119 files changed, 3139 insertions, 1805 deletions
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 4d9ca7d92a20..5b47acb86111 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1759,7 +1759,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        keepinitrd      [HW,ARM]
-        kernelcore=nn[KMG]      [KNL,X86,IA-64,PPC] This parameter
+        kernelcore=     [KNL,X86,IA-64,PPC]
+                        Format: nn[KMGTPE] | "mirror"
+                        This parameter
                        specifies the amount of memory usable by the kernel
                        for non-movable allocations.  The requested amount is
                        spread evenly throughout all nodes in the system. The
@@ -1775,6 +1777,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        use the HighMem zone if it exists, and the Normal
                        zone if it does not.
+                        Instead of specifying the amount of memory (nn[KMGTPE]),
+                        you can specify "mirror" option. In case "mirror"
+                        option is specified, mirrored (reliable) memory is used
+                        for non-movable allocations and remaining memory is used
+                        for Movable pages. nn[KMGTPE] and "mirror" are exclusive,
+                        so you can NOT specify nn[KMGTPE] and "mirror" at the same
+                        time.
        kgdbdbgp=       [KGDB,HW] kgdb over EHCI usb debug port.
                        Format: <Controller#>[,poll interval]
                        The controller # is the number of the ehci usb debug
@@ -2732,6 +2742,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        we can turn it on.
                        on: enable the feature
+        page_poison=    [KNL] Boot-time parameter changing the state of
+                        poisoning on the buddy allocator.
+                        off: turn off poisoning
+                        on: turn on poisoning
        panic=          [KNL] Kernel behaviour on panic: delay <timeout>
                        timeout > 0: seconds before rebooting
                        timeout = 0: wait forever
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
index ce2cfcf35c27..443f4b44ad97 100644
--- a/Documentation/memory-hotplug.txt
+++ b/Documentation/memory-hotplug.txt
@@ -256,10 +256,27 @@ If the memory block is offline, you'll read "offline".
 5.2. How to online memory
 ------------
-Even if the memory is hot-added, it is not at ready-to-use state.
+When the memory is hot-added, the kernel decides whether or not to "online"
-For using newly added memory, you have to "online" the memory block.
+it according to the policy which can be read from "auto_online_blocks" file:
-For onlining, you have to write "online" to the memory block's state file as:
+% cat /sys/devices/system/memory/auto_online_blocks
+The default is "offline" which means the newly added memory is not in a
+ready-to-use state and you have to "online" the newly added memory blocks
+manually. Automatic onlining can be requested by writing "online" to
+"auto_online_blocks" file:
+% echo online > /sys/devices/system/memory/auto_online_blocks
+This sets a global policy and impacts all memory blocks that will subsequently
+be hotplugged. Currently offline blocks keep their state. It is possible, under
+certain circumstances, that some memory blocks will be added but will fail to
+online. User space tools can check their "state" files
+(/sys/devices/system/memory/memoryXXX/state) and try to online them manually.
+If the automatic onlining wasn't requested, failed, or some memory block was
+offlined it is possible to change the individual block's state by writing to the
+"state" file:
 % echo online > /sys/devices/system/memory/memoryXXX/state
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 5d1128bf0282..5962949944fd 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -298,6 +298,24 @@ bitmap and its derivatives such as cpumask and nodemask:
        Passed by reference.
+Flags bitfields such as page flags, gfp_flags:
+        %pGp    referenced|uptodate|lru|active|private
+        %pGg    GFP_USER|GFP_DMA32|GFP_NOWARN
+        %pGv    read|exec|mayread|maywrite|mayexec|denywrite
+        For printing flags bitfields as a collection of symbolic constants that
+        would construct the value. The type of flags is given by the third
+        character. Currently supported are [p]age flags, [v]ma_flags (both
+        expect unsigned long *) and [g]fp_flags (expects gfp_t *). The flag
+        names and print order depends on the particular type.
+        Note that this format should not be used directly in TP_printk() part
+        of a tracepoint. Instead, use the show_*_flags() functions from
+        <trace/events/mmflags.h>.
+        Passed by reference.
 Network device features:
        %pNF    0x000000000000c000
diff --git a/Documentation/vm/page_owner.txt b/Documentation/vm/page_owner.txt
index 8f3ce9b3aa11..ffff1439076a 100644
--- a/Documentation/vm/page_owner.txt
+++ b/Documentation/vm/page_owner.txt
@@ -28,10 +28,11 @@ with page owner and page owner is disabled in runtime due to no enabling
 boot option, runtime overhead is marginal. If disabled in runtime, it
 doesn't require memory to store owner information, so there is no runtime
 memory overhead. And, page owner inserts just two unlikely branches into
-the page allocator hotpath and if it returns false then allocation is
+the page allocator hotpath and if not enabled, then allocation is done
-done like as the kernel without page owner. These two unlikely branches
+like as the kernel without page owner. These two unlikely branches should
-would not affect to allocation performance. Following is the kernel's
+not affect to allocation performance, especially if the static keys jump
-code size change due to this facility.
+label patching functionality is available. Following is the kernel's code
+size change due to this facility.
 - Without page owner
   text    data     bss     dec     hex filename
diff --git a/Documentation/vm/slub.txt b/Documentation/vm/slub.txt
index f0d340959319..84652419bff2 100644
--- a/Documentation/vm/slub.txt
+++ b/Documentation/vm/slub.txt
@@ -35,8 +35,8 @@ slub_debug=<Debug-Options>,<slab name>
                                Enable options only for select slabs
 Possible debug options are
-        F               Sanity checks on (enables SLAB_DEBUG_FREE. Sorry
+        F               Sanity checks on (enables SLAB_DEBUG_CONSISTENCY_CHECKS
-                        SLAB legacy issues)
+                        Sorry SLAB legacy issues)
        Z               Red zoning
        P               Poisoning (object and padding)
        U               User tracking (free and alloc)
diff --git a/arch/blackfin/include/asm/pgtable.h b/arch/blackfin/include/asm/pgtable.h
index b88a1558b0b9..c1ee3d6533fb 100644
--- a/arch/blackfin/include/asm/pgtable.h
+++ b/arch/blackfin/include/asm/pgtable.h
@@ -97,6 +97,8 @@ extern unsigned long get_fb_unmapped_area(struct file *filp, unsigned long,
                                          unsigned long);
 #define HAVE_ARCH_FB_UNMAPPED_AREA
+#define pgprot_writecombine pgprot_noncached
 #include <asm-generic/pgtable.h>
 #endif                          /* _BLACKFIN_PGTABLE_H */
diff --git a/arch/m32r/mm/init.c b/arch/m32r/mm/init.c
index 0d4146f644dc..11fa717d93b1 100644
--- a/arch/m32r/mm/init.c
+++ b/arch/m32r/mm/init.c
@@ -59,21 +59,24 @@ void free_initrd_mem(unsigned long, unsigned long);
 void __init zone_sizes_init(void)
 {
        unsigned long  zones_size[MAX_NR_ZONES] = {0, };
-        unsigned long  max_dma;
-        unsigned long  low;
        unsigned long  start_pfn;
 #ifdef CONFIG_MMU
-        start_pfn = START_PFN(0);
+        {
-        max_dma = virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT;
+                unsigned long  low;
-        low = MAX_LOW_PFN(0);
+                unsigned long  max_dma;
-        if (low < max_dma){
+                start_pfn = START_PFN(0);
-                zones_size[ZONE_DMA] = low - start_pfn;
+                max_dma = virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT;
-                zones_size[ZONE_NORMAL] = 0;
+                low = MAX_LOW_PFN(0);
-        } else {
-                zones_size[ZONE_DMA] = low - start_pfn;
+                if (low < max_dma) {
-                zones_size[ZONE_NORMAL] = low - max_dma;
+                        zones_size[ZONE_DMA] = low - start_pfn;
+                        zones_size[ZONE_NORMAL] = 0;
+                } else {
+                        zones_size[ZONE_DMA] = low - start_pfn;
+                        zones_size[ZONE_NORMAL] = low - max_dma;
+                }
        }
 #else
        zones_size[ZONE_DMA] = 0 >> PAGE_SHIFT;
diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
index 2150b0139a0b..1b6081c0aff9 100644
--- a/arch/s390/kernel/dumpstack.c
+++ b/arch/s390/kernel/dumpstack.c
@@ -11,6 +11,7 @@
 #include <linux/export.h>
 #include <linux/kdebug.h>
 #include <linux/ptrace.h>
+#include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <asm/processor.h>
@@ -189,9 +190,8 @@ void die(struct pt_regs *regs, const char *str)
 #ifdef CONFIG_SMP
        printk("SMP ");
 #endif
-#ifdef CONFIG_DEBUG_PAGEALLOC
+        if (debug_pagealloc_enabled())
-        printk("DEBUG_PAGEALLOC");
+                printk("DEBUG_PAGEALLOC");
-#endif
        printk("\n");
        notify_die(DIE_OOPS, str, regs, 0, regs->int_code & 0xffff, SIGSEGV);
        print_modules();
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index ef7d6c8fea66..d27fccbad7c1 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -94,16 +94,15 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                        pgd_populate(&init_mm, pg_dir, pu_dir);
                }
                pu_dir = pud_offset(pg_dir, address);
-#ifndef CONFIG_DEBUG_PAGEALLOC
                if (MACHINE_HAS_EDAT2 && pud_none(*pu_dir) && address &&
-                    !(address & ~PUD_MASK) && (address + PUD_SIZE <= end)) {
+                    !(address & ~PUD_MASK) && (address + PUD_SIZE <= end) &&
+                     !debug_pagealloc_enabled()) {
                        pud_val(*pu_dir) = __pa(address) |
                                _REGION_ENTRY_TYPE_R3 | _REGION3_ENTRY_LARGE |
                                (ro ? _REGION_ENTRY_PROTECT : 0);
                        address += PUD_SIZE;
                        continue;
                }
-#endif
                if (pud_none(*pu_dir)) {
                        pm_dir = vmem_pmd_alloc();
                        if (!pm_dir)
@@ -111,9 +110,9 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                        pud_populate(&init_mm, pu_dir, pm_dir);
                }
                pm_dir = pmd_offset(pu_dir, address);
-#ifndef CONFIG_DEBUG_PAGEALLOC
                if (MACHINE_HAS_EDAT1 && pmd_none(*pm_dir) && address &&
-                    !(address & ~PMD_MASK) && (address + PMD_SIZE <= end)) {
+                    !(address & ~PMD_MASK) && (address + PMD_SIZE <= end) &&
+                    !debug_pagealloc_enabled()) {
                        pmd_val(*pm_dir) = __pa(address) |
                                _SEGMENT_ENTRY | _SEGMENT_ENTRY_LARGE |
                                _SEGMENT_ENTRY_YOUNG |
@@ -121,7 +120,6 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                        address += PMD_SIZE;
                        continue;
                }
-#endif
                if (pmd_none(*pm_dir)) {
                        pt_dir = vmem_pte_alloc(address);
                        if (!pt_dir)
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 9c30acfadae2..32e5699eadfe 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -265,9 +265,8 @@ int __die(const char *str, struct pt_regs *regs, long err)
 #ifdef CONFIG_SMP
        printk("SMP ");
 #endif
-#ifdef CONFIG_DEBUG_PAGEALLOC
+        if (debug_pagealloc_enabled())
-        printk("DEBUG_PAGEALLOC ");
+                printk("DEBUG_PAGEALLOC ");
-#endif
 #ifdef CONFIG_KASAN
        printk("KASAN");
 #endif
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 493f54172b4a..9d56f271d519 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -150,13 +150,14 @@ static int page_size_mask;
 static void __init probe_page_size_mask(void)
 {
-#if !defined(CONFIG_DEBUG_PAGEALLOC) && !defined(CONFIG_KMEMCHECK)
+#if !defined(CONFIG_KMEMCHECK)
        /*
-         * For CONFIG_DEBUG_PAGEALLOC, identity mapping will use small pages.
+         * For CONFIG_KMEMCHECK or pagealloc debugging, identity mapping will
+         * use small pages.
         * This will simplify cpa(), which otherwise needs to support splitting
         * large pages into small in interrupt context, etc.
         */
-        if (cpu_has_pse)
+        if (cpu_has_pse && !debug_pagealloc_enabled())
                page_size_mask |= 1 << PG_LEVEL_2M;
 #endif
@@ -666,21 +667,22 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
         * mark them not present - any buggy init-section access will
         * create a kernel page fault:
         */
-#ifdef CONFIG_DEBUG_PAGEALLOC
+        if (debug_pagealloc_enabled()) {
-        printk(KERN_INFO "debug: unmapping init [mem %#010lx-%#010lx]\n",
+                pr_info("debug: unmapping init [mem %#010lx-%#010lx]\n",
-                begin, end - 1);
+                        begin, end - 1);
-        set_memory_np(begin, (end - begin) >> PAGE_SHIFT);
+                set_memory_np(begin, (end - begin) >> PAGE_SHIFT);
-#else
+        } else {
-        /*
+                /*
-         * We just marked the kernel text read only above, now that
+                 * We just marked the kernel text read only above, now that
-         * we are going to free part of that, we need to make that
+                 * we are going to free part of that, we need to make that
-         * writeable and non-executable first.
+                 * writeable and non-executable first.
-         */
+                 */
-        set_memory_nx(begin, (end - begin) >> PAGE_SHIFT);
+                set_memory_nx(begin, (end - begin) >> PAGE_SHIFT);
-        set_memory_rw(begin, (end - begin) >> PAGE_SHIFT);
+                set_memory_rw(begin, (end - begin) >> PAGE_SHIFT);
-        free_reserved_area((void *)begin, (void *)end, POISON_FREE_INITMEM, what);
+                free_reserved_area((void *)begin, (void *)end,
-#endif
+                                   POISON_FREE_INITMEM, what);
+        }
 }
 void free_initmem(void)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 007ebe2d8157..4d0b26253042 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -106,12 +106,6 @@ static inline unsigned long highmap_end_pfn(void)
 #endif
-#ifdef CONFIG_DEBUG_PAGEALLOC
-# define debug_pagealloc 1
-#else
-# define debug_pagealloc 0
-#endif
 static inline int
 within(unsigned long addr, unsigned long start, unsigned long end)
 {
@@ -714,10 +708,10 @@ static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
 {
        struct page *base;
-        if (!debug_pagealloc)
+        if (!debug_pagealloc_enabled())
                spin_unlock(&cpa_lock);
        base = alloc_pages(GFP_KERNEL | __GFP_NOTRACK, 0);
-        if (!debug_pagealloc)
+        if (!debug_pagealloc_enabled())
                spin_lock(&cpa_lock);
        if (!base)
                return -ENOMEM;
@@ -1339,10 +1333,10 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
                if (cpa->flags & (CPA_ARRAY | CPA_PAGES_ARRAY))
                        cpa->numpages = 1;
-                if (!debug_pagealloc)
+                if (!debug_pagealloc_enabled())
                        spin_lock(&cpa_lock);
                ret = __change_page_attr(cpa, checkalias);
-                if (!debug_pagealloc)
+                if (!debug_pagealloc_enabled())
                        spin_unlock(&cpa_lock);
                if (ret)
                        return ret;
diff --git a/block/partition-generic.c b/block/partition-generic.c
index fefd01b496a0..5d8701941054 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -217,10 +217,21 @@ static void part_release(struct device *dev)
        kfree(p);
 }
+static int part_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        struct hd_struct *part = dev_to_part(dev);
+        add_uevent_var(env, "PARTN=%u", part->partno);
+        if (part->info && part->info->volname[0])
+                add_uevent_var(env, "PARTNAME=%s", part->info->volname);
+        return 0;
+}
 struct device_type part_type = {
        .name           = "partition",
        .groups         = part_attr_groups,
        .release        = part_release,
+        .uevent         = part_uevent,
 };
 static void delete_partition_rcu_cb(struct rcu_head *head)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 175c86bee3a9..9ca2b2fefd76 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -61,8 +61,8 @@ module_param(latency_factor, uint, 0644);
 static DEFINE_PER_CPU(struct cpuidle_device *, acpi_cpuidle_device);
-static DEFINE_PER_CPU(struct acpi_processor_cx * [CPUIDLE_STATE_MAX],
+static
-                                                                acpi_cstate);
+DEFINE_PER_CPU(struct acpi_processor_cx * [CPUIDLE_STATE_MAX], acpi_cstate);
 static int disabled_by_idle_boot_param(void)
 {
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 213456c2b123..f46dba8b7092 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -251,7 +251,7 @@ memory_block_action(unsigned long phys_index, unsigned long action, int online_t
        return ret;
 }
-static int memory_block_change_state(struct memory_block *mem,
+int memory_block_change_state(struct memory_block *mem,
                unsigned long to_state, unsigned long from_state_req)
 {
        int ret = 0;
@@ -439,6 +439,37 @@ print_block_size(struct device *dev, struct device_attribute *attr,
 static DEVICE_ATTR(block_size_bytes, 0444, print_block_size, NULL);
 /*
+ * Memory auto online policy.
+ */
+static ssize_t
+show_auto_online_blocks(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        if (memhp_auto_online)
+                return sprintf(buf, "online\n");
+        else
+                return sprintf(buf, "offline\n");
+}
+static ssize_t
+store_auto_online_blocks(struct device *dev, struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        if (sysfs_streq(buf, "online"))
+                memhp_auto_online = true;
+        else if (sysfs_streq(buf, "offline"))
+                memhp_auto_online = false;
+        else
+                return -EINVAL;
+        return count;
+}
+static DEVICE_ATTR(auto_online_blocks, 0644, show_auto_online_blocks,
+                   store_auto_online_blocks);
+/*
 * Some architectures will have custom drivers to do this, and
 * will not need to do it from userspace.  The fake hot-add code
 * as well as ppc64 will do all of their discovery in userspace
@@ -746,6 +777,7 @@ static struct attribute *memory_root_attrs[] = {
 #endif
        &dev_attr_block_size_bytes.attr,
+        &dev_attr_auto_online_blocks.attr,
        NULL
 };
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 562b5a4ca7b7..78a39f736c64 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -126,7 +126,7 @@
 */
 #include <linux/types.h>
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PD_MAJOR;
 static char *name = PD_NAME;
 static int cluster = 64;
@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV};
 static DEFINE_MUTEX(pd_mutex);
 static DEFINE_SPINLOCK(pd_lock);
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param(cluster, int, 0);
diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
index 1740d75e8a32..216a94fed5b4 100644
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -117,7 +117,7 @@
 */
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PT_MAJOR;
 static char *name = PT_NAME;
 static int disable = 0;
@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3};
 #include <asm/uaccess.h>
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param_array(drive0, int, NULL, 0);
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 73708acce3ca..979a8317204f 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -37,23 +37,30 @@ config XEN_BALLOON_MEMORY_HOTPLUG
          Memory could be hotplugged in following steps:
-            1) dom0: xl mem-max <domU> <maxmem>
+            1) target domain: ensure that memory auto online policy is in
+               effect by checking /sys/devices/system/memory/auto_online_blocks
+               file (should be 'online').
+            2) control domain: xl mem-max <target-domain> <maxmem>
               where <maxmem> is >= requested memory size,
-            2) dom0: xl mem-set <domU> <memory>
+            3) control domain: xl mem-set <target-domain> <memory>
               where <memory> is requested memory size; alternatively memory
               could be added by writing proper value to
               /sys/devices/system/xen_memory/xen_memory0/target or
-               /sys/devices/system/xen_memory/xen_memory0/target_kb on dumU,
+               /sys/devices/system/xen_memory/xen_memory0/target_kb on the
+               target domain.
-            3) domU: for i in /sys/devices/system/memory/memory*/state; do \
+          Alternatively, if memory auto onlining was not requested at step 1
-                       [ "`cat "$i"`" = offline ] && echo online > "$i"; done
+          the newly added memory can be manually onlined in the target domain
+          by doing the following:
-          Memory could be onlined automatically on domU by adding following line to udev rules:
+                for i in /sys/devices/system/memory/memory*/state; do \
+                  [ "`cat "$i"`" = offline ] && echo online > "$i"; done
-          SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'"
+          or by adding the following line to udev rules:
-          In that case step 3 should be omitted.
+          SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'"
 config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
        int "Hotplugged memory limit (in GiB) for a PV guest"
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index dc4305b407bf..7c8a2cf16f58 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -338,7 +338,16 @@ static enum bp_state reserve_additional_memory(void)
        }
 #endif
-        rc = add_memory_resource(nid, resource);
+        /*
+         * add_memory_resource() will call online_pages() which in its turn
+         * will call xen_online_page() callback causing deadlock if we don't
+         * release balloon_mutex here. Unlocking here is safe because the
+         * callers drop the mutex before trying again.
+         */
+        mutex_unlock(&balloon_mutex);
+        rc = add_memory_resource(nid, resource, memhp_auto_online);
+        mutex_lock(&balloon_mutex);
        if (rc) {
                pr_warn("Cannot add additional memory (%i)\n", rc);
                goto err;
diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
index 7dd46312c180..403fe3955393 100644
--- a/drivers/xen/events/events_2l.c
+++ b/drivers/xen/events/events_2l.c
@@ -38,8 +38,9 @@
 /* Find the first set bit in a evtchn mask */
 #define EVTCHN_FIRST_BIT(w) find_first_bit(BM(&(w)), BITS_PER_EVTCHN_WORD)
-static DEFINE_PER_CPU(xen_ulong_t [EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD],
+#define EVTCHN_MASK_SIZE (EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD)
-                      cpu_evtchn_mask);
+static DEFINE_PER_CPU(xen_ulong_t [EVTCHN_MASK_SIZE], cpu_evtchn_mask);
 static unsigned evtchn_2l_max_channels(void)
 {
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index c37149b929be..f0d268b97d19 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -1,15 +1,11 @@
-/* -*- c -*- ------------------------------------------------------------- *
+/*
- *   
+ *  Copyright 1997-1998 Transmeta Corporation - All Rights Reserved
- * linux/fs/autofs/autofs_i.h
+ *  Copyright 2005-2006 Ian Kent <raven@themaw.net>
- *
- *   Copyright 1997-1998 Transmeta Corporation - All Rights Reserved
- *   Copyright 2005-2006 Ian Kent <raven@themaw.net>
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ----------------------------------------------------------------------- */
 /* Internal header file for autofs */
@@ -35,28 +31,23 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <asm/current.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 /* #define DEBUG */
-#define DPRINTK(fmt, ...)                               \
+#ifdef pr_fmt
-        pr_debug("pid %d: %s: " fmt "\n",               \
+#undef pr_fmt
-                current->pid, __func__, ##__VA_ARGS__)
+#endif
+#define pr_fmt(fmt) KBUILD_MODNAME ":pid:%d:%s: " fmt, current->pid, __func__
-#define AUTOFS_WARN(fmt, ...)                           \
-        printk(KERN_WARNING "pid %d: %s: " fmt "\n",    \
+/*
-                current->pid, __func__, ##__VA_ARGS__)
+ * Unified info structure.  This is pointed to by both the dentry and
+ * inode structures.  Each file in the filesystem has an instance of this
-#define AUTOFS_ERROR(fmt, ...)                          \
+ * structure.  It holds a reference to the dentry, so dentries are never
-        printk(KERN_ERR "pid %d: %s: " fmt "\n",        \
+ * flushed while the file exists.  All name lookups are dealt with at the
-                current->pid, __func__, ##__VA_ARGS__)
+ * dentry level, although the filesystem can interfere in the validation
+ * process.  Readdir is implemented by traversing the dentry lists.
-/* Unified info structure.  This is pointed to by both the dentry and
+ */
-   inode structures.  Each file in the filesystem has an instance of this
-   structure.  It holds a reference to the dentry, so dentries are never
-   flushed while the file exists.  All name lookups are dealt with at the
-   dentry level, although the filesystem can interfere in the validation
-   process.  Readdir is implemented by traversing the dentry lists. */
 struct autofs_info {
        struct dentry   *dentry;
        struct inode    *inode;
@@ -78,7 +69,7 @@ struct autofs_info {
        kgid_t gid;
 };
-#define AUTOFS_INF_EXPIRING     (1<<0) /* dentry is in the process of expiring */
+#define AUTOFS_INF_EXPIRING     (1<<0) /* dentry in the process of expiring */
 #define AUTOFS_INF_NO_RCU       (1<<1) /* the dentry is being considered
                                        * for expiry, so RCU_walk is
                                        * not permitted
@@ -140,10 +131,11 @@ static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry)
 }
 /* autofs4_oz_mode(): do we see the man behind the curtain?  (The
-   processes which do manipulations for us in user space sees the raw
+ * processes which do manipulations for us in user space sees the raw
-   filesystem without "magic".) */
+ * filesystem without "magic".)
+ */
-static inline int autofs4_oz_mode(struct autofs_sb_info *sbi) {
+static inline int autofs4_oz_mode(struct autofs_sb_info *sbi)
+{
        return sbi->catatonic || task_pgrp(current) == sbi->oz_pgrp;
 }
@@ -154,12 +146,12 @@ void autofs4_free_ino(struct autofs_info *);
 int is_autofs4_dentry(struct dentry *);
 int autofs4_expire_wait(struct dentry *dentry, int rcu_walk);
 int autofs4_expire_run(struct super_block *, struct vfsmount *,
-                        struct autofs_sb_info *,
+                       struct autofs_sb_info *,
-                        struct autofs_packet_expire __user *);
+                       struct autofs_packet_expire __user *);
 int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                            struct autofs_sb_info *sbi, int when);
 int autofs4_expire_multi(struct super_block *, struct vfsmount *,
-                        struct autofs_sb_info *, int __user *);
+                         struct autofs_sb_info *, int __user *);
 struct dentry *autofs4_expire_direct(struct super_block *sb,
                                     struct vfsmount *mnt,
                                     struct autofs_sb_info *sbi, int how);
@@ -224,8 +216,8 @@ static inline int autofs_prepare_pipe(struct file *pipe)
 /* Queue management functions */
-int autofs4_wait(struct autofs_sb_info *,struct dentry *, enum autofs_notify);
+int autofs4_wait(struct autofs_sb_info *, struct dentry *, enum autofs_notify);
-int autofs4_wait_release(struct autofs_sb_info *,autofs_wqt_t,int);
+int autofs4_wait_release(struct autofs_sb_info *, autofs_wqt_t, int);
 void autofs4_catatonic_mode(struct autofs_sb_info *);
 static inline u32 autofs4_get_dev(struct autofs_sb_info *sbi)
@@ -242,37 +234,37 @@ static inline void __autofs4_add_expiring(struct dentry *dentry)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        if (ino) {
                if (list_empty(&ino->expiring))
                        list_add(&ino->expiring, &sbi->expiring_list);
        }
-        return;
 }
 static inline void autofs4_add_expiring(struct dentry *dentry)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        if (ino) {
                spin_lock(&sbi->lookup_lock);
                if (list_empty(&ino->expiring))
                        list_add(&ino->expiring, &sbi->expiring_list);
                spin_unlock(&sbi->lookup_lock);
        }
-        return;
 }
 static inline void autofs4_del_expiring(struct dentry *dentry)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        if (ino) {
                spin_lock(&sbi->lookup_lock);
                if (!list_empty(&ino->expiring))
                        list_del_init(&ino->expiring);
                spin_unlock(&sbi->lookup_lock);
        }
-        return;
 }
 extern void autofs4_kill_sb(struct super_block *);
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index ac7d921ed984..c7fcc7438843 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -72,13 +72,13 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param)
 {
        int err = 0;
-        if ((AUTOFS_DEV_IOCTL_VERSION_MAJOR != param->ver_major) ||
+        if ((param->ver_major != AUTOFS_DEV_IOCTL_VERSION_MAJOR) ||
-            (AUTOFS_DEV_IOCTL_VERSION_MINOR < param->ver_minor)) {
+            (param->ver_minor > AUTOFS_DEV_IOCTL_VERSION_MINOR)) {
-                AUTOFS_WARN("ioctl control interface version mismatch: "
+                pr_warn("ioctl control interface version mismatch: "
-                     "kernel(%u.%u), user(%u.%u), cmd(%d)",
+                        "kernel(%u.%u), user(%u.%u), cmd(%d)\n",
-                     AUTOFS_DEV_IOCTL_VERSION_MAJOR,
+                        AUTOFS_DEV_IOCTL_VERSION_MAJOR,
-                     AUTOFS_DEV_IOCTL_VERSION_MINOR,
+                        AUTOFS_DEV_IOCTL_VERSION_MINOR,
-                     param->ver_major, param->ver_minor, cmd);
+                        param->ver_major, param->ver_minor, cmd);
                err = -EINVAL;
        }
@@ -93,7 +93,8 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param)
 * Copy parameter control struct, including a possible path allocated
 * at the end of the struct.
 */
-static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
+static struct autofs_dev_ioctl *
+                copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
 {
        struct autofs_dev_ioctl tmp, *res;
@@ -116,7 +117,6 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
 static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)
 {
        kfree(param);
-        return;
 }
 /*
@@ -129,24 +129,24 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param)
        err = check_dev_ioctl_version(cmd, param);
        if (err) {
-                AUTOFS_WARN("invalid device control module version "
+                pr_warn("invalid device control module version "
-                     "supplied for cmd(0x%08x)", cmd);
+                        "supplied for cmd(0x%08x)\n", cmd);
                goto out;
        }
        if (param->size > sizeof(*param)) {
                err = invalid_str(param->path, param->size - sizeof(*param));
                if (err) {
-                        AUTOFS_WARN(
+                        pr_warn(
-                          "path string terminator missing for cmd(0x%08x)",
+                          "path string terminator missing for cmd(0x%08x)\n",
                          cmd);
                        goto out;
                }
                err = check_name(param->path);
                if (err) {
-                        AUTOFS_WARN("invalid path supplied for cmd(0x%08x)",
+                        pr_warn("invalid path supplied for cmd(0x%08x)\n",
-                                    cmd);
+                                cmd);
                        goto out;
                }
        }
@@ -197,7 +197,9 @@ static int find_autofs_mount(const char *pathname,
                             void *data)
 {
        struct path path;
-        int err = kern_path_mountpoint(AT_FDCWD, pathname, &path, 0);
+        int err;
+        err = kern_path_mountpoint(AT_FDCWD, pathname, &path, 0);
        if (err)
                return err;
        err = -ENOENT;
@@ -225,6 +227,7 @@ static int test_by_dev(struct path *path, void *p)
 static int test_by_type(struct path *path, void *p)
 {
        struct autofs_info *ino = autofs4_dentry_ino(path->dentry);
        return ino && ino->sbi->type & *(unsigned *)p;
 }
@@ -370,7 +373,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                new_pid = get_task_pid(current, PIDTYPE_PGID);
                if (ns_of_pid(new_pid) != ns_of_pid(sbi->oz_pgrp)) {
-                        AUTOFS_WARN("Not allowed to change PID namespace");
+                        pr_warn("not allowed to change PID namespace\n");
                        err = -EINVAL;
                        goto out;
                }
@@ -456,8 +459,10 @@ static int autofs_dev_ioctl_requester(struct file *fp,
                err = 0;
                autofs4_expire_wait(path.dentry, 0);
                spin_lock(&sbi->fs_lock);
-                param->requester.uid = from_kuid_munged(current_user_ns(), ino->uid);
+                param->requester.uid =
-                param->requester.gid = from_kgid_munged(current_user_ns(), ino->gid);
+                        from_kuid_munged(current_user_ns(), ino->uid);
+                param->requester.gid =
+                        from_kgid_munged(current_user_ns(), ino->gid);
                spin_unlock(&sbi->fs_lock);
        }
        path_put(&path);
@@ -619,7 +624,8 @@ static ioctl_fn lookup_dev_ioctl(unsigned int cmd)
 }
 /* ioctl dispatcher */
-static int _autofs_dev_ioctl(unsigned int command, struct autofs_dev_ioctl __user *user)
+static int _autofs_dev_ioctl(unsigned int command,
+                             struct autofs_dev_ioctl __user *user)
 {
        struct autofs_dev_ioctl *param;
        struct file *fp;
@@ -655,7 +661,7 @@ static int _autofs_dev_ioctl(unsigned int command, struct autofs_dev_ioctl __use
        fn = lookup_dev_ioctl(cmd);
        if (!fn) {
-                AUTOFS_WARN("unknown command 0x%08x", command);
+                pr_warn("unknown command 0x%08x\n", command);
                return -ENOTTY;
        }
@@ -711,6 +717,7 @@ out:
 static long autofs_dev_ioctl(struct file *file, uint command, ulong u)
 {
        int err;
        err = _autofs_dev_ioctl(command, (struct autofs_dev_ioctl __user *) u);
        return (long) err;
 }
@@ -733,8 +740,8 @@ static const struct file_operations _dev_ioctl_fops = {
 static struct miscdevice _autofs_dev_ioctl_misc = {
        .minor          = AUTOFS_MINOR,
-        .name           = AUTOFS_DEVICE_NAME,
+        .name           = AUTOFS_DEVICE_NAME,
-        .fops           = &_dev_ioctl_fops
+        .fops           = &_dev_ioctl_fops
 };
 MODULE_ALIAS_MISCDEV(AUTOFS_MINOR);
@@ -747,7 +754,7 @@ int __init autofs_dev_ioctl_init(void)
        r = misc_register(&_autofs_dev_ioctl_misc);
        if (r) {
-                AUTOFS_ERROR("misc_register failed for control device");
+                pr_err("misc_register failed for control device\n");
                return r;
        }
@@ -757,6 +764,4 @@ int __init autofs_dev_ioctl_init(void)
 void autofs_dev_ioctl_exit(void)
 {
        misc_deregister(&_autofs_dev_ioctl_misc);
-        return;
 }
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 1cebc3c52fa5..9510d8d2e9cd 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -1,16 +1,12 @@
-/* -*- c -*- --------------------------------------------------------------- *
+/*
- *
+ * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- * linux/fs/autofs/expire.c
+ * Copyright 1999-2000 Jeremy Fitzhardinge <jeremy@goop.org>
- *
+ * Copyright 2001-2006 Ian Kent <raven@themaw.net>
- *  Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- *  Copyright 1999-2000 Jeremy Fitzhardinge <jeremy@goop.org>
- *  Copyright 2001-2006 Ian Kent <raven@themaw.net>
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ------------------------------------------------------------------------- */
 #include "autofs_i.h"
@@ -18,7 +14,7 @@ static unsigned long now;
 /* Check if a dentry can be expired */
 static inline int autofs4_can_expire(struct dentry *dentry,
-                                        unsigned long timeout, int do_now)
+                                     unsigned long timeout, int do_now)
 {
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
@@ -41,7 +37,7 @@ static int autofs4_mount_busy(struct vfsmount *mnt, struct dentry *dentry)
        struct path path = {.mnt = mnt, .dentry = dentry};
        int status = 1;
-        DPRINTK("dentry %p %pd", dentry, dentry);
+        pr_debug("dentry %p %pd\n", dentry, dentry);
        path_get(&path);
@@ -58,14 +54,16 @@ static int autofs4_mount_busy(struct vfsmount *mnt, struct dentry *dentry)
        /* Update the expiry counter if fs is busy */
        if (!may_umount_tree(path.mnt)) {
-                struct autofs_info *ino = autofs4_dentry_ino(top);
+                struct autofs_info *ino;
+                ino = autofs4_dentry_ino(top);
                ino->last_used = jiffies;
                goto done;
        }
        status = 0;
 done:
-        DPRINTK("returning = %d", status);
+        pr_debug("returning = %d\n", status);
        path_put(&path);
        return status;
 }
@@ -74,7 +72,7 @@ done:
 * Calculate and dget next entry in the subdirs list under root.
 */
 static struct dentry *get_next_positive_subdir(struct dentry *prev,
-                                                struct dentry *root)
+                                               struct dentry *root)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(root->d_sb);
        struct list_head *next;
@@ -121,7 +119,7 @@ cont:
 * Calculate and dget next entry in top down tree traversal.
 */
 static struct dentry *get_next_positive_dentry(struct dentry *prev,
-                                                struct dentry *root)
+                                               struct dentry *root)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(root->d_sb);
        struct list_head *next;
@@ -187,15 +185,17 @@ again:
 * autofs submounts.
 */
 static int autofs4_direct_busy(struct vfsmount *mnt,
-                                struct dentry *top,
+                               struct dentry *top,
-                                unsigned long timeout,
+                               unsigned long timeout,
-                                int do_now)
+                               int do_now)
 {
-        DPRINTK("top %p %pd", top, top);
+        pr_debug("top %p %pd\n", top, top);
        /* If it's busy update the expiry counters */
        if (!may_umount_tree(mnt)) {
-                struct autofs_info *ino = autofs4_dentry_ino(top);
+                struct autofs_info *ino;
+                ino = autofs4_dentry_ino(top);
                if (ino)
                        ino->last_used = jiffies;
                return 1;
@@ -208,7 +208,8 @@ static int autofs4_direct_busy(struct vfsmount *mnt,
        return 0;
 }
-/* Check a directory tree of mount points for busyness
+/*
+ * Check a directory tree of mount points for busyness
 * The tree is not busy iff no mountpoints are busy
 */
 static int autofs4_tree_busy(struct vfsmount *mnt,
@@ -219,7 +220,7 @@ static int autofs4_tree_busy(struct vfsmount *mnt,
        struct autofs_info *top_ino = autofs4_dentry_ino(top);
        struct dentry *p;
-        DPRINTK("top %p %pd", top, top);
+        pr_debug("top %p %pd\n", top, top);
        /* Negative dentry - give up */
        if (!simple_positive(top))
@@ -227,7 +228,7 @@ static int autofs4_tree_busy(struct vfsmount *mnt,
        p = NULL;
        while ((p = get_next_positive_dentry(p, top))) {
-                DPRINTK("dentry %p %pd", p, p);
+                pr_debug("dentry %p %pd\n", p, p);
                /*
                 * Is someone visiting anywhere in the subtree ?
@@ -273,11 +274,11 @@ static struct dentry *autofs4_check_leaves(struct vfsmount *mnt,
 {
        struct dentry *p;
-        DPRINTK("parent %p %pd", parent, parent);
+        pr_debug("parent %p %pd\n", parent, parent);
        p = NULL;
        while ((p = get_next_positive_dentry(p, parent))) {
-                DPRINTK("dentry %p %pd", p, p);
+                pr_debug("dentry %p %pd\n", p, p);
                if (d_mountpoint(p)) {
                        /* Can we umount this guy */
@@ -362,7 +363,7 @@ static struct dentry *should_expire(struct dentry *dentry,
         *         offset (autofs-5.0+).
         */
        if (d_mountpoint(dentry)) {
-                DPRINTK("checking mountpoint %p %pd", dentry, dentry);
+                pr_debug("checking mountpoint %p %pd\n", dentry, dentry);
                /* Can we umount this guy */
                if (autofs4_mount_busy(mnt, dentry))
@@ -375,7 +376,7 @@ static struct dentry *should_expire(struct dentry *dentry,
        }
        if (d_really_is_positive(dentry) && d_is_symlink(dentry)) {
-                DPRINTK("checking symlink %p %pd", dentry, dentry);
+                pr_debug("checking symlink %p %pd\n", dentry, dentry);
                /*
                 * A symlink can't be "busy" in the usual sense so
                 * just check last used for expire timeout.
@@ -404,6 +405,7 @@ static struct dentry *should_expire(struct dentry *dentry,
        } else {
                /* Path walk currently on this dentry? */
                struct dentry *expired;
                ino_count = atomic_read(&ino->count) + 1;
                if (d_count(dentry) > ino_count)
                        return NULL;
@@ -471,7 +473,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
        return NULL;
 found:
-        DPRINTK("returning %p %pd", expired, expired);
+        pr_debug("returning %p %pd\n", expired, expired);
        ino->flags |= AUTOFS_INF_EXPIRING;
        smp_mb();
        ino->flags &= ~AUTOFS_INF_NO_RCU;
@@ -503,12 +505,12 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
        if (ino->flags & AUTOFS_INF_EXPIRING) {
                spin_unlock(&sbi->fs_lock);
-                DPRINTK("waiting for expire %p name=%pd", dentry, dentry);
+                pr_debug("waiting for expire %p name=%pd\n", dentry, dentry);
                status = autofs4_wait(sbi, dentry, NFY_NONE);
                wait_for_completion(&ino->expire_complete);
-                DPRINTK("expire done status=%d", status);
+                pr_debug("expire done status=%d\n", status);
                if (d_unhashed(dentry))
                        return -EAGAIN;
@@ -522,21 +524,22 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
 /* Perform an expiry operation */
 int autofs4_expire_run(struct super_block *sb,
-                      struct vfsmount *mnt,
+                       struct vfsmount *mnt,
-                      struct autofs_sb_info *sbi,
+                       struct autofs_sb_info *sbi,
-                      struct autofs_packet_expire __user *pkt_p)
+                       struct autofs_packet_expire __user *pkt_p)
 {
        struct autofs_packet_expire pkt;
        struct autofs_info *ino;
        struct dentry *dentry;
        int ret = 0;
-        memset(&pkt,0,sizeof pkt);
+        memset(&pkt, 0, sizeof(pkt));
        pkt.hdr.proto_version = sbi->version;
        pkt.hdr.type = autofs_ptype_expire;
-        if ((dentry = autofs4_expire_indirect(sb, mnt, sbi, 0)) == NULL)
+        dentry = autofs4_expire_indirect(sb, mnt, sbi, 0);
+        if (!dentry)
                return -EAGAIN;
        pkt.len = dentry->d_name.len;
@@ -544,7 +547,7 @@ int autofs4_expire_run(struct super_block *sb,
        pkt.name[pkt.len] = '\0';
        dput(dentry);
-        if ( copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)) )
+        if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)))
                ret = -EFAULT;
        spin_lock(&sbi->fs_lock);
@@ -573,7 +576,8 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                struct autofs_info *ino = autofs4_dentry_ino(dentry);
                /* This is synchronous because it makes the daemon a
-                   little easier */
+                 * little easier
+                 */
                ret = autofs4_wait(sbi, dentry, NFY_EXPIRE);
                spin_lock(&sbi->fs_lock);
@@ -588,8 +592,10 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
        return ret;
 }
-/* Call repeatedly until it returns -EAGAIN, meaning there's nothing
+/*
-   more to be done */
+ * Call repeatedly until it returns -EAGAIN, meaning there's nothing
+ * more to be done.
+ */
 int autofs4_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                        struct autofs_sb_info *sbi, int __user *arg)
 {
diff --git a/fs/autofs4/init.c b/fs/autofs4/init.c
index b3db517e89ec..8cf0e63389ae 100644
--- a/fs/autofs4/init.c
+++ b/fs/autofs4/init.c
@@ -1,14 +1,10 @@
-/* -*- c -*- --------------------------------------------------------------- *
+/*
- *
+ * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- * linux/fs/autofs/init.c
- *
- *  Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ------------------------------------------------------------------------- */
 #include <linux/module.h>
 #include <linux/init.h>
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index a3ae0b2aeb5a..61b21051bd5a 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -1,15 +1,11 @@
-/* -*- c -*- --------------------------------------------------------------- *
+/*
- *
+ * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- * linux/fs/autofs/inode.c
+ * Copyright 2005-2006 Ian Kent <raven@themaw.net>
- *
- *  Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- *  Copyright 2005-2006 Ian Kent <raven@themaw.net>
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ------------------------------------------------------------------------- */
 #include <linux/kernel.h>
 #include <linux/slab.h>
@@ -24,7 +20,9 @@
 struct autofs_info *autofs4_new_ino(struct autofs_sb_info *sbi)
 {
-        struct autofs_info *ino = kzalloc(sizeof(*ino), GFP_KERNEL);
+        struct autofs_info *ino;
+        ino = kzalloc(sizeof(*ino), GFP_KERNEL);
        if (ino) {
                INIT_LIST_HEAD(&ino->active);
                INIT_LIST_HEAD(&ino->expiring);
@@ -62,7 +60,7 @@ void autofs4_kill_sb(struct super_block *sb)
                put_pid(sbi->oz_pgrp);
        }
-        DPRINTK("shutting down");
+        pr_debug("shutting down\n");
        kill_litter_super(sb);
        if (sbi)
                kfree_rcu(sbi, rcu);
@@ -94,7 +92,12 @@ static int autofs4_show_options(struct seq_file *m, struct dentry *root)
                seq_printf(m, ",direct");
        else
                seq_printf(m, ",indirect");
+#ifdef CONFIG_CHECKPOINT_RESTORE
+        if (sbi->pipe)
+                seq_printf(m, ",pipe_ino=%ld", sbi->pipe->f_inode->i_ino);
+        else
+                seq_printf(m, ",pipe_ino=-1");
+#endif
        return 0;
 }
@@ -147,6 +150,7 @@ static int parse_options(char *options, int *pipefd, kuid_t *uid, kgid_t *gid,
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
                if (!*p)
                        continue;
@@ -204,9 +208,9 @@ static int parse_options(char *options, int *pipefd, kuid_t *uid, kgid_t *gid,
 int autofs4_fill_super(struct super_block *s, void *data, int silent)
 {
-        struct inode * root_inode;
+        struct inode *root_inode;
-        struct dentry * root;
+        struct dentry *root;
-        struct file * pipe;
+        struct file *pipe;
        int pipefd;
        struct autofs_sb_info *sbi;
        struct autofs_info *ino;
@@ -217,7 +221,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
        sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
        if (!sbi)
                return -ENOMEM;
-        DPRINTK("starting up, sbi = %p",sbi);
+        pr_debug("starting up, sbi = %p\n", sbi);
        s->s_fs_info = sbi;
        sbi->magic = AUTOFS_SBI_MAGIC;
@@ -266,14 +270,14 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
        if (parse_options(data, &pipefd, &root_inode->i_uid, &root_inode->i_gid,
                          &pgrp, &pgrp_set, &sbi->type, &sbi->min_proto,
                          &sbi->max_proto)) {
-                printk("autofs: called with bogus options\n");
+                pr_err("called with bogus options\n");
                goto fail_dput;
        }
        if (pgrp_set) {
                sbi->oz_pgrp = find_get_pid(pgrp);
                if (!sbi->oz_pgrp) {
-                        pr_warn("autofs: could not find process group %d\n",
+                        pr_err("could not find process group %d\n",
                                pgrp);
                        goto fail_dput;
                }
@@ -290,10 +294,10 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
        /* Couldn't this be tested earlier? */
        if (sbi->max_proto < AUTOFS_MIN_PROTO_VERSION ||
            sbi->min_proto > AUTOFS_MAX_PROTO_VERSION) {
-                printk("autofs: kernel does not match daemon version "
+                pr_err("kernel does not match daemon version "
                       "daemon (%d, %d) kernel (%d, %d)\n",
-                        sbi->min_proto, sbi->max_proto,
+                       sbi->min_proto, sbi->max_proto,
-                        AUTOFS_MIN_PROTO_VERSION, AUTOFS_MAX_PROTO_VERSION);
+                       AUTOFS_MIN_PROTO_VERSION, AUTOFS_MAX_PROTO_VERSION);
                goto fail_dput;
        }
@@ -304,11 +308,11 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
                sbi->version = sbi->max_proto;
        sbi->sub_version = AUTOFS_PROTO_SUBVERSION;
-        DPRINTK("pipe fd = %d, pgrp = %u", pipefd, pid_nr(sbi->oz_pgrp));
+        pr_debug("pipe fd = %d, pgrp = %u\n", pipefd, pid_nr(sbi->oz_pgrp));
        pipe = fget(pipefd);
        if (!pipe) {
-                printk("autofs: could not open pipe file descriptor\n");
+                pr_err("could not open pipe file descriptor\n");
                goto fail_dput;
        }
        ret = autofs_prepare_pipe(pipe);
@@ -323,12 +327,12 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         */
        s->s_root = root;
        return 0;
-        
        /*
         * Failure ... clean up.
