12 files changed, 79 insertions, 55 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index edd300aca173..f791196cee8c 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -67,7 +67,7 @@ config DISCONTIGMEM
 
 config SPARSEMEM
         def_bool y
-        depends on SPARSEMEM_MANUAL
+        depends on (!SELECT_MEMORY_MODEL && ARCH_SPARSEMEM_ENABLE) || SPARSEMEM_MANUAL
 
 config FLATMEM
         def_bool y
@@ -224,7 +224,9 @@ config KSM
           the many instances by a single resident page with that content, so
           saving memory until one or another app needs to modify the content.
           Recommended for use with KVM, or with other duplicative applications.
-          See Documentation/vm/ksm.txt for more information.
+          See Documentation/vm/ksm.txt for more information: KSM is inactive
+          until a program has madvised that an area is MADV_MERGEABLE, and
+          root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
 
 config DEFAULT_MMAP_MIN_ADDR
         int "Low address space to protect from user allocation"
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 3d3accb1f800..5a37e2055717 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -92,7 +92,7 @@ static int bdi_debug_stats_show(struct seq_file *m, void *v)
                    "BdiDirtyThresh:   %8lu kB\n"
                    "DirtyThresh:      %8lu kB\n"
                    "BackgroundThresh: %8lu kB\n"
-                   "WriteBack threads:%8lu\n"
+                   "WritebackThreads: %8lu\n"
                    "b_dirty:          %8lu\n"
                    "b_io:             %8lu\n"
                    "b_more_io:        %8lu\n"
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 4ea4510e2996..8bf765c4f58d 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -833,12 +833,15 @@ static void early_alloc(struct early_log *log)
          */
         rcu_read_lock();
         object = create_object((unsigned long)log->ptr, log->size,
-                               log->min_count, GFP_KERNEL);
+                               log->min_count, GFP_ATOMIC);
+        if (!object)
+                goto out;
         spin_lock_irqsave(&object->lock, flags);
         for (i = 0; i < log->trace_len; i++)
                 object->trace[i] = log->trace[i];
         object->trace_len = log->trace_len;
         spin_unlock_irqrestore(&object->lock, flags);
+out:
         rcu_read_unlock();
 }
 
diff --git a/mm/ksm.c b/mm/ksm.c
index f7edac356f46..bef1af4f77e3 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -184,11 +184,6 @@ static DEFINE_SPINLOCK(ksm_mmlist_lock);
                 sizeof(struct __struct), __alignof__(struct __struct),\
                 (__flags), NULL)
 
-static void __init ksm_init_max_kernel_pages(void)
-{
-        ksm_max_kernel_pages = nr_free_buffer_pages() / 4;
-}
-
 static int __init ksm_slab_init(void)
 {
         rmap_item_cache = KSM_KMEM_CACHE(rmap_item, 0);
@@ -1673,7 +1668,7 @@ static int __init ksm_init(void)
         struct task_struct *ksm_thread;
         int err;
 
-        ksm_init_max_kernel_pages();
+        ksm_max_kernel_pages = totalram_pages / 4;
 
         err = ksm_slab_init();
         if (err)
@@ -1697,6 +1692,9 @@ static int __init ksm_init(void)
                 kthread_stop(ksm_thread);
                 goto out_free2;
         }
+#else
+        ksm_run = KSM_RUN_MERGE;        /* no way for user to start it */
+
 #endif /* CONFIG_SYSFS */
 
         return 0;
diff --git a/mm/memory.c b/mm/memory.c
index 7a3b0ad5594a..6ab19dd4a199 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -641,6 +641,7 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 pmd_t *dst_pmd, pmd_t *src_pmd, struct vm_area_struct *vma,
                 unsigned long addr, unsigned long end)
 {
+        pte_t *orig_src_pte, *orig_dst_pte;
         pte_t *src_pte, *dst_pte;
         spinlock_t *src_ptl, *dst_ptl;
         int progress = 0;
@@ -654,6 +655,8 @@ again:
         src_pte = pte_offset_map_nested(src_pmd, addr);
         src_ptl = pte_lockptr(src_mm, src_pmd);
         spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
+        orig_src_pte = src_pte;
+        orig_dst_pte = dst_pte;
         arch_enter_lazy_mmu_mode();
 
