Merge branch 'akpm' (patches from Andrew)

Merge first patch-bomb from Andrew Morton:

 - A few hotfixes which missed 4.4 becasue I was asleep.  cc'ed to
   -stable

 - A few misc fixes

 - OCFS2 updates

 - Part of MM.  Including pretty large changes to page-flags handling
   and to thp management which have been buffered up for 2-3 cycles now.

  I have a lot of MM material this time.

[ It turns out the THP part wasn't quite ready, so that got dropped from
  this series  - Linus ]

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (117 commits)
  zsmalloc: reorganize struct size_class to pack 4 bytes hole
  mm/zbud.c: use list_last_entry() instead of list_tail_entry()
  zram/zcomp: do not zero out zcomp private pages
  zram: pass gfp from zcomp frontend to backend
  zram: try vmalloc() after kmalloc()
  zram/zcomp: use GFP_NOIO to allocate streams
  mm: add tracepoint for scanning pages
  drivers/base/memory.c: fix kernel warning during memory hotplug on ppc64
  mm/page_isolation: use macro to judge the alignment
  mm: fix noisy sparse warning in LIBCFS_ALLOC_PRE()
  mm: rework virtual memory accounting
  include/linux/memblock.h: fix ordering of 'flags' argument in comments
  mm: move lru_to_page to mm_inline.h
  Documentation/filesystems: describe the shared memory usage/accounting
  memory-hotplug: don't BUG() in register_memory_resource()
  hugetlb: make mm and fs code explicitly non-modular
  mm/swapfile.c: use list_for_each_entry_safe in free_swap_count_continuations
  mm: /proc/pid/clear_refs: no need to clear VM_SOFTDIRTY in clear_soft_dirty_pmd()
  mm: make sure isolate_lru_page() is never called for tail page
  vmstat: make vmstat_updater deferrable again and shut down on idle
  ...

176 files changed, 1852 insertions, 1284 deletions

diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 402ab99e409f..e95aa1c6eadf 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -169,6 +169,9 @@ read the file /proc/PID/status:
   VmLck:         0 kB
   VmHWM:       476 kB
   VmRSS:       476 kB
+  RssAnon:             352 kB
+  RssFile:             120 kB
+  RssShmem:              4 kB
   VmData:      156 kB
   VmStk:        88 kB
   VmExe:        68 kB
@@ -231,14 +234,20 @@ Table 1-2: Contents of the status files (as of 4.1)
  VmSize                      total program size
  VmLck                       locked memory size
  VmHWM                       peak resident set size ("high water mark")
- VmRSS                       size of memory portions
+ VmRSS                       size of memory portions. It contains the three
+                             following parts (VmRSS = RssAnon + RssFile + RssShmem)
+ RssAnon                     size of resident anonymous memory
+ RssFile                     size of resident file mappings
+ RssShmem                    size of resident shmem memory (includes SysV shm,
+                             mapping of tmpfs and shared anonymous mappings)
  VmData                      size of data, stack, and text segments
  VmStk                       size of data, stack, and text segments
  VmExe                       size of text segment
  VmLib                       size of shared library code
  VmPTE                       size of page table entries
  VmPMD                       size of second level page tables
- VmSwap                      size of swap usage (the number of referred swapents)
+ VmSwap                      amount of swap used by anonymous private data
+                             (shmem swap usage is not included)
  HugetlbPages                size of hugetlb memory portions
  Threads                     number of threads
  SigQ                        number of signals queued/max. number for queue
@@ -265,7 +274,8 @@ Table 1-3: Contents of the statm files (as of 2.6.8-rc3)
  Field    Content
  size     total program size (pages)            (same as VmSize in status)
  resident size of memory portions (pages)       (same as VmRSS in status)
- shared   number of pages that are shared       (i.e. backed by a file)
+ shared   number of pages that are shared       (i.e. backed by a file, same
+                                                as RssFile+RssShmem in status)
  trs      number of pages that are 'code'       (not including libs; broken,
                                                         includes data segment)
  lrs      number of pages of library            (always 0 on 2.6)
@@ -459,7 +469,10 @@ and a page is modified, the file page is replaced by a private anonymous copy.
 hugetlbfs page which is *not* counted in "RSS" or "PSS" field for historical
 reasons. And these are not included in {Shared,Private}_{Clean,Dirty} field.
 "Swap" shows how much would-be-anonymous memory is also used, but out on swap.
-"SwapPss" shows proportional swap share of this mapping.
+For shmem mappings, "Swap" includes also the size of the mapped (and not
+replaced by copy-on-write) part of the underlying shmem object out on swap.
+"SwapPss" shows proportional swap share of this mapping. Unlike "Swap", this
+does not take into account swapped out page of underlying shmem objects.
 "Locked" indicates whether the mapping is locked in memory or not.
 
 "VmFlags" field deserves a separate description. This member represents the kernel
@@ -842,6 +855,7 @@ Dirty:             968 kB
 Writeback:           0 kB
 AnonPages:      861800 kB
 Mapped:         280372 kB
+Shmem:             644 kB
 Slab:           284364 kB
 SReclaimable:   159856 kB
 SUnreclaim:     124508 kB
@@ -898,6 +912,7 @@ MemAvailable: An estimate of how much memory is available for starting new
    AnonPages: Non-file backed pages mapped into userspace page tables
 AnonHugePages: Non-file backed huge pages mapped into userspace page tables
       Mapped: files which have been mmaped, such as libraries
+       Shmem: Total memory used by shared memory (shmem) and tmpfs
         Slab: in-kernel data structures cache
 SReclaimable: Part of Slab, that might be reclaimed, such as caches
   SUnreclaim: Part of Slab, that cannot be reclaimed on memory pressure
diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
index 98ef55124158..d392e1505f17 100644
--- a/Documentation/filesystems/tmpfs.txt
+++ b/Documentation/filesystems/tmpfs.txt
@@ -17,10 +17,10 @@ RAM, where you have to create an ordinary filesystem on top. Ramdisks
 cannot swap and you do not have the possibility to resize them. 
 
 Since tmpfs lives completely in the page cache and on swap, all tmpfs
-pages currently in memory will show up as cached. It will not show up
-as shared or something like that. Further on you can check the actual
-RAM+swap use of a tmpfs instance with df(1) and du(1).
-
+pages will be shown as "Shmem" in /proc/meminfo and "Shared" in
+free(1). Notice that these counters also include shared memory
+(shmem, see ipcs(1)). The most reliable way to get the count is
+using df(1) and du(1).
 
 tmpfs has the following uses:
 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index b7d44871effc..168fd79dc697 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -608,6 +608,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         cut the overhead, others just disable the usage. So
                         only cgroup_disable=memory is actually worthy}
 
+        cgroup.memory=  [KNL] Pass options to the cgroup memory controller.
+                        Format: <string>
+                        nosocket -- Disable socket memory accounting.
+
         checkreqprot    [SELINUX] Set initial checkreqprot flag value.
                         Format: { "0" | "1" }
                         See security/selinux/Kconfig help text.
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 8ee925c046aa..89a887c76629 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -42,6 +42,8 @@ Currently, these files are in /proc/sys/vm:
 - min_slab_ratio
 - min_unmapped_ratio
 - mmap_min_addr
+- mmap_rnd_bits
+- mmap_rnd_compat_bits
 - nr_hugepages
 - nr_overcommit_hugepages
 - nr_trim_pages         (only if CONFIG_MMU=n)
@@ -485,6 +487,33 @@ against future potential kernel bugs.
 
 ==============================================================
 
+mmap_rnd_bits:
+
+This value can be used to select the number of bits to use to
+determine the random offset to the base address of vma regions
+resulting from mmap allocations on architectures which support
+tuning address space randomization.  This value will be bounded
+by the architecture's minimum and maximum supported values.
+
+This value can be changed after boot using the
+/proc/sys/vm/mmap_rnd_bits tunable
+
+==============================================================
+
+mmap_rnd_compat_bits:
+
+This value can be used to select the number of bits to use to
+determine the random offset to the base address of vma regions
+resulting from mmap allocations for applications run in
+compatibility mode on architectures which support tuning address
+space randomization.  This value will be bounded by the
+architecture's minimum and maximum supported values.
+
+This value can be changed after boot using the
+/proc/sys/vm/mmap_rnd_compat_bits tunable
+
+==============================================================
+
 nr_hugepages
 
 Change the minimum size of the hugepage pool.
diff --git a/arch/Kconfig b/arch/Kconfig
index 4e949e58b192..ba1b626bca00 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -511,6 +511,74 @@ config ARCH_HAS_ELF_RANDOMIZE
           - arch_mmap_rnd()
           - arch_randomize_brk()
 
+config HAVE_ARCH_MMAP_RND_BITS
+        bool
+        help
+          An arch should select this symbol if it supports setting a variable
+          number of bits for use in establishing the base address for mmap
+          allocations, has MMU enabled and provides values for both:
+          - ARCH_MMAP_RND_BITS_MIN
+          - ARCH_MMAP_RND_BITS_MAX
+
+config ARCH_MMAP_RND_BITS_MIN
+        int
+
+config ARCH_MMAP_RND_BITS_MAX
+        int
+
+config ARCH_MMAP_RND_BITS_DEFAULT
+        int
+
+config ARCH_MMAP_RND_BITS
+        int "Number of bits to use for ASLR of mmap base address" if EXPERT
+        range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX
+        default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT
+        default ARCH_MMAP_RND_BITS_MIN
+        depends on HAVE_ARCH_MMAP_RND_BITS
+        help
+          This value can be used to select the number of bits to use to
+          determine the random offset to the base address of vma regions
+          resulting from mmap allocations. This value will be bounded
+          by the architecture's minimum and maximum supported values.
+
+          This value can be changed after boot using the
+          /proc/sys/vm/mmap_rnd_bits tunable
+
+config HAVE_ARCH_MMAP_RND_COMPAT_BITS
+        bool
+        help
+          An arch should select this symbol if it supports running applications
+          in compatibility mode, supports setting a variable number of bits for
+          use in establishing the base address for mmap allocations, has MMU
+          enabled and provides values for both:
+          - ARCH_MMAP_RND_COMPAT_BITS_MIN
+          - ARCH_MMAP_RND_COMPAT_BITS_MAX
+
+config ARCH_MMAP_RND_COMPAT_BITS_MIN
+        int
+
+config ARCH_MMAP_RND_COMPAT_BITS_MAX
+        int
+
+config ARCH_MMAP_RND_COMPAT_BITS_DEFAULT
+        int
+
+config ARCH_MMAP_RND_COMPAT_BITS
+        int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT
+        range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX
+        default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT
+        default ARCH_MMAP_RND_COMPAT_BITS_MIN
+        depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS
+        help
+          This value can be used to select the number of bits to use to
+          determine the random offset to the base address of vma regions
+          resulting from mmap allocations for compatible applications This
+          value will be bounded by the architecture's minimum and maximum
+          supported values.
+
+          This value can be changed after boot using the
+          /proc/sys/vm/mmap_rnd_compat_bits tunable
+
 config HAVE_COPY_THREAD_TLS
         bool
         help
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 84b1b21b08ae..4e489cc5c45e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -37,6 +37,7 @@ config ARM
         select HAVE_ARCH_BITREVERSE if (CPU_32v7M || CPU_32v7) && !CPU_32v6
         select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL && !CPU_ENDIAN_BE32 && MMU
         select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32 && MMU
+        select HAVE_ARCH_MMAP_RND_BITS if MMU
         select HAVE_ARCH_SECCOMP_FILTER if (AEABI && !OABI_COMPAT)
         select HAVE_ARCH_TRACEHOOK
         select HAVE_ARM_SMCCC if CPU_V7
@@ -311,6 +312,14 @@ config MMU
           Select if you want MMU-based virtualised addressing space
           support by paged memory management. If unsure, say 'Y'.
 
+config ARCH_MMAP_RND_BITS_MIN
+        default 8
+
+config ARCH_MMAP_RND_BITS_MAX
+        default 14 if PAGE_OFFSET=0x40000000
+        default 15 if PAGE_OFFSET=0x80000000
+        default 16
+
 #
 # The "ARM system type" choice list is ordered alphabetically by option
 # text.  Please add new entries in the option alphabetic order.
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 407dc786583a..4b4058db0781 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -173,8 +173,7 @@ unsigned long arch_mmap_rnd(void)
 {
         unsigned long rnd;
 
-        /* 8 bits of randomness in 20 address space bits */
-        rnd = (unsigned long)get_random_int() % (1 << 8);
+        rnd = (unsigned long)get_random_int() & ((1 << mmap_rnd_bits) - 1);
 
         return rnd << PAGE_SHIFT;
 }
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 4d5b416e2e4b..6be3fa2310ee 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -52,6 +52,8 @@ config ARM64
         select HAVE_ARCH_JUMP_LABEL
         select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP && !(ARM64_16K_PAGES && ARM64_VA_BITS_48)
         select HAVE_ARCH_KGDB
+        select HAVE_ARCH_MMAP_RND_BITS
+        select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
         select HAVE_ARCH_SECCOMP_FILTER
         select HAVE_ARCH_TRACEHOOK
         select HAVE_BPF_JIT
@@ -107,6 +109,33 @@ config ARCH_PHYS_ADDR_T_64BIT
 config MMU
         def_bool y
 
+config ARCH_MMAP_RND_BITS_MIN
+       default 14 if ARM64_64K_PAGES
+       default 16 if ARM64_16K_PAGES
+       default 18
+
+# max bits determined by the following formula:
+#  VA_BITS - PAGE_SHIFT - 3
+config ARCH_MMAP_RND_BITS_MAX
+       default 19 if ARM64_VA_BITS=36
+       default 24 if ARM64_VA_BITS=39
+       default 27 if ARM64_VA_BITS=42
+       default 30 if ARM64_VA_BITS=47
+       default 29 if ARM64_VA_BITS=48 && ARM64_64K_PAGES
+       default 31 if ARM64_VA_BITS=48 && ARM64_16K_PAGES
+       default 33 if ARM64_VA_BITS=48
+       default 14 if ARM64_64K_PAGES
+       default 16 if ARM64_16K_PAGES
+       default 18
+
+config ARCH_MMAP_RND_COMPAT_BITS_MIN
+       default 7 if ARM64_64K_PAGES
+       default 9 if ARM64_16K_PAGES
+       default 11
+
+config ARCH_MMAP_RND_COMPAT_BITS_MAX
+       default 16
+
 config NO_IOPORT_MAP
         def_bool y if !PCI
 
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index ed177475dd8c..4c893b5189dd 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -51,8 +51,12 @@ unsigned long arch_mmap_rnd(void)
 {
         unsigned long rnd;
 
-        rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
-
+#ifdef CONFIG_COMPAT
+        if (test_thread_flag(TIF_32BIT))
+                rnd = (unsigned long)get_random_int() & ((1 << mmap_rnd_compat_bits) - 1);
+        else
+#endif
+                rnd = (unsigned long)get_random_int() & ((1 << mmap_rnd_bits) - 1);
         return rnd << PAGE_SHIFT;
 }
 
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 60e02f7747ff..9cd607b06964 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -2332,8 +2332,7 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
          */
         insert_vm_struct(mm, vma);
 
-        vm_stat_account(vma->vm_mm, vma->vm_flags, vma->vm_file,
-                                                        vma_pages(vma));
+        vm_stat_account(vma->vm_mm, vma->vm_flags, vma_pages(vma));
         up_write(&task->mm->mmap_sem);
 
         /*
diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
index 0392112a5d70..a5ecef7188ba 100644
--- a/arch/m32r/kernel/setup.c
+++ b/arch/m32r/kernel/setup.c
@@ -81,7 +81,10 @@ static struct resource code_resource = {
 };
 
 unsigned long memory_start;
+EXPORT_SYMBOL(memory_start);
+
 unsigned long memory_end;
+EXPORT_SYMBOL(memory_end);
 
 void __init setup_arch(char **);
 int get_cpuinfo(char *);
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 11634fa7ab3c..ad4840f86be1 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -767,7 +767,7 @@ static int __init spufs_init(void)
         ret = -ENOMEM;
         spufs_inode_cache = kmem_cache_create("spufs_inode_cache",
                         sizeof(struct spufs_inode_info), 0,
-                        SLAB_HWCACHE_ALIGN, spufs_init_once);
+                        SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT, spufs_init_once);
 
         if (!spufs_inode_cache)
                 goto out;
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 63b039899a5e..aa34af0a0b26 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -603,10 +603,7 @@ static void gmap_zap_swap_entry(swp_entry_t entry, struct mm_struct *mm)
         else if (is_migration_entry(entry)) {
                 struct page *page = migration_entry_to_page(entry);
 
-                if (PageAnon(page))
-                        dec_mm_counter(mm, MM_ANONPAGES);
-                else
-                        dec_mm_counter(mm, MM_FILEPAGES);
+                dec_mm_counter(mm, mm_counter(page));
         }
         free_swap_and_cache(entry);
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 5d2293417946..24f362bf3ec6 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -83,6 +83,8 @@ config X86
         select HAVE_ARCH_KASAN                  if X86_64 && SPARSEMEM_VMEMMAP
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_KMEMCHECK
+        select HAVE_ARCH_MMAP_RND_BITS          if MMU
+        select HAVE_ARCH_MMAP_RND_COMPAT_BITS   if MMU && COMPAT
         select HAVE_ARCH_SECCOMP_FILTER
         select HAVE_ARCH_SOFT_DIRTY             if X86_64
         select HAVE_ARCH_TRACEHOOK
@@ -184,6 +186,20 @@ config HAVE_LATENCYTOP_SUPPORT
 config MMU
         def_bool y
 
+config ARCH_MMAP_RND_BITS_MIN
+        default 28 if 64BIT
+        default 8
+
+config ARCH_MMAP_RND_BITS_MAX
+        default 32 if 64BIT
+        default 16
+
+config ARCH_MMAP_RND_COMPAT_BITS_MIN
+        default 8
+
+config ARCH_MMAP_RND_COMPAT_BITS_MAX
+        default 16
+
 config SBUS
         bool
 
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 844b06d67df4..96bd1e2bffaf 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -69,14 +69,14 @@ unsigned long arch_mmap_rnd(void)
 {
         unsigned long rnd;
 
-        /*
-         *  8 bits of randomness in 32bit mmaps, 20 address space bits
-         * 28 bits of randomness in 64bit mmaps, 40 address space bits
-         */
         if (mmap_is_ia32())
-                rnd = (unsigned long)get_random_int() % (1<<8);
+#ifdef CONFIG_COMPAT
+                rnd = (unsigned long)get_random_int() & ((1 << mmap_rnd_compat_bits) - 1);
+#else
+                rnd = (unsigned long)get_random_int() & ((1 << mmap_rnd_bits) - 1);
+#endif
         else
-                rnd = (unsigned long)get_random_int() % (1<<28);
+                rnd = (unsigned long)get_random_int() & ((1 << mmap_rnd_bits) - 1);
 
         return rnd << PAGE_SHIFT;
 }
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 25425d3f2575..619fe584a44c 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -450,8 +450,7 @@ memory_probe_store(struct device *dev, struct device_attribute *attr,
                    const char *buf, size_t count)
 {
         u64 phys_addr;
-        int nid;
-        int i, ret;
+        int nid, ret;
         unsigned long pages_per_block = PAGES_PER_SECTION * sections_per_block;
 
         ret = kstrtoull(buf, 0, &phys_addr);
@@ -461,15 +460,12 @@ memory_probe_store(struct device *dev, struct device_attribute *attr,
         if (phys_addr & ((pages_per_block << PAGE_SHIFT) - 1))
                 return -EINVAL;
 
-        for (i = 0; i < sections_per_block; i++) {
-                nid = memory_add_physaddr_to_nid(phys_addr);
-                ret = add_memory(nid, phys_addr,
-                                 PAGES_PER_SECTION << PAGE_SHIFT);
-                if (ret)
-                        goto out;
+        nid = memory_add_physaddr_to_nid(phys_addr);
+        ret = add_memory(nid, phys_addr,
+                         MIN_MEMORY_BLOCK_SIZE * sections_per_block);
 
-                phys_addr += MIN_MEMORY_BLOCK_SIZE;
-        }
+        if (ret)
+                goto out;
 
         ret = count;
 out:
@@ -618,7 +614,6 @@ static int init_memory_block(struct memory_block **memory,
                         base_memory_block_id(scn_nr) * sections_per_block;
         mem->end_section_nr = mem->start_section_nr + sections_per_block - 1;
         mem->state = state;
-        mem->section_count++;
         start_pfn = section_nr_to_pfn(mem->start_section_nr);
         mem->phys_device = arch_get_memory_phys_device(start_pfn);
 
@@ -672,6 +667,7 @@ int register_new_memory(int nid, struct mem_section *section)
                 ret = init_memory_block(&mem, section, MEM_OFFLINE);
                 if (ret)
                         goto out;
+                mem->section_count++;
         }
 
         if (mem->section_count == sections_per_block)
@@ -692,7 +688,7 @@ unregister_memory(struct memory_block *memory)
         device_unregister(&memory->dev);
 }
 
-static int remove_memory_block(unsigned long node_id,
+static int remove_memory_section(unsigned long node_id,
                                struct mem_section *section, int phys_device)
 {
         struct memory_block *mem;
@@ -716,7 +712,7 @@ int unregister_memory_section(struct mem_section *section)
         if (!present_section(section))
                 return -EINVAL;
 
-        return remove_memory_block(0, section, 0);
+        return remove_memory_section(0, section, 0);
 }
 #endif /* CONFIG_MEMORY_HOTREMOVE */
 
diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
index 5cb13ca3a3ac..3ef42e563bb5 100644
--- a/drivers/block/zram/zcomp.c
+++ b/drivers/block/zram/zcomp.c
@@ -74,18 +74,18 @@ static void zcomp_strm_free(struct zcomp *comp, struct zcomp_strm *zstrm)
  * allocate new zcomp_strm structure with ->private initialized by
  * backend, return NULL on error
  */
-static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
+static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp, gfp_t flags)
 {
-        struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_KERNEL);
+        struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), flags);
         if (!zstrm)
                 return NULL;
 
-        zstrm->private = comp->backend->create();
+        zstrm->private = comp->backend->create(flags);
         /*
          * allocate 2 pages. 1 for compressed data, plus 1 extra for the
          * case when compressed size is larger than the original one
          */
-        zstrm->buffer = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 1);
+        zstrm->buffer = (void *)__get_free_pages(flags | __GFP_ZERO, 1);
         if (!zstrm->private || !zstrm->buffer) {
                 zcomp_strm_free(comp, zstrm);
                 zstrm = NULL;
@@ -120,8 +120,16 @@ static struct zcomp_strm *zcomp_strm_multi_find(struct zcomp *comp)
                 /* allocate new zstrm stream */
                 zs->avail_strm++;
                 spin_unlock(&zs->strm_lock);
-
-                zstrm = zcomp_strm_alloc(comp);
+                /*
+                 * This function can be called in swapout/fs write path
+                 * so we can't use GFP_FS|IO. And it assumes we already
+                 * have at least one stream in zram initialization so we
+                 * don't do best effort to allocate more stream in here.
+                 * A default stream will work well without further multiple
+                 * streams. That's why we use NORETRY | NOWARN.
+                 */
+                zstrm = zcomp_strm_alloc(comp, GFP_NOIO | __GFP_NORETRY |
+                                        __GFP_NOWARN);
                 if (!zstrm) {
                         spin_lock(&zs->strm_lock);
                         zs->avail_strm--;
@@ -209,7 +217,7 @@ static int zcomp_strm_multi_create(struct zcomp *comp, int max_strm)
         zs->max_strm = max_strm;
         zs->avail_strm = 1;
 
-        zstrm = zcomp_strm_alloc(comp);
+        zstrm = zcomp_strm_alloc(comp, GFP_KERNEL);
         if (!zstrm) {
                 kfree(zs);
                 return -ENOMEM;
@@ -259,7 +267,7 @@ static int zcomp_strm_single_create(struct zcomp *comp)
 
         comp->stream = zs;
         mutex_init(&zs->strm_lock);
-        zs->zstrm = zcomp_strm_alloc(comp);
+        zs->zstrm = zcomp_strm_alloc(comp, GFP_KERNEL);
         if (!zs->zstrm) {
                 kfree(zs);
                 return -ENOMEM;
diff --git a/drivers/block/zram/zcomp.h b/drivers/block/zram/zcomp.h
index 46e2b9f8f1f0..b7d2a4bcae54 100644
--- a/drivers/block/zram/zcomp.h
+++ b/drivers/block/zram/zcomp.h
@@ -33,7 +33,7 @@ struct zcomp_backend {
         int (*decompress)(const unsigned char *src, size_t src_len,
                         unsigned char *dst);
 
-        void *(*create)(void);
+        void *(*create)(gfp_t flags);
         void (*destroy)(void *private);
 
         const char *name;
diff --git a/drivers/block/zram/zcomp_lz4.c b/drivers/block/zram/zcomp_lz4.c
index f2afb7e988c3..0110086accba 100644
--- a/drivers/block/zram/zcomp_lz4.c
+++ b/drivers/block/zram/zcomp_lz4.c
@@ -10,17 +10,26 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/lz4.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
 
 #include "zcomp_lz4.h"
 
-static void *zcomp_lz4_create(void)
+static void *zcomp_lz4_create(gfp_t flags)
 {
-        return kzalloc(LZ4_MEM_COMPRESS, GFP_KERNEL);
+        void *ret;
+
+        ret = kmalloc(LZ4_MEM_COMPRESS, flags);
+        if (!ret)
+                ret = __vmalloc(LZ4_MEM_COMPRESS,
+                                flags | __GFP_HIGHMEM,
+                                PAGE_KERNEL);
+        return ret;
 }
 
 static void zcomp_lz4_destroy(void *private)
 {
-        kfree(private);
+        kvfree(private);
 }
 
 static int zcomp_lz4_compress(const unsigned char *src, unsigned char *dst,
diff --git a/drivers/block/zram/zcomp_lzo.c b/drivers/block/zram/zcomp_lzo.c
index da1bc47d588e..ed7a1f0549ec 100644
--- a/drivers/block/zram/zcomp_lzo.c
+++ b/drivers/block/zram/zcomp_lzo.c
@@ -10,17 +10,26 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/lzo.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
 
 #include "zcomp_lzo.h"
 
-static void *lzo_create(void)
+static void *lzo_create(gfp_t flags)
 {
-        return kzalloc(LZO1X_MEM_COMPRESS, GFP_KERNEL);
+        void *ret;
+
+        ret = kmalloc(LZO1X_MEM_COMPRESS, flags);
+        if (!ret)
+                ret = __vmalloc(LZO1X_MEM_COMPRESS,
+                                flags | __GFP_HIGHMEM,
+                                PAGE_KERNEL);
+        return ret;
 }
 
 static void lzo_destroy(void *private)
 {
-        kfree(private);
+        kvfree(private);
 }
 
 static int lzo_compress(const unsigned char *src, unsigned char *dst,
diff --git a/drivers/staging/lustre/lustre/llite/super25.c b/drivers/staging/lustre/lustre/llite/super25.c
index 7a9fafc67693..86c371ef71ea 100644
--- a/drivers/staging/lustre/lustre/llite/super25.c
+++ b/drivers/staging/lustre/lustre/llite/super25.c
@@ -106,7 +106,8 @@ static int __init init_lustre_lite(void)
         rc = -ENOMEM;
         ll_inode_cachep = kmem_cache_create("lustre_inode_cache",
                                             sizeof(struct ll_inode_info),
-                                            0, SLAB_HWCACHE_ALIGN, NULL);
+                                            0, SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT,
+                                            NULL);
         if (ll_inode_cachep == NULL)
                 goto out_cache;
 
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 6caca025019d..072e7599583a 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -575,7 +575,7 @@ static int v9fs_init_inode_cache(void)
         v9fs_inode_cache = kmem_cache_create("v9fs_inode_cache",
                                           sizeof(struct v9fs_inode),
                                           0, (SLAB_RECLAIM_ACCOUNT|
-                                              SLAB_MEM_SPREAD),
+                                              SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                           v9fs_inode_init_once);
         if (!v9fs_inode_cache)
                 return -ENOMEM;
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index 4d4a0df8344f..c9fdfb112933 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -271,7 +271,7 @@ static int __init init_inodecache(void)
         adfs_inode_cachep = kmem_cache_create("adfs_inode_cache",
                                              sizeof(struct adfs_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (adfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 8836df5f1e11..2a6713b6b9f4 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -132,7 +132,7 @@ static int __init init_inodecache(void)
         affs_inode_cachep = kmem_cache_create("affs_inode_cache",
                                              sizeof(struct affs_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (affs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/afs/super.c b/fs/afs/super.c
index 1fb4a5129f7d..81afefe7d8a6 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -91,7 +91,7 @@ int __init afs_fs_init(void)
         afs_inode_cachep = kmem_cache_create("afs_inode_cache",
                                              sizeof(struct afs_vnode),
                                              0,
-                                             SLAB_HWCACHE_ALIGN,
+                                             SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT,
                                              afs_i_init_once);
         if (!afs_inode_cachep) {
                 printk(KERN_NOTICE "kAFS: Failed to allocate inode cache\n");
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 25250fa87086..cc0e08252913 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -434,7 +434,7 @@ befs_init_inodecache(void)
         befs_inode_cachep = kmem_cache_create("befs_inode_cache",
                                               sizeof (struct befs_inode_info),
                                               0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                               init_once);
         if (befs_inode_cachep == NULL) {
                 pr_err("%s: Couldn't initialize inode slabcache\n", __func__);
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index fdcb4d69f430..1e5c896f6b79 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -270,7 +270,7 @@ static int __init init_inodecache(void)
         bfs_inode_cachep = kmem_cache_create("bfs_inode_cache",
                                              sizeof(struct bfs_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (bfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index d878e4860fb7..81c0705558be 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -437,7 +437,7 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,
 
         if (!ops->rw_page || bdev_get_integrity(bdev))
                 return -EOPNOTSUPP;
-        result = blk_queue_enter(bdev->bd_queue, GFP_KERNEL);
+        result = blk_queue_enter(bdev->bd_queue, GFP_NOIO);
         if (result)
                 return result;
 
@@ -595,7 +595,7 @@ void __init bdev_cache_init(void)
 
         bdev_cachep = kmem_cache_create("bdev_cache", sizeof(struct bdev_inode),
                         0, (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
-                                SLAB_MEM_SPREAD|SLAB_PANIC),
+                                SLAB_MEM_SPREAD|SLAB_ACCOUNT|SLAB_PANIC),
                         init_once);
         err = register_filesystem(&bd_type);
         if (err)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3b8856e182ae..394017831692 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9161,7 +9161,8 @@ int btrfs_init_cachep(void)
 {
         btrfs_inode_cachep = kmem_cache_create("btrfs_inode",
                         sizeof(struct btrfs_inode), 0,
-                        SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD, init_once);
+                        SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD | SLAB_ACCOUNT,
+                        init_once);
         if (!btrfs_inode_cachep)
                 goto fail;
 
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index f446afada328..ca4d5e8457f1 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -639,8 +639,8 @@ static int __init init_caches(void)
         ceph_inode_cachep = kmem_cache_create("ceph_inode_info",
                                       sizeof(struct ceph_inode_info),
                                       __alignof__(struct ceph_inode_info),
-                                      (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD),
-                                      ceph_inode_init_once);
+                                      SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                      SLAB_ACCOUNT, ceph_inode_init_once);
         if (ceph_inode_cachep == NULL)
                 return -ENOMEM;
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index b7fcb3151103..c4c1169814b2 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1092,7 +1092,7 @@ cifs_init_inodecache(void)
         cifs_inode_cachep = kmem_cache_create("cifs_inode_cache",
                                               sizeof(struct cifsInodeInfo),
                                               0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                               cifs_init_once);
         if (cifs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/coda/inode.c b/fs/coda/inode.c
index cac1390b87a3..57e81cbba0fa 100644
--- a/fs/coda/inode.c
+++ b/fs/coda/inode.c
@@ -74,9 +74,9 @@ static void init_once(void *foo)
 int __init coda_init_inodecache(void)
 {
         coda_inode_cachep = kmem_cache_create("coda_inode_cache",
-                                sizeof(struct coda_inode_info),
-                                0, SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
-                                init_once);
+                                sizeof(struct coda_inode_info), 0,
+                                SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                SLAB_ACCOUNT, init_once);
         if (coda_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/fs/dcache.c b/fs/dcache.c
index 8d38cd07b207..b4539e84e577 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1571,7 +1571,8 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
         dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
         if (name->len > DNAME_INLINE_LEN-1) {
                 size_t size = offsetof(struct external_name, name[1]);
-                struct external_name *p = kmalloc(size + name->len, GFP_KERNEL);
+                struct external_name *p = kmalloc(size + name->len,
+                                                  GFP_KERNEL_ACCOUNT);
                 if (!p) {
                         kmem_cache_free(dentry_cache, dentry); 
                         return NULL;
@@ -3415,7 +3416,7 @@ static void __init dcache_init(void)
          * of the dcache. 
          */
         dentry_cache = KMEM_CACHE(dentry,
-                SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|SLAB_MEM_SPREAD);
+                SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|SLAB_MEM_SPREAD|SLAB_ACCOUNT);
 