         */
 fail_fput:
-        printk("autofs: pipe file descriptor does not contain proper ops\n");
+        pr_err("pipe file descriptor does not contain proper ops\n");
        fput(pipe);
        /* fall through */
 fail_dput:
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index c6d7d3dbd52a..9328b5861c7a 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -1,16 +1,12 @@
-/* -*- c -*- --------------------------------------------------------------- *
+/*
- *
+ * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- * linux/fs/autofs/root.c
+ * Copyright 1999-2000 Jeremy Fitzhardinge <jeremy@goop.org>
- *
+ * Copyright 2001-2006 Ian Kent <raven@themaw.net>
- *  Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- *  Copyright 1999-2000 Jeremy Fitzhardinge <jeremy@goop.org>
- *  Copyright 2001-2006 Ian Kent <raven@themaw.net>
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ------------------------------------------------------------------------- */
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -23,16 +19,18 @@
 #include "autofs_i.h"
-static int autofs4_dir_symlink(struct inode *,struct dentry *,const char *);
+static int autofs4_dir_symlink(struct inode *, struct dentry *, const char *);
-static int autofs4_dir_unlink(struct inode *,struct dentry *);
+static int autofs4_dir_unlink(struct inode *, struct dentry *);
-static int autofs4_dir_rmdir(struct inode *,struct dentry *);
+static int autofs4_dir_rmdir(struct inode *, struct dentry *);
-static int autofs4_dir_mkdir(struct inode *,struct dentry *,umode_t);
+static int autofs4_dir_mkdir(struct inode *, struct dentry *, umode_t);
-static long autofs4_root_ioctl(struct file *,unsigned int,unsigned long);
+static long autofs4_root_ioctl(struct file *, unsigned int, unsigned long);
 #ifdef CONFIG_COMPAT
-static long autofs4_root_compat_ioctl(struct file *,unsigned int,unsigned long);
+static long autofs4_root_compat_ioctl(struct file *,
+                                      unsigned int, unsigned long);
 #endif
 static int autofs4_dir_open(struct inode *inode, struct file *file);
-static struct dentry *autofs4_lookup(struct inode *,struct dentry *, unsigned int);
+static struct dentry *autofs4_lookup(struct inode *,
+                                     struct dentry *, unsigned int);
 static struct vfsmount *autofs4_d_automount(struct path *);
 static int autofs4_d_manage(struct dentry *, bool);
 static void autofs4_dentry_release(struct dentry *);
@@ -74,7 +72,9 @@ const struct dentry_operations autofs4_dentry_operations = {
 static void autofs4_add_active(struct dentry *dentry)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
+        struct autofs_info *ino;
+        ino = autofs4_dentry_ino(dentry);
        if (ino) {
                spin_lock(&sbi->lookup_lock);
                if (!ino->active_count) {
@@ -84,13 +84,14 @@ static void autofs4_add_active(struct dentry *dentry)
                ino->active_count++;
                spin_unlock(&sbi->lookup_lock);
        }
-        return;
 }
 static void autofs4_del_active(struct dentry *dentry)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
+        struct autofs_info *ino;
+        ino = autofs4_dentry_ino(dentry);
        if (ino) {
                spin_lock(&sbi->lookup_lock);
                ino->active_count--;
@@ -100,7 +101,6 @@ static void autofs4_del_active(struct dentry *dentry)
                }
                spin_unlock(&sbi->lookup_lock);
        }
-        return;
 }
 static int autofs4_dir_open(struct inode *inode, struct file *file)
@@ -108,7 +108,7 @@ static int autofs4_dir_open(struct inode *inode, struct file *file)
        struct dentry *dentry = file->f_path.dentry;
        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        DPRINTK("file=%p dentry=%p %pd", file, dentry, dentry);
+        pr_debug("file=%p dentry=%p %pd\n", file, dentry, dentry);
        if (autofs4_oz_mode(sbi))
                goto out;
@@ -138,7 +138,7 @@ static void autofs4_dentry_release(struct dentry *de)
        struct autofs_info *ino = autofs4_dentry_ino(de);
        struct autofs_sb_info *sbi = autofs4_sbi(de->d_sb);
-        DPRINTK("releasing %p", de);
+        pr_debug("releasing %p\n", de);
        if (!ino)
                return;
@@ -278,9 +278,9 @@ static int autofs4_mount_wait(struct dentry *dentry, bool rcu_walk)
        if (ino->flags & AUTOFS_INF_PENDING) {
                if (rcu_walk)
                        return -ECHILD;
-                DPRINTK("waiting for mount name=%pd", dentry);
+                pr_debug("waiting for mount name=%pd\n", dentry);
                status = autofs4_wait(sbi, dentry, NFY_MOUNT);
-                DPRINTK("mount wait done status=%d", status);
+                pr_debug("mount wait done status=%d\n", status);
        }
        ino->last_used = jiffies;
        return status;
@@ -320,7 +320,9 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path)
        if (autofs_type_indirect(sbi->type) && d_unhashed(dentry)) {
                struct dentry *parent = dentry->d_parent;
                struct autofs_info *ino;
-                struct dentry *new = d_lookup(parent, &dentry->d_name);
+                struct dentry *new;
+                new = d_lookup(parent, &dentry->d_name);
                if (!new)
                        return NULL;
                ino = autofs4_dentry_ino(new);
@@ -338,7 +340,7 @@ static struct vfsmount *autofs4_d_automount(struct path *path)
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        int status;
-        DPRINTK("dentry=%p %pd", dentry, dentry);
+        pr_debug("dentry=%p %pd\n", dentry, dentry);
        /* The daemon never triggers a mount. */
        if (autofs4_oz_mode(sbi))
@@ -425,7 +427,7 @@ static int autofs4_d_manage(struct dentry *dentry, bool rcu_walk)
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        int status;
-        DPRINTK("dentry=%p %pd", dentry, dentry);
+        pr_debug("dentry=%p %pd\n", dentry, dentry);
        /* The daemon never waits. */
        if (autofs4_oz_mode(sbi)) {
@@ -455,6 +457,7 @@ static int autofs4_d_manage(struct dentry *dentry, bool rcu_walk)
                 * a mount-trap.
                 */
                struct inode *inode;
                if (ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU))
                        return 0;
                if (d_mountpoint(dentry))
@@ -494,13 +497,14 @@ static int autofs4_d_manage(struct dentry *dentry, bool rcu_walk)
 }
 /* Lookups in the root directory */
-static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
+static struct dentry *autofs4_lookup(struct inode *dir,
+                                     struct dentry *dentry, unsigned int flags)
 {
        struct autofs_sb_info *sbi;
        struct autofs_info *ino;
        struct dentry *active;
-        DPRINTK("name = %pd", dentry);
+        pr_debug("name = %pd\n", dentry);
        /* File name too long to exist */
        if (dentry->d_name.len > NAME_MAX)
@@ -508,14 +512,14 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, u
        sbi = autofs4_sbi(dir->i_sb);
-        DPRINTK("pid = %u, pgrp = %u, catatonic = %d, oz_mode = %d",
+        pr_debug("pid = %u, pgrp = %u, catatonic = %d, oz_mode = %d\n",
-                current->pid, task_pgrp_nr(current), sbi->catatonic,
+                 current->pid, task_pgrp_nr(current), sbi->catatonic,
-                autofs4_oz_mode(sbi));
+                 autofs4_oz_mode(sbi));
        active = autofs4_lookup_active(dentry);
-        if (active) {
+        if (active)
                return active;
-        } else {
+        else {
                /*
                 * A dentry that is not within the root can never trigger a
                 * mount operation, unless the directory already exists, so we
@@ -526,7 +530,8 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, u
                        return ERR_PTR(-ENOENT);
                /* Mark entries in the root as mount triggers */
-                if (autofs_type_indirect(sbi->type) && IS_ROOT(dentry->d_parent))
+                if (IS_ROOT(dentry->d_parent) &&
+                    autofs_type_indirect(sbi->type))
                        __managed_dentry_set_managed(dentry);
                ino = autofs4_new_ino(sbi);
@@ -554,7 +559,7 @@ static int autofs4_dir_symlink(struct inode *dir,
        size_t size = strlen(symname);
        char *cp;
-        DPRINTK("%s <- %pd", symname, dentry);
+        pr_debug("%s <- %pd\n", symname, dentry);
        if (!autofs4_oz_mode(sbi))
                return -EACCES;
@@ -613,7 +618,7 @@ static int autofs4_dir_unlink(struct inode *dir, struct dentry *dentry)
        struct autofs_sb_info *sbi = autofs4_sbi(dir->i_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        struct autofs_info *p_ino;
-        
        /* This allows root to remove symlinks */
        if (!autofs4_oz_mode(sbi) && !capable(CAP_SYS_ADMIN))
                return -EPERM;
@@ -664,7 +669,6 @@ static void autofs_set_leaf_automount_flags(struct dentry *dentry)
        if (IS_ROOT(parent->d_parent))
                return;
        managed_dentry_clear_managed(parent);
-        return;
 }
 static void autofs_clear_leaf_automount_flags(struct dentry *dentry)
@@ -687,7 +691,6 @@ static void autofs_clear_leaf_automount_flags(struct dentry *dentry)
        if (d_child->next == &parent->d_subdirs &&
            d_child->prev == &parent->d_subdirs)
                managed_dentry_set_managed(parent);
-        return;
 }
 static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
@@ -695,8 +698,8 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
        struct autofs_sb_info *sbi = autofs4_sbi(dir->i_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
        struct autofs_info *p_ino;
-        
-        DPRINTK("dentry %p, removing %pd", dentry, dentry);
+        pr_debug("dentry %p, removing %pd\n", dentry, dentry);
        if (!autofs4_oz_mode(sbi))
                return -EACCES;
@@ -728,7 +731,8 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
        return 0;
 }
-static int autofs4_dir_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int autofs4_dir_mkdir(struct inode *dir,
+                             struct dentry *dentry, umode_t mode)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(dir->i_sb);
        struct autofs_info *ino = autofs4_dentry_ino(dentry);
@@ -738,7 +742,7 @@ static int autofs4_dir_mkdir(struct inode *dir, struct dentry *dentry, umode_t m
        if (!autofs4_oz_mode(sbi))
                return -EACCES;
-        DPRINTK("dentry %p, creating %pd", dentry, dentry);
+        pr_debug("dentry %p, creating %pd\n", dentry, dentry);
        BUG_ON(!ino);
@@ -768,14 +772,18 @@ static int autofs4_dir_mkdir(struct inode *dir, struct dentry *dentry, umode_t m
 /* Get/set timeout ioctl() operation */
 #ifdef CONFIG_COMPAT
 static inline int autofs4_compat_get_set_timeout(struct autofs_sb_info *sbi,
-                                         compat_ulong_t __user *p)
+                                                 compat_ulong_t __user *p)
 {
-        int rv;
        unsigned long ntimeout;
+        int rv;
-        if ((rv = get_user(ntimeout, p)) ||
+        rv = get_user(ntimeout, p);
-             (rv = put_user(sbi->exp_timeout/HZ, p)))
+        if (rv)
-                return rv;
+                goto error;
+        rv = put_user(sbi->exp_timeout/HZ, p);
+        if (rv)
+                goto error;
        if (ntimeout > UINT_MAX/HZ)
                sbi->exp_timeout = 0;
@@ -783,18 +791,24 @@ static inline int autofs4_compat_get_set_timeout(struct autofs_sb_info *sbi,
                sbi->exp_timeout = ntimeout * HZ;
        return 0;
+error:
+        return rv;
 }
 #endif
 static inline int autofs4_get_set_timeout(struct autofs_sb_info *sbi,
-                                         unsigned long __user *p)
+                                          unsigned long __user *p)
 {
-        int rv;
        unsigned long ntimeout;
+        int rv;
-        if ((rv = get_user(ntimeout, p)) ||
+        rv = get_user(ntimeout, p);
-             (rv = put_user(sbi->exp_timeout/HZ, p)))
+        if (rv)
-                return rv;
+                goto error;
+        rv = put_user(sbi->exp_timeout/HZ, p);
+        if (rv)
+                goto error;
        if (ntimeout > ULONG_MAX/HZ)
                sbi->exp_timeout = 0;
@@ -802,16 +816,20 @@ static inline int autofs4_get_set_timeout(struct autofs_sb_info *sbi,
                sbi->exp_timeout = ntimeout * HZ;
        return 0;
+error:
+        return rv;
 }
 /* Return protocol version */
-static inline int autofs4_get_protover(struct autofs_sb_info *sbi, int __user *p)
+static inline int autofs4_get_protover(struct autofs_sb_info *sbi,
+                                       int __user *p)
 {
        return put_user(sbi->version, p);
 }
 /* Return protocol sub version */
-static inline int autofs4_get_protosubver(struct autofs_sb_info *sbi, int __user *p)
+static inline int autofs4_get_protosubver(struct autofs_sb_info *sbi,
+                                          int __user *p)
 {
        return put_user(sbi->sub_version, p);
 }
@@ -826,7 +844,7 @@ static inline int autofs4_ask_umount(struct vfsmount *mnt, int __user *p)
        if (may_umount(mnt))
                status = 1;
-        DPRINTK("returning %d", status);
+        pr_debug("returning %d\n", status);
        status = put_user(status, p);
@@ -834,9 +852,9 @@ static inline int autofs4_ask_umount(struct vfsmount *mnt, int __user *p)
 }
 /* Identify autofs4_dentries - this is so we can tell if there's
-   an extra dentry refcount or not.  We only hold a refcount on the
+ * an extra dentry refcount or not.  We only hold a refcount on the
-   dentry if its non-negative (ie, d_inode != NULL)
+ * dentry if its non-negative (ie, d_inode != NULL)
-*/
+ */
 int is_autofs4_dentry(struct dentry *dentry)
 {
        return dentry && d_really_is_positive(dentry) &&
@@ -854,21 +872,21 @@ static int autofs4_root_ioctl_unlocked(struct inode *inode, struct file *filp,
        struct autofs_sb_info *sbi = autofs4_sbi(inode->i_sb);
        void __user *p = (void __user *)arg;
-        DPRINTK("cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u",
+        pr_debug("cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u\n",
-                cmd,arg,sbi,task_pgrp_nr(current));
+                 cmd, arg, sbi, task_pgrp_nr(current));
        if (_IOC_TYPE(cmd) != _IOC_TYPE(AUTOFS_IOC_FIRST) ||
             _IOC_NR(cmd) - _IOC_NR(AUTOFS_IOC_FIRST) >= AUTOFS_IOC_COUNT)
                return -ENOTTY;
-        
        if (!autofs4_oz_mode(sbi) && !capable(CAP_SYS_ADMIN))
                return -EPERM;
-        
-        switch(cmd) {
+        switch (cmd) {
        case AUTOFS_IOC_READY:  /* Wait queue: go ahead and retry */
-                return autofs4_wait_release(sbi,(autofs_wqt_t)arg,0);
+                return autofs4_wait_release(sbi, (autofs_wqt_t) arg, 0);
        case AUTOFS_IOC_FAIL:   /* Wait queue: fail with ENOENT */
-                return autofs4_wait_release(sbi,(autofs_wqt_t)arg,-ENOENT);
+                return autofs4_wait_release(sbi, (autofs_wqt_t) arg, -ENOENT);
        case AUTOFS_IOC_CATATONIC: /* Enter catatonic mode (daemon shutdown) */
                autofs4_catatonic_mode(sbi);
                return 0;
@@ -888,13 +906,15 @@ static int autofs4_root_ioctl_unlocked(struct inode *inode, struct file *filp,
        /* return a single thing to expire */
        case AUTOFS_IOC_EXPIRE:
-                return autofs4_expire_run(inode->i_sb,filp->f_path.mnt,sbi, p);
+                return autofs4_expire_run(inode->i_sb,
+                                          filp->f_path.mnt, sbi, p);
        /* same as above, but can send multiple expires through pipe */
        case AUTOFS_IOC_EXPIRE_MULTI:
-                return autofs4_expire_multi(inode->i_sb,filp->f_path.mnt,sbi, p);
+                return autofs4_expire_multi(inode->i_sb,
+                                            filp->f_path.mnt, sbi, p);
        default:
-                return -ENOSYS;
+                return -EINVAL;
        }
 }
@@ -902,12 +922,13 @@ static long autofs4_root_ioctl(struct file *filp,
                               unsigned int cmd, unsigned long arg)
 {
        struct inode *inode = file_inode(filp);
        return autofs4_root_ioctl_unlocked(inode, filp, cmd, arg);
 }
 #ifdef CONFIG_COMPAT
 static long autofs4_root_compat_ioctl(struct file *filp,
-                             unsigned int cmd, unsigned long arg)
+                                      unsigned int cmd, unsigned long arg)
 {
        struct inode *inode = file_inode(filp);
        int ret;
@@ -916,7 +937,7 @@ static long autofs4_root_compat_ioctl(struct file *filp,
                ret = autofs4_root_ioctl_unlocked(inode, filp, cmd, arg);
        else
                ret = autofs4_root_ioctl_unlocked(inode, filp, cmd,
-                        (unsigned long)compat_ptr(arg));
+                                              (unsigned long) compat_ptr(arg));
        return ret;
 }
diff --git a/fs/autofs4/symlink.c b/fs/autofs4/symlink.c
index 84e037d1d129..99aab00dc217 100644
--- a/fs/autofs4/symlink.c
+++ b/fs/autofs4/symlink.c
@@ -1,14 +1,10 @@
-/* -*- c -*- --------------------------------------------------------------- *
+/*
- *
+ * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- * linux/fs/autofs/symlink.c
- *
- *  Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ------------------------------------------------------------------------- */
 #include "autofs_i.h"
@@ -18,6 +14,7 @@ static const char *autofs4_get_link(struct dentry *dentry,
 {
        struct autofs_sb_info *sbi;
        struct autofs_info *ino;
        if (!dentry)
                return ERR_PTR(-ECHILD);
        sbi = autofs4_sbi(dentry->d_sb);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 35b755e79c2d..0146d911f468 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -1,15 +1,11 @@
-/* -*- c -*- --------------------------------------------------------------- *
+/*
- *
+ * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- * linux/fs/autofs/waitq.c
+ * Copyright 2001-2006 Ian Kent <raven@themaw.net>
- *
- *  Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
- *  Copyright 2001-2006 Ian Kent <raven@themaw.net>
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ------------------------------------------------------------------------- */
 #include <linux/slab.h>
 #include <linux/time.h>
@@ -18,7 +14,8 @@
 #include "autofs_i.h"
 /* We make this a static variable rather than a part of the superblock; it
-   is better if we don't reassign numbers easily even across filesystems */
+ * is better if we don't reassign numbers easily even across filesystems
+ */
 static autofs_wqt_t autofs4_next_wait_queue = 1;
 /* These are the signals we allow interrupting a pending mount */
@@ -34,7 +31,7 @@ void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
                return;
        }
-        DPRINTK("entering catatonic mode");
+        pr_debug("entering catatonic mode\n");
        sbi->catatonic = 1;
        wq = sbi->queues;
@@ -69,17 +66,19 @@ static int autofs4_write(struct autofs_sb_info *sbi,
        set_fs(KERNEL_DS);
        mutex_lock(&sbi->pipe_mutex);
-        while (bytes &&
+        wr = __vfs_write(file, data, bytes, &file->f_pos);
-               (wr = __vfs_write(file,data,bytes,&file->f_pos)) > 0) {
+        while (bytes && wr) {
                data += wr;
                bytes -= wr;
+                wr = __vfs_write(file, data, bytes, &file->f_pos);
        }
        mutex_unlock(&sbi->pipe_mutex);
        set_fs(fs);
        /* Keep the currently executing process from receiving a
-           SIGPIPE unless it was already supposed to get one */
+         * SIGPIPE unless it was already supposed to get one
+         */
        if (wr == -EPIPE && !sigpipe) {
                spin_lock_irqsave(&current->sighand->siglock, flags);
                sigdelset(&current->pending.signal, SIGPIPE);
@@ -89,7 +88,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
        return (bytes > 0);
 }
-        
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                 struct autofs_wait_queue *wq,
                                 int type)
@@ -102,10 +101,11 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
        struct file *pipe = NULL;
        size_t pktsz;
-        DPRINTK("wait id = 0x%08lx, name = %.*s, type=%d",
+        pr_debug("wait id = 0x%08lx, name = %.*s, type=%d\n",
-                (unsigned long) wq->wait_queue_token, wq->name.len, wq->name.name, type);
+                 (unsigned long) wq->wait_queue_token,
+                 wq->name.len, wq->name.name, type);
-        memset(&pkt,0,sizeof pkt); /* For security reasons */
+        memset(&pkt, 0, sizeof(pkt)); /* For security reasons */
        pkt.hdr.proto_version = sbi->version;
        pkt.hdr.type = type;
@@ -126,7 +126,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
        }
        case autofs_ptype_expire_multi:
        {
-                struct autofs_packet_expire_multi *ep = &pkt.v4_pkt.expire_multi;
+                struct autofs_packet_expire_multi *ep =
+                                        &pkt.v4_pkt.expire_multi;
                pktsz = sizeof(*ep);
@@ -163,7 +164,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                break;
        }
        default:
-                printk("autofs4_notify_daemon: bad type %d!\n", type);
+                pr_warn("bad type %d!\n", type);
                mutex_unlock(&sbi->wq_mutex);
                return;
        }
@@ -231,7 +232,7 @@ autofs4_find_wait(struct autofs_sb_info *sbi, struct qstr *qstr)
                if (wq->name.hash == qstr->hash &&
                    wq->name.len == qstr->len &&
                    wq->name.name &&
-                         !memcmp(wq->name.name, qstr->name, qstr->len))
+                    !memcmp(wq->name.name, qstr->name, qstr->len))
                        break;
        }
        return wq;
@@ -248,7 +249,7 @@ autofs4_find_wait(struct autofs_sb_info *sbi, struct qstr *qstr)
 static int validate_request(struct autofs_wait_queue **wait,
                            struct autofs_sb_info *sbi,
                            struct qstr *qstr,
-                            struct dentry*dentry, enum autofs_notify notify)
+                            struct dentry *dentry, enum autofs_notify notify)
 {
        struct autofs_wait_queue *wq;
        struct autofs_info *ino;
@@ -322,8 +323,10 @@ static int validate_request(struct autofs_wait_queue **wait,
                 * continue on and create a new request.
                 */
                if (!IS_ROOT(dentry)) {
-                        if (d_really_is_positive(dentry) && d_unhashed(dentry)) {
+                        if (d_unhashed(dentry) &&
+                            d_really_is_positive(dentry)) {
                                struct dentry *parent = dentry->d_parent;
                                new = d_lookup(parent, &dentry->d_name);
                                if (new)
                                        dentry = new;
@@ -340,8 +343,8 @@ static int validate_request(struct autofs_wait_queue **wait,
        return 1;
 }
-int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
+int autofs4_wait(struct autofs_sb_info *sbi,
-                enum autofs_notify notify)
+                 struct dentry *dentry, enum autofs_notify notify)
 {
        struct autofs_wait_queue *wq;
        struct qstr qstr;
@@ -411,7 +414,7 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
        if (!wq) {
                /* Create a new wait queue */
-                wq = kmalloc(sizeof(struct autofs_wait_queue),GFP_KERNEL);
+                wq = kmalloc(sizeof(struct autofs_wait_queue), GFP_KERNEL);
                if (!wq) {
                        kfree(qstr.name);
                        mutex_unlock(&sbi->wq_mutex);
@@ -450,17 +453,19 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                                        autofs_ptype_expire_indirect;
                }
-                DPRINTK("new wait id = 0x%08lx, name = %.*s, nfy=%d\n",
+                pr_debug("new wait id = 0x%08lx, name = %.*s, nfy=%d\n",
-                        (unsigned long) wq->wait_queue_token, wq->name.len,
+                         (unsigned long) wq->wait_queue_token, wq->name.len,
-                        wq->name.name, notify);
+                         wq->name.name, notify);
-                /* autofs4_notify_daemon() may block; it will unlock ->wq_mutex */
+                /*
+                 * autofs4_notify_daemon() may block; it will unlock ->wq_mutex
+                 */
                autofs4_notify_daemon(sbi, wq, type);
        } else {
                wq->wait_ctr++;
-                DPRINTK("existing wait id = 0x%08lx, name = %.*s, nfy=%d",
+                pr_debug("existing wait id = 0x%08lx, name = %.*s, nfy=%d\n",
-                        (unsigned long) wq->wait_queue_token, wq->name.len,
+                         (unsigned long) wq->wait_queue_token, wq->name.len,
-                        wq->name.name, notify);
+                         wq->name.name, notify);
                mutex_unlock(&sbi->wq_mutex);
                kfree(qstr.name);
        }
@@ -471,12 +476,14 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
         */
        if (wq->name.name) {
                /* Block all but "shutdown" signals while waiting */
-                sigset_t oldset;
+                unsigned long shutdown_sigs_mask;
                unsigned long irqflags;
+                sigset_t oldset;
                spin_lock_irqsave(&current->sighand->siglock, irqflags);
                oldset = current->blocked;
-                siginitsetinv(&current->blocked, SHUTDOWN_SIGS & ~oldset.sig[0]);
+                shutdown_sigs_mask = SHUTDOWN_SIGS & ~oldset.sig[0];
+                siginitsetinv(&current->blocked, shutdown_sigs_mask);
                recalc_sigpending();
                spin_unlock_irqrestore(&current->sighand->siglock, irqflags);
@@ -487,7 +494,7 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                recalc_sigpending();
                spin_unlock_irqrestore(&current->sighand->siglock, irqflags);
        } else {
-                DPRINTK("skipped sleeping");
+                pr_debug("skipped sleeping\n");
        }
        status = wq->status;
@@ -562,4 +569,3 @@ int autofs4_wait_release(struct autofs_sb_info *sbi, autofs_wqt_t wait_queue_tok
        return 0;
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index e1632abb4ca9..33be29675358 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -621,17 +621,17 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode);
 * If warn is true, then emit a warning if the page is not uptodate and has
 * not been truncated.
 *
- * The caller must hold mem_cgroup_begin_page_stat() lock.
+ * The caller must hold lock_page_memcg().
 */
 static void __set_page_dirty(struct page *page, struct address_space *mapping,
-                             struct mem_cgroup *memcg, int warn)
+                             int warn)
 {
        unsigned long flags;
        spin_lock_irqsave(&mapping->tree_lock, flags);
        if (page->mapping) {    /* Race with truncate? */
                WARN_ON_ONCE(warn && !PageUptodate(page));
-                account_page_dirtied(page, mapping, memcg);
+                account_page_dirtied(page, mapping);
                radix_tree_tag_set(&mapping->page_tree,
                                page_index(page), PAGECACHE_TAG_DIRTY);
        }
@@ -666,7 +666,6 @@ static void __set_page_dirty(struct page *page, struct address_space *mapping,
 int __set_page_dirty_buffers(struct page *page)
 {
        int newly_dirty;
-        struct mem_cgroup *memcg;
        struct address_space *mapping = page_mapping(page);
        if (unlikely(!mapping))
@@ -683,17 +682,17 @@ int __set_page_dirty_buffers(struct page *page)
                } while (bh != head);
        }
        /*
-         * Use mem_group_begin_page_stat() to keep PageDirty synchronized with
+         * Lock out page->mem_cgroup migration to keep PageDirty
-         * per-memcg dirty page counters.
+         * synchronized with per-memcg dirty page counters.
         */
-        memcg = mem_cgroup_begin_page_stat(page);
+        lock_page_memcg(page);
        newly_dirty = !TestSetPageDirty(page);
        spin_unlock(&mapping->private_lock);
        if (newly_dirty)
-                __set_page_dirty(page, mapping, memcg, 1);
+                __set_page_dirty(page, mapping, 1);
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
        if (newly_dirty)
                __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
@@ -1167,15 +1166,14 @@ void mark_buffer_dirty(struct buffer_head *bh)
        if (!test_set_buffer_dirty(bh)) {
                struct page *page = bh->b_page;
                struct address_space *mapping = NULL;
-                struct mem_cgroup *memcg;
-                memcg = mem_cgroup_begin_page_stat(page);
+                lock_page_memcg(page);
                if (!TestSetPageDirty(page)) {
                        mapping = page_mapping(page);
                        if (mapping)
-                                __set_page_dirty(page, mapping, memcg, 0);
+                                __set_page_dirty(page, mapping, 0);
                }
-                mem_cgroup_end_page_stat(memcg);
+                unlock_page_memcg(page);
                if (mapping)
                        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
        }
diff --git a/fs/mpage.c b/fs/mpage.c
index 1480d3a18037..6bd9fd90964e 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -24,6 +24,7 @@
 #include <linux/highmem.h>
 #include <linux/prefetch.h>
 #include <linux/mpage.h>
+#include <linux/mm_inline.h>
 #include <linux/writeback.h>
 #include <linux/backing-dev.h>
 #include <linux/pagevec.h>
@@ -366,7 +367,7 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages,
        map_bh.b_state = 0;
        map_bh.b_size = 0;
        for (page_idx = 0; page_idx < nr_pages; page_idx++) {
-                struct page *page = list_entry(pages->prev, struct page, lru);
+                struct page *page = lru_to_page(pages);
                prefetchw(&page->flags);
                list_del(&page->lru);
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index a76b9ea7722e..ef6a2ec494de 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -287,7 +287,6 @@ struct o2hb_bio_wait_ctxt {
 static void o2hb_write_timeout(struct work_struct *work)
 {
        int failed, quorum;
-        unsigned long flags;
        struct o2hb_region *reg =
                container_of(work, struct o2hb_region,
                             hr_write_timeout_work.work);
@@ -297,14 +296,14 @@ static void o2hb_write_timeout(struct work_struct *work)
             jiffies_to_msecs(jiffies - reg->hr_last_timeout_start));
        if (o2hb_global_heartbeat_active()) {
-                spin_lock_irqsave(&o2hb_live_lock, flags);
+                spin_lock(&o2hb_live_lock);
                if (test_bit(reg->hr_region_num, o2hb_quorum_region_bitmap))
                        set_bit(reg->hr_region_num, o2hb_failed_region_bitmap);
                failed = bitmap_weight(o2hb_failed_region_bitmap,
                                        O2NM_MAX_REGIONS);
                quorum = bitmap_weight(o2hb_quorum_region_bitmap,
                                        O2NM_MAX_REGIONS);
-                spin_unlock_irqrestore(&o2hb_live_lock, flags);
+                spin_unlock(&o2hb_live_lock);
                mlog(ML_HEARTBEAT, "Number of regions %d, failed regions %d\n",
                     quorum, failed);
@@ -2425,11 +2424,10 @@ EXPORT_SYMBOL_GPL(o2hb_check_node_heartbeating);
 int o2hb_check_node_heartbeating_no_sem(u8 node_num)
 {
        unsigned long testing_map[BITS_TO_LONGS(O2NM_MAX_NODES)];
-        unsigned long flags;
-        spin_lock_irqsave(&o2hb_live_lock, flags);
+        spin_lock(&o2hb_live_lock);
        o2hb_fill_node_map_from_callback(testing_map, sizeof(testing_map));
-        spin_unlock_irqrestore(&o2hb_live_lock, flags);
+        spin_unlock(&o2hb_live_lock);
        if (!test_bit(node_num, testing_map)) {
                mlog(ML_HEARTBEAT,
                     "node (%u) does not have heartbeating enabled.\n",
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index 68c607e63ff6..004f2cbe8f71 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -282,6 +282,7 @@ static inline void __dlm_set_joining_node(struct dlm_ctxt *dlm,
 #define DLM_LOCK_RES_DROPPING_REF         0x00000040
 #define DLM_LOCK_RES_BLOCK_DIRTY          0x00001000
 #define DLM_LOCK_RES_SETREF_INPROG        0x00002000
+#define DLM_LOCK_RES_RECOVERY_WAITING     0x00004000
 /* max milliseconds to wait to sync up a network failure with a node death */
 #define DLM_NODE_DEATH_WAIT_MAX (5 * 1000)
@@ -451,6 +452,7 @@ enum {
        DLM_QUERY_REGION                = 519,
        DLM_QUERY_NODEINFO              = 520,
        DLM_BEGIN_EXIT_DOMAIN_MSG       = 521,
+        DLM_DEREF_LOCKRES_DONE          = 522,
 };
 struct dlm_reco_node_data
@@ -545,7 +547,7 @@ struct dlm_master_requery
 * };
 *
 * from ../cluster/tcp.h
- *    NET_MAX_PAYLOAD_BYTES  (4096 - sizeof(net_msg))
+ *    O2NET_MAX_PAYLOAD_BYTES  (4096 - sizeof(net_msg))
 *    (roughly 4080 bytes)
 * and sizeof(dlm_migratable_lockres) = 112 bytes
 * and sizeof(dlm_migratable_lock) = 16 bytes
@@ -586,7 +588,7 @@ struct dlm_migratable_lockres
 /* from above, 128 bytes
 * for some undetermined future use */
-#define DLM_MIG_LOCKRES_RESERVED   (NET_MAX_PAYLOAD_BYTES - \
+#define DLM_MIG_LOCKRES_RESERVED   (O2NET_MAX_PAYLOAD_BYTES - \
                                    DLM_MIG_LOCKRES_MAX_LEN)
 struct dlm_create_lock
@@ -782,6 +784,20 @@ struct dlm_deref_lockres
        u8 name[O2NM_MAX_NAME_LEN];
 };
+enum {
+        DLM_DEREF_RESPONSE_DONE = 0,
+        DLM_DEREF_RESPONSE_INPROG = 1,
+};
+struct dlm_deref_lockres_done {
+        u32 pad1;
+        u16 pad2;
+        u8 node_idx;
+        u8 namelen;
+        u8 name[O2NM_MAX_NAME_LEN];
+};
 static inline enum dlm_status
 __dlm_lockres_state_to_status(struct dlm_lock_resource *res)
 {
@@ -789,7 +805,8 @@ __dlm_lockres_state_to_status(struct dlm_lock_resource *res)
        assert_spin_locked(&res->spinlock);
-        if (res->state & DLM_LOCK_RES_RECOVERING)
+        if (res->state & (DLM_LOCK_RES_RECOVERING|
+                        DLM_LOCK_RES_RECOVERY_WAITING))
                status = DLM_RECOVERING;
        else if (res->state & DLM_LOCK_RES_MIGRATING)
                status = DLM_MIGRATING;
@@ -968,6 +985,8 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
 void dlm_assert_master_post_handler(int status, void *data, void *ret_data);
 int dlm_deref_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                              void **ret_data);
+int dlm_deref_lockres_done_handler(struct o2net_msg *msg, u32 len, void *data,
+                              void **ret_data);
 int dlm_migrate_request_handler(struct o2net_msg *msg, u32 len, void *data,
                                void **ret_data);
 int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
@@ -1009,6 +1028,7 @@ static inline void __dlm_wait_on_lockres(struct dlm_lock_resource *res)
 {
        __dlm_wait_on_lockres_flags(res, (DLM_LOCK_RES_IN_PROGRESS|
                                          DLM_LOCK_RES_RECOVERING|
+                                          DLM_LOCK_RES_RECOVERY_WAITING|
                                          DLM_LOCK_RES_MIGRATING));
 }
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 2ee7fe747cea..12e064b8be9a 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -132,10 +132,13 @@ static DECLARE_WAIT_QUEUE_HEAD(dlm_domain_events);
 *      - Message DLM_QUERY_NODEINFO added to allow online node removes
 * New in version 1.2:
 *      - Message DLM_BEGIN_EXIT_DOMAIN_MSG added to mark start of exit domain
+ * New in version 1.3:
+ *      - Message DLM_DEREF_LOCKRES_DONE added to inform non-master that the
+ *        refmap is cleared
 */
 static const struct dlm_protocol_version dlm_protocol = {
        .pv_major = 1,
-        .pv_minor = 2,
+        .pv_minor = 3,
 };
 #define DLM_DOMAIN_BACKOFF_MS 200
@@ -1396,7 +1399,7 @@ static int dlm_send_join_cancels(struct dlm_ctxt *dlm,
                                 unsigned int map_size)
 {
        int status, tmpstat;
-        unsigned int node;
+        int node;
        if (map_size != (BITS_TO_LONGS(O2NM_MAX_NODES) *
                         sizeof(unsigned long))) {
@@ -1853,7 +1856,13 @@ static int dlm_register_domain_handlers(struct dlm_ctxt *dlm)
                                        sizeof(struct dlm_exit_domain),
                                        dlm_begin_exit_domain_handler,
                                        dlm, NULL, &dlm->dlm_domain_handlers);
+        if (status)
+                goto bail;
+        status = o2net_register_handler(DLM_DEREF_LOCKRES_DONE, dlm->key,
+                                        sizeof(struct dlm_deref_lockres_done),
+                                        dlm_deref_lockres_done_handler,
+                                        dlm, NULL, &dlm->dlm_domain_handlers);
 bail:
        if (status)
                dlm_unregister_domain_handlers(dlm);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 9477d6e1de37..9aed6e202201 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2278,7 +2278,7 @@ int dlm_drop_lockres_ref(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
                dlm_print_one_lock_resource(res);
                BUG();
        }
-        return ret;
+        return ret ? ret : r;
 }
 int dlm_deref_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
@@ -2345,7 +2345,7 @@ int dlm_deref_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                        res->lockname.len, res->lockname.name, node);
                        dlm_print_one_lock_resource(res);
                }
-                ret = 0;
+                ret = DLM_DEREF_RESPONSE_DONE;
                goto done;
        }
@@ -2365,7 +2365,7 @@ int dlm_deref_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
        spin_unlock(&dlm->work_lock);
        queue_work(dlm->dlm_worker, &dlm->dispatched_work);
-        return 0;
+        return DLM_DEREF_RESPONSE_INPROG;
 done:
        if (res)
@@ -2375,6 +2375,122 @@ done:
        return ret;
 }
+int dlm_deref_lockres_done_handler(struct o2net_msg *msg, u32 len, void *data,
+                              void **ret_data)
+{
+        struct dlm_ctxt *dlm = data;
+        struct dlm_deref_lockres_done *deref
+                        = (struct dlm_deref_lockres_done *)msg->buf;
+        struct dlm_lock_resource *res = NULL;
+        char *name;
+        unsigned int namelen;
+        int ret = -EINVAL;
+        u8 node;
+        unsigned int hash;
+        if (!dlm_grab(dlm))
+                return 0;
+        name = deref->name;
+        namelen = deref->namelen;
+        node = deref->node_idx;
+        if (namelen > DLM_LOCKID_NAME_MAX) {
+                mlog(ML_ERROR, "Invalid name length!");
+                goto done;
+        }
+        if (deref->node_idx >= O2NM_MAX_NODES) {
+                mlog(ML_ERROR, "Invalid node number: %u\n", node);
+                goto done;
+        }
+        hash = dlm_lockid_hash(name, namelen);
+        spin_lock(&dlm->spinlock);
+        res = __dlm_lookup_lockres_full(dlm, name, namelen, hash);
+        if (!res) {
+                spin_unlock(&dlm->spinlock);
+                mlog(ML_ERROR, "%s:%.*s: bad lockres name\n",
+                     dlm->name, namelen, name);
+                goto done;
+        }
+        spin_lock(&res->spinlock);
+        BUG_ON(!(res->state & DLM_LOCK_RES_DROPPING_REF));
+        if (!list_empty(&res->purge)) {
+                mlog(0, "%s: Removing res %.*s from purgelist\n",
+                        dlm->name, res->lockname.len, res->lockname.name);
+                list_del_init(&res->purge);
+                dlm_lockres_put(res);
+                dlm->purge_count--;
+        }
+        if (!__dlm_lockres_unused(res)) {
+                mlog(ML_ERROR, "%s: res %.*s in use after deref\n",
+                        dlm->name, res->lockname.len, res->lockname.name);
+                __dlm_print_one_lock_resource(res);
+                BUG();
+        }
+        __dlm_unhash_lockres(dlm, res);
+        spin_lock(&dlm->track_lock);
+        if (!list_empty(&res->tracking))
+                list_del_init(&res->tracking);
+        else {
+                mlog(ML_ERROR, "%s: Resource %.*s not on the Tracking list\n",
+                     dlm->name, res->lockname.len, res->lockname.name);
+                __dlm_print_one_lock_resource(res);
+        }
+        spin_unlock(&dlm->track_lock);
+        /* lockres is not in the hash now. drop the flag and wake up
+         * any processes waiting in dlm_get_lock_resource.
