cgroup: fix spurious lockdep warning in cgroup_exit()
[pandora-kernel.git] / kernel / cgroup.c
index 59dfb02..60fd6f1 100644 (file)
@@ -42,6 +42,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/rwsem.h>
 #include <linux/string.h>
 #include <linux/sort.h>
 #include <linux/kmod.h>
@@ -51,8 +52,8 @@
 #include <linux/pid_namespace.h>
 #include <linux/idr.h>
 #include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
-#include <linux/flex_array.h> /* used in cgroup_attach_task */
 #include <linux/kthread.h>
+#include <linux/delay.h>
 
 #include <linux/atomic.h>
 
@@ -79,12 +80,21 @@ static DEFINE_MUTEX(cgroup_tree_mutex);
 /*
  * cgroup_mutex is the master lock.  Any modification to cgroup or its
  * hierarchy must be performed while holding it.
+ *
+ * css_set_rwsem protects task->cgroups pointer, the list of css_set
+ * objects, and the chain of tasks off each css_set.
+ *
+ * These locks are exported if CONFIG_PROVE_RCU so that accessors in
+ * cgroup.h can use them for lockdep annotations.
  */
 #ifdef CONFIG_PROVE_RCU
 DEFINE_MUTEX(cgroup_mutex);
-EXPORT_SYMBOL_GPL(cgroup_mutex);       /* only for lockdep */
+DECLARE_RWSEM(css_set_rwsem);
+EXPORT_SYMBOL_GPL(cgroup_mutex);
+EXPORT_SYMBOL_GPL(css_set_rwsem);
 #else
 static DEFINE_MUTEX(cgroup_mutex);
+static DECLARE_RWSEM(css_set_rwsem);
 #endif
 
 /*
@@ -128,14 +138,17 @@ static const char *cgroup_subsys_name[] = {
 #undef SUBSYS
 
 /*
- * The dummy hierarchy, reserved for the subsystems that are otherwise
+ * The default hierarchy, reserved for the subsystems that are otherwise
  * unattached - it never has more than a single cgroup, and all tasks are
  * part of that cgroup.
  */
-static struct cgroupfs_root cgroup_dummy_root;
+struct cgroup_root cgrp_dfl_root;
 
-/* dummy_top is a shorthand for the dummy hierarchy's top cgroup */
-static struct cgroup * const cgroup_dummy_top = &cgroup_dummy_root.top_cgroup;
+/*
+ * The default hierarchy always exists but is hidden until mounted for the
+ * first time.  This is for backward compatibility.
+ */
+static bool cgrp_dfl_root_visible;
 
 /* The list of hierarchy roots */
 
@@ -145,8 +158,6 @@ static int cgroup_root_count;
 /* hierarchy ID allocation and mapping, protected by cgroup_mutex */
 static DEFINE_IDR(cgroup_hierarchy_idr);
 
-static struct cgroup_name root_cgroup_name = { .name = "/" };
-
 /*
  * Assign a monotonically increasing serial number to cgroups.  It
  * guarantees cgroups with bigger numbers are newer than those with smaller
@@ -167,8 +178,8 @@ static int need_forkexit_callback __read_mostly;
 static struct cftype cgroup_base_files[];
 
 static void cgroup_put(struct cgroup *cgrp);
-static int rebind_subsystems(struct cgroupfs_root *root,
-                            unsigned long added_mask, unsigned removed_mask);
+static int rebind_subsystems(struct cgroup_root *dst_root,
+                            unsigned long ss_mask);
 static void cgroup_destroy_css_killed(struct cgroup *cgrp);
 static int cgroup_destroy_locked(struct cgroup *cgrp);
 static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
@@ -242,7 +253,6 @@ bool cgroup_is_descendant(struct cgroup *cgrp, struct cgroup *ancestor)
        }
        return false;
 }
-EXPORT_SYMBOL_GPL(cgroup_is_descendant);
 
 static int cgroup_is_releasable(const struct cgroup *cgrp)
 {
@@ -282,8 +292,8 @@ static int notify_on_release(const struct cgroup *cgrp)
        for ((ssid) = 0; (ssid) < CGROUP_SUBSYS_COUNT &&                \
             (((ss) = cgroup_subsys[ssid]) || true); (ssid)++)
 
-/* iterate across the active hierarchies */
-#define for_each_active_root(root)                                     \
+/* iterate across the hierarchies */
+#define for_each_root(root)                                            \
        list_for_each_entry((root), &cgroup_roots, root_list)
 
 /**
@@ -331,23 +341,23 @@ struct cgrp_cset_link {
        struct list_head        cgrp_link;
 };
 
-/* The default css_set - used by init and its children prior to any
+/*
+ * The default css_set - used by init and its children prior to any
  * hierarchies being mounted. It contains a pointer to the root state
  * for each subsystem. Also used to anchor the list of css_sets. Not
  * reference-counted, to improve performance when child cgroups
  * haven't been created.
  */
+static struct css_set init_css_set = {
+       .refcount               = ATOMIC_INIT(1),
+       .cgrp_links             = LIST_HEAD_INIT(init_css_set.cgrp_links),
+       .tasks                  = LIST_HEAD_INIT(init_css_set.tasks),
+       .mg_tasks               = LIST_HEAD_INIT(init_css_set.mg_tasks),
+       .mg_preload_node        = LIST_HEAD_INIT(init_css_set.mg_preload_node),
+       .mg_node                = LIST_HEAD_INIT(init_css_set.mg_node),
+};
 
-static struct css_set init_css_set;
-static struct cgrp_cset_link init_cgrp_cset_link;
-
-/*
- * css_set_lock protects the list of css_set objects, and the chain of
- * tasks off each css_set.  Nests outside task->alloc_lock due to
- * css_task_iter_start().
- */
-static DEFINE_RWLOCK(css_set_lock);
-static int css_set_count;
+static int css_set_count       = 1;    /* 1 for init_css_set */
 
 /*
  * hash table for cgroup groups. This improves the performance to find
@@ -370,30 +380,14 @@ static unsigned long css_set_hash(struct cgroup_subsys_state *css[])
        return key;
 }
 
-/*
- * We don't maintain the lists running through each css_set to its task
- * until after the first call to css_task_iter_start().  This reduces the
- * fork()/exit() overhead for people who have cgroups compiled into their
- * kernel but not actually in use.
- */
-static int use_task_css_set_links __read_mostly;
-
-static void __put_css_set(struct css_set *cset, int taskexit)
+static void put_css_set_locked(struct css_set *cset, bool taskexit)
 {
        struct cgrp_cset_link *link, *tmp_link;
 
-       /*
-        * Ensure that the refcount doesn't hit zero while any readers
-        * can see it. Similar to atomic_dec_and_lock(), but for an
-        * rwlock
-        */
-       if (atomic_add_unless(&cset->refcount, -1, 1))
-               return;
-       write_lock(&css_set_lock);
-       if (!atomic_dec_and_test(&cset->refcount)) {
-               write_unlock(&css_set_lock);
+       lockdep_assert_held(&css_set_rwsem);
+
+       if (!atomic_dec_and_test(&cset->refcount))
                return;
-       }
 
        /* This css_set is dead. unlink it and release cgroup refcounts */
        hash_del(&cset->hlist);
@@ -405,7 +399,7 @@ static void __put_css_set(struct css_set *cset, int taskexit)
                list_del(&link->cset_link);
                list_del(&link->cgrp_link);
 
-               /* @cgrp can't go away while we're holding css_set_lock */
+               /* @cgrp can't go away while we're holding css_set_rwsem */
                if (list_empty(&cgrp->cset_links) && notify_on_release(cgrp)) {
                        if (taskexit)
                                set_bit(CGRP_RELEASABLE, &cgrp->flags);
@@ -415,10 +409,24 @@ static void __put_css_set(struct css_set *cset, int taskexit)
                kfree(link);
        }
 
-       write_unlock(&css_set_lock);
        kfree_rcu(cset, rcu_head);
 }
 
+static void put_css_set(struct css_set *cset, bool taskexit)
+{
+       /*
+        * Ensure that the refcount doesn't hit zero while any readers
+        * can see it. Similar to atomic_dec_and_lock(), but for an
+        * rwlock
+        */
+       if (atomic_add_unless(&cset->refcount, -1, 1))
+               return;
+
+       down_write(&css_set_rwsem);
+       put_css_set_locked(cset, taskexit);
+       up_write(&css_set_rwsem);
+}
+
 /*
  * refcounted get/put for css_set objects
  */
@@ -427,16 +435,6 @@ static inline void get_css_set(struct css_set *cset)
        atomic_inc(&cset->refcount);
 }
 
-static inline void put_css_set(struct css_set *cset)
-{
-       __put_css_set(cset, 0);
-}
-
-static inline void put_css_set_taskexit(struct css_set *cset)
-{
-       __put_css_set(cset, 1);
-}
-
 /**
  * compare_css_sets - helper function for find_existing_css_set().
  * @cset: candidate css_set being tested
@@ -519,7 +517,7 @@ static struct css_set *find_existing_css_set(struct css_set *old_cset,
                                        struct cgroup *cgrp,
                                        struct cgroup_subsys_state *template[])
 {
-       struct cgroupfs_root *root = cgrp->root;
+       struct cgroup_root *root = cgrp->root;
        struct cgroup_subsys *ss;
        struct css_set *cset;
        unsigned long key;
@@ -531,7 +529,7 @@ static struct css_set *find_existing_css_set(struct css_set *old_cset,
         * won't change, so no need for locking.
         */
        for_each_subsys(ss, i) {
-               if (root->subsys_mask & (1UL << i)) {
+               if (root->cgrp.subsys_mask & (1UL << i)) {
                        /* Subsystem is in this hierarchy. So we want
                         * the subsystem state from the new
                         * cgroup */
@@ -636,11 +634,11 @@ static struct css_set *find_css_set(struct css_set *old_cset,
 
        /* First see if we already have a cgroup group that matches
         * the desired set */
-       read_lock(&css_set_lock);
+       down_read(&css_set_rwsem);
        cset = find_existing_css_set(old_cset, cgrp, template);
        if (cset)
                get_css_set(cset);
-       read_unlock(&css_set_lock);
+       up_read(&css_set_rwsem);
 
        if (cset)
                return cset;
@@ -658,13 +656,16 @@ static struct css_set *find_css_set(struct css_set *old_cset,
        atomic_set(&cset->refcount, 1);
        INIT_LIST_HEAD(&cset->cgrp_links);
        INIT_LIST_HEAD(&cset->tasks);
+       INIT_LIST_HEAD(&cset->mg_tasks);
+       INIT_LIST_HEAD(&cset->mg_preload_node);
+       INIT_LIST_HEAD(&cset->mg_node);
        INIT_HLIST_NODE(&cset->hlist);
 
        /* Copy the set of subsystem state objects generated in
         * find_existing_css_set() */
        memcpy(cset->subsys, template, sizeof(cset->subsys));
 
-       write_lock(&css_set_lock);
+       down_write(&css_set_rwsem);
        /* Add reference counts and links from the new css_set. */
        list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) {
                struct cgroup *c = link->cgrp;
@@ -682,26 +683,25 @@ static struct css_set *find_css_set(struct css_set *old_cset,
        key = css_set_hash(cset->subsys);
        hash_add(css_set_table, &cset->hlist, key);
 
-       write_unlock(&css_set_lock);
+       up_write(&css_set_rwsem);
 
        return cset;
 }
 
-static struct cgroupfs_root *cgroup_root_from_kf(struct kernfs_root *kf_root)
+static struct cgroup_root *cgroup_root_from_kf(struct kernfs_root *kf_root)
 {
-       struct cgroup *top_cgrp = kf_root->kn->priv;
+       struct cgroup *root_cgrp = kf_root->kn->priv;
 
-       return top_cgrp->root;
+       return root_cgrp->root;
 }
 
-static int cgroup_init_root_id(struct cgroupfs_root *root, int start, int end)
+static int cgroup_init_root_id(struct cgroup_root *root)
 {
        int id;
 
        lockdep_assert_held(&cgroup_mutex);
 
-       id = idr_alloc_cyclic(&cgroup_hierarchy_idr, root, start, end,
-                             GFP_KERNEL);
+       id = idr_alloc_cyclic(&cgroup_hierarchy_idr, root, 0, 0, GFP_KERNEL);
        if (id < 0)
                return id;
 
@@ -709,7 +709,7 @@ static int cgroup_init_root_id(struct cgroupfs_root *root, int start, int end)
        return 0;
 }
 
-static void cgroup_exit_root_id(struct cgroupfs_root *root)
+static void cgroup_exit_root_id(struct cgroup_root *root)
 {
        lockdep_assert_held(&cgroup_mutex);
 
@@ -719,7 +719,7 @@ static void cgroup_exit_root_id(struct cgroupfs_root *root)
        }
 }
 
-static void cgroup_free_root(struct cgroupfs_root *root)
+static void cgroup_free_root(struct cgroup_root *root)
 {
        if (root) {
                /* hierarhcy ID shoulid already have been released */
@@ -730,58 +730,32 @@ static void cgroup_free_root(struct cgroupfs_root *root)
        }
 }
 
-static void cgroup_get_root(struct cgroupfs_root *root)
+static void cgroup_destroy_root(struct cgroup_root *root)
 {
-       /*
-        * The caller must ensure that @root is alive, which can be
-        * achieved by holding a ref on one of the member cgroups or
-        * following a registered reference to @root while holding
-        * cgroup_tree_mutex.
-        */
-       WARN_ON_ONCE(atomic_read(&root->refcnt) <= 0);
-       atomic_inc(&root->refcnt);
-}
-
-static void cgroup_put_root(struct cgroupfs_root *root)
-{
-       struct cgroup *cgrp = &root->top_cgroup;
+       struct cgroup *cgrp = &root->cgrp;
        struct cgrp_cset_link *link, *tmp_link;
-       int ret;
 
-       /*
-        * @root's refcnt reaching zero and its deregistration should be
-        * atomic w.r.t. cgroup_tree_mutex.  This ensures that
-        * cgroup_get_root() is safe to invoke if @root is registered.
-        */
        mutex_lock(&cgroup_tree_mutex);
-       if (!atomic_dec_and_test(&root->refcnt)) {
-               mutex_unlock(&cgroup_tree_mutex);
-               return;
-       }
        mutex_lock(&cgroup_mutex);
 
