Merge branch 'akpm' (incoming from Andrew)

Merge first patch-bomb from Andrew Morton:

 - a couple of misc things

 - inotify/fsnotify work from Jan

 - ocfs2 updates (partial)

 - about half of MM

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (117 commits)
  mm/migrate: remove unused function, fail_migrate_page()
  mm/migrate: remove putback_lru_pages, fix comment on putback_movable_pages
  mm/migrate: correct failure handling if !hugepage_migration_support()
  mm/migrate: add comment about permanent failure path
  mm, page_alloc: warn for non-blockable __GFP_NOFAIL allocation failure
  mm: compaction: reset scanner positions immediately when they meet
  mm: compaction: do not mark unmovable pageblocks as skipped in async compaction
  mm: compaction: detect when scanners meet in isolate_freepages
  mm: compaction: reset cached scanner pfn's before reading them
  mm: compaction: encapsulate defer reset logic
  mm: compaction: trace compaction begin and end
  memcg, oom: lock mem_cgroup_print_oom_info
  sched: add tracepoints related to NUMA task migration
  mm: numa: do not automatically migrate KSM pages
  mm: numa: trace tasks that fail migration due to rate limiting
  mm: numa: limit scope of lock for NUMA migrate rate limiting
  mm: numa: make NUMA-migrate related functions static
  lib/show_mem.c: show num_poisoned_pages when oom
  mm/hwpoison: add '#' to hwpoison_inject
  mm/memblock: use WARN_ONCE when MAX_NUMNODES passed as input parameter
  ...

5 files changed, 215 insertions, 35 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 6982094a7e74..900b63c1e899 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1584,8 +1584,16 @@ config DMA_API_DEBUG
           With this option you will be able to detect common bugs in device
           drivers like double-freeing of DMA mappings or freeing mappings that
           were never allocated.
-          This option causes a performance degredation.  Use only if you want
-          to debug device drivers. If unsure, say N.
+
+          This also attempts to catch cases where a page owned by DMA is
+          accessed by the cpu in a way that could cause data corruption.  For
+          example, this enables cow_user_page() to check that the source page is
+          not undergoing DMA.
+
+          This option causes a performance degradation.  Use only if you want to
+          debug device drivers and dma interactions.
+
+          If unsure, say N.
 
 source "samples/Kconfig"
 
diff --git a/lib/cpumask.c b/lib/cpumask.c
index d327b87c99b7..b810b753c607 100644
--- a/lib/cpumask.c
+++ b/lib/cpumask.c
@@ -140,7 +140,7 @@ EXPORT_SYMBOL(zalloc_cpumask_var);
  */
 void __init alloc_bootmem_cpumask_var(cpumask_var_t *mask)
 {
-        *mask = alloc_bootmem(cpumask_size());
+        *mask = memblock_virt_alloc(cpumask_size(), 0);
 }
 
 /**
@@ -161,6 +161,6 @@ EXPORT_SYMBOL(free_cpumask_var);
  */
 void __init free_bootmem_cpumask_var(cpumask_var_t mask)
 {
-        free_bootmem(__pa(mask), cpumask_size());
+        memblock_free_early(__pa(mask), cpumask_size());
 }
 #endif
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index d87a17a819d0..c38083871f11 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -53,11 +53,26 @@ enum map_err_types {
 
 #define DMA_DEBUG_STACKTRACE_ENTRIES 5
 
+/**
+ * struct dma_debug_entry - track a dma_map* or dma_alloc_coherent mapping
+ * @list: node on pre-allocated free_entries list
+ * @dev: 'dev' argument to dma_map_{page|single|sg} or dma_alloc_coherent
+ * @type: single, page, sg, coherent
+ * @pfn: page frame of the start address
+ * @offset: offset of mapping relative to pfn
+ * @size: length of the mapping
+ * @direction: enum dma_data_direction
+ * @sg_call_ents: 'nents' from dma_map_sg
+ * @sg_mapped_ents: 'mapped_ents' from dma_map_sg
+ * @map_err_type: track whether dma_mapping_error() was checked
+ * @stacktrace: support backtraces when a violation is detected
+ */
 struct dma_debug_entry {
         struct list_head list;
         struct device    *dev;
         int              type;
-        phys_addr_t      paddr;
+        unsigned long    pfn;
+        size_t           offset;
         u64              dev_addr;
         u64              size;
         int              direction;
@@ -372,6 +387,11 @@ static void hash_bucket_del(struct dma_debug_entry *entry)
         list_del(&entry->list);
 }
 
