13 files changed, 151 insertions, 108 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index ae9ce6b73e8a..21eb51d4da8f 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -125,12 +125,10 @@ comment "Memory hotplug is currently incompatible with Software Suspend"
 # space can be handled with less contention: split it at this NR_CPUS.
 # Default to 4 for wider testing, though 8 might be more appropriate.
 # ARM's adjust_pte (unused if VIPT) depends on mm-wide page_table_lock.
-# PA-RISC's debug spinlock_t is too large for the 32-bit struct page.
-# ARM26 and SPARC32 and PPC64 may use one page for multiple page tables.
+# PA-RISC 7xxx's spinlock_t would enlarge struct page from 32 to 44 bytes.
 #
 config SPLIT_PTLOCK_CPUS
         int
         default "4096" if ARM && !CPU_CACHE_VIPT
-        default "4096" if PARISC && DEBUG_SPINLOCK && !64BIT
-        default "4096" if ARM26 || SPARC32 || PPC64
+        default "4096" if PARISC && !PA20
         default "4"
diff --git a/mm/fremap.c b/mm/fremap.c
index d862be3bc3e3..007cbad9331e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -65,7 +65,7 @@ int install_page(struct mm_struct *mm, struct vm_area_struct *vma,
         pte_t pte_val;
         spinlock_t *ptl;
 
-        BUG_ON(vma->vm_flags & VM_RESERVED);
+        BUG_ON(vma->vm_flags & VM_UNPAGED);
 
         pgd = pgd_offset(mm, addr);
         pud = pud_alloc(mm, pgd, addr);
@@ -122,7 +122,7 @@ int install_file_pte(struct mm_struct *mm, struct vm_area_struct *vma,
         pte_t pte_val;
         spinlock_t *ptl;
 
-        BUG_ON(vma->vm_flags & VM_RESERVED);
+        BUG_ON(vma->vm_flags & VM_UNPAGED);
 
         pgd = pgd_offset(mm, addr);
         pud = pud_alloc(mm, pgd, addr);
@@ -204,12 +204,10 @@ asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
          * Make sure the vma is shared, that it supports prefaulting,
          * and that the remapped range is valid and fully within
          * the single existing vma.  vm_private_data is used as a
-         * swapout cursor in a VM_NONLINEAR vma (unless VM_RESERVED
-         * or VM_LOCKED, but VM_LOCKED could be revoked later on).
+         * swapout cursor in a VM_NONLINEAR vma.
          */
         if (vma && (vma->vm_flags & VM_SHARED) &&
-                (!vma->vm_private_data ||
-                        (vma->vm_flags & (VM_NONLINEAR|VM_RESERVED))) &&
+                (!vma->vm_private_data || (vma->vm_flags & VM_NONLINEAR)) &&
                 vma->vm_ops && vma->vm_ops->populate &&
                         end > start && start >= vma->vm_start &&
                                 end <= vma->vm_end) {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 728e9bda12ea..3e52df7c471b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -22,6 +22,10 @@ unsigned long max_huge_pages;
 static struct list_head hugepage_freelists[MAX_NUMNODES];
 static unsigned int nr_huge_pages_node[MAX_NUMNODES];
 static unsigned int free_huge_pages_node[MAX_NUMNODES];
+
+/*
+ * Protects updates to hugepage_freelists, nr_huge_pages, and free_huge_pages
+ */
 static DEFINE_SPINLOCK(hugetlb_lock);
 
 static void enqueue_huge_page(struct page *page)
@@ -61,8 +65,10 @@ static struct page *alloc_fresh_huge_page(void)
                                         HUGETLB_PAGE_ORDER);
         nid = (nid + 1) % num_online_nodes();
         if (page) {
+                spin_lock(&hugetlb_lock);
                 nr_huge_pages++;
                 nr_huge_pages_node[page_to_nid(page)]++;
+                spin_unlock(&hugetlb_lock);
         }
         return page;
 }
diff --git a/mm/madvise.c b/mm/madvise.c
index 17aaf3e16449..328a3bcce527 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -126,7 +126,7 @@ static long madvise_dontneed(struct vm_area_struct * vma,
                              unsigned long start, unsigned long end)
 {
         *prev = vma;
-        if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_RESERVED))
+        if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_UNPAGED))
                 return -EINVAL;
 
         if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
diff --git a/mm/memory.c b/mm/memory.c
index 2998cfc12f5b..d1f46f4e4c8a 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -334,7 +334,7 @@ static inline void add_mm_rss(struct mm_struct *mm, int file_rss, int anon_rss)
 
