Grsec/PaX: 3.0-{3.2.55,3.13.3}-20140215220420140215

56 files changed, 3384 insertions, 920 deletions

diff --git a/3.13.2/0000_README b/3.13.3/0000_README
index ce8a461..f4a0bac 100644
--- a/3.13.2/0000_README
+++ b/3.13.3/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.13.2-201402111747.patch
+Patch:	4420_grsecurity-3.0-3.13.3-201402152204.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.13.2/4420_grsecurity-3.0-3.13.2-201402111747.patch b/3.13.3/4420_grsecurity-3.0-3.13.3-201402152204.patch
index 3ac109b..2fcc457 100644
--- a/3.13.2/4420_grsecurity-3.0-3.13.2-201402111747.patch
+++ b/3.13.3/4420_grsecurity-3.0-3.13.3-201402152204.patch
@@ -287,7 +287,7 @@ index b9e9bd8..bf49b92 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index a7fd5d9..dc8e4db 100644
+index 704b508..4a788c4 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -11662,7 +11662,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 0952ecd..75e0e8a 100644
+index 0952ecd..725c779 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -249,7 +249,7 @@ config X86_HT
@@ -11674,14 +11674,14 @@ index 0952ecd..75e0e8a 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -1104,6 +1104,7 @@ config MICROCODE_EARLY
+@@ -602,6 +602,7 @@ config SCHED_OMIT_FRAME_POINTER
  
- config X86_MSR
- 	tristate "/dev/cpu/*/msr - Model-specific register support"
-+	depends on !GRKERNSEC_KMEM
+ menuconfig HYPERVISOR_GUEST
+ 	bool "Linux guest support"
++	depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_GUEST
  	---help---
- 	  This device gives privileged processes access to the x86
- 	  Model-Specific Registers (MSRs).  It is a character device with
+ 	  Say Y here to enable options for running Linux under various hyper-
+ 	  visors. This option enables basic hypervisor detection and platform
 @@ -1127,7 +1128,7 @@ choice
  
  config NOHIGHMEM
@@ -17417,7 +17417,7 @@ index 2d88344..4679fc3 100644
  #define EARLY_DYNAMIC_PAGE_TABLES	64
  
 diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
-index 0ecac25..7a15e09 100644
+index 840c127..a8f297b 100644
 --- a/arch/x86/include/asm/pgtable_types.h
 +++ b/arch/x86/include/asm/pgtable_types.h
 @@ -16,13 +16,12 @@
@@ -17457,7 +17457,7 @@ index 0ecac25..7a15e09 100644
  #endif
  
  #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -146,6 +146,9 @@
+@@ -147,6 +147,9 @@
  #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
  					 _PAGE_ACCESSED)
  
@@ -17467,7 +17467,7 @@ index 0ecac25..7a15e09 100644
  #define __PAGE_KERNEL_EXEC						\
  	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
  #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -156,7 +159,7 @@
+@@ -157,7 +160,7 @@
  #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
  #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
  #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
@@ -17476,7 +17476,7 @@ index 0ecac25..7a15e09 100644
  #define __PAGE_KERNEL_VVAR		(__PAGE_KERNEL_RO | _PAGE_USER)
  #define __PAGE_KERNEL_VVAR_NOCACHE	(__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
  #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
-@@ -218,8 +221,8 @@
+@@ -219,8 +222,8 @@
   * bits are combined, this will alow user to access the high address mapped
   * VDSO in the presence of CONFIG_COMPAT_VDSO
   */
@@ -17487,7 +17487,7 @@ index 0ecac25..7a15e09 100644
  #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
  #endif
  
-@@ -257,7 +260,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
+@@ -258,7 +261,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
  {
  	return native_pgd_val(pgd) & PTE_FLAGS_MASK;
  }
@@ -17505,7 +17505,7 @@ index 0ecac25..7a15e09 100644
  #if PAGETABLE_LEVELS > 3
  typedef struct { pudval_t pud; } pud_t;
  
-@@ -271,8 +284,6 @@ static inline pudval_t native_pud_val(pud_t pud)
+@@ -272,8 +285,6 @@ static inline pudval_t native_pud_val(pud_t pud)
  	return pud.pud;
  }
  #else
@@ -17514,7 +17514,7 @@ index 0ecac25..7a15e09 100644
  static inline pudval_t native_pud_val(pud_t pud)
  {
  	return native_pgd_val(pud.pgd);
-@@ -292,8 +303,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
+@@ -293,8 +304,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
  	return pmd.pmd;
  }
  #else
@@ -17523,7 +17523,7 @@ index 0ecac25..7a15e09 100644
  static inline pmdval_t native_pmd_val(pmd_t pmd)
  {
  	return native_pgd_val(pmd.pud.pgd);
-@@ -333,7 +342,6 @@ typedef struct page *pgtable_t;
+@@ -334,7 +343,6 @@ typedef struct page *pgtable_t;
  
  extern pteval_t __supported_pte_mask;
  extern void set_nx(void);
@@ -20311,7 +20311,7 @@ index 59bfebc..d8f27bd 100644
  		if (c->x86_model == 3 && c->x86_mask == 0)
  			size = 64;
 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 6abc172..3b0df94 100644
+index 6abc172..77b0d1b 100644
 --- a/arch/x86/kernel/cpu/common.c
 +++ b/arch/x86/kernel/cpu/common.c
 @@ -88,60 +88,6 @@ static const struct cpu_dev default_cpu = {
@@ -20375,8 +20375,18 @@ index 6abc172..3b0df94 100644
  static int __init x86_xsave_setup(char *s)
  {
  	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -288,6 +234,59 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+@@ -284,10 +230,68 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+ 	raw_local_save_flags(eflags);
+ 	BUG_ON(eflags & X86_EFLAGS_AC);
+ 
+-	if (cpu_has(c, X86_FEATURE_SMAP))
++	if (cpu_has(c, X86_FEATURE_SMAP)) {
++#ifdef CONFIG_X86_SMAP
  		set_in_cr4(X86_CR4_SMAP);
++#else
++		clear_in_cr4(X86_CR4_SMAP);
++#endif
++	}
  }
  
 +#ifdef CONFIG_X86_64
@@ -20435,7 +20445,7 @@ index 6abc172..3b0df94 100644
  /*
   * Some CPU features depend on higher CPUID levels, which may not always
   * be available due to CPUID level capping or broken virtualization
-@@ -388,7 +387,7 @@ void switch_to_new_gdt(int cpu)
+@@ -388,7 +392,7 @@ void switch_to_new_gdt(int cpu)
  {
  	struct desc_ptr gdt_descr;
  
@@ -20444,7 +20454,7 @@ index 6abc172..3b0df94 100644
  	gdt_descr.size = GDT_SIZE - 1;
  	load_gdt(&gdt_descr);
  	/* Reload the per-cpu base */
-@@ -877,6 +876,10 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -877,6 +881,10 @@ static void identify_cpu(struct cpuinfo_x86 *c)
  	setup_smep(c);
  	setup_smap(c);
  
@@ -20455,7 +20465,7 @@ index 6abc172..3b0df94 100644
  	/*
  	 * The vendor-specific functions might have changed features.
  	 * Now we do "generic changes."
-@@ -885,6 +888,10 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -885,6 +893,10 @@ static void identify_cpu(struct cpuinfo_x86 *c)
  	/* Filter out anything that depends on CPUID levels we don't have */
  	filter_cpuid_features(c, true);
  
@@ -20466,7 +20476,7 @@ index 6abc172..3b0df94 100644
  	/* If the model name is still unset, do table lookup. */
  	if (!c->x86_model_id[0]) {
  		const char *p;
-@@ -1072,10 +1079,12 @@ static __init int setup_disablecpuid(char *arg)
+@@ -1072,10 +1084,12 @@ static __init int setup_disablecpuid(char *arg)
  }
  __setup("clearcpuid=", setup_disablecpuid);
  
@@ -20482,7 +20492,7 @@ index 6abc172..3b0df94 100644
  
  DEFINE_PER_CPU_FIRST(union irq_stack_union,
  		     irq_stack_union) __aligned(PAGE_SIZE) __visible;
-@@ -1089,7 +1098,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
+@@ -1089,7 +1103,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
  EXPORT_PER_CPU_SYMBOL(current_task);
  
  DEFINE_PER_CPU(unsigned long, kernel_stack) =
@@ -20491,7 +20501,7 @@ index 6abc172..3b0df94 100644
  EXPORT_PER_CPU_SYMBOL(kernel_stack);
  
  DEFINE_PER_CPU(char *, irq_stack_ptr) =
-@@ -1239,7 +1248,7 @@ void cpu_init(void)
+@@ -1239,7 +1253,7 @@ void cpu_init(void)
  	load_ucode_ap();
  
  	cpu = stack_smp_processor_id();
@@ -20500,7 +20510,7 @@ index 6abc172..3b0df94 100644
  	oist = &per_cpu(orig_ist, cpu);
  
  #ifdef CONFIG_NUMA
-@@ -1274,7 +1283,6 @@ void cpu_init(void)
+@@ -1274,7 +1288,6 @@ void cpu_init(void)
  	wrmsrl(MSR_KERNEL_GS_BASE, 0);
  	barrier();
  
@@ -20508,7 +20518,7 @@ index 6abc172..3b0df94 100644
  	enable_x2apic();
  
  	/*
-@@ -1326,7 +1334,7 @@ void cpu_init(void)
+@@ -1326,7 +1339,7 @@ void cpu_init(void)
  {
  	int cpu = smp_processor_id();
  	struct task_struct *curr = current;
@@ -25121,10 +25131,41 @@ index 18be189..4a9fe40 100644
  			if ((s64)val != *(s32 *)loc)
  				goto overflow;
 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index 05266b5..1577fde 100644
+index 05266b5..3432443 100644
 --- a/arch/x86/kernel/msr.c
 +++ b/arch/x86/kernel/msr.c
-@@ -233,7 +233,7 @@ static int msr_class_cpu_callback(struct notifier_block *nfb,
+@@ -37,6 +37,7 @@
+ #include <linux/notifier.h>
+ #include <linux/uaccess.h>
+ #include <linux/gfp.h>
++#include <linux/grsecurity.h>
+ 
+ #include <asm/processor.h>
+ #include <asm/msr.h>
+@@ -103,6 +104,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
+ 	int err = 0;
+ 	ssize_t bytes = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_msr_write();
++	return -EPERM;
++#endif
++
+ 	if (count % 8)
+ 		return -EINVAL;	/* Invalid chunk size */
+ 
+@@ -150,6 +156,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
+ 			err = -EBADF;
+ 			break;
+ 		}
++#ifdef CONFIG_GRKERNSEC_KMEM
++		gr_handle_msr_write();
++		return -EPERM;
++#endif
+ 		if (copy_from_user(&regs, uregs, sizeof regs)) {
+ 			err = -EFAULT;
+ 			break;
+@@ -233,7 +243,7 @@ static int msr_class_cpu_callback(struct notifier_block *nfb,
  	return notifier_from_errno(err);
  }
  
@@ -30661,7 +30702,7 @@ index 903ec1e..c4166b2 100644
  }
  
 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 9d591c8..2e61790 100644
+index 9d591c8..31e52ff 100644
 --- a/arch/x86/mm/fault.c
 +++ b/arch/x86/mm/fault.c
 @@ -14,11 +14,18 @@
@@ -31025,7 +31066,16 @@ index 9d591c8..2e61790 100644
  	if (error_code & PF_WRITE) {
  		/* write, present and write, not present: */
  		if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -1004,7 +1212,7 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
+@@ -1001,10 +1209,16 @@ static int fault_in_kernel_space(unsigned long address)
+ 
+ static inline bool smap_violation(int error_code, struct pt_regs *regs)
+ {
++	if (!IS_ENABLED(CONFIG_X86_SMAP))
++		return false;
++
++	if (!static_cpu_has(X86_FEATURE_SMAP))
++		return false;
++
  	if (error_code & PF_USER)
  		return false;
  
@@ -31034,7 +31084,7 @@ index 9d591c8..2e61790 100644
  		return false;
  
  	return true;
-@@ -1031,6 +1239,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1031,6 +1245,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
  	/* Get the faulting address: */
  	address = read_cr2();
  
@@ -31057,7 +31107,22 @@ index 9d591c8..2e61790 100644
  	/*
  	 * Detect and handle instructions that would cause a page fault for
  	 * both a tracked kernel page and a userspace page.
-@@ -1110,7 +1334,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1087,11 +1317,9 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
+ 	if (unlikely(error_code & PF_RSVD))
+ 		pgtable_bad(regs, error_code, address);
+ 
+-	if (static_cpu_has(X86_FEATURE_SMAP)) {
+-		if (unlikely(smap_violation(error_code, regs))) {
+-			bad_area_nosemaphore(regs, error_code, address);
+-			return;
+-		}
++	if (unlikely(smap_violation(error_code, regs))) {
++		bad_area_nosemaphore(regs, error_code, address);
++		return;
+ 	}
+ 
+ 	/*
+@@ -1110,7 +1338,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
  	 * User-mode registers count as a user access even for any
  	 * potential system fault or CPU buglet:
  	 */
@@ -31066,7 +31131,7 @@ index 9d591c8..2e61790 100644
  		local_irq_enable();
  		error_code |= PF_USER;
  		flags |= FAULT_FLAG_USER;
-@@ -1157,6 +1381,11 @@ retry:
+@@ -1157,6 +1385,11 @@ retry:
  		might_sleep();
  	}
  
@@ -31078,7 +31143,7 @@ index 9d591c8..2e61790 100644
  	vma = find_vma(mm, address);
  	if (unlikely(!vma)) {
  		bad_area(regs, error_code, address);
-@@ -1168,18 +1397,24 @@ retry:
+@@ -1168,18 +1401,24 @@ retry:
  		bad_area(regs, error_code, address);
  		return;
  	}
@@ -31114,7 +31179,7 @@ index 9d591c8..2e61790 100644
  	if (unlikely(expand_stack(vma, address))) {
  		bad_area(regs, error_code, address);
  		return;
-@@ -1273,3 +1508,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1273,3 +1512,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
  	__do_page_fault(regs, error_code);
  	exception_exit(prev_state);
  }
@@ -34762,6 +34827,18 @@ index 431e875..cbb23f3 100644
 -	return 0;
 -}
 -__setup("vdso=", vdso_setup);
+diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
+index 1a3c765..3d2e8d1 100644
+--- a/arch/x86/xen/Kconfig
++++ b/arch/x86/xen/Kconfig
+@@ -9,6 +9,7 @@ config XEN
+ 	select XEN_HAVE_PVMMU
+ 	depends on X86_64 || (X86_32 && X86_PAE && !X86_VISWS)
+ 	depends on X86_TSC
++	depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_XEN
+ 	help
+ 	  This is the Linux Xen port.  Enabling this will allow the
+ 	  kernel to boot in a paravirtualized environment under the
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
 index fa6ade7..73da73a5 100644
 --- a/arch/x86/xen/enlighten.c
@@ -39431,7 +39508,7 @@ index 6ed45a9..eb6dc41 100644
  		if (INTEL_INFO(dev)->gen >= 6) {
  			seq_printf(m,
 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index 5c64842..f14bdf8 100644
+index e02266a..e3411aa 100644
 --- a/drivers/gpu/drm/i915/i915_dma.c
 +++ b/drivers/gpu/drm/i915/i915_dma.c
 @@ -1271,7 +1271,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
@@ -39444,10 +39521,10 @@ index 5c64842..f14bdf8 100644
  	return can_switch;
  }
 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 90fcccb..b8aabc9 100644
+index 221ac62..f56acc8 100644
 --- a/drivers/gpu/drm/i915/i915_drv.h
 +++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -1325,7 +1325,7 @@ typedef struct drm_i915_private {
+@@ -1326,7 +1326,7 @@ typedef struct drm_i915_private {
  	drm_dma_handle_t *status_page_dmah;
  	struct resource mch_res;
  
@@ -40617,10 +40694,10 @@ index ac98964..5dbf512 100644
  	case VIA_IRQ_ABSOLUTE:
  		break;
 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-index 20890ad..699e4f2 100644
+index c0b73b9..f6f7f34 100644
 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-@@ -342,7 +342,7 @@ struct vmw_private {
+@@ -341,7 +341,7 @@ struct vmw_private {
  	 * Fencing and IRQs.
  	 */
  
@@ -43192,7 +43269,7 @@ index 3ba6a38..b0fa9b0 100644
  		       "start=%llu, len=%llu, dev_size=%llu",
  		       dm_device_name(ti->table->md), bdevname(bdev, b),
 diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
-index 8a30ad5..72792d3 100644
+index 7da3476..f75839e 100644
 --- a/drivers/md/dm-thin-metadata.c
 +++ b/drivers/md/dm-thin-metadata.c
 @@ -397,7 +397,7 @@ static void __setup_btree_details(struct dm_pool_metadata *pmd)
@@ -43214,7 +43291,7 @@ index 8a30ad5..72792d3 100644
  	pmd->bl_info.value_type.inc = data_block_inc;
  	pmd->bl_info.value_type.dec = data_block_dec;
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 0704c52..0a33d61 100644
+index b49c762..c9503cf 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
 @@ -185,9 +185,9 @@ struct mapped_device {
@@ -43240,7 +43317,7 @@ index 0704c52..0a33d61 100644
  	INIT_LIST_HEAD(&md->uevent_list);
  	spin_lock_init(&md->uevent_lock);
  
-@@ -2175,7 +2175,7 @@ static void event_callback(void *context)
+@@ -2176,7 +2176,7 @@ static void event_callback(void *context)
  
  	dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
  
@@ -43249,7 +43326,7 @@ index 0704c52..0a33d61 100644
  	wake_up(&md->eventq);
  }
  
-@@ -2868,18 +2868,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -2869,18 +2869,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
  
  uint32_t dm_next_uevent_seq(struct mapped_device *md)
  {
@@ -44869,7 +44946,7 @@ index 82dc574..8539ab2 100644
  
  		break;
 diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 29d5d98..fea356f 100644
+index 7b5424f..ed1d6ac 100644
 --- a/drivers/mmc/card/block.c
 +++ b/drivers/mmc/card/block.c
 @@ -575,7 +575,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
@@ -47645,10 +47722,10 @@ index 96c9f80..90974ca 100644
  	mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators,
  					ARRAY_SIZE(mc13892_regulators));
 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
-index f148762..5a6d1e5 100644
+index a2325bc..04c549f 100644
 --- a/drivers/rtc/rtc-cmos.c
 +++ b/drivers/rtc/rtc-cmos.c
-@@ -731,7 +731,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+@@ -779,7 +779,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
  	hpet_rtc_timer_init();
  
  	/* export at least the first block of NVRAM */
@@ -48894,10 +48971,10 @@ index df5e961..df6b97f 100644
  		return blk_trace_startstop(sdp->device->request_queue, 1);
  	case BLKTRACESTOP:
 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 349ebba..ff2a249 100644
+index d745f95..6bef2fc 100644
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -1945,7 +1945,7 @@ int spi_bus_unlock(struct spi_master *master)
+@@ -1947,7 +1947,7 @@ int spi_bus_unlock(struct spi_master *master)
  EXPORT_SYMBOL_GPL(spi_bus_unlock);
  
  /* portable code must never pass more than 32 bytes */
@@ -49428,10 +49505,10 @@ index d06de84..fd38c9b 100644
  	spin_lock_init(&dev->t10_wwn.t10_vpd_lock);
  	INIT_LIST_HEAD(&dev->t10_pr.registration_list);
 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 91953da..a842b90 100644
+index dee2be1..f5fd8ca 100644
 --- a/drivers/target/target_core_transport.c
 +++ b/drivers/target/target_core_transport.c
-@@ -1112,7 +1112,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
+@@ -1113,7 +1113,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
  	 * Used to determine when ORDERED commands should go from
  	 * Dormant to Active status.
  	 */
@@ -50736,6 +50813,19 @@ index d0e3a44..5f8b754 100644
  		if (!perm) {
  			ret = -EPERM;
  			goto reterr;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 61b1137..23b5d32 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1164,6 +1164,8 @@ static void csi_J(struct vc_data *vc, int vpar)
+ 			scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
+ 				    vc->vc_screenbuf_size >> 1);
+ 			set_origin(vc);
++			if (CON_IS_VISIBLE(vc))
++				update_screen(vc);
+ 			/* fall through */
+ 		case 2: /* erase whole display */
+ 			count = vc->vc_cols * vc->vc_rows;
 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
 index a673e5b..36e5d32 100644
 --- a/drivers/uio/uio.c
@@ -60046,10 +60136,10 @@ index b96a49b..9bfdc47 100644
  	cuse_class = class_create(THIS_MODULE, "cuse");
  	if (IS_ERR(cuse_class))
 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index ef74ad5..c9ac759e 100644
+index fa8cb4b..4acb935 100644
 --- a/fs/fuse/dev.c
 +++ b/fs/fuse/dev.c
-@@ -1339,7 +1339,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
+@@ -1323,7 +1323,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
  	ret = 0;
  	pipe_lock(pipe);
  
@@ -60058,7 +60148,7 @@ index ef74ad5..c9ac759e 100644
  		send_sig(SIGPIPE, current, 0);
  		if (!ret)
  			ret = -EPIPE;
-@@ -1364,7 +1364,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
+@@ -1352,7 +1352,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
  		page_nr++;
  		ret += buf->len;
  
@@ -61026,81 +61116,6 @@ index 00ad1c2..2fde15e 100644
  }
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
-diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
-index b4a160a..2b9bfba 100644
---- a/fs/nfs/nfs4client.c
-+++ b/fs/nfs/nfs4client.c
-@@ -409,13 +409,11 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
- 	error = nfs4_discover_server_trunking(clp, &old);
- 	if (error < 0)
- 		goto error;
--	nfs_put_client(clp);
--	if (clp != old) {
-+
-+	if (clp != old)
- 		clp->cl_preserve_clid = true;
--		clp = old;
--	}
--
--	return clp;
-+	nfs_put_client(clp);
-+	return old;
- 
- error:
- 	nfs_mark_client_ready(clp, error);
-@@ -493,9 +491,10 @@ int nfs40_walk_client_list(struct nfs_client *new,
- 			prev = pos;
- 
- 			status = nfs_wait_client_init_complete(pos);
--			spin_lock(&nn->nfs_client_lock);
- 			if (status < 0)
--				continue;
-+				goto out;
-+			status = -NFS4ERR_STALE_CLIENTID;
-+			spin_lock(&nn->nfs_client_lock);
- 		}
- 		if (pos->cl_cons_state != NFS_CS_READY)
- 			continue;
-@@ -633,7 +632,8 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 			}
- 			spin_lock(&nn->nfs_client_lock);
- 			if (status < 0)
--				continue;
-+				break;
-+			status = -NFS4ERR_STALE_CLIENTID;
- 		}
- 		if (pos->cl_cons_state != NFS_CS_READY)
- 			continue;
-diff --git a/fs/nfs/write.c b/fs/nfs/write.c
-index c1d5482..6a85038 100644
---- a/fs/nfs/write.c
-+++ b/fs/nfs/write.c
-@@ -922,19 +922,20 @@ out:
-  * extend the write to cover the entire page in order to avoid fragmentation
-  * inefficiencies.
-  *
-- * If the file is opened for synchronous writes or if we have a write delegation
-- * from the server then we can just skip the rest of the checks.
-+ * If the file is opened for synchronous writes then we can just skip the rest
-+ * of the checks.
-  */
- static int nfs_can_extend_write(struct file *file, struct page *page, struct inode *inode)
- {
- 	if (file->f_flags & O_DSYNC)
- 		return 0;
-+	if (!nfs_write_pageuptodate(page, inode))
-+		return 0;
- 	if (NFS_PROTO(inode)->have_delegation(inode, FMODE_WRITE))
- 		return 1;
--	if (nfs_write_pageuptodate(page, inode) && (inode->i_flock == NULL ||
--			(inode->i_flock->fl_start == 0 &&
-+	if (inode->i_flock == NULL || (inode->i_flock->fl_start == 0 &&
- 			inode->i_flock->fl_end == OFFSET_MAX &&
--			inode->i_flock->fl_type != F_RDLCK)))
-+			inode->i_flock->fl_type != F_RDLCK))
- 		return 1;
- 	return 0;
- }
 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
 index 419572f..5414a23 100644
 --- a/fs/nfsd/nfs4proc.c
@@ -61267,7 +61282,7 @@ index e7bc1d7..06bd4bb 100644
  	}
  
 diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
-index e44cb64..7668ca4 100644
+index 6663511..7668ca4 100644
 --- a/fs/notify/fanotify/fanotify_user.c
 +++ b/fs/notify/fanotify/fanotify_user.c
 @@ -253,8 +253,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
@@ -61281,18 +61296,6 @@ index e44cb64..7668ca4 100644
  		goto out_close_fd;
  
  	ret = prepare_for_access_response(group, event, fd);
-@@ -888,9 +888,9 @@ COMPAT_SYSCALL_DEFINE6(fanotify_mark,
- {
- 	return sys_fanotify_mark(fanotify_fd, flags,
- #ifdef __BIG_ENDIAN
--				((__u64)mask1 << 32) | mask0,
--#else
- 				((__u64)mask0 << 32) | mask1,
-+#else
-+				((__u64)mask1 << 32) | mask0,
- #endif
- 				 dfd, pathname);
- }
 diff --git a/fs/notify/notification.c b/fs/notify/notification.c
 index 7b51b05..5ea5ef6 100644
 --- a/fs/notify/notification.c
@@ -63328,7 +63331,7 @@ index 72d2917..c917c12 100644
  	if (!msg_head) {
  		printk(KERN_ERR
 diff --git a/fs/read_write.c b/fs/read_write.c
-index 58e440d..8ec2838 100644
+index cfa18df..c110979 100644
 --- a/fs/read_write.c
 +++ b/fs/read_write.c
 @@ -438,7 +438,7 @@ ssize_t __kernel_write(struct file *file, const char *buf, size_t count, loff_t
@@ -63612,7 +63615,7 @@ index 1d641bb..e600623 100644
  
  	if (op) {
 diff --git a/fs/splice.c b/fs/splice.c
-index 46a08f7..bb163cc 100644
+index 12028fa..a6f2619 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
 @@ -196,7 +196,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
@@ -63645,7 +63648,7 @@ index 46a08f7..bb163cc 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -565,7 +565,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+@@ -583,7 +583,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -63654,7 +63657,7 @@ index 46a08f7..bb163cc 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -580,7 +580,7 @@ ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+@@ -598,7 +598,7 @@ ssize_t kernel_write(struct file *file, const char *buf, size_t count,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -63663,7 +63666,7 @@ index 46a08f7..bb163cc 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -633,7 +633,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+@@ -651,7 +651,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
  			goto err;
  
  		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
@@ -63672,7 +63675,7 @@ index 46a08f7..bb163cc 100644
  		vec[i].iov_len = this_len;
  		spd.pages[i] = page;
  		spd.nr_pages++;
-@@ -829,7 +829,7 @@ int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
+@@ -847,7 +847,7 @@ int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
  			ops->release(pipe, buf);
  			pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
  			pipe->nrbufs--;
@@ -63681,7 +63684,7 @@ index 46a08f7..bb163cc 100644
  				sd->need_wakeup = true;
  		}
  
-@@ -854,10 +854,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+@@ -872,10 +872,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
  {
  	while (!pipe->nrbufs) {
@@ -63694,7 +63697,7 @@ index 46a08f7..bb163cc 100644
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1179,7 +1179,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+@@ -1197,7 +1197,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -63703,7 +63706,7 @@ index 46a08f7..bb163cc 100644
  
  		current->splice_pipe = pipe;
  	}
-@@ -1475,6 +1475,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
+@@ -1493,6 +1493,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
  
  			partial[buffers].offset = off;
  			partial[buffers].len = plen;
@@ -63711,7 +63714,7 @@ index 46a08f7..bb163cc 100644
  
  			off = 0;
  			len -= plen;
-@@ -1777,9 +1778,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1795,9 +1796,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -63723,7 +63726,7 @@ index 46a08f7..bb163cc 100644
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1811,7 +1812,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1829,7 +1830,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -63732,7 +63735,7 @@ index 46a08f7..bb163cc 100644
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1824,9 +1825,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1842,9 +1843,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -63744,7 +63747,7 @@ index 46a08f7..bb163cc 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -1862,14 +1863,14 @@ retry:
+@@ -1880,14 +1881,14 @@ retry:
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -63761,7 +63764,7 @@ index 46a08f7..bb163cc 100644
  			break;
  
  		/*
-@@ -1966,7 +1967,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1984,7 +1985,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -63770,7 +63773,7 @@ index 46a08f7..bb163cc 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -2011,7 +2012,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -2029,7 +2030,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -64240,10 +64243,10 @@ index 104455b..764c512 100644
  		kfree(s);
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..e98584b
+index 0000000..ffff596
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1147 @@
+@@ -0,0 +1,1153 @@
 +#
 +# grecurity configuration
 +#
@@ -65380,6 +65383,9 @@ index 0000000..e98584b
 +	  to allow informative logs to be produced, but large enough to
 +	  prevent flooding.
 +
++	  Setting both this value and GRKERNSEC_FLOODBURST to 0 will disable
++	  any rate limiting on grsecurity log messages.
++
 +config GRKERNSEC_FLOODBURST
 +	int "Number of messages in a burst (maximum)"
 +	default 6
@@ -65390,6 +65396,9 @@ index 0000000..e98584b
 +	  many of your logs are being interpreted as flooding, you may want to
 +	  raise this value.
 +
++	  Setting both this value and GRKERNSEC_FLOODTIME to 0 will disable
++	  any rate limiting on grsecurity log messages.
++
 +endmenu
 diff --git a/grsecurity/Makefile b/grsecurity/Makefile
 new file mode 100644
@@ -65453,7 +65462,7 @@ index 0000000..5307c8a
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..19a5b7c
+index 0000000..364a9d7
 --- /dev/null
 +++ b/grsecurity/gracl.c
 @@ -0,0 +1,2678 @@
@@ -67666,7 +67675,7 @@ index 0000000..19a5b7c
 +
 +	return;
 +}
-+EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL_GPL(gr_learn_resource);
 +#endif
 +
 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
@@ -68128,11 +68137,11 @@ index 0000000..19a5b7c
 +
 +
 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
-+EXPORT_SYMBOL(gr_acl_is_enabled);
++EXPORT_SYMBOL_GPL(gr_acl_is_enabled);
 +#endif
 +#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
++EXPORT_SYMBOL_GPL(gr_check_user_change);
++EXPORT_SYMBOL_GPL(gr_check_group_change);
 +#endif
 +
 diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
@@ -71940,7 +71949,7 @@ index 0000000..bc0be01
 +}
 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
 new file mode 100644
-index 0000000..e10b319
+index 0000000..651d6c2
 --- /dev/null
 +++ b/grsecurity/grsec_chroot.c
 @@ -0,0 +1,370 @@
@@ -72081,7 +72090,7 @@ index 0000000..e10b319
 +	return 0;
 +}
 +
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
++EXPORT_SYMBOL_GPL(gr_pid_is_chrooted);
 +
 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
@@ -72316,7 +72325,7 @@ index 0000000..e10b319
 +}
 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
 new file mode 100644
-index 0000000..52b3e30
+index 0000000..4d6fce8
 --- /dev/null
 +++ b/grsecurity/grsec_disabled.c
 @@ -0,0 +1,433 @@
@@ -72750,12 +72759,12 @@ index 0000000..52b3e30
 +}
 +
 +#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
++EXPORT_SYMBOL_GPL(gr_check_user_change);
++EXPORT_SYMBOL_GPL(gr_check_group_change);
 +#endif
 diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
 new file mode 100644
-index 0000000..387032b
+index 0000000..f35f454
 --- /dev/null
 +++ b/grsecurity/grsec_exec.c
 @@ -0,0 +1,187 @@
@@ -72942,10 +72951,10 @@ index 0000000..387032b
 +#endif
 +}
 +
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+EXPORT_SYMBOL(gr_task_is_capable);
-+EXPORT_SYMBOL(gr_task_is_capable_nolog);
++EXPORT_SYMBOL_GPL(gr_is_capable);
++EXPORT_SYMBOL_GPL(gr_is_capable_nolog);
++EXPORT_SYMBOL_GPL(gr_task_is_capable);
++EXPORT_SYMBOL_GPL(gr_task_is_capable_nolog);
 diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
 new file mode 100644
 index 0000000..06cc6ea
@@ -73007,7 +73016,7 @@ index 0000000..8ca18bf
 +}
 diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
 new file mode 100644
-index 0000000..a88e901
+index 0000000..ae6c028
 --- /dev/null
 +++ b/grsecurity/grsec_init.c
 @@ -0,0 +1,272 @@
@@ -73059,7 +73068,7 @@ index 0000000..a88e901
 +kgid_t grsec_tpe_gid;
 +int grsec_enable_blackhole;
 +#ifdef CONFIG_IPV6_MODULE
-+EXPORT_SYMBOL(grsec_enable_blackhole);
++EXPORT_SYMBOL_GPL(grsec_enable_blackhole);
 +#endif
 +int grsec_lastack_retries;
 +int grsec_enable_tpe_all;
@@ -73750,16 +73759,24 @@ index 0000000..dbe0a6b
 +}
 diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
 new file mode 100644
-index 0000000..f536303
+index 0000000..0e39d8c
 --- /dev/null
 +++ b/grsecurity/grsec_mem.c
-@@ -0,0 +1,40 @@
+@@ -0,0 +1,48 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/mm.h>
 +#include <linux/mman.h>
++#include <linux/module.h>
 +#include <linux/grinternal.h>
 +
++void gr_handle_msr_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_MSRWRITE_MSG);
++	return;
++}
++EXPORT_SYMBOL_GPL(gr_handle_msr_write);
++
 +void
 +gr_handle_ioperm(void)
 +{
@@ -74196,7 +74213,7 @@ index 0000000..3860c7e
 +}
 diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
 new file mode 100644
-index 0000000..4030d57
+index 0000000..c0aef3a
 --- /dev/null
 +++ b/grsecurity/grsec_sock.c
 @@ -0,0 +1,244 @@
@@ -74216,14 +74233,14 @@ index 0000000..4030d57
 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
 +
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
++EXPORT_SYMBOL_GPL(gr_search_udp_recvmsg);
++EXPORT_SYMBOL_GPL(gr_search_udp_sendmsg);
 +
 +#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
++EXPORT_SYMBOL_GPL(gr_acl_handle_unix);
++EXPORT_SYMBOL_GPL(gr_acl_handle_mknod);
++EXPORT_SYMBOL_GPL(gr_handle_chroot_unix);
++EXPORT_SYMBOL_GPL(gr_handle_create);
 +#endif
 +
 +#ifdef CONFIG_GRKERNSEC
@@ -74931,7 +74948,7 @@ index 0000000..8159888
 +#endif
 diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
 new file mode 100644
-index 0000000..0dc13c3
+index 0000000..61b514e
 --- /dev/null
 +++ b/grsecurity/grsec_time.c
 @@ -0,0 +1,16 @@
@@ -74950,7 +74967,7 @@ index 0000000..0dc13c3
 +	return;
 +}
 +
-+EXPORT_SYMBOL(gr_log_timechange);
++EXPORT_SYMBOL_GPL(gr_log_timechange);
 diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
 new file mode 100644
 index 0000000..ee57dcf
@@ -75743,10 +75760,10 @@ index 810431d..0ec4804f 100644
   * (puds are folded into pgds so this doesn't get actually called,
   * but the define is needed for a generic inline function.)
 diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
-index db09234..86683e3 100644
+index 8e4f41d..c5e9afd 100644
 --- a/include/asm-generic/pgtable.h
 +++ b/include/asm-generic/pgtable.h
-@@ -736,6 +736,22 @@ static inline pmd_t pmd_mknuma(pmd_t pmd)
+@@ -748,6 +748,22 @@ static inline pmd_t pmd_mknuma(pmd_t pmd)
  }
  #endif /* CONFIG_NUMA_BALANCING */
  
@@ -75988,7 +76005,7 @@ index c1da539..1dcec55 100644
  struct atmphy_ops {
  	int (*start)(struct atm_dev *dev);
 diff --git a/include/linux/audit.h b/include/linux/audit.h
-index a406419..c2bb164 100644
+index bf1ef22..2a55e1b 100644
 --- a/include/linux/audit.h
 +++ b/include/linux/audit.h
 @@ -195,7 +195,7 @@ static inline void audit_ptrace(struct task_struct *t)
@@ -76148,7 +76165,7 @@ index 7e59253..d6e4cae 100644
  /**
   * struct clk_init_data - holds init data that's common to all clocks and is
 diff --git a/include/linux/compat.h b/include/linux/compat.h
-index eb8a49d..6b66ed9 100644
+index 19f6003..90b64f4 100644
 --- a/include/linux/compat.h
 +++ b/include/linux/compat.h
 @@ -313,7 +313,7 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
@@ -76167,10 +76184,10 @@ index eb8a49d..6b66ed9 100644
 -				  compat_long_t addr, compat_long_t data);
 +				  compat_ulong_t addr, compat_ulong_t data);
  
- asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, size_t);
+ asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t);
  /*
 diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
-index ded4299..ddcbe31 100644
+index ded4299..55203f8 100644
 --- a/include/linux/compiler-gcc4.h
 +++ b/include/linux/compiler-gcc4.h
 @@ -39,9 +39,34 @@
@@ -76208,6 +76225,19 @@ index ded4299..ddcbe31 100644
  /*
   * Mark a position in code as unreachable.  This can be used to
   * suppress control flow warnings after asm blocks that transfer
+@@ -75,11 +100,7 @@
+  *
+  * (asm goto is automatically volatile - the naming reflects this.)
+  */
+-#if GCC_VERSION <= 40801
+-# define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
+-#else
+-# define asm_volatile_goto(x...)	do { asm goto(x); } while (0)
+-#endif
++#define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
+ 
+ #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+ #if GCC_VERSION >= 40400
 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
 index 92669cd..cc564c0 100644
 --- a/include/linux/compiler.h
@@ -77918,10 +77948,10 @@ index 0000000..d25522e
 +#endif
 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
 new file mode 100644
-index 0000000..195cbe4
+index 0000000..ba93581
 --- /dev/null
 +++ b/include/linux/grmsg.h
-@@ -0,0 +1,115 @@
+@@ -0,0 +1,116 @@
 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -78037,12 +78067,13 @@ index 0000000..195cbe4
 +#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds.  Please investigate the crash report for "
 +#define GR_BRUTE_SUID_MSG "bruteforce prevention initiated due to crash of %.950s against uid %u, banning suid/sgid execs for %u minutes.  Please investigate the crash report for "
 +#define GR_IPC_DENIED_MSG "denied %s of overly-permissive IPC object with creator uid %u by "
++#define GR_MSRWRITE_MSG "denied write to CPU MSR by "
 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
 new file mode 100644
-index 0000000..d8b5b48
+index 0000000..8108301
 --- /dev/null
 +++ b/include/linux/grsecurity.h
-@@ -0,0 +1,245 @@
+@@ -0,0 +1,246 @@
 +#ifndef GR_SECURITY_H
 +#define GR_SECURITY_H
 +#include <linux/fs.h>
@@ -78103,6 +78134,7 @@ index 0000000..d8b5b48
 +
 +void gr_handle_ioperm(void);
 +void gr_handle_iopl(void);
++void gr_handle_msr_write(void);
 +
 +umode_t gr_acl_umask(void);
 +
@@ -79754,7 +79786,7 @@ index 7246ef3..1539ea4 100644
  extern struct pid_namespace init_pid_ns;
  
 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
-index b8809fe..ae4ccd0 100644
+index ab57526..94598804 100644
 --- a/include/linux/pipe_fs_i.h
 +++ b/include/linux/pipe_fs_i.h
 @@ -47,10 +47,10 @@ struct pipe_inode_info {
@@ -80489,7 +80521,7 @@ index 53f97eb..1d90705 100644
  	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
  }
 diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
-index 41467f8..1e4253d 100644
+index e3347c5..f682891 100644
 --- a/include/linux/sched/sysctl.h
 +++ b/include/linux/sched/sysctl.h
 @@ -30,6 +30,7 @@ enum { sysctl_hung_task_timeout_secs = 0 };
@@ -81459,7 +81491,7 @@ index 4b8a891..cb8df6e 100644
  /*
   *	Internals.  Dont't use..
 diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
-index e4b9480..5a5f65a 100644
+index a67b384..f52a537 100644
 --- a/include/linux/vmstat.h
 +++ b/include/linux/vmstat.h
 @@ -90,18 +90,18 @@ static inline void vm_events_fold_cpu(int cpu)
@@ -81508,7 +81540,7 @@ index e4b9480..5a5f65a 100644
  
  #ifdef CONFIG_SMP
  	int cpu;
-@@ -220,8 +220,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
+@@ -218,8 +218,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
  
  static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
  {
@@ -81519,7 +81551,7 @@ index e4b9480..5a5f65a 100644
  }
  
  static inline void __inc_zone_page_state(struct page *page,
-@@ -232,8 +232,8 @@ static inline void __inc_zone_page_state(struct page *page,
+@@ -230,8 +230,8 @@ static inline void __inc_zone_page_state(struct page *page,
  
  static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
  {
@@ -82432,7 +82464,7 @@ index 1f741cb..8cefc08 100644
  struct snd_soc_platform {
  	const char *name;
 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index 321301c..2ae5cb0 100644
+index e3569f8..6544ffd 100644
 --- a/include/target/target_core_base.h
 +++ b/include/target/target_core_base.h
 @@ -687,7 +687,7 @@ struct se_device {
@@ -83643,10 +83675,10 @@ index 8d6e145..33e0b1e 100644
  	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
  	set_fs(fs);
 diff --git a/kernel/audit.c b/kernel/audit.c
-index 906ae5a0..a7ad0b4 100644
+index 15ec13a..986322e 100644
 --- a/kernel/audit.c
 +++ b/kernel/audit.c
-@@ -117,7 +117,7 @@ u32		audit_sig_sid = 0;
+@@ -118,7 +118,7 @@ u32		audit_sig_sid = 0;
     3) suppressed due to audit_rate_limit
     4) suppressed due to audit_backlog_limit
  */
@@ -83655,7 +83687,7 @@ index 906ae5a0..a7ad0b4 100644
  
  /* The netlink socket. */
  static struct sock *audit_sock;
-@@ -250,7 +250,7 @@ void audit_log_lost(const char *message)
+@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
  	unsigned long		now;
  	int			print;
  
@@ -83664,7 +83696,7 @@ index 906ae5a0..a7ad0b4 100644
  
  	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
  
-@@ -269,7 +269,7 @@ void audit_log_lost(const char *message)
+@@ -270,7 +270,7 @@ void audit_log_lost(const char *message)
  			printk(KERN_WARNING
  				"audit: audit_lost=%d audit_rate_limit=%d "
  				"audit_backlog_limit=%d\n",
@@ -83673,7 +83705,7 @@ index 906ae5a0..a7ad0b4 100644
  				audit_rate_limit,
  				audit_backlog_limit);
  		audit_panic(message);
-@@ -765,7 +765,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+@@ -766,7 +766,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  		status_set.pid		 = audit_pid;
  		status_set.rate_limit	 = audit_rate_limit;
  		status_set.backlog_limit = audit_backlog_limit;
@@ -83682,7 +83714,7 @@ index 906ae5a0..a7ad0b4 100644
  		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
  		audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
  				 &status_set, sizeof(status_set));
-@@ -1356,7 +1356,7 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
+@@ -1359,7 +1359,7 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
  	int i, avail, new_len;
  	unsigned char *ptr;
  	struct sk_buff *skb;
@@ -87846,10 +87878,19 @@ index a63f4dc..349bbb0 100644
  				     unsigned long timeout)
  {
 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index a88f4a4..9d57ac9 100644
+index c677510..132bb14 100644
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -2871,6 +2871,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -1768,7 +1768,7 @@ void set_numabalancing_state(bool enabled)
+ int sysctl_numa_balancing(struct ctl_table *table, int write,
+ 			 void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+-	struct ctl_table t;
++	ctl_table_no_const t;
+ 	int err;
+ 	int state = numabalancing_enabled;
+ 
+@@ -2893,6 +2893,8 @@ int can_nice(const struct task_struct *p, const int nice)
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = 20 - nice;
  
@@ -87858,7 +87899,7 @@ index a88f4a4..9d57ac9 100644
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -2904,7 +2906,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -2926,7 +2928,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (nice > 19)
  		nice = 19;
  
@@ -87868,7 +87909,7 @@ index a88f4a4..9d57ac9 100644
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -3066,6 +3069,7 @@ recheck:
+@@ -3088,6 +3091,7 @@ recheck:
  			unsigned long rlim_rtprio =
  					task_rlimit(p, RLIMIT_RTPRIO);
  
@@ -87876,7 +87917,7 @@ index a88f4a4..9d57ac9 100644
  			/* can't set/change the rt policy */
  			if (policy != p->policy && !rlim_rtprio)
  				return -EPERM;
-@@ -4232,7 +4236,7 @@ static void migrate_tasks(unsigned int dead_cpu)
+@@ -4254,7 +4258,7 @@ static void migrate_tasks(unsigned int dead_cpu)
  
  #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
  
@@ -87885,7 +87926,7 @@ index a88f4a4..9d57ac9 100644
  	{
  		.procname	= "sched_domain",
  		.mode		= 0555,
-@@ -4249,17 +4253,17 @@ static struct ctl_table sd_ctl_root[] = {
+@@ -4271,17 +4275,17 @@ static struct ctl_table sd_ctl_root[] = {
  	{}
  };
  
@@ -87907,7 +87948,7 @@ index a88f4a4..9d57ac9 100644
  
  	/*
  	 * In the intermediate directories, both the child directory and
-@@ -4267,22 +4271,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -4289,22 +4293,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
  	 * will always be set. In the lowest directory the names are
  	 * static strings and all have proc handlers.
  	 */
@@ -87939,7 +87980,7 @@ index a88f4a4..9d57ac9 100644
  		const char *procname, void *data, int maxlen,
  		umode_t mode, proc_handler *proc_handler,
  		bool load_idx)
-@@ -4302,7 +4309,7 @@ set_table_entry(struct ctl_table *entry,
+@@ -4324,7 +4331,7 @@ set_table_entry(struct ctl_table *entry,
  static struct ctl_table *
  sd_alloc_ctl_domain_table(struct sched_domain *sd)
  {
@@ -87948,7 +87989,7 @@ index a88f4a4..9d57ac9 100644
  
  	if (table == NULL)
  		return NULL;
-@@ -4337,9 +4344,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -4359,9 +4366,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
  	return table;
  }
  
@@ -87960,7 +88001,7 @@ index a88f4a4..9d57ac9 100644
  	struct sched_domain *sd;
  	int domain_num = 0, i;
  	char buf[32];
-@@ -4366,11 +4373,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -4388,11 +4395,13 @@ static struct ctl_table_header *sd_sysctl_header;
  static void register_sched_domain_sysctl(void)
  {
  	int i, cpu_num = num_possible_cpus();
@@ -87975,7 +88016,7 @@ index a88f4a4..9d57ac9 100644
  
  	if (entry == NULL)
  		return;
-@@ -4393,8 +4402,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -4415,8 +4424,12 @@ static void unregister_sched_domain_sysctl(void)
  	if (sd_sysctl_header)
  		unregister_sysctl_table(sd_sysctl_header);
  	sd_sysctl_header = NULL;
@@ -88412,7 +88453,7 @@ index c723113..46bf922 100644
  	if (!retval) {
  		if (old_rlim)
 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index 34a6047..5665aa7 100644
+index 06962ba..a54d45e 100644
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
 @@ -93,7 +93,6 @@
@@ -88514,7 +88555,7 @@ index 34a6047..5665aa7 100644
  	{
  		.procname	= "sched_child_runs_first",
  		.data		= &sysctl_sched_child_runs_first,
-@@ -620,7 +650,7 @@ static struct ctl_table kern_table[] = {
+@@ -629,7 +659,7 @@ static struct ctl_table kern_table[] = {
  		.data		= &modprobe_path,
  		.maxlen		= KMOD_PATH_LEN,
  		.mode		= 0644,
@@ -88523,7 +88564,7 @@ index 34a6047..5665aa7 100644
  	},
  	{
  		.procname	= "modules_disabled",
-@@ -787,16 +817,20 @@ static struct ctl_table kern_table[] = {
+@@ -796,16 +826,20 @@ static struct ctl_table kern_table[] = {
  		.extra1		= &zero,
  		.extra2		= &one,
  	},
@@ -88545,7 +88586,7 @@ index 34a6047..5665aa7 100644
  	{
  		.procname	= "ngroups_max",
  		.data		= &ngroups_max,
-@@ -1039,10 +1073,17 @@ static struct ctl_table kern_table[] = {
+@@ -1048,10 +1082,17 @@ static struct ctl_table kern_table[] = {
  	 */
  	{
  		.procname	= "perf_event_paranoid",
@@ -88566,7 +88607,7 @@ index 34a6047..5665aa7 100644
  	},
  	{
  		.procname	= "perf_event_mlock_kb",
-@@ -1306,6 +1347,13 @@ static struct ctl_table vm_table[] = {
+@@ -1315,6 +1356,13 @@ static struct ctl_table vm_table[] = {
  		.proc_handler	= proc_dointvec_minmax,
  		.extra1		= &zero,
  	},
@@ -88580,7 +88621,7 @@ index 34a6047..5665aa7 100644
  #else
  	{
  		.procname	= "nr_trim_pages",
-@@ -1770,6 +1818,16 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -1779,6 +1827,16 @@ int proc_dostring(struct ctl_table *table, int write,
  			       buffer, lenp, ppos);
  }
  
@@ -88597,7 +88638,7 @@ index 34a6047..5665aa7 100644
  static size_t proc_skip_spaces(char **buf)
  {
  	size_t ret;
-@@ -1875,6 +1933,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
+@@ -1884,6 +1942,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
  	len = strlen(tmp);
  	if (len > *size)
  		len = *size;
@@ -88606,7 +88647,7 @@ index 34a6047..5665aa7 100644
  	if (copy_to_user(*buf, tmp, len))
  		return -EFAULT;
  	*size -= len;
-@@ -2039,7 +2099,7 @@ int proc_dointvec(struct ctl_table *table, int write,
+@@ -2048,7 +2108,7 @@ int proc_dointvec(struct ctl_table *table, int write,
  static int proc_taint(struct ctl_table *table, int write,
  			       void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -88615,7 +88656,7 @@ index 34a6047..5665aa7 100644
  	unsigned long tmptaint = get_taint();
  	int err;
  
-@@ -2067,7 +2127,6 @@ static int proc_taint(struct ctl_table *table, int write,
+@@ -2076,7 +2136,6 @@ static int proc_taint(struct ctl_table *table, int write,
  	return err;
  }
  
@@ -88623,7 +88664,7 @@ index 34a6047..5665aa7 100644
  static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
  				void __user *buffer, size_t *lenp, loff_t *ppos)
  {
-@@ -2076,7 +2135,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+@@ -2085,7 +2144,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
  
  	return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
  }
@@ -88631,7 +88672,7 @@ index 34a6047..5665aa7 100644
  
  struct do_proc_dointvec_minmax_conv_param {
  	int *min;
-@@ -2623,6 +2681,12 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2632,6 +2690,12 @@ int proc_dostring(struct ctl_table *table, int write,
  	return -ENOSYS;
  }
  
@@ -88644,7 +88685,7 @@ index 34a6047..5665aa7 100644
  int proc_dointvec(struct ctl_table *table, int write,
  		  void __user *buffer, size_t *lenp, loff_t *ppos)
  {
-@@ -2679,5 +2743,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
+@@ -2688,5 +2752,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
  EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
  EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
  EXPORT_SYMBOL(proc_dostring);
@@ -88708,7 +88749,7 @@ index 88c9c65..7497ebc 100644
  		.clock_get	= alarm_clock_get,
  		.timer_create	= alarm_timer_create,
 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 87b4f00..b7f77a7 100644
+index b415457..c26876d 100644
 --- a/kernel/time/timekeeping.c
 +++ b/kernel/time/timekeeping.c
 @@ -15,6 +15,7 @@
@@ -88899,10 +88940,10 @@ index f785aef..59f1b18 100644
  
  	ret = -EIO;
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 72a0f81..0bbfd090 100644
+index 38463d2..68abe92 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
-@@ -1944,12 +1944,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+@@ -1978,12 +1978,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
  	if (unlikely(ftrace_disabled))
  		return 0;
  
@@ -88922,7 +88963,7 @@ index 72a0f81..0bbfd090 100644
  }
  
  /*
-@@ -4119,8 +4124,10 @@ static int ftrace_process_locs(struct module *mod,
+@@ -4190,8 +4195,10 @@ static int ftrace_process_locs(struct module *mod,
  	if (!count)
  		return 0;
  
@@ -88933,7 +88974,7 @@ index 72a0f81..0bbfd090 100644
  
  	start_pg = ftrace_allocate_pages(count);
  	if (!start_pg)
-@@ -4851,8 +4858,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+@@ -4922,8 +4929,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  
  static int ftrace_graph_active;
@@ -88942,9 +88983,9 @@ index 72a0f81..0bbfd090 100644
  int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
  {
  	return 0;
-@@ -5003,6 +5008,10 @@ static struct ftrace_ops fgraph_ops __read_mostly = {
- 				FTRACE_OPS_FL_RECURSION_SAFE,
- };
+@@ -5099,6 +5104,10 @@ static void update_function_graph_func(void)
+ 		ftrace_graph_entry = ftrace_graph_entry_test;
+ }
  
 +static struct notifier_block ftrace_suspend_notifier = {
 +	.notifier_call = ftrace_suspend_notifier_call
@@ -88953,7 +88994,7 @@ index 72a0f81..0bbfd090 100644
  int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  			trace_func_graph_ent_t entryfunc)
  {
-@@ -5016,7 +5025,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+@@ -5112,7 +5121,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  		goto out;
  	}
  
@@ -89240,10 +89281,10 @@ index cc2f66f..05edd54 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 9d20cd9..221d816 100644
+index 0a360ce..7bd800e 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
-@@ -3346,7 +3346,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
+@@ -3352,7 +3352,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
  	return 0;
  }
  
@@ -90469,10 +90510,10 @@ index dee6cf4..52b94f7 100644
  	if (!ptep)
  		return VM_FAULT_OOM;
 diff --git a/mm/internal.h b/mm/internal.h
-index 684f7aa..9eb9edc 100644
+index 8b6cfd6..ec809a6 100644
 --- a/mm/internal.h
 +++ b/mm/internal.h
-@@ -97,6 +97,7 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address);
+@@ -96,6 +96,7 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address);
   * in mm/page_alloc.c
   */
  extern void __free_pages_bootmem(struct page *page, unsigned int order);
@@ -90480,7 +90521,7 @@ index 684f7aa..9eb9edc 100644
  extern void prep_compound_page(struct page *page, unsigned long order);
  #ifdef CONFIG_MEMORY_FAILURE
  extern bool is_free_buddy_page(struct page *page);
-@@ -352,7 +353,7 @@ extern u32 hwpoison_filter_enable;
+@@ -351,7 +352,7 @@ extern u32 hwpoison_filter_enable;
  
  extern unsigned long vm_mmap_pgoff(struct file *, unsigned long,
          unsigned long, unsigned long,
@@ -90614,7 +90655,7 @@ index 539eeb9..e24a987 100644
  	if (end == start)
  		return error;
 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
-index fabe550..f31b51c 100644
+index 6420be5..b7b7c8f 100644
 --- a/mm/memory-failure.c
 +++ b/mm/memory-failure.c
 @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
@@ -90644,7 +90685,7 @@ index fabe550..f31b51c 100644
  	{ reserved,	reserved,	"reserved kernel",	me_kernel },
  	/*
  	 * free pages are specially detected outside this table:
-@@ -1063,7 +1063,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+@@ -1060,7 +1060,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  		nr_pages = 1 << compound_order(hpage);
  	else /* normal page or thp */
  		nr_pages = 1;
@@ -90653,7 +90694,7 @@ index fabe550..f31b51c 100644
  
  	/*
  	 * We need/can do nothing about count=0 pages.
-@@ -1093,7 +1093,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+@@ -1090,7 +1090,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  			if (!PageHWPoison(hpage)
  			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
  			    || (p != hpage && TestSetPageHWPoison(hpage))) {
@@ -90662,7 +90703,7 @@ index fabe550..f31b51c 100644
  				return 0;
  			}
  			set_page_hwpoison_huge_page(hpage);
-@@ -1162,7 +1162,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+@@ -1159,7 +1159,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
  	}
  	if (hwpoison_filter(p)) {
  		if (TestClearPageHWPoison(p))
@@ -90671,7 +90712,7 @@ index fabe550..f31b51c 100644
  		unlock_page(hpage);
  		put_page(hpage);
  		return 0;
-@@ -1380,7 +1380,7 @@ int unpoison_memory(unsigned long pfn)
+@@ -1381,7 +1381,7 @@ int unpoison_memory(unsigned long pfn)
  			return 0;
  		}
  		if (TestClearPageHWPoison(p))
@@ -90680,7 +90721,7 @@ index fabe550..f31b51c 100644
  		pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
  		return 0;
  	}
-@@ -1394,7 +1394,7 @@ int unpoison_memory(unsigned long pfn)
+@@ -1395,7 +1395,7 @@ int unpoison_memory(unsigned long pfn)
  	 */
  	if (TestClearPageHWPoison(page)) {
  		pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
@@ -90689,7 +90730,7 @@ index fabe550..f31b51c 100644
  		freeit = 1;
  		if (PageHuge(page))
  			clear_page_hwpoison_huge_page(page);
-@@ -1519,11 +1519,11 @@ static int soft_offline_huge_page(struct page *page, int flags)
+@@ -1520,11 +1520,11 @@ static int soft_offline_huge_page(struct page *page, int flags)
  		if (PageHuge(page)) {
  			set_page_hwpoison_huge_page(hpage);
  			dequeue_hwpoisoned_huge_page(hpage);
@@ -90703,7 +90744,7 @@ index fabe550..f31b51c 100644
  		}
  	}
  	return ret;
-@@ -1562,7 +1562,7 @@ static int __soft_offline_page(struct page *page, int flags)
+@@ -1563,7 +1563,7 @@ static int __soft_offline_page(struct page *page, int flags)
  		put_page(page);
  		pr_info("soft_offline: %#lx: invalidated\n", pfn);
  		SetPageHWPoison(page);
@@ -90712,7 +90753,7 @@ index fabe550..f31b51c 100644
  		return 0;
  	}
  
-@@ -1607,7 +1607,7 @@ static int __soft_offline_page(struct page *page, int flags)
+@@ -1608,7 +1608,7 @@ static int __soft_offline_page(struct page *page, int flags)
  			if (!is_free_buddy_page(page))
  				pr_info("soft offline: %#lx: page leaked\n",
  					pfn);
@@ -90721,7 +90762,7 @@ index fabe550..f31b51c 100644
  		}
  	} else {
  		pr_info("soft offline: %#lx: isolation failed: %d, page count %d, type %lx\n",
-@@ -1681,11 +1681,11 @@ int soft_offline_page(struct page *page, int flags)
+@@ -1682,11 +1682,11 @@ int soft_offline_page(struct page *page, int flags)
  		if (PageHuge(page)) {
  			set_page_hwpoison_huge_page(hpage);
  			dequeue_hwpoisoned_huge_page(hpage);
@@ -91431,7 +91472,7 @@ index 6768ce9..4c41d69 100644
  	mm = get_task_mm(tsk);
  	if (!mm)
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index e1bd997..055f496 100644
+index cb2f3dd..fb80468 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -747,6 +747,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -91592,7 +91633,7 @@ index 192e6ee..b044449 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index 834b2d7..650d1b9 100644
+index 546db74..650d1b9 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -36,6 +36,7 @@
@@ -91673,24 +91714,7 @@ index 834b2d7..650d1b9 100644
  	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
  			(mm->end_data - mm->start_data) > rlim)
  		goto out;
-@@ -893,7 +916,15 @@ again:			remove_next = 1 + (end > next->vm_end);
- static inline int is_mergeable_vma(struct vm_area_struct *vma,
- 			struct file *file, unsigned long vm_flags)
- {
--	if (vma->vm_flags ^ vm_flags)
-+	/*
-+	 * VM_SOFTDIRTY should not prevent from VMA merging, if we
-+	 * match the flags but dirty bit -- the caller should mark
-+	 * merged VMA as dirty. If dirty bit won't be excluded from
-+	 * comparison, we increase pressue on the memory system forcing
-+	 * the kernel to generate new VMAs when old one could be
-+	 * extended instead.
-+	 */
-+	if ((vma->vm_flags ^ vm_flags) & ~VM_SOFTDIRTY)
- 		return 0;
- 	if (vma->vm_file != file)
- 		return 0;
-@@ -931,6 +962,12 @@ static int
+@@ -939,6 +962,12 @@ static int
  can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
  	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
  {
@@ -91703,7 +91727,7 @@ index 834b2d7..650d1b9 100644
  	if (is_mergeable_vma(vma, file, vm_flags) &&
  	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
  		if (vma->vm_pgoff == vm_pgoff)
-@@ -950,6 +987,12 @@ static int
+@@ -958,6 +987,12 @@ static int
  can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
  	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
  {
@@ -91716,7 +91740,7 @@ index 834b2d7..650d1b9 100644
  	if (is_mergeable_vma(vma, file, vm_flags) &&
  	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
  		pgoff_t vm_pglen;
-@@ -992,13 +1035,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+@@ -1000,13 +1035,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
  struct vm_area_struct *vma_merge(struct mm_struct *mm,
  			struct vm_area_struct *prev, unsigned long addr,
  			unsigned long end, unsigned long vm_flags,
@@ -91738,7 +91762,7 @@ index 834b2d7..650d1b9 100644
  	/*
  	 * We later require that vma->vm_flags == vm_flags,
  	 * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -1014,6 +1064,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1022,6 +1064,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
  		next = next->vm_next;
  
@@ -91754,7 +91778,7 @@ index 834b2d7..650d1b9 100644
  	/*
  	 * Can it merge with the predecessor?
  	 */
-@@ -1033,9 +1092,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1041,9 +1092,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  							/* cases 1, 6 */
  			err = vma_adjust(prev, prev->vm_start,
  				next->vm_end, prev->vm_pgoff, NULL);
@@ -91780,7 +91804,7 @@ index 834b2d7..650d1b9 100644
  		if (err)
  			return NULL;
  		khugepaged_enter_vma_merge(prev);
-@@ -1049,12 +1123,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1057,12 +1123,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
   			mpol_equal(policy, vma_policy(next)) &&
  			can_vma_merge_before(next, vm_flags,
  					anon_vma, file, pgoff+pglen)) {
@@ -91810,16 +91834,7 @@ index 834b2d7..650d1b9 100644
  		if (err)
  			return NULL;
  		khugepaged_enter_vma_merge(area);
-@@ -1082,7 +1171,7 @@ static int anon_vma_compatible(struct vm_area_struct *a, struct vm_area_struct *
- 	return a->vm_end == b->vm_start &&
- 		mpol_equal(vma_policy(a), vma_policy(b)) &&
- 		a->vm_file == b->vm_file &&
--		!((a->vm_flags ^ b->vm_flags) & ~(VM_READ|VM_WRITE|VM_EXEC)) &&
-+		!((a->vm_flags ^ b->vm_flags) & ~(VM_READ|VM_WRITE|VM_EXEC|VM_SOFTDIRTY)) &&
- 		b->vm_pgoff == a->vm_pgoff + ((b->vm_start - a->vm_start) >> PAGE_SHIFT);
- }
- 
-@@ -1163,8 +1252,10 @@ none:
+@@ -1171,8 +1252,10 @@ none:
  void vm_stat_account(struct mm_struct *mm, unsigned long flags,
  						struct file *file, long pages)
  {
@@ -91832,7 +91847,7 @@ index 834b2d7..650d1b9 100644
  
  	mm->total_vm += pages;
  
-@@ -1172,7 +1263,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+@@ -1180,7 +1263,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
  		mm->shared_vm += pages;
  		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
  			mm->exec_vm += pages;
@@ -91841,7 +91856,7 @@ index 834b2d7..650d1b9 100644
  		mm->stack_vm += pages;
  }
  #endif /* CONFIG_PROC_FS */
-@@ -1210,7 +1301,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1218,7 +1301,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	 * (the exception is when the underlying filesystem is noexec
  	 *  mounted, in which case we dont add PROT_EXEC.)
  	 */
@@ -91850,7 +91865,7 @@ index 834b2d7..650d1b9 100644
  		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
  			prot |= PROT_EXEC;
  
-@@ -1236,7 +1327,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1244,7 +1327,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	/* Obtain the address to map to. we verify (or select) it and ensure
  	 * that it represents a valid section of the address space.
  	 */
@@ -91859,7 +91874,7 @@ index 834b2d7..650d1b9 100644
  	if (addr & ~PAGE_MASK)
  		return addr;
  
-@@ -1247,6 +1338,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1255,6 +1338,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
  			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
  
@@ -91903,7 +91918,7 @@ index 834b2d7..650d1b9 100644
  	if (flags & MAP_LOCKED)
  		if (!can_do_mlock())
  			return -EPERM;
-@@ -1258,6 +1386,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1266,6 +1386,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
@@ -91911,7 +91926,7 @@ index 834b2d7..650d1b9 100644
  		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
  			return -EAGAIN;
  	}
-@@ -1342,6 +1471,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1350,6 +1471,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  			vm_flags |= VM_NORESERVE;
  	}
  
@@ -91921,7 +91936,7 @@ index 834b2d7..650d1b9 100644
  	addr = mmap_region(file, addr, len, vm_flags, pgoff);
  	if (!IS_ERR_VALUE(addr) &&
  	    ((vm_flags & VM_LOCKED) ||
-@@ -1435,7 +1567,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
+@@ -1443,7 +1567,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
  	vm_flags_t vm_flags = vma->vm_flags;
  
  	/* If it was private or non-writable, the write bit is already clear */
@@ -91930,7 +91945,7 @@ index 834b2d7..650d1b9 100644
  		return 0;
  
  	/* The backer wishes to know when pages are first written to? */
-@@ -1481,7 +1613,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1489,7 +1613,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  	struct rb_node **rb_link, *rb_parent;
  	unsigned long charged = 0;
  
@@ -91953,7 +91968,7 @@ index 834b2d7..650d1b9 100644
  	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
  		unsigned long nr_pages;
  
-@@ -1500,11 +1647,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1508,11 +1647,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  
  	/* Clear old maps */
  	error = -ENOMEM;
@@ -91966,7 +91981,7 @@ index 834b2d7..650d1b9 100644
  	}
  
  	/*
-@@ -1535,6 +1681,16 @@ munmap_back:
+@@ -1543,6 +1681,16 @@ munmap_back:
  		goto unacct_error;
  	}
  
@@ -91983,7 +91998,7 @@ index 834b2d7..650d1b9 100644
  	vma->vm_mm = mm;
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
-@@ -1554,6 +1710,13 @@ munmap_back:
+@@ -1562,6 +1710,13 @@ munmap_back:
  		if (error)
  			goto unmap_and_free_vma;
  
@@ -91997,7 +92012,7 @@ index 834b2d7..650d1b9 100644
  		/* Can addr have changed??
  		 *
  		 * Answer: Yes, several device drivers can do it in their
-@@ -1587,6 +1750,12 @@ munmap_back:
+@@ -1595,6 +1750,12 @@ munmap_back:
  	}
  
  	vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -92010,7 +92025,7 @@ index 834b2d7..650d1b9 100644
  	/* Once vma denies write, undo our temporary denial count */
  	if (vm_flags & VM_DENYWRITE)
  		allow_write_access(file);
-@@ -1595,6 +1764,7 @@ out:
+@@ -1603,6 +1764,7 @@ out:
  	perf_event_mmap(vma);
  
  	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
@@ -92018,7 +92033,7 @@ index 834b2d7..650d1b9 100644
  	if (vm_flags & VM_LOCKED) {
  		if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
  					vma == get_gate_vma(current->mm)))
-@@ -1627,6 +1797,12 @@ unmap_and_free_vma:
+@@ -1635,6 +1797,12 @@ unmap_and_free_vma:
  	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
  	charged = 0;
  free_vma:
@@ -92031,7 +92046,7 @@ index 834b2d7..650d1b9 100644
  	kmem_cache_free(vm_area_cachep, vma);
  unacct_error:
  	if (charged)
-@@ -1634,7 +1810,63 @@ unacct_error:
+@@ -1642,7 +1810,63 @@ unacct_error:
  	return error;
  }
  
@@ -92096,7 +92111,7 @@ index 834b2d7..650d1b9 100644
  {
  	/*
  	 * We implement the search by looking for an rbtree node that
-@@ -1682,11 +1914,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+@@ -1690,11 +1914,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
  			}
  		}
  
@@ -92127,7 +92142,7 @@ index 834b2d7..650d1b9 100644
  		if (gap_end >= low_limit && gap_end - gap_start >= length)
  			goto found;
  
-@@ -1736,7 +1986,7 @@ found:
+@@ -1744,7 +1986,7 @@ found:
  	return gap_start;
  }
  