-       BUG_ON(root->number_of_cgroups != 1);
+       BUG_ON(atomic_read(&root->nr_cgrps));
        BUG_ON(!list_empty(&cgrp->children));
 
        /* Rebind all subsystems back to the default hierarchy */
-       if (root->flags & CGRP_ROOT_SUBSYS_BOUND) {
-               ret = rebind_subsystems(root, 0, root->subsys_mask);
-               /* Shouldn't be able to fail ... */
-               BUG_ON(ret);
-       }
+       rebind_subsystems(&cgrp_dfl_root, cgrp->subsys_mask);
 
        /*
         * Release all the links from cset_links to this hierarchy's
         * root cgroup
         */
-       write_lock(&css_set_lock);
+       down_write(&css_set_rwsem);
 
        list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
                list_del(&link->cset_link);
                list_del(&link->cgrp_link);
                kfree(link);
        }
-       write_unlock(&css_set_lock);
+       up_write(&css_set_rwsem);
 
        if (!list_empty(&root->root_list)) {
                list_del(&root->root_list);
@@ -797,26 +771,17 @@ static void cgroup_put_root(struct cgroupfs_root *root)
        cgroup_free_root(root);
 }
 
-/*
- * Return the cgroup for "task" from the given hierarchy. Must be
- * called with cgroup_mutex held.
- */
-static struct cgroup *task_cgroup_from_root(struct task_struct *task,
-                                           struct cgroupfs_root *root)
+/* look up cgroup associated with given css_set on the specified hierarchy */
+static struct cgroup *cset_cgroup_from_root(struct css_set *cset,
+                                           struct cgroup_root *root)
 {
-       struct css_set *cset;
        struct cgroup *res = NULL;
 
-       BUG_ON(!mutex_is_locked(&cgroup_mutex));
-       read_lock(&css_set_lock);
-       /*
-        * No need to lock the task - since we hold cgroup_mutex the
-        * task can't change groups, so the only thing that can happen
-        * is that it exits and its css is set back to init_css_set.
-        */
-       cset = task_css_set(task);
+       lockdep_assert_held(&cgroup_mutex);
+       lockdep_assert_held(&css_set_rwsem);
+
        if (cset == &init_css_set) {
-               res = &root->top_cgroup;
+               res = &root->cgrp;
        } else {
                struct cgrp_cset_link *link;
 
@@ -829,16 +794,27 @@ static struct cgroup *task_cgroup_from_root(struct task_struct *task,
                        }
                }
        }
-       read_unlock(&css_set_lock);
+
        BUG_ON(!res);
        return res;
 }
 
 /*
- * There is one global cgroup mutex. We also require taking
- * task_lock() when dereferencing a task's cgroup subsys pointers.
- * See "The task_lock() exception", at the end of this comment.
- *
+ * Return the cgroup for "task" from the given hierarchy. Must be
+ * called with cgroup_mutex and css_set_rwsem held.
+ */
+static struct cgroup *task_cgroup_from_root(struct task_struct *task,
+                                           struct cgroup_root *root)
+{
+       /*
+        * No need to lock the task - since we hold cgroup_mutex the
+        * task can't change groups, so the only thing that can happen
+        * is that it exits and its css is set back to init_css_set.
+        */
+       return cset_cgroup_from_root(task_css_set(task), root);
+}
+
+/*
  * A task must hold cgroup_mutex to modify cgroups.
  *
  * Any task can increment and decrement the count field without lock.
@@ -864,21 +840,9 @@ static struct cgroup *task_cgroup_from_root(struct task_struct *task,
  * A cgroup can only be deleted if both its 'count' of using tasks
  * is zero, and its list of 'children' cgroups is empty.  Since all
  * tasks in the system use _some_ cgroup, and since there is always at
- * least one task in the system (init, pid == 1), therefore, top_cgroup
+ * least one task in the system (init, pid == 1), therefore, root cgroup
  * always has either children cgroups and/or using tasks.  So we don't
- * need a special hack to ensure that top_cgroup cannot be deleted.
- *
- *     The task_lock() exception
- *
- * The need for this exception arises from the action of
- * cgroup_attach_task(), which overwrites one task's cgroup pointer with
- * another.  It does so using cgroup_mutex, however there are
- * several performance critical places that need to reference
- * task->cgroup without the expense of grabbing a system global
- * mutex.  Therefore except as noted below, when dereferencing or, as
- * in cgroup_attach_task(), modifying a task's cgroup pointer we use
- * task_lock(), which acts on a spinlock (task->alloc_lock) already in
- * the task_struct routinely used for such matters.
+ * need a special hack to ensure that root cgroup cannot be deleted.
  *
  * P.S.  One more locking exception.  RCU is used to guard the
  * update of a tasks cgroup pointer by cgroup_attach_task()
@@ -888,17 +852,6 @@ static int cgroup_populate_dir(struct cgroup *cgrp, unsigned long subsys_mask);
 static struct kernfs_syscall_ops cgroup_kf_syscall_ops;
 static const struct file_operations proc_cgroupstats_operations;
 
-static struct cgroup_name *cgroup_alloc_name(const char *name_str)
-{
-       struct cgroup_name *name;
-
-       name = kmalloc(sizeof(*name) + strlen(name_str) + 1, GFP_KERNEL);
-       if (!name)
-               return NULL;
-       strcpy(name->name, name_str);
-       return name;
-}
-
 static char *cgroup_file_name(struct cgroup *cgrp, const struct cftype *cft,
                              char *buf)
 {
@@ -941,26 +894,25 @@ static void cgroup_free_fn(struct work_struct *work)
 {
        struct cgroup *cgrp = container_of(work, struct cgroup, destroy_work);
 
-       mutex_lock(&cgroup_mutex);
-       cgrp->root->number_of_cgroups--;
-       mutex_unlock(&cgroup_mutex);
-
-       /*
-        * We get a ref to the parent, and put the ref when this cgroup is
-        * being freed, so it's guaranteed that the parent won't be
-        * destroyed before its children.
-        */
-       cgroup_put(cgrp->parent);
-
-       /* put the root reference that we took when we created the cgroup */
-       cgroup_put_root(cgrp->root);
-
+       atomic_dec(&cgrp->root->nr_cgrps);
        cgroup_pidlist_destroy_all(cgrp);
 
-       kernfs_put(cgrp->kn);
-
-       kfree(rcu_dereference_raw(cgrp->name));
-       kfree(cgrp);
+       if (cgrp->parent) {
+               /*
+                * We get a ref to the parent, and put the ref when this
+                * cgroup is being freed, so it's guaranteed that the
+                * parent won't be destroyed before its children.
+                */
+               cgroup_put(cgrp->parent);
+               kernfs_put(cgrp->kn);
+               kfree(cgrp);
+       } else {
+               /*
+                * This is root cgroup's refcnt reaching zero, which
+                * indicates that the root should be released.
+                */
+               cgroup_destroy_root(cgrp->root);
+       }
 }
 
 static void cgroup_free_rcu(struct rcu_head *head)
@@ -982,7 +934,7 @@ static void cgroup_put(struct cgroup *cgrp)
 {
        if (!atomic_dec_and_test(&cgrp->refcnt))
                return;
-       if (WARN_ON_ONCE(!cgroup_is_dead(cgrp)))
+       if (WARN_ON_ONCE(cgrp->parent && !cgroup_is_dead(cgrp)))
                return;
 
        /*
@@ -1027,87 +979,97 @@ static void cgroup_clear_dir(struct cgroup *cgrp, unsigned long subsys_mask)
        }
 }
 
-static int rebind_subsystems(struct cgroupfs_root *root,
-                            unsigned long added_mask, unsigned removed_mask)
+static int rebind_subsystems(struct cgroup_root *dst_root,
+                            unsigned long ss_mask)
 {
-       struct cgroup *cgrp = &root->top_cgroup;
        struct cgroup_subsys *ss;
-       int i, ret;
+       int ssid, ret;
 
        lockdep_assert_held(&cgroup_tree_mutex);
        lockdep_assert_held(&cgroup_mutex);
 
-       /* Check that any added subsystems are currently free */
-       for_each_subsys(ss, i)
-               if ((added_mask & (1 << i)) && ss->root != &cgroup_dummy_root)
+       for_each_subsys(ss, ssid) {
+               if (!(ss_mask & (1 << ssid)))
+                       continue;
+
+               /* if @ss is on the dummy_root, we can always move it */
+               if (ss->root == &cgrp_dfl_root)
+                       continue;
+
+               /* if @ss has non-root cgroups attached to it, can't move */
+               if (!list_empty(&ss->root->cgrp.children))
                        return -EBUSY;
 
-       ret = cgroup_populate_dir(cgrp, added_mask);
-       if (ret)
-               return ret;
+               /* can't move between two non-dummy roots either */
+               if (dst_root != &cgrp_dfl_root)
+                       return -EBUSY;
+       }
+
+       ret = cgroup_populate_dir(&dst_root->cgrp, ss_mask);
+       if (ret) {
+               if (dst_root != &cgrp_dfl_root)
+                       return ret;
+
+               /*
+                * Rebinding back to the default root is not allowed to
+                * fail.  Using both default and non-default roots should
+                * be rare.  Moving subsystems back and forth even more so.
+                * Just warn about it and continue.
+                */
+               if (cgrp_dfl_root_visible) {
+                       pr_warning("cgroup: failed to create files (%d) while rebinding 0x%lx to default root\n",
+                                  ret, ss_mask);
+                       pr_warning("cgroup: you may retry by moving them to a different hierarchy and unbinding\n");
+               }
+       }
 
        /*
         * Nothing can fail from this point on.  Remove files for the
         * removed subsystems and rebind each subsystem.
         */
        mutex_unlock(&cgroup_mutex);
-       cgroup_clear_dir(cgrp, removed_mask);
+       for_each_subsys(ss, ssid)
+               if (ss_mask & (1 << ssid))
+                       cgroup_clear_dir(&ss->root->cgrp, 1 << ssid);
        mutex_lock(&cgroup_mutex);
 
-       for_each_subsys(ss, i) {
-               unsigned long bit = 1UL << i;
-
-               if (bit & added_mask) {
-                       /* We're binding this subsystem to this hierarchy */
-                       BUG_ON(cgroup_css(cgrp, ss));
-                       BUG_ON(!cgroup_css(cgroup_dummy_top, ss));
-                       BUG_ON(cgroup_css(cgroup_dummy_top, ss)->cgroup != cgroup_dummy_top);
+       for_each_subsys(ss, ssid) {
+               struct cgroup_root *src_root;
+               struct cgroup_subsys_state *css;
 
-                       rcu_assign_pointer(cgrp->subsys[i],
-                                          cgroup_css(cgroup_dummy_top, ss));
-                       cgroup_css(cgrp, ss)->cgroup = cgrp;
+               if (!(ss_mask & (1 << ssid)))
+                       continue;
 
-                       ss->root = root;
-                       if (ss->bind)
-                               ss->bind(cgroup_css(cgrp, ss));
+               src_root = ss->root;
+               css = cgroup_css(&src_root->cgrp, ss);
 
-                       /* refcount was already taken, and we're keeping it */
-                       root->subsys_mask |= bit;
-               } else if (bit & removed_mask) {
-                       /* We're removing this subsystem */
-                       BUG_ON(cgroup_css(cgrp, ss) != cgroup_css(cgroup_dummy_top, ss));
-                       BUG_ON(cgroup_css(cgrp, ss)->cgroup != cgrp);
+               WARN_ON(!css || cgroup_css(&dst_root->cgrp, ss));
 
-                       if (ss->bind)
-                               ss->bind(cgroup_css(cgroup_dummy_top, ss));
+               RCU_INIT_POINTER(src_root->cgrp.subsys[ssid], NULL);
+               rcu_assign_pointer(dst_root->cgrp.subsys[ssid], css);
+               ss->root = dst_root;
+               css->cgroup = &dst_root->cgrp;
 
-                       cgroup_css(cgroup_dummy_top, ss)->cgroup = cgroup_dummy_top;
-                       RCU_INIT_POINTER(cgrp->subsys[i], NULL);
+               src_root->cgrp.subsys_mask &= ~(1 << ssid);
+               dst_root->cgrp.subsys_mask |= 1 << ssid;
 
-                       cgroup_subsys[i]->root = &cgroup_dummy_root;
-                       root->subsys_mask &= ~bit;
-               }
+               if (ss->bind)
+                       ss->bind(css);
        }
 
-       /*
-        * Mark @root has finished binding subsystems.  @root->subsys_mask
-        * now matches the bound subsystems.
-        */
-       root->flags |= CGRP_ROOT_SUBSYS_BOUND;
-       kernfs_activate(cgrp->kn);
-
+       kernfs_activate(dst_root->cgrp.kn);
        return 0;
 }
 
 static int cgroup_show_options(struct seq_file *seq,
                               struct kernfs_root *kf_root)
 {
-       struct cgroupfs_root *root = cgroup_root_from_kf(kf_root);
+       struct cgroup_root *root = cgroup_root_from_kf(kf_root);
        struct cgroup_subsys *ss;
        int ssid;
 
        for_each_subsys(ss, ssid)
-               if (root->subsys_mask & (1 << ssid))
+               if (root->cgrp.subsys_mask & (1 << ssid))
                        seq_printf(seq, ",%s", ss->name);
        if (root->flags & CGRP_ROOT_SANE_BEHAVIOR)
                seq_puts(seq, ",sane_behavior");
@@ -1121,7 +1083,7 @@ static int cgroup_show_options(struct seq_file *seq,
                seq_printf(seq, ",release_agent=%s", root->release_agent_path);
        spin_unlock(&release_agent_path_lock);
 
-       if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags))
+       if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags))
                seq_puts(seq, ",clone_children");
        if (strlen(root->name))
                seq_printf(seq, ",name=%s", root->name);
@@ -1245,33 +1207,34 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
                        return -ENOENT;
        }
 
