diff --git a/sys/compat/linuxkpi/common/include/linux/mm.h b/sys/compat/linuxkpi/common/include/linux/mm.h
index 74709299ba1a..dc75ae4483c3 100644
--- a/sys/compat/linuxkpi/common/include/linux/mm.h
+++ b/sys/compat/linuxkpi/common/include/linux/mm.h
@@ -1,270 +1,293 @@
 /*-
  * Copyright (c) 2010 Isilon Systems, Inc.
  * Copyright (c) 2010 iX Systems, Inc.
  * Copyright (c) 2010 Panasas, Inc.
  * Copyright (c) 2013-2017 Mellanox Technologies, Ltd.
  * Copyright (c) 2015 François Tigeot
  * Copyright (c) 2015 Matthew Dillon <dillon@backplane.com>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice unmodified, this list of conditions, and the following
  *    disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * $FreeBSD$
  */
 #ifndef	_LINUX_MM_H_
 #define	_LINUX_MM_H_
 
 #include <linux/spinlock.h>
 #include <linux/gfp.h>
 #include <linux/kernel.h>
 #include <linux/mm_types.h>
 #include <linux/pfn.h>
 #include <linux/list.h>
 
 #include <asm/pgtable.h>
 
 #define	PAGE_ALIGN(x)	ALIGN(x, PAGE_SIZE)
 
 /*
  * Make sure our LinuxKPI defined virtual memory flags don't conflict
  * with the ones defined by FreeBSD:
  */
 CTASSERT((VM_PROT_ALL & -(1 << 8)) == 0);
 
 #define	VM_READ			VM_PROT_READ
 #define	VM_WRITE		VM_PROT_WRITE
 #define	VM_EXEC			VM_PROT_EXECUTE
 
 #define	VM_PFNINTERNAL		(1 << 8)	/* FreeBSD private flag to vm_insert_pfn() */
 #define	VM_MIXEDMAP		(1 << 9)
 #define	VM_NORESERVE		(1 << 10)
 #define	VM_PFNMAP		(1 << 11)
 #define	VM_IO			(1 << 12)
 #define	VM_MAYWRITE		(1 << 13)
 #define	VM_DONTCOPY		(1 << 14)
 #define	VM_DONTEXPAND		(1 << 15)
 #define	VM_DONTDUMP		(1 << 16)
 #define	VM_SHARED		(1 << 17)
 
 #define	VMA_MAX_PREFAULT_RECORD	1
 
 #define	FOLL_WRITE		(1 << 0)
 #define	FOLL_FORCE		(1 << 1)
 
 #define	VM_FAULT_OOM		(1 << 0)
 #define	VM_FAULT_SIGBUS		(1 << 1)
 #define	VM_FAULT_MAJOR		(1 << 2)
 #define	VM_FAULT_WRITE		(1 << 3)
 #define	VM_FAULT_HWPOISON	(1 << 4)
 #define	VM_FAULT_HWPOISON_LARGE	(1 << 5)
 #define	VM_FAULT_SIGSEGV	(1 << 6)
 #define	VM_FAULT_NOPAGE		(1 << 7)
 #define	VM_FAULT_LOCKED		(1 << 8)
 #define	VM_FAULT_RETRY		(1 << 9)
 #define	VM_FAULT_FALLBACK	(1 << 10)
 
+#define	VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
+	VM_FAULT_HWPOISON |VM_FAULT_HWPOISON_LARGE | VM_FAULT_FALLBACK)
+
 #define	FAULT_FLAG_WRITE	(1 << 0)
 #define	FAULT_FLAG_MKWRITE	(1 << 1)
 #define	FAULT_FLAG_ALLOW_RETRY	(1 << 2)
 #define	FAULT_FLAG_RETRY_NOWAIT	(1 << 3)
 #define	FAULT_FLAG_KILLABLE	(1 << 4)
 #define	FAULT_FLAG_TRIED	(1 << 5)
 #define	FAULT_FLAG_USER		(1 << 6)
 #define	FAULT_FLAG_REMOTE	(1 << 7)
 #define	FAULT_FLAG_INSTRUCTION	(1 << 8)
 