+         */
+        res->state &= ~DLM_LOCK_RES_DROPPING_REF;
+        spin_unlock(&res->spinlock);
+        wake_up(&res->wq);
+        dlm_lockres_put(res);
+        spin_unlock(&dlm->spinlock);
+done:
+        dlm_put(dlm);
+        return ret;
+}
+static void dlm_drop_lockres_ref_done(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res, u8 node)
+{
+        struct dlm_deref_lockres_done deref;
+        int ret = 0, r;
+        const char *lockname;
+        unsigned int namelen;
+        lockname = res->lockname.name;
+        namelen = res->lockname.len;
+        BUG_ON(namelen > O2NM_MAX_NAME_LEN);
+        memset(&deref, 0, sizeof(deref));
+        deref.node_idx = dlm->node_num;
+        deref.namelen = namelen;
+        memcpy(deref.name, lockname, namelen);
+        ret = o2net_send_message(DLM_DEREF_LOCKRES_DONE, dlm->key,
+                                 &deref, sizeof(deref), node, &r);
+        if (ret < 0) {
+                mlog(ML_ERROR, "%s: res %.*s, error %d send DEREF DONE "
+                                " to node %u\n", dlm->name, namelen,
+                                lockname, ret, node);
+        } else if (r < 0) {
+                /* ignore the error */
+                mlog(ML_ERROR, "%s: res %.*s, DEREF to node %u got %d\n",
+                     dlm->name, namelen, lockname, node, r);
+                dlm_print_one_lock_resource(res);
+        }
+}
 static void dlm_deref_lockres_worker(struct dlm_work_item *item, void *data)
 {
        struct dlm_ctxt *dlm;
@@ -2395,6 +2511,8 @@ static void dlm_deref_lockres_worker(struct dlm_work_item *item, void *data)
        }
        spin_unlock(&res->spinlock);
+        dlm_drop_lockres_ref_done(dlm, res, node);
        if (cleared) {
                mlog(0, "%s:%.*s node %u ref dropped in dispatch\n",
                     dlm->name, res->lockname.len, res->lockname.name, node);
@@ -2432,7 +2550,8 @@ static int dlm_is_lockres_migrateable(struct dlm_ctxt *dlm,
                return 0;
        /* delay migration when the lockres is in RECOCERING state */
-        if (res->state & DLM_LOCK_RES_RECOVERING)
+        if (res->state & (DLM_LOCK_RES_RECOVERING|
+                        DLM_LOCK_RES_RECOVERY_WAITING))
                return 0;
        if (res->owner != dlm->node_num)
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index b94a425f0175..cd38488a10fc 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1403,12 +1403,24 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
         * and RECOVERY flag changed when it completes. */
        hash = dlm_lockid_hash(mres->lockname, mres->lockname_len);
        spin_lock(&dlm->spinlock);
-        res = __dlm_lookup_lockres(dlm, mres->lockname, mres->lockname_len,
+        res = __dlm_lookup_lockres_full(dlm, mres->lockname, mres->lockname_len,
                        hash);
        if (res) {
                /* this will get a ref on res */
                /* mark it as recovering/migrating and hash it */
                spin_lock(&res->spinlock);
+                if (res->state & DLM_LOCK_RES_DROPPING_REF) {
+                        mlog(0, "%s: node is attempting to migrate "
+                                "lockres %.*s, but marked as dropping "
+                                " ref!\n", dlm->name,
+                                mres->lockname_len, mres->lockname);
+                        ret = -EINVAL;
+                        spin_unlock(&res->spinlock);
+                        spin_unlock(&dlm->spinlock);
+                        dlm_lockres_put(res);
+                        goto leave;
+                }
                if (mres->flags & DLM_MRES_RECOVERY) {
                        res->state |= DLM_LOCK_RES_RECOVERING;
                } else {
@@ -2163,6 +2175,13 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
        for (i = 0; i < DLM_HASH_BUCKETS; i++) {
                bucket = dlm_lockres_hash(dlm, i);
                hlist_for_each_entry(res, bucket, hash_node) {
+                        if (res->state & DLM_LOCK_RES_RECOVERY_WAITING) {
+                                spin_lock(&res->spinlock);
+                                res->state &= ~DLM_LOCK_RES_RECOVERY_WAITING;
+                                spin_unlock(&res->spinlock);
+                                wake_up(&res->wq);
+                        }
                        if (!(res->state & DLM_LOCK_RES_RECOVERING))
                                continue;
@@ -2300,6 +2319,7 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
                             res->lockname.len, res->lockname.name, freed, dead_node);
                        __dlm_print_one_lock_resource(res);
                }
+                res->state |= DLM_LOCK_RES_RECOVERY_WAITING;
                dlm_lockres_clear_refmap_bit(dlm, res, dead_node);
        } else if (test_bit(dead_node, res->refmap)) {
                mlog(0, "%s:%.*s: dead node %u had a ref, but had "
@@ -2377,14 +2397,16 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
                        dlm_revalidate_lvb(dlm, res, dead_node);
                        if (res->owner == dead_node) {
                                if (res->state & DLM_LOCK_RES_DROPPING_REF) {
-                                        mlog(ML_NOTICE, "%s: res %.*s, Skip "
+                                        mlog(0, "%s:%.*s: owned by "
-                                             "recovery as it is being freed\n",
+                                                "dead node %u, this node was "
-                                             dlm->name, res->lockname.len,
+                                                "dropping its ref when it died. "
-                                             res->lockname.name);
+                                                "continue, dropping the flag.\n",
-                                } else
+                                                dlm->name, res->lockname.len,
-                                        dlm_move_lockres_to_recovery_list(dlm,
+                                                res->lockname.name, dead_node);
-                                                                          res);
+                                }
+                                res->state &= ~DLM_LOCK_RES_DROPPING_REF;
+                                dlm_move_lockres_to_recovery_list(dlm,
+                                                res);
                        } else if (res->owner == dlm->node_num) {
                                dlm_free_dead_locks(dlm, res, dead_node);
                                __dlm_lockres_calc_usage(dlm, res);
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index c5f6c241ecd7..68d239ba0c63 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -106,7 +106,8 @@ int __dlm_lockres_unused(struct dlm_lock_resource *res)
        if (!list_empty(&res->dirty) || res->state & DLM_LOCK_RES_DIRTY)
                return 0;
-        if (res->state & DLM_LOCK_RES_RECOVERING)
+        if (res->state & (DLM_LOCK_RES_RECOVERING|
+                        DLM_LOCK_RES_RECOVERY_WAITING))
                return 0;
        /* Another node has this resource with this node as the master */
@@ -202,6 +203,13 @@ static void dlm_purge_lockres(struct dlm_ctxt *dlm,
                dlm->purge_count--;
        }
+        if (!master && ret != 0) {
+                mlog(0, "%s: deref %.*s in progress or master goes down\n",
+                        dlm->name, res->lockname.len, res->lockname.name);
+                spin_unlock(&res->spinlock);
+                return;
+        }
        if (!__dlm_lockres_unused(res)) {
                mlog(ML_ERROR, "%s: res %.*s in use after deref\n",
                     dlm->name, res->lockname.len, res->lockname.name);
@@ -700,7 +708,8 @@ static int dlm_thread(void *data)
                         * dirty for a short while. */
                        BUG_ON(res->state & DLM_LOCK_RES_MIGRATING);
                        if (res->state & (DLM_LOCK_RES_IN_PROGRESS |
-                                          DLM_LOCK_RES_RECOVERING)) {
+                                          DLM_LOCK_RES_RECOVERING |
+                                          DLM_LOCK_RES_RECOVERY_WAITING)) {
                                /* move it to the tail and keep going */
                                res->state &= ~DLM_LOCK_RES_DIRTY;
                                spin_unlock(&res->spinlock);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index faa1365097bc..302854ee0985 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -236,6 +236,7 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
        struct ocfs2_recovery_map *rm = osb->recovery_map;
        struct ocfs2_orphan_scan *os = &osb->osb_orphan_scan;
        int i, out = 0;
+        unsigned long flags;
        out += snprintf(buf + out, len - out,
                        "%10s => Id: %-s  Uuid: %-s  Gen: 0x%X  Label: %-s\n",
@@ -271,14 +272,14 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
                                cconn->cc_version.pv_minor);
        }
-        spin_lock(&osb->dc_task_lock);
+        spin_lock_irqsave(&osb->dc_task_lock, flags);
        out += snprintf(buf + out, len - out,
                        "%10s => Pid: %d  Count: %lu  WakeSeq: %lu  "
                        "WorkSeq: %lu\n", "DownCnvt",
                        (osb->dc_task ?  task_pid_nr(osb->dc_task) : -1),
                        osb->blocked_lock_count, osb->dc_wake_sequence,
                        osb->dc_work_sequence);
-        spin_unlock(&osb->dc_task_lock);
+        spin_unlock_irqrestore(&osb->dc_task_lock, flags);
        spin_lock(&osb->osb_lock);
        out += snprintf(buf + out, len - out, "%10s => Pid: %d  Nodes:",
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index a9ebabfe7587..5c57b7b40728 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1957,7 +1957,6 @@ xfs_vm_set_page_dirty(
        loff_t                  end_offset;
        loff_t                  offset;
        int                     newly_dirty;
-        struct mem_cgroup       *memcg;
        if (unlikely(!mapping))
                return !TestSetPageDirty(page);
@@ -1978,10 +1977,10 @@ xfs_vm_set_page_dirty(
                } while (bh != head);
        }
        /*
-         * Use mem_group_begin_page_stat() to keep PageDirty synchronized with
+         * Lock out page->mem_cgroup migration to keep PageDirty
-         * per-memcg dirty page counters.
+         * synchronized with per-memcg dirty page counters.
         */
-        memcg = mem_cgroup_begin_page_stat(page);
+        lock_page_memcg(page);
        newly_dirty = !TestSetPageDirty(page);
        spin_unlock(&mapping->private_lock);
@@ -1992,13 +1991,13 @@ xfs_vm_set_page_dirty(
                spin_lock_irqsave(&mapping->tree_lock, flags);
                if (page->mapping) {    /* Race with truncate? */
                        WARN_ON_ONCE(!PageUptodate(page));
-                        account_page_dirtied(page, mapping, memcg);
+                        account_page_dirtied(page, mapping);
                        radix_tree_tag_set(&mapping->page_tree,
                                        page_index(page), PAGECACHE_TAG_DIRTY);
                }
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
        }
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
        if (newly_dirty)
                __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
        return newly_dirty;
diff --git a/include/linux/auto_dev-ioctl.h b/include/linux/auto_dev-ioctl.h
index 850f39b33e74..7caaf298f539 100644
--- a/include/linux/auto_dev-ioctl.h
+++ b/include/linux/auto_dev-ioctl.h
@@ -11,12 +11,7 @@
 #define _LINUX_AUTO_DEV_IOCTL_H
 #include <linux/auto_fs.h>
-#ifdef __KERNEL__
 #include <linux/string.h>
-#else
-#include <string.h>
-#endif /* __KERNEL__ */
 #define AUTOFS_DEVICE_NAME              "autofs"
@@ -125,7 +120,6 @@ static inline void init_autofs_dev_ioctl(struct autofs_dev_ioctl *in)
        in->ver_minor = AUTOFS_DEV_IOCTL_VERSION_MINOR;
        in->size = sizeof(struct autofs_dev_ioctl);
        in->ioctlfd = -1;
-        return;
 }
 /*
diff --git a/include/linux/auto_fs.h b/include/linux/auto_fs.h
index fcd704d354c4..b4066bb89083 100644
--- a/include/linux/auto_fs.h
+++ b/include/linux/auto_fs.h
@@ -1,14 +1,10 @@
-/* -*- linux-c -*- ------------------------------------------------------- *
+/*
- *   
+ * Copyright 1997 Transmeta Corporation - All Rights Reserved
- * linux/include/linux/auto_fs.h
- *
- *   Copyright 1997 Transmeta Corporation - All Rights Reserved
 *
 * This file is part of the Linux kernel and is made available under
 * the terms of the GNU General Public License, version 2, or at your
 * option, any later version, incorporated herein by reference.
- *
+ */
- * ----------------------------------------------------------------------- */
 #ifndef _LINUX_AUTO_FS_H
 #define _LINUX_AUTO_FS_H
diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h
index 3159a7dba034..9f4956d8601c 100644
--- a/include/linux/fault-inject.h
+++ b/include/linux/fault-inject.h
@@ -62,10 +62,9 @@ static inline struct dentry *fault_create_debugfs_attr(const char *name,
 #endif /* CONFIG_FAULT_INJECTION */
 #ifdef CONFIG_FAILSLAB
-extern bool should_failslab(size_t size, gfp_t gfpflags, unsigned long flags);
+extern bool should_failslab(struct kmem_cache *s, gfp_t gfpflags);
 #else
-static inline bool should_failslab(size_t size, gfp_t gfpflags,
+static inline bool should_failslab(struct kmem_cache *s, gfp_t gfpflags)
-                                unsigned long flags)
 {
        return false;
 }
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index af1f2b24bbe4..bb16dfeb917e 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -9,6 +9,11 @@
 struct vm_area_struct;
+/*
+ * In case of changes, please don't forget to update
+ * include/trace/events/mmflags.h and tools/perf/builtin-kmem.c
+ */
 /* Plain integer GFP bitmasks. Do not use this directly. */
 #define ___GFP_DMA              0x01u
 #define ___GFP_HIGHMEM          0x02u
@@ -48,7 +53,6 @@ struct vm_area_struct;
 #define __GFP_DMA       ((__force gfp_t)___GFP_DMA)
 #define __GFP_HIGHMEM   ((__force gfp_t)___GFP_HIGHMEM)
 #define __GFP_DMA32     ((__force gfp_t)___GFP_DMA32)
-#define __GFP_MOVABLE   ((__force gfp_t)___GFP_MOVABLE)  /* Page is movable */
 #define __GFP_MOVABLE   ((__force gfp_t)___GFP_MOVABLE)  /* ZONE_MOVABLE allowed */
 #define GFP_ZONEMASK    (__GFP_DMA|__GFP_HIGHMEM|__GFP_DMA32|__GFP_MOVABLE)
@@ -515,13 +519,7 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp);
 void drain_all_pages(struct zone *zone);
 void drain_local_pages(struct zone *zone);
-#ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
 void page_alloc_init_late(void);
-#else
-static inline void page_alloc_init_late(void)
-{
-}
-#endif
 /*
 * gfp_allowed_mask is set to GFP_BOOT_MASK during early boot to restrict what
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 792c8981e633..f0c4bec6565b 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -28,6 +28,7 @@
 #include <linux/eventfd.h>
 #include <linux/mmzone.h>
 #include <linux/writeback.h>
+#include <linux/page-flags.h>
 struct mem_cgroup;
 struct page;
@@ -89,6 +90,10 @@ enum mem_cgroup_events_target {
 };
 #ifdef CONFIG_MEMCG
+#define MEM_CGROUP_ID_SHIFT     16
+#define MEM_CGROUP_ID_MAX       USHRT_MAX
 struct mem_cgroup_stat_cpu {
        long count[MEMCG_NR_STAT];
        unsigned long events[MEMCG_NR_EVENTS];
@@ -265,6 +270,11 @@ struct mem_cgroup {
 extern struct mem_cgroup *root_mem_cgroup;
+static inline bool mem_cgroup_disabled(void)
+{
+        return !cgroup_subsys_enabled(memory_cgrp_subsys);
+}
 /**
 * mem_cgroup_events - count memory events against a cgroup
 * @memcg: the memory cgroup
@@ -291,7 +301,7 @@ void mem_cgroup_cancel_charge(struct page *page, struct mem_cgroup *memcg,
 void mem_cgroup_uncharge(struct page *page);
 void mem_cgroup_uncharge_list(struct list_head *page_list);
-void mem_cgroup_replace_page(struct page *oldpage, struct page *newpage);
+void mem_cgroup_migrate(struct page *oldpage, struct page *newpage);
 struct lruvec *mem_cgroup_zone_lruvec(struct zone *, struct mem_cgroup *);
 struct lruvec *mem_cgroup_page_lruvec(struct page *, struct zone *);
@@ -312,6 +322,28 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *,
                                   struct mem_cgroup_reclaim_cookie *);
 void mem_cgroup_iter_break(struct mem_cgroup *, struct mem_cgroup *);
+static inline unsigned short mem_cgroup_id(struct mem_cgroup *memcg)
+{
+        if (mem_cgroup_disabled())
+                return 0;
+        return memcg->css.id;
+}
+/**
+ * mem_cgroup_from_id - look up a memcg from an id
+ * @id: the id to look up
+ *
+ * Caller must hold rcu_read_lock() and use css_tryget() as necessary.
+ */
+static inline struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
+{
+        struct cgroup_subsys_state *css;
+        css = css_from_id(id, &memory_cgrp_subsys);
+        return mem_cgroup_from_css(css);
+}
 /**
 * parent_mem_cgroup - find the accounting parent of a memcg
 * @memcg: memcg whose parent to find
@@ -353,11 +385,6 @@ static inline bool mm_match_cgroup(struct mm_struct *mm,
 struct cgroup_subsys_state *mem_cgroup_css_from_page(struct page *page);
 ino_t page_cgroup_ino(struct page *page);
-static inline bool mem_cgroup_disabled(void)
-{
-        return !cgroup_subsys_enabled(memory_cgrp_subsys);
-}
 static inline bool mem_cgroup_online(struct mem_cgroup *memcg)
 {
        if (mem_cgroup_disabled())
@@ -429,36 +456,43 @@ bool mem_cgroup_oom_synchronize(bool wait);
 extern int do_swap_account;
 #endif
-struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page);
+void lock_page_memcg(struct page *page);
-void mem_cgroup_end_page_stat(struct mem_cgroup *memcg);
+void unlock_page_memcg(struct page *page);
 /**
 * mem_cgroup_update_page_stat - update page state statistics
- * @memcg: memcg to account against
+ * @page: the page
 * @idx: page state item to account
 * @val: number of pages (positive or negative)
 *
- * See mem_cgroup_begin_page_stat() for locking requirements.
+ * The @page must be locked or the caller must use lock_page_memcg()
+ * to prevent double accounting when the page is concurrently being
+ * moved to another memcg:
+ *
+ *   lock_page(page) or lock_page_memcg(page)
+ *   if (TestClearPageState(page))
+ *     mem_cgroup_update_page_stat(page, state, -1);
+ *   unlock_page(page) or unlock_page_memcg(page)
 */
-static inline void mem_cgroup_update_page_stat(struct mem_cgroup *memcg,
+static inline void mem_cgroup_update_page_stat(struct page *page,
                                 enum mem_cgroup_stat_index idx, int val)
 {
-        VM_BUG_ON(!rcu_read_lock_held());
+        VM_BUG_ON(!(rcu_read_lock_held() || PageLocked(page)));
-        if (memcg)
+        if (page->mem_cgroup)
-                this_cpu_add(memcg->stat->count[idx], val);
+                this_cpu_add(page->mem_cgroup->stat->count[idx], val);
 }
-static inline void mem_cgroup_inc_page_stat(struct mem_cgroup *memcg,
+static inline void mem_cgroup_inc_page_stat(struct page *page,
                                            enum mem_cgroup_stat_index idx)
 {
-        mem_cgroup_update_page_stat(memcg, idx, 1);
+        mem_cgroup_update_page_stat(page, idx, 1);
 }
-static inline void mem_cgroup_dec_page_stat(struct mem_cgroup *memcg,
+static inline void mem_cgroup_dec_page_stat(struct page *page,
                                            enum mem_cgroup_stat_index idx)
 {
-        mem_cgroup_update_page_stat(memcg, idx, -1);
+        mem_cgroup_update_page_stat(page, idx, -1);
 }
 unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
@@ -496,8 +530,17 @@ void mem_cgroup_split_huge_fixup(struct page *head);
 #endif
 #else /* CONFIG_MEMCG */
+#define MEM_CGROUP_ID_SHIFT     0
+#define MEM_CGROUP_ID_MAX       0
 struct mem_cgroup;
+static inline bool mem_cgroup_disabled(void)
+{
+        return true;
+}
 static inline void mem_cgroup_events(struct mem_cgroup *memcg,
                                     enum mem_cgroup_events_index idx,
                                     unsigned int nr)
@@ -539,7 +582,7 @@ static inline void mem_cgroup_uncharge_list(struct list_head *page_list)
 {
 }
-static inline void mem_cgroup_replace_page(struct page *old, struct page *new)
+static inline void mem_cgroup_migrate(struct page *old, struct page *new)
 {
 }
@@ -580,9 +623,16 @@ static inline void mem_cgroup_iter_break(struct mem_cgroup *root,
 {
 }
-static inline bool mem_cgroup_disabled(void)
+static inline unsigned short mem_cgroup_id(struct mem_cgroup *memcg)
 {
-        return true;
+        return 0;
+}
+static inline struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
+{
+        WARN_ON_ONCE(id);
+        /* XXX: This should always return root_mem_cgroup */
+        return NULL;
 }
 static inline bool mem_cgroup_online(struct mem_cgroup *memcg)
@@ -613,12 +663,11 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 {
 }
-static inline struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page)
+static inline void lock_page_memcg(struct page *page)
 {
-        return NULL;
 }
-static inline void mem_cgroup_end_page_stat(struct mem_cgroup *memcg)
+static inline void unlock_page_memcg(struct page *page)
 {
 }
@@ -644,12 +693,12 @@ static inline bool mem_cgroup_oom_synchronize(bool wait)
        return false;
 }
-static inline void mem_cgroup_inc_page_stat(struct mem_cgroup *memcg,
+static inline void mem_cgroup_inc_page_stat(struct page *page,
                                            enum mem_cgroup_stat_index idx)
 {
 }
-static inline void mem_cgroup_dec_page_stat(struct mem_cgroup *memcg,
+static inline void mem_cgroup_dec_page_stat(struct page *page,
                                            enum mem_cgroup_stat_index idx)
 {
 }
@@ -765,7 +814,7 @@ int __memcg_kmem_charge(struct page *page, gfp_t gfp, int order);
 void __memcg_kmem_uncharge(struct page *page, int order);
 /*
- * helper for acessing a memcg's index. It will be used as an index in the
+ * helper for accessing a memcg's index. It will be used as an index in the
 * child cache array in kmem_cache, and also to derive its name. This function
 * will return -1 when this is not a kmem-limited memcg.
 */
diff --git a/include/linux/memory.h b/include/linux/memory.h
index 8b8d8d12348e..82730adba950 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -109,6 +109,9 @@ extern void unregister_memory_notifier(struct notifier_block *nb);
 extern int register_memory_isolate_notifier(struct notifier_block *nb);
 extern void unregister_memory_isolate_notifier(struct notifier_block *nb);
 extern int register_new_memory(int, struct mem_section *);
+extern int memory_block_change_state(struct memory_block *mem,
+                                     unsigned long to_state,
+                                     unsigned long from_state_req);
 #ifdef CONFIG_MEMORY_HOTREMOVE
 extern int unregister_memory_section(struct mem_section *);
 #endif
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 43405992d027..adbef586e696 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -99,6 +99,8 @@ extern void __online_page_free(struct page *page);
 extern int try_online_node(int nid);
+extern bool memhp_auto_online;
 #ifdef CONFIG_MEMORY_HOTREMOVE
 extern bool is_pageblock_removable_nolock(struct page *page);
 extern int arch_remove_memory(u64 start, u64 size);
@@ -196,6 +198,9 @@ void put_online_mems(void);
 void mem_hotplug_begin(void);
 void mem_hotplug_done(void);
+extern void set_zone_contiguous(struct zone *zone);
+extern void clear_zone_contiguous(struct zone *zone);
 #else /* ! CONFIG_MEMORY_HOTPLUG */
 /*
 * Stub functions for when hotplug is off
@@ -267,7 +272,7 @@ static inline void remove_memory(int nid, u64 start, u64 size) {}
 extern int walk_memory_range(unsigned long start_pfn, unsigned long end_pfn,
                void *arg, int (*func)(struct memory_block *, void *));
 extern int add_memory(int nid, u64 start, u64 size);
-extern int add_memory_resource(int nid, struct resource *resource);
+extern int add_memory_resource(int nid, struct resource *resource, bool online);
 extern int zone_for_memory(int nid, u64 start, u64 size, int zone_default,
                bool for_device);
 extern int arch_add_memory(int nid, u64 start, u64 size, bool for_device);
diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index cac1c0904d5f..9b50325e4ddf 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -23,9 +23,13 @@ enum migrate_reason {
        MR_SYSCALL,             /* also applies to cpusets */
        MR_MEMPOLICY_MBIND,
        MR_NUMA_MISPLACED,
-        MR_CMA
+        MR_CMA,
+        MR_TYPES
 };
+/* In mm/debug.c; also keep sync with include/trace/events/migrate.h */
+extern char *migrate_reason_names[MR_TYPES];
 #ifdef CONFIG_MIGRATION
 extern void putback_movable_pages(struct list_head *l);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 3579d1e2fe3a..dbf1eddab964 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -905,20 +905,11 @@ static inline struct mem_cgroup *page_memcg(struct page *page)
 {
        return page->mem_cgroup;
 }
-static inline void set_page_memcg(struct page *page, struct mem_cgroup *memcg)
-{
-        page->mem_cgroup = memcg;
-}
 #else
 static inline struct mem_cgroup *page_memcg(struct page *page)
 {
        return NULL;
 }
-static inline void set_page_memcg(struct page *page, struct mem_cgroup *memcg)
-{
-}
 #endif
 /*
@@ -1300,10 +1291,9 @@ int __set_page_dirty_nobuffers(struct page *page);
 int __set_page_dirty_no_writeback(struct page *page);
 int redirty_page_for_writepage(struct writeback_control *wbc,
                                struct page *page);
-void account_page_dirtied(struct page *page, struct address_space *mapping,
+void account_page_dirtied(struct page *page, struct address_space *mapping);
-                          struct mem_cgroup *memcg);
 void account_page_cleaned(struct page *page, struct address_space *mapping,
-                          struct mem_cgroup *memcg, struct bdi_writeback *wb);
+                          struct bdi_writeback *wb);
 int set_page_dirty(struct page *page);
 int set_page_dirty_lock(struct page *page);
 void cancel_dirty_page(struct page *page);
@@ -2178,6 +2168,17 @@ extern int apply_to_page_range(struct mm_struct *mm, unsigned long address,
                               unsigned long size, pte_fn_t fn, void *data);
+#ifdef CONFIG_PAGE_POISONING
+extern bool page_poisoning_enabled(void);
+extern void kernel_poison_pages(struct page *page, int numpages, int enable);
+extern bool page_is_poisoned(struct page *page);
+#else
+static inline bool page_poisoning_enabled(void) { return false; }
+static inline void kernel_poison_pages(struct page *page, int numpages,
+                                        int enable) { }
+static inline bool page_is_poisoned(struct page *page) { return false; }
+#endif
 #ifdef CONFIG_DEBUG_PAGEALLOC
 extern bool _debug_pagealloc_enabled;
 extern void __kernel_map_pages(struct page *page, int numpages, int enable);
@@ -2197,14 +2198,18 @@ kernel_map_pages(struct page *page, int numpages, int enable)
 }
 #ifdef CONFIG_HIBERNATION
 extern bool kernel_page_present(struct page *page);
-#endif /* CONFIG_HIBERNATION */
+#endif  /* CONFIG_HIBERNATION */
-#else
+#else   /* CONFIG_DEBUG_PAGEALLOC */
 static inline void
 kernel_map_pages(struct page *page, int numpages, int enable) {}
 #ifdef CONFIG_HIBERNATION
 static inline bool kernel_page_present(struct page *page) { return true; }
-#endif /* CONFIG_HIBERNATION */
+#endif  /* CONFIG_HIBERNATION */
-#endif
+static inline bool debug_pagealloc_enabled(void)
+{
+        return false;
+}
+#endif  /* CONFIG_DEBUG_PAGEALLOC */
 #ifdef __HAVE_ARCH_GATE_AREA
 extern struct vm_area_struct *get_gate_vma(struct mm_struct *mm);
diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
index 053824b0a412..de7be78c6f0e 100644
--- a/include/linux/mmdebug.h
+++ b/include/linux/mmdebug.h
@@ -9,8 +9,7 @@ struct vm_area_struct;
 struct mm_struct;
 extern void dump_page(struct page *page, const char *reason);
-extern void dump_page_badflags(struct page *page, const char *reason,
+extern void __dump_page(struct page *page, const char *reason);
-                               unsigned long badflags);
 void dump_vma(const struct vm_area_struct *vma);
 void dump_mm(const struct mm_struct *mm);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 7b6c2cfee390..6de02ac378a0 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -63,6 +63,9 @@ enum {
        MIGRATE_TYPES
 };
+/* In mm/page_alloc.c; keep in sync also with show_migration_types() there */
+extern char * const migratetype_names[MIGRATE_TYPES];
 #ifdef CONFIG_CMA
 #  define is_migrate_cma(migratetype) unlikely((migratetype) == MIGRATE_CMA)
 #else
@@ -209,10 +212,12 @@ struct zone_reclaim_stat {
 };
 struct lruvec {
-        struct list_head lists[NR_LRU_LISTS];
+        struct list_head                lists[NR_LRU_LISTS];
-        struct zone_reclaim_stat reclaim_stat;
+        struct zone_reclaim_stat        reclaim_stat;
+        /* Evictions & activations on the inactive file list */
+        atomic_long_t                   inactive_age;
 #ifdef CONFIG_MEMCG
-        struct zone *zone;
+        struct zone                     *zone;
 #endif
 };
@@ -487,9 +492,6 @@ struct zone {
        spinlock_t              lru_lock;
        struct lruvec           lruvec;
-        /* Evictions & activations on the inactive file list */
-        atomic_long_t           inactive_age;
        /*
         * When free pages are below this point, additional steps are taken
         * when reading the number of free pages to avoid per-cpu counter
@@ -520,6 +522,8 @@ struct zone {
        bool                    compact_blockskip_flush;
 #endif
+        bool                    contiguous;
        ZONE_PADDING(_pad3_)
        /* Zone statistics */
        atomic_long_t           vm_stat[NR_VM_ZONE_STAT_ITEMS];
@@ -758,6 +762,8 @@ static inline struct zone *lruvec_zone(struct lruvec *lruvec)
 #endif
 }
+extern unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru);
 #ifdef CONFIG_HAVE_MEMORY_PRESENT
 void memory_present(int nid, unsigned long start, unsigned long end);
 #else
diff --git a/include/linux/page_ext.h b/include/linux/page_ext.h
index 17f118a82854..e1fe7cf5bddf 100644
--- a/include/linux/page_ext.h
+++ b/include/linux/page_ext.h
@@ -45,6 +45,7 @@ struct page_ext {
        unsigned int order;
        gfp_t gfp_mask;
        unsigned int nr_entries;
+        int last_migrate_reason;
        unsigned long trace_entries[8];
 #endif
 };
diff --git a/include/linux/page_owner.h b/include/linux/page_owner.h
index cacaabea8a09..46f1b939948c 100644
--- a/include/linux/page_owner.h
+++ b/include/linux/page_owner.h
@@ -1,38 +1,54 @@
 #ifndef __LINUX_PAGE_OWNER_H
 #define __LINUX_PAGE_OWNER_H
+#include <linux/jump_label.h>
 #ifdef CONFIG_PAGE_OWNER
-extern bool page_owner_inited;
+extern struct static_key_false page_owner_inited;
 extern struct page_ext_operations page_owner_ops;
 extern void __reset_page_owner(struct page *page, unsigned int order);
 extern void __set_page_owner(struct page *page,
                        unsigned int order, gfp_t gfp_mask);
 extern gfp_t __get_page_owner_gfp(struct page *page);
+extern void __copy_page_owner(struct page *oldpage, struct page *newpage);
+extern void __set_page_owner_migrate_reason(struct page *page, int reason);
+extern void __dump_page_owner(struct page *page);
 static inline void reset_page_owner(struct page *page, unsigned int order)
 {
-        if (likely(!page_owner_inited))
+        if (static_branch_unlikely(&page_owner_inited))
-                return;
+                __reset_page_owner(page, order);
-        __reset_page_owner(page, order);
 }
 static inline void set_page_owner(struct page *page,
                        unsigned int order, gfp_t gfp_mask)
 {
-        if (likely(!page_owner_inited))
+        if (static_branch_unlikely(&page_owner_inited))
-                return;
+                __set_page_owner(page, order, gfp_mask);
-        __set_page_owner(page, order, gfp_mask);
 }
 static inline gfp_t get_page_owner_gfp(struct page *page)
 {
-        if (likely(!page_owner_inited))
+        if (static_branch_unlikely(&page_owner_inited))
+                return __get_page_owner_gfp(page);
+        else
                return 0;
+}
-        return __get_page_owner_gfp(page);
+static inline void copy_page_owner(struct page *oldpage, struct page *newpage)
+{
+        if (static_branch_unlikely(&page_owner_inited))
+                __copy_page_owner(oldpage, newpage);
+}
+static inline void set_page_owner_migrate_reason(struct page *page, int reason)
+{
+        if (static_branch_unlikely(&page_owner_inited))
+                __set_page_owner_migrate_reason(page, reason);
+}
+static inline void dump_page_owner(struct page *page)
+{
+        if (static_branch_unlikely(&page_owner_inited))
+                __dump_page_owner(page);
 }
 #else
 static inline void reset_page_owner(struct page *page, unsigned int order)
@@ -46,6 +62,14 @@ static inline gfp_t get_page_owner_gfp(struct page *page)
 {
        return 0;
 }
+static inline void copy_page_owner(struct page *oldpage, struct page *newpage)
+{
+}
+static inline void set_page_owner_migrate_reason(struct page *page, int reason)
+{
+}
+static inline void dump_page_owner(struct page *page)
+{
+}
 #endif /* CONFIG_PAGE_OWNER */
 #endif /* __LINUX_PAGE_OWNER_H */
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 92395a0a7dc5..183b15ea052b 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -663,8 +663,7 @@ int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
 int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
                                pgoff_t index, gfp_t gfp_mask);
 extern void delete_from_page_cache(struct page *page);
-extern void __delete_from_page_cache(struct page *page, void *shadow,
+extern void __delete_from_page_cache(struct page *page, void *shadow);
-                                     struct mem_cgroup *memcg);
 int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask);
 /*
diff --git a/include/linux/poison.h b/include/linux/poison.h
index 4a27153574e2..51334edec506 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -30,7 +30,11 @@
 #define TIMER_ENTRY_STATIC      ((void *) 0x300 + POISON_POINTER_DELTA)
 /********** mm/debug-pagealloc.c **********/
+#ifdef CONFIG_PAGE_POISONING_ZERO
+#define PAGE_POISON 0x00
+#else
 #define PAGE_POISON 0xaa
+#endif
 /********** mm/page_alloc.c ************/
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 3627d5c1bc47..e4b568738ca3 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -20,7 +20,7 @@
 * Flags to pass to kmem_cache_create().
 * The ones marked DEBUG are only valid if CONFIG_DEBUG_SLAB is set.
 */
-#define SLAB_DEBUG_FREE         0x00000100UL    /* DEBUG: Perform (expensive) checks on free */
+#define SLAB_CONSISTENCY_CHECKS 0x00000100UL    /* DEBUG: Perform (expensive) checks on alloc/free */
 #define SLAB_RED_ZONE           0x00000400UL    /* DEBUG: Red zone objs in a cache */
 #define SLAB_POISON             0x00000800UL    /* DEBUG: Poison objects */
 #define SLAB_HWCACHE_ALIGN      0x00002000UL    /* Align objs on cache lines */
@@ -314,7 +314,7 @@ void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment
 void kmem_cache_free(struct kmem_cache *, void *);
 /*
- * Bulk allocation and freeing operations. These are accellerated in an
+ * Bulk allocation and freeing operations. These are accelerated in an
 * allocator specific way to avoid taking locks repeatedly or building
 * metadata structures unnecessarily.
 *
@@ -323,6 +323,15 @@ void kmem_cache_free(struct kmem_cache *, void *);
 void kmem_cache_free_bulk(struct kmem_cache *, size_t, void **);
 int kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
+/*
+ * Caller must not use kfree_bulk() on memory not originally allocated
+ * by kmalloc(), because the SLOB allocator cannot handle this.
+ */
+static __always_inline void kfree_bulk(size_t size, void **p)
+{
+        kmem_cache_free_bulk(NULL, size, p);
+}
 #ifdef CONFIG_NUMA
 void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment;
 void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment;
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
index cf139d3fa513..e878ba35ae91 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -60,6 +60,9 @@ struct kmem_cache {
        atomic_t allocmiss;
        atomic_t freehit;
        atomic_t freemiss;
+#ifdef CONFIG_DEBUG_SLAB_LEAK
+        atomic_t store_user_clean;
+#endif
        /*
         * If debugging is enabled, then the allocator can add additional
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index b7e57927f521..ac5143f95ee6 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -81,6 +81,7 @@ struct kmem_cache {
        int reserved;           /* Reserved bytes at the end of slabs */
        const char *name;       /* Name (only for display!) */
        struct list_head list;  /* List of slab caches */
+        int red_left_pad;       /* Left redzone padding size */
 #ifdef CONFIG_SYSFS
        struct kobject kobj;    /* For sysfs */
 #endif
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 925730bc9fc1..705df7db4482 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -15,16 +15,6 @@ struct tracer;
 struct dentry;
 struct bpf_prog;
-struct trace_print_flags {
-        unsigned long           mask;
-        const char              *name;
-};
-struct trace_print_flags_u64 {
-        unsigned long long      mask;
-        const char              *name;
-};
 const char *trace_print_flags_seq(struct trace_seq *p, const char *delim,
                                  unsigned long flags,
                                  const struct trace_print_flags *flag_array);
diff --git a/include/linux/tracepoint-defs.h b/include/linux/tracepoint-defs.h
index e1ee97c713bf..4ac89acb6136 100644
--- a/include/linux/tracepoint-defs.h
+++ b/include/linux/tracepoint-defs.h
@@ -3,13 +3,23 @@
 /*
 * File can be included directly by headers who only want to access
- * tracepoint->key to guard out of line trace calls. Otherwise
+ * tracepoint->key to guard out of line trace calls, or the definition of
- * linux/tracepoint.h should be used.
+ * trace_print_flags{_u64}. Otherwise linux/tracepoint.h should be used.
 */
 #include <linux/atomic.h>
 #include <linux/static_key.h>
+struct trace_print_flags {
+        unsigned long           mask;
+        const char              *name;
+};
+struct trace_print_flags_u64 {
+        unsigned long long      mask;
+        const char              *name;
+};
 struct tracepoint_func {
        void *func;
        void *data;
diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
index d866f21efbbf..677807f29a1c 100644
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
@@ -6,7 +6,7 @@
 #include <linux/writeback.h>
 #include <linux/tracepoint.h>
-#include <trace/events/gfpflags.h>
+#include <trace/events/mmflags.h>
 struct btrfs_root;
 struct btrfs_fs_info;
diff --git a/include/trace/events/compaction.h b/include/trace/events/compaction.h
index c92d1e1cbad9..111e5666e5eb 100644
--- a/include/trace/events/compaction.h
+++ b/include/trace/events/compaction.h
@@ -7,7 +7,7 @@
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/tracepoint.h>
-#include <trace/events/gfpflags.h>
+#include <trace/events/mmflags.h>
 #define COMPACTION_STATUS                                       \
        EM( COMPACT_DEFERRED,           "deferred")             \
diff --git a/include/trace/events/gfpflags.h b/include/trace/events/gfpflags.h
deleted file mode 100644
index dde6bf092c8a..000000000000
--- a/include/trace/events/gfpflags.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * The order of these masks is important. Matching masks will be seen
- * first and the left over flags will end up showing by themselves.
- *
- * For example, if we have GFP_KERNEL before GFP_USER we wil get:
- *
- *  GFP_KERNEL|GFP_HARDWALL
- *
- * Thus most bits set go first.
- */
-#define show_gfp_flags(flags)                                           \
-        (flags) ? __print_flags(flags, "|",                             \
-        {(unsigned long)GFP_TRANSHUGE,          "GFP_TRANSHUGE"},       \
-        {(unsigned long)GFP_HIGHUSER_MOVABLE,   "GFP_HIGHUSER_MOVABLE"}, \
-        {(unsigned long)GFP_HIGHUSER,           "GFP_HIGHUSER"},        \
-        {(unsigned long)GFP_USER,               "GFP_USER"},            \
-        {(unsigned long)GFP_TEMPORARY,          "GFP_TEMPORARY"},       \
-        {(unsigned long)GFP_KERNEL,             "GFP_KERNEL"},          \
-        {(unsigned long)GFP_NOFS,               "GFP_NOFS"},            \
-        {(unsigned long)GFP_ATOMIC,             "GFP_ATOMIC"},          \
-        {(unsigned long)GFP_NOIO,               "GFP_NOIO"},            \
-        {(unsigned long)__GFP_HIGH,             "GFP_HIGH"},            \
-        {(unsigned long)__GFP_ATOMIC,           "GFP_ATOMIC"},          \
-        {(unsigned long)__GFP_IO,               "GFP_IO"},              \
-        {(unsigned long)__GFP_COLD,             "GFP_COLD"},            \
-        {(unsigned long)__GFP_NOWARN,           "GFP_NOWARN"},          \
-        {(unsigned long)__GFP_REPEAT,           "GFP_REPEAT"},          \
-        {(unsigned long)__GFP_NOFAIL,           "GFP_NOFAIL"},          \
-        {(unsigned long)__GFP_NORETRY,          "GFP_NORETRY"},         \
-        {(unsigned long)__GFP_COMP,             "GFP_COMP"},            \
-        {(unsigned long)__GFP_ZERO,             "GFP_ZERO"},            \
-        {(unsigned long)__GFP_NOMEMALLOC,       "GFP_NOMEMALLOC"},      \
-        {(unsigned long)__GFP_MEMALLOC,         "GFP_MEMALLOC"},        \
-        {(unsigned long)__GFP_HARDWALL,         "GFP_HARDWALL"},        \
-        {(unsigned long)__GFP_THISNODE,         "GFP_THISNODE"},        \
-        {(unsigned long)__GFP_RECLAIMABLE,      "GFP_RECLAIMABLE"},     \
-        {(unsigned long)__GFP_MOVABLE,          "GFP_MOVABLE"},         \
-        {(unsigned long)__GFP_NOTRACK,          "GFP_NOTRACK"},         \
-        {(unsigned long)__GFP_DIRECT_RECLAIM,   "GFP_DIRECT_RECLAIM"},  \
-        {(unsigned long)__GFP_KSWAPD_RECLAIM,   "GFP_KSWAPD_RECLAIM"},  \
-        {(unsigned long)__GFP_OTHER_NODE,       "GFP_OTHER_NODE"}       \
-        ) : "GFP_NOWAIT"
diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h
index 47c6212d8f3c..551ba4acde4d 100644
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -6,8 +6,6 @@
 #include  <linux/tracepoint.h>
-#include <trace/events/gfpflags.h>
 #define SCAN_STATUS                                                     \
        EM( SCAN_FAIL,                  "failed")                       \
        EM( SCAN_SUCCEED,               "succeeded")                    \
diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
index f7554fd7fc62..ca7217389067 100644
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -6,7 +6,7 @@
 #include <linux/types.h>
 #include <linux/tracepoint.h>
-#include <trace/events/gfpflags.h>
+#include <trace/events/mmflags.h>
 DECLARE_EVENT_CLASS(kmem_alloc,
diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h
new file mode 100644
index 000000000000..a849185c82f0
--- /dev/null
+++ b/include/trace/events/mmflags.h
@@ -0,0 +1,164 @@
+/*
+ * The order of these masks is important. Matching masks will be seen
+ * first and the left over flags will end up showing by themselves.
+ *
+ * For example, if we have GFP_KERNEL before GFP_USER we wil get:
+ *
+ *  GFP_KERNEL|GFP_HARDWALL
+ *
+ * Thus most bits set go first.
