6 files changed, 639 insertions, 219 deletions

diff --git a/Documentation/vm/hugetlbpage.txt b/Documentation/vm/hugetlbpage.txt
index 82a7bd1800b2..bc31636973e3 100644
--- a/Documentation/vm/hugetlbpage.txt
+++ b/Documentation/vm/hugetlbpage.txt
@@ -11,23 +11,21 @@ This optimization is more critical now as bigger and bigger physical memories
 (several GBs) are more readily available.
 
 Users can use the huge page support in Linux kernel by either using the mmap
-system call or standard SYSv shared memory system calls (shmget, shmat).
+system call or standard SYSV shared memory system calls (shmget, shmat).
 
 First the Linux kernel needs to be built with the CONFIG_HUGETLBFS
 (present under "File systems") and CONFIG_HUGETLB_PAGE (selected
 automatically when CONFIG_HUGETLBFS is selected) configuration
 options.
 
-The kernel built with huge page support should show the number of configured
-huge pages in the system by running the "cat /proc/meminfo" command.
+The /proc/meminfo file provides information about the total number of
+persistent hugetlb pages in the kernel's huge page pool.  It also displays
+information about the number of free, reserved and surplus huge pages and the
+default huge page size.  The huge page size is needed for generating the
+proper alignment and size of the arguments to system calls that map huge page
+regions.
 
-/proc/meminfo also provides information about the total number of hugetlb
-pages configured in the kernel.  It also displays information about the
-number of free hugetlb pages at any time.  It also displays information about
-the configured huge page size - this is needed for generating the proper
-alignment and size of the arguments to the above system calls.
-
-The output of "cat /proc/meminfo" will have lines like:
+The output of "cat /proc/meminfo" will include lines like:
 
 .....
 HugePages_Total: vvv
@@ -53,59 +51,63 @@ HugePages_Surp  is short for "surplus," and is the number of huge pages in
 /proc/filesystems should also show a filesystem of type "hugetlbfs" configured
 in the kernel.
 
-/proc/sys/vm/nr_hugepages indicates the current number of configured hugetlb
-pages in the kernel.  Super user can dynamically request more (or free some
-pre-configured) huge pages.
-The allocation (or deallocation) of hugetlb pages is possible only if there are
-enough physically contiguous free pages in system (freeing of huge pages is
-possible only if there are enough hugetlb pages free that can be transferred
-back to regular memory pool).
+/proc/sys/vm/nr_hugepages indicates the current number of "persistent" huge
+pages in the kernel's huge page pool.  "Persistent" huge pages will be
+returned to the huge page pool when freed by a task.  A user with root
+privileges can dynamically allocate more or free some persistent huge pages
+by increasing or decreasing the value of 'nr_hugepages'.
 
-Pages that are used as hugetlb pages are reserved inside the kernel and cannot
-be used for other purposes.
+Pages that are used as huge pages are reserved inside the kernel and cannot
+be used for other purposes.  Huge pages cannot be swapped out under
+memory pressure.
 
-Once the kernel with Hugetlb page support is built and running, a user can
-use either the mmap system call or shared memory system calls to start using
-the huge pages.  It is required that the system administrator preallocate
-enough memory for huge page purposes.
+Once a number of huge pages have been pre-allocated to the kernel huge page
+pool, a user with appropriate privilege can use either the mmap system call
+or shared memory system calls to use the huge pages.  See the discussion of
+Using Huge Pages, below.
 
-The administrator can preallocate huge pages on the kernel boot command line by
-specifying the "hugepages=N" parameter, where 'N' = the number of huge pages
-requested.  This is the most reliable method for preallocating huge pages as
-memory has not yet become fragmented.
+The administrator can allocate persistent huge pages on the kernel boot
+command line by specifying the "hugepages=N" parameter, where 'N' = the
+number of huge pages requested.  This is the most reliable method of
+allocating huge pages as memory has not yet become fragmented.
 
-Some platforms support multiple huge page sizes.  To preallocate huge pages
+Some platforms support multiple huge page sizes.  To allocate huge pages
 of a specific size, one must preceed the huge pages boot command parameters
 with a huge page size selection parameter "hugepagesz=<size>".  <size> must
 be specified in bytes with optional scale suffix [kKmMgG].  The default huge
 page size may be selected with the "default_hugepagesz=<size>" boot parameter.
 
-/proc/sys/vm/nr_hugepages indicates the current number of configured [default
-size] hugetlb pages in the kernel.  Super user can dynamically request more
-(or free some pre-configured) huge pages.
-
-Use the following command to dynamically allocate/deallocate default sized
-huge pages:
+When multiple huge page sizes are supported, /proc/sys/vm/nr_hugepages
+indicates the current number of pre-allocated huge pages of the default size.
+Thus, one can use the following command to dynamically allocate/deallocate
+default sized persistent huge pages:
 
         echo 20 > /proc/sys/vm/nr_hugepages
 
-This command will try to configure 20 default sized huge pages in the system.
+This command will try to adjust the number of default sized huge pages in the
+huge page pool to 20, allocating or freeing huge pages, as required.
+
 On a NUMA platform, the kernel will attempt to distribute the huge page pool
-over the all on-line nodes.  These huge pages, allocated when nr_hugepages
-is increased, are called "persistent huge pages".
+over all the set of allowed nodes specified by the NUMA memory policy of the
+task that modifies nr_hugepages.  The default for the allowed nodes--when the
+task has default memory policy--is all on-line nodes with memory.  Allowed
+nodes with insufficient available, contiguous memory for a huge page will be
+silently skipped when allocating persistent huge pages.  See the discussion
+below of the interaction of task memory policy, cpusets and per node attributes
+with the allocation and freeing of persistent huge pages.
 
 The success or failure of huge page allocation depends on the amount of
-physically contiguous memory that is preset in system at the time of the
+physically contiguous memory that is present in system at the time of the
 allocation attempt.  If the kernel is unable to allocate huge pages from
 some nodes in a NUMA system, it will attempt to make up the difference by
 allocating extra pages on other nodes with sufficient available contiguous
 memory, if any.
 
