Merge branch 'akpm' (patchbomb from Andrew) into next

Merge misc updates from Andrew Morton:

 - a few fixes for 3.16.  Cc'ed to stable so they'll get there somehow.

 - various misc fixes and cleanups

 - most of the ocfs2 queue.  Review is slow...

 - most of MM.  The MM queue is pretty huge this time, but not much in
   the way of feature work.

 - some tweaks under kernel/

 - printk maintenance work

 - updates to lib/

 - checkpatch updates

 - tweaks to init/

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (276 commits)
  fs/autofs4/dev-ioctl.c: add __init to autofs_dev_ioctl_init
  fs/ncpfs/getopt.c: replace simple_strtoul by kstrtoul
  init/main.c: remove an ifdef
  kthreads: kill CLONE_KERNEL, change kernel_thread(kernel_init) to avoid CLONE_SIGHAND
  init/main.c: add initcall_blacklist kernel parameter
  init/main.c: don't use pr_debug()
  fs/binfmt_flat.c: make old_reloc() static
  fs/binfmt_elf.c: fix bool assignements
  fs/efs: convert printk(KERN_DEBUG to pr_debug
  fs/efs: add pr_fmt / use __func__
  fs/efs: convert printk to pr_foo()
  scripts/checkpatch.pl: device_initcall is not the only __initcall substitute
  checkpatch: check stable email address
  checkpatch: warn on unnecessary void function return statements
  checkpatch: prefer kstrto<foo> to sscanf(buf, "%<lhuidx>", &bar);
  checkpatch: add warning for kmalloc/kzalloc with multiply
  checkpatch: warn on #defines ending in semicolon
  checkpatch: make --strict a default for files in drivers/net and net/
  checkpatch: always warn on missing blank line after variable declaration block
  checkpatch: fix wildcard DT compatible string checking
  ...

279 files changed, 4712 insertions, 3514 deletions

diff --git a/Documentation/CodingStyle b/Documentation/CodingStyle
index 7fe0546c504a..6b6bef31e956 100644
--- a/Documentation/CodingStyle
+++ b/Documentation/CodingStyle
@@ -660,15 +660,23 @@ There are a number of driver model diagnostic macros in <linux/device.h>
 which you should use to make sure messages are matched to the right device
 and driver, and are tagged with the right level:  dev_err(), dev_warn(),
 dev_info(), and so forth.  For messages that aren't associated with a
-particular device, <linux/printk.h> defines pr_debug() and pr_info().
+particular device, <linux/printk.h> defines pr_notice(), pr_info(),
+pr_warn(), pr_err(), etc.
 
 Coming up with good debugging messages can be quite a challenge; and once
-you have them, they can be a huge help for remote troubleshooting.  Such
-messages should be compiled out when the DEBUG symbol is not defined (that
-is, by default they are not included).  When you use dev_dbg() or pr_debug(),
-that's automatic.  Many subsystems have Kconfig options to turn on -DDEBUG.
-A related convention uses VERBOSE_DEBUG to add dev_vdbg() messages to the
-ones already enabled by DEBUG.
+you have them, they can be a huge help for remote troubleshooting.  However
+debug message printing is handled differently than printing other non-debug
+messages.  While the other pr_XXX() functions print unconditionally,
+pr_debug() does not; it is compiled out by default, unless either DEBUG is
+defined or CONFIG_DYNAMIC_DEBUG is set.  That is true for dev_dbg() also,
+and a related convention uses VERBOSE_DEBUG to add dev_vdbg() messages to
+the ones already enabled by DEBUG.
+
+Many subsystems have Kconfig debug options to turn on -DDEBUG in the
+corresponding Makefile; in other cases specific files #define DEBUG.  And
+when a debug message should be unconditionally printed, such as if it is
+already inside a debug-related #ifdef secton, printk(KERN_DEBUG ...) can be
+used.
 
 
                 Chapter 14: Allocating memory
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index 2622115276aa..4937e6fff9b4 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -270,6 +270,11 @@ When oom event notifier is registered, event will be delivered.
 
 2.7 Kernel Memory Extension (CONFIG_MEMCG_KMEM)
 
+WARNING: Current implementation lacks reclaim support. That means allocation
+         attempts will fail when close to the limit even if there are plenty of
+         kmem available for reclaim. That makes this option unusable in real
+         life so DO NOT SELECT IT unless for development purposes.
+
 With the Kernel memory extension, the Memory Controller is able to limit
 the amount of kernel memory used by the system. Kernel memory is fundamentally
 different than user memory, since it can't be swapped out, which makes it
@@ -535,17 +540,15 @@ Note:
 
 5.3 swappiness
 
-Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only.
+Similar to /proc/sys/vm/swappiness, but only affecting reclaim that is
+triggered by this cgroup's hard limit.  The tunable in the root cgroup
+corresponds to the global swappiness setting.
+
 Please note that unlike the global swappiness, memcg knob set to 0
 really prevents from any swapping even if there is a swap storage
 available. This might lead to memcg OOM killer if there are no file
 pages to reclaim.
 
-Following cgroups' swappiness can't be changed.
-- root cgroup (uses /proc/sys/vm/swappiness).
-- a cgroup which uses hierarchy and it has other cgroup(s) below it.
-- a cgroup which uses hierarchy and not the root of hierarchy.
-
 5.4 failcnt
 
 A memory cgroup provides memory.failcnt and memory.memsw.failcnt files.
@@ -754,7 +757,6 @@ You can disable the OOM-killer by writing "1" to memory.oom_control file, as:
 
         #echo 1 > memory.oom_control
 
-This operation is only allowed to the top cgroup of a sub-hierarchy.
 If OOM-killer is disabled, tasks under cgroup will hang/sleep
 in memory cgroup's OOM-waitqueue when they request accountable memory.
 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index af55e13ace8f..9973a7e2e0ac 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -630,8 +630,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         Also note the kernel might malfunction if you disable
                         some critical bits.
 
-        cma=nn[MG]      [ARM,KNL]
-                        Sets the size of kernel global memory area for contiguous
+        cma=nn[MG]@[start[MG][-end[MG]]]
+                        [ARM,X86,KNL]
+                        Sets the size of kernel global memory area for
+                        contiguous memory allocations and optionally the
+                        placement constraint by the physical address range of
                         memory allocations. For more information, see
                         include/linux/dma-contiguous.h
 
@@ -1309,6 +1312,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         for working out where the kernel is dying during
                         startup.
 
+        initcall_blacklist=  [KNL] Do not execute a comma-separated list of
+                        initcall functions.  Useful for debugging built-in
+                        modules and initcalls.
+
         initrd=         [BOOT] Specify the location of the initial ramdisk
 
         inport.irq=     [HW] Inport (ATI XL and Microsoft) busmouse driver
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
index 58340d50f8a6..f304edb8fbe7 100644
--- a/Documentation/memory-hotplug.txt
+++ b/Documentation/memory-hotplug.txt
@@ -88,16 +88,21 @@ phase by hand.
 
 1.3. Unit of Memory online/offline operation
 ------------
-Memory hotplug uses SPARSEMEM memory model. SPARSEMEM divides the whole memory
-into chunks of the same size. The chunk is called a "section". The size of
-a section is architecture dependent. For example, power uses 16MiB, ia64 uses
-1GiB. The unit of online/offline operation is "one section". (see Section 3.)
+Memory hotplug uses SPARSEMEM memory model which allows memory to be divided
+into chunks of the same size. These chunks are called "sections". The size of
+a memory section is architecture dependent. For example, power uses 16MiB, ia64
+uses 1GiB.
 
-To determine the size of sections, please read this file:
+Memory sections are combined into chunks referred to as "memory blocks". The
+size of a memory block is architecture dependent and represents the logical
+unit upon which memory online/offline operations are to be performed. The
+default size of a memory block is the same as memory section size unless an
+architecture specifies otherwise. (see Section 3.)
+
+To determine the size (in bytes) of a memory block please read this file:
 
 /sys/devices/system/memory/block_size_bytes
 
-This file shows the size of sections in byte.
 
 -----------------------
 2. Kernel Configuration
@@ -123,42 +128,35 @@ config options.
     (CONFIG_ACPI_CONTAINER).
     This option can be kernel module too.
 
+
 --------------------------------
-4 sysfs files for memory hotplug
+3 sysfs files for memory hotplug
 --------------------------------
-All sections have their device information in sysfs.  Each section is part of
-a memory block under /sys/devices/system/memory as
+All memory blocks have their device information in sysfs.  Each memory block
+is described under /sys/devices/system/memory as
 
 /sys/devices/system/memory/memoryXXX
-(XXX is the section id.)
+(XXX is the memory block id.)
 
-Now, XXX is defined as (start_address_of_section / section_size) of the first
-section contained in the memory block.  The files 'phys_index' and
-'end_phys_index' under each directory report the beginning and end section id's
-for the memory block covered by the sysfs directory.  It is expected that all
+For the memory block covered by the sysfs directory.  It is expected that all
 memory sections in this range are present and no memory holes exist in the
 range. Currently there is no way to determine if there is a memory hole, but
 the existence of one should not affect the hotplug capabilities of the memory
 block.
 
-For example, assume 1GiB section size. A device for a memory starting at
+For example, assume 1GiB memory block size. A device for a memory starting at
 0x100000000 is /sys/device/system/memory/memory4
 (0x100000000 / 1Gib = 4)
 This device covers address range [0x100000000 ... 0x140000000)
 
-Under each section, you can see 4 or 5 files, the end_phys_index file being
-a recent addition and not present on older kernels.
+Under each memory block, you can see 4 files:
 
-/sys/devices/system/memory/memoryXXX/start_phys_index
-/sys/devices/system/memory/memoryXXX/end_phys_index
+/sys/devices/system/memory/memoryXXX/phys_index
 /sys/devices/system/memory/memoryXXX/phys_device
 /sys/devices/system/memory/memoryXXX/state
 /sys/devices/system/memory/memoryXXX/removable
 
-'phys_index'      : read-only and contains section id of the first section
-                    in the memory block, same as XXX.
-'end_phys_index'  : read-only and contains section id of the last section
-                    in the memory block.
+'phys_index'      : read-only and contains memory block id, same as XXX.
 'state'           : read-write
                     at read:  contains online/offline state of memory.
                     at write: user can specify "online_kernel",
@@ -185,6 +183,7 @@ For example:
 A backlink will also be created:
 /sys/devices/system/memory/memory9/node0 -> ../../node/node0
 
+
 --------------------------------
 4. Physical memory hot-add phase
 --------------------------------
@@ -227,11 +226,10 @@ You can tell the physical address of new memory to the kernel by
 
 % echo start_address_of_new_memory > /sys/devices/system/memory/probe
 
-Then, [start_address_of_new_memory, start_address_of_new_memory + section_size)
-memory range is hot-added. In this case, hotplug script is not called (in
-current implementation). You'll have to online memory by yourself.
-Please see "How to online memory" in this text.
-
+Then, [start_address_of_new_memory, start_address_of_new_memory +
+memory_block_size] memory range is hot-added. In this case, hotplug script is
+not called (in current implementation). You'll have to online memory by
+yourself.  Please see "How to online memory" in this text.
 
 
 ------------------------------
@@ -240,36 +238,36 @@ Please see "How to online memory" in this text.
 
 5.1. State of memory
 ------------
-To see (online/offline) state of memory section, read 'state' file.
+To see (online/offline) state of a memory block, read 'state' file.
 
 % cat /sys/device/system/memory/memoryXXX/state
 
 
-If the memory section is online, you'll read "online".
-If the memory section is offline, you'll read "offline".
+If the memory block is online, you'll read "online".
+If the memory block is offline, you'll read "offline".
 
 
 5.2. How to online memory
 ------------
 Even if the memory is hot-added, it is not at ready-to-use state.
-For using newly added memory, you have to "online" the memory section.
+For using newly added memory, you have to "online" the memory block.
 
-For onlining, you have to write "online" to the section's state file as:
+For onlining, you have to write "online" to the memory block's state file as:
 
 % echo online > /sys/devices/system/memory/memoryXXX/state
 
-This onlining will not change the ZONE type of the target memory section,
-If the memory section is in ZONE_NORMAL, you can change it to ZONE_MOVABLE:
+This onlining will not change the ZONE type of the target memory block,
+If the memory block is in ZONE_NORMAL, you can change it to ZONE_MOVABLE:
 
 % echo online_movable > /sys/devices/system/memory/memoryXXX/state
-(NOTE: current limit: this memory section must be adjacent to ZONE_MOVABLE)
+(NOTE: current limit: this memory block must be adjacent to ZONE_MOVABLE)
 
-And if the memory section is in ZONE_MOVABLE, you can change it to ZONE_NORMAL:
+And if the memory block is in ZONE_MOVABLE, you can change it to ZONE_NORMAL:
 
 % echo online_kernel > /sys/devices/system/memory/memoryXXX/state
-(NOTE: current limit: this memory section must be adjacent to ZONE_NORMAL)
+(NOTE: current limit: this memory block must be adjacent to ZONE_NORMAL)
 
-After this, section memoryXXX's state will be 'online' and the amount of
+After this, memory block XXX's state will be 'online' and the amount of
 available memory will be increased.
 
 Currently, newly added memory is added as ZONE_NORMAL (for powerpc, ZONE_DMA).
@@ -284,22 +282,22 @@ This may be changed in future.
 6.1 Memory offline and ZONE_MOVABLE
 ------------
 Memory offlining is more complicated than memory online. Because memory offline
-has to make the whole memory section be unused, memory offline can fail if
-the section includes memory which cannot be freed.
+has to make the whole memory block be unused, memory offline can fail if
+the memory block includes memory which cannot be freed.
 
 In general, memory offline can use 2 techniques.
 
-(1) reclaim and free all memory in the section.
-(2) migrate all pages in the section.
+(1) reclaim and free all memory in the memory block.
+(2) migrate all pages in the memory block.
 
 In the current implementation, Linux's memory offline uses method (2), freeing
-all  pages in the section by page migration. But not all pages are
+all  pages in the memory block by page migration. But not all pages are
 migratable. Under current Linux, migratable pages are anonymous pages and
-page caches. For offlining a section by migration, the kernel has to guarantee
-that the section contains only migratable pages.
+page caches. For offlining a memory block by migration, the kernel has to
+guarantee that the memory block contains only migratable pages.
 
-Now, a boot option for making a section which consists of migratable pages is
-supported. By specifying "kernelcore=" or "movablecore=" boot option, you can
+Now, a boot option for making a memory block which consists of migratable pages
+is supported. By specifying "kernelcore=" or "movablecore=" boot option, you can
 create ZONE_MOVABLE...a zone which is just used for movable pages.
 (See also Documentation/kernel-parameters.txt)
 
@@ -315,28 +313,27 @@ creates ZONE_MOVABLE as following.
   Size of memory for movable pages (for offline) is ZZZZ.
 
 
-Note) Unfortunately, there is no information to show which section belongs
+Note: Unfortunately, there is no information to show which memory block belongs
 to ZONE_MOVABLE. This is TBD.
 
 
 6.2. How to offline memory
 ------------
-You can offline a section by using the same sysfs interface that was used in
-memory onlining.
+You can offline a memory block by using the same sysfs interface that was used
+in memory onlining.
 
 % echo offline > /sys/devices/system/memory/memoryXXX/state
 
-If offline succeeds, the state of the memory section is changed to be "offline".
+If offline succeeds, the state of the memory block is changed to be "offline".
 If it fails, some error core (like -EBUSY) will be returned by the kernel.
-Even if a section does not belong to ZONE_MOVABLE, you can try to offline it.
-If it doesn't contain 'unmovable' memory, you'll get success.
+Even if a memory block does not belong to ZONE_MOVABLE, you can try to offline
+it.  If it doesn't contain 'unmovable' memory, you'll get success.
 
-A section under ZONE_MOVABLE is considered to be able to be offlined easily.
-But under some busy state, it may return -EBUSY. Even if a memory section
-cannot be offlined due to -EBUSY, you can retry offlining it and may be able to
-offline it (or not).
-(For example, a page is referred to by some kernel internal call and released
- soon.)
+A memory block under ZONE_MOVABLE is considered to be able to be offlined
+easily.  But under some busy state, it may return -EBUSY. Even if a memory
+block cannot be offlined due to -EBUSY, you can retry offlining it and may be
+able to offline it (or not). (For example, a page is referred to by some kernel
+internal call and released soon.)
 
 Consideration:
 Memory hotplug's design direction is to make the possibility of memory offlining
@@ -373,11 +370,11 @@ MEMORY_GOING_OFFLINE
   Generated to begin the process of offlining memory. Allocations are no
   longer possible from the memory but some of the memory to be offlined
   is still in use. The callback can be used to free memory known to a
-  subsystem from the indicated memory section.
+  subsystem from the indicated memory block.
 
 MEMORY_CANCEL_OFFLINE
   Generated if MEMORY_GOING_OFFLINE fails. Memory is available again from
-  the section that we attempted to offline.
+  the memory block that we attempted to offline.
 
 MEMORY_OFFLINE
   Generated after offlining memory is complete.
@@ -413,8 +410,8 @@ node if necessary.
 --------------
   - allowing memory hot-add to ZONE_MOVABLE. maybe we need some switch like
     sysctl or new control file.
-  - showing memory section and physical device relationship.
-  - showing memory section is under ZONE_MOVABLE or not
+  - showing memory block and physical device relationship.
+  - showing memory block is under ZONE_MOVABLE or not
   - test and make it better memory offlining.
   - support HugeTLB page migration and offlining.
   - memmap removing at memory offline.
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index dd9d0e33b443..bd4b34c03738 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -746,8 +746,8 @@ Changing this takes effect whenever an application requests memory.
 vfs_cache_pressure
 ------------------
 
-Controls the tendency of the kernel to reclaim the memory which is used for
-caching of directory and inode objects.
+This percentage value controls the tendency of the kernel to reclaim
+the memory which is used for caching of directory and inode objects.
 
 At the default value of vfs_cache_pressure=100 the kernel will attempt to
 reclaim dentries and inodes at a "fair" rate with respect to pagecache and
@@ -757,6 +757,11 @@ never reclaim dentries and inodes due to memory pressure and this can easily
 lead to out-of-memory conditions. Increasing vfs_cache_pressure beyond 100
 causes the kernel to prefer to reclaim dentries and inodes.
 
+Increasing vfs_cache_pressure significantly beyond 100 may have negative
+performance impact. Reclaim code needs to take various locks to find freeable
+directory and inode objects. With vfs_cache_pressure=1000, it will look for
+ten times more freeable objects than there are.
+
 ==============================================================
 
 zone_reclaim_mode:
@@ -772,16 +777,17 @@ This is value ORed together of
 2       = Zone reclaim writes dirty pages out
 4       = Zone reclaim swaps pages
 
-zone_reclaim_mode is set during bootup to 1 if it is determined that pages
-from remote zones will cause a measurable performance reduction. The
-page allocator will then reclaim easily reusable pages (those page
-cache pages that are currently not used) before allocating off node pages.
-
-It may be beneficial to switch off zone reclaim if the system is
-used for a file server and all of memory should be used for caching files
-from disk. In that case the caching effect is more important than
+zone_reclaim_mode is disabled by default.  For file servers or workloads
+that benefit from having their data cached, zone_reclaim_mode should be
+left disabled as the caching effect is likely to be more important than
 data locality.
 
+zone_reclaim may be enabled if it's known that the workload is partitioned
+such that each partition fits within a NUMA node and that accessing remote
+memory would cause a measurable performance reduction.  The page allocator
+will then reclaim easily reusable pages (those page cache pages that are
+currently not used) before allocating off node pages.
+
 Allowing zone reclaim to write out pages stops processes that are
 writing large amounts of data from dirtying pages on other nodes. Zone
 reclaim will write out dirty pages if a zone fills up and so effectively
diff --git a/Documentation/vm/hwpoison.txt b/Documentation/vm/hwpoison.txt
index 550068466605..6ae89a9edf2a 100644
--- a/Documentation/vm/hwpoison.txt
+++ b/Documentation/vm/hwpoison.txt
@@ -84,6 +84,11 @@ PR_MCE_KILL
                 PR_MCE_KILL_EARLY: Early kill
                 PR_MCE_KILL_LATE:  Late kill
                 PR_MCE_KILL_DEFAULT: Use system global default
+        Note that if you want to have a dedicated thread which handles
+        the SIGBUS(BUS_MCEERR_AO) on behalf of the process, you should
+        call prctl(PR_MCE_KILL_EARLY) on the designated thread. Otherwise,
+        the SIGBUS is sent to the main thread.
+
 PR_MCE_KILL_GET
         return current mode
 
diff --git a/MAINTAINERS b/MAINTAINERS
index e433e45814af..7d101d5ba953 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3882,6 +3882,11 @@ L:	kvm@vger.kernel.org
 S:      Supported
 F:      drivers/uio/uio_pci_generic.c
 
+GET_MAINTAINER SCRIPT
+M:      Joe Perches <joe@perches.com>
+S:      Maintained
+F:      scripts/get_maintainer.pl
+
 GFS2 FILE SYSTEM
 M:      Steven Whitehouse <swhiteho@redhat.com>
 L:      cluster-devel@redhat.com
@@ -4006,9 +4011,8 @@ S:	Odd Fixes
 F:      drivers/media/usb/hdpvr/
 
 HWPOISON MEMORY FAILURE HANDLING
-M:      Andi Kleen <andi@firstfloor.org>
+M:      Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
 L:      linux-mm@kvack.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6.git hwpoison
 S:      Maintained
 F:      mm/memory-failure.c
 F:      mm/hwpoison-inject.c
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 73a7450ee622..1badf9b84b51 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -86,12 +86,13 @@ static void show_faulting_vma(unsigned long address, char *buf)
         unsigned long ino = 0;
         dev_t dev = 0;
         char *nm = buf;
+        struct mm_struct *active_mm = current->active_mm;
 
         /* can't use print_vma_addr() yet as it doesn't check for
          * non-inclusive vma
          */
-
-        vma = find_vma(current->active_mm, address);
+        down_read(&active_mm->mmap_sem);
+        vma = find_vma(active_mm, address);
 
         /* check against the find_vma( ) behaviour which returns the next VMA
          * if the container VMA is not found
@@ -110,9 +111,10 @@ static void show_faulting_vma(unsigned long address, char *buf)
                         vma->vm_start < TASK_UNMAPPED_BASE ?
                                 address : address - vma->vm_start,
                         nm, vma->vm_start, vma->vm_end);
-        } else {
+        } else
                 pr_info("    @No matching VMA found\n");
-        }
+
+        up_read(&active_mm->mmap_sem);
 }
 
 static void show_ecr_verbose(struct pt_regs *regs)
diff --git a/arch/arm/mm/hugetlbpage.c b/arch/arm/mm/hugetlbpage.c
index 54ee6163c181..66781bf34077 100644
--- a/arch/arm/mm/hugetlbpage.c
+++ b/arch/arm/mm/hugetlbpage.c
@@ -56,8 +56,3 @@ int pmd_huge(pmd_t pmd)
 {
         return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
 }
-
-int pmd_huge_support(void)
-{
-        return 1;
-}
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 31eb959e9aa8..023747bf4dd7 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -58,11 +58,6 @@ int pud_huge(pud_t pud)
 #endif
 }
 
-int pmd_huge_support(void)
-{
-        return 1;
-}
-
 static __init int setup_hugepagesz(char *opt)
 {
         unsigned long ps = memparse(opt, &opt);
diff --git a/arch/blackfin/include/asm/unistd.h b/arch/blackfin/include/asm/unistd.h
index c35414bdf7bd..c8c8ff9eff61 100644
--- a/arch/blackfin/include/asm/unistd.h
+++ b/arch/blackfin/include/asm/unistd.h
@@ -12,7 +12,6 @@
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_FADVISE64
 #define __ARCH_WANT_SYS_GETPGRP
diff --git a/arch/cris/include/asm/unistd.h b/arch/cris/include/asm/unistd.h
index 5cc7d1991e48..0f40fed1ba25 100644
--- a/arch/cris/include/asm/unistd.h
+++ b/arch/cris/include/asm/unistd.h
@@ -15,7 +15,6 @@
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/frv/include/asm/unistd.h b/arch/frv/include/asm/unistd.h
index 70ec7293dce7..17b5df8fc28a 100644
--- a/arch/frv/include/asm/unistd.h
+++ b/arch/frv/include/asm/unistd.h
@@ -13,7 +13,6 @@
 /* #define __ARCH_WANT_SYS_GETHOSTNAME */
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
-/* #define __ARCH_WANT_SYS_SGETMASK */
 /* #define __ARCH_WANT_SYS_SIGNAL */
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/ia64/include/asm/topology.h b/arch/ia64/include/asm/topology.h
index 3202aa74e0d6..6437ca21f61b 100644
--- a/arch/ia64/include/asm/topology.h
+++ b/arch/ia64/include/asm/topology.h
@@ -21,7 +21,8 @@
 #define PENALTY_FOR_NODE_WITH_CPUS 255
 
 /*
- * Distance above which we begin to use zone reclaim
+ * Nodes within this distance are eligible for reclaim by zone_reclaim() when
+ * zone_reclaim_mode is enabled.
  */
 #define RECLAIM_DISTANCE 15
 
diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index 68232db98baa..76069c18ee42 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c
@@ -114,11 +114,6 @@ int pud_huge(pud_t pud)
         return 0;
 }
 
-int pmd_huge_support(void)
-{
-        return 0;
-}
-
 struct page *
 follow_huge_pmd(struct mm_struct *mm, unsigned long address, pmd_t *pmd, int write)
 {
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 33afa56ad47a..1fcdd344c7ad 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -13,7 +13,6 @@
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
index 042431509b56..3c52fa6d0f8e 100644
--- a/arch/metag/mm/hugetlbpage.c
+++ b/arch/metag/mm/hugetlbpage.c
@@ -110,11 +110,6 @@ int pud_huge(pud_t pud)
         return 0;
 }
 
-int pmd_huge_support(void)
-{
-        return 1;
-}
-
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                              pmd_t *pmd, int write)
 {
diff --git a/arch/microblaze/include/asm/unistd.h b/arch/microblaze/include/asm/unistd.h
index b14232b6878f..fd56a8f66489 100644
--- a/arch/microblaze/include/asm/unistd.h
+++ b/arch/microblaze/include/asm/unistd.h
@@ -19,7 +19,6 @@
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index 413d6c612bec..e55813029d5a 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -29,7 +29,6 @@
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_UTIME
 #define __ARCH_WANT_SYS_WAITPID
 #define __ARCH_WANT_SYS_SOCKETCALL
diff --git a/arch/mips/mm/hugetlbpage.c b/arch/mips/mm/hugetlbpage.c
index 77e0ae036e7c..4ec8ee10d371 100644
--- a/arch/mips/mm/hugetlbpage.c
+++ b/arch/mips/mm/hugetlbpage.c
@@ -84,11 +84,6 @@ int pud_huge(pud_t pud)
         return (pud_val(pud) & _PAGE_HUGE) != 0;
 }
 
-int pmd_huge_support(void)
-{
-        return 1;
-}
-
 struct page *
 follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                 pmd_t *pmd, int write)
diff --git a/arch/mn10300/include/asm/unistd.h b/arch/mn10300/include/asm/unistd.h
index 9d4e2d1ef90e..0522468f488b 100644
--- a/arch/mn10300/include/asm/unistd.h
+++ b/arch/mn10300/include/asm/unistd.h
@@ -26,7 +26,6 @@
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/parisc/include/asm/unistd.h b/arch/parisc/include/asm/unistd.h
index 74d835820ee7..5f4c68daa261 100644
--- a/arch/parisc/include/asm/unistd.h
+++ b/arch/parisc/include/asm/unistd.h
@@ -145,7 +145,6 @@ type name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, type5 arg5)	\
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_COMPAT_SYS_TIME
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index 3ebb188c3ff5..d98c1ecc3266 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -44,6 +44,12 @@ static inline int pte_present(pte_t pte)
         return pte_val(pte) & (_PAGE_PRESENT | _PAGE_NUMA);
 }
 
+#define pte_present_nonuma pte_present_nonuma
+static inline int pte_present_nonuma(pte_t pte)
+{
+        return pte_val(pte) & (_PAGE_PRESENT);
+}
+
 #define pte_numa pte_numa
 static inline int pte_numa(pte_t pte)
 {
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index c9202151079f..6c8a8c5a37a1 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -9,12 +9,8 @@ struct device_node;
 #ifdef CONFIG_NUMA
 
 /*
- * Before going off node we want the VM to try and reclaim from the local
- * node. It does this if the remote distance is larger than RECLAIM_DISTANCE.
- * With the default REMOTE_DISTANCE of 20 and the default RECLAIM_DISTANCE of
- * 20, we never reclaim and go off node straight away.
- *
- * To fix this we choose a smaller value of RECLAIM_DISTANCE.
+ * If zone_reclaim_mode is enabled, a RECLAIM_DISTANCE of 10 will mean that
+ * all zones on all nodes will be eligible for zone_reclaim().
  */
 #define RECLAIM_DISTANCE 10
 
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index 9b892bbd9d84..5ce5552ab9f5 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -29,7 +29,6 @@
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_IPC
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index eb923654ba80..7e70ae968e5f 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -86,11 +86,6 @@ int pgd_huge(pgd_t pgd)
          */
         return ((pgd_val(pgd) & 0x3) != 0x0);
 }
-
-int pmd_huge_support(void)
-{
-        return 1;
-}
 #else
 int pmd_huge(pmd_t pmd)
 {
@@ -106,11 +101,6 @@ int pgd_huge(pgd_t pgd)
 {
         return 0;
 }
-
-int pmd_huge_support(void)
-{
-        return 0;
-}
 #endif
 
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
index 0727a55d87d9..0ff66a7e29bb 100644
--- a/arch/s390/mm/hugetlbpage.c
+++ b/arch/s390/mm/hugetlbpage.c
@@ -220,11 +220,6 @@ int pud_huge(pud_t pud)
         return 0;
 }
 
-int pmd_huge_support(void)
-{
-        return 1;
-}
-
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                              pmd_t *pmdp, int write)
 {
diff --git a/arch/sh/include/asm/unistd.h b/arch/sh/include/asm/unistd.h
index e77816c4b9bc..126fe8340b22 100644
--- a/arch/sh/include/asm/unistd.h
+++ b/arch/sh/include/asm/unistd.h
@@ -11,7 +11,6 @@
 # define __ARCH_WANT_SYS_GETHOSTNAME
 # define __ARCH_WANT_SYS_IPC
 # define __ARCH_WANT_SYS_PAUSE
-# define __ARCH_WANT_SYS_SGETMASK
 # define __ARCH_WANT_SYS_SIGNAL
 # define __ARCH_WANT_SYS_TIME
 # define __ARCH_WANT_SYS_UTIME
diff --git a/arch/sh/kernel/hw_breakpoint.c b/arch/sh/kernel/hw_breakpoint.c
index f9173766ec4b..2197fc584186 100644
--- a/arch/sh/kernel/hw_breakpoint.c
+++ b/arch/sh/kernel/hw_breakpoint.c
@@ -52,7 +52,7 @@ int arch_install_hw_breakpoint(struct perf_event *bp)
         int i;
 
         for (i = 0; i < sh_ubc->num_events; i++) {
-                struct perf_event **slot = &__get_cpu_var(bp_per_reg[i]);
+                struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]);
 
                 if (!*slot) {
                         *slot = bp;
@@ -84,7 +84,7 @@ void arch_uninstall_hw_breakpoint(struct perf_event *bp)
         int i;
 
         for (i = 0; i < sh_ubc->num_events; i++) {
-                struct perf_event **slot = &__get_cpu_var(bp_per_reg[i]);
+                struct perf_event **slot = this_cpu_ptr(&bp_per_reg[i]);
 
                 if (*slot == bp) {
                         *slot = NULL;
diff --git a/arch/sh/kernel/kprobes.c b/arch/sh/kernel/kprobes.c
index 42b46e61a2d5..83acbf3f6de8 100644
--- a/arch/sh/kernel/kprobes.c
+++ b/arch/sh/kernel/kprobes.c
@@ -102,7 +102,7 @@ int __kprobes kprobe_handle_illslot(unsigned long pc)
 
 void __kprobes arch_remove_kprobe(struct kprobe *p)
 {
-        struct kprobe *saved = &__get_cpu_var(saved_next_opcode);
+        struct kprobe *saved = this_cpu_ptr(&saved_next_opcode);
 
         if (saved->addr) {
                 arch_disarm_kprobe(p);
@@ -111,7 +111,7 @@ void __kprobes arch_remove_kprobe(struct kprobe *p)
                 saved->addr = NULL;
                 saved->opcode = 0;
 
-                saved = &__get_cpu_var(saved_next_opcode2);
+                saved = this_cpu_ptr(&saved_next_opcode2);
                 if (saved->addr) {
                         arch_disarm_kprobe(saved);
 
@@ -129,14 +129,14 @@ static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
 
 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
-        __get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
+        __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
         kcb->kprobe_status = kcb->prev_kprobe.status;
 }
 
 static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
                                          struct kprobe_ctlblk *kcb)
 {
-        __get_cpu_var(current_kprobe) = p;
+        __this_cpu_write(current_kprobe, p);
 }
 
 /*
@@ -146,15 +146,15 @@ static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
  */
 static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
 {
-        __get_cpu_var(saved_current_opcode).addr = (kprobe_opcode_t *)regs->pc;
+        __this_cpu_write(saved_current_opcode.addr, (kprobe_opcode_t *)regs->pc);
 
         if (p != NULL) {
                 struct kprobe *op1, *op2;
 
                 arch_disarm_kprobe(p);
 
-                op1 = &__get_cpu_var(saved_next_opcode);
-                op2 = &__get_cpu_var(saved_next_opcode2);
+                op1 = this_cpu_ptr(&saved_next_opcode);
+                op2 = this_cpu_ptr(&saved_next_opcode2);
 
                 if (OPCODE_JSR(p->opcode) || OPCODE_JMP(p->opcode)) {
                         unsigned int reg_nr = ((p->opcode >> 8) & 0x000F);
@@ -249,7 +249,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                         kcb->kprobe_status = KPROBE_REENTER;
                         return 1;
                 } else {
-                        p = __get_cpu_var(current_kprobe);
+                        p = __this_cpu_read(current_kprobe);
                         if (p->break_handler && p->break_handler(p, regs)) {
                                 goto ss_probe;
                         }
@@ -336,9 +336,9 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
                         continue;
 
                 if (ri->rp && ri->rp->handler) {
-                        __get_cpu_var(current_kprobe) = &ri->rp->kp;
+                        __this_cpu_write(current_kprobe, &ri->rp->kp);
                         ri->rp->handler(ri, regs);
-                        __get_cpu_var(current_kprobe) = NULL;
+                        __this_cpu_write(current_kprobe, NULL);
                 }
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
@@ -383,19 +383,19 @@ static int __kprobes post_kprobe_handler(struct pt_regs *regs)
                 cur->post_handler(cur, regs, 0);
         }
 
-        p = &__get_cpu_var(saved_next_opcode);
+        p = this_cpu_ptr(&saved_next_opcode);
         if (p->addr) {
                 arch_disarm_kprobe(p);
                 p->addr = NULL;
                 p->opcode = 0;
 
-                addr = __get_cpu_var(saved_current_opcode).addr;
-                __get_cpu_var(saved_current_opcode).addr = NULL;
+                addr = __this_cpu_read(saved_current_opcode.addr);
+                __this_cpu_write(saved_current_opcode.addr, NULL);
 
                 p = get_kprobe(addr);
                 arch_arm_kprobe(p);
 
-                p = &__get_cpu_var(saved_next_opcode2);
+                p = this_cpu_ptr(&saved_next_opcode2);
                 if (p->addr) {
                         arch_disarm_kprobe(p);
                         p->addr = NULL;
@@ -511,7 +511,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
                                 if (kprobe_handler(args->regs)) {
                                         ret = NOTIFY_STOP;
                                 } else {
-                                        p = __get_cpu_var(current_kprobe);
+                                        p = __this_cpu_read(current_kprobe);
                                         if (p->break_handler &&
                                             p->break_handler(p, args->regs))
                                                 ret = NOTIFY_STOP;
diff --git a/arch/sh/kernel/localtimer.c b/arch/sh/kernel/localtimer.c
index 8bfc6dfa8b94..b880a7e2ace7 100644
--- a/arch/sh/kernel/localtimer.c
+++ b/arch/sh/kernel/localtimer.c
@@ -32,7 +32,7 @@ static DEFINE_PER_CPU(struct clock_event_device, local_clockevent);
  */
 void local_timer_interrupt(void)
 {
-        struct clock_event_device *clk = &__get_cpu_var(local_clockevent);
+        struct clock_event_device *clk = this_cpu_ptr(&local_clockevent);
 
         irq_enter();
         clk->event_handler(clk);
diff --git a/arch/sh/kernel/perf_event.c b/arch/sh/kernel/perf_event.c
index b9cefebda55c..02331672b6db 100644
--- a/arch/sh/kernel/perf_event.c
+++ b/arch/sh/kernel/perf_event.c
@@ -227,7 +227,7 @@ again:
 
 static void sh_pmu_stop(struct perf_event *event, int flags)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         int idx = hwc->idx;
 
@@ -245,7 +245,7 @@ static void sh_pmu_stop(struct perf_event *event, int flags)
 
 static void sh_pmu_start(struct perf_event *event, int flags)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         int idx = hwc->idx;
 
@@ -262,7 +262,7 @@ static void sh_pmu_start(struct perf_event *event, int flags)
 
 static void sh_pmu_del(struct perf_event *event, int flags)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
 
         sh_pmu_stop(event, PERF_EF_UPDATE);
         __clear_bit(event->hw.idx, cpuc->used_mask);
@@ -272,7 +272,7 @@ static void sh_pmu_del(struct perf_event *event, int flags)
 
 static int sh_pmu_add(struct perf_event *event, int flags)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         int idx = hwc->idx;
         int ret = -EAGAIN;
diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c
index 86a7936a980b..fc5acfc93c92 100644
--- a/arch/sh/kernel/smp.c
+++ b/arch/sh/kernel/smp.c
@@ -111,7 +111,7 @@ void play_dead_common(void)
         irq_ctx_exit(raw_smp_processor_id());
         mb();
 
-        __get_cpu_var(cpu_state) = CPU_DEAD;
+        __this_cpu_write(cpu_state, CPU_DEAD);
         local_irq_disable();
 }
 
diff --git a/arch/sh/mm/hugetlbpage.c b/arch/sh/mm/hugetlbpage.c
index 0d676a41081e..d7762349ea48 100644
--- a/arch/sh/mm/hugetlbpage.c
+++ b/arch/sh/mm/hugetlbpage.c
@@ -83,11 +83,6 @@ int pud_huge(pud_t pud)
         return 0;
 }
 
-int pmd_huge_support(void)
-{
-        return 0;
-}
-
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                              pmd_t *pmd, int write)
 {
diff --git a/arch/sparc/include/asm/unistd.h b/arch/sparc/include/asm/unistd.h
index dfa53fdd5cbc..0aac1e8f2968 100644
--- a/arch/sparc/include/asm/unistd.h
+++ b/arch/sparc/include/asm/unistd.h
@@ -25,7 +25,6 @@
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
-#define __ARCH_WANT_SYS_SGETMASK
 #define __ARCH_WANT_SYS_SIGNAL
 #define __ARCH_WANT_SYS_TIME
 #define __ARCH_WANT_SYS_UTIME
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index 9bd9ce80bf77..d329537739c6 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -231,11 +231,6 @@ int pud_huge(pud_t pud)
         return 0;
 }
 
-int pmd_huge_support(void)
-{
-        return 0;
-}
-
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                              pmd_t *pmd, int write)
 {
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c
index 004ba568d93f..33294fdc402e 100644
--- a/arch/tile/mm/homecache.c
+++ b/arch/tile/mm/homecache.c
@@ -417,7 +417,7 @@ void __homecache_free_pages(struct page *page, unsigned int order)
         if (put_page_testzero(page)) {
                 homecache_change_page_home(page, order, PAGE_HOME_HASH);
                 if (order == 0) {
-                        free_hot_cold_page(page, 0);
+                        free_hot_cold_page(page, false);
                 } else {
                         init_page_count(page);
                         __free_pages(page, order);
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
index 0cb3bbaa580c..e514899e1100 100644
--- a/arch/tile/mm/hugetlbpage.c
+++ b/arch/tile/mm/hugetlbpage.c
@@ -166,11 +166,6 @@ int pud_huge(pud_t pud)
         return !!(pud_val(pud) & _PAGE_HUGE_PAGE);
 }
 
-int pmd_huge_support(void)
-{
-        return 1;
-}
-
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                              pmd_t *pmd, int write)
 {
diff --git a/arch/unicore32/mm/ioremap.c b/arch/unicore32/mm/ioremap.c
index 13068ee22f33..bf012b2b71a9 100644
--- a/arch/unicore32/mm/ioremap.c
+++ b/arch/unicore32/mm/ioremap.c
@@ -144,11 +144,11 @@ void __iomem *__uc32_ioremap_pfn_caller(unsigned long pfn,
          * Don't allow RAM to be mapped
          */
         if (pfn_valid(pfn)) {
-                printk(KERN_WARNING "BUG: Your driver calls ioremap() on\n"
+                WARN(1, "BUG: Your driver calls ioremap() on\n"
                         "system memory.  This leads to architecturally\n"
                         "unpredictable behaviour, and ioremap() will fail in\n"
                         "the next kernel release. Please fix your driver.\n");
-                WARN_ON(1);
+                return NULL;
         }
 
         type = get_mem_type(mtype);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 7a01d4335029..272b493ea1bf 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -26,7 +26,7 @@ config X86
         select ARCH_MIGHT_HAVE_PC_SERIO
         select HAVE_AOUT if X86_32
         select HAVE_UNSTABLE_SCHED_CLOCK
-        select ARCH_SUPPORTS_NUMA_BALANCING
+        select ARCH_SUPPORTS_NUMA_BALANCING if X86_64
         select ARCH_SUPPORTS_INT128 if X86_64
         select ARCH_WANTS_PROT_NUMA_PROT_NONE
         select HAVE_IDE
@@ -41,7 +41,7 @@ config X86
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select ARCH_WANT_FRAME_POINTERS
         select HAVE_DMA_ATTRS
-        select HAVE_DMA_CONTIGUOUS if !SWIOTLB
+        select HAVE_DMA_CONTIGUOUS
         select HAVE_KRETPROBES
         select GENERIC_EARLY_IOREMAP
         select HAVE_OPTPROBES
@@ -105,7 +105,7 @@ config X86
         select HAVE_ARCH_SECCOMP_FILTER
         select BUILDTIME_EXTABLE_SORT
         select GENERIC_CMOS_UPDATE
-        select HAVE_ARCH_SOFT_DIRTY
+        select HAVE_ARCH_SOFT_DIRTY if X86_64
         select CLOCKSOURCE_WATCHDOG
         select GENERIC_CLOCKEVENTS
         select ARCH_CLOCKSOURCE_DATA
@@ -1874,6 +1874,10 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
         def_bool y
         depends on X86_64 || X86_PAE
 
+config ARCH_ENABLE_HUGEPAGE_MIGRATION
+        def_bool y
+        depends on X86_64 && HUGETLB_PAGE && MIGRATION
+
 menu "Power management and ACPI options"
 
 config ARCH_HIBERNATION_HEADER
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 6e4ce2df87cf..958b90f761e5 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -176,8 +176,6 @@ int mce_available(struct cpuinfo_x86 *c);
 DECLARE_PER_CPU(unsigned, mce_exception_count);
 DECLARE_PER_CPU(unsigned, mce_poll_count);
 
-extern atomic_t mce_entry;
-
 typedef DECLARE_BITMAP(mce_banks_t, MAX_NR_BANKS);
 DECLARE_PER_CPU(mce_banks_t, mce_poll_banks);
 
diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
index 0d193e234647..206a87fdd22d 100644
--- a/arch/x86/include/asm/pgtable-2level.h
+++ b/arch/x86/include/asm/pgtable-2level.h
@@ -62,66 +62,14 @@ static inline unsigned long pte_bitop(unsigned long value, unsigned int rightshi
         return ((value >> rightshift) & mask) << leftshift;
 }
 
-#ifdef CONFIG_MEM_SOFT_DIRTY
-
-/*
- * Bits _PAGE_BIT_PRESENT, _PAGE_BIT_FILE, _PAGE_BIT_SOFT_DIRTY and
- * _PAGE_BIT_PROTNONE are taken, split up the 28 bits of offset
- * into this range.
- */
-#define PTE_FILE_MAX_BITS       28
-#define PTE_FILE_SHIFT1         (_PAGE_BIT_PRESENT + 1)
-#define PTE_FILE_SHIFT2         (_PAGE_BIT_FILE + 1)
-#define PTE_FILE_SHIFT3         (_PAGE_BIT_PROTNONE + 1)
-#define PTE_FILE_SHIFT4         (_PAGE_BIT_SOFT_DIRTY + 1)
-#define PTE_FILE_BITS1          (PTE_FILE_SHIFT2 - PTE_FILE_SHIFT1 - 1)
-#define PTE_FILE_BITS2          (PTE_FILE_SHIFT3 - PTE_FILE_SHIFT2 - 1)
-#define PTE_FILE_BITS3          (PTE_FILE_SHIFT4 - PTE_FILE_SHIFT3 - 1)
-
-#define PTE_FILE_MASK1          ((1U << PTE_FILE_BITS1) - 1)
-#define PTE_FILE_MASK2          ((1U << PTE_FILE_BITS2) - 1)
-#define PTE_FILE_MASK3          ((1U << PTE_FILE_BITS3) - 1)
-
-#define PTE_FILE_LSHIFT2        (PTE_FILE_BITS1)
-#define PTE_FILE_LSHIFT3        (PTE_FILE_BITS1 + PTE_FILE_BITS2)
-#define PTE_FILE_LSHIFT4        (PTE_FILE_BITS1 + PTE_FILE_BITS2 + PTE_FILE_BITS3)
-
-static __always_inline pgoff_t pte_to_pgoff(pte_t pte)
-{
-        return (pgoff_t)
-                (pte_bitop(pte.pte_low, PTE_FILE_SHIFT1, PTE_FILE_MASK1,  0)                +
-                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT2, PTE_FILE_MASK2,  PTE_FILE_LSHIFT2) +
-                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT3, PTE_FILE_MASK3,  PTE_FILE_LSHIFT3) +
-                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT4,           -1UL,  PTE_FILE_LSHIFT4));
-}
-
-static __always_inline pte_t pgoff_to_pte(pgoff_t off)
-{
-        return (pte_t){
-                .pte_low =
-                        pte_bitop(off,                0, PTE_FILE_MASK1,  PTE_FILE_SHIFT1) +
-                        pte_bitop(off, PTE_FILE_LSHIFT2, PTE_FILE_MASK2,  PTE_FILE_SHIFT2) +
-                        pte_bitop(off, PTE_FILE_LSHIFT3, PTE_FILE_MASK3,  PTE_FILE_SHIFT3) +
-                        pte_bitop(off, PTE_FILE_LSHIFT4,           -1UL,  PTE_FILE_SHIFT4) +
-                        _PAGE_FILE,
-        };
-}
-
-#else /* CONFIG_MEM_SOFT_DIRTY */
-
 /*
  * Bits _PAGE_BIT_PRESENT, _PAGE_BIT_FILE and _PAGE_BIT_PROTNONE are taken,
  * split up the 29 bits of offset into this range.
  */
 #define PTE_FILE_MAX_BITS       29
 #define PTE_FILE_SHIFT1         (_PAGE_BIT_PRESENT + 1)
-#if _PAGE_BIT_FILE < _PAGE_BIT_PROTNONE
 #define PTE_FILE_SHIFT2         (_PAGE_BIT_FILE + 1)
 #define PTE_FILE_SHIFT3         (_PAGE_BIT_PROTNONE + 1)
-#else
-#define PTE_FILE_SHIFT2         (_PAGE_BIT_PROTNONE + 1)
-#define PTE_FILE_SHIFT3         (_PAGE_BIT_FILE + 1)
-#endif
 #define PTE_FILE_BITS1          (PTE_FILE_SHIFT2 - PTE_FILE_SHIFT1 - 1)
 #define PTE_FILE_BITS2          (PTE_FILE_SHIFT3 - PTE_FILE_SHIFT2 - 1)
 
@@ -150,16 +98,9 @@ static __always_inline pte_t pgoff_to_pte(pgoff_t off)
         };
 }
 
-#endif /* CONFIG_MEM_SOFT_DIRTY */
-
 /* Encode and de-code a swap entry */
-#if _PAGE_BIT_FILE < _PAGE_BIT_PROTNONE
 #define SWP_TYPE_BITS (_PAGE_BIT_FILE - _PAGE_BIT_PRESENT - 1)
 #define SWP_OFFSET_SHIFT (_PAGE_BIT_PROTNONE + 1)
-#else
-#define SWP_TYPE_BITS (_PAGE_BIT_PROTNONE - _PAGE_BIT_PRESENT - 1)
-#define SWP_OFFSET_SHIFT (_PAGE_BIT_FILE + 1)
-#endif
 
 #define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > SWP_TYPE_BITS)
 
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index b459ddf27d64..0ec056012618 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -131,7 +131,8 @@ static inline int pte_exec(pte_t pte)
 
 static inline int pte_special(pte_t pte)
 {
-        return pte_flags(pte) & _PAGE_SPECIAL;
+        return (pte_flags(pte) & (_PAGE_PRESENT|_PAGE_SPECIAL)) ==
+                                 (_PAGE_PRESENT|_PAGE_SPECIAL);
 }
 
 static inline unsigned long pte_pfn(pte_t pte)
@@ -296,6 +297,7 @@ static inline pmd_t pmd_mknotpresent(pmd_t pmd)
         return pmd_clear_flags(pmd, _PAGE_PRESENT);
 }
 
+#ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY
 static inline int pte_soft_dirty(pte_t pte)
 {
         return pte_flags(pte) & _PAGE_SOFT_DIRTY;
@@ -331,6 +333,8 @@ static inline int pte_file_soft_dirty(pte_t pte)
         return pte_flags(pte) & _PAGE_SOFT_DIRTY;
 }
 
+#endif /* CONFIG_HAVE_ARCH_SOFT_DIRTY */
+
 /*
  * Mask out unsupported bits in a present pgprot.  Non-present pgprots
  * can use those bits for other purposes, so leave them be.
@@ -452,6 +456,12 @@ static inline int pte_present(pte_t a)
                                _PAGE_NUMA);
 }
 
+#define pte_present_nonuma pte_present_nonuma
+static inline int pte_present_nonuma(pte_t a)
+{
+        return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE);
+}
+
 #define pte_accessible pte_accessible
 static inline bool pte_accessible(struct mm_struct *mm, pte_t a)
 {
@@ -858,23 +868,25 @@ static inline void update_mmu_cache_pmd(struct vm_area_struct *vma,
 {
 }
 
+#ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY
 static inline pte_t pte_swp_mksoft_dirty(pte_t pte)
 {
-        VM_BUG_ON(pte_present(pte));
+        VM_BUG_ON(pte_present_nonuma(pte));
         return pte_set_flags(pte, _PAGE_SWP_SOFT_DIRTY);
 }
 
 static inline int pte_swp_soft_dirty(pte_t pte)
 {
-        VM_BUG_ON(pte_present(pte));
+        VM_BUG_ON(pte_present_nonuma(pte));
         return pte_flags(pte) & _PAGE_SWP_SOFT_DIRTY;
 }
 
 static inline pte_t pte_swp_clear_soft_dirty(pte_t pte)
 {
-        VM_BUG_ON(pte_present(pte));
+        VM_BUG_ON(pte_present_nonuma(pte));
         return pte_clear_flags(pte, _PAGE_SWP_SOFT_DIRTY);
 }
+#endif
 
 #include <asm-generic/pgtable.h>
 #endif  /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index e22c1dbf7feb..5be9063545d2 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -143,12 +143,12 @@ static inline int pgd_large(pgd_t pgd) { return 0; }
 #define pte_unmap(pte) ((void)(pte))/* NOP */
 
 /* Encode and de-code a swap entry */
-#if _PAGE_BIT_FILE < _PAGE_BIT_PROTNONE
 #define SWP_TYPE_BITS (_PAGE_BIT_FILE - _PAGE_BIT_PRESENT - 1)
-#define SWP_OFFSET_SHIFT (_PAGE_BIT_PROTNONE + 1)
+#ifdef CONFIG_NUMA_BALANCING
+/* Automatic NUMA balancing needs to be distinguishable from swap entries */
+#define SWP_OFFSET_SHIFT (_PAGE_BIT_PROTNONE + 2)
 #else
-#define SWP_TYPE_BITS (_PAGE_BIT_PROTNONE - _PAGE_BIT_PRESENT - 1)
-#define SWP_OFFSET_SHIFT (_PAGE_BIT_FILE + 1)
+#define SWP_OFFSET_SHIFT (_PAGE_BIT_PROTNONE + 1)
 #endif
 
 #define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > SWP_TYPE_BITS)
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index eb3d44945133..f216963760e5 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -16,15 +16,26 @@
 #define _PAGE_BIT_PSE           7       /* 4 MB (or 2MB) page */
 #define _PAGE_BIT_PAT           7       /* on 4KB pages */
 #define _PAGE_BIT_GLOBAL        8       /* Global TLB entry PPro+ */
-#define _PAGE_BIT_UNUSED1       9       /* available for programmer */
-#define _PAGE_BIT_IOMAP         10      /* flag used to indicate IO mapping */
-#define _PAGE_BIT_HIDDEN        11      /* hidden by kmemcheck */
+#define _PAGE_BIT_SOFTW1        9       /* available for programmer */
+#define _PAGE_BIT_SOFTW2        10      /* " */
+#define _PAGE_BIT_SOFTW3        11      /* " */
 #define _PAGE_BIT_PAT_LARGE     12      /* On 2MB or 1GB pages */
-#define _PAGE_BIT_SPECIAL       _PAGE_BIT_UNUSED1
-#define _PAGE_BIT_CPA_TEST      _PAGE_BIT_UNUSED1
-#define _PAGE_BIT_SPLITTING     _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
+#define _PAGE_BIT_SPECIAL       _PAGE_BIT_SOFTW1
+#define _PAGE_BIT_CPA_TEST      _PAGE_BIT_SOFTW1
+#define _PAGE_BIT_SPLITTING     _PAGE_BIT_SOFTW2 /* only valid on a PSE pmd */
+#define _PAGE_BIT_IOMAP         _PAGE_BIT_SOFTW2 /* flag used to indicate IO mapping */
+#define _PAGE_BIT_HIDDEN        _PAGE_BIT_SOFTW3 /* hidden by kmemcheck */
+#define _PAGE_BIT_SOFT_DIRTY    _PAGE_BIT_SOFTW3 /* software dirty tracking */
 #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
 
+/*
+ * Swap offsets on configurations that allow automatic NUMA balancing use the
+ * bits after _PAGE_BIT_GLOBAL. To uniquely distinguish NUMA hinting PTEs from
+ * swap entries, we use the first bit after _PAGE_BIT_GLOBAL and shrink the
+ * maximum possible swap space from 16TB to 8TB.
+ */
+#define _PAGE_BIT_NUMA          (_PAGE_BIT_GLOBAL+1)
+
 /* If _PAGE_BIT_PRESENT is clear, we use these: */
 /* - if the user mapped it with PROT_NONE; pte_present gives true */
 #define _PAGE_BIT_PROTNONE      _PAGE_BIT_GLOBAL
@@ -40,7 +51,7 @@
 #define _PAGE_DIRTY     (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
 #define _PAGE_PSE       (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
 #define _PAGE_GLOBAL    (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
-#define _PAGE_UNUSED1   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
+#define _PAGE_SOFTW1    (_AT(pteval_t, 1) << _PAGE_BIT_SOFTW1)
 #define _PAGE_IOMAP     (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
 #define _PAGE_PAT       (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
@@ -61,8 +72,6 @@
  * they do not conflict with each other.
  */
 
-#define _PAGE_BIT_SOFT_DIRTY    _PAGE_BIT_HIDDEN
-
 #ifdef CONFIG_MEM_SOFT_DIRTY
 #define _PAGE_SOFT_DIRTY        (_AT(pteval_t, 1) << _PAGE_BIT_SOFT_DIRTY)
 #else
@@ -70,6 +79,21 @@
 #endif
 
 /*
+ * _PAGE_NUMA distinguishes between a numa hinting minor fault and a page
+ * that is not present. The hinting fault gathers numa placement statistics
+ * (see pte_numa()). The bit is always zero when the PTE is not present.
+ *
+ * The bit picked must be always zero when the pmd is present and not
+ * present, so that we don't lose information when we set it while
+ * atomically clearing the present bit.
+ */
+#ifdef CONFIG_NUMA_BALANCING
+#define _PAGE_NUMA      (_AT(pteval_t, 1) << _PAGE_BIT_NUMA)
+#else
+#define _PAGE_NUMA      (_AT(pteval_t, 0))
+#endif
+
+/*
  * Tracking soft dirty bit when a page goes to a swap is tricky.
  * We need a bit which can be stored in pte _and_ not conflict
  * with swap entry format. On x86 bits 6 and 7 are *not* involved
@@ -94,26 +118,6 @@
 #define _PAGE_FILE      (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
 #define _PAGE_PROTNONE  (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE)
 
-/*
- * _PAGE_NUMA indicates that this page will trigger a numa hinting
- * minor page fault to gather numa placement statistics (see
- * pte_numa()). The bit picked (8) is within the range between
- * _PAGE_FILE (6) and _PAGE_PROTNONE (8) bits. Therefore, it doesn't
- * require changes to the swp entry format because that bit is always
- * zero when the pte is not present.
- *
- * The bit picked must be always zero when the pmd is present and not
- * present, so that we don't lose information when we set it while
- * atomically clearing the present bit.
- *
- * Because we shared the same bit (8) with _PAGE_PROTNONE this can be
- * interpreted as _PAGE_NUMA only in places that _PAGE_PROTNONE
- * couldn't reach, like handle_mm_fault() (see access_error in
- * arch/x86/mm/fault.c, the vma protection must not be PROT_NONE for
- * handle_mm_fault() to be invoked).
- */
-#define _PAGE_NUMA      _PAGE_PROTNONE
-
 #define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |        \
                          _PAGE_ACCESSED | _PAGE_DIRTY)
 #define _KERNPG_TABLE   (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED |    \
@@ -122,8 +126,8 @@
 /* Set of bits not changed in pte_modify */
 #define _PAGE_CHG_MASK  (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT |         \
                          _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY | \
-                         _PAGE_SOFT_DIRTY)
-#define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE)
+                         _PAGE_SOFT_DIRTY | _PAGE_NUMA)
+#define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE | _PAGE_NUMA)
 
 #define _PAGE_CACHE_MASK        (_PAGE_PCD | _PAGE_PWT)
 #define _PAGE_CACHE_WB          (0)
diff --git a/arch/x86/include/asm/swiotlb.h b/arch/x86/include/asm/swiotlb.h
index 977f1761a25d..ab05d73e2bb7 100644
--- a/arch/x86/include/asm/swiotlb.h
+++ b/arch/x86/include/asm/swiotlb.h
@@ -29,4 +29,11 @@ static inline void pci_swiotlb_late_init(void)
 
 static inline void dma_mark_clean(void *addr, size_t size) {}
 
+extern void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+                                        dma_addr_t *dma_handle, gfp_t flags,
+                                        struct dma_attrs *attrs);
+extern void x86_swiotlb_free_coherent(struct device *dev, size_t size,
+                                        void *vaddr, dma_addr_t dma_addr,
+                                        struct dma_attrs *attrs);
+
 #endif /* _ASM_X86_SWIOTLB_H */
diff --git a/arch/x86/include/asm/unistd.h b/arch/x86/include/asm/unistd.h
index 3f556c6a0157..2b19caa4081c 100644
--- a/arch/x86/include/asm/unistd.h
+++ b/arch/x86/include/asm/unistd.h
@@ -41,7 +41,6 @@
 # define __ARCH_WANT_SYS_OLD_GETRLIMIT
 # define __ARCH_WANT_SYS_OLD_UNAME
 # define __ARCH_WANT_SYS_PAUSE
-# define __ARCH_WANT_SYS_SGETMASK
 # define __ARCH_WANT_SYS_SIGNAL
 # define __ARCH_WANT_SYS_SIGPENDING
 # define __ARCH_WANT_SYS_SIGPROCMASK
diff --git a/arch/x86/kernel/amd_gart_64.c b/arch/x86/kernel/amd_gart_64.c
index b574b295a2f9..8e3842fc8bea 100644
--- a/arch/x86/kernel/amd_gart_64.c
+++ b/arch/x86/kernel/amd_gart_64.c
@@ -512,7 +512,7 @@ gart_free_coherent(struct device *dev, size_t size, void *vaddr,
                    dma_addr_t dma_addr, struct dma_attrs *attrs)
 {
         gart_unmap_page(dev, dma_addr, size, DMA_BIDIRECTIONAL, NULL);
-        free_pages((unsigned long)vaddr, get_order(size));
+        dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
 }
 
 static int gart_mapping_error(struct device *dev, dma_addr_t dma_addr)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 6cc800381d14..bb92f38153b2 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -60,8 +60,6 @@ static DEFINE_MUTEX(mce_chrdev_read_mutex);
 
 #define SPINUNIT 100    /* 100ns */
 
-atomic_t mce_entry;
-
 DEFINE_PER_CPU(unsigned, mce_exception_count);
 
 struct mce_bank *mce_banks __read_mostly;
@@ -1040,8 +1038,6 @@ void do_machine_check(struct pt_regs *regs, long error_code)
         DECLARE_BITMAP(valid_banks, MAX_NR_BANKS);
         char *msg = "Unknown";
 
-        atomic_inc(&mce_entry);
-
         this_cpu_inc(mce_exception_count);
 
         if (!cfg->banks)
@@ -1171,7 +1167,6 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                 mce_report_event(regs);
         mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
 out:
-        atomic_dec(&mce_entry);
         sync_core();
 }
 EXPORT_SYMBOL_GPL(do_machine_check);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 068054f4bf20..eda1a865641e 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -172,7 +172,7 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
          */
         load_ucode_bsp();
 
-        if (console_loglevel == 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 early_printk("Kernel alive\n");
 
         clear_page(init_level4_pgt);
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index f7d0672481fd..a25e202bb319 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -97,12 +97,17 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
 
         dma_mask = dma_alloc_coherent_mask(dev, flag);
 
-        flag |= __GFP_ZERO;
+        flag &= ~__GFP_ZERO;
 again:
         page = NULL;
         /* CMA can be used only in the context which permits sleeping */
-        if (flag & __GFP_WAIT)
+        if (flag & __GFP_WAIT) {
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
+                if (page && page_to_phys(page) + size > dma_mask) {
+                        dma_release_from_contiguous(dev, page, count);
+                        page = NULL;
+                }
+        }
         /* fallback */
         if (!page)
                 page = alloc_pages_node(dev_to_node(dev), flag, get_order(size));
@@ -120,7 +125,7 @@ again:
 
                 return NULL;
         }
-
+        memset(page_address(page), 0, size);
         *dma_addr = addr;
         return page_address(page);
 }
diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
index 6c483ba98b9c..77dd0ad58be4 100644
--- a/arch/x86/kernel/pci-swiotlb.c
+++ b/arch/x86/kernel/pci-swiotlb.c
@@ -14,7 +14,7 @@
 #include <asm/iommu_table.h>
 int swiotlb __read_mostly;
 
-static void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                                         dma_addr_t *dma_handle, gfp_t flags,
                                         struct dma_attrs *attrs)
 {
@@ -28,11 +28,14 @@ static void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
         return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
 }
 
-static void x86_swiotlb_free_coherent(struct device *dev, size_t size,
+void x86_swiotlb_free_coherent(struct device *dev, size_t size,
                                       void *vaddr, dma_addr_t dma_addr,
                                       struct dma_attrs *attrs)
 {
-        swiotlb_free_coherent(dev, size, vaddr, dma_addr);
+        if (is_swiotlb_buffer(dma_to_phys(dev, dma_addr)))
+                swiotlb_free_coherent(dev, size, vaddr, dma_addr);
+        else
+                dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
 }
 
 static struct dma_map_ops swiotlb_dma_ops = {
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 09c76d265550..78a0e6298922 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1119,7 +1119,7 @@ void __init setup_arch(char **cmdline_p)
         setup_real_mode();
 
         memblock_set_current_limit(get_max_mapped());
-        dma_contiguous_reserve(0);
+        dma_contiguous_reserve(max_pfn_mapped << PAGE_SHIFT);
 
         /*
          * NOTE: On x86-32, only from this point on, fixmaps are ready for use.
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 8c9f647ff9e1..8b977ebf9388 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -58,11 +58,6 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 {
         return NULL;
 }
-
-int pmd_huge_support(void)
-{
-        return 0;
-}
 #else
 
 struct page *
@@ -80,11 +75,6 @@ int pud_huge(pud_t pud)
 {
         return !!(pud_val(pud) & _PAGE_PSE);
 }
-
-int pmd_huge_support(void)
-{
-        return 1;
-}
 #endif
 
 #ifdef CONFIG_HUGETLB_PAGE
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index f35c66c5959a..b92591fa8970 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1230,17 +1230,43 @@ const char *arch_vma_name(struct vm_area_struct *vma)
         return NULL;
 }
 
-#ifdef CONFIG_X86_UV
-unsigned long memory_block_size_bytes(void)
+static unsigned long probe_memory_block_size(void)
 {
+        /* start from 2g */
+        unsigned long bz = 1UL<<31;
+
+#ifdef CONFIG_X86_UV
         if (is_uv_system()) {
                 printk(KERN_INFO "UV: memory block size 2GB\n");
                 return 2UL * 1024 * 1024 * 1024;
         }
-        return MIN_MEMORY_BLOCK_SIZE;
-}
 #endif
 
+        /* less than 64g installed */
+        if ((max_pfn << PAGE_SHIFT) < (16UL << 32))
+                return MIN_MEMORY_BLOCK_SIZE;
+
+        /* get the tail size */
+        while (bz > MIN_MEMORY_BLOCK_SIZE) {
+                if (!((max_pfn << PAGE_SHIFT) & (bz - 1)))
+                        break;
+                bz >>= 1;
+        }
+
+        printk(KERN_DEBUG "memory block size : %ldMB\n", bz >> 20);
+
+        return bz;
+}
+
+static unsigned long memory_block_size_probed;
+unsigned long memory_block_size_bytes(void)
+{
+        if (!memory_block_size_probed)
+                memory_block_size_probed = probe_memory_block_size();
+
+        return memory_block_size_probed;
+}
+
 #ifdef CONFIG_SPARSEMEM_VMEMMAP
 /*
  * Initialise the sparsemem vmemmap using huge-pages at the PMD level.
diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
index 1d045f9c390f..a32b706c401a 100644
--- a/arch/x86/mm/numa.c
+++ b/arch/x86/mm/numa.c
@@ -559,7 +559,7 @@ static void __init numa_clear_kernel_node_hotplug(void)
         int i, nid;
         nodemask_t numa_kernel_nodes = NODE_MASK_NONE;
         unsigned long start, end;
-        struct memblock_type *type = &memblock.reserved;
+        struct memblock_region *r;
 
         /*
          * At this time, all memory regions reserved by memblock are
@@ -573,8 +573,8 @@ static void __init numa_clear_kernel_node_hotplug(void)
         }
 
         /* Mark all kernel nodes. */
-        for (i = 0; i < type->cnt; i++)
-                node_set(type->regions[i].nid, numa_kernel_nodes);
+        for_each_memblock(reserved, r)
+                node_set(r->nid, numa_kernel_nodes);
 
         /* Clear MEMBLOCK_HOTPLUG flag for memory in kernel nodes. */
         for (i = 0; i < numa_meminfo.nr_blks; i++) {
diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
index 461bc8289024..6629f397b467 100644
--- a/arch/x86/mm/pageattr-test.c
+++ b/arch/x86/mm/pageattr-test.c
@@ -35,7 +35,7 @@ enum {
 
 static int pte_testbit(pte_t pte)
 {
-        return pte_flags(pte) & _PAGE_UNUSED1;
+        return pte_flags(pte) & _PAGE_SOFTW1;
 }
 
 struct split_state {
diff --git a/arch/x86/pci/sta2x11-fixup.c b/arch/x86/pci/sta2x11-fixup.c
index 9d8a509c9730..5ceda85b8687 100644
--- a/arch/x86/pci/sta2x11-fixup.c
+++ b/arch/x86/pci/sta2x11-fixup.c
@@ -173,9 +173,7 @@ static void *sta2x11_swiotlb_alloc_coherent(struct device *dev,
 {
         void *vaddr;
 
-        vaddr = dma_generic_alloc_coherent(dev, size, dma_handle, flags, attrs);
-        if (!vaddr)
-                vaddr = swiotlb_alloc_coherent(dev, size, dma_handle, flags);
+        vaddr = x86_swiotlb_alloc_coherent(dev, size, dma_handle, flags, attrs);
         *dma_handle = p2a(*dma_handle, to_pci_dev(dev));
         return vaddr;
 }
@@ -183,7 +181,7 @@ static void *sta2x11_swiotlb_alloc_coherent(struct device *dev,
 /* We have our own dma_ops: the same as swiotlb but from alloc (above) */
 static struct dma_map_ops sta2x11_dma_ops = {
         .alloc = sta2x11_swiotlb_alloc_coherent,
-        .free = swiotlb_free_coherent,
+        .free = x86_swiotlb_free_coherent,
         .map_page = swiotlb_map_page,
         .unmap_page = swiotlb_unmap_page,
         .map_sg = swiotlb_map_sg_attrs,
diff --git a/arch/x86/platform/uv/uv_nmi.c b/arch/x86/platform/uv/uv_nmi.c
index be27da60dc8f..c89c93320c12 100644
--- a/arch/x86/platform/uv/uv_nmi.c
+++ b/arch/x86/platform/uv/uv_nmi.c
@@ -85,7 +85,7 @@ static cpumask_var_t uv_nmi_cpu_mask;
  * Default is all stack dumps go to the console and buffer.
  * Lower level to send to log buffer only.
  */
-static int uv_nmi_loglevel = 7;
+static int uv_nmi_loglevel = CONSOLE_LOGLEVEL_DEFAULT;
 module_param_named(dump_loglevel, uv_nmi_loglevel, int, 0644);
 
 /*
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 4b7b4522b64f..23b8726962af 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -258,7 +258,7 @@ endchoice
 
 config CMA_ALIGNMENT
         int "Maximum PAGE_SIZE order of alignment for contiguous buffers"
-        range 4 9
+        range 4 12
         default 8
         help
           DMA mapping framework by default aligns all buffers to the smallest
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index c34ec3364243..83969f8c5727 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -60,11 +60,22 @@ struct cma *dma_contiguous_default_area;
  */
 static const phys_addr_t size_bytes = CMA_SIZE_MBYTES * SZ_1M;
 static phys_addr_t size_cmdline = -1;
+static phys_addr_t base_cmdline;
+static phys_addr_t limit_cmdline;
 
 static int __init early_cma(char *p)
 {
         pr_debug("%s(%s)\n", __func__, p);
         size_cmdline = memparse(p, &p);
+        if (*p != '@')
+                return 0;
+        base_cmdline = memparse(p + 1, &p);
+        if (*p != '-') {
+                limit_cmdline = base_cmdline + size_cmdline;
+                return 0;
+        }
+        limit_cmdline = memparse(p + 1, &p);
+
         return 0;
 }
 early_param("cma", early_cma);
@@ -108,11 +119,18 @@ static inline __maybe_unused phys_addr_t cma_early_percent_memory(void)
 void __init dma_contiguous_reserve(phys_addr_t limit)
 {
         phys_addr_t selected_size = 0;
+        phys_addr_t selected_base = 0;
+        phys_addr_t selected_limit = limit;
+        bool fixed = false;
 
         pr_debug("%s(limit %08lx)\n", __func__, (unsigned long)limit);
 
         if (size_cmdline != -1) {
                 selected_size = size_cmdline;
+                selected_base = base_cmdline;
+                selected_limit = min_not_zero(limit_cmdline, limit);
+                if (base_cmdline + size_cmdline == limit_cmdline)
+                        fixed = true;
         } else {
 #ifdef CONFIG_CMA_SIZE_SEL_MBYTES
                 selected_size = size_bytes;
@@ -129,10 +147,12 @@ void __init dma_contiguous_reserve(phys_addr_t limit)
                 pr_debug("%s: reserving %ld MiB for global area\n", __func__,
                          (unsigned long)selected_size / SZ_1M);
 
-                dma_contiguous_reserve_area(selected_size, 0, limit,
-                                            &dma_contiguous_default_area);
+                dma_contiguous_reserve_area(selected_size, selected_base,
+                                            selected_limit,
+                                            &dma_contiguous_default_area,
+                                            fixed);
         }
-};
+}
 
 static DEFINE_MUTEX(cma_mutex);
 
@@ -189,15 +209,20 @@ core_initcall(cma_init_reserved_areas);
  * @base: Base address of the reserved area optional, use 0 for any
  * @limit: End address of the reserved memory (optional, 0 for any).
  * @res_cma: Pointer to store the created cma region.
+ * @fixed: hint about where to place the reserved area
  *
  * This function reserves memory from early allocator. It should be
  * called by arch specific code once the early allocator (memblock or bootmem)
  * has been activated and all other subsystems have already allocated/reserved
  * memory. This function allows to create custom reserved areas for specific
  * devices.
+ *
+ * If @fixed is true, reserve contiguous area at exactly @base.  If false,
+ * reserve in range from @base to @limit.
  */
 int __init dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,
-                                       phys_addr_t limit, struct cma **res_cma)
+                                       phys_addr_t limit, struct cma **res_cma,
+                                       bool fixed)
 {
         struct cma *cma = &cma_areas[cma_area_count];
         phys_addr_t alignment;
@@ -223,18 +248,15 @@ int __init dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,
         limit &= ~(alignment - 1);
 
         /* Reserve memory */
-        if (base) {
+        if (base && fixed) {
                 if (memblock_is_region_reserved(base, size) ||
                     memblock_reserve(base, size) < 0) {
                         ret = -EBUSY;
                         goto err;
                 }
         } else {
-                /*
-                 * Use __memblock_alloc_base() since
-                 * memblock_alloc_base() panic()s.
-                 */
-                phys_addr_t addr = __memblock_alloc_base(size, alignment, limit);
+                phys_addr_t addr = memblock_alloc_range(size, alignment, base,
+                                                        limit);
                 if (!addr) {
                         ret = -ENOMEM;
                         goto err;
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index bece691cb5d9..89f752dd8465 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -118,16 +118,6 @@ static ssize_t show_mem_start_phys_index(struct device *dev,
         return sprintf(buf, "%08lx\n", phys_index);
 }
 
-static ssize_t show_mem_end_phys_index(struct device *dev,
-                        struct device_attribute *attr, char *buf)
-{
-        struct memory_block *mem = to_memory_block(dev);
-        unsigned long phys_index;
-
-        phys_index = mem->end_section_nr / sections_per_block;
-        return sprintf(buf, "%08lx\n", phys_index);
-}
-
 /*
  * Show whether the section of memory is likely to be hot-removable
  */
@@ -384,7 +374,6 @@ static ssize_t show_phys_device(struct device *dev,
 }
 
 static DEVICE_ATTR(phys_index, 0444, show_mem_start_phys_index, NULL);
-static DEVICE_ATTR(end_phys_index, 0444, show_mem_end_phys_index, NULL);
 static DEVICE_ATTR(state, 0644, show_mem_state, store_mem_state);
 static DEVICE_ATTR(phys_device, 0444, show_phys_device, NULL);
 static DEVICE_ATTR(removable, 0444, show_mem_removable, NULL);
@@ -529,7 +518,6 @@ struct memory_block *find_memory_block(struct mem_section *section)
 
 static struct attribute *memory_memblk_attrs[] = {
         &dev_attr_phys_index.attr,
-        &dev_attr_end_phys_index.attr,
         &dev_attr_state.attr,
         &dev_attr_phys_device.attr,
         &dev_attr_removable.attr,
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index e73b85cf0756..c7d138eca731 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -200,11 +200,11 @@ static int copy_to_brd_setup(struct brd_device *brd, sector_t sector, size_t n)
 
         copy = min_t(size_t, n, PAGE_SIZE - offset);
         if (!brd_insert_page(brd, sector))
-                return -ENOMEM;
+                return -ENOSPC;
         if (copy < n) {
                 sector += copy >> SECTOR_SHIFT;
                 if (!brd_insert_page(brd, sector))
-                        return -ENOMEM;
+                        return -ENOSPC;
         }
         return 0;
 }
@@ -360,6 +360,15 @@ out:
         bio_endio(bio, err);
 }
 
+static int brd_rw_page(struct block_device *bdev, sector_t sector,
+                       struct page *page, int rw)
+{
+        struct brd_device *brd = bdev->bd_disk->private_data;
+        int err = brd_do_bvec(brd, page, PAGE_CACHE_SIZE, 0, rw, sector);
+        page_endio(page, rw & WRITE, err);
+        return err;
+}
+
 #ifdef CONFIG_BLK_DEV_XIP
 static int brd_direct_access(struct block_device *bdev, sector_t sector,
                         void **kaddr, unsigned long *pfn)
@@ -375,7 +384,7 @@ static int brd_direct_access(struct block_device *bdev, sector_t sector,
                 return -ERANGE;
         page = brd_insert_page(brd, sector);
         if (!page)
-                return -ENOMEM;
+                return -ENOSPC;
         *kaddr = page_address(page);
         *pfn = page_to_pfn(page);
 
@@ -419,6 +428,7 @@ static int brd_ioctl(struct block_device *bdev, fmode_t mode,
 
 static const struct block_device_operations brd_fops = {
         .owner =                THIS_MODULE,
+        .rw_page =              brd_rw_page,
         .ioctl =                brd_ioctl,
 #ifdef CONFIG_BLK_DEV_XIP
         .direct_access =        brd_direct_access,
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 9849b5233bf4..48eccb350180 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -572,10 +572,10 @@ static void zram_bio_discard(struct zram *zram, u32 index,
          * skipping this logical block is appropriate here.
          */
         if (offset) {
-                if (n < offset)
+                if (n <= (PAGE_SIZE - offset))
                         return;
 
-                n -= offset;
+                n -= (PAGE_SIZE - offset);
                 index++;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 6c1885eedfdf..800158714473 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -467,14 +467,17 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
                 goto err_free;
         }
 
+        down_read(&current->mm->mmap_sem);
         vma = find_vma(current->mm, userptr);
         if (!vma) {
+                up_read(&current->mm->mmap_sem);
                 DRM_ERROR("failed to get vm region.\n");
                 ret = -EFAULT;
                 goto err_free_pages;
         }
 
         if (vma->vm_end < userptr + size) {
+                up_read(&current->mm->mmap_sem);
                 DRM_ERROR("vma is too small.\n");
                 ret = -EFAULT;
                 goto err_free_pages;
@@ -482,6 +485,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
 
         g2d_userptr->vma = exynos_gem_get_vma(vma);
         if (!g2d_userptr->vma) {
+                up_read(&current->mm->mmap_sem);
                 DRM_ERROR("failed to copy vma.\n");
                 ret = -ENOMEM;
                 goto err_free_pages;
@@ -492,10 +496,12 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
         ret = exynos_gem_get_pages_from_userptr(start & PAGE_MASK,
                                                 npages, pages, vma);
         if (ret < 0) {
+                up_read(&current->mm->mmap_sem);
                 DRM_ERROR("failed to get user pages from userptr.\n");
                 goto err_put_vma;
         }
 
+        up_read(&current->mm->mmap_sem);
         g2d_userptr->pages = pages;
 
         sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f256ffc02e29..6bb32773c3ac 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -39,6 +39,7 @@
 #include <linux/dmi.h>
 #include <linux/pci-ats.h>
 #include <linux/memblock.h>
+#include <linux/dma-contiguous.h>
 #include <asm/irq_remapping.h>
 #include <asm/cacheflush.h>
 #include <asm/iommu.h>
@@ -3193,7 +3194,7 @@ static void *intel_alloc_coherent(struct device *dev, size_t size,
                                   dma_addr_t *dma_handle, gfp_t flags,
                                   struct dma_attrs *attrs)
 {
-        void *vaddr;
+        struct page *page = NULL;
         int order;
 
         size = PAGE_ALIGN(size);
@@ -3208,17 +3209,31 @@ static void *intel_alloc_coherent(struct device *dev, size_t size,
                         flags |= GFP_DMA32;
         }
 
-        vaddr = (void *)__get_free_pages(flags, order);
-        if (!vaddr)
+        if (flags & __GFP_WAIT) {
+                unsigned int count = size >> PAGE_SHIFT;
+
+                page = dma_alloc_from_contiguous(dev, count, order);
+                if (page && iommu_no_mapping(dev) &&
+                    page_to_phys(page) + size > dev->coherent_dma_mask) {
+                        dma_release_from_contiguous(dev, page, count);
+                        page = NULL;
+                }
+        }
+
+        if (!page)
+                page = alloc_pages(flags, order);
+        if (!page)
                 return NULL;
-        memset(vaddr, 0, size);
+        memset(page_address(page), 0, size);
 
-        *dma_handle = __intel_map_single(dev, virt_to_bus(vaddr), size,
+        *dma_handle = __intel_map_single(dev, page_to_phys(page), size,
                                          DMA_BIDIRECTIONAL,
                                          dev->coherent_dma_mask);
         if (*dma_handle)
-                return vaddr;
-        free_pages((unsigned long)vaddr, order);
+                return page_address(page);
+        if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT))
+                __free_pages(page, order);
+
         return NULL;
 }
 
@@ -3226,12 +3241,14 @@ static void intel_free_coherent(struct device *dev, size_t size, void *vaddr,
                                 dma_addr_t dma_handle, struct dma_attrs *attrs)
 {
         int order;
+        struct page *page = virt_to_page(vaddr);
 
         size = PAGE_ALIGN(size);
         order = get_order(size);
 
         intel_unmap_page(dev, dma_handle, size, DMA_BIDIRECTIONAL, NULL);
-        free_pages((unsigned long)vaddr, order);
+        if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT))
+                __free_pages(page, order);
 }
 
 static void intel_unmap_sg(struct device *dev, struct scatterlist *sglist,
diff --git a/drivers/nubus/nubus.c b/drivers/nubus/nubus.c
index 43926cd25ae8..5066a7ef7b6c 100644
--- a/drivers/nubus/nubus.c
+++ b/drivers/nubus/nubus.c
@@ -473,7 +473,7 @@ static struct nubus_dev* __init
         if (slot == 0 && (unsigned long)dir.base % 2)
                 dir.base += 1;
         
