33 files changed, 3227 insertions, 1271 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index 9c61158308dc..527136b22384 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -172,6 +172,15 @@ config SPLIT_PTLOCK_CPUS
         default "4"
 
 #
+# support for memory compaction
+config COMPACTION
+        bool "Allow for memory compaction"
+        select MIGRATION
+        depends on EXPERIMENTAL && HUGETLB_PAGE && MMU
+        help
+          Allows the compaction of memory for the allocation of huge pages.
+
+#
 # support for page migration
 #
 config MIGRATION
@@ -180,9 +189,11 @@ config MIGRATION
         depends on NUMA || ARCH_ENABLE_MEMORY_HOTREMOVE
         help
           Allows the migration of the physical location of pages of processes
-          while the virtual addresses are not changed. This is useful for
-          example on NUMA systems to put pages nearer to the processors accessing
-          the page.
+          while the virtual addresses are not changed. This is useful in
+          two situations. The first is on NUMA systems to put pages nearer
+          to the processors accessing. The second is when allocating huge
+          pages as migration can relocate pages to satisfy a huge page
+          allocation instead of reclaiming.
 
 config PHYS_ADDR_T_64BIT
         def_bool 64BIT || ARCH_PHYS_ADDR_T_64BIT
diff --git a/mm/Makefile b/mm/Makefile
index 6c2a73a54a43..8982504bd03b 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_NUMA) 	+= mempolicy.o
 obj-$(CONFIG_SPARSEMEM) += sparse.o
 obj-$(CONFIG_SPARSEMEM_VMEMMAP) += sparse-vmemmap.o
 obj-$(CONFIG_SLOB) += slob.o
+obj-$(CONFIG_COMPACTION) += compaction.o
 obj-$(CONFIG_MMU_NOTIFIER) += mmu_notifier.o
 obj-$(CONFIG_KSM) += ksm.o
 obj-$(CONFIG_PAGE_POISONING) += debug-pagealloc.o
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 707d0dc6da0f..660a87a22511 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -48,7 +48,6 @@ static struct timer_list sync_supers_timer;
 
 static int bdi_sync_supers(void *);
 static void sync_supers_timer_fn(unsigned long);
-static void arm_supers_timer(void);
 
 static void bdi_add_default_flusher_task(struct backing_dev_info *bdi);
 
@@ -252,7 +251,7 @@ static int __init default_bdi_init(void)
 
         init_timer(&sync_supers_timer);
         setup_timer(&sync_supers_timer, sync_supers_timer_fn, 0);
-        arm_supers_timer();
+        bdi_arm_supers_timer();
 
         err = bdi_init(&default_backing_dev_info);
         if (!err)
@@ -374,10 +373,13 @@ static int bdi_sync_supers(void *unused)
         return 0;
 }
 
-static void arm_supers_timer(void)
+void bdi_arm_supers_timer(void)
 {
         unsigned long next;
 
+        if (!dirty_writeback_interval)
+                return;
+
         next = msecs_to_jiffies(dirty_writeback_interval * 10) + jiffies;
         mod_timer(&sync_supers_timer, round_jiffies_up(next));
 }
@@ -385,7 +387,7 @@ static void arm_supers_timer(void)
 static void sync_supers_timer_fn(unsigned long unused)
 {
         wake_up_process(sync_supers_tsk);
-        arm_supers_timer();
+        bdi_arm_supers_timer();
 }
 
 static int bdi_forker_task(void *ptr)
@@ -428,7 +430,10 @@ static int bdi_forker_task(void *ptr)
 
                         spin_unlock_bh(&bdi_lock);
                         wait = msecs_to_jiffies(dirty_writeback_interval * 10);
-                        schedule_timeout(wait);
+                        if (wait)
+                                schedule_timeout(wait);
+                        else
+                                schedule();
                         try_to_freeze();
                         continue;
                 }
diff --git a/mm/compaction.c b/mm/compaction.c
new file mode 100644
index 000000000000..94cce51b0b35
--- /dev/null
+++ b/mm/compaction.c
@@ -0,0 +1,605 @@
+/*
+ * linux/mm/compaction.c
+ *
+ * Memory compaction for the reduction of external fragmentation. Note that
+ * this heavily depends upon page migration to do all the real heavy
+ * lifting
+ *
+ * Copyright IBM Corp. 2007-2010 Mel Gorman <mel@csn.ul.ie>
+ */
+#include <linux/swap.h>
+#include <linux/migrate.h>
+#include <linux/compaction.h>
+#include <linux/mm_inline.h>
+#include <linux/backing-dev.h>
+#include <linux/sysctl.h>
+#include <linux/sysfs.h>
+#include "internal.h"
+
+/*
+ * compact_control is used to track pages being migrated and the free pages
+ * they are being migrated to during memory compaction. The free_pfn starts
+ * at the end of a zone and migrate_pfn begins at the start. Movable pages
+ * are moved to the end of a zone during a compaction run and the run
+ * completes when free_pfn <= migrate_pfn
+ */
+struct compact_control {
+        struct list_head freepages;     /* List of free pages to migrate to */
+        struct list_head migratepages;  /* List of pages being migrated */
+        unsigned long nr_freepages;     /* Number of isolated free pages */
+        unsigned long nr_migratepages;  /* Number of pages to migrate */
+        unsigned long free_pfn;         /* isolate_freepages search base */
+        unsigned long migrate_pfn;      /* isolate_migratepages search base */
+
+        /* Account for isolated anon and file pages */
+        unsigned long nr_anon;
+        unsigned long nr_file;
+
+        unsigned int order;             /* order a direct compactor needs */
+        int migratetype;                /* MOVABLE, RECLAIMABLE etc */
+        struct zone *zone;
+};
+
+static unsigned long release_freepages(struct list_head *freelist)
+{
+        struct page *page, *next;
+        unsigned long count = 0;
+
+        list_for_each_entry_safe(page, next, freelist, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                count++;
+        }
+
+        return count;
+}
+
+/* Isolate free pages onto a private freelist. Must hold zone->lock */
+static unsigned long isolate_freepages_block(struct zone *zone,
+                                unsigned long blockpfn,
+                                struct list_head *freelist)
+{
+        unsigned long zone_end_pfn, end_pfn;
+        int total_isolated = 0;
+        struct page *cursor;
+
+        /* Get the last PFN we should scan for free pages at */
+        zone_end_pfn = zone->zone_start_pfn + zone->spanned_pages;
+        end_pfn = min(blockpfn + pageblock_nr_pages, zone_end_pfn);
+
+        /* Find the first usable PFN in the block to initialse page cursor */
+        for (; blockpfn < end_pfn; blockpfn++) {
+                if (pfn_valid_within(blockpfn))
+                        break;
+        }
+        cursor = pfn_to_page(blockpfn);
+
+        /* Isolate free pages. This assumes the block is valid */
+        for (; blockpfn < end_pfn; blockpfn++, cursor++) {
+                int isolated, i;
+                struct page *page = cursor;
+
+                if (!pfn_valid_within(blockpfn))
+                        continue;
+
+                if (!PageBuddy(page))
+                        continue;
+
+                /* Found a free page, break it into order-0 pages */
+                isolated = split_free_page(page);
+                total_isolated += isolated;
+                for (i = 0; i < isolated; i++) {
+                        list_add(&page->lru, freelist);
+                        page++;
+                }
+
+                /* If a page was split, advance to the end of it */
+                if (isolated) {
+                        blockpfn += isolated - 1;
+                        cursor += isolated - 1;
+                }
+        }
+
+        return total_isolated;
+}
+
+/* Returns true if the page is within a block suitable for migration to */
+static bool suitable_migration_target(struct page *page)
+{
+
+        int migratetype = get_pageblock_migratetype(page);
+
+        /* Don't interfere with memory hot-remove or the min_free_kbytes blocks */
+        if (migratetype == MIGRATE_ISOLATE || migratetype == MIGRATE_RESERVE)
+                return false;
+
+        /* If the page is a large free page, then allow migration */
+        if (PageBuddy(page) && page_order(page) >= pageblock_order)
+                return true;
+
+        /* If the block is MIGRATE_MOVABLE, allow migration */
+        if (migratetype == MIGRATE_MOVABLE)
+                return true;
+
+        /* Otherwise skip the block */
+        return false;
+}
+
+/*
+ * Based on information in the current compact_control, find blocks
+ * suitable for isolating free pages from and then isolate them.
+ */
+static void isolate_freepages(struct zone *zone,
+                                struct compact_control *cc)
+{
+        struct page *page;
+        unsigned long high_pfn, low_pfn, pfn;
+        unsigned long flags;
+        int nr_freepages = cc->nr_freepages;
+        struct list_head *freelist = &cc->freepages;
+
+        pfn = cc->free_pfn;
+        low_pfn = cc->migrate_pfn + pageblock_nr_pages;
+        high_pfn = low_pfn;
+
+        /*
+         * Isolate free pages until enough are available to migrate the
+         * pages on cc->migratepages. We stop searching if the migrate
+         * and free page scanners meet or enough free pages are isolated.
+         */
+        spin_lock_irqsave(&zone->lock, flags);
+        for (; pfn > low_pfn && cc->nr_migratepages > nr_freepages;
+                                        pfn -= pageblock_nr_pages) {
+                unsigned long isolated;
+
+                if (!pfn_valid(pfn))
+                        continue;
+
+                /*
+                 * Check for overlapping nodes/zones. It's possible on some
+                 * configurations to have a setup like
+                 * node0 node1 node0
+                 * i.e. it's possible that all pages within a zones range of
+                 * pages do not belong to a single zone.
+                 */
+                page = pfn_to_page(pfn);
+                if (page_zone(page) != zone)
+                        continue;
+
+                /* Check the block is suitable for migration */
+                if (!suitable_migration_target(page))
+                        continue;
+
+                /* Found a block suitable for isolating free pages from */
+                isolated = isolate_freepages_block(zone, pfn, freelist);
+                nr_freepages += isolated;
+
+                /*
+                 * Record the highest PFN we isolated pages from. When next
+                 * looking for free pages, the search will restart here as
+                 * page migration may have returned some pages to the allocator
+                 */
+                if (isolated)
+                        high_pfn = max(high_pfn, pfn);
+        }
+        spin_unlock_irqrestore(&zone->lock, flags);
+
+        /* split_free_page does not map the pages */
+        list_for_each_entry(page, freelist, lru) {
+                arch_alloc_page(page, 0);
+                kernel_map_pages(page, 1, 1);
+        }
+
+        cc->free_pfn = high_pfn;
+        cc->nr_freepages = nr_freepages;
+}
+
+/* Update the number of anon and file isolated pages in the zone */
+static void acct_isolated(struct zone *zone, struct compact_control *cc)
+{
+        struct page *page;
+        unsigned int count[NR_LRU_LISTS] = { 0, };
+
+        list_for_each_entry(page, &cc->migratepages, lru) {
+                int lru = page_lru_base_type(page);
+                count[lru]++;
+        }
+
+        cc->nr_anon = count[LRU_ACTIVE_ANON] + count[LRU_INACTIVE_ANON];
+        cc->nr_file = count[LRU_ACTIVE_FILE] + count[LRU_INACTIVE_FILE];
+        __mod_zone_page_state(zone, NR_ISOLATED_ANON, cc->nr_anon);
+        __mod_zone_page_state(zone, NR_ISOLATED_FILE, cc->nr_file);
+}
+
+/* Similar to reclaim, but different enough that they don't share logic */
+static bool too_many_isolated(struct zone *zone)
+{
+
+        unsigned long inactive, isolated;
+
+        inactive = zone_page_state(zone, NR_INACTIVE_FILE) +
+                                        zone_page_state(zone, NR_INACTIVE_ANON);
+        isolated = zone_page_state(zone, NR_ISOLATED_FILE) +
+                                        zone_page_state(zone, NR_ISOLATED_ANON);
+
+        return isolated > inactive;
+}
+
+/*
+ * Isolate all pages that can be migrated from the block pointed to by
+ * the migrate scanner within compact_control.
+ */
+static unsigned long isolate_migratepages(struct zone *zone,
+                                        struct compact_control *cc)
+{
+        unsigned long low_pfn, end_pfn;
+        struct list_head *migratelist = &cc->migratepages;
+
+        /* Do not scan outside zone boundaries */
+        low_pfn = max(cc->migrate_pfn, zone->zone_start_pfn);
+
+        /* Only scan within a pageblock boundary */
+        end_pfn = ALIGN(low_pfn + pageblock_nr_pages, pageblock_nr_pages);
+
+        /* Do not cross the free scanner or scan within a memory hole */
+        if (end_pfn > cc->free_pfn || !pfn_valid(low_pfn)) {
+                cc->migrate_pfn = end_pfn;
+                return 0;
+        }
+
+        /*
+         * Ensure that there are not too many pages isolated from the LRU
+         * list by either parallel reclaimers or compaction. If there are,
+         * delay for some time until fewer pages are isolated
+         */
+        while (unlikely(too_many_isolated(zone))) {
+                congestion_wait(BLK_RW_ASYNC, HZ/10);
+
+                if (fatal_signal_pending(current))
+                        return 0;
+        }
+
+        /* Time to isolate some pages for migration */
+        spin_lock_irq(&zone->lru_lock);
+        for (; low_pfn < end_pfn; low_pfn++) {
+                struct page *page;
+                if (!pfn_valid_within(low_pfn))
+                        continue;
+
+                /* Get the page and skip if free */
+                page = pfn_to_page(low_pfn);
+                if (PageBuddy(page))
+                        continue;
+
+                /* Try isolate the page */
+                if (__isolate_lru_page(page, ISOLATE_BOTH, 0) != 0)
+                        continue;
+
+                /* Successfully isolated */
+                del_page_from_lru_list(zone, page, page_lru(page));
+                list_add(&page->lru, migratelist);
+                mem_cgroup_del_lru(page);
+                cc->nr_migratepages++;
+
+                /* Avoid isolating too much */
+                if (cc->nr_migratepages == COMPACT_CLUSTER_MAX)
+                        break;
+        }
+
+        acct_isolated(zone, cc);
+
+        spin_unlock_irq(&zone->lru_lock);
+        cc->migrate_pfn = low_pfn;
+
+        return cc->nr_migratepages;
+}
+
+/*
+ * This is a migrate-callback that "allocates" freepages by taking pages
+ * from the isolated freelists in the block we are migrating to.
+ */
+static struct page *compaction_alloc(struct page *migratepage,
+                                        unsigned long data,
+                                        int **result)
+{
+        struct compact_control *cc = (struct compact_control *)data;
+        struct page *freepage;
+
+        /* Isolate free pages if necessary */
+        if (list_empty(&cc->freepages)) {
+                isolate_freepages(cc->zone, cc);
+
+                if (list_empty(&cc->freepages))
+                        return NULL;
+        }
+
+        freepage = list_entry(cc->freepages.next, struct page, lru);
+        list_del(&freepage->lru);
+        cc->nr_freepages--;
+
+        return freepage;
+}
+
+/*
+ * We cannot control nr_migratepages and nr_freepages fully when migration is
+ * running as migrate_pages() has no knowledge of compact_control. When
+ * migration is complete, we count the number of pages on the lists by hand.
+ */
+static void update_nr_listpages(struct compact_control *cc)
+{
+        int nr_migratepages = 0;
+        int nr_freepages = 0;
+        struct page *page;
+
+        list_for_each_entry(page, &cc->migratepages, lru)
+                nr_migratepages++;
+        list_for_each_entry(page, &cc->freepages, lru)
+                nr_freepages++;
+
+        cc->nr_migratepages = nr_migratepages;
+        cc->nr_freepages = nr_freepages;
+}
+
+static int compact_finished(struct zone *zone,
+                                                struct compact_control *cc)
+{
+        unsigned int order;
+        unsigned long watermark = low_wmark_pages(zone) + (1 << cc->order);
+
+        if (fatal_signal_pending(current))
+                return COMPACT_PARTIAL;
+
+        /* Compaction run completes if the migrate and free scanner meet */
+        if (cc->free_pfn <= cc->migrate_pfn)
+                return COMPACT_COMPLETE;
+
+        /* Compaction run is not finished if the watermark is not met */
+        if (!zone_watermark_ok(zone, cc->order, watermark, 0, 0))
+                return COMPACT_CONTINUE;
+
+        if (cc->order == -1)
+                return COMPACT_CONTINUE;
+
+        /* Direct compactor: Is a suitable page free? */
+        for (order = cc->order; order < MAX_ORDER; order++) {
+                /* Job done if page is free of the right migratetype */
+                if (!list_empty(&zone->free_area[order].free_list[cc->migratetype]))
+                        return COMPACT_PARTIAL;
+
+                /* Job done if allocation would set block type */
+                if (order >= pageblock_order && zone->free_area[order].nr_free)
+                        return COMPACT_PARTIAL;
+        }
+
+        return COMPACT_CONTINUE;
+}
+
+static int compact_zone(struct zone *zone, struct compact_control *cc)
+{
+        int ret;
+
+        /* Setup to move all movable pages to the end of the zone */
+        cc->migrate_pfn = zone->zone_start_pfn;
+        cc->free_pfn = cc->migrate_pfn + zone->spanned_pages;
+        cc->free_pfn &= ~(pageblock_nr_pages-1);
+
+        migrate_prep_local();
+
+        while ((ret = compact_finished(zone, cc)) == COMPACT_CONTINUE) {
+                unsigned long nr_migrate, nr_remaining;
+
+                if (!isolate_migratepages(zone, cc))
+                        continue;
+
+                nr_migrate = cc->nr_migratepages;
+                migrate_pages(&cc->migratepages, compaction_alloc,
+                                                (unsigned long)cc, 0);
+                update_nr_listpages(cc);
+                nr_remaining = cc->nr_migratepages;
+
+                count_vm_event(COMPACTBLOCKS);
+                count_vm_events(COMPACTPAGES, nr_migrate - nr_remaining);
+                if (nr_remaining)
+                        count_vm_events(COMPACTPAGEFAILED, nr_remaining);
+
+                /* Release LRU pages not migrated */
+                if (!list_empty(&cc->migratepages)) {
+                        putback_lru_pages(&cc->migratepages);
+                        cc->nr_migratepages = 0;
+                }
+
+        }
+
+        /* Release free pages and check accounting */
+        cc->nr_freepages -= release_freepages(&cc->freepages);
+        VM_BUG_ON(cc->nr_freepages != 0);
+
+        return ret;
+}
+
+static unsigned long compact_zone_order(struct zone *zone,
+                                                int order, gfp_t gfp_mask)
+{
+        struct compact_control cc = {
+                .nr_freepages = 0,
+                .nr_migratepages = 0,
+                .order = order,
+                .migratetype = allocflags_to_migratetype(gfp_mask),
+                .zone = zone,
+        };
+        INIT_LIST_HEAD(&cc.freepages);
+        INIT_LIST_HEAD(&cc.migratepages);
+
+        return compact_zone(zone, &cc);
+}
+
+int sysctl_extfrag_threshold = 500;
+
+/**
+ * try_to_compact_pages - Direct compact to satisfy a high-order allocation
+ * @zonelist: The zonelist used for the current allocation
+ * @order: The order of the current allocation
+ * @gfp_mask: The GFP mask of the current allocation
+ * @nodemask: The allowed nodes to allocate from
+ *
+ * This is the main entry point for direct page compaction.
+ */
+unsigned long try_to_compact_pages(struct zonelist *zonelist,
+                        int order, gfp_t gfp_mask, nodemask_t *nodemask)
+{
+        enum zone_type high_zoneidx = gfp_zone(gfp_mask);
+        int may_enter_fs = gfp_mask & __GFP_FS;
+        int may_perform_io = gfp_mask & __GFP_IO;
+        unsigned long watermark;
+        struct zoneref *z;
+        struct zone *zone;
+        int rc = COMPACT_SKIPPED;
+
+        /*
+         * Check whether it is worth even starting compaction. The order check is
+         * made because an assumption is made that the page allocator can satisfy
+         * the "cheaper" orders without taking special steps
+         */
+        if (order <= PAGE_ALLOC_COSTLY_ORDER || !may_enter_fs || !may_perform_io)
+                return rc;
+
+        count_vm_event(COMPACTSTALL);
+
+        /* Compact each zone in the list */
+        for_each_zone_zonelist_nodemask(zone, z, zonelist, high_zoneidx,
+                                                                nodemask) {
+                int fragindex;
+                int status;
+
+                /*
+                 * Watermarks for order-0 must be met for compaction. Note
+                 * the 2UL. This is because during migration, copies of
+                 * pages need to be allocated and for a short time, the
+                 * footprint is higher
+                 */
+                watermark = low_wmark_pages(zone) + (2UL << order);
+                if (!zone_watermark_ok(zone, 0, watermark, 0, 0))
+                        continue;
+
+                /*
+                 * fragmentation index determines if allocation failures are
+                 * due to low memory or external fragmentation
+                 *
+                 * index of -1 implies allocations might succeed depending
+                 *      on watermarks
+                 * index towards 0 implies failure is due to lack of memory
+                 * index towards 1000 implies failure is due to fragmentation
+                 *
+                 * Only compact if a failure would be due to fragmentation.
+                 */
+                fragindex = fragmentation_index(zone, order);
+                if (fragindex >= 0 && fragindex <= sysctl_extfrag_threshold)
+                        continue;
+
+                if (fragindex == -1 && zone_watermark_ok(zone, order, watermark, 0, 0)) {
+                        rc = COMPACT_PARTIAL;
+                        break;
+                }
+
+                status = compact_zone_order(zone, order, gfp_mask);
+                rc = max(status, rc);
+
+                if (zone_watermark_ok(zone, order, watermark, 0, 0))
+                        break;
+        }
+
+        return rc;
+}
+
+
+/* Compact all zones within a node */
+static int compact_node(int nid)
+{
+        int zoneid;
+        pg_data_t *pgdat;
+        struct zone *zone;
+
+        if (nid < 0 || nid >= nr_node_ids || !node_online(nid))
+                return -EINVAL;
+        pgdat = NODE_DATA(nid);
+
+        /* Flush pending updates to the LRU lists */
+        lru_add_drain_all();
+
+        for (zoneid = 0; zoneid < MAX_NR_ZONES; zoneid++) {
+                struct compact_control cc = {
+                        .nr_freepages = 0,
+                        .nr_migratepages = 0,
+                        .order = -1,
+                };
+
+                zone = &pgdat->node_zones[zoneid];
+                if (!populated_zone(zone))
+                        continue;
+
+                cc.zone = zone;
+                INIT_LIST_HEAD(&cc.freepages);
+                INIT_LIST_HEAD(&cc.migratepages);
+
+                compact_zone(zone, &cc);
+
+                VM_BUG_ON(!list_empty(&cc.freepages));
+                VM_BUG_ON(!list_empty(&cc.migratepages));
+        }
+
+        return 0;
+}
+
+/* Compact all nodes in the system */
+static int compact_nodes(void)
+{
+        int nid;
+
+        for_each_online_node(nid)
+                compact_node(nid);
+
+        return COMPACT_COMPLETE;
+}
+
+/* The written value is actually unused, all memory is compacted */
+int sysctl_compact_memory;
+
+/* This is the entry point for compacting all nodes via /proc/sys/vm */
+int sysctl_compaction_handler(struct ctl_table *table, int write,
+                        void __user *buffer, size_t *length, loff_t *ppos)
+{
+        if (write)
+                return compact_nodes();
+
+        return 0;
+}
+
+int sysctl_extfrag_handler(struct ctl_table *table, int write,
+                        void __user *buffer, size_t *length, loff_t *ppos)
+{
+        proc_dointvec_minmax(table, write, buffer, length, ppos);
+
+        return 0;
+}
+
+#if defined(CONFIG_SYSFS) && defined(CONFIG_NUMA)
+ssize_t sysfs_compact_node(struct sys_device *dev,
+                        struct sysdev_attribute *attr,
+                        const char *buf, size_t count)
+{
+        compact_node(dev->id);
+
+        return count;
+}
+static SYSDEV_ATTR(compact, S_IWUSR, NULL, sysfs_compact_node);
+
+int compaction_register_node(struct node *node)
+{
+        return sysdev_create_file(&node->sysdev, &attr_compact);
+}
+
+void compaction_unregister_node(struct node *node)
+{
+        return sysdev_remove_file(&node->sysdev, &attr_compact);
+}
+#endif /* CONFIG_SYSFS && CONFIG_NUMA */
diff --git a/mm/filemap.c b/mm/filemap.c
index 829ac9cdbd70..45a2d18df849 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -441,7 +441,7 @@ int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
         /*
          * Splice_read and readahead add shmem/tmpfs pages into the page cache
          * before shmem_readpage has a chance to mark them as SwapBacked: they
-         * need to go on the active_anon lru below, and mem_cgroup_cache_charge
+         * need to go on the anon lru below, and mem_cgroup_cache_charge
          * (called in add_to_page_cache) needs to know where they're going too.
          */
         if (mapping_cap_swap_backed(mapping))
@@ -452,7 +452,7 @@ int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
                 if (page_is_file_cache(page))
                         lru_cache_add_file(page);
                 else
-                        lru_cache_add_active_anon(page);
+                        lru_cache_add_anon(page);
         }
         return ret;
 }
@@ -461,9 +461,15 @@ EXPORT_SYMBOL_GPL(add_to_page_cache_lru);
 #ifdef CONFIG_NUMA
 struct page *__page_cache_alloc(gfp_t gfp)
 {
+        int n;
+        struct page *page;
+
         if (cpuset_do_page_mem_spread()) {
-                int n = cpuset_mem_spread_node();
-                return alloc_pages_exact_node(n, gfp, 0);
+                get_mems_allowed();
+                n = cpuset_mem_spread_node();
+                page = alloc_pages_exact_node(n, gfp, 0);
+                put_mems_allowed();
+                return page;
         }
         return alloc_pages(gfp, 0);
 }
@@ -1099,6 +1105,12 @@ page_not_up_to_date_locked:
                 }
 
 readpage:
+                /*
+                 * A previous I/O error may have been due to temporary
+                 * failures, eg. multipath errors.
+                 * PG_error will be set again if readpage fails.
+                 */
+                ClearPageError(page);
                 /* Start the actual read. The read will unlock the page. */
                 error = mapping->a_ops->readpage(filp, page);
 
diff --git a/mm/highmem.c b/mm/highmem.c
index bed8a8bfd01f..66baa20f78f5 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -422,7 +422,7 @@ void __init page_address_init(void)
 
 #endif  /* defined(CONFIG_HIGHMEM) && !defined(WANT_PAGE_VIRTUAL) */
 
-#if defined(CONFIG_DEBUG_HIGHMEM) && defined(CONFIG_TRACE_IRQFLAGS_SUPPORT)
+#ifdef CONFIG_DEBUG_HIGHMEM
 
 void debug_kmap_atomic(enum km_type type)
 {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 4c9e6bbf3772..54d42b009dbe 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -465,11 +465,13 @@ static struct page *dequeue_huge_page_vma(struct hstate *h,
         struct page *page = NULL;
         struct mempolicy *mpol;
         nodemask_t *nodemask;
-        struct zonelist *zonelist = huge_zonelist(vma, address,
-                                        htlb_alloc_mask, &mpol, &nodemask);
+        struct zonelist *zonelist;
         struct zone *zone;
         struct zoneref *z;
 
+        get_mems_allowed();
+        zonelist = huge_zonelist(vma, address,
+                                        htlb_alloc_mask, &mpol, &nodemask);
         /*
          * A child process with MAP_PRIVATE mappings created by their parent
          * have no page reserves. This check ensures that reservations are
@@ -477,11 +479,11 @@ static struct page *dequeue_huge_page_vma(struct hstate *h,
          */
         if (!vma_has_reserves(vma) &&
                         h->free_huge_pages - h->resv_huge_pages == 0)
-                return NULL;
+                goto err;
 
         /* If reserves cannot be used, ensure enough pages are in the pool */
         if (avoid_reserve && h->free_huge_pages - h->resv_huge_pages == 0)
-                return NULL;
+                goto err;;
 
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                                                 MAX_NR_ZONES - 1, nodemask) {
@@ -500,7 +502,9 @@ static struct page *dequeue_huge_page_vma(struct hstate *h,
                         break;
                 }
         }
+err:
         mpol_cond_put(mpol);
+        put_mems_allowed();
         return page;
 }
 
diff --git a/mm/ksm.c b/mm/ksm.c
index 956880f2ff49..6c3e99b4ae7c 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -318,14 +318,14 @@ static void hold_anon_vma(struct rmap_item *rmap_item,
                           struct anon_vma *anon_vma)
 {
         rmap_item->anon_vma = anon_vma;
-        atomic_inc(&anon_vma->ksm_refcount);
+        atomic_inc(&anon_vma->external_refcount);
 }
 
 static void drop_anon_vma(struct rmap_item *rmap_item)
 {
         struct anon_vma *anon_vma = rmap_item->anon_vma;
 
-        if (atomic_dec_and_lock(&anon_vma->ksm_refcount, &anon_vma->lock)) {
+        if (atomic_dec_and_lock(&anon_vma->external_refcount, &anon_vma->lock)) {
                 int empty = list_empty(&anon_vma->head);
                 spin_unlock(&anon_vma->lock);
                 if (empty)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 8a79a6f0f029..c6ece0a57595 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -149,16 +149,35 @@ struct mem_cgroup_threshold {
         u64 threshold;
 };
 
+/* For threshold */
 struct mem_cgroup_threshold_ary {
         /* An array index points to threshold just below usage. */
-        atomic_t current_threshold;
+        int current_threshold;
         /* Size of entries[] */
         unsigned int size;
         /* Array of thresholds */
         struct mem_cgroup_threshold entries[0];
 };
 
+struct mem_cgroup_thresholds {
+        /* Primary thresholds array */
+        struct mem_cgroup_threshold_ary *primary;
+        /*
+         * Spare threshold array.
+         * This is needed to make mem_cgroup_unregister_event() "never fail".
+         * It must be able to store at least primary->size - 1 entries.
+         */
+        struct mem_cgroup_threshold_ary *spare;
+};
+
+/* for OOM */
+struct mem_cgroup_eventfd_list {
+        struct list_head list;
+        struct eventfd_ctx *eventfd;
+};
+
 static void mem_cgroup_threshold(struct mem_cgroup *mem);
+static void mem_cgroup_oom_notify(struct mem_cgroup *mem);
 
 /*
  * The memory controller data structure. The memory controller controls both
@@ -207,6 +226,8 @@ struct mem_cgroup {
         atomic_t        refcnt;
 
         unsigned int    swappiness;
+        /* OOM-Killer disable */
+        int             oom_kill_disable;
 
