10 files changed, 705 insertions, 278 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index 35e12d186566..20e5642e9f9f 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -151,6 +151,7 @@ void remove_from_page_cache(struct page *page)
         spin_unlock_irq(&mapping->tree_lock);
         mem_cgroup_uncharge_cache_page(page);
 }
+EXPORT_SYMBOL(remove_from_page_cache);
 
 static int sync_page(void *word)
 {
@@ -1275,7 +1276,7 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
 {
         struct file *filp = iocb->ki_filp;
         ssize_t retval;
-        unsigned long seg;
+        unsigned long seg = 0;
         size_t count;
         loff_t *ppos = &iocb->ki_pos;
 
@@ -1302,21 +1303,47 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                                 retval = mapping->a_ops->direct_IO(READ, iocb,
                                                         iov, pos, nr_segs);
                         }
-                        if (retval > 0)
+                        if (retval > 0) {
                                 *ppos = pos + retval;
-                        if (retval) {
+                                count -= retval;
+                        }
+
+                        /*
+                         * Btrfs can have a short DIO read if we encounter
+                         * compressed extents, so if there was an error, or if
+                         * we've already read everything we wanted to, or if
+                         * there was a short read because we hit EOF, go ahead
+                         * and return.  Otherwise fallthrough to buffered io for
+                         * the rest of the read.
+                         */
+                        if (retval < 0 || !count || *ppos >= size) {
                                 file_accessed(filp);
                                 goto out;
                         }
                 }
         }
 
+        count = retval;
         for (seg = 0; seg < nr_segs; seg++) {
                 read_descriptor_t desc;
+                loff_t offset = 0;
+
+                /*
+                 * If we did a short DIO read we need to skip the section of the
+                 * iov that we've already read data into.
+                 */
+                if (count) {
+                        if (count > iov[seg].iov_len) {
+                                count -= iov[seg].iov_len;
+                                continue;
+                        }
+                        offset = count;
+                        count = 0;
+                }
 
                 desc.written = 0;
-                desc.arg.buf = iov[seg].iov_base;
-                desc.count = iov[seg].iov_len;
+                desc.arg.buf = iov[seg].iov_base + offset;
+                desc.count = iov[seg].iov_len - offset;
                 if (desc.count == 0)
                         continue;
                 desc.error = 0;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c8569bc298ff..c6ece0a57595 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -149,16 +149,35 @@ struct mem_cgroup_threshold {
         u64 threshold;
 };
 
+/* For threshold */
 struct mem_cgroup_threshold_ary {
         /* An array index points to threshold just below usage. */
-        atomic_t current_threshold;
+        int current_threshold;
         /* Size of entries[] */
         unsigned int size;
         /* Array of thresholds */
         struct mem_cgroup_threshold entries[0];
 };
 
+struct mem_cgroup_thresholds {
+        /* Primary thresholds array */
+        struct mem_cgroup_threshold_ary *primary;
+        /*
+         * Spare threshold array.
+         * This is needed to make mem_cgroup_unregister_event() "never fail".
+         * It must be able to store at least primary->size - 1 entries.
+         */
+        struct mem_cgroup_threshold_ary *spare;
+};
+
+/* for OOM */
+struct mem_cgroup_eventfd_list {
+        struct list_head list;
+        struct eventfd_ctx *eventfd;
+};
+
 static void mem_cgroup_threshold(struct mem_cgroup *mem);
+static void mem_cgroup_oom_notify(struct mem_cgroup *mem);
 
 /*
  * The memory controller data structure. The memory controller controls both
@@ -207,6 +226,8 @@ struct mem_cgroup {
         atomic_t        refcnt;
 
         unsigned int    swappiness;
+        /* OOM-Killer disable */
+        int             oom_kill_disable;
 
         /* set when res.limit == memsw.limit */
         bool            memsw_is_minimum;
@@ -215,17 +236,19 @@ struct mem_cgroup {
         struct mutex thresholds_lock;
 
         /* thresholds for memory usage. RCU-protected */
-        struct mem_cgroup_threshold_ary *thresholds;
+        struct mem_cgroup_thresholds thresholds;
 
         /* thresholds for mem+swap usage. RCU-protected */
-        struct mem_cgroup_threshold_ary *memsw_thresholds;
+        struct mem_cgroup_thresholds memsw_thresholds;
+
+        /* For oom notifier event fd */
+        struct list_head oom_notify;
 
         /*
          * Should we move charges of a task when a task is moved into this
          * mem_cgroup ? And what type of charges should we move ?
          */
         unsigned long   move_charge_at_immigrate;
-
         /*
          * percpu counter.
          */
@@ -239,6 +262,7 @@ struct mem_cgroup {
  */
 enum move_type {
         MOVE_CHARGE_TYPE_ANON,  /* private anonymous page and swap of it */
+        MOVE_CHARGE_TYPE_FILE,  /* file page(including tmpfs) and swap of it */
         NR_MOVE_TYPE,
 };
 
@@ -255,6 +279,18 @@ static struct move_charge_struct {
         .waitq = __WAIT_QUEUE_HEAD_INITIALIZER(mc.waitq),
 };
 
+static bool move_anon(void)
+{
+        return test_bit(MOVE_CHARGE_TYPE_ANON,
+                                        &mc.to->move_charge_at_immigrate);
+}
+
+static bool move_file(void)
+{
+        return test_bit(MOVE_CHARGE_TYPE_FILE,
+                                        &mc.to->move_charge_at_immigrate);
+}
+
 /*
  * Maximum loops in mem_cgroup_hierarchical_reclaim(), used for soft
  * limit reclaim to prevent infinite loops, if they ever occur.
@@ -282,9 +318,12 @@ enum charge_type {
 /* for encoding cft->private value on file */
 #define _MEM                    (0)
 #define _MEMSWAP                (1)
+#define _OOM_TYPE               (2)
 #define MEMFILE_PRIVATE(x, val) (((x) << 16) | (val))
 #define MEMFILE_TYPE(val)       (((val) >> 16) & 0xffff)
 #define MEMFILE_ATTR(val)       ((val) & 0xffff)
+/* Used for OOM nofiier */
+#define OOM_CONTROL             (0)
 
 /*
  * Reclaim flags for mem_cgroup_hierarchical_reclaim
@@ -1293,14 +1332,62 @@ static void mem_cgroup_oom_unlock(struct mem_cgroup *mem)
 static DEFINE_MUTEX(memcg_oom_mutex);
 static DECLARE_WAIT_QUEUE_HEAD(memcg_oom_waitq);
 
+struct oom_wait_info {
+        struct mem_cgroup *mem;
+        wait_queue_t    wait;
+};
+
+static int memcg_oom_wake_function(wait_queue_t *wait,
+        unsigned mode, int sync, void *arg)
+{
+        struct mem_cgroup *wake_mem = (struct mem_cgroup *)arg;
+        struct oom_wait_info *oom_wait_info;
+
+        oom_wait_info = container_of(wait, struct oom_wait_info, wait);
+
+        if (oom_wait_info->mem == wake_mem)
+                goto wakeup;
+        /* if no hierarchy, no match */
+        if (!oom_wait_info->mem->use_hierarchy || !wake_mem->use_hierarchy)
+                return 0;
+        /*
+         * Both of oom_wait_info->mem and wake_mem are stable under us.
+         * Then we can use css_is_ancestor without taking care of RCU.
+         */
+        if (!css_is_ancestor(&oom_wait_info->mem->css, &wake_mem->css) &&
+            !css_is_ancestor(&wake_mem->css, &oom_wait_info->mem->css))
+                return 0;
+
+wakeup:
+        return autoremove_wake_function(wait, mode, sync, arg);
+}
+
+static void memcg_wakeup_oom(struct mem_cgroup *mem)
+{
+        /* for filtering, pass "mem" as argument. */
+        __wake_up(&memcg_oom_waitq, TASK_NORMAL, 0, mem);
+}
+
+static void memcg_oom_recover(struct mem_cgroup *mem)
+{
+        if (mem->oom_kill_disable && atomic_read(&mem->oom_lock))
+                memcg_wakeup_oom(mem);
+}
+
 /*
  * try to call OOM killer. returns false if we should exit memory-reclaim loop.
  */
 bool mem_cgroup_handle_oom(struct mem_cgroup *mem, gfp_t mask)
 {
-        DEFINE_WAIT(wait);
-        bool locked;
+        struct oom_wait_info owait;
+        bool locked, need_to_kill;
 