@@ -92136,7 +92151,7 @@ index 834b2d7..650d1b9 100644
  {
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
-@@ -1790,6 +2040,24 @@ check_current:
+@@ -1798,6 +2040,24 @@ check_current:
  		gap_end = vma->vm_start;
  		if (gap_end < low_limit)
  			return -ENOMEM;
@@ -92161,7 +92176,7 @@ index 834b2d7..650d1b9 100644
  		if (gap_start <= high_limit && gap_end - gap_start >= length)
  			goto found;
  
-@@ -1853,6 +2121,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1861,6 +2121,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
  	struct vm_unmapped_area_info info;
@@ -92169,7 +92184,7 @@ index 834b2d7..650d1b9 100644
  
  	if (len > TASK_SIZE - mmap_min_addr)
  		return -ENOMEM;
-@@ -1860,11 +2129,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1868,11 +2129,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -92186,7 +92201,7 @@ index 834b2d7..650d1b9 100644
  			return addr;
  	}
  
-@@ -1873,6 +2146,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1881,6 +2146,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	info.low_limit = mm->mmap_base;
  	info.high_limit = TASK_SIZE;
  	info.align_mask = 0;
@@ -92194,7 +92209,7 @@ index 834b2d7..650d1b9 100644
  	return vm_unmapped_area(&info);
  }
  #endif	
-@@ -1891,6 +2165,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1899,6 +2165,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	struct mm_struct *mm = current->mm;
  	unsigned long addr = addr0;
  	struct vm_unmapped_area_info info;
@@ -92202,7 +92217,7 @@ index 834b2d7..650d1b9 100644
  
  	/* requested length too big for entire address space */
  	if (len > TASK_SIZE - mmap_min_addr)
-@@ -1899,12 +2174,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1907,12 +2174,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -92220,7 +92235,7 @@ index 834b2d7..650d1b9 100644
  			return addr;
  	}
  
-@@ -1913,6 +2192,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1921,6 +2192,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
  	info.high_limit = mm->mmap_base;
  	info.align_mask = 0;
@@ -92228,7 +92243,7 @@ index 834b2d7..650d1b9 100644
  	addr = vm_unmapped_area(&info);
  
  	/*
-@@ -1925,6 +2205,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1933,6 +2205,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  		VM_BUG_ON(addr != -ENOMEM);
  		info.flags = 0;
  		info.low_limit = TASK_UNMAPPED_BASE;
@@ -92241,7 +92256,7 @@ index 834b2d7..650d1b9 100644
  		info.high_limit = TASK_SIZE;
  		addr = vm_unmapped_area(&info);
  	}
-@@ -2026,6 +2312,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+@@ -2034,6 +2312,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
  	return vma;
  }
  
@@ -92270,7 +92285,7 @@ index 834b2d7..650d1b9 100644
  /*
   * Verify that the stack growth is acceptable and
   * update accounting. This is shared with both the
-@@ -2042,6 +2350,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2050,6 +2350,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		return -ENOMEM;
  
  	/* Stack limit test */
@@ -92278,7 +92293,7 @@ index 834b2d7..650d1b9 100644
  	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
  		return -ENOMEM;
  
-@@ -2052,6 +2361,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2060,6 +2361,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		locked = mm->locked_vm + grow;
  		limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
  		limit >>= PAGE_SHIFT;
@@ -92286,7 +92301,7 @@ index 834b2d7..650d1b9 100644
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -2081,37 +2391,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2089,37 +2391,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -92344,7 +92359,7 @@ index 834b2d7..650d1b9 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -2146,6 +2467,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2154,6 +2467,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  			}
  		}
  	}
@@ -92353,7 +92368,7 @@ index 834b2d7..650d1b9 100644
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma);
  	validate_mm(vma->vm_mm);
-@@ -2160,6 +2483,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2168,6 +2483,8 @@ int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -92362,7 +92377,7 @@ index 834b2d7..650d1b9 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -2173,6 +2498,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2181,6 +2498,15 @@ int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -92378,7 +92393,7 @@ index 834b2d7..650d1b9 100644
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -2182,9 +2516,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2190,9 +2516,17 @@ int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -92397,7 +92412,7 @@ index 834b2d7..650d1b9 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -2209,13 +2551,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2217,13 +2551,27 @@ int expand_downwards(struct vm_area_struct *vma,
  				vma->vm_pgoff -= grow;
  				anon_vma_interval_tree_post_update_vma(vma);
  				vma_gap_update(vma);
@@ -92425,7 +92440,7 @@ index 834b2d7..650d1b9 100644
  	khugepaged_enter_vma_merge(vma);
  	validate_mm(vma->vm_mm);
  	return error;
-@@ -2313,6 +2669,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2321,6 +2669,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -92439,7 +92454,7 @@ index 834b2d7..650d1b9 100644
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2357,6 +2720,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2365,6 +2720,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -92456,7 +92471,7 @@ index 834b2d7..650d1b9 100644
  		vma_rb_erase(vma, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -2382,14 +2755,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2390,14 +2755,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -92490,7 +92505,7 @@ index 834b2d7..650d1b9 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -2402,6 +2794,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2410,6 +2794,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -92513,7 +92528,7 @@ index 834b2d7..650d1b9 100644
  	err = vma_dup_policy(vma, new);
  	if (err)
  		goto out_free_vma;
-@@ -2421,6 +2829,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2429,6 +2829,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -92552,7 +92567,7 @@ index 834b2d7..650d1b9 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -2430,10 +2870,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2438,10 +2870,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_ops->close(new);
  	if (new->vm_file)
  		fput(new->vm_file);
@@ -92572,7 +92587,7 @@ index 834b2d7..650d1b9 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2446,6 +2894,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2454,6 +2894,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -92588,7 +92603,7 @@ index 834b2d7..650d1b9 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2457,11 +2914,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2465,11 +2914,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -92619,7 +92634,7 @@ index 834b2d7..650d1b9 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2536,6 +3012,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2544,6 +3012,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -92628,7 +92643,7 @@ index 834b2d7..650d1b9 100644
  	return 0;
  }
  
-@@ -2544,6 +3022,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2552,6 +3022,13 @@ int vm_munmap(unsigned long start, size_t len)
  	int ret;
  	struct mm_struct *mm = current->mm;
  
@@ -92642,7 +92657,7 @@ index 834b2d7..650d1b9 100644
  	down_write(&mm->mmap_sem);
  	ret = do_munmap(mm, start, len);
  	up_write(&mm->mmap_sem);
-@@ -2557,16 +3042,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2565,16 +3042,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  	return vm_munmap(addr, len);
  }
  
@@ -92659,7 +92674,7 @@ index 834b2d7..650d1b9 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2580,6 +3055,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2588,6 +3055,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -92667,7 +92682,7 @@ index 834b2d7..650d1b9 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2587,16 +3063,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2595,16 +3063,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -92699,7 +92714,7 @@ index 834b2d7..650d1b9 100644
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-@@ -2613,21 +3103,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2621,21 +3103,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -92724,7 +92739,7 @@ index 834b2d7..650d1b9 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2641,7 +3130,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2649,7 +3130,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -92733,7 +92748,7 @@ index 834b2d7..650d1b9 100644
  		return -ENOMEM;
  	}
  
-@@ -2655,10 +3144,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2663,10 +3144,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -92747,7 +92762,7 @@ index 834b2d7..650d1b9 100644
  	return addr;
  }
  
-@@ -2720,6 +3210,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2728,6 +3210,7 @@ void exit_mmap(struct mm_struct *mm)
  	while (vma) {
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += vma_pages(vma);
@@ -92755,7 +92770,7 @@ index 834b2d7..650d1b9 100644
  		vma = remove_vma(vma);
  	}
  	vm_unacct_memory(nr_accounted);
-@@ -2737,6 +3228,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2745,6 +3228,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	struct vm_area_struct *prev;
  	struct rb_node **rb_link, *rb_parent;
  
@@ -92769,7 +92784,7 @@ index 834b2d7..650d1b9 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2760,7 +3258,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2768,7 +3258,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
  
@@ -92791,7 +92806,7 @@ index 834b2d7..650d1b9 100644
  	return 0;
  }
  
-@@ -2779,6 +3291,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2787,6 +3291,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	bool faulted_in_anon_vma = true;
  
@@ -92800,7 +92815,7 @@ index 834b2d7..650d1b9 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2843,6 +3357,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2851,6 +3357,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -92840,7 +92855,7 @@ index 834b2d7..650d1b9 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2854,6 +3401,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2862,6 +3401,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
@@ -92848,7 +92863,7 @@ index 834b2d7..650d1b9 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2924,6 +3472,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2932,6 +3472,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -93278,10 +93293,10 @@ index fec093a..8162f74 100644
  	struct mm_struct *mm;
  
 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 6380758..4064aec 100644
+index 2d30e2c..8b3d14c 100644
 --- a/mm/page-writeback.c
 +++ b/mm/page-writeback.c
-@@ -690,7 +690,7 @@ static inline long long pos_ratio_polynom(unsigned long setpoint,
+@@ -685,7 +685,7 @@ static inline long long pos_ratio_polynom(unsigned long setpoint,
   *   card's bdi_dirty may rush to many times higher than bdi_setpoint.
   * - the bdi dirty thresh drops quickly due to change of JBOD workload
   */
@@ -94368,7 +94383,7 @@ index 4bf8809..98a6914 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 545a170..a086226 100644
+index 89490d9..c7b226a 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -207,7 +207,7 @@ struct track {
@@ -94542,7 +94557,7 @@ index 545a170..a086226 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4486,7 +4551,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4492,7 +4557,7 @@ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
  {
@@ -94551,7 +94566,7 @@ index 545a170..a086226 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -4574,6 +4639,14 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
+@@ -4580,6 +4645,14 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
  SLAB_ATTR_RO(cache_dma);
  #endif
  
@@ -94566,7 +94581,7 @@ index 545a170..a086226 100644
  static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
  {
  	return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
-@@ -4908,6 +4981,9 @@ static struct attribute *slab_attrs[] = {
+@@ -4914,6 +4987,9 @@ static struct attribute *slab_attrs[] = {
  #ifdef CONFIG_ZONE_DMA
  	&cache_dma_attr.attr,
  #endif
@@ -94576,7 +94591,7 @@ index 545a170..a086226 100644
  #ifdef CONFIG_NUMA
  	&remote_node_defrag_ratio_attr.attr,
  #endif
-@@ -5140,6 +5216,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5146,6 +5222,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -94584,7 +94599,7 @@ index 545a170..a086226 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5163,7 +5240,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
+@@ -5169,7 +5246,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
  	}
  
  	s->kobj.kset = slab_kset;
@@ -94593,7 +94608,7 @@ index 545a170..a086226 100644
  	if (err) {
  		kobject_put(&s->kobj);
  		return err;
-@@ -5197,6 +5274,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5203,6 +5280,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -94601,7 +94616,7 @@ index 545a170..a086226 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5210,6 +5288,7 @@ struct saved_alias {
+@@ -5216,6 +5294,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -94609,7 +94624,7 @@ index 545a170..a086226 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5232,6 +5311,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5238,6 +5317,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -95106,6 +95121,22 @@ index 9321a77..ed2f256 100644
  	set_fs(oldfs);
  
  	if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 9c5a1aa..3c6c637 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -340,7 +340,10 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
+ 		int count = nr_pages;
+ 		while (nr_pages) {
+ 			s = rest_of_page(data);
+-			pages[index++] = kmap_to_page(data);
++			if (is_vmalloc_addr(data))
++				pages[index++] = vmalloc_to_page(data);
++			else
++				pages[index++] = kmap_to_page(data);
+ 			data += s;
+ 			nr_pages--;
+ 		}
 diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
 index 876fbe8..8bbea9f 100644
 --- a/net/atm/atm_misc.c
@@ -96165,10 +96196,10 @@ index b442e7e..6f5b5a2 100644
  	{
  		struct socket *sock;
 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 06e72d3..19dfa7b 100644
+index 0b5149c..24e9976 100644
 --- a/net/core/skbuff.c
 +++ b/net/core/skbuff.c
-@@ -2034,7 +2034,7 @@ EXPORT_SYMBOL(__skb_checksum);
+@@ -2004,7 +2004,7 @@ EXPORT_SYMBOL(__skb_checksum);
  __wsum skb_checksum(const struct sk_buff *skb, int offset,
  		    int len, __wsum csum)
  {
@@ -96177,7 +96208,7 @@ index 06e72d3..19dfa7b 100644
  		.update  = csum_partial_ext,
  		.combine = csum_block_add_ext,
  	};
-@@ -3147,13 +3147,15 @@ void __init skb_init(void)
+@@ -3117,13 +3117,15 @@ void __init skb_init(void)
  	skbuff_head_cache = kmem_cache_create("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
@@ -100440,7 +100471,7 @@ index e83c416..1094d88 100644
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
 diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
-index 008cdad..6f17474 100644
+index 1b94a9c..496f7f5 100644
 --- a/net/sunrpc/auth_gss/svcauth_gss.c
 +++ b/net/sunrpc/auth_gss/svcauth_gss.c
 @@ -1140,7 +1140,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
@@ -100462,7 +100493,7 @@ index 008cdad..6f17474 100644
  	/* make a copy for the caller */
  	*handle = ctxh;
 diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index f09b7db..393c39e 100644
+index e726e16..393c39e 100644
 --- a/net/sunrpc/clnt.c
 +++ b/net/sunrpc/clnt.c
 @@ -1415,7 +1415,9 @@ call_start(struct rpc_task *task)
@@ -100476,22 +100507,6 @@ index f09b7db..393c39e 100644
  	clnt->cl_stats->rpccnt++;
  	task->tk_action = call_reserve;
  }
-@@ -1529,9 +1531,13 @@ call_refreshresult(struct rpc_task *task)
- 	task->tk_action = call_refresh;
- 	switch (status) {
- 	case 0:
--		if (rpcauth_uptodatecred(task))
-+		if (rpcauth_uptodatecred(task)) {
- 			task->tk_action = call_allocate;
--		return;
-+			return;
-+		}
-+		/* Use rate-limiting and a max number of retries if refresh
-+		 * had status 0 but failed to update the cred.
-+		 */
- 	case -ETIMEDOUT:
- 		rpc_delay(task, 3*HZ);
- 	case -EAGAIN:
 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
 index ff3cc4b..7612a9e 100644
 --- a/net/sunrpc/sched.c
@@ -103852,7 +103867,7 @@ index 0000000..4c2c45c
 +size_overflow_hash.h
 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
 new file mode 100644
-index 0000000..0d1d9d3
+index 0000000..b198b6d
 --- /dev/null
 +++ b/tools/gcc/Makefile
 @@ -0,0 +1,54 @@
@@ -103867,7 +103882,7 @@ index 0000000..0d1d9d3
 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu99 -ggdb
 +else
 +HOSTLIBS := hostcxxlibs
-+HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu++98 -fno-rtti -ggdb -Wno-unused-parameter
++HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu++98 -fno-rtti -ggdb -Wno-unused-parameter -Wno-narrowing
 +endif
 +
 +$(HOSTLIBS)-$(CONFIG_PAX_CONSTIFY_PLUGIN) := constify_plugin.so
@@ -105902,10 +105917,10 @@ index 0000000..dd73713
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..592b923
+index 0000000..515d689
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,325 @@
+@@ -0,0 +1,337 @@
 +/*
 + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -105934,7 +105949,7 @@ index 0000000..592b923
 +static tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201401260140",
++	.version	= "201402131900",
 +	.help		= NULL
 +};
 +
@@ -106131,7 +106146,7 @@ index 0000000..592b923
 +	return 0;
 +}
 +
-+static void start_unit_callback(void *gcc_data, void *user_data)
++static void latent_entropy_start_unit(void *gcc_data, void *user_data)
 +{
 +	tree latent_entropy_type;
 +
@@ -106218,6 +106233,16 @@ index 0000000..592b923
 +	latent_entropy_pass_info.reference_pass_name		= "optimized";
 +	latent_entropy_pass_info.ref_pass_instance_number	= 1;
 +	latent_entropy_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++	static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = {
++		{
++			.base = &latent_entropy_decl,
++			.nelt = 1,
++			.stride = sizeof(latent_entropy_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
 +	if (!plugin_default_version_check(version, &gcc_version)) {
 +		error(G_("incompatible gcc/plugin versions"));
@@ -106225,7 +106250,9 @@ index 0000000..592b923
 +	}
 +
 +	register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
-+	register_callback(plugin_name, PLUGIN_START_UNIT, &start_unit_callback, NULL);
++	register_callback(plugin_name, PLUGIN_START_UNIT, &latent_entropy_start_unit, NULL);
++	if (!in_lto_p)
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_latent_entropy);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
 +	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
@@ -106233,10 +106260,10 @@ index 0000000..592b923
 +}
 diff --git a/tools/gcc/randomize_layout_plugin.c b/tools/gcc/randomize_layout_plugin.c
 new file mode 100644
-index 0000000..fed12bf
+index 0000000..bc490ca
 --- /dev/null
 +++ b/tools/gcc/randomize_layout_plugin.c
-@@ -0,0 +1,902 @@
+@@ -0,0 +1,906 @@
 +/*
 + * Copyright 2014 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net>
 + *                   and PaX Team <pageexec@freemail.hu>
@@ -106253,6 +106280,10 @@ index 0000000..fed12bf
 +#include "gcc-common.h"
 +#include "randomize_layout_seed.h"
 +
++#if BUILDING_GCC_MAJOR < 4 || BUILDING_GCC_MINOR < 6 || (BUILDING_GCC_MINOR == 6 && BUILDING_GCC_PATCHLEVEL < 4)
++#error "The RANDSTRUCT plugin requires GCC 4.6.4 or newer."
++#endif
++
 +#define ORIG_TYPE_NAME(node) \
 +	(TYPE_NAME(TYPE_MAIN_VARIANT(node)) != NULL_TREE ? ((const unsigned char *)IDENTIFIER_POINTER(TYPE_NAME(TYPE_MAIN_VARIANT(node)))) : (const unsigned char *)"anonymous")
 +
@@ -106669,7 +106700,7 @@ index 0000000..fed12bf
 +#endif
 +}
 +
-+static void finish_decl(void *event_data, void *data)
++static void randomize_layout_finish_decl(void *event_data, void *data)
 +{
 +	tree decl = (tree)event_data;
 +	tree type;
@@ -107133,7 +107164,7 @@ index 0000000..fed12bf
 +		register_callback(plugin_name, PLUGIN_ALL_IPA_PASSES_START, check_global_variables, NULL);
 +		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &randomize_layout_bad_cast_info);
 +		register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+		register_callback(plugin_name, PLUGIN_FINISH_DECL, finish_decl, NULL);
++		register_callback(plugin_name, PLUGIN_FINISH_DECL, randomize_layout_finish_decl, NULL);
 +	}
 +	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
@@ -107141,10 +107172,10 @@ index 0000000..fed12bf
 +}
 diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data
 new file mode 100644
-index 0000000..0c980be
+index 0000000..102f0d6
 --- /dev/null
 +++ b/tools/gcc/size_overflow_hash.data
-@@ -0,0 +1,5697 @@
+@@ -0,0 +1,5703 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -107190,6 +107221,7 @@ index 0000000..0c980be
 +start_isoc_chain_565 start_isoc_chain 2 565 NULL nohasharray
 +dev_hard_header_565 dev_hard_header 0 565 &start_isoc_chain_565
 +ocfs2_refcounted_xattr_delete_need_584 ocfs2_refcounted_xattr_delete_need 0 584 NULL
++osl_pktget_590 osl_pktget 2 590 NULL
 +smk_write_load_self2_591 smk_write_load_self2 3 591 NULL
 +btrfs_stack_file_extent_offset_607 btrfs_stack_file_extent_offset 0 607 NULL
 +ni_gpct_device_construct_610 ni_gpct_device_construct 5 610 NULL
@@ -108220,6 +108252,7 @@ index 0000000..0c980be
 +lustre_pack_request_v2_12665 lustre_pack_request_v2 0 12665 NULL
 +sel_read_class_12669 sel_read_class 3 12669 NULL nohasharray
 +sparse_mem_maps_populate_node_12669 sparse_mem_maps_populate_node 4 12669 &sel_read_class_12669
++ext4_writepage_trans_blocks_12674 ext4_writepage_trans_blocks 0 12674 NULL
 +iwl_dbgfs_calib_disabled_write_12707 iwl_dbgfs_calib_disabled_write 3 12707 NULL
 +ieee80211_if_read_num_buffered_multicast_12716 ieee80211_if_read_num_buffered_multicast 3 12716 NULL
 +ivtv_write_12721 ivtv_write 3 12721 NULL
@@ -108489,6 +108522,7 @@ index 0000000..0c980be
 +SyS_connect_15674 SyS_connect 3 15674 &dm_read_15674
 +tracing_snapshot_write_15719 tracing_snapshot_write 3 15719 NULL
 +HiSax_readstatus_15752 HiSax_readstatus 2 15752 NULL
++bio_map_15794 bio_map 3-0 15794 NULL
 +smk_read_direct_15803 smk_read_direct 3 15803 NULL
 +nameseq_list_15817 nameseq_list 3-0 15817 NULL nohasharray
 +gnttab_expand_15817 gnttab_expand 1 15817 &nameseq_list_15817
@@ -111756,6 +111790,7 @@ index 0000000..0c980be
 +ieee80211_if_fmt_fwded_mcast_52961 ieee80211_if_fmt_fwded_mcast 3 52961 NULL
 +tx_tx_exch_read_52986 tx_tx_exch_read 3 52986 NULL
 +num_node_state_52989 num_node_state 0 52989 NULL
++efivarfs_file_write_53000 efivarfs_file_write 3 53000 NULL
 +uasp_alloc_stream_res_53015 uasp_alloc_stream_res 0 53015 NULL
 +btrfs_free_and_pin_reserved_extent_53016 btrfs_free_and_pin_reserved_extent 2 53016 NULL
 +tx_tx_exch_pending_read_53018 tx_tx_exch_pending_read 3 53018 NULL
@@ -111994,6 +112029,7 @@ index 0000000..0c980be
 +dgap_do_config_load_55548 dgap_do_config_load 2 55548 NULL
 +hash_ipport6_expire_55549 hash_ipport6_expire 4 55549 NULL
 +dm_stats_list_55551 dm_stats_list 4 55551 NULL
++__vdev_disk_physio_55568 __vdev_disk_physio 4 55568 NULL
 +add_partition_55588 add_partition 2 55588 NULL
 +kstrtou8_from_user_55599 kstrtou8_from_user 2 55599 NULL
 +SyS_keyctl_55602 SyS_keyctl 4 55602 NULL nohasharray
@@ -112474,6 +112510,7 @@ index 0000000..0c980be
 +vmemmap_alloc_block_buf_61126 vmemmap_alloc_block_buf 1 61126 NULL
 +afs_proc_cells_write_61139 afs_proc_cells_write 3 61139 NULL
 +brcmf_sdio_chip_cr4_exitdl_61143 brcmf_sdio_chip_cr4_exitdl 4 61143 NULL
++osl_malloc_61156 osl_malloc 2 61156 NULL
 +pair_device_61175 pair_device 4 61175 NULL nohasharray
 +event_oom_late_read_61175 event_oom_late_read 3 61175 &pair_device_61175
 +dio_bio_add_page_61178 dio_bio_add_page 0 61178 NULL
@@ -112844,10 +112881,10 @@ index 0000000..0c980be
 +nvme_trans_standard_inquiry_page_65526 nvme_trans_standard_inquiry_page 4 65526 NULL
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..4a637ab
+index 0000000..4aab36f
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,4040 @@
+@@ -0,0 +1,4051 @@
 +/*
 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -112872,7 +112909,7 @@ index 0000000..4a637ab
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20140128",
++	.version	= "20140213",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
@@ -112940,7 +112977,6 @@ index 0000000..4a637ab
 +};
 +
 +static tree report_size_overflow_decl;
-+static const_tree const_char_ptr_type_node;
 +
 +static tree expand(struct pointer_set_t *visited, struct cgraph_node *caller_node, tree lhs);
 +static void set_conditions(struct pointer_set_t *visited, bool *interesting_conditions, const_tree lhs);
@@ -116713,8 +116749,9 @@ index 0000000..4a637ab
 +}
 +
 +// Create the noreturn report_size_overflow() function decl.
-+static void start_unit_callback(void __unused *gcc_data, void __unused *user_data)
++static void size_overflow_start_unit(void __unused *gcc_data, void __unused *user_data)
 +{
++	tree const_char_ptr_type_node;
 +	tree fntype;
 +
 +	const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
@@ -116842,6 +116879,16 @@ index 0000000..4a637ab
 +	struct register_pass_info __unused dump_before_pass_info;
 +	struct register_pass_info __unused dump_after_pass_info;
 +	struct register_pass_info ipa_pass_info;
++	static const struct ggc_root_tab gt_ggc_r_gt_size_overflow[] = {
++		{
++			.base = &report_size_overflow_decl,
++			.nelt = 1,
++			.stride = sizeof(report_size_overflow_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
 +	insert_size_overflow_asm_pass_info.pass				= make_insert_size_overflow_asm_pass();
 +	insert_size_overflow_asm_pass_info.reference_pass_name		= "ssa";
@@ -116878,7 +116925,8 @@ index 0000000..4a637ab
 +
 +	register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
 +	if (enable) {
-+		register_callback(plugin_name, PLUGIN_START_UNIT, &start_unit_callback, NULL);
++		register_callback(plugin_name, PLUGIN_START_UNIT, &size_overflow_start_unit, NULL);
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_size_overflow);
 +		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &insert_size_overflow_asm_pass_info);
 +//		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &dump_before_pass_info);
 +		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &ipa_pass_info);
@@ -116890,10 +116938,10 @@ index 0000000..4a637ab
 +}
 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
 new file mode 100644
-index 0000000..a4f816a
+index 0000000..e684c74
 --- /dev/null
 +++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,341 @@
+@@ -0,0 +1,373 @@
 +/*
 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -116921,10 +116969,11 @@ index 0000000..a4f816a
 +static int track_frame_size = -1;
 +static const char track_function[] = "pax_track_stack";
 +static const char check_function[] = "pax_check_alloca";
++static tree track_function_decl, check_function_decl;
 +static bool init_locals;
 +
 +static struct plugin_info stackleak_plugin_info = {
-+	.version	= "201401260140",
++	.version	= "201402131920",
 +	.help		= "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
 +//			  "initialize-locals\t\tforcibly initialize all stack frames\n"
 +};
@@ -116932,29 +116981,20 @@ index 0000000..a4f816a
 +static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
 +{
 +	gimple check_alloca;
-+	tree fntype, fndecl, alloca_size;
-+
-+	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
-+	fndecl = build_fn_decl(check_function, fntype);
-+	DECL_ASSEMBLER_NAME(fndecl); // for LTO
++	tree alloca_size;
 +
 +	// insert call to void pax_check_alloca(unsigned long size)
 +	alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
-+	check_alloca = gimple_build_call(fndecl, 1, alloca_size);
++	check_alloca = gimple_build_call(check_function_decl, 1, alloca_size);
 +	gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
 +}
 +
 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
 +{
 +	gimple track_stack;
-+	tree fntype, fndecl;
-+
-+	fntype = build_function_type_list(void_type_node, NULL_TREE);
-+	fndecl = build_fn_decl(track_function, fntype);
-+	DECL_ASSEMBLER_NAME(fndecl); // for LTO
 +
 +	// insert call to void pax_track_stack(void)
-+	track_stack = gimple_build_call(fndecl, 0);
++	track_stack = gimple_build_call(track_function_decl, 0);
 +	gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
 +}
 +
@@ -117081,6 +117121,27 @@ index 0000000..a4f816a
 +	return track_frame_size >= 0;
 +}
 +
++static void stackleak_start_unit(void *gcc_data, void *user_data)
++{
++	tree fntype;
++
++	// void pax_track_stack(void)
++	fntype = build_function_type_list(void_type_node, NULL_TREE);
++	track_function_decl = build_fn_decl(track_function, fntype);
++	DECL_ASSEMBLER_NAME(track_function_decl); // for LTO
++	TREE_PUBLIC(track_function_decl) = 1;
++	DECL_EXTERNAL(track_function_decl) = 1;
++	DECL_ARTIFICIAL(track_function_decl) = 1;
++
++	// void pax_check_alloca(unsigned long)
++	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
++	check_function_decl = build_fn_decl(check_function, fntype);
++	DECL_ASSEMBLER_NAME(check_function_decl); // for LTO
++	TREE_PUBLIC(check_function_decl) = 1;
++	DECL_EXTERNAL(check_function_decl) = 1;
++	DECL_ARTIFICIAL(check_function_decl) = 1;
++}
++
 +#if BUILDING_GCC_VERSION >= 4009
 +static const struct pass_data stackleak_tree_instrument_pass_data = {
 +#else
@@ -117189,6 +117250,23 @@ index 0000000..a4f816a
 +	int i;
 +	struct register_pass_info stackleak_tree_instrument_pass_info;
 +	struct register_pass_info stackleak_final_pass_info;
++	static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
++		{
++			.base = &track_function_decl,
++			.nelt = 1,
++			.stride = sizeof(track_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		{
++			.base = &check_function_decl,
++			.nelt = 1,
++			.stride = sizeof(check_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
 +	stackleak_tree_instrument_pass_info.pass			= make_stackleak_tree_instrument_pass();
 +//	stackleak_tree_instrument_pass_info.reference_pass_name		= "tree_profile";
@@ -117230,6 +117308,8 @@ index 0000000..a4f816a
 +		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
 +	}
 +
++	register_callback(plugin_name, PLUGIN_START_UNIT, &stackleak_start_unit, NULL);
++	register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_stackleak);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
 +
diff --git a/3.13.2/4425_grsec_remove_EI_PAX.patch b/3.13.3/4425_grsec_remove_EI_PAX.patch
index fc51f79..fc51f79 100644
--- a/3.13.2/4425_grsec_remove_EI_PAX.patch
+++ b/3.13.3/4425_grsec_remove_EI_PAX.patch
diff --git a/3.13.2/4427_force_XATTR_PAX_tmpfs.patch b/3.13.3/4427_force_XATTR_PAX_tmpfs.patch
index 23e60cd..23e60cd 100644
--- a/3.13.2/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.13.3/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.13.2/4430_grsec-remove-localversion-grsec.patch b/3.13.3/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.13.2/4430_grsec-remove-localversion-grsec.patch
+++ b/3.13.3/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.13.2/4435_grsec-mute-warnings.patch b/3.13.3/4435_grsec-mute-warnings.patch
index cb51a05..cb51a05 100644
--- a/3.13.2/4435_grsec-mute-warnings.patch
+++ b/3.13.3/4435_grsec-mute-warnings.patch
diff --git a/3.13.2/4440_grsec-remove-protected-paths.patch b/3.13.3/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.13.2/4440_grsec-remove-protected-paths.patch
+++ b/3.13.3/4440_grsec-remove-protected-paths.patch
diff --git a/3.13.2/4450_grsec-kconfig-default-gids.patch b/3.13.3/4450_grsec-kconfig-default-gids.patch
index 88f1f9b..88f1f9b 100644
--- a/3.13.2/4450_grsec-kconfig-default-gids.patch
+++ b/3.13.3/4450_grsec-kconfig-default-gids.patch
diff --git a/3.13.2/4465_selinux-avc_audit-log-curr_ip.patch b/3.13.3/4465_selinux-avc_audit-log-curr_ip.patch
index 0648169..0648169 100644
--- a/3.13.2/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.13.3/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.13.2/4470_disable-compat_vdso.patch b/3.13.3/4470_disable-compat_vdso.patch
index a25c029..a25c029 100644
--- a/3.13.2/4470_disable-compat_vdso.patch
+++ b/3.13.3/4470_disable-compat_vdso.patch
diff --git a/3.13.2/4475_emutramp_default_on.patch b/3.13.3/4475_emutramp_default_on.patch
index 30f6978..30f6978 100644
--- a/3.13.2/4475_emutramp_default_on.patch
+++ b/3.13.3/4475_emutramp_default_on.patch
diff --git a/3.2.54/0000_README b/3.2.55/0000_README
index b0f9c87..f81409b 100644
--- a/3.2.54/0000_README
+++ b/3.2.55/0000_README
@@ -134,7 +134,11 @@ Patch:	1053_linux-3.2.54.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.54
 