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_functional_resource: parent is 0x%p, dir is 0x%p\n",
                        parent->base, dir.base);
 
@@ -568,7 +568,7 @@ static int __init nubus_get_vidnames(struct nubus_board* board,
 
         printk(KERN_INFO "    video modes supported:\n");
         nubus_get_subdir(parent, &dir);
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_vidnames: parent is 0x%p, dir is 0x%p\n",
                        parent->base, dir.base);
 
@@ -629,7 +629,7 @@ static int __init nubus_get_vendorinfo(struct nubus_board* board,
 
         printk(KERN_INFO "    vendor info:\n");
         nubus_get_subdir(parent, &dir);
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_vendorinfo: parent is 0x%p, dir is 0x%p\n",
                        parent->base, dir.base);
 
@@ -654,7 +654,7 @@ static int __init nubus_get_board_resource(struct nubus_board* board, int slot,
         struct nubus_dirent ent;
         
         nubus_get_subdir(parent, &dir);
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_board_resource: parent is 0x%p, dir is 0x%p\n",
                        parent->base, dir.base);
 
@@ -753,19 +753,19 @@ static void __init nubus_find_rom_dir(struct nubus_board* board)
         if (nubus_readdir(&dir, &ent) == -1)
                 goto badrom;
 
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_INFO "nubus_get_rom_dir: entry %02x %06x\n", ent.type, ent.data);
         /* This one takes us to where we want to go. */
         if (nubus_readdir(&dir, &ent) == -1) 
                 goto badrom;
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_rom_dir: entry %02x %06x\n", ent.type, ent.data);
         nubus_get_subdir(&ent, &dir);
 
         /* Resource ID 01, also an "Unknown Macintosh" */
         if (nubus_readdir(&dir, &ent) == -1) 
                 goto badrom;
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_rom_dir: entry %02x %06x\n", ent.type, ent.data);
 
         /* FIXME: the first one is *not* always the right one.  We
@@ -780,7 +780,7 @@ static void __init nubus_find_rom_dir(struct nubus_board* board)
            path to that address... */
         if (nubus_readdir(&dir, &ent) == -1)
                 goto badrom;
-        if (console_loglevel >= 10)
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG)
                 printk(KERN_DEBUG "nubus_get_rom_dir: entry %02x %06x\n", ent.type, ent.data);
         
         /* Bwahahahaha... */
@@ -816,7 +816,7 @@ static struct nubus_board* __init nubus_add_board(int slot, int bytelanes)
         board->fblock = rp;
 
         /* Dump the format block for debugging purposes */
-        if (console_loglevel >= 10) {
+        if (console_loglevel >= CONSOLE_LOGLEVEL_DEBUG) {
                 int i;
                 printk(KERN_DEBUG "Slot %X, format block at 0x%p\n",
                        slot, rp);
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index ce396ecdf412..b767a64e49d9 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -88,7 +88,7 @@ static void sysrq_handle_loglevel(int key)
         int i;
 
         i = key - '0';
-        console_loglevel = 7;
+        console_loglevel = CONSOLE_LOGLEVEL_DEFAULT;
         printk("Loglevel set to %d\n", i);
         console_loglevel = i;
 }
@@ -343,7 +343,7 @@ static void send_sig_all(int sig)
 static void sysrq_handle_term(int key)
 {
         send_sig_all(SIGTERM);
-        console_loglevel = 8;
+        console_loglevel = CONSOLE_LOGLEVEL_DEBUG;
 }
 static struct sysrq_key_op sysrq_term_op = {
         .handler        = sysrq_handle_term,
@@ -387,7 +387,7 @@ static struct sysrq_key_op sysrq_thaw_op = {
 static void sysrq_handle_kill(int key)
 {
         send_sig_all(SIGKILL);
-        console_loglevel = 8;
+        console_loglevel = CONSOLE_LOGLEVEL_DEBUG;
 }
 static struct sysrq_key_op sysrq_kill_op = {
         .handler        = sysrq_handle_kill,
@@ -520,7 +520,7 @@ void __handle_sysrq(int key, bool check_mask)
          * routing in the consumers of /proc/kmsg.
          */
         orig_log_level = console_loglevel;
-        console_loglevel = 7;
+        console_loglevel = CONSOLE_LOGLEVEL_DEFAULT;
         printk(KERN_INFO "SysRq : ");
 
         op_p = __sysrq_get_key_op(key);
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 14da82564f4e..6894b085f0ee 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -537,7 +537,7 @@ static struct attribute_group v9fs_attr_group = {
  *
  */
 
-static int v9fs_sysfs_init(void)
+static int __init v9fs_sysfs_init(void)
 {
         v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
         if (!v9fs_kobj)
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 4d0c2e0be7e5..0b3bfa303dda 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -42,7 +42,6 @@
 
 /**
  * struct p9_rdir - readdir accounting
- * @mutex: mutex protecting readdir
  * @head: start offset of current dirread buffer
  * @tail: end offset of current dirread buffer
  * @buf: dirread buffer
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 59e3fe3d56c0..96e550760699 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -681,7 +681,7 @@ v9fs_direct_read(struct file *filp, char __user *udata, size_t count,
 /**
  * v9fs_cached_file_read - read from a file
  * @filp: file pointer to read
- * @udata: user data buffer to read data into
+ * @data: user data buffer to read data into
  * @count: size of buffer
  * @offset: offset at which to read data
  *
@@ -698,7 +698,7 @@ v9fs_cached_file_read(struct file *filp, char __user *data, size_t count,
 /**
  * v9fs_mmap_file_read - read from a file
  * @filp: file pointer to read
- * @udata: user data buffer to read data into
+ * @data: user data buffer to read data into
  * @count: size of buffer
  * @offset: offset at which to read data
  *
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 53161ec058a7..00d140fb2263 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -580,7 +580,7 @@ static int v9fs_at_to_dotl_flags(int flags)
  * v9fs_remove - helper function to remove files and directories
  * @dir: directory inode that is being deleted
  * @dentry:  dentry that is being deleted
- * @rmdir: removing a directory
+ * @flags: removing a directory
  *
  */
 
@@ -778,7 +778,7 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
  * v9fs_vfs_lookup - VFS lookup hook to "walk" to a new inode
  * @dir:  inode that is being walked from
  * @dentry: dentry that is being walked to?
- * @nameidata: path data
+ * @flags: lookup flags (unused)
  *
  */
 
@@ -1324,7 +1324,7 @@ v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
  * v9fs_vfs_mkspecial - create a special file
  * @dir: inode to create special file in
  * @dentry: dentry to create
- * @mode: mode to create special file
+ * @perm: mode to create special file
  * @extension: 9p2000.u format extension string representing special file
  *
  */
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 59dc8e87647f..1fa85aae24df 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -226,7 +226,7 @@ int v9fs_open_to_dotl_flags(int flags)
  * v9fs_vfs_create_dotl - VFS hook to create files for 9P2000.L protocol.
  * @dir: directory inode that is being created
  * @dentry:  dentry that is being deleted
- * @mode: create permissions
+ * @omode: create permissions
  *
  */
 
@@ -375,7 +375,7 @@ err_clunk_old_fid:
  * v9fs_vfs_mkdir_dotl - VFS mkdir hook to create a directory
  * @dir:  inode that is being unlinked
  * @dentry: dentry that is being unlinked
- * @mode: mode for new directory
+ * @omode: mode for new directory
  *
  */
 
@@ -607,7 +607,6 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr)
  * v9fs_stat2inode_dotl - populate an inode structure with stat info
  * @stat: stat structure
  * @inode: inode to populate
- * @sb: superblock of filesystem
  *
  */
 
@@ -808,7 +807,7 @@ v9fs_vfs_link_dotl(struct dentry *old_dentry, struct inode *dir,
  * v9fs_vfs_mknod_dotl - create a special file
  * @dir: inode destination for new link
  * @dentry: dentry for file
- * @mode: mode for creation
+ * @omode: mode for creation
  * @rdev: device associated with special file
  *
  */
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 232e03d4780d..5b570b6efa28 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -737,7 +737,7 @@ MODULE_ALIAS_MISCDEV(AUTOFS_MINOR);
 MODULE_ALIAS("devname:autofs");
 
 /* Register/deregister misc character device */
-int autofs_dev_ioctl_init(void)
+int __init autofs_dev_ioctl_init(void)
 {
         int r;
 
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index aa3cb626671e..dabc73ab900f 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1686,7 +1686,7 @@ static size_t get_note_info_size(struct elf_note_info *info)
 static int write_note_info(struct elf_note_info *info,
                            struct coredump_params *cprm)
 {
-        bool first = 1;
+        bool first = true;
         struct elf_thread_core_info *t = info->thread;
 
         do {
@@ -1710,7 +1710,7 @@ static int write_note_info(struct elf_note_info *info,
                             !writenote(&t->notes[i], cprm))
                                 return 0;
 
-                first = 0;
+                first = false;
                 t = t->next;
         } while (t);
 
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index d50bbe59da1e..f723cd3a455c 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -380,7 +380,7 @@ failed:
 
 /****************************************************************************/
 
-void old_reloc(unsigned long rl)
+static void old_reloc(unsigned long rl)
 {
 #ifdef DEBUG
         char *segment[] = { "TEXT", "DATA", "BSS", "*UNKNOWN*" };
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 552a8d13bc32..83fba15cc394 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -363,6 +363,69 @@ int blkdev_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
 }
 EXPORT_SYMBOL(blkdev_fsync);
 
+/**
+ * bdev_read_page() - Start reading a page from a block device
+ * @bdev: The device to read the page from
+ * @sector: The offset on the device to read the page to (need not be aligned)
+ * @page: The page to read
+ *
+ * On entry, the page should be locked.  It will be unlocked when the page
+ * has been read.  If the block driver implements rw_page synchronously,
+ * that will be true on exit from this function, but it need not be.
+ *
+ * Errors returned by this function are usually "soft", eg out of memory, or
+ * queue full; callers should try a different route to read this page rather
+ * than propagate an error back up the stack.
+ *
+ * Return: negative errno if an error occurs, 0 if submission was successful.
+ */
+int bdev_read_page(struct block_device *bdev, sector_t sector,
+                        struct page *page)
+{
+        const struct block_device_operations *ops = bdev->bd_disk->fops;
+        if (!ops->rw_page)
+                return -EOPNOTSUPP;
+        return ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);
+}
+EXPORT_SYMBOL_GPL(bdev_read_page);
+
+/**
+ * bdev_write_page() - Start writing a page to a block device
+ * @bdev: The device to write the page to
+ * @sector: The offset on the device to write the page to (need not be aligned)
+ * @page: The page to write
+ * @wbc: The writeback_control for the write
+ *
+ * On entry, the page should be locked and not currently under writeback.
+ * On exit, if the write started successfully, the page will be unlocked and
+ * under writeback.  If the write failed already (eg the driver failed to
+ * queue the page to the device), the page will still be locked.  If the
+ * caller is a ->writepage implementation, it will need to unlock the page.
+ *
+ * Errors returned by this function are usually "soft", eg out of memory, or
+ * queue full; callers should try a different route to write this page rather
+ * than propagate an error back up the stack.
+ *
+ * Return: negative errno if an error occurs, 0 if submission was successful.
+ */
+int bdev_write_page(struct block_device *bdev, sector_t sector,
+                        struct page *page, struct writeback_control *wbc)
+{
+        int result;
+        int rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE;
+        const struct block_device_operations *ops = bdev->bd_disk->fops;
+        if (!ops->rw_page)
+                return -EOPNOTSUPP;
+        set_page_writeback(page);
+        result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw);
+        if (result)
+                end_page_writeback(page);
+        else
+                unlock_page(page);
+        return result;
+}
+EXPORT_SYMBOL_GPL(bdev_write_page);
+
 /*
  * pseudo-fs
  */
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index f29a54e454d4..4cd0ac983f91 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4510,7 +4510,8 @@ static void check_buffer_tree_ref(struct extent_buffer *eb)
         spin_unlock(&eb->refs_lock);
 }
 
-static void mark_extent_buffer_accessed(struct extent_buffer *eb)
+static void mark_extent_buffer_accessed(struct extent_buffer *eb,
+                struct page *accessed)
 {
         unsigned long num_pages, i;
 
@@ -4519,7 +4520,8 @@ static void mark_extent_buffer_accessed(struct extent_buffer *eb)
         num_pages = num_extent_pages(eb->start, eb->len);
         for (i = 0; i < num_pages; i++) {
                 struct page *p = extent_buffer_page(eb, i);
-                mark_page_accessed(p);
+                if (p != accessed)
+                        mark_page_accessed(p);
         }
 }
 
@@ -4533,7 +4535,7 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info,
                                start >> PAGE_CACHE_SHIFT);
         if (eb && atomic_inc_not_zero(&eb->refs)) {
                 rcu_read_unlock();
-                mark_extent_buffer_accessed(eb);
+                mark_extent_buffer_accessed(eb, NULL);
                 return eb;
         }
         rcu_read_unlock();
@@ -4581,7 +4583,7 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
                                 spin_unlock(&mapping->private_lock);
                                 unlock_page(p);
                                 page_cache_release(p);
-                                mark_extent_buffer_accessed(exists);
+                                mark_extent_buffer_accessed(exists, p);
                                 goto free_eb;
                         }
 
@@ -4596,7 +4598,6 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
                 attach_extent_buffer_page(eb, p);
                 spin_unlock(&mapping->private_lock);
                 WARN_ON(PageDirty(p));
-                mark_page_accessed(p);
                 eb->pages[i] = p;
                 if (!PageUptodate(p))
                         uptodate = 0;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index ae6af072b635..74272a3f9d9b 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -470,11 +470,12 @@ static void btrfs_drop_pages(struct page **pages, size_t num_pages)
         for (i = 0; i < num_pages; i++) {
                 /* page checked is some magic around finding pages that
                  * have been modified without going through btrfs_set_page_dirty
-                 * clear it here
+                 * clear it here. There should be no need to mark the pages
+                 * accessed as prepare_pages should have marked them accessed
+                 * in prepare_pages via find_or_create_page()
                  */
                 ClearPageChecked(pages[i]);
                 unlock_page(pages[i]);
-                mark_page_accessed(pages[i]);
                 page_cache_release(pages[i]);
         }
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index 6a8110c03a47..eba6e4f621ce 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -227,7 +227,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)
         int all_mapped = 1;
 
         index = block >> (PAGE_CACHE_SHIFT - bd_inode->i_blkbits);
-        page = find_get_page(bd_mapping, index);
+        page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED);
         if (!page)
                 goto out;
 
@@ -1366,12 +1366,13 @@ __find_get_block(struct block_device *bdev, sector_t block, unsigned size)
         struct buffer_head *bh = lookup_bh_lru(bdev, block, size);
 
         if (bh == NULL) {
+                /* __find_get_block_slow will mark the page accessed */
                 bh = __find_get_block_slow(bdev, block);
                 if (bh)
                         bh_lru_install(bh);
-        }
-        if (bh)
+        } else
                 touch_buffer(bh);
+
         return bh;
 }
 EXPORT_SYMBOL(__find_get_block);
@@ -1483,16 +1484,27 @@ EXPORT_SYMBOL(set_bh_page);
 /*
  * Called when truncating a buffer on a page completely.
  */
+
+/* Bits that are cleared during an invalidate */
+#define BUFFER_FLAGS_DISCARD \
+        (1 << BH_Mapped | 1 << BH_New | 1 << BH_Req | \
+         1 << BH_Delay | 1 << BH_Unwritten)
+
 static void discard_buffer(struct buffer_head * bh)
 {
+        unsigned long b_state, b_state_old;
+
         lock_buffer(bh);
         clear_buffer_dirty(bh);
         bh->b_bdev = NULL;
-        clear_buffer_mapped(bh);
-        clear_buffer_req(bh);
-        clear_buffer_new(bh);
-        clear_buffer_delay(bh);
-        clear_buffer_unwritten(bh);
+        b_state = bh->b_state;
+        for (;;) {
+                b_state_old = cmpxchg(&bh->b_state, b_state,
+                                      (b_state & ~BUFFER_FLAGS_DISCARD));
+                if (b_state_old == b_state)
+                        break;
+                b_state = b_state_old;
+        }
         unlock_buffer(bh);
 }
 
@@ -2879,10 +2891,9 @@ EXPORT_SYMBOL(block_truncate_page);
 
 /*
  * The generic ->writepage function for buffer-backed address_spaces
- * this form passes in the end_io handler used to finish the IO.
  */
-int block_write_full_page_endio(struct page *page, get_block_t *get_block,
-                        struct writeback_control *wbc, bh_end_io_t *handler)
+int block_write_full_page(struct page *page, get_block_t *get_block,
+                        struct writeback_control *wbc)
 {
         struct inode * const inode = page->mapping->host;
         loff_t i_size = i_size_read(inode);
@@ -2892,7 +2903,7 @@ int block_write_full_page_endio(struct page *page, get_block_t *get_block,
         /* Is the page fully inside i_size? */
         if (page->index < end_index)
                 return __block_write_full_page(inode, page, get_block, wbc,
-                                               handler);
+                                               end_buffer_async_write);
 
         /* Is the page fully outside i_size? (truncate in progress) */
         offset = i_size & (PAGE_CACHE_SIZE-1);
@@ -2915,18 +2926,8 @@ int block_write_full_page_endio(struct page *page, get_block_t *get_block,
          * writes to that region are not written out to the file."
          */
         zero_user_segment(page, offset, PAGE_CACHE_SIZE);
-        return __block_write_full_page(inode, page, get_block, wbc, handler);
-}
-EXPORT_SYMBOL(block_write_full_page_endio);
-
-/*
- * The generic ->writepage function for buffer-backed address_spaces
- */
-int block_write_full_page(struct page *page, get_block_t *get_block,
-                        struct writeback_control *wbc)
-{
-        return block_write_full_page_endio(page, get_block, wbc,
-                                           end_buffer_async_write);
+        return __block_write_full_page(inode, page, get_block, wbc,
+                                                        end_buffer_async_write);
 }
 EXPORT_SYMBOL(block_write_full_page);
 
diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index b5f0a3b91f18..bd4a3c167091 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -24,6 +24,12 @@
  * configfs Copyright (C) 2005 Oracle.  All rights reserved.
  */
 
+#ifdef pr_fmt
+#undef pr_fmt
+#endif
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index e081acbac2e7..668dcabc5695 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -940,9 +940,9 @@ static void client_drop_item(struct config_item *parent_item,
 #ifdef DEBUG
 static void configfs_dump_one(struct configfs_dirent *sd, int level)
 {
-        printk(KERN_INFO "%*s\"%s\":\n", level, " ", configfs_get_name(sd));
+        pr_info("%*s\"%s\":\n", level, " ", configfs_get_name(sd));
 
-#define type_print(_type) if (sd->s_type & _type) printk(KERN_INFO "%*s %s\n", level, " ", #_type);
+#define type_print(_type) if (sd->s_type & _type) pr_info("%*s %s\n", level, " ", #_type);
         type_print(CONFIGFS_ROOT);
         type_print(CONFIGFS_DIR);
         type_print(CONFIGFS_ITEM_ATTR);
@@ -1699,7 +1699,7 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys)
         struct dentry *root = dentry->d_sb->s_root;
 
         if (dentry->d_parent != root) {
-                printk(KERN_ERR "configfs: Tried to unregister non-subsystem!\n");
+                pr_err("Tried to unregister non-subsystem!\n");
                 return;
         }
 
@@ -1709,7 +1709,7 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys)
         mutex_lock(&configfs_symlink_mutex);
         spin_lock(&configfs_dirent_lock);
         if (configfs_detach_prep(dentry, NULL)) {
-                printk(KERN_ERR "configfs: Tried to unregister non-empty subsystem!\n");
+                pr_err("Tried to unregister non-empty subsystem!\n");
         }
         spin_unlock(&configfs_dirent_lock);
         mutex_unlock(&configfs_symlink_mutex);
diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c
index a9d35b0e06cf..5946ad98053f 100644
--- a/fs/configfs/inode.c
+++ b/fs/configfs/inode.c
@@ -168,9 +168,8 @@ static void configfs_set_inode_lock_class(struct configfs_dirent *sd,
                          * In practice the maximum level of locking depth is
                          * already reached. Just inform about possible reasons.
                          */
-                        printk(KERN_INFO "configfs: Too many levels of inodes"
-                               " for the locking correctness validator.\n");
-                        printk(KERN_INFO "Spurious warnings may appear.\n");
+                        pr_info("Too many levels of inodes for the locking correctness validator.\n");
+                        pr_info("Spurious warnings may appear.\n");
                 }
         }
 }
diff --git a/fs/configfs/item.c b/fs/configfs/item.c
index 50cee7f9110b..e65f9ffbb999 100644
--- a/fs/configfs/item.c
+++ b/fs/configfs/item.c
@@ -19,7 +19,7 @@
  * Boston, MA 021110-1307, USA.
  *
  * Based on kobject:
- *      kobject is Copyright (c) 2002-2003 Patrick Mochel
+ *      kobject is Copyright (c) 2002-2003 Patrick Mochel
  *
  * configfs Copyright (C) 2005 Oracle.  All rights reserved.
  *
@@ -35,9 +35,9 @@
 #include <linux/configfs.h>
 
 
-static inline struct config_item * to_item(struct list_head * entry)
+static inline struct config_item *to_item(struct list_head *entry)
 {
-        return container_of(entry,struct config_item,ci_entry);
+        return container_of(entry, struct config_item, ci_entry);
 }
 
 /* Evil kernel */
@@ -47,34 +47,35 @@ static void config_item_release(struct kref *kref);
  *      config_item_init - initialize item.
  *      @item:  item in question.
  */
-void config_item_init(struct config_item * item)
+void config_item_init(struct config_item *item)
 {
         kref_init(&item->ci_kref);
         INIT_LIST_HEAD(&item->ci_entry);
 }
+EXPORT_SYMBOL(config_item_init);
 
 /**
  *      config_item_set_name - Set the name of an item
  *      @item:  item.
- *      @name:  name.
+ *      @fmt:  The vsnprintf()'s format string.
  *
  *      If strlen(name) >= CONFIGFS_ITEM_NAME_LEN, then use a
  *      dynamically allocated string that @item->ci_name points to.
  *      Otherwise, use the static @item->ci_namebuf array.
  */
-int config_item_set_name(struct config_item * item, const char * fmt, ...)
+int config_item_set_name(struct config_item *item, const char *fmt, ...)
 {
         int error = 0;
         int limit = CONFIGFS_ITEM_NAME_LEN;
         int need;
         va_list args;
-        char * name;
+        char *name;
 
         /*
          * First, try the static array
          */
-        va_start(args,fmt);
-        need = vsnprintf(item->ci_namebuf,limit,fmt,args);
+        va_start(args, fmt);
+        need = vsnprintf(item->ci_namebuf, limit, fmt, args);
         va_end(args);
         if (need < limit)
                 name = item->ci_namebuf;
@@ -83,13 +84,13 @@ int config_item_set_name(struct config_item * item, const char * fmt, ...)
                  * Need more space? Allocate it and try again
                  */
                 limit = need + 1;
-                name = kmalloc(limit,GFP_KERNEL);
+                name = kmalloc(limit, GFP_KERNEL);
                 if (!name) {
                         error = -ENOMEM;
                         goto Done;
                 }
-                va_start(args,fmt);
-                need = vsnprintf(name,limit,fmt,args);
+                va_start(args, fmt);
+                need = vsnprintf(name, limit, fmt, args);
                 va_end(args);
 
                 /* Still? Give up. */
@@ -109,7 +110,6 @@ int config_item_set_name(struct config_item * item, const char * fmt, ...)
  Done:
         return error;
 }
-
 EXPORT_SYMBOL(config_item_set_name);
 
 void config_item_init_type_name(struct config_item *item,
@@ -131,20 +131,21 @@ void config_group_init_type_name(struct config_group *group, const char *name,
 }
 EXPORT_SYMBOL(config_group_init_type_name);
 
-struct config_item * config_item_get(struct config_item * item)
+struct config_item *config_item_get(struct config_item *item)
 {
         if (item)
                 kref_get(&item->ci_kref);
         return item;
 }
+EXPORT_SYMBOL(config_item_get);
 
-static void config_item_cleanup(struct config_item * item)
+static void config_item_cleanup(struct config_item *item)
 {
-        struct config_item_type * t = item->ci_type;
-        struct config_group * s = item->ci_group;
-        struct config_item * parent = item->ci_parent;
+        struct config_item_type *t = item->ci_type;
+        struct config_group *s = item->ci_group;
+        struct config_item *parent = item->ci_parent;
 
-        pr_debug("config_item %s: cleaning up\n",config_item_name(item));
+        pr_debug("config_item %s: cleaning up\n", config_item_name(item));
         if (item->ci_name != item->ci_namebuf)
                 kfree(item->ci_name);
         item->ci_name = NULL;
@@ -167,21 +168,23 @@ static void config_item_release(struct kref *kref)
  *
  *      Decrement the refcount, and if 0, call config_item_cleanup().
  */
-void config_item_put(struct config_item * item)
+void config_item_put(struct config_item *item)
 {
         if (item)
                 kref_put(&item->ci_kref, config_item_release);
 }
+EXPORT_SYMBOL(config_item_put);
 
 /**
  *      config_group_init - initialize a group for use
- *      @k:     group
+ *      @group: config_group
  */
 void config_group_init(struct config_group *group)
 {
         config_item_init(&group->cg_item);
         INIT_LIST_HEAD(&group->cg_children);
 }
+EXPORT_SYMBOL(config_group_init);
 
 /**
  *      config_group_find_item - search for item in group.
@@ -195,11 +198,11 @@ void config_group_init(struct config_group *group)
 struct config_item *config_group_find_item(struct config_group *group,
                                            const char *name)
 {
-        struct list_head * entry;
-        struct config_item * ret = NULL;
+        struct list_head *entry;
+        struct config_item *ret = NULL;
 
-        list_for_each(entry,&group->cg_children) {
-                struct config_item * item = to_item(entry);
+        list_for_each(entry, &group->cg_children) {
+                struct config_item *item = to_item(entry);
                 if (config_item_name(item) &&
                     !strcmp(config_item_name(item), name)) {
                         ret = config_item_get(item);
@@ -208,9 +211,4 @@ struct config_item *config_group_find_item(struct config_group *group,
         }
         return ret;
 }
-
-EXPORT_SYMBOL(config_item_init);
-EXPORT_SYMBOL(config_group_init);
-EXPORT_SYMBOL(config_item_get);
-EXPORT_SYMBOL(config_item_put);
 EXPORT_SYMBOL(config_group_find_item);
diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index 7f26c3cf75ae..f6c285833390 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -85,7 +85,7 @@ static int configfs_fill_super(struct super_block *sb, void *data, int silent)
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
                 inc_nlink(inode);
         } else {
-                pr_debug("configfs: could not get root inode\n");
+                pr_debug("could not get root inode\n");
                 return -ENOMEM;
         }
 
@@ -155,7 +155,7 @@ static int __init configfs_init(void)
 
         return 0;
 out4:
-        printk(KERN_ERR "configfs: Unable to register filesystem!\n");
+        pr_err("Unable to register filesystem!\n");
         configfs_inode_exit();
 out3:
         kobject_put(config_kobj);
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index becc725a1953..0a48886e069c 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -83,7 +83,7 @@ static int efivarfs_d_hash(const struct dentry *dentry, struct qstr *qstr)
         return 0;
 }
 
-static struct dentry_operations efivarfs_d_ops = {
+static const struct dentry_operations efivarfs_d_ops = {
         .d_compare = efivarfs_d_compare,
         .d_hash = efivarfs_d_hash,
         .d_delete = always_delete_dentry,
diff --git a/fs/efs/dir.c b/fs/efs/dir.c
index b72307ccdf7a..ce63b24f7c3e 100644
--- a/fs/efs/dir.c
+++ b/fs/efs/dir.c
@@ -26,7 +26,8 @@ static int efs_readdir(struct file *file, struct dir_context *ctx)
         int                     slot;
 
         if (inode->i_size & (EFS_DIRBSIZE-1))
-                printk(KERN_WARNING "EFS: WARNING: readdir(): directory size not a multiple of EFS_DIRBSIZE\n");
+                pr_warn("%s(): directory size not a multiple of EFS_DIRBSIZE\n",
+                        __func__);
 
         /* work out where this entry can be found */
         block = ctx->pos >> EFS_DIRBSIZE_BITS;
@@ -43,14 +44,15 @@ static int efs_readdir(struct file *file, struct dir_context *ctx)
                 bh = sb_bread(inode->i_sb, efs_bmap(inode, block));
 
                 if (!bh) {
-                        printk(KERN_ERR "EFS: readdir(): failed to read dir block %d\n", block);
+                        pr_err("%s(): failed to read dir block %d\n",
+                               __func__, block);
                         break;
                 }
 
                 dirblock = (struct efs_dir *) bh->b_data; 
 
                 if (be16_to_cpu(dirblock->magic) != EFS_DIRBLK_MAGIC) {
-                        printk(KERN_ERR "EFS: readdir(): invalid directory block\n");
+                        pr_err("%s(): invalid directory block\n", __func__);
                         brelse(bh);
                         break;
                 }
@@ -69,10 +71,9 @@ static int efs_readdir(struct file *file, struct dir_context *ctx)
                         inodenum = be32_to_cpu(dirslot->inode);
                         namelen  = dirslot->namelen;
                         nameptr  = dirslot->name;
-
-#ifdef DEBUG
-                        printk(KERN_DEBUG "EFS: readdir(): block %d slot %d/%d: inode %u, name \"%s\", namelen %u\n", block, slot, dirblock->slots-1, inodenum, nameptr, namelen);
-#endif
+                        pr_debug("%s(): block %d slot %d/%d: inode %u, name \"%s\", namelen %u\n",
+                                 __func__, block, slot, dirblock->slots-1,
+                                 inodenum, nameptr, namelen);
                         if (!namelen)
                                 continue;
                         /* found the next entry */
@@ -80,7 +81,8 @@ static int efs_readdir(struct file *file, struct dir_context *ctx)
 
                         /* sanity check */
                         if (nameptr - (char *) dirblock + namelen > EFS_DIRBSIZE) {
-                                printk(KERN_WARNING "EFS: directory entry %d exceeds directory block\n", slot);
+                                pr_warn("directory entry %d exceeds directory block\n",
+                                        slot);
                                 continue;
                         }
 
diff --git a/fs/efs/efs.h b/fs/efs/efs.h
index 5528926ac7f6..5bbf9612140c 100644
--- a/fs/efs/efs.h
+++ b/fs/efs/efs.h
@@ -7,6 +7,12 @@
 #ifndef _EFS_EFS_H_
 #define _EFS_EFS_H_
 
+#ifdef pr_fmt
+#undef pr_fmt
+#endif
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/fs.h>
 #include <asm/uaccess.h>
 
diff --git a/fs/efs/file.c b/fs/efs/file.c
index 1ccb364ffa63..a37dcee46866 100644
--- a/fs/efs/file.c
+++ b/fs/efs/file.c
@@ -22,10 +22,8 @@ int efs_get_block(struct inode *inode, sector_t iblock,
                 /*
                  * i have no idea why this happens as often as it does
                  */
-                printk(KERN_WARNING "EFS: bmap(): block %d >= %ld (filesize %ld)\n",
-                        block,
-                        inode->i_blocks,
-                        inode->i_size);
+                pr_warn("%s(): block %d >= %ld (filesize %ld)\n",
+                        __func__, block, inode->i_blocks, inode->i_size);
 #endif
                 return 0;
         }
@@ -38,7 +36,7 @@ int efs_get_block(struct inode *inode, sector_t iblock,
 int efs_bmap(struct inode *inode, efs_block_t block) {
 
         if (block < 0) {
-                printk(KERN_WARNING "EFS: bmap(): block < 0\n");
+                pr_warn("%s(): block < 0\n", __func__);
                 return 0;
         }
 
@@ -48,10 +46,8 @@ int efs_bmap(struct inode *inode, efs_block_t block) {
                 /*
                  * i have no idea why this happens as often as it does
                  */
-                printk(KERN_WARNING "EFS: bmap(): block %d >= %ld (filesize %ld)\n",
-                        block,
-                        inode->i_blocks,
-                        inode->i_size);
+                pr_warn("%s(): block %d >= %ld (filesize %ld)\n",
+                        __func__, block, inode->i_blocks, inode->i_size);
 #endif
                 return 0;
         }
diff --git a/fs/efs/inode.c b/fs/efs/inode.c
index d15ccf20f1b3..079d20306ee1 100644
--- a/fs/efs/inode.c
+++ b/fs/efs/inode.c
@@ -89,7 +89,7 @@ struct inode *efs_iget(struct super_block *super, unsigned long ino)
 
         bh = sb_bread(inode->i_sb, block);
         if (!bh) {
-                printk(KERN_WARNING "EFS: bread() failed at block %d\n", block);
+                pr_warn("%s() failed at block %d\n", __func__, block);
                 goto read_inode_error;
         }
 
@@ -130,19 +130,16 @@ struct inode *efs_iget(struct super_block *super, unsigned long ino)
         for(i = 0; i < EFS_DIRECTEXTENTS; i++) {
                 extent_copy(&(efs_inode->di_u.di_extents[i]), &(in->extents[i]));
                 if (i < in->numextents && in->extents[i].cooked.ex_magic != 0) {
-                        printk(KERN_WARNING "EFS: extent %d has bad magic number in inode %lu\n", i, inode->i_ino);
+                        pr_warn("extent %d has bad magic number in inode %lu\n",
+                                i, inode->i_ino);
                         brelse(bh);
                         goto read_inode_error;
                 }
         }
 
         brelse(bh);
-   
-#ifdef DEBUG
-        printk(KERN_DEBUG "EFS: efs_iget(): inode %lu, extents %d, mode %o\n",
-                inode->i_ino, in->numextents, inode->i_mode);
-#endif
-
+        pr_debug("efs_iget(): inode %lu, extents %d, mode %o\n",
+                 inode->i_ino, in->numextents, inode->i_mode);
         switch (inode->i_mode & S_IFMT) {
                 case S_IFDIR: 
                         inode->i_op = &efs_dir_inode_operations; 
@@ -162,7 +159,7 @@ struct inode *efs_iget(struct super_block *super, unsigned long ino)
                         init_special_inode(inode, inode->i_mode, device);
                         break;
                 default:
-                        printk(KERN_WARNING "EFS: unsupported inode mode %o\n", inode->i_mode);
+                        pr_warn("unsupported inode mode %o\n", inode->i_mode);
                         goto read_inode_error;
                         break;
         }
@@ -171,7 +168,7 @@ struct inode *efs_iget(struct super_block *super, unsigned long ino)
         return inode;
         
 read_inode_error:
-        printk(KERN_WARNING "EFS: failed to read inode %lu\n", inode->i_ino);
+        pr_warn("failed to read inode %lu\n", inode->i_ino);
         iget_failed(inode);
         return ERR_PTR(-EIO);
 }
@@ -216,7 +213,7 @@ efs_block_t efs_map_block(struct inode *inode, efs_block_t block) {
     
                 /* if we only have one extent then nothing can be found */
                 if (in->numextents == 1) {
-                        printk(KERN_ERR "EFS: map_block() failed to map (1 extent)\n");
+                        pr_err("%s() failed to map (1 extent)\n", __func__);
                         return 0;
                 }
 
@@ -234,13 +231,12 @@ efs_block_t efs_map_block(struct inode *inode, efs_block_t block) {
                         }
                 }
 
-                printk(KERN_ERR "EFS: map_block() failed to map block %u (dir)\n", block);
+                pr_err("%s() failed to map block %u (dir)\n", __func__, block);
                 return 0;
         }
 
-#ifdef DEBUG
-        printk(KERN_DEBUG "EFS: map_block(): indirect search for logical block %u\n", block);
-#endif
+        pr_debug("%s(): indirect search for logical block %u\n",
+                 __func__, block);
         direxts = in->extents[0].cooked.ex_offset;
         indexts = in->numextents;
 
@@ -262,7 +258,8 @@ efs_block_t efs_map_block(struct inode *inode, efs_block_t block) {
 
                 if (dirext == direxts) {
                         /* should never happen */
-                        printk(KERN_ERR "EFS: couldn't find direct extent for indirect extent %d (block %u)\n", cur, block);
+                        pr_err("couldn't find direct extent for indirect extent %d (block %u)\n",
+                               cur, block);
                         if (bh) brelse(bh);
                         return 0;
                 }
@@ -279,12 +276,12 @@ efs_block_t efs_map_block(struct inode *inode, efs_block_t block) {
 
                         bh = sb_bread(inode->i_sb, iblock);
                         if (!bh) {
-                                printk(KERN_ERR "EFS: bread() failed at block %d\n", iblock);
+                                pr_err("%s() failed at block %d\n",
+                                       __func__, iblock);
                                 return 0;
                         }
-#ifdef DEBUG
-                        printk(KERN_DEBUG "EFS: map_block(): read indirect extent block %d\n", iblock);
-#endif
+                        pr_debug("%s(): read indirect extent block %d\n",
+                                 __func__, iblock);
                         first = 0;
                         lastblock = iblock;
                 }
@@ -294,7 +291,8 @@ efs_block_t efs_map_block(struct inode *inode, efs_block_t block) {
                 extent_copy(&(exts[ioffset]), &ext);
 
                 if (ext.cooked.ex_magic != 0) {
-                        printk(KERN_ERR "EFS: extent %d has bad magic number in block %d\n", cur, iblock);
+                        pr_err("extent %d has bad magic number in block %d\n",
+                               cur, iblock);
                         if (bh) brelse(bh);
                         return 0;
                 }
@@ -306,7 +304,7 @@ efs_block_t efs_map_block(struct inode *inode, efs_block_t block) {
                 }
         }
         if (bh) brelse(bh);
-        printk(KERN_ERR "EFS: map_block() failed to map block %u (indir)\n", block);
+        pr_err("%s() failed to map block %u (indir)\n", __func__, block);
         return 0;
 }  
 
diff --git a/fs/efs/namei.c b/fs/efs/namei.c
index 96f66d213a19..356c044e2cd3 100644
--- a/fs/efs/namei.c
+++ b/fs/efs/namei.c
@@ -23,20 +23,22 @@ static efs_ino_t efs_find_entry(struct inode *inode, const char *name, int len)
         efs_block_t             block;
  
         if (inode->i_size & (EFS_DIRBSIZE-1))
-                printk(KERN_WARNING "EFS: WARNING: find_entry(): directory size not a multiple of EFS_DIRBSIZE\n");
+                pr_warn("%s(): directory size not a multiple of EFS_DIRBSIZE\n",
+                        __func__);
 
         for(block = 0; block < inode->i_blocks; block++) {
 
                 bh = sb_bread(inode->i_sb, efs_bmap(inode, block));
                 if (!bh) {
-                        printk(KERN_ERR "EFS: find_entry(): failed to read dir block %d\n", block);
+                        pr_err("%s(): failed to read dir block %d\n",
+                               __func__, block);
                         return 0;
                 }
     
                 dirblock = (struct efs_dir *) bh->b_data;
 
                 if (be16_to_cpu(dirblock->magic) != EFS_DIRBLK_MAGIC) {
-                        printk(KERN_ERR "EFS: find_entry(): invalid directory block\n");
+                        pr_err("%s(): invalid directory block\n", __func__);
                         brelse(bh);
                         return(0);
                 }
diff --git a/fs/efs/super.c b/fs/efs/super.c
index 3befcc9f5d63..7fca462ea4e3 100644
--- a/fs/efs/super.c
+++ b/fs/efs/super.c
@@ -134,7 +134,7 @@ static const struct export_operations efs_export_ops = {
 
 static int __init init_efs_fs(void) {
         int err;
-        printk("EFS: "EFS_VERSION" - http://aeschi.ch.eu.org/efs/\n");
+        pr_info(EFS_VERSION" - http://aeschi.ch.eu.org/efs/\n");
         err = init_inodecache();
         if (err)
                 goto out1;
@@ -179,12 +179,12 @@ static efs_block_t efs_validate_vh(struct volume_header *vh) {
                 csum += be32_to_cpu(cs);
         }
         if (csum) {
-                printk(KERN_INFO "EFS: SGI disklabel: checksum bad, label corrupted\n");
+                pr_warn("SGI disklabel: checksum bad, label corrupted\n");
                 return 0;
         }
 
 #ifdef DEBUG
-        printk(KERN_DEBUG "EFS: bf: \"%16s\"\n", vh->vh_bootfile);
+        pr_debug("bf: \"%16s\"\n", vh->vh_bootfile);
 
         for(i = 0; i < NVDIR; i++) {
                 int     j;
@@ -196,9 +196,8 @@ static efs_block_t efs_validate_vh(struct volume_header *vh) {
                 name[j] = (char) 0;
 
                 if (name[0]) {
-                        printk(KERN_DEBUG "EFS: vh: %8s block: 0x%08x size: 0x%08x\n",
-                                name,
-                                (int) be32_to_cpu(vh->vh_vd[i].vd_lbn),
+                        pr_debug("vh: %8s block: 0x%08x size: 0x%08x\n",
+                                name, (int) be32_to_cpu(vh->vh_vd[i].vd_lbn),
                                 (int) be32_to_cpu(vh->vh_vd[i].vd_nbytes));
                 }
         }
@@ -211,12 +210,11 @@ static efs_block_t efs_validate_vh(struct volume_header *vh) {
                 }
 #ifdef DEBUG
                 if (be32_to_cpu(vh->vh_pt[i].pt_nblks)) {
-                        printk(KERN_DEBUG "EFS: pt %2d: start: %08d size: %08d type: 0x%02x (%s)\n",
-                                i,
-                                (int) be32_to_cpu(vh->vh_pt[i].pt_firstlbn),
-                                (int) be32_to_cpu(vh->vh_pt[i].pt_nblks),
-                                pt_type,
-                                (pt_entry->pt_name) ? pt_entry->pt_name : "unknown");
+                        pr_debug("pt %2d: start: %08d size: %08d type: 0x%02x (%s)\n",
+                                 i, (int)be32_to_cpu(vh->vh_pt[i].pt_firstlbn),
+                                 (int)be32_to_cpu(vh->vh_pt[i].pt_nblks),
+                                 pt_type, (pt_entry->pt_name) ?
+                                 pt_entry->pt_name : "unknown");
                 }
 #endif
                 if (IS_EFS(pt_type)) {
@@ -226,11 +224,10 @@ static efs_block_t efs_validate_vh(struct volume_header *vh) {
         }
 
         if (slice == -1) {
-                printk(KERN_NOTICE "EFS: partition table contained no EFS partitions\n");
+                pr_notice("partition table contained no EFS partitions\n");
 #ifdef DEBUG
         } else {
-                printk(KERN_INFO "EFS: using slice %d (type %s, offset 0x%x)\n",
-                        slice,
+                pr_info("using slice %d (type %s, offset 0x%x)\n", slice,
                         (pt_entry->pt_name) ? pt_entry->pt_name : "unknown",
                         sblock);
 #endif
@@ -268,7 +265,7 @@ static int efs_fill_super(struct super_block *s, void *d, int silent)
  
         s->s_magic              = EFS_SUPER_MAGIC;
         if (!sb_set_blocksize(s, EFS_BLOCKSIZE)) {
-                printk(KERN_ERR "EFS: device does not support %d byte blocks\n",
+                pr_err("device does not support %d byte blocks\n",
                         EFS_BLOCKSIZE);
                 return -EINVAL;
         }
@@ -277,7 +274,7 @@ static int efs_fill_super(struct super_block *s, void *d, int silent)
         bh = sb_bread(s, 0);
 
         if (!bh) {
-                printk(KERN_ERR "EFS: cannot read volume header\n");
+                pr_err("cannot read volume header\n");
                 return -EINVAL;
         }
 
@@ -295,13 +292,14 @@ static int efs_fill_super(struct super_block *s, void *d, int silent)
 
         bh = sb_bread(s, sb->fs_start + EFS_SUPER);
         if (!bh) {
-                printk(KERN_ERR "EFS: cannot read superblock\n");
+                pr_err("cannot read superblock\n");
                 return -EINVAL;
         }
                 
         if (efs_validate_super(sb, (struct efs_super *) bh->b_data)) {
 #ifdef DEBUG
-                printk(KERN_WARNING "EFS: invalid superblock at block %u\n", sb->fs_start + EFS_SUPER);
+                pr_warn("invalid superblock at block %u\n",
+                        sb->fs_start + EFS_SUPER);
 #endif
                 brelse(bh);
                 return -EINVAL;
@@ -310,7 +308,7 @@ static int efs_fill_super(struct super_block *s, void *d, int silent)
 
         if (!(s->s_flags & MS_RDONLY)) {
 #ifdef DEBUG
-                printk(KERN_INFO "EFS: forcing read-only mode\n");
+                pr_info("forcing read-only mode\n");
 #endif
                 s->s_flags |= MS_RDONLY;
         }
@@ -318,13 +316,13 @@ static int efs_fill_super(struct super_block *s, void *d, int silent)
         s->s_export_op = &efs_export_ops;
         root = efs_iget(s, EFS_ROOTINODE);
         if (IS_ERR(root)) {
-                printk(KERN_ERR "EFS: get root inode failed\n");
+                pr_err("get root inode failed\n");
                 return PTR_ERR(root);
         }
 
         s->s_root = d_make_root(root);
         if (!(s->s_root)) {
-                printk(KERN_ERR "EFS: get root dentry failed\n");
+                pr_err("get root dentry failed\n");
                 return -ENOMEM;
         }
 
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 48a359dd286e..b01fbfb51f43 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -259,7 +259,7 @@ static int filldir_one(void * __buf, const char * name, int len,
 
 /**
  * get_name - default export_operations->get_name function
- * @dentry: the directory in which to find a name
+ * @path:   the directory in which to find a name
  * @name:   a pointer to a %NAME_MAX+1 char buffer to store the name
  * @child:  the dentry for the child directory.
  *
@@ -337,7 +337,7 @@ out:
 /**
  * export_encode_fh - default export_operations->encode_fh function
  * @inode:   the object to encode
- * @fh:      where to store the file handle fragment
+ * @fid:     where to store the file handle fragment
  * @max_len: maximum length to store there
  * @parent:  parent directory inode, if wanted
  *
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index c8238a26818c..afe8a133e3d1 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1044,6 +1044,8 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
          * allocating. If we are looking at the buddy cache we would
          * have taken a reference using ext4_mb_load_buddy and that
          * would have pinned buddy page to page cache.
+         * The call to ext4_mb_get_buddy_page_lock will mark the
+         * page accessed.
          */
         ret = ext4_mb_get_buddy_page_lock(sb, group, &e4b);
         if (ret || !EXT4_MB_GRP_NEED_INIT(this_grp)) {
@@ -1062,7 +1064,6 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
                 ret = -EIO;
                 goto err;
         }
-        mark_page_accessed(page);
 
         if (e4b.bd_buddy_page == NULL) {
                 /*
@@ -1082,7 +1083,6 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
                 ret = -EIO;
                 goto err;
         }
-        mark_page_accessed(page);
 err:
         ext4_mb_put_buddy_page_lock(&e4b);
         return ret;
@@ -1141,7 +1141,7 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
 
         /* we could use find_or_create_page(), but it locks page
          * what we'd like to avoid in fast path ... */
-        page = find_get_page(inode->i_mapping, pnum);
+        page = find_get_page_flags(inode->i_mapping, pnum, FGP_ACCESSED);
         if (page == NULL || !PageUptodate(page)) {
                 if (page)
                         /*
@@ -1176,15 +1176,16 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
                 ret = -EIO;
                 goto err;
         }
+
+        /* Pages marked accessed already */
         e4b->bd_bitmap_page = page;
         e4b->bd_bitmap = page_address(page) + (poff * sb->s_blocksize);
-        mark_page_accessed(page);
 
         block++;
         pnum = block / blocks_per_page;
         poff = block % blocks_per_page;
 
-        page = find_get_page(inode->i_mapping, pnum);
+        page = find_get_page_flags(inode->i_mapping, pnum, FGP_ACCESSED);
         if (page == NULL || !PageUptodate(page)) {
                 if (page)
                         page_cache_release(page);
@@ -1209,9 +1210,10 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
                 ret = -EIO;
                 goto err;
         }
+
+        /* Pages marked accessed already */
         e4b->bd_buddy_page = page;
         e4b->bd_buddy = page_address(page) + (poff * sb->s_blocksize);
-        mark_page_accessed(page);
 
         BUG_ON(e4b->bd_bitmap_page == NULL);
         BUG_ON(e4b->bd_buddy_page == NULL);
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index c18d95b50540..1a64e7a52b84 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -429,7 +429,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
                 block_start = bh_offset(bh);
                 if (block_start >= len) {
                         /*
-                         * Comments copied from block_write_full_page_endio:
+                         * Comments copied from block_write_full_page:
                          *
                          * The page straddles i_size.  It must be zeroed out on
                          * each and every writepage invocation because it may
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 4aa521aa9bc3..c405b8f17054 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -69,7 +69,6 @@ repeat:
                 goto repeat;
         }
 out:
-        mark_page_accessed(page);
         return page;
 }
 
@@ -137,13 +136,11 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, int start, int nrpages, int type)
                 if (!page)
                         continue;
                 if (PageUptodate(page)) {
-                        mark_page_accessed(page);
                         f2fs_put_page(page, 1);
                         continue;
                 }
 
                 f2fs_submit_page_mbio(sbi, page, blk_addr, &fio);
-                mark_page_accessed(page);
                 f2fs_put_page(page, 0);
         }
 out:
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index a161e955c4c8..57caa6eaf47b 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -967,7 +967,6 @@ repeat:
                 goto repeat;
         }
 got_it:
-        mark_page_accessed(page);
         return page;
 }
 
@@ -1022,7 +1021,6 @@ page_hit:
                 f2fs_put_page(page, 1);
                 return ERR_PTR(-EIO);
         }
-        mark_page_accessed(page);
         return page;
 }
 
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index f7cff367db7f..56cce7fdd39e 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -280,15 +280,15 @@ int fscache_add_cache(struct fscache_cache *cache,
         spin_unlock(&fscache_fsdef_index.lock);
         up_write(&fscache_addremove_sem);
 
-        printk(KERN_NOTICE "FS-Cache: Cache \"%s\" added (type %s)\n",
-               cache->tag->name, cache->ops->name);
+        pr_notice("Cache \"%s\" added (type %s)\n",
+                  cache->tag->name, cache->ops->name);
         kobject_uevent(cache->kobj, KOBJ_ADD);
 
         _leave(" = 0 [%s]", cache->identifier);
         return 0;
 
 tag_in_use:
-        printk(KERN_ERR "FS-Cache: Cache tag '%s' already in use\n", tagname);
+        pr_err("Cache tag '%s' already in use\n", tagname);
         __fscache_release_cache_tag(tag);
         _leave(" = -EXIST");
         return -EEXIST;
@@ -317,8 +317,7 @@ EXPORT_SYMBOL(fscache_add_cache);
 void fscache_io_error(struct fscache_cache *cache)
 {
         if (!test_and_set_bit(FSCACHE_IOERROR, &cache->flags))
-                printk(KERN_ERR "FS-Cache:"
-                       " Cache '%s' stopped due to I/O error\n",
+                pr_err("Cache '%s' stopped due to I/O error\n",
                        cache->ops->name);
 }
 EXPORT_SYMBOL(fscache_io_error);
@@ -369,8 +368,8 @@ void fscache_withdraw_cache(struct fscache_cache *cache)
 
         _enter("");
 
-        printk(KERN_NOTICE "FS-Cache: Withdrawing cache \"%s\"\n",
-               cache->tag->name);
+        pr_notice("Withdrawing cache \"%s\"\n",
+                  cache->tag->name);
 
         /* make the cache unavailable for cookie acquisition */
         if (test_and_set_bit(FSCACHE_CACHE_WITHDRAWN, &cache->flags))
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 29d7feb62cf7..aec01be91b0a 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -519,7 +519,7 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
         ASSERTCMP(atomic_read(&cookie->n_active), >, 0);
 
         if (atomic_read(&cookie->n_children) != 0) {
-                printk(KERN_ERR "FS-Cache: Cookie '%s' still has children\n",
+                pr_err("Cookie '%s' still has children\n",
                        cookie->def->name);
                 BUG();
         }
diff --git a/fs/fscache/histogram.c b/fs/fscache/histogram.c
index bad496748a59..7d637e2335fd 100644
--- a/fs/fscache/histogram.c
+++ b/fs/fscache/histogram.c
@@ -31,12 +31,10 @@ static int fscache_histogram_show(struct seq_file *m, void *v)
 
         switch ((unsigned long) v) {
         case 1:
-                seq_puts(m, "JIFS  SECS  OBJ INST  OP RUNS   OBJ RUNS "
-                         " RETRV DLY RETRIEVLS\n");
+                seq_puts(m, "JIFS  SECS  OBJ INST  OP RUNS   OBJ RUNS  RETRV DLY RETRIEVLS\n");
                 return 0;
         case 2:
-                seq_puts(m, "===== ===== ========= ========= ========="
-                         " ========= =========\n");
+                seq_puts(m, "===== ===== ========= ========= ========= ========= =========\n");
                 return 0;
         default:
                 index = (unsigned long) v - 3;
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index 4226f6680b06..bc6c08fcfddd 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -22,6 +22,12 @@
  *
  */
 
+#ifdef pr_fmt
+#undef pr_fmt
+#endif
+
+#define pr_fmt(fmt) "FS-Cache: " fmt
+
 #include <linux/fscache-cache.h>
 #include <linux/sched.h>
 
@@ -413,8 +419,8 @@ do {						\
 #define ASSERT(X)                                                       \
 do {                                                                    \
         if (unlikely(!(X))) {                                           \
-                printk(KERN_ERR "\n");                                  \
-                printk(KERN_ERR "FS-Cache: Assertion failed\n");        \
+                pr_err("\n");                                   \
+                pr_err("Assertion failed\n");   \
                 BUG();                                                  \
         }                                                               \
 } while (0)
@@ -422,9 +428,9 @@ do {									\
 #define ASSERTCMP(X, OP, Y)                                             \
 do {                                                                    \
         if (unlikely(!((X) OP (Y)))) {                                  \
-                printk(KERN_ERR "\n");                                  \
-                printk(KERN_ERR "FS-Cache: Assertion failed\n");        \
-                printk(KERN_ERR "%lx " #OP " %lx is false\n",           \
+                pr_err("\n");                                   \
+                pr_err("Assertion failed\n");   \
+                pr_err("%lx " #OP " %lx is false\n",            \
                        (unsigned long)(X), (unsigned long)(Y));         \
                 BUG();                                                  \
         }                                                               \
@@ -433,8 +439,8 @@ do {									\
 #define ASSERTIF(C, X)                                                  \
 do {                                                                    \
         if (unlikely((C) && !(X))) {                                    \
-                printk(KERN_ERR "\n");                                  \
-                printk(KERN_ERR "FS-Cache: Assertion failed\n");        \
+                pr_err("\n");                                   \
+                pr_err("Assertion failed\n");   \
                 BUG();                                                  \
         }                                                               \
 } while (0)
@@ -442,9 +448,9 @@ do {									\
 #define ASSERTIFCMP(C, X, OP, Y)                                        \
 do {                                                                    \
         if (unlikely((C) && !((X) OP (Y)))) {                           \
-                printk(KERN_ERR "\n");                                  \
-                printk(KERN_ERR "FS-Cache: Assertion failed\n");        \
-                printk(KERN_ERR "%lx " #OP " %lx is false\n",           \
+                pr_err("\n");                                   \
+                pr_err("Assertion failed\n");   \
+                pr_err("%lx " #OP " %lx is false\n",            \
                        (unsigned long)(X), (unsigned long)(Y));         \
                 BUG();                                                  \
         }                                                               \
diff --git a/fs/fscache/main.c b/fs/fscache/main.c
index 7c27907e650c..acd4bf1fc277 100644
--- a/fs/fscache/main.c
+++ b/fs/fscache/main.c
@@ -146,8 +146,7 @@ static int __init fscache_init(void)
                                                0,
                                                fscache_cookie_init_once);
         if (!fscache_cookie_jar) {
-                printk(KERN_NOTICE
-                       "FS-Cache: Failed to allocate a cookie jar\n");
+                pr_notice("Failed to allocate a cookie jar\n");
                 ret = -ENOMEM;
                 goto error_cookie_jar;
         }
@@ -156,7 +155,7 @@ static int __init fscache_init(void)
         if (!fscache_root)
                 goto error_kobj;
 
-        printk(KERN_NOTICE "FS-Cache: Loaded\n");
+        pr_notice("Loaded\n");
         return 0;
 
 error_kobj:
@@ -192,7 +191,7 @@ static void __exit fscache_exit(void)
         fscache_proc_cleanup();
         destroy_workqueue(fscache_op_wq);
         destroy_workqueue(fscache_object_wq);
-        printk(KERN_NOTICE "FS-Cache: Unloaded\n");
+        pr_notice("Unloaded\n");
 }
 
 module_exit(fscache_exit);
diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
index 989f39401547..6d941f56faf4 100644
--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -65,8 +65,7 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
         list_add(&netfs->link, &fscache_netfs_list);
         ret = 0;
 
-        printk(KERN_NOTICE "FS-Cache: Netfs '%s' registered for caching\n",
-               netfs->name);
+        pr_notice("Netfs '%s' registered for caching\n", netfs->name);
 
 already_registered:
         up_write(&fscache_addremove_sem);
@@ -97,8 +96,8 @@ void __fscache_unregister_netfs(struct fscache_netfs *netfs)
 
         up_write(&fscache_addremove_sem);
 
-        printk(KERN_NOTICE "FS-Cache: Netfs '%s' unregistered from caching\n",
-               netfs->name);
+        pr_notice("Netfs '%s' unregistered from caching\n",
+                  netfs->name);
 
         _leave("");
 }
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index b5ebc2d7d80d..b8179ca6bf9d 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -285,20 +285,20 @@ static int fscache_objlist_show(struct seq_file *m, void *v)
                 fscache_unuse_cookie(obj);
 
                 if (keylen > 0 || auxlen > 0) {
-                        seq_printf(m, " ");
+                        seq_puts(m, " ");
                         for (p = buf; keylen > 0; keylen--)
                                 seq_printf(m, "%02x", *p++);
                         if (auxlen > 0) {
                                 if (config & FSCACHE_OBJLIST_CONFIG_KEY)
-                                        seq_printf(m, ", ");
+                                        seq_puts(m, ", ");
                                 for (; auxlen > 0; auxlen--)
                                         seq_printf(m, "%02x", *p++);
                         }
                 }
 
-                seq_printf(m, "\n");
+                seq_puts(m, "\n");
         } else {
-                seq_printf(m, "<no_netfs>\n");
+                seq_puts(m, "<no_netfs>\n");
         }
         return 0;
 }
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index 318071aca217..e7b87a0e5185 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -51,8 +51,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
                 _debug("queue for caller's attention");
                 break;
         default:
-                printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
-                       op->flags);
+                pr_err("Unexpected op type %lx", op->flags);
                 BUG();
                 break;
         }
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index 7f5c658af755..ed70714503fa 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -1108,10 +1108,8 @@ void fscache_mark_page_cached(struct fscache_retrieval *op, struct page *page)
                 static bool once_only;
                 if (!once_only) {
                         once_only = true;
-                        printk(KERN_WARNING "FS-Cache:"
-                               " Cookie type %s marked page %lx"
-                               " multiple times\n",
-                               cookie->def->name, page->index);
+                        pr_warn("Cookie type %s marked page %lx multiple times\n",
+                                cookie->def->name, page->index);
                 }
         }
 
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index aac71ce373e4..098f97bdcf1b 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1614,7 +1614,7 @@ out_finish:
 
 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        release_pages(req->pages, req->num_pages, 0);
+        release_pages(req->pages, req->num_pages, false);
 }
 
 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f680d2c44e97..903cbc9cd6bd 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1089,8 +1089,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                 tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
                 flush_dcache_page(page);
 
-                mark_page_accessed(page);
-
                 if (!tmp) {
                         unlock_page(page);
                         page_cache_release(page);
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 5a49b037da81..492123cda64a 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -577,7 +577,6 @@ int gfs2_internal_read(struct gfs2_inode *ip, char *buf, loff_t *pos,
                 p = kmap_atomic(page);
                 memcpy(buf + copied, p + offset, amt);
                 kunmap_atomic(p);
-                mark_page_accessed(page);
                 page_cache_release(page);
                 copied += amt;
                 index++;
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 2cf09b63a6b4..b984a6e190bc 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -136,7 +136,8 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create)
                         yield();
                 }
         } else {
-                page = find_lock_page(mapping, index);
+                page = find_get_page_flags(mapping, index,
+                                                FGP_LOCK|FGP_ACCESSED);
                 if (!page)
                         return NULL;
         }
@@ -153,7 +154,6 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create)
                 map_bh(bh, sdp->sd_vfs, blkno);
 
         unlock_page(page);
-        mark_page_accessed(page);
         page_cache_release(page);
 
         return bh;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index e19d4c0cacae..1e2872b25343 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -6,6 +6,8 @@
  * Copyright (C) 2002 Linus Torvalds.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/thread_info.h>
 #include <asm/current.h>
@@ -475,7 +477,7 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
  * annotation because huge_pmd_share() does an allocation under
  * i_mmap_mutex.
  */
-struct lock_class_key hugetlbfs_i_mmap_mutex_key;
+static struct lock_class_key hugetlbfs_i_mmap_mutex_key;
 
 static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                                         struct inode *dir,
@@ -823,8 +825,7 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
                         ps = memparse(args[0].from, &rest);
                         pconfig->hstate = size_to_hstate(ps);
                         if (!pconfig->hstate) {
-                                printk(KERN_ERR
-                                "hugetlbfs: Unsupported page size %lu MB\n",
+                                pr_err("Unsupported page size %lu MB\n",
                                         ps >> 20);
                                 return -EINVAL;
                         }
@@ -832,8 +833,7 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
                 }
 
                 default:
-                        printk(KERN_ERR "hugetlbfs: Bad mount option: \"%s\"\n",
-                                 p);
+                        pr_err("Bad mount option: \"%s\"\n", p);
                         return -EINVAL;
                         break;
                 }
@@ -853,8 +853,7 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
         return 0;
 
 bad_val:
-        printk(KERN_ERR "hugetlbfs: Bad value '%s' for mount option '%s'\n",
-               args[0].from, p);
+        pr_err("Bad value '%s' for mount option '%s'\n", args[0].from, p);
         return -EINVAL;
 }
 
@@ -902,8 +901,7 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
                 goto out_free;
         return 0;
 out_free:
-        if (sbinfo->spool)
-                kfree(sbinfo->spool);
+        kfree(sbinfo->spool);
         kfree(sbinfo);
         return -ENOMEM;
 }
@@ -939,7 +937,7 @@ static int get_hstate_idx(int page_size_log)
         return h - hstates;
 }
 
-static struct dentry_operations anon_ops = {
+static const struct dentry_operations anon_ops = {
         .d_dname = simple_dname
 };
 
@@ -970,8 +968,7 @@ struct file *hugetlb_file_setup(const char *name, size_t size,
                 *user = current_user();
                 if (user_shm_lock(size, *user)) {
                         task_lock(current);
-                        printk_once(KERN_WARNING
-                                "%s (%d): Using mlock ulimits for SHM_HUGETLB is deprecated\n",
+                        pr_warn_once("%s (%d): Using mlock ulimits for SHM_HUGETLB is deprecated\n",
                                 current->comm, current->pid);
                         task_unlock(current);
                 } else {
@@ -1031,7 +1028,7 @@ static int __init init_hugetlbfs_fs(void)
         int i;
 
         if (!hugepages_supported()) {
-                pr_info("hugetlbfs: disabling because there are no supported hugepage sizes\n");
+                pr_info("disabling because there are no supported hugepage sizes\n");
                 return -ENOTSUPP;
         }
 
@@ -1060,7 +1057,7 @@ static int __init init_hugetlbfs_fs(void)
                                                         buf);
 
                 if (IS_ERR(hugetlbfs_vfsmount[i])) {
-                        pr_err("hugetlb: Cannot mount internal hugetlbfs for "
+                        pr_err("Cannot mount internal hugetlbfs for "
                                 "page size %uK", ps_kb);
                         error = PTR_ERR(hugetlbfs_vfsmount[i]);
                         hugetlbfs_vfsmount[i] = NULL;
diff --git a/fs/libfs.c b/fs/libfs.c
index a1844244246f..88e3e00e2eca 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -3,6 +3,7 @@
  *      Library for filesystems writers.
  */
 
+#include <linux/blkdev.h>
 #include <linux/export.h>
 #include <linux/pagemap.h>
 #include <linux/slab.h>
@@ -923,16 +924,19 @@ struct dentry *generic_fh_to_parent(struct super_block *sb, struct fid *fid,
 EXPORT_SYMBOL_GPL(generic_fh_to_parent);
 
 /**
- * generic_file_fsync - generic fsync implementation for simple filesystems
+ * __generic_file_fsync - generic fsync implementation for simple filesystems
+ *
  * @file:       file to synchronize
+ * @start:      start offset in bytes
+ * @end:        end offset in bytes (inclusive)
  * @datasync:   only synchronize essential metadata if true
  *
  * This is a generic implementation of the fsync method for simple
  * filesystems which track all non-inode metadata in the buffers list
  * hanging off the address_space structure.
  */
-int generic_file_fsync(struct file *file, loff_t start, loff_t end,
-                       int datasync)
+int __generic_file_fsync(struct file *file, loff_t start, loff_t end,
+                                 int datasync)
 {
         struct inode *inode = file->f_mapping->host;
         int err;
@@ -952,10 +956,34 @@ int generic_file_fsync(struct file *file, loff_t start, loff_t end,
         err = sync_inode_metadata(inode, 1);
         if (ret == 0)
                 ret = err;
+
 out:
         mutex_unlock(&inode->i_mutex);
         return ret;
 }
+EXPORT_SYMBOL(__generic_file_fsync);
+
+/**
+ * generic_file_fsync - generic fsync implementation for simple filesystems
+ *                      with flush
+ * @file:       file to synchronize
+ * @start:      start offset in bytes
+ * @end:        end offset in bytes (inclusive)
+ * @datasync:   only synchronize essential metadata if true
+ *
+ */
+
+int generic_file_fsync(struct file *file, loff_t start, loff_t end,
+                       int datasync)
+{
+        struct inode *inode = file->f_mapping->host;
+        int err;
+
+        err = __generic_file_fsync(file, start, end, datasync);
+        if (err)
+                return err;
+        return blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL);
+}
 EXPORT_SYMBOL(generic_file_fsync);
 
 /**
diff --git a/fs/mpage.c b/fs/mpage.c
index 4979ffa60aaa..5f9ed622274f 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -48,23 +48,7 @@ static void mpage_end_io(struct bio *bio, int err)
 
         bio_for_each_segment_all(bv, bio, i) {
                 struct page *page = bv->bv_page;
-
-                if (bio_data_dir(bio) == READ) {
-                        if (!err) {
-                                SetPageUptodate(page);
-                        } else {
-                                ClearPageUptodate(page);
-                                SetPageError(page);
-                        }
-                        unlock_page(page);
-                } else { /* bio_data_dir(bio) == WRITE */
-                        if (err) {
-                                SetPageError(page);
-                                if (page->mapping)
-                                        set_bit(AS_EIO, &page->mapping->flags);
-                        }
-                        end_page_writeback(page);
-                }
+                page_endio(page, bio_data_dir(bio), err);
         }
 
         bio_put(bio);
@@ -285,6 +269,11 @@ do_mpage_readpage(struct bio *bio, struct page *page, unsigned nr_pages,
 
 alloc_new:
         if (bio == NULL) {
+                if (first_hole == blocks_per_page) {
+                        if (!bdev_read_page(bdev, blocks[0] << (blkbits - 9),
+                                                                page))
+                                goto out;
+                }
                 bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),
                                 min_t(int, nr_pages, bio_get_nr_vecs(bdev)),
                                 GFP_KERNEL);
@@ -439,6 +428,35 @@ struct mpage_data {
         unsigned use_writepage;
 };
 
+/*
+ * We have our BIO, so we can now mark the buffers clean.  Make
+ * sure to only clean buffers which we know we'll be writing.
+ */
+static void clean_buffers(struct page *page, unsigned first_unmapped)
+{
+        unsigned buffer_counter = 0;
+        struct buffer_head *bh, *head;
+        if (!page_has_buffers(page))
+                return;
+        head = page_buffers(page);
+        bh = head;
+
+        do {
+                if (buffer_counter++ == first_unmapped)
+                        break;
+                clear_buffer_dirty(bh);
+                bh = bh->b_this_page;
+        } while (bh != head);
+
+        /*
+         * we cannot drop the bh if the page is not uptodate or a concurrent
+         * readpage would fail to serialize with the bh and it would read from
+         * disk before we reach the platter.
+         */
+        if (buffer_heads_over_limit && PageUptodate(page))
+                try_to_free_buffers(page);
+}
+
 static int __mpage_writepage(struct page *page, struct writeback_control *wbc,
                       void *data)
 {
@@ -574,6 +592,13 @@ page_is_mapped:
 
 alloc_new:
         if (bio == NULL) {
+                if (first_unmapped == blocks_per_page) {
+                        if (!bdev_write_page(bdev, blocks[0] << (blkbits - 9),
+                                                                page, wbc)) {
+                                clean_buffers(page, first_unmapped);
+                                goto out;
+                        }
+                }
                 bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),
                                 bio_get_nr_vecs(bdev), GFP_NOFS|__GFP_HIGH);
                 if (bio == NULL)
@@ -591,30 +616,7 @@ alloc_new:
                 goto alloc_new;
         }
 
-        /*
-         * OK, we have our BIO, so we can now mark the buffers clean.  Make
-         * sure to only clean buffers which we know we'll be writing.
-         */
-        if (page_has_buffers(page)) {
-                struct buffer_head *head = page_buffers(page);
-                struct buffer_head *bh = head;
-                unsigned buffer_counter = 0;
-
-                do {
-                        if (buffer_counter++ == first_unmapped)
-                                break;
-                        clear_buffer_dirty(bh);
-                        bh = bh->b_this_page;
-                } while (bh != head);
-
-                /*
-                 * we cannot drop the bh if the page is not uptodate
-                 * or a concurrent readpage would fail to serialize with the bh
-                 * and it would read from disk before we reach the platter.
-                 */
-                if (buffer_heads_over_limit && PageUptodate(page))
-                        try_to_free_buffers(page);
-        }
+        clean_buffers(page, first_unmapped);
 
         BUG_ON(PageWriteback(page));
         set_page_writeback(page);
diff --git a/fs/ncpfs/getopt.c b/fs/ncpfs/getopt.c
index 03ffde1f44d6..344889cd120e 100644
--- a/fs/ncpfs/getopt.c
+++ b/fs/ncpfs/getopt.c
@@ -53,15 +53,14 @@ int ncp_getopt(const char *caller, char **options, const struct ncp_option *opts
                                 return -EINVAL;
                         }
                         if (opts->has_arg & OPT_INT) {
-                                char* v;
+                                int rc = kstrtoul(val, 0, value);
 
-                                *value = simple_strtoul(val, &v, 0);
-                                if (!*v) {
-                                        return opts->val;
+                                if (rc) {
+                                        pr_info("%s: invalid numeric value in %s=%s\n",
+                                                caller, token, val);
+                                        return rc;
                                 }
-                                pr_info("%s: invalid numeric value in %s=%s\n",
-                                        caller, token, val);
-                                return -EDOM;
+                                return opts->val;
                         }
                         if (opts->has_arg & OPT_STRING) {
                                 return opts->val;
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 732648b270dc..3fdc8a3e1134 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -25,6 +25,19 @@
 #define FANOTIFY_DEFAULT_MAX_MARKS      8192
 #define FANOTIFY_DEFAULT_MAX_LISTENERS  128
 
+/*
+ * All flags that may be specified in parameter event_f_flags of fanotify_init.
+ *
+ * Internal and external open flags are stored together in field f_flags of
+ * struct file. Only external open flags shall be allowed in event_f_flags.
+ * Internal flags like FMODE_NONOTIFY, FMODE_EXEC, FMODE_NOCMTIME shall be
+ * excluded.
+ */
+#define FANOTIFY_INIT_ALL_EVENT_F_BITS                          ( \
+                O_ACCMODE       | O_APPEND      | O_NONBLOCK    | \
+                __O_SYNC        | O_DSYNC       | O_CLOEXEC     | \
+                O_LARGEFILE     | O_NOATIME     )
+
 extern const struct fsnotify_ops fanotify_fsnotify_ops;
 
 static struct kmem_cache *fanotify_mark_cache __read_mostly;
@@ -669,6 +682,18 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
         if (flags & ~FAN_ALL_INIT_FLAGS)
                 return -EINVAL;
 
+        if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS)
+                return -EINVAL;
+
+        switch (event_f_flags & O_ACCMODE) {
+        case O_RDONLY:
+        case O_RDWR:
+        case O_WRONLY:
+                break;
+        default:
+                return -EINVAL;
+        }
+
         user = get_current_user();
         if (atomic_read(&user->fanotify_listeners) > FANOTIFY_DEFAULT_MAX_LISTENERS) {
                 free_uid(user);
@@ -776,7 +801,10 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
         case FAN_MARK_REMOVE:
                 if (!mask)
                         return -EINVAL;
+                break;
         case FAN_MARK_FLUSH:
+                if (flags & ~(FAN_MARK_MOUNT | FAN_MARK_FLUSH))
+                        return -EINVAL;
                 break;
         default:
                 return -EINVAL;
@@ -813,6 +841,15 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
             group->priority == FS_PRIO_0)
                 goto fput_and_out;
 
+        if (flags & FAN_MARK_FLUSH) {
+                ret = 0;
+                if (flags & FAN_MARK_MOUNT)
+                        fsnotify_clear_vfsmount_marks_by_group(group);
+                else
+                        fsnotify_clear_inode_marks_by_group(group);
+                goto fput_and_out;
+        }
+
         ret = fanotify_find_path(dfd, pathname, &path, flags);
         if (ret)
                 goto fput_and_out;
@@ -824,7 +861,7 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
                 mnt = path.mnt;
 
         /* create/update an inode mark */
-        switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE | FAN_MARK_FLUSH)) {
+        switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE)) {
         case FAN_MARK_ADD:
                 if (flags & FAN_MARK_MOUNT)
                         ret = fanotify_add_vfsmount_mark(group, mnt, mask, flags);
@@ -837,12 +874,6 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
                 else
                         ret = fanotify_remove_inode_mark(group, inode, mask, flags);
                 break;
-        case FAN_MARK_FLUSH:
-                if (flags & FAN_MARK_MOUNT)
-                        fsnotify_clear_vfsmount_marks_by_group(group);
-                else
-                        fsnotify_clear_inode_marks_by_group(group);
-                break;
         default:
                 ret = -EINVAL;
         }
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 923fe4a5f503..d90deaa08e78 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -340,7 +340,7 @@ void fsnotify_init_mark(struct fsnotify_mark *mark,
 static int fsnotify_mark_destroy(void *ignored)
 {
         struct fsnotify_mark *mark, *next;
-        LIST_HEAD(private_destroy_list);
+        struct list_head private_destroy_list;
 
         for (;;) {
                 spin_lock(&destroy_lock);
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index a27e3fecefaf..250ed5b20c8f 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -1748,7 +1748,6 @@ int ntfs_attr_make_non_resident(ntfs_inode *ni, const u32 data_size)
         if (page) {
                 set_page_dirty(page);
                 unlock_page(page);
-                mark_page_accessed(page);
                 page_cache_release(page);
         }
         ntfs_debug("Done.");
diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index ee4144ce5d7c..f82498c35e78 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -58,7 +58,7 @@ typedef enum {
 /**
  * ntfs_compression_buffer - one buffer for the decompression engine
  */
-static u8 *ntfs_compression_buffer = NULL;
+static u8 *ntfs_compression_buffer;
 
 /**
  * ntfs_cb_lock - spinlock which protects ntfs_compression_buffer
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index db9bd8a31725..86ddab916b66 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -2060,7 +2060,6 @@ static ssize_t ntfs_file_buffered_write(struct kiocb *iocb,
                 }
                 do {
                         unlock_page(pages[--do_pages]);
-                        mark_page_accessed(pages[do_pages]);
                         page_cache_release(pages[do_pages]);
                 } while (do_pages);
                 if (unlikely(status))
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 9de2491f2926..6c3296e546c3 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -50,8 +50,8 @@
 static unsigned long ntfs_nr_compression_users;
 
 /* A global default upcase table and a corresponding reference count. */
-static ntfschar *default_upcase = NULL;
-static unsigned long ntfs_nr_upcase_users = 0;
+static ntfschar *default_upcase;
+static unsigned long ntfs_nr_upcase_users;
 
 /* Error constants/strings used in inode.c::ntfs_show_options(). */
 typedef enum {
diff --git a/fs/ntfs/sysctl.c b/fs/ntfs/sysctl.c
index 79a89184cb5e..1927170a35ce 100644
--- a/fs/ntfs/sysctl.c
+++ b/fs/ntfs/sysctl.c
@@ -56,7 +56,7 @@ static ctl_table sysctls_root[] = {
 };
 
 /* Storage for the sysctls header. */
-static struct ctl_table_header *sysctls_root_table = NULL;
+static struct ctl_table_header *sysctls_root_table;
 
 /**
  * ntfs_sysctl - add or remove the debug sysctl
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index b4deb5f750d9..9d8fcf2f3b94 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -6046,7 +6046,8 @@ static void ocfs2_truncate_log_worker(struct work_struct *work)
 void ocfs2_schedule_truncate_log_flush(struct ocfs2_super *osb,
                                        int cancel)
 {
-        if (osb->osb_tl_inode) {
+        if (osb->osb_tl_inode &&
+                        atomic_read(&osb->osb_tl_disable) == 0) {
                 /* We want to push off log flushes while truncates are
                  * still running. */
                 if (cancel)
@@ -6223,6 +6224,8 @@ void ocfs2_truncate_log_shutdown(struct ocfs2_super *osb)
         int status;
         struct inode *tl_inode = osb->osb_tl_inode;
 
+        atomic_set(&osb->osb_tl_disable, 1);
+
         if (tl_inode) {
                 cancel_delayed_work(&osb->osb_truncate_log_wq);
                 flush_workqueue(ocfs2_wq);
@@ -6254,6 +6257,7 @@ int ocfs2_truncate_log_init(struct ocfs2_super *osb)
          * until we're sure all is well. */
         INIT_DELAYED_WORK(&osb->osb_truncate_log_wq,
                           ocfs2_truncate_log_worker);
+        atomic_set(&osb->osb_tl_disable, 0);
         osb->osb_tl_bh    = tl_bh;
         osb->osb_tl_inode = tl_inode;
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index c6b90e670389..a68e07a9bd46 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -108,7 +108,7 @@ static struct rb_root o2net_handler_tree = RB_ROOT;
 static struct o2net_node o2net_nodes[O2NM_MAX_NODES];
 
 /* XXX someday we'll need better accounting */
-static struct socket *o2net_listen_sock = NULL;
+static struct socket *o2net_listen_sock;
 
 /*
  * listen work is only queued by the listening socket callbacks on the
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index e0517762fcc0..a106b3f2b22a 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -108,7 +108,6 @@ static inline int dlm_is_recovery_lock(const char *lock_name, int name_len)
 struct dlm_recovery_ctxt
 {
         struct list_head resources;
-        struct list_head received;
         struct list_head node_data;
         u8  new_master;
         u8  dead_node;
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index e33cd7a3c582..18f13c2e4a10 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -338,7 +338,7 @@ void dlm_print_one_mle(struct dlm_master_list_entry *mle)
 
 #ifdef CONFIG_DEBUG_FS
 
-static struct dentry *dlm_debugfs_root = NULL;
+static struct dentry *dlm_debugfs_root;
 
 #define DLM_DEBUGFS_DIR                         "o2dlm"
 #define DLM_DEBUGFS_DLM_STATE                   "dlm_state"
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index c973690dc0bc..39efc5057a36 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -959,6 +959,14 @@ static int dlm_assert_joined_handler(struct o2net_msg *msg, u32 len, void *data,
                  * domain. Set him in the map and clean up our
                  * leftover join state. */
                 BUG_ON(dlm->joining_node != assert->node_idx);
+
+                if (dlm->reco.state & DLM_RECO_STATE_ACTIVE) {
+                        mlog(0, "dlm recovery is ongoing, disallow join\n");
+                        spin_unlock(&dlm->spinlock);
+                        spin_unlock(&dlm_domain_lock);
+                        return -EAGAIN;
+                }
+
                 set_bit(assert->node_idx, dlm->domain_map);
                 clear_bit(assert->node_idx, dlm->exit_domain_map);
                 __dlm_set_joining_node(dlm, DLM_LOCK_RES_OWNER_UNKNOWN);
@@ -1517,6 +1525,7 @@ static int dlm_send_one_join_assert(struct dlm_ctxt *dlm,
                                     unsigned int node)
 {
         int status;
+        int ret;
         struct dlm_assert_joined assert_msg;
 
         mlog(0, "Sending join assert to node %u\n", node);
@@ -1528,11 +1537,13 @@ static int dlm_send_one_join_assert(struct dlm_ctxt *dlm,
 
         status = o2net_send_message(DLM_ASSERT_JOINED_MSG, DLM_MOD_KEY,
                                     &assert_msg, sizeof(assert_msg), node,
-                                    NULL);
+                                    &ret);
         if (status < 0)
                 mlog(ML_ERROR, "Error %d when sending message %u (key 0x%x) to "
                      "node %u\n", status, DLM_ASSERT_JOINED_MSG, DLM_MOD_KEY,
                      node);
+        else
+                status = ret;
 
         return status;
 }
@@ -2023,7 +2034,6 @@ static struct dlm_ctxt *dlm_alloc_ctxt(const char *domain,
         INIT_LIST_HEAD(&dlm->list);
         INIT_LIST_HEAD(&dlm->dirty_list);
         INIT_LIST_HEAD(&dlm->reco.resources);
-        INIT_LIST_HEAD(&dlm->reco.received);
         INIT_LIST_HEAD(&dlm->reco.node_data);
         INIT_LIST_HEAD(&dlm->purge_list);
         INIT_LIST_HEAD(&dlm->dlm_domain_handlers);
diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
index 5d32f7511f74..66c2a491f68d 100644
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -52,7 +52,7 @@
 #define MLOG_MASK_PREFIX ML_DLM
 #include "cluster/masklog.h"
 
