177 files changed, 4103 insertions, 2866 deletions

diff --git a/Documentation/ABI/stable/sysfs-devices-node b/Documentation/ABI/stable/sysfs-devices-node
index ce259c13c36a..5b2d0f08867c 100644
--- a/Documentation/ABI/stable/sysfs-devices-node
+++ b/Documentation/ABI/stable/sysfs-devices-node
@@ -85,14 +85,6 @@ Description:
                 will be compacted. When it completes, memory will be freed
                 into blocks which have as many contiguous pages as possible
 
-What:           /sys/devices/system/node/nodeX/scan_unevictable_pages
-Date:           October 2008
-Contact:        Lee Schermerhorn <lee.schermerhorn@hp.com>
-Description:
-                When set, it triggers scanning the node's unevictable lists
-                and move any pages that have become evictable onto the respective
-                zone's inactive list. See mm/vmscan.c
-
 What:           /sys/devices/system/node/nodeX/hugepages/hugepages-<size>/
 Date:           December 2009
 Contact:        Lee Schermerhorn <lee.schermerhorn@hp.com>
diff --git a/Documentation/ABI/testing/sysfs-block-zram b/Documentation/ABI/testing/sysfs-block-zram
index 70ec992514d0..a6148eaf91e5 100644
--- a/Documentation/ABI/testing/sysfs-block-zram
+++ b/Documentation/ABI/testing/sysfs-block-zram
@@ -77,11 +77,14 @@ What:		/sys/block/zram<id>/notify_free
 Date:           August 2010
 Contact:        Nitin Gupta <ngupta@vflare.org>
 Description:
-                The notify_free file is read-only and specifies the number of
-                swap slot free notifications received by this device. These
-                notifications are sent to a swap block device when a swap slot
-                is freed. This statistic is applicable only when this disk is
-                being used as a swap disk.
+                The notify_free file is read-only. Depending on device usage
+                scenario it may account a) the number of pages freed because
+                of swap slot free notifications or b) the number of pages freed
+                because of REQ_DISCARD requests sent by bio. The former ones
+                are sent to a swap block device when a swap slot is freed, which
+                implies that this disk is being used as a swap disk. The latter
+                ones are sent by filesystem mounted with discard option,
+                whenever some data blocks are getting discarded.
 
 What:           /sys/block/zram<id>/zero_pages
 Date:           August 2010
@@ -119,3 +122,22 @@ Description:
                 efficiency can be calculated using compr_data_size and this
                 statistic.
                 Unit: bytes
+
+What:           /sys/block/zram<id>/mem_used_max
+Date:           August 2014
+Contact:        Minchan Kim <minchan@kernel.org>
+Description:
+                The mem_used_max file is read/write and specifies the amount
+                of maximum memory zram have consumed to store compressed data.
+                For resetting the value, you should write "0". Otherwise,
+                you could see -EINVAL.
+                Unit: bytes
+
+What:           /sys/block/zram<id>/mem_limit
+Date:           August 2014
+Contact:        Minchan Kim <minchan@kernel.org>
+Description:
+                The mem_limit file is read/write and specifies the maximum
+                amount of memory ZRAM can use to store the compressed data.  The
+                limit could be changed in run time and "0" means disable the
+                limit.  No limit is the initial state.  Unit: bytes
diff --git a/Documentation/ABI/testing/sysfs-devices-memory b/Documentation/ABI/testing/sysfs-devices-memory
index 7405de26ee60..deef3b5723cf 100644
--- a/Documentation/ABI/testing/sysfs-devices-memory
+++ b/Documentation/ABI/testing/sysfs-devices-memory
@@ -61,6 +61,14 @@ Users:		hotplug memory remove tools
                 http://www.ibm.com/developerworks/wikis/display/LinuxP/powerpc-utils
 
 
+What:           /sys/devices/system/memory/memoryX/valid_zones
+Date:           July 2014
+Contact:        Zhang Zhen <zhenzhang.zhang@huawei.com>
+Description:
+                The file /sys/devices/system/memory/memoryX/valid_zones is
+                read-only and is designed to show which zone this memory
+                block can be onlined to.
+
 What:           /sys/devices/system/memoryX/nodeY
 Date:           October 2009
 Contact:        Linux Memory Management list <linux-mm@kvack.org>
diff --git a/Documentation/blockdev/zram.txt b/Documentation/blockdev/zram.txt
index 0595c3f56ccf..7fcf9c6592ec 100644
--- a/Documentation/blockdev/zram.txt
+++ b/Documentation/blockdev/zram.txt
@@ -74,14 +74,30 @@ There is little point creating a zram of greater than twice the size of memory
 since we expect a 2:1 compression ratio. Note that zram uses about 0.1% of the
 size of the disk when not in use so a huge zram is wasteful.
 
-5) Activate:
+5) Set memory limit: Optional
+        Set memory limit by writing the value to sysfs node 'mem_limit'.
+        The value can be either in bytes or you can use mem suffixes.
+        In addition, you could change the value in runtime.
+        Examples:
+            # limit /dev/zram0 with 50MB memory
+            echo $((50*1024*1024)) > /sys/block/zram0/mem_limit
+
+            # Using mem suffixes
+            echo 256K > /sys/block/zram0/mem_limit
+            echo 512M > /sys/block/zram0/mem_limit
+            echo 1G > /sys/block/zram0/mem_limit
+
+            # To disable memory limit
+            echo 0 > /sys/block/zram0/mem_limit
+
+6) Activate:
         mkswap /dev/zram0
         swapon /dev/zram0
 
         mkfs.ext4 /dev/zram1
         mount /dev/zram1 /tmp
 
-6) Stats:
+7) Stats:
         Per-device statistics are exported as various nodes under
         /sys/block/zram<id>/
                 disksize
@@ -95,12 +111,13 @@ size of the disk when not in use so a huge zram is wasteful.
                 orig_data_size
                 compr_data_size
                 mem_used_total
+                mem_used_max
 
-7) Deactivate:
+8) Deactivate:
         swapoff /dev/zram0
         umount /dev/zram1
 
-8) Reset:
+9) Reset:
         Write any positive value to 'reset' sysfs node
         echo 1 > /sys/block/zram0/reset
         echo 1 > /sys/block/zram1/reset
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index cc4ab2517abc..41f7ec1fcf61 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -656,7 +656,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         Sets the size of kernel global memory area for
                         contiguous memory allocations and optionally the
                         placement constraint by the physical address range of
-                        memory allocations. For more information, see
+                        memory allocations. A value of 0 disables CMA
+                        altogether. For more information, see
                         include/linux/dma-contiguous.h
 
         cmo_free_hint=  [PPC] Format: { yes | no }
@@ -3158,6 +3159,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         slram=          [HW,MTD]
 
+        slab_nomerge    [MM]
+                        Disable merging of slabs with similar size. May be
+                        necessary if there is some reason to distinguish
+                        allocs to different slabs. Debug options disable
+                        merging on their own.
+                        For more information see Documentation/vm/slub.txt.
+
         slab_max_order= [MM, SLAB]
                         Determines the maximum allowed order for slabs.
                         A high setting may cause OOMs due to memory
@@ -3193,11 +3201,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         For more information see Documentation/vm/slub.txt.
 
         slub_nomerge    [MM, SLUB]
-                        Disable merging of slabs with similar size. May be
-                        necessary if there is some reason to distinguish
-                        allocs to different slabs. Debug options disable
-                        merging on their own.
-                        For more information see Documentation/vm/slub.txt.
+                        Same with slab_nomerge. This is supported for legacy.
+                        See slab_nomerge for more information.
 
         smart2=         [HW]
                         Format: <io1>[,<io2>[,...,<io8>]]
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
index 45134dc23854..ea03abfc97e9 100644
--- a/Documentation/memory-hotplug.txt
+++ b/Documentation/memory-hotplug.txt
@@ -155,6 +155,7 @@ Under each memory block, you can see 4 files:
 /sys/devices/system/memory/memoryXXX/phys_device
 /sys/devices/system/memory/memoryXXX/state
 /sys/devices/system/memory/memoryXXX/removable
+/sys/devices/system/memory/memoryXXX/valid_zones
 
 'phys_index'      : read-only and contains memory block id, same as XXX.
 'state'           : read-write
@@ -170,6 +171,15 @@ Under each memory block, you can see 4 files:
                     block is removable and a value of 0 indicates that
                     it is not removable. A memory block is removable only if
                     every section in the block is removable.
+'valid_zones'     : read-only: designed to show which zones this memory block
+                    can be onlined to.
+                    The first column shows it's default zone.
+                    "memory6/valid_zones: Normal Movable" shows this memoryblock
+                    can be onlined to ZONE_NORMAL by default and to ZONE_MOVABLE
+                    by online_movable.
+                    "memory7/valid_zones: Movable Normal" shows this memoryblock
+                    can be onlined to ZONE_MOVABLE by default and to ZONE_NORMAL
+                    by online_kernel.
 
 NOTE:
   These directories/files appear after physical memory hotplug phase.
@@ -408,7 +418,6 @@ node if necessary.
   - allowing memory hot-add to ZONE_MOVABLE. maybe we need some switch like
     sysctl or new control file.
   - showing memory block and physical device relationship.
-  - showing memory block is under ZONE_MOVABLE or not
   - test and make it better memory offlining.
   - support HugeTLB page migration and offlining.
   - memmap removing at memory offline.
diff --git a/arch/alpha/include/asm/Kbuild b/arch/alpha/include/asm/Kbuild
index a52cbf178c3a..25b49725df07 100644
--- a/arch/alpha/include/asm/Kbuild
+++ b/arch/alpha/include/asm/Kbuild
@@ -8,4 +8,5 @@ generic-y += irq_work.h
 generic-y += mcs_spinlock.h
 generic-y += preempt.h
 generic-y += scatterlist.h
+generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/alpha/include/asm/sections.h b/arch/alpha/include/asm/sections.h
deleted file mode 100644
index 43b40edd6e44..000000000000
--- a/arch/alpha/include/asm/sections.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _ALPHA_SECTIONS_H
-#define _ALPHA_SECTIONS_H
-
-/* nothing to see, move along */
-#include <asm-generic/sections.h>
-
-#endif
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index d9d32de9628c..18f392f8b744 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -14,6 +14,7 @@ config ARM
         select CLONE_BACKWARDS
         select CPU_PM if (SUSPEND || CPU_IDLE)
         select DCACHE_WORD_ACCESS if HAVE_EFFICIENT_UNALIGNED_ACCESS
+        select GENERIC_ALLOCATOR
         select GENERIC_ATOMIC64 if (CPU_V7M || CPU_V6 || !CPU_32v6K || !AEABI)
         select GENERIC_CLOCKEVENTS_BROADCAST if SMP
         select GENERIC_IDLE_POLL_SETUP
@@ -61,6 +62,7 @@ config ARM
         select HAVE_PERF_EVENTS
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
+        select HAVE_RCU_TABLE_FREE if (SMP && ARM_LPAE)
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_UID16
@@ -1659,6 +1661,10 @@ config ARCH_SELECT_MEMORY_MODEL
 config HAVE_ARCH_PFN_VALID
         def_bool ARCH_HAS_HOLES_MEMORYMODEL || !SPARSEMEM
 
+config HAVE_GENERIC_RCU_GUP
+        def_bool y
+        depends on ARM_LPAE
+
 config HIGHMEM
         bool "High Memory Support"
         depends on MMU
diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
index 219ac88a9542..f0279411847d 100644
--- a/arch/arm/include/asm/pgtable-2level.h
+++ b/arch/arm/include/asm/pgtable-2level.h
@@ -182,6 +182,8 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 #define pmd_addr_end(addr,end) (end)
 
 #define set_pte_ext(ptep,pte,ext) cpu_set_pte_ext(ptep,pte,ext)
+#define pte_special(pte)        (0)
+static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
 
 /*
  * We don't have huge page support for short descriptors, for the moment
diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
index 06e0bc0f8b00..a31ecdad4b59 100644
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -213,10 +213,19 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 #define pmd_isclear(pmd, val)   (!(pmd_val(pmd) & (val)))
 
 #define pmd_young(pmd)          (pmd_isset((pmd), PMD_SECT_AF))
+#define pte_special(pte)        (pte_isset((pte), L_PTE_SPECIAL))
+static inline pte_t pte_mkspecial(pte_t pte)
+{
+        pte_val(pte) |= L_PTE_SPECIAL;
+        return pte;
+}
+#define __HAVE_ARCH_PTE_SPECIAL
 
 #define __HAVE_ARCH_PMD_WRITE
 #define pmd_write(pmd)          (pmd_isclear((pmd), L_PMD_SECT_RDONLY))
 #define pmd_dirty(pmd)          (pmd_isset((pmd), L_PMD_SECT_DIRTY))
+#define pud_page(pud)           pmd_page(__pmd(pud_val(pud)))
+#define pud_write(pud)          pmd_write(__pmd(pud_val(pud)))
 
 #define pmd_hugewillfault(pmd)  (!pmd_young(pmd) || !pmd_write(pmd))
 #define pmd_thp_or_huge(pmd)    (pmd_huge(pmd) || pmd_trans_huge(pmd))
@@ -224,6 +233,12 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 #define pmd_trans_huge(pmd)     (pmd_val(pmd) && !pmd_table(pmd))
 #define pmd_trans_splitting(pmd) (pmd_isset((pmd), L_PMD_SECT_SPLITTING))
+
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+#define __HAVE_ARCH_PMDP_SPLITTING_FLUSH
+void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
+                          pmd_t *pmdp);
+#endif
 #endif
 
 #define PMD_BIT_FUNC(fn,op) \
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index 01baef07cd0c..90aa4583b308 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -226,7 +226,6 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
 #define pte_dirty(pte)          (pte_isset((pte), L_PTE_DIRTY))
 #define pte_young(pte)          (pte_isset((pte), L_PTE_YOUNG))
 #define pte_exec(pte)           (pte_isclear((pte), L_PTE_XN))
-#define pte_special(pte)        (0)
 
 #define pte_valid_user(pte)     \
         (pte_valid(pte) && pte_isset((pte), L_PTE_USER) && pte_young(pte))
@@ -245,7 +244,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
         unsigned long ext = 0;
 
         if (addr < TASK_SIZE && pte_valid_user(pteval)) {
-                __sync_icache_dcache(pteval);
+                if (!pte_special(pteval))
+                        __sync_icache_dcache(pteval);
                 ext |= PTE_EXT_NG;
         }
 
@@ -264,8 +264,6 @@ PTE_BIT_FUNC(mkyoung,   |= L_PTE_YOUNG);
 PTE_BIT_FUNC(mkexec,   &= ~L_PTE_XN);
 PTE_BIT_FUNC(mknexec,   |= L_PTE_XN);
 
-static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
-
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index f1a0dace3efe..3cadb726ec88 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -35,12 +35,39 @@
 
 #define MMU_GATHER_BUNDLE       8
 
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+static inline void __tlb_remove_table(void *_table)
+{
+        free_page_and_swap_cache((struct page *)_table);
+}
+
+struct mmu_table_batch {
+        struct rcu_head         rcu;
+        unsigned int            nr;
+        void                    *tables[0];
+};
+
+#define MAX_TABLE_BATCH         \
+        ((PAGE_SIZE - sizeof(struct mmu_table_batch)) / sizeof(void *))
+
+extern void tlb_table_flush(struct mmu_gather *tlb);
+extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
+
+#define tlb_remove_entry(tlb, entry)    tlb_remove_table(tlb, entry)
+#else
+#define tlb_remove_entry(tlb, entry)    tlb_remove_page(tlb, entry)
+#endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+
 /*
  * TLB handling.  This allows us to remove pages from the page
  * tables, and efficiently handle the TLB issues.
  */
 struct mmu_gather {
         struct mm_struct        *mm;
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+        struct mmu_table_batch  *batch;
+        unsigned int            need_flush;
+#endif
         unsigned int            fullmm;
         struct vm_area_struct   *vma;
         unsigned long           start, end;
@@ -101,6 +128,9 @@ static inline void __tlb_alloc_page(struct mmu_gather *tlb)
 static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
         tlb_flush(tlb);
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+        tlb_table_flush(tlb);
+#endif
 }
 
 static inline void tlb_flush_mmu_free(struct mmu_gather *tlb)
@@ -129,6 +159,10 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
         tlb->pages = tlb->local;
         tlb->nr = 0;
         __tlb_alloc_page(tlb);
+
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+        tlb->batch = NULL;
+#endif
 }
 
 static inline void
@@ -205,7 +239,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
         tlb_add_flush(tlb, addr + SZ_1M);
 #endif
 
-        tlb_remove_page(tlb, pte);
+        tlb_remove_entry(tlb, pte);
 }
 
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
@@ -213,7 +247,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 {
 #ifdef CONFIG_ARM_LPAE
         tlb_add_flush(tlb, addr);
-        tlb_remove_page(tlb, virt_to_page(pmdp));
+        tlb_remove_entry(tlb, virt_to_page(pmdp));
 #endif
 }
 
diff --git a/arch/arm/kernel/hibernate.c b/arch/arm/kernel/hibernate.c
index bb8b79648643..c4cc50e58c13 100644
--- a/arch/arm/kernel/hibernate.c
+++ b/arch/arm/kernel/hibernate.c
@@ -21,8 +21,7 @@
 #include <asm/idmap.h>
 #include <asm/suspend.h>
 #include <asm/memory.h>
-
-extern const void __nosave_begin, __nosave_end;
+#include <asm/sections.h>
 
 int pfn_is_nosave(unsigned long pfn)
 {
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 7a996aaa061e..c245d903927f 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -12,6 +12,7 @@
 #include <linux/bootmem.h>
 #include <linux/module.h>
 #include <linux/mm.h>
+#include <linux/genalloc.h>
 #include <linux/gfp.h>
 #include <linux/errno.h>
 #include <linux/list.h>
@@ -298,57 +299,29 @@ static void *
 __dma_alloc_remap(struct page *page, size_t size, gfp_t gfp, pgprot_t prot,
         const void *caller)
 {
-        struct vm_struct *area;
-        unsigned long addr;
-
         /*
          * DMA allocation can be mapped to user space, so lets
          * set VM_USERMAP flags too.
          */
-        area = get_vm_area_caller(size, VM_ARM_DMA_CONSISTENT | VM_USERMAP,
-                                  caller);
-        if (!area)
-                return NULL;
-        addr = (unsigned long)area->addr;
-        area->phys_addr = __pfn_to_phys(page_to_pfn(page));
-
-        if (ioremap_page_range(addr, addr + size, area->phys_addr, prot)) {
-                vunmap((void *)addr);
-                return NULL;
-        }
-        return (void *)addr;
+        return dma_common_contiguous_remap(page, size,
+                        VM_ARM_DMA_CONSISTENT | VM_USERMAP,
+                        prot, caller);
 }
 
 static void __dma_free_remap(void *cpu_addr, size_t size)
 {
-        unsigned int flags = VM_ARM_DMA_CONSISTENT | VM_USERMAP;
-        struct vm_struct *area = find_vm_area(cpu_addr);
-        if (!area || (area->flags & flags) != flags) {
-                WARN(1, "trying to free invalid coherent area: %p\n", cpu_addr);
-                return;
-        }
-        unmap_kernel_range((unsigned long)cpu_addr, size);
-        vunmap(cpu_addr);
+        dma_common_free_remap(cpu_addr, size,
+                        VM_ARM_DMA_CONSISTENT | VM_USERMAP);
 }
 
 #define DEFAULT_DMA_COHERENT_POOL_SIZE  SZ_256K
+static struct gen_pool *atomic_pool;
 
-struct dma_pool {
-        size_t size;
-        spinlock_t lock;
-        unsigned long *bitmap;
-        unsigned long nr_pages;
-        void *vaddr;
-        struct page **pages;
-};
-
-static struct dma_pool atomic_pool = {
-        .size = DEFAULT_DMA_COHERENT_POOL_SIZE,
-};
+static size_t atomic_pool_size = DEFAULT_DMA_COHERENT_POOL_SIZE;
 
 static int __init early_coherent_pool(char *p)
 {
-        atomic_pool.size = memparse(p, &p);
+        atomic_pool_size = memparse(p, &p);
         return 0;
 }
 early_param("coherent_pool", early_coherent_pool);
@@ -358,14 +331,14 @@ void __init init_dma_coherent_pool_size(unsigned long size)
         /*
          * Catch any attempt to set the pool size too late.
          */
-        BUG_ON(atomic_pool.vaddr);
+        BUG_ON(atomic_pool);
 
         /*
          * Set architecture specific coherent pool size only if
          * it has not been changed by kernel command line parameter.
          */
-        if (atomic_pool.size == DEFAULT_DMA_COHERENT_POOL_SIZE)
-                atomic_pool.size = size;
+        if (atomic_pool_size == DEFAULT_DMA_COHERENT_POOL_SIZE)
+                atomic_pool_size = size;
 }
 
 /*
@@ -373,52 +346,44 @@ void __init init_dma_coherent_pool_size(unsigned long size)
  */
 static int __init atomic_pool_init(void)
 {
-        struct dma_pool *pool = &atomic_pool;
         pgprot_t prot = pgprot_dmacoherent(PAGE_KERNEL);
         gfp_t gfp = GFP_KERNEL | GFP_DMA;
-        unsigned long nr_pages = pool->size >> PAGE_SHIFT;
-        unsigned long *bitmap;
         struct page *page;
-        struct page **pages;
         void *ptr;
-        int bitmap_size = BITS_TO_LONGS(nr_pages) * sizeof(long);
 
-        bitmap = kzalloc(bitmap_size, GFP_KERNEL);
-        if (!bitmap)
-                goto no_bitmap;
-
-        pages = kzalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
-        if (!pages)
-                goto no_pages;
+        atomic_pool = gen_pool_create(PAGE_SHIFT, -1);
+        if (!atomic_pool)
+                goto out;
 
         if (dev_get_cma_area(NULL))
-                ptr = __alloc_from_contiguous(NULL, pool->size, prot, &page,
-                                              atomic_pool_init);
+                ptr = __alloc_from_contiguous(NULL, atomic_pool_size, prot,
+                                              &page, atomic_pool_init);
         else
-                ptr = __alloc_remap_buffer(NULL, pool->size, gfp, prot, &page,
-                                           atomic_pool_init);
+                ptr = __alloc_remap_buffer(NULL, atomic_pool_size, gfp, prot,
+                                           &page, atomic_pool_init);
         if (ptr) {
-                int i;
-
-                for (i = 0; i < nr_pages; i++)
-                        pages[i] = page + i;
-
-                spin_lock_init(&pool->lock);
-                pool->vaddr = ptr;
-                pool->pages = pages;
-                pool->bitmap = bitmap;
-                pool->nr_pages = nr_pages;
-                pr_info("DMA: preallocated %u KiB pool for atomic coherent allocations\n",
-                       (unsigned)pool->size / 1024);
+                int ret;
+
+                ret = gen_pool_add_virt(atomic_pool, (unsigned long)ptr,
+                                        page_to_phys(page),
+                                        atomic_pool_size, -1);
+                if (ret)
+                        goto destroy_genpool;
+
+                gen_pool_set_algo(atomic_pool,
+                                gen_pool_first_fit_order_align,
+                                (void *)PAGE_SHIFT);
+                pr_info("DMA: preallocated %zd KiB pool for atomic coherent allocations\n",
+                       atomic_pool_size / 1024);
                 return 0;
         }
 
-        kfree(pages);
-no_pages:
-        kfree(bitmap);
-no_bitmap:
-        pr_err("DMA: failed to allocate %u KiB pool for atomic coherent allocation\n",
-               (unsigned)pool->size / 1024);
+destroy_genpool:
+        gen_pool_destroy(atomic_pool);
+        atomic_pool = NULL;
+out:
+        pr_err("DMA: failed to allocate %zx KiB pool for atomic coherent allocation\n",
+               atomic_pool_size / 1024);
         return -ENOMEM;
 }
 /*
@@ -522,76 +487,36 @@ static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp,
 
 static void *__alloc_from_pool(size_t size, struct page **ret_page)
 {
-        struct dma_pool *pool = &atomic_pool;
-        unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
-        unsigned int pageno;
-        unsigned long flags;
+        unsigned long val;
         void *ptr = NULL;
-        unsigned long align_mask;
 
-        if (!pool->vaddr) {
+        if (!atomic_pool) {
                 WARN(1, "coherent pool not initialised!\n");
                 return NULL;
         }
 
-        /*
-         * Align the region allocation - allocations from pool are rather
-         * small, so align them to their order in pages, minimum is a page
-         * size. This helps reduce fragmentation of the DMA space.
-         */
-        align_mask = (1 << get_order(size)) - 1;
-
-        spin_lock_irqsave(&pool->lock, flags);
-        pageno = bitmap_find_next_zero_area(pool->bitmap, pool->nr_pages,
-                                            0, count, align_mask);
-        if (pageno < pool->nr_pages) {
-                bitmap_set(pool->bitmap, pageno, count);
-                ptr = pool->vaddr + PAGE_SIZE * pageno;
-                *ret_page = pool->pages[pageno];
-        } else {
-                pr_err_once("ERROR: %u KiB atomic DMA coherent pool is too small!\n"
-                            "Please increase it with coherent_pool= kernel parameter!\n",
-                            (unsigned)pool->size / 1024);
+        val = gen_pool_alloc(atomic_pool, size);
+        if (val) {
+                phys_addr_t phys = gen_pool_virt_to_phys(atomic_pool, val);
+
+                *ret_page = phys_to_page(phys);
+                ptr = (void *)val;
         }
-        spin_unlock_irqrestore(&pool->lock, flags);
 
         return ptr;
 }
 
 static bool __in_atomic_pool(void *start, size_t size)
 {
-        struct dma_pool *pool = &atomic_pool;
-        void *end = start + size;
-        void *pool_start = pool->vaddr;
-        void *pool_end = pool->vaddr + pool->size;
-
-        if (start < pool_start || start >= pool_end)
-                return false;
-
-        if (end <= pool_end)
-                return true;
-
-        WARN(1, "Wrong coherent size(%p-%p) from atomic pool(%p-%p)\n",
-             start, end - 1, pool_start, pool_end - 1);
-
-        return false;
+        return addr_in_gen_pool(atomic_pool, (unsigned long)start, size);
 }
 
 static int __free_from_pool(void *start, size_t size)
 {
-        struct dma_pool *pool = &atomic_pool;
-        unsigned long pageno, count;
-        unsigned long flags;
-
         if (!__in_atomic_pool(start, size))
                 return 0;
 
-        pageno = (start - pool->vaddr) >> PAGE_SHIFT;
-        count = size >> PAGE_SHIFT;
-
-        spin_lock_irqsave(&pool->lock, flags);
-        bitmap_clear(pool->bitmap, pageno, count);
-        spin_unlock_irqrestore(&pool->lock, flags);
+        gen_pool_free(atomic_pool, (unsigned long)start, size);
 
         return 1;
 }
@@ -1271,29 +1196,8 @@ static void *
 __iommu_alloc_remap(struct page **pages, size_t size, gfp_t gfp, pgprot_t prot,
                     const void *caller)
 {
-        unsigned int i, nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
-        struct vm_struct *area;
-        unsigned long p;
-
-        area = get_vm_area_caller(size, VM_ARM_DMA_CONSISTENT | VM_USERMAP,
-                                  caller);
-        if (!area)
-                return NULL;
-
-        area->pages = pages;
-        area->nr_pages = nr_pages;
-        p = (unsigned long)area->addr;
-
-        for (i = 0; i < nr_pages; i++) {
-                phys_addr_t phys = __pfn_to_phys(page_to_pfn(pages[i]));
-                if (ioremap_page_range(p, p + PAGE_SIZE, phys, prot))
-                        goto err;
-                p += PAGE_SIZE;
-        }
-        return area->addr;
-err:
-        unmap_kernel_range((unsigned long)area->addr, size);
-        vunmap(area->addr);
+        return dma_common_pages_remap(pages, size,
+                        VM_ARM_DMA_CONSISTENT | VM_USERMAP, prot, caller);
         return NULL;
 }
 
@@ -1355,11 +1259,13 @@ static int __iommu_remove_mapping(struct device *dev, dma_addr_t iova, size_t si
 
 static struct page **__atomic_get_pages(void *addr)
 {
-        struct dma_pool *pool = &atomic_pool;
-        struct page **pages = pool->pages;
-        int offs = (addr - pool->vaddr) >> PAGE_SHIFT;
+        struct page *page;
+        phys_addr_t phys;
+
+        phys = gen_pool_virt_to_phys(atomic_pool, (unsigned long)addr);
+        page = phys_to_page(phys);
 
-        return pages + offs;
+        return (struct page **)page;
 }
 
 static struct page **__iommu_get_pages(void *cpu_addr, struct dma_attrs *attrs)
@@ -1501,8 +1407,8 @@ void arm_iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
         }
 
         if (!dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs)) {
-                unmap_kernel_range((unsigned long)cpu_addr, size);
-                vunmap(cpu_addr);
+                dma_common_free_remap(cpu_addr, size,
+                        VM_ARM_DMA_CONSISTENT | VM_USERMAP);
         }
 
         __iommu_remove_mapping(dev, handle, size);
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 43d54f5b26b9..265b836b3bd1 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -400,3 +400,18 @@ void __flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned l
          */
         __cpuc_flush_dcache_area(page_address(page), PAGE_SIZE);
 }
+
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
+                          pmd_t *pmdp)
+{
+        pmd_t pmd = pmd_mksplitting(*pmdp);
+        VM_BUG_ON(address & ~PMD_MASK);
+        set_pmd_at(vma->vm_mm, address, pmdp, pmd);
+
+        /* dummy IPI to serialise against fast_gup */
+        kick_all_cpus_sync();
+}
+#endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 9221645dd192..92bba32d9230 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -322,7 +322,7 @@ void __init arm_memblock_init(const struct machine_desc *mdesc)
          * reserve memory for DMA contigouos allocations,
          * must come from DMA area inside low memory
          */
-        dma_contiguous_reserve(min(arm_dma_limit, arm_lowmem_limit));
+        dma_contiguous_reserve(arm_dma_limit);
 
         arm_memblock_steal_permitted = false;
         memblock_dump_all();
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 3f0e854d0ff4..c49ca4c738bb 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -18,6 +18,7 @@ config ARM64
         select COMMON_CLK
         select CPU_PM if (SUSPEND || CPU_IDLE)
         select DCACHE_WORD_ACCESS
+        select GENERIC_ALLOCATOR
         select GENERIC_CLOCKEVENTS
         select GENERIC_CLOCKEVENTS_BROADCAST if SMP
         select GENERIC_CPU_AUTOPROBE
@@ -56,6 +57,7 @@ config ARM64
         select HAVE_PERF_EVENTS
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
+        select HAVE_RCU_TABLE_FREE
         select HAVE_SYSCALL_TRACEPOINTS
         select IRQ_DOMAIN
         select MODULES_USE_ELF_RELA
@@ -109,6 +111,9 @@ config GENERIC_CALIBRATE_DELAY
 config ZONE_DMA
         def_bool y
 
+config HAVE_GENERIC_RCU_GUP
+        def_bool y
+
 config ARCH_DMA_ADDR_T_64BIT
         def_bool y
 
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 77dbe1e6398d..cefd3e825612 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -244,6 +244,16 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 
 #define __HAVE_ARCH_PTE_SPECIAL
 
+static inline pte_t pud_pte(pud_t pud)
+{
+        return __pte(pud_val(pud));
+}
+
+static inline pmd_t pud_pmd(pud_t pud)
+{
+        return __pmd(pud_val(pud));
+}
+
 static inline pte_t pmd_pte(pmd_t pmd)
 {
         return __pte(pmd_val(pmd));
@@ -261,7 +271,13 @@ static inline pmd_t pte_pmd(pte_t pte)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 #define pmd_trans_huge(pmd)     (pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT))
 #define pmd_trans_splitting(pmd)        pte_special(pmd_pte(pmd))
-#endif
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+#define __HAVE_ARCH_PMDP_SPLITTING_FLUSH
+struct vm_area_struct;
+void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
+                          pmd_t *pmdp);
+#endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
 #define pmd_young(pmd)          pte_young(pmd_pte(pmd))
 #define pmd_wrprotect(pmd)      pte_pmd(pte_wrprotect(pmd_pte(pmd)))
@@ -282,6 +298,7 @@ static inline pmd_t pte_pmd(pte_t pte)
 #define mk_pmd(page,prot)       pfn_pmd(page_to_pfn(page),prot)
 
 #define pmd_page(pmd)           pfn_to_page(__phys_to_pfn(pmd_val(pmd) & PHYS_MASK))
+#define pud_write(pud)          pte_write(pud_pte(pud))
 #define pud_pfn(pud)            (((pud_val(pud) & PUD_MASK) & PHYS_MASK) >> PAGE_SHIFT)
 
 #define set_pmd_at(mm, addr, pmdp, pmd) set_pte_at(mm, addr, (pte_t *)pmdp, pmd_pte(pmd))
@@ -383,6 +400,8 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
         return (pmd_t *)pud_page_vaddr(*pud) + pmd_index(addr);
 }
 
+#define pud_page(pud)           pmd_page(pud_pmd(pud))
+
 #endif  /* CONFIG_ARM64_PGTABLE_LEVELS > 2 */
 
 #if CONFIG_ARM64_PGTABLE_LEVELS > 3
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index 62731ef9749a..a82c0c5c8b52 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -23,6 +23,20 @@
 
 #include <asm-generic/tlb.h>
 
+#include <linux/pagemap.h>
+#include <linux/swap.h>
+
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+
+#define tlb_remove_entry(tlb, entry)    tlb_remove_table(tlb, entry)
+static inline void __tlb_remove_table(void *_table)
+{
+        free_page_and_swap_cache((struct page *)_table);
+}
+#else
+#define tlb_remove_entry(tlb, entry)    tlb_remove_page(tlb, entry)
+#endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+
 /*
  * There's three ways the TLB shootdown code is used:
  *  1. Unmapping a range of vmas.  See zap_page_range(), unmap_region().
@@ -88,7 +102,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 {
         pgtable_page_dtor(pte);
         tlb_add_flush(tlb, addr);
-        tlb_remove_page(tlb, pte);
+        tlb_remove_entry(tlb, pte);
 }
 
 #if CONFIG_ARM64_PGTABLE_LEVELS > 2
@@ -96,7 +110,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
                                   unsigned long addr)
 {
         tlb_add_flush(tlb, addr);
-        tlb_remove_page(tlb, virt_to_page(pmdp));
+        tlb_remove_entry(tlb, virt_to_page(pmdp));
 }
 #endif
 
@@ -105,7 +119,7 @@ static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
                                   unsigned long addr)
 {
         tlb_add_flush(tlb, addr);
-        tlb_remove_page(tlb, virt_to_page(pudp));
+        tlb_remove_entry(tlb, virt_to_page(pudp));
 }
 #endif
 
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 2c71077cacfd..d92094203913 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -20,6 +20,7 @@
 #include <linux/gfp.h>
 #include <linux/export.h>
 #include <linux/slab.h>
+#include <linux/genalloc.h>
 #include <linux/dma-mapping.h>
 #include <linux/dma-contiguous.h>
 #include <linux/vmalloc.h>
@@ -38,6 +39,54 @@ static pgprot_t __get_dma_pgprot(struct dma_attrs *attrs, pgprot_t prot,
         return prot;
 }
 
+static struct gen_pool *atomic_pool;
+
+#define DEFAULT_DMA_COHERENT_POOL_SIZE  SZ_256K
+static size_t atomic_pool_size = DEFAULT_DMA_COHERENT_POOL_SIZE;
+
+static int __init early_coherent_pool(char *p)
+{
+        atomic_pool_size = memparse(p, &p);
+        return 0;
+}
+early_param("coherent_pool", early_coherent_pool);
+
+static void *__alloc_from_pool(size_t size, struct page **ret_page)
+{
+        unsigned long val;
+        void *ptr = NULL;
+
+        if (!atomic_pool) {
+                WARN(1, "coherent pool not initialised!\n");
+                return NULL;
+        }
+
+        val = gen_pool_alloc(atomic_pool, size);
+        if (val) {
+                phys_addr_t phys = gen_pool_virt_to_phys(atomic_pool, val);
+
+                *ret_page = phys_to_page(phys);
+                ptr = (void *)val;
+        }
+
+        return ptr;
+}
+
+static bool __in_atomic_pool(void *start, size_t size)
+{
+        return addr_in_gen_pool(atomic_pool, (unsigned long)start, size);
+}
+
+static int __free_from_pool(void *start, size_t size)
+{
+        if (!__in_atomic_pool(start, size))
+                return 0;
+
+        gen_pool_free(atomic_pool, (unsigned long)start, size);
+
+        return 1;
+}
+
 static void *__dma_alloc_coherent(struct device *dev, size_t size,
                                   dma_addr_t *dma_handle, gfp_t flags,
                                   struct dma_attrs *attrs)
@@ -50,7 +99,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
         if (IS_ENABLED(CONFIG_ZONE_DMA) &&
             dev->coherent_dma_mask <= DMA_BIT_MASK(32))
                 flags |= GFP_DMA;
-        if (IS_ENABLED(CONFIG_DMA_CMA)) {
+        if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
                 struct page *page;
 
                 size = PAGE_ALIGN(size);
@@ -70,50 +119,54 @@ static void __dma_free_coherent(struct device *dev, size_t size,
                                 void *vaddr, dma_addr_t dma_handle,
                                 struct dma_attrs *attrs)
 {
+        bool freed;
+        phys_addr_t paddr = dma_to_phys(dev, dma_handle);
+
         if (dev == NULL) {
                 WARN_ONCE(1, "Use an actual device structure for DMA allocation\n");
                 return;
         }
 
-        if (IS_ENABLED(CONFIG_DMA_CMA)) {
-                phys_addr_t paddr = dma_to_phys(dev, dma_handle);
-
-                dma_release_from_contiguous(dev,
+        freed = dma_release_from_contiguous(dev,
                                         phys_to_page(paddr),
                                         size >> PAGE_SHIFT);
-        } else {
+        if (!freed)
                 swiotlb_free_coherent(dev, size, vaddr, dma_handle);
-        }
 }
 
 static void *__dma_alloc_noncoherent(struct device *dev, size_t size,
                                      dma_addr_t *dma_handle, gfp_t flags,
                                      struct dma_attrs *attrs)
 {
-        struct page *page, **map;
+        struct page *page;
         void *ptr, *coherent_ptr;
-        int order, i;
 
         size = PAGE_ALIGN(size);
-        order = get_order(size);
+
+        if (!(flags & __GFP_WAIT)) {
+                struct page *page = NULL;
+                void *addr = __alloc_from_pool(size, &page);
+
+                if (addr)
+                        *dma_handle = phys_to_dma(dev, page_to_phys(page));
+
+                return addr;
+
+        }
 
         ptr = __dma_alloc_coherent(dev, size, dma_handle, flags, attrs);
         if (!ptr)
                 goto no_mem;
-        map = kmalloc(sizeof(struct page *) << order, flags & ~GFP_DMA);
-        if (!map)
-                goto no_map;
 
         /* remove any dirty cache lines on the kernel alias */
         __dma_flush_range(ptr, ptr + size);
 
         /* create a coherent mapping */
         page = virt_to_page(ptr);
-        for (i = 0; i < (size >> PAGE_SHIFT); i++)
-                map[i] = page + i;
-        coherent_ptr = vmap(map, size >> PAGE_SHIFT, VM_MAP,
-                            __get_dma_pgprot(attrs, __pgprot(PROT_NORMAL_NC), false));
-        kfree(map);
+        coherent_ptr = dma_common_contiguous_remap(page, size, VM_USERMAP,
+                                __get_dma_pgprot(attrs,
+                                        __pgprot(PROT_NORMAL_NC), false),
+                                        NULL);
         if (!coherent_ptr)
                 goto no_map;
 
@@ -132,6 +185,8 @@ static void __dma_free_noncoherent(struct device *dev, size_t size,
 {
         void *swiotlb_addr = phys_to_virt(dma_to_phys(dev, dma_handle));
 
+        if (__free_from_pool(vaddr, size))
+                return;
         vunmap(vaddr);
         __dma_free_coherent(dev, size, swiotlb_addr, dma_handle, attrs);
 }
@@ -307,6 +362,67 @@ EXPORT_SYMBOL(coherent_swiotlb_dma_ops);
 
 extern int swiotlb_late_init_with_default_size(size_t default_size);
 
+static int __init atomic_pool_init(void)
+{
+        pgprot_t prot = __pgprot(PROT_NORMAL_NC);
+        unsigned long nr_pages = atomic_pool_size >> PAGE_SHIFT;
+        struct page *page;
+        void *addr;
+        unsigned int pool_size_order = get_order(atomic_pool_size);
+
+        if (dev_get_cma_area(NULL))
+                page = dma_alloc_from_contiguous(NULL, nr_pages,
+                                                        pool_size_order);
+        else
+                page = alloc_pages(GFP_DMA, pool_size_order);
+
+        if (page) {
+                int ret;
+                void *page_addr = page_address(page);
+
+                memset(page_addr, 0, atomic_pool_size);
+                __dma_flush_range(page_addr, page_addr + atomic_pool_size);
+
+                atomic_pool = gen_pool_create(PAGE_SHIFT, -1);
+                if (!atomic_pool)
+                        goto free_page;
+
+                addr = dma_common_contiguous_remap(page, atomic_pool_size,
+                                        VM_USERMAP, prot, atomic_pool_init);
+
+                if (!addr)
+                        goto destroy_genpool;
+
+                ret = gen_pool_add_virt(atomic_pool, (unsigned long)addr,
+                                        page_to_phys(page),
+                                        atomic_pool_size, -1);
+                if (ret)
+                        goto remove_mapping;
+
+                gen_pool_set_algo(atomic_pool,
+                                  gen_pool_first_fit_order_align,
+                                  (void *)PAGE_SHIFT);
+
+                pr_info("DMA: preallocated %zu KiB pool for atomic allocations\n",
+                        atomic_pool_size / 1024);
+                return 0;
+        }
+        goto out;
+
+remove_mapping:
+        dma_common_free_remap(addr, atomic_pool_size, VM_USERMAP);
+destroy_genpool:
+        gen_pool_destroy(atomic_pool);
+        atomic_pool = NULL;
+free_page:
+        if (!dma_release_from_contiguous(NULL, page, nr_pages))
+                __free_pages(page, pool_size_order);
+out:
+        pr_err("DMA: failed to allocate %zu KiB pool for atomic coherent allocation\n",
+                atomic_pool_size / 1024);
+        return -ENOMEM;
+}
+
 static int __init swiotlb_late_init(void)
 {
         size_t swiotlb_size = min(SZ_64M, MAX_ORDER_NR_PAGES << PAGE_SHIFT);
@@ -315,7 +431,17 @@ static int __init swiotlb_late_init(void)
 
         return swiotlb_late_init_with_default_size(swiotlb_size);
 }
-arch_initcall(swiotlb_late_init);
+
+static int __init arm64_dma_init(void)
+{
+        int ret = 0;
+
+        ret |= swiotlb_late_init();
+        ret |= atomic_pool_init();
+
+        return ret;
+}
+arch_initcall(arm64_dma_init);
 
 #define PREALLOC_DMA_DEBUG_ENTRIES      4096
 
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index 0d64089d28b5..b6f14e8d2121 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -104,3 +104,19 @@ EXPORT_SYMBOL(flush_dcache_page);
  */
 EXPORT_SYMBOL(flush_cache_all);
 EXPORT_SYMBOL(flush_icache_range);
+
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#ifdef CONFIG_HAVE_RCU_TABLE_FREE
+void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
+                          pmd_t *pmdp)
+{
+        pmd_t pmd = pmd_mksplitting(*pmdp);
+
+        VM_BUG_ON(address & ~PMD_MASK);
+        set_pmd_at(vma->vm_mm, address, pmdp, pmd);
+
+        /* dummy IPI to serialise against fast_gup */
+        kick_all_cpus_sync();
+}
+#endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
diff --git a/arch/cris/include/asm/Kbuild b/arch/cris/include/asm/Kbuild
index 802b94c4ca86..2ca489eaadd3 100644
--- a/arch/cris/include/asm/Kbuild
+++ b/arch/cris/include/asm/Kbuild
@@ -15,6 +15,7 @@ generic-y += mcs_spinlock.h
 generic-y += module.h
 generic-y += preempt.h
 generic-y += scatterlist.h
+generic-y += sections.h
 generic-y += trace_clock.h
 generic-y += vga.h
 generic-y += xor.h
diff --git a/arch/cris/include/asm/sections.h b/arch/cris/include/asm/sections.h
deleted file mode 100644
index 2c998ce8967b..000000000000
--- a/arch/cris/include/asm/sections.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _CRIS_SECTIONS_H
-#define _CRIS_SECTIONS_H
-
-/* nothing to see, move along */
-#include <asm-generic/sections.h>
-
-#endif
diff --git a/arch/frv/include/asm/processor.h b/arch/frv/include/asm/processor.h
index 6554e78893f2..ae8d423e79d9 100644
--- a/arch/frv/include/asm/processor.h
+++ b/arch/frv/include/asm/processor.h
@@ -35,22 +35,6 @@
 struct task_struct;
 
 /*
- *  CPU type and hardware bug flags. Kept separately for each CPU.
- */
-struct cpuinfo_frv {
-#ifdef CONFIG_MMU
-        unsigned long   *pgd_quick;
-        unsigned long   *pte_quick;
-        unsigned long   pgtable_cache_sz;
-#endif
-} __cacheline_aligned;
-
-extern struct cpuinfo_frv __nongprelbss boot_cpu_data;
-
-#define cpu_data                (&boot_cpu_data)
-#define current_cpu_data        boot_cpu_data
-
-/*
  * Bus types
  */
 #define EISA_bus 0
diff --git a/arch/frv/kernel/irq-mb93091.c b/arch/frv/kernel/irq-mb93091.c
index 2cc327a1ca44..091b2839be90 100644
--- a/arch/frv/kernel/irq-mb93091.c
+++ b/arch/frv/kernel/irq-mb93091.c
@@ -107,25 +107,25 @@ static irqreturn_t fpga_interrupt(int irq, void *_mask)
 static struct irqaction fpga_irq[4]  = {
         [0] = {
                 .handler        = fpga_interrupt,
-                .flags          = IRQF_DISABLED | IRQF_SHARED,
+                .flags          = IRQF_SHARED,
                 .name           = "fpga.0",
                 .dev_id         = (void *) 0x0028UL,
         },
         [1] = {
                 .handler        = fpga_interrupt,
-                .flags          = IRQF_DISABLED | IRQF_SHARED,
+                .flags          = IRQF_SHARED,
                 .name           = "fpga.1",
                 .dev_id         = (void *) 0x0050UL,
         },
         [2] = {
                 .handler        = fpga_interrupt,
-                .flags          = IRQF_DISABLED | IRQF_SHARED,
+                .flags          = IRQF_SHARED,
                 .name           = "fpga.2",
                 .dev_id         = (void *) 0x1c00UL,
         },
         [3] = {
                 .handler        = fpga_interrupt,
-                .flags          = IRQF_DISABLED | IRQF_SHARED,
+                .flags          = IRQF_SHARED,
                 .name           = "fpga.3",
                 .dev_id         = (void *) 0x6386UL,
         }
diff --git a/arch/frv/kernel/irq-mb93093.c b/arch/frv/kernel/irq-mb93093.c
index 95e4eb4f1f38..1f3015cf80f5 100644
--- a/arch/frv/kernel/irq-mb93093.c
+++ b/arch/frv/kernel/irq-mb93093.c
@@ -105,7 +105,6 @@ static irqreturn_t fpga_interrupt(int irq, void *_mask)
 static struct irqaction fpga_irq[1]  = {
         [0] = {
                 .handler        = fpga_interrupt,
-                .flags          = IRQF_DISABLED,
                 .name           = "fpga.0",
                 .dev_id         = (void *) 0x0700UL,
         }
diff --git a/arch/frv/kernel/irq-mb93493.c b/arch/frv/kernel/irq-mb93493.c
index ba648da0932d..8ca5aa4ff595 100644
--- a/arch/frv/kernel/irq-mb93493.c
+++ b/arch/frv/kernel/irq-mb93493.c
@@ -118,13 +118,13 @@ static irqreturn_t mb93493_interrupt(int irq, void *_piqsr)
 static struct irqaction mb93493_irq[2]  = {
         [0] = {
                 .handler        = mb93493_interrupt,
-                .flags          = IRQF_DISABLED | IRQF_SHARED,
+                .flags          = IRQF_SHARED,
                 .name           = "mb93493.0",
                 .dev_id         = (void *) __addr_MB93493_IQSR(0),
         },
         [1] = {
                 .handler        = mb93493_interrupt,
-                .flags          = IRQF_DISABLED | IRQF_SHARED,
+                .flags          = IRQF_SHARED,
                 .name           = "mb93493.1",
                 .dev_id         = (void *) __addr_MB93493_IQSR(1),
         }
diff --git a/arch/frv/kernel/setup.c b/arch/frv/kernel/setup.c
index 9f3a7a62d787..9f4a9a607dbe 100644
--- a/arch/frv/kernel/setup.c
+++ b/arch/frv/kernel/setup.c
@@ -104,8 +104,6 @@ unsigned long __nongprelbss dma_coherent_mem_end;
 unsigned long __initdata __sdram_old_base;
 unsigned long __initdata num_mappedpages;
 
-struct cpuinfo_frv __nongprelbss boot_cpu_data;
-
 char __initdata command_line[COMMAND_LINE_SIZE];
 char __initdata redboot_command_line[COMMAND_LINE_SIZE];
 
diff --git a/arch/frv/kernel/time.c b/arch/frv/kernel/time.c
index b457de496b70..332e00bf9d06 100644
--- a/arch/frv/kernel/time.c
+++ b/arch/frv/kernel/time.c
@@ -44,7 +44,6 @@ static irqreturn_t timer_interrupt(int irq, void *dummy);
 
 static struct irqaction timer_irq  = {
         .handler = timer_interrupt,
-        .flags = IRQF_DISABLED,
         .name = "timer",
 };
 
diff --git a/arch/m32r/include/asm/Kbuild b/arch/m32r/include/asm/Kbuild
index e02448b0648b..3796801d6e0c 100644
--- a/arch/m32r/include/asm/Kbuild
+++ b/arch/m32r/include/asm/Kbuild
@@ -8,4 +8,5 @@ generic-y += mcs_spinlock.h
 generic-y += module.h
 generic-y += preempt.h
 generic-y += scatterlist.h
+generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/m32r/include/asm/sections.h b/arch/m32r/include/asm/sections.h
deleted file mode 100644
index 5e5d21c4908a..000000000000
--- a/arch/m32r/include/asm/sections.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _M32R_SECTIONS_H
-#define _M32R_SECTIONS_H
-
-/* nothing to see, move along */
-#include <asm-generic/sections.h>
-
-#endif  /* _M32R_SECTIONS_H */
diff --git a/arch/m32r/kernel/time.c b/arch/m32r/kernel/time.c
index 1a15f81ea1bd..093f2761aa51 100644
--- a/arch/m32r/kernel/time.c
+++ b/arch/m32r/kernel/time.c
@@ -134,7 +134,6 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id)
 
 static struct irqaction irq0 = {
         .handler = timer_interrupt,
-        .flags = IRQF_DISABLED,
         .name = "MFT2",
 };
 
diff --git a/arch/m68k/kernel/sys_m68k.c b/arch/m68k/kernel/sys_m68k.c
index 3a480b3df0d6..9aa01adb407f 100644
--- a/arch/m68k/kernel/sys_m68k.c
+++ b/arch/m68k/kernel/sys_m68k.c
@@ -376,7 +376,6 @@ cache_flush_060 (unsigned long addr, int scope, int cache, unsigned long len)
 asmlinkage int
 sys_cacheflush (unsigned long addr, int scope, int cache, unsigned long len)
 {
-        struct vm_area_struct *vma;
         int ret = -EINVAL;
 
         if (scope < FLUSH_SCOPE_LINE || scope > FLUSH_SCOPE_ALL ||
@@ -389,17 +388,21 @@ sys_cacheflush (unsigned long addr, int scope, int cache, unsigned long len)
                 if (!capable(CAP_SYS_ADMIN))
                         goto out;
         } else {
+                struct vm_area_struct *vma;
+
+                /* Check for overflow.  */
+                if (addr + len < addr)
+                        goto out;
+
                 /*
                  * Verify that the specified address region actually belongs
                  * to this process.
                  */
-                vma = find_vma (current->mm, addr);
                 ret = -EINVAL;
-                /* Check for overflow.  */
-                if (addr + len < addr)
-                        goto out;
-                if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end)
-                        goto out;
+                down_read(&current->mm->mmap_sem);
+                vma = find_vma(current->mm, addr);
+                if (!vma || addr < vma->vm_start || addr + len > vma->vm_end)
+                        goto out_unlock;
         }
 
         if (CPU_IS_020_OR_030) {
@@ -429,7 +432,7 @@ sys_cacheflush (unsigned long addr, int scope, int cache, unsigned long len)
                         __asm__ __volatile__ ("movec %0, %%cacr" : : "r" (cacr));
                 }
                 ret = 0;
-                goto out;
+                goto out_unlock;
         } else {
             /*
              * 040 or 060: don't blindly trust 'scope', someone could
@@ -446,6 +449,8 @@ sys_cacheflush (unsigned long addr, int scope, int cache, unsigned long len)
                 ret = cache_flush_060 (addr, scope, cache, len);
             }
         }
+out_unlock:
+        up_read(&current->mm->mmap_sem);
 out:
         return ret;
 }
diff --git a/arch/mips/include/asm/suspend.h b/arch/mips/include/asm/suspend.h
deleted file mode 100644
index 3adac3b53d19..000000000000
--- a/arch/mips/include/asm/suspend.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef __ASM_SUSPEND_H
-#define __ASM_SUSPEND_H
-
-/* References to section boundaries */
-extern const void __nosave_begin, __nosave_end;
-
-#endif /* __ASM_SUSPEND_H */
diff --git a/arch/mips/power/cpu.c b/arch/mips/power/cpu.c
index 521e5963df05..2129e67723ff 100644
--- a/arch/mips/power/cpu.c
+++ b/arch/mips/power/cpu.c
@@ -7,7 +7,7 @@
  * Author: Hu Hongbing <huhb@lemote.com>
  *         Wu Zhangjin <wuzhangjin@gmail.com>
  */
-#include <asm/suspend.h>
+#include <asm/sections.h>
 #include <asm/fpu.h>
 #include <asm/dsp.h>
 
diff --git a/arch/mn10300/include/asm/Kbuild b/arch/mn10300/include/asm/Kbuild
index 77eb1a68d13b..54a062cb9f2c 100644
--- a/arch/mn10300/include/asm/Kbuild
+++ b/arch/mn10300/include/asm/Kbuild
@@ -8,4 +8,5 @@ generic-y += irq_work.h
 generic-y += mcs_spinlock.h
 generic-y += preempt.h
 generic-y += scatterlist.h
+generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/mn10300/include/asm/sections.h b/arch/mn10300/include/asm/sections.h
deleted file mode 100644
index 2b8c5160388f..000000000000
--- a/arch/mn10300/include/asm/sections.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sections.h>
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index d98c1ecc3266..f60d4ea8b50c 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -38,10 +38,9 @@ static inline int pte_none(pte_t pte)		{ return (pte_val(pte) & ~_PTE_NONE_MASK)
 static inline pgprot_t pte_pgprot(pte_t pte)    { return __pgprot(pte_val(pte) & PAGE_PROT_BITS); }
 
 #ifdef CONFIG_NUMA_BALANCING
-
 static inline int pte_present(pte_t pte)
 {
-        return pte_val(pte) & (_PAGE_PRESENT | _PAGE_NUMA);
+        return pte_val(pte) & _PAGE_NUMA_MASK;
 }
 
 #define pte_present_nonuma pte_present_nonuma
@@ -50,37 +49,6 @@ static inline int pte_present_nonuma(pte_t pte)
         return pte_val(pte) & (_PAGE_PRESENT);
 }
 