-System administrators may want to put this command in one of the local rc init
-files.  This will enable the kernel to request huge pages early in the boot
-process when the possibility of getting physical contiguous pages is still
-very high.  Administrators can verify the number of huge pages actually
-allocated by checking the sysctl or meminfo.  To check the per node
+System administrators may want to put this command in one of the local rc
+init files.  This will enable the kernel to allocate huge pages early in
+the boot process when the possibility of getting physical contiguous pages
+is still very high.  Administrators can verify the number of huge pages
+actually allocated by checking the sysctl or meminfo.  To check the per node
 distribution of huge pages in a NUMA system, use:
 
         cat /sys/devices/system/node/node*/meminfo | fgrep Huge
@@ -113,45 +115,47 @@ distribution of huge pages in a NUMA system, use:
 /proc/sys/vm/nr_overcommit_hugepages specifies how large the pool of
 huge pages can grow, if more huge pages than /proc/sys/vm/nr_hugepages are
 requested by applications.  Writing any non-zero value into this file
-indicates that the hugetlb subsystem is allowed to try to obtain "surplus"
-huge pages from the buddy allocator, when the normal pool is exhausted. As
-these surplus huge pages go out of use, they are freed back to the buddy
-allocator.
+indicates that the hugetlb subsystem is allowed to try to obtain that
+number of "surplus" huge pages from the kernel's normal page pool, when the
+persistent huge page pool is exhausted. As these surplus huge pages become
+unused, they are freed back to the kernel's normal page pool.
 
-When increasing the huge page pool size via nr_hugepages, any surplus
+When increasing the huge page pool size via nr_hugepages, any existing surplus
 pages will first be promoted to persistent huge pages.  Then, additional
 huge pages will be allocated, if necessary and if possible, to fulfill
-the new huge page pool size.
+the new persistent huge page pool size.
 
-The administrator may shrink the pool of preallocated huge pages for
+The administrator may shrink the pool of persistent huge pages for
 the default huge page size by setting the nr_hugepages sysctl to a
 smaller value.  The kernel will attempt to balance the freeing of huge pages
-across all on-line nodes.  Any free huge pages on the selected nodes will
-be freed back to the buddy allocator.
-
-Caveat: Shrinking the pool via nr_hugepages such that it becomes less
-than the number of huge pages in use will convert the balance to surplus
-huge pages even if it would exceed the overcommit value.  As long as
-this condition holds, however, no more surplus huge pages will be
-allowed on the system until one of the two sysctls are increased
-sufficiently, or the surplus huge pages go out of use and are freed.
+across all nodes in the memory policy of the task modifying nr_hugepages.
+Any free huge pages on the selected nodes will be freed back to the kernel's
+normal page pool.
+
+Caveat: Shrinking the persistent huge page pool via nr_hugepages such that
+it becomes less than the number of huge pages in use will convert the balance
+of the in-use huge pages to surplus huge pages.  This will occur even if
+the number of surplus pages it would exceed the overcommit value.  As long as
+this condition holds--that is, until nr_hugepages+nr_overcommit_hugepages is
+increased sufficiently, or the surplus huge pages go out of use and are freed--
+no more surplus huge pages will be allowed to be allocated.
 
 With support for multiple huge page pools at run-time available, much of
-the huge page userspace interface has been duplicated in sysfs. The above
-information applies to the default huge page size which will be
-controlled by the /proc interfaces for backwards compatibility. The root
-huge page control directory in sysfs is:
+the huge page userspace interface in /proc/sys/vm has been duplicated in sysfs.
+The /proc interfaces discussed above have been retained for backwards
+compatibility. The root huge page control directory in sysfs is:
 
         /sys/kernel/mm/hugepages
 
 For each huge page size supported by the running kernel, a subdirectory
-will exist, of the form
+will exist, of the form:
 
         hugepages-${size}kB
 
 Inside each of these directories, the same set of files will exist:
 
         nr_hugepages
+        nr_hugepages_mempolicy
         nr_overcommit_hugepages
         free_hugepages
         resv_hugepages
@@ -159,6 +163,102 @@ Inside each of these directories, the same set of files will exist:
 
 which function as described above for the default huge page-sized case.
 