-static struct kmem_cache *dlm_lock_cache = NULL;
+static struct kmem_cache *dlm_lock_cache;
 
 static DEFINE_SPINLOCK(dlm_cookie_lock);
 static u64 dlm_next_cookie = 1;
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index ee1f88419cb0..3087a21d32f9 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -82,9 +82,9 @@ static inline int dlm_mle_equal(struct dlm_ctxt *dlm,
         return 1;
 }
 
-static struct kmem_cache *dlm_lockres_cache = NULL;
-static struct kmem_cache *dlm_lockname_cache = NULL;
-static struct kmem_cache *dlm_mle_cache = NULL;
+static struct kmem_cache *dlm_lockres_cache;
+static struct kmem_cache *dlm_lockname_cache;
+static struct kmem_cache *dlm_mle_cache;
 
 static void dlm_mle_release(struct kref *kref);
 static void dlm_init_mle(struct dlm_master_list_entry *mle,
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index fe29f7978f81..5de019437ea5 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1986,7 +1986,15 @@ skip_lvb:
                 }
                 if (!bad) {
                         dlm_lock_get(newlock);
-                        list_add_tail(&newlock->list, queue);
+                        if (mres->flags & DLM_MRES_RECOVERY &&
+                                        ml->list == DLM_CONVERTING_LIST &&
+                                        newlock->ml.type >
+                                        newlock->ml.convert_type) {
+                                /* newlock is doing downconvert, add it to the
+                                 * head of converting list */
+                                list_add(&newlock->list, queue);
+                        } else
+                                list_add_tail(&newlock->list, queue);
                         mlog(0, "%s:%.*s: added lock for node %u, "
                              "setting refmap bit\n", dlm->name,
                              res->lockname.len, res->lockname.name, ml->node);
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 6bd690b5a061..52cfe99ae056 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2544,11 +2544,6 @@ int ocfs2_super_lock(struct ocfs2_super *osb,
          * refreshed, so we do it here. Of course, making sense of
          * everything is up to the caller :) */
         status = ocfs2_should_refresh_lock_res(lockres);
-        if (status < 0) {
-                ocfs2_cluster_unlock(osb, lockres, level);
-                mlog_errno(status);
-                goto bail;
-        }
         if (status) {
                 status = ocfs2_refresh_slot_info(osb);
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8970dcf74de5..8eb6e5732d3b 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -828,7 +828,7 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                 /*
                  * fs-writeback will release the dirty pages without page lock
                  * whose offset are over inode size, the release happens at
-                 * block_write_full_page_endio().
+                 * block_write_full_page().
                  */
                 i_size_write(inode, abs_to);
                 inode->i_blocks = ocfs2_inode_sector_count(inode);
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 490229f43731..6f66b3751ace 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -143,8 +143,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_blocksize(struct inode *inode,
-                                struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_blocksize(struct inode *inode,
+                                       struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_blocksize oib;
@@ -167,8 +167,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_clustersize(struct inode *inode,
-                                  struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_clustersize(struct inode *inode,
+                                         struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_clustersize oic;
@@ -192,8 +192,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_maxslots(struct inode *inode,
-                               struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_maxslots(struct inode *inode,
+                                      struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_maxslots oim;
@@ -217,8 +217,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_label(struct inode *inode,
-                            struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_label(struct inode *inode,
+                                   struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_label oil;
@@ -242,8 +242,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_uuid(struct inode *inode,
-                           struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_uuid(struct inode *inode,
+                                  struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_uuid oiu;
@@ -267,8 +267,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_fs_features(struct inode *inode,
-                                  struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_fs_features(struct inode *inode,
+                                         struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_fs_features oif;
@@ -294,8 +294,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_journal_size(struct inode *inode,
-                                   struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_journal_size(struct inode *inode,
+                                          struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_journal_size oij;
@@ -319,9 +319,10 @@ bail:
         return status;
 }
 
-int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
-                                struct inode *inode_alloc, u64 blkno,
-                                struct ocfs2_info_freeinode *fi, u32 slot)
+static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
+                                       struct inode *inode_alloc, u64 blkno,
+                                       struct ocfs2_info_freeinode *fi,
+                                       u32 slot)
 {
         int status = 0, unlock = 0;
 
@@ -366,8 +367,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_freeinode(struct inode *inode,
-                                struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_freeinode(struct inode *inode,
+                                       struct ocfs2_info_request __user *req)
 {
         u32 i;
         u64 blkno = -1;
@@ -462,19 +463,19 @@ static void o2ffg_update_stats(struct ocfs2_info_freefrag_stats *stats,
         stats->ffs_free_chunks_real++;
 }
 
-void ocfs2_info_update_ffg(struct ocfs2_info_freefrag *ffg,
-                           unsigned int chunksize)
+static void ocfs2_info_update_ffg(struct ocfs2_info_freefrag *ffg,
+                                  unsigned int chunksize)
 {
         o2ffg_update_histogram(&(ffg->iff_ffs.ffs_fc_hist), chunksize);
         o2ffg_update_stats(&(ffg->iff_ffs), chunksize);
 }
 
-int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb,
-                                   struct inode *gb_inode,
-                                   struct ocfs2_dinode *gb_dinode,
-                                   struct ocfs2_chain_rec *rec,
-                                   struct ocfs2_info_freefrag *ffg,
-                                   u32 chunks_in_group)
+static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb,
+                                          struct inode *gb_inode,
+                                          struct ocfs2_dinode *gb_dinode,
+                                          struct ocfs2_chain_rec *rec,
+                                          struct ocfs2_info_freefrag *ffg,
+                                          u32 chunks_in_group)
 {
         int status = 0, used;
         u64 blkno;
@@ -572,9 +573,9 @@ bail:
         return status;
 }
 
-int ocfs2_info_freefrag_scan_bitmap(struct ocfs2_super *osb,
-                                    struct inode *gb_inode, u64 blkno,
-                                    struct ocfs2_info_freefrag *ffg)
+static int ocfs2_info_freefrag_scan_bitmap(struct ocfs2_super *osb,
+                                           struct inode *gb_inode, u64 blkno,
+                                           struct ocfs2_info_freefrag *ffg)
 {
         u32 chunks_in_group;
         int status = 0, unlock = 0, i;
@@ -652,8 +653,8 @@ bail:
         return status;
 }
 
-int ocfs2_info_handle_freefrag(struct inode *inode,
-                               struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_freefrag(struct inode *inode,
+                                      struct ocfs2_info_request __user *req)
 {
         u64 blkno = -1;
         char namebuf[40];
@@ -723,8 +724,8 @@ out_err:
         return status;
 }
 
-int ocfs2_info_handle_unknown(struct inode *inode,
-                              struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_unknown(struct inode *inode,
+                                     struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_request oir;
@@ -752,8 +753,8 @@ bail:
  * - distinguish different requests.
  * - validate size of different requests.
  */
-int ocfs2_info_handle_request(struct inode *inode,
-                              struct ocfs2_info_request __user *req)
+static int ocfs2_info_handle_request(struct inode *inode,
+                                     struct ocfs2_info_request __user *req)
 {
         int status = -EFAULT;
         struct ocfs2_info_request oir;
@@ -811,8 +812,8 @@ bail:
         return status;
 }
 
-int ocfs2_get_request_ptr(struct ocfs2_info *info, int idx,
-                          u64 *req_addr, int compat_flag)
+static int ocfs2_get_request_ptr(struct ocfs2_info *info, int idx,
+                                 u64 *req_addr, int compat_flag)
 {
         int status = -EFAULT;
         u64 __user *bp = NULL;
@@ -849,8 +850,8 @@ bail:
  * a better backward&forward compatibility, since a small piece of
  * request will be less likely to be broken if disk layout get changed.
  */
-int ocfs2_info_handle(struct inode *inode, struct ocfs2_info *info,
-                      int compat_flag)
+static int ocfs2_info_handle(struct inode *inode, struct ocfs2_info *info,
+                             int compat_flag)
 {
         int i, status = 0;
         u64 req_addr;
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 03ea9314fecd..4b0c68849b36 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -30,6 +30,7 @@
 #include <linux/kthread.h>
 #include <linux/time.h>
 #include <linux/random.h>
+#include <linux/delay.h>
 
 #include <cluster/masklog.h>
 
@@ -2185,8 +2186,20 @@ static int ocfs2_commit_thread(void *arg)
                                          || kthread_should_stop());
 
                 status = ocfs2_commit_cache(osb);
-                if (status < 0)
-                        mlog_errno(status);
+                if (status < 0) {
+                        static unsigned long abort_warn_time;
+
+                        /* Warn about this once per minute */
+                        if (printk_timed_ratelimit(&abort_warn_time, 60*HZ))
+                                mlog(ML_ERROR, "status = %d, journal is "
+                                                "already aborted.\n", status);
+                        /*
+                         * After ocfs2_commit_cache() fails, j_num_trans has a
+                         * non-zero value.  Sleep here to avoid a busy-wait
+                         * loop.
+                         */
+                        msleep_interruptible(1000);
+                }
 
                 if (kthread_should_stop() && atomic_read(&journal->j_num_trans)){
                         mlog(ML_KTHREAD,
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 8d64a97a9d5e..bbec539230fd 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -422,6 +422,7 @@ struct ocfs2_super
         struct inode                    *osb_tl_inode;
         struct buffer_head              *osb_tl_bh;
         struct delayed_work             osb_truncate_log_wq;
+        atomic_t                        osb_tl_disable;
         /*
          * How many clusters in our truncate log.
          * It must be protected by osb_tl_inode->i_mutex.
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 6ba4bcbc4796..714e53b9cc66 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -1408,10 +1408,9 @@ static void swap_refcount_rec(void *a, void *b, int size)
 {
         struct ocfs2_refcount_rec *l = a, *r = b, tmp;
 
-        tmp = *(struct ocfs2_refcount_rec *)l;
-        *(struct ocfs2_refcount_rec *)l =
-                        *(struct ocfs2_refcount_rec *)r;
-        *(struct ocfs2_refcount_rec *)r = tmp;
+        tmp = *l;
+        *l = *r;
+        *r = tmp;
 }
 
 /*
diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
index 822ebc10f281..d5da6f624142 100644
--- a/fs/ocfs2/resize.c
+++ b/fs/ocfs2/resize.c
@@ -53,8 +53,6 @@
  */
 static u16 ocfs2_calc_new_backup_super(struct inode *inode,
                                        struct ocfs2_group_desc *gd,
-                                       int new_clusters,
-                                       u32 first_new_cluster,
                                        u16 cl_cpg,
                                        int set)
 {
@@ -127,8 +125,6 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
                                      OCFS2_FEATURE_COMPAT_BACKUP_SB)) {
                 backups = ocfs2_calc_new_backup_super(bm_inode,
                                                      group,
-                                                     new_clusters,
-                                                     first_new_cluster,
                                                      cl_cpg, 1);
                 le16_add_cpu(&group->bg_free_bits_count, -1 * backups);
         }
@@ -157,7 +153,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
 
         spin_lock(&OCFS2_I(bm_inode)->ip_lock);
         OCFS2_I(bm_inode)->ip_clusters = le32_to_cpu(fe->i_clusters);
-        le64_add_cpu(&fe->i_size, new_clusters << osb->s_clustersize_bits);
+        le64_add_cpu(&fe->i_size, (u64)new_clusters << osb->s_clustersize_bits);
         spin_unlock(&OCFS2_I(bm_inode)->ip_lock);
         i_size_write(bm_inode, le64_to_cpu(fe->i_size));
 
@@ -167,8 +163,6 @@ out_rollback:
         if (ret < 0) {
                 ocfs2_calc_new_backup_super(bm_inode,
                                             group,
-                                            new_clusters,
-                                            first_new_cluster,
                                             cl_cpg, 0);
                 le16_add_cpu(&group->bg_free_bits_count, backups);
                 le16_add_cpu(&group->bg_bits, -1 * num_bits);
@@ -569,7 +563,7 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input)
 
         spin_lock(&OCFS2_I(main_bm_inode)->ip_lock);
         OCFS2_I(main_bm_inode)->ip_clusters = le32_to_cpu(fe->i_clusters);
-        le64_add_cpu(&fe->i_size, input->clusters << osb->s_clustersize_bits);
+        le64_add_cpu(&fe->i_size, (u64)input->clusters << osb->s_clustersize_bits);
         spin_unlock(&OCFS2_I(main_bm_inode)->ip_lock);
         i_size_write(main_bm_inode, le64_to_cpu(fe->i_size));
 
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 83f1a665ae97..5d965e83bd43 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -709,7 +709,7 @@ static struct ctl_table ocfs2_root_table[] = {
         { }
 };
 
-static struct ctl_table_header *ocfs2_table_header = NULL;
+static struct ctl_table_header *ocfs2_table_header;
 
 
 /*
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index a7cdd56f4c79..c7a89cea5c5d 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -75,7 +75,7 @@
 
 #include "buffer_head_io.h"
 
-static struct kmem_cache *ocfs2_inode_cachep = NULL;
+static struct kmem_cache *ocfs2_inode_cachep;
 struct kmem_cache *ocfs2_dquot_cachep;
 struct kmem_cache *ocfs2_qf_chunk_cachep;
 
@@ -85,7 +85,7 @@ struct kmem_cache *ocfs2_qf_chunk_cachep;
  * workqueue and schedule on our own. */
 struct workqueue_struct *ocfs2_wq = NULL;
 
-static struct dentry *ocfs2_debugfs_root = NULL;
+static struct dentry *ocfs2_debugfs_root;
 
 MODULE_AUTHOR("Oracle");
 MODULE_LICENSE("GPL");
@@ -2292,8 +2292,8 @@ static int ocfs2_initialize_super(struct super_block *sb,
                 goto bail;
         }
 
-        strncpy(osb->vol_label, di->id2.i_super.s_label, 63);
-        osb->vol_label[63] = '\0';
+        strlcpy(osb->vol_label, di->id2.i_super.s_label,
+                OCFS2_MAX_VOL_LABEL_LEN);
         osb->root_blkno = le64_to_cpu(di->id2.i_super.s_root_blkno);
         osb->system_dir_blkno = le64_to_cpu(di->id2.i_super.s_system_dir_blkno);
         osb->first_cluster_group_blkno =
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index 52eaf33d346f..82e17b076ce7 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -67,7 +67,7 @@ struct ocfs2_meta_cache_item {
         sector_t        c_block;
 };
 
-static struct kmem_cache *ocfs2_uptodate_cachep = NULL;
+static struct kmem_cache *ocfs2_uptodate_cachep;
 
 u64 ocfs2_metadata_cache_owner(struct ocfs2_caching_info *ci)
 {
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 442177b1119a..2101ce46a5d2 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -737,9 +737,6 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma,
                 ptent = pte_file_clear_soft_dirty(ptent);
         }
 
-        if (vma->vm_flags & VM_SOFTDIRTY)
-                vma->vm_flags &= ~VM_SOFTDIRTY;
-
         set_pte_at(vma->vm_mm, addr, pte, ptent);
 #endif
 }
@@ -807,8 +804,9 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
 
         if (type == CLEAR_REFS_SOFT_DIRTY) {
                 soft_dirty_cleared = true;
-                pr_warn_once("The pagemap bits 55-60 has changed their meaning! "
-                                "See the linux/Documentation/vm/pagemap.txt for details.\n");
+                pr_warn_once("The pagemap bits 55-60 has changed their meaning!"
+                             " See the linux/Documentation/vm/pagemap.txt for "
+                             "details.\n");
         }
 
         task = get_proc_task(file_inode(file));
@@ -839,11 +837,17 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                          *
                          * Writing 3 to /proc/pid/clear_refs only affects file
                          * mapped pages.
+                         *
+                         * Writing 4 to /proc/pid/clear_refs affects all pages.
                          */
                         if (type == CLEAR_REFS_ANON && vma->vm_file)
                                 continue;
                         if (type == CLEAR_REFS_MAPPED && !vma->vm_file)
                                 continue;
+                        if (type == CLEAR_REFS_SOFT_DIRTY) {
+                                if (vma->vm_flags & VM_SOFTDIRTY)
+                                        vma->vm_flags &= ~VM_SOFTDIRTY;
+                        }
                         walk_page_range(vma->vm_start, vma->vm_end,
                                         &clear_refs_walk);
                 }
diff --git a/fs/readdir.c b/fs/readdir.c
index 5b53d995cae6..33fd92208cb7 100644
--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -13,6 +13,7 @@
 #include <linux/stat.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/fsnotify.h>
 #include <linux/dirent.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
@@ -40,6 +41,7 @@ int iterate_dir(struct file *file, struct dir_context *ctx)
                 ctx->pos = file->f_pos;
                 res = file->f_op->iterate(file, ctx);
                 file->f_pos = ctx->pos;
+                fsnotify_access(file);
                 file_accessed(file);
         }
         mutex_unlock(&inode->i_mutex);
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 9e1bb79f7e6f..887d6d270080 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -25,7 +25,7 @@
 
 #define ERROR(s, args...)       pr_err("SQUASHFS error: "s, ## args)
 
-#define WARNING(s, args...)     pr_warning("SQUASHFS: "s, ## args)
+#define WARNING(s, args...)     pr_warn("SQUASHFS: "s, ## args)
 
 /* block.c */
 extern int squashfs_read_data(struct super_block *, u64, int, u64 *,
diff --git a/fs/super.c b/fs/super.c
index 48377f7463c0..d20d5b11dedf 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -112,9 +112,14 @@ static unsigned long super_cache_count(struct shrinker *shrink,
 
         sb = container_of(shrink, struct super_block, s_shrink);
 
-        if (!grab_super_passive(sb))
-                return 0;
-
+        /*
+         * Don't call grab_super_passive as it is a potential
+         * scalability bottleneck. The counts could get updated
+         * between super_cache_count and super_cache_scan anyway.
+         * Call to super_cache_count with shrinker_rwsem held
+         * ensures the safety of call to list_lru_count_node() and
+         * s_op->nr_cached_objects().
+         */
         if (sb->s_op && sb->s_op->nr_cached_objects)
                 total_objects = sb->s_op->nr_cached_objects(sb,
                                                  sc->nid);
@@ -125,7 +130,6 @@ static unsigned long super_cache_count(struct shrinker *shrink,
                                                  sc->nid);
 
         total_objects = vfs_pressure_ratio(total_objects);
-        drop_super(sb);
         return total_objects;
 }
 
@@ -276,10 +280,8 @@ void deactivate_locked_super(struct super_block *s)
         struct file_system_type *fs = s->s_type;
         if (atomic_dec_and_test(&s->s_active)) {
                 cleancache_invalidate_fs(s);
-                fs->kill_sb(s);
-
-                /* caches are now gone, we can safely kill the shrinker now */
                 unregister_shrinker(&s->s_shrink);
+                fs->kill_sb(s);
 
                 put_filesystem(fs);
                 put_super(s);
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index a8015a7a55bb..53b2acc38213 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -233,6 +233,10 @@ static inline int pmd_same(pmd_t pmd_a, pmd_t pmd_b)
 # define pte_accessible(mm, pte)        ((void)(pte), 1)
 #endif
 
+#ifndef pte_present_nonuma
+#define pte_present_nonuma(pte) pte_present(pte)
+#endif
+
 #ifndef flush_tlb_fix_spurious_fault
 #define flush_tlb_fix_spurious_fault(vma, address) flush_tlb_page(vma, address)
 #endif
@@ -670,7 +674,7 @@ static inline int pmd_trans_unstable(pmd_t *pmd)
 static inline int pte_numa(pte_t pte)
 {
         return (pte_flags(pte) &
-                (_PAGE_NUMA|_PAGE_PRESENT)) == _PAGE_NUMA;
+                (_PAGE_NUMA|_PAGE_PROTNONE|_PAGE_PRESENT)) == _PAGE_NUMA;
 }
 #endif
 
@@ -678,7 +682,7 @@ static inline int pte_numa(pte_t pte)
 static inline int pmd_numa(pmd_t pmd)
 {
         return (pmd_flags(pmd) &
-                (_PAGE_NUMA|_PAGE_PRESENT)) == _PAGE_NUMA;
+                (_PAGE_NUMA|_PAGE_PROTNONE|_PAGE_PRESENT)) == _PAGE_NUMA;
 }
 #endif
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 5c6f836afa1b..3cd426e971db 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1588,6 +1588,7 @@ static inline bool blk_integrity_is_initialized(struct gendisk *g)
 struct block_device_operations {
         int (*open) (struct block_device *, fmode_t);
         void (*release) (struct gendisk *, fmode_t);
+        int (*rw_page)(struct block_device *, sector_t, struct page *, int rw);
         int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
         int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
         int (*direct_access) (struct block_device *, sector_t,
@@ -1606,7 +1607,13 @@ struct block_device_operations {
 
 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
                                  unsigned long);
+extern int bdev_read_page(struct block_device *, sector_t, struct page *);
+extern int bdev_write_page(struct block_device *, sector_t, struct page *,
+                                                struct writeback_control *);
 #else /* CONFIG_BLOCK */
+
+struct block_device;
+
 /*
  * stubs for when the block layer is configured out
  */
@@ -1642,6 +1649,12 @@ static inline bool blk_needs_flush_plug(struct task_struct *tsk)
         return false;
 }
 
+static inline int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
+                                     sector_t *error_sector)
+{
+        return 0;
+}
+
 #endif /* CONFIG_BLOCK */
 
 #endif
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index db51fe4fe317..4e2bd4c95b66 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -58,9 +58,9 @@ extern void free_bootmem_late(unsigned long physaddr, unsigned long size);
  * Flags for reserve_bootmem (also if CONFIG_HAVE_ARCH_BOOTMEM_NODE,
  * the architecture-specific code should honor this).
  *
- * If flags is 0, then the return value is always 0 (success). If
- * flags contains BOOTMEM_EXCLUSIVE, then -EBUSY is returned if the
- * memory already was reserved.
+ * If flags is BOOTMEM_DEFAULT, then the return value is always 0 (success).
+ * If flags contains BOOTMEM_EXCLUSIVE, then -EBUSY is returned if the memory
+ * already was reserved.
  */
 #define BOOTMEM_DEFAULT         0
 #define BOOTMEM_EXCLUSIVE       (1<<0)
diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
index 7cbf837a279c..324329ceea1e 100644
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -207,8 +207,6 @@ void block_invalidatepage(struct page *page, unsigned int offset,
                           unsigned int length);
 int block_write_full_page(struct page *page, get_block_t *get_block,
                                 struct writeback_control *wbc);
-int block_write_full_page_endio(struct page *page, get_block_t *get_block,
-                        struct writeback_control *wbc, bh_end_io_t *handler);
 int block_read_full_page(struct page*, get_block_t*);
 int block_is_partially_uptodate(struct page *page, unsigned long from,
                                 unsigned long count);
diff --git a/include/linux/compaction.h b/include/linux/compaction.h
index 7e1c76e3cd68..01e3132820da 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -22,7 +22,7 @@ extern int sysctl_extfrag_handler(struct ctl_table *table, int write,
 extern int fragmentation_index(struct zone *zone, unsigned int order);
 extern unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *mask,
-                        bool sync, bool *contended);
+                        enum migrate_mode mode, bool *contended);
 extern void compact_pgdat(pg_data_t *pgdat, int order);
 extern void reset_isolation_suitable(pg_data_t *pgdat);
 extern unsigned long compaction_suitable(struct zone *zone, int order);
@@ -91,7 +91,7 @@ static inline bool compaction_restarting(struct zone *zone, int order)
 #else
 static inline unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        bool sync, bool *contended)
+                        enum migrate_mode mode, bool *contended)
 {
         return COMPACT_CONTINUE;
 }
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index ee7239ea1583..64fdfe1cfcf0 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -323,9 +323,18 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 #endif
 #ifndef __compiletime_error
 # define __compiletime_error(message)
-# define __compiletime_error_fallback(condition) \
+/*
+ * Sparse complains of variable sized arrays due to the temporary variable in
+ * __compiletime_assert. Unfortunately we can't just expand it out to make
+ * sparse see a constant array size without breaking compiletime_assert on old
+ * versions of GCC (e.g. 4.2.4), so hide the array from sparse altogether.
+ */
+# ifndef __CHECKER__
+#  define __compiletime_error_fallback(condition) \
         do { ((void)sizeof(char[1 - 2 * condition])); } while (0)
-#else
+# endif
+#endif
+#ifndef __compiletime_error_fallback
 # define __compiletime_error_fallback(condition) do { } while (0)
 #endif
 
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index b19d3dc2e651..ade2390ffe92 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -12,10 +12,31 @@
 #include <linux/cpumask.h>
 #include <linux/nodemask.h>
 #include <linux/mm.h>
+#include <linux/jump_label.h>
 
 #ifdef CONFIG_CPUSETS
 
-extern int number_of_cpusets;   /* How many cpusets are defined in system? */
+extern struct static_key cpusets_enabled_key;
+static inline bool cpusets_enabled(void)
+{
+        return static_key_false(&cpusets_enabled_key);
+}
+
+static inline int nr_cpusets(void)
+{
+        /* jump label reference count + the top-level cpuset */
+        return static_key_count(&cpusets_enabled_key) + 1;
+}
+
+static inline void cpuset_inc(void)
+{
+        static_key_slow_inc(&cpusets_enabled_key);
+}
+
+static inline void cpuset_dec(void)
+{
+        static_key_slow_dec(&cpusets_enabled_key);
+}
 
 extern int cpuset_init(void);
 extern void cpuset_init_smp(void);
@@ -32,13 +53,13 @@ extern int __cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask);
 
 static inline int cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
 {
-        return number_of_cpusets <= 1 ||
+        return nr_cpusets() <= 1 ||
                 __cpuset_node_allowed_softwall(node, gfp_mask);
 }
 
 static inline int cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask)
 {
-        return number_of_cpusets <= 1 ||
+        return nr_cpusets() <= 1 ||
                 __cpuset_node_allowed_hardwall(node, gfp_mask);
 }
 
@@ -124,6 +145,8 @@ static inline void set_mems_allowed(nodemask_t nodemask)
 
 #else /* !CONFIG_CPUSETS */
 
+static inline bool cpusets_enabled(void) { return false; }
+
 static inline int cpuset_init(void) { return 0; }
 static inline void cpuset_init_smp(void) {}
 
diff --git a/include/linux/dma-contiguous.h b/include/linux/dma-contiguous.h
index 3b28f937d959..772eab5d524a 100644
--- a/include/linux/dma-contiguous.h
+++ b/include/linux/dma-contiguous.h
@@ -88,7 +88,8 @@ static inline void dma_contiguous_set_default(struct cma *cma)
 void dma_contiguous_reserve(phys_addr_t addr_limit);
 
 int __init dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,
-                                       phys_addr_t limit, struct cma **res_cma);
+                                       phys_addr_t limit, struct cma **res_cma,
+                                       bool fixed);
 
 /**
  * dma_declare_contiguous() - reserve area for contiguous memory handling
@@ -108,7 +109,7 @@ static inline int dma_declare_contiguous(struct device *dev, phys_addr_t size,
 {
         struct cma *cma;
         int ret;
-        ret = dma_contiguous_reserve_area(size, base, limit, &cma);
+        ret = dma_contiguous_reserve_area(size, base, limit, &cma, true);
         if (ret == 0)
                 dev_set_cma_area(dev, cma);
 
@@ -136,7 +137,9 @@ static inline void dma_contiguous_set_default(struct cma *cma) { }
 static inline void dma_contiguous_reserve(phys_addr_t limit) { }
 
 static inline int dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,
-                                       phys_addr_t limit, struct cma **res_cma) {
+                                       phys_addr_t limit, struct cma **res_cma,
+                                       bool fixed)
+{
         return -ENOSYS;
 }
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 878031227c57..c3f46e499dd0 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2590,6 +2590,7 @@ extern ssize_t simple_read_from_buffer(void __user *to, size_t count,
 extern ssize_t simple_write_to_buffer(void *to, size_t available, loff_t *ppos,
                 const void __user *from, size_t count);
 
+extern int __generic_file_fsync(struct file *, loff_t, loff_t, int);
 extern int generic_file_fsync(struct file *, loff_t, loff_t, int);
 
 extern int generic_check_addressable(unsigned, u64);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 39b81dc7d01a..6eb1fb37de9a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -6,7 +6,6 @@
 #include <linux/stddef.h>
 #include <linux/linkage.h>
 #include <linux/topology.h>
-#include <linux/mmdebug.h>
 
 struct vm_area_struct;
 
@@ -31,7 +30,6 @@ struct vm_area_struct;
 #define ___GFP_HARDWALL         0x20000u
 #define ___GFP_THISNODE         0x40000u
 #define ___GFP_RECLAIMABLE      0x80000u
-#define ___GFP_KMEMCG           0x100000u
 #define ___GFP_NOTRACK          0x200000u
 #define ___GFP_NO_KSWAPD        0x400000u
 #define ___GFP_OTHER_NODE       0x800000u
@@ -91,7 +89,6 @@ struct vm_area_struct;
 
 #define __GFP_NO_KSWAPD ((__force gfp_t)___GFP_NO_KSWAPD)
 #define __GFP_OTHER_NODE ((__force gfp_t)___GFP_OTHER_NODE) /* On behalf of other node */
-#define __GFP_KMEMCG    ((__force gfp_t)___GFP_KMEMCG) /* Allocation comes from a memcg-accounted resource */
 #define __GFP_WRITE     ((__force gfp_t)___GFP_WRITE)   /* Allocator intends to dirty page */
 
 /*
@@ -353,6 +350,10 @@ extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order,
 #define alloc_page_vma_node(gfp_mask, vma, addr, node)          \
         alloc_pages_vma(gfp_mask, 0, vma, addr, node)
 
+extern struct page *alloc_kmem_pages(gfp_t gfp_mask, unsigned int order);
+extern struct page *alloc_kmem_pages_node(int nid, gfp_t gfp_mask,
+                                          unsigned int order);
+
 extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
 extern unsigned long get_zeroed_page(gfp_t gfp_mask);
 
@@ -369,11 +370,11 @@ void *alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask);
 
 extern void __free_pages(struct page *page, unsigned int order);
 extern void free_pages(unsigned long addr, unsigned int order);
-extern void free_hot_cold_page(struct page *page, int cold);
-extern void free_hot_cold_page_list(struct list_head *list, int cold);
+extern void free_hot_cold_page(struct page *page, bool cold);
+extern void free_hot_cold_page_list(struct list_head *list, bool cold);
 
-extern void __free_memcg_kmem_pages(struct page *page, unsigned int order);
-extern void free_memcg_kmem_pages(unsigned long addr, unsigned int order);
+extern void __free_kmem_pages(struct page *page, unsigned int order);
+extern void free_kmem_pages(unsigned long addr, unsigned int order);
 
 #define __free_page(page) __free_pages((page), 0)
 #define free_page(addr) free_pages((addr), 0)
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index b65166de1d9d..255cd5cc0754 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -343,6 +343,11 @@ static inline unsigned huge_page_shift(struct hstate *h)
         return h->order + PAGE_SHIFT;
 }
 
+static inline bool hstate_is_gigantic(struct hstate *h)
+{
+        return huge_page_order(h) >= MAX_ORDER;
+}
+
 static inline unsigned int pages_per_huge_page(struct hstate *h)
 {
         return 1 << h->order;
@@ -392,15 +397,13 @@ static inline pgoff_t basepage_index(struct page *page)
 
 extern void dissolve_free_huge_pages(unsigned long start_pfn,
                                      unsigned long end_pfn);
-int pmd_huge_support(void);
-/*
- * Currently hugepage migration is enabled only for pmd-based hugepage.
- * This function will be updated when hugepage migration is more widely
- * supported.
- */
-static inline int hugepage_migration_support(struct hstate *h)
+static inline int hugepage_migration_supported(struct hstate *h)
 {
-        return pmd_huge_support() && (huge_page_shift(h) == PMD_SHIFT);
+#ifdef CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
+        return huge_page_shift(h) == PMD_SHIFT;
+#else
+        return 0;
+#endif
 }
 
 static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
@@ -450,8 +453,7 @@ static inline pgoff_t basepage_index(struct page *page)
         return page->index;
 }
 #define dissolve_free_huge_pages(s, e)  do {} while (0)
-#define pmd_huge_support()      0
-#define hugepage_migration_support(h)   0
+#define hugepage_migration_supported(h) 0
 
 static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
                                            struct mm_struct *mm, pte_t *pte)
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 5c1dfb2a9e73..784304b222b3 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -69,6 +69,10 @@ struct static_key {
 
 # include <asm/jump_label.h>
 # define HAVE_JUMP_LABEL
+#else
+struct static_key {
+        atomic_t enabled;
+};
 #endif  /* CC_HAVE_ASM_GOTO && CONFIG_JUMP_LABEL */
 
 enum jump_label_type {
@@ -79,6 +83,12 @@ enum jump_label_type {
 struct module;
 
 #include <linux/atomic.h>
+
+static inline int static_key_count(struct static_key *key)
+{
+        return atomic_read(&key->enabled);
+}
+
 #ifdef HAVE_JUMP_LABEL
 
 #define JUMP_LABEL_TYPE_FALSE_BRANCH    0UL
@@ -134,10 +144,6 @@ extern void jump_label_apply_nops(struct module *mod);
 
 #else  /* !HAVE_JUMP_LABEL */
 
-struct static_key {
-        atomic_t enabled;
-};
-
 static __always_inline void jump_label_init(void)
 {
         static_key_initialized = true;
@@ -145,14 +151,14 @@ static __always_inline void jump_label_init(void)
 
 static __always_inline bool static_key_false(struct static_key *key)
 {
-        if (unlikely(atomic_read(&key->enabled) > 0))
+        if (unlikely(static_key_count(key) > 0))
                 return true;
         return false;
 }
 
 static __always_inline bool static_key_true(struct static_key *key)
 {
-        if (likely(atomic_read(&key->enabled) > 0))
+        if (likely(static_key_count(key) > 0))
                 return true;
         return false;
 }
@@ -194,7 +200,7 @@ static inline int jump_label_apply_nops(struct module *mod)
 
 static inline bool static_key_enabled(struct static_key *key)
 {
-        return (atomic_read(&key->enabled) > 0);
+        return static_key_count(key) > 0;
 }
 
 #endif  /* _LINUX_JUMP_LABEL_H */
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 73dc382e72d8..b660e05b63d4 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -272,6 +272,8 @@ static inline bool memblock_bottom_up(void) { return false; }
 #define MEMBLOCK_ALLOC_ANYWHERE (~(phys_addr_t)0)
 #define MEMBLOCK_ALLOC_ACCESSIBLE       0
 
+phys_addr_t __init memblock_alloc_range(phys_addr_t size, phys_addr_t align,
+                                        phys_addr_t start, phys_addr_t end);
 phys_addr_t memblock_alloc_base(phys_addr_t size, phys_addr_t align,
                                 phys_addr_t max_addr);
 phys_addr_t __memblock_alloc_base(phys_addr_t size, phys_addr_t align,
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index b569b8be5c5a..eb65d29516ca 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -492,13 +492,9 @@ void __memcg_kmem_uncharge_pages(struct page *page, int order);
 
 int memcg_cache_id(struct mem_cgroup *memcg);
 
-char *memcg_create_cache_name(struct mem_cgroup *memcg,
-                              struct kmem_cache *root_cache);
 int memcg_alloc_cache_params(struct mem_cgroup *memcg, struct kmem_cache *s,
                              struct kmem_cache *root_cache);
 void memcg_free_cache_params(struct kmem_cache *s);
-void memcg_register_cache(struct kmem_cache *s);
-void memcg_unregister_cache(struct kmem_cache *s);
 
 int memcg_update_cache_size(struct kmem_cache *s, int num_groups);
 void memcg_update_array_size(int num_groups);
@@ -506,8 +502,10 @@ void memcg_update_array_size(int num_groups);
 struct kmem_cache *
 __memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp);
 
-void mem_cgroup_destroy_cache(struct kmem_cache *cachep);
-int __kmem_cache_destroy_memcg_children(struct kmem_cache *s);
+int __memcg_charge_slab(struct kmem_cache *cachep, gfp_t gfp, int order);
+void __memcg_uncharge_slab(struct kmem_cache *cachep, int order);
+
+int __memcg_cleanup_cache_params(struct kmem_cache *s);
 
 /**
  * memcg_kmem_newpage_charge: verify if a new kmem allocation is allowed.
@@ -534,7 +532,7 @@ memcg_kmem_newpage_charge(gfp_t gfp, struct mem_cgroup **memcg, int order)
          * res_counter_charge_nofail, but we hope those allocations are rare,
          * and won't be worth the trouble.
          */
-        if (!(gfp & __GFP_KMEMCG) || (gfp & __GFP_NOFAIL))
+        if (gfp & __GFP_NOFAIL)
                 return true;
         if (in_interrupt() || (!current->mm) || (current->flags & PF_KTHREAD))
                 return true;
@@ -583,17 +581,7 @@ memcg_kmem_commit_charge(struct page *page, struct mem_cgroup *memcg, int order)
  * @cachep: the original global kmem cache
  * @gfp: allocation flags.
  *
- * This function assumes that the task allocating, which determines the memcg
- * in the page allocator, belongs to the same cgroup throughout the whole
- * process.  Misacounting can happen if the task calls memcg_kmem_get_cache()
- * while belonging to a cgroup, and later on changes. This is considered
- * acceptable, and should only happen upon task migration.
- *
- * Before the cache is created by the memcg core, there is also a possible
- * imbalance: the task belongs to a memcg, but the cache being allocated from
- * is the global cache, since the child cache is not yet guaranteed to be
- * ready. This case is also fine, since in this case the GFP_KMEMCG will not be
- * passed and the page allocator will not attempt any cgroup accounting.
+ * All memory allocated from a per-memcg cache is charged to the owner memcg.
  */
 static __always_inline struct kmem_cache *
 memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp)
@@ -648,14 +636,6 @@ static inline void memcg_free_cache_params(struct kmem_cache *s)
 {
 }
 
-static inline void memcg_register_cache(struct kmem_cache *s)
-{
-}
-
-static inline void memcg_unregister_cache(struct kmem_cache *s)
-{
-}
-
 static inline struct kmem_cache *
 memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp)
 {
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 4ca3d951fe91..010d125bffbf 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -187,14 +187,8 @@ extern void put_page_bootmem(struct page *page);
 extern void get_page_bootmem(unsigned long ingo, struct page *page,
                              unsigned long type);
 
-/*
- * Lock for memory hotplug guarantees 1) all callbacks for memory hotplug
- * notifier will be called under this. 2) offline/online/add/remove memory
- * will not run simultaneously.
- */
-
-void lock_memory_hotplug(void);
-void unlock_memory_hotplug(void);
+void get_online_mems(void);
+void put_online_mems(void);
 
 #else /* ! CONFIG_MEMORY_HOTPLUG */
 /*
@@ -232,8 +226,8 @@ static inline int try_online_node(int nid)
         return 0;
 }
 
-static inline void lock_memory_hotplug(void) {}
-static inline void unlock_memory_hotplug(void) {}
+static inline void get_online_mems(void) {}
+static inline void put_online_mems(void) {}
 
 #endif /* ! CONFIG_MEMORY_HOTPLUG */
 
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 3c1b968da0ca..f230a978e6ba 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -175,6 +175,12 @@ static inline int vma_migratable(struct vm_area_struct *vma)
 {
         if (vma->vm_flags & (VM_IO | VM_PFNMAP))
                 return 0;
+
+#ifndef CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
+        if (vma->vm_flags & VM_HUGETLB)
+                return 0;
+#endif
+
         /*
          * Migration allocates pages in the highest zone. If we cannot
          * do so then migration (at least from node to node) is not
diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index 84a31ad0b791..a2901c414664 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -5,7 +5,9 @@
 #include <linux/mempolicy.h>
 #include <linux/migrate_mode.h>
 
-typedef struct page *new_page_t(struct page *, unsigned long private, int **);
+typedef struct page *new_page_t(struct page *page, unsigned long private,
+                                int **reason);
+typedef void free_page_t(struct page *page, unsigned long private);
 
 /*
  * Return values from addresss_space_operations.migratepage():
@@ -38,7 +40,7 @@ enum migrate_reason {
 extern void putback_movable_pages(struct list_head *l);
 extern int migrate_page(struct address_space *,
                         struct page *, struct page *, enum migrate_mode);
-extern int migrate_pages(struct list_head *l, new_page_t x,
+extern int migrate_pages(struct list_head *l, new_page_t new, free_page_t free,
                 unsigned long private, enum migrate_mode mode, int reason);
 
 extern int migrate_prep(void);
@@ -56,8 +58,9 @@ extern int migrate_page_move_mapping(struct address_space *mapping,
 #else
 
 static inline void putback_movable_pages(struct list_head *l) {}
-static inline int migrate_pages(struct list_head *l, new_page_t x,
-                unsigned long private, enum migrate_mode mode, int reason)
+static inline int migrate_pages(struct list_head *l, new_page_t new,
+                free_page_t free, unsigned long private, enum migrate_mode mode,
+                int reason)
         { return -ENOSYS; }
 
 static inline int migrate_prep(void) { return -ENOSYS; }
diff --git a/include/linux/mm.h b/include/linux/mm.h
index d6777060449f..368600628d14 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -407,20 +407,25 @@ static inline void compound_unlock_irqrestore(struct page *page,
 #endif
 }
 
+static inline struct page *compound_head_by_tail(struct page *tail)
+{
+        struct page *head = tail->first_page;
+
+        /*
+         * page->first_page may be a dangling pointer to an old
+         * compound page, so recheck that it is still a tail
+         * page before returning.
+         */
+        smp_rmb();
+        if (likely(PageTail(tail)))
+                return head;
+        return tail;
+}
+
 static inline struct page *compound_head(struct page *page)
 {
-        if (unlikely(PageTail(page))) {
-                struct page *head = page->first_page;
-
-                /*
-                 * page->first_page may be a dangling pointer to an old
-                 * compound page, so recheck that it is still a tail
-                 * page before returning.
-                 */
-                smp_rmb();
-                if (likely(PageTail(page)))
-                        return head;
-        }
+        if (unlikely(PageTail(page)))
+                return compound_head_by_tail(page);
         return page;
 }
 
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 8967e20cbe57..de1627232af0 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -406,7 +406,7 @@ struct mm_struct {
         spinlock_t                      ioctx_lock;
         struct kioctx_table __rcu       *ioctx_table;
 #endif
-#ifdef CONFIG_MM_OWNER
+#ifdef CONFIG_MEMCG
         /*
          * "owner" points to a task that is regarded as the canonical
          * user/owner of this mm. All of the following must be true in
diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
index 2d57efa64cc1..edd82a105220 100644
--- a/include/linux/mmdebug.h
+++ b/include/linux/mmdebug.h
@@ -1,6 +1,8 @@
 #ifndef LINUX_MM_DEBUG_H
 #define LINUX_MM_DEBUG_H 1
 
+#include <linux/stringify.h>
+
 struct page;
 
 extern void dump_page(struct page *page, const char *reason);
@@ -9,11 +11,20 @@ extern void dump_page_badflags(struct page *page, const char *reason,
 
 #ifdef CONFIG_DEBUG_VM
 #define VM_BUG_ON(cond) BUG_ON(cond)
-#define VM_BUG_ON_PAGE(cond, page) \
-        do { if (unlikely(cond)) { dump_page(page, NULL); BUG(); } } while (0)
+#define VM_BUG_ON_PAGE(cond, page)                                      \
+        do {                                                            \
+                if (unlikely(cond)) {                                   \
+                        dump_page(page, "VM_BUG_ON_PAGE(" __stringify(cond)")");\
+                        BUG();                                          \
+                }                                                       \
+        } while (0)
+#define VM_WARN_ON(cond) WARN_ON(cond)
+#define VM_WARN_ON_ONCE(cond) WARN_ON_ONCE(cond)
 #else
 #define VM_BUG_ON(cond) BUILD_BUG_ON_INVALID(cond)
 #define VM_BUG_ON_PAGE(cond, page) VM_BUG_ON(cond)
+#define VM_WARN_ON(cond) BUILD_BUG_ON_INVALID(cond)
+#define VM_WARN_ON_ONCE(cond) BUILD_BUG_ON_INVALID(cond)
 #endif
 
 #ifdef CONFIG_DEBUG_VIRTUAL
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index fac5509c18f0..6cbd1b6c3d20 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -75,9 +75,18 @@ enum {
 
 extern int page_group_by_mobility_disabled;
 
-static inline int get_pageblock_migratetype(struct page *page)
+#define NR_MIGRATETYPE_BITS (PB_migrate_end - PB_migrate + 1)
+#define MIGRATETYPE_MASK ((1UL << NR_MIGRATETYPE_BITS) - 1)
+
+#define get_pageblock_migratetype(page)                                 \
+        get_pfnblock_flags_mask(page, page_to_pfn(page),                \
+                        PB_migrate_end, MIGRATETYPE_MASK)
+
+static inline int get_pfnblock_migratetype(struct page *page, unsigned long pfn)
 {
-        return get_pageblock_flags_group(page, PB_migrate, PB_migrate_end);
+        BUILD_BUG_ON(PB_migrate_end - PB_migrate != 2);
+        return get_pfnblock_flags_mask(page, pfn, PB_migrate_end,
+                                        MIGRATETYPE_MASK);
 }
 
 struct free_area {
@@ -360,9 +369,10 @@ struct zone {
         /* Set to true when the PG_migrate_skip bits should be cleared */
         bool                    compact_blockskip_flush;
 
-        /* pfns where compaction scanners should start */
+        /* pfn where compaction free scanner should start */
         unsigned long           compact_cached_free_pfn;
-        unsigned long           compact_cached_migrate_pfn;
+        /* pfn where async and sync compaction migration scanner should start */
+        unsigned long           compact_cached_migrate_pfn[2];
 #endif
 #ifdef CONFIG_MEMORY_HOTPLUG
         /* see spanned/present_pages for more description */
@@ -481,9 +491,8 @@ struct zone {
          * give them a chance of being in the same cacheline.
          *
          * Write access to present_pages at runtime should be protected by
-         * lock_memory_hotplug()/unlock_memory_hotplug().  Any reader who can't
-         * tolerant drift of present_pages should hold memory hotplug lock to
-         * get a stable value.
+         * mem_hotplug_begin/end(). Any reader who can't tolerant drift of
+         * present_pages should get_online_mems() to get a stable value.
          *
          * Read access to managed_pages should be safe because it's unsigned
          * long. Write access to zone->managed_pages and totalram_pages are
@@ -763,10 +772,10 @@ typedef struct pglist_data {
         unsigned long node_spanned_pages; /* total size of physical page
                                              range, including holes */
         int node_id;
-        nodemask_t reclaim_nodes;       /* Nodes allowed to reclaim from */
         wait_queue_head_t kswapd_wait;
         wait_queue_head_t pfmemalloc_wait;
-        struct task_struct *kswapd;     /* Protected by lock_memory_hotplug() */
+        struct task_struct *kswapd;     /* Protected by
+                                           mem_hotplug_begin/end() */
         int kswapd_max_order;
         enum zone_type classzone_idx;
 #ifdef CONFIG_NUMA_BALANCING
@@ -808,10 +817,10 @@ static inline bool pgdat_is_empty(pg_data_t *pgdat)
 extern struct mutex zonelists_mutex;
 void build_all_zonelists(pg_data_t *pgdat, struct zone *zone);
 void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx);
-bool zone_watermark_ok(struct zone *z, int order, unsigned long mark,
-                int classzone_idx, int alloc_flags);
-bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark,
-                int classzone_idx, int alloc_flags);
+bool zone_watermark_ok(struct zone *z, unsigned int order,
+                unsigned long mark, int classzone_idx, int alloc_flags);
+bool zone_watermark_ok_safe(struct zone *z, unsigned int order,
+                unsigned long mark, int classzone_idx, int alloc_flags);
 enum memmap_context {
         MEMMAP_EARLY,
         MEMMAP_HOTPLUG,
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index d1fe1a761047..2093eb72785e 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -198,6 +198,7 @@ struct page;	/* forward declaration */
 TESTPAGEFLAG(Locked, locked)
 PAGEFLAG(Error, error) TESTCLEARFLAG(Error, error)
 PAGEFLAG(Referenced, referenced) TESTCLEARFLAG(Referenced, referenced)
+        __SETPAGEFLAG(Referenced, referenced)
 PAGEFLAG(Dirty, dirty) TESTSCFLAG(Dirty, dirty) __CLEARPAGEFLAG(Dirty, dirty)
 PAGEFLAG(LRU, lru) __CLEARPAGEFLAG(LRU, lru)
 PAGEFLAG(Active, active) __CLEARPAGEFLAG(Active, active)
@@ -208,6 +209,7 @@ PAGEFLAG(Pinned, pinned) TESTSCFLAG(Pinned, pinned)	/* Xen */
 PAGEFLAG(SavePinned, savepinned);                       /* Xen */
 PAGEFLAG(Reserved, reserved) __CLEARPAGEFLAG(Reserved, reserved)
 PAGEFLAG(SwapBacked, swapbacked) __CLEARPAGEFLAG(SwapBacked, swapbacked)
+        __SETPAGEFLAG(SwapBacked, swapbacked)
 
 __PAGEFLAG(SlobFree, slob_free)
 
diff --git a/include/linux/pageblock-flags.h b/include/linux/pageblock-flags.h
index 2ee8cd2466b5..2baeee12f48e 100644
--- a/include/linux/pageblock-flags.h
+++ b/include/linux/pageblock-flags.h
@@ -30,9 +30,12 @@ enum pageblock_bits {
         PB_migrate,
         PB_migrate_end = PB_migrate + 3 - 1,
                         /* 3 bits required for migrate types */
-#ifdef CONFIG_COMPACTION
         PB_migrate_skip,/* If set the block is skipped by compaction */
-#endif /* CONFIG_COMPACTION */
+
+        /*
+         * Assume the bits will always align on a word. If this assumption
+         * changes then get/set pageblock needs updating.
+         */
         NR_PAGEBLOCK_BITS
 };
 
@@ -62,11 +65,26 @@ extern int pageblock_order;
 /* Forward declaration */
 struct page;
 
+unsigned long get_pfnblock_flags_mask(struct page *page,
+                                unsigned long pfn,
+                                unsigned long end_bitidx,
+                                unsigned long mask);
+
+void set_pfnblock_flags_mask(struct page *page,
+                                unsigned long flags,
+                                unsigned long pfn,
+                                unsigned long end_bitidx,
+                                unsigned long mask);
+
 /* Declarations for getting and setting flags. See mm/page_alloc.c */
-unsigned long get_pageblock_flags_group(struct page *page,
-                                        int start_bitidx, int end_bitidx);
-void set_pageblock_flags_group(struct page *page, unsigned long flags,
-                                        int start_bitidx, int end_bitidx);
+#define get_pageblock_flags_group(page, start_bitidx, end_bitidx) \
+        get_pfnblock_flags_mask(page, page_to_pfn(page),                \
+                        end_bitidx,                                     \
+                        (1 << (end_bitidx - start_bitidx + 1)) - 1)
+#define set_pageblock_flags_group(page, flags, start_bitidx, end_bitidx) \
+        set_pfnblock_flags_mask(page, flags, page_to_pfn(page),         \
+                        end_bitidx,                                     \
+                        (1 << (end_bitidx - start_bitidx + 1)) - 1)
 
 #ifdef CONFIG_COMPACTION
 #define get_pageblock_skip(page) \
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 45598f1e9aa3..0a97b583ee8d 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -110,7 +110,7 @@ static inline void mapping_set_gfp_mask(struct address_space *m, gfp_t mask)
 
 #define page_cache_get(page)            get_page(page)
 #define page_cache_release(page)        put_page(page)
-void release_pages(struct page **pages, int nr, int cold);
+void release_pages(struct page **pages, int nr, bool cold);
 
 /*
  * speculatively take a reference to a page.
@@ -259,12 +259,109 @@ pgoff_t page_cache_next_hole(struct address_space *mapping,
 pgoff_t page_cache_prev_hole(struct address_space *mapping,
                              pgoff_t index, unsigned long max_scan);
 
+#define FGP_ACCESSED            0x00000001
+#define FGP_LOCK                0x00000002
+#define FGP_CREAT               0x00000004
+#define FGP_WRITE               0x00000008
+#define FGP_NOFS                0x00000010
+#define FGP_NOWAIT              0x00000020
+
+struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
+                int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask);
+
+/**
+ * find_get_page - find and get a page reference
+ * @mapping: the address_space to search
+ * @offset: the page index
+ *
+ * Looks up the page cache slot at @mapping & @offset.  If there is a
+ * page cache page, it is returned with an increased refcount.
+ *
+ * Otherwise, %NULL is returned.
+ */
+static inline struct page *find_get_page(struct address_space *mapping,
+                                        pgoff_t offset)
+{
+        return pagecache_get_page(mapping, offset, 0, 0, 0);
+}
+
+static inline struct page *find_get_page_flags(struct address_space *mapping,
+                                        pgoff_t offset, int fgp_flags)
+{
+        return pagecache_get_page(mapping, offset, fgp_flags, 0, 0);
+}
+
+/**
+ * find_lock_page - locate, pin and lock a pagecache page
+ * pagecache_get_page - find and get a page reference
+ * @mapping: the address_space to search
+ * @offset: the page index
+ *
+ * Looks up the page cache slot at @mapping & @offset.  If there is a
+ * page cache page, it is returned locked and with an increased
+ * refcount.
+ *
+ * Otherwise, %NULL is returned.
+ *
+ * find_lock_page() may sleep.
+ */
+static inline struct page *find_lock_page(struct address_space *mapping,
+                                        pgoff_t offset)
+{
+        return pagecache_get_page(mapping, offset, FGP_LOCK, 0, 0);
+}
+
+/**
+ * find_or_create_page - locate or add a pagecache page
+ * @mapping: the page's address_space
+ * @index: the page's index into the mapping
+ * @gfp_mask: page allocation mode
+ *
+ * Looks up the page cache slot at @mapping & @offset.  If there is a
+ * page cache page, it is returned locked and with an increased
+ * refcount.
+ *
+ * If the page is not present, a new page is allocated using @gfp_mask
+ * and added to the page cache and the VM's LRU list.  The page is
+ * returned locked and with an increased refcount.
+ *
+ * On memory exhaustion, %NULL is returned.
+ *
+ * find_or_create_page() may sleep, even if @gfp_flags specifies an
+ * atomic allocation!
+ */
+static inline struct page *find_or_create_page(struct address_space *mapping,
+                                        pgoff_t offset, gfp_t gfp_mask)
+{
+        return pagecache_get_page(mapping, offset,
+                                        FGP_LOCK|FGP_ACCESSED|FGP_CREAT,
+                                        gfp_mask, gfp_mask & GFP_RECLAIM_MASK);
+}
+
+/**
+ * grab_cache_page_nowait - returns locked page at given index in given cache
+ * @mapping: target address_space
+ * @index: the page index
+ *
+ * Same as grab_cache_page(), but do not wait if the page is unavailable.
+ * This is intended for speculative data generators, where the data can
+ * be regenerated if the page couldn't be grabbed.  This routine should
+ * be safe to call while holding the lock for another page.
+ *
+ * Clear __GFP_FS when allocating the page to avoid recursion into the fs
+ * and deadlock against the caller's locked page.
+ */
+static inline struct page *grab_cache_page_nowait(struct address_space *mapping,
+                                pgoff_t index)
+{
+        return pagecache_get_page(mapping, index,
+                        FGP_LOCK|FGP_CREAT|FGP_NOFS|FGP_NOWAIT,
+                        mapping_gfp_mask(mapping),
+                        GFP_NOFS);
+}
+
 struct page *find_get_entry(struct address_space *mapping, pgoff_t offset);
-struct page *find_get_page(struct address_space *mapping, pgoff_t offset);
 struct page *find_lock_entry(struct address_space *mapping, pgoff_t offset);
-struct page *find_lock_page(struct address_space *mapping, pgoff_t offset);
-struct page *find_or_create_page(struct address_space *mapping, pgoff_t index,
-                                 gfp_t gfp_mask);
 unsigned find_get_entries(struct address_space *mapping, pgoff_t start,
                           unsigned int nr_entries, struct page **entries,
                           pgoff_t *indices);
@@ -287,8 +384,6 @@ static inline struct page *grab_cache_page(struct address_space *mapping,
         return find_or_create_page(mapping, index, mapping_gfp_mask(mapping));
 }
 
-extern struct page * grab_cache_page_nowait(struct address_space *mapping,
-                                pgoff_t index);
 extern struct page * read_cache_page(struct address_space *mapping,
                                 pgoff_t index, filler_t *filler, void *data);
 extern struct page * read_cache_page_gfp(struct address_space *mapping,
@@ -425,6 +520,8 @@ static inline void wait_on_page_writeback(struct page *page)
 extern void end_page_writeback(struct page *page);
 void wait_for_stable_page(struct page *page);
 
+void page_endio(struct page *page, int rw, int err);
+
 /*
  * Add an arbitrary waiter to a page's wait queue
  */
diff --git a/include/linux/plist.h b/include/linux/plist.h
index aa0fb390bd29..8b6c970cff6c 100644
--- a/include/linux/plist.h
+++ b/include/linux/plist.h
@@ -98,6 +98,13 @@ struct plist_node {
 }
 
 /**
+ * PLIST_HEAD - declare and init plist_head
+ * @head:       name for struct plist_head variable
+ */
+#define PLIST_HEAD(head) \
+        struct plist_head head = PLIST_HEAD_INIT(head)
+
+/**
  * PLIST_NODE_INIT - static struct plist_node initializer
  * @node:       struct plist_node variable name
  * @__prio:     initial node priority
@@ -134,6 +141,8 @@ static inline void plist_node_init(struct plist_node *node, int prio)
 extern void plist_add(struct plist_node *node, struct plist_head *head);
 extern void plist_del(struct plist_node *node, struct plist_head *head);
 
+extern void plist_requeue(struct plist_node *node, struct plist_head *head);
+
 /**
  * plist_for_each - iterate over the plist
  * @pos:        the type * to use as a loop counter
@@ -143,6 +152,16 @@ extern void plist_del(struct plist_node *node, struct plist_head *head);
          list_for_each_entry(pos, &(head)->node_list, node_list)
 
 /**
+ * plist_for_each_continue - continue iteration over the plist
+ * @pos:        the type * to use as a loop cursor
+ * @head:       the head for your list
+ *
+ * Continue to iterate over plist, continuing after the current position.
+ */
+#define plist_for_each_continue(pos, head)      \
+         list_for_each_entry_continue(pos, &(head)->node_list, node_list)
+
+/**
  * plist_for_each_safe - iterate safely over a plist of given type
  * @pos:        the type * to use as a loop counter
  * @n:  another type * to use as temporary storage
@@ -163,6 +182,18 @@ extern void plist_del(struct plist_node *node, struct plist_head *head);
          list_for_each_entry(pos, &(head)->node_list, mem.node_list)
 
 /**
+ * plist_for_each_entry_continue - continue iteration over list of given type
+ * @pos:        the type * to use as a loop cursor
+ * @head:       the head for your list
+ * @m:          the name of the list_struct within the struct
+ *
+ * Continue to iterate over list of given type, continuing after
+ * the current position.
+ */
+#define plist_for_each_entry_continue(pos, head, m)     \
+        list_for_each_entry_continue(pos, &(head)->node_list, m.node_list)
+
+/**
  * plist_for_each_entry_safe - iterate safely over list of given type
  * @pos:        the type * to use as a loop counter
  * @n:          another type * to use as temporary storage
@@ -229,6 +260,20 @@ static inline int plist_node_empty(const struct plist_node *node)
 #endif
 
 /**
+ * plist_next - get the next entry in list
+ * @pos:        the type * to cursor
+ */
+#define plist_next(pos) \
+        list_next_entry(pos, node_list)
+
+/**
+ * plist_prev - get the prev entry in list
+ * @pos:        the type * to cursor
+ */
+#define plist_prev(pos) \
+        list_prev_entry(pos, node_list)
+
+/**
  * plist_first - return the first node (and thus, highest priority)
  * @head:       the &struct plist_head pointer
  *
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 8752f7595b27..319ff7e53efb 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -30,6 +30,17 @@ static inline const char *printk_skip_level(const char *buffer)
         return buffer;
 }
 
+/* printk's without a loglevel use this.. */
+#define DEFAULT_MESSAGE_LOGLEVEL CONFIG_DEFAULT_MESSAGE_LOGLEVEL
+
+/* We show everything that is MORE important than this.. */
+#define CONSOLE_LOGLEVEL_SILENT  0 /* Mum's the word */
+#define CONSOLE_LOGLEVEL_MIN     1 /* Minimum loglevel we let people use */
+#define CONSOLE_LOGLEVEL_QUIET   4 /* Shhh ..., when booted with "quiet" */
+#define CONSOLE_LOGLEVEL_DEFAULT 7 /* anything MORE serious than KERN_DEBUG */
+#define CONSOLE_LOGLEVEL_DEBUG  10 /* issue debug messages */
+#define CONSOLE_LOGLEVEL_MOTORMOUTH 15  /* You can't shut this one up */
+
 extern int console_printk[];
 
 #define console_loglevel (console_printk[0])
@@ -39,13 +50,13 @@ extern int console_printk[];
 
 static inline void console_silent(void)
 {
-        console_loglevel = 0;
+        console_loglevel = CONSOLE_LOGLEVEL_SILENT;
 }
 
 static inline void console_verbose(void)
 {
         if (console_loglevel)
-                console_loglevel = 15;
+                console_loglevel = CONSOLE_LOGLEVEL_MOTORMOUTH;
 }
 
 struct va_format {
@@ -128,9 +139,9 @@ asmlinkage __printf(1, 2) __cold
 int printk(const char *fmt, ...);
 
 /*
- * Special printk facility for scheduler use only, _DO_NOT_USE_ !
+ * Special printk facility for scheduler/timekeeping use only, _DO_NOT_USE_ !
  */
-__printf(1, 2) __cold int printk_sched(const char *fmt, ...);
+__printf(1, 2) __cold int printk_deferred(const char *fmt, ...);
 
 /*
  * Please don't use printk_ratelimit(), because it shares ratelimiting state
@@ -165,7 +176,7 @@ int printk(const char *s, ...)
         return 0;
 }
 static inline __printf(1, 2) __cold
-int printk_sched(const char *s, ...)
+int printk_deferred(const char *s, ...)
 {
         return 0;
 }
@@ -210,6 +221,12 @@ extern asmlinkage void dump_stack(void) __cold;
 #define pr_fmt(fmt) fmt
 #endif
 
+/*
+ * These can be used to print at the various log levels.
+ * All of these will print unconditionally, although note that pr_debug()
+ * and other debug macros are compiled out unless either DEBUG is defined
+ * or CONFIG_DYNAMIC_DEBUG is set.
+ */
 #define pr_emerg(fmt, ...) \
         printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__)
 #define pr_alert(fmt, ...) \
@@ -266,9 +283,20 @@ extern asmlinkage void dump_stack(void) __cold;
                 printk(fmt, ##__VA_ARGS__);                     \
         }                                                       \
 })
+#define printk_deferred_once(fmt, ...)                          \
+({                                                              \
+        static bool __print_once __read_mostly;                 \
+                                                                \
+        if (!__print_once) {                                    \
+                __print_once = true;                            \
+                printk_deferred(fmt, ##__VA_ARGS__);            \
+        }                                                       \
+})
 #else
 #define printk_once(fmt, ...)                                   \
         no_printk(fmt, ##__VA_ARGS__)
+#define printk_deferred_once(fmt, ...)                          \
+        no_printk(fmt, ##__VA_ARGS__)
 #endif
 
 #define pr_emerg_once(fmt, ...)                                 \
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 608e60a74c3c..9d117f61d976 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -44,6 +44,10 @@ extern int remove_proc_subtree(const char *, struct proc_dir_entry *);
 
 #else /* CONFIG_PROC_FS */
 
+static inline void proc_root_init(void)
+{
+}
+
 static inline void proc_flush_task(struct task_struct *task)
 {
 }
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index b66c2110cb1f..be574506e6a9 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -72,10 +72,9 @@ struct anon_vma_chain {
 };
 
 enum ttu_flags {
-        TTU_UNMAP = 0,                  /* unmap mode */
-        TTU_MIGRATION = 1,              /* migration mode */
-        TTU_MUNLOCK = 2,                /* munlock mode */
-        TTU_ACTION_MASK = 0xff,
+        TTU_UNMAP = 1,                  /* unmap mode */
+        TTU_MIGRATION = 2,              /* migration mode */
+        TTU_MUNLOCK = 4,                /* munlock mode */
 
         TTU_IGNORE_MLOCK = (1 << 8),    /* ignore mlock */
         TTU_IGNORE_ACCESS = (1 << 9),   /* don't age */
@@ -183,14 +182,10 @@ static inline void page_dup_rmap(struct page *page)
  */
 int page_referenced(struct page *, int is_locked,
                         struct mem_cgroup *memcg, unsigned long *vm_flags);
-int page_referenced_one(struct page *, struct vm_area_struct *,
-        unsigned long address, void *arg);
 
 #define TTU_ACTION(x) ((x) & TTU_ACTION_MASK)
 
 int try_to_unmap(struct page *, enum ttu_flags flags);
-int try_to_unmap_one(struct page *, struct vm_area_struct *,
-                        unsigned long address, void *arg);
 
 /*
  * Called from mm/filemap_xip.c to unmap empty zero page
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 70f67e4e6156..8fcd0e6098d9 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -137,12 +137,6 @@ struct filename;
 #define VMACACHE_MASK (VMACACHE_SIZE - 1)
 
 /*
- * List of flags we want to share for kernel threads,
- * if only because they are not used by them anyway.
- */
-#define CLONE_KERNEL    (CLONE_FS | CLONE_FILES | CLONE_SIGHAND)
-
-/*
  * These are the constant used to fake the fixed-point load-average
  * counting. Some notes:
  *  - 11 bit fractions expand to 22 bits by the multiplies: this gives
@@ -745,7 +739,6 @@ static inline int signal_group_exit(const struct signal_struct *sig)
 struct user_struct {
         atomic_t __count;       /* reference count */
         atomic_t processes;     /* How many processes does this user have? */
-        atomic_t files;         /* How many open files does this user have? */
         atomic_t sigpending;    /* How many pending signals does this user have? */
 #ifdef CONFIG_INOTIFY_USER
         atomic_t inotify_watches; /* How many inotify watches does this user have? */
@@ -2967,7 +2960,7 @@ static inline void inc_syscw(struct task_struct *tsk)
 #define TASK_SIZE_OF(tsk)       TASK_SIZE
 #endif
 
-#ifdef CONFIG_MM_OWNER
+#ifdef CONFIG_MEMCG
 extern void mm_update_next_owner(struct mm_struct *mm);
 extern void mm_init_owner(struct mm_struct *mm, struct task_struct *p);
 #else
@@ -2978,7 +2971,7 @@ static inline void mm_update_next_owner(struct mm_struct *mm)
 static inline void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
 {
 }
-#endif /* CONFIG_MM_OWNER */
+#endif /* CONFIG_MEMCG */
 
 static inline unsigned long task_rlimit(const struct task_struct *tsk,
                 unsigned int limit)
diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
index 8045a554cafb..596a0e007c62 100644
--- a/include/linux/sched/sysctl.h
+++ b/include/linux/sched/sysctl.h
@@ -25,6 +25,10 @@ enum { sysctl_hung_task_timeout_secs = 0 };
  * Because the kernel adds some informative sections to a image of program at
  * generating coredump, we need some margin. The number of extra sections is
  * 1-3 now and depends on arch. We use "5" as safe margin, here.
+ *
+ * ELF extended numbering allows more than 65535 sections, so 16-bit bound is
+ * not a hard limit any more. Although some userspace tools can be surprised by
+ * that.
  */
 #define MAPCOUNT_ELF_CORE_MARGIN        (5)
 #define DEFAULT_MAX_MAP_COUNT   (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 307bfbe62387..1d9abb7d22a0 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -116,7 +116,9 @@ struct kmem_cache *kmem_cache_create(const char *, size_t, size_t,
                         unsigned long,
                         void (*)(void *));
 #ifdef CONFIG_MEMCG_KMEM
-void kmem_cache_create_memcg(struct mem_cgroup *, struct kmem_cache *);
+struct kmem_cache *memcg_create_kmem_cache(struct mem_cgroup *,
+                                           struct kmem_cache *,
+                                           const char *);
 #endif
 void kmem_cache_destroy(struct kmem_cache *);
 int kmem_cache_shrink(struct kmem_cache *);
@@ -369,16 +371,7 @@ kmem_cache_alloc_node_trace(struct kmem_cache *s,
 #include <linux/slub_def.h>
 #endif
 
-static __always_inline void *
-kmalloc_order(size_t size, gfp_t flags, unsigned int order)
-{
-        void *ret;
-
-        flags |= (__GFP_COMP | __GFP_KMEMCG);
-        ret = (void *) __get_free_pages(flags, order);
-        kmemleak_alloc(ret, size, 1, flags);
-        return ret;
-}
+extern void *kmalloc_order(size_t size, gfp_t flags, unsigned int order);
 
 #ifdef CONFIG_TRACING
 extern void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order);
@@ -533,10 +526,7 @@ static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
  * @memcg: pointer to the memcg this cache belongs to
  * @list: list_head for the list of all caches in this memcg
  * @root_cache: pointer to the global, root cache, this cache was derived from
- * @dead: set to true after the memcg dies; the cache may still be around.
  * @nr_pages: number of pages that belongs to this cache.
- * @destroy: worker to be called whenever we are ready, or believe we may be
- *           ready, to destroy this cache.
  */
 struct memcg_cache_params {
         bool is_root_cache;
@@ -549,9 +539,7 @@ struct memcg_cache_params {
                         struct mem_cgroup *memcg;
                         struct list_head list;
                         struct kmem_cache *root_cache;
-                        bool dead;
                         atomic_t nr_pages;
-                        struct work_struct destroy;
                 };
         };
 };
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 350711560753..4bdbee80eede 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -166,10 +166,10 @@ enum {
 #define COMPACT_CLUSTER_MAX SWAP_CLUSTER_MAX
 
 /*
- * Ratio between the present memory in the zone and the "gap" that
- * we're allowing kswapd to shrink in addition to the per-zone high
- * wmark, even for zones that already have the high wmark satisfied,
- * in order to provide better per-zone lru behavior. We are ok to
+ * Ratio between zone->managed_pages and the "gap" that above the per-zone
+ * "high_wmark". While balancing nodes, We allow kswapd to shrink zones that
+ * do not meet the (high_wmark + gap) watermark, even which already met the
+ * high_wmark, in order to provide better per-zone lru behavior. We are ok to
  * spend not more than 1% of the memory for this zone balancing "gap".
  */
 #define KSWAPD_ZONE_BALANCE_GAP_RATIO 100
@@ -214,8 +214,9 @@ struct percpu_cluster {
 struct swap_info_struct {
         unsigned long   flags;          /* SWP_USED etc: see above */
         signed short    prio;           /* swap priority of this type */
+        struct plist_node list;         /* entry in swap_active_head */
+        struct plist_node avail_list;   /* entry in swap_avail_head */
         signed char     type;           /* strange name for an index */
-        signed char     next;           /* next type on the swap list */
         unsigned int    max;            /* extent of the swap_map */
         unsigned char *swap_map;        /* vmalloc'ed array of usage counts */
         struct swap_cluster_info *cluster_info; /* cluster info. Only for SSD */
@@ -255,11 +256,6 @@ struct swap_info_struct {
         struct swap_cluster_info discard_cluster_tail; /* list tail of discard clusters */
 };
 
-struct swap_list_t {
-        int head;       /* head of priority-ordered swapfile list */
-        int next;       /* swapfile to be used next */
-};
-
 /* linux/mm/workingset.c */
 void *workingset_eviction(struct address_space *mapping, struct page *page);
 bool workingset_refault(void *shadow);
@@ -308,12 +304,14 @@ extern unsigned long nr_free_pagecache_pages(void);
 
 
 /* linux/mm/swap.c */
-extern void __lru_cache_add(struct page *);
 extern void lru_cache_add(struct page *);
+extern void lru_cache_add_anon(struct page *page);
+extern void lru_cache_add_file(struct page *page);
 extern void lru_add_page_tail(struct page *page, struct page *page_tail,
                          struct lruvec *lruvec, struct list_head *head);
 extern void activate_page(struct page *);
 extern void mark_page_accessed(struct page *);
+extern void init_page_accessed(struct page *page);
 extern void lru_add_drain(void);
 extern void lru_add_drain_cpu(int cpu);
 extern void lru_add_drain_all(void);
@@ -323,22 +321,6 @@ extern void swap_setup(void);
 
 extern void add_page_to_unevictable_list(struct page *page);
 
-/**
- * lru_cache_add: add a page to the page lists
- * @page: the page to add
- */
-static inline void lru_cache_add_anon(struct page *page)
-{
-        ClearPageActive(page);
-        __lru_cache_add(page);
-}
-
-static inline void lru_cache_add_file(struct page *page)
-{
-        ClearPageActive(page);
-        __lru_cache_add(page);
-}
-
 /* linux/mm/vmscan.c */
 extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                                         gfp_t gfp_mask, nodemask_t *mask);
@@ -496,7 +478,7 @@ mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent, bool swapout)
 #define free_page_and_swap_cache(page) \
         page_cache_release(page)
 #define free_pages_and_swap_cache(pages, nr) \
-        release_pages((pages), (nr), 0);
+        release_pages((pages), (nr), false);
 
 static inline void show_swap_cache_info(void)
 {
diff --git a/include/linux/swapfile.h b/include/linux/swapfile.h
index e282624e8c10..388293a91e8c 100644
--- a/include/linux/swapfile.h
+++ b/include/linux/swapfile.h
@@ -6,7 +6,7 @@
  * want to expose them to the dozens of source files that include swap.h
  */
 extern spinlock_t swap_lock;
-extern struct swap_list_t swap_list;
+extern struct plist_head swap_active_head;
 extern struct swap_info_struct *swap_info[];
 extern int try_to_unuse(unsigned int, bool, unsigned long);
 
diff --git a/include/linux/swapops.h b/include/linux/swapops.h
index c0f75261a728..6adfb7bfbf44 100644
--- a/include/linux/swapops.h
+++ b/include/linux/swapops.h
@@ -54,7 +54,7 @@ static inline pgoff_t swp_offset(swp_entry_t entry)
 /* check whether a pte points to a swap entry */
 static inline int is_swap_pte(pte_t pte)
 {
-        return !pte_none(pte) && !pte_present(pte) && !pte_file(pte);
+        return !pte_none(pte) && !pte_present_nonuma(pte) && !pte_file(pte);
 }
 #endif
 
diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
index a5ffd32642fd..e7a018eaf3a2 100644
--- a/include/linux/swiotlb.h
+++ b/include/linux/swiotlb.h
@@ -116,4 +116,6 @@ static inline void swiotlb_free(void) { }
 #endif
 
 extern void swiotlb_print_info(void);
+extern int is_swiotlb_buffer(phys_addr_t paddr);
+
 #endif /* __LINUX_SWIOTLB_H */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index a4a0588c5397..b0881a0ed322 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -711,7 +711,7 @@ asmlinkage long sys_keyctl(int cmd, unsigned long arg2, unsigned long arg3,
 
 asmlinkage long sys_ioprio_set(int which, int who, int ioprio);
 asmlinkage long sys_ioprio_get(int which, int who);
-asmlinkage long sys_set_mempolicy(int mode, unsigned long __user *nmask,
+asmlinkage long sys_set_mempolicy(int mode, const unsigned long __user *nmask,
                                 unsigned long maxnode);
 asmlinkage long sys_migrate_pages(pid_t pid, unsigned long maxnode,
                                 const unsigned long __user *from,
@@ -723,7 +723,7 @@ asmlinkage long sys_move_pages(pid_t pid, unsigned long nr_pages,
                                 int flags);
 asmlinkage long sys_mbind(unsigned long start, unsigned long len,
                                 unsigned long mode,
-                                unsigned long __user *nmask,
+                                const unsigned long __user *nmask,
                                 unsigned long maxnode,
                                 unsigned flags);
 asmlinkage long sys_get_mempolicy(int __user *policy,
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index cb0cec94fda3..ff307b548ed3 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -61,8 +61,6 @@ extern long do_no_restart_syscall(struct restart_block *parm);
 # define THREADINFO_GFP         (GFP_KERNEL | __GFP_NOTRACK)
 #endif
 
-#define THREADINFO_GFP_ACCOUNTED (THREADINFO_GFP | __GFP_KMEMCG)
-
 /*
  * flag set/clear/test wrappers
  * - pass TIF_xxxx constants to these functions
diff --git a/include/linux/topology.h b/include/linux/topology.h
index 973671ff9e7d..dda6ee521e74 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -58,7 +58,8 @@ int arch_update_cpu_topology(void);
 /*
  * If the distance between nodes in a system is larger than RECLAIM_DISTANCE
  * (in whatever arch specific measurement units returned by node_distance())
- * then switch on zone reclaim on boot.
+ * and zone_reclaim_mode is enabled then the VM will only call zone_reclaim()
+ * on nodes within this distance.
  */
 #define RECLAIM_DISTANCE 30
 #endif
diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
index 486c3972c0be..ced92345c963 100644
--- a/include/linux/vm_event_item.h
+++ b/include/linux/vm_event_item.h
@@ -80,6 +80,10 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 NR_TLB_LOCAL_FLUSH_ALL,
                 NR_TLB_LOCAL_FLUSH_ONE,
 #endif /* CONFIG_DEBUG_TLBFLUSH */
+#ifdef CONFIG_DEBUG_VM_VMACACHE
+                VMACACHE_FIND_CALLS,
+                VMACACHE_FIND_HITS,
+#endif
                 NR_VM_EVENT_ITEMS
 };
 
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 45c9cd1daf7a..82e7db7f7100 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -95,6 +95,12 @@ static inline void vm_events_fold_cpu(int cpu)
 #define count_vm_tlb_events(x, y) do { (void)(y); } while (0)
 #endif
 
+#ifdef CONFIG_DEBUG_VM_VMACACHE
+#define count_vm_vmacache_event(x) count_vm_event(x)
+#else
+#define count_vm_vmacache_event(x) do {} while (0)
+#endif
+
 #define __count_zone_vm_events(item, zone, delta) \
                 __count_vm_events(item##_NORMAL - ZONE_NORMAL + \
                 zone_idx(zone), delta)
diff --git a/include/linux/zbud.h b/include/linux/zbud.h
index 2571a5cfa5fc..13af0d450bf6 100644
--- a/include/linux/zbud.h
+++ b/include/linux/zbud.h
@@ -11,7 +11,7 @@ struct zbud_ops {
 
 struct zbud_pool *zbud_create_pool(gfp_t gfp, struct zbud_ops *ops);
 void zbud_destroy_pool(struct zbud_pool *pool);
-int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
+int zbud_alloc(struct zbud_pool *pool, unsigned int size, gfp_t gfp,
         unsigned long *handle);
 void zbud_free(struct zbud_pool *pool, unsigned long handle);
 int zbud_reclaim_page(struct zbud_pool *pool, unsigned int retries);
diff --git a/include/trace/events/compaction.h b/include/trace/events/compaction.h
index 06f544ef2f6f..c6814b917bdf 100644
--- a/include/trace/events/compaction.h
+++ b/include/trace/events/compaction.h
@@ -5,6 +5,7 @@
 #define _TRACE_COMPACTION_H
 
 #include <linux/types.h>
+#include <linux/list.h>
 #include <linux/tracepoint.h>
 #include <trace/events/gfpflags.h>
 
@@ -47,10 +48,11 @@ DEFINE_EVENT(mm_compaction_isolate_template, mm_compaction_isolate_freepages,
 
 TRACE_EVENT(mm_compaction_migratepages,
 
-        TP_PROTO(unsigned long nr_migrated,
-                unsigned long nr_failed),
+        TP_PROTO(unsigned long nr_all,
+                int migrate_rc,
+                struct list_head *migratepages),
 
-        TP_ARGS(nr_migrated, nr_failed),
+        TP_ARGS(nr_all, migrate_rc, migratepages),
 
         TP_STRUCT__entry(
                 __field(unsigned long, nr_migrated)
@@ -58,7 +60,22 @@ TRACE_EVENT(mm_compaction_migratepages,
         ),
 
         TP_fast_assign(
-                __entry->nr_migrated = nr_migrated;
+                unsigned long nr_failed = 0;
+                struct list_head *page_lru;
+
+                /*
+                 * migrate_pages() returns either a non-negative number
+                 * with the number of pages that failed migration, or an
+                 * error code, in which case we need to count the remaining
+                 * pages manually
+                 */
+                if (migrate_rc >= 0)
+                        nr_failed = migrate_rc;
+                else
+                        list_for_each(page_lru, migratepages)
+                                nr_failed++;
+
+                __entry->nr_migrated = nr_all - nr_failed;
                 __entry->nr_failed = nr_failed;
         ),
 
diff --git a/include/trace/events/gfpflags.h b/include/trace/events/gfpflags.h
index 1eddbf1557f2..d6fd8e5b14b7 100644
--- a/include/trace/events/gfpflags.h
+++ b/include/trace/events/gfpflags.h
@@ -34,7 +34,6 @@
         {(unsigned long)__GFP_HARDWALL,         "GFP_HARDWALL"},        \
         {(unsigned long)__GFP_THISNODE,         "GFP_THISNODE"},        \
         {(unsigned long)__GFP_RECLAIMABLE,      "GFP_RECLAIMABLE"},     \
-        {(unsigned long)__GFP_KMEMCG,           "GFP_KMEMCG"},          \
         {(unsigned long)__GFP_MOVABLE,          "GFP_MOVABLE"},         \
         {(unsigned long)__GFP_NOTRACK,          "GFP_NOTRACK"},         \
         {(unsigned long)__GFP_NO_KSWAPD,        "GFP_NO_KSWAPD"},       \
diff --git a/include/trace/events/vmscan.h b/include/trace/events/vmscan.h
index 132a985aba8b..69590b6ffc09 100644
--- a/include/trace/events/vmscan.h
+++ b/include/trace/events/vmscan.h
@@ -191,6 +191,7 @@ TRACE_EVENT(mm_shrink_slab_start,
         TP_STRUCT__entry(
                 __field(struct shrinker *, shr)
                 __field(void *, shrink)
+                __field(int, nid)
                 __field(long, nr_objects_to_shrink)
                 __field(gfp_t, gfp_flags)
                 __field(unsigned long, pgs_scanned)
@@ -203,6 +204,7 @@ TRACE_EVENT(mm_shrink_slab_start,
         TP_fast_assign(
                 __entry->shr = shr;
                 __entry->shrink = shr->scan_objects;
+                __entry->nid = sc->nid;
                 __entry->nr_objects_to_shrink = nr_objects_to_shrink;
                 __entry->gfp_flags = sc->gfp_mask;
                 __entry->pgs_scanned = pgs_scanned;
@@ -212,9 +214,10 @@ TRACE_EVENT(mm_shrink_slab_start,
                 __entry->total_scan = total_scan;
         ),
 
-        TP_printk("%pF %p: objects to shrink %ld gfp_flags %s pgs_scanned %ld lru_pgs %ld cache items %ld delta %lld total_scan %ld",
+        TP_printk("%pF %p: nid: %d objects to shrink %ld gfp_flags %s pgs_scanned %ld lru_pgs %ld cache items %ld delta %lld total_scan %ld",
                 __entry->shrink,
                 __entry->shr,
+                __entry->nid,
                 __entry->nr_objects_to_shrink,
                 show_gfp_flags(__entry->gfp_flags),
                 __entry->pgs_scanned,
@@ -225,13 +228,15 @@ TRACE_EVENT(mm_shrink_slab_start,
 );
 
 TRACE_EVENT(mm_shrink_slab_end,
-        TP_PROTO(struct shrinker *shr, int shrinker_retval,
-                long unused_scan_cnt, long new_scan_cnt),
+        TP_PROTO(struct shrinker *shr, int nid, int shrinker_retval,
+                long unused_scan_cnt, long new_scan_cnt, long total_scan),
 
-        TP_ARGS(shr, shrinker_retval, unused_scan_cnt, new_scan_cnt),
+        TP_ARGS(shr, nid, shrinker_retval, unused_scan_cnt, new_scan_cnt,
+                total_scan),
 
         TP_STRUCT__entry(
                 __field(struct shrinker *, shr)
+                __field(int, nid)
                 __field(void *, shrink)
                 __field(long, unused_scan)
                 __field(long, new_scan)
@@ -241,16 +246,18 @@ TRACE_EVENT(mm_shrink_slab_end,
 
         TP_fast_assign(
                 __entry->shr = shr;
+                __entry->nid = nid;
                 __entry->shrink = shr->scan_objects;
                 __entry->unused_scan = unused_scan_cnt;
                 __entry->new_scan = new_scan_cnt;
                 __entry->retval = shrinker_retval;
-                __entry->total_scan = new_scan_cnt - unused_scan_cnt;
+                __entry->total_scan = total_scan;
         ),
 
-        TP_printk("%pF %p: unused scan count %ld new scan count %ld total_scan %ld last shrinker return val %d",
+        TP_printk("%pF %p: nid: %d unused scan count %ld new scan count %ld total_scan %ld last shrinker return val %d",
                 __entry->shrink,
                 __entry->shr,
+                __entry->nid,
                 __entry->unused_scan,
                 __entry->new_scan,
                 __entry->total_scan,
diff --git a/init/Kconfig b/init/Kconfig
index 9d3585bb2a7a..9d76b99af1b9 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -261,6 +261,16 @@ config POSIX_MQUEUE_SYSCTL
         depends on SYSCTL
         default y
 
+config CROSS_MEMORY_ATTACH
+        bool "Enable process_vm_readv/writev syscalls"
+        depends on MMU
+        default y
+        help
+          Enabling this option adds the system calls process_vm_readv and
+          process_vm_writev which allow a process with the correct privileges
+          to directly read from or write to to another process's address space.
+          See the man page for more details.
+
 config FHANDLE
         bool "open by fhandle syscalls"
         select EXPORTFS
@@ -933,7 +943,6 @@ config RESOURCE_COUNTERS
 config MEMCG
         bool "Memory Resource Controller for Control Groups"
         depends on RESOURCE_COUNTERS
-        select MM_OWNER
         select EVENTFD
         help
           Provides a memory resource controller that manages both anonymous
@@ -951,9 +960,6 @@ config MEMCG
           disable memory resource controller and you can avoid overheads.
           (and lose benefits of memory resource controller)
 
-          This config option also selects MM_OWNER config option, which
-          could in turn add some fork/exit overhead.
-
 config MEMCG_SWAP
         bool "Memory Resource Controller Swap Extension"
         depends on MEMCG && SWAP
@@ -996,6 +1002,12 @@ config MEMCG_KMEM
           the kmem extension can use it to guarantee that no group of processes
           will ever exhaust kernel resources alone.
 
