21 files changed, 334 insertions, 173 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index aa799007a11b..efee5d379df4 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -77,6 +77,9 @@ config FLAT_NODE_MEM_MAP
         def_bool y
         depends on !SPARSEMEM
 
+config HAVE_GET_USER_PAGES_FAST
+        bool
+
 #
 # Both the NUMA code and DISCONTIGMEM use arrays of pg_data_t's
 # to represent different areas of memory.  This variable allows
diff --git a/mm/allocpercpu.c b/mm/allocpercpu.c
index 843364594e23..4297bc41bfd2 100644
--- a/mm/allocpercpu.c
+++ b/mm/allocpercpu.c
@@ -18,27 +18,28 @@
  * Depopulating per-cpu data for a cpu going offline would be a typical
  * use case. You need to register a cpu hotplug handler for that purpose.
  */
-void percpu_depopulate(void *__pdata, int cpu)
+static void percpu_depopulate(void *__pdata, int cpu)
 {
         struct percpu_data *pdata = __percpu_disguise(__pdata);
 
         kfree(pdata->ptrs[cpu]);
         pdata->ptrs[cpu] = NULL;
 }
-EXPORT_SYMBOL_GPL(percpu_depopulate);
 
 /**
  * percpu_depopulate_mask - depopulate per-cpu data for some cpu's
  * @__pdata: per-cpu data to depopulate
  * @mask: depopulate per-cpu data for cpu's selected through mask bits
  */
-void __percpu_depopulate_mask(void *__pdata, cpumask_t *mask)
+static void __percpu_depopulate_mask(void *__pdata, cpumask_t *mask)
 {
         int cpu;
         for_each_cpu_mask_nr(cpu, *mask)
                 percpu_depopulate(__pdata, cpu);
 }
-EXPORT_SYMBOL_GPL(__percpu_depopulate_mask);
+
+#define percpu_depopulate_mask(__pdata, mask) \
+        __percpu_depopulate_mask((__pdata), &(mask))
 
 /**
  * percpu_populate - populate per-cpu data for given cpu
@@ -51,7 +52,7 @@ EXPORT_SYMBOL_GPL(__percpu_depopulate_mask);
  * use case. You need to register a cpu hotplug handler for that purpose.
  * Per-cpu object is populated with zeroed buffer.
  */
-void *percpu_populate(void *__pdata, size_t size, gfp_t gfp, int cpu)
+static void *percpu_populate(void *__pdata, size_t size, gfp_t gfp, int cpu)
 {
         struct percpu_data *pdata = __percpu_disguise(__pdata);
         int node = cpu_to_node(cpu);
@@ -68,7 +69,6 @@ void *percpu_populate(void *__pdata, size_t size, gfp_t gfp, int cpu)
                 pdata->ptrs[cpu] = kzalloc(size, gfp);
         return pdata->ptrs[cpu];
 }
-EXPORT_SYMBOL_GPL(percpu_populate);
 
 /**
  * percpu_populate_mask - populate per-cpu data for more cpu's
@@ -79,8 +79,8 @@ EXPORT_SYMBOL_GPL(percpu_populate);
  *
  * Per-cpu objects are populated with zeroed buffers.
  */
-int __percpu_populate_mask(void *__pdata, size_t size, gfp_t gfp,
-                           cpumask_t *mask)
+static int __percpu_populate_mask(void *__pdata, size_t size, gfp_t gfp,
+                                  cpumask_t *mask)
 {
         cpumask_t populated;
         int cpu;
@@ -94,7 +94,9 @@ int __percpu_populate_mask(void *__pdata, size_t size, gfp_t gfp,
                         cpu_set(cpu, populated);
         return 0;
 }
-EXPORT_SYMBOL_GPL(__percpu_populate_mask);
+
+#define percpu_populate_mask(__pdata, size, gfp, mask) \
+        __percpu_populate_mask((__pdata), (size), (gfp), &(mask))
 
 /**
  * percpu_alloc_mask - initial setup of per-cpu data
diff --git a/mm/filemap.c b/mm/filemap.c
index 2d3ec1ffc66e..2ed8b0389c51 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -109,7 +109,7 @@
 /*
  * Remove a page from the page cache and free it. Caller has to make
  * sure the page is locked and that nobody else uses it - or that usage
- * is safe.  The caller must hold a write_lock on the mapping's tree_lock.
+ * is safe.  The caller must hold the mapping's tree_lock.
  */
 void __remove_from_page_cache(struct page *page)
 {
@@ -141,9 +141,9 @@ void remove_from_page_cache(struct page *page)
 
         BUG_ON(!PageLocked(page));
 
-        write_lock_irq(&mapping->tree_lock);
+        spin_lock_irq(&mapping->tree_lock);
         __remove_from_page_cache(page);
-        write_unlock_irq(&mapping->tree_lock);
+        spin_unlock_irq(&mapping->tree_lock);
 }
 
 static int sync_page(void *word)
@@ -442,48 +442,52 @@ int filemap_write_and_wait_range(struct address_space *mapping,
 }
 
