20 files changed, 258 insertions, 178 deletions
diff --git a/mm/Kconfig b/mm/Kconfig
index f4e516e9c37c..f0fb9124e410 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -189,7 +189,7 @@ config COMPACTION
 config MIGRATION
        bool "Page migration"
        def_bool y
-        depends on NUMA || ARCH_ENABLE_MEMORY_HOTREMOVE
+        depends on NUMA || ARCH_ENABLE_MEMORY_HOTREMOVE || COMPACTION
        help
          Allows the migration of the physical location of pages of processes
          while the virtual addresses are not changed. This is useful in
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index eaa4a5bbe063..65d420499a61 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -30,6 +30,7 @@ EXPORT_SYMBOL_GPL(default_backing_dev_info);
 struct backing_dev_info noop_backing_dev_info = {
        .name           = "noop",
+        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 EXPORT_SYMBOL_GPL(noop_backing_dev_info);
@@ -243,6 +244,7 @@ static int __init default_bdi_init(void)
        err = bdi_init(&default_backing_dev_info);
        if (!err)
                bdi_register(&default_backing_dev_info, NULL, "default");
+        err = bdi_init(&noop_backing_dev_info);
        return err;
 }
@@ -445,8 +447,8 @@ static int bdi_forker_thread(void *ptr)
                switch (action) {
                case FORK_THREAD:
                        __set_current_state(TASK_RUNNING);
-                        task = kthread_run(bdi_writeback_thread, &bdi->wb, "flush-%s",
+                        task = kthread_create(bdi_writeback_thread, &bdi->wb,
-                                           dev_name(bdi->dev));
+                                              "flush-%s", dev_name(bdi->dev));
                        if (IS_ERR(task)) {
                                /*
                                 * If thread creation fails, force writeout of
@@ -457,10 +459,13 @@ static int bdi_forker_thread(void *ptr)
                                /*
                                 * The spinlock makes sure we do not lose
                                 * wake-ups when racing with 'bdi_queue_work()'.
+                                 * And as soon as the bdi thread is visible, we
+                                 * can start it.
                                 */
                                spin_lock_bh(&bdi->wb_lock);
                                bdi->wb.task = task;
                                spin_unlock_bh(&bdi->wb_lock);
+                                wake_up_process(task);
                        }
                        break;
diff --git a/mm/bounce.c b/mm/bounce.c
index 13b6dad1eed2..1481de68184b 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -116,8 +116,8 @@ static void copy_to_high_bio_irq(struct bio *to, struct bio *from)
                 */
                vfrom = page_address(fromvec->bv_page) + tovec->bv_offset;
-                flush_dcache_page(tovec->bv_page);
                bounce_copy_vec(tovec, vfrom);
+                flush_dcache_page(tovec->bv_page);
        }
 }
diff --git a/mm/compaction.c b/mm/compaction.c
index 94cce51b0b35..4d709ee59013 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -214,15 +214,16 @@ static void acct_isolated(struct zone *zone, struct compact_control *cc)
 /* Similar to reclaim, but different enough that they don't share logic */
 static bool too_many_isolated(struct zone *zone)
 {
+        unsigned long active, inactive, isolated;
-        unsigned long inactive, isolated;
        inactive = zone_page_state(zone, NR_INACTIVE_FILE) +
                                        zone_page_state(zone, NR_INACTIVE_ANON);
+        active = zone_page_state(zone, NR_ACTIVE_FILE) +
+                                        zone_page_state(zone, NR_ACTIVE_ANON);
        isolated = zone_page_state(zone, NR_ISOLATED_FILE) +
                                        zone_page_state(zone, NR_ISOLATED_ANON);
-        return isolated > inactive;
+        return isolated > (inactive + active) / 2;
 }
 /*
diff --git a/mm/fremap.c b/mm/fremap.c
index 46f5dacf90a2..ec520c7b28df 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -125,7 +125,6 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
 {
        struct mm_struct *mm = current->mm;
        struct address_space *mapping;
-        unsigned long end = start + size;
        struct vm_area_struct *vma;
        int err = -EINVAL;
        int has_write_lock = 0;
@@ -142,6 +141,10 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
        if (start + size <= start)
                return err;
+        /* Does pgoff wrap? */
+        if (pgoff + (size >> PAGE_SHIFT) < pgoff)
+                return err;
        /* Can we represent this offset inside this architecture's pte's? */
 #if PTE_FILE_MAX_BITS < BITS_PER_LONG
        if (pgoff + (size >> PAGE_SHIFT) >= (1UL << PTE_FILE_MAX_BITS))
@@ -168,7 +171,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
        if (!(vma->vm_flags & VM_CAN_NONLINEAR))
                goto out;
-        if (end <= start || start < vma->vm_start || end > vma->vm_end)
+        if (start < vma->vm_start || start + size > vma->vm_end)
                goto out;