+          WARNING: Current implementation lacks reclaim support. That means
+          allocation attempts will fail when close to the limit even if there
+          are plenty of kmem available for reclaim. That makes this option
+          unusable in real life so DO NOT SELECT IT unless for development
+          purposes.
+
 config CGROUP_HUGETLB
         bool "HugeTLB Resource Controller for Control Groups"
         depends on RESOURCE_COUNTERS && HUGETLB_PAGE
@@ -1173,9 +1185,6 @@ config SCHED_AUTOGROUP
           desktop applications.  Task group autogeneration is currently based
           upon task session.
 
-config MM_OWNER
-        bool
-
 config SYSFS_DEPRECATED
         bool "Enable deprecated sysfs features to support old userspace tools"
         depends on SYSFS
@@ -1304,6 +1313,16 @@ config UID16
         help
           This enables the legacy 16-bit UID syscall wrappers.
 
+config SGETMASK_SYSCALL
+        bool "sgetmask/ssetmask syscalls support" if EXPERT
+        def_bool PARISC || MN10300 || BLACKFIN || M68K || PPC || MIPS || X86 || SPARC || CRIS || MICROBLAZE || SUPERH
+        ---help---
+          sys_sgetmask and sys_ssetmask are obsolete system calls
+          no longer supported in libc but still enabled by default in some
+          architectures.
+
+          If unsure, leave the default option here.
+
 config SYSFS_SYSCALL
         bool "Sysfs syscall support" if EXPERT
         default y
diff --git a/init/main.c b/init/main.c
index 48655ceb66f4..17d47bcdf573 100644
--- a/init/main.c
+++ b/init/main.c
@@ -77,6 +77,7 @@
 #include <linux/sched_clock.h>
 #include <linux/context_tracking.h>
 #include <linux/random.h>
+#include <linux/list.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -203,13 +204,13 @@ EXPORT_SYMBOL(loops_per_jiffy);
 
 static int __init debug_kernel(char *str)
 {
-        console_loglevel = 10;
+        console_loglevel = CONSOLE_LOGLEVEL_DEBUG;
         return 0;
 }
 
 static int __init quiet_kernel(char *str)
 {
-        console_loglevel = 4;
+        console_loglevel = CONSOLE_LOGLEVEL_QUIET;
         return 0;
 }
 
@@ -379,7 +380,7 @@ static noinline void __init_refok rest_init(void)
          * the init task will end up wanting to create kthreads, which, if
          * we schedule it before we create kthreadd, will OOPS.
          */
-        kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
+        kernel_thread(kernel_init, NULL, CLONE_FS);
         numa_default_policy();
         pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
         rcu_read_lock();
@@ -507,7 +508,6 @@ asmlinkage __visible void __init start_kernel(void)
         page_address_init();
         pr_notice("%s", linux_banner);
         setup_arch(&command_line);
-        mm_init_owner(&init_mm, &init_task);
         mm_init_cpumask(&init_mm);
         setup_command_line(command_line);
         setup_nr_cpu_ids();
@@ -629,9 +629,7 @@ asmlinkage __visible void __init start_kernel(void)
         signals_init();
         /* rootfs populating might need page-writeback */
         page_writeback_init();
-#ifdef CONFIG_PROC_FS
         proc_root_init();
-#endif
         cgroup_init();
         cpuset_init();
         taskstats_init_early();
@@ -666,19 +664,83 @@ static void __init do_ctors(void)
 bool initcall_debug;
 core_param(initcall_debug, initcall_debug, bool, 0644);
 
+#ifdef CONFIG_KALLSYMS
+struct blacklist_entry {
+        struct list_head next;
+        char *buf;
+};
+
+static __initdata_or_module LIST_HEAD(blacklisted_initcalls);
+
+static int __init initcall_blacklist(char *str)
+{
+        char *str_entry;
+        struct blacklist_entry *entry;
+
+        /* str argument is a comma-separated list of functions */
+        do {
+                str_entry = strsep(&str, ",");
+                if (str_entry) {
+                        pr_debug("blacklisting initcall %s\n", str_entry);
+                        entry = alloc_bootmem(sizeof(*entry));
+                        entry->buf = alloc_bootmem(strlen(str_entry) + 1);
+                        strcpy(entry->buf, str_entry);
+                        list_add(&entry->next, &blacklisted_initcalls);
+                }
+        } while (str_entry);
+
+        return 0;
+}
+
+static bool __init_or_module initcall_blacklisted(initcall_t fn)
+{
+        struct list_head *tmp;
+        struct blacklist_entry *entry;
+        char *fn_name;
+
+        fn_name = kasprintf(GFP_KERNEL, "%pf", fn);
+        if (!fn_name)
+                return false;
+
+        list_for_each(tmp, &blacklisted_initcalls) {
+                entry = list_entry(tmp, struct blacklist_entry, next);
+                if (!strcmp(fn_name, entry->buf)) {
+                        pr_debug("initcall %s blacklisted\n", fn_name);
+                        kfree(fn_name);
+                        return true;
+                }
+        }
+
+        kfree(fn_name);
+        return false;
+}
+#else
+static int __init initcall_blacklist(char *str)
+{
+        pr_warn("initcall_blacklist requires CONFIG_KALLSYMS\n");
+        return 0;
+}
+
+static bool __init_or_module initcall_blacklisted(initcall_t fn)
+{
+        return false;
+}
+#endif
+__setup("initcall_blacklist=", initcall_blacklist);
+
 static int __init_or_module do_one_initcall_debug(initcall_t fn)
 {
         ktime_t calltime, delta, rettime;
         unsigned long long duration;
         int ret;
 
-        pr_debug("calling  %pF @ %i\n", fn, task_pid_nr(current));
+        printk(KERN_DEBUG "calling  %pF @ %i\n", fn, task_pid_nr(current));
         calltime = ktime_get();
         ret = fn();
         rettime = ktime_get();
         delta = ktime_sub(rettime, calltime);
         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-        pr_debug("initcall %pF returned %d after %lld usecs\n",
+        printk(KERN_DEBUG "initcall %pF returned %d after %lld usecs\n",
                  fn, ret, duration);
 
         return ret;
@@ -690,6 +752,9 @@ int __init_or_module do_one_initcall(initcall_t fn)
         int ret;
         char msgbuf[64];
 
+        if (initcall_blacklisted(fn))
+                return -EPERM;
+
         if (initcall_debug)
                 ret = do_one_initcall_debug(fn);
         else
diff --git a/kernel/backtracetest.c b/kernel/backtracetest.c
index a5e026bc45c4..1323360d90e3 100644
--- a/kernel/backtracetest.c
+++ b/kernel/backtracetest.c
@@ -19,8 +19,8 @@
 
 static void backtrace_test_normal(void)
 {
-        printk("Testing a backtrace from process context.\n");
-        printk("The following trace is a kernel self test and not a bug!\n");
+        pr_info("Testing a backtrace from process context.\n");
+        pr_info("The following trace is a kernel self test and not a bug!\n");
 
         dump_stack();
 }
@@ -37,8 +37,8 @@ static DECLARE_TASKLET(backtrace_tasklet, &backtrace_test_irq_callback, 0);
 
 static void backtrace_test_irq(void)
 {
-        printk("Testing a backtrace from irq context.\n");
-        printk("The following trace is a kernel self test and not a bug!\n");
+        pr_info("Testing a backtrace from irq context.\n");
+        pr_info("The following trace is a kernel self test and not a bug!\n");
 
         init_completion(&backtrace_work);
         tasklet_schedule(&backtrace_tasklet);
@@ -51,8 +51,8 @@ static void backtrace_test_saved(void)
         struct stack_trace trace;
         unsigned long entries[8];
 
-        printk("Testing a saved backtrace.\n");
-        printk("The following trace is a kernel self test and not a bug!\n");
+        pr_info("Testing a saved backtrace.\n");
+        pr_info("The following trace is a kernel self test and not a bug!\n");
 
         trace.nr_entries = 0;
         trace.max_entries = ARRAY_SIZE(entries);
@@ -65,19 +65,19 @@ static void backtrace_test_saved(void)
 #else
 static void backtrace_test_saved(void)
 {
-        printk("Saved backtrace test skipped.\n");
+        pr_info("Saved backtrace test skipped.\n");
 }
 #endif
 
 static int backtrace_regression_test(void)
 {
-        printk("====[ backtrace testing ]===========\n");
+        pr_info("====[ backtrace testing ]===========\n");
 
         backtrace_test_normal();
         backtrace_test_irq();
         backtrace_test_saved();
 
-        printk("====[ end of backtrace testing ]====\n");
+        pr_info("====[ end of backtrace testing ]====\n");
         return 0;
 }
 
diff --git a/kernel/capability.c b/kernel/capability.c
index a8d63df0c322..84b2bbf443e7 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -24,7 +24,6 @@
  */
 
 const kernel_cap_t __cap_empty_set = CAP_EMPTY_SET;
-
 EXPORT_SYMBOL(__cap_empty_set);
 
 int file_caps_enabled = 1;
@@ -189,7 +188,7 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
                  *
                  * An alternative would be to return an error here
                  * (-ERANGE), but that causes legacy applications to
-                 * unexpectidly fail; the capget/modify/capset aborts
+                 * unexpectedly fail; the capget/modify/capset aborts
                  * before modification is attempted and the application
                  * fails.
                  */
@@ -395,7 +394,8 @@ EXPORT_SYMBOL(ns_capable);
  * This does not set PF_SUPERPRIV because the caller may not
  * actually be privileged.
  */
-bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)
+bool file_ns_capable(const struct file *file, struct user_namespace *ns,
+                     int cap)
 {
         if (WARN_ON_ONCE(!cap_valid(cap)))
                 return false;
diff --git a/kernel/compat.c b/kernel/compat.c
index e40b0430b562..633394f442f8 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -157,7 +157,7 @@ static int __compat_put_timespec(const struct timespec *ts, struct compat_timesp
 int compat_get_timeval(struct timeval *tv, const void __user *utv)
 {
         if (COMPAT_USE_64BIT_TIME)
-                return copy_from_user(tv, utv, sizeof *tv) ? -EFAULT : 0;
+                return copy_from_user(tv, utv, sizeof(*tv)) ? -EFAULT : 0;
         else
                 return __compat_get_timeval(tv, utv);
 }
@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(compat_get_timeval);
 int compat_put_timeval(const struct timeval *tv, void __user *utv)
 {
         if (COMPAT_USE_64BIT_TIME)
-                return copy_to_user(utv, tv, sizeof *tv) ? -EFAULT : 0;
+                return copy_to_user(utv, tv, sizeof(*tv)) ? -EFAULT : 0;
         else
                 return __compat_put_timeval(tv, utv);
 }
@@ -175,7 +175,7 @@ EXPORT_SYMBOL_GPL(compat_put_timeval);
 int compat_get_timespec(struct timespec *ts, const void __user *uts)
 {
         if (COMPAT_USE_64BIT_TIME)
-                return copy_from_user(ts, uts, sizeof *ts) ? -EFAULT : 0;
+                return copy_from_user(ts, uts, sizeof(*ts)) ? -EFAULT : 0;
         else
                 return __compat_get_timespec(ts, uts);
 }
@@ -184,7 +184,7 @@ EXPORT_SYMBOL_GPL(compat_get_timespec);
 int compat_put_timespec(const struct timespec *ts, void __user *uts)
 {
         if (COMPAT_USE_64BIT_TIME)
-                return copy_to_user(uts, ts, sizeof *ts) ? -EFAULT : 0;
+                return copy_to_user(uts, ts, sizeof(*ts)) ? -EFAULT : 0;
         else
                 return __compat_put_timespec(ts, uts);
 }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 247979a1b815..acf791c55b71 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -283,8 +283,7 @@ static inline void check_for_tasks(int cpu)
                 task_cputime(p, &utime, &stime);
                 if (task_cpu(p) == cpu && p->state == TASK_RUNNING &&
                     (utime || stime))
-                        printk(KERN_WARNING "Task %s (pid = %d) is on cpu %d "
-                                "(state = %ld, flags = %x)\n",
+                        pr_warn("Task %s (pid = %d) is on cpu %d (state = %ld, flags = %x)\n",
                                 p->comm, task_pid_nr(p), cpu,
                                 p->state, p->flags);
         }
@@ -336,8 +335,8 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
         if (err) {
                 nr_calls--;
                 __cpu_notify(CPU_DOWN_FAILED | mod, hcpu, nr_calls, NULL);
-                printk("%s: attempt to take down CPU %u failed\n",
-                                __func__, cpu);
+                pr_warn("%s: attempt to take down CPU %u failed\n",
+                        __func__, cpu);
                 goto out_release;
         }
 
@@ -444,8 +443,8 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen)
         ret = __cpu_notify(CPU_UP_PREPARE | mod, hcpu, -1, &nr_calls);
         if (ret) {
                 nr_calls--;
-                printk(KERN_WARNING "%s: attempt to bring up CPU %u failed\n",
-                                __func__, cpu);
+                pr_warn("%s: attempt to bring up CPU %u failed\n",
+                        __func__, cpu);
                 goto out_notify;
         }
 
@@ -475,11 +474,10 @@ int cpu_up(unsigned int cpu)
         int err = 0;
 
         if (!cpu_possible(cpu)) {
-                printk(KERN_ERR "can't online cpu %d because it is not "
-                        "configured as may-hotadd at boot time\n", cpu);
+                pr_err("can't online cpu %d because it is not configured as may-hotadd at boot time\n",
+                       cpu);
 #if defined(CONFIG_IA64)
-                printk(KERN_ERR "please check additional_cpus= boot "
-                                "parameter\n");
+                pr_err("please check additional_cpus= boot parameter\n");
 #endif
                 return -EINVAL;
         }
@@ -518,7 +516,7 @@ int disable_nonboot_cpus(void)
          */
         cpumask_clear(frozen_cpus);
 
-        printk("Disabling non-boot CPUs ...\n");
+        pr_info("Disabling non-boot CPUs ...\n");
         for_each_online_cpu(cpu) {
                 if (cpu == first_cpu)
                         continue;
@@ -526,8 +524,7 @@ int disable_nonboot_cpus(void)
                 if (!error)
                         cpumask_set_cpu(cpu, frozen_cpus);
                 else {
-                        printk(KERN_ERR "Error taking CPU%d down: %d\n",
-                                cpu, error);
+                        pr_err("Error taking CPU%d down: %d\n", cpu, error);
                         break;
                 }
         }
@@ -537,7 +534,7 @@ int disable_nonboot_cpus(void)
                 /* Make sure the CPUs won't be enabled by someone else */
                 cpu_hotplug_disabled = 1;
         } else {
-                printk(KERN_ERR "Non-boot CPUs are not disabled\n");
+                pr_err("Non-boot CPUs are not disabled\n");
         }
         cpu_maps_update_done();
         return error;
@@ -561,17 +558,17 @@ void __ref enable_nonboot_cpus(void)
         if (cpumask_empty(frozen_cpus))
                 goto out;
 
-        printk(KERN_INFO "Enabling non-boot CPUs ...\n");
+        pr_info("Enabling non-boot CPUs ...\n");
 
         arch_enable_nonboot_cpus_begin();
 
         for_each_cpu(cpu, frozen_cpus) {
                 error = _cpu_up(cpu, 1);
                 if (!error) {
-                        printk(KERN_INFO "CPU%d is up\n", cpu);
+                        pr_info("CPU%d is up\n", cpu);
                         continue;
                 }
-                printk(KERN_WARNING "Error taking CPU%d up: %d\n", cpu, error);
+                pr_warn("Error taking CPU%d up: %d\n", cpu, error);
         }
 
         arch_enable_nonboot_cpus_end();
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 3d54c418bd06..130017843899 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -61,12 +61,7 @@
 #include <linux/cgroup.h>
 #include <linux/wait.h>
 
-/*
- * Tracks how many cpusets are currently defined in system.
- * When there is only one cpuset (the root cpuset) we can
- * short circuit some hooks.
- */
-int number_of_cpusets __read_mostly;
+struct static_key cpusets_enabled_key __read_mostly = STATIC_KEY_INIT_FALSE;
 
 /* See "Frequency meter" comments, below. */
 
@@ -611,7 +606,7 @@ static int generate_sched_domains(cpumask_var_t **domains,
                 goto done;
         }
 
-        csa = kmalloc(number_of_cpusets * sizeof(cp), GFP_KERNEL);
+        csa = kmalloc(nr_cpusets() * sizeof(cp), GFP_KERNEL);
         if (!csa)
                 goto done;
         csn = 0;
@@ -1888,7 +1883,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
         if (is_spread_slab(parent))
                 set_bit(CS_SPREAD_SLAB, &cs->flags);
 
-        number_of_cpusets++;
+        cpuset_inc();
 
         if (!test_bit(CGRP_CPUSET_CLONE_CHILDREN, &css->cgroup->flags))
                 goto out_unlock;
@@ -1939,7 +1934,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css)
         if (is_sched_load_balance(cs))
                 update_flag(CS_SCHED_LOAD_BALANCE, cs, 0);
 
-        number_of_cpusets--;
+        cpuset_dec();
         clear_bit(CS_ONLINE, &cs->flags);
 
         mutex_unlock(&cpuset_mutex);
@@ -1992,7 +1987,6 @@ int __init cpuset_init(void)
         if (!alloc_cpumask_var(&cpus_attach, GFP_KERNEL))
                 BUG();
 
-        number_of_cpusets = 1;
         return 0;
 }
 
diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
index b03e0e814e43..fe15fff5df53 100644
--- a/kernel/debug/kdb/kdb_bt.c
+++ b/kernel/debug/kdb/kdb_bt.c
@@ -21,7 +21,7 @@
 static void kdb_show_stack(struct task_struct *p, void *addr)
 {
         int old_lvl = console_loglevel;
-        console_loglevel = 15;
+        console_loglevel = CONSOLE_LOGLEVEL_MOTORMOUTH;
         kdb_trap_printk++;
         kdb_set_current_task(p);
         if (addr) {
diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index 14ff4849262c..7c70812caea5 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -710,7 +710,7 @@ kdb_printit:
         }
         if (logging) {
                 saved_loglevel = console_loglevel;
-                console_loglevel = 0;
+                console_loglevel = CONSOLE_LOGLEVEL_SILENT;
                 printk(KERN_INFO "%s", kdb_buffer);
         }
 
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 0b097c8a1e50..2f7c760305ca 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1091,7 +1091,7 @@ static int kdb_reboot(int argc, const char **argv)
 static void kdb_dumpregs(struct pt_regs *regs)
 {
         int old_lvl = console_loglevel;
-        console_loglevel = 15;
+        console_loglevel = CONSOLE_LOGLEVEL_MOTORMOUTH;
         kdb_trap_printk++;
         show_regs(regs);
         kdb_trap_printk--;
diff --git a/kernel/exec_domain.c b/kernel/exec_domain.c
index 0dbeae374225..83d4382f5699 100644
--- a/kernel/exec_domain.c
+++ b/kernel/exec_domain.c
@@ -37,7 +37,7 @@ static unsigned long ident_map[32] = {
 struct exec_domain default_exec_domain = {
         .name           = "Linux",              /* name */
         .handler        = default_handler,      /* lcall7 causes a seg fault. */
-        .pers_low       = 0,                    /* PER_LINUX personality. */
+        .pers_low       = 0,                    /* PER_LINUX personality. */
         .pers_high      = 0,                    /* PER_LINUX personality. */
         .signal_map     = ident_map,            /* Identity map signals. */
         .signal_invmap  = ident_map,            /*  - both ways. */
@@ -83,7 +83,7 @@ lookup_exec_domain(unsigned int personality)
         ep = &default_exec_domain;
 out:
         read_unlock(&exec_domains_lock);
-        return (ep);
+        return ep;
 }
 
 int
@@ -110,8 +110,9 @@ register_exec_domain(struct exec_domain *ep)
 
 out:
         write_unlock(&exec_domains_lock);
-        return (err);
+        return err;
 }
+EXPORT_SYMBOL(register_exec_domain);
 
 int
 unregister_exec_domain(struct exec_domain *ep)
@@ -133,6 +134,7 @@ unregister:
         write_unlock(&exec_domains_lock);
         return 0;
 }
+EXPORT_SYMBOL(unregister_exec_domain);
 
 int __set_personality(unsigned int personality)
 {
@@ -144,6 +146,7 @@ int __set_personality(unsigned int personality)
 
         return 0;
 }
+EXPORT_SYMBOL(__set_personality);
 
 #ifdef CONFIG_PROC_FS
 static int execdomains_proc_show(struct seq_file *m, void *v)
@@ -188,8 +191,3 @@ SYSCALL_DEFINE1(personality, unsigned int, personality)
 
         return old;
 }
-
-
-EXPORT_SYMBOL(register_exec_domain);
-EXPORT_SYMBOL(unregister_exec_domain);
-EXPORT_SYMBOL(__set_personality);
diff --git a/kernel/exit.c b/kernel/exit.c
index 6ed6a1d552b5..750c2e594617 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -352,7 +352,7 @@ int disallow_signal(int sig)
 
 EXPORT_SYMBOL(disallow_signal);
 
-#ifdef CONFIG_MM_OWNER
+#ifdef CONFIG_MEMCG
 /*
  * A task is exiting.   If it owned this mm, find a new owner for the mm.
  */
@@ -395,14 +395,18 @@ retry:
         }
 
         /*
-         * Search through everything else. We should not get
-         * here often
+         * Search through everything else, we should not get here often.
          */
-        do_each_thread(g, c) {
-                if (c->mm == mm)
-                        goto assign_new_owner;
-        } while_each_thread(g, c);
-
+        for_each_process(g) {
+                if (g->flags & PF_KTHREAD)
+                        continue;
+                for_each_thread(g, c) {
+                        if (c->mm == mm)
+                                goto assign_new_owner;
+                        if (c->mm)
+                                break;
+                }
+        }
         read_unlock(&tasklist_lock);
         /*
          * We found no owner yet mm_users > 1: this implies that we are
@@ -434,7 +438,7 @@ assign_new_owner:
         task_unlock(c);
         put_task_struct(c);
 }
-#endif /* CONFIG_MM_OWNER */
+#endif /* CONFIG_MEMCG */
 
 /*
  * Turn us into a lazy TLB process if we
diff --git a/kernel/fork.c b/kernel/fork.c
index 54a8d26f612f..0d53eb0dfb6f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -150,15 +150,15 @@ void __weak arch_release_thread_info(struct thread_info *ti)
 static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
                                                   int node)
 {
-        struct page *page = alloc_pages_node(node, THREADINFO_GFP_ACCOUNTED,
-                                             THREAD_SIZE_ORDER);
+        struct page *page = alloc_kmem_pages_node(node, THREADINFO_GFP,
+                                                  THREAD_SIZE_ORDER);
 
         return page ? page_address(page) : NULL;
 }
 
 static inline void free_thread_info(struct thread_info *ti)
 {
-        free_memcg_kmem_pages((unsigned long)ti, THREAD_SIZE_ORDER);
+        free_kmem_pages((unsigned long)ti, THREAD_SIZE_ORDER);
 }
 # else
 static struct kmem_cache *thread_info_cache;
@@ -1099,12 +1099,12 @@ static void rt_mutex_init_task(struct task_struct *p)
 #endif
 }
 
-#ifdef CONFIG_MM_OWNER
+#ifdef CONFIG_MEMCG
 void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
 {
         mm->owner = p;
 }
-#endif /* CONFIG_MM_OWNER */
+#endif /* CONFIG_MEMCG */
 
 /*
  * Initialize POSIX timer handling for a single task.
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 06bb1417b063..06db12434d72 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -52,8 +52,10 @@ unsigned int __read_mostly sysctl_hung_task_panic =
 
 static int __init hung_task_panic_setup(char *str)
 {
-        sysctl_hung_task_panic = simple_strtoul(str, NULL, 0);
+        int rc = kstrtouint(str, 0, &sysctl_hung_task_panic);
 
+        if (rc)
+                return rc;
         return 1;
 }
 __setup("hung_task_panic=", hung_task_panic_setup);
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 9a130ec06f7a..c2390f41307b 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -262,7 +262,7 @@ static void create_kthread(struct kthread_create_info *create)
  * kthread_stop() has been called).  The return value should be zero
  * or a negative error number; it will be passed to kthread_stop().
  *
- * Returns a task_struct or ERR_PTR(-ENOMEM).
+ * Returns a task_struct or ERR_PTR(-ENOMEM) or ERR_PTR(-EINTR).
  */
 struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
                                            void *data, int node,
@@ -298,7 +298,7 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
                  * that thread.
                  */
                 if (xchg(&create->done, NULL))
-                        return ERR_PTR(-ENOMEM);
+                        return ERR_PTR(-EINTR);
                 /*
                  * kthreadd (or new kernel thread) will call complete()
                  * shortly.
diff --git a/kernel/latencytop.c b/kernel/latencytop.c
index a462b317f9a0..a02812743a7e 100644
--- a/kernel/latencytop.c
+++ b/kernel/latencytop.c
@@ -88,7 +88,8 @@ static void clear_global_latency_tracing(void)
 }
 
 static void __sched
-account_global_scheduler_latency(struct task_struct *tsk, struct latency_record *lat)
+account_global_scheduler_latency(struct task_struct *tsk,
+                                 struct latency_record *lat)
 {
         int firstnonnull = MAXLR + 1;
         int i;
@@ -255,7 +256,7 @@ static int lstats_show(struct seq_file *m, void *v)
                                         break;
                                 seq_printf(m, " %ps", (void *)bt);
                         }
-                        seq_printf(m, "\n");
+                        seq_puts(m, "\n");
                 }
         }
         return 0;
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 221229cf0190..ea2d5f6962ed 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -54,20 +54,16 @@
 #include "console_cmdline.h"
 #include "braille.h"
 
-/* printk's without a loglevel use this.. */
-#define DEFAULT_MESSAGE_LOGLEVEL CONFIG_DEFAULT_MESSAGE_LOGLEVEL
-
-/* We show everything that is MORE important than this.. */
-#define MINIMUM_CONSOLE_LOGLEVEL 1 /* Minimum loglevel we let people use */
-#define DEFAULT_CONSOLE_LOGLEVEL 7 /* anything MORE serious than KERN_DEBUG */
-
 int console_printk[4] = {
-        DEFAULT_CONSOLE_LOGLEVEL,       /* console_loglevel */
+        CONSOLE_LOGLEVEL_DEFAULT,       /* console_loglevel */
         DEFAULT_MESSAGE_LOGLEVEL,       /* default_message_loglevel */
-        MINIMUM_CONSOLE_LOGLEVEL,       /* minimum_console_loglevel */
-        DEFAULT_CONSOLE_LOGLEVEL,       /* default_console_loglevel */
+        CONSOLE_LOGLEVEL_MIN,           /* minimum_console_loglevel */
+        CONSOLE_LOGLEVEL_DEFAULT,       /* default_console_loglevel */
 };
 
+/* Deferred messaged from sched code are marked by this special level */
+#define SCHED_MESSAGE_LOGLEVEL -2
+
 /*
  * Low level drivers may need that to know if they can schedule in
  * their unblank() callback or not. So let's export it.
@@ -91,6 +87,29 @@ static struct lockdep_map console_lock_dep_map = {
 #endif
 
 /*
+ * Helper macros to handle lockdep when locking/unlocking console_sem. We use
+ * macros instead of functions so that _RET_IP_ contains useful information.
+ */
+#define down_console_sem() do { \
+        down(&console_sem);\
+        mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);\
+} while (0)
+
+static int __down_trylock_console_sem(unsigned long ip)
+{
+        if (down_trylock(&console_sem))
+                return 1;
+        mutex_acquire(&console_lock_dep_map, 0, 1, ip);
+        return 0;
+}
+#define down_trylock_console_sem() __down_trylock_console_sem(_RET_IP_)
+
+#define up_console_sem() do { \
+        mutex_release(&console_lock_dep_map, 1, _RET_IP_);\
+        up(&console_sem);\
+} while (0)
+
+/*
  * This is used for debugging the mess that is the VT code by
  * keeping track if we have the console semaphore held. It's
  * definitely not the perfect debug tool (we don't know if _WE_
@@ -206,8 +225,9 @@ struct printk_log {
 };
 
 /*
- * The logbuf_lock protects kmsg buffer, indices, counters. It is also
- * used in interesting ways to provide interlocking in console_unlock();
+ * The logbuf_lock protects kmsg buffer, indices, counters.  This can be taken
+ * within the scheduler's rq lock. It must be released before calling
+ * console_unlock() or anything else that might wake up a process.
  */
 static DEFINE_RAW_SPINLOCK(logbuf_lock);
 
@@ -250,9 +270,6 @@ static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
 static char *log_buf = __log_buf;
 static u32 log_buf_len = __LOG_BUF_LEN;
 
-/* cpu currently holding logbuf_lock */
-static volatile unsigned int logbuf_cpu = UINT_MAX;
-
 /* human readable text of the record */
 static char *log_text(const struct printk_log *msg)
 {
@@ -297,34 +314,106 @@ static u32 log_next(u32 idx)
         return idx + msg->len;
 }
 
-/* insert record into the buffer, discard old ones, update heads */
-static void log_store(int facility, int level,
-                      enum log_flags flags, u64 ts_nsec,
-                      const char *dict, u16 dict_len,
-                      const char *text, u16 text_len)
+/*
+ * Check whether there is enough free space for the given message.
+ *
+ * The same values of first_idx and next_idx mean that the buffer
+ * is either empty or full.
+ *
+ * If the buffer is empty, we must respect the position of the indexes.
+ * They cannot be reset to the beginning of the buffer.
+ */
+static int logbuf_has_space(u32 msg_size, bool empty)
 {
-        struct printk_log *msg;
-        u32 size, pad_len;
+        u32 free;
 
-        /* number of '\0' padding bytes to next message */
-        size = sizeof(struct printk_log) + text_len + dict_len;
-        pad_len = (-size) & (LOG_ALIGN - 1);
-        size += pad_len;
+        if (log_next_idx > log_first_idx || empty)
+                free = max(log_buf_len - log_next_idx, log_first_idx);
+        else
+                free = log_first_idx - log_next_idx;
 
+        /*
+         * We need space also for an empty header that signalizes wrapping
+         * of the buffer.
+         */
+        return free >= msg_size + sizeof(struct printk_log);
+}
+
+static int log_make_free_space(u32 msg_size)
+{
         while (log_first_seq < log_next_seq) {
-                u32 free;
+                if (logbuf_has_space(msg_size, false))
+                        return 0;
+                /* drop old messages until we have enough continuous space */
+                log_first_idx = log_next(log_first_idx);
+                log_first_seq++;
+        }
 
-                if (log_next_idx > log_first_idx)
-                        free = max(log_buf_len - log_next_idx, log_first_idx);
-                else
-                        free = log_first_idx - log_next_idx;
+        /* sequence numbers are equal, so the log buffer is empty */
+        if (logbuf_has_space(msg_size, true))
+                return 0;
 
-                if (free >= size + sizeof(struct printk_log))
-                        break;
+        return -ENOMEM;
+}
 
-                /* drop old messages until we have enough contiuous space */
-                log_first_idx = log_next(log_first_idx);
-                log_first_seq++;
+/* compute the message size including the padding bytes */
+static u32 msg_used_size(u16 text_len, u16 dict_len, u32 *pad_len)
+{
+        u32 size;
+
+        size = sizeof(struct printk_log) + text_len + dict_len;
+        *pad_len = (-size) & (LOG_ALIGN - 1);
+        size += *pad_len;
+
+        return size;
+}
+
+/*
+ * Define how much of the log buffer we could take at maximum. The value
+ * must be greater than two. Note that only half of the buffer is available
+ * when the index points to the middle.
+ */
+#define MAX_LOG_TAKE_PART 4
+static const char trunc_msg[] = "<truncated>";
+
+static u32 truncate_msg(u16 *text_len, u16 *trunc_msg_len,
+                        u16 *dict_len, u32 *pad_len)
+{
+        /*
+         * The message should not take the whole buffer. Otherwise, it might
+         * get removed too soon.
+         */
+        u32 max_text_len = log_buf_len / MAX_LOG_TAKE_PART;
+        if (*text_len > max_text_len)
+                *text_len = max_text_len;
+        /* enable the warning message */
+        *trunc_msg_len = strlen(trunc_msg);
+        /* disable the "dict" completely */
+        *dict_len = 0;
+        /* compute the size again, count also the warning message */
+        return msg_used_size(*text_len + *trunc_msg_len, 0, pad_len);
+}
+
+/* insert record into the buffer, discard old ones, update heads */
+static int log_store(int facility, int level,
+                     enum log_flags flags, u64 ts_nsec,
+                     const char *dict, u16 dict_len,
+                     const char *text, u16 text_len)
+{
+        struct printk_log *msg;
+        u32 size, pad_len;
+        u16 trunc_msg_len = 0;
+
+        /* number of '\0' padding bytes to next message */
+        size = msg_used_size(text_len, dict_len, &pad_len);
+
+        if (log_make_free_space(size)) {
+                /* truncate the message if it is too long for empty buffer */
+                size = truncate_msg(&text_len, &trunc_msg_len,
+                                    &dict_len, &pad_len);
+                /* survive when the log buffer is too small for trunc_msg */
+                if (log_make_free_space(size))
+                        return 0;
         }
 
         if (log_next_idx + size + sizeof(struct printk_log) > log_buf_len) {
@@ -341,6 +430,10 @@ static void log_store(int facility, int level,
         msg = (struct printk_log *)(log_buf + log_next_idx);
         memcpy(log_text(msg), text, text_len);
         msg->text_len = text_len;
+        if (trunc_msg_len) {
+                memcpy(log_text(msg) + text_len, trunc_msg, trunc_msg_len);
+                msg->text_len += trunc_msg_len;
+        }
         memcpy(log_dict(msg), dict, dict_len);
         msg->dict_len = dict_len;
         msg->facility = facility;
@@ -356,6 +449,8 @@ static void log_store(int facility, int level,
         /* insert message */
         log_next_idx += msg->len;
         log_next_seq++;
+
+        return msg->text_len;
 }
 
 #ifdef CONFIG_SECURITY_DMESG_RESTRICT
@@ -1303,7 +1398,10 @@ static void zap_locks(void)
         sema_init(&console_sem, 1);
 }
 
-/* Check if we have any console registered that can be called early in boot. */
+/*
+ * Check if we have any console that is capable of printing while cpu is
+ * booting or shutting down. Requires console_sem.
+ */
 static int have_callable_console(void)
 {
         struct console *con;
@@ -1318,10 +1416,9 @@ static int have_callable_console(void)
 /*
  * Can we actually use the console at this time on this cpu?
  *
- * Console drivers may assume that per-cpu resources have
- * been allocated. So unless they're explicitly marked as
- * being able to cope (CON_ANYTIME) don't call them until
- * this CPU is officially up.
+ * Console drivers may assume that per-cpu resources have been allocated. So
+ * unless they're explicitly marked as being able to cope (CON_ANYTIME) don't
+ * call them until this CPU is officially up.
  */
 static inline int can_use_console(unsigned int cpu)
 {
@@ -1333,36 +1430,24 @@ static inline int can_use_console(unsigned int cpu)
  * messages from a 'printk'. Return true (and with the
  * console_lock held, and 'console_locked' set) if it
  * is successful, false otherwise.
- *
- * This gets called with the 'logbuf_lock' spinlock held and
- * interrupts disabled. It should return with 'lockbuf_lock'
- * released but interrupts still disabled.
  */
-static int console_trylock_for_printk(unsigned int cpu)
-        __releases(&logbuf_lock)
+static int console_trylock_for_printk(void)
 {
-        int retval = 0, wake = 0;
-
-        if (console_trylock()) {
-                retval = 1;
+        unsigned int cpu = smp_processor_id();
 
-                /*
-                 * If we can't use the console, we need to release
-                 * the console semaphore by hand to avoid flushing
-                 * the buffer. We need to hold the console semaphore
-                 * in order to do this test safely.
-                 */
-                if (!can_use_console(cpu)) {
-                        console_locked = 0;
-                        wake = 1;
-                        retval = 0;
-                }
+        if (!console_trylock())
+                return 0;
+        /*
+         * If we can't use the console, we need to release the console
+         * semaphore by hand to avoid flushing the buffer. We need to hold the
+         * console semaphore in order to do this test safely.
+         */
+        if (!can_use_console(cpu)) {
+                console_locked = 0;
+                up_console_sem();
+                return 0;
         }
-        logbuf_cpu = UINT_MAX;
-        raw_spin_unlock(&logbuf_lock);
-        if (wake)
-                up(&console_sem);
-        return retval;
+        return 1;
 }
 
 int printk_delay_msec __read_mostly;
@@ -1490,11 +1575,19 @@ asmlinkage int vprintk_emit(int facility, int level,
         static int recursion_bug;
         static char textbuf[LOG_LINE_MAX];
         char *text = textbuf;
-        size_t text_len;
+        size_t text_len = 0;
         enum log_flags lflags = 0;
         unsigned long flags;
         int this_cpu;
         int printed_len = 0;
+        bool in_sched = false;
+        /* cpu currently holding logbuf_lock in this function */
+        static volatile unsigned int logbuf_cpu = UINT_MAX;
+
+        if (level == SCHED_MESSAGE_LOGLEVEL) {
+                level = -1;
+                in_sched = true;
+        }
 
         boot_delay_msec(level);
         printk_delay();
@@ -1516,7 +1609,8 @@ asmlinkage int vprintk_emit(int facility, int level,
                  */
                 if (!oops_in_progress && !lockdep_recursing(current)) {
                         recursion_bug = 1;
-                        goto out_restore_irqs;
+                        local_irq_restore(flags);
+                        return 0;
                 }
                 zap_locks();
         }
@@ -1530,17 +1624,22 @@ asmlinkage int vprintk_emit(int facility, int level,
                         "BUG: recent printk recursion!";
 
                 recursion_bug = 0;
-                printed_len += strlen(recursion_msg);
+                text_len = strlen(recursion_msg);
                 /* emit KERN_CRIT message */
-                log_store(0, 2, LOG_PREFIX|LOG_NEWLINE, 0,
-                          NULL, 0, recursion_msg, printed_len);
+                printed_len += log_store(0, 2, LOG_PREFIX|LOG_NEWLINE, 0,
+                                         NULL, 0, recursion_msg, text_len);
         }
 
         /*
          * The printf needs to come first; we need the syslog
          * prefix which might be passed-in as a parameter.
          */
-        text_len = vscnprintf(text, sizeof(textbuf), fmt, args);
+        if (in_sched)
+                text_len = scnprintf(text, sizeof(textbuf),
+                                     KERN_WARNING "[sched_delayed] ");
+
+        text_len += vscnprintf(text + text_len,
+                               sizeof(textbuf) - text_len, fmt, args);
 
         /* mark and strip a trailing newline */
         if (text_len && text[text_len-1] == '\n') {
@@ -1586,9 +1685,12 @@ asmlinkage int vprintk_emit(int facility, int level,
                         cont_flush(LOG_NEWLINE);
 
                 /* buffer line if possible, otherwise store it right away */
-                if (!cont_add(facility, level, text, text_len))
-                        log_store(facility, level, lflags | LOG_CONT, 0,
-                                  dict, dictlen, text, text_len);
+                if (cont_add(facility, level, text, text_len))
+                        printed_len += text_len;
+                else
+                        printed_len += log_store(facility, level,
+                                                 lflags | LOG_CONT, 0,
+                                                 dict, dictlen, text, text_len);
         } else {
                 bool stored = false;
 
@@ -1607,26 +1709,35 @@ asmlinkage int vprintk_emit(int facility, int level,
                         cont_flush(LOG_NEWLINE);
                 }
 
-                if (!stored)
-                        log_store(facility, level, lflags, 0,
-                                  dict, dictlen, text, text_len);
+                if (stored)
+                        printed_len += text_len;
+                else
+                        printed_len += log_store(facility, level, lflags, 0,
+                                                 dict, dictlen, text, text_len);
         }
-        printed_len += text_len;
 
+        logbuf_cpu = UINT_MAX;
+        raw_spin_unlock(&logbuf_lock);
+        lockdep_on();
+        local_irq_restore(flags);
+
+        /* If called from the scheduler, we can not call up(). */
+        if (in_sched)
+                return printed_len;
+
+        /*
+         * Disable preemption to avoid being preempted while holding
+         * console_sem which would prevent anyone from printing to console
+         */
+        preempt_disable();
         /*
          * Try to acquire and then immediately release the console semaphore.
          * The release will print out buffers and wake up /dev/kmsg and syslog()
          * users.
-         *
-         * The console_trylock_for_printk() function will release 'logbuf_lock'
-         * regardless of whether it actually gets the console semaphore or not.
          */
-        if (console_trylock_for_printk(this_cpu))
+        if (console_trylock_for_printk())
                 console_unlock();
-
-        lockdep_on();
-out_restore_irqs:
-        local_irq_restore(flags);
+        preempt_enable();
 
         return printed_len;
 }
@@ -1882,16 +1993,14 @@ void suspend_console(void)
         printk("Suspending console(s) (use no_console_suspend to debug)\n");
         console_lock();
         console_suspended = 1;
-        up(&console_sem);
-        mutex_release(&console_lock_dep_map, 1, _RET_IP_);
+        up_console_sem();
 }
 
 void resume_console(void)
 {
         if (!console_suspend_enabled)
                 return;
-        down(&console_sem);
-        mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);
+        down_console_sem();
         console_suspended = 0;
         console_unlock();
 }
@@ -1933,12 +2042,11 @@ void console_lock(void)
 {
         might_sleep();
 
-        down(&console_sem);
+        down_console_sem();
         if (console_suspended)
                 return;
         console_locked = 1;
         console_may_schedule = 1;
-        mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);
 }
 EXPORT_SYMBOL(console_lock);
 
@@ -1952,15 +2060,14 @@ EXPORT_SYMBOL(console_lock);
  */
 int console_trylock(void)
 {
-        if (down_trylock(&console_sem))
+        if (down_trylock_console_sem())
                 return 0;
         if (console_suspended) {
-                up(&console_sem);
+                up_console_sem();
                 return 0;
         }
         console_locked = 1;
         console_may_schedule = 0;
-        mutex_acquire(&console_lock_dep_map, 0, 1, _RET_IP_);
         return 1;
 }
 EXPORT_SYMBOL(console_trylock);
@@ -2022,7 +2129,7 @@ void console_unlock(void)
         bool retry;
 
         if (console_suspended) {
-                up(&console_sem);
+                up_console_sem();
                 return;
         }
 
@@ -2043,10 +2150,15 @@ again:
                 }
 
                 if (console_seq < log_first_seq) {
+                        len = sprintf(text, "** %u printk messages dropped ** ",
+                                      (unsigned)(log_first_seq - console_seq));
+
                         /* messages are gone, move to first one */
                         console_seq = log_first_seq;
                         console_idx = log_first_idx;
                         console_prev = 0;
+                } else {
+                        len = 0;
                 }
 skip:
                 if (console_seq == log_next_seq)
@@ -2071,8 +2183,8 @@ skip:
                 }
 
                 level = msg->level;
-                len = msg_print_text(msg, console_prev, false,
-                                     text, sizeof(text));
+                len += msg_print_text(msg, console_prev, false,
+                                      text + len, sizeof(text) - len);
                 console_idx = log_next(console_idx);
                 console_seq++;
                 console_prev = msg->flags;
@@ -2084,7 +2196,6 @@ skip:
                 local_irq_restore(flags);
         }
         console_locked = 0;
-        mutex_release(&console_lock_dep_map, 1, _RET_IP_);
 
         /* Release the exclusive_console once it is used */
         if (unlikely(exclusive_console))
@@ -2092,7 +2203,7 @@ skip:
 
         raw_spin_unlock(&logbuf_lock);
 
-        up(&console_sem);
+        up_console_sem();
 
         /*
          * Someone could have filled up the buffer again, so re-check if there's
@@ -2137,7 +2248,7 @@ void console_unblank(void)
          * oops_in_progress is set to 1..
          */
         if (oops_in_progress) {
-                if (down_trylock(&console_sem) != 0)
+                if (down_trylock_console_sem() != 0)
                         return;
         } else
                 console_lock();
@@ -2438,21 +2549,19 @@ late_initcall(printk_late_init);
 /*
  * Delayed printk version, for scheduler-internal messages:
  */
-#define PRINTK_BUF_SIZE         512
-
 #define PRINTK_PENDING_WAKEUP   0x01
-#define PRINTK_PENDING_SCHED    0x02
+#define PRINTK_PENDING_OUTPUT   0x02
 
 static DEFINE_PER_CPU(int, printk_pending);
-static DEFINE_PER_CPU(char [PRINTK_BUF_SIZE], printk_sched_buf);
 
 static void wake_up_klogd_work_func(struct irq_work *irq_work)
 {
         int pending = __this_cpu_xchg(printk_pending, 0);
 
-        if (pending & PRINTK_PENDING_SCHED) {
-                char *buf = __get_cpu_var(printk_sched_buf);
-                pr_warn("[sched_delayed] %s", buf);
+        if (pending & PRINTK_PENDING_OUTPUT) {
+                /* If trylock fails, someone else is doing the printing */
+                if (console_trylock())
+                        console_unlock();
         }
 
         if (pending & PRINTK_PENDING_WAKEUP)
@@ -2474,23 +2583,19 @@ void wake_up_klogd(void)
         preempt_enable();
 }
 
-int printk_sched(const char *fmt, ...)
+int printk_deferred(const char *fmt, ...)
 {
-        unsigned long flags;
         va_list args;
-        char *buf;
         int r;
 
-        local_irq_save(flags);
-        buf = __get_cpu_var(printk_sched_buf);
-
+        preempt_disable();
         va_start(args, fmt);
-        r = vsnprintf(buf, PRINTK_BUF_SIZE, fmt, args);
+        r = vprintk_emit(0, SCHED_MESSAGE_LOGLEVEL, NULL, 0, fmt, args);
         va_end(args);
 
-        __this_cpu_or(printk_pending, PRINTK_PENDING_SCHED);
+        __this_cpu_or(printk_pending, PRINTK_PENDING_OUTPUT);
         irq_work_queue(&__get_cpu_var(wake_up_klogd_work));
-        local_irq_restore(flags);
+        preempt_enable();
 
         return r;
 }
diff --git a/kernel/reboot.c b/kernel/reboot.c
index 662c83fc16b7..a3a9e240fcdb 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -388,15 +388,22 @@ static int __init reboot_setup(char *str)
                         break;
 
                 case 's':
-                        if (isdigit(*(str+1)))
-                                reboot_cpu = simple_strtoul(str+1, NULL, 0);
-                        else if (str[1] == 'm' && str[2] == 'p' &&
-                                                        isdigit(*(str+3)))
-                                reboot_cpu = simple_strtoul(str+3, NULL, 0);
-                        else
+                {
+                        int rc;
+
+                        if (isdigit(*(str+1))) {
+                                rc = kstrtoint(str+1, 0, &reboot_cpu);
+                                if (rc)
+                                        return rc;
+                        } else if (str[1] == 'm' && str[2] == 'p' &&
+                                   isdigit(*(str+3))) {
+                                rc = kstrtoint(str+3, 0, &reboot_cpu);
+                                if (rc)
+                                        return rc;
+                        } else
                                 reboot_mode = REBOOT_SOFT;
                         break;
-
+                }
                 case 'g':
                         reboot_mode = REBOOT_GPIO;
                         break;
diff --git a/kernel/res_counter.c b/kernel/res_counter.c
index 51dbac6a3633..e791130f85a7 100644
--- a/kernel/res_counter.c
+++ b/kernel/res_counter.c
@@ -186,8 +186,11 @@ int res_counter_memparse_write_strategy(const char *buf,
 
         /* return RES_COUNTER_MAX(unlimited) if "-1" is specified */
         if (*buf == '-') {
-                res = simple_strtoull(buf + 1, &end, 10);
-                if (res != 1 || *end != '\0')
+                int rc = kstrtoull(buf + 1, 10, &res);
+
+                if (rc)
+                        return rc;
+                if (res != 1)
                         return -EINVAL;
                 *resp = RES_COUNTER_MAX;
                 return 0;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 913c6d6cc2c1..caf03e89a068 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1367,7 +1367,7 @@ out:
                  * leave kernel.
                  */
                 if (p->mm && printk_ratelimit()) {
-                        printk_sched("process %d (%s) no longer affine to cpu%d\n",
+                        printk_deferred("process %d (%s) no longer affine to cpu%d\n",
                                         task_pid_nr(p), p->comm, cpu);
                 }
         }
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index f9ca7d19781a..e1574fca03b5 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -348,12 +348,7 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
          * entity.
          */
         if (dl_time_before(dl_se->deadline, rq_clock(rq))) {
-                static bool lag_once = false;
-
-                if (!lag_once) {
-                        lag_once = true;
-                        printk_sched("sched: DL replenish lagged to much\n");
-                }
+                printk_deferred_once("sched: DL replenish lagged to much\n");
                 dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
                 dl_se->runtime = pi_se->dl_runtime;
         }
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 0ebfd7a29472..b3512f1afce9 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -890,14 +890,8 @@ static int sched_rt_runtime_exceeded(struct rt_rq *rt_rq)
                  * but accrue some time due to boosting.
                  */
                 if (likely(rt_b->rt_runtime)) {
-                        static bool once = false;
-
                         rt_rq->rt_throttled = 1;
-
-                        if (!once) {
-                                once = true;
-                                printk_sched("sched: RT throttling activated\n");
-                        }
+                        printk_deferred_once("sched: RT throttling activated\n");
                 } else {
                         /*
                          * In case we did anyway, make it go away,
diff --git a/kernel/signal.c b/kernel/signal.c
index 6ea13c09ae56..6e600aaa2af4 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3496,7 +3496,7 @@ COMPAT_SYSCALL_DEFINE3(sigaction, int, sig,
 }
 #endif
 
-#ifdef __ARCH_WANT_SYS_SGETMASK
+#ifdef CONFIG_SGETMASK_SYSCALL
 
 /*
  * For backwards compatibility.  Functionality superseded by sigprocmask.
@@ -3517,7 +3517,7 @@ SYSCALL_DEFINE1(ssetmask, int, newmask)
 
         return old;
 }
-#endif /* __ARCH_WANT_SGETMASK */
+#endif /* CONFIG_SGETMASK_SYSCALL */
 
 #ifdef __ARCH_WANT_SYS_SIGNAL
 /*
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 01fbae5b97b7..695f0c6cd169 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -307,6 +307,7 @@ int stop_two_cpus(unsigned int cpu1, unsigned int cpu2, cpu_stop_fn_t fn, void *
  * @cpu: cpu to stop
  * @fn: function to execute
  * @arg: argument to @fn
+ * @work_buf: pointer to cpu_stop_work structure
  *
  * Similar to stop_one_cpu() but doesn't wait for completion.  The
  * caller is responsible for ensuring @work_buf is currently unused
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index bc8d1b74a6b9..36441b51b5df 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -135,6 +135,8 @@ cond_syscall(sys_setresgid16);
 cond_syscall(sys_setresuid16);
 cond_syscall(sys_setreuid16);
 cond_syscall(sys_setuid16);
+cond_syscall(sys_sgetmask);
+cond_syscall(sys_ssetmask);
 cond_syscall(sys_vm86old);
 cond_syscall(sys_vm86);
 cond_syscall(sys_ipc);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index c8780cdaf852..33db43a39515 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -786,8 +786,9 @@ static long hardpps_update_freq(struct pps_normtime freq_norm)
                 time_status |= STA_PPSERROR;
                 pps_errcnt++;
                 pps_dec_freq_interval();
-                pr_err("hardpps: PPSERROR: interval too long - %ld s\n",
-                                freq_norm.sec);
+                printk_deferred(KERN_ERR
+                        "hardpps: PPSERROR: interval too long - %ld s\n",
+                        freq_norm.sec);
                 return 0;
         }
 
@@ -800,7 +801,8 @@ static long hardpps_update_freq(struct pps_normtime freq_norm)
         delta = shift_right(ftemp - pps_freq, NTP_SCALE_SHIFT);
         pps_freq = ftemp;
         if (delta > PPS_MAXWANDER || delta < -PPS_MAXWANDER) {
-                pr_warning("hardpps: PPSWANDER: change=%ld\n", delta);
+                printk_deferred(KERN_WARNING
+                                "hardpps: PPSWANDER: change=%ld\n", delta);
                 time_status |= STA_PPSWANDER;
                 pps_stbcnt++;
                 pps_dec_freq_interval();
@@ -844,8 +846,9 @@ static void hardpps_update_phase(long error)
          * the time offset is updated.
          */
         if (jitter > (pps_jitter << PPS_POPCORN)) {
-                pr_warning("hardpps: PPSJITTER: jitter=%ld, limit=%ld\n",
-                       jitter, (pps_jitter << PPS_POPCORN));
+                printk_deferred(KERN_WARNING
+                                "hardpps: PPSJITTER: jitter=%ld, limit=%ld\n",
+                                jitter, (pps_jitter << PPS_POPCORN));
                 time_status |= STA_PPSJITTER;
                 pps_jitcnt++;
         } else if (time_status & STA_PPSTIME) {
@@ -902,7 +905,7 @@ void __hardpps(const struct timespec *phase_ts, const struct timespec *raw_ts)
                 time_status |= STA_PPSJITTER;
                 /* restart the frequency calibration interval */
                 pps_fbase = *raw_ts;
-                pr_err("hardpps: PPSJITTER: bad pulse\n");
+                printk_deferred(KERN_ERR "hardpps: PPSJITTER: bad pulse\n");
                 return;
         }
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index f7df8ea21707..32d8d6aaedb8 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -852,8 +852,9 @@ static void __timekeeping_inject_sleeptime(struct timekeeper *tk,
                                                         struct timespec *delta)
 {
         if (!timespec_valid_strict(delta)) {
-                printk(KERN_WARNING "__timekeeping_inject_sleeptime: Invalid "
-                                        "sleep delta value!\n");
+                printk_deferred(KERN_WARNING
+                                "__timekeeping_inject_sleeptime: Invalid "
+                                "sleep delta value!\n");
                 return;
         }
         tk_xtime_add(tk, delta);
@@ -1157,7 +1158,7 @@ static void timekeeping_adjust(struct timekeeper *tk, s64 offset)
 
         if (unlikely(tk->clock->maxadj &&
                 (tk->mult + adj > tk->clock->mult + tk->clock->maxadj))) {
-                printk_once(KERN_WARNING
+                printk_deferred_once(KERN_WARNING
                         "Adjusting %s more than 11%% (%ld vs %ld)\n",
                         tk->clock->name, (long)tk->mult + adj,
                         (long)tk->clock->mult + tk->clock->maxadj);
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 6620e5837ce2..33cbd8c203f8 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -239,6 +239,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
  * tracepoint_probe_register -  Connect a probe to a tracepoint
  * @tp: tracepoint
  * @probe: probe handler
+ * @data: tracepoint data
  *
  * Returns 0 if ok, error value on error.
  * Note: if @tp is within a module, the caller is responsible for
@@ -264,6 +265,7 @@ EXPORT_SYMBOL_GPL(tracepoint_probe_register);
  * tracepoint_probe_unregister -  Disconnect a probe from a tracepoint
  * @tp: tracepoint
  * @probe: probe function pointer
+ * @data: tracepoint data
  *
  * Returns 0 if ok, error value on error.
  */
diff --git a/kernel/user.c b/kernel/user.c
index 294fc6a94168..4efa39350e44 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -87,7 +87,6 @@ static DEFINE_SPINLOCK(uidhash_lock);
 struct user_struct root_user = {
         .__count        = ATOMIC_INIT(1),
         .processes      = ATOMIC_INIT(1),
-        .files          = ATOMIC_INIT(0),
         .sigpending     = ATOMIC_INIT(0),
         .locked_shm     = 0,
         .uid            = GLOBAL_ROOT_UID,
diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
index 4f69f9a5e221..6fbe811c7ad1 100644
--- a/kernel/utsname_sysctl.c
+++ b/kernel/utsname_sysctl.c
@@ -51,7 +51,7 @@ static int proc_do_uts_string(ctl_table *table, int write,
         int r;
         memcpy(&uts_table, table, sizeof(uts_table));
         uts_table.data = get_uts(table, write);
-        r = proc_dostring(&uts_table,write,buffer,lenp, ppos);
+        r = proc_dostring(&uts_table, write, buffer, lenp, ppos);
         put_uts(table, write, uts_table.data);
 
         if (write)
@@ -135,4 +135,4 @@ static int __init utsname_sysctl_init(void)
         return 0;
 }
 
-__initcall(utsname_sysctl_init);
+device_initcall(utsname_sysctl_init);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 99c8bfee1b00..ccca32264748 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -501,6 +501,16 @@ config DEBUG_VM
 
           If unsure, say N.
 
+config DEBUG_VM_VMACACHE
+        bool "Debug VMA caching"
+        depends on DEBUG_VM
+        help
+          Enable this to turn on VMA caching debug information. Doing so
+          can cause significant overhead, so only enable it in non-production
+          environments.
+
+          If unsure, say N.
+
 config DEBUG_VM_RB
         bool "Debug VM red-black trees"
         depends on DEBUG_VM
@@ -823,11 +833,6 @@ config DEBUG_RT_MUTEXES
          This allows rt mutex semantics violations and rt mutex related
          deadlocks (lockups) to be detected and reported automatically.
 
-config DEBUG_PI_LIST
-        bool
-        default y
-        depends on DEBUG_RT_MUTEXES
-
 config RT_MUTEX_TESTER
         bool "Built-in scriptable tester for rt-mutexes"
         depends on DEBUG_KERNEL && RT_MUTEXES
@@ -1053,6 +1058,16 @@ config DEBUG_LIST
 
           If unsure, say N.
 
+config DEBUG_PI_LIST
+        bool "Debug priority linked list manipulation"
+        depends on DEBUG_KERNEL
+        help
+          Enable this to turn on extended checks in the priority-ordered
+          linked-list (plist) walking routines.  This checks the entire
+          list multiple times during each manipulation.
+
+          If unsure, say N.
+
 config DEBUG_SG
         bool "Debug SG table operations"
         depends on DEBUG_KERNEL
diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
index 11b9b01fda6b..1a000bb050f9 100644
--- a/lib/asn1_decoder.c
+++ b/lib/asn1_decoder.c
@@ -140,7 +140,7 @@ error:
  * @decoder: The decoder definition (produced by asn1_compiler)
  * @context: The caller's context (to be passed to the action functions)
  * @data: The encoded data
- * @datasize: The size of the encoded data
+ * @datalen: The size of the encoded data
  *
  * Decode BER/DER/CER encoded ASN.1 data according to a bytecode pattern
  * produced by asn1_compiler.  Action functions are called on marked tags to
diff --git a/lib/atomic64_test.c b/lib/atomic64_test.c
index 00bca223d1e1..0211d30d8c39 100644
--- a/lib/atomic64_test.c
+++ b/lib/atomic64_test.c
@@ -8,6 +8,9 @@
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/init.h>
 #include <linux/bug.h>
 #include <linux/kernel.h>
@@ -146,18 +149,18 @@ static __init int test_atomic64(void)
         BUG_ON(v.counter != r);
 
 #ifdef CONFIG_X86
-        printk(KERN_INFO "atomic64 test passed for %s platform %s CX8 and %s SSE\n",
+        pr_info("passed for %s platform %s CX8 and %s SSE\n",
 #ifdef CONFIG_X86_64
-               "x86-64",
+                "x86-64",
 #elif defined(CONFIG_X86_CMPXCHG64)
-               "i586+",
+                "i586+",
 #else
-               "i386+",
+                "i386+",
 #endif
                boot_cpu_has(X86_FEATURE_CX8) ? "with" : "without",
                boot_cpu_has(X86_FEATURE_XMM) ? "with" : "without");
 #else
-        printk(KERN_INFO "atomic64 test passed\n");
+        pr_info("passed\n");
 #endif
 
         return 0;
diff --git a/lib/btree.c b/lib/btree.c
index f9a484676cb6..4264871ea1a0 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -198,6 +198,7 @@ EXPORT_SYMBOL_GPL(btree_init);
 
 void btree_destroy(struct btree_head *head)
 {
+        mempool_free(head->node, head->mempool);
         mempool_destroy(head->mempool);
         head->mempool = NULL;
 }
diff --git a/lib/bug.c b/lib/bug.c
index 168603477f02..d1d7c7878900 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -37,6 +37,9 @@
 
     Jeremy Fitzhardinge <jeremy@goop.org> 2006
  */
+
+#define pr_fmt(fmt) fmt
+
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -153,15 +156,13 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
 
         if (warning) {
                 /* this is a WARN_ON rather than BUG/BUG_ON */
-                printk(KERN_WARNING "------------[ cut here ]------------\n");
+                pr_warn("------------[ cut here ]------------\n");
 
                 if (file)
-                        printk(KERN_WARNING "WARNING: at %s:%u\n",
-                               file, line);
+                        pr_warn("WARNING: at %s:%u\n", file, line);
                 else
-                        printk(KERN_WARNING "WARNING: at %p "
-                               "[verbose debug info unavailable]\n",
-                               (void *)bugaddr);
+                        pr_warn("WARNING: at %p [verbose debug info unavailable]\n",
+                                (void *)bugaddr);
 
                 print_modules();
                 show_regs(regs);
@@ -174,12 +175,10 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
         printk(KERN_DEFAULT "------------[ cut here ]------------\n");
 
         if (file)
-                printk(KERN_CRIT "kernel BUG at %s:%u!\n",
-                       file, line);
+                pr_crit("kernel BUG at %s:%u!\n", file, line);
         else
-                printk(KERN_CRIT "Kernel BUG at %p "
-                       "[verbose debug info unavailable]\n",
-                       (void *)bugaddr);
+                pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n",
+                        (void *)bugaddr);
 
         return BUG_TRAP_TYPE_BUG;
 }
diff --git a/lib/crc32.c b/lib/crc32.c
index 70f00ca5ef1e..21a7b2135af6 100644
--- a/lib/crc32.c
+++ b/lib/crc32.c
@@ -33,13 +33,13 @@
 #include "crc32defs.h"
 
 #if CRC_LE_BITS > 8
-# define tole(x) ((__force u32) __constant_cpu_to_le32(x))
+# define tole(x) ((__force u32) cpu_to_le32(x))
 #else
 # define tole(x) (x)
 #endif
 
 #if CRC_BE_BITS > 8
-# define tobe(x) ((__force u32) __constant_cpu_to_be32(x))
+# define tobe(x) ((__force u32) cpu_to_be32(x))
 #else
 # define tobe(x) (x)
 #endif
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index e0731c3db706..547f7f923dbc 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -7,6 +7,9 @@
  *
  * For licencing details see kernel-base/COPYING
  */
+
+#define pr_fmt(fmt) "ODEBUG: " fmt
+
 #include <linux/debugobjects.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
@@ -218,7 +221,7 @@ static void debug_objects_oom(void)
         unsigned long flags;
         int i;
 
-        printk(KERN_WARNING "ODEBUG: Out of memory. ODEBUG disabled\n");
+        pr_warn("Out of memory. ODEBUG disabled\n");
 
         for (i = 0; i < ODEBUG_HASH_SIZE; i++, db++) {
                 raw_spin_lock_irqsave(&db->lock, flags);
@@ -292,11 +295,9 @@ static void debug_object_is_on_stack(void *addr, int onstack)
 
         limit++;
         if (is_on_stack)
-                printk(KERN_WARNING
-                       "ODEBUG: object is on stack, but not annotated\n");
+                pr_warn("object is on stack, but not annotated\n");
         else
-                printk(KERN_WARNING
-                       "ODEBUG: object is not on stack, but annotated\n");
+                pr_warn("object is not on stack, but annotated\n");
         WARN_ON(1);
 }
 
@@ -985,7 +986,7 @@ static void __init debug_objects_selftest(void)
         if (check_results(&obj, ODEBUG_STATE_NONE, ++fixups, ++warnings))
                 goto out;
 #endif
-        printk(KERN_INFO "ODEBUG: selftest passed\n");
+        pr_info("selftest passed\n");
 
 out:
         debug_objects_fixups = oldfixups;
@@ -1060,8 +1061,8 @@ static int __init debug_objects_replace_static_objects(void)
         }
         local_irq_enable();
 
-        printk(KERN_DEBUG "ODEBUG: %d of %d active objects replaced\n", cnt,
-               obj_pool_used);
+        pr_debug("%d of %d active objects replaced\n",
+                 cnt, obj_pool_used);
         return 0;
 free:
         hlist_for_each_entry_safe(obj, tmp, &objects, node) {
@@ -1090,7 +1091,7 @@ void __init debug_objects_mem_init(void)
                 debug_objects_enabled = 0;
                 if (obj_cache)
                         kmem_cache_destroy(obj_cache);
-                printk(KERN_WARNING "ODEBUG: out of memory.\n");
+                pr_warn("out of memory.\n");
         } else
                 debug_objects_selftest();
 }
diff --git a/lib/digsig.c b/lib/digsig.c
index 8793aeda30ca..ae05ea393fc8 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -175,10 +175,11 @@ err1:
  * digsig_verify() - digital signature verification with public key
  * @keyring:    keyring to search key in
  * @sig:        digital signature
- * @sigen:      length of the signature
+ * @siglen:     length of the signature
  * @data:       data
  * @datalen:    length of the data
- * @return:     0 on success, -EINVAL otherwise
+ *
+ * Returns 0 on success, -EINVAL otherwise
  *
  * Verifies data integrity against digital signature.
  * Currently only RSA is supported.
diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
index 244f5480c898..b3131f5cf8a2 100644
--- a/lib/libcrc32c.c
+++ b/lib/libcrc32c.c
@@ -62,10 +62,7 @@ EXPORT_SYMBOL(crc32c);
 static int __init libcrc32c_mod_init(void)
 {
         tfm = crypto_alloc_shash("crc32c", 0, 0);
-        if (IS_ERR(tfm))
-                return PTR_ERR(tfm);
-
-        return 0;
+        return PTR_ERR_OR_ZERO(tfm);
 }
 
 static void __exit libcrc32c_mod_fini(void)
diff --git a/lib/nlattr.c b/lib/nlattr.c
index fc6754720ced..0c5778752aec 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -136,6 +136,7 @@ int nla_validate(const struct nlattr *head, int len, int maxtype,
 errout:
         return err;
 }
+EXPORT_SYMBOL(nla_validate);
 
 /**
  * nla_policy_len - Determin the max. length of a policy
@@ -162,6 +163,7 @@ nla_policy_len(const struct nla_policy *p, int n)
 
         return len;
 }
+EXPORT_SYMBOL(nla_policy_len);
 
 /**
  * nla_parse - Parse a stream of attributes into a tb buffer
@@ -208,6 +210,7 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
 errout:
         return err;
 }
+EXPORT_SYMBOL(nla_parse);
 
 /**
  * nla_find - Find a specific attribute in a stream of attributes
@@ -228,6 +231,7 @@ struct nlattr *nla_find(const struct nlattr *head, int len, int attrtype)
 
         return NULL;
 }
+EXPORT_SYMBOL(nla_find);
 
 /**
  * nla_strlcpy - Copy string attribute payload into a sized buffer
@@ -258,6 +262,7 @@ size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
 
         return srclen;
 }
+EXPORT_SYMBOL(nla_strlcpy);
 
 /**
  * nla_memcpy - Copy a netlink attribute into another memory area
@@ -278,6 +283,7 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
 
         return minlen;
 }
+EXPORT_SYMBOL(nla_memcpy);
 
 /**
  * nla_memcmp - Compare an attribute with sized memory area
@@ -295,6 +301,7 @@ int nla_memcmp(const struct nlattr *nla, const void *data,
 
         return d;
 }
+EXPORT_SYMBOL(nla_memcmp);
 
 /**
  * nla_strcmp - Compare a string attribute against a string
@@ -317,6 +324,7 @@ int nla_strcmp(const struct nlattr *nla, const char *str)
 
         return d;
 }
+EXPORT_SYMBOL(nla_strcmp);
 
 #ifdef CONFIG_NET
 /**
@@ -502,12 +510,3 @@ int nla_append(struct sk_buff *skb, int attrlen, const void *data)
 }
 EXPORT_SYMBOL(nla_append);
 #endif
-
-EXPORT_SYMBOL(nla_validate);
-EXPORT_SYMBOL(nla_policy_len);
-EXPORT_SYMBOL(nla_parse);
-EXPORT_SYMBOL(nla_find);
-EXPORT_SYMBOL(nla_strlcpy);
-EXPORT_SYMBOL(nla_memcpy);
-EXPORT_SYMBOL(nla_memcmp);
-EXPORT_SYMBOL(nla_strcmp);
diff --git a/lib/plist.c b/lib/plist.c
index 1ebc95f7a46f..d408e774b746 100644
--- a/lib/plist.c
+++ b/lib/plist.c
@@ -134,6 +134,46 @@ void plist_del(struct plist_node *node, struct plist_head *head)
         plist_check_head(head);
 }
 
+/**
+ * plist_requeue - Requeue @node at end of same-prio entries.
+ *
+ * This is essentially an optimized plist_del() followed by
+ * plist_add().  It moves an entry already in the plist to
+ * after any other same-priority entries.
+ *
+ * @node:       &struct plist_node pointer - entry to be moved
+ * @head:       &struct plist_head pointer - list head
+ */
+void plist_requeue(struct plist_node *node, struct plist_head *head)
+{
+        struct plist_node *iter;
+        struct list_head *node_next = &head->node_list;
+
+        plist_check_head(head);
+        BUG_ON(plist_head_empty(head));
+        BUG_ON(plist_node_empty(node));
+
+        if (node == plist_last(head))
+                return;
+
+        iter = plist_next(node);
+
+        if (node->prio != iter->prio)
+                return;
+
+        plist_del(node, head);
+
+        plist_for_each_continue(iter, head) {
+                if (node->prio != iter->prio) {
+                        node_next = &iter->node_list;
+                        break;
+                }
+        }
+        list_add_tail(&node->node_list, node_next);
+
+        plist_check_head(head);
+}
+
 #ifdef CONFIG_DEBUG_PI_LIST
 #include <linux/sched.h>
 #include <linux/module.h>
@@ -170,12 +210,20 @@ static void __init plist_test_check(int nr_expect)
         BUG_ON(prio_pos->prio_list.next != &first->prio_list);
 }
 
+static void __init plist_test_requeue(struct plist_node *node)
+{
+        plist_requeue(node, &test_head);
+
+        if (node != plist_last(&test_head))
+                BUG_ON(node->prio == plist_next(node)->prio);
+}
+
 static int  __init plist_test(void)
 {
         int nr_expect = 0, i, loop;
         unsigned int r = local_clock();
 
-        pr_debug("start plist test\n");
+        printk(KERN_DEBUG "start plist test\n");
         plist_head_init(&test_head);
         for (i = 0; i < ARRAY_SIZE(test_node); i++)
                 plist_node_init(test_node + i, 0);
@@ -193,6 +241,10 @@ static int  __init plist_test(void)
                         nr_expect--;
                 }
                 plist_test_check(nr_expect);
+                if (!plist_node_empty(test_node + i)) {
+                        plist_test_requeue(test_node + i);
+                        plist_test_check(nr_expect);
+                }
         }
 
         for (i = 0; i < ARRAY_SIZE(test_node); i++) {
@@ -203,7 +255,7 @@ static int  __init plist_test(void)
                 plist_test_check(nr_expect);
         }
 
-        pr_debug("end plist test\n");
+        printk(KERN_DEBUG "end plist test\n");
         return 0;
 }
 
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 9599aa72d7a0..d64815651e90 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -194,7 +194,7 @@ radix_tree_node_alloc(struct radix_tree_root *root)
                  * succeed in getting a node here (and never reach
                  * kmem_cache_alloc)
                  */
-                rtp = &__get_cpu_var(radix_tree_preloads);
+                rtp = this_cpu_ptr(&radix_tree_preloads);
                 if (rtp->nr) {
                         ret = rtp->nodes[rtp->nr - 1];
                         rtp->nodes[rtp->nr - 1] = NULL;
@@ -250,14 +250,14 @@ static int __radix_tree_preload(gfp_t gfp_mask)
         int ret = -ENOMEM;
 
         preempt_disable();
-        rtp = &__get_cpu_var(radix_tree_preloads);
+        rtp = this_cpu_ptr(&radix_tree_preloads);
         while (rtp->nr < ARRAY_SIZE(rtp->nodes)) {
                 preempt_enable();
                 node = kmem_cache_alloc(radix_tree_node_cachep, gfp_mask);
                 if (node == NULL)
                         goto out;
                 preempt_disable();
-                rtp = &__get_cpu_var(radix_tree_preloads);
+                rtp = this_cpu_ptr(&radix_tree_preloads);
                 if (rtp->nr < ARRAY_SIZE(rtp->nodes))
                         rtp->nodes[rtp->nr++] = node;
                 else
@@ -1296,7 +1296,6 @@ static inline void radix_tree_shrink(struct radix_tree_root *root)
 /**
  *      __radix_tree_delete_node    -    try to free node after clearing a slot
  *      @root:          radix tree root
- *      @index:         index key
  *      @node:          node containing @index
  *
  *      After clearing the slot at @index in @node from radix tree
diff --git a/lib/string.c b/lib/string.c
index e0c20eb362f0..992bf30af759 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -107,7 +107,7 @@ EXPORT_SYMBOL(strcpy);
 
 #ifndef __HAVE_ARCH_STRNCPY
 /**
- * strncpy - Copy a length-limited, %NUL-terminated string
+ * strncpy - Copy a length-limited, C-string
  * @dest: Where to copy the string to
  * @src: Where to copy the string from
  * @count: The maximum number of bytes to copy
@@ -136,7 +136,7 @@ EXPORT_SYMBOL(strncpy);
 
 #ifndef __HAVE_ARCH_STRLCPY
 /**
- * strlcpy - Copy a %NUL terminated string into a sized buffer
+ * strlcpy - Copy a C-string into a sized buffer
  * @dest: Where to copy the string to
  * @src: Where to copy the string from
  * @size: size of destination buffer
@@ -182,7 +182,7 @@ EXPORT_SYMBOL(strcat);
 
 #ifndef __HAVE_ARCH_STRNCAT
 /**
- * strncat - Append a length-limited, %NUL-terminated string to another
+ * strncat - Append a length-limited, C-string to another
  * @dest: The string to be appended to
  * @src: The string to append to it
  * @count: The maximum numbers of bytes to copy
@@ -211,7 +211,7 @@ EXPORT_SYMBOL(strncat);
 
 #ifndef __HAVE_ARCH_STRLCAT
 /**
- * strlcat - Append a length-limited, %NUL-terminated string to another
+ * strlcat - Append a length-limited, C-string to another
  * @dest: The string to be appended to
  * @src: The string to append to it
  * @count: The size of the destination buffer.
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index b604b831f4d1..649d097853a1 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -374,7 +374,7 @@ void __init swiotlb_free(void)
         io_tlb_nslabs = 0;
 }
 
-static int is_swiotlb_buffer(phys_addr_t paddr)
+int is_swiotlb_buffer(phys_addr_t paddr)
 {
         return paddr >= io_tlb_start && paddr < io_tlb_end;
 }
diff --git a/lib/textsearch.c b/lib/textsearch.c
index e0cc0146ae62..0c7e9ab2d88f 100644
--- a/lib/textsearch.c
+++ b/lib/textsearch.c
@@ -159,6 +159,7 @@ errout:
         spin_unlock(&ts_mod_lock);
         return err;
 }
+EXPORT_SYMBOL(textsearch_register);
 
 /**
  * textsearch_unregister - unregister a textsearch module
@@ -190,6 +191,7 @@ out:
         spin_unlock(&ts_mod_lock);
         return err;
 }
+EXPORT_SYMBOL(textsearch_unregister);
 
 struct ts_linear_state
 {
@@ -236,6 +238,7 @@ unsigned int textsearch_find_continuous(struct ts_config *conf,
 
         return textsearch_find(conf, state);
 }
+EXPORT_SYMBOL(textsearch_find_continuous);
 
 /**
  * textsearch_prepare - Prepare a search
@@ -298,6 +301,7 @@ errout:
                 
         return ERR_PTR(err);
 }
+EXPORT_SYMBOL(textsearch_prepare);
 
 /**
  * textsearch_destroy - destroy a search configuration
@@ -316,9 +320,4 @@ void textsearch_destroy(struct ts_config *conf)
 
         kfree(conf);
 }
-
-EXPORT_SYMBOL(textsearch_register);
-EXPORT_SYMBOL(textsearch_unregister);
-EXPORT_SYMBOL(textsearch_prepare);
-EXPORT_SYMBOL(textsearch_find_continuous);
 EXPORT_SYMBOL(textsearch_destroy);
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 0648291cdafe..6fe2c84eb055 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2347,7 +2347,7 @@ int vsscanf(const char *buf, const char *fmt, va_list args)
                         break;
 
                 base = 10;
-                is_sign = 0;
+                is_sign = false;
 
                 switch (*fmt++) {
                 case 'c':
@@ -2386,7 +2386,7 @@ int vsscanf(const char *buf, const char *fmt, va_list args)
                 case 'i':
                         base = 0;
                 case 'd':
-                        is_sign = 1;
+                        is_sign = true;
                 case 'u':
                         break;
                 case '%':
diff --git a/lib/xz/Kconfig b/lib/xz/Kconfig
index 08837db52d94..12d2d777f36b 100644
--- a/lib/xz/Kconfig
+++ b/lib/xz/Kconfig
@@ -9,33 +9,33 @@ config XZ_DEC
 if XZ_DEC
 
 config XZ_DEC_X86
-        bool "x86 BCJ filter decoder"
-        default y if X86
+        bool "x86 BCJ filter decoder" if EXPERT
+        default y
         select XZ_DEC_BCJ
 
 config XZ_DEC_POWERPC
-        bool "PowerPC BCJ filter decoder"
-        default y if PPC
+        bool "PowerPC BCJ filter decoder" if EXPERT
+        default y
         select XZ_DEC_BCJ
 
 config XZ_DEC_IA64
-        bool "IA-64 BCJ filter decoder"
-        default y if IA64
+        bool "IA-64 BCJ filter decoder" if EXPERT
+        default y
         select XZ_DEC_BCJ
 
 config XZ_DEC_ARM
-        bool "ARM BCJ filter decoder"
-        default y if ARM
+        bool "ARM BCJ filter decoder" if EXPERT
+        default y
         select XZ_DEC_BCJ
 
 config XZ_DEC_ARMTHUMB
-        bool "ARM-Thumb BCJ filter decoder"
-        default y if (ARM && ARM_THUMB)
+        bool "ARM-Thumb BCJ filter decoder" if EXPERT
+        default y
         select XZ_DEC_BCJ
 
 config XZ_DEC_SPARC
-        bool "SPARC BCJ filter decoder"
-        default y if SPARC
+        bool "SPARC BCJ filter decoder" if EXPERT
+        default y
         select XZ_DEC_BCJ
 
 endif
diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
index a6cdc969ea42..08c3c8049998 100644
--- a/lib/xz/xz_dec_lzma2.c
+++ b/lib/xz/xz_dec_lzma2.c
@@ -1043,6 +1043,8 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
 
                         s->lzma2.sequence = SEQ_LZMA_PREPARE;
 
+                /* Fall through */
+
                 case SEQ_LZMA_PREPARE:
                         if (s->lzma2.compressed < RC_INIT_BYTES)
                                 return XZ_DATA_ERROR;
@@ -1053,6 +1055,8 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
                         s->lzma2.compressed -= RC_INIT_BYTES;
                         s->lzma2.sequence = SEQ_LZMA_RUN;
 
+                /* Fall through */
+
                 case SEQ_LZMA_RUN:
                         /*
                          * Set dictionary limit to indicate how much we want
diff --git a/mm/Kconfig b/mm/Kconfig
index 28cec518f4d4..3e9977a9d657 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -267,6 +267,9 @@ config MIGRATION
           pages as migration can relocate pages to satisfy a huge page
           allocation instead of reclaiming.
 