 /**
- * add_to_page_cache - add newly allocated pagecache pages
+ * add_to_page_cache_locked - add a locked page to the pagecache
  * @page:       page to add
  * @mapping:    the page's address_space
  * @offset:     page index
  * @gfp_mask:   page allocation mode
  *
- * This function is used to add newly allocated pagecache pages;
- * the page is new, so we can just run SetPageLocked() against it.
- * The other page state flags were set by rmqueue().
- *
+ * This function is used to add a page to the pagecache. It must be locked.
  * This function does not add the page to the LRU.  The caller must do that.
  */
-int add_to_page_cache(struct page *page, struct address_space *mapping,
+int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
                 pgoff_t offset, gfp_t gfp_mask)
 {
-        int error = mem_cgroup_cache_charge(page, current->mm,
+        int error;
+
+        VM_BUG_ON(!PageLocked(page));
+
+        error = mem_cgroup_cache_charge(page, current->mm,
                                         gfp_mask & ~__GFP_HIGHMEM);
         if (error)
                 goto out;
 
         error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
         if (error == 0) {
-                write_lock_irq(&mapping->tree_lock);
+                page_cache_get(page);
+                page->mapping = mapping;
+                page->index = offset;
+
+                spin_lock_irq(&mapping->tree_lock);
                 error = radix_tree_insert(&mapping->page_tree, offset, page);
-                if (!error) {
-                        page_cache_get(page);
-                        SetPageLocked(page);
-                        page->mapping = mapping;
-                        page->index = offset;
+                if (likely(!error)) {
                         mapping->nrpages++;
                         __inc_zone_page_state(page, NR_FILE_PAGES);
-                } else
+                } else {
+                        page->mapping = NULL;
                         mem_cgroup_uncharge_cache_page(page);
+                        page_cache_release(page);
+                }
 
-                write_unlock_irq(&mapping->tree_lock);
+                spin_unlock_irq(&mapping->tree_lock);
                 radix_tree_preload_end();
         } else
                 mem_cgroup_uncharge_cache_page(page);
 out:
         return error;
 }
-EXPORT_SYMBOL(add_to_page_cache);
+EXPORT_SYMBOL(add_to_page_cache_locked);
 
 int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
                                 pgoff_t offset, gfp_t gfp_mask)
@@ -633,15 +637,35 @@ void __lock_page_nosync(struct page *page)
  * Is there a pagecache struct page at the given (mapping, offset) tuple?
  * If yes, increment its refcount and return it; if no, return NULL.
  */
-struct page * find_get_page(struct address_space *mapping, pgoff_t offset)
+struct page *find_get_page(struct address_space *mapping, pgoff_t offset)
 {
+        void **pagep;
         struct page *page;
 
-        read_lock_irq(&mapping->tree_lock);
-        page = radix_tree_lookup(&mapping->page_tree, offset);
-        if (page)
-                page_cache_get(page);
-        read_unlock_irq(&mapping->tree_lock);
+        rcu_read_lock();
+repeat:
+        page = NULL;
+        pagep = radix_tree_lookup_slot(&mapping->page_tree, offset);
+        if (pagep) {
+                page = radix_tree_deref_slot(pagep);
+                if (unlikely(!page || page == RADIX_TREE_RETRY))
+                        goto repeat;
+
+                if (!page_cache_get_speculative(page))
+                        goto repeat;
+
+                /*
+                 * Has the page moved?
+                 * This is part of the lockless pagecache protocol. See
+                 * include/linux/pagemap.h for details.
+                 */
+                if (unlikely(page != *pagep)) {
+                        page_cache_release(page);
+                        goto repeat;
+                }
+        }
+        rcu_read_unlock();
+
         return page;
 }
 EXPORT_SYMBOL(find_get_page);
@@ -656,32 +680,22 @@ EXPORT_SYMBOL(find_get_page);
  *
  * Returns zero if the page was not present. find_lock_page() may sleep.
  */
-struct page *find_lock_page(struct address_space *mapping,
-                                pgoff_t offset)
+struct page *find_lock_page(struct address_space *mapping, pgoff_t offset)
 {
         struct page *page;
 
 repeat:
-        read_lock_irq(&mapping->tree_lock);
-        page = radix_tree_lookup(&mapping->page_tree, offset);
+        page = find_get_page(mapping, offset);
         if (page) {
-                page_cache_get(page);
-                if (TestSetPageLocked(page)) {
-                        read_unlock_irq(&mapping->tree_lock);
-                        __lock_page(page);
-
-                        /* Has the page been truncated while we slept? */
-                        if (unlikely(page->mapping != mapping)) {
-                                unlock_page(page);
-                                page_cache_release(page);
-                                goto repeat;
-                        }
-                        VM_BUG_ON(page->index != offset);
-                        goto out;
+                lock_page(page);
+                /* Has the page been truncated? */
+                if (unlikely(page->mapping != mapping)) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto repeat;
                 }
+                VM_BUG_ON(page->index != offset);
         }
-        read_unlock_irq(&mapping->tree_lock);
-out:
         return page;
 }
 EXPORT_SYMBOL(find_lock_page);
@@ -747,13 +761,39 @@ unsigned find_get_pages(struct address_space *mapping, pgoff_t start,
 {
         unsigned int i;
         unsigned int ret;
+        unsigned int nr_found;
+
+        rcu_read_lock();
+restart:
+        nr_found = radix_tree_gang_lookup_slot(&mapping->page_tree,
+                                (void ***)pages, start, nr_pages);
+        ret = 0;
+        for (i = 0; i < nr_found; i++) {
+                struct page *page;
+repeat:
+                page = radix_tree_deref_slot((void **)pages[i]);
+                if (unlikely(!page))
+                        continue;
+                /*
+                 * this can only trigger if nr_found == 1, making livelock
+                 * a non issue.
+                 */
+                if (unlikely(page == RADIX_TREE_RETRY))
+                        goto restart;
 