         /* Hash may have been set up in dcache_init_early */
         if (!hashdist)
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 4f4d0474bee9..e25b6b06bacf 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -663,6 +663,7 @@ static struct ecryptfs_cache_info {
         struct kmem_cache **cache;
         const char *name;
         size_t size;
+        unsigned long flags;
         void (*ctor)(void *obj);
 } ecryptfs_cache_infos[] = {
         {
@@ -684,6 +685,7 @@ static struct ecryptfs_cache_info {
                 .cache = &ecryptfs_inode_info_cache,
                 .name = "ecryptfs_inode_cache",
                 .size = sizeof(struct ecryptfs_inode_info),
+                .flags = SLAB_ACCOUNT,
                 .ctor = inode_info_init_once,
         },
         {
@@ -755,8 +757,8 @@ static int ecryptfs_init_kmem_caches(void)
                 struct ecryptfs_cache_info *info;
 
                 info = &ecryptfs_cache_infos[i];
-                *(info->cache) = kmem_cache_create(info->name, info->size,
-                                0, SLAB_HWCACHE_ALIGN, info->ctor);
+                *(info->cache) = kmem_cache_create(info->name, info->size, 0,
+                                SLAB_HWCACHE_ALIGN | info->flags, info->ctor);
                 if (!*(info->cache)) {
                         ecryptfs_free_kmem_caches();
                         ecryptfs_printk(KERN_WARNING, "%s: "
diff --git a/fs/efs/super.c b/fs/efs/super.c
index c8411a30f7da..cb68dac4f9d3 100644
--- a/fs/efs/super.c
+++ b/fs/efs/super.c
@@ -94,9 +94,9 @@ static void init_once(void *foo)
 static int __init init_inodecache(void)
 {
         efs_inode_cachep = kmem_cache_create("efs_inode_cache",
-                                sizeof(struct efs_inode_info),
-                                0, SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
-                                init_once);
+                                sizeof(struct efs_inode_info), 0,
+                                SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                SLAB_ACCOUNT, init_once);
         if (efs_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index b795c567b5e1..6658a50530a0 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -194,8 +194,8 @@ static int init_inodecache(void)
 {
         exofs_inode_cachep = kmem_cache_create("exofs_inode_cache",
                                 sizeof(struct exofs_i_info), 0,
-                                SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD,
-                                exofs_init_once);
+                                SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD |
+                                SLAB_ACCOUNT, exofs_init_once);
         if (exofs_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 748d35afc902..2a188413a2b0 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -203,7 +203,7 @@ static int __init init_inodecache(void)
         ext2_inode_cachep = kmem_cache_create("ext2_inode_cache",
                                              sizeof(struct ext2_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (ext2_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index c9ab67da6e5a..f1b56ff01208 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -966,7 +966,7 @@ static int __init init_inodecache(void)
         ext4_inode_cachep = kmem_cache_create("ext4_inode_cache",
                                              sizeof(struct ext4_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (ext4_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 3bf990b80026..6134832baaaf 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1541,8 +1541,9 @@ MODULE_ALIAS_FS("f2fs");
 
 static int __init init_inodecache(void)
 {
-        f2fs_inode_cachep = f2fs_kmem_cache_create("f2fs_inode_cache",
-                        sizeof(struct f2fs_inode_info));
+        f2fs_inode_cachep = kmem_cache_create("f2fs_inode_cache",
+                        sizeof(struct f2fs_inode_info), 0,
+                        SLAB_RECLAIM_ACCOUNT|SLAB_ACCOUNT, NULL);
         if (!f2fs_inode_cachep)
                 return -ENOMEM;
         return 0;
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 509411dd3698..6aece96df19f 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -677,7 +677,7 @@ static int __init fat_init_inodecache(void)
         fat_inode_cachep = kmem_cache_create("fat_inode_cache",
                                              sizeof(struct msdos_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (fat_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/file.c b/fs/file.c
index 1aed0add16a2..1fbc5c0555a9 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -37,11 +37,12 @@ static void *alloc_fdmem(size_t size)
          * vmalloc() if the allocation size will be considered "large" by the VM.
          */
         if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
-                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY);
+                void *data = kmalloc(size, GFP_KERNEL_ACCOUNT |
+                                     __GFP_NOWARN | __GFP_NORETRY);
                 if (data != NULL)
                         return data;
         }
-        return vmalloc(size);
+        return __vmalloc(size, GFP_KERNEL_ACCOUNT | __GFP_HIGHMEM, PAGE_KERNEL);
 }
 
 static void __free_fdtable(struct fdtable *fdt)
@@ -126,7 +127,7 @@ static struct fdtable * alloc_fdtable(unsigned int nr)
         if (unlikely(nr > sysctl_nr_open))
                 nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1;
 
-        fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL);
+        fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL_ACCOUNT);
         if (!fdt)
                 goto out;
         fdt->max_fds = nr;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 2913db2a5b99..4d69d5c0bedc 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1255,8 +1255,8 @@ static int __init fuse_fs_init(void)
         int err;
 
         fuse_inode_cachep = kmem_cache_create("fuse_inode",
-                                              sizeof(struct fuse_inode),
-                                              0, SLAB_HWCACHE_ALIGN,
+                                              sizeof(struct fuse_inode), 0,
+                                              SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT,
                                               fuse_inode_init_once);
         err = -ENOMEM;
         if (!fuse_inode_cachep)
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index 1d709d496364..f99f8e94de3f 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -114,7 +114,8 @@ static int __init init_gfs2_fs(void)
         gfs2_inode_cachep = kmem_cache_create("gfs2_inode",
                                               sizeof(struct gfs2_inode),
                                               0,  SLAB_RECLAIM_ACCOUNT|
-                                                  SLAB_MEM_SPREAD,
+                                                  SLAB_MEM_SPREAD|
+                                                  SLAB_ACCOUNT,
                                               gfs2_init_inode_once);
         if (!gfs2_inode_cachep)
                 goto fail;
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 4574fdd3d421..1ca95c232bb5 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -483,8 +483,8 @@ static int __init init_hfs_fs(void)
         int err;
 
         hfs_inode_cachep = kmem_cache_create("hfs_inode_cache",
-                sizeof(struct hfs_inode_info), 0, SLAB_HWCACHE_ALIGN,
-                hfs_init_once);
+                sizeof(struct hfs_inode_info), 0,
+                SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT, hfs_init_once);
         if (!hfs_inode_cachep)
                 return -ENOMEM;
         err = register_filesystem(&hfs_fs_type);
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 7302d96ae8bf..5d54490a136d 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -663,7 +663,7 @@ static int __init init_hfsplus_fs(void)
         int err;
 
         hfsplus_inode_cachep = kmem_cache_create("hfsplus_icache",
-                HFSPLUS_INODE_SIZE, 0, SLAB_HWCACHE_ALIGN,
+                HFSPLUS_INODE_SIZE, 0, SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT,
                 hfsplus_init_once);
         if (!hfsplus_inode_cachep)
                 return -ENOMEM;
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index f49be23e78aa..cfaa18c7a337 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -223,7 +223,7 @@ static struct inode *hostfs_alloc_inode(struct super_block *sb)
 {
         struct hostfs_inode_info *hi;
 
-        hi = kmalloc(sizeof(*hi), GFP_KERNEL);
+        hi = kmalloc(sizeof(*hi), GFP_KERNEL_ACCOUNT);
         if (hi == NULL)
                 return NULL;
         hi->fd = -1;
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index a561591896bd..458cf463047b 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -261,7 +261,7 @@ static int init_inodecache(void)
         hpfs_inode_cachep = kmem_cache_create("hpfs_inode_cache",
                                              sizeof(struct hpfs_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (hpfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index d8f51ee8126b..47789292a582 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -4,11 +4,11 @@
  * Nadia Yvette Chambers, 2002
  *
  * Copyright (C) 2002 Linus Torvalds.
+ * License: GPL
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
-#include <linux/module.h>
 #include <linux/thread_info.h>
 #include <asm/current.h>
 #include <linux/sched.h>                /* remove ASAP */
@@ -738,7 +738,7 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 /*
                  * The policy is initialized here even if we are creating a
                  * private inode because initialization simply creates an
-                 * an empty rb tree and calls spin_lock_init(), later when we
+                 * an empty rb tree and calls rwlock_init(), later when we
                  * call mpol_free_shared_policy() it will just return because
                  * the rb tree will still be empty.
                  */
@@ -1202,7 +1202,6 @@ static struct file_system_type hugetlbfs_fs_type = {
         .mount          = hugetlbfs_mount,
         .kill_sb        = kill_litter_super,
 };
-MODULE_ALIAS_FS("hugetlbfs");
 
 static struct vfsmount *hugetlbfs_vfsmount[HUGE_MAX_HSTATE];
 
@@ -1322,7 +1321,7 @@ static int __init init_hugetlbfs_fs(void)
         error = -ENOMEM;
         hugetlbfs_inode_cachep = kmem_cache_create("hugetlbfs_inode_cache",
                                         sizeof(struct hugetlbfs_inode_info),
-                                        0, 0, init_once);
+                                        0, SLAB_ACCOUNT, init_once);
         if (hugetlbfs_inode_cachep == NULL)
                 goto out2;
 
@@ -1356,26 +1355,4 @@ static int __init init_hugetlbfs_fs(void)
  out2:
         return error;
 }
-
-static void __exit exit_hugetlbfs_fs(void)
-{
-        struct hstate *h;
-        int i;
-
-
-        /*
-         * Make sure all delayed rcu free inodes are flushed before we
-         * destroy cache.
-         */
-        rcu_barrier();
-        kmem_cache_destroy(hugetlbfs_inode_cachep);
-        i = 0;
-        for_each_hstate(h)
-                kern_unmount(hugetlbfs_vfsmount[i++]);
-        unregister_filesystem(&hugetlbfs_fs_type);
-}
-
-module_init(init_hugetlbfs_fs)
-module_exit(exit_hugetlbfs_fs)
-
-MODULE_LICENSE("GPL");
+fs_initcall(init_hugetlbfs_fs)
diff --git a/fs/inode.c b/fs/inode.c
index 4230f66b7410..e491e54d2430 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1883,7 +1883,7 @@ void __init inode_init(void)
                                          sizeof(struct inode),
                                          0,
                                          (SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
-                                         SLAB_MEM_SPREAD),
+                                         SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                          init_once);
 
         /* Hash may have been set up in inode_init_early */
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 61abdc4920da..bcd2d41b318a 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -94,7 +94,7 @@ static int __init init_inodecache(void)
         isofs_inode_cachep = kmem_cache_create("isofs_inode_cache",
                                         sizeof(struct iso_inode_info),
                                         0, (SLAB_RECLAIM_ACCOUNT|
-                                        SLAB_MEM_SPREAD),
+                                        SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                         init_once);
         if (isofs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index d86c5e3176a1..bb080c272149 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -387,7 +387,7 @@ static int __init init_jffs2_fs(void)
         jffs2_inode_cachep = kmem_cache_create("jffs2_i",
                                              sizeof(struct jffs2_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              jffs2_i_init_once);
         if (!jffs2_inode_cachep) {
                 pr_err("error: Failed to initialise inode cache\n");
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 8f9176caf098..900925b5eb8c 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -898,7 +898,7 @@ static int __init init_jfs_fs(void)
 
         jfs_inode_cachep =
             kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
-                            SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
+                            SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
                             init_once);
         if (jfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index 742bf4a230e8..821973853340 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -541,14 +541,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
         if (!kn)
                 goto err_out1;
 
-        /*
-         * If the ino of the sysfs entry created for a kmem cache gets
-         * allocated from an ida layer, which is accounted to the memcg that
-         * owns the cache, the memcg will get pinned forever. So do not account
-         * ino ida allocations.
-         */
-        ret = ida_simple_get(&root->ino_ida, 1, 0,
-                             GFP_KERNEL | __GFP_NOACCOUNT);
+        ret = ida_simple_get(&root->ino_ida, 1, 0, GFP_KERNEL);
         if (ret < 0)
                 goto err_out2;
         kn->ino = ret;
diff --git a/fs/logfs/Kconfig b/fs/logfs/Kconfig
index 09ed066c0221..2b4503163930 100644
--- a/fs/logfs/Kconfig
+++ b/fs/logfs/Kconfig
@@ -1,6 +1,6 @@
 config LOGFS
         tristate "LogFS file system"
-        depends on (MTD || BLOCK)
+        depends on MTD || (!MTD && BLOCK)
         select ZLIB_INFLATE
         select ZLIB_DEFLATE
         select CRC32
diff --git a/fs/logfs/inode.c b/fs/logfs/inode.c
index 0fce46d62b9c..db9cfc598883 100644
--- a/fs/logfs/inode.c
+++ b/fs/logfs/inode.c
@@ -409,7 +409,8 @@ const struct super_operations logfs_super_operations = {
 int logfs_init_inode_cache(void)
 {
         logfs_inode_cache = kmem_cache_create("logfs_inode_cache",
-                        sizeof(struct logfs_inode), 0, SLAB_RECLAIM_ACCOUNT,
+                        sizeof(struct logfs_inode), 0,
+                        SLAB_RECLAIM_ACCOUNT|SLAB_ACCOUNT,
                         logfs_init_once);
         if (!logfs_inode_cache)
                 return -ENOMEM;
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index cb1789ca1ee6..f975d667c539 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -91,7 +91,7 @@ static int __init init_inodecache(void)
         minix_inode_cachep = kmem_cache_create("minix_inode_cache",
                                              sizeof(struct minix_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (minix_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
index ce1eb3f9dfe8..1af15fcbe57b 100644
--- a/fs/ncpfs/inode.c
+++ b/fs/ncpfs/inode.c
@@ -82,7 +82,7 @@ static int init_inodecache(void)
         ncp_inode_cachep = kmem_cache_create("ncp_inode_cache",
                                              sizeof(struct ncp_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (ncp_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index c11e855e0e18..8e24d886d2c5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1969,7 +1969,7 @@ static int __init nfs_init_inodecache(void)
         nfs_inode_cachep = kmem_cache_create("nfs_inode_cache",
                                              sizeof(struct nfs_inode),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (nfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index c7343844e6b6..7f5d3d9f1c37 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -1416,7 +1416,8 @@ static int __init nilfs_init_cachep(void)
 {
         nilfs_inode_cachep = kmem_cache_create("nilfs2_inode_cache",
                         sizeof(struct nilfs_inode_info), 0,
-                        SLAB_RECLAIM_ACCOUNT, nilfs_inode_init_once);
+                        SLAB_RECLAIM_ACCOUNT|SLAB_ACCOUNT,
+                        nilfs_inode_init_once);
         if (!nilfs_inode_cachep)
                 goto fail;
 
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index e785fd954c30..741077deef3b 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -199,8 +199,7 @@ void fsnotify_unmount_inodes(struct super_block *sb)
                                 break;
                         }
                         spin_unlock(&next_i->i_lock);
-                        next_i = list_entry(next_i->i_sb_list.next,
-                                                struct inode, i_sb_list);
+                        next_i = list_next_entry(next_i, i_sb_list);
                 }
 
                 /*
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index fc0df4442f7b..cfcbf114676e 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -92,9 +92,6 @@
 #include "fsnotify.h"
 
 struct srcu_struct fsnotify_mark_srcu;
-static DEFINE_SPINLOCK(destroy_lock);
-static LIST_HEAD(destroy_list);
-static DECLARE_WAIT_QUEUE_HEAD(destroy_waitq);
 
 void fsnotify_get_mark(struct fsnotify_mark *mark)
 {
@@ -168,10 +165,19 @@ void fsnotify_detach_mark(struct fsnotify_mark *mark)
         atomic_dec(&group->num_marks);
 }
 
+static void
+fsnotify_mark_free_rcu(struct rcu_head *rcu)
+{
+        struct fsnotify_mark    *mark;
+
+        mark = container_of(rcu, struct fsnotify_mark, g_rcu);
+        fsnotify_put_mark(mark);
+}
+
 /*
- * Free fsnotify mark. The freeing is actually happening from a kthread which
- * first waits for srcu period end. Caller must have a reference to the mark
- * or be protected by fsnotify_mark_srcu.
+ * Free fsnotify mark. The freeing is actually happening from a call_srcu
+ * callback. Caller must have a reference to the mark or be protected by
+ * fsnotify_mark_srcu.
  */
 void fsnotify_free_mark(struct fsnotify_mark *mark)
 {
@@ -186,10 +192,7 @@ void fsnotify_free_mark(struct fsnotify_mark *mark)
         mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
         spin_unlock(&mark->lock);
 
-        spin_lock(&destroy_lock);
-        list_add(&mark->g_list, &destroy_list);
-        spin_unlock(&destroy_lock);
-        wake_up(&destroy_waitq);
+        call_srcu(&fsnotify_mark_srcu, &mark->g_rcu, fsnotify_mark_free_rcu);
 
         /*
          * Some groups like to know that marks are being freed.  This is a
@@ -385,11 +388,7 @@ err:
 
         spin_unlock(&mark->lock);
 
-        spin_lock(&destroy_lock);
-        list_add(&mark->g_list, &destroy_list);
-        spin_unlock(&destroy_lock);
-        wake_up(&destroy_waitq);
-
+        call_srcu(&fsnotify_mark_srcu, &mark->g_rcu, fsnotify_mark_free_rcu);
         return ret;
 }
 
@@ -492,40 +491,3 @@ void fsnotify_init_mark(struct fsnotify_mark *mark,
         atomic_set(&mark->refcnt, 1);
         mark->free_mark = free_mark;
 }
-
-static int fsnotify_mark_destroy(void *ignored)
-{
-        struct fsnotify_mark *mark, *next;
-        struct list_head private_destroy_list;
-
-        for (;;) {
-                spin_lock(&destroy_lock);
-                /* exchange the list head */
-                list_replace_init(&destroy_list, &private_destroy_list);
-                spin_unlock(&destroy_lock);
-
-                synchronize_srcu(&fsnotify_mark_srcu);
-
-                list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
-                        list_del_init(&mark->g_list);
-                        fsnotify_put_mark(mark);
-                }
-
-                wait_event_interruptible(destroy_waitq, !list_empty(&destroy_list));
-        }
-
-        return 0;
-}
-
-static int __init fsnotify_mark_init(void)
-{
-        struct task_struct *thread;
-
-        thread = kthread_run(fsnotify_mark_destroy, NULL,
-                             "fsnotify_mark");
-        if (IS_ERR(thread))
-                panic("unable to start fsnotify mark destruction thread.");
-
-        return 0;
-}
-device_initcall(fsnotify_mark_init);
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index d1a853585b53..2f77f8dfb861 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -3139,8 +3139,8 @@ static int __init init_ntfs_fs(void)
 
         ntfs_big_inode_cache = kmem_cache_create(ntfs_big_inode_cache_name,
                         sizeof(big_ntfs_inode), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
-                        ntfs_big_inode_init_once);
+                        SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                        SLAB_ACCOUNT, ntfs_big_inode_init_once);
         if (!ntfs_big_inode_cache) {
                 pr_crit("Failed to create %s!\n", ntfs_big_inode_cache_name);
                 goto big_inode_err_out;
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 86181d6526dc..a3ded88718c9 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -164,7 +164,7 @@ static int ocfs2_dinode_insert_check(struct ocfs2_extent_tree *et,
                                      struct ocfs2_extent_rec *rec);
 static int ocfs2_dinode_sanity_check(struct ocfs2_extent_tree *et);
 static void ocfs2_dinode_fill_root_el(struct ocfs2_extent_tree *et);
-static struct ocfs2_extent_tree_operations ocfs2_dinode_et_ops = {
+static const struct ocfs2_extent_tree_operations ocfs2_dinode_et_ops = {
         .eo_set_last_eb_blk     = ocfs2_dinode_set_last_eb_blk,
         .eo_get_last_eb_blk     = ocfs2_dinode_get_last_eb_blk,
         .eo_update_clusters     = ocfs2_dinode_update_clusters,
@@ -286,7 +286,7 @@ static void ocfs2_xattr_value_update_clusters(struct ocfs2_extent_tree *et,
         le32_add_cpu(&vb->vb_xv->xr_clusters, clusters);
 }
 
-static struct ocfs2_extent_tree_operations ocfs2_xattr_value_et_ops = {
+static const struct ocfs2_extent_tree_operations ocfs2_xattr_value_et_ops = {
         .eo_set_last_eb_blk     = ocfs2_xattr_value_set_last_eb_blk,
         .eo_get_last_eb_blk     = ocfs2_xattr_value_get_last_eb_blk,
         .eo_update_clusters     = ocfs2_xattr_value_update_clusters,
@@ -332,7 +332,7 @@ static void ocfs2_xattr_tree_update_clusters(struct ocfs2_extent_tree *et,
         le32_add_cpu(&xb->xb_attrs.xb_root.xt_clusters, clusters);
 }
 
-static struct ocfs2_extent_tree_operations ocfs2_xattr_tree_et_ops = {
+static const struct ocfs2_extent_tree_operations ocfs2_xattr_tree_et_ops = {
         .eo_set_last_eb_blk     = ocfs2_xattr_tree_set_last_eb_blk,
         .eo_get_last_eb_blk     = ocfs2_xattr_tree_get_last_eb_blk,
         .eo_update_clusters     = ocfs2_xattr_tree_update_clusters,
@@ -379,7 +379,7 @@ static void ocfs2_dx_root_fill_root_el(struct ocfs2_extent_tree *et)
         et->et_root_el = &dx_root->dr_list;
 }
 
-static struct ocfs2_extent_tree_operations ocfs2_dx_root_et_ops = {
+static const struct ocfs2_extent_tree_operations ocfs2_dx_root_et_ops = {
         .eo_set_last_eb_blk     = ocfs2_dx_root_set_last_eb_blk,
         .eo_get_last_eb_blk     = ocfs2_dx_root_get_last_eb_blk,
         .eo_update_clusters     = ocfs2_dx_root_update_clusters,
@@ -425,7 +425,7 @@ ocfs2_refcount_tree_extent_contig(struct ocfs2_extent_tree *et,
         return CONTIG_NONE;
 }
 
-static struct ocfs2_extent_tree_operations ocfs2_refcount_tree_et_ops = {
+static const struct ocfs2_extent_tree_operations ocfs2_refcount_tree_et_ops = {
         .eo_set_last_eb_blk     = ocfs2_refcount_tree_set_last_eb_blk,
         .eo_get_last_eb_blk     = ocfs2_refcount_tree_get_last_eb_blk,
         .eo_update_clusters     = ocfs2_refcount_tree_update_clusters,
@@ -438,7 +438,7 @@ static void __ocfs2_init_extent_tree(struct ocfs2_extent_tree *et,
                                      struct buffer_head *bh,
                                      ocfs2_journal_access_func access,
                                      void *obj,
-                                     struct ocfs2_extent_tree_operations *ops)
+                                     const struct ocfs2_extent_tree_operations *ops)
 {
         et->et_ops = ops;
         et->et_root_bh = bh;
@@ -6174,8 +6174,7 @@ int ocfs2_begin_truncate_log_recovery(struct ocfs2_super *osb,
         }
 
 bail:
-        if (tl_inode)
-                iput(tl_inode);
+        iput(tl_inode);
         brelse(tl_bh);
 
         if (status < 0) {
diff --git a/fs/ocfs2/alloc.h b/fs/ocfs2/alloc.h
index fb09b97db162..f3dc1b0dfffc 100644
--- a/fs/ocfs2/alloc.h
+++ b/fs/ocfs2/alloc.h
@@ -54,7 +54,7 @@
  */
 struct ocfs2_extent_tree_operations;
 struct ocfs2_extent_tree {
-        struct ocfs2_extent_tree_operations     *et_ops;
+        const struct ocfs2_extent_tree_operations *et_ops;
         struct buffer_head                      *et_root_bh;
         struct ocfs2_extent_list                *et_root_el;
         struct ocfs2_caching_info               *et_ci;
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 709fbbd44c65..a3cc6d2fc896 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1780,8 +1780,8 @@ static ssize_t o2hb_region_dev_store(struct config_item *item,
         }
         ++live_threshold;
         atomic_set(&reg->hr_steady_iterations, live_threshold);
-        /* unsteady_iterations is double the steady_iterations */
-        atomic_set(&reg->hr_unsteady_iterations, (live_threshold << 1));
+        /* unsteady_iterations is triple the steady_iterations */
+        atomic_set(&reg->hr_unsteady_iterations, (live_threshold * 3));
 
         hb_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
                               reg->hr_item.ci_name);
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index e88ccf8c83ff..68c607e63ff6 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -376,17 +376,6 @@ struct dlm_lock
                  lksb_kernel_allocated:1;
 };
 
-
-#define DLM_LKSB_UNUSED1           0x01
-#define DLM_LKSB_PUT_LVB           0x02
-#define DLM_LKSB_GET_LVB           0x04
-#define DLM_LKSB_UNUSED2           0x08
-#define DLM_LKSB_UNUSED3           0x10
-#define DLM_LKSB_UNUSED4           0x20
-#define DLM_LKSB_UNUSED5           0x40
-#define DLM_LKSB_UNUSED6           0x80
-
-
 enum dlm_lockres_list {
         DLM_GRANTED_LIST = 0,
         DLM_CONVERTING_LIST = 1,
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 84f2f8079466..9477d6e1de37 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2388,8 +2388,8 @@ static void dlm_deref_lockres_worker(struct dlm_work_item *item, void *data)
 
         spin_lock(&res->spinlock);
         BUG_ON(res->state & DLM_LOCK_RES_DROPPING_REF);
+        __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
         if (test_bit(node, res->refmap)) {
-                __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
                 dlm_lockres_clear_refmap_bit(dlm, res, node);
                 cleared = 1;
         }
@@ -2519,6 +2519,11 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
         spin_lock(&dlm->master_lock);
         ret = dlm_add_migration_mle(dlm, res, mle, &oldmle, name,
                                     namelen, target, dlm->node_num);
+        /* get an extra reference on the mle.
+         * otherwise the assert_master from the new
+         * master will destroy this.
+         */
+        dlm_get_mle_inuse(mle);
         spin_unlock(&dlm->master_lock);
         spin_unlock(&dlm->spinlock);
 
@@ -2544,7 +2549,7 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
         }
 
 fail:
-        if (oldmle) {
+        if (ret != -EEXIST && oldmle) {
                 /* master is known, detach if not already detached */
                 dlm_mle_detach_hb_events(dlm, oldmle);
                 dlm_put_mle(oldmle);
@@ -2554,6 +2559,7 @@ fail:
                 if (mle_added) {
                         dlm_mle_detach_hb_events(dlm, mle);
                         dlm_put_mle(mle);
+                        dlm_put_mle_inuse(mle);
                 } else if (mle) {
                         kmem_cache_free(dlm_mle_cache, mle);
                         mle = NULL;
@@ -2571,17 +2577,6 @@ fail:
          * ensure that all assert_master work is flushed. */
         flush_workqueue(dlm->dlm_worker);
 
-        /* get an extra reference on the mle.
-         * otherwise the assert_master from the new
-         * master will destroy this.
-         * also, make sure that all callers of dlm_get_mle
-         * take both dlm->spinlock and dlm->master_lock */
-        spin_lock(&dlm->spinlock);
-        spin_lock(&dlm->master_lock);
-        dlm_get_mle_inuse(mle);
-        spin_unlock(&dlm->master_lock);
-        spin_unlock(&dlm->spinlock);
-
         /* notify new node and send all lock state */
         /* call send_one_lockres with migration flag.
          * this serves as notice to the target node that a
@@ -3050,7 +3045,7 @@ int dlm_migrate_request_handler(struct o2net_msg *msg, u32 len, void *data,
         int ret = 0;
 
         if (!dlm_grab(dlm))
-                return -EINVAL;
+                return 0;
 
         name = migrate->name;
         namelen = migrate->namelen;
@@ -3141,7 +3136,8 @@ static int dlm_add_migration_mle(struct dlm_ctxt *dlm,
                                 mlog(0, "tried to migrate %.*s, but some "
                                      "process beat me to it\n",
                                      namelen, name);
-                                ret = -EEXIST;
+                                spin_unlock(&tmp->spinlock);
+                                return -EEXIST;
                         } else {
                                 /* bad.  2 NODES are trying to migrate! */
                                 mlog(ML_ERROR, "migration error  mle: "
@@ -3312,6 +3308,15 @@ top:
                             mle->new_master != dead_node)
                                 continue;
 
+                        if (mle->new_master == dead_node && mle->inuse) {
+                                mlog(ML_NOTICE, "%s: target %u died during "
+                                                "migration from %u, the MLE is "
+                                                "still keep used, ignore it!\n",
+                                                dlm->name, dead_node,
+                                                mle->master);
+                                continue;
+                        }
+
                         /* If we have reached this point, this mle needs to be
                          * removed from the list and freed. */
                         dlm_clean_migration_mle(dlm, mle);
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 9e4f862d20fe..c5bdf02c213b 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1373,6 +1373,7 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
         char *buf = NULL;
         struct dlm_work_item *item = NULL;
         struct dlm_lock_resource *res = NULL;
+        unsigned int hash;
 
         if (!dlm_grab(dlm))
                 return -EINVAL;
@@ -1400,7 +1401,10 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
         /* lookup the lock to see if we have a secondary queue for this
          * already...  just add the locks in and this will have its owner
          * and RECOVERY flag changed when it completes. */
-        res = dlm_lookup_lockres(dlm, mres->lockname, mres->lockname_len);
+        hash = dlm_lockid_hash(mres->lockname, mres->lockname_len);
+        spin_lock(&dlm->spinlock);
+        res = __dlm_lookup_lockres(dlm, mres->lockname, mres->lockname_len,
+                        hash);
         if (res) {
                 /* this will get a ref on res */
                 /* mark it as recovering/migrating and hash it */
@@ -1421,13 +1425,16 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                                      mres->lockname_len, mres->lockname);
                                 ret = -EFAULT;
                                 spin_unlock(&res->spinlock);
+                                spin_unlock(&dlm->spinlock);
                                 dlm_lockres_put(res);
                                 goto leave;
                         }
                         res->state |= DLM_LOCK_RES_MIGRATING;
                 }
                 spin_unlock(&res->spinlock);
+                spin_unlock(&dlm->spinlock);
         } else {
+                spin_unlock(&dlm->spinlock);
                 /* need to allocate, just like if it was
                  * mastered here normally  */
                 res = dlm_new_lockres(dlm, mres->lockname, mres->lockname_len);
@@ -2450,11 +2457,7 @@ static void __dlm_hb_node_down(struct dlm_ctxt *dlm, int idx)
          * perhaps later we can genericize this for other waiters. */
         wake_up(&dlm->migration_wq);
 
-        if (test_bit(idx, dlm->recovery_map))
-                mlog(0, "domain %s, node %u already added "
-                     "to recovery map!\n", dlm->name, idx);
-        else
-                set_bit(idx, dlm->recovery_map);
+        set_bit(idx, dlm->recovery_map);
 }
 
 void dlm_hb_node_down_cb(struct o2nm_node *node, int idx, void *data)
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 2e3c9dbab68c..1082b2c3014b 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -421,7 +421,7 @@ int dlm_unlock_lock_handler(struct o2net_msg *msg, u32 len, void *data,
         }
 
         if (!dlm_grab(dlm))
-                return DLM_REJECTED;
+                return DLM_FORWARD;
 
         mlog_bug_on_msg(!dlm_domain_fully_joined(dlm),
                         "Domain %s not fully joined!\n", dlm->name);
diff --git a/fs/ocfs2/dlmfs/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
index b5cf27dcb18a..03768bb3aab1 100644
--- a/fs/ocfs2/dlmfs/dlmfs.c
+++ b/fs/ocfs2/dlmfs/dlmfs.c
@@ -638,7 +638,7 @@ static int __init init_dlmfs_fs(void)
         dlmfs_inode_cache = kmem_cache_create("dlmfs_inode_cache",
                                 sizeof(struct dlmfs_inode_private),
                                 0, (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
-                                        SLAB_MEM_SPREAD),
+                                        SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                 dlmfs_init_once);
         if (!dlmfs_inode_cache) {
                 status = -ENOMEM;
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 20276e340339..f92612e4b9d6 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2432,12 +2432,6 @@ bail:
  * done this we have to return AOP_TRUNCATED_PAGE so the aop method
  * that called us can bubble that back up into the VFS who will then
  * immediately retry the aop call.
- *
- * We do a blocking lock and immediate unlock before returning, though, so that
- * the lock has a great chance of being cached on this node by the time the VFS
- * calls back to retry the aop.    This has a potential to livelock as nodes
- * ping locks back and forth, but that's a risk we're willing to take to avoid
- * the lock inversion simply.
  */
 int ocfs2_inode_lock_with_page(struct inode *inode,
                               struct buffer_head **ret_bh,
@@ -2449,8 +2443,6 @@ int ocfs2_inode_lock_with_page(struct inode *inode,
         ret = ocfs2_inode_lock_full(inode, ret_bh, ex, OCFS2_LOCK_NONBLOCK);
         if (ret == -EAGAIN) {
                 unlock_page(page);
-                if (ocfs2_inode_lock(inode, ret_bh, ex) == 0)
-                        ocfs2_inode_unlock(inode, ex);
                 ret = AOP_TRUNCATED_PAGE;
         }
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 0e5b4515f92e..d63127932509 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1302,6 +1302,14 @@ int ocfs2_getattr(struct vfsmount *mnt,
         }
 
         generic_fillattr(inode, stat);
+        /*
+         * If there is inline data in the inode, the inode will normally not
+         * have data blocks allocated (it may have an external xattr block).
+         * Report at least one sector for such files, so tools like tar, rsync,
+         * others don't incorrectly think the file is completely sparse.
+         */
+        if (unlikely(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL))
+                stat->blocks += (stat->size + 511)>>9;
 
         /* We set the blksize from the cluster size for performance */
         stat->blksize = osb->s_clustersize;
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 3cb097ccce60..16b0bb482ea7 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -606,9 +606,7 @@ bail:
         if (gb_inode)
                 mutex_unlock(&gb_inode->i_mutex);
 
-        if (gb_inode)
-                iput(gb_inode);
-
+        iput(gb_inode);
         brelse(bh);
 
         return status;
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 13534f4fe5b5..3772a2dbb980 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1042,8 +1042,7 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
 
 //      up_write(&journal->j_trans_barrier);
 done:
-        if (inode)
-                iput(inode);
+        iput(inode);
 }
 
 static void ocfs2_clear_journal_error(struct super_block *sb,
@@ -1687,9 +1686,7 @@ done:
         if (got_lock)
                 ocfs2_inode_unlock(inode, 1);
 
-        if (inode)
-                iput(inode);
-
+        iput(inode);
         brelse(bh);
 
         return status;
@@ -1796,8 +1793,7 @@ static int ocfs2_trylock_journal(struct ocfs2_super *osb,
 
         ocfs2_inode_unlock(inode, 1);
 bail:
-        if (inode)
-                iput(inode);
+        iput(inode);
 
         return status;
 }
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index 0a4457fb0711..e9c99e35f5ea 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -358,8 +358,7 @@ int ocfs2_load_local_alloc(struct ocfs2_super *osb)
 bail:
         if (status < 0)
                 brelse(alloc_bh);
-        if (inode)
-                iput(inode);
+        iput(inode);
 
         trace_ocfs2_load_local_alloc(osb->local_alloc_bits);
 
@@ -473,8 +472,7 @@ out_mutex:
         iput(main_bm_inode);
 
 out:
-        if (local_alloc_inode)
-                iput(local_alloc_inode);
+        iput(local_alloc_inode);
 
         kfree(alloc_copy);
 }
@@ -1327,9 +1325,7 @@ bail:
 
         brelse(main_bm_bh);
 
-        if (main_bm_inode)
-                iput(main_bm_inode);
-
+        iput(main_bm_inode);
         kfree(alloc_copy);
 
         if (ac)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index afb81eae2c18..ab42c38031b1 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1683,8 +1683,7 @@ bail:
         if (new_inode)
                 sync_mapping_buffers(old_inode->i_mapping);
 
-        if (new_inode)
-                iput(new_inode);
+        iput(new_inode);
 
         ocfs2_free_dir_lookup_result(&target_lookup_res);
         ocfs2_free_dir_lookup_result(&old_entry_lookup);
@@ -2373,6 +2372,15 @@ int ocfs2_orphan_del(struct ocfs2_super *osb,
              (unsigned long long)OCFS2_I(orphan_dir_inode)->ip_blkno,
              name, strlen(name));
 
+        status = ocfs2_journal_access_di(handle,
+                                         INODE_CACHE(orphan_dir_inode),
+                                         orphan_dir_bh,
+                                         OCFS2_JOURNAL_ACCESS_WRITE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto leave;
+        }
+
         /* find it's spot in the orphan directory */
         status = ocfs2_find_entry(name, strlen(name), orphan_dir_inode,
                                   &lookup);
@@ -2388,15 +2396,6 @@ int ocfs2_orphan_del(struct ocfs2_super *osb,
                 goto leave;
         }
 
