9 files changed, 118 insertions, 52 deletions

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index f2e574dbc300..801c08b046e6 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -176,6 +176,9 @@ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
         int ret = 0;
         struct device *dev;
 
+        if (bdi->dev)   /* The driver needs to use separate queues per device */
+                goto exit;
+
         va_start(args, fmt);
         dev = device_create_vargs(bdi_class, parent, MKDEV(0, 0), bdi, fmt, args);
         va_end(args);
diff --git a/mm/memory.c b/mm/memory.c
index 164951c47305..f01b7eed6e16 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -669,6 +669,16 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
         if (is_vm_hugetlb_page(vma))
                 return copy_hugetlb_page_range(dst_mm, src_mm, vma);
 
+        if (unlikely(is_pfn_mapping(vma))) {
+                /*
+                 * We do not free on error cases below as remove_vma
+                 * gets called on error from higher level routine
+                 */
+                ret = track_pfn_vma_copy(vma);
+                if (ret)
+                        return ret;
+        }
+
         /*
          * We need to invalidate the secondary MMU mappings only when
          * there could be a permission downgrade on the ptes of the
@@ -915,6 +925,9 @@ unsigned long unmap_vmas(struct mmu_gather **tlbp,
                 if (vma->vm_flags & VM_ACCOUNT)
                         *nr_accounted += (end - start) >> PAGE_SHIFT;
 
+                if (unlikely(is_pfn_mapping(vma)))
+                        untrack_pfn_vma(vma, 0, 0);
+
                 while (start != end) {
                         if (!tlb_start_valid) {
                                 tlb_start = start;
@@ -1430,6 +1443,7 @@ out:
 int vm_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
                         unsigned long pfn)
 {
+        int ret;
         /*
          * Technically, architectures with pte_special can avoid all these
          * restrictions (same for remap_pfn_range).  However we would like
@@ -1444,7 +1458,15 @@ int vm_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
 
         if (addr < vma->vm_start || addr >= vma->vm_end)
                 return -EFAULT;
-        return insert_pfn(vma, addr, pfn, vma->vm_page_prot);
+        if (track_pfn_vma_new(vma, vma->vm_page_prot, pfn, PAGE_SIZE))
+                return -EINVAL;
+
+        ret = insert_pfn(vma, addr, pfn, vma->vm_page_prot);
+
+        if (ret)
+                untrack_pfn_vma(vma, pfn, PAGE_SIZE);
+
+        return ret;
 }
 EXPORT_SYMBOL(vm_insert_pfn);
 
@@ -1575,14 +1597,17 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
          * behaviour that some programs depend on. We mark the "original"
          * un-COW'ed pages by matching them up with "vma->vm_pgoff".
          */
-        if (is_cow_mapping(vma->vm_flags)) {
-                if (addr != vma->vm_start || end != vma->vm_end)
-                        return -EINVAL;
+        if (addr == vma->vm_start && end == vma->vm_end)
                 vma->vm_pgoff = pfn;
-        }
+        else if (is_cow_mapping(vma->vm_flags))
+                return -EINVAL;
 
         vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
 
+        err = track_pfn_vma_new(vma, prot, pfn, PAGE_ALIGN(size));
+        if (err)
+                return -EINVAL;
+
         BUG_ON(addr >= end);
         pfn -= addr >> PAGE_SHIFT;
         pgd = pgd_offset(mm, addr);
@@ -1594,6 +1619,10 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
+
+        if (err)
+                untrack_pfn_vma(vma, pfn, PAGE_ALIGN(size));
+
         return err;
 }
 EXPORT_SYMBOL(remap_pfn_range);
@@ -2865,9 +2894,9 @@ int in_gate_area_no_task(unsigned long addr)
 #endif  /* __HAVE_ARCH_GATE_AREA */
 
 #ifdef CONFIG_HAVE_IOREMAP_PROT
-static resource_size_t follow_phys(struct vm_area_struct *vma,
-                        unsigned long address, unsigned int flags,
-                        unsigned long *prot)
+int follow_phys(struct vm_area_struct *vma,
+                unsigned long address, unsigned int flags,
+                unsigned long *prot, resource_size_t *phys)
 {
         pgd_t *pgd;
         pud_t *pud;
@@ -2876,24 +2905,26 @@ static resource_size_t follow_phys(struct vm_area_struct *vma,
         spinlock_t *ptl;
         resource_size_t phys_addr = 0;
         struct mm_struct *mm = vma->vm_mm;
+        int ret = -EINVAL;
 