+ */
+#define __def_gfpflag_names                                             \
+        {(unsigned long)GFP_TRANSHUGE,          "GFP_TRANSHUGE"},       \
+        {(unsigned long)GFP_HIGHUSER_MOVABLE,   "GFP_HIGHUSER_MOVABLE"},\
+        {(unsigned long)GFP_HIGHUSER,           "GFP_HIGHUSER"},        \
+        {(unsigned long)GFP_USER,               "GFP_USER"},            \
+        {(unsigned long)GFP_TEMPORARY,          "GFP_TEMPORARY"},       \
+        {(unsigned long)GFP_KERNEL_ACCOUNT,     "GFP_KERNEL_ACCOUNT"},  \
+        {(unsigned long)GFP_KERNEL,             "GFP_KERNEL"},          \
+        {(unsigned long)GFP_NOFS,               "GFP_NOFS"},            \
+        {(unsigned long)GFP_ATOMIC,             "GFP_ATOMIC"},          \
+        {(unsigned long)GFP_NOIO,               "GFP_NOIO"},            \
+        {(unsigned long)GFP_NOWAIT,             "GFP_NOWAIT"},          \
+        {(unsigned long)GFP_DMA,                "GFP_DMA"},             \
+        {(unsigned long)__GFP_HIGHMEM,          "__GFP_HIGHMEM"},       \
+        {(unsigned long)GFP_DMA32,              "GFP_DMA32"},           \
+        {(unsigned long)__GFP_HIGH,             "__GFP_HIGH"},          \
+        {(unsigned long)__GFP_ATOMIC,           "__GFP_ATOMIC"},        \
+        {(unsigned long)__GFP_IO,               "__GFP_IO"},            \
+        {(unsigned long)__GFP_FS,               "__GFP_FS"},            \
+        {(unsigned long)__GFP_COLD,             "__GFP_COLD"},          \
+        {(unsigned long)__GFP_NOWARN,           "__GFP_NOWARN"},        \
+        {(unsigned long)__GFP_REPEAT,           "__GFP_REPEAT"},        \
+        {(unsigned long)__GFP_NOFAIL,           "__GFP_NOFAIL"},        \
+        {(unsigned long)__GFP_NORETRY,          "__GFP_NORETRY"},       \
+        {(unsigned long)__GFP_COMP,             "__GFP_COMP"},          \
+        {(unsigned long)__GFP_ZERO,             "__GFP_ZERO"},          \
+        {(unsigned long)__GFP_NOMEMALLOC,       "__GFP_NOMEMALLOC"},    \
+        {(unsigned long)__GFP_MEMALLOC,         "__GFP_MEMALLOC"},      \
+        {(unsigned long)__GFP_HARDWALL,         "__GFP_HARDWALL"},      \
+        {(unsigned long)__GFP_THISNODE,         "__GFP_THISNODE"},      \
+        {(unsigned long)__GFP_RECLAIMABLE,      "__GFP_RECLAIMABLE"},   \
+        {(unsigned long)__GFP_MOVABLE,          "__GFP_MOVABLE"},       \
+        {(unsigned long)__GFP_ACCOUNT,          "__GFP_ACCOUNT"},       \
+        {(unsigned long)__GFP_NOTRACK,          "__GFP_NOTRACK"},       \
+        {(unsigned long)__GFP_WRITE,            "__GFP_WRITE"},         \
+        {(unsigned long)__GFP_RECLAIM,          "__GFP_RECLAIM"},       \
+        {(unsigned long)__GFP_DIRECT_RECLAIM,   "__GFP_DIRECT_RECLAIM"},\
+        {(unsigned long)__GFP_KSWAPD_RECLAIM,   "__GFP_KSWAPD_RECLAIM"},\
+        {(unsigned long)__GFP_OTHER_NODE,       "__GFP_OTHER_NODE"}     \
+#define show_gfp_flags(flags)                                           \
+        (flags) ? __print_flags(flags, "|",                             \
+        __def_gfpflag_names                                             \
+        ) : "none"
+#ifdef CONFIG_MMU
+#define IF_HAVE_PG_MLOCK(flag,string) ,{1UL << flag, string}
+#else
+#define IF_HAVE_PG_MLOCK(flag,string)
+#endif
+#ifdef CONFIG_ARCH_USES_PG_UNCACHED
+#define IF_HAVE_PG_UNCACHED(flag,string) ,{1UL << flag, string}
+#else
+#define IF_HAVE_PG_UNCACHED(flag,string)
+#endif
+#ifdef CONFIG_MEMORY_FAILURE
+#define IF_HAVE_PG_HWPOISON(flag,string) ,{1UL << flag, string}
+#else
+#define IF_HAVE_PG_HWPOISON(flag,string)
+#endif
+#if defined(CONFIG_IDLE_PAGE_TRACKING) && defined(CONFIG_64BIT)
+#define IF_HAVE_PG_IDLE(flag,string) ,{1UL << flag, string}
+#else
+#define IF_HAVE_PG_IDLE(flag,string)
+#endif
+#define __def_pageflag_names                                            \
+        {1UL << PG_locked,              "locked"        },              \
+        {1UL << PG_error,               "error"         },              \
+        {1UL << PG_referenced,          "referenced"    },              \
+        {1UL << PG_uptodate,            "uptodate"      },              \
+        {1UL << PG_dirty,               "dirty"         },              \
+        {1UL << PG_lru,                 "lru"           },              \
+        {1UL << PG_active,              "active"        },              \
+        {1UL << PG_slab,                "slab"          },              \
+        {1UL << PG_owner_priv_1,        "owner_priv_1"  },              \
+        {1UL << PG_arch_1,              "arch_1"        },              \
+        {1UL << PG_reserved,            "reserved"      },              \
+        {1UL << PG_private,             "private"       },              \
+        {1UL << PG_private_2,           "private_2"     },              \
+        {1UL << PG_writeback,           "writeback"     },              \
+        {1UL << PG_head,                "head"          },              \
+        {1UL << PG_swapcache,           "swapcache"     },              \
+        {1UL << PG_mappedtodisk,        "mappedtodisk"  },              \
+        {1UL << PG_reclaim,             "reclaim"       },              \
+        {1UL << PG_swapbacked,          "swapbacked"    },              \
+        {1UL << PG_unevictable,         "unevictable"   }               \
+IF_HAVE_PG_MLOCK(PG_mlocked,            "mlocked"       )               \
+IF_HAVE_PG_UNCACHED(PG_uncached,        "uncached"      )               \
+IF_HAVE_PG_HWPOISON(PG_hwpoison,        "hwpoison"      )               \
+IF_HAVE_PG_IDLE(PG_young,               "young"         )               \
+IF_HAVE_PG_IDLE(PG_idle,                "idle"          )
+#define show_page_flags(flags)                                          \
+        (flags) ? __print_flags(flags, "|",                             \
+        __def_pageflag_names                                            \
+        ) : "none"
+#if defined(CONFIG_X86)
+#define __VM_ARCH_SPECIFIC {VM_PAT,     "pat"           }
+#elif defined(CONFIG_PPC)
+#define __VM_ARCH_SPECIFIC {VM_SAO,     "sao"           }
+#elif defined(CONFIG_PARISC) || defined(CONFIG_METAG) || defined(CONFIG_IA64)
+#define __VM_ARCH_SPECIFIC {VM_GROWSUP, "growsup"       }
+#elif !defined(CONFIG_MMU)
+#define __VM_ARCH_SPECIFIC {VM_MAPPED_COPY,"mappedcopy" }
+#else
+#define __VM_ARCH_SPECIFIC {VM_ARCH_1,  "arch_1"        }
+#endif
+#ifdef CONFIG_MEM_SOFT_DIRTY
+#define IF_HAVE_VM_SOFTDIRTY(flag,name) {flag, name },
+#else
+#define IF_HAVE_VM_SOFTDIRTY(flag,name)
+#endif
+#define __def_vmaflag_names                                             \
+        {VM_READ,                       "read"          },              \
+        {VM_WRITE,                      "write"         },              \
+        {VM_EXEC,                       "exec"          },              \
+        {VM_SHARED,                     "shared"        },              \
+        {VM_MAYREAD,                    "mayread"       },              \
+        {VM_MAYWRITE,                   "maywrite"      },              \
+        {VM_MAYEXEC,                    "mayexec"       },              \
+        {VM_MAYSHARE,                   "mayshare"      },              \
+        {VM_GROWSDOWN,                  "growsdown"     },              \
+        {VM_PFNMAP,                     "pfnmap"        },              \
+        {VM_DENYWRITE,                  "denywrite"     },              \
+        {VM_LOCKONFAULT,                "lockonfault"   },              \
+        {VM_LOCKED,                     "locked"        },              \
+        {VM_IO,                         "io"            },              \
+        {VM_SEQ_READ,                   "seqread"       },              \
+        {VM_RAND_READ,                  "randread"      },              \
+        {VM_DONTCOPY,                   "dontcopy"      },              \
+        {VM_DONTEXPAND,                 "dontexpand"    },              \
+        {VM_ACCOUNT,                    "account"       },              \
+        {VM_NORESERVE,                  "noreserve"     },              \
+        {VM_HUGETLB,                    "hugetlb"       },              \
+        __VM_ARCH_SPECIFIC                              ,               \
+        {VM_DONTDUMP,                   "dontdump"      },              \
+IF_HAVE_VM_SOFTDIRTY(VM_SOFTDIRTY,      "softdirty"     )               \
+        {VM_MIXEDMAP,                   "mixedmap"      },              \
+        {VM_HUGEPAGE,                   "hugepage"      },              \
+        {VM_NOHUGEPAGE,                 "nohugepage"    },              \
+        {VM_MERGEABLE,                  "mergeable"     }               \
+#define show_vma_flags(flags)                                           \
+        (flags) ? __print_flags(flags, "|",                             \
+        __def_vmaflag_names                                             \
+        ) : "none"
diff --git a/include/trace/events/vmscan.h b/include/trace/events/vmscan.h
index 31763dd8db1c..0101ef37f1ee 100644
--- a/include/trace/events/vmscan.h
+++ b/include/trace/events/vmscan.h
@@ -8,7 +8,7 @@
 #include <linux/tracepoint.h>
 #include <linux/mm.h>
 #include <linux/memcontrol.h>
-#include <trace/events/gfpflags.h>
+#include <trace/events/mmflags.h>
 #define RECLAIM_WB_ANON         0x0001u
 #define RECLAIM_WB_FILE         0x0002u
diff --git a/include/uapi/linux/auto_fs.h b/include/uapi/linux/auto_fs.h
index bb991dfe134f..9175a1b4dc69 100644
--- a/include/uapi/linux/auto_fs.h
+++ b/include/uapi/linux/auto_fs.h
@@ -1,7 +1,4 @@
-/* -*- linux-c -*- ------------------------------------------------------- *
+/*
- *   
- * linux/include/linux/auto_fs.h
- *
 *   Copyright 1997 Transmeta Corporation - All Rights Reserved
 *
 * This file is part of the Linux kernel and is made available under
@@ -51,7 +48,7 @@ struct autofs_packet_hdr {
 struct autofs_packet_missing {
        struct autofs_packet_hdr hdr;
-        autofs_wqt_t wait_queue_token;
+        autofs_wqt_t wait_queue_token;
        int len;
        char name[NAME_MAX+1];
 };      
@@ -63,12 +60,12 @@ struct autofs_packet_expire {
        char name[NAME_MAX+1];
 };
-#define AUTOFS_IOC_READY      _IO(0x93,0x60)
+#define AUTOFS_IOC_READY      _IO(0x93, 0x60)
-#define AUTOFS_IOC_FAIL       _IO(0x93,0x61)
+#define AUTOFS_IOC_FAIL       _IO(0x93, 0x61)
-#define AUTOFS_IOC_CATATONIC  _IO(0x93,0x62)
+#define AUTOFS_IOC_CATATONIC  _IO(0x93, 0x62)
-#define AUTOFS_IOC_PROTOVER   _IOR(0x93,0x63,int)
+#define AUTOFS_IOC_PROTOVER   _IOR(0x93, 0x63, int)
-#define AUTOFS_IOC_SETTIMEOUT32 _IOWR(0x93,0x64,compat_ulong_t)
+#define AUTOFS_IOC_SETTIMEOUT32 _IOWR(0x93, 0x64, compat_ulong_t)
-#define AUTOFS_IOC_SETTIMEOUT _IOWR(0x93,0x64,unsigned long)
+#define AUTOFS_IOC_SETTIMEOUT _IOWR(0x93, 0x64, unsigned long)
-#define AUTOFS_IOC_EXPIRE     _IOR(0x93,0x65,struct autofs_packet_expire)
+#define AUTOFS_IOC_EXPIRE     _IOR(0x93, 0x65, struct autofs_packet_expire)
 #endif /* _UAPI_LINUX_AUTO_FS_H */
diff --git a/include/uapi/linux/auto_fs4.h b/include/uapi/linux/auto_fs4.h
index e02982fa2953..8f8f1bdcca8c 100644
--- a/include/uapi/linux/auto_fs4.h
+++ b/include/uapi/linux/auto_fs4.h
@@ -1,6 +1,4 @@
-/* -*- c -*-
+/*
- * linux/include/linux/auto_fs4.h
- *
 * Copyright 1999-2000 Jeremy Fitzhardinge <jeremy@goop.org>
 *
 * This file is part of the Linux kernel and is made available under
@@ -38,7 +36,6 @@
 static inline void set_autofs_type_indirect(unsigned int *type)
 {
        *type = AUTOFS_TYPE_INDIRECT;
-        return;
 }
 static inline unsigned int autofs_type_indirect(unsigned int type)
@@ -49,7 +46,6 @@ static inline unsigned int autofs_type_indirect(unsigned int type)
 static inline void set_autofs_type_direct(unsigned int *type)
 {
        *type = AUTOFS_TYPE_DIRECT;
-        return;
 }
 static inline unsigned int autofs_type_direct(unsigned int type)
@@ -60,7 +56,6 @@ static inline unsigned int autofs_type_direct(unsigned int type)
 static inline void set_autofs_type_offset(unsigned int *type)
 {
        *type = AUTOFS_TYPE_OFFSET;
-        return;
 }
 static inline unsigned int autofs_type_offset(unsigned int type)
@@ -81,7 +76,6 @@ static inline unsigned int autofs_type_trigger(unsigned int type)
 static inline void set_autofs_type_any(unsigned int *type)
 {
        *type = AUTOFS_TYPE_ANY;
-        return;
 }
 static inline unsigned int autofs_type_any(unsigned int type)
@@ -114,7 +108,7 @@ enum autofs_notify {
 /* v4 multi expire (via pipe) */
 struct autofs_packet_expire_multi {
        struct autofs_packet_hdr hdr;
-        autofs_wqt_t wait_queue_token;
+        autofs_wqt_t wait_queue_token;
        int len;
        char name[NAME_MAX+1];
 };
@@ -154,11 +148,10 @@ union autofs_v5_packet_union {
        autofs_packet_expire_direct_t expire_direct;
 };
-#define AUTOFS_IOC_EXPIRE_MULTI         _IOW(0x93,0x66,int)
+#define AUTOFS_IOC_EXPIRE_MULTI         _IOW(0x93, 0x66, int)
 #define AUTOFS_IOC_EXPIRE_INDIRECT      AUTOFS_IOC_EXPIRE_MULTI
 #define AUTOFS_IOC_EXPIRE_DIRECT        AUTOFS_IOC_EXPIRE_MULTI
-#define AUTOFS_IOC_PROTOSUBVER          _IOR(0x93,0x67,int)
+#define AUTOFS_IOC_PROTOSUBVER          _IOR(0x93, 0x67, int)
-#define AUTOFS_IOC_ASKUMOUNT            _IOR(0x93,0x70,int)
+#define AUTOFS_IOC_ASKUMOUNT            _IOR(0x93, 0x70, int)
 #endif /* _LINUX_AUTO_FS4_H */
diff --git a/init/Kconfig b/init/Kconfig
index 22320804fbaf..fd664b3ab99e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1420,6 +1420,28 @@ config KALLSYMS_ALL
           Say N unless you really need all symbols.
+config KALLSYMS_ABSOLUTE_PERCPU
+        bool
+        default X86_64 && SMP
+config KALLSYMS_BASE_RELATIVE
+        bool
+        depends on KALLSYMS
+        default !IA64 && !(TILE && 64BIT)
+        help
+          Instead of emitting them as absolute values in the native word size,
+          emit the symbol references in the kallsyms table as 32-bit entries,
+          each containing a relative value in the range [base, base + U32_MAX]
+          or, when KALLSYMS_ABSOLUTE_PERCPU is in effect, each containing either
+          an absolute value in the range [0, S32_MAX] or a relative value in the
+          range [base, base + S32_MAX], where base is the lowest relative symbol
+          address encountered in the image.
+          On 64-bit builds, this reduces the size of the address table by 50%,
+          but more importantly, it results in entries whose values are build
+          time constants, and no relocation pass is required at runtime to fix
+          up the entries based on the runtime load address of the kernel.
 config PRINTK
        default y
        bool "Enable support for printk" if EXPERT
diff --git a/init/main.c b/init/main.c
index 8dc93df20f7f..b3c6e363ae18 100644
--- a/init/main.c
+++ b/init/main.c
@@ -705,7 +705,6 @@ static int __init initcall_blacklist(char *str)
 static bool __init_or_module initcall_blacklisted(initcall_t fn)
 {
-        struct list_head *tmp;
        struct blacklist_entry *entry;
        char *fn_name;
@@ -713,8 +712,7 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
        if (!fn_name)
                return false;
-        list_for_each(tmp, &blacklisted_initcalls) {
+        list_for_each_entry(entry, &blacklisted_initcalls, next) {
-                entry = list_entry(tmp, struct blacklist_entry, next);
                if (!strcmp(fn_name, entry->buf)) {
                        pr_debug("initcall %s blacklisted\n", fn_name);
                        kfree(fn_name);
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 5c5987f10819..fafd1a3ef0da 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -38,6 +38,7 @@
 * during the second link stage.
 */
 extern const unsigned long kallsyms_addresses[] __weak;
+extern const int kallsyms_offsets[] __weak;
 extern const u8 kallsyms_names[] __weak;
 /*
@@ -47,6 +48,9 @@ extern const u8 kallsyms_names[] __weak;
 extern const unsigned long kallsyms_num_syms
 __attribute__((weak, section(".rodata")));
+extern const unsigned long kallsyms_relative_base
+__attribute__((weak, section(".rodata")));
 extern const u8 kallsyms_token_table[] __weak;
 extern const u16 kallsyms_token_index[] __weak;
@@ -176,6 +180,23 @@ static unsigned int get_symbol_offset(unsigned long pos)
        return name - kallsyms_names;
 }
+static unsigned long kallsyms_sym_address(int idx)
+{
+        if (!IS_ENABLED(CONFIG_KALLSYMS_BASE_RELATIVE))
+                return kallsyms_addresses[idx];
+        /* values are unsigned offsets if --absolute-percpu is not in effect */
+        if (!IS_ENABLED(CONFIG_KALLSYMS_ABSOLUTE_PERCPU))
+                return kallsyms_relative_base + (u32)kallsyms_offsets[idx];
+        /* ...otherwise, positive offsets are absolute values */
+        if (kallsyms_offsets[idx] >= 0)
+                return kallsyms_offsets[idx];
+        /* ...and negative offsets are relative to kallsyms_relative_base - 1 */
+        return kallsyms_relative_base - 1 - kallsyms_offsets[idx];
+}
 /* Lookup the address for this symbol. Returns 0 if not found. */
 unsigned long kallsyms_lookup_name(const char *name)
 {
@@ -187,7 +208,7 @@ unsigned long kallsyms_lookup_name(const char *name)
                off = kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
                if (strcmp(namebuf, name) == 0)
-                        return kallsyms_addresses[i];
+                        return kallsyms_sym_address(i);
        }
        return module_kallsyms_lookup_name(name);
 }
@@ -204,7 +225,7 @@ int kallsyms_on_each_symbol(int (*fn)(void *, const char *, struct module *,
        for (i = 0, off = 0; i < kallsyms_num_syms; i++) {
                off = kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
-                ret = fn(data, namebuf, NULL, kallsyms_addresses[i]);
+                ret = fn(data, namebuf, NULL, kallsyms_sym_address(i));
                if (ret != 0)
                        return ret;
        }
@@ -220,7 +241,10 @@ static unsigned long get_symbol_pos(unsigned long addr,
        unsigned long i, low, high, mid;
        /* This kernel should never had been booted. */
-        BUG_ON(!kallsyms_addresses);
+        if (!IS_ENABLED(CONFIG_KALLSYMS_BASE_RELATIVE))
+                BUG_ON(!kallsyms_addresses);
+        else
+                BUG_ON(!kallsyms_offsets);
        /* Do a binary search on the sorted kallsyms_addresses array. */
        low = 0;
@@ -228,7 +252,7 @@ static unsigned long get_symbol_pos(unsigned long addr,
        while (high - low > 1) {
                mid = low + (high - low) / 2;
-                if (kallsyms_addresses[mid] <= addr)
+                if (kallsyms_sym_address(mid) <= addr)
                        low = mid;
                else
                        high = mid;
@@ -238,15 +262,15 @@ static unsigned long get_symbol_pos(unsigned long addr,
         * Search for the first aliased symbol. Aliased
         * symbols are symbols with the same address.
         */
-        while (low && kallsyms_addresses[low-1] == kallsyms_addresses[low])
+        while (low && kallsyms_sym_address(low-1) == kallsyms_sym_address(low))
                --low;
-        symbol_start = kallsyms_addresses[low];
+        symbol_start = kallsyms_sym_address(low);
        /* Search for next non-aliased symbol. */
        for (i = low + 1; i < kallsyms_num_syms; i++) {
-                if (kallsyms_addresses[i] > symbol_start) {
+                if (kallsyms_sym_address(i) > symbol_start) {
-                        symbol_end = kallsyms_addresses[i];
+                        symbol_end = kallsyms_sym_address(i);
                        break;
                }
        }
@@ -470,7 +494,7 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
        unsigned off = iter->nameoff;
        iter->module_name[0] = '\0';
-        iter->value = kallsyms_addresses[iter->pos];
+        iter->value = kallsyms_sym_address(iter->pos);
        iter->type = kallsyms_get_symbol_type(off);
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index f894a2cd9b2a..53ab2f85d77e 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -148,8 +148,7 @@ static inline struct lock_class *hlock_class(struct held_lock *hlock)
 }
 #ifdef CONFIG_LOCK_STAT
-static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS],
+static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], cpu_lock_stats);
-                      cpu_lock_stats);
 static inline u64 lockstat_clock(void)
 {
diff --git a/kernel/memremap.c b/kernel/memremap.c
index fb9b88787ebc..584febd13e2e 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -391,7 +391,7 @@ struct vmem_altmap *to_vmem_altmap(unsigned long memmap_start)
        /*
         * 'memmap_start' is the virtual address for the first "struct
         * page" in this range of the vmemmap array.  In the case of
-         * CONFIG_SPARSE_VMEMMAP a page_to_pfn conversion is simple
+         * CONFIG_SPARSEMEM_VMEMMAP a page_to_pfn conversion is simple
         * pointer arithmetic, so we can perform this to_vmem_altmap()
         * conversion without concern for the initialization state of
         * the struct page fields.
@@ -400,7 +400,7 @@ struct vmem_altmap *to_vmem_altmap(unsigned long memmap_start)
        struct dev_pagemap *pgmap;
        /*
-         * Uncoditionally retrieve a dev_pagemap associated with the
+         * Unconditionally retrieve a dev_pagemap associated with the
         * given physical address, this is only for use in the
         * arch_{add|remove}_memory() for setting up and tearing down
         * the memmap.
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index b7342a24f559..aa0f26b58426 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -1158,6 +1158,22 @@ static int __init kaslr_nohibernate_setup(char *str)
        return nohibernate_setup(str);
 }
+static int __init page_poison_nohibernate_setup(char *str)
+{
+#ifdef CONFIG_PAGE_POISONING_ZERO
+        /*
+         * The zeroing option for page poison skips the checks on alloc.
+         * since hibernation doesn't save free pages there's no way to
+         * guarantee the pages will still be zeroed.
+         */
+        if (!strcmp(str, "on")) {
+                pr_info("Disabling hibernation due to page poisoning\n");
+                return nohibernate_setup(str);
+        }
+#endif
+        return 1;
+}
 __setup("noresume", noresume_setup);
 __setup("resume_offset=", resume_offset_setup);
 __setup("resume=", resume_setup);
@@ -1166,3 +1182,4 @@ __setup("resumewait", resumewait_setup);
 __setup("resumedelay=", resumedelay_setup);
 __setup("nohibernate", nohibernate_setup);
 __setup("kaslr", kaslr_nohibernate_setup);
+__setup("page_poison=", page_poison_nohibernate_setup);
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 65ae0e5c35da..250ea67c1615 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -130,10 +130,8 @@ static struct rcu_torture __rcu *rcu_torture_current;
 static unsigned long rcu_torture_current_version;
 static struct rcu_torture rcu_tortures[10 * RCU_TORTURE_PIPE_LEN];
 static DEFINE_SPINLOCK(rcu_torture_lock);
-static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1],
+static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) = { 0 };
-                      rcu_torture_count) = { 0 };
+static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) = { 0 };
-static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1],
-                      rcu_torture_batch) = { 0 };
 static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
 static atomic_t n_rcu_torture_alloc;
 static atomic_t n_rcu_torture_alloc_fail;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 7ff5dc7d2ac5..16e13d8628a3 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -320,8 +320,7 @@ static bool wq_debug_force_rr_cpu = false;
 module_param_named(debug_force_rr_cpu, wq_debug_force_rr_cpu, bool, 0644);
 /* the per-cpu worker pools */
-static DEFINE_PER_CPU_SHARED_ALIGNED(struct worker_pool [NR_STD_WORKER_POOLS],
+static DEFINE_PER_CPU_SHARED_ALIGNED(struct worker_pool [NR_STD_WORKER_POOLS], cpu_worker_pools);
-                                     cpu_worker_pools);
 static DEFINE_IDR(worker_pool_idr);     /* PR: idr of all pools */
diff --git a/lib/test_printf.c b/lib/test_printf.c
index 4f6ae60433bc..563f10e6876a 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -17,6 +17,9 @@
 #include <linux/socket.h>
 #include <linux/in.h>
+#include <linux/gfp.h>
+#include <linux/mm.h>
 #define BUF_SIZE 256
 #define PAD_SIZE 16
 #define FILL_CHAR '$'
@@ -411,6 +414,55 @@ netdev_features(void)
 }
 static void __init
+flags(void)
+{
+        unsigned long flags;
+        gfp_t gfp;
+        char *cmp_buffer;
+        flags = 0;
+        test("", "%pGp", &flags);
+        /* Page flags should filter the zone id */
+        flags = 1UL << NR_PAGEFLAGS;
+        test("", "%pGp", &flags);
+        flags |= 1UL << PG_uptodate | 1UL << PG_dirty | 1UL << PG_lru
+                | 1UL << PG_active | 1UL << PG_swapbacked;
+        test("uptodate|dirty|lru|active|swapbacked", "%pGp", &flags);
+        flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC
+                        | VM_DENYWRITE;
+        test("read|exec|mayread|maywrite|mayexec|denywrite", "%pGv", &flags);
+        gfp = GFP_TRANSHUGE;
+        test("GFP_TRANSHUGE", "%pGg", &gfp);
+        gfp = GFP_ATOMIC|__GFP_DMA;
+        test("GFP_ATOMIC|GFP_DMA", "%pGg", &gfp);
+        gfp = __GFP_ATOMIC;
+        test("__GFP_ATOMIC", "%pGg", &gfp);
+        cmp_buffer = kmalloc(BUF_SIZE, GFP_KERNEL);
+        if (!cmp_buffer)
+                return;
+        /* Any flags not translated by the table should remain numeric */
+        gfp = ~__GFP_BITS_MASK;
+        snprintf(cmp_buffer, BUF_SIZE, "%#lx", (unsigned long) gfp);
+        test(cmp_buffer, "%pGg", &gfp);
+        snprintf(cmp_buffer, BUF_SIZE, "__GFP_ATOMIC|%#lx",
+                                                        (unsigned long) gfp);
+        gfp |= __GFP_ATOMIC;
+        test(cmp_buffer, "%pGg", &gfp);
+        kfree(cmp_buffer);
+}
+static void __init
 test_pointer(void)
 {
        plain();
@@ -428,6 +480,7 @@ test_pointer(void)
        struct_clk();
        bitmap();
        netdev_features();
+        flags();
 }
 static int __init
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index f44e178e6ede..525c8e19bda2 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -35,6 +35,8 @@
 #include <linux/blkdev.h>
 #endif
+#include "../mm/internal.h"     /* For the trace_print_flags arrays */
 #include <asm/page.h>           /* for PAGE_SIZE */
 #include <asm/sections.h>       /* for dereference_function_descriptor() */
 #include <asm/byteorder.h>      /* cpu_to_le16 */
@@ -1407,6 +1409,72 @@ char *clock(char *buf, char *end, struct clk *clk, struct printf_spec spec,
        }
 }
+static
+char *format_flags(char *buf, char *end, unsigned long flags,
+                                        const struct trace_print_flags *names)
+{
+        unsigned long mask;
+        const struct printf_spec strspec = {
+                .field_width = -1,
+                .precision = -1,
+        };
+        const struct printf_spec numspec = {
+                .flags = SPECIAL|SMALL,
+                .field_width = -1,
+                .precision = -1,
+                .base = 16,
+        };
+        for ( ; flags && names->name; names++) {
+                mask = names->mask;
+                if ((flags & mask) != mask)
+                        continue;
+                buf = string(buf, end, names->name, strspec);
+                flags &= ~mask;
+                if (flags) {
+                        if (buf < end)
+                                *buf = '|';
+                        buf++;
+                }
+        }
+        if (flags)
+                buf = number(buf, end, flags, numspec);
+        return buf;
+}
+static noinline_for_stack
+char *flags_string(char *buf, char *end, void *flags_ptr, const char *fmt)
+{
+        unsigned long flags;
+        const struct trace_print_flags *names;
+        switch (fmt[1]) {
+        case 'p':
+                flags = *(unsigned long *)flags_ptr;
+                /* Remove zone id */
+                flags &= (1UL << NR_PAGEFLAGS) - 1;
+                names = pageflag_names;
+                break;
+        case 'v':
+                flags = *(unsigned long *)flags_ptr;
+                names = vmaflag_names;
+                break;
+        case 'g':
+                flags = *(gfp_t *)flags_ptr;
+                names = gfpflag_names;
+                break;
+        default:
+                WARN_ONCE(1, "Unsupported flags modifier: %c\n", fmt[1]);
+                return buf;
+        }
+        return format_flags(buf, end, flags, names);
+}
 int kptr_restrict __read_mostly;
 /*
@@ -1495,6 +1563,11 @@ int kptr_restrict __read_mostly;
 * - 'Cn' For a clock, it prints the name (Common Clock Framework) or address
 *        (legacy clock framework) of the clock
 * - 'Cr' For a clock, it prints the current rate of the clock
+ * - 'G' For flags to be printed as a collection of symbolic strings that would
+ *       construct the specific value. Supported flags given by option:
+ *       p page flags (see struct page) given as pointer to unsigned long
+ *       g gfp flags (GFP_* and __GFP_*) given as pointer to gfp_t
+ *       v vma flags (VM_*) given as pointer to unsigned long
 *
 * ** Please update also Documentation/printk-formats.txt when making changes **
 *
@@ -1648,6 +1721,8 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                return bdev_name(buf, end, ptr, spec, fmt);
 #endif
+        case 'G':
+                return flags_string(buf, end, ptr, fmt);
        }
        spec.flags |= SMALL;
        if (spec.field_width == -1) {
diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
index 957d3da53ddd..5c50b238b770 100644
--- a/mm/Kconfig.debug
+++ b/mm/Kconfig.debug
@@ -16,8 +16,8 @@ config DEBUG_PAGEALLOC
        select PAGE_POISONING if !ARCH_SUPPORTS_DEBUG_PAGEALLOC
        ---help---
          Unmap pages from the kernel linear mapping after free_pages().
-          This results in a large slowdown, but helps to find certain types
+          Depending on runtime enablement, this results in a small or large
-          of memory corruption.
+          slowdown, but helps to find certain types of memory corruption.
          For architectures which don't enable ARCH_SUPPORTS_DEBUG_PAGEALLOC,
          fill the pages with poison patterns after free_pages() and verify
@@ -26,5 +26,56 @@ config DEBUG_PAGEALLOC
          that would result in incorrect warnings of memory corruption after
          a resume because free pages are not saved to the suspend image.
+          By default this option will have a small overhead, e.g. by not
+          allowing the kernel mapping to be backed by large pages on some
+          architectures. Even bigger overhead comes when the debugging is
+          enabled by DEBUG_PAGEALLOC_ENABLE_DEFAULT or the debug_pagealloc
+          command line parameter.
+config DEBUG_PAGEALLOC_ENABLE_DEFAULT
+        bool "Enable debug page memory allocations by default?"
+        default n
+        depends on DEBUG_PAGEALLOC
+        ---help---
+          Enable debug page memory allocations by default? This value
+          can be overridden by debug_pagealloc=off|on.
 config PAGE_POISONING
-        bool
+        bool "Poison pages after freeing"
+        select PAGE_EXTENSION
+        select PAGE_POISONING_NO_SANITY if HIBERNATION
+        ---help---
+          Fill the pages with poison patterns after free_pages() and verify
+          the patterns before alloc_pages. The filling of the memory helps
+          reduce the risk of information leaks from freed data. This does
+          have a potential performance impact.
+          Note that "poison" here is not the same thing as the "HWPoison"
+          for CONFIG_MEMORY_FAILURE. This is software poisoning only.
+          If unsure, say N
+config PAGE_POISONING_NO_SANITY
+        depends on PAGE_POISONING
+        bool "Only poison, don't sanity check"
+        ---help---
+           Skip the sanity checking on alloc, only fill the pages with
+           poison on free. This reduces some of the overhead of the
+           poisoning feature.
+           If you are only interested in sanitization, say Y. Otherwise
+           say N.
+config PAGE_POISONING_ZERO
+        bool "Use zero for poisoning instead of random data"
+        depends on PAGE_POISONING
+        ---help---
+           Instead of using the existing poison value, fill the pages with
+           zeros. This makes it harder to detect when errors are occurring
+           due to sanitization but the zeroing at free means that it is
+           no longer necessary to write zeros when GFP_ZERO is used on
+           allocation.
+           Enabling page poisoning with this option will disable hibernation
+           If unsure, say N
diff --git a/mm/Makefile b/mm/Makefile
index 2ed43191fc3b..cfdd481d27a5 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -48,7 +48,7 @@ obj-$(CONFIG_SPARSEMEM_VMEMMAP) += sparse-vmemmap.o
 obj-$(CONFIG_SLOB) += slob.o
 obj-$(CONFIG_MMU_NOTIFIER) += mmu_notifier.o
 obj-$(CONFIG_KSM) += ksm.o
-obj-$(CONFIG_PAGE_POISONING) += debug-pagealloc.o
+obj-$(CONFIG_PAGE_POISONING) += page_poison.o
 obj-$(CONFIG_SLAB) += slab.o
 obj-$(CONFIG_SLUB) += slub.o
 obj-$(CONFIG_KMEMCHECK) += kmemcheck.o
diff --git a/mm/compaction.c b/mm/compaction.c
index 585de54dbe8c..93f71d968098 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -71,49 +71,6 @@ static inline bool migrate_async_suitable(int migratetype)
        return is_migrate_cma(migratetype) || migratetype == MIGRATE_MOVABLE;
 }
-/*
- * Check that the whole (or subset of) a pageblock given by the interval of
- * [start_pfn, end_pfn) is valid and within the same zone, before scanning it
- * with the migration of free compaction scanner. The scanners then need to
- * use only pfn_valid_within() check for arches that allow holes within
- * pageblocks.
- *
- * Return struct page pointer of start_pfn, or NULL if checks were not passed.
- *
- * It's possible on some configurations to have a setup like node0 node1 node0
- * i.e. it's possible that all pages within a zones range of pages do not
- * belong to a single zone. We assume that a border between node0 and node1
- * can occur within a single pageblock, but not a node0 node1 node0
- * interleaving within a single pageblock. It is therefore sufficient to check
- * the first and last page of a pageblock and avoid checking each individual
- * page in a pageblock.
- */
-static struct page *pageblock_pfn_to_page(unsigned long start_pfn,
-                                unsigned long end_pfn, struct zone *zone)
-{
-        struct page *start_page;
-        struct page *end_page;
-        /* end_pfn is one past the range we are checking */
-        end_pfn--;
-        if (!pfn_valid(start_pfn) || !pfn_valid(end_pfn))
-                return NULL;
-        start_page = pfn_to_page(start_pfn);
-        if (page_zone(start_page) != zone)
-                return NULL;
-        end_page = pfn_to_page(end_pfn);
-        /* This gives a shorter code than deriving page_zone(end_page) */
-        if (page_zone_id(start_page) != page_zone_id(end_page))
-                return NULL;
-        return start_page;
-}
 #ifdef CONFIG_COMPACTION
 /* Do not skip compaction more than 64 times */
@@ -200,7 +157,8 @@ static void reset_cached_positions(struct zone *zone)
 {
        zone->compact_cached_migrate_pfn[0] = zone->zone_start_pfn;
        zone->compact_cached_migrate_pfn[1] = zone->zone_start_pfn;
-        zone->compact_cached_free_pfn = zone_end_pfn(zone);
+        zone->compact_cached_free_pfn =
+                        round_down(zone_end_pfn(zone) - 1, pageblock_nr_pages);
 }
 /*
@@ -554,13 +512,17 @@ unsigned long
 isolate_freepages_range(struct compact_control *cc,
                        unsigned long start_pfn, unsigned long end_pfn)
 {
-        unsigned long isolated, pfn, block_end_pfn;
+        unsigned long isolated, pfn, block_start_pfn, block_end_pfn;
        LIST_HEAD(freelist);
        pfn = start_pfn;
+        block_start_pfn = pfn & ~(pageblock_nr_pages - 1);
+        if (block_start_pfn < cc->zone->zone_start_pfn)
+                block_start_pfn = cc->zone->zone_start_pfn;
        block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
        for (; pfn < end_pfn; pfn += isolated,
+                                block_start_pfn = block_end_pfn,
                                block_end_pfn += pageblock_nr_pages) {
                /* Protect pfn from changing by isolate_freepages_block */
                unsigned long isolate_start_pfn = pfn;
@@ -573,11 +535,13 @@ isolate_freepages_range(struct compact_control *cc,
                 * scanning range to right one.
                 */
                if (pfn >= block_end_pfn) {
+                        block_start_pfn = pfn & ~(pageblock_nr_pages - 1);
                        block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
                        block_end_pfn = min(block_end_pfn, end_pfn);
                }
-                if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone))
+                if (!pageblock_pfn_to_page(block_start_pfn,
+                                        block_end_pfn, cc->zone))
                        break;
                isolated = isolate_freepages_block(cc, &isolate_start_pfn,
@@ -863,18 +827,23 @@ unsigned long
 isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,
                                                        unsigned long end_pfn)
 {
-        unsigned long pfn, block_end_pfn;
+        unsigned long pfn, block_start_pfn, block_end_pfn;
        /* Scan block by block. First and last block may be incomplete */
        pfn = start_pfn;
+        block_start_pfn = pfn & ~(pageblock_nr_pages - 1);
+        if (block_start_pfn < cc->zone->zone_start_pfn)
+                block_start_pfn = cc->zone->zone_start_pfn;
        block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
        for (; pfn < end_pfn; pfn = block_end_pfn,
+                                block_start_pfn = block_end_pfn,
                                block_end_pfn += pageblock_nr_pages) {
                block_end_pfn = min(block_end_pfn, end_pfn);
-                if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone))
+                if (!pageblock_pfn_to_page(block_start_pfn,
+                                        block_end_pfn, cc->zone))
                        continue;
                pfn = isolate_migratepages_block(cc, pfn, block_end_pfn,
@@ -1103,7 +1072,9 @@ int sysctl_compact_unevictable_allowed __read_mostly = 1;
 static isolate_migrate_t isolate_migratepages(struct zone *zone,
                                        struct compact_control *cc)
 {
-        unsigned long low_pfn, end_pfn;
+        unsigned long block_start_pfn;
+        unsigned long block_end_pfn;
+        unsigned long low_pfn;
        unsigned long isolate_start_pfn;
        struct page *page;
        const isolate_mode_t isolate_mode =
@@ -1115,16 +1086,21 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
         * initialized by compact_zone()
         */
        low_pfn = cc->migrate_pfn;
+        block_start_pfn = cc->migrate_pfn & ~(pageblock_nr_pages - 1);
+        if (block_start_pfn < zone->zone_start_pfn)
+                block_start_pfn = zone->zone_start_pfn;
        /* Only scan within a pageblock boundary */
-        end_pfn = ALIGN(low_pfn + 1, pageblock_nr_pages);
+        block_end_pfn = ALIGN(low_pfn + 1, pageblock_nr_pages);
        /*
         * Iterate over whole pageblocks until we find the first suitable.
         * Do not cross the free scanner.
         */
-        for (; end_pfn <= cc->free_pfn;
+        for (; block_end_pfn <= cc->free_pfn;
-                        low_pfn = end_pfn, end_pfn += pageblock_nr_pages) {
+                        low_pfn = block_end_pfn,
+                        block_start_pfn = block_end_pfn,
+                        block_end_pfn += pageblock_nr_pages) {
                /*
                 * This can potentially iterate a massively long zone with
@@ -1135,7 +1111,8 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
                                                && compact_should_abort(cc))
                        break;
-                page = pageblock_pfn_to_page(low_pfn, end_pfn, zone);
+                page = pageblock_pfn_to_page(block_start_pfn, block_end_pfn,
+                                                                        zone);
                if (!page)
                        continue;
@@ -1154,8 +1131,8 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
                /* Perform the isolation */
                isolate_start_pfn = low_pfn;
-                low_pfn = isolate_migratepages_block(cc, low_pfn, end_pfn,
+                low_pfn = isolate_migratepages_block(cc, low_pfn,
-                                                                isolate_mode);
+                                                block_end_pfn, isolate_mode);
                if (!low_pfn || cc->contended) {
                        acct_isolated(zone, cc);
@@ -1371,11 +1348,11 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
         */
        cc->migrate_pfn = zone->compact_cached_migrate_pfn[sync];
        cc->free_pfn = zone->compact_cached_free_pfn;
-        if (cc->free_pfn < start_pfn || cc->free_pfn > end_pfn) {
+        if (cc->free_pfn < start_pfn || cc->free_pfn >= end_pfn) {
-                cc->free_pfn = end_pfn & ~(pageblock_nr_pages-1);
+                cc->free_pfn = round_down(end_pfn - 1, pageblock_nr_pages);
                zone->compact_cached_free_pfn = cc->free_pfn;
        }
-        if (cc->migrate_pfn < start_pfn || cc->migrate_pfn > end_pfn) {
+        if (cc->migrate_pfn < start_pfn || cc->migrate_pfn >= end_pfn) {
                cc->migrate_pfn = start_pfn;
                zone->compact_cached_migrate_pfn[0] = cc->migrate_pfn;
                zone->compact_cached_migrate_pfn[1] = cc->migrate_pfn;
diff --git a/mm/debug.c b/mm/debug.c
index f05b2d5d6481..df7247b0b532 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -9,75 +9,38 @@
 #include <linux/mm.h>
 #include <linux/trace_events.h>
 #include <linux/memcontrol.h>
+#include <trace/events/mmflags.h>
-static const struct trace_print_flags pageflag_names[] = {
+#include <linux/migrate.h>
-        {1UL << PG_locked,              "locked"        },
+#include <linux/page_owner.h>
-        {1UL << PG_error,               "error"         },
-        {1UL << PG_referenced,          "referenced"    },
+#include "internal.h"
-        {1UL << PG_uptodate,            "uptodate"      },
-        {1UL << PG_dirty,               "dirty"         },
+char *migrate_reason_names[MR_TYPES] = {
-        {1UL << PG_lru,                 "lru"           },
+        "compaction",
-        {1UL << PG_active,              "active"        },
+        "memory_failure",
-        {1UL << PG_slab,                "slab"          },
+        "memory_hotplug",
-        {1UL << PG_owner_priv_1,        "owner_priv_1"  },
+        "syscall_or_cpuset",
-        {1UL << PG_arch_1,              "arch_1"        },
+        "mempolicy_mbind",
-        {1UL << PG_reserved,            "reserved"      },
+        "numa_misplaced",
-        {1UL << PG_private,             "private"       },
+        "cma",
-        {1UL << PG_private_2,           "private_2"     },
-        {1UL << PG_writeback,           "writeback"     },
-        {1UL << PG_head,                "head"          },
-        {1UL << PG_swapcache,           "swapcache"     },
-        {1UL << PG_mappedtodisk,        "mappedtodisk"  },
-        {1UL << PG_reclaim,             "reclaim"       },
-        {1UL << PG_swapbacked,          "swapbacked"    },
-        {1UL << PG_unevictable,         "unevictable"   },
-#ifdef CONFIG_MMU
-        {1UL << PG_mlocked,             "mlocked"       },
-#endif
-#ifdef CONFIG_ARCH_USES_PG_UNCACHED
-        {1UL << PG_uncached,            "uncached"      },
-#endif
-#ifdef CONFIG_MEMORY_FAILURE
-        {1UL << PG_hwpoison,            "hwpoison"      },
-#endif
-#if defined(CONFIG_IDLE_PAGE_TRACKING) && defined(CONFIG_64BIT)
-        {1UL << PG_young,               "young"         },
-        {1UL << PG_idle,                "idle"          },
-#endif
 };
-static void dump_flags(unsigned long flags,
+const struct trace_print_flags pageflag_names[] = {
-                        const struct trace_print_flags *names, int count)
+        __def_pageflag_names,
-{
+        {0, NULL}
-        const char *delim = "";
+};
-        unsigned long mask;
-        int i;
-        pr_emerg("flags: %#lx(", flags);
-        /* remove zone id */
-        flags &= (1UL << NR_PAGEFLAGS) - 1;
-        for (i = 0; i < count && flags; i++) {
-                mask = names[i].mask;
-                if ((flags & mask) != mask)
-                        continue;
-                flags &= ~mask;
-                pr_cont("%s%s", delim, names[i].name);
-                delim = "|";
-        }
-        /* check for left over flags */
+const struct trace_print_flags gfpflag_names[] = {
-        if (flags)
+        __def_gfpflag_names,
-                pr_cont("%s%#lx", delim, flags);
+        {0, NULL}
+};
-        pr_cont(")\n");
+const struct trace_print_flags vmaflag_names[] = {
-}
+        __def_vmaflag_names,
+        {0, NULL}
+};
-void dump_page_badflags(struct page *page, const char *reason,
+void __dump_page(struct page *page, const char *reason)
-                unsigned long badflags)
 {
        pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx",
                  page, atomic_read(&page->_count), page_mapcount(page),
@@ -85,15 +48,13 @@ void dump_page_badflags(struct page *page, const char *reason,
        if (PageCompound(page))
                pr_cont(" compound_mapcount: %d", compound_mapcount(page));
        pr_cont("\n");
-        BUILD_BUG_ON(ARRAY_SIZE(pageflag_names) != __NR_PAGEFLAGS);
+        BUILD_BUG_ON(ARRAY_SIZE(pageflag_names) != __NR_PAGEFLAGS + 1);
-        dump_flags(page->flags, pageflag_names, ARRAY_SIZE(pageflag_names));
+        pr_emerg("flags: %#lx(%pGp)\n", page->flags, &page->flags);
        if (reason)
                pr_alert("page dumped because: %s\n", reason);
-        if (page->flags & badflags) {
-                pr_alert("bad because of flags:\n");
-                dump_flags(page->flags & badflags,
-                                pageflag_names, ARRAY_SIZE(pageflag_names));
-        }
 #ifdef CONFIG_MEMCG
        if (page->mem_cgroup)
                pr_alert("page->mem_cgroup:%p\n", page->mem_cgroup);
@@ -102,67 +63,26 @@ void dump_page_badflags(struct page *page, const char *reason,
 void dump_page(struct page *page, const char *reason)
 {
-        dump_page_badflags(page, reason, 0);
+        __dump_page(page, reason);
+        dump_page_owner(page);
 }
 EXPORT_SYMBOL(dump_page);
 #ifdef CONFIG_DEBUG_VM
-static const struct trace_print_flags vmaflags_names[] = {
-        {VM_READ,                       "read"          },
-        {VM_WRITE,                      "write"         },
-        {VM_EXEC,                       "exec"          },
-        {VM_SHARED,                     "shared"        },
-        {VM_MAYREAD,                    "mayread"       },
-        {VM_MAYWRITE,                   "maywrite"      },
-        {VM_MAYEXEC,                    "mayexec"       },
-        {VM_MAYSHARE,                   "mayshare"      },
-        {VM_GROWSDOWN,                  "growsdown"     },
-        {VM_PFNMAP,                     "pfnmap"        },
-        {VM_DENYWRITE,                  "denywrite"     },
-        {VM_LOCKONFAULT,                "lockonfault"   },
-        {VM_LOCKED,                     "locked"        },
-        {VM_IO,                         "io"            },
-        {VM_SEQ_READ,                   "seqread"       },
-        {VM_RAND_READ,                  "randread"      },
-        {VM_DONTCOPY,                   "dontcopy"      },
-        {VM_DONTEXPAND,                 "dontexpand"    },
-        {VM_ACCOUNT,                    "account"       },
-        {VM_NORESERVE,                  "noreserve"     },
-        {VM_HUGETLB,                    "hugetlb"       },
-#if defined(CONFIG_X86)
-        {VM_PAT,                        "pat"           },
-#elif defined(CONFIG_PPC)
-        {VM_SAO,                        "sao"           },
-#elif defined(CONFIG_PARISC) || defined(CONFIG_METAG) || defined(CONFIG_IA64)
-        {VM_GROWSUP,                    "growsup"       },
-#elif !defined(CONFIG_MMU)
-        {VM_MAPPED_COPY,                "mappedcopy"    },
-#else
-        {VM_ARCH_1,                     "arch_1"        },
-#endif
-        {VM_DONTDUMP,                   "dontdump"      },
-#ifdef CONFIG_MEM_SOFT_DIRTY
-        {VM_SOFTDIRTY,                  "softdirty"     },
-#endif
-        {VM_MIXEDMAP,                   "mixedmap"      },
-        {VM_HUGEPAGE,                   "hugepage"      },
-        {VM_NOHUGEPAGE,                 "nohugepage"    },
-        {VM_MERGEABLE,                  "mergeable"     },
-};
 void dump_vma(const struct vm_area_struct *vma)
 {
        pr_emerg("vma %p start %p end %p\n"
                "next %p prev %p mm %p\n"
                "prot %lx anon_vma %p vm_ops %p\n"
-                "pgoff %lx file %p private_data %p\n",
+                "pgoff %lx file %p private_data %p\n"
+                "flags: %#lx(%pGv)\n",
                vma, (void *)vma->vm_start, (void *)vma->vm_end, vma->vm_next,
                vma->vm_prev, vma->vm_mm,
                (unsigned long)pgprot_val(vma->vm_page_prot),
                vma->anon_vma, vma->vm_ops, vma->vm_pgoff,
-                vma->vm_file, vma->vm_private_data);
+                vma->vm_file, vma->vm_private_data,
-        dump_flags(vma->vm_flags, vmaflags_names, ARRAY_SIZE(vmaflags_names));
+                vma->vm_flags, &vma->vm_flags);
 }
 EXPORT_SYMBOL(dump_vma);
@@ -196,7 +116,7 @@ void dump_mm(const struct mm_struct *mm)
 #if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
                "tlb_flush_pending %d\n"
 #endif
-                "%s",   /* This is here to hold the comma */
+                "def_flags: %#lx(%pGv)\n",
                mm, mm->mmap, mm->vmacache_seqnum, mm->task_size,
 #ifdef CONFIG_MMU
@@ -230,11 +150,8 @@ void dump_mm(const struct mm_struct *mm)
 #if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
                mm->tlb_flush_pending,
 #endif
-                ""              /* This is here to not have a comma! */
+                mm->def_flags, &mm->def_flags
-                );
+        );
-                dump_flags(mm->def_flags, vmaflags_names,
-                                ARRAY_SIZE(vmaflags_names));
 }
 #endif          /* CONFIG_DEBUG_VM */
diff --git a/mm/failslab.c b/mm/failslab.c
index 79171b4a5826..b0fac98cd938 100644
--- a/mm/failslab.c
+++ b/mm/failslab.c
@@ -1,5 +1,7 @@
 #include <linux/fault-inject.h>
 #include <linux/slab.h>
+#include <linux/mm.h>
+#include "slab.h"
 static struct {
        struct fault_attr attr;
@@ -11,18 +13,22 @@ static struct {
        .cache_filter = false,
 };
-bool should_failslab(size_t size, gfp_t gfpflags, unsigned long cache_flags)
+bool should_failslab(struct kmem_cache *s, gfp_t gfpflags)
 {
+        /* No fault-injection for bootstrap cache */
+        if (unlikely(s == kmem_cache))
+                return false;
        if (gfpflags & __GFP_NOFAIL)
                return false;
        if (failslab.ignore_gfp_reclaim && (gfpflags & __GFP_RECLAIM))
                return false;
-        if (failslab.cache_filter && !(cache_flags & SLAB_FAILSLAB))
+        if (failslab.cache_filter && !(s->flags & SLAB_FAILSLAB))
                return false;
-        return should_fail(&failslab.attr, size);
+        return should_fail(&failslab.attr, s->object_size);
 }
 static int __init setup_failslab(char *str)
diff --git a/mm/filemap.c b/mm/filemap.c
index da7a35d83de7..61b441b191ad 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -101,7 +101,7 @@
 *    ->tree_lock               (page_remove_rmap->set_page_dirty)
 *    bdi.wb->list_lock         (page_remove_rmap->set_page_dirty)
 *    ->inode->i_lock           (page_remove_rmap->set_page_dirty)
- *    ->memcg->move_lock        (page_remove_rmap->mem_cgroup_begin_page_stat)
+ *    ->memcg->move_lock        (page_remove_rmap->lock_page_memcg)
 *    bdi.wb->list_lock         (zap_pte_range->set_page_dirty)
 *    ->inode->i_lock           (zap_pte_range->set_page_dirty)
 *    ->private_lock            (zap_pte_range->__set_page_dirty_buffers)
@@ -176,11 +176,9 @@ static void page_cache_tree_delete(struct address_space *mapping,
 /*
 * Delete a page from the page cache and free it. Caller has to make
 * sure the page is locked and that nobody else uses it - or that usage
- * is safe.  The caller must hold the mapping's tree_lock and
+ * is safe.  The caller must hold the mapping's tree_lock.