+        owait.mem = mem;
+        owait.wait.flags = 0;
+        owait.wait.func = memcg_oom_wake_function;
+        owait.wait.private = current;
+        INIT_LIST_HEAD(&owait.wait.task_list);
+        need_to_kill = true;
         /* At first, try to OOM lock hierarchy under mem.*/
         mutex_lock(&memcg_oom_mutex);
         locked = mem_cgroup_oom_lock(mem);
@@ -1309,32 +1396,23 @@ bool mem_cgroup_handle_oom(struct mem_cgroup *mem, gfp_t mask)
          * accounting. So, UNINTERRUPTIBLE is appropriate. But SIGKILL
          * under OOM is always welcomed, use TASK_KILLABLE here.
          */
-        if (!locked)
-                prepare_to_wait(&memcg_oom_waitq, &wait, TASK_KILLABLE);
+        prepare_to_wait(&memcg_oom_waitq, &owait.wait, TASK_KILLABLE);
+        if (!locked || mem->oom_kill_disable)
+                need_to_kill = false;
+        if (locked)
+                mem_cgroup_oom_notify(mem);
         mutex_unlock(&memcg_oom_mutex);
 
-        if (locked)
+        if (need_to_kill) {
+                finish_wait(&memcg_oom_waitq, &owait.wait);
                 mem_cgroup_out_of_memory(mem, mask);
-        else {
+        } else {
                 schedule();
-                finish_wait(&memcg_oom_waitq, &wait);
+                finish_wait(&memcg_oom_waitq, &owait.wait);
         }
         mutex_lock(&memcg_oom_mutex);
         mem_cgroup_oom_unlock(mem);
-        /*
-         * Here, we use global waitq .....more fine grained waitq ?
-         * Assume following hierarchy.
-         * A/
-         *   01
-         *   02
-         * assume OOM happens both in A and 01 at the same time. Tthey are
-         * mutually exclusive by lock. (kill in 01 helps A.)
-         * When we use per memcg waitq, we have to wake up waiters on A and 02
-         * in addtion to waiters on 01. We use global waitq for avoiding mess.
-         * It will not be a big problem.
-         * (And a task may be moved to other groups while it's waiting for OOM.)
-         */
-        wake_up_all(&memcg_oom_waitq);
+        memcg_wakeup_oom(mem);
         mutex_unlock(&memcg_oom_mutex);
 
         if (test_thread_flag(TIF_MEMDIE) || fatal_signal_pending(current))
@@ -2118,15 +2196,6 @@ __do_uncharge(struct mem_cgroup *mem, const enum charge_type ctype)
         /* If swapout, usage of swap doesn't decrease */
         if (!do_swap_account || ctype == MEM_CGROUP_CHARGE_TYPE_SWAPOUT)
                 uncharge_memsw = false;
-        /*
-         * do_batch > 0 when unmapping pages or inode invalidate/truncate.
-         * In those cases, all pages freed continously can be expected to be in
-         * the same cgroup and we have chance to coalesce uncharges.
-         * But we do uncharge one by one if this is killed by OOM(TIF_MEMDIE)
-         * because we want to do uncharge as soon as possible.
-         */
-        if (!current->memcg_batch.do_batch || test_thread_flag(TIF_MEMDIE))
-                goto direct_uncharge;
 
         batch = &current->memcg_batch;
         /*
@@ -2137,6 +2206,17 @@ __do_uncharge(struct mem_cgroup *mem, const enum charge_type ctype)
         if (!batch->memcg)
                 batch->memcg = mem;
         /*
+         * do_batch > 0 when unmapping pages or inode invalidate/truncate.
+         * In those cases, all pages freed continously can be expected to be in
+         * the same cgroup and we have chance to coalesce uncharges.
+         * But we do uncharge one by one if this is killed by OOM(TIF_MEMDIE)
+         * because we want to do uncharge as soon as possible.
+         */
+
+        if (!batch->do_batch || test_thread_flag(TIF_MEMDIE))
+                goto direct_uncharge;
+
+        /*
          * In typical case, batch->memcg == mem. This means we can
          * merge a series of uncharges to an uncharge of res_counter.
          * If not, we uncharge res_counter ony by one.
@@ -2152,6 +2232,8 @@ direct_uncharge:
         res_counter_uncharge(&mem->res, PAGE_SIZE);
         if (uncharge_memsw)
                 res_counter_uncharge(&mem->memsw, PAGE_SIZE);
+        if (unlikely(batch->memcg != mem))
+                memcg_oom_recover(mem);
         return;
 }
 
@@ -2188,7 +2270,8 @@ __mem_cgroup_uncharge_common(struct page *page, enum charge_type ctype)
         switch (ctype) {
         case MEM_CGROUP_CHARGE_TYPE_MAPPED:
         case MEM_CGROUP_CHARGE_TYPE_DROP:
-                if (page_mapped(page))
+                /* See mem_cgroup_prepare_migration() */
+                if (page_mapped(page) || PageCgroupMigration(pc))
                         goto unlock_out;
                 break;
         case MEM_CGROUP_CHARGE_TYPE_SWAPOUT:
@@ -2288,6 +2371,7 @@ void mem_cgroup_uncharge_end(void)
                 res_counter_uncharge(&batch->memcg->res, batch->bytes);
         if (batch->memsw_bytes)
                 res_counter_uncharge(&batch->memcg->memsw, batch->memsw_bytes);
+        memcg_oom_recover(batch->memcg);
         /* forget this pointer (for sanity check) */
         batch->memcg = NULL;
 }
@@ -2410,10 +2494,12 @@ static inline int mem_cgroup_move_swap_account(swp_entry_t entry,
  * Before starting migration, account PAGE_SIZE to mem_cgroup that the old
  * page belongs to.
  */
-int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
+int mem_cgroup_prepare_migration(struct page *page,
+        struct page *newpage, struct mem_cgroup **ptr)
 {
         struct page_cgroup *pc;
         struct mem_cgroup *mem = NULL;
+        enum charge_type ctype;
         int ret = 0;
 
         if (mem_cgroup_disabled())
@@ -2424,69 +2510,125 @@ int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
         if (PageCgroupUsed(pc)) {
                 mem = pc->mem_cgroup;
                 css_get(&mem->css);
+                /*
+                 * At migrating an anonymous page, its mapcount goes down
+                 * to 0 and uncharge() will be called. But, even if it's fully
+                 * unmapped, migration may fail and this page has to be
+                 * charged again. We set MIGRATION flag here and delay uncharge
+                 * until end_migration() is called
+                 *
+                 * Corner Case Thinking
+                 * A)
+                 * When the old page was mapped as Anon and it's unmap-and-freed
+                 * while migration was ongoing.
+                 * If unmap finds the old page, uncharge() of it will be delayed
+                 * until end_migration(). If unmap finds a new page, it's
+                 * uncharged when it make mapcount to be 1->0. If unmap code
+                 * finds swap_migration_entry, the new page will not be mapped
+                 * and end_migration() will find it(mapcount==0).
+                 *
+                 * B)
+                 * When the old page was mapped but migraion fails, the kernel
+                 * remaps it. A charge for it is kept by MIGRATION flag even
+                 * if mapcount goes down to 0. We can do remap successfully
+                 * without charging it again.
+                 *
+                 * C)
+                 * The "old" page is under lock_page() until the end of
+                 * migration, so, the old page itself will not be swapped-out.
+                 * If the new page is swapped out before end_migraton, our
+                 * hook to usual swap-out path will catch the event.
+                 */
+                if (PageAnon(page))
+                        SetPageCgroupMigration(pc);
         }
         unlock_page_cgroup(pc);
+        /*
+         * If the page is not charged at this point,
+         * we return here.
+         */
+        if (!mem)
+                return 0;
 