         /* set when res.limit == memsw.limit */
         bool            memsw_is_minimum;
@@ -215,17 +236,19 @@ struct mem_cgroup {
         struct mutex thresholds_lock;
 
         /* thresholds for memory usage. RCU-protected */
-        struct mem_cgroup_threshold_ary *thresholds;
+        struct mem_cgroup_thresholds thresholds;
 
         /* thresholds for mem+swap usage. RCU-protected */
-        struct mem_cgroup_threshold_ary *memsw_thresholds;
+        struct mem_cgroup_thresholds memsw_thresholds;
+
+        /* For oom notifier event fd */
+        struct list_head oom_notify;
 
         /*
          * Should we move charges of a task when a task is moved into this
          * mem_cgroup ? And what type of charges should we move ?
          */
         unsigned long   move_charge_at_immigrate;
-
         /*
          * percpu counter.
          */
@@ -239,6 +262,7 @@ struct mem_cgroup {
  */
 enum move_type {
         MOVE_CHARGE_TYPE_ANON,  /* private anonymous page and swap of it */
+        MOVE_CHARGE_TYPE_FILE,  /* file page(including tmpfs) and swap of it */
         NR_MOVE_TYPE,
 };
 
@@ -255,6 +279,18 @@ static struct move_charge_struct {
         .waitq = __WAIT_QUEUE_HEAD_INITIALIZER(mc.waitq),
 };
 
+static bool move_anon(void)
+{
+        return test_bit(MOVE_CHARGE_TYPE_ANON,
+                                        &mc.to->move_charge_at_immigrate);
+}
+
+static bool move_file(void)
+{
+        return test_bit(MOVE_CHARGE_TYPE_FILE,
+                                        &mc.to->move_charge_at_immigrate);
+}
+
 /*
  * Maximum loops in mem_cgroup_hierarchical_reclaim(), used for soft
  * limit reclaim to prevent infinite loops, if they ever occur.
@@ -282,9 +318,12 @@ enum charge_type {
 /* for encoding cft->private value on file */
 #define _MEM                    (0)
 #define _MEMSWAP                (1)
+#define _OOM_TYPE               (2)
 #define MEMFILE_PRIVATE(x, val) (((x) << 16) | (val))
 #define MEMFILE_TYPE(val)       (((val) >> 16) & 0xffff)
 #define MEMFILE_ATTR(val)       ((val) & 0xffff)
+/* Used for OOM nofiier */
+#define OOM_CONTROL             (0)
 
 /*
  * Reclaim flags for mem_cgroup_hierarchical_reclaim
@@ -1293,14 +1332,62 @@ static void mem_cgroup_oom_unlock(struct mem_cgroup *mem)
 static DEFINE_MUTEX(memcg_oom_mutex);
 static DECLARE_WAIT_QUEUE_HEAD(memcg_oom_waitq);
 
+struct oom_wait_info {
+        struct mem_cgroup *mem;
+        wait_queue_t    wait;
+};
+
+static int memcg_oom_wake_function(wait_queue_t *wait,
+        unsigned mode, int sync, void *arg)
+{
+        struct mem_cgroup *wake_mem = (struct mem_cgroup *)arg;
+        struct oom_wait_info *oom_wait_info;
+
+        oom_wait_info = container_of(wait, struct oom_wait_info, wait);
+
+        if (oom_wait_info->mem == wake_mem)
+                goto wakeup;
+        /* if no hierarchy, no match */
+        if (!oom_wait_info->mem->use_hierarchy || !wake_mem->use_hierarchy)
+                return 0;
+        /*
+         * Both of oom_wait_info->mem and wake_mem are stable under us.
+         * Then we can use css_is_ancestor without taking care of RCU.
+         */
+        if (!css_is_ancestor(&oom_wait_info->mem->css, &wake_mem->css) &&
+            !css_is_ancestor(&wake_mem->css, &oom_wait_info->mem->css))
+                return 0;
+
+wakeup:
+        return autoremove_wake_function(wait, mode, sync, arg);
+}
+
+static void memcg_wakeup_oom(struct mem_cgroup *mem)
+{
+        /* for filtering, pass "mem" as argument. */
+        __wake_up(&memcg_oom_waitq, TASK_NORMAL, 0, mem);
+}
+
+static void memcg_oom_recover(struct mem_cgroup *mem)
+{
+        if (mem->oom_kill_disable && atomic_read(&mem->oom_lock))
+                memcg_wakeup_oom(mem);
+}
+
 /*
  * try to call OOM killer. returns false if we should exit memory-reclaim loop.
  */
 bool mem_cgroup_handle_oom(struct mem_cgroup *mem, gfp_t mask)
 {
-        DEFINE_WAIT(wait);
-        bool locked;
+        struct oom_wait_info owait;
+        bool locked, need_to_kill;
 
+        owait.mem = mem;
+        owait.wait.flags = 0;
+        owait.wait.func = memcg_oom_wake_function;
+        owait.wait.private = current;
+        INIT_LIST_HEAD(&owait.wait.task_list);
+        need_to_kill = true;
         /* At first, try to OOM lock hierarchy under mem.*/
         mutex_lock(&memcg_oom_mutex);
         locked = mem_cgroup_oom_lock(mem);
@@ -1309,32 +1396,23 @@ bool mem_cgroup_handle_oom(struct mem_cgroup *mem, gfp_t mask)
          * accounting. So, UNINTERRUPTIBLE is appropriate. But SIGKILL
          * under OOM is always welcomed, use TASK_KILLABLE here.
          */
-        if (!locked)
-                prepare_to_wait(&memcg_oom_waitq, &wait, TASK_KILLABLE);
+        prepare_to_wait(&memcg_oom_waitq, &owait.wait, TASK_KILLABLE);
+        if (!locked || mem->oom_kill_disable)
+                need_to_kill = false;
+        if (locked)
+                mem_cgroup_oom_notify(mem);
         mutex_unlock(&memcg_oom_mutex);
 
-        if (locked)
+        if (need_to_kill) {
+                finish_wait(&memcg_oom_waitq, &owait.wait);
                 mem_cgroup_out_of_memory(mem, mask);
-        else {
+        } else {
                 schedule();
-                finish_wait(&memcg_oom_waitq, &wait);
+                finish_wait(&memcg_oom_waitq, &owait.wait);
         }
         mutex_lock(&memcg_oom_mutex);
         mem_cgroup_oom_unlock(mem);
-        /*
-         * Here, we use global waitq .....more fine grained waitq ?
-         * Assume following hierarchy.
-         * A/
-         *   01
-         *   02
-         * assume OOM happens both in A and 01 at the same time. Tthey are
-         * mutually exclusive by lock. (kill in 01 helps A.)
-         * When we use per memcg waitq, we have to wake up waiters on A and 02
-         * in addtion to waiters on 01. We use global waitq for avoiding mess.
-         * It will not be a big problem.
-         * (And a task may be moved to other groups while it's waiting for OOM.)
-         */
-        wake_up_all(&memcg_oom_waitq);
+        memcg_wakeup_oom(mem);
         mutex_unlock(&memcg_oom_mutex);
 
         if (test_thread_flag(TIF_MEMDIE) || fatal_signal_pending(current))
@@ -1438,7 +1516,7 @@ static void drain_local_stock(struct work_struct *dummy)
 
 /*
  * Cache charges(val) which is from res_counter, to local per_cpu area.
- * This will be consumed by consumt_stock() function, later.
+ * This will be consumed by consume_stock() function, later.
  */
 static void refill_stock(struct mem_cgroup *mem, int val)
 {
@@ -2118,15 +2196,6 @@ __do_uncharge(struct mem_cgroup *mem, const enum charge_type ctype)
         /* If swapout, usage of swap doesn't decrease */
         if (!do_swap_account || ctype == MEM_CGROUP_CHARGE_TYPE_SWAPOUT)
                 uncharge_memsw = false;
-        /*
-         * do_batch > 0 when unmapping pages or inode invalidate/truncate.
-         * In those cases, all pages freed continously can be expected to be in
-         * the same cgroup and we have chance to coalesce uncharges.
-         * But we do uncharge one by one if this is killed by OOM(TIF_MEMDIE)
-         * because we want to do uncharge as soon as possible.
-         */
-        if (!current->memcg_batch.do_batch || test_thread_flag(TIF_MEMDIE))
-                goto direct_uncharge;
 
         batch = &current->memcg_batch;
         /*
@@ -2137,6 +2206,17 @@ __do_uncharge(struct mem_cgroup *mem, const enum charge_type ctype)
         if (!batch->memcg)
                 batch->memcg = mem;
         /*
+         * do_batch > 0 when unmapping pages or inode invalidate/truncate.
+         * In those cases, all pages freed continously can be expected to be in
+         * the same cgroup and we have chance to coalesce uncharges.
+         * But we do uncharge one by one if this is killed by OOM(TIF_MEMDIE)
+         * because we want to do uncharge as soon as possible.
+         */
+
+        if (!batch->do_batch || test_thread_flag(TIF_MEMDIE))
+                goto direct_uncharge;
+
+        /*
          * In typical case, batch->memcg == mem. This means we can
          * merge a series of uncharges to an uncharge of res_counter.
          * If not, we uncharge res_counter ony by one.
@@ -2152,6 +2232,8 @@ direct_uncharge:
         res_counter_uncharge(&mem->res, PAGE_SIZE);
         if (uncharge_memsw)
                 res_counter_uncharge(&mem->memsw, PAGE_SIZE);
+        if (unlikely(batch->memcg != mem))
+                memcg_oom_recover(mem);
         return;
 }
 
@@ -2188,7 +2270,8 @@ __mem_cgroup_uncharge_common(struct page *page, enum charge_type ctype)
         switch (ctype) {
         case MEM_CGROUP_CHARGE_TYPE_MAPPED:
         case MEM_CGROUP_CHARGE_TYPE_DROP:
-                if (page_mapped(page))
+                /* See mem_cgroup_prepare_migration() */
+                if (page_mapped(page) || PageCgroupMigration(pc))
                         goto unlock_out;
                 break;
         case MEM_CGROUP_CHARGE_TYPE_SWAPOUT:
@@ -2288,6 +2371,7 @@ void mem_cgroup_uncharge_end(void)
                 res_counter_uncharge(&batch->memcg->res, batch->bytes);
         if (batch->memsw_bytes)
                 res_counter_uncharge(&batch->memcg->memsw, batch->memsw_bytes);
+        memcg_oom_recover(batch->memcg);
         /* forget this pointer (for sanity check) */
         batch->memcg = NULL;
 }
@@ -2410,10 +2494,12 @@ static inline int mem_cgroup_move_swap_account(swp_entry_t entry,
  * Before starting migration, account PAGE_SIZE to mem_cgroup that the old
  * page belongs to.
  */
-int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
+int mem_cgroup_prepare_migration(struct page *page,
+        struct page *newpage, struct mem_cgroup **ptr)
 {
         struct page_cgroup *pc;
         struct mem_cgroup *mem = NULL;
+        enum charge_type ctype;
         int ret = 0;
 
         if (mem_cgroup_disabled())
@@ -2424,69 +2510,125 @@ int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
         if (PageCgroupUsed(pc)) {
                 mem = pc->mem_cgroup;
                 css_get(&mem->css);
+                /*
+                 * At migrating an anonymous page, its mapcount goes down
+                 * to 0 and uncharge() will be called. But, even if it's fully
+                 * unmapped, migration may fail and this page has to be
+                 * charged again. We set MIGRATION flag here and delay uncharge
+                 * until end_migration() is called
+                 *
+                 * Corner Case Thinking
+                 * A)
+                 * When the old page was mapped as Anon and it's unmap-and-freed
+                 * while migration was ongoing.
+                 * If unmap finds the old page, uncharge() of it will be delayed
+                 * until end_migration(). If unmap finds a new page, it's
+                 * uncharged when it make mapcount to be 1->0. If unmap code
+                 * finds swap_migration_entry, the new page will not be mapped
+                 * and end_migration() will find it(mapcount==0).
+                 *
+                 * B)
+                 * When the old page was mapped but migraion fails, the kernel
+                 * remaps it. A charge for it is kept by MIGRATION flag even
+                 * if mapcount goes down to 0. We can do remap successfully
+                 * without charging it again.
+                 *
+                 * C)
+                 * The "old" page is under lock_page() until the end of
+                 * migration, so, the old page itself will not be swapped-out.
+                 * If the new page is swapped out before end_migraton, our
+                 * hook to usual swap-out path will catch the event.
+                 */
+                if (PageAnon(page))
+                        SetPageCgroupMigration(pc);
         }
         unlock_page_cgroup(pc);
+        /*
+         * If the page is not charged at this point,
+         * we return here.
+         */
+        if (!mem)
+                return 0;
 
         *ptr = mem;
-        if (mem) {
-                ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false);
-                css_put(&mem->css);
+        ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false);
+        css_put(&mem->css);/* drop extra refcnt */
+        if (ret || *ptr == NULL) {
+                if (PageAnon(page)) {
+                        lock_page_cgroup(pc);
+                        ClearPageCgroupMigration(pc);
+                        unlock_page_cgroup(pc);
+                        /*
+                         * The old page may be fully unmapped while we kept it.
+                         */
+                        mem_cgroup_uncharge_page(page);
+                }
+                return -ENOMEM;
         }
+        /*
+         * We charge new page before it's used/mapped. So, even if unlock_page()
+         * is called before end_migration, we can catch all events on this new
+         * page. In the case new page is migrated but not remapped, new page's
+         * mapcount will be finally 0 and we call uncharge in end_migration().
+         */
+        pc = lookup_page_cgroup(newpage);
+        if (PageAnon(page))
+                ctype = MEM_CGROUP_CHARGE_TYPE_MAPPED;
+        else if (page_is_file_cache(page))
+                ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
+        else
+                ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
+        __mem_cgroup_commit_charge(mem, pc, ctype);
         return ret;
 }
 
 /* remove redundant charge if migration failed*/
 void mem_cgroup_end_migration(struct mem_cgroup *mem,
-                struct page *oldpage, struct page *newpage)
+        struct page *oldpage, struct page *newpage)
 {
-        struct page *target, *unused;
+        struct page *used, *unused;
         struct page_cgroup *pc;
-        enum charge_type ctype;
 
         if (!mem)
                 return;
+        /* blocks rmdir() */
         cgroup_exclude_rmdir(&mem->css);
         /* at migration success, oldpage->mapping is NULL. */
         if (oldpage->mapping) {
-                target = oldpage;
-                unused = NULL;
+                used = oldpage;
+                unused = newpage;
         } else {
-                target = newpage;
+                used = newpage;
                 unused = oldpage;
         }
-
-        if (PageAnon(target))
-                ctype = MEM_CGROUP_CHARGE_TYPE_MAPPED;
-        else if (page_is_file_cache(target))
-                ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
-        else
-                ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-
-        /* unused page is not on radix-tree now. */
-        if (unused)
-                __mem_cgroup_uncharge_common(unused, ctype);
-
-        pc = lookup_page_cgroup(target);
         /*
-         * __mem_cgroup_commit_charge() check PCG_USED bit of page_cgroup.
-         * So, double-counting is effectively avoided.
+         * We disallowed uncharge of pages under migration because mapcount
+         * of the page goes down to zero, temporarly.
+         * Clear the flag and check the page should be charged.
          */
-        __mem_cgroup_commit_charge(mem, pc, ctype);
+        pc = lookup_page_cgroup(oldpage);
+        lock_page_cgroup(pc);
+        ClearPageCgroupMigration(pc);
+        unlock_page_cgroup(pc);
+
+        if (unused != oldpage)
+                pc = lookup_page_cgroup(unused);
+        __mem_cgroup_uncharge_common(unused, MEM_CGROUP_CHARGE_TYPE_FORCE);
 
+        pc = lookup_page_cgroup(used);
         /*
-         * Both of oldpage and newpage are still under lock_page().
-         * Then, we don't have to care about race in radix-tree.
-         * But we have to be careful that this page is unmapped or not.
-         *
-         * There is a case for !page_mapped(). At the start of
-         * migration, oldpage was mapped. But now, it's zapped.
-         * But we know *target* page is not freed/reused under us.
-         * mem_cgroup_uncharge_page() does all necessary checks.
+         * If a page is a file cache, radix-tree replacement is very atomic
+         * and we can skip this check. When it was an Anon page, its mapcount
+         * goes down to 0. But because we added MIGRATION flage, it's not
+         * uncharged yet. There are several case but page->mapcount check
+         * and USED bit check in mem_cgroup_uncharge_page() will do enough
+         * check. (see prepare_charge() also)
          */
-        if (ctype == MEM_CGROUP_CHARGE_TYPE_MAPPED)
-                mem_cgroup_uncharge_page(target);
+        if (PageAnon(used))
+                mem_cgroup_uncharge_page(used);
         /*
-         * At migration, we may charge account against cgroup which has no tasks
+         * At migration, we may charge account against cgroup which has no
+         * tasks.
          * So, rmdir()->pre_destroy() can be called while we do this charge.
          * In that case, we need to call pre_destroy() again. check it here.
          */
@@ -2524,10 +2666,11 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                                 unsigned long long val)
 {
         int retry_count;
-        u64 memswlimit;
+        u64 memswlimit, memlimit;
         int ret = 0;
         int children = mem_cgroup_count_children(memcg);
         u64 curusage, oldusage;
+        int enlarge;
 
         /*
          * For keeping hierarchical_reclaim simple, how long we should retry
@@ -2538,6 +2681,7 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
 
         oldusage = res_counter_read_u64(&memcg->res, RES_USAGE);
 
+        enlarge = 0;
         while (retry_count) {
                 if (signal_pending(current)) {
                         ret = -EINTR;
@@ -2555,6 +2699,11 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                         mutex_unlock(&set_limit_mutex);
                         break;
                 }
+
+                memlimit = res_counter_read_u64(&memcg->res, RES_LIMIT);
+                if (memlimit < val)
+                        enlarge = 1;
+
                 ret = res_counter_set_limit(&memcg->res, val);
                 if (!ret) {
                         if (memswlimit == val)
@@ -2576,6 +2725,8 @@ static int mem_cgroup_resize_limit(struct mem_cgroup *memcg,
                 else
                         oldusage = curusage;
         }
+        if (!ret && enlarge)
+                memcg_oom_recover(memcg);
 
         return ret;
 }
@@ -2584,9 +2735,10 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                                         unsigned long long val)
 {
         int retry_count;
-        u64 memlimit, oldusage, curusage;
+        u64 memlimit, memswlimit, oldusage, curusage;
         int children = mem_cgroup_count_children(memcg);
         int ret = -EBUSY;
+        int enlarge = 0;
 
         /* see mem_cgroup_resize_res_limit */
         retry_count = children * MEM_CGROUP_RECLAIM_RETRIES;
@@ -2608,6 +2760,9 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                         mutex_unlock(&set_limit_mutex);
                         break;
                 }
+                memswlimit = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
+                if (memswlimit < val)
+                        enlarge = 1;
                 ret = res_counter_set_limit(&memcg->memsw, val);
                 if (!ret) {
                         if (memlimit == val)
@@ -2630,6 +2785,8 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
                 else
                         oldusage = curusage;
         }
+        if (!ret && enlarge)
+                memcg_oom_recover(memcg);
         return ret;
 }
 
@@ -2821,6 +2978,7 @@ move_account:
                         if (ret)
                                 break;
                 }
+                memcg_oom_recover(mem);
                 /* it seems parent cgroup doesn't have enough mem */
                 if (ret == -ENOMEM)
                         goto try_to_free;
@@ -3311,9 +3469,9 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
 
         rcu_read_lock();
         if (!swap)
-                t = rcu_dereference(memcg->thresholds);
+                t = rcu_dereference(memcg->thresholds.primary);
         else
-                t = rcu_dereference(memcg->memsw_thresholds);
+                t = rcu_dereference(memcg->memsw_thresholds.primary);
 
         if (!t)
                 goto unlock;
@@ -3325,7 +3483,7 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
          * If it's not true, a threshold was crossed after last
          * call of __mem_cgroup_threshold().
          */
-        i = atomic_read(&t->current_threshold);
+        i = t->current_threshold;
 
         /*
          * Iterate backward over array of thresholds starting from
@@ -3349,7 +3507,7 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
                 eventfd_signal(t->entries[i].eventfd, 1);
 
         /* Update current_threshold */
-        atomic_set(&t->current_threshold, i - 1);
+        t->current_threshold = i - 1;
 unlock:
         rcu_read_unlock();
 }
@@ -3369,106 +3527,117 @@ static int compare_thresholds(const void *a, const void *b)
         return _a->threshold - _b->threshold;
 }
 
-static int mem_cgroup_register_event(struct cgroup *cgrp, struct cftype *cft,
-                struct eventfd_ctx *eventfd, const char *args)
+static int mem_cgroup_oom_notify_cb(struct mem_cgroup *mem, void *data)
+{
+        struct mem_cgroup_eventfd_list *ev;
+
+        list_for_each_entry(ev, &mem->oom_notify, list)
+                eventfd_signal(ev->eventfd, 1);
+        return 0;
+}
+
+static void mem_cgroup_oom_notify(struct mem_cgroup *mem)
+{
+        mem_cgroup_walk_tree(mem, NULL, mem_cgroup_oom_notify_cb);
+}
+
+static int mem_cgroup_usage_register_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd, const char *args)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
-        struct mem_cgroup_threshold_ary *thresholds, *thresholds_new;
+        struct mem_cgroup_thresholds *thresholds;
+        struct mem_cgroup_threshold_ary *new;
         int type = MEMFILE_TYPE(cft->private);
         u64 threshold, usage;
-        int size;
-        int i, ret;
+        int i, size, ret;
 
         ret = res_counter_memparse_write_strategy(args, &threshold);
         if (ret)
                 return ret;
 
         mutex_lock(&memcg->thresholds_lock);
+
         if (type == _MEM)
-                thresholds = memcg->thresholds;
+                thresholds = &memcg->thresholds;
         else if (type == _MEMSWAP)
-                thresholds = memcg->memsw_thresholds;
+                thresholds = &memcg->memsw_thresholds;
         else
                 BUG();
 
         usage = mem_cgroup_usage(memcg, type == _MEMSWAP);
 
         /* Check if a threshold crossed before adding a new one */
-        if (thresholds)
+        if (thresholds->primary)
                 __mem_cgroup_threshold(memcg, type == _MEMSWAP);
 
-        if (thresholds)
-                size = thresholds->size + 1;
-        else
-                size = 1;
+        size = thresholds->primary ? thresholds->primary->size + 1 : 1;
 
         /* Allocate memory for new array of thresholds */
-        thresholds_new = kmalloc(sizeof(*thresholds_new) +
-                        size * sizeof(struct mem_cgroup_threshold),
+        new = kmalloc(sizeof(*new) + size * sizeof(struct mem_cgroup_threshold),
                         GFP_KERNEL);
-        if (!thresholds_new) {
+        if (!new) {
                 ret = -ENOMEM;
                 goto unlock;
         }
-        thresholds_new->size = size;
+        new->size = size;
 
         /* Copy thresholds (if any) to new array */
-        if (thresholds)
-                memcpy(thresholds_new->entries, thresholds->entries,
-                                thresholds->size *
+        if (thresholds->primary) {
+                memcpy(new->entries, thresholds->primary->entries, (size - 1) *
                                 sizeof(struct mem_cgroup_threshold));
+        }
+
         /* Add new threshold */
-        thresholds_new->entries[size - 1].eventfd = eventfd;
-        thresholds_new->entries[size - 1].threshold = threshold;
+        new->entries[size - 1].eventfd = eventfd;
+        new->entries[size - 1].threshold = threshold;
 
         /* Sort thresholds. Registering of new threshold isn't time-critical */
-        sort(thresholds_new->entries, size,
-                        sizeof(struct mem_cgroup_threshold),
+        sort(new->entries, size, sizeof(struct mem_cgroup_threshold),
                         compare_thresholds, NULL);
 
         /* Find current threshold */
-        atomic_set(&thresholds_new->current_threshold, -1);
+        new->current_threshold = -1;
         for (i = 0; i < size; i++) {
-                if (thresholds_new->entries[i].threshold < usage) {
+                if (new->entries[i].threshold < usage) {
                         /*
-                         * thresholds_new->current_threshold will not be used
-                         * until rcu_assign_pointer(), so it's safe to increment
+                         * new->current_threshold will not be used until
+                         * rcu_assign_pointer(), so it's safe to increment
                          * it here.
                          */
-                        atomic_inc(&thresholds_new->current_threshold);
+                        ++new->current_threshold;
                 }
         }
 
-        if (type == _MEM)
-                rcu_assign_pointer(memcg->thresholds, thresholds_new);
-        else
-                rcu_assign_pointer(memcg->memsw_thresholds, thresholds_new);
+        /* Free old spare buffer and save old primary buffer as spare */
+        kfree(thresholds->spare);
+        thresholds->spare = thresholds->primary;
+
+        rcu_assign_pointer(thresholds->primary, new);
 
-        /* To be sure that nobody uses thresholds before freeing it */
+        /* To be sure that nobody uses thresholds */
         synchronize_rcu();
 
-        kfree(thresholds);
 unlock:
         mutex_unlock(&memcg->thresholds_lock);
 
         return ret;
 }
 
-static int mem_cgroup_unregister_event(struct cgroup *cgrp, struct cftype *cft,
-                struct eventfd_ctx *eventfd)
+static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
-        struct mem_cgroup_threshold_ary *thresholds, *thresholds_new;
+        struct mem_cgroup_thresholds *thresholds;
+        struct mem_cgroup_threshold_ary *new;
         int type = MEMFILE_TYPE(cft->private);
         u64 usage;
-        int size = 0;
-        int i, j, ret;
+        int i, j, size;
 
         mutex_lock(&memcg->thresholds_lock);
         if (type == _MEM)
-                thresholds = memcg->thresholds;
+                thresholds = &memcg->thresholds;
         else if (type == _MEMSWAP)
-                thresholds = memcg->memsw_thresholds;
+                thresholds = &memcg->memsw_thresholds;
         else
                 BUG();
 
@@ -3484,59 +3653,136 @@ static int mem_cgroup_unregister_event(struct cgroup *cgrp, struct cftype *cft,
         __mem_cgroup_threshold(memcg, type == _MEMSWAP);
 
         /* Calculate new number of threshold */
-        for (i = 0; i < thresholds->size; i++) {
-                if (thresholds->entries[i].eventfd != eventfd)
+        size = 0;
+        for (i = 0; i < thresholds->primary->size; i++) {
+                if (thresholds->primary->entries[i].eventfd != eventfd)
                         size++;
         }
 
+        new = thresholds->spare;
+
         /* Set thresholds array to NULL if we don't have thresholds */
         if (!size) {
-                thresholds_new = NULL;
-                goto assign;
+                kfree(new);
+                new = NULL;
+                goto swap_buffers;
         }
 
-        /* Allocate memory for new array of thresholds */
-        thresholds_new = kmalloc(sizeof(*thresholds_new) +
-                        size * sizeof(struct mem_cgroup_threshold),
-                        GFP_KERNEL);
-        if (!thresholds_new) {
-                ret = -ENOMEM;
-                goto unlock;
-        }
-        thresholds_new->size = size;
+        new->size = size;
 
         /* Copy thresholds and find current threshold */
-        atomic_set(&thresholds_new->current_threshold, -1);
-        for (i = 0, j = 0; i < thresholds->size; i++) {
-                if (thresholds->entries[i].eventfd == eventfd)
+        new->current_threshold = -1;
+        for (i = 0, j = 0; i < thresholds->primary->size; i++) {
+                if (thresholds->primary->entries[i].eventfd == eventfd)
                         continue;
 
-                thresholds_new->entries[j] = thresholds->entries[i];
-                if (thresholds_new->entries[j].threshold < usage) {
+                new->entries[j] = thresholds->primary->entries[i];
+                if (new->entries[j].threshold < usage) {
                         /*
-                         * thresholds_new->current_threshold will not be used
+                         * new->current_threshold will not be used
                          * until rcu_assign_pointer(), so it's safe to increment
                          * it here.
                          */
-                        atomic_inc(&thresholds_new->current_threshold);
+                        ++new->current_threshold;
                 }
                 j++;
         }
 
-assign:
-        if (type == _MEM)
-                rcu_assign_pointer(memcg->thresholds, thresholds_new);
-        else
-                rcu_assign_pointer(memcg->memsw_thresholds, thresholds_new);
+swap_buffers:
+        /* Swap primary and spare array */
+        thresholds->spare = thresholds->primary;
+        rcu_assign_pointer(thresholds->primary, new);
 
-        /* To be sure that nobody uses thresholds before freeing it */
+        /* To be sure that nobody uses thresholds */
         synchronize_rcu();
 
-        kfree(thresholds);
-unlock:
         mutex_unlock(&memcg->thresholds_lock);
+}
 