- * mem_cgroup_begin_page_stat().
 */
-void __delete_from_page_cache(struct page *page, void *shadow,
+void __delete_from_page_cache(struct page *page, void *shadow)
-                              struct mem_cgroup *memcg)
 {
        struct address_space *mapping = page->mapping;
@@ -239,8 +237,7 @@ void __delete_from_page_cache(struct page *page, void *shadow,
         * anyway will be cleared before returning page into buddy allocator.
         */
        if (WARN_ON_ONCE(PageDirty(page)))
-                account_page_cleaned(page, mapping, memcg,
+                account_page_cleaned(page, mapping, inode_to_wb(mapping->host));
-                                     inode_to_wb(mapping->host));
 }
 /**
@@ -254,7 +251,6 @@ void __delete_from_page_cache(struct page *page, void *shadow,
 void delete_from_page_cache(struct page *page)
 {
        struct address_space *mapping = page->mapping;
-        struct mem_cgroup *memcg;
        unsigned long flags;
        void (*freepage)(struct page *);
@@ -263,11 +259,9 @@ void delete_from_page_cache(struct page *page)
        freepage = mapping->a_ops->freepage;
-        memcg = mem_cgroup_begin_page_stat(page);
        spin_lock_irqsave(&mapping->tree_lock, flags);
-        __delete_from_page_cache(page, NULL, memcg);
+        __delete_from_page_cache(page, NULL);
        spin_unlock_irqrestore(&mapping->tree_lock, flags);
-        mem_cgroup_end_page_stat(memcg);
        if (freepage)
                freepage(page);
@@ -551,7 +545,6 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
        if (!error) {
                struct address_space *mapping = old->mapping;
                void (*freepage)(struct page *);
-                struct mem_cgroup *memcg;
                unsigned long flags;
                pgoff_t offset = old->index;
@@ -561,9 +554,8 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
                new->mapping = mapping;
                new->index = offset;
-                memcg = mem_cgroup_begin_page_stat(old);
                spin_lock_irqsave(&mapping->tree_lock, flags);
-                __delete_from_page_cache(old, NULL, memcg);
+                __delete_from_page_cache(old, NULL);
                error = radix_tree_insert(&mapping->page_tree, offset, new);
                BUG_ON(error);
                mapping->nrpages++;
@@ -576,8 +568,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
                if (PageSwapBacked(new))
                        __inc_zone_page_state(new, NR_SHMEM);
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
-                mem_cgroup_end_page_stat(memcg);
+                mem_cgroup_migrate(old, new);
-                mem_cgroup_replace_page(old, new);
                radix_tree_preload_end();
                if (freepage)
                        freepage(old);
@@ -1668,6 +1659,15 @@ find_page:
                                        index, last_index - index);
                }
                if (!PageUptodate(page)) {
+                        /*
+                         * See comment in do_read_cache_page on why
+                         * wait_on_page_locked is used to avoid unnecessarily
+                         * serialisations and why it's safe.
+                         */
+                        wait_on_page_locked_killable(page);
+                        if (PageUptodate(page))
+                                goto page_ok;
                        if (inode->i_blkbits == PAGE_CACHE_SHIFT ||
                                        !mapping->a_ops->is_partially_uptodate)
                                goto page_not_up_to_date;
@@ -2303,7 +2303,7 @@ static struct page *wait_on_page_read(struct page *page)
        return page;
 }
-static struct page *__read_cache_page(struct address_space *mapping,
+static struct page *do_read_cache_page(struct address_space *mapping,
                                pgoff_t index,
                                int (*filler)(void *, struct page *),
                                void *data,
@@ -2325,53 +2325,74 @@ repeat:
                        /* Presumably ENOMEM for radix tree node */
                        return ERR_PTR(err);
                }
+filler:
                err = filler(data, page);
                if (err < 0) {
                        page_cache_release(page);
-                        page = ERR_PTR(err);
+                        return ERR_PTR(err);
-                } else {
-                        page = wait_on_page_read(page);
                }
-        }
-        return page;
-}
-static struct page *do_read_cache_page(struct address_space *mapping,
-                                pgoff_t index,
-                                int (*filler)(void *, struct page *),
-                                void *data,
-                                gfp_t gfp)
-{
+                page = wait_on_page_read(page);
-        struct page *page;
+                if (IS_ERR(page))
-        int err;
+                        return page;
+                goto out;
+        }
+        if (PageUptodate(page))
+                goto out;
-retry:
+        /*
-        page = __read_cache_page(mapping, index, filler, data, gfp);
+         * Page is not up to date and may be locked due one of the following
-        if (IS_ERR(page))
+         * case a: Page is being filled and the page lock is held
-                return page;
+         * case b: Read/write error clearing the page uptodate status
+         * case c: Truncation in progress (page locked)
+         * case d: Reclaim in progress
+         *
+         * Case a, the page will be up to date when the page is unlocked.
+         *    There is no need to serialise on the page lock here as the page
+         *    is pinned so the lock gives no additional protection. Even if the
+         *    the page is truncated, the data is still valid if PageUptodate as
+         *    it's a race vs truncate race.
+         * Case b, the page will not be up to date
+         * Case c, the page may be truncated but in itself, the data may still
+         *    be valid after IO completes as it's a read vs truncate race. The
+         *    operation must restart if the page is not uptodate on unlock but
+         *    otherwise serialising on page lock to stabilise the mapping gives
+         *    no additional guarantees to the caller as the page lock is
+         *    released before return.
+         * Case d, similar to truncation. If reclaim holds the page lock, it
+         *    will be a race with remove_mapping that determines if the mapping
+         *    is valid on unlock but otherwise the data is valid and there is
+         *    no need to serialise with page lock.
+         *
+         * As the page lock gives no additional guarantee, we optimistically
+         * wait on the page to be unlocked and check if it's up to date and
+         * use the page if it is. Otherwise, the page lock is required to
+         * distinguish between the different cases. The motivation is that we
+         * avoid spurious serialisations and wakeups when multiple processes
+         * wait on the same page for IO to complete.
+         */
+        wait_on_page_locked(page);
        if (PageUptodate(page))
                goto out;
+        /* Distinguish between all the cases under the safety of the lock */
        lock_page(page);
+        /* Case c or d, restart the operation */
        if (!page->mapping) {
                unlock_page(page);
                page_cache_release(page);
-                goto retry;
+                goto repeat;
        }
+        /* Someone else locked and filled the page in a very small window */
        if (PageUptodate(page)) {
                unlock_page(page);
                goto out;
        }
-        err = filler(data, page);
+        goto filler;
-        if (err < 0) {
-                page_cache_release(page);
-                return ERR_PTR(err);
-        } else {
-                page = wait_on_page_read(page);
-                if (IS_ERR(page))
-                        return page;
-        }
 out:
        mark_page_accessed(page);
        return page;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index e10a4fee88d2..1ea21e203a70 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3220,28 +3220,26 @@ static void unfreeze_page(struct anon_vma *anon_vma, struct page *page)
        }
 }
-static int __split_huge_page_tail(struct page *head, int tail,
+static void __split_huge_page_tail(struct page *head, int tail,
                struct lruvec *lruvec, struct list_head *list)
 {
-        int mapcount;
        struct page *page_tail = head + tail;
-        mapcount = atomic_read(&page_tail->_mapcount) + 1;
+        VM_BUG_ON_PAGE(atomic_read(&page_tail->_mapcount) != -1, page_tail);
        VM_BUG_ON_PAGE(atomic_read(&page_tail->_count) != 0, page_tail);
        /*
         * tail_page->_count is zero and not changing from under us. But
         * get_page_unless_zero() may be running from under us on the
-         * tail_page. If we used atomic_set() below instead of atomic_add(), we
+         * tail_page. If we used atomic_set() below instead of atomic_inc(), we
         * would then run atomic_set() concurrently with
         * get_page_unless_zero(), and atomic_set() is implemented in C not
         * using locked ops. spin_unlock on x86 sometime uses locked ops
         * because of PPro errata 66, 92, so unless somebody can guarantee
         * atomic_set() here would be safe on all archs (and not only on x86),
-         * it's safer to use atomic_add().
+         * it's safer to use atomic_inc().
         */
-        atomic_add(mapcount + 1, &page_tail->_count);
+        atomic_inc(&page_tail->_count);
        page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
        page_tail->flags |= (head->flags &
@@ -3275,8 +3273,6 @@ static int __split_huge_page_tail(struct page *head, int tail,
        page_tail->index = head->index + tail;
        page_cpupid_xchg_last(page_tail, page_cpupid_last(head));
        lru_add_page_tail(head, page_tail, lruvec, list);
-        return mapcount;
 }
 static void __split_huge_page(struct page *page, struct list_head *list)
@@ -3284,7 +3280,7 @@ static void __split_huge_page(struct page *page, struct list_head *list)
        struct page *head = compound_head(page);
        struct zone *zone = page_zone(head);
        struct lruvec *lruvec;
-        int i, tail_mapcount;
+        int i;
        /* prevent PageLRU to go away from under us, and freeze lru stats */
        spin_lock_irq(&zone->lru_lock);
@@ -3293,10 +3289,8 @@ static void __split_huge_page(struct page *page, struct list_head *list)
        /* complete memcg works before add pages to LRU */
        mem_cgroup_split_huge_fixup(head);
-        tail_mapcount = 0;
        for (i = HPAGE_PMD_NR - 1; i >= 1; i--)
-                tail_mapcount += __split_huge_page_tail(head, i, lruvec, list);
+                __split_huge_page_tail(head, i, lruvec, list);
-        atomic_sub(tail_mapcount, &head->_count);
        ClearPageCompound(head);
        spin_unlock_irq(&zone->lru_lock);
diff --git a/mm/internal.h b/mm/internal.h
index a38a21ebddb4..ad9400d759c8 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -14,6 +14,7 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
+#include <linux/tracepoint-defs.h>
 /*
 * The set of flags that only affect watermark checking and reclaim
@@ -131,6 +132,18 @@ __find_buddy_index(unsigned long page_idx, unsigned int order)
        return page_idx ^ (1 << order);
 }
+extern struct page *__pageblock_pfn_to_page(unsigned long start_pfn,
+                                unsigned long end_pfn, struct zone *zone);
+static inline struct page *pageblock_pfn_to_page(unsigned long start_pfn,
+                                unsigned long end_pfn, struct zone *zone)
+{
+        if (zone->contiguous)
+                return pfn_to_page(start_pfn);
+        return __pageblock_pfn_to_page(start_pfn, end_pfn, zone);
+}
 extern int __isolate_free_page(struct page *page, unsigned int order);
 extern void __free_pages_bootmem(struct page *page, unsigned long pfn,
                                        unsigned int order);
@@ -466,4 +479,9 @@ static inline void try_to_unmap_flush_dirty(void)
 }
 #endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
+extern const struct trace_print_flags pageflag_names[];
+extern const struct trace_print_flags vmaflag_names[];
+extern const struct trace_print_flags gfpflag_names[];
 #endif  /* __MM_INTERNAL_H */
diff --git a/mm/kmemcheck.c b/mm/kmemcheck.c
index cab58bb592d8..6f4f424037c0 100644
--- a/mm/kmemcheck.c
+++ b/mm/kmemcheck.c
@@ -60,6 +60,9 @@ void kmemcheck_free_shadow(struct page *page, int order)
 void kmemcheck_slab_alloc(struct kmem_cache *s, gfp_t gfpflags, void *object,
                          size_t size)
 {
+        if (unlikely(!object)) /* Skip object if allocation failed */
+                return;
        /*
         * Has already been memset(), which initializes the shadow for us
         * as well.
diff --git a/mm/madvise.c b/mm/madvise.c
index f56825b6d2e1..a01147359f3b 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -555,8 +555,9 @@ static int madvise_hwpoison(int bhv, unsigned long start, unsigned long end)
                }
                pr_info("Injecting memory failure for page %#lx at %#lx\n",
                       page_to_pfn(p), start);
-                /* Ignore return value for now */
+                ret = memory_failure(page_to_pfn(p), 0, MF_COUNT_INCREASED);
-                memory_failure(page_to_pfn(p), 0, MF_COUNT_INCREASED);
+                if (ret)
+                        return ret;
        }
        return 0;
 }
@@ -638,14 +639,28 @@ madvise_behavior_valid(int behavior)
 *              some pages ahead.
 *  MADV_DONTNEED - the application is finished with the given range,
 *              so the kernel can free resources associated with it.
+ *  MADV_FREE - the application marks pages in the given range as lazy free,
+ *              where actual purges are postponed until memory pressure happens.
 *  MADV_REMOVE - the application wants to free up the given range of
 *              pages and associated backing store.
 *  MADV_DONTFORK - omit this area from child's address space when forking:
 *              typically, to avoid COWing pages pinned by get_user_pages().
 *  MADV_DOFORK - cancel MADV_DONTFORK: no longer omit this area when forking.
+ *  MADV_HWPOISON - trigger memory error handler as if the given memory range
+ *              were corrupted by unrecoverable hardware memory failure.
+ *  MADV_SOFT_OFFLINE - try to soft-offline the given range of memory.
 *  MADV_MERGEABLE - the application recommends that KSM try to merge pages in
 *              this area with pages of identical content from other such areas.
 *  MADV_UNMERGEABLE- cancel MADV_MERGEABLE: no longer merge pages with others.
+ *  MADV_HUGEPAGE - the application wants to back the given range by transparent
+ *              huge pages in the future. Existing pages might be coalesced and
+ *              new pages might be allocated as THP.
+ *  MADV_NOHUGEPAGE - mark the given range as not worth being backed by
+ *              transparent huge pages so the existing pages will not be
+ *              coalesced into THP and new pages will not be allocated as THP.
+ *  MADV_DONTDUMP - the application wants to prevent pages in the given range
+ *              from being included in its core dump.
+ *  MADV_DODUMP - cancel MADV_DONTDUMP: no longer exclude from core dump.
 *
 * return values:
 *  zero    - success
diff --git a/mm/memblock.c b/mm/memblock.c
index dd7989929f13..fc7824fa1b42 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -612,14 +612,12 @@ static int __init_memblock memblock_add_region(phys_addr_t base,
                                                int nid,
                                                unsigned long flags)
 {
-        struct memblock_type *type = &memblock.memory;
        memblock_dbg("memblock_add: [%#016llx-%#016llx] flags %#02lx %pF\n",
                     (unsigned long long)base,
                     (unsigned long long)base + size - 1,
                     flags, (void *)_RET_IP_);
-        return memblock_add_range(type, base, size, nid, flags);
+        return memblock_add_range(&memblock.memory, base, size, nid, flags);
 }
 int __init_memblock memblock_add(phys_addr_t base, phys_addr_t size)
@@ -740,14 +738,12 @@ static int __init_memblock memblock_reserve_region(phys_addr_t base,
                                                   int nid,
                                                   unsigned long flags)
 {
-        struct memblock_type *type = &memblock.reserved;
        memblock_dbg("memblock_reserve: [%#016llx-%#016llx] flags %#02lx %pF\n",
                     (unsigned long long)base,
                     (unsigned long long)base + size - 1,
                     flags, (void *)_RET_IP_);
-        return memblock_add_range(type, base, size, nid, flags);
+        return memblock_add_range(&memblock.reserved, base, size, nid, flags);
 }
 int __init_memblock memblock_reserve(phys_addr_t base, phys_addr_t size)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d06cae2de783..42882c1e7fce 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -268,31 +268,6 @@ static inline bool mem_cgroup_is_root(struct mem_cgroup *memcg)
        return (memcg == root_mem_cgroup);
 }
-/*
- * We restrict the id in the range of [1, 65535], so it can fit into
- * an unsigned short.
- */
-#define MEM_CGROUP_ID_MAX       USHRT_MAX
-static inline unsigned short mem_cgroup_id(struct mem_cgroup *memcg)
-{
-        return memcg->css.id;
-}
-/*
- * A helper function to get mem_cgroup from ID. must be called under
- * rcu_read_lock().  The caller is responsible for calling
- * css_tryget_online() if the mem_cgroup is used for charging. (dropping
- * refcnt from swap can be called against removed memcg.)
- */
-static inline struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
-{
-        struct cgroup_subsys_state *css;
-        css = css_from_id(id, &memory_cgrp_subsys);
-        return mem_cgroup_from_css(css);
-}
 #ifndef CONFIG_SLOB
 /*
 * This will be the memcg's index in each cache's ->memcg_params.memcg_caches.
@@ -1709,19 +1684,13 @@ cleanup:
 }
 /**
- * mem_cgroup_begin_page_stat - begin a page state statistics transaction
+ * lock_page_memcg - lock a page->mem_cgroup binding
- * @page: page that is going to change accounted state
+ * @page: the page
- *
- * This function must mark the beginning of an accounted page state
- * change to prevent double accounting when the page is concurrently
- * being moved to another memcg:
 *
- *   memcg = mem_cgroup_begin_page_stat(page);
+ * This function protects unlocked LRU pages from being moved to
- *   if (TestClearPageState(page))
+ * another cgroup and stabilizes their page->mem_cgroup binding.
- *     mem_cgroup_update_page_stat(memcg, state, -1);
- *   mem_cgroup_end_page_stat(memcg);
 */
-struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page)
+void lock_page_memcg(struct page *page)
 {
        struct mem_cgroup *memcg;
        unsigned long flags;
@@ -1730,25 +1699,18 @@ struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page)
         * The RCU lock is held throughout the transaction.  The fast
         * path can get away without acquiring the memcg->move_lock
         * because page moving starts with an RCU grace period.
-         *
-         * The RCU lock also protects the memcg from being freed when
-         * the page state that is going to change is the only thing
-         * preventing the page from being uncharged.
-         * E.g. end-writeback clearing PageWriteback(), which allows
-         * migration to go ahead and uncharge the page before the
-         * account transaction might be complete.
         */
        rcu_read_lock();
        if (mem_cgroup_disabled())
-                return NULL;
+                return;
 again:
        memcg = page->mem_cgroup;
        if (unlikely(!memcg))
-                return NULL;
+                return;
        if (atomic_read(&memcg->moving_account) <= 0)
-                return memcg;
+                return;
        spin_lock_irqsave(&memcg->move_lock, flags);
        if (memcg != page->mem_cgroup) {
@@ -1759,21 +1721,23 @@ again:
        /*
         * When charge migration first begins, we can have locked and
         * unlocked page stat updates happening concurrently.  Track
-         * the task who has the lock for mem_cgroup_end_page_stat().
+         * the task who has the lock for unlock_page_memcg().
         */
        memcg->move_lock_task = current;
        memcg->move_lock_flags = flags;
-        return memcg;
+        return;
 }
-EXPORT_SYMBOL(mem_cgroup_begin_page_stat);
+EXPORT_SYMBOL(lock_page_memcg);
 /**
- * mem_cgroup_end_page_stat - finish a page state statistics transaction
+ * unlock_page_memcg - unlock a page->mem_cgroup binding
- * @memcg: the memcg that was accounted against
+ * @page: the page
 */
-void mem_cgroup_end_page_stat(struct mem_cgroup *memcg)
+void unlock_page_memcg(struct page *page)
 {
+        struct mem_cgroup *memcg = page->mem_cgroup;
        if (memcg && memcg->move_lock_task == current) {
                unsigned long flags = memcg->move_lock_flags;
@@ -1785,7 +1749,7 @@ void mem_cgroup_end_page_stat(struct mem_cgroup *memcg)
        rcu_read_unlock();
 }
-EXPORT_SYMBOL(mem_cgroup_end_page_stat);
+EXPORT_SYMBOL(unlock_page_memcg);
 /*
 * size of first charge trial. "32" comes from vmscan.c's magic value.
@@ -4488,7 +4452,7 @@ static int mem_cgroup_move_account(struct page *page,
        VM_BUG_ON(compound && !PageTransHuge(page));
        /*
-         * Prevent mem_cgroup_replace_page() from looking at
+         * Prevent mem_cgroup_migrate() from looking at
         * page->mem_cgroup of its source page while we change it.
         */
        ret = -EBUSY;
@@ -4923,9 +4887,9 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
        lru_add_drain_all();
        /*
-         * Signal mem_cgroup_begin_page_stat() to take the memcg's
+         * Signal lock_page_memcg() to take the memcg's move_lock
-         * move_lock while we're moving its pages to another memcg.
+         * while we're moving its pages to another memcg. Then wait
-         * Then wait for already started RCU-only updates to finish.
+         * for already started RCU-only updates to finish.
         */
        atomic_inc(&mc.from->moving_account);
        synchronize_rcu();
@@ -5517,16 +5481,16 @@ void mem_cgroup_uncharge_list(struct list_head *page_list)
 }
 /**
- * mem_cgroup_replace_page - migrate a charge to another page
+ * mem_cgroup_migrate - charge a page's replacement
- * @oldpage: currently charged page
+ * @oldpage: currently circulating page
- * @newpage: page to transfer the charge to
+ * @newpage: replacement page
 *
- * Migrate the charge from @oldpage to @newpage.
+ * Charge @newpage as a replacement page for @oldpage. @oldpage will
+ * be uncharged upon free.
 *
 * Both pages must be locked, @newpage->mapping must be set up.
- * Either or both pages might be on the LRU already.
 */
-void mem_cgroup_replace_page(struct page *oldpage, struct page *newpage)
+void mem_cgroup_migrate(struct page *oldpage, struct page *newpage)
 {
        struct mem_cgroup *memcg;
        unsigned int nr_pages;
@@ -5559,7 +5523,7 @@ void mem_cgroup_replace_page(struct page *oldpage, struct page *newpage)
                page_counter_charge(&memcg->memsw, nr_pages);
        css_get_many(&memcg->css, nr_pages);
-        commit_charge(newpage, memcg, true);
+        commit_charge(newpage, memcg, false);
        local_irq_disable();
        mem_cgroup_charge_statistics(memcg, newpage, compound, nr_pages);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index ac595e7a3a95..67c30eb993f0 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -826,8 +826,6 @@ static struct page_state {
 #undef lru
 #undef swapbacked
 #undef head
-#undef tail
-#undef compound
 #undef slab
 #undef reserved
diff --git a/mm/memory.c b/mm/memory.c
index 906d8e3b42c0..0e247642ed5b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1897,7 +1897,9 @@ int apply_to_page_range(struct mm_struct *mm, unsigned long addr,
        unsigned long end = addr + size;
        int err;
-        BUG_ON(addr >= end);
+        if (WARN_ON(addr >= end))
+                return -EINVAL;
        pgd = pgd_offset(mm, addr);
        do {
                next = pgd_addr_end(addr, end);
@@ -3143,8 +3145,7 @@ static int do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                unsigned long address, pte_t *page_table, pmd_t *pmd,
                unsigned int flags, pte_t orig_pte)
 {
-        pgoff_t pgoff = (((address & PAGE_MASK)
+        pgoff_t pgoff = linear_page_index(vma, address);
-                        - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
        pte_unmap(page_table);
        /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 979b18cbd343..24ea06393816 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -77,6 +77,9 @@ static struct {
 #define memhp_lock_acquire()      lock_map_acquire(&mem_hotplug.dep_map)
 #define memhp_lock_release()      lock_map_release(&mem_hotplug.dep_map)
+bool memhp_auto_online;
+EXPORT_SYMBOL_GPL(memhp_auto_online);
 void get_online_mems(void)
 {
        might_sleep();
@@ -509,6 +512,8 @@ int __ref __add_pages(int nid, struct zone *zone, unsigned long phys_start_pfn,
        int start_sec, end_sec;
        struct vmem_altmap *altmap;
+        clear_zone_contiguous(zone);
        /* during initialize mem_map, align hot-added range to section */
        start_sec = pfn_to_section_nr(phys_start_pfn);
        end_sec = pfn_to_section_nr(phys_start_pfn + nr_pages - 1);
@@ -521,7 +526,8 @@ int __ref __add_pages(int nid, struct zone *zone, unsigned long phys_start_pfn,
                if (altmap->base_pfn != phys_start_pfn
                                || vmem_altmap_offset(altmap) > nr_pages) {
                        pr_warn_once("memory add fail, invalid altmap\n");
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto out;
                }
                altmap->alloc = 0;
        }
@@ -539,7 +545,8 @@ int __ref __add_pages(int nid, struct zone *zone, unsigned long phys_start_pfn,
                err = 0;
        }
        vmemmap_populate_print_last();
+out:
+        set_zone_contiguous(zone);
        return err;
 }
 EXPORT_SYMBOL_GPL(__add_pages);
@@ -811,6 +818,8 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn,
                }
        }
+        clear_zone_contiguous(zone);
        /*
         * We can only remove entire sections
         */
@@ -826,6 +835,9 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn,
                if (ret)
                        break;
        }
+        set_zone_contiguous(zone);
        return ret;
 }
 EXPORT_SYMBOL_GPL(__remove_pages);
@@ -1261,8 +1273,13 @@ int zone_for_memory(int nid, u64 start, u64 size, int zone_default,
        return zone_default;
 }
+static int online_memory_block(struct memory_block *mem, void *arg)
+{
+        return memory_block_change_state(mem, MEM_ONLINE, MEM_OFFLINE);
+}
 /* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
-int __ref add_memory_resource(int nid, struct resource *res)
+int __ref add_memory_resource(int nid, struct resource *res, bool online)
 {
        u64 start, size;
        pg_data_t *pgdat = NULL;
@@ -1322,6 +1339,11 @@ int __ref add_memory_resource(int nid, struct resource *res)
        /* create new memmap entry */
        firmware_map_add_hotplug(start, start + size, "System RAM");
+        /* online pages if requested */
+        if (online)
+                walk_memory_range(PFN_DOWN(start), PFN_UP(start + size - 1),
+                                  NULL, online_memory_block);
        goto out;
 error:
@@ -1345,7 +1367,7 @@ int __ref add_memory(int nid, u64 start, u64 size)
        if (IS_ERR(res))
                return PTR_ERR(res);
-        ret = add_memory_resource(nid, res);
+        ret = add_memory_resource(nid, res, memhp_auto_online);
        if (ret < 0)
                release_memory_resource(res);
        return ret;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 9a3f6b90e628..8cbc74387df3 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -643,7 +643,9 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
        if (flags & MPOL_MF_LAZY) {
                /* Similar to task_numa_work, skip inaccessible VMAs */
-                if (vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))
+                if (!is_vm_hugetlb_page(vma) &&
+                        (vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)) &&
+                        !(vma->vm_flags & VM_MIXEDMAP))
                        change_prot_numa(vma, start, endvma);
                return 1;
        }
diff --git a/mm/migrate.c b/mm/migrate.c
index 3ad0fea5c438..568284ec75d4 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -38,6 +38,7 @@
 #include <linux/balloon_compaction.h>
 #include <linux/mmu_notifier.h>
 #include <linux/page_idle.h>
+#include <linux/page_owner.h>
 #include <asm/tlbflush.h>
@@ -325,7 +326,6 @@ int migrate_page_move_mapping(struct address_space *mapping,
                        return -EAGAIN;
                /* No turning back from here */
-                set_page_memcg(newpage, page_memcg(page));
                newpage->index = page->index;
                newpage->mapping = page->mapping;
                if (PageSwapBacked(page))
@@ -372,7 +372,6 @@ int migrate_page_move_mapping(struct address_space *mapping,
         * Now we know that no one else is looking at the page:
         * no turning back from here.
         */
-        set_page_memcg(newpage, page_memcg(page));
        newpage->index = page->index;
        newpage->mapping = page->mapping;
        if (PageSwapBacked(page))
@@ -457,9 +456,9 @@ int migrate_huge_page_move_mapping(struct address_space *mapping,
                return -EAGAIN;
        }
-        set_page_memcg(newpage, page_memcg(page));
        newpage->index = page->index;
        newpage->mapping = page->mapping;
        get_page(newpage);
        radix_tree_replace_slot(pslot, newpage);
@@ -467,6 +466,7 @@ int migrate_huge_page_move_mapping(struct address_space *mapping,
        page_unfreeze_refs(page, expected_count - 1);
        spin_unlock_irq(&mapping->tree_lock);
        return MIGRATEPAGE_SUCCESS;
 }
@@ -578,6 +578,10 @@ void migrate_page_copy(struct page *newpage, struct page *page)
         */
        if (PageWriteback(newpage))
                end_page_writeback(newpage);
+        copy_page_owner(page, newpage);
+        mem_cgroup_migrate(page, newpage);
 }
 /************************************************************
@@ -772,7 +776,6 @@ static int move_to_new_page(struct page *newpage, struct page *page,
         * page is freed; but stats require that PageAnon be left as PageAnon.
         */
        if (rc == MIGRATEPAGE_SUCCESS) {
-                set_page_memcg(page, NULL);
                if (!PageAnon(page))
                        page->mapping = NULL;
        }
@@ -952,8 +955,10 @@ static ICE_noinline int unmap_and_move(new_page_t get_new_page,
        }
        rc = __unmap_and_move(page, newpage, force, mode);
-        if (rc == MIGRATEPAGE_SUCCESS)
+        if (rc == MIGRATEPAGE_SUCCESS) {
                put_new_page = NULL;
+                set_page_owner_migrate_reason(newpage, reason);
+        }
 out:
        if (rc != -EAGAIN) {
@@ -1018,7 +1023,7 @@ out:
 static int unmap_and_move_huge_page(new_page_t get_new_page,
                                free_page_t put_new_page, unsigned long private,
                                struct page *hpage, int force,
-                                enum migrate_mode mode)
+                                enum migrate_mode mode, int reason)
 {
        int rc = -EAGAIN;
        int *result = NULL;
@@ -1076,6 +1081,7 @@ put_anon:
        if (rc == MIGRATEPAGE_SUCCESS) {
                hugetlb_cgroup_migrate(hpage, new_hpage);
                put_new_page = NULL;
+                set_page_owner_migrate_reason(new_hpage, reason);
        }
        unlock_page(hpage);
@@ -1148,7 +1154,7 @@ int migrate_pages(struct list_head *from, new_page_t get_new_page,
                        if (PageHuge(page))
                                rc = unmap_and_move_huge_page(get_new_page,
                                                put_new_page, private, page,
-                                                pass > 2, mode);
+                                                pass > 2, mode, reason);
                        else
                                rc = unmap_and_move(get_new_page, put_new_page,
                                                private, page, pass > 2, mode,
@@ -1836,9 +1842,8 @@ fail_putback:
        }
        mlock_migrate_page(new_page, page);
-        set_page_memcg(new_page, page_memcg(page));
-        set_page_memcg(page, NULL);
        page_remove_rmap(page, true);
+        set_page_owner_migrate_reason(new_page, MR_NUMA_MISPLACED);
        spin_unlock(ptl);
        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index dc490c06941b..e97a05d9621f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -386,10 +386,11 @@ static void dump_tasks(struct mem_cgroup *memcg, const nodemask_t *nodemask)
 static void dump_header(struct oom_control *oc, struct task_struct *p,
                        struct mem_cgroup *memcg)
 {
-        pr_warning("%s invoked oom-killer: gfp_mask=0x%x, order=%d, "
+        pr_warn("%s invoked oom-killer: gfp_mask=%#x(%pGg), order=%d, "
-                "oom_score_adj=%hd\n",
+                        "oom_score_adj=%hd\n",
-                current->comm, oc->gfp_mask, oc->order,
+                current->comm, oc->gfp_mask, &oc->gfp_mask, oc->order,
                current->signal->oom_score_adj);
        cpuset_print_current_mems_allowed();
        dump_stack();
        if (memcg)
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 6fe7d15bd1f7..11ff8f758631 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1169,6 +1169,7 @@ static void wb_update_dirty_ratelimit(struct dirty_throttle_control *dtc,
        unsigned long balanced_dirty_ratelimit;
        unsigned long step;
        unsigned long x;
+        unsigned long shift;
        /*
         * The dirty rate will match the writeout rate in long term, except
@@ -1293,11 +1294,11 @@ static void wb_update_dirty_ratelimit(struct dirty_throttle_control *dtc,
         * rate itself is constantly fluctuating. So decrease the track speed
         * when it gets close to the target. Helps eliminate pointless tremors.
         */
-        step >>= dirty_ratelimit / (2 * step + 1);
+        shift = dirty_ratelimit / (2 * step + 1);
-        /*
+        if (shift < BITS_PER_LONG)
-         * Limit the tracking speed to avoid overshooting.
+                step = DIV_ROUND_UP(step >> shift, 8);
-         */
+        else
-        step = (step + 7) / 8;
+                step = 0;
        if (dirty_ratelimit < balanced_dirty_ratelimit)
                dirty_ratelimit += step;
@@ -2409,12 +2410,11 @@ int __set_page_dirty_no_writeback(struct page *page)
 /*
 * Helper function for set_page_dirty family.
 *
- * Caller must hold mem_cgroup_begin_page_stat().
+ * Caller must hold lock_page_memcg().
 *
 * NOTE: This relies on being atomic wrt interrupts.
 */
-void account_page_dirtied(struct page *page, struct address_space *mapping,
+void account_page_dirtied(struct page *page, struct address_space *mapping)
-                          struct mem_cgroup *memcg)
 {
        struct inode *inode = mapping->host;
@@ -2426,7 +2426,7 @@ void account_page_dirtied(struct page *page, struct address_space *mapping,
                inode_attach_wb(inode, page);
                wb = inode_to_wb(inode);
-                mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_DIRTY);
+                mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_DIRTY);
                __inc_zone_page_state(page, NR_FILE_DIRTY);
                __inc_zone_page_state(page, NR_DIRTIED);
                __inc_wb_stat(wb, WB_RECLAIMABLE);
@@ -2441,13 +2441,13 @@ EXPORT_SYMBOL(account_page_dirtied);
 /*
 * Helper function for deaccounting dirty page without writeback.
 *
- * Caller must hold mem_cgroup_begin_page_stat().
+ * Caller must hold lock_page_memcg().
 */
 void account_page_cleaned(struct page *page, struct address_space *mapping,
-                          struct mem_cgroup *memcg, struct bdi_writeback *wb)
+                          struct bdi_writeback *wb)
 {
        if (mapping_cap_account_dirty(mapping)) {
-                mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_DIRTY);
+                mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_DIRTY);
                dec_zone_page_state(page, NR_FILE_DIRTY);
                dec_wb_stat(wb, WB_RECLAIMABLE);
                task_io_account_cancelled_write(PAGE_CACHE_SIZE);
@@ -2468,26 +2468,24 @@ void account_page_cleaned(struct page *page, struct address_space *mapping,
 */
 int __set_page_dirty_nobuffers(struct page *page)
 {
-        struct mem_cgroup *memcg;
+        lock_page_memcg(page);
-        memcg = mem_cgroup_begin_page_stat(page);
        if (!TestSetPageDirty(page)) {
                struct address_space *mapping = page_mapping(page);
                unsigned long flags;
                if (!mapping) {
-                        mem_cgroup_end_page_stat(memcg);
+                        unlock_page_memcg(page);
                        return 1;
                }
                spin_lock_irqsave(&mapping->tree_lock, flags);
                BUG_ON(page_mapping(page) != mapping);
                WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
-                account_page_dirtied(page, mapping, memcg);
+                account_page_dirtied(page, mapping);
                radix_tree_tag_set(&mapping->page_tree, page_index(page),
                                   PAGECACHE_TAG_DIRTY);
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
-                mem_cgroup_end_page_stat(memcg);
+                unlock_page_memcg(page);
                if (mapping->host) {
                        /* !PageAnon && !swapper_space */
@@ -2495,7 +2493,7 @@ int __set_page_dirty_nobuffers(struct page *page)
                }
                return 1;
        }
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
        return 0;
 }
 EXPORT_SYMBOL(__set_page_dirty_nobuffers);
@@ -2625,17 +2623,16 @@ void cancel_dirty_page(struct page *page)
        if (mapping_cap_account_dirty(mapping)) {
                struct inode *inode = mapping->host;
                struct bdi_writeback *wb;
-                struct mem_cgroup *memcg;
                bool locked;
-                memcg = mem_cgroup_begin_page_stat(page);
+                lock_page_memcg(page);
                wb = unlocked_inode_to_wb_begin(inode, &locked);
                if (TestClearPageDirty(page))
-                        account_page_cleaned(page, mapping, memcg, wb);
+                        account_page_cleaned(page, mapping, wb);
                unlocked_inode_to_wb_end(inode, locked);
-                mem_cgroup_end_page_stat(memcg);
+                unlock_page_memcg(page);
        } else {
                ClearPageDirty(page);
        }
@@ -2666,7 +2663,6 @@ int clear_page_dirty_for_io(struct page *page)
        if (mapping && mapping_cap_account_dirty(mapping)) {
                struct inode *inode = mapping->host;
                struct bdi_writeback *wb;
-                struct mem_cgroup *memcg;
                bool locked;
                /*
@@ -2704,16 +2700,14 @@ int clear_page_dirty_for_io(struct page *page)
                 * always locked coming in here, so we get the desired
                 * exclusion.
                 */
-                memcg = mem_cgroup_begin_page_stat(page);
                wb = unlocked_inode_to_wb_begin(inode, &locked);
                if (TestClearPageDirty(page)) {
-                        mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_DIRTY);
+                        mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_DIRTY);
                        dec_zone_page_state(page, NR_FILE_DIRTY);
                        dec_wb_stat(wb, WB_RECLAIMABLE);
                        ret = 1;
                }
                unlocked_inode_to_wb_end(inode, locked);
-                mem_cgroup_end_page_stat(memcg);
                return ret;
        }
        return TestClearPageDirty(page);
@@ -2723,10 +2717,9 @@ EXPORT_SYMBOL(clear_page_dirty_for_io);
 int test_clear_page_writeback(struct page *page)
 {
        struct address_space *mapping = page_mapping(page);
-        struct mem_cgroup *memcg;
        int ret;
-        memcg = mem_cgroup_begin_page_stat(page);
+        lock_page_memcg(page);
        if (mapping) {
                struct inode *inode = mapping->host;
                struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -2750,21 +2743,20 @@ int test_clear_page_writeback(struct page *page)
                ret = TestClearPageWriteback(page);
        }
        if (ret) {
-                mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_WRITEBACK);
+                mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_WRITEBACK);
                dec_zone_page_state(page, NR_WRITEBACK);
                inc_zone_page_state(page, NR_WRITTEN);
        }
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
        return ret;
 }
 int __test_set_page_writeback(struct page *page, bool keep_write)
 {
        struct address_space *mapping = page_mapping(page);
-        struct mem_cgroup *memcg;
        int ret;
-        memcg = mem_cgroup_begin_page_stat(page);
+        lock_page_memcg(page);
        if (mapping) {
                struct inode *inode = mapping->host;
                struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -2792,10 +2784,10 @@ int __test_set_page_writeback(struct page *page, bool keep_write)
                ret = TestSetPageWriteback(page);
        }
        if (!ret) {
-                mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_WRITEBACK);
+                mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_WRITEBACK);
                inc_zone_page_state(page, NR_WRITEBACK);
        }
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
        return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 838ca8bb64f7..c46b75d14b6f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -223,6 +223,19 @@ static char * const zone_names[MAX_NR_ZONES] = {
 #endif
 };
+char * const migratetype_names[MIGRATE_TYPES] = {
+        "Unmovable",
+        "Movable",
+        "Reclaimable",
+        "HighAtomic",
+#ifdef CONFIG_CMA
+        "CMA",
+#endif
+#ifdef CONFIG_MEMORY_ISOLATION
+        "Isolate",
+#endif
+};
 compound_page_dtor * const compound_page_dtors[] = {
        NULL,
        free_compound_page,
@@ -247,6 +260,7 @@ static unsigned long __meminitdata arch_zone_highest_possible_pfn[MAX_NR_ZONES];
 static unsigned long __initdata required_kernelcore;
 static unsigned long __initdata required_movablecore;
 static unsigned long __meminitdata zone_movable_pfn[MAX_NUMNODES];
+static bool mirrored_kernelcore;
 /* movable_zone is the "real" zone pages in ZONE_MOVABLE are taken from */
 int movable_zone;
@@ -416,7 +430,7 @@ static void bad_page(struct page *page, const char *reason,
                        goto out;
                }
                if (nr_unshown) {
-                        printk(KERN_ALERT
+                        pr_alert(
                              "BUG: Bad page state: %lu messages suppressed\n",
                                nr_unshown);
                        nr_unshown = 0;
@@ -426,9 +440,14 @@ static void bad_page(struct page *page, const char *reason,
        if (nr_shown++ == 0)
                resume = jiffies + 60 * HZ;
-        printk(KERN_ALERT "BUG: Bad page state in process %s  pfn:%05lx\n",
+        pr_alert("BUG: Bad page state in process %s  pfn:%05lx\n",
                current->comm, page_to_pfn(page));
-        dump_page_badflags(page, reason, bad_flags);
+        __dump_page(page, reason);
+        bad_flags &= page->flags;
+        if (bad_flags)
+                pr_alert("bad because of flags: %#lx(%pGp)\n",
+                                                bad_flags, &bad_flags);
+        dump_page_owner(page);
        print_modules();
        dump_stack();
@@ -477,7 +496,8 @@ void prep_compound_page(struct page *page, unsigned int order)
 #ifdef CONFIG_DEBUG_PAGEALLOC
 unsigned int _debug_guardpage_minorder;
-bool _debug_pagealloc_enabled __read_mostly;
+bool _debug_pagealloc_enabled __read_mostly
+                        = IS_ENABLED(CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT);
 bool _debug_guardpage_enabled __read_mostly;
 static int __init early_debug_pagealloc(char *buf)
@@ -488,6 +508,9 @@ static int __init early_debug_pagealloc(char *buf)
        if (strcmp(buf, "on") == 0)
                _debug_pagealloc_enabled = true;
+        if (strcmp(buf, "off") == 0)
+                _debug_pagealloc_enabled = false;
        return 0;
 }
 early_param("debug_pagealloc", early_debug_pagealloc);
@@ -1002,6 +1025,7 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
                                           PAGE_SIZE << order);
        }
        arch_free_page(page, order);
+        kernel_poison_pages(page, 1 << order, 0);
        kernel_map_pages(page, 1 << order, 0);
        return true;
@@ -1104,6 +1128,75 @@ void __init __free_pages_bootmem(struct page *page, unsigned long pfn,
        return __free_pages_boot_core(page, pfn, order);
 }
+/*
+ * Check that the whole (or subset of) a pageblock given by the interval of
+ * [start_pfn, end_pfn) is valid and within the same zone, before scanning it
+ * with the migration of free compaction scanner. The scanners then need to
+ * use only pfn_valid_within() check for arches that allow holes within
+ * pageblocks.
+ *
+ * Return struct page pointer of start_pfn, or NULL if checks were not passed.
+ *
+ * It's possible on some configurations to have a setup like node0 node1 node0
+ * i.e. it's possible that all pages within a zones range of pages do not
+ * belong to a single zone. We assume that a border between node0 and node1
+ * can occur within a single pageblock, but not a node0 node1 node0
+ * interleaving within a single pageblock. It is therefore sufficient to check
+ * the first and last page of a pageblock and avoid checking each individual
+ * page in a pageblock.