+
+Interaction of Task Memory Policy with Huge Page Allocation/Freeing
+
+Whether huge pages are allocated and freed via the /proc interface or
+the /sysfs interface using the nr_hugepages_mempolicy attribute, the NUMA
+nodes from which huge pages are allocated or freed are controlled by the
+NUMA memory policy of the task that modifies the nr_hugepages_mempolicy
+sysctl or attribute.  When the nr_hugepages attribute is used, mempolicy
+is ignored.
+
+The recommended method to allocate or free huge pages to/from the kernel
+huge page pool, using the nr_hugepages example above, is:
+
+    numactl --interleave <node-list> echo 20 \
+                                >/proc/sys/vm/nr_hugepages_mempolicy
+
+or, more succinctly:
+
+    numactl -m <node-list> echo 20 >/proc/sys/vm/nr_hugepages_mempolicy
+
+This will allocate or free abs(20 - nr_hugepages) to or from the nodes
+specified in <node-list>, depending on whether number of persistent huge pages
+is initially less than or greater than 20, respectively.  No huge pages will be
+allocated nor freed on any node not included in the specified <node-list>.
+
+When adjusting the persistent hugepage count via nr_hugepages_mempolicy, any
+memory policy mode--bind, preferred, local or interleave--may be used.  The
+resulting effect on persistent huge page allocation is as follows:
+
+1) Regardless of mempolicy mode [see Documentation/vm/numa_memory_policy.txt],
+   persistent huge pages will be distributed across the node or nodes
+   specified in the mempolicy as if "interleave" had been specified.
+   However, if a node in the policy does not contain sufficient contiguous
+   memory for a huge page, the allocation will not "fallback" to the nearest
+   neighbor node with sufficient contiguous memory.  To do this would cause
+   undesirable imbalance in the distribution of the huge page pool, or
+   possibly, allocation of persistent huge pages on nodes not allowed by
+   the task's memory policy.
+
+2) One or more nodes may be specified with the bind or interleave policy.
+   If more than one node is specified with the preferred policy, only the
+   lowest numeric id will be used.  Local policy will select the node where
+   the task is running at the time the nodes_allowed mask is constructed.
+   For local policy to be deterministic, the task must be bound to a cpu or
+   cpus in a single node.  Otherwise, the task could be migrated to some
+   other node at any time after launch and the resulting node will be
+   indeterminate.  Thus, local policy is not very useful for this purpose.
+   Any of the other mempolicy modes may be used to specify a single node.
+
+3) The nodes allowed mask will be derived from any non-default task mempolicy,
+   whether this policy was set explicitly by the task itself or one of its
+   ancestors, such as numactl.  This means that if the task is invoked from a
+   shell with non-default policy, that policy will be used.  One can specify a
+   node list of "all" with numactl --interleave or --membind [-m] to achieve
+   interleaving over all nodes in the system or cpuset.
+
+4) Any task mempolicy specifed--e.g., using numactl--will be constrained by
+   the resource limits of any cpuset in which the task runs.  Thus, there will
+   be no way for a task with non-default policy running in a cpuset with a
+   subset of the system nodes to allocate huge pages outside the cpuset
+   without first moving to a cpuset that contains all of the desired nodes.
+
+5) Boot-time huge page allocation attempts to distribute the requested number
+   of huge pages over all on-lines nodes with memory.
+
+Per Node Hugepages Attributes
+
+A subset of the contents of the root huge page control directory in sysfs,
+described above, will be replicated under each the system device of each
+NUMA node with memory in:
+
+        /sys/devices/system/node/node[0-9]*/hugepages/
+
+Under this directory, the subdirectory for each supported huge page size
+contains the following attribute files:
+
+        nr_hugepages
+        free_hugepages
+        surplus_hugepages
+
+The free_' and surplus_' attribute files are read-only.  They return the number
+of free and surplus [overcommitted] huge pages, respectively, on the parent
+node.
+
+The nr_hugepages attribute returns the total number of huge pages on the
+specified node.  When this attribute is written, the number of persistent huge
+pages on the parent node will be adjusted to the specified value, if sufficient
+resources exist, regardless of the task's mempolicy or cpuset constraints.
+
+Note that the number of overcommit and reserve pages remain global quantities,
+as we don't know until fault time, when the faulting task's mempolicy is
+applied, from which node the huge page allocation will be attempted.
+
+
+Using Huge Pages
+
 If the user applications are going to request huge pages using mmap system
 call, then it is required that system administrator mount a file system of
 type hugetlbfs:
@@ -206,9 +306,11 @@ map_hugetlb.c.
  * requesting huge pages.
  *
  * For the ia64 architecture, the Linux kernel reserves Region number 4 for
- * huge pages.  That means the addresses starting with 0x800000... will need
- * to be specified.  Specifying a fixed address is not required on ppc64,
- * i386 or x86_64.
+ * huge pages.  That means that if one requires a fixed address, a huge page
+ * aligned address starting with 0x800000... will be required.  If a fixed
+ * address is not required, the kernel will select an address in the proper
+ * range.
+ * Other architectures, such as ppc64, i386 or x86_64 are not so constrained.
  *
  * Note: The default shared memory limit is quite low on many kernels,
  * you may need to increase it via:
@@ -237,14 +339,8 @@ map_hugetlb.c.
 
 #define dprintf(x)  printf(x)
 
-/* Only ia64 requires this */
-#ifdef __ia64__
-#define ADDR (void *)(0x8000000000000000UL)
-#define SHMAT_FLAGS (SHM_RND)
-#else
-#define ADDR (void *)(0x0UL)
+#define ADDR (void *)(0x0UL)    /* let kernel choose address */
 #define SHMAT_FLAGS (0)
-#endif
 
 int main(void)
 {
@@ -302,10 +398,12 @@ int main(void)
  * example, the app is requesting memory of size 256MB that is backed by
  * huge pages.
  *
- * For ia64 architecture, Linux kernel reserves Region number 4 for huge pages.
- * That means the addresses starting with 0x800000... will need to be
- * specified.  Specifying a fixed address is not required on ppc64, i386
- * or x86_64.
+ * For the ia64 architecture, the Linux kernel reserves Region number 4 for
+ * huge pages.  That means that if one requires a fixed address, a huge page
+ * aligned address starting with 0x800000... will be required.  If a fixed
+ * address is not required, the kernel will select an address in the proper
+ * range.
+ * Other architectures, such as ppc64, i386 or x86_64 are not so constrained.
  */
 #include <stdlib.h>
 #include <stdio.h>
@@ -317,14 +415,8 @@ int main(void)
 #define LENGTH (256UL*1024*1024)
 #define PROTECTION (PROT_READ | PROT_WRITE)
 
-/* Only ia64 requires this */
-#ifdef __ia64__
-#define ADDR (void *)(0x8000000000000000UL)
-#define FLAGS (MAP_SHARED | MAP_FIXED)
-#else
-#define ADDR (void *)(0x0UL)
+#define ADDR (void *)(0x0UL)    /* let kernel choose address */
 #define FLAGS (MAP_SHARED)
-#endif
 