 #define fault_flag_allow_retry_first(flags) \
 	(((flags) & (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_TRIED)) == FAULT_FLAG_ALLOW_RETRY)
 
 typedef int (*pte_fn_t)(linux_pte_t *, pgtable_t, unsigned long addr, void *data);
 
 struct vm_area_struct {
 	vm_offset_t vm_start;
 	vm_offset_t vm_end;
 	vm_offset_t vm_pgoff;
 	pgprot_t vm_page_prot;
 	unsigned long vm_flags;
 	struct mm_struct *vm_mm;
 	void   *vm_private_data;
 	const struct vm_operations_struct *vm_ops;
 	struct linux_file *vm_file;
 
 	/* internal operation */
 	vm_paddr_t vm_pfn;		/* PFN for memory map */
 	vm_size_t vm_len;		/* length for memory map */
 	vm_pindex_t vm_pfn_first;
 	int	vm_pfn_count;
 	int    *vm_pfn_pcount;
 	vm_object_t vm_obj;
 	vm_map_t vm_cached_map;
 	TAILQ_ENTRY(vm_area_struct) vm_entry;
 };
 
 struct vm_fault {
 	unsigned int flags;
 	pgoff_t	pgoff;
 	union {
 		/* user-space address */
 		void *virtual_address;	/* < 4.11 */
 		unsigned long address;	/* >= 4.11 */
 	};
 	struct page *page;
 	struct vm_area_struct *vma;
 };
 
 struct vm_operations_struct {
 	void    (*open) (struct vm_area_struct *);
 	void    (*close) (struct vm_area_struct *);
 	int     (*fault) (struct vm_area_struct *, struct vm_fault *);
 	int	(*access) (struct vm_area_struct *, unsigned long, void *, int, int);
 };
 
 struct sysinfo {
 	uint64_t totalram;
 	uint64_t totalhigh;
 	uint32_t mem_unit;
 };
 
 /*
  * Compute log2 of the power of two rounded up count of pages
  * needed for size bytes.
  */
 static inline int
 get_order(unsigned long size)
 {
 	int order;
 
 	size = (size - 1) >> PAGE_SHIFT;
 	order = 0;
 	while (size) {
 		order++;
 		size >>= 1;
 	}
 	return (order);
 }
 
 static inline void *
 lowmem_page_address(struct page *page)
 {
 	return (page_address(page));
 }
 
 /*
  * This only works via memory map operations.
  */
 static inline int
 io_remap_pfn_range(struct vm_area_struct *vma,
     unsigned long addr, unsigned long pfn, unsigned long size,
     vm_memattr_t prot)
 {
 	vma->vm_page_prot = prot;
 	vma->vm_pfn = pfn;
 	vma->vm_len = size;
 
 	return (0);
 }
 
+vm_fault_t
+lkpi_vmf_insert_pfn_prot_locked(struct vm_area_struct *vma, unsigned long addr,
+    unsigned long pfn, pgprot_t prot);
+
+static inline vm_fault_t
+vmf_insert_pfn_prot(struct vm_area_struct *vma, unsigned long addr,
+    unsigned long pfn, pgprot_t prot)
+{
+	vm_fault_t ret;
+
+	VM_OBJECT_WLOCK(vma->vm_obj);
+	ret = lkpi_vmf_insert_pfn_prot_locked(vma, addr, pfn, prot);
+	VM_OBJECT_WUNLOCK(vma->vm_obj);
+
+	return (ret);
+}
+#define	vmf_insert_pfn_prot(...)	\
+	_Static_assert(false,		\
+"This function is always called in a loop. Consider using the locked version")
+
 static inline int
 apply_to_page_range(struct mm_struct *mm, unsigned long address,
     unsigned long size, pte_fn_t fn, void *data)
 {
 	return (-ENOTSUP);
 }
 
 int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
     unsigned long size);
 
 static inline int
 remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
     unsigned long pfn, unsigned long size, pgprot_t prot)
 {
 	return (-ENOTSUP);
 }
 
 static inline unsigned long
 vma_pages(struct vm_area_struct *vma)
 {
 	return ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT);
 }
 
