7 files changed, 104 insertions, 27 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index d56d3c145b9f..7a13f6ac5421 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2553,8 +2553,8 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         if (ret > 0) {
                 ssize_t err;
 
-                err = generic_write_sync(file, pos, ret);
-                if (err < 0 && ret > 0)
+                err = generic_write_sync(file, iocb->ki_pos - ret, ret);
+                if (err < 0)
                         ret = err;
         }
         return ret;
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 4f08a2d61487..2f2f34a4e77d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -945,8 +945,10 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
                          * to it. Similarly, page lock is shifted.
                          */
                         if (hpage != p) {
-                                put_page(hpage);
-                                get_page(p);
+                                if (!(flags & MF_COUNT_INCREASED)) {
+                                        put_page(hpage);
+                                        get_page(p);
+                                }
                                 lock_page(p);
                                 unlock_page(hpage);
                                 *hpagep = p;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 2d30e2cfe804..7106cb1aca8e 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2173,11 +2173,12 @@ int __set_page_dirty_nobuffers(struct page *page)
         if (!TestSetPageDirty(page)) {
                 struct address_space *mapping = page_mapping(page);
                 struct address_space *mapping2;
+                unsigned long flags;
 
                 if (!mapping)
                         return 1;
 
-                spin_lock_irq(&mapping->tree_lock);
+                spin_lock_irqsave(&mapping->tree_lock, flags);
                 mapping2 = page_mapping(page);
                 if (mapping2) { /* Race with truncate? */
                         BUG_ON(mapping2 != mapping);
@@ -2186,7 +2187,7 @@ int __set_page_dirty_nobuffers(struct page *page)
                         radix_tree_tag_set(&mapping->page_tree,
                                 page_index(page), PAGECACHE_TAG_DIRTY);
                 }
-                spin_unlock_irq(&mapping->tree_lock);
+                spin_unlock_irqrestore(&mapping->tree_lock, flags);
                 if (mapping->host) {
                         /* !PageAnon && !swapper_space */
                         __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
diff --git a/mm/slub.c b/mm/slub.c
index 7e3e0458bce4..25f14ad8f817 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1004,21 +1004,19 @@ static inline void slab_free_hook(struct kmem_cache *s, void *x)
 static void add_full(struct kmem_cache *s,
         struct kmem_cache_node *n, struct page *page)
 {
-        lockdep_assert_held(&n->list_lock);
-
         if (!(s->flags & SLAB_STORE_USER))
                 return;
 
+        lockdep_assert_held(&n->list_lock);
         list_add(&page->lru, &n->full);
 }
 
 static void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, struct page *page)
 {
-        lockdep_assert_held(&n->list_lock);
-
         if (!(s->flags & SLAB_STORE_USER))
                 return;
 
+        lockdep_assert_held(&n->list_lock);
         list_del(&page->lru);
 }
 
@@ -1520,11 +1518,9 @@ static void discard_slab(struct kmem_cache *s, struct page *page)
 /*
  * Management of partially allocated slabs.
  */
-static inline void add_partial(struct kmem_cache_node *n,
-                                struct page *page, int tail)
+static inline void
+__add_partial(struct kmem_cache_node *n, struct page *page, int tail)
 {
-        lockdep_assert_held(&n->list_lock);
-
         n->nr_partial++;
         if (tail == DEACTIVATE_TO_TAIL)
                 list_add_tail(&page->lru, &n->partial);
@@ -1532,15 +1528,27 @@ static inline void add_partial(struct kmem_cache_node *n,
                 list_add(&page->lru, &n->partial);
 }
 
-static inline void remove_partial(struct kmem_cache_node *n,
-                                        struct page *page)
+static inline void add_partial(struct kmem_cache_node *n,
+                                struct page *page, int tail)
 {
         lockdep_assert_held(&n->list_lock);
+        __add_partial(n, page, tail);
+}
 
+static inline void
+__remove_partial(struct kmem_cache_node *n, struct page *page)
+{
         list_del(&page->lru);
         n->nr_partial--;
 }
 
+static inline void remove_partial(struct kmem_cache_node *n,
+                                        struct page *page)
+{
+        lockdep_assert_held(&n->list_lock);
+        __remove_partial(n, page);
+}
+
 /*
  * Remove slab from the partial list, freeze it and
  * return the pointer to the freelist.
@@ -2906,12 +2914,10 @@ static void early_kmem_cache_node_alloc(int node)
         inc_slabs_node(kmem_cache_node, node, page->objects);
 
         /*
-         * the lock is for lockdep's sake, not for any actual
-         * race protection
+         * No locks need to be taken here as it has just been
+         * initialized and there is no concurrent access.
          */
-        spin_lock(&n->list_lock);
-        add_partial(n, page, DEACTIVATE_TO_HEAD);
-        spin_unlock(&n->list_lock);
+        __add_partial(n, page, DEACTIVATE_TO_HEAD);
 }
 
 static void free_kmem_cache_nodes(struct kmem_cache *s)
@@ -3197,7 +3203,7 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
 
         list_for_each_entry_safe(page, h, &n->partial, lru) {
                 if (!page->inuse) {
-                        remove_partial(n, page);
+                        __remove_partial(n, page);
                         discard_slab(s, page);
                 } else {
                         list_slab_objects(s, page,
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 98e85e9c2b2d..e76ace30d436 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -63,6 +63,8 @@ unsigned long total_swapcache_pages(void)
         return ret;
 }
 