-#define pte_numa pte_numa
-static inline int pte_numa(pte_t pte)
-{
-        return (pte_val(pte) &
-                (_PAGE_NUMA|_PAGE_PRESENT)) == _PAGE_NUMA;
-}
-
-#define pte_mknonnuma pte_mknonnuma
-static inline pte_t pte_mknonnuma(pte_t pte)
-{
-        pte_val(pte) &= ~_PAGE_NUMA;
-        pte_val(pte) |=  _PAGE_PRESENT | _PAGE_ACCESSED;
-        return pte;
-}
-
-#define pte_mknuma pte_mknuma
-static inline pte_t pte_mknuma(pte_t pte)
-{
-        /*
-         * We should not set _PAGE_NUMA on non present ptes. Also clear the
-         * present bit so that hash_page will return 1 and we collect this
-         * as numa fault.
-         */
-        if (pte_present(pte)) {
-                pte_val(pte) |= _PAGE_NUMA;
-                pte_val(pte) &= ~_PAGE_PRESENT;
-        } else
-                VM_BUG_ON(1);
-        return pte;
-}
-
 #define ptep_set_numa ptep_set_numa
 static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
                                  pte_t *ptep)
@@ -92,12 +60,6 @@ static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
         return;
 }
 
-#define pmd_numa pmd_numa
-static inline int pmd_numa(pmd_t pmd)
-{
-        return pte_numa(pmd_pte(pmd));
-}
-
 #define pmdp_set_numa pmdp_set_numa
 static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
                                  pmd_t *pmdp)
@@ -109,16 +71,21 @@ static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
         return;
 }
 
-#define pmd_mknonnuma pmd_mknonnuma
-static inline pmd_t pmd_mknonnuma(pmd_t pmd)
+/*
+ * Generic NUMA pte helpers expect pteval_t and pmdval_t types to exist
+ * which was inherited from x86. For the purposes of powerpc pte_basic_t and
+ * pmd_t are equivalent
+ */
+#define pteval_t pte_basic_t
+#define pmdval_t pmd_t
+static inline pteval_t ptenuma_flags(pte_t pte)
 {
-        return pte_pmd(pte_mknonnuma(pmd_pte(pmd)));
+        return pte_val(pte) & _PAGE_NUMA_MASK;
 }
 
-#define pmd_mknuma pmd_mknuma
-static inline pmd_t pmd_mknuma(pmd_t pmd)
+static inline pmdval_t pmdnuma_flags(pmd_t pmd)
 {
-        return pte_pmd(pte_mknuma(pmd_pte(pmd)));
+        return pmd_val(pmd) & _PAGE_NUMA_MASK;
 }
 
 # else
diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
index 8d1569c29042..e040c3595129 100644
--- a/arch/powerpc/include/asm/pte-common.h
+++ b/arch/powerpc/include/asm/pte-common.h
@@ -98,6 +98,11 @@ extern unsigned long bad_call_to_PMD_PAGE_SIZE(void);
                          _PAGE_USER | _PAGE_ACCESSED | \
                          _PAGE_RW | _PAGE_HWWRITE | _PAGE_DIRTY | _PAGE_EXEC)
 
+#ifdef CONFIG_NUMA_BALANCING
+/* Mask of bits that distinguish present and numa ptes */
+#define _PAGE_NUMA_MASK (_PAGE_NUMA|_PAGE_PRESENT)
+#endif
+
 /*
  * We define 2 sets of base prot bits, one for basic pages (ie,
  * cacheable kernel and user pages) and one for non cacheable
diff --git a/arch/powerpc/kernel/suspend.c b/arch/powerpc/kernel/suspend.c
index 0167d53da30c..a531154cc0f3 100644
--- a/arch/powerpc/kernel/suspend.c
+++ b/arch/powerpc/kernel/suspend.c
@@ -9,9 +9,7 @@
 
 #include <linux/mm.h>
 #include <asm/page.h>
-
-/* References to section boundaries */
-extern const void __nosave_begin, __nosave_end;
+#include <asm/sections.h>
 
 /*
  *      pfn_is_nosave - check if given pfn is in the 'nosave' section
diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
index a7a7537ce1e7..1c4c5accd220 100644
--- a/arch/s390/kernel/suspend.c
+++ b/arch/s390/kernel/suspend.c
@@ -13,14 +13,10 @@
 #include <asm/ipl.h>
 #include <asm/cio.h>
 #include <asm/pci.h>
+#include <asm/sections.h>
 #include "entry.h"
 
 /*
- * References to section boundaries
- */
-extern const void __nosave_begin, __nosave_end;
-
-/*
  * The restore of the saved pages in an hibernation image will set
  * the change and referenced bits in the storage key for each page.
  * Overindication of the referenced bits after an hibernation cycle
diff --git a/arch/score/include/asm/Kbuild b/arch/score/include/asm/Kbuild
index 3fe5681744f1..46461c19f284 100644
--- a/arch/score/include/asm/Kbuild
+++ b/arch/score/include/asm/Kbuild
@@ -10,6 +10,7 @@ generic-y += irq_work.h
 generic-y += mcs_spinlock.h
 generic-y += preempt.h
 generic-y += scatterlist.h
+generic-y += sections.h
 generic-y += trace_clock.h
 generic-y += xor.h
 generic-y += serial.h
diff --git a/arch/score/include/asm/sections.h b/arch/score/include/asm/sections.h
deleted file mode 100644
index 9441d23af005..000000000000
--- a/arch/score/include/asm/sections.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_SCORE_SECTIONS_H
-#define _ASM_SCORE_SECTIONS_H
-
-#include <asm-generic/sections.h>
-
-#endif /* _ASM_SCORE_SECTIONS_H */
diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h
index 1b6199740e98..7a99e6af6372 100644
--- a/arch/sh/include/asm/sections.h
+++ b/arch/sh/include/asm/sections.h
@@ -3,7 +3,6 @@
 
 #include <asm-generic/sections.h>
 
-extern long __nosave_begin, __nosave_end;
 extern long __machvec_start, __machvec_end;
 extern char __uncached_start, __uncached_end;
 extern char __start_eh_frame[], __stop_eh_frame[];
diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c
index 42b0b8ce699a..17bd2e167e07 100644
--- a/arch/sparc/power/hibernate.c
+++ b/arch/sparc/power/hibernate.c
@@ -9,11 +9,9 @@
 #include <asm/hibernate.h>
 #include <asm/visasm.h>
 #include <asm/page.h>
+#include <asm/sections.h>
 #include <asm/tlb.h>
 
-/* References to section boundaries */
-extern const void __nosave_begin, __nosave_end;
-
 struct saved_context saved_context;
 
 /*
diff --git a/arch/unicore32/include/mach/pm.h b/arch/unicore32/include/mach/pm.h
index 4dcd34ae194c..77b522694e74 100644
--- a/arch/unicore32/include/mach/pm.h
+++ b/arch/unicore32/include/mach/pm.h
@@ -36,8 +36,5 @@ extern int puv3_pm_enter(suspend_state_t state);
 /* Defined in hibernate_asm.S */
 extern int restore_image(pgd_t *resume_pg_dir, struct pbe *restore_pblist);
 
-/* References to section boundaries */
-extern const void __nosave_begin, __nosave_end;
-
 extern struct pbe *restore_pblist;
 #endif
diff --git a/arch/unicore32/kernel/hibernate.c b/arch/unicore32/kernel/hibernate.c
index d75ef8b6cb56..9969ec374abb 100644
--- a/arch/unicore32/kernel/hibernate.c
+++ b/arch/unicore32/kernel/hibernate.c
@@ -18,6 +18,7 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
+#include <asm/sections.h>
 #include <asm/suspend.h>
 
 #include "mach/pm.h"
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e4b1f431c7ed..3eb8a41509b3 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -30,7 +30,6 @@ config X86
         select HAVE_UNSTABLE_SCHED_CLOCK
         select ARCH_SUPPORTS_NUMA_BALANCING if X86_64
         select ARCH_SUPPORTS_INT128 if X86_64
-        select ARCH_WANTS_PROT_NUMA_PROT_NONE
         select HAVE_IDE
         select HAVE_OPROFILE
         select HAVE_PCSPKR_PLATFORM
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index f216963760e5..0f9724c9c510 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -325,6 +325,20 @@ static inline pteval_t pte_flags(pte_t pte)
         return native_pte_val(pte) & PTE_FLAGS_MASK;
 }
 
+#ifdef CONFIG_NUMA_BALANCING
+/* Set of bits that distinguishes present, prot_none and numa ptes */
+#define _PAGE_NUMA_MASK (_PAGE_NUMA|_PAGE_PROTNONE|_PAGE_PRESENT)
+static inline pteval_t ptenuma_flags(pte_t pte)
+{
+        return pte_flags(pte) & _PAGE_NUMA_MASK;
+}
+
+static inline pmdval_t pmdnuma_flags(pmd_t pmd)
+{
+        return pmd_flags(pmd) & _PAGE_NUMA_MASK;
+}
+#endif /* CONFIG_NUMA_BALANCING */
+
 #define pgprot_val(x)   ((x).pgprot)
 #define __pgprot(x)     ((pgprot_t) { (x) } )
 
diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c
index 7d28c885d238..291226b952a9 100644
--- a/arch/x86/power/hibernate_32.c
+++ b/arch/x86/power/hibernate_32.c
@@ -13,13 +13,11 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/mmzone.h>
+#include <asm/sections.h>
 
 /* Defined in hibernate_asm_32.S */
 extern int restore_image(void);
 
-/* References to section boundaries */
-extern const void __nosave_begin, __nosave_end;
-
 /* Pointer to the temporary resume page tables */
 pgd_t *resume_pg_dir;
 
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index 35e2bb6c0f37..009947d419a6 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -17,11 +17,9 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/mtrr.h>
+#include <asm/sections.h>
 #include <asm/suspend.h>
 
-/* References to section boundaries */
-extern __visible const void __nosave_begin, __nosave_end;
-
 /* Defined in hibernate_asm_64.S */
 extern asmlinkage __visible int restore_image(void);
 
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 134f763d90fd..61a33f4ba608 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -252,6 +252,9 @@ config DMA_CMA
           to allocate big physically-contiguous blocks of memory for use with
           hardware components that do not support I/O map nor scatter-gather.
 
+          You can disable CMA by specifying "cma=0" on the kernel's command
+          line.
+
           For more information see <include/linux/dma-contiguous.h>.
           If unsure, say "n".
 
diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
index 6cd08e145bfa..9e8bbdd470ca 100644
--- a/drivers/base/dma-mapping.c
+++ b/drivers/base/dma-mapping.c
@@ -10,6 +10,8 @@
 #include <linux/dma-mapping.h>
 #include <linux/export.h>
 #include <linux/gfp.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <asm-generic/dma-coherent.h>
 
 /*
@@ -267,3 +269,73 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
         return ret;
 }
 EXPORT_SYMBOL(dma_common_mmap);
+
+#ifdef CONFIG_MMU
+/*
+ * remaps an array of PAGE_SIZE pages into another vm_area
+ * Cannot be used in non-sleeping contexts
+ */
+void *dma_common_pages_remap(struct page **pages, size_t size,
+                        unsigned long vm_flags, pgprot_t prot,
+                        const void *caller)
+{
+        struct vm_struct *area;
+
+        area = get_vm_area_caller(size, vm_flags, caller);
+        if (!area)
+                return NULL;
+
+        area->pages = pages;
+
+        if (map_vm_area(area, prot, pages)) {
+                vunmap(area->addr);
+                return NULL;
+        }
+
+        return area->addr;
+}
+
+/*
+ * remaps an allocated contiguous region into another vm_area.
+ * Cannot be used in non-sleeping contexts
+ */
+
+void *dma_common_contiguous_remap(struct page *page, size_t size,
+                        unsigned long vm_flags,
+                        pgprot_t prot, const void *caller)
+{
+        int i;
+        struct page **pages;
+        void *ptr;
+        unsigned long pfn;
+
+        pages = kmalloc(sizeof(struct page *) << get_order(size), GFP_KERNEL);
+        if (!pages)
+                return NULL;
+
+        for (i = 0, pfn = page_to_pfn(page); i < (size >> PAGE_SHIFT); i++)
+                pages[i] = pfn_to_page(pfn + i);
+
+        ptr = dma_common_pages_remap(pages, size, vm_flags, prot, caller);
+
+        kfree(pages);
+
+        return ptr;
+}
+
+/*
+ * unmaps a range previously mapped by dma_common_*_remap
+ */
+void dma_common_free_remap(void *cpu_addr, size_t size, unsigned long vm_flags)
+{
+        struct vm_struct *area = find_vm_area(cpu_addr);
+
+        if (!area || (area->flags & vm_flags) != vm_flags) {
+                WARN(1, "trying to free invalid coherent area: %p\n", cpu_addr);
+                return;
+        }
+
+        unmap_kernel_range((unsigned long)cpu_addr, size);
+        vunmap(cpu_addr);
+}
+#endif
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index a2e13e250bba..7c5d87191b28 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -373,6 +373,45 @@ static ssize_t show_phys_device(struct device *dev,
         return sprintf(buf, "%d\n", mem->phys_device);
 }
 
+#ifdef CONFIG_MEMORY_HOTREMOVE
+static ssize_t show_valid_zones(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct memory_block *mem = to_memory_block(dev);
+        unsigned long start_pfn, end_pfn;
+        unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
+        struct page *first_page;
+        struct zone *zone;
+
+        start_pfn = section_nr_to_pfn(mem->start_section_nr);
+        end_pfn = start_pfn + nr_pages;
+        first_page = pfn_to_page(start_pfn);
+
+        /* The block contains more than one zone can not be offlined. */
+        if (!test_pages_in_a_zone(start_pfn, end_pfn))
+                return sprintf(buf, "none\n");
+
+        zone = page_zone(first_page);
+
+        if (zone_idx(zone) == ZONE_MOVABLE - 1) {
+                /*The mem block is the last memoryblock of this zone.*/
+                if (end_pfn == zone_end_pfn(zone))
+                        return sprintf(buf, "%s %s\n",
+                                        zone->name, (zone + 1)->name);
+        }
+
+        if (zone_idx(zone) == ZONE_MOVABLE) {
+                /*The mem block is the first memoryblock of ZONE_MOVABLE.*/
+                if (start_pfn == zone->zone_start_pfn)
+                        return sprintf(buf, "%s %s\n",
+                                        zone->name, (zone - 1)->name);
+        }
+
+        return sprintf(buf, "%s\n", zone->name);
+}
+static DEVICE_ATTR(valid_zones, 0444, show_valid_zones, NULL);
+#endif
+
 static DEVICE_ATTR(phys_index, 0444, show_mem_start_phys_index, NULL);
 static DEVICE_ATTR(state, 0644, show_mem_state, store_mem_state);
 static DEVICE_ATTR(phys_device, 0444, show_phys_device, NULL);
@@ -523,6 +562,9 @@ static struct attribute *memory_memblk_attrs[] = {
         &dev_attr_state.attr,
         &dev_attr_phys_device.attr,
         &dev_attr_removable.attr,
+#ifdef CONFIG_MEMORY_HOTREMOVE
+        &dev_attr_valid_zones.attr,
+#endif
         NULL
 };
 
diff --git a/drivers/base/node.c b/drivers/base/node.c
index d51c49c9bafa..472168cd0c97 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -289,8 +289,6 @@ static int register_node(struct node *node, int num, struct node *parent)
                 device_create_file(&node->dev, &dev_attr_distance);
                 device_create_file(&node->dev, &dev_attr_vmstat);
 
-                scan_unevictable_register_node(node);
-
                 hugetlb_register_node(node);
 
                 compaction_register_node(node);
@@ -314,7 +312,6 @@ void unregister_node(struct node *node)
         device_remove_file(&node->dev, &dev_attr_distance);
         device_remove_file(&node->dev, &dev_attr_vmstat);
 
-        scan_unevictable_unregister_node(node);
         hugetlb_unregister_node(node);          /* no-op, if memoryless node */
 
         device_unregister(&node->dev);
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index d00831c3d731..3b850164c65c 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -103,10 +103,10 @@ static ssize_t mem_used_total_show(struct device *dev,
 
         down_read(&zram->init_lock);
         if (init_done(zram))
-                val = zs_get_total_size_bytes(meta->mem_pool);
+                val = zs_get_total_pages(meta->mem_pool);
         up_read(&zram->init_lock);
 
-        return scnprintf(buf, PAGE_SIZE, "%llu\n", val);
+        return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT);
 }
 
 static ssize_t max_comp_streams_show(struct device *dev,
@@ -122,6 +122,72 @@ static ssize_t max_comp_streams_show(struct device *dev,
         return scnprintf(buf, PAGE_SIZE, "%d\n", val);
 }
 
+static ssize_t mem_limit_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        u64 val;
+        struct zram *zram = dev_to_zram(dev);
+
+        down_read(&zram->init_lock);
+        val = zram->limit_pages;
+        up_read(&zram->init_lock);
+
+        return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT);
+}
+
+static ssize_t mem_limit_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t len)
+{
+        u64 limit;
+        char *tmp;
+        struct zram *zram = dev_to_zram(dev);
+
+        limit = memparse(buf, &tmp);
+        if (buf == tmp) /* no chars parsed, invalid input */
+                return -EINVAL;
+
+        down_write(&zram->init_lock);
+        zram->limit_pages = PAGE_ALIGN(limit) >> PAGE_SHIFT;
+        up_write(&zram->init_lock);
+
+        return len;
+}
+
+static ssize_t mem_used_max_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        u64 val = 0;
+        struct zram *zram = dev_to_zram(dev);
+
+        down_read(&zram->init_lock);
+        if (init_done(zram))
+                val = atomic_long_read(&zram->stats.max_used_pages);
+        up_read(&zram->init_lock);
+
+        return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT);
+}
+
+static ssize_t mem_used_max_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t len)
+{
+        int err;
+        unsigned long val;
+        struct zram *zram = dev_to_zram(dev);
+        struct zram_meta *meta = zram->meta;
+
+        err = kstrtoul(buf, 10, &val);
+        if (err || val != 0)
+                return -EINVAL;
+
+        down_read(&zram->init_lock);
+        if (init_done(zram))
+                atomic_long_set(&zram->stats.max_used_pages,
+                                zs_get_total_pages(meta->mem_pool));
+        up_read(&zram->init_lock);
+
+        return len;
+}
+
 static ssize_t max_comp_streams_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t len)
 {
@@ -434,6 +500,21 @@ out_cleanup:
         return ret;
 }
 
+static inline void update_used_max(struct zram *zram,
+                                        const unsigned long pages)
+{
+        int old_max, cur_max;
+
+        old_max = atomic_long_read(&zram->stats.max_used_pages);
+
+        do {
+                cur_max = old_max;
+                if (pages > cur_max)
+                        old_max = atomic_long_cmpxchg(
+                                &zram->stats.max_used_pages, cur_max, pages);
+        } while (old_max != cur_max);
+}
+
 static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                            int offset)
 {
@@ -445,6 +526,7 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         struct zram_meta *meta = zram->meta;
         struct zcomp_strm *zstrm;
         bool locked = false;
+        unsigned long alloced_pages;
 
         page = bvec->bv_page;
         if (is_partial_io(bvec)) {
@@ -513,6 +595,16 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                 ret = -ENOMEM;
                 goto out;
         }
+
+        alloced_pages = zs_get_total_pages(meta->mem_pool);
+        if (zram->limit_pages && alloced_pages > zram->limit_pages) {
+                zs_free(meta->mem_pool, handle);
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        update_used_max(zram, alloced_pages);
+
         cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_WO);
 
         if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
@@ -606,6 +698,7 @@ static void zram_bio_discard(struct zram *zram, u32 index,
                 bit_spin_lock(ZRAM_ACCESS, &meta->table[index].value);
                 zram_free_page(zram, index);
                 bit_spin_unlock(ZRAM_ACCESS, &meta->table[index].value);
+                atomic64_inc(&zram->stats.notify_free);
                 index++;
                 n -= PAGE_SIZE;
         }
@@ -617,6 +710,9 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
         struct zram_meta *meta;
 
         down_write(&zram->init_lock);
+
+        zram->limit_pages = 0;
+
         if (!init_done(zram)) {
                 up_write(&zram->init_lock);
                 return;
@@ -857,6 +953,10 @@ static DEVICE_ATTR(initstate, S_IRUGO, initstate_show, NULL);
 static DEVICE_ATTR(reset, S_IWUSR, NULL, reset_store);
 static DEVICE_ATTR(orig_data_size, S_IRUGO, orig_data_size_show, NULL);
 static DEVICE_ATTR(mem_used_total, S_IRUGO, mem_used_total_show, NULL);
+static DEVICE_ATTR(mem_limit, S_IRUGO | S_IWUSR, mem_limit_show,
+                mem_limit_store);
+static DEVICE_ATTR(mem_used_max, S_IRUGO | S_IWUSR, mem_used_max_show,
+                mem_used_max_store);
 static DEVICE_ATTR(max_comp_streams, S_IRUGO | S_IWUSR,
                 max_comp_streams_show, max_comp_streams_store);
 static DEVICE_ATTR(comp_algorithm, S_IRUGO | S_IWUSR,
@@ -885,6 +985,8 @@ static struct attribute *zram_disk_attrs[] = {
         &dev_attr_orig_data_size.attr,
         &dev_attr_compr_data_size.attr,
         &dev_attr_mem_used_total.attr,
+        &dev_attr_mem_limit.attr,
+        &dev_attr_mem_used_max.attr,
         &dev_attr_max_comp_streams.attr,
         &dev_attr_comp_algorithm.attr,
         NULL,
diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h
index e0f725c87cc6..c6ee271317f5 100644
--- a/drivers/block/zram/zram_drv.h
+++ b/drivers/block/zram/zram_drv.h
@@ -90,6 +90,7 @@ struct zram_stats {
         atomic64_t notify_free; /* no. of swap slot free notifications */
         atomic64_t zero_pages;          /* no. of zero filled pages */
         atomic64_t pages_stored;        /* no. of pages currently stored */
+        atomic_long_t max_used_pages;   /* no. of maximum pages stored */
 };
 
 struct zram_meta {
@@ -112,6 +113,11 @@ struct zram {
         u64 disksize;   /* bytes */
         int max_comp_streams;
         struct zram_stats stats;
+        /*
+         * the number of pages zram can consume for storing compressed data
+         */
+        unsigned long limit_pages;
+
         char compressor[10];
 };
 #endif
diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
index 79f18e6d9c4f..cc016c615c19 100644
--- a/drivers/firmware/memmap.c
+++ b/drivers/firmware/memmap.c
@@ -184,6 +184,9 @@ static int add_sysfs_fw_map_entry(struct firmware_map_entry *entry)
         static int map_entries_nr;
         static struct kset *mmap_kset;
 
+        if (entry->kobj.state_in_sysfs)
+                return -EEXIST;
+
         if (!mmap_kset) {
                 mmap_kset = kset_create_and_add("memmap", NULL, firmware_kobj);
                 if (!mmap_kset)
diff --git a/drivers/virtio/Kconfig b/drivers/virtio/Kconfig
index c6683f2e396c..00b228638274 100644
--- a/drivers/virtio/Kconfig
+++ b/drivers/virtio/Kconfig
@@ -25,6 +25,7 @@ config VIRTIO_PCI
 config VIRTIO_BALLOON
         tristate "Virtio balloon driver"
         depends on VIRTIO
+        select MEMORY_BALLOON
         ---help---
          This driver supports increasing and decreasing the amount
          of memory within a KVM guest.
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 25ebe8eecdb7..f893148a107b 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -59,7 +59,7 @@ struct virtio_balloon
          * Each page on this list adds VIRTIO_BALLOON_PAGES_PER_PAGE
          * to num_pages above.
          */
-        struct balloon_dev_info *vb_dev_info;
+        struct balloon_dev_info vb_dev_info;
 
         /* Synchronize access/update to this struct virtio_balloon elements */
         struct mutex balloon_lock;
@@ -127,7 +127,7 @@ static void set_page_pfns(u32 pfns[], struct page *page)
 
 static void fill_balloon(struct virtio_balloon *vb, size_t num)
 {
-        struct balloon_dev_info *vb_dev_info = vb->vb_dev_info;
+        struct balloon_dev_info *vb_dev_info = &vb->vb_dev_info;
 
         /* We can only do one array worth at a time. */
         num = min(num, ARRAY_SIZE(vb->pfns));
@@ -163,15 +163,15 @@ static void release_pages_by_pfn(const u32 pfns[], unsigned int num)
         /* Find pfns pointing at start of each page, get pages and free them. */
         for (i = 0; i < num; i += VIRTIO_BALLOON_PAGES_PER_PAGE) {
                 struct page *page = balloon_pfn_to_page(pfns[i]);
-                balloon_page_free(page);
                 adjust_managed_page_count(page, 1);
+                put_page(page); /* balloon reference */
         }
 }
 
 static void leak_balloon(struct virtio_balloon *vb, size_t num)
 {
         struct page *page;
-        struct balloon_dev_info *vb_dev_info = vb->vb_dev_info;
+        struct balloon_dev_info *vb_dev_info = &vb->vb_dev_info;
 
         /* We can only do one array worth at a time. */
         num = min(num, ARRAY_SIZE(vb->pfns));
@@ -353,12 +353,11 @@ static int init_vqs(struct virtio_balloon *vb)
         return 0;
 }
 
-static const struct address_space_operations virtio_balloon_aops;
 #ifdef CONFIG_BALLOON_COMPACTION
 /*
  * virtballoon_migratepage - perform the balloon page migration on behalf of
  *                           a compation thread.     (called under page lock)
- * @mapping: the page->mapping which will be assigned to the new migrated page.
+ * @vb_dev_info: the balloon device
  * @newpage: page that will replace the isolated page after migration finishes.
  * @page   : the isolated (old) page that is about to be migrated to newpage.
  * @mode   : compaction mode -- not used for balloon page migration.
@@ -373,17 +372,13 @@ static const struct address_space_operations virtio_balloon_aops;
  * This function preforms the balloon page migration task.
  * Called through balloon_mapping->a_ops->migratepage
  */
-static int virtballoon_migratepage(struct address_space *mapping,
+static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info,
                 struct page *newpage, struct page *page, enum migrate_mode mode)
 {
-        struct balloon_dev_info *vb_dev_info = balloon_page_device(page);
-        struct virtio_balloon *vb;
+        struct virtio_balloon *vb = container_of(vb_dev_info,
+                        struct virtio_balloon, vb_dev_info);
         unsigned long flags;
 
-        BUG_ON(!vb_dev_info);
-
-        vb = vb_dev_info->balloon_device;
-
         /*
          * In order to avoid lock contention while migrating pages concurrently
          * to leak_balloon() or fill_balloon() we just give up the balloon_lock
@@ -395,21 +390,19 @@ static int virtballoon_migratepage(struct address_space *mapping,
         if (!mutex_trylock(&vb->balloon_lock))
                 return -EAGAIN;
 
+        get_page(newpage); /* balloon reference */
+
         /* balloon's page migration 1st step  -- inflate "newpage" */
         spin_lock_irqsave(&vb_dev_info->pages_lock, flags);
-        balloon_page_insert(newpage, mapping, &vb_dev_info->pages);
+        balloon_page_insert(vb_dev_info, newpage);
         vb_dev_info->isolated_pages--;
+        __count_vm_event(BALLOON_MIGRATE);
         spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags);
         vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
         set_page_pfns(vb->pfns, newpage);
         tell_host(vb, vb->inflate_vq);
 
-        /*
-         * balloon's page migration 2nd step -- deflate "page"
-         *
-         * It's safe to delete page->lru here because this page is at
-         * an isolated migration list, and this step is expected to happen here
-         */
+        /* balloon's page migration 2nd step -- deflate "page" */
         balloon_page_delete(page);
         vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
         set_page_pfns(vb->pfns, page);
@@ -417,20 +410,15 @@ static int virtballoon_migratepage(struct address_space *mapping,
 
         mutex_unlock(&vb->balloon_lock);
 
-        return MIGRATEPAGE_BALLOON_SUCCESS;
-}
+        put_page(page); /* balloon reference */
 
-/* define the balloon_mapping->a_ops callback to allow balloon page migration */
-static const struct address_space_operations virtio_balloon_aops = {
-                        .migratepage = virtballoon_migratepage,
-};
+        return MIGRATEPAGE_SUCCESS;
+}
 #endif /* CONFIG_BALLOON_COMPACTION */
 
 static int virtballoon_probe(struct virtio_device *vdev)
 {
         struct virtio_balloon *vb;
-        struct address_space *vb_mapping;
-        struct balloon_dev_info *vb_devinfo;
         int err;
 
         vdev->priv = vb = kmalloc(sizeof(*vb), GFP_KERNEL);
@@ -446,30 +434,14 @@ static int virtballoon_probe(struct virtio_device *vdev)
         vb->vdev = vdev;
         vb->need_stats_update = 0;
 
-        vb_devinfo = balloon_devinfo_alloc(vb);
-        if (IS_ERR(vb_devinfo)) {
-                err = PTR_ERR(vb_devinfo);
-                goto out_free_vb;
-        }
-
-        vb_mapping = balloon_mapping_alloc(vb_devinfo,
-                                           (balloon_compaction_check()) ?
-                                           &virtio_balloon_aops : NULL);
-        if (IS_ERR(vb_mapping)) {
-                /*
-                 * IS_ERR(vb_mapping) && PTR_ERR(vb_mapping) == -EOPNOTSUPP
-                 * This means !CONFIG_BALLOON_COMPACTION, otherwise we get off.
-                 */
-                err = PTR_ERR(vb_mapping);
-                if (err != -EOPNOTSUPP)
-                        goto out_free_vb_devinfo;
-        }
-
-        vb->vb_dev_info = vb_devinfo;
+        balloon_devinfo_init(&vb->vb_dev_info);
+#ifdef CONFIG_BALLOON_COMPACTION
+        vb->vb_dev_info.migratepage = virtballoon_migratepage;
+#endif
 
         err = init_vqs(vb);
         if (err)
-                goto out_free_vb_mapping;
+                goto out_free_vb;
 
         vb->thread = kthread_run(balloon, vb, "vballoon");
         if (IS_ERR(vb->thread)) {
@@ -481,10 +453,6 @@ static int virtballoon_probe(struct virtio_device *vdev)
 
 out_del_vqs:
         vdev->config->del_vqs(vdev);
-out_free_vb_mapping:
-        balloon_mapping_free(vb_mapping);
-out_free_vb_devinfo:
-        balloon_devinfo_free(vb_devinfo);
 out_free_vb:
         kfree(vb);
 out:
@@ -510,8 +478,6 @@ static void virtballoon_remove(struct virtio_device *vdev)
 
         kthread_stop(vb->thread);
         remove_common(vb);
-        balloon_mapping_free(vb->vb_dev_info->mapping);
-        balloon_devinfo_free(vb->vb_dev_info);
         kfree(vb);
 }
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 6d7274619bf9..e2f3ad0879ce 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -304,6 +304,12 @@ static int blkdev_readpage(struct file * file, struct page * page)
         return block_read_full_page(page, blkdev_get_block);
 }
 
+static int blkdev_readpages(struct file *file, struct address_space *mapping,
+                        struct list_head *pages, unsigned nr_pages)
+{
+        return mpage_readpages(mapping, pages, nr_pages, blkdev_get_block);
+}
+
 static int blkdev_write_begin(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned flags,
                         struct page **pagep, void **fsdata)
@@ -1622,6 +1628,7 @@ static int blkdev_releasepage(struct page *page, gfp_t wait)
 
 static const struct address_space_operations def_blk_aops = {
         .readpage       = blkdev_readpage,
+        .readpages      = blkdev_readpages,
         .writepage      = blkdev_writepage,
         .write_begin    = blkdev_write_begin,
         .write_end      = blkdev_write_end,
diff --git a/fs/buffer.c b/fs/buffer.c
index 3588a80854b2..44c14a87750e 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1253,7 +1253,7 @@ static struct buffer_head *__bread_slow(struct buffer_head *bh)
  * a local interrupt disable for that.
  */
 
-#define BH_LRU_SIZE     8
+#define BH_LRU_SIZE     16
 
 struct bh_lru {
         struct buffer_head *bhs[BH_LRU_SIZE];
@@ -2956,7 +2956,7 @@ static void end_bio_bh_io_sync(struct bio *bio, int err)
 
 /*
  * This allows us to do IO even on the odd last sectors
- * of a device, even if the bh block size is some multiple
+ * of a device, even if the block size is some multiple
  * of the physical sector size.
  *
  * We'll just truncate the bio to the size of the device,
@@ -2966,10 +2966,11 @@ static void end_bio_bh_io_sync(struct bio *bio, int err)
  * errors, this only handles the "we need to be able to
  * do IO at the final sector" case.
  */
-static void guard_bh_eod(int rw, struct bio *bio, struct buffer_head *bh)
+void guard_bio_eod(int rw, struct bio *bio)
 {
         sector_t maxsector;
-        unsigned bytes;
+        struct bio_vec *bvec = &bio->bi_io_vec[bio->bi_vcnt - 1];
+        unsigned truncated_bytes;
 
         maxsector = i_size_read(bio->bi_bdev->bd_inode) >> 9;
         if (!maxsector)
@@ -2984,23 +2985,20 @@ static void guard_bh_eod(int rw, struct bio *bio, struct buffer_head *bh)
                 return;
 
         maxsector -= bio->bi_iter.bi_sector;
-        bytes = bio->bi_iter.bi_size;
-        if (likely((bytes >> 9) <= maxsector))
+        if (likely((bio->bi_iter.bi_size >> 9) <= maxsector))
                 return;
 
-        /* Uhhuh. We've got a bh that straddles the device size! */
-        bytes = maxsector << 9;
+        /* Uhhuh. We've got a bio that straddles the device size! */
+        truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9);
 
         /* Truncate the bio.. */
-        bio->bi_iter.bi_size = bytes;
-        bio->bi_io_vec[0].bv_len = bytes;
+        bio->bi_iter.bi_size -= truncated_bytes;
+        bvec->bv_len -= truncated_bytes;
 
         /* ..and clear the end of the buffer for reads */
         if ((rw & RW_MASK) == READ) {
-                void *kaddr = kmap_atomic(bh->b_page);
-                memset(kaddr + bh_offset(bh) + bytes, 0, bh->b_size - bytes);
-                kunmap_atomic(kaddr);
-                flush_dcache_page(bh->b_page);
+                zero_user(bvec->bv_page, bvec->bv_offset + bvec->bv_len,
+                                truncated_bytes);
         }
 }
 
@@ -3041,7 +3039,7 @@ int _submit_bh(int rw, struct buffer_head *bh, unsigned long bio_flags)
         bio->bi_flags |= bio_flags;
 
         /* Take care of bh's that straddle the end of the device */
-        guard_bh_eod(rw, bio, bh);
+        guard_bio_eod(rw, bio);
 
         if (buffer_meta(bh))
                 rw |= REQ_META;
diff --git a/fs/internal.h b/fs/internal.h
index e325b4f9c799..b2623200107b 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -35,6 +35,11 @@ static inline int __sync_blockdev(struct block_device *bdev, int wait)
 #endif
 
 /*
+ * buffer.c
+ */
+extern void guard_bio_eod(int rw, struct bio *bio);
+
+/*
  * char_dev.c
  */
 extern void __init chrdev_init(void);
diff --git a/fs/mpage.c b/fs/mpage.c
index 5f9ed622274f..3e79220babac 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -28,6 +28,7 @@
 #include <linux/backing-dev.h>
 #include <linux/pagevec.h>
 #include <linux/cleancache.h>
+#include "internal.h"
 
 /*
  * I/O completion handler for multipage BIOs.
@@ -57,6 +58,7 @@ static void mpage_end_io(struct bio *bio, int err)
 static struct bio *mpage_bio_submit(int rw, struct bio *bio)
 {
         bio->bi_end_io = mpage_end_io;
+        guard_bio_eod(rw, bio);
         submit_bio(rw, bio);
         return NULL;
 }
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index b13992a41bd9..c991616acca9 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -78,7 +78,7 @@ static int create_fd(struct fsnotify_group *group,
 
         pr_debug("%s: group=%p event=%p\n", __func__, group, event);
 
-        client_fd = get_unused_fd();
+        client_fd = get_unused_fd_flags(group->fanotify_data.f_flags);
         if (client_fd < 0)
                 return client_fd;
 
diff --git a/fs/notify/fsnotify.h b/fs/notify/fsnotify.h
index 85e7d2b431d9..9c0898c4cfe1 100644
--- a/fs/notify/fsnotify.h
+++ b/fs/notify/fsnotify.h
@@ -23,9 +23,6 @@ extern int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
                                       struct fsnotify_group *group, struct vfsmount *mnt,
                                       int allow_dups);
 
-/* final kfree of a group */
-extern void fsnotify_final_destroy_group(struct fsnotify_group *group);
-
 /* vfsmount specific destruction of a mark */
 extern void fsnotify_destroy_vfsmount_mark(struct fsnotify_mark *mark);
 /* inode specific destruction of a mark */
diff --git a/fs/notify/group.c b/fs/notify/group.c
index ad1995980456..d16b62cb2854 100644
--- a/fs/notify/group.c
+++ b/fs/notify/group.c
@@ -31,7 +31,7 @@
 /*
  * Final freeing of a group
  */
-void fsnotify_final_destroy_group(struct fsnotify_group *group)
+static void fsnotify_final_destroy_group(struct fsnotify_group *group)
 {
         if (group->ops->free_group_priv)
                 group->ops->free_group_priv(group);
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 0f88bc0b4e6c..7d888d77d59a 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -165,8 +165,10 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
         /* ideally the idr is empty and we won't hit the BUG in the callback */
         idr_for_each(&group->inotify_data.idr, idr_callback, group);
         idr_destroy(&group->inotify_data.idr);
-        atomic_dec(&group->inotify_data.user->inotify_devs);
-        free_uid(group->inotify_data.user);
+        if (group->inotify_data.user) {
+                atomic_dec(&group->inotify_data.user->inotify_devs);
+                free_uid(group->inotify_data.user);
+        }
 }
 
 static void inotify_free_event(struct fsnotify_event *fsn_event)
diff --git a/fs/ntfs/debug.c b/fs/ntfs/debug.c
index dd6103cc93c1..825a54e8f490 100644
--- a/fs/ntfs/debug.c
+++ b/fs/ntfs/debug.c
@@ -112,7 +112,7 @@ void __ntfs_error(const char *function, const struct super_block *sb,
 /* If 1, output debug messages, and if 0, don't. */
 int debug_msgs = 0;
 
-void __ntfs_debug (const char *file, int line, const char *function,
+void __ntfs_debug(const char *file, int line, const char *function,
                 const char *fmt, ...)
 {
         struct va_format vaf;
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index f5ec1ce7a532..643faa44f22b 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -1,7 +1,7 @@
 /*
  * file.c - NTFS kernel file operations.  Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
+ * Copyright (c) 2001-2014 Anton Altaparmakov and Tuxera Inc.
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -410,7 +410,8 @@ static inline int __ntfs_grab_cache_pages(struct address_space *mapping,
         BUG_ON(!nr_pages);
         err = nr = 0;
         do {
-                pages[nr] = find_lock_page(mapping, index);
+                pages[nr] = find_get_page_flags(mapping, index, FGP_LOCK |
+                                FGP_ACCESSED);
                 if (!pages[nr]) {
                         if (!*cached_page) {
                                 *cached_page = page_cache_alloc(mapping);
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 6c3296e546c3..9e1e112074fb 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -3208,7 +3208,7 @@ static void __exit exit_ntfs_fs(void)
 }
 
 MODULE_AUTHOR("Anton Altaparmakov <anton@tuxera.com>");
-MODULE_DESCRIPTION("NTFS 1.2/3.x driver - Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.");
+MODULE_DESCRIPTION("NTFS 1.2/3.x driver - Copyright (c) 2001-2014 Anton Altaparmakov and Tuxera Inc.");
 MODULE_VERSION(NTFS_VERSION);
 MODULE_LICENSE("GPL");
 #ifdef DEBUG
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 4a231a166cf8..1ef547e49373 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1481,8 +1481,16 @@ static int ocfs2_write_begin_inline(struct address_space *mapping,
         handle_t *handle;
         struct ocfs2_dinode *di = (struct ocfs2_dinode *)wc->w_di_bh->b_data;
 
+        handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                mlog_errno(ret);
+                goto out;
+        }
+
         page = find_or_create_page(mapping, 0, GFP_NOFS);
         if (!page) {
+                ocfs2_commit_trans(osb, handle);
                 ret = -ENOMEM;
                 mlog_errno(ret);
                 goto out;
@@ -1494,13 +1502,6 @@ static int ocfs2_write_begin_inline(struct address_space *mapping,
         wc->w_pages[0] = wc->w_target_page = page;
         wc->w_num_pages = 1;
 
-        handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                mlog_errno(ret);
-                goto out;
-        }
-
         ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), wc->w_di_bh,
                                       OCFS2_JOURNAL_ACCESS_WRITE);
         if (ret) {
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 73039295d0d1..d13385448168 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -2572,6 +2572,25 @@ int o2hb_check_node_heartbeating(u8 node_num)
 }
 EXPORT_SYMBOL_GPL(o2hb_check_node_heartbeating);
 
+int o2hb_check_node_heartbeating_no_sem(u8 node_num)
+{
+        unsigned long testing_map[BITS_TO_LONGS(O2NM_MAX_NODES)];
+        unsigned long flags;
+
+        spin_lock_irqsave(&o2hb_live_lock, flags);
+        o2hb_fill_node_map_from_callback(testing_map, sizeof(testing_map));
+        spin_unlock_irqrestore(&o2hb_live_lock, flags);
+        if (!test_bit(node_num, testing_map)) {
+                mlog(ML_HEARTBEAT,
+                     "node (%u) does not have heartbeating enabled.\n",
+                     node_num);
+                return 0;
+        }
+
+        return 1;
+}
+EXPORT_SYMBOL_GPL(o2hb_check_node_heartbeating_no_sem);
+
 int o2hb_check_node_heartbeating_from_callback(u8 node_num)
 {
         unsigned long testing_map[BITS_TO_LONGS(O2NM_MAX_NODES)];
diff --git a/fs/ocfs2/cluster/heartbeat.h b/fs/ocfs2/cluster/heartbeat.h
index 00ad8e8fea51..3ef5137dc362 100644
--- a/fs/ocfs2/cluster/heartbeat.h
+++ b/fs/ocfs2/cluster/heartbeat.h
@@ -80,6 +80,7 @@ void o2hb_fill_node_map(unsigned long *map,
 void o2hb_exit(void);
 int o2hb_init(void);
 int o2hb_check_node_heartbeating(u8 node_num);
+int o2hb_check_node_heartbeating_no_sem(u8 node_num);
 int o2hb_check_node_heartbeating_from_callback(u8 node_num);
 int o2hb_check_local_node_heartbeating(void);
 void o2hb_stop_all_regions(void);
diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
index 73ba81928bce..27d1242c8383 100644
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -185,29 +185,13 @@ static const struct seq_operations nst_seq_ops = {
 static int nst_fop_open(struct inode *inode, struct file *file)
 {
         struct o2net_send_tracking *dummy_nst;
-        struct seq_file *seq;
-        int ret;
 
-        dummy_nst = kmalloc(sizeof(struct o2net_send_tracking), GFP_KERNEL);
-        if (dummy_nst == NULL) {
-                ret = -ENOMEM;
-                goto out;
-        }
-        dummy_nst->st_task = NULL;
-
-        ret = seq_open(file, &nst_seq_ops);
-        if (ret)
-                goto out;
-
-        seq = file->private_data;
-        seq->private = dummy_nst;
+        dummy_nst = __seq_open_private(file, &nst_seq_ops, sizeof(*dummy_nst));
+        if (!dummy_nst)
+                return -ENOMEM;
         o2net_debug_add_nst(dummy_nst);
 
-        dummy_nst = NULL;
-
-out:
-        kfree(dummy_nst);
-        return ret;
+        return 0;
 }
 
 static int nst_fop_release(struct inode *inode, struct file *file)
@@ -412,33 +396,27 @@ static const struct seq_operations sc_seq_ops = {
         .show = sc_seq_show,
 };
 
-static int sc_common_open(struct file *file, struct o2net_sock_debug *sd)
+static int sc_common_open(struct file *file, int ctxt)
 {
+        struct o2net_sock_debug *sd;
         struct o2net_sock_container *dummy_sc;
-        struct seq_file *seq;
-        int ret;
 
-        dummy_sc = kmalloc(sizeof(struct o2net_sock_container), GFP_KERNEL);
-        if (dummy_sc == NULL) {
-                ret = -ENOMEM;
-                goto out;
-        }
-        dummy_sc->sc_page = NULL;
+        dummy_sc = kzalloc(sizeof(*dummy_sc), GFP_KERNEL);
+        if (!dummy_sc)
+                return -ENOMEM;
 
-        ret = seq_open(file, &sc_seq_ops);
-        if (ret)
-                goto out;
+        sd = __seq_open_private(file, &sc_seq_ops, sizeof(*sd));
+        if (!sd) {
+                kfree(dummy_sc);
+                return -ENOMEM;
+        }
 
-        seq = file->private_data;
-        seq->private = sd;
+        sd->dbg_ctxt = ctxt;
         sd->dbg_sock = dummy_sc;
-        o2net_debug_add_sc(dummy_sc);
 
-        dummy_sc = NULL;
+        o2net_debug_add_sc(dummy_sc);
 
-out:
-        kfree(dummy_sc);
-        return ret;
+        return 0;
 }
 
 static int sc_fop_release(struct inode *inode, struct file *file)
@@ -453,16 +431,7 @@ static int sc_fop_release(struct inode *inode, struct file *file)
 
 static int stats_fop_open(struct inode *inode, struct file *file)
 {
-        struct o2net_sock_debug *sd;
-
-        sd = kmalloc(sizeof(struct o2net_sock_debug), GFP_KERNEL);
-        if (sd == NULL)
-                return -ENOMEM;
-
-        sd->dbg_ctxt = SHOW_SOCK_STATS;
-        sd->dbg_sock = NULL;
-
-        return sc_common_open(file, sd);
+        return sc_common_open(file, SHOW_SOCK_STATS);
 }
 
 static const struct file_operations stats_seq_fops = {
@@ -474,16 +443,7 @@ static const struct file_operations stats_seq_fops = {
 
 static int sc_fop_open(struct inode *inode, struct file *file)
 {
-        struct o2net_sock_debug *sd;
-
-        sd = kmalloc(sizeof(struct o2net_sock_debug), GFP_KERNEL);
-        if (sd == NULL)
-                return -ENOMEM;
-
-        sd->dbg_ctxt = SHOW_SOCK_CONTAINERS;
-        sd->dbg_sock = NULL;
-
-        return sc_common_open(file, sd);
+        return sc_common_open(file, SHOW_SOCK_CONTAINERS);
 }
 
 static const struct file_operations sc_seq_fops = {
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index ea34952f9496..97de0fbd9f78 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -536,7 +536,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
         if (nn->nn_persistent_error || nn->nn_sc_valid)
                 wake_up(&nn->nn_sc_wq);
 
-        if (!was_err && nn->nn_persistent_error) {
+        if (was_valid && !was_err && nn->nn_persistent_error) {
                 o2quo_conn_err(o2net_num_from_nn(nn));
                 queue_delayed_work(o2net_wq, &nn->nn_still_up,
                                    msecs_to_jiffies(O2NET_QUORUM_DELAY_MS));
@@ -1601,7 +1601,15 @@ static void o2net_start_connect(struct work_struct *work)
         struct sockaddr_in myaddr = {0, }, remoteaddr = {0, };
         int ret = 0, stop;
         unsigned int timeout;
+        unsigned int noio_flag;
 
+        /*
+         * sock_create allocates the sock with GFP_KERNEL. We must set
+         * per-process flag PF_MEMALLOC_NOIO so that all allocations done
+         * by this process are done as if GFP_NOIO was specified. So we
+         * are not reentering filesystem while doing memory reclaim.
+         */
+        noio_flag = memalloc_noio_save();
         /* if we're greater we initiate tx, otherwise we accept */
         if (o2nm_this_node() <= o2net_num_from_nn(nn))
                 goto out;
@@ -1710,6 +1718,7 @@ out:
         if (mynode)
                 o2nm_node_put(mynode);
 
+        memalloc_noio_restore(noio_flag);
         return;
 }
 
@@ -1721,7 +1730,8 @@ static void o2net_connect_expired(struct work_struct *work)
         spin_lock(&nn->nn_lock);
         if (!nn->nn_sc_valid) {
                 printk(KERN_NOTICE "o2net: No connection established with "
-                       "node %u after %u.%u seconds, giving up.\n",
+                       "node %u after %u.%u seconds, check network and"
+                       " cluster configuration.\n",
                      o2net_num_from_nn(nn),
                      o2net_idle_timeout() / 1000,
                      o2net_idle_timeout() % 1000);
@@ -1835,6 +1845,15 @@ static int o2net_accept_one(struct socket *sock, int *more)
         struct o2nm_node *local_node = NULL;
         struct o2net_sock_container *sc = NULL;
         struct o2net_node *nn;
+        unsigned int noio_flag;
+
+        /*
+         * sock_create_lite allocates the sock with GFP_KERNEL. We must set
+         * per-process flag PF_MEMALLOC_NOIO so that all allocations done
+         * by this process are done as if GFP_NOIO was specified. So we
+         * are not reentering filesystem while doing memory reclaim.
+         */
+        noio_flag = memalloc_noio_save();
 
         BUG_ON(sock == NULL);
         *more = 0;
@@ -1951,6 +1970,8 @@ out:
                 o2nm_node_put(local_node);
         if (sc)
                 sc_put(sc);
+
+        memalloc_noio_restore(noio_flag);
         return ret;
 }
 
@@ -2146,17 +2167,13 @@ int o2net_init(void)
         o2quo_init();
 
         if (o2net_debugfs_init())
-                return -ENOMEM;
+                goto out;
 
         o2net_hand = kzalloc(sizeof(struct o2net_handshake), GFP_KERNEL);
         o2net_keep_req = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
         o2net_keep_resp = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
-        if (!o2net_hand || !o2net_keep_req || !o2net_keep_resp) {
-                kfree(o2net_hand);
-                kfree(o2net_keep_req);
-                kfree(o2net_keep_resp);
-                return -ENOMEM;
-        }
+        if (!o2net_hand || !o2net_keep_req || !o2net_keep_resp)
+                goto out;
 
         o2net_hand->protocol_version = cpu_to_be64(O2NET_PROTOCOL_VERSION);
         o2net_hand->connector_id = cpu_to_be64(1);
@@ -2181,6 +2198,14 @@ int o2net_init(void)
         }
 
         return 0;
+
+out:
+        kfree(o2net_hand);
+        kfree(o2net_keep_req);
+        kfree(o2net_keep_resp);
+
+        o2quo_exit();
+        return -ENOMEM;
 }
 
 void o2net_exit(void)
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index 18f13c2e4a10..149eb556b8c6 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -647,41 +647,30 @@ static const struct seq_operations debug_lockres_ops = {
 static int debug_lockres_open(struct inode *inode, struct file *file)
 {
         struct dlm_ctxt *dlm = inode->i_private;
-        int ret = -ENOMEM;
-        struct seq_file *seq;
-        struct debug_lockres *dl = NULL;
+        struct debug_lockres *dl;
+        void *buf;
 
-        dl = kzalloc(sizeof(struct debug_lockres), GFP_KERNEL);
-        if (!dl) {
-                mlog_errno(ret);
+        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!buf)
                 goto bail;
-        }
 
-        dl->dl_len = PAGE_SIZE;
-        dl->dl_buf = kmalloc(dl->dl_len, GFP_KERNEL);
-        if (!dl->dl_buf) {
-                mlog_errno(ret);
-                goto bail;
-        }
+        dl = __seq_open_private(file, &debug_lockres_ops, sizeof(*dl));
+        if (!dl)
+                goto bailfree;
 
-        ret = seq_open(file, &debug_lockres_ops);
-        if (ret) {
-                mlog_errno(ret);
-                goto bail;
-        }
-
-        seq = file->private_data;
-        seq->private = dl;
+        dl->dl_len = PAGE_SIZE;
+        dl->dl_buf = buf;
 
         dlm_grab(dlm);
         dl->dl_ctxt = dlm;
 
         return 0;
+
+bailfree:
+        kfree(buf);
 bail:
-        if (dl)
-                kfree(dl->dl_buf);
-        kfree(dl);
-        return ret;
+        mlog_errno(-ENOMEM);
+        return -ENOMEM;
 }
 
 static int debug_lockres_release(struct inode *inode, struct file *file)
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 3fcf205ee900..02d315fef432 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -839,7 +839,7 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
          * to back off and try again.  This gives heartbeat a chance
          * to catch up.
          */
-        if (!o2hb_check_node_heartbeating(query->node_idx)) {
+        if (!o2hb_check_node_heartbeating_no_sem(query->node_idx)) {
                 mlog(0, "node %u is not in our live map yet\n",
                      query->node_idx);
 
@@ -1975,24 +1975,22 @@ static struct dlm_ctxt *dlm_alloc_ctxt(const char *domain,
 
         dlm = kzalloc(sizeof(*dlm), GFP_KERNEL);
         if (!dlm) {
-                mlog_errno(-ENOMEM);
+                ret = -ENOMEM;
+                mlog_errno(ret);
                 goto leave;
         }
 
         dlm->name = kstrdup(domain, GFP_KERNEL);
         if (dlm->name == NULL) {
-                mlog_errno(-ENOMEM);
-                kfree(dlm);
-                dlm = NULL;
+                ret = -ENOMEM;
+                mlog_errno(ret);
                 goto leave;
         }
 
         dlm->lockres_hash = (struct hlist_head **)dlm_alloc_pagevec(DLM_HASH_PAGES);
         if (!dlm->lockres_hash) {
-                mlog_errno(-ENOMEM);
-                kfree(dlm->name);
-                kfree(dlm);
-                dlm = NULL;
+                ret = -ENOMEM;
+                mlog_errno(ret);
                 goto leave;
         }
 
@@ -2002,11 +2000,8 @@ static struct dlm_ctxt *dlm_alloc_ctxt(const char *domain,
         dlm->master_hash = (struct hlist_head **)
                                 dlm_alloc_pagevec(DLM_HASH_PAGES);
         if (!dlm->master_hash) {
-                mlog_errno(-ENOMEM);
-                dlm_free_pagevec((void **)dlm->lockres_hash, DLM_HASH_PAGES);
-                kfree(dlm->name);
-                kfree(dlm);
-                dlm = NULL;
+                ret = -ENOMEM;
+                mlog_errno(ret);
                 goto leave;
         }
 
@@ -2017,14 +2012,8 @@ static struct dlm_ctxt *dlm_alloc_ctxt(const char *domain,
         dlm->node_num = o2nm_this_node();
 
         ret = dlm_create_debugfs_subroot(dlm);
-        if (ret < 0) {
-                dlm_free_pagevec((void **)dlm->master_hash, DLM_HASH_PAGES);
-                dlm_free_pagevec((void **)dlm->lockres_hash, DLM_HASH_PAGES);
-                kfree(dlm->name);
-                kfree(dlm);
-                dlm = NULL;
+        if (ret < 0)
                 goto leave;
-        }
 
         spin_lock_init(&dlm->spinlock);
         spin_lock_init(&dlm->master_lock);
@@ -2085,6 +2074,19 @@ static struct dlm_ctxt *dlm_alloc_ctxt(const char *domain,
                   atomic_read(&dlm->dlm_refs.refcount));
 
 leave:
+        if (ret < 0 && dlm) {
+                if (dlm->master_hash)
+                        dlm_free_pagevec((void **)dlm->master_hash,
+                                        DLM_HASH_PAGES);
+
+                if (dlm->lockres_hash)
+                        dlm_free_pagevec((void **)dlm->lockres_hash,
+                                        DLM_HASH_PAGES);
+
+                kfree(dlm->name);
+                kfree(dlm);
+                dlm = NULL;
+        }
         return dlm;
 }
 
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 12ba682fc53c..215e41abf101 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -625,9 +625,6 @@ struct dlm_lock_resource *dlm_new_lockres(struct dlm_ctxt *dlm,
         return res;
 
 error:
-        if (res && res->lockname.name)
-                kmem_cache_free(dlm_lockname_cache, (void *)res->lockname.name);
-
         if (res)
                 kmem_cache_free(dlm_lockres_cache, res);
         return NULL;
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 45067faf5695..3365839d2971 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1710,9 +1710,12 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
                                 BUG();
                         } else
                                 __dlm_lockres_grab_inflight_worker(dlm, res);
-                } else /* put.. incase we are not the master */
+                        spin_unlock(&res->spinlock);
+                } else {
+                        /* put.. incase we are not the master */
+                        spin_unlock(&res->spinlock);
                         dlm_lockres_put(res);
-                spin_unlock(&res->spinlock);
+                }
         }
         spin_unlock(&dlm->spinlock);
 