 #define	offset_in_page(off)	((off) & (PAGE_SIZE - 1))
 
 static inline void
 set_page_dirty(struct vm_page *page)
 {
 	vm_page_dirty(page);
 }
 
 static inline void
 mark_page_accessed(struct vm_page *page)
 {
 	vm_page_reference(page);
 }
 
 static inline void
 get_page(struct vm_page *page)
 {
 	vm_page_wire(page);
 }
 
 extern long
 get_user_pages(unsigned long start, unsigned long nr_pages,
     int gup_flags, struct page **,
     struct vm_area_struct **);
 
 extern int
 __get_user_pages_fast(unsigned long start, int nr_pages, int write,
     struct page **);
 
 extern long
 get_user_pages_remote(struct task_struct *, struct mm_struct *,
     unsigned long start, unsigned long nr_pages,
     int gup_flags, struct page **,
     struct vm_area_struct **);
 
 static inline void
 put_page(struct vm_page *page)
 {
 	vm_page_unwire(page, PQ_ACTIVE);
 }
 
 #define	copy_highpage(to, from) pmap_copy_page(from, to)
 
 static inline pgprot_t
 vm_get_page_prot(unsigned long vm_flags)
 {
 	return (vm_flags & VM_PROT_ALL);
 }
 
 static inline vm_page_t
 vmalloc_to_page(const void *addr)
 {
 	vm_paddr_t paddr;
 
 	paddr = pmap_kextract((vm_offset_t)addr);
 	return (PHYS_TO_VM_PAGE(paddr));
 }
 
 extern int is_vmalloc_addr(const void *addr);
 void si_meminfo(struct sysinfo *si);
 
 #endif					/* _LINUX_MM_H_ */
diff --git a/sys/compat/linuxkpi/common/src/linux_page.c b/sys/compat/linuxkpi/common/src/linux_page.c
index ee41366c53a6..cbe6d2530b91 100644
--- a/sys/compat/linuxkpi/common/src/linux_page.c
+++ b/sys/compat/linuxkpi/common/src/linux_page.c
@@ -1,277 +1,309 @@
 /*-
  * Copyright (c) 2010 Isilon Systems, Inc.
  * Copyright (c) 2016 Matthew Macy (mmacy@mattmacy.io)
  * Copyright (c) 2017 Mellanox Technologies, Ltd.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice unmodified, this list of conditions, and the following
  *    disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/rwlock.h>
 #include <sys/proc.h>
 #include <sys/sched.h>
 
 #include <machine/bus.h>
 
 #include <vm/vm.h>
 #include <vm/pmap.h>
 #include <vm/vm_param.h>
 #include <vm/vm_kern.h>
 #include <vm/vm_object.h>
 #include <vm/vm_map.h>
 #include <vm/vm_page.h>
 #include <vm/vm_pageout.h>
 #include <vm/vm_pager.h>
 #include <vm/vm_radix.h>
 #include <vm/vm_reserv.h>
 #include <vm/vm_extern.h>
 
 #include <vm/uma.h>
 #include <vm/uma_int.h>
 
 #include <linux/gfp.h>
 #include <linux/mm.h>
 #include <linux/preempt.h>
 #include <linux/fs.h>
 #include <linux/shmem_fs.h>
 
 void
 si_meminfo(struct sysinfo *si)
 {
 	si->totalram = physmem;
 	si->totalhigh = 0;
 	si->mem_unit = PAGE_SIZE;
 }
 
 void *
 linux_page_address(struct page *page)
 {
 
 	if (page->object != kernel_object) {
 		return (PMAP_HAS_DMAP ?
 		    ((void *)(uintptr_t)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(page))) :
 		    NULL);
 	}
 	return ((void *)(uintptr_t)(VM_MIN_KERNEL_ADDRESS +
 	    IDX_TO_OFF(page->pindex)));
 }
 