 void check_bytes(char *addr)
 {
diff --git a/Documentation/vm/hwpoison.txt b/Documentation/vm/hwpoison.txt
new file mode 100644
index 000000000000..12f9ba20ccb7
--- /dev/null
+++ b/Documentation/vm/hwpoison.txt
@@ -0,0 +1,182 @@
+What is hwpoison?
+
+Upcoming Intel CPUs have support for recovering from some memory errors
+(``MCA recovery''). This requires the OS to declare a page "poisoned",
+kill the processes associated with it and avoid using it in the future.
+
+This patchkit implements the necessary infrastructure in the VM.
+
+To quote the overview comment:
+
+ * High level machine check handler. Handles pages reported by the
+ * hardware as being corrupted usually due to a 2bit ECC memory or cache
+ * failure.
+ *
+ * This focusses on pages detected as corrupted in the background.
+ * When the current CPU tries to consume corruption the currently
+ * running process can just be killed directly instead. This implies
+ * that if the error cannot be handled for some reason it's safe to
+ * just ignore it because no corruption has been consumed yet. Instead
+ * when that happens another machine check will happen.
+ *
+ * Handles page cache pages in various states. The tricky part
+ * here is that we can access any page asynchronous to other VM
+ * users, because memory failures could happen anytime and anywhere,
+ * possibly violating some of their assumptions. This is why this code
+ * has to be extremely careful. Generally it tries to use normal locking
+ * rules, as in get the standard locks, even if that means the
+ * error handling takes potentially a long time.
+ *
+ * Some of the operations here are somewhat inefficient and have non
+ * linear algorithmic complexity, because the data structures have not
+ * been optimized for this case. This is in particular the case
+ * for the mapping from a vma to a process. Since this case is expected
+ * to be rare we hope we can get away with this.
+
+The code consists of a the high level handler in mm/memory-failure.c,
+a new page poison bit and various checks in the VM to handle poisoned
+pages.
+
+The main target right now is KVM guests, but it works for all kinds
+of applications. KVM support requires a recent qemu-kvm release.
+
+For the KVM use there was need for a new signal type so that
+KVM can inject the machine check into the guest with the proper
+address. This in theory allows other applications to handle
+memory failures too. The expection is that near all applications
+won't do that, but some very specialized ones might.
+
+---
+
+There are two (actually three) modi memory failure recovery can be in:
+
+vm.memory_failure_recovery sysctl set to zero:
+        All memory failures cause a panic. Do not attempt recovery.
+        (on x86 this can be also affected by the tolerant level of the
+        MCE subsystem)
+
+early kill
+        (can be controlled globally and per process)
+        Send SIGBUS to the application as soon as the error is detected
+        This allows applications who can process memory errors in a gentle
+        way (e.g. drop affected object)
+        This is the mode used by KVM qemu.
+
+late kill
+        Send SIGBUS when the application runs into the corrupted page.
+        This is best for memory error unaware applications and default
+        Note some pages are always handled as late kill.
+
+---
+
+User control:
+
+vm.memory_failure_recovery
+        See sysctl.txt
+
+vm.memory_failure_early_kill
+        Enable early kill mode globally
+
+PR_MCE_KILL
+        Set early/late kill mode/revert to system default
+        arg1: PR_MCE_KILL_CLEAR: Revert to system default
+        arg1: PR_MCE_KILL_SET: arg2 defines thread specific mode
+                PR_MCE_KILL_EARLY: Early kill
+                PR_MCE_KILL_LATE:  Late kill
+                PR_MCE_KILL_DEFAULT: Use system global default
+PR_MCE_KILL_GET
+        return current mode
+
+
+---
+
+Testing:
+
+madvise(MADV_HWPOISON, ....)
+        (as root)
+        Poison a page in the process for testing
+
+
+hwpoison-inject module through debugfs
+
+/sys/debug/hwpoison/
+
+corrupt-pfn
+
+Inject hwpoison fault at PFN echoed into this file. This does
+some early filtering to avoid corrupted unintended pages in test suites.
+
+unpoison-pfn
+
+Software-unpoison page at PFN echoed into this file. This
+way a page can be reused again.
+This only works for Linux injected failures, not for real
+memory failures.
+
+Note these injection interfaces are not stable and might change between
+kernel versions
+
+corrupt-filter-dev-major
+corrupt-filter-dev-minor
+
+Only handle memory failures to pages associated with the file system defined
+by block device major/minor.  -1U is the wildcard value.
+This should be only used for testing with artificial injection.
+
+corrupt-filter-memcg
+
+Limit injection to pages owned by memgroup. Specified by inode number
+of the memcg.
+
+Example:
+        mkdir /cgroup/hwpoison
+
+        usemem -m 100 -s 1000 &
+        echo `jobs -p` > /cgroup/hwpoison/tasks
+
+        memcg_ino=$(ls -id /cgroup/hwpoison | cut -f1 -d' ')
+        echo $memcg_ino > /debug/hwpoison/corrupt-filter-memcg
+
+        page-types -p `pidof init`   --hwpoison  # shall do nothing
+        page-types -p `pidof usemem` --hwpoison  # poison its pages
+
+corrupt-filter-flags-mask
+corrupt-filter-flags-value
+
+When specified, only poison pages if ((page_flags & mask) == value).
+This allows stress testing of many kinds of pages. The page_flags
+are the same as in /proc/kpageflags. The flag bits are defined in
+include/linux/kernel-page-flags.h and documented in
+Documentation/vm/pagemap.txt
+
+Architecture specific MCE injector
+
+x86 has mce-inject, mce-test
+
+Some portable hwpoison test programs in mce-test, see blow.
+
+---
+
+References:
+
+http://halobates.de/mce-lc09-2.pdf
+        Overview presentation from LinuxCon 09
+
+git://git.kernel.org/pub/scm/utils/cpu/mce/mce-test.git
+        Test suite (hwpoison specific portable tests in tsrc)
+
+git://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git
+        x86 specific injector
+
+
+---
+
+Limitations:
+
+- Not all page types are supported and never will. Most kernel internal
+objects cannot be recovered, only LRU pages for now.
+- Right now hugepage support is missing.
+
+---
+Andi Kleen, Oct 2009
+
diff --git a/Documentation/vm/ksm.txt b/Documentation/vm/ksm.txt
index 72a22f65960e..b392e496f816 100644
--- a/Documentation/vm/ksm.txt
+++ b/Documentation/vm/ksm.txt
@@ -16,9 +16,9 @@ by sharing the data common between them.  But it can be useful to any
 application which generates many instances of the same data.
 
 KSM only merges anonymous (private) pages, never pagecache (file) pages.
-KSM's merged pages are at present locked into kernel memory for as long
-as they are shared: so cannot be swapped out like the user pages they
-replace (but swapping KSM pages should follow soon in a later release).
+KSM's merged pages were originally locked into kernel memory, but can now
+be swapped out just like other user pages (but sharing is broken when they
+are swapped back in: ksmd must rediscover their identity and merge again).
 