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 52cfe99ae056..21262f2b1654 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2892,37 +2892,24 @@ static int ocfs2_dlm_debug_release(struct inode *inode, struct file *file)
 
 static int ocfs2_dlm_debug_open(struct inode *inode, struct file *file)
 {
-        int ret;
         struct ocfs2_dlm_seq_priv *priv;
-        struct seq_file *seq;
         struct ocfs2_super *osb;
 
-        priv = kzalloc(sizeof(struct ocfs2_dlm_seq_priv), GFP_KERNEL);
+        priv = __seq_open_private(file, &ocfs2_dlm_seq_ops, sizeof(*priv));
         if (!priv) {
-                ret = -ENOMEM;
-                mlog_errno(ret);
-                goto out;
+                mlog_errno(-ENOMEM);
+                return -ENOMEM;
         }
+
         osb = inode->i_private;
         ocfs2_get_dlm_debug(osb->osb_dlm_debug);
         priv->p_dlm_debug = osb->osb_dlm_debug;
         INIT_LIST_HEAD(&priv->p_iter_res.l_debug_list);
 
-        ret = seq_open(file, &ocfs2_dlm_seq_ops);
-        if (ret) {
-                kfree(priv);
-                mlog_errno(ret);
-                goto out;
-        }
-
-        seq = file->private_data;
-        seq->private = priv;
-
         ocfs2_add_lockres_tracking(&priv->p_iter_res,
                                    priv->p_dlm_debug);
 
-out:
-        return ret;
+        return 0;
 }
 
 static const struct file_operations ocfs2_dlm_debug_fops = {
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 2930e231f3f9..682732f3f0d8 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -760,7 +760,7 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
         struct address_space *mapping = inode->i_mapping;
         struct page *page;
         unsigned long index = abs_from >> PAGE_CACHE_SHIFT;
-        handle_t *handle = NULL;
+        handle_t *handle;
         int ret = 0;
         unsigned zero_from, zero_to, block_start, block_end;
         struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
@@ -769,11 +769,17 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
         BUG_ON(abs_to > (((u64)index + 1) << PAGE_CACHE_SHIFT));
         BUG_ON(abs_from & (inode->i_blkbits - 1));
 
+        handle = ocfs2_zero_start_ordered_transaction(inode, di_bh);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out;
+        }
+
         page = find_or_create_page(mapping, index, GFP_NOFS);
         if (!page) {
                 ret = -ENOMEM;
                 mlog_errno(ret);
-                goto out;
+                goto out_commit_trans;
         }
 
         /* Get the offsets within the page that we want to zero */
@@ -805,15 +811,6 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                         goto out_unlock;
                 }
 
-                if (!handle) {
-                        handle = ocfs2_zero_start_ordered_transaction(inode,
-                                                                      di_bh);
-                        if (IS_ERR(handle)) {
-                                ret = PTR_ERR(handle);
-                                handle = NULL;
-                                break;
-                        }
-                }
 
                 /* must not update i_size! */
                 ret = block_commit_write(page, block_start + 1,
@@ -824,27 +821,29 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                         ret = 0;
         }
 
+        /*
+         * fs-writeback will release the dirty pages without page lock
+         * whose offset are over inode size, the release happens at
+         * block_write_full_page().
+         */
+        i_size_write(inode, abs_to);
+        inode->i_blocks = ocfs2_inode_sector_count(inode);
+        di->i_size = cpu_to_le64((u64)i_size_read(inode));
+        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        di->i_mtime = di->i_ctime = cpu_to_le64(inode->i_mtime.tv_sec);
+        di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
+        di->i_mtime_nsec = di->i_ctime_nsec;
         if (handle) {
-                /*
-                 * fs-writeback will release the dirty pages without page lock
-                 * whose offset are over inode size, the release happens at
-                 * block_write_full_page().
-                 */
-                i_size_write(inode, abs_to);
-                inode->i_blocks = ocfs2_inode_sector_count(inode);
-                di->i_size = cpu_to_le64((u64)i_size_read(inode));
-                inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-                di->i_mtime = di->i_ctime = cpu_to_le64(inode->i_mtime.tv_sec);
-                di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
-                di->i_mtime_nsec = di->i_ctime_nsec;
                 ocfs2_journal_dirty(handle, di_bh);
                 ocfs2_update_inode_fsync_trans(handle, inode, 1);
-                ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
         }
 
 out_unlock:
         unlock_page(page);
         page_cache_release(page);
+out_commit_trans:
+        if (handle)
+                ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
 out:
         return ret;
 }
diff --git a/fs/ocfs2/inode.h b/fs/ocfs2/inode.h
index a6c991c0fc98..a9b76de46047 100644
--- a/fs/ocfs2/inode.h
+++ b/fs/ocfs2/inode.h
@@ -162,7 +162,7 @@ static inline blkcnt_t ocfs2_inode_sector_count(struct inode *inode)
 {
         int c_to_s_bits = OCFS2_SB(inode->i_sb)->s_clustersize_bits - 9;
 
-        return (blkcnt_t)(OCFS2_I(inode)->ip_clusters << c_to_s_bits);
+        return (blkcnt_t)OCFS2_I(inode)->ip_clusters << c_to_s_bits;
 }
 
 /* Validate that a bh contains a valid inode */
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 6219aaadeb08..74caffeeee1d 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -404,7 +404,7 @@ static int ocfs2_find_victim_alloc_group(struct inode *inode,
          * 'vict_blkno' was out of the valid range.
          */
         if ((vict_blkno < le64_to_cpu(rec->c_blkno)) ||
-            (vict_blkno >= (le32_to_cpu(ac_dinode->id1.bitmap1.i_total) <<
+            (vict_blkno >= ((u64)le32_to_cpu(ac_dinode->id1.bitmap1.i_total) <<
                                 bits_per_unit))) {
                 ret = -EINVAL;
                 goto out;
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 13a8537d8e8b..720aa389e0ea 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -591,7 +591,7 @@ static int ocfs2_control_release(struct inode *inode, struct file *file)
                  */
                 ocfs2_control_this_node = -1;
                 running_proto.pv_major = 0;
-                running_proto.pv_major = 0;
+                running_proto.pv_minor = 0;
         }
 
 out:
diff --git a/fs/proc/base.c b/fs/proc/base.c
index baf852b648ad..4c542b907754 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -632,29 +632,35 @@ static const struct file_operations proc_single_file_operations = {
         .release        = single_release,
 };
 
-static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
+
+struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 {
-        struct task_struct *task = get_proc_task(file_inode(file));
-        struct mm_struct *mm;
+        struct task_struct *task = get_proc_task(inode);
+        struct mm_struct *mm = ERR_PTR(-ESRCH);
 
-        if (!task)
-                return -ESRCH;
+        if (task) {
+                mm = mm_access(task, mode);
+                put_task_struct(task);
 
-        mm = mm_access(task, mode);
-        put_task_struct(task);
+                if (!IS_ERR_OR_NULL(mm)) {
+                        /* ensure this mm_struct can't be freed */
+                        atomic_inc(&mm->mm_count);
+                        /* but do not pin its memory */
+                        mmput(mm);
+                }
+        }
+
+        return mm;
+}
+
+static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
+{
+        struct mm_struct *mm = proc_mem_open(inode, mode);
 
         if (IS_ERR(mm))
                 return PTR_ERR(mm);
 
-        if (mm) {
-                /* ensure this mm_struct can't be freed */
-                atomic_inc(&mm->mm_count);
-                /* but do not pin its memory */
-                mmput(mm);
-        }
-
         file->private_data = mm;
-
         return 0;
 }
 
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 7da13e49128a..aa7a0ee182e1 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -268,8 +268,9 @@ extern int proc_remount(struct super_block *, int *, char *);
  * task_[no]mmu.c
  */
 struct proc_maps_private {
-        struct pid *pid;
+        struct inode *inode;
         struct task_struct *task;
+        struct mm_struct *mm;
 #ifdef CONFIG_MMU
         struct vm_area_struct *tail_vma;
 #endif
@@ -278,6 +279,8 @@ struct proc_maps_private {
 #endif
 };
 
+struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode);
+
 extern const struct file_operations proc_pid_maps_operations;
 extern const struct file_operations proc_tid_maps_operations;
 extern const struct file_operations proc_pid_numa_maps_operations;
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 6df8d0722c97..91a4e6426321 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -610,8 +610,10 @@ static void __init proc_kcore_text_init(void)
 struct kcore_list kcore_modules;
 static void __init add_modules_range(void)
 {
-        kclist_add(&kcore_modules, (void *)MODULES_VADDR,
+        if (MODULES_VADDR != VMALLOC_START && MODULES_END != VMALLOC_END) {
+                kclist_add(&kcore_modules, (void *)MODULES_VADDR,
                         MODULES_END - MODULES_VADDR, KCORE_VMALLOC);
+        }
 }
 #else
 static void __init add_modules_range(void)
diff --git a/fs/proc/page.c b/fs/proc/page.c
index e647c55275d9..1e3187da1fed 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -133,6 +133,9 @@ u64 stable_page_flags(struct page *page)
         if (PageBuddy(page))
                 u |= 1 << KPF_BUDDY;
 
+        if (PageBalloon(page))
+                u |= 1 << KPF_BALLOON;
+
         u |= kpf_copy_bit(k, KPF_LOCKED,        PG_locked);
 
         u |= kpf_copy_bit(k, KPF_SLAB,          PG_slab);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index c34156888d70..b7a7dc963a35 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -87,32 +87,14 @@ unsigned long task_statm(struct mm_struct *mm,
 
 #ifdef CONFIG_NUMA
 /*
- * These functions are for numa_maps but called in generic **maps seq_file
- * ->start(), ->stop() ops.
- *
- * numa_maps scans all vmas under mmap_sem and checks their mempolicy.
- * Each mempolicy object is controlled by reference counting. The problem here
- * is how to avoid accessing dead mempolicy object.
- *
- * Because we're holding mmap_sem while reading seq_file, it's safe to access
- * each vma's mempolicy, no vma objects will never drop refs to mempolicy.
- *
- * A task's mempolicy (task->mempolicy) has different behavior. task->mempolicy
- * is set and replaced under mmap_sem but unrefed and cleared under task_lock().
- * So, without task_lock(), we cannot trust get_vma_policy() because we cannot
- * gurantee the task never exits under us. But taking task_lock() around
- * get_vma_plicy() causes lock order problem.
- *
- * To access task->mempolicy without lock, we hold a reference count of an
- * object pointed by task->mempolicy and remember it. This will guarantee
- * that task->mempolicy points to an alive object or NULL in numa_maps accesses.
+ * Save get_task_policy() for show_numa_map().
  */
 static void hold_task_mempolicy(struct proc_maps_private *priv)
 {
         struct task_struct *task = priv->task;
 
         task_lock(task);
-        priv->task_mempolicy = task->mempolicy;
+        priv->task_mempolicy = get_task_policy(task);
         mpol_get(priv->task_mempolicy);
         task_unlock(task);
 }
@@ -129,124 +111,154 @@ static void release_task_mempolicy(struct proc_maps_private *priv)
 }
 #endif
 
-static void vma_stop(struct proc_maps_private *priv, struct vm_area_struct *vma)
+static void vma_stop(struct proc_maps_private *priv)
 {
-        if (vma && vma != priv->tail_vma) {
-                struct mm_struct *mm = vma->vm_mm;
-                release_task_mempolicy(priv);
-                up_read(&mm->mmap_sem);
-                mmput(mm);
-        }
+        struct mm_struct *mm = priv->mm;
+
+        release_task_mempolicy(priv);
+        up_read(&mm->mmap_sem);
+        mmput(mm);
+}
+
+static struct vm_area_struct *
+m_next_vma(struct proc_maps_private *priv, struct vm_area_struct *vma)
+{
+        if (vma == priv->tail_vma)
+                return NULL;
+        return vma->vm_next ?: priv->tail_vma;
+}
+
+static void m_cache_vma(struct seq_file *m, struct vm_area_struct *vma)
+{
+        if (m->count < m->size) /* vma is copied successfully */
+                m->version = m_next_vma(m->private, vma) ? vma->vm_start : -1UL;
 }
 
-static void *m_start(struct seq_file *m, loff_t *pos)
+static void *m_start(struct seq_file *m, loff_t *ppos)
 {
         struct proc_maps_private *priv = m->private;
         unsigned long last_addr = m->version;
         struct mm_struct *mm;
-        struct vm_area_struct *vma, *tail_vma = NULL;
-        loff_t l = *pos;
-
-        /* Clear the per syscall fields in priv */
-        priv->task = NULL;
-        priv->tail_vma = NULL;
-
-        /*
-         * We remember last_addr rather than next_addr to hit with
-         * vmacache most of the time. We have zero last_addr at
-         * the beginning and also after lseek. We will have -1 last_addr
-         * after the end of the vmas.
-         */
+        struct vm_area_struct *vma;
+        unsigned int pos = *ppos;
 
+        /* See m_cache_vma(). Zero at the start or after lseek. */
         if (last_addr == -1UL)
                 return NULL;
 
-        priv->task = get_pid_task(priv->pid, PIDTYPE_PID);
+        priv->task = get_proc_task(priv->inode);
         if (!priv->task)
                 return ERR_PTR(-ESRCH);
 
-        mm = mm_access(priv->task, PTRACE_MODE_READ);
-        if (!mm || IS_ERR(mm))
-                return mm;
-        down_read(&mm->mmap_sem);
+        mm = priv->mm;
+        if (!mm || !atomic_inc_not_zero(&mm->mm_users))
+                return NULL;
 
-        tail_vma = get_gate_vma(priv->task->mm);
-        priv->tail_vma = tail_vma;
+        down_read(&mm->mmap_sem);
         hold_task_mempolicy(priv);
-        /* Start with last addr hint */
-        vma = find_vma(mm, last_addr);
-        if (last_addr && vma) {
-                vma = vma->vm_next;
-                goto out;
+        priv->tail_vma = get_gate_vma(mm);
+
+        if (last_addr) {
+                vma = find_vma(mm, last_addr);
+                if (vma && (vma = m_next_vma(priv, vma)))
+                        return vma;
         }
 
-        /*
-         * Check the vma index is within the range and do
-         * sequential scan until m_index.
-         */
-        vma = NULL;
-        if ((unsigned long)l < mm->map_count) {
-                vma = mm->mmap;
-                while (l-- && vma)
+        m->version = 0;
+        if (pos < mm->map_count) {
+                for (vma = mm->mmap; pos; pos--) {
+                        m->version = vma->vm_start;
                         vma = vma->vm_next;
-                goto out;
+                }
+                return vma;
         }
 
-        if (l != mm->map_count)
-                tail_vma = NULL; /* After gate vma */
-
-out:
-        if (vma)
-                return vma;
+        /* we do not bother to update m->version in this case */
+        if (pos == mm->map_count && priv->tail_vma)
+                return priv->tail_vma;
 
-        release_task_mempolicy(priv);
-        /* End of vmas has been reached */
-        m->version = (tail_vma != NULL)? 0: -1UL;
-        up_read(&mm->mmap_sem);
-        mmput(mm);
-        return tail_vma;
+        vma_stop(priv);
+        return NULL;
 }
 
 static void *m_next(struct seq_file *m, void *v, loff_t *pos)
 {
         struct proc_maps_private *priv = m->private;
-        struct vm_area_struct *vma = v;
-        struct vm_area_struct *tail_vma = priv->tail_vma;
+        struct vm_area_struct *next;
 
         (*pos)++;
-        if (vma && (vma != tail_vma) && vma->vm_next)
-                return vma->vm_next;
-        vma_stop(priv, vma);
-        return (vma != tail_vma)? tail_vma: NULL;
+        next = m_next_vma(priv, v);
+        if (!next)
+                vma_stop(priv);
+        return next;
 }
 
 static void m_stop(struct seq_file *m, void *v)
 {
         struct proc_maps_private *priv = m->private;
-        struct vm_area_struct *vma = v;
 
-        if (!IS_ERR(vma))
-                vma_stop(priv, vma);
-        if (priv->task)
+        if (!IS_ERR_OR_NULL(v))
+                vma_stop(priv);
+        if (priv->task) {
                 put_task_struct(priv->task);
+                priv->task = NULL;
+        }
+}
+
+static int proc_maps_open(struct inode *inode, struct file *file,
+                        const struct seq_operations *ops, int psize)
+{
+        struct proc_maps_private *priv = __seq_open_private(file, ops, psize);
+
+        if (!priv)
+                return -ENOMEM;
+
+        priv->inode = inode;
+        priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
+        if (IS_ERR(priv->mm)) {
+                int err = PTR_ERR(priv->mm);
+
+                seq_release_private(inode, file);
+                return err;
+        }
+
+        return 0;
+}
+
+static int proc_map_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct proc_maps_private *priv = seq->private;
+
+        if (priv->mm)
+                mmdrop(priv->mm);
+
+        return seq_release_private(inode, file);
 }
 
 static int do_maps_open(struct inode *inode, struct file *file,
                         const struct seq_operations *ops)
 {
-        struct proc_maps_private *priv;
-        int ret = -ENOMEM;
-        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-        if (priv) {
-                priv->pid = proc_pid(inode);
-                ret = seq_open(file, ops);
-                if (!ret) {
-                        struct seq_file *m = file->private_data;
-                        m->private = priv;
-                } else {
-                        kfree(priv);
-                }
+        return proc_maps_open(inode, file, ops,
+                                sizeof(struct proc_maps_private));
+}
+
+static pid_t pid_of_stack(struct proc_maps_private *priv,
+                                struct vm_area_struct *vma, bool is_pid)
+{
+        struct inode *inode = priv->inode;
+        struct task_struct *task;
+        pid_t ret = 0;
+
+        rcu_read_lock();
+        task = pid_task(proc_pid(inode), PIDTYPE_PID);
+        if (task) {
+                task = task_of_stack(task, vma, is_pid);
+                if (task)
+                        ret = task_pid_nr_ns(task, inode->i_sb->s_fs_info);
         }
+        rcu_read_unlock();
+
         return ret;
 }
 
@@ -256,7 +268,6 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
         struct mm_struct *mm = vma->vm_mm;
         struct file *file = vma->vm_file;
         struct proc_maps_private *priv = m->private;
-        struct task_struct *task = priv->task;
         vm_flags_t flags = vma->vm_flags;
         unsigned long ino = 0;
         unsigned long long pgoff = 0;
@@ -321,8 +332,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
                         goto done;
                 }
 
-                tid = vm_is_stack(task, vma, is_pid);
-
+                tid = pid_of_stack(priv, vma, is_pid);
                 if (tid != 0) {
                         /*
                          * Thread stack in /proc/PID/task/TID/maps or
@@ -349,15 +359,8 @@ done:
 
 static int show_map(struct seq_file *m, void *v, int is_pid)
 {
-        struct vm_area_struct *vma = v;
-        struct proc_maps_private *priv = m->private;
-        struct task_struct *task = priv->task;
-
-        show_map_vma(m, vma, is_pid);
-
-        if (m->count < m->size)  /* vma is copied successfully */
-                m->version = (vma != get_gate_vma(task->mm))
-                        ? vma->vm_start : 0;
+        show_map_vma(m, v, is_pid);
+        m_cache_vma(m, v);
         return 0;
 }
 
@@ -399,14 +402,14 @@ const struct file_operations proc_pid_maps_operations = {
         .open           = pid_maps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = proc_map_release,
 };
 
 const struct file_operations proc_tid_maps_operations = {
         .open           = tid_maps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = proc_map_release,
 };
 
 /*
@@ -583,8 +586,6 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma)
 
 static int show_smap(struct seq_file *m, void *v, int is_pid)
 {
-        struct proc_maps_private *priv = m->private;
-        struct task_struct *task = priv->task;
         struct vm_area_struct *vma = v;
         struct mem_size_stats mss;
         struct mm_walk smaps_walk = {
@@ -637,10 +638,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
                                 mss.nonlinear >> 10);
 
         show_smap_vma_flags(m, vma);
-
-        if (m->count < m->size)  /* vma is copied successfully */
-                m->version = (vma != get_gate_vma(task->mm))
-                        ? vma->vm_start : 0;
+        m_cache_vma(m, vma);
         return 0;
 }
 
@@ -682,14 +680,14 @@ const struct file_operations proc_pid_smaps_operations = {
         .open           = pid_smaps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = proc_map_release,
 };
 
 const struct file_operations proc_tid_smaps_operations = {
         .open           = tid_smaps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = proc_map_release,
 };
 
 /*
@@ -1029,7 +1027,6 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
         spinlock_t *ptl;
         pte_t *pte;
         int err = 0;
-        pagemap_entry_t pme = make_pme(PM_NOT_PRESENT(pm->v2));
 
         /* find the first VMA at or above 'addr' */
         vma = find_vma(walk->mm, addr);
@@ -1043,6 +1040,7 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 
                 for (; addr != end; addr += PAGE_SIZE) {
                         unsigned long offset;
+                        pagemap_entry_t pme;
 
                         offset = (addr & ~PAGEMAP_WALK_MASK) >>
                                         PAGE_SHIFT;
@@ -1057,32 +1055,51 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 
         if (pmd_trans_unstable(pmd))
                 return 0;
-        for (; addr != end; addr += PAGE_SIZE) {
-                int flags2;
-
-                /* check to see if we've left 'vma' behind
-                 * and need a new, higher one */
-                if (vma && (addr >= vma->vm_end)) {
-                        vma = find_vma(walk->mm, addr);
-                        if (vma && (vma->vm_flags & VM_SOFTDIRTY))
-                                flags2 = __PM_SOFT_DIRTY;
-                        else
-                                flags2 = 0;
-                        pme = make_pme(PM_NOT_PRESENT(pm->v2) | PM_STATUS2(pm->v2, flags2));
+
+        while (1) {
+                /* End of address space hole, which we mark as non-present. */
+                unsigned long hole_end;
+
+                if (vma)
+                        hole_end = min(end, vma->vm_start);
+                else
+                        hole_end = end;
+
+                for (; addr < hole_end; addr += PAGE_SIZE) {
+                        pagemap_entry_t pme = make_pme(PM_NOT_PRESENT(pm->v2));
+
+                        err = add_to_pagemap(addr, &pme, pm);
+                        if (err)
+                                return err;
                 }
 
-                /* check that 'vma' actually covers this address,
-                 * and that it isn't a huge page vma */
-                if (vma && (vma->vm_start <= addr) &&
-                    !is_vm_hugetlb_page(vma)) {
+                if (!vma || vma->vm_start >= end)
+                        break;
+                /*
+                 * We can't possibly be in a hugetlb VMA. In general,
+                 * for a mm_walk with a pmd_entry and a hugetlb_entry,
+                 * the pmd_entry can only be called on addresses in a
+                 * hugetlb if the walk starts in a non-hugetlb VMA and
+                 * spans a hugepage VMA. Since pagemap_read walks are
+                 * PMD-sized and PMD-aligned, this will never be true.
+                 */
+                BUG_ON(is_vm_hugetlb_page(vma));
+
+                /* Addresses in the VMA. */
+                for (; addr < min(end, vma->vm_end); addr += PAGE_SIZE) {
+                        pagemap_entry_t pme;
                         pte = pte_offset_map(pmd, addr);
                         pte_to_pagemap_entry(&pme, pm, vma, addr, *pte);
-                        /* unmap before userspace copy */
                         pte_unmap(pte);
+                        err = add_to_pagemap(addr, &pme, pm);
+                        if (err)
+                                return err;
                 }
-                err = add_to_pagemap(addr, &pme, pm);
-                if (err)
-                        return err;
+
+                if (addr == end)
+                        break;
+
+                vma = find_vma(walk->mm, addr);
         }
 
         cond_resched();
@@ -1415,7 +1432,6 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
         struct vm_area_struct *vma = v;
         struct numa_maps *md = &numa_priv->md;
         struct file *file = vma->vm_file;
-        struct task_struct *task = proc_priv->task;
         struct mm_struct *mm = vma->vm_mm;
         struct mm_walk walk = {};
         struct mempolicy *pol;
@@ -1435,9 +1451,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
         walk.private = md;
         walk.mm = mm;
 
-        pol = get_vma_policy(task, vma, vma->vm_start);
-        mpol_to_str(buffer, sizeof(buffer), pol);
-        mpol_cond_put(pol);
+        pol = __get_vma_policy(vma, vma->vm_start);
+        if (pol) {
+                mpol_to_str(buffer, sizeof(buffer), pol);
+                mpol_cond_put(pol);
+        } else {
+                mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy);
+        }
 
         seq_printf(m, "%08lx %s", vma->vm_start, buffer);
 
@@ -1447,7 +1467,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
         } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
                 seq_puts(m, " heap");
         } else {
-                pid_t tid = vm_is_stack(task, vma, is_pid);
+                pid_t tid = pid_of_stack(proc_priv, vma, is_pid);
                 if (tid != 0) {
                         /*
                          * Thread stack in /proc/PID/task/TID/maps or
@@ -1495,9 +1515,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
                         seq_printf(m, " N%d=%lu", nid, md->node[nid]);
 out:
         seq_putc(m, '\n');
-
-        if (m->count < m->size)
-                m->version = (vma != proc_priv->tail_vma) ? vma->vm_start : 0;
+        m_cache_vma(m, vma);
         return 0;
 }
 
@@ -1528,20 +1546,8 @@ static const struct seq_operations proc_tid_numa_maps_op = {
 static int numa_maps_open(struct inode *inode, struct file *file,
                           const struct seq_operations *ops)
 {
-        struct numa_maps_private *priv;
-        int ret = -ENOMEM;
-        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-        if (priv) {
-                priv->proc_maps.pid = proc_pid(inode);
-                ret = seq_open(file, ops);
-                if (!ret) {
-                        struct seq_file *m = file->private_data;
-                        m->private = priv;
-                } else {
-                        kfree(priv);
-                }
-        }
-        return ret;
+        return proc_maps_open(inode, file, ops,
+                                sizeof(struct numa_maps_private));
 }
 
 static int pid_numa_maps_open(struct inode *inode, struct file *file)
@@ -1558,13 +1564,13 @@ const struct file_operations proc_pid_numa_maps_operations = {
         .open           = pid_numa_maps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = proc_map_release,
 };
 
 const struct file_operations proc_tid_numa_maps_operations = {
         .open           = tid_numa_maps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = proc_map_release,
 };
 #endif /* CONFIG_NUMA */
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 678455d2d683..599ec2e20104 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -123,6 +123,25 @@ unsigned long task_statm(struct mm_struct *mm,
         return size;
 }
 
+static pid_t pid_of_stack(struct proc_maps_private *priv,
+                                struct vm_area_struct *vma, bool is_pid)
+{
+        struct inode *inode = priv->inode;
+        struct task_struct *task;
+        pid_t ret = 0;
+
+        rcu_read_lock();
+        task = pid_task(proc_pid(inode), PIDTYPE_PID);
+        if (task) {
+                task = task_of_stack(task, vma, is_pid);
+                if (task)
+                        ret = task_pid_nr_ns(task, inode->i_sb->s_fs_info);
+        }
+        rcu_read_unlock();
+
+        return ret;
+}
+
 /*
  * display a single VMA to a sequenced file
  */
@@ -163,7 +182,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
                 seq_pad(m, ' ');
                 seq_path(m, &file->f_path, "");
         } else if (mm) {
-                pid_t tid = vm_is_stack(priv->task, vma, is_pid);
+                pid_t tid = pid_of_stack(priv, vma, is_pid);
 
                 if (tid != 0) {
                         seq_pad(m, ' ');
@@ -212,22 +231,22 @@ static void *m_start(struct seq_file *m, loff_t *pos)
         loff_t n = *pos;
 
         /* pin the task and mm whilst we play with them */
-        priv->task = get_pid_task(priv->pid, PIDTYPE_PID);
+        priv->task = get_proc_task(priv->inode);
         if (!priv->task)
                 return ERR_PTR(-ESRCH);
 
-        mm = mm_access(priv->task, PTRACE_MODE_READ);
-        if (!mm || IS_ERR(mm)) {
-                put_task_struct(priv->task);
-                priv->task = NULL;
-                return mm;
-        }
-        down_read(&mm->mmap_sem);
+        mm = priv->mm;
+        if (!mm || !atomic_inc_not_zero(&mm->mm_users))
+                return NULL;
 
+        down_read(&mm->mmap_sem);
         /* start from the Nth VMA */
         for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
                 if (n-- == 0)
                         return p;
+
+        up_read(&mm->mmap_sem);
+        mmput(mm);
         return NULL;
 }
 
@@ -235,11 +254,13 @@ static void m_stop(struct seq_file *m, void *_vml)
 {
         struct proc_maps_private *priv = m->private;
 
+        if (!IS_ERR_OR_NULL(_vml)) {
+                up_read(&priv->mm->mmap_sem);
+                mmput(priv->mm);
+        }
         if (priv->task) {
-                struct mm_struct *mm = priv->task->mm;
-                up_read(&mm->mmap_sem);
-                mmput(mm);
                 put_task_struct(priv->task);
+                priv->task = NULL;
         }
 }
 
@@ -269,20 +290,33 @@ static int maps_open(struct inode *inode, struct file *file,
                      const struct seq_operations *ops)
 {
         struct proc_maps_private *priv;
-        int ret = -ENOMEM;
-
-        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-        if (priv) {
-                priv->pid = proc_pid(inode);
-                ret = seq_open(file, ops);
-                if (!ret) {
-                        struct seq_file *m = file->private_data;
-                        m->private = priv;
-                } else {
-                        kfree(priv);
-                }
+
+        priv = __seq_open_private(file, ops, sizeof(*priv));
+        if (!priv)
+                return -ENOMEM;
+
+        priv->inode = inode;
+        priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
+        if (IS_ERR(priv->mm)) {
+                int err = PTR_ERR(priv->mm);
+
+                seq_release_private(inode, file);
+                return err;
         }
-        return ret;
+
+        return 0;
+}
+
+
+static int map_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct proc_maps_private *priv = seq->private;
+
+        if (priv->mm)
+                mmdrop(priv->mm);
+
+        return seq_release_private(inode, file);
 }
 
 static int pid_maps_open(struct inode *inode, struct file *file)
@@ -299,13 +333,13 @@ const struct file_operations proc_pid_maps_operations = {
         .open           = pid_maps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = map_release,
 };
 
 const struct file_operations proc_tid_maps_operations = {
         .open           = tid_maps_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = map_release,
 };
 
diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
index de8bf89940f8..a9fd248f5d48 100644
--- a/include/asm-generic/dma-mapping-common.h
+++ b/include/asm-generic/dma-mapping-common.h
@@ -179,6 +179,15 @@ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
 extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
                            void *cpu_addr, dma_addr_t dma_addr, size_t size);
 
+void *dma_common_contiguous_remap(struct page *page, size_t size,
+                        unsigned long vm_flags,
+                        pgprot_t prot, const void *caller);
+
+void *dma_common_pages_remap(struct page **pages, size_t size,
+                        unsigned long vm_flags, pgprot_t prot,
+                        const void *caller);
+void dma_common_free_remap(void *cpu_addr, size_t size, unsigned long vm_flags);
+
 /**
  * dma_mmap_attrs - map a coherent DMA allocation into user space
  * @dev: valid struct device pointer, or NULL for ISA and EISA-like devices
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 977e545a64c3..081ff8826bf6 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -664,11 +664,12 @@ static inline int pmd_trans_unstable(pmd_t *pmd)
 }
 
 #ifdef CONFIG_NUMA_BALANCING
-#ifdef CONFIG_ARCH_USES_NUMA_PROT_NONE
 /*
- * _PAGE_NUMA works identical to _PAGE_PROTNONE (it's actually the
- * same bit too). It's set only when _PAGE_PRESET is not set and it's
- * never set if _PAGE_PRESENT is set.
+ * _PAGE_NUMA distinguishes between an unmapped page table entry, an entry that
+ * is protected for PROT_NONE and a NUMA hinting fault entry. If the
+ * architecture defines __PAGE_PROTNONE then it should take that into account
+ * but those that do not can rely on the fact that the NUMA hinting scanner
+ * skips inaccessible VMAs.
  *
  * pte/pmd_present() returns true if pte/pmd_numa returns true. Page
  * fault triggers on those regions if pte/pmd_numa returns true
@@ -677,16 +678,14 @@ static inline int pmd_trans_unstable(pmd_t *pmd)
 #ifndef pte_numa
 static inline int pte_numa(pte_t pte)
 {
-        return (pte_flags(pte) &
-                (_PAGE_NUMA|_PAGE_PROTNONE|_PAGE_PRESENT)) == _PAGE_NUMA;
+        return ptenuma_flags(pte) == _PAGE_NUMA;
 }
 #endif
 
 #ifndef pmd_numa
 static inline int pmd_numa(pmd_t pmd)
 {
-        return (pmd_flags(pmd) &
-                (_PAGE_NUMA|_PAGE_PROTNONE|_PAGE_PRESENT)) == _PAGE_NUMA;
+        return pmdnuma_flags(pmd) == _PAGE_NUMA;
 }
 #endif
 
@@ -726,6 +725,8 @@ static inline pte_t pte_mknuma(pte_t pte)
 {
         pteval_t val = pte_val(pte);
 
+        VM_BUG_ON(!(val & _PAGE_PRESENT));
+
         val &= ~_PAGE_PRESENT;
         val |= _PAGE_NUMA;
 
@@ -769,16 +770,6 @@ static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
 }
 #endif
 #else
-extern int pte_numa(pte_t pte);
-extern int pmd_numa(pmd_t pmd);
-extern pte_t pte_mknonnuma(pte_t pte);
-extern pmd_t pmd_mknonnuma(pmd_t pmd);
-extern pte_t pte_mknuma(pte_t pte);
-extern pmd_t pmd_mknuma(pmd_t pmd);
-extern void ptep_set_numa(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
-extern void pmdp_set_numa(struct mm_struct *mm, unsigned long addr, pmd_t *pmdp);
-#endif /* CONFIG_ARCH_USES_NUMA_PROT_NONE */
-#else
 static inline int pmd_numa(pmd_t pmd)
 {
         return 0;
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index f1a24b5c3b90..b58fd667f87b 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -3,6 +3,8 @@
 
 /* References to section boundaries */
 
+#include <linux/compiler.h>
+
 /*
  * Usage guidelines:
  * _text, _data: architecture specific, don't use them in arch-independent code
@@ -37,6 +39,8 @@ extern char __start_rodata[], __end_rodata[];
 /* Start and end of .ctors section - used for constructor calls. */
 extern char __ctors_start[], __ctors_end[];
 
+extern __visible const void __nosave_begin, __nosave_end;
+
 /* function descriptor handling (if any).  Override
  * in asm/sections.h */
 #ifndef dereference_function_descriptor
diff --git a/include/linux/balloon_compaction.h b/include/linux/balloon_compaction.h
index 089743ade734..9b0a15d06a4f 100644
--- a/include/linux/balloon_compaction.h
+++ b/include/linux/balloon_compaction.h
@@ -27,10 +27,13 @@
  *      counter raised only while it is under our special handling;
  *
  * iii. after the lockless scan step have selected a potential balloon page for
- *      isolation, re-test the page->mapping flags and the page ref counter
+ *      isolation, re-test the PageBalloon mark and the PagePrivate flag
  *      under the proper page lock, to ensure isolating a valid balloon page
  *      (not yet isolated, nor under release procedure)
  *
+ *  iv. isolation or dequeueing procedure must clear PagePrivate flag under
+ *      page lock together with removing page from balloon device page list.
+ *
  * The functions provided by this interface are placed to help on coping with
  * the aforementioned balloon page corner case, as well as to ensure the simple
  * set of exposed rules are satisfied while we are dealing with balloon pages
@@ -54,43 +57,22 @@
  * balloon driver as a page book-keeper for its registered balloon devices.
  */
 struct balloon_dev_info {
-        void *balloon_device;           /* balloon device descriptor */
-        struct address_space *mapping;  /* balloon special page->mapping */
         unsigned long isolated_pages;   /* # of isolated pages for migration */
         spinlock_t pages_lock;          /* Protection to pages list */
         struct list_head pages;         /* Pages enqueued & handled to Host */
+        int (*migratepage)(struct balloon_dev_info *, struct page *newpage,
+                        struct page *page, enum migrate_mode mode);
 };
 
 extern struct page *balloon_page_enqueue(struct balloon_dev_info *b_dev_info);
 extern struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info);
-extern struct balloon_dev_info *balloon_devinfo_alloc(
-                                                void *balloon_dev_descriptor);
 
-static inline void balloon_devinfo_free(struct balloon_dev_info *b_dev_info)
-{
-        kfree(b_dev_info);
-}
-
-/*
- * balloon_page_free - release a balloon page back to the page free lists
- * @page: ballooned page to be set free
- *
- * This function must be used to properly set free an isolated/dequeued balloon
- * page at the end of a sucessful page migration, or at the balloon driver's
- * page release procedure.
- */
-static inline void balloon_page_free(struct page *page)
+static inline void balloon_devinfo_init(struct balloon_dev_info *balloon)
 {
-        /*
-         * Balloon pages always get an extra refcount before being isolated
-         * and before being dequeued to help on sorting out fortuite colisions
-         * between a thread attempting to isolate and another thread attempting
-         * to release the very same balloon page.
-         *
-         * Before we handle the page back to Buddy, lets drop its extra refcnt.
-         */
-        put_page(page);
-        __free_page(page);
+        balloon->isolated_pages = 0;
+        spin_lock_init(&balloon->pages_lock);
+        INIT_LIST_HEAD(&balloon->pages);
+        balloon->migratepage = NULL;
 }
 
 #ifdef CONFIG_BALLOON_COMPACTION
@@ -98,107 +80,58 @@ extern bool balloon_page_isolate(struct page *page);
 extern void balloon_page_putback(struct page *page);
 extern int balloon_page_migrate(struct page *newpage,
                                 struct page *page, enum migrate_mode mode);
-extern struct address_space
-*balloon_mapping_alloc(struct balloon_dev_info *b_dev_info,
-                        const struct address_space_operations *a_ops);
-
-static inline void balloon_mapping_free(struct address_space *balloon_mapping)
-{
-        kfree(balloon_mapping);
-}
 
 /*
- * page_flags_cleared - helper to perform balloon @page ->flags tests.
- *
- * As balloon pages are obtained from buddy and we do not play with page->flags
- * at driver level (exception made when we get the page lock for compaction),
- * we can safely identify a ballooned page by checking if the
- * PAGE_FLAGS_CHECK_AT_PREP page->flags are all cleared.  This approach also
- * helps us skip ballooned pages that are locked for compaction or release, thus
- * mitigating their racy check at balloon_page_movable()
- */
-static inline bool page_flags_cleared(struct page *page)
-{
-        return !(page->flags & PAGE_FLAGS_CHECK_AT_PREP);
-}
-
-/*
- * __is_movable_balloon_page - helper to perform @page mapping->flags tests
+ * __is_movable_balloon_page - helper to perform @page PageBalloon tests
  */
 static inline bool __is_movable_balloon_page(struct page *page)
 {
-        struct address_space *mapping = page->mapping;
-        return mapping_balloon(mapping);
+        return PageBalloon(page);
 }
 
 /*
- * balloon_page_movable - test page->mapping->flags to identify balloon pages
- *                        that can be moved by compaction/migration.
- *
- * This function is used at core compaction's page isolation scheme, therefore
- * most pages exposed to it are not enlisted as balloon pages and so, to avoid
- * undesired side effects like racing against __free_pages(), we cannot afford
- * holding the page locked while testing page->mapping->flags here.
+ * balloon_page_movable - test PageBalloon to identify balloon pages
+ *                        and PagePrivate to check that the page is not
+ *                        isolated and can be moved by compaction/migration.
  *
  * As we might return false positives in the case of a balloon page being just
- * released under us, the page->mapping->flags need to be re-tested later,
- * under the proper page lock, at the functions that will be coping with the
- * balloon page case.
+ * released under us, this need to be re-tested later, under the page lock.
  */
 static inline bool balloon_page_movable(struct page *page)
 {
-        /*
-         * Before dereferencing and testing mapping->flags, let's make sure
-         * this is not a page that uses ->mapping in a different way
-         */
-        if (page_flags_cleared(page) && !page_mapped(page) &&
-            page_count(page) == 1)
-                return __is_movable_balloon_page(page);
-
-        return false;
+        return PageBalloon(page) && PagePrivate(page);
 }
 
 /*
  * isolated_balloon_page - identify an isolated balloon page on private
  *                         compaction/migration page lists.
- *
- * After a compaction thread isolates a balloon page for migration, it raises
- * the page refcount to prevent concurrent compaction threads from re-isolating
- * the same page. For that reason putback_movable_pages(), or other routines
- * that need to identify isolated balloon pages on private pagelists, cannot
- * rely on balloon_page_movable() to accomplish the task.
  */
 static inline bool isolated_balloon_page(struct page *page)
 {
-        /* Already isolated balloon pages, by default, have a raised refcount */
-        if (page_flags_cleared(page) && !page_mapped(page) &&
-            page_count(page) >= 2)
-                return __is_movable_balloon_page(page);
-
-        return false;
+        return PageBalloon(page);
 }
 
 /*
  * balloon_page_insert - insert a page into the balloon's page list and make
- *                       the page->mapping assignment accordingly.
+ *                       the page->private assignment accordingly.
+ * @balloon : pointer to balloon device
  * @page    : page to be assigned as a 'balloon page'
- * @mapping : allocated special 'balloon_mapping'
- * @head    : balloon's device page list head
  *
  * Caller must ensure the page is locked and the spin_lock protecting balloon
  * pages list is held before inserting a page into the balloon device.
  */
-static inline void balloon_page_insert(struct page *page,
-                                       struct address_space *mapping,
-                                       struct list_head *head)
+static inline void balloon_page_insert(struct balloon_dev_info *balloon,
+                                       struct page *page)
 {
-        page->mapping = mapping;
-        list_add(&page->lru, head);
+        __SetPageBalloon(page);
+        SetPagePrivate(page);
+        set_page_private(page, (unsigned long)balloon);
+        list_add(&page->lru, &balloon->pages);
 }
 
 /*
  * balloon_page_delete - delete a page from balloon's page list and clear
- *                       the page->mapping assignement accordingly.
+ *                       the page->private assignement accordingly.
  * @page    : page to be released from balloon's page list
  *
  * Caller must ensure the page is locked and the spin_lock protecting balloon
@@ -206,8 +139,12 @@ static inline void balloon_page_insert(struct page *page,
  */
 static inline void balloon_page_delete(struct page *page)
 {
-        page->mapping = NULL;
-        list_del(&page->lru);
+        __ClearPageBalloon(page);
+        set_page_private(page, 0);
+        if (PagePrivate(page)) {
+                ClearPagePrivate(page);
+                list_del(&page->lru);
+        }
 }
 
 /*
@@ -216,11 +153,7 @@ static inline void balloon_page_delete(struct page *page)
  */
 static inline struct balloon_dev_info *balloon_page_device(struct page *page)
 {
-        struct address_space *mapping = page->mapping;
-        if (likely(mapping))
-                return mapping->private_data;
-
-        return NULL;
+        return (struct balloon_dev_info *)page_private(page);
 }
 
 static inline gfp_t balloon_mapping_gfp_mask(void)
@@ -228,34 +161,24 @@ static inline gfp_t balloon_mapping_gfp_mask(void)
         return GFP_HIGHUSER_MOVABLE;
 }
 
-static inline bool balloon_compaction_check(void)
-{
-        return true;
-}
-
 #else /* !CONFIG_BALLOON_COMPACTION */
 
-static inline void *balloon_mapping_alloc(void *balloon_device,
-                                const struct address_space_operations *a_ops)
-{
-        return ERR_PTR(-EOPNOTSUPP);
-}
-
-static inline void balloon_mapping_free(struct address_space *balloon_mapping)
+static inline void balloon_page_insert(struct balloon_dev_info *balloon,
+                                       struct page *page)
 {
-        return;
+        __SetPageBalloon(page);
+        list_add(&page->lru, &balloon->pages);
 }
 
-static inline void balloon_page_insert(struct page *page,
-                                       struct address_space *mapping,
-                                       struct list_head *head)
+static inline void balloon_page_delete(struct page *page)
 {
-        list_add(&page->lru, head);
+        __ClearPageBalloon(page);
+        list_del(&page->lru);
 }
 
-static inline void balloon_page_delete(struct page *page)
+static inline bool __is_movable_balloon_page(struct page *page)
 {
-        list_del(&page->lru);
+        return false;
 }
 
 static inline bool balloon_page_movable(struct page *page)
@@ -289,9 +212,5 @@ static inline gfp_t balloon_mapping_gfp_mask(void)
         return GFP_HIGHUSER;
 }
 
-static inline bool balloon_compaction_check(void)
-{
-        return false;
-}
 #endif /* CONFIG_BALLOON_COMPACTION */
 #endif /* _LINUX_BALLOON_COMPACTION_H */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 518b46555b80..87be398166d3 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1564,7 +1564,7 @@ static inline int blk_rq_map_integrity_sg(struct request_queue *q,
 }
 static inline struct blk_integrity *bdev_get_integrity(struct block_device *b)
 {
-        return 0;
+        return NULL;
 }
 static inline struct blk_integrity *blk_get_integrity(struct gendisk *disk)
 {
diff --git a/include/linux/compaction.h b/include/linux/compaction.h
index 01e3132820da..60bdf8dc02a3 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -2,14 +2,24 @@
 #define _LINUX_COMPACTION_H
 
 /* Return values for compact_zone() and try_to_compact_pages() */
+/* compaction didn't start as it was deferred due to past failures */
+#define COMPACT_DEFERRED        0
 /* compaction didn't start as it was not possible or direct reclaim was more suitable */
-#define COMPACT_SKIPPED         0
+#define COMPACT_SKIPPED         1
 /* compaction should continue to another pageblock */
-#define COMPACT_CONTINUE        1
+#define COMPACT_CONTINUE        2
 /* direct compaction partially compacted a zone and there are suitable pages */
-#define COMPACT_PARTIAL         2
+#define COMPACT_PARTIAL         3
 /* The full zone was compacted */
-#define COMPACT_COMPLETE        3
+#define COMPACT_COMPLETE        4
+
+/* Used to signal whether compaction detected need_sched() or lock contention */
+/* No contention detected */
+#define COMPACT_CONTENDED_NONE  0
+/* Either need_sched() was true or fatal signal pending */
+#define COMPACT_CONTENDED_SCHED 1
+/* Zone lock or lru_lock was contended in async compaction */
+#define COMPACT_CONTENDED_LOCK  2
 
 #ifdef CONFIG_COMPACTION
 extern int sysctl_compact_memory;
@@ -22,7 +32,8 @@ extern int sysctl_extfrag_handler(struct ctl_table *table, int write,
 extern int fragmentation_index(struct zone *zone, unsigned int order);
 extern unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *mask,
-                        enum migrate_mode mode, bool *contended);
+                        enum migrate_mode mode, int *contended,
+                        struct zone **candidate_zone);
 extern void compact_pgdat(pg_data_t *pgdat, int order);
 extern void reset_isolation_suitable(pg_data_t *pgdat);
 extern unsigned long compaction_suitable(struct zone *zone, int order);
@@ -91,7 +102,8 @@ static inline bool compaction_restarting(struct zone *zone, int order)
 #else
 static inline unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        enum migrate_mode mode, bool *contended)
+                        enum migrate_mode mode, int *contended,
+                        struct zone **candidate_zone)
 {
         return COMPACT_CONTINUE;
 }
diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
index 1c2fdaa2ffc3..1ccaab44abcc 100644
--- a/include/linux/genalloc.h
+++ b/include/linux/genalloc.h
@@ -110,6 +110,10 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo,
 extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
                 unsigned long start, unsigned int nr, void *data);
 
+extern unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+                unsigned long size, unsigned long start, unsigned int nr,
+                void *data);
+
 extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
                 unsigned long start, unsigned int nr, void *data);
 
@@ -117,6 +121,9 @@ extern struct gen_pool *devm_gen_pool_create(struct device *dev,
                 int min_alloc_order, int nid);
 extern struct gen_pool *dev_get_gen_pool(struct device *dev);
 
+bool addr_in_gen_pool(struct gen_pool *pool, unsigned long start,
+                        size_t size);
+
 #ifdef CONFIG_OF
 extern struct gen_pool *of_get_named_gen_pool(struct device_node *np,
         const char *propname, int index);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 5e7219dc0fae..41b30fd4d041 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -156,7 +156,7 @@ struct vm_area_struct;
 #define GFP_DMA32       __GFP_DMA32
 
 /* Convert GFP flags to their corresponding migrate type */
-static inline int allocflags_to_migratetype(gfp_t gfp_flags)
+static inline int gfpflags_to_migratetype(const gfp_t gfp_flags)
 {
         WARN_ON((gfp_flags & GFP_MOVABLE_MASK) == GFP_MOVABLE_MASK);
 
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index 63579cb8d3dc..ad9051bab267 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -132,7 +132,7 @@ extern int __pmd_trans_huge_lock(pmd_t *pmd, struct vm_area_struct *vma,
 static inline int pmd_trans_huge_lock(pmd_t *pmd, struct vm_area_struct *vma,
                 spinlock_t **ptl)
 {
-        VM_BUG_ON(!rwsem_is_locked(&vma->vm_mm->mmap_sem));
+        VM_BUG_ON_VMA(!rwsem_is_locked(&vma->vm_mm->mmap_sem), vma);
         if (pmd_trans_huge(*pmd))
                 return __pmd_trans_huge_lock(pmd, vma, ptl);
         else
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 95624bed87ef..e9e420b6d931 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -715,23 +715,8 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
         (void) (&_max1 == &_max2);              \
         _max1 > _max2 ? _max1 : _max2; })
 
-#define min3(x, y, z) ({                        \
-        typeof(x) _min1 = (x);                  \
-        typeof(y) _min2 = (y);                  \
-        typeof(z) _min3 = (z);                  \
-        (void) (&_min1 == &_min2);              \
-        (void) (&_min1 == &_min3);              \
-        _min1 < _min2 ? (_min1 < _min3 ? _min1 : _min3) : \
-                (_min2 < _min3 ? _min2 : _min3); })
-
-#define max3(x, y, z) ({                        \
-        typeof(x) _max1 = (x);                  \
-        typeof(y) _max2 = (y);                  \
-        typeof(z) _max3 = (z);                  \
-        (void) (&_max1 == &_max2);              \
-        (void) (&_max1 == &_max3);              \
-        _max1 > _max2 ? (_max1 > _max3 ? _max1 : _max3) : \
-                (_max2 > _max3 ? _max2 : _max3); })
+#define min3(x, y, z) min((typeof(x))min(x, y), z)
+#define max3(x, y, z) max((typeof(x))max(x, y), z)
 
 /**
  * min_not_zero - return the minimum that is _not_ zero, unless both are zero
@@ -746,20 +731,13 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
 /**
  * clamp - return a value clamped to a given range with strict typechecking
  * @val: current value
- * @min: minimum allowable value
- * @max: maximum allowable value
+ * @lo: lowest allowable value
+ * @hi: highest allowable value
  *
- * This macro does strict typechecking of min/max to make sure they are of the
+ * This macro does strict typechecking of lo/hi to make sure they are of the
  * same type as val.  See the unnecessary pointer comparisons.
  */
-#define clamp(val, min, max) ({                 \
-        typeof(val) __val = (val);              \
-        typeof(min) __min = (min);              \
-        typeof(max) __max = (max);              \
-        (void) (&__val == &__min);              \
-        (void) (&__val == &__max);              \
-        __val = __val < __min ? __min: __val;   \
-        __val > __max ? __max: __val; })
+#define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi)
 
 /*
  * ..and if you can't take the strict
@@ -781,36 +759,26 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * clamp_t - return a value clamped to a given range using a given type
  * @type: the type of variable to use
  * @val: current value
- * @min: minimum allowable value
- * @max: maximum allowable value
+ * @lo: minimum allowable value
+ * @hi: maximum allowable value
  *
  * This macro does no typechecking and uses temporary variables of type
  * 'type' to make all the comparisons.
  */
-#define clamp_t(type, val, min, max) ({         \
-        type __val = (val);                     \
-        type __min = (min);                     \
-        type __max = (max);                     \
-        __val = __val < __min ? __min: __val;   \
-        __val > __max ? __max: __val; })
+#define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi)
 
 /**
  * clamp_val - return a value clamped to a given range using val's type
  * @val: current value
- * @min: minimum allowable value
- * @max: maximum allowable value
+ * @lo: minimum allowable value
+ * @hi: maximum allowable value
  *
  * This macro does no typechecking and uses temporary variables of whatever
  * type the input argument 'val' is.  This is useful when val is an unsigned
  * type and min and max are literals that will otherwise be assigned a signed
  * integer type.
  */
-#define clamp_val(val, min, max) ({             \
-        typeof(val) __val = (val);              \
-        typeof(val) __min = (min);              \
-        typeof(val) __max = (max);              \
-        __val = __val < __min ? __min: __val;   \
-        __val > __max ? __max: __val; })
+#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
 
 
 /*
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index e0752d204d9e..19df5d857411 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -440,11 +440,6 @@ void __memcg_kmem_uncharge_pages(struct page *page, int order);
 
 int memcg_cache_id(struct mem_cgroup *memcg);
 
-int memcg_alloc_cache_params(struct mem_cgroup *memcg, struct kmem_cache *s,
-                             struct kmem_cache *root_cache);
-void memcg_free_cache_params(struct kmem_cache *s);
-
-int memcg_update_cache_size(struct kmem_cache *s, int num_groups);
 void memcg_update_array_size(int num_groups);
 
 struct kmem_cache *
@@ -574,16 +569,6 @@ static inline int memcg_cache_id(struct mem_cgroup *memcg)
         return -1;
 }
 
-static inline int memcg_alloc_cache_params(struct mem_cgroup *memcg,
-                struct kmem_cache *s, struct kmem_cache *root_cache)
-{
-        return 0;
-}
-
-static inline void memcg_free_cache_params(struct kmem_cache *s)
-{
-}
-
 static inline struct kmem_cache *
 memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp)
 {
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index d9524c49d767..8f1a41951df9 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -84,6 +84,7 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages);
 extern int add_one_highpage(struct page *page, int pfn, int bad_ppro);
 /* VM interface that may be used by firmware interface */
 extern int online_pages(unsigned long, unsigned long, int);
+extern int test_pages_in_a_zone(unsigned long, unsigned long);
 extern void __offline_isolated_pages(unsigned long, unsigned long);
 
 typedef void (*online_page_callback_t)(struct page *page);
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index f230a978e6ba..3d385c81c153 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -134,9 +134,10 @@ void mpol_free_shared_policy(struct shared_policy *p);
 struct mempolicy *mpol_shared_policy_lookup(struct shared_policy *sp,
                                             unsigned long idx);
 
-struct mempolicy *get_vma_policy(struct task_struct *tsk,
-                struct vm_area_struct *vma, unsigned long addr);
-bool vma_policy_mof(struct task_struct *task, struct vm_area_struct *vma);
+struct mempolicy *get_task_policy(struct task_struct *p);
+struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
+                unsigned long addr);
+bool vma_policy_mof(struct vm_area_struct *vma);
 
 extern void numa_default_policy(void);
 extern void numa_policy_init(void);
diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index a2901c414664..01aad3ed89ec 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -13,18 +13,9 @@ typedef void free_page_t(struct page *page, unsigned long private);
  * Return values from addresss_space_operations.migratepage():
  * - negative errno on page migration failure;
  * - zero on page migration success;
- *
- * The balloon page migration introduces this special case where a 'distinct'
- * return code is used to flag a successful page migration to unmap_and_move().
- * This approach is necessary because page migration can race against balloon
- * deflation procedure, and for such case we could introduce a nasty page leak
- * if a successfully migrated balloon page gets released concurrently with
- * migration's unmap_and_move() wrap-up steps.
  */
 #define MIGRATEPAGE_SUCCESS             0
-#define MIGRATEPAGE_BALLOON_SUCCESS     1 /* special ret code for balloon page
-                                           * sucessful migration case.
-                                           */
+
 enum migrate_reason {
         MR_COMPACTION,
         MR_MEMORY_FAILURE,
@@ -82,9 +73,6 @@ static inline int migrate_huge_page_move_mapping(struct address_space *mapping,
         return -ENOSYS;
 }
 