-        return ret;
+static int mem_cgroup_oom_register_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd, const char *args)
+{
+        struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
+        struct mem_cgroup_eventfd_list *event;
+        int type = MEMFILE_TYPE(cft->private);
+
+        BUG_ON(type != _OOM_TYPE);
+        event = kmalloc(sizeof(*event), GFP_KERNEL);
+        if (!event)
+                return -ENOMEM;
+
+        mutex_lock(&memcg_oom_mutex);
+
+        event->eventfd = eventfd;
+        list_add(&event->list, &memcg->oom_notify);
+
+        /* already in OOM ? */
+        if (atomic_read(&memcg->oom_lock))
+                eventfd_signal(eventfd, 1);
+        mutex_unlock(&memcg_oom_mutex);
+
+        return 0;
+}
+
+static void mem_cgroup_oom_unregister_event(struct cgroup *cgrp,
+        struct cftype *cft, struct eventfd_ctx *eventfd)
+{
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
+        struct mem_cgroup_eventfd_list *ev, *tmp;
+        int type = MEMFILE_TYPE(cft->private);
+
+        BUG_ON(type != _OOM_TYPE);
+
+        mutex_lock(&memcg_oom_mutex);
+
+        list_for_each_entry_safe(ev, tmp, &mem->oom_notify, list) {
+                if (ev->eventfd == eventfd) {
+                        list_del(&ev->list);
+                        kfree(ev);
+                }
+        }
+
+        mutex_unlock(&memcg_oom_mutex);
+}
+
+static int mem_cgroup_oom_control_read(struct cgroup *cgrp,
+        struct cftype *cft,  struct cgroup_map_cb *cb)
+{
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
+
+        cb->fill(cb, "oom_kill_disable", mem->oom_kill_disable);
+
+        if (atomic_read(&mem->oom_lock))
+                cb->fill(cb, "under_oom", 1);
+        else
+                cb->fill(cb, "under_oom", 0);
+        return 0;
+}
+
+/*
+ */
+static int mem_cgroup_oom_control_write(struct cgroup *cgrp,
+        struct cftype *cft, u64 val)
+{
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
+        struct mem_cgroup *parent;
+
+        /* cannot set to root cgroup and only 0 and 1 are allowed */
+        if (!cgrp->parent || !((val == 0) || (val == 1)))
+                return -EINVAL;
+
+        parent = mem_cgroup_from_cont(cgrp->parent);
+
+        cgroup_lock();
+        /* oom-kill-disable is a flag for subhierarchy. */
+        if ((parent->use_hierarchy) ||
+            (mem->use_hierarchy && !list_empty(&cgrp->children))) {
+                cgroup_unlock();
+                return -EINVAL;
+        }
+        mem->oom_kill_disable = val;
+        cgroup_unlock();
+        return 0;
 }
 
 static struct cftype mem_cgroup_files[] = {
@@ -3544,8 +3790,8 @@ static struct cftype mem_cgroup_files[] = {
                 .name = "usage_in_bytes",
                 .private = MEMFILE_PRIVATE(_MEM, RES_USAGE),
                 .read_u64 = mem_cgroup_read,
-                .register_event = mem_cgroup_register_event,
-                .unregister_event = mem_cgroup_unregister_event,
+                .register_event = mem_cgroup_usage_register_event,
+                .unregister_event = mem_cgroup_usage_unregister_event,
         },
         {
                 .name = "max_usage_in_bytes",
@@ -3594,6 +3840,14 @@ static struct cftype mem_cgroup_files[] = {
                 .read_u64 = mem_cgroup_move_charge_read,
                 .write_u64 = mem_cgroup_move_charge_write,
         },
+        {
+                .name = "oom_control",
+                .read_map = mem_cgroup_oom_control_read,
+                .write_u64 = mem_cgroup_oom_control_write,
+                .register_event = mem_cgroup_oom_register_event,
+                .unregister_event = mem_cgroup_oom_unregister_event,
+                .private = MEMFILE_PRIVATE(_OOM_TYPE, OOM_CONTROL),
+        },
 };
 
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
@@ -3602,8 +3856,8 @@ static struct cftype memsw_cgroup_files[] = {
                 .name = "memsw.usage_in_bytes",
                 .private = MEMFILE_PRIVATE(_MEMSWAP, RES_USAGE),
                 .read_u64 = mem_cgroup_read,
-                .register_event = mem_cgroup_register_event,
-                .unregister_event = mem_cgroup_unregister_event,
+                .register_event = mem_cgroup_usage_register_event,
+                .unregister_event = mem_cgroup_usage_unregister_event,
         },
         {
                 .name = "memsw.max_usage_in_bytes",
@@ -3831,6 +4085,7 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
         } else {
                 parent = mem_cgroup_from_cont(cont->parent);
                 mem->use_hierarchy = parent->use_hierarchy;
+                mem->oom_kill_disable = parent->oom_kill_disable;
         }
 
         if (parent && parent->use_hierarchy) {
@@ -3849,6 +4104,7 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
         }
         mem->last_scanned_child = 0;
         spin_lock_init(&mem->reclaim_param_lock);
+        INIT_LIST_HEAD(&mem->oom_notify);
 
         if (parent)
                 mem->swappiness = get_swappiness(parent);
@@ -3976,6 +4232,80 @@ enum mc_target_type {
         MC_TARGET_SWAP,
 };
 
+static struct page *mc_handle_present_pte(struct vm_area_struct *vma,
+                                                unsigned long addr, pte_t ptent)
+{
+        struct page *page = vm_normal_page(vma, addr, ptent);
+
+        if (!page || !page_mapped(page))
+                return NULL;
+        if (PageAnon(page)) {
+                /* we don't move shared anon */
+                if (!move_anon() || page_mapcount(page) > 2)
+                        return NULL;
+        } else if (!move_file())
+                /* we ignore mapcount for file pages */
+                return NULL;
+        if (!get_page_unless_zero(page))
+                return NULL;
+
+        return page;
+}
+
+static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
+                        unsigned long addr, pte_t ptent, swp_entry_t *entry)
+{
+        int usage_count;
+        struct page *page = NULL;
+        swp_entry_t ent = pte_to_swp_entry(ptent);
+
+        if (!move_anon() || non_swap_entry(ent))
+                return NULL;
+        usage_count = mem_cgroup_count_swap_user(ent, &page);
+        if (usage_count > 1) { /* we don't move shared anon */
+                if (page)
+                        put_page(page);
+                return NULL;
+        }
+        if (do_swap_account)
+                entry->val = ent.val;
+
+        return page;
+}
+
+static struct page *mc_handle_file_pte(struct vm_area_struct *vma,
+                        unsigned long addr, pte_t ptent, swp_entry_t *entry)
+{
+        struct page *page = NULL;
+        struct inode *inode;
+        struct address_space *mapping;
+        pgoff_t pgoff;
+
+        if (!vma->vm_file) /* anonymous vma */
+                return NULL;
+        if (!move_file())
+                return NULL;
+
+        inode = vma->vm_file->f_path.dentry->d_inode;
+        mapping = vma->vm_file->f_mapping;
+        if (pte_none(ptent))
+                pgoff = linear_page_index(vma, addr);
+        else /* pte_file(ptent) is true */
+                pgoff = pte_to_pgoff(ptent);
+
+        /* page is moved even if it's not RSS of this task(page-faulted). */
+        if (!mapping_cap_swap_backed(mapping)) { /* normal file */
+                page = find_get_page(mapping, pgoff);
+        } else { /* shmem/tmpfs file. we should take account of swap too. */
+                swp_entry_t ent;
+                mem_cgroup_get_shmem_target(inode, pgoff, &page, &ent);
+                if (do_swap_account)
+                        entry->val = ent.val;
+        }
+
+        return page;
+}
+
 static int is_target_pte_for_mc(struct vm_area_struct *vma,
                 unsigned long addr, pte_t ptent, union mc_target *target)
 {
@@ -3983,43 +4313,16 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
         struct page_cgroup *pc;
         int ret = 0;
         swp_entry_t ent = { .val = 0 };
-        int usage_count = 0;
-        bool move_anon = test_bit(MOVE_CHARGE_TYPE_ANON,
-                                        &mc.to->move_charge_at_immigrate);
 
-        if (!pte_present(ptent)) {
-                /* TODO: handle swap of shmes/tmpfs */
-                if (pte_none(ptent) || pte_file(ptent))
-                        return 0;
-                else if (is_swap_pte(ptent)) {
-                        ent = pte_to_swp_entry(ptent);
-                        if (!move_anon || non_swap_entry(ent))
-                                return 0;
-                        usage_count = mem_cgroup_count_swap_user(ent, &page);
-                }
-        } else {
-                page = vm_normal_page(vma, addr, ptent);
-                if (!page || !page_mapped(page))
-                        return 0;
-                /*
-                 * TODO: We don't move charges of file(including shmem/tmpfs)
-                 * pages for now.
-                 */
-                if (!move_anon || !PageAnon(page))
-                        return 0;
-                if (!get_page_unless_zero(page))
-                        return 0;
-                usage_count = page_mapcount(page);
-        }
-        if (usage_count > 1) {
-                /*
-                 * TODO: We don't move charges of shared(used by multiple
-                 * processes) pages for now.
-                 */
-                if (page)
-                        put_page(page);
+        if (pte_present(ptent))
+                page = mc_handle_present_pte(vma, addr, ptent);
+        else if (is_swap_pte(ptent))
+                page = mc_handle_swap_pte(vma, addr, ptent, &ent);
+        else if (pte_none(ptent) || pte_file(ptent))
+                page = mc_handle_file_pte(vma, addr, ptent, &ent);
+
+        if (!page && !ent.val)
                 return 0;
-        }
         if (page) {
                 pc = lookup_page_cgroup(page);
                 /*
@@ -4035,8 +4338,8 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
                 if (!ret || !target)
                         put_page(page);
         }
-        /* throught */
-        if (ent.val && do_swap_account && !ret &&
+        /* There is a swap entry and a page doesn't exist or isn't charged */
+        if (ent.val && !ret &&
                         css_id(&mc.from->css) == lookup_swap_cgroup(ent)) {
                 ret = MC_TARGET_SWAP;
                 if (target)
@@ -4077,9 +4380,6 @@ static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm)
                 };
                 if (is_vm_hugetlb_page(vma))
                         continue;
-                /* TODO: We don't move charges of shmem/tmpfs pages for now. */
-                if (vma->vm_flags & VM_SHARED)
-                        continue;
                 walk_page_range(vma->vm_start, vma->vm_end,
                                         &mem_cgroup_count_precharge_walk);
         }
@@ -4102,6 +4402,7 @@ static void mem_cgroup_clear_mc(void)
         if (mc.precharge) {
                 __mem_cgroup_cancel_charge(mc.to, mc.precharge);
                 mc.precharge = 0;
+                memcg_oom_recover(mc.to);
         }
         /*
          * we didn't uncharge from mc.from at mem_cgroup_move_account(), so
@@ -4110,6 +4411,7 @@ static void mem_cgroup_clear_mc(void)
         if (mc.moved_charge) {
                 __mem_cgroup_cancel_charge(mc.from, mc.moved_charge);
                 mc.moved_charge = 0;
+                memcg_oom_recover(mc.from);
         }
         /* we must fixup refcnts and charges */
         if (mc.moved_swap) {
@@ -4274,9 +4576,6 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
                 };
                 if (is_vm_hugetlb_page(vma))
                         continue;
-                /* TODO: We don't move charges of shmem/tmpfs pages for now. */
-                if (vma->vm_flags & VM_SHARED)
-                        continue;
                 ret = walk_page_range(vma->vm_start, vma->vm_end,
                                                 &mem_cgroup_move_charge_walk);
                 if (ret)
diff --git a/mm/memory.c b/mm/memory.c
index 833952d8b74d..119b7ccdf39b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1227,8 +1227,17 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
 }
 EXPORT_SYMBOL_GPL(zap_vma_ptes);
 
-/*
- * Do a quick page-table lookup for a single page.
+/**
+ * follow_page - look up a page descriptor from a user-virtual address
+ * @vma: vm_area_struct mapping @address
+ * @address: virtual address to look up
+ * @flags: flags modifying lookup behaviour
+ *
+ * @flags can have FOLL_ flags set, defined in <linux/mm.h>
+ *
+ * Returns the mapped (struct page *), %NULL if no mapping exists, or
+ * an error pointer if there is a mapping to something not represented
+ * by a page descriptor (see also vm_normal_page()).
  */
 struct page *follow_page(struct vm_area_struct *vma, unsigned long address,
                         unsigned int flags)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index be211a582930..a4cfcdc00455 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -415,12 +415,14 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
          * This means the page allocator ignores this zone.
          * So, zonelist must be updated after online.
          */
+        mutex_lock(&zonelists_mutex);
         if (!populated_zone(zone))
                 need_zonelists_rebuild = 1;
 
         ret = walk_system_ram_range(pfn, nr_pages, &onlined_pages,
                 online_pages_range);
         if (ret) {
+                mutex_unlock(&zonelists_mutex);
                 printk(KERN_DEBUG "online_pages %lx at %lx failed\n",
                         nr_pages, pfn);
                 memory_notify(MEM_CANCEL_ONLINE, &arg);
@@ -429,8 +431,12 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
 
         zone->present_pages += onlined_pages;
         zone->zone_pgdat->node_present_pages += onlined_pages;
+        if (need_zonelists_rebuild)
+                build_all_zonelists(zone);
+        else
+                zone_pcp_update(zone);
 
-        zone_pcp_update(zone);
+        mutex_unlock(&zonelists_mutex);
         setup_per_zone_wmarks();
         calculate_zone_inactive_ratio(zone);
         if (onlined_pages) {
@@ -438,10 +444,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
                 node_set_state(zone_to_nid(zone), N_HIGH_MEMORY);
         }
 
-        if (need_zonelists_rebuild)
-                build_all_zonelists();
-        else
-                vm_total_pages = nr_free_pagecache_pages();
+        vm_total_pages = nr_free_pagecache_pages();
 
         writeback_set_ratelimit();
 
@@ -482,6 +485,29 @@ static void rollback_node_hotadd(int nid, pg_data_t *pgdat)
 }
 
 
+/*
+ * called by cpu_up() to online a node without onlined memory.
+ */
+int mem_online_node(int nid)
+{
+        pg_data_t       *pgdat;
+        int     ret;
+
+        lock_system_sleep();
+        pgdat = hotadd_new_pgdat(nid, 0);
+        if (pgdat) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        node_set_online(nid);
+        ret = register_one_node(nid);
+        BUG_ON(ret);
+
+out:
+        unlock_system_sleep();
+        return ret;
+}
+
 /* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
 int __ref add_memory(int nid, u64 start, u64 size)
 {
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 08f40a2f3fe0..5d6fb339de03 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -119,7 +119,22 @@ struct mempolicy default_policy = {
 
 static const struct mempolicy_operations {
         int (*create)(struct mempolicy *pol, const nodemask_t *nodes);
-        void (*rebind)(struct mempolicy *pol, const nodemask_t *nodes);
+        /*
+         * If read-side task has no lock to protect task->mempolicy, write-side
+         * task will rebind the task->mempolicy by two step. The first step is
+         * setting all the newly nodes, and the second step is cleaning all the
+         * disallowed nodes. In this way, we can avoid finding no node to alloc
+         * page.
+         * If we have a lock to protect task->mempolicy in read-side, we do
+         * rebind directly.
+         *
+         * step:
+         *      MPOL_REBIND_ONCE - do rebind work at once
+         *      MPOL_REBIND_STEP1 - set all the newly nodes
+         *      MPOL_REBIND_STEP2 - clean all the disallowed nodes
+         */
+        void (*rebind)(struct mempolicy *pol, const nodemask_t *nodes,
+                        enum mpol_rebind_step step);
 } mpol_ops[MPOL_MAX];
 
 /* Check that the nodemask contains at least one populated zone */
@@ -127,9 +142,6 @@ static int is_valid_nodemask(const nodemask_t *nodemask)
 {
         int nd, k;
 
-        /* Check that there is something useful in this mask */
-        k = policy_zone;
-
         for_each_node_mask(nd, *nodemask) {
                 struct zone *z;
 
@@ -145,7 +157,7 @@ static int is_valid_nodemask(const nodemask_t *nodemask)
 
 static inline int mpol_store_user_nodemask(const struct mempolicy *pol)
 {
-        return pol->flags & (MPOL_F_STATIC_NODES | MPOL_F_RELATIVE_NODES);
+        return pol->flags & MPOL_MODE_FLAGS;
 }
 
 static void mpol_relative_nodemask(nodemask_t *ret, const nodemask_t *orig,
@@ -277,12 +289,19 @@ void __mpol_put(struct mempolicy *p)
         kmem_cache_free(policy_cache, p);
 }
 
-static void mpol_rebind_default(struct mempolicy *pol, const nodemask_t *nodes)
+static void mpol_rebind_default(struct mempolicy *pol, const nodemask_t *nodes,
+                                enum mpol_rebind_step step)
 {
 }
 
-static void mpol_rebind_nodemask(struct mempolicy *pol,
-                                 const nodemask_t *nodes)
+/*
+ * step:
+ *      MPOL_REBIND_ONCE  - do rebind work at once
+ *      MPOL_REBIND_STEP1 - set all the newly nodes
+ *      MPOL_REBIND_STEP2 - clean all the disallowed nodes
+ */
+static void mpol_rebind_nodemask(struct mempolicy *pol, const nodemask_t *nodes,
+                                 enum mpol_rebind_step step)
 {
         nodemask_t tmp;
 
@@ -291,12 +310,31 @@ static void mpol_rebind_nodemask(struct mempolicy *pol,
         else if (pol->flags & MPOL_F_RELATIVE_NODES)
                 mpol_relative_nodemask(&tmp, &pol->w.user_nodemask, nodes);
         else {
-                nodes_remap(tmp, pol->v.nodes, pol->w.cpuset_mems_allowed,
-                            *nodes);
-                pol->w.cpuset_mems_allowed = *nodes;
+                /*
+                 * if step == 1, we use ->w.cpuset_mems_allowed to cache the
+                 * result
+                 */
+                if (step == MPOL_REBIND_ONCE || step == MPOL_REBIND_STEP1) {
+                        nodes_remap(tmp, pol->v.nodes,
+                                        pol->w.cpuset_mems_allowed, *nodes);
+                        pol->w.cpuset_mems_allowed = step ? tmp : *nodes;
+                } else if (step == MPOL_REBIND_STEP2) {
+                        tmp = pol->w.cpuset_mems_allowed;
+                        pol->w.cpuset_mems_allowed = *nodes;
+                } else
+                        BUG();
         }
 
-        pol->v.nodes = tmp;
+        if (nodes_empty(tmp))
+                tmp = *nodes;
+
+        if (step == MPOL_REBIND_STEP1)
+                nodes_or(pol->v.nodes, pol->v.nodes, tmp);
+        else if (step == MPOL_REBIND_ONCE || step == MPOL_REBIND_STEP2)
+                pol->v.nodes = tmp;
+        else
+                BUG();
+
         if (!node_isset(current->il_next, tmp)) {
                 current->il_next = next_node(current->il_next, tmp);
                 if (current->il_next >= MAX_NUMNODES)
@@ -307,7 +345,8 @@ static void mpol_rebind_nodemask(struct mempolicy *pol,
 }
 
 static void mpol_rebind_preferred(struct mempolicy *pol,
-                                  const nodemask_t *nodes)
+                                  const nodemask_t *nodes,
+                                  enum mpol_rebind_step step)
 {
         nodemask_t tmp;
 
@@ -330,16 +369,45 @@ static void mpol_rebind_preferred(struct mempolicy *pol,
         }
 }
 
-/* Migrate a policy to a different set of nodes */
-static void mpol_rebind_policy(struct mempolicy *pol,
-                               const nodemask_t *newmask)
+/*
+ * mpol_rebind_policy - Migrate a policy to a different set of nodes
+ *
+ * If read-side task has no lock to protect task->mempolicy, write-side
+ * task will rebind the task->mempolicy by two step. The first step is
+ * setting all the newly nodes, and the second step is cleaning all the
+ * disallowed nodes. In this way, we can avoid finding no node to alloc
+ * page.
+ * If we have a lock to protect task->mempolicy in read-side, we do
+ * rebind directly.
+ *
+ * step:
+ *      MPOL_REBIND_ONCE  - do rebind work at once
+ *      MPOL_REBIND_STEP1 - set all the newly nodes
+ *      MPOL_REBIND_STEP2 - clean all the disallowed nodes
+ */
+static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask,
+                                enum mpol_rebind_step step)
 {
         if (!pol)
                 return;
-        if (!mpol_store_user_nodemask(pol) &&
+        if (!mpol_store_user_nodemask(pol) && step == 0 &&
             nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
                 return;
-        mpol_ops[pol->mode].rebind(pol, newmask);
+
+        if (step == MPOL_REBIND_STEP1 && (pol->flags & MPOL_F_REBINDING))
+                return;
+
+        if (step == MPOL_REBIND_STEP2 && !(pol->flags & MPOL_F_REBINDING))
+                BUG();
+
+        if (step == MPOL_REBIND_STEP1)
+                pol->flags |= MPOL_F_REBINDING;
+        else if (step == MPOL_REBIND_STEP2)
+                pol->flags &= ~MPOL_F_REBINDING;
+        else if (step >= MPOL_REBIND_NSTEP)
+                BUG();
+
+        mpol_ops[pol->mode].rebind(pol, newmask, step);
 }
 
 /*
@@ -349,9 +417,10 @@ static void mpol_rebind_policy(struct mempolicy *pol,
  * Called with task's alloc_lock held.
  */
 
-void mpol_rebind_task(struct task_struct *tsk, const nodemask_t *new)
+void mpol_rebind_task(struct task_struct *tsk, const nodemask_t *new,
+                        enum mpol_rebind_step step)
 {
-        mpol_rebind_policy(tsk->mempolicy, new);
+        mpol_rebind_policy(tsk->mempolicy, new, step);
 }
 
 /*
@@ -366,7 +435,7 @@ void mpol_rebind_mm(struct mm_struct *mm, nodemask_t *new)
 
         down_write(&mm->mmap_sem);
         for (vma = mm->mmap; vma; vma = vma->vm_next)
-                mpol_rebind_policy(vma->vm_policy, new);
+                mpol_rebind_policy(vma->vm_policy, new, MPOL_REBIND_ONCE);
         up_write(&mm->mmap_sem);
 }
 
@@ -859,7 +928,7 @@ static int migrate_to_node(struct mm_struct *mm, int source, int dest,
         nodes_clear(nmask);
         node_set(source, nmask);
 
-        check_range(mm, mm->mmap->vm_start, TASK_SIZE, &nmask,
+        check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask,
                         flags | MPOL_MF_DISCONTIG_OK, &pagelist);
 
         if (!list_empty(&pagelist))
@@ -1444,15 +1513,13 @@ static struct zonelist *policy_zonelist(gfp_t gfp, struct mempolicy *policy)
                 /*
                  * Normally, MPOL_BIND allocations are node-local within the
                  * allowed nodemask.  However, if __GFP_THISNODE is set and the
-                 * current node is part of the mask, we use the zonelist for
+                 * current node isn't part of the mask, we use the zonelist for
                  * the first node in the mask instead.
                  */
                 if (unlikely(gfp & __GFP_THISNODE) &&
                                 unlikely(!node_isset(nd, policy->v.nodes)))
                         nd = first_node(policy->v.nodes);
                 break;
-        case MPOL_INTERLEAVE: /* should not happen */
-                break;
         default:
                 BUG();
         }
@@ -1572,6 +1639,8 @@ static inline unsigned interleave_nid(struct mempolicy *pol,
  * to the struct mempolicy for conditional unref after allocation.
  * If the effective policy is 'BIND, returns a pointer to the mempolicy's
  * @nodemask for filtering the zonelist.
+ *
+ * Must be protected by get_mems_allowed()
  */
 struct zonelist *huge_zonelist(struct vm_area_struct *vma, unsigned long addr,
                                 gfp_t gfp_flags, struct mempolicy **mpol,
@@ -1617,6 +1686,7 @@ bool init_nodemask_of_mempolicy(nodemask_t *mask)
         if (!(mask && current->mempolicy))
                 return false;
 
+        task_lock(current);
         mempolicy = current->mempolicy;
         switch (mempolicy->mode) {
         case MPOL_PREFERRED:
@@ -1636,6 +1706,7 @@ bool init_nodemask_of_mempolicy(nodemask_t *mask)
         default:
                 BUG();
         }
+        task_unlock(current);
 
         return true;
 }
@@ -1683,13 +1754,17 @@ alloc_page_vma(gfp_t gfp, struct vm_area_struct *vma, unsigned long addr)
 {
         struct mempolicy *pol = get_vma_policy(current, vma, addr);
         struct zonelist *zl;
+        struct page *page;
 
+        get_mems_allowed();
         if (unlikely(pol->mode == MPOL_INTERLEAVE)) {
                 unsigned nid;
 
                 nid = interleave_nid(pol, vma, addr, PAGE_SHIFT);
                 mpol_cond_put(pol);
-                return alloc_page_interleave(gfp, 0, nid);
+                page = alloc_page_interleave(gfp, 0, nid);
+                put_mems_allowed();
+                return page;
         }
         zl = policy_zonelist(gfp, pol);
         if (unlikely(mpol_needs_cond_ref(pol))) {
@@ -1699,12 +1774,15 @@ alloc_page_vma(gfp_t gfp, struct vm_area_struct *vma, unsigned long addr)
                 struct page *page =  __alloc_pages_nodemask(gfp, 0,
                                                 zl, policy_nodemask(gfp, pol));
                 __mpol_put(pol);
+                put_mems_allowed();
                 return page;
         }
         /*
          * fast path:  default or task policy
          */
-        return __alloc_pages_nodemask(gfp, 0, zl, policy_nodemask(gfp, pol));
+        page = __alloc_pages_nodemask(gfp, 0, zl, policy_nodemask(gfp, pol));
+        put_mems_allowed();
+        return page;
 }
 
 /**
@@ -1729,18 +1807,23 @@ alloc_page_vma(gfp_t gfp, struct vm_area_struct *vma, unsigned long addr)
 struct page *alloc_pages_current(gfp_t gfp, unsigned order)
 {
         struct mempolicy *pol = current->mempolicy;
+        struct page *page;
 
         if (!pol || in_interrupt() || (gfp & __GFP_THISNODE))
                 pol = &default_policy;
 
+        get_mems_allowed();
         /*
          * No reference counting needed for current->mempolicy
          * nor system default_policy
          */
         if (pol->mode == MPOL_INTERLEAVE)
-                return alloc_page_interleave(gfp, order, interleave_nodes(pol));
-        return __alloc_pages_nodemask(gfp, order,
+                page = alloc_page_interleave(gfp, order, interleave_nodes(pol));
+        else
+                page = __alloc_pages_nodemask(gfp, order,
                         policy_zonelist(gfp, pol), policy_nodemask(gfp, pol));
+        put_mems_allowed();
+        return page;
 }
 EXPORT_SYMBOL(alloc_pages_current);
 
@@ -1750,6 +1833,9 @@ EXPORT_SYMBOL(alloc_pages_current);
  * with the mems_allowed returned by cpuset_mems_allowed().  This
  * keeps mempolicies cpuset relative after its cpuset moves.  See
  * further kernel/cpuset.c update_nodemask().
+ *
+ * current's mempolicy may be rebinded by the other task(the task that changes
+ * cpuset's mems), so we needn't do rebind work for current task.
  */
 
 /* Slow path of a mempolicy duplicate */
@@ -1759,13 +1845,24 @@ struct mempolicy *__mpol_dup(struct mempolicy *old)
 
         if (!new)
                 return ERR_PTR(-ENOMEM);
+
+        /* task's mempolicy is protected by alloc_lock */
+        if (old == current->mempolicy) {
+                task_lock(current);
+                *new = *old;
+                task_unlock(current);
+        } else
+                *new = *old;
+
         rcu_read_lock();
         if (current_cpuset_is_being_rebound()) {
                 nodemask_t mems = cpuset_mems_allowed(current);
-                mpol_rebind_policy(old, &mems);
+                if (new->flags & MPOL_F_REBINDING)
+                        mpol_rebind_policy(new, &mems, MPOL_REBIND_STEP2);
+                else
+                        mpol_rebind_policy(new, &mems, MPOL_REBIND_ONCE);
         }
         rcu_read_unlock();
-        *new = *old;
         atomic_set(&new->refcnt, 1);
         return new;
 }
@@ -1792,16 +1889,6 @@ struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
         return tompol;
 }
 
-static int mpol_match_intent(const struct mempolicy *a,
-                             const struct mempolicy *b)
-{
-        if (a->flags != b->flags)
-                return 0;
-        if (!mpol_store_user_nodemask(a))
-                return 1;
-        return nodes_equal(a->w.user_nodemask, b->w.user_nodemask);
-}
-
 /* Slow path of a mempolicy comparison */
 int __mpol_equal(struct mempolicy *a, struct mempolicy *b)
 {
@@ -1809,8 +1896,12 @@ int __mpol_equal(struct mempolicy *a, struct mempolicy *b)
                 return 0;
         if (a->mode != b->mode)
                 return 0;
-        if (a->mode != MPOL_DEFAULT && !mpol_match_intent(a, b))
+        if (a->flags != b->flags)
                 return 0;
+        if (mpol_store_user_nodemask(a))
+                if (!nodes_equal(a->w.user_nodemask, b->w.user_nodemask))
+                        return 0;
+
         switch (a->mode) {
         case MPOL_BIND:
                 /* Fall through */
@@ -2006,27 +2097,24 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                         return;
                 /* contextualize the tmpfs mount point mempolicy */
                 new = mpol_new(mpol->mode, mpol->flags, &mpol->w.user_nodemask);
-                if (IS_ERR(new)) {
-                        mpol_put(mpol); /* drop our ref on sb mpol */
-                        NODEMASK_SCRATCH_FREE(scratch);
-                        return;         /* no valid nodemask intersection */
-                }
+                if (IS_ERR(new))
+                        goto free_scratch; /* no valid nodemask intersection */
 
                 task_lock(current);
                 ret = mpol_set_nodemask(new, &mpol->w.user_nodemask, scratch);
                 task_unlock(current);
                 mpol_put(mpol); /* drop our ref on sb mpol */
-                if (ret) {
-                        NODEMASK_SCRATCH_FREE(scratch);
-                        mpol_put(new);
-                        return;
-                }
+                if (ret)
+                        goto put_free;
 
                 /* Create pseudo-vma that contains just the policy */
                 memset(&pvma, 0, sizeof(struct vm_area_struct));
                 pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                 mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
+
+put_free:
                 mpol_put(new);                  /* drop initial ref */
+free_scratch:
                 NODEMASK_SCRATCH_FREE(scratch);
         }
 }
@@ -2132,9 +2220,15 @@ void numa_default_policy(void)
  * "local" is pseudo-policy:  MPOL_PREFERRED with MPOL_F_LOCAL flag
  * Used only for mpol_parse_str() and mpol_to_str()
  */
-#define MPOL_LOCAL (MPOL_INTERLEAVE + 1)
-static const char * const policy_types[] =
-        { "default", "prefer", "bind", "interleave", "local" };
+#define MPOL_LOCAL MPOL_MAX
+static const char * const policy_modes[] =
+{
+        [MPOL_DEFAULT]    = "default",
+        [MPOL_PREFERRED]  = "prefer",
+        [MPOL_BIND]       = "bind",
+        [MPOL_INTERLEAVE] = "interleave",
+        [MPOL_LOCAL]      = "local"
+};
 
 
 #ifdef CONFIG_TMPFS
@@ -2159,12 +2253,11 @@ static const char * const policy_types[] =
 int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
 {
         struct mempolicy *new = NULL;
-        unsigned short uninitialized_var(mode);
+        unsigned short mode;
         unsigned short uninitialized_var(mode_flags);
         nodemask_t nodes;
         char *nodelist = strchr(str, ':');
         char *flags = strchr(str, '=');
-        int i;
         int err = 1;
 
         if (nodelist) {
@@ -2180,13 +2273,12 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
         if (flags)
                 *flags++ = '\0';        /* terminate mode string */
 