        /* Must set VM_NONLINEAR before any pages are populated. */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index cc5be788a39f..c03273807182 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2324,11 +2324,8 @@ retry_avoidcopy:
         * and just make the page writable */
        avoidcopy = (page_mapcount(old_page) == 1);
        if (avoidcopy) {
-                if (!trylock_page(old_page)) {
+                if (PageAnon(old_page))
-                        if (PageAnon(old_page))
+                        page_move_anon_rmap(old_page, vma, address);
-                                page_move_anon_rmap(old_page, vma, address);
-                } else
-                        unlock_page(old_page);
                set_huge_ptep_writable(vma, address, ptep);
                return 0;
        }
@@ -2404,7 +2401,7 @@ retry_avoidcopy:
                set_huge_pte_at(mm, address, ptep,
                                make_huge_pte(vma, new_page, 1));
                page_remove_rmap(old_page);
-                hugepage_add_anon_rmap(new_page, vma, address);
+                hugepage_add_new_anon_rmap(new_page, vma, address);
                /* Make the old page be freed below */
                new_page = old_page;
                mmu_notifier_invalidate_range_end(mm,
@@ -2631,10 +2628,16 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                                                                vma, address);
        }
-        if (!pagecache_page) {
+        /*
-                page = pte_page(entry);
+         * hugetlb_cow() requires page locks of pte_page(entry) and
+         * pagecache_page, so here we need take the former one
+         * when page != pagecache_page or !pagecache_page.
+         * Note that locking order is always pagecache_page -> page,
+         * so no worry about deadlock.
+         */
+        page = pte_page(entry);
+        if (page != pagecache_page)
                lock_page(page);
-        }
        spin_lock(&mm->page_table_lock);
        /* Check for a racing update before calling hugetlb_cow */
@@ -2661,9 +2664,8 @@ out_page_table_lock:
        if (pagecache_page) {
                unlock_page(pagecache_page);
                put_page(pagecache_page);
-        } else {
-                unlock_page(page);
        }
+        unlock_page(page);
 out_mutex:
        mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/ksm.c b/mm/ksm.c
index e2ae00458320..b1873cf03ed9 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1504,8 +1504,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
 {
        struct page *new_page;
-        unlock_page(page);      /* any racers will COW it, not modify it */
        new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
        if (new_page) {
                copy_user_highpage(new_page, page, address, vma);
@@ -1521,7 +1519,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
                        add_page_to_unevictable_list(new_page);
        }
-        page_cache_release(page);
        return new_page;
 }
diff --git a/mm/memory.c b/mm/memory.c
index 6b2ab1051851..0e18b4d649ec 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2623,7 +2623,7 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
                unsigned int flags, pte_t orig_pte)
 {
        spinlock_t *ptl;
-        struct page *page;
+        struct page *page, *swapcache = NULL;
        swp_entry_t entry;
        pte_t pte;
        struct mem_cgroup *ptr = NULL;
@@ -2679,10 +2679,25 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
        lock_page(page);
        delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
-        page = ksm_might_need_to_copy(page, vma, address);
+        /*
-        if (!page) {
+         * Make sure try_to_free_swap or reuse_swap_page or swapoff did not
-                ret = VM_FAULT_OOM;
+         * release the swapcache from under us.  The page pin, and pte_same
-                goto out;
+         * test below, are not enough to exclude that.  Even if it is still
+         * swapcache, we need to check that the page's swap has not changed.
+         */
+        if (unlikely(!PageSwapCache(page) || page_private(page) != entry.val))
+                goto out_page;
+        if (ksm_might_need_to_copy(page, vma, address)) {
+                swapcache = page;
+                page = ksm_does_need_to_copy(page, vma, address);
+                if (unlikely(!page)) {
+                        ret = VM_FAULT_OOM;
+                        page = swapcache;
+                        swapcache = NULL;
+                        goto out_page;
+                }
        }
        if (mem_cgroup_try_charge_swapin(mm, page, GFP_KERNEL, &ptr)) {
@@ -2735,6 +2750,18 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
        if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
                try_to_free_swap(page);
        unlock_page(page);
+        if (swapcache) {
+                /*
+                 * Hold the lock to avoid the swap entry to be reused
+                 * until we take the PT lock for the pte_same() check
+                 * (to avoid false positives from pte_same). For
+                 * further safety release the lock after the swap_free
+                 * so that the swap count won't change under a
+                 * parallel locked swapcache.