-        read_lock_irq(&mapping->tree_lock);
-        ret = radix_tree_gang_lookup(&mapping->page_tree,
-                                (void **)pages, start, nr_pages);
-        for (i = 0; i < ret; i++)
-                page_cache_get(pages[i]);
-        read_unlock_irq(&mapping->tree_lock);
+                if (!page_cache_get_speculative(page))
+                        goto repeat;
+
+                /* Has the page moved? */
+                if (unlikely(page != *((void **)pages[i]))) {
+                        page_cache_release(page);
+                        goto repeat;
+                }
+
+                pages[ret] = page;
+                ret++;
+        }
+        rcu_read_unlock();
         return ret;
 }
 
@@ -774,19 +814,44 @@ unsigned find_get_pages_contig(struct address_space *mapping, pgoff_t index,
 {
         unsigned int i;
         unsigned int ret;
+        unsigned int nr_found;
+
+        rcu_read_lock();
+restart:
+        nr_found = radix_tree_gang_lookup_slot(&mapping->page_tree,
+                                (void ***)pages, index, nr_pages);
+        ret = 0;
+        for (i = 0; i < nr_found; i++) {
+                struct page *page;
+repeat:
+                page = radix_tree_deref_slot((void **)pages[i]);
+                if (unlikely(!page))
+                        continue;
+                /*
+                 * this can only trigger if nr_found == 1, making livelock
+                 * a non issue.
+                 */
+                if (unlikely(page == RADIX_TREE_RETRY))
+                        goto restart;
 
-        read_lock_irq(&mapping->tree_lock);
-        ret = radix_tree_gang_lookup(&mapping->page_tree,
-                                (void **)pages, index, nr_pages);
-        for (i = 0; i < ret; i++) {
-                if (pages[i]->mapping == NULL || pages[i]->index != index)
+                if (page->mapping == NULL || page->index != index)
                         break;
 
-                page_cache_get(pages[i]);
+                if (!page_cache_get_speculative(page))
+                        goto repeat;
+
+                /* Has the page moved? */
+                if (unlikely(page != *((void **)pages[i]))) {
+                        page_cache_release(page);
+                        goto repeat;
+                }
+
+                pages[ret] = page;
+                ret++;
                 index++;
         }
-        read_unlock_irq(&mapping->tree_lock);
-        return i;
+        rcu_read_unlock();
+        return ret;
 }
 EXPORT_SYMBOL(find_get_pages_contig);
 
@@ -806,15 +871,43 @@ unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index,
 {
         unsigned int i;
         unsigned int ret;
+        unsigned int nr_found;
+
+        rcu_read_lock();
+restart:
+        nr_found = radix_tree_gang_lookup_tag_slot(&mapping->page_tree,
+                                (void ***)pages, *index, nr_pages, tag);
+        ret = 0;
+        for (i = 0; i < nr_found; i++) {
+                struct page *page;
+repeat:
+                page = radix_tree_deref_slot((void **)pages[i]);
+                if (unlikely(!page))
+                        continue;
+                /*
+                 * this can only trigger if nr_found == 1, making livelock
+                 * a non issue.
+                 */
+                if (unlikely(page == RADIX_TREE_RETRY))
+                        goto restart;
+
+                if (!page_cache_get_speculative(page))
+                        goto repeat;
+
+                /* Has the page moved? */
+                if (unlikely(page != *((void **)pages[i]))) {
+                        page_cache_release(page);
+                        goto repeat;
+                }
+
+                pages[ret] = page;
+                ret++;
+        }
+        rcu_read_unlock();
 
-        read_lock_irq(&mapping->tree_lock);
-        ret = radix_tree_gang_lookup_tag(&mapping->page_tree,
-                                (void **)pages, *index, nr_pages, tag);
-        for (i = 0; i < ret; i++)
-                page_cache_get(pages[i]);
         if (ret)
                 *index = pages[ret - 1]->index + 1;
-        read_unlock_irq(&mapping->tree_lock);
+
         return ret;
 }
 EXPORT_SYMBOL(find_get_pages_tag);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a8bf4ab01f86..3be79dc18c5c 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1026,18 +1026,6 @@ static void __init report_hugepages(void)
         }
 }
 
-static unsigned int cpuset_mems_nr(unsigned int *array)
-{
-        int node;
-        unsigned int nr = 0;
-
-        for_each_node_mask(node, cpuset_current_mems_allowed)
-                nr += array[node];
-
-        return nr;
-}
-
-#ifdef CONFIG_SYSCTL
 #ifdef CONFIG_HIGHMEM
 static void try_to_free_low(struct hstate *h, unsigned long count)
 {
@@ -1386,6 +1374,18 @@ static int __init hugetlb_default_setup(char *s)
 }
 __setup("default_hugepagesz=", hugetlb_default_setup);
 