-        for (i = 0; i <= MPOL_LOCAL; i++) {
-                if (!strcmp(str, policy_types[i])) {
-                        mode = i;
+        for (mode = 0; mode <= MPOL_LOCAL; mode++) {
+                if (!strcmp(str, policy_modes[mode])) {
                         break;
                 }
         }
-        if (i > MPOL_LOCAL)
+        if (mode > MPOL_LOCAL)
                 goto out;
 
         switch (mode) {
@@ -2250,7 +2342,10 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
         if (IS_ERR(new))
                 goto out;
 
-        {
+        if (no_context) {
+                /* save for contextualization */
+                new->w.user_nodemask = nodes;
+        } else {
                 int ret;
                 NODEMASK_SCRATCH(scratch);
                 if (scratch) {
@@ -2266,10 +2361,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                 }
         }
         err = 0;
-        if (no_context) {
-                /* save for contextualization */
-                new->w.user_nodemask = nodes;
-        }
 
 out:
         /* Restore string for error message */
@@ -2338,11 +2429,11 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
                 BUG();
         }
 
-        l = strlen(policy_types[mode]);
+        l = strlen(policy_modes[mode]);
         if (buffer + maxlen < p + l + 1)
                 return -ENOSPC;
 
-        strcpy(p, policy_types[mode]);
+        strcpy(p, policy_modes[mode]);
         p += l;
 
         if (flags & MPOL_MODE_FLAGS) {
diff --git a/mm/migrate.c b/mm/migrate.c
index d3f3f7f81075..4205b1d6049e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -40,7 +40,8 @@
 
 /*
  * migrate_prep() needs to be called before we start compiling a list of pages
- * to be migrated using isolate_lru_page().
+ * to be migrated using isolate_lru_page(). If scheduling work on other CPUs is
+ * undesirable, use migrate_prep_local()
  */
 int migrate_prep(void)
 {
@@ -55,26 +56,29 @@ int migrate_prep(void)
         return 0;
 }
 
+/* Do the necessary work of migrate_prep but not if it involves other CPUs */
+int migrate_prep_local(void)
+{
+        lru_add_drain();
+
+        return 0;
+}
+
 /*
  * Add isolated pages on the list back to the LRU under page lock
  * to avoid leaking evictable pages back onto unevictable list.
- *
- * returns the number of pages put back.
  */
-int putback_lru_pages(struct list_head *l)
+void putback_lru_pages(struct list_head *l)
 {
         struct page *page;
         struct page *page2;
-        int count = 0;
 
         list_for_each_entry_safe(page, page2, l, lru) {
                 list_del(&page->lru);
                 dec_zone_page_state(page, NR_ISOLATED_ANON +
                                 page_is_file_cache(page));
                 putback_lru_page(page);
-                count++;
         }
-        return count;
 }
 
 /*
@@ -490,7 +494,8 @@ static int fallback_migrate_page(struct address_space *mapping,
  *   < 0 - error code
  *  == 0 - success
  */
-static int move_to_new_page(struct page *newpage, struct page *page)
+static int move_to_new_page(struct page *newpage, struct page *page,
+                                                int remap_swapcache)
 {
         struct address_space *mapping;
         int rc;
@@ -525,10 +530,12 @@ static int move_to_new_page(struct page *newpage, struct page *page)
         else
                 rc = fallback_migrate_page(mapping, newpage, page);
 
-        if (!rc)
-                remove_migration_ptes(page, newpage);
-        else
+        if (rc) {
                 newpage->mapping = NULL;
+        } else {
+                if (remap_swapcache)
+                        remove_migration_ptes(page, newpage);
+        }
 
         unlock_page(newpage);
 
@@ -545,9 +552,11 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         int rc = 0;
         int *result = NULL;
         struct page *newpage = get_new_page(page, private, &result);
+        int remap_swapcache = 1;
         int rcu_locked = 0;
         int charge = 0;
         struct mem_cgroup *mem = NULL;
+        struct anon_vma *anon_vma = NULL;
 
         if (!newpage)
                 return -ENOMEM;
@@ -581,7 +590,7 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         }
 
         /* charge against new page */
-        charge = mem_cgroup_prepare_migration(page, &mem);
+        charge = mem_cgroup_prepare_migration(page, newpage, &mem);
         if (charge == -ENOMEM) {
                 rc = -ENOMEM;
                 goto unlock;
@@ -604,6 +613,34 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         if (PageAnon(page)) {
                 rcu_read_lock();
                 rcu_locked = 1;
+
+                /* Determine how to safely use anon_vma */
+                if (!page_mapped(page)) {
+                        if (!PageSwapCache(page))
+                                goto rcu_unlock;
+
+                        /*
+                         * We cannot be sure that the anon_vma of an unmapped
+                         * swapcache page is safe to use because we don't
+                         * know in advance if the VMA that this page belonged
+                         * to still exists. If the VMA and others sharing the
+                         * data have been freed, then the anon_vma could
+                         * already be invalid.
+                         *
+                         * To avoid this possibility, swapcache pages get
+                         * migrated but are not remapped when migration
+                         * completes
+                         */
+                        remap_swapcache = 0;
+                } else {
+                        /*
+                         * Take a reference count on the anon_vma if the
+                         * page is mapped so that it is guaranteed to
+                         * exist when the page is remapped later
+                         */
+                        anon_vma = page_anon_vma(page);
+                        atomic_inc(&anon_vma->external_refcount);
+                }
         }
 
         /*
@@ -638,11 +675,20 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
 
 skip_unmap:
         if (!page_mapped(page))
-                rc = move_to_new_page(newpage, page);
+                rc = move_to_new_page(newpage, page, remap_swapcache);
 
-        if (rc)
+        if (rc && remap_swapcache)
                 remove_migration_ptes(page, page);
 rcu_unlock:
+
+        /* Drop an anon_vma reference if we took one */
+        if (anon_vma && atomic_dec_and_lock(&anon_vma->external_refcount, &anon_vma->lock)) {
+                int empty = list_empty(&anon_vma->head);
+                spin_unlock(&anon_vma->lock);
+                if (empty)
+                        anon_vma_free(anon_vma);
+        }
+
         if (rcu_locked)
                 rcu_read_unlock();
 uncharge:
diff --git a/mm/mincore.c b/mm/mincore.c
index f77433c20279..9ac42dc6d7b6 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -19,6 +19,40 @@
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 
+static void mincore_hugetlb_page_range(struct vm_area_struct *vma,
+                                unsigned long addr, unsigned long end,
+                                unsigned char *vec)
+{
+#ifdef CONFIG_HUGETLB_PAGE
+        struct hstate *h;
+
+        h = hstate_vma(vma);
+        while (1) {
+                unsigned char present;
+                pte_t *ptep;
+                /*
+                 * Huge pages are always in RAM for now, but
+                 * theoretically it needs to be checked.
+                 */
+                ptep = huge_pte_offset(current->mm,
+                                       addr & huge_page_mask(h));
+                present = ptep && !huge_pte_none(huge_ptep_get(ptep));
+                while (1) {
+                        *vec = present;
+                        vec++;
+                        addr += PAGE_SIZE;
+                        if (addr == end)
+                                return;
+                        /* check hugepage border */
+                        if (!(addr & ~huge_page_mask(h)))
+                                break;
+                }
+        }
+#else
+        BUG();
+#endif
+}
+
 /*
  * Later we can get more picky about what "in core" means precisely.
  * For now, simply check to see if the page is in the page cache,
@@ -49,145 +83,150 @@ static unsigned char mincore_page(struct address_space *mapping, pgoff_t pgoff)
         return present;
 }
 
-/*
- * Do a chunk of "sys_mincore()". We've already checked
- * all the arguments, we hold the mmap semaphore: we should
- * just return the amount of info we're asked for.
- */
-static long do_mincore(unsigned long addr, unsigned char *vec, unsigned long pages)
+static void mincore_unmapped_range(struct vm_area_struct *vma,
+                                unsigned long addr, unsigned long end,
+                                unsigned char *vec)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *ptep;
-        spinlock_t *ptl;
-        unsigned long nr;
+        unsigned long nr = (end - addr) >> PAGE_SHIFT;
         int i;
-        pgoff_t pgoff;
-        struct vm_area_struct *vma = find_vma(current->mm, addr);
 
-        /*
-         * find_vma() didn't find anything above us, or we're
-         * in an unmapped hole in the address space: ENOMEM.
-         */
-        if (!vma || addr < vma->vm_start)
-                return -ENOMEM;
-
-#ifdef CONFIG_HUGETLB_PAGE
-        if (is_vm_hugetlb_page(vma)) {
-                struct hstate *h;
-                unsigned long nr_huge;
-                unsigned char present;
+        if (vma->vm_file) {
+                pgoff_t pgoff;
 
-                i = 0;
-                nr = min(pages, (vma->vm_end - addr) >> PAGE_SHIFT);
-                h = hstate_vma(vma);
-                nr_huge = ((addr + pages * PAGE_SIZE - 1) >> huge_page_shift(h))
-                          - (addr >> huge_page_shift(h)) + 1;
-                nr_huge = min(nr_huge,
-                              (vma->vm_end - addr) >> huge_page_shift(h));
-                while (1) {
-                        /* hugepage always in RAM for now,
-                         * but generally it needs to be check */
-                        ptep = huge_pte_offset(current->mm,
-                                               addr & huge_page_mask(h));
-                        present = !!(ptep &&
-                                     !huge_pte_none(huge_ptep_get(ptep)));
-                        while (1) {
-                                vec[i++] = present;
-                                addr += PAGE_SIZE;
-                                /* reach buffer limit */
-                                if (i == nr)
-                                        return nr;
-                                /* check hugepage border */
-                                if (!((addr & ~huge_page_mask(h))
-                                      >> PAGE_SHIFT))
-                                        break;
-                        }
-                }
-                return nr;
+                pgoff = linear_page_index(vma, addr);
+                for (i = 0; i < nr; i++, pgoff++)
+                        vec[i] = mincore_page(vma->vm_file->f_mapping, pgoff);
+        } else {
+                for (i = 0; i < nr; i++)
+                        vec[i] = 0;
         }
-#endif
-
-        /*
-         * Calculate how many pages there are left in the last level of the
-         * PTE array for our address.
-         */
-        nr = PTRS_PER_PTE - ((addr >> PAGE_SHIFT) & (PTRS_PER_PTE-1));
-
-        /*
-         * Don't overrun this vma
-         */
-        nr = min(nr, (vma->vm_end - addr) >> PAGE_SHIFT);
-
-        /*
-         * Don't return more than the caller asked for
-         */
-        nr = min(nr, pages);
+}
 
-        pgd = pgd_offset(vma->vm_mm, addr);
-        if (pgd_none_or_clear_bad(pgd))
-                goto none_mapped;
-        pud = pud_offset(pgd, addr);
-        if (pud_none_or_clear_bad(pud))
-                goto none_mapped;
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none_or_clear_bad(pmd))
-                goto none_mapped;
+static void mincore_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+                        unsigned long addr, unsigned long end,
+                        unsigned char *vec)
+{
+        unsigned long next;
+        spinlock_t *ptl;
+        pte_t *ptep;
 
         ptep = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
-        for (i = 0; i < nr; i++, ptep++, addr += PAGE_SIZE) {
-                unsigned char present;
+        do {
                 pte_t pte = *ptep;
+                pgoff_t pgoff;
 
-                if (pte_present(pte)) {
-                        present = 1;
-
-                } else if (pte_none(pte)) {
-                        if (vma->vm_file) {
-                                pgoff = linear_page_index(vma, addr);
-                                present = mincore_page(vma->vm_file->f_mapping,
-                                                        pgoff);
-                        } else
-                                present = 0;
-
-                } else if (pte_file(pte)) {
+                next = addr + PAGE_SIZE;
+                if (pte_none(pte))
+                        mincore_unmapped_range(vma, addr, next, vec);
+                else if (pte_present(pte))
+                        *vec = 1;
+                else if (pte_file(pte)) {
                         pgoff = pte_to_pgoff(pte);
-                        present = mincore_page(vma->vm_file->f_mapping, pgoff);
-
+                        *vec = mincore_page(vma->vm_file->f_mapping, pgoff);
                 } else { /* pte is a swap entry */
                         swp_entry_t entry = pte_to_swp_entry(pte);
+
                         if (is_migration_entry(entry)) {
                                 /* migration entries are always uptodate */
-                                present = 1;
+                                *vec = 1;
                         } else {
 #ifdef CONFIG_SWAP
                                 pgoff = entry.val;
-                                present = mincore_page(&swapper_space, pgoff);
+                                *vec = mincore_page(&swapper_space, pgoff);
 #else
                                 WARN_ON(1);
-                                present = 1;
+                                *vec = 1;
 #endif
                         }
                 }
+                vec++;
+        } while (ptep++, addr = next, addr != end);
+        pte_unmap_unlock(ptep - 1, ptl);
+}
 
-                vec[i] = present;
-        }
-        pte_unmap_unlock(ptep-1, ptl);
+static void mincore_pmd_range(struct vm_area_struct *vma, pud_t *pud,
+                        unsigned long addr, unsigned long end,
+                        unsigned char *vec)
+{
+        unsigned long next;
+        pmd_t *pmd;
 
-        return nr;
+        pmd = pmd_offset(pud, addr);
+        do {
+                next = pmd_addr_end(addr, end);
+                if (pmd_none_or_clear_bad(pmd))
+                        mincore_unmapped_range(vma, addr, next, vec);
+                else
+                        mincore_pte_range(vma, pmd, addr, next, vec);
+                vec += (next - addr) >> PAGE_SHIFT;
+        } while (pmd++, addr = next, addr != end);
+}
 
-none_mapped:
-        if (vma->vm_file) {
-                pgoff = linear_page_index(vma, addr);
-                for (i = 0; i < nr; i++, pgoff++)
-                        vec[i] = mincore_page(vma->vm_file->f_mapping, pgoff);
-        } else {
-                for (i = 0; i < nr; i++)
-                        vec[i] = 0;
+static void mincore_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
+                        unsigned long addr, unsigned long end,
+                        unsigned char *vec)
+{
+        unsigned long next;
+        pud_t *pud;
+
+        pud = pud_offset(pgd, addr);
+        do {
+                next = pud_addr_end(addr, end);
+                if (pud_none_or_clear_bad(pud))
+                        mincore_unmapped_range(vma, addr, next, vec);
+                else
+                        mincore_pmd_range(vma, pud, addr, next, vec);
+                vec += (next - addr) >> PAGE_SHIFT;
+        } while (pud++, addr = next, addr != end);
+}
+
+static void mincore_page_range(struct vm_area_struct *vma,
+                        unsigned long addr, unsigned long end,
+                        unsigned char *vec)
+{
+        unsigned long next;
+        pgd_t *pgd;
+
+        pgd = pgd_offset(vma->vm_mm, addr);
+        do {
+                next = pgd_addr_end(addr, end);
+                if (pgd_none_or_clear_bad(pgd))
+                        mincore_unmapped_range(vma, addr, next, vec);
+                else
+                        mincore_pud_range(vma, pgd, addr, next, vec);
+                vec += (next - addr) >> PAGE_SHIFT;
+        } while (pgd++, addr = next, addr != end);
+}
+
+/*
+ * Do a chunk of "sys_mincore()". We've already checked
+ * all the arguments, we hold the mmap semaphore: we should
+ * just return the amount of info we're asked for.
+ */
+static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *vec)
+{
+        struct vm_area_struct *vma;
+        unsigned long end;
+
+        vma = find_vma(current->mm, addr);
+        if (!vma || addr < vma->vm_start)
+                return -ENOMEM;
+
+        end = min(vma->vm_end, addr + (pages << PAGE_SHIFT));
+
+        if (is_vm_hugetlb_page(vma)) {
+                mincore_hugetlb_page_range(vma, addr, end, vec);
+                return (end - addr) >> PAGE_SHIFT;
         }
 
-        return nr;
+        end = pmd_addr_end(addr, end);
+
+        if (is_vm_hugetlb_page(vma))
+                mincore_hugetlb_page_range(vma, addr, end, vec);
+        else
+                mincore_page_range(vma, addr, end, vec);
+
+        return (end - addr) >> PAGE_SHIFT;
 }
 
 /*
@@ -247,7 +286,7 @@ SYSCALL_DEFINE3(mincore, unsigned long, start, size_t, len,
                  * the temporary buffer size.
                  */
                 down_read(&current->mm->mmap_sem);
-                retval = do_mincore(start, tmp, min(pages, PAGE_SIZE));
+                retval = do_mincore(start, min(pages, PAGE_SIZE), tmp);
                 up_read(&current->mm->mmap_sem);
 
                 if (retval <= 0)
diff --git a/mm/mlock.c b/mm/mlock.c
index 8f4e2dfceec1..3f82720e0515 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -607,44 +607,3 @@ void user_shm_unlock(size_t size, struct user_struct *user)
         spin_unlock(&shmlock_user_lock);
         free_uid(user);
 }
-
-int account_locked_memory(struct mm_struct *mm, struct rlimit *rlim,
-                          size_t size)
-{
-        unsigned long lim, vm, pgsz;
-        int error = -ENOMEM;
-
-        pgsz = PAGE_ALIGN(size) >> PAGE_SHIFT;
-
-        down_write(&mm->mmap_sem);
-
-        lim = ACCESS_ONCE(rlim[RLIMIT_AS].rlim_cur) >> PAGE_SHIFT;
-        vm   = mm->total_vm + pgsz;
-        if (lim < vm)
-                goto out;
-
-        lim = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur) >> PAGE_SHIFT;
-        vm   = mm->locked_vm + pgsz;
-        if (lim < vm)
-                goto out;
-
-        mm->total_vm  += pgsz;
-        mm->locked_vm += pgsz;
-
-        error = 0;
- out:
-        up_write(&mm->mmap_sem);
-        return error;
-}
-
-void refund_locked_memory(struct mm_struct *mm, size_t size)
-{
-        unsigned long pgsz = PAGE_ALIGN(size) >> PAGE_SHIFT;
-
-        down_write(&mm->mmap_sem);
-
-        mm->total_vm  -= pgsz;
-        mm->locked_vm -= pgsz;
-
-        up_write(&mm->mmap_sem);
-}
diff --git a/mm/msync.c b/mm/msync.c
index 4083209b7f02..632df4527c01 100644
--- a/mm/msync.c
+++ b/mm/msync.c
@@ -82,7 +82,7 @@ SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
                                 (vma->vm_flags & VM_SHARED)) {
                         get_file(file);
                         up_read(&mm->mmap_sem);
-                        error = vfs_fsync(file, file->f_path.dentry, 0);
+                        error = vfs_fsync(file, 0);
                         fput(file);
                         if (error || start >= end)
                                 goto out;
diff --git a/mm/nommu.c b/mm/nommu.c
index 63fa17d121f0..b76f3ee0abe0 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -918,14 +918,6 @@ static int validate_mmap_request(struct file *file,
                         if (!(capabilities & BDI_CAP_MAP_DIRECT))
                                 return -ENODEV;
 
-                        if (((prot & PROT_READ)  && !(capabilities & BDI_CAP_READ_MAP))  ||
-                            ((prot & PROT_WRITE) && !(capabilities & BDI_CAP_WRITE_MAP)) ||
-                            ((prot & PROT_EXEC)  && !(capabilities & BDI_CAP_EXEC_MAP))
-                            ) {
-                                printk("MAP_SHARED not completely supported on !MMU\n");
-                                return -EINVAL;
-                        }
-
                         /* we mustn't privatise shared mappings */
                         capabilities &= ~BDI_CAP_MAP_COPY;
                 }
@@ -941,6 +933,20 @@ static int validate_mmap_request(struct file *file,
                                 capabilities &= ~BDI_CAP_MAP_DIRECT;
                 }
 
+                if (capabilities & BDI_CAP_MAP_DIRECT) {
+                        if (((prot & PROT_READ)  && !(capabilities & BDI_CAP_READ_MAP))  ||
+                            ((prot & PROT_WRITE) && !(capabilities & BDI_CAP_WRITE_MAP)) ||
+                            ((prot & PROT_EXEC)  && !(capabilities & BDI_CAP_EXEC_MAP))
+                            ) {
+                                capabilities &= ~BDI_CAP_MAP_DIRECT;
+                                if (flags & MAP_SHARED) {
+                                        printk(KERN_WARNING
+                                               "MAP_SHARED not completely supported on !MMU\n");
+                                        return -EINVAL;
+                                }
+                        }
+                }
+
                 /* handle executable mappings and implied executable
                  * mappings */
                 if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) {
@@ -996,22 +1002,20 @@ static unsigned long determine_vm_flags(struct file *file,
         unsigned long vm_flags;
 
         vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags);
-        vm_flags |= VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
         /* vm_flags |= mm->def_flags; */
 
         if (!(capabilities & BDI_CAP_MAP_DIRECT)) {
                 /* attempt to share read-only copies of mapped file chunks */
+                vm_flags |= VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
                 if (file && !(prot & PROT_WRITE))
                         vm_flags |= VM_MAYSHARE;
-        }
-        else {
+        } else {
                 /* overlay a shareable mapping on the backing device or inode
                  * if possible - used for chardevs, ramfs/tmpfs/shmfs and
                  * romfs/cramfs */
+                vm_flags |= VM_MAYSHARE | (capabilities & BDI_CAP_VMFLAGS);
                 if (flags & MAP_SHARED)
-                        vm_flags |= VM_MAYSHARE | VM_SHARED;
-                else if ((((vm_flags & capabilities) ^ vm_flags) & BDI_CAP_VMFLAGS) == 0)
-                        vm_flags |= VM_MAYSHARE;
+                        vm_flags |= VM_SHARED;
         }
 
         /* refuse to let anyone share private mappings with this process if
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b68e802a7a7d..709aedfaa014 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -479,12 +479,9 @@ void mem_cgroup_out_of_memory(struct mem_cgroup *mem, gfp_t gfp_mask)
         read_lock(&tasklist_lock);
 retry:
         p = select_bad_process(&points, mem);
-        if (PTR_ERR(p) == -1UL)
+        if (!p || PTR_ERR(p) == -1UL)
                 goto out;
 
-        if (!p)
-                p = current;
-
         if (oom_kill_process(p, gfp_mask, 0, points, mem,
                                 "Memory cgroup out of memory"))
                 goto retry;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 0b19943ecf8b..b289310e2c89 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -597,7 +597,7 @@ static void balance_dirty_pages(struct address_space *mapping,
             (!laptop_mode && ((global_page_state(NR_FILE_DIRTY)
                                + global_page_state(NR_UNSTABLE_NFS))
                                           > background_thresh)))
-                bdi_start_writeback(bdi, NULL, 0);
+                bdi_start_writeback(bdi, NULL, 0, 0);
 }
 
 void set_page_dirty_balance(struct page *page, int page_mkwrite)
@@ -683,10 +683,6 @@ void throttle_vm_writeout(gfp_t gfp_mask)
         }
 }
 
-static void laptop_timer_fn(unsigned long unused);
-
-static DEFINE_TIMER(laptop_mode_wb_timer, laptop_timer_fn, 0, 0);
-
 /*
  * sysctl handler for /proc/sys/vm/dirty_writeback_centisecs
  */
@@ -694,24 +690,24 @@ int dirty_writeback_centisecs_handler(ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
         proc_dointvec(table, write, buffer, length, ppos);
+        bdi_arm_supers_timer();
         return 0;
 }
 
-static void do_laptop_sync(struct work_struct *work)
+#ifdef CONFIG_BLOCK
+void laptop_mode_timer_fn(unsigned long data)
 {
-        wakeup_flusher_threads(0);
-        kfree(work);
-}
+        struct request_queue *q = (struct request_queue *)data;
+        int nr_pages = global_page_state(NR_FILE_DIRTY) +
+                global_page_state(NR_UNSTABLE_NFS);
 
-static void laptop_timer_fn(unsigned long unused)
-{
-        struct work_struct *work;
+        /*
+         * We want to write everything out, not just down to the dirty
+         * threshold
+         */
 
-        work = kmalloc(sizeof(*work), GFP_ATOMIC);
-        if (work) {
-                INIT_WORK(work, do_laptop_sync);
-                schedule_work(work);
-        }
+        if (bdi_has_dirty_io(&q->backing_dev_info))
+                bdi_start_writeback(&q->backing_dev_info, NULL, nr_pages, 0);
 }
 
 /*
@@ -719,9 +715,9 @@ static void laptop_timer_fn(unsigned long unused)
  * of all dirty data a few seconds from now.  If the flush is already scheduled
  * then push it back - the user is still using the disk.
  */
-void laptop_io_completion(void)
+void laptop_io_completion(struct backing_dev_info *info)
 {
-        mod_timer(&laptop_mode_wb_timer, jiffies + laptop_mode);
+        mod_timer(&info->laptop_mode_wb_timer, jiffies + laptop_mode);
 }
 
 /*
@@ -731,8 +727,16 @@ void laptop_io_completion(void)
  */
 void laptop_sync_completion(void)
 {
-        del_timer(&laptop_mode_wb_timer);
+        struct backing_dev_info *bdi;
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(bdi, &bdi_list, bdi_list)
+                del_timer(&bdi->laptop_mode_wb_timer);
+
+        rcu_read_unlock();
 }
+#endif
 
 /*
  * If ratelimit_pages is too high then we can get into dirty-data overload
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d03c946d5566..431214b941ac 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -49,6 +49,7 @@
 #include <linux/debugobjects.h>
 #include <linux/kmemleak.h>
 #include <linux/memory.h>
+#include <linux/compaction.h>
 #include <trace/events/kmem.h>
 #include <linux/ftrace_event.h>
 
@@ -56,6 +57,22 @@
 #include <asm/div64.h>
 #include "internal.h"
 
+#ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
+DEFINE_PER_CPU(int, numa_node);
+EXPORT_PER_CPU_SYMBOL(numa_node);
+#endif
+
+#ifdef CONFIG_HAVE_MEMORYLESS_NODES
+/*
+ * N.B., Do NOT reference the '_numa_mem_' per cpu variable directly.
+ * It will not be defined when CONFIG_HAVE_MEMORYLESS_NODES is not defined.
+ * Use the accessor functions set_numa_mem(), numa_mem_id() and cpu_to_mem()
+ * defined in <linux/topology.h>.
+ */
+DEFINE_PER_CPU(int, _numa_mem_);                /* Kernel "local memory" node */
+EXPORT_PER_CPU_SYMBOL(_numa_mem_);
+#endif
+
 /*
  * Array of node states.
  */
@@ -475,6 +492,8 @@ static inline void __free_one_page(struct page *page,
                 int migratetype)
 {
         unsigned long page_idx;
+        unsigned long combined_idx;
+        struct page *buddy;
 
         if (unlikely(PageCompound(page)))
                 if (unlikely(destroy_compound_page(page, order)))
@@ -488,9 +507,6 @@ static inline void __free_one_page(struct page *page,
         VM_BUG_ON(bad_range(zone, page));
 
         while (order < MAX_ORDER-1) {
-                unsigned long combined_idx;
-                struct page *buddy;
-
                 buddy = __page_find_buddy(page, page_idx, order);
                 if (!page_is_buddy(page, buddy, order))
                         break;
@@ -505,8 +521,29 @@ static inline void __free_one_page(struct page *page,
                 order++;
         }
         set_page_order(page, order);
-        list_add(&page->lru,
-                &zone->free_area[order].free_list[migratetype]);
+
+        /*
+         * If this is not the largest possible page, check if the buddy
+         * of the next-highest order is free. If it is, it's possible
+         * that pages are being freed that will coalesce soon. In case,
+         * that is happening, add the free page to the tail of the list
+         * so it's less likely to be used soon and more likely to be merged
+         * as a higher order page
+         */
+        if ((order < MAX_ORDER-1) && pfn_valid_within(page_to_pfn(buddy))) {
+                struct page *higher_page, *higher_buddy;
+                combined_idx = __find_combined_index(page_idx, order);
+                higher_page = page + combined_idx - page_idx;
+                higher_buddy = __page_find_buddy(higher_page, combined_idx, order + 1);
+                if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
+                        list_add_tail(&page->lru,
+                                &zone->free_area[order].free_list[migratetype]);
+                        goto out;
+                }
+        }
+
+        list_add(&page->lru, &zone->free_area[order].free_list[migratetype]);
+out:
         zone->free_area[order].nr_free++;
 }
 
@@ -599,20 +636,23 @@ static void free_one_page(struct zone *zone, struct page *page, int order,
         spin_unlock(&zone->lock);
 }
 
-static void __free_pages_ok(struct page *page, unsigned int order)
+static bool free_pages_prepare(struct page *page, unsigned int order)
 {
-        unsigned long flags;
         int i;
         int bad = 0;
-        int wasMlocked = __TestClearPageMlocked(page);
 
         trace_mm_page_free_direct(page, order);
         kmemcheck_free_shadow(page, order);
 
-        for (i = 0 ; i < (1 << order) ; ++i)
-                bad += free_pages_check(page + i);
+        for (i = 0; i < (1 << order); i++) {
+                struct page *pg = page + i;
+
+                if (PageAnon(pg))
+                        pg->mapping = NULL;
+                bad += free_pages_check(pg);
+        }
         if (bad)
-                return;
+                return false;
 
         if (!PageHighMem(page)) {
                 debug_check_no_locks_freed(page_address(page),PAGE_SIZE<<order);
@@ -622,6 +662,17 @@ static void __free_pages_ok(struct page *page, unsigned int order)
         arch_free_page(page, order);
         kernel_map_pages(page, 1 << order, 0);
 
+        return true;
+}
+
+static void __free_pages_ok(struct page *page, unsigned int order)
+{
+        unsigned long flags;
+        int wasMlocked = __TestClearPageMlocked(page);
+
+        if (!free_pages_prepare(page, order))
+                return;
+
         local_irq_save(flags);
         if (unlikely(wasMlocked))
                 free_page_mlock(page);
@@ -1107,21 +1158,9 @@ void free_hot_cold_page(struct page *page, int cold)
         int migratetype;
         int wasMlocked = __TestClearPageMlocked(page);
 
-        trace_mm_page_free_direct(page, 0);
-        kmemcheck_free_shadow(page, 0);
-
-        if (PageAnon(page))
-                page->mapping = NULL;
-        if (free_pages_check(page))
+        if (!free_pages_prepare(page, 0))
                 return;
 
-        if (!PageHighMem(page)) {
-                debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
-                debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
-        }
-        arch_free_page(page, 0);
-        kernel_map_pages(page, 1, 0);
-
         migratetype = get_pageblock_migratetype(page);
         set_page_private(page, migratetype);
         local_irq_save(flags);
@@ -1188,6 +1227,51 @@ void split_page(struct page *page, unsigned int order)
 }
 