+static unsigned long long phys_addr(struct dma_debug_entry *entry)
+{
+        return page_to_phys(pfn_to_page(entry->pfn)) + entry->offset;
+}
+
 /*
  * Dump mapping entries for debugging purposes
  */
@@ -389,9 +409,9 @@ void debug_dma_dump_mappings(struct device *dev)
                 list_for_each_entry(entry, &bucket->list, list) {
                         if (!dev || dev == entry->dev) {
                                 dev_info(entry->dev,
-                                         "%s idx %d P=%Lx D=%Lx L=%Lx %s %s\n",
+                                         "%s idx %d P=%Lx N=%lx D=%Lx L=%Lx %s %s\n",
                                          type2name[entry->type], idx,
-                                         (unsigned long long)entry->paddr,
+                                         phys_addr(entry), entry->pfn,
                                          entry->dev_addr, entry->size,
                                          dir2name[entry->direction],
                                          maperr2str[entry->map_err_type]);
@@ -404,6 +424,133 @@ void debug_dma_dump_mappings(struct device *dev)
 EXPORT_SYMBOL(debug_dma_dump_mappings);
 
 /*
+ * For each page mapped (initial page in the case of
+ * dma_alloc_coherent/dma_map_{single|page}, or each page in a
+ * scatterlist) insert into this tree using the pfn as the key. At
+ * dma_unmap_{single|sg|page} or dma_free_coherent delete the entry.  If
+ * the pfn already exists at insertion time add a tag as a reference
+ * count for the overlapping mappings.  For now, the overlap tracking
+ * just ensures that 'unmaps' balance 'maps' before marking the pfn
+ * idle, but we should also be flagging overlaps as an API violation.
+ *
+ * Memory usage is mostly constrained by the maximum number of available
+ * dma-debug entries in that we need a free dma_debug_entry before
+ * inserting into the tree.  In the case of dma_map_{single|page} and
+ * dma_alloc_coherent there is only one dma_debug_entry and one pfn to
+ * track per event.  dma_map_sg(), on the other hand,
+ * consumes a single dma_debug_entry, but inserts 'nents' entries into
+ * the tree.
+ *
+ * At any time debug_dma_assert_idle() can be called to trigger a
+ * warning if the given page is in the active set.
+ */
+static RADIX_TREE(dma_active_pfn, GFP_NOWAIT);
+static DEFINE_SPINLOCK(radix_lock);
+#define ACTIVE_PFN_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
+
+static int active_pfn_read_overlap(unsigned long pfn)
+{
+        int overlap = 0, i;
+
+        for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
+                if (radix_tree_tag_get(&dma_active_pfn, pfn, i))
+                        overlap |= 1 << i;
+        return overlap;
+}
+
+static int active_pfn_set_overlap(unsigned long pfn, int overlap)
+{
+        int i;
+
+        if (overlap > ACTIVE_PFN_MAX_OVERLAP || overlap < 0)
+                return 0;
+
+        for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
+                if (overlap & 1 << i)
+                        radix_tree_tag_set(&dma_active_pfn, pfn, i);
+                else
+                        radix_tree_tag_clear(&dma_active_pfn, pfn, i);
+
+        return overlap;
+}
+
+static void active_pfn_inc_overlap(unsigned long pfn)