 /*
  * This function is called to print an error when a pte in a
- * !VM_RESERVED region is found pointing to an invalid pfn (which
+ * !VM_UNPAGED region is found pointing to an invalid pfn (which
  * is an error.
  *
  * The calling function must still handle the error.
@@ -350,6 +350,22 @@ void print_bad_pte(struct vm_area_struct *vma, pte_t pte, unsigned long vaddr)
 }
 
 /*
+ * page_is_anon applies strict checks for an anonymous page belonging to
+ * this vma at this address.  It is used on VM_UNPAGED vmas, which are
+ * usually populated with shared originals (which must not be counted),
+ * but occasionally contain private COWed copies (when !VM_SHARED, or
+ * perhaps via ptrace when VM_SHARED).  An mmap of /dev/mem might window
+ * free pages, pages from other processes, or from other parts of this:
+ * it's tricky, but try not to be deceived by foreign anonymous pages.
+ */
+static inline int page_is_anon(struct page *page,
+                        struct vm_area_struct *vma, unsigned long addr)
+{
+        return page && PageAnon(page) && page_mapped(page) &&
+                page_address_in_vma(page, vma) == addr;
+}
+
+/*
  * copy one vm_area from one task to the other. Assumes the page tables
  * already present in the new task to be cleared in the whole range
  * covered by this vma.
@@ -381,23 +397,22 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 goto out_set_pte;
         }
 
-        /* If the region is VM_RESERVED, the mapping is not
-         * mapped via rmap - duplicate the pte as is.
-         */
-        if (vm_flags & VM_RESERVED)
-                goto out_set_pte;
-
         pfn = pte_pfn(pte);
-        /* If the pte points outside of valid memory but
-         * the region is not VM_RESERVED, we have a problem.
+        page = pfn_valid(pfn)? pfn_to_page(pfn): NULL;
+
+        if (unlikely(vm_flags & VM_UNPAGED))
+                if (!page_is_anon(page, vma, addr))
+                        goto out_set_pte;
+
+        /*
+         * If the pte points outside of valid memory but
+         * the region is not VM_UNPAGED, we have a problem.
          */
-        if (unlikely(!pfn_valid(pfn))) {
+        if (unlikely(!page)) {
                 print_bad_pte(vma, pte, addr);
                 goto out_set_pte; /* try to do something sane */
         }
 
-        page = pfn_to_page(pfn);
-
         /*
          * If it's a COW mapping, write protect it both
          * in the parent and the child
@@ -528,7 +543,7 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
          * readonly mappings. The tradeoff is that copy_page_range is more
          * efficient than faulting.
          */
-        if (!(vma->vm_flags & (VM_HUGETLB|VM_NONLINEAR|VM_RESERVED))) {
+        if (!(vma->vm_flags & (VM_HUGETLB|VM_NONLINEAR|VM_UNPAGED))) {
                 if (!vma->anon_vma)
                         return 0;
         }
@@ -568,17 +583,20 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
                         continue;
                 }
                 if (pte_present(ptent)) {
-                        struct page *page = NULL;
+                        struct page *page;
+                        unsigned long pfn;
 
                         (*zap_work) -= PAGE_SIZE;
 