-/* Possible settings for the migrate_page() method in address_operations */
-#define migrate_page NULL
-
 #endif /* CONFIG_MIGRATION */
 
 #ifdef CONFIG_NUMA_BALANCING
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 0f4196a0bc20..fa0d74e06428 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -18,6 +18,7 @@
 #include <linux/pfn.h>
 #include <linux/bit_spinlock.h>
 #include <linux/shrinker.h>
+#include <linux/resource.h>
 
 struct mempolicy;
 struct anon_vma;
@@ -553,6 +554,25 @@ static inline void __ClearPageBuddy(struct page *page)
         atomic_set(&page->_mapcount, -1);
 }
 
+#define PAGE_BALLOON_MAPCOUNT_VALUE (-256)
+
+static inline int PageBalloon(struct page *page)
+{
+        return atomic_read(&page->_mapcount) == PAGE_BALLOON_MAPCOUNT_VALUE;
+}
+
+static inline void __SetPageBalloon(struct page *page)
+{
+        VM_BUG_ON_PAGE(atomic_read(&page->_mapcount) != -1, page);
+        atomic_set(&page->_mapcount, PAGE_BALLOON_MAPCOUNT_VALUE);
+}
+
+static inline void __ClearPageBalloon(struct page *page)
+{
+        VM_BUG_ON_PAGE(!PageBalloon(page), page);
+        atomic_set(&page->_mapcount, -1);
+}
+
 void put_page(struct page *page);
 void put_pages_list(struct list_head *pages);
 
@@ -1247,8 +1267,8 @@ static inline int stack_guard_page_end(struct vm_area_struct *vma,
                 !vma_growsup(vma->vm_next, addr);
 }
 
-extern pid_t
-vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group);
+extern struct task_struct *task_of_stack(struct task_struct *task,
+                                struct vm_area_struct *vma, bool in_group);
 
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
                 unsigned long old_addr, struct vm_area_struct *new_vma,
@@ -1780,6 +1800,20 @@ extern struct vm_area_struct *copy_vma(struct vm_area_struct **,
         bool *need_rmap_locks);
 extern void exit_mmap(struct mm_struct *);
 
+static inline int check_data_rlimit(unsigned long rlim,
+                                    unsigned long new,
+                                    unsigned long start,
+                                    unsigned long end_data,
+                                    unsigned long start_data)
+{
+        if (rlim < RLIM_INFINITY) {
+                if (((new - start) + (end_data - start_data)) > rlim)
+                        return -ENOSPC;
+        }
+
+        return 0;
+}
+
 extern int mm_take_all_locks(struct mm_struct *mm);
 extern void mm_drop_all_locks(struct mm_struct *mm);
 
diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
index 2f348d02f640..877ef226f90f 100644
--- a/include/linux/mmdebug.h
+++ b/include/linux/mmdebug.h
@@ -4,10 +4,14 @@
 #include <linux/stringify.h>
 
 struct page;
+struct vm_area_struct;
+struct mm_struct;
 
 extern void dump_page(struct page *page, const char *reason);
 extern void dump_page_badflags(struct page *page, const char *reason,
                                unsigned long badflags);
+void dump_vma(const struct vm_area_struct *vma);
+void dump_mm(const struct mm_struct *mm);
 
 #ifdef CONFIG_DEBUG_VM
 #define VM_BUG_ON(cond) BUG_ON(cond)
@@ -18,12 +22,28 @@ extern void dump_page_badflags(struct page *page, const char *reason,
                         BUG();                                          \
                 }                                                       \
         } while (0)
+#define VM_BUG_ON_VMA(cond, vma)                                        \
+        do {                                                            \
+                if (unlikely(cond)) {                                   \
+                        dump_vma(vma);                                  \
+                        BUG();                                          \
+                }                                                       \
+        } while (0)
+#define VM_BUG_ON_MM(cond, mm)                                          \
+        do {                                                            \
+                if (unlikely(cond)) {                                   \
+                        dump_mm(mm);                                    \
+                        BUG();                                          \
+                }                                                       \
+        } while (0)
 #define VM_WARN_ON(cond) WARN_ON(cond)
 #define VM_WARN_ON_ONCE(cond) WARN_ON_ONCE(cond)
 #define VM_WARN_ONCE(cond, format...) WARN_ONCE(cond, format)
 #else
 #define VM_BUG_ON(cond) BUILD_BUG_ON_INVALID(cond)
 #define VM_BUG_ON_PAGE(cond, page) VM_BUG_ON(cond)
+#define VM_BUG_ON_VMA(cond, vma) VM_BUG_ON(cond)
+#define VM_BUG_ON_MM(cond, mm) VM_BUG_ON(cond)
 #define VM_WARN_ON(cond) BUILD_BUG_ON_INVALID(cond)
 #define VM_WARN_ON_ONCE(cond) BUILD_BUG_ON_INVALID(cond)
 #define VM_WARN_ONCE(cond, format...) BUILD_BUG_ON_INVALID(cond)
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 318df7051850..48bf12ef6620 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -521,13 +521,13 @@ struct zone {
         atomic_long_t           vm_stat[NR_VM_ZONE_STAT_ITEMS];
 } ____cacheline_internodealigned_in_smp;
 
-typedef enum {
+enum zone_flags {
         ZONE_RECLAIM_LOCKED,            /* prevents concurrent reclaim */
         ZONE_OOM_LOCKED,                /* zone is in OOM killer zonelist */
         ZONE_CONGESTED,                 /* zone has many dirty pages backed by
                                          * a congested BDI
                                          */
-        ZONE_TAIL_LRU_DIRTY,            /* reclaim scanning has recently found
+        ZONE_DIRTY,                     /* reclaim scanning has recently found
                                          * many dirty file pages at the tail
                                          * of the LRU.
                                          */
@@ -535,52 +535,7 @@ typedef enum {
                                          * many pages under writeback
                                          */
         ZONE_FAIR_DEPLETED,             /* fair zone policy batch depleted */
-} zone_flags_t;
-
-static inline void zone_set_flag(struct zone *zone, zone_flags_t flag)
-{
-        set_bit(flag, &zone->flags);
-}
-
-static inline int zone_test_and_set_flag(struct zone *zone, zone_flags_t flag)
-{
-        return test_and_set_bit(flag, &zone->flags);
-}
-
-static inline void zone_clear_flag(struct zone *zone, zone_flags_t flag)
-{
-        clear_bit(flag, &zone->flags);
-}
-
-static inline int zone_is_reclaim_congested(const struct zone *zone)
-{
-        return test_bit(ZONE_CONGESTED, &zone->flags);
-}
-
-static inline int zone_is_reclaim_dirty(const struct zone *zone)
-{
-        return test_bit(ZONE_TAIL_LRU_DIRTY, &zone->flags);
-}
-
-static inline int zone_is_reclaim_writeback(const struct zone *zone)
-{
-        return test_bit(ZONE_WRITEBACK, &zone->flags);
-}
-
-static inline int zone_is_reclaim_locked(const struct zone *zone)
-{
-        return test_bit(ZONE_RECLAIM_LOCKED, &zone->flags);
-}
-
-static inline int zone_is_fair_depleted(const struct zone *zone)
-{
-        return test_bit(ZONE_FAIR_DEPLETED, &zone->flags);
-}
-
-static inline int zone_is_oom_locked(const struct zone *zone)
-{
-        return test_bit(ZONE_OOM_LOCKED, &zone->flags);
-}
+};
 
 static inline unsigned long zone_end_pfn(const struct zone *zone)
 {
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 19191d39c4f3..7ea069cd3257 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -24,8 +24,7 @@ enum mapping_flags {
         AS_ENOSPC       = __GFP_BITS_SHIFT + 1, /* ENOSPC on async write */
         AS_MM_ALL_LOCKS = __GFP_BITS_SHIFT + 2, /* under mm_take_all_locks() */
         AS_UNEVICTABLE  = __GFP_BITS_SHIFT + 3, /* e.g., ramdisk, SHM_LOCK */
-        AS_BALLOON_MAP  = __GFP_BITS_SHIFT + 4, /* balloon page special map */
-        AS_EXITING      = __GFP_BITS_SHIFT + 5, /* final truncate in progress */
+        AS_EXITING      = __GFP_BITS_SHIFT + 4, /* final truncate in progress */
 };
 
 static inline void mapping_set_error(struct address_space *mapping, int error)
@@ -55,21 +54,6 @@ static inline int mapping_unevictable(struct address_space *mapping)
         return !!mapping;
 }
 
-static inline void mapping_set_balloon(struct address_space *mapping)
-{
-        set_bit(AS_BALLOON_MAP, &mapping->flags);
-}
-
-static inline void mapping_clear_balloon(struct address_space *mapping)
-{
-        clear_bit(AS_BALLOON_MAP, &mapping->flags);
-}
-
-static inline int mapping_balloon(struct address_space *mapping)
-{
-        return mapping && test_bit(AS_BALLOON_MAP, &mapping->flags);
-}
-
 static inline void mapping_set_exiting(struct address_space *mapping)
 {
         set_bit(AS_EXITING, &mapping->flags);
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index be574506e6a9..c0c2bce6b0b7 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -150,7 +150,7 @@ int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
 static inline void anon_vma_merge(struct vm_area_struct *vma,
                                   struct vm_area_struct *next)
 {
-        VM_BUG_ON(vma->anon_vma != next->anon_vma);
+        VM_BUG_ON_VMA(vma->anon_vma != next->anon_vma, vma);
         unlink_anon_vmas(next);
 }
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 9c6353d9e63a..5e63ba59258c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1935,11 +1935,13 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
 #define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
 #define used_math() tsk_used_math(current)
 
-/* __GFP_IO isn't allowed if PF_MEMALLOC_NOIO is set in current->flags */
+/* __GFP_IO isn't allowed if PF_MEMALLOC_NOIO is set in current->flags
+ * __GFP_FS is also cleared as it implies __GFP_IO.
+ */
 static inline gfp_t memalloc_noio_flags(gfp_t flags)
 {
         if (unlikely(current->flags & PF_MEMALLOC_NOIO))
-                flags &= ~__GFP_IO;
+                flags &= ~(__GFP_IO | __GFP_FS);
         return flags;
 }
 
diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
index 005bf3e38db5..f0f8bad54be9 100644
--- a/include/linux/screen_info.h
+++ b/include/linux/screen_info.h
@@ -5,12 +5,4 @@
 
 extern struct screen_info screen_info;
 
-#define ORIG_X                  (screen_info.orig_x)
-#define ORIG_Y                  (screen_info.orig_y)
-#define ORIG_VIDEO_MODE         (screen_info.orig_video_mode)
-#define ORIG_VIDEO_COLS         (screen_info.orig_video_cols)
-#define ORIG_VIDEO_EGA_BX       (screen_info.orig_video_ega_bx)
-#define ORIG_VIDEO_LINES        (screen_info.orig_video_lines)
-#define ORIG_VIDEO_ISVGA        (screen_info.orig_video_isVGA)
-#define ORIG_VIDEO_POINTS       (screen_info.orig_video_points)
 #endif /* _SCREEN_INFO_H */
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 1d9abb7d22a0..c265bec6a57d 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -158,31 +158,6 @@ size_t ksize(const void *);
 #define ARCH_KMALLOC_MINALIGN __alignof__(unsigned long long)
 #endif
 
-#ifdef CONFIG_SLOB
-/*
- * Common fields provided in kmem_cache by all slab allocators
- * This struct is either used directly by the allocator (SLOB)
- * or the allocator must include definitions for all fields
- * provided in kmem_cache_common in their definition of kmem_cache.
- *
- * Once we can do anonymous structs (C11 standard) we could put a
- * anonymous struct definition in these allocators so that the
- * separate allocations in the kmem_cache structure of SLAB and
- * SLUB is no longer needed.
- */
-struct kmem_cache {
-        unsigned int object_size;/* The original size of the object */
-        unsigned int size;      /* The aligned/padded/added on size  */
-        unsigned int align;     /* Alignment as calculated */
-        unsigned long flags;    /* Active flags on the slab */
-        const char *name;       /* Slab name for sysfs */
-        int refcount;           /* Use counter */
-        void (*ctor)(void *);   /* Called on object slot creation */
-        struct list_head list;  /* List of all slab caches on the system */
-};
-
-#endif /* CONFIG_SLOB */
-
 /*
  * Kmalloc array related definitions
  */
@@ -363,14 +338,6 @@ kmem_cache_alloc_node_trace(struct kmem_cache *s,
 }
 #endif /* CONFIG_TRACING */
 
-#ifdef CONFIG_SLAB
-#include <linux/slab_def.h>
-#endif
-
-#ifdef CONFIG_SLUB
-#include <linux/slub_def.h>
-#endif
-
 extern void *kmalloc_order(size_t size, gfp_t flags, unsigned int order);
 
 #ifdef CONFIG_TRACING
@@ -582,37 +549,15 @@ static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
  * allocator where we care about the real place the memory allocation
  * request comes from.
  */
-#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
-        (defined(CONFIG_SLAB) && defined(CONFIG_TRACING)) || \
-        (defined(CONFIG_SLOB) && defined(CONFIG_TRACING))
 extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
 #define kmalloc_track_caller(size, flags) \
         __kmalloc_track_caller(size, flags, _RET_IP_)
-#else
-#define kmalloc_track_caller(size, flags) \
-        __kmalloc(size, flags)
-#endif /* DEBUG_SLAB */
 
 #ifdef CONFIG_NUMA
-/*
- * kmalloc_node_track_caller is a special version of kmalloc_node that
- * records the calling function of the routine calling it for slab leak
- * tracking instead of just the calling function (confusing, eh?).
- * It's useful when the call to kmalloc_node comes from a widely-used
- * standard allocator where we care about the real place the memory
- * allocation request comes from.
- */
-#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
-        (defined(CONFIG_SLAB) && defined(CONFIG_TRACING)) || \
-        (defined(CONFIG_SLOB) && defined(CONFIG_TRACING))
 extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long);
 #define kmalloc_node_track_caller(size, flags, node) \
         __kmalloc_node_track_caller(size, flags, node, \
                         _RET_IP_)
-#else
-#define kmalloc_node_track_caller(size, flags, node) \
-        __kmalloc_node(size, flags, node)
-#endif
 
 #else /* CONFIG_NUMA */
 
@@ -650,14 +595,7 @@ static inline void *kzalloc_node(size_t size, gfp_t flags, int node)
         return kmalloc_node(size, flags | __GFP_ZERO, node);
 }
 
-/*
- * Determine the size of a slab object
- */
-static inline unsigned int kmem_cache_size(struct kmem_cache *s)
-{
-        return s->object_size;
-}
-
+unsigned int kmem_cache_size(struct kmem_cache *s);
 void __init kmem_cache_init_late(void);
 
 #endif  /* _LINUX_SLAB_H */
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
index 8235dfbb3b05..b869d1662ba3 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -8,6 +8,8 @@
  */
 
 struct kmem_cache {
+        struct array_cache __percpu *cpu_cache;
+
 /* 1) Cache tunables. Protected by slab_mutex */
         unsigned int batchcount;
         unsigned int limit;
@@ -71,23 +73,7 @@ struct kmem_cache {
         struct memcg_cache_params *memcg_params;
 #endif
 
-/* 6) per-cpu/per-node data, touched during every alloc/free */
-        /*
-         * We put array[] at the end of kmem_cache, because we want to size
-         * this array to nr_cpu_ids slots instead of NR_CPUS
-         * (see kmem_cache_init())
-         * We still use [NR_CPUS] and not [1] or [0] because cache_cache
-         * is statically defined, so we reserve the max number of cpus.
-         *
-         * We also need to guarantee that the list is able to accomodate a
-         * pointer for each node since "nodelists" uses the remainder of
-         * available pointers.
-         */
-        struct kmem_cache_node **node;
-        struct array_cache *array[NR_CPUS + MAX_NUMNODES];
-        /*
-         * Do not add fields after array[]
-         */
+        struct kmem_cache_node *node[MAX_NUMNODES];
 };
 
 #endif  /* _LINUX_SLAB_DEF_H */
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 1b72060f093a..37a585beef5c 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -327,8 +327,10 @@ extern void lru_cache_add_active_or_unevictable(struct page *page,
 extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                                         gfp_t gfp_mask, nodemask_t *mask);
 extern int __isolate_lru_page(struct page *page, isolate_mode_t mode);
-extern unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem,
-                                                  gfp_t gfp_mask, bool noswap);
+extern unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
+                                                  unsigned long nr_pages,
+                                                  gfp_t gfp_mask,
+                                                  bool may_swap);
 extern unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
                                                 gfp_t gfp_mask, bool noswap,
                                                 struct zone *zone,
@@ -354,22 +356,6 @@ static inline int zone_reclaim(struct zone *z, gfp_t mask, unsigned int order)
 extern int page_evictable(struct page *page);
 extern void check_move_unevictable_pages(struct page **, int nr_pages);
 
-extern unsigned long scan_unevictable_pages;
-extern int scan_unevictable_handler(struct ctl_table *, int,
-                                        void __user *, size_t *, loff_t *);
-#ifdef CONFIG_NUMA
-extern int scan_unevictable_register_node(struct node *node);
-extern void scan_unevictable_unregister_node(struct node *node);
-#else
-static inline int scan_unevictable_register_node(struct node *node)
-{
-        return 0;
-}
-static inline void scan_unevictable_unregister_node(struct node *node)
-{
-}
-#endif
-
 extern int kswapd_run(int nid);
 extern void kswapd_stop(int nid);
 #ifdef CONFIG_MEMCG
diff --git a/include/linux/topology.h b/include/linux/topology.h
index dda6ee521e74..909b6e43b694 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -119,11 +119,20 @@ static inline int numa_node_id(void)
  * Use the accessor functions set_numa_mem(), numa_mem_id() and cpu_to_mem().
  */
 DECLARE_PER_CPU(int, _numa_mem_);
+extern int _node_numa_mem_[MAX_NUMNODES];
 
 #ifndef set_numa_mem
 static inline void set_numa_mem(int node)
 {
         this_cpu_write(_numa_mem_, node);
+        _node_numa_mem_[numa_node_id()] = node;
+}
+#endif
+
+#ifndef node_to_mem_node
+static inline int node_to_mem_node(int node)
+{
+        return _node_numa_mem_[node];
 }
 #endif
 
@@ -146,6 +155,7 @@ static inline int cpu_to_mem(int cpu)
 static inline void set_cpu_numa_mem(int cpu, int node)
 {
         per_cpu(_numa_mem_, cpu) = node;
+        _node_numa_mem_[cpu_to_node(cpu)] = node;
 }
 #endif
 
@@ -159,6 +169,13 @@ static inline int numa_mem_id(void)
 }
 #endif
 
+#ifndef node_to_mem_node
+static inline int node_to_mem_node(int node)
+{
+        return node;
+}
+#endif
+
 #ifndef cpu_to_mem
 static inline int cpu_to_mem(int cpu)
 {
diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
index ced92345c963..730334cdf037 100644
--- a/include/linux/vm_event_item.h
+++ b/include/linux/vm_event_item.h
@@ -72,6 +72,13 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 THP_ZERO_PAGE_ALLOC,
                 THP_ZERO_PAGE_ALLOC_FAILED,
 #endif
+#ifdef CONFIG_MEMORY_BALLOON
+                BALLOON_INFLATE,
+                BALLOON_DEFLATE,
+#ifdef CONFIG_BALLOON_COMPACTION
+                BALLOON_MIGRATE,
+#endif
+#endif
 #ifdef CONFIG_DEBUG_TLBFLUSH
 #ifdef CONFIG_SMP
                 NR_TLB_REMOTE_FLUSH,    /* cpu tried to flush others' tlbs */
diff --git a/include/linux/zsmalloc.h b/include/linux/zsmalloc.h
index e44d634e7fb7..05c214760977 100644
--- a/include/linux/zsmalloc.h
+++ b/include/linux/zsmalloc.h
@@ -46,6 +46,6 @@ void *zs_map_object(struct zs_pool *pool, unsigned long handle,
                         enum zs_mapmode mm);
 void zs_unmap_object(struct zs_pool *pool, unsigned long handle);
 
-u64 zs_get_total_size_bytes(struct zs_pool *pool);
+unsigned long zs_get_total_pages(struct zs_pool *pool);
 
 #endif
diff --git a/include/uapi/linux/kernel-page-flags.h b/include/uapi/linux/kernel-page-flags.h
index 5116a0e48172..2f96d233c980 100644
--- a/include/uapi/linux/kernel-page-flags.h
+++ b/include/uapi/linux/kernel-page-flags.h
@@ -31,6 +31,7 @@
 
 #define KPF_KSM                 21
 #define KPF_THP                 22
+#define KPF_BALLOON             23
 
 
 #endif /* _UAPILINUX_KERNEL_PAGE_FLAGS_H */
diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
index 58afc04c107e..513df75d0fc9 100644
--- a/include/uapi/linux/prctl.h
+++ b/include/uapi/linux/prctl.h
@@ -1,6 +1,8 @@
 #ifndef _LINUX_PRCTL_H
 #define _LINUX_PRCTL_H
 
+#include <linux/types.h>
+
 /* Values to pass as first argument to prctl() */
 
 #define PR_SET_PDEATHSIG  1  /* Second arg is a signal */
@@ -119,6 +121,31 @@
 # define PR_SET_MM_ENV_END              11
 # define PR_SET_MM_AUXV                 12
 # define PR_SET_MM_EXE_FILE             13
+# define PR_SET_MM_MAP                  14
+# define PR_SET_MM_MAP_SIZE             15
+
+/*
+ * This structure provides new memory descriptor
+ * map which mostly modifies /proc/pid/stat[m]
+ * output for a task. This mostly done in a
+ * sake of checkpoint/restore functionality.
+ */
+struct prctl_mm_map {
+        __u64   start_code;             /* code section bounds */
+        __u64   end_code;
+        __u64   start_data;             /* data section bounds */
+        __u64   end_data;
+        __u64   start_brk;              /* heap for brk() syscall */
+        __u64   brk;
+        __u64   start_stack;            /* stack starts at */
+        __u64   arg_start;              /* command line arguments bounds */
+        __u64   arg_end;
+        __u64   env_start;              /* environment variables bounds */
+        __u64   env_end;
+        __u64   *auxv;                  /* auxiliary vector */
+        __u32   auxv_size;              /* vector size */
+        __u32   exe_fd;                 /* /proc/$pid/exe link file */
+};
 
 /*
  * Set specific pid that is allowed to ptrace the current task.
diff --git a/init/Kconfig b/init/Kconfig
index e25a82a291a6..d2355812ba48 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -889,17 +889,6 @@ config ARCH_SUPPORTS_INT128
 config ARCH_WANT_NUMA_VARIABLE_LOCALITY
         bool
 
-#
-# For architectures that are willing to define _PAGE_NUMA as _PAGE_PROTNONE
-config ARCH_WANTS_PROT_NUMA_PROT_NONE
-        bool
-
-config ARCH_USES_NUMA_PROT_NONE
-        bool
-        default y
-        depends on ARCH_WANTS_PROT_NUMA_PROT_NONE
-        depends on NUMA_BALANCING
-
 config NUMA_BALANCING_DEFAULT_ENABLED
         bool "Automatically enable NUMA aware memory/task placement"
         default y
diff --git a/kernel/acct.c b/kernel/acct.c
index b4c667d22e79..33738ef972f3 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -472,7 +472,6 @@ static void do_acct_process(struct bsd_acct_struct *acct)
         acct_t ac;
         unsigned long flim;
         const struct cred *orig_cred;
-        struct pid_namespace *ns = acct->ns;
         struct file *file = acct->file;
 
         /*
@@ -500,10 +499,15 @@ static void do_acct_process(struct bsd_acct_struct *acct)
         ac.ac_gid16 = ac.ac_gid;
 #endif
 #if ACCT_VERSION == 3
-        ac.ac_pid = task_tgid_nr_ns(current, ns);
-        rcu_read_lock();
-        ac.ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent), ns);
-        rcu_read_unlock();
+        {
+                struct pid_namespace *ns = acct->ns;
+
+                ac.ac_pid = task_tgid_nr_ns(current, ns);
+                rcu_read_lock();
+                ac.ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent),
+                                             ns);
+                rcu_read_unlock();
+        }
 #endif
         /*
          * Get freeze protection. If the fs is frozen, just skip the write
diff --git a/kernel/async.c b/kernel/async.c
index 61f023ce0228..4c3773c0bf63 100644
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -115,7 +115,7 @@ static void async_run_entry_fn(struct work_struct *work)
 
         /* 1) run (and print duration) */
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
-                printk(KERN_DEBUG "calling  %lli_%pF @ %i\n",
+                pr_debug("calling  %lli_%pF @ %i\n",
                         (long long)entry->cookie,
                         entry->func, task_pid_nr(current));
                 calltime = ktime_get();
@@ -124,7 +124,7 @@ static void async_run_entry_fn(struct work_struct *work)
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
                 rettime = ktime_get();
                 delta = ktime_sub(rettime, calltime);
-                printk(KERN_DEBUG "initcall %lli_%pF returned 0 after %lld usecs\n",
+                pr_debug("initcall %lli_%pF returned 0 after %lld usecs\n",
                         (long long)entry->cookie,
                         entry->func,
                         (long long)ktime_to_ns(delta) >> 10);
@@ -285,7 +285,7 @@ void async_synchronize_cookie_domain(async_cookie_t cookie, struct async_domain
         ktime_t uninitialized_var(starttime), delta, endtime;
 
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
-                printk(KERN_DEBUG "async_waiting @ %i\n", task_pid_nr(current));
+                pr_debug("async_waiting @ %i\n", task_pid_nr(current));
                 starttime = ktime_get();
         }
 
@@ -295,7 +295,7 @@ void async_synchronize_cookie_domain(async_cookie_t cookie, struct async_domain
                 endtime = ktime_get();
                 delta = ktime_sub(endtime, starttime);
 
-                printk(KERN_DEBUG "async_continuing @ %i after %lli usec\n",
+                pr_debug("async_continuing @ %i after %lli usec\n",
                         task_pid_nr(current),
                         (long long)ktime_to_ns(delta) >> 10);
         }
diff --git a/kernel/fork.c b/kernel/fork.c
index a91e47d86de2..8c162d102740 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -601,9 +601,8 @@ static void check_mm(struct mm_struct *mm)
                         printk(KERN_ALERT "BUG: Bad rss-counter state "
                                           "mm:%p idx:%d val:%ld\n", mm, i, x);
         }
-
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
-        VM_BUG_ON(mm->pmd_huge_pte);
+        VM_BUG_ON_MM(mm->pmd_huge_pte, mm);
 #endif
 }
 
diff --git a/kernel/kthread.c b/kernel/kthread.c
index ef483220e855..10e489c448fe 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -369,7 +369,7 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
 {
         struct task_struct *p;
 
-        p = kthread_create_on_node(threadfn, data, cpu_to_mem(cpu), namefmt,
+        p = kthread_create_on_node(threadfn, data, cpu_to_node(cpu), namefmt,
                                    cpu);
         if (IS_ERR(p))
                 return p;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bfa3c86d0d68..82088b29704e 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1946,7 +1946,7 @@ void task_numa_work(struct callback_head *work)
                 vma = mm->mmap;
         }
         for (; vma; vma = vma->vm_next) {
-                if (!vma_migratable(vma) || !vma_policy_mof(p, vma))
+                if (!vma_migratable(vma) || !vma_policy_mof(vma))
                         continue;
 
                 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index ce8129192a26..dfce4debd138 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -62,28 +62,28 @@
 #include <asm/unistd.h>
 
 #ifndef SET_UNALIGN_CTL
-# define SET_UNALIGN_CTL(a,b)   (-EINVAL)
+# define SET_UNALIGN_CTL(a, b)  (-EINVAL)
 #endif
 #ifndef GET_UNALIGN_CTL
-# define GET_UNALIGN_CTL(a,b)   (-EINVAL)
+# define GET_UNALIGN_CTL(a, b)  (-EINVAL)
 #endif
 #ifndef SET_FPEMU_CTL
-# define SET_FPEMU_CTL(a,b)     (-EINVAL)
+# define SET_FPEMU_CTL(a, b)    (-EINVAL)
 #endif
 #ifndef GET_FPEMU_CTL
-# define GET_FPEMU_CTL(a,b)     (-EINVAL)
+# define GET_FPEMU_CTL(a, b)    (-EINVAL)
 #endif
 #ifndef SET_FPEXC_CTL
-# define SET_FPEXC_CTL(a,b)     (-EINVAL)
+# define SET_FPEXC_CTL(a, b)    (-EINVAL)
 #endif
 #ifndef GET_FPEXC_CTL
-# define GET_FPEXC_CTL(a,b)     (-EINVAL)
+# define GET_FPEXC_CTL(a, b)    (-EINVAL)
 #endif
 #ifndef GET_ENDIAN
-# define GET_ENDIAN(a,b)        (-EINVAL)
+# define GET_ENDIAN(a, b)       (-EINVAL)
 #endif
 #ifndef SET_ENDIAN
-# define SET_ENDIAN(a,b)        (-EINVAL)
+# define SET_ENDIAN(a, b)       (-EINVAL)
 #endif
 #ifndef GET_TSC_CTL
 # define GET_TSC_CTL(a)         (-EINVAL)
@@ -182,39 +182,40 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
         rcu_read_lock();
         read_lock(&tasklist_lock);
         switch (which) {
-                case PRIO_PROCESS:
-                        if (who)
-                                p = find_task_by_vpid(who);
-                        else
-                                p = current;
-                        if (p)
-                                error = set_one_prio(p, niceval, error);
-                        break;
-                case PRIO_PGRP:
-                        if (who)
-                                pgrp = find_vpid(who);
-                        else
-                                pgrp = task_pgrp(current);
-                        do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
-                                error = set_one_prio(p, niceval, error);
-                        } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
-                        break;
-                case PRIO_USER:
-                        uid = make_kuid(cred->user_ns, who);
-                        user = cred->user;
-                        if (!who)
-                                uid = cred->uid;
-                        else if (!uid_eq(uid, cred->uid) &&
-                                 !(user = find_user(uid)))
+        case PRIO_PROCESS:
+                if (who)
+                        p = find_task_by_vpid(who);
+                else
+                        p = current;
+                if (p)
+                        error = set_one_prio(p, niceval, error);
+                break;
+        case PRIO_PGRP:
+                if (who)
+                        pgrp = find_vpid(who);
+                else
+                        pgrp = task_pgrp(current);
+                do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+                        error = set_one_prio(p, niceval, error);
+                } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
+                break;
+        case PRIO_USER:
+                uid = make_kuid(cred->user_ns, who);
+                user = cred->user;
+                if (!who)
+                        uid = cred->uid;
+                else if (!uid_eq(uid, cred->uid)) {
+                        user = find_user(uid);
+                        if (!user)
                                 goto out_unlock;        /* No processes for this user */
-
-                        do_each_thread(g, p) {
-                                if (uid_eq(task_uid(p), uid))
-                                        error = set_one_prio(p, niceval, error);
-                        } while_each_thread(g, p);
-                        if (!uid_eq(uid, cred->uid))
-                                free_uid(user);         /* For find_user() */
-                        break;
+                }
+                do_each_thread(g, p) {
+                        if (uid_eq(task_uid(p), uid))
+                                error = set_one_prio(p, niceval, error);
+                } while_each_thread(g, p);
+                if (!uid_eq(uid, cred->uid))
+                        free_uid(user);         /* For find_user() */
+                break;
         }
 out_unlock:
         read_unlock(&tasklist_lock);
@@ -244,47 +245,48 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
         rcu_read_lock();
         read_lock(&tasklist_lock);
         switch (which) {
-                case PRIO_PROCESS:
-                        if (who)
-                                p = find_task_by_vpid(who);
-                        else
-                                p = current;
-                        if (p) {
+        case PRIO_PROCESS:
+                if (who)
+                        p = find_task_by_vpid(who);
+                else
+                        p = current;
+                if (p) {
+                        niceval = nice_to_rlimit(task_nice(p));
+                        if (niceval > retval)
+                                retval = niceval;
+                }
+                break;
+        case PRIO_PGRP:
+                if (who)
+                        pgrp = find_vpid(who);
+                else
+                        pgrp = task_pgrp(current);
+                do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+                        niceval = nice_to_rlimit(task_nice(p));
+                        if (niceval > retval)
+                                retval = niceval;
+                } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
+                break;
+        case PRIO_USER:
+                uid = make_kuid(cred->user_ns, who);
+                user = cred->user;
+                if (!who)
+                        uid = cred->uid;
+                else if (!uid_eq(uid, cred->uid)) {
+                        user = find_user(uid);
+                        if (!user)
+                                goto out_unlock;        /* No processes for this user */
+                }
+                do_each_thread(g, p) {
+                        if (uid_eq(task_uid(p), uid)) {
                                 niceval = nice_to_rlimit(task_nice(p));
                                 if (niceval > retval)
                                         retval = niceval;
                         }
-                        break;
-                case PRIO_PGRP:
-                        if (who)
-                                pgrp = find_vpid(who);
-                        else
-                                pgrp = task_pgrp(current);
-                        do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
-                                niceval = nice_to_rlimit(task_nice(p));
-                                if (niceval > retval)
-                                        retval = niceval;
-                        } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
-                        break;
-                case PRIO_USER:
-                        uid = make_kuid(cred->user_ns, who);
-                        user = cred->user;
-                        if (!who)
-                                uid = cred->uid;
-                        else if (!uid_eq(uid, cred->uid) &&
-                                 !(user = find_user(uid)))
-                                goto out_unlock;        /* No processes for this user */
-
-                        do_each_thread(g, p) {
-                                if (uid_eq(task_uid(p), uid)) {
-                                        niceval = nice_to_rlimit(task_nice(p));
-                                        if (niceval > retval)
-                                                retval = niceval;
-                                }
-                        } while_each_thread(g, p);
-                        if (!uid_eq(uid, cred->uid))
-                                free_uid(user);         /* for find_user() */
-                        break;
+                } while_each_thread(g, p);
+                if (!uid_eq(uid, cred->uid))
+                        free_uid(user);         /* for find_user() */
+                break;
         }
 out_unlock:
         read_unlock(&tasklist_lock);
@@ -306,7 +308,7 @@ out_unlock:
  *
  * The general idea is that a program which uses just setregid() will be
  * 100% compatible with BSD.  A program which uses just setgid() will be
- * 100% compatible with POSIX with saved IDs. 
+ * 100% compatible with POSIX with saved IDs.
  *
  * SMP: There are not races, the GIDs are checked only by filesystem
  *      operations (as far as semantic preservation is concerned).
@@ -364,7 +366,7 @@ error:
 }
 
 /*
- * setgid() is implemented like SysV w/ SAVED_IDS 
+ * setgid() is implemented like SysV w/ SAVED_IDS
  *
  * SMP: Same implicit races as above.
  */
@@ -442,7 +444,7 @@ static int set_user(struct cred *new)
  *
  * The general idea is that a program which uses just setreuid() will be
  * 100% compatible with BSD.  A program which uses just setuid() will be
- * 100% compatible with POSIX with saved IDs. 
+ * 100% compatible with POSIX with saved IDs.
  */
 SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
 {
@@ -503,17 +505,17 @@ error:
         abort_creds(new);
         return retval;
 }
-                
+
 /*
- * setuid() is implemented like SysV with SAVED_IDS 
- * 
+ * setuid() is implemented like SysV with SAVED_IDS
+ *
  * Note that SAVED_ID's is deficient in that a setuid root program
- * like sendmail, for example, cannot set its uid to be a normal 
+ * like sendmail, for example, cannot set its uid to be a normal
  * user and then switch back, because if you're root, setuid() sets
  * the saved uid too.  If you don't like this, blame the bright people
  * in the POSIX committee and/or USG.  Note that the BSD-style setreuid()
  * will allow a root program to temporarily drop privileges and be able to
- * regain them by swapping the real and effective uid.  
+ * regain them by swapping the real and effective uid.
  */
 SYSCALL_DEFINE1(setuid, uid_t, uid)
 {
@@ -637,10 +639,12 @@ SYSCALL_DEFINE3(getresuid, uid_t __user *, ruidp, uid_t __user *, euidp, uid_t _
         euid = from_kuid_munged(cred->user_ns, cred->euid);
         suid = from_kuid_munged(cred->user_ns, cred->suid);
 
-        if (!(retval   = put_user(ruid, ruidp)) &&
-            !(retval   = put_user(euid, euidp)))
-                retval = put_user(suid, suidp);
-
+        retval = put_user(ruid, ruidp);
+        if (!retval) {
+                retval = put_user(euid, euidp);
+                if (!retval)
+                        return put_user(suid, suidp);
+        }
         return retval;
 }
 
@@ -709,9 +713,12 @@ SYSCALL_DEFINE3(getresgid, gid_t __user *, rgidp, gid_t __user *, egidp, gid_t _
         egid = from_kgid_munged(cred->user_ns, cred->egid);
         sgid = from_kgid_munged(cred->user_ns, cred->sgid);
 
-        if (!(retval   = put_user(rgid, rgidp)) &&
-            !(retval   = put_user(egid, egidp)))
-                retval = put_user(sgid, sgidp);
+        retval = put_user(rgid, rgidp);
+        if (!retval) {
+                retval = put_user(egid, egidp);
+                if (!retval)
+                        retval = put_user(sgid, sgidp);
+        }
 
         return retval;
 }
@@ -1284,7 +1291,6 @@ SYSCALL_DEFINE2(getrlimit, unsigned int, resource, struct rlimit __user *, rlim)
 /*
  *      Back compatibility for getrlimit. Needed for some apps.
  */
- 
 SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
                 struct rlimit __user *, rlim)
 {
@@ -1299,7 +1305,7 @@ SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
                 x.rlim_cur = 0x7FFFFFFF;
         if (x.rlim_max > 0x7FFFFFFF)
                 x.rlim_max = 0x7FFFFFFF;
-        return copy_to_user(rlim, &x, sizeof(x))?-EFAULT:0;
+        return copy_to_user(rlim, &x, sizeof(x)) ? -EFAULT : 0;
 }
 
 #endif
@@ -1527,7 +1533,7 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
         cputime_t tgutime, tgstime, utime, stime;
         unsigned long maxrss = 0;
 
-        memset((char *) r, 0, sizeof *r);
+        memset((char *)r, 0, sizeof (*r));
         utime = stime = 0;
 
         if (who == RUSAGE_THREAD) {
@@ -1541,41 +1547,41 @@ static void k_getrusage(struct task_struct *p, int who, struct rusage *r)
                 return;
 
         switch (who) {
-                case RUSAGE_BOTH:
-                case RUSAGE_CHILDREN:
-                        utime = p->signal->cutime;
-                        stime = p->signal->cstime;
-                        r->ru_nvcsw = p->signal->cnvcsw;
-                        r->ru_nivcsw = p->signal->cnivcsw;
-                        r->ru_minflt = p->signal->cmin_flt;
-                        r->ru_majflt = p->signal->cmaj_flt;
-                        r->ru_inblock = p->signal->cinblock;
-                        r->ru_oublock = p->signal->coublock;
-                        maxrss = p->signal->cmaxrss;
-
-                        if (who == RUSAGE_CHILDREN)
-                                break;
-
-                case RUSAGE_SELF:
-                        thread_group_cputime_adjusted(p, &tgutime, &tgstime);
-                        utime += tgutime;
-                        stime += tgstime;
-                        r->ru_nvcsw += p->signal->nvcsw;
-                        r->ru_nivcsw += p->signal->nivcsw;
-                        r->ru_minflt += p->signal->min_flt;
-                        r->ru_majflt += p->signal->maj_flt;
-                        r->ru_inblock += p->signal->inblock;
-                        r->ru_oublock += p->signal->oublock;
-                        if (maxrss < p->signal->maxrss)
-                                maxrss = p->signal->maxrss;
-                        t = p;
-                        do {
-                                accumulate_thread_rusage(t, r);
-                        } while_each_thread(p, t);
+        case RUSAGE_BOTH:
+        case RUSAGE_CHILDREN:
+                utime = p->signal->cutime;
+                stime = p->signal->cstime;
+                r->ru_nvcsw = p->signal->cnvcsw;
+                r->ru_nivcsw = p->signal->cnivcsw;
+                r->ru_minflt = p->signal->cmin_flt;
+                r->ru_majflt = p->signal->cmaj_flt;
+                r->ru_inblock = p->signal->cinblock;
+                r->ru_oublock = p->signal->coublock;
+                maxrss = p->signal->cmaxrss;
+
+                if (who == RUSAGE_CHILDREN)
                         break;
 
-                default:
-                        BUG();
+        case RUSAGE_SELF:
+                thread_group_cputime_adjusted(p, &tgutime, &tgstime);
+                utime += tgutime;
+                stime += tgstime;
+                r->ru_nvcsw += p->signal->nvcsw;
+                r->ru_nivcsw += p->signal->nivcsw;
+                r->ru_minflt += p->signal->min_flt;
+                r->ru_majflt += p->signal->maj_flt;
+                r->ru_inblock += p->signal->inblock;
+                r->ru_oublock += p->signal->oublock;
+                if (maxrss < p->signal->maxrss)
+                        maxrss = p->signal->maxrss;
+                t = p;
+                do {
+                        accumulate_thread_rusage(t, r);
+                } while_each_thread(p, t);
+                break;
+
+        default:
+                BUG();
         }
         unlock_task_sighand(p, &flags);
 
@@ -1585,6 +1591,7 @@ out:
 
         if (who != RUSAGE_CHILDREN) {
                 struct mm_struct *mm = get_task_mm(p);
+
                 if (mm) {
                         setmax_mm_hiwater_rss(&maxrss, mm);
                         mmput(mm);
@@ -1596,6 +1603,7 @@ out:
 int getrusage(struct task_struct *p, int who, struct rusage __user *ru)
 {
         struct rusage r;
+
         k_getrusage(p, who, &r);
         return copy_to_user(ru, &r, sizeof(r)) ? -EFAULT : 0;
 }
@@ -1628,12 +1636,14 @@ SYSCALL_DEFINE1(umask, int, mask)
         return mask;
 }
 
-static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
+static int prctl_set_mm_exe_file_locked(struct mm_struct *mm, unsigned int fd)
 {
         struct fd exe;
         struct inode *inode;
         int err;
 
+        VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_sem), mm);
+
         exe = fdget(fd);
         if (!exe.file)
                 return -EBADF;
@@ -1654,8 +1664,6 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
         if (err)
                 goto exit;
 
-        down_write(&mm->mmap_sem);
-
         /*
          * Forbid mm->exe_file change if old file still mapped.
          */
@@ -1667,7 +1675,7 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
                         if (vma->vm_file &&
                             path_equal(&vma->vm_file->f_path,
                                        &mm->exe_file->f_path))
-                                goto exit_unlock;
+                                goto exit;
         }
 
         /*
@@ -1678,34 +1686,222 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
          */
         err = -EPERM;
         if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
-                goto exit_unlock;
+                goto exit;
 
         err = 0;
         set_mm_exe_file(mm, exe.file);  /* this grabs a reference to exe.file */
-exit_unlock:
-        up_write(&mm->mmap_sem);
-
 exit:
         fdput(exe);
         return err;
 }
 
+#ifdef CONFIG_CHECKPOINT_RESTORE
+/*
+ * WARNING: we don't require any capability here so be very careful
+ * in what is allowed for modification from userspace.
+ */
+static int validate_prctl_map(struct prctl_mm_map *prctl_map)
+{
+        unsigned long mmap_max_addr = TASK_SIZE;
+        struct mm_struct *mm = current->mm;
+        int error = -EINVAL, i;
+
+        static const unsigned char offsets[] = {
+                offsetof(struct prctl_mm_map, start_code),
+                offsetof(struct prctl_mm_map, end_code),
+                offsetof(struct prctl_mm_map, start_data),
+                offsetof(struct prctl_mm_map, end_data),
+                offsetof(struct prctl_mm_map, start_brk),
+                offsetof(struct prctl_mm_map, brk),
+                offsetof(struct prctl_mm_map, start_stack),
+                offsetof(struct prctl_mm_map, arg_start),
+                offsetof(struct prctl_mm_map, arg_end),
+                offsetof(struct prctl_mm_map, env_start),
+                offsetof(struct prctl_mm_map, env_end),
+        };
+
+        /*
+         * Make sure the members are not somewhere outside
+         * of allowed address space.
+         */
+        for (i = 0; i < ARRAY_SIZE(offsets); i++) {
+                u64 val = *(u64 *)((char *)prctl_map + offsets[i]);
+
+                if ((unsigned long)val >= mmap_max_addr ||
+                    (unsigned long)val < mmap_min_addr)
+                        goto out;
+        }
+
+        /*
+         * Make sure the pairs are ordered.
+         */
+#define __prctl_check_order(__m1, __op, __m2)                           \
+        ((unsigned long)prctl_map->__m1 __op                            \
+         (unsigned long)prctl_map->__m2) ? 0 : -EINVAL
+        error  = __prctl_check_order(start_code, <, end_code);
+        error |= __prctl_check_order(start_data, <, end_data);
+        error |= __prctl_check_order(start_brk, <=, brk);
+        error |= __prctl_check_order(arg_start, <=, arg_end);
+        error |= __prctl_check_order(env_start, <=, env_end);
+        if (error)
+                goto out;
+#undef __prctl_check_order
+
+        error = -EINVAL;
+
+        /*
+         * @brk should be after @end_data in traditional maps.
+         */
+        if (prctl_map->start_brk <= prctl_map->end_data ||
+            prctl_map->brk <= prctl_map->end_data)
+                goto out;
+
+        /*
+         * Neither we should allow to override limits if they set.
+         */
+        if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map->brk,
+                              prctl_map->start_brk, prctl_map->end_data,
+                              prctl_map->start_data))
+                        goto out;
+
+        /*
+         * Someone is trying to cheat the auxv vector.
+         */
+        if (prctl_map->auxv_size) {
+                if (!prctl_map->auxv || prctl_map->auxv_size > sizeof(mm->saved_auxv))
+                        goto out;
+        }
+
+        /*
+         * Finally, make sure the caller has the rights to
+         * change /proc/pid/exe link: only local root should
+         * be allowed to.
+         */
+        if (prctl_map->exe_fd != (u32)-1) {
+                struct user_namespace *ns = current_user_ns();
+                const struct cred *cred = current_cred();
+
+                if (!uid_eq(cred->uid, make_kuid(ns, 0)) ||
+                    !gid_eq(cred->gid, make_kgid(ns, 0)))
+                        goto out;
+        }
+
+        error = 0;
+out:
+        return error;
+}
+
+static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data_size)
+{
+        struct prctl_mm_map prctl_map = { .exe_fd = (u32)-1, };
+        unsigned long user_auxv[AT_VECTOR_SIZE];
+        struct mm_struct *mm = current->mm;
+        int error;
+
+        BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
+        BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256);
+
+        if (opt == PR_SET_MM_MAP_SIZE)
+                return put_user((unsigned int)sizeof(prctl_map),
+                                (unsigned int __user *)addr);
+
+        if (data_size != sizeof(prctl_map))
+                return -EINVAL;
+
+        if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
+                return -EFAULT;
+
+        error = validate_prctl_map(&prctl_map);
+        if (error)
+                return error;
+
+        if (prctl_map.auxv_size) {
+                memset(user_auxv, 0, sizeof(user_auxv));
+                if (copy_from_user(user_auxv,
+                                   (const void __user *)prctl_map.auxv,
+                                   prctl_map.auxv_size))
+                        return -EFAULT;
+
+                /* Last entry must be AT_NULL as specification requires */
+                user_auxv[AT_VECTOR_SIZE - 2] = AT_NULL;
+                user_auxv[AT_VECTOR_SIZE - 1] = AT_NULL;
+        }
+
+        down_write(&mm->mmap_sem);
+        if (prctl_map.exe_fd != (u32)-1)
+                error = prctl_set_mm_exe_file_locked(mm, prctl_map.exe_fd);
+        downgrade_write(&mm->mmap_sem);
+        if (error)
+                goto out;
+
+        /*
+         * We don't validate if these members are pointing to
+         * real present VMAs because application may have correspond
+         * VMAs already unmapped and kernel uses these members for statistics
+         * output in procfs mostly, except
+         *
+         *  - @start_brk/@brk which are used in do_brk but kernel lookups
+         *    for VMAs when updating these memvers so anything wrong written
+         *    here cause kernel to swear at userspace program but won't lead
+         *    to any problem in kernel itself
+         */
+
+        mm->start_code  = prctl_map.start_code;
+        mm->end_code    = prctl_map.end_code;
+        mm->start_data  = prctl_map.start_data;
+        mm->end_data    = prctl_map.end_data;
+        mm->start_brk   = prctl_map.start_brk;
+        mm->brk         = prctl_map.brk;
+        mm->start_stack = prctl_map.start_stack;
+        mm->arg_start   = prctl_map.arg_start;
+        mm->arg_end     = prctl_map.arg_end;
+        mm->env_start   = prctl_map.env_start;
+        mm->env_end     = prctl_map.env_end;
+
+        /*
+         * Note this update of @saved_auxv is lockless thus
+         * if someone reads this member in procfs while we're
+         * updating -- it may get partly updated results. It's
+         * known and acceptable trade off: we leave it as is to
+         * not introduce additional locks here making the kernel
+         * more complex.
+         */
+        if (prctl_map.auxv_size)
+                memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
+
+        error = 0;
+out:
+        up_read(&mm->mmap_sem);
+        return error;
+}
+#endif /* CONFIG_CHECKPOINT_RESTORE */
+
 static int prctl_set_mm(int opt, unsigned long addr,
                         unsigned long arg4, unsigned long arg5)
 {
-        unsigned long rlim = rlimit(RLIMIT_DATA);
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
         int error;
 
-        if (arg5 || (arg4 && opt != PR_SET_MM_AUXV))
+        if (arg5 || (arg4 && (opt != PR_SET_MM_AUXV &&
+                              opt != PR_SET_MM_MAP &&
+                              opt != PR_SET_MM_MAP_SIZE)))
                 return -EINVAL;
 
+#ifdef CONFIG_CHECKPOINT_RESTORE
+        if (opt == PR_SET_MM_MAP || opt == PR_SET_MM_MAP_SIZE)
+                return prctl_set_mm_map(opt, (const void __user *)addr, arg4);
+#endif
+
         if (!capable(CAP_SYS_RESOURCE))
                 return -EPERM;
 
-        if (opt == PR_SET_MM_EXE_FILE)
-                return prctl_set_mm_exe_file(mm, (unsigned int)addr);
+        if (opt == PR_SET_MM_EXE_FILE) {
+                down_write(&mm->mmap_sem);
+                error = prctl_set_mm_exe_file_locked(mm, (unsigned int)addr);
+                up_write(&mm->mmap_sem);
+                return error;
+        }
 
         if (addr >= TASK_SIZE || addr < mmap_min_addr)
                 return -EINVAL;
@@ -1733,9 +1929,8 @@ static int prctl_set_mm(int opt, unsigned long addr,
                 if (addr <= mm->end_data)
                         goto out;
 
-                if (rlim < RLIM_INFINITY &&
-                    (mm->brk - addr) +
-                    (mm->end_data - mm->start_data) > rlim)
+                if (check_data_rlimit(rlimit(RLIMIT_DATA), mm->brk, addr,
+                                      mm->end_data, mm->start_data))
                         goto out;
 
                 mm->start_brk = addr;
@@ -1745,9 +1940,8 @@ static int prctl_set_mm(int opt, unsigned long addr,
                 if (addr <= mm->end_data)
                         goto out;
 
-                if (rlim < RLIM_INFINITY &&
-                    (addr - mm->start_brk) +
-                    (mm->end_data - mm->start_data) > rlim)
+                if (check_data_rlimit(rlimit(RLIMIT_DATA), addr, mm->start_brk,
+                                      mm->end_data, mm->start_data))
                         goto out;
 
                 mm->brk = addr;
@@ -2023,6 +2217,7 @@ SYSCALL_DEFINE3(getcpu, unsigned __user *, cpup, unsigned __user *, nodep,
 {
         int err = 0;
         int cpu = raw_smp_processor_id();
+
         if (cpup)
                 err |= put_user(cpu, cpup);
         if (nodep)
@@ -2135,7 +2330,7 @@ COMPAT_SYSCALL_DEFINE1(sysinfo, struct compat_sysinfo __user *, info)
         /* Check to see if any memory value is too large for 32-bit and scale
          *  down if needed
          */
-        if ((s.totalram >> 32) || (s.totalswap >> 32)) {
+        if (upper_32_bits(s.totalram) || upper_32_bits(s.totalswap)) {
                 int bitcount = 0;
 
                 while (s.mem_unit < PAGE_SIZE) {
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 75875a741b5e..91180987e40e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1460,13 +1460,6 @@ static struct ctl_table vm_table[] = {
                 .extra2         = &one,
         },
 #endif
-        {
-                .procname       = "scan_unevictable_pages",
-                .data           = &scan_unevictable_pages,
-                .maxlen         = sizeof(scan_unevictable_pages),
-                .mode           = 0644,
-                .proc_handler   = scan_unevictable_handler,
-        },
 #ifdef CONFIG_MEMORY_FAILURE
         {
                 .procname       = "memory_failure_early_kill",
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index a8d6914030fe..7b223b212683 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -47,6 +47,7 @@ static DEFINE_PER_CPU(bool, softlockup_touch_sync);
 static DEFINE_PER_CPU(bool, soft_watchdog_warn);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts);
 static DEFINE_PER_CPU(unsigned long, soft_lockup_hrtimer_cnt);
+static DEFINE_PER_CPU(struct task_struct *, softlockup_task_ptr_saved);
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 static DEFINE_PER_CPU(bool, hard_watchdog_warn);
 static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
@@ -333,8 +334,22 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
                         return HRTIMER_RESTART;
 
                 /* only warn once */
-                if (__this_cpu_read(soft_watchdog_warn) == true)
+                if (__this_cpu_read(soft_watchdog_warn) == true) {
+                        /*
+                         * When multiple processes are causing softlockups the
+                         * softlockup detector only warns on the first one
+                         * because the code relies on a full quiet cycle to
+                         * re-arm.  The second process prevents the quiet cycle
+                         * and never gets reported.  Use task pointers to detect
+                         * this.
+                         */
+                        if (__this_cpu_read(softlockup_task_ptr_saved) !=
+                            current) {
+                                __this_cpu_write(soft_watchdog_warn, false);
+                                __touch_watchdog();
+                        }
                         return HRTIMER_RESTART;
+                }
 
                 if (softlockup_all_cpu_backtrace) {
                         /* Prevent multiple soft-lockup reports if one cpu is already
@@ -350,6 +365,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
                 pr_emerg("BUG: soft lockup - CPU#%d stuck for %us! [%s:%d]\n",
                         smp_processor_id(), duration,
                         current->comm, task_pid_nr(current));
+                __this_cpu_write(softlockup_task_ptr_saved, current);
                 print_modules();
                 print_irqtrace_events(current);
                 if (regs)
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 38d2db82228c..cce4dd68c40d 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -403,6 +403,35 @@ void gen_pool_for_each_chunk(struct gen_pool *pool,
 EXPORT_SYMBOL(gen_pool_for_each_chunk);
 
 /**
+ * addr_in_gen_pool - checks if an address falls within the range of a pool
+ * @pool:       the generic memory pool
+ * @start:      start address
+ * @size:       size of the region
+ *
+ * Check if the range of addresses falls within the specified pool. Returns
+ * true if the entire range is contained in the pool and false otherwise.
+ */
+bool addr_in_gen_pool(struct gen_pool *pool, unsigned long start,
+                        size_t size)
+{
+        bool found = false;
+        unsigned long end = start + size;
+        struct gen_pool_chunk *chunk;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(chunk, &(pool)->chunks, next_chunk) {
+                if (start >= chunk->start_addr && start <= chunk->end_addr) {
+                        if (end <= chunk->end_addr) {
+                                found = true;
+                                break;
+                        }
+                }
+        }
+        rcu_read_unlock();
+        return found;
+}
+
+/**
  * gen_pool_avail - get available free space of the pool
  * @pool: pool to get available free space
  *
@@ -481,6 +510,26 @@ unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
 EXPORT_SYMBOL(gen_pool_first_fit);
 