+static unsigned int cpuset_mems_nr(unsigned int *array)
+{
+        int node;
+        unsigned int nr = 0;
+
+        for_each_node_mask(node, cpuset_current_mems_allowed)
+                nr += array[node];
+
+        return nr;
+}
+
+#ifdef CONFIG_SYSCTL
 int hugetlb_sysctl_handler(struct ctl_table *table, int write,
                            struct file *file, void __user *buffer,
                            size_t *length, loff_t *ppos)
diff --git a/mm/memory.c b/mm/memory.c
index 262e3eb6601a..a8ca04faaea6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -374,7 +374,8 @@ static inline void add_mm_rss(struct mm_struct *mm, int file_rss, int anon_rss)
  *
  * The calling function must still handle the error.
  */
-void print_bad_pte(struct vm_area_struct *vma, pte_t pte, unsigned long vaddr)
+static void print_bad_pte(struct vm_area_struct *vma, pte_t pte,
+                          unsigned long vaddr)
 {
         printk(KERN_ERR "Bad pte = %08llx, process = %s, "
                         "vm_flags = %lx, vaddr = %lx\n",
diff --git a/mm/migrate.c b/mm/migrate.c
index d8c65a65c61d..153572fb60b8 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -285,7 +285,15 @@ void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
 
         page = migration_entry_to_page(entry);
 
-        get_page(page);
+        /*
+         * Once radix-tree replacement of page migration started, page_count
+         * *must* be zero. And, we don't want to call wait_on_page_locked()
+         * against a page without get_page().
+         * So, we use get_page_unless_zero(), here. Even failed, page fault
+         * will occur again.
+         */
+        if (!get_page_unless_zero(page))
+                goto out;
         pte_unmap_unlock(ptep, ptl);
         wait_on_page_locked(page);
         put_page(page);
@@ -305,6 +313,7 @@ out:
 static int migrate_page_move_mapping(struct address_space *mapping,
                 struct page *newpage, struct page *page)
 {
+        int expected_count;
         void **pslot;
 
         if (!mapping) {
@@ -314,14 +323,20 @@ static int migrate_page_move_mapping(struct address_space *mapping,
                 return 0;
         }
 
-        write_lock_irq(&mapping->tree_lock);
+        spin_lock_irq(&mapping->tree_lock);
 
         pslot = radix_tree_lookup_slot(&mapping->page_tree,
                                         page_index(page));
 
-        if (page_count(page) != 2 + !!PagePrivate(page) ||
+        expected_count = 2 + !!PagePrivate(page);
+        if (page_count(page) != expected_count ||
                         (struct page *)radix_tree_deref_slot(pslot) != page) {
-                write_unlock_irq(&mapping->tree_lock);
+                spin_unlock_irq(&mapping->tree_lock);
+                return -EAGAIN;
+        }
+
+        if (!page_freeze_refs(page, expected_count)) {
+                spin_unlock_irq(&mapping->tree_lock);
                 return -EAGAIN;
         }
 
@@ -338,6 +353,7 @@ static int migrate_page_move_mapping(struct address_space *mapping,
 
         radix_tree_replace_slot(pslot, newpage);
 
+        page_unfreeze_refs(page, expected_count);
         /*
          * Drop cache reference from old page.
          * We know this isn't the last reference.
@@ -357,10 +373,9 @@ static int migrate_page_move_mapping(struct address_space *mapping,
         __dec_zone_page_state(page, NR_FILE_PAGES);
         __inc_zone_page_state(newpage, NR_FILE_PAGES);
 
-        write_unlock_irq(&mapping->tree_lock);
-        if (!PageSwapCache(newpage)) {
+        spin_unlock_irq(&mapping->tree_lock);
+        if (!PageSwapCache(newpage))
                 mem_cgroup_uncharge_cache_page(page);
-        }
 
         return 0;
 }
diff --git a/mm/nommu.c b/mm/nommu.c
index 4462b6a3fcb9..5edccd9c9218 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -22,7 +22,7 @@
 #include <linux/pagemap.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
-#include <linux/ptrace.h>
+#include <linux/tracehook.h>
 #include <linux/blkdev.h>
 #include <linux/backing-dev.h>
 #include <linux/mount.h>
@@ -745,7 +745,7 @@ static unsigned long determine_vm_flags(struct file *file,
          * it's being traced - otherwise breakpoints set in it may interfere
          * with another untraced process
          */
-        if ((flags & MAP_PRIVATE) && (current->ptrace & PT_PTRACED))
+        if ((flags & MAP_PRIVATE) && tracehook_expect_breakpoints(current))
                 vm_flags &= ~VM_MAYSHARE;
 
         return vm_flags;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 94c6d8988ab3..24de8b65fdbd 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1088,7 +1088,7 @@ int __set_page_dirty_nobuffers(struct page *page)
                 if (!mapping)
                         return 1;
 
-                write_lock_irq(&mapping->tree_lock);
+                spin_lock_irq(&mapping->tree_lock);
                 mapping2 = page_mapping(page);
                 if (mapping2) { /* Race with truncate? */
                         BUG_ON(mapping2 != mapping);
@@ -1102,7 +1102,7 @@ int __set_page_dirty_nobuffers(struct page *page)
                         radix_tree_tag_set(&mapping->page_tree,
                                 page_index(page), PAGECACHE_TAG_DIRTY);
                 }
-                write_unlock_irq(&mapping->tree_lock);
+                spin_unlock_irq(&mapping->tree_lock);
                 if (mapping->host) {
                         /* !PageAnon && !swapper_space */
                         __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
@@ -1258,7 +1258,7 @@ int test_clear_page_writeback(struct page *page)
                 struct backing_dev_info *bdi = mapping->backing_dev_info;
                 unsigned long flags;
 