-                        if (!(vma->vm_flags & VM_RESERVED)) {
-                                unsigned long pfn = pte_pfn(ptent);
-                                if (unlikely(!pfn_valid(pfn)))
-                                        print_bad_pte(vma, ptent, addr);
-                                else
-                                        page = pfn_to_page(pfn);
-                        }
+                        pfn = pte_pfn(ptent);
+                        page = pfn_valid(pfn)? pfn_to_page(pfn): NULL;
+
+                        if (unlikely(vma->vm_flags & VM_UNPAGED)) {
+                                if (!page_is_anon(page, vma, addr))
+                                        page = NULL;
+                        } else if (unlikely(!page))
+                                print_bad_pte(vma, ptent, addr);
+
                         if (unlikely(details) && page) {
                                 /*
                                  * unmap_shared_mapping_pages() wants to
@@ -968,7 +986,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         continue;
                 }
 
-                if (!vma || (vma->vm_flags & (VM_IO | VM_RESERVED))
+                if (!vma || (vma->vm_flags & VM_IO)
                                 || !(vm_flags & vma->vm_flags))
                         return i ? : -EFAULT;
 
@@ -1191,10 +1209,16 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
          * rest of the world about it:
          *   VM_IO tells people not to look at these pages
          *      (accesses can have side effects).
-         *   VM_RESERVED tells the core MM not to "manage" these pages
-         *      (e.g. refcount, mapcount, try to swap them out).
+         *   VM_RESERVED is specified all over the place, because
+         *      in 2.4 it kept swapout's vma scan off this vma; but
+         *      in 2.6 the LRU scan won't even find its pages, so this
+         *      flag means no more than count its pages in reserved_vm,
+         *      and omit it from core dump, even when VM_IO turned off.
+         *   VM_UNPAGED tells the core MM not to "manage" these pages
+         *      (e.g. refcount, mapcount, try to swap them out): in
+         *      particular, zap_pte_range does not try to free them.
          */
-        vma->vm_flags |= VM_IO | VM_RESERVED;
+        vma->vm_flags |= VM_IO | VM_RESERVED | VM_UNPAGED;
 
         BUG_ON(addr >= end);
         pfn -= addr >> PAGE_SHIFT;
@@ -1271,22 +1295,29 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 unsigned long address, pte_t *page_table, pmd_t *pmd,
                 spinlock_t *ptl, pte_t orig_pte)
 {
-        struct page *old_page, *new_page;
+        struct page *old_page, *src_page, *new_page;
         unsigned long pfn = pte_pfn(orig_pte);
         pte_t entry;
         int ret = VM_FAULT_MINOR;
 
-        BUG_ON(vma->vm_flags & VM_RESERVED);
-
         if (unlikely(!pfn_valid(pfn))) {
                 /*
                  * Page table corrupted: show pte and kill process.
+                 * Or it's an attempt to COW an out-of-map VM_UNPAGED
+                 * entry, which copy_user_highpage does not support.
                  */
                 print_bad_pte(vma, orig_pte, address);
                 ret = VM_FAULT_OOM;
                 goto unlock;
         }
         old_page = pfn_to_page(pfn);
+        src_page = old_page;
+
+        if (unlikely(vma->vm_flags & VM_UNPAGED))
+                if (!page_is_anon(old_page, vma, address)) {
+                        old_page = NULL;
+                        goto gotten;
+                }
 
         if (PageAnon(old_page) && !TestSetPageLocked(old_page)) {
                 int reuse = can_share_swap_page(old_page);
@@ -1307,11 +1338,12 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
          * Ok, we need to copy. Oh, well..
          */
         page_cache_get(old_page);
+gotten:
         pte_unmap_unlock(page_table, ptl);
 
         if (unlikely(anon_vma_prepare(vma)))
                 goto oom;
-        if (old_page == ZERO_PAGE(address)) {
+        if (src_page == ZERO_PAGE(address)) {
                 new_page = alloc_zeroed_user_highpage(vma, address);
                 if (!new_page)
                         goto oom;
@@ -1319,7 +1351,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 new_page = alloc_page_vma(GFP_HIGHUSER, vma, address);
                 if (!new_page)
                         goto oom;
-                copy_user_highpage(new_page, old_page, address);
+                copy_user_highpage(new_page, src_page, address);
         }
 