         *ptr = mem;
-        if (mem) {
-                ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false);
-                css_put(&mem->css);
+        ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false);
+        css_put(&mem->css);/* drop extra refcnt */
+        if (ret || *ptr == NULL) {
+                if (PageAnon(page)) {
+                        lock_page_cgroup(pc);
+                        ClearPageCgroupMigration(pc);
+                        unlock_page_cgroup(pc);
+                        /*
+                         * The old page may be fully unmapped while we kept it.
+                         */
+                        mem_cgroup_uncharge_page(page);
+                }
+                return -ENOMEM;
         }
+        /*
+         * We charge new page before it's used/mapped. So, even if unlock_page()
+         * is called before end_migration, we can catch all events on this new
+         * page. In the case new page is migrated but not remapped, new page's
+         * mapcount will be finally 0 and we call uncharge in end_migration().
+         */
+        pc = lookup_page_cgroup(newpage);
+        if (PageAnon(page))
+                ctype = MEM_CGROUP_CHARGE_TYPE_MAPPED;
+        else if (page_is_file_cache(page))
+                ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
+        else
+                ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
+        __mem_cgroup_commit_charge(mem, pc, ctype);
         return ret;
 }
 
 /* remove redundant charge if migration failed*/
 void mem_cgroup_end_migration(struct mem_cgroup *mem,
-                struct page *oldpage, struct page *newpage)
+        struct page *oldpage, struct page *newpage)
 {
-        struct page *target, *unused;
+        struct page *used, *unused;
         struct page_cgroup *pc;
-        enum charge_type ctype;
 
         if (!mem)
                 return;
+        /* blocks rmdir() */
         cgroup_exclude_rmdir(&mem->css);
         /* at migration success, oldpage->mapping is NULL. */
         if (oldpage->mapping) {
-                target = oldpage;
-                unused = NULL;
+                used = oldpage;
+                unused = newpage;
         } else {
-                target = newpage;
+                used = newpage;
                 unused = oldpage;
         }
-
-        if (PageAnon(target))
-                ctype = MEM_CGROUP_CHARGE_TYPE_MAPPED;
-        else if (page_is_file_cache(target))
-                ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
-        else
-                ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-
-        /* unused page is not on radix-tree now. */
-        if (unused)
-                __mem_cgroup_uncharge_common(unused, ctype);
-
-        pc = lookup_page_cgroup(target);
         /*
-         * __mem_cgroup_commit_charge() check PCG_USED bit of page_cgroup.
-         * So, double-counting is effectively avoided.
+         * We disallowed uncharge of pages under migration because mapcount
+         * of the page goes down to zero, temporarly.
+         * Clear the flag and check the page should be charged.
          */
-        __mem_cgroup_commit_charge(mem, pc, ctype);
+        pc = lookup_page_cgroup(oldpage);
+        lock_page_cgroup(pc);
+        ClearPageCgroupMigration(pc);
+        unlock_page_cgroup(pc);
+
+        if (unused != oldpage)
+                pc = lookup_page_cgroup(unused);
+        __mem_cgroup_uncharge_common(unused, MEM_CGROUP_CHARGE_TYPE_FORCE);
 
+        pc = lookup_page_cgroup(used);
         /*
-         * Both of oldpage and newpage are still under lock_page().
-         * Then, we don't have to care about race in radix-tree.
-         * But we have to be careful that this page is unmapped or not.
-         *
-         * There is a case for !page_mapped(). At the start of
-         * migration, oldpage was mapped. But now, it's zapped.
-         * But we know *target* page is not freed/reused under us.
-         * mem_cgroup_uncharge_page() does all necessary checks.
+         * If a page is a file cache, radix-tree replacement is very atomic
+         * and we can skip this check. When it was an Anon page, its mapcount
+         * goes down to 0. But because we added MIGRATION flage, it's not
+         * uncharged yet. There are several case but page->mapcount check
+         * and USED bit check in mem_cgroup_uncharge_page() will do enough
+         * check. (see prepare_charge() also)
          */
-        if (ctype == MEM_CGROUP_CHARGE_TYPE_MAPPED)
-                mem_cgroup_uncharge_page(target);
+        if (PageAnon(used))
+                mem_cgroup_uncharge_page(used);
         /*
-         * At migration, we may charge account against cgroup which has no tasks
+         * At migration, we may charge account against cgroup which has no
+         * tasks.
          * So, rmdir()->pre_destroy() can be called while we do this charge.
          * In that case, we need to call pre_destroy() again. check it here.
          */
@@ -2524,10 +2666,11 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                                 unsigned long long val)
 {
         int retry_count;
-        u64 memswlimit;
+        u64 memswlimit, memlimit;
         int ret = 0;
         int children = mem_cgroup_count_children(memcg);
         u64 curusage, oldusage;
+        int enlarge;
 
         /*
          * For keeping hierarchical_reclaim simple, how long we should retry
@@ -2538,6 +2681,7 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
 
         oldusage = res_counter_read_u64(&memcg->res, RES_USAGE);
 
+        enlarge = 0;
         while (retry_count) {
                 if (signal_pending(current)) {
                         ret = -EINTR;
@@ -2555,6 +2699,11 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                         mutex_unlock(&set_limit_mutex);
                         break;
                 }
+
+                memlimit = res_counter_read_u64(&memcg->res, RES_LIMIT);
+                if (memlimit < val)
+                        enlarge = 1;
+
                 ret = res_counter_set_limit(&memcg->res, val);
                 if (!ret) {
                         if (memswlimit == val)
@@ -2576,6 +2725,8 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                 else
                         oldusage = curusage;
         }
+        if (!ret && enlarge)
+                memcg_oom_recover(memcg);
 
         return ret;
 }
@@ -2584,9 +2735,10 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                                         unsigned long long val)
 {
         int retry_count;
-        u64 memlimit, oldusage, curusage;
+        u64 memlimit, memswlimit, oldusage, curusage;
         int children = mem_cgroup_count_children(memcg);
         int ret = -EBUSY;
+        int enlarge = 0;
 
         /* see mem_cgroup_resize_res_limit */
         retry_count = children * MEM_CGROUP_RECLAIM_RETRIES;
@@ -2608,6 +2760,9 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                         mutex_unlock(&set_limit_mutex);
                         break;
                 }
+                memswlimit = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
+                if (memswlimit < val)
+                        enlarge = 1;
                 ret = res_counter_set_limit(&memcg->memsw, val);
                 if (!ret) {
                         if (memlimit == val)
@@ -2630,6 +2785,8 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                 else
                         oldusage = curusage;
         }
+        if (!ret && enlarge)
+                memcg_oom_recover(memcg);
         return ret;
 }
 
@@ -2821,6 +2978,7 @@ move_account:
                         if (ret)
                                 break;
                 }
+                memcg_oom_recover(mem);
                 /* it seems parent cgroup doesn't have enough mem */
                 if (ret == -ENOMEM)
                         goto try_to_free;
@@ -3311,9 +3469,9 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
 
         rcu_read_lock();
         if (!swap)
-                t = rcu_dereference(memcg->thresholds);
+                t = rcu_dereference(memcg->thresholds.primary);
         else
-                t = rcu_dereference(memcg->memsw_thresholds);
+                t = rcu_dereference(memcg->memsw_thresholds.primary);
 
         if (!t)
                 goto unlock;
@@ -3325,7 +3483,7 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
          * If it's not true, a threshold was crossed after last
          * call of __mem_cgroup_threshold().
          */
-        i = atomic_read(&t->current_threshold);
+        i = t->current_threshold;
 
         /*
          * Iterate backward over array of thresholds starting from
@@ -3349,7 +3507,7 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
                 eventfd_signal(t->entries[i].eventfd, 1);
 
         /* Update current_threshold */
-        atomic_set(&t->current_threshold, i - 1);
+        t->current_threshold = i - 1;
 unlock:
         rcu_read_unlock();
 }
@@ -3369,106 +3527,117 @@ static int compare_thresholds(const void *a, const void *b)
         return _a->threshold - _b->threshold;
 }
 
-static int mem_cgroup_register_event(struct cgroup *cgrp, struct cftype *cft,
-                struct eventfd_ctx *eventfd, const char *args)
+static int mem_cgroup_oom_notify_cb(struct mem_cgroup *mem, void *data)
+{
+        struct mem_cgroup_eventfd_list *ev;
+
+        list_for_each_entry(ev, &mem->oom_notify, list)
+                eventfd_signal(ev->eventfd, 1);
+        return 0;
+}
+
+static void mem_cgroup_oom_notify(struct mem_cgroup *mem)
+{
+        mem_cgroup_walk_tree(mem, NULL, mem_cgroup_oom_notify_cb);
+}
+
+static int mem_cgroup_usage_register_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd, const char *args)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
-        struct mem_cgroup_threshold_ary *thresholds, *thresholds_new;
+        struct mem_cgroup_thresholds *thresholds;
+        struct mem_cgroup_threshold_ary *new;
         int type = MEMFILE_TYPE(cft->private);
         u64 threshold, usage;
-        int size;
-        int i, ret;
+        int i, size, ret;
 
         ret = res_counter_memparse_write_strategy(args, &threshold);
         if (ret)
                 return ret;
 
         mutex_lock(&memcg->thresholds_lock);
+
         if (type == _MEM)
-                thresholds = memcg->thresholds;
+                thresholds = &memcg->thresholds;
         else if (type == _MEMSWAP)
-                thresholds = memcg->memsw_thresholds;
+                thresholds = &memcg->memsw_thresholds;
         else
                 BUG();
 
         usage = mem_cgroup_usage(memcg, type == _MEMSWAP);
 