+                 */
+                unlock_page(swapcache);
+                page_cache_release(swapcache);
+        }
        if (flags & FAULT_FLAG_WRITE) {
                ret |= do_wp_page(mm, vma, address, page_table, pmd, ptl, pte);
@@ -2756,6 +2783,10 @@ out_page:
        unlock_page(page);
 out_release:
        page_cache_release(page);
+        if (swapcache) {
+                unlock_page(swapcache);
+                page_cache_release(swapcache);
+        }
        return ret;
 }
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a4cfcdc00455..dd186c1a5d53 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -584,19 +584,19 @@ static inline int pageblock_free(struct page *page)
 /* Return the start of the next active pageblock after a given page */
 static struct page *next_active_pageblock(struct page *page)
 {
-        int pageblocks_stride;
        /* Ensure the starting page is pageblock-aligned */
        BUG_ON(page_to_pfn(page) & (pageblock_nr_pages - 1));
-        /* Move forward by at least 1 * pageblock_nr_pages */
-        pageblocks_stride = 1;
        /* If the entire pageblock is free, move to the end of free page */
-        if (pageblock_free(page))
+        if (pageblock_free(page)) {
-                pageblocks_stride += page_order(page) - pageblock_order;
+                int order;
+                /* be careful. we don't have locks, page_order can be changed.*/
+                order = page_order(page);
+                if ((order < MAX_ORDER) && (order >= pageblock_order))
+                        return page + (1 << order);
+        }
-        return page + (pageblocks_stride * pageblock_nr_pages);
+        return page + pageblock_nr_pages;
 }
 /* Checks if this range of memory is likely to be hot-removable. */
diff --git a/mm/mlock.c b/mm/mlock.c
index cbae7c5b9568..b70919ce4f72 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -135,12 +135,6 @@ void munlock_vma_page(struct page *page)
        }
 }
-/* Is the vma a continuation of the stack vma above it? */
-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
-{
-        return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-}
 static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
 {
        return (vma->vm_flags & VM_GROWSDOWN) &&
diff --git a/mm/mmap.c b/mm/mmap.c
index 6128dc8e5ede..00161a48a451 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2009,6 +2009,7 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
                        removed_exe_file_vma(mm);
                fput(new->vm_file);
        }
+        unlink_anon_vmas(new);
 out_free_mpol:
        mpol_put(pol);
 out_free_vma:
diff --git a/mm/mmzone.c b/mm/mmzone.c
index f5b7d1760213..e35bfb82c855 100644
--- a/mm/mmzone.c
+++ b/mm/mmzone.c
@@ -87,3 +87,24 @@ int memmap_valid_within(unsigned long pfn,
        return 1;
 }
 #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
+#ifdef CONFIG_SMP
+/* Called when a more accurate view of NR_FREE_PAGES is needed */
+unsigned long zone_nr_free_pages(struct zone *zone)
+{
+        unsigned long nr_free_pages = zone_page_state(zone, NR_FREE_PAGES);
+        /*
+         * While kswapd is awake, it is considered the zone is under some
+         * memory pressure. Under pressure, there is a risk that
+         * per-cpu-counter-drift will allow the min watermark to be breached
+         * potentially causing a live-lock. While kswapd is awake and
+         * free pages are low, get a better estimate for free pages
+         */
+        if (nr_free_pages < zone->percpu_drift_mark &&
+                        !waitqueue_active(&zone->zone_pgdat->kswapd_wait))
+                return zone_page_state_snapshot(zone, NR_FREE_PAGES);
+        return nr_free_pages;
+}
+#endif /* CONFIG_SMP */
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index fc81cb22869e..4029583a1024 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -121,8 +121,8 @@ struct task_struct *find_lock_task_mm(struct task_struct *p)
 }
 /* return true if the task is not adequate as candidate victim task. */
-static bool oom_unkillable_task(struct task_struct *p, struct mem_cgroup *mem,
+static bool oom_unkillable_task(struct task_struct *p,
-                           const nodemask_t *nodemask)
+                const struct mem_cgroup *mem, const nodemask_t *nodemask)
 {
        if (is_global_init(p))
                return true;
@@ -208,8 +208,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
         */
        points += p->signal->oom_score_adj;
-        if (points < 0)
+        /*
-                return 0;
+         * Never return 0 for an eligible task that may be killed since it's
+         * possible that no single user task uses more than 0.1% of memory and
+         * no single admin tasks uses more than 3.0%.
+         */
+        if (points <= 0)
+                return 1;
        return (points < 1000) ? points : 1000;
 }
@@ -339,26 +344,24 @@ static struct task_struct *select_bad_process(unsigned int *ppoints,
 /**
 * dump_tasks - dump current memory state of all system tasks
 * @mem: current's memory controller, if constrained
+ * @nodemask: nodemask passed to page allocator for mempolicy ooms
 *
- * Dumps the current memory state of all system tasks, excluding kernel threads.
+ * Dumps the current memory state of all eligible tasks.  Tasks not in the same
+ * memcg, not in the same cpuset, or bound to a disjoint set of mempolicy nodes
+ * are not shown.
