10 files changed, 103 insertions, 37 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index ae55c1e04d10..3bea74f1ccfe 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -286,8 +286,12 @@ config NR_QUICK
         default "1"
 
 config VIRT_TO_BUS
-        def_bool y
-        depends on HAVE_VIRT_TO_BUS
+        bool
+        help
+          An architecture should select this if it implements the
+          deprecated interface virt_to_bus().  All new architectures
+          should probably not select this.
+
 
 config MMU_NOTIFIER
         bool
diff --git a/mm/fremap.c b/mm/fremap.c
index 0cd4c11488ed..87da3590c61e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -129,7 +129,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
         struct vm_area_struct *vma;
         int err = -EINVAL;
         int has_write_lock = 0;
-        vm_flags_t vm_flags;
+        vm_flags_t vm_flags = 0;
 
         if (prot)
                 return err;
@@ -204,10 +204,8 @@ get_write_lock:
                         unsigned long addr;
                         struct file *file = get_file(vma->vm_file);
 
-                        vm_flags = vma->vm_flags;
-                        if (!(flags & MAP_NONBLOCK))
-                                vm_flags |= VM_POPULATE;
-                        addr = mmap_region(file, start, size, vm_flags, pgoff);
+                        addr = mmap_region(file, start, size,
+                                        vma->vm_flags, pgoff);
                         fput(file);
                         if (IS_ERR_VALUE(addr)) {
                                 err = addr;
@@ -226,12 +224,6 @@ get_write_lock:
                 mutex_unlock(&mapping->i_mmap_mutex);
         }
 
-        if (!(flags & MAP_NONBLOCK) && !(vma->vm_flags & VM_POPULATE)) {
-                if (!has_write_lock)
-                        goto get_write_lock;
-                vma->vm_flags |= VM_POPULATE;
-        }
-
         if (vma->vm_flags & VM_LOCKED) {
                 /*
                  * drop PG_Mlocked flag for over-mapped range
@@ -254,7 +246,8 @@ get_write_lock:
          */
 
 out:
-        vm_flags = vma->vm_flags;
+        if (vma)
+                vm_flags = vma->vm_flags;
         if (likely(!has_write_lock))
                 up_read(&mm->mmap_sem);
         else
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 0a0be33bb199..1a12f5b9a0ab 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2124,8 +2124,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf)
 /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
 unsigned long hugetlb_total_pages(void)
 {
-        struct hstate *h = &default_hstate;
-        return h->nr_huge_pages * pages_per_huge_page(h);
+        struct hstate *h;
+        unsigned long nr_total_pages = 0;
+
+        for_each_hstate(h)
+                nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
+        return nr_total_pages;
 }
 
 static int hugetlb_acct_memory(struct hstate *h, long delta)
@@ -2957,7 +2961,17 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         break;
                 }
 
-                if (absent ||
+                /*
+                 * We need call hugetlb_fault for both hugepages under migration
+                 * (in which case hugetlb_fault waits for the migration,) and
+                 * hwpoisoned hugepages (in which case we need to prevent the
+                 * caller from accessing to them.) In order to do this, we use
+                 * here is_swap_pte instead of is_hugetlb_entry_migration and
+                 * is_hugetlb_entry_hwpoisoned. This is because it simply covers
+                 * both cases, and because we can't follow correct pages
+                 * directly from any kind of swap entries.
+                 */
+                if (absent || is_swap_pte(huge_ptep_get(pte)) ||
                     ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) {
                         int ret;
 
diff --git a/mm/memory.c b/mm/memory.c
index 494526ae024a..ba94dec5b259 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -216,6 +216,7 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
         tlb->mm = mm;
 
         tlb->fullmm     = fullmm;
+        tlb->need_flush_all = 0;
         tlb->start      = -1UL;
         tlb->end        = 0;
         tlb->need_flush = 0;
@@ -2392,6 +2393,53 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
 }
 EXPORT_SYMBOL(remap_pfn_range);
 
+/**
+ * vm_iomap_memory - remap memory to userspace
+ * @vma: user vma to map to
+ * @start: start of area
+ * @len: size of area
+ *
+ * This is a simplified io_remap_pfn_range() for common driver use. The
+ * driver just needs to give us the physical memory range to be mapped,
+ * we'll figure out the rest from the vma information.
+ *
+ * NOTE! Some drivers might want to tweak vma->vm_page_prot first to get
+ * whatever write-combining details or similar.
+ */
+int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
+{
+        unsigned long vm_len, pfn, pages;
+
+        /* Check that the physical memory area passed in looks valid */
+        if (start + len < start)
+                return -EINVAL;
+        /*
+         * You *really* shouldn't map things that aren't page-aligned,
+         * but we've historically allowed it because IO memory might
+         * just have smaller alignment.
+         */
+        len += start & ~PAGE_MASK;
+        pfn = start >> PAGE_SHIFT;
+        pages = (len + ~PAGE_MASK) >> PAGE_SHIFT;
+        if (pfn + pages < pfn)
+                return -EINVAL;
+
+        /* We start the mapping 'vm_pgoff' pages into the area */
+        if (vma->vm_pgoff > pages)
+                return -EINVAL;
+        pfn += vma->vm_pgoff;
+        pages -= vma->vm_pgoff;
+
+        /* Can we fit all of the mapping? */
+        vm_len = vma->vm_end - vma->vm_start;
+        if (vm_len >> PAGE_SHIFT > pages)
+                return -EINVAL;
+
+        /* Ok, let it rip */
+        return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
+}
+EXPORT_SYMBOL(vm_iomap_memory);
+
 static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
                                      unsigned long addr, unsigned long end,
                                      pte_fn_t fn, void *data)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b81a367b9f39..ee3765760818 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1779,7 +1779,11 @@ void try_offline_node(int nid)
         for (i = 0; i < MAX_NR_ZONES; i++) {
                 struct zone *zone = pgdat->node_zones + i;
 