         /* Check if a threshold crossed before adding a new one */
-        if (thresholds)
+        if (thresholds->primary)
                 __mem_cgroup_threshold(memcg, type == _MEMSWAP);
 
-        if (thresholds)
-                size = thresholds->size + 1;
-        else
-                size = 1;
+        size = thresholds->primary ? thresholds->primary->size + 1 : 1;
 
         /* Allocate memory for new array of thresholds */
-        thresholds_new = kmalloc(sizeof(*thresholds_new) +
-                        size * sizeof(struct mem_cgroup_threshold),
+        new = kmalloc(sizeof(*new) + size * sizeof(struct mem_cgroup_threshold),
                         GFP_KERNEL);
-        if (!thresholds_new) {
+        if (!new) {
                 ret = -ENOMEM;
                 goto unlock;
         }
-        thresholds_new->size = size;
+        new->size = size;
 
         /* Copy thresholds (if any) to new array */
-        if (thresholds)
-                memcpy(thresholds_new->entries, thresholds->entries,
-                                thresholds->size *
+        if (thresholds->primary) {
+                memcpy(new->entries, thresholds->primary->entries, (size - 1) *
                                 sizeof(struct mem_cgroup_threshold));
+        }
+
         /* Add new threshold */
-        thresholds_new->entries[size - 1].eventfd = eventfd;
-        thresholds_new->entries[size - 1].threshold = threshold;
+        new->entries[size - 1].eventfd = eventfd;
+        new->entries[size - 1].threshold = threshold;
 
         /* Sort thresholds. Registering of new threshold isn't time-critical */
-        sort(thresholds_new->entries, size,
-                        sizeof(struct mem_cgroup_threshold),
+        sort(new->entries, size, sizeof(struct mem_cgroup_threshold),
                         compare_thresholds, NULL);
 
         /* Find current threshold */
-        atomic_set(&thresholds_new->current_threshold, -1);
+        new->current_threshold = -1;
         for (i = 0; i < size; i++) {
-                if (thresholds_new->entries[i].threshold < usage) {
+                if (new->entries[i].threshold < usage) {
                         /*
-                         * thresholds_new->current_threshold will not be used
-                         * until rcu_assign_pointer(), so it's safe to increment
+                         * new->current_threshold will not be used until
+                         * rcu_assign_pointer(), so it's safe to increment
                          * it here.
                          */
-                        atomic_inc(&thresholds_new->current_threshold);
+                        ++new->current_threshold;
                 }
         }
 
-        if (type == _MEM)
-                rcu_assign_pointer(memcg->thresholds, thresholds_new);
-        else
-                rcu_assign_pointer(memcg->memsw_thresholds, thresholds_new);
+        /* Free old spare buffer and save old primary buffer as spare */
+        kfree(thresholds->spare);
+        thresholds->spare = thresholds->primary;
+
+        rcu_assign_pointer(thresholds->primary, new);
 
-        /* To be sure that nobody uses thresholds before freeing it */
+        /* To be sure that nobody uses thresholds */
         synchronize_rcu();
 
-        kfree(thresholds);
 unlock:
         mutex_unlock(&memcg->thresholds_lock);
 
         return ret;
 }
 
-static int mem_cgroup_unregister_event(struct cgroup *cgrp, struct cftype *cft,
-                struct eventfd_ctx *eventfd)
+static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
-        struct mem_cgroup_threshold_ary *thresholds, *thresholds_new;
+        struct mem_cgroup_thresholds *thresholds;
+        struct mem_cgroup_threshold_ary *new;
         int type = MEMFILE_TYPE(cft->private);
         u64 usage;
-        int size = 0;
-        int i, j, ret;
+        int i, j, size;
 
         mutex_lock(&memcg->thresholds_lock);
         if (type == _MEM)
-                thresholds = memcg->thresholds;
+                thresholds = &memcg->thresholds;
         else if (type == _MEMSWAP)
-                thresholds = memcg->memsw_thresholds;
+                thresholds = &memcg->memsw_thresholds;
         else
                 BUG();
 
@@ -3484,59 +3653,136 @@ static int mem_cgroup_unregister_event(struct cgroup *cgrp, struct cftype *cft,
         __mem_cgroup_threshold(memcg, type == _MEMSWAP);
 
         /* Calculate new number of threshold */
-        for (i = 0; i < thresholds->size; i++) {
-                if (thresholds->entries[i].eventfd != eventfd)
+        size = 0;
+        for (i = 0; i < thresholds->primary->size; i++) {
+                if (thresholds->primary->entries[i].eventfd != eventfd)
                         size++;
         }
 
+        new = thresholds->spare;
+
         /* Set thresholds array to NULL if we don't have thresholds */
         if (!size) {
-                thresholds_new = NULL;
-                goto assign;
+                kfree(new);
+                new = NULL;
+                goto swap_buffers;
         }
 
-        /* Allocate memory for new array of thresholds */
-        thresholds_new = kmalloc(sizeof(*thresholds_new) +
-                        size * sizeof(struct mem_cgroup_threshold),
-                        GFP_KERNEL);
-        if (!thresholds_new) {
-                ret = -ENOMEM;
-                goto unlock;
-        }
-        thresholds_new->size = size;
+        new->size = size;
 
         /* Copy thresholds and find current threshold */
-        atomic_set(&thresholds_new->current_threshold, -1);
-        for (i = 0, j = 0; i < thresholds->size; i++) {
-                if (thresholds->entries[i].eventfd == eventfd)
+        new->current_threshold = -1;
+        for (i = 0, j = 0; i < thresholds->primary->size; i++) {
+                if (thresholds->primary->entries[i].eventfd == eventfd)
                         continue;
 
-                thresholds_new->entries[j] = thresholds->entries[i];
-                if (thresholds_new->entries[j].threshold < usage) {
+                new->entries[j] = thresholds->primary->entries[i];
+                if (new->entries[j].threshold < usage) {
                         /*
-                         * thresholds_new->current_threshold will not be used
+                         * new->current_threshold will not be used
                          * until rcu_assign_pointer(), so it's safe to increment
                          * it here.
                          */
-                        atomic_inc(&thresholds_new->current_threshold);
+                        ++new->current_threshold;
                 }
                 j++;
         }
 
-assign:
-        if (type == _MEM)
-                rcu_assign_pointer(memcg->thresholds, thresholds_new);
-        else
-                rcu_assign_pointer(memcg->memsw_thresholds, thresholds_new);
+swap_buffers:
+        /* Swap primary and spare array */
+        thresholds->spare = thresholds->primary;
+        rcu_assign_pointer(thresholds->primary, new);
 
-        /* To be sure that nobody uses thresholds before freeing it */
+        /* To be sure that nobody uses thresholds */
         synchronize_rcu();
 
-        kfree(thresholds);
-unlock:
         mutex_unlock(&memcg->thresholds_lock);
+}
 