+config ARCH_ENABLE_HUGEPAGE_MIGRATION
+        boolean
+
 config PHYS_ADDR_T_64BIT
         def_bool 64BIT || ARCH_PHYS_ADDR_T_64BIT
 
@@ -433,16 +436,6 @@ choice
           benefit.
 endchoice
 
-config CROSS_MEMORY_ATTACH
-        bool "Cross Memory Support"
-        depends on MMU
-        default y
-        help
-          Enabling this option adds the system calls process_vm_readv and
-          process_vm_writev which allow a process with the correct privileges
-          to directly read from or write to to another process's address space.
-          See the man page for more details.
-
 #
 # UP and nommu archs use km based percpu allocator
 #
@@ -558,7 +551,7 @@ config MEM_SOFT_DIRTY
           See Documentation/vm/soft-dirty.txt for more details.
 
 config ZSMALLOC
-        bool "Memory allocator for compressed pages"
+        tristate "Memory allocator for compressed pages"
         depends on MMU
         default n
         help
diff --git a/mm/Makefile b/mm/Makefile
index 0173940407f6..4064f3ec145e 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -3,7 +3,7 @@
 #
 
 mmu-y                   := nommu.o
-mmu-$(CONFIG_MMU)       := fremap.o highmem.o madvise.o memory.o mincore.o \
+mmu-$(CONFIG_MMU)       := fremap.o gup.o highmem.o madvise.o memory.o mincore.o \
                            mlock.o mmap.o mprotect.o mremap.o msync.o rmap.o \
                            vmalloc.o pagewalk.o pgtable-generic.o
 
diff --git a/mm/compaction.c b/mm/compaction.c
index 627dc2e4320f..21bf292b642a 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -89,7 +89,8 @@ static void __reset_isolation_suitable(struct zone *zone)
         unsigned long end_pfn = zone_end_pfn(zone);
         unsigned long pfn;
 
-        zone->compact_cached_migrate_pfn = start_pfn;
+        zone->compact_cached_migrate_pfn[0] = start_pfn;
+        zone->compact_cached_migrate_pfn[1] = start_pfn;
         zone->compact_cached_free_pfn = end_pfn;
         zone->compact_blockskip_flush = false;
 
@@ -131,9 +132,10 @@ void reset_isolation_suitable(pg_data_t *pgdat)
  */
 static void update_pageblock_skip(struct compact_control *cc,
                         struct page *page, unsigned long nr_isolated,
-                        bool migrate_scanner)
+                        bool set_unsuitable, bool migrate_scanner)
 {
         struct zone *zone = cc->zone;
+        unsigned long pfn;
 
         if (cc->ignore_skip_hint)
                 return;
@@ -141,20 +143,32 @@ static void update_pageblock_skip(struct compact_control *cc,
         if (!page)
                 return;
 
-        if (!nr_isolated) {
-                unsigned long pfn = page_to_pfn(page);
+        if (nr_isolated)
+                return;
+
+        /*
+         * Only skip pageblocks when all forms of compaction will be known to
+         * fail in the near future.
+         */
+        if (set_unsuitable)
                 set_pageblock_skip(page);
 
-                /* Update where compaction should restart */
-                if (migrate_scanner) {
-                        if (!cc->finished_update_migrate &&
-                            pfn > zone->compact_cached_migrate_pfn)
-                                zone->compact_cached_migrate_pfn = pfn;
-                } else {
-                        if (!cc->finished_update_free &&
-                            pfn < zone->compact_cached_free_pfn)
-                                zone->compact_cached_free_pfn = pfn;
-                }
+        pfn = page_to_pfn(page);
+
+        /* Update where async and sync compaction should restart */
+        if (migrate_scanner) {
+                if (cc->finished_update_migrate)
+                        return;
+                if (pfn > zone->compact_cached_migrate_pfn[0])
+                        zone->compact_cached_migrate_pfn[0] = pfn;
+                if (cc->mode != MIGRATE_ASYNC &&
+                    pfn > zone->compact_cached_migrate_pfn[1])
+                        zone->compact_cached_migrate_pfn[1] = pfn;
+        } else {
+                if (cc->finished_update_free)
+                        return;
+                if (pfn < zone->compact_cached_free_pfn)
+                        zone->compact_cached_free_pfn = pfn;
         }
 }
 #else
@@ -166,7 +180,7 @@ static inline bool isolation_suitable(struct compact_control *cc,
 
 static void update_pageblock_skip(struct compact_control *cc,
                         struct page *page, unsigned long nr_isolated,
-                        bool migrate_scanner)
+                        bool set_unsuitable, bool migrate_scanner)
 {
 }
 #endif /* CONFIG_COMPACTION */
@@ -195,7 +209,7 @@ static bool compact_checklock_irqsave(spinlock_t *lock, unsigned long *flags,
                 }
 
                 /* async aborts if taking too long or contended */
-                if (!cc->sync) {
+                if (cc->mode == MIGRATE_ASYNC) {
                         cc->contended = true;
                         return false;
                 }
@@ -208,10 +222,28 @@ static bool compact_checklock_irqsave(spinlock_t *lock, unsigned long *flags,
         return true;
 }
 
-static inline bool compact_trylock_irqsave(spinlock_t *lock,
-                        unsigned long *flags, struct compact_control *cc)
+/*
+ * Aside from avoiding lock contention, compaction also periodically checks
+ * need_resched() and either schedules in sync compaction or aborts async
+ * compaction. This is similar to what compact_checklock_irqsave() does, but
+ * is used where no lock is concerned.
+ *
+ * Returns false when no scheduling was needed, or sync compaction scheduled.
+ * Returns true when async compaction should abort.
+ */
+static inline bool compact_should_abort(struct compact_control *cc)
 {
-        return compact_checklock_irqsave(lock, flags, false, cc);
+        /* async compaction aborts if contended */
+        if (need_resched()) {
+                if (cc->mode == MIGRATE_ASYNC) {
+                        cc->contended = true;
+                        return true;
+                }
+
+                cond_resched();
+        }
+
+        return false;
 }
 
 /* Returns true if the page is within a block suitable for migration to */
@@ -329,7 +361,8 @@ isolate_fail:
 
         /* Update the pageblock-skip if the whole pageblock was scanned */
         if (blockpfn == end_pfn)
-                update_pageblock_skip(cc, valid_page, total_isolated, false);
+                update_pageblock_skip(cc, valid_page, total_isolated, true,
+                                      false);
 
         count_compact_events(COMPACTFREE_SCANNED, nr_scanned);
         if (total_isolated)
@@ -464,8 +497,9 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
         unsigned long flags;
         bool locked = false;
         struct page *page = NULL, *valid_page = NULL;
-        bool skipped_async_unsuitable = false;
-        const isolate_mode_t mode = (!cc->sync ? ISOLATE_ASYNC_MIGRATE : 0) |
+        bool set_unsuitable = true;
+        const isolate_mode_t mode = (cc->mode == MIGRATE_ASYNC ?
+                                        ISOLATE_ASYNC_MIGRATE : 0) |
                                     (unevictable ? ISOLATE_UNEVICTABLE : 0);
 
         /*
@@ -475,7 +509,7 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
          */
         while (unlikely(too_many_isolated(zone))) {
                 /* async migration should just abort */
-                if (!cc->sync)
+                if (cc->mode == MIGRATE_ASYNC)
                         return 0;
 
                 congestion_wait(BLK_RW_ASYNC, HZ/10);
@@ -484,8 +518,10 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                         return 0;
         }
 
+        if (compact_should_abort(cc))
+                return 0;
+
         /* Time to isolate some pages for migration */
-        cond_resched();
         for (; low_pfn < end_pfn; low_pfn++) {
                 /* give a chance to irqs before checking need_resched() */
                 if (locked && !(low_pfn % SWAP_CLUSTER_MAX)) {
@@ -540,9 +576,9 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                          * the minimum amount of work satisfies the allocation
                          */
                         mt = get_pageblock_migratetype(page);
-                        if (!cc->sync && !migrate_async_suitable(mt)) {
-                                cc->finished_update_migrate = true;
-                                skipped_async_unsuitable = true;
+                        if (cc->mode == MIGRATE_ASYNC &&
+                            !migrate_async_suitable(mt)) {
+                                set_unsuitable = false;
                                 goto next_pageblock;
                         }
                 }
@@ -646,11 +682,10 @@ next_pageblock:
         /*
          * Update the pageblock-skip information and cached scanner pfn,
          * if the whole pageblock was scanned without isolating any page.
-         * This is not done when pageblock was skipped due to being unsuitable
-         * for async compaction, so that eventual sync compaction can try.
          */
-        if (low_pfn == end_pfn && !skipped_async_unsuitable)
-                update_pageblock_skip(cc, valid_page, nr_isolated, true);
+        if (low_pfn == end_pfn)
+                update_pageblock_skip(cc, valid_page, nr_isolated,
+                                      set_unsuitable, true);
 
         trace_mm_compaction_isolate_migratepages(nr_scanned, nr_isolated);
 
@@ -671,7 +706,9 @@ static void isolate_freepages(struct zone *zone,
                                 struct compact_control *cc)
 {
         struct page *page;
-        unsigned long high_pfn, low_pfn, pfn, z_end_pfn;
+        unsigned long block_start_pfn;  /* start of current pageblock */
+        unsigned long block_end_pfn;    /* end of current pageblock */
+        unsigned long low_pfn;       /* lowest pfn scanner is able to scan */
         int nr_freepages = cc->nr_freepages;
         struct list_head *freelist = &cc->freepages;
 
@@ -679,41 +716,38 @@ static void isolate_freepages(struct zone *zone,
          * Initialise the free scanner. The starting point is where we last
          * successfully isolated from, zone-cached value, or the end of the
          * zone when isolating for the first time. We need this aligned to
-         * the pageblock boundary, because we do pfn -= pageblock_nr_pages
-         * in the for loop.
+         * the pageblock boundary, because we do
+         * block_start_pfn -= pageblock_nr_pages in the for loop.
+         * For ending point, take care when isolating in last pageblock of a
+         * a zone which ends in the middle of a pageblock.
          * The low boundary is the end of the pageblock the migration scanner
          * is using.
          */
-        pfn = cc->free_pfn & ~(pageblock_nr_pages-1);
+        block_start_pfn = cc->free_pfn & ~(pageblock_nr_pages-1);
+        block_end_pfn = min(block_start_pfn + pageblock_nr_pages,
+                                                zone_end_pfn(zone));
         low_pfn = ALIGN(cc->migrate_pfn + 1, pageblock_nr_pages);
 
         /*
-         * Take care that if the migration scanner is at the end of the zone
-         * that the free scanner does not accidentally move to the next zone
-         * in the next isolation cycle.
-         */
-        high_pfn = min(low_pfn, pfn);
-
-        z_end_pfn = zone_end_pfn(zone);
-
-        /*
          * Isolate free pages until enough are available to migrate the
          * pages on cc->migratepages. We stop searching if the migrate
          * and free page scanners meet or enough free pages are isolated.
          */
-        for (; pfn >= low_pfn && cc->nr_migratepages > nr_freepages;
-                                        pfn -= pageblock_nr_pages) {
+        for (; block_start_pfn >= low_pfn && cc->nr_migratepages > nr_freepages;
+                                block_end_pfn = block_start_pfn,
+                                block_start_pfn -= pageblock_nr_pages) {
                 unsigned long isolated;
-                unsigned long end_pfn;
 
                 /*
                  * This can iterate a massively long zone without finding any
                  * suitable migration targets, so periodically check if we need
-                 * to schedule.
+                 * to schedule, or even abort async compaction.
                  */
-                cond_resched();
+                if (!(block_start_pfn % (SWAP_CLUSTER_MAX * pageblock_nr_pages))
+                                                && compact_should_abort(cc))
+                        break;
 
-                if (!pfn_valid(pfn))
+                if (!pfn_valid(block_start_pfn))
                         continue;
 
                 /*
@@ -723,7 +757,7 @@ static void isolate_freepages(struct zone *zone,
                  * i.e. it's possible that all pages within a zones range of
                  * pages do not belong to a single zone.
                  */
-                page = pfn_to_page(pfn);
+                page = pfn_to_page(block_start_pfn);
                 if (page_zone(page) != zone)
                         continue;
 
@@ -736,26 +770,26 @@ static void isolate_freepages(struct zone *zone,
                         continue;
 
                 /* Found a block suitable for isolating free pages from */
-                isolated = 0;
+                cc->free_pfn = block_start_pfn;
+                isolated = isolate_freepages_block(cc, block_start_pfn,
+                                        block_end_pfn, freelist, false);
+                nr_freepages += isolated;
 
                 /*
-                 * Take care when isolating in last pageblock of a zone which
-                 * ends in the middle of a pageblock.
+                 * Set a flag that we successfully isolated in this pageblock.
+                 * In the next loop iteration, zone->compact_cached_free_pfn
+                 * will not be updated and thus it will effectively contain the
+                 * highest pageblock we isolated pages from.
                  */
-                end_pfn = min(pfn + pageblock_nr_pages, z_end_pfn);
-                isolated = isolate_freepages_block(cc, pfn, end_pfn,
-                                                   freelist, false);
-                nr_freepages += isolated;
+                if (isolated)
+                        cc->finished_update_free = true;
 
                 /*
-                 * Record the highest PFN we isolated pages from. When next
-                 * looking for free pages, the search will restart here as
-                 * page migration may have returned some pages to the allocator
+                 * isolate_freepages_block() might have aborted due to async
+                 * compaction being contended
                  */
-                if (isolated) {
-                        cc->finished_update_free = true;
-                        high_pfn = max(high_pfn, pfn);
-                }
+                if (cc->contended)
+                        break;
         }
 
         /* split_free_page does not map the pages */
@@ -765,10 +799,9 @@ static void isolate_freepages(struct zone *zone,
          * If we crossed the migrate scanner, we want to keep it that way
          * so that compact_finished() may detect this
          */
-        if (pfn < low_pfn)
-                cc->free_pfn = max(pfn, zone->zone_start_pfn);
-        else
-                cc->free_pfn = high_pfn;
+        if (block_start_pfn < low_pfn)
+                cc->free_pfn = cc->migrate_pfn;
+
         cc->nr_freepages = nr_freepages;
 }
 
@@ -783,9 +816,13 @@ static struct page *compaction_alloc(struct page *migratepage,
         struct compact_control *cc = (struct compact_control *)data;
         struct page *freepage;
 
-        /* Isolate free pages if necessary */
+        /*
+         * Isolate free pages if necessary, and if we are not aborting due to
+         * contention.
+         */
         if (list_empty(&cc->freepages)) {
-                isolate_freepages(cc->zone, cc);
+                if (!cc->contended)
+                        isolate_freepages(cc->zone, cc);
 
                 if (list_empty(&cc->freepages))
                         return NULL;
@@ -799,23 +836,16 @@ static struct page *compaction_alloc(struct page *migratepage,
 }
 
 /*
- * We cannot control nr_migratepages and nr_freepages fully when migration is
- * running as migrate_pages() has no knowledge of compact_control. When
- * migration is complete, we count the number of pages on the lists by hand.
+ * This is a migrate-callback that "frees" freepages back to the isolated
+ * freelist.  All pages on the freelist are from the same zone, so there is no
+ * special handling needed for NUMA.
  */
-static void update_nr_listpages(struct compact_control *cc)
+static void compaction_free(struct page *page, unsigned long data)
 {
-        int nr_migratepages = 0;
-        int nr_freepages = 0;
-        struct page *page;
-
-        list_for_each_entry(page, &cc->migratepages, lru)
-                nr_migratepages++;
-        list_for_each_entry(page, &cc->freepages, lru)
-                nr_freepages++;
+        struct compact_control *cc = (struct compact_control *)data;
 
-        cc->nr_migratepages = nr_migratepages;
-        cc->nr_freepages = nr_freepages;
+        list_add(&page->lru, &cc->freepages);
+        cc->nr_freepages++;
 }
 
 /* possible outcome of isolate_migratepages */
@@ -862,13 +892,14 @@ static int compact_finished(struct zone *zone,
         unsigned int order;
         unsigned long watermark;
 
-        if (fatal_signal_pending(current))
+        if (cc->contended || fatal_signal_pending(current))
                 return COMPACT_PARTIAL;
 
         /* Compaction run completes if the migrate and free scanner meet */
         if (cc->free_pfn <= cc->migrate_pfn) {
                 /* Let the next compaction start anew. */
-                zone->compact_cached_migrate_pfn = zone->zone_start_pfn;
+                zone->compact_cached_migrate_pfn[0] = zone->zone_start_pfn;
+                zone->compact_cached_migrate_pfn[1] = zone->zone_start_pfn;
                 zone->compact_cached_free_pfn = zone_end_pfn(zone);
 
                 /*
@@ -968,6 +999,7 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
         int ret;
         unsigned long start_pfn = zone->zone_start_pfn;
         unsigned long end_pfn = zone_end_pfn(zone);
+        const bool sync = cc->mode != MIGRATE_ASYNC;
 
         ret = compaction_suitable(zone, cc->order);
         switch (ret) {
@@ -993,7 +1025,7 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
          * information on where the scanners should start but check that it
          * is initialised by ensuring the values are within zone boundaries.
          */
-        cc->migrate_pfn = zone->compact_cached_migrate_pfn;
+        cc->migrate_pfn = zone->compact_cached_migrate_pfn[sync];
         cc->free_pfn = zone->compact_cached_free_pfn;
         if (cc->free_pfn < start_pfn || cc->free_pfn > end_pfn) {
                 cc->free_pfn = end_pfn & ~(pageblock_nr_pages-1);
@@ -1001,7 +1033,8 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
         }
         if (cc->migrate_pfn < start_pfn || cc->migrate_pfn > end_pfn) {
                 cc->migrate_pfn = start_pfn;
-                zone->compact_cached_migrate_pfn = cc->migrate_pfn;
+                zone->compact_cached_migrate_pfn[0] = cc->migrate_pfn;
+                zone->compact_cached_migrate_pfn[1] = cc->migrate_pfn;
         }
 
         trace_mm_compaction_begin(start_pfn, cc->migrate_pfn, cc->free_pfn, end_pfn);
@@ -1009,7 +1042,6 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
         migrate_prep_local();
 
         while ((ret = compact_finished(zone, cc)) == COMPACT_CONTINUE) {
-                unsigned long nr_migrate, nr_remaining;
                 int err;
 
                 switch (isolate_migratepages(zone, cc)) {
@@ -1024,21 +1056,20 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
                         ;
                 }
 
-                nr_migrate = cc->nr_migratepages;
+                if (!cc->nr_migratepages)
+                        continue;
+
                 err = migrate_pages(&cc->migratepages, compaction_alloc,
-                                (unsigned long)cc,
-                                cc->sync ? MIGRATE_SYNC_LIGHT : MIGRATE_ASYNC,
+                                compaction_free, (unsigned long)cc, cc->mode,
                                 MR_COMPACTION);
-                update_nr_listpages(cc);
-                nr_remaining = cc->nr_migratepages;
 
-                trace_mm_compaction_migratepages(nr_migrate - nr_remaining,
-                                                nr_remaining);
+                trace_mm_compaction_migratepages(cc->nr_migratepages, err,
+                                                        &cc->migratepages);
 
-                /* Release isolated pages not migrated */
+                /* All pages were either migrated or will be released */
+                cc->nr_migratepages = 0;
                 if (err) {
                         putback_movable_pages(&cc->migratepages);
-                        cc->nr_migratepages = 0;
                         /*
                          * migrate_pages() may return -ENOMEM when scanners meet
                          * and we want compact_finished() to detect it
@@ -1060,9 +1091,8 @@ out:
         return ret;
 }
 
-static unsigned long compact_zone_order(struct zone *zone,
-                                 int order, gfp_t gfp_mask,
-                                 bool sync, bool *contended)
+static unsigned long compact_zone_order(struct zone *zone, int order,
+                gfp_t gfp_mask, enum migrate_mode mode, bool *contended)
 {
         unsigned long ret;
         struct compact_control cc = {
@@ -1071,7 +1101,7 @@ static unsigned long compact_zone_order(struct zone *zone,
                 .order = order,
                 .migratetype = allocflags_to_migratetype(gfp_mask),
                 .zone = zone,
-                .sync = sync,
+                .mode = mode,
         };
         INIT_LIST_HEAD(&cc.freepages);
         INIT_LIST_HEAD(&cc.migratepages);
@@ -1093,7 +1123,7 @@ int sysctl_extfrag_threshold = 500;
  * @order: The order of the current allocation
  * @gfp_mask: The GFP mask of the current allocation
  * @nodemask: The allowed nodes to allocate from
- * @sync: Whether migration is synchronous or not
+ * @mode: The migration mode for async, sync light, or sync migration
  * @contended: Return value that is true if compaction was aborted due to lock contention
  * @page: Optionally capture a free page of the requested order during compaction
  *
@@ -1101,7 +1131,7 @@ int sysctl_extfrag_threshold = 500;
  */
 unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        bool sync, bool *contended)
+                        enum migrate_mode mode, bool *contended)
 {
         enum zone_type high_zoneidx = gfp_zone(gfp_mask);
         int may_enter_fs = gfp_mask & __GFP_FS;
@@ -1126,7 +1156,7 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist,
                                                                 nodemask) {
                 int status;
 
-                status = compact_zone_order(zone, order, gfp_mask, sync,
+                status = compact_zone_order(zone, order, gfp_mask, mode,
                                                 contended);
                 rc = max(status, rc);
 
@@ -1165,9 +1195,6 @@ static void __compact_pgdat(pg_data_t *pgdat, struct compact_control *cc)
                         if (zone_watermark_ok(zone, cc->order,
                                                 low_wmark_pages(zone), 0, 0))
                                 compaction_defer_reset(zone, cc->order, false);
-                        /* Currently async compaction is never deferred. */
-                        else if (cc->sync)
-                                defer_compaction(zone, cc->order);
                 }
 
                 VM_BUG_ON(!list_empty(&cc->freepages));
@@ -1179,7 +1206,7 @@ void compact_pgdat(pg_data_t *pgdat, int order)
 {
         struct compact_control cc = {
                 .order = order,
-                .sync = false,
+                .mode = MIGRATE_ASYNC,
         };
 
         if (!order)
@@ -1192,7 +1219,7 @@ static void compact_node(int nid)
 {
         struct compact_control cc = {
                 .order = -1,
-                .sync = true,
+                .mode = MIGRATE_SYNC,
                 .ignore_skip_hint = true,
         };
 
diff --git a/mm/dmapool.c b/mm/dmapool.c
index 8058fcd7ae91..306baa594f95 100644
--- a/mm/dmapool.c
+++ b/mm/dmapool.c
@@ -170,24 +170,16 @@ struct dma_pool *dma_pool_create(const char *name, struct device *dev,
         retval->boundary = boundary;
         retval->allocation = allocation;
 
-        if (dev) {
-                int ret;
+        INIT_LIST_HEAD(&retval->pools);
 
-                mutex_lock(&pools_lock);
-                if (list_empty(&dev->dma_pools))
-                        ret = device_create_file(dev, &dev_attr_pools);
-                else
-                        ret = 0;
-                /* note:  not currently insisting "name" be unique */
-                if (!ret)
-                        list_add(&retval->pools, &dev->dma_pools);
-                else {
-                        kfree(retval);
-                        retval = NULL;
-                }
-                mutex_unlock(&pools_lock);
+        mutex_lock(&pools_lock);
+        if (list_empty(&dev->dma_pools) &&
+            device_create_file(dev, &dev_attr_pools)) {
+                kfree(retval);
+                return NULL;
         } else
-                INIT_LIST_HEAD(&retval->pools);
+                list_add(&retval->pools, &dev->dma_pools);
+        mutex_unlock(&pools_lock);
 
         return retval;
 }
@@ -508,7 +500,6 @@ void dmam_pool_destroy(struct dma_pool *pool)
 {
         struct device *dev = pool->dev;
 
-        WARN_ON(devres_destroy(dev, dmam_pool_release, dmam_pool_match, pool));
-        dma_pool_destroy(pool);
+        WARN_ON(devres_release(dev, dmam_pool_release, dmam_pool_match, pool));
 }
 EXPORT_SYMBOL(dmam_pool_destroy);
diff --git a/mm/filemap.c b/mm/filemap.c
index 021056c324e6..7fadf1c62838 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -753,8 +753,17 @@ EXPORT_SYMBOL(unlock_page);
  */
 void end_page_writeback(struct page *page)
 {
-        if (TestClearPageReclaim(page))
+        /*
+         * TestClearPageReclaim could be used here but it is an atomic
+         * operation and overkill in this particular case. Failing to
+         * shuffle a page marked for immediate reclaim is too mild to
+         * justify taking an atomic operation penalty at the end of
+         * ever page writeback.
+         */
+        if (PageReclaim(page)) {
+                ClearPageReclaim(page);
                 rotate_reclaimable_page(page);
+        }
 
         if (!test_clear_page_writeback(page))
                 BUG();
@@ -764,6 +773,31 @@ void end_page_writeback(struct page *page)
 }
 EXPORT_SYMBOL(end_page_writeback);
 
+/*
+ * After completing I/O on a page, call this routine to update the page
+ * flags appropriately
+ */
+void page_endio(struct page *page, int rw, int err)
+{
+        if (rw == READ) {
+                if (!err) {
+                        SetPageUptodate(page);
+                } else {
+                        ClearPageUptodate(page);
+                        SetPageError(page);
+                }
+                unlock_page(page);
+        } else { /* rw == WRITE */
+                if (err) {
+                        SetPageError(page);
+                        if (page->mapping)
+                                mapping_set_error(page->mapping, err);
+                }
+                end_page_writeback(page);
+        }
+}
+EXPORT_SYMBOL_GPL(page_endio);
+
 /**
  * __lock_page - get a lock on the page, assuming we need to sleep to get it
  * @page: the page to lock
@@ -957,26 +991,6 @@ out:
 EXPORT_SYMBOL(find_get_entry);
 
 /**
- * find_get_page - find and get a page reference
- * @mapping: the address_space to search
- * @offset: the page index
- *
- * Looks up the page cache slot at @mapping & @offset.  If there is a
- * page cache page, it is returned with an increased refcount.
- *
- * Otherwise, %NULL is returned.
- */
-struct page *find_get_page(struct address_space *mapping, pgoff_t offset)
-{
-        struct page *page = find_get_entry(mapping, offset);
-
-        if (radix_tree_exceptional_entry(page))
-                page = NULL;
-        return page;
-}
-EXPORT_SYMBOL(find_get_page);
-
-/**
  * find_lock_entry - locate, pin and lock a page cache entry
  * @mapping: the address_space to search
  * @offset: the page cache index
@@ -1013,66 +1027,84 @@ repeat:
 EXPORT_SYMBOL(find_lock_entry);
 
 /**
- * find_lock_page - locate, pin and lock a pagecache page
+ * pagecache_get_page - find and get a page reference
  * @mapping: the address_space to search
  * @offset: the page index
+ * @fgp_flags: PCG flags
+ * @gfp_mask: gfp mask to use if a page is to be allocated
  *
- * Looks up the page cache slot at @mapping & @offset.  If there is a
- * page cache page, it is returned locked and with an increased
- * refcount.
- *
- * Otherwise, %NULL is returned.
- *
- * find_lock_page() may sleep.
- */
-struct page *find_lock_page(struct address_space *mapping, pgoff_t offset)
-{
-        struct page *page = find_lock_entry(mapping, offset);
-
-        if (radix_tree_exceptional_entry(page))
-                page = NULL;
-        return page;
-}
-EXPORT_SYMBOL(find_lock_page);
-
-/**
- * find_or_create_page - locate or add a pagecache page
- * @mapping: the page's address_space
- * @index: the page's index into the mapping
- * @gfp_mask: page allocation mode
+ * Looks up the page cache slot at @mapping & @offset.
  *
- * Looks up the page cache slot at @mapping & @offset.  If there is a
- * page cache page, it is returned locked and with an increased
- * refcount.
+ * PCG flags modify how the page is returned
  *
- * If the page is not present, a new page is allocated using @gfp_mask
- * and added to the page cache and the VM's LRU list.  The page is
- * returned locked and with an increased refcount.
+ * FGP_ACCESSED: the page will be marked accessed
+ * FGP_LOCK: Page is return locked
+ * FGP_CREAT: If page is not present then a new page is allocated using
+ *              @gfp_mask and added to the page cache and the VM's LRU
+ *              list. The page is returned locked and with an increased
+ *              refcount. Otherwise, %NULL is returned.
  *
- * On memory exhaustion, %NULL is returned.
+ * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
+ * if the GFP flags specified for FGP_CREAT are atomic.
  *
- * find_or_create_page() may sleep, even if @gfp_flags specifies an
- * atomic allocation!
+ * If there is a page cache page, it is returned with an increased refcount.
  */
-struct page *find_or_create_page(struct address_space *mapping,
-                pgoff_t index, gfp_t gfp_mask)
+struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
+        int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask)
 {
         struct page *page;
-        int err;
+
 repeat:
-        page = find_lock_page(mapping, index);
-        if (!page) {
-                page = __page_cache_alloc(gfp_mask);
+        page = find_get_entry(mapping, offset);
+        if (radix_tree_exceptional_entry(page))
+                page = NULL;
+        if (!page)
+                goto no_page;
+
+        if (fgp_flags & FGP_LOCK) {
+                if (fgp_flags & FGP_NOWAIT) {
+                        if (!trylock_page(page)) {
+                                page_cache_release(page);
+                                return NULL;
+                        }
+                } else {
+                        lock_page(page);
+                }
+
+                /* Has the page been truncated? */
+                if (unlikely(page->mapping != mapping)) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto repeat;
+                }
+                VM_BUG_ON_PAGE(page->index != offset, page);
+        }
+
+        if (page && (fgp_flags & FGP_ACCESSED))
+                mark_page_accessed(page);
+
+no_page:
+        if (!page && (fgp_flags & FGP_CREAT)) {
+                int err;
+                if ((fgp_flags & FGP_WRITE) && mapping_cap_account_dirty(mapping))
+                        cache_gfp_mask |= __GFP_WRITE;
+                if (fgp_flags & FGP_NOFS) {
+                        cache_gfp_mask &= ~__GFP_FS;
+                        radix_gfp_mask &= ~__GFP_FS;
+                }
+
+                page = __page_cache_alloc(cache_gfp_mask);
                 if (!page)
                         return NULL;
-                /*
-                 * We want a regular kernel memory (not highmem or DMA etc)
-                 * allocation for the radix tree nodes, but we need to honour
-                 * the context-specific requirements the caller has asked for.
-                 * GFP_RECLAIM_MASK collects those requirements.
-                 */
-                err = add_to_page_cache_lru(page, mapping, index,
-                        (gfp_mask & GFP_RECLAIM_MASK));
+
+                if (WARN_ON_ONCE(!(fgp_flags & FGP_LOCK)))
+                        fgp_flags |= FGP_LOCK;
+
+                /* Init accessed so avoit atomic mark_page_accessed later */
+                if (fgp_flags & FGP_ACCESSED)
+                        init_page_accessed(page);
+
+                err = add_to_page_cache_lru(page, mapping, offset, radix_gfp_mask);
                 if (unlikely(err)) {
                         page_cache_release(page);
                         page = NULL;
@@ -1080,9 +1112,10 @@ repeat:
                                 goto repeat;
                 }
         }
+
         return page;
 }
-EXPORT_SYMBOL(find_or_create_page);
+EXPORT_SYMBOL(pagecache_get_page);
 
 /**
  * find_get_entries - gang pagecache lookup
@@ -1379,39 +1412,6 @@ repeat:
 }
 EXPORT_SYMBOL(find_get_pages_tag);
 
-/**
- * grab_cache_page_nowait - returns locked page at given index in given cache
- * @mapping: target address_space
- * @index: the page index
- *
- * Same as grab_cache_page(), but do not wait if the page is unavailable.
- * This is intended for speculative data generators, where the data can
- * be regenerated if the page couldn't be grabbed.  This routine should
- * be safe to call while holding the lock for another page.
- *
- * Clear __GFP_FS when allocating the page to avoid recursion into the fs
- * and deadlock against the caller's locked page.
- */
-struct page *
-grab_cache_page_nowait(struct address_space *mapping, pgoff_t index)
-{
-        struct page *page = find_get_page(mapping, index);
-
-        if (page) {
-                if (trylock_page(page))
-                        return page;
-                page_cache_release(page);
-                return NULL;
-        }
-        page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~__GFP_FS);
-        if (page && add_to_page_cache_lru(page, mapping, index, GFP_NOFS)) {
-                page_cache_release(page);
-                page = NULL;
-        }
-        return page;
-}
-EXPORT_SYMBOL(grab_cache_page_nowait);
-
 /*
  * CD/DVDs are error prone. When a medium error occurs, the driver may fail
  * a _large_ part of the i/o request. Imagine the worst scenario:
@@ -2381,7 +2381,6 @@ int pagecache_write_end(struct file *file, struct address_space *mapping,
 {
         const struct address_space_operations *aops = mapping->a_ops;
 
-        mark_page_accessed(page);
         return aops->write_end(file, mapping, pos, len, copied, page, fsdata);
 }
 EXPORT_SYMBOL(pagecache_write_end);
@@ -2463,34 +2462,18 @@ EXPORT_SYMBOL(generic_file_direct_write);
 struct page *grab_cache_page_write_begin(struct address_space *mapping,
                                         pgoff_t index, unsigned flags)
 {
-        int status;
-        gfp_t gfp_mask;
         struct page *page;
-        gfp_t gfp_notmask = 0;
+        int fgp_flags = FGP_LOCK|FGP_ACCESSED|FGP_WRITE|FGP_CREAT;
 
-        gfp_mask = mapping_gfp_mask(mapping);
-        if (mapping_cap_account_dirty(mapping))
-                gfp_mask |= __GFP_WRITE;
         if (flags & AOP_FLAG_NOFS)
-                gfp_notmask = __GFP_FS;
-repeat:
-        page = find_lock_page(mapping, index);
+                fgp_flags |= FGP_NOFS;
+
+        page = pagecache_get_page(mapping, index, fgp_flags,
+                        mapping_gfp_mask(mapping),
+                        GFP_KERNEL);
         if (page)
-                goto found;
+                wait_for_stable_page(page);
 
-        page = __page_cache_alloc(gfp_mask & ~gfp_notmask);
-        if (!page)
-                return NULL;
-        status = add_to_page_cache_lru(page, mapping, index,
-                                                GFP_KERNEL & ~gfp_notmask);
-        if (unlikely(status)) {
-                page_cache_release(page);
-                if (status == -EEXIST)
-                        goto repeat;
-                return NULL;
-        }
-found:
-        wait_for_stable_page(page);
         return page;
 }
 EXPORT_SYMBOL(grab_cache_page_write_begin);
@@ -2539,7 +2522,7 @@ again:
 
                 status = a_ops->write_begin(file, mapping, pos, bytes, flags,
                                                 &page, &fsdata);
-                if (unlikely(status))
+                if (unlikely(status < 0))
                         break;
 
                 if (mapping_writably_mapped(mapping))
@@ -2548,7 +2531,6 @@ again:
                 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
                 flush_dcache_page(page);
 
-                mark_page_accessed(page);
                 status = a_ops->write_end(file, mapping, pos, bytes, copied,
                                                 page, fsdata);
                 if (unlikely(status < 0))
diff --git a/mm/fremap.c b/mm/fremap.c
index 34feba60a17e..2c5646f11f41 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -82,13 +82,10 @@ static int install_file_pte(struct mm_struct *mm, struct vm_area_struct *vma,
 
         ptfile = pgoff_to_pte(pgoff);
 
-        if (!pte_none(*pte)) {
-                if (pte_present(*pte) && pte_soft_dirty(*pte))
-                        pte_file_mksoft_dirty(ptfile);
+        if (!pte_none(*pte))
                 zap_pte(mm, vma, addr, pte);
-        }
 
-        set_pte_at(mm, addr, pte, ptfile);
+        set_pte_at(mm, addr, pte, pte_file_mksoft_dirty(ptfile));
         /*
          * We don't need to run update_mmu_cache() here because the "file pte"
          * being installed by install_file_pte() is not a real pte - it's a
diff --git a/mm/frontswap.c b/mm/frontswap.c
index 1b24bdcb3197..c30eec536f03 100644
--- a/mm/frontswap.c
+++ b/mm/frontswap.c
@@ -327,15 +327,12 @@ EXPORT_SYMBOL(__frontswap_invalidate_area);
 
 static unsigned long __frontswap_curr_pages(void)
 {
-        int type;
         unsigned long totalpages = 0;
         struct swap_info_struct *si = NULL;
 
         assert_spin_locked(&swap_lock);
-        for (type = swap_list.head; type >= 0; type = si->next) {
-                si = swap_info[type];
+        plist_for_each_entry(si, &swap_active_head, list)
                 totalpages += atomic_read(&si->frontswap_pages);
-        }
         return totalpages;
 }
 
@@ -347,11 +344,9 @@ static int __frontswap_unuse_pages(unsigned long total, unsigned long *unused,
         int si_frontswap_pages;
         unsigned long total_pages_to_unuse = total;
         unsigned long pages = 0, pages_to_unuse = 0;
-        int type;
 
         assert_spin_locked(&swap_lock);
-        for (type = swap_list.head; type >= 0; type = si->next) {
-                si = swap_info[type];
+        plist_for_each_entry(si, &swap_active_head, list) {
                 si_frontswap_pages = atomic_read(&si->frontswap_pages);
                 if (total_pages_to_unuse < si_frontswap_pages) {
                         pages = pages_to_unuse = total_pages_to_unuse;
@@ -366,7 +361,7 @@ static int __frontswap_unuse_pages(unsigned long total, unsigned long *unused,
                 }
                 vm_unacct_memory(pages);
                 *unused = pages_to_unuse;
-                *swapid = type;
+                *swapid = si->type;
                 ret = 0;
                 break;
         }
@@ -413,7 +408,7 @@ void frontswap_shrink(unsigned long target_pages)
         /*
          * we don't want to hold swap_lock while doing a very
          * lengthy try_to_unuse, but swap_list may change
-         * so restart scan from swap_list.head each time
+         * so restart scan from swap_active_head each time
          */
         spin_lock(&swap_lock);
         ret = __frontswap_shrink(target_pages, &pages_to_unuse, &type);
diff --git a/mm/gup.c b/mm/gup.c
new file mode 100644
index 000000000000..cc5a9e7adea7
--- /dev/null
+++ b/mm/gup.c
@@ -0,0 +1,662 @@
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/spinlock.h>
+
+#include <linux/hugetlb.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/rmap.h>
+#include <linux/swap.h>
+#include <linux/swapops.h>
+
+#include "internal.h"
+
+static struct page *no_page_table(struct vm_area_struct *vma,
+                unsigned int flags)
+{
+        /*
+         * When core dumping an enormous anonymous area that nobody
+         * has touched so far, we don't want to allocate unnecessary pages or
+         * page tables.  Return error instead of NULL to skip handle_mm_fault,
+         * then get_dump_page() will return NULL to leave a hole in the dump.
+         * But we can only make this optimization where a hole would surely
+         * be zero-filled if handle_mm_fault() actually did handle it.
+         */
+        if ((flags & FOLL_DUMP) && (!vma->vm_ops || !vma->vm_ops->fault))
+                return ERR_PTR(-EFAULT);
+        return NULL;
+}
+
+static struct page *follow_page_pte(struct vm_area_struct *vma,
+                unsigned long address, pmd_t *pmd, unsigned int flags)
+{
+        struct mm_struct *mm = vma->vm_mm;
+        struct page *page;
+        spinlock_t *ptl;
+        pte_t *ptep, pte;
+
+retry:
+        if (unlikely(pmd_bad(*pmd)))
+                return no_page_table(vma, flags);
+
+        ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
+        pte = *ptep;
+        if (!pte_present(pte)) {
+                swp_entry_t entry;
+                /*
+                 * KSM's break_ksm() relies upon recognizing a ksm page
+                 * even while it is being migrated, so for that case we
+                 * need migration_entry_wait().
+                 */
+                if (likely(!(flags & FOLL_MIGRATION)))
+                        goto no_page;
+                if (pte_none(pte) || pte_file(pte))
+                        goto no_page;
+                entry = pte_to_swp_entry(pte);
+                if (!is_migration_entry(entry))
+                        goto no_page;
+                pte_unmap_unlock(ptep, ptl);
+                migration_entry_wait(mm, pmd, address);
+                goto retry;
+        }
+        if ((flags & FOLL_NUMA) && pte_numa(pte))
+                goto no_page;
+        if ((flags & FOLL_WRITE) && !pte_write(pte)) {
+                pte_unmap_unlock(ptep, ptl);
+                return NULL;
+        }
+
+        page = vm_normal_page(vma, address, pte);
+        if (unlikely(!page)) {
+                if ((flags & FOLL_DUMP) ||
+                    !is_zero_pfn(pte_pfn(pte)))
+                        goto bad_page;
+                page = pte_page(pte);
+        }
+
+        if (flags & FOLL_GET)
+                get_page_foll(page);
+        if (flags & FOLL_TOUCH) {
+                if ((flags & FOLL_WRITE) &&
+                    !pte_dirty(pte) && !PageDirty(page))
+                        set_page_dirty(page);
+                /*
+                 * pte_mkyoung() would be more correct here, but atomic care
+                 * is needed to avoid losing the dirty bit: it is easier to use
+                 * mark_page_accessed().
+                 */
+                mark_page_accessed(page);
+        }
+        if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
+                /*
+                 * The preliminary mapping check is mainly to avoid the
+                 * pointless overhead of lock_page on the ZERO_PAGE
+                 * which might bounce very badly if there is contention.
+                 *
+                 * If the page is already locked, we don't need to
+                 * handle it now - vmscan will handle it later if and
+                 * when it attempts to reclaim the page.
+                 */
+                if (page->mapping && trylock_page(page)) {
+                        lru_add_drain();  /* push cached pages to LRU */
+                        /*
+                         * Because we lock page here, and migration is
+                         * blocked by the pte's page reference, and we
+                         * know the page is still mapped, we don't even
+                         * need to check for file-cache page truncation.
+                         */
+                        mlock_vma_page(page);
+                        unlock_page(page);
+                }
+        }
+        pte_unmap_unlock(ptep, ptl);
+        return page;
+bad_page:
+        pte_unmap_unlock(ptep, ptl);
+        return ERR_PTR(-EFAULT);
+
+no_page:
+        pte_unmap_unlock(ptep, ptl);
+        if (!pte_none(pte))
+                return NULL;
+        return no_page_table(vma, flags);
+}
+
+/**
+ * follow_page_mask - look up a page descriptor from a user-virtual address
+ * @vma: vm_area_struct mapping @address
+ * @address: virtual address to look up
+ * @flags: flags modifying lookup behaviour
+ * @page_mask: on output, *page_mask is set according to the size of the page
+ *
+ * @flags can have FOLL_ flags set, defined in <linux/mm.h>
+ *
+ * Returns the mapped (struct page *), %NULL if no mapping exists, or
+ * an error pointer if there is a mapping to something not represented
+ * by a page descriptor (see also vm_normal_page()).
+ */
+struct page *follow_page_mask(struct vm_area_struct *vma,
+                              unsigned long address, unsigned int flags,
+                              unsigned int *page_mask)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        spinlock_t *ptl;
+        struct page *page;
+        struct mm_struct *mm = vma->vm_mm;
+
+        *page_mask = 0;
+
+        page = follow_huge_addr(mm, address, flags & FOLL_WRITE);
+        if (!IS_ERR(page)) {
+                BUG_ON(flags & FOLL_GET);
+                return page;
+        }
+
+        pgd = pgd_offset(mm, address);
+        if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
+                return no_page_table(vma, flags);
+
+        pud = pud_offset(pgd, address);
+        if (pud_none(*pud))
+                return no_page_table(vma, flags);
+        if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) {
+                if (flags & FOLL_GET)
+                        return NULL;
+                page = follow_huge_pud(mm, address, pud, flags & FOLL_WRITE);
+                return page;
+        }
+        if (unlikely(pud_bad(*pud)))
+                return no_page_table(vma, flags);
+
+        pmd = pmd_offset(pud, address);
+        if (pmd_none(*pmd))
+                return no_page_table(vma, flags);
+        if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) {
+                page = follow_huge_pmd(mm, address, pmd, flags & FOLL_WRITE);
+                if (flags & FOLL_GET) {
+                        /*
+                         * Refcount on tail pages are not well-defined and
+                         * shouldn't be taken. The caller should handle a NULL
+                         * return when trying to follow tail pages.
+                         */
+                        if (PageHead(page))
+                                get_page(page);
+                        else
+                                page = NULL;
+                }
+                return page;
+        }
+        if ((flags & FOLL_NUMA) && pmd_numa(*pmd))
+                return no_page_table(vma, flags);
+        if (pmd_trans_huge(*pmd)) {
+                if (flags & FOLL_SPLIT) {
+                        split_huge_page_pmd(vma, address, pmd);
+                        return follow_page_pte(vma, address, pmd, flags);
+                }
+                ptl = pmd_lock(mm, pmd);
+                if (likely(pmd_trans_huge(*pmd))) {
+                        if (unlikely(pmd_trans_splitting(*pmd))) {
+                                spin_unlock(ptl);
+                                wait_split_huge_page(vma->anon_vma, pmd);
+                        } else {
+                                page = follow_trans_huge_pmd(vma, address,
+                                                             pmd, flags);
+                                spin_unlock(ptl);
+                                *page_mask = HPAGE_PMD_NR - 1;
+                                return page;
+                        }
+                } else
+                        spin_unlock(ptl);
+        }
+        return follow_page_pte(vma, address, pmd, flags);
+}
+
+static int get_gate_page(struct mm_struct *mm, unsigned long address,
+                unsigned int gup_flags, struct vm_area_struct **vma,
+                struct page **page)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte;
+        int ret = -EFAULT;
+
+        /* user gate pages are read-only */
+        if (gup_flags & FOLL_WRITE)
+                return -EFAULT;
+        if (address > TASK_SIZE)
+                pgd = pgd_offset_k(address);
+        else
+                pgd = pgd_offset_gate(mm, address);
+        BUG_ON(pgd_none(*pgd));
+        pud = pud_offset(pgd, address);
+        BUG_ON(pud_none(*pud));
+        pmd = pmd_offset(pud, address);
+        if (pmd_none(*pmd))
+                return -EFAULT;
+        VM_BUG_ON(pmd_trans_huge(*pmd));
+        pte = pte_offset_map(pmd, address);
+        if (pte_none(*pte))
+                goto unmap;
+        *vma = get_gate_vma(mm);
+        if (!page)
+                goto out;
+        *page = vm_normal_page(*vma, address, *pte);
+        if (!*page) {
+                if ((gup_flags & FOLL_DUMP) || !is_zero_pfn(pte_pfn(*pte)))
+                        goto unmap;
+                *page = pte_page(*pte);
+        }
+        get_page(*page);
+out:
+        ret = 0;
+unmap:
+        pte_unmap(pte);
+        return ret;
+}
+
+static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
+                unsigned long address, unsigned int *flags, int *nonblocking)
+{
+        struct mm_struct *mm = vma->vm_mm;
+        unsigned int fault_flags = 0;
+        int ret;
+
+        /* For mlock, just skip the stack guard page. */
+        if ((*flags & FOLL_MLOCK) &&
+                        (stack_guard_page_start(vma, address) ||
+                         stack_guard_page_end(vma, address + PAGE_SIZE)))
+                return -ENOENT;
+        if (*flags & FOLL_WRITE)
+                fault_flags |= FAULT_FLAG_WRITE;
+        if (nonblocking)
+                fault_flags |= FAULT_FLAG_ALLOW_RETRY;
+        if (*flags & FOLL_NOWAIT)
+                fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT;
+
+        ret = handle_mm_fault(mm, vma, address, fault_flags);
+        if (ret & VM_FAULT_ERROR) {
+                if (ret & VM_FAULT_OOM)
+                        return -ENOMEM;
+                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+                        return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
+                if (ret & VM_FAULT_SIGBUS)
+                        return -EFAULT;
+                BUG();
+        }
+
+        if (tsk) {
+                if (ret & VM_FAULT_MAJOR)
+                        tsk->maj_flt++;
+                else
+                        tsk->min_flt++;
+        }
+
+        if (ret & VM_FAULT_RETRY) {
+                if (nonblocking)
+                        *nonblocking = 0;
+                return -EBUSY;
+        }
+
+        /*
+         * The VM_FAULT_WRITE bit tells us that do_wp_page has broken COW when
+         * necessary, even if maybe_mkwrite decided not to set pte_write. We
+         * can thus safely do subsequent page lookups as if they were reads.
+         * But only do so when looping for pte_write is futile: in some cases
+         * userspace may also be wanting to write to the gotten user page,
+         * which a read fault here might prevent (a readonly page might get
+         * reCOWed by userspace write).
+         */
+        if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
+                *flags &= ~FOLL_WRITE;
+        return 0;
+}
+
+static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags)
+{
+        vm_flags_t vm_flags = vma->vm_flags;
+
+        if (vm_flags & (VM_IO | VM_PFNMAP))
+                return -EFAULT;
+
+        if (gup_flags & FOLL_WRITE) {
+                if (!(vm_flags & VM_WRITE)) {
+                        if (!(gup_flags & FOLL_FORCE))
+                                return -EFAULT;
+                        /*
+                         * We used to let the write,force case do COW in a
+                         * VM_MAYWRITE VM_SHARED !VM_WRITE vma, so ptrace could
+                         * set a breakpoint in a read-only mapping of an
+                         * executable, without corrupting the file (yet only
+                         * when that file had been opened for writing!).
+                         * Anon pages in shared mappings are surprising: now
+                         * just reject it.
+                         */
+                        if (!is_cow_mapping(vm_flags)) {
+                                WARN_ON_ONCE(vm_flags & VM_MAYWRITE);
+                                return -EFAULT;
+                        }
+                }
+        } else if (!(vm_flags & VM_READ)) {
+                if (!(gup_flags & FOLL_FORCE))
+                        return -EFAULT;
+                /*
+                 * Is there actually any vma we can reach here which does not
+                 * have VM_MAYREAD set?
+                 */
+                if (!(vm_flags & VM_MAYREAD))
+                        return -EFAULT;
+        }
+        return 0;
+}
+
+/**
+ * __get_user_pages() - pin user pages in memory
+ * @tsk:        task_struct of target task
+ * @mm:         mm_struct of target mm
+ * @start:      starting user address
+ * @nr_pages:   number of pages from start to pin
+ * @gup_flags:  flags modifying pin behaviour
+ * @pages:      array that receives pointers to the pages pinned.
+ *              Should be at least nr_pages long. Or NULL, if caller
+ *              only intends to ensure the pages are faulted in.
+ * @vmas:       array of pointers to vmas corresponding to each page.
+ *              Or NULL if the caller does not require them.
+ * @nonblocking: whether waiting for disk IO or mmap_sem contention
+ *
+ * Returns number of pages pinned. This may be fewer than the number
+ * requested. If nr_pages is 0 or negative, returns 0. If no pages
+ * were pinned, returns -errno. Each page returned must be released
+ * with a put_page() call when it is finished with. vmas will only
+ * remain valid while mmap_sem is held.
+ *
+ * Must be called with mmap_sem held for read or write.
+ *
+ * __get_user_pages walks a process's page tables and takes a reference to
+ * each struct page that each user address corresponds to at a given
+ * instant. That is, it takes the page that would be accessed if a user
+ * thread accesses the given user virtual address at that instant.
+ *
+ * This does not guarantee that the page exists in the user mappings when
+ * __get_user_pages returns, and there may even be a completely different
+ * page there in some cases (eg. if mmapped pagecache has been invalidated
+ * and subsequently re faulted). However it does guarantee that the page
+ * won't be freed completely. And mostly callers simply care that the page
+ * contains data that was valid *at some point in time*. Typically, an IO
+ * or similar operation cannot guarantee anything stronger anyway because
+ * locks can't be held over the syscall boundary.
+ *
+ * If @gup_flags & FOLL_WRITE == 0, the page must not be written to. If
+ * the page is written to, set_page_dirty (or set_page_dirty_lock, as
+ * appropriate) must be called after the page is finished with, and
+ * before put_page is called.
+ *
+ * If @nonblocking != NULL, __get_user_pages will not wait for disk IO
+ * or mmap_sem contention, and if waiting is needed to pin all pages,
+ * *@nonblocking will be set to 0.
+ *
+ * In most cases, get_user_pages or get_user_pages_fast should be used
+ * instead of __get_user_pages. __get_user_pages should be used only if
+ * you need some special @gup_flags.
+ */
+long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+                unsigned long start, unsigned long nr_pages,
+                unsigned int gup_flags, struct page **pages,
+                struct vm_area_struct **vmas, int *nonblocking)
+{
+        long i = 0;
+        unsigned int page_mask;
+        struct vm_area_struct *vma = NULL;
+
+        if (!nr_pages)
+                return 0;
+
+        VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET));
+
+        /*
+         * If FOLL_FORCE is set then do not force a full fault as the hinting
+         * fault information is unrelated to the reference behaviour of a task
+         * using the address space
+         */
+        if (!(gup_flags & FOLL_FORCE))
+                gup_flags |= FOLL_NUMA;
+
+        do {
+                struct page *page;
+                unsigned int foll_flags = gup_flags;
+                unsigned int page_increm;
+
+                /* first iteration or cross vma bound */
+                if (!vma || start >= vma->vm_end) {
+                        vma = find_extend_vma(mm, start);
+                        if (!vma && in_gate_area(mm, start)) {
+                                int ret;
+                                ret = get_gate_page(mm, start & PAGE_MASK,
+                                                gup_flags, &vma,
+                                                pages ? &pages[i] : NULL);
+                                if (ret)
+                                        return i ? : ret;
+                                page_mask = 0;
+                                goto next_page;
+                        }
+
+                        if (!vma || check_vma_flags(vma, gup_flags))
+                                return i ? : -EFAULT;
+                        if (is_vm_hugetlb_page(vma)) {
+                                i = follow_hugetlb_page(mm, vma, pages, vmas,
+                                                &start, &nr_pages, i,
+                                                gup_flags);
+                                continue;
+                        }
+                }
+retry:
+                /*
+                 * If we have a pending SIGKILL, don't keep faulting pages and
+                 * potentially allocating memory.
+                 */
+                if (unlikely(fatal_signal_pending(current)))
+                        return i ? i : -ERESTARTSYS;
+                cond_resched();
+                page = follow_page_mask(vma, start, foll_flags, &page_mask);
+                if (!page) {
+                        int ret;
+                        ret = faultin_page(tsk, vma, start, &foll_flags,
+                                        nonblocking);
+                        switch (ret) {
+                        case 0:
+                                goto retry;
+                        case -EFAULT:
+                        case -ENOMEM:
+                        case -EHWPOISON:
+                                return i ? i : ret;
+                        case -EBUSY:
+                                return i;
+                        case -ENOENT:
+                                goto next_page;
+                        }
+                        BUG();
+                }
+                if (IS_ERR(page))
+                        return i ? i : PTR_ERR(page);
+                if (pages) {
+                        pages[i] = page;
+                        flush_anon_page(vma, page, start);
+                        flush_dcache_page(page);
+                        page_mask = 0;
+                }
+next_page:
+                if (vmas) {
+                        vmas[i] = vma;
+                        page_mask = 0;
+                }
+                page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask);
+                if (page_increm > nr_pages)
+                        page_increm = nr_pages;
+                i += page_increm;
+                start += page_increm * PAGE_SIZE;
+                nr_pages -= page_increm;
+        } while (nr_pages);
+        return i;
+}
+EXPORT_SYMBOL(__get_user_pages);
+
+/*
+ * fixup_user_fault() - manually resolve a user page fault
+ * @tsk:        the task_struct to use for page fault accounting, or
+ *              NULL if faults are not to be recorded.
+ * @mm:         mm_struct of target mm
+ * @address:    user address
+ * @fault_flags:flags to pass down to handle_mm_fault()
+ *
+ * This is meant to be called in the specific scenario where for locking reasons
+ * we try to access user memory in atomic context (within a pagefault_disable()
+ * section), this returns -EFAULT, and we want to resolve the user fault before
+ * trying again.
+ *
+ * Typically this is meant to be used by the futex code.
+ *
+ * The main difference with get_user_pages() is that this function will
+ * unconditionally call handle_mm_fault() which will in turn perform all the
+ * necessary SW fixup of the dirty and young bits in the PTE, while
+ * handle_mm_fault() only guarantees to update these in the struct page.
+ *
+ * This is important for some architectures where those bits also gate the
+ * access permission to the page because they are maintained in software.  On
+ * such architectures, gup() will not be enough to make a subsequent access
+ * succeed.
+ *
+ * This should be called with the mm_sem held for read.
+ */
+int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+                     unsigned long address, unsigned int fault_flags)
+{
+        struct vm_area_struct *vma;
+        vm_flags_t vm_flags;
+        int ret;
+
+        vma = find_extend_vma(mm, address);
+        if (!vma || address < vma->vm_start)
+                return -EFAULT;
+
+        vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
+        if (!(vm_flags & vma->vm_flags))
+                return -EFAULT;
+
+        ret = handle_mm_fault(mm, vma, address, fault_flags);
+        if (ret & VM_FAULT_ERROR) {
+                if (ret & VM_FAULT_OOM)
+                        return -ENOMEM;
+                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+                        return -EHWPOISON;
+                if (ret & VM_FAULT_SIGBUS)
+                        return -EFAULT;
+                BUG();
+        }
+        if (tsk) {
+                if (ret & VM_FAULT_MAJOR)
+                        tsk->maj_flt++;
+                else
+                        tsk->min_flt++;
+        }
+        return 0;
+}
+
+/*
+ * get_user_pages() - pin user pages in memory
+ * @tsk:        the task_struct to use for page fault accounting, or
+ *              NULL if faults are not to be recorded.
+ * @mm:         mm_struct of target mm
+ * @start:      starting user address
+ * @nr_pages:   number of pages from start to pin
+ * @write:      whether pages will be written to by the caller
+ * @force:      whether to force access even when user mapping is currently
+ *              protected (but never forces write access to shared mapping).
+ * @pages:      array that receives pointers to the pages pinned.
+ *              Should be at least nr_pages long. Or NULL, if caller
+ *              only intends to ensure the pages are faulted in.
+ * @vmas:       array of pointers to vmas corresponding to each page.
+ *              Or NULL if the caller does not require them.
+ *
+ * Returns number of pages pinned. This may be fewer than the number
+ * requested. If nr_pages is 0 or negative, returns 0. If no pages
+ * were pinned, returns -errno. Each page returned must be released
+ * with a put_page() call when it is finished with. vmas will only
+ * remain valid while mmap_sem is held.
+ *
+ * Must be called with mmap_sem held for read or write.
+ *
+ * get_user_pages walks a process's page tables and takes a reference to
+ * each struct page that each user address corresponds to at a given
+ * instant. That is, it takes the page that would be accessed if a user
+ * thread accesses the given user virtual address at that instant.
+ *
+ * This does not guarantee that the page exists in the user mappings when
+ * get_user_pages returns, and there may even be a completely different
+ * page there in some cases (eg. if mmapped pagecache has been invalidated
+ * and subsequently re faulted). However it does guarantee that the page
+ * won't be freed completely. And mostly callers simply care that the page
+ * contains data that was valid *at some point in time*. Typically, an IO
+ * or similar operation cannot guarantee anything stronger anyway because
+ * locks can't be held over the syscall boundary.
+ *
+ * If write=0, the page must not be written to. If the page is written to,
+ * set_page_dirty (or set_page_dirty_lock, as appropriate) must be called
+ * after the page is finished with, and before put_page is called.
+ *
+ * get_user_pages is typically used for fewer-copy IO operations, to get a
+ * handle on the memory by some means other than accesses via the user virtual
+ * addresses. The pages may be submitted for DMA to devices or accessed via
+ * their kernel linear mapping (via the kmap APIs). Care should be taken to
+ * use the correct cache flushing APIs.
+ *
+ * See also get_user_pages_fast, for performance critical applications.
+ */
+long get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+                unsigned long start, unsigned long nr_pages, int write,
+                int force, struct page **pages, struct vm_area_struct **vmas)
+{
+        int flags = FOLL_TOUCH;
+
+        if (pages)
+                flags |= FOLL_GET;
+        if (write)
+                flags |= FOLL_WRITE;
+        if (force)
+                flags |= FOLL_FORCE;
+
+        return __get_user_pages(tsk, mm, start, nr_pages, flags, pages, vmas,
+                                NULL);
+}
+EXPORT_SYMBOL(get_user_pages);
+
+/**
+ * get_dump_page() - pin user page in memory while writing it to core dump
+ * @addr: user address
+ *
+ * Returns struct page pointer of user page pinned for dump,
+ * to be freed afterwards by page_cache_release() or put_page().
+ *
+ * Returns NULL on any kind of failure - a hole must then be inserted into
+ * the corefile, to preserve alignment with its headers; and also returns
+ * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found -
+ * allowing a hole to be left in the corefile to save diskspace.
+ *
+ * Called without mmap_sem, but after all other threads have been killed.
+ */
+#ifdef CONFIG_ELF_CORE
+struct page *get_dump_page(unsigned long addr)
+{
+        struct vm_area_struct *vma;
+        struct page *page;
+
+        if (__get_user_pages(current, current->mm, addr, 1,
+                             FOLL_FORCE | FOLL_DUMP | FOLL_GET, &page, &vma,
+                             NULL) < 1)
+                return NULL;
+        flush_cache_page(vma, addr, page_to_pfn(page));
+        return page;
+}
+#endif /* CONFIG_ELF_CORE */
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index d199d2d91946..e60837dc785c 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -5,6 +5,8 @@
  *  the COPYING file in the top-level directory.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/highmem.h>
@@ -151,8 +153,7 @@ static int start_khugepaged(void)
                         khugepaged_thread = kthread_run(khugepaged, NULL,
                                                         "khugepaged");
                 if (unlikely(IS_ERR(khugepaged_thread))) {
-                        printk(KERN_ERR
-                               "khugepaged: kthread_run(khugepaged) failed\n");
+                        pr_err("khugepaged: kthread_run(khugepaged) failed\n");
                         err = PTR_ERR(khugepaged_thread);
                         khugepaged_thread = NULL;
                 }
@@ -584,19 +585,19 @@ static int __init hugepage_init_sysfs(struct kobject **hugepage_kobj)
 
         *hugepage_kobj = kobject_create_and_add("transparent_hugepage", mm_kobj);
         if (unlikely(!*hugepage_kobj)) {
-                printk(KERN_ERR "hugepage: failed to create transparent hugepage kobject\n");
+                pr_err("failed to create transparent hugepage kobject\n");
                 return -ENOMEM;
         }
 
         err = sysfs_create_group(*hugepage_kobj, &hugepage_attr_group);
         if (err) {
-                printk(KERN_ERR "hugepage: failed to register transparent hugepage group\n");
+                pr_err("failed to register transparent hugepage group\n");
                 goto delete_obj;
         }
 
         err = sysfs_create_group(*hugepage_kobj, &khugepaged_attr_group);
         if (err) {
-                printk(KERN_ERR "hugepage: failed to register transparent hugepage group\n");
+                pr_err("failed to register transparent hugepage group\n");
                 goto remove_hp_group;
         }
 
@@ -689,8 +690,7 @@ static int __init setup_transparent_hugepage(char *str)
         }
 out:
         if (!ret)
-                printk(KERN_WARNING
-                       "transparent_hugepage= cannot parse, ignored\n");
+                pr_warn("transparent_hugepage= cannot parse, ignored\n");
         return ret;
 }
 __setup("transparent_hugepage=", setup_transparent_hugepage);
@@ -1830,10 +1830,11 @@ static void __split_huge_page(struct page *page,
          * the newly established pmd of the child later during the
          * walk, to be able to set it as pmd_trans_splitting too.
          */
-        if (mapcount != page_mapcount(page))
-                printk(KERN_ERR "mapcount %d page_mapcount %d\n",
-                       mapcount, page_mapcount(page));
-        BUG_ON(mapcount != page_mapcount(page));
+        if (mapcount != page_mapcount(page)) {
+                pr_err("mapcount %d page_mapcount %d\n",
+                        mapcount, page_mapcount(page));
+                BUG();
+        }
 
         __split_huge_page_refcount(page, list);
 
@@ -1844,10 +1845,11 @@ static void __split_huge_page(struct page *page,
                 BUG_ON(is_vma_temporary_stack(vma));
                 mapcount2 += __split_huge_page_map(page, vma, addr);
         }
-        if (mapcount != mapcount2)
-                printk(KERN_ERR "mapcount %d mapcount2 %d page_mapcount %d\n",
-                       mapcount, mapcount2, page_mapcount(page));
-        BUG_ON(mapcount != mapcount2);
+        if (mapcount != mapcount2) {
+                pr_err("mapcount %d mapcount2 %d page_mapcount %d\n",
+                        mapcount, mapcount2, page_mapcount(page));
+                BUG();
+        }
 }
 
 /*
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c82290b9c1fc..226910cb7c9b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -544,7 +544,7 @@ static struct page *dequeue_huge_page_node(struct hstate *h, int nid)
 /* Movability of hugepages depends on migration support. */
 static inline gfp_t htlb_alloc_mask(struct hstate *h)
 {
-        if (hugepages_treat_as_movable || hugepage_migration_support(h))
+        if (hugepages_treat_as_movable || hugepage_migration_supported(h))
                 return GFP_HIGHUSER_MOVABLE;
         else
                 return GFP_HIGHUSER;
@@ -607,25 +607,242 @@ err:
         return NULL;
 }
 
+/*
+ * common helper functions for hstate_next_node_to_{alloc|free}.
+ * We may have allocated or freed a huge page based on a different
+ * nodes_allowed previously, so h->next_node_to_{alloc|free} might
+ * be outside of *nodes_allowed.  Ensure that we use an allowed
+ * node for alloc or free.
+ */
+static int next_node_allowed(int nid, nodemask_t *nodes_allowed)
+{
+        nid = next_node(nid, *nodes_allowed);
+        if (nid == MAX_NUMNODES)
+                nid = first_node(*nodes_allowed);
+        VM_BUG_ON(nid >= MAX_NUMNODES);
+
+        return nid;
+}
+
+static int get_valid_node_allowed(int nid, nodemask_t *nodes_allowed)
+{
+        if (!node_isset(nid, *nodes_allowed))
+                nid = next_node_allowed(nid, nodes_allowed);
+        return nid;
+}
+
+/*
+ * returns the previously saved node ["this node"] from which to
+ * allocate a persistent huge page for the pool and advance the
+ * next node from which to allocate, handling wrap at end of node
+ * mask.
+ */
+static int hstate_next_node_to_alloc(struct hstate *h,
+                                        nodemask_t *nodes_allowed)
+{
+        int nid;
+
+        VM_BUG_ON(!nodes_allowed);
+
+        nid = get_valid_node_allowed(h->next_nid_to_alloc, nodes_allowed);
+        h->next_nid_to_alloc = next_node_allowed(nid, nodes_allowed);
+
+        return nid;
+}
+
+/*
+ * helper for free_pool_huge_page() - return the previously saved
+ * node ["this node"] from which to free a huge page.  Advance the
+ * next node id whether or not we find a free huge page to free so
+ * that the next attempt to free addresses the next node.
+ */
+static int hstate_next_node_to_free(struct hstate *h, nodemask_t *nodes_allowed)
+{
+        int nid;
+
+        VM_BUG_ON(!nodes_allowed);
+
+        nid = get_valid_node_allowed(h->next_nid_to_free, nodes_allowed);
+        h->next_nid_to_free = next_node_allowed(nid, nodes_allowed);
+
+        return nid;
+}
+
+#define for_each_node_mask_to_alloc(hs, nr_nodes, node, mask)           \
+        for (nr_nodes = nodes_weight(*mask);                            \
+                nr_nodes > 0 &&                                         \
+                ((node = hstate_next_node_to_alloc(hs, mask)) || 1);    \
+                nr_nodes--)
+
+#define for_each_node_mask_to_free(hs, nr_nodes, node, mask)            \
+        for (nr_nodes = nodes_weight(*mask);                            \
+                nr_nodes > 0 &&                                         \
+                ((node = hstate_next_node_to_free(hs, mask)) || 1);     \
+                nr_nodes--)
+
+#if defined(CONFIG_CMA) && defined(CONFIG_X86_64)
+static void destroy_compound_gigantic_page(struct page *page,
+                                        unsigned long order)
+{
+        int i;
+        int nr_pages = 1 << order;
+        struct page *p = page + 1;
+
+        for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
+                __ClearPageTail(p);
+                set_page_refcounted(p);
+                p->first_page = NULL;
+        }
+
+        set_compound_order(page, 0);
+        __ClearPageHead(page);
+}
+
+static void free_gigantic_page(struct page *page, unsigned order)
+{
+        free_contig_range(page_to_pfn(page), 1 << order);
+}
+
+static int __alloc_gigantic_page(unsigned long start_pfn,
+                                unsigned long nr_pages)
+{
+        unsigned long end_pfn = start_pfn + nr_pages;
+        return alloc_contig_range(start_pfn, end_pfn, MIGRATE_MOVABLE);
+}
+
+static bool pfn_range_valid_gigantic(unsigned long start_pfn,
+                                unsigned long nr_pages)
+{
+        unsigned long i, end_pfn = start_pfn + nr_pages;
+        struct page *page;
+
+        for (i = start_pfn; i < end_pfn; i++) {
+                if (!pfn_valid(i))
+                        return false;
+
+                page = pfn_to_page(i);
+
+                if (PageReserved(page))
+                        return false;
+
+                if (page_count(page) > 0)
+                        return false;
+
+                if (PageHuge(page))
+                        return false;
+        }
+
+        return true;
+}
+
+static bool zone_spans_last_pfn(const struct zone *zone,
+                        unsigned long start_pfn, unsigned long nr_pages)
+{
+        unsigned long last_pfn = start_pfn + nr_pages - 1;
+        return zone_spans_pfn(zone, last_pfn);
+}
+
+static struct page *alloc_gigantic_page(int nid, unsigned order)
+{
+        unsigned long nr_pages = 1 << order;
+        unsigned long ret, pfn, flags;
+        struct zone *z;
+
+        z = NODE_DATA(nid)->node_zones;
+        for (; z - NODE_DATA(nid)->node_zones < MAX_NR_ZONES; z++) {
+                spin_lock_irqsave(&z->lock, flags);
+
+                pfn = ALIGN(z->zone_start_pfn, nr_pages);
+                while (zone_spans_last_pfn(z, pfn, nr_pages)) {
+                        if (pfn_range_valid_gigantic(pfn, nr_pages)) {
+                                /*
+                                 * We release the zone lock here because
+                                 * alloc_contig_range() will also lock the zone
+                                 * at some point. If there's an allocation
+                                 * spinning on this lock, it may win the race
+                                 * and cause alloc_contig_range() to fail...
+                                 */
+                                spin_unlock_irqrestore(&z->lock, flags);
+                                ret = __alloc_gigantic_page(pfn, nr_pages);
+                                if (!ret)
+                                        return pfn_to_page(pfn);
+                                spin_lock_irqsave(&z->lock, flags);
+                        }
+                        pfn += nr_pages;
+                }
+
+                spin_unlock_irqrestore(&z->lock, flags);
+        }
+
+        return NULL;
+}
+
+static void prep_new_huge_page(struct hstate *h, struct page *page, int nid);
+static void prep_compound_gigantic_page(struct page *page, unsigned long order);
+
+static struct page *alloc_fresh_gigantic_page_node(struct hstate *h, int nid)
+{
+        struct page *page;
+
+        page = alloc_gigantic_page(nid, huge_page_order(h));
+        if (page) {
+                prep_compound_gigantic_page(page, huge_page_order(h));
+                prep_new_huge_page(h, page, nid);
+        }
+
+        return page;
+}
+
+static int alloc_fresh_gigantic_page(struct hstate *h,
+                                nodemask_t *nodes_allowed)
+{
+        struct page *page = NULL;
+        int nr_nodes, node;
+
+        for_each_node_mask_to_alloc(h, nr_nodes, node, nodes_allowed) {
+                page = alloc_fresh_gigantic_page_node(h, node);
+                if (page)
+                        return 1;
+        }
+
+        return 0;
+}
+
+static inline bool gigantic_page_supported(void) { return true; }
+#else
+static inline bool gigantic_page_supported(void) { return false; }
+static inline void free_gigantic_page(struct page *page, unsigned order) { }
+static inline void destroy_compound_gigantic_page(struct page *page,
+                                                unsigned long order) { }
+static inline int alloc_fresh_gigantic_page(struct hstate *h,
+                                        nodemask_t *nodes_allowed) { return 0; }
+#endif
+
 static void update_and_free_page(struct hstate *h, struct page *page)
 {
         int i;
 
-        VM_BUG_ON(h->order >= MAX_ORDER);
+        if (hstate_is_gigantic(h) && !gigantic_page_supported())
+                return;
 
         h->nr_huge_pages--;
         h->nr_huge_pages_node[page_to_nid(page)]--;
         for (i = 0; i < pages_per_huge_page(h); i++) {
                 page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
                                 1 << PG_referenced | 1 << PG_dirty |
-                                1 << PG_active | 1 << PG_reserved |
-                                1 << PG_private | 1 << PG_writeback);
+                                1 << PG_active | 1 << PG_private |
+                                1 << PG_writeback);
         }
         VM_BUG_ON_PAGE(hugetlb_cgroup_from_page(page), page);
         set_compound_page_dtor(page, NULL);
         set_page_refcounted(page);
-        arch_release_hugepage(page);
-        __free_pages(page, huge_page_order(h));
+        if (hstate_is_gigantic(h)) {
+                destroy_compound_gigantic_page(page, huge_page_order(h));
+                free_gigantic_page(page, huge_page_order(h));
+        } else {
+                arch_release_hugepage(page);
+                __free_pages(page, huge_page_order(h));
+        }
 }
 
 struct hstate *size_to_hstate(unsigned long size)
@@ -664,7 +881,7 @@ static void free_huge_page(struct page *page)
         if (restore_reserve)
                 h->resv_huge_pages++;
 
-        if (h->surplus_huge_pages_node[nid] && huge_page_order(h) < MAX_ORDER) {
+        if (h->surplus_huge_pages_node[nid]) {
                 /* remove the page from active list */
                 list_del(&page->lru);
                 update_and_free_page(h, page);
@@ -690,8 +907,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
         put_page(page); /* free it into the hugepage allocator */
 }
 
-static void __init prep_compound_gigantic_page(struct page *page,
-                                               unsigned long order)
+static void prep_compound_gigantic_page(struct page *page, unsigned long order)
 {
         int i;
         int nr_pages = 1 << order;
@@ -769,9 +985,6 @@ static struct page *alloc_fresh_huge_page_node(struct hstate *h, int nid)
 {
         struct page *page;
 
-        if (h->order >= MAX_ORDER)
-                return NULL;
-
         page = alloc_pages_exact_node(nid,
                 htlb_alloc_mask(h)|__GFP_COMP|__GFP_THISNODE|
                                                 __GFP_REPEAT|__GFP_NOWARN,
@@ -787,79 +1000,6 @@ static struct page *alloc_fresh_huge_page_node(struct hstate *h, int nid)
         return page;
 }
 
-/*
- * common helper functions for hstate_next_node_to_{alloc|free}.
- * We may have allocated or freed a huge page based on a different
- * nodes_allowed previously, so h->next_node_to_{alloc|free} might
- * be outside of *nodes_allowed.  Ensure that we use an allowed
- * node for alloc or free.
- */
-static int next_node_allowed(int nid, nodemask_t *nodes_allowed)
-{
-        nid = next_node(nid, *nodes_allowed);
-        if (nid == MAX_NUMNODES)
-                nid = first_node(*nodes_allowed);
-        VM_BUG_ON(nid >= MAX_NUMNODES);
-
-        return nid;
-}
-
-static int get_valid_node_allowed(int nid, nodemask_t *nodes_allowed)
-{
-        if (!node_isset(nid, *nodes_allowed))
-                nid = next_node_allowed(nid, nodes_allowed);
-        return nid;
-}
-
-/*
- * returns the previously saved node ["this node"] from which to
- * allocate a persistent huge page for the pool and advance the
- * next node from which to allocate, handling wrap at end of node
- * mask.
- */
-static int hstate_next_node_to_alloc(struct hstate *h,
-                                        nodemask_t *nodes_allowed)
-{
-        int nid;
-
-        VM_BUG_ON(!nodes_allowed);
-
-        nid = get_valid_node_allowed(h->next_nid_to_alloc, nodes_allowed);
-        h->next_nid_to_alloc = next_node_allowed(nid, nodes_allowed);
-
-        return nid;
-}
-
-/*
- * helper for free_pool_huge_page() - return the previously saved
- * node ["this node"] from which to free a huge page.  Advance the
- * next node id whether or not we find a free huge page to free so
- * that the next attempt to free addresses the next node.
- */
-static int hstate_next_node_to_free(struct hstate *h, nodemask_t *nodes_allowed)
-{
-        int nid;
-
-        VM_BUG_ON(!nodes_allowed);
-
-        nid = get_valid_node_allowed(h->next_nid_to_free, nodes_allowed);
-        h->next_nid_to_free = next_node_allowed(nid, nodes_allowed);
-
-        return nid;
-}
-
-#define for_each_node_mask_to_alloc(hs, nr_nodes, node, mask)           \
-        for (nr_nodes = nodes_weight(*mask);                            \
-                nr_nodes > 0 &&                                         \
-                ((node = hstate_next_node_to_alloc(hs, mask)) || 1);    \
-                nr_nodes--)
-
-#define for_each_node_mask_to_free(hs, nr_nodes, node, mask)            \
-        for (nr_nodes = nodes_weight(*mask);                            \
-                nr_nodes > 0 &&                                         \
-                ((node = hstate_next_node_to_free(hs, mask)) || 1);     \
-                nr_nodes--)
-
 static int alloc_fresh_huge_page(struct hstate *h, nodemask_t *nodes_allowed)
 {
         struct page *page;
@@ -963,7 +1103,7 @@ static struct page *alloc_buddy_huge_page(struct hstate *h, int nid)
         struct page *page;
         unsigned int r_nid;
 
-        if (h->order >= MAX_ORDER)
+        if (hstate_is_gigantic(h))
                 return NULL;
 
         /*
@@ -1156,7 +1296,7 @@ static void return_unused_surplus_pages(struct hstate *h,
         h->resv_huge_pages -= unused_resv_pages;
 
         /* Cannot return gigantic pages currently */
-        if (h->order >= MAX_ORDER)
+        if (hstate_is_gigantic(h))
                 return;
 
         nr_pages = min(unused_resv_pages, h->surplus_huge_pages);
@@ -1246,24 +1386,17 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
                         return ERR_PTR(-ENOSPC);
 
         ret = hugetlb_cgroup_charge_cgroup(idx, pages_per_huge_page(h), &h_cg);
-        if (ret) {
-                if (chg || avoid_reserve)
-                        hugepage_subpool_put_pages(spool, 1);
-                return ERR_PTR(-ENOSPC);
-        }
+        if (ret)
+                goto out_subpool_put;
+
         spin_lock(&hugetlb_lock);
         page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve, chg);
         if (!page) {
                 spin_unlock(&hugetlb_lock);
                 page = alloc_buddy_huge_page(h, NUMA_NO_NODE);
-                if (!page) {
-                        hugetlb_cgroup_uncharge_cgroup(idx,
-                                                       pages_per_huge_page(h),
-                                                       h_cg);
-                        if (chg || avoid_reserve)
-                                hugepage_subpool_put_pages(spool, 1);
-                        return ERR_PTR(-ENOSPC);
-                }
+                if (!page)
+                        goto out_uncharge_cgroup;
+
                 spin_lock(&hugetlb_lock);
                 list_move(&page->lru, &h->hugepage_activelist);
                 /* Fall through */
@@ -1275,6 +1408,13 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
 
         vma_commit_reservation(h, vma, addr);
         return page;
+
+out_uncharge_cgroup:
+        hugetlb_cgroup_uncharge_cgroup(idx, pages_per_huge_page(h), h_cg);
+out_subpool_put:
+        if (chg || avoid_reserve)
+                hugepage_subpool_put_pages(spool, 1);
+        return ERR_PTR(-ENOSPC);
 }
 
 /*
@@ -1356,7 +1496,7 @@ static void __init gather_bootmem_prealloc(void)
                  * fix confusing memory reports from free(1) and another
                  * side-effects, like CommitLimit going negative.
                  */
-                if (h->order > (MAX_ORDER - 1))
+                if (hstate_is_gigantic(h))
                         adjust_managed_page_count(page, 1 << h->order);
         }
 }
@@ -1366,7 +1506,7 @@ static void __init hugetlb_hstate_alloc_pages(struct hstate *h)
         unsigned long i;
 
         for (i = 0; i < h->max_huge_pages; ++i) {
-                if (h->order >= MAX_ORDER) {
+                if (hstate_is_gigantic(h)) {
                         if (!alloc_bootmem_huge_page(h))
                                 break;
                 } else if (!alloc_fresh_huge_page(h,
@@ -1382,7 +1522,7 @@ static void __init hugetlb_init_hstates(void)
 
         for_each_hstate(h) {
                 /* oversize hugepages were init'ed in early boot */
-                if (h->order < MAX_ORDER)
+                if (!hstate_is_gigantic(h))
                         hugetlb_hstate_alloc_pages(h);
         }
 }
@@ -1416,7 +1556,7 @@ static void try_to_free_low(struct hstate *h, unsigned long count,
 {
         int i;
 