+ */
+struct page *__pageblock_pfn_to_page(unsigned long start_pfn,
+                                     unsigned long end_pfn, struct zone *zone)
+{
+        struct page *start_page;
+        struct page *end_page;
+        /* end_pfn is one past the range we are checking */
+        end_pfn--;
+        if (!pfn_valid(start_pfn) || !pfn_valid(end_pfn))
+                return NULL;
+        start_page = pfn_to_page(start_pfn);
+        if (page_zone(start_page) != zone)
+                return NULL;
+        end_page = pfn_to_page(end_pfn);
+        /* This gives a shorter code than deriving page_zone(end_page) */
+        if (page_zone_id(start_page) != page_zone_id(end_page))
+                return NULL;
+        return start_page;
+}
+void set_zone_contiguous(struct zone *zone)
+{
+        unsigned long block_start_pfn = zone->zone_start_pfn;
+        unsigned long block_end_pfn;
+        block_end_pfn = ALIGN(block_start_pfn + 1, pageblock_nr_pages);
+        for (; block_start_pfn < zone_end_pfn(zone);
+                        block_start_pfn = block_end_pfn,
+                         block_end_pfn += pageblock_nr_pages) {
+                block_end_pfn = min(block_end_pfn, zone_end_pfn(zone));
+                if (!__pageblock_pfn_to_page(block_start_pfn,
+                                             block_end_pfn, zone))
+                        return;
+        }
+        /* We confirm that there is no hole */
+        zone->contiguous = true;
+}
+void clear_zone_contiguous(struct zone *zone)
+{
+        zone->contiguous = false;
+}
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
 static void __init deferred_free_range(struct page *page,
                                        unsigned long pfn, int nr_pages)
@@ -1254,9 +1347,13 @@ free_range:
        pgdat_init_report_one_done();
        return 0;
 }
+#endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */
 void __init page_alloc_init_late(void)
 {
+        struct zone *zone;
+#ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
        int nid;
        /* There will be num_node_state(N_MEMORY) threads */
@@ -1270,8 +1367,11 @@ void __init page_alloc_init_late(void)
        /* Reinit limits that are based on free pages after the kernel is up */
        files_maxfiles_init();
+#endif
+        for_each_populated_zone(zone)
+                set_zone_contiguous(zone);
 }
-#endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */
 #ifdef CONFIG_CMA
 /* Free whole pageblock and set its migration type to MIGRATE_CMA. */
@@ -1381,15 +1481,24 @@ static inline int check_new_page(struct page *page)
        return 0;
 }
+static inline bool free_pages_prezeroed(bool poisoned)
+{
+        return IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) &&
+                page_poisoning_enabled() && poisoned;
+}
 static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags,
                                                                int alloc_flags)
 {
        int i;
+        bool poisoned = true;
        for (i = 0; i < (1 << order); i++) {
                struct page *p = page + i;
                if (unlikely(check_new_page(p)))
                        return 1;
+                if (poisoned)
+                        poisoned &= page_is_poisoned(p);
        }
        set_page_private(page, 0);
@@ -1397,9 +1506,10 @@ static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags,
        arch_alloc_page(page, order);
        kernel_map_pages(page, 1 << order, 1);
+        kernel_poison_pages(page, 1 << order, 1);
        kasan_alloc_pages(page, order);
-        if (gfp_flags & __GFP_ZERO)
+        if (!free_pages_prezeroed(poisoned) && (gfp_flags & __GFP_ZERO))
                for (i = 0; i < (1 << order); i++)
                        clear_highpage(page + i);
@@ -2690,9 +2800,8 @@ void warn_alloc_failed(gfp_t gfp_mask, unsigned int order, const char *fmt, ...)
                va_end(args);
        }
-        pr_warn("%s: page allocation failure: order:%u, mode:0x%x\n",
+        pr_warn("%s: page allocation failure: order:%u, mode:%#x(%pGg)\n",
-                current->comm, order, gfp_mask);
+                current->comm, order, gfp_mask, &gfp_mask);
        dump_stack();
        if (!should_suppress_show_mem())
                show_mem(filter);
@@ -4491,6 +4600,9 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
        pg_data_t *pgdat = NODE_DATA(nid);
        unsigned long pfn;
        unsigned long nr_initialised = 0;
+#ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
+        struct memblock_region *r = NULL, *tmp;
+#endif
        if (highest_memmap_pfn < end_pfn - 1)
                highest_memmap_pfn = end_pfn - 1;
@@ -4504,20 +4616,51 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
        for (pfn = start_pfn; pfn < end_pfn; pfn++) {
                /*
-                 * There can be holes in boot-time mem_map[]s
+                 * There can be holes in boot-time mem_map[]s handed to this
-                 * handed to this function.  They do not
+                 * function.  They do not exist on hotplugged memory.
-                 * exist on hotplugged memory.
                 */
-                if (context == MEMMAP_EARLY) {
+                if (context != MEMMAP_EARLY)
-                        if (!early_pfn_valid(pfn))
+                        goto not_early;
+                if (!early_pfn_valid(pfn))
+                        continue;
+                if (!early_pfn_in_nid(pfn, nid))
+                        continue;
+                if (!update_defer_init(pgdat, pfn, end_pfn, &nr_initialised))
+                        break;
+#ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
+                /*
+                 * If not mirrored_kernelcore and ZONE_MOVABLE exists, range
+                 * from zone_movable_pfn[nid] to end of each node should be
+                 * ZONE_MOVABLE not ZONE_NORMAL. skip it.
+                 */
+                if (!mirrored_kernelcore && zone_movable_pfn[nid])
+                        if (zone == ZONE_NORMAL && pfn >= zone_movable_pfn[nid])
                                continue;
-                        if (!early_pfn_in_nid(pfn, nid))
+                /*
+                 * Check given memblock attribute by firmware which can affect
+                 * kernel memory layout.  If zone==ZONE_MOVABLE but memory is
+                 * mirrored, it's an overlapped memmap init. skip it.
+                 */
+                if (mirrored_kernelcore && zone == ZONE_MOVABLE) {
+                        if (!r || pfn >= memblock_region_memory_end_pfn(r)) {
+                                for_each_memblock(memory, tmp)
+                                        if (pfn < memblock_region_memory_end_pfn(tmp))
+                                                break;
+                                r = tmp;
+                        }
+                        if (pfn >= memblock_region_memory_base_pfn(r) &&
+                            memblock_is_mirror(r)) {
+                                /* already initialized as NORMAL */
+                                pfn = memblock_region_memory_end_pfn(r);
                                continue;
-                        if (!update_defer_init(pgdat, pfn, end_pfn,
+                        }
-                                                &nr_initialised))
-                                break;
                }
+#endif
+not_early:
                /*
                 * Mark the block movable so that blocks are reserved for
                 * movable at startup. This will force kernel allocations
@@ -4934,11 +5077,6 @@ static void __meminit adjust_zone_range_for_zone_movable(int nid,
                        *zone_end_pfn = min(node_end_pfn,
                                arch_zone_highest_possible_pfn[movable_zone]);
-                /* Adjust for ZONE_MOVABLE starting within this range */
-                } else if (*zone_start_pfn < zone_movable_pfn[nid] &&
-                                *zone_end_pfn > zone_movable_pfn[nid]) {
-                        *zone_end_pfn = zone_movable_pfn[nid];
                /* Check if this whole range is within ZONE_MOVABLE */
                } else if (*zone_start_pfn >= zone_movable_pfn[nid])
                        *zone_start_pfn = *zone_end_pfn;
@@ -4953,31 +5091,31 @@ static unsigned long __meminit zone_spanned_pages_in_node(int nid,
                                        unsigned long zone_type,
                                        unsigned long node_start_pfn,
                                        unsigned long node_end_pfn,
+                                        unsigned long *zone_start_pfn,
+                                        unsigned long *zone_end_pfn,
                                        unsigned long *ignored)
 {
-        unsigned long zone_start_pfn, zone_end_pfn;
        /* When hotadd a new node from cpu_up(), the node should be empty */
        if (!node_start_pfn && !node_end_pfn)
                return 0;
        /* Get the start and end of the zone */
-        zone_start_pfn = arch_zone_lowest_possible_pfn[zone_type];
+        *zone_start_pfn = arch_zone_lowest_possible_pfn[zone_type];
-        zone_end_pfn = arch_zone_highest_possible_pfn[zone_type];
+        *zone_end_pfn = arch_zone_highest_possible_pfn[zone_type];
        adjust_zone_range_for_zone_movable(nid, zone_type,
                                node_start_pfn, node_end_pfn,
-                                &zone_start_pfn, &zone_end_pfn);
+                                zone_start_pfn, zone_end_pfn);
        /* Check that this node has pages within the zone's required range */
-        if (zone_end_pfn < node_start_pfn || zone_start_pfn > node_end_pfn)
+        if (*zone_end_pfn < node_start_pfn || *zone_start_pfn > node_end_pfn)
                return 0;
        /* Move the zone boundaries inside the node if necessary */
-        zone_end_pfn = min(zone_end_pfn, node_end_pfn);
+        *zone_end_pfn = min(*zone_end_pfn, node_end_pfn);
-        zone_start_pfn = max(zone_start_pfn, node_start_pfn);
+        *zone_start_pfn = max(*zone_start_pfn, node_start_pfn);
        /* Return the spanned pages */
-        return zone_end_pfn - zone_start_pfn;
+        return *zone_end_pfn - *zone_start_pfn;
 }
 /*
@@ -5023,6 +5161,7 @@ static unsigned long __meminit zone_absent_pages_in_node(int nid,
        unsigned long zone_low = arch_zone_lowest_possible_pfn[zone_type];
        unsigned long zone_high = arch_zone_highest_possible_pfn[zone_type];
        unsigned long zone_start_pfn, zone_end_pfn;
+        unsigned long nr_absent;
        /* When hotadd a new node from cpu_up(), the node should be empty */
        if (!node_start_pfn && !node_end_pfn)
@@ -5034,7 +5173,39 @@ static unsigned long __meminit zone_absent_pages_in_node(int nid,
        adjust_zone_range_for_zone_movable(nid, zone_type,
                        node_start_pfn, node_end_pfn,
                        &zone_start_pfn, &zone_end_pfn);
-        return __absent_pages_in_range(nid, zone_start_pfn, zone_end_pfn);
+        nr_absent = __absent_pages_in_range(nid, zone_start_pfn, zone_end_pfn);
+        /*
+         * ZONE_MOVABLE handling.
+         * Treat pages to be ZONE_MOVABLE in ZONE_NORMAL as absent pages
+         * and vice versa.
+         */
+        if (zone_movable_pfn[nid]) {
+                if (mirrored_kernelcore) {
+                        unsigned long start_pfn, end_pfn;
+                        struct memblock_region *r;
+                        for_each_memblock(memory, r) {
+                                start_pfn = clamp(memblock_region_memory_base_pfn(r),
+                                                  zone_start_pfn, zone_end_pfn);
+                                end_pfn = clamp(memblock_region_memory_end_pfn(r),
+                                                zone_start_pfn, zone_end_pfn);
+                                if (zone_type == ZONE_MOVABLE &&
+                                    memblock_is_mirror(r))
+                                        nr_absent += end_pfn - start_pfn;
+                                if (zone_type == ZONE_NORMAL &&
+                                    !memblock_is_mirror(r))
+                                        nr_absent += end_pfn - start_pfn;
+                        }
+                } else {
+                        if (zone_type == ZONE_NORMAL)
+                                nr_absent += node_end_pfn - zone_movable_pfn[nid];
+                }
+        }
+        return nr_absent;
 }
 #else /* CONFIG_HAVE_MEMBLOCK_NODE_MAP */
@@ -5042,8 +5213,18 @@ static inline unsigned long __meminit zone_spanned_pages_in_node(int nid,
                                        unsigned long zone_type,
                                        unsigned long node_start_pfn,
                                        unsigned long node_end_pfn,
+                                        unsigned long *zone_start_pfn,
+                                        unsigned long *zone_end_pfn,
                                        unsigned long *zones_size)
 {
+        unsigned int zone;
+        *zone_start_pfn = node_start_pfn;
+        for (zone = 0; zone < zone_type; zone++)
+                *zone_start_pfn += zones_size[zone];
+        *zone_end_pfn = *zone_start_pfn + zones_size[zone_type];
        return zones_size[zone_type];
 }
@@ -5072,15 +5253,22 @@ static void __meminit calculate_node_totalpages(struct pglist_data *pgdat,
        for (i = 0; i < MAX_NR_ZONES; i++) {
                struct zone *zone = pgdat->node_zones + i;
+                unsigned long zone_start_pfn, zone_end_pfn;
                unsigned long size, real_size;
                size = zone_spanned_pages_in_node(pgdat->node_id, i,
                                                  node_start_pfn,
                                                  node_end_pfn,
+                                                  &zone_start_pfn,
+                                                  &zone_end_pfn,
                                                  zones_size);
                real_size = size - zone_absent_pages_in_node(pgdat->node_id, i,
                                                  node_start_pfn, node_end_pfn,
                                                  zholes_size);
+                if (size)
+                        zone->zone_start_pfn = zone_start_pfn;
+                else
+                        zone->zone_start_pfn = 0;
                zone->spanned_pages = size;
                zone->present_pages = real_size;
@@ -5201,7 +5389,6 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat)
 {
        enum zone_type j;
        int nid = pgdat->node_id;
-        unsigned long zone_start_pfn = pgdat->node_start_pfn;
        int ret;
        pgdat_resize_init(pgdat);
@@ -5222,6 +5409,7 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat)
        for (j = 0; j < MAX_NR_ZONES; j++) {
                struct zone *zone = pgdat->node_zones + j;
                unsigned long size, realsize, freesize, memmap_pages;
+                unsigned long zone_start_pfn = zone->zone_start_pfn;
                size = zone->spanned_pages;
                realsize = freesize = zone->present_pages;
@@ -5290,7 +5478,6 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat)
                ret = init_currently_empty_zone(zone, zone_start_pfn, size);
                BUG_ON(ret);
                memmap_init(size, nid, j, zone_start_pfn);
-                zone_start_pfn += size;
        }
 }
@@ -5358,6 +5545,8 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
        pr_info("Initmem setup node %d [mem %#018Lx-%#018Lx]\n", nid,
                (u64)start_pfn << PAGE_SHIFT,
                end_pfn ? ((u64)end_pfn << PAGE_SHIFT) - 1 : 0);
+#else
+        start_pfn = node_start_pfn;
 #endif
        calculate_node_totalpages(pgdat, start_pfn, end_pfn,
                                  zones_size, zholes_size);
@@ -5529,6 +5718,36 @@ static void __init find_zone_movable_pfns_for_nodes(void)
        }
        /*
+         * If kernelcore=mirror is specified, ignore movablecore option
+         */
+        if (mirrored_kernelcore) {
+                bool mem_below_4gb_not_mirrored = false;
+                for_each_memblock(memory, r) {
+                        if (memblock_is_mirror(r))
+                                continue;
+                        nid = r->nid;
+                        usable_startpfn = memblock_region_memory_base_pfn(r);
+                        if (usable_startpfn < 0x100000) {
+                                mem_below_4gb_not_mirrored = true;
+                                continue;
+                        }
+                        zone_movable_pfn[nid] = zone_movable_pfn[nid] ?
+                                min(usable_startpfn, zone_movable_pfn[nid]) :
+                                usable_startpfn;
+                }
+                if (mem_below_4gb_not_mirrored)
+                        pr_warn("This configuration results in unmirrored kernel memory.");
+                goto out2;
+        }
+        /*
         * If movablecore=nn[KMG] was specified, calculate what size of
         * kernelcore that corresponds so that memory usable for
         * any allocation type is evenly spread. If both kernelcore
@@ -5788,6 +6007,12 @@ static int __init cmdline_parse_core(char *p, unsigned long *core)
 */
 static int __init cmdline_parse_kernelcore(char *p)
 {
+        /* parse kernelcore=mirror */
+        if (parse_option_str(p, "mirror")) {
+                mirrored_kernelcore = true;
+                return 0;
+        }
        return cmdline_parse_core(p, &required_kernelcore);
 }
diff --git a/mm/page_ext.c b/mm/page_ext.c
index 292ca7b8debd..2d864e64f7fe 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -106,12 +106,15 @@ struct page_ext *lookup_page_ext(struct page *page)
        struct page_ext *base;
        base = NODE_DATA(page_to_nid(page))->node_page_ext;
-#ifdef CONFIG_DEBUG_VM
+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAGE_POISONING)
        /*
         * The sanity checks the page allocator does upon freeing a
         * page can reach here before the page_ext arrays are
         * allocated when feeding a range of pages to the allocator
         * for the first time during bootup or memory hotplug.
+         *
+         * This check is also necessary for ensuring page poisoning
+         * works as expected when enabled
         */
        if (unlikely(!base))
                return NULL;
@@ -180,12 +183,15 @@ struct page_ext *lookup_page_ext(struct page *page)
 {
        unsigned long pfn = page_to_pfn(page);
        struct mem_section *section = __pfn_to_section(pfn);
-#ifdef CONFIG_DEBUG_VM
+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAGE_POISONING)
        /*
         * The sanity checks the page allocator does upon freeing a
         * page can reach here before the page_ext arrays are
         * allocated when feeding a range of pages to the allocator
         * for the first time during bootup or memory hotplug.
+         *
+         * This check is also necessary for ensuring page poisoning
+         * works as expected when enabled
         */
        if (!section->page_ext)
                return NULL;
diff --git a/mm/page_owner.c b/mm/page_owner.c
index 983c3a10fa07..44ad1f00c4e1 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -5,10 +5,12 @@
 #include <linux/bootmem.h>
 #include <linux/stacktrace.h>
 #include <linux/page_owner.h>
+#include <linux/jump_label.h>
+#include <linux/migrate.h>
 #include "internal.h"
 static bool page_owner_disabled = true;
-bool page_owner_inited __read_mostly;
+DEFINE_STATIC_KEY_FALSE(page_owner_inited);
 static void init_early_allocated_pages(void);
@@ -37,7 +39,7 @@ static void init_page_owner(void)
        if (page_owner_disabled)
                return;
-        page_owner_inited = true;
+        static_branch_enable(&page_owner_inited);
        init_early_allocated_pages();
 }
@@ -72,10 +74,18 @@ void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask)
        page_ext->order = order;
        page_ext->gfp_mask = gfp_mask;
        page_ext->nr_entries = trace.nr_entries;
+        page_ext->last_migrate_reason = -1;
        __set_bit(PAGE_EXT_OWNER, &page_ext->flags);
 }
+void __set_page_owner_migrate_reason(struct page *page, int reason)
+{
+        struct page_ext *page_ext = lookup_page_ext(page);
+        page_ext->last_migrate_reason = reason;
+}
 gfp_t __get_page_owner_gfp(struct page *page)
 {
        struct page_ext *page_ext = lookup_page_ext(page);
@@ -83,6 +93,31 @@ gfp_t __get_page_owner_gfp(struct page *page)
        return page_ext->gfp_mask;
 }
+void __copy_page_owner(struct page *oldpage, struct page *newpage)
+{
+        struct page_ext *old_ext = lookup_page_ext(oldpage);
+        struct page_ext *new_ext = lookup_page_ext(newpage);
+        int i;
+        new_ext->order = old_ext->order;
+        new_ext->gfp_mask = old_ext->gfp_mask;
+        new_ext->nr_entries = old_ext->nr_entries;
+        for (i = 0; i < ARRAY_SIZE(new_ext->trace_entries); i++)
+                new_ext->trace_entries[i] = old_ext->trace_entries[i];
+        /*
+         * We don't clear the bit on the oldpage as it's going to be freed
+         * after migration. Until then, the info can be useful in case of
+         * a bug, and the overal stats will be off a bit only temporarily.
+         * Also, migrate_misplaced_transhuge_page() can still fail the
+         * migration and then we want the oldpage to retain the info. But
+         * in that case we also don't need to explicitly clear the info from
+         * the new page, which will be freed.
+         */
+        __set_bit(PAGE_EXT_OWNER, &new_ext->flags);
+}
 static ssize_t
 print_page_owner(char __user *buf, size_t count, unsigned long pfn,
                struct page *page, struct page_ext *page_ext)
@@ -100,8 +135,9 @@ print_page_owner(char __user *buf, size_t count, unsigned long pfn,
                return -ENOMEM;
        ret = snprintf(kbuf, count,
-                        "Page allocated via order %u, mask 0x%x\n",
+                        "Page allocated via order %u, mask %#x(%pGg)\n",
-                        page_ext->order, page_ext->gfp_mask);
+                        page_ext->order, page_ext->gfp_mask,
+                        &page_ext->gfp_mask);
        if (ret >= count)
                goto err;
@@ -110,23 +146,12 @@ print_page_owner(char __user *buf, size_t count, unsigned long pfn,
        pageblock_mt = get_pfnblock_migratetype(page, pfn);
        page_mt  = gfpflags_to_migratetype(page_ext->gfp_mask);
        ret += snprintf(kbuf + ret, count - ret,
-                        "PFN %lu Block %lu type %d %s Flags %s%s%s%s%s%s%s%s%s%s%s%s\n",
+                        "PFN %lu type %s Block %lu type %s Flags %#lx(%pGp)\n",
                        pfn,
+                        migratetype_names[page_mt],
                        pfn >> pageblock_order,
-                        pageblock_mt,
+                        migratetype_names[pageblock_mt],
-                        pageblock_mt != page_mt ? "Fallback" : "        ",
+                        page->flags, &page->flags);
-                        PageLocked(page)        ? "K" : " ",
-                        PageError(page)         ? "E" : " ",
-                        PageReferenced(page)    ? "R" : " ",
-                        PageUptodate(page)      ? "U" : " ",
-                        PageDirty(page)         ? "D" : " ",
-                        PageLRU(page)           ? "L" : " ",
-                        PageActive(page)        ? "A" : " ",
-                        PageSlab(page)          ? "S" : " ",
-                        PageWriteback(page)     ? "W" : " ",
-                        PageCompound(page)      ? "C" : " ",
-                        PageSwapCache(page)     ? "B" : " ",
-                        PageMappedToDisk(page)  ? "M" : " ");
        if (ret >= count)
                goto err;
@@ -135,6 +160,14 @@ print_page_owner(char __user *buf, size_t count, unsigned long pfn,
        if (ret >= count)
                goto err;
+        if (page_ext->last_migrate_reason != -1) {
+                ret += snprintf(kbuf + ret, count - ret,
+                        "Page has been migrated, last migrate reason: %s\n",
+                        migrate_reason_names[page_ext->last_migrate_reason]);
+                if (ret >= count)
+                        goto err;
+        }
        ret += snprintf(kbuf + ret, count - ret, "\n");
        if (ret >= count)
                goto err;
@@ -150,6 +183,31 @@ err:
        return -ENOMEM;
 }
+void __dump_page_owner(struct page *page)
+{
+        struct page_ext *page_ext = lookup_page_ext(page);
+        struct stack_trace trace = {
+                .nr_entries = page_ext->nr_entries,
+                .entries = &page_ext->trace_entries[0],
+        };
+        gfp_t gfp_mask = page_ext->gfp_mask;
+        int mt = gfpflags_to_migratetype(gfp_mask);
+        if (!test_bit(PAGE_EXT_OWNER, &page_ext->flags)) {
+                pr_alert("page_owner info is not active (free page?)\n");
+                return;
+        }
+        pr_alert("page allocated via order %u, migratetype %s, "
+                        "gfp_mask %#x(%pGg)\n", page_ext->order,
+                        migratetype_names[mt], gfp_mask, &gfp_mask);
+        print_stack_trace(&trace, 0);
+        if (page_ext->last_migrate_reason != -1)
+                pr_alert("page has been migrated, last migrate reason: %s\n",
+                        migrate_reason_names[page_ext->last_migrate_reason]);
+}
 static ssize_t
 read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
@@ -157,7 +215,7 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)
        struct page *page;
        struct page_ext *page_ext;
-        if (!page_owner_inited)
+        if (!static_branch_unlikely(&page_owner_inited))
                return -EINVAL;
        page = NULL;
@@ -305,7 +363,7 @@ static int __init pageowner_init(void)
 {
        struct dentry *dentry;
-        if (!page_owner_inited) {
+        if (!static_branch_unlikely(&page_owner_inited)) {
                pr_info("page_owner is disabled\n");
                return 0;
        }
diff --git a/mm/debug-pagealloc.c b/mm/page_poison.c
index 5bf5906ce13b..479e7ea2bea6 100644
--- a/mm/debug-pagealloc.c
+++ b/mm/page_poison.c
@@ -6,22 +6,48 @@
 #include <linux/poison.h>
 #include <linux/ratelimit.h>
-static bool page_poisoning_enabled __read_mostly;
+static bool __page_poisoning_enabled __read_mostly;
+static bool want_page_poisoning __read_mostly;
-static bool need_page_poisoning(void)
+static int early_page_poison_param(char *buf)
 {
-        if (!debug_pagealloc_enabled())
+        if (!buf)
-                return false;
+                return -EINVAL;
+        if (strcmp(buf, "on") == 0)
+                want_page_poisoning = true;
+        else if (strcmp(buf, "off") == 0)
+                want_page_poisoning = false;
-        return true;
+        return 0;
+}
+early_param("page_poison", early_page_poison_param);
+bool page_poisoning_enabled(void)
+{
+        return __page_poisoning_enabled;
+}
+static bool need_page_poisoning(void)
+{
+        return want_page_poisoning;
 }
 static void init_page_poisoning(void)
 {
-        if (!debug_pagealloc_enabled())
+        /*
-                return;
+         * page poisoning is debug page alloc for some arches. If either
+         * of those options are enabled, enable poisoning
+         */
+        if (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC)) {
+                if (!want_page_poisoning && !debug_pagealloc_enabled())
+                        return;
+        } else {
+                if (!want_page_poisoning)
+                        return;
+        }
-        page_poisoning_enabled = true;
+        __page_poisoning_enabled = true;
 }
 struct page_ext_operations page_poisoning_ops = {
@@ -45,11 +71,14 @@ static inline void clear_page_poison(struct page *page)
        __clear_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags);
 }
-static inline bool page_poison(struct page *page)
+bool page_is_poisoned(struct page *page)
 {
        struct page_ext *page_ext;
        page_ext = lookup_page_ext(page);
+        if (!page_ext)
+                return false;
        return test_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags);
 }
@@ -83,6 +112,9 @@ static void check_poison_mem(unsigned char *mem, size_t bytes)
        unsigned char *start;
        unsigned char *end;
+        if (IS_ENABLED(CONFIG_PAGE_POISONING_NO_SANITY))
+                return;
        start = memchr_inv(mem, PAGE_POISON, bytes);
        if (!start)
                return;
@@ -95,9 +127,9 @@ static void check_poison_mem(unsigned char *mem, size_t bytes)
        if (!__ratelimit(&ratelimit))
                return;
        else if (start == end && single_bit_flip(*start, PAGE_POISON))
-                printk(KERN_ERR "pagealloc: single bit error\n");
+                pr_err("pagealloc: single bit error\n");
        else
-                printk(KERN_ERR "pagealloc: memory corruption\n");
+                pr_err("pagealloc: memory corruption\n");
        print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, start,
                        end - start + 1, 1);
@@ -108,7 +140,7 @@ static void unpoison_page(struct page *page)
 {
        void *addr;
-        if (!page_poison(page))
+        if (!page_is_poisoned(page))
                return;
        addr = kmap_atomic(page);
@@ -125,9 +157,9 @@ static void unpoison_pages(struct page *page, int n)
                unpoison_page(page + i);
 }
-void __kernel_map_pages(struct page *page, int numpages, int enable)
+void kernel_poison_pages(struct page *page, int numpages, int enable)
 {
-        if (!page_poisoning_enabled)
+        if (!page_poisoning_enabled())
                return;
        if (enable)
@@ -135,3 +167,10 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
        else
                poison_pages(page, numpages);
 }
+#ifndef CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC
+void __kernel_map_pages(struct page *page, int numpages, int enable)
+{
+        /* This function does nothing, all work is done via poison pages */
+}
+#endif
diff --git a/mm/rmap.c b/mm/rmap.c
index 79f3bf047f38..02f0bfc3c80a 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1287,21 +1287,17 @@ void page_add_new_anon_rmap(struct page *page,
 */
 void page_add_file_rmap(struct page *page)
 {
-        struct mem_cgroup *memcg;
+        lock_page_memcg(page);
-        memcg = mem_cgroup_begin_page_stat(page);
        if (atomic_inc_and_test(&page->_mapcount)) {
                __inc_zone_page_state(page, NR_FILE_MAPPED);
-                mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_FILE_MAPPED);
+                mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
        }
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
 }
 static void page_remove_file_rmap(struct page *page)
 {
-        struct mem_cgroup *memcg;
+        lock_page_memcg(page);
-        memcg = mem_cgroup_begin_page_stat(page);
        /* Hugepages are not counted in NR_FILE_MAPPED for now. */
        if (unlikely(PageHuge(page))) {
@@ -1320,12 +1316,12 @@ static void page_remove_file_rmap(struct page *page)
         * pte lock(a spinlock) is held, which implies preemption disabled.
         */
        __dec_zone_page_state(page, NR_FILE_MAPPED);
-        mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
        if (unlikely(PageMlocked(page)))
                clear_page_mlock(page);
 out:
-        mem_cgroup_end_page_stat(memcg);
+        unlock_page_memcg(page);
 }
 static void page_remove_anon_compound_rmap(struct page *page)
diff --git a/mm/shmem.c b/mm/shmem.c
index 440e2a7e6c1c..1acfdbc4bd9e 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1116,7 +1116,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
                 */
                oldpage = newpage;
        } else {
-                mem_cgroup_replace_page(oldpage, newpage);
+                mem_cgroup_migrate(oldpage, newpage);
                lru_cache_add_anon(newpage);
                *pagep = newpage;
        }
diff --git a/mm/slab.c b/mm/slab.c
index 621fbcb35a36..852fc5c79829 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -169,12 +169,6 @@ typedef unsigned short freelist_idx_t;
 #define SLAB_OBJ_MAX_NUM ((1 << sizeof(freelist_idx_t) * BITS_PER_BYTE) - 1)
 /*
- * true if a page was allocated from pfmemalloc reserves for network-based
- * swap
- */
-static bool pfmemalloc_active __read_mostly;
-/*
 * struct array_cache
 *
 * Purpose:
@@ -195,10 +189,6 @@ struct array_cache {
                         * Must have this definition in here for the proper
                         * alignment of array_cache. Also simplifies accessing
                         * the entries.
-                         *
-                         * Entries should not be directly dereferenced as
-                         * entries belonging to slabs marked pfmemalloc will
-                         * have the lower bits set SLAB_OBJ_PFMEMALLOC
                         */
 };
@@ -207,33 +197,6 @@ struct alien_cache {
        struct array_cache ac;
 };
-#define SLAB_OBJ_PFMEMALLOC     1
-static inline bool is_obj_pfmemalloc(void *objp)
-{
-        return (unsigned long)objp & SLAB_OBJ_PFMEMALLOC;
-}
-static inline void set_obj_pfmemalloc(void **objp)
-{
-        *objp = (void *)((unsigned long)*objp | SLAB_OBJ_PFMEMALLOC);
-        return;
-}
-static inline void clear_obj_pfmemalloc(void **objp)
-{
-        *objp = (void *)((unsigned long)*objp & ~SLAB_OBJ_PFMEMALLOC);
-}
-/*
- * bootstrap: The caches do not work without cpuarrays anymore, but the
- * cpuarrays are allocated from the generic caches...
- */
-#define BOOT_CPUCACHE_ENTRIES   1
-struct arraycache_init {
-        struct array_cache cache;
-        void *entries[BOOT_CPUCACHE_ENTRIES];
-};
 /*
 * Need this for bootstrapping a per node allocator.
 */
@@ -280,9 +243,10 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)
        MAKE_LIST((cachep), (&(ptr)->slabs_free), slabs_free, nodeid);  \
        } while (0)
+#define CFLGS_OBJFREELIST_SLAB  (0x40000000UL)
 #define CFLGS_OFF_SLAB          (0x80000000UL)
+#define OBJFREELIST_SLAB(x)     ((x)->flags & CFLGS_OBJFREELIST_SLAB)
 #define OFF_SLAB(x)     ((x)->flags & CFLGS_OFF_SLAB)
-#define OFF_SLAB_MIN_SIZE (max_t(size_t, PAGE_SIZE >> 5, KMALLOC_MIN_SIZE + 1))
 #define BATCHREFILL_LIMIT       16
 /*
@@ -390,36 +354,26 @@ static void **dbg_userword(struct kmem_cache *cachep, void *objp)
 #endif
-#define OBJECT_FREE (0)
-#define OBJECT_ACTIVE (1)
 #ifdef CONFIG_DEBUG_SLAB_LEAK
-static void set_obj_status(struct page *page, int idx, int val)
+static inline bool is_store_user_clean(struct kmem_cache *cachep)
 {
-        int freelist_size;
+        return atomic_read(&cachep->store_user_clean) == 1;
-        char *status;
-        struct kmem_cache *cachep = page->slab_cache;
-        freelist_size = cachep->num * sizeof(freelist_idx_t);
-        status = (char *)page->freelist + freelist_size;
-        status[idx] = val;
 }
-static inline unsigned int get_obj_status(struct page *page, int idx)
+static inline void set_store_user_clean(struct kmem_cache *cachep)
 {
-        int freelist_size;
+        atomic_set(&cachep->store_user_clean, 1);
-        char *status;
+}
-        struct kmem_cache *cachep = page->slab_cache;
-        freelist_size = cachep->num * sizeof(freelist_idx_t);
-        status = (char *)page->freelist + freelist_size;
-        return status[idx];
+static inline void set_store_user_dirty(struct kmem_cache *cachep)
+{
+        if (is_store_user_clean(cachep))
+                atomic_set(&cachep->store_user_clean, 0);
 }
 #else
-static inline void set_obj_status(struct page *page, int idx, int val) {}
+static inline void set_store_user_dirty(struct kmem_cache *cachep) {}
 #endif
@@ -457,6 +411,7 @@ static inline unsigned int obj_to_index(const struct kmem_cache *cache,
        return reciprocal_divide(offset, cache->reciprocal_buffer_size);
 }
+#define BOOT_CPUCACHE_ENTRIES   1
 /* internal cache of cache description objs */
 static struct kmem_cache kmem_cache_boot = {
        .batchcount = 1,
@@ -475,61 +430,13 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
        return this_cpu_ptr(cachep->cpu_cache);
 }
-static size_t calculate_freelist_size(int nr_objs, size_t align)
-{
-        size_t freelist_size;
-        freelist_size = nr_objs * sizeof(freelist_idx_t);
-        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
-                freelist_size += nr_objs * sizeof(char);
-        if (align)
-                freelist_size = ALIGN(freelist_size, align);
-        return freelist_size;
-}
-static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
-                                size_t idx_size, size_t align)
-{
-        int nr_objs;
-        size_t remained_size;
-        size_t freelist_size;
-        int extra_space = 0;
-        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
-                extra_space = sizeof(char);
-        /*
-         * Ignore padding for the initial guess. The padding
-         * is at most @align-1 bytes, and @buffer_size is at
-         * least @align. In the worst case, this result will
-         * be one greater than the number of objects that fit
-         * into the memory allocation when taking the padding
-         * into account.
-         */
-        nr_objs = slab_size / (buffer_size + idx_size + extra_space);
-        /*
-         * This calculated number will be either the right
-         * amount, or one greater than what we want.
-         */
-        remained_size = slab_size - nr_objs * buffer_size;
-        freelist_size = calculate_freelist_size(nr_objs, align);
-        if (remained_size < freelist_size)
-                nr_objs--;
-        return nr_objs;
-}
 /*
 * Calculate the number of objects and left-over bytes for a given buffer size.
 */
-static void cache_estimate(unsigned long gfporder, size_t buffer_size,
+static unsigned int cache_estimate(unsigned long gfporder, size_t buffer_size,
-                           size_t align, int flags, size_t *left_over,
+                unsigned long flags, size_t *left_over)
-                           unsigned int *num)
 {
-        int nr_objs;
+        unsigned int num;
-        size_t mgmt_size;
        size_t slab_size = PAGE_SIZE << gfporder;
        /*
@@ -537,26 +444,28 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
         * on it. For the latter case, the memory allocated for a
         * slab is used for:
         *
-         * - One unsigned int for each object
-         * - Padding to respect alignment of @align
         * - @buffer_size bytes for each object
+         * - One freelist_idx_t for each object
+         *
+         * We don't need to consider alignment of freelist because
+         * freelist will be at the end of slab page. The objects will be
+         * at the correct alignment.
         *
         * If the slab management structure is off the slab, then the
         * alignment will already be calculated into the size. Because
         * the slabs are all pages aligned, the objects will be at the
         * correct alignment when allocated.
         */
-        if (flags & CFLGS_OFF_SLAB) {
+        if (flags & (CFLGS_OBJFREELIST_SLAB | CFLGS_OFF_SLAB)) {
-                mgmt_size = 0;
+                num = slab_size / buffer_size;
-                nr_objs = slab_size / buffer_size;
+                *left_over = slab_size % buffer_size;
        } else {
-                nr_objs = calculate_nr_objs(slab_size, buffer_size,
+                num = slab_size / (buffer_size + sizeof(freelist_idx_t));
-                                        sizeof(freelist_idx_t), align);
+                *left_over = slab_size %
-                mgmt_size = calculate_freelist_size(nr_objs, align);
+                        (buffer_size + sizeof(freelist_idx_t));
        }
-        *num = nr_objs;
-        *left_over = slab_size - nr_objs*buffer_size - mgmt_size;
+        return num;
 }
 #if DEBUG
@@ -687,120 +596,21 @@ static struct array_cache *alloc_arraycache(int node, int entries,
        return ac;
 }
-static inline bool is_slab_pfmemalloc(struct page *page)
+static noinline void cache_free_pfmemalloc(struct kmem_cache *cachep,
-{
+                                        struct page *page, void *objp)
-        return PageSlabPfmemalloc(page);
-}
-/* Clears pfmemalloc_active if no slabs have pfmalloc set */
-static void recheck_pfmemalloc_active(struct kmem_cache *cachep,
-                                                struct array_cache *ac)
-{
-        struct kmem_cache_node *n = get_node(cachep, numa_mem_id());
-        struct page *page;
-        unsigned long flags;
-        if (!pfmemalloc_active)
-                return;
-        spin_lock_irqsave(&n->list_lock, flags);
-        list_for_each_entry(page, &n->slabs_full, lru)
-                if (is_slab_pfmemalloc(page))
-                        goto out;
-        list_for_each_entry(page, &n->slabs_partial, lru)
-                if (is_slab_pfmemalloc(page))
-                        goto out;
-        list_for_each_entry(page, &n->slabs_free, lru)
-                if (is_slab_pfmemalloc(page))
-                        goto out;
-        pfmemalloc_active = false;
-out:
-        spin_unlock_irqrestore(&n->list_lock, flags);
-}
-static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
-                                                gfp_t flags, bool force_refill)
 {
-        int i;
+        struct kmem_cache_node *n;
-        void *objp = ac->entry[--ac->avail];
+        int page_node;
+        LIST_HEAD(list);
-        /* Ensure the caller is allowed to use objects from PFMEMALLOC slab */
-        if (unlikely(is_obj_pfmemalloc(objp))) {
-                struct kmem_cache_node *n;
-                if (gfp_pfmemalloc_allowed(flags)) {
-                        clear_obj_pfmemalloc(&objp);
-                        return objp;
-                }
-                /* The caller cannot use PFMEMALLOC objects, find another one */
-                for (i = 0; i < ac->avail; i++) {
-                        /* If a !PFMEMALLOC object is found, swap them */
-                        if (!is_obj_pfmemalloc(ac->entry[i])) {
-                                objp = ac->entry[i];
-                                ac->entry[i] = ac->entry[ac->avail];
-                                ac->entry[ac->avail] = objp;
-                                return objp;
-                        }
-                }
-                /*
-                 * If there are empty slabs on the slabs_free list and we are
-                 * being forced to refill the cache, mark this one !pfmemalloc.
-                 */
-                n = get_node(cachep, numa_mem_id());
-                if (!list_empty(&n->slabs_free) && force_refill) {
-                        struct page *page = virt_to_head_page(objp);
-                        ClearPageSlabPfmemalloc(page);
-                        clear_obj_pfmemalloc(&objp);
-                        recheck_pfmemalloc_active(cachep, ac);
-                        return objp;
-                }
-                /* No !PFMEMALLOC objects available */
-                ac->avail++;
-                objp = NULL;
-        }
-        return objp;
-}
-static inline void *ac_get_obj(struct kmem_cache *cachep,
-                        struct array_cache *ac, gfp_t flags, bool force_refill)
-{
-        void *objp;
-        if (unlikely(sk_memalloc_socks()))
-                objp = __ac_get_obj(cachep, ac, flags, force_refill);
-        else
-                objp = ac->entry[--ac->avail];
-        return objp;
-}
-static noinline void *__ac_put_obj(struct kmem_cache *cachep,
-                        struct array_cache *ac, void *objp)
-{
-        if (unlikely(pfmemalloc_active)) {
-                /* Some pfmemalloc slabs exist, check if this is one */
-                struct page *page = virt_to_head_page(objp);
-                if (PageSlabPfmemalloc(page))
-                        set_obj_pfmemalloc(&objp);
-        }
-        return objp;
+        page_node = page_to_nid(page);
-}
+        n = get_node(cachep, page_node);
-static inline void ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac,
+        spin_lock(&n->list_lock);
-                                                                void *objp)
+        free_block(cachep, &objp, 1, page_node, &list);
-{
+        spin_unlock(&n->list_lock);
-        if (unlikely(sk_memalloc_socks()))
-                objp = __ac_put_obj(cachep, ac, objp);
-        ac->entry[ac->avail++] = objp;
+        slabs_destroy(cachep, &list);
 }
 /*
@@ -1003,7 +813,7 @@ static int __cache_free_alien(struct kmem_cache *cachep, void *objp,
                        STATS_INC_ACOVERFLOW(cachep);
                        __drain_alien_cache(cachep, ac, page_node, &list);
                }
-                ac_put_obj(cachep, ac, objp);
+                ac->entry[ac->avail++] = objp;
                spin_unlock(&alien->lock);
                slabs_destroy(cachep, &list);
        } else {
@@ -1540,10 +1350,9 @@ slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
        if ((gfpflags & __GFP_NOWARN) || !__ratelimit(&slab_oom_rs))
                return;
-        printk(KERN_WARNING
+        pr_warn("SLAB: Unable to allocate memory on node %d, gfp=%#x(%pGg)\n",
-                "SLAB: Unable to allocate memory on node %d (gfp=0x%x)\n",
+                nodeid, gfpflags, &gfpflags);
-                nodeid, gfpflags);
+        pr_warn("  cache: %s, object size: %d, order: %d\n",
-        printk(KERN_WARNING "  cache: %s, object size: %d, order: %d\n",
                cachep->name, cachep->size, cachep->gfporder);
        for_each_kmem_cache_node(cachep, node, n) {
@@ -1567,8 +1376,7 @@ slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
                num_slabs += active_slabs;
                num_objs = num_slabs * cachep->num;
-                printk(KERN_WARNING
+                pr_warn("  node %d: slabs: %ld/%ld, objs: %ld/%ld, free: %ld\n",
-                        "  node %d: slabs: %ld/%ld, objs: %ld/%ld, free: %ld\n",
                        node, active_slabs, num_slabs, active_objs, num_objs,
                        free_objects);
        }
@@ -1604,10 +1412,6 @@ static struct page *kmem_getpages(struct kmem_cache *cachep, gfp_t flags,
                return NULL;
        }
-        /* Record if ALLOC_NO_WATERMARKS was set when allocating the slab */
-        if (page_is_pfmemalloc(page))
-                pfmemalloc_active = true;
        nr_pages = (1 << cachep->gfporder);
        if (cachep->flags & SLAB_RECLAIM_ACCOUNT)
                add_zone_page_state(page_zone(page),
@@ -1615,8 +1419,10 @@ static struct page *kmem_getpages(struct kmem_cache *cachep, gfp_t flags,
        else
                add_zone_page_state(page_zone(page),
                        NR_SLAB_UNRECLAIMABLE, nr_pages);
        __SetPageSlab(page);
-        if (page_is_pfmemalloc(page))
+        /* Record if ALLOC_NO_WATERMARKS was set when allocating the slab */
+        if (sk_memalloc_socks() && page_is_pfmemalloc(page))
                SetPageSlabPfmemalloc(page);
        if (kmemcheck_enabled && !(cachep->flags & SLAB_NOTRACK)) {
@@ -1670,6 +1476,14 @@ static void kmem_rcu_free(struct rcu_head *head)
 }
 #if DEBUG
+static bool is_debug_pagealloc_cache(struct kmem_cache *cachep)
+{
+        if (debug_pagealloc_enabled() && OFF_SLAB(cachep) &&
+                (cachep->size % PAGE_SIZE) == 0)
+                return true;
+        return false;
+}
 #ifdef CONFIG_DEBUG_PAGEALLOC
 static void store_stackinfo(struct kmem_cache *cachep, unsigned long *addr,
@@ -1703,6 +1517,23 @@ static void store_stackinfo(struct kmem_cache *cachep, unsigned long *addr,
        }
        *addr++ = 0x87654321;
 }
+static void slab_kernel_map(struct kmem_cache *cachep, void *objp,
+                                int map, unsigned long caller)
+{
+        if (!is_debug_pagealloc_cache(cachep))
+                return;
+        if (caller)
+                store_stackinfo(cachep, objp, caller);
+        kernel_map_pages(virt_to_page(objp), cachep->size / PAGE_SIZE, map);
+}
+#else
+static inline void slab_kernel_map(struct kmem_cache *cachep, void *objp,
+                                int map, unsigned long caller) {}
 #endif
 static void poison_obj(struct kmem_cache *cachep, void *addr, unsigned char val)
@@ -1781,6 +1612,9 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
        int size, i;
        int lines = 0;
+        if (is_debug_pagealloc_cache(cachep))
+                return;
        realobj = (char *)objp + obj_offset(cachep);
        size = cachep->object_size;
@@ -1842,20 +1676,18 @@ static void slab_destroy_debugcheck(struct kmem_cache *cachep,
                                                struct page *page)
 {
        int i;
+        if (OBJFREELIST_SLAB(cachep) && cachep->flags & SLAB_POISON) {
+                poison_obj(cachep, page->freelist - obj_offset(cachep),
+                        POISON_FREE);
+        }
        for (i = 0; i < cachep->num; i++) {
                void *objp = index_to_obj(cachep, page, i);
                if (cachep->flags & SLAB_POISON) {
-#ifdef CONFIG_DEBUG_PAGEALLOC
-                        if (cachep->size % PAGE_SIZE == 0 &&
-                                        OFF_SLAB(cachep))
-                                kernel_map_pages(virt_to_page(objp),
-                                        cachep->size / PAGE_SIZE, 1);
-                        else
-                                check_poison_obj(cachep, objp);
-#else
                        check_poison_obj(cachep, objp);
-#endif
+                        slab_kernel_map(cachep, objp, 1, 0);
                }
                if (cachep->flags & SLAB_RED_ZONE) {
                        if (*dbg_redzone1(cachep, objp) != RED_INACTIVE)
@@ -1916,7 +1748,6 @@ static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list)
 * calculate_slab_order - calculate size (page order) of slabs
 * @cachep: pointer to the cache that is being created
 * @size: size of objects to be created in this cache.
- * @align: required alignment for the objects.
 * @flags: slab allocation flags
 *
 * Also calculates the number of objects per slab.
@@ -1926,9 +1757,8 @@ static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list)
 * towards high-order requests, this should be changed.
 */
 static size_t calculate_slab_order(struct kmem_cache *cachep,
-                        size_t size, size_t align, unsigned long flags)
+                                size_t size, unsigned long flags)
 {
-        unsigned long offslab_limit;
        size_t left_over = 0;
        int gfporder;
@@ -1936,7 +1766,7 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
                unsigned int num;
                size_t remainder;
-                cache_estimate(gfporder, size, align, flags, &remainder, &num);
+                num = cache_estimate(gfporder, size, flags, &remainder);
                if (!num)
                        continue;
@@ -1945,19 +1775,24 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
                        break;
                if (flags & CFLGS_OFF_SLAB) {
-                        size_t freelist_size_per_obj = sizeof(freelist_idx_t);
+                        struct kmem_cache *freelist_cache;
+                        size_t freelist_size;
+                        freelist_size = num * sizeof(freelist_idx_t);
+                        freelist_cache = kmalloc_slab(freelist_size, 0u);
+                        if (!freelist_cache)
+                                continue;
                        /*
-                         * Max number of objs-per-slab for caches which
+                         * Needed to avoid possible looping condition
-                         * use off-slab slabs. Needed to avoid a possible
+                         * in cache_grow()
-                         * looping condition in cache_grow().