-       /*
-        * If the 'all' option was specified select all the subsystems,
-        * otherwise if 'none', 'name=' and a subsystem name options
-        * were not specified, let's default to 'all'
-        */
-       if (all_ss || (!one_ss && !opts->none && !opts->name))
-               for_each_subsys(ss, i)
-                       if (!ss->disabled)
-                               set_bit(i, &opts->subsys_mask);
-
        /* Consistency checks */
 
        if (opts->flags & CGRP_ROOT_SANE_BEHAVIOR) {
                pr_warning("cgroup: sane_behavior: this is still under development and its behaviors will change, proceed at your own risk\n");
 
-               if (opts->flags & CGRP_ROOT_NOPREFIX) {
-                       pr_err("cgroup: sane_behavior: noprefix is not allowed\n");
+               if ((opts->flags & (CGRP_ROOT_NOPREFIX | CGRP_ROOT_XATTR)) ||
+                   opts->cpuset_clone_children || opts->release_agent ||
+                   opts->name) {
+                       pr_err("cgroup: sane_behavior: noprefix, xattr, clone_children, release_agent and name are not allowed\n");
                        return -EINVAL;
                }
+       } else {
+               /*
+                * If the 'all' option was specified select all the
+                * subsystems, otherwise if 'none', 'name=' and a subsystem
+                * name options were not specified, let's default to 'all'
+                */
+               if (all_ss || (!one_ss && !opts->none && !opts->name))
+                       for_each_subsys(ss, i)
+                               if (!ss->disabled)
+                                       set_bit(i, &opts->subsys_mask);
 
-               if (opts->cpuset_clone_children) {
-                       pr_err("cgroup: sane_behavior: clone_children is not allowed\n");
+               /*
+                * We either have to specify by name or by subsystems. (So
+                * all empty hierarchies must have a name).
+                */
+               if (!opts->subsys_mask && !opts->name)
                        return -EINVAL;
-               }
-
-               if (opts->flags & CGRP_ROOT_XATTR)
-                       pr_warning("cgroup: sane_behavior: xattr is always available, flag unnecessary\n");
        }
 
        /*
@@ -1287,20 +1250,13 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
        if (opts->subsys_mask && opts->none)
                return -EINVAL;
 
-       /*
-        * We either have to specify by name or by subsystems. (So all
-        * empty hierarchies must have a name).
-        */
-       if (!opts->subsys_mask && !opts->name)
-               return -EINVAL;
-
        return 0;
 }
 
 static int cgroup_remount(struct kernfs_root *kf_root, int *flags, char *data)
 {
        int ret = 0;
-       struct cgroupfs_root *root = cgroup_root_from_kf(kf_root);
+       struct cgroup_root *root = cgroup_root_from_kf(kf_root);
        struct cgroup_sb_opts opts;
        unsigned long added_mask, removed_mask;
 
@@ -1317,12 +1273,12 @@ static int cgroup_remount(struct kernfs_root *kf_root, int *flags, char *data)
        if (ret)
                goto out_unlock;
 
-       if (opts.subsys_mask != root->subsys_mask || opts.release_agent)
+       if (opts.subsys_mask != root->cgrp.subsys_mask || opts.release_agent)
                pr_warning("cgroup: option changes via remount are deprecated (pid=%d comm=%s)\n",
                           task_tgid_nr(current), current->comm);
 
-       added_mask = opts.subsys_mask & ~root->subsys_mask;
-       removed_mask = root->subsys_mask & ~opts.subsys_mask;
+       added_mask = opts.subsys_mask & ~root->cgrp.subsys_mask;
+       removed_mask = root->cgrp.subsys_mask & ~opts.subsys_mask;
 
        /* Don't allow flags or name to change at remount */
        if (((opts.flags ^ root->flags) & CGRP_ROOT_OPTION_MASK) ||
@@ -1335,15 +1291,17 @@ static int cgroup_remount(struct kernfs_root *kf_root, int *flags, char *data)
        }
 
        /* remounting is not allowed for populated hierarchies */
-       if (root->number_of_cgroups > 1) {
+       if (!list_empty(&root->cgrp.children)) {
                ret = -EBUSY;
                goto out_unlock;
        }
 
-       ret = rebind_subsystems(root, added_mask, removed_mask);
+       ret = rebind_subsystems(root, added_mask);
        if (ret)
                goto out_unlock;
 
+       rebind_subsystems(&cgrp_dfl_root, removed_mask);
+
        if (opts.release_agent) {
                spin_lock(&release_agent_path_lock);
                strcpy(root->release_agent_path, opts.release_agent);
@@ -1357,6 +1315,58 @@ static int cgroup_remount(struct kernfs_root *kf_root, int *flags, char *data)
        return ret;
 }
 
+/*
+ * To reduce the fork() overhead for systems that are not actually using
+ * their cgroups capability, we don't maintain the lists running through
+ * each css_set to its tasks until we see the list actually used - in other
+ * words after the first mount.
+ */
+static bool use_task_css_set_links __read_mostly;
+
+static void cgroup_enable_task_cg_lists(void)
+{
+       struct task_struct *p, *g;
+
+       down_write(&css_set_rwsem);
+
+       if (use_task_css_set_links)
+               goto out_unlock;
+
+       use_task_css_set_links = true;
+
+       /*
+        * We need tasklist_lock because RCU is not safe against
+        * while_each_thread(). Besides, a forking task that has passed
+        * cgroup_post_fork() without seeing use_task_css_set_links = 1
+        * is not guaranteed to have its child immediately visible in the
+        * tasklist if we walk through it with RCU.
+        */
+       read_lock(&tasklist_lock);
+       do_each_thread(g, p) {
+               WARN_ON_ONCE(!list_empty(&p->cg_list) ||
+                            task_css_set(p) != &init_css_set);
+
+               /*
+                * We should check if the process is exiting, otherwise
+                * it will race with cgroup_exit() in that the list
+                * entry won't be deleted though the process has exited.
+                * Do it while holding siglock so that we don't end up
+                * racing against cgroup_exit().
+                */
+               spin_lock_irq(&p->sighand->siglock);
+               if (!(p->flags & PF_EXITING)) {
+                       struct css_set *cset = task_css_set(p);
+
+                       list_add(&p->cg_list, &cset->tasks);
+                       get_css_set(cset);
+               }
+               spin_unlock_irq(&p->sighand->siglock);
+       } while_each_thread(g, p);
+       read_unlock(&tasklist_lock);
+out_unlock:
+       up_write(&css_set_rwsem);
+}
+
 static void init_cgroup_housekeeping(struct cgroup *cgrp)
 {
        atomic_set(&cgrp->refcnt, 1);
@@ -1369,55 +1379,30 @@ static void init_cgroup_housekeeping(struct cgroup *cgrp)
        cgrp->dummy_css.cgroup = cgrp;
 }
 
-static void init_cgroup_root(struct cgroupfs_root *root)
+static void init_cgroup_root(struct cgroup_root *root,
+                            struct cgroup_sb_opts *opts)
 {
-       struct cgroup *cgrp = &root->top_cgroup;
+       struct cgroup *cgrp = &root->cgrp;
 
-       atomic_set(&root->refcnt, 1);
        INIT_LIST_HEAD(&root->root_list);
-       root->number_of_cgroups = 1;
+       atomic_set(&root->nr_cgrps, 1);
        cgrp->root = root;
-       RCU_INIT_POINTER(cgrp->name, &root_cgroup_name);
        init_cgroup_housekeeping(cgrp);
        idr_init(&root->cgroup_idr);
-}
-
-static struct cgroupfs_root *cgroup_root_from_opts(struct cgroup_sb_opts *opts)
-{
-       struct cgroupfs_root *root;
 
-       if (!opts->subsys_mask && !opts->none)
-               return ERR_PTR(-EINVAL);
-
-       root = kzalloc(sizeof(*root), GFP_KERNEL);
-       if (!root)
-               return ERR_PTR(-ENOMEM);
-
-       init_cgroup_root(root);
-
-       /*
-        * We need to set @root->subsys_mask now so that @root can be
-        * matched by cgroup_test_super() before it finishes
-        * initialization; otherwise, competing mounts with the same
-        * options may try to bind the same subsystems instead of waiting
-        * for the first one leading to unexpected mount errors.
-        * SUBSYS_BOUND will be set once actual binding is complete.
-        */
-       root->subsys_mask = opts->subsys_mask;
        root->flags = opts->flags;
        if (opts->release_agent)
                strcpy(root->release_agent_path, opts->release_agent);
        if (opts->name)
                strcpy(root->name, opts->name);
        if (opts->cpuset_clone_children)
-               set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags);
-       return root;
+               set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);
 }
 
-static int cgroup_setup_root(struct cgroupfs_root *root)
+static int cgroup_setup_root(struct cgroup_root *root, unsigned long ss_mask)
 {
        LIST_HEAD(tmp_links);
-       struct cgroup *root_cgrp = &root->top_cgroup;
+       struct cgroup *root_cgrp = &root->cgrp;
        struct css_set *cset;
        int i, ret;
 
@@ -1430,7 +1415,7 @@ static int cgroup_setup_root(struct cgroupfs_root *root)
        root_cgrp->id = ret;
 
        /*
-        * We're accessing css_set_count without locking css_set_lock here,
+        * We're accessing css_set_count without locking css_set_rwsem here,
         * but that's OK - it can only be increased by someone holding
         * cgroup_lock, and that's us. The worst that can happen is that we
         * have some link structures left over
@@ -1439,8 +1424,7 @@ static int cgroup_setup_root(struct cgroupfs_root *root)
        if (ret)
                goto out;
 
-       /* ID 0 is reserved for dummy root, 1 for unified hierarchy */
-       ret = cgroup_init_root_id(root, 2, 0);
+       ret = cgroup_init_root_id(root);
        if (ret)
                goto out;
 
@@ -1457,7 +1441,7 @@ static int cgroup_setup_root(struct cgroupfs_root *root)
        if (ret)
                goto destroy_root;
 
-       ret = rebind_subsystems(root, root->subsys_mask, 0);
+       ret = rebind_subsystems(root, ss_mask);
        if (ret)
                goto destroy_root;
 
@@ -1470,16 +1454,16 @@ static int cgroup_setup_root(struct cgroupfs_root *root)
        cgroup_root_count++;
 
        /*
-        * Link the top cgroup in this hierarchy into all the css_set
+        * Link the root cgroup in this hierarchy into all the css_set
         * objects.
         */
-       write_lock(&css_set_lock);
+       down_write(&css_set_rwsem);
        hash_for_each(css_set_table, i, cset, hlist)
                link_css_set(&tmp_links, cset, root_cgrp);
-       write_unlock(&css_set_lock);
+       up_write(&css_set_rwsem);
 
        BUG_ON(!list_empty(&root_cgrp->children));
-       BUG_ON(root->number_of_cgroups != 1);
+       BUG_ON(atomic_read(&root->nr_cgrps) != 1);
 
        kernfs_activate(root_cgrp->kn);
        ret = 0;
@@ -1499,11 +1483,18 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                         int flags, const char *unused_dev_name,
                         void *data)
 {
-       struct cgroupfs_root *root;
+       struct cgroup_root *root;
        struct cgroup_sb_opts opts;
        struct dentry *dentry;
        int ret;
 
+       /*
+        * The first time anyone tries to mount a cgroup, enable the list
+        * linking each css_set to its tasks and fix up all existing tasks.
+        */
+       if (!use_task_css_set_links)
+               cgroup_enable_task_cg_lists();
+retry:
        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
 
@@ -1513,9 +1504,20 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                goto out_unlock;
 
        /* look for a matching existing root */
-       for_each_active_root(root) {
+       if (!opts.subsys_mask && !opts.none && !opts.name) {
+               cgrp_dfl_root_visible = true;
+               root = &cgrp_dfl_root;
+               cgroup_get(&root->cgrp);
+               ret = 0;
+               goto out_unlock;
+       }
+
+       for_each_root(root) {
                bool name_match = false;
 
+               if (root == &cgrp_dfl_root)
+                       continue;
+
                /*
                 * If we asked for a name then it must match.  Also, if
                 * name matches but sybsys_mask doesn't, we should fail.
@@ -1532,7 +1534,7 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 * subsystems) then they must match.
                 */
                if ((opts.subsys_mask || opts.none) &&
-                   (opts.subsys_mask != root->subsys_mask)) {
+                   (opts.subsys_mask != root->cgrp.subsys_mask)) {
                        if (!name_match)
                                continue;
                        ret = -EBUSY;
@@ -1549,18 +1551,45 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                        }
                }
 
-               cgroup_get_root(root);
+               /*
+                * A root's lifetime is governed by its root cgroup.  Zero
+                * ref indicate that the root is being destroyed.  Wait for
+                * destruction to complete so that the subsystems are free.
+                * We can use wait_queue for the wait but this path is
+                * super cold.  Let's just sleep for a bit and retry.
+                */
+               if (!atomic_inc_not_zero(&root->cgrp.refcnt)) {
+                       mutex_unlock(&cgroup_mutex);
+                       mutex_unlock(&cgroup_tree_mutex);
+                       kfree(opts.release_agent);
+                       kfree(opts.name);
+                       msleep(10);
+                       goto retry;
+               }
+
+               ret = 0;
+               goto out_unlock;
+       }
+
+       /*
+        * No such thing, create a new one.  name= matching without subsys
+        * specification is allowed for already existing hierarchies but we
+        * can't create new one without subsys specification.
+        */
+       if (!opts.subsys_mask && !opts.none) {
+               ret = -EINVAL;
                goto out_unlock;
        }
 
-       /* no such thing, create a new one */
-       root = cgroup_root_from_opts(&opts);
-       if (IS_ERR(root)) {
-               ret = PTR_ERR(root);
+       root = kzalloc(sizeof(*root), GFP_KERNEL);
+       if (!root) {
+               ret = -ENOMEM;
                goto out_unlock;
        }
 
-       ret = cgroup_setup_root(root);
+       init_cgroup_root(root, &opts);
+
+       ret = cgroup_setup_root(root, opts.subsys_mask);
        if (ret)
                cgroup_free_root(root);
 