 * State information includes task's pid, uid, tgid, vm size, rss, cpu, oom_adj
 * value, oom_score_adj value, and name.
 *
- * If the actual is non-NULL, only tasks that are a member of the mem_cgroup are
- * shown.
- *
 * Call with tasklist_lock read-locked.
 */
-static void dump_tasks(const struct mem_cgroup *mem)
+static void dump_tasks(const struct mem_cgroup *mem, const nodemask_t *nodemask)
 {
        struct task_struct *p;
        struct task_struct *task;
        pr_info("[ pid ]   uid  tgid total_vm      rss cpu oom_adj oom_score_adj name\n");
        for_each_process(p) {
-                if (p->flags & PF_KTHREAD)
+                if (oom_unkillable_task(p, mem, nodemask))
-                        continue;
-                if (mem && !task_in_mem_cgroup(p, mem))
                        continue;
                task = find_lock_task_mm(p);
@@ -381,7 +384,7 @@ static void dump_tasks(const struct mem_cgroup *mem)
 }
 static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,
-                                                        struct mem_cgroup *mem)
+                        struct mem_cgroup *mem, const nodemask_t *nodemask)
 {
        task_lock(current);
        pr_warning("%s invoked oom-killer: gfp_mask=0x%x, order=%d, "
@@ -394,7 +397,7 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,
        mem_cgroup_print_oom_info(mem, p);
        show_mem();
        if (sysctl_oom_dump_tasks)
-                dump_tasks(mem);
+                dump_tasks(mem, nodemask);
 }
 #define K(x) ((x) << (PAGE_SHIFT-10))
@@ -436,7 +439,7 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
        unsigned int victim_points = 0;
        if (printk_ratelimit())
-                dump_header(p, gfp_mask, order, mem);
+                dump_header(p, gfp_mask, order, mem, nodemask);
        /*
         * If the task is already exiting, don't alarm the sysadmin or kill
@@ -482,7 +485,7 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
 * Determines whether the kernel must panic because of the panic_on_oom sysctl.
 */
 static void check_panic_on_oom(enum oom_constraint constraint, gfp_t gfp_mask,
-                                int order)
+                                int order, const nodemask_t *nodemask)
 {
        if (likely(!sysctl_panic_on_oom))
                return;
@@ -496,7 +499,7 @@ static void check_panic_on_oom(enum oom_constraint constraint, gfp_t gfp_mask,
                        return;
        }
        read_lock(&tasklist_lock);
-        dump_header(NULL, gfp_mask, order, NULL);
+        dump_header(NULL, gfp_mask, order, NULL, nodemask);
        read_unlock(&tasklist_lock);
        panic("Out of memory: %s panic_on_oom is enabled\n",
                sysctl_panic_on_oom == 2 ? "compulsory" : "system-wide");
@@ -509,7 +512,7 @@ void mem_cgroup_out_of_memory(struct mem_cgroup *mem, gfp_t gfp_mask)
        unsigned int points = 0;
        struct task_struct *p;
-        check_panic_on_oom(CONSTRAINT_MEMCG, gfp_mask, 0);
+        check_panic_on_oom(CONSTRAINT_MEMCG, gfp_mask, 0, NULL);
        limit = mem_cgroup_get_limit(mem) >> PAGE_SHIFT;
        read_lock(&tasklist_lock);
 retry:
@@ -641,6 +644,7 @@ static void clear_system_oom(void)
 void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
                int order, nodemask_t *nodemask)
 {
+        const nodemask_t *mpol_mask;
        struct task_struct *p;
        unsigned long totalpages;
        unsigned long freed = 0;
@@ -670,7 +674,8 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
         */
        constraint = constrained_alloc(zonelist, gfp_mask, nodemask,
                                                &totalpages);
-        check_panic_on_oom(constraint, gfp_mask, order);
+        mpol_mask = (constraint == CONSTRAINT_MEMORY_POLICY) ? nodemask : NULL;
+        check_panic_on_oom(constraint, gfp_mask, order, mpol_mask);
        read_lock(&tasklist_lock);
        if (sysctl_oom_kill_allocating_task &&
@@ -688,15 +693,13 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
        }
 retry:
-        p = select_bad_process(&points, totalpages, NULL,
+        p = select_bad_process(&points, totalpages, NULL, mpol_mask);
-                        constraint == CONSTRAINT_MEMORY_POLICY ? nodemask :
-                                                                 NULL);
        if (PTR_ERR(p) == -1UL)
                goto out;
        /* Found nothing?!?! Either we hang forever, or we panic. */
        if (!p) {
-                dump_header(NULL, gfp_mask, order, NULL);
+                dump_header(NULL, gfp_mask, order, NULL, mpol_mask);
                read_unlock(&tasklist_lock);
                panic("Out of memory and no killable processes...\n");
        }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a9649f4b261e..a8cfa9cc6e86 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -588,13 +588,13 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 {