-        status = ocfs2_journal_access_di(handle,
-                                         INODE_CACHE(orphan_dir_inode),
-                                         orphan_dir_bh,
-                                         OCFS2_JOURNAL_ACCESS_WRITE);
-        if (status < 0) {
-                mlog_errno(status);
-                goto leave;
-        }
-
         /* do the i_nlink dance! :) */
         orphan_fe = (struct ocfs2_dinode *) orphan_dir_bh->b_data;
         if (S_ISDIR(inode->i_mode))
diff --git a/fs/ocfs2/slot_map.c b/fs/ocfs2/slot_map.c
index e78a203d44c8..1e09592148ad 100644
--- a/fs/ocfs2/slot_map.c
+++ b/fs/ocfs2/slot_map.c
@@ -322,8 +322,7 @@ static void __ocfs2_free_slot_info(struct ocfs2_slot_info *si)
         if (si == NULL)
                 return;
 
-        if (si->si_inode)
-                iput(si->si_inode);
+        iput(si->si_inode);
         if (si->si_bh) {
                 for (i = 0; i < si->si_blocks; i++) {
                         if (si->si_bh[i]) {
@@ -503,8 +502,17 @@ int ocfs2_find_slot(struct ocfs2_super *osb)
         trace_ocfs2_find_slot(osb->slot_num);
 
         status = ocfs2_update_disk_slot(osb, si, osb->slot_num);
-        if (status < 0)
+        if (status < 0) {
                 mlog_errno(status);
+                /*
+                 * if write block failed, invalidate slot to avoid overwrite
+                 * slot during dismount in case another node rightly has mounted
+                 */
+                spin_lock(&osb->osb_lock);
+                ocfs2_invalidate_slot(si, osb->slot_num);
+                osb->slot_num = OCFS2_INVALID_SLOT;
+                spin_unlock(&osb->osb_lock);
+        }
 
 bail:
         return status;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 2de4c8a9340c..faa1365097bc 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1280,6 +1280,8 @@ static int ocfs2_parse_options(struct super_block *sb,
         int status, user_stack = 0;
         char *p;
         u32 tmp;
+        int token, option;
+        substring_t args[MAX_OPT_ARGS];
 
         trace_ocfs2_parse_options(is_remount, options ? options : "(none)");
 
@@ -1298,9 +1300,6 @@ static int ocfs2_parse_options(struct super_block *sb,
         }
 
         while ((p = strsep(&options, ",")) != NULL) {
-                int token, option;
-                substring_t args[MAX_OPT_ARGS];
-
                 if (!*p)
                         continue;
 
@@ -1367,7 +1366,6 @@ static int ocfs2_parse_options(struct super_block *sb,
                                 mopt->atime_quantum = option;
                         break;
                 case Opt_slot:
-                        option = 0;
                         if (match_int(&args[0], &option)) {
                                 status = 0;
                                 goto bail;
@@ -1376,7 +1374,6 @@ static int ocfs2_parse_options(struct super_block *sb,
                                 mopt->slot = (s16)option;
                         break;
                 case Opt_commit:
-                        option = 0;
                         if (match_int(&args[0], &option)) {
                                 status = 0;
                                 goto bail;
@@ -1388,7 +1385,6 @@ static int ocfs2_parse_options(struct super_block *sb,
                         mopt->commit_interval = HZ * option;
                         break;
                 case Opt_localalloc:
-                        option = 0;
                         if (match_int(&args[0], &option)) {
                                 status = 0;
                                 goto bail;
@@ -1726,8 +1722,7 @@ static int ocfs2_statfs(struct dentry *dentry, struct kstatfs *buf)
         ocfs2_inode_unlock(inode, 0);
         status = 0;
 bail:
-        if (inode)
-                iput(inode);
+        iput(inode);
 
         if (status)
                 mlog_errno(status);
@@ -1771,7 +1766,7 @@ static int ocfs2_initialize_mem_caches(void)
                                        sizeof(struct ocfs2_inode_info),
                                        0,
                                        (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                        ocfs2_inode_init_once);
         ocfs2_dquot_cachep = kmem_cache_create("ocfs2_dquot_cache",
                                         sizeof(struct ocfs2_dquot),
diff --git a/fs/openpromfs/inode.c b/fs/openpromfs/inode.c
index 15e4500cda3e..b61b883c8ff8 100644
--- a/fs/openpromfs/inode.c
+++ b/fs/openpromfs/inode.c
@@ -443,7 +443,7 @@ static int __init init_openprom_fs(void)
                                             sizeof(struct op_inode_info),
                                             0,
                                             (SLAB_RECLAIM_ACCOUNT |
-                                             SLAB_MEM_SPREAD),
+                                             SLAB_MEM_SPREAD | SLAB_ACCOUNT),
                                             op_inode_init_once);
         if (!op_inode_cachep)
                 return -ENOMEM;
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index d0e9b9b6223e..42305ddcbaa0 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -95,7 +95,8 @@ void __init proc_init_inodecache(void)
         proc_inode_cachep = kmem_cache_create("proc_inode_cache",
                                              sizeof(struct proc_inode),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD|SLAB_PANIC),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT|
+                                                SLAB_PANIC),
                                              init_once);
 }
 
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 9155a5a0d3b9..df4661abadc4 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -57,11 +57,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
         /*
          * Estimate the amount of memory available for userspace allocations,
          * without causing swapping.
-         *
-         * Free memory cannot be taken below the low watermark, before the
-         * system starts swapping.
          */
-        available = i.freeram - wmark_low;
+        available = i.freeram - totalreserve_pages;
 
         /*
          * Not all the page cache can be freed, otherwise the system will
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 187b3b5f242e..a353b4c6e86e 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -14,6 +14,7 @@
 #include <linux/swapops.h>
 #include <linux/mmu_notifier.h>
 #include <linux/page_idle.h>
+#include <linux/shmem_fs.h>
 
 #include <asm/elf.h>
 #include <asm/uaccess.h>
@@ -22,9 +23,13 @@
 
 void task_mem(struct seq_file *m, struct mm_struct *mm)
 {
-        unsigned long data, text, lib, swap, ptes, pmds;
+        unsigned long text, lib, swap, ptes, pmds, anon, file, shmem;
         unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss;
 
+        anon = get_mm_counter(mm, MM_ANONPAGES);
+        file = get_mm_counter(mm, MM_FILEPAGES);
+        shmem = get_mm_counter(mm, MM_SHMEMPAGES);
+
         /*
          * Note: to minimize their overhead, mm maintains hiwater_vm and
          * hiwater_rss only when about to *lower* total_vm or rss.  Any
@@ -35,11 +40,10 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
         hiwater_vm = total_vm = mm->total_vm;
         if (hiwater_vm < mm->hiwater_vm)
                 hiwater_vm = mm->hiwater_vm;
-        hiwater_rss = total_rss = get_mm_rss(mm);
+        hiwater_rss = total_rss = anon + file + shmem;
         if (hiwater_rss < mm->hiwater_rss)
                 hiwater_rss = mm->hiwater_rss;
 
-        data = mm->total_vm - mm->shared_vm - mm->stack_vm;
         text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK)) >> 10;
         lib = (mm->exec_vm << (PAGE_SHIFT-10)) - text;
         swap = get_mm_counter(mm, MM_SWAPENTS);
@@ -52,6 +56,9 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
                 "VmPin:\t%8lu kB\n"
                 "VmHWM:\t%8lu kB\n"
                 "VmRSS:\t%8lu kB\n"
+                "RssAnon:\t%8lu kB\n"
+                "RssFile:\t%8lu kB\n"
+                "RssShmem:\t%8lu kB\n"
                 "VmData:\t%8lu kB\n"
                 "VmStk:\t%8lu kB\n"
                 "VmExe:\t%8lu kB\n"
@@ -65,7 +72,10 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
                 mm->pinned_vm << (PAGE_SHIFT-10),
                 hiwater_rss << (PAGE_SHIFT-10),
                 total_rss << (PAGE_SHIFT-10),
-                data << (PAGE_SHIFT-10),
+                anon << (PAGE_SHIFT-10),
+                file << (PAGE_SHIFT-10),
+                shmem << (PAGE_SHIFT-10),
+                mm->data_vm << (PAGE_SHIFT-10),
                 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
                 ptes >> 10,
                 pmds >> 10,
@@ -82,10 +92,11 @@ unsigned long task_statm(struct mm_struct *mm,
                          unsigned long *shared, unsigned long *text,
                          unsigned long *data, unsigned long *resident)
 {
-        *shared = get_mm_counter(mm, MM_FILEPAGES);
+        *shared = get_mm_counter(mm, MM_FILEPAGES) +
+                        get_mm_counter(mm, MM_SHMEMPAGES);
         *text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK))
                                                                 >> PAGE_SHIFT;
-        *data = mm->total_vm - mm->shared_vm;
+        *data = mm->data_vm + mm->stack_vm;
         *resident = *shared + get_mm_counter(mm, MM_ANONPAGES);
         return mm->total_vm;
 }
@@ -451,6 +462,7 @@ struct mem_size_stats {
         unsigned long private_hugetlb;
         u64 pss;
         u64 swap_pss;
+        bool check_shmem_swap;
 };
 
 static void smaps_account(struct mem_size_stats *mss, struct page *page,
@@ -485,6 +497,19 @@ static void smaps_account(struct mem_size_stats *mss, struct page *page,
         }
 }
 
+#ifdef CONFIG_SHMEM
+static int smaps_pte_hole(unsigned long addr, unsigned long end,
+                struct mm_walk *walk)
+{
+        struct mem_size_stats *mss = walk->private;
+
+        mss->swap += shmem_partial_swap_usage(
+                        walk->vma->vm_file->f_mapping, addr, end);
+
+        return 0;
+}
+#endif
+
 static void smaps_pte_entry(pte_t *pte, unsigned long addr,
                 struct mm_walk *walk)
 {
@@ -512,6 +537,19 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
                         }
                 } else if (is_migration_entry(swpent))
                         page = migration_entry_to_page(swpent);
+        } else if (unlikely(IS_ENABLED(CONFIG_SHMEM) && mss->check_shmem_swap
+                                                        && pte_none(*pte))) {
+                page = find_get_entry(vma->vm_file->f_mapping,
+                                                linear_page_index(vma, addr));
+                if (!page)
+                        return;
+
+                if (radix_tree_exceptional_entry(page))
+                        mss->swap += PAGE_SIZE;
+                else
+                        page_cache_release(page);
+
+                return;
         }
 
         if (!page)
@@ -671,6 +709,31 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
         };
 
         memset(&mss, 0, sizeof mss);
+
+#ifdef CONFIG_SHMEM
+        if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) {
+                /*
+                 * For shared or readonly shmem mappings we know that all
+                 * swapped out pages belong to the shmem object, and we can
+                 * obtain the swap value much more efficiently. For private
+                 * writable mappings, we might have COW pages that are
+                 * not affected by the parent swapped out pages of the shmem
+                 * object, so we have to distinguish them during the page walk.
+                 * Unless we know that the shmem object (or the part mapped by
+                 * our VMA) has no swapped out pages at all.
+                 */
+                unsigned long shmem_swapped = shmem_swap_usage(vma);
+
+                if (!shmem_swapped || (vma->vm_flags & VM_SHARED) ||
+                                        !(vma->vm_flags & VM_WRITE)) {
+                        mss.swap = shmem_swapped;
+                } else {
+                        mss.check_shmem_swap = true;
+                        smaps_walk.pte_hole = smaps_pte_hole;
+                }
+        }
+#endif
+
         /* mmap_sem is held in m_start */
         walk_page_vma(vma, &smaps_walk);
 
@@ -817,9 +880,6 @@ static inline void clear_soft_dirty_pmd(struct vm_area_struct *vma,
         pmd = pmd_wrprotect(pmd);
         pmd = pmd_clear_soft_dirty(pmd);
 
-        if (vma->vm_flags & VM_SOFTDIRTY)
-                vma->vm_flags &= ~VM_SOFTDIRTY;
-
         set_pmd_at(vma->vm_mm, addr, pmdp, pmd);
 }
 #else
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index f37b3deb01b4..3a67cfb142d8 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -365,7 +365,7 @@ static int init_inodecache(void)
         qnx4_inode_cachep = kmem_cache_create("qnx4_inode_cache",
                                              sizeof(struct qnx4_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (qnx4_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c
index 9728b5499e1d..47bb1de07155 100644
--- a/fs/qnx6/inode.c
+++ b/fs/qnx6/inode.c
@@ -625,7 +625,7 @@ static int init_inodecache(void)
         qnx6_inode_cachep = kmem_cache_create("qnx6_inode_cache",
                                              sizeof(struct qnx6_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (!qnx6_inode_cachep)
                 return -ENOMEM;
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 4a62fe8cc3bf..05db7473bcb5 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -626,7 +626,8 @@ static int __init init_inodecache(void)
                                                   sizeof(struct
                                                          reiserfs_inode_info),
                                                   0, (SLAB_RECLAIM_ACCOUNT|
-                                                        SLAB_MEM_SPREAD),
+                                                      SLAB_MEM_SPREAD|
+                                                      SLAB_ACCOUNT),
                                                   init_once);
         if (reiserfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/romfs/super.c b/fs/romfs/super.c
index bb894e78a821..6b00ca357c58 100644
--- a/fs/romfs/super.c
+++ b/fs/romfs/super.c
@@ -619,8 +619,8 @@ static int __init init_romfs_fs(void)
         romfs_inode_cachep =
                 kmem_cache_create("romfs_i",
                                   sizeof(struct romfs_inode_info), 0,
-                                  SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD,
-                                  romfs_i_init_once);
+                                  SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD |
+                                  SLAB_ACCOUNT, romfs_i_init_once);
 
         if (!romfs_inode_cachep) {
                 pr_err("Failed to initialise inode cache\n");
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index dded920cbc8f..5e79bfa4f260 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -419,7 +419,8 @@ static int __init init_inodecache(void)
 {
         squashfs_inode_cachep = kmem_cache_create("squashfs_inode_cache",
                 sizeof(struct squashfs_inode_info), 0,
-                SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT, init_once);
+                SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|SLAB_ACCOUNT,
+                init_once);
 
         return squashfs_inode_cachep ? 0 : -ENOMEM;
 }
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 07ac18c355e7..d62c423a5a2d 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -346,7 +346,7 @@ int __init sysv_init_icache(void)
 {
         sysv_inode_cachep = kmem_cache_create("sysv_inode_cache",
                         sizeof(struct sysv_inode_info), 0,
-                        SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
+                        SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
                         init_once);
         if (!sysv_inode_cachep)
                 return -ENOMEM;
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 1fd90c079537..a233ba913be4 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -2248,8 +2248,8 @@ static int __init ubifs_init(void)
 
         ubifs_inode_slab = kmem_cache_create("ubifs_inode_slab",
                                 sizeof(struct ubifs_inode), 0,
-                                SLAB_MEM_SPREAD | SLAB_RECLAIM_ACCOUNT,
-                                &inode_slab_ctor);
+                                SLAB_MEM_SPREAD | SLAB_RECLAIM_ACCOUNT |
+                                SLAB_ACCOUNT, &inode_slab_ctor);
         if (!ubifs_inode_slab)
                 return -ENOMEM;
 
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 81155b9b445b..9c64a3ca9837 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -179,7 +179,8 @@ static int __init init_inodecache(void)
         udf_inode_cachep = kmem_cache_create("udf_inode_cache",
                                              sizeof(struct udf_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT |
-                                                 SLAB_MEM_SPREAD),
+                                                 SLAB_MEM_SPREAD |
+                                                 SLAB_ACCOUNT),
                                              init_once);
         if (!udf_inode_cachep)
                 return -ENOMEM;
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index f6390eec02ca..442fd52ebffe 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -1427,7 +1427,7 @@ static int __init init_inodecache(void)
         ufs_inode_cachep = kmem_cache_create("ufs_inode_cache",
                                              sizeof(struct ufs_inode_info),
                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                              init_once);
         if (ufs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
index cc6b768fc068..d1c66e465ca5 100644
--- a/fs/xfs/kmem.h
+++ b/fs/xfs/kmem.h
@@ -84,6 +84,7 @@ kmem_zalloc(size_t size, xfs_km_flags_t flags)
 #define KM_ZONE_HWALIGN SLAB_HWCACHE_ALIGN
 #define KM_ZONE_RECLAIM SLAB_RECLAIM_ACCOUNT
 #define KM_ZONE_SPREAD  SLAB_MEM_SPREAD
+#define KM_ZONE_ACCOUNT SLAB_ACCOUNT
 
 #define kmem_zone       kmem_cache
 #define kmem_zone_t     struct kmem_cache
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index b35775752b74..59c9b7bd958d 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1714,8 +1714,8 @@ xfs_init_zones(void)
 
         xfs_inode_zone =
                 kmem_zone_init_flags(sizeof(xfs_inode_t), "xfs_inode",
-                        KM_ZONE_HWALIGN | KM_ZONE_RECLAIM | KM_ZONE_SPREAD,
-                        xfs_fs_inode_init_once);
+                        KM_ZONE_HWALIGN | KM_ZONE_RECLAIM | KM_ZONE_SPREAD |
+                        KM_ZONE_ACCOUNT, xfs_fs_inode_init_once);
         if (!xfs_inode_zone)
                 goto out_destroy_efi_zone;
 
diff --git a/include/asm-generic/memory_model.h b/include/asm-generic/memory_model.h
index 4b4b056a6eb0..5148150cc80b 100644
--- a/include/asm-generic/memory_model.h
+++ b/include/asm-generic/memory_model.h
@@ -1,6 +1,8 @@
 #ifndef __ASM_MEMORY_MODEL_H
 #define __ASM_MEMORY_MODEL_H
 
+#include <linux/pfn.h>
+
 #ifndef __ASSEMBLY__
 
 #if defined(CONFIG_FLATMEM)
@@ -72,7 +74,7 @@
 /*
  * Convert a physical address to a Page Frame Number and back
  */
-#define __phys_to_pfn(paddr)    ((unsigned long)((paddr) >> PAGE_SHIFT))
+#define __phys_to_pfn(paddr)    PHYS_PFN(paddr)
 #define __pfn_to_phys(pfn)      PFN_PHYS(pfn)
 
 #define page_to_pfn __page_to_pfn
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d67ae119cf4e..7781ce110503 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -27,10 +27,10 @@ struct vfsmount;
 
 /* The hash is always the low bits of hash_len */
 #ifdef __LITTLE_ENDIAN
- #define HASH_LEN_DECLARE u32 hash; u32 len;
+ #define HASH_LEN_DECLARE u32 hash; u32 len
  #define bytemask_from_count(cnt)       (~(~0ul << (cnt)*8))
 #else
- #define HASH_LEN_DECLARE u32 len; u32 hash;
+ #define HASH_LEN_DECLARE u32 len; u32 hash
  #define bytemask_from_count(cnt)       (~(~0ul >> (cnt)*8))
 #endif
 
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 533c4408529a..6b7e89f45aa4 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -220,7 +220,10 @@ struct fsnotify_mark {
         /* List of marks by group->i_fsnotify_marks. Also reused for queueing
          * mark into destroy_list when it's waiting for the end of SRCU period
          * before it can be freed. [group->mark_mutex] */
-        struct list_head g_list;
+        union {
+                struct list_head g_list;
+                struct rcu_head g_rcu;
+        };
         /* Protects inode / mnt pointers, flags, masks */
         spinlock_t lock;
         /* List of marks for inode / vfsmount [obj_lock] */
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 8942af0813e3..28ad5f6494b0 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -30,7 +30,7 @@ struct vm_area_struct;
 #define ___GFP_HARDWALL         0x20000u
 #define ___GFP_THISNODE         0x40000u
 #define ___GFP_ATOMIC           0x80000u
-#define ___GFP_NOACCOUNT        0x100000u
+#define ___GFP_ACCOUNT          0x100000u
 #define ___GFP_NOTRACK          0x200000u
 #define ___GFP_DIRECT_RECLAIM   0x400000u
 #define ___GFP_OTHER_NODE       0x800000u
@@ -73,11 +73,15 @@ struct vm_area_struct;
  *
  * __GFP_THISNODE forces the allocation to be satisified from the requested
  *   node with no fallbacks or placement policy enforcements.
+ *
+ * __GFP_ACCOUNT causes the allocation to be accounted to kmemcg (only relevant
+ *   to kmem allocations).
  */
 #define __GFP_RECLAIMABLE ((__force gfp_t)___GFP_RECLAIMABLE)
 #define __GFP_WRITE     ((__force gfp_t)___GFP_WRITE)
 #define __GFP_HARDWALL   ((__force gfp_t)___GFP_HARDWALL)
 #define __GFP_THISNODE  ((__force gfp_t)___GFP_THISNODE)
+#define __GFP_ACCOUNT   ((__force gfp_t)___GFP_ACCOUNT)
 
 /*
  * Watermark modifiers -- controls access to emergency reserves
@@ -104,7 +108,6 @@ struct vm_area_struct;
 #define __GFP_HIGH      ((__force gfp_t)___GFP_HIGH)
 #define __GFP_MEMALLOC  ((__force gfp_t)___GFP_MEMALLOC)
 #define __GFP_NOMEMALLOC ((__force gfp_t)___GFP_NOMEMALLOC)
-#define __GFP_NOACCOUNT ((__force gfp_t)___GFP_NOACCOUNT)
 
 /*
  * Reclaim modifiers
@@ -197,6 +200,9 @@ struct vm_area_struct;
  * GFP_KERNEL is typical for kernel-internal allocations. The caller requires
  *   ZONE_NORMAL or a lower zone for direct access but can direct reclaim.
  *
+ * GFP_KERNEL_ACCOUNT is the same as GFP_KERNEL, except the allocation is
+ *   accounted to kmemcg.
+ *
  * GFP_NOWAIT is for kernel allocations that should not stall for direct
  *   reclaim, start physical IO or use any filesystem callback.
  *
@@ -236,6 +242,7 @@ struct vm_area_struct;
  */
 #define GFP_ATOMIC      (__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)
 #define GFP_KERNEL      (__GFP_RECLAIM | __GFP_IO | __GFP_FS)
+#define GFP_KERNEL_ACCOUNT (GFP_KERNEL | __GFP_ACCOUNT)
 #define GFP_NOWAIT      (__GFP_KSWAPD_RECLAIM)
 #define GFP_NOIO        (__GFP_RECLAIM)
 #define GFP_NOFS        (__GFP_RECLAIM | __GFP_IO)
@@ -271,7 +278,7 @@ static inline int gfpflags_to_migratetype(const gfp_t gfp_flags)
 
 static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
 {
-        return (bool __force)(gfp_flags & __GFP_DIRECT_RECLAIM);
+        return !!(gfp_flags & __GFP_DIRECT_RECLAIM);
 }
 
 #ifdef CONFIG_HIGHMEM
@@ -377,10 +384,11 @@ static inline enum zone_type gfp_zone(gfp_t flags)
 
 static inline int gfp_zonelist(gfp_t flags)
 {
-        if (IS_ENABLED(CONFIG_NUMA) && unlikely(flags & __GFP_THISNODE))
-                return 1;
-
-        return 0;
+#ifdef CONFIG_NUMA
+        if (unlikely(flags & __GFP_THISNODE))
+                return ZONELIST_NOFALLBACK;
+#endif
+        return ZONELIST_FALLBACK;
 }
 
 /*
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index b0eb06423d5e..e76574d8f9b5 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -263,20 +263,18 @@ struct file *hugetlb_file_setup(const char *name, size_t size, vm_flags_t acct,
                                 struct user_struct **user, int creat_flags,
                                 int page_size_log);
 
-static inline int is_file_hugepages(struct file *file)
+static inline bool is_file_hugepages(struct file *file)
 {
         if (file->f_op == &hugetlbfs_file_operations)
-                return 1;
-        if (is_file_shm_hugepages(file))
-                return 1;
+                return true;
 
-        return 0;
+        return is_file_shm_hugepages(file);
 }
 
 
 #else /* !CONFIG_HUGETLBFS */
 
-#define is_file_hugepages(file)                 0
+#define is_file_hugepages(file)                 false
 static inline struct file *
 hugetlb_file_setup(const char *name, size_t size, vm_flags_t acctflag,
                 struct user_struct **user, int creat_flags,
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index fec66f86eeff..173fb44e22f1 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -216,10 +216,10 @@ void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
  * for_each_free_mem_range - iterate through free memblock areas
  * @i: u64 used as loop variable
  * @nid: node selector, %NUMA_NO_NODE for all nodes
+ * @flags: pick from blocks based on memory attributes
  * @p_start: ptr to phys_addr_t for start address of the range, can be %NULL
  * @p_end: ptr to phys_addr_t for end address of the range, can be %NULL
  * @p_nid: ptr to int for nid of the range, can be %NULL
- * @flags: pick from blocks based on memory attributes
  *
  * Walks over free (memory && !reserved) areas of memblock.  Available as
  * soon as memblock is initialized.
@@ -232,10 +232,10 @@ void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
  * for_each_free_mem_range_reverse - rev-iterate through free memblock areas
  * @i: u64 used as loop variable
  * @nid: node selector, %NUMA_NO_NODE for all nodes
+ * @flags: pick from blocks based on memory attributes
  * @p_start: ptr to phys_addr_t for start address of the range, can be %NULL
  * @p_end: ptr to phys_addr_t for end address of the range, can be %NULL
  * @p_nid: ptr to int for nid of the range, can be %NULL
- * @flags: pick from blocks based on memory attributes
  *
  * Walks over free (memory && !reserved) areas of memblock in reverse
  * order.  Available as soon as memblock is initialized.
@@ -325,10 +325,10 @@ phys_addr_t memblock_mem_size(unsigned long limit_pfn);
 phys_addr_t memblock_start_of_DRAM(void);
 phys_addr_t memblock_end_of_DRAM(void);
 void memblock_enforce_memory_limit(phys_addr_t memory_limit);
-int memblock_is_memory(phys_addr_t addr);
+bool memblock_is_memory(phys_addr_t addr);
 int memblock_is_map_memory(phys_addr_t addr);
 int memblock_is_region_memory(phys_addr_t base, phys_addr_t size);
-int memblock_is_reserved(phys_addr_t addr);
+bool memblock_is_reserved(phys_addr_t addr);
 bool memblock_is_region_reserved(phys_addr_t base, phys_addr_t size);
 
 extern void __memblock_dump_all(void);
@@ -399,6 +399,11 @@ static inline unsigned long memblock_region_reserved_end_pfn(const struct memblo
              region < (memblock.memblock_type.regions + memblock.memblock_type.cnt);    \
              region++)
 
+#define for_each_memblock_type(memblock_type, rgn)                      \
+        idx = 0;                                                        \
+        rgn = &memblock_type->regions[idx];                             \
+        for (idx = 0; idx < memblock_type->cnt;                         \
+             idx++,rgn = &memblock_type->regions[idx])
 
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
 #define __init_memblock __meminit
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index cd0e2413c358..2292468f2a30 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -85,32 +85,10 @@ enum mem_cgroup_events_target {
         MEM_CGROUP_NTARGETS,
 };
 
-/*
- * Bits in struct cg_proto.flags
- */
-enum cg_proto_flags {
-        /* Currently active and new sockets should be assigned to cgroups */
-        MEMCG_SOCK_ACTIVE,
-        /* It was ever activated; we must disarm static keys on destruction */
-        MEMCG_SOCK_ACTIVATED,
-};
-
 struct cg_proto {
         struct page_counter     memory_allocated;       /* Current allocated memory. */
-        struct percpu_counter   sockets_allocated;      /* Current number of sockets. */
         int                     memory_pressure;
-        long                    sysctl_mem[3];
-        unsigned long           flags;
-        /*
-         * memcg field is used to find which memcg we belong directly
-         * Each memcg struct can hold more than one cg_proto, so container_of
-         * won't really cut.
-         *
-         * The elegant solution would be having an inverse function to
-         * proto_cgroup in struct proto, but that means polluting the structure
-         * for everybody, instead of just for memcg users.
-         */
-        struct mem_cgroup       *memcg;
+        bool                    active;
 };
 
 #ifdef CONFIG_MEMCG
@@ -192,6 +170,9 @@ struct mem_cgroup {
         unsigned long low;
         unsigned long high;
 
+        /* Range enforcement for interrupt charges */
+        struct work_struct high_work;
+
         unsigned long soft_limit;
 
         /* vmpressure notifications */
@@ -268,6 +249,10 @@ struct mem_cgroup {
         struct wb_domain cgwb_domain;
 #endif
 
+#ifdef CONFIG_INET
+        unsigned long           socket_pressure;
+#endif
+
         /* List of events which userspace want to receive */
         struct list_head event_list;
         spinlock_t event_list_lock;
@@ -275,7 +260,8 @@ struct mem_cgroup {
         struct mem_cgroup_per_node *nodeinfo[0];
         /* WARNING: nodeinfo must be the last member here */
 };
-extern struct cgroup_subsys_state *mem_cgroup_root_css;
+
+extern struct mem_cgroup *root_mem_cgroup;
 
 /**
  * mem_cgroup_events - count memory events against a cgroup
@@ -308,18 +294,34 @@ struct lruvec *mem_cgroup_page_lruvec(struct page *, struct zone *);
 
 bool task_in_mem_cgroup(struct task_struct *task, struct mem_cgroup *memcg);
 struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p);
-struct mem_cgroup *parent_mem_cgroup(struct mem_cgroup *memcg);
 
 static inline
 struct mem_cgroup *mem_cgroup_from_css(struct cgroup_subsys_state *css){
         return css ? container_of(css, struct mem_cgroup, css) : NULL;
 }
 
+#define mem_cgroup_from_counter(counter, member)        \
+        container_of(counter, struct mem_cgroup, member)
+
 struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *,
                                    struct mem_cgroup *,
                                    struct mem_cgroup_reclaim_cookie *);
 void mem_cgroup_iter_break(struct mem_cgroup *, struct mem_cgroup *);
 
+/**
+ * parent_mem_cgroup - find the accounting parent of a memcg
+ * @memcg: memcg whose parent to find
+ *
+ * Returns the parent memcg, or NULL if this is the root or the memory
+ * controller is in legacy no-hierarchy mode.
+ */
+static inline struct mem_cgroup *parent_mem_cgroup(struct mem_cgroup *memcg)
+{
+        if (!memcg->memory.parent)
+                return NULL;
+        return mem_cgroup_from_counter(memcg->memory.parent, memory);
+}
+
 static inline bool mem_cgroup_is_descendant(struct mem_cgroup *memcg,
                               struct mem_cgroup *root)
 {
@@ -671,12 +673,6 @@ void mem_cgroup_count_vm_event(struct mm_struct *mm, enum vm_event_item idx)
 }
 #endif /* CONFIG_MEMCG */
 
-enum {
-        UNDER_LIMIT,
-        SOFT_LIMIT,
-        OVER_LIMIT,
-};
-
 #ifdef CONFIG_CGROUP_WRITEBACK
 
 struct list_head *mem_cgroup_cgwb_list(struct mem_cgroup *memcg);
@@ -703,20 +699,35 @@ static inline void mem_cgroup_wb_stats(struct bdi_writeback *wb,
 #endif  /* CONFIG_CGROUP_WRITEBACK */
 
 struct sock;
-#if defined(CONFIG_INET) && defined(CONFIG_MEMCG_KMEM)
 void sock_update_memcg(struct sock *sk);
 void sock_release_memcg(struct sock *sk);
-#else
-static inline void sock_update_memcg(struct sock *sk)
+bool mem_cgroup_charge_skmem(struct mem_cgroup *memcg, unsigned int nr_pages);
+void mem_cgroup_uncharge_skmem(struct mem_cgroup *memcg, unsigned int nr_pages);
+#if defined(CONFIG_MEMCG) && defined(CONFIG_INET)
+extern struct static_key_false memcg_sockets_enabled_key;
+#define mem_cgroup_sockets_enabled static_branch_unlikely(&memcg_sockets_enabled_key)
+static inline bool mem_cgroup_under_socket_pressure(struct mem_cgroup *memcg)
 {
+#ifdef CONFIG_MEMCG_KMEM
+        if (memcg->tcp_mem.memory_pressure)
+                return true;
+#endif
+        do {
+                if (time_before(jiffies, memcg->socket_pressure))
+                        return true;
+        } while ((memcg = parent_mem_cgroup(memcg)));
+        return false;
 }
-static inline void sock_release_memcg(struct sock *sk)
+#else
+#define mem_cgroup_sockets_enabled 0
+static inline bool mem_cgroup_under_socket_pressure(struct mem_cgroup *memcg)
 {
+        return false;
 }
-#endif /* CONFIG_INET && CONFIG_MEMCG_KMEM */
+#endif
 
 #ifdef CONFIG_MEMCG_KMEM
-extern struct static_key memcg_kmem_enabled_key;
+extern struct static_key_false memcg_kmem_enabled_key;
 
 extern int memcg_nr_cache_ids;
 void memcg_get_cache_ids(void);
@@ -732,7 +743,7 @@ void memcg_put_cache_ids(void);
 
 static inline bool memcg_kmem_enabled(void)
 {
-        return static_key_false(&memcg_kmem_enabled_key);
+        return static_branch_unlikely(&memcg_kmem_enabled_key);
 }
 
 static inline bool memcg_kmem_is_active(struct mem_cgroup *memcg)
@@ -766,15 +777,13 @@ static inline int memcg_cache_id(struct mem_cgroup *memcg)
         return memcg ? memcg->kmemcg_id : -1;
 }
 
-struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep);
+struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp);
 void __memcg_kmem_put_cache(struct kmem_cache *cachep);
 
-static inline bool __memcg_kmem_bypass(gfp_t gfp)
+static inline bool __memcg_kmem_bypass(void)
 {
         if (!memcg_kmem_enabled())
                 return true;
-        if (gfp & __GFP_NOACCOUNT)
-                return true;
         if (in_interrupt() || (!current->mm) || (current->flags & PF_KTHREAD))
                 return true;
         return false;
@@ -791,7 +800,9 @@ static inline bool __memcg_kmem_bypass(gfp_t gfp)
 static __always_inline int memcg_kmem_charge(struct page *page,
                                              gfp_t gfp, int order)
 {
-        if (__memcg_kmem_bypass(gfp))
+        if (__memcg_kmem_bypass())
+                return 0;
+        if (!(gfp & __GFP_ACCOUNT))
                 return 0;
         return __memcg_kmem_charge(page, gfp, order);
 }
@@ -810,16 +821,15 @@ static __always_inline void memcg_kmem_uncharge(struct page *page, int order)
 /**
  * memcg_kmem_get_cache: selects the correct per-memcg cache for allocation
  * @cachep: the original global kmem cache
- * @gfp: allocation flags.
  *
  * All memory allocated from a per-memcg cache is charged to the owner memcg.
  */
 static __always_inline struct kmem_cache *
 memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp)
 {
-        if (__memcg_kmem_bypass(gfp))
+        if (__memcg_kmem_bypass())
                 return cachep;
-        return __memcg_kmem_get_cache(cachep);
+        return __memcg_kmem_get_cache(cachep, gfp);
 }
 
 static __always_inline void memcg_kmem_put_cache(struct kmem_cache *cachep)
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 3d385c81c153..2696c1f05ed1 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -122,7 +122,7 @@ struct sp_node {
 
 struct shared_policy {
         struct rb_root root;
-        spinlock_t lock;
+        rwlock_t lock;
 };
 
 int vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 00bad7793788..839d9e9a1c38 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -51,6 +51,17 @@ extern int sysctl_legacy_va_layout;
 #define sysctl_legacy_va_layout 0
 #endif
 