 /*
+ * Similar to split_page except the page is already free. As this is only
+ * being used for migration, the migratetype of the block also changes.
+ * As this is called with interrupts disabled, the caller is responsible
+ * for calling arch_alloc_page() and kernel_map_page() after interrupts
+ * are enabled.
+ *
+ * Note: this is probably too low level an operation for use in drivers.
+ * Please consult with lkml before using this in your driver.
+ */
+int split_free_page(struct page *page)
+{
+        unsigned int order;
+        unsigned long watermark;
+        struct zone *zone;
+
+        BUG_ON(!PageBuddy(page));
+
+        zone = page_zone(page);
+        order = page_order(page);
+
+        /* Obey watermarks as if the page was being allocated */
+        watermark = low_wmark_pages(zone) + (1 << order);
+        if (!zone_watermark_ok(zone, 0, watermark, 0, 0))
+                return 0;
+
+        /* Remove page from free list */
+        list_del(&page->lru);
+        zone->free_area[order].nr_free--;
+        rmv_page_order(page);
+        __mod_zone_page_state(zone, NR_FREE_PAGES, -(1UL << order));
+
+        /* Split into individual pages */
+        set_page_refcounted(page);
+        split_page(page, order);
+
+        if (order >= pageblock_order - 1) {
+                struct page *endpage = page + (1 << order) - 1;
+                for (; page < endpage; page += pageblock_nr_pages)
+                        set_pageblock_migratetype(page, MIGRATE_MOVABLE);
+        }
+
+        return 1 << order;
+}
+
+/*
  * Really, prep_compound_page() should be called from __rmqueue_bulk().  But
  * we cheat by calling it from here, in the order > 0 path.  Saves a branch
  * or two.
@@ -1693,6 +1777,62 @@ out:
         return page;
 }
 
+#ifdef CONFIG_COMPACTION
+/* Try memory compaction for high-order allocations before reclaim */
+static struct page *
+__alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
+        struct zonelist *zonelist, enum zone_type high_zoneidx,
+        nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
+        int migratetype, unsigned long *did_some_progress)
+{
+        struct page *page;
+
+        if (!order || compaction_deferred(preferred_zone))
+                return NULL;
+
+        *did_some_progress = try_to_compact_pages(zonelist, order, gfp_mask,
+                                                                nodemask);
+        if (*did_some_progress != COMPACT_SKIPPED) {
+
+                /* Page migration frees to the PCP lists but we want merging */
+                drain_pages(get_cpu());
+                put_cpu();
+
+                page = get_page_from_freelist(gfp_mask, nodemask,
+                                order, zonelist, high_zoneidx,
+                                alloc_flags, preferred_zone,
+                                migratetype);
+                if (page) {
+                        preferred_zone->compact_considered = 0;
+                        preferred_zone->compact_defer_shift = 0;
+                        count_vm_event(COMPACTSUCCESS);
+                        return page;
+                }
+
+                /*
+                 * It's bad if compaction run occurs and fails.
+                 * The most likely reason is that pages exist,
+                 * but not enough to satisfy watermarks.
+                 */
+                count_vm_event(COMPACTFAIL);
+                defer_compaction(preferred_zone);
+
+                cond_resched();
+        }
+
+        return NULL;
+}
+#else
+static inline struct page *
+__alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
+        struct zonelist *zonelist, enum zone_type high_zoneidx,
+        nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
+        int migratetype, unsigned long *did_some_progress)
+{
+        return NULL;
+}
+#endif /* CONFIG_COMPACTION */
+
 /* The really slow allocator path where we enter direct reclaim */
 static inline struct page *
 __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order,
@@ -1879,6 +2019,15 @@ rebalance:
         if (test_thread_flag(TIF_MEMDIE) && !(gfp_mask & __GFP_NOFAIL))
                 goto nopage;
 
+        /* Try direct compaction */
+        page = __alloc_pages_direct_compact(gfp_mask, order,
+                                        zonelist, high_zoneidx,
+                                        nodemask,
+                                        alloc_flags, preferred_zone,
+                                        migratetype, &did_some_progress);
+        if (page)
+                goto got_pg;
+
         /* Try direct reclaim and then allocating */
         page = __alloc_pages_direct_reclaim(gfp_mask, order,
                                         zonelist, high_zoneidx,
@@ -1970,10 +2119,13 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
         if (unlikely(!zonelist->_zonerefs->zone))
                 return NULL;
 
+        get_mems_allowed();
         /* The preferred zone is used for statistics later */
         first_zones_zonelist(zonelist, high_zoneidx, nodemask, &preferred_zone);
-        if (!preferred_zone)
+        if (!preferred_zone) {
+                put_mems_allowed();
                 return NULL;
+        }
 
         /* First allocation attempt */
         page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order,
@@ -1983,6 +2135,7 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
                 page = __alloc_pages_slowpath(gfp_mask, order,
                                 zonelist, high_zoneidx, nodemask,
                                 preferred_zone, migratetype);
+        put_mems_allowed();
 
         trace_mm_page_alloc(page, order, gfp_mask, migratetype);
         return page;
@@ -2434,8 +2587,11 @@ int numa_zonelist_order_handler(ctl_table *table, int write,
                         strncpy((char*)table->data, saved_string,
                                 NUMA_ZONELIST_ORDER_LEN);
                         user_zonelist_order = oldval;
-                } else if (oldval != user_zonelist_order)
-                        build_all_zonelists();
+                } else if (oldval != user_zonelist_order) {
+                        mutex_lock(&zonelists_mutex);
+                        build_all_zonelists(NULL);
+                        mutex_unlock(&zonelists_mutex);
+                }
         }
 out:
         mutex_unlock(&zl_order_mutex);
@@ -2579,10 +2735,10 @@ static int default_zonelist_order(void)
         struct zone *z;
         int average_size;
         /*
-         * ZONE_DMA and ZONE_DMA32 can be very small area in the sytem.
+         * ZONE_DMA and ZONE_DMA32 can be very small area in the system.
          * If they are really small and used heavily, the system can fall
          * into OOM very easily.
-         * This function detect ZONE_DMA/DMA32 size and confgigures zone order.
+         * This function detect ZONE_DMA/DMA32 size and configures zone order.
          */
         /* Is there ZONE_NORMAL ? (ex. ppc has only DMA zone..) */
         low_kmem_size = 0;
@@ -2594,6 +2750,15 @@ static int default_zonelist_order(void)
                                 if (zone_type < ZONE_NORMAL)
                                         low_kmem_size += z->present_pages;
                                 total_size += z->present_pages;
+                        } else if (zone_type == ZONE_NORMAL) {
+                                /*
+                                 * If any node has only lowmem, then node order
+                                 * is preferred to allow kernel allocations
+                                 * locally; otherwise, they can easily infringe
+                                 * on other nodes when there is an abundance of
+                                 * lowmem available to allocate from.
+                                 */
+                                return ZONELIST_ORDER_NODE;
                         }
                 }
         }
@@ -2707,6 +2872,24 @@ static void build_zonelist_cache(pg_data_t *pgdat)
                 zlc->z_to_n[z - zonelist->_zonerefs] = zonelist_node_idx(z);
 }
 
+#ifdef CONFIG_HAVE_MEMORYLESS_NODES
+/*
+ * Return node id of node used for "local" allocations.
+ * I.e., first node id of first zone in arg node's generic zonelist.
+ * Used for initializing percpu 'numa_mem', which is used primarily
+ * for kernel allocations, so use GFP_KERNEL flags to locate zonelist.
+ */
+int local_memory_node(int node)
+{
+        struct zone *zone;
+
+        (void)first_zones_zonelist(node_zonelist(node, GFP_KERNEL),
+                                   gfp_zone(GFP_KERNEL),
+                                   NULL,
+                                   &zone);
+        return zone->node;
+}
+#endif
 
 #else   /* CONFIG_NUMA */
 
@@ -2776,9 +2959,16 @@ static void build_zonelist_cache(pg_data_t *pgdat)
  */
 static void setup_pageset(struct per_cpu_pageset *p, unsigned long batch);
 static DEFINE_PER_CPU(struct per_cpu_pageset, boot_pageset);
+static void setup_zone_pageset(struct zone *zone);
+
+/*
+ * Global mutex to protect against size modification of zonelists
+ * as well as to serialize pageset setup for the new populated zone.
+ */
+DEFINE_MUTEX(zonelists_mutex);
 
 /* return values int ....just for stop_machine() */
-static int __build_all_zonelists(void *dummy)
+static __init_refok int __build_all_zonelists(void *data)
 {
         int nid;
         int cpu;
@@ -2793,6 +2983,14 @@ static int __build_all_zonelists(void *dummy)
                 build_zonelist_cache(pgdat);
         }
 
+#ifdef CONFIG_MEMORY_HOTPLUG
+        /* Setup real pagesets for the new zone */
+        if (data) {
+                struct zone *zone = data;
+                setup_zone_pageset(zone);
+        }
+#endif
+
         /*
          * Initialize the boot_pagesets that are going to be used
          * for bootstrapping processors. The real pagesets for
@@ -2806,13 +3004,31 @@ static int __build_all_zonelists(void *dummy)
          * needs the percpu allocator in order to allocate its pagesets
          * (a chicken-egg dilemma).
          */
-        for_each_possible_cpu(cpu)
+        for_each_possible_cpu(cpu) {
                 setup_pageset(&per_cpu(boot_pageset, cpu), 0);
 
+#ifdef CONFIG_HAVE_MEMORYLESS_NODES
+                /*
+                 * We now know the "local memory node" for each node--
+                 * i.e., the node of the first zone in the generic zonelist.
+                 * Set up numa_mem percpu variable for on-line cpus.  During
+                 * boot, only the boot cpu should be on-line;  we'll init the
+                 * secondary cpus' numa_mem as they come on-line.  During
+                 * node/memory hotplug, we'll fixup all on-line cpus.
+                 */
+                if (cpu_online(cpu))
+                        set_cpu_numa_mem(cpu, local_memory_node(cpu_to_node(cpu)));
+#endif
+        }
+
         return 0;
 }
 
-void build_all_zonelists(void)
+/*
+ * Called with zonelists_mutex held always
+ * unless system_state == SYSTEM_BOOTING.
+ */
+void build_all_zonelists(void *data)
 {
         set_zonelist_order();
 
@@ -2823,7 +3039,7 @@ void build_all_zonelists(void)
         } else {
                 /* we have to stop all cpus to guarantee there is no user
                    of zonelist */
-                stop_machine(__build_all_zonelists, NULL, NULL);
+                stop_machine(__build_all_zonelists, data, NULL);
                 /* cpuset refresh routine should be here */
         }
         vm_total_pages = nr_free_pagecache_pages();
@@ -3146,31 +3362,34 @@ static void setup_pagelist_highmark(struct per_cpu_pageset *p,
                 pcp->batch = PAGE_SHIFT * 8;
 }
 
+static __meminit void setup_zone_pageset(struct zone *zone)
+{
+        int cpu;
+
+        zone->pageset = alloc_percpu(struct per_cpu_pageset);
+
+        for_each_possible_cpu(cpu) {
+                struct per_cpu_pageset *pcp = per_cpu_ptr(zone->pageset, cpu);
+
+                setup_pageset(pcp, zone_batchsize(zone));
+
+                if (percpu_pagelist_fraction)
+                        setup_pagelist_highmark(pcp,
+                                (zone->present_pages /
+                                        percpu_pagelist_fraction));
+        }
+}
+
 /*
  * Allocate per cpu pagesets and initialize them.
  * Before this call only boot pagesets were available.
- * Boot pagesets will no longer be used by this processorr
- * after setup_per_cpu_pageset().
  */
 void __init setup_per_cpu_pageset(void)
 {
         struct zone *zone;
-        int cpu;
-
-        for_each_populated_zone(zone) {
-                zone->pageset = alloc_percpu(struct per_cpu_pageset);
-
-                for_each_possible_cpu(cpu) {
-                        struct per_cpu_pageset *pcp = per_cpu_ptr(zone->pageset, cpu);
-
-                        setup_pageset(pcp, zone_batchsize(zone));
 
-                        if (percpu_pagelist_fraction)
-                                setup_pagelist_highmark(pcp,
-                                        (zone->present_pages /
-                                                percpu_pagelist_fraction));
-                }
-        }
+        for_each_populated_zone(zone)
+                setup_zone_pageset(zone);
 }
 
 static noinline __init_refok
diff --git a/mm/percpu-km.c b/mm/percpu-km.c
new file mode 100644
index 000000000000..df680855540a
--- /dev/null
+++ b/mm/percpu-km.c
@@ -0,0 +1,104 @@
+/*
+ * mm/percpu-km.c - kernel memory based chunk allocation
+ *
+ * Copyright (C) 2010           SUSE Linux Products GmbH
+ * Copyright (C) 2010           Tejun Heo <tj@kernel.org>
+ *
+ * This file is released under the GPLv2.
+ *
+ * Chunks are allocated as a contiguous kernel memory using gfp
+ * allocation.  This is to be used on nommu architectures.
+ *
+ * To use percpu-km,
+ *
+ * - define CONFIG_NEED_PER_CPU_KM from the arch Kconfig.
+ *
+ * - CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK must not be defined.  It's
+ *   not compatible with PER_CPU_KM.  EMBED_FIRST_CHUNK should work
+ *   fine.
+ *
+ * - NUMA is not supported.  When setting up the first chunk,
+ *   @cpu_distance_fn should be NULL or report all CPUs to be nearer
+ *   than or at LOCAL_DISTANCE.
+ *
+ * - It's best if the chunk size is power of two multiple of
+ *   PAGE_SIZE.  Because each chunk is allocated as a contiguous
+ *   kernel memory block using alloc_pages(), memory will be wasted if
+ *   chunk size is not aligned.  percpu-km code will whine about it.
+ */
+
+#ifdef CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK
+#error "contiguous percpu allocation is incompatible with paged first chunk"
+#endif
+
+#include <linux/log2.h>
+
+static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size)
+{
+        /* noop */
+        return 0;
+}
+
+static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size)
+{
+        /* nada */
+}
+
+static struct pcpu_chunk *pcpu_create_chunk(void)
+{
+        const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
+        struct pcpu_chunk *chunk;
+        struct page *pages;
+        int i;
+
+        chunk = pcpu_alloc_chunk();
+        if (!chunk)
+                return NULL;
+
+        pages = alloc_pages(GFP_KERNEL, order_base_2(nr_pages));
+        if (!pages) {
+                pcpu_free_chunk(chunk);
+                return NULL;
+        }
+
+        for (i = 0; i < nr_pages; i++)
+                pcpu_set_page_chunk(nth_page(pages, i), chunk);
+
+        chunk->data = pages;
+        chunk->base_addr = page_address(pages) - pcpu_group_offsets[0];
+        return chunk;
+}
+
+static void pcpu_destroy_chunk(struct pcpu_chunk *chunk)
+{
+        const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
+
+        if (chunk && chunk->data)
+                __free_pages(chunk->data, order_base_2(nr_pages));
+        pcpu_free_chunk(chunk);
+}
+
+static struct page *pcpu_addr_to_page(void *addr)
+{
+        return virt_to_page(addr);
+}
+
+static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
+{
+        size_t nr_pages, alloc_pages;
+
+        /* all units must be in a single group */
+        if (ai->nr_groups != 1) {
+                printk(KERN_CRIT "percpu: can't handle more than one groups\n");
+                return -EINVAL;
+        }
+
+        nr_pages = (ai->groups[0].nr_units * ai->unit_size) >> PAGE_SHIFT;
+        alloc_pages = roundup_pow_of_two(nr_pages);
+
+        if (alloc_pages > nr_pages)
+                printk(KERN_WARNING "percpu: wasting %zu pages per chunk\n",
+                       alloc_pages - nr_pages);
+
+        return 0;
+}
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
new file mode 100644
index 000000000000..7d9c1d0ebd3f
--- /dev/null
+++ b/mm/percpu-vm.c
@@ -0,0 +1,451 @@
+/*
+ * mm/percpu-vm.c - vmalloc area based chunk allocation
+ *
+ * Copyright (C) 2010           SUSE Linux Products GmbH
+ * Copyright (C) 2010           Tejun Heo <tj@kernel.org>
+ *
+ * This file is released under the GPLv2.
+ *
+ * Chunks are mapped into vmalloc areas and populated page by page.
+ * This is the default chunk allocator.
+ */
+
+static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
+                                    unsigned int cpu, int page_idx)
+{
+        /* must not be used on pre-mapped chunk */
+        WARN_ON(chunk->immutable);
+
+        return vmalloc_to_page((void *)pcpu_chunk_addr(chunk, cpu, page_idx));
+}
+
+/**
+ * pcpu_get_pages_and_bitmap - get temp pages array and bitmap
+ * @chunk: chunk of interest
+ * @bitmapp: output parameter for bitmap
+ * @may_alloc: may allocate the array
+ *
+ * Returns pointer to array of pointers to struct page and bitmap,
+ * both of which can be indexed with pcpu_page_idx().  The returned
+ * array is cleared to zero and *@bitmapp is copied from
+ * @chunk->populated.  Note that there is only one array and bitmap
+ * and access exclusion is the caller's responsibility.
+ *
+ * CONTEXT:
+ * pcpu_alloc_mutex and does GFP_KERNEL allocation if @may_alloc.
+ * Otherwise, don't care.
+ *
+ * RETURNS:
+ * Pointer to temp pages array on success, NULL on failure.
+ */
+static struct page **pcpu_get_pages_and_bitmap(struct pcpu_chunk *chunk,
+                                               unsigned long **bitmapp,
+                                               bool may_alloc)
+{
+        static struct page **pages;
+        static unsigned long *bitmap;
+        size_t pages_size = pcpu_nr_units * pcpu_unit_pages * sizeof(pages[0]);
+        size_t bitmap_size = BITS_TO_LONGS(pcpu_unit_pages) *
+                             sizeof(unsigned long);
+
+        if (!pages || !bitmap) {
+                if (may_alloc && !pages)
+                        pages = pcpu_mem_alloc(pages_size);
+                if (may_alloc && !bitmap)
+                        bitmap = pcpu_mem_alloc(bitmap_size);
+                if (!pages || !bitmap)
+                        return NULL;
+        }
+
+        memset(pages, 0, pages_size);
+        bitmap_copy(bitmap, chunk->populated, pcpu_unit_pages);
+
+        *bitmapp = bitmap;
+        return pages;
+}
+
+/**
+ * pcpu_free_pages - free pages which were allocated for @chunk
+ * @chunk: chunk pages were allocated for
+ * @pages: array of pages to be freed, indexed by pcpu_page_idx()
+ * @populated: populated bitmap
+ * @page_start: page index of the first page to be freed
+ * @page_end: page index of the last page to be freed + 1
+ *
+ * Free pages [@page_start and @page_end) in @pages for all units.
+ * The pages were allocated for @chunk.
+ */
+static void pcpu_free_pages(struct pcpu_chunk *chunk,
+                            struct page **pages, unsigned long *populated,
+                            int page_start, int page_end)
+{
+        unsigned int cpu;
+        int i;
+
+        for_each_possible_cpu(cpu) {
+                for (i = page_start; i < page_end; i++) {
+                        struct page *page = pages[pcpu_page_idx(cpu, i)];
+
+                        if (page)
+                                __free_page(page);
+                }
+        }
+}
+
+/**
+ * pcpu_alloc_pages - allocates pages for @chunk
+ * @chunk: target chunk
+ * @pages: array to put the allocated pages into, indexed by pcpu_page_idx()
+ * @populated: populated bitmap
+ * @page_start: page index of the first page to be allocated
+ * @page_end: page index of the last page to be allocated + 1
+ *
+ * Allocate pages [@page_start,@page_end) into @pages for all units.
+ * The allocation is for @chunk.  Percpu core doesn't care about the
+ * content of @pages and will pass it verbatim to pcpu_map_pages().
+ */
+static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+                            struct page **pages, unsigned long *populated,
+                            int page_start, int page_end)
+{
+        const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
+        unsigned int cpu;
+        int i;
+
+        for_each_possible_cpu(cpu) {
+                for (i = page_start; i < page_end; i++) {
+                        struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
+
+                        *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
+                        if (!*pagep) {
+                                pcpu_free_pages(chunk, pages, populated,
+                                                page_start, page_end);
+                                return -ENOMEM;
+                        }
+                }
+        }
+        return 0;
+}
+
+/**
+ * pcpu_pre_unmap_flush - flush cache prior to unmapping
+ * @chunk: chunk the regions to be flushed belongs to
+ * @page_start: page index of the first page to be flushed
+ * @page_end: page index of the last page to be flushed + 1
+ *
+ * Pages in [@page_start,@page_end) of @chunk are about to be
+ * unmapped.  Flush cache.  As each flushing trial can be very
+ * expensive, issue flush on the whole region at once rather than
+ * doing it for each cpu.  This could be an overkill but is more
+ * scalable.
+ */
+static void pcpu_pre_unmap_flush(struct pcpu_chunk *chunk,
+                                 int page_start, int page_end)
+{
+        flush_cache_vunmap(
+                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
+                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+}
+
+static void __pcpu_unmap_pages(unsigned long addr, int nr_pages)
+{
+        unmap_kernel_range_noflush(addr, nr_pages << PAGE_SHIFT);
+}
+
+/**
+ * pcpu_unmap_pages - unmap pages out of a pcpu_chunk
+ * @chunk: chunk of interest
+ * @pages: pages array which can be used to pass information to free
+ * @populated: populated bitmap
+ * @page_start: page index of the first page to unmap
+ * @page_end: page index of the last page to unmap + 1
+ *
+ * For each cpu, unmap pages [@page_start,@page_end) out of @chunk.
+ * Corresponding elements in @pages were cleared by the caller and can
+ * be used to carry information to pcpu_free_pages() which will be
+ * called after all unmaps are finished.  The caller should call
+ * proper pre/post flush functions.
+ */
+static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
+                             struct page **pages, unsigned long *populated,
+                             int page_start, int page_end)
+{
+        unsigned int cpu;
+        int i;
+
+        for_each_possible_cpu(cpu) {
+                for (i = page_start; i < page_end; i++) {
+                        struct page *page;
+
+                        page = pcpu_chunk_page(chunk, cpu, i);
+                        WARN_ON(!page);
+                        pages[pcpu_page_idx(cpu, i)] = page;
+                }
+                __pcpu_unmap_pages(pcpu_chunk_addr(chunk, cpu, page_start),
+                                   page_end - page_start);
+        }
+
+        for (i = page_start; i < page_end; i++)
+                __clear_bit(i, populated);
+}
+
+/**
+ * pcpu_post_unmap_tlb_flush - flush TLB after unmapping
+ * @chunk: pcpu_chunk the regions to be flushed belong to
+ * @page_start: page index of the first page to be flushed
+ * @page_end: page index of the last page to be flushed + 1
+ *
+ * Pages [@page_start,@page_end) of @chunk have been unmapped.  Flush
+ * TLB for the regions.  This can be skipped if the area is to be
+ * returned to vmalloc as vmalloc will handle TLB flushing lazily.
+ *
+ * As with pcpu_pre_unmap_flush(), TLB flushing also is done at once
+ * for the whole region.
+ */
+static void pcpu_post_unmap_tlb_flush(struct pcpu_chunk *chunk,
+                                      int page_start, int page_end)
+{
+        flush_tlb_kernel_range(
+                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
+                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+}
+
+static int __pcpu_map_pages(unsigned long addr, struct page **pages,
+                            int nr_pages)
+{
+        return map_kernel_range_noflush(addr, nr_pages << PAGE_SHIFT,
+                                        PAGE_KERNEL, pages);
+}
+
+/**
+ * pcpu_map_pages - map pages into a pcpu_chunk
+ * @chunk: chunk of interest
+ * @pages: pages array containing pages to be mapped
+ * @populated: populated bitmap
+ * @page_start: page index of the first page to map
+ * @page_end: page index of the last page to map + 1
+ *
+ * For each cpu, map pages [@page_start,@page_end) into @chunk.  The
+ * caller is responsible for calling pcpu_post_map_flush() after all
+ * mappings are complete.
+ *
+ * This function is responsible for setting corresponding bits in
+ * @chunk->populated bitmap and whatever is necessary for reverse
+ * lookup (addr -> chunk).
+ */
+static int pcpu_map_pages(struct pcpu_chunk *chunk,
+                          struct page **pages, unsigned long *populated,
+                          int page_start, int page_end)
+{
+        unsigned int cpu, tcpu;
+        int i, err;
+
+        for_each_possible_cpu(cpu) {
+                err = __pcpu_map_pages(pcpu_chunk_addr(chunk, cpu, page_start),
+                                       &pages[pcpu_page_idx(cpu, page_start)],
+                                       page_end - page_start);
+                if (err < 0)
+                        goto err;
+        }
+
+        /* mapping successful, link chunk and mark populated */
+        for (i = page_start; i < page_end; i++) {
+                for_each_possible_cpu(cpu)
+                        pcpu_set_page_chunk(pages[pcpu_page_idx(cpu, i)],
+                                            chunk);
+                __set_bit(i, populated);
+        }
+
+        return 0;
+
+err:
+        for_each_possible_cpu(tcpu) {
+                if (tcpu == cpu)
+                        break;
+                __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
+                                   page_end - page_start);
+        }
+        return err;
+}
+
+/**
+ * pcpu_post_map_flush - flush cache after mapping
+ * @chunk: pcpu_chunk the regions to be flushed belong to
+ * @page_start: page index of the first page to be flushed
+ * @page_end: page index of the last page to be flushed + 1
+ *
+ * Pages [@page_start,@page_end) of @chunk have been mapped.  Flush
+ * cache.
+ *
+ * As with pcpu_pre_unmap_flush(), TLB flushing also is done at once
+ * for the whole region.
+ */
+static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
+                                int page_start, int page_end)
+{
+        flush_cache_vmap(
+                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
+                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+}
+
+/**
+ * pcpu_populate_chunk - populate and map an area of a pcpu_chunk
+ * @chunk: chunk of interest
+ * @off: offset to the area to populate
+ * @size: size of the area to populate in bytes
+ *
+ * For each cpu, populate and map pages [@page_start,@page_end) into
+ * @chunk.  The area is cleared on return.
+ *
+ * CONTEXT:
+ * pcpu_alloc_mutex, does GFP_KERNEL allocation.
+ */
+static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size)
+{
+        int page_start = PFN_DOWN(off);
+        int page_end = PFN_UP(off + size);
+        int free_end = page_start, unmap_end = page_start;
+        struct page **pages;
+        unsigned long *populated;
+        unsigned int cpu;
+        int rs, re, rc;
+
+        /* quick path, check whether all pages are already there */
+        rs = page_start;
+        pcpu_next_pop(chunk, &rs, &re, page_end);
+        if (rs == page_start && re == page_end)
+                goto clear;
+
+        /* need to allocate and map pages, this chunk can't be immutable */
+        WARN_ON(chunk->immutable);
+
+        pages = pcpu_get_pages_and_bitmap(chunk, &populated, true);
+        if (!pages)
+                return -ENOMEM;
+
+        /* alloc and map */
+        pcpu_for_each_unpop_region(chunk, rs, re, page_start, page_end) {
+                rc = pcpu_alloc_pages(chunk, pages, populated, rs, re);
+                if (rc)
+                        goto err_free;
+                free_end = re;
+        }
+
+        pcpu_for_each_unpop_region(chunk, rs, re, page_start, page_end) {
+                rc = pcpu_map_pages(chunk, pages, populated, rs, re);
+                if (rc)
+                        goto err_unmap;
+                unmap_end = re;
+        }
+        pcpu_post_map_flush(chunk, page_start, page_end);
+
+        /* commit new bitmap */
+        bitmap_copy(chunk->populated, populated, pcpu_unit_pages);
+clear:
+        for_each_possible_cpu(cpu)
+                memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
+        return 0;
+
+err_unmap:
+        pcpu_pre_unmap_flush(chunk, page_start, unmap_end);
+        pcpu_for_each_unpop_region(chunk, rs, re, page_start, unmap_end)
+                pcpu_unmap_pages(chunk, pages, populated, rs, re);
+        pcpu_post_unmap_tlb_flush(chunk, page_start, unmap_end);
+err_free:
+        pcpu_for_each_unpop_region(chunk, rs, re, page_start, free_end)
+                pcpu_free_pages(chunk, pages, populated, rs, re);
+        return rc;
+}
+
+/**
+ * pcpu_depopulate_chunk - depopulate and unmap an area of a pcpu_chunk
+ * @chunk: chunk to depopulate
+ * @off: offset to the area to depopulate
+ * @size: size of the area to depopulate in bytes
+ * @flush: whether to flush cache and tlb or not
+ *
+ * For each cpu, depopulate and unmap pages [@page_start,@page_end)
+ * from @chunk.  If @flush is true, vcache is flushed before unmapping
+ * and tlb after.
+ *
+ * CONTEXT:
+ * pcpu_alloc_mutex.
+ */
+static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size)
+{
+        int page_start = PFN_DOWN(off);
+        int page_end = PFN_UP(off + size);
+        struct page **pages;
+        unsigned long *populated;
+        int rs, re;
+
+        /* quick path, check whether it's empty already */
+        rs = page_start;
+        pcpu_next_unpop(chunk, &rs, &re, page_end);
+        if (rs == page_start && re == page_end)
+                return;
+
+        /* immutable chunks can't be depopulated */
+        WARN_ON(chunk->immutable);
+
+        /*
+         * If control reaches here, there must have been at least one
+         * successful population attempt so the temp pages array must
+         * be available now.
+         */
+        pages = pcpu_get_pages_and_bitmap(chunk, &populated, false);
+        BUG_ON(!pages);
+
+        /* unmap and free */
+        pcpu_pre_unmap_flush(chunk, page_start, page_end);
+
+        pcpu_for_each_pop_region(chunk, rs, re, page_start, page_end)
+                pcpu_unmap_pages(chunk, pages, populated, rs, re);
+
+        /* no need to flush tlb, vmalloc will handle it lazily */
+
+        pcpu_for_each_pop_region(chunk, rs, re, page_start, page_end)
+                pcpu_free_pages(chunk, pages, populated, rs, re);
+
+        /* commit new bitmap */
+        bitmap_copy(chunk->populated, populated, pcpu_unit_pages);
+}
+
+static struct pcpu_chunk *pcpu_create_chunk(void)
+{
+        struct pcpu_chunk *chunk;
+        struct vm_struct **vms;
+
+        chunk = pcpu_alloc_chunk();
+        if (!chunk)
+                return NULL;
+
+        vms = pcpu_get_vm_areas(pcpu_group_offsets, pcpu_group_sizes,
+                                pcpu_nr_groups, pcpu_atom_size, GFP_KERNEL);
+        if (!vms) {
+                pcpu_free_chunk(chunk);
+                return NULL;
+        }
+
+        chunk->data = vms;
+        chunk->base_addr = vms[0]->addr - pcpu_group_offsets[0];
+        return chunk;
+}
+
+static void pcpu_destroy_chunk(struct pcpu_chunk *chunk)
+{
+        if (chunk && chunk->data)
+                pcpu_free_vm_areas(chunk->data, pcpu_nr_groups);
+        pcpu_free_chunk(chunk);
+}
+
+static struct page *pcpu_addr_to_page(void *addr)
+{
+        return vmalloc_to_page(addr);
+}
+
+static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
+{
+        /* no extra restriction */
+        return 0;
+}
diff --git a/mm/percpu.c b/mm/percpu.c
index 6e09741ddc62..39f7dfd59585 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1,5 +1,5 @@
 /*
- * linux/mm/percpu.c - percpu memory allocator
+ * mm/percpu.c - percpu memory allocator
  *
  * Copyright (C) 2009           SUSE Linux Products GmbH
  * Copyright (C) 2009           Tejun Heo <tj@kernel.org>
@@ -7,14 +7,13 @@
  * This file is released under the GPLv2.
  *
  * This is percpu allocator which can handle both static and dynamic
- * areas.  Percpu areas are allocated in chunks in vmalloc area.  Each
- * chunk is consisted of boot-time determined number of units and the
- * first chunk is used for static percpu variables in the kernel image
+ * areas.  Percpu areas are allocated in chunks.  Each chunk is
+ * consisted of boot-time determined number of units and the first
+ * chunk is used for static percpu variables in the kernel image
  * (special boot time alloc/init handling necessary as these areas
  * need to be brought up before allocation services are running).
  * Unit grows as necessary and all units grow or shrink in unison.
- * When a chunk is filled up, another chunk is allocated.  ie. in
- * vmalloc area
+ * When a chunk is filled up, another chunk is allocated.
  *
  *  c0                           c1                         c2
  *  -------------------          -------------------        ------------
@@ -99,7 +98,7 @@ struct pcpu_chunk {
         int                     map_used;       /* # of map entries used */
         int                     map_alloc;      /* # of map entries allocated */
         int                     *map;           /* allocation map */
-        struct vm_struct        **vms;          /* mapped vmalloc regions */
+        void                    *data;          /* chunk data */
         bool                    immutable;      /* no [de]population allowed */
         unsigned long           populated[];    /* populated bitmap */
 };
@@ -177,6 +176,21 @@ static struct list_head *pcpu_slot __read_mostly; /* chunk list slots */
 static void pcpu_reclaim(struct work_struct *work);
 static DECLARE_WORK(pcpu_reclaim_work, pcpu_reclaim);
 