-        if (h->order >= MAX_ORDER)
+        if (hstate_is_gigantic(h))
                 return;
 
         for_each_node_mask(i, *nodes_allowed) {
@@ -1479,7 +1619,7 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count,
 {
         unsigned long min_count, ret;
 
-        if (h->order >= MAX_ORDER)
+        if (hstate_is_gigantic(h) && !gigantic_page_supported())
                 return h->max_huge_pages;
 
         /*
@@ -1506,7 +1646,10 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count,
                  * and reducing the surplus.
                  */
                 spin_unlock(&hugetlb_lock);
-                ret = alloc_fresh_huge_page(h, nodes_allowed);
+                if (hstate_is_gigantic(h))
+                        ret = alloc_fresh_gigantic_page(h, nodes_allowed);
+                else
+                        ret = alloc_fresh_huge_page(h, nodes_allowed);
                 spin_lock(&hugetlb_lock);
                 if (!ret)
                         goto out;
@@ -1606,7 +1749,7 @@ static ssize_t nr_hugepages_store_common(bool obey_mempolicy,
                 goto out;
 
         h = kobj_to_hstate(kobj, &nid);
-        if (h->order >= MAX_ORDER) {
+        if (hstate_is_gigantic(h) && !gigantic_page_supported()) {
                 err = -EINVAL;
                 goto out;
         }
@@ -1689,7 +1832,7 @@ static ssize_t nr_overcommit_hugepages_store(struct kobject *kobj,
         unsigned long input;
         struct hstate *h = kobj_to_hstate(kobj, NULL);
 
-        if (h->order >= MAX_ORDER)
+        if (hstate_is_gigantic(h))
                 return -EINVAL;
 
         err = kstrtoul(buf, 10, &input);
@@ -2113,7 +2256,7 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
 
         tmp = h->max_huge_pages;
 
-        if (write && h->order >= MAX_ORDER)
+        if (write && hstate_is_gigantic(h) && !gigantic_page_supported())
                 return -EINVAL;
 
         table->data = &tmp;
@@ -2169,7 +2312,7 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
 
         tmp = h->nr_overcommit_huge_pages;
 
-        if (write && h->order >= MAX_ORDER)
+        if (write && hstate_is_gigantic(h))
                 return -EINVAL;
 
         table->data = &tmp;
diff --git a/mm/internal.h b/mm/internal.h
index 07b67361a40a..7f22a11fcc66 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -134,7 +134,7 @@ struct compact_control {
         unsigned long nr_migratepages;  /* Number of pages to migrate */
         unsigned long free_pfn;         /* isolate_freepages search base */
         unsigned long migrate_pfn;      /* isolate_migratepages search base */
-        bool sync;                      /* Synchronous migration */
+        enum migrate_mode mode;         /* Async or sync migration mode */
         bool ignore_skip_hint;          /* Scan blocks even if marked skip */
         bool finished_update_free;      /* True when the zone cached pfns are
                                          * no longer being updated
@@ -144,7 +144,10 @@ struct compact_control {
         int order;                      /* order a direct compactor needs */
         int migratetype;                /* MOVABLE, RECLAIMABLE etc */
         struct zone *zone;
-        bool contended;                 /* True if a lock was contended */
+        bool contended;                 /* True if a lock was contended, or
+                                         * need_resched() true during async
+                                         * compaction
+                                         */
 };
 
 unsigned long
@@ -169,6 +172,11 @@ static inline unsigned long page_order(struct page *page)
         return page_private(page);
 }
 
+static inline bool is_cow_mapping(vm_flags_t flags)
+{
+        return (flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE;
+}
+
 /* mm/util.c */
 void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
                 struct vm_area_struct *prev, struct rb_node *rb_parent);
@@ -184,26 +192,6 @@ static inline void munlock_vma_pages_all(struct vm_area_struct *vma)
 }
 
 /*
- * Called only in fault path, to determine if a new page is being
- * mapped into a LOCKED vma.  If it is, mark page as mlocked.
- */
-static inline int mlocked_vma_newpage(struct vm_area_struct *vma,
-                                    struct page *page)
-{
-        VM_BUG_ON_PAGE(PageLRU(page), page);
-
-        if (likely((vma->vm_flags & (VM_LOCKED | VM_SPECIAL)) != VM_LOCKED))
-                return 0;
-
-        if (!TestSetPageMlocked(page)) {
-                mod_zone_page_state(page_zone(page), NR_MLOCK,
-                                    hpage_nr_pages(page));
-                count_vm_event(UNEVICTABLE_PGMLOCKED);
-        }
-        return 1;
-}
-
-/*
  * must be called with vma's mmap_sem held for read or write, and page locked.
  */
 extern void mlock_vma_page(struct page *page);
@@ -245,10 +233,6 @@ extern unsigned long vma_address(struct page *page,
                                  struct vm_area_struct *vma);
 #endif
 #else /* !CONFIG_MMU */
-static inline int mlocked_vma_newpage(struct vm_area_struct *v, struct page *p)
-{
-        return 0;
-}
 static inline void clear_page_mlock(struct page *page) { }
 static inline void mlock_vma_page(struct page *page) { }
 static inline void mlock_migrate_page(struct page *new, struct page *old) { }
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 8d2fcdfeff7f..736ade31d1dc 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1300,7 +1300,7 @@ static void kmemleak_scan(void)
         /*
          * Struct page scanning for each node.
          */
-        lock_memory_hotplug();
+        get_online_mems();
         for_each_online_node(i) {
                 unsigned long start_pfn = node_start_pfn(i);
                 unsigned long end_pfn = node_end_pfn(i);
@@ -1318,7 +1318,7 @@ static void kmemleak_scan(void)
                         scan_block(page, page + 1, NULL, 1);
                 }
         }
-        unlock_memory_hotplug();
+        put_online_mems();
 
         /*
          * Scanning the task stacks (may introduce false negatives).
diff --git a/mm/memblock.c b/mm/memblock.c
index a810ba923cdd..0aa0d2b07624 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1033,22 +1033,35 @@ int __init_memblock memblock_set_node(phys_addr_t base, phys_addr_t size,
 }
 #endif /* CONFIG_HAVE_MEMBLOCK_NODE_MAP */
 
-static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
-                                        phys_addr_t align, phys_addr_t max_addr,
-                                        int nid)
+static phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size,
+                                        phys_addr_t align, phys_addr_t start,
+                                        phys_addr_t end, int nid)
 {
         phys_addr_t found;
 
         if (!align)
                 align = SMP_CACHE_BYTES;
 
-        found = memblock_find_in_range_node(size, align, 0, max_addr, nid);
+        found = memblock_find_in_range_node(size, align, start, end, nid);
         if (found && !memblock_reserve(found, size))
                 return found;
 
         return 0;
 }
 
+phys_addr_t __init memblock_alloc_range(phys_addr_t size, phys_addr_t align,
+                                        phys_addr_t start, phys_addr_t end)
+{
+        return memblock_alloc_range_nid(size, align, start, end, NUMA_NO_NODE);
+}
+
+static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
+                                        phys_addr_t align, phys_addr_t max_addr,
+                                        int nid)
+{
+        return memblock_alloc_range_nid(size, align, 0, max_addr, nid);
+}
+
 phys_addr_t __init memblock_alloc_nid(phys_addr_t size, phys_addr_t align, int nid)
 {
         return memblock_alloc_base_nid(size, align, MEMBLOCK_ALLOC_ACCESSIBLE, nid);
@@ -1389,9 +1402,8 @@ int __init_memblock memblock_search_pfn_nid(unsigned long pfn,
         if (mid == -1)
                 return -1;
 
-        *start_pfn = type->regions[mid].base >> PAGE_SHIFT;
-        *end_pfn = (type->regions[mid].base + type->regions[mid].size)
-                        >> PAGE_SHIFT;
+        *start_pfn = PFN_DOWN(type->regions[mid].base);
+        *end_pfn = PFN_DOWN(type->regions[mid].base + type->regions[mid].size);
 
         return type->regions[mid].nid;
 }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 5177c6d4a2dd..a500cb0594c4 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -80,7 +80,7 @@ int do_swap_account __read_mostly;
 #ifdef CONFIG_MEMCG_SWAP_ENABLED
 static int really_do_swap_account __initdata = 1;
 #else
-static int really_do_swap_account __initdata = 0;
+static int really_do_swap_account __initdata;
 #endif
 
 #else
@@ -357,10 +357,9 @@ struct mem_cgroup {
         struct cg_proto tcp_mem;
 #endif
 #if defined(CONFIG_MEMCG_KMEM)
-        /* analogous to slab_common's slab_caches list. per-memcg */
+        /* analogous to slab_common's slab_caches list, but per-memcg;
+         * protected by memcg_slab_mutex */
         struct list_head memcg_slab_caches;
-        /* Not a spinlock, we can take a lot of time walking the list */
-        struct mutex slab_caches_mutex;
         /* Index in the kmem_cache->memcg_params->memcg_caches array */
         int kmemcg_id;
 #endif
@@ -1595,23 +1594,12 @@ static void mem_cgroup_end_move(struct mem_cgroup *memcg)
 }
 
 /*
- * 2 routines for checking "mem" is under move_account() or not.
+ * A routine for checking "mem" is under move_account() or not.
  *
- * mem_cgroup_stolen() -  checking whether a cgroup is mc.from or not. This
- *                        is used for avoiding races in accounting.  If true,
- *                        pc->mem_cgroup may be overwritten.
- *
- * mem_cgroup_under_move() - checking a cgroup is mc.from or mc.to or
- *                        under hierarchy of moving cgroups. This is for
- *                        waiting at hith-memory prressure caused by "move".
+ * Checking a cgroup is mc.from or mc.to or under hierarchy of
+ * moving cgroups. This is for waiting at high-memory pressure
+ * caused by "move".
  */
-
-static bool mem_cgroup_stolen(struct mem_cgroup *memcg)
-{
-        VM_BUG_ON(!rcu_read_lock_held());
-        return atomic_read(&memcg->moving_account) > 0;
-}
-
 static bool mem_cgroup_under_move(struct mem_cgroup *memcg)
 {
         struct mem_cgroup *from;
@@ -1654,7 +1642,6 @@ static bool mem_cgroup_wait_acct_move(struct mem_cgroup *memcg)
  * Take this lock when
  * - a code tries to modify page's memcg while it's USED.
  * - a code tries to modify page state accounting in a memcg.
- * see mem_cgroup_stolen(), too.
  */
 static void move_lock_mem_cgroup(struct mem_cgroup *memcg,
                                   unsigned long *flags)
@@ -2289,12 +2276,11 @@ cleanup:
 }
 
 /*
- * Currently used to update mapped file statistics, but the routine can be
- * generalized to update other statistics as well.
+ * Used to update mapped file or writeback or other statistics.
  *
  * Notes: Race condition
  *
- * We usually use page_cgroup_lock() for accessing page_cgroup member but
+ * We usually use lock_page_cgroup() for accessing page_cgroup member but
  * it tends to be costly. But considering some conditions, we doesn't need
  * to do so _always_.
  *
@@ -2308,8 +2294,8 @@ cleanup:
  * by flags.
  *
  * Considering "move", this is an only case we see a race. To make the race
- * small, we check mm->moving_account and detect there are possibility of race
- * If there is, we take a lock.
+ * small, we check memcg->moving_account and detect there are possibility
+ * of race or not. If there is, we take a lock.
  */
 
 void __mem_cgroup_begin_update_page_stat(struct page *page,
@@ -2327,9 +2313,10 @@ again:
          * If this memory cgroup is not under account moving, we don't
          * need to take move_lock_mem_cgroup(). Because we already hold
          * rcu_read_lock(), any calls to move_account will be delayed until
-         * rcu_read_unlock() if mem_cgroup_stolen() == true.
+         * rcu_read_unlock().
          */
-        if (!mem_cgroup_stolen(memcg))
+        VM_BUG_ON(!rcu_read_lock_held());
+        if (atomic_read(&memcg->moving_account) <= 0)
                 return;
 
         move_lock_mem_cgroup(memcg, flags);
@@ -2437,7 +2424,7 @@ static void drain_stock(struct memcg_stock_pcp *stock)
  */
 static void drain_local_stock(struct work_struct *dummy)
 {
-        struct memcg_stock_pcp *stock = &__get_cpu_var(memcg_stock);
+        struct memcg_stock_pcp *stock = this_cpu_ptr(&memcg_stock);
         drain_stock(stock);
         clear_bit(FLUSHING_CACHED_CHARGE, &stock->flags);
 }
@@ -2684,7 +2671,8 @@ static int mem_cgroup_try_charge(struct mem_cgroup *memcg,
          * free their memory.
          */
         if (unlikely(test_thread_flag(TIF_MEMDIE) ||
-                     fatal_signal_pending(current)))
+                     fatal_signal_pending(current) ||
+                     current->flags & PF_EXITING))
                 goto bypass;
 
         if (unlikely(task_in_memcg_oom(current)))
@@ -2912,6 +2900,12 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
 static DEFINE_MUTEX(set_limit_mutex);
 
 #ifdef CONFIG_MEMCG_KMEM
+/*
+ * The memcg_slab_mutex is held whenever a per memcg kmem cache is created or
+ * destroyed. It protects memcg_caches arrays and memcg_slab_caches lists.
+ */
+static DEFINE_MUTEX(memcg_slab_mutex);
+
 static DEFINE_MUTEX(activate_kmem_mutex);
 
 static inline bool memcg_can_account_kmem(struct mem_cgroup *memcg)
@@ -2944,10 +2938,10 @@ static int mem_cgroup_slabinfo_read(struct seq_file *m, void *v)
 
         print_slabinfo_header(m);
 
-        mutex_lock(&memcg->slab_caches_mutex);
+        mutex_lock(&memcg_slab_mutex);
         list_for_each_entry(params, &memcg->memcg_slab_caches, list)
                 cache_show(memcg_params_to_cache(params), m);
-        mutex_unlock(&memcg->slab_caches_mutex);
+        mutex_unlock(&memcg_slab_mutex);
 
         return 0;
 }
@@ -3049,8 +3043,6 @@ void memcg_update_array_size(int num)
                 memcg_limited_groups_array_size = memcg_caches_array_size(num);
 }
 
-static void kmem_cache_destroy_work_func(struct work_struct *w);
-
 int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
 {
         struct memcg_cache_params *cur_params = s->memcg_params;
@@ -3103,29 +3095,6 @@ int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
         return 0;
 }
 
-char *memcg_create_cache_name(struct mem_cgroup *memcg,
-                              struct kmem_cache *root_cache)
-{
-        static char *buf = NULL;
-
-        /*
-         * We need a mutex here to protect the shared buffer. Since this is
-         * expected to be called only on cache creation, we can employ the
-         * slab_mutex for that purpose.
-         */
-        lockdep_assert_held(&slab_mutex);
-
-        if (!buf) {
-                buf = kmalloc(NAME_MAX + 1, GFP_KERNEL);
-                if (!buf)
-                        return NULL;
-        }
-
-        cgroup_name(memcg->css.cgroup, buf, NAME_MAX + 1);
-        return kasprintf(GFP_KERNEL, "%s(%d:%s)", root_cache->name,
-                         memcg_cache_id(memcg), buf);
-}
-
 int memcg_alloc_cache_params(struct mem_cgroup *memcg, struct kmem_cache *s,
                              struct kmem_cache *root_cache)
 {
@@ -3147,8 +3116,6 @@ int memcg_alloc_cache_params(struct mem_cgroup *memcg, struct kmem_cache *s,
         if (memcg) {
                 s->memcg_params->memcg = memcg;
                 s->memcg_params->root_cache = root_cache;
-                INIT_WORK(&s->memcg_params->destroy,
-                                kmem_cache_destroy_work_func);
                 css_get(&memcg->css);
         } else
                 s->memcg_params->is_root_cache = true;
@@ -3165,24 +3132,37 @@ void memcg_free_cache_params(struct kmem_cache *s)
         kfree(s->memcg_params);
 }
 
-void memcg_register_cache(struct kmem_cache *s)
+static void memcg_register_cache(struct mem_cgroup *memcg,
+                                 struct kmem_cache *root_cache)
 {
-        struct kmem_cache *root;
-        struct mem_cgroup *memcg;
+        static char memcg_name_buf[NAME_MAX + 1]; /* protected by
+                                                     memcg_slab_mutex */
+        struct kmem_cache *cachep;
         int id;
 
-        if (is_root_cache(s))
+        lockdep_assert_held(&memcg_slab_mutex);
+
+        id = memcg_cache_id(memcg);
+
+        /*
+         * Since per-memcg caches are created asynchronously on first
+         * allocation (see memcg_kmem_get_cache()), several threads can try to
+         * create the same cache, but only one of them may succeed.
+         */
+        if (cache_from_memcg_idx(root_cache, id))
                 return;
 
+        cgroup_name(memcg->css.cgroup, memcg_name_buf, NAME_MAX + 1);
+        cachep = memcg_create_kmem_cache(memcg, root_cache, memcg_name_buf);
         /*
-         * Holding the slab_mutex assures nobody will touch the memcg_caches
-         * array while we are modifying it.
+         * If we could not create a memcg cache, do not complain, because
+         * that's not critical at all as we can always proceed with the root
+         * cache.
          */
-        lockdep_assert_held(&slab_mutex);
+        if (!cachep)
+                return;
 
-        root = s->memcg_params->root_cache;
-        memcg = s->memcg_params->memcg;
-        id = memcg_cache_id(memcg);
+        list_add(&cachep->memcg_params->list, &memcg->memcg_slab_caches);
 
         /*
          * Since readers won't lock (see cache_from_memcg_idx()), we need a
@@ -3191,49 +3171,30 @@ void memcg_register_cache(struct kmem_cache *s)
          */
         smp_wmb();
 
-        /*
-         * Initialize the pointer to this cache in its parent's memcg_params
-         * before adding it to the memcg_slab_caches list, otherwise we can
-         * fail to convert memcg_params_to_cache() while traversing the list.
-         */
-        VM_BUG_ON(root->memcg_params->memcg_caches[id]);
-        root->memcg_params->memcg_caches[id] = s;
-
-        mutex_lock(&memcg->slab_caches_mutex);
-        list_add(&s->memcg_params->list, &memcg->memcg_slab_caches);
-        mutex_unlock(&memcg->slab_caches_mutex);
+        BUG_ON(root_cache->memcg_params->memcg_caches[id]);
+        root_cache->memcg_params->memcg_caches[id] = cachep;
 }
 
-void memcg_unregister_cache(struct kmem_cache *s)
+static void memcg_unregister_cache(struct kmem_cache *cachep)
 {
-        struct kmem_cache *root;
+        struct kmem_cache *root_cache;
         struct mem_cgroup *memcg;
         int id;
 
-        if (is_root_cache(s))
-                return;
+        lockdep_assert_held(&memcg_slab_mutex);
 
-        /*
-         * Holding the slab_mutex assures nobody will touch the memcg_caches
-         * array while we are modifying it.
-         */
-        lockdep_assert_held(&slab_mutex);
+        BUG_ON(is_root_cache(cachep));
 
-        root = s->memcg_params->root_cache;
-        memcg = s->memcg_params->memcg;
+        root_cache = cachep->memcg_params->root_cache;
+        memcg = cachep->memcg_params->memcg;
         id = memcg_cache_id(memcg);
 
-        mutex_lock(&memcg->slab_caches_mutex);
-        list_del(&s->memcg_params->list);
-        mutex_unlock(&memcg->slab_caches_mutex);
+        BUG_ON(root_cache->memcg_params->memcg_caches[id] != cachep);
+        root_cache->memcg_params->memcg_caches[id] = NULL;
 
-        /*
-         * Clear the pointer to this cache in its parent's memcg_params only
-         * after removing it from the memcg_slab_caches list, otherwise we can
-         * fail to convert memcg_params_to_cache() while traversing the list.
-         */
-        VM_BUG_ON(root->memcg_params->memcg_caches[id] != s);
-        root->memcg_params->memcg_caches[id] = NULL;
+        list_del(&cachep->memcg_params->list);
+
+        kmem_cache_destroy(cachep);
 }
 
 /*
@@ -3267,144 +3228,61 @@ static inline void memcg_resume_kmem_account(void)
         current->memcg_kmem_skip_account--;
 }
 
-static void kmem_cache_destroy_work_func(struct work_struct *w)
-{
-        struct kmem_cache *cachep;
-        struct memcg_cache_params *p;
-
-        p = container_of(w, struct memcg_cache_params, destroy);
-
-        cachep = memcg_params_to_cache(p);
-
-        /*
-         * If we get down to 0 after shrink, we could delete right away.
-         * However, memcg_release_pages() already puts us back in the workqueue
-         * in that case. If we proceed deleting, we'll get a dangling
-         * reference, and removing the object from the workqueue in that case
-         * is unnecessary complication. We are not a fast path.
-         *
-         * Note that this case is fundamentally different from racing with
-         * shrink_slab(): if memcg_cgroup_destroy_cache() is called in
-         * kmem_cache_shrink, not only we would be reinserting a dead cache
-         * into the queue, but doing so from inside the worker racing to
-         * destroy it.
-         *
-         * So if we aren't down to zero, we'll just schedule a worker and try
-         * again
-         */
-        if (atomic_read(&cachep->memcg_params->nr_pages) != 0)
-                kmem_cache_shrink(cachep);
-        else
-                kmem_cache_destroy(cachep);
-}
-
-void mem_cgroup_destroy_cache(struct kmem_cache *cachep)
-{
-        if (!cachep->memcg_params->dead)
-                return;
-
-        /*
-         * There are many ways in which we can get here.
-         *
-         * We can get to a memory-pressure situation while the delayed work is
-         * still pending to run. The vmscan shrinkers can then release all
-         * cache memory and get us to destruction. If this is the case, we'll
-         * be executed twice, which is a bug (the second time will execute over
-         * bogus data). In this case, cancelling the work should be fine.
-         *
-         * But we can also get here from the worker itself, if
-         * kmem_cache_shrink is enough to shake all the remaining objects and
-         * get the page count to 0. In this case, we'll deadlock if we try to
-         * cancel the work (the worker runs with an internal lock held, which
-         * is the same lock we would hold for cancel_work_sync().)
-         *
-         * Since we can't possibly know who got us here, just refrain from
-         * running if there is already work pending
-         */
-        if (work_pending(&cachep->memcg_params->destroy))
-                return;
-        /*
-         * We have to defer the actual destroying to a workqueue, because
-         * we might currently be in a context that cannot sleep.
-         */
-        schedule_work(&cachep->memcg_params->destroy);
-}
-
-int __kmem_cache_destroy_memcg_children(struct kmem_cache *s)
+int __memcg_cleanup_cache_params(struct kmem_cache *s)
 {
         struct kmem_cache *c;
         int i, failed = 0;
 
-        /*
-         * If the cache is being destroyed, we trust that there is no one else
-         * requesting objects from it. Even if there are, the sanity checks in
-         * kmem_cache_destroy should caught this ill-case.
-         *
-         * Still, we don't want anyone else freeing memcg_caches under our
-         * noses, which can happen if a new memcg comes to life. As usual,
-         * we'll take the activate_kmem_mutex to protect ourselves against
-         * this.
-         */
-        mutex_lock(&activate_kmem_mutex);
+        mutex_lock(&memcg_slab_mutex);
         for_each_memcg_cache_index(i) {
                 c = cache_from_memcg_idx(s, i);
                 if (!c)
                         continue;
 
-                /*
-                 * We will now manually delete the caches, so to avoid races
-                 * we need to cancel all pending destruction workers and
-                 * proceed with destruction ourselves.
-                 *
-                 * kmem_cache_destroy() will call kmem_cache_shrink internally,
-                 * and that could spawn the workers again: it is likely that
-                 * the cache still have active pages until this very moment.
-                 * This would lead us back to mem_cgroup_destroy_cache.
-                 *
-                 * But that will not execute at all if the "dead" flag is not
-                 * set, so flip it down to guarantee we are in control.
-                 */
-                c->memcg_params->dead = false;
-                cancel_work_sync(&c->memcg_params->destroy);
-                kmem_cache_destroy(c);
+                memcg_unregister_cache(c);
 
                 if (cache_from_memcg_idx(s, i))
                         failed++;
         }
-        mutex_unlock(&activate_kmem_mutex);
+        mutex_unlock(&memcg_slab_mutex);
         return failed;
 }
 
-static void mem_cgroup_destroy_all_caches(struct mem_cgroup *memcg)
+static void memcg_unregister_all_caches(struct mem_cgroup *memcg)
 {
         struct kmem_cache *cachep;
-        struct memcg_cache_params *params;
+        struct memcg_cache_params *params, *tmp;
 
         if (!memcg_kmem_is_active(memcg))
                 return;
 
-        mutex_lock(&memcg->slab_caches_mutex);
-        list_for_each_entry(params, &memcg->memcg_slab_caches, list) {
+        mutex_lock(&memcg_slab_mutex);
+        list_for_each_entry_safe(params, tmp, &memcg->memcg_slab_caches, list) {
                 cachep = memcg_params_to_cache(params);
-                cachep->memcg_params->dead = true;
-                schedule_work(&cachep->memcg_params->destroy);
+                kmem_cache_shrink(cachep);
+                if (atomic_read(&cachep->memcg_params->nr_pages) == 0)
+                        memcg_unregister_cache(cachep);
         }
-        mutex_unlock(&memcg->slab_caches_mutex);
+        mutex_unlock(&memcg_slab_mutex);
 }
 
-struct create_work {
+struct memcg_register_cache_work {
         struct mem_cgroup *memcg;
         struct kmem_cache *cachep;
         struct work_struct work;
 };
 
-static void memcg_create_cache_work_func(struct work_struct *w)
+static void memcg_register_cache_func(struct work_struct *w)
 {
-        struct create_work *cw = container_of(w, struct create_work, work);
+        struct memcg_register_cache_work *cw =
+                container_of(w, struct memcg_register_cache_work, work);
         struct mem_cgroup *memcg = cw->memcg;
         struct kmem_cache *cachep = cw->cachep;
 
-        kmem_cache_create_memcg(memcg, cachep);
+        mutex_lock(&memcg_slab_mutex);
+        memcg_register_cache(memcg, cachep);
+        mutex_unlock(&memcg_slab_mutex);
+
         css_put(&memcg->css);
         kfree(cw);
 }
@@ -3412,12 +3290,12 @@ static void memcg_create_cache_work_func(struct work_struct *w)
 /*
  * Enqueue the creation of a per-memcg kmem_cache.
  */
-static void __memcg_create_cache_enqueue(struct mem_cgroup *memcg,
-                                         struct kmem_cache *cachep)
+static void __memcg_schedule_register_cache(struct mem_cgroup *memcg,
+                                            struct kmem_cache *cachep)
 {
-        struct create_work *cw;
+        struct memcg_register_cache_work *cw;
 
-        cw = kmalloc(sizeof(struct create_work), GFP_NOWAIT);
+        cw = kmalloc(sizeof(*cw), GFP_NOWAIT);
         if (cw == NULL) {
                 css_put(&memcg->css);
                 return;
@@ -3426,17 +3304,17 @@ static void __memcg_create_cache_enqueue(struct mem_cgroup *memcg,
         cw->memcg = memcg;
         cw->cachep = cachep;
 
-        INIT_WORK(&cw->work, memcg_create_cache_work_func);
+        INIT_WORK(&cw->work, memcg_register_cache_func);
         schedule_work(&cw->work);
 }
 
-static void memcg_create_cache_enqueue(struct mem_cgroup *memcg,
-                                       struct kmem_cache *cachep)
+static void memcg_schedule_register_cache(struct mem_cgroup *memcg,
+                                          struct kmem_cache *cachep)
 {
         /*
          * We need to stop accounting when we kmalloc, because if the
          * corresponding kmalloc cache is not yet created, the first allocation
-         * in __memcg_create_cache_enqueue will recurse.
+         * in __memcg_schedule_register_cache will recurse.
          *
          * However, it is better to enclose the whole function. Depending on
          * the debugging options enabled, INIT_WORK(), for instance, can
@@ -3445,9 +3323,27 @@ static void memcg_create_cache_enqueue(struct mem_cgroup *memcg,
          * the safest choice is to do it like this, wrapping the whole function.
          */
         memcg_stop_kmem_account();
-        __memcg_create_cache_enqueue(memcg, cachep);
+        __memcg_schedule_register_cache(memcg, cachep);
         memcg_resume_kmem_account();
 }
+
+int __memcg_charge_slab(struct kmem_cache *cachep, gfp_t gfp, int order)
+{
+        int res;
+
+        res = memcg_charge_kmem(cachep->memcg_params->memcg, gfp,
+                                PAGE_SIZE << order);
+        if (!res)
+                atomic_add(1 << order, &cachep->memcg_params->nr_pages);
+        return res;
+}
+
+void __memcg_uncharge_slab(struct kmem_cache *cachep, int order)
+{
+        memcg_uncharge_kmem(cachep->memcg_params->memcg, PAGE_SIZE << order);
+        atomic_sub(1 << order, &cachep->memcg_params->nr_pages);
+}
+
 /*
  * Return the kmem_cache we're supposed to use for a slab allocation.
  * We try to use the current memcg's version of the cache.
@@ -3498,22 +3394,16 @@ struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep,
          *
          * However, there are some clashes that can arrive from locking.
          * For instance, because we acquire the slab_mutex while doing
-         * kmem_cache_dup, this means no further allocation could happen
-         * with the slab_mutex held.
-         *
-         * Also, because cache creation issue get_online_cpus(), this
-         * creates a lock chain: memcg_slab_mutex -> cpu_hotplug_mutex,
-         * that ends up reversed during cpu hotplug. (cpuset allocates
-         * a bunch of GFP_KERNEL memory during cpuup). Due to all that,
-         * better to defer everything.
+         * memcg_create_kmem_cache, this means no further allocation
+         * could happen with the slab_mutex held. So it's better to
+         * defer everything.
          */
-        memcg_create_cache_enqueue(memcg, cachep);
+        memcg_schedule_register_cache(memcg, cachep);
         return cachep;
 out:
         rcu_read_unlock();
         return cachep;
 }
-EXPORT_SYMBOL(__memcg_kmem_get_cache);
 
 /*
  * We need to verify if the allocation against current->mm->owner's memcg is
@@ -3540,11 +3430,12 @@ __memcg_kmem_newpage_charge(gfp_t gfp, struct mem_cgroup **_memcg, int order)
         /*
          * Disabling accounting is only relevant for some specific memcg
          * internal allocations. Therefore we would initially not have such
-         * check here, since direct calls to the page allocator that are marked
-         * with GFP_KMEMCG only happen outside memcg core. We are mostly
-         * concerned with cache allocations, and by having this test at
-         * memcg_kmem_get_cache, we are already able to relay the allocation to
-         * the root cache and bypass the memcg cache altogether.
+         * check here, since direct calls to the page allocator that are
+         * accounted to kmemcg (alloc_kmem_pages and friends) only happen
+         * outside memcg core. We are mostly concerned with cache allocations,
+         * and by having this test at memcg_kmem_get_cache, we are already able
+         * to relay the allocation to the root cache and bypass the memcg cache
+         * altogether.
          *
          * There is one exception, though: the SLUB allocator does not create
          * large order caches, but rather service large kmallocs directly from
@@ -3631,7 +3522,7 @@ void __memcg_kmem_uncharge_pages(struct page *page, int order)
         memcg_uncharge_kmem(memcg, PAGE_SIZE << order);
 }
 #else
-static inline void mem_cgroup_destroy_all_caches(struct mem_cgroup *memcg)
+static inline void memcg_unregister_all_caches(struct mem_cgroup *memcg)
 {
 }
 #endif /* CONFIG_MEMCG_KMEM */
@@ -4784,9 +4675,9 @@ static void mem_cgroup_force_empty_list(struct mem_cgroup *memcg,
                 if (mem_cgroup_move_parent(page, pc, memcg)) {
                         /* found lock contention or "pc" is obsolete. */
                         busy = page;
-                        cond_resched();
                 } else
                         busy = NULL;
+                cond_resched();
         } while (!list_empty(list));
 }
 
@@ -5062,13 +4953,14 @@ static int __memcg_activate_kmem(struct mem_cgroup *memcg,
          * Make sure we have enough space for this cgroup in each root cache's
          * memcg_params.
          */
+        mutex_lock(&memcg_slab_mutex);
         err = memcg_update_all_caches(memcg_id + 1);
+        mutex_unlock(&memcg_slab_mutex);
         if (err)
                 goto out_rmid;
 
         memcg->kmemcg_id = memcg_id;
         INIT_LIST_HEAD(&memcg->memcg_slab_caches);
-        mutex_init(&memcg->slab_caches_mutex);
 
         /*
          * We couldn't have accounted to this cgroup, because it hasn't got the
@@ -5443,22 +5335,14 @@ static int mem_cgroup_swappiness_write(struct cgroup_subsys_state *css,
                                        struct cftype *cft, u64 val)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
-        struct mem_cgroup *parent = mem_cgroup_from_css(css_parent(&memcg->css));
 
-        if (val > 100 || !parent)
+        if (val > 100)
                 return -EINVAL;
 
-        mutex_lock(&memcg_create_mutex);
-
-        /* If under hierarchy, only empty-root can set this value */
-        if ((parent->use_hierarchy) || memcg_has_children(memcg)) {
-                mutex_unlock(&memcg_create_mutex);
-                return -EINVAL;
-        }
-
-        memcg->swappiness = val;
-
-        mutex_unlock(&memcg_create_mutex);
+        if (css_parent(css))
+                memcg->swappiness = val;
+        else
+                vm_swappiness = val;
 
         return 0;
 }
@@ -5790,22 +5674,15 @@ static int mem_cgroup_oom_control_write(struct cgroup_subsys_state *css,
         struct cftype *cft, u64 val)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
-        struct mem_cgroup *parent = mem_cgroup_from_css(css_parent(&memcg->css));
 
         /* cannot set to root cgroup and only 0 and 1 are allowed */
-        if (!parent || !((val == 0) || (val == 1)))
+        if (!css_parent(css) || !((val == 0) || (val == 1)))
                 return -EINVAL;
 
-        mutex_lock(&memcg_create_mutex);
-        /* oom-kill-disable is a flag for subhierarchy. */
-        if ((parent->use_hierarchy) || memcg_has_children(memcg)) {
-                mutex_unlock(&memcg_create_mutex);
-                return -EINVAL;
-        }
         memcg->oom_kill_disable = val;
         if (!val)
                 memcg_oom_recover(memcg);
-        mutex_unlock(&memcg_create_mutex);
+
         return 0;
 }
 
@@ -6491,7 +6368,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
         css_for_each_descendant_post(iter, css)
                 mem_cgroup_reparent_charges(mem_cgroup_from_css(iter));
 
-        mem_cgroup_destroy_all_caches(memcg);
+        memcg_unregister_all_caches(memcg);
         vmpressure_cleanup(&memcg->vmpressure);
 }
 
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 9ccef39a9de2..cd8989c1027e 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -204,9 +204,9 @@ static int kill_proc(struct task_struct *t, unsigned long addr, int trapno,
 #endif
         si.si_addr_lsb = compound_order(compound_head(page)) + PAGE_SHIFT;
 
-        if ((flags & MF_ACTION_REQUIRED) && t == current) {
+        if ((flags & MF_ACTION_REQUIRED) && t->mm == current->mm) {
                 si.si_code = BUS_MCEERR_AR;
-                ret = force_sig_info(SIGBUS, &si, t);
+                ret = force_sig_info(SIGBUS, &si, current);
         } else {
                 /*
                  * Don't use force here, it's convenient if the signal
@@ -380,20 +380,51 @@ static void kill_procs(struct list_head *to_kill, int forcekill, int trapno,
         }
 }
 
-static int task_early_kill(struct task_struct *tsk)
+/*
+ * Find a dedicated thread which is supposed to handle SIGBUS(BUS_MCEERR_AO)
+ * on behalf of the thread group. Return task_struct of the (first found)
+ * dedicated thread if found, and return NULL otherwise.
+ *
+ * We already hold read_lock(&tasklist_lock) in the caller, so we don't
+ * have to call rcu_read_lock/unlock() in this function.
+ */
+static struct task_struct *find_early_kill_thread(struct task_struct *tsk)
 {
+        struct task_struct *t;
+
+        for_each_thread(tsk, t)
+                if ((t->flags & PF_MCE_PROCESS) && (t->flags & PF_MCE_EARLY))
+                        return t;
+        return NULL;
+}
+
+/*
+ * Determine whether a given process is "early kill" process which expects
+ * to be signaled when some page under the process is hwpoisoned.
+ * Return task_struct of the dedicated thread (main thread unless explicitly
+ * specified) if the process is "early kill," and otherwise returns NULL.
+ */
+static struct task_struct *task_early_kill(struct task_struct *tsk,
+                                           int force_early)
+{
+        struct task_struct *t;
         if (!tsk->mm)
-                return 0;
-        if (tsk->flags & PF_MCE_PROCESS)
-                return !!(tsk->flags & PF_MCE_EARLY);
-        return sysctl_memory_failure_early_kill;
+                return NULL;
+        if (force_early)
+                return tsk;
+        t = find_early_kill_thread(tsk);
+        if (t)
+                return t;
+        if (sysctl_memory_failure_early_kill)
+                return tsk;
+        return NULL;
 }
 
 /*
  * Collect processes when the error hit an anonymous page.
  */
 static void collect_procs_anon(struct page *page, struct list_head *to_kill,
-                              struct to_kill **tkc)
+                              struct to_kill **tkc, int force_early)
 {
         struct vm_area_struct *vma;
         struct task_struct *tsk;
@@ -408,16 +439,17 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
         read_lock(&tasklist_lock);
         for_each_process (tsk) {
                 struct anon_vma_chain *vmac;
+                struct task_struct *t = task_early_kill(tsk, force_early);
 
-                if (!task_early_kill(tsk))
+                if (!t)
                         continue;
                 anon_vma_interval_tree_foreach(vmac, &av->rb_root,
                                                pgoff, pgoff) {
                         vma = vmac->vma;
                         if (!page_mapped_in_vma(page, vma))
                                 continue;
-                        if (vma->vm_mm == tsk->mm)
-                                add_to_kill(tsk, page, vma, to_kill, tkc);
+                        if (vma->vm_mm == t->mm)
+                                add_to_kill(t, page, vma, to_kill, tkc);
                 }
         }
         read_unlock(&tasklist_lock);
@@ -428,7 +460,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
  * Collect processes when the error hit a file mapped page.
  */
 static void collect_procs_file(struct page *page, struct list_head *to_kill,
-                              struct to_kill **tkc)
+                              struct to_kill **tkc, int force_early)
 {
         struct vm_area_struct *vma;
         struct task_struct *tsk;
@@ -438,10 +470,10 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill,
         read_lock(&tasklist_lock);
         for_each_process(tsk) {
                 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+                struct task_struct *t = task_early_kill(tsk, force_early);
 
-                if (!task_early_kill(tsk))
+                if (!t)
                         continue;
-
                 vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff,
                                       pgoff) {
                         /*
@@ -451,8 +483,8 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill,
                          * Assume applications who requested early kill want
                          * to be informed of all such data corruptions.
                          */
-                        if (vma->vm_mm == tsk->mm)
-                                add_to_kill(tsk, page, vma, to_kill, tkc);
+                        if (vma->vm_mm == t->mm)
+                                add_to_kill(t, page, vma, to_kill, tkc);
                 }
         }
         read_unlock(&tasklist_lock);
@@ -465,7 +497,8 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill,
  * First preallocate one tokill structure outside the spin locks,
  * so that we can kill at least one process reasonably reliable.
  */
-static void collect_procs(struct page *page, struct list_head *tokill)
+static void collect_procs(struct page *page, struct list_head *tokill,
+                                int force_early)
 {
         struct to_kill *tk;
 
@@ -476,9 +509,9 @@ static void collect_procs(struct page *page, struct list_head *tokill)
         if (!tk)
                 return;
         if (PageAnon(page))
-                collect_procs_anon(page, tokill, &tk);
+                collect_procs_anon(page, tokill, &tk, force_early);
         else
-                collect_procs_file(page, tokill, &tk);
+                collect_procs_file(page, tokill, &tk, force_early);
         kfree(tk);
 }
 
@@ -963,7 +996,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
          * there's nothing that can be done.
          */
         if (kill)
-                collect_procs(ppage, &tokill);
+                collect_procs(ppage, &tokill, flags & MF_ACTION_REQUIRED);
 
         ret = try_to_unmap(ppage, ttu);
         if (ret != SWAP_SUCCESS)
@@ -1132,11 +1165,6 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                 }
         }
 
-        /*
-         * Lock the page and wait for writeback to finish.
-         * It's very difficult to mess with pages currently under IO
-         * and in many cases impossible, so we just avoid it here.
-         */
         lock_page(hpage);
 
         /*
@@ -1186,6 +1214,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
         if (PageHuge(p))
                 set_page_hwpoison_huge_page(hpage);
 
+        /*
+         * It's very difficult to mess with pages currently under IO
+         * and in many cases impossible, so we just avoid it here.
+         */
         wait_on_page_writeback(p);
 
         /*
@@ -1298,7 +1330,7 @@ static void memory_failure_work_func(struct work_struct *work)
         unsigned long proc_flags;
         int gotten;
 
-        mf_cpu = &__get_cpu_var(memory_failure_cpu);
+        mf_cpu = this_cpu_ptr(&memory_failure_cpu);
         for (;;) {
                 spin_lock_irqsave(&mf_cpu->lock, proc_flags);
                 gotten = kfifo_get(&mf_cpu->fifo, &entry);
@@ -1503,7 +1535,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
 
         /* Keep page count to indicate a given hugepage is isolated. */
         list_move(&hpage->lru, &pagelist);
-        ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
+        ret = migrate_pages(&pagelist, new_page, NULL, MPOL_MF_MOVE_ALL,
                                 MIGRATE_SYNC, MR_MEMORY_FAILURE);
         if (ret) {
                 pr_info("soft offline: %#lx: migration failed %d, type %lx\n",
@@ -1584,7 +1616,7 @@ static int __soft_offline_page(struct page *page, int flags)
                 inc_zone_page_state(page, NR_ISOLATED_ANON +
                                         page_is_file_cache(page));
                 list_add(&page->lru, &pagelist);
-                ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
+                ret = migrate_pages(&pagelist, new_page, NULL, MPOL_MF_MOVE_ALL,
                                         MIGRATE_SYNC, MR_MEMORY_FAILURE);
                 if (ret) {
                         if (!list_empty(&pagelist)) {
@@ -1664,11 +1696,7 @@ int soft_offline_page(struct page *page, int flags)
                 }
         }
 
-        /*
-         * The lock_memory_hotplug prevents a race with memory hotplug.
-         * This is a big hammer, a better would be nicer.
-         */
-        lock_memory_hotplug();
+        get_online_mems();
 
         /*
          * Isolate the page, so that it doesn't get reallocated if it
@@ -1679,7 +1707,7 @@ int soft_offline_page(struct page *page, int flags)
                 set_migratetype_isolate(page, true);
 
         ret = get_any_page(page, pfn, flags);
-        unlock_memory_hotplug();
+        put_online_mems();
         if (ret > 0) { /* for in-use pages */
                 if (PageHuge(page))
                         ret = soft_offline_huge_page(page, flags);
diff --git a/mm/memory.c b/mm/memory.c
index e302ae1dcce0..d67fd9fcf1f2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -698,11 +698,6 @@ static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr,
         add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
 }
 
-static inline bool is_cow_mapping(vm_flags_t flags)
-{
-        return (flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE;
-}
-
 /*
  * vm_normal_page -- This function gets the "struct page" associated with a pte.
  *
@@ -756,7 +751,7 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
         unsigned long pfn = pte_pfn(pte);
 
         if (HAVE_PTE_SPECIAL) {
-                if (likely(!pte_special(pte)))
+                if (likely(!pte_special(pte) || pte_numa(pte)))
                         goto check_pfn;
                 if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
                         return NULL;
@@ -782,14 +777,15 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
                 }
         }
 
-        if (is_zero_pfn(pfn))
-                return NULL;
 check_pfn:
         if (unlikely(pfn > highest_memmap_pfn)) {
                 print_bad_pte(vma, addr, pte, NULL);
                 return NULL;
         }
 
+        if (is_zero_pfn(pfn))
+                return NULL;
+
         /*
          * NOTE! We still have PageReserved() pages in the page tables.
          * eg. VDSO mappings can cause them to exist.
@@ -1457,646 +1453,6 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
 }
 EXPORT_SYMBOL_GPL(zap_vma_ptes);
 
-/**
- * follow_page_mask - look up a page descriptor from a user-virtual address
- * @vma: vm_area_struct mapping @address
- * @address: virtual address to look up
- * @flags: flags modifying lookup behaviour
- * @page_mask: on output, *page_mask is set according to the size of the page
- *
- * @flags can have FOLL_ flags set, defined in <linux/mm.h>
- *
- * Returns the mapped (struct page *), %NULL if no mapping exists, or
- * an error pointer if there is a mapping to something not represented
- * by a page descriptor (see also vm_normal_page()).
- */
-struct page *follow_page_mask(struct vm_area_struct *vma,
-                              unsigned long address, unsigned int flags,
-                              unsigned int *page_mask)
-{
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *ptep, pte;
-        spinlock_t *ptl;
-        struct page *page;
-        struct mm_struct *mm = vma->vm_mm;
-
-        *page_mask = 0;
-
-        page = follow_huge_addr(mm, address, flags & FOLL_WRITE);
-        if (!IS_ERR(page)) {
-                BUG_ON(flags & FOLL_GET);
-                goto out;
-        }
-
-        page = NULL;
-        pgd = pgd_offset(mm, address);
-        if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
-                goto no_page_table;
-
-        pud = pud_offset(pgd, address);
-        if (pud_none(*pud))
-                goto no_page_table;
-        if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) {
-                if (flags & FOLL_GET)
-                        goto out;
-                page = follow_huge_pud(mm, address, pud, flags & FOLL_WRITE);
-                goto out;
-        }
-        if (unlikely(pud_bad(*pud)))
-                goto no_page_table;
-
-        pmd = pmd_offset(pud, address);
-        if (pmd_none(*pmd))
-                goto no_page_table;
-        if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) {
-                page = follow_huge_pmd(mm, address, pmd, flags & FOLL_WRITE);
-                if (flags & FOLL_GET) {
-                        /*
-                         * Refcount on tail pages are not well-defined and
-                         * shouldn't be taken. The caller should handle a NULL
-                         * return when trying to follow tail pages.
-                         */
-                        if (PageHead(page))
-                                get_page(page);
-                        else {
-                                page = NULL;
-                                goto out;
-                        }
-                }
-                goto out;
-        }
-        if ((flags & FOLL_NUMA) && pmd_numa(*pmd))
-                goto no_page_table;
-        if (pmd_trans_huge(*pmd)) {
-                if (flags & FOLL_SPLIT) {
-                        split_huge_page_pmd(vma, address, pmd);
-                        goto split_fallthrough;
-                }
-                ptl = pmd_lock(mm, pmd);
-                if (likely(pmd_trans_huge(*pmd))) {
-                        if (unlikely(pmd_trans_splitting(*pmd))) {
-                                spin_unlock(ptl);
-                                wait_split_huge_page(vma->anon_vma, pmd);
-                        } else {
-                                page = follow_trans_huge_pmd(vma, address,
-                                                             pmd, flags);
-                                spin_unlock(ptl);
-                                *page_mask = HPAGE_PMD_NR - 1;
-                                goto out;
-                        }
-                } else
-                        spin_unlock(ptl);
-                /* fall through */
-        }
-split_fallthrough:
-        if (unlikely(pmd_bad(*pmd)))
-                goto no_page_table;
-
-        ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
-
-        pte = *ptep;
-        if (!pte_present(pte)) {
-                swp_entry_t entry;
-                /*
-                 * KSM's break_ksm() relies upon recognizing a ksm page
-                 * even while it is being migrated, so for that case we
-                 * need migration_entry_wait().
-                 */
-                if (likely(!(flags & FOLL_MIGRATION)))
-                        goto no_page;
-                if (pte_none(pte) || pte_file(pte))
-                        goto no_page;
-                entry = pte_to_swp_entry(pte);
-                if (!is_migration_entry(entry))
-                        goto no_page;
-                pte_unmap_unlock(ptep, ptl);
-                migration_entry_wait(mm, pmd, address);
-                goto split_fallthrough;
-        }
-        if ((flags & FOLL_NUMA) && pte_numa(pte))
-                goto no_page;
-        if ((flags & FOLL_WRITE) && !pte_write(pte))
-                goto unlock;
-
-        page = vm_normal_page(vma, address, pte);
-        if (unlikely(!page)) {
-                if ((flags & FOLL_DUMP) ||
-                    !is_zero_pfn(pte_pfn(pte)))
-                        goto bad_page;
-                page = pte_page(pte);
-        }
-
-        if (flags & FOLL_GET)
-                get_page_foll(page);
-        if (flags & FOLL_TOUCH) {
-                if ((flags & FOLL_WRITE) &&
-                    !pte_dirty(pte) && !PageDirty(page))
-                        set_page_dirty(page);
-                /*
-                 * pte_mkyoung() would be more correct here, but atomic care
-                 * is needed to avoid losing the dirty bit: it is easier to use
-                 * mark_page_accessed().
-                 */
-                mark_page_accessed(page);
-        }
-        if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
-                /*
-                 * The preliminary mapping check is mainly to avoid the
-                 * pointless overhead of lock_page on the ZERO_PAGE
-                 * which might bounce very badly if there is contention.
-                 *
-                 * If the page is already locked, we don't need to
-                 * handle it now - vmscan will handle it later if and
-                 * when it attempts to reclaim the page.
-                 */
-                if (page->mapping && trylock_page(page)) {
-                        lru_add_drain();  /* push cached pages to LRU */
-                        /*
-                         * Because we lock page here, and migration is
-                         * blocked by the pte's page reference, and we
-                         * know the page is still mapped, we don't even
-                         * need to check for file-cache page truncation.
-                         */
-                        mlock_vma_page(page);
-                        unlock_page(page);
-                }
-        }
-unlock:
-        pte_unmap_unlock(ptep, ptl);
-out:
-        return page;
-
-bad_page:
-        pte_unmap_unlock(ptep, ptl);
-        return ERR_PTR(-EFAULT);
-
-no_page:
-        pte_unmap_unlock(ptep, ptl);
-        if (!pte_none(pte))
-                return page;
-
-no_page_table:
-        /*
-         * When core dumping an enormous anonymous area that nobody
-         * has touched so far, we don't want to allocate unnecessary pages or
-         * page tables.  Return error instead of NULL to skip handle_mm_fault,
-         * then get_dump_page() will return NULL to leave a hole in the dump.
-         * But we can only make this optimization where a hole would surely
-         * be zero-filled if handle_mm_fault() actually did handle it.
-         */
-        if ((flags & FOLL_DUMP) &&
-            (!vma->vm_ops || !vma->vm_ops->fault))
-                return ERR_PTR(-EFAULT);
-        return page;
-}
-
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-        return stack_guard_page_start(vma, addr) ||
-               stack_guard_page_end(vma, addr+PAGE_SIZE);
-}
-
-/**
- * __get_user_pages() - pin user pages in memory
- * @tsk:        task_struct of target task
- * @mm:         mm_struct of target mm
- * @start:      starting user address
- * @nr_pages:   number of pages from start to pin
- * @gup_flags:  flags modifying pin behaviour
- * @pages:      array that receives pointers to the pages pinned.
- *              Should be at least nr_pages long. Or NULL, if caller
- *              only intends to ensure the pages are faulted in.
- * @vmas:       array of pointers to vmas corresponding to each page.
- *              Or NULL if the caller does not require them.
- * @nonblocking: whether waiting for disk IO or mmap_sem contention
- *
- * Returns number of pages pinned. This may be fewer than the number
- * requested. If nr_pages is 0 or negative, returns 0. If no pages
- * were pinned, returns -errno. Each page returned must be released
- * with a put_page() call when it is finished with. vmas will only
- * remain valid while mmap_sem is held.
- *
- * Must be called with mmap_sem held for read or write.
- *
- * __get_user_pages walks a process's page tables and takes a reference to
- * each struct page that each user address corresponds to at a given
- * instant. That is, it takes the page that would be accessed if a user
- * thread accesses the given user virtual address at that instant.
- *
- * This does not guarantee that the page exists in the user mappings when
- * __get_user_pages returns, and there may even be a completely different
- * page there in some cases (eg. if mmapped pagecache has been invalidated
- * and subsequently re faulted). However it does guarantee that the page
- * won't be freed completely. And mostly callers simply care that the page
- * contains data that was valid *at some point in time*. Typically, an IO
- * or similar operation cannot guarantee anything stronger anyway because
- * locks can't be held over the syscall boundary.
- *
- * If @gup_flags & FOLL_WRITE == 0, the page must not be written to. If
- * the page is written to, set_page_dirty (or set_page_dirty_lock, as
- * appropriate) must be called after the page is finished with, and
- * before put_page is called.
- *
- * If @nonblocking != NULL, __get_user_pages will not wait for disk IO
- * or mmap_sem contention, and if waiting is needed to pin all pages,
- * *@nonblocking will be set to 0.
- *
- * In most cases, get_user_pages or get_user_pages_fast should be used
- * instead of __get_user_pages. __get_user_pages should be used only if
- * you need some special @gup_flags.
- */
-long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
-                unsigned long start, unsigned long nr_pages,
-                unsigned int gup_flags, struct page **pages,
-                struct vm_area_struct **vmas, int *nonblocking)
-{
-        long i;
-        unsigned long vm_flags;
-        unsigned int page_mask;
-
-        if (!nr_pages)
-                return 0;
-
-        VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET));
-
-        /*
-         * If FOLL_FORCE and FOLL_NUMA are both set, handle_mm_fault
-         * would be called on PROT_NONE ranges. We must never invoke
-         * handle_mm_fault on PROT_NONE ranges or the NUMA hinting
-         * page faults would unprotect the PROT_NONE ranges if
-         * _PAGE_NUMA and _PAGE_PROTNONE are sharing the same pte/pmd
-         * bitflag. So to avoid that, don't set FOLL_NUMA if
-         * FOLL_FORCE is set.
-         */
-        if (!(gup_flags & FOLL_FORCE))
-                gup_flags |= FOLL_NUMA;
-
-        i = 0;
-
-        do {
-                struct vm_area_struct *vma;
-
-                vma = find_extend_vma(mm, start);
-                if (!vma && in_gate_area(mm, start)) {
-                        unsigned long pg = start & PAGE_MASK;
-                        pgd_t *pgd;
-                        pud_t *pud;
-                        pmd_t *pmd;
-                        pte_t *pte;
-
-                        /* user gate pages are read-only */
-                        if (gup_flags & FOLL_WRITE)
-                                goto efault;
-                        if (pg > TASK_SIZE)
-                                pgd = pgd_offset_k(pg);
-                        else
-                                pgd = pgd_offset_gate(mm, pg);
-                        BUG_ON(pgd_none(*pgd));
-                        pud = pud_offset(pgd, pg);
-                        BUG_ON(pud_none(*pud));
-                        pmd = pmd_offset(pud, pg);
-                        if (pmd_none(*pmd))
-                                goto efault;
-                        VM_BUG_ON(pmd_trans_huge(*pmd));
-                        pte = pte_offset_map(pmd, pg);
-                        if (pte_none(*pte)) {
-                                pte_unmap(pte);
-                                goto efault;
-                        }
-                        vma = get_gate_vma(mm);
-                        if (pages) {
-                                struct page *page;
-
-                                page = vm_normal_page(vma, start, *pte);
-                                if (!page) {
-                                        if (!(gup_flags & FOLL_DUMP) &&
-                                             is_zero_pfn(pte_pfn(*pte)))
-                                                page = pte_page(*pte);
-                                        else {
-                                                pte_unmap(pte);
-                                                goto efault;
-                                        }
-                                }
-                                pages[i] = page;
-                                get_page(page);
-                        }
-                        pte_unmap(pte);
-                        page_mask = 0;
-                        goto next_page;
-                }
-
-                if (!vma)
-                        goto efault;
-                vm_flags = vma->vm_flags;
-                if (vm_flags & (VM_IO | VM_PFNMAP))
-                        goto efault;
-
-                if (gup_flags & FOLL_WRITE) {
-                        if (!(vm_flags & VM_WRITE)) {
-                                if (!(gup_flags & FOLL_FORCE))
-                                        goto efault;
-                                /*
-                                 * We used to let the write,force case do COW
-                                 * in a VM_MAYWRITE VM_SHARED !VM_WRITE vma, so
-                                 * ptrace could set a breakpoint in a read-only
-                                 * mapping of an executable, without corrupting
-                                 * the file (yet only when that file had been
-                                 * opened for writing!).  Anon pages in shared
-                                 * mappings are surprising: now just reject it.
-                                 */
-                                if (!is_cow_mapping(vm_flags)) {
-                                        WARN_ON_ONCE(vm_flags & VM_MAYWRITE);
-                                        goto efault;
-                                }
-                        }
-                } else {
-                        if (!(vm_flags & VM_READ)) {
-                                if (!(gup_flags & FOLL_FORCE))
-                                        goto efault;
-                                /*
-                                 * Is there actually any vma we can reach here
-                                 * which does not have VM_MAYREAD set?
-                                 */
-                                if (!(vm_flags & VM_MAYREAD))
-                                        goto efault;
-                        }
-                }
-
-                if (is_vm_hugetlb_page(vma)) {
-                        i = follow_hugetlb_page(mm, vma, pages, vmas,
-                                        &start, &nr_pages, i, gup_flags);
-                        continue;
-                }
-
-                do {
-                        struct page *page;
-                        unsigned int foll_flags = gup_flags;
-                        unsigned int page_increm;
-
-                        /*
-                         * If we have a pending SIGKILL, don't keep faulting
-                         * pages and potentially allocating memory.
-                         */
-                        if (unlikely(fatal_signal_pending(current)))
-                                return i ? i : -ERESTARTSYS;
-
-                        cond_resched();
-                        while (!(page = follow_page_mask(vma, start,
-                                                foll_flags, &page_mask))) {
-                                int ret;
-                                unsigned int fault_flags = 0;
-
-                                /* For mlock, just skip the stack guard page. */
-                                if (foll_flags & FOLL_MLOCK) {
-                                        if (stack_guard_page(vma, start))
-                                                goto next_page;
-                                }
-                                if (foll_flags & FOLL_WRITE)
-                                        fault_flags |= FAULT_FLAG_WRITE;
-                                if (nonblocking)
-                                        fault_flags |= FAULT_FLAG_ALLOW_RETRY;
-                                if (foll_flags & FOLL_NOWAIT)
-                                        fault_flags |= (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT);
-
-                                ret = handle_mm_fault(mm, vma, start,
-                                                        fault_flags);
-
-                                if (ret & VM_FAULT_ERROR) {
-                                        if (ret & VM_FAULT_OOM)
-                                                return i ? i : -ENOMEM;
-                                        if (ret & (VM_FAULT_HWPOISON |
-                                                   VM_FAULT_HWPOISON_LARGE)) {
-                                                if (i)
-                                                        return i;
-                                                else if (gup_flags & FOLL_HWPOISON)
-                                                        return -EHWPOISON;
-                                                else
-                                                        return -EFAULT;
-                                        }
-                                        if (ret & VM_FAULT_SIGBUS)
-                                                goto efault;
-                                        BUG();
-                                }
-
-                                if (tsk) {
-                                        if (ret & VM_FAULT_MAJOR)
-                                                tsk->maj_flt++;
-                                        else
-                                                tsk->min_flt++;
-                                }
-
-                                if (ret & VM_FAULT_RETRY) {
-                                        if (nonblocking)
-                                                *nonblocking = 0;
-                                        return i;
-                                }
-
-                                /*
-                                 * The VM_FAULT_WRITE bit tells us that
-                                 * do_wp_page has broken COW when necessary,
-                                 * even if maybe_mkwrite decided not to set
-                                 * pte_write. We can thus safely do subsequent
-                                 * page lookups as if they were reads. But only
-                                 * do so when looping for pte_write is futile:
-                                 * in some cases userspace may also be wanting
-                                 * to write to the gotten user page, which a
-                                 * read fault here might prevent (a readonly
-                                 * page might get reCOWed by userspace write).
-                                 */
-                                if ((ret & VM_FAULT_WRITE) &&
-                                    !(vma->vm_flags & VM_WRITE))
-                                        foll_flags &= ~FOLL_WRITE;
-
-                                cond_resched();
-                        }
-                        if (IS_ERR(page))
-                                return i ? i : PTR_ERR(page);
-                        if (pages) {
-                                pages[i] = page;
-
-                                flush_anon_page(vma, page, start);
-                                flush_dcache_page(page);
-                                page_mask = 0;
-                        }
-next_page:
-                        if (vmas) {
-                                vmas[i] = vma;
-                                page_mask = 0;
-                        }
-                        page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask);
-                        if (page_increm > nr_pages)
-                                page_increm = nr_pages;
-                        i += page_increm;
-                        start += page_increm * PAGE_SIZE;
-                        nr_pages -= page_increm;
-                } while (nr_pages && start < vma->vm_end);
-        } while (nr_pages);
-        return i;
-efault:
-        return i ? : -EFAULT;
-}
-EXPORT_SYMBOL(__get_user_pages);
-
-/*
- * fixup_user_fault() - manually resolve a user page fault
- * @tsk:        the task_struct to use for page fault accounting, or
- *              NULL if faults are not to be recorded.
- * @mm:         mm_struct of target mm
- * @address:    user address
- * @fault_flags:flags to pass down to handle_mm_fault()
- *
- * This is meant to be called in the specific scenario where for locking reasons
- * we try to access user memory in atomic context (within a pagefault_disable()
- * section), this returns -EFAULT, and we want to resolve the user fault before
- * trying again.
- *
- * Typically this is meant to be used by the futex code.
- *
- * The main difference with get_user_pages() is that this function will
- * unconditionally call handle_mm_fault() which will in turn perform all the
- * necessary SW fixup of the dirty and young bits in the PTE, while
- * handle_mm_fault() only guarantees to update these in the struct page.
- *
- * This is important for some architectures where those bits also gate the
- * access permission to the page because they are maintained in software.  On
- * such architectures, gup() will not be enough to make a subsequent access
- * succeed.
- *
- * This should be called with the mm_sem held for read.
- */
-int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
-                     unsigned long address, unsigned int fault_flags)
-{
-        struct vm_area_struct *vma;
-        vm_flags_t vm_flags;
-        int ret;
-
-        vma = find_extend_vma(mm, address);
-        if (!vma || address < vma->vm_start)
-                return -EFAULT;
-
-        vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
-        if (!(vm_flags & vma->vm_flags))
-                return -EFAULT;
-
-        ret = handle_mm_fault(mm, vma, address, fault_flags);
-        if (ret & VM_FAULT_ERROR) {
-                if (ret & VM_FAULT_OOM)
-                        return -ENOMEM;
-                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
-                        return -EHWPOISON;
-                if (ret & VM_FAULT_SIGBUS)
-                        return -EFAULT;
-                BUG();
-        }
-        if (tsk) {
-                if (ret & VM_FAULT_MAJOR)
-                        tsk->maj_flt++;
-                else
-                        tsk->min_flt++;
-        }
-        return 0;
-}
-
-/*
- * get_user_pages() - pin user pages in memory
- * @tsk:        the task_struct to use for page fault accounting, or
- *              NULL if faults are not to be recorded.
- * @mm:         mm_struct of target mm
- * @start:      starting user address
- * @nr_pages:   number of pages from start to pin
- * @write:      whether pages will be written to by the caller
- * @force:      whether to force access even when user mapping is currently
- *              protected (but never forces write access to shared mapping).
- * @pages:      array that receives pointers to the pages pinned.
- *              Should be at least nr_pages long. Or NULL, if caller
- *              only intends to ensure the pages are faulted in.
- * @vmas:       array of pointers to vmas corresponding to each page.
- *              Or NULL if the caller does not require them.
- *
- * Returns number of pages pinned. This may be fewer than the number
- * requested. If nr_pages is 0 or negative, returns 0. If no pages
- * were pinned, returns -errno. Each page returned must be released
- * with a put_page() call when it is finished with. vmas will only
- * remain valid while mmap_sem is held.
- *
- * Must be called with mmap_sem held for read or write.
- *
- * get_user_pages walks a process's page tables and takes a reference to
- * each struct page that each user address corresponds to at a given
- * instant. That is, it takes the page that would be accessed if a user
- * thread accesses the given user virtual address at that instant.
- *
- * This does not guarantee that the page exists in the user mappings when
- * get_user_pages returns, and there may even be a completely different
- * page there in some cases (eg. if mmapped pagecache has been invalidated
- * and subsequently re faulted). However it does guarantee that the page
- * won't be freed completely. And mostly callers simply care that the page
- * contains data that was valid *at some point in time*. Typically, an IO
- * or similar operation cannot guarantee anything stronger anyway because
- * locks can't be held over the syscall boundary.
- *
- * If write=0, the page must not be written to. If the page is written to,
- * set_page_dirty (or set_page_dirty_lock, as appropriate) must be called
- * after the page is finished with, and before put_page is called.
- *
- * get_user_pages is typically used for fewer-copy IO operations, to get a
- * handle on the memory by some means other than accesses via the user virtual
- * addresses. The pages may be submitted for DMA to devices or accessed via
- * their kernel linear mapping (via the kmap APIs). Care should be taken to
- * use the correct cache flushing APIs.
- *
- * See also get_user_pages_fast, for performance critical applications.
- */
-long get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
-                unsigned long start, unsigned long nr_pages, int write,
-                int force, struct page **pages, struct vm_area_struct **vmas)
-{
-        int flags = FOLL_TOUCH;
-
-        if (pages)
-                flags |= FOLL_GET;
-        if (write)
-                flags |= FOLL_WRITE;
-        if (force)
-                flags |= FOLL_FORCE;
-
-        return __get_user_pages(tsk, mm, start, nr_pages, flags, pages, vmas,
-                                NULL);
-}
-EXPORT_SYMBOL(get_user_pages);
-
-/**
- * get_dump_page() - pin user page in memory while writing it to core dump
- * @addr: user address
- *
- * Returns struct page pointer of user page pinned for dump,
- * to be freed afterwards by page_cache_release() or put_page().
- *
- * Returns NULL on any kind of failure - a hole must then be inserted into
- * the corefile, to preserve alignment with its headers; and also returns
- * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found -
- * allowing a hole to be left in the corefile to save diskspace.
- *
- * Called without mmap_sem, but after all other threads have been killed.
- */
-#ifdef CONFIG_ELF_CORE
-struct page *get_dump_page(unsigned long addr)
-{
-        struct vm_area_struct *vma;
-        struct page *page;
-
-        if (__get_user_pages(current, current->mm, addr, 1,
-                             FOLL_FORCE | FOLL_DUMP | FOLL_GET, &page, &vma,
-                             NULL) < 1)
-                return NULL;
-        flush_cache_page(vma, addr, page_to_pfn(page));
-        return page;
-}
-#endif /* CONFIG_ELF_CORE */
-
 pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                         spinlock_t **ptl)
 {
@@ -3402,65 +2758,76 @@ void do_set_pte(struct vm_area_struct *vma, unsigned long address,
         update_mmu_cache(vma, address, pte);
 }
 
-#define FAULT_AROUND_ORDER 4
+static unsigned long fault_around_bytes = 65536;
+
+/*
+ * fault_around_pages() and fault_around_mask() round down fault_around_bytes
+ * to nearest page order. It's what do_fault_around() expects to see.
+ */
+static inline unsigned long fault_around_pages(void)
+{
+        return rounddown_pow_of_two(fault_around_bytes) / PAGE_SIZE;
+}
+
+static inline unsigned long fault_around_mask(void)
+{
+        return ~(rounddown_pow_of_two(fault_around_bytes) - 1) & PAGE_MASK;
+}
 
-#ifdef CONFIG_DEBUG_FS
-static unsigned int fault_around_order = FAULT_AROUND_ORDER;
 
-static int fault_around_order_get(void *data, u64 *val)
+#ifdef CONFIG_DEBUG_FS
+static int fault_around_bytes_get(void *data, u64 *val)
 {
-        *val = fault_around_order;
+        *val = fault_around_bytes;
         return 0;
 }
 
-static int fault_around_order_set(void *data, u64 val)
+static int fault_around_bytes_set(void *data, u64 val)
 {
-        BUILD_BUG_ON((1UL << FAULT_AROUND_ORDER) > PTRS_PER_PTE);
-        if (1UL << val > PTRS_PER_PTE)
+        if (val / PAGE_SIZE > PTRS_PER_PTE)
                 return -EINVAL;
-        fault_around_order = val;
+        fault_around_bytes = val;
         return 0;
 }
-DEFINE_SIMPLE_ATTRIBUTE(fault_around_order_fops,
-                fault_around_order_get, fault_around_order_set, "%llu\n");
+DEFINE_SIMPLE_ATTRIBUTE(fault_around_bytes_fops,
+                fault_around_bytes_get, fault_around_bytes_set, "%llu\n");
 
 static int __init fault_around_debugfs(void)
 {
         void *ret;
 
-        ret = debugfs_create_file("fault_around_order", 0644, NULL, NULL,
-                        &fault_around_order_fops);
+        ret = debugfs_create_file("fault_around_bytes", 0644, NULL, NULL,
+                        &fault_around_bytes_fops);
         if (!ret)
-                pr_warn("Failed to create fault_around_order in debugfs");
+                pr_warn("Failed to create fault_around_bytes in debugfs");
         return 0;
 }
 late_initcall(fault_around_debugfs);
-
-static inline unsigned long fault_around_pages(void)
-{
-        return 1UL << fault_around_order;
-}
-
-static inline unsigned long fault_around_mask(void)
-{
-        return ~((1UL << (PAGE_SHIFT + fault_around_order)) - 1);
-}
-#else
-static inline unsigned long fault_around_pages(void)
-{
-        unsigned long nr_pages;
-
-        nr_pages = 1UL << FAULT_AROUND_ORDER;
-        BUILD_BUG_ON(nr_pages > PTRS_PER_PTE);
-        return nr_pages;
-}
-
-static inline unsigned long fault_around_mask(void)
-{
-        return ~((1UL << (PAGE_SHIFT + FAULT_AROUND_ORDER)) - 1);
-}
 #endif
 
+/*
+ * do_fault_around() tries to map few pages around the fault address. The hope
+ * is that the pages will be needed soon and this will lower the number of
+ * faults to handle.
+ *
+ * It uses vm_ops->map_pages() to map the pages, which skips the page if it's
+ * not ready to be mapped: not up-to-date, locked, etc.
+ *
+ * This function is called with the page table lock taken. In the split ptlock
+ * case the page table lock only protects only those entries which belong to
+ * the page table corresponding to the fault address.
+ *
+ * This function doesn't cross the VMA boundaries, in order to call map_pages()
+ * only once.
+ *
+ * fault_around_pages() defines how many pages we'll try to map.
+ * do_fault_around() expects it to return a power of two less than or equal to
+ * PTRS_PER_PTE.
+ *
+ * The virtual address of the area that we map is naturally aligned to the
+ * fault_around_pages() value (and therefore to page order).  This way it's
+ * easier to guarantee that we don't cross page table boundaries.
+ */
 static void do_fault_around(struct vm_area_struct *vma, unsigned long address,
                 pte_t *pte, pgoff_t pgoff, unsigned int flags)
 {
@@ -3476,7 +2843,7 @@ static void do_fault_around(struct vm_area_struct *vma, unsigned long address,
 
         /*
          *  max_pgoff is either end of page table or end of vma
-         *  or fault_around_pages() from pgoff, depending what is neast.
+         *  or fault_around_pages() from pgoff, depending what is nearest.
          */
         max_pgoff = pgoff - ((start_addr >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)) +
                 PTRS_PER_PTE - 1;
@@ -3515,7 +2882,7 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * if page by the offset is not ready to be mapped (cold cache or
          * something).
          */
-        if (vma->vm_ops->map_pages) {
+        if (vma->vm_ops->map_pages && fault_around_pages() > 1) {
                 pte = pte_offset_map_lock(mm, pmd, address, &ptl);
                 do_fault_around(vma, address, pte, pgoff, flags);
                 if (!pte_same(*pte, orig_pte))
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a650db29606f..469bbf505f85 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -46,19 +46,84 @@
 static void generic_online_page(struct page *page);
 
 static online_page_callback_t online_page_callback = generic_online_page;
+static DEFINE_MUTEX(online_page_callback_lock);
 
-DEFINE_MUTEX(mem_hotplug_mutex);
+/* The same as the cpu_hotplug lock, but for memory hotplug. */
+static struct {
+        struct task_struct *active_writer;
+        struct mutex lock; /* Synchronizes accesses to refcount, */
+        /*
+         * Also blocks the new readers during
+         * an ongoing mem hotplug operation.
+         */
+        int refcount;
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map dep_map;
+#endif
+} mem_hotplug = {
+        .active_writer = NULL,
+        .lock = __MUTEX_INITIALIZER(mem_hotplug.lock),
+        .refcount = 0,
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        .dep_map = {.name = "mem_hotplug.lock" },
+#endif
+};
+
+/* Lockdep annotations for get/put_online_mems() and mem_hotplug_begin/end() */
+#define memhp_lock_acquire_read() lock_map_acquire_read(&mem_hotplug.dep_map)
+#define memhp_lock_acquire()      lock_map_acquire(&mem_hotplug.dep_map)
+#define memhp_lock_release()      lock_map_release(&mem_hotplug.dep_map)
+
+void get_online_mems(void)
+{
+        might_sleep();
+        if (mem_hotplug.active_writer == current)
+                return;
+        memhp_lock_acquire_read();
+        mutex_lock(&mem_hotplug.lock);
+        mem_hotplug.refcount++;
+        mutex_unlock(&mem_hotplug.lock);
+
+}
 
-void lock_memory_hotplug(void)
+void put_online_mems(void)
 {
-        mutex_lock(&mem_hotplug_mutex);
+        if (mem_hotplug.active_writer == current)
+                return;
+        mutex_lock(&mem_hotplug.lock);
+
+        if (WARN_ON(!mem_hotplug.refcount))
+                mem_hotplug.refcount++; /* try to fix things up */
+
+        if (!--mem_hotplug.refcount && unlikely(mem_hotplug.active_writer))
+                wake_up_process(mem_hotplug.active_writer);
+        mutex_unlock(&mem_hotplug.lock);
+        memhp_lock_release();
+
 }
 
-void unlock_memory_hotplug(void)
+static void mem_hotplug_begin(void)
 {
-        mutex_unlock(&mem_hotplug_mutex);
+        mem_hotplug.active_writer = current;
+
+        memhp_lock_acquire();
+        for (;;) {
+                mutex_lock(&mem_hotplug.lock);
+                if (likely(!mem_hotplug.refcount))
+                        break;
+                __set_current_state(TASK_UNINTERRUPTIBLE);
+                mutex_unlock(&mem_hotplug.lock);
+                schedule();
+        }
 }
 
+static void mem_hotplug_done(void)
+{
+        mem_hotplug.active_writer = NULL;
+        mutex_unlock(&mem_hotplug.lock);
+        memhp_lock_release();
+}
 
 /* add this memory to iomem resource */
 static struct resource *register_memory_resource(u64 start, u64 size)
@@ -727,14 +792,16 @@ int set_online_page_callback(online_page_callback_t callback)
 {
         int rc = -EINVAL;
 
-        lock_memory_hotplug();
+        get_online_mems();
+        mutex_lock(&online_page_callback_lock);
 
         if (online_page_callback == generic_online_page) {
                 online_page_callback = callback;
                 rc = 0;
         }
 
-        unlock_memory_hotplug();
+        mutex_unlock(&online_page_callback_lock);
+        put_online_mems();
 
         return rc;
 }
@@ -744,14 +811,16 @@ int restore_online_page_callback(online_page_callback_t callback)
 {
         int rc = -EINVAL;
 
-        lock_memory_hotplug();
+        get_online_mems();
+        mutex_lock(&online_page_callback_lock);
 
         if (online_page_callback == callback) {
                 online_page_callback = generic_online_page;
                 rc = 0;
         }
 
-        unlock_memory_hotplug();
+        mutex_unlock(&online_page_callback_lock);
+        put_online_mems();
 
         return rc;
 }
@@ -899,7 +968,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
         int ret;
         struct memory_notify arg;
 
-        lock_memory_hotplug();
+        mem_hotplug_begin();
         /*
          * This doesn't need a lock to do pfn_to_page().
          * The section can't be removed here because of the
@@ -907,23 +976,18 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
          */
         zone = page_zone(pfn_to_page(pfn));
 
+        ret = -EINVAL;
         if ((zone_idx(zone) > ZONE_NORMAL || online_type == ONLINE_MOVABLE) &&
-            !can_online_high_movable(zone)) {
-                unlock_memory_hotplug();
-                return -EINVAL;
-        }
+            !can_online_high_movable(zone))
+                goto out;
 
         if (online_type == ONLINE_KERNEL && zone_idx(zone) == ZONE_MOVABLE) {
-                if (move_pfn_range_left(zone - 1, zone, pfn, pfn + nr_pages)) {
-                        unlock_memory_hotplug();
-                        return -EINVAL;
-                }
+                if (move_pfn_range_left(zone - 1, zone, pfn, pfn + nr_pages))
+                        goto out;
         }
         if (online_type == ONLINE_MOVABLE && zone_idx(zone) == ZONE_MOVABLE - 1) {
-                if (move_pfn_range_right(zone, zone + 1, pfn, pfn + nr_pages)) {
-                        unlock_memory_hotplug();
-                        return -EINVAL;
-                }
+                if (move_pfn_range_right(zone, zone + 1, pfn, pfn + nr_pages))
+                        goto out;
         }
 
         /* Previous code may changed the zone of the pfn range */
@@ -939,8 +1003,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
         ret = notifier_to_errno(ret);
         if (ret) {
                 memory_notify(MEM_CANCEL_ONLINE, &arg);
-                unlock_memory_hotplug();
-                return ret;
+                goto out;
         }
         /*
          * If this zone is not populated, then it is not in zonelist.
@@ -964,8 +1027,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
                        (((unsigned long long) pfn + nr_pages)
                             << PAGE_SHIFT) - 1);
                 memory_notify(MEM_CANCEL_ONLINE, &arg);
-                unlock_memory_hotplug();
-                return ret;
+                goto out;
         }
 
         zone->present_pages += onlined_pages;
@@ -995,9 +1057,9 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
 
         if (onlined_pages)
                 memory_notify(MEM_ONLINE, &arg);
-        unlock_memory_hotplug();
-
-        return 0;
+out:
+        mem_hotplug_done();
+        return ret;
 }
 #endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
 
@@ -1007,7 +1069,7 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
         struct pglist_data *pgdat;
         unsigned long zones_size[MAX_NR_ZONES] = {0};
         unsigned long zholes_size[MAX_NR_ZONES] = {0};
-        unsigned long start_pfn = start >> PAGE_SHIFT;
+        unsigned long start_pfn = PFN_DOWN(start);
 
         pgdat = NODE_DATA(nid);
         if (!pgdat) {
@@ -1055,7 +1117,7 @@ int try_online_node(int nid)
         if (node_online(nid))
                 return 0;
 
-        lock_memory_hotplug();
+        mem_hotplug_begin();
         pgdat = hotadd_new_pgdat(nid, 0);
         if (!pgdat) {
                 pr_err("Cannot online node %d due to NULL pgdat\n", nid);
@@ -1073,13 +1135,13 @@ int try_online_node(int nid)
         }
 
 out:
-        unlock_memory_hotplug();
+        mem_hotplug_done();
         return ret;
 }
 
 static int check_hotplug_memory_range(u64 start, u64 size)
 {
-        u64 start_pfn = start >> PAGE_SHIFT;
+        u64 start_pfn = PFN_DOWN(start);
         u64 nr_pages = size >> PAGE_SHIFT;
 
         /* Memory range must be aligned with section */
@@ -1117,7 +1179,7 @@ int __ref add_memory(int nid, u64 start, u64 size)
                 new_pgdat = !p;
         }
 
-        lock_memory_hotplug();
+        mem_hotplug_begin();
 
         new_node = !node_online(nid);
         if (new_node) {
@@ -1158,7 +1220,7 @@ error:
         release_memory_resource(res);
 
 out:
-        unlock_memory_hotplug();
+        mem_hotplug_done();
         return ret;
 }
 EXPORT_SYMBOL_GPL(add_memory);
@@ -1332,7 +1394,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                  * alloc_migrate_target should be improooooved!!
                  * migrate_pages returns # of failed pages.
                  */
-                ret = migrate_pages(&source, alloc_migrate_target, 0,
+                ret = migrate_pages(&source, alloc_migrate_target, NULL, 0,
                                         MIGRATE_SYNC, MR_MEMORY_HOTPLUG);
                 if (ret)
                         putback_movable_pages(&source);
@@ -1565,7 +1627,7 @@ static int __ref __offline_pages(unsigned long start_pfn,
         if (!test_pages_in_a_zone(start_pfn, end_pfn))
                 return -EINVAL;
 
-        lock_memory_hotplug();
+        mem_hotplug_begin();
 
         zone = page_zone(pfn_to_page(start_pfn));
         node = zone_to_nid(zone);
@@ -1672,7 +1734,7 @@ repeat:
         writeback_set_ratelimit();
 
         memory_notify(MEM_OFFLINE, &arg);
-        unlock_memory_hotplug();
+        mem_hotplug_done();
         return 0;
 
 failed_removal:
@@ -1684,7 +1746,7 @@ failed_removal:
         undo_isolate_page_range(start_pfn, end_pfn, MIGRATE_MOVABLE);
 
 out:
-        unlock_memory_hotplug();
+        mem_hotplug_done();
         return ret;
 }
 
@@ -1888,7 +1950,7 @@ void __ref remove_memory(int nid, u64 start, u64 size)
 
         BUG_ON(check_hotplug_memory_range(start, size));
 
-        lock_memory_hotplug();
+        mem_hotplug_begin();
 
         /*
          * All memory blocks must be offlined before removing memory.  Check
@@ -1897,10 +1959,8 @@ void __ref remove_memory(int nid, u64 start, u64 size)
          */
         ret = walk_memory_range(PFN_DOWN(start), PFN_UP(start + size - 1), NULL,
                                 check_memblock_offlined_cb);
-        if (ret) {
-                unlock_memory_hotplug();
+        if (ret)
                 BUG();
-        }
 