        int migratetype = 0;
        int batch_free = 0;
+        int to_free = count;
        spin_lock(&zone->lock);
        zone->all_unreclaimable = 0;
        zone->pages_scanned = 0;
-        __mod_zone_page_state(zone, NR_FREE_PAGES, count);
+        while (to_free) {
-        while (count) {
                struct page *page;
                struct list_head *list;
@@ -619,8 +619,9 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                        /* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */
                        __free_one_page(page, zone, 0, page_private(page));
                        trace_mm_page_pcpu_drain(page, 0, page_private(page));
-                } while (--count && --batch_free && !list_empty(list));
+                } while (--to_free && --batch_free && !list_empty(list));
        }
+        __mod_zone_page_state(zone, NR_FREE_PAGES, count);
        spin_unlock(&zone->lock);
 }
@@ -631,8 +632,8 @@ static void free_one_page(struct zone *zone, struct page *page, int order,
        zone->all_unreclaimable = 0;
        zone->pages_scanned = 0;
-        __mod_zone_page_state(zone, NR_FREE_PAGES, 1 << order);
        __free_one_page(page, zone, order, migratetype);
+        __mod_zone_page_state(zone, NR_FREE_PAGES, 1 << order);
        spin_unlock(&zone->lock);
 }
@@ -1461,7 +1462,7 @@ int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
 {
        /* free_pages my go negative - that's OK */
        long min = mark;
-        long free_pages = zone_page_state(z, NR_FREE_PAGES) - (1 << order) + 1;
+        long free_pages = zone_nr_free_pages(z) - (1 << order) + 1;
        int o;
        if (alloc_flags & ALLOC_HIGH)
@@ -1846,6 +1847,7 @@ __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order,
        struct page *page = NULL;
        struct reclaim_state reclaim_state;
        struct task_struct *p = current;
+        bool drained = false;
        cond_resched();
@@ -1864,14 +1866,25 @@ __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order,
        cond_resched();
-        if (order != 0)
+        if (unlikely(!(*did_some_progress)))
-                drain_all_pages();
+                return NULL;
-        if (likely(*did_some_progress))
+retry:
-                page = get_page_from_freelist(gfp_mask, nodemask, order,
+        page = get_page_from_freelist(gfp_mask, nodemask, order,
                                        zonelist, high_zoneidx,
                                        alloc_flags, preferred_zone,
                                        migratetype);
+        /*
+         * If an allocation failed after direct reclaim, it could be because
+         * pages are pinned on the per-cpu lists. Drain them and try again
+         */
+        if (!page && !drained) {
+                drain_all_pages();
+                drained = true;
+                goto retry;
+        }
        return page;
 }
@@ -2423,7 +2436,7 @@ void show_free_areas(void)
                        " all_unreclaimable? %s"
                        "\n",
                        zone->name,
-                        K(zone_page_state(zone, NR_FREE_PAGES)),
+                        K(zone_nr_free_pages(zone)),
                        K(min_wmark_pages(zone)),
                        K(low_wmark_pages(zone)),
                        K(high_wmark_pages(zone)),
diff --git a/mm/percpu.c b/mm/percpu.c
index e61dc2cc5873..c76ef3891e0d 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -393,7 +393,9 @@ static int pcpu_extend_area_map(struct pcpu_chunk *chunk, int new_alloc)
                goto out_unlock;
        old_size = chunk->map_alloc * sizeof(chunk->map[0]);
-        memcpy(new, chunk->map, old_size);
+        old = chunk->map;
+        memcpy(new, old, old_size);
        chunk->map_alloc = new_alloc;
        chunk->map = new;
@@ -1162,7 +1164,7 @@ static struct pcpu_alloc_info * __init pcpu_build_alloc_info(
                }
                /*
-                 * Don't accept if wastage is over 25%.  The
+                 * Don't accept if wastage is over 1/3.  The
                 * greater-than comparison ensures upa==1 always
                 * passes the following check.
                 */
@@ -1399,9 +1401,9 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
                        if (pcpu_first_unit_cpu == NR_CPUS)
                                pcpu_first_unit_cpu = cpu;
+                        pcpu_last_unit_cpu = cpu;
                }
        }
-        pcpu_last_unit_cpu = cpu;
        pcpu_nr_units = unit;
        for_each_possible_cpu(cpu)
diff --git a/mm/percpu_up.c b/mm/percpu_up.c
index c4351c7f57d2..db884fae5721 100644
--- a/mm/percpu_up.c
+++ b/mm/percpu_up.c
@@ -14,13 +14,13 @@ void __percpu *__alloc_percpu(size_t size, size_t align)
         * percpu sections on SMP for which this path isn't used.