+{
+        int overlap = active_pfn_read_overlap(pfn);
+
+        overlap = active_pfn_set_overlap(pfn, ++overlap);
+
+        /* If we overflowed the overlap counter then we're potentially
+         * leaking dma-mappings.  Otherwise, if maps and unmaps are
+         * balanced then this overflow may cause false negatives in
+         * debug_dma_assert_idle() as the pfn may be marked idle
+         * prematurely.
+         */
+        WARN_ONCE(overlap == 0,
+                  "DMA-API: exceeded %d overlapping mappings of pfn %lx\n",
+                  ACTIVE_PFN_MAX_OVERLAP, pfn);
+}
+
+static int active_pfn_dec_overlap(unsigned long pfn)
+{
+        int overlap = active_pfn_read_overlap(pfn);
+
+        return active_pfn_set_overlap(pfn, --overlap);
+}
+
+static int active_pfn_insert(struct dma_debug_entry *entry)
+{
+        unsigned long flags;
+        int rc;
+
+        spin_lock_irqsave(&radix_lock, flags);
+        rc = radix_tree_insert(&dma_active_pfn, entry->pfn, entry);
+        if (rc == -EEXIST)
+                active_pfn_inc_overlap(entry->pfn);
+        spin_unlock_irqrestore(&radix_lock, flags);
+
+        return rc;
+}
+
+static void active_pfn_remove(struct dma_debug_entry *entry)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&radix_lock, flags);
+        if (active_pfn_dec_overlap(entry->pfn) == 0)
+                radix_tree_delete(&dma_active_pfn, entry->pfn);
+        spin_unlock_irqrestore(&radix_lock, flags);
+}
+
+/**
+ * debug_dma_assert_idle() - assert that a page is not undergoing dma
+ * @page: page to lookup in the dma_active_pfn tree
+ *
+ * Place a call to this routine in cases where the cpu touching the page
+ * before the dma completes (page is dma_unmapped) will lead to data
+ * corruption.
+ */
+void debug_dma_assert_idle(struct page *page)
+{
+        unsigned long flags;
+        struct dma_debug_entry *entry;
+
+        if (!page)
+                return;
+
+        spin_lock_irqsave(&radix_lock, flags);
+        entry = radix_tree_lookup(&dma_active_pfn, page_to_pfn(page));
+        spin_unlock_irqrestore(&radix_lock, flags);
+
+        if (!entry)
+                return;
+
+        err_printk(entry->dev, entry,
+                   "DMA-API: cpu touching an active dma mapped page "
+                   "[pfn=0x%lx]\n", entry->pfn);
+}
+
+/*
  * Wrapper function for adding an entry to the hash.
  * This function takes care of locking itself.
  */
@@ -411,10 +558,21 @@ static void add_dma_entry(struct dma_debug_entry *entry)
 {
         struct hash_bucket *bucket;
         unsigned long flags;
+        int rc;
 
         bucket = get_hash_bucket(entry, &flags);
         hash_bucket_add(bucket, entry);
         put_hash_bucket(bucket, &flags);
+
+        rc = active_pfn_insert(entry);
+        if (rc == -ENOMEM) {
+                pr_err("DMA-API: pfn tracking ENOMEM, dma-debug disabled\n");
+                global_disable = true;
+        }
+
+        /* TODO: report -EEXIST errors here as overlapping mappings are
+         * not supported by the DMA API
+         */
 }
 
 static struct dma_debug_entry *__dma_entry_alloc(void)
@@ -469,6 +627,8 @@ static void dma_entry_free(struct dma_debug_entry *entry)
 {
         unsigned long flags;
 
