPF_S_ANC_SECCOMP_LD_W;
+                        ftest->code = BPF_LDX | BPF_W | BPF_ABS;
                        /* 32-bit aligned and not out of bounds. */
                        if (k >= sizeof(struct seccomp_data) || k & 3)
                                return -EINVAL;
                        continue;
                case BPF_S_LD_W_LEN:
-                        ftest->code = BPF_S_LD_IMM;
+                        ftest->code = BPF_LD | BPF_IMM;
                        ftest->k = sizeof(struct seccomp_data);
                        continue;
                case BPF_S_LDX_W_LEN:
-                        ftest->code = BPF_S_LDX_IMM;
+                        ftest->code = BPF_LDX | BPF_IMM;
                        ftest->k = sizeof(struct seccomp_data);
                        continue;
                /* Explicitly include allowed calls. */
@@ -185,6 +158,7 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
                case BPF_S_JMP_JGT_X:
                case BPF_S_JMP_JSET_K:
                case BPF_S_JMP_JSET_X:
+                        sk_decode_filter(ftest, ftest);
                        continue;
                default:
                        return -EINVAL;
@@ -202,18 +176,21 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 static u32 seccomp_run_filters(int syscall)
 {
        struct seccomp_filter *f;
+        struct seccomp_data sd;
        u32 ret = SECCOMP_RET_ALLOW;
        /* Ensure unexpected behavior doesn't result in failing open. */
        if (WARN_ON(current->seccomp.filter == NULL))
                return SECCOMP_RET_KILL;
+        populate_seccomp_data(&sd);
        /*
         * All filters in the list are evaluated and the lowest BPF return
         * value always takes priority (ignoring the DATA).
         */
        for (f = current->seccomp.filter; f; f = f->prev) {
-                u32 cur_ret = sk_run_filter(NULL, f->insns);
+                u32 cur_ret = sk_run_filter_int_seccomp(&sd, f->insnsi);
                if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
                        ret = cur_ret;
        }
@@ -231,6 +208,8 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
        struct seccomp_filter *filter;
        unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
        unsigned long total_insns = fprog->len;
+        struct sock_filter *fp;
+        int new_len;
        long ret;
        if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
@@ -252,28 +231,43 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
                                     CAP_SYS_ADMIN) != 0)
                return -EACCES;
-        /* Allocate a new seccomp_filter */
+        fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
-        filter = kzalloc(sizeof(struct seccomp_filter) + fp_size,
+        if (!fp)
-                         GFP_KERNEL|__GFP_NOWARN);
-        if (!filter)
                return -ENOMEM;
-        atomic_set(&filter->usage, 1);
-        filter->len = fprog->len;
        /* Copy the instructions from fprog. */
        ret = -EFAULT;
-        if (copy_from_user(filter->insns, fprog->filter, fp_size))
+        if (copy_from_user(fp, fprog->filter, fp_size))
-                goto fail;
+                goto free_prog;
        /* Check and rewrite the fprog via the skb checker */
-        ret = sk_chk_filter(filter->insns, filter->len);
+        ret = sk_chk_filter(fp, fprog->len);
        if (ret)
-                goto fail;
+                goto free_prog;
        /* Check and rewrite the fprog for seccomp use */
-        ret = seccomp_check_filter(filter->insns, filter->len);
+        ret = seccomp_check_filter(fp, fprog->len);
+        if (ret)
+                goto free_prog;
+        /* Convert 'sock_filter' insns to 'sock_filter_int' insns */
+        ret = sk_convert_filter(fp, fprog->len, NULL, &new_len);
+        if (ret)
+                goto free_prog;
+        /* Allocate a new seccomp_filter */
+        filter = kzalloc(sizeof(struct seccomp_filter) +
+                         sizeof(struct sock_filter_int) * new_len,
+                         GFP_KERNEL|__GFP_NOWARN);
+        if (!filter)
+                goto free_prog;
+        ret = sk_convert_filter(fp, fprog->len, filter->insnsi, &new_len);
        if (ret)
-                goto fail;
+                goto free_filter;
+        atomic_set(&filter->usage, 1);
+        filter->len = new_len;
        /*
         * If there is an existing filter, make it the prev and don't drop its
@@ -282,8 +276,11 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
        filter->prev = current->seccomp.filter;
        current->seccomp.filter = filter;
        return 0;
-fail:
+free_filter:
        kfree(filter);
+free_prog:
+        kfree(fp);
        return ret;
 }
@@ -293,7 +290,7 @@ fail:
 *
 * Returns 0 on success and non-zero otherwise.
 */
-long seccomp_attach_user_filter(char __user *user_filter)
+static long seccomp_attach_user_filter(char __user *user_filter)
 {
        struct sock_fprog fprog;
        long ret = -EFAULT;
diff --git a/kernel/signal.c b/kernel/signal.c
index 52f881db1ca0..6ea13c09ae56 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -33,6 +33,8 @@
 #include <linux/uprobes.h>
 #include <linux/compat.h>
 #include <linux/cn_proc.h>
+#include <linux/compiler.h>
 #define CREATE_TRACE_POINTS
 #include <trace/events/signal.h>
@@ -2382,7 +2384,7 @@ relock:
 * @regs:               user register state
 * @stepping:           nonzero if debugger single-step or block-step in use
 *
- * This function should be called when a signal has succesfully been
+ * This function should be called when a signal has successfully been
 * delivered. It updates the blocked signals accordingly (@ka->sa.sa_mask
 * is always blocked, and the signal itself is blocked unless %SA_NODEFER
 * is set in @ka->sa.sa_flags.  Tracing is notified.
@@ -3618,7 +3620,7 @@ SYSCALL_DEFINE3(sigsuspend, int, unused1, int, unused2, old_sigset_t, mask)
 }
 #endif
-__attribute__((weak)) const char *arch_vma_name(struct vm_area_struct *vma)
+__weak const char *arch_vma_name(struct vm_area_struct *vma)
 {
        return NULL;
 }
diff --git a/kernel/smp.c b/kernel/smp.c
index ffee35bef179..06d574e42c72 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -117,13 +117,43 @@ static void csd_unlock(struct call_single_data *csd)
        csd->flags &= ~CSD_FLAG_LOCK;
 }
+static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_single_data, csd_data);
 /*
 * Insert a previously allocated call_single_data element
 * for execution on the given CPU. data must already have
 * ->func, ->info, and ->flags set.
 */
-static void generic_exec_single(int cpu, struct call_single_data *csd, int wait)
+static int generic_exec_single(int cpu, struct call_single_data *csd,
+                               smp_call_func_t func, void *info, int wait)
 {
+        struct call_single_data csd_stack = { .flags = 0 };
+        unsigned long flags;
+        if (cpu == smp_processor_id()) {
+                local_irq_save(flags);
+                func(info);
+                local_irq_restore(flags);
+                return 0;
+        }
+        if ((unsigned)cpu >= nr_cpu_ids || !cpu_online(cpu))
+                return -ENXIO;
+        if (!csd) {
+                csd = &csd_stack;
+                if (!wait)
+                        csd = &__get_cpu_var(csd_data);
+        }
+        csd_lock(csd);
+        csd->func = func;
+        csd->info = info;
        if (wait)
                csd->flags |= CSD_FLAG_WAIT;
@@ -143,6 +173,8 @@ static void generic_exec_single(int cpu, struct call_single_data *csd, int wait)
        if (wait)
                csd_lock_wait(csd);
+        return 0;
 }
 /*
@@ -151,7 +183,8 @@ static void generic_exec_single(int cpu, struct call_single_data *csd, int wait)
 */
 void generic_smp_call_function_single_interrupt(void)
 {
-        struct llist_node *entry, *next;
+        struct llist_node *entry;
+        struct call_single_data *csd, *csd_next;
        /*
         * Shouldn't receive this interrupt on a cpu that is not yet online.
@@ -161,21 +194,12 @@ void generic_smp_call_function_single_interrupt(void)
        entry = llist_del_all(&__get_cpu_var(call_single_queue));
        entry = llist_reverse_order(entry);
-        while (entry) {
+        llist_for_each_entry_safe(csd, csd_next, entry, llist) {
-                struct call_single_data *csd;
-                next = entry->next;
-                csd = llist_entry(entry, struct call_single_data, llist);
                csd->func(csd->info);
                csd_unlock(csd);
-                entry = next;
        }
 }
-static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_single_data, csd_data);
 /*
 * smp_call_function_single - Run a function on a specific CPU
 * @func: The function to run. This must be fast and non-blocking.
@@ -187,12 +211,8 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_single_data, csd_data);
 int smp_call_function_single(int cpu, smp_call_func_t func, void *info,
                             int wait)
 {
-        struct call_single_data d = {
-                .flags = 0,
-        };
-        unsigned long flags;
        int this_cpu;
-        int err = 0;
+        int err;
        /*
         * prevent preemption and reschedule on another processor,
@@ -209,32 +229,41 @@ int smp_call_function_single(int cpu, smp_call_func_t func, void *info,
        WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled()
                     && !oops_in_progress);
-        if (cpu == this_cpu) {
+        err = generic_exec_single(cpu, NULL, func, info, wait);
-                local_irq_save(flags);
-                func(info);
-                local_irq_restore(flags);
-        } else {
-                if ((unsigned)cpu < nr_cpu_ids && cpu_online(cpu)) {
-                        struct call_single_data *csd = &d;
-                        if (!wait)
+        put_cpu();
-                                csd = &__get_cpu_var(csd_data);
-                        csd_lock(csd);
+        return err;
+}
+EXPORT_SYMBOL(smp_call_function_single);
-                        csd->func = func;
+/**
-                        csd->info = info;
+ * smp_call_function_single_async(): Run an asynchronous function on a
-                        generic_exec_single(cpu, csd, wait);
+ *                               specific CPU.
-                } else {
+ * @cpu: The CPU to run on.
-                        err = -ENXIO;   /* CPU not online */
+ * @csd: Pre-allocated and setup data structure
-                }
+ *
-        }
+ * Like smp_call_function_single(), but the call is asynchonous and
+ * can thus be done from contexts with disabled interrupts.
+ *
+ * The caller passes his own pre-allocated data structure
+ * (ie: embedded in an object) and is responsible for synchronizing it
+ * such that the IPIs performed on the @csd are strictly serialized.
+ *
+ * NOTE: Be careful, there is unfortunately no current debugging facility to
+ * validate the correctness of this serialization.
+ */
+int smp_call_function_single_async(int cpu, struct call_single_data *csd)
+{
+        int err = 0;
-        put_cpu();
+        preempt_disable();
+        err = generic_exec_single(cpu, csd, csd->func, csd->info, 0);
+        preempt_enable();
        return err;
 }
-EXPORT_SYMBOL(smp_call_function_single);
+EXPORT_SYMBOL_GPL(smp_call_function_single_async);
 /*
 * smp_call_function_any - Run a function on any of the given cpus
@@ -280,44 +309,6 @@ call:
 EXPORT_SYMBOL_GPL(smp_call_function_any);
 /**
- * __smp_call_function_single(): Run a function on a specific CPU
- * @cpu: The CPU to run on.
- * @data: Pre-allocated and setup data structure
- * @wait: If true, wait until function has completed on specified CPU.
- *
- * Like smp_call_function_single(), but allow caller to pass in a
- * pre-allocated data structure. Useful for embedding @data inside
- * other structures, for instance.
- */
-void __smp_call_function_single(int cpu, struct call_single_data *csd,
-                                int wait)
-{
-        unsigned int this_cpu;
-        unsigned long flags;
-        this_cpu = get_cpu();
-        /*
-         * Can deadlock when called with interrupts disabled.
-         * We allow cpu's that are not yet online though, as no one else can
-         * send smp call function interrupt to this cpu and as such deadlocks
-         * can't happen.
-         */
-        WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
-                     && !oops_in_progress);
-        if (cpu == this_cpu) {
-                local_irq_save(flags);
-                csd->func(csd->info);
-                local_irq_restore(flags);
-        } else {
-                csd_lock(csd);
-                generic_exec_single(cpu, csd, wait);
-        }
-        put_cpu();
-}
-EXPORT_SYMBOL_GPL(__smp_call_function_single);
-/**
 * smp_call_function_many(): Run a function on a set of other CPUs.
 * @mask: The set of cpus to run on (only runs on online subset).
 * @func: The function to run. This must be fast and non-blocking.