         */
        WARN_ON_ONCE(align > SMP_CACHE_BYTES);
-        return kzalloc(size, GFP_KERNEL);
+        return (void __percpu __force *)kzalloc(size, GFP_KERNEL);
 }
 EXPORT_SYMBOL_GPL(__alloc_percpu);
 void free_percpu(void __percpu *p)
 {
-        kfree(p);
+        kfree(this_cpu_ptr(p));
 }
 EXPORT_SYMBOL_GPL(free_percpu);
diff --git a/mm/rmap.c b/mm/rmap.c
index f6f0d2dda2ea..9d2ba01bd4f9 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1564,13 +1564,14 @@ static void __hugepage_set_anon_rmap(struct page *page,
        struct vm_area_struct *vma, unsigned long address, int exclusive)
 {
        struct anon_vma *anon_vma = vma->anon_vma;
        BUG_ON(!anon_vma);
-        if (!exclusive) {
-                struct anon_vma_chain *avc;
+        if (PageAnon(page))
-                avc = list_entry(vma->anon_vma_chain.prev,
+                return;
-                                 struct anon_vma_chain, same_vma);
+        if (!exclusive)
-                anon_vma = avc->anon_vma;
+                anon_vma = anon_vma->root;
-        }
        anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
        page->mapping = (struct address_space *) anon_vma;
        page->index = linear_page_index(vma, address);
@@ -1581,6 +1582,8 @@ void hugepage_add_anon_rmap(struct page *page,
 {
        struct anon_vma *anon_vma = vma->anon_vma;
        int first;
+        BUG_ON(!PageLocked(page));
        BUG_ON(!anon_vma);
        BUG_ON(address < vma->vm_start || address >= vma->vm_end);
        first = atomic_inc_and_test(&page->_mapcount);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 1f3f9c59a73a..7c703ff2f36f 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -47,8 +47,6 @@ long nr_swap_pages;
 long total_swap_pages;
 static int least_priority;
-static bool swap_for_hibernation;
 static const char Bad_file[] = "Bad swap file entry ";
 static const char Unused_file[] = "Unused swap file entry ";
 static const char Bad_offset[] = "Bad swap offset entry ";
@@ -141,8 +139,7 @@ static int discard_swap(struct swap_info_struct *si)
        nr_blocks = ((sector_t)se->nr_pages - 1) << (PAGE_SHIFT - 9);
        if (nr_blocks) {
                err = blkdev_issue_discard(si->bdev, start_block,
-                                nr_blocks, GFP_KERNEL,
+                                nr_blocks, GFP_KERNEL, BLKDEV_IFL_WAIT);
-                                BLKDEV_IFL_WAIT | BLKDEV_IFL_BARRIER);
                if (err)
                        return err;
                cond_resched();
@@ -153,8 +150,7 @@ static int discard_swap(struct swap_info_struct *si)
                nr_blocks = (sector_t)se->nr_pages << (PAGE_SHIFT - 9);
                err = blkdev_issue_discard(si->bdev, start_block,
-                                nr_blocks, GFP_KERNEL,
+                                nr_blocks, GFP_KERNEL, BLKDEV_IFL_WAIT);
-                                BLKDEV_IFL_WAIT | BLKDEV_IFL_BARRIER);
                if (err)
                        break;
@@ -193,8 +189,7 @@ static void discard_swap_cluster(struct swap_info_struct *si,
                        start_block <<= PAGE_SHIFT - 9;
                        nr_blocks <<= PAGE_SHIFT - 9;
                        if (blkdev_issue_discard(si->bdev, start_block,
-                                    nr_blocks, GFP_NOIO, BLKDEV_IFL_WAIT |
+                                    nr_blocks, GFP_NOIO, BLKDEV_IFL_WAIT))
-                                                        BLKDEV_IFL_BARRIER))
                                break;
                }
@@ -320,10 +315,8 @@ checks:
        if (offset > si->highest_bit)
                scan_base = offset = si->lowest_bit;
-        /* reuse swap entry of cache-only swap if not hibernation. */
+        /* reuse swap entry of cache-only swap if not busy. */
-        if (vm_swap_full()
+        if (vm_swap_full() && si->swap_map[offset] == SWAP_HAS_CACHE) {
-                && usage == SWAP_HAS_CACHE
-                && si->swap_map[offset] == SWAP_HAS_CACHE) {
                int swap_was_freed;
                spin_unlock(&swap_lock);
                swap_was_freed = __try_to_reclaim_swap(si, offset);
@@ -453,8 +446,6 @@ swp_entry_t get_swap_page(void)
        spin_lock(&swap_lock);
        if (nr_swap_pages <= 0)
                goto noswap;
-        if (swap_for_hibernation)
-                goto noswap;
        nr_swap_pages--;
        for (type = swap_list.next; type >= 0 && wrapped < 2; type = next) {
@@ -487,6 +478,28 @@ noswap:
        return (swp_entry_t) {0};
 }
+/* The only caller of this function is now susupend routine */
+swp_entry_t get_swap_page_of_type(int type)