         do {
@@ -677,9 +680,9 @@ again:
 
         arch_leave_lazy_mmu_mode();
         spin_unlock(src_ptl);
-        pte_unmap_nested(src_pte - 1);
+        pte_unmap_nested(orig_src_pte);
         add_mm_rss(dst_mm, rss[0], rss[1]);
-        pte_unmap_unlock(dst_pte - 1, dst_ptl);
+        pte_unmap_unlock(orig_dst_pte, dst_ptl);
         cond_resched();
         if (addr != end)
                 goto again;
@@ -1820,10 +1823,10 @@ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
         token = pmd_pgtable(*pmd);
 
         do {
-                err = fn(pte, token, addr, data);
+                err = fn(pte++, token, addr, data);
                 if (err)
                         break;
-        } while (pte++, addr += PAGE_SIZE, addr != end);
+        } while (addr += PAGE_SIZE, addr != end);
 
         arch_leave_lazy_mmu_mode();
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 7dd9d9f80694..4545d5944243 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1024,7 +1024,7 @@ static long do_mbind(unsigned long start, unsigned long len,
 
                 err = migrate_prep();
                 if (err)
-                        return err;
+                        goto mpol_out;
         }
         {
                 NODEMASK_SCRATCH(scratch);
@@ -1039,10 +1039,9 @@ static long do_mbind(unsigned long start, unsigned long len,
                         err = -ENOMEM;
                 NODEMASK_SCRATCH_FREE(scratch);
         }
-        if (err) {
-                mpol_put(new);
-                return err;
-        }
+        if (err)
+                goto mpol_out;
+
         vma = check_range(mm, start, end, nmask,
                           flags | MPOL_MF_INVERT, &pagelist);
 
@@ -1058,9 +1057,11 @@ static long do_mbind(unsigned long start, unsigned long len,
 
                 if (!err && nr_failed && (flags & MPOL_MF_STRICT))
                         err = -EIO;
-        }
+        } else
+                putback_lru_pages(&pagelist);
 
         up_write(&mm->mmap_sem);
+ mpol_out:
         mpol_put(new);
         return err;
 }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index a3b14090b1fb..2c5d79236ead 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -566,7 +566,8 @@ static void balance_dirty_pages(struct address_space *mapping,
                 if (pages_written >= write_chunk)
                         break;          /* We've done our duty */
 
-                schedule_timeout_interruptible(pause);
+                __set_current_state(TASK_INTERRUPTIBLE);
+                io_schedule_timeout(pause);
 
                 /*
                  * Increase the delay for each loop, up to our previous
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index bf720550b44d..cdcedf661616 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2183,7 +2183,7 @@ void show_free_areas(void)
         printk("active_anon:%lu inactive_anon:%lu isolated_anon:%lu\n"
                 " active_file:%lu inactive_file:%lu isolated_file:%lu\n"
                 " unevictable:%lu"
-                " dirty:%lu writeback:%lu unstable:%lu buffer:%lu\n"
+                " dirty:%lu writeback:%lu unstable:%lu\n"
                 " free:%lu slab_reclaimable:%lu slab_unreclaimable:%lu\n"
                 " mapped:%lu shmem:%lu pagetables:%lu bounce:%lu\n",
                 global_page_state(NR_ACTIVE_ANON),
@@ -2196,7 +2196,6 @@ void show_free_areas(void)
                 global_page_state(NR_FILE_DIRTY),
                 global_page_state(NR_WRITEBACK),
                 global_page_state(NR_UNSTABLE_NFS),
-                nr_blockdev_pages(),
                 global_page_state(NR_FREE_PAGES),
                 global_page_state(NR_SLAB_RECLAIMABLE),
                 global_page_state(NR_SLAB_UNRECLAIMABLE),
diff --git a/mm/percpu.c b/mm/percpu.c
index 4a048abad043..6af78c1ee704 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1870,13 +1870,14 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, ssize_t dyn_size,
         max_distance = 0;
         for (group = 0; group < ai->nr_groups; group++) {
                 ai->groups[group].base_offset = areas[group] - base;
-                max_distance = max(max_distance, ai->groups[group].base_offset);
+                max_distance = max_t(size_t, max_distance,
+                                     ai->groups[group].base_offset);
         }
         max_distance += ai->unit_size;
 