         /*
@@ -1327,11 +1359,14 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
          */
         page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
         if (likely(pte_same(*page_table, orig_pte))) {
-                page_remove_rmap(old_page);
-                if (!PageAnon(old_page)) {
+                if (old_page) {
+                        page_remove_rmap(old_page);
+                        if (!PageAnon(old_page)) {
+                                dec_mm_counter(mm, file_rss);
+                                inc_mm_counter(mm, anon_rss);
+                        }
+                } else
                         inc_mm_counter(mm, anon_rss);
-                        dec_mm_counter(mm, file_rss);
-                }
                 flush_cache_page(vma, address, pfn);
                 entry = mk_pte(new_page, vma->vm_page_prot);
                 entry = maybe_mkwrite(pte_mkdirty(entry), vma);
@@ -1345,13 +1380,16 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 new_page = old_page;
                 ret |= VM_FAULT_WRITE;
         }
-        page_cache_release(new_page);
-        page_cache_release(old_page);
+        if (new_page)
+                page_cache_release(new_page);
+        if (old_page)
+                page_cache_release(old_page);
 unlock:
         pte_unmap_unlock(page_table, ptl);
         return ret;
 oom:
-        page_cache_release(old_page);
+        if (old_page)
+                page_cache_release(old_page);
         return VM_FAULT_OOM;
 }
 
@@ -1774,7 +1812,16 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
         spinlock_t *ptl;
         pte_t entry;
 
-        if (write_access) {
+        /*
+         * A VM_UNPAGED vma will normally be filled with present ptes
+         * by remap_pfn_range, and never arrive here; but it might have
+         * holes, or if !VM_DONTEXPAND, mremap might have expanded it.
+         * It's weird enough handling anon pages in unpaged vmas, we do
+         * not want to worry about ZERO_PAGEs too (it may or may not
+         * matter if their counts wrap): just give them anon pages.
+         */
+
+        if (write_access || (vma->vm_flags & VM_UNPAGED)) {
                 /* Allocate our own private page. */
                 pte_unmap(page_table);
 
@@ -1849,6 +1896,7 @@ static int do_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int anon = 0;
 
         pte_unmap(page_table);
+        BUG_ON(vma->vm_flags & VM_UNPAGED);
 
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
@@ -1924,7 +1972,7 @@ retry:
                         inc_mm_counter(mm, anon_rss);
                         lru_cache_add_active(new_page);
                         page_add_anon_rmap(new_page, vma, address);
-                } else if (!(vma->vm_flags & VM_RESERVED)) {
+                } else {
                         inc_mm_counter(mm, file_rss);
                         page_add_file_rmap(new_page);
                 }
@@ -2203,7 +2251,7 @@ static int __init gate_vma_init(void)
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_page_prot = PAGE_READONLY;
-        gate_vma.vm_flags = VM_RESERVED;
+        gate_vma.vm_flags = 0;
         return 0;
 }
 __initcall(gate_vma_init);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 5abc57c2b8bd..5609a31bdf22 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -269,7 +269,7 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
         first = find_vma(mm, start);
         if (!first)
                 return ERR_PTR(-EFAULT);
-        if (first->vm_flags & VM_RESERVED)
+        if (first->vm_flags & VM_UNPAGED)
                 return ERR_PTR(-EACCES);
         prev = NULL;
         for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
diff --git a/mm/mmap.c b/mm/mmap.c
index 4f8def03428c..11ca5927d5ff 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1076,17 +1076,6 @@ munmap_back:
                 error = file->f_op->mmap(file, vma);
                 if (error)
                         goto unmap_and_free_vma;
-                if ((vma->vm_flags & (VM_SHARED | VM_WRITE | VM_RESERVED))
-                                                == (VM_WRITE | VM_RESERVED)) {
-                        printk(KERN_WARNING "program %s is using MAP_PRIVATE, "
-                                "PROT_WRITE mmap of VM_RESERVED memory, which "
-                                "is deprecated. Please report this to "
-                                "linux-kernel@vger.kernel.org\n",current->comm);
-                        if (vma->vm_ops && vma->vm_ops->close)
-                                vma->vm_ops->close(vma);
-                        error = -EACCES;
-                        goto unmap_and_free_vma;
-                }
         } else if (vm_flags & VM_SHARED) {
                 error = shmem_zero_setup(vma);
                 if (error)
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 17a2b52b753b..653b8571c1ed 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -124,14 +124,6 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
          * a MAP_NORESERVE private mapping to writable will now reserve.
          */
         if (newflags & VM_WRITE) {
-                if (oldflags & VM_RESERVED) {
-                        BUG_ON(oldflags & VM_WRITE);
-                        printk(KERN_WARNING "program %s is using MAP_PRIVATE, "
-                                "PROT_WRITE mprotect of VM_RESERVED memory, "
-                                "which is deprecated. Please report this to "
-                                "linux-kernel@vger.kernel.org\n",current->comm);
-                        return -EACCES;
-                }
                 if (!(oldflags & (VM_ACCOUNT|VM_WRITE|VM_SHARED|VM_HUGETLB))) {
                         charged = nrpages;
                         if (security_vm_enough_memory(charged))
diff --git a/mm/msync.c b/mm/msync.c
index 0e040e9c39d8..b3f4caf3010b 100644
--- a/mm/msync.c
+++ b/mm/msync.c
@@ -97,9 +97,9 @@ static void msync_page_range(struct vm_area_struct *vma,
         /* For hugepages we can't go walking the page table normally,
          * but that's ok, hugetlbfs is memory based, so we don't need
          * to do anything more on an msync().
-         * Can't do anything with VM_RESERVED regions either.
+         * Can't do anything with VM_UNPAGED regions either.
          */
-        if (vma->vm_flags & (VM_HUGETLB|VM_RESERVED))
+        if (vma->vm_flags & (VM_HUGETLB|VM_UNPAGED))
                 return;
 