+#ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS
+extern const int mmap_rnd_bits_min;
+extern const int mmap_rnd_bits_max;
+extern int mmap_rnd_bits __read_mostly;
+#endif
+#ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS
+extern const int mmap_rnd_compat_bits_min;
+extern const int mmap_rnd_compat_bits_max;
+extern int mmap_rnd_compat_bits __read_mostly;
+#endif
+
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -225,10 +236,14 @@ extern pgprot_t protection_map[16];
  * ->fault function. The vma's ->fault is responsible for returning a bitmask
  * of VM_FAULT_xxx flags that give details about how the fault was handled.
  *
+ * MM layer fills up gfp_mask for page allocations but fault handler might
+ * alter it if its implementation requires a different allocation context.
+ *
  * pgoff should be used in favour of virtual_address, if possible.
  */
 struct vm_fault {
         unsigned int flags;             /* FAULT_FLAG_xxx flags */
+        gfp_t gfp_mask;                 /* gfp mask to be used for allocations */
         pgoff_t pgoff;                  /* Logical page offset based on vma */
         void __user *virtual_address;   /* Faulting virtual address */
 
@@ -1361,10 +1376,26 @@ static inline void dec_mm_counter(struct mm_struct *mm, int member)
         atomic_long_dec(&mm->rss_stat.count[member]);
 }
 
+/* Optimized variant when page is already known not to be PageAnon */
+static inline int mm_counter_file(struct page *page)
+{
+        if (PageSwapBacked(page))
+                return MM_SHMEMPAGES;
+        return MM_FILEPAGES;
+}
+
+static inline int mm_counter(struct page *page)
+{
+        if (PageAnon(page))
+                return MM_ANONPAGES;
+        return mm_counter_file(page);
+}
+
 static inline unsigned long get_mm_rss(struct mm_struct *mm)
 {
         return get_mm_counter(mm, MM_FILEPAGES) +
-                get_mm_counter(mm, MM_ANONPAGES);
+                get_mm_counter(mm, MM_ANONPAGES) +
+                get_mm_counter(mm, MM_SHMEMPAGES);
 }
 
 static inline unsigned long get_mm_hiwater_rss(struct mm_struct *mm)
@@ -1898,7 +1929,9 @@ extern void mm_drop_all_locks(struct mm_struct *mm);
 extern void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file);
 extern struct file *get_mm_exe_file(struct mm_struct *mm);
 
-extern int may_expand_vm(struct mm_struct *mm, unsigned long npages);
+extern bool may_expand_vm(struct mm_struct *, vm_flags_t, unsigned long npages);
+extern void vm_stat_account(struct mm_struct *, vm_flags_t, long npages);
+
 extern struct vm_area_struct *_install_special_mapping(struct mm_struct *mm,
                                    unsigned long addr, unsigned long len,
                                    unsigned long flags,
@@ -2116,15 +2149,6 @@ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
 extern int apply_to_page_range(struct mm_struct *mm, unsigned long address,
                                unsigned long size, pte_fn_t fn, void *data);
 
-#ifdef CONFIG_PROC_FS
-void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
-#else
-static inline void vm_stat_account(struct mm_struct *mm,
-                        unsigned long flags, struct file *file, long pages)
-{
-        mm->total_vm += pages;
-}
-#endif /* CONFIG_PROC_FS */
 
 #ifdef CONFIG_DEBUG_PAGEALLOC
 extern bool _debug_pagealloc_enabled;
diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index cf55945c83fb..712e8c37a200 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -100,4 +100,6 @@ static __always_inline enum lru_list page_lru(struct page *page)
         return lru;
 }
 
+#define lru_to_page(head) (list_entry((head)->prev, struct page, lru))
+
 #endif
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index f8d1492a114f..6bc9a0ce2253 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -369,9 +369,10 @@ struct core_state {
 };
 
 enum {
-        MM_FILEPAGES,
-        MM_ANONPAGES,
-        MM_SWAPENTS,
+        MM_FILEPAGES,   /* Resident file mapping pages */
+        MM_ANONPAGES,   /* Resident anonymous pages */
+        MM_SWAPENTS,    /* Anonymous swap entries */
+        MM_SHMEMPAGES,  /* Resident shared memory pages */
         NR_MM_COUNTERS
 };
 
@@ -426,7 +427,7 @@ struct mm_struct {
         unsigned long total_vm;         /* Total pages mapped */
         unsigned long locked_vm;        /* Pages that have PG_mlocked set */
         unsigned long pinned_vm;        /* Refcount permanently increased */
-        unsigned long shared_vm;        /* Shared pages (files) */
+        unsigned long data_vm;          /* VM_WRITE & ~VM_SHARED/GROWSDOWN */
         unsigned long exec_vm;          /* VM_EXEC & ~VM_WRITE */
         unsigned long stack_vm;         /* VM_GROWSUP/DOWN */
         unsigned long def_flags;
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index e23a9e704536..33bb1b19273e 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -195,11 +195,6 @@ static inline int is_active_lru(enum lru_list lru)
         return (lru == LRU_ACTIVE_ANON || lru == LRU_ACTIVE_FILE);
 }
 
-static inline int is_unevictable_lru(enum lru_list lru)
-{
-        return (lru == LRU_UNEVICTABLE);
-}
-
 struct zone_reclaim_stat {
         /*
          * The pageout code in vmscan.c keeps track of how many of the
@@ -361,10 +356,10 @@ struct zone {
         struct per_cpu_pageset __percpu *pageset;
 
         /*
-         * This is a per-zone reserve of pages that should not be
-         * considered dirtyable memory.
+         * This is a per-zone reserve of pages that are not available
+         * to userspace allocations.
          */
-        unsigned long           dirty_balance_reserve;
+        unsigned long           totalreserve_pages;
 
 #ifndef CONFIG_SPARSEMEM
         /*
@@ -576,19 +571,17 @@ static inline bool zone_is_empty(struct zone *zone)
 /* Maximum number of zones on a zonelist */
 #define MAX_ZONES_PER_ZONELIST (MAX_NUMNODES * MAX_NR_ZONES)
 
+enum {
+        ZONELIST_FALLBACK,      /* zonelist with fallback */
 #ifdef CONFIG_NUMA
-
-/*
- * The NUMA zonelists are doubled because we need zonelists that restrict the
- * allocations to a single node for __GFP_THISNODE.
- *
- * [0]  : Zonelist with fallback
- * [1]  : No fallback (__GFP_THISNODE)
- */
-#define MAX_ZONELISTS 2
-#else
-#define MAX_ZONELISTS 1
+        /*
+         * The NUMA zonelists are doubled because we need zonelists that
+         * restrict the allocations to a single node for __GFP_THISNODE.
+         */
+        ZONELIST_NOFALLBACK,    /* zonelist without fallback (__GFP_THISNODE) */
 #endif
+        MAX_ZONELISTS
+};
 
 /*
  * This struct contains information about a zone in a zonelist. It is stored
@@ -1207,13 +1200,13 @@ unsigned long __init node_memmap_size_bytes(int, unsigned long, unsigned long);
  * the zone and PFN linkages are still valid. This is expensive, but walkers
  * of the full memmap are extremely rare.
  */
-int memmap_valid_within(unsigned long pfn,
+bool memmap_valid_within(unsigned long pfn,
                                         struct page *page, struct zone *zone);
 #else
-static inline int memmap_valid_within(unsigned long pfn,
+static inline bool memmap_valid_within(unsigned long pfn,
                                         struct page *page, struct zone *zone)
 {
-        return 1;
+        return true;
 }
 #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
 
diff --git a/include/linux/pfn.h b/include/linux/pfn.h
index 7646637221f3..97f3e88aead4 100644
--- a/include/linux/pfn.h
+++ b/include/linux/pfn.h
@@ -9,5 +9,6 @@
 #define PFN_UP(x)       (((x) + PAGE_SIZE-1) >> PAGE_SHIFT)
 #define PFN_DOWN(x)     ((x) >> PAGE_SHIFT)
 #define PFN_PHYS(x)     ((phys_addr_t)(x) << PAGE_SHIFT)
+#define PHYS_PFN(x)     ((unsigned long)((x) >> PAGE_SHIFT))
 
 #endif
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index 50777b5b1e4c..a43f41cb3c43 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -60,6 +60,10 @@ extern struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
 extern void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end);
 extern int shmem_unuse(swp_entry_t entry, struct page *page);
 
+extern unsigned long shmem_swap_usage(struct vm_area_struct *vma);
+extern unsigned long shmem_partial_swap_usage(struct address_space *mapping,
+                                                pgoff_t start, pgoff_t end);
+
 static inline struct page *shmem_read_mapping_page(
                                 struct address_space *mapping, pgoff_t index)
 {
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 2037a861e367..3ffee7422012 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -86,6 +86,11 @@
 #else
 # define SLAB_FAILSLAB          0x00000000UL
 #endif
+#ifdef CONFIG_MEMCG_KMEM
+# define SLAB_ACCOUNT           0x04000000UL    /* Account to memcg */
+#else
+# define SLAB_ACCOUNT           0x00000000UL
+#endif
 
 /* The following flags affect the page allocator grouping pages by mobility */
 #define SLAB_RECLAIM_ACCOUNT    0x00020000UL            /* Objects are reclaimable */
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 7ba7dccaf0e7..066bd21765ad 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -287,7 +287,6 @@ static inline void workingset_node_shadows_dec(struct radix_tree_node *node)
 /* linux/mm/page_alloc.c */
 extern unsigned long totalram_pages;
 extern unsigned long totalreserve_pages;
-extern unsigned long dirty_balance_reserve;
 extern unsigned long nr_free_buffer_pages(void);
 extern unsigned long nr_free_pagecache_pages(void);
 
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index ff307b548ed3..b4c2a485b28a 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -56,9 +56,10 @@ extern long do_no_restart_syscall(struct restart_block *parm);
 #ifdef __KERNEL__
 
 #ifdef CONFIG_DEBUG_STACK_USAGE
-# define THREADINFO_GFP         (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
+# define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT | __GFP_NOTRACK | \
+                                 __GFP_ZERO)
 #else
-# define THREADINFO_GFP         (GFP_KERNEL | __GFP_NOTRACK)
+# define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT | __GFP_NOTRACK)
 #endif
 
 /*
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 3bff87a25a42..d1f1d338af20 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -14,7 +14,6 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
 #define VM_ALLOC                0x00000002      /* vmalloc() */
 #define VM_MAP                  0x00000004      /* vmap()ed pages */
 #define VM_USERMAP              0x00000008      /* suitable for remap_vmalloc_range */
-#define VM_VPAGES               0x00000010      /* buffer for pages was vmalloc'ed */
 #define VM_UNINITIALIZED        0x00000020      /* vm_struct is not fully initialized */
 #define VM_NO_GUARD             0x00000040      /* don't add guard page */
 #define VM_KASAN                0x00000080      /* has allocated kasan shadow memory */
diff --git a/include/linux/vmpressure.h b/include/linux/vmpressure.h
index 3e4535876d37..3347cc3ec0ab 100644
--- a/include/linux/vmpressure.h
+++ b/include/linux/vmpressure.h
@@ -12,6 +12,9 @@
 struct vmpressure {
         unsigned long scanned;
         unsigned long reclaimed;
+
+        unsigned long tree_scanned;
+        unsigned long tree_reclaimed;
         /* The lock is used to keep the scanned/reclaimed above in sync. */
         struct spinlock sr_lock;
 
@@ -26,7 +29,7 @@ struct vmpressure {
 struct mem_cgroup;
 
 #ifdef CONFIG_MEMCG
-extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
+extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg, bool tree,
                        unsigned long scanned, unsigned long reclaimed);
 extern void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio);
 
@@ -40,7 +43,7 @@ extern int vmpressure_register_event(struct mem_cgroup *memcg,
 extern void vmpressure_unregister_event(struct mem_cgroup *memcg,
                                         struct eventfd_ctx *eventfd);
 #else
-static inline void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
+static inline void vmpressure(gfp_t gfp, struct mem_cgroup *memcg, bool tree,
                               unsigned long scanned, unsigned long reclaimed) {}
 static inline void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg,
                                    int prio) {}
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 3e5d9075960f..73fae8c4a5fb 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -189,6 +189,7 @@ extern void __inc_zone_state(struct zone *, enum zone_stat_item);
 extern void dec_zone_state(struct zone *, enum zone_stat_item);
 extern void __dec_zone_state(struct zone *, enum zone_stat_item);
 
+void quiet_vmstat(void);
 void cpu_vm_stats_fold(int cpu);
 void refresh_zone_stat_thresholds(void);
 
@@ -249,6 +250,7 @@ static inline void __dec_zone_page_state(struct page *page,
 
 static inline void refresh_zone_stat_thresholds(void) { }
 static inline void cpu_vm_stats_fold(int cpu) { }
+static inline void quiet_vmstat(void) { }
 
 static inline void drain_zonestat(struct zone *zone,
                         struct per_cpu_pageset *pset) { }
diff --git a/include/net/sock.h b/include/net/sock.h
index e830c1006935..b9e7b3d863a0 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -71,22 +71,6 @@
 #include <net/tcp_states.h>
 #include <linux/net_tstamp.h>
 
-struct cgroup;
-struct cgroup_subsys;
-#ifdef CONFIG_NET
-int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss);
-void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg);
-#else
-static inline
-int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
-{
-        return 0;
-}
-static inline
-void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg)
-{
-}
-#endif
 /*
  * This structure really needs to be cleaned up.
  * Most of it is for TCP, and not used by any of
@@ -245,7 +229,6 @@ struct sock_common {
         /* public: */
 };
 
-struct cg_proto;
 /**
   *     struct sock - network layer representation of sockets
   *     @__sk_common: shared layout with inet_timewait_sock
@@ -310,7 +293,7 @@ struct cg_proto;
   *     @sk_security: used by security modules
   *     @sk_mark: generic packet mark
   *     @sk_cgrp_data: cgroup data for this cgroup
-  *     @sk_cgrp: this socket's cgroup-specific proto data
+  *     @sk_memcg: this socket's memory cgroup association
   *     @sk_write_pending: a write to stream socket waits to start
   *     @sk_state_change: callback to indicate change in the state of the sock
   *     @sk_data_ready: callback to indicate there is data to be processed
@@ -446,7 +429,7 @@ struct sock {
         void                    *sk_security;
 #endif
         struct sock_cgroup_data sk_cgrp_data;
-        struct cg_proto         *sk_cgrp;
+        struct mem_cgroup       *sk_memcg;
         void                    (*sk_state_change)(struct sock *sk);
         void                    (*sk_data_ready)(struct sock *sk);
         void                    (*sk_write_space)(struct sock *sk);
@@ -1096,23 +1079,6 @@ static inline void sk_refcnt_debug_release(const struct sock *sk)
 #define sk_refcnt_debug_release(sk) do { } while (0)
 #endif /* SOCK_REFCNT_DEBUG */
 
-#if defined(CONFIG_MEMCG_KMEM) && defined(CONFIG_NET)
-extern struct static_key memcg_socket_limit_enabled;
-static inline struct cg_proto *parent_cg_proto(struct proto *proto,
-                                               struct cg_proto *cg_proto)
-{
-        return proto->proto_cgroup(parent_mem_cgroup(cg_proto->memcg));
-}
-#define mem_cgroup_sockets_enabled static_key_false(&memcg_socket_limit_enabled)
-#else
-#define mem_cgroup_sockets_enabled 0
-static inline struct cg_proto *parent_cg_proto(struct proto *proto,
-                                               struct cg_proto *cg_proto)
-{
-        return NULL;
-}
-#endif
-
 static inline bool sk_stream_memory_free(const struct sock *sk)
 {
         if (sk->sk_wmem_queued >= sk->sk_sndbuf)
@@ -1139,8 +1105,9 @@ static inline bool sk_under_memory_pressure(const struct sock *sk)
         if (!sk->sk_prot->memory_pressure)
                 return false;
 
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                return !!sk->sk_cgrp->memory_pressure;
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg &&
+            mem_cgroup_under_socket_pressure(sk->sk_memcg))
+                return true;
 
         return !!*sk->sk_prot->memory_pressure;
 }
@@ -1154,15 +1121,6 @@ static inline void sk_leave_memory_pressure(struct sock *sk)
 
         if (*memory_pressure)
                 *memory_pressure = 0;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
-                struct cg_proto *cg_proto = sk->sk_cgrp;
-                struct proto *prot = sk->sk_prot;
-
-                for (; cg_proto; cg_proto = parent_cg_proto(prot, cg_proto))
-                        cg_proto->memory_pressure = 0;
-        }
-
 }
 
 static inline void sk_enter_memory_pressure(struct sock *sk)
@@ -1170,116 +1128,46 @@ static inline void sk_enter_memory_pressure(struct sock *sk)
         if (!sk->sk_prot->enter_memory_pressure)
                 return;
 
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
-                struct cg_proto *cg_proto = sk->sk_cgrp;
-                struct proto *prot = sk->sk_prot;
-
-                for (; cg_proto; cg_proto = parent_cg_proto(prot, cg_proto))
-                        cg_proto->memory_pressure = 1;
-        }
-
         sk->sk_prot->enter_memory_pressure(sk);
 }
 
 static inline long sk_prot_mem_limits(const struct sock *sk, int index)
 {
-        long *prot = sk->sk_prot->sysctl_mem;
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                prot = sk->sk_cgrp->sysctl_mem;
-        return prot[index];
-}
-
-static inline void memcg_memory_allocated_add(struct cg_proto *prot,
-                                              unsigned long amt,
-                                              int *parent_status)
-{
-        page_counter_charge(&prot->memory_allocated, amt);
-
-        if (page_counter_read(&prot->memory_allocated) >
-            prot->memory_allocated.limit)
-                *parent_status = OVER_LIMIT;
-}
-
-static inline void memcg_memory_allocated_sub(struct cg_proto *prot,
-                                              unsigned long amt)
-{
-        page_counter_uncharge(&prot->memory_allocated, amt);
+        return sk->sk_prot->sysctl_mem[index];
 }
 
 static inline long
 sk_memory_allocated(const struct sock *sk)
 {
-        struct proto *prot = sk->sk_prot;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                return page_counter_read(&sk->sk_cgrp->memory_allocated);
-
-        return atomic_long_read(prot->memory_allocated);
+        return atomic_long_read(sk->sk_prot->memory_allocated);
 }
 
 static inline long
-sk_memory_allocated_add(struct sock *sk, int amt, int *parent_status)
+sk_memory_allocated_add(struct sock *sk, int amt)
 {
-        struct proto *prot = sk->sk_prot;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
-                memcg_memory_allocated_add(sk->sk_cgrp, amt, parent_status);
-                /* update the root cgroup regardless */
-                atomic_long_add_return(amt, prot->memory_allocated);
-                return page_counter_read(&sk->sk_cgrp->memory_allocated);
-        }
-
-        return atomic_long_add_return(amt, prot->memory_allocated);
+        return atomic_long_add_return(amt, sk->sk_prot->memory_allocated);
 }
 
 static inline void
 sk_memory_allocated_sub(struct sock *sk, int amt)
 {
-        struct proto *prot = sk->sk_prot;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                memcg_memory_allocated_sub(sk->sk_cgrp, amt);
-
-        atomic_long_sub(amt, prot->memory_allocated);
+        atomic_long_sub(amt, sk->sk_prot->memory_allocated);
 }
 
 static inline void sk_sockets_allocated_dec(struct sock *sk)
 {
-        struct proto *prot = sk->sk_prot;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
-                struct cg_proto *cg_proto = sk->sk_cgrp;
-
-                for (; cg_proto; cg_proto = parent_cg_proto(prot, cg_proto))
-                        percpu_counter_dec(&cg_proto->sockets_allocated);
-        }
-
-        percpu_counter_dec(prot->sockets_allocated);
+        percpu_counter_dec(sk->sk_prot->sockets_allocated);
 }
 
 static inline void sk_sockets_allocated_inc(struct sock *sk)
 {
-        struct proto *prot = sk->sk_prot;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
-                struct cg_proto *cg_proto = sk->sk_cgrp;
-
-                for (; cg_proto; cg_proto = parent_cg_proto(prot, cg_proto))
-                        percpu_counter_inc(&cg_proto->sockets_allocated);
-        }
-
-        percpu_counter_inc(prot->sockets_allocated);
+        percpu_counter_inc(sk->sk_prot->sockets_allocated);
 }
 
 static inline int
 sk_sockets_allocated_read_positive(struct sock *sk)
 {
-        struct proto *prot = sk->sk_prot;
-
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                return percpu_counter_read_positive(&sk->sk_cgrp->sockets_allocated);
-
-        return percpu_counter_read_positive(prot->sockets_allocated);
+        return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
 }
 
 static inline int
diff --git a/include/net/tcp.h b/include/net/tcp.h
index a80255f4ca33..8ea19977ea53 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -289,8 +289,9 @@ extern int tcp_memory_pressure;
 /* optimized version of sk_under_memory_pressure() for TCP sockets */
 static inline bool tcp_under_memory_pressure(const struct sock *sk)
 {
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                return !!sk->sk_cgrp->memory_pressure;
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg &&
+            mem_cgroup_under_socket_pressure(sk->sk_memcg))
+                return true;
 
         return tcp_memory_pressure;
 }
diff --git a/include/net/tcp_memcontrol.h b/include/net/tcp_memcontrol.h
index 05b94d9453de..3a17b16ae8aa 100644
--- a/include/net/tcp_memcontrol.h
+++ b/include/net/tcp_memcontrol.h
@@ -1,7 +1,6 @@
 #ifndef _TCP_MEMCG_H
 #define _TCP_MEMCG_H
 
-struct cg_proto *tcp_proto_cgroup(struct mem_cgroup *memcg);
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss);
 void tcp_destroy_cgroup(struct mem_cgroup *memcg);
 #endif /* _TCP_MEMCG_H */
diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h
new file mode 100644
index 000000000000..97d635cabac8
--- /dev/null
+++ b/include/trace/events/huge_memory.h
@@ -0,0 +1,136 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM huge_memory
+
+#if !defined(__HUGE_MEMORY_H) || defined(TRACE_HEADER_MULTI_READ)
+#define __HUGE_MEMORY_H
+
+#include  <linux/tracepoint.h>
+
+#include <trace/events/gfpflags.h>
+
+#define SCAN_STATUS                                                     \
+        EM( SCAN_FAIL,                  "failed")                       \
+        EM( SCAN_SUCCEED,               "succeeded")                    \
+        EM( SCAN_PMD_NULL,              "pmd_null")                     \
+        EM( SCAN_EXCEED_NONE_PTE,       "exceed_none_pte")              \
+        EM( SCAN_PTE_NON_PRESENT,       "pte_non_present")              \
+        EM( SCAN_PAGE_RO,               "no_writable_page")             \
+        EM( SCAN_NO_REFERENCED_PAGE,    "no_referenced_page")           \
+        EM( SCAN_PAGE_NULL,             "page_null")                    \
+        EM( SCAN_SCAN_ABORT,            "scan_aborted")                 \
+        EM( SCAN_PAGE_COUNT,            "not_suitable_page_count")      \
+        EM( SCAN_PAGE_LRU,              "page_not_in_lru")              \
+        EM( SCAN_PAGE_LOCK,             "page_locked")                  \
+        EM( SCAN_PAGE_ANON,             "page_not_anon")                \
+        EM( SCAN_ANY_PROCESS,           "no_process_for_page")          \
+        EM( SCAN_VMA_NULL,              "vma_null")                     \
+        EM( SCAN_VMA_CHECK,             "vma_check_failed")             \
+        EM( SCAN_ADDRESS_RANGE,         "not_suitable_address_range")   \
+        EM( SCAN_SWAP_CACHE_PAGE,       "page_swap_cache")              \
+        EM( SCAN_DEL_PAGE_LRU,          "could_not_delete_page_from_lru")\
+        EM( SCAN_ALLOC_HUGE_PAGE_FAIL,  "alloc_huge_page_failed")       \
+        EMe( SCAN_CGROUP_CHARGE_FAIL,   "ccgroup_charge_failed")
+
+#undef EM
+#undef EMe
+#define EM(a, b)        TRACE_DEFINE_ENUM(a);
+#define EMe(a, b)       TRACE_DEFINE_ENUM(a);
+
+SCAN_STATUS
+
+#undef EM
+#undef EMe
+#define EM(a, b)        {a, b},
+#define EMe(a, b)       {a, b}
+
+TRACE_EVENT(mm_khugepaged_scan_pmd,
+
+        TP_PROTO(struct mm_struct *mm, unsigned long pfn, bool writable,
+                 bool referenced, int none_or_zero, int status),
+
+        TP_ARGS(mm, pfn, writable, referenced, none_or_zero, status),
+
+        TP_STRUCT__entry(
+                __field(struct mm_struct *, mm)
+                __field(unsigned long, pfn)
+                __field(bool, writable)
+                __field(bool, referenced)
+                __field(int, none_or_zero)
+                __field(int, status)
+        ),
+
+        TP_fast_assign(
+                __entry->mm = mm;
+                __entry->pfn = pfn;
+                __entry->writable = writable;
+                __entry->referenced = referenced;
+                __entry->none_or_zero = none_or_zero;
+                __entry->status = status;
+        ),
+
+        TP_printk("mm=%p, scan_pfn=0x%lx, writable=%d, referenced=%d, none_or_zero=%d, status=%s",
+                __entry->mm,
+                __entry->pfn,
+                __entry->writable,
+                __entry->referenced,
+                __entry->none_or_zero,
+                __print_symbolic(__entry->status, SCAN_STATUS))
+);
+
+TRACE_EVENT(mm_collapse_huge_page,
+
+        TP_PROTO(struct mm_struct *mm, int isolated, int status),
+
+        TP_ARGS(mm, isolated, status),
+
+        TP_STRUCT__entry(
+                __field(struct mm_struct *, mm)
+                __field(int, isolated)
+                __field(int, status)
+        ),
+
+        TP_fast_assign(
+                __entry->mm = mm;
+                __entry->isolated = isolated;
+                __entry->status = status;
+        ),
+
+        TP_printk("mm=%p, isolated=%d, status=%s",
+                __entry->mm,
+                __entry->isolated,
+                __print_symbolic(__entry->status, SCAN_STATUS))
+);
+
+TRACE_EVENT(mm_collapse_huge_page_isolate,
+
+        TP_PROTO(unsigned long pfn, int none_or_zero,
+                 bool referenced, bool  writable, int status),
+
+        TP_ARGS(pfn, none_or_zero, referenced, writable, status),
+
+        TP_STRUCT__entry(
+                __field(unsigned long, pfn)
+                __field(int, none_or_zero)
+                __field(bool, referenced)
+                __field(bool, writable)
+                __field(int, status)
+        ),
+
+        TP_fast_assign(
+                __entry->pfn = pfn;
+                __entry->none_or_zero = none_or_zero;
+                __entry->referenced = referenced;
+                __entry->writable = writable;
+                __entry->status = status;
+        ),
+
+        TP_printk("scan_pfn=0x%lx, none_or_zero=%d, referenced=%d, writable=%d, status=%s",
+                __entry->pfn,
+                __entry->none_or_zero,
+                __entry->referenced,
+                __entry->writable,
+                __print_symbolic(__entry->status, SCAN_STATUS))
+);
+
+#endif /* __HUGE_MEMORY_H */
+#include <trace/define_trace.h>
diff --git a/include/trace/events/page_isolation.h b/include/trace/events/page_isolation.h
new file mode 100644
index 000000000000..6fb644029c80
--- /dev/null
+++ b/include/trace/events/page_isolation.h
@@ -0,0 +1,38 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM page_isolation
+
+#if !defined(_TRACE_PAGE_ISOLATION_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_PAGE_ISOLATION_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(test_pages_isolated,
+
+        TP_PROTO(
+                unsigned long start_pfn,
+                unsigned long end_pfn,
+                unsigned long fin_pfn),
+
+        TP_ARGS(start_pfn, end_pfn, fin_pfn),
+
+        TP_STRUCT__entry(
+                __field(unsigned long, start_pfn)
+                __field(unsigned long, end_pfn)
+                __field(unsigned long, fin_pfn)
+        ),
+
+        TP_fast_assign(
+                __entry->start_pfn = start_pfn;
+                __entry->end_pfn = end_pfn;
+                __entry->fin_pfn = fin_pfn;
+        ),
+
+        TP_printk("start_pfn=0x%lx end_pfn=0x%lx fin_pfn=0x%lx ret=%s",
+                __entry->start_pfn, __entry->end_pfn, __entry->fin_pfn,
+                __entry->end_pfn == __entry->fin_pfn ? "success" : "fail")
+);
+
+#endif /* _TRACE_PAGE_ISOLATION_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/include/trace/events/vmscan.h b/include/trace/events/vmscan.h
index f66476b96264..31763dd8db1c 100644
--- a/include/trace/events/vmscan.h
+++ b/include/trace/events/vmscan.h
@@ -330,10 +330,9 @@ DEFINE_EVENT(mm_vmscan_lru_isolate_template, mm_vmscan_memcg_isolate,
 
 TRACE_EVENT(mm_vmscan_writepage,
 
-        TP_PROTO(struct page *page,
-                int reclaim_flags),
+        TP_PROTO(struct page *page),
 
-        TP_ARGS(page, reclaim_flags),
+        TP_ARGS(page),
 
         TP_STRUCT__entry(
                 __field(unsigned long, pfn)
@@ -342,7 +341,7 @@ TRACE_EVENT(mm_vmscan_writepage,
 
         TP_fast_assign(
                 __entry->pfn = page_to_pfn(page);
-                __entry->reclaim_flags = reclaim_flags;
+                __entry->reclaim_flags = trace_reclaim_flags(page);
         ),
 
         TP_printk("page=%p pfn=%lu flags=%s",
@@ -353,11 +352,11 @@ TRACE_EVENT(mm_vmscan_writepage,
 
 TRACE_EVENT(mm_vmscan_lru_shrink_inactive,
 
-        TP_PROTO(int nid, int zid,
-                        unsigned long nr_scanned, unsigned long nr_reclaimed,
-                        int priority, int reclaim_flags),
+        TP_PROTO(struct zone *zone,
+                unsigned long nr_scanned, unsigned long nr_reclaimed,
+                int priority, int file),
 
-        TP_ARGS(nid, zid, nr_scanned, nr_reclaimed, priority, reclaim_flags),
+        TP_ARGS(zone, nr_scanned, nr_reclaimed, priority, file),
 
         TP_STRUCT__entry(
                 __field(int, nid)
@@ -369,12 +368,12 @@ TRACE_EVENT(mm_vmscan_lru_shrink_inactive,
         ),
 
         TP_fast_assign(
-                __entry->nid = nid;
-                __entry->zid = zid;
+                __entry->nid = zone_to_nid(zone);
+                __entry->zid = zone_idx(zone);
                 __entry->nr_scanned = nr_scanned;
                 __entry->nr_reclaimed = nr_reclaimed;
                 __entry->priority = priority;
-                __entry->reclaim_flags = reclaim_flags;
+                __entry->reclaim_flags = trace_shrink_flags(file);
         ),
 
         TP_printk("nid=%d zid=%d nr_scanned=%ld nr_reclaimed=%ld priority=%d flags=%s",
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 161a1807e6ef..f4617cf07069 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -1438,7 +1438,7 @@ static int __init init_mqueue_fs(void)
 
         mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache",
                                 sizeof(struct mqueue_inode_info), 0,
-                                SLAB_HWCACHE_ALIGN, init_once);
+                                SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT, init_once);
         if (mqueue_inode_cachep == NULL)
                 return -ENOMEM;
 
diff --git a/kernel/cred.c b/kernel/cred.c
index 71179a09c1d6..0c0cd8a62285 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -569,8 +569,8 @@ EXPORT_SYMBOL(revert_creds);
 void __init cred_init(void)
 {
         /* allocate a slab in which we can store credentials */
-        cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred),
-                                     0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+        cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
 }
 
 /**
diff --git a/kernel/delayacct.c b/kernel/delayacct.c
index ef90b04d783f..435c14a45118 100644
--- a/kernel/delayacct.c
+++ b/kernel/delayacct.c
@@ -34,7 +34,7 @@ __setup("nodelayacct", delayacct_setup_disable);
 
 void delayacct_init(void)
 {
-        delayacct_cache = KMEM_CACHE(task_delay_info, SLAB_PANIC);
+        delayacct_cache = KMEM_CACHE(task_delay_info, SLAB_PANIC|SLAB_ACCOUNT);
         delayacct_tsk_init(&init_task);
 }
 
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 7dad84913abf..bb0669169716 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -180,7 +180,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
         lru_cache_add_active_or_unevictable(kpage, vma);
 
         if (!PageAnon(page)) {
-                dec_mm_counter(mm, MM_FILEPAGES);
+                dec_mm_counter(mm, mm_counter_file(page));
                 inc_mm_counter(mm, MM_ANONPAGES);
         }
 
diff --git a/kernel/fork.c b/kernel/fork.c
index 6774e6b2e96d..2e391c754ae7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -300,9 +300,9 @@ void __init fork_init(void)
 #define ARCH_MIN_TASKALIGN      L1_CACHE_BYTES
 #endif
         /* create a slab on which task_structs can be allocated */
-        task_struct_cachep =
-                kmem_cache_create("task_struct", arch_task_struct_size,
-                        ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
+        task_struct_cachep = kmem_cache_create("task_struct",
+                        arch_task_struct_size, ARCH_MIN_TASKALIGN,
+                        SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT, NULL);
 #endif
 
         /* do the arch specific task caches init */
@@ -414,7 +414,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
         RCU_INIT_POINTER(mm->exe_file, get_mm_exe_file(oldmm));
 
         mm->total_vm = oldmm->total_vm;
-        mm->shared_vm = oldmm->shared_vm;
+        mm->data_vm = oldmm->data_vm;
         mm->exec_vm = oldmm->exec_vm;
         mm->stack_vm = oldmm->stack_vm;
 