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 490fcbb1dc5b..b50990a5bea0 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -25,6 +25,7 @@
 #include <linux/smp.h>
 #include <linux/smpboot.h>
 #include <linux/tick.h>
+#include <linux/irq.h>
 #define CREATE_TRACE_POINTS
 #include <trace/events/irq.h>
diff --git a/kernel/sys.c b/kernel/sys.c
index adaeab6f7a87..fba0f29401ea 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1996,6 +1996,21 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                if (arg2 || arg3 || arg4 || arg5)
                        return -EINVAL;
                return current->no_new_privs ? 1 : 0;
+        case PR_GET_THP_DISABLE:
+                if (arg2 || arg3 || arg4 || arg5)
+                        return -EINVAL;
+                error = !!(me->mm->def_flags & VM_NOHUGEPAGE);
+                break;
+        case PR_SET_THP_DISABLE:
+                if (arg3 || arg4 || arg5)
+                        return -EINVAL;
+                down_write(&me->mm->mmap_sem);
+                if (arg2)
+                        me->mm->def_flags |= VM_NOHUGEPAGE;
+                else
+                        me->mm->def_flags &= ~VM_NOHUGEPAGE;
+                up_write(&me->mm->mmap_sem);
+                break;
        default:
                error = -EINVAL;
                break;
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 7078052284fd..bc8d1b74a6b9 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -146,11 +146,13 @@ cond_syscall(sys_io_destroy);
 cond_syscall(sys_io_submit);
 cond_syscall(sys_io_cancel);
 cond_syscall(sys_io_getevents);
+cond_syscall(sys_sysfs);
 cond_syscall(sys_syslog);
 cond_syscall(sys_process_vm_readv);
 cond_syscall(sys_process_vm_writev);
 cond_syscall(compat_sys_process_vm_readv);
 cond_syscall(compat_sys_process_vm_writev);
+cond_syscall(sys_uselib);
 /* arch-specific weak syscall entries */
 cond_syscall(sys_pciconfig_read);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 7754ff16f334..74f5b580fe34 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -112,9 +112,6 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
 #ifndef CONFIG_MMU
 extern int sysctl_nr_trim_pages;
 #endif
-#ifdef CONFIG_BLOCK
-extern int blk_iopoll_enabled;
-#endif
 /* Constants used for minimum and  maximum */
 #ifdef CONFIG_LOCKUP_DETECTOR
@@ -126,7 +123,7 @@ static int __maybe_unused neg_one = -1;
 static int zero;
 static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
-static int __maybe_unused three = 3;
+static int __maybe_unused four = 4;
 static unsigned long one_ul = 1;
 static int one_hundred = 100;
 #ifdef CONFIG_PRINTK
@@ -144,6 +141,11 @@ static int min_percpu_pagelist_fract = 8;
 static int ngroups_max = NGROUPS_MAX;
 static const int cap_last_cap = CAP_LAST_CAP;
+/*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */
+#ifdef CONFIG_DETECT_HUNG_TASK
+static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
+#endif
 #ifdef CONFIG_INOTIFY_USER
 #include <linux/inotify.h>
 #endif
@@ -988,6 +990,7 @@ static struct ctl_table kern_table[] = {
                .maxlen         = sizeof(unsigned long),
                .mode           = 0644,
                .proc_handler   = proc_dohung_task_timeout_secs,
+                .extra2         = &hung_task_timeout_max,
        },
        {
                .procname       = "hung_task_warnings",
@@ -1087,15 +1090,6 @@ static struct ctl_table kern_table[] = {
                .proc_handler   = proc_dointvec,
        },
 #endif
-#ifdef CONFIG_BLOCK
-        {
-                .procname       = "blk_iopoll",
-                .data           = &blk_iopoll_enabled,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-#endif
        { }
 };
@@ -1276,7 +1270,7 @@ static struct ctl_table vm_table[] = {
                .mode           = 0644,
                .proc_handler   = drop_caches_sysctl_handler,
                .extra1         = &one,
-                .extra2         = &three,
+                .extra2         = &four,
        },
 #ifdef CONFIG_COMPACTION
        {
diff --git a/kernel/time/Kconfig b/kernel/time/Kconfig
index 3ce6e8c5f3fc..f448513a45ed 100644
--- a/kernel/time/Kconfig
+++ b/kernel/time/Kconfig
@@ -124,7 +124,7 @@ config NO_HZ_FULL
 endchoice
 config NO_HZ_FULL_ALL
-       bool "Full dynticks system on all CPUs by default"
+       bool "Full dynticks system on all CPUs by default (except CPU 0)"
       depends on NO_HZ_FULL
       help
         If the user doesn't pass the nohz_full boot option to
diff --git a/kernel/time/Makefile b/kernel/time/Makefile
index 9250130646f5..57a413fd0ebf 100644
--- a/kernel/time/Makefile
+++ b/kernel/time/Makefile
@@ -3,7 +3,10 @@ obj-y += timeconv.o posix-clock.o alarmtimer.o
 obj-$(CONFIG_GENERIC_CLOCKEVENTS_BUILD)         += clockevents.o
 obj-$(CONFIG_GENERIC_CLOCKEVENTS)               += tick-common.o
-obj-$(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST)     += tick-broadcast.o
+ifeq ($(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST),y)
+ obj-y                                          += tick-broadcast.o
+ obj-$(CONFIG_TICK_ONESHOT)                     += tick-broadcast-hrtimer.o
+endif
 obj-$(CONFIG_GENERIC_SCHED_CLOCK)               += sched_clock.o
 obj-$(CONFIG_TICK_ONESHOT)                      += tick-oneshot.o
 obj-$(CONFIG_TICK_ONESHOT)                      += tick-sched.o
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 086ad6043bcb..ad362c260ef4 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -439,6 +439,19 @@ void clockevents_config_and_register(struct clock_event_device *dev,
 }
 EXPORT_SYMBOL_GPL(clockevents_config_and_register);
+int __clockevents_update_freq(struct clock_event_device *dev, u32 freq)
+{
+        clockevents_config(dev, freq);
+        if (dev->mode == CLOCK_EVT_MODE_ONESHOT)
+                return clockevents_program_event(dev, dev->next_event, false);
+        if (dev->mode == CLOCK_EVT_MODE_PERIODIC)
+                dev->set_mode(CLOCK_EVT_MODE_PERIODIC, dev);
+        return 0;
+}
 /**
 * clockevents_update_freq - Update frequency and reprogram a clock event device.
 * @dev:        device to modify
@@ -446,17 +459,22 @@ EXPORT_SYMBOL_GPL(clockevents_config_and_register);
 *
 * Reconfigure and reprogram a clock event device in oneshot
 * mode. Must be called on the cpu for which the device delivers per
- * cpu timer events with interrupts disabled!  Returns 0 on success,
+ * cpu timer events. If called for the broadcast device the core takes
- * -ETIME when the event is in the past.
+ * care of serialization.
+ *
+ * Returns 0 on success, -ETIME when the event is in the past.
 */
 int clockevents_update_freq(struct clock_event_device *dev, u32 freq)
 {
-        clockevents_config(dev, freq);
+        unsigned long flags;
+        int ret;
-        if (dev->mode != CLOCK_EVT_MODE_ONESHOT)
-                return 0;
-        return clockevents_program_event(dev, dev->next_event, false);
+        local_irq_save(flags);
+        ret = tick_broadcast_update_freq(dev, freq);
+        if (ret == -ENODEV)
+                ret = __clockevents_update_freq(dev, freq);
+        local_irq_restore(flags);
+        return ret;
 }
 /*
@@ -524,12 +542,13 @@ void clockevents_resume(void)
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
 /**
 * clockevents_notify - notification about relevant events
+ * Returns 0 on success, any other value on error
 */
-void clockevents_notify(unsigned long reason, void *arg)
+int clockevents_notify(unsigned long reason, void *arg)
 {
        struct clock_event_device *dev, *tmp;
        unsigned long flags;
-        int cpu;
+        int cpu, ret = 0;
        raw_spin_lock_irqsave(&clockevents_lock, flags);
@@ -542,7 +561,7 @@ void clockevents_notify(unsigned long reason, void *arg)
        case CLOCK_EVT_NOTIFY_BROADCAST_ENTER:
        case CLOCK_EVT_NOTIFY_BROADCAST_EXIT:
-                tick_broadcast_oneshot_control(reason);
+                ret = tick_broadcast_oneshot_control(reason);
                break;
        case CLOCK_EVT_NOTIFY_CPU_DYING:
@@ -585,6 +604,7 @@ void clockevents_notify(unsigned long reason, void *arg)
                break;
        }
        raw_spin_unlock_irqrestore(&clockevents_lock, flags);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(clockevents_notify);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index af8d1d4f3d55..419a52cecd20 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -514,12 +514,13 @@ static void sync_cmos_clock(struct work_struct *work)
                next.tv_sec++;
                next.tv_nsec -= NSEC_PER_SEC;
        }
-        schedule_delayed_work(&sync_cmos_work, timespec_to_jiffies(&next));
+        queue_delayed_work(system_power_efficient_wq,
+                           &sync_cmos_work, timespec_to_jiffies(&next));
 }
 void ntp_notify_cmos_timer(void)
 {
-        schedule_delayed_work(&sync_cmos_work, 0);
+        queue_delayed_work(system_power_efficient_wq, &sync_cmos_work, 0);
 }
 #else
diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c
new file mode 100644
index 000000000000..eb682d5c697c
--- /dev/null
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -0,0 +1,106 @@
+/*
+ * linux/kernel/time/tick-broadcast-hrtimer.c
+ * This file emulates a local clock event device
+ * via a pseudo clock device.
+ */
+#include <linux/cpu.h>
+#include <linux/err.h>
+#include <linux/hrtimer.h>
+#include <linux/interrupt.h>
+#include <linux/percpu.h>
+#include <linux/profile.h>
+#include <linux/clockchips.h>
+#include <linux/sched.h>
+#include <linux/smp.h>
+#include <linux/module.h>
+#include "tick-internal.h"
+static struct hrtimer bctimer;
+static void bc_set_mode(enum clock_event_mode mode,
+                        struct clock_event_device *bc)
+{
+        switch (mode) {
+        case CLOCK_EVT_MODE_SHUTDOWN:
+                /*
+                 * Note, we cannot cancel the timer here as we might
+                 * run into the following live lock scenario:
+                 *
+                 * cpu 0                cpu1
+                 * lock(broadcast_lock);
+                 *                      hrtimer_interrupt()
+                 *                      bc_handler()
+                 *                         tick_handle_oneshot_broadcast();
+                 *                          lock(broadcast_lock);
+                 * hrtimer_cancel()
+                 *  wait_for_callback()
+                 */
+                hrtimer_try_to_cancel(&bctimer);
+                break;
+        default:
+                break;
+        }
+}
+/*
+ * This is called from the guts of the broadcast code when the cpu
+ * which is about to enter idle has the earliest broadcast timer event.
+ */
+static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
+{
+        /*
+         * We try to cancel the timer first. If the callback is on
+         * flight on some other cpu then we let it handle it. If we
+         * were able to cancel the timer nothing can rearm it as we
+         * own broadcast_lock.
+         *
+         * However we can also be called from the event handler of
+         * ce_broadcast_hrtimer itself when it expires. We cannot
+         * restart the timer because we are in the callback, but we
+         * can set the expiry time and let the callback return
+         * HRTIMER_RESTART.
+         */
+        if (hrtimer_try_to_cancel(&bctimer) >= 0) {
+                hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
+                /* Bind the "device" to the cpu */
+                bc->bound_on = smp_processor_id();
+        } else if (bc->bound_on == smp_processor_id()) {
+                hrtimer_set_expires(&bctimer, expires);
+        }
+        return 0;
+}
+static struct clock_event_device ce_broadcast_hrtimer = {
+        .set_mode               = bc_set_mode,
+        .set_next_ktime         = bc_set_next,
+        .features               = CLOCK_EVT_FEAT_ONESHOT |
+                                  CLOCK_EVT_FEAT_KTIME |
+                                  CLOCK_EVT_FEAT_HRTIMER,
+        .rating                 = 0,
+        .bound_on               = -1,
+        .min_delta_ns           = 1,
+        .max_delta_ns           = KTIME_MAX,
+        .min_delta_ticks        = 1,
+        .max_delta_ticks        = ULONG_MAX,
+        .mult                   = 1,
+        .shift                  = 0,
+        .cpumask                = cpu_all_mask,
+};
+static enum hrtimer_restart bc_handler(struct hrtimer *t)
+{
+        ce_broadcast_hrtimer.event_handler(&ce_broadcast_hrtimer);
+        if (ce_broadcast_hrtimer.next_event.tv64 == KTIME_MAX)
+                return HRTIMER_NORESTART;
+        return HRTIMER_RESTART;
+}
+void tick_setup_hrtimer_broadcast(void)
+{
+        hrtimer_init(&bctimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        bctimer.function = bc_handler;
+        clockevents_register_device(&ce_broadcast_hrtimer);
+}
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 98977a57ac72..64c5990fd500 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -120,6 +120,19 @@ int tick_is_broadcast_device(struct clock_event_device *dev)
        return (dev && tick_broadcast_device.evtdev == dev);
 }
+int tick_broadcast_update_freq(struct clock_event_device *dev, u32 freq)
+{
+        int ret = -ENODEV;
+        if (tick_is_broadcast_device(dev)) {
+                raw_spin_lock(&tick_broadcast_lock);
+                ret = __clockevents_update_freq(dev, freq);
+                raw_spin_unlock(&tick_broadcast_lock);
+        }
+        return ret;
+}
 static void err_broadcast(const struct cpumask *mask)
 {
        pr_crit_once("Failed to broadcast timer tick. Some CPUs may be unresponsive.\n");
@@ -272,12 +285,8 @@ static void tick_do_broadcast(struct cpumask *mask)
 */
 static void tick_do_periodic_broadcast(void)
 {
-        raw_spin_lock(&tick_broadcast_lock);
        cpumask_and(tmpmask, cpu_online_mask, tick_broadcast_mask);
        tick_do_broadcast(tmpmask);
-        raw_spin_unlock(&tick_broadcast_lock);
 }
 /*
@@ -287,13 +296,15 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
 {
        ktime_t next;
+        raw_spin_lock(&tick_broadcast_lock);
        tick_do_periodic_broadcast();
        /*
         * The device is in periodic mode. No reprogramming necessary:
         */
        if (dev->mode == CLOCK_EVT_MODE_PERIODIC)
-                return;
+                goto unlock;
        /*
         * Setup the next period for devices, which do not have
@@ -306,9 +317,11 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
                next = ktime_add(next, tick_period);
                if (!clockevents_program_event(dev, next, false))
-                        return;
+                        goto unlock;
                tick_do_periodic_broadcast();
        }
+unlock:
+        raw_spin_unlock(&tick_broadcast_lock);
 }
 /*
@@ -630,24 +643,61 @@ again:
        raw_spin_unlock(&tick_broadcast_lock);
 }
+static int broadcast_needs_cpu(struct clock_event_device *bc, int cpu)
+{
+        if (!(bc->features & CLOCK_EVT_FEAT_HRTIMER))
+                return 0;
+        if (bc->next_event.tv64 == KTIME_MAX)
+                return 0;
+        return bc->bound_on == cpu ? -EBUSY : 0;
+}
+static void broadcast_shutdown_local(struct clock_event_device *bc,
+                                     struct clock_event_device *dev)
+{
+        /*
+         * For hrtimer based broadcasting we cannot shutdown the cpu
+         * local device if our own event is the first one to expire or
+         * if we own the broadcast timer.
+         */
+        if (bc->features & CLOCK_EVT_FEAT_HRTIMER) {
+                if (broadcast_needs_cpu(bc, smp_processor_id()))
+                        return;
+                if (dev->next_event.tv64 < bc->next_event.tv64)
+                        return;
+        }
+        clockevents_set_mode(dev, CLOCK_EVT_MODE_SHUTDOWN);
+}
+static void broadcast_move_bc(int deadcpu)
+{
+        struct clock_event_device *bc = tick_broadcast_device.evtdev;
+        if (!bc || !broadcast_needs_cpu(bc, deadcpu))
+                return;
+        /* This moves the broadcast assignment to this cpu */
+        clockevents_program_event(bc, bc->next_event, 1);
+}
 /*
 * Powerstate information: The system enters/leaves a state, where
 * affected devices might stop
+ * Returns 0 on success, -EBUSY if the cpu is used to broadcast wakeups.
 */
-void tick_broadcast_oneshot_control(unsigned long reason)
+int tick_broadcast_oneshot_control(unsigned long reason)
 {
        struct clock_event_device *bc, *dev;
        struct tick_device *td;
        unsigned long flags;
        ktime_t now;
-        int cpu;
+        int cpu, ret = 0;
        /*
         * Periodic mode does not care about the enter/exit of power
         * states
         */
        if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
-                return;
+                return 0;
        /*
         * We are called with preemtion disabled from the depth of the
@@ -658,7 +708,7 @@ void tick_broadcast_oneshot_control(unsigned long reason)
        dev = td->evtdev;
        if (!(dev->features & CLOCK_EVT_FEAT_C3STOP))
-                return;
+                return 0;
        bc = tick_broadcast_device.evtdev;
@@ -666,7 +716,7 @@ void tick_broadcast_oneshot_control(unsigned long reason)
        if (reason == CLOCK_EVT_NOTIFY_BROADCAST_ENTER) {
                if (!cpumask_test_and_set_cpu(cpu, tick_broadcast_oneshot_mask)) {
                        WARN_ON_ONCE(cpumask_test_cpu(cpu, tick_broadcast_pending_mask));
-                        clockevents_set_mode(dev, CLOCK_EVT_MODE_SHUTDOWN);
+                        broadcast_shutdown_local(bc, dev);
                        /*
                         * We only reprogram the broadcast timer if we
                         * did not mark ourself in the force mask and
@@ -679,6 +729,16 @@ void tick_broadcast_oneshot_control(unsigned long reason)
                            dev->next_event.tv64 < bc->next_event.tv64)
                                tick_broadcast_set_event(bc, cpu, dev->next_event, 1);
                }
+                /*
+                 * If the current CPU owns the hrtimer broadcast
+                 * mechanism, it cannot go deep idle and we remove the
+                 * CPU from the broadcast mask. We don't have to go
+                 * through the EXIT path as the local timer is not
+                 * shutdown.