 vm_page_t
 linux_alloc_pages(gfp_t flags, unsigned int order)
 {
 	vm_page_t page;
 
 	if (PMAP_HAS_DMAP) {
 		unsigned long npages = 1UL << order;
 		int req = VM_ALLOC_NOOBJ | VM_ALLOC_WIRED | VM_ALLOC_NORMAL;
 
 		if ((flags & M_ZERO) != 0)
 			req |= VM_ALLOC_ZERO;
 		if (order == 0 && (flags & GFP_DMA32) == 0) {
 			page = vm_page_alloc(NULL, 0, req);
 			if (page == NULL)
 				return (NULL);
 		} else {
 			vm_paddr_t pmax = (flags & GFP_DMA32) ?
 			    BUS_SPACE_MAXADDR_32BIT : BUS_SPACE_MAXADDR;
 		retry:
 			page = vm_page_alloc_contig(NULL, 0, req,
 			    npages, 0, pmax, PAGE_SIZE, 0, VM_MEMATTR_DEFAULT);
 
 			if (page == NULL) {
 				if (flags & M_WAITOK) {
 					if (!vm_page_reclaim_contig(req,
 					    npages, 0, pmax, PAGE_SIZE, 0)) {
 						vm_wait(NULL);
 					}
 					flags &= ~M_WAITOK;
 					goto retry;
 				}
 				return (NULL);
 			}
 		}
 		if (flags & M_ZERO) {
 			unsigned long x;
 
 			for (x = 0; x != npages; x++) {
 				vm_page_t pgo = page + x;
 
 				if ((pgo->flags & PG_ZERO) == 0)
 					pmap_zero_page(pgo);
 			}
 		}
 	} else {
 		vm_offset_t vaddr;
 
 		vaddr = linux_alloc_kmem(flags, order);
 		if (vaddr == 0)
 			return (NULL);
 
 		page = PHYS_TO_VM_PAGE(vtophys((void *)vaddr));
 
 		KASSERT(vaddr == (vm_offset_t)page_address(page),
 		    ("Page address mismatch"));
 	}
 
 	return (page);
 }
 
 void
 linux_free_pages(vm_page_t page, unsigned int order)
 {
 	if (PMAP_HAS_DMAP) {
 		unsigned long npages = 1UL << order;
 		unsigned long x;
 
 		for (x = 0; x != npages; x++) {
 			vm_page_t pgo = page + x;
 
 			if (vm_page_unwire_noq(pgo))
 				vm_page_free(pgo);
 		}
 	} else {
 		vm_offset_t vaddr;
 
 		vaddr = (vm_offset_t)page_address(page);
 
 		linux_free_kmem(vaddr, order);
 	}
 }
 
 vm_offset_t
 linux_alloc_kmem(gfp_t flags, unsigned int order)
 {
 	size_t size = ((size_t)PAGE_SIZE) << order;
 	vm_offset_t addr;
 
 	if ((flags & GFP_DMA32) == 0) {
 		addr = kmem_malloc(size, flags & GFP_NATIVE_MASK);
 	} else {
 		addr = kmem_alloc_contig(size, flags & GFP_NATIVE_MASK, 0,
 		    BUS_SPACE_MAXADDR_32BIT, PAGE_SIZE, 0, VM_MEMATTR_DEFAULT);
 	}
 	return (addr);
 }
 
 void
 linux_free_kmem(vm_offset_t addr, unsigned int order)
 {
 	size_t size = ((size_t)PAGE_SIZE) << order;
 
 	kmem_free(addr, size);
 }
 
 static int
 linux_get_user_pages_internal(vm_map_t map, unsigned long start, int nr_pages,
     int write, struct page **pages)
 {
 	vm_prot_t prot;
 	size_t len;
 	int count;
 
 	prot = write ? (VM_PROT_READ | VM_PROT_WRITE) : VM_PROT_READ;
 	len = ptoa((vm_offset_t)nr_pages);
 	count = vm_fault_quick_hold_pages(map, start, len, prot, pages, nr_pages);
 	return (count == -1 ? -EFAULT : nr_pages);
 }
 
 int
 __get_user_pages_fast(unsigned long start, int nr_pages, int write,
     struct page **pages)
 {
 	vm_map_t map;
 	vm_page_t *mp;
 	vm_offset_t va;
 	vm_offset_t end;
 	vm_prot_t prot;
 	int count;
 
 	if (nr_pages == 0 || in_interrupt())
 		return (0);
 
