11 files changed, 98 insertions, 76 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index b72777ff32a9..1ae94bcae5d9 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -10,6 +10,7 @@ config X86_32
         def_bool y
         depends on !64BIT
         select CLKSRC_I8253
+        select HAVE_UID16
 
 config X86_64
         def_bool y
@@ -46,6 +47,7 @@ config X86
         select HAVE_FUNCTION_GRAPH_FP_TEST
         select HAVE_FUNCTION_TRACE_MCOUNT_TEST
         select HAVE_SYSCALL_TRACEPOINTS
+        select SYSCTL_EXCEPTION_TRACE
         select HAVE_KVM
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_TRACEHOOK
@@ -65,6 +67,7 @@ config X86
         select HAVE_PERF_EVENTS_NMI
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
+        select HAVE_DEBUG_KMEMLEAK
         select ANON_INODES
         select HAVE_ALIGNED_STRUCT_PAGE if SLUB && !M386
         select HAVE_CMPXCHG_LOCAL if !M386
@@ -85,6 +88,7 @@ config X86
         select IRQ_FORCED_THREADING
         select USE_GENERIC_SMP_HELPERS if SMP
         select HAVE_BPF_JIT if X86_64
+        select HAVE_ARCH_TRANSPARENT_HUGEPAGE
         select CLKEVT_I8253
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_IOMAP
@@ -2168,6 +2172,7 @@ config IA32_EMULATION
         bool "IA32 Emulation"
         depends on X86_64
         select COMPAT_BINFMT_ELF
+        select HAVE_UID16
         ---help---
           Include code to run legacy 32-bit programs under a
           64-bit kernel. You should likely turn this on, unless you're
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index 250b8774c158..b6c3b821acf6 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -240,30 +240,6 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
         return c;
 }
 
-
-/*
- * atomic_dec_if_positive - decrement by 1 if old value positive
- * @v: pointer of type atomic_t
- *
- * The function returns the old value of *v minus 1, even if
- * the atomic variable, v, was not decremented.
- */
-static inline int atomic_dec_if_positive(atomic_t *v)
-{
-        int c, old, dec;
-        c = atomic_read(v);
-        for (;;) {
-                dec = c - 1;
-                if (unlikely(dec < 0))
-                        break;
-                old = atomic_cmpxchg((v), c, dec);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return dec;
-}
-
 /**
  * atomic_inc_short - increment of a short integer
  * @v: pointer to type int
diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
index 439a9acc132d..bdd35dbd0605 100644
--- a/arch/x86/include/asm/hugetlb.h
+++ b/arch/x86/include/asm/hugetlb.h
@@ -90,4 +90,8 @@ static inline void arch_release_hugepage(struct page *page)
 {
 }
 
+static inline void arch_clear_hugepage_flags(struct page *page)
+{
+}
+
 #endif /* _ASM_X86_HUGETLB_H */
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index fc9948465293..a1f780d45f76 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -146,8 +146,7 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
 
 static inline int pmd_large(pmd_t pte)
 {
-        return (pmd_flags(pte) & (_PAGE_PSE | _PAGE_PRESENT)) ==
-                (_PAGE_PSE | _PAGE_PRESENT);
+        return pmd_flags(pte) & _PAGE_PSE;
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -415,7 +414,13 @@ static inline int pte_hidden(pte_t pte)
 
 static inline int pmd_present(pmd_t pmd)
 {
-        return pmd_flags(pmd) & _PAGE_PRESENT;
+        /*
+         * Checking for _PAGE_PSE is needed too because
+         * split_huge_page will temporarily clear the present bit (but
+         * the _PAGE_PSE flag will remain set at all times while the
+         * _PAGE_PRESENT bit is clear).
+         */
+        return pmd_flags(pmd) & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_PSE);
 }
 
 static inline int pmd_none(pmd_t pmd)
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index 0c92113c4cb6..8faa215a503e 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -71,6 +71,7 @@ do {						\
  * tables contain all the necessary information.
  */
 #define update_mmu_cache(vma, address, ptep) do { } while (0)
+#define update_mmu_cache_pmd(vma, address, pmd) do { } while (0)
 
 #endif /* !__ASSEMBLY__ */
 
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index 8251be02301e..47356f9df82e 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -143,6 +143,7 @@ static inline int pgd_large(pgd_t pgd) { return 0; }
 #define pte_unmap(pte) ((void)(pte))/* NOP */
 
 #define update_mmu_cache(vma, address, ptep) do { } while (0)
+#define update_mmu_cache_pmd(vma, address, pmd) do { } while (0)
 