         /* warn if maximum distance is further than 75% of vmalloc space */
         if (max_distance > (VMALLOC_END - VMALLOC_START) * 3 / 4) {
-                pr_warning("PERCPU: max_distance=0x%lx too large for vmalloc "
+                pr_warning("PERCPU: max_distance=0x%zx too large for vmalloc "
                            "space 0x%lx\n",
                            max_distance, VMALLOC_END - VMALLOC_START);
 #ifdef CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 4de7f02f820b..a1bc6b9af9a2 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1974,12 +1974,14 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
                 goto bad_swap;
         }
 
-        if (blk_queue_nonrot(bdev_get_queue(p->bdev))) {
-                p->flags |= SWP_SOLIDSTATE;
-                p->cluster_next = 1 + (random32() % p->highest_bit);
+        if (p->bdev) {
+                if (blk_queue_nonrot(bdev_get_queue(p->bdev))) {
+                        p->flags |= SWP_SOLIDSTATE;
+                        p->cluster_next = 1 + (random32() % p->highest_bit);
+                }
+                if (discard_swap(p) == 0)
+                        p->flags |= SWP_DISCARDABLE;
         }
-        if (discard_swap(p) == 0)
-                p->flags |= SWP_DISCARDABLE;
 
         mutex_lock(&swapon_mutex);
         spin_lock(&swap_lock);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 69511e663234..0f551a4a44cd 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -12,6 +12,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/highmem.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
@@ -25,10 +26,10 @@
 #include <linux/rcupdate.h>
 #include <linux/pfn.h>
 #include <linux/kmemleak.h>
-#include <linux/highmem.h>
 #include <asm/atomic.h>
 #include <asm/uaccess.h>
 #include <asm/tlbflush.h>
+#include <asm/shmparam.h>
 
 
 /*** Page table manipulation functions ***/
@@ -1156,12 +1157,11 @@ static void insert_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
 }
 
 static struct vm_struct *__get_vm_area_node(unsigned long size,
-                unsigned long flags, unsigned long start, unsigned long end,
-                int node, gfp_t gfp_mask, void *caller)
+                unsigned long align, unsigned long flags, unsigned long start,
+                unsigned long end, int node, gfp_t gfp_mask, void *caller)
 {
         static struct vmap_area *va;
         struct vm_struct *area;
-        unsigned long align = 1;
 
         BUG_ON(in_interrupt());
         if (flags & VM_IOREMAP) {
@@ -1201,7 +1201,7 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
 struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
                                 unsigned long start, unsigned long end)
 {
-        return __get_vm_area_node(size, flags, start, end, -1, GFP_KERNEL,
+        return __get_vm_area_node(size, 1, flags, start, end, -1, GFP_KERNEL,
                                                 __builtin_return_address(0));
 }
 EXPORT_SYMBOL_GPL(__get_vm_area);
@@ -1210,7 +1210,7 @@ struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags,
                                        unsigned long start, unsigned long end,
                                        void *caller)
 {
-        return __get_vm_area_node(size, flags, start, end, -1, GFP_KERNEL,
+        return __get_vm_area_node(size, 1, flags, start, end, -1, GFP_KERNEL,
                                   caller);
 }
 