+                 */
+                ret = broadcast_needs_cpu(bc, cpu);
+                if (ret)
+                        cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask);
        } else {
                if (cpumask_test_and_clear_cpu(cpu, tick_broadcast_oneshot_mask)) {
                        clockevents_set_mode(dev, CLOCK_EVT_MODE_ONESHOT);
@@ -746,6 +806,7 @@ void tick_broadcast_oneshot_control(unsigned long reason)
        }
 out:
        raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+        return ret;
 }
 /*
@@ -852,6 +913,8 @@ void tick_shutdown_broadcast_oneshot(unsigned int *cpup)
        cpumask_clear_cpu(cpu, tick_broadcast_pending_mask);
        cpumask_clear_cpu(cpu, tick_broadcast_force_mask);
+        broadcast_move_bc(cpu);
        raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 }
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 20b2fe37d105..015661279b68 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -98,18 +98,19 @@ static void tick_periodic(int cpu)
 void tick_handle_periodic(struct clock_event_device *dev)
 {
        int cpu = smp_processor_id();
-        ktime_t next;
+        ktime_t next = dev->next_event;
        tick_periodic(cpu);
        if (dev->mode != CLOCK_EVT_MODE_ONESHOT)
                return;
-        /*
-         * Setup the next period for devices, which do not have
-         * periodic mode:
-         */
-        next = ktime_add(dev->next_event, tick_period);
        for (;;) {
+                /*
+                 * Setup the next period for devices, which do not have
+                 * periodic mode:
+                 */
+                next = ktime_add(next, tick_period);
                if (!clockevents_program_event(dev, next, false))
                        return;
                /*
@@ -118,12 +119,11 @@ void tick_handle_periodic(struct clock_event_device *dev)
                 * to be sure we're using a real hardware clocksource.
                 * Otherwise we could get trapped in an infinite
                 * loop, as the tick_periodic() increments jiffies,
-                 * when then will increment time, posibly causing
+                 * which then will increment time, possibly causing
                 * the loop to trigger again and again.
                 */
                if (timekeeping_valid_for_hres())
                        tick_periodic(cpu);
-                next = ktime_add(next, tick_period);
        }
 }
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 8329669b51ec..7ab92b19965a 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -46,7 +46,7 @@ extern int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *));
 extern void tick_resume_oneshot(void);
 # ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
 extern void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
-extern void tick_broadcast_oneshot_control(unsigned long reason);
+extern int tick_broadcast_oneshot_control(unsigned long reason);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
 extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
@@ -58,7 +58,7 @@ static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
        BUG();
 }
-static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
+static inline int tick_broadcast_oneshot_control(unsigned long reason) { return 0; }
 static inline void tick_broadcast_switch_to_oneshot(void) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
 static inline int tick_broadcast_oneshot_active(void) { return 0; }
@@ -87,7 +87,7 @@ static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
        BUG();
 }
-static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
+static inline int tick_broadcast_oneshot_control(unsigned long reason) { return 0; }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
 static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
 {
@@ -111,6 +111,7 @@ extern int tick_resume_broadcast(void);
 extern void tick_broadcast_init(void);
 extern void
 tick_set_periodic_handler(struct clock_event_device *dev, int broadcast);
+int tick_broadcast_update_freq(struct clock_event_device *dev, u32 freq);
 #else /* !BROADCAST */
@@ -133,6 +134,8 @@ static inline void tick_shutdown_broadcast(unsigned int *cpup) { }
 static inline void tick_suspend_broadcast(void) { }
 static inline int tick_resume_broadcast(void) { return 0; }
 static inline void tick_broadcast_init(void) { }
+static inline int tick_broadcast_update_freq(struct clock_event_device *dev,
+                                             u32 freq) { return -ENODEV; }
 /*
 * Set the periodic handler in non broadcast mode
@@ -152,6 +155,8 @@ static inline int tick_device_is_functional(struct clock_event_device *dev)
        return !(dev->features & CLOCK_EVT_FEAT_DUMMY);
 }
+int __clockevents_update_freq(struct clock_event_device *dev, u32 freq);
 #endif
 extern void do_timer(unsigned long ticks);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 5b40279ecd71..f7df8ea21707 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -22,6 +22,7 @@
 #include <linux/tick.h>
 #include <linux/stop_machine.h>
 #include <linux/pvclock_gtod.h>
+#include <linux/compiler.h>
 #include "tick-internal.h"
 #include "ntp_internal.h"
@@ -760,7 +761,7 @@ u64 timekeeping_max_deferment(void)
 *
 *  XXX - Do be sure to remove it once all arches implement it.
 */
-void __attribute__((weak)) read_persistent_clock(struct timespec *ts)
+void __weak read_persistent_clock(struct timespec *ts)
 {
        ts->tv_sec = 0;
        ts->tv_nsec = 0;
@@ -775,7 +776,7 @@ void __attribute__((weak)) read_persistent_clock(struct timespec *ts)
 *
 *  XXX - Do be sure to remove it once all arches implement it.
 */
-void __attribute__((weak)) read_boot_clock(struct timespec *ts)
+void __weak read_boot_clock(struct timespec *ts)
 {
        ts->tv_sec = 0;
        ts->tv_nsec = 0;
diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
index 802433a4f5eb..4d54f97558df 100644
--- a/kernel/time/timekeeping_debug.c
+++ b/kernel/time/timekeeping_debug.c
@@ -21,6 +21,8 @@
 #include <linux/seq_file.h>
 #include <linux/time.h>
+#include "timekeeping_internal.h"
 static unsigned int sleep_time_bin[32] = {0};
 static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
diff --git a/kernel/timer.c b/kernel/timer.c
index d78de047599b..87bd529879c2 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -81,6 +81,7 @@ struct tvec_base {
        unsigned long timer_jiffies;
        unsigned long next_timer;
        unsigned long active_timers;
+        unsigned long all_timers;
        struct tvec_root tv1;
        struct tvec tv2;
        struct tvec tv3;
@@ -337,6 +338,20 @@ void set_timer_slack(struct timer_list *timer, int slack_hz)
 }
 EXPORT_SYMBOL_GPL(set_timer_slack);
+/*
+ * If the list is empty, catch up ->timer_jiffies to the current time.
+ * The caller must hold the tvec_base lock.  Returns true if the list
+ * was empty and therefore ->timer_jiffies was updated.
+ */
+static bool catchup_timer_jiffies(struct tvec_base *base)
+{
+        if (!base->all_timers) {
+                base->timer_jiffies = jiffies;
+                return true;
+        }
+        return false;
+}
 static void
 __internal_add_timer(struct tvec_base *base, struct timer_list *timer)
 {
@@ -383,15 +398,17 @@ __internal_add_timer(struct tvec_base *base, struct timer_list *timer)
 static void internal_add_timer(struct tvec_base *base, struct timer_list *timer)
 {
+        (void)catchup_timer_jiffies(base);
        __internal_add_timer(base, timer);
        /*
         * Update base->active_timers and base->next_timer
         */
        if (!tbase_get_deferrable(timer->base)) {
-                if (time_before(timer->expires, base->next_timer))
+                if (!base->active_timers++ ||
+                    time_before(timer->expires, base->next_timer))
                        base->next_timer = timer->expires;
-                base->active_timers++;
        }
+        base->all_timers++;
 }
 #ifdef CONFIG_TIMER_STATS
@@ -671,6 +688,8 @@ detach_expired_timer(struct timer_list *timer, struct tvec_base *base)
        detach_timer(timer, true);
        if (!tbase_get_deferrable(timer->base))
                base->active_timers--;
+        base->all_timers--;
+        (void)catchup_timer_jiffies(base);
 }
 static int detach_if_pending(struct timer_list *timer, struct tvec_base *base,
@@ -685,6 +704,8 @@ static int detach_if_pending(struct timer_list *timer, struct tvec_base *base,
                if (timer->expires == base->next_timer)
                        base->next_timer = base->timer_jiffies;
        }
+        base->all_timers--;
+        (void)catchup_timer_jiffies(base);
        return 1;
 }
@@ -739,12 +760,7 @@ __mod_timer(struct timer_list *timer, unsigned long expires,
        debug_activate(timer, expires);
-        cpu = smp_processor_id();
+        cpu = get_nohz_timer_target(pinned);
-#if defined(CONFIG_NO_HZ_COMMON) && defined(CONFIG_SMP)
-        if (!pinned && get_sysctl_timer_migration() && idle_cpu(cpu))
-                cpu = get_nohz_timer_target();
-#endif
        new_base = per_cpu(tvec_bases, cpu);
        if (base != new_base) {
@@ -939,8 +955,15 @@ void add_timer_on(struct timer_list *timer, int cpu)
         * with the timer by holding the timer base lock. This also
         * makes sure that a CPU on the way to stop its tick can not
         * evaluate the timer wheel.
+         *
+         * Spare the IPI for deferrable timers on idle targets though.
+         * The next busy ticks will take care of it. Except full dynticks
+         * require special care against races with idle_cpu(), lets deal
+         * with that later.
         */
-        wake_up_nohz_cpu(cpu);
+        if (!tbase_get_deferrable(timer->base) || tick_nohz_full_cpu(cpu))
+                wake_up_nohz_cpu(cpu);
        spin_unlock_irqrestore(&base->lock, flags);
 }
 EXPORT_SYMBOL_GPL(add_timer_on);
@@ -1146,6 +1169,10 @@ static inline void __run_timers(struct tvec_base *base)
        struct timer_list *timer;
        spin_lock_irq(&base->lock);
+        if (catchup_timer_jiffies(base)) {
+                spin_unlock_irq(&base->lock);
+                return;
+        }
        while (time_after_eq(jiffies, base->timer_jiffies)) {
                struct list_head work_list;
                struct list_head *head = &work_list;
@@ -1160,7 +1187,7 @@ static inline void __run_timers(struct tvec_base *base)
                                        !cascade(base, &base->tv4, INDEX(2)))
                        cascade(base, &base->tv5, INDEX(3));
                ++base->timer_jiffies;
-                list_replace_init(base->tv1.vec + index, &work_list);
+                list_replace_init(base->tv1.vec + index, head);
                while (!list_empty(head)) {
                        void (*fn)(unsigned long);
                        unsigned long data;
@@ -1523,9 +1550,8 @@ static int init_timers_cpu(int cpu)
                        if (!base)
                                return -ENOMEM;
-                        /* Make sure that tvec_base is 2 byte aligned */
+                        /* Make sure tvec_base has TIMER_FLAG_MASK bits free */
-                        if (tbase_get_deferrable(base)) {
+                        if (WARN_ON(base != tbase_get_base(base))) {
-                                WARN_ON(1);
                                kfree(base);
                                return -ENOMEM;
                        }
@@ -1559,6 +1585,7 @@ static int init_timers_cpu(int cpu)
        base->timer_jiffies = jiffies;
        base->next_timer = base->timer_jiffies;
        base->active_timers = 0;
+        base->all_timers = 0;
        return 0;
 }
@@ -1648,9 +1675,9 @@ void __init init_timers(void)
        err = timer_cpu_notify(&timers_nb, (unsigned long)CPU_UP_PREPARE,
                               (void *)(long)smp_processor_id());
-        init_timer_stats();
        BUG_ON(err != NOTIFY_OK);
+        init_timer_stats();
        register_cpu_notifier(&timers_nb);
        open_softirq(TIMER_SOFTIRQ, run_timer_softirq);
 }
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 015f85aaca08..8639819f6cef 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -424,6 +424,7 @@ config UPROBE_EVENT
        bool "Enable uprobes-based dynamic events"
        depends on ARCH_SUPPORTS_UPROBES
        depends on MMU
+        depends on PERF_EVENTS
        select UPROBES
        select PROBE_EVENTS
        select TRACING
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index b418cb0d7242..c1bd4ada2a04 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -702,6 +702,7 @@ void blk_trace_shutdown(struct request_queue *q)
 * blk_add_trace_rq - Add a trace for a request oriented action
 * @q:          queue the io is for
 * @rq:         the source request
+ * @nr_bytes:   number of completed bytes
 * @what:       the action
 *
 * Description:
@@ -709,7 +710,7 @@ void blk_trace_shutdown(struct request_queue *q)
 *
 **/
 static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
-                             u32 what)
+                             unsigned int nr_bytes, u32 what)
 {
        struct blk_trace *bt = q->blk_trace;
@@ -718,11 +719,11 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
        if (rq->cmd_type == REQ_TYPE_BLOCK_PC) {
                what |= BLK_TC_ACT(BLK_TC_PC);
-                __blk_add_trace(bt, 0, blk_rq_bytes(rq), rq->cmd_flags,
+                __blk_add_trace(bt, 0, nr_bytes, rq->cmd_flags,
                                what, rq->errors, rq->cmd_len, rq->cmd);
        } else  {
                what |= BLK_TC_ACT(BLK_TC_FS);
-                __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
+                __blk_add_trace(bt, blk_rq_pos(rq), nr_bytes,
                                rq->cmd_flags, what, rq->errors, 0, NULL);
        }
 }
@@ -730,33 +731,34 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
 static void blk_add_trace_rq_abort(void *ignore,
                                   struct request_queue *q, struct request *rq)
 {
-        blk_add_trace_rq(q, rq, BLK_TA_ABORT);
+        blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ABORT);
 }
 static void blk_add_trace_rq_insert(void *ignore,
                                    struct request_queue *q, struct request *rq)
 {
-        blk_add_trace_rq(q, rq, BLK_TA_INSERT);
+        blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_INSERT);
 }
 static void blk_add_trace_rq_issue(void *ignore,
                                   struct request_queue *q, struct request *rq)
 {
-        blk_add_trace_rq(q, rq, BLK_TA_ISSUE);
+        blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ISSUE);
 }
 static void blk_add_trace_rq_requeue(void *ignore,
                                     struct request_queue *q,
                                     struct request *rq)
 {
-        blk_add_trace_rq(q, rq, BLK_TA_REQUEUE);
+        blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_REQUEUE);
 }
 static void blk_add_trace_rq_complete(void *ignore,
                                      struct request_queue *q,
-                                      struct request *rq)
+                                      struct request *rq,
+                                      unsigned int nr_bytes)
 {
-        blk_add_trace_rq(q, rq, BLK_TA_COMPLETE);
+        blk_add_trace_rq(q, rq, nr_bytes, BLK_TA_COMPLETE);
 }
 /**
@@ -1427,7 +1429,8 @@ static enum print_line_t blk_tracer_print_line(struct trace_iterator *iter)
        return print_one_line(iter, true);
 }
-static int blk_tracer_set_flag(u32 old_flags, u32 bit, int set)
+static int
+blk_tracer_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        /* don't output context-info for blk_classic output */
        if (bit == TRACE_BLK_OPT_CLASSIC) {
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index cd7f76d1eb86..1fd4b9479210 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -237,14 +237,13 @@ static int control_ops_alloc(struct ftrace_ops *ops)
        return 0;
 }
-static void control_ops_free(struct ftrace_ops *ops)
-{
-        free_percpu(ops->disabled);
-}
 static void update_global_ops(void)
 {
-        ftrace_func_t func;
+        ftrace_func_t func = ftrace_global_list_func;
+        void *private = NULL;
+        /* The list has its own recursion protection. */
+        global_ops.flags |= FTRACE_OPS_FL_RECURSION_SAFE;
        /*
         * If there's only one function registered, then call that
@@ -254,23 +253,17 @@ static void update_global_ops(void)
        if (ftrace_global_list == &ftrace_list_end ||
            ftrace_global_list->next == &ftrace_list_end) {
                func = ftrace_global_list->func;
+                private = ftrace_global_list->private;
                /*
                 * As we are calling the function directly.
