12 files changed, 53 insertions, 36 deletions

diff --git a/mm/early_ioremap.c b/mm/early_ioremap.c
index d04ac1ec0559..1826f191e72c 100644
--- a/mm/early_ioremap.c
+++ b/mm/early_ioremap.c
@@ -111,7 +111,7 @@ __early_ioremap(resource_size_t phys_addr, unsigned long size, pgprot_t prot)
         enum fixed_addresses idx;
         int i, slot;
 
-        WARN_ON(system_state != SYSTEM_BOOTING);
+        WARN_ON(system_state >= SYSTEM_RUNNING);
 
         slot = -1;
         for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
diff --git a/mm/frame_vector.c b/mm/frame_vector.c
index 297c7238f7d4..c64dca6e27c2 100644
--- a/mm/frame_vector.c
+++ b/mm/frame_vector.c
@@ -62,8 +62,10 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
          * get_user_pages_longterm() and disallow it for filesystem-dax
          * mappings.
          */
-        if (vma_is_fsdax(vma))
-                return -EOPNOTSUPP;
+        if (vma_is_fsdax(vma)) {
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
 
         if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
                 vec->got_ref = true;
diff --git a/mm/gup.c b/mm/gup.c
index d3fb60e5bfac..e0d82b6706d7 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -66,7 +66,7 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
  */
 static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
 {
-        return pte_access_permitted(pte, WRITE) ||
+        return pte_write(pte) ||
                 ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
 }
 
diff --git a/mm/hmm.c b/mm/hmm.c
index 3a5c172af560..ea19742a5d60 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -391,11 +391,11 @@ again:
                 if (pmd_protnone(pmd))
                         return hmm_vma_walk_clear(start, end, walk);
 
-                if (!pmd_access_permitted(pmd, write_fault))
+                if (write_fault && !pmd_write(pmd))
                         return hmm_vma_walk_clear(start, end, walk);
 
                 pfn = pmd_pfn(pmd) + pte_index(addr);
-                flag |= pmd_access_permitted(pmd, WRITE) ? HMM_PFN_WRITE : 0;
+                flag |= pmd_write(pmd) ? HMM_PFN_WRITE : 0;
                 for (; addr < end; addr += PAGE_SIZE, i++, pfn++)
                         pfns[i] = hmm_pfn_t_from_pfn(pfn) | flag;
                 return 0;
@@ -456,11 +456,11 @@ again:
                         continue;
                 }
 
-                if (!pte_access_permitted(pte, write_fault))
+                if (write_fault && !pte_write(pte))
                         goto fault;
 
                 pfns[i] = hmm_pfn_t_from_pfn(pte_pfn(pte)) | flag;
-                pfns[i] |= pte_access_permitted(pte, WRITE) ? HMM_PFN_WRITE : 0;
+                pfns[i] |= pte_write(pte) ? HMM_PFN_WRITE : 0;
                 continue;
 
 fault:
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2f2f5e774902..0e7ded98d114 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -870,7 +870,7 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
          */
         WARN_ONCE(flags & FOLL_COW, "mm: In follow_devmap_pmd with FOLL_COW set");
 
-        if (!pmd_access_permitted(*pmd, flags & FOLL_WRITE))
+        if (flags & FOLL_WRITE && !pmd_write(*pmd))
                 return NULL;
 
         if (pmd_present(*pmd) && pmd_devmap(*pmd))
@@ -1012,7 +1012,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
 
         assert_spin_locked(pud_lockptr(mm, pud));
 
-        if (!pud_access_permitted(*pud, flags & FOLL_WRITE))
+        if (flags & FOLL_WRITE && !pud_write(*pud))
                 return NULL;
 
         if (pud_present(*pud) && pud_devmap(*pud))
@@ -1386,7 +1386,7 @@ out_unlock:
  */
 static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
 {
-        return pmd_access_permitted(pmd, WRITE) ||
+        return pmd_write(pmd) ||
                ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
 }
 
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 3d4781756d50..d73c14294f3a 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1523,7 +1523,7 @@ static void kmemleak_scan(void)
                         if (page_count(page) == 0)
                                 continue;
                         scan_block(page, page + 1, NULL);
-                        if (!(pfn % (MAX_SCAN_SIZE / sizeof(*page))))
+                        if (!(pfn & 63))
                                 cond_resched();
                 }
         }
diff --git a/mm/memory.c b/mm/memory.c
index 5eb3d2524bdc..ca5674cbaff2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3831,7 +3831,8 @@ static inline int create_huge_pmd(struct vm_fault *vmf)
         return VM_FAULT_FALLBACK;
 }
 