@@ -433,8 +433,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                 struct file *file;
 
                 if (mpnt->vm_flags & VM_DONTCOPY) {
-                        vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file,
-                                                        -vma_pages(mpnt));
+                        vm_stat_account(mm, mpnt->vm_flags, -vma_pages(mpnt));
                         continue;
                 }
                 charge = 0;
@@ -1848,16 +1847,19 @@ void __init proc_caches_init(void)
         sighand_cachep = kmem_cache_create("sighand_cache",
                         sizeof(struct sighand_struct), 0,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_DESTROY_BY_RCU|
-                        SLAB_NOTRACK, sighand_ctor);
+                        SLAB_NOTRACK|SLAB_ACCOUNT, sighand_ctor);
         signal_cachep = kmem_cache_create("signal_cache",
                         sizeof(struct signal_struct), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT,
+                        NULL);
         files_cachep = kmem_cache_create("files_cache",
                         sizeof(struct files_struct), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT,
+                        NULL);
         fs_cachep = kmem_cache_create("fs_cache",
                         sizeof(struct fs_struct), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT,
+                        NULL);
         /*
          * FIXME! The "sizeof(struct mm_struct)" currently includes the
          * whole struct cpumask for the OFFSTACK case. We could change
@@ -1867,8 +1869,9 @@ void __init proc_caches_init(void)
          */
         mm_cachep = kmem_cache_create("mm_struct",
                         sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
-        vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT,
+                        NULL);
+        vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT);
         mmap_init();
         nsproxy_cache_init();
 }
diff --git a/kernel/pid.c b/kernel/pid.c
index 78b3d9f80d44..f4ad91b746f1 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -604,5 +604,5 @@ void __init pidmap_init(void)
         atomic_dec(&init_pid_ns.pidmap[0].nr_free);
 
         init_pid_ns.pid_cachep = KMEM_CACHE(pid,
-                        SLAB_HWCACHE_ALIGN | SLAB_PANIC);
+                        SLAB_HWCACHE_ALIGN | SLAB_PANIC | SLAB_ACCOUNT);
 }
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 4a2ef5a02fd3..2489140a7c51 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -219,6 +219,7 @@ static void cpu_idle_loop(void)
                  */
 
                 __current_set_polling();
+                quiet_vmstat();
                 tick_nohz_idle_enter();
 
                 while (!need_resched()) {
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 5faf89ac9ec0..c810f8afdb7f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1568,6 +1568,28 @@ static struct ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
         },
+#ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS
+        {
+                .procname       = "mmap_rnd_bits",
+                .data           = &mmap_rnd_bits,
+                .maxlen         = sizeof(mmap_rnd_bits),
+                .mode           = 0600,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&mmap_rnd_bits_min,
+                .extra2         = (void *)&mmap_rnd_bits_max,
+        },
+#endif
+#ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS
+        {
+                .procname       = "mmap_rnd_compat_bits",
+                .data           = &mmap_rnd_compat_bits,
+                .maxlen         = sizeof(mmap_rnd_compat_bits),
+                .mode           = 0600,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&mmap_rnd_compat_bits_min,
+                .extra2         = (void *)&mmap_rnd_compat_bits_max,
+        },
+#endif
         { }
 };
 
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index d34bd24c2c84..4a1515f4b452 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1181,7 +1181,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end
 
 static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
 {
-        if (overlap(addr, len, _text, _etext) ||
+        if (overlap(addr, len, _stext, _etext) ||
             overlap(addr, len, __start_rodata, __end_rodata))
                 err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
 }
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 7340353f8aea..cc5d29d2da9b 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -672,7 +672,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
 
         ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
         if (!ret) {
-                bdi->wb.memcg_css = mem_cgroup_root_css;
+                bdi->wb.memcg_css = &root_mem_cgroup->css;
                 bdi->wb.blkcg_css = blkcg_root_css;
         }
         return ret;
diff --git a/mm/compaction.c b/mm/compaction.c
index de3e1e71cd9f..585de54dbe8c 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1658,14 +1658,15 @@ static void __compact_pgdat(pg_data_t *pgdat, struct compact_control *cc)
                                 !compaction_deferred(zone, cc->order))
                         compact_zone(zone, cc);
 
-                if (cc->order > 0) {
-                        if (zone_watermark_ok(zone, cc->order,
-                                                low_wmark_pages(zone), 0, 0))
-                                compaction_defer_reset(zone, cc->order, false);
-                }
-
                 VM_BUG_ON(!list_empty(&cc->freepages));
                 VM_BUG_ON(!list_empty(&cc->migratepages));
+
+                if (is_via_compact_memory(cc->order))
+                        continue;
+
+                if (zone_watermark_ok(zone, cc->order,
+                                low_wmark_pages(zone), 0, 0))
+                        compaction_defer_reset(zone, cc->order, false);
         }
 }
 
@@ -1708,7 +1709,10 @@ static void compact_nodes(void)
 /* The written value is actually unused, all memory is compacted */
 int sysctl_compact_memory;
 
-/* This is the entry point for compacting all nodes via /proc/sys/vm */
+/*
+ * This is the entry point for compacting all nodes via
+ * /proc/sys/vm/compact_memory
+ */
 int sysctl_compaction_handler(struct ctl_table *table, int write,
                         void __user *buffer, size_t *length, loff_t *ppos)
 {
diff --git a/mm/debug.c b/mm/debug.c
index 668aa35191ca..5d2072ed8d5e 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -175,7 +175,7 @@ void dump_mm(const struct mm_struct *mm)
                 "mmap_base %lu mmap_legacy_base %lu highest_vm_end %lu\n"
                 "pgd %p mm_users %d mm_count %d nr_ptes %lu nr_pmds %lu map_count %d\n"
                 "hiwater_rss %lx hiwater_vm %lx total_vm %lx locked_vm %lx\n"
-                "pinned_vm %lx shared_vm %lx exec_vm %lx stack_vm %lx\n"
+                "pinned_vm %lx data_vm %lx exec_vm %lx stack_vm %lx\n"
                 "start_code %lx end_code %lx start_data %lx end_data %lx\n"
                 "start_brk %lx brk %lx start_stack %lx\n"
                 "arg_start %lx arg_end %lx env_start %lx env_end %lx\n"
@@ -209,7 +209,7 @@ void dump_mm(const struct mm_struct *mm)
                 mm_nr_pmds((struct mm_struct *)mm),
                 mm->map_count,
                 mm->hiwater_rss, mm->hiwater_vm, mm->total_vm, mm->locked_vm,
-                mm->pinned_vm, mm->shared_vm, mm->exec_vm, mm->stack_vm,
+                mm->pinned_vm, mm->data_vm, mm->exec_vm, mm->stack_vm,
                 mm->start_code, mm->end_code, mm->start_data, mm->end_data,
                 mm->start_brk, mm->brk, mm->start_stack,
                 mm->arg_start, mm->arg_end, mm->env_start, mm->env_end,
diff --git a/mm/filemap.c b/mm/filemap.c
index 1bb007624b53..ff42d31c891a 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1812,19 +1812,18 @@ EXPORT_SYMBOL(generic_file_read_iter);
  * This adds the requested page to the page cache if it isn't already there,
  * and schedules an I/O to read in its contents from disk.
  */
-static int page_cache_read(struct file *file, pgoff_t offset)
+static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
 {
         struct address_space *mapping = file->f_mapping;
         struct page *page;
         int ret;
 
         do {
-                page = page_cache_alloc_cold(mapping);
+                page = __page_cache_alloc(gfp_mask|__GFP_COLD);
                 if (!page)
                         return -ENOMEM;
 
-                ret = add_to_page_cache_lru(page, mapping, offset,
-                                mapping_gfp_constraint(mapping, GFP_KERNEL));
+                ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
                 if (ret == 0)
                         ret = mapping->a_ops->readpage(file, page);
                 else if (ret == -EEXIST)
@@ -2005,7 +2004,7 @@ no_cached_page:
          * We're only likely to ever get here if MADV_RANDOM is in
          * effect.
          */
-        error = page_cache_read(file, offset);
+        error = page_cache_read(file, offset, vmf->gfp_mask);
 
         /*
          * The page we want has now been added to the page cache.
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 62fe06bb7d04..f952f055fdcf 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -31,6 +31,33 @@
 #include <asm/pgalloc.h>
 #include "internal.h"
 
+enum scan_result {
+        SCAN_FAIL,
+        SCAN_SUCCEED,
+        SCAN_PMD_NULL,
+        SCAN_EXCEED_NONE_PTE,
+        SCAN_PTE_NON_PRESENT,
+        SCAN_PAGE_RO,
+        SCAN_NO_REFERENCED_PAGE,
+        SCAN_PAGE_NULL,
+        SCAN_SCAN_ABORT,
+        SCAN_PAGE_COUNT,
+        SCAN_PAGE_LRU,
+        SCAN_PAGE_LOCK,
+        SCAN_PAGE_ANON,
+        SCAN_ANY_PROCESS,
+        SCAN_VMA_NULL,
+        SCAN_VMA_CHECK,
+        SCAN_ADDRESS_RANGE,
+        SCAN_SWAP_CACHE_PAGE,
+        SCAN_DEL_PAGE_LRU,
+        SCAN_ALLOC_HUGE_PAGE_FAIL,
+        SCAN_CGROUP_CHARGE_FAIL
+};
+
+#define CREATE_TRACE_POINTS
+#include <trace/events/huge_memory.h>
+
 /*
  * By default transparent hugepage support is disabled in order that avoid
  * to risk increase the memory footprint of applications without a guaranteed
@@ -2198,26 +2225,33 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                                         unsigned long address,
                                         pte_t *pte)
 {
-        struct page *page;
+        struct page *page = NULL;
         pte_t *_pte;
-        int none_or_zero = 0;
+        int none_or_zero = 0, result = 0;
         bool referenced = false, writable = false;
+
         for (_pte = pte; _pte < pte+HPAGE_PMD_NR;
              _pte++, address += PAGE_SIZE) {
                 pte_t pteval = *_pte;
                 if (pte_none(pteval) || (pte_present(pteval) &&
                                 is_zero_pfn(pte_pfn(pteval)))) {
                         if (!userfaultfd_armed(vma) &&
-                            ++none_or_zero <= khugepaged_max_ptes_none)
+                            ++none_or_zero <= khugepaged_max_ptes_none) {
                                 continue;
-                        else
+                        } else {
+                                result = SCAN_EXCEED_NONE_PTE;
                                 goto out;
+                        }
                 }
-                if (!pte_present(pteval))
+                if (!pte_present(pteval)) {
+                        result = SCAN_PTE_NON_PRESENT;
                         goto out;
+                }
                 page = vm_normal_page(vma, address, pteval);
-                if (unlikely(!page))
+                if (unlikely(!page)) {
+                        result = SCAN_PAGE_NULL;
                         goto out;
+                }
 
                 VM_BUG_ON_PAGE(PageCompound(page), page);
                 VM_BUG_ON_PAGE(!PageAnon(page), page);
@@ -2229,8 +2263,10 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                  * is needed to serialize against split_huge_page
                  * when invoked from the VM.
                  */
-                if (!trylock_page(page))
+                if (!trylock_page(page)) {
+                        result = SCAN_PAGE_LOCK;
                         goto out;
+                }
 
                 /*
                  * cannot use mapcount: can't collapse if there's a gup pin.
@@ -2239,6 +2275,7 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                  */
                 if (page_count(page) != 1 + !!PageSwapCache(page)) {
                         unlock_page(page);
+                        result = SCAN_PAGE_COUNT;
                         goto out;
                 }
                 if (pte_write(pteval)) {
@@ -2246,6 +2283,7 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                 } else {
                         if (PageSwapCache(page) && !reuse_swap_page(page)) {
                                 unlock_page(page);
+                                result = SCAN_SWAP_CACHE_PAGE;
                                 goto out;
                         }
                         /*
@@ -2260,6 +2298,7 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                  */
                 if (isolate_lru_page(page)) {
                         unlock_page(page);
+                        result = SCAN_DEL_PAGE_LRU;
                         goto out;
                 }
                 /* 0 stands for page_is_file_cache(page) == false */
@@ -2273,10 +2312,21 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                     mmu_notifier_test_young(vma->vm_mm, address))
                         referenced = true;
         }
-        if (likely(referenced && writable))
-                return 1;
+        if (likely(writable)) {
+                if (likely(referenced)) {
+                        result = SCAN_SUCCEED;
+                        trace_mm_collapse_huge_page_isolate(page_to_pfn(page), none_or_zero,
+                                                            referenced, writable, result);
+                        return 1;
+                }
+        } else {
+                result = SCAN_PAGE_RO;
+        }
+
 out:
         release_pte_pages(pte, _pte);
+        trace_mm_collapse_huge_page_isolate(page_to_pfn(page), none_or_zero,
+                                            referenced, writable, result);
         return 0;
 }
 
@@ -2513,7 +2563,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         pgtable_t pgtable;
         struct page *new_page;
         spinlock_t *pmd_ptl, *pte_ptl;
-        int isolated;
+        int isolated, result = 0;
         unsigned long hstart, hend;
         struct mem_cgroup *memcg;
         unsigned long mmun_start;       /* For mmu_notifiers */
@@ -2528,12 +2578,15 @@ static void collapse_huge_page(struct mm_struct *mm,
 
         /* release the mmap_sem read lock. */
         new_page = khugepaged_alloc_page(hpage, gfp, mm, address, node);
-        if (!new_page)
-                return;
+        if (!new_page) {
+                result = SCAN_ALLOC_HUGE_PAGE_FAIL;
+                goto out_nolock;
+        }
 
-        if (unlikely(mem_cgroup_try_charge(new_page, mm,
-                                           gfp, &memcg)))
-                return;
+        if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg))) {
+                result = SCAN_CGROUP_CHARGE_FAIL;
+                goto out_nolock;
+        }
 
         /*
          * Prevent all access to pagetables with the exception of
@@ -2541,21 +2594,31 @@ static void collapse_huge_page(struct mm_struct *mm,
          * handled by the anon_vma lock + PG_lock.
          */
         down_write(&mm->mmap_sem);
-        if (unlikely(khugepaged_test_exit(mm)))
+        if (unlikely(khugepaged_test_exit(mm))) {
+                result = SCAN_ANY_PROCESS;
                 goto out;
+        }
 
         vma = find_vma(mm, address);
-        if (!vma)
+        if (!vma) {
+                result = SCAN_VMA_NULL;
                 goto out;
+        }
         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
         hend = vma->vm_end & HPAGE_PMD_MASK;
-        if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+        if (address < hstart || address + HPAGE_PMD_SIZE > hend) {
+                result = SCAN_ADDRESS_RANGE;
                 goto out;
-        if (!hugepage_vma_check(vma))
+        }
+        if (!hugepage_vma_check(vma)) {
+                result = SCAN_VMA_CHECK;
                 goto out;
+        }
         pmd = mm_find_pmd(mm, address);
-        if (!pmd)
+        if (!pmd) {
+                result = SCAN_PMD_NULL;
                 goto out;
+        }
 
         anon_vma_lock_write(vma->anon_vma);
 
@@ -2592,6 +2655,7 @@ static void collapse_huge_page(struct mm_struct *mm,
                 pmd_populate(mm, pmd, pmd_pgtable(_pmd));
                 spin_unlock(pmd_ptl);
                 anon_vma_unlock_write(vma->anon_vma);
+                result = SCAN_FAIL;
                 goto out;
         }
 
@@ -2629,10 +2693,15 @@ static void collapse_huge_page(struct mm_struct *mm,
         *hpage = NULL;
 
         khugepaged_pages_collapsed++;
+        result = SCAN_SUCCEED;
 out_up_write:
         up_write(&mm->mmap_sem);
+        trace_mm_collapse_huge_page(mm, isolated, result);
         return;
 
+out_nolock:
+        trace_mm_collapse_huge_page(mm, isolated, result);
+        return;
 out:
         mem_cgroup_cancel_charge(new_page, memcg);
         goto out_up_write;
@@ -2645,8 +2714,8 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
 {
         pmd_t *pmd;
         pte_t *pte, *_pte;
-        int ret = 0, none_or_zero = 0;
-        struct page *page;
+        int ret = 0, none_or_zero = 0, result = 0;
+        struct page *page = NULL;
         unsigned long _address;
         spinlock_t *ptl;
         int node = NUMA_NO_NODE;
@@ -2655,8 +2724,10 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
         VM_BUG_ON(address & ~HPAGE_PMD_MASK);
 
         pmd = mm_find_pmd(mm, address);
-        if (!pmd)
+        if (!pmd) {
+                result = SCAN_PMD_NULL;
                 goto out;
+        }
 
         memset(khugepaged_node_load, 0, sizeof(khugepaged_node_load));
         pte = pte_offset_map_lock(mm, pmd, address, &ptl);
@@ -2665,19 +2736,25 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
                 pte_t pteval = *_pte;
                 if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {
                         if (!userfaultfd_armed(vma) &&
-                            ++none_or_zero <= khugepaged_max_ptes_none)
+                            ++none_or_zero <= khugepaged_max_ptes_none) {
                                 continue;
-                        else
+                        } else {
+                                result = SCAN_EXCEED_NONE_PTE;
                                 goto out_unmap;
+                        }
                 }
-                if (!pte_present(pteval))
+                if (!pte_present(pteval)) {
+                        result = SCAN_PTE_NON_PRESENT;
                         goto out_unmap;
+                }
                 if (pte_write(pteval))
                         writable = true;
 
                 page = vm_normal_page(vma, _address, pteval);
-                if (unlikely(!page))
+                if (unlikely(!page)) {
+                        result = SCAN_PAGE_NULL;
                         goto out_unmap;
+                }
                 /*
                  * Record which node the original page is from and save this
                  * information to khugepaged_node_load[].
@@ -2685,26 +2762,49 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
                  * hit record.
                  */
                 node = page_to_nid(page);
-                if (khugepaged_scan_abort(node))
+                if (khugepaged_scan_abort(node)) {
+                        result = SCAN_SCAN_ABORT;
                         goto out_unmap;
+                }
                 khugepaged_node_load[node]++;
                 VM_BUG_ON_PAGE(PageCompound(page), page);
-                if (!PageLRU(page) || PageLocked(page) || !PageAnon(page))
+                if (!PageLRU(page)) {
+                        result = SCAN_SCAN_ABORT;
+                        goto out_unmap;
+                }
+                if (PageLocked(page)) {
+                        result = SCAN_PAGE_LOCK;
+                        goto out_unmap;
+                }
+                if (!PageAnon(page)) {
+                        result = SCAN_PAGE_ANON;
                         goto out_unmap;
+                }
+
                 /*
                  * cannot use mapcount: can't collapse if there's a gup pin.
                  * The page must only be referenced by the scanned process
                  * and page swap cache.
                  */
-                if (page_count(page) != 1 + !!PageSwapCache(page))
+                if (page_count(page) != 1 + !!PageSwapCache(page)) {
+                        result = SCAN_PAGE_COUNT;
                         goto out_unmap;
+                }
                 if (pte_young(pteval) ||
                     page_is_young(page) || PageReferenced(page) ||
                     mmu_notifier_test_young(vma->vm_mm, address))
                         referenced = true;
         }
-        if (referenced && writable)
-                ret = 1;
+        if (writable) {
+                if (referenced) {
+                        result = SCAN_SUCCEED;
+                        ret = 1;
+                } else {
+                        result = SCAN_NO_REFERENCED_PAGE;
+                }
+        } else {
+                result = SCAN_PAGE_RO;
+        }
 out_unmap:
         pte_unmap_unlock(pte, ptl);
         if (ret) {
@@ -2713,6 +2813,8 @@ out_unmap:
                 collapse_huge_page(mm, address, hpage, vma, node);
         }
 out:
+        trace_mm_khugepaged_scan_pmd(mm, page_to_pfn(page), writable, referenced,
+                                     none_or_zero, result);
         return ret;
 }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ef6963b577fd..be934df69b85 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4,7 +4,6 @@
  */
 #include <linux/list.h>
 #include <linux/init.h>
-#include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/sysctl.h>
@@ -2549,25 +2548,6 @@ static void hugetlb_unregister_node(struct node *node)
         nhs->hugepages_kobj = NULL;
 }
 
-/*
- * hugetlb module exit:  unregister hstate attributes from node devices
- * that have them.
- */
-static void hugetlb_unregister_all_nodes(void)
-{
-        int nid;
-
-        /*
-         * disable node device registrations.
-         */
-        register_hugetlbfs_with_node(NULL, NULL);
-
-        /*
-         * remove hstate attributes from any nodes that have them.
-         */
-        for (nid = 0; nid < nr_node_ids; nid++)
-                hugetlb_unregister_node(node_devices[nid]);
-}
 
 /*
  * Register hstate attributes for a single node device.
@@ -2632,27 +2612,10 @@ static struct hstate *kobj_to_node_hstate(struct kobject *kobj, int *nidp)
         return NULL;
 }
 
-static void hugetlb_unregister_all_nodes(void) { }
-
 static void hugetlb_register_all_nodes(void) { }
 
 #endif
 
-static void __exit hugetlb_exit(void)
-{
-        struct hstate *h;
-
-        hugetlb_unregister_all_nodes();
-
-        for_each_hstate(h) {
-                kobject_put(hstate_kobjs[hstate_index(h)]);
-        }
-
-        kobject_put(hugepages_kobj);
-        kfree(hugetlb_fault_mutex_table);
-}
-module_exit(hugetlb_exit);
-
 static int __init hugetlb_init(void)
 {
         int i;
@@ -2690,7 +2653,7 @@ static int __init hugetlb_init(void)
                 mutex_init(&hugetlb_fault_mutex_table[i]);
         return 0;
 }
-module_init(hugetlb_init);
+subsys_initcall(hugetlb_init);
 
 /* Should be called on processing a hugepagesz=... option */
 void __init hugetlb_add_hstate(unsigned int order)
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 19423a45d7d7..25c0ad36fe38 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -122,8 +122,7 @@
 #define BYTES_PER_POINTER       sizeof(void *)
 
 /* GFP bitmask for kmemleak internal allocations */
-#define gfp_kmemleak_mask(gfp)  (((gfp) & (GFP_KERNEL | GFP_ATOMIC | \
-                                           __GFP_NOACCOUNT)) | \
+#define gfp_kmemleak_mask(gfp)  (((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
                                  __GFP_NORETRY | __GFP_NOMEMALLOC | \
                                  __GFP_NOWARN)
 
diff --git a/mm/ksm.c b/mm/ksm.c
index b5cd647daa52..2d162c5625f6 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -740,8 +740,7 @@ static int remove_stable_node(struct stable_node *stable_node)
 
 static int remove_all_stable_nodes(void)
 {
-        struct stable_node *stable_node;
-        struct list_head *this, *next;
+        struct stable_node *stable_node, *next;
         int nid;
         int err = 0;
 
@@ -756,8 +755,7 @@ static int remove_all_stable_nodes(void)
                         cond_resched();
                 }
         }
-        list_for_each_safe(this, next, &migrate_nodes) {
-                stable_node = list_entry(this, struct stable_node, list);
+        list_for_each_entry_safe(stable_node, next, &migrate_nodes, list) {
                 if (remove_stable_node(stable_node))
                         err = -EBUSY;
                 cond_resched();
@@ -1583,13 +1581,11 @@ static struct rmap_item *scan_get_next_rmap_item(struct page **page)
                  * so prune them once before each full scan.
                  */
                 if (!ksm_merge_across_nodes) {
-                        struct stable_node *stable_node;
-                        struct list_head *this, *next;
+                        struct stable_node *stable_node, *next;
                         struct page *page;
 
-                        list_for_each_safe(this, next, &migrate_nodes) {
-                                stable_node = list_entry(this,
-                                                struct stable_node, list);
+                        list_for_each_entry_safe(stable_node, next,
+                                                 &migrate_nodes, list) {
                                 page = get_ksm_page(stable_node, false);
                                 if (page)
                                         put_page(page);
@@ -2012,8 +2008,7 @@ static void wait_while_offlining(void)
 static void ksm_check_stable_tree(unsigned long start_pfn,
                                   unsigned long end_pfn)
 {
-        struct stable_node *stable_node;
-        struct list_head *this, *next;
+        struct stable_node *stable_node, *next;
         struct rb_node *node;
         int nid;
 
@@ -2034,8 +2029,7 @@ static void ksm_check_stable_tree(unsigned long start_pfn,
                         cond_resched();
                 }
         }
-        list_for_each_safe(this, next, &migrate_nodes) {
-                stable_node = list_entry(this, struct stable_node, list);
+        list_for_each_entry_safe(stable_node, next, &migrate_nodes, list) {
                 if (stable_node->kpfn >= start_pfn &&
                     stable_node->kpfn < end_pfn)
                         remove_node_from_stable_tree(stable_node);
diff --git a/mm/memblock.c b/mm/memblock.c
index 07ff069fef25..d2ed81e59a94 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -96,13 +96,10 @@ bool __init_memblock memblock_overlaps_region(struct memblock_type *type,
 {
         unsigned long i;
 
-        for (i = 0; i < type->cnt; i++) {
-                phys_addr_t rgnbase = type->regions[i].base;
-                phys_addr_t rgnsize = type->regions[i].size;
-                if (memblock_addrs_overlap(base, size, rgnbase, rgnsize))
+        for (i = 0; i < type->cnt; i++)
+                if (memblock_addrs_overlap(base, size, type->regions[i].base,
+                                           type->regions[i].size))
                         break;
-        }
-
         return i < type->cnt;
 }
 
@@ -528,7 +525,8 @@ int __init_memblock memblock_add_range(struct memblock_type *type,
         bool insert = false;
         phys_addr_t obase = base;
         phys_addr_t end = base + memblock_cap_size(base, &size);
-        int i, nr_new;
+        int idx, nr_new;
+        struct memblock_region *rgn;
 
         if (!size)
                 return 0;
@@ -552,8 +550,7 @@ repeat:
         base = obase;
         nr_new = 0;
 
-        for (i = 0; i < type->cnt; i++) {
-                struct memblock_region *rgn = &type->regions[i];
+        for_each_memblock_type(type, rgn) {
                 phys_addr_t rbase = rgn->base;
                 phys_addr_t rend = rbase + rgn->size;
 
@@ -572,7 +569,7 @@ repeat:
                         WARN_ON(flags != rgn->flags);
                         nr_new++;
                         if (insert)
-                                memblock_insert_region(type, i++, base,
+                                memblock_insert_region(type, idx++, base,
                                                        rbase - base, nid,
                                                        flags);
                 }
@@ -584,7 +581,7 @@ repeat:
         if (base < end) {
                 nr_new++;
                 if (insert)
-                        memblock_insert_region(type, i, base, end - base,
+                        memblock_insert_region(type, idx, base, end - base,
                                                nid, flags);
         }
 
@@ -651,7 +648,8 @@ static int __init_memblock memblock_isolate_range(struct memblock_type *type,
                                         int *start_rgn, int *end_rgn)
 {
         phys_addr_t end = base + memblock_cap_size(base, &size);
-        int i;
+        int idx;
+        struct memblock_region *rgn;
 
         *start_rgn = *end_rgn = 0;
 
@@ -663,8 +661,7 @@ static int __init_memblock memblock_isolate_range(struct memblock_type *type,
                 if (memblock_double_array(type, base, size) < 0)
                         return -ENOMEM;
 
-        for (i = 0; i < type->cnt; i++) {
-                struct memblock_region *rgn = &type->regions[i];
+        for_each_memblock_type(type, rgn) {
                 phys_addr_t rbase = rgn->base;
                 phys_addr_t rend = rbase + rgn->size;
 
@@ -681,7 +678,7 @@ static int __init_memblock memblock_isolate_range(struct memblock_type *type,
                         rgn->base = base;
                         rgn->size -= base - rbase;
                         type->total_size -= base - rbase;
-                        memblock_insert_region(type, i, rbase, base - rbase,
+                        memblock_insert_region(type, idx, rbase, base - rbase,
                                                memblock_get_region_node(rgn),
                                                rgn->flags);
                 } else if (rend > end) {
@@ -692,14 +689,14 @@ static int __init_memblock memblock_isolate_range(struct memblock_type *type,
                         rgn->base = end;
                         rgn->size -= end - rbase;
                         type->total_size -= end - rbase;
-                        memblock_insert_region(type, i--, rbase, end - rbase,
+                        memblock_insert_region(type, idx--, rbase, end - rbase,
                                                memblock_get_region_node(rgn),
                                                rgn->flags);
                 } else {
                         /* @rgn is fully contained, record it */
                         if (!*end_rgn)
-                                *start_rgn = i;
-                        *end_rgn = i + 1;
+                                *start_rgn = idx;
+                        *end_rgn = idx + 1;
                 }
         }
 
@@ -1528,12 +1525,12 @@ static int __init_memblock memblock_search(struct memblock_type *type, phys_addr
         return -1;
 }
 
-int __init memblock_is_reserved(phys_addr_t addr)
+bool __init memblock_is_reserved(phys_addr_t addr)
 {
         return memblock_search(&memblock.reserved, addr) != -1;
 }
 
-int __init_memblock memblock_is_memory(phys_addr_t addr)
+bool __init_memblock memblock_is_memory(phys_addr_t addr)
 {
         return memblock_search(&memblock.memory, addr) != -1;
 }
@@ -1641,12 +1638,12 @@ static void __init_memblock memblock_dump(struct memblock_type *type, char *name
 {
         unsigned long long base, size;
         unsigned long flags;
-        int i;
+        int idx;
+        struct memblock_region *rgn;
 
         pr_info(" %s.cnt  = 0x%lx\n", name, type->cnt);
 
-        for (i = 0; i < type->cnt; i++) {
-                struct memblock_region *rgn = &type->regions[i];
+        for_each_memblock_type(type, rgn) {
                 char nid_buf[32] = "";
 
                 base = rgn->base;
@@ -1658,7 +1655,7 @@ static void __init_memblock memblock_dump(struct memblock_type *type, char *name
                                  memblock_get_region_node(rgn));
 #endif
                 pr_info(" %s[%#x]\t[%#016llx-%#016llx], %#llx bytes%s flags: %#lx\n",
-                        name, i, base, base + size - 1, size, nid_buf, flags);
+                        name, idx, base, base + size - 1, size, nid_buf, flags);
         }
 }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 14cb1db4c52b..54eae4f19d80 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -76,9 +76,12 @@
 struct cgroup_subsys memory_cgrp_subsys __read_mostly;
 EXPORT_SYMBOL(memory_cgrp_subsys);
 
+struct mem_cgroup *root_mem_cgroup __read_mostly;
+
 #define MEM_CGROUP_RECLAIM_RETRIES      5
-static struct mem_cgroup *root_mem_cgroup __read_mostly;
-struct cgroup_subsys_state *mem_cgroup_root_css __read_mostly;
+
+/* Socket memory accounting disabled? */
+static bool cgroup_memory_nosocket;
 
 /* Whether the swap controller is active */
 #ifdef CONFIG_MEMCG_SWAP
@@ -87,6 +90,12 @@ int do_swap_account __read_mostly;
 #define do_swap_account         0
 #endif
 
+/* Whether legacy memory+swap accounting is active */
+static bool do_memsw_account(void)
+{
+        return !cgroup_subsys_on_dfl(memory_cgrp_subsys) && do_swap_account;
+}
+
 static const char * const mem_cgroup_stat_names[] = {
         "cache",
         "rss",
@@ -288,64 +297,6 @@ static inline struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
         return mem_cgroup_from_css(css);
 }
 
-/* Writing them here to avoid exposing memcg's inner layout */
-#if defined(CONFIG_INET) && defined(CONFIG_MEMCG_KMEM)
-
-void sock_update_memcg(struct sock *sk)
-{
-        if (mem_cgroup_sockets_enabled) {
-                struct mem_cgroup *memcg;
-                struct cg_proto *cg_proto;
-
-                BUG_ON(!sk->sk_prot->proto_cgroup);
-
-                /* Socket cloning can throw us here with sk_cgrp already
-                 * filled. It won't however, necessarily happen from
-                 * process context. So the test for root memcg given
-                 * the current task's memcg won't help us in this case.
-                 *
-                 * Respecting the original socket's memcg is a better
-                 * decision in this case.
-                 */
-                if (sk->sk_cgrp) {
-                        BUG_ON(mem_cgroup_is_root(sk->sk_cgrp->memcg));
-                        css_get(&sk->sk_cgrp->memcg->css);
-                        return;
-                }
-
-                rcu_read_lock();
-                memcg = mem_cgroup_from_task(current);
-                cg_proto = sk->sk_prot->proto_cgroup(memcg);
-                if (cg_proto && test_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags) &&
-                    css_tryget_online(&memcg->css)) {
-                        sk->sk_cgrp = cg_proto;
-                }
-                rcu_read_unlock();
-        }
-}
-EXPORT_SYMBOL(sock_update_memcg);
-
-void sock_release_memcg(struct sock *sk)
-{
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
-                struct mem_cgroup *memcg;
-                WARN_ON(!sk->sk_cgrp->memcg);
-                memcg = sk->sk_cgrp->memcg;
-                css_put(&sk->sk_cgrp->memcg->css);
-        }
-}
-
-struct cg_proto *tcp_proto_cgroup(struct mem_cgroup *memcg)
-{
-        if (!memcg || mem_cgroup_is_root(memcg))
-                return NULL;
-
-        return &memcg->tcp_mem;
-}
-EXPORT_SYMBOL(tcp_proto_cgroup);
-
-#endif
-
 #ifdef CONFIG_MEMCG_KMEM
 /*
  * This will be the memcg's index in each cache's ->memcg_params.memcg_caches.
@@ -395,7 +346,7 @@ void memcg_put_cache_ids(void)
  * conditional to this static branch, we'll have to allow modules that does
  * kmem_cache_alloc and the such to see this symbol as well
  */
-struct static_key memcg_kmem_enabled_key;
+DEFINE_STATIC_KEY_FALSE(memcg_kmem_enabled_key);
 EXPORT_SYMBOL(memcg_kmem_enabled_key);
 
 #endif /* CONFIG_MEMCG_KMEM */
@@ -1162,9 +1113,6 @@ bool task_in_mem_cgroup(struct task_struct *task, struct mem_cgroup *memcg)
         return ret;
 }
 
-#define mem_cgroup_from_counter(counter, member)        \
-        container_of(counter, struct mem_cgroup, member)
-
 /**
  * mem_cgroup_margin - calculate chargeable space of a memory cgroup
  * @memcg: the memory cgroup
@@ -1183,7 +1131,7 @@ static unsigned long mem_cgroup_margin(struct mem_cgroup *memcg)
         if (count < limit)
                 margin = limit - count;
 
-        if (do_swap_account) {
+        if (do_memsw_account()) {
                 count = page_counter_read(&memcg->memsw);
                 limit = READ_ONCE(memcg->memsw.limit);
                 if (count <= limit)
@@ -1286,7 +1234,7 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
                 pr_cont(":");
 
                 for (i = 0; i < MEM_CGROUP_STAT_NSTATS; i++) {
-                        if (i == MEM_CGROUP_STAT_SWAP && !do_swap_account)
+                        if (i == MEM_CGROUP_STAT_SWAP && !do_memsw_account())
                                 continue;
                         pr_cont(" %s:%luKB", mem_cgroup_stat_names[i],
                                 K(mem_cgroup_read_stat(iter, i)));
@@ -1909,7 +1857,7 @@ static void drain_stock(struct memcg_stock_pcp *stock)
 
         if (stock->nr_pages) {
                 page_counter_uncharge(&old->memory, stock->nr_pages);
-                if (do_swap_account)
+                if (do_memsw_account())
                         page_counter_uncharge(&old->memsw, stock->nr_pages);
                 css_put_many(&old->css, stock->nr_pages);
                 stock->nr_pages = 0;
@@ -1997,6 +1945,26 @@ static int memcg_cpu_hotplug_callback(struct notifier_block *nb,
         return NOTIFY_OK;
 }
 