                         */
-                        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                        if (OFF_SLAB(freelist_cache))
-                                freelist_size_per_obj += sizeof(char);
+                                continue;
-                        offslab_limit = size;
-                        offslab_limit /= freelist_size_per_obj;
-                        if (num > offslab_limit)
+                        /* check if off slab has enough benefit */
-                                break;
+                        if (freelist_cache->size > cachep->size / 2)
+                                continue;
                }
                /* Found something acceptable - save it away */
@@ -2075,6 +1910,79 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
        return cachep;
 }
+static bool set_objfreelist_slab_cache(struct kmem_cache *cachep,
+                        size_t size, unsigned long flags)
+{
+        size_t left;
+        cachep->num = 0;
+        if (cachep->ctor || flags & SLAB_DESTROY_BY_RCU)
+                return false;
+        left = calculate_slab_order(cachep, size,
+                        flags | CFLGS_OBJFREELIST_SLAB);
+        if (!cachep->num)
+                return false;
+        if (cachep->num * sizeof(freelist_idx_t) > cachep->object_size)
+                return false;
+        cachep->colour = left / cachep->colour_off;
+        return true;
+}
+static bool set_off_slab_cache(struct kmem_cache *cachep,
+                        size_t size, unsigned long flags)
+{
+        size_t left;
+        cachep->num = 0;
+        /*
+         * Always use on-slab management when SLAB_NOLEAKTRACE
+         * to avoid recursive calls into kmemleak.
+         */
+        if (flags & SLAB_NOLEAKTRACE)
+                return false;
+        /*
+         * Size is large, assume best to place the slab management obj
+         * off-slab (should allow better packing of objs).
+         */
+        left = calculate_slab_order(cachep, size, flags | CFLGS_OFF_SLAB);
+        if (!cachep->num)
+                return false;
+        /*
+         * If the slab has been placed off-slab, and we have enough space then
+         * move it on-slab. This is at the expense of any extra colouring.
+         */
+        if (left >= cachep->num * sizeof(freelist_idx_t))
+                return false;
+        cachep->colour = left / cachep->colour_off;
+        return true;
+}
+static bool set_on_slab_cache(struct kmem_cache *cachep,
+                        size_t size, unsigned long flags)
+{
+        size_t left;
+        cachep->num = 0;
+        left = calculate_slab_order(cachep, size, flags);
+        if (!cachep->num)
+                return false;
+        cachep->colour = left / cachep->colour_off;
+        return true;
+}
 /**
 * __kmem_cache_create - Create a cache.
 * @cachep: cache management descriptor
@@ -2099,7 +2007,6 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
 int
 __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
 {
-        size_t left_over, freelist_size;
        size_t ralign = BYTES_PER_WORD;
        gfp_t gfp;
        int err;
@@ -2119,8 +2026,6 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
        if (!(flags & SLAB_DESTROY_BY_RCU))
                flags |= SLAB_POISON;
 #endif
-        if (flags & SLAB_DESTROY_BY_RCU)
-                BUG_ON(flags & SLAB_POISON);
 #endif
        /*
@@ -2152,6 +2057,10 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
         * 4) Store it.
         */
        cachep->align = ralign;
+        cachep->colour_off = cache_line_size();
+        /* Offset must be a multiple of the alignment. */
+        if (cachep->colour_off < cachep->align)
+                cachep->colour_off = cachep->align;
        if (slab_is_available())
                gfp = GFP_KERNEL;
@@ -2179,37 +2088,8 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
                else
                        size += BYTES_PER_WORD;
        }
-#if FORCED_DEBUG && defined(CONFIG_DEBUG_PAGEALLOC)
-        /*
-         * To activate debug pagealloc, off-slab management is necessary
-         * requirement. In early phase of initialization, small sized slab
-         * doesn't get initialized so it would not be possible. So, we need
-         * to check size >= 256. It guarantees that all necessary small
-         * sized slab is initialized in current slab initialization sequence.
-         */
-        if (!slab_early_init && size >= kmalloc_size(INDEX_NODE) &&
-                size >= 256 && cachep->object_size > cache_line_size() &&
-                ALIGN(size, cachep->align) < PAGE_SIZE) {
-                cachep->obj_offset += PAGE_SIZE - ALIGN(size, cachep->align);
-                size = PAGE_SIZE;
-        }
-#endif
 #endif
-        /*
-         * Determine if the slab management is 'on' or 'off' slab.
-         * (bootstrapping cannot cope with offslab caches so don't do
-         * it too early on. Always use on-slab management when
-         * SLAB_NOLEAKTRACE to avoid recursive calls into kmemleak)
-         */
-        if (size >= OFF_SLAB_MIN_SIZE && !slab_early_init &&
-            !(flags & SLAB_NOLEAKTRACE))
-                /*
-                 * Size is large, assume best to place the slab management obj
-                 * off-slab (should allow better packing of objs).
-                 */
-                flags |= CFLGS_OFF_SLAB;
        size = ALIGN(size, cachep->align);
        /*
         * We should restrict the number of objects in a slab to implement
@@ -2218,42 +2098,46 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
        if (FREELIST_BYTE_INDEX && size < SLAB_OBJ_MIN_SIZE)
                size = ALIGN(SLAB_OBJ_MIN_SIZE, cachep->align);
-        left_over = calculate_slab_order(cachep, size, cachep->align, flags);
+#if DEBUG
-        if (!cachep->num)
-                return -E2BIG;
-        freelist_size = calculate_freelist_size(cachep->num, cachep->align);
        /*
-         * If the slab has been placed off-slab, and we have enough space then
+         * To activate debug pagealloc, off-slab management is necessary
-         * move it on-slab. This is at the expense of any extra colouring.
+         * requirement. In early phase of initialization, small sized slab
+         * doesn't get initialized so it would not be possible. So, we need
+         * to check size >= 256. It guarantees that all necessary small
+         * sized slab is initialized in current slab initialization sequence.
         */
-        if (flags & CFLGS_OFF_SLAB && left_over >= freelist_size) {
+        if (debug_pagealloc_enabled() && (flags & SLAB_POISON) &&
-                flags &= ~CFLGS_OFF_SLAB;
+                size >= 256 && cachep->object_size > cache_line_size()) {
-                left_over -= freelist_size;
+                if (size < PAGE_SIZE || size % PAGE_SIZE == 0) {
+                        size_t tmp_size = ALIGN(size, PAGE_SIZE);
+                        if (set_off_slab_cache(cachep, tmp_size, flags)) {
+                                flags |= CFLGS_OFF_SLAB;
+                                cachep->obj_offset += tmp_size - size;
+                                size = tmp_size;
+                                goto done;
+                        }
+                }
        }
+#endif
-        if (flags & CFLGS_OFF_SLAB) {
+        if (set_objfreelist_slab_cache(cachep, size, flags)) {
-                /* really off slab. No need for manual alignment */
+                flags |= CFLGS_OBJFREELIST_SLAB;
-                freelist_size = calculate_freelist_size(cachep->num, 0);
+                goto done;
+        }
-#ifdef CONFIG_PAGE_POISONING
+        if (set_off_slab_cache(cachep, size, flags)) {
-                /* If we're going to use the generic kernel_map_pages()
+                flags |= CFLGS_OFF_SLAB;
-                 * poisoning, then it's going to smash the contents of
+                goto done;
-                 * the redzone and userword anyhow, so switch them off.
-                 */
-                if (size % PAGE_SIZE == 0 && flags & SLAB_POISON)
-                        flags &= ~(SLAB_RED_ZONE | SLAB_STORE_USER);
-#endif
        }
-        cachep->colour_off = cache_line_size();
+        if (set_on_slab_cache(cachep, size, flags))
-        /* Offset must be a multiple of the alignment. */
+                goto done;
-        if (cachep->colour_off < cachep->align)
-                cachep->colour_off = cachep->align;
+        return -E2BIG;
-        cachep->colour = left_over / cachep->colour_off;
-        cachep->freelist_size = freelist_size;
+done:
+        cachep->freelist_size = cachep->num * sizeof(freelist_idx_t);
        cachep->flags = flags;
        cachep->allocflags = __GFP_COMP;
        if (CONFIG_ZONE_DMA_FLAG && (flags & SLAB_CACHE_DMA))
@@ -2261,16 +2145,21 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
        cachep->size = size;
        cachep->reciprocal_buffer_size = reciprocal_value(size);
-        if (flags & CFLGS_OFF_SLAB) {
+#if DEBUG
-                cachep->freelist_cache = kmalloc_slab(freelist_size, 0u);
+        /*
-                /*
+         * If we're going to use the generic kernel_map_pages()
-                 * This is a possibility for one of the kmalloc_{dma,}_caches.
+         * poisoning, then it's going to smash the contents of
-                 * But since we go off slab only for object size greater than
+         * the redzone and userword anyhow, so switch them off.
-                 * OFF_SLAB_MIN_SIZE, and kmalloc_{dma,}_caches get created
+         */
-                 * in ascending order,this should not happen at all.
+        if (IS_ENABLED(CONFIG_PAGE_POISONING) &&
-                 * But leave a BUG_ON for some lucky dude.
+                (cachep->flags & SLAB_POISON) &&
-                 */
+                is_debug_pagealloc_cache(cachep))
-                BUG_ON(ZERO_OR_NULL_PTR(cachep->freelist_cache));
+                cachep->flags &= ~(SLAB_RED_ZONE | SLAB_STORE_USER);
+#endif
+        if (OFF_SLAB(cachep)) {
+                cachep->freelist_cache =
+                        kmalloc_slab(cachep->freelist_size, 0u);
        }
        err = setup_cpu_cache(cachep, gfp);
@@ -2377,9 +2266,6 @@ static int drain_freelist(struct kmem_cache *cache,
                }
                page = list_entry(p, struct page, lru);
-#if DEBUG
-                BUG_ON(page->active);
-#endif
                list_del(&page->lru);
                /*
                 * Safe to drop the lock. The slab is no longer linked
@@ -2454,18 +2340,23 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
        void *freelist;
        void *addr = page_address(page);
-        if (OFF_SLAB(cachep)) {
+        page->s_mem = addr + colour_off;
+        page->active = 0;
+        if (OBJFREELIST_SLAB(cachep))
+                freelist = NULL;
+        else if (OFF_SLAB(cachep)) {
                /* Slab management obj is off-slab. */
                freelist = kmem_cache_alloc_node(cachep->freelist_cache,
                                              local_flags, nodeid);
                if (!freelist)
                        return NULL;
        } else {
-                freelist = addr + colour_off;
+                /* We will use last bytes at the slab for freelist */
-                colour_off += cachep->freelist_size;
+                freelist = addr + (PAGE_SIZE << cachep->gfporder) -
+                                cachep->freelist_size;
        }
-        page->active = 0;
-        page->s_mem = addr + colour_off;
        return freelist;
 }
@@ -2480,17 +2371,14 @@ static inline void set_free_obj(struct page *page,
        ((freelist_idx_t *)(page->freelist))[idx] = val;
 }
-static void cache_init_objs(struct kmem_cache *cachep,
+static void cache_init_objs_debug(struct kmem_cache *cachep, struct page *page)
-                            struct page *page)
 {
+#if DEBUG
        int i;
        for (i = 0; i < cachep->num; i++) {
                void *objp = index_to_obj(cachep, page, i);
-#if DEBUG
-                /* need to poison the objs? */
-                if (cachep->flags & SLAB_POISON)
-                        poison_obj(cachep, objp, POISON_FREE);
                if (cachep->flags & SLAB_STORE_USER)
                        *dbg_userword(cachep, objp) = NULL;
@@ -2514,15 +2402,32 @@ static void cache_init_objs(struct kmem_cache *cachep,
                                slab_error(cachep, "constructor overwrote the"
                                           " start of an object");
                }
-                if ((cachep->size % PAGE_SIZE) == 0 &&
+                /* need to poison the objs? */
-                            OFF_SLAB(cachep) && cachep->flags & SLAB_POISON)
+                if (cachep->flags & SLAB_POISON) {
-                        kernel_map_pages(virt_to_page(objp),
+                        poison_obj(cachep, objp, POISON_FREE);
-                                         cachep->size / PAGE_SIZE, 0);
+                        slab_kernel_map(cachep, objp, 0, 0);
-#else
+                }
-                if (cachep->ctor)
+        }
-                        cachep->ctor(objp);
 #endif
-                set_obj_status(page, i, OBJECT_FREE);
+}
+static void cache_init_objs(struct kmem_cache *cachep,
+                            struct page *page)
+{
+        int i;
+        cache_init_objs_debug(cachep, page);
+        if (OBJFREELIST_SLAB(cachep)) {
+                page->freelist = index_to_obj(cachep, page, cachep->num - 1) +
+                                                obj_offset(cachep);
+        }
+        for (i = 0; i < cachep->num; i++) {
+                /* constructor could break poison info */
+                if (DEBUG == 0 && cachep->ctor)
+                        cachep->ctor(index_to_obj(cachep, page, i));
                set_free_obj(page, i, i);
        }
 }
@@ -2537,30 +2442,28 @@ static void kmem_flagcheck(struct kmem_cache *cachep, gfp_t flags)
        }
 }
-static void *slab_get_obj(struct kmem_cache *cachep, struct page *page,
+static void *slab_get_obj(struct kmem_cache *cachep, struct page *page)
-                                int nodeid)
 {
        void *objp;
        objp = index_to_obj(cachep, page, get_free_obj(page, page->active));
        page->active++;
 #if DEBUG
-        WARN_ON(page_to_nid(virt_to_page(objp)) != nodeid);
+        if (cachep->flags & SLAB_STORE_USER)
+                set_store_user_dirty(cachep);
 #endif
        return objp;
 }
-static void slab_put_obj(struct kmem_cache *cachep, struct page *page,
+static void slab_put_obj(struct kmem_cache *cachep,
-                                void *objp, int nodeid)
+                        struct page *page, void *objp)
 {
        unsigned int objnr = obj_to_index(cachep, page, objp);
 #if DEBUG
        unsigned int i;
-        /* Verify that the slab belongs to the intended node */
-        WARN_ON(page_to_nid(virt_to_page(objp)) != nodeid);
        /* Verify double free bug */
        for (i = page->active; i < cachep->num; i++) {
                if (get_free_obj(page, i) == objnr) {
@@ -2571,6 +2474,9 @@ static void slab_put_obj(struct kmem_cache *cachep, struct page *page,
        }
 #endif
        page->active--;
+        if (!page->freelist)
+                page->freelist = objp + obj_offset(cachep);
        set_free_obj(page, page->active, objnr);
 }
@@ -2645,7 +2551,7 @@ static int cache_grow(struct kmem_cache *cachep,
        /* Get slab management. */
        freelist = alloc_slabmgmt(cachep, page, offset,
                        local_flags & ~GFP_CONSTRAINT_MASK, nodeid);
-        if (!freelist)
+        if (OFF_SLAB(cachep) && !freelist)
                goto opps1;
        slab_map_pages(cachep, page, freelist);
@@ -2726,27 +2632,19 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
                *dbg_redzone1(cachep, objp) = RED_INACTIVE;
                *dbg_redzone2(cachep, objp) = RED_INACTIVE;
        }
-        if (cachep->flags & SLAB_STORE_USER)
+        if (cachep->flags & SLAB_STORE_USER) {
+                set_store_user_dirty(cachep);
                *dbg_userword(cachep, objp) = (void *)caller;
+        }
        objnr = obj_to_index(cachep, page, objp);
        BUG_ON(objnr >= cachep->num);
        BUG_ON(objp != index_to_obj(cachep, page, objnr));
-        set_obj_status(page, objnr, OBJECT_FREE);
        if (cachep->flags & SLAB_POISON) {
-#ifdef CONFIG_DEBUG_PAGEALLOC
-                if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
-                        store_stackinfo(cachep, objp, caller);
-                        kernel_map_pages(virt_to_page(objp),
-                                         cachep->size / PAGE_SIZE, 0);
-                } else {
-                        poison_obj(cachep, objp, POISON_FREE);
-                }
-#else
                poison_obj(cachep, objp, POISON_FREE);
-#endif
+                slab_kernel_map(cachep, objp, 0, caller);
        }
        return objp;
 }
@@ -2756,7 +2654,85 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
 #define cache_free_debugcheck(x,objp,z) (objp)
 #endif
-static struct page *get_first_slab(struct kmem_cache_node *n)
+static inline void fixup_objfreelist_debug(struct kmem_cache *cachep,
+                                                void **list)
+{
+#if DEBUG
+        void *next = *list;
+        void *objp;
+        while (next) {
+                objp = next - obj_offset(cachep);
+                next = *(void **)next;
+                poison_obj(cachep, objp, POISON_FREE);
+        }
+#endif
+}
+static inline void fixup_slab_list(struct kmem_cache *cachep,
+                                struct kmem_cache_node *n, struct page *page,
+                                void **list)
+{
+        /* move slabp to correct slabp list: */
+        list_del(&page->lru);
+        if (page->active == cachep->num) {
+                list_add(&page->lru, &n->slabs_full);
+                if (OBJFREELIST_SLAB(cachep)) {
+#if DEBUG
+                        /* Poisoning will be done without holding the lock */
+                        if (cachep->flags & SLAB_POISON) {
+                                void **objp = page->freelist;
+                                *objp = *list;
+                                *list = objp;
+                        }
+#endif
+                        page->freelist = NULL;
+                }
+        } else
+                list_add(&page->lru, &n->slabs_partial);
+}
+/* Try to find non-pfmemalloc slab if needed */
+static noinline struct page *get_valid_first_slab(struct kmem_cache_node *n,
+                                        struct page *page, bool pfmemalloc)
+{
+        if (!page)
+                return NULL;
+        if (pfmemalloc)
+                return page;
+        if (!PageSlabPfmemalloc(page))
+                return page;
+        /* No need to keep pfmemalloc slab if we have enough free objects */
+        if (n->free_objects > n->free_limit) {
+                ClearPageSlabPfmemalloc(page);
+                return page;
+        }
+        /* Move pfmemalloc slab to the end of list to speed up next search */
+        list_del(&page->lru);
+        if (!page->active)
+                list_add_tail(&page->lru, &n->slabs_free);
+        else
+                list_add_tail(&page->lru, &n->slabs_partial);
+        list_for_each_entry(page, &n->slabs_partial, lru) {
+                if (!PageSlabPfmemalloc(page))
+                        return page;
+        }
+        list_for_each_entry(page, &n->slabs_free, lru) {
+                if (!PageSlabPfmemalloc(page))
+                        return page;
+        }
+        return NULL;
+}
+static struct page *get_first_slab(struct kmem_cache_node *n, bool pfmemalloc)
 {
        struct page *page;
@@ -2768,21 +2744,51 @@ static struct page *get_first_slab(struct kmem_cache_node *n)
                                struct page, lru);
        }
+        if (sk_memalloc_socks())
+                return get_valid_first_slab(n, page, pfmemalloc);
        return page;
 }
-static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags,
+static noinline void *cache_alloc_pfmemalloc(struct kmem_cache *cachep,
-                                                        bool force_refill)
+                                struct kmem_cache_node *n, gfp_t flags)
+{
+        struct page *page;
+        void *obj;
+        void *list = NULL;
+        if (!gfp_pfmemalloc_allowed(flags))
+                return NULL;
+        spin_lock(&n->list_lock);
+        page = get_first_slab(n, true);
+        if (!page) {
+                spin_unlock(&n->list_lock);
+                return NULL;
+        }
+        obj = slab_get_obj(cachep, page);
+        n->free_objects--;
+        fixup_slab_list(cachep, n, page, &list);
+        spin_unlock(&n->list_lock);
+        fixup_objfreelist_debug(cachep, &list);
+        return obj;
+}
+static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
 {
        int batchcount;
        struct kmem_cache_node *n;
        struct array_cache *ac;
        int node;
+        void *list = NULL;
        check_irq_off();
        node = numa_mem_id();
-        if (unlikely(force_refill))
-                goto force_grow;
 retry:
        ac = cpu_cache_get(cachep);
        batchcount = ac->batchcount;
@@ -2808,7 +2814,7 @@ retry:
        while (batchcount > 0) {
                struct page *page;
                /* Get slab alloc is to come from. */
-                page = get_first_slab(n);
+                page = get_first_slab(n, false);
                if (!page)
                        goto must_grow;
@@ -2826,26 +2832,29 @@ retry:
                        STATS_INC_ACTIVE(cachep);
                        STATS_SET_HIGH(cachep);
-                        ac_put_obj(cachep, ac, slab_get_obj(cachep, page,
+                        ac->entry[ac->avail++] = slab_get_obj(cachep, page);
-                                                                        node));
                }
-                /* move slabp to correct slabp list: */
+                fixup_slab_list(cachep, n, page, &list);
-                list_del(&page->lru);
-                if (page->active == cachep->num)
-                        list_add(&page->lru, &n->slabs_full);
-                else
-                        list_add(&page->lru, &n->slabs_partial);
        }
 must_grow:
        n->free_objects -= ac->avail;
 alloc_done:
        spin_unlock(&n->list_lock);
+        fixup_objfreelist_debug(cachep, &list);
        if (unlikely(!ac->avail)) {
                int x;
-force_grow:
+                /* Check if we can use obj in pfmemalloc slab */
+                if (sk_memalloc_socks()) {
+                        void *obj = cache_alloc_pfmemalloc(cachep, n, flags);
+                        if (obj)
+                                return obj;
+                }
                x = cache_grow(cachep, gfp_exact_node(flags), node, NULL);
                /* cache_grow can reenable interrupts, then ac could change. */
@@ -2853,7 +2862,7 @@ force_grow:
                node = numa_mem_id();
                /* no objects in sight? abort */
-                if (!x && (ac->avail == 0 || force_refill))
+                if (!x && ac->avail == 0)
                        return NULL;
                if (!ac->avail)         /* objects refilled by interrupt? */
@@ -2861,7 +2870,7 @@ force_grow:
        }
        ac->touched = 1;
-        return ac_get_obj(cachep, ac, flags, force_refill);
+        return ac->entry[--ac->avail];
 }
 static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep,
@@ -2877,20 +2886,11 @@ static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep,
 static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                                gfp_t flags, void *objp, unsigned long caller)
 {
-        struct page *page;
        if (!objp)
                return objp;
        if (cachep->flags & SLAB_POISON) {
-#ifdef CONFIG_DEBUG_PAGEALLOC
-                if ((cachep->size % PAGE_SIZE) == 0 && OFF_SLAB(cachep))
-                        kernel_map_pages(virt_to_page(objp),
-                                         cachep->size / PAGE_SIZE, 1);
-                else
-                        check_poison_obj(cachep, objp);
-#else
                check_poison_obj(cachep, objp);
-#endif
+                slab_kernel_map(cachep, objp, 1, 0);
                poison_obj(cachep, objp, POISON_INUSE);
        }
        if (cachep->flags & SLAB_STORE_USER)
@@ -2910,8 +2910,6 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                *dbg_redzone2(cachep, objp) = RED_ACTIVE;
        }
-        page = virt_to_head_page(objp);
-        set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE);
        objp += obj_offset(cachep);
        if (cachep->ctor && cachep->flags & SLAB_POISON)
                cachep->ctor(objp);
@@ -2926,40 +2924,24 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
 #define cache_alloc_debugcheck_after(a,b,objp,d) (objp)
 #endif
-static bool slab_should_failslab(struct kmem_cache *cachep, gfp_t flags)
-{
-        if (unlikely(cachep == kmem_cache))
-                return false;
-        return should_failslab(cachep->object_size, flags, cachep->flags);
-}
 static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 {
        void *objp;
        struct array_cache *ac;
-        bool force_refill = false;
        check_irq_off();
        ac = cpu_cache_get(cachep);
        if (likely(ac->avail)) {
                ac->touched = 1;
-                objp = ac_get_obj(cachep, ac, flags, false);
+                objp = ac->entry[--ac->avail];
-                /*
+                STATS_INC_ALLOCHIT(cachep);
-                 * Allow for the possibility all avail objects are not allowed
+                goto out;
-                 * by the current flags
-                 */
-                if (objp) {
-                        STATS_INC_ALLOCHIT(cachep);
-                        goto out;
-                }
-                force_refill = true;
        }
        STATS_INC_ALLOCMISS(cachep);
-        objp = cache_alloc_refill(cachep, flags, force_refill);
+        objp = cache_alloc_refill(cachep, flags);
        /*
         * the 'ac' may be updated by cache_alloc_refill(),
         * and kmemleak_erase() requires its correct value.
@@ -3097,6 +3079,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
        struct page *page;
        struct kmem_cache_node *n;
        void *obj;
+        void *list = NULL;
        int x;
        VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES);
@@ -3106,7 +3089,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
 retry:
        check_irq_off();
        spin_lock(&n->list_lock);
-        page = get_first_slab(n);
+        page = get_first_slab(n, false);
        if (!page)
                goto must_grow;
@@ -3118,17 +3101,13 @@ retry:
        BUG_ON(page->active == cachep->num);
-        obj = slab_get_obj(cachep, page, nodeid);
+        obj = slab_get_obj(cachep, page);
        n->free_objects--;
-        /* move slabp to correct slabp list: */
-        list_del(&page->lru);
-        if (page->active == cachep->num)
+        fixup_slab_list(cachep, n, page, &list);
-                list_add(&page->lru, &n->slabs_full);
-        else
-                list_add(&page->lru, &n->slabs_partial);
        spin_unlock(&n->list_lock);
+        fixup_objfreelist_debug(cachep, &list);
        goto done;
 must_grow:
@@ -3152,14 +3131,10 @@ slab_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
        int slab_node = numa_mem_id();
        flags &= gfp_allowed_mask;
+        cachep = slab_pre_alloc_hook(cachep, flags);
-        lockdep_trace_alloc(flags);
+        if (unlikely(!cachep))
-        if (slab_should_failslab(cachep, flags))
                return NULL;
-        cachep = memcg_kmem_get_cache(cachep, flags);
        cache_alloc_debugcheck_before(cachep, flags);
        local_irq_save(save_flags);
@@ -3188,16 +3163,11 @@ slab_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
  out:
        local_irq_restore(save_flags);
        ptr = cache_alloc_debugcheck_after(cachep, flags, ptr, caller);
-        kmemleak_alloc_recursive(ptr, cachep->object_size, 1, cachep->flags,
-                                 flags);
-        if (likely(ptr)) {
+        if (unlikely(flags & __GFP_ZERO) && ptr)
-                kmemcheck_slab_alloc(cachep, flags, ptr, cachep->object_size);
+                memset(ptr, 0, cachep->object_size);
-                if (unlikely(flags & __GFP_ZERO))
-                        memset(ptr, 0, cachep->object_size);
-        }
-        memcg_kmem_put_cache(cachep);
+        slab_post_alloc_hook(cachep, flags, 1, &ptr);
        return ptr;
 }
@@ -3240,30 +3210,21 @@ slab_alloc(struct kmem_cache *cachep, gfp_t flags, unsigned long caller)
        void *objp;
        flags &= gfp_allowed_mask;
+        cachep = slab_pre_alloc_hook(cachep, flags);
-        lockdep_trace_alloc(flags);
+        if (unlikely(!cachep))
-        if (slab_should_failslab(cachep, flags))
                return NULL;
-        cachep = memcg_kmem_get_cache(cachep, flags);
        cache_alloc_debugcheck_before(cachep, flags);
        local_irq_save(save_flags);
        objp = __do_cache_alloc(cachep, flags);
        local_irq_restore(save_flags);
        objp = cache_alloc_debugcheck_after(cachep, flags, objp, caller);
-        kmemleak_alloc_recursive(objp, cachep->object_size, 1, cachep->flags,
-                                 flags);
        prefetchw(objp);
-        if (likely(objp)) {
+        if (unlikely(flags & __GFP_ZERO) && objp)
-                kmemcheck_slab_alloc(cachep, flags, objp, cachep->object_size);
+                memset(objp, 0, cachep->object_size);
-                if (unlikely(flags & __GFP_ZERO))
-                        memset(objp, 0, cachep->object_size);
-        }
-        memcg_kmem_put_cache(cachep);
+        slab_post_alloc_hook(cachep, flags, 1, &objp);
        return objp;
 }
@@ -3281,13 +3242,12 @@ static void free_block(struct kmem_cache *cachep, void **objpp,
                void *objp;
                struct page *page;
-                clear_obj_pfmemalloc(&objpp[i]);
                objp = objpp[i];
                page = virt_to_head_page(objp);
                list_del(&page->lru);
                check_spinlock_acquired_node(cachep, node);
-                slab_put_obj(cachep, page, objp, node);
+                slab_put_obj(cachep, page, objp);
                STATS_DEC_ACTIVE(cachep);
                n->free_objects++;
@@ -3317,9 +3277,7 @@ static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac)
        LIST_HEAD(list);
        batchcount = ac->batchcount;
-#if DEBUG
-        BUG_ON(!batchcount || batchcount > ac->avail);
-#endif
        check_irq_off();
        n = get_node(cachep, node);
        spin_lock(&n->list_lock);
@@ -3389,7 +3347,16 @@ static inline void __cache_free(struct kmem_cache *cachep, void *objp,
                cache_flusharray(cachep, ac);
        }
-        ac_put_obj(cachep, ac, objp);
+        if (sk_memalloc_socks()) {
+                struct page *page = virt_to_head_page(objp);
+                if (unlikely(PageSlabPfmemalloc(page))) {
+                        cache_free_pfmemalloc(cachep, page, objp);
+                        return;
+                }
+        }
+        ac->entry[ac->avail++] = objp;
 }
 /**
@@ -3411,16 +3378,53 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 }
 EXPORT_SYMBOL(kmem_cache_alloc);
-void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
+static __always_inline void
+cache_alloc_debugcheck_after_bulk(struct kmem_cache *s, gfp_t flags,
+                                  size_t size, void **p, unsigned long caller)
 {
-        __kmem_cache_free_bulk(s, size, p);
+        size_t i;
+        for (i = 0; i < size; i++)
+                p[i] = cache_alloc_debugcheck_after(s, flags, p[i], caller);
 }
-EXPORT_SYMBOL(kmem_cache_free_bulk);
 int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
-                                                                void **p)
+                          void **p)
 {
-        return __kmem_cache_alloc_bulk(s, flags, size, p);
+        size_t i;
+        s = slab_pre_alloc_hook(s, flags);
+        if (!s)
+                return 0;
+        cache_alloc_debugcheck_before(s, flags);
+        local_irq_disable();
+        for (i = 0; i < size; i++) {
+                void *objp = __do_cache_alloc(s, flags);
+                if (unlikely(!objp))
+                        goto error;
+                p[i] = objp;
+        }
+        local_irq_enable();
+        cache_alloc_debugcheck_after_bulk(s, flags, size, p, _RET_IP_);
+        /* Clear memory outside IRQ disabled section */
+        if (unlikely(flags & __GFP_ZERO))
+                for (i = 0; i < size; i++)
+                        memset(p[i], 0, s->object_size);
+        slab_post_alloc_hook(s, flags, size, p);
+        /* FIXME: Trace call missing. Christoph would like a bulk variant */
+        return size;
+error:
+        local_irq_enable();
+        cache_alloc_debugcheck_after_bulk(s, flags, i, p, _RET_IP_);
+        slab_post_alloc_hook(s, flags, i, p);
+        __kmem_cache_free_bulk(s, i, p);
+        return 0;
 }
 EXPORT_SYMBOL(kmem_cache_alloc_bulk);
@@ -3567,6 +3571,32 @@ void kmem_cache_free(struct kmem_cache *cachep, void *objp)
 }
 EXPORT_SYMBOL(kmem_cache_free);
+void kmem_cache_free_bulk(struct kmem_cache *orig_s, size_t size, void **p)
+{
+        struct kmem_cache *s;
+        size_t i;
+        local_irq_disable();
+        for (i = 0; i < size; i++) {
+                void *objp = p[i];
+                if (!orig_s) /* called via kfree_bulk */
+                        s = virt_to_cache(objp);
+                else
+                        s = cache_from_obj(orig_s, objp);
+                debug_check_no_locks_freed(objp, s->object_size);
+                if (!(s->flags & SLAB_DEBUG_OBJECTS))
+                        debug_check_no_obj_freed(objp, s->object_size);
+                __cache_free(s, objp, _RET_IP_);
+        }
+        local_irq_enable();
+        /* FIXME: add tracing */
+}
+EXPORT_SYMBOL(kmem_cache_free_bulk);
 /**
 * kfree - free previously allocated memory
 * @objp: pointer returned by kmalloc.
@@ -4102,15 +4132,34 @@ static void handle_slab(unsigned long *n, struct kmem_cache *c,
                                                struct page *page)
 {
        void *p;
-        int i;
+        int i, j;
+        unsigned long v;
        if (n[0] == n[1])
                return;
        for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
-                if (get_obj_status(page, i) != OBJECT_ACTIVE)
+                bool active = true;
+                for (j = page->active; j < c->num; j++) {
+                        if (get_free_obj(page, j) == i) {
+                                active = false;
+                                break;
+                        }
+                }
+                if (!active)
+                        continue;
+                /*
+                 * probe_kernel_read() is used for DEBUG_PAGEALLOC. page table
+                 * mapping is established when actual object allocation and
+                 * we could mistakenly access the unmapped object in the cpu
+                 * cache.
+                 */
+                if (probe_kernel_read(&v, dbg_userword(c, p), sizeof(v)))
                        continue;
-                if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
+                if (!add_caller(n, v))
                        return;
        }
 }
@@ -4146,21 +4195,31 @@ static int leaks_show(struct seq_file *m, void *p)
        if (!(cachep->flags & SLAB_RED_ZONE))
                return 0;
-        /* OK, we can do it */
+        /*
+         * Set store_user_clean and start to grab stored user information
+         * for all objects on this cache. If some alloc/free requests comes
+         * during the processing, information would be wrong so restart
+         * whole processing.
+         */
+        do {
+                set_store_user_clean(cachep);
+                drain_cpu_caches(cachep);
-        x[1] = 0;
+                x[1] = 0;
-        for_each_kmem_cache_node(cachep, node, n) {
+                for_each_kmem_cache_node(cachep, node, n) {
-                check_irq_on();
+                        check_irq_on();
-                spin_lock_irq(&n->list_lock);
+                        spin_lock_irq(&n->list_lock);
+                        list_for_each_entry(page, &n->slabs_full, lru)
+                                handle_slab(x, cachep, page);
+                        list_for_each_entry(page, &n->slabs_partial, lru)
+                                handle_slab(x, cachep, page);
+                        spin_unlock_irq(&n->list_lock);
+                }
+        } while (!is_store_user_clean(cachep));
-                list_for_each_entry(page, &n->slabs_full, lru)
-                        handle_slab(x, cachep, page);
-                list_for_each_entry(page, &n->slabs_partial, lru)
-                        handle_slab(x, cachep, page);
-                spin_unlock_irq(&n->list_lock);
-        }
        name = cachep->name;
        if (x[0] == x[1]) {
                /* Increase the buffer size */
diff --git a/mm/slab.h b/mm/slab.h
index 2eedacea439d..b7934361f026 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -38,6 +38,10 @@ struct kmem_cache {
 #endif
 #include <linux/memcontrol.h>
+#include <linux/fault-inject.h>
+#include <linux/kmemcheck.h>
+#include <linux/kasan.h>
+#include <linux/kmemleak.h>
 /*
 * State of the slab allocator.
@@ -121,7 +125,7 @@ static inline unsigned long kmem_cache_flags(unsigned long object_size,
 #define SLAB_DEBUG_FLAGS (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER)
 #elif defined(CONFIG_SLUB_DEBUG)
 #define SLAB_DEBUG_FLAGS (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER | \
-                          SLAB_TRACE | SLAB_DEBUG_FREE)
+                          SLAB_TRACE | SLAB_CONSISTENCY_CHECKS)
 #else
 #define SLAB_DEBUG_FLAGS (0)
 #endif
@@ -168,7 +172,7 @@ ssize_t slabinfo_write(struct file *file, const char __user *buffer,
 /*
 * Generic implementation of bulk operations
 * These are useful for situations in which the allocator cannot
- * perform optimizations. In that case segments of the objecct listed
+ * perform optimizations. In that case segments of the object listed
 * may be allocated or freed using these operations.
 */
 void __kmem_cache_free_bulk(struct kmem_cache *, size_t, void **);
@@ -307,7 +311,8 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
         * to not do even the assignment. In that case, slab_equal_or_root
         * will also be a constant.
         */
-        if (!memcg_kmem_enabled() && !unlikely(s->flags & SLAB_DEBUG_FREE))
+        if (!memcg_kmem_enabled() &&
+            !unlikely(s->flags & SLAB_CONSISTENCY_CHECKS))
                return s;
        page = virt_to_head_page(x);
@@ -321,6 +326,64 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
        return s;
 }
+static inline size_t slab_ksize(const struct kmem_cache *s)
+{
+#ifndef CONFIG_SLUB
+        return s->object_size;
+#else /* CONFIG_SLUB */
+# ifdef CONFIG_SLUB_DEBUG
+        /*
+         * Debugging requires use of the padding between object
+         * and whatever may come after it.
+         */
+        if (s->flags & (SLAB_RED_ZONE | SLAB_POISON))
+                return s->object_size;
+# endif
+        /*
+         * If we have the need to store the freelist pointer
+         * back there or track user information then we can
+         * only use the space before that information.
+         */
+        if (s->flags & (SLAB_DESTROY_BY_RCU | SLAB_STORE_USER))
+                return s->inuse;
+        /*
+         * Else we can use all the padding etc for the allocation
+         */
+        return s->size;
+#endif
+}
+static inline struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s,
+                                                     gfp_t flags)
+{
+        flags &= gfp_allowed_mask;
+        lockdep_trace_alloc(flags);
+        might_sleep_if(gfpflags_allow_blocking(flags));
+        if (should_failslab(s, flags))
+                return NULL;
+        return memcg_kmem_get_cache(s, flags);
+}
+static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
+                                        size_t size, void **p)
+{
+        size_t i;
+        flags &= gfp_allowed_mask;
+        for (i = 0; i < size; i++) {
+                void *object = p[i];
+                kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
+                kmemleak_alloc_recursive(object, s->object_size, 1,
+                                         s->flags, flags);
+                kasan_slab_alloc(s, object);
+        }
+        memcg_kmem_put_cache(s);
+}
 #ifndef CONFIG_SLOB
 /*
 * The slab lists for all objects.
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 065b7bdabdc3..6afb2263a5c5 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -109,8 +109,12 @@ void __kmem_cache_free_bulk(struct kmem_cache *s, size_t nr, void **p)
 {
        size_t i;
-        for (i = 0; i < nr; i++)
+        for (i = 0; i < nr; i++) {
-                kmem_cache_free(s, p[i]);
+                if (s)
+                        kmem_cache_free(s, p[i]);
+                else
+                        kfree(p[i]);
+        }
 }
 int __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
diff --git a/mm/slub.c b/mm/slub.c
index d8fbd4a6ed59..6c91324f9370 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -124,6 +124,14 @@ static inline int kmem_cache_debug(struct kmem_cache *s)
 #endif
 }
+static inline void *fixup_red_left(struct kmem_cache *s, void *p)
+{
+        if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
+                p += s->red_left_pad;
+        return p;
+}
 static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s)
 {
 #ifdef CONFIG_SLUB_CPU_PARTIAL
@@ -160,10 +168,18 @@ static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s)
 */
 #define MAX_PARTIAL 10
-#define DEBUG_DEFAULT_FLAGS (SLAB_DEBUG_FREE | SLAB_RED_ZONE | \
+#define DEBUG_DEFAULT_FLAGS (SLAB_CONSISTENCY_CHECKS | SLAB_RED_ZONE | \
                                SLAB_POISON | SLAB_STORE_USER)
 /*
+ * These debug flags cannot use CMPXCHG because there might be consistency
+ * issues when checking or reading debug information
+ */
+#define SLAB_NO_CMPXCHG (SLAB_CONSISTENCY_CHECKS | SLAB_STORE_USER | \
+                                SLAB_TRACE)
+/*
 * Debugging flags that require metadata to be stored in the slab.  These get
 * disabled when slub_debug=O is used and a cache's min order increases with
 * metadata.
@@ -224,24 +240,6 @@ static inline void stat(const struct kmem_cache *s, enum stat_item si)
 *                      Core slab cache functions
 *******************************************************************/
-/* Verify that a pointer has an address that is valid within a slab page */
-static inline int check_valid_pointer(struct kmem_cache *s,
-                                struct page *page, const void *object)
-{
-        void *base;
-        if (!object)
-                return 1;
-        base = page_address(page);
-        if (object < base || object >= base + page->objects * s->size ||
-                (object - base) % s->size) {
-                return 0;
-        }
-        return 1;
-}
 static inline void *get_freepointer(struct kmem_cache *s, void *object)
 {
        return *(void **)(object + s->offset);
@@ -271,12 +269,14 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
 /* Loop over all objects in a slab */
 #define for_each_object(__p, __s, __addr, __objects) \
-        for (__p = (__addr); __p < (__addr) + (__objects) * (__s)->size;\
+        for (__p = fixup_red_left(__s, __addr); \
-                        __p += (__s)->size)
+                __p < (__addr) + (__objects) * (__s)->size; \
+                __p += (__s)->size)
 #define for_each_object_idx(__p, __idx, __s, __addr, __objects) \
-        for (__p = (__addr), __idx = 1; __idx <= __objects;\
+        for (__p = fixup_red_left(__s, __addr), __idx = 1; \
-                        __p += (__s)->size, __idx++)
+                __idx <= __objects; \
+                __p += (__s)->size, __idx++)
 /* Determine object index from a given position */
 static inline int slab_index(void *p, struct kmem_cache *s, void *addr)
@@ -284,30 +284,6 @@ static inline int slab_index(void *p, struct kmem_cache *s, void *addr)
        return (p - addr) / s->size;
 }
-static inline size_t slab_ksize(const struct kmem_cache *s)
-{
-#ifdef CONFIG_SLUB_DEBUG
-        /*
-         * Debugging requires use of the padding between object
-         * and whatever may come after it.
-         */
-        if (s->flags & (SLAB_RED_ZONE | SLAB_POISON))
-                return s->object_size;
-#endif
-        /*
-         * If we have the need to store the freelist pointer
-         * back there or track user information then we can
-         * only use the space before that information.