-                write_lock_irqsave(&mapping->tree_lock, flags);
+                spin_lock_irqsave(&mapping->tree_lock, flags);
                 ret = TestClearPageWriteback(page);
                 if (ret) {
                         radix_tree_tag_clear(&mapping->page_tree,
@@ -1269,7 +1269,7 @@ int test_clear_page_writeback(struct page *page)
                                 __bdi_writeout_inc(bdi);
                         }
                 }
-                write_unlock_irqrestore(&mapping->tree_lock, flags);
+                spin_unlock_irqrestore(&mapping->tree_lock, flags);
         } else {
                 ret = TestClearPageWriteback(page);
         }
@@ -1287,7 +1287,7 @@ int test_set_page_writeback(struct page *page)
                 struct backing_dev_info *bdi = mapping->backing_dev_info;
                 unsigned long flags;
 
-                write_lock_irqsave(&mapping->tree_lock, flags);
+                spin_lock_irqsave(&mapping->tree_lock, flags);
                 ret = TestSetPageWriteback(page);
                 if (!ret) {
                         radix_tree_tag_set(&mapping->page_tree,
@@ -1300,7 +1300,7 @@ int test_set_page_writeback(struct page *page)
                         radix_tree_tag_clear(&mapping->page_tree,
                                                 page_index(page),
                                                 PAGECACHE_TAG_DIRTY);
-                write_unlock_irqrestore(&mapping->tree_lock, flags);
+                spin_unlock_irqrestore(&mapping->tree_lock, flags);
         } else {
                 ret = TestSetPageWriteback(page);
         }
diff --git a/mm/readahead.c b/mm/readahead.c
index d8723a5f6496..77e8ddf945e9 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -382,9 +382,9 @@ ondemand_readahead(struct address_space *mapping,
         if (hit_readahead_marker) {
                 pgoff_t start;
 
-                read_lock_irq(&mapping->tree_lock);
-                start = radix_tree_next_hole(&mapping->page_tree, offset, max+1);
-                read_unlock_irq(&mapping->tree_lock);
+                rcu_read_lock();
+                start = radix_tree_next_hole(&mapping->page_tree, offset,max+1);
+                rcu_read_unlock();
 
                 if (!start || start - offset > max)
                         return 0;
diff --git a/mm/rmap.c b/mm/rmap.c
index abbd29f7c43f..39ae5a9bf382 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -138,7 +138,7 @@ void anon_vma_unlink(struct vm_area_struct *vma)
                 anon_vma_free(anon_vma);
 }
 
-static void anon_vma_ctor(struct kmem_cache *cachep, void *data)
+static void anon_vma_ctor(void *data)
 {
         struct anon_vma *anon_vma = data;
 
diff --git a/mm/shmem.c b/mm/shmem.c
index f92fea94d037..952d361774bb 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -936,7 +936,7 @@ found:
         spin_lock(&info->lock);
         ptr = shmem_swp_entry(info, idx, NULL);
         if (ptr && ptr->val == entry.val) {
-                error = add_to_page_cache(page, inode->i_mapping,
+                error = add_to_page_cache_locked(page, inode->i_mapping,
                                                 idx, GFP_NOWAIT);
                 /* does mem_cgroup_uncharge_cache_page on error */
         } else  /* we must compensate for our precharge above */
@@ -1301,8 +1301,8 @@ repeat:
                         SetPageUptodate(filepage);
                         set_page_dirty(filepage);
                         swap_free(swap);
-                } else if (!(error = add_to_page_cache(
-                                swappage, mapping, idx, GFP_NOWAIT))) {
+                } else if (!(error = add_to_page_cache_locked(swappage, mapping,
+                                        idx, GFP_NOWAIT))) {
                         info->flags |= SHMEM_PAGEIN;
                         shmem_swp_set(info, entry, 0);
                         shmem_swp_unmap(entry);
@@ -2352,7 +2352,7 @@ static void shmem_destroy_inode(struct inode *inode)
         kmem_cache_free(shmem_inode_cachep, SHMEM_I(inode));
 }
 
-static void init_once(struct kmem_cache *cachep, void *foo)
+static void init_once(void *foo)
 {
         struct shmem_inode_info *p = (struct shmem_inode_info *) foo;
 
diff --git a/mm/slab.c b/mm/slab.c
index 052e7d64537e..918f04f7fef1 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -406,7 +406,7 @@ struct kmem_cache {
         unsigned int dflags;            /* dynamic flags */
 
         /* constructor func */
-        void (*ctor)(struct kmem_cache *, void *);
+        void (*ctor)(void *obj);
 
 /* 5) cache creation/removal */
         const char *name;
@@ -2137,8 +2137,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep)
  */
 struct kmem_cache *
 kmem_cache_create (const char *name, size_t size, size_t align,
-        unsigned long flags,
-        void (*ctor)(struct kmem_cache *, void *))
+        unsigned long flags, void (*ctor)(void *))
 {
         size_t left_over, slab_size, ralign;
         struct kmem_cache *cachep = NULL, *pc;
@@ -2653,7 +2652,7 @@ static void cache_init_objs(struct kmem_cache *cachep,
                  * They must also be threaded.
                  */
                 if (cachep->ctor && !(cachep->flags & SLAB_POISON))
-                        cachep->ctor(cachep, objp + obj_offset(cachep));
+                        cachep->ctor(objp + obj_offset(cachep));
 