                 * If it does not have recursion protection,
                 * the function_trace_op needs to be updated
                 * accordingly.
                 */
-                if (ftrace_global_list->flags & FTRACE_OPS_FL_RECURSION_SAFE)
+                if (!(ftrace_global_list->flags & FTRACE_OPS_FL_RECURSION_SAFE))
-                        global_ops.flags |= FTRACE_OPS_FL_RECURSION_SAFE;
-                else
                        global_ops.flags &= ~FTRACE_OPS_FL_RECURSION_SAFE;
-        } else {
-                func = ftrace_global_list_func;
-                /* The list has its own recursion protection. */
-                global_ops.flags |= FTRACE_OPS_FL_RECURSION_SAFE;
        }
        /* If we filter on pids, update to use the pid function */
        if (!list_empty(&ftrace_pids)) {
                set_ftrace_pid_function(func);
@@ -278,6 +271,7 @@ static void update_global_ops(void)
        }
        global_ops.func = func;
+        global_ops.private = private;
 }
 static void ftrace_sync(struct work_struct *work)
@@ -437,6 +431,9 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
 static int __register_ftrace_function(struct ftrace_ops *ops)
 {
+        if (ops->flags & FTRACE_OPS_FL_DELETED)
+                return -EINVAL;
        if (FTRACE_WARN_ON(ops == &global_ops))
                return -EINVAL;
@@ -1172,8 +1169,6 @@ struct ftrace_page {
        int                     size;
 };
-static struct ftrace_page *ftrace_new_pgs;
 #define ENTRY_SIZE sizeof(struct dyn_ftrace)
 #define ENTRIES_PER_PAGE (PAGE_SIZE / ENTRY_SIZE)
@@ -1560,7 +1555,7 @@ unsigned long ftrace_location(unsigned long ip)
 * the function tracer. It checks the ftrace internal tables to
 * determine if the address belongs or not.
 */
-int ftrace_text_reserved(void *start, void *end)
+int ftrace_text_reserved(const void *start, const void *end)
 {
        unsigned long ret;
@@ -1994,6 +1989,7 @@ int __weak ftrace_arch_code_modify_post_process(void)
 void ftrace_modify_all_code(int command)
 {
        int update = command & FTRACE_UPDATE_TRACE_FUNC;
+        int err = 0;
        /*
         * If the ftrace_caller calls a ftrace_ops func directly,
@@ -2005,8 +2001,11 @@ void ftrace_modify_all_code(int command)
         * to make sure the ops are having the right functions
         * traced.
         */
-        if (update)
+        if (update) {
-                ftrace_update_ftrace_func(ftrace_ops_list_func);
+                err = ftrace_update_ftrace_func(ftrace_ops_list_func);
+                if (FTRACE_WARN_ON(err))
+                        return;
+        }
        if (command & FTRACE_UPDATE_CALLS)
                ftrace_replace_code(1);
@@ -2019,13 +2018,16 @@ void ftrace_modify_all_code(int command)
                /* If irqs are disabled, we are in stop machine */
                if (!irqs_disabled())
                        smp_call_function(ftrace_sync_ipi, NULL, 1);
-                ftrace_update_ftrace_func(ftrace_trace_function);
+                err = ftrace_update_ftrace_func(ftrace_trace_function);
+                if (FTRACE_WARN_ON(err))
+                        return;
        }
        if (command & FTRACE_START_FUNC_RET)
-                ftrace_enable_ftrace_graph_caller();
+                err = ftrace_enable_ftrace_graph_caller();
        else if (command & FTRACE_STOP_FUNC_RET)
-                ftrace_disable_ftrace_graph_caller();
+                err = ftrace_disable_ftrace_graph_caller();
+        FTRACE_WARN_ON(err);
 }
 static int __ftrace_modify_code(void *data)
@@ -2093,6 +2095,11 @@ static ftrace_func_t saved_ftrace_func;
 static int ftrace_start_up;
 static int global_start_up;
+static void control_ops_free(struct ftrace_ops *ops)
+{
+        free_percpu(ops->disabled);
+}
 static void ftrace_startup_enable(int command)
 {
        if (saved_ftrace_func != ftrace_trace_function) {
@@ -2244,7 +2251,6 @@ static void ftrace_shutdown_sysctl(void)
 }
 static cycle_t          ftrace_update_time;
-static unsigned long    ftrace_update_cnt;
 unsigned long           ftrace_update_tot_cnt;
 static inline int ops_traces_mod(struct ftrace_ops *ops)
@@ -2300,11 +2306,12 @@ static int referenced_filters(struct dyn_ftrace *rec)
        return cnt;
 }
-static int ftrace_update_code(struct module *mod)
+static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs)
 {
        struct ftrace_page *pg;
        struct dyn_ftrace *p;
        cycle_t start, stop;
+        unsigned long update_cnt = 0;
        unsigned long ref = 0;
        bool test = false;
        int i;
@@ -2330,9 +2337,8 @@ static int ftrace_update_code(struct module *mod)
        }
        start = ftrace_now(raw_smp_processor_id());
-        ftrace_update_cnt = 0;
-        for (pg = ftrace_new_pgs; pg; pg = pg->next) {
+        for (pg = new_pgs; pg; pg = pg->next) {
                for (i = 0; i < pg->index; i++) {
                        int cnt = ref;
@@ -2353,7 +2359,7 @@ static int ftrace_update_code(struct module *mod)
                        if (!ftrace_code_disable(mod, p))
                                break;
-                        ftrace_update_cnt++;
+                        update_cnt++;
                        /*
                         * If the tracing is enabled, go ahead and enable the record.
@@ -2372,11 +2378,9 @@ static int ftrace_update_code(struct module *mod)
                }
        }
-        ftrace_new_pgs = NULL;
        stop = ftrace_now(raw_smp_processor_id());
        ftrace_update_time = stop - start;
-        ftrace_update_tot_cnt += ftrace_update_cnt;
+        ftrace_update_tot_cnt += update_cnt;
        return 0;
 }
@@ -2468,22 +2472,6 @@ ftrace_allocate_pages(unsigned long num_to_init)
        return NULL;
 }
-static int __init ftrace_dyn_table_alloc(unsigned long num_to_init)
-{
-        int cnt;
-        if (!num_to_init) {
-                pr_info("ftrace: No functions to be traced?\n");
-                return -1;
-        }
-        cnt = num_to_init / ENTRIES_PER_PAGE;
-        pr_info("ftrace: allocating %ld entries in %d pages\n",
-                num_to_init, cnt + 1);
-        return 0;
-}
 #define FTRACE_BUFF_MAX (KSYM_SYMBOL_LEN+4) /* room for wildcards */
 struct ftrace_iterator {
@@ -2871,7 +2859,9 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
 static int
 ftrace_filter_open(struct inode *inode, struct file *file)
 {
-        return ftrace_regex_open(&global_ops,
+        struct ftrace_ops *ops = inode->i_private;
+        return ftrace_regex_open(ops,
                        FTRACE_ITER_FILTER | FTRACE_ITER_DO_HASH,
                        inode, file);
 }
@@ -2879,7 +2869,9 @@ ftrace_filter_open(struct inode *inode, struct file *file)
 static int
 ftrace_notrace_open(struct inode *inode, struct file *file)
 {
-        return ftrace_regex_open(&global_ops, FTRACE_ITER_NOTRACE,
+        struct ftrace_ops *ops = inode->i_private;
+        return ftrace_regex_open(ops, FTRACE_ITER_NOTRACE,
                                 inode, file);
 }
@@ -4109,6 +4101,36 @@ static const struct file_operations ftrace_graph_notrace_fops = {
 };
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+void ftrace_create_filter_files(struct ftrace_ops *ops,
+                                struct dentry *parent)
+{
+        trace_create_file("set_ftrace_filter", 0644, parent,
+                          ops, &ftrace_filter_fops);
+        trace_create_file("set_ftrace_notrace", 0644, parent,
+                          ops, &ftrace_notrace_fops);
+}
+/*
+ * The name "destroy_filter_files" is really a misnomer. Although
+ * in the future, it may actualy delete the files, but this is
+ * really intended to make sure the ops passed in are disabled
+ * and that when this function returns, the caller is free to
+ * free the ops.
+ *
+ * The "destroy" name is only to match the "create" name that this
+ * should be paired with.
+ */
+void ftrace_destroy_filter_files(struct ftrace_ops *ops)
+{
+        mutex_lock(&ftrace_lock);
+        if (ops->flags & FTRACE_OPS_FL_ENABLED)
+                ftrace_shutdown(ops, 0);
+        ops->flags |= FTRACE_OPS_FL_DELETED;
+        mutex_unlock(&ftrace_lock);
+}
 static __init int ftrace_init_dyn_debugfs(struct dentry *d_tracer)
 {
@@ -4118,11 +4140,7 @@ static __init int ftrace_init_dyn_debugfs(struct dentry *d_tracer)
        trace_create_file("enabled_functions", 0444,
                        d_tracer, NULL, &ftrace_enabled_fops);
-        trace_create_file("set_ftrace_filter", 0644, d_tracer,
+        ftrace_create_filter_files(&global_ops, d_tracer);
-                        NULL, &ftrace_filter_fops);
-        trace_create_file("set_ftrace_notrace", 0644, d_tracer,
-                                    NULL, &ftrace_notrace_fops);
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
        trace_create_file("set_graph_function", 0444, d_tracer,
@@ -4238,9 +4256,6 @@ static int ftrace_process_locs(struct module *mod,
        /* Assign the last page to ftrace_pages */
        ftrace_pages = pg;
-        /* These new locations need to be initialized */
-        ftrace_new_pgs = start_pg;
        /*
         * We only need to disable interrupts on start up
         * because we are modifying code that an interrupt
@@ -4251,7 +4266,7 @@ static int ftrace_process_locs(struct module *mod,
         */
        if (!mod)
                local_irq_save(flags);
-        ftrace_update_code(mod);
+        ftrace_update_code(mod, start_pg);
        if (!mod)
                local_irq_restore(flags);
        ret = 0;
@@ -4360,30 +4375,27 @@ struct notifier_block ftrace_module_exit_nb = {
        .priority = INT_MIN,    /* Run after anything that can remove kprobes */
 };
-extern unsigned long __start_mcount_loc[];
-extern unsigned long __stop_mcount_loc[];
 void __init ftrace_init(void)
 {
-        unsigned long count, addr, flags;
+        extern unsigned long __start_mcount_loc[];
+        extern unsigned long __stop_mcount_loc[];
+        unsigned long count, flags;
        int ret;
-        /* Keep the ftrace pointer to the stub */
-        addr = (unsigned long)ftrace_stub;
        local_irq_save(flags);
-        ftrace_dyn_arch_init(&addr);
+        ret = ftrace_dyn_arch_init();
        local_irq_restore(flags);
+        if (ret)
-        /* ftrace_dyn_arch_init places the return code in addr */
-        if (addr)
                goto failed;
        count = __stop_mcount_loc - __start_mcount_loc;
+        if (!count) {
-        ret = ftrace_dyn_table_alloc(count);
+                pr_info("ftrace: No functions to be traced?\n");
-        if (ret)
                goto failed;
+        }
+        pr_info("ftrace: allocating %ld entries in %ld pages\n",
+                count, count / ENTRIES_PER_PAGE + 1);
        last_ftrace_enabled = ftrace_enabled = 1;
@@ -4431,7 +4443,13 @@ static inline void ftrace_startup_enable(int command) { }
                        (ops)->flags |= FTRACE_OPS_FL_ENABLED;          \
                ___ret;                                                 \
        })
-# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
+# define ftrace_shutdown(ops, command)                                  \
+        ({                                                              \
+                int ___ret = __unregister_ftrace_function(ops);         \
+                if (!___ret)                                            \
+                        (ops)->flags &= ~FTRACE_OPS_FL_ENABLED;         \
+                ___ret;                                                 \
+        })
 # define ftrace_startup_sysctl()        do { } while (0)
 # define ftrace_shutdown_sysctl()       do { } while (0)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index fc4da2d97f9b..c634868c2921 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1301,7 +1301,7 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
         * In that off case, we need to allocate for all possible cpus.
         */
 #ifdef CONFIG_HOTPLUG_CPU
-        get_online_cpus();
+        cpu_notifier_register_begin();
        cpumask_copy(buffer->cpumask, cpu_online_mask);
 #else
        cpumask_copy(buffer->cpumask, cpu_possible_mask);
@@ -1324,10 +1324,10 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
 #ifdef CONFIG_HOTPLUG_CPU
        buffer->cpu_notify.notifier_call = rb_cpu_notify;
        buffer->cpu_notify.priority = 0;
-        register_cpu_notifier(&buffer->cpu_notify);
+        __register_cpu_notifier(&buffer->cpu_notify);
+        cpu_notifier_register_done();
 #endif
-        put_online_cpus();
        mutex_init(&buffer->mutex);
        return buffer;
@@ -1341,7 +1341,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags,
 fail_free_cpumask:
        free_cpumask_var(buffer->cpumask);
-        put_online_cpus();
+#ifdef CONFIG_HOTPLUG_CPU
+        cpu_notifier_register_done();
+#endif
 fail_free_buffer:
        kfree(buffer);
@@ -1358,16 +1360,17 @@ ring_buffer_free(struct ring_buffer *buffer)
 {
        int cpu;
-        get_online_cpus();
 #ifdef CONFIG_HOTPLUG_CPU
-        unregister_cpu_notifier(&buffer->cpu_notify);
+        cpu_notifier_register_begin();
+        __unregister_cpu_notifier(&buffer->cpu_notify);
 #endif
        for_each_buffer_cpu(buffer, cpu)
                rb_free_cpu_buffer(buffer->buffers[cpu]);
-        put_online_cpus();
+#ifdef CONFIG_HOTPLUG_CPU
+        cpu_notifier_register_done();
+#endif
        kfree(buffer->buffers);
        free_cpumask_var(buffer->cpumask);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 24c1f2382557..9be67c5e5b0f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -73,7 +73,8 @@ static struct tracer_flags dummy_tracer_flags = {
        .opts = dummy_tracer_opt
 };
-static int dummy_set_flag(u32 old_flags, u32 bit, int set)
+static int
+dummy_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        return 0;
 }
@@ -118,7 +119,7 @@ enum ftrace_dump_mode ftrace_dump_on_oops;
 /* When set, tracing will stop when a WARN*() is hit */
 int __disable_trace_on_warning;
-static int tracing_set_tracer(const char *buf);
+static int tracing_set_tracer(struct trace_array *tr, const char *buf);
 #define MAX_TRACER_SIZE         100
 static char bootup_tracer_buf[MAX_TRACER_SIZE] __initdata;
@@ -180,6 +181,17 @@ static int __init set_trace_boot_options(char *str)
 }
 __setup("trace_options=", set_trace_boot_options);
+static char trace_boot_clock_buf[MAX_TRACER_SIZE] __initdata;
+static char *trace_boot_clock __initdata;
+static int __init set_trace_boot_clock(char *str)
+{
+        strlcpy(trace_boot_clock_buf, str, MAX_TRACER_SIZE);
+        trace_boot_clock = trace_boot_clock_buf;
+        return 0;
+}
+__setup("trace_clock=", set_trace_boot_clock);
 unsigned long long ns2usecs(cycle_t nsec)
 {
@@ -1230,7 +1242,7 @@ int register_tracer(struct tracer *type)
        printk(KERN_INFO "Starting tracer '%s'\n", type->name);
        /* Do we want this tracer to start on bootup? */
-        tracing_set_tracer(type->name);
+        tracing_set_tracer(&global_trace, type->name);
        default_bootup_tracer = NULL;
        /* disable other selftests, since this will break it. */
        tracing_selftest_disabled = true;
@@ -3137,27 +3149,52 @@ static int tracing_open(struct inode *inode, struct file *file)
        return ret;
 }
+/*
+ * Some tracers are not suitable for instance buffers.