-        return ret;
+static int mem_cgroup_oom_register_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd, const char *args)
+{
+        struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
+        struct mem_cgroup_eventfd_list *event;
+        int type = MEMFILE_TYPE(cft->private);
+
+        BUG_ON(type != _OOM_TYPE);
+        event = kmalloc(sizeof(*event), GFP_KERNEL);
+        if (!event)
+                return -ENOMEM;
+
+        mutex_lock(&memcg_oom_mutex);
+
+        event->eventfd = eventfd;
+        list_add(&event->list, &memcg->oom_notify);
+
+        /* already in OOM ? */
+        if (atomic_read(&memcg->oom_lock))
+                eventfd_signal(eventfd, 1);
+        mutex_unlock(&memcg_oom_mutex);
+
+        return 0;
+}
+
+static void mem_cgroup_oom_unregister_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd)
+{
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
+        struct mem_cgroup_eventfd_list *ev, *tmp;
+        int type = MEMFILE_TYPE(cft->private);
+
+        BUG_ON(type != _OOM_TYPE);
+
+        mutex_lock(&memcg_oom_mutex);
+
+        list_for_each_entry_safe(ev, tmp, &mem->oom_notify, list) {
+                if (ev->eventfd == eventfd) {
+                        list_del(&ev->list);
+                        kfree(ev);
+                }
+        }
+
+        mutex_unlock(&memcg_oom_mutex);
+}
+
+static int mem_cgroup_oom_control_read(struct cgroup *cgrp,
+        struct cftype *cft,  struct cgroup_map_cb *cb)
+{
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
+
+        cb->fill(cb, "oom_kill_disable", mem->oom_kill_disable);
+
+        if (atomic_read(&mem->oom_lock))
+                cb->fill(cb, "under_oom", 1);
+        else
+                cb->fill(cb, "under_oom", 0);
+        return 0;
+}
+
+/*
+ */
+static int mem_cgroup_oom_control_write(struct cgroup *cgrp,
+        struct cftype *cft, u64 val)
+{
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
+        struct mem_cgroup *parent;
+
+        /* cannot set to root cgroup and only 0 and 1 are allowed */
+        if (!cgrp->parent || !((val == 0) || (val == 1)))
+                return -EINVAL;
+
+        parent = mem_cgroup_from_cont(cgrp->parent);
+
+        cgroup_lock();
+        /* oom-kill-disable is a flag for subhierarchy. */
+        if ((parent->use_hierarchy) ||
+            (mem->use_hierarchy && !list_empty(&cgrp->children))) {
+                cgroup_unlock();
+                return -EINVAL;
+        }
+        mem->oom_kill_disable = val;
+        cgroup_unlock();
+        return 0;
 }
 
 static struct cftype mem_cgroup_files[] = {
@@ -3544,8 +3790,8 @@ static struct cftype mem_cgroup_files[] = {
                 .name = "usage_in_bytes",
                 .private = MEMFILE_PRIVATE(_MEM, RES_USAGE),
                 .read_u64 = mem_cgroup_read,
-                .register_event = mem_cgroup_register_event,
-                .unregister_event = mem_cgroup_unregister_event,
+                .register_event = mem_cgroup_usage_register_event,
+                .unregister_event = mem_cgroup_usage_unregister_event,
         },
         {
                 .name = "max_usage_in_bytes",
@@ -3594,6 +3840,14 @@ static struct cftype mem_cgroup_files[] = {
                 .read_u64 = mem_cgroup_move_charge_read,
                 .write_u64 = mem_cgroup_move_charge_write,
         },
+        {
+                .name = "oom_control",
+                .read_map = mem_cgroup_oom_control_read,
+                .write_u64 = mem_cgroup_oom_control_write,
+                .register_event = mem_cgroup_oom_register_event,
+                .unregister_event = mem_cgroup_oom_unregister_event,
+                .private = MEMFILE_PRIVATE(_OOM_TYPE, OOM_CONTROL),
+        },
 };
 
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
@@ -3602,8 +3856,8 @@ static struct cftype memsw_cgroup_files[] = {
                 .name = "memsw.usage_in_bytes",
                 .private = MEMFILE_PRIVATE(_MEMSWAP, RES_USAGE),
                 .read_u64 = mem_cgroup_read,
-                .register_event = mem_cgroup_register_event,
-                .unregister_event = mem_cgroup_unregister_event,
+                .register_event = mem_cgroup_usage_register_event,
+                .unregister_event = mem_cgroup_usage_unregister_event,
         },
         {
                 .name = "memsw.max_usage_in_bytes",
@@ -3831,6 +4085,7 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
         } else {
                 parent = mem_cgroup_from_cont(cont->parent);
                 mem->use_hierarchy = parent->use_hierarchy;
+                mem->oom_kill_disable = parent->oom_kill_disable;
         }
 
         if (parent && parent->use_hierarchy) {
@@ -3849,6 +4104,7 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
         }
         mem->last_scanned_child = 0;
         spin_lock_init(&mem->reclaim_param_lock);
+        INIT_LIST_HEAD(&mem->oom_notify);
 
         if (parent)
                 mem->swappiness = get_swappiness(parent);
@@ -3976,6 +4232,80 @@ enum mc_target_type {
         MC_TARGET_SWAP,
 };
 
+static struct page *mc_handle_present_pte(struct vm_area_struct *vma,
+                                                unsigned long addr, pte_t ptent)
+{
+        struct page *page = vm_normal_page(vma, addr, ptent);
+
+        if (!page || !page_mapped(page))
+                return NULL;
+        if (PageAnon(page)) {
+                /* we don't move shared anon */
+                if (!move_anon() || page_mapcount(page) > 2)
+                        return NULL;
+        } else if (!move_file())
+                /* we ignore mapcount for file pages */
+                return NULL;
+        if (!get_page_unless_zero(page))
+                return NULL;
+
+        return page;
+}
+
+static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
+                        unsigned long addr, pte_t ptent, swp_entry_t *entry)
+{
+        int usage_count;
+        struct page *page = NULL;
+        swp_entry_t ent = pte_to_swp_entry(ptent);
+
+        if (!move_anon() || non_swap_entry(ent))
+                return NULL;
+        usage_count = mem_cgroup_count_swap_user(ent, &page);
+        if (usage_count > 1) { /* we don't move shared anon */
+                if (page)
+                        put_page(page);
+                return NULL;
+        }
+        if (do_swap_account)
+                entry->val = ent.val;
+
+        return page;
+}
+
+static struct page *mc_handle_file_pte(struct vm_area_struct *vma,
+                        unsigned long addr, pte_t ptent, swp_entry_t *entry)
+{
+        struct page *page = NULL;
+        struct inode *inode;
+        struct address_space *mapping;
+        pgoff_t pgoff;
+
+        if (!vma->vm_file) /* anonymous vma */
+                return NULL;
+        if (!move_file())
+                return NULL;
+
+        inode = vma->vm_file->f_path.dentry->d_inode;
+        mapping = vma->vm_file->f_mapping;
+        if (pte_none(ptent))
+                pgoff = linear_page_index(vma, addr);
+        else /* pte_file(ptent) is true */
+                pgoff = pte_to_pgoff(ptent);
+
+        /* page is moved even if it's not RSS of this task(page-faulted). */
+        if (!mapping_cap_swap_backed(mapping)) { /* normal file */
+                page = find_get_page(mapping, pgoff);
+        } else { /* shmem/tmpfs file. we should take account of swap too. */
+                swp_entry_t ent;
+                mem_cgroup_get_shmem_target(inode, pgoff, &page, &ent);
+                if (do_swap_account)
+                        entry->val = ent.val;
+        }
+
+        return page;
+}
+
 static int is_target_pte_for_mc(struct vm_area_struct *vma,
                 unsigned long addr, pte_t ptent, union mc_target *target)
 {
@@ -3983,43 +4313,16 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
         struct page_cgroup *pc;
         int ret = 0;
         swp_entry_t ent = { .val = 0 };
-        int usage_count = 0;
-        bool move_anon = test_bit(MOVE_CHARGE_TYPE_ANON,
-                                        &mc.to->move_charge_at_immigrate);
 