-         */
-        if (s->flags & (SLAB_DESTROY_BY_RCU | SLAB_STORE_USER))
-                return s->inuse;
-        /*
-         * Else we can use all the padding etc for the allocation
-         */
-        return s->size;
-}
 static inline int order_objects(int order, unsigned long size, int reserved)
 {
        return ((PAGE_SIZE << order) - reserved) / size;
@@ -458,6 +434,22 @@ static void get_map(struct kmem_cache *s, struct page *page, unsigned long *map)
                set_bit(slab_index(p, s, addr), map);
 }
+static inline int size_from_object(struct kmem_cache *s)
+{
+        if (s->flags & SLAB_RED_ZONE)
+                return s->size - s->red_left_pad;
+        return s->size;
+}
+static inline void *restore_red_left(struct kmem_cache *s, void *p)
+{
+        if (s->flags & SLAB_RED_ZONE)
+                p -= s->red_left_pad;
+        return p;
+}
 /*
 * Debug settings:
 */
@@ -491,6 +483,26 @@ static inline void metadata_access_disable(void)
 /*
 * Object debugging
 */
+/* Verify that a pointer has an address that is valid within a slab page */
+static inline int check_valid_pointer(struct kmem_cache *s,
+                                struct page *page, void *object)
+{
+        void *base;
+        if (!object)
+                return 1;
+        base = page_address(page);
+        object = restore_red_left(s, object);
+        if (object < base || object >= base + page->objects * s->size ||
+                (object - base) % s->size) {
+                return 0;
+        }
+        return 1;
+}
 static void print_section(char *text, u8 *addr, unsigned int length)
 {
        metadata_access_enable();
@@ -630,7 +642,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
        pr_err("INFO: Object 0x%p @offset=%tu fp=0x%p\n\n",
               p, p - addr, get_freepointer(s, p));
-        if (p > addr + 16)
+        if (s->flags & SLAB_RED_ZONE)
+                print_section("Redzone ", p - s->red_left_pad, s->red_left_pad);
+        else if (p > addr + 16)
                print_section("Bytes b4 ", p - 16, 16);
        print_section("Object ", p, min_t(unsigned long, s->object_size,
@@ -647,9 +661,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
        if (s->flags & SLAB_STORE_USER)
                off += 2 * sizeof(struct track);
-        if (off != s->size)
+        if (off != size_from_object(s))
                /* Beginning of the filler is the free pointer */
-                print_section("Padding ", p + off, s->size - off);
+                print_section("Padding ", p + off, size_from_object(s) - off);
        dump_stack();
 }
@@ -679,6 +693,9 @@ static void init_object(struct kmem_cache *s, void *object, u8 val)
 {
        u8 *p = object;
+        if (s->flags & SLAB_RED_ZONE)
+                memset(p - s->red_left_pad, val, s->red_left_pad);
        if (s->flags & __OBJECT_POISON) {
                memset(p, POISON_FREE, s->object_size - 1);
                p[s->object_size - 1] = POISON_END;
@@ -771,11 +788,11 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p)
                /* We also have user information there */
                off += 2 * sizeof(struct track);
-        if (s->size == off)
+        if (size_from_object(s) == off)
                return 1;
        return check_bytes_and_report(s, page, p, "Object padding",
-                                p + off, POISON_INUSE, s->size - off);
+                        p + off, POISON_INUSE, size_from_object(s) - off);
 }
 /* Check the pad bytes at the end of a slab page */
@@ -820,6 +837,10 @@ static int check_object(struct kmem_cache *s, struct page *page,
        if (s->flags & SLAB_RED_ZONE) {
                if (!check_bytes_and_report(s, page, object, "Redzone",
+                        object - s->red_left_pad, val, s->red_left_pad))
+                        return 0;
+                if (!check_bytes_and_report(s, page, object, "Redzone",
                        endobject, val, s->inuse - s->object_size))
                        return 0;
        } else {
@@ -1031,20 +1052,32 @@ static void setup_object_debug(struct kmem_cache *s, struct page *page,
        init_tracking(s, object);
 }
-static noinline int alloc_debug_processing(struct kmem_cache *s,
+static inline int alloc_consistency_checks(struct kmem_cache *s,
                                        struct page *page,
                                        void *object, unsigned long addr)
 {
        if (!check_slab(s, page))
-                goto bad;
+                return 0;
        if (!check_valid_pointer(s, page, object)) {
                object_err(s, page, object, "Freelist Pointer check fails");
-                goto bad;
+                return 0;
        }
        if (!check_object(s, page, object, SLUB_RED_INACTIVE))
-                goto bad;
+                return 0;
+        return 1;
+}
+static noinline int alloc_debug_processing(struct kmem_cache *s,
+                                        struct page *page,
+                                        void *object, unsigned long addr)
+{
+        if (s->flags & SLAB_CONSISTENCY_CHECKS) {
+                if (!alloc_consistency_checks(s, page, object, addr))
+                        goto bad;
+        }
        /* Success perform special debug activities for allocs */
        if (s->flags & SLAB_STORE_USER)
@@ -1067,37 +1100,21 @@ bad:
        return 0;
 }
-/* Supports checking bulk free of a constructed freelist */
+static inline int free_consistency_checks(struct kmem_cache *s,
-static noinline struct kmem_cache_node *free_debug_processing(
+                struct page *page, void *object, unsigned long addr)
-        struct kmem_cache *s, struct page *page,
-        void *head, void *tail, int bulk_cnt,
-        unsigned long addr, unsigned long *flags)
 {
-        struct kmem_cache_node *n = get_node(s, page_to_nid(page));
-        void *object = head;
-        int cnt = 0;
-        spin_lock_irqsave(&n->list_lock, *flags);
-        slab_lock(page);
-        if (!check_slab(s, page))
-                goto fail;
-next_object:
-        cnt++;
        if (!check_valid_pointer(s, page, object)) {
                slab_err(s, page, "Invalid object pointer 0x%p", object);
-                goto fail;
+                return 0;
        }
        if (on_freelist(s, page, object)) {
                object_err(s, page, object, "Object already free");
-                goto fail;
+                return 0;
        }
        if (!check_object(s, page, object, SLUB_RED_ACTIVE))
-                goto out;
+                return 0;
        if (unlikely(s != page->slab_cache)) {
                if (!PageSlab(page)) {
@@ -1110,7 +1127,37 @@ next_object:
                } else
                        object_err(s, page, object,
                                        "page slab pointer corrupt.");
-                goto fail;
+                return 0;
+        }
+        return 1;
+}
+/* Supports checking bulk free of a constructed freelist */
+static noinline int free_debug_processing(
+        struct kmem_cache *s, struct page *page,
+        void *head, void *tail, int bulk_cnt,
+        unsigned long addr)
+{
+        struct kmem_cache_node *n = get_node(s, page_to_nid(page));
+        void *object = head;
+        int cnt = 0;
+        unsigned long uninitialized_var(flags);
+        int ret = 0;
+        spin_lock_irqsave(&n->list_lock, flags);
+        slab_lock(page);
+        if (s->flags & SLAB_CONSISTENCY_CHECKS) {
+                if (!check_slab(s, page))
+                        goto out;
+        }
+next_object:
+        cnt++;
+        if (s->flags & SLAB_CONSISTENCY_CHECKS) {
+                if (!free_consistency_checks(s, page, object, addr))
+                        goto out;
        }
        if (s->flags & SLAB_STORE_USER)
@@ -1124,23 +1171,18 @@ next_object:
                object = get_freepointer(s, object);
                goto next_object;
        }
+        ret = 1;
 out:
        if (cnt != bulk_cnt)
                slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n",
                         bulk_cnt, cnt);
        slab_unlock(page);
-        /*
+        spin_unlock_irqrestore(&n->list_lock, flags);
-         * Keep node_lock to preserve integrity
+        if (!ret)
-         * until the object is actually freed
+                slab_fix(s, "Object at 0x%p not freed", object);
-         */
+        return ret;
-        return n;
-fail:
-        slab_unlock(page);
-        spin_unlock_irqrestore(&n->list_lock, *flags);
-        slab_fix(s, "Object at 0x%p not freed", object);
-        return NULL;
 }
 static int __init setup_slub_debug(char *str)
@@ -1172,7 +1214,7 @@ static int __init setup_slub_debug(char *str)
        for (; *str && *str != ','; str++) {
                switch (tolower(*str)) {
                case 'f':
-                        slub_debug |= SLAB_DEBUG_FREE;
+                        slub_debug |= SLAB_CONSISTENCY_CHECKS;
                        break;
                case 'z':
                        slub_debug |= SLAB_RED_ZONE;
@@ -1231,10 +1273,10 @@ static inline void setup_object_debug(struct kmem_cache *s,
 static inline int alloc_debug_processing(struct kmem_cache *s,
        struct page *page, void *object, unsigned long addr) { return 0; }
-static inline struct kmem_cache_node *free_debug_processing(
+static inline int free_debug_processing(
        struct kmem_cache *s, struct page *page,
        void *head, void *tail, int bulk_cnt,
-        unsigned long addr, unsigned long *flags) { return NULL; }
+        unsigned long addr) { return 0; }
 static inline int slab_pad_check(struct kmem_cache *s, struct page *page)
                        { return 1; }
@@ -1281,36 +1323,6 @@ static inline void kfree_hook(const void *x)
        kasan_kfree_large(x);
 }
-static inline struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s,
-                                                     gfp_t flags)
-{
-        flags &= gfp_allowed_mask;
-        lockdep_trace_alloc(flags);
-        might_sleep_if(gfpflags_allow_blocking(flags));
-        if (should_failslab(s->object_size, flags, s->flags))
-                return NULL;
-        return memcg_kmem_get_cache(s, flags);
-}
-static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
-                                        size_t size, void **p)
-{
-        size_t i;
-        flags &= gfp_allowed_mask;
-        for (i = 0; i < size; i++) {
-                void *object = p[i];
-                kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
-                kmemleak_alloc_recursive(object, s->object_size, 1,
-                                         s->flags, flags);
-                kasan_slab_alloc(s, object);
-        }
-        memcg_kmem_put_cache(s);
-}
 static inline void slab_free_hook(struct kmem_cache *s, void *x)
 {
        kmemleak_free_recursive(x, s->flags);
@@ -1470,7 +1482,7 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
                        set_freepointer(s, p, NULL);
        }
-        page->freelist = start;
+        page->freelist = fixup_red_left(s, start);
        page->inuse = page->objects;
        page->frozen = 1;
@@ -1506,7 +1518,7 @@ static void __free_slab(struct kmem_cache *s, struct page *page)
        int order = compound_order(page);
        int pages = 1 << order;
-        if (kmem_cache_debug(s)) {
+        if (s->flags & SLAB_CONSISTENCY_CHECKS) {
                void *p;
                slab_pad_check(s, page);
@@ -2224,8 +2236,8 @@ slab_out_of_memory(struct kmem_cache *s, gfp_t gfpflags, int nid)
        if ((gfpflags & __GFP_NOWARN) || !__ratelimit(&slub_oom_rs))
                return;
-        pr_warn("SLUB: Unable to allocate memory on node %d (gfp=0x%x)\n",
+        pr_warn("SLUB: Unable to allocate memory on node %d, gfp=%#x(%pGg)\n",
-                nid, gfpflags);
+                nid, gfpflags, &gfpflags);
        pr_warn("  cache: %s, object size: %d, buffer size: %d, default order: %d, min order: %d\n",
                s->name, s->object_size, s->size, oo_order(s->oo),
                oo_order(s->min));
@@ -2642,8 +2654,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
        stat(s, FREE_SLOWPATH);
        if (kmem_cache_debug(s) &&
-            !(n = free_debug_processing(s, page, head, tail, cnt,
+            !free_debug_processing(s, page, head, tail, cnt, addr))
-                                        addr, &flags)))
                return;
        do {
@@ -2815,6 +2826,7 @@ struct detached_freelist {
        void *tail;
        void *freelist;
        int cnt;
+        struct kmem_cache *s;
 };
 /*
@@ -2829,26 +2841,45 @@ struct detached_freelist {
 * synchronization primitive.  Look ahead in the array is limited due
 * to performance reasons.
 */
-static int build_detached_freelist(struct kmem_cache *s, size_t size,
+static inline
-                                   void **p, struct detached_freelist *df)
+int build_detached_freelist(struct kmem_cache *s, size_t size,
+                            void **p, struct detached_freelist *df)
 {
        size_t first_skipped_index = 0;
        int lookahead = 3;
        void *object;
+        struct page *page;
        /* Always re-init detached_freelist */
        df->page = NULL;
        do {
                object = p[--size];
+                /* Do we need !ZERO_OR_NULL_PTR(object) here? (for kfree) */
        } while (!object && size);
        if (!object)
                return 0;
+        page = virt_to_head_page(object);
+        if (!s) {
+                /* Handle kalloc'ed objects */
+                if (unlikely(!PageSlab(page))) {
+                        BUG_ON(!PageCompound(page));
+                        kfree_hook(object);
+                        __free_kmem_pages(page, compound_order(page));
+                        p[size] = NULL; /* mark object processed */
+                        return size;
+                }
+                /* Derive kmem_cache from object */
+                df->s = page->slab_cache;
+        } else {
+                df->s = cache_from_obj(s, object); /* Support for memcg */
+        }
        /* Start new detached freelist */
-        set_freepointer(s, object, NULL);
+        df->page = page;
-        df->page = virt_to_head_page(object);
+        set_freepointer(df->s, object, NULL);
        df->tail = object;
        df->freelist = object;
        p[size] = NULL; /* mark object processed */
@@ -2862,7 +2893,7 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size,
                /* df->page is always set at this point */
                if (df->page == virt_to_head_page(object)) {
                        /* Opportunity build freelist */
-                        set_freepointer(s, object, df->freelist);
+                        set_freepointer(df->s, object, df->freelist);
                        df->freelist = object;
                        df->cnt++;
                        p[size] = NULL; /* mark object processed */
@@ -2881,25 +2912,20 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size,
        return first_skipped_index;
 }
 /* Note that interrupts must be enabled when calling this function. */
-void kmem_cache_free_bulk(struct kmem_cache *orig_s, size_t size, void **p)
+void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
 {
        if (WARN_ON(!size))
                return;
        do {
                struct detached_freelist df;
-                struct kmem_cache *s;
-                /* Support for memcg */
-                s = cache_from_obj(orig_s, p[size - 1]);
                size = build_detached_freelist(s, size, p, &df);
                if (unlikely(!df.page))
                        continue;
-                slab_free(s, df.page, df.freelist, df.tail, df.cnt, _RET_IP_);
+                slab_free(df.s, df.page, df.freelist, df.tail, df.cnt,_RET_IP_);
        } while (likely(size));
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
@@ -3285,7 +3311,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
                 */
                size += 2 * sizeof(struct track);
-        if (flags & SLAB_RED_ZONE)
+        if (flags & SLAB_RED_ZONE) {
                /*
                 * Add some empty padding so that we can catch
                 * overwrites from earlier objects rather than let
@@ -3294,6 +3320,11 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
                 * of the object.
                 */
                size += sizeof(void *);
+                s->red_left_pad = sizeof(void *);
+                s->red_left_pad = ALIGN(s->red_left_pad, s->align);
+                size += s->red_left_pad;
+        }
 #endif
        /*
@@ -3357,7 +3388,7 @@ static int kmem_cache_open(struct kmem_cache *s, unsigned long flags)
 #if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \
    defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)
-        if (system_has_cmpxchg_double() && (s->flags & SLAB_DEBUG_FLAGS) == 0)
+        if (system_has_cmpxchg_double() && (s->flags & SLAB_NO_CMPXCHG) == 0)
                /* Enable fast mode */
                s->flags |= __CMPXCHG_DOUBLE;
 #endif
@@ -4812,16 +4843,16 @@ SLAB_ATTR_RO(total_objects);
 static ssize_t sanity_checks_show(struct kmem_cache *s, char *buf)
 {
-        return sprintf(buf, "%d\n", !!(s->flags & SLAB_DEBUG_FREE));
+        return sprintf(buf, "%d\n", !!(s->flags & SLAB_CONSISTENCY_CHECKS));
 }
 static ssize_t sanity_checks_store(struct kmem_cache *s,
                                const char *buf, size_t length)
 {
-        s->flags &= ~SLAB_DEBUG_FREE;
+        s->flags &= ~SLAB_CONSISTENCY_CHECKS;
        if (buf[0] == '1') {
                s->flags &= ~__CMPXCHG_DOUBLE;
-                s->flags |= SLAB_DEBUG_FREE;
+                s->flags |= SLAB_CONSISTENCY_CHECKS;
        }
        return length;
 }
@@ -4865,7 +4896,6 @@ static ssize_t red_zone_store(struct kmem_cache *s,
        s->flags &= ~SLAB_RED_ZONE;
        if (buf[0] == '1') {
-                s->flags &= ~__CMPXCHG_DOUBLE;
                s->flags |= SLAB_RED_ZONE;
        }
        calculate_sizes(s, -1);
@@ -4886,7 +4916,6 @@ static ssize_t poison_store(struct kmem_cache *s,
        s->flags &= ~SLAB_POISON;
        if (buf[0] == '1') {
-                s->flags &= ~__CMPXCHG_DOUBLE;
                s->flags |= SLAB_POISON;
        }
        calculate_sizes(s, -1);
@@ -5356,7 +5385,7 @@ static char *create_unique_id(struct kmem_cache *s)
                *p++ = 'd';
        if (s->flags & SLAB_RECLAIM_ACCOUNT)
                *p++ = 'a';
-        if (s->flags & SLAB_DEBUG_FREE)
+        if (s->flags & SLAB_CONSISTENCY_CHECKS)
                *p++ = 'F';
        if (!(s->flags & SLAB_NOTRACK))
                *p++ = 't';
diff --git a/mm/truncate.c b/mm/truncate.c
index e3ee0e27cd17..7598b552ae03 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -519,7 +519,6 @@ EXPORT_SYMBOL(invalidate_mapping_pages);
 static int
 invalidate_complete_page2(struct address_space *mapping, struct page *page)
 {
-        struct mem_cgroup *memcg;
        unsigned long flags;
        if (page->mapping != mapping)
@@ -528,15 +527,13 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
        if (page_has_private(page) && !try_to_release_page(page, GFP_KERNEL))
                return 0;
-        memcg = mem_cgroup_begin_page_stat(page);
        spin_lock_irqsave(&mapping->tree_lock, flags);
        if (PageDirty(page))
                goto failed;
        BUG_ON(page_has_private(page));
-        __delete_from_page_cache(page, NULL, memcg);
+        __delete_from_page_cache(page, NULL);
        spin_unlock_irqrestore(&mapping->tree_lock, flags);
-        mem_cgroup_end_page_stat(memcg);
        if (mapping->a_ops->freepage)
                mapping->a_ops->freepage(page);
@@ -545,7 +542,6 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
        return 1;
 failed:
        spin_unlock_irqrestore(&mapping->tree_lock, flags);
-        mem_cgroup_end_page_stat(memcg);
        return 0;
 }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 71b1c29948db..dd984470248f 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -195,25 +195,25 @@ static unsigned long zone_reclaimable_pages(struct zone *zone)
 {
        unsigned long nr;
-        nr = zone_page_state(zone, NR_ACTIVE_FILE) +
+        nr = zone_page_state_snapshot(zone, NR_ACTIVE_FILE) +
-             zone_page_state(zone, NR_INACTIVE_FILE) +
+             zone_page_state_snapshot(zone, NR_INACTIVE_FILE) +
-             zone_page_state(zone, NR_ISOLATED_FILE);
+             zone_page_state_snapshot(zone, NR_ISOLATED_FILE);
        if (get_nr_swap_pages() > 0)
-                nr += zone_page_state(zone, NR_ACTIVE_ANON) +
+                nr += zone_page_state_snapshot(zone, NR_ACTIVE_ANON) +
-                      zone_page_state(zone, NR_INACTIVE_ANON) +
+                      zone_page_state_snapshot(zone, NR_INACTIVE_ANON) +
-                      zone_page_state(zone, NR_ISOLATED_ANON);
+                      zone_page_state_snapshot(zone, NR_ISOLATED_ANON);
        return nr;
 }
 bool zone_reclaimable(struct zone *zone)
 {
-        return zone_page_state(zone, NR_PAGES_SCANNED) <
+        return zone_page_state_snapshot(zone, NR_PAGES_SCANNED) <
                zone_reclaimable_pages(zone) * 6;
 }
-static unsigned long get_lru_size(struct lruvec *lruvec, enum lru_list lru)
+unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru)
 {
        if (!mem_cgroup_disabled())
                return mem_cgroup_get_lru_size(lruvec, lru);
@@ -228,14 +228,6 @@ int register_shrinker(struct shrinker *shrinker)
 {
        size_t size = sizeof(*shrinker->nr_deferred);
-        /*
-         * If we only have one possible node in the system anyway, save
-         * ourselves the trouble and disable NUMA aware behavior. This way we
-         * will save memory and some small loop time later.
-         */
-        if (nr_node_ids == 1)
-                shrinker->flags &= ~SHRINKER_NUMA_AWARE;
        if (shrinker->flags & SHRINKER_NUMA_AWARE)
                size *= nr_node_ids;
@@ -611,12 +603,10 @@ static int __remove_mapping(struct address_space *mapping, struct page *page,
                            bool reclaimed)
 {
        unsigned long flags;
-        struct mem_cgroup *memcg;
        BUG_ON(!PageLocked(page));
        BUG_ON(mapping != page_mapping(page));
-        memcg = mem_cgroup_begin_page_stat(page);
        spin_lock_irqsave(&mapping->tree_lock, flags);
        /*
         * The non racy check for a busy page.
@@ -656,7 +646,6 @@ static int __remove_mapping(struct address_space *mapping, struct page *page,
                mem_cgroup_swapout(page, swap);
                __delete_from_swap_cache(page);
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
-                mem_cgroup_end_page_stat(memcg);
                swapcache_free(swap);
        } else {
                void (*freepage)(struct page *);
@@ -682,9 +671,8 @@ static int __remove_mapping(struct address_space *mapping, struct page *page,
                if (reclaimed && page_is_file_cache(page) &&
                    !mapping_exiting(mapping) && !dax_mapping(mapping))
                        shadow = workingset_eviction(mapping, page);
-                __delete_from_page_cache(page, shadow, memcg);
+                __delete_from_page_cache(page, shadow);
                spin_unlock_irqrestore(&mapping->tree_lock, flags);
-                mem_cgroup_end_page_stat(memcg);
                if (freepage != NULL)
                        freepage(page);
@@ -694,7 +682,6 @@ static int __remove_mapping(struct address_space *mapping, struct page *page,
 cannot_free:
        spin_unlock_irqrestore(&mapping->tree_lock, flags);
-        mem_cgroup_end_page_stat(memcg);
        return 0;
 }
@@ -1931,8 +1918,8 @@ static bool inactive_file_is_low(struct lruvec *lruvec)
        unsigned long inactive;
        unsigned long active;
-        inactive = get_lru_size(lruvec, LRU_INACTIVE_FILE);
+        inactive = lruvec_lru_size(lruvec, LRU_INACTIVE_FILE);
-        active = get_lru_size(lruvec, LRU_ACTIVE_FILE);
+        active = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE);
        return active > inactive;
 }
@@ -2071,7 +2058,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
         * system is under heavy pressure.
         */
        if (!inactive_file_is_low(lruvec) &&
-            get_lru_size(lruvec, LRU_INACTIVE_FILE) >> sc->priority) {
+            lruvec_lru_size(lruvec, LRU_INACTIVE_FILE) >> sc->priority) {
                scan_balance = SCAN_FILE;
                goto out;
        }
@@ -2097,10 +2084,10 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
         * anon in [0], file in [1]
         */
-        anon  = get_lru_size(lruvec, LRU_ACTIVE_ANON) +
+        anon  = lruvec_lru_size(lruvec, LRU_ACTIVE_ANON) +
-                get_lru_size(lruvec, LRU_INACTIVE_ANON);
+                lruvec_lru_size(lruvec, LRU_INACTIVE_ANON);
-        file  = get_lru_size(lruvec, LRU_ACTIVE_FILE) +
+        file  = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE) +
-                get_lru_size(lruvec, LRU_INACTIVE_FILE);
+                lruvec_lru_size(lruvec, LRU_INACTIVE_FILE);
        spin_lock_irq(&zone->lru_lock);
        if (unlikely(reclaim_stat->recent_scanned[0] > anon / 4)) {
@@ -2138,7 +2125,7 @@ out:
                        unsigned long size;
                        unsigned long scan;
-                        size = get_lru_size(lruvec, lru);
+                        size = lruvec_lru_size(lruvec, lru);
                        scan = size >> sc->priority;
                        if (!scan && pass && force_scan)
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 084c6725b373..69ce64f7b8d7 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -924,19 +924,6 @@ static void walk_zones_in_node(struct seq_file *m, pg_data_t *pgdat,
 #endif
 #ifdef CONFIG_PROC_FS
-static char * const migratetype_names[MIGRATE_TYPES] = {
-        "Unmovable",
-        "Movable",
-        "Reclaimable",
-        "HighAtomic",
-#ifdef CONFIG_CMA
-        "CMA",
-#endif
-#ifdef CONFIG_MEMORY_ISOLATION
-        "Isolate",
-#endif
-};
 static void frag_show_print(struct seq_file *m, pg_data_t *pgdat,
                                                struct zone *zone)
 {
@@ -1133,7 +1120,7 @@ static void pagetypeinfo_showmixedcount(struct seq_file *m, pg_data_t *pgdat)
 #ifdef CONFIG_PAGE_OWNER
        int mtype;
-        if (!page_owner_inited)
+        if (!static_branch_unlikely(&page_owner_inited))
                return;
        drain_all_pages(NULL);
diff --git a/mm/workingset.c b/mm/workingset.c
index 61ead9e5549d..6130ba0b2641 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -152,8 +152,25 @@
 * refault distance will immediately activate the refaulting page.
 */
-static void *pack_shadow(unsigned long eviction, struct zone *zone)
+#define EVICTION_SHIFT  (RADIX_TREE_EXCEPTIONAL_ENTRY + \
+                         ZONES_SHIFT + NODES_SHIFT +    \
+                         MEM_CGROUP_ID_SHIFT)
+#define EVICTION_MASK   (~0UL >> EVICTION_SHIFT)
+/*
+ * Eviction timestamps need to be able to cover the full range of
+ * actionable refaults. However, bits are tight in the radix tree
+ * entry, and after storing the identifier for the lruvec there might
+ * not be enough left to represent every single actionable refault. In
+ * that case, we have to sacrifice granularity for distance, and group
+ * evictions into coarser buckets by shaving off lower timestamp bits.
+ */
+static unsigned int bucket_order __read_mostly;
+static void *pack_shadow(int memcgid, struct zone *zone, unsigned long eviction)
 {
+        eviction >>= bucket_order;
+        eviction = (eviction << MEM_CGROUP_ID_SHIFT) | memcgid;
        eviction = (eviction << NODES_SHIFT) | zone_to_nid(zone);
        eviction = (eviction << ZONES_SHIFT) | zone_idx(zone);
        eviction = (eviction << RADIX_TREE_EXCEPTIONAL_SHIFT);
@@ -161,45 +178,23 @@ static void *pack_shadow(unsigned long eviction, struct zone *zone)
        return (void *)(eviction | RADIX_TREE_EXCEPTIONAL_ENTRY);
 }
-static void unpack_shadow(void *shadow,
+static void unpack_shadow(void *shadow, int *memcgidp, struct zone **zonep,
-                          struct zone **zone,
+                          unsigned long *evictionp)
-                          unsigned long *distance)
 {
        unsigned long entry = (unsigned long)shadow;
-        unsigned long eviction;
+        int memcgid, nid, zid;
-        unsigned long refault;
-        unsigned long mask;
-        int zid, nid;
        entry >>= RADIX_TREE_EXCEPTIONAL_SHIFT;
        zid = entry & ((1UL << ZONES_SHIFT) - 1);
        entry >>= ZONES_SHIFT;
        nid = entry & ((1UL << NODES_SHIFT) - 1);
        entry >>= NODES_SHIFT;
-        eviction = entry;
+        memcgid = entry & ((1UL << MEM_CGROUP_ID_SHIFT) - 1);
+        entry >>= MEM_CGROUP_ID_SHIFT;
-        *zone = NODE_DATA(nid)->node_zones + zid;
+        *memcgidp = memcgid;
+        *zonep = NODE_DATA(nid)->node_zones + zid;
-        refault = atomic_long_read(&(*zone)->inactive_age);
+        *evictionp = entry << bucket_order;
-        mask = ~0UL >> (NODES_SHIFT + ZONES_SHIFT +
-                        RADIX_TREE_EXCEPTIONAL_SHIFT);
-        /*
-         * The unsigned subtraction here gives an accurate distance
-         * across inactive_age overflows in most cases.
-         *
-         * There is a special case: usually, shadow entries have a
-         * short lifetime and are either refaulted or reclaimed along
-         * with the inode before they get too old.  But it is not
-         * impossible for the inactive_age to lap a shadow entry in
-         * the field, which can then can result in a false small
-         * refault distance, leading to a false activation should this
-         * old entry actually refault again.  However, earlier kernels
-         * used to deactivate unconditionally with *every* reclaim
-         * invocation for the longest time, so the occasional
-         * inappropriate activation leading to pressure on the active
-         * list is not a problem.
-         */
-        *distance = (refault - eviction) & mask;
 }
 /**
@@ -212,11 +207,20 @@ static void unpack_shadow(void *shadow,
 */
 void *workingset_eviction(struct address_space *mapping, struct page *page)
 {
+        struct mem_cgroup *memcg = page_memcg(page);
        struct zone *zone = page_zone(page);
+        int memcgid = mem_cgroup_id(memcg);
        unsigned long eviction;
+        struct lruvec *lruvec;
-        eviction = atomic_long_inc_return(&zone->inactive_age);
+        /* Page is fully exclusive and pins page->mem_cgroup */
-        return pack_shadow(eviction, zone);
+        VM_BUG_ON_PAGE(PageLRU(page), page);
+        VM_BUG_ON_PAGE(page_count(page), page);
+        VM_BUG_ON_PAGE(!PageLocked(page), page);
+        lruvec = mem_cgroup_zone_lruvec(zone, memcg);
+        eviction = atomic_long_inc_return(&lruvec->inactive_age);
+        return pack_shadow(memcgid, zone, eviction);
 }
 /**
@@ -231,12 +235,64 @@ void *workingset_eviction(struct address_space *mapping, struct page *page)
 bool workingset_refault(void *shadow)
 {
        unsigned long refault_distance;
+        unsigned long active_file;
+        struct mem_cgroup *memcg;
+        unsigned long eviction;
+        struct lruvec *lruvec;
+        unsigned long refault;
        struct zone *zone;
+        int memcgid;
+        unpack_shadow(shadow, &memcgid, &zone, &eviction);
+        rcu_read_lock();
+        /*
+         * Look up the memcg associated with the stored ID. It might
+         * have been deleted since the page's eviction.
+         *
+         * Note that in rare events the ID could have been recycled
+         * for a new cgroup that refaults a shared page. This is
+         * impossible to tell from the available data. However, this
+         * should be a rare and limited disturbance, and activations
+         * are always speculative anyway. Ultimately, it's the aging
+         * algorithm's job to shake out the minimum access frequency
+         * for the active cache.
+         *
+         * XXX: On !CONFIG_MEMCG, this will always return NULL; it
+         * would be better if the root_mem_cgroup existed in all
+         * configurations instead.
+         */
+        memcg = mem_cgroup_from_id(memcgid);
+        if (!mem_cgroup_disabled() && !memcg) {
+                rcu_read_unlock();
+                return false;
+        }
+        lruvec = mem_cgroup_zone_lruvec(zone, memcg);
+        refault = atomic_long_read(&lruvec->inactive_age);
+        active_file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE);
+        rcu_read_unlock();
+        /*
+         * The unsigned subtraction here gives an accurate distance
+         * across inactive_age overflows in most cases.
+         *
+         * There is a special case: usually, shadow entries have a
+         * short lifetime and are either refaulted or reclaimed along
+         * with the inode before they get too old.  But it is not
+         * impossible for the inactive_age to lap a shadow entry in
+         * the field, which can then can result in a false small
+         * refault distance, leading to a false activation should this
+         * old entry actually refault again.  However, earlier kernels
+         * used to deactivate unconditionally with *every* reclaim
+         * invocation for the longest time, so the occasional
+         * inappropriate activation leading to pressure on the active
+         * list is not a problem.
+         */
+        refault_distance = (refault - eviction) & EVICTION_MASK;
-        unpack_shadow(shadow, &zone, &refault_distance);
        inc_zone_state(zone, WORKINGSET_REFAULT);
-        if (refault_distance <= zone_page_state(zone, NR_ACTIVE_FILE)) {
+        if (refault_distance <= active_file) {
                inc_zone_state(zone, WORKINGSET_ACTIVATE);
                return true;
        }
@@ -249,7 +305,22 @@ bool workingset_refault(void *shadow)
 */
 void workingset_activation(struct page *page)
 {
-        atomic_long_inc(&page_zone(page)->inactive_age);
+        struct lruvec *lruvec;
+        lock_page_memcg(page);
+        /*
+         * Filter non-memcg pages here, e.g. unmap can call
+         * mark_page_accessed() on VDSO pages.
+         *
+         * XXX: See workingset_refault() - this should return
+         * root_mem_cgroup even for !CONFIG_MEMCG.
+         */
+        if (!mem_cgroup_disabled() && !page_memcg(page))
+                goto out;
+        lruvec = mem_cgroup_zone_lruvec(page_zone(page), page_memcg(page));
+        atomic_long_inc(&lruvec->inactive_age);
+out:
+        unlock_page_memcg(page);
 }
 /*
@@ -398,8 +469,25 @@ static struct lock_class_key shadow_nodes_key;
 static int __init workingset_init(void)
 {
+        unsigned int timestamp_bits;
+        unsigned int max_order;
        int ret;
+        BUILD_BUG_ON(BITS_PER_LONG < EVICTION_SHIFT);
+        /*
+         * Calculate the eviction bucket size to cover the longest
+         * actionable refault distance, which is currently half of
+         * memory (totalram_pages/2). However, memory hotplug may add
+         * some more pages at runtime, so keep working with up to
+         * double the initial memory by using totalram_pages as-is.
+         */
+        timestamp_bits = BITS_PER_LONG - EVICTION_SHIFT;
+        max_order = fls_long(totalram_pages - 1);
+        if (max_order > timestamp_bits)
+                bucket_order = max_order - timestamp_bits;
+        printk("workingset: timestamp_bits=%d max_order=%d bucket_order=%u\n",
+               timestamp_bits, max_order, bucket_order);
        ret = list_lru_init_key(&workingset_shadow_nodes, &shadow_nodes_key);
        if (ret)
                goto err;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 643a86c49020..2d5589b61e9f 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -50,8 +50,7 @@ static u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS] __read_mostly;
 #define TSBITS  6
 #define TSMASK  (((__u32)1 << TSBITS) - 1)
-static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
+static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS], ipv4_cookie_scratch);
-                      ipv4_cookie_scratch);
 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
                       u32 count, int c)
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 2906ef20795e..aae3e5ca63ea 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -41,8 +41,7 @@ static __u16 const msstab[] = {
        9000 - 60,
 };
-static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
+static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS], ipv6_cookie_scratch);
-                      ipv6_cookie_scratch);
 static u32 cookie_hash(const struct in6_addr *saddr, const struct in6_addr *daddr,
                       __be16 sport, __be16 dport, u32 count, int c)
diff --git a/net/rds/page.c b/net/rds/page.c
index 5a14e6d6a926..616f21f4e7d7 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -42,8 +42,8 @@ struct rds_page_remainder {
        unsigned long   r_offset;
 };
-static DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_page_remainder,
+static
-                                     rds_page_remainders);
+DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_page_remainder, rds_page_remainders);
 /*
 * returns 0 on success or -errno on failure.
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 874132b26d23..d574d13ba963 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3240,6 +3240,30 @@ sub process {
 #ignore lines not being added
                next if ($line =~ /^[^\+]/);
+# check for declarations of signed or unsigned without int
+                while ($line =~ m{($Declare)\s*(?!char\b|short\b|int\b|long\b)\s*($Ident)?\s*[=,;\[\)\(]}g) {
+                        my $type = $1;
+                        my $var = $2;
+                        $var = "" if (!defined $var);
+                        if ($type =~ /^(?:(?:$Storage|$Inline|$Attribute)\s+)*((?:un)?signed)((?:\s*\*)*)\s*$/) {
+                                my $sign = $1;
+                                my $pointer = $2;
+                                $pointer = "" if (!defined $pointer);
+                                if (WARN("UNSPECIFIED_INT",
+                                         "Prefer '" . trim($sign) . " int" . rtrim($pointer) . "' to bare use of '$sign" . rtrim($pointer) . "'\n" . $herecurr) &&
+                                    $fix) {
+                                        my $decl = trim($sign) . " int ";
+                                        my $comp_pointer = $pointer;
+                                        $comp_pointer =~ s/\s//g;
+                                        $decl .= $comp_pointer;
+                                        $decl = rtrim($decl) if ($var eq "");
+                                        $fixed[$fixlinenr] =~ s@\b$sign\s*\Q$pointer\E\s*$var\b@$decl$var@;
+                                }
+                        }
+                }
 # TEST: allow direct testing of the type matcher.
                if ($dbg_type) {
                        if ($line =~ /^.\s*$Declare\s*$/) {
@@ -4109,7 +4133,7 @@ sub process {
 ##              }
 #need space before brace following if, while, etc
-                if (($line =~ /\(.*\)\{/ && $line !~ /\($Type\){/) ||
+                if (($line =~ /\(.*\)\{/ && $line !~ /\($Type\)\{/) ||
                    $line =~ /do\{/) {
                        if (ERROR("SPACING",
                                  "space required before the open brace '{'\n" . $herecurr) &&
@@ -4561,6 +4585,9 @@ sub process {
                        {
                        }
+                        # Make asm volatile uses seem like a generic function
+                        $dstat =~ s/\b_*asm_*\s+_*volatile_*\b/asm_volatile/g;
                        my $exceptions = qr{
                                $Declare|
                                module_param_named|
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 8fa81e84e295..638b143ee60f 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -22,6 +22,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
+#include <limits.h>
 #ifndef ARRAY_SIZE
 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof(arr[0]))
@@ -34,6 +35,7 @@ struct sym_entry {
        unsigned int len;
        unsigned int start_pos;
        unsigned char *sym;
+        unsigned int percpu_absolute;
 };
 struct addr_range {
@@ -42,6 +44,7 @@ struct addr_range {
 };
 static unsigned long long _text;
+static unsigned long long relative_base;
 static struct addr_range text_ranges[] = {
        { "_stext",     "_etext"     },
        { "_sinittext", "_einittext" },
@@ -61,6 +64,7 @@ static int all_symbols = 0;
 static int absolute_percpu = 0;
 static char symbol_prefix_char = '\0';
 static unsigned long long kernel_start_addr = 0;
+static int base_relative = 0;
 int token_profit[0x10000];
@@ -74,7 +78,7 @@ static void usage(void)
        fprintf(stderr, "Usage: kallsyms [--all-symbols] "
                        "[--symbol-prefix=<prefix char>] "
                        "[--page-offset=<CONFIG_PAGE_OFFSET>] "
-                        "< in.map > out.S\n");
+                        "[--base-relative] < in.map > out.S\n");
        exit(1);
 }
@@ -171,6 +175,8 @@ static int read_symbol(FILE *in, struct sym_entry *s)
        strcpy((char *)s->sym + 1, str);
        s->sym[0] = stype;
+        s->percpu_absolute = 0;
        /* Record if we've found __per_cpu_start/end. */
        check_symbol_range(sym, s->addr, &percpu_range, 1);
@@ -202,6 +208,8 @@ static int symbol_valid(struct sym_entry *s)
         */
        static char *special_symbols[] = {
                "kallsyms_addresses",
+                "kallsyms_offsets",
+                "kallsyms_relative_base",
                "kallsyms_num_syms",
                "kallsyms_names",
                "kallsyms_markers",
@@ -325,7 +333,7 @@ static int expand_symbol(unsigned char *data, int len, char *result)
 static int symbol_absolute(struct sym_entry *s)
 {
-        return toupper(s->sym[0]) == 'A';
+        return s->percpu_absolute;
 }
 static void write_src(void)
@@ -346,16 +354,48 @@ static void write_src(void)
        printf("\t.section .rodata, \"a\"\n");
-        /* Provide proper symbols relocatability by their '_text'
+        /* Provide proper symbols relocatability by their relativeness
-         * relativeness.  The symbol names cannot be used to construct
+         * to a fixed anchor point in the runtime image, either '_text'
-         * normal symbol references as the list of symbols contains
+         * for absolute address tables, in which case the linker will
-         * symbols that are declared static and are private to their
+         * emit the final addresses at build time. Otherwise, use the
-         * .o files.  This prevents .tmp_kallsyms.o or any other
+         * offset relative to the lowest value encountered of all relative
-         * object from referencing them.
+         * symbols, and emit non-relocatable fixed offsets that will be fixed
+         * up at runtime.
+         *
+         * The symbol names cannot be used to construct normal symbol
+         * references as the list of symbols contains symbols that are
+         * declared static and are private to their .o files.  This prevents
+         * .tmp_kallsyms.o or any other object from referencing them.
         */
-        output_label("kallsyms_addresses");
+        if (!base_relative)
+                output_label("kallsyms_addresses");
+        else
+                output_label("kallsyms_offsets");
        for (i = 0; i < table_cnt; i++) {
-                if (!symbol_absolute(&table[i])) {
+                if (base_relative) {
+                        long long offset;
+                        int overflow;
+                        if (!absolute_percpu) {
+                                offset = table[i].addr - relative_base;
+                                overflow = (offset < 0 || offset > UINT_MAX);
+                        } else if (symbol_absolute(&table[i])) {
+                                offset = table[i].addr;
+                                overflow = (offset < 0 || offset > INT_MAX);
+                        } else {
+                                offset = relative_base - table[i].addr - 1;
+                                overflow = (offset < INT_MIN || offset >= 0);
+                        }
+                        if (overflow) {
+                                fprintf(stderr, "kallsyms failure: "
+                                        "%s symbol value %#llx out of range in relative mode\n",
+                                        symbol_absolute(&table[i]) ? "absolute" : "relative",
+                                        table[i].addr);
+                                exit(EXIT_FAILURE);
+                        }
+                        printf("\t.long\t%#x\n", (int)offset);
+                } else if (!symbol_absolute(&table[i])) {
                        if (_text <= table[i].addr)
                                printf("\tPTR\t_text + %#llx\n",
                                        table[i].addr - _text);
@@ -368,6 +408,12 @@ static void write_src(void)
        }
        printf("\n");
+        if (base_relative) {
+                output_label("kallsyms_relative_base");
+                printf("\tPTR\t_text - %#llx\n", _text - relative_base);
+                printf("\n");
+        }
        output_label("kallsyms_num_syms");
        printf("\tPTR\t%d\n", table_cnt);
        printf("\n");
@@ -681,8 +727,27 @@ static void make_percpus_absolute(void)
        unsigned int i;
        for (i = 0; i < table_cnt; i++)
-                if (symbol_in_range(&table[i], &percpu_range, 1))
+                if (symbol_in_range(&table[i], &percpu_range, 1)) {
+                        /*
+                         * Keep the 'A' override for percpu symbols to
+                         * ensure consistent behavior compared to older
+                         * versions of this tool.
+                         */
                        table[i].sym[0] = 'A';
+                        table[i].percpu_absolute = 1;
+                }
+}
+/* find the minimum non-absolute symbol address */
+static void record_relative_base(void)
+{
+        unsigned int i;
+        relative_base = -1ULL;
+        for (i = 0; i < table_cnt; i++)
+                if (!symbol_absolute(&table[i]) &&
+                    table[i].addr < relative_base)
+                        relative_base = table[i].addr;
 }
 int main(int argc, char **argv)
@@ -703,7 +768,9 @@ int main(int argc, char **argv)
                        } else if (strncmp(argv[i], "--page-offset=", 14) == 0) {
                                const char *p = &argv[i][14];
                                kernel_start_addr = strtoull(p, NULL, 16);
-                        } else
+                        } else if (strcmp(argv[i], "--base-relative") == 0)
+                                base_relative = 1;
+                        else
                                usage();
                }
        } else if (argc != 1)
@@ -712,6 +779,8 @@ int main(int argc, char **argv)
        read_map(stdin);
        if (absolute_percpu)
                make_percpus_absolute();
+        if (base_relative)
+                record_relative_base();
        sort_symbols();
        optimize_token_table();
        write_src();
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index ba6c34ea5429..453ede9d2f3d 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -86,10 +86,14 @@ kallsyms()
                kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
        fi
-        if [ -n "${CONFIG_X86_64}" ]; then
+        if [ -n "${CONFIG_KALLSYMS_ABSOLUTE_PERCPU}" ]; then
                kallsymopt="${kallsymopt} --absolute-percpu"
        fi
+        if [ -n "${CONFIG_KALLSYMS_BASE_RELATIVE}" ]; then
+                kallsymopt="${kallsymopt} --base-relative"
+        fi
        local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
                      ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS}"
diff --git a/scripts/namespace.pl b/scripts/namespace.pl
index a71be6b7cdec..9f3c9d47a4a5 100755
--- a/scripts/namespace.pl
+++ b/scripts/namespace.pl
@@ -117,6 +117,8 @@ my %nameexception = (
    'kallsyms_names'    => 1,
    'kallsyms_num_syms' => 1,
    'kallsyms_addresses'=> 1,
+    'kallsyms_offsets'  => 1,
+    'kallsyms_relative_base'=> 1,
    '__this_module'     => 1,
    '_etext'            => 1,
    '_edata'            => 1,
diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
index 4d3340cce9a0..c9cb3be47cff 100644
--- a/tools/perf/builtin-kmem.c
+++ b/tools/perf/builtin-kmem.c
@@ -602,7 +602,7 @@ static int gfpcmp(const void *a, const void *b)
        return fa->flags - fb->flags;
 }
-/* see include/trace/events/gfpflags.h */
+/* see include/trace/events/mmflags.h */
 static const struct {
        const char *original;
        const char *compact;
@@ -612,30 +612,39 @@ static const struct {
        { "GFP_HIGHUSER",               "HU" },
        { "GFP_USER",                   "U" },
        { "GFP_TEMPORARY",              "TMP" },
+        { "GFP_KERNEL_ACCOUNT",         "KAC" },
        { "GFP_KERNEL",                 "K" },
        { "GFP_NOFS",                   "NF" },
        { "GFP_ATOMIC",                 "A" },
        { "GFP_NOIO",                   "NI" },
-        { "GFP_HIGH",                   "H" },
-        { "GFP_WAIT",                   "W" },
-        { "GFP_IO",                     "I" },
-        { "GFP_COLD",                   "CO" },
-        { "GFP_NOWARN",                 "NWR" },
-        { "GFP_REPEAT",                 "R" },
-        { "GFP_NOFAIL",                 "NF" },
-        { "GFP_NORETRY",                "NR" },
-        { "GFP_COMP",                   "C" },
-        { "GFP_ZERO",                   "Z" },
-        { "GFP_NOMEMALLOC",             "NMA" },
-        { "GFP_MEMALLOC",               "MA" },
-        { "GFP_HARDWALL",               "HW" },
-        { "GFP_THISNODE",               "TN" },
-        { "GFP_RECLAIMABLE",            "RC" },
-        { "GFP_MOVABLE",                "M" },
-        { "GFP_NOTRACK",                "NT" },
-        { "GFP_NO_KSWAPD",              "NK" },
-        { "GFP_OTHER_NODE",             "ON" },
        { "GFP_NOWAIT",                 "NW" },
+        { "GFP_DMA",                    "D" },
+        { "__GFP_HIGHMEM",              "HM" },
+        { "GFP_DMA32",                  "D32" },
+        { "__GFP_HIGH",                 "H" },
+        { "__GFP_ATOMIC",               "_A" },
+        { "__GFP_IO",                   "I" },
+        { "__GFP_FS",                   "F" },
+        { "__GFP_COLD",                 "CO" },
+        { "__GFP_NOWARN",               "NWR" },
+        { "__GFP_REPEAT",               "R" },
+        { "__GFP_NOFAIL",               "NF" },
+        { "__GFP_NORETRY",              "NR" },
+        { "__GFP_COMP",                 "C" },
+        { "__GFP_ZERO",                 "Z" },
+        { "__GFP_NOMEMALLOC",           "NMA" },
+        { "__GFP_MEMALLOC",             "MA" },
+        { "__GFP_HARDWALL",             "HW" },
+        { "__GFP_THISNODE",             "TN" },
+        { "__GFP_RECLAIMABLE",          "RC" },
+        { "__GFP_MOVABLE",              "M" },
+        { "__GFP_ACCOUNT",              "AC" },
+        { "__GFP_NOTRACK",              "NT" },
+        { "__GFP_WRITE",                "WR" },
+        { "__GFP_RECLAIM",              "R" },
+        { "__GFP_DIRECT_RECLAIM",       "DR" },
+        { "__GFP_KSWAPD_RECLAIM",       "KR" },
+        { "__GFP_OTHER_NODE",           "ON" },
 };
 static size_t max_gfp_len;
diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
index 86e698d07e20..1889163f2f05 100644
--- a/tools/vm/slabinfo.c
+++ b/tools/vm/slabinfo.c
@@ -135,7 +135,7 @@ static void usage(void)
                "\nValid debug options (FZPUT may be combined)\n"
                "a / A          Switch on all debug options (=FZUP)\n"
                "-              Switch off all debug options\n"
-                "f / F          Sanity Checks (SLAB_DEBUG_FREE)\n"
+                "f / F          Sanity Checks (SLAB_CONSISTENCY_CHECKS)\n"
                "z / Z          Redzoning\n"
                "p / P          Poisoning\n"
                "u / U          Tracking\n"