         BUG_ON(addr >= end);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index bd4de592dc23..1731236dec35 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -140,18 +140,13 @@ static void bad_page(const char *function, struct page *page)
                         1 << PG_reclaim |
                         1 << PG_slab    |
                         1 << PG_swapcache |
-                        1 << PG_writeback |
-                        1 << PG_reserved );
+                        1 << PG_writeback );
         set_page_count(page, 0);
         reset_page_mapcount(page);
         page->mapping = NULL;
         add_taint(TAINT_BAD_PAGE);
 }
 
-#ifndef CONFIG_HUGETLB_PAGE
-#define prep_compound_page(page, order) do { } while (0)
-#define destroy_compound_page(page, order) do { } while (0)
-#else
 /*
  * Higher-order pages are called "compound pages".  They are structured thusly:
  *
@@ -205,7 +200,6 @@ static void destroy_compound_page(struct page *page, unsigned long order)
                 ClearPageCompound(p);
         }
 }
-#endif          /* CONFIG_HUGETLB_PAGE */
 
 /*
  * function for dealing with page's order in buddy system.
@@ -340,7 +334,7 @@ static inline void __free_pages_bulk (struct page *page,
         zone->free_area[order].nr_free++;
 }
 
-static inline void free_pages_check(const char *function, struct page *page)
+static inline int free_pages_check(const char *function, struct page *page)
 {
         if (    page_mapcount(page) ||
                 page->mapping != NULL ||
@@ -358,6 +352,12 @@ static inline void free_pages_check(const char *function, struct page *page)
                 bad_page(function, page);
         if (PageDirty(page))
                 __ClearPageDirty(page);
+        /*
+         * For now, we report if PG_reserved was found set, but do not
+         * clear it, and do not free the page.  But we shall soon need
+         * to do more, for when the ZERO_PAGE count wraps negative.
+         */
+        return PageReserved(page);
 }
 
 /*
@@ -397,11 +397,10 @@ void __free_pages_ok(struct page *page, unsigned int order)
 {
         LIST_HEAD(list);
         int i;
+        int reserved = 0;
 
         arch_free_page(page, order);
 