+static void reclaim_high(struct mem_cgroup *memcg,
+                         unsigned int nr_pages,
+                         gfp_t gfp_mask)
+{
+        do {
+                if (page_counter_read(&memcg->memory) <= memcg->high)
+                        continue;
+                mem_cgroup_events(memcg, MEMCG_HIGH, 1);
+                try_to_free_mem_cgroup_pages(memcg, nr_pages, gfp_mask, true);
+        } while ((memcg = parent_mem_cgroup(memcg)));
+}
+
+static void high_work_func(struct work_struct *work)
+{
+        struct mem_cgroup *memcg;
+
+        memcg = container_of(work, struct mem_cgroup, high_work);
+        reclaim_high(memcg, CHARGE_BATCH, GFP_KERNEL);
+}
+
 /*
  * Scheduled by try_charge() to be executed from the userland return path
  * and reclaims memory over the high limit.
@@ -2004,20 +1972,13 @@ static int memcg_cpu_hotplug_callback(struct notifier_block *nb,
 void mem_cgroup_handle_over_high(void)
 {
         unsigned int nr_pages = current->memcg_nr_pages_over_high;
-        struct mem_cgroup *memcg, *pos;
+        struct mem_cgroup *memcg;
 
         if (likely(!nr_pages))
                 return;
 
-        pos = memcg = get_mem_cgroup_from_mm(current->mm);
-
-        do {
-                if (page_counter_read(&pos->memory) <= pos->high)
-                        continue;
-                mem_cgroup_events(pos, MEMCG_HIGH, 1);
-                try_to_free_mem_cgroup_pages(pos, nr_pages, GFP_KERNEL, true);
-        } while ((pos = parent_mem_cgroup(pos)));
-
+        memcg = get_mem_cgroup_from_mm(current->mm);
+        reclaim_high(memcg, nr_pages, GFP_KERNEL);
         css_put(&memcg->css);
         current->memcg_nr_pages_over_high = 0;
 }
@@ -2039,11 +2000,11 @@ retry:
         if (consume_stock(memcg, nr_pages))
                 return 0;
 
-        if (!do_swap_account ||
+        if (!do_memsw_account() ||
             page_counter_try_charge(&memcg->memsw, batch, &counter)) {
                 if (page_counter_try_charge(&memcg->memory, batch, &counter))
                         goto done_restock;
-                if (do_swap_account)
+                if (do_memsw_account())
                         page_counter_uncharge(&memcg->memsw, batch);
                 mem_over_limit = mem_cgroup_from_counter(counter, memory);
         } else {
@@ -2130,7 +2091,7 @@ force:
          * temporarily by force charging it.
          */
         page_counter_charge(&memcg->memory, nr_pages);
-        if (do_swap_account)
+        if (do_memsw_account())
                 page_counter_charge(&memcg->memsw, nr_pages);
         css_get_many(&memcg->css, nr_pages);
 
@@ -2152,6 +2113,11 @@ done_restock:
          */
         do {
                 if (page_counter_read(&memcg->memory) > memcg->high) {
+                        /* Don't bother a random interrupted task */
+                        if (in_interrupt()) {
+                                schedule_work(&memcg->high_work);
+                                break;
+                        }
                         current->memcg_nr_pages_over_high += batch;
                         set_notify_resume(current);
                         break;
@@ -2167,7 +2133,7 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
                 return;
 
         page_counter_uncharge(&memcg->memory, nr_pages);
-        if (do_swap_account)
+        if (do_memsw_account())
                 page_counter_uncharge(&memcg->memsw, nr_pages);
 
         css_put_many(&memcg->css, nr_pages);
@@ -2356,7 +2322,7 @@ static void memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg,
  * Can't be called in interrupt context or from kernel threads.
  * This function needs to be called with rcu_read_lock() held.
  */
-struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep)
+struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep, gfp_t gfp)
 {
         struct mem_cgroup *memcg;
         struct kmem_cache *memcg_cachep;
@@ -2364,6 +2330,12 @@ struct kmem_cache *__memcg_kmem_get_cache(struct kmem_cache *cachep)
 
         VM_BUG_ON(!is_root_cache(cachep));
 
+        if (cachep->flags & SLAB_ACCOUNT)
+                gfp |= __GFP_ACCOUNT;
+
+        if (!(gfp & __GFP_ACCOUNT))
+                return cachep;
+
         if (current->memcg_kmem_skip_account)
                 return cachep;
 
@@ -2447,7 +2419,7 @@ void __memcg_kmem_uncharge(struct page *page, int order)
 
         page_counter_uncharge(&memcg->kmem, nr_pages);
         page_counter_uncharge(&memcg->memory, nr_pages);
-        if (do_swap_account)
+        if (do_memsw_account())
                 page_counter_uncharge(&memcg->memsw, nr_pages);
 
         page->mem_cgroup = NULL;
@@ -2935,7 +2907,7 @@ static int memcg_activate_kmem(struct mem_cgroup *memcg,
         err = page_counter_limit(&memcg->kmem, nr_pages);
         VM_BUG_ON(err);
 
-        static_key_slow_inc(&memcg_kmem_enabled_key);
+        static_branch_inc(&memcg_kmem_enabled_key);
         /*
          * A memory cgroup is considered kmem-active as soon as it gets
          * kmemcg_id. Setting the id after enabling static branching will
@@ -3162,7 +3134,7 @@ static int memcg_stat_show(struct seq_file *m, void *v)
         BUILD_BUG_ON(ARRAY_SIZE(mem_cgroup_lru_names) != NR_LRU_LISTS);
 
         for (i = 0; i < MEM_CGROUP_STAT_NSTATS; i++) {
-                if (i == MEM_CGROUP_STAT_SWAP && !do_swap_account)
+                if (i == MEM_CGROUP_STAT_SWAP && !do_memsw_account())
                         continue;
                 seq_printf(m, "%s %lu\n", mem_cgroup_stat_names[i],
                            mem_cgroup_read_stat(memcg, i) * PAGE_SIZE);
@@ -3184,14 +3156,14 @@ static int memcg_stat_show(struct seq_file *m, void *v)
         }
         seq_printf(m, "hierarchical_memory_limit %llu\n",
                    (u64)memory * PAGE_SIZE);
-        if (do_swap_account)
+        if (do_memsw_account())
                 seq_printf(m, "hierarchical_memsw_limit %llu\n",
                            (u64)memsw * PAGE_SIZE);
 
         for (i = 0; i < MEM_CGROUP_STAT_NSTATS; i++) {
                 unsigned long long val = 0;
 
-                if (i == MEM_CGROUP_STAT_SWAP && !do_swap_account)
+                if (i == MEM_CGROUP_STAT_SWAP && !do_memsw_account())
                         continue;
                 for_each_mem_cgroup_tree(mi, memcg)
                         val += mem_cgroup_read_stat(mi, i) * PAGE_SIZE;
@@ -3322,7 +3294,7 @@ static void mem_cgroup_threshold(struct mem_cgroup *memcg)
 {
         while (memcg) {
                 __mem_cgroup_threshold(memcg, false);
-                if (do_swap_account)
+                if (do_memsw_account())
                         __mem_cgroup_threshold(memcg, true);
 
                 memcg = parent_mem_cgroup(memcg);
@@ -3621,7 +3593,7 @@ static int memcg_init_kmem(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
         if (ret)
                 return ret;
 
-        return mem_cgroup_sockets_init(memcg, ss);
+        return tcp_init_cgroup(memcg, ss);
 }
 
 static void memcg_deactivate_kmem(struct mem_cgroup *memcg)
@@ -3674,10 +3646,10 @@ static void memcg_destroy_kmem(struct mem_cgroup *memcg)
 {
         if (memcg->kmem_acct_activated) {
                 memcg_destroy_kmem_caches(memcg);
-                static_key_slow_dec(&memcg_kmem_enabled_key);
+                static_branch_dec(&memcg_kmem_enabled_key);
                 WARN_ON(page_counter_read(&memcg->kmem));
         }
-        mem_cgroup_sockets_destroy(memcg);
+        tcp_destroy_cgroup(memcg);
 }
 #else
 static int memcg_init_kmem(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
@@ -4196,6 +4168,8 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
 {
         int node;
 
+        cancel_work_sync(&memcg->high_work);
+
         mem_cgroup_remove_from_trees(memcg);
 
         for_each_node(node)
@@ -4206,17 +4180,6 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
         kfree(memcg);
 }
 
-/*
- * Returns the parent mem_cgroup in memcgroup hierarchy with hierarchy enabled.
- */
-struct mem_cgroup *parent_mem_cgroup(struct mem_cgroup *memcg)
-{
-        if (!memcg->memory.parent)
-                return NULL;
-        return mem_cgroup_from_counter(memcg->memory.parent, memory);
-}
-EXPORT_SYMBOL(parent_mem_cgroup);
-
 static struct cgroup_subsys_state * __ref
 mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
 {
@@ -4235,7 +4198,6 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
         /* root ? */
         if (parent_css == NULL) {
                 root_mem_cgroup = memcg;
-                mem_cgroup_root_css = &memcg->css;
                 page_counter_init(&memcg->memory, NULL);
                 memcg->high = PAGE_COUNTER_MAX;
                 memcg->soft_limit = PAGE_COUNTER_MAX;
@@ -4243,6 +4205,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
                 page_counter_init(&memcg->kmem, NULL);
         }
 
+        INIT_WORK(&memcg->high_work, high_work_func);
         memcg->last_scanned_node = MAX_NUMNODES;
         INIT_LIST_HEAD(&memcg->oom_notify);
         memcg->move_charge_at_immigrate = 0;
@@ -4257,6 +4220,9 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
 #ifdef CONFIG_CGROUP_WRITEBACK
         INIT_LIST_HEAD(&memcg->cgwb_list);
 #endif
+#ifdef CONFIG_INET
+        memcg->socket_pressure = jiffies;
+#endif
         return &memcg->css;
 
 free_out:
@@ -4314,6 +4280,11 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
         if (ret)
                 return ret;
 
+#ifdef CONFIG_INET
+        if (cgroup_subsys_on_dfl(memory_cgrp_subsys) && !cgroup_memory_nosocket)
+                static_branch_inc(&memcg_sockets_enabled_key);
+#endif
+
         /*
          * Make sure the memcg is initialized: mem_cgroup_iter()
          * orders reading memcg->initialized against its callers
@@ -4360,6 +4331,10 @@ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
 
         memcg_destroy_kmem(memcg);
+#ifdef CONFIG_INET
+        if (cgroup_subsys_on_dfl(memory_cgrp_subsys) && !cgroup_memory_nosocket)
+                static_branch_dec(&memcg_sockets_enabled_key);
+#endif
         __mem_cgroup_free(memcg);
 }
 
@@ -4476,7 +4451,7 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
          * we call find_get_page() with swapper_space directly.
          */
         page = find_get_page(swap_address_space(ent), ent.val);
-        if (do_swap_account)
+        if (do_memsw_account())
                 entry->val = ent.val;
 
         return page;
@@ -4511,7 +4486,7 @@ static struct page *mc_handle_file_pte(struct vm_area_struct *vma,
                 page = find_get_entry(mapping, pgoff);
                 if (radix_tree_exceptional_entry(page)) {
                         swp_entry_t swp = radix_to_swp_entry(page);
-                        if (do_swap_account)
+                        if (do_memsw_account())
                                 *entry = swp;
                         page = find_get_page(swap_address_space(swp), swp.val);
                 }
@@ -5304,7 +5279,7 @@ int mem_cgroup_try_charge(struct page *page, struct mm_struct *mm,
                 if (page->mem_cgroup)
                         goto out;
 
-                if (do_swap_account) {
+                if (do_memsw_account()) {
                         swp_entry_t ent = { .val = page_private(page), };
                         unsigned short id = lookup_swap_cgroup_id(ent);
 
@@ -5378,7 +5353,7 @@ void mem_cgroup_commit_charge(struct page *page, struct mem_cgroup *memcg,
         memcg_check_events(memcg, page);
         local_irq_enable();
 
-        if (do_swap_account && PageSwapCache(page)) {
+        if (do_memsw_account() && PageSwapCache(page)) {
                 swp_entry_t entry = { .val = page_private(page) };
                 /*
                  * The swap entry might not get freed for a long time,
@@ -5427,7 +5402,7 @@ static void uncharge_batch(struct mem_cgroup *memcg, unsigned long pgpgout,
 
         if (!mem_cgroup_is_root(memcg)) {
                 page_counter_uncharge(&memcg->memory, nr_pages);
-                if (do_swap_account)
+                if (do_memsw_account())
                         page_counter_uncharge(&memcg->memsw, nr_pages);
                 memcg_oom_recover(memcg);
         }
@@ -5580,6 +5555,121 @@ void mem_cgroup_replace_page(struct page *oldpage, struct page *newpage)
         commit_charge(newpage, memcg, true);
 }
 
+#ifdef CONFIG_INET
+
+DEFINE_STATIC_KEY_FALSE(memcg_sockets_enabled_key);
+EXPORT_SYMBOL(memcg_sockets_enabled_key);
+
+void sock_update_memcg(struct sock *sk)
+{
+        struct mem_cgroup *memcg;
+
+        /* Socket cloning can throw us here with sk_cgrp already
+         * filled. It won't however, necessarily happen from
+         * process context. So the test for root memcg given
+         * the current task's memcg won't help us in this case.
+         *
+         * Respecting the original socket's memcg is a better
+         * decision in this case.
+         */
+        if (sk->sk_memcg) {
+                BUG_ON(mem_cgroup_is_root(sk->sk_memcg));
+                css_get(&sk->sk_memcg->css);
+                return;
+        }
+
+        rcu_read_lock();
+        memcg = mem_cgroup_from_task(current);
+        if (memcg == root_mem_cgroup)
+                goto out;
+#ifdef CONFIG_MEMCG_KMEM
+        if (!cgroup_subsys_on_dfl(memory_cgrp_subsys) && !memcg->tcp_mem.active)
+                goto out;
+#endif
+        if (css_tryget_online(&memcg->css))
+                sk->sk_memcg = memcg;
+out:
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(sock_update_memcg);
+
+void sock_release_memcg(struct sock *sk)
+{
+        WARN_ON(!sk->sk_memcg);
+        css_put(&sk->sk_memcg->css);
+}
+
+/**
+ * mem_cgroup_charge_skmem - charge socket memory
+ * @memcg: memcg to charge
+ * @nr_pages: number of pages to charge
+ *
+ * Charges @nr_pages to @memcg. Returns %true if the charge fit within
+ * @memcg's configured limit, %false if the charge had to be forced.
+ */
+bool mem_cgroup_charge_skmem(struct mem_cgroup *memcg, unsigned int nr_pages)
+{
+        gfp_t gfp_mask = GFP_KERNEL;
+
+#ifdef CONFIG_MEMCG_KMEM
+        if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
+                struct page_counter *counter;
+
+                if (page_counter_try_charge(&memcg->tcp_mem.memory_allocated,
+                                            nr_pages, &counter)) {
+                        memcg->tcp_mem.memory_pressure = 0;
+                        return true;
+                }
+                page_counter_charge(&memcg->tcp_mem.memory_allocated, nr_pages);
+                memcg->tcp_mem.memory_pressure = 1;
+                return false;
+        }
+#endif
+        /* Don't block in the packet receive path */
+        if (in_softirq())
+                gfp_mask = GFP_NOWAIT;
+
+        if (try_charge(memcg, gfp_mask, nr_pages) == 0)
+                return true;
+
+        try_charge(memcg, gfp_mask|__GFP_NOFAIL, nr_pages);
+        return false;
+}
+
+/**
+ * mem_cgroup_uncharge_skmem - uncharge socket memory
+ * @memcg - memcg to uncharge
+ * @nr_pages - number of pages to uncharge
+ */
+void mem_cgroup_uncharge_skmem(struct mem_cgroup *memcg, unsigned int nr_pages)
+{
+#ifdef CONFIG_MEMCG_KMEM
+        if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
+                page_counter_uncharge(&memcg->tcp_mem.memory_allocated,
+                                      nr_pages);
+                return;
+        }
+#endif
+        page_counter_uncharge(&memcg->memory, nr_pages);
+        css_put_many(&memcg->css, nr_pages);
+}
+
+#endif /* CONFIG_INET */
+
+static int __init cgroup_memory(char *s)
+{
+        char *token;
+
+        while ((token = strsep(&s, ",")) != NULL) {
+                if (!*token)
+                        continue;
+                if (!strcmp(token, "nosocket"))
+                        cgroup_memory_nosocket = true;
+        }
+        return 0;
+}
+__setup("cgroup.memory=", cgroup_memory);
+
 /*
  * subsys_initcall() for memory controller.
  *
@@ -5635,7 +5725,7 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
         VM_BUG_ON_PAGE(PageLRU(page), page);
         VM_BUG_ON_PAGE(page_count(page), page);
 
-        if (!do_swap_account)
+        if (!do_memsw_account())
                 return;
 
         memcg = page->mem_cgroup;
@@ -5675,7 +5765,7 @@ void mem_cgroup_uncharge_swap(swp_entry_t entry)
         struct mem_cgroup *memcg;
         unsigned short id;
 
-        if (!do_swap_account)
+        if (!do_memsw_account())
                 return;
 
         id = swap_cgroup_record(entry, 0);
diff --git a/mm/memory.c b/mm/memory.c
index c387430f06c3..d4e4d37c1989 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -832,10 +832,7 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 } else if (is_migration_entry(entry)) {
                         page = migration_entry_to_page(entry);
 
-                        if (PageAnon(page))
-                                rss[MM_ANONPAGES]++;
-                        else
-                                rss[MM_FILEPAGES]++;
+                        rss[mm_counter(page)]++;
 
                         if (is_write_migration_entry(entry) &&
                                         is_cow_mapping(vm_flags)) {
@@ -874,10 +871,7 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
         if (page) {
                 get_page(page);
                 page_dup_rmap(page);
-                if (PageAnon(page))
-                        rss[MM_ANONPAGES]++;
-                else
-                        rss[MM_FILEPAGES]++;
+                rss[mm_counter(page)]++;
         }
 
 out_set_pte:
@@ -1113,9 +1107,8 @@ again:
                         tlb_remove_tlb_entry(tlb, pte, addr);
                         if (unlikely(!page))
                                 continue;
-                        if (PageAnon(page))
-                                rss[MM_ANONPAGES]--;
-                        else {
+
+                        if (!PageAnon(page)) {
                                 if (pte_dirty(ptent)) {
                                         force_flush = 1;
                                         set_page_dirty(page);
@@ -1123,8 +1116,8 @@ again:
                                 if (pte_young(ptent) &&
                                     likely(!(vma->vm_flags & VM_SEQ_READ)))
                                         mark_page_accessed(page);
-                                rss[MM_FILEPAGES]--;
                         }
+                        rss[mm_counter(page)]--;
                         page_remove_rmap(page);
                         if (unlikely(page_mapcount(page) < 0))
                                 print_bad_pte(vma, addr, ptent, page);
@@ -1146,11 +1139,7 @@ again:
                         struct page *page;
 
                         page = migration_entry_to_page(entry);
-
-                        if (PageAnon(page))
-                                rss[MM_ANONPAGES]--;
-                        else
-                                rss[MM_FILEPAGES]--;
+                        rss[mm_counter(page)]--;
                 }
                 if (unlikely(!free_swap_and_cache(entry)))
                         print_bad_pte(vma, addr, ptent, NULL);
@@ -1460,7 +1449,7 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
 
         /* Ok, finally just insert the thing.. */
         get_page(page);
-        inc_mm_counter_fast(mm, MM_FILEPAGES);
+        inc_mm_counter_fast(mm, mm_counter_file(page));
         page_add_file_rmap(page);
         set_pte_at(mm, addr, pte, mk_pte(page, prot));
 
@@ -1949,6 +1938,20 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
                 copy_user_highpage(dst, src, va, vma);
 }
 
+static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma)
+{
+        struct file *vm_file = vma->vm_file;
+
+        if (vm_file)
+                return mapping_gfp_mask(vm_file->f_mapping) | __GFP_FS | __GFP_IO;
+
+        /*
+         * Special mappings (e.g. VDSO) do not have any file so fake
+         * a default GFP_KERNEL for them.
+         */
+        return GFP_KERNEL;
+}
+
 /*
  * Notify the address space that the page is about to become writable so that
  * it can prohibit this or wait for the page to get into an appropriate state.
@@ -1964,6 +1967,7 @@ static int do_page_mkwrite(struct vm_area_struct *vma, struct page *page,
         vmf.virtual_address = (void __user *)(address & PAGE_MASK);
         vmf.pgoff = page->index;
         vmf.flags = FAULT_FLAG_WRITE|FAULT_FLAG_MKWRITE;
+        vmf.gfp_mask = __get_fault_gfp_mask(vma);
         vmf.page = page;
         vmf.cow_page = NULL;
 
@@ -2097,7 +2101,8 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma,
         if (likely(pte_same(*page_table, orig_pte))) {
                 if (old_page) {
                         if (!PageAnon(old_page)) {
-                                dec_mm_counter_fast(mm, MM_FILEPAGES);
+                                dec_mm_counter_fast(mm,
+                                                mm_counter_file(old_page));
                                 inc_mm_counter_fast(mm, MM_ANONPAGES);
                         }
                 } else {
@@ -2767,6 +2772,7 @@ static int __do_fault(struct vm_area_struct *vma, unsigned long address,
         vmf.pgoff = pgoff;
         vmf.flags = flags;
         vmf.page = NULL;
+        vmf.gfp_mask = __get_fault_gfp_mask(vma);
         vmf.cow_page = cow_page;
 
         ret = vma->vm_ops->fault(vma, &vmf);
@@ -2820,7 +2826,7 @@ void do_set_pte(struct vm_area_struct *vma, unsigned long address,
                 inc_mm_counter_fast(vma->vm_mm, MM_ANONPAGES);
                 page_add_new_anon_rmap(page, vma, address);
         } else {
-                inc_mm_counter_fast(vma->vm_mm, MM_FILEPAGES);
+                inc_mm_counter_fast(vma->vm_mm, mm_counter_file(page));
                 page_add_file_rmap(page);
         }
         set_pte_at(vma->vm_mm, address, pte, entry);
@@ -2933,6 +2939,7 @@ static void do_fault_around(struct vm_area_struct *vma, unsigned long address,
         vmf.pgoff = pgoff;
         vmf.max_pgoff = max_pgoff;
         vmf.flags = flags;
+        vmf.gfp_mask = __get_fault_gfp_mask(vma);
         vma->vm_ops->map_pages(vma, &vmf);
 }
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a042a9d537bb..92f95952692b 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -131,7 +131,8 @@ static struct resource *register_memory_resource(u64 start, u64 size)
 {
         struct resource *res;
         res = kzalloc(sizeof(struct resource), GFP_KERNEL);
-        BUG_ON(!res);
+        if (!res)
+                return ERR_PTR(-ENOMEM);
 
         res->name = "System RAM";
         res->start = start;
@@ -140,7 +141,7 @@ static struct resource *register_memory_resource(u64 start, u64 size)
         if (request_resource(&iomem_resource, res) < 0) {
                 pr_debug("System RAM resource %pR cannot be added\n", res);
                 kfree(res);
-                res = NULL;
+                return ERR_PTR(-EEXIST);
         }
         return res;
 }
@@ -1312,8 +1313,8 @@ int __ref add_memory(int nid, u64 start, u64 size)
         int ret;
 
         res = register_memory_resource(start, size);
-        if (!res)
-                return -EEXIST;
+        if (IS_ERR(res))
+                return PTR_ERR(res);
 
         ret = add_memory_resource(nid, res);
         if (ret < 0)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 87a177917cb2..d8caff071a30 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2142,12 +2142,14 @@ bool __mpol_equal(struct mempolicy *a, struct mempolicy *b)
  *
  * Remember policies even when nobody has shared memory mapped.
  * The policies are kept in Red-Black tree linked from the inode.
- * They are protected by the sp->lock spinlock, which should be held
+ * They are protected by the sp->lock rwlock, which should be held
  * for any accesses to the tree.
  */
 
-/* lookup first element intersecting start-end */
-/* Caller holds sp->lock */
+/*
+ * lookup first element intersecting start-end.  Caller holds sp->lock for
+ * reading or for writing
+ */
 static struct sp_node *
 sp_lookup(struct shared_policy *sp, unsigned long start, unsigned long end)
 {
@@ -2178,8 +2180,10 @@ sp_lookup(struct shared_policy *sp, unsigned long start, unsigned long end)
         return rb_entry(n, struct sp_node, nd);
 }
 
-/* Insert a new shared policy into the list. */
-/* Caller holds sp->lock */
+/*
+ * Insert a new shared policy into the list.  Caller holds sp->lock for
+ * writing.
+ */
 static void sp_insert(struct shared_policy *sp, struct sp_node *new)
 {
         struct rb_node **p = &sp->root.rb_node;
@@ -2211,13 +2215,13 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
 
         if (!sp->root.rb_node)
                 return NULL;
-        spin_lock(&sp->lock);
+        read_lock(&sp->lock);
         sn = sp_lookup(sp, idx, idx+1);
         if (sn) {
                 mpol_get(sn->policy);
                 pol = sn->policy;
         }
-        spin_unlock(&sp->lock);
+        read_unlock(&sp->lock);
         return pol;
 }
 
@@ -2360,7 +2364,7 @@ static int shared_policy_replace(struct shared_policy *sp, unsigned long start,
         int ret = 0;
 
 restart:
-        spin_lock(&sp->lock);
+        write_lock(&sp->lock);
         n = sp_lookup(sp, start, end);
         /* Take care of old policies in the same range. */
         while (n && n->start < end) {
@@ -2393,7 +2397,7 @@ restart:
         }
         if (new)
                 sp_insert(sp, new);
-        spin_unlock(&sp->lock);
+        write_unlock(&sp->lock);
         ret = 0;
 
 err_out:
@@ -2405,7 +2409,7 @@ err_out:
         return ret;
 
 alloc_new:
-        spin_unlock(&sp->lock);
+        write_unlock(&sp->lock);
         ret = -ENOMEM;
         n_new = kmem_cache_alloc(sn_cache, GFP_KERNEL);
         if (!n_new)
@@ -2431,7 +2435,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
         int ret;
 
         sp->root = RB_ROOT;             /* empty tree == default mempolicy */
-        spin_lock_init(&sp->lock);
+        rwlock_init(&sp->lock);
 
         if (mpol) {
                 struct vm_area_struct pvma;
@@ -2497,14 +2501,14 @@ void mpol_free_shared_policy(struct shared_policy *p)
 
         if (!p->root.rb_node)
                 return;
-        spin_lock(&p->lock);
+        write_lock(&p->lock);
         next = rb_first(&p->root);
         while (next) {
                 n = rb_entry(next, struct sp_node, nd);
                 next = rb_next(&n->nd);
                 sp_delete(p, n);
         }
-        spin_unlock(&p->lock);
+        write_unlock(&p->lock);
 }
 
 #ifdef CONFIG_NUMA_BALANCING
diff --git a/mm/mlock.c b/mm/mlock.c
index 339d9e0949b6..9cb87cbc4071 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -425,7 +425,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
         vma->vm_flags &= VM_LOCKED_CLEAR_MASK;
 
         while (start < end) {
-                struct page *page = NULL;
+                struct page *page;
                 unsigned int page_mask;
                 unsigned long page_increm;
                 struct pagevec pvec;
diff --git a/mm/mmap.c b/mm/mmap.c
index 2ce04a649f6b..b3f00b616b81 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -58,6 +58,18 @@
 #define arch_rebalance_pgtables(addr, len)              (addr)
 #endif
 
+#ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS
+const int mmap_rnd_bits_min = CONFIG_ARCH_MMAP_RND_BITS_MIN;
+const int mmap_rnd_bits_max = CONFIG_ARCH_MMAP_RND_BITS_MAX;
+int mmap_rnd_bits __read_mostly = CONFIG_ARCH_MMAP_RND_BITS;
+#endif
+#ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS
+const int mmap_rnd_compat_bits_min = CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN;
+const int mmap_rnd_compat_bits_max = CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX;
+int mmap_rnd_compat_bits __read_mostly = CONFIG_ARCH_MMAP_RND_COMPAT_BITS;
+#endif
+
+
 static void unmap_region(struct mm_struct *mm,
                 struct vm_area_struct *vma, struct vm_area_struct *prev,
                 unsigned long start, unsigned long end);
@@ -1208,24 +1220,6 @@ none:
         return NULL;
 }
 
-#ifdef CONFIG_PROC_FS
-void vm_stat_account(struct mm_struct *mm, unsigned long flags,
-                                                struct file *file, long pages)
-{
-        const unsigned long stack_flags
-                = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
-
-        mm->total_vm += pages;
-
-        if (file) {
-                mm->shared_vm += pages;
-                if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
-                        mm->exec_vm += pages;
-        } else if (flags & stack_flags)
-                mm->stack_vm += pages;
-}
-#endif /* CONFIG_PROC_FS */
-
 /*
  * If a hint addr is less than mmap_min_addr change hint to be as
  * low as possible but still greater than mmap_min_addr
@@ -1544,19 +1538,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
         unsigned long charged = 0;
 
         /* Check against address space limit. */
-        if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
+        if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) {
                 unsigned long nr_pages;
 
                 /*
                  * MAP_FIXED may remove pages of mappings that intersects with
                  * requested mapping. Account for the pages it would unmap.
                  */
-                if (!(vm_flags & MAP_FIXED))
-                        return -ENOMEM;
-
                 nr_pages = count_vma_pages_range(mm, addr, addr + len);
 
-                if (!may_expand_vm(mm, (len >> PAGE_SHIFT) - nr_pages))
+                if (!may_expand_vm(mm, vm_flags,
+                                        (len >> PAGE_SHIFT) - nr_pages))
                         return -ENOMEM;
         }
 
@@ -1655,7 +1647,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
 out:
         perf_event_mmap(vma);
 
-        vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
+        vm_stat_account(mm, vm_flags, len >> PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {
                 if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
                                         vma == get_gate_vma(current->mm)))
@@ -2102,7 +2094,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
         unsigned long new_start, actual_size;
 
         /* address space limit tests */
-        if (!may_expand_vm(mm, grow))
+        if (!may_expand_vm(mm, vma->vm_flags, grow))
                 return -ENOMEM;
 
         /* Stack limit test */
@@ -2199,8 +2191,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                                 spin_lock(&mm->page_table_lock);
                                 if (vma->vm_flags & VM_LOCKED)
                                         mm->locked_vm += grow;
-                                vm_stat_account(mm, vma->vm_flags,
-                                                vma->vm_file, grow);
+                                vm_stat_account(mm, vma->vm_flags, grow);
                                 anon_vma_interval_tree_pre_update_vma(vma);
                                 vma->vm_end = address;
                                 anon_vma_interval_tree_post_update_vma(vma);
@@ -2275,8 +2266,7 @@ int expand_downwards(struct vm_area_struct *vma,
                                 spin_lock(&mm->page_table_lock);
                                 if (vma->vm_flags & VM_LOCKED)
                                         mm->locked_vm += grow;
-                                vm_stat_account(mm, vma->vm_flags,
-                                                vma->vm_file, grow);
+                                vm_stat_account(mm, vma->vm_flags, grow);
                                 anon_vma_interval_tree_pre_update_vma(vma);
                                 vma->vm_start = address;
                                 vma->vm_pgoff -= grow;
@@ -2390,7 +2380,7 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
 
                 if (vma->vm_flags & VM_ACCOUNT)
                         nr_accounted += nrpages;
-                vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
+                vm_stat_account(mm, vma->vm_flags, -nrpages);
                 vma = remove_vma(vma);
         } while (vma);
         vm_unacct_memory(nr_accounted);
@@ -2760,7 +2750,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
         }
 
         /* Check against address space limits *after* clearing old maps... */
-        if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+        if (!may_expand_vm(mm, flags, len >> PAGE_SHIFT))
                 return -ENOMEM;
 
         if (mm->map_count > sysctl_max_map_count)
@@ -2795,6 +2785,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
 out:
         perf_event_mmap(vma);
         mm->total_vm += len >> PAGE_SHIFT;
+        mm->data_vm += len >> PAGE_SHIFT;
         if (flags & VM_LOCKED)
                 mm->locked_vm += (len >> PAGE_SHIFT);
         vma->vm_flags |= VM_SOFTDIRTY;
@@ -2986,16 +2977,28 @@ out:
  * Return true if the calling process may expand its vm space by the passed
  * number of pages
  */
-int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+bool may_expand_vm(struct mm_struct *mm, vm_flags_t flags, unsigned long npages)
 {
-        unsigned long cur = mm->total_vm;       /* pages */
-        unsigned long lim;
+        if (mm->total_vm + npages > rlimit(RLIMIT_AS) >> PAGE_SHIFT)
+                return false;
 
-        lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
+        if ((flags & (VM_WRITE | VM_SHARED | (VM_STACK_FLAGS &
+                                (VM_GROWSUP | VM_GROWSDOWN)))) == VM_WRITE)
+                return mm->data_vm + npages <= rlimit(RLIMIT_DATA);
 
-        if (cur + npages > lim)
-                return 0;
-        return 1;
+        return true;
+}
+
+void vm_stat_account(struct mm_struct *mm, vm_flags_t flags, long npages)
+{
+        mm->total_vm += npages;
+
+        if ((flags & (VM_EXEC | VM_WRITE)) == VM_EXEC)
+                mm->exec_vm += npages;
+        else if (flags & (VM_STACK_FLAGS & (VM_GROWSUP | VM_GROWSDOWN)))
+                mm->stack_vm += npages;
+        else if ((flags & (VM_WRITE | VM_SHARED)) == VM_WRITE)
+                mm->data_vm += npages;
 }
 
 static int special_mapping_fault(struct vm_area_struct *vma,
@@ -3077,7 +3080,7 @@ static struct vm_area_struct *__install_special_mapping(
         if (ret)
                 goto out;
 
-        mm->total_vm += len >> PAGE_SHIFT;
+        vm_stat_account(mm, vma->vm_flags, len >> PAGE_SHIFT);
 
         perf_event_mmap(vma);
 
diff --git a/mm/mmzone.c b/mm/mmzone.c
index 7d87ebb0d632..52687fb4de6f 100644
--- a/mm/mmzone.c
+++ b/mm/mmzone.c
@@ -72,16 +72,16 @@ struct zoneref *next_zones_zonelist(struct zoneref *z,
 }
 
 #ifdef CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
-int memmap_valid_within(unsigned long pfn,
+bool memmap_valid_within(unsigned long pfn,
                                         struct page *page, struct zone *zone)
 {
         if (page_to_pfn(page) != pfn)
-                return 0;
+                return false;
 
         if (page_zone(page) != zone)
-                return 0;
+                return false;
 