         /* remove memmap entry */
         firmware_map_remove(start, start + size, "System RAM");
@@ -1909,7 +1969,7 @@ void __ref remove_memory(int nid, u64 start, u64 size)
 
         try_offline_node(nid);
 
-        unlock_memory_hotplug();
+        mem_hotplug_done();
 }
 EXPORT_SYMBOL_GPL(remove_memory);
 #endif /* CONFIG_MEMORY_HOTREMOVE */
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 78e1472933ea..16bc9fa42998 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1028,7 +1028,7 @@ static int migrate_to_node(struct mm_struct *mm, int source, int dest,
                         flags | MPOL_MF_DISCONTIG_OK, &pagelist);
 
         if (!list_empty(&pagelist)) {
-                err = migrate_pages(&pagelist, new_node_page, dest,
+                err = migrate_pages(&pagelist, new_node_page, NULL, dest,
                                         MIGRATE_SYNC, MR_SYSCALL);
                 if (err)
                         putback_movable_pages(&pagelist);
@@ -1277,7 +1277,7 @@ static long do_mbind(unsigned long start, unsigned long len,
                 if (!list_empty(&pagelist)) {
                         WARN_ON_ONCE(flags & MPOL_MF_LAZY);
                         nr_failed = migrate_pages(&pagelist, new_vma_page,
-                                        (unsigned long)vma,
+                                        NULL, (unsigned long)vma,
                                         MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
                         if (nr_failed)
                                 putback_movable_pages(&pagelist);
@@ -1362,7 +1362,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
 }
 
 SYSCALL_DEFINE6(mbind, unsigned long, start, unsigned long, len,
-                unsigned long, mode, unsigned long __user *, nmask,
+                unsigned long, mode, const unsigned long __user *, nmask,
                 unsigned long, maxnode, unsigned, flags)
 {
         nodemask_t nodes;
@@ -1383,7 +1383,7 @@ SYSCALL_DEFINE6(mbind, unsigned long, start, unsigned long, len,
 }
 
 /* Set the process memory policy */
-SYSCALL_DEFINE3(set_mempolicy, int, mode, unsigned long __user *, nmask,
+SYSCALL_DEFINE3(set_mempolicy, int, mode, const unsigned long __user *, nmask,
                 unsigned long, maxnode)
 {
         int err;
@@ -1606,9 +1606,9 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
 
 /*
  * get_vma_policy(@task, @vma, @addr)
- * @task - task for fallback if vma policy == default
- * @vma   - virtual memory area whose policy is sought
- * @addr  - address in @vma for shared policy lookup
+ * @task: task for fallback if vma policy == default
+ * @vma: virtual memory area whose policy is sought
+ * @addr: address in @vma for shared policy lookup
  *
  * Returns effective policy for a VMA at specified address.
  * Falls back to @task or system default policy, as necessary.
@@ -1854,11 +1854,11 @@ int node_random(const nodemask_t *maskp)
 #ifdef CONFIG_HUGETLBFS
 /*
  * huge_zonelist(@vma, @addr, @gfp_flags, @mpol)
- * @vma = virtual memory area whose policy is sought
- * @addr = address in @vma for shared policy lookup and interleave policy
- * @gfp_flags = for requested zone
- * @mpol = pointer to mempolicy pointer for reference counted mempolicy
- * @nodemask = pointer to nodemask pointer for MPOL_BIND nodemask
+ * @vma: virtual memory area whose policy is sought
+ * @addr: address in @vma for shared policy lookup and interleave policy
+ * @gfp_flags: for requested zone
+ * @mpol: pointer to mempolicy pointer for reference counted mempolicy
+ * @nodemask: pointer to nodemask pointer for MPOL_BIND nodemask
  *
  * Returns a zonelist suitable for a huge page allocation and a pointer
  * to the struct mempolicy for conditional unref after allocation.
@@ -2270,9 +2270,9 @@ static void sp_free(struct sp_node *n)
 /**
  * mpol_misplaced - check whether current page node is valid in policy
  *
- * @page   - page to be checked
- * @vma    - vm area where page mapped
- * @addr   - virtual address where page mapped
+ * @page: page to be checked
+ * @vma: vm area where page mapped
+ * @addr: virtual address where page mapped
  *
  * Lookup current policy node id for vma,addr and "compare to" page's
  * node id.
diff --git a/mm/mempool.c b/mm/mempool.c
index 905434f18c97..455d468c3a5d 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -192,6 +192,7 @@ EXPORT_SYMBOL(mempool_resize);
  * returns NULL. Note that due to preallocation, this function
  * *never* fails when called from process contexts. (it might
  * fail if called from an IRQ context.)
+ * Note: using __GFP_ZERO is not supported.
  */
 void * mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
 {
@@ -200,6 +201,7 @@ void * mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
         wait_queue_t wait;
         gfp_t gfp_temp;
 
+        VM_WARN_ON_ONCE(gfp_mask & __GFP_ZERO);
         might_sleep_if(gfp_mask & __GFP_WAIT);
 
         gfp_mask |= __GFP_NOMEMALLOC;   /* don't allocate emergency reserves */
diff --git a/mm/migrate.c b/mm/migrate.c
index bed48809e5d0..63f0cd559999 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -938,8 +938,9 @@ out:
  * Obtain the lock on page, remove all ptes and migrate the page
  * to the newly allocated page in newpage.
  */
-static int unmap_and_move(new_page_t get_new_page, unsigned long private,
-                        struct page *page, int force, enum migrate_mode mode)
+static int unmap_and_move(new_page_t get_new_page, free_page_t put_new_page,
+                        unsigned long private, struct page *page, int force,
+                        enum migrate_mode mode)
 {
         int rc = 0;
         int *result = NULL;
@@ -983,11 +984,17 @@ out:
                                 page_is_file_cache(page));
                 putback_lru_page(page);
         }
+
         /*
-         * Move the new page to the LRU. If migration was not successful
-         * then this will free the page.
+         * If migration was not successful and there's a freeing callback, use
+         * it.  Otherwise, putback_lru_page() will drop the reference grabbed
+         * during isolation.
          */
-        putback_lru_page(newpage);
+        if (rc != MIGRATEPAGE_SUCCESS && put_new_page)
+                put_new_page(newpage, private);
+        else
+                putback_lru_page(newpage);
+
         if (result) {
                 if (rc)
                         *result = rc;
@@ -1016,8 +1023,9 @@ out:
  * will wait in the page fault for migration to complete.
  */
 static int unmap_and_move_huge_page(new_page_t get_new_page,
-                                unsigned long private, struct page *hpage,
-                                int force, enum migrate_mode mode)
+                                free_page_t put_new_page, unsigned long private,
+                                struct page *hpage, int force,
+                                enum migrate_mode mode)
 {
         int rc = 0;
         int *result = NULL;
@@ -1031,7 +1039,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
          * tables or check whether the hugepage is pmd-based or not before
          * kicking migration.
          */
-        if (!hugepage_migration_support(page_hstate(hpage))) {
+        if (!hugepage_migration_supported(page_hstate(hpage))) {
                 putback_active_hugepage(hpage);
                 return -ENOSYS;
         }
@@ -1056,20 +1064,30 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
         if (!page_mapped(hpage))
                 rc = move_to_new_page(new_hpage, hpage, 1, mode);
 
-        if (rc)
+        if (rc != MIGRATEPAGE_SUCCESS)
                 remove_migration_ptes(hpage, hpage);
 
         if (anon_vma)
                 put_anon_vma(anon_vma);
 
-        if (!rc)
+        if (rc == MIGRATEPAGE_SUCCESS)
                 hugetlb_cgroup_migrate(hpage, new_hpage);
 
         unlock_page(hpage);
 out:
         if (rc != -EAGAIN)
                 putback_active_hugepage(hpage);
-        put_page(new_hpage);
+
+        /*
+         * If migration was not successful and there's a freeing callback, use
+         * it.  Otherwise, put_page() will drop the reference grabbed during
+         * isolation.
+         */
+        if (rc != MIGRATEPAGE_SUCCESS && put_new_page)
+                put_new_page(new_hpage, private);
+        else
+                put_page(new_hpage);
+
         if (result) {
                 if (rc)
                         *result = rc;
@@ -1086,6 +1104,8 @@ out:
  * @from:               The list of pages to be migrated.
  * @get_new_page:       The function used to allocate free pages to be used
  *                      as the target of the page migration.
+ * @put_new_page:       The function used to free target pages if migration
+ *                      fails, or NULL if no special handling is necessary.
  * @private:            Private data to be passed on to get_new_page()
  * @mode:               The migration mode that specifies the constraints for
  *                      page migration, if any.
@@ -1099,7 +1119,8 @@ out:
  * Returns the number of pages that were not migrated, or an error code.
  */
 int migrate_pages(struct list_head *from, new_page_t get_new_page,
-                unsigned long private, enum migrate_mode mode, int reason)
+                free_page_t put_new_page, unsigned long private,
+                enum migrate_mode mode, int reason)
 {
         int retry = 1;
         int nr_failed = 0;
@@ -1121,10 +1142,11 @@ int migrate_pages(struct list_head *from, new_page_t get_new_page,
 
                         if (PageHuge(page))
                                 rc = unmap_and_move_huge_page(get_new_page,
-                                                private, page, pass > 2, mode);
+                                                put_new_page, private, page,
+                                                pass > 2, mode);
                         else
-                                rc = unmap_and_move(get_new_page, private,
-                                                page, pass > 2, mode);
+                                rc = unmap_and_move(get_new_page, put_new_page,
+                                                private, page, pass > 2, mode);
 
                         switch(rc) {
                         case -ENOMEM:
@@ -1273,7 +1295,7 @@ set_status:
 
         err = 0;
         if (!list_empty(&pagelist)) {
-                err = migrate_pages(&pagelist, new_page_node,
+                err = migrate_pages(&pagelist, new_page_node, NULL,
                                 (unsigned long)pm, MIGRATE_SYNC, MR_SYSCALL);
                 if (err)
                         putback_movable_pages(&pagelist);
@@ -1729,7 +1751,8 @@ int migrate_misplaced_page(struct page *page, struct vm_area_struct *vma,
 
         list_add(&page->lru, &migratepages);
         nr_remaining = migrate_pages(&migratepages, alloc_misplaced_dst_page,
-                                     node, MIGRATE_ASYNC, MR_NUMA_MISPLACED);
+                                     NULL, node, MIGRATE_ASYNC,
+                                     MR_NUMA_MISPLACED);
         if (nr_remaining) {
                 if (!list_empty(&migratepages)) {
                         list_del(&page->lru);
@@ -1852,7 +1875,7 @@ fail_putback:
          * guarantee the copy is visible before the pagetable update.
          */
         flush_cache_range(vma, mmun_start, mmun_end);
-        page_add_new_anon_rmap(new_page, vma, mmun_start);
+        page_add_anon_rmap(new_page, vma, mmun_start);
         pmdp_clear_flush(vma, mmun_start, pmd);
         set_pmd_at(mm, mmun_start, pmd, entry);
         flush_tlb_range(vma, mmun_start, mmun_end);
@@ -1877,6 +1900,10 @@ fail_putback:
         spin_unlock(ptl);
         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 
+        /* Take an "isolate" reference and put new page on the LRU. */
+        get_page(new_page);
+        putback_lru_page(new_page);
+
         unlock_page(new_page);
         unlock_page(page);
         put_page(page);                 /* Drop the rmap reference */
diff --git a/mm/mmap.c b/mm/mmap.c
index b1202cf81f4b..8a56d39df4ed 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -640,11 +640,10 @@ static void vma_link(struct mm_struct *mm, struct vm_area_struct *vma,
 {
         struct address_space *mapping = NULL;
 
-        if (vma->vm_file)
+        if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
-
-        if (mapping)
                 mutex_lock(&mapping->i_mmap_mutex);
+        }
 
         __vma_link(mm, vma, prev, rb_link, rb_parent);
         __vma_link_file(vma);
@@ -2965,9 +2964,7 @@ int install_special_mapping(struct mm_struct *mm,
         struct vm_area_struct *vma = _install_special_mapping(mm,
                             addr, len, vm_flags, pages);
 
-        if (IS_ERR(vma))
-                return PTR_ERR(vma);
-        return 0;
+        return PTR_ERR_OR_ZERO(vma);
 }
 
 static DEFINE_MUTEX(mm_all_locks_mutex);
diff --git a/mm/msync.c b/mm/msync.c
index 632df4527c01..a5c673669ca6 100644
--- a/mm/msync.c
+++ b/mm/msync.c
@@ -58,6 +58,7 @@ SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
         vma = find_vma(mm, start);
         for (;;) {
                 struct file *file;
+                loff_t fstart, fend;
 
                 /* Still start < end. */
                 error = -ENOMEM;
@@ -77,12 +78,17 @@ SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
                         goto out_unlock;
                 }
                 file = vma->vm_file;
+                fstart = start + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+                fend = fstart + (min(end, vma->vm_end) - start) - 1;
                 start = vma->vm_end;
                 if ((flags & MS_SYNC) && file &&
                                 (vma->vm_flags & VM_SHARED)) {
                         get_file(file);
                         up_read(&mm->mmap_sem);
-                        error = vfs_fsync(file, 0);
+                        if (vma->vm_flags & VM_NONLINEAR)
+                                error = vfs_fsync(file, 1);
+                        else
+                                error = vfs_fsync_range(file, fstart, fend, 1);
                         fput(file);
                         if (error || start >= end)
                                 goto out;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index a4317da60532..533fa60c9ac1 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -156,24 +156,6 @@ static unsigned long writeout_period_time = 0;
 #define VM_COMPLETIONS_PERIOD_LEN (3*HZ)
 
 /*
- * Work out the current dirty-memory clamping and background writeout
- * thresholds.
- *
- * The main aim here is to lower them aggressively if there is a lot of mapped
- * memory around.  To avoid stressing page reclaim with lots of unreclaimable
- * pages.  It is better to clamp down on writers than to start swapping, and
- * performing lots of scanning.
- *
- * We only allow 1/2 of the currently-unmapped memory to be dirtied.
- *
- * We don't permit the clamping level to fall below 5% - that is getting rather
- * excessive.
- *
- * We make sure that the background writeout level is below the adjusted
- * clamping level.
- */
-
-/*
  * In a memory zone, there is a certain amount of pages we consider
  * available for the page cache, which is essentially the number of
  * free and reclaimable pages, minus some zone reserves to protect
@@ -1623,7 +1605,7 @@ void balance_dirty_pages_ratelimited(struct address_space *mapping)
          * 1000+ tasks, all of them start dirtying pages at exactly the same
          * time, hence all honoured too large initial task->nr_dirtied_pause.
          */
-        p =  &__get_cpu_var(bdp_ratelimits);
+        p =  this_cpu_ptr(&bdp_ratelimits);
         if (unlikely(current->nr_dirtied >= ratelimit))
                 *p = 0;
         else if (unlikely(*p >= ratelimit_pages)) {
@@ -1635,7 +1617,7 @@ void balance_dirty_pages_ratelimited(struct address_space *mapping)
          * short-lived tasks (eg. gcc invocations in a kernel build) escaping
          * the dirty throttling and livelock other long-run dirtiers.
          */
-        p = &__get_cpu_var(dirty_throttle_leaks);
+        p = this_cpu_ptr(&dirty_throttle_leaks);
         if (*p > 0 && current->nr_dirtied < ratelimit) {
                 unsigned long nr_pages_dirtied;
                 nr_pages_dirtied = min(*p, ratelimit - current->nr_dirtied);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 5dba2933c9c0..a59bdb653958 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -261,8 +261,9 @@ static int page_outside_zone_boundaries(struct zone *zone, struct page *page)
         } while (zone_span_seqretry(zone, seq));
 
         if (ret)
-                pr_err("page %lu outside zone [ %lu - %lu ]\n",
-                        pfn, start_pfn, start_pfn + sp);
+                pr_err("page 0x%lx outside node %d zone %s [ 0x%lx - 0x%lx ]\n",
+                        pfn, zone_to_nid(zone), zone->name,
+                        start_pfn, start_pfn + sp);
 
         return ret;
 }
@@ -408,7 +409,8 @@ static int destroy_compound_page(struct page *page, unsigned long order)
         return bad;
 }
 
-static inline void prep_zero_page(struct page *page, int order, gfp_t gfp_flags)
+static inline void prep_zero_page(struct page *page, unsigned int order,
+                                                        gfp_t gfp_flags)
 {
         int i;
 
@@ -452,7 +454,7 @@ static inline void set_page_guard_flag(struct page *page) { }
 static inline void clear_page_guard_flag(struct page *page) { }
 #endif
 
-static inline void set_page_order(struct page *page, int order)
+static inline void set_page_order(struct page *page, unsigned int order)
 {
         set_page_private(page, order);
         __SetPageBuddy(page);
@@ -503,21 +505,31 @@ __find_buddy_index(unsigned long page_idx, unsigned int order)
  * For recording page's order, we use page_private(page).
  */
 static inline int page_is_buddy(struct page *page, struct page *buddy,
-                                                                int order)
+                                                        unsigned int order)
 {
         if (!pfn_valid_within(page_to_pfn(buddy)))
                 return 0;
 
-        if (page_zone_id(page) != page_zone_id(buddy))
-                return 0;
-
         if (page_is_guard(buddy) && page_order(buddy) == order) {
                 VM_BUG_ON_PAGE(page_count(buddy) != 0, buddy);
+
+                if (page_zone_id(page) != page_zone_id(buddy))
+                        return 0;
+
                 return 1;
         }
 
         if (PageBuddy(buddy) && page_order(buddy) == order) {
                 VM_BUG_ON_PAGE(page_count(buddy) != 0, buddy);
+
+                /*
+                 * zone check is done late to avoid uselessly
+                 * calculating zone/node ids for pages that could
+                 * never merge.
+                 */
+                if (page_zone_id(page) != page_zone_id(buddy))
+                        return 0;
+
                 return 1;
         }
         return 0;
@@ -549,6 +561,7 @@ static inline int page_is_buddy(struct page *page, struct page *buddy,
  */
 
 static inline void __free_one_page(struct page *page,
+                unsigned long pfn,
                 struct zone *zone, unsigned int order,
                 int migratetype)
 {
@@ -565,7 +578,7 @@ static inline void __free_one_page(struct page *page,
 
         VM_BUG_ON(migratetype == -1);
 
-        page_idx = page_to_pfn(page) & ((1 << MAX_ORDER) - 1);
+        page_idx = pfn & ((1 << MAX_ORDER) - 1);
 
         VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page);
         VM_BUG_ON_PAGE(bad_range(zone, page), page);
@@ -700,7 +713,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                         list_del(&page->lru);
                         mt = get_freepage_migratetype(page);
                         /* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */
-                        __free_one_page(page, zone, 0, mt);
+                        __free_one_page(page, page_to_pfn(page), zone, 0, mt);
                         trace_mm_page_pcpu_drain(page, 0, mt);
                         if (likely(!is_migrate_isolate_page(page))) {
                                 __mod_zone_page_state(zone, NR_FREE_PAGES, 1);
@@ -712,13 +725,15 @@ static void free_pcppages_bulk(struct zone *zone, int count,
         spin_unlock(&zone->lock);
 }
 
-static void free_one_page(struct zone *zone, struct page *page, int order,
+static void free_one_page(struct zone *zone,
+                                struct page *page, unsigned long pfn,
+                                unsigned int order,
                                 int migratetype)
 {
         spin_lock(&zone->lock);
         zone->pages_scanned = 0;
 
-        __free_one_page(page, zone, order, migratetype);
+        __free_one_page(page, pfn, zone, order, migratetype);
         if (unlikely(!is_migrate_isolate(migratetype)))
                 __mod_zone_freepage_state(zone, 1 << order, migratetype);
         spin_unlock(&zone->lock);
@@ -755,15 +770,16 @@ static void __free_pages_ok(struct page *page, unsigned int order)
 {
         unsigned long flags;
         int migratetype;
+        unsigned long pfn = page_to_pfn(page);
 
         if (!free_pages_prepare(page, order))
                 return;
 
+        migratetype = get_pfnblock_migratetype(page, pfn);
         local_irq_save(flags);
         __count_vm_events(PGFREE, 1 << order);
-        migratetype = get_pageblock_migratetype(page);
         set_freepage_migratetype(page, migratetype);
-        free_one_page(page_zone(page), page, order, migratetype);
+        free_one_page(page_zone(page), page, pfn, order, migratetype);
         local_irq_restore(flags);
 }
 
@@ -882,7 +898,7 @@ static inline int check_new_page(struct page *page)
         return 0;
 }
 
-static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
+static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags)
 {
         int i;
 
@@ -931,6 +947,7 @@ struct page *__rmqueue_smallest(struct zone *zone, unsigned int order,
                 rmv_page_order(page);
                 area->nr_free--;
                 expand(zone, page, order, current_order, area, migratetype);
+                set_freepage_migratetype(page, migratetype);
                 return page;
         }
 
@@ -1057,7 +1074,9 @@ static int try_to_steal_freepages(struct zone *zone, struct page *page,
 
         /*
          * When borrowing from MIGRATE_CMA, we need to release the excess
-         * buddy pages to CMA itself.
+         * buddy pages to CMA itself. We also ensure the freepage_migratetype
+         * is set to CMA so it is returned to the correct freelist in case
+         * the page ends up being not actually allocated from the pcp lists.
          */
         if (is_migrate_cma(fallback_type))
                 return fallback_type;
@@ -1090,16 +1109,17 @@ static int try_to_steal_freepages(struct zone *zone, struct page *page,
 
 /* Remove an element from the buddy allocator from the fallback list */
 static inline struct page *
-__rmqueue_fallback(struct zone *zone, int order, int start_migratetype)
+__rmqueue_fallback(struct zone *zone, unsigned int order, int start_migratetype)
 {
         struct free_area *area;
-        int current_order;
+        unsigned int current_order;
         struct page *page;
         int migratetype, new_type, i;
 
         /* Find the largest possible block of pages in the other list */
-        for (current_order = MAX_ORDER-1; current_order >= order;
-                                                --current_order) {
+        for (current_order = MAX_ORDER-1;
+                                current_order >= order && current_order <= MAX_ORDER-1;
+                                --current_order) {
                 for (i = 0;; i++) {
                         migratetype = fallbacks[start_migratetype][i];
 
@@ -1125,6 +1145,12 @@ __rmqueue_fallback(struct zone *zone, int order, int start_migratetype)
 
                         expand(zone, page, order, current_order, area,
                                new_type);
+                        /* The freepage_migratetype may differ from pageblock's
+                         * migratetype depending on the decisions in
+                         * try_to_steal_freepages. This is OK as long as it does
+                         * not differ for MIGRATE_CMA type.
+                         */
+                        set_freepage_migratetype(page, new_type);
 
                         trace_mm_page_alloc_extfrag(page, order, current_order,
                                 start_migratetype, migratetype, new_type);
@@ -1173,9 +1199,9 @@ retry_reserve:
  */
 static int rmqueue_bulk(struct zone *zone, unsigned int order,
                         unsigned long count, struct list_head *list,
-                        int migratetype, int cold)
+                        int migratetype, bool cold)
 {
-        int mt = migratetype, i;
+        int i;
 
         spin_lock(&zone->lock);
         for (i = 0; i < count; ++i) {
@@ -1192,18 +1218,12 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
                  * merge IO requests if the physical pages are ordered
                  * properly.
                  */
-                if (likely(cold == 0))
+                if (likely(!cold))
                         list_add(&page->lru, list);
                 else
                         list_add_tail(&page->lru, list);
-                if (IS_ENABLED(CONFIG_CMA)) {
-                        mt = get_pageblock_migratetype(page);
-                        if (!is_migrate_cma(mt) && !is_migrate_isolate(mt))
-                                mt = migratetype;
-                }
-                set_freepage_migratetype(page, mt);
                 list = &page->lru;
-                if (is_migrate_cma(mt))
+                if (is_migrate_cma(get_freepage_migratetype(page)))
                         __mod_zone_page_state(zone, NR_FREE_CMA_PAGES,
                                               -(1 << order));
         }
@@ -1327,7 +1347,7 @@ void mark_free_pages(struct zone *zone)
 {
         unsigned long pfn, max_zone_pfn;
         unsigned long flags;
-        int order, t;
+        unsigned int order, t;
         struct list_head *curr;
 
         if (zone_is_empty(zone))
@@ -1359,19 +1379,20 @@ void mark_free_pages(struct zone *zone)
 
 /*
  * Free a 0-order page
- * cold == 1 ? free a cold page : free a hot page
+ * cold == true ? free a cold page : free a hot page
  */
-void free_hot_cold_page(struct page *page, int cold)
+void free_hot_cold_page(struct page *page, bool cold)
 {
         struct zone *zone = page_zone(page);
         struct per_cpu_pages *pcp;
         unsigned long flags;
+        unsigned long pfn = page_to_pfn(page);
         int migratetype;
 
         if (!free_pages_prepare(page, 0))
                 return;
 
-        migratetype = get_pageblock_migratetype(page);
+        migratetype = get_pfnblock_migratetype(page, pfn);
         set_freepage_migratetype(page, migratetype);
         local_irq_save(flags);
         __count_vm_event(PGFREE);
@@ -1385,17 +1406,17 @@ void free_hot_cold_page(struct page *page, int cold)
          */
         if (migratetype >= MIGRATE_PCPTYPES) {
                 if (unlikely(is_migrate_isolate(migratetype))) {
-                        free_one_page(zone, page, 0, migratetype);
+                        free_one_page(zone, page, pfn, 0, migratetype);
                         goto out;
                 }
                 migratetype = MIGRATE_MOVABLE;
         }
 
         pcp = &this_cpu_ptr(zone->pageset)->pcp;
-        if (cold)
-                list_add_tail(&page->lru, &pcp->lists[migratetype]);
-        else
+        if (!cold)
                 list_add(&page->lru, &pcp->lists[migratetype]);
+        else
+                list_add_tail(&page->lru, &pcp->lists[migratetype]);
         pcp->count++;
         if (pcp->count >= pcp->high) {
                 unsigned long batch = ACCESS_ONCE(pcp->batch);
@@ -1410,7 +1431,7 @@ out:
 /*
  * Free a list of 0-order pages
  */
-void free_hot_cold_page_list(struct list_head *list, int cold)
+void free_hot_cold_page_list(struct list_head *list, bool cold)
 {
         struct page *page, *next;
 
@@ -1522,12 +1543,12 @@ int split_free_page(struct page *page)
  */
 static inline
 struct page *buffered_rmqueue(struct zone *preferred_zone,
-                        struct zone *zone, int order, gfp_t gfp_flags,
-                        int migratetype)
+                        struct zone *zone, unsigned int order,
+                        gfp_t gfp_flags, int migratetype)
 {
         unsigned long flags;
         struct page *page;
-        int cold = !!(gfp_flags & __GFP_COLD);
+        bool cold = ((gfp_flags & __GFP_COLD) != 0);
 
 again:
         if (likely(order == 0)) {
@@ -1572,7 +1593,7 @@ again:
                 if (!page)
                         goto failed;
                 __mod_zone_freepage_state(zone, -(1 << order),
-                                          get_pageblock_migratetype(page));
+                                          get_freepage_migratetype(page));
         }
 
         __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
@@ -1672,8 +1693,9 @@ static inline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
  * Return true if free pages are above 'mark'. This takes into account the order
  * of the allocation.
  */
-static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
-                      int classzone_idx, int alloc_flags, long free_pages)
+static bool __zone_watermark_ok(struct zone *z, unsigned int order,
+                        unsigned long mark, int classzone_idx, int alloc_flags,
+                        long free_pages)
 {
         /* free_pages my go negative - that's OK */
         long min = mark;
@@ -1707,15 +1729,15 @@ static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
         return true;
 }
 
-bool zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+bool zone_watermark_ok(struct zone *z, unsigned int order, unsigned long mark,
                       int classzone_idx, int alloc_flags)
 {
         return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
                                         zone_page_state(z, NR_FREE_PAGES));
 }
 
-bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark,
-                      int classzone_idx, int alloc_flags)
+bool zone_watermark_ok_safe(struct zone *z, unsigned int order,
+                        unsigned long mark, int classzone_idx, int alloc_flags)
 {
         long free_pages = zone_page_state(z, NR_FREE_PAGES);
 
@@ -1850,18 +1872,8 @@ static bool zone_local(struct zone *local_zone, struct zone *zone)
 
 static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone)
 {
-        return node_isset(local_zone->node, zone->zone_pgdat->reclaim_nodes);
-}
-
-static void __paginginit init_zone_allows_reclaim(int nid)
-{
-        int i;
-
-        for_each_node_state(i, N_MEMORY)
-                if (node_distance(nid, i) <= RECLAIM_DISTANCE)
-                        node_set(i, NODE_DATA(nid)->reclaim_nodes);
-                else
-                        zone_reclaim_mode = 1;
+        return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <
+                                RECLAIM_DISTANCE;
 }
 
 #else   /* CONFIG_NUMA */
@@ -1895,9 +1907,6 @@ static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone)
         return true;
 }
 
-static inline void init_zone_allows_reclaim(int nid)
-{
-}
 #endif  /* CONFIG_NUMA */
 
 /*
@@ -1907,17 +1916,17 @@ static inline void init_zone_allows_reclaim(int nid)
 static struct page *
 get_page_from_freelist(gfp_t gfp_mask, nodemask_t *nodemask, unsigned int order,
                 struct zonelist *zonelist, int high_zoneidx, int alloc_flags,
-                struct zone *preferred_zone, int migratetype)
+                struct zone *preferred_zone, int classzone_idx, int migratetype)
 {
         struct zoneref *z;
         struct page *page = NULL;
-        int classzone_idx;
         struct zone *zone;
         nodemask_t *allowednodes = NULL;/* zonelist_cache approximation */
         int zlc_active = 0;             /* set if using zonelist_cache */
         int did_zlc_setup = 0;          /* just call zlc_setup() one time */
+        bool consider_zone_dirty = (alloc_flags & ALLOC_WMARK_LOW) &&
+                                (gfp_mask & __GFP_WRITE);
 
-        classzone_idx = zone_idx(preferred_zone);
 zonelist_scan:
         /*
          * Scan zonelist, looking for a zone with enough free.
@@ -1930,12 +1939,10 @@ zonelist_scan:
                 if (IS_ENABLED(CONFIG_NUMA) && zlc_active &&
                         !zlc_zone_worth_trying(zonelist, z, allowednodes))
                                 continue;
-                if ((alloc_flags & ALLOC_CPUSET) &&
+                if (cpusets_enabled() &&
+                        (alloc_flags & ALLOC_CPUSET) &&
                         !cpuset_zone_allowed_softwall(zone, gfp_mask))
                                 continue;
-                BUILD_BUG_ON(ALLOC_NO_WATERMARKS < NR_WMARK);
-                if (unlikely(alloc_flags & ALLOC_NO_WATERMARKS))
-                        goto try_this_zone;
                 /*
                  * Distribute pages in proportion to the individual
                  * zone size to ensure fair page aging.  The zone a
@@ -1974,15 +1981,19 @@ zonelist_scan:
                  * will require awareness of zones in the
                  * dirty-throttling and the flusher threads.
                  */
-                if ((alloc_flags & ALLOC_WMARK_LOW) &&
-                    (gfp_mask & __GFP_WRITE) && !zone_dirty_ok(zone))
-                        goto this_zone_full;
+                if (consider_zone_dirty && !zone_dirty_ok(zone))
+                        continue;
 
                 mark = zone->watermark[alloc_flags & ALLOC_WMARK_MASK];
                 if (!zone_watermark_ok(zone, order, mark,
                                        classzone_idx, alloc_flags)) {
                         int ret;
 
+                        /* Checked here to keep the fast path fast */
+                        BUILD_BUG_ON(ALLOC_NO_WATERMARKS < NR_WMARK);
+                        if (alloc_flags & ALLOC_NO_WATERMARKS)
+                                goto try_this_zone;
+
                         if (IS_ENABLED(CONFIG_NUMA) &&
                                         !did_zlc_setup && nr_online_nodes > 1) {
                                 /*
@@ -2044,7 +2055,7 @@ try_this_zone:
                 if (page)
                         break;
 this_zone_full:
-                if (IS_ENABLED(CONFIG_NUMA))
+                if (IS_ENABLED(CONFIG_NUMA) && zlc_active)
                         zlc_mark_zone_full(zonelist, z);
         }
 
@@ -2173,7 +2184,7 @@ static inline struct page *
 __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, struct zone *preferred_zone,
-        int migratetype)
+        int classzone_idx, int migratetype)
 {
         struct page *page;
 
@@ -2191,7 +2202,7 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
         page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask,
                 order, zonelist, high_zoneidx,
                 ALLOC_WMARK_HIGH|ALLOC_CPUSET,
-                preferred_zone, migratetype);
+                preferred_zone, classzone_idx, migratetype);
         if (page)
                 goto out;
 
@@ -2226,7 +2237,7 @@ static struct page *
 __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
-        int migratetype, bool sync_migration,
+        int classzone_idx, int migratetype, enum migrate_mode mode,
         bool *contended_compaction, bool *deferred_compaction,
         unsigned long *did_some_progress)
 {
@@ -2240,7 +2251,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
 
         current->flags |= PF_MEMALLOC;
         *did_some_progress = try_to_compact_pages(zonelist, order, gfp_mask,
-                                                nodemask, sync_migration,
+                                                nodemask, mode,
                                                 contended_compaction);
         current->flags &= ~PF_MEMALLOC;
 
@@ -2254,7 +2265,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
                 page = get_page_from_freelist(gfp_mask, nodemask,
                                 order, zonelist, high_zoneidx,
                                 alloc_flags & ~ALLOC_NO_WATERMARKS,
-                                preferred_zone, migratetype);
+                                preferred_zone, classzone_idx, migratetype);
                 if (page) {
                         preferred_zone->compact_blockskip_flush = false;
                         compaction_defer_reset(preferred_zone, order, true);
@@ -2273,7 +2284,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
                  * As async compaction considers a subset of pageblocks, only
                  * defer if the failure was a sync compaction failure.
                  */
-                if (sync_migration)
+                if (mode != MIGRATE_ASYNC)
                         defer_compaction(preferred_zone, order);
 
                 cond_resched();
@@ -2286,9 +2297,9 @@ static inline struct page *
 __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
-        int migratetype, bool sync_migration,
-        bool *contended_compaction, bool *deferred_compaction,
-        unsigned long *did_some_progress)
+        int classzone_idx, int migratetype,
+        enum migrate_mode mode, bool *contended_compaction,
+        bool *deferred_compaction, unsigned long *did_some_progress)
 {
         return NULL;
 }
@@ -2327,7 +2338,7 @@ static inline struct page *
 __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
-        int migratetype, unsigned long *did_some_progress)
+        int classzone_idx, int migratetype, unsigned long *did_some_progress)
 {
         struct page *page = NULL;
         bool drained = false;
@@ -2345,7 +2356,8 @@ retry:
         page = get_page_from_freelist(gfp_mask, nodemask, order,
                                         zonelist, high_zoneidx,
                                         alloc_flags & ~ALLOC_NO_WATERMARKS,
-                                        preferred_zone, migratetype);
+                                        preferred_zone, classzone_idx,
+                                        migratetype);
 
         /*
          * If an allocation failed after direct reclaim, it could be because
@@ -2368,14 +2380,14 @@ static inline struct page *
 __alloc_pages_high_priority(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, struct zone *preferred_zone,
-        int migratetype)
+        int classzone_idx, int migratetype)
 {
         struct page *page;
 
         do {
                 page = get_page_from_freelist(gfp_mask, nodemask, order,
                         zonelist, high_zoneidx, ALLOC_NO_WATERMARKS,
-                        preferred_zone, migratetype);
+                        preferred_zone, classzone_idx, migratetype);
 
                 if (!page && gfp_mask & __GFP_NOFAIL)
                         wait_iff_congested(preferred_zone, BLK_RW_ASYNC, HZ/50);
@@ -2476,14 +2488,14 @@ static inline struct page *
 __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, struct zone *preferred_zone,
-        int migratetype)
+        int classzone_idx, int migratetype)
 {
         const gfp_t wait = gfp_mask & __GFP_WAIT;
         struct page *page = NULL;
         int alloc_flags;
         unsigned long pages_reclaimed = 0;
         unsigned long did_some_progress;
-        bool sync_migration = false;
+        enum migrate_mode migration_mode = MIGRATE_ASYNC;
         bool deferred_compaction = false;
         bool contended_compaction = false;
 
@@ -2525,15 +2537,18 @@ restart:
          * Find the true preferred zone if the allocation is unconstrained by
          * cpusets.
          */
-        if (!(alloc_flags & ALLOC_CPUSET) && !nodemask)
-                first_zones_zonelist(zonelist, high_zoneidx, NULL,
-                                        &preferred_zone);
+        if (!(alloc_flags & ALLOC_CPUSET) && !nodemask) {
+                struct zoneref *preferred_zoneref;
+                preferred_zoneref = first_zones_zonelist(zonelist, high_zoneidx,
+                                NULL, &preferred_zone);
+                classzone_idx = zonelist_zone_idx(preferred_zoneref);
+        }
 
 rebalance:
         /* This is the last chance, in general, before the goto nopage. */
         page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
                         high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
-                        preferred_zone, migratetype);
+                        preferred_zone, classzone_idx, migratetype);
         if (page)
                 goto got_pg;
 
@@ -2548,7 +2563,7 @@ rebalance:
 
                 page = __alloc_pages_high_priority(gfp_mask, order,
                                 zonelist, high_zoneidx, nodemask,
-                                preferred_zone, migratetype);
+                                preferred_zone, classzone_idx, migratetype);
                 if (page) {
                         goto got_pg;
                 }
@@ -2577,17 +2592,23 @@ rebalance:
          * Try direct compaction. The first pass is asynchronous. Subsequent
          * attempts after direct reclaim are synchronous
          */
-        page = __alloc_pages_direct_compact(gfp_mask, order,
-                                        zonelist, high_zoneidx,
-                                        nodemask,
-                                        alloc_flags, preferred_zone,
-                                        migratetype, sync_migration,
-                                        &contended_compaction,
+        page = __alloc_pages_direct_compact(gfp_mask, order, zonelist,
+                                        high_zoneidx, nodemask, alloc_flags,
+                                        preferred_zone,
+                                        classzone_idx, migratetype,
+                                        migration_mode, &contended_compaction,
                                         &deferred_compaction,
                                         &did_some_progress);
         if (page)
                 goto got_pg;
-        sync_migration = true;
+
+        /*
+         * It can become very expensive to allocate transparent hugepages at
+         * fault, so use asynchronous memory compaction for THP unless it is
+         * khugepaged trying to collapse.
+         */
+        if (!(gfp_mask & __GFP_NO_KSWAPD) || (current->flags & PF_KTHREAD))
+                migration_mode = MIGRATE_SYNC_LIGHT;
 
         /*
          * If compaction is deferred for high-order allocations, it is because
@@ -2604,7 +2625,8 @@ rebalance:
                                         zonelist, high_zoneidx,
                                         nodemask,
                                         alloc_flags, preferred_zone,
-                                        migratetype, &did_some_progress);
+                                        classzone_idx, migratetype,
+                                        &did_some_progress);
         if (page)
                 goto got_pg;
 
@@ -2623,7 +2645,7 @@ rebalance:
                         page = __alloc_pages_may_oom(gfp_mask, order,
                                         zonelist, high_zoneidx,
                                         nodemask, preferred_zone,
-                                        migratetype);
+                                        classzone_idx, migratetype);
                         if (page)
                                 goto got_pg;
 
@@ -2662,12 +2684,11 @@ rebalance:
                  * direct reclaim and reclaim/compaction depends on compaction
                  * being called after reclaim so call directly if necessary
                  */
-                page = __alloc_pages_direct_compact(gfp_mask, order,
-                                        zonelist, high_zoneidx,
-                                        nodemask,
-                                        alloc_flags, preferred_zone,
-                                        migratetype, sync_migration,
-                                        &contended_compaction,
+                page = __alloc_pages_direct_compact(gfp_mask, order, zonelist,
+                                        high_zoneidx, nodemask, alloc_flags,
+                                        preferred_zone,
+                                        classzone_idx, migratetype,
+                                        migration_mode, &contended_compaction,
                                         &deferred_compaction,
                                         &did_some_progress);
                 if (page)
@@ -2693,11 +2714,12 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
 {
         enum zone_type high_zoneidx = gfp_zone(gfp_mask);
         struct zone *preferred_zone;
+        struct zoneref *preferred_zoneref;
         struct page *page = NULL;
         int migratetype = allocflags_to_migratetype(gfp_mask);
         unsigned int cpuset_mems_cookie;
         int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET|ALLOC_FAIR;
-        struct mem_cgroup *memcg = NULL;
+        int classzone_idx;
 
         gfp_mask &= gfp_allowed_mask;
 
@@ -2716,22 +2738,16 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
         if (unlikely(!zonelist->_zonerefs->zone))
                 return NULL;
 
-        /*
-         * Will only have any effect when __GFP_KMEMCG is set.  This is
-         * verified in the (always inline) callee
-         */
-        if (!memcg_kmem_newpage_charge(gfp_mask, &memcg, order))
-                return NULL;
-
 retry_cpuset:
         cpuset_mems_cookie = read_mems_allowed_begin();
 
         /* The preferred zone is used for statistics later */
-        first_zones_zonelist(zonelist, high_zoneidx,
+        preferred_zoneref = first_zones_zonelist(zonelist, high_zoneidx,
                                 nodemask ? : &cpuset_current_mems_allowed,
                                 &preferred_zone);
         if (!preferred_zone)
                 goto out;
+        classzone_idx = zonelist_zone_idx(preferred_zoneref);
 
 #ifdef CONFIG_CMA
         if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
@@ -2741,7 +2757,7 @@ retry:
         /* First allocation attempt */
         page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order,
                         zonelist, high_zoneidx, alloc_flags,
-                        preferred_zone, migratetype);
+                        preferred_zone, classzone_idx, migratetype);
         if (unlikely(!page)) {
                 /*
                  * The first pass makes sure allocations are spread
@@ -2767,7 +2783,7 @@ retry:
                 gfp_mask = memalloc_noio_flags(gfp_mask);
                 page = __alloc_pages_slowpath(gfp_mask, order,
                                 zonelist, high_zoneidx, nodemask,
-                                preferred_zone, migratetype);
+                                preferred_zone, classzone_idx, migratetype);
         }
 
         trace_mm_page_alloc(page, order, gfp_mask, migratetype);
@@ -2782,8 +2798,6 @@ out:
         if (unlikely(!page && read_mems_allowed_retry(cpuset_mems_cookie)))
                 goto retry_cpuset;
 
-        memcg_kmem_commit_charge(page, memcg, order);
-
         return page;
 }
 EXPORT_SYMBOL(__alloc_pages_nodemask);
@@ -2818,7 +2832,7 @@ void __free_pages(struct page *page, unsigned int order)
 {
         if (put_page_testzero(page)) {
                 if (order == 0)
-                        free_hot_cold_page(page, 0);
+                        free_hot_cold_page(page, false);
                 else
                         __free_pages_ok(page, order);
         }
@@ -2837,27 +2851,51 @@ void free_pages(unsigned long addr, unsigned int order)
 EXPORT_SYMBOL(free_pages);
 
 /*
- * __free_memcg_kmem_pages and free_memcg_kmem_pages will free
- * pages allocated with __GFP_KMEMCG.
- *
- * Those pages are accounted to a particular memcg, embedded in the
- * corresponding page_cgroup. To avoid adding a hit in the allocator to search
- * for that information only to find out that it is NULL for users who have no
- * interest in that whatsoever, we provide these functions.
+ * alloc_kmem_pages charges newly allocated pages to the kmem resource counter
+ * of the current memory cgroup.
  *
- * The caller knows better which flags it relies on.
+ * It should be used when the caller would like to use kmalloc, but since the
+ * allocation is large, it has to fall back to the page allocator.
  */
-void __free_memcg_kmem_pages(struct page *page, unsigned int order)
+struct page *alloc_kmem_pages(gfp_t gfp_mask, unsigned int order)
+{
+        struct page *page;
+        struct mem_cgroup *memcg = NULL;
+
+        if (!memcg_kmem_newpage_charge(gfp_mask, &memcg, order))
+                return NULL;
+        page = alloc_pages(gfp_mask, order);
+        memcg_kmem_commit_charge(page, memcg, order);
+        return page;
+}
+
+struct page *alloc_kmem_pages_node(int nid, gfp_t gfp_mask, unsigned int order)
+{
+        struct page *page;
+        struct mem_cgroup *memcg = NULL;
+
+        if (!memcg_kmem_newpage_charge(gfp_mask, &memcg, order))
+                return NULL;
+        page = alloc_pages_node(nid, gfp_mask, order);
+        memcg_kmem_commit_charge(page, memcg, order);
+        return page;
+}
+
+/*
+ * __free_kmem_pages and free_kmem_pages will free pages allocated with
+ * alloc_kmem_pages.
+ */
+void __free_kmem_pages(struct page *page, unsigned int order)
 {
         memcg_kmem_uncharge_pages(page, order);
         __free_pages(page, order);
 }
 
-void free_memcg_kmem_pages(unsigned long addr, unsigned int order)
+void free_kmem_pages(unsigned long addr, unsigned int order)
 {
         if (addr != 0) {
                 VM_BUG_ON(!virt_addr_valid((void *)addr));
-                __free_memcg_kmem_pages(virt_to_page((void *)addr), order);
+                __free_kmem_pages(virt_to_page((void *)addr), order);
         }
 }
 
@@ -4095,7 +4133,7 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
 
 static void __meminit zone_init_free_lists(struct zone *zone)
 {
-        int order, t;
+        unsigned int order, t;
         for_each_migratetype_order(order, t) {
                 INIT_LIST_HEAD(&zone->free_area[order].free_list[t]);
                 zone->free_area[order].nr_free = 0;
@@ -4349,9 +4387,6 @@ int __meminit init_currently_empty_zone(struct zone *zone,
 #ifndef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
 /*
  * Required by SPARSEMEM. Given a PFN, return what node the PFN is on.
- * Architectures may implement their own version but if add_active_range()
- * was used and there are no special requirements, this is a convenient
- * alternative
  */
 int __meminit __early_pfn_to_nid(unsigned long pfn)
 {
@@ -4406,10 +4441,9 @@ bool __meminit early_pfn_in_nid(unsigned long pfn, int node)
  * @nid: The node to free memory on. If MAX_NUMNODES, all nodes are freed.
  * @max_low_pfn: The highest PFN that will be passed to memblock_free_early_nid
  *
- * If an architecture guarantees that all ranges registered with
- * add_active_ranges() contain no holes and may be freed, this
- * this function may be used instead of calling memblock_free_early_nid()
- * manually.
+ * If an architecture guarantees that all ranges registered contain no holes
+ * and may be freed, this this function may be used instead of calling
+ * memblock_free_early_nid() manually.
  */
 void __init free_bootmem_with_active_regions(int nid, unsigned long max_low_pfn)
 {
@@ -4431,9 +4465,8 @@ void __init free_bootmem_with_active_regions(int nid, unsigned long max_low_pfn)
  * sparse_memory_present_with_active_regions - Call memory_present for each active range
  * @nid: The node to call memory_present for. If MAX_NUMNODES, all nodes will be used.
  *
- * If an architecture guarantees that all ranges registered with
- * add_active_ranges() contain no holes and may be freed, this
- * function may be used instead of calling memory_present() manually.
+ * If an architecture guarantees that all ranges registered contain no holes and may
+ * be freed, this function may be used instead of calling memory_present() manually.
  */
 void __init sparse_memory_present_with_active_regions(int nid)
 {
@@ -4451,7 +4484,7 @@ void __init sparse_memory_present_with_active_regions(int nid)
  * @end_pfn: Passed by reference. On return, it will have the node end_pfn.
  *
  * It returns the start and end page frame of a node based on information
- * provided by an arch calling add_active_range(). If called for a node
+ * provided by memblock_set_node(). If called for a node
  * with no available memory, a warning is printed and the start and end
  * PFNs will be 0.
  */
@@ -4921,8 +4954,6 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
 
         pgdat->node_id = nid;
         pgdat->node_start_pfn = node_start_pfn;
-        if (node_state(nid, N_MEMORY))
-                init_zone_allows_reclaim(nid);
 #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
         get_pfn_range_for_nid(nid, &start_pfn, &end_pfn);
 #endif
@@ -5030,7 +5061,7 @@ static unsigned long __init find_min_pfn_for_node(int nid)
  * find_min_pfn_with_active_regions - Find the minimum PFN registered
  *
  * It returns the minimum PFN based on information provided via
- * add_active_range().
+ * memblock_set_node().
  */
 unsigned long __init find_min_pfn_with_active_regions(void)
 {
@@ -5251,7 +5282,7 @@ static void check_for_memory(pg_data_t *pgdat, int nid)
  * @max_zone_pfn: an array of max PFNs for each zone
  *
  * This will call free_area_init_node() for each active node in the system.
- * Using the page ranges provided by add_active_range(), the size of each
+ * Using the page ranges provided by memblock_set_node(), the size of each
  * zone in each node and their holes is calculated. If the maximum PFN
  * between two adjacent zones match, it is assumed that the zone is empty.
  * For example, if arch_max_dma_pfn == arch_max_dma32_pfn, it is assumed
@@ -6009,53 +6040,64 @@ static inline int pfn_to_bitidx(struct zone *zone, unsigned long pfn)
  * @end_bitidx: The last bit of interest
  * returns pageblock_bits flags
  */
-unsigned long get_pageblock_flags_group(struct page *page,
-                                        int start_bitidx, int end_bitidx)
+unsigned long get_pfnblock_flags_mask(struct page *page, unsigned long pfn,
+                                        unsigned long end_bitidx,
+                                        unsigned long mask)
 {
         struct zone *zone;
         unsigned long *bitmap;
-        unsigned long pfn, bitidx;
-        unsigned long flags = 0;
-        unsigned long value = 1;
+        unsigned long bitidx, word_bitidx;
+        unsigned long word;
 
         zone = page_zone(page);
-        pfn = page_to_pfn(page);
         bitmap = get_pageblock_bitmap(zone, pfn);
         bitidx = pfn_to_bitidx(zone, pfn);
+        word_bitidx = bitidx / BITS_PER_LONG;
+        bitidx &= (BITS_PER_LONG-1);
 
-        for (; start_bitidx <= end_bitidx; start_bitidx++, value <<= 1)
-                if (test_bit(bitidx + start_bitidx, bitmap))
-                        flags |= value;
-
-        return flags;
+        word = bitmap[word_bitidx];
+        bitidx += end_bitidx;
+        return (word >> (BITS_PER_LONG - bitidx - 1)) & mask;
 }
 
 /**
- * set_pageblock_flags_group - Set the requested group of flags for a pageblock_nr_pages block of pages
+ * set_pfnblock_flags_mask - Set the requested group of flags for a pageblock_nr_pages block of pages
  * @page: The page within the block of interest
  * @start_bitidx: The first bit of interest
  * @end_bitidx: The last bit of interest
  * @flags: The flags to set
  */
-void set_pageblock_flags_group(struct page *page, unsigned long flags,
-                                        int start_bitidx, int end_bitidx)
+void set_pfnblock_flags_mask(struct page *page, unsigned long flags,
+                                        unsigned long pfn,
+                                        unsigned long end_bitidx,
+                                        unsigned long mask)
 {
         struct zone *zone;
         unsigned long *bitmap;
-        unsigned long pfn, bitidx;
-        unsigned long value = 1;
+        unsigned long bitidx, word_bitidx;
+        unsigned long old_word, word;
+
+        BUILD_BUG_ON(NR_PAGEBLOCK_BITS != 4);
 
         zone = page_zone(page);
-        pfn = page_to_pfn(page);
         bitmap = get_pageblock_bitmap(zone, pfn);
         bitidx = pfn_to_bitidx(zone, pfn);
+        word_bitidx = bitidx / BITS_PER_LONG;
+        bitidx &= (BITS_PER_LONG-1);
+
         VM_BUG_ON_PAGE(!zone_spans_pfn(zone, pfn), page);
 
-        for (; start_bitidx <= end_bitidx; start_bitidx++, value <<= 1)
-                if (flags & value)
-                        __set_bit(bitidx + start_bitidx, bitmap);
-                else
-                        __clear_bit(bitidx + start_bitidx, bitmap);
+        bitidx += end_bitidx;
+        mask <<= (BITS_PER_LONG - bitidx - 1);
+        flags <<= (BITS_PER_LONG - bitidx - 1);
+
+        word = ACCESS_ONCE(bitmap[word_bitidx]);
+        for (;;) {
+                old_word = cmpxchg(&bitmap[word_bitidx], word, (word & ~mask) | flags);
+                if (word == old_word)
+                        break;
+                word = old_word;
+        }
 }
 
 /*
@@ -6215,7 +6257,7 @@ static int __alloc_contig_migrate_range(struct compact_control *cc,
                 cc->nr_migratepages -= nr_reclaimed;
 
                 ret = migrate_pages(&cc->migratepages, alloc_migrate_target,
-                                    0, MIGRATE_SYNC, MR_CMA);
+                                    NULL, 0, cc->mode, MR_CMA);
         }
         if (ret < 0) {
                 putback_movable_pages(&cc->migratepages);
@@ -6254,7 +6296,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
                 .nr_migratepages = 0,
                 .order = -1,
                 .zone = page_zone(pfn_to_page(start)),
-                .sync = true,
+                .mode = MIGRATE_SYNC,
                 .ignore_skip_hint = true,
         };
         INIT_LIST_HEAD(&cc.migratepages);
@@ -6409,7 +6451,7 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
 {
         struct page *page;
         struct zone *zone;
-        int order, i;
+        unsigned int order, i;
         unsigned long pfn;
         unsigned long flags;
         /* find the first valid pfn */
@@ -6461,7 +6503,7 @@ bool is_free_buddy_page(struct page *page)
         struct zone *zone = page_zone(page);
         unsigned long pfn = page_to_pfn(page);
         unsigned long flags;
-        int order;
+        unsigned int order;
 
         spin_lock_irqsave(&zone->lock, flags);
         for (order = 0; order < MAX_ORDER; order++) {
diff --git a/mm/page_io.c b/mm/page_io.c
index 7c59ef681381..58b50d2901fe 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -248,11 +248,16 @@ out:
         return ret;
 }
 
+static sector_t swap_page_sector(struct page *page)
+{
+        return (sector_t)__page_file_index(page) << (PAGE_CACHE_SHIFT - 9);
+}
+
 int __swap_writepage(struct page *page, struct writeback_control *wbc,
         void (*end_write_func)(struct bio *, int))
 {
         struct bio *bio;
-        int ret = 0, rw = WRITE;
+        int ret, rw = WRITE;
         struct swap_info_struct *sis = page_swap_info(page);
 
         if (sis->flags & SWP_FILE) {
@@ -297,6 +302,13 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
                 return ret;
         }
 
+        ret = bdev_write_page(sis->bdev, swap_page_sector(page), page, wbc);
+        if (!ret) {
+                count_vm_event(PSWPOUT);
+                return 0;
+        }
+
+        ret = 0;
         bio = get_swap_bio(GFP_NOIO, page, end_write_func);
         if (bio == NULL) {
                 set_page_dirty(page);
@@ -338,6 +350,13 @@ int swap_readpage(struct page *page)
                 return ret;
         }
 
+        ret = bdev_read_page(sis->bdev, swap_page_sector(page), page);
+        if (!ret) {
+                count_vm_event(PSWPIN);
+                return 0;
+        }
+
+        ret = 0;
         bio = get_swap_bio(GFP_KERNEL, page, end_swap_bio_read);
         if (bio == NULL) {
                 unlock_page(page);
diff --git a/mm/rmap.c b/mm/rmap.c
index 9c3e77396d1a..ea8e20d75b29 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -103,6 +103,7 @@ static inline void anon_vma_free(struct anon_vma *anon_vma)
          * LOCK should suffice since the actual taking of the lock must
          * happen _before_ what follows.
          */
+        might_sleep();
         if (rwsem_is_locked(&anon_vma->root->rwsem)) {
                 anon_vma_lock_write(anon_vma);
                 anon_vma_unlock_write(anon_vma);
@@ -426,8 +427,9 @@ struct anon_vma *page_get_anon_vma(struct page *page)
          * above cannot corrupt).
          */
         if (!page_mapped(page)) {
+                rcu_read_unlock();
                 put_anon_vma(anon_vma);
-                anon_vma = NULL;
+                return NULL;
         }
 out:
         rcu_read_unlock();
@@ -477,9 +479,9 @@ struct anon_vma *page_lock_anon_vma_read(struct page *page)
         }
 
         if (!page_mapped(page)) {
+                rcu_read_unlock();
                 put_anon_vma(anon_vma);
-                anon_vma = NULL;
-                goto out;
+                return NULL;
         }
 
         /* we pinned the anon_vma, its safe to sleep */
@@ -669,7 +671,7 @@ struct page_referenced_arg {
 /*
  * arg: page_referenced_arg will be passed
  */
-int page_referenced_one(struct page *page, struct vm_area_struct *vma,
+static int page_referenced_one(struct page *page, struct vm_area_struct *vma,
                         unsigned long address, void *arg)
 {
         struct mm_struct *mm = vma->vm_mm;
@@ -986,6 +988,12 @@ void do_page_add_anon_rmap(struct page *page,
 {
         int first = atomic_inc_and_test(&page->_mapcount);
         if (first) {
+                /*
+                 * We use the irq-unsafe __{inc|mod}_zone_page_stat because
+                 * these counters are not modified in interrupt context, and
+                 * pte lock(a spinlock) is held, which implies preemption
+                 * disabled.
+                 */
                 if (PageTransHuge(page))
                         __inc_zone_page_state(page,
                                               NR_ANON_TRANSPARENT_HUGEPAGES);
@@ -1024,11 +1032,25 @@ void page_add_new_anon_rmap(struct page *page,
         __mod_zone_page_state(page_zone(page), NR_ANON_PAGES,
                         hpage_nr_pages(page));
         __page_set_anon_rmap(page, vma, address, 1);
-        if (!mlocked_vma_newpage(vma, page)) {
+
+        VM_BUG_ON_PAGE(PageLRU(page), page);
+        if (likely((vma->vm_flags & (VM_LOCKED | VM_SPECIAL)) != VM_LOCKED)) {
                 SetPageActive(page);
                 lru_cache_add(page);
-        } else
-                add_page_to_unevictable_list(page);
+                return;
+        }
+
+        if (!TestSetPageMlocked(page)) {
+                /*
+                 * We use the irq-unsafe __mod_zone_page_stat because this
+                 * counter is not modified from interrupt context, and the pte
+                 * lock is held(spinlock), which implies preemption disabled.
+                 */
+                __mod_zone_page_state(page_zone(page), NR_MLOCK,
+                                    hpage_nr_pages(page));
+                count_vm_event(UNEVICTABLE_PGMLOCKED);
+        }
+        add_page_to_unevictable_list(page);
 }
 
 /**
@@ -1077,6 +1099,11 @@ void page_remove_rmap(struct page *page)
         /*
          * Hugepages are not counted in NR_ANON_PAGES nor NR_FILE_MAPPED
          * and not charged by memcg for now.
+         *
+         * We use the irq-unsafe __{inc|mod}_zone_page_stat because
+         * these counters are not modified in interrupt context, and
+         * these counters are not modified in interrupt context, and
+         * pte lock(a spinlock) is held, which implies preemption disabled.
          */
         if (unlikely(PageHuge(page)))
                 goto out;
@@ -1112,7 +1139,7 @@ out:
 /*
  * @arg: enum ttu_flags will be passed to this argument
  */
-int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                      unsigned long address, void *arg)
 {
         struct mm_struct *mm = vma->vm_mm;
@@ -1135,7 +1162,7 @@ int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 if (vma->vm_flags & VM_LOCKED)
                         goto out_mlock;
 
-                if (TTU_ACTION(flags) == TTU_MUNLOCK)
+                if (flags & TTU_MUNLOCK)
                         goto out_unmap;
         }
         if (!(flags & TTU_IGNORE_ACCESS)) {
@@ -1203,7 +1230,7 @@ int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                          * pte. do_swap_page() will wait until the migration
                          * pte is removed and then restart fault handling.
                          */
-                        BUG_ON(TTU_ACTION(flags) != TTU_MIGRATION);
+                        BUG_ON(!(flags & TTU_MIGRATION));
                         entry = make_migration_entry(page, pte_write(pteval));
                 }
                 swp_pte = swp_entry_to_pte(entry);
@@ -1212,7 +1239,7 @@ int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 set_pte_at(mm, address, pte, swp_pte);
                 BUG_ON(pte_file(*pte));
         } else if (IS_ENABLED(CONFIG_MIGRATION) &&
-                   (TTU_ACTION(flags) == TTU_MIGRATION)) {
+                   (flags & TTU_MIGRATION)) {
                 /* Establish migration entry for a file page */
                 swp_entry_t entry;
                 entry = make_migration_entry(page, pte_write(pteval));
@@ -1225,7 +1252,7 @@ int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
 
 out_unmap:
         pte_unmap_unlock(pte, ptl);
-        if (ret != SWAP_FAIL)
+        if (ret != SWAP_FAIL && !(flags & TTU_MUNLOCK))
                 mmu_notifier_invalidate_page(mm, address);
 out:
         return ret;
@@ -1359,7 +1386,7 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
                 if (page->index != linear_page_index(vma, address)) {
                         pte_t ptfile = pgoff_to_pte(page->index);
                         if (pte_soft_dirty(pteval))
-                                pte_file_mksoft_dirty(ptfile);
+                                ptfile = pte_file_mksoft_dirty(ptfile);
                         set_pte_at(mm, address, pte, ptfile);
                 }
 
@@ -1512,7 +1539,7 @@ int try_to_unmap(struct page *page, enum ttu_flags flags)
          * locking requirements of exec(), migration skips
          * temporary VMAs until after exec() completes.
          */
-        if (flags & TTU_MIGRATION && !PageKsm(page) && PageAnon(page))
+        if ((flags & TTU_MIGRATION) && !PageKsm(page) && PageAnon(page))
                 rwc.invalid_vma = invalid_migration_vma;
 
         ret = rmap_walk(page, &rwc);
diff --git a/mm/shmem.c b/mm/shmem.c
index 9f70e02111c6..5402481c28d1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1132,7 +1132,7 @@ repeat:
                         goto decused;
                 }
 
-                SetPageSwapBacked(page);
+                __SetPageSwapBacked(page);
                 __set_page_locked(page);
                 error = mem_cgroup_charge_file(page, current->mm,
                                                 gfp & GFP_RECLAIM_MASK);
@@ -1372,9 +1372,13 @@ shmem_write_begin(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned flags,
                         struct page **pagep, void **fsdata)
 {
+        int ret;
         struct inode *inode = mapping->host;
         pgoff_t index = pos >> PAGE_CACHE_SHIFT;
-        return shmem_getpage(inode, index, pagep, SGP_WRITE, NULL);
+        ret = shmem_getpage(inode, index, pagep, SGP_WRITE, NULL);
+        if (ret == 0 && *pagep)
+                init_page_accessed(*pagep);
+        return ret;
 }
 
 static int
diff --git a/mm/slab.c b/mm/slab.c
index 19d92181ce24..9ca3b87edabc 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1621,10 +1621,16 @@ __initcall(cpucache_init);
 static noinline void
 slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
 {
+#if DEBUG
         struct kmem_cache_node *n;
         struct page *page;
         unsigned long flags;
         int node;
+        static DEFINE_RATELIMIT_STATE(slab_oom_rs, DEFAULT_RATELIMIT_INTERVAL,
+                                      DEFAULT_RATELIMIT_BURST);
+
+        if ((gfpflags & __GFP_NOWARN) || !__ratelimit(&slab_oom_rs))
+                return;
 
         printk(KERN_WARNING
                 "SLAB: Unable to allocate memory on node %d (gfp=0x%x)\n",
@@ -1662,6 +1668,7 @@ slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
                         node, active_slabs, num_slabs, active_objs, num_objs,
                         free_objects);
         }
+#endif
 }
 
 /*
@@ -1681,10 +1688,13 @@ static struct page *kmem_getpages(struct kmem_cache *cachep, gfp_t flags,
         if (cachep->flags & SLAB_RECLAIM_ACCOUNT)
                 flags |= __GFP_RECLAIMABLE;
 
+        if (memcg_charge_slab(cachep, flags, cachep->gfporder))
+                return NULL;
+
         page = alloc_pages_exact_node(nodeid, flags | __GFP_NOTRACK, cachep->gfporder);
         if (!page) {
-                if (!(flags & __GFP_NOWARN) && printk_ratelimit())
-                        slab_out_of_memory(cachep, flags, nodeid);
+                memcg_uncharge_slab(cachep, cachep->gfporder);
+                slab_out_of_memory(cachep, flags, nodeid);
                 return NULL;
         }
 
@@ -1702,7 +1712,6 @@ static struct page *kmem_getpages(struct kmem_cache *cachep, gfp_t flags,
         __SetPageSlab(page);
         if (page->pfmemalloc)
                 SetPageSlabPfmemalloc(page);
-        memcg_bind_pages(cachep, cachep->gfporder);
 
         if (kmemcheck_enabled && !(cachep->flags & SLAB_NOTRACK)) {
                 kmemcheck_alloc_shadow(page, cachep->gfporder, flags, nodeid);
@@ -1738,10 +1747,10 @@ static void kmem_freepages(struct kmem_cache *cachep, struct page *page)
         page_mapcount_reset(page);
         page->mapping = NULL;
 
-        memcg_release_pages(cachep, cachep->gfporder);
         if (current->reclaim_state)
                 current->reclaim_state->reclaimed_slab += nr_freed;
-        __free_memcg_kmem_pages(page, cachep->gfporder);
+        __free_pages(page, cachep->gfporder);
+        memcg_uncharge_slab(cachep, cachep->gfporder);
 }
 
 static void kmem_rcu_free(struct rcu_head *head)
@@ -2469,8 +2478,7 @@ out:
         return nr_freed;
 }
 
-/* Called with slab_mutex held to protect against cpu hotplug */
-static int __cache_shrink(struct kmem_cache *cachep)
+int __kmem_cache_shrink(struct kmem_cache *cachep)
 {
         int ret = 0, i = 0;
         struct kmem_cache_node *n;
@@ -2491,32 +2499,11 @@ static int __cache_shrink(struct kmem_cache *cachep)
         return (ret ? 1 : 0);
 }
 
-/**
- * kmem_cache_shrink - Shrink a cache.
- * @cachep: The cache to shrink.
- *
- * Releases as many slabs as possible for a cache.
- * To help debugging, a zero exit status indicates all slabs were released.
- */
-int kmem_cache_shrink(struct kmem_cache *cachep)
-{
-        int ret;
-        BUG_ON(!cachep || in_interrupt());
-
-        get_online_cpus();
-        mutex_lock(&slab_mutex);
-        ret = __cache_shrink(cachep);
-        mutex_unlock(&slab_mutex);
-        put_online_cpus();
-        return ret;
-}
-EXPORT_SYMBOL(kmem_cache_shrink);
-
 int __kmem_cache_shutdown(struct kmem_cache *cachep)
 {
         int i;
         struct kmem_cache_node *n;
-        int rc = __cache_shrink(cachep);
+        int rc = __kmem_cache_shrink(cachep);
 
         if (rc)
                 return rc;
diff --git a/mm/slab.h b/mm/slab.h
index 6bd4c353704f..961a3fb1f5a2 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -91,6 +91,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
 #define CACHE_CREATE_MASK (SLAB_CORE_FLAGS | SLAB_DEBUG_FLAGS | SLAB_CACHE_FLAGS)
 
 int __kmem_cache_shutdown(struct kmem_cache *);
+int __kmem_cache_shrink(struct kmem_cache *);
 void slab_kmem_cache_release(struct kmem_cache *);
 
 struct seq_file;
@@ -120,21 +121,6 @@ static inline bool is_root_cache(struct kmem_cache *s)
         return !s->memcg_params || s->memcg_params->is_root_cache;
 }
 
-static inline void memcg_bind_pages(struct kmem_cache *s, int order)
-{
-        if (!is_root_cache(s))
-                atomic_add(1 << order, &s->memcg_params->nr_pages);
-}
-
-static inline void memcg_release_pages(struct kmem_cache *s, int order)
-{
-        if (is_root_cache(s))
-                return;
-
-        if (atomic_sub_and_test((1 << order), &s->memcg_params->nr_pages))
-                mem_cgroup_destroy_cache(s);
-}
-
 static inline bool slab_equal_or_root(struct kmem_cache *s,
                                         struct kmem_cache *p)
 {
@@ -192,18 +178,29 @@ static inline struct kmem_cache *memcg_root_cache(struct kmem_cache *s)
                 return s;
         return s->memcg_params->root_cache;
 }
-#else
-static inline bool is_root_cache(struct kmem_cache *s)
+
+static __always_inline int memcg_charge_slab(struct kmem_cache *s,
+                                             gfp_t gfp, int order)
 {
-        return true;
+        if (!memcg_kmem_enabled())
+                return 0;
+        if (is_root_cache(s))
+                return 0;
+        return __memcg_charge_slab(s, gfp, order);
 }
 
-static inline void memcg_bind_pages(struct kmem_cache *s, int order)
+static __always_inline void memcg_uncharge_slab(struct kmem_cache *s, int order)
 {
+        if (!memcg_kmem_enabled())
+                return;
+        if (is_root_cache(s))
+                return;
+        __memcg_uncharge_slab(s, order);
 }
-
-static inline void memcg_release_pages(struct kmem_cache *s, int order)
+#else
+static inline bool is_root_cache(struct kmem_cache *s)
 {
+        return true;
 }
 
 static inline bool slab_equal_or_root(struct kmem_cache *s,
@@ -227,6 +224,15 @@ static inline struct kmem_cache *memcg_root_cache(struct kmem_cache *s)
 {
         return s;
 }
+
+static inline int memcg_charge_slab(struct kmem_cache *s, gfp_t gfp, int order)
+{
+        return 0;
+}
+
+static inline void memcg_uncharge_slab(struct kmem_cache *s, int order)
+{
+}
 #endif
 
 static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 102cc6fca3d3..735e01a0db6f 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -160,7 +160,6 @@ do_kmem_cache_create(char *name, size_t object_size, size_t size, size_t align,
 
         s->refcount = 1;
         list_add(&s->list, &slab_caches);
-        memcg_register_cache(s);
 out:
         if (err)
                 return ERR_PTR(err);
@@ -205,6 +204,8 @@ kmem_cache_create(const char *name, size_t size, size_t align,
         int err;
 
         get_online_cpus();
+        get_online_mems();
+
         mutex_lock(&slab_mutex);
 
         err = kmem_cache_sanity_check(name, size);
@@ -239,6 +240,8 @@ kmem_cache_create(const char *name, size_t size, size_t align,
 
 out_unlock:
         mutex_unlock(&slab_mutex);
+
+        put_online_mems();
         put_online_cpus();
 
         if (err) {
@@ -258,31 +261,29 @@ EXPORT_SYMBOL(kmem_cache_create);
 
 #ifdef CONFIG_MEMCG_KMEM
 /*
- * kmem_cache_create_memcg - Create a cache for a memory cgroup.
+ * memcg_create_kmem_cache - Create a cache for a memory cgroup.
  * @memcg: The memory cgroup the new cache is for.
  * @root_cache: The parent of the new cache.
+ * @memcg_name: The name of the memory cgroup (used for naming the new cache).
  *
  * This function attempts to create a kmem cache that will serve allocation
  * requests going from @memcg to @root_cache. The new cache inherits properties
  * from its parent.
  */
-void kmem_cache_create_memcg(struct mem_cgroup *memcg, struct kmem_cache *root_cache)
+struct kmem_cache *memcg_create_kmem_cache(struct mem_cgroup *memcg,
+                                           struct kmem_cache *root_cache,
+                                           const char *memcg_name)
 {
-        struct kmem_cache *s;
+        struct kmem_cache *s = NULL;
         char *cache_name;
 
         get_online_cpus();
-        mutex_lock(&slab_mutex);
+        get_online_mems();
 
-        /*
-         * Since per-memcg caches are created asynchronously on first
-         * allocation (see memcg_kmem_get_cache()), several threads can try to
-         * create the same cache, but only one of them may succeed.
-         */
-        if (cache_from_memcg_idx(root_cache, memcg_cache_id(memcg)))
-                goto out_unlock;
+        mutex_lock(&slab_mutex);
 
-        cache_name = memcg_create_cache_name(memcg, root_cache);
+        cache_name = kasprintf(GFP_KERNEL, "%s(%d:%s)", root_cache->name,
+                               memcg_cache_id(memcg), memcg_name);
         if (!cache_name)
                 goto out_unlock;
 
@@ -292,17 +293,19 @@ void kmem_cache_create_memcg(struct mem_cgroup *memcg, struct kmem_cache *root_c
                                  memcg, root_cache);
         if (IS_ERR(s)) {
                 kfree(cache_name);
-                goto out_unlock;
+                s = NULL;
         }
 
-        s->allocflags |= __GFP_KMEMCG;
-
 out_unlock:
         mutex_unlock(&slab_mutex);
+
+        put_online_mems();
         put_online_cpus();
+
+        return s;
 }
 
-static int kmem_cache_destroy_memcg_children(struct kmem_cache *s)
+static int memcg_cleanup_cache_params(struct kmem_cache *s)
 {
         int rc;
 
@@ -311,13 +314,13 @@ static int kmem_cache_destroy_memcg_children(struct kmem_cache *s)
                 return 0;
 
         mutex_unlock(&slab_mutex);
-        rc = __kmem_cache_destroy_memcg_children(s);
+        rc = __memcg_cleanup_cache_params(s);
         mutex_lock(&slab_mutex);
 
         return rc;
 }
 #else
-static int kmem_cache_destroy_memcg_children(struct kmem_cache *s)
+static int memcg_cleanup_cache_params(struct kmem_cache *s)
 {
         return 0;
 }
@@ -332,27 +335,26 @@ void slab_kmem_cache_release(struct kmem_cache *s)
 void kmem_cache_destroy(struct kmem_cache *s)
 {
         get_online_cpus();
+        get_online_mems();
+
         mutex_lock(&slab_mutex);
 
         s->refcount--;
         if (s->refcount)
                 goto out_unlock;
 
-        if (kmem_cache_destroy_memcg_children(s) != 0)
+        if (memcg_cleanup_cache_params(s) != 0)
                 goto out_unlock;
 
-        list_del(&s->list);
-        memcg_unregister_cache(s);
-
         if (__kmem_cache_shutdown(s) != 0) {
-                list_add(&s->list, &slab_caches);
-                memcg_register_cache(s);
                 printk(KERN_ERR "kmem_cache_destroy %s: "
                        "Slab cache still has objects\n", s->name);
                 dump_stack();
                 goto out_unlock;
         }
 
+        list_del(&s->list);
+
         mutex_unlock(&slab_mutex);
         if (s->flags & SLAB_DESTROY_BY_RCU)
                 rcu_barrier();
@@ -363,15 +365,36 @@ void kmem_cache_destroy(struct kmem_cache *s)
 #else
         slab_kmem_cache_release(s);
 #endif
-        goto out_put_cpus;
+        goto out;
 
 out_unlock:
         mutex_unlock(&slab_mutex);
-out_put_cpus:
+out:
+        put_online_mems();
         put_online_cpus();
 }
 EXPORT_SYMBOL(kmem_cache_destroy);
 
+/**
+ * kmem_cache_shrink - Shrink a cache.
+ * @cachep: The cache to shrink.
+ *
+ * Releases as many slabs as possible for a cache.
+ * To help debugging, a zero exit status indicates all slabs were released.
+ */
+int kmem_cache_shrink(struct kmem_cache *cachep)
+{
+        int ret;
+
+        get_online_cpus();
+        get_online_mems();
+        ret = __kmem_cache_shrink(cachep);
+        put_online_mems();
+        put_online_cpus();
+        return ret;
+}
+EXPORT_SYMBOL(kmem_cache_shrink);
+
 int slab_is_available(void)
 {
         return slab_state >= UP;
@@ -586,6 +609,24 @@ void __init create_kmalloc_caches(unsigned long flags)
 }
 #endif /* !CONFIG_SLOB */
 
+/*
+ * To avoid unnecessary overhead, we pass through large allocation requests
+ * directly to the page allocator. We use __GFP_COMP, because we will need to
+ * know the allocation order to free the pages properly in kfree.
+ */
+void *kmalloc_order(size_t size, gfp_t flags, unsigned int order)
+{
+        void *ret;
+        struct page *page;
+
+        flags |= __GFP_COMP;
+        page = alloc_kmem_pages(flags, order);
+        ret = page ? page_address(page) : NULL;
+        kmemleak_alloc(ret, size, 1, flags);
+        return ret;
+}
+EXPORT_SYMBOL(kmalloc_order);
+
 #ifdef CONFIG_TRACING
 void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order)
 {
diff --git a/mm/slob.c b/mm/slob.c
index 730cad45d4be..21980e0f39a8 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -620,11 +620,10 @@ int __kmem_cache_shutdown(struct kmem_cache *c)
         return 0;
 }
 
-int kmem_cache_shrink(struct kmem_cache *d)
+int __kmem_cache_shrink(struct kmem_cache *d)
 {
         return 0;
 }
-EXPORT_SYMBOL(kmem_cache_shrink);
 
 struct kmem_cache kmem_cache_boot = {
         .name = "kmem_cache",
diff --git a/mm/slub.c b/mm/slub.c
index 2b1ce697fc4b..fdf0fe4da9a9 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -403,7 +403,7 @@ static inline bool __cmpxchg_double_slab(struct kmem_cache *s, struct page *page
         stat(s, CMPXCHG_DOUBLE_FAIL);
 
 #ifdef SLUB_DEBUG_CMPXCHG
-        printk(KERN_INFO "%s %s: cmpxchg double redo ", n, s->name);
+        pr_info("%s %s: cmpxchg double redo ", n, s->name);
 #endif
 
         return 0;
@@ -444,7 +444,7 @@ static inline bool cmpxchg_double_slab(struct kmem_cache *s, struct page *page,
         stat(s, CMPXCHG_DOUBLE_FAIL);
 
 #ifdef SLUB_DEBUG_CMPXCHG
-        printk(KERN_INFO "%s %s: cmpxchg double redo ", n, s->name);
+        pr_info("%s %s: cmpxchg double redo ", n, s->name);
 #endif
 
         return 0;
@@ -546,14 +546,14 @@ static void print_track(const char *s, struct track *t)
         if (!t->addr)
                 return;
 
-        printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
-                s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
+        pr_err("INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
+               s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
 #ifdef CONFIG_STACKTRACE
         {
                 int i;
                 for (i = 0; i < TRACK_ADDRS_COUNT; i++)
                         if (t->addrs[i])
-                                printk(KERN_ERR "\t%pS\n", (void *)t->addrs[i]);
+                                pr_err("\t%pS\n", (void *)t->addrs[i]);
                         else
                                 break;
         }
@@ -571,38 +571,37 @@ static void print_tracking(struct kmem_cache *s, void *object)
 
 static void print_page_info(struct page *page)
 {
-        printk(KERN_ERR
-               "INFO: Slab 0x%p objects=%u used=%u fp=0x%p flags=0x%04lx\n",
+        pr_err("INFO: Slab 0x%p objects=%u used=%u fp=0x%p flags=0x%04lx\n",
                page, page->objects, page->inuse, page->freelist, page->flags);
 
 }
 
 static void slab_bug(struct kmem_cache *s, char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
-        char buf[100];
 
         va_start(args, fmt);
-        vsnprintf(buf, sizeof(buf), fmt, args);
-        va_end(args);
-        printk(KERN_ERR "========================================"
-                        "=====================================\n");
-        printk(KERN_ERR "BUG %s (%s): %s\n", s->name, print_tainted(), buf);
-        printk(KERN_ERR "----------------------------------------"
-                        "-------------------------------------\n\n");
+        vaf.fmt = fmt;
+        vaf.va = &args;
+        pr_err("=============================================================================\n");
+        pr_err("BUG %s (%s): %pV\n", s->name, print_tainted(), &vaf);
+        pr_err("-----------------------------------------------------------------------------\n\n");
 
         add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+        va_end(args);
 }
 
 static void slab_fix(struct kmem_cache *s, char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
-        char buf[100];
 
         va_start(args, fmt);
-        vsnprintf(buf, sizeof(buf), fmt, args);
+        vaf.fmt = fmt;
+        vaf.va = &args;
+        pr_err("FIX %s: %pV\n", s->name, &vaf);
         va_end(args);
-        printk(KERN_ERR "FIX %s: %s\n", s->name, buf);
 }
 
 static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
@@ -614,8 +613,8 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
 
         print_page_info(page);
 
-        printk(KERN_ERR "INFO: Object 0x%p @offset=%tu fp=0x%p\n\n",
-                        p, p - addr, get_freepointer(s, p));
+        pr_err("INFO: Object 0x%p @offset=%tu fp=0x%p\n\n",
+               p, p - addr, get_freepointer(s, p));
 
         if (p > addr + 16)
                 print_section("Bytes b4 ", p - 16, 16);
@@ -698,7 +697,7 @@ static int check_bytes_and_report(struct kmem_cache *s, struct page *page,
                 end--;
 
         slab_bug(s, "%s overwritten", what);
-        printk(KERN_ERR "INFO: 0x%p-0x%p. First byte 0x%x instead of 0x%x\n",
+        pr_err("INFO: 0x%p-0x%p. First byte 0x%x instead of 0x%x\n",
                                         fault, end - 1, fault[0], value);
         print_trailer(s, page, object);
 
@@ -931,7 +930,7 @@ static void trace(struct kmem_cache *s, struct page *page, void *object,
                                                                 int alloc)
 {
         if (s->flags & SLAB_TRACE) {
-                printk(KERN_INFO "TRACE %s %s 0x%p inuse=%d fp=0x%p\n",
+                pr_info("TRACE %s %s 0x%p inuse=%d fp=0x%p\n",
                         s->name,
                         alloc ? "alloc" : "free",
                         object, page->inuse,
@@ -1134,9 +1133,8 @@ static noinline struct kmem_cache_node *free_debug_processing(
                         slab_err(s, page, "Attempt to free object(0x%p) "
                                 "outside of slab", object);
                 } else if (!page->slab_cache) {
-                        printk(KERN_ERR
-                                "SLUB <none>: no slab for object 0x%p.\n",
-                                                object);
+                        pr_err("SLUB <none>: no slab for object 0x%p.\n",
+                               object);
                         dump_stack();
                 } else
                         object_err(s, page, object,
@@ -1219,8 +1217,8 @@ static int __init setup_slub_debug(char *str)
                         slub_debug |= SLAB_FAILSLAB;
                         break;
                 default:
-                        printk(KERN_ERR "slub_debug option '%c' "
-                                "unknown. skipped\n", *str);
+                        pr_err("slub_debug option '%c' unknown. skipped\n",
+                               *str);
                 }
         }
 