-        mod_page_state(pgfree, 1 << order);
-
 #ifndef CONFIG_MMU
         if (order > 0)
                 for (i = 1 ; i < (1 << order) ; ++i)
@@ -409,8 +408,12 @@ void __free_pages_ok(struct page *page, unsigned int order)
 #endif
 
         for (i = 0 ; i < (1 << order) ; ++i)
-                free_pages_check(__FUNCTION__, page + i);
+                reserved += free_pages_check(__FUNCTION__, page + i);
+        if (reserved)
+                return;
+
         list_add(&page->lru, &list);
+        mod_page_state(pgfree, 1 << order);
         kernel_map_pages(page, 1<<order, 0);
         free_pages_bulk(page_zone(page), 1, &list, order);
 }
@@ -468,7 +471,7 @@ void set_page_refs(struct page *page, int order)
 /*
  * This page is about to be returned from the page allocator
  */
-static void prep_new_page(struct page *page, int order)
+static int prep_new_page(struct page *page, int order)
 {
         if (    page_mapcount(page) ||
                 page->mapping != NULL ||
@@ -486,12 +489,20 @@ static void prep_new_page(struct page *page, int order)
                         1 << PG_reserved )))
                 bad_page(__FUNCTION__, page);
 
+        /*
+         * For now, we report if PG_reserved was found set, but do not
+         * clear it, and do not allocate the page: as a safety net.
+         */
+        if (PageReserved(page))
+                return 1;
+
         page->flags &= ~(1 << PG_uptodate | 1 << PG_error |
                         1 << PG_referenced | 1 << PG_arch_1 |
                         1 << PG_checked | 1 << PG_mappedtodisk);
         set_page_private(page, 0);
         set_page_refs(page, order);
         kernel_map_pages(page, 1 << order, 1);
+        return 0;
 }
 
 /* 
@@ -674,11 +685,14 @@ static void fastcall free_hot_cold_page(struct page *page, int cold)
 
         arch_free_page(page, 0);
 
-        kernel_map_pages(page, 1, 0);
-        inc_page_state(pgfree);
         if (PageAnon(page))
                 page->mapping = NULL;
-        free_pages_check(__FUNCTION__, page);
+        if (free_pages_check(__FUNCTION__, page))
+                return;
+
+        inc_page_state(pgfree);
+        kernel_map_pages(page, 1, 0);
+
         pcp = &zone_pcp(zone, get_cpu())->pcp[cold];
         local_irq_save(flags);
         list_add(&page->lru, &pcp->list);
@@ -717,12 +731,14 @@ static struct page *
 buffered_rmqueue(struct zone *zone, int order, gfp_t gfp_flags)
 {
         unsigned long flags;
-        struct page *page = NULL;
+        struct page *page;
         int cold = !!(gfp_flags & __GFP_COLD);
 
+again:
         if (order == 0) {
                 struct per_cpu_pages *pcp;
 
+                page = NULL;
                 pcp = &zone_pcp(zone, get_cpu())->pcp[cold];
                 local_irq_save(flags);
                 if (pcp->count <= pcp->low)
@@ -744,7 +760,8 @@ buffered_rmqueue(struct zone *zone, int order, gfp_t gfp_flags)
         if (page != NULL) {
                 BUG_ON(bad_range(zone, page));
                 mod_page_state_zone(zone, pgalloc, 1 << order);
-                prep_new_page(page, order);
+                if (prep_new_page(page, order))
+                        goto again;
 