 KSM only operates on those areas of address space which an application
 has advised to be likely candidates for merging, by using the madvise(2)
@@ -44,23 +44,15 @@ includes unmapped gaps (though working on the intervening mapped areas),
 and might fail with EAGAIN if not enough memory for internal structures.
 
 Applications should be considerate in their use of MADV_MERGEABLE,
-restricting its use to areas likely to benefit.  KSM's scans may use
-a lot of processing power, and its kernel-resident pages are a limited
-resource.  Some installations will disable KSM for these reasons.
+restricting its use to areas likely to benefit.  KSM's scans may use a lot
+of processing power: some installations will disable KSM for that reason.
 
 The KSM daemon is controlled by sysfs files in /sys/kernel/mm/ksm/,
 readable by all but writable only by root:
 
-max_kernel_pages - set to maximum number of kernel pages that KSM may use
-                   e.g. "echo 2000 > /sys/kernel/mm/ksm/max_kernel_pages"
-                   Value 0 imposes no limit on the kernel pages KSM may use;
-                   but note that any process using MADV_MERGEABLE can cause
-                   KSM to allocate these pages, unswappable until it exits.
-                   Default: 2000 (chosen for demonstration purposes)
-
 pages_to_scan    - how many present pages to scan before ksmd goes to sleep
-                   e.g. "echo 200 > /sys/kernel/mm/ksm/pages_to_scan"
-                   Default: 200 (chosen for demonstration purposes)
+                   e.g. "echo 100 > /sys/kernel/mm/ksm/pages_to_scan"
+                   Default: 100 (chosen for demonstration purposes)
 
 sleep_millisecs  - how many milliseconds ksmd should sleep before next scan
                    e.g. "echo 20 > /sys/kernel/mm/ksm/sleep_millisecs"
@@ -70,11 +62,12 @@ run              - set 0 to stop ksmd from running but keep merged pages,
                    set 1 to run ksmd e.g. "echo 1 > /sys/kernel/mm/ksm/run",
                    set 2 to stop ksmd and unmerge all pages currently merged,
                          but leave mergeable areas registered for next run
-                   Default: 1 (for immediate use by apps which register)
+                   Default: 0 (must be changed to 1 to activate KSM,
+                               except if CONFIG_SYSFS is disabled)
 
 The effectiveness of KSM and MADV_MERGEABLE is shown in /sys/kernel/mm/ksm/:
 
-pages_shared     - how many shared unswappable kernel pages KSM is using
+pages_shared     - how many shared pages are being used
 pages_sharing    - how many more sites are sharing them i.e. how much saved
 pages_unshared   - how many pages unique but repeatedly checked for merging
 pages_volatile   - how many pages changing too fast to be placed in a tree
@@ -86,4 +79,4 @@ pages_volatile embraces several different kinds of activity, but a high
 proportion there would also indicate poor use of madvise MADV_MERGEABLE.
 
 Izik Eidus,
-Hugh Dickins, 30 July 2009
+Hugh Dickins, 17 Nov 2009
diff --git a/Documentation/vm/page-types.c b/Documentation/vm/page-types.c
index fa1a30d9e9d5..66e9358e2144 100644
--- a/Documentation/vm/page-types.c
+++ b/Documentation/vm/page-types.c
@@ -1,8 +1,22 @@
 /*
  * page-types: Tool for querying page flags
  *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should find a copy of v2 of the GNU General Public License somewhere on
+ * your Linux system; if not, write to the Free Software Foundation, Inc., 59
+ * Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
  * Copyright (C) 2009 Intel corporation
- * Copyright (C) 2009 Wu Fengguang <fengguang.wu@intel.com>
+ *
+ * Authors: Wu Fengguang <fengguang.wu@intel.com>
  */
 
 #define _LARGEFILE64_SOURCE
@@ -69,7 +83,9 @@
 #define KPF_COMPOUND_TAIL       16
 #define KPF_HUGE                17
 #define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
 #define KPF_NOPAGE              20
+#define KPF_KSM                 21
 
 /* [32-] kernel hacking assistances */
 #define KPF_RESERVED            32
@@ -95,7 +111,7 @@
 #define BIT(name)               (1ULL << KPF_##name)
 #define BITS_COMPOUND           (BIT(COMPOUND_HEAD) | BIT(COMPOUND_TAIL))
 
-static char *page_flag_names[] = {
+static const char *page_flag_names[] = {
         [KPF_LOCKED]            = "L:locked",
         [KPF_ERROR]             = "E:error",
         [KPF_REFERENCED]        = "R:referenced",
@@ -116,7 +132,9 @@ static char *page_flag_names[] = {
         [KPF_COMPOUND_TAIL]     = "T:compound_tail",
         [KPF_HUGE]              = "G:huge",
         [KPF_UNEVICTABLE]       = "u:unevictable",
+        [KPF_HWPOISON]          = "X:hwpoison",
         [KPF_NOPAGE]            = "n:nopage",
+        [KPF_KSM]               = "x:ksm",
 
         [KPF_RESERVED]          = "r:reserved",
         [KPF_MLOCKED]           = "m:mlocked",
@@ -152,9 +170,6 @@ static unsigned long	opt_size[MAX_ADDR_RANGES];
 static int              nr_vmas;
 static unsigned long    pg_start[MAX_VMAS];
 static unsigned long    pg_end[MAX_VMAS];
-static unsigned long    voffset;
-
-static int              pagemap_fd;
 
 #define MAX_BIT_FILTERS 64
 static int              nr_bit_filters;
@@ -163,9 +178,16 @@ static uint64_t		opt_bits[MAX_BIT_FILTERS];
 
 static int              page_size;
 
-#define PAGES_BATCH     (64 << 10)      /* 64k pages */
+static int              pagemap_fd;
 static int              kpageflags_fd;
 
+static int              opt_hwpoison;
+static int              opt_unpoison;
+
+static const char       hwpoison_debug_fs[] = "/debug/hwpoison";
+static int              hwpoison_inject_fd;
+static int              hwpoison_forget_fd;
+
 #define HASH_SHIFT      13
 #define HASH_SIZE       (1 << HASH_SHIFT)
 #define HASH_MASK       (HASH_SIZE - 1)
@@ -207,6 +229,74 @@ static void fatal(const char *x, ...)
         exit(EXIT_FAILURE);
 }
 