+{
+        struct swap_info_struct *si;
+        pgoff_t offset;
+        spin_lock(&swap_lock);
+        si = swap_info[type];
+        if (si && (si->flags & SWP_WRITEOK)) {
+                nr_swap_pages--;
+                /* This is called for allocating swap entry, not cache */
+                offset = scan_swap_map(si, 1);
+                if (offset) {
+                        spin_unlock(&swap_lock);
+                        return swp_entry(type, offset);
+                }
+                nr_swap_pages++;
+        }
+        spin_unlock(&swap_lock);
+        return (swp_entry_t) {0};
+}
 static struct swap_info_struct *swap_info_get(swp_entry_t entry)
 {
        struct swap_info_struct *p;
@@ -670,6 +683,24 @@ int try_to_free_swap(struct page *page)
        if (page_swapcount(page))
                return 0;
+        /*
+         * Once hibernation has begun to create its image of memory,
+         * there's a danger that one of the calls to try_to_free_swap()
+         * - most probably a call from __try_to_reclaim_swap() while
+         * hibernation is allocating its own swap pages for the image,
+         * but conceivably even a call from memory reclaim - will free
+         * the swap from a page which has already been recorded in the
+         * image as a clean swapcache page, and then reuse its swap for
+         * another page of the image.  On waking from hibernation, the
+         * original page might be freed under memory pressure, then
+         * later read back in from swap, now with the wrong data.
+         *
+         * Hibernation clears bits from gfp_allowed_mask to prevent
+         * memory reclaim from writing to disk, so check that here.
+         */
+        if (!(gfp_allowed_mask & __GFP_IO))
+                return 0;
        delete_from_swap_cache(page);
        SetPageDirty(page);
        return 1;
@@ -746,74 +777,6 @@ int mem_cgroup_count_swap_user(swp_entry_t ent, struct page **pagep)
 #endif
 #ifdef CONFIG_HIBERNATION
-static pgoff_t hibernation_offset[MAX_SWAPFILES];
-/*
- * Once hibernation starts to use swap, we freeze swap_map[]. Otherwise,
- * saved swap_map[] image to the disk will be an incomplete because it's
- * changing without synchronization with hibernation snap shot.
- * At resume, we just make swap_for_hibernation=false. We can forget
- * used maps easily.
- */
-void hibernation_freeze_swap(void)
-{
-        int i;
-        spin_lock(&swap_lock);
-        printk(KERN_INFO "PM: Freeze Swap\n");
-        swap_for_hibernation = true;
-        for (i = 0; i < MAX_SWAPFILES; i++)
-                hibernation_offset[i] = 1;
-        spin_unlock(&swap_lock);
-}
-void hibernation_thaw_swap(void)
-{
-        spin_lock(&swap_lock);
-        if (swap_for_hibernation) {
-                printk(KERN_INFO "PM: Thaw Swap\n");
-                swap_for_hibernation = false;
-        }
-        spin_unlock(&swap_lock);
-}
-/*
- * Because updateing swap_map[] can make not-saved-status-change,
- * we use our own easy allocator.
- * Please see kernel/power/swap.c, Used swaps are recorded into
- * RB-tree.
- */
-swp_entry_t get_swap_for_hibernation(int type)
-{
-        pgoff_t off;
-        swp_entry_t val = {0};
-        struct swap_info_struct *si;
-        spin_lock(&swap_lock);
-        si = swap_info[type];
-        if (!si || !(si->flags & SWP_WRITEOK))
-                goto done;
-        for (off = hibernation_offset[type]; off < si->max; ++off) {
-                if (!si->swap_map[off])
-                        break;
-        }
-        if (off < si->max) {
-                val = swp_entry(type, off);
-                hibernation_offset[type] = off + 1;
-        }
-done:
-        spin_unlock(&swap_lock);
-        return val;
-}
-void swap_free_for_hibernation(swp_entry_t ent)
-{
-        /* Nothing to do */
-}
 /*
 * Find the swap type that corresponds to given device (if any).
 *
@@ -2084,7 +2047,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
                        p->flags |= SWP_SOLIDSTATE;
                        p->cluster_next = 1 + (random32() % p->highest_bit);
                }
-                if (discard_swap(p) == 0)
+                if (discard_swap(p) == 0 && (swap_flags & SWAP_FLAG_DISCARD))
                        p->flags |= SWP_DISCARDABLE;
        }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c391c320dbaf..c5dfabf25f11 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1804,12 +1804,11 @@ static void shrink_zone(int priority, struct zone *zone,
 * If a zone is deemed to be full of pinned pages then just give it a light
 * scan then give up on it.