@@ -1576,16 +1605,16 @@ out_unlock:
 
        dentry = kernfs_mount(fs_type, flags, root->kf_root);
        if (IS_ERR(dentry))
-               cgroup_put_root(root);
+               cgroup_put(&root->cgrp);
        return dentry;
 }
 
 static void cgroup_kill_sb(struct super_block *sb)
 {
        struct kernfs_root *kf_root = kernfs_root_from_sb(sb);
-       struct cgroupfs_root *root = cgroup_root_from_kf(kf_root);
+       struct cgroup_root *root = cgroup_root_from_kf(kf_root);
 
-       cgroup_put_root(root);
+       cgroup_put(&root->cgrp);
        kernfs_kill_sb(sb);
 }
 
@@ -1597,57 +1626,6 @@ static struct file_system_type cgroup_fs_type = {
 
 static struct kobject *cgroup_kobj;
 
-/**
- * cgroup_path - generate the path of a cgroup
- * @cgrp: the cgroup in question
- * @buf: the buffer to write the path into
- * @buflen: the length of the buffer
- *
- * Writes path of cgroup into buf.  Returns 0 on success, -errno on error.
- *
- * We can't generate cgroup path using dentry->d_name, as accessing
- * dentry->name must be protected by irq-unsafe dentry->d_lock or parent
- * inode's i_mutex, while on the other hand cgroup_path() can be called
- * with some irq-safe spinlocks held.
- */
-int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
-{
-       int ret = -ENAMETOOLONG;
-       char *start;
-
-       if (!cgrp->parent) {
-               if (strlcpy(buf, "/", buflen) >= buflen)
-                       return -ENAMETOOLONG;
-               return 0;
-       }
-
-       start = buf + buflen - 1;
-       *start = '\0';
-
-       rcu_read_lock();
-       do {
-               const char *name = cgroup_name(cgrp);
-               int len;
-
-               len = strlen(name);
-               if ((start -= len) < buf)
-                       goto out;
-               memcpy(start, name, len);
-
-               if (--start < buf)
-                       goto out;
-               *start = '/';
-
-               cgrp = cgrp->parent;
-       } while (cgrp->parent);
-       ret = 0;
-       memmove(buf, start, buf + buflen - start);
-out:
-       rcu_read_unlock();
-       return ret;
-}
-EXPORT_SYMBOL_GPL(cgroup_path);
-
 /**
  * task_cgroup_path - cgroup path of a task in the first cgroup hierarchy
  * @task: target task
@@ -1659,49 +1637,55 @@ EXPORT_SYMBOL_GPL(cgroup_path);
  * function grabs cgroup_mutex and shouldn't be used inside locks used by
  * cgroup controller callbacks.
  *
- * Returns 0 on success, fails with -%ENAMETOOLONG if @buflen is too short.
+ * Return value is the same as kernfs_path().
  */
-int task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
+char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
 {
-       struct cgroupfs_root *root;
+       struct cgroup_root *root;
        struct cgroup *cgrp;
-       int hierarchy_id = 1, ret = 0;
-
-       if (buflen < 2)
-               return -ENAMETOOLONG;
+       int hierarchy_id = 1;
+       char *path = NULL;
 
        mutex_lock(&cgroup_mutex);
+       down_read(&css_set_rwsem);
 
        root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id);
 
        if (root) {
                cgrp = task_cgroup_from_root(task, root);
-               ret = cgroup_path(cgrp, buf, buflen);
+               path = cgroup_path(cgrp, buf, buflen);
        } else {
                /* if no hierarchy exists, everyone is in "/" */
-               memcpy(buf, "/", 2);
+               if (strlcpy(buf, "/", buflen) < buflen)
+                       path = buf;
        }
 
+       up_read(&css_set_rwsem);
        mutex_unlock(&cgroup_mutex);
-       return ret;
+       return path;
 }
 EXPORT_SYMBOL_GPL(task_cgroup_path);
 
-/*
- * Control Group taskset
- */
-struct task_and_cgroup {
-       struct task_struct      *task;
-       struct cgroup           *cgrp;
-       struct css_set          *cset;
-};
-
+/* used to track tasks and other necessary states during migration */
 struct cgroup_taskset {
-       struct task_and_cgroup  single;
-       struct flex_array       *tc_array;
-       int                     tc_array_len;
-       int                     idx;
-       struct cgroup           *cur_cgrp;
+       /* the src and dst cset list running through cset->mg_node */
+       struct list_head        src_csets;
+       struct list_head        dst_csets;
+
+       /*
+        * Fields for cgroup_taskset_*() iteration.
+        *
+        * Before migration is committed, the target migration tasks are on
+        * ->mg_tasks of the csets on ->src_csets.  After, on ->mg_tasks of
+        * the csets on ->dst_csets.  ->csets point to either ->src_csets
+        * or ->dst_csets depending on whether migration is committed.
+        *
+        * ->cur_csets and ->cur_task point to the current task position
+        * during iteration.
+        */
+       struct list_head        *csets;
+       struct css_set          *cur_cset;
+       struct task_struct      *cur_task;
 };
 
 /**
@@ -1712,15 +1696,11 @@ struct cgroup_taskset {
  */
 struct task_struct *cgroup_taskset_first(struct cgroup_taskset *tset)
 {
-       if (tset->tc_array) {
-               tset->idx = 0;
-               return cgroup_taskset_next(tset);
-       } else {
-               tset->cur_cgrp = tset->single.cgrp;
-               return tset->single.task;
-       }
+       tset->cur_cset = list_first_entry(tset->csets, struct css_set, mg_node);
+       tset->cur_task = NULL;
+
+       return cgroup_taskset_next(tset);
 }
-EXPORT_SYMBOL_GPL(cgroup_taskset_first);
 
 /**
  * cgroup_taskset_next - iterate to the next task in taskset
@@ -1731,48 +1711,36 @@ EXPORT_SYMBOL_GPL(cgroup_taskset_first);
  */
 struct task_struct *cgroup_taskset_next(struct cgroup_taskset *tset)
 {
-       struct task_and_cgroup *tc;
+       struct css_set *cset = tset->cur_cset;
+       struct task_struct *task = tset->cur_task;
 
-       if (!tset->tc_array || tset->idx >= tset->tc_array_len)
-               return NULL;
+       while (&cset->mg_node != tset->csets) {
+               if (!task)
+                       task = list_first_entry(&cset->mg_tasks,
+                                               struct task_struct, cg_list);
+               else
+                       task = list_next_entry(task, cg_list);
 
-       tc = flex_array_get(tset->tc_array, tset->idx++);
-       tset->cur_cgrp = tc->cgrp;
-       return tc->task;
-}
-EXPORT_SYMBOL_GPL(cgroup_taskset_next);
+               if (&task->cg_list != &cset->mg_tasks) {
+                       tset->cur_cset = cset;
+                       tset->cur_task = task;
+                       return task;
+               }
 
-/**
- * cgroup_taskset_cur_css - return the matching css for the current task
- * @tset: taskset of interest
- * @subsys_id: the ID of the target subsystem
- *
- * Return the css for the current (last returned) task of @tset for
- * subsystem specified by @subsys_id.  This function must be preceded by
- * either cgroup_taskset_first() or cgroup_taskset_next().
- */
-struct cgroup_subsys_state *cgroup_taskset_cur_css(struct cgroup_taskset *tset,
-                                                  int subsys_id)
-{
-       return cgroup_css(tset->cur_cgrp, cgroup_subsys[subsys_id]);
-}
-EXPORT_SYMBOL_GPL(cgroup_taskset_cur_css);
+               cset = list_next_entry(cset, mg_node);
+               task = NULL;
+       }
 
-/**
- * cgroup_taskset_size - return the number of tasks in taskset
- * @tset: taskset of interest
- */
-int cgroup_taskset_size(struct cgroup_taskset *tset)
-{
-       return tset->tc_array ? tset->tc_array_len : 1;
+       return NULL;
 }
-EXPORT_SYMBOL_GPL(cgroup_taskset_size);
 
-
-/*
+/**
  * cgroup_task_migrate - move a task from one cgroup to another.
+ * @old_cgrp; the cgroup @tsk is being migrated from
+ * @tsk: the task being migrated
+ * @new_cset: the new css_set @tsk is being attached to
  *
- * Must be called with cgroup_mutex and threadgroup locked.
+ * Must be called with cgroup_mutex, threadgroup and css_set_rwsem locked.
  */
 static void cgroup_task_migrate(struct cgroup *old_cgrp,
                                struct task_struct *tsk,
@@ -1780,6 +1748,9 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
 {
        struct css_set *old_cset;
 
+       lockdep_assert_held(&cgroup_mutex);
+       lockdep_assert_held(&css_set_rwsem);
+
        /*
         * We are synchronized through threadgroup_lock() against PF_EXITING
         * setting such that we can't race against cgroup_exit() changing the
@@ -1788,15 +1759,16 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
        WARN_ON_ONCE(tsk->flags & PF_EXITING);
        old_cset = task_css_set(tsk);
 
-       task_lock(tsk);
+       get_css_set(new_cset);
        rcu_assign_pointer(tsk->cgroups, new_cset);
-       task_unlock(tsk);
 
-       /* Update the css_set linked lists if we're using them */
-       write_lock(&css_set_lock);
-       if (!list_empty(&tsk->cg_list))
-               list_move(&tsk->cg_list, &new_cset->tasks);
-       write_unlock(&css_set_lock);
+       /*
+        * Use move_tail so that cgroup_taskset_first() still returns the
+        * leader after migration.  This works because cgroup_migrate()
+        * ensures that the dst_cset of the leader is the first on the
+        * tset's dst_csets list.
+        */
+       list_move_tail(&tsk->cg_list, &new_cset->mg_tasks);
 
        /*
         * We just gained a reference on old_cset by taking it from the
@@ -1804,100 +1776,199 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
         * we're safe to drop it here; it will be freed under RCU.
         */
        set_bit(CGRP_RELEASABLE, &old_cgrp->flags);
-       put_css_set(old_cset);
+       put_css_set_locked(old_cset, false);
 }
 
 /**
- * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
- * @cgrp: the cgroup to attach to
- * @tsk: the task or the leader of the threadgroup to be attached
- * @threadgroup: attach the whole threadgroup?
+ * cgroup_migrate_finish - cleanup after attach
+ * @preloaded_csets: list of preloaded css_sets
  *
- * Call holding cgroup_mutex and the group_rwsem of the leader. Will take
- * task_lock of @tsk or each thread in the threadgroup individually in turn.
+ * Undo cgroup_migrate_add_src() and cgroup_migrate_prepare_dst().  See
+ * those functions for details.
  */
-static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
-                             bool threadgroup)
+static void cgroup_migrate_finish(struct list_head *preloaded_csets)
 {
-       int retval, i, group_size;
-       struct cgroupfs_root *root = cgrp->root;
-       struct cgroup_subsys_state *css, *failed_css = NULL;
-       /* threadgroup list cursor and array */
-       struct task_struct *leader = tsk;
-       struct task_and_cgroup *tc;
-       struct flex_array *group;
-       struct cgroup_taskset tset = { };
+       struct css_set *cset, *tmp_cset;
 
-       /*
-        * step 0: in order to do expensive, possibly blocking operations for
-        * every thread, we cannot iterate the thread group list, since it needs
-        * rcu or tasklist locked. instead, build an array of all threads in the
-        * group - group_rwsem prevents new threads from appearing, and if
-        * threads exit, this will just be an over-estimate.
-        */
-       if (threadgroup)
-               group_size = get_nr_threads(tsk);
-       else
-               group_size = 1;
-       /* flex_array supports very large thread-groups better than kmalloc. */
-       group = flex_array_alloc(sizeof(*tc), group_size, GFP_KERNEL);
-       if (!group)
-               return -ENOMEM;
-       /* pre-allocate to guarantee space while iterating in rcu read-side. */
-       retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL);
-       if (retval)
-               goto out_free_group_list;
+       lockdep_assert_held(&cgroup_mutex);
+
+       down_write(&css_set_rwsem);
+       list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) {
+               cset->mg_src_cgrp = NULL;
+               cset->mg_dst_cset = NULL;
+               list_del_init(&cset->mg_preload_node);
+               put_css_set_locked(cset, false);
+       }
+       up_write(&css_set_rwsem);
+}
+
+/**
+ * cgroup_migrate_add_src - add a migration source css_set
+ * @src_cset: the source css_set to add
+ * @dst_cgrp: the destination cgroup
+ * @preloaded_csets: list of preloaded css_sets
+ *
+ * Tasks belonging to @src_cset are about to be migrated to @dst_cgrp.  Pin
+ * @src_cset and add it to @preloaded_csets, which should later be cleaned
+ * up by cgroup_migrate_finish().
+ *
+ * This function may be called without holding threadgroup_lock even if the
+ * target is a process.  Threads may be created and destroyed but as long
+ * as cgroup_mutex is not dropped, no new css_set can be put into play and
+ * the preloaded css_sets are guaranteed to cover all migrations.
+ */
+static void cgroup_migrate_add_src(struct css_set *src_cset,
+                                  struct cgroup *dst_cgrp,
+                                  struct list_head *preloaded_csets)
+{
+       struct cgroup *src_cgrp;
+
+       lockdep_assert_held(&cgroup_mutex);
+       lockdep_assert_held(&css_set_rwsem);
+
+       src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root);
+
+       /* nothing to do if this cset already belongs to the cgroup */
+       if (src_cgrp == dst_cgrp)
+               return;
+
+       if (!list_empty(&src_cset->mg_preload_node))
+               return;
+
+       WARN_ON(src_cset->mg_src_cgrp);
+       WARN_ON(!list_empty(&src_cset->mg_tasks));
+       WARN_ON(!list_empty(&src_cset->mg_node));
+
+       src_cset->mg_src_cgrp = src_cgrp;
+       get_css_set(src_cset);
+       list_add(&src_cset->mg_preload_node, preloaded_csets);
+}
+
+/**
+ * cgroup_migrate_prepare_dst - prepare destination css_sets for migration
+ * @dst_cgrp: the destination cgroup
+ * @preloaded_csets: list of preloaded source css_sets
+ *
+ * Tasks are about to be moved to @dst_cgrp and all the source css_sets
+ * have been preloaded to @preloaded_csets.  This function looks up and
+ * pins all destination css_sets, links each to its source, and put them on
+ * @preloaded_csets.
+ *
+ * This function must be called after cgroup_migrate_add_src() has been
+ * called on each migration source css_set.  After migration is performed
+ * using cgroup_migrate(), cgroup_migrate_finish() must be called on
+ * @preloaded_csets.
+ */
+static int cgroup_migrate_prepare_dst(struct cgroup *dst_cgrp,
+                                     struct list_head *preloaded_csets)
+{
+       LIST_HEAD(csets);
+       struct css_set *src_cset;
+
+       lockdep_assert_held(&cgroup_mutex);
+
+       /* look up the dst cset for each src cset and link it to src */
+       list_for_each_entry(src_cset, preloaded_csets, mg_preload_node) {
+               struct css_set *dst_cset;
+
+               dst_cset = find_css_set(src_cset, dst_cgrp);
+               if (!dst_cset)
+                       goto err;
+
+               WARN_ON_ONCE(src_cset->mg_dst_cset || dst_cset->mg_dst_cset);
+               src_cset->mg_dst_cset = dst_cset;
+
+               if (list_empty(&dst_cset->mg_preload_node))
+                       list_add(&dst_cset->mg_preload_node, &csets);
+               else
+                       put_css_set(dst_cset, false);
+       }
+
+       list_splice(&csets, preloaded_csets);
+       return 0;
+err:
+       cgroup_migrate_finish(&csets);
+       return -ENOMEM;
+}
+
+/**
+ * cgroup_migrate - migrate a process or task to a cgroup
+ * @cgrp: the destination cgroup
+ * @leader: the leader of the process or the task to migrate
+ * @threadgroup: whether @leader points to the whole process or a single task
+ *
+ * Migrate a process or task denoted by @leader to @cgrp.  If migrating a
+ * process, the caller must be holding threadgroup_lock of @leader.  The
+ * caller is also responsible for invoking cgroup_migrate_add_src() and
+ * cgroup_migrate_prepare_dst() on the targets before invoking this
+ * function and following up with cgroup_migrate_finish().
+ *
+ * As long as a controller's ->can_attach() doesn't fail, this function is
+ * guaranteed to succeed.  This means that, excluding ->can_attach()
+ * failure, when migrating multiple targets, the success or failure can be
+ * decided for all targets by invoking group_migrate_prepare_dst() before
+ * actually starting migrating.
+ */
+static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
+                         bool threadgroup)
+{
+       struct cgroup_taskset tset = {
+               .src_csets      = LIST_HEAD_INIT(tset.src_csets),
+               .dst_csets      = LIST_HEAD_INIT(tset.dst_csets),
+               .csets          = &tset.src_csets,
+       };
+       struct cgroup_subsys_state *css, *failed_css = NULL;
+       struct css_set *cset, *tmp_cset;
+       struct task_struct *task, *tmp_task;
+       int i, ret;
 