                 if (cachep->flags & SLAB_RED_ZONE) {
                         if (*dbg_redzone2(cachep, objp) != RED_INACTIVE)
@@ -2669,7 +2668,7 @@ static void cache_init_objs(struct kmem_cache *cachep,
                                          cachep->buffer_size / PAGE_SIZE, 0);
 #else
                 if (cachep->ctor)
-                        cachep->ctor(cachep, objp);
+                        cachep->ctor(objp);
 #endif
                 slab_bufctl(slabp)[i] = i + 1;
         }
@@ -3093,7 +3092,7 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
 #endif
         objp += obj_offset(cachep);
         if (cachep->ctor && cachep->flags & SLAB_POISON)
-                cachep->ctor(cachep, objp);
+                cachep->ctor(objp);
 #if ARCH_SLAB_MINALIGN
         if ((u32)objp & (ARCH_SLAB_MINALIGN-1)) {
                 printk(KERN_ERR "0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n",
diff --git a/mm/slob.c b/mm/slob.c
index de268eb7ac70..d8fbd4d1bfa7 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -525,12 +525,11 @@ struct kmem_cache {
         unsigned int size, align;
         unsigned long flags;
         const char *name;
-        void (*ctor)(struct kmem_cache *, void *);
+        void (*ctor)(void *);
 };
 
 struct kmem_cache *kmem_cache_create(const char *name, size_t size,
-        size_t align, unsigned long flags,
-        void (*ctor)(struct kmem_cache *, void *))
+        size_t align, unsigned long flags, void (*ctor)(void *))
 {
         struct kmem_cache *c;
 
@@ -575,7 +574,7 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
                 b = slob_new_page(flags, get_order(c->size), node);
 
         if (c->ctor)
-                c->ctor(c, b);
+                c->ctor(b);
 
         return b;
 }
diff --git a/mm/slub.c b/mm/slub.c
index 77c21cf53ff9..b7e2cd5d82db 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1012,7 +1012,7 @@ __setup("slub_debug", setup_slub_debug);
 
 static unsigned long kmem_cache_flags(unsigned long objsize,
         unsigned long flags, const char *name,
-        void (*ctor)(struct kmem_cache *, void *))
+        void (*ctor)(void *))
 {
         /*
          * Enable debugging if selected on the kernel commandline.
@@ -1040,7 +1040,7 @@ static inline int check_object(struct kmem_cache *s, struct page *page,
 static inline void add_full(struct kmem_cache_node *n, struct page *page) {}
 static inline unsigned long kmem_cache_flags(unsigned long objsize,
         unsigned long flags, const char *name,
-        void (*ctor)(struct kmem_cache *, void *))
+        void (*ctor)(void *))
 {
         return flags;
 }
@@ -1103,7 +1103,7 @@ static void setup_object(struct kmem_cache *s, struct page *page,
 {
         setup_object_debug(s, page, object);
         if (unlikely(s->ctor))
-                s->ctor(s, object);
+                s->ctor(object);
 }
 
 static struct page *new_slab(struct kmem_cache *s, gfp_t flags, int node)
@@ -2286,7 +2286,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
 static int kmem_cache_open(struct kmem_cache *s, gfp_t gfpflags,
                 const char *name, size_t size,
                 size_t align, unsigned long flags,
-                void (*ctor)(struct kmem_cache *, void *))
+                void (*ctor)(void *))
 {
         memset(s, 0, kmem_size);
         s->name = name;
@@ -3042,7 +3042,7 @@ static int slab_unmergeable(struct kmem_cache *s)
 
 static struct kmem_cache *find_mergeable(size_t size,
                 size_t align, unsigned long flags, const char *name,
-                void (*ctor)(struct kmem_cache *, void *))
+                void (*ctor)(void *))
 {
         struct kmem_cache *s;
 
@@ -3082,8 +3082,7 @@ static struct kmem_cache *find_mergeable(size_t size,
 }
 
 struct kmem_cache *kmem_cache_create(const char *name, size_t size,
-                size_t align, unsigned long flags,
-                void (*ctor)(struct kmem_cache *, void *))
+                size_t align, unsigned long flags, void (*ctor)(void *))
 {
         struct kmem_cache *s;
 
diff --git a/mm/sparse.c b/mm/sparse.c
index 8ffc08990008..5d9dbbb9d39e 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -377,7 +377,7 @@ struct page __init *sparse_mem_map_populate(unsigned long pnum, int nid)
 }
 #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
 
-struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
+static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
 {
         struct page *map;
         struct mem_section *ms = __nr_to_section(pnum);
diff --git a/mm/swap_state.c b/mm/swap_state.c
index d8aadaf2a0ba..b8035b055129 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -39,7 +39,7 @@ static struct backing_dev_info swap_backing_dev_info = {
 
 struct address_space swapper_space = {
         .page_tree      = RADIX_TREE_INIT(GFP_ATOMIC|__GFP_NOWARN),
-        .tree_lock      = __RW_LOCK_UNLOCKED(swapper_space.tree_lock),
+        .tree_lock      = __SPIN_LOCK_UNLOCKED(swapper_space.tree_lock),
         .a_ops          = &swap_aops,
         .i_mmap_nonlinear = LIST_HEAD_INIT(swapper_space.i_mmap_nonlinear),
         .backing_dev_info = &swap_backing_dev_info,
@@ -56,7 +56,8 @@ static struct {
 
 void show_swap_cache_info(void)
 {
-        printk("Swap cache: add %lu, delete %lu, find %lu/%lu\n",
+        printk("%lu pages in swap cache\n", total_swapcache_pages);
+        printk("Swap cache stats: add %lu, delete %lu, find %lu/%lu\n",
                 swap_cache_info.add_total, swap_cache_info.del_total,
                 swap_cache_info.find_success, swap_cache_info.find_total);
         printk("Free swap  = %lukB\n", nr_swap_pages << (PAGE_SHIFT - 10));
@@ -64,7 +65,7 @@ void show_swap_cache_info(void)
 }
 