 /* Encode and de-code a swap entry */
 #if _PAGE_BIT_FILE < _PAGE_BIT_PROTNONE
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index a530b230e7d7..8e13ecb41bee 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1220,6 +1220,7 @@ good_area:
                         /* Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk
                          * of starvation. */
                         flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                        flags |= FAULT_FLAG_TRIED;
                         goto retry;
                 }
         }
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index b91e48512425..937bff5cdaa7 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -71,7 +71,6 @@ huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
         struct address_space *mapping = vma->vm_file->f_mapping;
         pgoff_t idx = ((addr - vma->vm_start) >> PAGE_SHIFT) +
                         vma->vm_pgoff;
-        struct prio_tree_iter iter;
         struct vm_area_struct *svma;
         unsigned long saddr;
         pte_t *spte = NULL;
@@ -81,7 +80,7 @@ huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
                 return (pte_t *)pmd_alloc(mm, pud, addr);
 
         mutex_lock(&mapping->i_mmap_mutex);
-        vma_prio_tree_foreach(svma, &iter, &mapping->i_mmap, idx, idx) {
+        vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
                 if (svma == vma)
                         continue;
 
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 3d68ef6d2266..0eb572eda406 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -664,20 +664,20 @@ static void free_pfn_range(u64 paddr, unsigned long size)
 }
 
 /*
- * track_pfn_vma_copy is called when vma that is covering the pfnmap gets
+ * track_pfn_copy is called when vma that is covering the pfnmap gets
  * copied through copy_page_range().
  *
  * If the vma has a linear pfn mapping for the entire range, we get the prot
  * from pte and reserve the entire vma range with single reserve_pfn_range call.
  */
-int track_pfn_vma_copy(struct vm_area_struct *vma)
+int track_pfn_copy(struct vm_area_struct *vma)
 {
         resource_size_t paddr;
         unsigned long prot;
         unsigned long vma_size = vma->vm_end - vma->vm_start;
         pgprot_t pgprot;
 
-        if (is_linear_pfn_mapping(vma)) {
+        if (vma->vm_flags & VM_PAT) {
                 /*
                  * reserve the whole chunk covered by vma. We need the
                  * starting address and protection from pte.
@@ -694,31 +694,59 @@ int track_pfn_vma_copy(struct vm_area_struct *vma)
 }
 
 /*
- * track_pfn_vma_new is called when a _new_ pfn mapping is being established
- * for physical range indicated by pfn and size.
- *
  * prot is passed in as a parameter for the new mapping. If the vma has a
  * linear pfn mapping for the entire range reserve the entire vma range with
  * single reserve_pfn_range call.
  */
-int track_pfn_vma_new(struct vm_area_struct *vma, pgprot_t *prot,
-                        unsigned long pfn, unsigned long size)
+int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
+                    unsigned long pfn, unsigned long addr, unsigned long size)
 {
+        resource_size_t paddr = (resource_size_t)pfn << PAGE_SHIFT;
         unsigned long flags;
-        resource_size_t paddr;
-        unsigned long vma_size = vma->vm_end - vma->vm_start;
 
-        if (is_linear_pfn_mapping(vma)) {
-                /* reserve the whole chunk starting from vm_pgoff */
-                paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
-                return reserve_pfn_range(paddr, vma_size, prot, 0);
+        /* reserve the whole chunk starting from paddr */
+        if (addr == vma->vm_start && size == (vma->vm_end - vma->vm_start)) {
+                int ret;
+
+                ret = reserve_pfn_range(paddr, size, prot, 0);
+                if (!ret)
+                        vma->vm_flags |= VM_PAT;
+                return ret;
         }
 
         if (!pat_enabled)
                 return 0;
 
-        /* for vm_insert_pfn and friends, we set prot based on lookup */
-        flags = lookup_memtype(pfn << PAGE_SHIFT);
+        /*
+         * For anything smaller than the vma size we set prot based on the
+         * lookup.
+         */
+        flags = lookup_memtype(paddr);
+
+        /* Check memtype for the remaining pages */
+        while (size > PAGE_SIZE) {
+                size -= PAGE_SIZE;
+                paddr += PAGE_SIZE;
+                if (flags != lookup_memtype(paddr))
+                        return -EINVAL;
+        }
+
+        *prot = __pgprot((pgprot_val(vma->vm_page_prot) & (~_PAGE_CACHE_MASK)) |
+                         flags);
+
+        return 0;
+}
+
+int track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot,
+                     unsigned long pfn)
+{
+        unsigned long flags;
+
+        if (!pat_enabled)
+                return 0;
+
+        /* Set prot based on lookup */
+        flags = lookup_memtype((resource_size_t)pfn << PAGE_SHIFT);
         *prot = __pgprot((pgprot_val(vma->vm_page_prot) & (~_PAGE_CACHE_MASK)) |
                          flags);
 
@@ -726,22 +754,31 @@ int track_pfn_vma_new(struct vm_area_struct *vma, pgprot_t *prot,
 }
 
 /*
- * untrack_pfn_vma is called while unmapping a pfnmap for a region.
+ * untrack_pfn is called while unmapping a pfnmap for a region.
  * untrack can be called for a specific region indicated by pfn and size or
- * can be for the entire vma (in which case size can be zero).
+ * can be for the entire vma (in which case pfn, size are zero).
  */
-void untrack_pfn_vma(struct vm_area_struct *vma, unsigned long pfn,
-                        unsigned long size)
+void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
+                 unsigned long size)
 {
         resource_size_t paddr;
-        unsigned long vma_size = vma->vm_end - vma->vm_start;
+        unsigned long prot;
 