-        if (!pte_present(ptent)) {
-                /* TODO: handle swap of shmes/tmpfs */
-                if (pte_none(ptent) || pte_file(ptent))
-                        return 0;
-                else if (is_swap_pte(ptent)) {
-                        ent = pte_to_swp_entry(ptent);
-                        if (!move_anon || non_swap_entry(ent))
-                                return 0;
-                        usage_count = mem_cgroup_count_swap_user(ent, &page);
-                }
-        } else {
-                page = vm_normal_page(vma, addr, ptent);
-                if (!page || !page_mapped(page))
-                        return 0;
-                /*
-                 * TODO: We don't move charges of file(including shmem/tmpfs)
-                 * pages for now.
-                 */
-                if (!move_anon || !PageAnon(page))
-                        return 0;
-                if (!get_page_unless_zero(page))
-                        return 0;
-                usage_count = page_mapcount(page);
-        }
-        if (usage_count > 1) {
-                /*
-                 * TODO: We don't move charges of shared(used by multiple
-                 * processes) pages for now.
-                 */
-                if (page)
-                        put_page(page);
+        if (pte_present(ptent))
+                page = mc_handle_present_pte(vma, addr, ptent);
+        else if (is_swap_pte(ptent))
+                page = mc_handle_swap_pte(vma, addr, ptent, &ent);
+        else if (pte_none(ptent) || pte_file(ptent))
+                page = mc_handle_file_pte(vma, addr, ptent, &ent);
+
+        if (!page && !ent.val)
                 return 0;
-        }
         if (page) {
                 pc = lookup_page_cgroup(page);
                 /*
@@ -4035,8 +4338,8 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
                 if (!ret || !target)
                         put_page(page);
         }
-        /* throught */
-        if (ent.val && do_swap_account && !ret &&
+        /* There is a swap entry and a page doesn't exist or isn't charged */
+        if (ent.val && !ret &&
                         css_id(&mc.from->css) == lookup_swap_cgroup(ent)) {
                 ret = MC_TARGET_SWAP;
                 if (target)
@@ -4077,9 +4380,6 @@ static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm)
                 };
                 if (is_vm_hugetlb_page(vma))
                         continue;
-                /* TODO: We don't move charges of shmem/tmpfs pages for now. */
-                if (vma->vm_flags & VM_SHARED)
-                        continue;
                 walk_page_range(vma->vm_start, vma->vm_end,
                                         &mem_cgroup_count_precharge_walk);
         }
@@ -4102,6 +4402,7 @@ static void mem_cgroup_clear_mc(void)
         if (mc.precharge) {
                 __mem_cgroup_cancel_charge(mc.to, mc.precharge);
                 mc.precharge = 0;
+                memcg_oom_recover(mc.to);
         }
         /*
          * we didn't uncharge from mc.from at mem_cgroup_move_account(), so
@@ -4110,6 +4411,7 @@ static void mem_cgroup_clear_mc(void)
         if (mc.moved_charge) {
                 __mem_cgroup_cancel_charge(mc.from, mc.moved_charge);
                 mc.moved_charge = 0;
+                memcg_oom_recover(mc.from);
         }
         /* we must fixup refcnts and charges */
         if (mc.moved_swap) {
@@ -4274,9 +4576,6 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
                 };
                 if (is_vm_hugetlb_page(vma))
                         continue;
-                /* TODO: We don't move charges of shmem/tmpfs pages for now. */
-                if (vma->vm_flags & VM_SHARED)
-                        continue;
                 ret = walk_page_range(vma->vm_start, vma->vm_end,
                                                 &mem_cgroup_move_charge_walk);
                 if (ret)
diff --git a/mm/migrate.c b/mm/migrate.c
index 09e2471afa0f..4205b1d6049e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -590,7 +590,7 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         }
 
         /* charge against new page */
-        charge = mem_cgroup_prepare_migration(page, &mem);
+        charge = mem_cgroup_prepare_migration(page, newpage, &mem);
         if (charge == -ENOMEM) {
                 rc = -ENOMEM;
                 goto unlock;
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b68e802a7a7d..709aedfaa014 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -479,12 +479,9 @@ void mem_cgroup_out_of_memory(struct mem_cgroup *mem, gfp_t gfp_mask)
         read_lock(&tasklist_lock);
 retry:
         p = select_bad_process(&points, mem);
-        if (PTR_ERR(p) == -1UL)
+        if (!p || PTR_ERR(p) == -1UL)
                 goto out;
 
-        if (!p)
-                p = current;
-
         if (oom_kill_process(p, gfp_mask, 0, points, mem,
                                 "Memory cgroup out of memory"))
                 goto retry;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 08b349931ebc..431214b941ac 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -57,6 +57,22 @@
 #include <asm/div64.h>
 #include "internal.h"
 
+#ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
+DEFINE_PER_CPU(int, numa_node);
+EXPORT_PER_CPU_SYMBOL(numa_node);
+#endif
+
+#ifdef CONFIG_HAVE_MEMORYLESS_NODES
+/*
+ * N.B., Do NOT reference the '_numa_mem_' per cpu variable directly.
+ * It will not be defined when CONFIG_HAVE_MEMORYLESS_NODES is not defined.
+ * Use the accessor functions set_numa_mem(), numa_mem_id() and cpu_to_mem()
+ * defined in <linux/topology.h>.
+ */
+DEFINE_PER_CPU(int, _numa_mem_);                /* Kernel "local memory" node */
+EXPORT_PER_CPU_SYMBOL(_numa_mem_);
+#endif
+
 /*
  * Array of node states.
  */
@@ -2856,6 +2872,24 @@ static void build_zonelist_cache(pg_data_t *pgdat)
                 zlc->z_to_n[z - zonelist->_zonerefs] = zonelist_node_idx(z);
 }
 
+#ifdef CONFIG_HAVE_MEMORYLESS_NODES
+/*
+ * Return node id of node used for "local" allocations.
+ * I.e., first node id of first zone in arg node's generic zonelist.
+ * Used for initializing percpu 'numa_mem', which is used primarily
+ * for kernel allocations, so use GFP_KERNEL flags to locate zonelist.
+ */
+int local_memory_node(int node)
+{
+        struct zone *zone;
+
+        (void)first_zones_zonelist(node_zonelist(node, GFP_KERNEL),
+                                   gfp_zone(GFP_KERNEL),
+                                   NULL,
+                                   &zone);
+        return zone->node;
+}
+#endif
 
 #else   /* CONFIG_NUMA */
 
@@ -2970,9 +3004,23 @@ static __init_refok int __build_all_zonelists(void *data)
          * needs the percpu allocator in order to allocate its pagesets
          * (a chicken-egg dilemma).
          */
-        for_each_possible_cpu(cpu)
+        for_each_possible_cpu(cpu) {
                 setup_pageset(&per_cpu(boot_pageset, cpu), 0);
 
+#ifdef CONFIG_HAVE_MEMORYLESS_NODES
+                /*
+                 * We now know the "local memory node" for each node--
+                 * i.e., the node of the first zone in the generic zonelist.
+                 * Set up numa_mem percpu variable for on-line cpus.  During
+                 * boot, only the boot cpu should be on-line;  we'll init the
+                 * secondary cpus' numa_mem as they come on-line.  During
+                 * node/memory hotplug, we'll fixup all on-line cpus.
+                 */
+                if (cpu_online(cpu))
+                        set_cpu_numa_mem(cpu, local_memory_node(cpu_to_node(cpu)));
+#endif
+        }
+
         return 0;
 }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 4ef9797bd430..7e5030ae18ff 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -727,10 +727,11 @@ done2:
         if (inode->i_mapping->nrpages && (info->flags & SHMEM_PAGEIN)) {
                 /*
                  * Call truncate_inode_pages again: racing shmem_unuse_inode
-                 * may have swizzled a page in from swap since vmtruncate or
-                 * generic_delete_inode did it, before we lowered next_index.
-                 * Also, though shmem_getpage checks i_size before adding to
-                 * cache, no recheck after: so fix the narrow window there too.
+                 * may have swizzled a page in from swap since
+                 * truncate_pagecache or generic_delete_inode did it, before we
+                 * lowered next_index.  Also, though shmem_getpage checks
+                 * i_size before adding to cache, no recheck after: so fix the
+                 * narrow window there too.
                  *
                  * Recalling truncate_inode_pages_range and unmap_mapping_range
                  * every time for punch_hole (which never got a chance to clear
@@ -760,19 +761,16 @@ done2:
         }
 }
 