+ * A tracer is always available for the global array (toplevel)
+ * or if it explicitly states that it is.
+ */
+static bool
+trace_ok_for_array(struct tracer *t, struct trace_array *tr)
+{
+        return (tr->flags & TRACE_ARRAY_FL_GLOBAL) || t->allow_instances;
+}
+/* Find the next tracer that this trace array may use */
+static struct tracer *
+get_tracer_for_array(struct trace_array *tr, struct tracer *t)
+{
+        while (t && !trace_ok_for_array(t, tr))
+                t = t->next;
+        return t;
+}
 static void *
 t_next(struct seq_file *m, void *v, loff_t *pos)
 {
+        struct trace_array *tr = m->private;
        struct tracer *t = v;
        (*pos)++;
        if (t)
-                t = t->next;
+                t = get_tracer_for_array(tr, t->next);
        return t;
 }
 static void *t_start(struct seq_file *m, loff_t *pos)
 {
+        struct trace_array *tr = m->private;
        struct tracer *t;
        loff_t l = 0;
        mutex_lock(&trace_types_lock);
-        for (t = trace_types; t && l < *pos; t = t_next(m, t, &l))
-                ;
+        t = get_tracer_for_array(tr, trace_types);
+        for (; t && l < *pos; t = t_next(m, t, &l))
+                        ;
        return t;
 }
@@ -3192,10 +3229,21 @@ static const struct seq_operations show_traces_seq_ops = {
 static int show_traces_open(struct inode *inode, struct file *file)
 {
+        struct trace_array *tr = inode->i_private;
+        struct seq_file *m;
+        int ret;
        if (tracing_disabled)
                return -ENODEV;
-        return seq_open(file, &show_traces_seq_ops);
+        ret = seq_open(file, &show_traces_seq_ops);
+        if (ret)
+                return ret;
+        m = file->private_data;
+        m->private = tr;
+        return 0;
 }
 static ssize_t
@@ -3355,13 +3403,14 @@ static int tracing_trace_options_show(struct seq_file *m, void *v)
        return 0;
 }
-static int __set_tracer_option(struct tracer *trace,
+static int __set_tracer_option(struct trace_array *tr,
                               struct tracer_flags *tracer_flags,
                               struct tracer_opt *opts, int neg)
 {
+        struct tracer *trace = tr->current_trace;
        int ret;
-        ret = trace->set_flag(tracer_flags->val, opts->bit, !neg);
+        ret = trace->set_flag(tr, tracer_flags->val, opts->bit, !neg);
        if (ret)
                return ret;
@@ -3373,8 +3422,9 @@ static int __set_tracer_option(struct tracer *trace,
 }
 /* Try to assign a tracer specific option */
-static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
+static int set_tracer_option(struct trace_array *tr, char *cmp, int neg)
 {
+        struct tracer *trace = tr->current_trace;
        struct tracer_flags *tracer_flags = trace->flags;
        struct tracer_opt *opts = NULL;
        int i;
@@ -3383,8 +3433,7 @@ static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
                opts = &tracer_flags->opts[i];
                if (strcmp(cmp, opts->name) == 0)
-                        return __set_tracer_option(trace, trace->flags,
+                        return __set_tracer_option(tr, trace->flags, opts, neg);
-                                                   opts, neg);
        }
        return -EINVAL;
@@ -3407,7 +3456,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
        /* Give the tracer a chance to approve the change */
        if (tr->current_trace->flag_changed)
-                if (tr->current_trace->flag_changed(tr->current_trace, mask, !!enabled))
+                if (tr->current_trace->flag_changed(tr, mask, !!enabled))
                        return -EINVAL;
        if (enabled)
@@ -3456,7 +3505,7 @@ static int trace_set_options(struct trace_array *tr, char *option)
        /* If no option could be set, test the specific tracer options */
        if (!trace_options[i])
-                ret = set_tracer_option(tr->current_trace, cmp, neg);
+                ret = set_tracer_option(tr, cmp, neg);
        mutex_unlock(&trace_types_lock);
@@ -3885,10 +3934,26 @@ create_trace_option_files(struct trace_array *tr, struct tracer *tracer);
 static void
 destroy_trace_option_files(struct trace_option_dentry *topts);
-static int tracing_set_tracer(const char *buf)
+/*
+ * Used to clear out the tracer before deletion of an instance.
+ * Must have trace_types_lock held.
+ */
+static void tracing_set_nop(struct trace_array *tr)
+{
+        if (tr->current_trace == &nop_trace)
+                return;
+        
+        tr->current_trace->enabled--;
+        if (tr->current_trace->reset)
+                tr->current_trace->reset(tr);
+        tr->current_trace = &nop_trace;
+}
+static int tracing_set_tracer(struct trace_array *tr, const char *buf)
 {
        static struct trace_option_dentry *topts;
-        struct trace_array *tr = &global_trace;
        struct tracer *t;
 #ifdef CONFIG_TRACER_MAX_TRACE
        bool had_max_tr;
@@ -3916,9 +3981,15 @@ static int tracing_set_tracer(const char *buf)
        if (t == tr->current_trace)
                goto out;
+        /* Some tracers are only allowed for the top level buffer */
+        if (!trace_ok_for_array(t, tr)) {
+                ret = -EINVAL;
+                goto out;
+        }
        trace_branch_disable();
-        tr->current_trace->enabled = false;
+        tr->current_trace->enabled--;
        if (tr->current_trace->reset)
                tr->current_trace->reset(tr);
@@ -3941,9 +4012,11 @@ static int tracing_set_tracer(const char *buf)
                free_snapshot(tr);
        }
 #endif
-        destroy_trace_option_files(topts);
+        /* Currently, only the top instance has options */
+        if (tr->flags & TRACE_ARRAY_FL_GLOBAL) {
-        topts = create_trace_option_files(tr, t);
+                destroy_trace_option_files(topts);
+                topts = create_trace_option_files(tr, t);
+        }
 #ifdef CONFIG_TRACER_MAX_TRACE
        if (t->use_max_tr && !had_max_tr) {
@@ -3960,7 +4033,7 @@ static int tracing_set_tracer(const char *buf)
        }
        tr->current_trace = t;
-        tr->current_trace->enabled = true;
+        tr->current_trace->enabled++;
        trace_branch_enable(tr);
 out:
        mutex_unlock(&trace_types_lock);
@@ -3972,6 +4045,7 @@ static ssize_t
 tracing_set_trace_write(struct file *filp, const char __user *ubuf,
                        size_t cnt, loff_t *ppos)
 {
+        struct trace_array *tr = filp->private_data;
        char buf[MAX_TRACER_SIZE+1];
        int i;
        size_t ret;
@@ -3991,7 +4065,7 @@ tracing_set_trace_write(struct file *filp, const char __user *ubuf,
        for (i = cnt - 1; i > 0 && isspace(buf[i]); i--)
                buf[i] = 0;
-        err = tracing_set_tracer(buf);
+        err = tracing_set_tracer(tr, buf);
        if (err)
                return err;
@@ -4699,25 +4773,10 @@ static int tracing_clock_show(struct seq_file *m, void *v)
        return 0;
 }
-static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
+static int tracing_set_clock(struct trace_array *tr, const char *clockstr)
-                                   size_t cnt, loff_t *fpos)
 {
-        struct seq_file *m = filp->private_data;
-        struct trace_array *tr = m->private;
-        char buf[64];
-        const char *clockstr;
        int i;
-        if (cnt >= sizeof(buf))
-                return -EINVAL;
-        if (copy_from_user(&buf, ubuf, cnt))
-                return -EFAULT;
-        buf[cnt] = 0;
-        clockstr = strstrip(buf);
        for (i = 0; i < ARRAY_SIZE(trace_clocks); i++) {
                if (strcmp(trace_clocks[i].name, clockstr) == 0)
                        break;
@@ -4745,6 +4804,32 @@ static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
        mutex_unlock(&trace_types_lock);
+        return 0;
+}
+static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
+                                   size_t cnt, loff_t *fpos)
+{
+        struct seq_file *m = filp->private_data;
+        struct trace_array *tr = m->private;
+        char buf[64];
+        const char *clockstr;
+        int ret;
+        if (cnt >= sizeof(buf))
+                return -EINVAL;
+        if (copy_from_user(&buf, ubuf, cnt))
+                return -EFAULT;
+        buf[cnt] = 0;
+        clockstr = strstrip(buf);
+        ret = tracing_set_clock(tr, clockstr);
+        if (ret)
+                return ret;
        *fpos += cnt;
        return cnt;
@@ -5705,7 +5790,7 @@ trace_options_write(struct file *filp, const char __user *ubuf, size_t cnt,
        if (!!(topt->flags->val & topt->opt->bit) != val) {
                mutex_lock(&trace_types_lock);
-                ret = __set_tracer_option(topt->tr->current_trace, topt->flags,
+                ret = __set_tracer_option(topt->tr, topt->flags,
                                          topt->opt, !val);
                mutex_unlock(&trace_types_lock);
                if (ret)
@@ -6112,7 +6197,9 @@ static int instance_delete(const char *name)
        list_del(&tr->list);
+        tracing_set_nop(tr);
        event_trace_del_tracer(tr);
+        ftrace_destroy_function_files(tr);
        debugfs_remove_recursive(tr->dir);
        free_percpu(tr->trace_buffer.data);
        ring_buffer_free(tr->trace_buffer.buffer);
@@ -6207,6 +6294,12 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
 {
        int cpu;
+        trace_create_file("available_tracers", 0444, d_tracer,
+                        tr, &show_traces_fops);
+        trace_create_file("current_tracer", 0644, d_tracer,
+                        tr, &set_tracer_fops);
        trace_create_file("tracing_cpumask", 0644, d_tracer,
                          tr, &tracing_cpumask_fops);
@@ -6237,6 +6330,9 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
        trace_create_file("tracing_on", 0644, d_tracer,
                          tr, &rb_simple_fops);
+        if (ftrace_create_function_files(tr, d_tracer))
+                WARN(1, "Could not allocate function filter files");
 #ifdef CONFIG_TRACER_SNAPSHOT
        trace_create_file("snapshot", 0644, d_tracer,
                          tr, &snapshot_fops);
@@ -6259,12 +6355,6 @@ static __init int tracer_init_debugfs(void)
        init_tracer_debugfs(&global_trace, d_tracer);
-        trace_create_file("available_tracers", 0444, d_tracer,
-                        &global_trace, &show_traces_fops);
-        trace_create_file("current_tracer", 0644, d_tracer,
-                        &global_trace, &set_tracer_fops);
 #ifdef CONFIG_TRACER_MAX_TRACE
        trace_create_file("tracing_max_latency", 0644, d_tracer,
                        &tracing_max_latency, &tracing_max_lat_fops);
@@ -6527,6 +6617,13 @@ __init static int tracer_alloc_buffers(void)
        trace_init_cmdlines();
+        if (trace_boot_clock) {
+                ret = tracing_set_clock(&global_trace, trace_boot_clock);
+                if (ret < 0)
+                        pr_warning("Trace clock %s not defined, going back to default\n",
+                                   trace_boot_clock);
+        }
        /*
         * register_tracer() might reference current_trace, so it
         * needs to be set before we register anything. This is
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 02b592f2d4b7..2e29d7ba5a52 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -13,6 +13,7 @@
 #include <linux/hw_breakpoint.h>
 #include <linux/trace_seq.h>
 #include <linux/ftrace_event.h>
+#include <linux/compiler.h>
 #ifdef CONFIG_FTRACE_SYSCALLS
 #include <asm/unistd.h>         /* For NR_SYSCALLS           */
@@ -210,6 +211,11 @@ struct trace_array {
        struct list_head        events;
        cpumask_var_t           tracing_cpumask; /* only trace on set CPUs */
        int                     ref;
+#ifdef CONFIG_FUNCTION_TRACER
+        struct ftrace_ops       *ops;
+        /* function tracing enabled */
+        int                     function_enabled;
+#endif
 };
 enum {
@@ -355,14 +361,16 @@ struct tracer {
        void                    (*print_header)(struct seq_file *m);
        enum print_line_t       (*print_line)(struct trace_iterator *iter);
        /* If you handled the flag setting, return 0 */
-        int                     (*set_flag)(u32 old_flags, u32 bit, int set);
+        int                     (*set_flag)(struct trace_array *tr,
+                                            u32 old_flags, u32 bit, int set);
        /* Return 0 if OK with change, else return non-zero */
-        int                     (*flag_changed)(struct tracer *tracer,
+        int                     (*flag_changed)(struct trace_array *tr,
                                                u32 mask, int set);
        struct tracer           *next;
        struct tracer_flags     *flags;
+        int                     enabled;
        bool                    print_max;
-        bool                    enabled;
+        bool                    allow_instances;
 #ifdef CONFIG_TRACER_MAX_TRACE
        bool                    use_max_tr;
 #endif
@@ -812,13 +820,36 @@ static inline int ftrace_trace_task(struct task_struct *task)
        return test_tsk_trace_trace(task);
 }
 extern int ftrace_is_dead(void);
+int ftrace_create_function_files(struct trace_array *tr,
+                                 struct dentry *parent);
+void ftrace_destroy_function_files(struct trace_array *tr);
 #else
 static inline int ftrace_trace_task(struct task_struct *task)
 {
        return 1;
 }
 static inline int ftrace_is_dead(void) { return 0; }
-#endif
+static inline int
+ftrace_create_function_files(struct trace_array *tr,
+                             struct dentry *parent)
+{
+        return 0;
+}
+static inline void ftrace_destroy_function_files(struct trace_array *tr) { }
+#endif /* CONFIG_FUNCTION_TRACER */
+#if defined(CONFIG_FUNCTION_TRACER) && defined(CONFIG_DYNAMIC_FTRACE)
+void ftrace_create_filter_files(struct ftrace_ops *ops,
+                                struct dentry *parent);
+void ftrace_destroy_filter_files(struct ftrace_ops *ops);
+#else
+/*
+ * The ops parameter passed in is usually undefined.