+static int checked_open(const char *pathname, int flags)
+{
+        int fd = open(pathname, flags);
+
+        if (fd < 0) {
+                perror(pathname);
+                exit(EXIT_FAILURE);
+        }
+
+        return fd;
+}
+
+/*
+ * pagemap/kpageflags routines
+ */
+
+static unsigned long do_u64_read(int fd, char *name,
+                                 uint64_t *buf,
+                                 unsigned long index,
+                                 unsigned long count)
+{
+        long bytes;
+
+        if (index > ULONG_MAX / 8)
+                fatal("index overflow: %lu\n", index);
+
+        if (lseek(fd, index * 8, SEEK_SET) < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+
+        bytes = read(fd, buf, count * 8);
+        if (bytes < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+        if (bytes % 8)
+                fatal("partial read: %lu bytes\n", bytes);
+
+        return bytes / 8;
+}
+
+static unsigned long kpageflags_read(uint64_t *buf,
+                                     unsigned long index,
+                                     unsigned long pages)
+{
+        return do_u64_read(kpageflags_fd, PROC_KPAGEFLAGS, buf, index, pages);
+}
+
+static unsigned long pagemap_read(uint64_t *buf,
+                                  unsigned long index,
+                                  unsigned long pages)
+{
+        return do_u64_read(pagemap_fd, "/proc/pid/pagemap", buf, index, pages);
+}
+
+static unsigned long pagemap_pfn(uint64_t val)
+{
+        unsigned long pfn;
+
+        if (val & PM_PRESENT)
+                pfn = PM_PFRAME(val);
+        else
+                pfn = 0;
+
+        return pfn;
+}
+
 
 /*
  * page flag names
@@ -222,7 +312,7 @@ static char *page_flag_name(uint64_t flags)
                 present = (flags >> i) & 1;
                 if (!page_flag_names[i]) {
                         if (present)
-                                fatal("unkown flag bit %d\n", i);
+                                fatal("unknown flag bit %d\n", i);
                         continue;
                 }
                 buf[j++] = present ? page_flag_names[i][0] : '_';
@@ -255,7 +345,8 @@ static char *page_flag_longname(uint64_t flags)
  * page list and summary
  */
 
-static void show_page_range(unsigned long offset, uint64_t flags)
+static void show_page_range(unsigned long voffset,
+                            unsigned long offset, uint64_t flags)
 {
         static uint64_t      flags0;
         static unsigned long voff;
@@ -281,7 +372,8 @@ static void show_page_range(unsigned long offset, uint64_t flags)
         count  = 1;
 }
 
-static void show_page(unsigned long offset, uint64_t flags)
+static void show_page(unsigned long voffset,
+                      unsigned long offset, uint64_t flags)
 {
         if (opt_pid)
                 printf("%lx\t", voffset);
@@ -362,6 +454,62 @@ static uint64_t well_known_flags(uint64_t flags)
         return flags;
 }
 
+static uint64_t kpageflags_flags(uint64_t flags)
+{
+        flags = expand_overloaded_flags(flags);
+
+        if (!opt_raw)
+                flags = well_known_flags(flags);
+
+        return flags;
+}
+
+/*
+ * page actions
+ */
+
+static void prepare_hwpoison_fd(void)
+{
+        char buf[100];
+
+        if (opt_hwpoison && !hwpoison_inject_fd) {
+                sprintf(buf, "%s/corrupt-pfn", hwpoison_debug_fs);
+                hwpoison_inject_fd = checked_open(buf, O_WRONLY);
+        }
+
+        if (opt_unpoison && !hwpoison_forget_fd) {
+                sprintf(buf, "%s/renew-pfn", hwpoison_debug_fs);
+                hwpoison_forget_fd = checked_open(buf, O_WRONLY);
+        }
+}
+
+static int hwpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_inject_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison inject");
+                return len;
+        }
+        return 0;
+}
+
+static int unpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_forget_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison forget");
+                return len;
+        }
+        return 0;
+}
 
 /*
  * page frame walker
@@ -394,104 +542,83 @@ static int hash_slot(uint64_t flags)
         exit(EXIT_FAILURE);
 }
 
-static void add_page(unsigned long offset, uint64_t flags)
+static void add_page(unsigned long voffset,
+                     unsigned long offset, uint64_t flags)
 {
-        flags = expand_overloaded_flags(flags);
-
-        if (!opt_raw)
-                flags = well_known_flags(flags);
+        flags = kpageflags_flags(flags);
 
         if (!bit_mask_ok(flags))
                 return;
 
+        if (opt_hwpoison)
+                hwpoison_page(offset);
+        if (opt_unpoison)
+                unpoison_page(offset);
+
         if (opt_list == 1)
-                show_page_range(offset, flags);
+                show_page_range(voffset, offset, flags);
         else if (opt_list == 2)
-                show_page(offset, flags);
+                show_page(voffset, offset, flags);
 
         nr_pages[hash_slot(flags)]++;
         total_pages++;
 }
 
-static void walk_pfn(unsigned long index, unsigned long count)
+#define KPAGEFLAGS_BATCH        (64 << 10)      /* 64k pages */
+static void walk_pfn(unsigned long voffset,
+                     unsigned long index,
+                     unsigned long count)
 {
+        uint64_t buf[KPAGEFLAGS_BATCH];
         unsigned long batch;
-        unsigned long n;
+        long pages;
         unsigned long i;
 
-        if (index > ULONG_MAX / KPF_BYTES)
-                fatal("index overflow: %lu\n", index);
-
-        lseek(kpageflags_fd, index * KPF_BYTES, SEEK_SET);
-
         while (count) {
-                uint64_t kpageflags_buf[KPF_BYTES * PAGES_BATCH];
-
-                batch = min_t(unsigned long, count, PAGES_BATCH);
-                n = read(kpageflags_fd, kpageflags_buf, batch * KPF_BYTES);
-                if (n == 0)
+                batch = min_t(unsigned long, count, KPAGEFLAGS_BATCH);
+                pages = kpageflags_read(buf, index, batch);
+                if (pages == 0)
                         break;
-                if (n < 0) {
-                        perror(PROC_KPAGEFLAGS);
-                        exit(EXIT_FAILURE);
-                }
 