 /*
- * add_to_swap_cache resembles add_to_page_cache on swapper_space,
+ * add_to_swap_cache resembles add_to_page_cache_locked on swapper_space,
  * but sets SwapCache flag and private instead of mapping and index.
  */
 int add_to_swap_cache(struct page *page, swp_entry_t entry, gfp_t gfp_mask)
@@ -76,19 +77,26 @@ int add_to_swap_cache(struct page *page, swp_entry_t entry, gfp_t gfp_mask)
         BUG_ON(PagePrivate(page));
         error = radix_tree_preload(gfp_mask);
         if (!error) {
-                write_lock_irq(&swapper_space.tree_lock);
+                page_cache_get(page);
+                SetPageSwapCache(page);
+                set_page_private(page, entry.val);
+
+                spin_lock_irq(&swapper_space.tree_lock);
                 error = radix_tree_insert(&swapper_space.page_tree,
                                                 entry.val, page);
-                if (!error) {
-                        page_cache_get(page);
-                        SetPageSwapCache(page);
-                        set_page_private(page, entry.val);
+                if (likely(!error)) {
                         total_swapcache_pages++;
                         __inc_zone_page_state(page, NR_FILE_PAGES);
                         INC_CACHE_INFO(add_total);
                 }
-                write_unlock_irq(&swapper_space.tree_lock);
+                spin_unlock_irq(&swapper_space.tree_lock);
                 radix_tree_preload_end();
+
+                if (unlikely(error)) {
+                        set_page_private(page, 0UL);
+                        ClearPageSwapCache(page);
+                        page_cache_release(page);
+                }
         }
         return error;
 }
@@ -175,9 +183,9 @@ void delete_from_swap_cache(struct page *page)
 
         entry.val = page_private(page);
 
-        write_lock_irq(&swapper_space.tree_lock);
+        spin_lock_irq(&swapper_space.tree_lock);
         __delete_from_swap_cache(page);
-        write_unlock_irq(&swapper_space.tree_lock);
+        spin_unlock_irq(&swapper_space.tree_lock);
 
         swap_free(entry);
         page_cache_release(page);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 2f33edb8bee9..6beb6251e99d 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -33,8 +33,8 @@
 #include <asm/tlbflush.h>
 #include <linux/swapops.h>
 
-DEFINE_SPINLOCK(swap_lock);
-unsigned int nr_swapfiles;
+static DEFINE_SPINLOCK(swap_lock);
+static unsigned int nr_swapfiles;
 long total_swap_pages;
 static int swap_overflow;
 static int least_priority;
@@ -44,7 +44,7 @@ static const char Unused_file[] = "Unused swap file entry ";
 static const char Bad_offset[] = "Bad swap offset entry ";
 static const char Unused_offset[] = "Unused swap offset entry ";
 
-struct swap_list_t swap_list = {-1, -1};
+static struct swap_list_t swap_list = {-1, -1};
 
 static struct swap_info_struct swap_info[MAX_SWAPFILES];
 
@@ -369,13 +369,13 @@ int remove_exclusive_swap_page(struct page *page)
         retval = 0;
         if (p->swap_map[swp_offset(entry)] == 1) {
                 /* Recheck the page count with the swapcache lock held.. */
-                write_lock_irq(&swapper_space.tree_lock);
+                spin_lock_irq(&swapper_space.tree_lock);
                 if ((page_count(page) == 2) && !PageWriteback(page)) {
                         __delete_from_swap_cache(page);
                         SetPageDirty(page);
                         retval = 1;
                 }
-                write_unlock_irq(&swapper_space.tree_lock);
+                spin_unlock_irq(&swapper_space.tree_lock);
         }
         spin_unlock(&swap_lock);
 
diff --git a/mm/truncate.c b/mm/truncate.c
index b8961cb63414..e68443d74567 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -349,18 +349,18 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
         if (PagePrivate(page) && !try_to_release_page(page, GFP_KERNEL))
                 return 0;
 
-        write_lock_irq(&mapping->tree_lock);
+        spin_lock_irq(&mapping->tree_lock);
         if (PageDirty(page))
                 goto failed;
 
         BUG_ON(PagePrivate(page));
         __remove_from_page_cache(page);
-        write_unlock_irq(&mapping->tree_lock);
+        spin_unlock_irq(&mapping->tree_lock);
         ClearPageUptodate(page);
         page_cache_release(page);       /* pagecache ref */
         return 1;
 failed:
-        write_unlock_irq(&mapping->tree_lock);
+        spin_unlock_irq(&mapping->tree_lock);
         return 0;
 }
 
diff --git a/mm/util.c b/mm/util.c
index 8f18683825bc..0efd83097ecf 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -1,3 +1,4 @@
+#include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/module.h>
@@ -136,3 +137,12 @@ char *strndup_user(const char __user *s, long n)
         return p;
 }
 EXPORT_SYMBOL(strndup_user);
+
+#ifndef HAVE_ARCH_PICK_MMAP_LAYOUT
+void arch_pick_mmap_layout(struct mm_struct *mm)
+{
+        mm->mmap_base = TASK_UNMAPPED_BASE;
+        mm->get_unmapped_area = arch_get_unmapped_area;
+        mm->unmap_area = arch_unmap_area;
+}
+#endif
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 35f293816294..85b9a0d2c877 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -381,16 +381,14 @@ static void __vunmap(const void *addr, int deallocate_pages)
                 return;
 