-       i = 0;
        /*
         * Prevent freeing of tasks while we take a snapshot. Tasks that are
         * already PF_EXITING could be freed from underneath us unless we
         * take an rcu_read_lock.
         */
+       down_write(&css_set_rwsem);
        rcu_read_lock();
+       task = leader;
        do {
-               struct task_and_cgroup ent;
+               /* @task either already exited or can't exit until the end */
+               if (task->flags & PF_EXITING)
+                       goto next;
 
-               /* @tsk either already exited or can't exit until the end */
-               if (tsk->flags & PF_EXITING)
+               /* leave @task alone if post_fork() hasn't linked it yet */
+               if (list_empty(&task->cg_list))
                        goto next;
 
-               /* as per above, nr_threads may decrease, but not increase. */
-               BUG_ON(i >= group_size);
-               ent.task = tsk;
-               ent.cgrp = task_cgroup_from_root(tsk, root);
-               /* nothing to do if this task is already in the cgroup */
-               if (ent.cgrp == cgrp)
+               cset = task_css_set(task);
+               if (!cset->mg_src_cgrp)
                        goto next;
+
                /*
-                * saying GFP_ATOMIC has no effect here because we did prealloc
-                * earlier, but it's good form to communicate our expectations.
+                * cgroup_taskset_first() must always return the leader.
+                * Take care to avoid disturbing the ordering.
                 */
-               retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
-               BUG_ON(retval != 0);
-               i++;
+               list_move_tail(&task->cg_list, &cset->mg_tasks);
+               if (list_empty(&cset->mg_node))
+                       list_add_tail(&cset->mg_node, &tset.src_csets);
+               if (list_empty(&cset->mg_dst_cset->mg_node))
+                       list_move_tail(&cset->mg_dst_cset->mg_node,
+                                      &tset.dst_csets);
        next:
                if (!threadgroup)
                        break;
-       } while_each_thread(leader, tsk);
+       } while_each_thread(leader, task);
        rcu_read_unlock();
-       /* remember the number of threads in the array for later. */
-       group_size = i;
-       tset.tc_array = group;
-       tset.tc_array_len = group_size;
+       up_write(&css_set_rwsem);
 
        /* methods shouldn't be called if no task is actually migrating */
-       retval = 0;
-       if (!group_size)
-               goto out_free_group_list;
+       if (list_empty(&tset.src_csets))
+               return 0;
 
-       /*
-        * step 1: check that we can legitimately attach to the cgroup.
-        */
+       /* check that we can legitimately attach to the cgroup */
        for_each_css(css, i, cgrp) {
                if (css->ss->can_attach) {
-                       retval = css->ss->can_attach(css, &tset);
-                       if (retval) {
+                       ret = css->ss->can_attach(css, &tset);
+                       if (ret) {
                                failed_css = css;
                                goto out_cancel_attach;
                        }
@@ -1905,70 +1976,91 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
        }
 
        /*
-        * step 2: make sure css_sets exist for all threads to be migrated.
-        * we use find_css_set, which allocates a new one if necessary.
+        * Now that we're guaranteed success, proceed to move all tasks to
+        * the new cgroup.  There are no failure cases after here, so this
+        * is the commit point.
         */
-       for (i = 0; i < group_size; i++) {
-               struct css_set *old_cset;
-
-               tc = flex_array_get(group, i);
-               old_cset = task_css_set(tc->task);
-               tc->cset = find_css_set(old_cset, cgrp);
-               if (!tc->cset) {
-                       retval = -ENOMEM;
-                       goto out_put_css_set_refs;
-               }
+       down_write(&css_set_rwsem);
+       list_for_each_entry(cset, &tset.src_csets, mg_node) {
+               list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list)
+                       cgroup_task_migrate(cset->mg_src_cgrp, task,
+                                           cset->mg_dst_cset);
        }
+       up_write(&css_set_rwsem);
 
        /*
-        * step 3: now that we're guaranteed success wrt the css_sets,
-        * proceed to move all tasks to the new cgroup.  There are no
-        * failure cases after here, so this is the commit point.
+        * Migration is committed, all target tasks are now on dst_csets.
+        * Nothing is sensitive to fork() after this point.  Notify
+        * controllers that migration is complete.
         */
-       for (i = 0; i < group_size; i++) {
-               tc = flex_array_get(group, i);
-               cgroup_task_migrate(tc->cgrp, tc->task, tc->cset);
-       }
-       /* nothing is sensitive to fork() after this point. */
+       tset.csets = &tset.dst_csets;
 
-       /*
-        * step 4: do subsystem attach callbacks.
-        */
        for_each_css(css, i, cgrp)
                if (css->ss->attach)
                        css->ss->attach(css, &tset);
 
-       /*
-        * step 5: success! and cleanup
-        */
-       retval = 0;
-out_put_css_set_refs:
-       if (retval) {
-               for (i = 0; i < group_size; i++) {
-                       tc = flex_array_get(group, i);
-                       if (!tc->cset)
-                               break;
-                       put_css_set(tc->cset);
-               }
-       }
+       ret = 0;
+       goto out_release_tset;
+
 out_cancel_attach:
-       if (retval) {
-               for_each_css(css, i, cgrp) {
-                       if (css == failed_css)
-                               break;
-                       if (css->ss->cancel_attach)
-                               css->ss->cancel_attach(css, &tset);
-               }
+       for_each_css(css, i, cgrp) {
+               if (css == failed_css)
+                       break;
+               if (css->ss->cancel_attach)
+                       css->ss->cancel_attach(css, &tset);
        }
-out_free_group_list:
-       flex_array_free(group);
-       return retval;
+out_release_tset:
+       down_write(&css_set_rwsem);
+       list_splice_init(&tset.dst_csets, &tset.src_csets);
+       list_for_each_entry_safe(cset, tmp_cset, &tset.src_csets, mg_node) {
+               list_splice_tail_init(&cset->mg_tasks, &cset->tasks);
+               list_del_init(&cset->mg_node);
+       }
+       up_write(&css_set_rwsem);
+       return ret;
+}
+
+/**
+ * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
+ * @dst_cgrp: the cgroup to attach to
+ * @leader: the task or the leader of the threadgroup to be attached
+ * @threadgroup: attach the whole threadgroup?
+ *
+ * Call holding cgroup_mutex and threadgroup_lock of @leader.
+ */
+static int cgroup_attach_task(struct cgroup *dst_cgrp,
+                             struct task_struct *leader, bool threadgroup)
+{
+       LIST_HEAD(preloaded_csets);
+       struct task_struct *task;
+       int ret;
+
+       /* look up all src csets */
+       down_read(&css_set_rwsem);
+       rcu_read_lock();
+       task = leader;
+       do {
+               cgroup_migrate_add_src(task_css_set(task), dst_cgrp,
+                                      &preloaded_csets);
+               if (!threadgroup)
+                       break;
+       } while_each_thread(leader, task);
+       rcu_read_unlock();
+       up_read(&css_set_rwsem);
+
+       /* prepare dst csets and commit */
+       ret = cgroup_migrate_prepare_dst(dst_cgrp, &preloaded_csets);
+       if (!ret)
+               ret = cgroup_migrate(dst_cgrp, leader, threadgroup);
+
+       cgroup_migrate_finish(&preloaded_csets);
+       return ret;
 }
 
 /*
  * Find the task_struct of the task to attach by vpid and pass it along to the
  * function to attach either it or all tasks in its threadgroup. Will lock
- * cgroup_mutex and threadgroup; may take task_lock of task.
+ * cgroup_mutex and threadgroup.
  */
 static int attach_task_by_pid(struct cgroup *cgrp, u64 pid, bool threadgroup)
 {
@@ -2053,12 +2145,19 @@ out_unlock_cgroup:
  */
 int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
 {
-       struct cgroupfs_root *root;
+       struct cgroup_root *root;
        int retval = 0;
 
        mutex_lock(&cgroup_mutex);
-       for_each_active_root(root) {
-               struct cgroup *from_cgrp = task_cgroup_from_root(from, root);
+       for_each_root(root) {
+               struct cgroup *from_cgrp;
+
+               if (root == &cgrp_dfl_root)
+                       continue;
+
+               down_read(&css_set_rwsem);
+               from_cgrp = task_cgroup_from_root(from, root);
+               up_read(&css_set_rwsem);
 
                retval = cgroup_attach_task(from_cgrp, tsk, false);
                if (retval)
@@ -2083,9 +2182,9 @@ static int cgroup_procs_write(struct cgroup_subsys_state *css,
 }
 
 static int cgroup_release_agent_write(struct cgroup_subsys_state *css,
-                                     struct cftype *cft, const char *buffer)
+                                     struct cftype *cft, char *buffer)
 {
-       struct cgroupfs_root *root = css->cgroup->root;
+       struct cgroup_root *root = css->cgroup->root;
 
        BUILD_BUG_ON(sizeof(root->release_agent_path) < PATH_MAX);
        if (!cgroup_lock_live_group(css->cgroup))
@@ -2211,7 +2310,6 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent,
                         const char *new_name_str)
 {
        struct cgroup *cgrp = kn->priv;
-       struct cgroup_name *name, *old_name;
        int ret;
 
        if (kernfs_type(kn) != KERNFS_DIR)
@@ -2226,25 +2324,24 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent,
        if (cgroup_sane_behavior(cgrp))
                return -EPERM;
 
-       name = cgroup_alloc_name(new_name_str);
-       if (!name)
-               return -ENOMEM;
+       /*
+        * We're gonna grab cgroup_tree_mutex which nests outside kernfs
+        * active_ref.  kernfs_rename() doesn't require active_ref
+        * protection.  Break them before grabbing cgroup_tree_mutex.
+        */
+       kernfs_break_active_protection(new_parent);
+       kernfs_break_active_protection(kn);
 
        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
 
        ret = kernfs_rename(kn, new_parent, new_name_str);
-       if (!ret) {
-               old_name = rcu_dereference_protected(cgrp->name, true);
-               rcu_assign_pointer(cgrp->name, name);
-       } else {
-               old_name = name;
-       }
 
        mutex_unlock(&cgroup_mutex);
        mutex_unlock(&cgroup_tree_mutex);
 
-       kfree_rcu(old_name, rcu_head);
+       kernfs_unbreak_active_protection(kn);
+       kernfs_unbreak_active_protection(new_parent);
        return ret;
 }
 
@@ -2260,9 +2357,7 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cftype *cft)
        kn = __kernfs_create_file(cgrp->kn, cgroup_file_name(cgrp, cft, name),
                                  cgroup_file_mode(cft), 0, cft->kf_ops, cft,
                                  NULL, false, key);
-       if (IS_ERR(kn))
-               return PTR_ERR(kn);
-       return 0;
+       return PTR_ERR_OR_ZERO(kn);
 }
 
 /**
@@ -2286,6 +2381,8 @@ static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
 
        for (cft = cfts; cft->name[0] != '\0'; cft++) {
                /* does cft->flags tell us to skip this file on @cgrp? */
+               if ((cft->flags & CFTYPE_ONLY_ON_DFL) && !cgroup_on_dfl(cgrp))
+                       continue;
                if ((cft->flags & CFTYPE_INSANE) && cgroup_sane_behavior(cgrp))
                        continue;
                if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent)
@@ -2311,14 +2408,14 @@ static int cgroup_apply_cftypes(struct cftype *cfts, bool is_add)
 {
        LIST_HEAD(pending);
        struct cgroup_subsys *ss = cfts[0].ss;
-       struct cgroup *root = &ss->root->top_cgroup;
+       struct cgroup *root = &ss->root->cgrp;
        struct cgroup_subsys_state *css;
        int ret = 0;
 
        lockdep_assert_held(&cgroup_tree_mutex);
 