-                if (zone->wait_table)
+                /*
+                 * wait_table may be allocated from boot memory,
+                 * here only free if it's allocated by vmalloc.
+                 */
+                if (is_vmalloc_addr(zone->wait_table))
                         vfree(zone->wait_table);
         }
 
@@ -1801,7 +1805,7 @@ int __ref remove_memory(int nid, u64 start, u64 size)
         int retry = 1;
 
         start_pfn = PFN_DOWN(start);
-        end_pfn = start_pfn + PFN_DOWN(size);
+        end_pfn = PFN_UP(start + size - 1);
 
         /*
          * When CONFIG_MEMCG is on, one memory block may be used by other
diff --git a/mm/mlock.c b/mm/mlock.c
index 1c5e33fce639..79b7cf7d1bca 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -358,7 +358,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
 
                 newflags = vma->vm_flags & ~VM_LOCKED;
                 if (on)
-                        newflags |= VM_LOCKED | VM_POPULATE;
+                        newflags |= VM_LOCKED;
 
                 tmp = vma->vm_end;
                 if (tmp > end)
@@ -418,8 +418,7 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
                  * range with the first VMA. Also, skip undesirable VMA types.
                  */
                 nend = min(end, vma->vm_end);
-                if ((vma->vm_flags & (VM_IO | VM_PFNMAP | VM_POPULATE)) !=
-                    VM_POPULATE)
+                if (vma->vm_flags & (VM_IO | VM_PFNMAP))
                         continue;
                 if (nstart < vma->vm_start)
                         nstart = vma->vm_start;
@@ -492,9 +491,9 @@ static int do_mlockall(int flags)
         struct vm_area_struct * vma, * prev = NULL;
 
         if (flags & MCL_FUTURE)
-                current->mm->def_flags |= VM_LOCKED | VM_POPULATE;
+                current->mm->def_flags |= VM_LOCKED;
         else
-                current->mm->def_flags &= ~(VM_LOCKED | VM_POPULATE);
+                current->mm->def_flags &= ~VM_LOCKED;
         if (flags == MCL_FUTURE)
                 goto out;
 
@@ -503,7 +502,7 @@ static int do_mlockall(int flags)
 
                 newflags = vma->vm_flags & ~VM_LOCKED;
                 if (flags & MCL_CURRENT)
-                        newflags |= VM_LOCKED | VM_POPULATE;
+                        newflags |= VM_LOCKED;
 
                 /* Ignore errors */
                 mlock_fixup(vma, &prev, vma->vm_start, vma->vm_end, newflags);
diff --git a/mm/mmap.c b/mm/mmap.c
index 2664a47cec93..0db0de1c2fbe 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1306,7 +1306,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         }
 
         addr = mmap_region(file, addr, len, vm_flags, pgoff);
-        if (!IS_ERR_VALUE(addr) && (vm_flags & VM_POPULATE))
+        if (!IS_ERR_VALUE(addr) &&
+            ((vm_flags & VM_LOCKED) ||
+             (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
                 *populate = len;
         return addr;
 }
@@ -1938,7 +1940,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
 
         /* Check the cache first. */
         /* (Cache hit rate is typically around 35%.) */
-        vma = mm->mmap_cache;
+        vma = ACCESS_ONCE(mm->mmap_cache);
         if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
                 struct rb_node *rb_node;
 
diff --git a/mm/nommu.c b/mm/nommu.c
index e19328087534..e001768b14e8 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -821,7 +821,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
         struct vm_area_struct *vma;
 
         /* check the cache first */
-        vma = mm->mmap_cache;
+        vma = ACCESS_ONCE(mm->mmap_cache);
         if (vma && vma->vm_start <= addr && vma->vm_end > addr)
                 return vma;
 
@@ -1838,6 +1838,16 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
 }
 EXPORT_SYMBOL(remap_pfn_range);
 
+int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
+{
+        unsigned long pfn = start >> PAGE_SHIFT;
+        unsigned long vm_len = vma->vm_end - vma->vm_start;
+
+        pfn += vma->vm_pgoff;
+        return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
+}
+EXPORT_SYMBOL(vm_iomap_memory);
+
 int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
                         unsigned long pgoff)
 {
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index 926b46649749..fd26d0433509 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -429,12 +429,6 @@ compat_process_vm_rw(compat_pid_t pid,
         if (flags != 0)
                 return -EINVAL;
 
-        if (!access_ok(VERIFY_READ, lvec, liovcnt * sizeof(*lvec)))
-                goto out;
-
-        if (!access_ok(VERIFY_READ, rvec, riovcnt * sizeof(*rvec)))
-                goto out;
-
         if (vm_write)
                 rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt,
                                                   UIO_FASTIOV, iovstack_l,
@@ -459,8 +453,6 @@ free_iovecs:
                 kfree(iov_r);
         if (iov_l != iovstack_l)
                 kfree(iov_l);
-
-out:
         return rc;
 }
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 88c5fed8b9a4..669fba39be1a 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3188,9 +3188,9 @@ int kswapd_run(int nid)
         if (IS_ERR(pgdat->kswapd)) {
                 /* failure at boot is fatal */
                 BUG_ON(system_state == SYSTEM_BOOTING);
-                pgdat->kswapd = NULL;
                 pr_err("Failed to start kswapd on node %d\n", nid);
                 ret = PTR_ERR(pgdat->kswapd);
+                pgdat->kswapd = NULL;
         }
         return ret;
 }