 /**
+ * gen_pool_first_fit_order_align - find the first available region
+ * of memory matching the size requirement. The region will be aligned
+ * to the order of the size specified.
+ * @map: The address to base the search on
+ * @size: The bitmap size in bits
+ * @start: The bitnumber to start searching at
+ * @nr: The number of zeroed bits we're looking for
+ * @data: additional data - unused
+ */
+unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+                unsigned long size, unsigned long start,
+                unsigned int nr, void *data)
+{
+        unsigned long align_mask = roundup_pow_of_two(nr) - 1;
+
+        return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
+}
+EXPORT_SYMBOL(gen_pool_first_fit_order_align);
+
+/**
  * gen_pool_best_fit - find the best fitting region of memory
  * macthing the size requirement (no alignment constraint)
  * @map: The address to base the search on
diff --git a/mm/Kconfig b/mm/Kconfig
index 886db2158538..1d1ae6b078fd 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -137,6 +137,9 @@ config HAVE_MEMBLOCK_NODE_MAP
 config HAVE_MEMBLOCK_PHYS_MAP
         boolean
 
+config HAVE_GENERIC_RCU_GUP
+        boolean
+
 config ARCH_DISCARD_MEMBLOCK
         boolean
 
@@ -228,11 +231,16 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
         boolean
 
 #
+# support for memory balloon
+config MEMORY_BALLOON
+        boolean
+
+#
 # support for memory balloon compaction
 config BALLOON_COMPACTION
         bool "Allow for balloon memory compaction/migration"
         def_bool y
-        depends on COMPACTION && VIRTIO_BALLOON
+        depends on COMPACTION && MEMORY_BALLOON
         help
           Memory fragmentation introduced by ballooning might reduce
           significantly the number of 2MB contiguous memory blocks that can be
diff --git a/mm/Makefile b/mm/Makefile
index fe7a053c0f45..1f534a7f0a71 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -16,9 +16,9 @@ obj-y			:= filemap.o mempool.o oom_kill.o \
                            readahead.o swap.o truncate.o vmscan.o shmem.o \
                            util.o mmzone.o vmstat.o backing-dev.o \
                            mm_init.o mmu_context.o percpu.o slab_common.o \
-                           compaction.o balloon_compaction.o vmacache.o \
+                           compaction.o vmacache.o \
                            interval_tree.o list_lru.o workingset.o \
-                           iov_iter.o $(mmu-y)
+                           iov_iter.o debug.o $(mmu-y)
 
 obj-y += init-mm.o
 
@@ -67,3 +67,4 @@ obj-$(CONFIG_ZBUD)	+= zbud.o
 obj-$(CONFIG_ZSMALLOC)  += zsmalloc.o
 obj-$(CONFIG_GENERIC_EARLY_IOREMAP) += early_ioremap.o
 obj-$(CONFIG_CMA)       += cma.o
+obj-$(CONFIG_MEMORY_BALLOON) += balloon_compaction.o
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 1706cbbdf5f0..b27714f1b40f 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -631,7 +631,7 @@ long wait_iff_congested(struct zone *zone, int sync, long timeout)
          * of sleeping on the congestion queue
          */
         if (atomic_read(&nr_bdi_congested[sync]) == 0 ||
-                        !zone_is_reclaim_congested(zone)) {
+            !test_bit(ZONE_CONGESTED, &zone->flags)) {
                 cond_resched();
 
                 /* In case we scheduled, work out time remaining */
diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
index 6e45a5074bf0..b3cbe19f71b5 100644
--- a/mm/balloon_compaction.c
+++ b/mm/balloon_compaction.c
@@ -11,32 +11,6 @@
 #include <linux/balloon_compaction.h>
 
 /*
- * balloon_devinfo_alloc - allocates a balloon device information descriptor.
- * @balloon_dev_descriptor: pointer to reference the balloon device which
- *                          this struct balloon_dev_info will be servicing.
- *
- * Driver must call it to properly allocate and initialize an instance of
- * struct balloon_dev_info which will be used to reference a balloon device
- * as well as to keep track of the balloon device page list.
- */
-struct balloon_dev_info *balloon_devinfo_alloc(void *balloon_dev_descriptor)
-{
-        struct balloon_dev_info *b_dev_info;
-        b_dev_info = kmalloc(sizeof(*b_dev_info), GFP_KERNEL);
-        if (!b_dev_info)
-                return ERR_PTR(-ENOMEM);
-
-        b_dev_info->balloon_device = balloon_dev_descriptor;
-        b_dev_info->mapping = NULL;
-        b_dev_info->isolated_pages = 0;
-        spin_lock_init(&b_dev_info->pages_lock);
-        INIT_LIST_HEAD(&b_dev_info->pages);
-
-        return b_dev_info;
-}
-EXPORT_SYMBOL_GPL(balloon_devinfo_alloc);
-
-/*
  * balloon_page_enqueue - allocates a new page and inserts it into the balloon
  *                        page list.
  * @b_dev_info: balloon device decriptor where we will insert a new page to
@@ -61,7 +35,8 @@ struct page *balloon_page_enqueue(struct balloon_dev_info *b_dev_info)
          */
         BUG_ON(!trylock_page(page));
         spin_lock_irqsave(&b_dev_info->pages_lock, flags);
-        balloon_page_insert(page, b_dev_info->mapping, &b_dev_info->pages);
+        balloon_page_insert(b_dev_info, page);
+        __count_vm_event(BALLOON_INFLATE);
         spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
         unlock_page(page);
         return page;
@@ -93,18 +68,14 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
                  * to be released by the balloon driver.
                  */
                 if (trylock_page(page)) {
+                        if (!PagePrivate(page)) {
+                                /* raced with isolation */
+                                unlock_page(page);
+                                continue;
+                        }
                         spin_lock_irqsave(&b_dev_info->pages_lock, flags);
-                        /*
-                         * Raise the page refcount here to prevent any wrong
-                         * attempt to isolate this page, in case of coliding
-                         * with balloon_page_isolate() just after we release
-                         * the page lock.
-                         *
-                         * balloon_page_free() will take care of dropping
-                         * this extra refcount later.
-                         */
-                        get_page(page);
                         balloon_page_delete(page);
+                        __count_vm_event(BALLOON_DEFLATE);
                         spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
                         unlock_page(page);
                         dequeued_page = true;
@@ -132,62 +103,14 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
 EXPORT_SYMBOL_GPL(balloon_page_dequeue);
 
 #ifdef CONFIG_BALLOON_COMPACTION
-/*
- * balloon_mapping_alloc - allocates a special ->mapping for ballooned pages.
- * @b_dev_info: holds the balloon device information descriptor.
- * @a_ops: balloon_mapping address_space_operations descriptor.
- *
- * Driver must call it to properly allocate and initialize an instance of
- * struct address_space which will be used as the special page->mapping for
- * balloon device enlisted page instances.
- */
-struct address_space *balloon_mapping_alloc(struct balloon_dev_info *b_dev_info,
-                                const struct address_space_operations *a_ops)
-{
-        struct address_space *mapping;
-
-        mapping = kmalloc(sizeof(*mapping), GFP_KERNEL);
-        if (!mapping)
-                return ERR_PTR(-ENOMEM);
-
-        /*
-         * Give a clean 'zeroed' status to all elements of this special
-         * balloon page->mapping struct address_space instance.
-         */
-        address_space_init_once(mapping);
-
-        /*
-         * Set mapping->flags appropriately, to allow balloon pages
-         * ->mapping identification.
-         */
-        mapping_set_balloon(mapping);
-        mapping_set_gfp_mask(mapping, balloon_mapping_gfp_mask());
-
-        /* balloon's page->mapping->a_ops callback descriptor */
-        mapping->a_ops = a_ops;
-
-        /*
-         * Establish a pointer reference back to the balloon device descriptor
-         * this particular page->mapping will be servicing.
-         * This is used by compaction / migration procedures to identify and
-         * access the balloon device pageset while isolating / migrating pages.
-         *
-         * As some balloon drivers can register multiple balloon devices
-         * for a single guest, this also helps compaction / migration to
-         * properly deal with multiple balloon pagesets, when required.
-         */
-        mapping->private_data = b_dev_info;
-        b_dev_info->mapping = mapping;
-
-        return mapping;
-}
-EXPORT_SYMBOL_GPL(balloon_mapping_alloc);
 
 static inline void __isolate_balloon_page(struct page *page)
 {
-        struct balloon_dev_info *b_dev_info = page->mapping->private_data;
+        struct balloon_dev_info *b_dev_info = balloon_page_device(page);
         unsigned long flags;
+
         spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+        ClearPagePrivate(page);
         list_del(&page->lru);
         b_dev_info->isolated_pages++;
         spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
@@ -195,20 +118,16 @@ static inline void __isolate_balloon_page(struct page *page)
 
 static inline void __putback_balloon_page(struct page *page)
 {
-        struct balloon_dev_info *b_dev_info = page->mapping->private_data;
+        struct balloon_dev_info *b_dev_info = balloon_page_device(page);
         unsigned long flags;
+
         spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+        SetPagePrivate(page);
         list_add(&page->lru, &b_dev_info->pages);
         b_dev_info->isolated_pages--;
         spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
 }
 
-static inline int __migrate_balloon_page(struct address_space *mapping,
-                struct page *newpage, struct page *page, enum migrate_mode mode)
-{
-        return page->mapping->a_ops->migratepage(mapping, newpage, page, mode);
-}
-
 /* __isolate_lru_page() counterpart for a ballooned page */
 bool balloon_page_isolate(struct page *page)
 {
@@ -235,12 +154,11 @@ bool balloon_page_isolate(struct page *page)
                  */
                 if (likely(trylock_page(page))) {
                         /*
-                         * A ballooned page, by default, has just one refcount.
+                         * A ballooned page, by default, has PagePrivate set.
                          * Prevent concurrent compaction threads from isolating
-                         * an already isolated balloon page by refcount check.
+                         * an already isolated balloon page by clearing it.
                          */
-                        if (__is_movable_balloon_page(page) &&
-                            page_count(page) == 2) {
+                        if (balloon_page_movable(page)) {
                                 __isolate_balloon_page(page);
                                 unlock_page(page);
                                 return true;
@@ -276,7 +194,7 @@ void balloon_page_putback(struct page *page)
 int balloon_page_migrate(struct page *newpage,
                          struct page *page, enum migrate_mode mode)
 {
-        struct address_space *mapping;
+        struct balloon_dev_info *balloon = balloon_page_device(page);
         int rc = -EAGAIN;
 
         /*
@@ -292,9 +210,8 @@ int balloon_page_migrate(struct page *newpage,
                 return rc;
         }
 
-        mapping = page->mapping;
-        if (mapping)
-                rc = __migrate_balloon_page(mapping, newpage, page, mode);
+        if (balloon && balloon->migratepage)
+                rc = balloon->migratepage(balloon, newpage, page, mode);
 
         unlock_page(newpage);
         return rc;
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 90bd3507b413..8a000cebb0d7 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -16,9 +16,9 @@
 #include <linux/kmemleak.h>
 #include <linux/range.h>
 #include <linux/memblock.h>
+#include <linux/bug.h>
+#include <linux/io.h>
 
-#include <asm/bug.h>
-#include <asm/io.h>
 #include <asm/processor.h>
 
 #include "internal.h"
diff --git a/mm/cma.c b/mm/cma.c
index c17751c0dcaf..474c644a0dc6 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -32,6 +32,7 @@
 #include <linux/slab.h>
 #include <linux/log2.h>
 #include <linux/cma.h>
+#include <linux/highmem.h>
 
 struct cma {
         unsigned long   base_pfn;
@@ -163,6 +164,8 @@ int __init cma_declare_contiguous(phys_addr_t base,
                         bool fixed, struct cma **res_cma)
 {
         struct cma *cma;
+        phys_addr_t memblock_end = memblock_end_of_DRAM();
+        phys_addr_t highmem_start = __pa(high_memory);
         int ret = 0;
 
         pr_debug("%s(size %lx, base %08lx, limit %08lx alignment %08lx)\n",
@@ -196,6 +199,24 @@ int __init cma_declare_contiguous(phys_addr_t base,
         if (!IS_ALIGNED(size >> PAGE_SHIFT, 1 << order_per_bit))
                 return -EINVAL;
 
+        /*
+         * adjust limit to avoid crossing low/high memory boundary for
+         * automatically allocated regions
+         */
+        if (((limit == 0 || limit > memblock_end) &&
+             (memblock_end - size < highmem_start &&
+              memblock_end > highmem_start)) ||
+            (!fixed && limit > highmem_start && limit - size < highmem_start)) {
+                limit = highmem_start;
+        }
+
+        if (fixed && base < highmem_start && base+size > highmem_start) {
+                ret = -EINVAL;
+                pr_err("Region at %08lx defined on low/high memory boundary (%08lx)\n",
+                        (unsigned long)base, (unsigned long)highmem_start);
+                goto err;
+        }
+
         /* Reserve memory */
         if (base && fixed) {
                 if (memblock_is_region_reserved(base, size) ||
diff --git a/mm/compaction.c b/mm/compaction.c
index 21bf292b642a..edba18aed173 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -67,6 +67,49 @@ static inline bool migrate_async_suitable(int migratetype)
         return is_migrate_cma(migratetype) || migratetype == MIGRATE_MOVABLE;
 }
 
+/*
+ * Check that the whole (or subset of) a pageblock given by the interval of
+ * [start_pfn, end_pfn) is valid and within the same zone, before scanning it
+ * with the migration of free compaction scanner. The scanners then need to
+ * use only pfn_valid_within() check for arches that allow holes within
+ * pageblocks.
+ *
+ * Return struct page pointer of start_pfn, or NULL if checks were not passed.
+ *
+ * It's possible on some configurations to have a setup like node0 node1 node0
+ * i.e. it's possible that all pages within a zones range of pages do not
+ * belong to a single zone. We assume that a border between node0 and node1
+ * can occur within a single pageblock, but not a node0 node1 node0
+ * interleaving within a single pageblock. It is therefore sufficient to check
+ * the first and last page of a pageblock and avoid checking each individual
+ * page in a pageblock.
+ */
+static struct page *pageblock_pfn_to_page(unsigned long start_pfn,
+                                unsigned long end_pfn, struct zone *zone)
+{
+        struct page *start_page;
+        struct page *end_page;
+
+        /* end_pfn is one past the range we are checking */
+        end_pfn--;
+
+        if (!pfn_valid(start_pfn) || !pfn_valid(end_pfn))
+                return NULL;
+
+        start_page = pfn_to_page(start_pfn);
+
+        if (page_zone(start_page) != zone)
+                return NULL;
+
+        end_page = pfn_to_page(end_pfn);
+
+        /* This gives a shorter code than deriving page_zone(end_page) */
+        if (page_zone_id(start_page) != page_zone_id(end_page))
+                return NULL;
+
+        return start_page;
+}
+
 #ifdef CONFIG_COMPACTION
 /* Returns true if the pageblock should be scanned for pages to isolate. */
 static inline bool isolation_suitable(struct compact_control *cc,
@@ -132,7 +175,7 @@ void reset_isolation_suitable(pg_data_t *pgdat)
  */
 static void update_pageblock_skip(struct compact_control *cc,
                         struct page *page, unsigned long nr_isolated,
-                        bool set_unsuitable, bool migrate_scanner)
+                        bool migrate_scanner)
 {
         struct zone *zone = cc->zone;
         unsigned long pfn;
@@ -146,12 +189,7 @@ static void update_pageblock_skip(struct compact_control *cc,
         if (nr_isolated)
                 return;
 
-        /*
-         * Only skip pageblocks when all forms of compaction will be known to
-         * fail in the near future.
-         */
-        if (set_unsuitable)
-                set_pageblock_skip(page);
+        set_pageblock_skip(page);
 
         pfn = page_to_pfn(page);
 
@@ -180,52 +218,77 @@ static inline bool isolation_suitable(struct compact_control *cc,
 
 static void update_pageblock_skip(struct compact_control *cc,
                         struct page *page, unsigned long nr_isolated,
-                        bool set_unsuitable, bool migrate_scanner)
+                        bool migrate_scanner)
 {
 }
 #endif /* CONFIG_COMPACTION */
 
-static inline bool should_release_lock(spinlock_t *lock)
+/*
+ * Compaction requires the taking of some coarse locks that are potentially
+ * very heavily contended. For async compaction, back out if the lock cannot
+ * be taken immediately. For sync compaction, spin on the lock if needed.
+ *
+ * Returns true if the lock is held
+ * Returns false if the lock is not held and compaction should abort
+ */
+static bool compact_trylock_irqsave(spinlock_t *lock, unsigned long *flags,
+                                                struct compact_control *cc)
 {
-        return need_resched() || spin_is_contended(lock);
+        if (cc->mode == MIGRATE_ASYNC) {
+                if (!spin_trylock_irqsave(lock, *flags)) {
+                        cc->contended = COMPACT_CONTENDED_LOCK;
+                        return false;
+                }
+        } else {
+                spin_lock_irqsave(lock, *flags);
+        }
+
+        return true;
 }
 
 /*
  * Compaction requires the taking of some coarse locks that are potentially
- * very heavily contended. Check if the process needs to be scheduled or
- * if the lock is contended. For async compaction, back out in the event
- * if contention is severe. For sync compaction, schedule.
+ * very heavily contended. The lock should be periodically unlocked to avoid
+ * having disabled IRQs for a long time, even when there is nobody waiting on
+ * the lock. It might also be that allowing the IRQs will result in
+ * need_resched() becoming true. If scheduling is needed, async compaction
+ * aborts. Sync compaction schedules.
+ * Either compaction type will also abort if a fatal signal is pending.
+ * In either case if the lock was locked, it is dropped and not regained.
  *
- * Returns true if the lock is held.
- * Returns false if the lock is released and compaction should abort
+ * Returns true if compaction should abort due to fatal signal pending, or
+ *              async compaction due to need_resched()
+ * Returns false when compaction can continue (sync compaction might have
+ *              scheduled)
  */
-static bool compact_checklock_irqsave(spinlock_t *lock, unsigned long *flags,
-                                      bool locked, struct compact_control *cc)
+static bool compact_unlock_should_abort(spinlock_t *lock,
+                unsigned long flags, bool *locked, struct compact_control *cc)
 {
-        if (should_release_lock(lock)) {
-                if (locked) {
-                        spin_unlock_irqrestore(lock, *flags);
-                        locked = false;
-                }
+        if (*locked) {
+                spin_unlock_irqrestore(lock, flags);
+                *locked = false;
+        }
+
+        if (fatal_signal_pending(current)) {
+                cc->contended = COMPACT_CONTENDED_SCHED;
+                return true;
+        }
 
-                /* async aborts if taking too long or contended */
+        if (need_resched()) {
                 if (cc->mode == MIGRATE_ASYNC) {
-                        cc->contended = true;
-                        return false;
+                        cc->contended = COMPACT_CONTENDED_SCHED;
+                        return true;
                 }
-
                 cond_resched();
         }
 
-        if (!locked)
-                spin_lock_irqsave(lock, *flags);
-        return true;
+        return false;
 }
 
 /*
  * Aside from avoiding lock contention, compaction also periodically checks
  * need_resched() and either schedules in sync compaction or aborts async
- * compaction. This is similar to what compact_checklock_irqsave() does, but
+ * compaction. This is similar to what compact_unlock_should_abort() does, but
  * is used where no lock is concerned.
  *
  * Returns false when no scheduling was needed, or sync compaction scheduled.
@@ -236,7 +299,7 @@ static inline bool compact_should_abort(struct compact_control *cc)
         /* async compaction aborts if contended */
         if (need_resched()) {
                 if (cc->mode == MIGRATE_ASYNC) {
-                        cc->contended = true;
+                        cc->contended = COMPACT_CONTENDED_SCHED;
                         return true;
                 }
 
@@ -250,8 +313,15 @@ static inline bool compact_should_abort(struct compact_control *cc)
 static bool suitable_migration_target(struct page *page)
 {
         /* If the page is a large free page, then disallow migration */
-        if (PageBuddy(page) && page_order(page) >= pageblock_order)
-                return false;
+        if (PageBuddy(page)) {
+                /*
+                 * We are checking page_order without zone->lock taken. But
+                 * the only small danger is that we skip a potentially suitable
+                 * pageblock, so it's not worth to check order for valid range.
+                 */
+                if (page_order_unsafe(page) >= pageblock_order)
+                        return false;
+        }
 
         /* If the block is MIGRATE_MOVABLE or MIGRATE_CMA, allow migration */
         if (migrate_async_suitable(get_pageblock_migratetype(page)))
@@ -267,16 +337,16 @@ static bool suitable_migration_target(struct page *page)
  * (even though it may still end up isolating some pages).
  */
 static unsigned long isolate_freepages_block(struct compact_control *cc,
-                                unsigned long blockpfn,
+                                unsigned long *start_pfn,
                                 unsigned long end_pfn,
                                 struct list_head *freelist,
                                 bool strict)
 {
         int nr_scanned = 0, total_isolated = 0;
         struct page *cursor, *valid_page = NULL;
-        unsigned long flags;
+        unsigned long flags = 0;
         bool locked = false;
-        bool checked_pageblock = false;
+        unsigned long blockpfn = *start_pfn;
 
         cursor = pfn_to_page(blockpfn);
 
@@ -285,6 +355,16 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                 int isolated, i;
                 struct page *page = cursor;
 
+                /*
+                 * Periodically drop the lock (if held) regardless of its
+                 * contention, to give chance to IRQs. Abort if fatal signal
+                 * pending or async compaction detects need_resched()
+                 */
+                if (!(blockpfn % SWAP_CLUSTER_MAX)
+                    && compact_unlock_should_abort(&cc->zone->lock, flags,
+                                                                &locked, cc))
+                        break;
+
                 nr_scanned++;
                 if (!pfn_valid_within(blockpfn))
                         goto isolate_fail;
@@ -295,33 +375,30 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                         goto isolate_fail;
 
                 /*
-                 * The zone lock must be held to isolate freepages.
-                 * Unfortunately this is a very coarse lock and can be
-                 * heavily contended if there are parallel allocations
-                 * or parallel compactions. For async compaction do not
-                 * spin on the lock and we acquire the lock as late as
-                 * possible.
+                 * If we already hold the lock, we can skip some rechecking.
+                 * Note that if we hold the lock now, checked_pageblock was
+                 * already set in some previous iteration (or strict is true),
+                 * so it is correct to skip the suitable migration target
+                 * recheck as well.
                  */
-                locked = compact_checklock_irqsave(&cc->zone->lock, &flags,
-                                                                locked, cc);
-                if (!locked)
-                        break;
-
-                /* Recheck this is a suitable migration target under lock */
-                if (!strict && !checked_pageblock) {
+                if (!locked) {
                         /*
-                         * We need to check suitability of pageblock only once
-                         * and this isolate_freepages_block() is called with
-                         * pageblock range, so just check once is sufficient.
+                         * The zone lock must be held to isolate freepages.
+                         * Unfortunately this is a very coarse lock and can be
+                         * heavily contended if there are parallel allocations
+                         * or parallel compactions. For async compaction do not
+                         * spin on the lock and we acquire the lock as late as
+                         * possible.
                          */
-                        checked_pageblock = true;
-                        if (!suitable_migration_target(page))
+                        locked = compact_trylock_irqsave(&cc->zone->lock,
+                                                                &flags, cc);
+                        if (!locked)
                                 break;
-                }
 
-                /* Recheck this is a buddy page under lock */
-                if (!PageBuddy(page))
-                        goto isolate_fail;
+                        /* Recheck this is a buddy page under lock */
+                        if (!PageBuddy(page))
+                                goto isolate_fail;
+                }
 
                 /* Found a free page, break it into order-0 pages */
                 isolated = split_free_page(page);
@@ -346,6 +423,9 @@ isolate_fail:
 
         }
 
+        /* Record how far we have got within the block */
+        *start_pfn = blockpfn;
+
         trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
 
         /*
@@ -361,8 +441,7 @@ isolate_fail:
 
         /* Update the pageblock-skip if the whole pageblock was scanned */
         if (blockpfn == end_pfn)
-                update_pageblock_skip(cc, valid_page, total_isolated, true,
-                                      false);
+                update_pageblock_skip(cc, valid_page, total_isolated, false);
 
         count_compact_events(COMPACTFREE_SCANNED, nr_scanned);
         if (total_isolated)
@@ -390,19 +469,21 @@ isolate_freepages_range(struct compact_control *cc,
         unsigned long isolated, pfn, block_end_pfn;
         LIST_HEAD(freelist);
 
-        for (pfn = start_pfn; pfn < end_pfn; pfn += isolated) {
-                if (!pfn_valid(pfn) || cc->zone != page_zone(pfn_to_page(pfn)))
-                        break;
+        pfn = start_pfn;
+        block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+
+        for (; pfn < end_pfn; pfn += isolated,
+                                block_end_pfn += pageblock_nr_pages) {
+                /* Protect pfn from changing by isolate_freepages_block */
+                unsigned long isolate_start_pfn = pfn;
 
-                /*
-                 * On subsequent iterations ALIGN() is actually not needed,
-                 * but we keep it that we not to complicate the code.
-                 */
-                block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
                 block_end_pfn = min(block_end_pfn, end_pfn);
 
-                isolated = isolate_freepages_block(cc, pfn, block_end_pfn,
-                                                   &freelist, true);
+                if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone))
+                        break;
+
+                isolated = isolate_freepages_block(cc, &isolate_start_pfn,
+                                                block_end_pfn, &freelist, true);
 
                 /*
                  * In strict mode, isolate_freepages_block() returns 0 if
@@ -433,22 +514,19 @@ isolate_freepages_range(struct compact_control *cc,
 }
 
 /* Update the number of anon and file isolated pages in the zone */
-static void acct_isolated(struct zone *zone, bool locked, struct compact_control *cc)
+static void acct_isolated(struct zone *zone, struct compact_control *cc)
 {
         struct page *page;
         unsigned int count[2] = { 0, };
 
+        if (list_empty(&cc->migratepages))
+                return;
+
         list_for_each_entry(page, &cc->migratepages, lru)
                 count[!!page_is_file_cache(page)]++;
 
-        /* If locked we can use the interrupt unsafe versions */
-        if (locked) {
-                __mod_zone_page_state(zone, NR_ISOLATED_ANON, count[0]);
-                __mod_zone_page_state(zone, NR_ISOLATED_FILE, count[1]);
-        } else {
-                mod_zone_page_state(zone, NR_ISOLATED_ANON, count[0]);
-                mod_zone_page_state(zone, NR_ISOLATED_FILE, count[1]);
-        }
+        mod_zone_page_state(zone, NR_ISOLATED_ANON, count[0]);
+        mod_zone_page_state(zone, NR_ISOLATED_FILE, count[1]);
 }
 
 /* Similar to reclaim, but different enough that they don't share logic */
@@ -467,40 +545,34 @@ static bool too_many_isolated(struct zone *zone)
 }
 
 /**
- * isolate_migratepages_range() - isolate all migrate-able pages in range.
- * @zone:       Zone pages are in.
+ * isolate_migratepages_block() - isolate all migrate-able pages within
+ *                                a single pageblock
  * @cc:         Compaction control structure.
- * @low_pfn:    The first PFN of the range.
- * @end_pfn:    The one-past-the-last PFN of the range.
- * @unevictable: true if it allows to isolate unevictable pages
+ * @low_pfn:    The first PFN to isolate
+ * @end_pfn:    The one-past-the-last PFN to isolate, within same pageblock
+ * @isolate_mode: Isolation mode to be used.
  *
  * Isolate all pages that can be migrated from the range specified by
- * [low_pfn, end_pfn).  Returns zero if there is a fatal signal
- * pending), otherwise PFN of the first page that was not scanned
- * (which may be both less, equal to or more then end_pfn).
+ * [low_pfn, end_pfn). The range is expected to be within same pageblock.
+ * Returns zero if there is a fatal signal pending, otherwise PFN of the
+ * first page that was not scanned (which may be both less, equal to or more
+ * than end_pfn).
  *
- * Assumes that cc->migratepages is empty and cc->nr_migratepages is
- * zero.
- *
- * Apart from cc->migratepages and cc->nr_migratetypes this function
- * does not modify any cc's fields, in particular it does not modify
- * (or read for that matter) cc->migrate_pfn.
+ * The pages are isolated on cc->migratepages list (not required to be empty),
+ * and cc->nr_migratepages is updated accordingly. The cc->migrate_pfn field
+ * is neither read nor updated.
  */
-unsigned long
-isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
-                unsigned long low_pfn, unsigned long end_pfn, bool unevictable)
+static unsigned long
+isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn,
+                        unsigned long end_pfn, isolate_mode_t isolate_mode)
 {
-        unsigned long last_pageblock_nr = 0, pageblock_nr;
+        struct zone *zone = cc->zone;
         unsigned long nr_scanned = 0, nr_isolated = 0;
         struct list_head *migratelist = &cc->migratepages;
         struct lruvec *lruvec;
-        unsigned long flags;
+        unsigned long flags = 0;
         bool locked = false;
         struct page *page = NULL, *valid_page = NULL;
-        bool set_unsuitable = true;
-        const isolate_mode_t mode = (cc->mode == MIGRATE_ASYNC ?
-                                        ISOLATE_ASYNC_MIGRATE : 0) |
-                                    (unevictable ? ISOLATE_UNEVICTABLE : 0);
 
         /*
          * Ensure that there are not too many pages isolated from the LRU
@@ -523,72 +595,43 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
 
         /* Time to isolate some pages for migration */
         for (; low_pfn < end_pfn; low_pfn++) {
-                /* give a chance to irqs before checking need_resched() */
-                if (locked && !(low_pfn % SWAP_CLUSTER_MAX)) {
-                        if (should_release_lock(&zone->lru_lock)) {
-                                spin_unlock_irqrestore(&zone->lru_lock, flags);
-                                locked = false;
-                        }
-                }
-
                 /*
-                 * migrate_pfn does not necessarily start aligned to a
-                 * pageblock. Ensure that pfn_valid is called when moving
-                 * into a new MAX_ORDER_NR_PAGES range in case of large
-                 * memory holes within the zone
+                 * Periodically drop the lock (if held) regardless of its
+                 * contention, to give chance to IRQs. Abort async compaction
+                 * if contended.
                  */
-                if ((low_pfn & (MAX_ORDER_NR_PAGES - 1)) == 0) {
-                        if (!pfn_valid(low_pfn)) {
-                                low_pfn += MAX_ORDER_NR_PAGES - 1;
-                                continue;
-                        }
-                }
+                if (!(low_pfn % SWAP_CLUSTER_MAX)
+                    && compact_unlock_should_abort(&zone->lru_lock, flags,
+                                                                &locked, cc))
+                        break;
 
                 if (!pfn_valid_within(low_pfn))
                         continue;
                 nr_scanned++;
 
-                /*
-                 * Get the page and ensure the page is within the same zone.
-                 * See the comment in isolate_freepages about overlapping
-                 * nodes. It is deliberate that the new zone lock is not taken
-                 * as memory compaction should not move pages between nodes.
-                 */
                 page = pfn_to_page(low_pfn);
-                if (page_zone(page) != zone)
-                        continue;
 
                 if (!valid_page)
                         valid_page = page;
 
-                /* If isolation recently failed, do not retry */
-                pageblock_nr = low_pfn >> pageblock_order;
-                if (last_pageblock_nr != pageblock_nr) {
-                        int mt;
-
-                        last_pageblock_nr = pageblock_nr;
-                        if (!isolation_suitable(cc, page))
-                                goto next_pageblock;
+                /*
+                 * Skip if free. We read page order here without zone lock
+                 * which is generally unsafe, but the race window is small and
+                 * the worst thing that can happen is that we skip some
+                 * potential isolation targets.
+                 */
+                if (PageBuddy(page)) {
+                        unsigned long freepage_order = page_order_unsafe(page);
 
                         /*
-                         * For async migration, also only scan in MOVABLE
-                         * blocks. Async migration is optimistic to see if
-                         * the minimum amount of work satisfies the allocation
+                         * Without lock, we cannot be sure that what we got is
+                         * a valid page order. Consider only values in the
+                         * valid order range to prevent low_pfn overflow.
                          */
-                        mt = get_pageblock_migratetype(page);
-                        if (cc->mode == MIGRATE_ASYNC &&
-                            !migrate_async_suitable(mt)) {
-                                set_unsuitable = false;
-                                goto next_pageblock;
-                        }
-                }
-
-                /*
-                 * Skip if free. page_order cannot be used without zone->lock
-                 * as nothing prevents parallel allocations or buddy merging.
-                 */
-                if (PageBuddy(page))
+                        if (freepage_order > 0 && freepage_order < MAX_ORDER)
+                                low_pfn += (1UL << freepage_order) - 1;
                         continue;
+                }
 
                 /*
                  * Check may be lockless but that's ok as we recheck later.
@@ -597,7 +640,7 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                  */
                 if (!PageLRU(page)) {
                         if (unlikely(balloon_page_movable(page))) {
-                                if (locked && balloon_page_isolate(page)) {
+                                if (balloon_page_isolate(page)) {
                                         /* Successfully isolated */
                                         goto isolate_success;
                                 }
@@ -617,8 +660,11 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                  */
                 if (PageTransHuge(page)) {
                         if (!locked)
-                                goto next_pageblock;
-                        low_pfn += (1 << compound_order(page)) - 1;
+                                low_pfn = ALIGN(low_pfn + 1,
+                                                pageblock_nr_pages) - 1;
+                        else
+                                low_pfn += (1 << compound_order(page)) - 1;
+
                         continue;
                 }
 
@@ -631,24 +677,26 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                     page_count(page) > page_mapcount(page))
                         continue;
 
-                /* Check if it is ok to still hold the lock */
-                locked = compact_checklock_irqsave(&zone->lru_lock, &flags,
-                                                                locked, cc);
-                if (!locked || fatal_signal_pending(current))
-                        break;
+                /* If we already hold the lock, we can skip some rechecking */
+                if (!locked) {
+                        locked = compact_trylock_irqsave(&zone->lru_lock,
+                                                                &flags, cc);
+                        if (!locked)
+                                break;
 
-                /* Recheck PageLRU and PageTransHuge under lock */
-                if (!PageLRU(page))
-                        continue;
-                if (PageTransHuge(page)) {
-                        low_pfn += (1 << compound_order(page)) - 1;
-                        continue;
+                        /* Recheck PageLRU and PageTransHuge under lock */
+                        if (!PageLRU(page))
+                                continue;
+                        if (PageTransHuge(page)) {
+                                low_pfn += (1 << compound_order(page)) - 1;
+                                continue;
+                        }
                 }
 
                 lruvec = mem_cgroup_page_lruvec(page, zone);
 
                 /* Try isolate the page */
-                if (__isolate_lru_page(page, mode) != 0)
+                if (__isolate_lru_page(page, isolate_mode) != 0)
                         continue;
 
                 VM_BUG_ON_PAGE(PageTransCompound(page), page);
@@ -667,14 +715,14 @@ isolate_success:
                         ++low_pfn;
                         break;
                 }
-
-                continue;
-
-next_pageblock:
-                low_pfn = ALIGN(low_pfn + 1, pageblock_nr_pages) - 1;
         }
 
-        acct_isolated(zone, locked, cc);
+        /*
+         * The PageBuddy() check could have potentially brought us outside
+         * the range to be scanned.
+         */
+        if (unlikely(low_pfn > end_pfn))
+                low_pfn = end_pfn;
 
         if (locked)
                 spin_unlock_irqrestore(&zone->lru_lock, flags);
@@ -684,8 +732,7 @@ next_pageblock:
          * if the whole pageblock was scanned without isolating any page.
          */
         if (low_pfn == end_pfn)
-                update_pageblock_skip(cc, valid_page, nr_isolated,
-                                      set_unsuitable, true);
+                update_pageblock_skip(cc, valid_page, nr_isolated, true);
 
         trace_mm_compaction_isolate_migratepages(nr_scanned, nr_isolated);
 
@@ -696,17 +743,65 @@ next_pageblock:
         return low_pfn;
 }
 
+/**
+ * isolate_migratepages_range() - isolate migrate-able pages in a PFN range
+ * @cc:        Compaction control structure.
+ * @start_pfn: The first PFN to start isolating.
+ * @end_pfn:   The one-past-last PFN.
+ *
+ * Returns zero if isolation fails fatally due to e.g. pending signal.
+ * Otherwise, function returns one-past-the-last PFN of isolated page
+ * (which may be greater than end_pfn if end fell in a middle of a THP page).
+ */
+unsigned long
+isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,
+                                                        unsigned long end_pfn)
+{
+        unsigned long pfn, block_end_pfn;
+
+        /* Scan block by block. First and last block may be incomplete */
+        pfn = start_pfn;
+        block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+
+        for (; pfn < end_pfn; pfn = block_end_pfn,
+                                block_end_pfn += pageblock_nr_pages) {
+
+                block_end_pfn = min(block_end_pfn, end_pfn);
+
+                if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone))
+                        continue;
+
+                pfn = isolate_migratepages_block(cc, pfn, block_end_pfn,
+                                                        ISOLATE_UNEVICTABLE);
+
+                /*
+                 * In case of fatal failure, release everything that might
+                 * have been isolated in the previous iteration, and signal
+                 * the failure back to caller.
+                 */
+                if (!pfn) {
+                        putback_movable_pages(&cc->migratepages);
+                        cc->nr_migratepages = 0;
+                        break;
+                }
+        }
+        acct_isolated(cc->zone, cc);
+
+        return pfn;
+}
+
 #endif /* CONFIG_COMPACTION || CONFIG_CMA */
 #ifdef CONFIG_COMPACTION
 /*
  * Based on information in the current compact_control, find blocks
  * suitable for isolating free pages from and then isolate them.
  */
-static void isolate_freepages(struct zone *zone,
-                                struct compact_control *cc)
+static void isolate_freepages(struct compact_control *cc)
 {
+        struct zone *zone = cc->zone;
         struct page *page;
         unsigned long block_start_pfn;  /* start of current pageblock */
+        unsigned long isolate_start_pfn; /* exact pfn we start at */
         unsigned long block_end_pfn;    /* end of current pageblock */
         unsigned long low_pfn;       /* lowest pfn scanner is able to scan */
         int nr_freepages = cc->nr_freepages;
@@ -715,14 +810,15 @@ static void isolate_freepages(struct zone *zone,
         /*
          * Initialise the free scanner. The starting point is where we last
          * successfully isolated from, zone-cached value, or the end of the
-         * zone when isolating for the first time. We need this aligned to
-         * the pageblock boundary, because we do
+         * zone when isolating for the first time. For looping we also need
+         * this pfn aligned down to the pageblock boundary, because we do
          * block_start_pfn -= pageblock_nr_pages in the for loop.
          * For ending point, take care when isolating in last pageblock of a
          * a zone which ends in the middle of a pageblock.
          * The low boundary is the end of the pageblock the migration scanner
          * is using.
          */
+        isolate_start_pfn = cc->free_pfn;
         block_start_pfn = cc->free_pfn & ~(pageblock_nr_pages-1);
         block_end_pfn = min(block_start_pfn + pageblock_nr_pages,
                                                 zone_end_pfn(zone));
@@ -735,7 +831,8 @@ static void isolate_freepages(struct zone *zone,
          */
         for (; block_start_pfn >= low_pfn && cc->nr_migratepages > nr_freepages;
                                 block_end_pfn = block_start_pfn,
-                                block_start_pfn -= pageblock_nr_pages) {
+                                block_start_pfn -= pageblock_nr_pages,
+                                isolate_start_pfn = block_start_pfn) {
                 unsigned long isolated;
 
                 /*
@@ -747,18 +844,9 @@ static void isolate_freepages(struct zone *zone,
                                                 && compact_should_abort(cc))
                         break;
 
-                if (!pfn_valid(block_start_pfn))
-                        continue;
-
-                /*
-                 * Check for overlapping nodes/zones. It's possible on some
-                 * configurations to have a setup like
-                 * node0 node1 node0
-                 * i.e. it's possible that all pages within a zones range of
-                 * pages do not belong to a single zone.
-                 */
-                page = pfn_to_page(block_start_pfn);
-                if (page_zone(page) != zone)
+                page = pageblock_pfn_to_page(block_start_pfn, block_end_pfn,
+                                                                        zone);
+                if (!page)
                         continue;
 
                 /* Check the block is suitable for migration */
@@ -769,13 +857,25 @@ static void isolate_freepages(struct zone *zone,
                 if (!isolation_suitable(cc, page))
                         continue;
 
-                /* Found a block suitable for isolating free pages from */
-                cc->free_pfn = block_start_pfn;
-                isolated = isolate_freepages_block(cc, block_start_pfn,
+                /* Found a block suitable for isolating free pages from. */
+                isolated = isolate_freepages_block(cc, &isolate_start_pfn,
                                         block_end_pfn, freelist, false);
                 nr_freepages += isolated;
 
                 /*
+                 * Remember where the free scanner should restart next time,
+                 * which is where isolate_freepages_block() left off.
+                 * But if it scanned the whole pageblock, isolate_start_pfn
+                 * now points at block_end_pfn, which is the start of the next
+                 * pageblock.
+                 * In that case we will however want to restart at the start
+                 * of the previous pageblock.
+                 */
+                cc->free_pfn = (isolate_start_pfn < block_end_pfn) ?
+                                isolate_start_pfn :
+                                block_start_pfn - pageblock_nr_pages;
+
+                /*
                  * Set a flag that we successfully isolated in this pageblock.
                  * In the next loop iteration, zone->compact_cached_free_pfn
                  * will not be updated and thus it will effectively contain the
@@ -822,7 +922,7 @@ static struct page *compaction_alloc(struct page *migratepage,
          */
         if (list_empty(&cc->freepages)) {
                 if (!cc->contended)
-                        isolate_freepages(cc->zone, cc);
+                        isolate_freepages(cc);
 
                 if (list_empty(&cc->freepages))
                         return NULL;
@@ -856,38 +956,84 @@ typedef enum {
 } isolate_migrate_t;
 
 /*
- * Isolate all pages that can be migrated from the block pointed to by
- * the migrate scanner within compact_control.
+ * Isolate all pages that can be migrated from the first suitable block,
+ * starting at the block pointed to by the migrate scanner pfn within
+ * compact_control.
  */
 static isolate_migrate_t isolate_migratepages(struct zone *zone,
                                         struct compact_control *cc)
 {
         unsigned long low_pfn, end_pfn;
+        struct page *page;
+        const isolate_mode_t isolate_mode =
+                (cc->mode == MIGRATE_ASYNC ? ISOLATE_ASYNC_MIGRATE : 0);
 
-        /* Do not scan outside zone boundaries */
-        low_pfn = max(cc->migrate_pfn, zone->zone_start_pfn);
+        /*
+         * Start at where we last stopped, or beginning of the zone as
+         * initialized by compact_zone()
+         */
+        low_pfn = cc->migrate_pfn;
 
         /* Only scan within a pageblock boundary */
         end_pfn = ALIGN(low_pfn + 1, pageblock_nr_pages);
 
-        /* Do not cross the free scanner or scan within a memory hole */
-        if (end_pfn > cc->free_pfn || !pfn_valid(low_pfn)) {
-                cc->migrate_pfn = end_pfn;
-                return ISOLATE_NONE;
-        }
+        /*
+         * Iterate over whole pageblocks until we find the first suitable.
+         * Do not cross the free scanner.
+         */
+        for (; end_pfn <= cc->free_pfn;
+                        low_pfn = end_pfn, end_pfn += pageblock_nr_pages) {
 
-        /* Perform the isolation */
-        low_pfn = isolate_migratepages_range(zone, cc, low_pfn, end_pfn, false);
-        if (!low_pfn || cc->contended)
-                return ISOLATE_ABORT;
+                /*
+                 * This can potentially iterate a massively long zone with
+                 * many pageblocks unsuitable, so periodically check if we
+                 * need to schedule, or even abort async compaction.
+                 */
+                if (!(low_pfn % (SWAP_CLUSTER_MAX * pageblock_nr_pages))
+                                                && compact_should_abort(cc))
+                        break;
+
+                page = pageblock_pfn_to_page(low_pfn, end_pfn, zone);
+                if (!page)
+                        continue;
+
+                /* If isolation recently failed, do not retry */
+                if (!isolation_suitable(cc, page))
+                        continue;
+
+                /*
+                 * For async compaction, also only scan in MOVABLE blocks.
+                 * Async compaction is optimistic to see if the minimum amount
+                 * of work satisfies the allocation.
+                 */
+                if (cc->mode == MIGRATE_ASYNC &&
+                    !migrate_async_suitable(get_pageblock_migratetype(page)))
+                        continue;
+
+                /* Perform the isolation */
+                low_pfn = isolate_migratepages_block(cc, low_pfn, end_pfn,
+                                                                isolate_mode);
 
+                if (!low_pfn || cc->contended)
+                        return ISOLATE_ABORT;
+
+                /*
+                 * Either we isolated something and proceed with migration. Or
+                 * we failed and compact_zone should decide if we should
+                 * continue or not.
+                 */
+                break;
+        }
+
+        acct_isolated(zone, cc);
+        /* Record where migration scanner will be restarted */
         cc->migrate_pfn = low_pfn;
 
-        return ISOLATE_SUCCESS;
+        return cc->nr_migratepages ? ISOLATE_SUCCESS : ISOLATE_NONE;
 }
 
-static int compact_finished(struct zone *zone,
-                            struct compact_control *cc)
+static int compact_finished(struct zone *zone, struct compact_control *cc,
+                            const int migratetype)
 {
         unsigned int order;
         unsigned long watermark;
@@ -933,7 +1079,7 @@ static int compact_finished(struct zone *zone,
                 struct free_area *area = &zone->free_area[order];
 
                 /* Job done if page is free of the right migratetype */
-                if (!list_empty(&area->free_list[cc->migratetype]))
+                if (!list_empty(&area->free_list[migratetype]))
                         return COMPACT_PARTIAL;
 
                 /* Job done if allocation would set block type */
@@ -999,6 +1145,7 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
         int ret;
         unsigned long start_pfn = zone->zone_start_pfn;
         unsigned long end_pfn = zone_end_pfn(zone);
+        const int migratetype = gfpflags_to_migratetype(cc->gfp_mask);
         const bool sync = cc->mode != MIGRATE_ASYNC;
 
         ret = compaction_suitable(zone, cc->order);
@@ -1041,7 +1188,8 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
 
         migrate_prep_local();
 
-        while ((ret = compact_finished(zone, cc)) == COMPACT_CONTINUE) {
+        while ((ret = compact_finished(zone, cc, migratetype)) ==
+                                                COMPACT_CONTINUE) {
                 int err;
 
                 switch (isolate_migratepages(zone, cc)) {
@@ -1056,9 +1204,6 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
                         ;
                 }
 
-                if (!cc->nr_migratepages)
-                        continue;
-
                 err = migrate_pages(&cc->migratepages, compaction_alloc,
                                 compaction_free, (unsigned long)cc, cc->mode,
                                 MR_COMPACTION);
@@ -1092,14 +1237,14 @@ out:
 }
 
 static unsigned long compact_zone_order(struct zone *zone, int order,
-                gfp_t gfp_mask, enum migrate_mode mode, bool *contended)
+                gfp_t gfp_mask, enum migrate_mode mode, int *contended)
 {
         unsigned long ret;
         struct compact_control cc = {
                 .nr_freepages = 0,
                 .nr_migratepages = 0,
                 .order = order,
-                .migratetype = allocflags_to_migratetype(gfp_mask),
+                .gfp_mask = gfp_mask,
                 .zone = zone,
                 .mode = mode,
         };
@@ -1124,48 +1269,117 @@ int sysctl_extfrag_threshold = 500;
  * @gfp_mask: The GFP mask of the current allocation
  * @nodemask: The allowed nodes to allocate from
  * @mode: The migration mode for async, sync light, or sync migration
- * @contended: Return value that is true if compaction was aborted due to lock contention
- * @page: Optionally capture a free page of the requested order during compaction
+ * @contended: Return value that determines if compaction was aborted due to
+ *             need_resched() or lock contention
+ * @candidate_zone: Return the zone where we think allocation should succeed
  *
  * This is the main entry point for direct page compaction.
  */
 unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        enum migrate_mode mode, bool *contended)
+                        enum migrate_mode mode, int *contended,
+                        struct zone **candidate_zone)
 {
         enum zone_type high_zoneidx = gfp_zone(gfp_mask);
         int may_enter_fs = gfp_mask & __GFP_FS;
         int may_perform_io = gfp_mask & __GFP_IO;
         struct zoneref *z;
         struct zone *zone;
-        int rc = COMPACT_SKIPPED;
+        int rc = COMPACT_DEFERRED;
         int alloc_flags = 0;
+        int all_zones_contended = COMPACT_CONTENDED_LOCK; /* init for &= op */
+
+        *contended = COMPACT_CONTENDED_NONE;
 
         /* Check if the GFP flags allow compaction */
         if (!order || !may_enter_fs || !may_perform_io)
-                return rc;
-
-        count_compact_event(COMPACTSTALL);
+                return COMPACT_SKIPPED;
 
 #ifdef CONFIG_CMA
-        if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
+        if (gfpflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
                 alloc_flags |= ALLOC_CMA;
 #endif
         /* Compact each zone in the list */
         for_each_zone_zonelist_nodemask(zone, z, zonelist, high_zoneidx,
                                                                 nodemask) {
                 int status;
+                int zone_contended;
+
+                if (compaction_deferred(zone, order))
+                        continue;
 
                 status = compact_zone_order(zone, order, gfp_mask, mode,
-                                                contended);
+                                                        &zone_contended);
                 rc = max(status, rc);
+                /*
+                 * It takes at least one zone that wasn't lock contended
+                 * to clear all_zones_contended.
+                 */
+                all_zones_contended &= zone_contended;
 
                 /* If a normal allocation would succeed, stop compacting */
                 if (zone_watermark_ok(zone, order, low_wmark_pages(zone), 0,
-                                      alloc_flags))
-                        break;
+                                      alloc_flags)) {
+                        *candidate_zone = zone;
+                        /*
+                         * We think the allocation will succeed in this zone,
+                         * but it is not certain, hence the false. The caller
+                         * will repeat this with true if allocation indeed
+                         * succeeds in this zone.
+                         */
+                        compaction_defer_reset(zone, order, false);
+                        /*
+                         * It is possible that async compaction aborted due to
+                         * need_resched() and the watermarks were ok thanks to
+                         * somebody else freeing memory. The allocation can
+                         * however still fail so we better signal the
+                         * need_resched() contention anyway (this will not
+                         * prevent the allocation attempt).
+                         */
+                        if (zone_contended == COMPACT_CONTENDED_SCHED)
+                                *contended = COMPACT_CONTENDED_SCHED;
+
+                        goto break_loop;
+                }
+
+                if (mode != MIGRATE_ASYNC) {
+                        /*
+                         * We think that allocation won't succeed in this zone
+                         * so we defer compaction there. If it ends up
+                         * succeeding after all, it will be reset.
+                         */
+                        defer_compaction(zone, order);
+                }
+
+                /*
+                 * We might have stopped compacting due to need_resched() in
+                 * async compaction, or due to a fatal signal detected. In that
+                 * case do not try further zones and signal need_resched()
+                 * contention.
+                 */
+                if ((zone_contended == COMPACT_CONTENDED_SCHED)
+                                        || fatal_signal_pending(current)) {
+                        *contended = COMPACT_CONTENDED_SCHED;
+                        goto break_loop;
+                }
+
+                continue;
+break_loop:
+                /*
+                 * We might not have tried all the zones, so  be conservative
+                 * and assume they are not all lock contended.
+                 */
+                all_zones_contended = 0;
+                break;
         }
 