-                if (n % KPF_BYTES != 0)
-                        fatal("partial read: %lu bytes\n", n);
-                n = n / KPF_BYTES;
+                for (i = 0; i < pages; i++)
+                        add_page(voffset + i, index + i, buf[i]);
 
-                for (i = 0; i < n; i++)
-                        add_page(index + i, kpageflags_buf[i]);
-
-                index += batch;
-                count -= batch;
+                index += pages;
+                count -= pages;
         }
 }
 
-
-#define PAGEMAP_BATCH   4096
-static unsigned long task_pfn(unsigned long pgoff)
+#define PAGEMAP_BATCH   (64 << 10)
+static void walk_vma(unsigned long index, unsigned long count)
 {
-        static uint64_t buf[PAGEMAP_BATCH];
-        static unsigned long start;
-        static long count;
-        uint64_t pfn;
+        uint64_t buf[PAGEMAP_BATCH];
+        unsigned long batch;
+        unsigned long pages;
+        unsigned long pfn;
+        unsigned long i;
 
-        if (pgoff < start || pgoff >= start + count) {
-                if (lseek64(pagemap_fd,
-                            (uint64_t)pgoff * PM_ENTRY_BYTES,
-                            SEEK_SET) < 0) {
-                        perror("pagemap seek");
-                        exit(EXIT_FAILURE);
-                }
-                count = read(pagemap_fd, buf, sizeof(buf));
-                if (count == 0)
-                        return 0;
-                if (count < 0) {
-                        perror("pagemap read");
-                        exit(EXIT_FAILURE);
-                }
-                if (count % PM_ENTRY_BYTES) {
-                        fatal("pagemap read not aligned.\n");
-                        exit(EXIT_FAILURE);
-                }
-                count /= PM_ENTRY_BYTES;
-                start = pgoff;
-        }
+        while (count) {
+                batch = min_t(unsigned long, count, PAGEMAP_BATCH);
+                pages = pagemap_read(buf, index, batch);
+                if (pages == 0)
+                        break;
 
-        pfn = buf[pgoff - start];
-        if (pfn & PM_PRESENT)
-                pfn = PM_PFRAME(pfn);
-        else
-                pfn = 0;
+                for (i = 0; i < pages; i++) {
+                        pfn = pagemap_pfn(buf[i]);
+                        if (pfn)
+                                walk_pfn(index + i, pfn, 1);
+                }
 
-        return pfn;
+                index += pages;
+                count -= pages;
+        }
 }
 
 static void walk_task(unsigned long index, unsigned long count)
 {
-        int i = 0;
         const unsigned long end = index + count;
+        unsigned long start;
+        int i = 0;
 
         while (index < end) {
 
@@ -501,15 +628,11 @@ static void walk_task(unsigned long index, unsigned long count)
                 if (pg_start[i] >= end)
                         return;
 
-                voffset = max_t(unsigned long, pg_start[i], index);
-                index   = min_t(unsigned long, pg_end[i], end);
+                start = max_t(unsigned long, pg_start[i], index);
+                index = min_t(unsigned long, pg_end[i], end);
 
-                assert(voffset < index);
-                for (; voffset < index; voffset++) {
-                        unsigned long pfn = task_pfn(voffset);
-                        if (pfn)
-                                walk_pfn(pfn, 1);
-                }
+                assert(start < index);
+                walk_vma(start, index - start);
         }
 }
 
@@ -527,18 +650,14 @@ static void walk_addr_ranges(void)
 {
         int i;
 
-        kpageflags_fd = open(PROC_KPAGEFLAGS, O_RDONLY);
-        if (kpageflags_fd < 0) {
-                perror(PROC_KPAGEFLAGS);
-                exit(EXIT_FAILURE);
-        }
+        kpageflags_fd = checked_open(PROC_KPAGEFLAGS, O_RDONLY);
 
         if (!nr_addr_ranges)
                 add_addr_range(0, ULONG_MAX);
 
         for (i = 0; i < nr_addr_ranges; i++)
                 if (!opt_pid)
-                        walk_pfn(opt_offset[i], opt_size[i]);
+                        walk_pfn(0, opt_offset[i], opt_size[i]);
                 else
                         walk_task(opt_offset[i], opt_size[i]);
 
@@ -565,28 +684,35 @@ static void usage(void)
 
         printf(
 "page-types [options]\n"
-"            -r|--raw                  Raw mode, for kernel developers\n"
-"            -a|--addr    addr-spec    Walk a range of pages\n"
-"            -b|--bits    bits-spec    Walk pages with specified bits\n"
-"            -p|--pid     pid          Walk process address space\n"
+"            -r|--raw                   Raw mode, for kernel developers\n"
+"            -d|--describe flags        Describe flags\n"
+"            -a|--addr    addr-spec     Walk a range of pages\n"
+"            -b|--bits    bits-spec     Walk pages with specified bits\n"
+"            -p|--pid     pid           Walk process address space\n"
 #if 0 /* planned features */
-"            -f|--file    filename     Walk file address space\n"
+"            -f|--file    filename      Walk file address space\n"
 #endif
-"            -l|--list                 Show page details in ranges\n"
-"            -L|--list-each            Show page details one by one\n"
-"            -N|--no-summary           Don't show summay info\n"
-"            -h|--help                 Show this usage message\n"
+"            -l|--list                  Show page details in ranges\n"
+"            -L|--list-each             Show page details one by one\n"
+"            -N|--no-summary            Don't show summay info\n"
+"            -X|--hwpoison              hwpoison pages\n"
+"            -x|--unpoison              unpoison pages\n"
+"            -h|--help                  Show this usage message\n"
+"flags:\n"
+"            0x10                       bitfield format, e.g.\n"
+"            anon                       bit-name, e.g.\n"
+"            0x10,anon                  comma-separated list, e.g.\n"
 "addr-spec:\n"
-"            N                         one page at offset N (unit: pages)\n"
-"            N+M                       pages range from N to N+M-1\n"
-"            N,M                       pages range from N to M-1\n"
-"            N,                        pages range from N to end\n"
-"            ,M                        pages range from 0 to M-1\n"
+"            N                          one page at offset N (unit: pages)\n"
+"            N+M                        pages range from N to N+M-1\n"
+"            N,M                        pages range from N to M-1\n"
+"            N,                         pages range from N to end\n"
+"            ,M                         pages range from 0 to M-1\n"
 "bits-spec:\n"
-"            bit1,bit2                 (flags & (bit1|bit2)) != 0\n"
-"            bit1,bit2=bit1            (flags & (bit1|bit2)) == bit1\n"
-"            bit1,~bit2                (flags & (bit1|bit2)) == bit1\n"
-"            =bit1,bit2                flags == (bit1|bit2)\n"
+"            bit1,bit2                  (flags & (bit1|bit2)) != 0\n"
+"            bit1,bit2=bit1             (flags & (bit1|bit2)) == bit1\n"
+"            bit1,~bit2                 (flags & (bit1|bit2)) == bit1\n"
+"            =bit1,bit2                 flags == (bit1|bit2)\n"
 "bit-names:\n"
         );
 