-Patch:	4420_grsecurity-3.0-3.2.54-201402111745.patch
+Patch:	1054_linux-3.2.55.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.55
+
+Patch:	4420_grsecurity-3.0-3.2.55-201402152203.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.54/1021_linux-3.2.22.patch b/3.2.55/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.54/1021_linux-3.2.22.patch
+++ b/3.2.55/1021_linux-3.2.22.patch
diff --git a/3.2.54/1022_linux-3.2.23.patch b/3.2.55/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.54/1022_linux-3.2.23.patch
+++ b/3.2.55/1022_linux-3.2.23.patch
diff --git a/3.2.54/1023_linux-3.2.24.patch b/3.2.55/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.54/1023_linux-3.2.24.patch
+++ b/3.2.55/1023_linux-3.2.24.patch
diff --git a/3.2.54/1024_linux-3.2.25.patch b/3.2.55/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.54/1024_linux-3.2.25.patch
+++ b/3.2.55/1024_linux-3.2.25.patch
diff --git a/3.2.54/1025_linux-3.2.26.patch b/3.2.55/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.54/1025_linux-3.2.26.patch
+++ b/3.2.55/1025_linux-3.2.26.patch
diff --git a/3.2.54/1026_linux-3.2.27.patch b/3.2.55/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.54/1026_linux-3.2.27.patch
+++ b/3.2.55/1026_linux-3.2.27.patch
diff --git a/3.2.54/1027_linux-3.2.28.patch b/3.2.55/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.54/1027_linux-3.2.28.patch
+++ b/3.2.55/1027_linux-3.2.28.patch
diff --git a/3.2.54/1028_linux-3.2.29.patch b/3.2.55/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.54/1028_linux-3.2.29.patch
+++ b/3.2.55/1028_linux-3.2.29.patch
diff --git a/3.2.54/1029_linux-3.2.30.patch b/3.2.55/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.54/1029_linux-3.2.30.patch
+++ b/3.2.55/1029_linux-3.2.30.patch
diff --git a/3.2.54/1030_linux-3.2.31.patch b/3.2.55/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.54/1030_linux-3.2.31.patch
+++ b/3.2.55/1030_linux-3.2.31.patch
diff --git a/3.2.54/1031_linux-3.2.32.patch b/3.2.55/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.54/1031_linux-3.2.32.patch
+++ b/3.2.55/1031_linux-3.2.32.patch
diff --git a/3.2.54/1032_linux-3.2.33.patch b/3.2.55/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.54/1032_linux-3.2.33.patch
+++ b/3.2.55/1032_linux-3.2.33.patch
diff --git a/3.2.54/1033_linux-3.2.34.patch b/3.2.55/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.54/1033_linux-3.2.34.patch
+++ b/3.2.55/1033_linux-3.2.34.patch
diff --git a/3.2.54/1034_linux-3.2.35.patch b/3.2.55/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.54/1034_linux-3.2.35.patch
+++ b/3.2.55/1034_linux-3.2.35.patch
diff --git a/3.2.54/1035_linux-3.2.36.patch b/3.2.55/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.54/1035_linux-3.2.36.patch
+++ b/3.2.55/1035_linux-3.2.36.patch
diff --git a/3.2.54/1036_linux-3.2.37.patch b/3.2.55/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.54/1036_linux-3.2.37.patch
+++ b/3.2.55/1036_linux-3.2.37.patch
diff --git a/3.2.54/1037_linux-3.2.38.patch b/3.2.55/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.54/1037_linux-3.2.38.patch
+++ b/3.2.55/1037_linux-3.2.38.patch
diff --git a/3.2.54/1038_linux-3.2.39.patch b/3.2.55/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.54/1038_linux-3.2.39.patch
+++ b/3.2.55/1038_linux-3.2.39.patch
diff --git a/3.2.54/1039_linux-3.2.40.patch b/3.2.55/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.54/1039_linux-3.2.40.patch
+++ b/3.2.55/1039_linux-3.2.40.patch
diff --git a/3.2.54/1040_linux-3.2.41.patch b/3.2.55/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.54/1040_linux-3.2.41.patch
+++ b/3.2.55/1040_linux-3.2.41.patch
diff --git a/3.2.54/1041_linux-3.2.42.patch b/3.2.55/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.54/1041_linux-3.2.42.patch
+++ b/3.2.55/1041_linux-3.2.42.patch
diff --git a/3.2.54/1042_linux-3.2.43.patch b/3.2.55/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.54/1042_linux-3.2.43.patch
+++ b/3.2.55/1042_linux-3.2.43.patch
diff --git a/3.2.54/1043_linux-3.2.44.patch b/3.2.55/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.54/1043_linux-3.2.44.patch
+++ b/3.2.55/1043_linux-3.2.44.patch
diff --git a/3.2.54/1044_linux-3.2.45.patch b/3.2.55/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.54/1044_linux-3.2.45.patch
+++ b/3.2.55/1044_linux-3.2.45.patch
diff --git a/3.2.54/1045_linux-3.2.46.patch b/3.2.55/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.54/1045_linux-3.2.46.patch
+++ b/3.2.55/1045_linux-3.2.46.patch
diff --git a/3.2.54/1046_linux-3.2.47.patch b/3.2.55/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.54/1046_linux-3.2.47.patch
+++ b/3.2.55/1046_linux-3.2.47.patch
diff --git a/3.2.54/1047_linux-3.2.48.patch b/3.2.55/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.54/1047_linux-3.2.48.patch
+++ b/3.2.55/1047_linux-3.2.48.patch
diff --git a/3.2.54/1048_linux-3.2.49.patch b/3.2.55/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.54/1048_linux-3.2.49.patch
+++ b/3.2.55/1048_linux-3.2.49.patch
diff --git a/3.2.54/1049_linux-3.2.50.patch b/3.2.55/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.54/1049_linux-3.2.50.patch
+++ b/3.2.55/1049_linux-3.2.50.patch
diff --git a/3.2.54/1050_linux-3.2.51.patch b/3.2.55/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.54/1050_linux-3.2.51.patch
+++ b/3.2.55/1050_linux-3.2.51.patch
diff --git a/3.2.54/1051_linux-3.2.52.patch b/3.2.55/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.54/1051_linux-3.2.52.patch
+++ b/3.2.55/1051_linux-3.2.52.patch
diff --git a/3.2.54/1052_linux-3.2.53.patch b/3.2.55/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.54/1052_linux-3.2.53.patch
+++ b/3.2.55/1052_linux-3.2.53.patch
diff --git a/3.2.54/1053_linux-3.2.54.patch b/3.2.55/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.54/1053_linux-3.2.54.patch
+++ b/3.2.55/1053_linux-3.2.54.patch
diff --git a/3.2.55/1054_linux-3.2.55.patch b/3.2.55/1054_linux-3.2.55.patch
new file mode 100644
index 0000000..6071ff5
--- /dev/null
+++ b/3.2.55/1054_linux-3.2.55.patch
@@ -0,0 +1,2495 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 2ba8272..1b196ea 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -1305,6 +1305,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 
+ 			* dump_id: dump IDENTIFY data.
+ 
++			* disable: Disable this device.
++
+ 			If there are multiple matching configurations changing
+ 			the same attribute, the last one is used.
+ 
+diff --git a/Makefile b/Makefile
+index 848be26..538463e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 54
++SUBLEVEL = 55
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 7ac5dfd..d45fd22 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -37,7 +37,13 @@
+ 
+ #include "signal.h"
+ 
+-static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
++static const char *handler[]= {
++	"prefetch abort",
++	"data abort",
++	"address exception",
++	"interrupt",
++	"undefined instruction",
++};
+ 
+ void *vectors_page;
+ 
+diff --git a/arch/arm/mach-footbridge/dc21285-timer.c b/arch/arm/mach-footbridge/dc21285-timer.c
+index 121ad1d..547731b 100644
+--- a/arch/arm/mach-footbridge/dc21285-timer.c
++++ b/arch/arm/mach-footbridge/dc21285-timer.c
+@@ -95,17 +95,14 @@ static struct irqaction footbridge_timer_irq = {
+ static void __init footbridge_timer_init(void)
+ {
+ 	struct clock_event_device *ce = &ckevt_dc21285;
++	unsigned rate = DIV_ROUND_CLOSEST(mem_fclk_21285, 16);
+ 
+-	clocksource_register_hz(&cksrc_dc21285, (mem_fclk_21285 + 8) / 16);
++	clocksource_register_hz(&cksrc_dc21285, rate);
+ 
+ 	setup_irq(ce->irq, &footbridge_timer_irq);
+ 
+-	clockevents_calc_mult_shift(ce, mem_fclk_21285, 5);
+-	ce->max_delta_ns = clockevent_delta2ns(0xffffff, ce);
+-	ce->min_delta_ns = clockevent_delta2ns(0x000004, ce);
+ 	ce->cpumask = cpumask_of(smp_processor_id());
+-
+-	clockevents_register_device(ce);
++	clockevents_config_and_register(ce, rate, 0x4, 0xffffff);
+ }
+ 
+ struct sys_timer footbridge_timer = {
+diff --git a/arch/ia64/kernel/machine_kexec.c b/arch/ia64/kernel/machine_kexec.c
+index 3d3aeef..abd6bad 100644
+--- a/arch/ia64/kernel/machine_kexec.c
++++ b/arch/ia64/kernel/machine_kexec.c
+@@ -157,7 +157,7 @@ void arch_crash_save_vmcoreinfo(void)
+ #endif
+ #ifdef CONFIG_PGTABLE_3
+ 	VMCOREINFO_CONFIG(PGTABLE_3);
+-#elif  CONFIG_PGTABLE_4
++#elif defined(CONFIG_PGTABLE_4)
+ 	VMCOREINFO_CONFIG(PGTABLE_4);
+ #endif
+ }
+diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
+index 8057f4f..da85ad4 100644
+--- a/arch/powerpc/include/asm/exception-64s.h
++++ b/arch/powerpc/include/asm/exception-64s.h
+@@ -163,7 +163,7 @@ do_kvm_##n:								\
+ 	subi	r1,r1,INT_FRAME_SIZE;	/* alloc frame on kernel stack	*/ \
+ 	beq-	1f;							   \
+ 	ld	r1,PACAKSAVE(r13);	/* kernel stack to use		*/ \
+-1:	cmpdi	cr1,r1,0;		/* check if r1 is in userspace	*/ \
++1:	cmpdi	cr1,r1,-INT_FRAME_SIZE;	/* check if r1 is in userspace	*/ \
+ 	blt+	cr1,3f;			/* abort if it is		*/ \
+ 	li	r1,(n);			/* will be reloaded later	*/ \
+ 	sth	r1,PACA_TRAP_SAVE(r13);					   \
+diff --git a/arch/sh/lib/Makefile b/arch/sh/lib/Makefile
+index 7b95f29..3baff31 100644
+--- a/arch/sh/lib/Makefile
++++ b/arch/sh/lib/Makefile
+@@ -6,7 +6,7 @@ lib-y  = delay.o memmove.o memchr.o \
+ 	 checksum.o strlen.o div64.o div64-generic.o
+ 
+ # Extracted from libgcc
+-lib-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
++obj-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
+ 	 ashlsi3.o ashrsi3.o ashiftrt.o lshrsi3.o \
+ 	 udiv_qrnnd.o
+ 
+diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+index 3b8a2d3..ea34253 100644
+--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
++++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+@@ -9,6 +9,7 @@
+ #include <linux/perf_event.h>
+ #include <linux/module.h>
+ #include <linux/pci.h>
++#include <linux/syscore_ops.h>
+ 
+ #include <asm/apic.h>
+ 
+@@ -209,6 +210,18 @@ out:
+ 	return ret;
+ }
+ 
++static void ibs_eilvt_setup(void)
++{
++	/*
++	 * Force LVT offset assignment for family 10h: The offsets are
++	 * not assigned by the BIOS for this family, so the OS is
++	 * responsible for doing it. If the OS assignment fails, fall
++	 * back to BIOS settings and try to setup this.
++	 */
++	if (boot_cpu_data.x86 == 0x10)
++		force_ibs_eilvt_setup();
++}
++
+ static inline int get_ibs_lvt_offset(void)
+ {
+ 	u64 val;
+@@ -244,6 +257,36 @@ static void clear_APIC_ibs(void *dummy)
+ 		setup_APIC_eilvt(offset, 0, APIC_EILVT_MSG_FIX, 1);
+ }
+ 
++#ifdef CONFIG_PM
++
++static int perf_ibs_suspend(void)
++{
++	clear_APIC_ibs(NULL);
++	return 0;
++}
++
++static void perf_ibs_resume(void)
++{
++	ibs_eilvt_setup();
++	setup_APIC_ibs(NULL);
++}
++
++static struct syscore_ops perf_ibs_syscore_ops = {
++	.resume		= perf_ibs_resume,
++	.suspend	= perf_ibs_suspend,
++};
++
++static void perf_ibs_pm_init(void)
++{
++	register_syscore_ops(&perf_ibs_syscore_ops);
++}
++
++#else
++
++static inline void perf_ibs_pm_init(void) { }
++
++#endif
++
+ static int __cpuinit
+ perf_ibs_cpu_notifier(struct notifier_block *self, unsigned long action, void *hcpu)
+ {
+@@ -270,18 +313,12 @@ static __init int amd_ibs_init(void)
+ 	if (!caps)
+ 		return -ENODEV;	/* ibs not supported by the cpu */
+ 
+-	/*
+-	 * Force LVT offset assignment for family 10h: The offsets are
+-	 * not assigned by the BIOS for this family, so the OS is
+-	 * responsible for doing it. If the OS assignment fails, fall
+-	 * back to BIOS settings and try to setup this.
+-	 */
+-	if (boot_cpu_data.x86 == 0x10)
+-		force_ibs_eilvt_setup();
++	ibs_eilvt_setup();
+ 
+ 	if (!ibs_eilvt_valid())
+ 		goto out;
+ 
++	perf_ibs_pm_init();
+ 	get_online_cpus();
+ 	ibs_caps = caps;
+ 	/* make ibs_caps visible to other cpus: */
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index e6fbb94..20061b9 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -582,12 +582,13 @@ void __math_state_restore(struct task_struct *tsk)
+ 	/* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
+ 	   is pending.  Clear the x87 state here by setting it to fixed
+ 	   values. safe_address is a random variable that should be in L1 */
+-	alternative_input(
+-		ASM_NOP8 ASM_NOP2,
+-		"emms\n\t"	  	/* clear stack tags */
+-		"fildl %P[addr]",	/* set F?P to defined value */
+-		X86_FEATURE_FXSAVE_LEAK,
+-		[addr] "m" (safe_address));
++	if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) {
++		asm volatile(
++			"fnclex\n\t"
++			"emms\n\t"
++			"fildl %P[addr]"	/* set F?P to defined value */
++			: : [addr] "m" (safe_address));
++	}
+ 
+ 	/*
+ 	 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 43e7753..757c716 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1278,14 +1278,12 @@ void __kvm_migrate_apic_timer(struct kvm_vcpu *vcpu)
+ void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu)
+ {
+ 	u32 data;
+-	void *vapic;
+ 
+ 	if (!irqchip_in_kernel(vcpu->kvm) || !vcpu->arch.apic->vapic_addr)
+ 		return;
+ 
+-	vapic = kmap_atomic(vcpu->arch.apic->vapic_page, KM_USER0);
+-	data = *(u32 *)(vapic + offset_in_page(vcpu->arch.apic->vapic_addr));
+-	kunmap_atomic(vapic, KM_USER0);
++	kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apic->vapic_cache, &data,
++				sizeof(u32));
+ 
+ 	apic_set_tpr(vcpu->arch.apic, data & 0xff);
+ }
+@@ -1295,7 +1293,6 @@ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu)
+ 	u32 data, tpr;
+ 	int max_irr, max_isr;
+ 	struct kvm_lapic *apic;
+-	void *vapic;
+ 
+ 	if (!irqchip_in_kernel(vcpu->kvm) || !vcpu->arch.apic->vapic_addr)
+ 		return;
+@@ -1310,17 +1307,22 @@ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu)
+ 		max_isr = 0;
+ 	data = (tpr & 0xff) | ((max_isr & 0xf0) << 8) | (max_irr << 24);
+ 
+-	vapic = kmap_atomic(vcpu->arch.apic->vapic_page, KM_USER0);
+-	*(u32 *)(vapic + offset_in_page(vcpu->arch.apic->vapic_addr)) = data;
+-	kunmap_atomic(vapic, KM_USER0);
++	kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.apic->vapic_cache, &data,
++				sizeof(u32));
+ }
+ 
+-void kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr)
++int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr)
+ {
+ 	if (!irqchip_in_kernel(vcpu->kvm))
+-		return;
++		return 0;
++
++	if (vapic_addr && kvm_gfn_to_hva_cache_init(vcpu->kvm,
++					  &vcpu->arch.apic->vapic_cache,
++					  vapic_addr, sizeof(u32)))
++		return -EINVAL;
+ 
+ 	vcpu->arch.apic->vapic_addr = vapic_addr;
++	return 0;
+ }
+ 
+ int kvm_x2apic_msr_write(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
+index 138e8cc..62ae376 100644
+--- a/arch/x86/kvm/lapic.h
++++ b/arch/x86/kvm/lapic.h
+@@ -15,7 +15,7 @@ struct kvm_lapic {
+ 	bool irr_pending;
+ 	void *regs;
+ 	gpa_t vapic_addr;
+-	struct page *vapic_page;
++	struct gfn_to_hva_cache vapic_cache;
+ };
+ int kvm_create_lapic(struct kvm_vcpu *vcpu);
+ void kvm_free_lapic(struct kvm_vcpu *vcpu);
+@@ -45,7 +45,7 @@ int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu);
+ u64 kvm_get_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu);
+ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data);
+ 
+-void kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
++int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
+ void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu);
+ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu);
+ 
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 57867e4..7774cca 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3140,8 +3140,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ 		r = -EFAULT;
+ 		if (copy_from_user(&va, argp, sizeof va))
+ 			goto out;
+-		r = 0;
+-		kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr);
++		r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr);
+ 		break;
+ 	}
+ 	case KVM_X86_SETUP_MCE: {
+@@ -5537,33 +5536,6 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
+ 			!kvm_event_needs_reinjection(vcpu);
+ }
+ 
+-static void vapic_enter(struct kvm_vcpu *vcpu)
+-{
+-	struct kvm_lapic *apic = vcpu->arch.apic;
+-	struct page *page;
+-
+-	if (!apic || !apic->vapic_addr)
+-		return;
+-
+-	page = gfn_to_page(vcpu->kvm, apic->vapic_addr >> PAGE_SHIFT);
+-
+-	vcpu->arch.apic->vapic_page = page;
+-}
+-
+-static void vapic_exit(struct kvm_vcpu *vcpu)
+-{
+-	struct kvm_lapic *apic = vcpu->arch.apic;
+-	int idx;
+-
+-	if (!apic || !apic->vapic_addr)
+-		return;
+-
+-	idx = srcu_read_lock(&vcpu->kvm->srcu);
+-	kvm_release_page_dirty(apic->vapic_page);
+-	mark_page_dirty(vcpu->kvm, apic->vapic_addr >> PAGE_SHIFT);
+-	srcu_read_unlock(&vcpu->kvm->srcu, idx);
+-}
+-
+ static void update_cr8_intercept(struct kvm_vcpu *vcpu)
+ {
+ 	int max_irr, tpr;
+@@ -5836,7 +5808,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
+ 	}
+ 
+ 	vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
+-	vapic_enter(vcpu);
+ 
+ 	r = 1;
+ 	while (r > 0) {
+@@ -5893,8 +5864,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
+ 
+ 	srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
+ 
+-	vapic_exit(vcpu);
+-
+ 	return r;
+ }
+ 
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index d29f6d5..f4000ee 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -429,17 +429,22 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	/* Marvell */
+ 	{ PCI_VDEVICE(MARVELL, 0x6145), board_ahci_mv },	/* 6145 */
+ 	{ PCI_VDEVICE(MARVELL, 0x6121), board_ahci_mv },	/* 6121 */
+-	{ PCI_DEVICE(0x1b4b, 0x9123),
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9123),
+ 	  .class = PCI_CLASS_STORAGE_SATA_AHCI,
+ 	  .class_mask = 0xffffff,
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9128 */
+-	{ PCI_DEVICE(0x1b4b, 0x9125),
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9125),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9125 */
+-	{ PCI_DEVICE(0x1b4b, 0x917a),
++	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_MARVELL_EXT, 0x9178,
++			 PCI_VENDOR_ID_MARVELL_EXT, 0x9170),
++	  .driver_data = board_ahci_yes_fbs },			/* 88se9170 */
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
+-	{ PCI_DEVICE(0x1b4b, 0x9192),
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
++	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 on some Gigabyte */
+-	{ PCI_DEVICE(0x1b4b, 0x91a3),
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3),
+ 	  .driver_data = board_ahci_yes_fbs },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
+ 	  .driver_data = board_ahci_yes_fbs },
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index a0a3987..72bbb5e 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4097,6 +4097,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "ST3320[68]13AS",	"SD1[5-9]",	ATA_HORKAGE_NONCQ |
+ 						ATA_HORKAGE_FIRMWARE_WARN },
+ 
++	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
++	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
++
+ 	/* Blacklist entries taken from Silicon Image 3124/3132
+ 	   Windows driver .inf file - also several Linux problem reports */
+ 	{ "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
+@@ -6328,6 +6331,7 @@ static int __init ata_parse_force_one(char **cur,
+ 		{ "nohrst",	.lflags		= ATA_LFLAG_NO_HRST },
+ 		{ "nosrst",	.lflags		= ATA_LFLAG_NO_SRST },
+ 		{ "norst",	.lflags		= ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST },
++		{ "disable",	.horkage_on	= ATA_HORKAGE_DISABLE },
+ 	};
+ 	char *start = *cur, *p = *cur;
+ 	char *id, *val, *endp;
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index da85c0d..a842317 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -254,6 +254,7 @@ config NET_DMA
+ 	bool "Network: TCP receive copy offload"
+ 	depends on DMA_ENGINE && NET
+ 	default (INTEL_IOATDMA || FSL_DMA)
++	depends on BROKEN
+ 	help
+ 	  This enables the use of DMA engines in the network stack to
+ 	  offload receive copy-to-user operations, freeing CPU cycles.
+diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
+index 5cb1227..3104502 100644
+--- a/drivers/gpio/gpio-msm-v2.c
++++ b/drivers/gpio/gpio-msm-v2.c
+@@ -249,7 +249,7 @@ static void msm_gpio_irq_mask(struct irq_data *d)
+ 
+ 	spin_lock_irqsave(&tlmm_lock, irq_flags);
+ 	writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
+-	clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
++	clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
+ 	__clear_bit(gpio, msm_gpio.enabled_irqs);
+ 	spin_unlock_irqrestore(&tlmm_lock, irq_flags);
+ }
+@@ -261,7 +261,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
+ 
+ 	spin_lock_irqsave(&tlmm_lock, irq_flags);
+ 	__set_bit(gpio, msm_gpio.enabled_irqs);
+-	set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
++	set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
+ 	writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
+ 	spin_unlock_irqrestore(&tlmm_lock, irq_flags);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 97a050f..ddb22e7 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -37,6 +37,7 @@
+  */
+ #define INTEL_GMCH_CTRL		0x52
+ #define INTEL_GMCH_VGA_DISABLE  (1 << 1)
++#define SNB_GMCH_CTRL		0x50
+ 
+ /* PCI config space */
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 6d36695..61b708b 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -9141,14 +9141,15 @@ void intel_connector_attach_encoder(struct intel_connector *connector,
+ int intel_modeset_vga_set_state(struct drm_device *dev, bool state)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
++	unsigned reg = INTEL_INFO(dev)->gen >= 6 ? SNB_GMCH_CTRL : INTEL_GMCH_CTRL;
+ 	u16 gmch_ctrl;
+ 
+-	pci_read_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, &gmch_ctrl);
++	pci_read_config_word(dev_priv->bridge_dev, reg, &gmch_ctrl);
+ 	if (state)
+ 		gmch_ctrl &= ~INTEL_GMCH_VGA_DISABLE;
+ 	else
+ 		gmch_ctrl |= INTEL_GMCH_VGA_DISABLE;
+-	pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
++	pci_write_config_word(dev_priv->bridge_dev, reg, gmch_ctrl);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
+index 93bce72..414a681 100644
+--- a/drivers/gpu/drm/radeon/rs690.c
++++ b/drivers/gpu/drm/radeon/rs690.c
+@@ -160,6 +160,16 @@ void rs690_mc_init(struct radeon_device *rdev)
+ 	base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
+ 	base = G_000100_MC_FB_START(base) << 16;
+ 	rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
++	/* Some boards seem to be configured for 128MB of sideport memory,
++	 * but really only have 64MB.  Just skip the sideport and use
++	 * UMA memory.
++	 */
++	if (rdev->mc.igp_sideport_enabled &&
++	    (rdev->mc.real_vram_size == (384 * 1024 * 1024))) {
++		base += 128 * 1024 * 1024;
++		rdev->mc.real_vram_size -= 128 * 1024 * 1024;
++		rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
++	}
+ 	rs690_pm_info(rdev);
+ 	radeon_vram_location(rdev, &rdev->mc, base);
+ 	rdev->mc.gtt_base_align = rdev->mc.gtt_size - 1;
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 221b924..e223175 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -144,9 +144,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ 	}
+ 
+ 	page_offset = ((address - vma->vm_start) >> PAGE_SHIFT) +
+-	    bo->vm_node->start - vma->vm_pgoff;
+-	page_last = ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) +
+-	    bo->vm_node->start - vma->vm_pgoff;
++		vma->vm_pgoff - bo->vm_node->start;
++	page_last = vma_pages(vma) + vma->vm_pgoff -
++		bo->vm_node->start;
+ 
+ 	if (unlikely(page_offset >= bo->num_pages)) {
+ 		retval = VM_FAULT_SIGBUS;
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 3d630bb..e6ec920 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -52,7 +52,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
+ 
+ #define BASE_SYSFS_ATTR_NO	2	/* Sysfs Base attr no for coretemp */
+ #define NUM_REAL_CORES		32	/* Number of Real cores per cpu */
+-#define CORETEMP_NAME_LENGTH	17	/* String Length of attrs */
++#define CORETEMP_NAME_LENGTH	19	/* String Length of attrs */
+ #define MAX_CORE_ATTRS		4	/* Maximum no of basic attrs */
+ #define TOTAL_ATTRS		(MAX_CORE_ATTRS + 1)
+ #define MAX_CORE_DATA		(NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 8bba438..6d05e26 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -997,7 +997,7 @@ read_again:
+ 			/* Could not read all from this device, so we will
+ 			 * need another r10_bio.
+ 			 */
+-			sectors_handled = (r10_bio->sectors + max_sectors
++			sectors_handled = (r10_bio->sector + max_sectors
+ 					   - bio->bi_sector);
+ 			r10_bio->sectors = max_sectors;
+ 			spin_lock_irq(&conf->device_lock);
+@@ -1005,7 +1005,7 @@ read_again:
+ 				bio->bi_phys_segments = 2;
+ 			else
+ 				bio->bi_phys_segments++;
+-			spin_unlock(&conf->device_lock);
++			spin_unlock_irq(&conf->device_lock);
+ 			/* Cannot call generic_make_request directly
+ 			 * as that will be queued in __generic_make_request
+ 			 * and subsequent mempool_alloc might block
+@@ -2563,10 +2563,6 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
+ 			if (j == conf->copies) {
+ 				/* Cannot recover, so abort the recovery or
+ 				 * record a bad block */
+-				put_buf(r10_bio);
+-				if (rb2)
+-					atomic_dec(&rb2->remaining);
+-				r10_bio = rb2;
+ 				if (any_working) {
+ 					/* problem is that there are bad blocks
+ 					 * on other device(s)
+@@ -2590,6 +2586,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
+ 					conf->mirrors[i].recovery_disabled
+ 						= mddev->recovery_disabled;
+ 				}
++				put_buf(r10_bio);
++				if (rb2)
++					atomic_dec(&rb2->remaining);
++				r10_bio = rb2;
+ 				break;
+ 			}
+ 		}
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 26ef63a..fb67833 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3084,7 +3084,7 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
+ 			 */
+ 			set_bit(R5_Insync, &dev->flags);
+ 
+-		if (rdev && test_bit(R5_WriteError, &dev->flags)) {
++		if (test_bit(R5_WriteError, &dev->flags)) {
+ 			clear_bit(R5_Insync, &dev->flags);
+ 			if (!test_bit(Faulty, &rdev->flags)) {
+ 				s->handle_bad_blocks = 1;
+@@ -3092,7 +3092,7 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
+ 			} else
+ 				clear_bit(R5_WriteError, &dev->flags);
+ 		}
+-		if (rdev && test_bit(R5_MadeGood, &dev->flags)) {
++		if (test_bit(R5_MadeGood, &dev->flags)) {
+ 			if (!test_bit(Faulty, &rdev->flags)) {
+ 				s->handle_bad_blocks = 1;
+ 				atomic_inc(&rdev->nr_pending);
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index bbb6692..e367ab1 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -108,6 +108,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	struct sk_buff *skb = tx_buf->skb;
+ 	u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
+ 	int nbd;
++	u16 split_bd_len = 0;
+ 
+ 	/* prefetch skb end pointer to speedup dev_kfree_skb() */
+ 	prefetch(&skb->end);
+@@ -115,11 +116,8 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	DP(BNX2X_MSG_FP, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
+ 	   txdata->txq_index, idx, tx_buf, skb);
+ 
+-	/* unmap first bd */
+ 	DP(BNX2X_MSG_OFF, "free bd_idx %d\n", bd_idx);
+ 	tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
+-	dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+-			 BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
+ 
+ 
+ 	nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
+@@ -138,12 +136,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	--nbd;
+ 	bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+ 
+-	/* ...and the TSO split header bd since they have no mapping */
++	/* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
+ 	if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
++		tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
++		split_bd_len = BD_UNMAP_LEN(tx_data_bd);
+ 		--nbd;
+ 		bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+ 	}
+ 
++	/* unmap first bd */
++	dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
++			 BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
++			 DMA_TO_DEVICE);
++
+ 	/* now free frags */
+ 	while (nbd > 0) {
+ 
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 1bc927a..d5793d3 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -14537,6 +14537,9 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
+ 	/* Clear this out for sanity. */
+ 	tw32(TG3PCI_MEM_WIN_BASE_ADDR, 0);
+ 
++	/* Clear TG3PCI_REG_BASE_ADDR to prevent hangs. */
++	tw32(TG3PCI_REG_BASE_ADDR, 0);
++
+ 	pci_read_config_dword(tp->pdev, TG3PCI_PCISTATE,
+ 			      &pci_state_reg);
+ 	if ((pci_state_reg & PCISTATE_CONV_PCI_MODE) == 0 &&
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index bfeccbf..297f0b6 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -3015,7 +3015,7 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
+ 
+ 	dev->hw_features = NETIF_F_SG | NETIF_F_TSO
+ 		      | NETIF_F_IP_CSUM | NETIF_F_HW_VLAN_TX | NETIF_F_LRO;
+-	dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_TSO
++	dev->features = NETIF_F_SG | NETIF_F_TSO
+ 		      | NETIF_F_HIGHDMA | NETIF_F_IP_CSUM | NETIF_F_HW_VLAN_TX
+ 		      | NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_FILTER
+ 		      | NETIF_F_RXCSUM;
+diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
+index 3a90af6..cc7e7de 100644
+--- a/drivers/net/ethernet/tehuti/tehuti.c
++++ b/drivers/net/ethernet/tehuti/tehuti.c
+@@ -1995,7 +1995,6 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		ndev->features = NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_TSO
+ 		    | NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
+ 		    NETIF_F_HW_VLAN_FILTER | NETIF_F_RXCSUM
+-		    /*| NETIF_F_FRAGLIST */
+ 		    ;
+ 		ndev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
+ 			NETIF_F_TSO | NETIF_F_HW_VLAN_TX;
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index e26945d..1b7b3be 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1011,7 +1011,7 @@ static int __devinit temac_of_probe(struct platform_device *op)
+ 	dev_set_drvdata(&op->dev, ndev);
+ 	SET_NETDEV_DEV(ndev, &op->dev);
+ 	ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
+-	ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
++	ndev->features = NETIF_F_SG;
+ 	ndev->netdev_ops = &temac_netdev_ops;
+ 	ndev->ethtool_ops = &temac_ethtool_ops;
+ #if 0
+diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
+index a4a3516..3b3a7e0 100644
+--- a/drivers/net/hamradio/hdlcdrv.c
++++ b/drivers/net/hamradio/hdlcdrv.c
+@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ 	case HDLCDRVCTL_CALIBRATE:
+ 		if(!capable(CAP_SYS_RAWIO))
+ 			return -EPERM;
++		if (bi.data.calibrate > INT_MAX / s->par.bitrate)
++			return -EINVAL;
+ 		s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
+ 		return 0;
+ 
+diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
+index 96a98d2..e4260ab 100644
+--- a/drivers/net/hamradio/yam.c
++++ b/drivers/net/hamradio/yam.c
+@@ -1060,6 +1060,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ 		break;
+ 
+ 	case SIOCYAMGCFG:
++		memset(&yi, 0, sizeof(yi));
+ 		yi.cfg.mask = 0xffffffff;
+ 		yi.cfg.iobase = yp->iobase;
+ 		yi.cfg.irq = yp->irq;
+diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
+index 136ecf3..dc60aec 100644
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -445,7 +445,12 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	dev->net->ethtool_ops = &dm9601_ethtool_ops;
+ 	dev->net->hard_header_len += DM_TX_OVERHEAD;
+ 	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+-	dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
++
++	/* dm9620/21a require room for 4 byte padding, even in dm9601
++	 * mode, so we need +1 to be able to receive full size
++	 * ethernet frames.
++	 */
++	dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1;
+ 
+ 	dev->mii.dev = dev->net;
+ 	dev->mii.mdio_read = dm9601_mdio_read;
+@@ -531,7 +536,7 @@ static int dm9601_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 				       gfp_t flags)
+ {
+-	int len;
++	int len, pad;
+ 
+ 	/* format:
+ 	   b1: packet length low
+@@ -539,12 +544,23 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 	   b3..n: packet data
+ 	*/
+ 
+-	len = skb->len;
++	len = skb->len + DM_TX_OVERHEAD;
+ 
+-	if (skb_headroom(skb) < DM_TX_OVERHEAD) {
++	/* workaround for dm962x errata with tx fifo getting out of
++	 * sync if a USB bulk transfer retry happens right after a
++	 * packet with odd / maxpacket length by adding up to 3 bytes
++	 * padding.
++	 */
++	while ((len & 1) || !(len % dev->maxpacket))
++		len++;
++
++	len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */
++	pad = len - skb->len;
++
++	if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) {
+ 		struct sk_buff *skb2;
+ 
+-		skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags);
++		skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags);
+ 		dev_kfree_skb_any(skb);
+ 		skb = skb2;
+ 		if (!skb)
+@@ -553,10 +569,10 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 
+ 	__skb_push(skb, DM_TX_OVERHEAD);
+ 
+-	/* usbnet adds padding if length is a multiple of packet size
+-	   if so, adjust length value in header */
+-	if ((skb->len % dev->maxpacket) == 0)
+-		len++;
++	if (pad) {
++		memset(skb->data + skb->len, 0, pad);
++		__skb_put(skb, pad);
++	}
+ 
+ 	skb->data[0] = len;
+ 	skb->data[1] = len >> 8;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+index b592016..f4caeb3 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+ 				mask2 |= ATH9K_INT_CST;
+ 			if (isr2 & AR_ISR_S2_TSFOOR)
+ 				mask2 |= ATH9K_INT_TSFOOR;
++
++			if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
++				REG_WRITE(ah, AR_ISR_S2, isr2);
++				isr &= ~AR_ISR_BCNMISC;
++			}
+ 		}
+ 
+-		isr = REG_READ(ah, AR_ISR_RAC);
++		if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
++			isr = REG_READ(ah, AR_ISR_RAC);
++
+ 		if (isr == 0xffffffff) {
+ 			*masked = 0;
+ 			return false;
+@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+ 
+ 			*masked |= ATH9K_INT_TX;
+ 
+-			s0_s = REG_READ(ah, AR_ISR_S0_S);
++			if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
++				s0_s = REG_READ(ah, AR_ISR_S0_S);
++				s1_s = REG_READ(ah, AR_ISR_S1_S);
++			} else {
++				s0_s = REG_READ(ah, AR_ISR_S0);
++				REG_WRITE(ah, AR_ISR_S0, s0_s);
++				s1_s = REG_READ(ah, AR_ISR_S1);
++				REG_WRITE(ah, AR_ISR_S1, s1_s);
++
++				isr &= ~(AR_ISR_TXOK |
++					 AR_ISR_TXDESC |
++					 AR_ISR_TXERR |
++					 AR_ISR_TXEOL);
++			}
++
+ 			ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
+ 			ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
+-
+-			s1_s = REG_READ(ah, AR_ISR_S1_S);
+ 			ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
+ 			ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
+ 		}
+@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+ 		*masked |= mask2;
+ 	}
+ 
+-	if (AR_SREV_9100(ah))
+-		return true;
+-
+-	if (isr & AR_ISR_GENTMR) {
++	if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) {
+ 		u32 s5_s;
+ 
+-		s5_s = REG_READ(ah, AR_ISR_S5_S);
++		if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
++			s5_s = REG_READ(ah, AR_ISR_S5_S);
++		} else {
++			s5_s = REG_READ(ah, AR_ISR_S5);
++		}
++
+ 		ah->intr_gen_timer_trigger =
+ 				MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
+ 
+@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+ 		if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
+ 		    !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
+ 			*masked |= ATH9K_INT_TIM_TIMER;
++
++		if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
++			REG_WRITE(ah, AR_ISR_S5, s5_s);
++			isr &= ~AR_ISR_GENTMR;
++		}
+ 	}
+ 
++	if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
++		REG_WRITE(ah, AR_ISR, isr);
++		REG_READ(ah, AR_ISR);
++	}
++
++	if (AR_SREV_9100(ah))
++		return true;
++
+ 	if (sync_cause) {
+ 		fatal_int =
+ 			(sync_cause &
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+index 0b9a0e8..b6cd36c 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -139,21 +139,26 @@ static void ath9k_htc_bssid_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
+ 	struct ath9k_vif_iter_data *iter_data = data;
+ 	int i;
+ 
+-	for (i = 0; i < ETH_ALEN; i++)
+-		iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
++	if (iter_data->hw_macaddr != NULL) {
++		for (i = 0; i < ETH_ALEN; i++)
++			iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
++	} else {
++		iter_data->hw_macaddr = mac;
++	}
+ }
+ 
+-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
++static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
+ 				     struct ieee80211_vif *vif)
+ {
+ 	struct ath_common *common = ath9k_hw_common(priv->ah);
+ 	struct ath9k_vif_iter_data iter_data;
+ 
+ 	/*
+-	 * Use the hardware MAC address as reference, the hardware uses it
+-	 * together with the BSSID mask when matching addresses.
++	 * Pick the MAC address of the first interface as the new hardware
++	 * MAC address. The hardware will use it together with the BSSID mask
++	 * when matching addresses.
+ 	 */
+-	iter_data.hw_macaddr = common->macaddr;
++	iter_data.hw_macaddr = NULL;
+ 	memset(&iter_data.mask, 0xff, ETH_ALEN);
+ 
+ 	if (vif)
+@@ -164,6 +169,10 @@ static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
+ 						   &iter_data);
+ 
+ 	memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
++
++	if (iter_data.hw_macaddr)
++		memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
++
+ 	ath_hw_setbssidmask(common);
+ }
+ 
+@@ -1100,7 +1109,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
+ 		goto out;
+ 	}
+ 
+-	ath9k_htc_set_bssid_mask(priv, vif);
++	ath9k_htc_set_mac_bssid_mask(priv, vif);
+ 
+ 	priv->vif_slot |= (1 << avp->index);
+ 	priv->nvifs++;
+@@ -1163,7 +1172,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
+ 
+ 	ath9k_htc_set_opmode(priv);
+ 
+-	ath9k_htc_set_bssid_mask(priv, vif);
++	ath9k_htc_set_mac_bssid_mask(priv, vif);
+ 
+ 	/*
+ 	 * Stop ANI only if there are no associated station interfaces.
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index a59267a..ad33126 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1357,8 +1357,9 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 
+ 	/*
+-	 * Use the hardware MAC address as reference, the hardware uses it
+-	 * together with the BSSID mask when matching addresses.
++	 * Pick the MAC address of the first interface as the new hardware
++	 * MAC address. The hardware will use it together with the BSSID mask
++	 * when matching addresses.
+ 	 */
+ 	memset(iter_data, 0, sizeof(*iter_data));
+ 	iter_data->hw_macaddr = common->macaddr;
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index 47ba0f7..38b793b 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -685,6 +685,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 	};
+ 	int index = rtlpci->rx_ring[rx_queue_idx].idx;
+ 
++	if (rtlpci->driver_is_goingto_unload)
++		return;
+ 	/*RX NORMAL PKT */
+ 	while (count--) {
+ 		/*rx descriptor */
+@@ -1563,6 +1565,7 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
+ 	 */
+ 	set_hal_stop(rtlhal);
+ 
++	rtlpci->driver_is_goingto_unload = true;
+ 	rtlpriv->cfg->ops->disable_interrupt(hw);
+ 	tasklet_kill(&rtlpriv->works.ips_leave_tasklet);
+ 
+@@ -1580,7 +1583,6 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
+ 	ppsc->rfchange_inprogress = true;
+ 	spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flags);
+ 
+-	rtlpci->driver_is_goingto_unload = true;
+ 	rtlpriv->cfg->ops->hw_disable(hw);
+ 	rtlpriv->cfg->ops->led_control(hw, LED_CTL_POWER_OFF);
+ 
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 363a5c6..9f1fec1 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1915,10 +1915,6 @@ void pci_enable_ari(struct pci_dev *dev)
+ 	if (!pci_is_pcie(dev) || dev->devfn)
+ 		return;
+ 
+-	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ARI);
+-	if (!pos)
+-		return;
+-
+ 	bridge = dev->bus->self;
+ 	if (!bridge || !pci_is_pcie(bridge))
+ 		return;
+@@ -1937,10 +1933,14 @@ void pci_enable_ari(struct pci_dev *dev)
+ 		return;
+ 
+ 	pci_read_config_word(bridge, pos + PCI_EXP_DEVCTL2, &ctrl);
+-	ctrl |= PCI_EXP_DEVCTL2_ARI;
++	if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ARI)) {
++		ctrl |= PCI_EXP_DEVCTL2_ARI;
++		bridge->ari_enabled = 1;
++	} else {
++		ctrl &= ~PCI_EXP_DEVCTL2_ARI;
++		bridge->ari_enabled = 0;
++	}
+ 	pci_write_config_word(bridge, pos + PCI_EXP_DEVCTL2, ctrl);
+-
+-	bridge->ari_enabled = 1;
+ }
+ 
+ /**
+diff --git a/drivers/staging/comedi/drivers/cb_pcidio.c b/drivers/staging/comedi/drivers/cb_pcidio.c
+index 79477a5..b3c9c8f 100644
+--- a/drivers/staging/comedi/drivers/cb_pcidio.c
++++ b/drivers/staging/comedi/drivers/cb_pcidio.c
+@@ -56,10 +56,6 @@ struct pcidio_board {
+ 	const char *name;	/*  name of the board */
+ 	int dev_id;
+ 	int n_8255;		/*  number of 8255 chips on board */
+-
+-	/*  indices of base address regions */
+-	int pcicontroler_badrindex;
+-	int dioregs_badrindex;
+ };
+ 
+ static const struct pcidio_board pcidio_boards[] = {
+@@ -67,22 +63,16 @@ static const struct pcidio_board pcidio_boards[] = {
+ 	 .name = "pci-dio24",
+ 	 .dev_id = 0x0028,
+ 	 .n_8255 = 1,
+-	 .pcicontroler_badrindex = 1,
+-	 .dioregs_badrindex = 2,
+ 	 },
+ 	{
+ 	 .name = "pci-dio24h",
+ 	 .dev_id = 0x0014,
+ 	 .n_8255 = 1,
+-	 .pcicontroler_badrindex = 1,
+-	 .dioregs_badrindex = 2,
+ 	 },
+ 	{
+ 	 .name = "pci-dio48h",
+ 	 .dev_id = 0x000b,
+ 	 .n_8255 = 2,
+-	 .pcicontroler_badrindex = 0,
+-	 .dioregs_badrindex = 1,
+ 	 },
+ };
+ 
+@@ -244,10 +234,15 @@ found:
+ 		    ("cb_pcidio: failed to enable PCI device and request regions\n");
+ 		return -EIO;
+ 	}
+-	devpriv->dio_reg_base
+-	    =
++	/*
++	 * Use PCI BAR 2 region if non-zero length, else use PCI BAR 1 region.
++	 * PCI BAR 1 is only used for older PCI-DIO48H boards.  At some point
++	 * the PCI-DIO48H was redesigned to use the same PCI interface chip
++	 * (and same PCI BAR region) as the other boards.
++	 */
++	devpriv->dio_reg_base =
+ 	    pci_resource_start(devpriv->pci_dev,
+-			       pcidio_boards[index].dioregs_badrindex);
++			       (pci_resource_len(pcidev, 2) ? 2 : 1));
+ 
+ /*
+  * Allocate the subdevice structures.  alloc_subdevice() is a
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 3effde2..45c13a6 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -861,24 +861,22 @@ static int iscsit_handle_scsi_cmd(
+ 	if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
+ 	     (hdr->flags & ISCSI_FLAG_CMD_WRITE)) && !hdr->data_length) {
+ 		/*
+-		 * Vmware ESX v3.0 uses a modified Cisco Initiator (v3.4.2)
+-		 * that adds support for RESERVE/RELEASE.  There is a bug
+-		 * add with this new functionality that sets R/W bits when
+-		 * neither CDB carries any READ or WRITE datapayloads.
++		 * From RFC-3720 Section 10.3.1:
++		 *
++		 * "Either or both of R and W MAY be 1 when either the
++		 *  Expected Data Transfer Length and/or Bidirectional Read
++		 *  Expected Data Transfer Length are 0"
++		 *
++		 * For this case, go ahead and clear the unnecssary bits
++		 * to avoid any confusion with ->data_direction.
+ 		 */
+-		if ((hdr->cdb[0] == 0x16) || (hdr->cdb[0] == 0x17)) {
+-			hdr->flags &= ~ISCSI_FLAG_CMD_READ;
+-			hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
+-			goto done;
+-		}
++		hdr->flags &= ~ISCSI_FLAG_CMD_READ;
++		hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
+ 
+-		pr_err("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
++		pr_warn("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
+ 			" set when Expected Data Transfer Length is 0 for"
+-			" CDB: 0x%02x. Bad iSCSI Initiator.\n", hdr->cdb[0]);
+-		return iscsit_add_reject(ISCSI_REASON_BOOKMARK_INVALID, 1,
+-				buf, conn);
++			" CDB: 0x%02x, Fixing up flags\n", hdr->cdb[0]);
+ 	}
+-done:
+ 
+ 	if (!(hdr->flags & ISCSI_FLAG_CMD_READ) &&
+ 	    !(hdr->flags & ISCSI_FLAG_CMD_WRITE) && (hdr->data_length != 0)) {
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 827f933..15685c3 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -121,7 +121,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		 * any other sleep) on Haswell machines with LPT and LPT-LP
+ 		 * with the new Intel BIOS
+ 		 */
+-		xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
++		/* Limit the quirk to only known vendors, as this triggers
++		 * yet another BIOS bug on some other machines
++		 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
++		 */
++		if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
++			xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+ 	}
+ 	if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ 			pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 6203d80..b24e2d3 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -608,6 +608,8 @@ static void __unregister_request(struct ceph_mds_client *mdsc,
+ 		req->r_unsafe_dir = NULL;
+ 	}
+ 
++	complete_all(&req->r_safe_completion);
++
+ 	ceph_mdsc_put_request(req);
+ }
+ 