+        /*
+         * If at least one zone wasn't deferred or skipped, we report if all
+         * zones that were tried were lock contended.
+         */
+        if (rc > COMPACT_SKIPPED && all_zones_contended)
+                *contended = COMPACT_CONTENDED_LOCK;
+
         return rc;
 }
 
diff --git a/mm/debug.c b/mm/debug.c
new file mode 100644
index 000000000000..5ce45c9a29b5
--- /dev/null
+++ b/mm/debug.c
@@ -0,0 +1,237 @@
+/*
+ * mm/debug.c
+ *
+ * mm/ specific debug routines.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/ftrace_event.h>
+#include <linux/memcontrol.h>
+
+static const struct trace_print_flags pageflag_names[] = {
+        {1UL << PG_locked,              "locked"        },
+        {1UL << PG_error,               "error"         },
+        {1UL << PG_referenced,          "referenced"    },
+        {1UL << PG_uptodate,            "uptodate"      },
+        {1UL << PG_dirty,               "dirty"         },
+        {1UL << PG_lru,                 "lru"           },
+        {1UL << PG_active,              "active"        },
+        {1UL << PG_slab,                "slab"          },
+        {1UL << PG_owner_priv_1,        "owner_priv_1"  },
+        {1UL << PG_arch_1,              "arch_1"        },
+        {1UL << PG_reserved,            "reserved"      },
+        {1UL << PG_private,             "private"       },
+        {1UL << PG_private_2,           "private_2"     },
+        {1UL << PG_writeback,           "writeback"     },
+#ifdef CONFIG_PAGEFLAGS_EXTENDED
+        {1UL << PG_head,                "head"          },
+        {1UL << PG_tail,                "tail"          },
+#else
+        {1UL << PG_compound,            "compound"      },
+#endif
+        {1UL << PG_swapcache,           "swapcache"     },
+        {1UL << PG_mappedtodisk,        "mappedtodisk"  },
+        {1UL << PG_reclaim,             "reclaim"       },
+        {1UL << PG_swapbacked,          "swapbacked"    },
+        {1UL << PG_unevictable,         "unevictable"   },
+#ifdef CONFIG_MMU
+        {1UL << PG_mlocked,             "mlocked"       },
+#endif
+#ifdef CONFIG_ARCH_USES_PG_UNCACHED
+        {1UL << PG_uncached,            "uncached"      },
+#endif
+#ifdef CONFIG_MEMORY_FAILURE
+        {1UL << PG_hwpoison,            "hwpoison"      },
+#endif
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        {1UL << PG_compound_lock,       "compound_lock" },
+#endif
+};
+
+static void dump_flags(unsigned long flags,
+                        const struct trace_print_flags *names, int count)
+{
+        const char *delim = "";
+        unsigned long mask;
+        int i;
+
+        pr_emerg("flags: %#lx(", flags);
+
+        /* remove zone id */
+        flags &= (1UL << NR_PAGEFLAGS) - 1;
+
+        for (i = 0; i < count && flags; i++) {
+
+                mask = names[i].mask;
+                if ((flags & mask) != mask)
+                        continue;
+
+                flags &= ~mask;
+                pr_cont("%s%s", delim, names[i].name);
+                delim = "|";
+        }
+
+        /* check for left over flags */
+        if (flags)
+                pr_cont("%s%#lx", delim, flags);
+
+        pr_cont(")\n");
+}
+
+void dump_page_badflags(struct page *page, const char *reason,
+                unsigned long badflags)
+{
+        pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx\n",
+                  page, atomic_read(&page->_count), page_mapcount(page),
+                  page->mapping, page->index);
+        BUILD_BUG_ON(ARRAY_SIZE(pageflag_names) != __NR_PAGEFLAGS);
+        dump_flags(page->flags, pageflag_names, ARRAY_SIZE(pageflag_names));
+        if (reason)
+                pr_alert("page dumped because: %s\n", reason);
+        if (page->flags & badflags) {
+                pr_alert("bad because of flags:\n");
+                dump_flags(page->flags & badflags,
+                                pageflag_names, ARRAY_SIZE(pageflag_names));
+        }
+        mem_cgroup_print_bad_page(page);
+}
+
+void dump_page(struct page *page, const char *reason)
+{
+        dump_page_badflags(page, reason, 0);
+}
+EXPORT_SYMBOL(dump_page);
+
+#ifdef CONFIG_DEBUG_VM
+
+static const struct trace_print_flags vmaflags_names[] = {
+        {VM_READ,                       "read"          },
+        {VM_WRITE,                      "write"         },
+        {VM_EXEC,                       "exec"          },
+        {VM_SHARED,                     "shared"        },
+        {VM_MAYREAD,                    "mayread"       },
+        {VM_MAYWRITE,                   "maywrite"      },
+        {VM_MAYEXEC,                    "mayexec"       },
+        {VM_MAYSHARE,                   "mayshare"      },
+        {VM_GROWSDOWN,                  "growsdown"     },
+        {VM_PFNMAP,                     "pfnmap"        },
+        {VM_DENYWRITE,                  "denywrite"     },
+        {VM_LOCKED,                     "locked"        },
+        {VM_IO,                         "io"            },
+        {VM_SEQ_READ,                   "seqread"       },
+        {VM_RAND_READ,                  "randread"      },
+        {VM_DONTCOPY,                   "dontcopy"      },
+        {VM_DONTEXPAND,                 "dontexpand"    },
+        {VM_ACCOUNT,                    "account"       },
+        {VM_NORESERVE,                  "noreserve"     },
+        {VM_HUGETLB,                    "hugetlb"       },
+        {VM_NONLINEAR,                  "nonlinear"     },
+#if defined(CONFIG_X86)
+        {VM_PAT,                        "pat"           },
+#elif defined(CONFIG_PPC)
+        {VM_SAO,                        "sao"           },
+#elif defined(CONFIG_PARISC) || defined(CONFIG_METAG) || defined(CONFIG_IA64)
+        {VM_GROWSUP,                    "growsup"       },
+#elif !defined(CONFIG_MMU)
+        {VM_MAPPED_COPY,                "mappedcopy"    },
+#else
+        {VM_ARCH_1,                     "arch_1"        },
+#endif
+        {VM_DONTDUMP,                   "dontdump"      },
+#ifdef CONFIG_MEM_SOFT_DIRTY
+        {VM_SOFTDIRTY,                  "softdirty"     },
+#endif
+        {VM_MIXEDMAP,                   "mixedmap"      },
+        {VM_HUGEPAGE,                   "hugepage"      },
+        {VM_NOHUGEPAGE,                 "nohugepage"    },
+        {VM_MERGEABLE,                  "mergeable"     },
+};
+
+void dump_vma(const struct vm_area_struct *vma)
+{
+        pr_emerg("vma %p start %p end %p\n"
+                "next %p prev %p mm %p\n"
+                "prot %lx anon_vma %p vm_ops %p\n"
+                "pgoff %lx file %p private_data %p\n",
+                vma, (void *)vma->vm_start, (void *)vma->vm_end, vma->vm_next,
+                vma->vm_prev, vma->vm_mm,
+                (unsigned long)pgprot_val(vma->vm_page_prot),
+                vma->anon_vma, vma->vm_ops, vma->vm_pgoff,
+                vma->vm_file, vma->vm_private_data);
+        dump_flags(vma->vm_flags, vmaflags_names, ARRAY_SIZE(vmaflags_names));
+}
+EXPORT_SYMBOL(dump_vma);
+
+void dump_mm(const struct mm_struct *mm)
+{
+        pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n"
+#ifdef CONFIG_MMU
+                "get_unmapped_area %p\n"
+#endif
+                "mmap_base %lu mmap_legacy_base %lu highest_vm_end %lu\n"
+                "pgd %p mm_users %d mm_count %d nr_ptes %lu map_count %d\n"
+                "hiwater_rss %lx hiwater_vm %lx total_vm %lx locked_vm %lx\n"
+                "pinned_vm %lx shared_vm %lx exec_vm %lx stack_vm %lx\n"
+                "start_code %lx end_code %lx start_data %lx end_data %lx\n"
+                "start_brk %lx brk %lx start_stack %lx\n"
+                "arg_start %lx arg_end %lx env_start %lx env_end %lx\n"
+                "binfmt %p flags %lx core_state %p\n"
+#ifdef CONFIG_AIO
+                "ioctx_table %p\n"
+#endif
+#ifdef CONFIG_MEMCG
+                "owner %p "
+#endif
+                "exe_file %p\n"
+#ifdef CONFIG_MMU_NOTIFIER
+                "mmu_notifier_mm %p\n"
+#endif
+#ifdef CONFIG_NUMA_BALANCING
+                "numa_next_scan %lu numa_scan_offset %lu numa_scan_seq %d\n"
+#endif
+#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+                "tlb_flush_pending %d\n"
+#endif
+                "%s",   /* This is here to hold the comma */
+
+                mm, mm->mmap, mm->vmacache_seqnum, mm->task_size,
+#ifdef CONFIG_MMU
+                mm->get_unmapped_area,
+#endif
+                mm->mmap_base, mm->mmap_legacy_base, mm->highest_vm_end,
+                mm->pgd, atomic_read(&mm->mm_users),
+                atomic_read(&mm->mm_count),
+                atomic_long_read((atomic_long_t *)&mm->nr_ptes),
+                mm->map_count,
+                mm->hiwater_rss, mm->hiwater_vm, mm->total_vm, mm->locked_vm,
+                mm->pinned_vm, mm->shared_vm, mm->exec_vm, mm->stack_vm,
+                mm->start_code, mm->end_code, mm->start_data, mm->end_data,
+                mm->start_brk, mm->brk, mm->start_stack,
+                mm->arg_start, mm->arg_end, mm->env_start, mm->env_end,
+                mm->binfmt, mm->flags, mm->core_state,
+#ifdef CONFIG_AIO
+                mm->ioctx_table,
+#endif
+#ifdef CONFIG_MEMCG
+                mm->owner,
+#endif
+                mm->exe_file,
+#ifdef CONFIG_MMU_NOTIFIER
+                mm->mmu_notifier_mm,
+#endif
+#ifdef CONFIG_NUMA_BALANCING
+                mm->numa_next_scan, mm->numa_scan_offset, mm->numa_scan_seq,
+#endif
+#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+                mm->tlb_flush_pending,
+#endif
+                ""              /* This is here to not have a comma! */
+                );
+
+                dump_flags(mm->def_flags, vmaflags_names,
+                                ARRAY_SIZE(vmaflags_names));
+}
+
+#endif          /* CONFIG_DEBUG_VM */
diff --git a/mm/dmapool.c b/mm/dmapool.c
index ba8019b063e1..fd5fe4342e93 100644
--- a/mm/dmapool.c
+++ b/mm/dmapool.c
@@ -62,6 +62,7 @@ struct dma_page {		/* cacheable header for 'allocation' bytes */
 };
 
 static DEFINE_MUTEX(pools_lock);
+static DEFINE_MUTEX(pools_reg_lock);
 
 static ssize_t
 show_pools(struct device *dev, struct device_attribute *attr, char *buf)
@@ -132,29 +133,27 @@ struct dma_pool *dma_pool_create(const char *name, struct device *dev,
 {
         struct dma_pool *retval;
         size_t allocation;
+        bool empty = false;
 
-        if (align == 0) {
+        if (align == 0)
                 align = 1;
-        } else if (align & (align - 1)) {
+        else if (align & (align - 1))
                 return NULL;
-        }
 
-        if (size == 0) {
+        if (size == 0)
                 return NULL;
-        } else if (size < 4) {
+        else if (size < 4)
                 size = 4;
-        }
 
         if ((size % align) != 0)
                 size = ALIGN(size, align);
 
         allocation = max_t(size_t, size, PAGE_SIZE);
 
-        if (!boundary) {
+        if (!boundary)
                 boundary = allocation;
-        } else if ((boundary < size) || (boundary & (boundary - 1))) {
+        else if ((boundary < size) || (boundary & (boundary - 1)))
                 return NULL;
-        }
 
         retval = kmalloc_node(sizeof(*retval), GFP_KERNEL, dev_to_node(dev));
         if (!retval)
@@ -172,15 +171,34 @@ struct dma_pool *dma_pool_create(const char *name, struct device *dev,
 
         INIT_LIST_HEAD(&retval->pools);
 
+        /*
+         * pools_lock ensures that the ->dma_pools list does not get corrupted.
+         * pools_reg_lock ensures that there is not a race between
+         * dma_pool_create() and dma_pool_destroy() or within dma_pool_create()
+         * when the first invocation of dma_pool_create() failed on
+         * device_create_file() and the second assumes that it has been done (I
+         * know it is a short window).
+         */
+        mutex_lock(&pools_reg_lock);
         mutex_lock(&pools_lock);
-        if (list_empty(&dev->dma_pools) &&
-            device_create_file(dev, &dev_attr_pools)) {
-                kfree(retval);
-                retval = NULL;
-        } else
-                list_add(&retval->pools, &dev->dma_pools);
+        if (list_empty(&dev->dma_pools))
+                empty = true;
+        list_add(&retval->pools, &dev->dma_pools);
         mutex_unlock(&pools_lock);
-
+        if (empty) {
+                int err;
+
+                err = device_create_file(dev, &dev_attr_pools);
+                if (err) {
+                        mutex_lock(&pools_lock);
+                        list_del(&retval->pools);
+                        mutex_unlock(&pools_lock);
+                        mutex_unlock(&pools_reg_lock);
+                        kfree(retval);
+                        return NULL;
+                }
+        }
+        mutex_unlock(&pools_reg_lock);
         return retval;
 }
 EXPORT_SYMBOL(dma_pool_create);
@@ -251,11 +269,17 @@ static void pool_free_page(struct dma_pool *pool, struct dma_page *page)
  */
 void dma_pool_destroy(struct dma_pool *pool)
 {
+        bool empty = false;
+
+        mutex_lock(&pools_reg_lock);
         mutex_lock(&pools_lock);
         list_del(&pool->pools);
         if (pool->dev && list_empty(&pool->dev->dma_pools))
-                device_remove_file(pool->dev, &dev_attr_pools);
+                empty = true;
         mutex_unlock(&pools_lock);
+        if (empty)
+                device_remove_file(pool->dev, &dev_attr_pools);
+        mutex_unlock(&pools_reg_lock);
 
         while (!list_empty(&pool->page_list)) {
                 struct dma_page *page;
diff --git a/mm/filemap.c b/mm/filemap.c
index 0ab0a3ea5721..14b4642279f1 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1753,7 +1753,7 @@ EXPORT_SYMBOL(generic_file_read_iter);
 static int page_cache_read(struct file *file, pgoff_t offset)
 {
         struct address_space *mapping = file->f_mapping;
-        struct page *page; 
+        struct page *page;
         int ret;
 
         do {
@@ -1770,7 +1770,7 @@ static int page_cache_read(struct file *file, pgoff_t offset)
                 page_cache_release(page);
 
         } while (ret == AOP_TRUNCATED_PAGE);
-                
+
         return ret;
 }
 
diff --git a/mm/gup.c b/mm/gup.c
index af7ea3e0826b..cd62c8c90d4a 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -10,6 +10,10 @@
 #include <linux/swap.h>
 #include <linux/swapops.h>
 
+#include <linux/sched.h>
+#include <linux/rwsem.h>
+#include <asm/pgtable.h>
+
 #include "internal.h"
 
 static struct page *no_page_table(struct vm_area_struct *vma,
@@ -676,3 +680,353 @@ struct page *get_dump_page(unsigned long addr)
         return page;
 }
 #endif /* CONFIG_ELF_CORE */
+
+/*
+ * Generic RCU Fast GUP
+ *
+ * get_user_pages_fast attempts to pin user pages by walking the page
+ * tables directly and avoids taking locks. Thus the walker needs to be
+ * protected from page table pages being freed from under it, and should
+ * block any THP splits.
+ *
+ * One way to achieve this is to have the walker disable interrupts, and
+ * rely on IPIs from the TLB flushing code blocking before the page table
+ * pages are freed. This is unsuitable for architectures that do not need
+ * to broadcast an IPI when invalidating TLBs.
+ *
+ * Another way to achieve this is to batch up page table containing pages
+ * belonging to more than one mm_user, then rcu_sched a callback to free those
+ * pages. Disabling interrupts will allow the fast_gup walker to both block
+ * the rcu_sched callback, and an IPI that we broadcast for splitting THPs
+ * (which is a relatively rare event). The code below adopts this strategy.
+ *
+ * Before activating this code, please be aware that the following assumptions
+ * are currently made:
+ *
+ *  *) HAVE_RCU_TABLE_FREE is enabled, and tlb_remove_table is used to free
+ *      pages containing page tables.
+ *
+ *  *) THP splits will broadcast an IPI, this can be achieved by overriding
+ *      pmdp_splitting_flush.
+ *
+ *  *) ptes can be read atomically by the architecture.
+ *
+ *  *) access_ok is sufficient to validate userspace address ranges.
+ *
+ * The last two assumptions can be relaxed by the addition of helper functions.
+ *
+ * This code is based heavily on the PowerPC implementation by Nick Piggin.
+ */
+#ifdef CONFIG_HAVE_GENERIC_RCU_GUP
+
+#ifdef __HAVE_ARCH_PTE_SPECIAL
+static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
+                         int write, struct page **pages, int *nr)
+{
+        pte_t *ptep, *ptem;
+        int ret = 0;
+
+        ptem = ptep = pte_offset_map(&pmd, addr);
+        do {
+                /*
+                 * In the line below we are assuming that the pte can be read
+                 * atomically. If this is not the case for your architecture,
+                 * please wrap this in a helper function!
+                 *
+                 * for an example see gup_get_pte in arch/x86/mm/gup.c
+                 */
+                pte_t pte = ACCESS_ONCE(*ptep);
+                struct page *page;
+
+                /*
+                 * Similar to the PMD case below, NUMA hinting must take slow
+                 * path
+                 */
+                if (!pte_present(pte) || pte_special(pte) ||
+                        pte_numa(pte) || (write && !pte_write(pte)))
+                        goto pte_unmap;
+
+                VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+                page = pte_page(pte);
+
+                if (!page_cache_get_speculative(page))
+                        goto pte_unmap;
+
+                if (unlikely(pte_val(pte) != pte_val(*ptep))) {
+                        put_page(page);
+                        goto pte_unmap;
+                }
+
+                pages[*nr] = page;
+                (*nr)++;
+
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
+
+        ret = 1;
+
+pte_unmap:
+        pte_unmap(ptem);
+        return ret;
+}
+#else
+
+/*
+ * If we can't determine whether or not a pte is special, then fail immediately
+ * for ptes. Note, we can still pin HugeTLB and THP as these are guaranteed not
+ * to be special.
+ *
+ * For a futex to be placed on a THP tail page, get_futex_key requires a
+ * __get_user_pages_fast implementation that can pin pages. Thus it's still
+ * useful to have gup_huge_pmd even if we can't operate on ptes.
+ */
+static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
+                         int write, struct page **pages, int *nr)
+{
+        return 0;
+}
+#endif /* __HAVE_ARCH_PTE_SPECIAL */
+
+static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        struct page *head, *page, *tail;
+        int refs;
+
+        if (write && !pmd_write(orig))
+                return 0;
+
+        refs = 0;
+        head = pmd_page(orig);
+        page = head + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
+        tail = page;
+        do {
+                VM_BUG_ON_PAGE(compound_head(page) != head, page);
+                pages[*nr] = page;
+                (*nr)++;
+                page++;
+                refs++;
+        } while (addr += PAGE_SIZE, addr != end);
+
+        if (!page_cache_add_speculative(head, refs)) {
+                *nr -= refs;
+                return 0;
+        }
+
+        if (unlikely(pmd_val(orig) != pmd_val(*pmdp))) {
+                *nr -= refs;
+                while (refs--)
+                        put_page(head);
+                return 0;
+        }
+
+        /*
+         * Any tail pages need their mapcount reference taken before we
+         * return. (This allows the THP code to bump their ref count when
+         * they are split into base pages).
+         */
+        while (refs--) {
+                if (PageTail(tail))
+                        get_huge_page_tail(tail);
+                tail++;
+        }
+
+        return 1;
+}
+
+static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        struct page *head, *page, *tail;
+        int refs;
+
+        if (write && !pud_write(orig))
+                return 0;
+
+        refs = 0;
+        head = pud_page(orig);
+        page = head + ((addr & ~PUD_MASK) >> PAGE_SHIFT);
+        tail = page;
+        do {
+                VM_BUG_ON_PAGE(compound_head(page) != head, page);
+                pages[*nr] = page;
+                (*nr)++;
+                page++;
+                refs++;
+        } while (addr += PAGE_SIZE, addr != end);
+
+        if (!page_cache_add_speculative(head, refs)) {
+                *nr -= refs;
+                return 0;
+        }
+
+        if (unlikely(pud_val(orig) != pud_val(*pudp))) {
+                *nr -= refs;
+                while (refs--)
+                        put_page(head);
+                return 0;
+        }
+
+        while (refs--) {
+                if (PageTail(tail))
+                        get_huge_page_tail(tail);
+                tail++;
+        }
+
+        return 1;
+}
+
+static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
+                int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        pmd_t *pmdp;
+
+        pmdp = pmd_offset(&pud, addr);
+        do {
+                pmd_t pmd = ACCESS_ONCE(*pmdp);
+
+                next = pmd_addr_end(addr, end);
+                if (pmd_none(pmd) || pmd_trans_splitting(pmd))
+                        return 0;
+
+                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) {
+                        /*
+                         * NUMA hinting faults need to be handled in the GUP
+                         * slowpath for accounting purposes and so that they
+                         * can be serialised against THP migration.
+                         */
+                        if (pmd_numa(pmd))
+                                return 0;
+
+                        if (!gup_huge_pmd(pmd, pmdp, addr, next, write,
+                                pages, nr))
+                                return 0;
+
+                } else if (!gup_pte_range(pmd, addr, next, write, pages, nr))
+                                return 0;
+        } while (pmdp++, addr = next, addr != end);
+
+        return 1;
+}
+
+static int gup_pud_range(pgd_t *pgdp, unsigned long addr, unsigned long end,
+                int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        pud_t *pudp;
+
+        pudp = pud_offset(pgdp, addr);
+        do {
+                pud_t pud = ACCESS_ONCE(*pudp);
+
+                next = pud_addr_end(addr, end);
+                if (pud_none(pud))
+                        return 0;
+                if (pud_huge(pud)) {
+                        if (!gup_huge_pud(pud, pudp, addr, next, write,
+                                        pages, nr))
+                                return 0;
+                } else if (!gup_pmd_range(pud, addr, next, write, pages, nr))
+                        return 0;
+        } while (pudp++, addr = next, addr != end);
+
+        return 1;
+}
+
+/*
+ * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to
+ * the regular GUP. It will only return non-negative values.
+ */
+int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                          struct page **pages)
+{
+        struct mm_struct *mm = current->mm;
+        unsigned long addr, len, end;
+        unsigned long next, flags;
+        pgd_t *pgdp;
+        int nr = 0;
+
+        start &= PAGE_MASK;
+        addr = start;
+        len = (unsigned long) nr_pages << PAGE_SHIFT;
+        end = start + len;
+
+        if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+                                        start, len)))
+                return 0;
+
+        /*
+         * Disable interrupts.  We use the nested form as we can already have
+         * interrupts disabled by get_futex_key.
+         *
+         * With interrupts disabled, we block page table pages from being
+         * freed from under us. See mmu_gather_tlb in asm-generic/tlb.h
+         * for more details.
+         *
+         * We do not adopt an rcu_read_lock(.) here as we also want to
+         * block IPIs that come from THPs splitting.
+         */
+
+        local_irq_save(flags);
+        pgdp = pgd_offset(mm, addr);
+        do {
+                next = pgd_addr_end(addr, end);
+                if (pgd_none(*pgdp))
+                        break;
+                else if (!gup_pud_range(pgdp, addr, next, write, pages, &nr))
+                        break;
+        } while (pgdp++, addr = next, addr != end);
+        local_irq_restore(flags);
+
+        return nr;
+}
+
+/**
+ * get_user_pages_fast() - pin user pages in memory
+ * @start:      starting user address
+ * @nr_pages:   number of pages from start to pin
+ * @write:      whether pages will be written to
+ * @pages:      array that receives pointers to the pages pinned.
+ *              Should be at least nr_pages long.
+ *
+ * Attempt to pin user pages in memory without taking mm->mmap_sem.
+ * If not successful, it will fall back to taking the lock and
+ * calling get_user_pages().
+ *
+ * Returns number of pages pinned. This may be fewer than the number
+ * requested. If nr_pages is 0 or negative, returns 0. If no pages
+ * were pinned, returns -errno.
+ */
+int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                        struct page **pages)
+{
+        struct mm_struct *mm = current->mm;
+        int nr, ret;
+
+        start &= PAGE_MASK;
+        nr = __get_user_pages_fast(start, nr_pages, write, pages);
+        ret = nr;
+
+        if (nr < nr_pages) {
+                /* Try to get the remaining pages with get_user_pages */
+                start += nr << PAGE_SHIFT;
+                pages += nr;
+
+                down_read(&mm->mmap_sem);
+                ret = get_user_pages(current, mm, start,
+                                     nr_pages - nr, write, 0, pages, NULL);
+                up_read(&mm->mmap_sem);
+
+                /* Have to be a bit careful with return values */
+                if (nr > 0) {
+                        if (ret < 0)
+                                ret = nr;
+                        else
+                                ret += nr;
+                }
+        }
+
+        return ret;
+}
+
+#endif /* CONFIG_HAVE_GENERIC_RCU_GUP */
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index f8ffd9412ec5..74c78aa8bc2f 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1096,7 +1096,7 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
         unsigned long mmun_end;         /* For mmu_notifiers */
 
         ptl = pmd_lockptr(mm, pmd);
-        VM_BUG_ON(!vma->anon_vma);
+        VM_BUG_ON_VMA(!vma->anon_vma, vma);
         haddr = address & HPAGE_PMD_MASK;
         if (is_huge_zero_pmd(orig_pmd))
                 goto alloc;
@@ -2048,7 +2048,7 @@ int __khugepaged_enter(struct mm_struct *mm)
                 return -ENOMEM;
 
         /* __khugepaged_exit() must not run from under us */
-        VM_BUG_ON(khugepaged_test_exit(mm));
+        VM_BUG_ON_MM(khugepaged_test_exit(mm), mm);
         if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
                 free_mm_slot(mm_slot);
                 return 0;
@@ -2083,7 +2083,7 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
         if (vma->vm_ops)
                 /* khugepaged not yet working on file or special mappings */
                 return 0;
-        VM_BUG_ON(vma->vm_flags & VM_NO_THP);
+        VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
         hend = vma->vm_end & HPAGE_PMD_MASK;
         if (hstart < hend)
@@ -2322,23 +2322,17 @@ static struct page
                        int node)
 {
         VM_BUG_ON_PAGE(*hpage, *hpage);
+
         /*
-         * Allocate the page while the vma is still valid and under
-         * the mmap_sem read mode so there is no memory allocation
-         * later when we take the mmap_sem in write mode. This is more
-         * friendly behavior (OTOH it may actually hide bugs) to
-         * filesystems in userland with daemons allocating memory in
-         * the userland I/O paths.  Allocating memory with the
-         * mmap_sem in read mode is good idea also to allow greater
-         * scalability.
+         * Before allocating the hugepage, release the mmap_sem read lock.
+         * The allocation can take potentially a long time if it involves
+         * sync compaction, and we do not need to hold the mmap_sem during
+         * that. We will recheck the vma after taking it again in write mode.
          */
+        up_read(&mm->mmap_sem);
+
         *hpage = alloc_pages_exact_node(node, alloc_hugepage_gfpmask(
                 khugepaged_defrag(), __GFP_OTHER_NODE), HPAGE_PMD_ORDER);
-        /*
-         * After allocating the hugepage, release the mmap_sem read lock in
-         * preparation for taking it in write mode.
-         */
-        up_read(&mm->mmap_sem);
         if (unlikely(!*hpage)) {
                 count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                 *hpage = ERR_PTR(-ENOMEM);
@@ -2412,7 +2406,7 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
                 return false;
         if (is_vma_temporary_stack(vma))
                 return false;
-        VM_BUG_ON(vma->vm_flags & VM_NO_THP);
+        VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
         return true;
 }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index eeceeeb09019..9fd722769927 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -434,7 +434,7 @@ static inline struct resv_map *inode_resv_map(struct inode *inode)
 
 static struct resv_map *vma_resv_map(struct vm_area_struct *vma)
 {
-        VM_BUG_ON(!is_vm_hugetlb_page(vma));
+        VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
         if (vma->vm_flags & VM_MAYSHARE) {
                 struct address_space *mapping = vma->vm_file->f_mapping;
                 struct inode *inode = mapping->host;
@@ -449,8 +449,8 @@ static struct resv_map *vma_resv_map(struct vm_area_struct *vma)
 
 static void set_vma_resv_map(struct vm_area_struct *vma, struct resv_map *map)
 {
-        VM_BUG_ON(!is_vm_hugetlb_page(vma));
-        VM_BUG_ON(vma->vm_flags & VM_MAYSHARE);
+        VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
+        VM_BUG_ON_VMA(vma->vm_flags & VM_MAYSHARE, vma);
 
         set_vma_private_data(vma, (get_vma_private_data(vma) &
                                 HPAGE_RESV_MASK) | (unsigned long)map);
@@ -458,15 +458,15 @@ static void set_vma_resv_map(struct vm_area_struct *vma, struct resv_map *map)
 
 static void set_vma_resv_flags(struct vm_area_struct *vma, unsigned long flags)
 {
-        VM_BUG_ON(!is_vm_hugetlb_page(vma));
-        VM_BUG_ON(vma->vm_flags & VM_MAYSHARE);
+        VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
+        VM_BUG_ON_VMA(vma->vm_flags & VM_MAYSHARE, vma);
 
         set_vma_private_data(vma, get_vma_private_data(vma) | flags);
 }
 
 static int is_vma_resv_set(struct vm_area_struct *vma, unsigned long flag)
 {
-        VM_BUG_ON(!is_vm_hugetlb_page(vma));
+        VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
 
         return (get_vma_private_data(vma) & flag) != 0;
 }
@@ -474,7 +474,7 @@ static int is_vma_resv_set(struct vm_area_struct *vma, unsigned long flag)
 /* Reset counters to 0 and clear all HPAGE_RESV_* flags */
 void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
 {
-        VM_BUG_ON(!is_vm_hugetlb_page(vma));
+        VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
         if (!(vma->vm_flags & VM_MAYSHARE))
                 vma->vm_private_data = (void *)0;
 }
diff --git a/mm/internal.h b/mm/internal.h
index a1b651b11c5f..829304090b90 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -142,10 +142,10 @@ struct compact_control {
         bool finished_update_migrate;
 
         int order;                      /* order a direct compactor needs */
-        int migratetype;                /* MOVABLE, RECLAIMABLE etc */
+        const gfp_t gfp_mask;           /* gfp mask of a direct compactor */
         struct zone *zone;
-        bool contended;                 /* True if a lock was contended, or
-                                         * need_resched() true during async
+        int contended;                  /* Signal need_sched() or lock
+                                         * contention detected during
                                          * compaction
                                          */
 };
@@ -154,8 +154,8 @@ unsigned long
 isolate_freepages_range(struct compact_control *cc,
                         unsigned long start_pfn, unsigned long end_pfn);
 unsigned long
-isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
-        unsigned long low_pfn, unsigned long end_pfn, bool unevictable);
+isolate_migratepages_range(struct compact_control *cc,
+                           unsigned long low_pfn, unsigned long end_pfn);
 
 #endif
 
@@ -164,7 +164,8 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
  * general, page_zone(page)->lock must be held by the caller to prevent the
  * page from being allocated in parallel and returning garbage as the order.
  * If a caller does not hold page_zone(page)->lock, it must guarantee that the
- * page cannot be allocated or merged in parallel.
+ * page cannot be allocated or merged in parallel. Alternatively, it must
+ * handle invalid values gracefully, and use page_order_unsafe() below.
  */
 static inline unsigned long page_order(struct page *page)
 {
@@ -172,6 +173,19 @@ static inline unsigned long page_order(struct page *page)
         return page_private(page);
 }
 
+/*
+ * Like page_order(), but for callers who cannot afford to hold the zone lock.
+ * PageBuddy() should be checked first by the caller to minimize race window,
+ * and invalid values must be handled gracefully.
+ *
+ * ACCESS_ONCE is used so that if the caller assigns the result into a local
+ * variable and e.g. tests it for valid range before using, the compiler cannot
+ * decide to remove the variable and inline the page_private(page) multiple
+ * times, potentially observing different values in the tests and the actual
+ * use of the result.
+ */
+#define page_order_unsafe(page)         ACCESS_ONCE(page_private(page))
+
 static inline bool is_cow_mapping(vm_flags_t flags)
 {
         return (flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE;
diff --git a/mm/interval_tree.c b/mm/interval_tree.c
index 4a5822a586e6..8da581fa9060 100644
--- a/mm/interval_tree.c
+++ b/mm/interval_tree.c
@@ -34,7 +34,7 @@ void vma_interval_tree_insert_after(struct vm_area_struct *node,
         struct vm_area_struct *parent;
         unsigned long last = vma_last_pgoff(node);
 
-        VM_BUG_ON(vma_start_pgoff(node) != vma_start_pgoff(prev));
+        VM_BUG_ON_VMA(vma_start_pgoff(node) != vma_start_pgoff(prev), node);
 
         if (!prev->shared.linear.rb.rb_right) {
                 parent = prev;
diff --git a/mm/kmemcheck.c b/mm/kmemcheck.c
index fd814fd61319..cab58bb592d8 100644
--- a/mm/kmemcheck.c
+++ b/mm/kmemcheck.c
@@ -2,6 +2,7 @@
 #include <linux/mm_types.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
+#include "slab.h"
 #include <linux/kmemcheck.h>
 
 void kmemcheck_alloc_shadow(struct page *page, int order, gfp_t flags, int node)
diff --git a/mm/ksm.c b/mm/ksm.c
index fb7590222706..6b2e337bc03c 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -2310,7 +2310,7 @@ static int __init ksm_init(void)
 
         ksm_thread = kthread_run(ksm_scan_thread, NULL, "ksmd");
         if (IS_ERR(ksm_thread)) {
-                printk(KERN_ERR "ksm: creating kthread failed\n");
+                pr_err("ksm: creating kthread failed\n");
                 err = PTR_ERR(ksm_thread);
                 goto out_free;
         }
@@ -2318,7 +2318,7 @@ static int __init ksm_init(void)
 #ifdef CONFIG_SYSFS
         err = sysfs_create_group(mm_kobj, &ksm_attr_group);
         if (err) {
-                printk(KERN_ERR "ksm: register sysfs failed\n");
+                pr_err("ksm: register sysfs failed\n");
                 kthread_stop(ksm_thread);
                 goto out_free;
         }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 28928ce9b07f..23976fd885fd 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -318,9 +318,6 @@ struct mem_cgroup {
         /* OOM-Killer disable */
         int             oom_kill_disable;
 
-        /* set when res.limit == memsw.limit */
-        bool            memsw_is_minimum;
-
         /* protect arrays of thresholds */
         struct mutex thresholds_lock;
 
@@ -484,14 +481,6 @@ enum res_type {
 #define OOM_CONTROL             (0)
 
 /*
- * Reclaim flags for mem_cgroup_hierarchical_reclaim
- */
-#define MEM_CGROUP_RECLAIM_NOSWAP_BIT   0x0
-#define MEM_CGROUP_RECLAIM_NOSWAP       (1 << MEM_CGROUP_RECLAIM_NOSWAP_BIT)
-#define MEM_CGROUP_RECLAIM_SHRINK_BIT   0x1
-#define MEM_CGROUP_RECLAIM_SHRINK       (1 << MEM_CGROUP_RECLAIM_SHRINK_BIT)
-
-/*
  * The memcg_create_mutex will be held whenever a new cgroup is created.
  * As a consequence, any change that needs to protect against new child cgroups
  * appearing has to hold it as well.
@@ -649,11 +638,13 @@ int memcg_limited_groups_array_size;
 struct static_key memcg_kmem_enabled_key;
 EXPORT_SYMBOL(memcg_kmem_enabled_key);
 
+static void memcg_free_cache_id(int id);
+
 static void disarm_kmem_keys(struct mem_cgroup *memcg)
 {
         if (memcg_kmem_is_active(memcg)) {
                 static_key_slow_dec(&memcg_kmem_enabled_key);
-                ida_simple_remove(&kmem_limited_groups, memcg->kmemcg_id);
+                memcg_free_cache_id(memcg->kmemcg_id);
         }
         /*
          * This check can't live in kmem destruction function,
@@ -1806,42 +1797,6 @@ static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
                          NULL, "Memory cgroup out of memory");
 }
 
-static unsigned long mem_cgroup_reclaim(struct mem_cgroup *memcg,
-                                        gfp_t gfp_mask,
-                                        unsigned long flags)
-{
-        unsigned long total = 0;
-        bool noswap = false;
-        int loop;
-
-        if (flags & MEM_CGROUP_RECLAIM_NOSWAP)
-                noswap = true;
-        if (!(flags & MEM_CGROUP_RECLAIM_SHRINK) && memcg->memsw_is_minimum)
-                noswap = true;
-
-        for (loop = 0; loop < MEM_CGROUP_MAX_RECLAIM_LOOPS; loop++) {
-                if (loop)
-                        drain_all_stock_async(memcg);
-                total += try_to_free_mem_cgroup_pages(memcg, gfp_mask, noswap);
-                /*
-                 * Allow limit shrinkers, which are triggered directly
-                 * by userspace, to catch signals and stop reclaim
-                 * after minimal progress, regardless of the margin.
-                 */
-                if (total && (flags & MEM_CGROUP_RECLAIM_SHRINK))
-                        break;
-                if (mem_cgroup_margin(memcg))
-                        break;
-                /*
-                 * If nothing was reclaimed after two attempts, there
-                 * may be no reclaimable pages in this hierarchy.
-                 */
-                if (loop && !total)
-                        break;
-        }
-        return total;
-}
-
 /**
  * test_mem_cgroup_node_reclaimable
  * @memcg: the target memcg
@@ -2544,8 +2499,9 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
         struct mem_cgroup *mem_over_limit;
         struct res_counter *fail_res;
         unsigned long nr_reclaimed;
-        unsigned long flags = 0;
         unsigned long long size;
+        bool may_swap = true;
+        bool drained = false;
         int ret = 0;
 
         if (mem_cgroup_is_root(memcg))
@@ -2555,16 +2511,17 @@ retry:
                 goto done;
 
         size = batch * PAGE_SIZE;
-        if (!res_counter_charge(&memcg->res, size, &fail_res)) {
-                if (!do_swap_account)
-                        goto done_restock;
-                if (!res_counter_charge(&memcg->memsw, size, &fail_res))
+        if (!do_swap_account ||
+            !res_counter_charge(&memcg->memsw, size, &fail_res)) {
+                if (!res_counter_charge(&memcg->res, size, &fail_res))
                         goto done_restock;
-                res_counter_uncharge(&memcg->res, size);
-                mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
-                flags |= MEM_CGROUP_RECLAIM_NOSWAP;
-        } else
+                if (do_swap_account)
+                        res_counter_uncharge(&memcg->memsw, size);
                 mem_over_limit = mem_cgroup_from_res_counter(fail_res, res);
+        } else {
+                mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
+                may_swap = false;
+        }
 
         if (batch > nr_pages) {
                 batch = nr_pages;
@@ -2588,11 +2545,18 @@ retry:
         if (!(gfp_mask & __GFP_WAIT))
                 goto nomem;
 
-        nr_reclaimed = mem_cgroup_reclaim(mem_over_limit, gfp_mask, flags);
+        nr_reclaimed = try_to_free_mem_cgroup_pages(mem_over_limit, nr_pages,
+                                                    gfp_mask, may_swap);
 
         if (mem_cgroup_margin(mem_over_limit) >= nr_pages)
                 goto retry;
 
+        if (!drained) {
+                drain_all_stock_async(mem_over_limit);
+                drained = true;
+                goto retry;
+        }
+
         if (gfp_mask & __GFP_NORETRY)
                 goto nomem;
         /*
@@ -2798,12 +2762,6 @@ static DEFINE_MUTEX(memcg_slab_mutex);
 
 static DEFINE_MUTEX(activate_kmem_mutex);
 
-static inline bool memcg_can_account_kmem(struct mem_cgroup *memcg)
-{
-        return !mem_cgroup_disabled() && !mem_cgroup_is_root(memcg) &&
-                memcg_kmem_is_active(memcg);
-}
-
 /*
  * This is a bit cumbersome, but it is rarely used and avoids a backpointer
  * in the memcg_cache_params struct.
@@ -2823,7 +2781,7 @@ static int mem_cgroup_slabinfo_read(struct seq_file *m, void *v)
         struct mem_cgroup *memcg = mem_cgroup_from_css(seq_css(m));
         struct memcg_cache_params *params;
 
-        if (!memcg_can_account_kmem(memcg))
+        if (!memcg_kmem_is_active(memcg))
                 return -EIO;
 
         print_slabinfo_header(m);
@@ -2906,19 +2864,44 @@ int memcg_cache_id(struct mem_cgroup *memcg)
         return memcg ? memcg->kmemcg_id : -1;
 }
 
-static size_t memcg_caches_array_size(int num_groups)
+static int memcg_alloc_cache_id(void)
 {
-        ssize_t size;
-        if (num_groups <= 0)
-                return 0;
+        int id, size;
+        int err;
+
+        id = ida_simple_get(&kmem_limited_groups,
+                            0, MEMCG_CACHES_MAX_SIZE, GFP_KERNEL);
+        if (id < 0)
+                return id;
+
+        if (id < memcg_limited_groups_array_size)
+                return id;
+
+        /*
+         * There's no space for the new id in memcg_caches arrays,
+         * so we have to grow them.
+         */
 
-        size = 2 * num_groups;
+        size = 2 * (id + 1);
         if (size < MEMCG_CACHES_MIN_SIZE)
                 size = MEMCG_CACHES_MIN_SIZE;
         else if (size > MEMCG_CACHES_MAX_SIZE)
                 size = MEMCG_CACHES_MAX_SIZE;
 
-        return size;
+        mutex_lock(&memcg_slab_mutex);
+        err = memcg_update_all_caches(size);
+        mutex_unlock(&memcg_slab_mutex);
+
+        if (err) {
+                ida_simple_remove(&kmem_limited_groups, id);
+                return err;
+        }
+        return id;
+}
+
+static void memcg_free_cache_id(int id)
+{
+        ida_simple_remove(&kmem_limited_groups, id);
 }
 
 /*
@@ -2928,97 +2911,7 @@ static size_t memcg_caches_array_size(int num_groups)
  */
 void memcg_update_array_size(int num)
 {
-        if (num > memcg_limited_groups_array_size)
-                memcg_limited_groups_array_size = memcg_caches_array_size(num);
-}
-
-int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
-{
-        struct memcg_cache_params *cur_params = s->memcg_params;
-
-        VM_BUG_ON(!is_root_cache(s));
-
-        if (num_groups > memcg_limited_groups_array_size) {
-                int i;
-                struct memcg_cache_params *new_params;
-                ssize_t size = memcg_caches_array_size(num_groups);
-
-                size *= sizeof(void *);
-                size += offsetof(struct memcg_cache_params, memcg_caches);
-
-                new_params = kzalloc(size, GFP_KERNEL);
-                if (!new_params)
-                        return -ENOMEM;
-
-                new_params->is_root_cache = true;
-
-                /*
-                 * There is the chance it will be bigger than
-                 * memcg_limited_groups_array_size, if we failed an allocation
-                 * in a cache, in which case all caches updated before it, will
-                 * have a bigger array.
-                 *
-                 * But if that is the case, the data after
-                 * memcg_limited_groups_array_size is certainly unused
-                 */
-                for (i = 0; i < memcg_limited_groups_array_size; i++) {
-                        if (!cur_params->memcg_caches[i])
-                                continue;
-                        new_params->memcg_caches[i] =
-                                                cur_params->memcg_caches[i];
-                }
-
-                /*
-                 * Ideally, we would wait until all caches succeed, and only
-                 * then free the old one. But this is not worth the extra
-                 * pointer per-cache we'd have to have for this.
-                 *
-                 * It is not a big deal if some caches are left with a size
-                 * bigger than the others. And all updates will reset this
-                 * anyway.
-                 */
-                rcu_assign_pointer(s->memcg_params, new_params);
-                if (cur_params)
-                        kfree_rcu(cur_params, rcu_head);
-        }
-        return 0;
-}
-
-int memcg_alloc_cache_params(struct mem_cgroup *memcg, struct kmem_cache *s,
-                             struct kmem_cache *root_cache)
-{
-        size_t size;
-
-        if (!memcg_kmem_enabled())
-                return 0;
-
-        if (!memcg) {
-                size = offsetof(struct memcg_cache_params, memcg_caches);
-                size += memcg_limited_groups_array_size * sizeof(void *);
-        } else
-                size = sizeof(struct memcg_cache_params);
-
-        s->memcg_params = kzalloc(size, GFP_KERNEL);
-        if (!s->memcg_params)
-                return -ENOMEM;
-
-        if (memcg) {
-                s->memcg_params->memcg = memcg;
-                s->memcg_params->root_cache = root_cache;
-                css_get(&memcg->css);
-        } else
-                s->memcg_params->is_root_cache = true;
-
-        return 0;
-}
-
-void memcg_free_cache_params(struct kmem_cache *s)
-{
-        if (!s->memcg_params)
-                return;
-        if (!s->memcg_params->is_root_cache)
-                css_put(&s->memcg_params->memcg->css);
-        kfree(s->memcg_params);
+        memcg_limited_groups_array_size = num;
 }
 
 static void memcg_register_cache(struct mem_cgroup *memcg,
@@ -3051,6 +2944,7 @@ static void memcg_register_cache(struct mem_cgroup *memcg,
         if (!cachep)
                 return;
 
+        css_get(&memcg->css);
         list_add(&cachep->memcg_params->list, &memcg->memcg_slab_caches);
 
         /*
@@ -3084,6 +2978,9 @@ static void memcg_unregister_cache(struct kmem_cache *cachep)
         list_del(&cachep->memcg_params->list);
 
         kmem_cache_destroy(cachep);
+
+        /* drop the reference taken in memcg_register_cache */
+        css_put(&memcg->css);
 }
 
 /*
@@ -3261,7 +3158,7 @@ struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep,
         rcu_read_lock();
         memcg = mem_cgroup_from_task(rcu_dereference(current->mm->owner));
 
-        if (!memcg_can_account_kmem(memcg))
+        if (!memcg_kmem_is_active(memcg))
                 goto out;
 
         memcg_cachep = cache_from_memcg_idx(cachep, memcg_cache_id(memcg));
@@ -3346,7 +3243,7 @@ __memcg_kmem_newpage_charge(gfp_t gfp, struct mem_cgroup **_memcg, int order)
 
         memcg = get_mem_cgroup_from_mm(current->mm);
 
-        if (!memcg_can_account_kmem(memcg)) {
+        if (!memcg_kmem_is_active(memcg)) {
                 css_put(&memcg->css);
                 return true;
         }
@@ -3688,7 +3585,6 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                                 unsigned long long val)
 {
         int retry_count;
-        u64 memswlimit, memlimit;
         int ret = 0;
         int children = mem_cgroup_count_children(memcg);
         u64 curusage, oldusage;
@@ -3715,31 +3611,23 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                  * We have to guarantee memcg->res.limit <= memcg->memsw.limit.
                  */
                 mutex_lock(&set_limit_mutex);
-                memswlimit = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
-                if (memswlimit < val) {
+                if (res_counter_read_u64(&memcg->memsw, RES_LIMIT) < val) {
                         ret = -EINVAL;
                         mutex_unlock(&set_limit_mutex);
                         break;
                 }
 
-                memlimit = res_counter_read_u64(&memcg->res, RES_LIMIT);
-                if (memlimit < val)
+                if (res_counter_read_u64(&memcg->res, RES_LIMIT) < val)
                         enlarge = 1;
 
                 ret = res_counter_set_limit(&memcg->res, val);
-                if (!ret) {
-                        if (memswlimit == val)
-                                memcg->memsw_is_minimum = true;
-                        else
-                                memcg->memsw_is_minimum = false;
-                }
                 mutex_unlock(&set_limit_mutex);
 
                 if (!ret)
                         break;
 
-                mem_cgroup_reclaim(memcg, GFP_KERNEL,
-                                   MEM_CGROUP_RECLAIM_SHRINK);
+                try_to_free_mem_cgroup_pages(memcg, 1, GFP_KERNEL, true);
+
                 curusage = res_counter_read_u64(&memcg->res, RES_USAGE);
                 /* Usage is reduced ? */
                 if (curusage >= oldusage)
@@ -3757,7 +3645,7 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                                         unsigned long long val)
 {
         int retry_count;
-        u64 memlimit, memswlimit, oldusage, curusage;
+        u64 oldusage, curusage;
         int children = mem_cgroup_count_children(memcg);
         int ret = -EBUSY;
         int enlarge = 0;
@@ -3776,30 +3664,21 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                  * We have to guarantee memcg->res.limit <= memcg->memsw.limit.
                  */
                 mutex_lock(&set_limit_mutex);
-                memlimit = res_counter_read_u64(&memcg->res, RES_LIMIT);
-                if (memlimit > val) {
+                if (res_counter_read_u64(&memcg->res, RES_LIMIT) > val) {
                         ret = -EINVAL;
                         mutex_unlock(&set_limit_mutex);
                         break;
                 }
-                memswlimit = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
-                if (memswlimit < val)
+                if (res_counter_read_u64(&memcg->memsw, RES_LIMIT) < val)
                         enlarge = 1;
                 ret = res_counter_set_limit(&memcg->memsw, val);
-                if (!ret) {
-                        if (memlimit == val)
-                                memcg->memsw_is_minimum = true;
-                        else
-                                memcg->memsw_is_minimum = false;
-                }
                 mutex_unlock(&set_limit_mutex);
 
                 if (!ret)
                         break;
 
-                mem_cgroup_reclaim(memcg, GFP_KERNEL,
-                                   MEM_CGROUP_RECLAIM_NOSWAP |
-                                   MEM_CGROUP_RECLAIM_SHRINK);
+                try_to_free_mem_cgroup_pages(memcg, 1, GFP_KERNEL, false);
+
                 curusage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
                 /* Usage is reduced ? */
                 if (curusage >= oldusage)
@@ -4048,8 +3927,8 @@ static int mem_cgroup_force_empty(struct mem_cgroup *memcg)
                 if (signal_pending(current))
                         return -EINTR;
 
-                progress = try_to_free_mem_cgroup_pages(memcg, GFP_KERNEL,
-                                                false);
+                progress = try_to_free_mem_cgroup_pages(memcg, 1,
+                                                        GFP_KERNEL, true);
                 if (!progress) {
                         nr_retries--;
                         /* maybe some writeback is necessary */
@@ -4214,23 +4093,12 @@ static int __memcg_activate_kmem(struct mem_cgroup *memcg,
         if (err)
                 goto out;
 
-        memcg_id = ida_simple_get(&kmem_limited_groups,
-                                  0, MEMCG_CACHES_MAX_SIZE, GFP_KERNEL);
+        memcg_id = memcg_alloc_cache_id();
         if (memcg_id < 0) {
                 err = memcg_id;
                 goto out;
         }
 
-        /*
-         * Make sure we have enough space for this cgroup in each root cache's
-         * memcg_params.
-         */
-        mutex_lock(&memcg_slab_mutex);
-        err = memcg_update_all_caches(memcg_id + 1);
-        mutex_unlock(&memcg_slab_mutex);
-        if (err)
-                goto out_rmid;
-
         memcg->kmemcg_id = memcg_id;
         INIT_LIST_HEAD(&memcg->memcg_slab_caches);
 
@@ -4251,10 +4119,6 @@ static int __memcg_activate_kmem(struct mem_cgroup *memcg,
 out:
         memcg_resume_kmem_account();
         return err;
-
-out_rmid:
-        ida_simple_remove(&kmem_limited_groups, memcg_id);
-        goto out;
 }
 
 static int memcg_activate_kmem(struct mem_cgroup *memcg,
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 2ff8c2325e96..29d8693d0c61 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1307,7 +1307,7 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 /*
  * Confirm all pages in a range [start, end) is belongs to the same zone.
  */
-static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
 {
         unsigned long pfn;
         struct zone *zone = NULL;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 8f5330d74f47..e58725aff7e9 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -123,25 +123,23 @@ static struct mempolicy default_policy = {
 
 static struct mempolicy preferred_node_policy[MAX_NUMNODES];
 
-static struct mempolicy *get_task_policy(struct task_struct *p)
+struct mempolicy *get_task_policy(struct task_struct *p)
 {
         struct mempolicy *pol = p->mempolicy;
+        int node;
 
-        if (!pol) {
-                int node = numa_node_id();
+        if (pol)
+                return pol;
 
-                if (node != NUMA_NO_NODE) {
-                        pol = &preferred_node_policy[node];
-                        /*
-                         * preferred_node_policy is not initialised early in
-                         * boot
-                         */
-                        if (!pol->mode)
-                                pol = NULL;
-                }
+        node = numa_node_id();
+        if (node != NUMA_NO_NODE) {
+                pol = &preferred_node_policy[node];
+                /* preferred_node_policy is not initialised early in boot */
+                if (pol->mode)
+                        return pol;
         }
 
-        return pol;
+        return &default_policy;
 }
 
 static const struct mempolicy_operations {
@@ -683,7 +681,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
                 }
 
                 if (flags & MPOL_MF_LAZY) {
-                        change_prot_numa(vma, start, endvma);
+                        /* Similar to task_numa_work, skip inaccessible VMAs */
+                        if (vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))
+                                change_prot_numa(vma, start, endvma);
                         goto next;
                 }
 
@@ -804,7 +804,6 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags,
                              nodemask_t *nodes)
 {
         struct mempolicy *new, *old;
-        struct mm_struct *mm = current->mm;
         NODEMASK_SCRATCH(scratch);
         int ret;
 
@@ -816,20 +815,11 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags,
                 ret = PTR_ERR(new);
                 goto out;
         }
-        /*
-         * prevent changing our mempolicy while show_numa_maps()
-         * is using it.
-         * Note:  do_set_mempolicy() can be called at init time
-         * with no 'mm'.
-         */
-        if (mm)
-                down_write(&mm->mmap_sem);
+
         task_lock(current);
         ret = mpol_set_nodemask(new, nodes, scratch);
         if (ret) {
                 task_unlock(current);
-                if (mm)
-                        up_write(&mm->mmap_sem);
                 mpol_put(new);
                 goto out;
         }
@@ -839,9 +829,6 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags,
             nodes_weight(new->v.nodes))
                 current->il_next = first_node(new->v.nodes);
         task_unlock(current);
-        if (mm)
-                up_write(&mm->mmap_sem);
-
         mpol_put(old);
         ret = 0;
 out:
@@ -1605,32 +1592,14 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
 
 #endif
 
-/*
- * get_vma_policy(@task, @vma, @addr)
- * @task: task for fallback if vma policy == default
- * @vma: virtual memory area whose policy is sought
- * @addr: address in @vma for shared policy lookup
- *
- * Returns effective policy for a VMA at specified address.
- * Falls back to @task or system default policy, as necessary.
- * Current or other task's task mempolicy and non-shared vma policies must be
- * protected by task_lock(task) by the caller.
- * Shared policies [those marked as MPOL_F_SHARED] require an extra reference
- * count--added by the get_policy() vm_op, as appropriate--to protect against
- * freeing by another task.  It is the caller's responsibility to free the
- * extra reference for shared policies.
- */
-struct mempolicy *get_vma_policy(struct task_struct *task,
-                struct vm_area_struct *vma, unsigned long addr)
+struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
+                                                unsigned long addr)
 {
-        struct mempolicy *pol = get_task_policy(task);
+        struct mempolicy *pol = NULL;
 
         if (vma) {
                 if (vma->vm_ops && vma->vm_ops->get_policy) {
-                        struct mempolicy *vpol = vma->vm_ops->get_policy(vma,
-                                                                        addr);
-                        if (vpol)
-                                pol = vpol;
+                        pol = vma->vm_ops->get_policy(vma, addr);
                 } else if (vma->vm_policy) {
                         pol = vma->vm_policy;
 
@@ -1644,31 +1613,51 @@ struct mempolicy *get_vma_policy(struct task_struct *task,
                                 mpol_get(pol);
                 }
         }
+
+        return pol;
+}
+
+/*
+ * get_vma_policy(@vma, @addr)
+ * @vma: virtual memory area whose policy is sought
+ * @addr: address in @vma for shared policy lookup
+ *
+ * Returns effective policy for a VMA at specified address.
+ * Falls back to current->mempolicy or system default policy, as necessary.
+ * Shared policies [those marked as MPOL_F_SHARED] require an extra reference
+ * count--added by the get_policy() vm_op, as appropriate--to protect against
+ * freeing by another task.  It is the caller's responsibility to free the
+ * extra reference for shared policies.
+ */
+static struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+                                                unsigned long addr)
+{
+        struct mempolicy *pol = __get_vma_policy(vma, addr);
+
         if (!pol)
-                pol = &default_policy;
+                pol = get_task_policy(current);
+
         return pol;
 }
 
-bool vma_policy_mof(struct task_struct *task, struct vm_area_struct *vma)
+bool vma_policy_mof(struct vm_area_struct *vma)
 {
-        struct mempolicy *pol = get_task_policy(task);
-        if (vma) {
-                if (vma->vm_ops && vma->vm_ops->get_policy) {
-                        bool ret = false;
+        struct mempolicy *pol;
 
-                        pol = vma->vm_ops->get_policy(vma, vma->vm_start);
-                        if (pol && (pol->flags & MPOL_F_MOF))
-                                ret = true;
-                        mpol_cond_put(pol);
+        if (vma->vm_ops && vma->vm_ops->get_policy) {
+                bool ret = false;
 
-                        return ret;
-                } else if (vma->vm_policy) {
-                        pol = vma->vm_policy;
-                }
+                pol = vma->vm_ops->get_policy(vma, vma->vm_start);
+                if (pol && (pol->flags & MPOL_F_MOF))
+                        ret = true;
+                mpol_cond_put(pol);
+
+                return ret;
         }
 
+        pol = vma->vm_policy;
         if (!pol)
-                return default_policy.flags & MPOL_F_MOF;
+                pol = get_task_policy(current);
 
         return pol->flags & MPOL_F_MOF;
 }
@@ -1874,7 +1863,7 @@ struct zonelist *huge_zonelist(struct vm_area_struct *vma, unsigned long addr,
 {
         struct zonelist *zl;
 
-        *mpol = get_vma_policy(current, vma, addr);
+        *mpol = get_vma_policy(vma, addr);
         *nodemask = NULL;       /* assume !MPOL_BIND */
 
         if (unlikely((*mpol)->mode == MPOL_INTERLEAVE)) {
@@ -2029,7 +2018,7 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
         unsigned int cpuset_mems_cookie;
 
 retry_cpuset:
-        pol = get_vma_policy(current, vma, addr);
+        pol = get_vma_policy(vma, addr);
         cpuset_mems_cookie = read_mems_allowed_begin();
 
         if (unlikely(pol->mode == MPOL_INTERLEAVE)) {
@@ -2046,8 +2035,7 @@ retry_cpuset:
         page = __alloc_pages_nodemask(gfp, order,
                                       policy_zonelist(gfp, pol, node),
                                       policy_nodemask(gfp, pol));
-        if (unlikely(mpol_needs_cond_ref(pol)))
-                __mpol_put(pol);
+        mpol_cond_put(pol);
         if (unlikely(!page && read_mems_allowed_retry(cpuset_mems_cookie)))
                 goto retry_cpuset;
         return page;
@@ -2074,12 +2062,12 @@ retry_cpuset:
  */
 struct page *alloc_pages_current(gfp_t gfp, unsigned order)
 {
-        struct mempolicy *pol = get_task_policy(current);
+        struct mempolicy *pol = &default_policy;
         struct page *page;
         unsigned int cpuset_mems_cookie;
 
-        if (!pol || in_interrupt() || (gfp & __GFP_THISNODE))
-                pol = &default_policy;
+        if (!in_interrupt() && !(gfp & __GFP_THISNODE))
+                pol = get_task_policy(current);
 
 retry_cpuset:
         cpuset_mems_cookie = read_mems_allowed_begin();
@@ -2296,7 +2284,7 @@ int mpol_misplaced(struct page *page, struct vm_area_struct *vma, unsigned long
 
         BUG_ON(!vma);
 
-        pol = get_vma_policy(current, vma, addr);
+        pol = get_vma_policy(vma, addr);
         if (!(pol->flags & MPOL_F_MOF))
                 goto out;
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 2740360cd216..01439953abf5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -876,7 +876,7 @@ static int __unmap_and_move(struct page *page, struct page *newpage,
                 }
         }
 
-        if (unlikely(balloon_page_movable(page))) {
+        if (unlikely(isolated_balloon_page(page))) {
                 /*
                  * A ballooned page does not need any special attention from
                  * physical to virtual reverse mapping procedures.
@@ -955,17 +955,6 @@ static int unmap_and_move(new_page_t get_new_page, free_page_t put_new_page,
 
         rc = __unmap_and_move(page, newpage, force, mode);
 