        /* don't bother if @ss isn't attached */
-       if (ss->root == &cgroup_dummy_root)
+       if (ss->root == &cgrp_dfl_root)
                return 0;
 
        /* add/rm files for all cgroups created before */
@@ -2437,6 +2534,9 @@ int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
 {
        int ret;
 
+       if (!cfts || cfts[0].name[0] == '\0')
+               return 0;
+
        ret = cgroup_init_cftypes(ss, cfts);
        if (ret)
                return ret;
@@ -2451,7 +2551,6 @@ int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
        mutex_unlock(&cgroup_tree_mutex);
        return ret;
 }
-EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
 
 /**
  * cgroup_task_count - count the number of tasks in a cgroup.
@@ -2459,52 +2558,18 @@ EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
  *
  * Return the number of tasks in the cgroup.
  */
-int cgroup_task_count(const struct cgroup *cgrp)
+static int cgroup_task_count(const struct cgroup *cgrp)
 {
        int count = 0;
        struct cgrp_cset_link *link;
 
-       read_lock(&css_set_lock);
+       down_read(&css_set_rwsem);
        list_for_each_entry(link, &cgrp->cset_links, cset_link)
                count += atomic_read(&link->cset->refcount);
-       read_unlock(&css_set_lock);
+       up_read(&css_set_rwsem);
        return count;
 }
 
-/*
- * To reduce the fork() overhead for systems that are not actually using
- * their cgroups capability, we don't maintain the lists running through
- * each css_set to its tasks until we see the list actually used - in other
- * words after the first call to css_task_iter_start().
- */
-static void cgroup_enable_task_cg_lists(void)
-{
-       struct task_struct *p, *g;
-       write_lock(&css_set_lock);
-       use_task_css_set_links = 1;
-       /*
-        * We need tasklist_lock because RCU is not safe against
-        * while_each_thread(). Besides, a forking task that has passed
-        * cgroup_post_fork() without seeing use_task_css_set_links = 1
-        * is not guaranteed to have its child immediately visible in the
-        * tasklist if we walk through it with RCU.
-        */
-       read_lock(&tasklist_lock);
-       do_each_thread(g, p) {
-               task_lock(p);
-               /*
-                * We should check if the process is exiting, otherwise
-                * it will race with cgroup_exit() in that the list
-                * entry won't be deleted though the process has exited.
-                */
-               if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
-                       list_add(&p->cg_list, &task_css_set(p)->tasks);
-               task_unlock(p);
-       } while_each_thread(g, p);
-       read_unlock(&tasklist_lock);
-       write_unlock(&css_set_lock);
-}
-
 /**
  * css_next_child - find the next child of a given css
  * @pos_css: the current position (%NULL to initiate traversal)
@@ -2559,7 +2624,6 @@ css_next_child(struct cgroup_subsys_state *pos_css,
 
        return cgroup_css(next, parent_css->ss);
 }
-EXPORT_SYMBOL_GPL(css_next_child);
 
 /**
  * css_next_descendant_pre - find the next descendant for pre-order walk
@@ -2602,7 +2666,6 @@ css_next_descendant_pre(struct cgroup_subsys_state *pos,
 
        return NULL;
 }
-EXPORT_SYMBOL_GPL(css_next_descendant_pre);
 
 /**
  * css_rightmost_descendant - return the rightmost descendant of a css
@@ -2634,7 +2697,6 @@ css_rightmost_descendant(struct cgroup_subsys_state *pos)
 
        return last;
 }
-EXPORT_SYMBOL_GPL(css_rightmost_descendant);
 
 static struct cgroup_subsys_state *
 css_leftmost_descendant(struct cgroup_subsys_state *pos)
@@ -2688,7 +2750,6 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
        /* no sibling left, visit parent */
        return css_parent(pos);
 }
-EXPORT_SYMBOL_GPL(css_next_descendant_post);
 
 /**
  * css_advance_task_iter - advance a task itererator to the next css_set
@@ -2711,9 +2772,14 @@ static void css_advance_task_iter(struct css_task_iter *it)
                }
                link = list_entry(l, struct cgrp_cset_link, cset_link);
                cset = link->cset;
-       } while (list_empty(&cset->tasks));
+       } while (list_empty(&cset->tasks) && list_empty(&cset->mg_tasks));
+
        it->cset_link = l;
-       it->task = cset->tasks.next;
+
+       if (!list_empty(&cset->tasks))
+               it->task = cset->tasks.next;
+       else
+               it->task = cset->mg_tasks.next;
 }
 
 /**
@@ -2732,17 +2798,12 @@ static void css_advance_task_iter(struct css_task_iter *it)
  */
 void css_task_iter_start(struct cgroup_subsys_state *css,
                         struct css_task_iter *it)
-       __acquires(css_set_lock)
+       __acquires(css_set_rwsem)
 {
-       /*
-        * The first time anyone tries to iterate across a css, we need to
-        * enable the list linking each css_set to its tasks, and fix up
-        * all existing tasks.
-        */
-       if (!use_task_css_set_links)
-               cgroup_enable_task_cg_lists();
+       /* no one should try to iterate before mounting cgroups */
+       WARN_ON_ONCE(!use_task_css_set_links);
 
-       read_lock(&css_set_lock);
+       down_read(&css_set_rwsem);
 
        it->origin_css = css;
        it->cset_link = &css->cgroup->cset_links;
@@ -2762,24 +2823,29 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 {
        struct task_struct *res;
        struct list_head *l = it->task;
-       struct cgrp_cset_link *link;
+       struct cgrp_cset_link *link = list_entry(it->cset_link,
+                                       struct cgrp_cset_link, cset_link);
 
        /* If the iterator cg is NULL, we have no tasks */
        if (!it->cset_link)
                return NULL;
        res = list_entry(l, struct task_struct, cg_list);
-       /* Advance iterator to find next entry */
+
+       /*
+        * Advance iterator to find next entry.  cset->tasks is consumed
+        * first and then ->mg_tasks.  After ->mg_tasks, we move onto the
+        * next cset.
+        */
        l = l->next;
-       link = list_entry(it->cset_link, struct cgrp_cset_link, cset_link);
-       if (l == &link->cset->tasks) {
-               /*
-                * We reached the end of this task list - move on to the
-                * next cgrp_cset_link.
-                */
+
+       if (l == &link->cset->tasks)
+               l = link->cset->mg_tasks.next;
+
+       if (l == &link->cset->mg_tasks)
                css_advance_task_iter(it);
-       } else {
+       else
                it->task = l;
-       }
+
        return res;
 }
 
@@ -2790,191 +2856,62 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
  * Finish task iteration started by css_task_iter_start().
  */
 void css_task_iter_end(struct css_task_iter *it)
-       __releases(css_set_lock)
-{
-       read_unlock(&css_set_lock);
-}
-
-static inline int started_after_time(struct task_struct *t1,
-                                    struct timespec *time,
-                                    struct task_struct *t2)
-{
-       int start_diff = timespec_compare(&t1->start_time, time);
-       if (start_diff > 0) {
-               return 1;
-       } else if (start_diff < 0) {
-               return 0;
-       } else {
-               /*
-                * Arbitrarily, if two processes started at the same
-                * time, we'll say that the lower pointer value
-                * started first. Note that t2 may have exited by now
-                * so this may not be a valid pointer any longer, but
-                * that's fine - it still serves to distinguish
-                * between two tasks started (effectively) simultaneously.
-                */
-               return t1 > t2;
-       }
-}
-
-/*
- * This function is a callback from heap_insert() and is used to order
- * the heap.
- * In this case we order the heap in descending task start time.
- */
-static inline int started_after(void *p1, void *p2)
+       __releases(css_set_rwsem)
 {
-       struct task_struct *t1 = p1;
-       struct task_struct *t2 = p2;
-       return started_after_time(t1, &t2->start_time, t2);
+       up_read(&css_set_rwsem);
 }
 
 /**
- * css_scan_tasks - iterate though all the tasks in a css
- * @css: the css to iterate tasks of
- * @test: optional test callback
- * @process: process callback
- * @data: data passed to @test and @process
- * @heap: optional pre-allocated heap used for task iteration
- *
- * Iterate through all the tasks in @css, calling @test for each, and if it
- * returns %true, call @process for it also.
- *
- * @test may be NULL, meaning always true (select all tasks), which
- * effectively duplicates css_task_iter_{start,next,end}() but does not
- * lock css_set_lock for the call to @process.
- *
- * It is guaranteed that @process will act on every task that is a member
- * of @css for the duration of this call.  This function may or may not
- * call @process for tasks that exit or move to a different css during the
- * call, or are forked or move into the css during the call.
- *
- * Note that @test may be called with locks held, and may in some
- * situations be called multiple times for the same task, so it should be
- * cheap.
+ * cgroup_trasnsfer_tasks - move tasks from one cgroup to another
+ * @to: cgroup to which the tasks will be moved
+ * @from: cgroup in which the tasks currently reside
  *
- * If @heap is non-NULL, a heap has been pre-allocated and will be used for
- * heap operations (and its "gt" member will be overwritten), else a
- * temporary heap will be used (allocation of which may cause this function
- * to fail).
+ * Locking rules between cgroup_post_fork() and the migration path
+ * guarantee that, if a task is forking while being migrated, the new child
+ * is guaranteed to be either visible in the source cgroup after the
+ * parent's migration is complete or put into the target cgroup.  No task
+ * can slip out of migration through forking.
  */
-int css_scan_tasks(struct cgroup_subsys_state *css,
-                  bool (*test)(struct task_struct *, void *),
-                  void (*process)(struct task_struct *, void *),
-                  void *data, struct ptr_heap *heap)
+int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
 {
-       int retval, i;
+       LIST_HEAD(preloaded_csets);
+       struct cgrp_cset_link *link;
        struct css_task_iter it;
-       struct task_struct *p, *dropped;
-       /* Never dereference latest_task, since it's not refcounted */
-       struct task_struct *latest_task = NULL;
-       struct ptr_heap tmp_heap;
-       struct timespec latest_time = { 0, 0 };
-
-       if (heap) {
-               /* The caller supplied our heap and pre-allocated its memory */
-               heap->gt = &started_after;
-       } else {
-               /* We need to allocate our own heap memory */
-               heap = &tmp_heap;
-               retval = heap_init(heap, PAGE_SIZE, GFP_KERNEL, &started_after);
-               if (retval)
-                       /* cannot allocate the heap */
-                       return retval;
-       }
+       struct task_struct *task;
+       int ret;
 
- again:
-       /*
-        * Scan tasks in the css, using the @test callback to determine
-        * which are of interest, and invoking @process callback on the
-        * ones which need an update.  Since we don't want to hold any
-        * locks during the task updates, gather tasks to be processed in a
-        * heap structure.  The heap is sorted by descending task start
-        * time.  If the statically-sized heap fills up, we overflow tasks
-        * that started later, and in future iterations only consider tasks
-        * that started after the latest task in the previous pass. This
-        * guarantees forward progress and that we don't miss any tasks.
-        */
-       heap->size = 0;
-       css_task_iter_start(css, &it);
-       while ((p = css_task_iter_next(&it))) {
-               /*
-                * Only affect tasks that qualify per the caller's callback,
-                * if he provided one
-                */
-               if (test && !test(p, data))
-                       continue;
-               /*
-                * Only process tasks that started after the last task
-                * we processed
-                */
-               if (!started_after_time(p, &latest_time, latest_task))
-                       continue;
-               dropped = heap_insert(heap, p);
-               if (dropped == NULL) {
-                       /*
-                        * The new task was inserted; the heap wasn't
-                        * previously full
-                        */
-                       get_task_struct(p);
-               } else if (dropped != p) {
-                       /*
-                        * The new task was inserted, and pushed out a
-                        * different task
-                        */
-                       get_task_struct(p);
-                       put_task_struct(dropped);
-               }
-               /*
-                * Else the new task was newer than anything already in
-                * the heap and wasn't inserted
-                */
-       }
-       css_task_iter_end(&it);
+       mutex_lock(&cgroup_mutex);
 
-       if (heap->size) {
-               for (i = 0; i < heap->size; i++) {
-                       struct task_struct *q = heap->ptrs[i];
-                       if (i == 0) {
-                               latest_time = q->start_time;
-                               latest_task = q;
-                       }
-                       /* Process the task per the caller's callback */
-                       process(q, data);
-                       put_task_struct(q);
-               }
-               /*
-                * If we had to process any tasks at all, scan again
-                * in case some of them were in the middle of forking
-                * children that didn't get processed.
-                * Not the most efficient way to do it, but it avoids
-                * having to take callback_mutex in the fork path
-                */
-               goto again;
-       }
-       if (heap == &tmp_heap)
-               heap_free(&tmp_heap);
-       return 0;
-}
+       /* all tasks in @from are being moved, all csets are source */
+       down_read(&css_set_rwsem);
+       list_for_each_entry(link, &from->cset_links, cset_link)
+               cgroup_migrate_add_src(link->cset, to, &preloaded_csets);
+       up_read(&css_set_rwsem);
 
-static void cgroup_transfer_one_task(struct task_struct *task, void *data)
-{
-       struct cgroup *new_cgroup = data;
+       ret = cgroup_migrate_prepare_dst(to, &preloaded_csets);
+       if (ret)
+               goto out_err;
 
-       mutex_lock(&cgroup_mutex);
-       cgroup_attach_task(new_cgroup, task, false);
+       /*
+        * Migrate tasks one-by-one until @form is empty.  This fails iff
+        * ->can_attach() fails.
+        */
+       do {
+               css_task_iter_start(&from->dummy_css, &it);
+               task = css_task_iter_next(&it);
+               if (task)
+                       get_task_struct(task);
+               css_task_iter_end(&it);
+
+               if (task) {
+                       ret = cgroup_migrate(to, task, false);
+                       put_task_struct(task);
+               }
+       } while (task && !ret);
+out_err:
+       cgroup_migrate_finish(&preloaded_csets);
        mutex_unlock(&cgroup_mutex);
-}
-
-/**
- * cgroup_trasnsfer_tasks - move tasks from one cgroup to another
- * @to: cgroup to which the tasks will be moved
- * @from: cgroup in which the tasks currently reside
- */
-int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
-{
-       return css_scan_tasks(&from->dummy_css, NULL, cgroup_transfer_one_task,
-                             to, NULL);
+       return ret;
 }
 