-        return 1;
+        return true;
 }
 #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index ef5be8eaab00..c764402c464f 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -278,6 +278,10 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
          * even if read-only so there is no need to account for them here
          */
         if (newflags & VM_WRITE) {
+                /* Check space limits when area turns into data. */
+                if (!may_expand_vm(mm, newflags, nrpages) &&
+                                may_expand_vm(mm, oldflags, nrpages))
+                        return -ENOMEM;
                 if (!(oldflags & (VM_ACCOUNT|VM_WRITE|VM_HUGETLB|
                                                 VM_SHARED|VM_NORESERVE))) {
                         charged = nrpages;
@@ -334,8 +338,8 @@ success:
                 populate_vma_page_range(vma, start, end, NULL);
         }
 
-        vm_stat_account(mm, oldflags, vma->vm_file, -nrpages);
-        vm_stat_account(mm, newflags, vma->vm_file, nrpages);
+        vm_stat_account(mm, oldflags, -nrpages);
+        vm_stat_account(mm, newflags, nrpages);
         perf_event_mmap(vma);
         return 0;
 
diff --git a/mm/mremap.c b/mm/mremap.c
index de824e72c3e8..e55b157865d5 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -317,7 +317,7 @@ static unsigned long move_vma(struct vm_area_struct *vma,
          * If this were a serious issue, we'd add a flag to do_munmap().
          */
         hiwater_vm = mm->hiwater_vm;
-        vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
+        vm_stat_account(mm, vma->vm_flags, new_len >> PAGE_SHIFT);
 
         /* Tell pfnmap has moved from this vma */
         if (unlikely(vma->vm_flags & VM_PFNMAP))
@@ -383,7 +383,8 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
                         return ERR_PTR(-EAGAIN);
         }
 
-        if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
+        if (!may_expand_vm(mm, vma->vm_flags,
+                                (new_len - old_len) >> PAGE_SHIFT))
                 return ERR_PTR(-ENOMEM);
 
         if (vma->vm_flags & VM_ACCOUNT) {
@@ -545,7 +546,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
                                 goto out;
                         }
 
-                        vm_stat_account(mm, vma->vm_flags, vma->vm_file, pages);
+                        vm_stat_account(mm, vma->vm_flags, pages);
                         if (vma->vm_flags & VM_LOCKED) {
                                 mm->locked_vm += pages;
                                 locked = true;
diff --git a/mm/nommu.c b/mm/nommu.c
index 92be862c859b..fbf6f0f1d6c9 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -560,7 +560,7 @@ void __init mmap_init(void)
 
         ret = percpu_counter_init(&vm_committed_as, 0, GFP_KERNEL);
         VM_BUG_ON(ret);
-        vm_region_jar = KMEM_CACHE(vm_region, SLAB_PANIC);
+        vm_region_jar = KMEM_CACHE(vm_region, SLAB_PANIC|SLAB_ACCOUNT);
 }
 
 /*
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index c12680993ff3..dc490c06941b 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -585,10 +585,11 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p,
          */
         do_send_sig_info(SIGKILL, SEND_SIG_FORCED, victim, true);
         mark_oom_victim(victim);
-        pr_err("Killed process %d (%s) total-vm:%lukB, anon-rss:%lukB, file-rss:%lukB\n",
+        pr_err("Killed process %d (%s) total-vm:%lukB, anon-rss:%lukB, file-rss:%lukB, shmem-rss:%lukB\n",
                 task_pid_nr(victim), victim->comm, K(victim->mm->total_vm),
                 K(get_mm_counter(victim->mm, MM_ANONPAGES)),
-                K(get_mm_counter(victim->mm, MM_FILEPAGES)));
+                K(get_mm_counter(victim->mm, MM_FILEPAGES)),
+                K(get_mm_counter(victim->mm, MM_SHMEMPAGES)));
         task_unlock(victim);
 
         /*
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index d15d88c8efa1..6fe7d15bd1f7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -278,7 +278,12 @@ static unsigned long zone_dirtyable_memory(struct zone *zone)
         unsigned long nr_pages;
 
         nr_pages = zone_page_state(zone, NR_FREE_PAGES);
-        nr_pages -= min(nr_pages, zone->dirty_balance_reserve);
+        /*
+         * Pages reserved for the kernel should not be considered
+         * dirtyable, to prevent a situation where reclaim has to
+         * clean pages in order to balance the zones.
+         */
+        nr_pages -= min(nr_pages, zone->totalreserve_pages);
 
         nr_pages += zone_page_state(zone, NR_INACTIVE_FILE);
         nr_pages += zone_page_state(zone, NR_ACTIVE_FILE);
@@ -332,7 +337,12 @@ static unsigned long global_dirtyable_memory(void)
         unsigned long x;
 
         x = global_page_state(NR_FREE_PAGES);
-        x -= min(x, dirty_balance_reserve);
+        /*
+         * Pages reserved for the kernel should not be considered
+         * dirtyable, to prevent a situation where reclaim has to
+         * clean pages in order to balance the zones.
+         */
+        x -= min(x, totalreserve_pages);
 
         x += global_page_state(NR_INACTIVE_FILE);
         x += global_page_state(NR_ACTIVE_FILE);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 9d666df5ef95..ce63d603820f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -114,13 +114,6 @@ static DEFINE_SPINLOCK(managed_page_count_lock);
 unsigned long totalram_pages __read_mostly;
 unsigned long totalreserve_pages __read_mostly;
 unsigned long totalcma_pages __read_mostly;
-/*
- * When calculating the number of globally allowed dirty pages, there
- * is a certain number of per-zone reserves that should not be
- * considered dirtyable memory.  This is the sum of those reserves
- * over all existing zones that contribute dirtyable memory.
- */
-unsigned long dirty_balance_reserve __read_mostly;
 
 int percpu_pagelist_fraction;
 gfp_t gfp_allowed_mask __read_mostly = GFP_BOOT_MASK;
@@ -812,7 +805,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                 do {
                         int mt; /* migratetype of the to-be-freed page */
 
-                        page = list_entry(list->prev, struct page, lru);
+                        page = list_last_entry(list, struct page, lru);
                         /* must delete as __free_one_page list manipulates */
                         list_del(&page->lru);
 
@@ -1417,11 +1410,10 @@ struct page *__rmqueue_smallest(struct zone *zone, unsigned int order,
         /* Find a page of the appropriate size in the preferred list */
         for (current_order = order; current_order < MAX_ORDER; ++current_order) {
                 area = &(zone->free_area[current_order]);
-                if (list_empty(&area->free_list[migratetype]))
-                        continue;
-
-                page = list_entry(area->free_list[migratetype].next,
+                page = list_first_entry_or_null(&area->free_list[migratetype],
                                                         struct page, lru);
+                if (!page)
+                        continue;
                 list_del(&page->lru);
                 rmv_page_order(page);
                 area->nr_free--;
@@ -1700,12 +1692,12 @@ static void unreserve_highatomic_pageblock(const struct alloc_context *ac)
                 for (order = 0; order < MAX_ORDER; order++) {
                         struct free_area *area = &(zone->free_area[order]);
 
-                        if (list_empty(&area->free_list[MIGRATE_HIGHATOMIC]))
+                        page = list_first_entry_or_null(
+                                        &area->free_list[MIGRATE_HIGHATOMIC],
+                                        struct page, lru);
+                        if (!page)
                                 continue;
 
-                        page = list_entry(area->free_list[MIGRATE_HIGHATOMIC].next,
-                                                struct page, lru);
-
                         /*
                          * It should never happen but changes to locking could
                          * inadvertently allow a per-cpu drain to add pages
@@ -1753,7 +1745,7 @@ __rmqueue_fallback(struct zone *zone, unsigned int order, int start_migratetype)
                 if (fallback_mt == -1)
                         continue;
 
-                page = list_entry(area->free_list[fallback_mt].next,
+                page = list_first_entry(&area->free_list[fallback_mt],
                                                 struct page, lru);
                 if (can_steal)
                         steal_suitable_fallback(zone, page, start_migratetype);
@@ -1788,7 +1780,7 @@ __rmqueue_fallback(struct zone *zone, unsigned int order, int start_migratetype)
  * Call me with the zone->lock already held.
  */
 static struct page *__rmqueue(struct zone *zone, unsigned int order,
-                                int migratetype, gfp_t gfp_flags)
+                                int migratetype)
 {
         struct page *page;
 
@@ -1818,7 +1810,7 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
 
         spin_lock(&zone->lock);
         for (i = 0; i < count; ++i) {
-                struct page *page = __rmqueue(zone, order, migratetype, 0);
+                struct page *page = __rmqueue(zone, order, migratetype);
                 if (unlikely(page == NULL))
                         break;
 
@@ -1988,7 +1980,7 @@ void mark_free_pages(struct zone *zone)
         unsigned long pfn, max_zone_pfn;
         unsigned long flags;
         unsigned int order, t;
-        struct list_head *curr;
+        struct page *page;
 
         if (zone_is_empty(zone))
                 return;
@@ -1998,17 +1990,17 @@ void mark_free_pages(struct zone *zone)
         max_zone_pfn = zone_end_pfn(zone);
         for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++)
                 if (pfn_valid(pfn)) {
-                        struct page *page = pfn_to_page(pfn);
-
+                        page = pfn_to_page(pfn);
                         if (!swsusp_page_is_forbidden(page))
                                 swsusp_unset_page_free(page);
                 }
 
         for_each_migratetype_order(order, t) {
-                list_for_each(curr, &zone->free_area[order].free_list[t]) {
+                list_for_each_entry(page,
+                                &zone->free_area[order].free_list[t], lru) {
                         unsigned long i;
 
-                        pfn = page_to_pfn(list_entry(curr, struct page, lru));
+                        pfn = page_to_pfn(page);
                         for (i = 0; i < (1UL << order); i++)
                                 swsusp_set_page_free(pfn_to_page(pfn + i));
                 }
@@ -2212,9 +2204,9 @@ struct page *buffered_rmqueue(struct zone *preferred_zone,
                 }
 
                 if (cold)
-                        page = list_entry(list->prev, struct page, lru);
+                        page = list_last_entry(list, struct page, lru);
                 else
-                        page = list_entry(list->next, struct page, lru);
+                        page = list_first_entry(list, struct page, lru);
 
                 list_del(&page->lru);
                 pcp->count--;
@@ -2241,7 +2233,7 @@ struct page *buffered_rmqueue(struct zone *preferred_zone,
                                 trace_mm_page_alloc_zone_locked(page, order, migratetype);
                 }
                 if (!page)
-                        page = __rmqueue(zone, order, migratetype, gfp_flags);
+                        page = __rmqueue(zone, order, migratetype);
                 spin_unlock(&zone->lock);
                 if (!page)
                         goto failed;
@@ -2740,8 +2732,21 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                         goto out;
         }
         /* Exhausted what can be done so it's blamo time */
-        if (out_of_memory(&oc) || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL))
+        if (out_of_memory(&oc) || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL)) {
                 *did_some_progress = 1;
+
+                if (gfp_mask & __GFP_NOFAIL) {
+                        page = get_page_from_freelist(gfp_mask, order,
+                                        ALLOC_NO_WATERMARKS|ALLOC_CPUSET, ac);
+                        /*
+                         * fallback to ignore cpuset restriction if our nodes
+                         * are depleted
+                         */
+                        if (!page)
+                                page = get_page_from_freelist(gfp_mask, order,
+                                        ALLOC_NO_WATERMARKS, ac);
+                }
+        }
 out:
         mutex_unlock(&oom_lock);
         return page;
@@ -2876,28 +2881,6 @@ retry:
         return page;
 }
 
-/*
- * This is called in the allocator slow-path if the allocation request is of
- * sufficient urgency to ignore watermarks and take other desperate measures
- */
-static inline struct page *
-__alloc_pages_high_priority(gfp_t gfp_mask, unsigned int order,
-                                const struct alloc_context *ac)
-{
-        struct page *page;
-
-        do {
-                page = get_page_from_freelist(gfp_mask, order,
-                                                ALLOC_NO_WATERMARKS, ac);
-
-                if (!page && gfp_mask & __GFP_NOFAIL)
-                        wait_iff_congested(ac->preferred_zone, BLK_RW_ASYNC,
-                                                                        HZ/50);
-        } while (!page && (gfp_mask & __GFP_NOFAIL));
-
-        return page;
-}
-
 static void wake_all_kswapds(unsigned int order, const struct alloc_context *ac)
 {
         struct zoneref *z;
@@ -3042,28 +3025,36 @@ retry:
                  * allocations are system rather than user orientated
                  */
                 ac->zonelist = node_zonelist(numa_node_id(), gfp_mask);
-
-                page = __alloc_pages_high_priority(gfp_mask, order, ac);
-
-                if (page) {
+                page = get_page_from_freelist(gfp_mask, order,
+                                                ALLOC_NO_WATERMARKS, ac);
+                if (page)
                         goto got_pg;
-                }
         }
 
         /* Caller is not willing to reclaim, we can't balance anything */
         if (!can_direct_reclaim) {
                 /*
-                 * All existing users of the deprecated __GFP_NOFAIL are
-                 * blockable, so warn of any new users that actually allow this
-                 * type of allocation to fail.
+                 * All existing users of the __GFP_NOFAIL are blockable, so warn
+                 * of any new users that actually allow this type of allocation
+                 * to fail.
                  */
                 WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL);
                 goto nopage;
         }
 
         /* Avoid recursion of direct reclaim */
-        if (current->flags & PF_MEMALLOC)
+        if (current->flags & PF_MEMALLOC) {
+                /*
+                 * __GFP_NOFAIL request from this context is rather bizarre
+                 * because we cannot reclaim anything and only can loop waiting
+                 * for somebody to do a work for us.
+                 */
+                if (WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL)) {
+                        cond_resched();
+                        goto retry;
+                }
                 goto nopage;
+        }
 
         /* Avoid allocations with no watermarks from looping endlessly */
         if (test_thread_flag(TIF_MEMDIE) && !(gfp_mask & __GFP_NOFAIL))
@@ -3402,7 +3393,8 @@ EXPORT_SYMBOL(__free_page_frag);
 
 /*
  * alloc_kmem_pages charges newly allocated pages to the kmem resource counter
- * of the current memory cgroup.
+ * of the current memory cgroup if __GFP_ACCOUNT is set, other than that it is
+ * equivalent to alloc_pages.
  *
  * It should be used when the caller would like to use kmalloc, but since the
  * allocation is large, it has to fall back to the page allocator.
@@ -4147,8 +4139,7 @@ static void set_zonelist_order(void)
 
 static void build_zonelists(pg_data_t *pgdat)
 {
-        int j, node, load;
-        enum zone_type i;
+        int i, node, load;
         nodemask_t used_mask;
         int local_node, prev_node;
         struct zonelist *zonelist;
@@ -4168,7 +4159,7 @@ static void build_zonelists(pg_data_t *pgdat)
         nodes_clear(used_mask);
 
         memset(node_order, 0, sizeof(node_order));
-        j = 0;
+        i = 0;
 
         while ((node = find_next_best_node(local_node, &used_mask)) >= 0) {
                 /*
@@ -4185,12 +4176,12 @@ static void build_zonelists(pg_data_t *pgdat)
                 if (order == ZONELIST_ORDER_NODE)
                         build_zonelists_in_node_order(pgdat, node);
                 else
-                        node_order[j++] = node; /* remember order */
+                        node_order[i++] = node; /* remember order */
         }
 
         if (order == ZONELIST_ORDER_ZONE) {
                 /* calculate node order -- i.e., DMA last! */
-                build_zonelists_in_zone_order(pgdat, j);
+                build_zonelists_in_zone_order(pgdat, i);
         }
 
         build_thisnode_zonelists(pgdat);
@@ -5956,20 +5947,12 @@ static void calculate_totalreserve_pages(void)
 
                         if (max > zone->managed_pages)
                                 max = zone->managed_pages;
+
+                        zone->totalreserve_pages = max;
+
                         reserve_pages += max;
-                        /*
-                         * Lowmem reserves are not available to
-                         * GFP_HIGHUSER page cache allocations and
-                         * kswapd tries to balance zones to their high
-                         * watermark.  As a result, neither should be
-                         * regarded as dirtyable memory, to prevent a
-                         * situation where reclaim has to clean pages
-                         * in order to balance the zones.
-                         */
-                        zone->dirty_balance_reserve = max;
                 }
         }
-        dirty_balance_reserve = reserve_pages;
         totalreserve_pages = reserve_pages;
 }
 
@@ -6724,8 +6707,12 @@ int alloc_contig_range(unsigned long start, unsigned long end,
         if (ret)
                 return ret;
 
+        /*
+         * In case of -EBUSY, we'd like to know which page causes problem.
+         * So, just fall through. We will check it in test_pages_isolated().
+         */
         ret = __alloc_contig_migrate_range(&cc, start, end);
-        if (ret)
+        if (ret && ret != -EBUSY)
                 goto done;
 
         /*
@@ -6752,12 +6739,25 @@ int alloc_contig_range(unsigned long start, unsigned long end,
         outer_start = start;
         while (!PageBuddy(pfn_to_page(outer_start))) {
                 if (++order >= MAX_ORDER) {
-                        ret = -EBUSY;
-                        goto done;
+                        outer_start = start;
+                        break;
                 }
                 outer_start &= ~0UL << order;
         }
 
+        if (outer_start != start) {
+                order = page_order(pfn_to_page(outer_start));
+
+                /*
+                 * outer_start page could be small order buddy page and
+                 * it doesn't include start page. Adjust outer_start
+                 * in this case to report failed page properly
+                 * on tracepoint in test_pages_isolated()
+                 */
+                if (outer_start + (1UL << order) <= start)
+                        outer_start = start;
+        }
+
         /* Make sure the range is really isolated. */
         if (test_pages_isolated(outer_start, end, false)) {
                 pr_info("%s: [%lx, %lx) PFNs busy\n",
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 4568fd58f70a..5e139fec6c6c 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -9,6 +9,9 @@
 #include <linux/hugetlb.h>
 #include "internal.h"
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/page_isolation.h>
+
 static int set_migratetype_isolate(struct page *page,
                                 bool skip_hwpoisoned_pages)
 {
@@ -162,8 +165,8 @@ int start_isolate_page_range(unsigned long start_pfn, unsigned long end_pfn,
         unsigned long undo_pfn;
         struct page *page;
 
-        BUG_ON((start_pfn) & (pageblock_nr_pages - 1));
-        BUG_ON((end_pfn) & (pageblock_nr_pages - 1));
+        BUG_ON(!IS_ALIGNED(start_pfn, pageblock_nr_pages));
+        BUG_ON(!IS_ALIGNED(end_pfn, pageblock_nr_pages));
 
         for (pfn = start_pfn;
              pfn < end_pfn;
@@ -212,7 +215,7 @@ int undo_isolate_page_range(unsigned long start_pfn, unsigned long end_pfn,
  *
  * Returns 1 if all pages in the range are isolated.
  */
-static int
+static unsigned long
 __test_page_isolated_in_pageblock(unsigned long pfn, unsigned long end_pfn,
                                   bool skip_hwpoisoned_pages)
 {
@@ -237,9 +240,8 @@ __test_page_isolated_in_pageblock(unsigned long pfn, unsigned long end_pfn,
                 else
                         break;
         }
-        if (pfn < end_pfn)
-                return 0;
-        return 1;
+
+        return pfn;
 }
 
 int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn,
@@ -248,7 +250,6 @@ int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn,
         unsigned long pfn, flags;
         struct page *page;
         struct zone *zone;
-        int ret;
 
         /*
          * Note: pageblock_nr_pages != MAX_ORDER. Then, chunks of free pages
@@ -266,10 +267,13 @@ int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn,
         /* Check all pages are free or marked as ISOLATED */
         zone = page_zone(page);
         spin_lock_irqsave(&zone->lock, flags);
-        ret = __test_page_isolated_in_pageblock(start_pfn, end_pfn,
+        pfn = __test_page_isolated_in_pageblock(start_pfn, end_pfn,
                                                 skip_hwpoisoned_pages);
         spin_unlock_irqrestore(&zone->lock, flags);
-        return ret ? 0 : -EBUSY;
+
+        trace_test_pages_isolated(start_pfn, end_pfn, pfn);
+
+        return pfn < end_pfn ? -EBUSY : 0;
 }
 
 struct page *alloc_migrate_target(struct page *page, unsigned long private,
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index 7d3db0247983..4c681baff363 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -176,13 +176,10 @@ pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
 
         /* FIFO */
         pgtable = pmd_huge_pte(mm, pmdp);
-        if (list_empty(&pgtable->lru))
-                pmd_huge_pte(mm, pmdp) = NULL;
-        else {
-                pmd_huge_pte(mm, pmdp) = list_entry(pgtable->lru.next,
-                                              struct page, lru);
+        pmd_huge_pte(mm, pmdp) = list_first_entry_or_null(&pgtable->lru,
+                                                          struct page, lru);
+        if (pmd_huge_pte(mm, pmdp))
                 list_del(&pgtable->lru);
-        }
         return pgtable;
 }
 #endif
diff --git a/mm/readahead.c b/mm/readahead.c
index ba22d7fe0afb..20e58e820e44 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -17,6 +17,7 @@
 #include <linux/pagemap.h>
 #include <linux/syscalls.h>
 #include <linux/file.h>
+#include <linux/mm_inline.h>
 
 #include "internal.h"
 
@@ -32,8 +33,6 @@ file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping)
 }
 EXPORT_SYMBOL_GPL(file_ra_state_init);
 
-#define list_to_page(head) (list_entry((head)->prev, struct page, lru))
-
 /*
  * see if a page needs releasing upon read_cache_pages() failure
  * - the caller of read_cache_pages() may have set PG_private or PG_fscache
@@ -64,7 +63,7 @@ static void read_cache_pages_invalidate_pages(struct address_space *mapping,
         struct page *victim;
 
         while (!list_empty(pages)) {
-                victim = list_to_page(pages);
+                victim = lru_to_page(pages);
                 list_del(&victim->lru);
                 read_cache_pages_invalidate_page(mapping, victim);
         }
@@ -87,7 +86,7 @@ int read_cache_pages(struct address_space *mapping, struct list_head *pages,
         int ret = 0;
 
         while (!list_empty(pages)) {
-                page = list_to_page(pages);
+                page = lru_to_page(pages);
                 list_del(&page->lru);
                 if (add_to_page_cache_lru(page, mapping, page->index,
                                 mapping_gfp_constraint(mapping, GFP_KERNEL))) {
@@ -125,7 +124,7 @@ static int read_pages(struct address_space *mapping, struct file *filp,
         }
 
         for (page_idx = 0; page_idx < nr_pages; page_idx++) {
-                struct page *page = list_to_page(pages);
+                struct page *page = lru_to_page(pages);
                 list_del(&page->lru);
                 if (!add_to_page_cache_lru(page, mapping, page->index,
                                 mapping_gfp_constraint(mapping, GFP_KERNEL))) {
diff --git a/mm/rmap.c b/mm/rmap.c
index b577fbb98d4b..622756c16ac8 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -428,8 +428,10 @@ static void anon_vma_ctor(void *data)
 void __init anon_vma_init(void)
 {
         anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma),
-                        0, SLAB_DESTROY_BY_RCU|SLAB_PANIC, anon_vma_ctor);
-        anon_vma_chain_cachep = KMEM_CACHE(anon_vma_chain, SLAB_PANIC);
+                        0, SLAB_DESTROY_BY_RCU|SLAB_PANIC|SLAB_ACCOUNT,
+                        anon_vma_ctor);
+        anon_vma_chain_cachep = KMEM_CACHE(anon_vma_chain,
+                        SLAB_PANIC|SLAB_ACCOUNT);
 }
 
 /*
@@ -1362,10 +1364,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 if (PageHuge(page)) {
                         hugetlb_count_sub(1 << compound_order(page), mm);
                 } else {
-                        if (PageAnon(page))
-                                dec_mm_counter(mm, MM_ANONPAGES);
-                        else
-                                dec_mm_counter(mm, MM_FILEPAGES);
+                        dec_mm_counter(mm, mm_counter(page));
                 }
                 set_pte_at(mm, address, pte,
                            swp_entry_to_pte(make_hwpoison_entry(page)));
@@ -1375,10 +1374,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                  * interest anymore. Simply discard the pte, vmscan
                  * will take care of the rest.
                  */
-                if (PageAnon(page))
-                        dec_mm_counter(mm, MM_ANONPAGES);
-                else
-                        dec_mm_counter(mm, MM_FILEPAGES);
+                dec_mm_counter(mm, mm_counter(page));
         } else if (IS_ENABLED(CONFIG_MIGRATION) && (flags & TTU_MIGRATION)) {
                 swp_entry_t entry;
                 pte_t swp_pte;
@@ -1418,7 +1414,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         swp_pte = pte_swp_mksoft_dirty(swp_pte);
                 set_pte_at(mm, address, pte, swp_pte);
         } else
-                dec_mm_counter(mm, MM_FILEPAGES);
+                dec_mm_counter(mm, mm_counter_file(page));
 
         page_remove_rmap(page);
         page_cache_release(page);
diff --git a/mm/shmem.c b/mm/shmem.c
index 642471b0ddea..970ff5b80853 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -360,6 +360,87 @@ static int shmem_free_swap(struct address_space *mapping,
 }
 
 /*
+ * Determine (in bytes) how many of the shmem object's pages mapped by the
+ * given offsets are swapped out.
+ *
+ * This is safe to call without i_mutex or mapping->tree_lock thanks to RCU,
+ * as long as the inode doesn't go away and racy results are not a problem.
+ */
+unsigned long shmem_partial_swap_usage(struct address_space *mapping,
+                                                pgoff_t start, pgoff_t end)
+{
+        struct radix_tree_iter iter;
+        void **slot;
+        struct page *page;
+        unsigned long swapped = 0;
+
+        rcu_read_lock();
+
+restart:
+        radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
+                if (iter.index >= end)
+                        break;
+
+                page = radix_tree_deref_slot(slot);
+
+                /*
+                 * This should only be possible to happen at index 0, so we
+                 * don't need to reset the counter, nor do we risk infinite
+                 * restarts.
+                 */
+                if (radix_tree_deref_retry(page))
+                        goto restart;
+
+                if (radix_tree_exceptional_entry(page))
+                        swapped++;
+
+                if (need_resched()) {
+                        cond_resched_rcu();
+                        start = iter.index + 1;
+                        goto restart;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return swapped << PAGE_SHIFT;
+}
+
+/*
+ * Determine (in bytes) how many of the shmem object's pages mapped by the
+ * given vma is swapped out.
+ *
+ * This is safe to call without i_mutex or mapping->tree_lock thanks to RCU,
+ * as long as the inode doesn't go away and racy results are not a problem.
+ */
+unsigned long shmem_swap_usage(struct vm_area_struct *vma)
+{
+        struct inode *inode = file_inode(vma->vm_file);
+        struct shmem_inode_info *info = SHMEM_I(inode);
+        struct address_space *mapping = inode->i_mapping;
+        unsigned long swapped;
+
+        /* Be careful as we don't hold info->lock */
+        swapped = READ_ONCE(info->swapped);
+
+        /*
+         * The easier cases are when the shmem object has nothing in swap, or
+         * the vma maps it whole. Then we can simply use the stats that we
+         * already track.
+         */
+        if (!swapped)
+                return 0;
+
+        if (!vma->vm_pgoff && vma->vm_end - vma->vm_start >= inode->i_size)
+                return swapped << PAGE_SHIFT;
+
+        /* Here comes the more involved part */
+        return shmem_partial_swap_usage(mapping,
+                        linear_page_index(vma, vma->vm_start),
+                        linear_page_index(vma, vma->vm_end));
+}
+
+/*
  * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
  */
 void shmem_unlock_mapping(struct address_space *mapping)
@@ -3064,7 +3145,7 @@ static int shmem_init_inodecache(void)
 {
         shmem_inode_cachep = kmem_cache_create("shmem_inode_cache",
                                 sizeof(struct shmem_inode_info),
-                                0, SLAB_PANIC, shmem_init_inode);
+                                0, SLAB_PANIC|SLAB_ACCOUNT, shmem_init_inode);
         return 0;
 }
 
diff --git a/mm/slab.c b/mm/slab.c
index 4765c97ce690..6ecc697a8bc4 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2756,6 +2756,21 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
 #define cache_free_debugcheck(x,objp,z) (objp)
 #endif
 
+static struct page *get_first_slab(struct kmem_cache_node *n)
+{
+        struct page *page;
+
+        page = list_first_entry_or_null(&n->slabs_partial,
+                        struct page, lru);
+        if (!page) {
+                n->free_touched = 1;
+                page = list_first_entry_or_null(&n->slabs_free,
+                                struct page, lru);
+        }
+
+        return page;
+}
+
 static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags,
                                                         bool force_refill)
 {
@@ -2791,18 +2806,12 @@ retry:
         }
 
         while (batchcount > 0) {
-                struct list_head *entry;
                 struct page *page;
                 /* Get slab alloc is to come from. */
-                entry = n->slabs_partial.next;
-                if (entry == &n->slabs_partial) {
-                        n->free_touched = 1;
-                        entry = n->slabs_free.next;
-                        if (entry == &n->slabs_free)
-                                goto must_grow;
-                }
+                page = get_first_slab(n);
+                if (!page)
+                        goto must_grow;
 
-                page = list_entry(entry, struct page, lru);
                 check_spinlock_acquired(cachep);
 
                 /*
@@ -3085,7 +3094,6 @@ retry:
 static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
                                 int nodeid)
 {
-        struct list_head *entry;
         struct page *page;
         struct kmem_cache_node *n;
         void *obj;
@@ -3098,15 +3106,10 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
 retry:
         check_irq_off();
         spin_lock(&n->list_lock);
-        entry = n->slabs_partial.next;
-        if (entry == &n->slabs_partial) {
-                n->free_touched = 1;
-                entry = n->slabs_free.next;
-                if (entry == &n->slabs_free)
-                        goto must_grow;
-        }
+        page = get_first_slab(n);
+        if (!page)
+                goto must_grow;
 
-        page = list_entry(entry, struct page, lru);
         check_spinlock_acquired_node(cachep, nodeid);
 
         STATS_INC_NODEALLOCS(cachep);
@@ -3338,17 +3341,12 @@ free_done:
 #if STATS
         {
                 int i = 0;
-                struct list_head *p;
-
-                p = n->slabs_free.next;
-                while (p != &(n->slabs_free)) {
-                        struct page *page;
+                struct page *page;
 
-                        page = list_entry(p, struct page, lru);
+                list_for_each_entry(page, &n->slabs_free, lru) {
                         BUG_ON(page->active);
 
                         i++;
-                        p = p->next;
                 }
                 STATS_SET_FREEABLE(cachep, i);
         }
diff --git a/mm/slab.h b/mm/slab.h
index 7b6087197997..c63b8699cfa3 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -128,10 +128,11 @@ static inline unsigned long kmem_cache_flags(unsigned long object_size,
 
 #if defined(CONFIG_SLAB)
 #define SLAB_CACHE_FLAGS (SLAB_MEM_SPREAD | SLAB_NOLEAKTRACE | \
-                          SLAB_RECLAIM_ACCOUNT | SLAB_TEMPORARY | SLAB_NOTRACK)
+                          SLAB_RECLAIM_ACCOUNT | SLAB_TEMPORARY | \
+                          SLAB_NOTRACK | SLAB_ACCOUNT)
 #elif defined(CONFIG_SLUB)
 #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \
-                          SLAB_TEMPORARY | SLAB_NOTRACK)
+                          SLAB_TEMPORARY | SLAB_NOTRACK | SLAB_ACCOUNT)
 #else
 #define SLAB_CACHE_FLAGS (0)
 #endif
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 3c6a86b4ec25..e016178063e1 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -37,7 +37,8 @@ struct kmem_cache *kmem_cache;
                 SLAB_TRACE | SLAB_DESTROY_BY_RCU | SLAB_NOLEAKTRACE | \
                 SLAB_FAILSLAB)
 
-#define SLAB_MERGE_SAME (SLAB_RECLAIM_ACCOUNT | SLAB_CACHE_DMA | SLAB_NOTRACK)
+#define SLAB_MERGE_SAME (SLAB_RECLAIM_ACCOUNT | SLAB_CACHE_DMA | \
+                         SLAB_NOTRACK | SLAB_ACCOUNT)
 
 /*
  * Merge control. If this is set then no merging of slab caches will occur.
diff --git a/mm/slub.c b/mm/slub.c
index 46997517406e..2d0e610d195a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5362,6 +5362,8 @@ static char *create_unique_id(struct kmem_cache *s)
                 *p++ = 'F';
         if (!(s->flags & SLAB_NOTRACK))
                 *p++ = 't';
+        if (s->flags & SLAB_ACCOUNT)
+                *p++ = 'A';
         if (p != name + 1)
                 *p++ = '-';
         p += sprintf(p, "%07d", s->size);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 58877312cf6b..e6b8591a3ed2 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -165,8 +165,6 @@ static void discard_swap_cluster(struct swap_info_struct *si,
         int found_extent = 0;
 
         while (nr_pages) {
-                struct list_head *lh;
-
                 if (se->start_page <= start_page &&
                     start_page < se->start_page + se->nr_pages) {
                         pgoff_t offset = start_page - se->start_page;
@@ -188,8 +186,7 @@ static void discard_swap_cluster(struct swap_info_struct *si,
                                 break;
                 }
 
-                lh = se->list.next;
-                se = list_entry(lh, struct swap_extent, list);
+                se = list_next_entry(se, list);
         }
 }
 
@@ -903,7 +900,7 @@ int swp_swapcount(swp_entry_t entry)
         VM_BUG_ON(page_private(page) != SWP_CONTINUED);
 
         do {
-                page = list_entry(page->lru.next, struct page, lru);
+                page = list_next_entry(page, lru);
                 map = kmap_atomic(page);
                 tmp_count = map[offset];
                 kunmap_atomic(map);
@@ -1633,14 +1630,11 @@ static sector_t map_swap_entry(swp_entry_t entry, struct block_device **bdev)
         se = start_se;
 
         for ( ; ; ) {
-                struct list_head *lh;
-
                 if (se->start_page <= offset &&
                                 offset < (se->start_page + se->nr_pages)) {
                         return se->start_block + (offset - se->start_page);
                 }
-                lh = se->list.next;
-                se = list_entry(lh, struct swap_extent, list);
+                se = list_next_entry(se, list);
                 sis->curr_swap_extent = se;
                 BUG_ON(se == start_se);         /* It *must* be present */
         }
@@ -1664,7 +1658,7 @@ static void destroy_swap_extents(struct swap_info_struct *sis)
         while (!list_empty(&sis->first_swap_extent.list)) {
                 struct swap_extent *se;
 