-        if (unlikely(rc == MIGRATEPAGE_BALLOON_SUCCESS)) {
-                /*
-                 * A ballooned page has been migrated already.
-                 * Now, it's the time to wrap-up counters,
-                 * handle the page back to Buddy and return.
-                 */
-                dec_zone_page_state(page, NR_ISOLATED_ANON +
-                                    page_is_file_cache(page));
-                balloon_page_free(page);
-                return MIGRATEPAGE_SUCCESS;
-        }
 out:
         if (rc != -EAGAIN) {
                 /*
@@ -988,6 +977,9 @@ out:
         if (rc != MIGRATEPAGE_SUCCESS && put_new_page) {
                 ClearPageSwapBacked(newpage);
                 put_new_page(newpage, private);
+        } else if (unlikely(__is_movable_balloon_page(newpage))) {
+                /* drop our reference, page already in the balloon */
+                put_page(newpage);
         } else
                 putback_lru_page(newpage);
 
diff --git a/mm/mlock.c b/mm/mlock.c
index ce84cb0b83ef..03aa8512723b 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -233,9 +233,9 @@ long __mlock_vma_pages_range(struct vm_area_struct *vma,
 
         VM_BUG_ON(start & ~PAGE_MASK);
         VM_BUG_ON(end   & ~PAGE_MASK);
-        VM_BUG_ON(start < vma->vm_start);
-        VM_BUG_ON(end   > vma->vm_end);
-        VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
+        VM_BUG_ON_VMA(start < vma->vm_start, vma);
+        VM_BUG_ON_VMA(end   > vma->vm_end, vma);
+        VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_sem), mm);
 
         gup_flags = FOLL_TOUCH | FOLL_MLOCK;
         /*
diff --git a/mm/mmap.c b/mm/mmap.c
index c0a3637cdb64..16d19b48e2ad 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -70,7 +70,7 @@ static void unmap_region(struct mm_struct *mm,
  * MAP_SHARED   r: (no) no      r: (yes) yes    r: (no) yes     r: (no) yes
  *              w: (no) no      w: (no) no      w: (yes) yes    w: (no) no
  *              x: (no) no      x: (no) yes     x: (no) yes     x: (yes) yes
- *              
+ *
  * MAP_PRIVATE  r: (no) no      r: (yes) yes    r: (no) yes     r: (no) yes
  *              w: (no) no      w: (no) no      w: (copy) copy  w: (no) no
  *              x: (no) no      x: (no) yes     x: (no) yes     x: (yes) yes
@@ -268,7 +268,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len);
 
 SYSCALL_DEFINE1(brk, unsigned long, brk)
 {
-        unsigned long rlim, retval;
+        unsigned long retval;
         unsigned long newbrk, oldbrk;
         struct mm_struct *mm = current->mm;
         unsigned long min_brk;
@@ -298,9 +298,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
          * segment grow beyond its set limit the in case where the limit is
          * not page aligned -Ram Gupta
          */
-        rlim = rlimit(RLIMIT_DATA);
-        if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
-                        (mm->end_data - mm->start_data) > rlim)
+        if (check_data_rlimit(rlimit(RLIMIT_DATA), brk, mm->start_brk,
+                              mm->end_data, mm->start_data))
                 goto out;
 
         newbrk = PAGE_ALIGN(brk);
@@ -369,16 +368,18 @@ static int browse_rb(struct rb_root *root)
                 struct vm_area_struct *vma;
                 vma = rb_entry(nd, struct vm_area_struct, vm_rb);
                 if (vma->vm_start < prev) {
-                        pr_emerg("vm_start %lx prev %lx\n", vma->vm_start, prev);
+                        pr_emerg("vm_start %lx < prev %lx\n",
+                                  vma->vm_start, prev);
                         bug = 1;
                 }
                 if (vma->vm_start < pend) {
-                        pr_emerg("vm_start %lx pend %lx\n", vma->vm_start, pend);
+                        pr_emerg("vm_start %lx < pend %lx\n",
+                                  vma->vm_start, pend);
                         bug = 1;
                 }
                 if (vma->vm_start > vma->vm_end) {
-                        pr_emerg("vm_end %lx < vm_start %lx\n",
-                                vma->vm_end, vma->vm_start);
+                        pr_emerg("vm_start %lx > vm_end %lx\n",
+                                  vma->vm_start, vma->vm_end);
                         bug = 1;
                 }
                 if (vma->rb_subtree_gap != vma_compute_subtree_gap(vma)) {
@@ -409,8 +410,9 @@ static void validate_mm_rb(struct rb_root *root, struct vm_area_struct *ignore)
         for (nd = rb_first(root); nd; nd = rb_next(nd)) {
                 struct vm_area_struct *vma;
                 vma = rb_entry(nd, struct vm_area_struct, vm_rb);
-                BUG_ON(vma != ignore &&
-                       vma->rb_subtree_gap != vma_compute_subtree_gap(vma));
+                VM_BUG_ON_VMA(vma != ignore &&
+                        vma->rb_subtree_gap != vma_compute_subtree_gap(vma),
+                        vma);
         }
 }
 
@@ -420,8 +422,10 @@ static void validate_mm(struct mm_struct *mm)
         int i = 0;
         unsigned long highest_address = 0;
         struct vm_area_struct *vma = mm->mmap;
+
         while (vma) {
                 struct anon_vma_chain *avc;
+
                 vma_lock_anon_vma(vma);
                 list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
                         anon_vma_interval_tree_verify(avc);
@@ -436,15 +440,16 @@ static void validate_mm(struct mm_struct *mm)
         }
         if (highest_address != mm->highest_vm_end) {
                 pr_emerg("mm->highest_vm_end %lx, found %lx\n",
-                       mm->highest_vm_end, highest_address);
+                          mm->highest_vm_end, highest_address);
                 bug = 1;
         }
         i = browse_rb(&mm->mm_rb);
         if (i != mm->map_count) {
-                pr_emerg("map_count %d rb %d\n", mm->map_count, i);
+                if (i != -1)
+                        pr_emerg("map_count %d rb %d\n", mm->map_count, i);
                 bug = 1;
         }
-        BUG_ON(bug);
+        VM_BUG_ON_MM(bug, mm);
 }
 #else
 #define validate_mm_rb(root, ignore) do { } while (0)
@@ -741,7 +746,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                          * split_vma inserting another: so it must be
                          * mprotect case 4 shifting the boundary down.
                          */
-                        adjust_next = - ((vma->vm_end - end) >> PAGE_SHIFT);
+                        adjust_next = -((vma->vm_end - end) >> PAGE_SHIFT);
                         exporter = vma;
                         importer = next;
                 }
@@ -787,8 +792,8 @@ again:			remove_next = 1 + (end > next->vm_end);
         if (!anon_vma && adjust_next)
                 anon_vma = next->anon_vma;
         if (anon_vma) {
-                VM_BUG_ON(adjust_next && next->anon_vma &&
-                          anon_vma != next->anon_vma);
+                VM_BUG_ON_VMA(adjust_next && next->anon_vma &&
+                          anon_vma != next->anon_vma, next);
                 anon_vma_lock_write(anon_vma);
                 anon_vma_interval_tree_pre_update_vma(vma);
                 if (adjust_next)
@@ -1010,7 +1015,7 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
 struct vm_area_struct *vma_merge(struct mm_struct *mm,
                         struct vm_area_struct *prev, unsigned long addr,
                         unsigned long end, unsigned long vm_flags,
-                        struct anon_vma *anon_vma, struct file *file,
+                        struct anon_vma *anon_vma, struct file *file,
                         pgoff_t pgoff, struct mempolicy *policy)
 {
         pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
@@ -1036,7 +1041,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
          * Can it merge with the predecessor?
          */
         if (prev && prev->vm_end == addr &&
-                        mpol_equal(vma_policy(prev), policy) &&
+                        mpol_equal(vma_policy(prev), policy) &&
                         can_vma_merge_after(prev, vm_flags,
                                                 anon_vma, file, pgoff)) {
                 /*
@@ -1064,7 +1069,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
          * Can this new request be merged in front of next?
          */
         if (next && end == next->vm_start &&
-                        mpol_equal(policy, vma_policy(next)) &&
+                        mpol_equal(policy, vma_policy(next)) &&
                         can_vma_merge_before(next, vm_flags,
                                         anon_vma, file, pgoff+pglen)) {
                 if (prev && addr < prev->vm_end)        /* case 4 */
@@ -1235,7 +1240,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                         unsigned long flags, unsigned long pgoff,
                         unsigned long *populate)
 {
-        struct mm_struct * mm = current->mm;
+        struct mm_struct *mm = current->mm;
         vm_flags_t vm_flags;
 
         *populate = 0;
@@ -1263,7 +1268,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
 
         /* offset overflow? */
         if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
-               return -EOVERFLOW;
+                return -EOVERFLOW;
 
         /* Too many mappings? */
         if (mm->map_count > sysctl_max_map_count)
@@ -1921,7 +1926,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
         info.align_mask = 0;
         return vm_unmapped_area(&info);
 }
-#endif  
+#endif
 
 /*
  * This mmap-allocator allocates new areas top-down from below the
@@ -2321,13 +2326,13 @@ int expand_stack(struct vm_area_struct *vma, unsigned long address)
 }
 
 struct vm_area_struct *
-find_extend_vma(struct mm_struct * mm, unsigned long addr)
+find_extend_vma(struct mm_struct *mm, unsigned long addr)
 {
-        struct vm_area_struct * vma;
+        struct vm_area_struct *vma;
         unsigned long start;
 
         addr &= PAGE_MASK;
-        vma = find_vma(mm,addr);
+        vma = find_vma(mm, addr);
         if (!vma)
                 return NULL;
         if (vma->vm_start <= addr)
@@ -2376,7 +2381,7 @@ static void unmap_region(struct mm_struct *mm,
                 struct vm_area_struct *vma, struct vm_area_struct *prev,
                 unsigned long start, unsigned long end)
 {
-        struct vm_area_struct *next = prev? prev->vm_next: mm->mmap;
+        struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap;
         struct mmu_gather tlb;
 
         lru_add_drain();
@@ -2423,7 +2428,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  * __split_vma() bypasses sysctl_max_map_count checking.  We use this on the
  * munmap path where it doesn't make sense to fail.
  */
-static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
               unsigned long addr, int new_below)
 {
         struct vm_area_struct *new;
@@ -2512,7 +2517,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
         if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
                 return -EINVAL;
 
-        if ((len = PAGE_ALIGN(len)) == 0)
+        len = PAGE_ALIGN(len);
+        if (len == 0)
                 return -EINVAL;
 
         /* Find the first overlapping VMA */
@@ -2558,7 +2564,7 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
                 if (error)
                         return error;
         }
-        vma = prev? prev->vm_next: mm->mmap;
+        vma = prev ? prev->vm_next : mm->mmap;
 
         /*
          * unlock any mlock()ed ranges before detaching vmas
@@ -2621,10 +2627,10 @@ static inline void verify_mm_writelocked(struct mm_struct *mm)
  */
 static unsigned long do_brk(unsigned long addr, unsigned long len)
 {
-        struct mm_struct * mm = current->mm;
-        struct vm_area_struct * vma, * prev;
+        struct mm_struct *mm = current->mm;
+        struct vm_area_struct *vma, *prev;
         unsigned long flags;
-        struct rb_node ** rb_link, * rb_parent;
+        struct rb_node **rb_link, *rb_parent;
         pgoff_t pgoff = addr >> PAGE_SHIFT;
         int error;
 
@@ -2848,7 +2854,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
                          * safe. It is only safe to keep the vm_pgoff
                          * linear if there are no pages mapped yet.
                          */
-                        VM_BUG_ON(faulted_in_anon_vma);
+                        VM_BUG_ON_VMA(faulted_in_anon_vma, new_vma);
                         *vmap = vma = new_vma;
                 }
                 *need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff);
diff --git a/mm/mremap.c b/mm/mremap.c
index 05f1180e9f21..b147f66f4c40 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -21,8 +21,8 @@
 #include <linux/syscalls.h>
 #include <linux/mmu_notifier.h>
 #include <linux/sched/sysctl.h>
+#include <linux/uaccess.h>
 
-#include <asm/uaccess.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
 
@@ -195,7 +195,8 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
                 if (pmd_trans_huge(*old_pmd)) {
                         int err = 0;
                         if (extent == HPAGE_PMD_SIZE) {
-                                VM_BUG_ON(vma->vm_file || !vma->anon_vma);
+                                VM_BUG_ON_VMA(vma->vm_file || !vma->anon_vma,
+                                              vma);
                                 /* See comment in move_ptes() */
                                 if (need_rmap_locks)
                                         anon_vma_lock_write(vma->anon_vma);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 1e11df8fa7ec..bbf405a3a18f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -565,7 +565,7 @@ bool oom_zonelist_trylock(struct zonelist *zonelist, gfp_t gfp_mask)
 
         spin_lock(&zone_scan_lock);
         for_each_zone_zonelist(zone, z, zonelist, gfp_zone(gfp_mask))
-                if (zone_is_oom_locked(zone)) {
+                if (test_bit(ZONE_OOM_LOCKED, &zone->flags)) {
                         ret = false;
                         goto out;
                 }
@@ -575,7 +575,7 @@ bool oom_zonelist_trylock(struct zonelist *zonelist, gfp_t gfp_mask)
          * call to oom_zonelist_trylock() doesn't succeed when it shouldn't.
          */
         for_each_zone_zonelist(zone, z, zonelist, gfp_zone(gfp_mask))
-                zone_set_flag(zone, ZONE_OOM_LOCKED);
+                set_bit(ZONE_OOM_LOCKED, &zone->flags);
 
 out:
         spin_unlock(&zone_scan_lock);
@@ -594,7 +594,7 @@ void oom_zonelist_unlock(struct zonelist *zonelist, gfp_t gfp_mask)
 
         spin_lock(&zone_scan_lock);
         for_each_zone_zonelist(zone, z, zonelist, gfp_zone(gfp_mask))
-                zone_clear_flag(zone, ZONE_OOM_LOCKED);
+                clear_bit(ZONE_OOM_LOCKED, &zone->flags);
         spin_unlock(&zone_scan_lock);
 }
 
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 91d73ef1744d..35ca7102d421 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1075,13 +1075,13 @@ static void bdi_update_dirty_ratelimit(struct backing_dev_info *bdi,
         }
 
         if (dirty < setpoint) {
-                x = min(bdi->balanced_dirty_ratelimit,
-                         min(balanced_dirty_ratelimit, task_ratelimit));
+                x = min3(bdi->balanced_dirty_ratelimit,
+                         balanced_dirty_ratelimit, task_ratelimit);
                 if (dirty_ratelimit < x)
                         step = x - dirty_ratelimit;
         } else {
-                x = max(bdi->balanced_dirty_ratelimit,
-                         max(balanced_dirty_ratelimit, task_ratelimit));
+                x = max3(bdi->balanced_dirty_ratelimit,
+                         balanced_dirty_ratelimit, task_ratelimit);
                 if (dirty_ratelimit > x)
                         step = dirty_ratelimit - x;
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index eee961958021..c9710c9bbee2 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -53,8 +53,6 @@
 #include <linux/kmemleak.h>
 #include <linux/compaction.h>
 #include <trace/events/kmem.h>
-#include <linux/ftrace_event.h>
-#include <linux/memcontrol.h>
 #include <linux/prefetch.h>
 #include <linux/mm_inline.h>
 #include <linux/migrate.h>
@@ -85,6 +83,7 @@ EXPORT_PER_CPU_SYMBOL(numa_node);
  */
 DEFINE_PER_CPU(int, _numa_mem_);                /* Kernel "local memory" node */
 EXPORT_PER_CPU_SYMBOL(_numa_mem_);
+int _node_numa_mem_[MAX_NUMNODES];
 #endif
 
 /*
@@ -1014,7 +1013,7 @@ int move_freepages(struct zone *zone,
          * Remove at a later date when no bug reports exist related to
          * grouping pages by mobility
          */
-        BUG_ON(page_zone(start_page) != page_zone(end_page));
+        VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
 #endif
 
         for (page = start_page; page <= end_page;) {
@@ -1613,8 +1612,8 @@ again:
 
         __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
         if (atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]) <= 0 &&
-            !zone_is_fair_depleted(zone))
-                zone_set_flag(zone, ZONE_FAIR_DEPLETED);
+            !test_bit(ZONE_FAIR_DEPLETED, &zone->flags))
+                set_bit(ZONE_FAIR_DEPLETED, &zone->flags);
 
         __count_zone_vm_events(PGALLOC, zone, 1 << order);
         zone_statistics(preferred_zone, zone, gfp_flags);
@@ -1934,7 +1933,7 @@ static void reset_alloc_batches(struct zone *preferred_zone)
                 mod_zone_page_state(zone, NR_ALLOC_BATCH,
                         high_wmark_pages(zone) - low_wmark_pages(zone) -
                         atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]));
-                zone_clear_flag(zone, ZONE_FAIR_DEPLETED);
+                clear_bit(ZONE_FAIR_DEPLETED, &zone->flags);
         } while (zone++ != preferred_zone);
 }
 
@@ -1985,7 +1984,7 @@ zonelist_scan:
                 if (alloc_flags & ALLOC_FAIR) {
                         if (!zone_local(preferred_zone, zone))
                                 break;
-                        if (zone_is_fair_depleted(zone)) {
+                        if (test_bit(ZONE_FAIR_DEPLETED, &zone->flags)) {
                                 nr_fair_skipped++;
                                 continue;
                         }
@@ -2296,58 +2295,72 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
         int classzone_idx, int migratetype, enum migrate_mode mode,
-        bool *contended_compaction, bool *deferred_compaction,
-        unsigned long *did_some_progress)
+        int *contended_compaction, bool *deferred_compaction)
 {
-        if (!order)
-                return NULL;
+        struct zone *last_compact_zone = NULL;
+        unsigned long compact_result;
+        struct page *page;
 
-        if (compaction_deferred(preferred_zone, order)) {
-                *deferred_compaction = true;
+        if (!order)
                 return NULL;
-        }
 
         current->flags |= PF_MEMALLOC;
-        *did_some_progress = try_to_compact_pages(zonelist, order, gfp_mask,
+        compact_result = try_to_compact_pages(zonelist, order, gfp_mask,
                                                 nodemask, mode,
-                                                contended_compaction);
+                                                contended_compaction,
+                                                &last_compact_zone);
         current->flags &= ~PF_MEMALLOC;
 
-        if (*did_some_progress != COMPACT_SKIPPED) {
-                struct page *page;
+        switch (compact_result) {
+        case COMPACT_DEFERRED:
+                *deferred_compaction = true;
+                /* fall-through */
+        case COMPACT_SKIPPED:
+                return NULL;
+        default:
+                break;
+        }
 
-                /* Page migration frees to the PCP lists but we want merging */
-                drain_pages(get_cpu());
-                put_cpu();
+        /*
+         * At least in one zone compaction wasn't deferred or skipped, so let's
+         * count a compaction stall
+         */
+        count_vm_event(COMPACTSTALL);
 
-                page = get_page_from_freelist(gfp_mask, nodemask,
-                                order, zonelist, high_zoneidx,
-                                alloc_flags & ~ALLOC_NO_WATERMARKS,
-                                preferred_zone, classzone_idx, migratetype);
-                if (page) {
-                        preferred_zone->compact_blockskip_flush = false;
-                        compaction_defer_reset(preferred_zone, order, true);
-                        count_vm_event(COMPACTSUCCESS);
-                        return page;
-                }
+        /* Page migration frees to the PCP lists but we want merging */
+        drain_pages(get_cpu());
+        put_cpu();
 
-                /*
-                 * It's bad if compaction run occurs and fails.
-                 * The most likely reason is that pages exist,
-                 * but not enough to satisfy watermarks.
-                 */
-                count_vm_event(COMPACTFAIL);
+        page = get_page_from_freelist(gfp_mask, nodemask,
+                        order, zonelist, high_zoneidx,
+                        alloc_flags & ~ALLOC_NO_WATERMARKS,
+                        preferred_zone, classzone_idx, migratetype);
 
-                /*
-                 * As async compaction considers a subset of pageblocks, only
-                 * defer if the failure was a sync compaction failure.
-                 */
-                if (mode != MIGRATE_ASYNC)
-                        defer_compaction(preferred_zone, order);
+        if (page) {
+                struct zone *zone = page_zone(page);
 
-                cond_resched();
+                zone->compact_blockskip_flush = false;
+                compaction_defer_reset(zone, order, true);
+                count_vm_event(COMPACTSUCCESS);
+                return page;
         }
 
+        /*
+         * last_compact_zone is where try_to_compact_pages thought allocation
+         * should succeed, so it did not defer compaction. But here we know
+         * that it didn't succeed, so we do the defer.
+         */
+        if (last_compact_zone && mode != MIGRATE_ASYNC)
+                defer_compaction(last_compact_zone, order);
+
+        /*
+         * It's bad if compaction run occurs and fails. The most likely reason
+         * is that pages exist, but not enough to satisfy watermarks.
+         */
+        count_vm_event(COMPACTFAIL);
+
+        cond_resched();
+
         return NULL;
 }
 #else
@@ -2355,9 +2368,8 @@ static inline struct page *
 __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
-        int classzone_idx, int migratetype,
-        enum migrate_mode mode, bool *contended_compaction,
-        bool *deferred_compaction, unsigned long *did_some_progress)
+        int classzone_idx, int migratetype, enum migrate_mode mode,
+        int *contended_compaction, bool *deferred_compaction)
 {
         return NULL;
 }
@@ -2457,12 +2469,14 @@ __alloc_pages_high_priority(gfp_t gfp_mask, unsigned int order,
 static void wake_all_kswapds(unsigned int order,
                              struct zonelist *zonelist,
                              enum zone_type high_zoneidx,
-                             struct zone *preferred_zone)
+                             struct zone *preferred_zone,
+                             nodemask_t *nodemask)
 {
         struct zoneref *z;
         struct zone *zone;
 
-        for_each_zone_zonelist(zone, z, zonelist, high_zoneidx)
+        for_each_zone_zonelist_nodemask(zone, z, zonelist,
+                                                high_zoneidx, nodemask)
                 wakeup_kswapd(zone, order, zone_idx(preferred_zone));
 }
 
@@ -2509,7 +2523,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
                         alloc_flags |= ALLOC_NO_WATERMARKS;
         }
 #ifdef CONFIG_CMA
-        if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
+        if (gfpflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
                 alloc_flags |= ALLOC_CMA;
 #endif
         return alloc_flags;
@@ -2533,7 +2547,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
         unsigned long did_some_progress;
         enum migrate_mode migration_mode = MIGRATE_ASYNC;
         bool deferred_compaction = false;
-        bool contended_compaction = false;
+        int contended_compaction = COMPACT_CONTENDED_NONE;
 
         /*
          * In the slowpath, we sanity check order to avoid ever trying to
@@ -2560,7 +2574,8 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
 
 restart:
         if (!(gfp_mask & __GFP_NO_KSWAPD))
-                wake_all_kswapds(order, zonelist, high_zoneidx, preferred_zone);
+                wake_all_kswapds(order, zonelist, high_zoneidx,
+                                preferred_zone, nodemask);
 
         /*
          * OK, we're below the kswapd watermark and have kicked background
@@ -2633,20 +2648,40 @@ rebalance:
                                         preferred_zone,
                                         classzone_idx, migratetype,
                                         migration_mode, &contended_compaction,
-                                        &deferred_compaction,
-                                        &did_some_progress);
+                                        &deferred_compaction);
         if (page)
                 goto got_pg;
 
-        /*
-         * If compaction is deferred for high-order allocations, it is because
-         * sync compaction recently failed. In this is the case and the caller
-         * requested a movable allocation that does not heavily disrupt the
-         * system then fail the allocation instead of entering direct reclaim.
-         */
-        if ((deferred_compaction || contended_compaction) &&
-                                                (gfp_mask & __GFP_NO_KSWAPD))
-                goto nopage;
+        /* Checks for THP-specific high-order allocations */
+        if ((gfp_mask & GFP_TRANSHUGE) == GFP_TRANSHUGE) {
+                /*
+                 * If compaction is deferred for high-order allocations, it is
+                 * because sync compaction recently failed. If this is the case
+                 * and the caller requested a THP allocation, we do not want
+                 * to heavily disrupt the system, so we fail the allocation
+                 * instead of entering direct reclaim.
+                 */
+                if (deferred_compaction)
+                        goto nopage;
+
+                /*
+                 * In all zones where compaction was attempted (and not
+                 * deferred or skipped), lock contention has been detected.
+                 * For THP allocation we do not want to disrupt the others
+                 * so we fallback to base pages instead.
+                 */
+                if (contended_compaction == COMPACT_CONTENDED_LOCK)
+                        goto nopage;
+
+                /*
+                 * If compaction was aborted due to need_resched(), we do not
+                 * want to further increase allocation latency, unless it is
+                 * khugepaged trying to collapse.
+                 */
+                if (contended_compaction == COMPACT_CONTENDED_SCHED
+                        && !(current->flags & PF_KTHREAD))
+                        goto nopage;
+        }
 
         /*
          * It can become very expensive to allocate transparent hugepages at
@@ -2726,8 +2761,7 @@ rebalance:
                                         preferred_zone,
                                         classzone_idx, migratetype,
                                         migration_mode, &contended_compaction,
-                                        &deferred_compaction,
-                                        &did_some_progress);
+                                        &deferred_compaction);
                 if (page)
                         goto got_pg;
         }
@@ -2753,7 +2787,7 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
         struct zone *preferred_zone;
         struct zoneref *preferred_zoneref;
         struct page *page = NULL;
-        int migratetype = allocflags_to_migratetype(gfp_mask);
+        int migratetype = gfpflags_to_migratetype(gfp_mask);
         unsigned int cpuset_mems_cookie;
         int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET|ALLOC_FAIR;
         int classzone_idx;
@@ -2775,6 +2809,9 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
         if (unlikely(!zonelist->_zonerefs->zone))
                 return NULL;
 
+        if (IS_ENABLED(CONFIG_CMA) && migratetype == MIGRATE_MOVABLE)
+                alloc_flags |= ALLOC_CMA;
+
 retry_cpuset:
         cpuset_mems_cookie = read_mems_allowed_begin();
 
@@ -2786,10 +2823,6 @@ retry_cpuset:
                 goto out;
         classzone_idx = zonelist_zone_idx(preferred_zoneref);
 
-#ifdef CONFIG_CMA
-        if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
-                alloc_flags |= ALLOC_CMA;
-#endif
         /* First allocation attempt */
         page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order,
                         zonelist, high_zoneidx, alloc_flags,
@@ -3579,68 +3612,30 @@ static void build_zonelists_in_zone_order(pg_data_t *pgdat, int nr_nodes)
         zonelist->_zonerefs[pos].zone_idx = 0;
 }
 
+#if defined(CONFIG_64BIT)
+/*
+ * Devices that require DMA32/DMA are relatively rare and do not justify a
+ * penalty to every machine in case the specialised case applies. Default
+ * to Node-ordering on 64-bit NUMA machines
+ */
+static int default_zonelist_order(void)
+{
+        return ZONELIST_ORDER_NODE;
+}
+#else
+/*
+ * On 32-bit, the Normal zone needs to be preserved for allocations accessible
+ * by the kernel. If processes running on node 0 deplete the low memory zone
+ * then reclaim will occur more frequency increasing stalls and potentially
+ * be easier to OOM if a large percentage of the zone is under writeback or
+ * dirty. The problem is significantly worse if CONFIG_HIGHPTE is not set.
+ * Hence, default to zone ordering on 32-bit.
+ */
 static int default_zonelist_order(void)
 {
-        int nid, zone_type;
-        unsigned long low_kmem_size, total_size;
-        struct zone *z;
-        int average_size;
-        /*
-         * ZONE_DMA and ZONE_DMA32 can be very small area in the system.
-         * If they are really small and used heavily, the system can fall
-         * into OOM very easily.
-         * This function detect ZONE_DMA/DMA32 size and configures zone order.
-         */
-        /* Is there ZONE_NORMAL ? (ex. ppc has only DMA zone..) */
-        low_kmem_size = 0;
-        total_size = 0;
-        for_each_online_node(nid) {
-                for (zone_type = 0; zone_type < MAX_NR_ZONES; zone_type++) {
-                        z = &NODE_DATA(nid)->node_zones[zone_type];
-                        if (populated_zone(z)) {
-                                if (zone_type < ZONE_NORMAL)
-                                        low_kmem_size += z->managed_pages;
-                                total_size += z->managed_pages;
-                        } else if (zone_type == ZONE_NORMAL) {
-                                /*
-                                 * If any node has only lowmem, then node order
-                                 * is preferred to allow kernel allocations
-                                 * locally; otherwise, they can easily infringe
-                                 * on other nodes when there is an abundance of
-                                 * lowmem available to allocate from.
-                                 */
-                                return ZONELIST_ORDER_NODE;
-                        }
-                }
-        }
-        if (!low_kmem_size ||  /* there are no DMA area. */
-            low_kmem_size > total_size/2) /* DMA/DMA32 is big. */
-                return ZONELIST_ORDER_NODE;
-        /*
-         * look into each node's config.
-         * If there is a node whose DMA/DMA32 memory is very big area on
-         * local memory, NODE_ORDER may be suitable.
-         */
-        average_size = total_size /
-                                (nodes_weight(node_states[N_MEMORY]) + 1);
-        for_each_online_node(nid) {
-                low_kmem_size = 0;
-                total_size = 0;
-                for (zone_type = 0; zone_type < MAX_NR_ZONES; zone_type++) {
-                        z = &NODE_DATA(nid)->node_zones[zone_type];
-                        if (populated_zone(z)) {
-                                if (zone_type < ZONE_NORMAL)
-                                        low_kmem_size += z->present_pages;
-                                total_size += z->present_pages;
-                        }
-                }
-                if (low_kmem_size &&
-                    total_size > average_size && /* ignore small node */
-                    low_kmem_size > total_size * 70/100)
-                        return ZONELIST_ORDER_NODE;
-        }
         return ZONELIST_ORDER_ZONE;
 }
+#endif /* CONFIG_64BIT */
 
 static void set_zonelist_order(void)
 {
@@ -6277,8 +6272,7 @@ static int __alloc_contig_migrate_range(struct compact_control *cc,
 
                 if (list_empty(&cc->migratepages)) {
                         cc->nr_migratepages = 0;
-                        pfn = isolate_migratepages_range(cc->zone, cc,
-                                                         pfn, end, true);
+                        pfn = isolate_migratepages_range(cc, pfn, end);
                         if (!pfn) {
                                 ret = -EINTR;
                                 break;
@@ -6554,97 +6548,3 @@ bool is_free_buddy_page(struct page *page)
         return order < MAX_ORDER;
 }
 #endif
-
-static const struct trace_print_flags pageflag_names[] = {
-        {1UL << PG_locked,              "locked"        },
-        {1UL << PG_error,               "error"         },
-        {1UL << PG_referenced,          "referenced"    },
-        {1UL << PG_uptodate,            "uptodate"      },
-        {1UL << PG_dirty,               "dirty"         },
-        {1UL << PG_lru,                 "lru"           },
-        {1UL << PG_active,              "active"        },
-        {1UL << PG_slab,                "slab"          },
-        {1UL << PG_owner_priv_1,        "owner_priv_1"  },
-        {1UL << PG_arch_1,              "arch_1"        },
-        {1UL << PG_reserved,            "reserved"      },
-        {1UL << PG_private,             "private"       },
-        {1UL << PG_private_2,           "private_2"     },
-        {1UL << PG_writeback,           "writeback"     },
-#ifdef CONFIG_PAGEFLAGS_EXTENDED
-        {1UL << PG_head,                "head"          },
-        {1UL << PG_tail,                "tail"          },
-#else
-        {1UL << PG_compound,            "compound"      },
-#endif
-        {1UL << PG_swapcache,           "swapcache"     },
-        {1UL << PG_mappedtodisk,        "mappedtodisk"  },
-        {1UL << PG_reclaim,             "reclaim"       },
-        {1UL << PG_swapbacked,          "swapbacked"    },
-        {1UL << PG_unevictable,         "unevictable"   },
-#ifdef CONFIG_MMU
-        {1UL << PG_mlocked,             "mlocked"       },
-#endif
-#ifdef CONFIG_ARCH_USES_PG_UNCACHED
-        {1UL << PG_uncached,            "uncached"      },
-#endif
-#ifdef CONFIG_MEMORY_FAILURE
-        {1UL << PG_hwpoison,            "hwpoison"      },
-#endif
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-        {1UL << PG_compound_lock,       "compound_lock" },
-#endif
-};
-
-static void dump_page_flags(unsigned long flags)
-{
-        const char *delim = "";
-        unsigned long mask;
-        int i;
-
-        BUILD_BUG_ON(ARRAY_SIZE(pageflag_names) != __NR_PAGEFLAGS);
-
-        printk(KERN_ALERT "page flags: %#lx(", flags);
-
-        /* remove zone id */
-        flags &= (1UL << NR_PAGEFLAGS) - 1;
-
-        for (i = 0; i < ARRAY_SIZE(pageflag_names) && flags; i++) {
-
-                mask = pageflag_names[i].mask;
-                if ((flags & mask) != mask)
-                        continue;
-
-                flags &= ~mask;
-                printk("%s%s", delim, pageflag_names[i].name);
-                delim = "|";
-        }
-
-        /* check for left over flags */
-        if (flags)
-                printk("%s%#lx", delim, flags);
-
-        printk(")\n");
-}
-
-void dump_page_badflags(struct page *page, const char *reason,
-                unsigned long badflags)
-{
-        printk(KERN_ALERT
-               "page:%p count:%d mapcount:%d mapping:%p index:%#lx\n",
-                page, atomic_read(&page->_count), page_mapcount(page),
-                page->mapping, page->index);
-        dump_page_flags(page->flags);
-        if (reason)
-                pr_alert("page dumped because: %s\n", reason);
-        if (page->flags & badflags) {
-                pr_alert("bad because of flags:\n");
-                dump_page_flags(page->flags & badflags);
-        }
-        mem_cgroup_print_bad_page(page);
-}
-
-void dump_page(struct page *page, const char *reason)
-{
-        dump_page_badflags(page, reason, 0);
-}
-EXPORT_SYMBOL(dump_page);
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 2beeabf502c5..ad83195521f2 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -177,7 +177,7 @@ int walk_page_range(unsigned long addr, unsigned long end,
         if (!walk->mm)
                 return -EINVAL;
 
-        VM_BUG_ON(!rwsem_is_locked(&walk->mm->mmap_sem));
+        VM_BUG_ON_MM(!rwsem_is_locked(&walk->mm->mmap_sem), walk->mm);
 
         pgd = pgd_offset(walk->mm, addr);
         do {
diff --git a/mm/rmap.c b/mm/rmap.c
index bc74e0012809..116a5053415b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -527,7 +527,7 @@ vma_address(struct page *page, struct vm_area_struct *vma)
         unsigned long address = __vma_address(page, vma);
 
         /* page should be within @vma mapping range */
-        VM_BUG_ON(address < vma->vm_start || address >= vma->vm_end);
+        VM_BUG_ON_VMA(address < vma->vm_start || address >= vma->vm_end, vma);
 
         return address;
 }
@@ -897,7 +897,7 @@ void page_move_anon_rmap(struct page *page,
         struct anon_vma *anon_vma = vma->anon_vma;
 
         VM_BUG_ON_PAGE(!PageLocked(page), page);
-        VM_BUG_ON(!anon_vma);
+        VM_BUG_ON_VMA(!anon_vma, vma);
         VM_BUG_ON_PAGE(page->index != linear_page_index(vma, address), page);
 
         anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
@@ -1024,7 +1024,7 @@ void do_page_add_anon_rmap(struct page *page,
 void page_add_new_anon_rmap(struct page *page,
         struct vm_area_struct *vma, unsigned long address)
 {
-        VM_BUG_ON(address < vma->vm_start || address >= vma->vm_end);
+        VM_BUG_ON_VMA(address < vma->vm_start || address >= vma->vm_end, vma);
         SetPageSwapBacked(page);
         atomic_set(&page->_mapcount, 0); /* increment count (starts at -1) */
         if (PageTransHuge(page))
@@ -1670,7 +1670,7 @@ static int rmap_walk_file(struct page *page, struct rmap_walk_control *rwc)
          * structure at mapping cannot be freed and reused yet,
          * so we can safely take mapping->i_mmap_mutex.
          */
-        VM_BUG_ON(!PageLocked(page));
+        VM_BUG_ON_PAGE(!PageLocked(page), page);
 
         if (!mapping)
                 return ret;
diff --git a/mm/shmem.c b/mm/shmem.c
index 469f90d56051..4fad61bb41e5 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3077,7 +3077,9 @@ static const struct address_space_operations shmem_aops = {
         .write_begin    = shmem_write_begin,
         .write_end      = shmem_write_end,
 #endif
+#ifdef CONFIG_MIGRATION
         .migratepage    = migrate_page,
+#endif
         .error_remove_page = generic_error_remove_page,
 };
 
diff --git a/mm/slab.c b/mm/slab.c
index 7c52b3890d25..154aac8411c5 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -237,11 +237,10 @@ struct arraycache_init {
 /*
  * Need this for bootstrapping a per node allocator.
  */
-#define NUM_INIT_LISTS (3 * MAX_NUMNODES)
+#define NUM_INIT_LISTS (2 * MAX_NUMNODES)
 static struct kmem_cache_node __initdata init_kmem_cache_node[NUM_INIT_LISTS];
 #define CACHE_CACHE 0
-#define SIZE_AC MAX_NUMNODES
-#define SIZE_NODE (2 * MAX_NUMNODES)
+#define SIZE_NODE (MAX_NUMNODES)
 
 static int drain_freelist(struct kmem_cache *cache,
                         struct kmem_cache_node *n, int tofree);
@@ -253,7 +252,6 @@ static void cache_reap(struct work_struct *unused);
 
 static int slab_early_init = 1;
 
-#define INDEX_AC kmalloc_index(sizeof(struct arraycache_init))
 #define INDEX_NODE kmalloc_index(sizeof(struct kmem_cache_node))
 
 static void kmem_cache_node_init(struct kmem_cache_node *parent)
@@ -458,9 +456,6 @@ static inline unsigned int obj_to_index(const struct kmem_cache *cache,
         return reciprocal_divide(offset, cache->reciprocal_buffer_size);
 }
 
-static struct arraycache_init initarray_generic =
-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-
 /* internal cache of cache description objs */
 static struct kmem_cache kmem_cache_boot = {
         .batchcount = 1,
@@ -476,7 +471,7 @@ static DEFINE_PER_CPU(struct delayed_work, slab_reap_work);
 
 static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
 {
-        return cachep->array[smp_processor_id()];
+        return this_cpu_ptr(cachep->cpu_cache);
 }
 
 static size_t calculate_freelist_size(int nr_objs, size_t align)
@@ -785,8 +780,8 @@ static inline void *ac_get_obj(struct kmem_cache *cachep,
         return objp;
 }
 
-static void *__ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac,
-                                                                void *objp)
+static noinline void *__ac_put_obj(struct kmem_cache *cachep,
+                        struct array_cache *ac, void *objp)
 {
         if (unlikely(pfmemalloc_active)) {
                 /* Some pfmemalloc slabs exist, check if this is one */
@@ -984,46 +979,50 @@ static void drain_alien_cache(struct kmem_cache *cachep,
         }
 }
 
-static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
+static int __cache_free_alien(struct kmem_cache *cachep, void *objp,
+                                int node, int page_node)
 {
-        int nodeid = page_to_nid(virt_to_page(objp));
         struct kmem_cache_node *n;
         struct alien_cache *alien = NULL;
         struct array_cache *ac;
-        int node;
         LIST_HEAD(list);
 
-        node = numa_mem_id();
-
-        /*
-         * Make sure we are not freeing a object from another node to the array
-         * cache on this cpu.
-         */
-        if (likely(nodeid == node))
-                return 0;
-
         n = get_node(cachep, node);
         STATS_INC_NODEFREES(cachep);
-        if (n->alien && n->alien[nodeid]) {
-                alien = n->alien[nodeid];
+        if (n->alien && n->alien[page_node]) {
+                alien = n->alien[page_node];
                 ac = &alien->ac;
                 spin_lock(&alien->lock);
                 if (unlikely(ac->avail == ac->limit)) {
                         STATS_INC_ACOVERFLOW(cachep);
-                        __drain_alien_cache(cachep, ac, nodeid, &list);
+                        __drain_alien_cache(cachep, ac, page_node, &list);
                 }
                 ac_put_obj(cachep, ac, objp);
                 spin_unlock(&alien->lock);
                 slabs_destroy(cachep, &list);
         } else {
-                n = get_node(cachep, nodeid);
+                n = get_node(cachep, page_node);
                 spin_lock(&n->list_lock);
-                free_block(cachep, &objp, 1, nodeid, &list);
+                free_block(cachep, &objp, 1, page_node, &list);
                 spin_unlock(&n->list_lock);
                 slabs_destroy(cachep, &list);
         }
         return 1;
 }
+
+static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
+{
+        int page_node = page_to_nid(virt_to_page(objp));
+        int node = numa_mem_id();
+        /*
+         * Make sure we are not freeing a object from another node to the array
+         * cache on this cpu.
+         */
+        if (likely(node == page_node))
+                return 0;
+
+        return __cache_free_alien(cachep, objp, node, page_node);
+}
 #endif
 
 /*
@@ -1092,24 +1091,25 @@ static void cpuup_canceled(long cpu)
                 struct alien_cache **alien;
                 LIST_HEAD(list);
 
-                /* cpu is dead; no one can alloc from it. */
-                nc = cachep->array[cpu];
-                cachep->array[cpu] = NULL;
                 n = get_node(cachep, node);
-
                 if (!n)
-                        goto free_array_cache;
+                        continue;
 
                 spin_lock_irq(&n->list_lock);
 
                 /* Free limit for this kmem_cache_node */
                 n->free_limit -= cachep->batchcount;
-                if (nc)
+
+                /* cpu is dead; no one can alloc from it. */
+                nc = per_cpu_ptr(cachep->cpu_cache, cpu);
+                if (nc) {
                         free_block(cachep, nc->entry, nc->avail, node, &list);
+                        nc->avail = 0;
+                }
 
                 if (!cpumask_empty(mask)) {
                         spin_unlock_irq(&n->list_lock);
-                        goto free_array_cache;
+                        goto free_slab;
                 }
 
                 shared = n->shared;
@@ -1129,9 +1129,9 @@ static void cpuup_canceled(long cpu)
                         drain_alien_cache(cachep, alien);
                         free_alien_cache(alien);
                 }
-free_array_cache:
+
+free_slab:
                 slabs_destroy(cachep, &list);
-                kfree(nc);
         }
         /*
          * In the previous loop, all the objects were freed to
@@ -1168,32 +1168,23 @@ static int cpuup_prepare(long cpu)
          * array caches
          */
         list_for_each_entry(cachep, &slab_caches, list) {
-                struct array_cache *nc;
                 struct array_cache *shared = NULL;
                 struct alien_cache **alien = NULL;
 
-                nc = alloc_arraycache(node, cachep->limit,
-                                        cachep->batchcount, GFP_KERNEL);
-                if (!nc)
-                        goto bad;
                 if (cachep->shared) {
                         shared = alloc_arraycache(node,
                                 cachep->shared * cachep->batchcount,
                                 0xbaadf00d, GFP_KERNEL);
-                        if (!shared) {
-                                kfree(nc);
+                        if (!shared)
                                 goto bad;
-                        }
                 }
                 if (use_alien_caches) {
                         alien = alloc_alien_cache(node, cachep->limit, GFP_KERNEL);
                         if (!alien) {
                                 kfree(shared);
-                                kfree(nc);
                                 goto bad;
                         }
                 }
-                cachep->array[cpu] = nc;
                 n = get_node(cachep, node);
                 BUG_ON(!n);
 
@@ -1385,15 +1376,6 @@ static void __init set_up_node(struct kmem_cache *cachep, int index)
 }
 
 /*
- * The memory after the last cpu cache pointer is used for the
- * the node pointer.
- */
-static void setup_node_pointer(struct kmem_cache *cachep)
-{
-        cachep->node = (struct kmem_cache_node **)&cachep->array[nr_cpu_ids];
-}
-
-/*
  * Initialisation.  Called after the page allocator have been initialised and
  * before smp_init().
  */
@@ -1404,7 +1386,6 @@ void __init kmem_cache_init(void)
         BUILD_BUG_ON(sizeof(((struct page *)NULL)->lru) <
                                         sizeof(struct rcu_head));
         kmem_cache = &kmem_cache_boot;
-        setup_node_pointer(kmem_cache);
 
         if (num_possible_nodes() == 1)
                 use_alien_caches = 0;
@@ -1412,8 +1393,6 @@ void __init kmem_cache_init(void)
         for (i = 0; i < NUM_INIT_LISTS; i++)
                 kmem_cache_node_init(&init_kmem_cache_node[i]);
 
-        set_up_node(kmem_cache, CACHE_CACHE);
-
         /*
          * Fragmentation resistance on low memory - only use bigger
          * page orders on machines with more than 32MB of memory if
@@ -1448,49 +1427,22 @@ void __init kmem_cache_init(void)
          * struct kmem_cache size depends on nr_node_ids & nr_cpu_ids
          */
         create_boot_cache(kmem_cache, "kmem_cache",
-                offsetof(struct kmem_cache, array[nr_cpu_ids]) +
+                offsetof(struct kmem_cache, node) +
                                   nr_node_ids * sizeof(struct kmem_cache_node *),
                                   SLAB_HWCACHE_ALIGN);
         list_add(&kmem_cache->list, &slab_caches);
-
-        /* 2+3) create the kmalloc caches */
+        slab_state = PARTIAL;
 
         /*
-         * Initialize the caches that provide memory for the array cache and the
-         * kmem_cache_node structures first.  Without this, further allocations will
-         * bug.
+         * Initialize the caches that provide memory for the  kmem_cache_node
+         * structures first.  Without this, further allocations will bug.
          */
-
-        kmalloc_caches[INDEX_AC] = create_kmalloc_cache("kmalloc-ac",
-                                        kmalloc_size(INDEX_AC), ARCH_KMALLOC_FLAGS);
-
-        if (INDEX_AC != INDEX_NODE)
-                kmalloc_caches[INDEX_NODE] =
-                        create_kmalloc_cache("kmalloc-node",
+        kmalloc_caches[INDEX_NODE] = create_kmalloc_cache("kmalloc-node",
                                 kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS);
+        slab_state = PARTIAL_NODE;
 
         slab_early_init = 0;
 
-        /* 4) Replace the bootstrap head arrays */
-        {
-                struct array_cache *ptr;
-
-                ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT);
-
-                memcpy(ptr, cpu_cache_get(kmem_cache),
-                       sizeof(struct arraycache_init));
-
-                kmem_cache->array[smp_processor_id()] = ptr;
-
-                ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT);
-
-                BUG_ON(cpu_cache_get(kmalloc_caches[INDEX_AC])
-                       != &initarray_generic.cache);
-                memcpy(ptr, cpu_cache_get(kmalloc_caches[INDEX_AC]),
-                       sizeof(struct arraycache_init));
-
-                kmalloc_caches[INDEX_AC]->array[smp_processor_id()] = ptr;
-        }
         /* 5) Replace the bootstrap kmem_cache_node */
         {
                 int nid;
@@ -1498,13 +1450,8 @@ void __init kmem_cache_init(void)
                 for_each_online_node(nid) {
                         init_list(kmem_cache, &init_kmem_cache_node[CACHE_CACHE + nid], nid);
 
-                        init_list(kmalloc_caches[INDEX_AC],
-                                  &init_kmem_cache_node[SIZE_AC + nid], nid);
-
-                        if (INDEX_AC != INDEX_NODE) {
-                                init_list(kmalloc_caches[INDEX_NODE],
+                        init_list(kmalloc_caches[INDEX_NODE],
                                           &init_kmem_cache_node[SIZE_NODE + nid], nid);
-                        }
                 }
         }
 
@@ -2037,56 +1984,53 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
         return left_over;
 }
 
+static struct array_cache __percpu *alloc_kmem_cache_cpus(
+                struct kmem_cache *cachep, int entries, int batchcount)
+{
+        int cpu;
+        size_t size;
+        struct array_cache __percpu *cpu_cache;
+
+        size = sizeof(void *) * entries + sizeof(struct array_cache);
+        cpu_cache = __alloc_percpu(size, 0);
+
+        if (!cpu_cache)
+                return NULL;
+
+        for_each_possible_cpu(cpu) {
+                init_arraycache(per_cpu_ptr(cpu_cache, cpu),
+                                entries, batchcount);
+        }
+
+        return cpu_cache;
+}
+
 static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
 {
         if (slab_state >= FULL)
                 return enable_cpucache(cachep, gfp);
 
+        cachep->cpu_cache = alloc_kmem_cache_cpus(cachep, 1, 1);
+        if (!cachep->cpu_cache)
+                return 1;
+
         if (slab_state == DOWN) {
-                /*
-                 * Note: Creation of first cache (kmem_cache).
-                 * The setup_node is taken care
-                 * of by the caller of __kmem_cache_create
-                 */
-                cachep->array[smp_processor_id()] = &initarray_generic.cache;
-                slab_state = PARTIAL;
+                /* Creation of first cache (kmem_cache). */
+                set_up_node(kmem_cache, CACHE_CACHE);
         } else if (slab_state == PARTIAL) {
-                /*
-                 * Note: the second kmem_cache_create must create the cache
-                 * that's used by kmalloc(24), otherwise the creation of
-                 * further caches will BUG().
-                 */
-                cachep->array[smp_processor_id()] = &initarray_generic.cache;
-
-                /*
-                 * If the cache that's used by kmalloc(sizeof(kmem_cache_node)) is
-                 * the second cache, then we need to set up all its node/,
-                 * otherwise the creation of further caches will BUG().
-                 */
-                set_up_node(cachep, SIZE_AC);
-                if (INDEX_AC == INDEX_NODE)
-                        slab_state = PARTIAL_NODE;
-                else
-                        slab_state = PARTIAL_ARRAYCACHE;
+                /* For kmem_cache_node */
+                set_up_node(cachep, SIZE_NODE);
         } else {
-                /* Remaining boot caches */
-                cachep->array[smp_processor_id()] =
-                        kmalloc(sizeof(struct arraycache_init), gfp);
+                int node;
 
-                if (slab_state == PARTIAL_ARRAYCACHE) {
-                        set_up_node(cachep, SIZE_NODE);
-                        slab_state = PARTIAL_NODE;
-                } else {
-                        int node;
-                        for_each_online_node(node) {
-                                cachep->node[node] =
-                                    kmalloc_node(sizeof(struct kmem_cache_node),
-                                                gfp, node);
-                                BUG_ON(!cachep->node[node]);
-                                kmem_cache_node_init(cachep->node[node]);
-                        }
+                for_each_online_node(node) {
+                        cachep->node[node] = kmalloc_node(
+                                sizeof(struct kmem_cache_node), gfp, node);
+                        BUG_ON(!cachep->node[node]);
+                        kmem_cache_node_init(cachep->node[node]);
                 }
         }
+
         cachep->node[numa_mem_id()]->next_reap =
                         jiffies + REAPTIMEOUT_NODE +
                         ((unsigned long)cachep) % REAPTIMEOUT_NODE;
@@ -2100,6 +2044,32 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
         return 0;
 }
 
+unsigned long kmem_cache_flags(unsigned long object_size,
+        unsigned long flags, const char *name,
+        void (*ctor)(void *))
+{
+        return flags;
+}
+
+struct kmem_cache *
+__kmem_cache_alias(const char *name, size_t size, size_t align,
+                   unsigned long flags, void (*ctor)(void *))
+{
+        struct kmem_cache *cachep;
+
+        cachep = find_mergeable(size, align, flags, name, ctor);
+        if (cachep) {
+                cachep->refcount++;
+
+                /*
+                 * Adjust the object sizes so that we clear
+                 * the complete object on kzalloc.
+                 */
+                cachep->object_size = max_t(int, cachep->object_size, size);
+        }
+        return cachep;
+}
+
 /**
  * __kmem_cache_create - Create a cache.
  * @cachep: cache management descriptor
@@ -2183,7 +2153,6 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
         else
                 gfp = GFP_NOWAIT;
 
-        setup_node_pointer(cachep);
 #if DEBUG
 
         /*
@@ -2440,8 +2409,7 @@ int __kmem_cache_shutdown(struct kmem_cache *cachep)
         if (rc)
                 return rc;
 
-        for_each_online_cpu(i)
-            kfree(cachep->array[i]);
+        free_percpu(cachep->cpu_cache);
 
         /* NUMA: free the node structures */
         for_each_kmem_cache_node(cachep, i, n) {
@@ -3399,7 +3367,7 @@ static inline void __cache_free(struct kmem_cache *cachep, void *objp,
         if (nr_online_nodes > 1 && cache_free_alien(cachep, objp))
                 return;
 
-        if (likely(ac->avail < ac->limit)) {
+        if (ac->avail < ac->limit) {
                 STATS_INC_FREEHIT(cachep);
         } else {
                 STATS_INC_FREEMISS(cachep);
@@ -3496,7 +3464,6 @@ __do_kmalloc_node(size_t size, gfp_t flags, int node, unsigned long caller)
         return kmem_cache_alloc_node_trace(cachep, flags, node, size);
 }
 
-#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_TRACING)
 void *__kmalloc_node(size_t size, gfp_t flags, int node)
 {
         return __do_kmalloc_node(size, flags, node, _RET_IP_);
@@ -3509,13 +3476,6 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t flags,
         return __do_kmalloc_node(size, flags, node, caller);
 }
 EXPORT_SYMBOL(__kmalloc_node_track_caller);
-#else
-void *__kmalloc_node(size_t size, gfp_t flags, int node)
-{
-        return __do_kmalloc_node(size, flags, node, 0);
-}
-EXPORT_SYMBOL(__kmalloc_node);
-#endif /* CONFIG_DEBUG_SLAB || CONFIG_TRACING */
 #endif /* CONFIG_NUMA */
 
 /**
@@ -3541,8 +3501,6 @@ static __always_inline void *__do_kmalloc(size_t size, gfp_t flags,
         return ret;
 }
 
-
-#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_TRACING)
 void *__kmalloc(size_t size, gfp_t flags)
 {
         return __do_kmalloc(size, flags, _RET_IP_);
@@ -3555,14 +3513,6 @@ void *__kmalloc_track_caller(size_t size, gfp_t flags, unsigned long caller)
 }
 EXPORT_SYMBOL(__kmalloc_track_caller);
 
-#else
-void *__kmalloc(size_t size, gfp_t flags)
-{
-        return __do_kmalloc(size, flags, 0);
-}
-EXPORT_SYMBOL(__kmalloc);
-#endif
-
 /**
  * kmem_cache_free - Deallocate an object
  * @cachep: The cache the allocation was from.
@@ -3707,72 +3657,45 @@ fail:
         return -ENOMEM;
 }
 
-struct ccupdate_struct {
-        struct kmem_cache *cachep;
-        struct array_cache *new[0];
-};
-
-static void do_ccupdate_local(void *info)
-{
-        struct ccupdate_struct *new = info;
-        struct array_cache *old;
-
-        check_irq_off();
-        old = cpu_cache_get(new->cachep);
-
-        new->cachep->array[smp_processor_id()] = new->new[smp_processor_id()];
-        new->new[smp_processor_id()] = old;
-}
-
 /* Always called with the slab_mutex held */
 static int __do_tune_cpucache(struct kmem_cache *cachep, int limit,
                                 int batchcount, int shared, gfp_t gfp)
 {
-        struct ccupdate_struct *new;
-        int i;
+        struct array_cache __percpu *cpu_cache, *prev;
+        int cpu;
 
-        new = kzalloc(sizeof(*new) + nr_cpu_ids * sizeof(struct array_cache *),
-                      gfp);
-        if (!new)
+        cpu_cache = alloc_kmem_cache_cpus(cachep, limit, batchcount);
+        if (!cpu_cache)
                 return -ENOMEM;
 