@@ -1225,22 +1225,22 @@ struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags,
  */
 struct vm_struct *get_vm_area(unsigned long size, unsigned long flags)
 {
-        return __get_vm_area_node(size, flags, VMALLOC_START, VMALLOC_END,
+        return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
                                 -1, GFP_KERNEL, __builtin_return_address(0));
 }
 
 struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,
                                 void *caller)
 {
-        return __get_vm_area_node(size, flags, VMALLOC_START, VMALLOC_END,
+        return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
                                                 -1, GFP_KERNEL, caller);
 }
 
 struct vm_struct *get_vm_area_node(unsigned long size, unsigned long flags,
                                    int node, gfp_t gfp_mask)
 {
-        return __get_vm_area_node(size, flags, VMALLOC_START, VMALLOC_END, node,
-                                  gfp_mask, __builtin_return_address(0));
+        return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
+                                  node, gfp_mask, __builtin_return_address(0));
 }
 
 static struct vm_struct *find_vm_area(const void *addr)
@@ -1403,7 +1403,8 @@ void *vmap(struct page **pages, unsigned int count,
 }
 EXPORT_SYMBOL(vmap);
 
-static void *__vmalloc_node(unsigned long size, gfp_t gfp_mask, pgprot_t prot,
+static void *__vmalloc_node(unsigned long size, unsigned long align,
+                            gfp_t gfp_mask, pgprot_t prot,
                             int node, void *caller);
 static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                                  pgprot_t prot, int node, void *caller)
@@ -1417,7 +1418,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         area->nr_pages = nr_pages;
         /* Please note that the recursion is strictly bounded. */
         if (array_size > PAGE_SIZE) {
-                pages = __vmalloc_node(array_size, gfp_mask | __GFP_ZERO,
+                pages = __vmalloc_node(array_size, 1, gfp_mask | __GFP_ZERO,
                                 PAGE_KERNEL, node, caller);
                 area->flags |= VM_VPAGES;
         } else {
@@ -1476,6 +1477,7 @@ void *__vmalloc_area(struct vm_struct *area, gfp_t gfp_mask, pgprot_t prot)
 /**
  *      __vmalloc_node  -  allocate virtually contiguous memory
  *      @size:          allocation size
+ *      @align:         desired alignment
  *      @gfp_mask:      flags for the page level allocator
  *      @prot:          protection mask for the allocated pages
  *      @node:          node to use for allocation or -1
@@ -1485,8 +1487,9 @@ void *__vmalloc_area(struct vm_struct *area, gfp_t gfp_mask, pgprot_t prot)
  *      allocator with @gfp_mask flags.  Map them into contiguous
  *      kernel virtual space, using a pagetable protection of @prot.
  */
-static void *__vmalloc_node(unsigned long size, gfp_t gfp_mask, pgprot_t prot,
-                                                int node, void *caller)
+static void *__vmalloc_node(unsigned long size, unsigned long align,
+                            gfp_t gfp_mask, pgprot_t prot,
+                            int node, void *caller)
 {
         struct vm_struct *area;
         void *addr;
@@ -1496,8 +1499,8 @@ static void *__vmalloc_node(unsigned long size, gfp_t gfp_mask, pgprot_t prot,
         if (!size || (size >> PAGE_SHIFT) > totalram_pages)
                 return NULL;
 
-        area = __get_vm_area_node(size, VM_ALLOC, VMALLOC_START, VMALLOC_END,
-                                                node, gfp_mask, caller);
+        area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
+                                  VMALLOC_END, node, gfp_mask, caller);
 
         if (!area)
                 return NULL;
@@ -1516,7 +1519,7 @@ static void *__vmalloc_node(unsigned long size, gfp_t gfp_mask, pgprot_t prot,
 