-static int wp_huge_pmd(struct vm_fault *vmf, pmd_t orig_pmd)
+/* `inline' is required to avoid gcc 4.1.2 build error */
+static inline int wp_huge_pmd(struct vm_fault *vmf, pmd_t orig_pmd)
 {
         if (vma_is_anonymous(vmf->vma))
                 return do_huge_pmd_wp_page(vmf, orig_pmd);
@@ -3948,7 +3949,7 @@ static int handle_pte_fault(struct vm_fault *vmf)
         if (unlikely(!pte_same(*vmf->pte, entry)))
                 goto unlock;
         if (vmf->flags & FAULT_FLAG_WRITE) {
-                if (!pte_access_permitted(entry, WRITE))
+                if (!pte_write(entry))
                         return do_wp_page(vmf);
                 entry = pte_mkdirty(entry);
         }
@@ -4013,7 +4014,7 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 
                         /* NUMA case for anonymous PUDs would go here */
 
-                        if (dirty && !pud_access_permitted(orig_pud, WRITE)) {
+                        if (dirty && !pud_write(orig_pud)) {
                                 ret = wp_huge_pud(&vmf, orig_pud);
                                 if (!(ret & VM_FAULT_FALLBACK))
                                         return ret;
@@ -4046,7 +4047,7 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                         if (pmd_protnone(orig_pmd) && vma_is_accessible(vma))
                                 return do_huge_pmd_numa_page(&vmf, orig_pmd);
 
-                        if (dirty && !pmd_access_permitted(orig_pmd, WRITE)) {
+                        if (dirty && !pmd_write(orig_pmd)) {
                                 ret = wp_huge_pmd(&vmf, orig_pmd);
                                 if (!(ret & VM_FAULT_FALLBACK))
                                         return ret;
@@ -4336,7 +4337,7 @@ int follow_phys(struct vm_area_struct *vma,
                 goto out;
         pte = *ptep;
 
-        if (!pte_access_permitted(pte, flags & FOLL_WRITE))
+        if ((flags & FOLL_WRITE) && !pte_write(pte))
                 goto unlock;
 
         *prot = pgprot_val(pte_pgprot(pte));
diff --git a/mm/mmap.c b/mm/mmap.c
index a4d546821214..9efdc021ad22 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -3019,20 +3019,20 @@ void exit_mmap(struct mm_struct *mm)
         /* Use -1 here to ensure all VMAs in the mm are unmapped */
         unmap_vmas(&tlb, vma, 0, -1);
 
-        set_bit(MMF_OOM_SKIP, &mm->flags);
-        if (unlikely(tsk_is_oom_victim(current))) {
+        if (unlikely(mm_is_oom_victim(mm))) {
                 /*
                  * Wait for oom_reap_task() to stop working on this
                  * mm. Because MMF_OOM_SKIP is already set before
                  * calling down_read(), oom_reap_task() will not run
                  * on this "mm" post up_write().
                  *
-                 * tsk_is_oom_victim() cannot be set from under us
-                 * either because current->mm is already set to NULL
+                 * mm_is_oom_victim() cannot be set from under us
+                 * either because victim->mm is already set to NULL
                  * under task_lock before calling mmput and oom_mm is
-                 * set not NULL by the OOM killer only if current->mm
+                 * set not NULL by the OOM killer only if victim->mm
                  * is found not NULL while holding the task_lock.
                  */
+                set_bit(MMF_OOM_SKIP, &mm->flags);
                 down_write(&mm->mmap_sem);
                 up_write(&mm->mmap_sem);
         }
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index c957be32b27a..29f855551efe 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -683,8 +683,10 @@ static void mark_oom_victim(struct task_struct *tsk)
                 return;
 
         /* oom_mm is bound to the signal struct life time. */
-        if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm))
+        if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm)) {
                 mmgrab(tsk->signal->oom_mm);
+                set_bit(MMF_OOM_VICTIM, &mm->flags);
+        }
 
         /*
          * Make sure that the task is woken up from uninterruptible sleep
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 73f5d4556b3d..7e5e775e97f4 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2684,6 +2684,7 @@ void free_unref_page_list(struct list_head *list)
 {
         struct page *page, *next;
         unsigned long flags, pfn;
+        int batch_count = 0;
 
         /* Prepare pages for freeing */
         list_for_each_entry_safe(page, next, list, lru) {
@@ -2700,6 +2701,16 @@ void free_unref_page_list(struct list_head *list)
                 set_page_private(page, 0);
                 trace_mm_page_free_batched(page);
                 free_unref_page_commit(page, pfn);
+
+                /*
+                 * Guard against excessive IRQ disabled times when we get
+                 * a large list of pages to free.
+                 */
+                if (++batch_count == SWAP_CLUSTER_MAX) {
+                        local_irq_restore(flags);
+                        batch_count = 0;
+                        local_irq_save(flags);
+                }
         }
         local_irq_restore(flags);
 }
diff --git a/mm/percpu.c b/mm/percpu.c
index 79e3549cab0f..50e7fdf84055 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -2719,7 +2719,11 @@ void __init setup_per_cpu_areas(void)
 
         if (pcpu_setup_first_chunk(ai, fc) < 0)
                 panic("Failed to initialize percpu areas.");
+#ifdef CONFIG_CRIS
+#warning "the CRIS architecture has physical and virtual addresses confused"
+#else
         pcpu_free_alloc_info(ai);
+#endif
 }
 