+static atomic_t swapin_readahead_hits = ATOMIC_INIT(4);
+
 void show_swap_cache_info(void)
 {
         printk("%lu pages in swap cache\n", total_swapcache_pages());
@@ -286,8 +288,11 @@ struct page * lookup_swap_cache(swp_entry_t entry)
 
         page = find_get_page(swap_address_space(entry), entry.val);
 
-        if (page)
+        if (page) {
                 INC_CACHE_INFO(find_success);
+                if (TestClearPageReadahead(page))
+                        atomic_inc(&swapin_readahead_hits);
+        }
 
         INC_CACHE_INFO(find_total);
         return page;
@@ -389,6 +394,50 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
         return found_page;
 }
 
+static unsigned long swapin_nr_pages(unsigned long offset)
+{
+        static unsigned long prev_offset;
+        unsigned int pages, max_pages, last_ra;
+        static atomic_t last_readahead_pages;
+
+        max_pages = 1 << ACCESS_ONCE(page_cluster);
+        if (max_pages <= 1)
+                return 1;
+
+        /*
+         * This heuristic has been found to work well on both sequential and
+         * random loads, swapping to hard disk or to SSD: please don't ask
+         * what the "+ 2" means, it just happens to work well, that's all.
+         */
+        pages = atomic_xchg(&swapin_readahead_hits, 0) + 2;
+        if (pages == 2) {
+                /*
+                 * We can have no readahead hits to judge by: but must not get
+                 * stuck here forever, so check for an adjacent offset instead
+                 * (and don't even bother to check whether swap type is same).
+                 */
+                if (offset != prev_offset + 1 && offset != prev_offset - 1)
+                        pages = 1;
+                prev_offset = offset;
+        } else {
+                unsigned int roundup = 4;
+                while (roundup < pages)
+                        roundup <<= 1;
+                pages = roundup;
+        }
+
+        if (pages > max_pages)
+                pages = max_pages;
+
+        /* Don't shrink readahead too fast */
+        last_ra = atomic_read(&last_readahead_pages) / 2;
+        if (pages < last_ra)
+                pages = last_ra;
+        atomic_set(&last_readahead_pages, pages);
+
+        return pages;
+}
+
 /**
  * swapin_readahead - swap in pages in hope we need them soon
  * @entry: swap entry of this memory
@@ -412,11 +461,16 @@ struct page *swapin_readahead(swp_entry_t entry, gfp_t gfp_mask,
                         struct vm_area_struct *vma, unsigned long addr)
 {
         struct page *page;
-        unsigned long offset = swp_offset(entry);
+        unsigned long entry_offset = swp_offset(entry);
+        unsigned long offset = entry_offset;
         unsigned long start_offset, end_offset;
-        unsigned long mask = (1UL << page_cluster) - 1;
+        unsigned long mask;
         struct blk_plug plug;
 
+        mask = swapin_nr_pages(offset) - 1;
+        if (!mask)
+                goto skip;
+
         /* Read a page_cluster sized and aligned cluster around offset. */
         start_offset = offset & ~mask;
         end_offset = offset | mask;
@@ -430,10 +484,13 @@ struct page *swapin_readahead(swp_entry_t entry, gfp_t gfp_mask,
                                                 gfp_mask, vma, addr);
                 if (!page)
                         continue;
+                if (offset != entry_offset)
+                        SetPageReadahead(page);
                 page_cache_release(page);
         }
         blk_finish_plug(&plug);
 
         lru_add_drain();        /* Push any new pages onto the LRU now */
+skip:
         return read_swap_cache_async(entry, gfp_mask, vma, addr);
 }
diff --git a/mm/swapfile.c b/mm/swapfile.c
index c6c13b050a58..4a7f7e6992b6 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1923,7 +1923,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         p->swap_map = NULL;
         cluster_info = p->cluster_info;
         p->cluster_info = NULL;
-        p->flags = 0;
         frontswap_map = frontswap_map_get(p);
         spin_unlock(&p->lock);
         spin_unlock(&swap_lock);
@@ -1949,6 +1948,16 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
                 mutex_unlock(&inode->i_mutex);
         }
         filp_close(swap_file, NULL);
+
+        /*
+         * Clear the SWP_USED flag after all resources are freed so that swapon
+         * can reuse this swap_info in alloc_swap_info() safely.  It is ok to
+         * not hold p->lock after we cleared its SWP_WRITEOK.
+         */
+        spin_lock(&swap_lock);
+        p->flags = 0;
+        spin_unlock(&swap_lock);
+
         err = 0;
         atomic_inc(&proc_poll_event);
         wake_up_interruptible(&proc_poll_wait);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 72496140ac08..def5dd2fbe61 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -851,12 +851,14 @@ const char * const vmstat_text[] = {
         "thp_zero_page_alloc",
         "thp_zero_page_alloc_failed",
 #endif
+#ifdef CONFIG_DEBUG_TLBFLUSH
 #ifdef CONFIG_SMP
         "nr_tlb_remote_flush",
         "nr_tlb_remote_flush_received",
-#endif
+#endif /* CONFIG_SMP */
         "nr_tlb_local_flush_all",
         "nr_tlb_local_flush_one",
+#endif /* CONFIG_DEBUG_TLBFLUSH */
 
 #endif /* CONFIG_VM_EVENTS_COUNTERS */
 };