 /*
@@ -3283,6 +3220,8 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
            kernfs_type(kn) != KERNFS_DIR)
                return -EINVAL;
 
+       mutex_lock(&cgroup_mutex);
+
        /*
         * We aren't being called from kernfs and there's no guarantee on
         * @kn->priv's validity.  For this and css_tryget_from_dir(),
@@ -3290,10 +3229,12 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
         */
        rcu_read_lock();
        cgrp = rcu_dereference(kn->priv);
-       if (!cgrp) {
+       if (!cgrp || cgroup_is_dead(cgrp)) {
                rcu_read_unlock();
+               mutex_unlock(&cgroup_mutex);
                return -ENOENT;
        }
+       rcu_read_unlock();
 
        css_task_iter_start(&cgrp->dummy_css, &it);
        while ((tsk = css_task_iter_next(&it))) {
@@ -3318,7 +3259,7 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
        }
        css_task_iter_end(&it);
 
-       rcu_read_unlock();
+       mutex_unlock(&cgroup_mutex);
        return 0;
 }
 
@@ -3604,7 +3545,7 @@ static void css_release(struct percpu_ref *ref)
        struct cgroup_subsys_state *css =
                container_of(ref, struct cgroup_subsys_state, refcnt);
 
-       rcu_assign_pointer(css->cgroup->subsys[css->ss->id], NULL);
+       RCU_INIT_POINTER(css->cgroup->subsys[css->ss->id], NULL);
        call_rcu(&css->rcu_head, css_free_rcu_fn);
 }
 
@@ -3699,6 +3640,8 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        cgroup_get(cgrp);
        css_get(css->parent);
 
+       cgrp->subsys_mask |= 1 << ss->id;
+
        if (ss->broken_hierarchy && !ss->warned_broken_hierarchy &&
            parent->parent) {
                pr_warning("cgroup: %s (%d) created nested cgroup for controller \"%s\" which has incomplete hierarchy support. Nested cgroups may change behavior in the future.\n",
@@ -3719,31 +3662,30 @@ err_free:
 /**
  * cgroup_create - create a cgroup
  * @parent: cgroup that will be parent of the new cgroup
- * @name_str: name of the new cgroup
+ * @name: name of the new cgroup
  * @mode: mode to set on new cgroup
  */
-static long cgroup_create(struct cgroup *parent, const char *name_str,
+static long cgroup_create(struct cgroup *parent, const char *name,
                          umode_t mode)
 {
        struct cgroup *cgrp;
-       struct cgroup_name *name;
-       struct cgroupfs_root *root = parent->root;
+       struct cgroup_root *root = parent->root;
        int ssid, err;
        struct cgroup_subsys *ss;
        struct kernfs_node *kn;
 
+       /*
+        * XXX: The default hierarchy isn't fully implemented yet.  Block
+        * !root cgroup creation on it for now.
+        */
+       if (root == &cgrp_dfl_root)
+               return -EINVAL;
+
        /* allocate the cgroup and its ID, 0 is reserved for the root */
        cgrp = kzalloc(sizeof(*cgrp), GFP_KERNEL);
        if (!cgrp)
                return -ENOMEM;
 
-       name = cgroup_alloc_name(name_str);
-       if (!name) {
-               err = -ENOMEM;
-               goto err_free_cgrp;
-       }
-       rcu_assign_pointer(cgrp->name, name);
-
        mutex_lock(&cgroup_tree_mutex);
 
        /*
@@ -3781,7 +3723,7 @@ static long cgroup_create(struct cgroup *parent, const char *name_str,
                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &cgrp->flags);
 
        /* create the directory */
-       kn = kernfs_create_dir(parent->kn, name->name, mode, cgrp);
+       kn = kernfs_create_dir(parent->kn, name, mode, cgrp);
        if (IS_ERR(kn)) {
                err = PTR_ERR(kn);
                goto err_free_id;
@@ -3798,13 +3740,7 @@ static long cgroup_create(struct cgroup *parent, const char *name_str,
 
        /* allocation complete, commit to creation */
        list_add_tail_rcu(&cgrp->sibling, &cgrp->parent->children);
-       root->number_of_cgroups++;
-
-       /*
-        * Grab a reference on the root and parent so that they don't get
-        * deleted while there are child cgroups.
-        */
-       cgroup_get_root(root);
+       atomic_inc(&root->nr_cgrps);
        cgroup_get(parent);
 
        /*
@@ -3819,7 +3755,7 @@ static long cgroup_create(struct cgroup *parent, const char *name_str,
 
        /* let's create and online css's */
        for_each_subsys(ss, ssid) {
-               if (root->subsys_mask & (1 << ssid)) {
+               if (root->cgrp.subsys_mask & (1 << ssid)) {
                        err = create_css(cgrp, ss);
                        if (err)
                                goto err_destroy;
@@ -3839,8 +3775,6 @@ err_unlock:
        mutex_unlock(&cgroup_mutex);
 err_unlock_tree:
        mutex_unlock(&cgroup_tree_mutex);
-       kfree(rcu_dereference_raw(cgrp->name));
-err_free_cgrp:
        kfree(cgrp);
        return err;
 
@@ -3855,8 +3789,22 @@ static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
                        umode_t mode)
 {
        struct cgroup *parent = parent_kn->priv;
+       int ret;
+
+       /*
+        * cgroup_create() grabs cgroup_tree_mutex which nests outside
+        * kernfs active_ref and cgroup_create() already synchronizes
+        * properly against removal through cgroup_lock_live_group().
+        * Break it before calling cgroup_create().
+        */
+       cgroup_get(parent);
+       kernfs_break_active_protection(parent_kn);
+
+       ret = cgroup_create(parent, name, mode);
 
-       return cgroup_create(parent, name, mode);
+       kernfs_unbreak_active_protection(parent_kn);
+       cgroup_put(parent);
+       return ret;
 }
 
 /*
@@ -3909,17 +3857,10 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
 
-/**
- * kill_css - destroy a css
- * @css: css to destroy
- *
- * This function initiates destruction of @css by removing cgroup interface
- * files and putting its base reference.  ->css_offline() will be invoked
- * asynchronously once css_tryget() is guaranteed to fail and when the
- * reference count reaches zero, @css will be released.
- */
-static void kill_css(struct cgroup_subsys_state *css)
+static void __kill_css(struct cgroup_subsys_state *css)
 {
+       lockdep_assert_held(&cgroup_tree_mutex);
+
        /*
         * This must happen before css is disassociated with its cgroup.
         * See seq_css() for details.
@@ -3945,6 +3886,28 @@ static void kill_css(struct cgroup_subsys_state *css)
        percpu_ref_kill_and_confirm(&css->refcnt, css_killed_ref_fn);
 }
 
+/**
+ * kill_css - destroy a css
+ * @css: css to destroy
+ *
+ * This function initiates destruction of @css by removing cgroup interface
+ * files and putting its base reference.  ->css_offline() will be invoked
+ * asynchronously once css_tryget() is guaranteed to fail and when the
+ * reference count reaches zero, @css will be released.
+ */
+static void kill_css(struct cgroup_subsys_state *css)
+{
+       struct cgroup *cgrp = css->cgroup;
+
+       lockdep_assert_held(&cgroup_tree_mutex);
+
+       /* if already killed, noop */
+       if (cgrp->subsys_mask & (1 << css->ss->id)) {
+               cgrp->subsys_mask &= ~(1 << css->ss->id);
+               __kill_css(css);
+       }
+}
+
 /**
  * cgroup_destroy_locked - the first stage of cgroup destruction
  * @cgrp: cgroup to be destroyed
@@ -3981,12 +3944,12 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
        lockdep_assert_held(&cgroup_mutex);
 
        /*
-        * css_set_lock synchronizes access to ->cset_links and prevents
-        * @cgrp from being removed while __put_css_set() is in progress.
+        * css_set_rwsem synchronizes access to ->cset_links and prevents
+        * @cgrp from being removed while put_css_set() is in progress.
         */
-       read_lock(&css_set_lock);
+       down_read(&css_set_rwsem);
        empty = list_empty(&cgrp->cset_links);
-       read_unlock(&css_set_lock);
+       up_read(&css_set_rwsem);
        if (!empty)
                return -EBUSY;
 
@@ -4006,6 +3969,15 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
        if (!empty)
                return -EBUSY;
 
+       /*
+        * Mark @cgrp dead.  This prevents further task migration and child
+        * creation by disabling cgroup_lock_live_group().  Note that
+        * CGRP_DEAD assertion is depended upon by css_next_child() to
+        * resume iteration after dropping RCU read lock.  See
+        * css_next_child() for details.
+        */
+       set_bit(CGRP_DEAD, &cgrp->flags);
+
        /*
         * Initiate massacre of all css's.  cgroup_destroy_css_killed()
         * will be invoked to perform the rest of destruction once the
@@ -4017,15 +3989,6 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
                kill_css(css);
        mutex_lock(&cgroup_mutex);
 
-       /*
-        * Mark @cgrp dead.  This prevents further task migration and child
-        * creation by disabling cgroup_lock_live_group().  Note that
-        * CGRP_DEAD assertion is depended upon by css_next_child() to
-        * resume iteration after dropping RCU read lock.  See
-        * css_next_child() for details.
-        */
-       set_bit(CGRP_DEAD, &cgrp->flags);
-
        /* CGRP_DEAD is set, remove from ->release_list for the last time */
        raw_spin_lock(&release_list_lock);
        if (!list_empty(&cgrp->release_list))
@@ -4135,17 +4098,17 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
 
        INIT_LIST_HEAD(&ss->cfts);
 
-       /* Create the top cgroup state for this subsystem */
-       ss->root = &cgroup_dummy_root;
-       css = ss->css_alloc(cgroup_css(cgroup_dummy_top, ss));
+       /* Create the root cgroup state for this subsystem */
+       ss->root = &cgrp_dfl_root;
+       css = ss->css_alloc(cgroup_css(&cgrp_dfl_root.cgrp, ss));
        /* We don't handle early failures gracefully */
        BUG_ON(IS_ERR(css));
-       init_css(css, ss, cgroup_dummy_top);
+       init_css(css, ss, &cgrp_dfl_root.cgrp);
 
        /* Update the init_css_set to contain a subsys
         * pointer to this state - since the subsystem is
         * newly registered, all tasks and hence the
-        * init_css_set is in the subsystem's top cgroup. */
+        * init_css_set is in the subsystem's root cgroup. */
        init_css_set.subsys[ss->id] = css;
 
        need_forkexit_callback |= ss->fork || ss->exit;
@@ -4157,6 +4120,8 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
 
        BUG_ON(online_css(css));
 
+       cgrp_dfl_root.cgrp.subsys_mask |= 1 << ss->id;
+
        mutex_unlock(&cgroup_mutex);
        mutex_unlock(&cgroup_tree_mutex);
 }
@@ -4169,23 +4134,14 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
  */
 int __init cgroup_init_early(void)
 {
+       static struct cgroup_sb_opts __initdata opts =
+               { .flags = CGRP_ROOT_SANE_BEHAVIOR };
        struct cgroup_subsys *ss;
        int i;
 
-       atomic_set(&init_css_set.refcount, 1);
-       INIT_LIST_HEAD(&init_css_set.cgrp_links);
-       INIT_LIST_HEAD(&init_css_set.tasks);
-       INIT_HLIST_NODE(&init_css_set.hlist);
-       css_set_count = 1;
-       init_cgroup_root(&cgroup_dummy_root);
-       cgroup_root_count = 1;
+       init_cgroup_root(&cgrp_dfl_root, &opts);
        RCU_INIT_POINTER(init_task.cgroups, &init_css_set);
 
-       init_cgrp_cset_link.cset = &init_css_set;
-       init_cgrp_cset_link.cgrp = cgroup_dummy_top;
-       list_add(&init_cgrp_cset_link.cset_link, &cgroup_dummy_top->cset_links);
-       list_add(&init_cgrp_cset_link.cgrp_link, &init_css_set.cgrp_links);
-
        for_each_subsys(ss, i) {
                WARN(!ss->css_alloc || !ss->css_free || ss->name || ss->id,
                     "invalid cgroup_subsys %d:%s css_alloc=%p css_free=%p name:id=%d:%s\n",
@@ -4213,11 +4169,23 @@ int __init cgroup_init(void)
 {
        struct cgroup_subsys *ss;
        unsigned long key;
-       int i, err;
+       int ssid, err;
 
        BUG_ON(cgroup_init_cftypes(NULL, cgroup_base_files));
 
-       for_each_subsys(ss, i) {
+       mutex_lock(&cgroup_tree_mutex);
+       mutex_lock(&cgroup_mutex);
+
+       /* Add init_css_set to the hash table */
+       key = css_set_hash(init_css_set.subsys);
+       hash_add(css_set_table, &init_css_set.hlist, key);
+
+       BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0));
+
+       mutex_unlock(&cgroup_mutex);
+       mutex_unlock(&cgroup_tree_mutex);
+
+       for_each_subsys(ss, ssid) {
                if (!ss->early_init)
                        cgroup_init_subsys(ss);
 
@@ -4229,21 +4197,6 @@ int __init cgroup_init(void)
                        WARN_ON(cgroup_add_cftypes(ss, ss->base_cftypes));
        }
 