-static void shmem_truncate(struct inode *inode)
-{
-        shmem_truncate_range(inode, inode->i_size, (loff_t)-1);
-}
-
 static int shmem_notify_change(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = dentry->d_inode;
-        struct page *page = NULL;
         int error;
 
         if (S_ISREG(inode->i_mode) && (attr->ia_valid & ATTR_SIZE)) {
-                if (attr->ia_size < inode->i_size) {
+                loff_t newsize = attr->ia_size;
+                struct page *page = NULL;
+
+                if (newsize < inode->i_size) {
                         /*
                          * If truncating down to a partial page, then
                          * if that page is already allocated, hold it
@@ -780,9 +778,9 @@ static int shmem_notify_change(struct dentry *dentry, struct iattr *attr)
                          * truncate_partial_page cannnot miss it were
                          * it assigned to swap.
                          */
-                        if (attr->ia_size & (PAGE_CACHE_SIZE-1)) {
+                        if (newsize & (PAGE_CACHE_SIZE-1)) {
                                 (void) shmem_getpage(inode,
-                                        attr->ia_size>>PAGE_CACHE_SHIFT,
+                                        newsize >> PAGE_CACHE_SHIFT,
                                                 &page, SGP_READ, NULL);
                                 if (page)
                                         unlock_page(page);
@@ -794,24 +792,29 @@ static int shmem_notify_change(struct dentry *dentry, struct iattr *attr)
                          * if it's being fully truncated to zero-length: the
                          * nrpages check is efficient enough in that case.
                          */
-                        if (attr->ia_size) {
+                        if (newsize) {
                                 struct shmem_inode_info *info = SHMEM_I(inode);
                                 spin_lock(&info->lock);
                                 info->flags &= ~SHMEM_PAGEIN;
                                 spin_unlock(&info->lock);
                         }
                 }
+
+                error = simple_setsize(inode, newsize);
+                if (page)
+                        page_cache_release(page);
+                if (error)
+                        return error;
+                shmem_truncate_range(inode, newsize, (loff_t)-1);
         }
 
         error = inode_change_ok(inode, attr);
         if (!error)
-                error = inode_setattr(inode, attr);
+                generic_setattr(inode, attr);
 #ifdef CONFIG_TMPFS_POSIX_ACL
         if (!error && (attr->ia_valid & ATTR_MODE))
                 error = generic_acl_chmod(inode);
 #endif
-        if (page)
-                page_cache_release(page);
         return error;
 }
 
@@ -819,11 +822,11 @@ static void shmem_delete_inode(struct inode *inode)
 {
         struct shmem_inode_info *info = SHMEM_I(inode);
 
-        if (inode->i_op->truncate == shmem_truncate) {
+        if (inode->i_mapping->a_ops == &shmem_aops) {
                 truncate_inode_pages(inode->i_mapping, 0);
                 shmem_unacct_size(info->flags, inode->i_size);
                 inode->i_size = 0;
-                shmem_truncate(inode);
+                shmem_truncate_range(inode, 0, (loff_t)-1);
                 if (!list_empty(&info->swaplist)) {
                         mutex_lock(&shmem_swaplist_mutex);
                         list_del_init(&info->swaplist);
@@ -2022,7 +2025,6 @@ static const struct inode_operations shmem_symlink_inline_operations = {
 };
 
 static const struct inode_operations shmem_symlink_inode_operations = {
-        .truncate       = shmem_truncate,
         .readlink       = generic_readlink,
         .follow_link    = shmem_follow_link,
         .put_link       = shmem_put_link,
@@ -2433,14 +2435,13 @@ static const struct file_operations shmem_file_operations = {
         .write          = do_sync_write,
         .aio_read       = shmem_file_aio_read,
         .aio_write      = generic_file_aio_write,
-        .fsync          = simple_sync_file,
+        .fsync          = noop_fsync,
         .splice_read    = generic_file_splice_read,
         .splice_write   = generic_file_splice_write,
 #endif
 };
 
 static const struct inode_operations shmem_inode_operations = {
-        .truncate       = shmem_truncate,
         .setattr        = shmem_notify_change,
         .truncate_range = shmem_truncate_range,
 #ifdef CONFIG_TMPFS_POSIX_ACL
@@ -2559,6 +2560,45 @@ out4:
         return error;
 }
 
+#ifdef CONFIG_CGROUP_MEM_RES_CTLR
+/**
+ * mem_cgroup_get_shmem_target - find a page or entry assigned to the shmem file
+ * @inode: the inode to be searched
+ * @pgoff: the offset to be searched
+ * @pagep: the pointer for the found page to be stored
+ * @ent: the pointer for the found swap entry to be stored
+ *
+ * If a page is found, refcount of it is incremented. Callers should handle
+ * these refcount.
+ */
+void mem_cgroup_get_shmem_target(struct inode *inode, pgoff_t pgoff,
+                                        struct page **pagep, swp_entry_t *ent)
+{
+        swp_entry_t entry = { .val = 0 }, *ptr;
+        struct page *page = NULL;
+        struct shmem_inode_info *info = SHMEM_I(inode);
+
+        if ((pgoff << PAGE_CACHE_SHIFT) >= i_size_read(inode))
+                goto out;
+
+        spin_lock(&info->lock);
+        ptr = shmem_swp_entry(info, pgoff, NULL);
+#ifdef CONFIG_SWAP
+        if (ptr && ptr->val) {
+                entry.val = ptr->val;
+                page = find_get_page(&swapper_space, entry.val);
+        } else
+#endif
+                page = find_get_page(inode->i_mapping, pgoff);
+        if (ptr)
+                shmem_swp_unmap(ptr);
+        spin_unlock(&info->lock);
+out:
+        *pagep = page;
+        *ent = entry;
+}
+#endif
+
 #else /* !CONFIG_SHMEM */
 
 /*
@@ -2598,6 +2638,31 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
         return 0;
 }
 
+#ifdef CONFIG_CGROUP_MEM_RES_CTLR
+/**
+ * mem_cgroup_get_shmem_target - find a page or entry assigned to the shmem file
+ * @inode: the inode to be searched
+ * @pgoff: the offset to be searched
+ * @pagep: the pointer for the found page to be stored
+ * @ent: the pointer for the found swap entry to be stored
+ *
+ * If a page is found, refcount of it is incremented. Callers should handle
+ * these refcount.
+ */
+void mem_cgroup_get_shmem_target(struct inode *inode, pgoff_t pgoff,
+                                        struct page **pagep, swp_entry_t *ent)
+{
+        struct page *page = NULL;
+
+        if ((pgoff << PAGE_CACHE_SHIFT) >= i_size_read(inode))
+                goto out;
+        page = find_get_page(inode->i_mapping, pgoff);
+out:
+        *pagep = page;
+        *ent = (swp_entry_t){ .val = 0 };
+}
+#endif
+
 #define shmem_vm_ops                            generic_file_vm_ops
 #define shmem_file_operations                   ramfs_file_operations
 #define shmem_get_inode(sb, dir, mode, dev, flags)      ramfs_get_inode(sb, dir, mode, dev)
diff --git a/mm/slab.c b/mm/slab.c
index 02786e1a32d2..e49f8f46f46d 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -821,7 +821,7 @@ static void init_reap_node(int cpu)
 {
         int node;
 
-        node = next_node(cpu_to_node(cpu), node_online_map);
+        node = next_node(cpu_to_mem(cpu), node_online_map);
         if (node == MAX_NUMNODES)
                 node = first_node(node_online_map);
 
@@ -1050,7 +1050,7 @@ static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
         struct array_cache *alien = NULL;
         int node;
 
-        node = numa_node_id();
+        node = numa_mem_id();
 
         /*
          * Make sure we are not freeing a object from another node to the array
@@ -1129,7 +1129,7 @@ static void __cpuinit cpuup_canceled(long cpu)
 {
         struct kmem_cache *cachep;
         struct kmem_list3 *l3 = NULL;
-        int node = cpu_to_node(cpu);
+        int node = cpu_to_mem(cpu);
         const struct cpumask *mask = cpumask_of_node(node);
 
         list_for_each_entry(cachep, &cache_chain, next) {
@@ -1194,7 +1194,7 @@ static int __cpuinit cpuup_prepare(long cpu)
 {
         struct kmem_cache *cachep;
         struct kmem_list3 *l3 = NULL;
-        int node = cpu_to_node(cpu);
+        int node = cpu_to_mem(cpu);
         int err;
 
         /*
@@ -1321,7 +1321,7 @@ static int __cpuinit cpuup_callback(struct notifier_block *nfb,
                 mutex_unlock(&cache_chain_mutex);
                 break;
         }
-        return err ? NOTIFY_BAD : NOTIFY_OK;
+        return notifier_from_errno(err);
 }
 
 static struct notifier_block __cpuinitdata cpucache_notifier = {
@@ -1479,7 +1479,7 @@ void __init kmem_cache_init(void)
          * 6) Resize the head arrays of the kmalloc caches to their final sizes.
          */
 
-        node = numa_node_id();
+        node = numa_mem_id();
 