+static bool pcpu_addr_in_first_chunk(void *addr)
+{
+        void *first_start = pcpu_first_chunk->base_addr;
+
+        return addr >= first_start && addr < first_start + pcpu_unit_size;
+}
+
+static bool pcpu_addr_in_reserved_chunk(void *addr)
+{
+        void *first_start = pcpu_first_chunk->base_addr;
+
+        return addr >= first_start &&
+                addr < first_start + pcpu_reserved_chunk_limit;
+}
+
 static int __pcpu_size_to_slot(int size)
 {
         int highbit = fls(size);        /* size is in bytes */
@@ -198,27 +212,6 @@ static int pcpu_chunk_slot(const struct pcpu_chunk *chunk)
         return pcpu_size_to_slot(chunk->free_size);
 }
 
-static int pcpu_page_idx(unsigned int cpu, int page_idx)
-{
-        return pcpu_unit_map[cpu] * pcpu_unit_pages + page_idx;
-}
-
-static unsigned long pcpu_chunk_addr(struct pcpu_chunk *chunk,
-                                     unsigned int cpu, int page_idx)
-{
-        return (unsigned long)chunk->base_addr + pcpu_unit_offsets[cpu] +
-                (page_idx << PAGE_SHIFT);
-}
-
-static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
-                                    unsigned int cpu, int page_idx)
-{
-        /* must not be used on pre-mapped chunk */
-        WARN_ON(chunk->immutable);
-
-        return vmalloc_to_page((void *)pcpu_chunk_addr(chunk, cpu, page_idx));
-}
-
 /* set the pointer to a chunk in a page struct */
 static void pcpu_set_page_chunk(struct page *page, struct pcpu_chunk *pcpu)
 {
@@ -231,13 +224,27 @@ static struct pcpu_chunk *pcpu_get_page_chunk(struct page *page)
         return (struct pcpu_chunk *)page->index;
 }
 
-static void pcpu_next_unpop(struct pcpu_chunk *chunk, int *rs, int *re, int end)
+static int __maybe_unused pcpu_page_idx(unsigned int cpu, int page_idx)
+{
+        return pcpu_unit_map[cpu] * pcpu_unit_pages + page_idx;
+}
+
+static unsigned long __maybe_unused pcpu_chunk_addr(struct pcpu_chunk *chunk,
+                                                unsigned int cpu, int page_idx)
+{
+        return (unsigned long)chunk->base_addr + pcpu_unit_offsets[cpu] +
+                (page_idx << PAGE_SHIFT);
+}
+
+static void __maybe_unused pcpu_next_unpop(struct pcpu_chunk *chunk,
+                                           int *rs, int *re, int end)
 {
         *rs = find_next_zero_bit(chunk->populated, end, *rs);
         *re = find_next_bit(chunk->populated, end, *rs + 1);
 }
 
-static void pcpu_next_pop(struct pcpu_chunk *chunk, int *rs, int *re, int end)
+static void __maybe_unused pcpu_next_pop(struct pcpu_chunk *chunk,
+                                         int *rs, int *re, int end)
 {
         *rs = find_next_bit(chunk->populated, end, *rs);
         *re = find_next_zero_bit(chunk->populated, end, *rs + 1);
@@ -326,36 +333,6 @@ static void pcpu_chunk_relocate(struct pcpu_chunk *chunk, int oslot)
 }
 
 /**
- * pcpu_chunk_addr_search - determine chunk containing specified address
- * @addr: address for which the chunk needs to be determined.
- *
- * RETURNS:
- * The address of the found chunk.
- */
-static struct pcpu_chunk *pcpu_chunk_addr_search(void *addr)
-{
-        void *first_start = pcpu_first_chunk->base_addr;
-
-        /* is it in the first chunk? */
-        if (addr >= first_start && addr < first_start + pcpu_unit_size) {
-                /* is it in the reserved area? */
-                if (addr < first_start + pcpu_reserved_chunk_limit)
-                        return pcpu_reserved_chunk;
-                return pcpu_first_chunk;
-        }
-
-        /*
-         * The address is relative to unit0 which might be unused and
-         * thus unmapped.  Offset the address to the unit space of the
-         * current processor before looking it up in the vmalloc
-         * space.  Note that any possible cpu id can be used here, so
-         * there's no need to worry about preemption or cpu hotplug.
-         */
-        addr += pcpu_unit_offsets[raw_smp_processor_id()];
-        return pcpu_get_page_chunk(vmalloc_to_page(addr));
-}
-
-/**
  * pcpu_need_to_extend - determine whether chunk area map needs to be extended
  * @chunk: chunk of interest
  *
@@ -623,434 +600,92 @@ static void pcpu_free_area(struct pcpu_chunk *chunk, int freeme)
         pcpu_chunk_relocate(chunk, oslot);
 }
 
-/**
- * pcpu_get_pages_and_bitmap - get temp pages array and bitmap
- * @chunk: chunk of interest
- * @bitmapp: output parameter for bitmap
- * @may_alloc: may allocate the array
- *
- * Returns pointer to array of pointers to struct page and bitmap,
- * both of which can be indexed with pcpu_page_idx().  The returned
- * array is cleared to zero and *@bitmapp is copied from
- * @chunk->populated.  Note that there is only one array and bitmap
- * and access exclusion is the caller's responsibility.
- *
- * CONTEXT:
- * pcpu_alloc_mutex and does GFP_KERNEL allocation if @may_alloc.
- * Otherwise, don't care.
- *
- * RETURNS:
- * Pointer to temp pages array on success, NULL on failure.
- */
-static struct page **pcpu_get_pages_and_bitmap(struct pcpu_chunk *chunk,
-                                               unsigned long **bitmapp,
-                                               bool may_alloc)
-{
-        static struct page **pages;
-        static unsigned long *bitmap;
-        size_t pages_size = pcpu_nr_units * pcpu_unit_pages * sizeof(pages[0]);
-        size_t bitmap_size = BITS_TO_LONGS(pcpu_unit_pages) *
-                             sizeof(unsigned long);
-
-        if (!pages || !bitmap) {
-                if (may_alloc && !pages)
-                        pages = pcpu_mem_alloc(pages_size);
-                if (may_alloc && !bitmap)
-                        bitmap = pcpu_mem_alloc(bitmap_size);
-                if (!pages || !bitmap)
-                        return NULL;
-        }
-
-        memset(pages, 0, pages_size);
-        bitmap_copy(bitmap, chunk->populated, pcpu_unit_pages);
-
-        *bitmapp = bitmap;
-        return pages;
-}
-
-/**
- * pcpu_free_pages - free pages which were allocated for @chunk
- * @chunk: chunk pages were allocated for
- * @pages: array of pages to be freed, indexed by pcpu_page_idx()
- * @populated: populated bitmap
- * @page_start: page index of the first page to be freed
- * @page_end: page index of the last page to be freed + 1
- *
- * Free pages [@page_start and @page_end) in @pages for all units.
- * The pages were allocated for @chunk.
- */
-static void pcpu_free_pages(struct pcpu_chunk *chunk,
-                            struct page **pages, unsigned long *populated,
-                            int page_start, int page_end)
+static struct pcpu_chunk *pcpu_alloc_chunk(void)
 {
-        unsigned int cpu;
-        int i;
+        struct pcpu_chunk *chunk;
 
-        for_each_possible_cpu(cpu) {
-                for (i = page_start; i < page_end; i++) {
-                        struct page *page = pages[pcpu_page_idx(cpu, i)];
+        chunk = kzalloc(pcpu_chunk_struct_size, GFP_KERNEL);
+        if (!chunk)
+                return NULL;
 
-                        if (page)
-                                __free_page(page);
-                }
+        chunk->map = pcpu_mem_alloc(PCPU_DFL_MAP_ALLOC * sizeof(chunk->map[0]));
+        if (!chunk->map) {
+                kfree(chunk);
+                return NULL;
         }
-}
 
-/**
- * pcpu_alloc_pages - allocates pages for @chunk
- * @chunk: target chunk
- * @pages: array to put the allocated pages into, indexed by pcpu_page_idx()
- * @populated: populated bitmap
- * @page_start: page index of the first page to be allocated
- * @page_end: page index of the last page to be allocated + 1
- *
- * Allocate pages [@page_start,@page_end) into @pages for all units.
- * The allocation is for @chunk.  Percpu core doesn't care about the
- * content of @pages and will pass it verbatim to pcpu_map_pages().
- */
-static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
-                            struct page **pages, unsigned long *populated,
-                            int page_start, int page_end)
-{
-        const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
-        unsigned int cpu;
-        int i;
+        chunk->map_alloc = PCPU_DFL_MAP_ALLOC;
+        chunk->map[chunk->map_used++] = pcpu_unit_size;
 
-        for_each_possible_cpu(cpu) {
-                for (i = page_start; i < page_end; i++) {
-                        struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
-
-                        *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
-                        if (!*pagep) {
-                                pcpu_free_pages(chunk, pages, populated,
-                                                page_start, page_end);
-                                return -ENOMEM;
-                        }
-                }
-        }
-        return 0;
-}
+        INIT_LIST_HEAD(&chunk->list);
+        chunk->free_size = pcpu_unit_size;
+        chunk->contig_hint = pcpu_unit_size;
 
-/**
- * pcpu_pre_unmap_flush - flush cache prior to unmapping
- * @chunk: chunk the regions to be flushed belongs to
- * @page_start: page index of the first page to be flushed
- * @page_end: page index of the last page to be flushed + 1
- *
- * Pages in [@page_start,@page_end) of @chunk are about to be
- * unmapped.  Flush cache.  As each flushing trial can be very
- * expensive, issue flush on the whole region at once rather than
- * doing it for each cpu.  This could be an overkill but is more
- * scalable.
- */
-static void pcpu_pre_unmap_flush(struct pcpu_chunk *chunk,
-                                 int page_start, int page_end)
-{
-        flush_cache_vunmap(
-                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
-                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+        return chunk;
 }
 
-static void __pcpu_unmap_pages(unsigned long addr, int nr_pages)
+static void pcpu_free_chunk(struct pcpu_chunk *chunk)
 {
-        unmap_kernel_range_noflush(addr, nr_pages << PAGE_SHIFT);
+        if (!chunk)
+                return;
+        pcpu_mem_free(chunk->map, chunk->map_alloc * sizeof(chunk->map[0]));
+        kfree(chunk);
 }
 
-/**
- * pcpu_unmap_pages - unmap pages out of a pcpu_chunk
- * @chunk: chunk of interest
- * @pages: pages array which can be used to pass information to free
- * @populated: populated bitmap
- * @page_start: page index of the first page to unmap
- * @page_end: page index of the last page to unmap + 1
- *
- * For each cpu, unmap pages [@page_start,@page_end) out of @chunk.
- * Corresponding elements in @pages were cleared by the caller and can
- * be used to carry information to pcpu_free_pages() which will be
- * called after all unmaps are finished.  The caller should call
- * proper pre/post flush functions.
+/*
+ * Chunk management implementation.
+ *
+ * To allow different implementations, chunk alloc/free and
+ * [de]population are implemented in a separate file which is pulled
+ * into this file and compiled together.  The following functions
+ * should be implemented.
+ *
+ * pcpu_populate_chunk          - populate the specified range of a chunk
+ * pcpu_depopulate_chunk        - depopulate the specified range of a chunk
+ * pcpu_create_chunk            - create a new chunk
+ * pcpu_destroy_chunk           - destroy a chunk, always preceded by full depop
+ * pcpu_addr_to_page            - translate address to physical address
+ * pcpu_verify_alloc_info       - check alloc_info is acceptable during init
  */
-static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
-                             struct page **pages, unsigned long *populated,
-                             int page_start, int page_end)
-{
-        unsigned int cpu;
-        int i;
-
-        for_each_possible_cpu(cpu) {
-                for (i = page_start; i < page_end; i++) {
-                        struct page *page;
-
-                        page = pcpu_chunk_page(chunk, cpu, i);
-                        WARN_ON(!page);
-                        pages[pcpu_page_idx(cpu, i)] = page;
-                }
-                __pcpu_unmap_pages(pcpu_chunk_addr(chunk, cpu, page_start),
-                                   page_end - page_start);
-        }
-
-        for (i = page_start; i < page_end; i++)
-                __clear_bit(i, populated);
-}
+static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size);
+static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size);
+static struct pcpu_chunk *pcpu_create_chunk(void);
+static void pcpu_destroy_chunk(struct pcpu_chunk *chunk);
+static struct page *pcpu_addr_to_page(void *addr);
+static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
+
+#ifdef CONFIG_NEED_PER_CPU_KM
+#include "percpu-km.c"
+#else
+#include "percpu-vm.c"
+#endif
 
 /**
- * pcpu_post_unmap_tlb_flush - flush TLB after unmapping
- * @chunk: pcpu_chunk the regions to be flushed belong to
- * @page_start: page index of the first page to be flushed
- * @page_end: page index of the last page to be flushed + 1
- *
- * Pages [@page_start,@page_end) of @chunk have been unmapped.  Flush
- * TLB for the regions.  This can be skipped if the area is to be
- * returned to vmalloc as vmalloc will handle TLB flushing lazily.
+ * pcpu_chunk_addr_search - determine chunk containing specified address
+ * @addr: address for which the chunk needs to be determined.
  *
- * As with pcpu_pre_unmap_flush(), TLB flushing also is done at once
- * for the whole region.
- */
-static void pcpu_post_unmap_tlb_flush(struct pcpu_chunk *chunk,
-                                      int page_start, int page_end)
-{
-        flush_tlb_kernel_range(
-                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
-                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
-}
-
-static int __pcpu_map_pages(unsigned long addr, struct page **pages,
-                            int nr_pages)
-{
-        return map_kernel_range_noflush(addr, nr_pages << PAGE_SHIFT,
-                                        PAGE_KERNEL, pages);
-}
-
-/**
- * pcpu_map_pages - map pages into a pcpu_chunk
- * @chunk: chunk of interest
- * @pages: pages array containing pages to be mapped
- * @populated: populated bitmap
- * @page_start: page index of the first page to map
- * @page_end: page index of the last page to map + 1
- *
- * For each cpu, map pages [@page_start,@page_end) into @chunk.  The
- * caller is responsible for calling pcpu_post_map_flush() after all
- * mappings are complete.
- *
- * This function is responsible for setting corresponding bits in
- * @chunk->populated bitmap and whatever is necessary for reverse
- * lookup (addr -> chunk).
+ * RETURNS:
+ * The address of the found chunk.
  */
-static int pcpu_map_pages(struct pcpu_chunk *chunk,
-                          struct page **pages, unsigned long *populated,
-                          int page_start, int page_end)
+static struct pcpu_chunk *pcpu_chunk_addr_search(void *addr)
 {
-        unsigned int cpu, tcpu;
-        int i, err;
-
-        for_each_possible_cpu(cpu) {
-                err = __pcpu_map_pages(pcpu_chunk_addr(chunk, cpu, page_start),
-                                       &pages[pcpu_page_idx(cpu, page_start)],
-                                       page_end - page_start);
-                if (err < 0)
-                        goto err;
-        }
-
-        /* mapping successful, link chunk and mark populated */
-        for (i = page_start; i < page_end; i++) {
-                for_each_possible_cpu(cpu)
-                        pcpu_set_page_chunk(pages[pcpu_page_idx(cpu, i)],
-                                            chunk);
-                __set_bit(i, populated);
-        }
-
-        return 0;
-
-err:
-        for_each_possible_cpu(tcpu) {
-                if (tcpu == cpu)
-                        break;
-                __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
-                                   page_end - page_start);
+        /* is it in the first chunk? */
+        if (pcpu_addr_in_first_chunk(addr)) {
+                /* is it in the reserved area? */
+                if (pcpu_addr_in_reserved_chunk(addr))
+                        return pcpu_reserved_chunk;
+                return pcpu_first_chunk;
         }
-        return err;
-}
-
-/**
- * pcpu_post_map_flush - flush cache after mapping
- * @chunk: pcpu_chunk the regions to be flushed belong to
- * @page_start: page index of the first page to be flushed
- * @page_end: page index of the last page to be flushed + 1
- *
- * Pages [@page_start,@page_end) of @chunk have been mapped.  Flush
- * cache.
- *
- * As with pcpu_pre_unmap_flush(), TLB flushing also is done at once
- * for the whole region.
- */
-static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
-                                int page_start, int page_end)
-{
-        flush_cache_vmap(
-                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
-                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
-}
-
-/**
- * pcpu_depopulate_chunk - depopulate and unmap an area of a pcpu_chunk
- * @chunk: chunk to depopulate
- * @off: offset to the area to depopulate
- * @size: size of the area to depopulate in bytes
- * @flush: whether to flush cache and tlb or not
- *
- * For each cpu, depopulate and unmap pages [@page_start,@page_end)
- * from @chunk.  If @flush is true, vcache is flushed before unmapping
- * and tlb after.
- *
- * CONTEXT:
- * pcpu_alloc_mutex.
- */
-static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size)
-{
-        int page_start = PFN_DOWN(off);
-        int page_end = PFN_UP(off + size);
-        struct page **pages;
-        unsigned long *populated;
-        int rs, re;
-
-        /* quick path, check whether it's empty already */
-        rs = page_start;
-        pcpu_next_unpop(chunk, &rs, &re, page_end);
-        if (rs == page_start && re == page_end)
-                return;
-
-        /* immutable chunks can't be depopulated */
-        WARN_ON(chunk->immutable);
 
         /*
-         * If control reaches here, there must have been at least one
-         * successful population attempt so the temp pages array must
-         * be available now.
+         * The address is relative to unit0 which might be unused and
+         * thus unmapped.  Offset the address to the unit space of the
+         * current processor before looking it up in the vmalloc
+         * space.  Note that any possible cpu id can be used here, so
+         * there's no need to worry about preemption or cpu hotplug.
          */
-        pages = pcpu_get_pages_and_bitmap(chunk, &populated, false);
-        BUG_ON(!pages);
-
-        /* unmap and free */
-        pcpu_pre_unmap_flush(chunk, page_start, page_end);
-
-        pcpu_for_each_pop_region(chunk, rs, re, page_start, page_end)
-                pcpu_unmap_pages(chunk, pages, populated, rs, re);
-
-        /* no need to flush tlb, vmalloc will handle it lazily */
-
-        pcpu_for_each_pop_region(chunk, rs, re, page_start, page_end)
-                pcpu_free_pages(chunk, pages, populated, rs, re);
-
-        /* commit new bitmap */
-        bitmap_copy(chunk->populated, populated, pcpu_unit_pages);
-}
-
-/**
- * pcpu_populate_chunk - populate and map an area of a pcpu_chunk
- * @chunk: chunk of interest
- * @off: offset to the area to populate
- * @size: size of the area to populate in bytes
- *
- * For each cpu, populate and map pages [@page_start,@page_end) into
- * @chunk.  The area is cleared on return.
- *
- * CONTEXT:
- * pcpu_alloc_mutex, does GFP_KERNEL allocation.
- */
-static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size)
-{
-        int page_start = PFN_DOWN(off);
-        int page_end = PFN_UP(off + size);
-        int free_end = page_start, unmap_end = page_start;
-        struct page **pages;
-        unsigned long *populated;
-        unsigned int cpu;
-        int rs, re, rc;
-
-        /* quick path, check whether all pages are already there */
-        rs = page_start;
-        pcpu_next_pop(chunk, &rs, &re, page_end);
-        if (rs == page_start && re == page_end)
-                goto clear;
-
-        /* need to allocate and map pages, this chunk can't be immutable */
-        WARN_ON(chunk->immutable);
-
-        pages = pcpu_get_pages_and_bitmap(chunk, &populated, true);
-        if (!pages)
-                return -ENOMEM;
-
-        /* alloc and map */
-        pcpu_for_each_unpop_region(chunk, rs, re, page_start, page_end) {
-                rc = pcpu_alloc_pages(chunk, pages, populated, rs, re);
-                if (rc)
-                        goto err_free;
-                free_end = re;
-        }
-
-        pcpu_for_each_unpop_region(chunk, rs, re, page_start, page_end) {
-                rc = pcpu_map_pages(chunk, pages, populated, rs, re);
-                if (rc)
-                        goto err_unmap;
-                unmap_end = re;
-        }
-        pcpu_post_map_flush(chunk, page_start, page_end);
-
-        /* commit new bitmap */
-        bitmap_copy(chunk->populated, populated, pcpu_unit_pages);
-clear:
-        for_each_possible_cpu(cpu)
-                memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
-        return 0;
-
-err_unmap:
-        pcpu_pre_unmap_flush(chunk, page_start, unmap_end);
-        pcpu_for_each_unpop_region(chunk, rs, re, page_start, unmap_end)
-                pcpu_unmap_pages(chunk, pages, populated, rs, re);
-        pcpu_post_unmap_tlb_flush(chunk, page_start, unmap_end);
-err_free:
-        pcpu_for_each_unpop_region(chunk, rs, re, page_start, free_end)
-                pcpu_free_pages(chunk, pages, populated, rs, re);
-        return rc;
-}
-
-static void free_pcpu_chunk(struct pcpu_chunk *chunk)
-{
-        if (!chunk)
-                return;
-        if (chunk->vms)
-                pcpu_free_vm_areas(chunk->vms, pcpu_nr_groups);
-        pcpu_mem_free(chunk->map, chunk->map_alloc * sizeof(chunk->map[0]));
-        kfree(chunk);
-}
-
-static struct pcpu_chunk *alloc_pcpu_chunk(void)
-{
-        struct pcpu_chunk *chunk;
-
-        chunk = kzalloc(pcpu_chunk_struct_size, GFP_KERNEL);
-        if (!chunk)
-                return NULL;
-
-        chunk->map = pcpu_mem_alloc(PCPU_DFL_MAP_ALLOC * sizeof(chunk->map[0]));
-        chunk->map_alloc = PCPU_DFL_MAP_ALLOC;
-        chunk->map[chunk->map_used++] = pcpu_unit_size;
-
-        chunk->vms = pcpu_get_vm_areas(pcpu_group_offsets, pcpu_group_sizes,
-                                       pcpu_nr_groups, pcpu_atom_size,
-                                       GFP_KERNEL);
-        if (!chunk->vms) {
-                free_pcpu_chunk(chunk);
-                return NULL;
-        }
-
-        INIT_LIST_HEAD(&chunk->list);
-        chunk->free_size = pcpu_unit_size;
-        chunk->contig_hint = pcpu_unit_size;
-        chunk->base_addr = chunk->vms[0]->addr - pcpu_group_offsets[0];
-
-        return chunk;
+        addr += pcpu_unit_offsets[raw_smp_processor_id()];
+        return pcpu_get_page_chunk(pcpu_addr_to_page(addr));
 }
 
 /**
@@ -1142,7 +777,7 @@ restart:
         /* hmmm... no space left, create a new chunk */
         spin_unlock_irqrestore(&pcpu_lock, flags);
 
-        chunk = alloc_pcpu_chunk();
+        chunk = pcpu_create_chunk();
         if (!chunk) {
                 err = "failed to allocate new chunk";
                 goto fail_unlock_mutex;
@@ -1254,7 +889,7 @@ static void pcpu_reclaim(struct work_struct *work)
 
         list_for_each_entry_safe(chunk, next, &todo, list) {
                 pcpu_depopulate_chunk(chunk, 0, pcpu_unit_size);
-                free_pcpu_chunk(chunk);
+                pcpu_destroy_chunk(chunk);
         }
 
         mutex_unlock(&pcpu_alloc_mutex);
@@ -1343,11 +978,14 @@ bool is_kernel_percpu_address(unsigned long addr)
  */
 phys_addr_t per_cpu_ptr_to_phys(void *addr)
 {
-        if ((unsigned long)addr < VMALLOC_START ||
-                        (unsigned long)addr >= VMALLOC_END)
-                return __pa(addr);
-        else
-                return page_to_phys(vmalloc_to_page(addr));
+        if (pcpu_addr_in_first_chunk(addr)) {
+                if ((unsigned long)addr < VMALLOC_START ||
+                    (unsigned long)addr >= VMALLOC_END)
+                        return __pa(addr);
+                else
+                        return page_to_phys(vmalloc_to_page(addr));
+        } else
+                return page_to_phys(pcpu_addr_to_page(addr));
 }
 
 static inline size_t pcpu_calc_fc_sizes(size_t static_size,
@@ -1719,6 +1357,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
         PCPU_SETUP_BUG_ON(ai->unit_size < size_sum);
         PCPU_SETUP_BUG_ON(ai->unit_size & ~PAGE_MASK);
         PCPU_SETUP_BUG_ON(ai->unit_size < PCPU_MIN_UNIT_SIZE);
+        PCPU_SETUP_BUG_ON(pcpu_verify_alloc_info(ai) < 0);
 
         /* process group information and build config tables accordingly */
         group_offsets = alloc_bootmem(ai->nr_groups * sizeof(group_offsets[0]));
diff --git a/mm/readahead.c b/mm/readahead.c
index dfa9a1a03a11..77506a291a2d 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -523,7 +523,7 @@ EXPORT_SYMBOL_GPL(page_cache_sync_readahead);
  * @req_size: hint: total size of the read which the caller is performing in
  *            pagecache pages
  *
- * page_cache_async_ondemand() should be called when a page is used which
+ * page_cache_async_readahead() should be called when a page is used which
  * has the PG_readahead flag; this is a marker to suggest that the application
  * has used up enough of the readahead window that we should start pulling in
  * more pages.
diff --git a/mm/rmap.c b/mm/rmap.c
index 0feeef860a8f..38a336e2eea1 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -250,7 +250,7 @@ static void anon_vma_unlink(struct anon_vma_chain *anon_vma_chain)
         list_del(&anon_vma_chain->same_anon_vma);
 
         /* We must garbage collect the anon_vma if it's empty */
-        empty = list_empty(&anon_vma->head) && !ksm_refcount(anon_vma);
+        empty = list_empty(&anon_vma->head) && !anonvma_external_refcount(anon_vma);
         spin_unlock(&anon_vma->lock);
 
         if (empty)
@@ -274,7 +274,7 @@ static void anon_vma_ctor(void *data)
         struct anon_vma *anon_vma = data;
 
         spin_lock_init(&anon_vma->lock);
-        ksm_refcount_init(anon_vma);
+        anonvma_external_refcount_init(anon_vma);
         INIT_LIST_HEAD(&anon_vma->head);
 }
 
@@ -1131,6 +1131,20 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
         return ret;
 }
 
+static bool is_vma_temporary_stack(struct vm_area_struct *vma)
+{
+        int maybe_stack = vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP);
+
+        if (!maybe_stack)
+                return false;
+
+        if ((vma->vm_flags & VM_STACK_INCOMPLETE_SETUP) ==
+                                                VM_STACK_INCOMPLETE_SETUP)
+                return true;
+
+        return false;
+}
+
 /**
  * try_to_unmap_anon - unmap or unlock anonymous page using the object-based
  * rmap method
@@ -1159,7 +1173,21 @@ static int try_to_unmap_anon(struct page *page, enum ttu_flags flags)
 
         list_for_each_entry(avc, &anon_vma->head, same_anon_vma) {
                 struct vm_area_struct *vma = avc->vma;
-                unsigned long address = vma_address(page, vma);
+                unsigned long address;
+
+                /*
+                 * During exec, a temporary VMA is setup and later moved.
+                 * The VMA is moved under the anon_vma lock but not the
+                 * page tables leading to a race where migration cannot
+                 * find the migration ptes. Rather than increasing the
+                 * locking requirements of exec(), migration skips
+                 * temporary VMAs until after exec() completes.
+                 */
+                if (PAGE_MIGRATION && (flags & TTU_MIGRATION) &&
+                                is_vma_temporary_stack(vma))
+                        continue;
+
+                address = vma_address(page, vma);
                 if (address == -EFAULT)
                         continue;
                 ret = try_to_unmap_one(page, vma, address, flags);
@@ -1355,10 +1383,8 @@ static int rmap_walk_anon(struct page *page, int (*rmap_one)(struct page *,
         /*
          * Note: remove_migration_ptes() cannot use page_lock_anon_vma()
          * because that depends on page_mapped(); but not all its usages
-         * are holding mmap_sem, which also gave the necessary guarantee
-         * (that this anon_vma's slab has not already been destroyed).
-         * This needs to be reviewed later: avoiding page_lock_anon_vma()
-         * is risky, and currently limits the usefulness of rmap_walk().
+         * are holding mmap_sem. Users without mmap_sem are required to
+         * take a reference count to prevent the anon_vma disappearing
          */
         anon_vma = page_anon_vma(page);
         if (!anon_vma)
diff --git a/mm/shmem.c b/mm/shmem.c
index eef4ebea5158..855eaf5b8d5b 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -433,8 +433,6 @@ static swp_entry_t *shmem_swp_alloc(struct shmem_inode_info *info, unsigned long
 
                 spin_unlock(&info->lock);
                 page = shmem_dir_alloc(mapping_gfp_mask(inode->i_mapping));
-                if (page)
-                        set_page_private(page, 0);
                 spin_lock(&info->lock);
 
                 if (!page) {
@@ -1545,8 +1543,8 @@ static int shmem_mmap(struct file *file, struct vm_area_struct *vma)
         return 0;
 }
 