-       /* allocate id for the dummy hierarchy */
-       mutex_lock(&cgroup_mutex);
-
-       /* Add init_css_set to the hash table */
-       key = css_set_hash(init_css_set.subsys);
-       hash_add(css_set_table, &init_css_set.hlist, key);
-
-       BUG_ON(cgroup_init_root_id(&cgroup_dummy_root, 0, 1));
-
-       err = idr_alloc(&cgroup_dummy_root.cgroup_idr, cgroup_dummy_top,
-                       0, 1, GFP_KERNEL);
-       BUG_ON(err < 0);
-
-       mutex_unlock(&cgroup_mutex);
-
        cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
        if (!cgroup_kobj)
                return -ENOMEM;
@@ -4263,16 +4216,12 @@ static int __init cgroup_wq_init(void)
        /*
         * There isn't much point in executing destruction path in
         * parallel.  Good chunk is serialized with cgroup_mutex anyway.
-        *
-        * XXX: Must be ordered to make sure parent is offlined after
-        * children.  The ordering requirement is for memcg where a
-        * parent's offline may wait for a child's leading to deadlock.  In
-        * the long term, this should be fixed from memcg side.
+        * Use 1 for @max_active.
         *
         * We would prefer to do this in cgroup_init() above, but that
         * is called before init_workqueues(): so leave this until after.
         */
-       cgroup_destroy_wq = alloc_ordered_workqueue("cgroup_destroy", 0);
+       cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1);
        BUG_ON(!cgroup_destroy_wq);
 
        /*
@@ -4291,12 +4240,6 @@ core_initcall(cgroup_wq_init);
  * proc_cgroup_show()
  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
  *  - Used for /proc/<pid>/cgroup.
- *  - No need to task_lock(tsk) on this tsk->cgroup reference, as it
- *    doesn't really matter if tsk->cgroup changes after we read it,
- *    and we take cgroup_mutex, keeping cgroup_attach_task() from changing it
- *    anyway.  No need to check that tsk->cgroup != NULL, thanks to
- *    the_top_cgroup_hack in cgroup_exit(), which sets an exiting tasks
- *    cgroup to top_cgroup.
  */
 
 /* TODO: Use a proper seq_file iterator */
@@ -4304,12 +4247,12 @@ int proc_cgroup_show(struct seq_file *m, void *v)
 {
        struct pid *pid;
        struct task_struct *tsk;
-       char *buf;
+       char *buf, *path;
        int retval;
-       struct cgroupfs_root *root;
+       struct cgroup_root *root;
 
        retval = -ENOMEM;
-       buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+       buf = kmalloc(PATH_MAX, GFP_KERNEL);
        if (!buf)
                goto out;
 
@@ -4322,29 +4265,36 @@ int proc_cgroup_show(struct seq_file *m, void *v)
        retval = 0;
 
        mutex_lock(&cgroup_mutex);
+       down_read(&css_set_rwsem);
 
-       for_each_active_root(root) {
+       for_each_root(root) {
                struct cgroup_subsys *ss;
                struct cgroup *cgrp;
                int ssid, count = 0;
 
+               if (root == &cgrp_dfl_root && !cgrp_dfl_root_visible)
+                       continue;
+
                seq_printf(m, "%d:", root->hierarchy_id);
                for_each_subsys(ss, ssid)
-                       if (root->subsys_mask & (1 << ssid))
+                       if (root->cgrp.subsys_mask & (1 << ssid))
                                seq_printf(m, "%s%s", count++ ? "," : "", ss->name);
                if (strlen(root->name))
                        seq_printf(m, "%sname=%s", count ? "," : "",
                                   root->name);
                seq_putc(m, ':');
                cgrp = task_cgroup_from_root(tsk, root);
-               retval = cgroup_path(cgrp, buf, PAGE_SIZE);
-               if (retval < 0)
+               path = cgroup_path(cgrp, buf, PATH_MAX);
+               if (!path) {
+                       retval = -ENAMETOOLONG;
                        goto out_unlock;
-               seq_puts(m, buf);
+               }
+               seq_puts(m, path);
                seq_putc(m, '\n');
        }
 
 out_unlock:
+       up_read(&css_set_rwsem);
        mutex_unlock(&cgroup_mutex);
        put_task_struct(tsk);
 out_free:
@@ -4370,7 +4320,7 @@ static int proc_cgroupstats_show(struct seq_file *m, void *v)
        for_each_subsys(ss, i)
                seq_printf(m, "%s\t%d\t%d\t%d\n",
                           ss->name, ss->root->hierarchy_id,
-                          ss->root->number_of_cgroups, !ss->disabled);
+                          atomic_read(&ss->root->nr_cgrps), !ss->disabled);
 
        mutex_unlock(&cgroup_mutex);
        return 0;
@@ -4389,27 +4339,16 @@ static const struct file_operations proc_cgroupstats_operations = {
 };
 
 /**
- * cgroup_fork - attach newly forked task to its parents cgroup.
+ * cgroup_fork - initialize cgroup related fields during copy_process()
  * @child: pointer to task_struct of forking parent process.
  *
- * Description: A task inherits its parent's cgroup at fork().
- *
- * A pointer to the shared css_set was automatically copied in
- * fork.c by dup_task_struct().  However, we ignore that copy, since
- * it was not made under the protection of RCU or cgroup_mutex, so
- * might no longer be a valid cgroup pointer.  cgroup_attach_task() might
- * have already changed current->cgroups, allowing the previously
- * referenced cgroup group to be removed and freed.
- *
- * At the point that cgroup_fork() is called, 'current' is the parent
- * task, and the passed argument 'child' points to the child task.
+ * A task is associated with the init_css_set until cgroup_post_fork()
+ * attaches it to the parent's css_set.  Empty cg_list indicates that
+ * @child isn't holding reference to its css_set.
  */
 void cgroup_fork(struct task_struct *child)
 {
-       task_lock(current);
-       get_css_set(task_css_set(current));
-       child->cgroups = current->cgroups;
-       task_unlock(current);
+       RCU_INIT_POINTER(child->cgroups, &init_css_set);
        INIT_LIST_HEAD(&child->cg_list);
 }
 
@@ -4429,23 +4368,37 @@ void cgroup_post_fork(struct task_struct *child)
        int i;
 
        /*
-        * use_task_css_set_links is set to 1 before we walk the tasklist
-        * under the tasklist_lock and we read it here after we added the child
-        * to the tasklist under the tasklist_lock as well. If the child wasn't
-        * yet in the tasklist when we walked through it from
-        * cgroup_enable_task_cg_lists(), then use_task_css_set_links value
-        * should be visible now due to the paired locking and barriers implied
-        * by LOCK/UNLOCK: it is written before the tasklist_lock unlock
-        * in cgroup_enable_task_cg_lists() and read here after the tasklist_lock
-        * lock on fork.
+        * This may race against cgroup_enable_task_cg_links().  As that
+        * function sets use_task_css_set_links before grabbing
+        * tasklist_lock and we just went through tasklist_lock to add
+        * @child, it's guaranteed that either we see the set
+        * use_task_css_set_links or cgroup_enable_task_cg_lists() sees
+        * @child during its iteration.
+        *
+        * If we won the race, @child is associated with %current's
+        * css_set.  Grabbing css_set_rwsem guarantees both that the
+        * association is stable, and, on completion of the parent's
+        * migration, @child is visible in the source of migration or
+        * already in the destination cgroup.  This guarantee is necessary
+        * when implementing operations which need to migrate all tasks of
+        * a cgroup to another.
+        *
+        * Note that if we lose to cgroup_enable_task_cg_links(), @child
+        * will remain in init_css_set.  This is safe because all tasks are
+        * in the init_css_set before cg_links is enabled and there's no
+        * operation which transfers all tasks out of init_css_set.
         */
        if (use_task_css_set_links) {
-               write_lock(&css_set_lock);
-               task_lock(child);
-               if (list_empty(&child->cg_list))
-                       list_add(&child->cg_list, &task_css_set(child)->tasks);
-               task_unlock(child);
-               write_unlock(&css_set_lock);
+               struct css_set *cset;
+
+               down_write(&css_set_rwsem);
+               cset = task_css_set(current);
+               if (list_empty(&child->cg_list)) {
+                       rcu_assign_pointer(child->cgroups, cset);
+                       list_add(&child->cg_list, &cset->tasks);
+                       get_css_set(cset);
+               }
+               up_write(&css_set_rwsem);
        }
 
        /*
@@ -4473,48 +4426,32 @@ void cgroup_post_fork(struct task_struct *child)
  * use notify_on_release cgroups where very high task exit scaling
  * is required on large systems.
  *
- * the_top_cgroup_hack:
- *
- *    Set the exiting tasks cgroup to the root cgroup (top_cgroup).
- *
- *    We call cgroup_exit() while the task is still competent to
- *    handle notify_on_release(), then leave the task attached to the
- *    root cgroup in each hierarchy for the remainder of its exit.
- *
- *    To do this properly, we would increment the reference count on
- *    top_cgroup, and near the very end of the kernel/exit.c do_exit()
- *    code we would add a second cgroup function call, to drop that
- *    reference.  This would just create an unnecessary hot spot on
- *    the top_cgroup reference count, to no avail.
- *
- *    Normally, holding a reference to a cgroup without bumping its
- *    count is unsafe.   The cgroup could go away, or someone could
- *    attach us to a different cgroup, decrementing the count on
- *    the first cgroup that we never incremented.  But in this case,
- *    top_cgroup isn't going away, and either task has PF_EXITING set,
- *    which wards off any cgroup_attach_task() attempts, or task is a failed
- *    fork, never visible to cgroup_attach_task.
+ * We set the exiting tasks cgroup to the root cgroup (top_cgroup).  We
+ * call cgroup_exit() while the task is still competent to handle
+ * notify_on_release(), then leave the task attached to the root cgroup in
+ * each hierarchy for the remainder of its exit.  No need to bother with
+ * init_css_set refcnting.  init_css_set never goes away and we can't race
+ * with migration path - PF_EXITING is visible to migration path.
  */
 void cgroup_exit(struct task_struct *tsk, int run_callbacks)
 {
        struct cgroup_subsys *ss;
        struct css_set *cset;
+       bool put_cset = false;
        int i;
 
        /*
-        * Unlink from the css_set task list if necessary.
-        * Optimistically check cg_list before taking
-        * css_set_lock
+        * Unlink from @tsk from its css_set.  As migration path can't race
+        * with us, we can check cg_list without grabbing css_set_rwsem.
         */
        if (!list_empty(&tsk->cg_list)) {
-               write_lock(&css_set_lock);
-               if (!list_empty(&tsk->cg_list))
-                       list_del_init(&tsk->cg_list);
-               write_unlock(&css_set_lock);
+               down_write(&css_set_rwsem);
+               list_del_init(&tsk->cg_list);
+               up_write(&css_set_rwsem);
+               put_cset = true;
        }
 
        /* Reassign the task to the init_css_set. */
-       task_lock(tsk);
        cset = task_css_set(tsk);
        RCU_INIT_POINTER(tsk->cgroups, &init_css_set);
 
@@ -4529,9 +4466,9 @@ void cgroup_exit(struct task_struct *tsk, int run_callbacks)
                        }
                }
        }
-       task_unlock(tsk);
 
-       put_css_set_taskexit(cset);
+       if (put_cset)
+               put_css_set(cset, true);
 }
 
 static void check_for_release(struct cgroup *cgrp)
@@ -4588,16 +4525,17 @@ static void cgroup_release_agent(struct work_struct *work)
        while (!list_empty(&release_list)) {
                char *argv[3], *envp[3];
                int i;
-               char *pathbuf = NULL, *agentbuf = NULL;
+               char *pathbuf = NULL, *agentbuf = NULL, *path;
                struct cgroup *cgrp = list_entry(release_list.next,
                                                    struct cgroup,
                                                    release_list);
                list_del_init(&cgrp->release_list);
                raw_spin_unlock(&release_list_lock);
-               pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+               pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
                if (!pathbuf)
                        goto continue_free;
-               if (cgroup_path(cgrp, pathbuf, PAGE_SIZE) < 0)
+               path = cgroup_path(cgrp, pathbuf, PATH_MAX);
+               if (!path)
                        goto continue_free;
                agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL);
                if (!agentbuf)
@@ -4605,7 +4543,7 @@ static void cgroup_release_agent(struct work_struct *work)
 
                i = 0;
                argv[i++] = agentbuf;
-               argv[i++] = pathbuf;
+               argv[i++] = path;
                argv[i] = NULL;
 
                i = 0;
@@ -4755,22 +4693,25 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
 {
        struct cgrp_cset_link *link;
        struct css_set *cset;
+       char *name_buf;
+
+       name_buf = kmalloc(NAME_MAX + 1, GFP_KERNEL);
+       if (!name_buf)
+               return -ENOMEM;
 
-       read_lock(&css_set_lock);
+       down_read(&css_set_rwsem);
        rcu_read_lock();
        cset = rcu_dereference(current->cgroups);
        list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
                struct cgroup *c = link->cgrp;
-               const char *name = "?";
-
-               if (c != cgroup_dummy_top)
-                       name = cgroup_name(c);
 
+               cgroup_name(c, name_buf, NAME_MAX + 1);
                seq_printf(seq, "Root %d group %s\n",
-                          c->root->hierarchy_id, name);
+                          c->root->hierarchy_id, name_buf);
        }
        rcu_read_unlock();
-       read_unlock(&css_set_lock);
+       up_read(&css_set_rwsem);
+       kfree(name_buf);
        return 0;
 }
 
@@ -4780,23 +4721,30 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
        struct cgroup_subsys_state *css = seq_css(seq);
        struct cgrp_cset_link *link;
 
-       read_lock(&css_set_lock);
+       down_read(&css_set_rwsem);
        list_for_each_entry(link, &css->cgroup->cset_links, cset_link) {
                struct css_set *cset = link->cset;
                struct task_struct *task;
                int count = 0;
+
                seq_printf(seq, "css_set %p\n", cset);
+
                list_for_each_entry(task, &cset->tasks, cg_list) {
-                       if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
-                               seq_puts(seq, "  ...\n");
-                               break;
-                       } else {
-                               seq_printf(seq, "  task %d\n",
-                                          task_pid_vnr(task));
-                       }
+                       if (count++ > MAX_TASKS_SHOWN_PER_CSS)
+                               goto overflow;
+                       seq_printf(seq, "  task %d\n", task_pid_vnr(task));
+               }
+
+               list_for_each_entry(task, &cset->mg_tasks, cg_list) {
+                       if (count++ > MAX_TASKS_SHOWN_PER_CSS)
+                               goto overflow;
+                       seq_printf(seq, "  task %d\n", task_pid_vnr(task));
                }
+               continue;
+       overflow:
+               seq_puts(seq, "  ...\n");
        }
-       read_unlock(&css_set_lock);
+       up_read(&css_set_rwsem);
        return 0;
 }