+        active_pfn_remove(entry);
+
         /*
          * add to beginning of the list - this way the entries are
          * more likely cache hot when they are reallocated.
@@ -895,15 +1055,15 @@ static void check_unmap(struct dma_debug_entry *ref)
                            ref->dev_addr, ref->size,
                            type2name[entry->type], type2name[ref->type]);
         } else if ((entry->type == dma_debug_coherent) &&
-                   (ref->paddr != entry->paddr)) {
+                   (phys_addr(ref) != phys_addr(entry))) {
                 err_printk(ref->dev, entry, "DMA-API: device driver frees "
                            "DMA memory with different CPU address "
                            "[device address=0x%016llx] [size=%llu bytes] "
                            "[cpu alloc address=0x%016llx] "
                            "[cpu free address=0x%016llx]",
                            ref->dev_addr, ref->size,
-                           (unsigned long long)entry->paddr,
-                           (unsigned long long)ref->paddr);
+                           phys_addr(entry),
+                           phys_addr(ref));
         }
 
         if (ref->sg_call_ents && ref->type == dma_debug_sg &&
@@ -1052,7 +1212,8 @@ void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
 
         entry->dev       = dev;
         entry->type      = dma_debug_page;
-        entry->paddr     = page_to_phys(page) + offset;
+        entry->pfn       = page_to_pfn(page);
+        entry->offset    = offset,
         entry->dev_addr  = dma_addr;
         entry->size      = size;
         entry->direction = direction;
@@ -1148,7 +1309,8 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
 
                 entry->type           = dma_debug_sg;
                 entry->dev            = dev;
-                entry->paddr          = sg_phys(s);
+                entry->pfn            = page_to_pfn(sg_page(s));
+                entry->offset         = s->offset,
                 entry->size           = sg_dma_len(s);
                 entry->dev_addr       = sg_dma_address(s);
                 entry->direction      = direction;
@@ -1198,7 +1360,8 @@ void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
                 struct dma_debug_entry ref = {
                         .type           = dma_debug_sg,
                         .dev            = dev,
-                        .paddr          = sg_phys(s),
+                        .pfn            = page_to_pfn(sg_page(s)),
+                        .offset         = s->offset,
                         .dev_addr       = sg_dma_address(s),
                         .size           = sg_dma_len(s),
                         .direction      = dir,
@@ -1233,7 +1396,8 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
 
         entry->type      = dma_debug_coherent;
         entry->dev       = dev;
-        entry->paddr     = virt_to_phys(virt);
+        entry->pfn       = page_to_pfn(virt_to_page(virt));
+        entry->offset    = (size_t) virt & PAGE_MASK;
         entry->size      = size;
         entry->dev_addr  = dma_addr;
         entry->direction = DMA_BIDIRECTIONAL;
@@ -1248,7 +1412,8 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
         struct dma_debug_entry ref = {
                 .type           = dma_debug_coherent,
                 .dev            = dev,
-                .paddr          = virt_to_phys(virt),
+                .pfn            = page_to_pfn(virt_to_page(virt)),
+                .offset         = (size_t) virt & PAGE_MASK,
                 .dev_addr       = addr,
                 .size           = size,
                 .direction      = DMA_BIDIRECTIONAL,
@@ -1356,7 +1521,8 @@ void debug_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
                 struct dma_debug_entry ref = {
                         .type           = dma_debug_sg,
                         .dev            = dev,
-                        .paddr          = sg_phys(s),
+                        .pfn            = page_to_pfn(sg_page(s)),
+                        .offset         = s->offset,
                         .dev_addr       = sg_dma_address(s),
                         .size           = sg_dma_len(s),
                         .direction      = direction,
@@ -1388,7 +1554,8 @@ void debug_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
                 struct dma_debug_entry ref = {
                         .type           = dma_debug_sg,
                         .dev            = dev,
-                        .paddr          = sg_phys(s),
+                        .pfn            = page_to_pfn(sg_page(s)),
+                        .offset         = s->offset,
                         .dev_addr       = sg_dma_address(s),
                         .size           = sg_dma_len(s),
                         .direction      = direction,
diff --git a/lib/show_mem.c b/lib/show_mem.c
index 5847a4921b8e..09225796991a 100644
--- a/lib/show_mem.c
+++ b/lib/show_mem.c
@@ -17,9 +17,6 @@ void show_mem(unsigned int filter)
         printk("Mem-Info:\n");
         show_free_areas(filter);
 