+ * This must be a macro.
+ */
+#define ftrace_create_filter_files(ops, parent) do { } while (0)
+#define ftrace_destroy_filter_files(ops) do { } while (0)
+#endif /* CONFIG_FUNCTION_TRACER && CONFIG_DYNAMIC_FTRACE */
 int ftrace_event_is_function(struct ftrace_event_call *call);
@@ -1249,7 +1280,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled);
 #undef FTRACE_ENTRY
 #define FTRACE_ENTRY(call, struct_name, id, tstruct, print, filter)     \
        extern struct ftrace_event_call                                 \
-        __attribute__((__aligned__(4))) event_##call;
+        __aligned(4) event_##call;
 #undef FTRACE_ENTRY_DUP
 #define FTRACE_ENTRY_DUP(call, struct_name, id, tstruct, print, filter) \
        FTRACE_ENTRY(call, struct_name, id, PARAMS(tstruct), PARAMS(print), \
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 7b16d40bd64d..83a4378dc5e0 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -188,6 +188,36 @@ int trace_event_raw_init(struct ftrace_event_call *call)
 }
 EXPORT_SYMBOL_GPL(trace_event_raw_init);
+void *ftrace_event_buffer_reserve(struct ftrace_event_buffer *fbuffer,
+                                  struct ftrace_event_file *ftrace_file,
+                                  unsigned long len)
+{
+        struct ftrace_event_call *event_call = ftrace_file->event_call;
+        local_save_flags(fbuffer->flags);
+        fbuffer->pc = preempt_count();
+        fbuffer->ftrace_file = ftrace_file;
+        fbuffer->event =
+                trace_event_buffer_lock_reserve(&fbuffer->buffer, ftrace_file,
+                                                event_call->event.type, len,
+                                                fbuffer->flags, fbuffer->pc);
+        if (!fbuffer->event)
+                return NULL;
+        fbuffer->entry = ring_buffer_event_data(fbuffer->event);
+        return fbuffer->entry;
+}
+EXPORT_SYMBOL_GPL(ftrace_event_buffer_reserve);
+void ftrace_event_buffer_commit(struct ftrace_event_buffer *fbuffer)
+{
+        event_trigger_unlock_commit(fbuffer->ftrace_file, fbuffer->buffer,
+                                    fbuffer->event, fbuffer->entry,
+                                    fbuffer->flags, fbuffer->pc);
+}
+EXPORT_SYMBOL_GPL(ftrace_event_buffer_commit);
 int ftrace_event_reg(struct ftrace_event_call *call,
                     enum trace_reg type, void *data)
 {
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index 38fe1483c508..5b781d2be383 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -13,32 +13,106 @@
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 #include "trace.h"
-/* function tracing enabled */
+static void tracing_start_function_trace(struct trace_array *tr);
-static int                      ftrace_function_enabled;
+static void tracing_stop_function_trace(struct trace_array *tr);
+static void
+function_trace_call(unsigned long ip, unsigned long parent_ip,
+                    struct ftrace_ops *op, struct pt_regs *pt_regs);
+static void
+function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
+                          struct ftrace_ops *op, struct pt_regs *pt_regs);
+static struct ftrace_ops trace_ops;
+static struct ftrace_ops trace_stack_ops;
+static struct tracer_flags func_flags;
+/* Our option */
+enum {
+        TRACE_FUNC_OPT_STACK    = 0x1,
+};
+static int allocate_ftrace_ops(struct trace_array *tr)
+{
+        struct ftrace_ops *ops;
+        ops = kzalloc(sizeof(*ops), GFP_KERNEL);
+        if (!ops)
+                return -ENOMEM;
-static struct trace_array       *func_trace;
+        /* Currently only the non stack verision is supported */
+        ops->func = function_trace_call;
+        ops->flags = FTRACE_OPS_FL_RECURSION_SAFE;
+        tr->ops = ops;
+        ops->private = tr;
+        return 0;
+}
+int ftrace_create_function_files(struct trace_array *tr,
+                                 struct dentry *parent)
+{
+        int ret;
+        /* The top level array uses the "global_ops". */
+        if (!(tr->flags & TRACE_ARRAY_FL_GLOBAL)) {
+                ret = allocate_ftrace_ops(tr);
+                if (ret)
+                        return ret;
+        }
+        ftrace_create_filter_files(tr->ops, parent);
+        return 0;
+}
-static void tracing_start_function_trace(void);
+void ftrace_destroy_function_files(struct trace_array *tr)
-static void tracing_stop_function_trace(void);
+{
+        ftrace_destroy_filter_files(tr->ops);
+        kfree(tr->ops);
+        tr->ops = NULL;
+}
 static int function_trace_init(struct trace_array *tr)
 {
-        func_trace = tr;
+        struct ftrace_ops *ops;
+        if (tr->flags & TRACE_ARRAY_FL_GLOBAL) {
+                /* There's only one global tr */
+                if (!trace_ops.private) {
+                        trace_ops.private = tr;
+                        trace_stack_ops.private = tr;
+                }
+                if (func_flags.val & TRACE_FUNC_OPT_STACK)
+                        ops = &trace_stack_ops;
+                else
+                        ops = &trace_ops;
+                tr->ops = ops;
+        } else if (!tr->ops) {
+                /*
+                 * Instance trace_arrays get their ops allocated
+                 * at instance creation. Unless it failed
+                 * the allocation.
+                 */
+                return -ENOMEM;
+        }
        tr->trace_buffer.cpu = get_cpu();
        put_cpu();
        tracing_start_cmdline_record();
-        tracing_start_function_trace();
+        tracing_start_function_trace(tr);
        return 0;
 }
 static void function_trace_reset(struct trace_array *tr)
 {
-        tracing_stop_function_trace();
+        tracing_stop_function_trace(tr);
        tracing_stop_cmdline_record();
 }
@@ -47,25 +121,18 @@ static void function_trace_start(struct trace_array *tr)
        tracing_reset_online_cpus(&tr->trace_buffer);
 }
-/* Our option */
-enum {
-        TRACE_FUNC_OPT_STACK    = 0x1,
-};
-static struct tracer_flags func_flags;
 static void
 function_trace_call(unsigned long ip, unsigned long parent_ip,
                    struct ftrace_ops *op, struct pt_regs *pt_regs)
 {
-        struct trace_array *tr = func_trace;
+        struct trace_array *tr = op->private;
        struct trace_array_cpu *data;
        unsigned long flags;
        int bit;
        int cpu;
        int pc;
-        if (unlikely(!ftrace_function_enabled))
+        if (unlikely(!tr->function_enabled))
                return;
        pc = preempt_count();
@@ -91,14 +158,14 @@ static void
 function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
                          struct ftrace_ops *op, struct pt_regs *pt_regs)
 {
-        struct trace_array *tr = func_trace;
+        struct trace_array *tr = op->private;
        struct trace_array_cpu *data;
        unsigned long flags;
        long disabled;
        int cpu;
        int pc;
-        if (unlikely(!ftrace_function_enabled))
+        if (unlikely(!tr->function_enabled))
                return;
        /*
@@ -128,7 +195,6 @@ function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
        local_irq_restore(flags);
 }
 static struct ftrace_ops trace_ops __read_mostly =
 {
        .func = function_trace_call,
@@ -153,29 +219,21 @@ static struct tracer_flags func_flags = {
        .opts = func_opts
 };
-static void tracing_start_function_trace(void)
+static void tracing_start_function_trace(struct trace_array *tr)
 {
-        ftrace_function_enabled = 0;
+        tr->function_enabled = 0;
+        register_ftrace_function(tr->ops);
-        if (func_flags.val & TRACE_FUNC_OPT_STACK)
+        tr->function_enabled = 1;
-                register_ftrace_function(&trace_stack_ops);
-        else
-                register_ftrace_function(&trace_ops);
-        ftrace_function_enabled = 1;
 }
-static void tracing_stop_function_trace(void)
+static void tracing_stop_function_trace(struct trace_array *tr)
 {
-        ftrace_function_enabled = 0;
+        tr->function_enabled = 0;
+        unregister_ftrace_function(tr->ops);
-        if (func_flags.val & TRACE_FUNC_OPT_STACK)
-                unregister_ftrace_function(&trace_stack_ops);
-        else
-                unregister_ftrace_function(&trace_ops);
 }
-static int func_set_flag(u32 old_flags, u32 bit, int set)
+static int
+func_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        switch (bit) {
        case TRACE_FUNC_OPT_STACK:
@@ -183,12 +241,14 @@ static int func_set_flag(u32 old_flags, u32 bit, int set)
                if (!!set == !!(func_flags.val & TRACE_FUNC_OPT_STACK))
                        break;
+                unregister_ftrace_function(tr->ops);
                if (set) {
-                        unregister_ftrace_function(&trace_ops);
+                        tr->ops = &trace_stack_ops;
-                        register_ftrace_function(&trace_stack_ops);
+                        register_ftrace_function(tr->ops);
                } else {
-                        unregister_ftrace_function(&trace_stack_ops);
+                        tr->ops = &trace_ops;
-                        register_ftrace_function(&trace_ops);
+                        register_ftrace_function(tr->ops);
                }
                break;
@@ -208,6 +268,7 @@ static struct tracer function_trace __tracer_data =
        .wait_pipe      = poll_wait_pipe,
        .flags          = &func_flags,
        .set_flag       = func_set_flag,
+        .allow_instances = true,
 #ifdef CONFIG_FTRACE_SELFTEST
        .selftest       = trace_selftest_startup_function,
 #endif
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 0b99120d395c..deff11200261 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -1476,7 +1476,8 @@ void graph_trace_close(struct trace_iterator *iter)
        }
 }
-static int func_graph_set_flag(u32 old_flags, u32 bit, int set)
+static int
+func_graph_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        if (bit == TRACE_GRAPH_PRINT_IRQS)
                ftrace_graph_skip_irqs = !set;
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 887ef88b0bc7..8ff02cbb892f 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -160,7 +160,8 @@ static struct ftrace_ops trace_ops __read_mostly =
 #endif /* CONFIG_FUNCTION_TRACER */
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-static int irqsoff_set_flag(u32 old_flags, u32 bit, int set)
+static int
+irqsoff_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        int cpu;
@@ -266,7 +267,8 @@ __trace_function(struct trace_array *tr,
 #else
 #define __trace_function trace_function
-static int irqsoff_set_flag(u32 old_flags, u32 bit, int set)
+static int
+irqsoff_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        return -EINVAL;
 }
@@ -570,8 +572,10 @@ static void irqsoff_function_set(int set)
                unregister_irqsoff_function(is_graph());
 }
-static int irqsoff_flag_changed(struct tracer *tracer, u32 mask, int set)
+static int irqsoff_flag_changed(struct trace_array *tr, u32 mask, int set)
 {
+        struct tracer *tracer = tr->current_trace;
        if (mask & TRACE_ITER_FUNCTION)
                irqsoff_function_set(set);
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index bdbae450c13e..d021d21dd150 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -35,11 +35,6 @@ struct trace_kprobe {
        struct trace_probe      tp;
 };
-struct event_file_link {
-        struct ftrace_event_file        *file;
-        struct list_head                list;
-};
 #define SIZEOF_TRACE_KPROBE(n)                          \
        (offsetof(struct trace_kprobe, tp.args) +       \
        (sizeof(struct probe_arg) * (n)))
@@ -387,18 +382,6 @@ enable_trace_kprobe(struct trace_kprobe *tk, struct ftrace_event_file *file)
        return ret;
 }
-static struct event_file_link *
-find_event_file_link(struct trace_probe *tp, struct ftrace_event_file *file)
-{
-        struct event_file_link *link;
-        list_for_each_entry(link, &tp->files, list)
-                if (link->file == file)
-                        return link;
-        return NULL;
-}
 /*
 * Disable trace_probe
 * if the file is NULL, disable "perf" handler, or disable "trace" handler.
diff --git a/kernel/trace/trace_nop.c b/kernel/trace/trace_nop.c
index 394f94417e2f..69a5cc94c01a 100644
--- a/kernel/trace/trace_nop.c
+++ b/kernel/trace/trace_nop.c
@@ -62,7 +62,7 @@ static void nop_trace_reset(struct trace_array *tr)
 * If you don't implement it, then the flag setting will be
 * automatically accepted.
 */
-static int nop_set_flag(u32 old_flags, u32 bit, int set)
+static int nop_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        /*
         * Note that you don't need to update nop_flags.val yourself.
@@ -96,6 +96,7 @@ struct tracer nop_trace __read_mostly =
        .selftest       = trace_selftest_startup_nop,
 #endif
        .flags          = &nop_flags,
-        .set_flag       = nop_set_flag
+        .set_flag       = nop_set_flag,
+        .allow_instances = true,
 };
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index ed32284fbe32..ca0e79e2abaa 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -439,6 +439,37 @@ int ftrace_raw_output_prep(struct trace_iterator *iter,
 }
 EXPORT_SYMBOL(ftrace_raw_output_prep);
+static int ftrace_output_raw(struct trace_iterator *iter, char *name,
+                             char *fmt, va_list ap)
+{
+        struct trace_seq *s = &iter->seq;
+        int ret;
+        ret = trace_seq_printf(s, "%s: ", name);
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+        ret = trace_seq_vprintf(s, fmt, ap);
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+        return TRACE_TYPE_HANDLED;
+}
+int ftrace_output_call(struct trace_iterator *iter, char *name, char *fmt, ...)