 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
 {
-        return __vmalloc_node(size, gfp_mask, prot, -1,
+        return __vmalloc_node(size, 1, gfp_mask, prot, -1,
                                 __builtin_return_address(0));
 }
 EXPORT_SYMBOL(__vmalloc);
@@ -1532,7 +1535,7 @@ EXPORT_SYMBOL(__vmalloc);
  */
 void *vmalloc(unsigned long size)
 {
-        return __vmalloc_node(size, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+        return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
                                         -1, __builtin_return_address(0));
 }
 EXPORT_SYMBOL(vmalloc);
@@ -1549,7 +1552,8 @@ void *vmalloc_user(unsigned long size)
         struct vm_struct *area;
         void *ret;
 
-        ret = __vmalloc_node(size, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
+        ret = __vmalloc_node(size, SHMLBA,
+                             GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
                              PAGE_KERNEL, -1, __builtin_return_address(0));
         if (ret) {
                 area = find_vm_area(ret);
@@ -1572,7 +1576,7 @@ EXPORT_SYMBOL(vmalloc_user);
  */
 void *vmalloc_node(unsigned long size, int node)
 {
-        return __vmalloc_node(size, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+        return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
                                         node, __builtin_return_address(0));
 }
 EXPORT_SYMBOL(vmalloc_node);
@@ -1595,7 +1599,7 @@ EXPORT_SYMBOL(vmalloc_node);
 
 void *vmalloc_exec(unsigned long size)
 {
-        return __vmalloc_node(size, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
+        return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
                               -1, __builtin_return_address(0));
 }
 
@@ -1616,7 +1620,7 @@ void *vmalloc_exec(unsigned long size)
  */
 void *vmalloc_32(unsigned long size)
 {
-        return __vmalloc_node(size, GFP_VMALLOC32, PAGE_KERNEL,
+        return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
                               -1, __builtin_return_address(0));
 }
 EXPORT_SYMBOL(vmalloc_32);
@@ -1633,7 +1637,7 @@ void *vmalloc_32_user(unsigned long size)
         struct vm_struct *area;
         void *ret;
 
-        ret = __vmalloc_node(size, GFP_VMALLOC32 | __GFP_ZERO, PAGE_KERNEL,
+        ret = __vmalloc_node(size, 1, GFP_VMALLOC32 | __GFP_ZERO, PAGE_KERNEL,
                              -1, __builtin_return_address(0));
         if (ret) {
                 area = find_vm_area(ret);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 64e438898832..777af57fd8c8 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -544,6 +544,16 @@ redo:
                  */
                 lru = LRU_UNEVICTABLE;
                 add_page_to_unevictable_list(page);
+                /*
+                 * When racing with an mlock clearing (page is
+                 * unlocked), make sure that if the other thread does
+                 * not observe our setting of PG_lru and fails
+                 * isolation, we see PG_mlocked cleared below and move
+                 * the page back to the evictable list.
+                 *
+                 * The other side is TestClearPageMlocked().
+                 */
+                smp_mb();
         }
 
         /*
@@ -1088,7 +1098,7 @@ static unsigned long shrink_inactive_list(unsigned long max_scan,
         int lumpy_reclaim = 0;
 
         while (unlikely(too_many_isolated(zone, file, sc))) {
-                congestion_wait(WRITE, HZ/10);
+                congestion_wait(BLK_RW_ASYNC, HZ/10);
 
                 /* We are about to die and free our memory. Return now. */
                 if (fatal_signal_pending(current))
@@ -1356,7 +1366,7 @@ static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
                          * IO, plus JVM can create lots of anon VM_EXEC pages,
                          * so we ignore them here.
                          */
-                        if ((vm_flags & VM_EXEC) && !PageAnon(page)) {
+                        if ((vm_flags & VM_EXEC) && page_is_file_cache(page)) {
                                 list_add(&page->lru, &l_active);
                                 continue;
                         }