-        if (is_linear_pfn_mapping(vma)) {
-                /* free the whole chunk starting from vm_pgoff */
-                paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
-                free_pfn_range(paddr, vma_size);
+        if (!(vma->vm_flags & VM_PAT))
                 return;
+
+        /* free the chunk starting from pfn or the whole chunk */
+        paddr = (resource_size_t)pfn << PAGE_SHIFT;
+        if (!paddr && !size) {
+                if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
+                        WARN_ON_ONCE(1);
+                        return;
+                }
+
+                size = vma->vm_end - vma->vm_start;
         }
+        free_pfn_range(paddr, size);
+        vma->vm_flags &= ~VM_PAT;
 }
 
 pgprot_t pgprot_writecombine(pgprot_t prot)
diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
index 8acaddd0fb21..415f6c4ced36 100644
--- a/arch/x86/mm/pat_rbtree.c
+++ b/arch/x86/mm/pat_rbtree.c
@@ -12,7 +12,7 @@
 #include <linux/debugfs.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/rbtree.h>
+#include <linux/rbtree_augmented.h>
 #include <linux/sched.h>
 #include <linux/gfp.h>
 
@@ -54,29 +54,24 @@ static u64 get_subtree_max_end(struct rb_node *node)
         return ret;
 }
 
-/* Update 'subtree_max_end' for a node, based on node and its children */
-static void memtype_rb_augment_cb(struct rb_node *node, void *__unused)
+static u64 compute_subtree_max_end(struct memtype *data)
 {
-        struct memtype *data;
-        u64 max_end, child_max_end;
-
-        if (!node)
-                return;
+        u64 max_end = data->end, child_max_end;
 
-        data = container_of(node, struct memtype, rb);
-        max_end = data->end;
-
-        child_max_end = get_subtree_max_end(node->rb_right);
+        child_max_end = get_subtree_max_end(data->rb.rb_right);
         if (child_max_end > max_end)
                 max_end = child_max_end;
 
-        child_max_end = get_subtree_max_end(node->rb_left);
+        child_max_end = get_subtree_max_end(data->rb.rb_left);
         if (child_max_end > max_end)
                 max_end = child_max_end;
 
-        data->subtree_max_end = max_end;
+        return max_end;
 }
 
+RB_DECLARE_CALLBACKS(static, memtype_rb_augment_cb, struct memtype, rb,
+                     u64, subtree_max_end, compute_subtree_max_end)
+
 /* Find the first (lowest start addr) overlapping range from rb tree */
 static struct memtype *memtype_rb_lowest_match(struct rb_root *root,
                                 u64 start, u64 end)
@@ -179,15 +174,17 @@ static void memtype_rb_insert(struct rb_root *root, struct memtype *newdata)
                 struct memtype *data = container_of(*node, struct memtype, rb);
 
                 parent = *node;
+                if (data->subtree_max_end < newdata->end)
+                        data->subtree_max_end = newdata->end;
                 if (newdata->start <= data->start)
                         node = &((*node)->rb_left);
                 else if (newdata->start > data->start)
                         node = &((*node)->rb_right);
         }
 
+        newdata->subtree_max_end = newdata->end;
         rb_link_node(&newdata->rb, parent, node);
-        rb_insert_color(&newdata->rb, root);
-        rb_augment_insert(&newdata->rb, memtype_rb_augment_cb, NULL);
+        rb_insert_augmented(&newdata->rb, root, &memtype_rb_augment_cb);
 }
 
 int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
@@ -209,16 +206,13 @@ int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
 
 struct memtype *rbt_memtype_erase(u64 start, u64 end)
 {
-        struct rb_node *deepest;
         struct memtype *data;
 
         data = memtype_rb_exact_match(&memtype_rbroot, start, end);
         if (!data)
                 goto out;
 
-        deepest = rb_augment_erase_begin(&data->rb);
-        rb_erase(&data->rb, &memtype_rbroot);
-        rb_augment_erase_end(deepest, memtype_rb_augment_cb, NULL);
+        rb_erase_augmented(&data->rb, &memtype_rbroot, &memtype_rb_augment_cb);
 out:
         return data;
 }
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 5a16824cc2b3..fd28d86fe3d2 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2451,8 +2451,7 @@ int xen_remap_domain_mfn_range(struct vm_area_struct *vma,
 
         prot = __pgprot(pgprot_val(prot) | _PAGE_IOMAP);
 
-        BUG_ON(!((vma->vm_flags & (VM_PFNMAP | VM_RESERVED | VM_IO)) ==
-                                (VM_PFNMAP | VM_RESERVED | VM_IO)));
+        BUG_ON(!((vma->vm_flags & (VM_PFNMAP | VM_IO)) == (VM_PFNMAP | VM_IO)));
 
         rmd.mfn = mfn;
         rmd.prot = prot;