                 if (gfp_flags & __GFP_ZERO)
                         prep_zero_page(page, order, gfp_flags);
diff --git a/mm/rmap.c b/mm/rmap.c
index 914d04b98bee..2e034a0b89ab 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -225,7 +225,9 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 
 /*
  * At what user virtual address is page expected in vma? checking that the
- * page matches the vma: currently only used by unuse_process, on anon pages.
+ * page matches the vma: currently only used on anon pages, by unuse_vma;
+ * and by extraordinary checks on anon pages in VM_UNPAGED vmas, taking
+ * care that an mmap of /dev/mem might window free and foreign pages.
  */
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
@@ -234,7 +236,8 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
                     (void *)page->mapping - PAGE_MAPPING_ANON)
                         return -EFAULT;
         } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
-                if (vma->vm_file->f_mapping != page->mapping)
+                if (!vma->vm_file ||
+                    vma->vm_file->f_mapping != page->mapping)
                         return -EFAULT;
         } else
                 return -EFAULT;
@@ -529,10 +532,8 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma)
          * If the page is mlock()d, we cannot swap it out.
          * If it's recently referenced (perhaps page_referenced
          * skipped over this mm) then we should reactivate it.
-         *
-         * Pages belonging to VM_RESERVED regions should not happen here.
          */
-        if ((vma->vm_flags & (VM_LOCKED|VM_RESERVED)) ||
+        if ((vma->vm_flags & VM_LOCKED) ||
                         ptep_clear_flush_young(vma, address, pte)) {
                 ret = SWAP_FAIL;
                 goto out_unmap;
@@ -727,7 +728,7 @@ static int try_to_unmap_file(struct page *page)
 
         list_for_each_entry(vma, &mapping->i_mmap_nonlinear,
                                                 shared.vm_set.list) {
-                if (vma->vm_flags & (VM_LOCKED|VM_RESERVED))
+                if (vma->vm_flags & VM_LOCKED)
                         continue;
                 cursor = (unsigned long) vma->vm_private_data;
                 if (cursor > max_nl_cursor)
@@ -761,7 +762,7 @@ static int try_to_unmap_file(struct page *page)
         do {
                 list_for_each_entry(vma, &mapping->i_mmap_nonlinear,
                                                 shared.vm_set.list) {
-                        if (vma->vm_flags & (VM_LOCKED|VM_RESERVED))
+                        if (vma->vm_flags & VM_LOCKED)
                                 continue;
                         cursor = (unsigned long) vma->vm_private_data;
                         while ( cursor < max_nl_cursor &&
@@ -783,11 +784,8 @@ static int try_to_unmap_file(struct page *page)
          * in locked vmas).  Reset cursor on all unreserved nonlinear
          * vmas, now forgetting on which ones it had fallen behind.
          */
-        list_for_each_entry(vma, &mapping->i_mmap_nonlinear,
-                                                shared.vm_set.list) {
-                if (!(vma->vm_flags & VM_RESERVED))
-                        vma->vm_private_data = NULL;
-        }
+        list_for_each_entry(vma, &mapping->i_mmap_nonlinear, shared.vm_set.list)
+                vma->vm_private_data = NULL;
 out:
         spin_unlock(&mapping->i_mmap_lock);
         return ret;
diff --git a/mm/swap.c b/mm/swap.c
index d09cf7f03e76..73d351439ef6 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -34,8 +34,6 @@
 /* How many pages do we try to swap or page in/out together? */
 int page_cluster;
 
-#ifdef CONFIG_HUGETLB_PAGE
-
 void put_page(struct page *page)
 {
         if (unlikely(PageCompound(page))) {
@@ -52,7 +50,6 @@ void put_page(struct page *page)
                 __page_cache_release(page);
 }
 EXPORT_SYMBOL(put_page);
-#endif
 
 /*
  * Writeback is about to end against a page which has been marked for immediate
diff --git a/mm/truncate.c b/mm/truncate.c
index 29c18f68dc35..9173ab500604 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -282,8 +282,8 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                                          * Zap the rest of the file in one hit.
                                          */
                                         unmap_mapping_range(mapping,
-                                            page_index << PAGE_CACHE_SHIFT,
-                                            (end - page_index + 1)
+                                           (loff_t)page_index<<PAGE_CACHE_SHIFT,
+                                           (loff_t)(end - page_index + 1)
                                                         << PAGE_CACHE_SHIFT,
                                             0);
                                         did_range_unmap = 1;
@@ -292,7 +292,7 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                                          * Just zap this page
                                          */
                                         unmap_mapping_range(mapping,
-                                          page_index << PAGE_CACHE_SHIFT,
+                                          (loff_t)page_index<<PAGE_CACHE_SHIFT,
                                           PAGE_CACHE_SIZE, 0);
                                 }
                         }