-        VM_BUG_ON(!(vma->vm_flags & (VM_IO | VM_PFNMAP)));
+        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
+                goto out;
 
         pgd = pgd_offset(mm, address);
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
-                goto no_page_table;
+                goto out;
 
         pud = pud_offset(pgd, address);
         if (pud_none(*pud) || unlikely(pud_bad(*pud)))
-                goto no_page_table;
+                goto out;
 
         pmd = pmd_offset(pud, address);
         if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd)))
-                goto no_page_table;
+                goto out;
 
         /* We cannot handle huge page PFN maps. Luckily they don't exist. */
         if (pmd_huge(*pmd))
-                goto no_page_table;
+                goto out;
 
         ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
         if (!ptep)
@@ -2908,13 +2939,13 @@ static resource_size_t follow_phys(struct vm_area_struct *vma,
         phys_addr <<= PAGE_SHIFT; /* Shift here to avoid overflow on PAE */
 
         *prot = pgprot_val(pte_pgprot(pte));
+        *phys = phys_addr;
+        ret = 0;
 
 unlock:
         pte_unmap_unlock(ptep, ptl);
 out:
-        return phys_addr;
-no_page_table:
-        return 0;
+        return ret;
 }
 
 int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
@@ -2925,12 +2956,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
         void *maddr;
         int offset = addr & (PAGE_SIZE-1);
 
-        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
-                return -EINVAL;
-
-        phys_addr = follow_phys(vma, addr, write, &prot);
-
-        if (!phys_addr)
+        if (follow_phys(vma, addr, write, &prot, &phys_addr))
                 return -EINVAL;
 
         maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
diff --git a/mm/migrate.c b/mm/migrate.c
index 1e0d6b237f44..037b0967c1e3 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -987,25 +987,18 @@ out:
 /*
  * Determine the nodes of an array of pages and store it in an array of status.
  */
-static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
-                         const void __user * __user *pages,
-                         int __user *status)
+static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
+                                const void __user **pages, int *status)
 {
         unsigned long i;
-        int err;
 
         down_read(&mm->mmap_sem);
 
         for (i = 0; i < nr_pages; i++) {
-                const void __user *p;
-                unsigned long addr;
+                unsigned long addr = (unsigned long)(*pages);
                 struct vm_area_struct *vma;
                 struct page *page;
-
-                err = -EFAULT;
-                if (get_user(p, pages+i))
-                        goto out;
-                addr = (unsigned long) p;
+                int err = -EFAULT;
 
                 vma = find_vma(mm, addr);
                 if (!vma)
@@ -1024,12 +1017,52 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 
                 err = page_to_nid(page);
 set_status:
-                put_user(err, status+i);
+                *status = err;
+
+                pages++;
+                status++;
+        }
+
+        up_read(&mm->mmap_sem);
+}
+
+/*
+ * Determine the nodes of a user array of pages and store it in
+ * a user array of status.
+ */
+static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
+                         const void __user * __user *pages,
+                         int __user *status)
+{
+#define DO_PAGES_STAT_CHUNK_NR 16
+        const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR];
+        int chunk_status[DO_PAGES_STAT_CHUNK_NR];
+        unsigned long i, chunk_nr = DO_PAGES_STAT_CHUNK_NR;
+        int err;
+
+        for (i = 0; i < nr_pages; i += chunk_nr) {
+                if (chunk_nr + i > nr_pages)
+                        chunk_nr = nr_pages - i;
+
+                err = copy_from_user(chunk_pages, &pages[i],
+                                     chunk_nr * sizeof(*chunk_pages));
+                if (err) {
+                        err = -EFAULT;
+                        goto out;
+                }
+
+                do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status);
+
+                err = copy_to_user(&status[i], chunk_status,
+                                   chunk_nr * sizeof(*chunk_status));
+                if (err) {
+                        err = -EFAULT;
+                        goto out;
+                }
         }
         err = 0;
 
 out:
-        up_read(&mm->mmap_sem);
         return err;
 }
 
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 0b3cbf090a67..ab27ff750519 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -49,6 +49,9 @@ static int __init alloc_node_page_cgroup(int nid)
         start_pfn = NODE_DATA(nid)->node_start_pfn;
         nr_pages = NODE_DATA(nid)->node_spanned_pages;
 