-        for_each_online_cpu(i) {
-                new->new[i] = alloc_arraycache(cpu_to_mem(i), limit,
-                                                batchcount, gfp);
-                if (!new->new[i]) {
-                        for (i--; i >= 0; i--)
-                                kfree(new->new[i]);
-                        kfree(new);
-                        return -ENOMEM;
-                }
-        }
-        new->cachep = cachep;
-
-        on_each_cpu(do_ccupdate_local, (void *)new, 1);
+        prev = cachep->cpu_cache;
+        cachep->cpu_cache = cpu_cache;
+        kick_all_cpus_sync();
 
         check_irq_on();
         cachep->batchcount = batchcount;
         cachep->limit = limit;
         cachep->shared = shared;
 
-        for_each_online_cpu(i) {
+        if (!prev)
+                goto alloc_node;
+
+        for_each_online_cpu(cpu) {
                 LIST_HEAD(list);
-                struct array_cache *ccold = new->new[i];
                 int node;
                 struct kmem_cache_node *n;
+                struct array_cache *ac = per_cpu_ptr(prev, cpu);
 
-                if (!ccold)
-                        continue;
-
-                node = cpu_to_mem(i);
+                node = cpu_to_mem(cpu);
                 n = get_node(cachep, node);
                 spin_lock_irq(&n->list_lock);
-                free_block(cachep, ccold->entry, ccold->avail, node, &list);
+                free_block(cachep, ac->entry, ac->avail, node, &list);
                 spin_unlock_irq(&n->list_lock);
                 slabs_destroy(cachep, &list);
-                kfree(ccold);
         }
-        kfree(new);
+        free_percpu(prev);
+
+alloc_node:
         return alloc_kmem_cache_node(cachep, gfp);
 }
 
@@ -4255,19 +4178,15 @@ static const struct seq_operations slabstats_op = {
 
 static int slabstats_open(struct inode *inode, struct file *file)
 {
-        unsigned long *n = kzalloc(PAGE_SIZE, GFP_KERNEL);
-        int ret = -ENOMEM;
-        if (n) {
-                ret = seq_open(file, &slabstats_op);
-                if (!ret) {
-                        struct seq_file *m = file->private_data;
-                        *n = PAGE_SIZE / (2 * sizeof(unsigned long));
-                        m->private = n;
-                        n = NULL;
-                }
-                kfree(n);
-        }
-        return ret;
+        unsigned long *n;
+
+        n = __seq_open_private(file, &slabstats_op, PAGE_SIZE);
+        if (!n)
+                return -ENOMEM;
+
+        *n = PAGE_SIZE / (2 * sizeof(unsigned long));
+
+        return 0;
 }
 
 static const struct file_operations proc_slabstats_operations = {
diff --git a/mm/slab.h b/mm/slab.h
index 0e0fdd365840..ab019e63e3c2 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -4,6 +4,41 @@
  * Internal slab definitions
  */
 
+#ifdef CONFIG_SLOB
+/*
+ * Common fields provided in kmem_cache by all slab allocators
+ * This struct is either used directly by the allocator (SLOB)
+ * or the allocator must include definitions for all fields
+ * provided in kmem_cache_common in their definition of kmem_cache.
+ *
+ * Once we can do anonymous structs (C11 standard) we could put a
+ * anonymous struct definition in these allocators so that the
+ * separate allocations in the kmem_cache structure of SLAB and
+ * SLUB is no longer needed.
+ */
+struct kmem_cache {
+        unsigned int object_size;/* The original size of the object */
+        unsigned int size;      /* The aligned/padded/added on size  */
+        unsigned int align;     /* Alignment as calculated */
+        unsigned long flags;    /* Active flags on the slab */
+        const char *name;       /* Slab name for sysfs */
+        int refcount;           /* Use counter */
+        void (*ctor)(void *);   /* Called on object slot creation */
+        struct list_head list;  /* List of all slab caches on the system */
+};
+
+#endif /* CONFIG_SLOB */
+
+#ifdef CONFIG_SLAB
+#include <linux/slab_def.h>
+#endif
+
+#ifdef CONFIG_SLUB
+#include <linux/slub_def.h>
+#endif
+
+#include <linux/memcontrol.h>
+
 /*
  * State of the slab allocator.
  *
@@ -15,7 +50,6 @@
 enum slab_state {
         DOWN,                   /* No slab functionality yet */
         PARTIAL,                /* SLUB: kmem_cache_node available */
-        PARTIAL_ARRAYCACHE,     /* SLAB: kmalloc size for arraycache available */
         PARTIAL_NODE,           /* SLAB: kmalloc size for node struct available */
         UP,                     /* Slab caches usable but not all extras yet */
         FULL                    /* Everything is working */
@@ -53,15 +87,30 @@ extern void create_boot_cache(struct kmem_cache *, const char *name,
                         size_t size, unsigned long flags);
 
 struct mem_cgroup;
-#ifdef CONFIG_SLUB
+
+int slab_unmergeable(struct kmem_cache *s);
+struct kmem_cache *find_mergeable(size_t size, size_t align,
+                unsigned long flags, const char *name, void (*ctor)(void *));
+#ifndef CONFIG_SLOB
 struct kmem_cache *
 __kmem_cache_alias(const char *name, size_t size, size_t align,
                    unsigned long flags, void (*ctor)(void *));
+
+unsigned long kmem_cache_flags(unsigned long object_size,
+        unsigned long flags, const char *name,
+        void (*ctor)(void *));
 #else
 static inline struct kmem_cache *
 __kmem_cache_alias(const char *name, size_t size, size_t align,
                    unsigned long flags, void (*ctor)(void *))
 { return NULL; }
+
+static inline unsigned long kmem_cache_flags(unsigned long object_size,
+        unsigned long flags, const char *name,
+        void (*ctor)(void *))
+{
+        return flags;
+}
 #endif
 
 
@@ -303,8 +352,8 @@ static inline struct kmem_cache_node *get_node(struct kmem_cache *s, int node)
  * a kmem_cache_node structure allocated (which is true for all online nodes)
  */
 #define for_each_kmem_cache_node(__s, __node, __n) \
-        for (__node = 0; __n = get_node(__s, __node), __node < nr_node_ids; __node++) \
-                 if (__n)
+        for (__node = 0; __node < nr_node_ids; __node++) \
+                 if ((__n = get_node(__s, __node)))
 
 #endif
 
diff --git a/mm/slab_common.c b/mm/slab_common.c
index d319502b2403..3a6e0cfdf03a 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -30,6 +30,43 @@ LIST_HEAD(slab_caches);
 DEFINE_MUTEX(slab_mutex);
 struct kmem_cache *kmem_cache;
 
+/*
+ * Set of flags that will prevent slab merging
+ */
+#define SLAB_NEVER_MERGE (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER | \
+                SLAB_TRACE | SLAB_DESTROY_BY_RCU | SLAB_NOLEAKTRACE | \
+                SLAB_FAILSLAB)
+
+#define SLAB_MERGE_SAME (SLAB_DEBUG_FREE | SLAB_RECLAIM_ACCOUNT | \
+                SLAB_CACHE_DMA | SLAB_NOTRACK)
+
+/*
+ * Merge control. If this is set then no merging of slab caches will occur.
+ * (Could be removed. This was introduced to pacify the merge skeptics.)
+ */
+static int slab_nomerge;
+
+static int __init setup_slab_nomerge(char *str)
+{
+        slab_nomerge = 1;
+        return 1;
+}
+
+#ifdef CONFIG_SLUB
+__setup_param("slub_nomerge", slub_nomerge, setup_slab_nomerge, 0);
+#endif
+
+__setup("slab_nomerge", setup_slab_nomerge);
+
+/*
+ * Determine the size of a slab object
+ */
+unsigned int kmem_cache_size(struct kmem_cache *s)
+{
+        return s->object_size;
+}
+EXPORT_SYMBOL(kmem_cache_size);
+
 #ifdef CONFIG_DEBUG_VM
 static int kmem_cache_sanity_check(const char *name, size_t size)
 {
@@ -79,6 +116,65 @@ static inline int kmem_cache_sanity_check(const char *name, size_t size)
 #endif
 
 #ifdef CONFIG_MEMCG_KMEM
+static int memcg_alloc_cache_params(struct mem_cgroup *memcg,
+                struct kmem_cache *s, struct kmem_cache *root_cache)
+{
+        size_t size;
+
+        if (!memcg_kmem_enabled())
+                return 0;
+
+        if (!memcg) {
+                size = offsetof(struct memcg_cache_params, memcg_caches);
+                size += memcg_limited_groups_array_size * sizeof(void *);
+        } else
+                size = sizeof(struct memcg_cache_params);
+
+        s->memcg_params = kzalloc(size, GFP_KERNEL);
+        if (!s->memcg_params)
+                return -ENOMEM;
+
+        if (memcg) {
+                s->memcg_params->memcg = memcg;
+                s->memcg_params->root_cache = root_cache;
+        } else
+                s->memcg_params->is_root_cache = true;
+
+        return 0;
+}
+
+static void memcg_free_cache_params(struct kmem_cache *s)
+{
+        kfree(s->memcg_params);
+}
+
+static int memcg_update_cache_params(struct kmem_cache *s, int num_memcgs)
+{
+        int size;
+        struct memcg_cache_params *new_params, *cur_params;
+
+        BUG_ON(!is_root_cache(s));
+
+        size = offsetof(struct memcg_cache_params, memcg_caches);
+        size += num_memcgs * sizeof(void *);
+
+        new_params = kzalloc(size, GFP_KERNEL);
+        if (!new_params)
+                return -ENOMEM;
+
+        cur_params = s->memcg_params;
+        memcpy(new_params->memcg_caches, cur_params->memcg_caches,
+               memcg_limited_groups_array_size * sizeof(void *));
+
+        new_params->is_root_cache = true;
+
+        rcu_assign_pointer(s->memcg_params, new_params);
+        if (cur_params)
+                kfree_rcu(cur_params, rcu_head);
+
+        return 0;
+}
+
 int memcg_update_all_caches(int num_memcgs)
 {
         struct kmem_cache *s;
@@ -89,9 +185,8 @@ int memcg_update_all_caches(int num_memcgs)
                 if (!is_root_cache(s))
                         continue;
 
-                ret = memcg_update_cache_size(s, num_memcgs);
+                ret = memcg_update_cache_params(s, num_memcgs);
                 /*
-                 * See comment in memcontrol.c, memcg_update_cache_size:
                  * Instead of freeing the memory, we'll just leave the caches
                  * up to this point in an updated state.
                  */
@@ -104,7 +199,80 @@ out:
         mutex_unlock(&slab_mutex);
         return ret;
 }
-#endif
+#else
+static inline int memcg_alloc_cache_params(struct mem_cgroup *memcg,
+                struct kmem_cache *s, struct kmem_cache *root_cache)
+{
+        return 0;
+}
+
+static inline void memcg_free_cache_params(struct kmem_cache *s)
+{
+}
+#endif /* CONFIG_MEMCG_KMEM */
+
+/*
+ * Find a mergeable slab cache
+ */
+int slab_unmergeable(struct kmem_cache *s)
+{
+        if (slab_nomerge || (s->flags & SLAB_NEVER_MERGE))
+                return 1;
+
+        if (!is_root_cache(s))
+                return 1;
+
+        if (s->ctor)
+                return 1;
+
+        /*
+         * We may have set a slab to be unmergeable during bootstrap.
+         */
+        if (s->refcount < 0)
+                return 1;
+
+        return 0;
+}
+
+struct kmem_cache *find_mergeable(size_t size, size_t align,
+                unsigned long flags, const char *name, void (*ctor)(void *))
+{
+        struct kmem_cache *s;
+
+        if (slab_nomerge || (flags & SLAB_NEVER_MERGE))
+                return NULL;
+
+        if (ctor)
+                return NULL;
+
+        size = ALIGN(size, sizeof(void *));
+        align = calculate_alignment(flags, align, size);
+        size = ALIGN(size, align);
+        flags = kmem_cache_flags(size, flags, name, NULL);
+
+        list_for_each_entry(s, &slab_caches, list) {
+                if (slab_unmergeable(s))
+                        continue;
+
+                if (size > s->size)
+                        continue;
+
+                if ((flags & SLAB_MERGE_SAME) != (s->flags & SLAB_MERGE_SAME))
+                        continue;
+                /*
+                 * Check if alignment is compatible.
+                 * Courtesy of Adrian Drzewiecki
+                 */
+                if ((s->size & ~(align - 1)) != s->size)
+                        continue;
+
+                if (s->size - size >= sizeof(void *))
+                        continue;
+
+                return s;
+        }
+        return NULL;
+}
 
 /*
  * Figure out what the alignment of the objects will be given a set of
@@ -211,8 +379,10 @@ kmem_cache_create(const char *name, size_t size, size_t align,
         mutex_lock(&slab_mutex);
 
         err = kmem_cache_sanity_check(name, size);
-        if (err)
+        if (err) {
+                s = NULL;       /* suppress uninit var warning */
                 goto out_unlock;
+        }
 
         /*
          * Some allocators will constraint the set of valid flags to a subset
diff --git a/mm/slob.c b/mm/slob.c
index 21980e0f39a8..96a86206a26b 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -468,7 +468,6 @@ void *__kmalloc(size_t size, gfp_t gfp)
 }
 EXPORT_SYMBOL(__kmalloc);
 
-#ifdef CONFIG_TRACING
 void *__kmalloc_track_caller(size_t size, gfp_t gfp, unsigned long caller)
 {
         return __do_kmalloc_node(size, gfp, NUMA_NO_NODE, caller);
@@ -481,7 +480,6 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfp,
         return __do_kmalloc_node(size, gfp, node, caller);
 }
 #endif
-#endif
 
 void kfree(const void *block)
 {
diff --git a/mm/slub.c b/mm/slub.c
index 3e8afcc07a76..ae7b9f1ad394 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -169,16 +169,6 @@ static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s)
  */
 #define DEBUG_METADATA_FLAGS (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER)
 
-/*
- * Set of flags that will prevent slab merging
- */
-#define SLUB_NEVER_MERGE (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER | \
-                SLAB_TRACE | SLAB_DESTROY_BY_RCU | SLAB_NOLEAKTRACE | \
-                SLAB_FAILSLAB)
-
-#define SLUB_MERGE_SAME (SLAB_DEBUG_FREE | SLAB_RECLAIM_ACCOUNT | \
-                SLAB_CACHE_DMA | SLAB_NOTRACK)
-
 #define OO_SHIFT        16
 #define OO_MASK         ((1 << OO_SHIFT) - 1)
 #define MAX_OBJS_PER_PAGE       32767 /* since page.objects is u15 */
@@ -1176,7 +1166,7 @@ out:
 
 __setup("slub_debug", setup_slub_debug);
 
-static unsigned long kmem_cache_flags(unsigned long object_size,
+unsigned long kmem_cache_flags(unsigned long object_size,
         unsigned long flags, const char *name,
         void (*ctor)(void *))
 {
@@ -1208,7 +1198,7 @@ static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n,
                                         struct page *page) {}
 static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n,
                                         struct page *page) {}
-static inline unsigned long kmem_cache_flags(unsigned long object_size,
+unsigned long kmem_cache_flags(unsigned long object_size,
         unsigned long flags, const char *name,
         void (*ctor)(void *))
 {
@@ -1699,7 +1689,12 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
                 struct kmem_cache_cpu *c)
 {
         void *object;
-        int searchnode = (node == NUMA_NO_NODE) ? numa_mem_id() : node;
+        int searchnode = node;
+
+        if (node == NUMA_NO_NODE)
+                searchnode = numa_mem_id();
+        else if (!node_present_pages(node))
+                searchnode = node_to_mem_node(node);
 
         object = get_partial_node(s, get_node(s, searchnode), c, flags);
         if (object || node != NUMA_NO_NODE)
@@ -2280,11 +2275,18 @@ static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
 redo:
 
         if (unlikely(!node_match(page, node))) {
-                stat(s, ALLOC_NODE_MISMATCH);
-                deactivate_slab(s, page, c->freelist);
-                c->page = NULL;
-                c->freelist = NULL;
-                goto new_slab;
+                int searchnode = node;
+
+                if (node != NUMA_NO_NODE && !node_present_pages(node))
+                        searchnode = node_to_mem_node(node);
+
+                if (unlikely(!node_match(page, searchnode))) {
+                        stat(s, ALLOC_NODE_MISMATCH);
+                        deactivate_slab(s, page, c->freelist);
+                        c->page = NULL;
+                        c->freelist = NULL;
+                        goto new_slab;
+                }
         }
 
         /*
@@ -2707,12 +2709,6 @@ static int slub_max_order = PAGE_ALLOC_COSTLY_ORDER;
 static int slub_min_objects;
 
 /*
- * Merge control. If this is set then no merging of slab caches will occur.
- * (Could be removed. This was introduced to pacify the merge skeptics.)
- */
-static int slub_nomerge;
-
-/*
  * Calculate the order of allocation given an slab object size.
  *
  * The order of allocation has significant impact on performance and other
@@ -3240,14 +3236,6 @@ static int __init setup_slub_min_objects(char *str)
 
 __setup("slub_min_objects=", setup_slub_min_objects);
 
-static int __init setup_slub_nomerge(char *str)
-{
-        slub_nomerge = 1;
-        return 1;
-}
-
-__setup("slub_nomerge", setup_slub_nomerge);
-
 void *__kmalloc(size_t size, gfp_t flags)
 {
         struct kmem_cache *s;
@@ -3625,69 +3613,6 @@ void __init kmem_cache_init_late(void)
 {
 }
 
-/*
- * Find a mergeable slab cache
- */
-static int slab_unmergeable(struct kmem_cache *s)
-{
-        if (slub_nomerge || (s->flags & SLUB_NEVER_MERGE))
-                return 1;
-
-        if (!is_root_cache(s))
-                return 1;
-
-        if (s->ctor)
-                return 1;
-
-        /*
-         * We may have set a slab to be unmergeable during bootstrap.
-         */
-        if (s->refcount < 0)
-                return 1;
-
-        return 0;
-}
-
-static struct kmem_cache *find_mergeable(size_t size, size_t align,
-                unsigned long flags, const char *name, void (*ctor)(void *))
-{
-        struct kmem_cache *s;
-
-        if (slub_nomerge || (flags & SLUB_NEVER_MERGE))
-                return NULL;
-
-        if (ctor)
-                return NULL;
-
-        size = ALIGN(size, sizeof(void *));
-        align = calculate_alignment(flags, align, size);
-        size = ALIGN(size, align);
-        flags = kmem_cache_flags(size, flags, name, NULL);
-
-        list_for_each_entry(s, &slab_caches, list) {
-                if (slab_unmergeable(s))
-                        continue;
-
-                if (size > s->size)
-                        continue;
-
-                if ((flags & SLUB_MERGE_SAME) != (s->flags & SLUB_MERGE_SAME))
-                        continue;
-                /*
-                 * Check if alignment is compatible.
-                 * Courtesy of Adrian Drzewiecki
-                 */
-                if ((s->size & ~(align - 1)) != s->size)
-                        continue;
-
-                if (s->size - size >= sizeof(void *))
-                        continue;
-
-                return s;
-        }
-        return NULL;
-}
-
 struct kmem_cache *
 __kmem_cache_alias(const char *name, size_t size, size_t align,
                    unsigned long flags, void (*ctor)(void *))
@@ -4604,6 +4529,14 @@ static ssize_t trace_show(struct kmem_cache *s, char *buf)
 static ssize_t trace_store(struct kmem_cache *s, const char *buf,
                                                         size_t length)
 {
+        /*
+         * Tracing a merged cache is going to give confusing results
+         * as well as cause other issues like converting a mergeable
+         * cache into an umergeable one.
+         */
+        if (s->refcount > 1)
+                return -EINVAL;
+
         s->flags &= ~SLAB_TRACE;
         if (buf[0] == '1') {
                 s->flags &= ~__CMPXCHG_DOUBLE;
@@ -4721,6 +4654,9 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
 static ssize_t failslab_store(struct kmem_cache *s, const char *buf,
                                                         size_t length)
 {
+        if (s->refcount > 1)
+                return -EINVAL;
+
         s->flags &= ~SLAB_FAILSLAB;
         if (buf[0] == '1')
                 s->flags |= SLAB_FAILSLAB;
diff --git a/mm/swap.c b/mm/swap.c
index 6b2dc3897cd5..8a12b33936b4 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -887,18 +887,14 @@ void lru_add_drain_all(void)
         mutex_unlock(&lock);
 }
 
-/*
- * Batched page_cache_release().  Decrement the reference count on all the
- * passed pages.  If it fell to zero then remove the page from the LRU and
- * free it.
- *
- * Avoid taking zone->lru_lock if possible, but if it is taken, retain it
- * for the remainder of the operation.
+/**
+ * release_pages - batched page_cache_release()
+ * @pages: array of pages to release
+ * @nr: number of pages
+ * @cold: whether the pages are cache cold
  *
- * The locking in this function is against shrink_inactive_list(): we recheck
- * the page count inside the lock to see whether shrink_inactive_list()
- * grabbed the page via the LRU.  If it did, give up: shrink_inactive_list()
- * will free it.
+ * Decrement the reference count on all the pages in @pages.  If it
+ * fell to zero, remove the page from the LRU and free it.
  */
 void release_pages(struct page **pages, int nr, bool cold)
 {
@@ -907,6 +903,7 @@ void release_pages(struct page **pages, int nr, bool cold)
         struct zone *zone = NULL;
         struct lruvec *lruvec;
         unsigned long uninitialized_var(flags);
+        unsigned int uninitialized_var(lock_batch);
 
         for (i = 0; i < nr; i++) {
                 struct page *page = pages[i];
@@ -920,6 +917,16 @@ void release_pages(struct page **pages, int nr, bool cold)
                         continue;
                 }
 
+                /*
+                 * Make sure the IRQ-safe lock-holding time does not get
+                 * excessive with a continuous string of pages from the
+                 * same zone. The lock is held only if zone != NULL.
+                 */
+                if (zone && ++lock_batch == SWAP_CLUSTER_MAX) {
+                        spin_unlock_irqrestore(&zone->lru_lock, flags);
+                        zone = NULL;
+                }
+
                 if (!put_page_testzero(page))
                         continue;
 
@@ -930,6 +937,7 @@ void release_pages(struct page **pages, int nr, bool cold)
                                 if (zone)
                                         spin_unlock_irqrestore(&zone->lru_lock,
                                                                         flags);
+                                lock_batch = 0;
                                 zone = pagezone;
                                 spin_lock_irqsave(&zone->lru_lock, flags);
                         }
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 3e0ec83d000c..154444918685 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -28,7 +28,9 @@
 static const struct address_space_operations swap_aops = {
         .writepage      = swap_writepage,
         .set_page_dirty = swap_set_page_dirty,
+#ifdef CONFIG_MIGRATION
         .migratepage    = migrate_page,
+#endif
 };
 
 static struct backing_dev_info swap_backing_dev_info = {
@@ -263,18 +265,12 @@ void free_page_and_swap_cache(struct page *page)
 void free_pages_and_swap_cache(struct page **pages, int nr)
 {
         struct page **pagep = pages;
+        int i;
 
         lru_add_drain();
-        while (nr) {
-                int todo = min(nr, PAGEVEC_SIZE);
-                int i;
-
-                for (i = 0; i < todo; i++)
-                        free_swap_cache(pagep[i]);
-                release_pages(pagep, todo, false);
-                pagep += todo;
-                nr -= todo;
-        }
+        for (i = 0; i < nr; i++)
+                free_swap_cache(pagep[i]);
+        release_pages(pagep, nr, false);
 }
 
 /*
diff --git a/mm/util.c b/mm/util.c
index 093c973f1697..fec39d4509a9 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -170,32 +170,25 @@ static int vm_is_stack_for_task(struct task_struct *t,
 /*
  * Check if the vma is being used as a stack.
  * If is_group is non-zero, check in the entire thread group or else
- * just check in the current task. Returns the pid of the task that
- * the vma is stack for.
+ * just check in the current task. Returns the task_struct of the task
+ * that the vma is stack for. Must be called under rcu_read_lock().
  */
-pid_t vm_is_stack(struct task_struct *task,
-                  struct vm_area_struct *vma, int in_group)
+struct task_struct *task_of_stack(struct task_struct *task,
+                                struct vm_area_struct *vma, bool in_group)
 {
-        pid_t ret = 0;
-
         if (vm_is_stack_for_task(task, vma))
-                return task->pid;
+                return task;
 
         if (in_group) {
                 struct task_struct *t;
 
-                rcu_read_lock();
                 for_each_thread(task, t) {
-                        if (vm_is_stack_for_task(t, vma)) {
-                                ret = t->pid;
-                                goto done;
-                        }
+                        if (vm_is_stack_for_task(t, vma))
+                                return t;
                 }
-done:
-                rcu_read_unlock();
         }
 
-        return ret;
+        return NULL;
 }
 
 #if defined(CONFIG_MMU) && !defined(HAVE_ARCH_PICK_MMAP_LAYOUT)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 2b0aa5486092..90520af7f186 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2646,21 +2646,11 @@ static const struct seq_operations vmalloc_op = {
 
 static int vmalloc_open(struct inode *inode, struct file *file)
 {
-        unsigned int *ptr = NULL;
-        int ret;
-
-        if (IS_ENABLED(CONFIG_NUMA)) {
-                ptr = kmalloc(nr_node_ids * sizeof(unsigned int), GFP_KERNEL);
-                if (ptr == NULL)
-                        return -ENOMEM;
-        }
-        ret = seq_open(file, &vmalloc_op);
-        if (!ret) {
-                struct seq_file *m = file->private_data;
-                m->private = ptr;
-        } else
-                kfree(ptr);
-        return ret;
+        if (IS_ENABLED(CONFIG_NUMA))
+                return seq_open_private(file, &vmalloc_op,
+                                        nr_node_ids * sizeof(unsigned int));
+        else
+                return seq_open(file, &vmalloc_op);
 }
 
 static const struct file_operations proc_vmalloc_operations = {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2836b5373b2e..dcb47074ae03 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -920,7 +920,7 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                         /* Case 1 above */
                         if (current_is_kswapd() &&
                             PageReclaim(page) &&
-                            zone_is_reclaim_writeback(zone)) {
+                            test_bit(ZONE_WRITEBACK, &zone->flags)) {
                                 nr_immediate++;
                                 goto keep_locked;
 
@@ -1002,7 +1002,7 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                          */
                         if (page_is_file_cache(page) &&
                                         (!current_is_kswapd() ||
-                                         !zone_is_reclaim_dirty(zone))) {
+                                         !test_bit(ZONE_DIRTY, &zone->flags))) {
                                 /*
                                  * Immediately reclaim when written back.
                                  * Similar in principal to deactivate_page()
@@ -1563,7 +1563,7 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
          * are encountered in the nr_immediate check below.
          */
         if (nr_writeback && nr_writeback == nr_taken)
-                zone_set_flag(zone, ZONE_WRITEBACK);
+                set_bit(ZONE_WRITEBACK, &zone->flags);
 
         /*
          * memcg will stall in page writeback so only consider forcibly
@@ -1575,16 +1575,16 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
                  * backed by a congested BDI and wait_iff_congested will stall.
                  */
                 if (nr_dirty && nr_dirty == nr_congested)
-                        zone_set_flag(zone, ZONE_CONGESTED);
+                        set_bit(ZONE_CONGESTED, &zone->flags);
 
                 /*
                  * If dirty pages are scanned that are not queued for IO, it
                  * implies that flushers are not keeping up. In this case, flag
-                 * the zone ZONE_TAIL_LRU_DIRTY and kswapd will start writing
-                 * pages from reclaim context.
+                 * the zone ZONE_DIRTY and kswapd will start writing pages from
+                 * reclaim context.
                  */
                 if (nr_unqueued_dirty == nr_taken)
-                        zone_set_flag(zone, ZONE_TAIL_LRU_DIRTY);
+                        set_bit(ZONE_DIRTY, &zone->flags);
 
                 /*
                  * If kswapd scans pages marked marked for immediate
@@ -2315,7 +2315,10 @@ static bool shrink_zone(struct zone *zone, struct scan_control *sc)
         return reclaimable;
 }
 
-/* Returns true if compaction should go ahead for a high-order request */
+/*
+ * Returns true if compaction should go ahead for a high-order request, or
+ * the high-order allocation would succeed without compaction.
+ */
 static inline bool compaction_ready(struct zone *zone, int order)
 {
         unsigned long balance_gap, watermark;
@@ -2339,8 +2342,11 @@ static inline bool compaction_ready(struct zone *zone, int order)
         if (compaction_deferred(zone, order))
                 return watermark_ok;
 
-        /* If compaction is not ready to start, keep reclaiming */
-        if (!compaction_suitable(zone, order))
+        /*
+         * If compaction is not ready to start and allocation is not likely
+         * to succeed without it, then keep reclaiming.
+         */
+        if (compaction_suitable(zone, order) == COMPACT_SKIPPED)
                 return false;
 
         return watermark_ok;
@@ -2753,21 +2759,22 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *memcg,
 }
 
 unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
+                                           unsigned long nr_pages,
                                            gfp_t gfp_mask,
-                                           bool noswap)
+                                           bool may_swap)
 {
         struct zonelist *zonelist;
         unsigned long nr_reclaimed;
         int nid;
         struct scan_control sc = {
-                .nr_to_reclaim = SWAP_CLUSTER_MAX,
+                .nr_to_reclaim = max(nr_pages, SWAP_CLUSTER_MAX),
                 .gfp_mask = (gfp_mask & GFP_RECLAIM_MASK) |
                                 (GFP_HIGHUSER_MOVABLE & ~GFP_RECLAIM_MASK),
                 .target_mem_cgroup = memcg,
                 .priority = DEF_PRIORITY,
                 .may_writepage = !laptop_mode,
                 .may_unmap = 1,
-                .may_swap = !noswap,
+                .may_swap = may_swap,
         };
 
         /*
@@ -2818,7 +2825,7 @@ static bool zone_balanced(struct zone *zone, int order,
                 return false;
 
         if (IS_ENABLED(CONFIG_COMPACTION) && order &&
-            !compaction_suitable(zone, order))
+            compaction_suitable(zone, order) == COMPACT_SKIPPED)
                 return false;
 
         return true;
@@ -2978,7 +2985,7 @@ static bool kswapd_shrink_zone(struct zone *zone,
         /* Account for the number of pages attempted to reclaim */
         *nr_attempted += sc->nr_to_reclaim;
 
-        zone_clear_flag(zone, ZONE_WRITEBACK);
+        clear_bit(ZONE_WRITEBACK, &zone->flags);
 
         /*
          * If a zone reaches its high watermark, consider it to be no longer
@@ -2988,8 +2995,8 @@ static bool kswapd_shrink_zone(struct zone *zone,
          */
         if (zone_reclaimable(zone) &&
             zone_balanced(zone, testorder, 0, classzone_idx)) {
-                zone_clear_flag(zone, ZONE_CONGESTED);
-                zone_clear_flag(zone, ZONE_TAIL_LRU_DIRTY);
+                clear_bit(ZONE_CONGESTED, &zone->flags);
+                clear_bit(ZONE_DIRTY, &zone->flags);
         }
 
         return sc->nr_scanned >= sc->nr_to_reclaim;
@@ -3080,8 +3087,8 @@ static unsigned long balance_pgdat(pg_data_t *pgdat, int order,
                                  * If balanced, clear the dirty and congested
                                  * flags
                                  */
-                                zone_clear_flag(zone, ZONE_CONGESTED);
-                                zone_clear_flag(zone, ZONE_TAIL_LRU_DIRTY);
+                                clear_bit(ZONE_CONGESTED, &zone->flags);
+                                clear_bit(ZONE_DIRTY, &zone->flags);
                         }
                 }
 
@@ -3708,11 +3715,11 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
         if (node_state(node_id, N_CPU) && node_id != numa_node_id())
                 return ZONE_RECLAIM_NOSCAN;
 
-        if (zone_test_and_set_flag(zone, ZONE_RECLAIM_LOCKED))
+        if (test_and_set_bit(ZONE_RECLAIM_LOCKED, &zone->flags))
                 return ZONE_RECLAIM_NOSCAN;
 
         ret = __zone_reclaim(zone, gfp_mask, order);
-        zone_clear_flag(zone, ZONE_RECLAIM_LOCKED);
+        clear_bit(ZONE_RECLAIM_LOCKED, &zone->flags);
 
         if (!ret)
                 count_vm_event(PGSCAN_ZONE_RECLAIM_FAILED);
@@ -3791,66 +3798,3 @@ void check_move_unevictable_pages(struct page **pages, int nr_pages)
         }
 }
 #endif /* CONFIG_SHMEM */
-
-static void warn_scan_unevictable_pages(void)
-{
-        printk_once(KERN_WARNING
-                    "%s: The scan_unevictable_pages sysctl/node-interface has been "
-                    "disabled for lack of a legitimate use case.  If you have "
-                    "one, please send an email to linux-mm@kvack.org.\n",
-                    current->comm);
-}
-
-/*
- * scan_unevictable_pages [vm] sysctl handler.  On demand re-scan of
- * all nodes' unevictable lists for evictable pages
- */
-unsigned long scan_unevictable_pages;
-
-int scan_unevictable_handler(struct ctl_table *table, int write,
-                           void __user *buffer,
-                           size_t *length, loff_t *ppos)
-{
-        warn_scan_unevictable_pages();
-        proc_doulongvec_minmax(table, write, buffer, length, ppos);
-        scan_unevictable_pages = 0;
-        return 0;
-}
-
-#ifdef CONFIG_NUMA
-/*
- * per node 'scan_unevictable_pages' attribute.  On demand re-scan of
- * a specified node's per zone unevictable lists for evictable pages.
- */
-
-static ssize_t read_scan_unevictable_node(struct device *dev,
-                                          struct device_attribute *attr,
-                                          char *buf)
-{
-        warn_scan_unevictable_pages();
-        return sprintf(buf, "0\n");     /* always zero; should fit... */
-}
-
-static ssize_t write_scan_unevictable_node(struct device *dev,
-                                           struct device_attribute *attr,
-                                        const char *buf, size_t count)
-{
-        warn_scan_unevictable_pages();
-        return 1;
-}
-
-
-static DEVICE_ATTR(scan_unevictable_pages, S_IRUGO | S_IWUSR,
-                        read_scan_unevictable_node,
-                        write_scan_unevictable_node);
-
-int scan_unevictable_register_node(struct node *node)
-{
-        return device_create_file(&node->dev, &dev_attr_scan_unevictable_pages);
-}
-
-void scan_unevictable_unregister_node(struct node *node)
-{
-        device_remove_file(&node->dev, &dev_attr_scan_unevictable_pages);
-}
-#endif
diff --git a/mm/vmstat.c b/mm/vmstat.c
index e9ab104b956f..1b12d390dc68 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -7,6 +7,7 @@
  *  zoned VM statistics
  *  Copyright (C) 2006 Silicon Graphics, Inc.,
  *              Christoph Lameter <christoph@lameter.com>
+ *  Copyright (C) 2008-2014 Christoph Lameter
  */
 #include <linux/fs.h>
 #include <linux/mm.h>
@@ -14,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/cpu.h>
+#include <linux/cpumask.h>
 #include <linux/vmstat.h>
 #include <linux/sched.h>
 #include <linux/math64.h>
@@ -419,13 +421,22 @@ void dec_zone_page_state(struct page *page, enum zone_stat_item item)
 EXPORT_SYMBOL(dec_zone_page_state);
 #endif
 
-static inline void fold_diff(int *diff)
+
+/*
+ * Fold a differential into the global counters.
+ * Returns the number of counters updated.
+ */
+static int fold_diff(int *diff)
 {
         int i;
+        int changes = 0;
 
         for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
-                if (diff[i])
+                if (diff[i]) {
                         atomic_long_add(diff[i], &vm_stat[i]);
+                        changes++;
+        }
+        return changes;
 }
 
 /*
@@ -441,12 +452,15 @@ static inline void fold_diff(int *diff)
  * statistics in the remote zone struct as well as the global cachelines
  * with the global counters. These could cause remote node cache line
  * bouncing and will have to be only done when necessary.
+ *
+ * The function returns the number of global counters updated.
  */
-static void refresh_cpu_vm_stats(void)
+static int refresh_cpu_vm_stats(void)
 {
         struct zone *zone;
         int i;
         int global_diff[NR_VM_ZONE_STAT_ITEMS] = { 0, };
+        int changes = 0;
 
         for_each_populated_zone(zone) {
                 struct per_cpu_pageset __percpu *p = zone->pageset;
@@ -486,15 +500,17 @@ static void refresh_cpu_vm_stats(void)
                         continue;
                 }
 
-
                 if (__this_cpu_dec_return(p->expire))
                         continue;
 
-                if (__this_cpu_read(p->pcp.count))
+                if (__this_cpu_read(p->pcp.count)) {
                         drain_zone_pages(zone, this_cpu_ptr(&p->pcp));
+                        changes++;
+                }
 #endif
         }
-        fold_diff(global_diff);
+        changes += fold_diff(global_diff);
+        return changes;
 }
 
 /*
@@ -735,7 +751,7 @@ static void walk_zones_in_node(struct seq_file *m, pg_data_t *pgdat,
                                         TEXT_FOR_HIGHMEM(xx) xx "_movable",
 
 const char * const vmstat_text[] = {
-        /* Zoned VM counters */
+        /* enum zone_stat_item countes */
         "nr_free_pages",
         "nr_alloc_batch",
         "nr_inactive_anon",
@@ -778,10 +794,13 @@ const char * const vmstat_text[] = {
         "workingset_nodereclaim",
         "nr_anon_transparent_hugepages",
         "nr_free_cma",
+
+        /* enum writeback_stat_item counters */
         "nr_dirty_threshold",
         "nr_dirty_background_threshold",
 
 #ifdef CONFIG_VM_EVENT_COUNTERS
+        /* enum vm_event_item counters */
         "pgpgin",
         "pgpgout",
         "pswpin",
@@ -860,6 +879,13 @@ const char * const vmstat_text[] = {
         "thp_zero_page_alloc",
         "thp_zero_page_alloc_failed",
 #endif
+#ifdef CONFIG_MEMORY_BALLOON
+        "balloon_inflate",
+        "balloon_deflate",
+#ifdef CONFIG_BALLOON_COMPACTION
+        "balloon_migrate",
+#endif
+#endif /* CONFIG_MEMORY_BALLOON */
 #ifdef CONFIG_DEBUG_TLBFLUSH
 #ifdef CONFIG_SMP
         "nr_tlb_remote_flush",
@@ -1229,20 +1255,108 @@ static const struct file_operations proc_vmstat_file_operations = {
 #ifdef CONFIG_SMP
 static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
 int sysctl_stat_interval __read_mostly = HZ;
+static cpumask_var_t cpu_stat_off;
 
 static void vmstat_update(struct work_struct *w)
 {
-        refresh_cpu_vm_stats();
-        schedule_delayed_work(this_cpu_ptr(&vmstat_work),
+        if (refresh_cpu_vm_stats())
+                /*
+                 * Counters were updated so we expect more updates
+                 * to occur in the future. Keep on running the
+                 * update worker thread.
+                 */
+                schedule_delayed_work(this_cpu_ptr(&vmstat_work),
+                        round_jiffies_relative(sysctl_stat_interval));
+        else {
+                /*
+                 * We did not update any counters so the app may be in
+                 * a mode where it does not cause counter updates.
+                 * We may be uselessly running vmstat_update.
+                 * Defer the checking for differentials to the
+                 * shepherd thread on a different processor.
+                 */
+                int r;
+                /*
+                 * Shepherd work thread does not race since it never
+                 * changes the bit if its zero but the cpu
+                 * online / off line code may race if
+                 * worker threads are still allowed during
+                 * shutdown / startup.
+                 */
+                r = cpumask_test_and_set_cpu(smp_processor_id(),
+                        cpu_stat_off);
+                VM_BUG_ON(r);
+        }
+}
+
+/*
+ * Check if the diffs for a certain cpu indicate that
+ * an update is needed.
+ */
+static bool need_update(int cpu)
+{
+        struct zone *zone;
+
+        for_each_populated_zone(zone) {
+                struct per_cpu_pageset *p = per_cpu_ptr(zone->pageset, cpu);
+
+                BUILD_BUG_ON(sizeof(p->vm_stat_diff[0]) != 1);
+                /*
+                 * The fast way of checking if there are any vmstat diffs.
+                 * This works because the diffs are byte sized items.
+                 */
+                if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS))
+                        return true;
+
+        }
+        return false;
+}
+
+
+/*
+ * Shepherd worker thread that checks the
+ * differentials of processors that have their worker
+ * threads for vm statistics updates disabled because of
+ * inactivity.
+ */
+static void vmstat_shepherd(struct work_struct *w);
+
+static DECLARE_DELAYED_WORK(shepherd, vmstat_shepherd);
+
+static void vmstat_shepherd(struct work_struct *w)
+{
+        int cpu;
+
+        get_online_cpus();
+        /* Check processors whose vmstat worker threads have been disabled */
+        for_each_cpu(cpu, cpu_stat_off)
+                if (need_update(cpu) &&
+                        cpumask_test_and_clear_cpu(cpu, cpu_stat_off))
+
+                        schedule_delayed_work_on(cpu, &per_cpu(vmstat_work, cpu),
+                                __round_jiffies_relative(sysctl_stat_interval, cpu));
+
+        put_online_cpus();
+
+        schedule_delayed_work(&shepherd,
                 round_jiffies_relative(sysctl_stat_interval));
+
 }
 
-static void start_cpu_timer(int cpu)
+static void __init start_shepherd_timer(void)
 {
-        struct delayed_work *work = &per_cpu(vmstat_work, cpu);
+        int cpu;
+
+        for_each_possible_cpu(cpu)
+                INIT_DEFERRABLE_WORK(per_cpu_ptr(&vmstat_work, cpu),
+                        vmstat_update);
+
+        if (!alloc_cpumask_var(&cpu_stat_off, GFP_KERNEL))
+                BUG();
+        cpumask_copy(cpu_stat_off, cpu_online_mask);
 
-        INIT_DEFERRABLE_WORK(work, vmstat_update);
-        schedule_delayed_work_on(cpu, work, __round_jiffies_relative(HZ, cpu));
+        schedule_delayed_work(&shepherd,
+                round_jiffies_relative(sysctl_stat_interval));
 }
 
 static void vmstat_cpu_dead(int node)
@@ -1273,17 +1387,17 @@ static int vmstat_cpuup_callback(struct notifier_block *nfb,
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
                 refresh_zone_stat_thresholds();
-                start_cpu_timer(cpu);
                 node_set_state(cpu_to_node(cpu), N_CPU);
+                cpumask_set_cpu(cpu, cpu_stat_off);
                 break;
         case CPU_DOWN_PREPARE:
         case CPU_DOWN_PREPARE_FROZEN:
                 cancel_delayed_work_sync(&per_cpu(vmstat_work, cpu));
-                per_cpu(vmstat_work, cpu).work.func = NULL;
+                cpumask_clear_cpu(cpu, cpu_stat_off);
                 break;
         case CPU_DOWN_FAILED:
         case CPU_DOWN_FAILED_FROZEN:
-                start_cpu_timer(cpu);
+                cpumask_set_cpu(cpu, cpu_stat_off);
                 break;
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
@@ -1303,15 +1417,10 @@ static struct notifier_block vmstat_notifier =
 static int __init setup_vmstat(void)
 {
 #ifdef CONFIG_SMP
-        int cpu;
-
         cpu_notifier_register_begin();
         __register_cpu_notifier(&vmstat_notifier);
 
-        for_each_online_cpu(cpu) {
-                start_cpu_timer(cpu);
-                node_set_state(cpu_to_node(cpu), N_CPU);
-        }
+        start_shepherd_timer();
         cpu_notifier_register_done();
 #endif
 #ifdef CONFIG_PROC_FS
diff --git a/mm/zbud.c b/mm/zbud.c
index f26e7fcc7fa2..ecf1dbef6983 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -60,15 +60,17 @@
  * NCHUNKS_ORDER determines the internal allocation granularity, effectively
  * adjusting internal fragmentation.  It also determines the number of
  * freelists maintained in each pool. NCHUNKS_ORDER of 6 means that the
- * allocation granularity will be in chunks of size PAGE_SIZE/64, and there
- * will be 64 freelists per pool.
+ * allocation granularity will be in chunks of size PAGE_SIZE/64. As one chunk
+ * in allocated page is occupied by zbud header, NCHUNKS will be calculated to
+ * 63 which shows the max number of free chunks in zbud page, also there will be
+ * 63 freelists per pool.
  */
 #define NCHUNKS_ORDER   6
 
 #define CHUNK_SHIFT     (PAGE_SHIFT - NCHUNKS_ORDER)
 #define CHUNK_SIZE      (1 << CHUNK_SHIFT)
-#define NCHUNKS         (PAGE_SIZE >> CHUNK_SHIFT)
 #define ZHDR_SIZE_ALIGNED CHUNK_SIZE
+#define NCHUNKS         ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT)
 
 /**
  * struct zbud_pool - stores metadata for each zbud pool
@@ -268,10 +270,9 @@ static int num_free_chunks(struct zbud_header *zhdr)
 {
         /*
          * Rather than branch for different situations, just use the fact that
-         * free buddies have a length of zero to simplify everything. -1 at the
-         * end for the zbud header.
+         * free buddies have a length of zero to simplify everything.
          */
-        return NCHUNKS - zhdr->first_chunks - zhdr->last_chunks - 1;
+        return NCHUNKS - zhdr->first_chunks - zhdr->last_chunks;
 }
 
 /*****************
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 94f38fac5e81..839a48c3ca27 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -175,7 +175,7 @@ enum fullness_group {
  *      n <= N / f, where
  * n = number of allocated objects
  * N = total number of objects zspage can store
- * f = 1/fullness_threshold_frac
+ * f = fullness_threshold_frac
  *
  * Similarly, we assign zspage to:
  *      ZS_ALMOST_FULL  when n > N / f
@@ -199,9 +199,6 @@ struct size_class {
 
         spinlock_t lock;
 
-        /* stats */
-        u64 pages_allocated;
-
         struct page *fullness_list[_ZS_NR_FULLNESS_GROUPS];
 };
 
@@ -220,6 +217,7 @@ struct zs_pool {
         struct size_class size_class[ZS_SIZE_CLASSES];
 
         gfp_t flags;    /* allocation flags used when growing pool */
+        atomic_long_t pages_allocated;
 };
 
 /*
@@ -299,7 +297,7 @@ static void zs_zpool_unmap(void *pool, unsigned long handle)
 
 static u64 zs_zpool_total_size(void *pool)
 {
-        return zs_get_total_size_bytes(pool);
+        return zs_get_total_pages(pool) << PAGE_SHIFT;
 }
 
 static struct zpool_driver zs_zpool_driver = {
@@ -630,7 +628,7 @@ static void init_zspage(struct page *first_page, struct size_class *class)
         while (page) {
                 struct page *next_page;
                 struct link_free *link;
-                unsigned int i, objs_on_page;
+                unsigned int i = 1;
 
                 /*
                  * page->index stores offset of first object starting
@@ -643,14 +641,10 @@ static void init_zspage(struct page *first_page, struct size_class *class)
 
                 link = (struct link_free *)kmap_atomic(page) +
                                                 off / sizeof(*link);
-                objs_on_page = (PAGE_SIZE - off) / class->size;
 
-                for (i = 1; i <= objs_on_page; i++) {
-                        off += class->size;
-                        if (off < PAGE_SIZE) {
-                                link->next = obj_location_to_handle(page, i);
-                                link += class->size / sizeof(*link);
-                        }
+                while ((off += class->size) < PAGE_SIZE) {
+                        link->next = obj_location_to_handle(page, i++);
+                        link += class->size / sizeof(*link);
                 }
 
                 /*
@@ -662,7 +656,7 @@ static void init_zspage(struct page *first_page, struct size_class *class)
                 link->next = obj_location_to_handle(next_page, 0);
                 kunmap_atomic(link);
                 page = next_page;
-                off = (off + class->size) % PAGE_SIZE;
+                off %= PAGE_SIZE;
         }
 }
 
@@ -1028,8 +1022,9 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size)
                         return 0;
 
                 set_zspage_mapping(first_page, class->index, ZS_EMPTY);
+                atomic_long_add(class->pages_per_zspage,
+                                        &pool->pages_allocated);
                 spin_lock(&class->lock);
-                class->pages_allocated += class->pages_per_zspage;
         }
 
         obj = (unsigned long)first_page->freelist;
@@ -1082,14 +1077,13 @@ void zs_free(struct zs_pool *pool, unsigned long obj)
 
         first_page->inuse--;
         fullness = fix_fullness_group(pool, first_page);
-
-        if (fullness == ZS_EMPTY)
-                class->pages_allocated -= class->pages_per_zspage;
-
         spin_unlock(&class->lock);
 
-        if (fullness == ZS_EMPTY)
+        if (fullness == ZS_EMPTY) {
+                atomic_long_sub(class->pages_per_zspage,
+                                &pool->pages_allocated);
                 free_zspage(first_page);
+        }
 }
 EXPORT_SYMBOL_GPL(zs_free);
 
@@ -1183,17 +1177,11 @@ void zs_unmap_object(struct zs_pool *pool, unsigned long handle)
 }
 EXPORT_SYMBOL_GPL(zs_unmap_object);
 
-u64 zs_get_total_size_bytes(struct zs_pool *pool)
+unsigned long zs_get_total_pages(struct zs_pool *pool)
 {
-        int i;
-        u64 npages = 0;
-
-        for (i = 0; i < ZS_SIZE_CLASSES; i++)
-                npages += pool->size_class[i].pages_allocated;
-
-        return npages << PAGE_SHIFT;
+        return atomic_long_read(&pool->pages_allocated);
 }
-EXPORT_SYMBOL_GPL(zs_get_total_size_bytes);
+EXPORT_SYMBOL_GPL(zs_get_total_pages);
 
 module_init(zs_init);
 module_exit(zs_exit);
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 3f94e1afd6cf..4c4b1f631ecf 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -3,6 +3,7 @@
 CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall
 BINARIES = hugepage-mmap hugepage-shm map_hugetlb thuge-gen hugetlbfstest
+BINARIES += transhuge-stress
 
 all: $(BINARIES)
 %: %.c
diff --git a/tools/testing/selftests/vm/transhuge-stress.c b/tools/testing/selftests/vm/transhuge-stress.c
new file mode 100644
index 000000000000..fd7f1b4a96f9
--- /dev/null
+++ b/tools/testing/selftests/vm/transhuge-stress.c
@@ -0,0 +1,144 @@
+/*
+ * Stress test for transparent huge pages, memory compaction and migration.
+ *
+ * Authors: Konstantin Khlebnikov <koct9i@gmail.com>
+ *
+ * This is free and unencumbered software released into the public domain.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <err.h>
+#include <time.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/mman.h>
+
+#define PAGE_SHIFT 12
+#define HPAGE_SHIFT 21
+
+#define PAGE_SIZE (1 << PAGE_SHIFT)
+#define HPAGE_SIZE (1 << HPAGE_SHIFT)
+
+#define PAGEMAP_PRESENT(ent)    (((ent) & (1ull << 63)) != 0)
+#define PAGEMAP_PFN(ent)        ((ent) & ((1ull << 55) - 1))
+
+int pagemap_fd;
+
+int64_t allocate_transhuge(void *ptr)
+{
+        uint64_t ent[2];
+
+        /* drop pmd */
+        if (mmap(ptr, HPAGE_SIZE, PROT_READ | PROT_WRITE,
+                                MAP_FIXED | MAP_ANONYMOUS |
+                                MAP_NORESERVE | MAP_PRIVATE, -1, 0) != ptr)
+                errx(2, "mmap transhuge");
+
+        if (madvise(ptr, HPAGE_SIZE, MADV_HUGEPAGE))
+                err(2, "MADV_HUGEPAGE");
+
+        /* allocate transparent huge page */
+        *(volatile void **)ptr = ptr;
+
+        if (pread(pagemap_fd, ent, sizeof(ent),
+                        (uintptr_t)ptr >> (PAGE_SHIFT - 3)) != sizeof(ent))
+                err(2, "read pagemap");
+
+        if (PAGEMAP_PRESENT(ent[0]) && PAGEMAP_PRESENT(ent[1]) &&
+            PAGEMAP_PFN(ent[0]) + 1 == PAGEMAP_PFN(ent[1]) &&
+            !(PAGEMAP_PFN(ent[0]) & ((1 << (HPAGE_SHIFT - PAGE_SHIFT)) - 1)))
+                return PAGEMAP_PFN(ent[0]);
+
+        return -1;
+}
+
+int main(int argc, char **argv)
+{
+        size_t ram, len;
+        void *ptr, *p;
+        struct timespec a, b;
+        double s;
+        uint8_t *map;
+        size_t map_len;
+
+        ram = sysconf(_SC_PHYS_PAGES);
+        if (ram > SIZE_MAX / sysconf(_SC_PAGESIZE) / 4)
+                ram = SIZE_MAX / 4;
+        else
+                ram *= sysconf(_SC_PAGESIZE);
+
+        if (argc == 1)
+                len = ram;
+        else if (!strcmp(argv[1], "-h"))
+                errx(1, "usage: %s [size in MiB]", argv[0]);
+        else
+                len = atoll(argv[1]) << 20;
+
+        warnx("allocate %zd transhuge pages, using %zd MiB virtual memory"
+              " and %zd MiB of ram", len >> HPAGE_SHIFT, len >> 20,
+              len >> (20 + HPAGE_SHIFT - PAGE_SHIFT - 1));
+
+        pagemap_fd = open("/proc/self/pagemap", O_RDONLY);
+        if (pagemap_fd < 0)
+                err(2, "open pagemap");
+
+        len -= len % HPAGE_SIZE;
+        ptr = mmap(NULL, len + HPAGE_SIZE, PROT_READ | PROT_WRITE,
+                        MAP_ANONYMOUS | MAP_NORESERVE | MAP_PRIVATE, -1, 0);
+        if (ptr == MAP_FAILED)
+                err(2, "initial mmap");
+        ptr += HPAGE_SIZE - (uintptr_t)ptr % HPAGE_SIZE;
+
+        if (madvise(ptr, len, MADV_HUGEPAGE))
+                err(2, "MADV_HUGEPAGE");
+
+        map_len = ram >> (HPAGE_SHIFT - 1);
+        map = malloc(map_len);
+        if (!map)
+                errx(2, "map malloc");
+
+        while (1) {
+                int nr_succeed = 0, nr_failed = 0, nr_pages = 0;
+
+                memset(map, 0, map_len);
+
+                clock_gettime(CLOCK_MONOTONIC, &a);
+                for (p = ptr; p < ptr + len; p += HPAGE_SIZE) {
+                        int64_t pfn;
+
+                        pfn = allocate_transhuge(p);
+
+                        if (pfn < 0) {
+                                nr_failed++;
+                        } else {
+                                size_t idx = pfn >> (HPAGE_SHIFT - PAGE_SHIFT);
+
+                                nr_succeed++;
+                                if (idx >= map_len) {
+                                        map = realloc(map, idx + 1);
+                                        if (!map)
+                                                errx(2, "map realloc");
+                                        memset(map + map_len, 0, idx + 1 - map_len);
+                                        map_len = idx + 1;
+                                }
+                                if (!map[idx])
+                                        nr_pages++;
+                                map[idx] = 1;
+                        }
+
+                        /* split transhuge page, keep last page */
+                        if (madvise(p, HPAGE_SIZE - PAGE_SIZE, MADV_DONTNEED))
+                                err(2, "MADV_DONTNEED");
+                }
+                clock_gettime(CLOCK_MONOTONIC, &b);
+                s = b.tv_sec - a.tv_sec + (b.tv_nsec - a.tv_nsec) / 1000000000.;
+
+                warnx("%.3f s/loop, %.3f ms/page, %10.3f MiB/s\t"
+                      "%4d succeed, %4d failed, %4d different pages",
+                      s, s * 1000 / (len >> HPAGE_SHIFT), len / s / (1 << 20),
+                      nr_succeed, nr_failed, nr_pages);
+        }
+}
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index c4d6d2e20e0d..264fbc297e0b 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -132,6 +132,7 @@ static const char * const page_flag_names[] = {
         [KPF_NOPAGE]            = "n:nopage",
         [KPF_KSM]               = "x:ksm",
         [KPF_THP]               = "t:thp",
+        [KPF_BALLOON]           = "o:balloon",
 
         [KPF_RESERVED]          = "r:reserved",
         [KPF_MLOCKED]           = "m:mlocked",