-                se = list_entry(sis->first_swap_extent.list.next,
+                se = list_first_entry(&sis->first_swap_extent.list,
                                 struct swap_extent, list);
                 list_del(&se->list);
                 kfree(se);
@@ -2959,11 +2953,10 @@ static void free_swap_count_continuations(struct swap_info_struct *si)
                 struct page *head;
                 head = vmalloc_to_page(si->swap_map + offset);
                 if (page_private(head)) {
-                        struct list_head *this, *next;
-                        list_for_each_safe(this, next, &head->lru) {
-                                struct page *page;
-                                page = list_entry(this, struct page, lru);
-                                list_del(this);
+                        struct page *page, *next;
+
+                        list_for_each_entry_safe(page, next, &head->lru, lru) {
+                                list_del(&page->lru);
                                 __free_page(page);
                         }
                 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8e3c9c5a3042..58ceeb107960 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -441,8 +441,7 @@ nocache:
                 if (list_is_last(&first->list, &vmap_area_list))
                         goto found;
 
-                first = list_entry(first->list.next,
-                                struct vmap_area, list);
+                first = list_next_entry(first, list);
         }
 
 found:
@@ -1477,13 +1476,10 @@ static void __vunmap(const void *addr, int deallocate_pages)
                         struct page *page = area->pages[i];
 
                         BUG_ON(!page);
-                        __free_page(page);
+                        __free_kmem_pages(page, 0);
                 }
 
-                if (area->flags & VM_VPAGES)
-                        vfree(area->pages);
-                else
-                        kfree(area->pages);
+                kvfree(area->pages);
         }
 
         kfree(area);
@@ -1593,7 +1589,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         if (array_size > PAGE_SIZE) {
                 pages = __vmalloc_node(array_size, 1, nested_gfp|__GFP_HIGHMEM,
                                 PAGE_KERNEL, node, area->caller);
-                area->flags |= VM_VPAGES;
         } else {
                 pages = kmalloc_node(array_size, nested_gfp, node);
         }
@@ -1608,9 +1603,9 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                 struct page *page;
 
                 if (node == NUMA_NO_NODE)
-                        page = alloc_page(alloc_mask);
+                        page = alloc_kmem_pages(alloc_mask, order);
                 else
-                        page = alloc_pages_node(node, alloc_mask, order);
+                        page = alloc_kmem_pages_node(node, alloc_mask, order);
 
                 if (unlikely(!page)) {
                         /* Successfully allocated i pages, free them in __vunmap() */
@@ -2559,10 +2554,10 @@ static void *s_start(struct seq_file *m, loff_t *pos)
         struct vmap_area *va;
 
         spin_lock(&vmap_area_lock);
-        va = list_entry((&vmap_area_list)->next, typeof(*va), list);
+        va = list_first_entry(&vmap_area_list, typeof(*va), list);
         while (n > 0 && &va->list != &vmap_area_list) {
                 n--;
-                va = list_entry(va->list.next, typeof(*va), list);
+                va = list_next_entry(va, list);
         }
         if (!n && &va->list != &vmap_area_list)
                 return va;
@@ -2576,7 +2571,7 @@ static void *s_next(struct seq_file *m, void *p, loff_t *pos)
         struct vmap_area *va = p, *next;
 
         ++*pos;
-        next = list_entry(va->list.next, typeof(*va), list);
+        next = list_next_entry(va, list);
         if (&next->list != &vmap_area_list)
                 return next;
 
@@ -2651,7 +2646,7 @@ static int s_show(struct seq_file *m, void *p)
         if (v->flags & VM_USERMAP)
                 seq_puts(m, " user");
 
-        if (v->flags & VM_VPAGES)
+        if (is_vmalloc_addr(v->pages))
                 seq_puts(m, " vpages");
 
         show_numa_info(m, v);
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index c5afd573d7da..9a6c0704211c 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -137,14 +137,11 @@ struct vmpressure_event {
 };
 
 static bool vmpressure_event(struct vmpressure *vmpr,
-                             unsigned long scanned, unsigned long reclaimed)
+                             enum vmpressure_levels level)
 {
         struct vmpressure_event *ev;
-        enum vmpressure_levels level;
         bool signalled = false;
 
-        level = vmpressure_calc_level(scanned, reclaimed);
-
         mutex_lock(&vmpr->events_lock);
 
         list_for_each_entry(ev, &vmpr->events, node) {
@@ -164,6 +161,7 @@ static void vmpressure_work_fn(struct work_struct *work)
         struct vmpressure *vmpr = work_to_vmpressure(work);
         unsigned long scanned;
         unsigned long reclaimed;
+        enum vmpressure_levels level;
 
         spin_lock(&vmpr->sr_lock);
         /*
@@ -174,19 +172,21 @@ static void vmpressure_work_fn(struct work_struct *work)
          * here. No need for any locks here since we don't care if
          * vmpr->reclaimed is in sync.
          */
-        scanned = vmpr->scanned;
+        scanned = vmpr->tree_scanned;
         if (!scanned) {
                 spin_unlock(&vmpr->sr_lock);
                 return;
         }
 
-        reclaimed = vmpr->reclaimed;
-        vmpr->scanned = 0;
-        vmpr->reclaimed = 0;
+        reclaimed = vmpr->tree_reclaimed;
+        vmpr->tree_scanned = 0;
+        vmpr->tree_reclaimed = 0;
         spin_unlock(&vmpr->sr_lock);
 
+        level = vmpressure_calc_level(scanned, reclaimed);
+
         do {
-                if (vmpressure_event(vmpr, scanned, reclaimed))
+                if (vmpressure_event(vmpr, level))
                         break;
                 /*
                  * If not handled, propagate the event upward into the
@@ -199,6 +199,7 @@ static void vmpressure_work_fn(struct work_struct *work)
  * vmpressure() - Account memory pressure through scanned/reclaimed ratio
  * @gfp:        reclaimer's gfp mask
  * @memcg:      cgroup memory controller handle
+ * @tree:       legacy subtree mode
  * @scanned:    number of pages scanned
  * @reclaimed:  number of pages reclaimed
  *
@@ -206,9 +207,16 @@ static void vmpressure_work_fn(struct work_struct *work)
  * "instantaneous" memory pressure (scanned/reclaimed ratio). The raw
  * pressure index is then further refined and averaged over time.
  *
+ * If @tree is set, vmpressure is in traditional userspace reporting
+ * mode: @memcg is considered the pressure root and userspace is
+ * notified of the entire subtree's reclaim efficiency.
+ *
+ * If @tree is not set, reclaim efficiency is recorded for @memcg, and
+ * only in-kernel users are notified.
+ *
  * This function does not return any value.
  */
-void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
+void vmpressure(gfp_t gfp, struct mem_cgroup *memcg, bool tree,
                 unsigned long scanned, unsigned long reclaimed)
 {
         struct vmpressure *vmpr = memcg_to_vmpressure(memcg);
@@ -238,15 +246,47 @@ void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
         if (!scanned)
                 return;
 
-        spin_lock(&vmpr->sr_lock);
-        vmpr->scanned += scanned;
-        vmpr->reclaimed += reclaimed;
-        scanned = vmpr->scanned;
-        spin_unlock(&vmpr->sr_lock);
+        if (tree) {
+                spin_lock(&vmpr->sr_lock);
+                vmpr->tree_scanned += scanned;
+                vmpr->tree_reclaimed += reclaimed;
+                scanned = vmpr->scanned;
+                spin_unlock(&vmpr->sr_lock);
 
-        if (scanned < vmpressure_win)
-                return;
-        schedule_work(&vmpr->work);
+                if (scanned < vmpressure_win)
+                        return;
+                schedule_work(&vmpr->work);
+        } else {
+                enum vmpressure_levels level;
+
+                /* For now, no users for root-level efficiency */
+                if (!memcg || memcg == root_mem_cgroup)
+                        return;
+
+                spin_lock(&vmpr->sr_lock);
+                scanned = vmpr->scanned += scanned;
+                reclaimed = vmpr->reclaimed += reclaimed;
+                if (scanned < vmpressure_win) {
+                        spin_unlock(&vmpr->sr_lock);
+                        return;
+                }
+                vmpr->scanned = vmpr->reclaimed = 0;
+                spin_unlock(&vmpr->sr_lock);
+
+                level = vmpressure_calc_level(scanned, reclaimed);
+
+                if (level > VMPRESSURE_LOW) {
+                        /*
+                         * Let the socket buffer allocator know that
+                         * we are having trouble reclaiming LRU pages.
+                         *
+                         * For hysteresis keep the pressure state
+                         * asserted for a second in which subsequent
+                         * pressure events can occur.
+                         */
+                        memcg->socket_pressure = jiffies + HZ;
+                }
+        }
 }
 
 /**
@@ -276,7 +316,7 @@ void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio)
          * to the vmpressure() basically means that we signal 'critical'
          * level.
          */
-        vmpressure(gfp, memcg, vmpressure_win, 0);
+        vmpressure(gfp, memcg, true, vmpressure_win, 0);
 }
 
 /**
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2aec4241b42a..108bd119f2f6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -106,8 +106,6 @@ struct scan_control {
         unsigned long nr_reclaimed;
 };
 
-#define lru_to_page(_head) (list_entry((_head)->prev, struct page, lru))
-
 #ifdef ARCH_HAS_PREFETCH
 #define prefetch_prev_lru_page(_page, _base, _field)                    \
         do {                                                            \
@@ -197,11 +195,13 @@ static unsigned long zone_reclaimable_pages(struct zone *zone)
         unsigned long nr;
 
         nr = zone_page_state(zone, NR_ACTIVE_FILE) +
-             zone_page_state(zone, NR_INACTIVE_FILE);
+             zone_page_state(zone, NR_INACTIVE_FILE) +
+             zone_page_state(zone, NR_ISOLATED_FILE);
 
         if (get_nr_swap_pages() > 0)
                 nr += zone_page_state(zone, NR_ACTIVE_ANON) +
-                      zone_page_state(zone, NR_INACTIVE_ANON);
+                      zone_page_state(zone, NR_INACTIVE_ANON) +
+                      zone_page_state(zone, NR_ISOLATED_ANON);
 
         return nr;
 }
@@ -594,7 +594,7 @@ static pageout_t pageout(struct page *page, struct address_space *mapping,
                         /* synchronous write or broken a_ops? */
                         ClearPageReclaim(page);
                 }
-                trace_mm_vmscan_writepage(page, trace_reclaim_flags(page));
+                trace_mm_vmscan_writepage(page);
                 inc_zone_page_state(page, NR_VMSCAN_WRITE);
                 return PAGE_SUCCESS;
         }
@@ -1426,6 +1426,7 @@ int isolate_lru_page(struct page *page)
         int ret = -EBUSY;
 
         VM_BUG_ON_PAGE(!page_count(page), page);
+        VM_BUG_ON_PAGE(PageTail(page), page);
 
         if (PageLRU(page)) {
                 struct zone *zone = page_zone(page);
@@ -1691,11 +1692,8 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
             current_may_throttle())
                 wait_iff_congested(zone, BLK_RW_ASYNC, HZ/10);
 
-        trace_mm_vmscan_lru_shrink_inactive(zone->zone_pgdat->node_id,
-                zone_idx(zone),
-                nr_scanned, nr_reclaimed,
-                sc->priority,
-                trace_shrink_flags(file));
+        trace_mm_vmscan_lru_shrink_inactive(zone, nr_scanned, nr_reclaimed,
+                        sc->priority, file);
         return nr_reclaimed;
 }
 
@@ -2046,10 +2044,16 @@ static void get_scan_count(struct lruvec *lruvec, int swappiness,
         }
 
         /*
-         * There is enough inactive page cache, do not reclaim
-         * anything from the anonymous working set right now.
+         * If there is enough inactive page cache, i.e. if the size of the
+         * inactive list is greater than that of the active list *and* the
+         * inactive list actually has some pages to scan on this priority, we
+         * do not reclaim anything from the anonymous working set right now.
+         * Without the second condition we could end up never scanning an
+         * lruvec even if it has plenty of old anonymous pages unless the
+         * system is under heavy pressure.
          */
-        if (!inactive_file_is_low(lruvec)) {
+        if (!inactive_file_is_low(lruvec) &&
+            get_lru_size(lruvec, LRU_INACTIVE_FILE) >> sc->priority) {
                 scan_balance = SCAN_FILE;
                 goto out;
         }
@@ -2393,6 +2397,7 @@ static bool shrink_zone(struct zone *zone, struct scan_control *sc,
                 memcg = mem_cgroup_iter(root, NULL, &reclaim);
                 do {
                         unsigned long lru_pages;
+                        unsigned long reclaimed;
                         unsigned long scanned;
                         struct lruvec *lruvec;
                         int swappiness;
@@ -2405,6 +2410,7 @@ static bool shrink_zone(struct zone *zone, struct scan_control *sc,
 
                         lruvec = mem_cgroup_zone_lruvec(zone, memcg);
                         swappiness = mem_cgroup_swappiness(memcg);
+                        reclaimed = sc->nr_reclaimed;
                         scanned = sc->nr_scanned;
 
                         shrink_lruvec(lruvec, swappiness, sc, &lru_pages);
@@ -2415,6 +2421,11 @@ static bool shrink_zone(struct zone *zone, struct scan_control *sc,
                                             memcg, sc->nr_scanned - scanned,
                                             lru_pages);
 
+                        /* Record the group's reclaim efficiency */
+                        vmpressure(sc->gfp_mask, memcg, false,
+                                   sc->nr_scanned - scanned,
+                                   sc->nr_reclaimed - reclaimed);
+
                         /*
                          * Direct reclaim and kswapd have to scan all memory
                          * cgroups to fulfill the overall scan target for the
@@ -2446,7 +2457,8 @@ static bool shrink_zone(struct zone *zone, struct scan_control *sc,
                         reclaim_state->reclaimed_slab = 0;
                 }
 
-                vmpressure(sc->gfp_mask, sc->target_mem_cgroup,
+                /* Record the subtree's reclaim efficiency */
+                vmpressure(sc->gfp_mask, sc->target_mem_cgroup, true,
                            sc->nr_scanned - nr_scanned,
                            sc->nr_reclaimed - nr_reclaimed);
 
diff --git a/mm/vmstat.c b/mm/vmstat.c
index c54fd2924f25..83a003bc3cae 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -460,7 +460,7 @@ static int fold_diff(int *diff)
  *
  * The function returns the number of global counters updated.
  */
-static int refresh_cpu_vm_stats(void)
+static int refresh_cpu_vm_stats(bool do_pagesets)
 {
         struct zone *zone;
         int i;
@@ -484,33 +484,35 @@ static int refresh_cpu_vm_stats(void)
 #endif
                         }
                 }
-                cond_resched();
 #ifdef CONFIG_NUMA
-                /*
-                 * Deal with draining the remote pageset of this
-                 * processor
-                 *
-                 * Check if there are pages remaining in this pageset
-                 * if not then there is nothing to expire.
-                 */
-                if (!__this_cpu_read(p->expire) ||
+                if (do_pagesets) {
+                        cond_resched();
+                        /*
+                         * Deal with draining the remote pageset of this
+                         * processor
+                         *
+                         * Check if there are pages remaining in this pageset
+                         * if not then there is nothing to expire.
+                         */
+                        if (!__this_cpu_read(p->expire) ||
                                !__this_cpu_read(p->pcp.count))
-                        continue;
+                                continue;
 
-                /*
-                 * We never drain zones local to this processor.
-                 */
-                if (zone_to_nid(zone) == numa_node_id()) {
-                        __this_cpu_write(p->expire, 0);
-                        continue;
-                }
+                        /*
+                         * We never drain zones local to this processor.
+                         */
+                        if (zone_to_nid(zone) == numa_node_id()) {
+                                __this_cpu_write(p->expire, 0);
+                                continue;
+                        }
 
-                if (__this_cpu_dec_return(p->expire))
-                        continue;
+                        if (__this_cpu_dec_return(p->expire))
+                                continue;
 
-                if (__this_cpu_read(p->pcp.count)) {
-                        drain_zone_pages(zone, this_cpu_ptr(&p->pcp));
-                        changes++;
+                        if (__this_cpu_read(p->pcp.count)) {
+                                drain_zone_pages(zone, this_cpu_ptr(&p->pcp));
+                                changes++;
+                        }
                 }
 #endif
         }
@@ -1386,7 +1388,7 @@ static cpumask_var_t cpu_stat_off;
 
 static void vmstat_update(struct work_struct *w)
 {
-        if (refresh_cpu_vm_stats()) {
+        if (refresh_cpu_vm_stats(true)) {
                 /*
                  * Counters were updated so we expect more updates
                  * to occur in the future. Keep on running the
@@ -1418,6 +1420,23 @@ static void vmstat_update(struct work_struct *w)
 }
 
 /*
+ * Switch off vmstat processing and then fold all the remaining differentials
+ * until the diffs stay at zero. The function is used by NOHZ and can only be
+ * invoked when tick processing is not active.
+ */
+void quiet_vmstat(void)
+{
+        if (system_state != SYSTEM_RUNNING)
+                return;
+
+        do {
+                if (!cpumask_test_and_set_cpu(smp_processor_id(), cpu_stat_off))
+                        cancel_delayed_work(this_cpu_ptr(&vmstat_work));
+
+        } while (refresh_cpu_vm_stats(false));
+}
+
+/*
  * Check if the diffs for a certain cpu indicate that
  * an update is needed.
  */
@@ -1449,7 +1468,7 @@ static bool need_update(int cpu)
  */
 static void vmstat_shepherd(struct work_struct *w);
 
-static DECLARE_DELAYED_WORK(shepherd, vmstat_shepherd);
+static DECLARE_DEFERRABLE_WORK(shepherd, vmstat_shepherd);
 
 static void vmstat_shepherd(struct work_struct *w)
 {
diff --git a/mm/zbud.c b/mm/zbud.c
index d8a181fd779b..b42322e50f63 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -463,9 +463,6 @@ void zbud_free(struct zbud_pool *pool, unsigned long handle)
         spin_unlock(&pool->lock);
 }
 
-#define list_tail_entry(ptr, type, member) \
-        list_entry((ptr)->prev, type, member)
-
 /**
  * zbud_reclaim_page() - evicts allocations from a pool page and frees it
  * @pool:       pool from which a page will attempt to be evicted
@@ -514,7 +511,7 @@ int zbud_reclaim_page(struct zbud_pool *pool, unsigned int retries)
                 return -EINVAL;
         }
         for (i = 0; i < retries; i++) {
-                zhdr = list_tail_entry(&pool->lru, struct zbud_header, lru);
+                zhdr = list_last_entry(&pool->lru, struct zbud_header, lru);
                 list_del(&zhdr->lru);
                 list_del(&zhdr->buddy);
                 /* Protect zbud page against free */
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 9f15bdd9163c..e7414cec220b 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -213,10 +213,10 @@ struct size_class {
         int size;
         unsigned int index;
 
-        /* Number of PAGE_SIZE sized pages to combine to form a 'zspage' */
-        int pages_per_zspage;
         struct zs_size_stat stats;
 
+        /* Number of PAGE_SIZE sized pages to combine to form a 'zspage' */
+        int pages_per_zspage;
         /* huge object: pages_per_zspage == 1 && maxobj_per_zspage == 1 */
         bool huge;
 };
diff --git a/net/core/sock.c b/net/core/sock.c
index 51270238e269..6c1c8bc93412 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -195,44 +195,6 @@ bool sk_net_capable(const struct sock *sk, int cap)
 }
 EXPORT_SYMBOL(sk_net_capable);
 
-
-#ifdef CONFIG_MEMCG_KMEM
-int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
-{
-        struct proto *proto;
-        int ret = 0;
-
-        mutex_lock(&proto_list_mutex);
-        list_for_each_entry(proto, &proto_list, node) {
-                if (proto->init_cgroup) {
-                        ret = proto->init_cgroup(memcg, ss);
-                        if (ret)
-                                goto out;
-                }
-        }
-
-        mutex_unlock(&proto_list_mutex);
-        return ret;
-out:
-        list_for_each_entry_continue_reverse(proto, &proto_list, node)
-                if (proto->destroy_cgroup)
-                        proto->destroy_cgroup(memcg);
-        mutex_unlock(&proto_list_mutex);
-        return ret;
-}
-
-void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg)
-{
-        struct proto *proto;
-
-        mutex_lock(&proto_list_mutex);
-        list_for_each_entry_reverse(proto, &proto_list, node)
-                if (proto->destroy_cgroup)
-                        proto->destroy_cgroup(memcg);
-        mutex_unlock(&proto_list_mutex);
-}
-#endif
-
 /*
  * Each address family might have different locking rules, so we have
  * one slock key per address family:
@@ -240,11 +202,6 @@ void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg)
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
 
-#if defined(CONFIG_MEMCG_KMEM)
-struct static_key memcg_socket_limit_enabled;
-EXPORT_SYMBOL(memcg_socket_limit_enabled);
-#endif
-
 /*
  * Make lock validator output more readable. (we pre-construct these
  * strings build-time, so that runtime initialization of socket
@@ -1507,12 +1464,6 @@ void sk_free(struct sock *sk)
 }
 EXPORT_SYMBOL(sk_free);
 
-static void sk_update_clone(const struct sock *sk, struct sock *newsk)
-{
-        if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                sock_update_memcg(newsk);
-}
-
 /**
  *      sk_clone_lock - clone a socket, and lock its clone
  *      @sk: the socket to clone
@@ -1607,7 +1558,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 sk_set_socket(newsk, NULL);
                 newsk->sk_wq = NULL;
 
-                sk_update_clone(sk, newsk);
+                if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+                        sock_update_memcg(newsk);
 
                 if (newsk->sk_prot->sockets_allocated)
                         sk_sockets_allocated_inc(newsk);
@@ -2089,27 +2041,27 @@ int __sk_mem_schedule(struct sock *sk, int size, int kind)
         struct proto *prot = sk->sk_prot;
         int amt = sk_mem_pages(size);
         long allocated;
-        int parent_status = UNDER_LIMIT;
 
         sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
 
-        allocated = sk_memory_allocated_add(sk, amt, &parent_status);
+        allocated = sk_memory_allocated_add(sk, amt);
+
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg &&
+            !mem_cgroup_charge_skmem(sk->sk_memcg, amt))
+                goto suppress_allocation;
 
         /* Under limit. */
-        if (parent_status == UNDER_LIMIT &&
-                        allocated <= sk_prot_mem_limits(sk, 0)) {
+        if (allocated <= sk_prot_mem_limits(sk, 0)) {
                 sk_leave_memory_pressure(sk);
                 return 1;
         }
 
-        /* Under pressure. (we or our parents) */
-        if ((parent_status > SOFT_LIMIT) ||
-                        allocated > sk_prot_mem_limits(sk, 1))
+        /* Under pressure. */
+        if (allocated > sk_prot_mem_limits(sk, 1))
                 sk_enter_memory_pressure(sk);
 
-        /* Over hard limit (we or our parents) */
-        if ((parent_status == OVER_LIMIT) ||
-                        (allocated > sk_prot_mem_limits(sk, 2)))
+        /* Over hard limit. */
+        if (allocated > sk_prot_mem_limits(sk, 2))
                 goto suppress_allocation;
 
         /* guarantee minimum buffer size under pressure */
@@ -2158,6 +2110,9 @@ suppress_allocation:
 
         sk_memory_allocated_sub(sk, amt);
 
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+                mem_cgroup_uncharge_skmem(sk->sk_memcg, amt);
+
         return 0;
 }
 EXPORT_SYMBOL(__sk_mem_schedule);
@@ -2173,6 +2128,9 @@ void __sk_mem_reclaim(struct sock *sk, int amount)
         sk_memory_allocated_sub(sk, amount);
         sk->sk_forward_alloc -= amount << SK_MEM_QUANTUM_SHIFT;
 
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+                mem_cgroup_uncharge_skmem(sk->sk_memcg, amount);
+
         if (sk_under_memory_pressure(sk) &&
             (sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
                 sk_leave_memory_pressure(sk);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7bb1b091efd1..fd17eec93525 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -422,7 +422,8 @@ void tcp_init_sock(struct sock *sk)
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
         local_bh_disable();
-        sock_update_memcg(sk);
+        if (mem_cgroup_sockets_enabled)
+                sock_update_memcg(sk);
         sk_sockets_allocated_inc(sk);
         local_bh_enable();
 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 65947c1f4733..c7d1fb50f381 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1818,7 +1818,9 @@ void tcp_v4_destroy_sock(struct sock *sk)
         tcp_saved_syn_free(tp);
 
         sk_sockets_allocated_dec(sk);
-        sock_release_memcg(sk);
+
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+                sock_release_memcg(sk);
 }
 EXPORT_SYMBOL(tcp_v4_destroy_sock);
 
@@ -2342,11 +2344,6 @@ struct proto tcp_prot = {
         .compat_setsockopt      = compat_tcp_setsockopt,
         .compat_getsockopt      = compat_tcp_getsockopt,
 #endif
-#ifdef CONFIG_MEMCG_KMEM
-        .init_cgroup            = tcp_init_cgroup,
-        .destroy_cgroup         = tcp_destroy_cgroup,
-        .proto_cgroup           = tcp_proto_cgroup,
-#endif
         .diag_destroy           = tcp_abort,
 };
 EXPORT_SYMBOL(tcp_prot);
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 2379c1b4efb2..18bc7f745e9c 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -8,75 +8,49 @@
 
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
+        struct mem_cgroup *parent = parent_mem_cgroup(memcg);
+        struct page_counter *counter_parent = NULL;
         /*
          * The root cgroup does not use page_counters, but rather,
          * rely on the data already collected by the network
          * subsystem
          */
-        struct mem_cgroup *parent = parent_mem_cgroup(memcg);
-        struct page_counter *counter_parent = NULL;
-        struct cg_proto *cg_proto, *parent_cg;
-
-        cg_proto = tcp_prot.proto_cgroup(memcg);
-        if (!cg_proto)
+        if (memcg == root_mem_cgroup)
                 return 0;
 
-        cg_proto->sysctl_mem[0] = sysctl_tcp_mem[0];
-        cg_proto->sysctl_mem[1] = sysctl_tcp_mem[1];
-        cg_proto->sysctl_mem[2] = sysctl_tcp_mem[2];
-        cg_proto->memory_pressure = 0;
-        cg_proto->memcg = memcg;
+        memcg->tcp_mem.memory_pressure = 0;
 
-        parent_cg = tcp_prot.proto_cgroup(parent);
-        if (parent_cg)
-                counter_parent = &parent_cg->memory_allocated;
+        if (parent)
+                counter_parent = &parent->tcp_mem.memory_allocated;
 
-        page_counter_init(&cg_proto->memory_allocated, counter_parent);
-        percpu_counter_init(&cg_proto->sockets_allocated, 0, GFP_KERNEL);
+        page_counter_init(&memcg->tcp_mem.memory_allocated, counter_parent);
 
         return 0;
 }
-EXPORT_SYMBOL(tcp_init_cgroup);
 
 void tcp_destroy_cgroup(struct mem_cgroup *memcg)
 {
-        struct cg_proto *cg_proto;
-
-        cg_proto = tcp_prot.proto_cgroup(memcg);
-        if (!cg_proto)
+        if (memcg == root_mem_cgroup)
                 return;
 
-        percpu_counter_destroy(&cg_proto->sockets_allocated);
-
-        if (test_bit(MEMCG_SOCK_ACTIVATED, &cg_proto->flags))
-                static_key_slow_dec(&memcg_socket_limit_enabled);
-
+        if (memcg->tcp_mem.active)
+                static_branch_dec(&memcg_sockets_enabled_key);
 }
-EXPORT_SYMBOL(tcp_destroy_cgroup);
 
 static int tcp_update_limit(struct mem_cgroup *memcg, unsigned long nr_pages)
 {
-        struct cg_proto *cg_proto;
-        int i;
         int ret;
 
-        cg_proto = tcp_prot.proto_cgroup(memcg);
-        if (!cg_proto)
+        if (memcg == root_mem_cgroup)
                 return -EINVAL;
 
-        ret = page_counter_limit(&cg_proto->memory_allocated, nr_pages);
+        ret = page_counter_limit(&memcg->tcp_mem.memory_allocated, nr_pages);
         if (ret)
                 return ret;
 
-        for (i = 0; i < 3; i++)
-                cg_proto->sysctl_mem[i] = min_t(long, nr_pages,
-                                                sysctl_tcp_mem[i]);
-
-        if (nr_pages == PAGE_COUNTER_MAX)
-                clear_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
-        else {
+        if (!memcg->tcp_mem.active) {
                 /*
-                 * The active bit needs to be written after the static_key
+                 * The active flag needs to be written after the static_key
                  * update. This is what guarantees that the socket activation
                  * function is the last one to run. See sock_update_memcg() for
                  * details, and note that we don't mark any socket as belonging
@@ -90,14 +64,9 @@ static int tcp_update_limit(struct mem_cgroup *memcg, unsigned long nr_pages)
                  * We never race with the readers in sock_update_memcg(),
                  * because when this value change, the code to process it is not
                  * patched in yet.
-                 *
-                 * The activated bit is used to guarantee that no two writers
-                 * will do the update in the same memcg. Without that, we can't
-                 * properly shutdown the static key.
                  */
-                if (!test_and_set_bit(MEMCG_SOCK_ACTIVATED, &cg_proto->flags))
-                        static_key_slow_inc(&memcg_socket_limit_enabled);
-                set_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
+                static_branch_inc(&memcg_sockets_enabled_key);
+                memcg->tcp_mem.active = true;
         }
 
         return 0;
@@ -141,32 +110,32 @@ static ssize_t tcp_cgroup_write(struct kernfs_open_file *of,
 static u64 tcp_cgroup_read(struct cgroup_subsys_state *css, struct cftype *cft)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
-        struct cg_proto *cg_proto = tcp_prot.proto_cgroup(memcg);
         u64 val;
 
         switch (cft->private) {
         case RES_LIMIT:
-                if (!cg_proto)
-                        return PAGE_COUNTER_MAX;
-                val = cg_proto->memory_allocated.limit;
+                if (memcg == root_mem_cgroup)
+                        val = PAGE_COUNTER_MAX;
+                else
+                        val = memcg->tcp_mem.memory_allocated.limit;
                 val *= PAGE_SIZE;
                 break;
         case RES_USAGE:
-                if (!cg_proto)
+                if (memcg == root_mem_cgroup)
                         val = atomic_long_read(&tcp_memory_allocated);
                 else
-                        val = page_counter_read(&cg_proto->memory_allocated);
+                        val = page_counter_read(&memcg->tcp_mem.memory_allocated);
                 val *= PAGE_SIZE;
                 break;
         case RES_FAILCNT:
-                if (!cg_proto)
+                if (memcg == root_mem_cgroup)
                         return 0;
-                val = cg_proto->memory_allocated.failcnt;
+                val = memcg->tcp_mem.memory_allocated.failcnt;
                 break;
         case RES_MAX_USAGE:
-                if (!cg_proto)
+                if (memcg == root_mem_cgroup)
                         return 0;
-                val = cg_proto->memory_allocated.watermark;
+                val = memcg->tcp_mem.memory_allocated.watermark;
                 val *= PAGE_SIZE;
                 break;
         default:
@@ -179,19 +148,17 @@ static ssize_t tcp_cgroup_reset(struct kernfs_open_file *of,
                                 char *buf, size_t nbytes, loff_t off)
 {
         struct mem_cgroup *memcg;
-        struct cg_proto *cg_proto;
 
         memcg = mem_cgroup_from_css(of_css(of));
-        cg_proto = tcp_prot.proto_cgroup(memcg);
-        if (!cg_proto)
+        if (memcg == root_mem_cgroup)
                 return nbytes;
 
         switch (of_cft(of)->private) {
         case RES_MAX_USAGE:
-                page_counter_reset_watermark(&cg_proto->memory_allocated);
+                page_counter_reset_watermark(&memcg->tcp_mem.memory_allocated);
                 break;
         case RES_FAILCNT:
-                cg_proto->memory_allocated.failcnt = 0;
+                memcg->tcp_mem.memory_allocated.failcnt = 0;
                 break;
         }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 412a920fe0ec..fda379cd600d 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2813,13 +2813,16 @@ begin_fwd:
  */
 void sk_forced_mem_schedule(struct sock *sk, int size)
 {
-        int amt, status;
+        int amt;
 
         if (size <= sk->sk_forward_alloc)
                 return;
         amt = sk_mem_pages(size);
         sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
-        sk_memory_allocated_add(sk, amt, &status);
+        sk_memory_allocated_add(sk, amt);
+
+        if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+                mem_cgroup_charge_skmem(sk->sk_memcg, amt);
 }
 
 /* Send a FIN. The caller locks the socket for us.
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index db9f1c318afc..4ad8edb46f7c 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1889,9 +1889,6 @@ struct proto tcpv6_prot = {
         .compat_setsockopt      = compat_tcp_setsockopt,
         .compat_getsockopt      = compat_tcp_getsockopt,
 #endif
-#ifdef CONFIG_MEMCG_KMEM
-        .proto_cgroup           = tcp_proto_cgroup,
-#endif
         .clear_sk               = tcp_v6_clear_sk,
         .diag_destroy           = tcp_abort,
 };
diff --git a/net/socket.c b/net/socket.c
index 91c2de6f5020..c044d1e8508c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -294,7 +294,7 @@ static int init_inodecache(void)
                                               0,
                                               (SLAB_HWCACHE_ALIGN |
                                                SLAB_RECLAIM_ACCOUNT |
-                                               SLAB_MEM_SPREAD),
+                                               SLAB_MEM_SPREAD | SLAB_ACCOUNT),
                                               init_once);
         if (sock_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index d81186d34558..14f45bf0410c 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1500,7 +1500,7 @@ int register_rpc_pipefs(void)
         rpc_inode_cachep = kmem_cache_create("rpc_inode_cache",
                                 sizeof(struct rpc_inode),
                                 0, (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD),
+                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
                                 init_once);
         if (!rpc_inode_cachep)
                 return -ENOMEM;
diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
index 23e78dcd12bf..38b64f487315 100755
--- a/scripts/bloat-o-meter
+++ b/scripts/bloat-o-meter
@@ -58,8 +58,8 @@ for name in common:
 delta.sort()
 delta.reverse()
 
-print "add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
-      (add, remove, grow, shrink, up, -down, up-down)
-print "%-40s %7s %7s %+7s" % ("function", "old", "new", "delta")
+print("add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
+      (add, remove, grow, shrink, up, -down, up-down))
+print("%-40s %7s %7s %+7s" % ("function", "old", "new", "delta"))
 for d, n in delta:
-    if d: print "%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d)
+    if d: print("%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d))
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 8adca4406198..161dd0d67da8 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -125,7 +125,7 @@ do {                                                            \
                 sprintf(str + strlen(str), "*");                \
 } while(0)
 
-/* Always end in a wildcard, for future extension */
+/* End in a wildcard, for future extension */
 static inline void add_wildcard(char *str)
 {
         int len = strlen(str);
@@ -704,7 +704,6 @@ static int do_of_entry (const char *filename, void *symval, char *alias)
                 if (isspace (*tmp))
                         *tmp = '_';
 
-        add_wildcard(alias);
         return 1;
 }
 ADD_TO_DEVTABLE("of", of_device_id, do_of_entry);