+{
+        va_list ap;
+        int ret;
+        va_start(ap, fmt);
+        ret = ftrace_output_raw(iter, name, fmt, ap);
+        va_end(ap);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ftrace_output_call);
 #ifdef CONFIG_KRETPROBES
 static inline const char *kretprobed(const char *name)
 {
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index b73574a5f429..fb1ab5dfbd42 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -288,6 +288,11 @@ struct trace_probe {
        struct probe_arg                args[];
 };
+struct event_file_link {
+        struct ftrace_event_file        *file;
+        struct list_head                list;
+};
 static inline bool trace_probe_is_enabled(struct trace_probe *tp)
 {
        return !!(tp->flags & (TP_FLAG_TRACE | TP_FLAG_PROFILE));
@@ -316,6 +321,18 @@ static inline int is_good_name(const char *name)
        return 1;
 }
+static inline struct event_file_link *
+find_event_file_link(struct trace_probe *tp, struct ftrace_event_file *file)
+{
+        struct event_file_link *link;
+        list_for_each_entry(link, &tp->files, list)
+                if (link->file == file)
+                        return link;
+        return NULL;
+}
 extern int traceprobe_parse_probe_arg(char *arg, ssize_t *size,
                   struct probe_arg *parg, bool is_return, bool is_kprobe);
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index 6e32635e5e57..e14da5e97a69 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -179,8 +179,10 @@ static void wakeup_function_set(int set)
                unregister_wakeup_function(is_graph());
 }
-static int wakeup_flag_changed(struct tracer *tracer, u32 mask, int set)
+static int wakeup_flag_changed(struct trace_array *tr, u32 mask, int set)
 {
+        struct tracer *tracer = tr->current_trace;
        if (mask & TRACE_ITER_FUNCTION)
                wakeup_function_set(set);
@@ -209,7 +211,8 @@ static void stop_func_tracer(int graph)
 }
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-static int wakeup_set_flag(u32 old_flags, u32 bit, int set)
+static int
+wakeup_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        if (!(bit & TRACE_DISPLAY_GRAPH))
@@ -311,7 +314,8 @@ __trace_function(struct trace_array *tr,
 #else
 #define __trace_function trace_function
-static int wakeup_set_flag(u32 old_flags, u32 bit, int set)
+static int
+wakeup_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set)
 {
        return -EINVAL;
 }
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index e6be585cf06a..21b320e5d163 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -13,6 +13,7 @@
 #include <linux/sysctl.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/magic.h>
 #include <asm/setup.h>
@@ -144,6 +145,8 @@ check_stack(unsigned long ip, unsigned long *stack)
                        i++;
        }
+        BUG_ON(current != &init_task &&
+                *(end_of_stack(current)) != STACK_END_MAGIC);
 out:
        arch_spin_unlock(&max_stack_lock);
        local_irq_restore(flags);
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 79e52d93860b..e4473367e7a4 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -260,6 +260,7 @@ alloc_trace_uprobe(const char *group, const char *event, int nargs, bool is_ret)
                goto error;
        INIT_LIST_HEAD(&tu->list);
+        INIT_LIST_HEAD(&tu->tp.files);
        tu->consumer.handler = uprobe_dispatcher;
        if (is_ret)
                tu->consumer.ret_handler = uretprobe_dispatcher;
@@ -758,31 +759,32 @@ static void uprobe_buffer_put(struct uprobe_cpu_buffer *ucb)
        mutex_unlock(&ucb->mutex);
 }
-static void uprobe_trace_print(struct trace_uprobe *tu,
+static void __uprobe_trace_func(struct trace_uprobe *tu,
-                                unsigned long func, struct pt_regs *regs)
+                                unsigned long func, struct pt_regs *regs,
+                                struct uprobe_cpu_buffer *ucb, int dsize,
+                                struct ftrace_event_file *ftrace_file)
 {
        struct uprobe_trace_entry_head *entry;
        struct ring_buffer_event *event;
        struct ring_buffer *buffer;
-        struct uprobe_cpu_buffer *ucb;
        void *data;
-        int size, dsize, esize;
+        int size, esize;
        struct ftrace_event_call *call = &tu->tp.call;
-        dsize = __get_data_size(&tu->tp, regs);
+        WARN_ON(call != ftrace_file->event_call);
-        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
-        if (WARN_ON_ONCE(!uprobe_cpu_buffer || tu->tp.size + dsize > PAGE_SIZE))
+        if (WARN_ON_ONCE(tu->tp.size + dsize > PAGE_SIZE))
                return;
-        ucb = uprobe_buffer_get();
+        if (ftrace_trigger_soft_disabled(ftrace_file))
-        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
+                return;
+        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
        size = esize + tu->tp.size + dsize;
-        event = trace_current_buffer_lock_reserve(&buffer, call->event.type,
+        event = trace_event_buffer_lock_reserve(&buffer, ftrace_file,
-                                                  size, 0, 0);
+                                                call->event.type, size, 0, 0);
        if (!event)
-                goto out;
+                return;
        entry = ring_buffer_event_data(event);
        if (is_ret_probe(tu)) {
@@ -796,25 +798,36 @@ static void uprobe_trace_print(struct trace_uprobe *tu,
        memcpy(data, ucb->buf, tu->tp.size + dsize);
-        if (!call_filter_check_discard(call, entry, buffer, event))
+        event_trigger_unlock_commit(ftrace_file, buffer, event, entry, 0, 0);
-                trace_buffer_unlock_commit(buffer, event, 0, 0);
-out:
-        uprobe_buffer_put(ucb);
 }
 /* uprobe handler */
-static int uprobe_trace_func(struct trace_uprobe *tu, struct pt_regs *regs)
+static int uprobe_trace_func(struct trace_uprobe *tu, struct pt_regs *regs,
+                             struct uprobe_cpu_buffer *ucb, int dsize)
 {
-        if (!is_ret_probe(tu))
+        struct event_file_link *link;
-                uprobe_trace_print(tu, 0, regs);
+        if (is_ret_probe(tu))
+                return 0;
+        rcu_read_lock();
+        list_for_each_entry_rcu(link, &tu->tp.files, list)
+                __uprobe_trace_func(tu, 0, regs, ucb, dsize, link->file);
+        rcu_read_unlock();
        return 0;
 }
 static void uretprobe_trace_func(struct trace_uprobe *tu, unsigned long func,
-                                struct pt_regs *regs)
+                                 struct pt_regs *regs,
+                                 struct uprobe_cpu_buffer *ucb, int dsize)
 {
-        uprobe_trace_print(tu, func, regs);
+        struct event_file_link *link;
+        rcu_read_lock();
+        list_for_each_entry_rcu(link, &tu->tp.files, list)
+                __uprobe_trace_func(tu, func, regs, ucb, dsize, link->file);
+        rcu_read_unlock();
 }
 /* Event entry printers */
@@ -861,12 +874,24 @@ typedef bool (*filter_func_t)(struct uprobe_consumer *self,
                                struct mm_struct *mm);
 static int
-probe_event_enable(struct trace_uprobe *tu, int flag, filter_func_t filter)
+probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
+                   filter_func_t filter)
 {
-        int ret = 0;
+        bool enabled = trace_probe_is_enabled(&tu->tp);
+        struct event_file_link *link = NULL;
+        int ret;
+        if (file) {
+                link = kmalloc(sizeof(*link), GFP_KERNEL);
+                if (!link)
+                        return -ENOMEM;
-        if (trace_probe_is_enabled(&tu->tp))
+                link->file = file;
-                return -EINTR;
+                list_add_tail_rcu(&link->list, &tu->tp.files);
+                tu->tp.flags |= TP_FLAG_TRACE;
+        } else
+                tu->tp.flags |= TP_FLAG_PROFILE;
        ret = uprobe_buffer_enable();
        if (ret < 0)
@@ -874,24 +899,49 @@ probe_event_enable(struct trace_uprobe *tu, int flag, filter_func_t filter)
        WARN_ON(!uprobe_filter_is_empty(&tu->filter));
-        tu->tp.flags |= flag;
+        if (enabled)
+                return 0;
        tu->consumer.filter = filter;
        ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
-        if (ret)
+        if (ret) {
-                tu->tp.flags &= ~flag;
+                if (file) {
+                        list_del(&link->list);
+                        kfree(link);
+                        tu->tp.flags &= ~TP_FLAG_TRACE;
+                } else
+                        tu->tp.flags &= ~TP_FLAG_PROFILE;
+        }
        return ret;
 }
-static void probe_event_disable(struct trace_uprobe *tu, int flag)
+static void
+probe_event_disable(struct trace_uprobe *tu, struct ftrace_event_file *file)
 {
        if (!trace_probe_is_enabled(&tu->tp))
                return;
+        if (file) {
+                struct event_file_link *link;
+                link = find_event_file_link(&tu->tp, file);
+                if (!link)
+                        return;
+                list_del_rcu(&link->list);
+                /* synchronize with u{,ret}probe_trace_func */
+                synchronize_sched();
+                kfree(link);
+                if (!list_empty(&tu->tp.files))
+                        return;
+        }
        WARN_ON(!uprobe_filter_is_empty(&tu->filter));
        uprobe_unregister(tu->inode, tu->offset, &tu->consumer);
-        tu->tp.flags &= ~flag;
+        tu->tp.flags &= file ? ~TP_FLAG_TRACE : ~TP_FLAG_PROFILE;
        uprobe_buffer_disable();
 }
@@ -1014,31 +1064,24 @@ static bool uprobe_perf_filter(struct uprobe_consumer *uc,
        return ret;
 }
-static void uprobe_perf_print(struct trace_uprobe *tu,
+static void __uprobe_perf_func(struct trace_uprobe *tu,
-                                unsigned long func, struct pt_regs *regs)
+                               unsigned long func, struct pt_regs *regs,
+                               struct uprobe_cpu_buffer *ucb, int dsize)
 {
        struct ftrace_event_call *call = &tu->tp.call;
        struct uprobe_trace_entry_head *entry;
        struct hlist_head *head;
-        struct uprobe_cpu_buffer *ucb;
        void *data;
-        int size, dsize, esize;
+        int size, esize;
        int rctx;
-        dsize = __get_data_size(&tu->tp, regs);
        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
-        if (WARN_ON_ONCE(!uprobe_cpu_buffer))
-                return;
        size = esize + tu->tp.size + dsize;
        size = ALIGN(size + sizeof(u32), sizeof(u64)) - sizeof(u32);
        if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE, "profile buffer not large enough"))
                return;
-        ucb = uprobe_buffer_get();
-        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
        preempt_disable();
        head = this_cpu_ptr(call->perf_events);
        if (hlist_empty(head))
@@ -1068,46 +1111,49 @@ static void uprobe_perf_print(struct trace_uprobe *tu,
        perf_trace_buf_submit(entry, size, rctx, 0, 1, regs, head, NULL);
 out:
        preempt_enable();
-        uprobe_buffer_put(ucb);
 }
 /* uprobe profile handler */
-static int uprobe_perf_func(struct trace_uprobe *tu, struct pt_regs *regs)
+static int uprobe_perf_func(struct trace_uprobe *tu, struct pt_regs *regs,
+                            struct uprobe_cpu_buffer *ucb, int dsize)
 {
        if (!uprobe_perf_filter(&tu->consumer, 0, current->mm))
                return UPROBE_HANDLER_REMOVE;
        if (!is_ret_probe(tu))
-                uprobe_perf_print(tu, 0, regs);
+                __uprobe_perf_func(tu, 0, regs, ucb, dsize);
        return 0;
 }
 static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
-                                struct pt_regs *regs)
+                                struct pt_regs *regs,
+                                struct uprobe_cpu_buffer *ucb, int dsize)
 {
-        uprobe_perf_print(tu, func, regs);
+        __uprobe_perf_func(tu, func, regs, ucb, dsize);
 }
 #endif  /* CONFIG_PERF_EVENTS */
-static
+static int
-int trace_uprobe_register(struct ftrace_event_call *event, enum trace_reg type, void *data)
+trace_uprobe_register(struct ftrace_event_call *event, enum trace_reg type,
+                      void *data)
 {
        struct trace_uprobe *tu = event->data;
+        struct ftrace_event_file *file = data;
        switch (type) {
        case TRACE_REG_REGISTER:
-                return probe_event_enable(tu, TP_FLAG_TRACE, NULL);
+                return probe_event_enable(tu, file, NULL);
        case TRACE_REG_UNREGISTER:
-                probe_event_disable(tu, TP_FLAG_TRACE);
+                probe_event_disable(tu, file);
                return 0;
 #ifdef CONFIG_PERF_EVENTS
        case TRACE_REG_PERF_REGISTER:
-                return probe_event_enable(tu, TP_FLAG_PROFILE, uprobe_perf_filter);
+                return probe_event_enable(tu, NULL, uprobe_perf_filter);
        case TRACE_REG_PERF_UNREGISTER:
-                probe_event_disable(tu, TP_FLAG_PROFILE);
+                probe_event_disable(tu, NULL);
                return 0;
        case TRACE_REG_PERF_OPEN:
@@ -1127,8 +1173,11 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs)
 {
        struct trace_uprobe *tu;
        struct uprobe_dispatch_data udd;
+        struct uprobe_cpu_buffer *ucb;
+        int dsize, esize;
        int ret = 0;
        tu = container_of(con, struct trace_uprobe, consumer);
        tu->nhit++;
@@ -1137,13 +1186,29 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs)
        current->utask->vaddr = (unsigned long) &udd;
+#ifdef CONFIG_PERF_EVENTS
+        if ((tu->tp.flags & TP_FLAG_TRACE) == 0 &&
+            !uprobe_perf_filter(&tu->consumer, 0, current->mm))
+                return UPROBE_HANDLER_REMOVE;
+#endif
+        if (WARN_ON_ONCE(!uprobe_cpu_buffer))
+                return 0;
+        dsize = __get_data_size(&tu->tp, regs);
+        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
+        ucb = uprobe_buffer_get();
+        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
        if (tu->tp.flags & TP_FLAG_TRACE)
-                ret |= uprobe_trace_func(tu, regs);
+                ret |= uprobe_trace_func(tu, regs, ucb, dsize);
 #ifdef CONFIG_PERF_EVENTS
        if (tu->tp.flags & TP_FLAG_PROFILE)
-                ret |= uprobe_perf_func(tu, regs);
+                ret |= uprobe_perf_func(tu, regs, ucb, dsize);
 #endif
+        uprobe_buffer_put(ucb);
        return ret;
 }
@@ -1152,6 +1217,8 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con,
 {
        struct trace_uprobe *tu;
        struct uprobe_dispatch_data udd;
+        struct uprobe_cpu_buffer *ucb;
+        int dsize, esize;
        tu = container_of(con, struct trace_uprobe, consumer);
@@ -1160,13 +1227,23 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con,
        current->utask->vaddr = (unsigned long) &udd;
+        if (WARN_ON_ONCE(!uprobe_cpu_buffer))
+                return 0;
+        dsize = __get_data_size(&tu->tp, regs);
+        esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
+        ucb = uprobe_buffer_get();
+        store_trace_args(esize, &tu->tp, regs, ucb->buf, dsize);
        if (tu->tp.flags & TP_FLAG_TRACE)
-                uretprobe_trace_func(tu, func, regs);
+                uretprobe_trace_func(tu, func, regs, ucb, dsize);
 #ifdef CONFIG_PERF_EVENTS
        if (tu->tp.flags & TP_FLAG_PROFILE)
-                uretprobe_perf_func(tu, func, regs);
+                uretprobe_perf_func(tu, func, regs, ucb, dsize);
 #endif
+        uprobe_buffer_put(ucb);
        return 0;
 }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 031cc5655a51..fb0a38a26555 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -62,14 +62,12 @@ struct tracepoint_entry {
        struct hlist_node hlist;
        struct tracepoint_func *funcs;
        int refcount;   /* Number of times armed. 0 if disarmed. */
+        int enabled;    /* Tracepoint enabled */
        char name[0];
 };
 struct tp_probes {
-        union {
+        struct rcu_head rcu;
-                struct rcu_head rcu;
-                struct list_head list;
-        } u;
        struct tracepoint_func probes[0];
 };
@@ -82,7 +80,7 @@ static inline void *allocate_probes(int count)
 static void rcu_free_old_probes(struct rcu_head *head)
 {
-        kfree(container_of(head, struct tp_probes, u.rcu));
+        kfree(container_of(head, struct tp_probes, rcu));
 }
 static inline void release_probes(struct tracepoint_func *old)
@@ -90,7 +88,7 @@ static inline void release_probes(struct tracepoint_func *old)
        if (old) {
                struct tp_probes *tp_probes = container_of(old,
                        struct tp_probes, probes[0]);
-                call_rcu_sched(&tp_probes->u.rcu, rcu_free_old_probes);
+                call_rcu_sched(&tp_probes->rcu, rcu_free_old_probes);
        }
 }
@@ -237,6 +235,7 @@ static struct tracepoint_entry *add_tracepoint(const char *name)
        memcpy(&e->name[0], name, name_len);
        e->funcs = NULL;
        e->refcount = 0;
+        e->enabled = 0;
        hlist_add_head(&e->hlist, head);
        return e;
 }
@@ -316,6 +315,7 @@ static void tracepoint_update_probe_range(struct tracepoint * const *begin,
                if (mark_entry) {
                        set_tracepoint(&mark_entry, *iter,
                                        !!mark_entry->refcount);
+                        mark_entry->enabled = !!mark_entry->refcount;
                } else {
                        disable_tracepoint(*iter);
                }
@@ -373,13 +373,26 @@ tracepoint_add_probe(const char *name, void *probe, void *data)
 * tracepoint_probe_register -  Connect a probe to a tracepoint
 * @name: tracepoint name
 * @probe: probe handler
+ * @data: probe private data
+ *
+ * Returns:
+ * - 0 if the probe was successfully registered, and tracepoint
+ *   callsites are currently loaded for that probe,
+ * - -ENODEV if the probe was successfully registered, but no tracepoint
+ *   callsite is currently loaded for that probe,
+ * - other negative error value on error.