 */
-static bool shrink_zones(int priority, struct zonelist *zonelist,
+static void shrink_zones(int priority, struct zonelist *zonelist,
                                        struct scan_control *sc)
 {
        struct zoneref *z;
        struct zone *zone;
-        bool all_unreclaimable = true;
        for_each_zone_zonelist_nodemask(zone, z, zonelist,
                                        gfp_zone(sc->gfp_mask), sc->nodemask) {
@@ -1827,8 +1826,38 @@ static bool shrink_zones(int priority, struct zonelist *zonelist,
                }
                shrink_zone(priority, zone, sc);
-                all_unreclaimable = false;
        }
+}
+static bool zone_reclaimable(struct zone *zone)
+{
+        return zone->pages_scanned < zone_reclaimable_pages(zone) * 6;
+}
+/*
+ * As hibernation is going on, kswapd is freezed so that it can't mark
+ * the zone into all_unreclaimable. It can't handle OOM during hibernation.
+ * So let's check zone's unreclaimable in direct reclaim as well as kswapd.
+ */
+static bool all_unreclaimable(struct zonelist *zonelist,
+                struct scan_control *sc)
+{
+        struct zoneref *z;
+        struct zone *zone;
+        bool all_unreclaimable = true;
+        for_each_zone_zonelist_nodemask(zone, z, zonelist,
+                        gfp_zone(sc->gfp_mask), sc->nodemask) {
+                if (!populated_zone(zone))
+                        continue;
+                if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
+                        continue;
+                if (zone_reclaimable(zone)) {
+                        all_unreclaimable = false;
+                        break;
+                }
+        }
        return all_unreclaimable;
 }
@@ -1852,7 +1881,6 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                                        struct scan_control *sc)
 {
        int priority;
-        bool all_unreclaimable;
        unsigned long total_scanned = 0;
        struct reclaim_state *reclaim_state = current->reclaim_state;
        struct zoneref *z;
@@ -1869,7 +1897,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                sc->nr_scanned = 0;
                if (!priority)
                        disable_swap_token();
-                all_unreclaimable = shrink_zones(priority, zonelist, sc);
+                shrink_zones(priority, zonelist, sc);
                /*
                 * Don't shrink slabs when reclaiming memory from
                 * over limit cgroups
@@ -1931,7 +1959,7 @@ out:
                return sc->nr_reclaimed;
        /* top priority shrink_zones still had more to do? don't OOM, then */
-        if (scanning_global_lru(sc) && !all_unreclaimable)
+        if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc))
                return 1;
        return 0;
@@ -2197,8 +2225,7 @@ loop_again:
                        total_scanned += sc.nr_scanned;
                        if (zone->all_unreclaimable)
                                continue;
-                        if (nr_slab == 0 &&
+                        if (nr_slab == 0 && !zone_reclaimable(zone))
-                            zone->pages_scanned >= (zone_reclaimable_pages(zone) * 6))
                                zone->all_unreclaimable = 1;
                        /*
                         * If we've done a decent amount of scanning and
diff --git a/mm/vmstat.c b/mm/vmstat.c
index f389168f9a83..355a9e669aaa 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -138,11 +138,24 @@ static void refresh_zone_stat_thresholds(void)
        int threshold;
        for_each_populated_zone(zone) {
+                unsigned long max_drift, tolerate_drift;
                threshold = calculate_threshold(zone);
                for_each_online_cpu(cpu)
                        per_cpu_ptr(zone->pageset, cpu)->stat_threshold
                                                        = threshold;
+                /*
+                 * Only set percpu_drift_mark if there is a danger that
+                 * NR_FREE_PAGES reports the low watermark is ok when in fact
+                 * the min watermark could be breached by an allocation
+                 */
+                tolerate_drift = low_wmark_pages(zone) - min_wmark_pages(zone);
+                max_drift = num_online_cpus() * threshold;
+                if (max_drift > tolerate_drift)
+                        zone->percpu_drift_mark = high_wmark_pages(zone) +
+                                        max_drift;
        }
 }
@@ -813,7 +826,7 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
                   "\n        scanned  %lu"
                   "\n        spanned  %lu"
                   "\n        present  %lu",
-                   zone_page_state(zone, NR_FREE_PAGES),
+                   zone_nr_free_pages(zone),
                   min_wmark_pages(zone),
                   low_wmark_pages(zone),
                   high_wmark_pages(zone),
@@ -998,6 +1011,7 @@ static int __cpuinit vmstat_cpuup_callback(struct notifier_block *nfb,
        switch (action) {
        case CPU_ONLINE:
        case CPU_ONLINE_FROZEN:
+                refresh_zone_stat_thresholds();
                start_cpu_timer(cpu);
                node_set_state(cpu_to_node(cpu), N_CPU);
                break;