+        if (!nr_pages)
+                return 0;
+
         table_size = sizeof(struct page_cgroup) * nr_pages;
 
         base = __alloc_bootmem_node_nopanic(NODE_DATA(nid),
diff --git a/mm/slob.c b/mm/slob.c
index cb675d126791..bf7e8fc3aed8 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -535,7 +535,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
         struct kmem_cache *c;
 
         c = slob_alloc(sizeof(struct kmem_cache),
-                flags, ARCH_KMALLOC_MINALIGN, -1);
+                GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
 
         if (c) {
                 c->name = name;
diff --git a/mm/slub.c b/mm/slub.c
index 749588a50a5a..a2cd47d89e0a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3597,7 +3597,7 @@ static int list_locations(struct kmem_cache *s, char *buf,
         for (i = 0; i < t.count; i++) {
                 struct location *l = &t.loc[i];
 
-                if (len > PAGE_SIZE - 100)
+                if (len > PAGE_SIZE - KSYM_SYMBOL_LEN - 100)
                         break;
                 len += sprintf(buf + len, "%7ld ", l->count);
 
diff --git a/mm/swap.c b/mm/swap.c
index 2152e48a7b8f..b135ec90cdeb 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -299,7 +299,6 @@ void lru_add_drain(void)
         put_cpu();
 }
 
-#if defined(CONFIG_NUMA) || defined(CONFIG_UNEVICTABLE_LRU)
 static void lru_add_drain_per_cpu(struct work_struct *dummy)
 {
         lru_add_drain();
@@ -313,18 +312,6 @@ int lru_add_drain_all(void)
         return schedule_on_each_cpu(lru_add_drain_per_cpu);
 }
 
-#else
-
-/*
- * Returns 0 for success
- */
-int lru_add_drain_all(void)
-{
-        lru_add_drain();
-        return 0;
-}
-#endif
-
 /*
  * Batched page_cache_release().  Decrement the reference count on all the
  * passed pages.  If it fell to zero then remove the page from the LRU and
@@ -445,6 +432,7 @@ void ____pagevec_lru_add(struct pagevec *pvec, enum lru_list lru)
         for (i = 0; i < pagevec_count(pvec); i++) {
                 struct page *page = pvec->pages[i];
                 struct zone *pagezone = page_zone(page);
+                int file;
 
                 if (pagezone != zone) {
                         if (zone)
@@ -456,8 +444,12 @@ void ____pagevec_lru_add(struct pagevec *pvec, enum lru_list lru)
                 VM_BUG_ON(PageUnevictable(page));
                 VM_BUG_ON(PageLRU(page));
                 SetPageLRU(page);
-                if (is_active_lru(lru))
+                file = is_file_lru(lru);
+                zone->recent_scanned[file]++;
+                if (is_active_lru(lru)) {
                         SetPageActive(page);
+                        zone->recent_rotated[file]++;
+                }
                 add_page_to_lru_list(zone, page, lru);
         }
         if (zone)
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 90cb67a5417c..54a9f87e5162 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1462,6 +1462,15 @@ static int __init procswaps_init(void)
 __initcall(procswaps_init);
 #endif /* CONFIG_PROC_FS */
 
+#ifdef MAX_SWAPFILES_CHECK
+static int __init max_swapfiles_check(void)
+{
+        MAX_SWAPFILES_CHECK();
+        return 0;
+}
+late_initcall(max_swapfiles_check);
+#endif
+
 /*
  * Written 01/25/92 by Simmule Turner, heavily changed by Linus.
  *
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index f3f6e0758562..1ddb77ba3995 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1717,7 +1717,7 @@ static int s_show(struct seq_file *m, void *p)
                 v->addr, v->addr + v->size, v->size);
 
         if (v->caller) {
-                char buff[2 * KSYM_NAME_LEN];
+                char buff[KSYM_SYMBOL_LEN];
 
                 seq_putc(m, ' ');
                 sprint_symbol(buff, (unsigned long)v->caller);