-        if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
-                return;
-
         for_each_online_pgdat(pgdat) {
                 unsigned long flags;
                 int zoneid;
@@ -46,4 +43,7 @@ void show_mem(unsigned int filter)
         printk("%lu pages in pagetable cache\n",
                 quicklist_total_size());
 #endif
+#ifdef CONFIG_MEMORY_FAILURE
+        printk("%lu pages hwpoisoned\n", atomic_long_read(&num_poisoned_pages));
+#endif
 }
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index e4399fa65ad6..615f3de4b5ce 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -172,8 +172,9 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
         /*
          * Get the overflow emergency buffer
          */
-        v_overflow_buffer = alloc_bootmem_low_pages_nopanic(
-                                                PAGE_ALIGN(io_tlb_overflow));
+        v_overflow_buffer = memblock_virt_alloc_nopanic(
+                                                PAGE_ALIGN(io_tlb_overflow),
+                                                PAGE_SIZE);
         if (!v_overflow_buffer)
                 return -ENOMEM;
 
@@ -184,11 +185,15 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
          * to find contiguous free memory regions of size up to IO_TLB_SEGSIZE
          * between io_tlb_start and io_tlb_end.
          */
-        io_tlb_list = alloc_bootmem_pages(PAGE_ALIGN(io_tlb_nslabs * sizeof(int)));
+        io_tlb_list = memblock_virt_alloc(
+                                PAGE_ALIGN(io_tlb_nslabs * sizeof(int)),
+                                PAGE_SIZE);
         for (i = 0; i < io_tlb_nslabs; i++)
                 io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
         io_tlb_index = 0;
-        io_tlb_orig_addr = alloc_bootmem_pages(PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)));
+        io_tlb_orig_addr = memblock_virt_alloc(
+                                PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)),
+                                PAGE_SIZE);
 
         if (verbose)
                 swiotlb_print_info();
@@ -215,13 +220,13 @@ swiotlb_init(int verbose)
         bytes = io_tlb_nslabs << IO_TLB_SHIFT;
 
         /* Get IO TLB memory from the low pages */
-        vstart = alloc_bootmem_low_pages_nopanic(PAGE_ALIGN(bytes));
+        vstart = memblock_virt_alloc_nopanic(PAGE_ALIGN(bytes), PAGE_SIZE);
         if (vstart && !swiotlb_init_with_tbl(vstart, io_tlb_nslabs, verbose))
                 return;
 
         if (io_tlb_start)
-                free_bootmem(io_tlb_start,
-                                 PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
+                memblock_free_early(io_tlb_start,
+                                    PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
         pr_warn("Cannot allocate SWIOTLB buffer");
         no_iotlb_memory = true;
 }
@@ -357,14 +362,14 @@ void __init swiotlb_free(void)
                 free_pages((unsigned long)phys_to_virt(io_tlb_start),
                            get_order(io_tlb_nslabs << IO_TLB_SHIFT));
         } else {
-                free_bootmem_late(io_tlb_overflow_buffer,
-                                  PAGE_ALIGN(io_tlb_overflow));
-                free_bootmem_late(__pa(io_tlb_orig_addr),
-                                  PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)));
-                free_bootmem_late(__pa(io_tlb_list),
-                                  PAGE_ALIGN(io_tlb_nslabs * sizeof(int)));
-                free_bootmem_late(io_tlb_start,
-                                  PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
+                memblock_free_late(io_tlb_overflow_buffer,
+                                   PAGE_ALIGN(io_tlb_overflow));
+                memblock_free_late(__pa(io_tlb_orig_addr),
+                                   PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)));
+                memblock_free_late(__pa(io_tlb_list),
+                                   PAGE_ALIGN(io_tlb_nslabs * sizeof(int)));
+                memblock_free_late(io_tlb_start,
+                                   PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
         }
         io_tlb_nslabs = 0;
 }