         /* 1) create the cache_cache */
         INIT_LIST_HEAD(&cache_chain);
@@ -2121,7 +2121,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
                         }
                 }
         }
-        cachep->nodelists[numa_node_id()]->next_reap =
+        cachep->nodelists[numa_mem_id()]->next_reap =
                         jiffies + REAPTIMEOUT_LIST3 +
                         ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
 
@@ -2452,7 +2452,7 @@ static void check_spinlock_acquired(struct kmem_cache *cachep)
 {
 #ifdef CONFIG_SMP
         check_irq_off();
-        assert_spin_locked(&cachep->nodelists[numa_node_id()]->list_lock);
+        assert_spin_locked(&cachep->nodelists[numa_mem_id()]->list_lock);
 #endif
 }
 
@@ -2479,7 +2479,7 @@ static void do_drain(void *arg)
 {
         struct kmem_cache *cachep = arg;
         struct array_cache *ac;
-        int node = numa_node_id();
+        int node = numa_mem_id();
 
         check_irq_off();
         ac = cpu_cache_get(cachep);
@@ -3012,7 +3012,7 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
 
 retry:
         check_irq_off();
-        node = numa_node_id();
+        node = numa_mem_id();
         ac = cpu_cache_get(cachep);
         batchcount = ac->batchcount;
         if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
@@ -3216,10 +3216,10 @@ static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags)
 
         if (in_interrupt() || (flags & __GFP_THISNODE))
                 return NULL;
-        nid_alloc = nid_here = numa_node_id();
+        nid_alloc = nid_here = numa_mem_id();
         get_mems_allowed();
         if (cpuset_do_slab_mem_spread() && (cachep->flags & SLAB_MEM_SPREAD))
-                nid_alloc = cpuset_mem_spread_node();
+                nid_alloc = cpuset_slab_spread_node();
         else if (current->mempolicy)
                 nid_alloc = slab_node(current->mempolicy);
         put_mems_allowed();
@@ -3281,7 +3281,7 @@ retry:
                 if (local_flags & __GFP_WAIT)
                         local_irq_enable();
                 kmem_flagcheck(cache, flags);
-                obj = kmem_getpages(cache, local_flags, numa_node_id());
+                obj = kmem_getpages(cache, local_flags, numa_mem_id());
                 if (local_flags & __GFP_WAIT)
                         local_irq_disable();
                 if (obj) {
@@ -3389,6 +3389,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
 {
         unsigned long save_flags;
         void *ptr;
+        int slab_node = numa_mem_id();
 
         flags &= gfp_allowed_mask;
 
@@ -3401,7 +3402,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
         local_irq_save(save_flags);
 
         if (nodeid == -1)
-                nodeid = numa_node_id();
+                nodeid = slab_node;
 
         if (unlikely(!cachep->nodelists[nodeid])) {
                 /* Node not bootstrapped yet */
@@ -3409,7 +3410,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
                 goto out;
         }
 
-        if (nodeid == numa_node_id()) {
+        if (nodeid == slab_node) {
                 /*
                  * Use the locally cached objects if possible.
                  * However ____cache_alloc does not allow fallback
@@ -3453,8 +3454,8 @@ __do_cache_alloc(struct kmem_cache *cache, gfp_t flags)
          * We may just have run out of memory on the local node.
          * ____cache_alloc_node() knows how to locate memory on other nodes
          */
-        if (!objp)
-                objp = ____cache_alloc_node(cache, flags, numa_node_id());
+        if (!objp)
+                objp = ____cache_alloc_node(cache, flags, numa_mem_id());
 
   out:
         return objp;
@@ -3551,7 +3552,7 @@ static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac)
 {
         int batchcount;
         struct kmem_list3 *l3;
-        int node = numa_node_id();
+        int node = numa_mem_id();
 
         batchcount = ac->batchcount;
 #if DEBUG
@@ -3985,7 +3986,7 @@ static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
                 return -ENOMEM;
 
         for_each_online_cpu(i) {
-                new->new[i] = alloc_arraycache(cpu_to_node(i), limit,
+                new->new[i] = alloc_arraycache(cpu_to_mem(i), limit,
                                                 batchcount, gfp);
                 if (!new->new[i]) {
                         for (i--; i >= 0; i--)
@@ -4007,9 +4008,9 @@ static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
                 struct array_cache *ccold = new->new[i];
                 if (!ccold)
                         continue;
-                spin_lock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
-                free_block(cachep, ccold->entry, ccold->avail, cpu_to_node(i));
-                spin_unlock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
+                spin_lock_irq(&cachep->nodelists[cpu_to_mem(i)]->list_lock);
+                free_block(cachep, ccold->entry, ccold->avail, cpu_to_mem(i));
+                spin_unlock_irq(&cachep->nodelists[cpu_to_mem(i)]->list_lock);
                 kfree(ccold);
         }
         kfree(new);
@@ -4115,7 +4116,7 @@ static void cache_reap(struct work_struct *w)
 {
         struct kmem_cache *searchp;
         struct kmem_list3 *l3;
-        int node = numa_node_id();
+        int node = numa_mem_id();
         struct delayed_work *work = to_delayed_work(w);
 
         if (!mutex_trylock(&cache_chain_mutex))
diff --git a/mm/slub.c b/mm/slub.c
index 26f0cb9cc584..578f68f3c51f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2137,7 +2137,7 @@ static void free_kmem_cache_nodes(struct kmem_cache *s)
 
         for_each_node_state(node, N_NORMAL_MEMORY) {
                 struct kmem_cache_node *n = s->node[node];
-                if (n && n != &s->local_node)
+                if (n)
                         kmem_cache_free(kmalloc_caches, n);
                 s->node[node] = NULL;
         }
@@ -2146,33 +2146,22 @@ static void free_kmem_cache_nodes(struct kmem_cache *s)
 static int init_kmem_cache_nodes(struct kmem_cache *s, gfp_t gfpflags)
 {
         int node;
-        int local_node;
-
-        if (slab_state >= UP && (s < kmalloc_caches ||
-                        s >= kmalloc_caches + KMALLOC_CACHES))
-                local_node = page_to_nid(virt_to_page(s));
-        else
-                local_node = 0;
 
         for_each_node_state(node, N_NORMAL_MEMORY) {
                 struct kmem_cache_node *n;
 
-                if (local_node == node)
-                        n = &s->local_node;
-                else {
-                        if (slab_state == DOWN) {
-                                early_kmem_cache_node_alloc(gfpflags, node);
-                                continue;
-                        }
-                        n = kmem_cache_alloc_node(kmalloc_caches,
-                                                        gfpflags, node);
-
-                        if (!n) {
-                                free_kmem_cache_nodes(s);
-                                return 0;
-                        }
+                if (slab_state == DOWN) {
+                        early_kmem_cache_node_alloc(gfpflags, node);
+                        continue;
+                }
+                n = kmem_cache_alloc_node(kmalloc_caches,
+                                                gfpflags, node);
 
+                if (!n) {
+                        free_kmem_cache_nodes(s);
+                        return 0;
                 }
+
                 s->node[node] = n;
                 init_kmem_cache_node(n, s);
         }
diff --git a/mm/swap.c b/mm/swap.c
index 7cd60bf0a972..3ce7bc373a52 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -224,6 +224,7 @@ void __lru_cache_add(struct page *page, enum lru_list lru)
                 ____pagevec_lru_add(pvec, lru);
         put_cpu_var(lru_add_pvecs);
 }
+EXPORT_SYMBOL(__lru_cache_add);
 
 /**
  * lru_cache_add_lru - add a page to a page list
diff --git a/mm/truncate.c b/mm/truncate.c
index f42675a3615d..937571b8b233 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -548,18 +548,18 @@ EXPORT_SYMBOL(truncate_pagecache);
  * NOTE! We have to be ready to update the memory sharing
  * between the file and the memory map for a potential last
  * incomplete page.  Ugly, but necessary.
+ *
+ * This function is deprecated and simple_setsize or truncate_pagecache
+ * should be used instead.
  */
 int vmtruncate(struct inode *inode, loff_t offset)
 {
-        loff_t oldsize;
         int error;
 
-        error = inode_newsize_ok(inode, offset);
+        error = simple_setsize(inode, offset);
         if (error)
                 return error;
-        oldsize = inode->i_size;
-        i_size_write(inode, offset);
-        truncate_pagecache(inode, oldsize, offset);
+
         if (inode->i_op->truncate)
                 inode->i_op->truncate(inode);