 	MPASS(pages != NULL);
 	map = &curthread->td_proc->p_vmspace->vm_map;
 	end = start + ptoa((vm_offset_t)nr_pages);
 	if (!vm_map_range_valid(map, start, end))
 		return (-EINVAL);
 	prot = write ? (VM_PROT_READ | VM_PROT_WRITE) : VM_PROT_READ;
 	for (count = 0, mp = pages, va = start; va < end;
 	    mp++, va += PAGE_SIZE, count++) {
 		*mp = pmap_extract_and_hold(map->pmap, va, prot);
 		if (*mp == NULL)
 			break;
 
 		if ((prot & VM_PROT_WRITE) != 0 &&
 		    (*mp)->dirty != VM_PAGE_BITS_ALL) {
 			/*
 			 * Explicitly dirty the physical page.  Otherwise, the
 			 * caller's changes may go unnoticed because they are
 			 * performed through an unmanaged mapping or by a DMA
 			 * operation.
 			 *
 			 * The object lock is not held here.
 			 * See vm_page_clear_dirty_mask().
 			 */
 			vm_page_dirty(*mp);
 		}
 	}
 	return (count);
 }
 
 long
 get_user_pages_remote(struct task_struct *task, struct mm_struct *mm,
     unsigned long start, unsigned long nr_pages, int gup_flags,
     struct page **pages, struct vm_area_struct **vmas)
 {
 	vm_map_t map;
 
 	map = &task->task_thread->td_proc->p_vmspace->vm_map;
 	return (linux_get_user_pages_internal(map, start, nr_pages,
 	    !!(gup_flags & FOLL_WRITE), pages));
 }
 
 long
 get_user_pages(unsigned long start, unsigned long nr_pages, int gup_flags,
     struct page **pages, struct vm_area_struct **vmas)
 {
 	vm_map_t map;
 
 	map = &curthread->td_proc->p_vmspace->vm_map;
 	return (linux_get_user_pages_internal(map, start, nr_pages,
 	    !!(gup_flags & FOLL_WRITE), pages));
 }
 
 int
 is_vmalloc_addr(const void *addr)
 {
 	return (vtoslab((vm_offset_t)addr & ~UMA_SLAB_MASK) != NULL);
 }
+
+vm_fault_t
+lkpi_vmf_insert_pfn_prot_locked(struct vm_area_struct *vma, unsigned long addr,
+    unsigned long pfn, pgprot_t prot)
+{
+	vm_object_t vm_obj = vma->vm_obj;
+	vm_page_t page;
+	vm_pindex_t pindex;
+
+	VM_OBJECT_ASSERT_WLOCKED(vm_obj);
+	pindex = OFF_TO_IDX(addr - vma->vm_start);
+	if (vma->vm_pfn_count == 0)
+		vma->vm_pfn_first = pindex;
+	MPASS(pindex <= OFF_TO_IDX(vma->vm_end));
+
+retry:
+	page = vm_page_grab(vm_obj, pindex, VM_ALLOC_NOCREAT);
+	if (page == NULL) {
+		page = PHYS_TO_VM_PAGE(IDX_TO_OFF(pfn));
+		if (!vm_page_busy_acquire(page, VM_ALLOC_WAITFAIL))
+			goto retry;
+		if (vm_page_insert(page, vm_obj, pindex)) {
+			vm_page_xunbusy(page);
+			return (VM_FAULT_OOM);
+		}
+		vm_page_valid(page);
+	}
+	pmap_page_set_memattr(page, pgprot2cachemode(prot));
+	vma->vm_pfn_count++;
+
+	return (VM_FAULT_NOPAGE);
+}