-static struct inode *shmem_get_inode(struct super_block *sb, int mode,
-                                        dev_t dev, unsigned long flags)
+static struct inode *shmem_get_inode(struct super_block *sb, const struct inode *dir,
+                                     int mode, dev_t dev, unsigned long flags)
 {
         struct inode *inode;
         struct shmem_inode_info *info;
@@ -1557,9 +1555,7 @@ static struct inode *shmem_get_inode(struct super_block *sb, int mode,
 
         inode = new_inode(sb);
         if (inode) {
-                inode->i_mode = mode;
-                inode->i_uid = current_fsuid();
-                inode->i_gid = current_fsgid();
+                inode_init_owner(inode, dir, mode);
                 inode->i_blocks = 0;
                 inode->i_mapping->backing_dev_info = &shmem_backing_dev_info;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
@@ -1814,7 +1810,7 @@ shmem_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
         struct inode *inode;
         int error = -ENOSPC;
 
-        inode = shmem_get_inode(dir->i_sb, mode, dev, VM_NORESERVE);
+        inode = shmem_get_inode(dir->i_sb, dir, mode, dev, VM_NORESERVE);
         if (inode) {
                 error = security_inode_init_security(inode, dir, NULL, NULL,
                                                      NULL);
@@ -1833,11 +1829,6 @@ shmem_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
 #else
                 error = 0;
 #endif
-                if (dir->i_mode & S_ISGID) {
-                        inode->i_gid = dir->i_gid;
-                        if (S_ISDIR(mode))
-                                inode->i_mode |= S_ISGID;
-                }
                 dir->i_size += BOGO_DIRENT_SIZE;
                 dir->i_ctime = dir->i_mtime = CURRENT_TIME;
                 d_instantiate(dentry, inode);
@@ -1957,7 +1948,7 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
         if (len > PAGE_CACHE_SIZE)
                 return -ENAMETOOLONG;
 
-        inode = shmem_get_inode(dir->i_sb, S_IFLNK|S_IRWXUGO, 0, VM_NORESERVE);
+        inode = shmem_get_inode(dir->i_sb, dir, S_IFLNK|S_IRWXUGO, 0, VM_NORESERVE);
         if (!inode)
                 return -ENOSPC;
 
@@ -1992,8 +1983,6 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
                 unlock_page(page);
                 page_cache_release(page);
         }
-        if (dir->i_mode & S_ISGID)
-                inode->i_gid = dir->i_gid;
         dir->i_size += BOGO_DIRENT_SIZE;
         dir->i_ctime = dir->i_mtime = CURRENT_TIME;
         d_instantiate(dentry, inode);
@@ -2071,14 +2060,14 @@ static int shmem_xattr_security_set(struct dentry *dentry, const char *name,
                                           size, flags);
 }
 
-static struct xattr_handler shmem_xattr_security_handler = {
+static const struct xattr_handler shmem_xattr_security_handler = {
         .prefix = XATTR_SECURITY_PREFIX,
         .list   = shmem_xattr_security_list,
         .get    = shmem_xattr_security_get,
         .set    = shmem_xattr_security_set,
 };
 
-static struct xattr_handler *shmem_xattr_handlers[] = {
+static const struct xattr_handler *shmem_xattr_handlers[] = {
         &generic_acl_access_handler,
         &generic_acl_default_handler,
         &shmem_xattr_security_handler,
@@ -2366,7 +2355,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_flags |= MS_POSIXACL;
 #endif
 
-        inode = shmem_get_inode(sb, S_IFDIR | sbinfo->mode, 0, VM_NORESERVE);
+        inode = shmem_get_inode(sb, NULL, S_IFDIR | sbinfo->mode, 0, VM_NORESERVE);
         if (!inode)
                 goto failed;
         inode->i_uid = sbinfo->uid;
@@ -2570,6 +2559,45 @@ out4:
         return error;
 }
 
+#ifdef CONFIG_CGROUP_MEM_RES_CTLR
+/**
+ * mem_cgroup_get_shmem_target - find a page or entry assigned to the shmem file
+ * @inode: the inode to be searched
+ * @pgoff: the offset to be searched
+ * @pagep: the pointer for the found page to be stored
+ * @ent: the pointer for the found swap entry to be stored
+ *
+ * If a page is found, refcount of it is incremented. Callers should handle
+ * these refcount.
+ */
+void mem_cgroup_get_shmem_target(struct inode *inode, pgoff_t pgoff,
+                                        struct page **pagep, swp_entry_t *ent)
+{
+        swp_entry_t entry = { .val = 0 }, *ptr;
+        struct page *page = NULL;
+        struct shmem_inode_info *info = SHMEM_I(inode);
+
+        if ((pgoff << PAGE_CACHE_SHIFT) >= i_size_read(inode))
+                goto out;
+
+        spin_lock(&info->lock);
+        ptr = shmem_swp_entry(info, pgoff, NULL);
+#ifdef CONFIG_SWAP
+        if (ptr && ptr->val) {
+                entry.val = ptr->val;
+                page = find_get_page(&swapper_space, entry.val);
+        } else
+#endif
+                page = find_get_page(inode->i_mapping, pgoff);
+        if (ptr)
+                shmem_swp_unmap(ptr);
+        spin_unlock(&info->lock);
+out:
+        *pagep = page;
+        *ent = entry;
+}
+#endif
+
 #else /* !CONFIG_SHMEM */
 
 /*
@@ -2609,9 +2637,34 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
         return 0;
 }
 
+#ifdef CONFIG_CGROUP_MEM_RES_CTLR
+/**
+ * mem_cgroup_get_shmem_target - find a page or entry assigned to the shmem file
+ * @inode: the inode to be searched
+ * @pgoff: the offset to be searched
+ * @pagep: the pointer for the found page to be stored
+ * @ent: the pointer for the found swap entry to be stored
+ *
+ * If a page is found, refcount of it is incremented. Callers should handle
+ * these refcount.
+ */
+void mem_cgroup_get_shmem_target(struct inode *inode, pgoff_t pgoff,
+                                        struct page **pagep, swp_entry_t *ent)
+{
+        struct page *page = NULL;
+
+        if ((pgoff << PAGE_CACHE_SHIFT) >= i_size_read(inode))
+                goto out;
+        page = find_get_page(inode->i_mapping, pgoff);
+out:
+        *pagep = page;
+        *ent = (swp_entry_t){ .val = 0 };
+}
+#endif
+
 #define shmem_vm_ops                            generic_file_vm_ops
 #define shmem_file_operations                   ramfs_file_operations
-#define shmem_get_inode(sb, mode, dev, flags)   ramfs_get_inode(sb, mode, dev)
+#define shmem_get_inode(sb, dir, mode, dev, flags)      ramfs_get_inode(sb, dir, mode, dev)
 #define shmem_acct_size(flags, size)            0
 #define shmem_unacct_size(flags, size)          do {} while (0)
 #define SHMEM_MAX_BYTES                         MAX_LFS_FILESIZE
@@ -2655,7 +2708,7 @@ struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags
         path.mnt = mntget(shm_mnt);
 
         error = -ENOSPC;
-        inode = shmem_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0, flags);
+        inode = shmem_get_inode(root->d_sb, NULL, S_IFREG | S_IRWXUGO, 0, flags);
         if (!inode)
                 goto put_dentry;
 
diff --git a/mm/slab.c b/mm/slab.c
index bac0f4fcc216..e49f8f46f46d 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -115,6 +115,7 @@
 #include        <linux/reciprocal_div.h>
 #include        <linux/debugobjects.h>
 #include        <linux/kmemcheck.h>
+#include        <linux/memory.h>
 
 #include        <asm/cacheflush.h>
 #include        <asm/tlbflush.h>
@@ -144,30 +145,6 @@
 #define BYTES_PER_WORD          sizeof(void *)
 #define REDZONE_ALIGN           max(BYTES_PER_WORD, __alignof__(unsigned long long))
 
-#ifndef ARCH_KMALLOC_MINALIGN
-/*
- * Enforce a minimum alignment for the kmalloc caches.
- * Usually, the kmalloc caches are cache_line_size() aligned, except when
- * DEBUG and FORCED_DEBUG are enabled, then they are BYTES_PER_WORD aligned.
- * Some archs want to perform DMA into kmalloc caches and need a guaranteed
- * alignment larger than the alignment of a 64-bit integer.
- * ARCH_KMALLOC_MINALIGN allows that.
- * Note that increasing this value may disable some debug features.
- */
-#define ARCH_KMALLOC_MINALIGN __alignof__(unsigned long long)
-#endif
-
-#ifndef ARCH_SLAB_MINALIGN
-/*
- * Enforce a minimum alignment for all caches.
- * Intended for archs that get misalignment faults even for BYTES_PER_WORD
- * aligned buffers. Includes ARCH_KMALLOC_MINALIGN.
- * If possible: Do not enable this flag for CONFIG_DEBUG_SLAB, it disables
- * some debug features.
- */
-#define ARCH_SLAB_MINALIGN 0
-#endif
-
 #ifndef ARCH_KMALLOC_FLAGS
 #define ARCH_KMALLOC_FLAGS SLAB_HWCACHE_ALIGN
 #endif
@@ -844,7 +821,7 @@ static void init_reap_node(int cpu)
 {
         int node;
 
-        node = next_node(cpu_to_node(cpu), node_online_map);
+        node = next_node(cpu_to_mem(cpu), node_online_map);
         if (node == MAX_NUMNODES)
                 node = first_node(node_online_map);
 
@@ -1073,7 +1050,7 @@ static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
         struct array_cache *alien = NULL;
         int node;
 
-        node = numa_node_id();
+        node = numa_mem_id();
 
         /*
          * Make sure we are not freeing a object from another node to the array
@@ -1102,11 +1079,57 @@ static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
 }
 #endif
 
+/*
+ * Allocates and initializes nodelists for a node on each slab cache, used for
+ * either memory or cpu hotplug.  If memory is being hot-added, the kmem_list3
+ * will be allocated off-node since memory is not yet online for the new node.
+ * When hotplugging memory or a cpu, existing nodelists are not replaced if
+ * already in use.
+ *
+ * Must hold cache_chain_mutex.
+ */
+static int init_cache_nodelists_node(int node)
+{
+        struct kmem_cache *cachep;
+        struct kmem_list3 *l3;
+        const int memsize = sizeof(struct kmem_list3);
+
+        list_for_each_entry(cachep, &cache_chain, next) {
+                /*
+                 * Set up the size64 kmemlist for cpu before we can
+                 * begin anything. Make sure some other cpu on this
+                 * node has not already allocated this
+                 */
+                if (!cachep->nodelists[node]) {
+                        l3 = kmalloc_node(memsize, GFP_KERNEL, node);
+                        if (!l3)
+                                return -ENOMEM;
+                        kmem_list3_init(l3);
+                        l3->next_reap = jiffies + REAPTIMEOUT_LIST3 +
+                            ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
+
+                        /*
+                         * The l3s don't come and go as CPUs come and
+                         * go.  cache_chain_mutex is sufficient
+                         * protection here.
+                         */
+                        cachep->nodelists[node] = l3;
+                }
+
+                spin_lock_irq(&cachep->nodelists[node]->list_lock);
+                cachep->nodelists[node]->free_limit =
+                        (1 + nr_cpus_node(node)) *
+                        cachep->batchcount + cachep->num;
+                spin_unlock_irq(&cachep->nodelists[node]->list_lock);
+        }
+        return 0;
+}
+
 static void __cpuinit cpuup_canceled(long cpu)
 {
         struct kmem_cache *cachep;
         struct kmem_list3 *l3 = NULL;
-        int node = cpu_to_node(cpu);
+        int node = cpu_to_mem(cpu);
         const struct cpumask *mask = cpumask_of_node(node);
 
         list_for_each_entry(cachep, &cache_chain, next) {
@@ -1171,8 +1194,8 @@ static int __cpuinit cpuup_prepare(long cpu)
 {
         struct kmem_cache *cachep;
         struct kmem_list3 *l3 = NULL;
-        int node = cpu_to_node(cpu);
-        const int memsize = sizeof(struct kmem_list3);
+        int node = cpu_to_mem(cpu);
+        int err;
 
         /*
          * We need to do this right in the beginning since
@@ -1180,35 +1203,9 @@ static int __cpuinit cpuup_prepare(long cpu)
          * kmalloc_node allows us to add the slab to the right
          * kmem_list3 and not this cpu's kmem_list3
          */
-
-        list_for_each_entry(cachep, &cache_chain, next) {
-                /*
-                 * Set up the size64 kmemlist for cpu before we can
-                 * begin anything. Make sure some other cpu on this
-                 * node has not already allocated this
-                 */
-                if (!cachep->nodelists[node]) {
-                        l3 = kmalloc_node(memsize, GFP_KERNEL, node);
-                        if (!l3)
-                                goto bad;
-                        kmem_list3_init(l3);
-                        l3->next_reap = jiffies + REAPTIMEOUT_LIST3 +
-                            ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
-
-                        /*
-                         * The l3s don't come and go as CPUs come and
-                         * go.  cache_chain_mutex is sufficient
-                         * protection here.
-                         */
-                        cachep->nodelists[node] = l3;
-                }
-
-                spin_lock_irq(&cachep->nodelists[node]->list_lock);
-                cachep->nodelists[node]->free_limit =
-                        (1 + nr_cpus_node(node)) *
-                        cachep->batchcount + cachep->num;
-                spin_unlock_irq(&cachep->nodelists[node]->list_lock);
-        }
+        err = init_cache_nodelists_node(node);
+        if (err < 0)
+                goto bad;
 
         /*
          * Now we can go ahead with allocating the shared arrays and
@@ -1324,18 +1321,82 @@ static int __cpuinit cpuup_callback(struct notifier_block *nfb,
                 mutex_unlock(&cache_chain_mutex);
                 break;
         }
-        return err ? NOTIFY_BAD : NOTIFY_OK;
+        return notifier_from_errno(err);
 }
 
 static struct notifier_block __cpuinitdata cpucache_notifier = {
         &cpuup_callback, NULL, 0
 };
 
+#if defined(CONFIG_NUMA) && defined(CONFIG_MEMORY_HOTPLUG)
+/*
+ * Drains freelist for a node on each slab cache, used for memory hot-remove.
+ * Returns -EBUSY if all objects cannot be drained so that the node is not
+ * removed.
+ *
+ * Must hold cache_chain_mutex.
+ */
+static int __meminit drain_cache_nodelists_node(int node)
+{
+        struct kmem_cache *cachep;
+        int ret = 0;
+
+        list_for_each_entry(cachep, &cache_chain, next) {
+                struct kmem_list3 *l3;
+
+                l3 = cachep->nodelists[node];
+                if (!l3)
+                        continue;
+
+                drain_freelist(cachep, l3, l3->free_objects);
+
+                if (!list_empty(&l3->slabs_full) ||
+                    !list_empty(&l3->slabs_partial)) {
+                        ret = -EBUSY;
+                        break;
+                }
+        }
+        return ret;
+}
+
+static int __meminit slab_memory_callback(struct notifier_block *self,
+                                        unsigned long action, void *arg)
+{
+        struct memory_notify *mnb = arg;
+        int ret = 0;
+        int nid;
+
+        nid = mnb->status_change_nid;
+        if (nid < 0)
+                goto out;
+
+        switch (action) {
+        case MEM_GOING_ONLINE:
+                mutex_lock(&cache_chain_mutex);
+                ret = init_cache_nodelists_node(nid);
+                mutex_unlock(&cache_chain_mutex);
+                break;
+        case MEM_GOING_OFFLINE:
+                mutex_lock(&cache_chain_mutex);
+                ret = drain_cache_nodelists_node(nid);
+                mutex_unlock(&cache_chain_mutex);
+                break;
+        case MEM_ONLINE:
+        case MEM_OFFLINE:
+        case MEM_CANCEL_ONLINE:
+        case MEM_CANCEL_OFFLINE:
+                break;
+        }
+out:
+        return ret ? notifier_from_errno(ret) : NOTIFY_OK;
+}
+#endif /* CONFIG_NUMA && CONFIG_MEMORY_HOTPLUG */
+
 /*
  * swap the static kmem_list3 with kmalloced memory
  */
-static void init_list(struct kmem_cache *cachep, struct kmem_list3 *list,
-                        int nodeid)
+static void __init init_list(struct kmem_cache *cachep, struct kmem_list3 *list,
+                                int nodeid)
 {
         struct kmem_list3 *ptr;
 
@@ -1418,7 +1479,7 @@ void __init kmem_cache_init(void)
          * 6) Resize the head arrays of the kmalloc caches to their final sizes.
          */
 
-        node = numa_node_id();
+        node = numa_mem_id();
 
         /* 1) create the cache_cache */
         INIT_LIST_HEAD(&cache_chain);
@@ -1580,6 +1641,14 @@ void __init kmem_cache_init_late(void)
          */
         register_cpu_notifier(&cpucache_notifier);
 
+#ifdef CONFIG_NUMA
+        /*
+         * Register a memory hotplug callback that initializes and frees
+         * nodelists.
+         */
+        hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
+#endif
+
         /*
          * The reap timers are started later, with a module init call: That part
          * of the kernel is not yet operational.
@@ -2052,7 +2121,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
                         }
                 }
         }
-        cachep->nodelists[numa_node_id()]->next_reap =
+        cachep->nodelists[numa_mem_id()]->next_reap =
                         jiffies + REAPTIMEOUT_LIST3 +
                         ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
 
@@ -2220,8 +2289,8 @@ kmem_cache_create (const char *name, size_t size, size_t align,
         if (ralign < align) {
                 ralign = align;
         }
-        /* disable debug if necessary */
-        if (ralign > __alignof__(unsigned long long))
+        /* disable debug if not aligning with REDZONE_ALIGN */
+        if (ralign & (__alignof__(unsigned long long) - 1))
                 flags &= ~(SLAB_RED_ZONE | SLAB_STORE_USER);
         /*
          * 4) Store it.
@@ -2247,8 +2316,8 @@ kmem_cache_create (const char *name, size_t size, size_t align,
          */
         if (flags & SLAB_RED_ZONE) {
                 /* add space for red zone words */
-                cachep->obj_offset += sizeof(unsigned long long);
-                size += 2 * sizeof(unsigned long long);
+                cachep->obj_offset += align;
+                size += align + sizeof(unsigned long long);
         }
         if (flags & SLAB_STORE_USER) {
                 /* user store requires one word storage behind the end of
@@ -2383,7 +2452,7 @@ static void check_spinlock_acquired(struct kmem_cache *cachep)
 {
 #ifdef CONFIG_SMP
         check_irq_off();
-        assert_spin_locked(&cachep->nodelists[numa_node_id()]->list_lock);
+        assert_spin_locked(&cachep->nodelists[numa_mem_id()]->list_lock);
 #endif
 }
 
@@ -2410,7 +2479,7 @@ static void do_drain(void *arg)
 {
         struct kmem_cache *cachep = arg;
         struct array_cache *ac;
-        int node = numa_node_id();
+        int node = numa_mem_id();
 
         check_irq_off();
         ac = cpu_cache_get(cachep);
@@ -2943,7 +3012,7 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
 
 retry:
         check_irq_off();
-        node = numa_node_id();
+        node = numa_mem_id();
         ac = cpu_cache_get(cachep);
         batchcount = ac->batchcount;
         if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
@@ -3147,11 +3216,13 @@ static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags)
 
         if (in_interrupt() || (flags & __GFP_THISNODE))
                 return NULL;
-        nid_alloc = nid_here = numa_node_id();
+        nid_alloc = nid_here = numa_mem_id();
+        get_mems_allowed();
         if (cpuset_do_slab_mem_spread() && (cachep->flags & SLAB_MEM_SPREAD))
-                nid_alloc = cpuset_mem_spread_node();
+                nid_alloc = cpuset_slab_spread_node();
         else if (current->mempolicy)
                 nid_alloc = slab_node(current->mempolicy);
+        put_mems_allowed();
         if (nid_alloc != nid_here)
                 return ____cache_alloc_node(cachep, flags, nid_alloc);
         return NULL;
@@ -3178,6 +3249,7 @@ static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags)
         if (flags & __GFP_THISNODE)
                 return NULL;
 
+        get_mems_allowed();
         zonelist = node_zonelist(slab_node(current->mempolicy), flags);
         local_flags = flags & (GFP_CONSTRAINT_MASK|GFP_RECLAIM_MASK);
 
@@ -3209,7 +3281,7 @@ retry:
                 if (local_flags & __GFP_WAIT)
                         local_irq_enable();
                 kmem_flagcheck(cache, flags);
-                obj = kmem_getpages(cache, local_flags, numa_node_id());
+                obj = kmem_getpages(cache, local_flags, numa_mem_id());
                 if (local_flags & __GFP_WAIT)
                         local_irq_disable();
                 if (obj) {
@@ -3233,6 +3305,7 @@ retry:
                         }
                 }
         }
+        put_mems_allowed();
         return obj;
 }
 
@@ -3316,6 +3389,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
 {
         unsigned long save_flags;
         void *ptr;
+        int slab_node = numa_mem_id();
 
         flags &= gfp_allowed_mask;
 
@@ -3328,7 +3402,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
         local_irq_save(save_flags);
 
         if (nodeid == -1)
-                nodeid = numa_node_id();
+                nodeid = slab_node;
 
         if (unlikely(!cachep->nodelists[nodeid])) {
                 /* Node not bootstrapped yet */
@@ -3336,7 +3410,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
                 goto out;
         }
 
-        if (nodeid == numa_node_id()) {
+        if (nodeid == slab_node) {
                 /*
                  * Use the locally cached objects if possible.
                  * However ____cache_alloc does not allow fallback
@@ -3380,8 +3454,8 @@ __do_cache_alloc(struct kmem_cache *cache, gfp_t flags)
          * We may just have run out of memory on the local node.
          * ____cache_alloc_node() knows how to locate memory on other nodes
          */
-        if (!objp)
-                objp = ____cache_alloc_node(cache, flags, numa_node_id());
+        if (!objp)
+                objp = ____cache_alloc_node(cache, flags, numa_mem_id());
 
   out:
         return objp;
@@ -3478,7 +3552,7 @@ static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac)
 {
         int batchcount;
         struct kmem_list3 *l3;
-        int node = numa_node_id();
+        int node = numa_mem_id();
 
         batchcount = ac->batchcount;
 #if DEBUG
@@ -3912,7 +3986,7 @@ static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
                 return -ENOMEM;
 
         for_each_online_cpu(i) {
-                new->new[i] = alloc_arraycache(cpu_to_node(i), limit,
+                new->new[i] = alloc_arraycache(cpu_to_mem(i), limit,
                                                 batchcount, gfp);
                 if (!new->new[i]) {
                         for (i--; i >= 0; i--)
@@ -3934,9 +4008,9 @@ static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
                 struct array_cache *ccold = new->new[i];
                 if (!ccold)
                         continue;
-                spin_lock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
-                free_block(cachep, ccold->entry, ccold->avail, cpu_to_node(i));
-                spin_unlock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
+                spin_lock_irq(&cachep->nodelists[cpu_to_mem(i)]->list_lock);
+                free_block(cachep, ccold->entry, ccold->avail, cpu_to_mem(i));
+                spin_unlock_irq(&cachep->nodelists[cpu_to_mem(i)]->list_lock);
                 kfree(ccold);
         }
         kfree(new);
@@ -4042,7 +4116,7 @@ static void cache_reap(struct work_struct *w)
 {
         struct kmem_cache *searchp;
         struct kmem_list3 *l3;
-        int node = numa_node_id();
+        int node = numa_mem_id();
         struct delayed_work *work = to_delayed_work(w);
 
         if (!mutex_trylock(&cache_chain_mutex))
@@ -4216,10 +4290,11 @@ static int s_show(struct seq_file *m, void *p)
                 unsigned long node_frees = cachep->node_frees;
                 unsigned long overflows = cachep->node_overflow;
 
-                seq_printf(m, " : globalstat %7lu %6lu %5lu %4lu \
-                                %4lu %4lu %4lu %4lu %4lu", allocs, high, grown,
-                                reaped, errors, max_freeable, node_allocs,
-                                node_frees, overflows);
+                seq_printf(m, " : globalstat %7lu %6lu %5lu %4lu "
+                           "%4lu %4lu %4lu %4lu %4lu",
+                           allocs, high, grown,
+                           reaped, errors, max_freeable, node_allocs,
+                           node_frees, overflows);
         }
         /* cpu stats */
         {
diff --git a/mm/slob.c b/mm/slob.c
index 837ebd64cc34..23631e2bb57a 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -467,14 +467,6 @@ out:
  * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
  */
 
-#ifndef ARCH_KMALLOC_MINALIGN
-#define ARCH_KMALLOC_MINALIGN __alignof__(unsigned long)
-#endif
-
-#ifndef ARCH_SLAB_MINALIGN
-#define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
-#endif
-
 void *__kmalloc_node(size_t size, gfp_t gfp, int node)
 {
         unsigned int *m;
diff --git a/mm/slub.c b/mm/slub.c
index d2a54fe71ea2..26f0cb9cc584 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -157,14 +157,6 @@
 #define SLUB_MERGE_SAME (SLAB_DEBUG_FREE | SLAB_RECLAIM_ACCOUNT | \
                 SLAB_CACHE_DMA | SLAB_NOTRACK)
 
-#ifndef ARCH_KMALLOC_MINALIGN
-#define ARCH_KMALLOC_MINALIGN __alignof__(unsigned long long)
-#endif
-
-#ifndef ARCH_SLAB_MINALIGN
-#define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
-#endif
-
 #define OO_SHIFT        16
 #define OO_MASK         ((1 << OO_SHIFT) - 1)
 #define MAX_OBJS_PER_PAGE       65535 /* since page.objects is u16 */
@@ -1084,7 +1076,7 @@ static inline struct page *alloc_slab_page(gfp_t flags, int node,
         if (node == -1)
                 return alloc_pages(flags, order);
         else
-                return alloc_pages_node(node, flags, order);
+                return alloc_pages_exact_node(node, flags, order);
 }
 
 static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
@@ -1368,6 +1360,7 @@ static struct page *get_any_partial(struct kmem_cache *s, gfp_t flags)
                         get_cycles() % 1024 > s->remote_node_defrag_ratio)
                 return NULL;
 
+        get_mems_allowed();
         zonelist = node_zonelist(slab_node(current->mempolicy), flags);
         for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
                 struct kmem_cache_node *n;
@@ -1377,10 +1370,13 @@ static struct page *get_any_partial(struct kmem_cache *s, gfp_t flags)
                 if (n && cpuset_zone_allowed_hardwall(zone, flags) &&
                                 n->nr_partial > s->min_partial) {
                         page = get_partial_node(n);
-                        if (page)
+                        if (page) {
+                                put_mems_allowed();
                                 return page;
+                        }
                 }
         }
+        put_mems_allowed();
 #endif
         return NULL;
 }
@@ -2429,9 +2425,11 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 #ifdef CONFIG_SLUB_DEBUG
         void *addr = page_address(page);
         void *p;
-        DECLARE_BITMAP(map, page->objects);
+        long *map = kzalloc(BITS_TO_LONGS(page->objects) * sizeof(long),
+                            GFP_ATOMIC);
 
-        bitmap_zero(map, page->objects);
+        if (!map)
+                return;
         slab_err(s, page, "%s", text);
         slab_lock(page);
         for_each_free_object(p, s, page->freelist)
@@ -2446,6 +2444,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
                 }
         }
         slab_unlock(page);
+        kfree(map);
 #endif
 }
 
@@ -3338,8 +3337,15 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
         struct kmem_cache *s;
         void *ret;
 
-        if (unlikely(size > SLUB_MAX_SIZE))
-                return kmalloc_large_node(size, gfpflags, node);
+        if (unlikely(size > SLUB_MAX_SIZE)) {
+                ret = kmalloc_large_node(size, gfpflags, node);
+
+                trace_kmalloc_node(caller, ret,
+                                   size, PAGE_SIZE << get_order(size),
+                                   gfpflags, node);
+
+                return ret;
+        }
 
         s = get_slab(size, gfpflags);
 
@@ -3651,10 +3657,10 @@ static int add_location(struct loc_track *t, struct kmem_cache *s,
 }
 
 static void process_slab(struct loc_track *t, struct kmem_cache *s,
-                struct page *page, enum track_item alloc)
+                struct page *page, enum track_item alloc,
+                long *map)
 {
         void *addr = page_address(page);
-        DECLARE_BITMAP(map, page->objects);
         void *p;
 
         bitmap_zero(map, page->objects);
@@ -3673,11 +3679,14 @@ static int list_locations(struct kmem_cache *s, char *buf,
         unsigned long i;
         struct loc_track t = { 0, 0, NULL };
         int node;
+        unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
+                                     sizeof(unsigned long), GFP_KERNEL);
 
-        if (!alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location),
-                        GFP_TEMPORARY))
+        if (!map || !alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location),
+                                     GFP_TEMPORARY)) {
+                kfree(map);
                 return sprintf(buf, "Out of memory\n");
-
+        }
         /* Push back cpu slabs */
         flush_all(s);
 
@@ -3691,9 +3700,9 @@ static int list_locations(struct kmem_cache *s, char *buf,
 
                 spin_lock_irqsave(&n->list_lock, flags);
                 list_for_each_entry(page, &n->partial, lru)
-                        process_slab(&t, s, page, alloc);
+                        process_slab(&t, s, page, alloc, map);
                 list_for_each_entry(page, &n->full, lru)
-                        process_slab(&t, s, page, alloc);
+                        process_slab(&t, s, page, alloc, map);
                 spin_unlock_irqrestore(&n->list_lock, flags);
         }
 