+ *
+ * When tracepoint_probe_register() returns either 0 or -ENODEV,
+ * parameters @name, @probe, and @data may be used by the tracepoint
+ * infrastructure until the probe is unregistered.
 *
- * Returns 0 if ok, error value on error.
 * The probe address must at least be aligned on the architecture pointer size.
 */
 int tracepoint_probe_register(const char *name, void *probe, void *data)
 {
        struct tracepoint_func *old;
+        struct tracepoint_entry *entry;
+        int ret = 0;
        mutex_lock(&tracepoints_mutex);
        old = tracepoint_add_probe(name, probe, data);
@@ -388,9 +401,13 @@ int tracepoint_probe_register(const char *name, void *probe, void *data)
                return PTR_ERR(old);
        }
        tracepoint_update_probes();             /* may update entry */
+        entry = get_tracepoint(name);
+        /* Make sure the entry was enabled */
+        if (!entry || !entry->enabled)
+                ret = -ENODEV;
        mutex_unlock(&tracepoints_mutex);
        release_probes(old);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(tracepoint_probe_register);
@@ -415,6 +432,7 @@ tracepoint_remove_probe(const char *name, void *probe, void *data)
 * tracepoint_probe_unregister -  Disconnect a probe from a tracepoint
 * @name: tracepoint name
 * @probe: probe function pointer
+ * @data: probe private data
 *
 * We do not need to call a synchronize_sched to make sure the probes have
 * finished running before doing a module unload, because the module unload
@@ -438,213 +456,26 @@ int tracepoint_probe_unregister(const char *name, void *probe, void *data)
 }
 EXPORT_SYMBOL_GPL(tracepoint_probe_unregister);
-static LIST_HEAD(old_probes);
-static int need_update;
-static void tracepoint_add_old_probes(void *old)
-{
-        need_update = 1;
-        if (old) {
-                struct tp_probes *tp_probes = container_of(old,
-                        struct tp_probes, probes[0]);
-                list_add(&tp_probes->u.list, &old_probes);
-        }
-}
-/**
- * tracepoint_probe_register_noupdate -  register a probe but not connect
- * @name: tracepoint name
- * @probe: probe handler
- *
- * caller must call tracepoint_probe_update_all()
- */
-int tracepoint_probe_register_noupdate(const char *name, void *probe,
-                                       void *data)
-{
-        struct tracepoint_func *old;
-        mutex_lock(&tracepoints_mutex);
-        old = tracepoint_add_probe(name, probe, data);
-        if (IS_ERR(old)) {
-                mutex_unlock(&tracepoints_mutex);
-                return PTR_ERR(old);
-        }
-        tracepoint_add_old_probes(old);
-        mutex_unlock(&tracepoints_mutex);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(tracepoint_probe_register_noupdate);
-/**
- * tracepoint_probe_unregister_noupdate -  remove a probe but not disconnect
- * @name: tracepoint name
- * @probe: probe function pointer
- *
- * caller must call tracepoint_probe_update_all()
- */
-int tracepoint_probe_unregister_noupdate(const char *name, void *probe,
-                                         void *data)
-{
-        struct tracepoint_func *old;
-        mutex_lock(&tracepoints_mutex);
-        old = tracepoint_remove_probe(name, probe, data);
-        if (IS_ERR(old)) {
-                mutex_unlock(&tracepoints_mutex);
-                return PTR_ERR(old);
-        }
-        tracepoint_add_old_probes(old);
-        mutex_unlock(&tracepoints_mutex);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(tracepoint_probe_unregister_noupdate);
-/**
- * tracepoint_probe_update_all -  update tracepoints
- */
-void tracepoint_probe_update_all(void)
-{
-        LIST_HEAD(release_probes);
-        struct tp_probes *pos, *next;
-        mutex_lock(&tracepoints_mutex);
-        if (!need_update) {
-                mutex_unlock(&tracepoints_mutex);
-                return;
-        }
-        if (!list_empty(&old_probes))
-                list_replace_init(&old_probes, &release_probes);
-        need_update = 0;
-        tracepoint_update_probes();
-        mutex_unlock(&tracepoints_mutex);
-        list_for_each_entry_safe(pos, next, &release_probes, u.list) {
-                list_del(&pos->u.list);
-                call_rcu_sched(&pos->u.rcu, rcu_free_old_probes);
-        }
-}
-EXPORT_SYMBOL_GPL(tracepoint_probe_update_all);
-/**
- * tracepoint_get_iter_range - Get a next tracepoint iterator given a range.
- * @tracepoint: current tracepoints (in), next tracepoint (out)
- * @begin: beginning of the range
- * @end: end of the range
- *
- * Returns whether a next tracepoint has been found (1) or not (0).
- * Will return the first tracepoint in the range if the input tracepoint is
- * NULL.
- */
-static int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
-        struct tracepoint * const *begin, struct tracepoint * const *end)
-{
-        if (!*tracepoint && begin != end) {
-                *tracepoint = begin;
-                return 1;
-        }
-        if (*tracepoint >= begin && *tracepoint < end)
-                return 1;
-        return 0;
-}
-#ifdef CONFIG_MODULES
-static void tracepoint_get_iter(struct tracepoint_iter *iter)
-{
-        int found = 0;
-        struct tp_module *iter_mod;
-        /* Core kernel tracepoints */
-        if (!iter->module) {
-                found = tracepoint_get_iter_range(&iter->tracepoint,
-                                __start___tracepoints_ptrs,
-                                __stop___tracepoints_ptrs);
-                if (found)
-                        goto end;
-        }
-        /* Tracepoints in modules */
-        mutex_lock(&tracepoints_mutex);
-        list_for_each_entry(iter_mod, &tracepoint_module_list, list) {
-                /*
-                 * Sorted module list
-                 */
-                if (iter_mod < iter->module)
-                        continue;
-                else if (iter_mod > iter->module)
-                        iter->tracepoint = NULL;
-                found = tracepoint_get_iter_range(&iter->tracepoint,
-                        iter_mod->tracepoints_ptrs,
-                        iter_mod->tracepoints_ptrs
-                                + iter_mod->num_tracepoints);
-                if (found) {
-                        iter->module = iter_mod;
-                        break;
-                }
-        }
-        mutex_unlock(&tracepoints_mutex);
-end:
-        if (!found)
-                tracepoint_iter_reset(iter);
-}
-#else /* CONFIG_MODULES */
-static void tracepoint_get_iter(struct tracepoint_iter *iter)
-{
-        int found = 0;
-        /* Core kernel tracepoints */
-        found = tracepoint_get_iter_range(&iter->tracepoint,
-                        __start___tracepoints_ptrs,
-                        __stop___tracepoints_ptrs);
-        if (!found)
-                tracepoint_iter_reset(iter);
-}
-#endif /* CONFIG_MODULES */
-void tracepoint_iter_start(struct tracepoint_iter *iter)
-{
-        tracepoint_get_iter(iter);
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_start);
-void tracepoint_iter_next(struct tracepoint_iter *iter)
-{
-        iter->tracepoint++;
-        /*
-         * iter->tracepoint may be invalid because we blindly incremented it.
-         * Make sure it is valid by marshalling on the tracepoints, getting the
-         * tracepoints from following modules if necessary.
-         */
-        tracepoint_get_iter(iter);
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_next);
-void tracepoint_iter_stop(struct tracepoint_iter *iter)
-{
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_stop);
-void tracepoint_iter_reset(struct tracepoint_iter *iter)
-{
-#ifdef CONFIG_MODULES
-        iter->module = NULL;
-#endif /* CONFIG_MODULES */
-        iter->tracepoint = NULL;
-}
-EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
 #ifdef CONFIG_MODULES
 bool trace_module_has_bad_taint(struct module *mod)
 {
-        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
+        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP) |
+                               (1 << TAINT_UNSIGNED_MODULE));
 }
 static int tracepoint_module_coming(struct module *mod)
 {
-        struct tp_module *tp_mod, *iter;
+        struct tp_module *tp_mod;
        int ret = 0;
+        if (!mod->num_tracepoints)
+                return 0;
        /*
         * We skip modules that taint the kernel, especially those with different
         * module headers (for forced load), to make sure we don't cause a crash.
-         * Staging and out-of-tree GPL modules are fine.
+         * Staging, out-of-tree, and unsigned GPL modules are fine.
         */
        if (trace_module_has_bad_taint(mod))
                return 0;
@@ -656,23 +487,7 @@ static int tracepoint_module_coming(struct module *mod)
        }
        tp_mod->num_tracepoints = mod->num_tracepoints;
        tp_mod->tracepoints_ptrs = mod->tracepoints_ptrs;
+        list_add_tail(&tp_mod->list, &tracepoint_module_list);
-        /*
-         * tracepoint_module_list is kept sorted by struct module pointer
-         * address for iteration on tracepoints from a seq_file that can release
-         * the mutex between calls.
-         */
-        list_for_each_entry_reverse(iter, &tracepoint_module_list, list) {
-                BUG_ON(iter == tp_mod); /* Should never be in the list twice */
-                if (iter < tp_mod) {
-                        /* We belong to the location right after iter. */
-                        list_add(&tp_mod->list, &iter->list);
-                        goto module_added;
-                }
-        }
-        /* We belong to the beginning of the list */
-        list_add(&tp_mod->list, &tracepoint_module_list);
-module_added:
        tracepoint_update_probe_range(mod->tracepoints_ptrs,
                mod->tracepoints_ptrs + mod->num_tracepoints);
 end:
@@ -684,6 +499,9 @@ static int tracepoint_module_going(struct module *mod)
 {
        struct tp_module *pos;
+        if (!mod->num_tracepoints)
+                return 0;
        mutex_lock(&tracepoints_mutex);
        tracepoint_update_probe_range(mod->tracepoints_ptrs,
                mod->tracepoints_ptrs + mod->num_tracepoints);
diff --git a/kernel/up.c b/kernel/up.c
index 509403e3fbc6..1760bf3d1463 100644
--- a/kernel/up.c
+++ b/kernel/up.c
@@ -22,16 +22,16 @@ int smp_call_function_single(int cpu, void (*func) (void *info), void *info,
 }
 EXPORT_SYMBOL(smp_call_function_single);
-void __smp_call_function_single(int cpu, struct call_single_data *csd,
+int smp_call_function_single_async(int cpu, struct call_single_data *csd)
-                                int wait)
 {
        unsigned long flags;
        local_irq_save(flags);
        csd->func(csd->info);
        local_irq_restore(flags);
+        return 0;
 }
-EXPORT_SYMBOL(__smp_call_function_single);
+EXPORT_SYMBOL(smp_call_function_single_async);
 int on_each_cpu(smp_call_func_t func, void *info, int wait)
 {
diff --git a/kernel/user.c b/kernel/user.c
index c006131beb77..294fc6a94168 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -222,5 +222,4 @@ static int __init uid_cache_init(void)
        return 0;
 }
+subsys_initcall(uid_cache_init);
-module_init(uid_cache_init);
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index dd06439b9c84..0d8f6023fd8d 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -902,4 +902,4 @@ static __init int user_namespaces_init(void)
        user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
        return 0;
 }
-module_init(user_namespaces_init);
+subsys_initcall(user_namespaces_init);
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 4431610f049a..e90089fd78e0 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -158,14 +158,14 @@ void touch_all_softlockup_watchdogs(void)
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 void touch_nmi_watchdog(void)
 {
-        if (watchdog_user_enabled) {
+        /*
-                unsigned cpu;
+         * Using __raw here because some code paths have
+         * preemption enabled.  If preemption is enabled
-                for_each_present_cpu(cpu) {
+         * then interrupts should be enabled too, in which
-                        if (per_cpu(watchdog_nmi_touch, cpu) != true)
+         * case we shouldn't have to worry about the watchdog
-                                per_cpu(watchdog_nmi_touch, cpu) = true;
+         * going off.
-                }
+         */
-        }
+        __raw_get_cpu_var(watchdog_nmi_touch) = true;
        touch_softlockup_watchdog();
 }
 EXPORT_SYMBOL(touch_nmi_watchdog);
@@ -505,7 +505,6 @@ static void restart_watchdog_hrtimer(void *info)
 static void update_timers(int cpu)
 {
-        struct call_single_data data = {.func = restart_watchdog_hrtimer};
        /*
         * Make sure that perf event counter will adopt to a new
         * sampling period. Updating the sampling period directly would
@@ -515,7 +514,7 @@ static void update_timers(int cpu)
         * might be late already so we have to restart the timer as well.
         */
        watchdog_nmi_disable(cpu);
-        __smp_call_function_single(cpu, &data, 1);
+        smp_call_function_single(cpu, restart_watchdog_hrtimer, NULL, 1);
        watchdog_nmi_enable(cpu);
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 3fa5b8f3aae3..0ee63af30bd1 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -516,6 +516,13 @@ void destroy_work_on_stack(struct work_struct *work)
 }
 EXPORT_SYMBOL_GPL(destroy_work_on_stack);
+void destroy_delayed_work_on_stack(struct delayed_work *work)
+{
+        destroy_timer_on_stack(&work->timer);
+        debug_object_free(&work->work, &work_debug_descr);
+}
+EXPORT_SYMBOL_GPL(destroy_delayed_work_on_stack);
 #else
 static inline void debug_work_activate(struct work_struct *work) { }
 static inline void debug_work_deactivate(struct work_struct *work) { }