@@ -1314,17 +1312,26 @@ static inline void slab_free_hook(struct kmem_cache *s, void *x)
 /*
  * Slab allocation and freeing
  */
-static inline struct page *alloc_slab_page(gfp_t flags, int node,
-                                        struct kmem_cache_order_objects oo)
+static inline struct page *alloc_slab_page(struct kmem_cache *s,
+                gfp_t flags, int node, struct kmem_cache_order_objects oo)
 {
+        struct page *page;
         int order = oo_order(oo);
 
         flags |= __GFP_NOTRACK;
 
+        if (memcg_charge_slab(s, flags, order))
+                return NULL;
+
         if (node == NUMA_NO_NODE)
-                return alloc_pages(flags, order);
+                page = alloc_pages(flags, order);
         else
-                return alloc_pages_exact_node(node, flags, order);
+                page = alloc_pages_exact_node(node, flags, order);
+
+        if (!page)
+                memcg_uncharge_slab(s, order);
+
+        return page;
 }
 
 static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
@@ -1346,7 +1353,7 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
          */
         alloc_gfp = (flags | __GFP_NOWARN | __GFP_NORETRY) & ~__GFP_NOFAIL;
 
-        page = alloc_slab_page(alloc_gfp, node, oo);
+        page = alloc_slab_page(s, alloc_gfp, node, oo);
         if (unlikely(!page)) {
                 oo = s->min;
                 alloc_gfp = flags;
@@ -1354,7 +1361,7 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
                  * Allocation may have failed due to fragmentation.
                  * Try a lower order alloc if possible
                  */
-                page = alloc_slab_page(alloc_gfp, node, oo);
+                page = alloc_slab_page(s, alloc_gfp, node, oo);
 
                 if (page)
                         stat(s, ORDER_FALLBACK);
@@ -1415,7 +1422,6 @@ static struct page *new_slab(struct kmem_cache *s, gfp_t flags, int node)
 
         order = compound_order(page);
         inc_slabs_node(s, page_to_nid(page), page->objects);
-        memcg_bind_pages(s, order);
         page->slab_cache = s;
         __SetPageSlab(page);
         if (page->pfmemalloc)
@@ -1466,11 +1472,11 @@ static void __free_slab(struct kmem_cache *s, struct page *page)
         __ClearPageSlabPfmemalloc(page);
         __ClearPageSlab(page);
 
-        memcg_release_pages(s, order);
         page_mapcount_reset(page);
         if (current->reclaim_state)
                 current->reclaim_state->reclaimed_slab += pages;
-        __free_memcg_kmem_pages(page, order);
+        __free_pages(page, order);
+        memcg_uncharge_slab(s, order);
 }
 
 #define need_reserve_slab_rcu                                           \
@@ -1770,19 +1776,19 @@ static inline void note_cmpxchg_failure(const char *n,
 #ifdef SLUB_DEBUG_CMPXCHG
         unsigned long actual_tid = __this_cpu_read(s->cpu_slab->tid);
 
-        printk(KERN_INFO "%s %s: cmpxchg redo ", n, s->name);
+        pr_info("%s %s: cmpxchg redo ", n, s->name);
 
 #ifdef CONFIG_PREEMPT
         if (tid_to_cpu(tid) != tid_to_cpu(actual_tid))
-                printk("due to cpu change %d -> %d\n",
+                pr_warn("due to cpu change %d -> %d\n",
                         tid_to_cpu(tid), tid_to_cpu(actual_tid));
         else
 #endif
         if (tid_to_event(tid) != tid_to_event(actual_tid))
-                printk("due to cpu running other code. Event %ld->%ld\n",
+                pr_warn("due to cpu running other code. Event %ld->%ld\n",
                         tid_to_event(tid), tid_to_event(actual_tid));
         else
-                printk("for unknown reason: actual=%lx was=%lx target=%lx\n",
+                pr_warn("for unknown reason: actual=%lx was=%lx target=%lx\n",
                         actual_tid, tid, next_tid(tid));
 #endif
         stat(s, CMPXCHG_DOUBLE_CPU_FAIL);
@@ -2121,11 +2127,19 @@ static inline int node_match(struct page *page, int node)
         return 1;
 }
 
+#ifdef CONFIG_SLUB_DEBUG
 static int count_free(struct page *page)
 {
         return page->objects - page->inuse;
 }
 
+static inline unsigned long node_nr_objs(struct kmem_cache_node *n)
+{
+        return atomic_long_read(&n->total_objects);
+}
+#endif /* CONFIG_SLUB_DEBUG */
+
+#if defined(CONFIG_SLUB_DEBUG) || defined(CONFIG_SYSFS)
 static unsigned long count_partial(struct kmem_cache_node *n,
                                         int (*get_count)(struct page *))
 {
@@ -2139,31 +2153,28 @@ static unsigned long count_partial(struct kmem_cache_node *n,
         spin_unlock_irqrestore(&n->list_lock, flags);
         return x;
 }
-
-static inline unsigned long node_nr_objs(struct kmem_cache_node *n)
-{
-#ifdef CONFIG_SLUB_DEBUG
-        return atomic_long_read(&n->total_objects);
-#else
-        return 0;
-#endif
-}
+#endif /* CONFIG_SLUB_DEBUG || CONFIG_SYSFS */
 
 static noinline void
 slab_out_of_memory(struct kmem_cache *s, gfp_t gfpflags, int nid)
 {
+#ifdef CONFIG_SLUB_DEBUG
+        static DEFINE_RATELIMIT_STATE(slub_oom_rs, DEFAULT_RATELIMIT_INTERVAL,
+                                      DEFAULT_RATELIMIT_BURST);
         int node;
 
-        printk(KERN_WARNING
-                "SLUB: Unable to allocate memory on node %d (gfp=0x%x)\n",
+        if ((gfpflags & __GFP_NOWARN) || !__ratelimit(&slub_oom_rs))
+                return;
+
+        pr_warn("SLUB: Unable to allocate memory on node %d (gfp=0x%x)\n",
                 nid, gfpflags);
-        printk(KERN_WARNING "  cache: %s, object size: %d, buffer size: %d, "
-                "default order: %d, min order: %d\n", s->name, s->object_size,
-                s->size, oo_order(s->oo), oo_order(s->min));
+        pr_warn("  cache: %s, object size: %d, buffer size: %d, default order: %d, min order: %d\n",
+                s->name, s->object_size, s->size, oo_order(s->oo),
+                oo_order(s->min));
 
         if (oo_order(s->min) > get_order(s->object_size))
-                printk(KERN_WARNING "  %s debugging increased min order, use "
-                       "slub_debug=O to disable.\n", s->name);
+                pr_warn("  %s debugging increased min order, use slub_debug=O to disable.\n",
+                        s->name);
 
         for_each_online_node(node) {
                 struct kmem_cache_node *n = get_node(s, node);
@@ -2178,10 +2189,10 @@ slab_out_of_memory(struct kmem_cache *s, gfp_t gfpflags, int nid)
                 nr_slabs = node_nr_slabs(n);
                 nr_objs  = node_nr_objs(n);
 
-                printk(KERN_WARNING
-                        "  node %d: slabs: %ld, objs: %ld, free: %ld\n",
+                pr_warn("  node %d: slabs: %ld, objs: %ld, free: %ld\n",
                         node, nr_slabs, nr_objs, nr_free);
         }
+#endif
 }
 
 static inline void *new_slab_objects(struct kmem_cache *s, gfp_t flags,
@@ -2198,7 +2209,7 @@ static inline void *new_slab_objects(struct kmem_cache *s, gfp_t flags,
 
         page = new_slab(s, flags, node);
         if (page) {
-                c = __this_cpu_ptr(s->cpu_slab);
+                c = raw_cpu_ptr(s->cpu_slab);
                 if (c->page)
                         flush_slab(s, c);
 
@@ -2323,8 +2334,6 @@ redo:
         if (freelist)
                 goto load_freelist;
 
-        stat(s, ALLOC_SLOWPATH);
-
         freelist = get_freelist(s, page);
 
         if (!freelist) {
@@ -2360,9 +2369,7 @@ new_slab:
         freelist = new_slab_objects(s, gfpflags, node, &c);
 
         if (unlikely(!freelist)) {
-                if (!(gfpflags & __GFP_NOWARN) && printk_ratelimit())
-                        slab_out_of_memory(s, gfpflags, node);
-
+                slab_out_of_memory(s, gfpflags, node);
                 local_irq_restore(flags);
                 return NULL;
         }
@@ -2418,7 +2425,7 @@ redo:
          * and the retrieval of the tid.
          */
         preempt_disable();
-        c = __this_cpu_ptr(s->cpu_slab);
+        c = this_cpu_ptr(s->cpu_slab);
 
         /*
          * The transaction ids are globally unique per cpu and per operation on
@@ -2431,10 +2438,10 @@ redo:
 
         object = c->freelist;
         page = c->page;
-        if (unlikely(!object || !node_match(page, node)))
+        if (unlikely(!object || !node_match(page, node))) {
                 object = __slab_alloc(s, gfpflags, node, addr, c);
-
-        else {
+                stat(s, ALLOC_SLOWPATH);
+        } else {
                 void *next_object = get_freepointer_safe(s, object);
 
                 /*
@@ -2674,7 +2681,7 @@ redo:
          * during the cmpxchg then the free will succedd.
          */
         preempt_disable();
-        c = __this_cpu_ptr(s->cpu_slab);
+        c = this_cpu_ptr(s->cpu_slab);
 
         tid = c->tid;
         preempt_enable();
@@ -2894,10 +2901,8 @@ static void early_kmem_cache_node_alloc(int node)
 
         BUG_ON(!page);
         if (page_to_nid(page) != node) {
-                printk(KERN_ERR "SLUB: Unable to allocate memory from "
-                                "node %d\n", node);
-                printk(KERN_ERR "SLUB: Allocating a useless per node structure "
-                                "in order to be able to continue\n");
+                pr_err("SLUB: Unable to allocate memory from node %d\n", node);
+                pr_err("SLUB: Allocating a useless per node structure in order to be able to continue\n");
         }
 
         n = page->freelist;
@@ -3182,8 +3187,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
         for_each_object(p, s, addr, page->objects) {
 
                 if (!test_bit(slab_index(p, s, addr), map)) {
-                        printk(KERN_ERR "INFO: Object 0x%p @offset=%tu\n",
-                                                        p, p - addr);
+                        pr_err("INFO: Object 0x%p @offset=%tu\n", p, p - addr);
                         print_tracking(s, p);
                 }
         }
@@ -3305,8 +3309,8 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
         struct page *page;
         void *ptr = NULL;
 
-        flags |= __GFP_COMP | __GFP_NOTRACK | __GFP_KMEMCG;
-        page = alloc_pages_node(node, flags, get_order(size));
+        flags |= __GFP_COMP | __GFP_NOTRACK;
+        page = alloc_kmem_pages_node(node, flags, get_order(size));
         if (page)
                 ptr = page_address(page);
 
@@ -3375,7 +3379,7 @@ void kfree(const void *x)
         if (unlikely(!PageSlab(page))) {
                 BUG_ON(!PageCompound(page));
                 kfree_hook(x);
-                __free_memcg_kmem_pages(page, compound_order(page));
+                __free_kmem_pages(page, compound_order(page));
                 return;
         }
         slab_free(page->slab_cache, page, object, _RET_IP_);
@@ -3392,7 +3396,7 @@ EXPORT_SYMBOL(kfree);
  * being allocated from last increasing the chance that the last objects
  * are freed in them.
  */
-int kmem_cache_shrink(struct kmem_cache *s)
+int __kmem_cache_shrink(struct kmem_cache *s)
 {
         int node;
         int i;
@@ -3448,7 +3452,6 @@ int kmem_cache_shrink(struct kmem_cache *s)
         kfree(slabs_by_inuse);
         return 0;
 }
-EXPORT_SYMBOL(kmem_cache_shrink);
 
 static int slab_mem_going_offline_callback(void *arg)
 {
@@ -3456,7 +3459,7 @@ static int slab_mem_going_offline_callback(void *arg)
 
         mutex_lock(&slab_mutex);
         list_for_each_entry(s, &slab_caches, list)
-                kmem_cache_shrink(s);
+                __kmem_cache_shrink(s);
         mutex_unlock(&slab_mutex);
 
         return 0;
@@ -3650,9 +3653,7 @@ void __init kmem_cache_init(void)
         register_cpu_notifier(&slab_notifier);
 #endif
 
-        printk(KERN_INFO
-                "SLUB: HWalign=%d, Order=%d-%d, MinObjects=%d,"
-                " CPUs=%d, Nodes=%d\n",
+        pr_info("SLUB: HWalign=%d, Order=%d-%d, MinObjects=%d, CPUs=%d, Nodes=%d\n",
                 cache_line_size(),
                 slub_min_order, slub_max_order, slub_min_objects,
                 nr_cpu_ids, nr_node_ids);
@@ -3934,8 +3935,8 @@ static int validate_slab_node(struct kmem_cache *s,
                 count++;
         }
         if (count != n->nr_partial)
-                printk(KERN_ERR "SLUB %s: %ld partial slabs counted but "
-                        "counter=%ld\n", s->name, count, n->nr_partial);
+                pr_err("SLUB %s: %ld partial slabs counted but counter=%ld\n",
+                       s->name, count, n->nr_partial);
 
         if (!(s->flags & SLAB_STORE_USER))
                 goto out;
@@ -3945,9 +3946,8 @@ static int validate_slab_node(struct kmem_cache *s,
                 count++;
         }
         if (count != atomic_long_read(&n->nr_slabs))
-                printk(KERN_ERR "SLUB: %s %ld slabs counted but "
-                        "counter=%ld\n", s->name, count,
-                        atomic_long_read(&n->nr_slabs));
+                pr_err("SLUB: %s %ld slabs counted but counter=%ld\n",
+                       s->name, count, atomic_long_read(&n->nr_slabs));
 
 out:
         spin_unlock_irqrestore(&n->list_lock, flags);
@@ -4211,53 +4211,50 @@ static void resiliency_test(void)
 
         BUILD_BUG_ON(KMALLOC_MIN_SIZE > 16 || KMALLOC_SHIFT_HIGH < 10);
 
-        printk(KERN_ERR "SLUB resiliency testing\n");
-        printk(KERN_ERR "-----------------------\n");
-        printk(KERN_ERR "A. Corruption after allocation\n");
+        pr_err("SLUB resiliency testing\n");
+        pr_err("-----------------------\n");
+        pr_err("A. Corruption after allocation\n");
 
         p = kzalloc(16, GFP_KERNEL);
         p[16] = 0x12;
-        printk(KERN_ERR "\n1. kmalloc-16: Clobber Redzone/next pointer"
-                        " 0x12->0x%p\n\n", p + 16);
+        pr_err("\n1. kmalloc-16: Clobber Redzone/next pointer 0x12->0x%p\n\n",
+               p + 16);
 
         validate_slab_cache(kmalloc_caches[4]);
 
         /* Hmmm... The next two are dangerous */
         p = kzalloc(32, GFP_KERNEL);
         p[32 + sizeof(void *)] = 0x34;
-        printk(KERN_ERR "\n2. kmalloc-32: Clobber next pointer/next slab"
-                        " 0x34 -> -0x%p\n", p);
-        printk(KERN_ERR
-                "If allocated object is overwritten then not detectable\n\n");
+        pr_err("\n2. kmalloc-32: Clobber next pointer/next slab 0x34 -> -0x%p\n",
+               p);
+        pr_err("If allocated object is overwritten then not detectable\n\n");
 
         validate_slab_cache(kmalloc_caches[5]);
         p = kzalloc(64, GFP_KERNEL);
         p += 64 + (get_cycles() & 0xff) * sizeof(void *);
         *p = 0x56;
-        printk(KERN_ERR "\n3. kmalloc-64: corrupting random byte 0x56->0x%p\n",
-                                                                        p);
-        printk(KERN_ERR
-                "If allocated object is overwritten then not detectable\n\n");
+        pr_err("\n3. kmalloc-64: corrupting random byte 0x56->0x%p\n",
+               p);
+        pr_err("If allocated object is overwritten then not detectable\n\n");
         validate_slab_cache(kmalloc_caches[6]);
 
-        printk(KERN_ERR "\nB. Corruption after free\n");
+        pr_err("\nB. Corruption after free\n");
         p = kzalloc(128, GFP_KERNEL);
         kfree(p);
         *p = 0x78;
-        printk(KERN_ERR "1. kmalloc-128: Clobber first word 0x78->0x%p\n\n", p);
+        pr_err("1. kmalloc-128: Clobber first word 0x78->0x%p\n\n", p);
         validate_slab_cache(kmalloc_caches[7]);
 
         p = kzalloc(256, GFP_KERNEL);
         kfree(p);
         p[50] = 0x9a;
-        printk(KERN_ERR "\n2. kmalloc-256: Clobber 50th byte 0x9a->0x%p\n\n",
-                        p);
+        pr_err("\n2. kmalloc-256: Clobber 50th byte 0x9a->0x%p\n\n", p);
         validate_slab_cache(kmalloc_caches[8]);
 
         p = kzalloc(512, GFP_KERNEL);
         kfree(p);
         p[512] = 0xab;
-        printk(KERN_ERR "\n3. kmalloc-512: Clobber redzone 0xab->0x%p\n\n", p);
+        pr_err("\n3. kmalloc-512: Clobber redzone 0xab->0x%p\n\n", p);
         validate_slab_cache(kmalloc_caches[9]);
 }
 #else
@@ -4332,7 +4329,7 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
                 }
         }
 
-        lock_memory_hotplug();
+        get_online_mems();
 #ifdef CONFIG_SLUB_DEBUG
         if (flags & SO_ALL) {
                 for_each_node_state(node, N_NORMAL_MEMORY) {
@@ -4372,7 +4369,7 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
                         x += sprintf(buf + x, " N%d=%lu",
                                         node, nodes[node]);
 #endif
-        unlock_memory_hotplug();
+        put_online_mems();
         kfree(nodes);
         return x + sprintf(buf + x, "\n");
 }
@@ -5303,7 +5300,7 @@ static int __init slab_sysfs_init(void)
         slab_kset = kset_create_and_add("slab", &slab_uevent_ops, kernel_kobj);
         if (!slab_kset) {
                 mutex_unlock(&slab_mutex);
-                printk(KERN_ERR "Cannot register slab subsystem.\n");
+                pr_err("Cannot register slab subsystem.\n");
                 return -ENOSYS;
         }
 
@@ -5312,8 +5309,8 @@ static int __init slab_sysfs_init(void)
         list_for_each_entry(s, &slab_caches, list) {
                 err = sysfs_slab_add(s);
                 if (err)
-                        printk(KERN_ERR "SLUB: Unable to add boot slab %s"
-                                                " to sysfs\n", s->name);
+                        pr_err("SLUB: Unable to add boot slab %s to sysfs\n",
+                               s->name);
         }
 
         while (alias_list) {
@@ -5322,8 +5319,8 @@ static int __init slab_sysfs_init(void)
                 alias_list = alias_list->next;
                 err = sysfs_slab_alias(al->s, al->name);
                 if (err)
-                        printk(KERN_ERR "SLUB: Unable to add boot slab alias"
-                                        " %s to sysfs\n", al->name);
+                        pr_err("SLUB: Unable to add boot slab alias %s to sysfs\n",
+                               al->name);
                 kfree(al);
         }
 
diff --git a/mm/swap.c b/mm/swap.c
index 9ce43ba4498b..9e8e3472248b 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -67,7 +67,7 @@ static void __page_cache_release(struct page *page)
 static void __put_single_page(struct page *page)
 {
         __page_cache_release(page);
-        free_hot_cold_page(page, 0);
+        free_hot_cold_page(page, false);
 }
 
 static void __put_compound_page(struct page *page)
@@ -79,95 +79,88 @@ static void __put_compound_page(struct page *page)
         (*dtor)(page);
 }
 
-static void put_compound_page(struct page *page)
+/**
+ * Two special cases here: we could avoid taking compound_lock_irqsave
+ * and could skip the tail refcounting(in _mapcount).
+ *
+ * 1. Hugetlbfs page:
+ *
+ *    PageHeadHuge will remain true until the compound page
+ *    is released and enters the buddy allocator, and it could
+ *    not be split by __split_huge_page_refcount().
+ *
+ *    So if we see PageHeadHuge set, and we have the tail page pin,
+ *    then we could safely put head page.
+ *
+ * 2. Slab THP page:
+ *
+ *    PG_slab is cleared before the slab frees the head page, and
+ *    tail pin cannot be the last reference left on the head page,
+ *    because the slab code is free to reuse the compound page
+ *    after a kfree/kmem_cache_free without having to check if
+ *    there's any tail pin left.  In turn all tail pinsmust be always
+ *    released while the head is still pinned by the slab code
+ *    and so we know PG_slab will be still set too.
+ *
+ *    So if we see PageSlab set, and we have the tail page pin,
+ *    then we could safely put head page.
+ */
+static __always_inline
+void put_unrefcounted_compound_page(struct page *page_head, struct page *page)
 {
-        struct page *page_head;
-
-        if (likely(!PageTail(page))) {
-                if (put_page_testzero(page)) {
-                        /*
-                         * By the time all refcounts have been released
-                         * split_huge_page cannot run anymore from under us.
-                         */
-                        if (PageHead(page))
-                                __put_compound_page(page);
-                        else
-                                __put_single_page(page);
-                }
-                return;
-        }
-
-        /* __split_huge_page_refcount can run under us */
-        page_head = compound_head(page);
-
         /*
-         * THP can not break up slab pages so avoid taking
-         * compound_lock() and skip the tail page refcounting (in
-         * _mapcount) too. Slab performs non-atomic bit ops on
-         * page->flags for better performance. In particular
-         * slab_unlock() in slub used to be a hot path. It is still
-         * hot on arches that do not support
-         * this_cpu_cmpxchg_double().
-         *
-         * If "page" is part of a slab or hugetlbfs page it cannot be
-         * splitted and the head page cannot change from under us. And
-         * if "page" is part of a THP page under splitting, if the
-         * head page pointed by the THP tail isn't a THP head anymore,
-         * we'll find PageTail clear after smp_rmb() and we'll treat
-         * it as a single page.
+         * If @page is a THP tail, we must read the tail page
+         * flags after the head page flags. The
+         * __split_huge_page_refcount side enforces write memory barriers
+         * between clearing PageTail and before the head page
+         * can be freed and reallocated.
          */
-        if (!__compound_tail_refcounted(page_head)) {
+        smp_rmb();
+        if (likely(PageTail(page))) {
                 /*
-                 * If "page" is a THP tail, we must read the tail page
-                 * flags after the head page flags. The
-                 * split_huge_page side enforces write memory barriers
-                 * between clearing PageTail and before the head page
-                 * can be freed and reallocated.
+                 * __split_huge_page_refcount cannot race
+                 * here, see the comment above this function.
                  */
-                smp_rmb();
-                if (likely(PageTail(page))) {
-                        /*
-                         * __split_huge_page_refcount cannot race
-                         * here.
-                         */
-                        VM_BUG_ON_PAGE(!PageHead(page_head), page_head);
-                        VM_BUG_ON_PAGE(page_mapcount(page) != 0, page);
-                        if (put_page_testzero(page_head)) {
-                                /*
-                                 * If this is the tail of a slab
-                                 * compound page, the tail pin must
-                                 * not be the last reference held on
-                                 * the page, because the PG_slab
-                                 * cannot be cleared before all tail
-                                 * pins (which skips the _mapcount
-                                 * tail refcounting) have been
-                                 * released. For hugetlbfs the tail
-                                 * pin may be the last reference on
-                                 * the page instead, because
-                                 * PageHeadHuge will not go away until
-                                 * the compound page enters the buddy
-                                 * allocator.
-                                 */
-                                VM_BUG_ON_PAGE(PageSlab(page_head), page_head);
-                                __put_compound_page(page_head);
-                        }
-                        return;
-                } else
+                VM_BUG_ON_PAGE(!PageHead(page_head), page_head);
+                VM_BUG_ON_PAGE(page_mapcount(page) != 0, page);
+                if (put_page_testzero(page_head)) {
                         /*
-                         * __split_huge_page_refcount run before us,
-                         * "page" was a THP tail. The split page_head
-                         * has been freed and reallocated as slab or
-                         * hugetlbfs page of smaller order (only
-                         * possible if reallocated as slab on x86).
+                         * If this is the tail of a slab THP page,
+                         * the tail pin must not be the last reference
+                         * held on the page, because the PG_slab cannot
+                         * be cleared before all tail pins (which skips
+                         * the _mapcount tail refcounting) have been
+                         * released.
+                         *
+                         * If this is the tail of a hugetlbfs page,
+                         * the tail pin may be the last reference on
+                         * the page instead, because PageHeadHuge will
+                         * not go away until the compound page enters
+                         * the buddy allocator.
                          */
-                        goto out_put_single;
-        }
+                        VM_BUG_ON_PAGE(PageSlab(page_head), page_head);
+                        __put_compound_page(page_head);
+                }
+        } else
+                /*
+                 * __split_huge_page_refcount run before us,
+                 * @page was a THP tail. The split @page_head
+                 * has been freed and reallocated as slab or
+                 * hugetlbfs page of smaller order (only
+                 * possible if reallocated as slab on x86).
+                 */
+                if (put_page_testzero(page))
+                        __put_single_page(page);
+}
 
+static __always_inline
+void put_refcounted_compound_page(struct page *page_head, struct page *page)
+{
         if (likely(page != page_head && get_page_unless_zero(page_head))) {
                 unsigned long flags;
 
                 /*
-                 * page_head wasn't a dangling pointer but it may not
+                 * @page_head wasn't a dangling pointer but it may not
                  * be a head page anymore by the time we obtain the
                  * lock. That is ok as long as it can't be freed from
                  * under us.
@@ -178,7 +171,7 @@ static void put_compound_page(struct page *page)
                         compound_unlock_irqrestore(page_head, flags);
                         if (put_page_testzero(page_head)) {
                                 /*
-                                 * The head page may have been freed
+                                 * The @page_head may have been freed
                                  * and reallocated as a compound page
                                  * of smaller order and then freed
                                  * again.  All we know is that it
@@ -222,12 +215,51 @@ out_put_single:
                                 __put_single_page(page_head);
                 }
         } else {
-                /* page_head is a dangling pointer */
+                /* @page_head is a dangling pointer */
                 VM_BUG_ON_PAGE(PageTail(page), page);
                 goto out_put_single;
         }
 }
 
+static void put_compound_page(struct page *page)
+{
+        struct page *page_head;
+
+        /*
+         * We see the PageCompound set and PageTail not set, so @page maybe:
+         *  1. hugetlbfs head page, or
+         *  2. THP head page.
+         */
+        if (likely(!PageTail(page))) {
+                if (put_page_testzero(page)) {
+                        /*
+                         * By the time all refcounts have been released
+                         * split_huge_page cannot run anymore from under us.
+                         */
+                        if (PageHead(page))
+                                __put_compound_page(page);
+                        else
+                                __put_single_page(page);
+                }
+                return;
+        }
+
+        /*
+         * We see the PageCompound set and PageTail set, so @page maybe:
+         *  1. a tail hugetlbfs page, or
+         *  2. a tail THP page, or
+         *  3. a split THP page.
+         *
+         *  Case 3 is possible, as we may race with
+         *  __split_huge_page_refcount tearing down a THP page.
+         */
+        page_head = compound_head_by_tail(page);
+        if (!__compound_tail_refcounted(page_head))
+                put_unrefcounted_compound_page(page_head, page);
+        else
+                put_refcounted_compound_page(page_head, page);
+}
+
 void put_page(struct page *page)
 {
         if (unlikely(PageCompound(page)))
@@ -441,7 +473,7 @@ void rotate_reclaimable_page(struct page *page)
 
                 page_cache_get(page);
                 local_irq_save(flags);
-                pvec = &__get_cpu_var(lru_rotate_pvecs);
+                pvec = this_cpu_ptr(&lru_rotate_pvecs);
                 if (!pagevec_add(pvec, page))
                         pagevec_move_tail(pvec);
                 local_irq_restore(flags);
@@ -583,12 +615,17 @@ void mark_page_accessed(struct page *page)
 EXPORT_SYMBOL(mark_page_accessed);
 
 /*
- * Queue the page for addition to the LRU via pagevec. The decision on whether
- * to add the page to the [in]active [file|anon] list is deferred until the
- * pagevec is drained. This gives a chance for the caller of __lru_cache_add()
- * have the page added to the active list using mark_page_accessed().
+ * Used to mark_page_accessed(page) that is not visible yet and when it is
+ * still safe to use non-atomic ops
  */
-void __lru_cache_add(struct page *page)
+void init_page_accessed(struct page *page)
+{
+        if (!PageReferenced(page))
+                __SetPageReferenced(page);
+}
+EXPORT_SYMBOL(init_page_accessed);
+
+static void __lru_cache_add(struct page *page)
 {
         struct pagevec *pvec = &get_cpu_var(lru_add_pvec);
 
@@ -598,11 +635,34 @@ void __lru_cache_add(struct page *page)
         pagevec_add(pvec, page);
         put_cpu_var(lru_add_pvec);
 }
-EXPORT_SYMBOL(__lru_cache_add);
+
+/**
+ * lru_cache_add: add a page to the page lists
+ * @page: the page to add
+ */
+void lru_cache_add_anon(struct page *page)
+{
+        if (PageActive(page))
+                ClearPageActive(page);
+        __lru_cache_add(page);
+}
+
+void lru_cache_add_file(struct page *page)
+{
+        if (PageActive(page))
+                ClearPageActive(page);
+        __lru_cache_add(page);
+}
+EXPORT_SYMBOL(lru_cache_add_file);
 
 /**
  * lru_cache_add - add a page to a page list
  * @page: the page to be added to the LRU.
+ *
+ * Queue the page for addition to the LRU via pagevec. The decision on whether
+ * to add the page to the [in]active [file|anon] list is deferred until the
+ * pagevec is drained. This gives a chance for the caller of lru_cache_add()
+ * have the page added to the active list using mark_page_accessed().
  */
 void lru_cache_add(struct page *page)
 {
@@ -813,7 +873,7 @@ void lru_add_drain_all(void)
  * grabbed the page via the LRU.  If it did, give up: shrink_inactive_list()
  * will free it.
  */
-void release_pages(struct page **pages, int nr, int cold)
+void release_pages(struct page **pages, int nr, bool cold)
 {
         int i;
         LIST_HEAD(pages_to_free);
@@ -854,7 +914,7 @@ void release_pages(struct page **pages, int nr, int cold)
                 }
 
                 /* Clear Active bit in case of parallel mark_page_accessed */
-                ClearPageActive(page);
+                __ClearPageActive(page);
 
                 list_add(&page->lru, &pages_to_free);
         }
diff --git a/mm/swap_state.c b/mm/swap_state.c
index e76ace30d436..2972eee184a4 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -270,7 +270,7 @@ void free_pages_and_swap_cache(struct page **pages, int nr)
 
                 for (i = 0; i < todo; i++)
                         free_swap_cache(pagep[i]);
-                release_pages(pagep, todo, 0);
+                release_pages(pagep, todo, false);
                 pagep += todo;
                 nr -= todo;
         }
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 4a7f7e6992b6..4c524f7bd0bf 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -51,14 +51,32 @@ atomic_long_t nr_swap_pages;
 /* protected with swap_lock. reading in vm_swap_full() doesn't need lock */
 long total_swap_pages;
 static int least_priority;
-static atomic_t highest_priority_index = ATOMIC_INIT(-1);
 
 static const char Bad_file[] = "Bad swap file entry ";
 static const char Unused_file[] = "Unused swap file entry ";
 static const char Bad_offset[] = "Bad swap offset entry ";
 static const char Unused_offset[] = "Unused swap offset entry ";
 
-struct swap_list_t swap_list = {-1, -1};
+/*
+ * all active swap_info_structs
+ * protected with swap_lock, and ordered by priority.
+ */
+PLIST_HEAD(swap_active_head);
+
+/*
+ * all available (active, not full) swap_info_structs
+ * protected with swap_avail_lock, ordered by priority.
+ * This is used by get_swap_page() instead of swap_active_head
+ * because swap_active_head includes all swap_info_structs,
+ * but get_swap_page() doesn't need to look at full ones.
+ * This uses its own lock instead of swap_lock because when a
+ * swap_info_struct changes between not-full/full, it needs to
+ * add/remove itself to/from this list, but the swap_info_struct->lock
+ * is held and the locking order requires swap_lock to be taken
+ * before any swap_info_struct->lock.
+ */
+static PLIST_HEAD(swap_avail_head);
+static DEFINE_SPINLOCK(swap_avail_lock);
 
 struct swap_info_struct *swap_info[MAX_SWAPFILES];
 
@@ -505,13 +523,10 @@ static unsigned long scan_swap_map(struct swap_info_struct *si,
                 /*
                  * If seek is expensive, start searching for new cluster from
                  * start of partition, to minimize the span of allocated swap.
-                 * But if seek is cheap, search from our current position, so
-                 * that swap is allocated from all over the partition: if the
-                 * Flash Translation Layer only remaps within limited zones,
-                 * we don't want to wear out the first zone too quickly.
+                 * If seek is cheap, that is the SWP_SOLIDSTATE si->cluster_info
+                 * case, just handled by scan_swap_map_try_ssd_cluster() above.
                  */
-                if (!(si->flags & SWP_SOLIDSTATE))
-                        scan_base = offset = si->lowest_bit;
+                scan_base = offset = si->lowest_bit;
                 last_in_cluster = offset + SWAPFILE_CLUSTER - 1;
 
                 /* Locate the first empty (unaligned) cluster */
@@ -531,26 +546,6 @@ static unsigned long scan_swap_map(struct swap_info_struct *si,
                         }
                 }
 
-                offset = si->lowest_bit;
-                last_in_cluster = offset + SWAPFILE_CLUSTER - 1;
-
-                /* Locate the first empty (unaligned) cluster */
-                for (; last_in_cluster < scan_base; offset++) {
-                        if (si->swap_map[offset])
-                                last_in_cluster = offset + SWAPFILE_CLUSTER;
-                        else if (offset == last_in_cluster) {
-                                spin_lock(&si->lock);
-                                offset -= SWAPFILE_CLUSTER - 1;
-                                si->cluster_next = offset;
-                                si->cluster_nr = SWAPFILE_CLUSTER - 1;
-                                goto checks;
-                        }
-                        if (unlikely(--latency_ration < 0)) {
-                                cond_resched();
-                                latency_ration = LATENCY_LIMIT;
-                        }
-                }
-
                 offset = scan_base;
                 spin_lock(&si->lock);
                 si->cluster_nr = SWAPFILE_CLUSTER - 1;
@@ -591,6 +586,9 @@ checks:
         if (si->inuse_pages == si->pages) {
                 si->lowest_bit = si->max;
                 si->highest_bit = 0;
+                spin_lock(&swap_avail_lock);
+                plist_del(&si->avail_list, &swap_avail_head);
+                spin_unlock(&swap_avail_lock);
         }
         si->swap_map[offset] = usage;
         inc_cluster_info_page(si, si->cluster_info, offset);
@@ -640,71 +638,65 @@ no_page:
 
 swp_entry_t get_swap_page(void)
 {
-        struct swap_info_struct *si;
+        struct swap_info_struct *si, *next;
         pgoff_t offset;
-        int type, next;
-        int wrapped = 0;
-        int hp_index;
 
-        spin_lock(&swap_lock);
         if (atomic_long_read(&nr_swap_pages) <= 0)
                 goto noswap;
         atomic_long_dec(&nr_swap_pages);
 
-        for (type = swap_list.next; type >= 0 && wrapped < 2; type = next) {
-                hp_index = atomic_xchg(&highest_priority_index, -1);
-                /*
-                 * highest_priority_index records current highest priority swap
-                 * type which just frees swap entries. If its priority is
-                 * higher than that of swap_list.next swap type, we use it.  It
-                 * isn't protected by swap_lock, so it can be an invalid value
-                 * if the corresponding swap type is swapoff. We double check
-                 * the flags here. It's even possible the swap type is swapoff
-                 * and swapon again and its priority is changed. In such rare
-                 * case, low prority swap type might be used, but eventually
-                 * high priority swap will be used after several rounds of
-                 * swap.
-                 */
-                if (hp_index != -1 && hp_index != type &&
-                    swap_info[type]->prio < swap_info[hp_index]->prio &&
-                    (swap_info[hp_index]->flags & SWP_WRITEOK)) {
-                        type = hp_index;
-                        swap_list.next = type;
-                }
-
-                si = swap_info[type];
-                next = si->next;
-                if (next < 0 ||
-                    (!wrapped && si->prio != swap_info[next]->prio)) {
-                        next = swap_list.head;
-                        wrapped++;
-                }
+        spin_lock(&swap_avail_lock);
 
+start_over:
+        plist_for_each_entry_safe(si, next, &swap_avail_head, avail_list) {
+                /* requeue si to after same-priority siblings */
+                plist_requeue(&si->avail_list, &swap_avail_head);
+                spin_unlock(&swap_avail_lock);
                 spin_lock(&si->lock);
-                if (!si->highest_bit) {
-                        spin_unlock(&si->lock);
-                        continue;
-                }
-                if (!(si->flags & SWP_WRITEOK)) {
+                if (!si->highest_bit || !(si->flags & SWP_WRITEOK)) {
+                        spin_lock(&swap_avail_lock);
+                        if (plist_node_empty(&si->avail_list)) {
+                                spin_unlock(&si->lock);
+                                goto nextsi;
+                        }
+                        WARN(!si->highest_bit,
+                             "swap_info %d in list but !highest_bit\n",
+                             si->type);
+                        WARN(!(si->flags & SWP_WRITEOK),
+                             "swap_info %d in list but !SWP_WRITEOK\n",
+                             si->type);
+                        plist_del(&si->avail_list, &swap_avail_head);
                         spin_unlock(&si->lock);
-                        continue;
+                        goto nextsi;
                 }
 
-                swap_list.next = next;
-
-                spin_unlock(&swap_lock);
                 /* This is called for allocating swap entry for cache */
                 offset = scan_swap_map(si, SWAP_HAS_CACHE);
                 spin_unlock(&si->lock);
                 if (offset)
-                        return swp_entry(type, offset);
-                spin_lock(&swap_lock);
-                next = swap_list.next;
+                        return swp_entry(si->type, offset);
+                pr_debug("scan_swap_map of si %d failed to find offset\n",
+                       si->type);
+                spin_lock(&swap_avail_lock);
+nextsi:
+                /*
+                 * if we got here, it's likely that si was almost full before,
+                 * and since scan_swap_map() can drop the si->lock, multiple
+                 * callers probably all tried to get a page from the same si
+                 * and it filled up before we could get one; or, the si filled
+                 * up between us dropping swap_avail_lock and taking si->lock.
+                 * Since we dropped the swap_avail_lock, the swap_avail_head
+                 * list may have been modified; so if next is still in the
+                 * swap_avail_head list then try it, otherwise start over.
+                 */
+                if (plist_node_empty(&next->avail_list))
+                        goto start_over;
         }
 
+        spin_unlock(&swap_avail_lock);
+
         atomic_long_inc(&nr_swap_pages);
 noswap:
-        spin_unlock(&swap_lock);
         return (swp_entry_t) {0};
 }
 
@@ -766,27 +758,6 @@ out:
         return NULL;
 }
 
-/*
- * This swap type frees swap entry, check if it is the highest priority swap
- * type which just frees swap entry. get_swap_page() uses
- * highest_priority_index to search highest priority swap type. The
- * swap_info_struct.lock can't protect us if there are multiple swap types
- * active, so we use atomic_cmpxchg.
- */
-static void set_highest_priority_index(int type)
-{
-        int old_hp_index, new_hp_index;
-
-        do {
-                old_hp_index = atomic_read(&highest_priority_index);
-                if (old_hp_index != -1 &&
-                        swap_info[old_hp_index]->prio >= swap_info[type]->prio)
-                        break;
-                new_hp_index = type;
-        } while (atomic_cmpxchg(&highest_priority_index,
-                old_hp_index, new_hp_index) != old_hp_index);
-}
-
 static unsigned char swap_entry_free(struct swap_info_struct *p,
                                      swp_entry_t entry, unsigned char usage)
 {
@@ -828,9 +799,18 @@ static unsigned char swap_entry_free(struct swap_info_struct *p,
                 dec_cluster_info_page(p, p->cluster_info, offset);
                 if (offset < p->lowest_bit)
                         p->lowest_bit = offset;
-                if (offset > p->highest_bit)
+                if (offset > p->highest_bit) {
+                        bool was_full = !p->highest_bit;
                         p->highest_bit = offset;
-                set_highest_priority_index(p->type);
+                        if (was_full && (p->flags & SWP_WRITEOK)) {
+                                spin_lock(&swap_avail_lock);
+                                WARN_ON(!plist_node_empty(&p->avail_list));
+                                if (plist_node_empty(&p->avail_list))
+                                        plist_add(&p->avail_list,
+                                                  &swap_avail_head);
+                                spin_unlock(&swap_avail_lock);
+                        }
+                }
                 atomic_long_inc(&nr_swap_pages);
                 p->inuse_pages--;
                 frontswap_invalidate_page(p->type, offset);
@@ -1765,30 +1745,37 @@ static void _enable_swap_info(struct swap_info_struct *p, int prio,
                                 unsigned char *swap_map,
                                 struct swap_cluster_info *cluster_info)
 {
-        int i, prev;
-
         if (prio >= 0)
                 p->prio = prio;
         else
                 p->prio = --least_priority;
+        /*
+         * the plist prio is negated because plist ordering is
+         * low-to-high, while swap ordering is high-to-low
+         */
+        p->list.prio = -p->prio;
+        p->avail_list.prio = -p->prio;
         p->swap_map = swap_map;
         p->cluster_info = cluster_info;
         p->flags |= SWP_WRITEOK;
         atomic_long_add(p->pages, &nr_swap_pages);
         total_swap_pages += p->pages;
 
-        /* insert swap space into swap_list: */
-        prev = -1;
-        for (i = swap_list.head; i >= 0; i = swap_info[i]->next) {
-                if (p->prio >= swap_info[i]->prio)
-                        break;
-                prev = i;
-        }
-        p->next = i;
-        if (prev < 0)
-                swap_list.head = swap_list.next = p->type;
-        else
-                swap_info[prev]->next = p->type;
+        assert_spin_locked(&swap_lock);
+        /*
+         * both lists are plists, and thus priority ordered.
+         * swap_active_head needs to be priority ordered for swapoff(),
+         * which on removal of any swap_info_struct with an auto-assigned
+         * (i.e. negative) priority increments the auto-assigned priority
+         * of any lower-priority swap_info_structs.
+         * swap_avail_head needs to be priority ordered for get_swap_page(),
+         * which allocates swap pages from the highest available priority
+         * swap_info_struct.
+         */
+        plist_add(&p->list, &swap_active_head);
+        spin_lock(&swap_avail_lock);
+        plist_add(&p->avail_list, &swap_avail_head);
+        spin_unlock(&swap_avail_lock);
 }
 
 static void enable_swap_info(struct swap_info_struct *p, int prio,
@@ -1823,8 +1810,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         struct address_space *mapping;
         struct inode *inode;
         struct filename *pathname;
-        int i, type, prev;
-        int err;
+        int err, found = 0;
         unsigned int old_block_size;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -1842,17 +1828,16 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
                 goto out;
 
         mapping = victim->f_mapping;
-        prev = -1;
         spin_lock(&swap_lock);
-        for (type = swap_list.head; type >= 0; type = swap_info[type]->next) {
-                p = swap_info[type];
+        plist_for_each_entry(p, &swap_active_head, list) {
                 if (p->flags & SWP_WRITEOK) {
-                        if (p->swap_file->f_mapping == mapping)
+                        if (p->swap_file->f_mapping == mapping) {
+                                found = 1;
                                 break;
+                        }
                 }
-                prev = type;
         }
-        if (type < 0) {
+        if (!found) {
                 err = -EINVAL;
                 spin_unlock(&swap_lock);
                 goto out_dput;
@@ -1864,20 +1849,21 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
                 spin_unlock(&swap_lock);
                 goto out_dput;
         }
-        if (prev < 0)
-                swap_list.head = p->next;
-        else
-                swap_info[prev]->next = p->next;
-        if (type == swap_list.next) {
-                /* just pick something that's safe... */
-                swap_list.next = swap_list.head;
-        }
+        spin_lock(&swap_avail_lock);
+        plist_del(&p->avail_list, &swap_avail_head);
+        spin_unlock(&swap_avail_lock);
         spin_lock(&p->lock);
         if (p->prio < 0) {
-                for (i = p->next; i >= 0; i = swap_info[i]->next)
-                        swap_info[i]->prio = p->prio--;
+                struct swap_info_struct *si = p;
+
+                plist_for_each_entry_continue(si, &swap_active_head, list) {
+                        si->prio++;
+                        si->list.prio--;
+                        si->avail_list.prio--;
+                }
                 least_priority++;
         }
+        plist_del(&p->list, &swap_active_head);
         atomic_long_sub(p->pages, &nr_swap_pages);
         total_swap_pages -= p->pages;
         p->flags &= ~SWP_WRITEOK;
@@ -1885,7 +1871,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         spin_unlock(&swap_lock);
 
         set_current_oom_origin();
-        err = try_to_unuse(type, false, 0); /* force all pages to be unused */
+        err = try_to_unuse(p->type, false, 0); /* force unuse all pages */
         clear_current_oom_origin();
 
         if (err) {
@@ -1926,7 +1912,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         frontswap_map = frontswap_map_get(p);
         spin_unlock(&p->lock);
         spin_unlock(&swap_lock);
-        frontswap_invalidate_area(type);
+        frontswap_invalidate_area(p->type);
         frontswap_map_set(p, NULL);
         mutex_unlock(&swapon_mutex);
         free_percpu(p->percpu_cluster);
@@ -1935,7 +1921,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         vfree(cluster_info);
         vfree(frontswap_map);
         /* Destroy swap account information */
-        swap_cgroup_swapoff(type);
+        swap_cgroup_swapoff(p->type);
 
         inode = mapping->host;
         if (S_ISBLK(inode->i_mode)) {
@@ -2142,8 +2128,9 @@ static struct swap_info_struct *alloc_swap_info(void)
                  */
         }
         INIT_LIST_HEAD(&p->first_swap_extent.list);
+        plist_node_init(&p->list, 0);
+        plist_node_init(&p->avail_list, 0);
         p->flags = SWP_USED;
-        p->next = -1;
         spin_unlock(&swap_lock);
         spin_lock_init(&p->lock);
 
diff --git a/mm/vmacache.c b/mm/vmacache.c
index 1037a3bab505..9f25af825dec 100644
--- a/mm/vmacache.c
+++ b/mm/vmacache.c
@@ -17,6 +17,16 @@ void vmacache_flush_all(struct mm_struct *mm)
 {
         struct task_struct *g, *p;
 
+        /*
+         * Single threaded tasks need not iterate the entire
+         * list of process. We can avoid the flushing as well
+         * since the mm's seqnum was increased and don't have
+         * to worry about other threads' seqnum. Current's
+         * flush will occur upon the next lookup.
+         */
+        if (atomic_read(&mm->mm_users) == 1)
+                return;
+
         rcu_read_lock();
         for_each_process_thread(g, p) {
                 /*
@@ -78,6 +88,8 @@ struct vm_area_struct *vmacache_find(struct mm_struct *mm, unsigned long addr)
         if (!vmacache_valid(mm))
                 return NULL;
 
+        count_vm_vmacache_event(VMACACHE_FIND_CALLS);
+
         for (i = 0; i < VMACACHE_SIZE; i++) {
                 struct vm_area_struct *vma = current->vmacache[i];
 
@@ -85,8 +97,10 @@ struct vm_area_struct *vmacache_find(struct mm_struct *mm, unsigned long addr)
                         continue;
                 if (WARN_ON_ONCE(vma->vm_mm != mm))
                         break;
-                if (vma->vm_start <= addr && vma->vm_end > addr)
+                if (vma->vm_start <= addr && vma->vm_end > addr) {
+                        count_vm_vmacache_event(VMACACHE_FIND_HITS);
                         return vma;
+                }
         }
 
         return NULL;
@@ -102,11 +116,15 @@ struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm,
         if (!vmacache_valid(mm))
                 return NULL;
 
+        count_vm_vmacache_event(VMACACHE_FIND_CALLS);
+
         for (i = 0; i < VMACACHE_SIZE; i++) {
                 struct vm_area_struct *vma = current->vmacache[i];
 
-                if (vma && vma->vm_start == start && vma->vm_end == end)
+                if (vma && vma->vm_start == start && vma->vm_end == end) {
+                        count_vm_vmacache_event(VMACACHE_FIND_HITS);
                         return vma;
+                }
         }
 
         return NULL;
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index bf233b283319..f64632b67196 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1268,6 +1268,7 @@ void unmap_kernel_range(unsigned long addr, unsigned long size)
         vunmap_page_range(addr, end);
         flush_tlb_kernel_range(addr, end);
 }
+EXPORT_SYMBOL_GPL(unmap_kernel_range);
 
 int map_vm_area(struct vm_struct *area, pgprot_t prot, struct page ***pages)
 {
@@ -1496,7 +1497,7 @@ void vfree(const void *addr)
         if (!addr)
                 return;
         if (unlikely(in_interrupt())) {
-                struct vfree_deferred *p = &__get_cpu_var(vfree_deferred);
+                struct vfree_deferred *p = this_cpu_ptr(&vfree_deferred);
                 if (llist_add((struct llist_node *)addr, &p->list))
                         schedule_work(&p->wq);
         } else
@@ -2619,19 +2620,19 @@ static int s_show(struct seq_file *m, void *p)
                 seq_printf(m, " phys=%llx", (unsigned long long)v->phys_addr);
 
         if (v->flags & VM_IOREMAP)
-                seq_printf(m, " ioremap");
+                seq_puts(m, " ioremap");
 
         if (v->flags & VM_ALLOC)
-                seq_printf(m, " vmalloc");
+                seq_puts(m, " vmalloc");
 
         if (v->flags & VM_MAP)
-                seq_printf(m, " vmap");
+                seq_puts(m, " vmap");
 
         if (v->flags & VM_USERMAP)
-                seq_printf(m, " user");
+                seq_puts(m, " user");
 
         if (v->flags & VM_VPAGES)
-                seq_printf(m, " vpages");
+                seq_puts(m, " vpages");
 
         show_numa_info(m, v);
         seq_putc(m, '\n');
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 32c661d66a45..9149444f947d 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -324,7 +324,7 @@ shrink_slab_node(struct shrink_control *shrinkctl, struct shrinker *shrinker,
         else
                 new_nr = atomic_long_read(&shrinker->nr_deferred[nid]);
 
-        trace_mm_shrink_slab_end(shrinker, freed, nr, new_nr);
+        trace_mm_shrink_slab_end(shrinker, nid, freed, nr, new_nr, total_scan);
         return freed;
 }
 
@@ -1121,7 +1121,7 @@ keep:
                 VM_BUG_ON_PAGE(PageLRU(page) || PageUnevictable(page), page);
         }
 
-        free_hot_cold_page_list(&free_pages, 1);
+        free_hot_cold_page_list(&free_pages, true);
 
         list_splice(&ret_pages, page_list);
         count_vm_events(PGACTIVATE, pgactivate);
@@ -1439,6 +1439,19 @@ putback_inactive_pages(struct lruvec *lruvec, struct list_head *page_list)
 }
 
 /*
+ * If a kernel thread (such as nfsd for loop-back mounts) services
+ * a backing device by writing to the page cache it sets PF_LESS_THROTTLE.
+ * In that case we should only throttle if the backing device it is
+ * writing to is congested.  In other cases it is safe to throttle.
+ */
+static int current_may_throttle(void)
+{
+        return !(current->flags & PF_LESS_THROTTLE) ||
+                current->backing_dev_info == NULL ||
+                bdi_write_congested(current->backing_dev_info);
+}
+
+/*
  * shrink_inactive_list() is a helper for shrink_zone().  It returns the number
  * of reclaimed pages
  */
@@ -1519,7 +1532,7 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
 
         spin_unlock_irq(&zone->lru_lock);
 
-        free_hot_cold_page_list(&page_list, 1);
+        free_hot_cold_page_list(&page_list, true);
 
         /*
          * If reclaim is isolating dirty pages under writeback, it implies
@@ -1566,7 +1579,8 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
                  * implies that pages are cycling through the LRU faster than
                  * they are written so also forcibly stall.
                  */
-                if (nr_unqueued_dirty == nr_taken || nr_immediate)
+                if ((nr_unqueued_dirty == nr_taken || nr_immediate) &&
+                    current_may_throttle())
                         congestion_wait(BLK_RW_ASYNC, HZ/10);
         }
 
@@ -1575,7 +1589,8 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
          * is congested. Allow kswapd to continue until it starts encountering
          * unqueued dirty pages or cycling through the LRU too quickly.
          */
-        if (!sc->hibernation_mode && !current_is_kswapd())
+        if (!sc->hibernation_mode && !current_is_kswapd() &&
+            current_may_throttle())
                 wait_iff_congested(zone, BLK_RW_ASYNC, HZ/10);
 
         trace_mm_vmscan_lru_shrink_inactive(zone->zone_pgdat->node_id,
@@ -1740,7 +1755,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
         __mod_zone_page_state(zone, NR_ISOLATED_ANON + file, -nr_taken);
         spin_unlock_irq(&zone->lru_lock);
 
-        free_hot_cold_page_list(&l_hold, 1);
+        free_hot_cold_page_list(&l_hold, true);
 }
 
 #ifdef CONFIG_SWAP
@@ -1866,6 +1881,8 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc,
         bool force_scan = false;
         unsigned long ap, fp;
         enum lru_list lru;
+        bool some_scanned;
+        int pass;
 
         /*
          * If the zone or memcg is small, nr[l] can be 0.  This
@@ -1989,39 +2006,49 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc,
         fraction[1] = fp;
         denominator = ap + fp + 1;
 out:
-        for_each_evictable_lru(lru) {
-                int file = is_file_lru(lru);
-                unsigned long size;
-                unsigned long scan;
+        some_scanned = false;
+        /* Only use force_scan on second pass. */
+        for (pass = 0; !some_scanned && pass < 2; pass++) {
+                for_each_evictable_lru(lru) {
+                        int file = is_file_lru(lru);
+                        unsigned long size;
+                        unsigned long scan;
 
-                size = get_lru_size(lruvec, lru);
-                scan = size >> sc->priority;
+                        size = get_lru_size(lruvec, lru);
+                        scan = size >> sc->priority;
 
-                if (!scan && force_scan)
-                        scan = min(size, SWAP_CLUSTER_MAX);
+                        if (!scan && pass && force_scan)
+                                scan = min(size, SWAP_CLUSTER_MAX);
 
-                switch (scan_balance) {
-                case SCAN_EQUAL:
-                        /* Scan lists relative to size */
-                        break;
-                case SCAN_FRACT:
+                        switch (scan_balance) {
+                        case SCAN_EQUAL:
+                                /* Scan lists relative to size */
+                                break;
+                        case SCAN_FRACT:
+                                /*
+                                 * Scan types proportional to swappiness and
+                                 * their relative recent reclaim efficiency.
+                                 */
+                                scan = div64_u64(scan * fraction[file],
+                                                        denominator);
+                                break;
+                        case SCAN_FILE:
+                        case SCAN_ANON:
+                                /* Scan one type exclusively */
+                                if ((scan_balance == SCAN_FILE) != file)
+                                        scan = 0;
+                                break;
+                        default:
+                                /* Look ma, no brain */
+                                BUG();
+                        }
+                        nr[lru] = scan;
                         /*
-                         * Scan types proportional to swappiness and
-                         * their relative recent reclaim efficiency.
+                         * Skip the second pass and don't force_scan,
+                         * if we found something to scan.
                          */
-                        scan = div64_u64(scan * fraction[file], denominator);
-                        break;
-                case SCAN_FILE:
-                case SCAN_ANON:
-                        /* Scan one type exclusively */
-                        if ((scan_balance == SCAN_FILE) != file)
-                                scan = 0;
-                        break;
-                default:
-                        /* Look ma, no brain */
-                        BUG();
+                        some_scanned |= !!scan;
                 }
-                nr[lru] = scan;
         }
 }
 
@@ -2037,13 +2064,27 @@ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
         unsigned long nr_reclaimed = 0;
         unsigned long nr_to_reclaim = sc->nr_to_reclaim;
         struct blk_plug plug;
-        bool scan_adjusted = false;
+        bool scan_adjusted;
 
         get_scan_count(lruvec, sc, nr);
 
         /* Record the original scan target for proportional adjustments later */
         memcpy(targets, nr, sizeof(nr));
 
+        /*
+         * Global reclaiming within direct reclaim at DEF_PRIORITY is a normal
+         * event that can occur when there is little memory pressure e.g.
+         * multiple streaming readers/writers. Hence, we do not abort scanning
+         * when the requested number of pages are reclaimed when scanning at
+         * DEF_PRIORITY on the assumption that the fact we are direct
+         * reclaiming implies that kswapd is not keeping up and it is best to
+         * do a batch of work at once. For memcg reclaim one check is made to
+         * abort proportional reclaim if either the file or anon lru has already
+         * dropped to zero at the first pass.
+         */
+        scan_adjusted = (global_reclaim(sc) && !current_is_kswapd() &&
+                         sc->priority == DEF_PRIORITY);
+
         blk_start_plug(&plug);
         while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] ||
                                         nr[LRU_INACTIVE_FILE]) {
@@ -2064,17 +2105,8 @@ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
                         continue;
 
                 /*
-                 * For global direct reclaim, reclaim only the number of pages
-                 * requested. Less care is taken to scan proportionally as it
-                 * is more important to minimise direct reclaim stall latency
-                 * than it is to properly age the LRU lists.
-                 */
-                if (global_reclaim(sc) && !current_is_kswapd())
-                        break;
-
-                /*
                  * For kswapd and memcg, reclaim at least the number of pages
-                 * requested. Ensure that the anon and file LRUs shrink
+                 * requested. Ensure that the anon and file LRUs are scanned
                  * proportionally what was requested by get_scan_count(). We
                  * stop reclaiming one LRU and reduce the amount scanning
                  * proportional to the original scan target.
@@ -2082,6 +2114,15 @@ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
                 nr_file = nr[LRU_INACTIVE_FILE] + nr[LRU_ACTIVE_FILE];
                 nr_anon = nr[LRU_INACTIVE_ANON] + nr[LRU_ACTIVE_ANON];
 
+                /*
+                 * It's just vindictive to attack the larger once the smaller
+                 * has gone to zero.  And given the way we stop scanning the
+                 * smaller below, this makes sure that we only make one nudge
+                 * towards proportionality once we've got nr_to_reclaim.
+                 */
+                if (!nr_file || !nr_anon)
+                        break;
+
                 if (nr_file > nr_anon) {
                         unsigned long scan_target = targets[LRU_INACTIVE_ANON] +
                                                 targets[LRU_ACTIVE_ANON] + 1;
@@ -2268,9 +2309,8 @@ static inline bool compaction_ready(struct zone *zone, struct scan_control *sc)
          * there is a buffer of free pages available to give compaction
          * a reasonable chance of completing and allocating the page
          */
-        balance_gap = min(low_wmark_pages(zone),
-                (zone->managed_pages + KSWAPD_ZONE_BALANCE_GAP_RATIO-1) /
-                        KSWAPD_ZONE_BALANCE_GAP_RATIO);
+        balance_gap = min(low_wmark_pages(zone), DIV_ROUND_UP(
+                        zone->managed_pages, KSWAPD_ZONE_BALANCE_GAP_RATIO));
         watermark = high_wmark_pages(zone) + balance_gap + (2UL << sc->order);
         watermark_ok = zone_watermark_ok_safe(zone, 0, watermark, 0, 0);
 
@@ -2525,10 +2565,17 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat)
 
         for (i = 0; i <= ZONE_NORMAL; i++) {
                 zone = &pgdat->node_zones[i];
+                if (!populated_zone(zone))
+                        continue;
+
                 pfmemalloc_reserve += min_wmark_pages(zone);
                 free_pages += zone_page_state(zone, NR_FREE_PAGES);
         }
 
+        /* If there are no reserves (unexpected config) then do not throttle */
+        if (!pfmemalloc_reserve)
+                return true;
+
         wmark_ok = free_pages > pfmemalloc_reserve / 2;
 
         /* kswapd must be awake if processes are being throttled */
@@ -2553,9 +2600,9 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat)
 static bool throttle_direct_reclaim(gfp_t gfp_mask, struct zonelist *zonelist,
                                         nodemask_t *nodemask)
 {
+        struct zoneref *z;
         struct zone *zone;
-        int high_zoneidx = gfp_zone(gfp_mask);
-        pg_data_t *pgdat;
+        pg_data_t *pgdat = NULL;
 
         /*
          * Kernel threads should not be throttled as they may be indirectly
@@ -2574,10 +2621,34 @@ static bool throttle_direct_reclaim(gfp_t gfp_mask, struct zonelist *zonelist,
         if (fatal_signal_pending(current))
                 goto out;
 
-        /* Check if the pfmemalloc reserves are ok */
-        first_zones_zonelist(zonelist, high_zoneidx, NULL, &zone);
-        pgdat = zone->zone_pgdat;
-        if (pfmemalloc_watermark_ok(pgdat))
+        /*
+         * Check if the pfmemalloc reserves are ok by finding the first node
+         * with a usable ZONE_NORMAL or lower zone. The expectation is that
+         * GFP_KERNEL will be required for allocating network buffers when
+         * swapping over the network so ZONE_HIGHMEM is unusable.
+         *
+         * Throttling is based on the first usable node and throttled processes
+         * wait on a queue until kswapd makes progress and wakes them. There
+         * is an affinity then between processes waking up and where reclaim
+         * progress has been made assuming the process wakes on the same node.
+         * More importantly, processes running on remote nodes will not compete
+         * for remote pfmemalloc reserves and processes on different nodes
+         * should make reasonable progress.
+         */
+        for_each_zone_zonelist_nodemask(zone, z, zonelist,
+                                        gfp_mask, nodemask) {
+                if (zone_idx(zone) > ZONE_NORMAL)
+                        continue;
+
+                /* Throttle based on the first usable node */
+                pgdat = zone->zone_pgdat;
+                if (pfmemalloc_watermark_ok(pgdat))
+                        goto out;
+                break;
+        }
+
+        /* If no zone was usable by the allocation flags then do not throttle */
+        if (!pgdat)
                 goto out;
 
         /* Account for the throttling */
@@ -2891,9 +2962,8 @@ static bool kswapd_shrink_zone(struct zone *zone,
          * high wmark plus a "gap" where the gap is either the low
          * watermark or 1% of the zone, whichever is smaller.
          */
-        balance_gap = min(low_wmark_pages(zone),
-                (zone->managed_pages + KSWAPD_ZONE_BALANCE_GAP_RATIO-1) /
-                KSWAPD_ZONE_BALANCE_GAP_RATIO);
+        balance_gap = min(low_wmark_pages(zone), DIV_ROUND_UP(
+                        zone->managed_pages, KSWAPD_ZONE_BALANCE_GAP_RATIO));
 
         /*
          * If there is no low memory pressure or the zone is balanced then no
@@ -3422,7 +3492,7 @@ int kswapd_run(int nid)
 
 /*
  * Called by memory hotplug when all memory in a node is offlined.  Caller must
- * hold lock_memory_hotplug().
+ * hold mem_hotplug_begin/end().
  */
 void kswapd_stop(int nid)
 {
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 302dd076b8bf..b37bd49bfd55 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -207,7 +207,9 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat,
 }
 
 /*
- * For use when we know that interrupts are disabled.
+ * For use when we know that interrupts are disabled,
+ * or when we know that preemption is disabled and that
+ * particular counter cannot be updated from interrupt context.
  */
 void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
                                 int delta)
@@ -489,7 +491,7 @@ static void refresh_cpu_vm_stats(void)
                         continue;
 
                 if (__this_cpu_read(p->pcp.count))
-                        drain_zone_pages(zone, __this_cpu_ptr(&p->pcp));
+                        drain_zone_pages(zone, this_cpu_ptr(&p->pcp));
 #endif
         }
         fold_diff(global_diff);
@@ -866,6 +868,10 @@ const char * const vmstat_text[] = {
         "nr_tlb_local_flush_one",
 #endif /* CONFIG_DEBUG_TLBFLUSH */
 
+#ifdef CONFIG_DEBUG_VM_VMACACHE
+        "vmacache_find_calls",
+        "vmacache_find_hits",
+#endif
 #endif /* CONFIG_VM_EVENTS_COUNTERS */
 };
 #endif /* CONFIG_PROC_FS || CONFIG_SYSFS || CONFIG_NUMA */
@@ -1226,7 +1232,7 @@ int sysctl_stat_interval __read_mostly = HZ;
 static void vmstat_update(struct work_struct *w)
 {
         refresh_cpu_vm_stats();
-        schedule_delayed_work(&__get_cpu_var(vmstat_work),
+        schedule_delayed_work(this_cpu_ptr(&vmstat_work),
                 round_jiffies_relative(sysctl_stat_interval));
 }
 
diff --git a/mm/zbud.c b/mm/zbud.c
index 9451361e6aa7..01df13a7e2e1 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -247,7 +247,7 @@ void zbud_destroy_pool(struct zbud_pool *pool)
  * gfp arguments are invalid or -ENOMEM if the pool was unable to allocate
  * a new page.
  */
-int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
+int zbud_alloc(struct zbud_pool *pool, unsigned int size, gfp_t gfp,
                         unsigned long *handle)
 {
         int chunks, i, freechunks;
@@ -255,7 +255,7 @@ int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
         enum buddy bud;
         struct page *page;
 
-        if (size <= 0 || gfp & __GFP_HIGHMEM)
+        if (!size || (gfp & __GFP_HIGHMEM))
                 return -EINVAL;
         if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED - CHUNK_SIZE)
                 return -ENOSPC;
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 36b4591a7a2d..fe78189624cf 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -141,7 +141,7 @@
 #define ZS_MAX_ALLOC_SIZE       PAGE_SIZE
 
 /*
- * On systems with 4K page size, this gives 254 size classes! There is a
+ * On systems with 4K page size, this gives 255 size classes! There is a
  * trader-off here:
  *  - Large number of size classes is potentially wasteful as free page are
  *    spread across these classes
@@ -1082,7 +1082,7 @@ void zs_unmap_object(struct zs_pool *pool, unsigned long handle)
         class = &pool->size_class[class_idx];
         off = obj_idx_to_offset(page, obj_idx, class->size);
 
-        area = &__get_cpu_var(zs_map_area);
+        area = this_cpu_ptr(&zs_map_area);
         if (off + class->size <= PAGE_SIZE)
                 kunmap_atomic(area->vm_addr);
         else {
diff --git a/mm/zswap.c b/mm/zswap.c
index aeaef0fb5624..008388fe7b0f 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -347,7 +347,7 @@ static int __zswap_cpu_notifier(unsigned long action, unsigned long cpu)
                         return NOTIFY_BAD;
                 }
                 *per_cpu_ptr(zswap_comp_pcpu_tfms, cpu) = tfm;
-                dst = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
+                dst = kmalloc_node(PAGE_SIZE * 2, GFP_KERNEL, cpu_to_node(cpu));
                 if (!dst) {
                         pr_err("can't allocate compressor buffer\n");
                         crypto_free_comp(tfm);
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 34eb2160489d..010b18ef4ea0 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -24,6 +24,7 @@ my $emacs = 0;
 my $terse = 0;
 my $file = 0;
 my $check = 0;
+my $check_orig = 0;
 my $summary = 1;
 my $mailback = 0;
 my $summary_file = 0;
@@ -146,6 +147,7 @@ GetOptions(
 help(0) if ($help);
 
 $fix = 1 if ($fix_inplace);
+$check_orig = $check;
 
 my $exit = 0;
 
@@ -397,6 +399,11 @@ foreach my $entry (@mode_permission_funcs) {
         $mode_perms_search .= $entry->[0];
 }
 
+our $declaration_macros = qr{(?x:
+        (?:$Storage\s+)?(?:DECLARE|DEFINE)_[A-Z]+\s*\(|
+        (?:$Storage\s+)?LIST_HEAD\s*\(
+)};
+
 our $allowed_asm_includes = qr{(?x:
         irq|
         memory
@@ -1808,11 +1815,13 @@ sub process {
                 $here = "#$linenr: " if (!$file);
                 $here = "#$realline: " if ($file);
 
+                my $found_file = 0;
                 # extract the filename as it passes
                 if ($line =~ /^diff --git.*?(\S+)$/) {
                         $realfile = $1;
                         $realfile =~ s@^([^/]*)/@@ if (!$file);
                         $in_commit_log = 0;
+                        $found_file = 1;
                 } elsif ($line =~ /^\+\+\+\s+(\S+)/) {
                         $realfile = $1;
                         $realfile =~ s@^([^/]*)/@@ if (!$file);
@@ -1829,6 +1838,15 @@ sub process {
                                 ERROR("MODIFIED_INCLUDE_ASM",
                                       "do not modify files in include/asm, change architecture specific files in include/asm-<architecture>\n" . "$here$rawline\n");
                         }
+                        $found_file = 1;
+                }
+
+                if ($found_file) {
+                        if ($realfile =~ m@^(drivers/net/|net/)@) {
+                                $check = 1;
+                        } else {
+                                $check = $check_orig;
+                        }
                         next;
                 }
 
@@ -1926,6 +1944,12 @@ sub process {
                         }
                 }
 
+# Check for old stable address
+                if ($line =~ /^\s*cc:\s*.*<?\bstable\@kernel\.org\b>?.*$/i) {
+                        ERROR("STABLE_ADDRESS",
+                              "The 'stable' address should be 'stable\@vger.kernel.org'\n" . $herecurr);
+                }
+
 # Check for unwanted Gerrit info
                 if ($in_commit_log && $line =~ /^\s*change-id:/i) {
                         ERROR("GERRIT_CHANGE_ID",
@@ -2093,8 +2117,10 @@ sub process {
 
                         foreach my $compat (@compats) {
                                 my $compat2 = $compat;
-                                $compat2 =~ s/\,[a-z]*\-/\,<\.\*>\-/;
-                                `grep -Erq "$compat|$compat2" $dt_path`;
+                                $compat2 =~ s/\,[a-zA-Z0-9]*\-/\,<\.\*>\-/;
+                                my $compat3 = $compat;
+                                $compat3 =~ s/\,([a-z]*)[0-9]*\-/\,$1<\.\*>\-/;
+                                `grep -Erq "$compat|$compat2|$compat3" $dt_path`;
                                 if ( $? >> 8 ) {
                                         WARN("UNDOCUMENTED_DT_STRING",
                                              "DT compatible string \"$compat\" appears un-documented -- check $dt_path\n" . $herecurr);
@@ -2266,18 +2292,37 @@ sub process {
                 }
 
 # check for missing blank lines after declarations
-                if ($realfile =~ m@^(drivers/net/|net/)@ &&
-                    $prevline =~ /^\+\s+$Declare\s+$Ident/ &&
-                    !($prevline =~ /(?:$Compare|$Assignment|$Operators)\s*$/ ||
-                      $prevline =~ /(?:\{\s*|\\)$/) &&          #extended lines
-                    $sline =~ /^\+\s+/ &&                       #Not at char 1
-                    !($sline =~ /^\+\s+$Declare/ ||
-                      $sline =~ /^\+\s+$Ident\s+$Ident/ ||      #eg: typedef foo
+                if ($sline =~ /^\+\s+\S/ &&                     #Not at char 1
+                        # actual declarations
+                    ($prevline =~ /^\+\s+$Declare\s*$Ident\s*[=,;:\[]/ ||
+                        # foo bar; where foo is some local typedef or #define
+                     $prevline =~ /^\+\s+$Ident(?:\s+|\s*\*\s*)$Ident\s*[=,;\[]/ ||
+                        # known declaration macros
+                     $prevline =~ /^\+\s+$declaration_macros/) &&
+                        # for "else if" which can look like "$Ident $Ident"
+                    !($prevline =~ /^\+\s+$c90_Keywords\b/ ||
+                        # other possible extensions of declaration lines
+                      $prevline =~ /(?:$Compare|$Assignment|$Operators)\s*$/ ||
+                        # not starting a section or a macro "\" extended line
+                      $prevline =~ /(?:\{\s*|\\)$/) &&
+                        # looks like a declaration
+                    !($sline =~ /^\+\s+$Declare\s*$Ident\s*[=,;:\[]/ ||
+                        # foo bar; where foo is some local typedef or #define
+                      $sline =~ /^\+\s+$Ident(?:\s+|\s*\*\s*)$Ident\s*[=,;\[]/ ||
+                        # known declaration macros
+                      $sline =~ /^\+\s+$declaration_macros/ ||
+                        # start of struct or union or enum
                       $sline =~ /^\+\s+(?:union|struct|enum|typedef)\b/ ||
-                      $sline =~ /^\+\s+(?:$|[\{\}\.\#\"\?\:\(])/ ||
-                      $sline =~ /^\+\s+\(?\s*(?:$Compare|$Assignment|$Operators)/)) {
+                        # start or end of block or continuation of declaration
+                      $sline =~ /^\+\s+(?:$|[\{\}\.\#\"\?\:\(\[])/ ||
+                        # bitfield continuation
+                      $sline =~ /^\+\s+$Ident\s*:\s*\d+\s*[,;]/ ||
+                        # other possible extensions of declaration lines
+                      $sline =~ /^\+\s+\(?\s*(?:$Compare|$Assignment|$Operators)/) &&
+                        # indentation of previous and current line are the same
+                    (($prevline =~ /\+(\s+)\S/) && $sline =~ /^\+$1\S/)) {
                         WARN("SPACING",
-                             "networking uses a blank line after declarations\n" . $hereprev);
+                             "Missing a blank line after declarations\n" . $hereprev);
                 }
 
 # check for spaces at the beginning of a line.
@@ -3431,6 +3476,13 @@ sub process {
                         }
                 }
 
+# unnecessary return in a void function? (a single leading tab, then return;)
+                if ($sline =~ /^\+\treturn\s*;\s*$/ &&
+                    $prevline =~ /^\+/) {
+                        WARN("RETURN_VOID",
+                             "void function return statements are not generally useful\n" . $herecurr);
+                }
+
 # if statements using unnecessary parentheses - ie: if ((foo == bar))
                 if ($^V && $^V ge 5.10.0 &&
                     $line =~ /\bif\s*((?:\(\s*){2,})/) {
@@ -3782,6 +3834,17 @@ sub process {
                                         WARN("DO_WHILE_MACRO_WITH_TRAILING_SEMICOLON",
                                              "do {} while (0) macros should not be semicolon terminated\n" . "$herectx");
                                 }
+                        } elsif ($dstat =~ /^\+\s*#\s*define\s+$Ident.*;\s*$/) {
+                                $ctx =~ s/\n*$//;
+                                my $cnt = statement_rawlines($ctx);
+                                my $herectx = $here . "\n";
+
+                                for (my $n = 0; $n < $cnt; $n++) {
+                                        $herectx .= raw_line($linenr, $n) . "\n";
+                                }
+
+                                WARN("TRAILING_SEMICOLON",
+                                     "macros should not use a trailing semicolon\n" . "$herectx");
                         }
                 }
 
@@ -4264,6 +4327,27 @@ sub process {
                              "unchecked sscanf return value\n" . "$here\n$stat_real\n");
                 }
 
+# check for simple sscanf that should be kstrto<foo>
+                if ($^V && $^V ge 5.10.0 &&
+                    defined $stat &&
+                    $line =~ /\bsscanf\b/) {
+                        my $lc = $stat =~ tr@\n@@;
+                        $lc = $lc + $linenr;
+                        my $stat_real = raw_line($linenr, 0);
+                        for (my $count = $linenr + 1; $count <= $lc; $count++) {
+                                $stat_real = $stat_real . "\n" . raw_line($count, 0);
+                        }
+                        if ($stat_real =~ /\bsscanf\b\s*\(\s*$FuncArg\s*,\s*("[^"]+")/) {
+                                my $format = $6;
+                                my $count = $format =~ tr@%@%@;
+                                if ($count == 1 &&
+                                    $format =~ /^"\%(?i:ll[udxi]|[udxi]ll|ll|[hl]h?[udxi]|[udxi][hl]h?|[hl]h?|[udxi])"$/) {
+                                        WARN("SSCANF_TO_KSTRTO",
+                                             "Prefer kstrto<type> to single variable sscanf\n" . "$here\n$stat_real\n");
+                                }
+                        }
+                }
+
 # check for new externs in .h files.
                 if ($realfile =~ /\.h$/ &&
                     $line =~ /^\+\s*(extern\s+)$Type\s*$Ident\s*\(/s) {
@@ -4328,6 +4412,30 @@ sub process {
                             "Prefer $3(sizeof(*$1)...) over $3($4...)\n" . $herecurr);
                 }
 
+# check for k[mz]alloc with multiplies that could be kmalloc_array/kcalloc
+                if ($^V && $^V ge 5.10.0 &&
+                    $line =~ /\b($Lval)\s*\=\s*(?:$balanced_parens)?\s*(k[mz]alloc)\s*\(\s*($FuncArg)\s*\*\s*($FuncArg)/) {
+                        my $oldfunc = $3;
+                        my $a1 = $4;
+                        my $a2 = $10;
+                        my $newfunc = "kmalloc_array";
+                        $newfunc = "kcalloc" if ($oldfunc eq "kzalloc");
+                        if ($a1 =~ /^sizeof\s*\S/ || $a2 =~ /^sizeof\s*\S/) {
+                                if (WARN("ALLOC_WITH_MULTIPLY",
+                                         "Prefer $newfunc over $oldfunc with multiply\n" . $herecurr) &&
+                                    $fix) {
+                                        my $r1 = $a1;
+                                        my $r2 = $a2;
+                                        if ($a1 =~ /^sizeof\s*\S/) {
+                                                $r1 = $a2;
+                                                $r2 = $a1;
+                                        }
+                                        $fixed[$linenr - 1] =~ s/\b($Lval)\s*\=\s*(?:$balanced_parens)?\s*(k[mz]alloc)\s*\(\s*($FuncArg)\s*\*\s*($FuncArg)/$1 . ' = ' . "$newfunc(" . trim($r1) . ', ' . trim($r2)/e;
+
+                                }
+                        }
+                }
+
 # check for krealloc arg reuse
                 if ($^V && $^V ge 5.10.0 &&
                     $line =~ /\b($Lval)\s*\=\s*(?:$balanced_parens)?\s*krealloc\s*\(\s*\1\s*,/) {
@@ -4443,10 +4551,10 @@ sub process {
                              "$1 is obsolete, use k$3 instead\n" . $herecurr);
                 }
 
-# check for __initcall(), use device_initcall() explicitly please
+# check for __initcall(), use device_initcall() explicitly or more appropriate function please
                 if ($line =~ /^.\s*__initcall\s*\(/) {
                         WARN("USE_DEVICE_INITCALL",
-                             "please use device_initcall() instead of __initcall()\n" . $herecurr);
+                             "please use device_initcall() or more appropriate function instead of __initcall() (see include/linux/init.h)\n" . $herecurr);
                 }
 
 # check for various ops structs, ensure they are const.
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index 05654f5e48d5..c4d6d2e20e0d 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -32,6 +32,8 @@
 #include <assert.h>
 #include <ftw.h>
 #include <time.h>
+#include <setjmp.h>
+#include <signal.h>
 #include <sys/types.h>
 #include <sys/errno.h>
 #include <sys/fcntl.h>
@@ -824,21 +826,38 @@ static void show_file(const char *name, const struct stat *st)
                         atime, now - st->st_atime);
 }
 
+static sigjmp_buf sigbus_jmp;
+
+static void * volatile sigbus_addr;
+
+static void sigbus_handler(int sig, siginfo_t *info, void *ucontex)
+{
+        (void)sig;
+        (void)ucontex;
+        sigbus_addr = info ? info->si_addr : NULL;
+        siglongjmp(sigbus_jmp, 1);
+}
+
+static struct sigaction sigbus_action = {
+        .sa_sigaction = sigbus_handler,
+        .sa_flags = SA_SIGINFO,
+};
+
 static void walk_file(const char *name, const struct stat *st)
 {
         uint8_t vec[PAGEMAP_BATCH];
         uint64_t buf[PAGEMAP_BATCH], flags;
         unsigned long nr_pages, pfn, i;
+        off_t off, end = st->st_size;
         int fd;
-        off_t off;
         ssize_t len;
         void *ptr;
         int first = 1;
 
         fd = checked_open(name, O_RDONLY|O_NOATIME|O_NOFOLLOW);
 
-        for (off = 0; off < st->st_size; off += len) {
-                nr_pages = (st->st_size - off + page_size - 1) / page_size;
+        for (off = 0; off < end; off += len) {
+                nr_pages = (end - off + page_size - 1) / page_size;
                 if (nr_pages > PAGEMAP_BATCH)
                         nr_pages = PAGEMAP_BATCH;
                 len = nr_pages * page_size;
@@ -855,11 +874,19 @@ static void walk_file(const char *name, const struct stat *st)
                 if (madvise(ptr, len, MADV_RANDOM))
                         fatal("madvice failed: %s", name);
 
+                if (sigsetjmp(sigbus_jmp, 1)) {
+                        end = off + sigbus_addr ? sigbus_addr - ptr : 0;
+                        fprintf(stderr, "got sigbus at offset %lld: %s\n",
+                                        (long long)end, name);
+                        goto got_sigbus;
+                }
+
                 /* populate ptes */
                 for (i = 0; i < nr_pages ; i++) {
                         if (vec[i] & 1)
                                 (void)*(volatile int *)(ptr + i * page_size);
                 }
+got_sigbus:
 
                 /* turn off harvesting reference bits */
                 if (madvise(ptr, len, MADV_SEQUENTIAL))
@@ -910,6 +937,7 @@ static void walk_page_cache(void)
 
         kpageflags_fd = checked_open(PROC_KPAGEFLAGS, O_RDONLY);
         pagemap_fd = checked_open("/proc/self/pagemap", O_RDONLY);
+        sigaction(SIGBUS, &sigbus_action, NULL);
 
         if (stat(opt_file, &st))
                 fatal("stat failed: %s\n", opt_file);
@@ -925,6 +953,7 @@ static void walk_page_cache(void)
 
         close(kpageflags_fd);
         close(pagemap_fd);
+        signal(SIGBUS, SIG_DFL);
 }
 
 static void parse_file(const char *name)