         if ((PAGE_SIZE-1) & (unsigned long)addr) {
-                printk(KERN_ERR "Trying to vfree() bad address (%p)\n", addr);
-                WARN_ON(1);
+                WARN(1, KERN_ERR "Trying to vfree() bad address (%p)\n", addr);
                 return;
         }
 
         area = remove_vm_area(addr);
         if (unlikely(!area)) {
-                printk(KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
+                WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
                                 addr);
-                WARN_ON(1);
                 return;
         }
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 26672c6cd3ce..8f71761bc4b7 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -391,17 +391,15 @@ static pageout_t pageout(struct page *page, struct address_space *mapping,
 }
 
 /*
- * Attempt to detach a locked page from its ->mapping.  If it is dirty or if
- * someone else has a ref on the page, abort and return 0.  If it was
- * successfully detached, return 1.  Assumes the caller has a single ref on
- * this page.
+ * Same as remove_mapping, but if the page is removed from the mapping, it
+ * gets returned with a refcount of 0.
  */
-int remove_mapping(struct address_space *mapping, struct page *page)
+static int __remove_mapping(struct address_space *mapping, struct page *page)
 {
         BUG_ON(!PageLocked(page));
         BUG_ON(mapping != page_mapping(page));
 
-        write_lock_irq(&mapping->tree_lock);
+        spin_lock_irq(&mapping->tree_lock);
         /*
          * The non racy check for a busy page.
          *
@@ -427,28 +425,48 @@ int remove_mapping(struct address_space *mapping, struct page *page)
          * Note that if SetPageDirty is always performed via set_page_dirty,
          * and thus under tree_lock, then this ordering is not required.
          */
-        if (unlikely(page_count(page) != 2))
+        if (!page_freeze_refs(page, 2))
                 goto cannot_free;
-        smp_rmb();
-        if (unlikely(PageDirty(page)))
+        /* note: atomic_cmpxchg in page_freeze_refs provides the smp_rmb */
+        if (unlikely(PageDirty(page))) {
+                page_unfreeze_refs(page, 2);
                 goto cannot_free;
+        }
 
         if (PageSwapCache(page)) {
                 swp_entry_t swap = { .val = page_private(page) };
                 __delete_from_swap_cache(page);
-                write_unlock_irq(&mapping->tree_lock);
+                spin_unlock_irq(&mapping->tree_lock);
                 swap_free(swap);
-                __put_page(page);       /* The pagecache ref */
-                return 1;
+        } else {
+                __remove_from_page_cache(page);
+                spin_unlock_irq(&mapping->tree_lock);
         }
 
-        __remove_from_page_cache(page);
-        write_unlock_irq(&mapping->tree_lock);
-        __put_page(page);
         return 1;
 
 cannot_free:
-        write_unlock_irq(&mapping->tree_lock);
+        spin_unlock_irq(&mapping->tree_lock);
+        return 0;
+}
+
+/*
+ * Attempt to detach a locked page from its ->mapping.  If it is dirty or if
+ * someone else has a ref on the page, abort and return 0.  If it was
+ * successfully detached, return 1.  Assumes the caller has a single ref on
+ * this page.
+ */
+int remove_mapping(struct address_space *mapping, struct page *page)
+{
+        if (__remove_mapping(mapping, page)) {
+                /*
+                 * Unfreezing the refcount with 1 rather than 2 effectively
+                 * drops the pagecache ref for us without requiring another
+                 * atomic operation.
+                 */
+                page_unfreeze_refs(page, 1);
+                return 1;
+        }
         return 0;
 }
 
@@ -598,18 +616,34 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                 if (PagePrivate(page)) {
                         if (!try_to_release_page(page, sc->gfp_mask))
                                 goto activate_locked;
-                        if (!mapping && page_count(page) == 1)
-                                goto free_it;
+                        if (!mapping && page_count(page) == 1) {
+                                unlock_page(page);
+                                if (put_page_testzero(page))
+                                        goto free_it;
+                                else {
+                                        /*
+                                         * rare race with speculative reference.
+                                         * the speculative reference will free
+                                         * this page shortly, so we may
+                                         * increment nr_reclaimed here (and
+                                         * leave it off the LRU).
+                                         */
+                                        nr_reclaimed++;
+                                        continue;
+                                }
+                        }
                 }
 
-                if (!mapping || !remove_mapping(mapping, page))
+                if (!mapping || !__remove_mapping(mapping, page))
                         goto keep_locked;
 
-free_it:
                 unlock_page(page);
+free_it:
                 nr_reclaimed++;
-                if (!pagevec_add(&freed_pvec, page))
-                        __pagevec_release_nonlru(&freed_pvec);
+                if (!pagevec_add(&freed_pvec, page)) {
+                        __pagevec_free(&freed_pvec);
+                        pagevec_reinit(&freed_pvec);
+                }
                 continue;
 
 activate_locked:
@@ -623,7 +657,7 @@ keep:
         }
         list_splice(&ret_pages, page_list);
         if (pagevec_count(&freed_pvec))
-                __pagevec_release_nonlru(&freed_pvec);
+                __pagevec_free(&freed_pvec);
         count_vm_events(PGACTIVATE, pgactivate);
         return nr_reclaimed;
 }