@@ -3744,6 +3753,7 @@ static int list_locations(struct kmem_cache *s, char *buf,
         }
 
         free_loc_track(&t);
+        kfree(map);
         if (!t.count)
                 len += sprintf(buf, "No data\n");
         return len;
diff --git a/mm/sparse.c b/mm/sparse.c
index dc0cc4d43ff3..95ac219af379 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -382,13 +382,15 @@ static void __init sparse_early_usemaps_alloc_node(unsigned long**usemap_map,
 struct page __init *sparse_mem_map_populate(unsigned long pnum, int nid)
 {
         struct page *map;
+        unsigned long size;
 
         map = alloc_remap(nid, sizeof(struct page) * PAGES_PER_SECTION);
         if (map)
                 return map;
 
-        map = alloc_bootmem_pages_node(NODE_DATA(nid),
-                       PAGE_ALIGN(sizeof(struct page) * PAGES_PER_SECTION));
+        size = PAGE_ALIGN(sizeof(struct page) * PAGES_PER_SECTION);
+        map = __alloc_bootmem_node_high(NODE_DATA(nid), size,
+                                         PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
         return map;
 }
 void __init sparse_mem_maps_populate_node(struct page **map_map,
@@ -412,7 +414,8 @@ void __init sparse_mem_maps_populate_node(struct page **map_map,
         }
 
         size = PAGE_ALIGN(size);
-        map = alloc_bootmem_pages_node(NODE_DATA(nodeid), size * map_count);
+        map = __alloc_bootmem_node_high(NODE_DATA(nodeid), size * map_count,
+                                         PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
         if (map) {
                 for (pnum = pnum_begin; pnum < pnum_end; pnum++) {
                         if (!present_section_nr(pnum))
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 6cd0a8f90dc7..03aa2d55f1a2 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -139,7 +139,8 @@ static int discard_swap(struct swap_info_struct *si)
         nr_blocks = ((sector_t)se->nr_pages - 1) << (PAGE_SHIFT - 9);
         if (nr_blocks) {
                 err = blkdev_issue_discard(si->bdev, start_block,
-                                nr_blocks, GFP_KERNEL, DISCARD_FL_BARRIER);
+                                nr_blocks, GFP_KERNEL,
+                                BLKDEV_IFL_WAIT | BLKDEV_IFL_BARRIER);
                 if (err)
                         return err;
                 cond_resched();
@@ -150,7 +151,8 @@ static int discard_swap(struct swap_info_struct *si)
                 nr_blocks = (sector_t)se->nr_pages << (PAGE_SHIFT - 9);
 
                 err = blkdev_issue_discard(si->bdev, start_block,
-                                nr_blocks, GFP_KERNEL, DISCARD_FL_BARRIER);
+                                nr_blocks, GFP_KERNEL,
+                                BLKDEV_IFL_WAIT | BLKDEV_IFL_BARRIER);
                 if (err)
                         break;
 
@@ -189,7 +191,8 @@ static void discard_swap_cluster(struct swap_info_struct *si,
                         start_block <<= PAGE_SHIFT - 9;
                         nr_blocks <<= PAGE_SHIFT - 9;
                         if (blkdev_issue_discard(si->bdev, start_block,
-                                    nr_blocks, GFP_NOIO, DISCARD_FL_BARRIER))
+                                    nr_blocks, GFP_NOIO, BLKDEV_IFL_WAIT |
+                                                        BLKDEV_IFL_BARRIER))
                                 break;
                 }
 
@@ -574,6 +577,7 @@ static unsigned char swap_entry_free(struct swap_info_struct *p,
 
         /* free if no reference */
         if (!usage) {
+                struct gendisk *disk = p->bdev->bd_disk;
                 if (offset < p->lowest_bit)
                         p->lowest_bit = offset;
                 if (offset > p->highest_bit)
@@ -583,6 +587,9 @@ static unsigned char swap_entry_free(struct swap_info_struct *p,
                         swap_list.next = p->type;
                 nr_swap_pages++;
                 p->inuse_pages--;
+                if ((p->flags & SWP_BLKDEV) &&
+                                disk->fops->swap_slot_free_notify)
+                        disk->fops->swap_slot_free_notify(p->bdev, offset);
         }
 
         return usage;
@@ -1884,6 +1891,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
                 if (error < 0)
                         goto bad_swap;
                 p->bdev = bdev;
+                p->flags |= SWP_BLKDEV;
         } else if (S_ISREG(inode->i_mode)) {
                 p->bdev = inode->i_sb->s_bdev;
                 mutex_lock(&inode->i_mutex);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 3ff3311447f5..915dceb487c1 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -73,10 +73,14 @@ struct scan_control {
 
         int swappiness;
 
-        int all_unreclaimable;
-
         int order;
 
+        /*
+         * Intend to reclaim enough contenious memory rather than to reclaim
+         * enough amount memory. I.e, it's the mode for high order allocation.
+         */
+        bool lumpy_reclaim_mode;
+
         /* Which cgroup do we reclaim from */
         struct mem_cgroup *mem_cgroup;
 
@@ -85,12 +89,6 @@ struct scan_control {
          * are scanned.
          */
         nodemask_t      *nodemask;
-
-        /* Pluggable isolate pages callback */
-        unsigned long (*isolate_pages)(unsigned long nr, struct list_head *dst,
-                        unsigned long *scanned, int order, int mode,
-                        struct zone *z, struct mem_cgroup *mem_cont,
-                        int active, int file);
 };
 
 #define lru_to_page(_head) (list_entry((_head)->prev, struct page, lru))
@@ -575,7 +573,7 @@ static enum page_references page_check_references(struct page *page,
         referenced_page = TestClearPageReferenced(page);
 
         /* Lumpy reclaim - ignore references */
-        if (sc->order > PAGE_ALLOC_COSTLY_ORDER)
+        if (sc->lumpy_reclaim_mode)
                 return PAGEREF_RECLAIM;
 
         /*
@@ -839,11 +837,6 @@ keep:
         return nr_reclaimed;
 }
 
-/* LRU Isolation modes. */
-#define ISOLATE_INACTIVE 0      /* Isolate inactive pages. */
-#define ISOLATE_ACTIVE 1        /* Isolate active pages. */
-#define ISOLATE_BOTH 2          /* Isolate both active and inactive pages. */
-
 /*
  * Attempt to remove the specified page from its LRU.  Only take this page
  * if it is of the appropriate PageActive status.  Pages which are being
@@ -1011,7 +1004,6 @@ static unsigned long isolate_pages_global(unsigned long nr,
                                         struct list_head *dst,
                                         unsigned long *scanned, int order,
                                         int mode, struct zone *z,
-                                        struct mem_cgroup *mem_cont,
                                         int active, int file)
 {
         int lru = LRU_BASE;
@@ -1130,7 +1122,6 @@ static unsigned long shrink_inactive_list(unsigned long max_scan,
         unsigned long nr_scanned = 0;
         unsigned long nr_reclaimed = 0;
         struct zone_reclaim_stat *reclaim_stat = get_reclaim_stat(zone, sc);
-        int lumpy_reclaim = 0;
 
         while (unlikely(too_many_isolated(zone, file, sc))) {
                 congestion_wait(BLK_RW_ASYNC, HZ/10);
@@ -1140,17 +1131,6 @@ static unsigned long shrink_inactive_list(unsigned long max_scan,
                         return SWAP_CLUSTER_MAX;
         }
 
-        /*
-         * If we need a large contiguous chunk of memory, or have
-         * trouble getting a small set of contiguous pages, we
-         * will reclaim both active and inactive pages.
-         *
-         * We use the same threshold as pageout congestion_wait below.
-         */
-        if (sc->order > PAGE_ALLOC_COSTLY_ORDER)
-                lumpy_reclaim = 1;
-        else if (sc->order && priority < DEF_PRIORITY - 2)
-                lumpy_reclaim = 1;
 
         pagevec_init(&pvec, 1);
 
@@ -1163,15 +1143,15 @@ static unsigned long shrink_inactive_list(unsigned long max_scan,
                 unsigned long nr_freed;
                 unsigned long nr_active;
                 unsigned int count[NR_LRU_LISTS] = { 0, };
-                int mode = lumpy_reclaim ? ISOLATE_BOTH : ISOLATE_INACTIVE;
+                int mode = sc->lumpy_reclaim_mode ? ISOLATE_BOTH : ISOLATE_INACTIVE;
                 unsigned long nr_anon;
                 unsigned long nr_file;
 
-                nr_taken = sc->isolate_pages(SWAP_CLUSTER_MAX,
-                             &page_list, &nr_scan, sc->order, mode,
-                                zone, sc->mem_cgroup, 0, file);
-
                 if (scanning_global_lru(sc)) {
+                        nr_taken = isolate_pages_global(SWAP_CLUSTER_MAX,
+                                                        &page_list, &nr_scan,
+                                                        sc->order, mode,
+                                                        zone, 0, file);
                         zone->pages_scanned += nr_scan;
                         if (current_is_kswapd())
                                 __count_zone_vm_events(PGSCAN_KSWAPD, zone,
@@ -1179,6 +1159,16 @@ static unsigned long shrink_inactive_list(unsigned long max_scan,
                         else
                                 __count_zone_vm_events(PGSCAN_DIRECT, zone,
                                                        nr_scan);
+                } else {
+                        nr_taken = mem_cgroup_isolate_pages(SWAP_CLUSTER_MAX,
+                                                        &page_list, &nr_scan,
+                                                        sc->order, mode,
+                                                        zone, sc->mem_cgroup,
+                                                        0, file);
+                        /*
+                         * mem_cgroup_isolate_pages() keeps track of
+                         * scanned pages on its own.
+                         */
                 }
 
                 if (nr_taken == 0)
@@ -1216,7 +1206,7 @@ static unsigned long shrink_inactive_list(unsigned long max_scan,
                  * but that should be acceptable to the caller
                  */
                 if (nr_freed < nr_taken && !current_is_kswapd() &&
-                    lumpy_reclaim) {
+                    sc->lumpy_reclaim_mode) {
                         congestion_wait(BLK_RW_ASYNC, HZ/10);
 
                         /*
@@ -1356,16 +1346,23 @@ static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
 
         lru_add_drain();
         spin_lock_irq(&zone->lru_lock);
-        nr_taken = sc->isolate_pages(nr_pages, &l_hold, &pgscanned, sc->order,
-                                        ISOLATE_ACTIVE, zone,
-                                        sc->mem_cgroup, 1, file);
-        /*
-         * zone->pages_scanned is used for detect zone's oom
-         * mem_cgroup remembers nr_scan by itself.
-         */
         if (scanning_global_lru(sc)) {
+                nr_taken = isolate_pages_global(nr_pages, &l_hold,
+                                                &pgscanned, sc->order,
+                                                ISOLATE_ACTIVE, zone,
+                                                1, file);
                 zone->pages_scanned += pgscanned;
+        } else {
+                nr_taken = mem_cgroup_isolate_pages(nr_pages, &l_hold,
+                                                &pgscanned, sc->order,
+                                                ISOLATE_ACTIVE, zone,
+                                                sc->mem_cgroup, 1, file);
+                /*
+                 * mem_cgroup_isolate_pages() keeps track of
+                 * scanned pages on its own.
+                 */
         }
+
         reclaim_stat->recent_scanned[file] += nr_taken;
 
         __count_zone_vm_events(PGREFILL, zone, pgscanned);
@@ -1519,21 +1516,52 @@ static unsigned long shrink_list(enum lru_list lru, unsigned long nr_to_scan,
 }
 
 /*
+ * Smallish @nr_to_scan's are deposited in @nr_saved_scan,
+ * until we collected @swap_cluster_max pages to scan.
+ */
+static unsigned long nr_scan_try_batch(unsigned long nr_to_scan,
+                                       unsigned long *nr_saved_scan)
+{
+        unsigned long nr;
+
+        *nr_saved_scan += nr_to_scan;
+        nr = *nr_saved_scan;
+
+        if (nr >= SWAP_CLUSTER_MAX)
+                *nr_saved_scan = 0;
+        else
+                nr = 0;
+
+        return nr;
+}
+
+/*
  * Determine how aggressively the anon and file LRU lists should be
  * scanned.  The relative value of each set of LRU lists is determined
  * by looking at the fraction of the pages scanned we did rotate back
  * onto the active list instead of evict.
  *
- * percent[0] specifies how much pressure to put on ram/swap backed
- * memory, while percent[1] determines pressure on the file LRUs.
+ * nr[0] = anon pages to scan; nr[1] = file pages to scan
  */
-static void get_scan_ratio(struct zone *zone, struct scan_control *sc,
-                                        unsigned long *percent)
+static void get_scan_count(struct zone *zone, struct scan_control *sc,
+                                        unsigned long *nr, int priority)
 {
         unsigned long anon, file, free;
         unsigned long anon_prio, file_prio;
         unsigned long ap, fp;
         struct zone_reclaim_stat *reclaim_stat = get_reclaim_stat(zone, sc);
+        u64 fraction[2], denominator;
+        enum lru_list l;
+        int noswap = 0;
+
+        /* If we have no swap space, do not bother scanning anon pages. */
+        if (!sc->may_swap || (nr_swap_pages <= 0)) {
+                noswap = 1;
+                fraction[0] = 0;
+                fraction[1] = 1;
+                denominator = 1;
+                goto out;
+        }
 
         anon  = zone_nr_lru_pages(zone, sc, LRU_ACTIVE_ANON) +
                 zone_nr_lru_pages(zone, sc, LRU_INACTIVE_ANON);
@@ -1545,9 +1573,10 @@ static void get_scan_ratio(struct zone *zone, struct scan_control *sc,
                 /* If we have very few page cache pages,
                    force-scan anon pages. */
                 if (unlikely(file + free <= high_wmark_pages(zone))) {
-                        percent[0] = 100;
-                        percent[1] = 0;
-                        return;
+                        fraction[0] = 1;
+                        fraction[1] = 0;
+                        denominator = 1;
+                        goto out;
                 }
         }
 
@@ -1594,29 +1623,37 @@ static void get_scan_ratio(struct zone *zone, struct scan_control *sc,
         fp = (file_prio + 1) * (reclaim_stat->recent_scanned[1] + 1);
         fp /= reclaim_stat->recent_rotated[1] + 1;
 
-        /* Normalize to percentages */
-        percent[0] = 100 * ap / (ap + fp + 1);
-        percent[1] = 100 - percent[0];
+        fraction[0] = ap;
+        fraction[1] = fp;
+        denominator = ap + fp + 1;
+out:
+        for_each_evictable_lru(l) {
+                int file = is_file_lru(l);
+                unsigned long scan;
+
+                scan = zone_nr_lru_pages(zone, sc, l);
+                if (priority || noswap) {
+                        scan >>= priority;
+                        scan = div64_u64(scan * fraction[file], denominator);
+                }
+                nr[l] = nr_scan_try_batch(scan,
+                                          &reclaim_stat->nr_saved_scan[l]);
+        }
 }
 
-/*
- * Smallish @nr_to_scan's are deposited in @nr_saved_scan,
- * until we collected @swap_cluster_max pages to scan.
- */
-static unsigned long nr_scan_try_batch(unsigned long nr_to_scan,
-                                       unsigned long *nr_saved_scan)
+static void set_lumpy_reclaim_mode(int priority, struct scan_control *sc)
 {
-        unsigned long nr;
-
-        *nr_saved_scan += nr_to_scan;
-        nr = *nr_saved_scan;
-
-        if (nr >= SWAP_CLUSTER_MAX)
-                *nr_saved_scan = 0;
+        /*
+         * If we need a large contiguous chunk of memory, or have
+         * trouble getting a small set of contiguous pages, we
+         * will reclaim both active and inactive pages.
+         */
+        if (sc->order > PAGE_ALLOC_COSTLY_ORDER)
+                sc->lumpy_reclaim_mode = 1;
+        else if (sc->order && priority < DEF_PRIORITY - 2)
+                sc->lumpy_reclaim_mode = 1;
         else
-                nr = 0;
-
-        return nr;
+                sc->lumpy_reclaim_mode = 0;
 }
 
 /*
@@ -1627,33 +1664,13 @@ static void shrink_zone(int priority, struct zone *zone,
 {
         unsigned long nr[NR_LRU_LISTS];
         unsigned long nr_to_scan;
-        unsigned long percent[2];       /* anon @ 0; file @ 1 */
         enum lru_list l;
         unsigned long nr_reclaimed = sc->nr_reclaimed;
         unsigned long nr_to_reclaim = sc->nr_to_reclaim;
-        struct zone_reclaim_stat *reclaim_stat = get_reclaim_stat(zone, sc);
-        int noswap = 0;
-
-        /* If we have no swap space, do not bother scanning anon pages. */
-        if (!sc->may_swap || (nr_swap_pages <= 0)) {
-                noswap = 1;
-                percent[0] = 0;
-                percent[1] = 100;
-        } else
-                get_scan_ratio(zone, sc, percent);
 
-        for_each_evictable_lru(l) {
-                int file = is_file_lru(l);
-                unsigned long scan;
+        get_scan_count(zone, sc, nr, priority);
 
-                scan = zone_nr_lru_pages(zone, sc, l);
-                if (priority || noswap) {
-                        scan >>= priority;
-                        scan = (scan * percent[file]) / 100;
-                }
-                nr[l] = nr_scan_try_batch(scan,
-                                          &reclaim_stat->nr_saved_scan[l]);
-        }
+        set_lumpy_reclaim_mode(priority, sc);
 
         while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] ||
                                         nr[LRU_INACTIVE_FILE]) {
@@ -1707,14 +1724,14 @@ static void shrink_zone(int priority, struct zone *zone,
  * If a zone is deemed to be full of pinned pages then just give it a light
  * scan then give up on it.
  */
-static void shrink_zones(int priority, struct zonelist *zonelist,
+static int shrink_zones(int priority, struct zonelist *zonelist,
                                         struct scan_control *sc)
 {
         enum zone_type high_zoneidx = gfp_zone(sc->gfp_mask);
         struct zoneref *z;
         struct zone *zone;
+        int progress = 0;
 
-        sc->all_unreclaimable = 1;
         for_each_zone_zonelist_nodemask(zone, z, zonelist, high_zoneidx,
                                         sc->nodemask) {
                 if (!populated_zone(zone))
@@ -1730,19 +1747,19 @@ static void shrink_zones(int priority, struct zonelist *zonelist,
 
                         if (zone->all_unreclaimable && priority != DEF_PRIORITY)
                                 continue;       /* Let kswapd poll it */
-                        sc->all_unreclaimable = 0;
                 } else {
                         /*
                          * Ignore cpuset limitation here. We just want to reduce
                          * # of used pages by us regardless of memory shortage.
                          */
-                        sc->all_unreclaimable = 0;
                         mem_cgroup_note_reclaim_priority(sc->mem_cgroup,
                                                         priority);
                 }
 
                 shrink_zone(priority, zone, sc);
+                progress = 1;
         }
+        return progress;
 }
 
 /*
@@ -1774,6 +1791,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
         enum zone_type high_zoneidx = gfp_zone(sc->gfp_mask);
         unsigned long writeback_threshold;
 
+        get_mems_allowed();
         delayacct_freepages_start();
 
         if (scanning_global_lru(sc))
@@ -1795,7 +1813,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                 sc->nr_scanned = 0;
                 if (!priority)
                         disable_swap_token();
-                shrink_zones(priority, zonelist, sc);
+                ret = shrink_zones(priority, zonelist, sc);
                 /*
                  * Don't shrink slabs when reclaiming memory from
                  * over limit cgroups
@@ -1832,7 +1850,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                         congestion_wait(BLK_RW_ASYNC, HZ/10);
         }
         /* top priority shrink_zones still had more to do? don't OOM, then */
-        if (!sc->all_unreclaimable && scanning_global_lru(sc))
+        if (ret && scanning_global_lru(sc))
                 ret = sc->nr_reclaimed;
 out:
         /*
@@ -1857,6 +1875,7 @@ out:
                 mem_cgroup_record_reclaim_priority(sc->mem_cgroup, priority);
 
         delayacct_freepages_end();
+        put_mems_allowed();
 
         return ret;
 }
@@ -1873,7 +1892,6 @@ unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                 .swappiness = vm_swappiness,
                 .order = order,
                 .mem_cgroup = NULL,
-                .isolate_pages = isolate_pages_global,
                 .nodemask = nodemask,
         };
 
@@ -1894,7 +1912,6 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
                 .swappiness = swappiness,
                 .order = 0,
                 .mem_cgroup = mem,
-                .isolate_pages = mem_cgroup_isolate_pages,
         };
         nodemask_t nm  = nodemask_of_node(nid);
 
@@ -1928,7 +1945,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                 .swappiness = swappiness,
                 .order = 0,
                 .mem_cgroup = mem_cont,
-                .isolate_pages = mem_cgroup_isolate_pages,
                 .nodemask = NULL, /* we don't care the placement */
         };
 
@@ -2006,7 +2022,6 @@ static unsigned long balance_pgdat(pg_data_t *pgdat, int order)
                 .swappiness = vm_swappiness,
                 .order = order,
                 .mem_cgroup = NULL,
-                .isolate_pages = isolate_pages_global,
         };
         /*
          * temp_priority is used to remember the scanning priority at which
@@ -2385,7 +2400,6 @@ unsigned long shrink_all_memory(unsigned long nr_to_reclaim)
                 .hibernation_mode = 1,
                 .swappiness = vm_swappiness,
                 .order = 0,
-                .isolate_pages = isolate_pages_global,
         };
         struct zonelist * zonelist = node_zonelist(numa_node_id(), sc.gfp_mask);
         struct task_struct *p = current;
@@ -2570,7 +2584,6 @@ static int __zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                 .gfp_mask = gfp_mask,
                 .swappiness = vm_swappiness,
                 .order = order,
-                .isolate_pages = isolate_pages_global,
         };
         unsigned long slab_reclaimable;
 
diff --git a/mm/vmstat.c b/mm/vmstat.c
index fa12ea3051fb..7759941d4e77 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -16,6 +16,7 @@
 #include <linux/cpu.h>
 #include <linux/vmstat.h>
 #include <linux/sched.h>
+#include <linux/math64.h>
 
 #ifdef CONFIG_VM_EVENT_COUNTERS
 DEFINE_PER_CPU(struct vm_event_state, vm_event_states) = {{0}};
@@ -379,7 +380,86 @@ void zone_statistics(struct zone *preferred_zone, struct zone *z)
 }
 #endif
 
-#ifdef CONFIG_PROC_FS
+#ifdef CONFIG_COMPACTION
+struct contig_page_info {
+        unsigned long free_pages;
+        unsigned long free_blocks_total;
+        unsigned long free_blocks_suitable;
+};
+
+/*
+ * Calculate the number of free pages in a zone, how many contiguous
+ * pages are free and how many are large enough to satisfy an allocation of
+ * the target size. Note that this function makes no attempt to estimate
+ * how many suitable free blocks there *might* be if MOVABLE pages were
+ * migrated. Calculating that is possible, but expensive and can be
+ * figured out from userspace
+ */
+static void fill_contig_page_info(struct zone *zone,
+                                unsigned int suitable_order,
+                                struct contig_page_info *info)
+{
+        unsigned int order;
+
+        info->free_pages = 0;
+        info->free_blocks_total = 0;
+        info->free_blocks_suitable = 0;
+
+        for (order = 0; order < MAX_ORDER; order++) {
+                unsigned long blocks;
+
+                /* Count number of free blocks */
+                blocks = zone->free_area[order].nr_free;
+                info->free_blocks_total += blocks;
+
+                /* Count free base pages */
+                info->free_pages += blocks << order;
+
+                /* Count the suitable free blocks */
+                if (order >= suitable_order)
+                        info->free_blocks_suitable += blocks <<
+                                                (order - suitable_order);
+        }
+}
+
+/*
+ * A fragmentation index only makes sense if an allocation of a requested
+ * size would fail. If that is true, the fragmentation index indicates
+ * whether external fragmentation or a lack of memory was the problem.
+ * The value can be used to determine if page reclaim or compaction
+ * should be used
+ */
+static int __fragmentation_index(unsigned int order, struct contig_page_info *info)
+{
+        unsigned long requested = 1UL << order;
+
+        if (!info->free_blocks_total)
+                return 0;
+
+        /* Fragmentation index only makes sense when a request would fail */
+        if (info->free_blocks_suitable)
+                return -1000;
+
+        /*
+         * Index is between 0 and 1 so return within 3 decimal places
+         *
+         * 0 => allocation would fail due to lack of memory
+         * 1 => allocation would fail due to fragmentation
+         */
+        return 1000 - div_u64( (1000+(div_u64(info->free_pages * 1000ULL, requested))), info->free_blocks_total);
+}
+
+/* Same as __fragmentation index but allocs contig_page_info on stack */
+int fragmentation_index(struct zone *zone, unsigned int order)
+{
+        struct contig_page_info info;
+
+        fill_contig_page_info(zone, order, &info);
+        return __fragmentation_index(order, &info);
+}
+#endif
+
+#if defined(CONFIG_PROC_FS) || defined(CONFIG_COMPACTION)
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
@@ -432,7 +512,9 @@ static void walk_zones_in_node(struct seq_file *m, pg_data_t *pgdat,
                 spin_unlock_irqrestore(&zone->lock, flags);
         }
 }
+#endif
 
+#ifdef CONFIG_PROC_FS
 static void frag_show_print(struct seq_file *m, pg_data_t *pgdat,
                                                 struct zone *zone)
 {
@@ -693,6 +775,16 @@ static const char * const vmstat_text[] = {
         "allocstall",
 
         "pgrotated",
+
+#ifdef CONFIG_COMPACTION
+        "compact_blocks_moved",
+        "compact_pages_moved",
+        "compact_pagemigrate_failed",
+        "compact_stall",
+        "compact_fail",
+        "compact_success",
+#endif
+
 #ifdef CONFIG_HUGETLB_PAGE
         "htlb_buddy_alloc_success",
         "htlb_buddy_alloc_fail",
@@ -954,3 +1046,162 @@ static int __init setup_vmstat(void)
         return 0;
 }
 module_init(setup_vmstat)
+
+#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_COMPACTION)
+#include <linux/debugfs.h>
+
+static struct dentry *extfrag_debug_root;
+
+/*
+ * Return an index indicating how much of the available free memory is
+ * unusable for an allocation of the requested size.
+ */
+static int unusable_free_index(unsigned int order,
+                                struct contig_page_info *info)
+{
+        /* No free memory is interpreted as all free memory is unusable */
+        if (info->free_pages == 0)
+                return 1000;
+
+        /*
+         * Index should be a value between 0 and 1. Return a value to 3
+         * decimal places.
+         *
+         * 0 => no fragmentation
+         * 1 => high fragmentation
+         */
+        return div_u64((info->free_pages - (info->free_blocks_suitable << order)) * 1000ULL, info->free_pages);
+
+}
+
+static void unusable_show_print(struct seq_file *m,
+                                        pg_data_t *pgdat, struct zone *zone)
+{
+        unsigned int order;
+        int index;
+        struct contig_page_info info;
+
+        seq_printf(m, "Node %d, zone %8s ",
+                                pgdat->node_id,
+                                zone->name);
+        for (order = 0; order < MAX_ORDER; ++order) {
+                fill_contig_page_info(zone, order, &info);
+                index = unusable_free_index(order, &info);
+                seq_printf(m, "%d.%03d ", index / 1000, index % 1000);
+        }
+
+        seq_putc(m, '\n');
+}
+
+/*
+ * Display unusable free space index
+ *
+ * The unusable free space index measures how much of the available free
+ * memory cannot be used to satisfy an allocation of a given size and is a
+ * value between 0 and 1. The higher the value, the more of free memory is
+ * unusable and by implication, the worse the external fragmentation is. This
+ * can be expressed as a percentage by multiplying by 100.
+ */
+static int unusable_show(struct seq_file *m, void *arg)
+{
+        pg_data_t *pgdat = (pg_data_t *)arg;
+
+        /* check memoryless node */
+        if (!node_state(pgdat->node_id, N_HIGH_MEMORY))
+                return 0;
+
+        walk_zones_in_node(m, pgdat, unusable_show_print);
+
+        return 0;
+}
+
+static const struct seq_operations unusable_op = {
+        .start  = frag_start,
+        .next   = frag_next,
+        .stop   = frag_stop,
+        .show   = unusable_show,
+};
+
+static int unusable_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &unusable_op);
+}
+
+static const struct file_operations unusable_file_ops = {
+        .open           = unusable_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
+
+static void extfrag_show_print(struct seq_file *m,
+                                        pg_data_t *pgdat, struct zone *zone)
+{
+        unsigned int order;
+        int index;
+
+        /* Alloc on stack as interrupts are disabled for zone walk */
+        struct contig_page_info info;
+
+        seq_printf(m, "Node %d, zone %8s ",
+                                pgdat->node_id,
+                                zone->name);
+        for (order = 0; order < MAX_ORDER; ++order) {
+                fill_contig_page_info(zone, order, &info);
+                index = __fragmentation_index(order, &info);
+                seq_printf(m, "%d.%03d ", index / 1000, index % 1000);
+        }
+
+        seq_putc(m, '\n');
+}
+
+/*
+ * Display fragmentation index for orders that allocations would fail for
+ */
+static int extfrag_show(struct seq_file *m, void *arg)
+{
+        pg_data_t *pgdat = (pg_data_t *)arg;
+
+        walk_zones_in_node(m, pgdat, extfrag_show_print);
+
+        return 0;
+}
+
+static const struct seq_operations extfrag_op = {
+        .start  = frag_start,
+        .next   = frag_next,
+        .stop   = frag_stop,
+        .show   = extfrag_show,
+};
+
+static int extfrag_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &extfrag_op);
+}
+
+static const struct file_operations extfrag_file_ops = {
+        .open           = extfrag_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
+
+static int __init extfrag_debug_init(void)
+{
+        extfrag_debug_root = debugfs_create_dir("extfrag", NULL);
+        if (!extfrag_debug_root)
+                return -ENOMEM;
+
+        if (!debugfs_create_file("unusable_index", 0444,
+                        extfrag_debug_root, NULL, &unusable_file_ops))
+                return -ENOMEM;
+
+        if (!debugfs_create_file("extfrag_index", 0444,
+                        extfrag_debug_root, NULL, &extfrag_file_ops))
+                return -ENOMEM;
+
+        return 0;
+}
+
+module_init(extfrag_debug_init);
+#endif