+@@ -1815,8 +1817,11 @@ static int __do_request(struct ceph_mds_client *mdsc,
+ 	int mds = -1;
+ 	int err = -EAGAIN;
+ 
+-	if (req->r_err || req->r_got_result)
++	if (req->r_err || req->r_got_result) {
++		if (req->r_aborted)
++			__unregister_request(mdsc, req);
+ 		goto out;
++	}
+ 
+ 	if (req->r_timeout &&
+ 	    time_after_eq(jiffies, req->r_started + req->r_timeout)) {
+@@ -2124,7 +2129,6 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
+ 	if (head->safe) {
+ 		req->r_got_safe = true;
+ 		__unregister_request(mdsc, req);
+-		complete_all(&req->r_safe_completion);
+ 
+ 		if (req->r_got_unsafe) {
+ 			/*
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index bd8ac16..94b9e32 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -1448,6 +1448,7 @@ static ssize_t ext2_quota_write(struct super_block *sb, int type,
+ 				sb->s_blocksize - offset : towrite;
+ 
+ 		tmp_bh.b_state = 0;
++		tmp_bh.b_size = sb->s_blocksize;
+ 		err = ext2_get_block(inode, blk, &tmp_bh, 1);
+ 		if (err < 0)
+ 			goto out;
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 22c71b9..68b1602 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -278,6 +278,16 @@ struct ext4_io_submit {
+ /* Translate # of blks to # of clusters */
+ #define EXT4_NUM_B2C(sbi, blks)	(((blks) + (sbi)->s_cluster_ratio - 1) >> \
+ 				 (sbi)->s_cluster_bits)
++/* Mask out the low bits to get the starting block of the cluster */
++#define EXT4_PBLK_CMASK(s, pblk) ((pblk) &				\
++				  ~((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
++#define EXT4_LBLK_CMASK(s, lblk) ((lblk) &				\
++				  ~((ext4_lblk_t) (s)->s_cluster_ratio - 1))
++/* Get the cluster offset */
++#define EXT4_PBLK_COFF(s, pblk) ((pblk) &				\
++				 ((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
++#define EXT4_LBLK_COFF(s, lblk) ((lblk) &				\
++				 ((ext4_lblk_t) (s)->s_cluster_ratio - 1))
+ 
+ /*
+  * Structure of a blocks group descriptor
+diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
+index d0b8f98..9995b99 100644
+--- a/fs/ext4/ext4_jbd2.c
++++ b/fs/ext4/ext4_jbd2.c
+@@ -113,6 +113,10 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
+ 		if (WARN_ON_ONCE(err)) {
+ 			ext4_journal_abort_handle(where, line, __func__, bh,
+ 						  handle, err);
++			ext4_error_inode(inode, where, line,
++					 bh->b_blocknr,
++					 "journal_dirty_metadata failed: "
++					 "errcode %d", err);
+ 		}
+ 	} else {
+ 		if (inode)
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 3e8fc80..bf35fe0 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -318,8 +318,10 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ {
+ 	ext4_fsblk_t block = ext4_ext_pblock(ext);
+ 	int len = ext4_ext_get_actual_len(ext);
++	ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
++	ext4_lblk_t last = lblock + len - 1;
+ 
+-	if (len == 0)
++	if (lblock > last)
+ 		return 0;
+ 	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+@@ -345,11 +347,26 @@ static int ext4_valid_extent_entries(struct inode *inode,
+ 	if (depth == 0) {
+ 		/* leaf entries */
+ 		struct ext4_extent *ext = EXT_FIRST_EXTENT(eh);
++		struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
++		ext4_fsblk_t pblock = 0;
++		ext4_lblk_t lblock = 0;
++		ext4_lblk_t prev = 0;
++		int len = 0;
+ 		while (entries) {
+ 			if (!ext4_valid_extent(inode, ext))
+ 				return 0;
++
++			/* Check for overlapping extents */
++			lblock = le32_to_cpu(ext->ee_block);
++			len = ext4_ext_get_actual_len(ext);
++			if ((lblock <= prev) && prev) {
++				pblock = ext4_ext_pblock(ext);
++				es->s_last_error_block = cpu_to_le64(pblock);
++				return 0;
++			}
+ 			ext++;
+ 			entries--;
++			prev = lblock + len - 1;
+ 		}
+ 	} else {
+ 		struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh);
+@@ -1642,8 +1659,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
+ 	depth = ext_depth(inode);
+ 	if (!path[depth].p_ext)
+ 		goto out;
+-	b2 = le32_to_cpu(path[depth].p_ext->ee_block);
+-	b2 &= ~(sbi->s_cluster_ratio - 1);
++	b2 = EXT4_LBLK_CMASK(sbi, le32_to_cpu(path[depth].p_ext->ee_block));
+ 
+ 	/*
+ 	 * get the next allocated block if the extent in the path
+@@ -1653,7 +1669,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
+ 		b2 = ext4_ext_next_allocated_block(path);
+ 		if (b2 == EXT_MAX_BLOCKS)
+ 			goto out;
+-		b2 &= ~(sbi->s_cluster_ratio - 1);
++		b2 = EXT4_LBLK_CMASK(sbi, b2);
+ 	}
+ 
+ 	/* check for wrap through zero on extent logical start block*/
+@@ -2288,7 +2304,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
+ 		 * truncate operation has removed all of the blocks in
+ 		 * the cluster.
+ 		 */
+-		if (pblk & (sbi->s_cluster_ratio - 1) &&
++		if (EXT4_PBLK_COFF(sbi, pblk) &&
+ 		    (ee_len == num))
+ 			*partial_cluster = EXT4_B2C(sbi, pblk);
+ 		else
+@@ -3491,7 +3507,7 @@ int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk,
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ 	ext4_lblk_t lblk_start, lblk_end;
+-	lblk_start = lblk & (~(sbi->s_cluster_ratio - 1));
++	lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
+ 	lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
+ 
+ 	return ext4_find_delalloc_range(inode, lblk_start, lblk_end,
+@@ -3551,9 +3567,9 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
+ 	trace_ext4_get_reserved_cluster_alloc(inode, lblk_start, num_blks);
+ 
+ 	/* Check towards left side */
+-	c_offset = lblk_start & (sbi->s_cluster_ratio - 1);
++	c_offset = EXT4_LBLK_COFF(sbi, lblk_start);
+ 	if (c_offset) {
+-		lblk_from = lblk_start & (~(sbi->s_cluster_ratio - 1));
++		lblk_from = EXT4_LBLK_CMASK(sbi, lblk_start);
+ 		lblk_to = lblk_from + c_offset - 1;
+ 
+ 		if (ext4_find_delalloc_range(inode, lblk_from, lblk_to, 0))
+@@ -3561,7 +3577,7 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
+ 	}
+ 
+ 	/* Now check towards right. */
+-	c_offset = (lblk_start + num_blks) & (sbi->s_cluster_ratio - 1);
++	c_offset = EXT4_LBLK_COFF(sbi, lblk_start + num_blks);
+ 	if (allocated_clusters && c_offset) {
+ 		lblk_from = lblk_start + num_blks;
+ 		lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) - 1;
+@@ -3754,7 +3770,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
+ 				     struct ext4_ext_path *path)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+-	ext4_lblk_t c_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
++	ext4_lblk_t c_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
+ 	ext4_lblk_t ex_cluster_start, ex_cluster_end;
+ 	ext4_lblk_t rr_cluster_start, rr_cluster_end;
+ 	ext4_lblk_t ee_block = le32_to_cpu(ex->ee_block);
+@@ -3773,8 +3789,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
+ 	    (rr_cluster_start == ex_cluster_start)) {
+ 		if (rr_cluster_start == ex_cluster_end)
+ 			ee_start += ee_len - 1;
+-		map->m_pblk = (ee_start & ~(sbi->s_cluster_ratio - 1)) +
+-			c_offset;
++		map->m_pblk = EXT4_PBLK_CMASK(sbi, ee_start) + c_offset;
+ 		map->m_len = min(map->m_len,
+ 				 (unsigned) sbi->s_cluster_ratio - c_offset);
+ 		/*
+@@ -4052,7 +4067,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ 	 */
+ 	map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
+ 	newex.ee_block = cpu_to_le32(map->m_lblk);
+-	cluster_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
++	cluster_offset = EXT4_LBLK_CMASK(sbi, map->m_lblk);
+ 
+ 	/*
+ 	 * If we are doing bigalloc, check to see if the extent returned
+@@ -4120,7 +4135,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ 	 * needed so that future calls to get_implied_cluster_alloc()
+ 	 * work correctly.
+ 	 */
+-	offset = map->m_lblk & (sbi->s_cluster_ratio - 1);
++	offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
+ 	ar.len = EXT4_NUM_B2C(sbi, offset+allocated);
+ 	ar.goal -= offset;
+ 	ar.logical -= offset;
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 9b8c131..81feb17 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3378,6 +3378,9 @@ static void ext4_mb_pa_callback(struct rcu_head *head)
+ {
+ 	struct ext4_prealloc_space *pa;
+ 	pa = container_of(head, struct ext4_prealloc_space, u.pa_rcu);
++
++	BUG_ON(atomic_read(&pa->pa_count));
++	BUG_ON(pa->pa_deleted == 0);
+ 	kmem_cache_free(ext4_pspace_cachep, pa);
+ }
+ 
+@@ -3391,11 +3394,13 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
+ 	ext4_group_t grp;
+ 	ext4_fsblk_t grp_blk;
+ 
+-	if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
+-		return;
+-
+ 	/* in this short window concurrent discard can set pa_deleted */
+ 	spin_lock(&pa->pa_lock);
++	if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0) {
++		spin_unlock(&pa->pa_lock);
++		return;
++	}
++
+ 	if (pa->pa_deleted == 1) {
+ 		spin_unlock(&pa->pa_lock);
+ 		return;
+@@ -4062,7 +4067,7 @@ ext4_mb_initialize_context(struct ext4_allocation_context *ac,
+ 
+ 	/* set up allocation goals */
+ 	memset(ac, 0, sizeof(struct ext4_allocation_context));
+-	ac->ac_b_ex.fe_logical = ar->logical & ~(sbi->s_cluster_ratio - 1);
++	ac->ac_b_ex.fe_logical = EXT4_LBLK_CMASK(sbi, ar->logical);
+ 	ac->ac_status = AC_STATUS_CONTINUE;
+ 	ac->ac_sb = sb;
+ 	ac->ac_inode = ar->inode;
+@@ -4600,7 +4605,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
+ 	 * blocks at the beginning or the end unless we are explicitly
+ 	 * requested to avoid doing so.
+ 	 */
+-	overflow = block & (sbi->s_cluster_ratio - 1);
++	overflow = EXT4_PBLK_COFF(sbi, block);
+ 	if (overflow) {
+ 		if (flags & EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER) {
+ 			overflow = sbi->s_cluster_ratio - overflow;
+@@ -4614,7 +4619,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
+ 			count += overflow;
+ 		}
+ 	}
+-	overflow = count & (sbi->s_cluster_ratio - 1);
++	overflow = EXT4_LBLK_COFF(sbi, count);
+ 	if (overflow) {
+ 		if (flags & EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER) {
+ 			if (count > overflow)
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 84f84bf..acf2baf 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -819,7 +819,7 @@ static void ext4_put_super(struct super_block *sb)
+ 			ext4_abort(sb, "Couldn't clean up the journal");
+ 	}
+ 
+-	del_timer(&sbi->s_err_report);
++	del_timer_sync(&sbi->s_err_report);
+ 	ext4_release_system_zone(sb);
+ 	ext4_mb_release(sb);
+ 	ext4_ext_release(sb);
+@@ -3961,7 +3961,7 @@ failed_mount_wq:
+ 		sbi->s_journal = NULL;
+ 	}
+ failed_mount3:
+-	del_timer(&sbi->s_err_report);
++	del_timer_sync(&sbi->s_err_report);
+ 	if (sbi->s_flex_groups)
+ 		ext4_kvfree(sbi->s_flex_groups);
+ 	percpu_counter_destroy(&sbi->s_freeclusters_counter);
+diff --git a/fs/hpfs/file.c b/fs/hpfs/file.c
+index 89d2a58..5ecfffe 100644
+--- a/fs/hpfs/file.c
++++ b/fs/hpfs/file.c
+@@ -116,9 +116,12 @@ static int hpfs_write_begin(struct file *file, struct address_space *mapping,
+ 				hpfs_get_block,
+ 				&hpfs_i(mapping->host)->mmu_private);
+ 	if (unlikely(ret)) {
+-		loff_t isize = mapping->host->i_size;
++		loff_t isize;
++		hpfs_lock(mapping->host->i_sb);
++		isize = mapping->host->i_size;
+ 		if (pos + len > isize)
+ 			vmtruncate(mapping->host, isize);
++		hpfs_unlock(mapping->host->i_sb);
+ 	}
+ 
+ 	return ret;
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 233d3ed..3ceaced 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1437,17 +1437,19 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
+ 
+ 		nilfs_clear_logs(&sci->sc_segbufs);
+ 
+-		err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
+-		if (unlikely(err))
+-			return err;
+-
+ 		if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
+ 			err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
+ 							sci->sc_freesegs,
+ 							sci->sc_nfreesegs,
+ 							NULL);
+ 			WARN_ON(err); /* do not happen */
++			sci->sc_stage.flags &= ~NILFS_CF_SUFREED;
+ 		}
++
++		err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
++		if (unlikely(err))
++			return err;
++
+ 		nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
+ 		sci->sc_stage = prev_stage;
+ 	}
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index 34817ad..10ca5e5 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -653,8 +653,9 @@ xfs_log_unmount_write(xfs_mount_t *mp)
+ 				.lv_iovecp = &reg,
+ 			};
+ 
+-			/* remove inited flag */
++			/* remove inited flag, and account for space used */
+ 			tic->t_flags = 0;
++			tic->t_curr_res -= sizeof(magic);
+ 			error = xlog_write(log, &vec, tic, &lsn,
+ 					   NULL, XLOG_UNMOUNT_TRANS);
+ 			/*
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index def807c..c37fd89 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -495,7 +495,7 @@
+ 	{0x1002, 0x9645, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
+ 	{0x1002, 0x9648, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
+-	{0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
++	{0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
+ 	{0x1002, 0x964a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x964b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x964c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 32697c1..4bc9445 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -24,6 +24,7 @@ struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
+ void hugepage_put_subpool(struct hugepage_subpool *spool);
+ 
+ int PageHuge(struct page *page);
++int PageHeadHuge(struct page *page_head);
+ 
+ void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
+ int hugetlb_sysctl_handler(struct ctl_table *, int, void __user *, size_t *, loff_t *);
+@@ -88,6 +89,11 @@ static inline int PageHuge(struct page *page)
+ 	return 0;
+ }
+ 
++static inline int PageHeadHuge(struct page *page_head)
++{
++	return 0;
++}
++
+ static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
+ {
+ }
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 8c43fd1..4b04097 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1719,6 +1719,15 @@ static inline int dev_parse_header(const struct sk_buff *skb,
+ 	return dev->header_ops->parse(skb, haddr);
+ }
+ 
++static inline int dev_rebuild_header(struct sk_buff *skb)
++{
++	const struct net_device *dev = skb->dev;
++
++	if (!dev->header_ops || !dev->header_ops->rebuild)
++		return 0;
++	return dev->header_ops->rebuild(skb);
++}
++
+ typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len);
+ extern int		register_gifconf(unsigned int family, gifconf_func_t * gifconf);
+ static inline int unregister_gifconf(unsigned int family)
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 7cda65b..fe76a74 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -590,6 +590,20 @@ struct pci_driver {
+ 	.subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID
+ 
+ /**
++ * PCI_DEVICE_SUB - macro used to describe a specific pci device with subsystem
++ * @vend: the 16 bit PCI Vendor ID
++ * @dev: the 16 bit PCI Device ID
++ * @subvend: the 16 bit PCI Subvendor ID
++ * @subdev: the 16 bit PCI Subdevice ID
++ *
++ * This macro is used to create a struct pci_device_id that matches a
++ * specific device with subsystem information.
++ */
++#define PCI_DEVICE_SUB(vend, dev, subvend, subdev) \
++	.vendor = (vend), .device = (dev), \
++	.subvendor = (subvend), .subdevice = (subdev)
++
++/**
+  * PCI_DEVICE_CLASS - macro used to describe a specific pci device class
+  * @dev_class: the class, subclass, prog-if triple for this device
+  * @dev_class_mask: the class mask for this device
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 312d047..c17fdfb 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1200,6 +1200,7 @@ struct sched_entity {
+ struct sched_rt_entity {
+ 	struct list_head run_list;
+ 	unsigned long timeout;
++	unsigned long watchdog_stamp;
+ 	unsigned int time_slice;
+ 	int nr_cpus_allowed;
+ 
+diff --git a/kernel/sched.c b/kernel/sched.c
+index d93369a..ea85b0d 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -2189,6 +2189,10 @@ static int irqtime_account_si_update(void)
+ 
+ #endif
+ 
++#ifdef CONFIG_SMP
++static void unthrottle_offline_cfs_rqs(struct rq *rq);
++#endif
++
+ #include "sched_idletask.c"
+ #include "sched_fair.c"
+ #include "sched_rt.c"
+@@ -6566,8 +6570,6 @@ static void unthrottle_offline_cfs_rqs(struct rq *rq)
+ 			unthrottle_cfs_rq(cfs_rq);
+ 	}
+ }
+-#else
+-static void unthrottle_offline_cfs_rqs(struct rq *rq) {}
+ #endif
+ 
+ /*
+@@ -6595,9 +6597,6 @@ static void migrate_tasks(unsigned int dead_cpu)
+ 	 */
+ 	rq->stop = NULL;
+ 
+-	/* Ensure any throttled groups are reachable by pick_next_task */
+-	unthrottle_offline_cfs_rqs(rq);
+-
+ 	for ( ; ; ) {
+ 		/*
+ 		 * There's this thread running, bail when that's the only
+@@ -6624,6 +6623,10 @@ static void migrate_tasks(unsigned int dead_cpu)
+ 
+ #endif /* CONFIG_HOTPLUG_CPU */
+ 
++#if !defined(CONFIG_HOTPLUG_CPU) || !defined(CONFIG_CFS_BANDWIDTH)
++static void unthrottle_offline_cfs_rqs(struct rq *rq) {}
++#endif
++
+ #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
+ 
+ static struct ctl_table sd_ctl_dir[] = {
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index 5b9e456..37f3f39 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -4848,6 +4848,9 @@ static void rq_online_fair(struct rq *rq)
+ static void rq_offline_fair(struct rq *rq)
+ {
+ 	update_sysctl();
++
++	/* Ensure any throttled groups are reachable by pick_next_task */
++	unthrottle_offline_cfs_rqs(rq);
+ }
+ 
+ #else	/* CONFIG_SMP */
+diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
+index 6ad4fb3..f57fda7 100644
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -509,6 +509,7 @@ balanced:
+ 		 * runtime - in which case borrowing doesn't make sense.
+ 		 */
+ 		rt_rq->rt_runtime = RUNTIME_INF;
++		rt_rq->rt_throttled = 0;
+ 		raw_spin_unlock(&rt_rq->rt_runtime_lock);
+ 		raw_spin_unlock(&rt_b->rt_runtime_lock);
+ 	}
+@@ -587,6 +588,19 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
+ 		return 1;
+ 
+ 	span = sched_rt_period_mask();
++#ifdef CONFIG_RT_GROUP_SCHED
++	/*
++	 * FIXME: isolated CPUs should really leave the root task group,
++	 * whether they are isolcpus or were isolated via cpusets, lest
++	 * the timer run on a CPU which does not service all runqueues,
++	 * potentially leaving other CPUs indefinitely throttled.  If
++	 * isolation is really required, the user will turn the throttle
++	 * off to kill the perturbations it causes anyway.  Meanwhile,
++	 * this maintains functionality for boot and/or troubleshooting.
++	 */
++	if (rt_b == &root_task_group.rt_bandwidth)
++		span = cpu_online_mask;
++#endif
+ 	for_each_cpu(i, span) {
+ 		int enqueue = 0;
+ 		struct rt_rq *rt_rq = sched_rt_period_rt_rq(rt_b, i);
+@@ -719,6 +733,13 @@ inc_rt_prio_smp(struct rt_rq *rt_rq, int prio, int prev_prio)
+ {
+ 	struct rq *rq = rq_of_rt_rq(rt_rq);
+ 
++#ifdef CONFIG_RT_GROUP_SCHED
++	/*
++	 * Change rq's cpupri only if rt_rq is the top queue.
++	 */
++	if (&rq->rt != rt_rq)
++		return;
++#endif
+ 	if (rq->online && prio < prev_prio)
+ 		cpupri_set(&rq->rd->cpupri, rq->cpu, prio);
+ }
+@@ -728,6 +749,13 @@ dec_rt_prio_smp(struct rt_rq *rt_rq, int prio, int prev_prio)
+ {
+ 	struct rq *rq = rq_of_rt_rq(rt_rq);
+ 
++#ifdef CONFIG_RT_GROUP_SCHED
++	/*
++	 * Change rq's cpupri only if rt_rq is the top queue.
++	 */
++	if (&rq->rt != rt_rq)
++		return;
++#endif
+ 	if (rq->online && rt_rq->highest_prio.curr != prev_prio)
+ 		cpupri_set(&rq->rd->cpupri, rq->cpu, rt_rq->highest_prio.curr);
+ }
+@@ -1749,7 +1777,11 @@ static void watchdog(struct rq *rq, struct task_struct *p)
+ 	if (soft != RLIM_INFINITY) {
+ 		unsigned long next;
+ 
+-		p->rt.timeout++;
++		if (p->rt.watchdog_stamp != jiffies) {
++			p->rt.timeout++;
++			p->rt.watchdog_stamp = jiffies;
++		}
++
+ 		next = DIV_ROUND_UP(min(soft, hard), USEC_PER_SEC/HZ);
+ 		if (p->rt.timeout > next)
+ 			p->cputime_expires.sched_exp = p->se.sum_exec_runtime;
+@@ -1758,6 +1790,8 @@ static void watchdog(struct rq *rq, struct task_struct *p)
+ 
+ static void task_tick_rt(struct rq *rq, struct task_struct *p, int queued)
+ {
++	struct sched_rt_entity *rt_se = &p->rt;
++
+ 	update_curr_rt(rq);
+ 
+ 	watchdog(rq, p);
+@@ -1775,12 +1809,15 @@ static void task_tick_rt(struct rq *rq, struct task_struct *p, int queued)
+ 	p->rt.time_slice = DEF_TIMESLICE;
+ 
+ 	/*
+-	 * Requeue to the end of queue if we are not the only element
+-	 * on the queue:
++	 * Requeue to the end of queue if we (and all of our ancestors) are the
++	 * only element on the queue
+ 	 */
+-	if (p->rt.run_list.prev != p->rt.run_list.next) {
+-		requeue_task_rt(rq, p, 0);
+-		set_tsk_need_resched(p);
++	for_each_sched_rt_entity(rt_se) {
++		if (rt_se->run_list.prev != rt_se->run_list.next) {
++			requeue_task_rt(rq, p, 0);
++			set_tsk_need_resched(p);
++			return;
++		}
+ 	}
+ }
+ 
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index d40d7f6..cf8b439 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -618,7 +618,7 @@ static int ftrace_profile_init(void)
+ 	int cpu;
+ 	int ret = 0;
+ 
+-	for_each_online_cpu(cpu) {
++	for_each_possible_cpu(cpu) {
+ 		ret = ftrace_profile_init_cpu(cpu);
+ 		if (ret)
+ 			break;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index ddf2128..3a5aae2 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -679,6 +679,23 @@ int PageHuge(struct page *page)
+ }
+ EXPORT_SYMBOL_GPL(PageHuge);
+ 
++/*
++ * PageHeadHuge() only returns true for hugetlbfs head page, but not for
++ * normal or transparent huge pages.
++ */
++int PageHeadHuge(struct page *page_head)
++{
++	compound_page_dtor *dtor;
++
++	if (!PageHead(page_head))
++		return 0;
++
++	dtor = get_compound_page_dtor(page_head);
++
++	return dtor == free_huge_page;
++}
++EXPORT_SYMBOL_GPL(PageHeadHuge);
++
+ pgoff_t __basepage_index(struct page *page)
+ {
+ 	struct page *page_head = compound_head(page);
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 1b03878..96c4bcf 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1441,10 +1441,18 @@ static int soft_offline_huge_page(struct page *page, int flags)
+ 		return ret;
+ 	}
+ done:
+-	if (!PageHWPoison(hpage))
+-		atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
+-	set_page_hwpoison_huge_page(hpage);
+-	dequeue_hwpoisoned_huge_page(hpage);
++	/* overcommit hugetlb page will be freed to buddy */
++	if (PageHuge(hpage)) {
++		if (!PageHWPoison(hpage))
++			atomic_long_add(1 << compound_trans_order(hpage),
++					&mce_bad_pages);
++		set_page_hwpoison_huge_page(hpage);
++		dequeue_hwpoisoned_huge_page(hpage);
++	} else {
++		SetPageHWPoison(page);
++		atomic_long_inc(&mce_bad_pages);
++	}
++
+ 	/* keep elevated page count for bad page */
+ 	return ret;
+ }
+diff --git a/mm/mmap.c b/mm/mmap.c
+index dff37a6..6182c8a 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1368,7 +1368,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	struct vm_area_struct *vma;
+ 	unsigned long start_addr;
+ 
+-	if (len > TASK_SIZE)
++	if (len > TASK_SIZE - mmap_min_addr)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED)
+@@ -1377,7 +1377,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
+ 		    (!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+@@ -1442,9 +1442,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long addr = addr0;
++	unsigned long low_limit = max(PAGE_SIZE, mmap_min_addr);
+ 
+ 	/* requested length too big for entire address space */
+-	if (len > TASK_SIZE)
++	if (len > TASK_SIZE - mmap_min_addr)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED)
+@@ -1454,7 +1455,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
+ 				(!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+@@ -1469,14 +1470,14 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	addr = mm->free_area_cache;
+ 
+ 	/* make sure it can fit in the remaining address space */
+-	if (addr > len) {
++	if (addr >= low_limit + len) {
+ 		vma = find_vma(mm, addr-len);
+ 		if (!vma || addr <= vma->vm_start)
+ 			/* remember the address as a hint for next time */
+ 			return (mm->free_area_cache = addr-len);
+ 	}
+ 
+-	if (mm->mmap_base < len)
++	if (mm->mmap_base < low_limit + len)
+ 		goto bottomup;
+ 
+ 	addr = mm->mmap_base-len;
+@@ -1498,7 +1499,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 
+ 		/* try just below the current vma->vm_start */
+ 		addr = vma->vm_start-len;
+-	} while (len < vma->vm_start);
++	} while (vma->vm_start >= low_limit + len);
+ 
+ bottomup:
+ 	/*
+diff --git a/mm/swap.c b/mm/swap.c
+index 55b266d..a4b9016 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -31,6 +31,7 @@
+ #include <linux/backing-dev.h>
+ #include <linux/memcontrol.h>
+ #include <linux/gfp.h>
++#include <linux/hugetlb.h>
+ 
+ #include "internal.h"
+ 
+@@ -69,7 +70,8 @@ static void __put_compound_page(struct page *page)
+ {
+ 	compound_page_dtor *dtor;
+ 
+-	__page_cache_release(page);
++	if (!PageHuge(page))
++		__page_cache_release(page);
+ 	dtor = get_compound_page_dtor(page);
+ 	(*dtor)(page);
+ }
+@@ -83,6 +85,35 @@ static void put_compound_page(struct page *page)
+ 		if (likely(page != page_head &&
+ 			   get_page_unless_zero(page_head))) {
+ 			unsigned long flags;
++
++			 if (PageHeadHuge(page_head)) {
++				if (likely(PageTail(page))) {
++					/*
++					 * __split_huge_page_refcount
++					 * cannot race here.
++					 */
++					VM_BUG_ON(!PageHead(page_head));
++					atomic_dec(&page->_mapcount);
++					if (put_page_testzero(page_head))
++						VM_BUG_ON(1);
++					if (put_page_testzero(page_head))
++						__put_compound_page(page_head);
++					return;
++				} else {
++					/*
++					 * __split_huge_page_refcount
++					 * run before us, "page" was a
++					 * THP tail. The split
++					 * page_head has been freed
++					 * and reallocated as slab or
++					 * hugetlbfs page of smaller
++					 * order (only possible if
++					 * reallocated as slab on
++					 * x86).
++					 */
++					goto skip_lock;
++				}
++			}
+ 			/*
+ 			 * page_head wasn't a dangling pointer but it
+ 			 * may not be a head page anymore by the time
+@@ -94,9 +125,29 @@ static void put_compound_page(struct page *page)
+ 				/* __split_huge_page_refcount run before us */
+ 				compound_unlock_irqrestore(page_head, flags);
+ 				VM_BUG_ON(PageHead(page_head));
+-				if (put_page_testzero(page_head))
+-					__put_single_page(page_head);
+-			out_put_single:
++skip_lock:
++				if (put_page_testzero(page_head)) {
++					/*
++					 * The head page may have been
++					 * freed and reallocated as a
++					 * compound page of smaller
++					 * order and then freed again.
++					 * All we know is that it
++					 * cannot have become: a THP
++					 * page, a compound page of
++					 * higher order, a tail page.
++					 * That is because we still
++					 * hold the refcount of the
++					 * split THP tail and
++					 * page_head was the THP head
++					 * before the split.
++					 */
++					if (PageHead(page_head))
++						__put_compound_page(page_head);
++					else
++						__put_single_page(page_head);
++				}
++out_put_single:
+ 				if (put_page_testzero(page))
+ 					__put_single_page(page);
+ 				return;
+@@ -163,6 +214,31 @@ bool __get_page_tail(struct page *page)
+ 	struct page *page_head = compound_trans_head(page);
+ 
+ 	if (likely(page != page_head && get_page_unless_zero(page_head))) {
++		/* Ref to put_compound_page() comment. */
++		if (PageHeadHuge(page_head)) {
++			if (likely(PageTail(page))) {
++				/*
++				 * This is a hugetlbfs
++				 * page. __split_huge_page_refcount
++				 * cannot race here.
++				 */
++				VM_BUG_ON(!PageHead(page_head));
++				__get_page_tail_foll(page, false);
++				return true;
++			} else {
++				/*
++				 * __split_huge_page_refcount run
++				 * before us, "page" was a THP
++				 * tail. The split page_head has been
++				 * freed and reallocated as slab or
++				 * hugetlbfs page of smaller order
++				 * (only possible if reallocated as
++				 * slab on x86).
++				 */
++				put_page(page_head);
++				return false;
++			}
++		}
+ 		/*
+ 		 * page_head wasn't a dangling pointer but it
+ 		 * may not be a head page anymore by the time
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index b40d3da..48a62d8 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -522,6 +522,22 @@ static const struct header_ops vlan_header_ops = {
+ 	.parse	 = eth_header_parse,
+ };
+ 
++static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
++				     unsigned short type,
++				     const void *daddr, const void *saddr,
++				     unsigned int len)
++{
++	struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
++
++	return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
++}
++
++static const struct header_ops vlan_passthru_header_ops = {
++	.create	 = vlan_passthru_hard_header,
++	.rebuild = dev_rebuild_header,
++	.parse	 = eth_header_parse,
++};
++
+ static const struct net_device_ops vlan_netdev_ops;
+ 
+ static int vlan_dev_init(struct net_device *dev)
+@@ -561,7 +577,7 @@ static int vlan_dev_init(struct net_device *dev)
+ 
+ 	dev->needed_headroom = real_dev->needed_headroom;
+ 	if (real_dev->features & NETIF_F_HW_VLAN_TX) {
+-		dev->header_ops      = real_dev->header_ops;
++		dev->header_ops      = &vlan_passthru_header_ops;
+ 		dev->hard_header_len = real_dev->hard_header_len;
+ 	} else {
+ 		dev->header_ops      = &vlan_header_ops;
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index a06deca..2157984 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1743,7 +1743,7 @@ int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
+ 	u32 old;
+ 	struct net_bridge_mdb_htable *mdb;
+ 
+-	spin_lock(&br->multicast_lock);
++	spin_lock_bh(&br->multicast_lock);
+ 	if (!netif_running(br->dev))
+ 		goto unlock;
+ 
+@@ -1775,7 +1775,7 @@ rollback:
+ 	}
+ 
+ unlock:
+-	spin_unlock(&br->multicast_lock);
++	spin_unlock_bh(&br->multicast_lock);
+ 
+ 	return err;
+ }
+diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
+index b856f87..1d9a529 100644
+--- a/net/core/drop_monitor.c
++++ b/net/core/drop_monitor.c
+@@ -61,7 +61,6 @@ static struct genl_family net_drop_monitor_family = {
+ 	.hdrsize        = 0,
+ 	.name           = "NET_DM",
+ 	.version        = 2,
+-	.maxattr        = NET_DM_CMD_MAX,
+ };
+ 
+ static DEFINE_PER_CPU(struct per_cpu_dm_data, dm_cpu_data);
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index ccee270..6be5e8e 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -119,6 +119,10 @@ static int inet_csk_diag_fill(struct sock *sk,
+ 
+ 	r->id.idiag_sport = inet->inet_sport;
+ 	r->id.idiag_dport = inet->inet_dport;
++
++	memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
++	memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
++
+ 	r->id.idiag_src[0] = inet->inet_rcv_saddr;
+ 	r->id.idiag_dst[0] = inet->inet_daddr;
+ 
+@@ -209,13 +213,20 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
+ 
+ 	r->idiag_family	      = tw->tw_family;
+ 	r->idiag_retrans      = 0;
++
+ 	r->id.idiag_if	      = tw->tw_bound_dev_if;
+ 	r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
+ 	r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
++
+ 	r->id.idiag_sport     = tw->tw_sport;
+ 	r->id.idiag_dport     = tw->tw_dport;
++
++	memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
++	memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
++
+ 	r->id.idiag_src[0]    = tw->tw_rcv_saddr;
+ 	r->id.idiag_dst[0]    = tw->tw_daddr;
++
+ 	r->idiag_state	      = tw->tw_substate;
+ 	r->idiag_timer	      = 3;
+ 	r->idiag_expires      = DIV_ROUND_UP(tmo * 1000, HZ);
+@@ -598,8 +609,13 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
+ 
+ 	r->id.idiag_sport = inet->inet_sport;
+ 	r->id.idiag_dport = ireq->rmt_port;
++
++	memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
++	memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
++
+ 	r->id.idiag_src[0] = ireq->loc_addr;
+ 	r->id.idiag_dst[0] = ireq->rmt_addr;
++
+ 	r->idiag_expires = jiffies_to_msecs(tmo);
+ 	r->idiag_rqueue = 0;
+ 	r->idiag_wqueue = 0;
+@@ -824,7 +840,7 @@ next_normal:
+ 			++num;
+ 		}
+ 
+-		if (r->idiag_states & TCPF_TIME_WAIT) {
++		if (r->idiag_states & (TCPF_TIME_WAIT | TCPF_FIN_WAIT2)) {
+ 			struct inet_timewait_sock *tw;
+ 
+ 			inet_twsk_for_each(tw, node,
+@@ -832,6 +848,8 @@ next_normal:
+ 
+ 				if (num < s_num)
+ 					goto next_dying;
++				if (!(r->idiag_states & (1 << tw->tw_substate)))
++					goto next_dying;
+ 				if (r->id.idiag_sport != tw->tw_sport &&
+ 				    r->id.idiag_sport)
+ 					goto next_dying;
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index b5e64e4..140d377 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -155,9 +155,12 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+ static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
+ 			   struct mr_table **mrt)
+ {
+-	struct ipmr_result res;
+-	struct fib_lookup_arg arg = { .result = &res, };
+ 	int err;
++	struct ipmr_result res;
++	struct fib_lookup_arg arg = {
++		.result = &res,
++		.flags = FIB_LOOKUP_NOREF,
++	};
+ 
+ 	err = fib_rules_lookup(net->ipv4.mr_rules_ops,
+ 			       flowi4_to_flowi(flp4), 0, &arg);
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index f5af259..f96c96f 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -139,9 +139,12 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
+ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
+ 			    struct mr6_table **mrt)
+ {
+-	struct ip6mr_result res;
+-	struct fib_lookup_arg arg = { .result = &res, };
+ 	int err;
++	struct ip6mr_result res;
++	struct fib_lookup_arg arg = {
++		.result = &res,
++		.flags = FIB_LOOKUP_NOREF,
++	};
+ 
+ 	err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
+ 			       flowi6_to_flowi(flp6), 0, &arg);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 1768238..9a4f437 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2058,15 +2058,11 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
+ {
+ 	struct net *net = dev_net(idev->dev);
+ 	struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+-					    net->loopback_dev, 0);
++					    net->loopback_dev, DST_NOCOUNT);
+ 	struct neighbour *neigh;
+ 
+-	if (rt == NULL) {
+-		if (net_ratelimit())
+-			pr_warning("IPv6:  Maximum number of routes reached,"
+-				   " consider increasing route/max_size.\n");
++	if (rt == NULL)
+ 		return ERR_PTR(-ENOMEM);
+-	}
+ 
+ 	in6_dev_hold(idev);
+ 
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 99a60d5..f432d7b 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -715,7 +715,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 	struct llc_sock *llc = llc_sk(sk);
+ 	size_t copied = 0;
+ 	u32 peek_seq = 0;
+-	u32 *seq;
++	u32 *seq, skb_len;
+ 	unsigned long used;
+ 	int target;	/* Read at least this many bytes */
+ 	long timeo;
+@@ -813,6 +813,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		}
+ 		continue;
+ 	found_ok_skb:
++		skb_len = skb->len;
+ 		/* Ok so how much can we use? */
+ 		used = skb->len - offset;
+ 		if (len < used)
+@@ -843,7 +844,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		}
+ 
+ 		/* Partial read */
+-		if (used + offset < skb->len)
++		if (used + offset < skb_len)
+ 			continue;
+ 	} while (len > 0);
+ 
+diff --git a/net/rds/ib.c b/net/rds/ib.c
+index b4c8b00..ba2dffe 100644
+--- a/net/rds/ib.c
++++ b/net/rds/ib.c
+@@ -338,7 +338,8 @@ static int rds_ib_laddr_check(__be32 addr)
+ 	ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
+ 	/* due to this, we will claim to support iWARP devices unless we
+ 	   check node_type. */
+-	if (ret || cm_id->device->node_type != RDMA_NODE_IB_CA)
++	if (ret || !cm_id->device ||
++	    cm_id->device->node_type != RDMA_NODE_IB_CA)
+ 		ret = -EADDRNOTAVAIL;
+ 
+ 	rdsdebug("addr %pI4 ret %d node type %d\n",
+diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
+index e590949..37be6e2 100644
+--- a/net/rds/ib_send.c
++++ b/net/rds/ib_send.c
+@@ -552,9 +552,8 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
+ 	    && rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
+ 		rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
+ 		scat = &rm->data.op_sg[sg];
+-		ret = sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+-		ret = min_t(int, ret, scat->length - conn->c_xmit_data_off);
+-		return ret;
++		ret = max_t(int, RDS_CONG_MAP_BYTES, scat->length);
++		return sizeof(struct rds_header) + ret;
+ 	}
+ 
+ 	/* FIXME we may overallocate here */
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index bf76dec7..686fb1a 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -1258,6 +1258,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 
+ 	if (msg->msg_name) {
+ 		struct sockaddr_rose *srose;
++		struct full_sockaddr_rose *full_srose = msg->msg_name;
+ 
+ 		memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
+ 		srose = msg->msg_name;
+@@ -1265,18 +1266,9 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		srose->srose_addr   = rose->dest_addr;
+ 		srose->srose_call   = rose->dest_call;
+ 		srose->srose_ndigis = rose->dest_ndigis;
+-		if (msg->msg_namelen >= sizeof(struct full_sockaddr_rose)) {
+-			struct full_sockaddr_rose *full_srose = (struct full_sockaddr_rose *)msg->msg_name;
+-			for (n = 0 ; n < rose->dest_ndigis ; n++)
+-				full_srose->srose_digis[n] = rose->dest_digis[n];
+-			msg->msg_namelen = sizeof(struct full_sockaddr_rose);
+-		} else {
+-			if (rose->dest_ndigis >= 1) {
+-				srose->srose_ndigis = 1;
+-				srose->srose_digi = rose->dest_digis[0];
+-			}
+-			msg->msg_namelen = sizeof(struct sockaddr_rose);
+-		}
++		for (n = 0 ; n < rose->dest_ndigis ; n++)
++			full_srose->srose_digis[n] = rose->dest_digis[n];
++		msg->msg_namelen = sizeof(struct full_sockaddr_rose);
+ 	}
+ 
+ 	skb_free_datagram(sk, skb);
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 9338ccc..eddfdec 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -696,7 +696,9 @@ static int unix_autobind(struct socket *sock)
+ 	int err;
+ 	unsigned int retries = 0;
+ 
+-	mutex_lock(&u->readlock);
++	err = mutex_lock_interruptible(&u->readlock);
++	if (err)
++		return err;
+ 
+ 	err = 0;
+ 	if (u->addr)
+@@ -829,7 +831,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 		goto out;
+ 	addr_len = err;
+ 
+-	mutex_lock(&u->readlock);
++	err = mutex_lock_interruptible(&u->readlock);
++	if (err)
++		goto out;
+ 
+ 	err = -EINVAL;
+ 	if (u->addr)
+diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
+index 617a310..60549a4 100644
+--- a/net/wireless/radiotap.c
++++ b/net/wireless/radiotap.c
+@@ -122,6 +122,10 @@ int ieee80211_radiotap_iterator_init(
+ 	/* find payload start allowing for extended bitmap(s) */
+ 
+ 	if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
++		if ((unsigned long)iterator->_arg -
++		    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
++		    (unsigned long)iterator->_max_length)
++			return -EINVAL;
+ 		while (get_unaligned_le32(iterator->_arg) &
+ 					(1 << IEEE80211_RADIOTAP_EXT)) {
+ 			iterator->_arg += sizeof(uint32_t);
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 5898f34..bcf1d73 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -217,6 +217,14 @@ static int inode_alloc_security(struct inode *inode)
+ 	return 0;
+ }
+ 
++static void inode_free_rcu(struct rcu_head *head)
++{
++	struct inode_security_struct *isec;
++
++	isec = container_of(head, struct inode_security_struct, rcu);
++	kmem_cache_free(sel_inode_cache, isec);
++}
++
+ static void inode_free_security(struct inode *inode)
+ {
+ 	struct inode_security_struct *isec = inode->i_security;
+@@ -227,8 +235,16 @@ static void inode_free_security(struct inode *inode)
+ 		list_del_init(&isec->list);
+ 	spin_unlock(&sbsec->isec_lock);
+ 
+-	inode->i_security = NULL;
+-	kmem_cache_free(sel_inode_cache, isec);
++	/*
++	 * The inode may still be referenced in a path walk and
++	 * a call to selinux_inode_permission() can be made
++	 * after inode_free_security() is called. Ideally, the VFS
++	 * wouldn't do this, but fixing that is a much harder
++	 * job. For now, simply free the i_security via RCU, and
++	 * leave the current inode->i_security pointer intact.
++	 * The inode will be freed after the RCU grace period too.
++	 */
++	call_rcu(&isec->rcu, inode_free_rcu);
+ }
+ 
+ static int file_alloc_security(struct file *file)
+@@ -4181,8 +4197,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ 		}
+ 		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
+ 				   PEER__RECV, &ad);
+-		if (err)
++		if (err) {
+ 			selinux_netlbl_err(skb, err, 0);
++			return err;
++		}
+ 	}
+ 
+ 	if (secmark_active) {
+@@ -5372,11 +5390,11 @@ static int selinux_setprocattr(struct task_struct *p,
+ 		/* Check for ptracing, and update the task SID if ok.
+ 		   Otherwise, leave SID unchanged and fail. */
+ 		ptsid = 0;
+-		task_lock(p);
++		rcu_read_lock();
+ 		tracer = ptrace_parent(p);
+ 		if (tracer)
+ 			ptsid = task_sid(tracer);
+-		task_unlock(p);
++		rcu_read_unlock();
+ 
+ 		if (tracer) {
+ 			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
+diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
+index 26c7eee..7b1830b 100644
+--- a/security/selinux/include/objsec.h
++++ b/security/selinux/include/objsec.h
+@@ -38,7 +38,10 @@ struct task_security_struct {
+ 
+ struct inode_security_struct {
+ 	struct inode *inode;	/* back pointer to inode object */
+-	struct list_head list;	/* list of inode_security_struct */
++	union {
++		struct list_head list;	/* list of inode_security_struct */
++		struct rcu_head rcu;	/* for freeing the inode_security_struct */
++	};
+ 	u32 task_sid;		/* SID of creating task */
+ 	u32 sid;		/* SID of this object */
+ 	u16 sclass;		/* security class of this object */
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 3420bd3..cf0d46e 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1846,6 +1846,8 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
+ 		case SNDRV_PCM_STATE_DISCONNECTED:
+ 			err = -EBADFD;
+ 			goto _endloop;
++		case SNDRV_PCM_STATE_PAUSED:
++			continue;
+ 		}
+ 		if (!tout) {
+ 			snd_printd("%s write error (DMA or IRQ trouble?)\n",
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 7ebe4b7..fea6895 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2618,6 +2618,10 @@ static void __devinit check_probe_mask(struct azx *chip, int dev)
+  * white/black-list for enable_msi
+  */
+ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
++	SND_PCI_QUIRK(0x103c, 0x2191, "HP", 0), /* AMD Hudson */
++	SND_PCI_QUIRK(0x103c, 0x2192, "HP", 0), /* AMD Hudson */
++	SND_PCI_QUIRK(0x103c, 0x21f7, "HP", 0), /* AMD Hudson */
++	SND_PCI_QUIRK(0x103c, 0x21fa, "HP", 0), /* AMD Hudson */
+ 	SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 285ef87..fafb76f 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -1714,7 +1714,7 @@ static int wm8904_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 
+ 	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ 	case SND_SOC_DAIFMT_DSP_B:
+-		aif1 |= WM8904_AIF_LRCLK_INV;
++		aif1 |= 0x3 | WM8904_AIF_LRCLK_INV;
+ 	case SND_SOC_DAIFMT_DSP_A:
+ 		aif1 |= 0x3;
+ 		break;
+diff --git a/tools/power/cpupower/utils/cpupower-set.c b/tools/power/cpupower/utils/cpupower-set.c
+index dc4de37..bcf1d2f 100644
+--- a/tools/power/cpupower/utils/cpupower-set.c
++++ b/tools/power/cpupower/utils/cpupower-set.c
+@@ -18,9 +18,9 @@
+ #include "helpers/bitmask.h"
+ 
+ static struct option set_opts[] = {
+-	{ .name = "perf-bias",	.has_arg = optional_argument,	.flag = NULL,	.val = 'b'},
+-	{ .name = "sched-mc",	.has_arg = optional_argument,	.flag = NULL,	.val = 'm'},
+-	{ .name = "sched-smt",	.has_arg = optional_argument,	.flag = NULL,	.val = 's'},
++	{ .name = "perf-bias",	.has_arg = required_argument,	.flag = NULL,	.val = 'b'},
++	{ .name = "sched-mc",	.has_arg = required_argument,	.flag = NULL,	.val = 'm'},
++	{ .name = "sched-smt",	.has_arg = required_argument,	.flag = NULL,	.val = 's'},
+ 	{ },
+ };
+ 
diff --git a/3.2.54/4420_grsecurity-3.0-3.2.54-201402111745.patch b/3.2.55/4420_grsecurity-3.0-3.2.55-201402152203.patch
index 21543e0..c279324 100644
--- a/3.2.54/4420_grsecurity-3.0-3.2.54-201402111745.patch
+++ b/3.2.55/4420_grsecurity-3.0-3.2.55-201402152203.patch
@@ -203,7 +203,7 @@ index dfa6fc6..ccbfbf3 100644
 +zconf.lex.c
  zoffset.h
 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 2ba8272..e2a9806 100644
+index 1b196ea..ea70ff0 100644
 --- a/Documentation/kernel-parameters.txt
 +++ b/Documentation/kernel-parameters.txt
 @@ -859,6 +859,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
@@ -216,7 +216,7 @@ index 2ba8272..e2a9806 100644
  	hashdist=	[KNL,NUMA] Large hashes allocated during boot
  			are distributed across NUMA nodes.  Defaults on
  			for 64-bit NUMA, off otherwise.
-@@ -1960,6 +1963,22 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -1962,6 +1965,22 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
  			the specified number of seconds.  This is to be used if
  			your oopses keep scrolling off the screen.
  
@@ -273,7 +273,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 848be26..296b92f 100644
+index 538463e..d1011ba 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -2054,10 +2054,10 @@ index 90fa8b3..a3a2212 100644
  		return scno;
  	if (!(current->ptrace & PT_PTRACED))
 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index 7ac5dfd..0ce09c2 100644
+index d45fd22..1f2471d 100644
 --- a/arch/arm/kernel/traps.c
 +++ b/arch/arm/kernel/traps.c
-@@ -57,7 +57,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
+@@ -63,7 +63,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
  void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
  {
  #ifdef CONFIG_KALLSYMS
@@ -2066,7 +2066,7 @@ index 7ac5dfd..0ce09c2 100644
  #else
  	printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
  #endif
-@@ -259,6 +259,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
+@@ -265,6 +265,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
  
  static DEFINE_RAW_SPINLOCK(die_lock);
  
@@ -2075,7 +2075,7 @@ index 7ac5dfd..0ce09c2 100644
  /*
   * This function is protected against re-entrancy.
   */
-@@ -288,6 +290,9 @@ void die(const char *str, struct pt_regs *regs, int err)
+@@ -294,6 +296,9 @@ void die(const char *str, struct pt_regs *regs, int err)
  		panic("Fatal exception in interrupt");
  	if (panic_on_oops)
  		panic("Fatal exception");
@@ -9518,7 +9518,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index fb2e69d..200616a 100644
+index fb2e69d..205753c 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -75,6 +75,7 @@ config X86
@@ -9538,14 +9538,14 @@ index fb2e69d..200616a 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -999,6 +1000,7 @@ config MICROCODE_OLD_INTERFACE
+@@ -525,6 +526,7 @@ config SCHED_OMIT_FRAME_POINTER
  
- config X86_MSR
- 	tristate "/dev/cpu/*/msr - Model-specific register support"
-+	depends on !GRKERNSEC_KMEM
+ menuconfig PARAVIRT_GUEST
+ 	bool "Paravirtualized guest support"
++	depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_GUEST
  	---help---
- 	  This device gives privileged processes access to the x86
- 	  Model-Specific Registers (MSRs).  It is a character device with
+ 	  Say Y here to get to see options related to running Linux under
+ 	  various hypervisors.  This option alone does not add any kernel code.
 @@ -1022,7 +1024,7 @@ choice
  
  config NOHIGHMEM
@@ -21438,10 +21438,41 @@ index 925179f..b151b74 100644
  			if ((s64)val != *(s32 *)loc)
  				goto overflow;
 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index f7d1a64..399615a 100644
+index f7d1a64..28afc4a 100644
 --- a/arch/x86/kernel/msr.c
 +++ b/arch/x86/kernel/msr.c
-@@ -235,7 +235,7 @@ static int __cpuinit msr_class_cpu_callback(struct notifier_block *nfb,
+@@ -37,6 +37,7 @@
+ #include <linux/notifier.h>
+ #include <linux/uaccess.h>
+ #include <linux/gfp.h>
++#include <linux/grsecurity.h>
+ 
+ #include <asm/processor.h>
+ #include <asm/msr.h>
+@@ -104,6 +105,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
+ 	int err = 0;
+ 	ssize_t bytes = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_msr_write();
++	return -EPERM;
++#endif
++
+ 	if (count % 8)
+ 		return -EINVAL;	/* Invalid chunk size */
+ 
+@@ -151,6 +157,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
+ 			err = -EBADF;
+ 			break;
+ 		}
++#ifdef CONFIG_GRKERNSEC_KMEM
++		gr_handle_msr_write();
++		return -EPERM;
++#endif
+ 		if (copy_from_user(&regs, uregs, sizeof regs)) {
+ 			err = -EFAULT;
+ 			break;
+@@ -235,7 +245,7 @@ static int __cpuinit msr_class_cpu_callback(struct notifier_block *nfb,
  	return notifier_from_errno(err);
  }
  
@@ -23231,7 +23262,7 @@ index 09ff517..df19fbff 100644
  	.short 0
  	.quad	0x00cf9b000000ffff	# __KERNEL32_CS
 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index e6fbb94..b372995 100644
+index 20061b9..56d1e1d 100644
 --- a/arch/x86/kernel/traps.c
 +++ b/arch/x86/kernel/traps.c
 @@ -70,12 +70,6 @@ asmlinkage int system_call(void);
@@ -23376,7 +23407,7 @@ index e6fbb94..b372995 100644
  	{
  		if (!fixup_exception(regs)) {
  			task->thread.error_code = error_code;
-@@ -576,18 +605,19 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
+@@ -576,8 +605,8 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
  void __math_state_restore(struct task_struct *tsk)
  {
  	/* We need a safe address that is cheap to find and that is already
@@ -23387,23 +23418,6 @@ index e6fbb94..b372995 100644
  
  	/* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
  	   is pending.  Clear the x87 state here by setting it to fixed
- 	   values. safe_address is a random variable that should be in L1 */
--	alternative_input(
--		ASM_NOP8 ASM_NOP2,
--		"emms\n\t"	  	/* clear stack tags */
--		"fildl %P[addr]",	/* set F?P to defined value */
--		X86_FEATURE_FXSAVE_LEAK,
--		[addr] "m" (safe_address));
-+	if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) {
-+		asm volatile(
-+			"fnclex\n\t"
-+			"emms\n\t"
-+			"fildl %P[addr]"	/* set F?P to defined value */
-+			: : [addr] "m" (init_tss[raw_smp_processor_id()].x86_tss.sp0));
-+	}
- 
- 	/*
- 	 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
 diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
 index b9242ba..50c5edd 100644
 --- a/arch/x86/kernel/verify_cpu.S
@@ -23916,7 +23930,7 @@ index f5302da..6ee193e 100644
  
  /* instruction has only one source operand, destination is implicit (e.g. mul, div, imul, idiv) */
 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 43e7753..873f4440 100644
+index 757c716..11c70cf 100644
 --- a/arch/x86/kvm/lapic.c
 +++ b/arch/x86/kvm/lapic.c
 @@ -53,7 +53,7 @@
@@ -24119,7 +24133,7 @@ index aac5ea7..266eda9 100644
  
  	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 57867e4..1d5ff81 100644
+index 7774cca..97dedc9 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
 @@ -1341,8 +1341,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
@@ -24198,7 +24212,7 @@ index 57867e4..1d5ff81 100644
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -5182,7 +5193,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5181,7 +5192,7 @@ static void kvm_set_mmio_spte_mask(void)
  	kvm_mmu_set_mmio_spte_mask(mask);
  }
  
@@ -31034,6 +31048,18 @@ index 153407c..611cba9 100644
 -	return 0;
 -}
 -__setup("vdso=", vdso_setup);
+diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
+index 26c731a..fb510c7 100644
+--- a/arch/x86/xen/Kconfig
++++ b/arch/x86/xen/Kconfig
+@@ -8,6 +8,7 @@ config XEN
+ 	select PARAVIRT_CLOCK
+ 	depends on X86_64 || (X86_32 && X86_PAE && !X86_VISWS)
+ 	depends on X86_CMPXCHG && X86_TSC
++	depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_XEN
+ 	help
+ 	  This is the Linux Xen port.  Enabling this will allow the
+ 	  kernel to boot in a paravirtualized environment under the
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
 index 5189fe8..d937469 100644
 --- a/arch/x86/xen/enlighten.c
@@ -31901,10 +31927,10 @@ index de2802c..2260da9 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index a0a3987..d029614 100644
+index 72bbb5e..19f16d3 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
-@@ -4746,7 +4746,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4749,7 +4749,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -31913,7 +31939,7 @@ index a0a3987..d029614 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4762,7 +4762,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4765,7 +4765,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -31922,7 +31948,7 @@ index a0a3987..d029614 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5767,6 +5767,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5770,6 +5770,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -31930,7 +31956,7 @@ index a0a3987..d029614 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5780,8 +5781,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5783,8 +5784,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -37221,7 +37247,7 @@ index 93e74fb..4a1182d 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 6d36695..4a3e870 100644
+index 61b708b..c8ca0e9 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2215,7 +2215,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -38097,10 +38123,10 @@ index 0b5468b..74cfb87 100644
  
  #endif
 diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
-index 93bce72..00332c1 100644
+index 414a681..2b17775 100644
 --- a/drivers/gpu/drm/radeon/rs690.c
 +++ b/drivers/gpu/drm/radeon/rs690.c
-@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
+@@ -314,9 +314,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
  		if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
  			rdev->pm.sideport_bandwidth.full)
  			rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
@@ -38608,7 +38634,7 @@ index 83d2fbd6..93017f7 100644
  {
  	sysfs_attr_init(&attr->attr);
 diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
-index 3d630bb..77756d7 100644
+index e6ec920..7664a6b 100644
 --- a/drivers/hwmon/coretemp.c
 +++ b/drivers/hwmon/coretemp.c
 @@ -787,7 +787,7 @@ static int __cpuinit coretemp_cpu_callback(struct notifier_block *nfb,
@@ -41458,27 +41484,9 @@ index c706a7b..2cc7511 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 8bba438..a579e8c 100644
+index 6d05e26..a579e8c 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
-@@ -997,7 +997,7 @@ read_again:
- 			/* Could not read all from this device, so we will
- 			 * need another r10_bio.
- 			 */
--			sectors_handled = (r10_bio->sectors + max_sectors
-+			sectors_handled = (r10_bio->sector + max_sectors
- 					   - bio->bi_sector);
- 			r10_bio->sectors = max_sectors;
- 			spin_lock_irq(&conf->device_lock);
-@@ -1005,7 +1005,7 @@ read_again:
- 				bio->bi_phys_segments = 2;
- 			else
- 				bio->bi_phys_segments++;
--			spin_unlock(&conf->device_lock);
-+			spin_unlock_irq(&conf->device_lock);
- 			/* Cannot call generic_make_request directly
- 			 * as that will be queued in __generic_make_request
- 			 * and subsequent mempool_alloc might block
 @@ -1465,7 +1465,7 @@ static void end_sync_read(struct bio *bio, int error)
  		/* The write handler will notice the lack of
  		 * R10BIO_Uptodate and record any errors etc
@@ -41538,30 +41546,8 @@ index 8bba438..a579e8c 100644
  			}
  
  			rdev_dec_pending(rdev, mddev);
-@@ -2563,10 +2563,6 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
- 			if (j == conf->copies) {
- 				/* Cannot recover, so abort the recovery or
- 				 * record a bad block */
--				put_buf(r10_bio);
--				if (rb2)
--					atomic_dec(&rb2->remaining);
--				r10_bio = rb2;
- 				if (any_working) {
- 					/* problem is that there are bad blocks
- 					 * on other device(s)
-@@ -2590,6 +2586,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
- 					conf->mirrors[i].recovery_disabled
- 						= mddev->recovery_disabled;
- 				}
-+				put_buf(r10_bio);
-+				if (rb2)
-+					atomic_dec(&rb2->remaining);
-+				r10_bio = rb2;
- 				break;
- 			}
- 		}
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 26ef63a..bd587cd 100644
+index fb67833..09c4732 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1618,19 +1618,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
@@ -43601,31 +43587,6 @@ index d4d2bc1..14b8672 100644
  };
  
  static int stmmac_init_fs(struct net_device *dev)
-diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
-index a4a3516..3b3a7e0 100644
---- a/drivers/net/hamradio/hdlcdrv.c
-+++ b/drivers/net/hamradio/hdlcdrv.c
-@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
- 	case HDLCDRVCTL_CALIBRATE:
- 		if(!capable(CAP_SYS_RAWIO))
- 			return -EPERM;
-+		if (bi.data.calibrate > INT_MAX / s->par.bitrate)
-+			return -EINVAL;
- 		s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
- 		return 0;
- 
-diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
-index 96a98d2..e4260ab 100644
---- a/drivers/net/hamradio/yam.c
-+++ b/drivers/net/hamradio/yam.c
-@@ -1060,6 +1060,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
- 		break;
- 
- 	case SIOCYAMGCFG:
-+		memset(&yi, 0, sizeof(yi));
- 		yi.cfg.mask = 0xffffffff;
- 		yi.cfg.iobase = yp->iobase;
- 		yi.cfg.irq = yp->irq;
 diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
 index d0893e4..14b0d44 100644
 --- a/drivers/net/loopback.c
@@ -44302,10 +44263,10 @@ index b346d04..04436fa 100644
  	avf->bbuf->skb = skb;
  	ret = ath5k_beacon_setup(ah, avf->bbuf);
 diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
-index b592016..fe47870 100644
+index f4caeb3..8da6f5d 100644
 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
-@@ -183,8 +183,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
+@@ -217,8 +217,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
  	ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
  	ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
  
@@ -44316,7 +44277,7 @@ index b592016..fe47870 100644
  
  	ctl1 = i->buf_len[0] | (i->is_last ? 0 : AR_TxMore);
  	ctl6 = SM(i->keytype, AR_EncrType);
-@@ -198,26 +198,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
+@@ -232,26 +232,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
  
  	if ((i->is_first || i->is_last) &&
  	    i->aggr != AGGR_BUF_MIDDLE && i->aggr != AGGR_BUF_LAST) {
@@ -44350,7 +44311,7 @@ index b592016..fe47870 100644
  		return;
  	}
  
-@@ -242,7 +242,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
+@@ -276,7 +276,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
  		break;
  	}
  
@@ -44359,7 +44320,7 @@ index b592016..fe47870 100644
  		| (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
  		| SM(i->txpower, AR_XmitPower)
  		| (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
-@@ -252,19 +252,19 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
+@@ -286,19 +286,19 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
  		| (i->flags & ATH9K_TXDESC_RTSENA ? AR_RTSEnable :
  		   (i->flags & ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0));
  
@@ -47391,10 +47352,10 @@ index ed147c4..94fc3c6 100644
  
  /* core tmem accessor functions */
 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 3effde2..dda7d46 100644
+index 45c13a6..f8c847c 100644
 --- a/drivers/target/iscsi/iscsi_target.c
 +++ b/drivers/target/iscsi/iscsi_target.c
-@@ -1351,7 +1351,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
+@@ -1349,7 +1349,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
  		 * outstanding_r2ts reaches zero, go ahead and send the delayed
  		 * TASK_ABORTED status.
  		 */
@@ -56068,10 +56029,10 @@ index a8cbe1b..fed04cb 100644
  		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
  		return 0;
 diff --git a/fs/ext2/super.c b/fs/ext2/super.c
-index bd8ac16..43811b9 100644
+index 94b9e32..4b85c15 100644
 --- a/fs/ext2/super.c
 +++ b/fs/ext2/super.c
-@@ -1494,6 +1494,7 @@ static struct file_system_type ext2_fs_type = {
+@@ -1495,6 +1495,7 @@ static struct file_system_type ext2_fs_type = {
  	.kill_sb	= kill_block_super,
  	.fs_flags	= FS_REQUIRES_DEV,
  };
@@ -56174,10 +56135,10 @@ index 2845a1f..f29de63 100644
  		if (free_clusters >= (nclusters + dirty_clusters))
  			return 1;
 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 22c71b9..ba28a7d 100644
+index 68b1602..830e05c 100644
 --- a/fs/ext4/ext4.h
 +++ b/fs/ext4/ext4.h
-@@ -1206,19 +1206,19 @@ struct ext4_sb_info {
+@@ -1216,19 +1216,19 @@ struct ext4_sb_info {
  	unsigned long s_mb_last_start;
  
  	/* stats for buddy allocator */
@@ -56208,7 +56169,7 @@ index 22c71b9..ba28a7d 100644
  
  	/* locality groups */
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 9b8c131..d469b31 100644
+index 81feb17..d1ac883 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
 @@ -1794,7 +1794,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
@@ -56288,7 +56249,7 @@ index 9b8c131..d469b31 100644
  	}
  
  	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3514,7 +3514,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+@@ -3519,7 +3519,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_inode_pa(ac, pa);
  
  	ext4_mb_use_inode_pa(ac, pa);
@@ -56297,7 +56258,7 @@ index 9b8c131..d469b31 100644
  
  	ei = EXT4_I(ac->ac_inode);
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3574,7 +3574,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+@@ -3579,7 +3579,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_group_pa(ac, pa);
  
  	ext4_mb_use_group_pa(ac, pa);
@@ -56306,7 +56267,7 @@ index 9b8c131..d469b31 100644
  
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
  	lg = ac->ac_lg;
-@@ -3663,7 +3663,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+@@ -3668,7 +3668,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
  		 * from the bitmap and continue.
  		 */
  	}
@@ -56315,7 +56276,7 @@ index 9b8c131..d469b31 100644
  
  	return err;
  }
-@@ -3681,7 +3681,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+@@ -3686,7 +3686,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
  	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
  	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
  	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -56338,7 +56299,7 @@ index f3358ab..fbb1d90 100644
  		       "MMP failure info: last update time: %llu, last update "
  		       "node: %s, last update device: %s\n",
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 84f84bf..a8770cd 100644
+index acf2baf..31c5131 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
 @@ -92,6 +92,8 @@ static struct file_system_type ext2_fs_type = {
@@ -59491,34 +59452,6 @@ index 6a66fc0..cfdadae 100644
  	set_fs(oldfs);
  
  	if (host_err < 0)
-diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
-index 233d3ed..3ceaced 100644
---- a/fs/nilfs2/segment.c
-+++ b/fs/nilfs2/segment.c
-@@ -1437,17 +1437,19 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
- 
- 		nilfs_clear_logs(&sci->sc_segbufs);
- 
--		err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
--		if (unlikely(err))
--			return err;
--
- 		if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
- 			err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
- 							sci->sc_freesegs,
- 							sci->sc_nfreesegs,
- 							NULL);
- 			WARN_ON(err); /* do not happen */
-+			sci->sc_stage.flags &= ~NILFS_CF_SUFREED;
- 		}
-+
-+		err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
-+		if (unlikely(err))
-+			return err;
-+
- 		nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
- 		sci->sc_stage = prev_stage;
- 	}
 diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
 index 97bfbdd..e7f644a 100644
 --- a/fs/nilfs2/super.c
@@ -62801,10 +62734,10 @@ index 8a89949..6776861 100644
  xfs_init_zones(void)
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..058b9e2
+index 0000000..849ba36
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1133 @@
+@@ -0,0 +1,1139 @@
 +#
 +# grecurity configuration
 +#
@@ -63927,6 +63860,9 @@ index 0000000..058b9e2
 +	  to allow informative logs to be produced, but large enough to
 +	  prevent flooding.
 +
++	  Setting both this value and GRKERNSEC_FLOODBURST to 0 will disable
++	  any rate limiting on grsecurity log messages.
++
 +config GRKERNSEC_FLOODBURST
 +	int "Number of messages in a burst (maximum)"
 +	default 6
@@ -63937,6 +63873,9 @@ index 0000000..058b9e2
 +	  many of your logs are being interpreted as flooding, you may want to
 +	  raise this value.
 +
++	  Setting both this value and GRKERNSEC_FLOODTIME to 0 will disable
++	  any rate limiting on grsecurity log messages.
++
 +endmenu
 diff --git a/grsecurity/Makefile b/grsecurity/Makefile
 new file mode 100644
@@ -64000,7 +63939,7 @@ index 0000000..5307c8a
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..bd57acb
+index 0000000..8532ed2
 --- /dev/null
 +++ b/grsecurity/gracl.c
 @@ -0,0 +1,2826 @@
@@ -66822,12 +66761,12 @@ index 0000000..bd57acb
 +
 +
 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
-+EXPORT_SYMBOL(gr_acl_is_enabled);
++EXPORT_SYMBOL_GPL(gr_acl_is_enabled);
 +#endif
-+EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL_GPL(gr_learn_resource);
 +#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
++EXPORT_SYMBOL_GPL(gr_check_user_change);
++EXPORT_SYMBOL_GPL(gr_check_group_change);
 +#endif
 +
 diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
@@ -70621,7 +70560,7 @@ index 0000000..bc0be01
 +}
 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
 new file mode 100644
-index 0000000..6b654b0
+index 0000000..12eb2bd
 --- /dev/null
 +++ b/grsecurity/grsec_chroot.c
 @@ -0,0 +1,353 @@
@@ -70762,7 +70701,7 @@ index 0000000..6b654b0
 +	return 0;
 +}
 +
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
++EXPORT_SYMBOL_GPL(gr_pid_is_chrooted);
 +
 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
@@ -70980,7 +70919,7 @@ index 0000000..6b654b0
 +}
 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
 new file mode 100644
-index 0000000..91cef85
+index 0000000..dcc6b9f
 --- /dev/null
 +++ b/grsecurity/grsec_disabled.c
 @@ -0,0 +1,441 @@
@@ -71420,14 +71359,14 @@ index 0000000..91cef85
 +	return;
 +}
 +
-+EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL_GPL(gr_learn_resource);
 +#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
++EXPORT_SYMBOL_GPL(gr_check_user_change);
++EXPORT_SYMBOL_GPL(gr_check_group_change);
 +#endif
 diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
 new file mode 100644
-index 0000000..ee1f60f
+index 0000000..c6db3ee
 --- /dev/null
 +++ b/grsecurity/grsec_exec.c
 @@ -0,0 +1,159 @@
@@ -71588,8 +71527,8 @@ index 0000000..ee1f60f
 +#endif
 +}
 +
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
++EXPORT_SYMBOL_GPL(gr_is_capable);
++EXPORT_SYMBOL_GPL(gr_is_capable_nolog);
 diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
 new file mode 100644
 index 0000000..d3ee748
@@ -71651,7 +71590,7 @@ index 0000000..8ca18bf
 +}
 diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
 new file mode 100644
-index 0000000..454a98e
+index 0000000..7bcfc7a
 --- /dev/null
 +++ b/grsecurity/grsec_init.c
 @@ -0,0 +1,272 @@
@@ -71703,7 +71642,7 @@ index 0000000..454a98e
 +int grsec_tpe_gid;
 +int grsec_enable_blackhole;
 +#ifdef CONFIG_IPV6_MODULE
-+EXPORT_SYMBOL(grsec_enable_blackhole);
++EXPORT_SYMBOL_GPL(grsec_enable_blackhole);
 +#endif
 +int grsec_lastack_retries;
 +int grsec_enable_tpe_all;
@@ -72390,16 +72329,24 @@ index 0000000..56b5e9d
 +}
 diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
 new file mode 100644
-index 0000000..f536303
+index 0000000..0e39d8c
 --- /dev/null
 +++ b/grsecurity/grsec_mem.c
-@@ -0,0 +1,40 @@
+@@ -0,0 +1,48 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/mm.h>
 +#include <linux/mman.h>
++#include <linux/module.h>
 +#include <linux/grinternal.h>
 +
++void gr_handle_msr_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_MSRWRITE_MSG);
++	return;
++}
++EXPORT_SYMBOL_GPL(gr_handle_msr_write);
++
 +void
 +gr_handle_ioperm(void)
 +{
@@ -72845,7 +72792,7 @@ index 0000000..c6a07aa
 +}
 diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
 new file mode 100644
-index 0000000..4030d57
+index 0000000..c0aef3a
 --- /dev/null
 +++ b/grsecurity/grsec_sock.c
 @@ -0,0 +1,244 @@
@@ -72865,14 +72812,14 @@ index 0000000..4030d57
 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
 +
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
++EXPORT_SYMBOL_GPL(gr_search_udp_recvmsg);
++EXPORT_SYMBOL_GPL(gr_search_udp_sendmsg);
 +
 +#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
++EXPORT_SYMBOL_GPL(gr_acl_handle_unix);
++EXPORT_SYMBOL_GPL(gr_acl_handle_mknod);
++EXPORT_SYMBOL_GPL(gr_handle_chroot_unix);
++EXPORT_SYMBOL_GPL(gr_handle_create);
 +#endif
 +
 +#ifdef CONFIG_GRKERNSEC
@@ -73578,7 +73525,7 @@ index 0000000..0d4723d
 +#endif
 diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
 new file mode 100644
-index 0000000..0dc13c3
+index 0000000..61b514e
 --- /dev/null
 +++ b/grsecurity/grsec_time.c
 @@ -0,0 +1,16 @@
@@ -73597,7 +73544,7 @@ index 0000000..0dc13c3
 +	return;
 +}
 +
-+EXPORT_SYMBOL(gr_log_timechange);
++EXPORT_SYMBOL_GPL(gr_log_timechange);
 diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
 new file mode 100644
 index 0000000..07e0dc0
@@ -76854,10 +76801,10 @@ index 0000000..7dc4203
 +#endif
 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
 new file mode 100644
-index 0000000..195cbe4
+index 0000000..ba93581
 --- /dev/null
 +++ b/include/linux/grmsg.h
-@@ -0,0 +1,115 @@
+@@ -0,0 +1,116 @@
 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -76973,12 +76920,13 @@ index 0000000..195cbe4
 +#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds.  Please investigate the crash report for "
 +#define GR_BRUTE_SUID_MSG "bruteforce prevention initiated due to crash of %.950s against uid %u, banning suid/sgid execs for %u minutes.  Please investigate the crash report for "
 +#define GR_IPC_DENIED_MSG "denied %s of overly-permissive IPC object with creator uid %u by "
++#define GR_MSRWRITE_MSG "denied write to CPU MSR by "
 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
 new file mode 100644
-index 0000000..8996115
+index 0000000..f253c0e
 --- /dev/null
 +++ b/include/linux/grsecurity.h
-@@ -0,0 +1,224 @@
+@@ -0,0 +1,225 @@
 +#ifndef GR_SECURITY_H
 +#define GR_SECURITY_H
 +#include <linux/fs.h>
@@ -77039,6 +76987,7 @@ index 0000000..8996115
 +
 +void gr_handle_ioperm(void);
 +void gr_handle_iopl(void);
++void gr_handle_msr_write(void);
 +
 +umode_t gr_acl_umask(void);
 +
@@ -78482,7 +78431,7 @@ index bd4f6c7..e9b8bb8 100644
  struct iovec;
  struct kvec;
 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 8c43fd1..782342e 100644
+index 4b04097..43bda9d 100644
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
 @@ -949,6 +949,7 @@ struct net_device_ops {
@@ -78502,7 +78451,7 @@ index 8c43fd1..782342e 100644
  					     * Do not use this in drivers.
  					     */
  
-@@ -2585,7 +2586,7 @@ static inline int netif_is_bond_slave(struct net_device *dev)
+@@ -2594,7 +2595,7 @@ static inline int netif_is_bond_slave(struct net_device *dev)
  	return dev->flags & IFF_SLAVE && dev->priv_flags & IFF_BONDING;
  }
  
@@ -79219,7 +79168,7 @@ index 2148b12..519b820 100644
  
  static inline void anon_vma_merge(struct vm_area_struct *vma,
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 312d047..a357e91 100644
+index c17fdfb..90df630 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -101,6 +101,7 @@ struct bio_list;
@@ -79335,7 +79284,7 @@ index 312d047..a357e91 100644
  
  struct load_weight {
  	unsigned long weight, inv_weight;
-@@ -1305,6 +1343,8 @@ struct task_struct {
+@@ -1306,6 +1344,8 @@ struct task_struct {
  				 * execve */
  	unsigned in_iowait:1;
  
@@ -79344,7 +79293,7 @@ index 312d047..a357e91 100644
  
  	/* Revert to default priority/policy when forking */
  	unsigned sched_reset_on_fork:1;
-@@ -1345,8 +1385,8 @@ struct task_struct {
+@@ -1346,8 +1386,8 @@ struct task_struct {
  	struct list_head thread_group;
  
  	struct completion *vfork_done;		/* for vfork() */
@@ -79355,7 +79304,7 @@ index 312d047..a357e91 100644
  
  	cputime_t utime, stime, utimescaled, stimescaled;
  	cputime_t gtime;
-@@ -1362,13 +1402,6 @@ struct task_struct {
+@@ -1363,13 +1403,6 @@ struct task_struct {
  	struct task_cputime cputime_expires;
  	struct list_head cpu_timers[3];
  
@@ -79369,7 +79318,7 @@ index 312d047..a357e91 100644
  	char comm[TASK_COMM_LEN]; /* executable name excluding path
  				     - access with [gs]et_task_comm (which lock
  				       it with task_lock())
-@@ -1385,8 +1418,16 @@ struct task_struct {
+@@ -1386,8 +1419,16 @@ struct task_struct {
  #endif
  /* CPU-specific state of this task */
  	struct thread_struct thread;
@@ -79386,7 +79335,7 @@ index 312d047..a357e91 100644
  /* open file information */
  	struct files_struct *files;
  /* namespaces */
-@@ -1409,7 +1450,7 @@ struct task_struct {
+@@ -1410,7 +1451,7 @@ struct task_struct {
  	uid_t loginuid;
  	unsigned int sessionid;
  #endif
@@ -79395,7 +79344,7 @@ index 312d047..a357e91 100644
  
  /* Thread group tracking */
     	u32 parent_exec_id;
-@@ -1433,6 +1474,11 @@ struct task_struct {
+@@ -1434,6 +1475,11 @@ struct task_struct {
  	struct rt_mutex_waiter *pi_blocked_on;
  #endif
  
@@ -79407,7 +79356,7 @@ index 312d047..a357e91 100644
  #ifdef CONFIG_DEBUG_MUTEXES
  	/* mutex deadlock detection */
  	struct mutex_waiter *blocked_on;
-@@ -1548,6 +1594,30 @@ struct task_struct {
+@@ -1549,6 +1595,30 @@ struct task_struct {
  	unsigned long default_timer_slack_ns;
  
  	struct list_head	*scm_work_list;
@@ -79438,7 +79387,7 @@ index 312d047..a357e91 100644
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  	/* Index of current stored address in ret_stack */
  	int curr_ret_stack;
-@@ -1580,7 +1650,54 @@ struct task_struct {
+@@ -1581,7 +1651,54 @@ struct task_struct {
  #ifdef CONFIG_HAVE_HW_BREAKPOINT
  	atomic_t ptrace_bp_refcnt;
  #endif
@@ -79494,7 +79443,7 @@ index 312d047..a357e91 100644
  
  /* Future-safe accessor for struct task_struct's cpus_allowed. */
  #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
-@@ -2097,7 +2214,9 @@ void yield(void);
+@@ -2098,7 +2215,9 @@ void yield(void);
  extern struct exec_domain	default_exec_domain;
  
  union thread_union {
@@ -79504,7 +79453,7 @@ index 312d047..a357e91 100644
  	unsigned long stack[THREAD_SIZE/sizeof(long)];
  };
  
-@@ -2130,6 +2249,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2131,6 +2250,7 @@ extern struct pid_namespace init_pid_ns;
   */
  
  extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -79512,7 +79461,7 @@ index 312d047..a357e91 100644
  extern struct task_struct *find_task_by_pid_ns(pid_t nr,
  		struct pid_namespace *ns);
  
-@@ -2251,6 +2371,12 @@ static inline void mmdrop(struct mm_struct * mm)
+@@ -2252,6 +2372,12 @@ static inline void mmdrop(struct mm_struct * mm)
  extern void mmput(struct mm_struct *);
  /* Grab a reference to a task's mm, if it is not already going away */
  extern struct mm_struct *get_task_mm(struct task_struct *task);
@@ -79525,7 +79474,7 @@ index 312d047..a357e91 100644
  /* Remove the current tasks stale references to the old mm_struct */
  extern void mm_release(struct task_struct *, struct mm_struct *);
  /* Allocate a new mm structure and copy contents from tsk->mm */
-@@ -2267,9 +2393,8 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2268,9 +2394,8 @@ extern void __cleanup_sighand(struct sighand_struct *);
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -79536,7 +79485,7 @@ index 312d047..a357e91 100644
  extern int allow_signal(int);
  extern int disallow_signal(int);
  
-@@ -2432,9 +2557,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2433,9 +2558,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
  
  #endif
  
@@ -87037,10 +86986,10 @@ index 3d9f31c..7fefc9e 100644
  
  	default:
 diff --git a/kernel/sched.c b/kernel/sched.c
-index d93369a..700af59 100644
+index ea85b0d..e0b6326 100644
 --- a/kernel/sched.c
 +++ b/kernel/sched.c
-@@ -5046,7 +5046,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
+@@ -5050,7 +5050,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
   * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
   * positive (at least 1, or number of jiffies left till timeout) if completed.
   */
@@ -87049,7 +86998,7 @@ index d93369a..700af59 100644
  wait_for_completion_interruptible_timeout(struct completion *x,
  					  unsigned long timeout)
  {
-@@ -5063,7 +5063,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
+@@ -5067,7 +5067,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
   *
   * The return value is -ERESTARTSYS if interrupted, 0 if completed.
   */
@@ -87058,7 +87007,7 @@ index d93369a..700af59 100644
  {
  	long t = wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_KILLABLE);
  	if (t == -ERESTARTSYS)
-@@ -5084,7 +5084,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
+@@ -5088,7 +5088,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
   * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
   * positive (at least 1, or number of jiffies left till timeout) if completed.
   */
@@ -87067,7 +87016,7 @@ index d93369a..700af59 100644
  wait_for_completion_killable_timeout(struct completion *x,
  				     unsigned long timeout)
  {
-@@ -5293,6 +5293,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -5297,6 +5297,8 @@ int can_nice(const struct task_struct *p, const int nice)
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = 20 - nice;
  
@@ -87076,7 +87025,7 @@ index d93369a..700af59 100644
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -5326,7 +5328,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -5330,7 +5332,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (nice > 19)
  		nice = 19;
  
@@ -87086,7 +87035,7 @@ index d93369a..700af59 100644
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -5483,6 +5486,7 @@ recheck:
+@@ -5487,6 +5490,7 @@ recheck:
  			unsigned long rlim_rtprio =
  					task_rlimit(p, RLIMIT_RTPRIO);
  
@@ -87094,7 +87043,7 @@ index d93369a..700af59 100644
  			/* can't set/change the rt policy */
  			if (policy != p->policy && !rlim_rtprio)
  				return -EPERM;
-@@ -6626,7 +6630,7 @@ static void migrate_tasks(unsigned int dead_cpu)
+@@ -6629,7 +6633,7 @@ static void unthrottle_offline_cfs_rqs(struct rq *rq) {}
  
  #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
  
@@ -87103,7 +87052,7 @@ index d93369a..700af59 100644
  	{
  		.procname	= "sched_domain",
  		.mode		= 0555,
-@@ -6643,17 +6647,17 @@ static struct ctl_table sd_ctl_root[] = {
+@@ -6646,17 +6650,17 @@ static struct ctl_table sd_ctl_root[] = {
  	{}
  };
  
@@ -87125,7 +87074,7 @@ index d93369a..700af59 100644
  
  	/*
  	 * In the intermediate directories, both the child directory and
-@@ -6661,22 +6665,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -6664,22 +6668,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
  	 * will always be set. In the lowest directory the names are
  	 * static strings and all have proc handlers.
  	 */
@@ -87157,7 +87106,7 @@ index d93369a..700af59 100644
  		const char *procname, void *data, int maxlen,
  		mode_t mode, proc_handler *proc_handler,
  		bool load_idx)
-@@ -6696,7 +6703,7 @@ set_table_entry(struct ctl_table *entry,
+@@ -6699,7 +6706,7 @@ set_table_entry(struct ctl_table *entry,
  static struct ctl_table *
  sd_alloc_ctl_domain_table(struct sched_domain *sd)
  {
@@ -87166,7 +87115,7 @@ index d93369a..700af59 100644
  
  	if (table == NULL)
  		return NULL;
-@@ -6731,9 +6738,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -6734,9 +6741,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
  	return table;
  }
  
@@ -87178,7 +87127,7 @@ index d93369a..700af59 100644
  	struct sched_domain *sd;
  	int domain_num = 0, i;
  	char buf[32];
-@@ -6760,11 +6767,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -6763,11 +6770,13 @@ static struct ctl_table_header *sd_sysctl_header;
  static void register_sched_domain_sysctl(void)
  {
  	int i, cpu_num = num_possible_cpus();
@@ -87193,7 +87142,7 @@ index d93369a..700af59 100644
  
  	if (entry == NULL)
  		return;
-@@ -6787,8 +6796,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -6790,8 +6799,12 @@ static void unregister_sched_domain_sysctl(void)
  	if (sd_sysctl_header)
  		unregister_sysctl_table(sd_sysctl_header);
  	sd_sysctl_header = NULL;
@@ -87208,7 +87157,7 @@ index d93369a..700af59 100644
  }
  #else
  static void register_sched_domain_sysctl(void)
-@@ -6886,7 +6899,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+@@ -6889,7 +6902,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
   * happens before everything else.  This has to be lower priority than
   * the notifier in the perf_event subsystem, though.
   */
@@ -87240,7 +87189,7 @@ index f280df1..da1281d 100644
  #ifdef CONFIG_RT_GROUP_SCHED
  	/*
 diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
-index 5b9e456..03c74cd 100644
+index 37f3f39..6d3b6e1 100644
 --- a/kernel/sched_fair.c
 +++ b/kernel/sched_fair.c
 @@ -4803,7 +4803,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
@@ -88946,7 +88895,7 @@ index 16fc34a..efd8bb8 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index d40d7f6..b4e9662 100644
+index cf8b439..fe97a05 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
 @@ -1598,12 +1598,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
@@ -90949,10 +90898,10 @@ index ed0ed8a..cc835b9 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index ddf2128..af57f40 100644
+index 3a5aae2..ef6f89a 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
-@@ -1990,15 +1990,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+@@ -2007,15 +2007,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
  	struct hstate *h = &default_hstate;
  	unsigned long tmp;
  	int ret;
@@ -90973,7 +90922,7 @@ index ddf2128..af57f40 100644
  	if (ret)
  		goto out;
  
-@@ -2055,15 +2057,17 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
+@@ -2072,15 +2074,17 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
  	struct hstate *h = &default_hstate;
  	unsigned long tmp;
  	int ret;
@@ -90994,7 +90943,7 @@ index ddf2128..af57f40 100644
  	if (ret)
  		goto out;
  
-@@ -2482,6 +2486,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2499,6 +2503,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
  	return 1;
  }
  
@@ -91022,7 +90971,7 @@ index ddf2128..af57f40 100644
  /*
   * Hugetlb_cow() should be called with page lock of the original hugepage held.
   */
-@@ -2584,6 +2609,11 @@ retry_avoidcopy:
+@@ -2601,6 +2626,11 @@ retry_avoidcopy:
  				make_huge_pte(vma, new_page, 1));
  		page_remove_rmap(old_page);
  		hugepage_add_new_anon_rmap(new_page, vma, address);
@@ -91034,7 +90983,7 @@ index ddf2128..af57f40 100644
  		/* Make the old page be freed below */
  		new_page = old_page;
  		mmu_notifier_invalidate_range_end(mm,
-@@ -2735,6 +2765,10 @@ retry:
+@@ -2752,6 +2782,10 @@ retry:
  				&& (vma->vm_flags & VM_SHARED)));
  	set_huge_pte_at(mm, address, ptep, new_pte);
  
@@ -91045,7 +90994,7 @@ index ddf2128..af57f40 100644
  	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
  		/* Optimization, do the COW without a second fault */
  		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2764,6 +2798,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2781,6 +2815,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
  	struct hstate *h = hstate_vma(vma);
  
@@ -91056,7 +91005,7 @@ index ddf2128..af57f40 100644
  	ptep = huge_pte_offset(mm, address);
  	if (ptep) {
  		entry = huge_ptep_get(ptep);
-@@ -2775,6 +2813,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2792,6 +2830,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  			       VM_FAULT_SET_HINDEX(h - hstates);
  	}
  
@@ -91220,7 +91169,7 @@ index 23d3a6b..e10d35a 100644
  	if (end == start)
  		goto out;
 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
-index 1b03878..d62c02b 100644
+index 96c4bcf..436254e 100644
 --- a/mm/memory-failure.c
 +++ b/mm/memory-failure.c
 @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
@@ -91295,16 +91244,23 @@ index 1b03878..d62c02b 100644
  		freeit = 1;
  		if (PageHuge(page))
  			clear_page_hwpoison_huge_page(page);
-@@ -1442,7 +1442,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
+@@ -1444,13 +1444,13 @@ done:
+ 	/* overcommit hugetlb page will be freed to buddy */
+ 	if (PageHuge(hpage)) {
+ 		if (!PageHWPoison(hpage))
+-			atomic_long_add(1 << compound_trans_order(hpage),
++			atomic_long_add_unchecked(1 << compound_trans_order(hpage),
+ 					&mce_bad_pages);
+ 		set_page_hwpoison_huge_page(hpage);
+ 		dequeue_hwpoisoned_huge_page(hpage);
+ 	} else {
+ 		SetPageHWPoison(page);
+-		atomic_long_inc(&mce_bad_pages);
++		atomic_long_inc_unchecked(&mce_bad_pages);
  	}
- done:
- 	if (!PageHWPoison(hpage))
--		atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
-+		atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
- 	set_page_hwpoison_huge_page(hpage);
- 	dequeue_hwpoisoned_huge_page(hpage);
+ 
  	/* keep elevated page count for bad page */
-@@ -1581,7 +1581,7 @@ int soft_offline_page(struct page *page, int flags)
+@@ -1589,7 +1589,7 @@ int soft_offline_page(struct page *page, int flags)
  		return ret;
  
  done:
@@ -92240,7 +92196,7 @@ index 1ffd97a..240aa20 100644
  int mminit_loglevel;
  
 diff --git a/mm/mmap.c b/mm/mmap.c
-index dff37a6..49e182f 100644
+index 6182c8a..7d532cf 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -30,6 +30,7 @@
@@ -92761,7 +92717,7 @@ index dff37a6..49e182f 100644
  	unsigned long start_addr;
 +	unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
  
- 	if (len > TASK_SIZE)
+ 	if (len > TASK_SIZE - mmap_min_addr)
  		return -ENOMEM;
 @@ -1374,18 +1623,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	if (flags & MAP_FIXED)
@@ -92774,12 +92730,12 @@ index dff37a6..49e182f 100644
  	if (addr) {
  		addr = PAGE_ALIGN(addr);
 -		vma = find_vma(mm, addr);
--		if (TASK_SIZE - len >= addr &&
+-		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
 -		    (!vma || addr + len <= vma->vm_start))
 -			return addr;
 +		if (TASK_SIZE - len >= addr) {
 +			vma = find_vma(mm, addr);
-+			if (check_heap_stack_gap(vma, &addr, len, offset))
++			if (addr >= mmap_min_addr && check_heap_stack_gap(vma, &addr, len, offset))
 +				return addr;
 +		}
  	}
@@ -92853,10 +92809,10 @@ index dff37a6..49e182f 100644
 -	unsigned long addr = addr0;
 +	unsigned long base = mm->mmap_base, addr = addr0;
 +	unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
+ 	unsigned long low_limit = max(PAGE_SIZE, mmap_min_addr);
  
  	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -1450,13 +1711,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1451,13 +1712,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -92868,10 +92824,10 @@ index dff37a6..49e182f 100644
  	if (addr) {
  		addr = PAGE_ALIGN(addr);
 -		vma = find_vma(mm, addr);
--		if (TASK_SIZE - len >= addr &&
+-		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
 -				(!vma || addr + len <= vma->vm_start))
 -			return addr;
-+		if (TASK_SIZE - len >= addr) {
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr) {
 +			vma = find_vma(mm, addr);
 +			if (check_heap_stack_gap(vma, &addr, len, offset))
 +				return addr;
@@ -92879,10 +92835,10 @@ index dff37a6..49e182f 100644
  	}
  
  	/* check if free_area_cache is useful for us */
-@@ -1470,10 +1736,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1471,10 +1737,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  
  	/* make sure it can fit in the remaining address space */
- 	if (addr > len) {
+ 	if (addr >= low_limit + len) {
 -		vma = find_vma(mm, addr-len);
 -		if (!vma || addr <= vma->vm_start)
 +		addr -= len;
@@ -92893,8 +92849,8 @@ index dff37a6..49e182f 100644
 +			return (mm->free_area_cache = addr);
  	}
  
- 	if (mm->mmap_base < len)
-@@ -1488,7 +1755,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	if (mm->mmap_base < low_limit + len)
+@@ -1489,7 +1756,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  		 * return with success:
  		 */
  		vma = find_vma(mm, addr);
@@ -92903,18 +92859,18 @@ index dff37a6..49e182f 100644
  			/* remember the address as a hint for next time */
  			return (mm->free_area_cache = addr);
  
-@@ -1497,8 +1764,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1498,8 +1765,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
   		        mm->cached_hole_size = vma->vm_start - addr;
  
  		/* try just below the current vma->vm_start */
 -		addr = vma->vm_start-len;
--	} while (len < vma->vm_start);
+-	} while (vma->vm_start >= low_limit + len);
 +		addr = skip_heap_stack_gap(vma, len, offset);
-+	} while (!IS_ERR_VALUE(addr));
++	} while (!IS_ERR_VALUE(addr) && addr >= low_limit);
  
  bottomup:
  	/*
-@@ -1507,13 +1774,21 @@ bottomup:
+@@ -1508,13 +1775,21 @@ bottomup:
  	 * can happen with large stack limits and large mmap()
  	 * allocations.
  	 */
@@ -92938,7 +92894,7 @@ index dff37a6..49e182f 100644
  	mm->cached_hole_size = ~0UL;
  
  	return addr;
-@@ -1522,6 +1797,12 @@ bottomup:
+@@ -1523,6 +1798,12 @@ bottomup:
  
  void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
  {
@@ -92951,7 +92907,7 @@ index dff37a6..49e182f 100644
  	/*
  	 * Is this a new hole at the highest possible address?
  	 */
-@@ -1529,8 +1810,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+@@ -1530,8 +1811,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
  		mm->free_area_cache = addr;
  
  	/* dont allow allocations above current base */
@@ -92963,7 +92919,7 @@ index dff37a6..49e182f 100644
  }
  
  unsigned long
-@@ -1603,40 +1886,50 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+@@ -1604,40 +1887,50 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
  
  EXPORT_SYMBOL(find_vma);
  
@@ -93039,7 +92995,7 @@ index dff37a6..49e182f 100644
  
  /*
   * Verify that the stack growth is acceptable and
-@@ -1654,6 +1947,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1655,6 +1948,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		return -ENOMEM;
  
  	/* Stack limit test */
@@ -93047,7 +93003,7 @@ index dff37a6..49e182f 100644
  	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
  		return -ENOMEM;
  
-@@ -1664,6 +1958,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1665,6 +1959,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		locked = mm->locked_vm + grow;
  		limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
  		limit >>= PAGE_SHIFT;
@@ -93055,7 +93011,7 @@ index dff37a6..49e182f 100644
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -1682,7 +1977,6 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1683,7 +1978,6 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		return -ENOMEM;
  
  	/* Ok, everything looks good - let it rip */
@@ -93063,7 +93019,7 @@ index dff37a6..49e182f 100644
  	if (vma->vm_flags & VM_LOCKED)
  		mm->locked_vm += grow;
  	vm_stat_account(mm, vma->vm_flags, vma->vm_file, grow);
-@@ -1694,37 +1988,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1695,37 +1989,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -93121,7 +93077,7 @@ index dff37a6..49e182f 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -1739,6 +2044,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -1740,6 +2045,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  			}
  		}
  	}
@@ -93130,7 +93086,7 @@ index dff37a6..49e182f 100644
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma);
  	return error;
-@@ -1752,6 +2059,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1753,6 +2060,8 @@ int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -93139,7 +93095,7 @@ index dff37a6..49e182f 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -1765,6 +2074,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1766,6 +2075,15 @@ int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -93155,7 +93111,7 @@ index dff37a6..49e182f 100644
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -1774,9 +2092,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1775,9 +2093,17 @@ int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -93174,7 +93130,7 @@ index dff37a6..49e182f 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -1786,18 +2112,48 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1787,18 +2113,48 @@ int expand_downwards(struct vm_area_struct *vma,
  			if (!error) {
  				vma->vm_start = address;
  				vma->vm_pgoff -= grow;
@@ -93223,7 +93179,7 @@ index dff37a6..49e182f 100644
  	return expand_upwards(vma, address);
  }
  
-@@ -1820,6 +2176,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
+@@ -1821,6 +2177,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
  #else
  int expand_stack(struct vm_area_struct *vma, unsigned long address)
  {
@@ -93238,7 +93194,7 @@ index dff37a6..49e182f 100644
  	return expand_downwards(vma, address);
  }
  
-@@ -1860,7 +2224,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -1861,7 +2225,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -93253,7 +93209,7 @@ index dff37a6..49e182f 100644
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
  		vma = remove_vma(vma);
  	} while (vma);
-@@ -1905,6 +2275,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -1906,6 +2276,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -93270,7 +93226,7 @@ index dff37a6..49e182f 100644
  		rb_erase(&vma->vm_rb, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -1933,14 +2313,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1934,14 +2314,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -93304,7 +93260,7 @@ index dff37a6..49e182f 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -1953,6 +2352,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1954,6 +2353,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -93327,7 +93283,7 @@ index dff37a6..49e182f 100644
  	pol = mpol_dup(vma_policy(vma));
  	if (IS_ERR(pol)) {
  		err = PTR_ERR(pol);
-@@ -1978,6 +2393,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1979,6 +2394,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -93370,7 +93326,7 @@ index dff37a6..49e182f 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -1990,10 +2441,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1991,10 +2442,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  			removed_exe_file_vma(mm);
  		fput(new->vm_file);
  	}
@@ -93390,7 +93346,7 @@ index dff37a6..49e182f 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2006,6 +2465,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2007,6 +2466,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -93406,7 +93362,7 @@ index dff37a6..49e182f 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2017,11 +2485,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2018,11 +2486,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -93437,7 +93393,7 @@ index dff37a6..49e182f 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2096,6 +2583,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2097,6 +2584,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -93446,7 +93402,7 @@ index dff37a6..49e182f 100644
  	return 0;
  }
  
-@@ -2108,22 +2597,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2109,22 +2598,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  
  	profile_munmap(addr);
  
@@ -93475,7 +93431,7 @@ index dff37a6..49e182f 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2137,6 +2622,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2138,6 +2623,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -93483,7 +93439,7 @@ index dff37a6..49e182f 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2148,16 +2634,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2149,16 +2635,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -93515,7 +93471,7 @@ index dff37a6..49e182f 100644
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-@@ -2174,22 +2674,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2175,22 +2675,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -93542,7 +93498,7 @@ index dff37a6..49e182f 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2203,7 +2703,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2204,7 +2704,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -93551,7 +93507,7 @@ index dff37a6..49e182f 100644
  		return -ENOMEM;
  	}
  
-@@ -2217,11 +2717,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2218,11 +2718,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -93566,7 +93522,7 @@ index dff37a6..49e182f 100644
  	return addr;
  }
  
-@@ -2268,8 +2769,10 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2269,8 +2770,10 @@ void exit_mmap(struct mm_struct *mm)
  	 * Walk the list again, actually closing and freeing it,
  	 * with preemption enabled, without holding any MM locks.
  	 */
@@ -93578,7 +93534,7 @@ index dff37a6..49e182f 100644
  
  	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
  }
-@@ -2283,6 +2786,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2284,6 +2787,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	struct vm_area_struct * __vma, * prev;
  	struct rb_node ** rb_link, * rb_parent;
  
@@ -93592,7 +93548,7 @@ index dff37a6..49e182f 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2305,7 +2815,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2306,7 +2816,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	if ((vma->vm_flags & VM_ACCOUNT) &&
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
@@ -93615,7 +93571,7 @@ index dff37a6..49e182f 100644
  	return 0;
  }
  
-@@ -2323,6 +2848,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2324,6 +2849,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	struct mempolicy *pol;
  
@@ -93624,7 +93580,7 @@ index dff37a6..49e182f 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2373,6 +2900,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2374,6 +2901,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -93664,7 +93620,7 @@ index dff37a6..49e182f 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2384,6 +2944,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2385,6 +2945,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
@@ -93672,7 +93628,7 @@ index dff37a6..49e182f 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2454,6 +3015,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2455,6 +3016,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -95570,23 +95526,20 @@ index 1b7e22a..3fcd4f3 100644
  	return pgd;
  }
 diff --git a/mm/swap.c b/mm/swap.c
-index 55b266d..a532537 100644
+index a4b9016..d1a1b68 100644
 --- a/mm/swap.c
 +++ b/mm/swap.c
-@@ -31,6 +31,7 @@
- #include <linux/backing-dev.h>
- #include <linux/memcontrol.h>
- #include <linux/gfp.h>
-+#include <linux/hugetlb.h>
- 
- #include "internal.h"
- 
-@@ -71,6 +72,8 @@ static void __put_compound_page(struct page *page)
+@@ -70,9 +70,11 @@ static void __put_compound_page(struct page *page)
+ {
+ 	compound_page_dtor *dtor;
  
- 	__page_cache_release(page);
+-	if (!PageHuge(page))
+-		__page_cache_release(page);
  	dtor = get_compound_page_dtor(page);
-+	if (!PageHuge(page))
++	if (!PageHuge(page)) {
 +		BUG_ON(dtor != free_compound_page);
++		__page_cache_release(page);
++	}
  	(*dtor)(page);
  }
  
@@ -96008,6 +95961,22 @@ index fdfdb57..38d368c 100644
  	set_fs(oldfs);
  
  	if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 55f0c09..d5bf348 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -324,7 +324,10 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
+ 		int count = nr_pages;
+ 		while (nr_pages) {
+ 			s = rest_of_page(data);
+-			pages[index++] = kmap_to_page(data);
++			if (is_vmalloc_addr(data))
++				pages[index++] = vmalloc_to_page(data);
++			else
++				pages[index++] = kmap_to_page(data);
+ 			data += s;
+ 			nr_pages--;
+ 		}
 diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
 index f41f026..fe76ea8 100644
 --- a/net/atm/atm_misc.c
@@ -96447,7 +96416,7 @@ index 14c4864..77ff888 100644
  			err = -EFAULT;
  			break;
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index a06deca..2269299 100644
+index 2157984..430c7e1 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
 @@ -1410,7 +1410,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
@@ -97953,10 +97922,10 @@ index 907ef2c..eba7111 100644
  
  void inet_get_local_port_range(int *low, int *high)
 diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index ccee270..2b3d4de 100644
+index 6be5e8e..22df23e 100644
 --- a/net/ipv4/inet_diag.c
 +++ b/net/ipv4/inet_diag.c
-@@ -114,11 +114,21 @@ static int inet_csk_diag_fill(struct sock *sk,
+@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct sock *sk,
  	r->idiag_retrans = 0;
  
  	r->id.idiag_if = sk->sk_bound_dev_if;
@@ -97971,18 +97940,9 @@ index ccee270..2b3d4de 100644
  
  	r->id.idiag_sport = inet->inet_sport;
  	r->id.idiag_dport = inet->inet_dport;
-+
-+	memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-+	memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-+
- 	r->id.idiag_src[0] = inet->inet_rcv_saddr;
- 	r->id.idiag_dst[0] = inet->inet_daddr;
- 
-@@ -209,13 +219,26 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
- 
- 	r->idiag_family	      = tw->tw_family;
+@@ -215,8 +221,14 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
  	r->idiag_retrans      = 0;
-+
+ 
  	r->id.idiag_if	      = tw->tw_bound_dev_if;
 +
 +#ifdef CONFIG_GRKERNSEC_HIDESYM
@@ -97992,20 +97952,10 @@ index ccee270..2b3d4de 100644
  	r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
  	r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
 +#endif
-+
+ 
  	r->id.idiag_sport     = tw->tw_sport;
  	r->id.idiag_dport     = tw->tw_dport;
-+
-+	memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-+	memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-+
- 	r->id.idiag_src[0]    = tw->tw_rcv_saddr;
- 	r->id.idiag_dst[0]    = tw->tw_daddr;
-+
- 	r->idiag_state	      = tw->tw_substate;
- 	r->idiag_timer	      = 3;
- 	r->idiag_expires      = DIV_ROUND_UP(tmo * 1000, HZ);
-@@ -294,12 +317,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
+@@ -305,12 +317,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
  	if (sk == NULL)
  		goto unlock;
  
@@ -98020,7 +97970,7 @@ index ccee270..2b3d4de 100644
  
  	err = -ENOMEM;
  	rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
-@@ -589,8 +614,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
+@@ -600,8 +614,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
  	r->idiag_retrans = req->retrans;
  
  	r->id.idiag_if = sk->sk_bound_dev_if;
@@ -98035,20 +97985,6 @@ index ccee270..2b3d4de 100644
  
  	tmo = req->expires - jiffies;
  	if (tmo < 0)
-@@ -598,8 +629,13 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
- 
- 	r->id.idiag_sport = inet->inet_sport;
- 	r->id.idiag_dport = ireq->rmt_port;
-+
-+	memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-+	memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-+
- 	r->id.idiag_src[0] = ireq->loc_addr;
- 	r->id.idiag_dst[0] = ireq->rmt_addr;
-+
- 	r->idiag_expires = jiffies_to_msecs(tmo);
- 	r->idiag_rqueue = 0;
- 	r->idiag_wqueue = 0;
 diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
 index 4afcf31..392d206 100644
 --- a/net/ipv4/inet_hashtables.c
@@ -98229,25 +98165,10 @@ index 99ec116..c5628fe 100644
  	return res;
  }
 diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
-index b5e64e4..69801fa 100644
+index 140d377..69801fa 100644
 --- a/net/ipv4/ipmr.c
 +++ b/net/ipv4/ipmr.c
-@@ -155,9 +155,12 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
- static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
- 			   struct mr_table **mrt)
- {
-+	int err;
- 	struct ipmr_result res;
--	struct fib_lookup_arg arg = { .result = &res, };
--	int err;
-+	struct fib_lookup_arg arg = {
-+		.result = &res,
-+		.flags = FIB_LOOKUP_NOREF,
-+	};
- 
- 	err = fib_rules_lookup(net->ipv4.mr_rules_ops,
- 			       flowi4_to_flowi(flp4), 0, &arg);
-@@ -1320,6 +1323,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
+@@ -1323,6 +1323,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
  		if (get_user(v, (u32 __user *)optval))
  			return -EFAULT;
  
@@ -99237,25 +99158,6 @@ index d3fde7e..f526e49 100644
  }
  
  int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
-diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
-index f5af259..f96c96f 100644
---- a/net/ipv6/ip6mr.c
-+++ b/net/ipv6/ip6mr.c
-@@ -139,9 +139,12 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
- static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
- 			    struct mr6_table **mrt)
- {
-+	int err;
- 	struct ip6mr_result res;
--	struct fib_lookup_arg arg = { .result = &res, };
--	int err;
-+	struct fib_lookup_arg arg = {
-+		.result = &res,
-+		.flags = FIB_LOOKUP_NOREF,
-+	};
- 
- 	err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
- 			       flowi6_to_flowi(flp6), 0, &arg);
 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
 index b204df8..8f274f4 100644
 --- a/net/ipv6/ipv6_sockglue.c
@@ -99459,10 +99361,10 @@ index eba5deb..61e026f 100644
  	return -ENOMEM;
  }
 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 1768238..b28b21a 100644
+index 9a4f437..d13bf8b 100644
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -2812,7 +2812,7 @@ ctl_table ipv6_route_table_template[] = {
+@@ -2808,7 +2808,7 @@ ctl_table ipv6_route_table_template[] = {
  
  struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
  {
@@ -102867,10 +102769,10 @@ index 1983717..4d6102c 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 9338ccc..9bc732b 100644
+index eddfdec..e20439d 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
-@@ -766,6 +766,12 @@ static struct sock *unix_find_other(struct net *net,
+@@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
  		err = -ECONNREFUSED;
  		if (!S_ISSOCK(inode->i_mode))
  			goto put_fail;
@@ -102883,7 +102785,7 @@ index 9338ccc..9bc732b 100644
  		u = unix_find_socket_byinode(inode);
  		if (!u)
  			goto put_fail;
-@@ -786,6 +792,13 @@ static struct sock *unix_find_other(struct net *net,
+@@ -788,6 +794,13 @@ static struct sock *unix_find_other(struct net *net,
  		if (u) {
  			struct dentry *dentry;
  			dentry = unix_sk(u)->dentry;
@@ -102897,7 +102799,7 @@ index 9338ccc..9bc732b 100644
  			if (dentry)
  				touch_atime(unix_sk(u)->mnt, dentry);
  		} else
-@@ -868,11 +881,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+@@ -872,11 +885,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
  		err = security_path_mknod(&path, dentry, mode, 0);
  		if (err)
  			goto out_mknod_drop_write;
@@ -102916,7 +102818,7 @@ index 9338ccc..9bc732b 100644
  		mutex_unlock(&path.dentry->d_inode->i_mutex);
  		dput(path.dentry);
  		path.dentry = dentry;
-@@ -2265,9 +2285,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2269,9 +2289,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -102931,7 +102833,7 @@ index 9338ccc..9bc732b 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2294,8 +2318,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2298,8 +2322,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  			}
  			for ( ; i < len; i++)
  				seq_putc(seq, u->addr->name->sun_path[i]);
@@ -106158,7 +106060,7 @@ index dca1c22..4fa4591 100644
  		lock = &avc_cache.slots_lock[hvalue];
  
 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index 5898f34..04f8b47 100644
+index bcf1d73..04f8b47 100644
 --- a/security/selinux/hooks.c
 +++ b/security/selinux/hooks.c
 @@ -95,8 +95,6 @@
@@ -106170,41 +106072,7 @@ index 5898f34..04f8b47 100644
  /* SECMARK reference count */
  static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  
-@@ -217,6 +215,14 @@ static int inode_alloc_security(struct inode *inode)
- 	return 0;
- }
- 
-+static void inode_free_rcu(struct rcu_head *head)
-+{
-+	struct inode_security_struct *isec;
-+
-+	isec = container_of(head, struct inode_security_struct, rcu);
-+	kmem_cache_free(sel_inode_cache, isec);
-+}
-+
- static void inode_free_security(struct inode *inode)
- {
- 	struct inode_security_struct *isec = inode->i_security;
-@@ -227,8 +233,16 @@ static void inode_free_security(struct inode *inode)
- 		list_del_init(&isec->list);
- 	spin_unlock(&sbsec->isec_lock);
- 
--	inode->i_security = NULL;
--	kmem_cache_free(sel_inode_cache, isec);
-+	/*
-+	 * The inode may still be referenced in a path walk and
-+	 * a call to selinux_inode_permission() can be made
-+	 * after inode_free_security() is called. Ideally, the VFS
-+	 * wouldn't do this, but fixing that is a much harder
-+	 * job. For now, simply free the i_security via RCU, and
-+	 * leave the current inode->i_security pointer intact.
-+	 * The inode will be freed after the RCU grace period too.
-+	 */
-+	call_rcu(&isec->rcu, inode_free_rcu);
- }
- 
- static int file_alloc_security(struct file *file)
-@@ -2001,6 +2015,13 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
+@@ -2017,6 +2015,13 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
  		new_tsec->sid = old_tsec->exec_sid;
  		/* Reset exec SID on execve. */
  		new_tsec->exec_sid = 0;
@@ -106218,7 +106086,7 @@ index 5898f34..04f8b47 100644
  	} else {
  		/* Check for a default transition on this program. */
  		rc = security_transition_sid(old_tsec->sid, isec->sid,
-@@ -2013,7 +2034,8 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
+@@ -2029,7 +2034,8 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
  	COMMON_AUDIT_DATA_INIT(&ad, PATH);
  	ad.u.path = bprm->file->f_path;
  
@@ -106228,33 +106096,7 @@ index 5898f34..04f8b47 100644
  		new_tsec->sid = old_tsec->sid;
  
  	if (new_tsec->sid == old_tsec->sid) {
-@@ -4181,8 +4203,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
- 		}
- 		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
- 				   PEER__RECV, &ad);
--		if (err)
-+		if (err) {
- 			selinux_netlbl_err(skb, err, 0);
-+			return err;
-+		}
- 	}
- 
- 	if (secmark_active) {
-@@ -5372,11 +5396,11 @@ static int selinux_setprocattr(struct task_struct *p,
- 		/* Check for ptracing, and update the task SID if ok.
- 		   Otherwise, leave SID unchanged and fail. */
- 		ptsid = 0;
--		task_lock(p);
-+		rcu_read_lock();
- 		tracer = ptrace_parent(p);
- 		if (tracer)
- 			ptsid = task_sid(tracer);
--		task_unlock(p);
-+		rcu_read_unlock();
- 
- 		if (tracer) {
- 			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
-@@ -5508,7 +5532,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
+@@ -5526,7 +5532,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
  
  #endif
  
@@ -106263,7 +106105,7 @@ index 5898f34..04f8b47 100644
  	.name =				"selinux",
  
  	.ptrace_access_check =		selinux_ptrace_access_check,
-@@ -5854,6 +5878,9 @@ static void selinux_nf_ip_exit(void)
+@@ -5872,6 +5878,9 @@ static void selinux_nf_ip_exit(void)
  #ifdef CONFIG_SECURITY_SELINUX_DISABLE
  static int selinux_disabled;
  
@@ -106273,7 +106115,7 @@ index 5898f34..04f8b47 100644
  int selinux_disable(void)
  {
  	if (ss_initialized) {
-@@ -5871,7 +5898,9 @@ int selinux_disable(void)
+@@ -5889,7 +5898,9 @@ int selinux_disable(void)
  	selinux_disabled = 1;
  	selinux_enabled = 0;
  
@@ -106284,22 +106126,6 @@ index 5898f34..04f8b47 100644
  
  	/* Try to destroy the avc node cache */
  	avc_disable();
-diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
-index 26c7eee..7b1830b 100644
---- a/security/selinux/include/objsec.h
-+++ b/security/selinux/include/objsec.h
-@@ -38,7 +38,10 @@ struct task_security_struct {
- 
- struct inode_security_struct {
- 	struct inode *inode;	/* back pointer to inode object */
--	struct list_head list;	/* list of inode_security_struct */
-+	union {
-+		struct list_head list;	/* list of inode_security_struct */
-+		struct rcu_head rcu;	/* for freeing the inode_security_struct */
-+	};
- 	u32 task_sid;		/* SID of creating task */
- 	u32 sid;		/* SID of this object */
- 	u16 sclass;		/* security class of this object */
 diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
 index b43813c..74be837 100644
 --- a/security/selinux/include/xfrm.h
@@ -107045,7 +106871,7 @@ index 0000000..4c2c45c
 +size_overflow_hash.h
 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
 new file mode 100644
-index 0000000..0d1d9d3
+index 0000000..b198b6d
 --- /dev/null
 +++ b/tools/gcc/Makefile
 @@ -0,0 +1,54 @@
@@ -107060,7 +106886,7 @@ index 0000000..0d1d9d3
 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu99 -ggdb
 +else
 +HOSTLIBS := hostcxxlibs
-+HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu++98 -fno-rtti -ggdb -Wno-unused-parameter
++HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu++98 -fno-rtti -ggdb -Wno-unused-parameter -Wno-narrowing
 +endif
 +
 +$(HOSTLIBS)-$(CONFIG_PAX_CONSTIFY_PLUGIN) := constify_plugin.so
@@ -109095,10 +108921,10 @@ index 0000000..dd73713
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..592b923
+index 0000000..515d689
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,325 @@
+@@ -0,0 +1,337 @@
 +/*
 + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -109127,7 +108953,7 @@ index 0000000..592b923
 +static tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201401260140",
++	.version	= "201402131900",
 +	.help		= NULL
 +};
 +
@@ -109324,7 +109150,7 @@ index 0000000..592b923
 +	return 0;
 +}
 +
-+static void start_unit_callback(void *gcc_data, void *user_data)
++static void latent_entropy_start_unit(void *gcc_data, void *user_data)
 +{
 +	tree latent_entropy_type;
 +
@@ -109411,6 +109237,16 @@ index 0000000..592b923
 +	latent_entropy_pass_info.reference_pass_name		= "optimized";
 +	latent_entropy_pass_info.ref_pass_instance_number	= 1;
 +	latent_entropy_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++	static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = {
++		{
++			.base = &latent_entropy_decl,
++			.nelt = 1,
++			.stride = sizeof(latent_entropy_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
 +	if (!plugin_default_version_check(version, &gcc_version)) {
 +		error(G_("incompatible gcc/plugin versions"));
@@ -109418,7 +109254,9 @@ index 0000000..592b923
 +	}
 +
 +	register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
-+	register_callback(plugin_name, PLUGIN_START_UNIT, &start_unit_callback, NULL);
++	register_callback(plugin_name, PLUGIN_START_UNIT, &latent_entropy_start_unit, NULL);
++	if (!in_lto_p)
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_latent_entropy);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
 +	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
@@ -109426,10 +109264,10 @@ index 0000000..592b923
 +}
 diff --git a/tools/gcc/randomize_layout_plugin.c b/tools/gcc/randomize_layout_plugin.c
 new file mode 100644
-index 0000000..fed12bf
+index 0000000..bc490ca
 --- /dev/null
 +++ b/tools/gcc/randomize_layout_plugin.c
-@@ -0,0 +1,902 @@
+@@ -0,0 +1,906 @@
 +/*
 + * Copyright 2014 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net>
 + *                   and PaX Team <pageexec@freemail.hu>
@@ -109446,6 +109284,10 @@ index 0000000..fed12bf
 +#include "gcc-common.h"
 +#include "randomize_layout_seed.h"
 +
++#if BUILDING_GCC_MAJOR < 4 || BUILDING_GCC_MINOR < 6 || (BUILDING_GCC_MINOR == 6 && BUILDING_GCC_PATCHLEVEL < 4)
++#error "The RANDSTRUCT plugin requires GCC 4.6.4 or newer."
++#endif
++
 +#define ORIG_TYPE_NAME(node) \
 +	(TYPE_NAME(TYPE_MAIN_VARIANT(node)) != NULL_TREE ? ((const unsigned char *)IDENTIFIER_POINTER(TYPE_NAME(TYPE_MAIN_VARIANT(node)))) : (const unsigned char *)"anonymous")
 +
@@ -109862,7 +109704,7 @@ index 0000000..fed12bf
 +#endif
 +}
 +
-+static void finish_decl(void *event_data, void *data)
++static void randomize_layout_finish_decl(void *event_data, void *data)
 +{
 +	tree decl = (tree)event_data;
 +	tree type;
@@ -110326,7 +110168,7 @@ index 0000000..fed12bf
 +		register_callback(plugin_name, PLUGIN_ALL_IPA_PASSES_START, check_global_variables, NULL);
 +		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &randomize_layout_bad_cast_info);
 +		register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+		register_callback(plugin_name, PLUGIN_FINISH_DECL, finish_decl, NULL);
++		register_callback(plugin_name, PLUGIN_FINISH_DECL, randomize_layout_finish_decl, NULL);
 +	}
 +	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
@@ -116341,10 +116183,10 @@ index 0000000..7b67f2b
 +selnl_msglen_65499 selnl_msglen 0 65499 NULL
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..4a637ab
+index 0000000..4aab36f
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,4040 @@
+@@ -0,0 +1,4051 @@
 +/*
 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -116369,7 +116211,7 @@ index 0000000..4a637ab
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20140128",
++	.version	= "20140213",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
@@ -116437,7 +116279,6 @@ index 0000000..4a637ab
 +};
 +
 +static tree report_size_overflow_decl;
-+static const_tree const_char_ptr_type_node;
 +
 +static tree expand(struct pointer_set_t *visited, struct cgraph_node *caller_node, tree lhs);
 +static void set_conditions(struct pointer_set_t *visited, bool *interesting_conditions, const_tree lhs);
@@ -120210,8 +120051,9 @@ index 0000000..4a637ab
 +}
 +
 +// Create the noreturn report_size_overflow() function decl.
-+static void start_unit_callback(void __unused *gcc_data, void __unused *user_data)
++static void size_overflow_start_unit(void __unused *gcc_data, void __unused *user_data)
 +{
++	tree const_char_ptr_type_node;
 +	tree fntype;
 +
 +	const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
@@ -120339,6 +120181,16 @@ index 0000000..4a637ab
 +	struct register_pass_info __unused dump_before_pass_info;
 +	struct register_pass_info __unused dump_after_pass_info;
 +	struct register_pass_info ipa_pass_info;
++	static const struct ggc_root_tab gt_ggc_r_gt_size_overflow[] = {
++		{
++			.base = &report_size_overflow_decl,
++			.nelt = 1,
++			.stride = sizeof(report_size_overflow_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
 +	insert_size_overflow_asm_pass_info.pass				= make_insert_size_overflow_asm_pass();
 +	insert_size_overflow_asm_pass_info.reference_pass_name		= "ssa";
@@ -120375,7 +120227,8 @@ index 0000000..4a637ab
 +
 +	register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
 +	if (enable) {
-+		register_callback(plugin_name, PLUGIN_START_UNIT, &start_unit_callback, NULL);
++		register_callback(plugin_name, PLUGIN_START_UNIT, &size_overflow_start_unit, NULL);
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_size_overflow);
 +		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &insert_size_overflow_asm_pass_info);
 +//		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &dump_before_pass_info);
 +		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &ipa_pass_info);
@@ -120387,10 +120240,10 @@ index 0000000..4a637ab
 +}
 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
 new file mode 100644
-index 0000000..a4f816a
+index 0000000..e684c74
 --- /dev/null
 +++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,341 @@
+@@ -0,0 +1,373 @@
 +/*
 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -120418,10 +120271,11 @@ index 0000000..a4f816a
 +static int track_frame_size = -1;
 +static const char track_function[] = "pax_track_stack";
 +static const char check_function[] = "pax_check_alloca";
++static tree track_function_decl, check_function_decl;
 +static bool init_locals;
 +
 +static struct plugin_info stackleak_plugin_info = {
-+	.version	= "201401260140",
++	.version	= "201402131920",
 +	.help		= "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
 +//			  "initialize-locals\t\tforcibly initialize all stack frames\n"
 +};
@@ -120429,29 +120283,20 @@ index 0000000..a4f816a
 +static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
 +{
 +	gimple check_alloca;
-+	tree fntype, fndecl, alloca_size;
-+
-+	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
-+	fndecl = build_fn_decl(check_function, fntype);
-+	DECL_ASSEMBLER_NAME(fndecl); // for LTO
++	tree alloca_size;
 +
 +	// insert call to void pax_check_alloca(unsigned long size)
 +	alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
-+	check_alloca = gimple_build_call(fndecl, 1, alloca_size);
++	check_alloca = gimple_build_call(check_function_decl, 1, alloca_size);
 +	gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
 +}
 +
 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
 +{
 +	gimple track_stack;
-+	tree fntype, fndecl;
-+
-+	fntype = build_function_type_list(void_type_node, NULL_TREE);
-+	fndecl = build_fn_decl(track_function, fntype);
-+	DECL_ASSEMBLER_NAME(fndecl); // for LTO
 +
 +	// insert call to void pax_track_stack(void)
-+	track_stack = gimple_build_call(fndecl, 0);
++	track_stack = gimple_build_call(track_function_decl, 0);
 +	gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
 +}
 +
@@ -120578,6 +120423,27 @@ index 0000000..a4f816a
 +	return track_frame_size >= 0;
 +}
 +
++static void stackleak_start_unit(void *gcc_data, void *user_data)
++{
++	tree fntype;
++
++	// void pax_track_stack(void)
++	fntype = build_function_type_list(void_type_node, NULL_TREE);
++	track_function_decl = build_fn_decl(track_function, fntype);
++	DECL_ASSEMBLER_NAME(track_function_decl); // for LTO
++	TREE_PUBLIC(track_function_decl) = 1;
++	DECL_EXTERNAL(track_function_decl) = 1;
++	DECL_ARTIFICIAL(track_function_decl) = 1;
++
++	// void pax_check_alloca(unsigned long)
++	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
++	check_function_decl = build_fn_decl(check_function, fntype);
++	DECL_ASSEMBLER_NAME(check_function_decl); // for LTO
++	TREE_PUBLIC(check_function_decl) = 1;
++	DECL_EXTERNAL(check_function_decl) = 1;
++	DECL_ARTIFICIAL(check_function_decl) = 1;
++}
++
 +#if BUILDING_GCC_VERSION >= 4009
 +static const struct pass_data stackleak_tree_instrument_pass_data = {
 +#else
@@ -120686,6 +120552,23 @@ index 0000000..a4f816a
 +	int i;
 +	struct register_pass_info stackleak_tree_instrument_pass_info;
 +	struct register_pass_info stackleak_final_pass_info;
++	static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
++		{
++			.base = &track_function_decl,
++			.nelt = 1,
++			.stride = sizeof(track_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		{
++			.base = &check_function_decl,
++			.nelt = 1,
++			.stride = sizeof(check_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
 +	stackleak_tree_instrument_pass_info.pass			= make_stackleak_tree_instrument_pass();
 +//	stackleak_tree_instrument_pass_info.reference_pass_name		= "tree_profile";
@@ -120727,6 +120610,8 @@ index 0000000..a4f816a
 +		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
 +	}
 +
++	register_callback(plugin_name, PLUGIN_START_UNIT, &stackleak_start_unit, NULL);
++	register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_stackleak);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
 +
diff --git a/3.2.54/4425_grsec_remove_EI_PAX.patch b/3.2.55/4425_grsec_remove_EI_PAX.patch
index cf65d90..cf65d90 100644
--- a/3.2.54/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.55/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.54/4427_force_XATTR_PAX_tmpfs.patch b/3.2.55/4427_force_XATTR_PAX_tmpfs.patch
index 8c7a533..8c7a533 100644
--- a/3.2.54/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.55/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.54/4430_grsec-remove-localversion-grsec.patch b/3.2.55/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.54/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.55/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.54/4435_grsec-mute-warnings.patch b/3.2.55/4435_grsec-mute-warnings.patch
index f099757..f099757 100644
--- a/3.2.54/4435_grsec-mute-warnings.patch
+++ b/3.2.55/4435_grsec-mute-warnings.patch
diff --git a/3.2.54/4440_grsec-remove-protected-paths.patch b/3.2.55/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.54/4440_grsec-remove-protected-paths.patch
+++ b/3.2.55/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.54/4450_grsec-kconfig-default-gids.patch b/3.2.55/4450_grsec-kconfig-default-gids.patch
index 4f345d6..4f345d6 100644
--- a/3.2.54/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.55/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.54/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.55/4465_selinux-avc_audit-log-curr_ip.patch
index 0545d51..0545d51 100644
--- a/3.2.54/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.55/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.54/4470_disable-compat_vdso.patch b/3.2.55/4470_disable-compat_vdso.patch
index f6eb9f7..f6eb9f7 100644
--- a/3.2.54/4470_disable-compat_vdso.patch
+++ b/3.2.55/4470_disable-compat_vdso.patch
diff --git a/3.2.54/4475_emutramp_default_on.patch b/3.2.55/4475_emutramp_default_on.patch
index cfde6f8..cfde6f8 100644
--- a/3.2.54/4475_emutramp_default_on.patch
+++ b/3.2.55/4475_emutramp_default_on.patch