 #endif  /* CONFIG_SMP */
diff --git a/mm/slab.c b/mm/slab.c
index 183e996dde5f..4e51ef954026 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1584,11 +1584,8 @@ static void print_objinfo(struct kmem_cache *cachep, void *objp, int lines)
                        *dbg_redzone2(cachep, objp));
         }
 
-        if (cachep->flags & SLAB_STORE_USER) {
-                pr_err("Last user: [<%p>](%pSR)\n",
-                       *dbg_userword(cachep, objp),
-                       *dbg_userword(cachep, objp));
-        }
+        if (cachep->flags & SLAB_STORE_USER)
+                pr_err("Last user: (%pSR)\n", *dbg_userword(cachep, objp));
         realobj = (char *)objp + obj_offset(cachep);
         size = cachep->object_size;
         for (i = 0; i < size && lines; i += 16, lines--) {
@@ -1621,7 +1618,7 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
                         /* Mismatch ! */
                         /* Print header */
                         if (lines == 0) {
-                                pr_err("Slab corruption (%s): %s start=%p, len=%d\n",
+                                pr_err("Slab corruption (%s): %s start=%px, len=%d\n",
                                        print_tainted(), cachep->name,
                                        realobj, size);
                                 print_objinfo(cachep, objp, 0);
@@ -1650,13 +1647,13 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
                 if (objnr) {
                         objp = index_to_obj(cachep, page, objnr - 1);
                         realobj = (char *)objp + obj_offset(cachep);
-                        pr_err("Prev obj: start=%p, len=%d\n", realobj, size);
+                        pr_err("Prev obj: start=%px, len=%d\n", realobj, size);
                         print_objinfo(cachep, objp, 2);
                 }
                 if (objnr + 1 < cachep->num) {
                         objp = index_to_obj(cachep, page, objnr + 1);
                         realobj = (char *)objp + obj_offset(cachep);
-                        pr_err("Next obj: start=%p, len=%d\n", realobj, size);
+                        pr_err("Next obj: start=%px, len=%d\n", realobj, size);
                         print_objinfo(cachep, objp, 2);
                 }
         }
@@ -2608,7 +2605,7 @@ static void slab_put_obj(struct kmem_cache *cachep,
         /* Verify double free bug */
         for (i = page->active; i < cachep->num; i++) {
                 if (get_free_obj(page, i) == objnr) {
-                        pr_err("slab: double free detected in cache '%s', objp %p\n",
+                        pr_err("slab: double free detected in cache '%s', objp %px\n",
                                cachep->name, objp);
                         BUG();
                 }
@@ -2772,7 +2769,7 @@ static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
         else
                 slab_error(cache, "memory outside object was overwritten");
 
-        pr_err("%p: redzone 1:0x%llx, redzone 2:0x%llx\n",
+        pr_err("%px: redzone 1:0x%llx, redzone 2:0x%llx\n",
                obj, redzone1, redzone2);
 }
 
@@ -3078,7 +3075,7 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 if (*dbg_redzone1(cachep, objp) != RED_INACTIVE ||
                                 *dbg_redzone2(cachep, objp) != RED_INACTIVE) {
                         slab_error(cachep, "double free, or memory outside object was overwritten");
-                        pr_err("%p: redzone 1:0x%llx, redzone 2:0x%llx\n",
+                        pr_err("%px: redzone 1:0x%llx, redzone 2:0x%llx\n",
                                objp, *dbg_redzone1(cachep, objp),
                                *dbg_redzone2(cachep, objp));
                 }
@@ -3091,7 +3088,7 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 cachep->ctor(objp);
         if (ARCH_SLAB_MINALIGN &&
             ((unsigned long)objp & (ARCH_SLAB_MINALIGN-1))) {
-                pr_err("0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n",
+                pr_err("0x%px: not aligned to ARCH_SLAB_MINALIGN=%d\n",
                        objp, (int)ARCH_SLAB_MINALIGN);
         }
         return objp;
@@ -4283,7 +4280,7 @@ static void show_symbol(struct seq_file *m, unsigned long address)
                 return;
         }
 #endif
-        seq_printf(m, "%p", (void *)address);
+        seq_printf(m, "%px", (void *)address);
 }
 
 static int leaks_show(struct seq_file *m, void *p)