@@ -624,11 +750,7 @@ static void parse_pid(const char *str)
         opt_pid = parse_number(str);
 
         sprintf(buf, "/proc/%d/pagemap", opt_pid);
-        pagemap_fd = open(buf, O_RDONLY);
-        if (pagemap_fd < 0) {
-                perror(buf);
-                exit(EXIT_FAILURE);
-        }
+        pagemap_fd = checked_open(buf, O_RDONLY);
 
         sprintf(buf, "/proc/%d/maps", opt_pid);
         file = fopen(buf, "r");
@@ -778,16 +900,28 @@ static void parse_bits_mask(const char *optarg)
         add_bits_filter(mask, bits);
 }
 
+static void describe_flags(const char *optarg)
+{
+        uint64_t flags = parse_flag_names(optarg, 0);
+
+        printf("0x%016llx\t%s\t%s\n",
+                (unsigned long long)flags,
+                page_flag_name(flags),
+                page_flag_longname(flags));
+}
 
-static struct option opts[] = {
+static const struct option opts[] = {
         { "raw"       , 0, NULL, 'r' },
         { "pid"       , 1, NULL, 'p' },
         { "file"      , 1, NULL, 'f' },
         { "addr"      , 1, NULL, 'a' },
         { "bits"      , 1, NULL, 'b' },
+        { "describe"  , 1, NULL, 'd' },
         { "list"      , 0, NULL, 'l' },
         { "list-each" , 0, NULL, 'L' },
         { "no-summary", 0, NULL, 'N' },
+        { "hwpoison"  , 0, NULL, 'X' },
+        { "unpoison"  , 0, NULL, 'x' },
         { "help"      , 0, NULL, 'h' },
         { NULL        , 0, NULL, 0 }
 };
@@ -799,7 +933,7 @@ int main(int argc, char *argv[])
         page_size = getpagesize();
 
         while ((c = getopt_long(argc, argv,
-                                "rp:f:a:b:lLNh", opts, NULL)) != -1) {
+                                "rp:f:a:b:d:lLNXxh", opts, NULL)) != -1) {
                 switch (c) {
                 case 'r':
                         opt_raw = 1;
@@ -816,6 +950,9 @@ int main(int argc, char *argv[])
                 case 'b':
                         parse_bits_mask(optarg);
                         break;
+                case 'd':
+                        describe_flags(optarg);
+                        exit(0);
                 case 'l':
                         opt_list = 1;
                         break;
@@ -825,6 +962,14 @@ int main(int argc, char *argv[])
                 case 'N':
                         opt_no_summary = 1;
                         break;
+                case 'X':
+                        opt_hwpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
+                case 'x':
+                        opt_unpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
                 case 'h':
                         usage();
                         exit(0);
@@ -844,7 +989,7 @@ int main(int argc, char *argv[])
         walk_addr_ranges();
 
         if (opt_list == 1)
-                show_page_range(0, 0);  /* drain the buffer */
+                show_page_range(0, 0, 0);  /* drain the buffer */
 
         if (opt_no_summary)
                 return 0;
diff --git a/Documentation/vm/pagemap.txt b/Documentation/vm/pagemap.txt
index 600a304a828c..df09b9650a81 100644
--- a/Documentation/vm/pagemap.txt
+++ b/Documentation/vm/pagemap.txt
@@ -57,7 +57,9 @@ There are three components to pagemap:
     16. COMPOUND_TAIL
     16. HUGE
     18. UNEVICTABLE
+    19. HWPOISON
     20. NOPAGE
+    21. KSM
 
 Short descriptions to the page flags:
 
@@ -86,9 +88,15 @@ Short descriptions to the page flags:
 17. HUGE
     this is an integral part of a HugeTLB page
 
+19. HWPOISON
+    hardware detected memory corruption on this page: don't touch the data!
+
 20. NOPAGE
     no page frame exists at the requested address
 
+21. KSM
+    identical memory pages dynamically shared between one or more processes
+
     [IO related page flags]
  1. ERROR     IO error occurred
  3. UPTODATE  page has up-to-date data
diff --git a/Documentation/vm/slub.txt b/Documentation/vm/slub.txt
index 510917ff59ed..b37300edf27c 100644
--- a/Documentation/vm/slub.txt
+++ b/Documentation/vm/slub.txt
@@ -245,7 +245,7 @@ been overwritten. Here a string of 8 characters was written into a slab that
 has the length of 8 characters. However, a 8 character string needs a
 terminating 0. That zero has overwritten the first byte of the Redzone field.
 After reporting the details of the issue encountered the FIX SLUB message
-tell us that SLUB has restored the Redzone to its proper value and then
+tells us that SLUB has restored the Redzone to its proper value and then
 system operations continue.
 
 Emergency operations: